if_urtwn.c revision 297601
1321936Shselasky/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2321936Shselasky
3321936Shselasky/*-
4321936Shselasky * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5321936Shselasky * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6321936Shselasky * Copyright (c) 2015 Andriy Voskoboinyk <avos@FreeBSD.org>
7321936Shselasky *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/dev/urtwn/if_urtwn.c 297601 2016-04-06 00:52:30Z adrian $");
23
24/*
25 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
26 */
27
28#include "opt_wlan.h"
29#include "opt_urtwn.h"
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/lock.h>
35#include <sys/mutex.h>
36#include <sys/condvar.h>
37#include <sys/mbuf.h>
38#include <sys/kernel.h>
39#include <sys/socket.h>
40#include <sys/systm.h>
41#include <sys/malloc.h>
42#include <sys/module.h>
43#include <sys/bus.h>
44#include <sys/endian.h>
45#include <sys/linker.h>
46#include <sys/firmware.h>
47#include <sys/kdb.h>
48
49#include <machine/bus.h>
50#include <machine/resource.h>
51#include <sys/rman.h>
52
53#include <net/bpf.h>
54#include <net/if.h>
55#include <net/if_var.h>
56#include <net/if_arp.h>
57#include <net/ethernet.h>
58#include <net/if_dl.h>
59#include <net/if_media.h>
60#include <net/if_types.h>
61
62#include <netinet/in.h>
63#include <netinet/in_systm.h>
64#include <netinet/in_var.h>
65#include <netinet/if_ether.h>
66#include <netinet/ip.h>
67
68#include <net80211/ieee80211_var.h>
69#include <net80211/ieee80211_input.h>
70#include <net80211/ieee80211_regdomain.h>
71#include <net80211/ieee80211_radiotap.h>
72#include <net80211/ieee80211_ratectl.h>
73#ifdef	IEEE80211_SUPPORT_SUPERG
74#include <net80211/ieee80211_superg.h>
75#endif
76
77#include <dev/usb/usb.h>
78#include <dev/usb/usbdi.h>
79#include <dev/usb/usb_device.h>
80#include "usbdevs.h"
81
82#include <dev/usb/usb_debug.h>
83
84#include <dev/urtwn/if_urtwnreg.h>
85#include <dev/urtwn/if_urtwnvar.h>
86
87#ifdef USB_DEBUG
88enum {
89	URTWN_DEBUG_XMIT	= 0x00000001,	/* basic xmit operation */
90	URTWN_DEBUG_RECV	= 0x00000002,	/* basic recv operation */
91	URTWN_DEBUG_STATE	= 0x00000004,	/* 802.11 state transitions */
92	URTWN_DEBUG_RA		= 0x00000008,	/* f/w rate adaptation setup */
93	URTWN_DEBUG_USB		= 0x00000010,	/* usb requests */
94	URTWN_DEBUG_FIRMWARE	= 0x00000020,	/* firmware(9) loading debug */
95	URTWN_DEBUG_BEACON	= 0x00000040,	/* beacon handling */
96	URTWN_DEBUG_INTR	= 0x00000080,	/* ISR */
97	URTWN_DEBUG_TEMP	= 0x00000100,	/* temperature calibration */
98	URTWN_DEBUG_ROM		= 0x00000200,	/* various ROM info */
99	URTWN_DEBUG_KEY		= 0x00000400,	/* crypto keys management */
100	URTWN_DEBUG_TXPWR	= 0x00000800,	/* dump Tx power values */
101	URTWN_DEBUG_RSSI	= 0x00001000,	/* dump RSSI lookups */
102	URTWN_DEBUG_ANY		= 0xffffffff
103};
104
105#define URTWN_DPRINTF(_sc, _m, ...) do {			\
106	if ((_sc)->sc_debug & (_m))				\
107		device_printf((_sc)->sc_dev, __VA_ARGS__);	\
108} while(0)
109
110#else
111#define URTWN_DPRINTF(_sc, _m, ...)	do { (void) sc; } while (0)
112#endif
113
114#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
115
116static int urtwn_enable_11n = 1;
117TUNABLE_INT("hw.usb.urtwn.enable_11n", &urtwn_enable_11n);
118
119/* various supported device vendors/products */
120static const STRUCT_USB_HOST_ID urtwn_devs[] = {
121#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
122#define	URTWN_RTL8188E_DEV(v,p)	\
123	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
124#define URTWN_RTL8188E  1
125	URTWN_DEV(ABOCOM,	RTL8188CU_1),
126	URTWN_DEV(ABOCOM,	RTL8188CU_2),
127	URTWN_DEV(ABOCOM,	RTL8192CU),
128	URTWN_DEV(ASUS,		RTL8192CU),
129	URTWN_DEV(ASUS,		USBN10NANO),
130	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
131	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
132	URTWN_DEV(AZUREWAVE,	RTL8188CU),
133	URTWN_DEV(BELKIN,	F7D2102),
134	URTWN_DEV(BELKIN,	RTL8188CU),
135	URTWN_DEV(BELKIN,	RTL8192CU),
136	URTWN_DEV(CHICONY,	RTL8188CUS_1),
137	URTWN_DEV(CHICONY,	RTL8188CUS_2),
138	URTWN_DEV(CHICONY,	RTL8188CUS_3),
139	URTWN_DEV(CHICONY,	RTL8188CUS_4),
140	URTWN_DEV(CHICONY,	RTL8188CUS_5),
141	URTWN_DEV(COREGA,	RTL8192CU),
142	URTWN_DEV(DLINK,	RTL8188CU),
143	URTWN_DEV(DLINK,	RTL8192CU_1),
144	URTWN_DEV(DLINK,	RTL8192CU_2),
145	URTWN_DEV(DLINK,	RTL8192CU_3),
146	URTWN_DEV(DLINK,	DWA131B),
147	URTWN_DEV(EDIMAX,	EW7811UN),
148	URTWN_DEV(EDIMAX,	RTL8192CU),
149	URTWN_DEV(FEIXUN,	RTL8188CU),
150	URTWN_DEV(FEIXUN,	RTL8192CU),
151	URTWN_DEV(GUILLEMOT,	HWNUP150),
152	URTWN_DEV(HAWKING,	RTL8192CU),
153	URTWN_DEV(HP3,		RTL8188CU),
154	URTWN_DEV(NETGEAR,	WNA1000M),
155	URTWN_DEV(NETGEAR,	RTL8192CU),
156	URTWN_DEV(NETGEAR4,	RTL8188CU),
157	URTWN_DEV(NOVATECH,	RTL8188CU),
158	URTWN_DEV(PLANEX2,	RTL8188CU_1),
159	URTWN_DEV(PLANEX2,	RTL8188CU_2),
160	URTWN_DEV(PLANEX2,	RTL8188CU_3),
161	URTWN_DEV(PLANEX2,	RTL8188CU_4),
162	URTWN_DEV(PLANEX2,	RTL8188CUS),
163	URTWN_DEV(PLANEX2,	RTL8192CU),
164	URTWN_DEV(REALTEK,	RTL8188CE_0),
165	URTWN_DEV(REALTEK,	RTL8188CE_1),
166	URTWN_DEV(REALTEK,	RTL8188CTV),
167	URTWN_DEV(REALTEK,	RTL8188CU_0),
168	URTWN_DEV(REALTEK,	RTL8188CU_1),
169	URTWN_DEV(REALTEK,	RTL8188CU_2),
170	URTWN_DEV(REALTEK,	RTL8188CU_3),
171	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
172	URTWN_DEV(REALTEK,	RTL8188CUS),
173	URTWN_DEV(REALTEK,	RTL8188RU_1),
174	URTWN_DEV(REALTEK,	RTL8188RU_2),
175	URTWN_DEV(REALTEK,	RTL8188RU_3),
176	URTWN_DEV(REALTEK,	RTL8191CU),
177	URTWN_DEV(REALTEK,	RTL8192CE),
178	URTWN_DEV(REALTEK,	RTL8192CU),
179	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
180	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
181	URTWN_DEV(SITECOMEU,	RTL8192CU),
182	URTWN_DEV(TRENDNET,	RTL8188CU),
183	URTWN_DEV(TRENDNET,	RTL8192CU),
184	URTWN_DEV(ZYXEL,	RTL8192CU),
185	/* URTWN_RTL8188E */
186	URTWN_RTL8188E_DEV(ABOCOM,	RTL8188EU),
187	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
188	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
189	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
190	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
191	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
192#undef URTWN_RTL8188E_DEV
193#undef URTWN_DEV
194};
195
196static device_probe_t	urtwn_match;
197static device_attach_t	urtwn_attach;
198static device_detach_t	urtwn_detach;
199
200static usb_callback_t   urtwn_bulk_tx_callback;
201static usb_callback_t	urtwn_bulk_rx_callback;
202
203static void		urtwn_sysctlattach(struct urtwn_softc *);
204static void		urtwn_drain_mbufq(struct urtwn_softc *);
205static usb_error_t	urtwn_do_request(struct urtwn_softc *,
206			    struct usb_device_request *, void *);
207static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
208		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
209                    const uint8_t [IEEE80211_ADDR_LEN],
210                    const uint8_t [IEEE80211_ADDR_LEN]);
211static void		urtwn_vap_delete(struct ieee80211vap *);
212static struct mbuf *	urtwn_rx_copy_to_mbuf(struct urtwn_softc *,
213			    struct r92c_rx_stat *, int);
214static struct mbuf *	urtwn_report_intr(struct usb_xfer *,
215			    struct urtwn_data *);
216static struct mbuf *	urtwn_rxeof(struct urtwn_softc *, uint8_t *, int);
217static void		urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
218			    void *);
219static struct ieee80211_node *urtwn_rx_frame(struct urtwn_softc *,
220			    struct mbuf *, int8_t *);
221static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
222			    int);
223static int		urtwn_alloc_list(struct urtwn_softc *,
224			    struct urtwn_data[], int, int);
225static int		urtwn_alloc_rx_list(struct urtwn_softc *);
226static int		urtwn_alloc_tx_list(struct urtwn_softc *);
227static void		urtwn_free_list(struct urtwn_softc *,
228			    struct urtwn_data data[], int);
229static void		urtwn_free_rx_list(struct urtwn_softc *);
230static void		urtwn_free_tx_list(struct urtwn_softc *);
231static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
232static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
233static usb_error_t	urtwn_write_region_1(struct urtwn_softc *, uint16_t,
234			    uint8_t *, int);
235static usb_error_t	urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
236static usb_error_t	urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
237static usb_error_t	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
238static usb_error_t	urtwn_read_region_1(struct urtwn_softc *, uint16_t,
239			    uint8_t *, int);
240static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
241static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
242static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
243static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
244			    const void *, int);
245static void		urtwn_cmdq_cb(void *, int);
246static int		urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
247			    size_t, CMD_FUNC_PROTO);
248static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
249			    uint8_t, uint32_t);
250static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
251			    uint8_t, uint32_t);
252static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
253static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
254			    uint32_t);
255static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
256static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
257			    uint8_t, uint8_t);
258#ifdef USB_DEBUG
259static void		urtwn_dump_rom_contents(struct urtwn_softc *,
260			    uint8_t *, uint16_t);
261#endif
262static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
263			    uint16_t);
264static int		urtwn_efuse_switch_power(struct urtwn_softc *);
265static int		urtwn_read_chipid(struct urtwn_softc *);
266static int		urtwn_read_rom(struct urtwn_softc *);
267static int		urtwn_r88e_read_rom(struct urtwn_softc *);
268static int		urtwn_ra_init(struct urtwn_softc *);
269static void		urtwn_init_beacon(struct urtwn_softc *,
270			    struct urtwn_vap *);
271static int		urtwn_setup_beacon(struct urtwn_softc *,
272			    struct ieee80211_node *);
273static void		urtwn_update_beacon(struct ieee80211vap *, int);
274static int		urtwn_tx_beacon(struct urtwn_softc *sc,
275			    struct urtwn_vap *);
276static int		urtwn_key_alloc(struct ieee80211vap *,
277			    struct ieee80211_key *, ieee80211_keyix *,
278			    ieee80211_keyix *);
279static void		urtwn_key_set_cb(struct urtwn_softc *,
280			    union sec_param *);
281static void		urtwn_key_del_cb(struct urtwn_softc *,
282			    union sec_param *);
283static int		urtwn_key_set(struct ieee80211vap *,
284			    const struct ieee80211_key *);
285static int		urtwn_key_delete(struct ieee80211vap *,
286			    const struct ieee80211_key *);
287static void		urtwn_tsf_task_adhoc(void *, int);
288static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
289			    struct ieee80211vap *);
290static void		urtwn_get_tsf(struct urtwn_softc *, uint64_t *);
291static void		urtwn_set_led(struct urtwn_softc *, int, int);
292static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
293static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
294			    struct mbuf *, int,
295			    const struct ieee80211_rx_stats *, int, int);
296static int		urtwn_newstate(struct ieee80211vap *,
297			    enum ieee80211_state, int);
298static void		urtwn_calib_to(void *);
299static void		urtwn_calib_cb(struct urtwn_softc *,
300			    union sec_param *);
301static void		urtwn_watchdog(void *);
302static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
303static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
304static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
305static int		urtwn_tx_data(struct urtwn_softc *,
306			    struct ieee80211_node *, struct mbuf *,
307			    struct urtwn_data *);
308static int		urtwn_tx_raw(struct urtwn_softc *,
309			    struct ieee80211_node *, struct mbuf *,
310			    struct urtwn_data *,
311			    const struct ieee80211_bpf_params *);
312static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
313			    uint8_t, struct urtwn_data *);
314static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
315static void		urtwn_start(struct urtwn_softc *);
316static void		urtwn_parent(struct ieee80211com *);
317static int		urtwn_r92c_power_on(struct urtwn_softc *);
318static int		urtwn_r88e_power_on(struct urtwn_softc *);
319static void		urtwn_r92c_power_off(struct urtwn_softc *);
320static void		urtwn_r88e_power_off(struct urtwn_softc *);
321static int		urtwn_llt_init(struct urtwn_softc *);
322#ifndef URTWN_WITHOUT_UCODE
323static void		urtwn_fw_reset(struct urtwn_softc *);
324static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
325static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
326			    const uint8_t *, int);
327static int		urtwn_load_firmware(struct urtwn_softc *);
328#endif
329static int		urtwn_dma_init(struct urtwn_softc *);
330static int		urtwn_mac_init(struct urtwn_softc *);
331static void		urtwn_bb_init(struct urtwn_softc *);
332static void		urtwn_rf_init(struct urtwn_softc *);
333static void		urtwn_cam_init(struct urtwn_softc *);
334static int		urtwn_cam_write(struct urtwn_softc *, uint32_t,
335			    uint32_t);
336static void		urtwn_pa_bias_init(struct urtwn_softc *);
337static void		urtwn_rxfilter_init(struct urtwn_softc *);
338static void		urtwn_edca_init(struct urtwn_softc *);
339static void		urtwn_write_txpower(struct urtwn_softc *, int,
340			    uint16_t[]);
341static void		urtwn_get_txpower(struct urtwn_softc *, int,
342		      	    struct ieee80211_channel *,
343			    struct ieee80211_channel *, uint16_t[]);
344static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
345		      	    struct ieee80211_channel *,
346			    struct ieee80211_channel *, uint16_t[]);
347static void		urtwn_set_txpower(struct urtwn_softc *,
348		    	    struct ieee80211_channel *,
349			    struct ieee80211_channel *);
350static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
351static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
352static void		urtwn_scan_start(struct ieee80211com *);
353static void		urtwn_scan_end(struct ieee80211com *);
354static void		urtwn_set_channel(struct ieee80211com *);
355static int		urtwn_wme_update(struct ieee80211com *);
356static void		urtwn_update_slot(struct ieee80211com *);
357static void		urtwn_update_slot_cb(struct urtwn_softc *,
358			    union sec_param *);
359static void		urtwn_update_aifs(struct urtwn_softc *, uint8_t);
360static void		urtwn_set_promisc(struct urtwn_softc *);
361static void		urtwn_update_promisc(struct ieee80211com *);
362static void		urtwn_update_mcast(struct ieee80211com *);
363static struct ieee80211_node *urtwn_r88e_node_alloc(struct ieee80211vap *,
364			    const uint8_t mac[IEEE80211_ADDR_LEN]);
365static void		urtwn_r88e_newassoc(struct ieee80211_node *, int);
366static void		urtwn_r88e_node_free(struct ieee80211_node *);
367static void		urtwn_set_chan(struct urtwn_softc *,
368		    	    struct ieee80211_channel *,
369			    struct ieee80211_channel *);
370static void		urtwn_iq_calib(struct urtwn_softc *);
371static void		urtwn_lc_calib(struct urtwn_softc *);
372static void		urtwn_temp_calib(struct urtwn_softc *);
373static int		urtwn_init(struct urtwn_softc *);
374static void		urtwn_stop(struct urtwn_softc *);
375static void		urtwn_abort_xfers(struct urtwn_softc *);
376static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
377			    const struct ieee80211_bpf_params *);
378static void		urtwn_ms_delay(struct urtwn_softc *);
379
380/* Aliases. */
381#define	urtwn_bb_write	urtwn_write_4
382#define urtwn_bb_read	urtwn_read_4
383
384static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
385	[URTWN_BULK_RX] = {
386		.type = UE_BULK,
387		.endpoint = UE_ADDR_ANY,
388		.direction = UE_DIR_IN,
389		.bufsize = URTWN_RXBUFSZ,
390		.flags = {
391			.pipe_bof = 1,
392			.short_xfer_ok = 1
393		},
394		.callback = urtwn_bulk_rx_callback,
395	},
396	[URTWN_BULK_TX_BE] = {
397		.type = UE_BULK,
398		.endpoint = 0x03,
399		.direction = UE_DIR_OUT,
400		.bufsize = URTWN_TXBUFSZ,
401		.flags = {
402			.ext_buffer = 1,
403			.pipe_bof = 1,
404			.force_short_xfer = 1
405		},
406		.callback = urtwn_bulk_tx_callback,
407		.timeout = URTWN_TX_TIMEOUT,	/* ms */
408	},
409	[URTWN_BULK_TX_BK] = {
410		.type = UE_BULK,
411		.endpoint = 0x03,
412		.direction = UE_DIR_OUT,
413		.bufsize = URTWN_TXBUFSZ,
414		.flags = {
415			.ext_buffer = 1,
416			.pipe_bof = 1,
417			.force_short_xfer = 1,
418		},
419		.callback = urtwn_bulk_tx_callback,
420		.timeout = URTWN_TX_TIMEOUT,	/* ms */
421	},
422	[URTWN_BULK_TX_VI] = {
423		.type = UE_BULK,
424		.endpoint = 0x02,
425		.direction = UE_DIR_OUT,
426		.bufsize = URTWN_TXBUFSZ,
427		.flags = {
428			.ext_buffer = 1,
429			.pipe_bof = 1,
430			.force_short_xfer = 1
431		},
432		.callback = urtwn_bulk_tx_callback,
433		.timeout = URTWN_TX_TIMEOUT,	/* ms */
434	},
435	[URTWN_BULK_TX_VO] = {
436		.type = UE_BULK,
437		.endpoint = 0x02,
438		.direction = UE_DIR_OUT,
439		.bufsize = URTWN_TXBUFSZ,
440		.flags = {
441			.ext_buffer = 1,
442			.pipe_bof = 1,
443			.force_short_xfer = 1
444		},
445		.callback = urtwn_bulk_tx_callback,
446		.timeout = URTWN_TX_TIMEOUT,	/* ms */
447	},
448};
449
450static const struct wme_to_queue {
451	uint16_t reg;
452	uint8_t qid;
453} wme2queue[WME_NUM_AC] = {
454	{ R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
455	{ R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
456	{ R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
457	{ R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
458};
459
460static int
461urtwn_match(device_t self)
462{
463	struct usb_attach_arg *uaa = device_get_ivars(self);
464
465	if (uaa->usb_mode != USB_MODE_HOST)
466		return (ENXIO);
467	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
468		return (ENXIO);
469	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
470		return (ENXIO);
471
472	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
473}
474
475static void
476urtwn_update_chw(struct ieee80211com *ic)
477{
478}
479
480static int
481urtwn_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
482{
483
484	/* We're driving this ourselves (eventually); don't involve net80211 */
485	return (0);
486}
487
488static int
489urtwn_attach(device_t self)
490{
491	struct usb_attach_arg *uaa = device_get_ivars(self);
492	struct urtwn_softc *sc = device_get_softc(self);
493	struct ieee80211com *ic = &sc->sc_ic;
494	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
495	int error;
496
497	device_set_usb_desc(self);
498	sc->sc_udev = uaa->device;
499	sc->sc_dev = self;
500	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
501		sc->chip |= URTWN_CHIP_88E;
502
503#ifdef USB_DEBUG
504	int debug;
505	if (resource_int_value(device_get_name(sc->sc_dev),
506	    device_get_unit(sc->sc_dev), "debug", &debug) == 0)
507		sc->sc_debug = debug;
508#endif
509
510	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
511	    MTX_NETWORK_LOCK, MTX_DEF);
512	URTWN_CMDQ_LOCK_INIT(sc);
513	URTWN_NT_LOCK_INIT(sc);
514	callout_init(&sc->sc_calib_to, 0);
515	callout_init(&sc->sc_watchdog_ch, 0);
516	mbufq_init(&sc->sc_snd, ifqmaxlen);
517
518	sc->sc_iface_index = URTWN_IFACE_INDEX;
519	error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
