if_urtwn.c revision 297910
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 * Copyright (c) 2015 Andriy Voskoboinyk <avos@FreeBSD.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/dev/urtwn/if_urtwn.c 297910 2016-04-13 05:19:16Z adrian $");
23
24/*
25 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
26 */
27
28#include "opt_wlan.h"
29#include "opt_urtwn.h"
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/lock.h>
35#include <sys/mutex.h>
36#include <sys/condvar.h>
37#include <sys/mbuf.h>
38#include <sys/kernel.h>
39#include <sys/socket.h>
40#include <sys/systm.h>
41#include <sys/malloc.h>
42#include <sys/module.h>
43#include <sys/bus.h>
44#include <sys/endian.h>
45#include <sys/linker.h>
46#include <sys/firmware.h>
47#include <sys/kdb.h>
48
49#include <machine/bus.h>
50#include <machine/resource.h>
51#include <sys/rman.h>
52
53#include <net/bpf.h>
54#include <net/if.h>
55#include <net/if_var.h>
56#include <net/if_arp.h>
57#include <net/ethernet.h>
58#include <net/if_dl.h>
59#include <net/if_media.h>
60#include <net/if_types.h>
61
62#include <netinet/in.h>
63#include <netinet/in_systm.h>
64#include <netinet/in_var.h>
65#include <netinet/if_ether.h>
66#include <netinet/ip.h>
67
68#include <net80211/ieee80211_var.h>
69#include <net80211/ieee80211_input.h>
70#include <net80211/ieee80211_regdomain.h>
71#include <net80211/ieee80211_radiotap.h>
72#include <net80211/ieee80211_ratectl.h>
73#ifdef	IEEE80211_SUPPORT_SUPERG
74#include <net80211/ieee80211_superg.h>
75#endif
76
77#include <dev/usb/usb.h>
78#include <dev/usb/usbdi.h>
79#include <dev/usb/usb_device.h>
80#include "usbdevs.h"
81
82#include <dev/usb/usb_debug.h>
83
84#include <dev/urtwn/if_urtwnreg.h>
85#include <dev/urtwn/if_urtwnvar.h>
86
87#ifdef USB_DEBUG
88enum {
89	URTWN_DEBUG_XMIT	= 0x00000001,	/* basic xmit operation */
90	URTWN_DEBUG_RECV	= 0x00000002,	/* basic recv operation */
91	URTWN_DEBUG_STATE	= 0x00000004,	/* 802.11 state transitions */
92	URTWN_DEBUG_RA		= 0x00000008,	/* f/w rate adaptation setup */
93	URTWN_DEBUG_USB		= 0x00000010,	/* usb requests */
94	URTWN_DEBUG_FIRMWARE	= 0x00000020,	/* firmware(9) loading debug */
95	URTWN_DEBUG_BEACON	= 0x00000040,	/* beacon handling */
96	URTWN_DEBUG_INTR	= 0x00000080,	/* ISR */
97	URTWN_DEBUG_TEMP	= 0x00000100,	/* temperature calibration */
98	URTWN_DEBUG_ROM		= 0x00000200,	/* various ROM info */
99	URTWN_DEBUG_KEY		= 0x00000400,	/* crypto keys management */
100	URTWN_DEBUG_TXPWR	= 0x00000800,	/* dump Tx power values */
101	URTWN_DEBUG_RSSI	= 0x00001000,	/* dump RSSI lookups */
102	URTWN_DEBUG_ANY		= 0xffffffff
103};
104
105#define URTWN_DPRINTF(_sc, _m, ...) do {			\
106	if ((_sc)->sc_debug & (_m))				\
107		device_printf((_sc)->sc_dev, __VA_ARGS__);	\
108} while(0)
109
110#else
111#define URTWN_DPRINTF(_sc, _m, ...)	do { (void) sc; } while (0)
112#endif
113
114#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
115
116static int urtwn_enable_11n = 1;
117TUNABLE_INT("hw.usb.urtwn.enable_11n", &urtwn_enable_11n);
118
119/* various supported device vendors/products */
120static const STRUCT_USB_HOST_ID urtwn_devs[] = {
121#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
122#define	URTWN_RTL8188E_DEV(v,p)	\
123	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
124#define URTWN_RTL8188E  1
125	URTWN_DEV(ABOCOM,	RTL8188CU_1),
126	URTWN_DEV(ABOCOM,	RTL8188CU_2),
127	URTWN_DEV(ABOCOM,	RTL8192CU),
128	URTWN_DEV(ASUS,		RTL8192CU),
129	URTWN_DEV(ASUS,		USBN10NANO),
130	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
131	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
132	URTWN_DEV(AZUREWAVE,	RTL8188CU),
133	URTWN_DEV(BELKIN,	F7D2102),
134	URTWN_DEV(BELKIN,	RTL8188CU),
135	URTWN_DEV(BELKIN,	RTL8192CU),
136	URTWN_DEV(CHICONY,	RTL8188CUS_1),
137	URTWN_DEV(CHICONY,	RTL8188CUS_2),
138	URTWN_DEV(CHICONY,	RTL8188CUS_3),
139	URTWN_DEV(CHICONY,	RTL8188CUS_4),
140	URTWN_DEV(CHICONY,	RTL8188CUS_5),
141	URTWN_DEV(COREGA,	RTL8192CU),
142	URTWN_DEV(DLINK,	RTL8188CU),
143	URTWN_DEV(DLINK,	RTL8192CU_1),
144	URTWN_DEV(DLINK,	RTL8192CU_2),
145	URTWN_DEV(DLINK,	RTL8192CU_3),
146	URTWN_DEV(DLINK,	DWA131B),
147	URTWN_DEV(EDIMAX,	EW7811UN),
148	URTWN_DEV(EDIMAX,	RTL8192CU),
149	URTWN_DEV(FEIXUN,	RTL8188CU),
150	URTWN_DEV(FEIXUN,	RTL8192CU),
151	URTWN_DEV(GUILLEMOT,	HWNUP150),
152	URTWN_DEV(HAWKING,	RTL8192CU),
153	URTWN_DEV(HP3,		RTL8188CU),
154	URTWN_DEV(NETGEAR,	WNA1000M),
155	URTWN_DEV(NETGEAR,	RTL8192CU),
156	URTWN_DEV(NETGEAR4,	RTL8188CU),
157	URTWN_DEV(NOVATECH,	RTL8188CU),
158	URTWN_DEV(PLANEX2,	RTL8188CU_1),
159	URTWN_DEV(PLANEX2,	RTL8188CU_2),
160	URTWN_DEV(PLANEX2,	RTL8188CU_3),
161	URTWN_DEV(PLANEX2,	RTL8188CU_4),
162	URTWN_DEV(PLANEX2,	RTL8188CUS),
163	URTWN_DEV(PLANEX2,	RTL8192CU),
164	URTWN_DEV(REALTEK,	RTL8188CE_0),
165	URTWN_DEV(REALTEK,	RTL8188CE_1),
166	URTWN_DEV(REALTEK,	RTL8188CTV),
167	URTWN_DEV(REALTEK,	RTL8188CU_0),
168	URTWN_DEV(REALTEK,	RTL8188CU_1),
169	URTWN_DEV(REALTEK,	RTL8188CU_2),
170	URTWN_DEV(REALTEK,	RTL8188CU_3),
171	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
172	URTWN_DEV(REALTEK,	RTL8188CUS),
173	URTWN_DEV(REALTEK,	RTL8188RU_1),
174	URTWN_DEV(REALTEK,	RTL8188RU_2),
175	URTWN_DEV(REALTEK,	RTL8188RU_3),
176	URTWN_DEV(REALTEK,	RTL8191CU),
177	URTWN_DEV(REALTEK,	RTL8192CE),
178	URTWN_DEV(REALTEK,	RTL8192CU),
179	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
180	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
181	URTWN_DEV(SITECOMEU,	RTL8192CU),
182	URTWN_DEV(TRENDNET,	RTL8188CU),
183	URTWN_DEV(TRENDNET,	RTL8192CU),
184	URTWN_DEV(ZYXEL,	RTL8192CU),
185	/* URTWN_RTL8188E */
186	URTWN_RTL8188E_DEV(ABOCOM,	RTL8188EU),
187	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
188	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
189	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
190	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
191	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
192#undef URTWN_RTL8188E_DEV
193#undef URTWN_DEV
194};
195
196static device_probe_t	urtwn_match;
197static device_attach_t	urtwn_attach;
198static device_detach_t	urtwn_detach;
199
200static usb_callback_t   urtwn_bulk_tx_callback;
201static usb_callback_t	urtwn_bulk_rx_callback;
202
203static void		urtwn_sysctlattach(struct urtwn_softc *);
204static void		urtwn_drain_mbufq(struct urtwn_softc *);
205static usb_error_t	urtwn_do_request(struct urtwn_softc *,
206			    struct usb_device_request *, void *);
207static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
208		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
209                    const uint8_t [IEEE80211_ADDR_LEN],
210                    const uint8_t [IEEE80211_ADDR_LEN]);
211static void		urtwn_vap_delete(struct ieee80211vap *);
212static struct mbuf *	urtwn_rx_copy_to_mbuf(struct urtwn_softc *,
213			    struct r92c_rx_stat *, int);
214static struct mbuf *	urtwn_report_intr(struct usb_xfer *,
215			    struct urtwn_data *);
216static struct mbuf *	urtwn_rxeof(struct urtwn_softc *, uint8_t *, int);
217static void		urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
218			    void *);
219static struct ieee80211_node *urtwn_rx_frame(struct urtwn_softc *,
220			    struct mbuf *, int8_t *);
221static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
222			    int);
223static int		urtwn_alloc_list(struct urtwn_softc *,
224			    struct urtwn_data[], int, int);
225static int		urtwn_alloc_rx_list(struct urtwn_softc *);
226static int		urtwn_alloc_tx_list(struct urtwn_softc *);
227static void		urtwn_free_list(struct urtwn_softc *,
228			    struct urtwn_data data[], int);
229static void		urtwn_free_rx_list(struct urtwn_softc *);