520	    sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
521	if (error) {
522		device_printf(self, "could not allocate USB transfers, "
523		    "err=%s\n", usbd_errstr(error));
524		goto detach;
525	}
526
527	URTWN_LOCK(sc);
528
529	error = urtwn_read_chipid(sc);
530	if (error) {
531		device_printf(sc->sc_dev, "unsupported test chip\n");
532		URTWN_UNLOCK(sc);
533		goto detach;
534	}
535
536	/* Determine number of Tx/Rx chains. */
537	if (sc->chip & URTWN_CHIP_92C) {
538		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
539		sc->nrxchains = 2;
540	} else {
541		sc->ntxchains = 1;
542		sc->nrxchains = 1;
543	}
544
545	if (sc->chip & URTWN_CHIP_88E)
546		error = urtwn_r88e_read_rom(sc);
547	else
548		error = urtwn_read_rom(sc);
549	if (error != 0) {
550		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
551		    __func__, error);
552		URTWN_UNLOCK(sc);
553		goto detach;
554	}
555
556	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
557	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
558	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
559	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
560	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
561	    "8188CUS", sc->ntxchains, sc->nrxchains);
562
563	URTWN_UNLOCK(sc);
564
565	ic->ic_softc = sc;
566	ic->ic_name = device_get_nameunit(self);
567	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
568	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
569
570	/* set device capabilities */
571	ic->ic_caps =
572		  IEEE80211_C_STA		/* station mode */
573		| IEEE80211_C_MONITOR		/* monitor mode */
574		| IEEE80211_C_IBSS		/* adhoc mode */
575		| IEEE80211_C_HOSTAP		/* hostap mode */
576		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
577		| IEEE80211_C_SHSLOT		/* short slot time supported */
578#if 0
579		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
580#endif
581		| IEEE80211_C_WPA		/* 802.11i */
582		| IEEE80211_C_WME		/* 802.11e */
583		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
584		| IEEE80211_C_FF		/* Atheros fast-frames */
585		;
586
587	ic->ic_cryptocaps =
588	    IEEE80211_CRYPTO_WEP |
589	    IEEE80211_CRYPTO_TKIP |
590	    IEEE80211_CRYPTO_AES_CCM;
591
592	/* Assume they're all 11n capable for now */
593	if (urtwn_enable_11n) {
594		device_printf(self, "enabling 11n\n");
595		ic->ic_htcaps = IEEE80211_HTC_HT |
596#if 0
597		    IEEE80211_HTC_AMPDU |
598#endif
599		    IEEE80211_HTC_AMSDU |
600		    IEEE80211_HTCAP_MAXAMSDU_3839 |
601		    IEEE80211_HTCAP_SMPS_OFF;
602		/* no HT40 just yet */
603		// ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
604
605		/* XXX TODO: verify chains versus streams for urtwn */
606		ic->ic_txstream = sc->ntxchains;
607		ic->ic_rxstream = sc->nrxchains;
608	}
609
610	memset(bands, 0, sizeof(bands));
611	setbit(bands, IEEE80211_MODE_11B);
612	setbit(bands, IEEE80211_MODE_11G);
613	if (urtwn_enable_11n)
614		setbit(bands, IEEE80211_MODE_11NG);
615	ieee80211_init_channels(ic, NULL, bands);
616
617	ieee80211_ifattach(ic);
618	ic->ic_raw_xmit = urtwn_raw_xmit;
619	ic->ic_scan_start = urtwn_scan_start;
620	ic->ic_scan_end = urtwn_scan_end;
621	ic->ic_set_channel = urtwn_set_channel;
622	ic->ic_transmit = urtwn_transmit;
623	ic->ic_parent = urtwn_parent;
624	ic->ic_vap_create = urtwn_vap_create;
625	ic->ic_vap_delete = urtwn_vap_delete;
626	ic->ic_wme.wme_update = urtwn_wme_update;
627	ic->ic_updateslot = urtwn_update_slot;
628	ic->ic_update_promisc = urtwn_update_promisc;
629	ic->ic_update_mcast = urtwn_update_mcast;
630	if (sc->chip & URTWN_CHIP_88E) {
631		ic->ic_node_alloc = urtwn_r88e_node_alloc;
632		ic->ic_newassoc = urtwn_r88e_newassoc;
633		sc->sc_node_free = ic->ic_node_free;
634		ic->ic_node_free = urtwn_r88e_node_free;
635	}
636	ic->ic_update_chw = urtwn_update_chw;
637	ic->ic_ampdu_enable = urtwn_ampdu_enable;
638
639	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
640	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
641	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
642	    URTWN_RX_RADIOTAP_PRESENT);
643
644	TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
645
646	urtwn_sysctlattach(sc);
647
648	if (bootverbose)
649		ieee80211_announce(ic);
650
651	return (0);
652
653detach:
654	urtwn_detach(self);
655	return (ENXIO);			/* failure */
656}
657
658static void
659urtwn_sysctlattach(struct urtwn_softc *sc)
660{
661#ifdef USB_DEBUG
662	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
663	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
664
665	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
666	    "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
667	    "control debugging printfs");
668#endif
669}
670
671static int
672urtwn_detach(device_t self)
673{
674	struct urtwn_softc *sc = device_get_softc(self);
675	struct ieee80211com *ic = &sc->sc_ic;
676	unsigned int x;
677
678	/* Prevent further ioctls. */
679	URTWN_LOCK(sc);
680	sc->sc_flags |= URTWN_DETACHED;
681	URTWN_UNLOCK(sc);
682
683	urtwn_stop(sc);
684
685	callout_drain(&sc->sc_watchdog_ch);
686	callout_drain(&sc->sc_calib_to);
687
688	/* stop all USB transfers */
689	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
690
691	/* Prevent further allocations from RX/TX data lists. */
692	URTWN_LOCK(sc);
693	STAILQ_INIT(&sc->sc_tx_active);
694	STAILQ_INIT(&sc->sc_tx_inactive);
695	STAILQ_INIT(&sc->sc_tx_pending);
696
697	STAILQ_INIT(&sc->sc_rx_active);
698	STAILQ_INIT(&sc->sc_rx_inactive);
699	URTWN_UNLOCK(sc);
700
701	/* drain USB transfers */
702	for (x = 0; x != URTWN_N_TRANSFER; x++)
703		usbd_transfer_drain(sc->sc_xfer[x]);
704
705	/* Free data buffers. */
706	URTWN_LOCK(sc);
707	urtwn_free_tx_list(sc);
708	urtwn_free_rx_list(sc);
709	URTWN_UNLOCK(sc);
710
711	if (ic->ic_softc == sc) {
712		ieee80211_draintask(ic, &sc->cmdq_task);
713		ieee80211_ifdetach(ic);
714	}
715
716	URTWN_NT_LOCK_DESTROY(sc);
717	URTWN_CMDQ_LOCK_DESTROY(sc);
718	mtx_destroy(&sc->sc_mtx);
719
720	return (0);
721}
722
723static void
724urtwn_drain_mbufq(struct urtwn_softc *sc)
725{
726	struct mbuf *m;
727	struct ieee80211_node *ni;
728	URTWN_ASSERT_LOCKED(sc);
729	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
730		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
731		m->m_pkthdr.rcvif = NULL;
732		ieee80211_free_node(ni);
733		m_freem(m);
734	}
735}
736
737static usb_error_t
738urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
739    void *data)
740{
741	usb_error_t err;
742	int ntries = 10;
743
744	URTWN_ASSERT_LOCKED(sc);
745
746	while (ntries--) {
747		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
748		    req, data, 0, NULL, 250 /* ms */);
749		if (err == 0)
750			break;
751
752		URTWN_DPRINTF(sc, URTWN_DEBUG_USB,
753		    "%s: control request failed, %s (retries left: %d)\n",
754		    __func__, usbd_errstr(err), ntries);
755		usb_pause_mtx(&sc->sc_mtx, hz / 100);
756	}
757	return (err);
758}
759
760static struct ieee80211vap *
761urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
762    enum ieee80211_opmode opmode, int flags,
763    const uint8_t bssid[IEEE80211_ADDR_LEN],
764    const uint8_t mac[IEEE80211_ADDR_LEN])
765{
766	struct urtwn_softc *sc = ic->ic_softc;
767	struct urtwn_vap *uvp;
768	struct ieee80211vap *vap;
769
770	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
771		return (NULL);
772
773	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
774	vap = &uvp->vap;
775	/* enable s/w bmiss handling for sta mode */
776
777	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
778	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
779		/* out of memory */
780		free(uvp, M_80211_VAP);
781		return (NULL);
782	}
783
784	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
785		urtwn_init_beacon(sc, uvp);
786
787	/* override state transition machine */
788	uvp->newstate = vap->iv_newstate;
789	vap->iv_newstate = urtwn_newstate;
790	vap->iv_update_beacon = urtwn_update_beacon;
791	vap->iv_key_alloc = urtwn_key_alloc;
792	vap->iv_key_set = urtwn_key_set;
793	vap->iv_key_delete = urtwn_key_delete;
794	if (opmode == IEEE80211_M_IBSS) {
795		uvp->recv_mgmt = vap->iv_recv_mgmt;
796		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
797		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
798	}
799
800	if (URTWN_CHIP_HAS_RATECTL(sc))
801		ieee80211_ratectl_init(vap);
802	/* complete setup */
803	ieee80211_vap_attach(vap, ieee80211_media_change,
804	    ieee80211_media_status, mac);
805	ic->ic_opmode = opmode;
806	return (vap);
807}
808
809static void
810urtwn_vap_delete(struct ieee80211vap *vap)
811{
812	struct ieee80211com *ic = vap->iv_ic;
813	struct urtwn_softc *sc = ic->ic_softc;
814	struct urtwn_vap *uvp = URTWN_VAP(vap);
815
816	if (uvp->bcn_mbuf != NULL)
817		m_freem(uvp->bcn_mbuf);
818	if (vap->iv_opmode == IEEE80211_M_IBSS)
819		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
820	if (URTWN_CHIP_HAS_RATECTL(sc))
821		ieee80211_ratectl_deinit(vap);
822	ieee80211_vap_detach(vap);
823	free(uvp, M_80211_VAP);
824}
825
826static struct mbuf *
827urtwn_rx_copy_to_mbuf(struct urtwn_softc *sc, struct r92c_rx_stat *stat,
828    int totlen)
829{
830	struct ieee80211com *ic = &sc->sc_ic;
831	struct mbuf *m;
832	uint32_t rxdw0;
833	int pktlen;
834
835	/*
836	 * don't pass packets to the ieee80211 framework if the driver isn't
837	 * RUNNING.
838	 */
839	if (!(sc->sc_flags & URTWN_RUNNING))
840		return (NULL);
841
842	rxdw0 = le32toh(stat->rxdw0);
843	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
844		/*
845		 * This should not happen since we setup our Rx filter
846		 * to not receive these frames.
847		 */
848		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
849		    "%s: RX flags error (%s)\n", __func__,
850		    rxdw0 & R92C_RXDW0_CRCERR ? "CRC" : "ICV");
851		goto fail;
852	}
853
854	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
855	if (pktlen < sizeof(struct ieee80211_frame_ack)) {
856		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
857		    "%s: frame is too short: %d\n", __func__, pktlen);
858		goto fail;
859	}
860
861	if (__predict_false(totlen > MCLBYTES)) {
862		/* convert to m_getjcl if this happens */
863		device_printf(sc->sc_dev, "%s: frame too long: %d (%d)\n",
864		    __func__, pktlen, totlen);
865		goto fail;
866	}
867
868	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
869	if (__predict_false(m == NULL)) {
870		device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
871		    __func__);
872		goto fail;
873	}
874
875	/* Finalize mbuf. */
876	memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
877	m->m_pkthdr.len = m->m_len = totlen;
878
879	return (m);
880fail:
881	counter_u64_add(ic->ic_ierrors, 1);
882	return (NULL);
883}
884
885static struct mbuf *
886urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data)
887{
888	struct urtwn_softc *sc = data->sc;
889	struct ieee80211com *ic = &sc->sc_ic;
890	struct r92c_rx_stat *stat;
891	uint8_t *buf;
892	int len;
893
894	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
895
896	if (len < sizeof(*stat)) {
897		counter_u64_add(ic->ic_ierrors, 1);
898		return (NULL);
899	}
900
901	buf = data->buf;
902	stat = (struct r92c_rx_stat *)buf;
903
904	/*
905	 * For 88E chips we can tie the FF flushing here;
906	 * this is where we do know exactly how deep the
907	 * transmit queue is.
908	 *
909	 * But it won't work for R92 chips, so we can't
910	 * take the easy way out.
911	 */
912
913	if (sc->chip & URTWN_CHIP_88E) {
914		int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
915
916		switch (report_sel) {
917		case R88E_RXDW3_RPT_RX:
918			return (urtwn_rxeof(sc, buf, len));
919		case R88E_RXDW3_RPT_TX1:
920			urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
921			break;
922		default:
923			URTWN_DPRINTF(sc, URTWN_DEBUG_INTR,
924			    "%s: case %d was not handled\n", __func__,
925			    report_sel);
926			break;
927		}
928	} else
929		return (urtwn_rxeof(sc, buf, len));
930
931	return (NULL);
932}
933
934static struct mbuf *
935urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len)
936{
937	struct r92c_rx_stat *stat;
938	struct mbuf *m, *m0 = NULL, *prevm = NULL;
939	uint32_t rxdw0;
940	int totlen, pktlen, infosz, npkts;
941
942	/* Get the number of encapsulated frames. */
943	stat = (struct r92c_rx_stat *)buf;
944	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
945	URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
946	    "%s: Rx %d frames in one chunk\n", __func__, npkts);
947
948	/* Process all of them. */
949	while (npkts-- > 0) {
950		if (len < sizeof(*stat))
951			break;
952		stat = (struct r92c_rx_stat *)buf;
953		rxdw0 = le32toh(stat->rxdw0);
954
955		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
956		if (pktlen == 0)
957			break;
958
959		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
960
961		/* Make sure everything fits in xfer. */
962		totlen = sizeof(*stat) + infosz + pktlen;
963		if (totlen > len)
964			break;
965
966		m = urtwn_rx_copy_to_mbuf(sc, stat, totlen);
967		if (m0 == NULL)
968			m0 = m;
969		if (prevm == NULL)
970			prevm = m;
971		else {
972			prevm->m_next = m;
973			prevm = m;
974		}
975
976		/* Next chunk is 128-byte aligned. */
977		totlen = (totlen + 127) & ~127;
978		buf += totlen;
979		len -= totlen;
980	}
981
982	return (m0);
983}
984
985static void
986urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
987{
988	struct r88e_tx_rpt_ccx *rpt = arg;
989	struct ieee80211vap *vap;
990	struct ieee80211_node *ni;
991	uint8_t macid;
992	int ntries;
993
994	macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
995	ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
996
997	URTWN_NT_LOCK(sc);
998	ni = sc->node_list[macid];
999	if (ni != NULL) {
1000		vap = ni->ni_vap;
1001		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: frame for macid %d was"
1002		    "%s sent (%d retries)\n", __func__, macid,
1003		    (rpt->rptb1 & R88E_RPTB1_PKT_OK) ? "" : " not",
1004		    ntries);
1005
1006		if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
1007			ieee80211_ratectl_tx_complete(vap, ni,
1008			    IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
1009		} else {
1010			ieee80211_ratectl_tx_complete(vap, ni,
1011			    IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
1012		}
1013	} else {
1014		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: macid %d, ni is NULL\n",
1015		    __func__, macid);
1016	}
1017	URTWN_NT_UNLOCK(sc);
1018}
1019
1020static struct ieee80211_node *
1021urtwn_rx_frame(struct urtwn_softc *sc, struct mbuf *m, int8_t *rssi_p)
1022{
1023	struct ieee80211com *ic = &sc->sc_ic;
1024	struct ieee80211_frame_min *wh;
1025	struct r92c_rx_stat *stat;
1026	uint32_t rxdw0, rxdw3;
1027	uint8_t rate, cipher;
1028	int8_t rssi = URTWN_NOISE_FLOOR + 1;
1029	int infosz;
1030
1031	stat = mtod(m, struct r92c_rx_stat *);
1032	rxdw0 = le32toh(stat->rxdw0);
1033	rxdw3 = le32toh(stat->rxdw3);
1034
1035	rate = MS(rxdw3, R92C_RXDW3_RATE);
1036	cipher = MS(rxdw0, R92C_RXDW0_CIPHER);
1037	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1038
1039	/* Get RSSI from PHY status descriptor if present. */
1040	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1041		if (sc->chip & URTWN_CHIP_88E)
1042			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
1043		else
1044			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
1045		/* Update our average RSSI. */
1046		urtwn_update_avgrssi(sc, rate, rssi);
1047	}
1048
1049	if (ieee80211_radiotap_active(ic)) {
1050		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1051
1052		tap->wr_flags = 0;
1053
1054		urtwn_get_tsf(sc, &tap->wr_tsft);
1055		if (__predict_false(le32toh((uint32_t)tap->wr_tsft) <
1056				    le32toh(stat->rxdw5))) {
1057			tap->wr_tsft = le32toh(tap->wr_tsft  >> 32) - 1;
1058			tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
1059		} else
1060			tap->wr_tsft &= 0xffffffff00000000;
1061		tap->wr_tsft += stat->rxdw5;
1062
1063		/* XXX 20/40? */
1064		/* XXX shortgi? */
1065
1066		/* Map HW rate index to 802.11 rate. */
1067		if (!(rxdw3 & R92C_RXDW3_HT)) {
1068			tap->wr_rate = ridx2rate[rate];
1069		} else if (rate >= 12) {	/* MCS0~15. */
1070			/* Bit 7 set means HT MCS instead of rate. */
1071			tap->wr_rate = 0x80 | (rate - 12);
1072		}
1073		tap->wr_dbm_antsignal = rssi;
1074		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
1075	}
1076
1077	*rssi_p = rssi;
1078
1079	/* Drop descriptor. */
1080	m_adj(m, sizeof(*stat) + infosz);
1081	wh = mtod(m, struct ieee80211_frame_min *);
1082
1083	if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
1084	    cipher != R92C_CAM_ALGO_NONE) {
1085		m->m_flags |= M_WEP;
1086	}
1087
1088	if (m->m_len >= sizeof(*wh))
1089		return (ieee80211_find_rxnode(ic, wh));
1090
1091	return (NULL);
1092}
1093
1094static void
1095urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1096{
1097	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1098	struct ieee80211com *ic = &sc->sc_ic;
1099	struct ieee80211_node *ni;
1100	struct mbuf *m = NULL, *next;
1101	struct urtwn_data *data;
1102	int8_t nf, rssi;
1103
1104	URTWN_ASSERT_LOCKED(sc);
1105
1106	switch (USB_GET_STATE(xfer)) {
1107	case USB_ST_TRANSFERRED:
1108		data = STAILQ_FIRST(&sc->sc_rx_active);
1109		if (data == NULL)
1110			goto tr_setup;
1111		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1112		m = urtwn_report_intr(xfer, data);
1113		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1114		/* FALLTHROUGH */
1115	case USB_ST_SETUP:
1116tr_setup:
1117		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1118		if (data == NULL) {
1119			KASSERT(m == NULL, ("mbuf isn't NULL"));
1120			goto finish;
1121		}
1122		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1123		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1124		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1125		    usbd_xfer_max_len(xfer));
1126		usbd_transfer_submit(xfer);
1127
1128		/*
1129		 * To avoid LOR we should unlock our private mutex here to call
1130		 * ieee80211_input() because here is at the end of a USB
1131		 * callback and safe to unlock.
1132		 */
1133		while (m != NULL) {
1134			next = m->m_next;
1135			m->m_next = NULL;
1136
1137			ni = urtwn_rx_frame(sc, m, &rssi);
1138			URTWN_UNLOCK(sc);
1139
1140			nf = URTWN_NOISE_FLOOR;
1141			if (ni != NULL) {
1142				if (ni->ni_flags & IEEE80211_NODE_HT)
1143					m->m_flags |= M_AMPDU;
1144				(void)ieee80211_input(ni, m, rssi - nf, nf);
1145				ieee80211_free_node(ni);
1146			} else {
1147				(void)ieee80211_input_all(ic, m, rssi - nf,
1148				    nf);
1149			}
1150			URTWN_LOCK(sc);
1151			m = next;
1152		}
1153		break;
1154	default:
1155		/* needs it to the inactive queue due to a error. */
1156		data = STAILQ_FIRST(&sc->sc_rx_active);
1157		if (data != NULL) {
1158			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1159			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1160		}
1161		if (error != USB_ERR_CANCELLED) {
1162			usbd_xfer_set_stall(xfer);
1163			counter_u64_add(ic->ic_ierrors, 1);
1164			goto tr_setup;
1165		}
1166		break;
1167	}
1168finish:
1169	/* Finished receive; age anything left on the FF queue by a little bump */
1170	/*
1171	 * XXX TODO: just make this a callout timer schedule so we can
1172	 * flush the FF staging queue if we're approaching idle.