230static void		urtwn_free_tx_list(struct urtwn_softc *);
231static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
232static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
233static usb_error_t	urtwn_write_region_1(struct urtwn_softc *, uint16_t,
234			    uint8_t *, int);
235static usb_error_t	urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
236static usb_error_t	urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
237static usb_error_t	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
238static usb_error_t	urtwn_read_region_1(struct urtwn_softc *, uint16_t,
239			    uint8_t *, int);
240static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
241static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
242static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
243static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
244			    const void *, int);
245static void		urtwn_cmdq_cb(void *, int);
246static int		urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
247			    size_t, CMD_FUNC_PROTO);
248static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
249			    uint8_t, uint32_t);
250static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
251			    uint8_t, uint32_t);
252static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
253static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
254			    uint32_t);
255static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
256static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
257			    uint8_t, uint8_t);
258#ifdef USB_DEBUG
259static void		urtwn_dump_rom_contents(struct urtwn_softc *,
260			    uint8_t *, uint16_t);
261#endif
262static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
263			    uint16_t);
264static int		urtwn_efuse_switch_power(struct urtwn_softc *);
265static int		urtwn_read_chipid(struct urtwn_softc *);
266static int		urtwn_read_rom(struct urtwn_softc *);
267static int		urtwn_r88e_read_rom(struct urtwn_softc *);
268static int		urtwn_ra_init(struct urtwn_softc *);
269static void		urtwn_init_beacon(struct urtwn_softc *,
270			    struct urtwn_vap *);
271static int		urtwn_setup_beacon(struct urtwn_softc *,
272			    struct ieee80211_node *);
273static void		urtwn_update_beacon(struct ieee80211vap *, int);
274static int		urtwn_tx_beacon(struct urtwn_softc *sc,
275			    struct urtwn_vap *);
276static int		urtwn_key_alloc(struct ieee80211vap *,
277			    struct ieee80211_key *, ieee80211_keyix *,
278			    ieee80211_keyix *);
279static void		urtwn_key_set_cb(struct urtwn_softc *,
280			    union sec_param *);
281static void		urtwn_key_del_cb(struct urtwn_softc *,
282			    union sec_param *);
283static int		urtwn_key_set(struct ieee80211vap *,
284			    const struct ieee80211_key *);
285static int		urtwn_key_delete(struct ieee80211vap *,
286			    const struct ieee80211_key *);
287static void		urtwn_tsf_task_adhoc(void *, int);
288static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
289			    struct ieee80211vap *);
290static void		urtwn_get_tsf(struct urtwn_softc *, uint64_t *);
291static void		urtwn_set_led(struct urtwn_softc *, int, int);
292static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
293static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
294			    struct mbuf *, int,
295			    const struct ieee80211_rx_stats *, int, int);
296static int		urtwn_newstate(struct ieee80211vap *,
297			    enum ieee80211_state, int);
298static void		urtwn_calib_to(void *);
299static void		urtwn_calib_cb(struct urtwn_softc *,
300			    union sec_param *);
301static void		urtwn_watchdog(void *);
302static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
303static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
304static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
305static int		urtwn_tx_data(struct urtwn_softc *,
306			    struct ieee80211_node *, struct mbuf *,
307			    struct urtwn_data *);
308static int		urtwn_tx_raw(struct urtwn_softc *,
309			    struct ieee80211_node *, struct mbuf *,
310			    struct urtwn_data *,
311			    const struct ieee80211_bpf_params *);
312static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
313			    uint8_t, struct urtwn_data *);
314static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
315static void		urtwn_start(struct urtwn_softc *);
316static void		urtwn_parent(struct ieee80211com *);
317static int		urtwn_r92c_power_on(struct urtwn_softc *);
318static int		urtwn_r88e_power_on(struct urtwn_softc *);
319static void		urtwn_r92c_power_off(struct urtwn_softc *);
320static void		urtwn_r88e_power_off(struct urtwn_softc *);
321static int		urtwn_llt_init(struct urtwn_softc *);
322#ifndef URTWN_WITHOUT_UCODE
323static void		urtwn_fw_reset(struct urtwn_softc *);
324static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
325static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
326			    const uint8_t *, int);
327static int		urtwn_load_firmware(struct urtwn_softc *);
328#endif
329static int		urtwn_dma_init(struct urtwn_softc *);
330static int		urtwn_mac_init(struct urtwn_softc *);
331static void		urtwn_bb_init(struct urtwn_softc *);
332static void		urtwn_rf_init(struct urtwn_softc *);
333static void		urtwn_cam_init(struct urtwn_softc *);
334static int		urtwn_cam_write(struct urtwn_softc *, uint32_t,
335			    uint32_t);
336static void		urtwn_pa_bias_init(struct urtwn_softc *);
337static void		urtwn_rxfilter_init(struct urtwn_softc *);
338static void		urtwn_edca_init(struct urtwn_softc *);
339static void		urtwn_write_txpower(struct urtwn_softc *, int,
340			    uint16_t[]);
341static void		urtwn_get_txpower(struct urtwn_softc *, int,
342		      	    struct ieee80211_channel *,
343			    struct ieee80211_channel *, uint16_t[]);
344static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
345		      	    struct ieee80211_channel *,
346			    struct ieee80211_channel *, uint16_t[]);
347static void		urtwn_set_txpower(struct urtwn_softc *,
348		    	    struct ieee80211_channel *,
349			    struct ieee80211_channel *);
350static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
351static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
352static void		urtwn_scan_start(struct ieee80211com *);
353static void		urtwn_scan_end(struct ieee80211com *);
354static void		urtwn_set_channel(struct ieee80211com *);
355static int		urtwn_wme_update(struct ieee80211com *);
356static void		urtwn_update_slot(struct ieee80211com *);
357static void		urtwn_update_slot_cb(struct urtwn_softc *,
358			    union sec_param *);
359static void		urtwn_update_aifs(struct urtwn_softc *, uint8_t);
360static void		urtwn_set_promisc(struct urtwn_softc *);
361static void		urtwn_update_promisc(struct ieee80211com *);
362static void		urtwn_update_mcast(struct ieee80211com *);
363static struct ieee80211_node *urtwn_node_alloc(struct ieee80211vap *,
364			    const uint8_t mac[IEEE80211_ADDR_LEN]);
365static void		urtwn_newassoc(struct ieee80211_node *, int);
366static void		urtwn_node_free(struct ieee80211_node *);
367static void		urtwn_set_chan(struct urtwn_softc *,
368		    	    struct ieee80211_channel *,
369			    struct ieee80211_channel *);
370static void		urtwn_iq_calib(struct urtwn_softc *);
371static void		urtwn_lc_calib(struct urtwn_softc *);
372static void		urtwn_temp_calib(struct urtwn_softc *);
373static int		urtwn_init(struct urtwn_softc *);
374static void		urtwn_stop(struct urtwn_softc *);
375static void		urtwn_abort_xfers(struct urtwn_softc *);
376static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
377			    const struct ieee80211_bpf_params *);