1173	 */
1174#ifdef	IEEE80211_SUPPORT_SUPERG
1175	URTWN_UNLOCK(sc);
1176	ieee80211_ff_age_all(ic, 1);
1177	URTWN_LOCK(sc);
1178#endif
1179
1180	/* Kick-start more transmit in case we stalled */
1181	urtwn_start(sc);
1182}
1183
1184static void
1185urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
1186{
1187
1188	URTWN_ASSERT_LOCKED(sc);
1189
1190	if (data->ni != NULL)	/* not a beacon frame */
1191		ieee80211_tx_complete(data->ni, data->m, status);
1192
1193	if (sc->sc_tx_n_active > 0)
1194		sc->sc_tx_n_active--;
1195
1196	data->ni = NULL;
1197	data->m = NULL;
1198
1199	sc->sc_txtimer = 0;
1200
1201	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1202}
1203
1204static int
1205urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1206    int ndata, int maxsz)
1207{
1208	int i, error;
1209
1210	for (i = 0; i < ndata; i++) {
1211		struct urtwn_data *dp = &data[i];
1212		dp->sc = sc;
1213		dp->m = NULL;
1214		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1215		if (dp->buf == NULL) {
1216			device_printf(sc->sc_dev,
1217			    "could not allocate buffer\n");
1218			error = ENOMEM;
1219			goto fail;
1220		}
1221		dp->ni = NULL;
1222	}
1223
1224	return (0);
1225fail:
1226	urtwn_free_list(sc, data, ndata);
1227	return (error);
1228}
1229
1230static int
1231urtwn_alloc_rx_list(struct urtwn_softc *sc)
1232{
1233        int error, i;
1234
1235	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1236	    URTWN_RXBUFSZ);
1237	if (error != 0)
1238		return (error);
1239
1240	STAILQ_INIT(&sc->sc_rx_active);
1241	STAILQ_INIT(&sc->sc_rx_inactive);
1242
1243	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1244		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1245
1246	return (0);
1247}
1248
1249static int
1250urtwn_alloc_tx_list(struct urtwn_softc *sc)
1251{
1252	int error, i;
1253
1254	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1255	    URTWN_TXBUFSZ);
1256	if (error != 0)
1257		return (error);
1258
1259	STAILQ_INIT(&sc->sc_tx_active);
1260	STAILQ_INIT(&sc->sc_tx_inactive);
1261	STAILQ_INIT(&sc->sc_tx_pending);
1262
1263	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1264		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1265
1266	return (0);
1267}
1268
1269static void
1270urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1271{
1272	int i;
1273
1274	for (i = 0; i < ndata; i++) {
1275		struct urtwn_data *dp = &data[i];
1276
1277		if (dp->buf != NULL) {
1278			free(dp->buf, M_USBDEV);
1279			dp->buf = NULL;
1280		}
1281		if (dp->ni != NULL) {
1282			ieee80211_free_node(dp->ni);
1283			dp->ni = NULL;
1284		}
1285	}
1286}
1287
1288static void
1289urtwn_free_rx_list(struct urtwn_softc *sc)
1290{
1291	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1292}
1293
1294static void
1295urtwn_free_tx_list(struct urtwn_softc *sc)
1296{
1297	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1298}
1299
1300static void
1301urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1302{
1303	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1304#ifdef	IEEE80211_SUPPORT_SUPERG
1305	struct ieee80211com *ic = &sc->sc_ic;
1306#endif
1307	struct urtwn_data *data;
1308
1309	URTWN_ASSERT_LOCKED(sc);
1310
1311	switch (USB_GET_STATE(xfer)){
1312	case USB_ST_TRANSFERRED:
1313		data = STAILQ_FIRST(&sc->sc_tx_active);
1314		if (data == NULL)
1315			goto tr_setup;
1316		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1317		urtwn_txeof(sc, data, 0);
1318		/* FALLTHROUGH */
1319	case USB_ST_SETUP:
1320tr_setup:
1321		data = STAILQ_FIRST(&sc->sc_tx_pending);
1322		if (data == NULL) {
1323			URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1324			    "%s: empty pending queue\n", __func__);
1325			sc->sc_tx_n_active = 0;
1326			goto finish;
1327		}
1328		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1329		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1330		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1331		usbd_transfer_submit(xfer);
1332		sc->sc_tx_n_active++;
1333		break;
1334	default:
1335		data = STAILQ_FIRST(&sc->sc_tx_active);
1336		if (data == NULL)
1337			goto tr_setup;
1338		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1339		urtwn_txeof(sc, data, 1);
1340		if (error != USB_ERR_CANCELLED) {
1341			usbd_xfer_set_stall(xfer);
1342			goto tr_setup;
1343		}
1344		break;
1345	}
1346finish:
1347#ifdef	IEEE80211_SUPPORT_SUPERG
1348	/*
1349	 * If the TX active queue drops below a certain
1350	 * threshold, ensure we age fast-frames out so they're
1351	 * transmitted.
1352	 */
1353	if (sc->sc_tx_n_active <= 1) {
1354		/* XXX ew - net80211 should defer this for us! */
1355
1356		/*
1357		 * Note: this sc_tx_n_active currently tracks
1358		 * the number of pending transmit submissions
1359		 * and not the actual depth of the TX frames
1360		 * pending to the hardware.  That means that
1361		 * we're going to end up with some sub-optimal
1362		 * aggregation behaviour.
1363		 */
1364		/*
1365		 * XXX TODO: just make this a callout timer schedule so we can
1366		 * flush the FF staging queue if we're approaching idle.
1367		 */
1368		URTWN_UNLOCK(sc);
1369		ieee80211_ff_flush(ic, WME_AC_VO);
1370		ieee80211_ff_flush(ic, WME_AC_VI);
1371		ieee80211_ff_flush(ic, WME_AC_BE);
1372		ieee80211_ff_flush(ic, WME_AC_BK);
1373		URTWN_LOCK(sc);
1374	}
1375#endif
1376	/* Kick-start more transmit */
1377	urtwn_start(sc);
1378}
1379
1380static struct urtwn_data *
1381_urtwn_getbuf(struct urtwn_softc *sc)
1382{
1383	struct urtwn_data *bf;
1384
1385	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1386	if (bf != NULL)
1387		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1388	else {
1389		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1390		    "%s: out of xmit buffers\n", __func__);
1391	}
1392	return (bf);
1393}
1394
1395static struct urtwn_data *
1396urtwn_getbuf(struct urtwn_softc *sc)
1397{
1398        struct urtwn_data *bf;
1399
1400	URTWN_ASSERT_LOCKED(sc);
1401
1402	bf = _urtwn_getbuf(sc);
1403	if (bf == NULL) {
1404		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: stop queue\n",
1405		    __func__);
1406	}
1407	return (bf);
1408}
1409
1410static usb_error_t
1411urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1412    int len)
1413{
1414	usb_device_request_t req;
1415
1416	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1417	req.bRequest = R92C_REQ_REGS;
1418	USETW(req.wValue, addr);
1419	USETW(req.wIndex, 0);
1420	USETW(req.wLength, len);
1421	return (urtwn_do_request(sc, &req, buf));
1422}
1423
1424static usb_error_t
1425urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1426{
1427	return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1428}
1429
1430static usb_error_t
1431urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1432{
1433	val = htole16(val);
1434	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1435}
1436
1437static usb_error_t
1438urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1439{
1440	val = htole32(val);
1441	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1442}
1443
1444static usb_error_t
1445urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1446    int len)
1447{
1448	usb_device_request_t req;
1449
1450	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1451	req.bRequest = R92C_REQ_REGS;
1452	USETW(req.wValue, addr);
1453	USETW(req.wIndex, 0);
1454	USETW(req.wLength, len);
1455	return (urtwn_do_request(sc, &req, buf));
1456}
1457
1458static uint8_t
1459urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1460{
1461	uint8_t val;
1462
1463	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1464		return (0xff);
1465	return (val);
1466}
1467
1468static uint16_t
1469urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1470{
1471	uint16_t val;
1472
1473	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1474		return (0xffff);
1475	return (le16toh(val));
1476}
1477
1478static uint32_t
1479urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1480{
1481	uint32_t val;
1482
1483	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1484		return (0xffffffff);
1485	return (le32toh(val));
1486}
1487
1488static int
1489urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1490{
1491	struct r92c_fw_cmd cmd;
1492	usb_error_t error;
1493	int ntries;
1494
1495	if (!(sc->sc_flags & URTWN_FW_LOADED)) {
1496		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE, "%s: firmware "
1497		    "was not loaded; command (id %d) will be discarded\n",
1498		    __func__, id);
1499		return (0);
1500	}
1501
1502	/* Wait for current FW box to be empty. */
1503	for (ntries = 0; ntries < 100; ntries++) {
1504		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1505			break;
1506		urtwn_ms_delay(sc);
1507	}
1508	if (ntries == 100) {
1509		device_printf(sc->sc_dev,
1510		    "could not send firmware command\n");
1511		return (ETIMEDOUT);
1512	}
1513	memset(&cmd, 0, sizeof(cmd));
1514	cmd.id = id;
1515	if (len > 3)
1516		cmd.id |= R92C_CMD_FLAG_EXT;
1517	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1518	memcpy(cmd.msg, buf, len);
1519
1520	/* Write the first word last since that will trigger the FW. */
1521	error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1522	    (uint8_t *)&cmd + 4, 2);
1523	if (error != USB_ERR_NORMAL_COMPLETION)
1524		return (EIO);
1525	error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1526	    (uint8_t *)&cmd + 0, 4);
1527	if (error != USB_ERR_NORMAL_COMPLETION)
1528		return (EIO);
1529
1530	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1531	return (0);
1532}
1533
1534static void
1535urtwn_cmdq_cb(void *arg, int pending)
1536{
1537	struct urtwn_softc *sc = arg;
1538	struct urtwn_cmdq *item;
1539
1540	/*
1541	 * Device must be powered on (via urtwn_power_on())
1542	 * before any command may be sent.
1543	 */
1544	URTWN_LOCK(sc);
1545	if (!(sc->sc_flags & URTWN_RUNNING)) {
1546		URTWN_UNLOCK(sc);
1547		return;
1548	}
1549
1550	URTWN_CMDQ_LOCK(sc);
1551	while (sc->cmdq[sc->cmdq_first].func != NULL) {
1552		item = &sc->cmdq[sc->cmdq_first];
1553		sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1554		URTWN_CMDQ_UNLOCK(sc);
1555
1556		item->func(sc, &item->data);
1557
1558		URTWN_CMDQ_LOCK(sc);
1559		memset(item, 0, sizeof (*item));
1560	}
1561	URTWN_CMDQ_UNLOCK(sc);
1562	URTWN_UNLOCK(sc);
1563}
1564
1565static int
1566urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1567    CMD_FUNC_PROTO)
1568{
1569	struct ieee80211com *ic = &sc->sc_ic;
1570
1571	KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1572
1573	URTWN_CMDQ_LOCK(sc);
1574	if (sc->cmdq[sc->cmdq_last].func != NULL) {
1575		device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1576		URTWN_CMDQ_UNLOCK(sc);
1577
1578		return (EAGAIN);
1579	}
1580
1581	if (ptr != NULL)
1582		memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1583	sc->cmdq[sc->cmdq_last].func = func;
1584	sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1585	URTWN_CMDQ_UNLOCK(sc);
1586
1587	ieee80211_runtask(ic, &sc->cmdq_task);
1588
1589	return (0);
1590}
1591
1592static __inline void
1593urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1594{
1595
1596	sc->sc_rf_write(sc, chain, addr, val);
1597}
1598
1599static void
1600urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1601    uint32_t val)
1602{
1603	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1604	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1605	    SM(R92C_LSSI_PARAM_DATA, val));
1606}
1607
1608static void
1609urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1610uint32_t val)
1611{
1612	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1613	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1614	    SM(R92C_LSSI_PARAM_DATA, val));
1615}
1616
1617static uint32_t
1618urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1619{
1620	uint32_t reg[R92C_MAX_CHAINS], val;
1621
1622	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1623	if (chain != 0)
1624		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1625
1626	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1627	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1628	urtwn_ms_delay(sc);
1629
1630	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1631	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1632	    R92C_HSSI_PARAM2_READ_EDGE);
1633	urtwn_ms_delay(sc);
1634
1635	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1636	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1637	urtwn_ms_delay(sc);
1638
1639	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1640		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1641	else
1642		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1643	return (MS(val, R92C_LSSI_READBACK_DATA));
1644}
1645
1646static int
1647urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1648{
1649	usb_error_t error;
1650	int ntries;
1651
1652	error = urtwn_write_4(sc, R92C_LLT_INIT,
1653	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1654	    SM(R92C_LLT_INIT_ADDR, addr) |
1655	    SM(R92C_LLT_INIT_DATA, data));
1656	if (error != USB_ERR_NORMAL_COMPLETION)
1657		return (EIO);
1658	/* Wait for write operation to complete. */
1659	for (ntries = 0; ntries < 20; ntries++) {
1660		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1661		    R92C_LLT_INIT_OP_NO_ACTIVE)
1662			return (0);
1663		urtwn_ms_delay(sc);
1664	}
1665	return (ETIMEDOUT);
1666}
1667
1668static int
1669urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1670{
1671	uint32_t reg;
1672	usb_error_t error;
1673	int ntries;
1674
1675	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1676		return (EFAULT);
1677
1678	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1679	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1680	reg &= ~R92C_EFUSE_CTRL_VALID;
1681
1682	error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1683	if (error != USB_ERR_NORMAL_COMPLETION)
1684		return (EIO);
1685	/* Wait for read operation to complete. */
1686	for (ntries = 0; ntries < 100; ntries++) {
1687		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1688		if (reg & R92C_EFUSE_CTRL_VALID)
1689			break;
1690		urtwn_ms_delay(sc);
1691	}
1692	if (ntries == 100) {
1693		device_printf(sc->sc_dev,
1694		    "could not read efuse byte at address 0x%x\n",
1695		    sc->last_rom_addr);
1696		return (ETIMEDOUT);
1697	}
1698
1699	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1700	sc->last_rom_addr++;
1701
1702	return (0);
1703}
1704
1705static int
1706urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1707    uint8_t msk)
1708{
1709	uint8_t reg;
1710	int i, error;
1711
1712	for (i = 0; i < 4; i++) {
1713		if (msk & (1 << i))
1714			continue;
1715		error = urtwn_efuse_read_next(sc, &reg);
1716		if (error != 0)
1717			return (error);
1718		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1719		    off * 8 + i * 2, reg);
1720		rom[off * 8 + i * 2 + 0] = reg;
1721
1722		error = urtwn_efuse_read_next(sc, &reg);
1723		if (error != 0)
1724			return (error);
1725		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1726		    off * 8 + i * 2 + 1, reg);
1727		rom[off * 8 + i * 2 + 1] = reg;
1728	}
1729
1730	return (0);
1731}
1732
1733#ifdef USB_DEBUG
1734static void
1735urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1736{
1737	int i;
1738
1739	/* Dump ROM contents. */
1740	device_printf(sc->sc_dev, "%s:", __func__);
1741	for (i = 0; i < size; i++) {
1742		if (i % 32 == 0)
1743			printf("\n%03X: ", i);
1744		else if (i % 4 == 0)
1745			printf(" ");
1746
1747		printf("%02X", rom[i]);
1748	}
1749	printf("\n");
1750}
1751#endif
1752
1753static int
1754urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1755{
1756#define URTWN_CHK(res) do {	\
1757	if ((error = res) != 0)	\
1758		goto end;	\
1759} while(0)
1760	uint8_t msk, off, reg;
1761	int error;
1762
1763	URTWN_CHK(urtwn_efuse_switch_power(sc));
1764
1765	/* Read full ROM image. */
1766	sc->last_rom_addr = 0;
1767	memset(rom, 0xff, size);
1768
1769	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1770	while (reg != 0xff) {
1771		/* check for extended header */
1772		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1773			off = reg >> 5;
1774			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1775
1776			if ((reg & 0x0f) != 0x0f)
1777				off = ((reg & 0xf0) >> 1) | off;
1778			else
1779				continue;
1780		} else
1781			off = reg >> 4;
1782		msk = reg & 0xf;
1783
1784		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1785		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1786	}
1787
1788end:
1789
1790#ifdef USB_DEBUG
1791	if (sc->sc_debug & URTWN_DEBUG_ROM)
1792		urtwn_dump_rom_contents(sc, rom, size);
1793#endif
1794
1795	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1796
1797	if (error != 0) {
1798		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1799		    __func__);
1800	}
1801
1802	return (error);
1803#undef URTWN_CHK
1804}
1805
1806static int
1807urtwn_efuse_switch_power(struct urtwn_softc *sc)
1808{
1809	usb_error_t error;
1810	uint32_t reg;
1811
1812	error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1813	if (error != USB_ERR_NORMAL_COMPLETION)
1814		return (EIO);
1815
1816	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1817	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1818		error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1819		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1820		if (error != USB_ERR_NORMAL_COMPLETION)
1821			return (EIO);
1822	}
1823	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1824	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1825		error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1826		    reg | R92C_SYS_FUNC_EN_ELDR);
1827		if (error != USB_ERR_NORMAL_COMPLETION)
1828			return (EIO);
1829	}
1830	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1831	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1832	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1833		error = urtwn_write_2(sc, R92C_SYS_CLKR,
1834		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1835		if (error != USB_ERR_NORMAL_COMPLETION)
1836			return (EIO);
1837	}
1838
1839	return (0);
1840}
1841
1842static int
1843urtwn_read_chipid(struct urtwn_softc *sc)
1844{
1845	uint32_t reg;
1846
1847	if (sc->chip & URTWN_CHIP_88E)
1848		return (0);
1849
1850	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1851	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1852		return (EIO);
1853
1854	if (reg & R92C_SYS_CFG_TYPE_92C) {
1855		sc->chip |= URTWN_CHIP_92C;
1856		/* Check if it is a castrated 8192C. */
1857		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1858		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1859		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1860			sc->chip |= URTWN_CHIP_92C_1T2R;
1861	}
1862	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1863		sc->chip |= URTWN_CHIP_UMC;
1864		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1865			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1866	}
1867	return (0);
1868}
1869
1870static int
1871urtwn_read_rom(struct urtwn_softc *sc)
1872{
1873	struct r92c_rom *rom = &sc->rom.r92c_rom;
1874	int error;
1875
1876	/* Read full ROM image. */
1877	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1878	if (error != 0)
1879		return (error);
1880
1881	/* XXX Weird but this is what the vendor driver does. */
1882	sc->last_rom_addr = 0x1fa;
1883	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1884	if (error != 0)
1885		return (error);
1886	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: PA setting=0x%x\n", __func__,
1887	    sc->pa_setting);
1888
1889	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1890
1891	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1892	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type=%d\n",
1893	    __func__, sc->regulatory);
1894	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1895
1896	sc->sc_rf_write = urtwn_r92c_rf_write;
1897	sc->sc_power_on = urtwn_r92c_power_on;
1898	sc->sc_power_off = urtwn_r92c_power_off;
1899
1900	return (0);
1901}
1902
1903static int
1904urtwn_r88e_read_rom(struct urtwn_softc *sc)
1905{
1906	struct r88e_rom *rom = &sc->rom.r88e_rom;
1907	int error;
1908
1909	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));
1910	if (error != 0)
1911		return (error);
1912
1913	sc->bw20_tx_pwr_diff = (rom->tx_pwr_diff >> 4);
1914	if (sc->bw20_tx_pwr_diff & 0x08)
1915		sc->bw20_tx_pwr_diff |= 0xf0;
1916	sc->ofdm_tx_pwr_diff = (rom->tx_pwr_diff & 0xf);
1917	if (sc->ofdm_tx_pwr_diff & 0x08)
1918		sc->ofdm_tx_pwr_diff |= 0xf0;
1919	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
1920	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type %d\n",
1921	    __func__,sc->regulatory);
1922	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1923
1924	sc->sc_rf_write = urtwn_r88e_rf_write;
1925	sc->sc_power_on = urtwn_r88e_power_on;
1926	sc->sc_power_off = urtwn_r88e_power_off;
1927
1928	return (0);
1929}
1930
1931/*
1932 * Initialize rate adaptation in firmware.