378static void		urtwn_ms_delay(struct urtwn_softc *);
379
380/* Aliases. */
381#define	urtwn_bb_write	urtwn_write_4
382#define urtwn_bb_read	urtwn_read_4
383
384static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
385	[URTWN_BULK_RX] = {
386		.type = UE_BULK,
387		.endpoint = UE_ADDR_ANY,
388		.direction = UE_DIR_IN,
389		.bufsize = URTWN_RXBUFSZ,
390		.flags = {
391			.pipe_bof = 1,
392			.short_xfer_ok = 1
393		},
394		.callback = urtwn_bulk_rx_callback,
395	},
396	[URTWN_BULK_TX_BE] = {
397		.type = UE_BULK,
398		.endpoint = 0x03,
399		.direction = UE_DIR_OUT,
400		.bufsize = URTWN_TXBUFSZ,
401		.flags = {
402			.ext_buffer = 1,
403			.pipe_bof = 1,
404			.force_short_xfer = 1
405		},
406		.callback = urtwn_bulk_tx_callback,
407		.timeout = URTWN_TX_TIMEOUT,	/* ms */
408	},
409	[URTWN_BULK_TX_BK] = {
410		.type = UE_BULK,
411		.endpoint = 0x03,
412		.direction = UE_DIR_OUT,
413		.bufsize = URTWN_TXBUFSZ,
414		.flags = {
415			.ext_buffer = 1,
416			.pipe_bof = 1,
417			.force_short_xfer = 1,
418		},
419		.callback = urtwn_bulk_tx_callback,
420		.timeout = URTWN_TX_TIMEOUT,	/* ms */
421	},
422	[URTWN_BULK_TX_VI] = {
423		.type = UE_BULK,
424		.endpoint = 0x02,
425		.direction = UE_DIR_OUT,
426		.bufsize = URTWN_TXBUFSZ,
427		.flags = {
428			.ext_buffer = 1,
429			.pipe_bof = 1,
430			.force_short_xfer = 1
431		},
432		.callback = urtwn_bulk_tx_callback,
433		.timeout = URTWN_TX_TIMEOUT,	/* ms */
434	},
435	[URTWN_BULK_TX_VO] = {
436		.type = UE_BULK,
437		.endpoint = 0x02,
438		.direction = UE_DIR_OUT,
439		.bufsize = URTWN_TXBUFSZ,
440		.flags = {
441			.ext_buffer = 1,
442			.pipe_bof = 1,
443			.force_short_xfer = 1
444		},
445		.callback = urtwn_bulk_tx_callback,
446		.timeout = URTWN_TX_TIMEOUT,	/* ms */
447	},
448};
449
450static const struct wme_to_queue {
451	uint16_t reg;
452	uint8_t qid;
453} wme2queue[WME_NUM_AC] = {
454	{ R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
455	{ R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
456	{ R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
457	{ R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
458};
459
460static int
461urtwn_match(device_t self)
462{
463	struct usb_attach_arg *uaa = device_get_ivars(self);
464
465	if (uaa->usb_mode != USB_MODE_HOST)
466		return (ENXIO);
467	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
468		return (ENXIO);
469	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
470		return (ENXIO);
471
472	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
473}
474
475static void
476urtwn_update_chw(struct ieee80211com *ic)
477{
478}
479
480static int
481urtwn_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
482{
483
484	/* We're driving this ourselves (eventually); don't involve net80211 */
485	return (0);
486}
487
488static int
489urtwn_attach(device_t self)
490{
491	struct usb_attach_arg *uaa = device_get_ivars(self);
492	struct urtwn_softc *sc = device_get_softc(self);
493	struct ieee80211com *ic = &sc->sc_ic;
494	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
495	int error;
496
497	device_set_usb_desc(self);
498	sc->sc_udev = uaa->device;
499	sc->sc_dev = self;
500	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
501		sc->chip |= URTWN_CHIP_88E;
502
503#ifdef USB_DEBUG
504	int debug;
505	if (resource_int_value(device_get_name(sc->sc_dev),
506	    device_get_unit(sc->sc_dev), "debug", &debug) == 0)
507		sc->sc_debug = debug;
508#endif
509
510	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
511	    MTX_NETWORK_LOCK, MTX_DEF);
512	URTWN_CMDQ_LOCK_INIT(sc);
513	URTWN_NT_LOCK_INIT(sc);
514	callout_init(&sc->sc_calib_to, 0);
515	callout_init(&sc->sc_watchdog_ch, 0);
516	mbufq_init(&sc->sc_snd, ifqmaxlen);
517
518	sc->sc_iface_index = URTWN_IFACE_INDEX;
519	error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
520	    sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
521	if (error) {
522		device_printf(self, "could not allocate USB transfers, "
523		    "err=%s\n", usbd_errstr(error));
524		goto detach;
525	}
526
527	URTWN_LOCK(sc);
528
529	error = urtwn_read_chipid(sc);
530	if (error) {
531		device_printf(sc->sc_dev, "unsupported test chip\n");
532		URTWN_UNLOCK(sc);
533		goto detach;
534	}
535
536	/* Determine number of Tx/Rx chains. */
537	if (sc->chip & URTWN_CHIP_92C) {
538		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
539		sc->nrxchains = 2;
540	} else {
541		sc->ntxchains = 1;
542		sc->nrxchains = 1;
543	}
544
545	if (sc->chip & URTWN_CHIP_88E)
546		error = urtwn_r88e_read_rom(sc);
547	else
548		error = urtwn_read_rom(sc);
549	if (error != 0) {
550		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
551		    __func__, error);
552		URTWN_UNLOCK(sc);
553		goto detach;
554	}
555
556	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
557	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
558	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
559	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
560	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
561	    "8188CUS", sc->ntxchains, sc->nrxchains);
562
563	URTWN_UNLOCK(sc);
564
565	ic->ic_softc = sc;
566	ic->ic_name = device_get_nameunit(self);
567	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
568	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
569
570	/* set device capabilities */
571	ic->ic_caps =
572		  IEEE80211_C_STA		/* station mode */
573		| IEEE80211_C_MONITOR		/* monitor mode */
574		| IEEE80211_C_IBSS		/* adhoc mode */
575		| IEEE80211_C_HOSTAP		/* hostap mode */
576		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
577		| IEEE80211_C_SHSLOT		/* short slot time supported */
578#if 0
579		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
580#endif
581		| IEEE80211_C_WPA		/* 802.11i */
582		| IEEE80211_C_WME		/* 802.11e */
583		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
584		| IEEE80211_C_FF		/* Atheros fast-frames */
585		;
586
587	ic->ic_cryptocaps =
588	    IEEE80211_CRYPTO_WEP |
589	    IEEE80211_CRYPTO_TKIP |
590	    IEEE80211_CRYPTO_AES_CCM;
591
592	/* Assume they're all 11n capable for now */
593	if (urtwn_enable_11n) {
594		device_printf(self, "enabling 11n\n");
595		ic->ic_htcaps = IEEE80211_HTC_HT |
596#if 0
597		    IEEE80211_HTC_AMPDU |
598#endif
599		    IEEE80211_HTC_AMSDU |
600		    IEEE80211_HTCAP_MAXAMSDU_3839 |
601		    IEEE80211_HTCAP_SMPS_OFF;
602		/* no HT40 just yet */
603		// ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
604
605		/* XXX TODO: verify chains versus streams for urtwn */
606		ic->ic_txstream = sc->ntxchains;
607		ic->ic_rxstream = sc->nrxchains;
608	}
609
610	memset(bands, 0, sizeof(bands));
611	setbit(bands, IEEE80211_MODE_11B);
612	setbit(bands, IEEE80211_MODE_11G);
613	if (urtwn_enable_11n)
614		setbit(bands, IEEE80211_MODE_11NG);
615	ieee80211_init_channels(ic, NULL, bands);
616
617	ieee80211_ifattach(ic);
618	ic->ic_raw_xmit = urtwn_raw_xmit;
619	ic->ic_scan_start = urtwn_scan_start;
620	ic->ic_scan_end = urtwn_scan_end;
621	ic->ic_set_channel = urtwn_set_channel;
622	ic->ic_transmit = urtwn_transmit;
623	ic->ic_parent = urtwn_parent;
624	ic->ic_vap_create = urtwn_vap_create;
625	ic->ic_vap_delete = urtwn_vap_delete;
626	ic->ic_wme.wme_update = urtwn_wme_update;
627	ic->ic_updateslot = urtwn_update_slot;
628	ic->ic_update_promisc = urtwn_update_promisc;
629	ic->ic_update_mcast = urtwn_update_mcast;
630	if (sc->chip & URTWN_CHIP_88E) {
631		ic->ic_node_alloc = urtwn_node_alloc;
632		ic->ic_newassoc = urtwn_newassoc;
633		sc->sc_node_free = ic->ic_node_free;
634		ic->ic_node_free = urtwn_node_free;
635	}
636	ic->ic_update_chw = urtwn_update_chw;