1933 */
1934static int
1935urtwn_ra_init(struct urtwn_softc *sc)
1936{
1937	struct ieee80211com *ic = &sc->sc_ic;
1938	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1939	struct ieee80211_node *ni;
1940	struct ieee80211_rateset *rs, *rs_ht;
1941	struct r92c_fw_cmd_macid_cfg cmd;
1942	uint32_t rates, basicrates;
1943	uint8_t mode;
1944	int maxrate, maxbasicrate, error, i, j;
1945
1946	ni = ieee80211_ref_node(vap->iv_bss);
1947	rs = &ni->ni_rates;
1948	rs_ht = (struct ieee80211_rateset *) &ni->ni_htrates;
1949
1950	/* Get normal and basic rates mask. */
1951	rates = basicrates = 0;
1952	maxrate = maxbasicrate = 0;
1953
1954	/* This is for 11bg */
1955	for (i = 0; i < rs->rs_nrates; i++) {
1956		/* Convert 802.11 rate to HW rate index. */
1957		for (j = 0; j < nitems(ridx2rate); j++)
1958			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1959			    ridx2rate[j])
1960				break;
1961		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1962			continue;
1963		rates |= 1 << j;
1964		if (j > maxrate)
1965			maxrate = j;
1966		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1967			basicrates |= 1 << j;
1968			if (j > maxbasicrate)
1969				maxbasicrate = j;
1970		}
1971	}
1972
1973	/* If we're doing 11n, enable 11n rates */
1974	if (ni->ni_flags & IEEE80211_NODE_HT) {
1975		for (i = 0; i < rs_ht->rs_nrates; i++) {
1976			if ((rs_ht->rs_rates[i] & 0x7f) > 0xf)
1977				continue;
1978			/* 11n rates start at index 12 */
1979			j = ((rs_ht->rs_rates[i]) & 0xf) + 12;
1980			rates |= (1 << j);
1981
1982			/* Guard against the rate table being oddly ordered */
1983			if (j > maxrate)
1984				maxrate = j;
1985		}
1986	}
1987
1988#if 0
1989	if (ic->ic_curmode == IEEE80211_MODE_11NG)
1990		raid = R92C_RAID_11GN;
1991#endif
1992	/* NB: group addressed frames are done at 11bg rates for now */
1993	if (ic->ic_curmode == IEEE80211_MODE_11B)
1994		mode = R92C_RAID_11B;
1995	else
1996		mode = R92C_RAID_11BG;
1997	/* XXX misleading 'mode' value here for unicast frames */
1998	URTWN_DPRINTF(sc, URTWN_DEBUG_RA,
1999	    "%s: mode 0x%x, rates 0x%08x, basicrates 0x%08x\n", __func__,
2000	    mode, rates, basicrates);
2001
2002	/* Set rates mask for group addressed frames. */
2003	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
2004	cmd.mask = htole32(mode << 28 | basicrates);
2005	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2006	if (error != 0) {
2007		ieee80211_free_node(ni);
2008		device_printf(sc->sc_dev,
2009		    "could not add broadcast station\n");
2010		return (error);
2011	}
2012
2013	/* Set initial MRR rate. */
2014	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxbasicrate %d\n", __func__,
2015	    maxbasicrate);
2016	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
2017	    maxbasicrate);
2018
2019	/* Set rates mask for unicast frames. */
2020	if (ni->ni_flags & IEEE80211_NODE_HT)
2021		mode = R92C_RAID_11GN;
2022	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2023		mode = R92C_RAID_11B;
2024	else
2025		mode = R92C_RAID_11BG;
2026	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
2027	cmd.mask = htole32(mode << 28 | rates);
2028	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2029	if (error != 0) {
2030		ieee80211_free_node(ni);
2031		device_printf(sc->sc_dev, "could not add BSS station\n");
2032		return (error);
2033	}
2034	/* Set initial MRR rate. */
2035	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxrate %d\n", __func__,
2036	    maxrate);
2037	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
2038	    maxrate);
2039
2040	/* Indicate highest supported rate. */
2041	if (ni->ni_flags & IEEE80211_NODE_HT)
2042		ni->ni_txrate = rs_ht->rs_rates[rs_ht->rs_nrates - 1]
2043		    | IEEE80211_RATE_MCS;
2044	else
2045		ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
2046	ieee80211_free_node(ni);
2047
2048	return (0);
2049}
2050
2051static void
2052urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2053{
2054	struct r92c_tx_desc *txd = &uvp->bcn_desc;
2055
2056	txd->txdw0 = htole32(
2057	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
2058	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2059	txd->txdw1 = htole32(
2060	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
2061	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
2062
2063	if (sc->chip & URTWN_CHIP_88E) {
2064		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
2065		txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
2066	} else {
2067		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
2068		txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2069	}
2070
2071	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
2072	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
2073}
2074
2075static int
2076urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
2077{
2078 	struct ieee80211vap *vap = ni->ni_vap;
2079	struct urtwn_vap *uvp = URTWN_VAP(vap);
2080	struct mbuf *m;
2081	int error;
2082
2083	URTWN_ASSERT_LOCKED(sc);
2084
2085	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
2086		return (EINVAL);
2087
2088	m = ieee80211_beacon_alloc(ni);
2089	if (m == NULL) {
2090		device_printf(sc->sc_dev,
2091		    "%s: could not allocate beacon frame\n", __func__);
2092		return (ENOMEM);
2093	}
2094
2095	if (uvp->bcn_mbuf != NULL)
2096		m_freem(uvp->bcn_mbuf);
2097
2098	uvp->bcn_mbuf = m;
2099
2100	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2101		return (error);
2102
2103	/* XXX bcnq stuck workaround */
2104	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2105		return (error);
2106
2107	URTWN_DPRINTF(sc, URTWN_DEBUG_BEACON, "%s: beacon was %srecognized\n",
2108	    __func__, urtwn_read_1(sc, R92C_TDECTRL + 2) &
2109	    (R92C_TDECTRL_BCN_VALID >> 16) ? "" : "not ");
2110
2111	return (0);
2112}
2113
2114static void
2115urtwn_update_beacon(struct ieee80211vap *vap, int item)
2116{
2117	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2118	struct urtwn_vap *uvp = URTWN_VAP(vap);
2119	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
2120	struct ieee80211_node *ni = vap->iv_bss;
2121	int mcast = 0;
2122
2123	URTWN_LOCK(sc);
2124	if (uvp->bcn_mbuf == NULL) {
2125		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
2126		if (uvp->bcn_mbuf == NULL) {
2127			device_printf(sc->sc_dev,
2128			    "%s: could not allocate beacon frame\n", __func__);
2129			URTWN_UNLOCK(sc);
2130			return;
2131		}
2132	}
2133	URTWN_UNLOCK(sc);
2134
2135	if (item == IEEE80211_BEACON_TIM)
2136		mcast = 1;	/* XXX */
2137
2138	setbit(bo->bo_flags, item);
2139	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
2140
2141	URTWN_LOCK(sc);
2142	urtwn_tx_beacon(sc, uvp);
2143	URTWN_UNLOCK(sc);
2144}
2145
2146/*
2147 * Push a beacon frame into the chip. Beacon will
2148 * be repeated by the chip every R92C_BCN_INTERVAL.
2149 */
2150static int
2151urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2152{
2153	struct r92c_tx_desc *desc = &uvp->bcn_desc;
2154	struct urtwn_data *bf;
2155
2156	URTWN_ASSERT_LOCKED(sc);
2157
2158	bf = urtwn_getbuf(sc);
2159	if (bf == NULL)
2160		return (ENOMEM);
2161
2162	memcpy(bf->buf, desc, sizeof(*desc));
2163	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
2164
2165	sc->sc_txtimer = 5;
2166	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2167
2168	return (0);
2169}
2170
2171static int
2172urtwn_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
2173    ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
2174{
2175	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2176	uint8_t i;
2177
2178	if (!(&vap->iv_nw_keys[0] <= k &&
2179	     k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
2180		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2181			URTWN_LOCK(sc);
2182			/*
2183			 * First 4 slots for group keys,
2184			 * what is left - for pairwise.
2185			 * XXX incompatible with IBSS RSN.
2186			 */
2187			for (i = IEEE80211_WEP_NKID;
2188			     i < R92C_CAM_ENTRY_COUNT; i++) {
2189				if ((sc->keys_bmap & (1 << i)) == 0) {
2190					sc->keys_bmap |= 1 << i;
2191					*keyix = i;
2192					break;
2193				}
2194			}
2195			URTWN_UNLOCK(sc);
2196			if (i == R92C_CAM_ENTRY_COUNT) {
2197				device_printf(sc->sc_dev,
2198				    "%s: no free space in the key table\n",
2199				    __func__);
2200				return 0;
2201			}
2202		} else
2203			*keyix = 0;
2204	} else {
2205		*keyix = k - vap->iv_nw_keys;
2206	}
2207	*rxkeyix = *keyix;
2208	return 1;
2209}
2210
2211static void
2212urtwn_key_set_cb(struct urtwn_softc *sc, union sec_param *data)
2213{
2214	struct ieee80211_key *k = &data->key;
2215	uint8_t algo, keyid;
2216	int i, error;
2217
2218	if (k->wk_keyix < IEEE80211_WEP_NKID)
2219		keyid = k->wk_keyix;
2220	else
2221		keyid = 0;
2222
2223	/* Map net80211 cipher to HW crypto algorithm. */
2224	switch (k->wk_cipher->ic_cipher) {
2225	case IEEE80211_CIPHER_WEP:
2226		if (k->wk_keylen < 8)
2227			algo = R92C_CAM_ALGO_WEP40;
2228		else
2229			algo = R92C_CAM_ALGO_WEP104;
2230		break;
2231	case IEEE80211_CIPHER_TKIP:
2232		algo = R92C_CAM_ALGO_TKIP;
2233		break;
2234	case IEEE80211_CIPHER_AES_CCM:
2235		algo = R92C_CAM_ALGO_AES;
2236		break;
2237	default:
2238		device_printf(sc->sc_dev, "%s: undefined cipher %d\n",
2239		    __func__, k->wk_cipher->ic_cipher);
2240		return;
2241	}
2242
2243	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2244	    "%s: keyix %d, keyid %d, algo %d/%d, flags %04X, len %d, "
2245	    "macaddr %s\n", __func__, k->wk_keyix, keyid,
2246	    k->wk_cipher->ic_cipher, algo, k->wk_flags, k->wk_keylen,
2247	    ether_sprintf(k->wk_macaddr));
2248
2249	/* Write key. */
2250	for (i = 0; i < 4; i++) {
2251		error = urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i),
2252		    LE_READ_4(&k->wk_key[i * 4]));
2253		if (error != 0)
2254			goto fail;
2255	}
2256
2257	/* Write CTL0 last since that will validate the CAM entry. */
2258	error = urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix),
2259	    LE_READ_4(&k->wk_macaddr[2]));
2260	if (error != 0)
2261		goto fail;
2262	error = urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix),
2263	    SM(R92C_CAM_ALGO, algo) |
2264	    SM(R92C_CAM_KEYID, keyid) |
2265	    SM(R92C_CAM_MACLO, LE_READ_2(&k->wk_macaddr[0])) |
2266	    R92C_CAM_VALID);
2267	if (error != 0)
2268		goto fail;
2269
2270	return;
2271
2272fail:
2273	device_printf(sc->sc_dev, "%s fails, error %d\n", __func__, error);
2274}
2275
2276static void
2277urtwn_key_del_cb(struct urtwn_softc *sc, union sec_param *data)
2278{
2279	struct ieee80211_key *k = &data->key;
2280	int i;
2281
2282	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2283	    "%s: keyix %d, flags %04X, macaddr %s\n", __func__,
2284	    k->wk_keyix, k->wk_flags, ether_sprintf(k->wk_macaddr));
2285
2286	urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix), 0);
2287	urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix), 0);
2288
2289	/* Clear key. */
2290	for (i = 0; i < 4; i++)
2291		urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i), 0);
2292	sc->keys_bmap &= ~(1 << k->wk_keyix);
2293}
2294
2295static int
2296urtwn_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
2297{
2298	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2299
2300	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2301		/* Not for us. */
2302		return (1);
2303	}
2304
2305	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_set_cb));
2306}
2307
2308static int
2309urtwn_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
2310{
2311	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2312
2313	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2314		/* Not for us. */
2315		return (1);
2316	}
2317
2318	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_del_cb));
2319}
2320
2321static void
2322urtwn_tsf_task_adhoc(void *arg, int pending)
2323{
2324	struct ieee80211vap *vap = arg;
2325	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2326	struct ieee80211_node *ni;
2327	uint32_t reg;
2328
2329	URTWN_LOCK(sc);
2330	ni = ieee80211_ref_node(vap->iv_bss);
2331	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
2332
2333	/* Accept beacons with the same BSSID. */
2334	urtwn_set_rx_bssid_all(sc, 0);
2335
2336	/* Enable synchronization. */
2337	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
2338	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2339
2340	/* Synchronize. */
2341	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
2342
2343	/* Disable synchronization. */
2344	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
2345	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2346
2347	/* Remove beacon filter. */
2348	urtwn_set_rx_bssid_all(sc, 1);
2349
2350	/* Enable beaconing. */
2351	urtwn_write_1(sc, R92C_MBID_NUM,
2352	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2353	reg |= R92C_BCN_CTRL_EN_BCN;
2354
2355	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2356	ieee80211_free_node(ni);
2357	URTWN_UNLOCK(sc);
2358}
2359
2360static void
2361urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
2362{
2363	struct ieee80211com *ic = &sc->sc_ic;
2364	struct urtwn_vap *uvp = URTWN_VAP(vap);
2365
2366	/* Reset TSF. */
2367	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2368
2369	switch (vap->iv_opmode) {
2370	case IEEE80211_M_STA:
2371		/* Enable TSF synchronization. */
2372		urtwn_write_1(sc, R92C_BCN_CTRL,
2373		    urtwn_read_1(sc, R92C_BCN_CTRL) &
2374		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
2375		break;
2376	case IEEE80211_M_IBSS:
2377		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
2378		break;
2379	case IEEE80211_M_HOSTAP:
2380		/* Enable beaconing. */
2381		urtwn_write_1(sc, R92C_MBID_NUM,
2382		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2383		urtwn_write_1(sc, R92C_BCN_CTRL,
2384		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
2385		break;
2386	default:
2387		device_printf(sc->sc_dev, "undefined opmode %d\n",
2388		    vap->iv_opmode);
2389		return;
2390	}
2391}
2392
2393static void
2394urtwn_get_tsf(struct urtwn_softc *sc, uint64_t *buf)
2395{
2396	urtwn_read_region_1(sc, R92C_TSFTR, (uint8_t *)buf, sizeof(*buf));
2397}
2398
2399static void
2400urtwn_set_led(struct urtwn_softc *sc, int led, int on)
2401{
2402	uint8_t reg;
2403
2404	if (led == URTWN_LED_LINK) {
2405		if (sc->chip & URTWN_CHIP_88E) {
2406			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
2407			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
2408			if (!on) {
2409				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
2410				urtwn_write_1(sc, R92C_LEDCFG2,
2411				    reg | R92C_LEDCFG0_DIS);
2412				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
2413				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
2414				    0xfe);
2415			}
2416		} else {
2417			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
2418			if (!on)
2419				reg |= R92C_LEDCFG0_DIS;
2420			urtwn_write_1(sc, R92C_LEDCFG0, reg);
2421		}
2422		sc->ledlink = on;       /* Save LED state. */
2423	}
2424}
2425
2426static void
2427urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
2428{
2429	uint8_t reg;
2430
2431	reg = urtwn_read_1(sc, R92C_MSR);
2432	reg = (reg & ~R92C_MSR_MASK) | mode;
2433	urtwn_write_1(sc, R92C_MSR, reg);
2434}
2435
2436static void
2437urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2438    const struct ieee80211_rx_stats *rxs,
2439    int rssi, int nf)
2440{
2441	struct ieee80211vap *vap = ni->ni_vap;
2442	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2443	struct urtwn_vap *uvp = URTWN_VAP(vap);
2444	uint64_t ni_tstamp, curr_tstamp;
2445
2446	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2447
2448	if (vap->iv_state == IEEE80211_S_RUN &&
2449	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2450	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2451		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2452		URTWN_LOCK(sc);
2453		urtwn_get_tsf(sc, &curr_tstamp);
2454		URTWN_UNLOCK(sc);
2455		curr_tstamp = le64toh(curr_tstamp);
2456
2457		if (ni_tstamp >= curr_tstamp)
2458			(void) ieee80211_ibss_merge(ni);
2459	}
2460}
2461
2462static int
2463urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2464{
2465	struct urtwn_vap *uvp = URTWN_VAP(vap);
2466	struct ieee80211com *ic = vap->iv_ic;
2467	struct urtwn_softc *sc = ic->ic_softc;
2468	struct ieee80211_node *ni;
2469	enum ieee80211_state ostate;
2470	uint32_t reg;
2471	uint8_t mode;
2472	int error = 0;
2473
2474	ostate = vap->iv_state;
2475	URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s -> %s\n",
2476	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
2477
2478	IEEE80211_UNLOCK(ic);
2479	URTWN_LOCK(sc);
2480	callout_stop(&sc->sc_watchdog_ch);
2481
2482	if (ostate == IEEE80211_S_RUN) {
2483		/* Stop calibration. */
2484		callout_stop(&sc->sc_calib_to);
2485
2486		/* Turn link LED off. */
2487		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2488
2489		/* Set media status to 'No Link'. */
2490		urtwn_set_mode(sc, R92C_MSR_NOLINK);
2491
2492		/* Stop Rx of data frames. */
2493		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2494
2495		/* Disable TSF synchronization. */
2496		urtwn_write_1(sc, R92C_BCN_CTRL,
2497		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2498		    R92C_BCN_CTRL_DIS_TSF_UDT0);
2499
2500		/* Disable beaconing. */
2501		urtwn_write_1(sc, R92C_MBID_NUM,
2502		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2503
2504		/* Reset TSF. */
2505		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2506
2507		/* Reset EDCA parameters. */
2508		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2509		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2510		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2511		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2512	}
2513
2514	switch (nstate) {
2515	case IEEE80211_S_INIT:
2516		/* Turn link LED off. */
2517		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2518		break;
2519	case IEEE80211_S_SCAN:
2520		/* Pause AC Tx queues. */
2521		urtwn_write_1(sc, R92C_TXPAUSE,
2522		    urtwn_read_1(sc, R92C_TXPAUSE) | R92C_TX_QUEUE_AC);
2523		break;
2524	case IEEE80211_S_AUTH:
2525		urtwn_set_chan(sc, ic->ic_curchan, NULL);
2526		break;
2527	case IEEE80211_S_RUN:
2528		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2529			/* Turn link LED on. */
2530			urtwn_set_led(sc, URTWN_LED_LINK, 1);
2531			break;
2532		}
2533
2534		ni = ieee80211_ref_node(vap->iv_bss);
2535
2536		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2537		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
2538			device_printf(sc->sc_dev,
2539			    "%s: could not move to RUN state\n", __func__);
2540			error = EINVAL;
2541			goto end_run;
2542		}
2543
2544		switch (vap->iv_opmode) {
2545		case IEEE80211_M_STA:
2546			mode = R92C_MSR_INFRA;
2547			break;
2548		case IEEE80211_M_IBSS:
2549			mode = R92C_MSR_ADHOC;
2550			break;
2551		case IEEE80211_M_HOSTAP:
2552			mode = R92C_MSR_AP;
2553			break;
2554		default:
2555			device_printf(sc->sc_dev, "undefined opmode %d\n",
2556			    vap->iv_opmode);
2557			error = EINVAL;
2558			goto end_run;
2559		}
2560
2561		/* Set media status to 'Associated'. */
2562		urtwn_set_mode(sc, mode);
2563
2564		/* Set BSSID. */
2565		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
2566		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
2567
2568		if (ic->ic_curmode == IEEE80211_MODE_11B)
2569			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2570		else	/* 802.11b/g */
2571			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2572
2573		/* Enable Rx of data frames. */
2574		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2575
2576		/* Flush all AC queues. */
2577		urtwn_write_1(sc, R92C_TXPAUSE, 0);
2578
2579		/* Set beacon interval. */
2580		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2581
2582		/* Allow Rx from our BSSID only. */
2583		if (ic->ic_promisc == 0) {
2584			reg = urtwn_read_4(sc, R92C_RCR);
2585
2586			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2587				reg |= R92C_RCR_CBSSID_DATA;
2588			if (vap->iv_opmode != IEEE80211_M_IBSS)
2589				reg |= R92C_RCR_CBSSID_BCN;
2590
2591			urtwn_write_4(sc, R92C_RCR, reg);
2592		}
2593
2594		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2595		    vap->iv_opmode == IEEE80211_M_IBSS) {
2596			error = urtwn_setup_beacon(sc, ni);
2597			if (error != 0) {
2598				device_printf(sc->sc_dev,
2599				    "unable to push beacon into the chip, "
2600				    "error %d\n", error);
2601				goto end_run;
2602			}
2603		}
2604
2605		/* Enable TSF synchronization. */
2606		urtwn_tsf_sync_enable(sc, vap);
2607
2608		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2609		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2610		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2611		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2612		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2613		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2614
2615		/* Intialize rate adaptation. */
2616		if (!(sc->chip & URTWN_CHIP_88E))
2617			urtwn_ra_init(sc);
2618		/* Turn link LED on. */
2619		urtwn_set_led(sc, URTWN_LED_LINK, 1);
2620
2621		sc->avg_pwdb = -1;	/* Reset average RSSI. */
2622		/* Reset temperature calibration state machine. */
2623		sc->sc_flags &= ~URTWN_TEMP_MEASURED;
2624		sc->thcal_lctemp = 0;
2625		/* Start periodic calibration. */
2626		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2627
2628end_run:
2629		ieee80211_free_node(ni);
2630		break;
2631	default:
2632		break;
2633	}
2634
2635	URTWN_UNLOCK(sc);
2636	IEEE80211_LOCK(ic);
2637	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2638}
2639
2640static void
2641urtwn_calib_to(void *arg)
2642{
2643	struct urtwn_softc *sc = arg;
2644
2645	/* Do it in a process context. */
2646	urtwn_cmd_sleepable(sc, NULL, 0, urtwn_calib_cb);
2647}
2648
2649static void
2650urtwn_calib_cb(struct urtwn_softc *sc, union sec_param *data)
2651{
2652	/* Do temperature compensation. */
2653	urtwn_temp_calib(sc);
2654
2655	if ((urtwn_read_1(sc, R92C_MSR) & R92C_MSR_MASK) != R92C_MSR_NOLINK)
2656		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2657}
2658
2659static void
2660urtwn_watchdog(void *arg)
2661{
2662	struct urtwn_softc *sc = arg;
2663
2664	if (sc->sc_txtimer > 0) {
2665		if (--sc->sc_txtimer == 0) {
2666			device_printf(sc->sc_dev, "device timeout\n");
2667			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2668			return;
2669		}
2670		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2671	}
2672}
2673
2674static void
2675urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2676{
2677	int pwdb;
2678
2679	/* Convert antenna signal to percentage. */
2680	if (rssi <= -100 || rssi >= 20)
2681		pwdb = 0;
2682	else if (rssi >= 0)
2683		pwdb = 100;
2684	else
2685		pwdb = 100 + rssi;
2686	if (!(sc->chip & URTWN_CHIP_88E)) {
2687		if (rate <= URTWN_RIDX_CCK11) {
2688			/* CCK gain is smaller than OFDM/MCS gain. */
2689			pwdb += 6;
2690			if (pwdb > 100)
2691				pwdb = 100;
2692			if (pwdb <= 14)
2693				pwdb -= 4;
2694			else if (pwdb <= 26)
2695				pwdb -= 8;
2696			else if (pwdb <= 34)
2697				pwdb -= 6;
2698			else if (pwdb <= 42)
2699				pwdb -= 2;
2700		}
2701	}
2702	if (sc->avg_pwdb == -1)	/* Init. */
2703		sc->avg_pwdb = pwdb;
2704	else if (sc->avg_pwdb < pwdb)
2705		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2706	else
2707		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2708	URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: PWDB %d, EMA %d\n", __func__,
2709	    pwdb, sc->avg_pwdb);
2710}
2711
2712static int8_t
2713urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2714{
2715	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2716	struct r92c_rx_phystat *phy;
2717	struct r92c_rx_cck *cck;
2718	uint8_t rpt;
2719	int8_t rssi;
2720
2721	if (rate <= URTWN_RIDX_CCK11) {
2722		cck = (struct r92c_rx_cck *)physt;
2723		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2724			rpt = (cck->agc_rpt >> 5) & 0x3;
2725			rssi = (cck->agc_rpt & 0x1f) << 1;
2726		} else {
2727			rpt = (cck->agc_rpt >> 6) & 0x3;
2728			rssi = cck->agc_rpt & 0x3e;
2729		}
2730		rssi = cckoff[rpt] - rssi;
2731	} else {	/* OFDM/HT. */
2732		phy = (struct r92c_rx_phystat *)physt;
2733		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2734	}
2735	return (rssi);
2736}
2737
2738static int8_t
2739urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2740{
2741	struct r92c_rx_phystat *phy;
2742	struct r88e_rx_cck *cck;
2743	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2744	int8_t rssi;
2745
2746	rssi = 0;
2747	if (rate <= URTWN_RIDX_CCK11) {
2748		cck = (struct r88e_rx_cck *)physt;
2749		cck_agc_rpt = cck->agc_rpt;
2750		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2751		vga_idx = cck_agc_rpt & 0x1f;
2752		switch (lna_idx) {
2753		case 7:
2754			if (vga_idx <= 27)
2755				rssi = -100 + 2* (27 - vga_idx);
2756			else
2757				rssi = -100;
2758			break;
2759		case 6:
2760			rssi = -48 + 2 * (2 - vga_idx);
2761			break;
2762		case 5:
2763			rssi = -42 + 2 * (7 - vga_idx);
2764			break;
2765		case 4:
2766			rssi = -36 + 2 * (7 - vga_idx);
2767			break;
2768		case 3:
2769			rssi = -24 + 2 * (7 - vga_idx);
2770			break;
2771		case 2:
2772			rssi = -12 + 2 * (5 - vga_idx);
2773			break;
2774		case 1:
2775			rssi = 8 - (2 * vga_idx);
2776			break;
2777		case 0:
2778			rssi = 14 - (2 * vga_idx);
2779			break;
2780		}
2781		rssi += 6;
2782	} else {	/* OFDM/HT. */
2783		phy = (struct r92c_rx_phystat *)physt;
2784		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2785	}
2786	return (rssi);
2787}
2788
2789static __inline uint8_t
2790rate2ridx(uint8_t rate)
2791{
2792	if (rate & IEEE80211_RATE_MCS) {
2793		/* 11n rates start at idx 12 */
2794		return ((rate & 0xf) + 12);
2795	}
2796	switch (rate) {
2797	/* 11g */
2798	case 12:	return 4;
2799	case 18:	return 5;
2800	case 24:	return 6;
2801	case 36:	return 7;
2802	case 48:	return 8;
2803	case 72:	return 9;
2804	case 96:	return 10;
2805	case 108:	return 11;
2806	/* 11b */
2807	case 2:		return 0;
2808	case 4:		return 1;
2809	case 11:	return 2;
2810	case 22:	return 3;
2811	default:	return 0;
2812	}
2813}
2814
2815static int
2816urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2817    struct mbuf *m, struct urtwn_data *data)
2818{
2819	const struct ieee80211_txparam *tp;
2820	struct ieee80211com *ic = &sc->sc_ic;
2821	struct ieee80211vap *vap = ni->ni_vap;
2822	struct ieee80211_key *k = NULL;
2823	struct ieee80211_channel *chan;
2824	struct ieee80211_frame *wh;
2825	struct r92c_tx_desc *txd;
2826	uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2827	int hasqos, ismcast;
2828
2829	URTWN_ASSERT_LOCKED(sc);
2830
2831	/*
2832	 * Software crypto.
2833	 */
2834	wh = mtod(m, struct ieee80211_frame *);
2835	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2836	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2837	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2838	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2839
2840	/* Select TX ring for this frame. */
2841	if (hasqos) {
2842		tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2843		tid &= IEEE80211_QOS_TID;
2844	} else
2845		tid = 0;
2846
2847	chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2848		ni->ni_chan : ic->ic_curchan;
2849	tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2850
2851	/* Choose a TX rate index. */
2852	if (type == IEEE80211_FC0_TYPE_MGT)
2853		rate = tp->mgmtrate;
2854	else if (ismcast)
2855		rate = tp->mcastrate;
2856	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2857		rate = tp->ucastrate;
2858	else if (m->m_flags & M_EAPOL)
2859		rate = tp->mgmtrate;
2860	else {
2861		if (URTWN_CHIP_HAS_RATECTL(sc)) {
2862			/* XXX pass pktlen */
2863			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2864			rate = ni->ni_txrate;
2865		} else {
2866			/* XXX TODO: drop the default rate for 11b/11g? */
2867			if (ni->ni_flags & IEEE80211_NODE_HT)
2868				rate = IEEE80211_RATE_MCS | 0x4; /* MCS4 */
2869			else if (ic->ic_curmode != IEEE80211_MODE_11B)
2870				rate = 108;
2871			else
2872				rate = 22;
2873		}
2874	}
2875
2876	/*
2877	 * XXX TODO: this should be per-node, for 11b versus 11bg
2878	 * nodes in hostap mode
2879	 */
2880	ridx = rate2ridx(rate);
2881	if (ni->ni_flags & IEEE80211_NODE_HT)
2882		raid = R92C_RAID_11GN;
2883	else if (ic->ic_curmode != IEEE80211_MODE_11B)
2884		raid = R92C_RAID_11BG;
2885	else
2886		raid = R92C_RAID_11B;
2887
2888	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2889		k = ieee80211_crypto_encap(ni, m);
2890		if (k == NULL) {
2891			device_printf(sc->sc_dev,
2892			    "ieee80211_crypto_encap returns NULL.\n");
2893			return (ENOBUFS);
2894		}
2895
2896		/* in case packet header moved, reset pointer */
2897		wh = mtod(m, struct ieee80211_frame *);
2898	}
2899
2900	/* Fill Tx descriptor. */
2901	txd = (struct r92c_tx_desc *)data->buf;
2902	memset(txd, 0, sizeof(*txd));
2903
2904	txd->txdw0 |= htole32(
2905	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2906	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2907	if (ismcast)
2908		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2909
2910	if (!ismcast) {
2911		if (sc->chip & URTWN_CHIP_88E) {
2912			struct urtwn_node *un = URTWN_NODE(ni);
2913			macid = un->id;
2914		} else
2915			macid = URTWN_MACID_BSS;
2916
2917		if (type == IEEE80211_FC0_TYPE_DATA) {
2918			qsel = tid % URTWN_MAX_TID;
2919
2920			if (sc->chip & URTWN_CHIP_88E) {
2921				txd->txdw2 |= htole32(
2922				    R88E_TXDW2_AGGBK |
2923				    R88E_TXDW2_CCX_RPT);
2924			} else
2925				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2926
2927			/* protmode, non-HT */
2928			/* XXX TODO: noack frames? */
2929			if ((rate & 0x80) == 0 &&
2930			    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2931				switch (ic->ic_protmode) {
2932				case IEEE80211_PROT_CTSONLY:
2933					txd->txdw4 |= htole32(
2934					    R92C_TXDW4_CTS2SELF |
2935					    R92C_TXDW4_HWRTSEN);
2936					break;
2937				case IEEE80211_PROT_RTSCTS:
2938					txd->txdw4 |= htole32(
2939					    R92C_TXDW4_RTSEN |
2940					    R92C_TXDW4_HWRTSEN);
2941					break;
2942				default:
2943					break;
2944				}
2945			}
2946
2947			/* protmode, HT */
2948			/* XXX TODO: noack frames? */
2949			if ((rate & 0x80) &&
2950			    (ic->ic_htprotmode == IEEE80211_PROT_RTSCTS)) {
2951				txd->txdw4 |= htole32(
2952				    R92C_TXDW4_RTSEN |
2953				    R92C_TXDW4_HWRTSEN);
2954			}
2955
2956			/* XXX TODO: rtsrate is configurable? 24mbit may
2957			 * be a bit high for RTS rate? */
2958			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2959			    URTWN_RIDX_OFDM24));
2960
2961			txd->txdw5 |= htole32(0x0001ff00);
2962		} else	/* IEEE80211_FC0_TYPE_MGT */
2963			qsel = R92C_TXDW1_QSEL_MGNT;
2964	} else {
2965		macid = URTWN_MACID_BC;
2966		qsel = R92C_TXDW1_QSEL_MGNT;
2967	}
2968
2969	txd->txdw1 |= htole32(
2970	    SM(R92C_TXDW1_QSEL, qsel) |
2971	    SM(R92C_TXDW1_RAID, raid));
2972
2973	/* XXX TODO: 40MHZ flag? */
2974	/* XXX TODO: AMPDU flag? (AGG_ENABLE or AGG_BREAK?) Density shift? */
2975	/* XXX Short preamble? */
2976	/* XXX Short-GI? */
2977
2978	if (sc->chip & URTWN_CHIP_88E)
2979		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2980	else
2981		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2982
2983	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2984
2985	/* Force this rate if needed. */
2986	if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
2987	    (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) ||
2988	    (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
2989		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
2990
2991	if (!hasqos) {
2992		/* Use HW sequence numbering for non-QoS frames. */
2993		if (sc->chip & URTWN_CHIP_88E)
2994			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
2995		else
2996			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2997	} else {
2998		/* Set sequence number. */
2999		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3000	}
3001
3002	if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3003		uint8_t cipher;
3004
3005		switch (k->wk_cipher->ic_cipher) {
3006		case IEEE80211_CIPHER_WEP:
3007		case IEEE80211_CIPHER_TKIP:
3008			cipher = R92C_TXDW1_CIPHER_RC4;
3009			break;
3010		case IEEE80211_CIPHER_AES_CCM:
3011			cipher = R92C_TXDW1_CIPHER_AES;
3012			break;
3013		default:
3014			device_printf(sc->sc_dev, "%s: unknown cipher %d\n",
3015			    __func__, k->wk_cipher->ic_cipher);
3016			return (EINVAL);
3017		}
3018
3019		txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3020	}
3021
3022	if (ieee80211_radiotap_active_vap(vap)) {
3023		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3024
3025		tap->wt_flags = 0;
3026		if (k != NULL)
3027			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3028		ieee80211_radiotap_tx(vap, m);
3029	}
3030
3031	data->ni = ni;
3032
3033	urtwn_tx_start(sc, m, type, data);
3034
3035	return (0);
3036}
3037
3038static int
3039urtwn_tx_raw(struct urtwn_softc *sc, struct ieee80211_node *ni,
3040    struct mbuf *m, struct urtwn_data *data,
3041    const struct ieee80211_bpf_params *params)
3042{
3043	struct ieee80211vap *vap = ni->ni_vap;
3044	struct ieee80211_key *k = NULL;
3045	struct ieee80211_frame *wh;
3046	struct r92c_tx_desc *txd;
3047	uint8_t cipher, ridx, type;
3048
3049	/* Encrypt the frame if need be. */
3050	cipher = R92C_TXDW1_CIPHER_NONE;
3051	if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
3052		/* Retrieve key for TX. */
3053		k = ieee80211_crypto_encap(ni, m);
3054		if (k == NULL)
3055			return (ENOBUFS);
3056
3057		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3058			switch (k->wk_cipher->ic_cipher) {
3059			case IEEE80211_CIPHER_WEP:
3060			case IEEE80211_CIPHER_TKIP:
3061				cipher = R92C_TXDW1_CIPHER_RC4;
3062				break;
3063			case IEEE80211_CIPHER_AES_CCM:
3064				cipher = R92C_TXDW1_CIPHER_AES;
3065				break;
3066			default:
3067				device_printf(sc->sc_dev,
3068				    "%s: unknown cipher %d\n",
3069				    __func__, k->wk_cipher->ic_cipher);
3070				return (EINVAL);
3071			}
3072		}
3073	}
3074
3075	/* XXX TODO: 11n checks, matching urtwn_tx_data() */
3076
3077	wh = mtod(m, struct ieee80211_frame *);
3078	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3079
3080	/* Fill Tx descriptor. */
3081	txd = (struct r92c_tx_desc *)data->buf;
3082	memset(txd, 0, sizeof(*txd));
3083
3084	txd->txdw0 |= htole32(
3085	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
3086	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
3087	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3088		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
3089
3090	if (params->ibp_flags & IEEE80211_BPF_RTS)
3091		txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
3092	if (params->ibp_flags & IEEE80211_BPF_CTS)
3093		txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
3094	if (txd->txdw4 & htole32(R92C_TXDW4_RTSEN | R92C_TXDW4_CTS2SELF)) {
3095		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
3096		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
3097		    URTWN_RIDX_OFDM24));
3098	}
3099
3100	if (sc->chip & URTWN_CHIP_88E)
3101		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
3102	else
3103		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
3104
3105	/* XXX TODO: rate index/config (RAID) for 11n? */
3106	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
3107	txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3108
3109	/* Choose a TX rate index. */
3110	ridx = rate2ridx(params->ibp_rate0);
3111	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3112	txd->txdw5 |= htole32(0x0001ff00);
3113	txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3114
3115	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
3116		/* Use HW sequence numbering for non-QoS frames. */
3117		if (sc->chip & URTWN_CHIP_88E)
3118			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3119		else
3120			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3121	} else {
3122		/* Set sequence number. */
3123		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3124	}
3125
3126	if (ieee80211_radiotap_active_vap(vap)) {
3127		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3128
3129		tap->wt_flags = 0;
3130		if (k != NULL)
3131			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3132		ieee80211_radiotap_tx(vap, m);
3133	}
3134
3135	data->ni = ni;
3136
3137	urtwn_tx_start(sc, m, type, data);
3138
3139	return (0);
3140}
3141
3142static void
3143urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
3144    struct urtwn_data *data)
3145{
3146	struct usb_xfer *xfer;
3147	struct r92c_tx_desc *txd;
3148	uint16_t ac, sum;
3149	int i, xferlen;
3150
3151	URTWN_ASSERT_LOCKED(sc);
3152
3153	ac = M_WME_GETAC(m);
3154
3155	switch (type) {
3156	case IEEE80211_FC0_TYPE_CTL:
3157	case IEEE80211_FC0_TYPE_MGT:
3158		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
3159		break;
3160	default:
3161		xfer = sc->sc_xfer[wme2queue[ac].qid];
3162		break;
3163	}
3164
3165	txd = (struct r92c_tx_desc *)data->buf;
3166	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
3167
3168	/* Compute Tx descriptor checksum. */
3169	sum = 0;
3170	for (i = 0; i < sizeof(*txd) / 2; i++)
3171		sum ^= ((uint16_t *)txd)[i];
3172	txd->txdsum = sum;	/* NB: already little endian. */
3173
3174	xferlen = sizeof(*txd) + m->m_pkthdr.len;
3175	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
3176
3177	data->buflen = xferlen;
3178	data->m = m;
3179
3180	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
3181	usbd_transfer_start(xfer);
3182}
3183
3184static int
3185urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
3186{
3187	struct urtwn_softc *sc = ic->ic_softc;
3188	int error;
3189
3190	URTWN_LOCK(sc);
3191	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
3192		URTWN_UNLOCK(sc);
3193		return (ENXIO);
3194	}
3195	error = mbufq_enqueue(&sc->sc_snd, m);
3196	if (error) {
3197		URTWN_UNLOCK(sc);
3198		return (error);
3199	}
3200	urtwn_start(sc);
3201	URTWN_UNLOCK(sc);
3202
3203	return (0);
3204}
3205
3206static void
3207urtwn_start(struct urtwn_softc *sc)
3208{
3209	struct ieee80211_node *ni;
3210	struct mbuf *m;
3211	struct urtwn_data *bf;
3212
3213	URTWN_ASSERT_LOCKED(sc);
3214	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3215		bf = urtwn_getbuf(sc);
3216		if (bf == NULL) {
3217			mbufq_prepend(&sc->sc_snd, m);
3218			break;
3219		}
3220		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3221		m->m_pkthdr.rcvif = NULL;
3222
3223		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
3224		    __func__,
3225		    m);
3226
3227		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
3228			if_inc_counter(ni->ni_vap->iv_ifp,
3229			    IFCOUNTER_OERRORS, 1);
3230			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3231			m_freem(m);
3232			ieee80211_free_node(ni);
3233			break;
3234		}
3235		sc->sc_txtimer = 5;
3236		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3237	}
3238}
3239
3240static void
3241urtwn_parent(struct ieee80211com *ic)
3242{
3243	struct urtwn_softc *sc = ic->ic_softc;
3244
3245	URTWN_LOCK(sc);
3246	if (sc->sc_flags & URTWN_DETACHED) {
3247		URTWN_UNLOCK(sc);
3248		return;
3249	}
3250	URTWN_UNLOCK(sc);
3251
3252	if (ic->ic_nrunning > 0) {
3253		if (urtwn_init(sc) != 0) {
3254			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3255			if (vap != NULL)
3256				ieee80211_stop(vap);
3257		} else
3258			ieee80211_start_all(ic);
3259	} else
3260		urtwn_stop(sc);
3261}
3262
3263static __inline int
3264urtwn_power_on(struct urtwn_softc *sc)
3265{
3266
3267	return sc->sc_power_on(sc);
3268}
3269
3270static int
3271urtwn_r92c_power_on(struct urtwn_softc *sc)
3272{
3273	uint32_t reg;
3274	usb_error_t error;
3275	int ntries;
3276
3277	/* Wait for autoload done bit. */
3278	for (ntries = 0; ntries < 1000; ntries++) {
3279		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
3280			break;
3281		urtwn_ms_delay(sc);
3282	}
3283	if (ntries == 1000) {
3284		device_printf(sc->sc_dev,
3285		    "timeout waiting for chip autoload\n");
3286		return (ETIMEDOUT);
3287	}
3288
3289	/* Unlock ISO/CLK/Power control register. */
3290	error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
3291	if (error != USB_ERR_NORMAL_COMPLETION)
3292		return (EIO);
3293	/* Move SPS into PWM mode. */
3294	error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
3295	if (error != USB_ERR_NORMAL_COMPLETION)
3296		return (EIO);
3297	urtwn_ms_delay(sc);
3298
3299	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
3300	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
3301		error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3302		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
3303		if (error != USB_ERR_NORMAL_COMPLETION)
3304			return (EIO);
3305		urtwn_ms_delay(sc);
3306		error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3307		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
3308		    ~R92C_SYS_ISO_CTRL_MD2PP);
3309		if (error != USB_ERR_NORMAL_COMPLETION)
3310			return (EIO);
3311	}
3312
3313	/* Auto enable WLAN. */
3314	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3315	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3316	if (error != USB_ERR_NORMAL_COMPLETION)
3317		return (EIO);
3318	for (ntries = 0; ntries < 1000; ntries++) {
3319		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3320		    R92C_APS_FSMCO_APFM_ONMAC))
3321			break;
3322		urtwn_ms_delay(sc);
3323	}
3324	if (ntries == 1000) {
3325		device_printf(sc->sc_dev,
3326		    "timeout waiting for MAC auto ON\n");
3327		return (ETIMEDOUT);
3328	}
3329
3330	/* Enable radio, GPIO and LED functions. */
3331	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3332	    R92C_APS_FSMCO_AFSM_HSUS |
3333	    R92C_APS_FSMCO_PDN_EN |
3334	    R92C_APS_FSMCO_PFM_ALDN);
3335	if (error != USB_ERR_NORMAL_COMPLETION)
3336		return (EIO);
3337	/* Release RF digital isolation. */
3338	error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
3339	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
3340	if (error != USB_ERR_NORMAL_COMPLETION)
3341		return (EIO);
3342
3343	/* Initialize MAC. */
3344	error = urtwn_write_1(sc, R92C_APSD_CTRL,
3345	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
3346	if (error != USB_ERR_NORMAL_COMPLETION)
3347		return (EIO);
3348	for (ntries = 0; ntries < 200; ntries++) {
3349		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
3350		    R92C_APSD_CTRL_OFF_STATUS))
3351			break;
3352		urtwn_ms_delay(sc);
3353	}
3354	if (ntries == 200) {
3355		device_printf(sc->sc_dev,
3356		    "timeout waiting for MAC initialization\n");
3357		return (ETIMEDOUT);
3358	}
3359
3360	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3361	reg = urtwn_read_2(sc, R92C_CR);
3362	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3363	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3364	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3365	    R92C_CR_ENSEC;
3366	error = urtwn_write_2(sc, R92C_CR, reg);
3367	if (error != USB_ERR_NORMAL_COMPLETION)
3368		return (EIO);
3369
3370	error = urtwn_write_1(sc, 0xfe10, 0x19);
3371	if (error != USB_ERR_NORMAL_COMPLETION)
3372		return (EIO);
3373	return (0);
3374}
3375
3376static int
3377urtwn_r88e_power_on(struct urtwn_softc *sc)
3378{
3379	uint32_t reg;
3380	usb_error_t error;
3381	int ntries;
3382
3383	/* Wait for power ready bit. */
3384	for (ntries = 0; ntries < 5000; ntries++) {
3385		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
3386			break;
3387		urtwn_ms_delay(sc);
3388	}
3389	if (ntries == 5000) {
3390		device_printf(sc->sc_dev,
3391		    "timeout waiting for chip power up\n");
3392		return (ETIMEDOUT);
3393	}
3394
3395	/* Reset BB. */
3396	error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3397	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
3398	    R92C_SYS_FUNC_EN_BB_GLB_RST));
3399	if (error != USB_ERR_NORMAL_COMPLETION)
3400		return (EIO);
3401
3402	error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3403	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3404	if (error != USB_ERR_NORMAL_COMPLETION)
3405		return (EIO);
3406
3407	/* Disable HWPDN. */
3408	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3409	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
3410	if (error != USB_ERR_NORMAL_COMPLETION)
3411		return (EIO);
3412
3413	/* Disable WL suspend. */
3414	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3415	    urtwn_read_2(sc, R92C_APS_FSMCO) &
3416	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
3417	if (error != USB_ERR_NORMAL_COMPLETION)
3418		return (EIO);
3419
3420	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3421	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3422	if (error != USB_ERR_NORMAL_COMPLETION)
3423		return (EIO);
3424	for (ntries = 0; ntries < 5000; ntries++) {
3425		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3426		    R92C_APS_FSMCO_APFM_ONMAC))
3427			break;
3428		urtwn_ms_delay(sc);
3429	}
3430	if (ntries == 5000)
3431		return (ETIMEDOUT);
3432
3433	/* Enable LDO normal mode. */
3434	error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
3435	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~R92C_LPLDO_CTRL_SLEEP);
3436	if (error != USB_ERR_NORMAL_COMPLETION)
3437		return (EIO);
3438
3439	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3440	error = urtwn_write_2(sc, R92C_CR, 0);
3441	if (error != USB_ERR_NORMAL_COMPLETION)
3442		return (EIO);
3443	reg = urtwn_read_2(sc, R92C_CR);
3444	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3445	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3446	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
3447	error = urtwn_write_2(sc, R92C_CR, reg);
3448	if (error != USB_ERR_NORMAL_COMPLETION)