637	ic->ic_ampdu_enable = urtwn_ampdu_enable;
638
639	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
640	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
641	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
642	    URTWN_RX_RADIOTAP_PRESENT);
643
644	TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
645
646	urtwn_sysctlattach(sc);
647
648	if (bootverbose)
649		ieee80211_announce(ic);
650
651	return (0);
652
653detach:
654	urtwn_detach(self);
655	return (ENXIO);			/* failure */
656}
657
658static void
659urtwn_sysctlattach(struct urtwn_softc *sc)
660{
661#ifdef USB_DEBUG
662	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
663	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
664
665	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
666	    "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
667	    "control debugging printfs");
668#endif
669}
670
671static int
672urtwn_detach(device_t self)
673{
674	struct urtwn_softc *sc = device_get_softc(self);
675	struct ieee80211com *ic = &sc->sc_ic;
676	unsigned int x;
677
678	/* Prevent further ioctls. */
679	URTWN_LOCK(sc);
680	sc->sc_flags |= URTWN_DETACHED;
681	URTWN_UNLOCK(sc);
682
683	urtwn_stop(sc);
684
685	callout_drain(&sc->sc_watchdog_ch);
686	callout_drain(&sc->sc_calib_to);
687
688	/* stop all USB transfers */
689	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
690
691	/* Prevent further allocations from RX/TX data lists. */
692	URTWN_LOCK(sc);
693	STAILQ_INIT(&sc->sc_tx_active);
694	STAILQ_INIT(&sc->sc_tx_inactive);
695	STAILQ_INIT(&sc->sc_tx_pending);
696
697	STAILQ_INIT(&sc->sc_rx_active);
698	STAILQ_INIT(&sc->sc_rx_inactive);
699	URTWN_UNLOCK(sc);
700
701	/* drain USB transfers */
702	for (x = 0; x != URTWN_N_TRANSFER; x++)
703		usbd_transfer_drain(sc->sc_xfer[x]);
704
705	/* Free data buffers. */
706	URTWN_LOCK(sc);
707	urtwn_free_tx_list(sc);
708	urtwn_free_rx_list(sc);
709	URTWN_UNLOCK(sc);
710
711	if (ic->ic_softc == sc) {
712		ieee80211_draintask(ic, &sc->cmdq_task);
713		ieee80211_ifdetach(ic);
714	}
715
716	URTWN_NT_LOCK_DESTROY(sc);
717	URTWN_CMDQ_LOCK_DESTROY(sc);
718	mtx_destroy(&sc->sc_mtx);
719
720	return (0);
721}
722
723static void
724urtwn_drain_mbufq(struct urtwn_softc *sc)
725{
726	struct mbuf *m;
727	struct ieee80211_node *ni;
728	URTWN_ASSERT_LOCKED(sc);
729	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
730		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
731		m->m_pkthdr.rcvif = NULL;
732		ieee80211_free_node(ni);
733		m_freem(m);
734	}
735}
736
737static usb_error_t
738urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
739    void *data)
740{
741	usb_error_t err;
742	int ntries = 10;
743
744	URTWN_ASSERT_LOCKED(sc);
745
746	while (ntries--) {
747		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
748		    req, data, 0, NULL, 250 /* ms */);
749		if (err == 0)
750			break;
751
752		URTWN_DPRINTF(sc, URTWN_DEBUG_USB,
753		    "%s: control request failed, %s (retries left: %d)\n",
754		    __func__, usbd_errstr(err), ntries);
755		usb_pause_mtx(&sc->sc_mtx, hz / 100);
756	}
757	return (err);
758}
759
760static struct ieee80211vap *
761urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
762    enum ieee80211_opmode opmode, int flags,
763    const uint8_t bssid[IEEE80211_ADDR_LEN],
764    const uint8_t mac[IEEE80211_ADDR_LEN])
765{
766	struct urtwn_softc *sc = ic->ic_softc;
767	struct urtwn_vap *uvp;
768	struct ieee80211vap *vap;
769
770	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
771		return (NULL);
772
773	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
774	vap = &uvp->vap;
775	/* enable s/w bmiss handling for sta mode */
776
777	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
778	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
779		/* out of memory */
780		free(uvp, M_80211_VAP);
781		return (NULL);
782	}
783
784	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
785		urtwn_init_beacon(sc, uvp);
786
787	/* override state transition machine */
788	uvp->newstate = vap->iv_newstate;
789	vap->iv_newstate = urtwn_newstate;
790	vap->iv_update_beacon = urtwn_update_beacon;
791	vap->iv_key_alloc = urtwn_key_alloc;
792	vap->iv_key_set = urtwn_key_set;
793	vap->iv_key_delete = urtwn_key_delete;
794	if (opmode == IEEE80211_M_IBSS) {
795		uvp->recv_mgmt = vap->iv_recv_mgmt;
796		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
797		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
798	}
799
800	if (URTWN_CHIP_HAS_RATECTL(sc))
801		ieee80211_ratectl_init(vap);
802	/* complete setup */
803	ieee80211_vap_attach(vap, ieee80211_media_change,
804	    ieee80211_media_status, mac);
805	ic->ic_opmode = opmode;
806	return (vap);
807}
808
809static void
810urtwn_vap_delete(struct ieee80211vap *vap)
811{
812	struct ieee80211com *ic = vap->iv_ic;
813	struct urtwn_softc *sc = ic->ic_softc;
814	struct urtwn_vap *uvp = URTWN_VAP(vap);
815
816	if (uvp->bcn_mbuf != NULL)
817		m_freem(uvp->bcn_mbuf);
818	if (vap->iv_opmode == IEEE80211_M_IBSS)
819		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
820	if (URTWN_CHIP_HAS_RATECTL(sc))
821		ieee80211_ratectl_deinit(vap);
822	ieee80211_vap_detach(vap);
823	free(uvp, M_80211_VAP);
824}
825
826static struct mbuf *
827urtwn_rx_copy_to_mbuf(struct urtwn_softc *sc, struct r92c_rx_stat *stat,
828    int totlen)
829{
830	struct ieee80211com *ic = &sc->sc_ic;
831	struct mbuf *m;
832	uint32_t rxdw0;
833	int pktlen;
834
835	/*
836	 * don't pass packets to the ieee80211 framework if the driver isn't
837	 * RUNNING.
838	 */
839	if (!(sc->sc_flags & URTWN_RUNNING))
840		return (NULL);
841
842	rxdw0 = le32toh(stat->rxdw0);
843	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
844		/*
845		 * This should not happen since we setup our Rx filter
846		 * to not receive these frames.
847		 */
848		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
849		    "%s: RX flags error (%s)\n", __func__,
850		    rxdw0 & R92C_RXDW0_CRCERR ? "CRC" : "ICV");
851		goto fail;
852	}
853
854	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
855	if (pktlen < sizeof(struct ieee80211_frame_ack)) {
856		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
857		    "%s: frame is too short: %d\n", __func__, pktlen);
858		goto fail;
859	}
860
861	if (__predict_false(totlen > MCLBYTES)) {
862		/* convert to m_getjcl if this happens */
863		device_printf(sc->sc_dev, "%s: frame too long: %d (%d)\n",
864		    __func__, pktlen, totlen);
865		goto fail;
866	}
867
868	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
869	if (__predict_false(m == NULL)) {
870		device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
871		    __func__);
872		goto fail;
873	}
874
875	/* Finalize mbuf. */
876	memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
877	m->m_pkthdr.len = m->m_len = totlen;
878
879	return (m);
880fail:
881	counter_u64_add(ic->ic_ierrors, 1);
882	return (NULL);
883}
884
885static struct mbuf *
886urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data)
887{
888	struct urtwn_softc *sc = data->sc;
889	struct ieee80211com *ic = &sc->sc_ic;
890	struct r92c_rx_stat *stat;
891	uint8_t *buf;
892	int len;
893
894	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
895
896	if (len < sizeof(*stat)) {
897		counter_u64_add(ic->ic_ierrors, 1);
898		return (NULL);
899	}
900
901	buf = data->buf;
902	stat = (struct r92c_rx_stat *)buf;
903
904	/*
905	 * For 88E chips we can tie the FF flushing here;
906	 * this is where we do know exactly how deep the
907	 * transmit queue is.
908	 *
909	 * But it won't work for R92 chips, so we can't
910	 * take the easy way out.