3449		return (EIO);
3450
3451	return (0);
3452}
3453
3454static __inline void
3455urtwn_power_off(struct urtwn_softc *sc)
3456{
3457
3458	return sc->sc_power_off(sc);
3459}
3460
3461static void
3462urtwn_r92c_power_off(struct urtwn_softc *sc)
3463{
3464	uint32_t reg;
3465
3466	/* Block all Tx queues. */
3467	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3468
3469	/* Disable RF */
3470	urtwn_rf_write(sc, 0, 0, 0);
3471
3472	urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
3473
3474	/* Reset BB state machine */
3475	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3476	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA |
3477	    R92C_SYS_FUNC_EN_BB_GLB_RST);
3478	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3479	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
3480
3481	/*
3482	 * Reset digital sequence
3483	 */
3484#ifndef URTWN_WITHOUT_UCODE
3485	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
3486		/* Reset MCU ready status */
3487		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3488
3489		/* If firmware in ram code, do reset */
3490		urtwn_fw_reset(sc);
3491	}
3492#endif
3493
3494	/* Reset MAC and Enable 8051 */
3495	urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1,
3496	    (R92C_SYS_FUNC_EN_CPUEN |
3497	     R92C_SYS_FUNC_EN_ELDR |
3498	     R92C_SYS_FUNC_EN_HWPDN) >> 8);
3499
3500	/* Reset MCU ready status */
3501	urtwn_write_1(sc, R92C_MCUFWDL, 0);
3502
3503	/* Disable MAC clock */
3504	urtwn_write_2(sc, R92C_SYS_CLKR,
3505	    R92C_SYS_CLKR_ANAD16V_EN |
3506	    R92C_SYS_CLKR_ANA8M |
3507	    R92C_SYS_CLKR_LOADER_EN |
3508	    R92C_SYS_CLKR_80M_SSC_DIS |
3509	    R92C_SYS_CLKR_SYS_EN |
3510	    R92C_SYS_CLKR_RING_EN |
3511	    0x4000);
3512
3513	/* Disable AFE PLL */
3514	urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80);
3515
3516	/* Gated AFE DIG_CLOCK */
3517	urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880F);
3518
3519	/* Isolated digital to PON */
3520	urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3521	    R92C_SYS_ISO_CTRL_MD2PP |
3522	    R92C_SYS_ISO_CTRL_PA2PCIE |
3523	    R92C_SYS_ISO_CTRL_PD2CORE |
3524	    R92C_SYS_ISO_CTRL_IP2MAC |
3525	    R92C_SYS_ISO_CTRL_DIOP |
3526	    R92C_SYS_ISO_CTRL_DIOE);
3527
3528	/*
3529	 * Pull GPIO PIN to balance level and LED control
3530	 */
3531	/* 1. Disable GPIO[7:0] */
3532	urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000);
3533
3534	reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00;
3535	reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000;
3536	urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg);
3537
3538	/* Disable GPIO[10:8] */
3539	urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00);
3540
3541	reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0;
3542	reg |= (((reg & 0x000f) << 4) | 0x0780);
3543	urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg);
3544
3545	/* Disable LED0 & 1 */
3546	urtwn_write_2(sc, R92C_LEDCFG0, 0x8080);
3547
3548	/*
3549	 * Reset digital sequence
3550	 */
3551	/* Disable ELDR clock */
3552	urtwn_write_2(sc, R92C_SYS_CLKR,
3553	    R92C_SYS_CLKR_ANAD16V_EN |
3554	    R92C_SYS_CLKR_ANA8M |
3555	    R92C_SYS_CLKR_LOADER_EN |
3556	    R92C_SYS_CLKR_80M_SSC_DIS |
3557	    R92C_SYS_CLKR_SYS_EN |
3558	    R92C_SYS_CLKR_RING_EN |
3559	    0x4000);
3560
3561	/* Isolated ELDR to PON */
3562	urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1,
3563	    (R92C_SYS_ISO_CTRL_DIOR |
3564	     R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8);
3565
3566	/*
3567	 * Disable analog sequence
3568	 */
3569	/* Disable A15 power */
3570	urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF);
3571	/* Disable digital core power */
3572	urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3573	    urtwn_read_1(sc, R92C_LDOV12D_CTRL) &
3574	      ~R92C_LDOV12D_CTRL_LDV12_EN);
3575
3576	/* Enter PFM mode */
3577	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
3578
3579	/* Set USB suspend */
3580	urtwn_write_2(sc, R92C_APS_FSMCO,
3581	    R92C_APS_FSMCO_APDM_HOST |
3582	    R92C_APS_FSMCO_AFSM_HSUS |
3583	    R92C_APS_FSMCO_PFM_ALDN);
3584
3585	/* Lock ISO/CLK/Power control register. */
3586	urtwn_write_1(sc, R92C_RSV_CTRL, 0x0E);
3587}
3588
3589static void
3590urtwn_r88e_power_off(struct urtwn_softc *sc)
3591{
3592	uint8_t reg;
3593	int ntries;
3594
3595	/* Disable any kind of TX reports. */
3596	urtwn_write_1(sc, R88E_TX_RPT_CTRL,
3597	    urtwn_read_1(sc, R88E_TX_RPT_CTRL) &
3598	      ~(R88E_TX_RPT1_ENA | R88E_TX_RPT2_ENA));
3599
3600	/* Stop Rx. */
3601	urtwn_write_1(sc, R92C_CR, 0);
3602
3603	/* Move card to Low Power State. */
3604	/* Block all Tx queues. */
3605	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3606
3607	for (ntries = 0; ntries < 20; ntries++) {
3608		/* Should be zero if no packet is transmitting. */
3609		if (urtwn_read_4(sc, R88E_SCH_TXCMD) == 0)
3610			break;
3611
3612		urtwn_ms_delay(sc);
3613	}
3614	if (ntries == 20) {
3615		device_printf(sc->sc_dev, "%s: failed to block Tx queues\n",
3616		    __func__);
3617		return;
3618	}
3619
3620	/* CCK and OFDM are disabled, and clock are gated. */
3621	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3622	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~R92C_SYS_FUNC_EN_BBRSTB);
3623
3624	urtwn_ms_delay(sc);
3625
3626	/* Reset MAC TRX */
3627	urtwn_write_1(sc, R92C_CR,
3628	    R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3629	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN |
3630	    R92C_CR_PROTOCOL_EN | R92C_CR_SCHEDULE_EN);
3631
3632	/* check if removed later */
3633	urtwn_write_1(sc, R92C_CR + 1,
3634	    urtwn_read_1(sc, R92C_CR + 1) & ~(R92C_CR_ENSEC >> 8));
3635
3636	/* Respond TxOK to scheduler */
3637	urtwn_write_1(sc, R92C_DUAL_TSF_RST,
3638	    urtwn_read_1(sc, R92C_DUAL_TSF_RST) | 0x20);
3639
3640	/* If firmware in ram code, do reset. */
3641#ifndef URTWN_WITHOUT_UCODE
3642	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY)
3643		urtwn_r88e_fw_reset(sc);
3644#endif
3645
3646	/* Reset MCU ready status. */
3647	urtwn_write_1(sc, R92C_MCUFWDL, 0x00);
3648
3649	/* Disable 32k. */
3650	urtwn_write_1(sc, R88E_32K_CTRL,
3651	    urtwn_read_1(sc, R88E_32K_CTRL) & ~0x01);
3652
3653	/* Move card to Disabled state. */
3654	/* Turn off RF. */
3655	urtwn_write_1(sc, R92C_RF_CTRL, 0);
3656
3657	/* LDO Sleep mode. */
3658	urtwn_write_1(sc, R92C_LPLDO_CTRL,
3659	    urtwn_read_1(sc, R92C_LPLDO_CTRL) | R92C_LPLDO_CTRL_SLEEP);
3660
3661	/* Turn off MAC by HW state machine */
3662	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3663	    urtwn_read_1(sc, R92C_APS_FSMCO + 1) |
3664	    (R92C_APS_FSMCO_APFM_OFF >> 8));
3665
3666	for (ntries = 0; ntries < 20; ntries++) {
3667		/* Wait until it will be disabled. */
3668		if ((urtwn_read_1(sc, R92C_APS_FSMCO + 1) &
3669		    (R92C_APS_FSMCO_APFM_OFF >> 8)) == 0)
3670			break;
3671
3672		urtwn_ms_delay(sc);
3673	}
3674	if (ntries == 20) {
3675		device_printf(sc->sc_dev, "%s: could not turn off MAC\n",
3676		    __func__);
3677		return;
3678	}
3679
3680	/* schmit trigger */
3681	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3682	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3683
3684	/* Enable WL suspend. */
3685	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3686	    (urtwn_read_1(sc, R92C_APS_FSMCO + 1) & ~0x10) | 0x08);
3687
3688	/* Enable bandgap mbias in suspend. */
3689	urtwn_write_1(sc, R92C_APS_FSMCO + 3, 0);
3690
3691	/* Clear SIC_EN register. */
3692	urtwn_write_1(sc, R92C_GPIO_MUXCFG + 1,
3693	    urtwn_read_1(sc, R92C_GPIO_MUXCFG + 1) & ~0x10);
3694
3695	/* Set USB suspend enable local register */
3696	urtwn_write_1(sc, R92C_USB_SUSPEND,
3697	    urtwn_read_1(sc, R92C_USB_SUSPEND) | 0x10);
3698
3699	/* Reset MCU IO Wrapper. */
3700	reg = urtwn_read_1(sc, R92C_RSV_CTRL + 1);
3701	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg & ~0x08);
3702	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg | 0x08);
3703
3704	/* marked as 'For Power Consumption' code. */
3705	urtwn_write_1(sc, R92C_GPIO_OUT, urtwn_read_1(sc, R92C_GPIO_IN));
3706	urtwn_write_1(sc, R92C_GPIO_IOSEL, 0xff);
3707
3708	urtwn_write_1(sc, R92C_GPIO_IO_SEL,
3709	    urtwn_read_1(sc, R92C_GPIO_IO_SEL) << 4);
3710	urtwn_write_1(sc, R92C_GPIO_MOD,
3711	    urtwn_read_1(sc, R92C_GPIO_MOD) | 0x0f);
3712
3713	/* Set LNA, TRSW, EX_PA Pin to output mode. */
3714	urtwn_write_4(sc, R88E_BB_PAD_CTRL, 0x00080808);
3715}
3716
3717static int
3718urtwn_llt_init(struct urtwn_softc *sc)
3719{
3720	int i, error, page_count, pktbuf_count;
3721
3722	page_count = (sc->chip & URTWN_CHIP_88E) ?
3723	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
3724	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
3725	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
3726
3727	/* Reserve pages [0; page_count]. */
3728	for (i = 0; i < page_count; i++) {
3729		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3730			return (error);
3731	}
3732	/* NB: 0xff indicates end-of-list. */
3733	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
3734		return (error);
3735	/*
3736	 * Use pages [page_count + 1; pktbuf_count - 1]
3737	 * as ring buffer.
3738	 */
3739	for (++i; i < pktbuf_count - 1; i++) {
3740		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3741			return (error);
3742	}
3743	/* Make the last page point to the beginning of the ring buffer. */
3744	error = urtwn_llt_write(sc, i, page_count + 1);
3745	return (error);
3746}
3747
3748#ifndef URTWN_WITHOUT_UCODE
3749static void
3750urtwn_fw_reset(struct urtwn_softc *sc)
3751{
3752	uint16_t reg;
3753	int ntries;
3754
3755	/* Tell 8051 to reset itself. */
3756	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
3757
3758	/* Wait until 8051 resets by itself. */
3759	for (ntries = 0; ntries < 100; ntries++) {
3760		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3761		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
3762			return;
3763		urtwn_ms_delay(sc);
3764	}
3765	/* Force 8051 reset. */
3766	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3767}
3768
3769static void
3770urtwn_r88e_fw_reset(struct urtwn_softc *sc)
3771{
3772	uint16_t reg;
3773
3774	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3775	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3776	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
3777}
3778
3779static int
3780urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
3781{
3782	uint32_t reg;
3783	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
3784	int off, mlen;
3785
3786	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3787	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
3788	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3789
3790	off = R92C_FW_START_ADDR;
3791	while (len > 0) {
3792		if (len > 196)
3793			mlen = 196;
3794		else if (len > 4)
3795			mlen = 4;
3796		else
3797			mlen = 1;
3798		/* XXX fix this deconst */
3799		error = urtwn_write_region_1(sc, off,
3800		    __DECONST(uint8_t *, buf), mlen);
3801		if (error != USB_ERR_NORMAL_COMPLETION)
3802			break;
3803		off += mlen;
3804		buf += mlen;
3805		len -= mlen;
3806	}
3807	return (error);
3808}
3809
3810static int
3811urtwn_load_firmware(struct urtwn_softc *sc)
3812{
3813	const struct firmware *fw;
3814	const struct r92c_fw_hdr *hdr;
3815	const char *imagename;
3816	const u_char *ptr;
3817	size_t len;
3818	uint32_t reg;
3819	int mlen, ntries, page, error;
3820
3821	URTWN_UNLOCK(sc);
3822	/* Read firmware image from the filesystem. */
3823	if (sc->chip & URTWN_CHIP_88E)
3824		imagename = "urtwn-rtl8188eufw";
3825	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3826		    URTWN_CHIP_UMC_A_CUT)
3827		imagename = "urtwn-rtl8192cfwU";
3828	else
3829		imagename = "urtwn-rtl8192cfwT";
3830
3831	fw = firmware_get(imagename);
3832	URTWN_LOCK(sc);
3833	if (fw == NULL) {
3834		device_printf(sc->sc_dev,
3835		    "failed loadfirmware of file %s\n", imagename);
3836		return (ENOENT);
3837	}
3838
3839	len = fw->datasize;
3840
3841	if (len < sizeof(*hdr)) {
3842		device_printf(sc->sc_dev, "firmware too short\n");
3843		error = EINVAL;
3844		goto fail;
3845	}
3846	ptr = fw->data;
3847	hdr = (const struct r92c_fw_hdr *)ptr;
3848	/* Check if there is a valid FW header and skip it. */
3849	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
3850	    (le16toh(hdr->signature) >> 4) == 0x88e ||
3851	    (le16toh(hdr->signature) >> 4) == 0x92c) {
3852		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE,
3853		    "FW V%d.%d %02d-%02d %02d:%02d\n",
3854		    le16toh(hdr->version), le16toh(hdr->subversion),
3855		    hdr->month, hdr->date, hdr->hour, hdr->minute);
3856		ptr += sizeof(*hdr);
3857		len -= sizeof(*hdr);
3858	}
3859
3860	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
3861		if (sc->chip & URTWN_CHIP_88E)
3862			urtwn_r88e_fw_reset(sc);
3863		else
3864			urtwn_fw_reset(sc);
3865		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3866	}
3867
3868	if (!(sc->chip & URTWN_CHIP_88E)) {
3869		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3870		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3871		    R92C_SYS_FUNC_EN_CPUEN);
3872	}
3873	urtwn_write_1(sc, R92C_MCUFWDL,
3874	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
3875	urtwn_write_1(sc, R92C_MCUFWDL + 2,
3876	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
3877
3878	/* Reset the FWDL checksum. */
3879	urtwn_write_1(sc, R92C_MCUFWDL,
3880	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
3881
3882	for (page = 0; len > 0; page++) {
3883		mlen = min(len, R92C_FW_PAGE_SIZE);
3884		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
3885		if (error != 0) {
3886			device_printf(sc->sc_dev,
3887			    "could not load firmware page\n");
3888			goto fail;
3889		}
3890		ptr += mlen;
3891		len -= mlen;
3892	}
3893	urtwn_write_1(sc, R92C_MCUFWDL,
3894	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
3895	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
3896
3897	/* Wait for checksum report. */
3898	for (ntries = 0; ntries < 1000; ntries++) {
3899		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
3900			break;
3901		urtwn_ms_delay(sc);
3902	}
3903	if (ntries == 1000) {
3904		device_printf(sc->sc_dev,
3905		    "timeout waiting for checksum report\n");
3906		error = ETIMEDOUT;
3907		goto fail;
3908	}
3909
3910	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3911	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
3912	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3913	if (sc->chip & URTWN_CHIP_88E)
3914		urtwn_r88e_fw_reset(sc);
3915	/* Wait for firmware readiness. */
3916	for (ntries = 0; ntries < 1000; ntries++) {
3917		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3918			break;
3919		urtwn_ms_delay(sc);
3920	}
3921	if (ntries == 1000) {
3922		device_printf(sc->sc_dev,
3923		    "timeout waiting for firmware readiness\n");
3924		error = ETIMEDOUT;
3925		goto fail;
3926	}
3927fail:
3928	firmware_put(fw, FIRMWARE_UNLOAD);
3929	return (error);
3930}
3931#endif
3932
3933static int
3934urtwn_dma_init(struct urtwn_softc *sc)
3935{
3936	struct usb_endpoint *ep, *ep_end;
3937	usb_error_t usb_err;
3938	uint32_t reg;
3939	int hashq, hasnq, haslq, nqueues, ntx;
3940	int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3941
3942	/* Initialize LLT table. */
3943	error = urtwn_llt_init(sc);
3944	if (error != 0)
3945		return (error);
3946
3947	/* Determine the number of bulk-out pipes. */
3948	ntx = 0;
3949	ep = sc->sc_udev->endpoints;
3950	ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
3951	for (; ep != ep_end; ep++) {
3952		if ((ep->edesc == NULL) ||
3953		    (ep->iface_index != sc->sc_iface_index))
3954			continue;
3955		if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
3956			ntx++;
3957	}
3958	if (ntx == 0) {
3959		device_printf(sc->sc_dev,
3960		    "%d: invalid number of Tx bulk pipes\n", ntx);
3961		return (EIO);
3962	}
3963
3964	/* Get Tx queues to USB endpoints mapping. */
3965	hashq = hasnq = haslq = nqueues = 0;
3966	switch (ntx) {
3967	case 1: hashq = 1; break;
3968	case 2: hashq = hasnq = 1; break;
3969	case 3: case 4: hashq = hasnq = haslq = 1; break;
3970	}
3971	nqueues = hashq + hasnq + haslq;
3972	if (nqueues == 0)
3973		return (EIO);
3974
3975	npubqpages = nqpages = nrempages = pagecount = 0;
3976	if (sc->chip & URTWN_CHIP_88E)
3977		tx_boundary = R88E_TX_PAGE_BOUNDARY;
3978	else {
3979		pagecount = R92C_TX_PAGE_COUNT;
3980		npubqpages = R92C_PUBQ_NPAGES;
3981		tx_boundary = R92C_TX_PAGE_BOUNDARY;
3982	}
3983
3984	/* Set number of pages for normal priority queue. */
3985	if (sc->chip & URTWN_CHIP_88E) {
3986		usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
3987		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3988			return (EIO);
3989		usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
3990		if (usb_err != USB_ERR_NORMAL_COMPLETION)
3991			return (EIO);
3992	} else {
3993		/* Get the number of pages for each queue. */
3994		nqpages = (pagecount - npubqpages) / nqueues;
3995		/*
3996		 * The remaining pages are assigned to the high priority
3997		 * queue.
3998		 */
3999		nrempages = (pagecount - npubqpages) % nqueues;
4000		usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
4001		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4002			return (EIO);
4003		usb_err = urtwn_write_4(sc, R92C_RQPN,
4004		    /* Set number of pages for public queue. */
4005		    SM(R92C_RQPN_PUBQ, npubqpages) |
4006		    /* Set number of pages for high priority queue. */
4007		    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
4008		    /* Set number of pages for low priority queue. */
4009		    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
4010		    /* Load values. */
4011		    R92C_RQPN_LD);
4012		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4013			return (EIO);
4014	}
4015
4016	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
4017	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4018		return (EIO);
4019	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
4020	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4021		return (EIO);
4022	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
4023	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4024		return (EIO);
4025	usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
4026	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4027		return (EIO);
4028	usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
4029	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4030		return (EIO);
4031
4032	/* Set queue to USB pipe mapping. */
4033	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
4034	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
4035	if (nqueues == 1) {
4036		if (hashq)
4037			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
4038		else if (hasnq)
4039			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
4040		else
4041			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
4042	} else if (nqueues == 2) {
4043		/*
4044		 * All 2-endpoints configs have high and normal
4045		 * priority queues.
4046		 */
4047		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
4048	} else
4049		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
4050	usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
4051	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4052		return (EIO);
4053
4054	/* Set Tx/Rx transfer page boundary. */
4055	usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
4056	    (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
4057	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4058		return (EIO);
4059
4060	/* Set Tx/Rx transfer page size. */
4061	usb_err = urtwn_write_1(sc, R92C_PBP,
4062	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
4063	    SM(R92C_PBP_PSTX, R92C_PBP_128));
4064	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4065		return (EIO);
4066
4067	return (0);
4068}
4069
4070static int
4071urtwn_mac_init(struct urtwn_softc *sc)
4072{
4073	usb_error_t error;
4074	int i;
4075
4076	/* Write MAC initialization values. */
4077	if (sc->chip & URTWN_CHIP_88E) {
4078		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
4079			error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
4080			    rtl8188eu_mac[i].val);
4081			if (error != USB_ERR_NORMAL_COMPLETION)
4082				return (EIO);
4083		}
4084		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
4085	} else {
4086		for (i = 0; i < nitems(rtl8192cu_mac); i++)
4087			error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
4088			    rtl8192cu_mac[i].val);
4089			if (error != USB_ERR_NORMAL_COMPLETION)
4090				return (EIO);
4091	}
4092
4093	return (0);
4094}
4095
4096static void
4097urtwn_bb_init(struct urtwn_softc *sc)
4098{
4099	const struct urtwn_bb_prog *prog;
4100	uint32_t reg;
4101	uint8_t crystalcap;
4102	int i;
4103
4104	/* Enable BB and RF. */
4105	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
4106	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
4107	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
4108	    R92C_SYS_FUNC_EN_DIO_RF);
4109
4110	if (!(sc->chip & URTWN_CHIP_88E))
4111		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
4112
4113	urtwn_write_1(sc, R92C_RF_CTRL,
4114	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
4115	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
4116	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
4117	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
4118
4119	if (!(sc->chip & URTWN_CHIP_88E)) {
4120		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
4121		urtwn_write_1(sc, 0x15, 0xe9);
4122		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
4123	}
4124
4125	/* Select BB programming based on board type. */
4126	if (sc->chip & URTWN_CHIP_88E)
4127		prog = &rtl8188eu_bb_prog;
4128	else if (!(sc->chip & URTWN_CHIP_92C)) {
4129		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4130			prog = &rtl8188ce_bb_prog;
4131		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4132			prog = &rtl8188ru_bb_prog;
4133		else
4134			prog = &rtl8188cu_bb_prog;
4135	} else {
4136		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4137			prog = &rtl8192ce_bb_prog;
4138		else
4139			prog = &rtl8192cu_bb_prog;
4140	}
4141	/* Write BB initialization values. */
4142	for (i = 0; i < prog->count; i++) {
4143		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
4144		urtwn_ms_delay(sc);
4145	}
4146
4147	if (sc->chip & URTWN_CHIP_92C_1T2R) {
4148		/* 8192C 1T only configuration. */
4149		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
4150		reg = (reg & ~0x00000003) | 0x2;
4151		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
4152
4153		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
4154		reg = (reg & ~0x00300033) | 0x00200022;
4155		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
4156
4157		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
4158		reg = (reg & ~0xff000000) | 0x45 << 24;
4159		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
4160
4161		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
4162		reg = (reg & ~0x000000ff) | 0x23;
4163		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
4164
4165		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
4166		reg = (reg & ~0x00000030) | 1 << 4;
4167		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
4168
4169		reg = urtwn_bb_read(sc, 0xe74);
4170		reg = (reg & ~0x0c000000) | 2 << 26;
4171		urtwn_bb_write(sc, 0xe74, reg);
4172		reg = urtwn_bb_read(sc, 0xe78);
4173		reg = (reg & ~0x0c000000) | 2 << 26;
4174		urtwn_bb_write(sc, 0xe78, reg);
4175		reg = urtwn_bb_read(sc, 0xe7c);
4176		reg = (reg & ~0x0c000000) | 2 << 26;
4177		urtwn_bb_write(sc, 0xe7c, reg);
4178		reg = urtwn_bb_read(sc, 0xe80);
4179		reg = (reg & ~0x0c000000) | 2 << 26;
4180		urtwn_bb_write(sc, 0xe80, reg);
4181		reg = urtwn_bb_read(sc, 0xe88);
4182		reg = (reg & ~0x0c000000) | 2 << 26;
4183		urtwn_bb_write(sc, 0xe88, reg);
4184	}
4185
4186	/* Write AGC values. */
4187	for (i = 0; i < prog->agccount; i++) {
4188		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
4189		    prog->agcvals[i]);
4190		urtwn_ms_delay(sc);
4191	}
4192
4193	if (sc->chip & URTWN_CHIP_88E) {
4194		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
4195		urtwn_ms_delay(sc);
4196		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
4197		urtwn_ms_delay(sc);
4198
4199		crystalcap = sc->rom.r88e_rom.crystalcap;
4200		if (crystalcap == 0xff)
4201			crystalcap = 0x20;
4202		crystalcap &= 0x3f;
4203		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
4204		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
4205		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
4206		    crystalcap | crystalcap << 6));
4207	} else {
4208		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
4209		    R92C_HSSI_PARAM2_CCK_HIPWR)
4210			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
4211	}
4212}
4213
4214static void
4215urtwn_rf_init(struct urtwn_softc *sc)
4216{
4217	const struct urtwn_rf_prog *prog;
4218	uint32_t reg, type;
4219	int i, j, idx, off;
4220
4221	/* Select RF programming based on board type. */
4222	if (sc->chip & URTWN_CHIP_88E)
4223		prog = rtl8188eu_rf_prog;
4224	else if (!(sc->chip & URTWN_CHIP_92C)) {
4225		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4226			prog = rtl8188ce_rf_prog;
4227		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4228			prog = rtl8188ru_rf_prog;
4229		else
4230			prog = rtl8188cu_rf_prog;
4231	} else
4232		prog = rtl8192ce_rf_prog;
4233
4234	for (i = 0; i < sc->nrxchains; i++) {
4235		/* Save RF_ENV control type. */
4236		idx = i / 2;
4237		off = (i % 2) * 16;
4238		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4239		type = (reg >> off) & 0x10;
4240
4241		/* Set RF_ENV enable. */
4242		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4243		reg |= 0x100000;
4244		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4245		urtwn_ms_delay(sc);
4246		/* Set RF_ENV output high. */
4247		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4248		reg |= 0x10;
4249		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4250		urtwn_ms_delay(sc);
4251		/* Set address and data lengths of RF registers. */
4252		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4253		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
4254		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4255		urtwn_ms_delay(sc);
4256		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4257		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
4258		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4259		urtwn_ms_delay(sc);
4260
4261		/* Write RF initialization values for this chain. */
4262		for (j = 0; j < prog[i].count; j++) {
4263			if (prog[i].regs[j] >= 0xf9 &&
4264			    prog[i].regs[j] <= 0xfe) {
4265				/*
4266				 * These are fake RF registers offsets that
4267				 * indicate a delay is required.
4268				 */
4269				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
4270				continue;
4271			}
4272			urtwn_rf_write(sc, i, prog[i].regs[j],
4273			    prog[i].vals[j]);
4274			urtwn_ms_delay(sc);
4275		}
4276
4277		/* Restore RF_ENV control type. */
4278		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4279		reg &= ~(0x10 << off) | (type << off);
4280		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
4281
4282		/* Cache RF register CHNLBW. */
4283		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
4284	}
4285
4286	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
4287	    URTWN_CHIP_UMC_A_CUT) {
4288		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
4289		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
4290	}
4291}
4292
4293static void
4294urtwn_cam_init(struct urtwn_softc *sc)
4295{
4296	/* Invalidate all CAM entries. */
4297	urtwn_write_4(sc, R92C_CAMCMD,
4298	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
4299}
4300
4301static int
4302urtwn_cam_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
4303{
4304	usb_error_t error;
4305
4306	error = urtwn_write_4(sc, R92C_CAMWRITE, data);
4307	if (error != USB_ERR_NORMAL_COMPLETION)
4308		return (EIO);
4309	error = urtwn_write_4(sc, R92C_CAMCMD,
4310	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
4311	    SM(R92C_CAMCMD_ADDR, addr));
4312	if (error != USB_ERR_NORMAL_COMPLETION)
4313		return (EIO);
4314
4315	return (0);
4316}
4317
4318static void
4319urtwn_pa_bias_init(struct urtwn_softc *sc)
4320{
4321	uint8_t reg;
4322	int i;
4323
4324	for (i = 0; i < sc->nrxchains; i++) {
4325		if (sc->pa_setting & (1 << i))
4326			continue;
4327		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
4328		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
4329		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
4330		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
4331	}
4332	if (!(sc->pa_setting & 0x10)) {
4333		reg = urtwn_read_1(sc, 0x16);
4334		reg = (reg & ~0xf0) | 0x90;
4335		urtwn_write_1(sc, 0x16, reg);
4336	}
4337}
4338
4339static void
4340urtwn_rxfilter_init(struct urtwn_softc *sc)
4341{
4342	struct ieee80211com *ic = &sc->sc_ic;
4343	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4344	uint32_t rcr;
4345	uint16_t filter;
4346
4347	URTWN_ASSERT_LOCKED(sc);
4348
4349	/* Accept all multicast frames. */
4350	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
4351	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
4352
4353	/* Filter for management frames. */
4354	filter = 0x7f3f;
4355	switch (vap->iv_opmode) {
4356	case IEEE80211_M_STA:
4357		filter &= ~(
4358		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
4359		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
4360		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
4361		break;
4362	case IEEE80211_M_HOSTAP:
4363		filter &= ~(
4364		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
4365		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP));
4366		break;
4367	case IEEE80211_M_MONITOR:
4368	case IEEE80211_M_IBSS:
4369		break;
4370	default:
4371		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4372		    __func__, vap->iv_opmode);
4373		break;
4374	}
4375	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
4376
4377	/* Reject all control frames. */
4378	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
4379
4380	/* Reject all data frames. */
4381	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
4382
4383	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
4384	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
4385	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
4386
4387	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
4388		/* Accept all frames. */
4389		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
4390		       R92C_RCR_AAP;
4391	}
4392
4393	/* Set Rx filter. */
4394	urtwn_write_4(sc, R92C_RCR, rcr);
4395
4396	if (ic->ic_promisc != 0) {
4397		/* Update Rx filter. */
4398		urtwn_set_promisc(sc);
4399	}
4400}
4401
4402static void
4403urtwn_edca_init(struct urtwn_softc *sc)
4404{
4405	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
4406	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
4407	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
4408	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
4409	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
4410	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
4411	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
4412	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
4413}
4414
4415static void
4416urtwn_write_txpower(struct urtwn_softc *sc, int chain,
4417    uint16_t power[URTWN_RIDX_COUNT])
4418{
4419	uint32_t reg;
4420
4421	/* Write per-CCK rate Tx power. */
4422	if (chain == 0) {
4423		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
4424		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
4425		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
4426		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4427		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
4428		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
4429		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
4430		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4431	} else {
4432		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
4433		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
4434		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
4435		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
4436		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
4437		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4438		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
4439		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4440	}
4441	/* Write per-OFDM rate Tx power. */
4442	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
4443	    SM(R92C_TXAGC_RATE06, power[ 4]) |
4444	    SM(R92C_TXAGC_RATE09, power[ 5]) |
4445	    SM(R92C_TXAGC_RATE12, power[ 6]) |
4446	    SM(R92C_TXAGC_RATE18, power[ 7]));
4447	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
4448	    SM(R92C_TXAGC_RATE24, power[ 8]) |
4449	    SM(R92C_TXAGC_RATE36, power[ 9]) |
4450	    SM(R92C_TXAGC_RATE48, power[10]) |
4451	    SM(R92C_TXAGC_RATE54, power[11]));
4452	/* Write per-MCS Tx power. */
4453	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
4454	    SM(R92C_TXAGC_MCS00,  power[12]) |
4455	    SM(R92C_TXAGC_MCS01,  power[13]) |
4456	    SM(R92C_TXAGC_MCS02,  power[14]) |
4457	    SM(R92C_TXAGC_MCS03,  power[15]));
4458	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
4459	    SM(R92C_TXAGC_MCS04,  power[16]) |
4460	    SM(R92C_TXAGC_MCS05,  power[17]) |
4461	    SM(R92C_TXAGC_MCS06,  power[18]) |
4462	    SM(R92C_TXAGC_MCS07,  power[19]));
4463	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
4464	    SM(R92C_TXAGC_MCS08,  power[20]) |
4465	    SM(R92C_TXAGC_MCS09,  power[21]) |
4466	    SM(R92C_TXAGC_MCS10,  power[22]) |
4467	    SM(R92C_TXAGC_MCS11,  power[23]));
4468	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
4469	    SM(R92C_TXAGC_MCS12,  power[24]) |
4470	    SM(R92C_TXAGC_MCS13,  power[25]) |
4471	    SM(R92C_TXAGC_MCS14,  power[26]) |
4472	    SM(R92C_TXAGC_MCS15,  power[27]));
4473}
4474
4475static void
4476urtwn_get_txpower(struct urtwn_softc *sc, int chain,
4477    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4478    uint16_t power[URTWN_RIDX_COUNT])
4479{
4480	struct ieee80211com *ic = &sc->sc_ic;
4481	struct r92c_rom *rom = &sc->rom.r92c_rom;
4482	uint16_t cckpow, ofdmpow, htpow, diff, max;
4483	const struct urtwn_txpwr *base;
4484	int ridx, chan, group;
4485
4486	/* Determine channel group. */
4487	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4488	if (chan <= 3)
4489		group = 0;
4490	else if (chan <= 9)
4491		group = 1;
4492	else
4493		group = 2;
4494
4495	/* Get original Tx power based on board type and RF chain. */
4496	if (!(sc->chip & URTWN_CHIP_92C)) {
4497		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4498			base = &rtl8188ru_txagc[chain];
4499		else
4500			base = &rtl8192cu_txagc[chain];
4501	} else
4502		base = &rtl8192cu_txagc[chain];
4503
4504	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4505	if (sc->regulatory == 0) {
4506		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4507			power[ridx] = base->pwr[0][ridx];
4508	}
4509	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4510		if (sc->regulatory == 3) {
4511			power[ridx] = base->pwr[0][ridx];
4512			/* Apply vendor limits. */
4513			if (extc != NULL)
4514				max = rom->ht40_max_pwr[group];
4515			else
4516				max = rom->ht20_max_pwr[group];
4517			max = (max >> (chain * 4)) & 0xf;
4518			if (power[ridx] > max)
4519				power[ridx] = max;
4520		} else if (sc->regulatory == 1) {
4521			if (extc == NULL)
4522				power[ridx] = base->pwr[group][ridx];
4523		} else if (sc->regulatory != 2)
4524			power[ridx] = base->pwr[0][ridx];
4525	}
4526
4527	/* Compute per-CCK rate Tx power. */
4528	cckpow = rom->cck_tx_pwr[chain][group];
4529	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4530		power[ridx] += cckpow;
4531		if (power[ridx] > R92C_MAX_TX_PWR)
4532			power[ridx] = R92C_MAX_TX_PWR;
4533	}
4534
4535	htpow = rom->ht40_1s_tx_pwr[chain][group];
4536	if (sc->ntxchains > 1) {
4537		/* Apply reduction for 2 spatial streams. */
4538		diff = rom->ht40_2s_tx_pwr_diff[group];
4539		diff = (diff >> (chain * 4)) & 0xf;
4540		htpow = (htpow > diff) ? htpow - diff : 0;
4541	}
4542
4543	/* Compute per-OFDM rate Tx power. */
4544	diff = rom->ofdm_tx_pwr_diff[group];
4545	diff = (diff >> (chain * 4)) & 0xf;
4546	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
4547	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4548		power[ridx] += ofdmpow;
4549		if (power[ridx] > R92C_MAX_TX_PWR)
4550			power[ridx] = R92C_MAX_TX_PWR;
4551	}
4552
4553	/* Compute per-MCS Tx power. */
4554	if (extc == NULL) {
4555		diff = rom->ht20_tx_pwr_diff[group];
4556		diff = (diff >> (chain * 4)) & 0xf;
4557		htpow += diff;	/* HT40->HT20 correction. */
4558	}
4559	for (ridx = 12; ridx <= 27; ridx++) {
4560		power[ridx] += htpow;
4561		if (power[ridx] > R92C_MAX_TX_PWR)
4562			power[ridx] = R92C_MAX_TX_PWR;
4563	}
4564#ifdef USB_DEBUG
4565	if (sc->sc_debug & URTWN_DEBUG_TXPWR) {
4566		/* Dump per-rate Tx power values. */
4567		printf("Tx power for chain %d:\n", chain);
4568		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
4569			printf("Rate %d = %u\n", ridx, power[ridx]);
4570	}
4571#endif
4572}
4573
4574static void
4575urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
4576    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4577    uint16_t power[URTWN_RIDX_COUNT])
4578{
4579	struct ieee80211com *ic = &sc->sc_ic;
4580	struct r88e_rom *rom = &sc->rom.r88e_rom;
4581	uint16_t cckpow, ofdmpow, bw20pow, htpow;
4582	const struct urtwn_r88e_txpwr *base;
4583	int ridx, chan, group;
4584
4585	/* Determine channel group. */
4586	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4587	if (chan <= 2)
4588		group = 0;
4589	else if (chan <= 5)
4590		group = 1;
4591	else if (chan <= 8)
4592		group = 2;
4593	else if (chan <= 11)
4594		group = 3;
4595	else if (chan <= 13)
4596		group = 4;
4597	else
4598		group = 5;
4599
4600	/* Get original Tx power based on board type and RF chain. */
4601	base = &rtl8188eu_txagc[chain];
4602
4603	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4604	if (sc->regulatory == 0) {
4605		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4606			power[ridx] = base->pwr[0][ridx];
4607	}
4608	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4609		if (sc->regulatory == 3)
4610			power[ridx] = base->pwr[0][ridx];
4611		else if (sc->regulatory == 1) {
4612			if (extc == NULL)
4613				power[ridx] = base->pwr[group][ridx];
4614		} else if (sc->regulatory != 2)
4615			power[ridx] = base->pwr[0][ridx];
4616	}
4617
4618	/* Compute per-CCK rate Tx power. */
4619	cckpow = rom->cck_tx_pwr[group];
4620	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4621		power[ridx] += cckpow;
4622		if (power[ridx] > R92C_MAX_TX_PWR)
4623			power[ridx] = R92C_MAX_TX_PWR;
4624	}
4625
4626	htpow = rom->ht40_tx_pwr[group];
4627
4628	/* Compute per-OFDM rate Tx power. */
4629	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
4630	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4631		power[ridx] += ofdmpow;
4632		if (power[ridx] > R92C_MAX_TX_PWR)
4633			power[ridx] = R92C_MAX_TX_PWR;
4634	}
4635
4636	bw20pow = htpow + sc->bw20_tx_pwr_diff;
4637	for (ridx = 12; ridx <= 27; ridx++) {
4638		power[ridx] += bw20pow;
4639		if (power[ridx] > R92C_MAX_TX_PWR)
4640			power[ridx] = R92C_MAX_TX_PWR;
4641	}
4642}
4643
4644static void
4645urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
4646    struct ieee80211_channel *extc)
4647{
4648	uint16_t power[URTWN_RIDX_COUNT];
4649	int i;
4650
4651	for (i = 0; i < sc->ntxchains; i++) {
4652		/* Compute per-rate Tx power values. */
4653		if (sc->chip & URTWN_CHIP_88E)
4654			urtwn_r88e_get_txpower(sc, i, c, extc, power);
4655		else
4656			urtwn_get_txpower(sc, i, c, extc, power);
4657		/* Write per-rate Tx power values to hardware. */
4658		urtwn_write_txpower(sc, i, power);
4659	}
4660}
4661
4662static void
4663urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
4664{
4665	uint32_t reg;
4666
4667	reg = urtwn_read_4(sc, R92C_RCR);
4668	if (enable)
4669		reg &= ~R92C_RCR_CBSSID_BCN;
4670	else
4671		reg |= R92C_RCR_CBSSID_BCN;
4672	urtwn_write_4(sc, R92C_RCR, reg);
4673}
4674
4675static void
4676urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
4677{
4678	uint32_t reg;
4679
4680	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
4681	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4682	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
4683
4684	if (!(sc->chip & URTWN_CHIP_88E)) {
4685		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
4686		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4687		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
4688	}
4689}
4690
4691static void
4692urtwn_scan_start(struct ieee80211com *ic)
4693{
4694	struct urtwn_softc *sc = ic->ic_softc;
4695
4696	URTWN_LOCK(sc);
4697	/* Receive beacons / probe responses from any BSSID. */
4698	if (ic->ic_opmode != IEEE80211_M_IBSS)
4699		urtwn_set_rx_bssid_all(sc, 1);
4700
4701	/* Set gain for scanning. */
4702	urtwn_set_gain(sc, 0x20);
4703	URTWN_UNLOCK(sc);
4704}
4705
4706static void
4707urtwn_scan_end(struct ieee80211com *ic)
4708{
4709	struct urtwn_softc *sc = ic->ic_softc;
4710
4711	URTWN_LOCK(sc);
4712	/* Restore limitations. */
4713	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
4714		urtwn_set_rx_bssid_all(sc, 0);
4715
4716	/* Set gain under link. */
4717	urtwn_set_gain(sc, 0x32);
4718	URTWN_UNLOCK(sc);
4719}
4720
4721static void
4722urtwn_set_channel(struct ieee80211com *ic)
4723{
4724	struct urtwn_softc *sc = ic->ic_softc;
4725	struct ieee80211_channel *c = ic->ic_curchan;
4726	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4727
4728	URTWN_LOCK(sc);