911	 */
912
913	if (sc->chip & URTWN_CHIP_88E) {
914		int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
915
916		switch (report_sel) {
917		case R88E_RXDW3_RPT_RX:
918			return (urtwn_rxeof(sc, buf, len));
919		case R88E_RXDW3_RPT_TX1:
920			urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
921			break;
922		default:
923			URTWN_DPRINTF(sc, URTWN_DEBUG_INTR,
924			    "%s: case %d was not handled\n", __func__,
925			    report_sel);
926			break;
927		}
928	} else
929		return (urtwn_rxeof(sc, buf, len));
930
931	return (NULL);
932}
933
934static struct mbuf *
935urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len)
936{
937	struct r92c_rx_stat *stat;
938	struct mbuf *m, *m0 = NULL, *prevm = NULL;
939	uint32_t rxdw0;
940	int totlen, pktlen, infosz, npkts;
941
942	/* Get the number of encapsulated frames. */
943	stat = (struct r92c_rx_stat *)buf;
944	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
945	URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
946	    "%s: Rx %d frames in one chunk\n", __func__, npkts);
947
948	/* Process all of them. */
949	while (npkts-- > 0) {
950		if (len < sizeof(*stat))
951			break;
952		stat = (struct r92c_rx_stat *)buf;
953		rxdw0 = le32toh(stat->rxdw0);
954
955		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
956		if (pktlen == 0)
957			break;
958
959		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
960
961		/* Make sure everything fits in xfer. */
962		totlen = sizeof(*stat) + infosz + pktlen;
963		if (totlen > len)
964			break;
965
966		m = urtwn_rx_copy_to_mbuf(sc, stat, totlen);
967		if (m0 == NULL)
968			m0 = m;
969		if (prevm == NULL)
970			prevm = m;
971		else {
972			prevm->m_next = m;
973			prevm = m;
974		}
975
976		/* Next chunk is 128-byte aligned. */
977		totlen = (totlen + 127) & ~127;
978		buf += totlen;
979		len -= totlen;
980	}
981
982	return (m0);
983}
984
985static void
986urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
987{
988	struct r88e_tx_rpt_ccx *rpt = arg;
989	struct ieee80211vap *vap;
990	struct ieee80211_node *ni;
991	uint8_t macid;
992	int ntries;
993
994	macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
995	ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
996
997	URTWN_NT_LOCK(sc);
998	ni = sc->node_list[macid];
999	if (ni != NULL) {
1000		vap = ni->ni_vap;
1001		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: frame for macid %d was"
1002		    "%s sent (%d retries)\n", __func__, macid,
1003		    (rpt->rptb1 & R88E_RPTB1_PKT_OK) ? "" : " not",
1004		    ntries);
1005
1006		if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
1007			ieee80211_ratectl_tx_complete(vap, ni,
1008			    IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
1009		} else {
1010			ieee80211_ratectl_tx_complete(vap, ni,
1011			    IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
1012		}
1013	} else {
1014		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: macid %d, ni is NULL\n",
1015		    __func__, macid);
1016	}
1017	URTWN_NT_UNLOCK(sc);
1018}
1019
1020static struct ieee80211_node *
1021urtwn_rx_frame(struct urtwn_softc *sc, struct mbuf *m, int8_t *rssi_p)
1022{
1023	struct ieee80211com *ic = &sc->sc_ic;
1024	struct ieee80211_frame_min *wh;
1025	struct r92c_rx_stat *stat;
1026	uint32_t rxdw0, rxdw3;
1027	uint8_t rate, cipher;
1028	int8_t rssi = -127;
1029	int infosz;
1030
1031	stat = mtod(m, struct r92c_rx_stat *);
1032	rxdw0 = le32toh(stat->rxdw0);
1033	rxdw3 = le32toh(stat->rxdw3);
1034
1035	rate = MS(rxdw3, R92C_RXDW3_RATE);
1036	cipher = MS(rxdw0, R92C_RXDW0_CIPHER);
1037	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1038
1039	/* Get RSSI from PHY status descriptor if present. */
1040	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1041		if (sc->chip & URTWN_CHIP_88E)
1042			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
1043		else
1044			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
1045		URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: rssi=%d\n", __func__, rssi);
1046		/* Update our average RSSI. */
1047		urtwn_update_avgrssi(sc, rate, rssi);
1048	}
1049
1050	if (ieee80211_radiotap_active(ic)) {
1051		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1052
1053		tap->wr_flags = 0;
1054
1055		urtwn_get_tsf(sc, &tap->wr_tsft);
1056		if (__predict_false(le32toh((uint32_t)tap->wr_tsft) <
1057				    le32toh(stat->rxdw5))) {
1058			tap->wr_tsft = le32toh(tap->wr_tsft  >> 32) - 1;
1059			tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
1060		} else
1061			tap->wr_tsft &= 0xffffffff00000000;
1062		tap->wr_tsft += stat->rxdw5;
1063
1064		/* XXX 20/40? */
1065		/* XXX shortgi? */
1066
1067		/* Map HW rate index to 802.11 rate. */
1068		if (!(rxdw3 & R92C_RXDW3_HT)) {
1069			tap->wr_rate = ridx2rate[rate];
1070		} else if (rate >= 12) {	/* MCS0~15. */
1071			/* Bit 7 set means HT MCS instead of rate. */
1072			tap->wr_rate = 0x80 | (rate - 12);
1073		}
1074
1075		/* XXX TODO: this isn't right; should use the last good RSSI */
1076		tap->wr_dbm_antsignal = rssi;
1077		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
1078	}
1079
1080	*rssi_p = rssi;
1081
1082	/* Drop descriptor. */
1083	m_adj(m, sizeof(*stat) + infosz);
1084	wh = mtod(m, struct ieee80211_frame_min *);
1085
1086	if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
1087	    cipher != R92C_CAM_ALGO_NONE) {
1088		m->m_flags |= M_WEP;
1089	}
1090
1091	if (m->m_len >= sizeof(*wh))
1092		return (ieee80211_find_rxnode(ic, wh));
1093
1094	return (NULL);
1095}
1096
1097static void
1098urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1099{
1100	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1101	struct ieee80211com *ic = &sc->sc_ic;
1102	struct ieee80211_node *ni;
1103	struct mbuf *m = NULL, *next;
1104	struct urtwn_data *data;
1105	int8_t nf, rssi;
1106
1107	URTWN_ASSERT_LOCKED(sc);
1108
1109	switch (USB_GET_STATE(xfer)) {
1110	case USB_ST_TRANSFERRED:
1111		data = STAILQ_FIRST(&sc->sc_rx_active);
1112		if (data == NULL)
1113			goto tr_setup;
1114		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1115		m = urtwn_report_intr(xfer, data);
1116		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1117		/* FALLTHROUGH */
1118	case USB_ST_SETUP:
1119tr_setup:
1120		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1121		if (data == NULL) {
1122			KASSERT(m == NULL, ("mbuf isn't NULL"));
1123			goto finish;
1124		}
1125		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1126		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1127		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1128		    usbd_xfer_max_len(xfer));
1129		usbd_transfer_submit(xfer);
1130
1131		/*
1132		 * To avoid LOR we should unlock our private mutex here to call
1133		 * ieee80211_input() because here is at the end of a USB
1134		 * callback and safe to unlock.
1135		 */
1136		while (m != NULL) {
1137			next = m->m_next;
1138			m->m_next = NULL;
1139
1140			ni = urtwn_rx_frame(sc, m, &rssi);
1141
1142			/* Store a global last-good RSSI */
1143			if (rssi != -127)
1144				sc->last_rssi = rssi;
1145
1146			URTWN_UNLOCK(sc);
1147
1148			nf = URTWN_NOISE_FLOOR;
1149			if (ni != NULL) {
1150				if (rssi != -127)
1151					URTWN_NODE(ni)->last_rssi = rssi;
1152				if (ni->ni_flags & IEEE80211_NODE_HT)
1153					m->m_flags |= M_AMPDU;
1154				(void)ieee80211_input(ni, m,
1155				    URTWN_NODE(ni)->last_rssi - nf, nf);
1156				ieee80211_free_node(ni);
1157			} else {
1158				/* Use last good global RSSI */
1159				(void)ieee80211_input_all(ic, m,
1160				    sc->last_rssi - nf, nf);
1161			}
1162			URTWN_LOCK(sc);
1163			m = next;
1164		}
1165		break;
1166	default:
1167		/* needs it to the inactive queue due to a error. */
1168		data = STAILQ_FIRST(&sc->sc_rx_active);
1169		if (data != NULL) {
1170			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1171			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1172		}
1173		if (error != USB_ERR_CANCELLED) {
1174			usbd_xfer_set_stall(xfer);
1175			counter_u64_add(ic->ic_ierrors, 1);
1176			goto tr_setup;
1177		}
1178		break;
1179	}
1180finish:
1181	/* Finished receive; age anything left on the FF queue by a little bump */
1182	/*
1183	 * XXX TODO: just make this a callout timer schedule so we can
1184	 * flush the FF staging queue if we're approaching idle.
1185	 */
1186#ifdef	IEEE80211_SUPPORT_SUPERG
1187	URTWN_UNLOCK(sc);
1188	ieee80211_ff_age_all(ic, 1);
1189	URTWN_LOCK(sc);
1190#endif
1191
1192	/* Kick-start more transmit in case we stalled */
1193	urtwn_start(sc);
1194}
1195
1196static void
1197urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
1198{
1199
1200	URTWN_ASSERT_LOCKED(sc);
1201
1202	if (data->ni != NULL)	/* not a beacon frame */
1203		ieee80211_tx_complete(data->ni, data->m, status);
1204
1205	if (sc->sc_tx_n_active > 0)
1206		sc->sc_tx_n_active--;
1207
1208	data->ni = NULL;
1209	data->m = NULL;
1210
1211	sc->sc_txtimer = 0;
1212
1213	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1214}
1215
1216static int
1217urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1218    int ndata, int maxsz)
1219{
1220	int i, error;
1221
1222	for (i = 0; i < ndata; i++) {
1223		struct urtwn_data *dp = &data[i];
1224		dp->sc = sc;
1225		dp->m = NULL;
1226		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1227		if (dp->buf == NULL) {
1228			device_printf(sc->sc_dev,
1229			    "could not allocate buffer\n");
1230			error = ENOMEM;
1231			goto fail;
1232		}
1233		dp->ni = NULL;
1234	}
1235
1236	return (0);
1237fail:
1238	urtwn_free_list(sc, data, ndata);
1239	return (error);
1240}
1241
1242static int
1243urtwn_alloc_rx_list(struct urtwn_softc *sc)
1244{
1245        int error, i;
1246
1247	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1248	    URTWN_RXBUFSZ);
1249	if (error != 0)
1250		return (error);
1251
1252	STAILQ_INIT(&sc->sc_rx_active);
1253	STAILQ_INIT(&sc->sc_rx_inactive);
1254
1255	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1256		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1257
1258	return (0);
1259}
1260
1261static int
1262urtwn_alloc_tx_list(struct urtwn_softc *sc)
1263{
1264	int error, i;
1265
1266	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1267	    URTWN_TXBUFSZ);
1268	if (error != 0)
1269		return (error);
1270
1271	STAILQ_INIT(&sc->sc_tx_active);
1272	STAILQ_INIT(&sc->sc_tx_inactive);
1273	STAILQ_INIT(&sc->sc_tx_pending);
1274
1275	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1276		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1277
1278	return (0);
1279}
1280
1281static void
1282urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1283{
1284	int i;
1285
1286	for (i = 0; i < ndata; i++) {
1287		struct urtwn_data *dp = &data[i];
1288
1289		if (dp->buf != NULL) {
1290			free(dp->buf, M_USBDEV);
1291			dp->buf = NULL;
1292		}
1293		if (dp->ni != NULL) {
1294			ieee80211_free_node(dp->ni);
1295			dp->ni = NULL;
1296		}
1297	}
1298}
1299
1300static void
1301urtwn_free_rx_list(struct urtwn_softc *sc)
1302{
1303	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1304}
1305
1306static void
1307urtwn_free_tx_list(struct urtwn_softc *sc)
1308{
1309	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1310}
1311
1312static void
1313urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1314{
1315	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1316#ifdef	IEEE80211_SUPPORT_SUPERG
1317	struct ieee80211com *ic = &sc->sc_ic;
1318#endif
1319	struct urtwn_data *data;
1320
1321	URTWN_ASSERT_LOCKED(sc);
1322
1323	switch (USB_GET_STATE(xfer)){
1324	case USB_ST_TRANSFERRED:
1325		data = STAILQ_FIRST(&sc->sc_tx_active);
1326		if (data == NULL)
1327			goto tr_setup;
1328		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1329		urtwn_txeof(sc, data, 0);
1330		/* FALLTHROUGH */
1331	case USB_ST_SETUP:
1332tr_setup:
1333		data = STAILQ_FIRST(&sc->sc_tx_pending);
1334		if (data == NULL) {
1335			URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1336			    "%s: empty pending queue\n", __func__);
1337			sc->sc_tx_n_active = 0;
1338			goto finish;
1339		}
1340		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1341		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1342		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1343		usbd_transfer_submit(xfer);
1344		sc->sc_tx_n_active++;
1345		break;
1346	default:
1347		data = STAILQ_FIRST(&sc->sc_tx_active);
1348		if (data == NULL)
1349			goto tr_setup;
1350		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1351		urtwn_txeof(sc, data, 1);
1352		if (error != USB_ERR_CANCELLED) {
1353			usbd_xfer_set_stall(xfer);
1354			goto tr_setup;
1355		}
1356		break;
1357	}
1358finish:
1359#ifdef	IEEE80211_SUPPORT_SUPERG
1360	/*
1361	 * If the TX active queue drops below a certain
1362	 * threshold, ensure we age fast-frames out so they're
1363	 * transmitted.
1364	 */
1365	if (sc->sc_tx_n_active <= 1) {
1366		/* XXX ew - net80211 should defer this for us! */
1367
1368		/*
1369		 * Note: this sc_tx_n_active currently tracks
1370		 * the number of pending transmit submissions
1371		 * and not the actual depth of the TX frames
1372		 * pending to the hardware.  That means that
1373		 * we're going to end up with some sub-optimal
1374		 * aggregation behaviour.
1375		 */
1376		/*
1377		 * XXX TODO: just make this a callout timer schedule so we can
1378		 * flush the FF staging queue if we're approaching idle.
1379		 */
1380		URTWN_UNLOCK(sc);
1381		ieee80211_ff_flush(ic, WME_AC_VO);
1382		ieee80211_ff_flush(ic, WME_AC_VI);
1383		ieee80211_ff_flush(ic, WME_AC_BE);
1384		ieee80211_ff_flush(ic, WME_AC_BK);
1385		URTWN_LOCK(sc);
1386	}
1387#endif
1388	/* Kick-start more transmit */
1389	urtwn_start(sc);
1390}
1391
1392static struct urtwn_data *
1393_urtwn_getbuf(struct urtwn_softc *sc)
1394{
1395	struct urtwn_data *bf;
1396
1397	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1398	if (bf != NULL)
1399		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1400	else {
1401		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1402		    "%s: out of xmit buffers\n", __func__);
1403	}
1404	return (bf);
1405}
1406
1407static struct urtwn_data *
1408urtwn_getbuf(struct urtwn_softc *sc)
1409{
1410        struct urtwn_data *bf;
1411
1412	URTWN_ASSERT_LOCKED(sc);
1413
1414	bf = _urtwn_getbuf(sc);
1415	if (bf == NULL) {
1416		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: stop queue\n",
1417		    __func__);
1418	}
1419	return (bf);
1420}
1421
1422static usb_error_t
1423urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1424    int len)
1425{
1426	usb_device_request_t req;
1427
1428	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1429	req.bRequest = R92C_REQ_REGS;
1430	USETW(req.wValue, addr);
1431	USETW(req.wIndex, 0);
1432	USETW(req.wLength, len);
1433	return (urtwn_do_request(sc, &req, buf));
1434}
1435
1436static usb_error_t
1437urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1438{
1439	return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1440}
1441
1442static usb_error_t
1443urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1444{
1445	val = htole16(val);
1446	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1447}
1448
1449static usb_error_t
1450urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1451{
1452	val = htole32(val);
1453	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1454}
1455
1456static usb_error_t
1457urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1458    int len)
1459{
1460	usb_device_request_t req;
1461
1462	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1463	req.bRequest = R92C_REQ_REGS;
1464	USETW(req.wValue, addr);
1465	USETW(req.wIndex, 0);
1466	USETW(req.wLength, len);
1467	return (urtwn_do_request(sc, &req, buf));
1468}
1469
1470static uint8_t
1471urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1472{
1473	uint8_t val;
1474
1475	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1476		return (0xff);
1477	return (val);
1478}
1479
1480static uint16_t
1481urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1482{
1483	uint16_t val;
1484
1485	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1486		return (0xffff);
1487	return (le16toh(val));
1488}
1489
1490static uint32_t
1491urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1492{
1493	uint32_t val;
1494
1495	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1496		return (0xffffffff);
1497	return (le32toh(val));
1498}
1499
1500static int
1501urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1502{
1503	struct r92c_fw_cmd cmd;
1504	usb_error_t error;
1505	int ntries;
1506
1507	if (!(sc->sc_flags & URTWN_FW_LOADED)) {
1508		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE, "%s: firmware "
1509		    "was not loaded; command (id %d) will be discarded\n",
1510		    __func__, id);
1511		return (0);
1512	}
1513
1514	/* Wait for current FW box to be empty. */
1515	for (ntries = 0; ntries < 100; ntries++) {
1516		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1517			break;
1518		urtwn_ms_delay(sc);
1519	}
1520	if (ntries == 100) {
1521		device_printf(sc->sc_dev,
1522		    "could not send firmware command\n");
1523		return (ETIMEDOUT);
1524	}
1525	memset(&cmd, 0, sizeof(cmd));
1526	cmd.id = id;
1527	if (len > 3)
1528		cmd.id |= R92C_CMD_FLAG_EXT;
1529	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1530	memcpy(cmd.msg, buf, len);
1531
1532	/* Write the first word last since that will trigger the FW. */
1533	error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1534	    (uint8_t *)&cmd + 4, 2);
1535	if (error != USB_ERR_NORMAL_COMPLETION)
1536		return (EIO);
1537	error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1538	    (uint8_t *)&cmd + 0, 4);
1539	if (error != USB_ERR_NORMAL_COMPLETION)
1540		return (EIO);
1541
1542	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1543	return (0);
1544}
1545
1546static void
1547urtwn_cmdq_cb(void *arg, int pending)
1548{
1549	struct urtwn_softc *sc = arg;
1550	struct urtwn_cmdq *item;
1551
1552	/*
1553	 * Device must be powered on (via urtwn_power_on())
1554	 * before any command may be sent.