4729	if (vap->iv_state == IEEE80211_S_SCAN) {
4730		/* Make link LED blink during scan. */
4731		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
4732	}
4733	urtwn_set_chan(sc, c, NULL);
4734	sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
4735	sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
4736	sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
4737	sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
4738	URTWN_UNLOCK(sc);
4739}
4740
4741static int
4742urtwn_wme_update(struct ieee80211com *ic)
4743{
4744	const struct wmeParams *wmep =
4745	    ic->ic_wme.wme_chanParams.cap_wmeParams;
4746	struct urtwn_softc *sc = ic->ic_softc;
4747	uint8_t aifs, acm, slottime;
4748	int ac;
4749
4750	acm = 0;
4751	slottime = IEEE80211_GET_SLOTTIME(ic);
4752
4753	URTWN_LOCK(sc);
4754	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4755		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4756		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4757		urtwn_write_4(sc, wme2queue[ac].reg,
4758		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
4759		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
4760		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
4761		    SM(R92C_EDCA_PARAM_AIFS, aifs));
4762		if (ac != WME_AC_BE)
4763			acm |= wmep[ac].wmep_acm << ac;
4764	}
4765
4766	if (acm != 0)
4767		acm |= R92C_ACMHWCTRL_EN;
4768	urtwn_write_1(sc, R92C_ACMHWCTRL,
4769	    (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
4770	    acm);
4771
4772	URTWN_UNLOCK(sc);
4773
4774	return 0;
4775}
4776
4777static void
4778urtwn_update_slot(struct ieee80211com *ic)
4779{
4780	urtwn_cmd_sleepable(ic->ic_softc, NULL, 0, urtwn_update_slot_cb);
4781}
4782
4783static void
4784urtwn_update_slot_cb(struct urtwn_softc *sc, union sec_param *data)
4785{
4786	struct ieee80211com *ic = &sc->sc_ic;
4787	uint8_t slottime;
4788
4789	slottime = IEEE80211_GET_SLOTTIME(ic);
4790
4791	URTWN_DPRINTF(sc, URTWN_DEBUG_ANY, "%s: setting slot time to %uus\n",
4792	    __func__, slottime);
4793
4794	urtwn_write_1(sc, R92C_SLOT, slottime);
4795	urtwn_update_aifs(sc, slottime);
4796}
4797
4798static void
4799urtwn_update_aifs(struct urtwn_softc *sc, uint8_t slottime)
4800{
4801	const struct wmeParams *wmep =
4802	    sc->sc_ic.ic_wme.wme_chanParams.cap_wmeParams;
4803	uint8_t aifs, ac;
4804
4805	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4806		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4807		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4808		urtwn_write_1(sc, wme2queue[ac].reg, aifs);
4809        }
4810}
4811
4812static void
4813urtwn_set_promisc(struct urtwn_softc *sc)
4814{
4815	struct ieee80211com *ic = &sc->sc_ic;
4816	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4817	uint32_t rcr, mask1, mask2;
4818
4819	URTWN_ASSERT_LOCKED(sc);
4820
4821	if (vap->iv_opmode == IEEE80211_M_MONITOR)
4822		return;
4823
4824	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
4825	mask2 = R92C_RCR_APM;
4826
4827	if (vap->iv_state == IEEE80211_S_RUN) {
4828		switch (vap->iv_opmode) {
4829		case IEEE80211_M_STA:
4830			mask2 |= R92C_RCR_CBSSID_DATA;
4831			/* FALLTHROUGH */
4832		case IEEE80211_M_HOSTAP:
4833			mask2 |= R92C_RCR_CBSSID_BCN;
4834			break;
4835		case IEEE80211_M_IBSS:
4836			mask2 |= R92C_RCR_CBSSID_DATA;
4837			break;
4838		default:
4839			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4840			    __func__, vap->iv_opmode);
4841			return;
4842		}
4843	}
4844
4845	rcr = urtwn_read_4(sc, R92C_RCR);
4846	if (ic->ic_promisc == 0)
4847		rcr = (rcr & ~mask1) | mask2;
4848	else
4849		rcr = (rcr & ~mask2) | mask1;
4850	urtwn_write_4(sc, R92C_RCR, rcr);
4851}
4852
4853static void
4854urtwn_update_promisc(struct ieee80211com *ic)
4855{
4856	struct urtwn_softc *sc = ic->ic_softc;
4857
4858	URTWN_LOCK(sc);
4859	if (sc->sc_flags & URTWN_RUNNING)
4860		urtwn_set_promisc(sc);
4861	URTWN_UNLOCK(sc);
4862}
4863
4864static void
4865urtwn_update_mcast(struct ieee80211com *ic)
4866{
4867	/* XXX do nothing?  */
4868}
4869
4870static struct ieee80211_node *
4871urtwn_r88e_node_alloc(struct ieee80211vap *vap,
4872    const uint8_t mac[IEEE80211_ADDR_LEN])
4873{
4874	struct urtwn_node *un;
4875
4876	un = malloc(sizeof (struct urtwn_node), M_80211_NODE,
4877	    M_NOWAIT | M_ZERO);
4878
4879	if (un == NULL)
4880		return NULL;
4881
4882	un->id = URTWN_MACID_UNDEFINED;
4883
4884	return &un->ni;
4885}
4886
4887static void
4888urtwn_r88e_newassoc(struct ieee80211_node *ni, int isnew)
4889{
4890	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4891	struct urtwn_node *un = URTWN_NODE(ni);
4892	uint8_t id;
4893
4894	if (!isnew)
4895		return;
4896
4897	URTWN_NT_LOCK(sc);
4898	for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
4899		if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
4900			un->id = id;
4901			sc->node_list[id] = ni;
4902			break;
4903		}
4904	}
4905	URTWN_NT_UNLOCK(sc);
4906
4907	if (id > URTWN_MACID_MAX(sc)) {
4908		device_printf(sc->sc_dev, "%s: node table is full\n",
4909		    __func__);
4910	}
4911}
4912
4913static void
4914urtwn_r88e_node_free(struct ieee80211_node *ni)
4915{
4916	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4917	struct urtwn_node *un = URTWN_NODE(ni);
4918
4919	URTWN_NT_LOCK(sc);
4920	if (un->id != URTWN_MACID_UNDEFINED)
4921		sc->node_list[un->id] = NULL;
4922	URTWN_NT_UNLOCK(sc);
4923
4924	sc->sc_node_free(ni);
4925}
4926
4927static void
4928urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
4929    struct ieee80211_channel *extc)
4930{
4931	struct ieee80211com *ic = &sc->sc_ic;
4932	uint32_t reg;
4933	u_int chan;
4934	int i;
4935
4936	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4937	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
4938		device_printf(sc->sc_dev,
4939		    "%s: invalid channel %x\n", __func__, chan);
4940		return;
4941	}
4942
4943	/* Set Tx power for this new channel. */
4944	urtwn_set_txpower(sc, c, extc);
4945
4946	for (i = 0; i < sc->nrxchains; i++) {
4947		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
4948		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
4949	}
4950#ifndef IEEE80211_NO_HT
4951	if (extc != NULL) {
4952		/* Is secondary channel below or above primary? */
4953		int prichlo = c->ic_freq < extc->ic_freq;
4954
4955		urtwn_write_1(sc, R92C_BWOPMODE,
4956		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
4957
4958		reg = urtwn_read_1(sc, R92C_RRSR + 2);
4959		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
4960		urtwn_write_1(sc, R92C_RRSR + 2, reg);
4961
4962		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4963		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
4964		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4965		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
4966
4967		/* Set CCK side band. */
4968		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
4969		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
4970		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
4971
4972		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
4973		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
4974		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
4975
4976		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4977		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
4978		    ~R92C_FPGA0_ANAPARAM2_CBW20);
4979
4980		reg = urtwn_bb_read(sc, 0x818);
4981		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
4982		urtwn_bb_write(sc, 0x818, reg);
4983
4984		/* Select 40MHz bandwidth. */
4985		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
4986		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
4987	} else
4988#endif
4989	{
4990		urtwn_write_1(sc, R92C_BWOPMODE,
4991		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
4992
4993		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4994		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
4995		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4996		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
4997
4998		if (!(sc->chip & URTWN_CHIP_88E)) {
4999			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5000			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
5001			    R92C_FPGA0_ANAPARAM2_CBW20);
5002		}
5003
5004		/* Select 20MHz bandwidth. */
5005		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5006		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
5007		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
5008		    R92C_RF_CHNLBW_BW20));
5009	}
5010}
5011
5012static void
5013urtwn_iq_calib(struct urtwn_softc *sc)
5014{
5015	/* TODO */
5016}
5017
5018static void
5019urtwn_lc_calib(struct urtwn_softc *sc)
5020{
5021	uint32_t rf_ac[2];
5022	uint8_t txmode;
5023	int i;
5024
5025	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
5026	if ((txmode & 0x70) != 0) {
5027		/* Disable all continuous Tx. */
5028		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
5029
5030		/* Set RF mode to standby mode. */
5031		for (i = 0; i < sc->nrxchains; i++) {
5032			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
5033			urtwn_rf_write(sc, i, R92C_RF_AC,
5034			    RW(rf_ac[i], R92C_RF_AC_MODE,
5035				R92C_RF_AC_MODE_STANDBY));
5036		}
5037	} else {
5038		/* Block all Tx queues. */
5039		urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
5040	}
5041	/* Start calibration. */
5042	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5043	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
5044
5045	/* Give calibration the time to complete. */
5046	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
5047
5048	/* Restore configuration. */
5049	if ((txmode & 0x70) != 0) {
5050		/* Restore Tx mode. */
5051		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
5052		/* Restore RF mode. */
5053		for (i = 0; i < sc->nrxchains; i++)
5054			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
5055	} else {
5056		/* Unblock all Tx queues. */
5057		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
5058	}
5059}
5060
5061static void
5062urtwn_temp_calib(struct urtwn_softc *sc)
5063{
5064	uint8_t temp;
5065
5066	URTWN_ASSERT_LOCKED(sc);
5067
5068	if (!(sc->sc_flags & URTWN_TEMP_MEASURED)) {
5069		/* Start measuring temperature. */
5070		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5071		    "%s: start measuring temperature\n", __func__);
5072		if (sc->chip & URTWN_CHIP_88E) {
5073			urtwn_rf_write(sc, 0, R88E_RF_T_METER,
5074			    R88E_RF_T_METER_START);
5075		} else {
5076			urtwn_rf_write(sc, 0, R92C_RF_T_METER,
5077			    R92C_RF_T_METER_START);
5078		}
5079		sc->sc_flags |= URTWN_TEMP_MEASURED;
5080		return;
5081	}
5082	sc->sc_flags &= ~URTWN_TEMP_MEASURED;
5083
5084	/* Read measured temperature. */
5085	if (sc->chip & URTWN_CHIP_88E) {
5086		temp = MS(urtwn_rf_read(sc, 0, R88E_RF_T_METER),
5087		    R88E_RF_T_METER_VAL);
5088	} else {
5089		temp = MS(urtwn_rf_read(sc, 0, R92C_RF_T_METER),
5090		    R92C_RF_T_METER_VAL);
5091	}
5092	if (temp == 0) {	/* Read failed, skip. */
5093		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5094		    "%s: temperature read failed, skipping\n", __func__);
5095		return;
5096	}
5097
5098	URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5099	    "%s: temperature: previous %u, current %u\n",
5100	    __func__, sc->thcal_lctemp, temp);
5101
5102	/*
5103	 * Redo LC calibration if temperature changed significantly since
5104	 * last calibration.
5105	 */
5106	if (sc->thcal_lctemp == 0) {
5107		/* First LC calibration is performed in urtwn_init(). */
5108		sc->thcal_lctemp = temp;
5109	} else if (abs(temp - sc->thcal_lctemp) > 1) {
5110		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5111		    "%s: LC calib triggered by temp: %u -> %u\n",
5112		    __func__, sc->thcal_lctemp, temp);
5113		urtwn_lc_calib(sc);
5114		/* Record temperature of last LC calibration. */
5115		sc->thcal_lctemp = temp;
5116	}
5117}
5118
5119static int
5120urtwn_init(struct urtwn_softc *sc)
5121{
5122	struct ieee80211com *ic = &sc->sc_ic;
5123	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5124	uint8_t macaddr[IEEE80211_ADDR_LEN];
5125	uint32_t reg;
5126	usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
5127	int error;
5128
5129	URTWN_LOCK(sc);
5130	if (sc->sc_flags & URTWN_RUNNING) {
5131		URTWN_UNLOCK(sc);
5132		return (0);
5133	}
5134
5135	/* Init firmware commands ring. */
5136	sc->fwcur = 0;
5137
5138	/* Allocate Tx/Rx buffers. */
5139	error = urtwn_alloc_rx_list(sc);
5140	if (error != 0)
5141		goto fail;
5142
5143	error = urtwn_alloc_tx_list(sc);
5144	if (error != 0)
5145		goto fail;
5146
5147	/* Power on adapter. */
5148	error = urtwn_power_on(sc);
5149	if (error != 0)
5150		goto fail;
5151
5152	/* Initialize DMA. */
5153	error = urtwn_dma_init(sc);
5154	if (error != 0)
5155		goto fail;
5156
5157	/* Set info size in Rx descriptors (in 64-bit words). */
5158	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
5159
5160	/* Init interrupts. */
5161	if (sc->chip & URTWN_CHIP_88E) {
5162		usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
5163		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5164			goto fail;
5165		usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
5166		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
5167		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5168			goto fail;
5169		usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
5170		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
5171		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5172			goto fail;
5173		usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5174		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5175		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
5176		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5177			goto fail;
5178	} else {
5179		usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
5180		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5181			goto fail;
5182		usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
5183		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5184			goto fail;
5185	}
5186
5187	/* Set MAC address. */
5188	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
5189	usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
5190	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5191		goto fail;
5192
5193	/* Set initial network type. */
5194	urtwn_set_mode(sc, R92C_MSR_INFRA);
5195
5196	/* Initialize Rx filter. */
5197	urtwn_rxfilter_init(sc);
5198
5199	/* Set response rate. */
5200	reg = urtwn_read_4(sc, R92C_RRSR);
5201	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
5202	urtwn_write_4(sc, R92C_RRSR, reg);
5203
5204	/* Set short/long retry limits. */
5205	urtwn_write_2(sc, R92C_RL,
5206	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
5207
5208	/* Initialize EDCA parameters. */
5209	urtwn_edca_init(sc);
5210
5211	/* Setup rate fallback. */
5212	if (!(sc->chip & URTWN_CHIP_88E)) {
5213		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
5214		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
5215		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
5216		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
5217	}
5218
5219	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
5220	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
5221	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
5222	/* Set ACK timeout. */
5223	urtwn_write_1(sc, R92C_ACKTO, 0x40);
5224
5225	/* Setup USB aggregation. */
5226	reg = urtwn_read_4(sc, R92C_TDECTRL);
5227	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
5228	urtwn_write_4(sc, R92C_TDECTRL, reg);
5229	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
5230	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
5231	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
5232	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
5233	if (sc->chip & URTWN_CHIP_88E)
5234		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
5235	else {
5236		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
5237		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5238		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5239		    R92C_USB_SPECIAL_OPTION_AGG_EN);
5240		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
5241		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
5242	}
5243
5244	/* Initialize beacon parameters. */
5245	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
5246	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
5247	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
5248	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
5249	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
5250
5251	if (!(sc->chip & URTWN_CHIP_88E)) {
5252		/* Setup AMPDU aggregation. */
5253		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
5254		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
5255		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
5256
5257		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
5258	}
5259
5260#ifndef URTWN_WITHOUT_UCODE
5261	/* Load 8051 microcode. */
5262	error = urtwn_load_firmware(sc);
5263	if (error == 0)
5264		sc->sc_flags |= URTWN_FW_LOADED;
5265#endif
5266
5267	/* Initialize MAC/BB/RF blocks. */
5268	error = urtwn_mac_init(sc);
5269	if (error != 0) {
5270		device_printf(sc->sc_dev,
5271		    "%s: error while initializing MAC block\n", __func__);
5272		goto fail;
5273	}
5274	urtwn_bb_init(sc);
5275	urtwn_rf_init(sc);
5276
5277	/* Reinitialize Rx filter (D3845 is not committed yet). */
5278	urtwn_rxfilter_init(sc);
5279
5280	if (sc->chip & URTWN_CHIP_88E) {
5281		urtwn_write_2(sc, R92C_CR,
5282		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
5283		    R92C_CR_MACRXEN);
5284	}
5285
5286	/* Turn CCK and OFDM blocks on. */
5287	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5288	reg |= R92C_RFMOD_CCK_EN;
5289	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5290	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5291		goto fail;
5292	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5293	reg |= R92C_RFMOD_OFDM_EN;
5294	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5295	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5296		goto fail;
5297
5298	/* Clear per-station keys table. */
5299	urtwn_cam_init(sc);
5300
5301	/* Enable decryption / encryption. */
5302	urtwn_write_2(sc, R92C_SECCFG,
5303	    R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
5304	    R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXDEC_ENA |
5305	    R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
5306
5307	/*
5308	 * Install static keys (if any).
5309	 * Must be called after urtwn_cam_init().
5310	 */
5311	ieee80211_runtask(ic, &sc->cmdq_task);
5312
5313	/* Enable hardware sequence numbering. */
5314	urtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
5315
5316	/* Enable per-packet TX report. */
5317	if (sc->chip & URTWN_CHIP_88E) {
5318		urtwn_write_1(sc, R88E_TX_RPT_CTRL,
5319		    urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
5320	}
5321
5322	/* Perform LO and IQ calibrations. */
5323	urtwn_iq_calib(sc);
5324	/* Perform LC calibration. */
5325	urtwn_lc_calib(sc);
5326
5327	/* Fix USB interference issue. */
5328	if (!(sc->chip & URTWN_CHIP_88E)) {
5329		urtwn_write_1(sc, 0xfe40, 0xe0);
5330		urtwn_write_1(sc, 0xfe41, 0x8d);
5331		urtwn_write_1(sc, 0xfe42, 0x80);
5332
5333		urtwn_pa_bias_init(sc);
5334	}
5335
5336	/* Initialize GPIO setting. */
5337	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
5338	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
5339
5340	/* Fix for lower temperature. */
5341	if (!(sc->chip & URTWN_CHIP_88E))
5342		urtwn_write_1(sc, 0x15, 0xe9);
5343
5344	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
5345
5346	sc->sc_flags |= URTWN_RUNNING;
5347
5348	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5349fail:
5350	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5351		error = EIO;
5352
5353	URTWN_UNLOCK(sc);
5354
5355	return (error);
5356}
5357
5358static void
5359urtwn_stop(struct urtwn_softc *sc)
5360{
5361
5362	URTWN_LOCK(sc);
5363	if (!(sc->sc_flags & URTWN_RUNNING)) {
5364		URTWN_UNLOCK(sc);
5365		return;
5366	}
5367
5368	sc->sc_flags &= ~(URTWN_RUNNING | URTWN_FW_LOADED |
5369	    URTWN_TEMP_MEASURED);
5370	sc->thcal_lctemp = 0;
5371	callout_stop(&sc->sc_watchdog_ch);
5372
5373	urtwn_abort_xfers(sc);
5374	urtwn_drain_mbufq(sc);
5375	urtwn_power_off(sc);
5376	URTWN_UNLOCK(sc);
5377}
5378
5379static void
5380urtwn_abort_xfers(struct urtwn_softc *sc)
5381{
5382	int i;
5383
5384	URTWN_ASSERT_LOCKED(sc);
5385
5386	/* abort any pending transfers */
5387	for (i = 0; i < URTWN_N_TRANSFER; i++)
5388		usbd_transfer_stop(sc->sc_xfer[i]);
5389}
5390
5391static int
5392urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5393    const struct ieee80211_bpf_params *params)
5394{
5395	struct ieee80211com *ic = ni->ni_ic;
5396	struct urtwn_softc *sc = ic->ic_softc;
5397	struct urtwn_data *bf;
5398	int error;
5399
5400	URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
5401	    __func__,
5402	    m);
5403
5404	/* prevent management frames from being sent if we're not ready */
5405	URTWN_LOCK(sc);
5406	if (!(sc->sc_flags & URTWN_RUNNING)) {
5407		error = ENETDOWN;
5408		goto end;
5409	}
5410
5411	bf = urtwn_getbuf(sc);
5412	if (bf == NULL) {
5413		error = ENOBUFS;
5414		goto end;
5415	}
5416
5417	if (params == NULL) {
5418		/*
5419		 * Legacy path; interpret frame contents to decide
5420		 * precisely how to send the frame.
5421		 */
5422		error = urtwn_tx_data(sc, ni, m, bf);
5423	} else {
5424		/*
5425		 * Caller supplied explicit parameters to use in
5426		 * sending the frame.
5427		 */
5428		error = urtwn_tx_raw(sc, ni, m, bf, params);
5429	}
5430	if (error != 0) {
5431		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
5432		goto end;
5433	}
5434
5435	sc->sc_txtimer = 5;
5436	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5437
5438end:
5439	if (error != 0)
5440		m_freem(m);
5441
5442	URTWN_UNLOCK(sc);
5443
5444	return (error);
5445}
5446
5447static void
5448urtwn_ms_delay(struct urtwn_softc *sc)
5449{
5450	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
5451}
5452
5453static device_method_t urtwn_methods[] = {
5454	/* Device interface */
5455	DEVMETHOD(device_probe,		urtwn_match),
5456	DEVMETHOD(device_attach,	urtwn_attach),
5457	DEVMETHOD(device_detach,	urtwn_detach),
5458
5459	DEVMETHOD_END
5460};
5461
5462static driver_t urtwn_driver = {
5463	"urtwn",
5464	urtwn_methods,
5465	sizeof(struct urtwn_softc)
5466};
5467
5468static devclass_t urtwn_devclass;
5469
5470DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
5471MODULE_DEPEND(urtwn, usb, 1, 1, 1);
5472MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
5473#ifndef URTWN_WITHOUT_UCODE
5474MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
5475#endif
5476MODULE_VERSION(urtwn, 1);
5477USB_PNP_HOST_INFO(urtwn_devs);
5478