1555	 */
1556	URTWN_LOCK(sc);
1557	if (!(sc->sc_flags & URTWN_RUNNING)) {
1558		URTWN_UNLOCK(sc);
1559		return;
1560	}
1561
1562	URTWN_CMDQ_LOCK(sc);
1563	while (sc->cmdq[sc->cmdq_first].func != NULL) {
1564		item = &sc->cmdq[sc->cmdq_first];
1565		sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1566		URTWN_CMDQ_UNLOCK(sc);
1567
1568		item->func(sc, &item->data);
1569
1570		URTWN_CMDQ_LOCK(sc);
1571		memset(item, 0, sizeof (*item));
1572	}
1573	URTWN_CMDQ_UNLOCK(sc);
1574	URTWN_UNLOCK(sc);
1575}
1576
1577static int
1578urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1579    CMD_FUNC_PROTO)
1580{
1581	struct ieee80211com *ic = &sc->sc_ic;
1582
1583	KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1584
1585	URTWN_CMDQ_LOCK(sc);
1586	if (sc->cmdq[sc->cmdq_last].func != NULL) {
1587		device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1588		URTWN_CMDQ_UNLOCK(sc);
1589
1590		return (EAGAIN);
1591	}
1592
1593	if (ptr != NULL)
1594		memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1595	sc->cmdq[sc->cmdq_last].func = func;
1596	sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1597	URTWN_CMDQ_UNLOCK(sc);
1598
1599	ieee80211_runtask(ic, &sc->cmdq_task);
1600
1601	return (0);
1602}
1603
1604static __inline void
1605urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1606{
1607
1608	sc->sc_rf_write(sc, chain, addr, val);
1609}
1610
1611static void
1612urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1613    uint32_t val)
1614{
1615	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1616	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1617	    SM(R92C_LSSI_PARAM_DATA, val));
1618}
1619
1620static void
1621urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1622uint32_t val)
1623{
1624	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1625	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1626	    SM(R92C_LSSI_PARAM_DATA, val));
1627}
1628
1629static uint32_t
1630urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1631{
1632	uint32_t reg[R92C_MAX_CHAINS], val;
1633
1634	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1635	if (chain != 0)
1636		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1637
1638	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1639	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1640	urtwn_ms_delay(sc);
1641
1642	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1643	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1644	    R92C_HSSI_PARAM2_READ_EDGE);
1645	urtwn_ms_delay(sc);
1646
1647	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1648	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1649	urtwn_ms_delay(sc);
1650
1651	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1652		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1653	else
1654		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1655	return (MS(val, R92C_LSSI_READBACK_DATA));
1656}
1657
1658static int
1659urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1660{
1661	usb_error_t error;
1662	int ntries;
1663
1664	error = urtwn_write_4(sc, R92C_LLT_INIT,
1665	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1666	    SM(R92C_LLT_INIT_ADDR, addr) |
1667	    SM(R92C_LLT_INIT_DATA, data));
1668	if (error != USB_ERR_NORMAL_COMPLETION)
1669		return (EIO);
1670	/* Wait for write operation to complete. */
1671	for (ntries = 0; ntries < 20; ntries++) {
1672		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1673		    R92C_LLT_INIT_OP_NO_ACTIVE)
1674			return (0);
1675		urtwn_ms_delay(sc);
1676	}
1677	return (ETIMEDOUT);
1678}
1679
1680static int
1681urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1682{
1683	uint32_t reg;
1684	usb_error_t error;
1685	int ntries;
1686
1687	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1688		return (EFAULT);
1689
1690	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1691	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1692	reg &= ~R92C_EFUSE_CTRL_VALID;
1693
1694	error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1695	if (error != USB_ERR_NORMAL_COMPLETION)
1696		return (EIO);
1697	/* Wait for read operation to complete. */
1698	for (ntries = 0; ntries < 100; ntries++) {
1699		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1700		if (reg & R92C_EFUSE_CTRL_VALID)
1701			break;
1702		urtwn_ms_delay(sc);
1703	}
1704	if (ntries == 100) {
1705		device_printf(sc->sc_dev,
1706		    "could not read efuse byte at address 0x%x\n",
1707		    sc->last_rom_addr);
1708		return (ETIMEDOUT);
1709	}
1710
1711	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1712	sc->last_rom_addr++;
1713
1714	return (0);
1715}
1716
1717static int
1718urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1719    uint8_t msk)
1720{
1721	uint8_t reg;
1722	int i, error;
1723
1724	for (i = 0; i < 4; i++) {
1725		if (msk & (1 << i))
1726			continue;
1727		error = urtwn_efuse_read_next(sc, &reg);
1728		if (error != 0)
1729			return (error);
1730		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1731		    off * 8 + i * 2, reg);
1732		rom[off * 8 + i * 2 + 0] = reg;
1733
1734		error = urtwn_efuse_read_next(sc, &reg);
1735		if (error != 0)
1736			return (error);
1737		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1738		    off * 8 + i * 2 + 1, reg);
1739		rom[off * 8 + i * 2 + 1] = reg;
1740	}
1741
1742	return (0);
1743}
1744
1745#ifdef USB_DEBUG
1746static void
1747urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1748{
1749	int i;
1750
1751	/* Dump ROM contents. */
1752	device_printf(sc->sc_dev, "%s:", __func__);
1753	for (i = 0; i < size; i++) {
1754		if (i % 32 == 0)
1755			printf("\n%03X: ", i);
1756		else if (i % 4 == 0)
1757			printf(" ");
1758
1759		printf("%02X", rom[i]);
1760	}
1761	printf("\n");
1762}
1763#endif
1764
1765static int
1766urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1767{
1768#define URTWN_CHK(res) do {	\
1769	if ((error = res) != 0)	\
1770		goto end;	\
1771} while(0)
1772	uint8_t msk, off, reg;
1773	int error;
1774
1775	URTWN_CHK(urtwn_efuse_switch_power(sc));
1776
1777	/* Read full ROM image. */
1778	sc->last_rom_addr = 0;
1779	memset(rom, 0xff, size);
1780
1781	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1782	while (reg != 0xff) {
1783		/* check for extended header */
1784		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1785			off = reg >> 5;
1786			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1787
1788			if ((reg & 0x0f) != 0x0f)
1789				off = ((reg & 0xf0) >> 1) | off;
1790			else
1791				continue;
1792		} else
1793			off = reg >> 4;
1794		msk = reg & 0xf;
1795
1796		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1797		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1798	}
1799
1800end:
1801
1802#ifdef USB_DEBUG
1803	if (sc->sc_debug & URTWN_DEBUG_ROM)
1804		urtwn_dump_rom_contents(sc, rom, size);
1805#endif
1806
1807	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1808
1809	if (error != 0) {
1810		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1811		    __func__);
1812	}
1813
1814	return (error);
1815#undef URTWN_CHK
1816}
1817
1818static int
1819urtwn_efuse_switch_power(struct urtwn_softc *sc)
1820{
1821	usb_error_t error;
1822	uint32_t reg;
1823
1824	error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1825	if (error != USB_ERR_NORMAL_COMPLETION)
1826		return (EIO);
1827
1828	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1829	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1830		error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1831		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1832		if (error != USB_ERR_NORMAL_COMPLETION)
1833			return (EIO);
1834	}
1835	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1836	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1837		error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1838		    reg | R92C_SYS_FUNC_EN_ELDR);
1839		if (error != USB_ERR_NORMAL_COMPLETION)
1840			return (EIO);
1841	}
1842	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1843	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1844	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1845		error = urtwn_write_2(sc, R92C_SYS_CLKR,
1846		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1847		if (error != USB_ERR_NORMAL_COMPLETION)
1848			return (EIO);
1849	}
1850
1851	return (0);
1852}
1853
1854static int
1855urtwn_read_chipid(struct urtwn_softc *sc)
1856{
1857	uint32_t reg;
1858
1859	if (sc->chip & URTWN_CHIP_88E)
1860		return (0);
1861
1862	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1863	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1864		return (EIO);
1865
1866	if (reg & R92C_SYS_CFG_TYPE_92C) {
1867		sc->chip |= URTWN_CHIP_92C;
1868		/* Check if it is a castrated 8192C. */
1869		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1870		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1871		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1872			sc->chip |= URTWN_CHIP_92C_1T2R;
1873	}
1874	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1875		sc->chip |= URTWN_CHIP_UMC;
1876		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1877			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1878	}
1879	return (0);
1880}
1881
1882static int
1883urtwn_read_rom(struct urtwn_softc *sc)
1884{
1885	struct r92c_rom *rom = &sc->rom.r92c_rom;
1886	int error;
1887
1888	/* Read full ROM image. */
1889	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1890	if (error != 0)
1891		return (error);
1892
1893	/* XXX Weird but this is what the vendor driver does. */
1894	sc->last_rom_addr = 0x1fa;
1895	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1896	if (error != 0)
1897		return (error);
1898	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: PA setting=0x%x\n", __func__,
1899	    sc->pa_setting);
1900
1901	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1902
1903	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1904	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type=%d\n",
1905	    __func__, sc->regulatory);
1906	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1907
1908	sc->sc_rf_write = urtwn_r92c_rf_write;
1909	sc->sc_power_on = urtwn_r92c_power_on;
1910	sc->sc_power_off = urtwn_r92c_power_off;
1911
1912	return (0);
1913}
1914
1915static int
1916urtwn_r88e_read_rom(struct urtwn_softc *sc)
1917{
1918	struct r88e_rom *rom = &sc->rom.r88e_rom;
1919	int error;
1920
1921	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));
1922	if (error != 0)
1923		return (error);
1924
1925	sc->bw20_tx_pwr_diff = (rom->tx_pwr_diff >> 4);
1926	if (sc->bw20_tx_pwr_diff & 0x08)
1927		sc->bw20_tx_pwr_diff |= 0xf0;
1928	sc->ofdm_tx_pwr_diff = (rom->tx_pwr_diff & 0xf);
1929	if (sc->ofdm_tx_pwr_diff & 0x08)
1930		sc->ofdm_tx_pwr_diff |= 0xf0;
1931	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
1932	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type %d\n",
1933	    __func__,sc->regulatory);
1934	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1935
1936	sc->sc_rf_write = urtwn_r88e_rf_write;
1937	sc->sc_power_on = urtwn_r88e_power_on;
1938	sc->sc_power_off = urtwn_r88e_power_off;
1939
1940	return (0);
1941}
1942
1943/*
1944 * Initialize rate adaptation in firmware.
1945 */
1946static int
1947urtwn_ra_init(struct urtwn_softc *sc)
1948{
1949	struct ieee80211com *ic = &sc->sc_ic;
1950	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1951	struct ieee80211_node *ni;
1952	struct ieee80211_rateset *rs, *rs_ht;
1953	struct r92c_fw_cmd_macid_cfg cmd;
1954	uint32_t rates, basicrates;
1955	uint8_t mode;
1956	int maxrate, maxbasicrate, error, i, j;
1957
1958	ni = ieee80211_ref_node(vap->iv_bss);
1959	rs = &ni->ni_rates;
1960	rs_ht = (struct ieee80211_rateset *) &ni->ni_htrates;
1961
1962	/* Get normal and basic rates mask. */
1963	rates = basicrates = 0;
1964	maxrate = maxbasicrate = 0;
1965
1966	/* This is for 11bg */
1967	for (i = 0; i < rs->rs_nrates; i++) {
1968		/* Convert 802.11 rate to HW rate index. */
1969		for (j = 0; j < nitems(ridx2rate); j++)
1970			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1971			    ridx2rate[j])
1972				break;
1973		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1974			continue;
1975		rates |= 1 << j;
1976		if (j > maxrate)
1977			maxrate = j;
1978		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1979			basicrates |= 1 << j;
1980			if (j > maxbasicrate)
1981				maxbasicrate = j;
1982		}
1983	}
1984
1985	/* If we're doing 11n, enable 11n rates */
1986	if (ni->ni_flags & IEEE80211_NODE_HT) {
1987		for (i = 0; i < rs_ht->rs_nrates; i++) {
1988			if ((rs_ht->rs_rates[i] & 0x7f) > 0xf)
1989				continue;
1990			/* 11n rates start at index 12 */
1991			j = ((rs_ht->rs_rates[i]) & 0xf) + 12;
1992			rates |= (1 << j);
1993
1994			/* Guard against the rate table being oddly ordered */
1995			if (j > maxrate)
1996				maxrate = j;
1997		}
1998	}
1999
2000#if 0
2001	if (ic->ic_curmode == IEEE80211_MODE_11NG)
2002		raid = R92C_RAID_11GN;
2003#endif
2004	/* NB: group addressed frames are done at 11bg rates for now */
2005	if (ic->ic_curmode == IEEE80211_MODE_11B)
2006		mode = R92C_RAID_11B;
2007	else
2008		mode = R92C_RAID_11BG;
2009	/* XXX misleading 'mode' value here for unicast frames */
2010	URTWN_DPRINTF(sc, URTWN_DEBUG_RA,
2011	    "%s: mode 0x%x, rates 0x%08x, basicrates 0x%08x\n", __func__,
2012	    mode, rates, basicrates);
2013
2014	/* Set rates mask for group addressed frames. */
2015	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
2016	cmd.mask = htole32(mode << 28 | basicrates);
2017	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2018	if (error != 0) {
2019		ieee80211_free_node(ni);
2020		device_printf(sc->sc_dev,
2021		    "could not add broadcast station\n");
2022		return (error);
2023	}
2024
2025	/* Set initial MRR rate. */
2026	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxbasicrate %d\n", __func__,
2027	    maxbasicrate);
2028	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
2029	    maxbasicrate);
2030
2031	/* Set rates mask for unicast frames. */
2032	if (ni->ni_flags & IEEE80211_NODE_HT)
2033		mode = R92C_RAID_11GN;
2034	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2035		mode = R92C_RAID_11B;
2036	else
2037		mode = R92C_RAID_11BG;
2038	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
2039	cmd.mask = htole32(mode << 28 | rates);
2040	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2041	if (error != 0) {
2042		ieee80211_free_node(ni);
2043		device_printf(sc->sc_dev, "could not add BSS station\n");
2044		return (error);
2045	}
2046	/* Set initial MRR rate. */
2047	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxrate %d\n", __func__,
2048	    maxrate);
2049	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
2050	    maxrate);
2051
2052	/* Indicate highest supported rate. */
2053	if (ni->ni_flags & IEEE80211_NODE_HT)
2054		ni->ni_txrate = rs_ht->rs_rates[rs_ht->rs_nrates - 1]
2055		    | IEEE80211_RATE_MCS;
2056	else
2057		ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
2058	ieee80211_free_node(ni);
2059
2060	return (0);
2061}
2062
2063static void
2064urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2065{
2066	struct r92c_tx_desc *txd = &uvp->bcn_desc;
2067
2068	txd->txdw0 = htole32(
2069	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
2070	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2071	txd->txdw1 = htole32(
2072	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
2073	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
2074
2075	if (sc->chip & URTWN_CHIP_88E) {
2076		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
2077		txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
2078	} else {
2079		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
2080		txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2081	}
2082
2083	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
2084	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
2085}
2086
2087static int
2088urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
2089{
2090 	struct ieee80211vap *vap = ni->ni_vap;
2091	struct urtwn_vap *uvp = URTWN_VAP(vap);
2092	struct mbuf *m;
2093	int error;
2094
2095	URTWN_ASSERT_LOCKED(sc);
2096
2097	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
2098		return (EINVAL);
2099
2100	m = ieee80211_beacon_alloc(ni);
2101	if (m == NULL) {
2102		device_printf(sc->sc_dev,
2103		    "%s: could not allocate beacon frame\n", __func__);
2104		return (ENOMEM);
2105	}
2106
2107	if (uvp->bcn_mbuf != NULL)
2108		m_freem(uvp->bcn_mbuf);
2109
2110	uvp->bcn_mbuf = m;
2111
2112	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2113		return (error);
2114
2115	/* XXX bcnq stuck workaround */
2116	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2117		return (error);
2118
2119	URTWN_DPRINTF(sc, URTWN_DEBUG_BEACON, "%s: beacon was %srecognized\n",
2120	    __func__, urtwn_read_1(sc, R92C_TDECTRL + 2) &
2121	    (R92C_TDECTRL_BCN_VALID >> 16) ? "" : "not ");
2122
2123	return (0);
2124}
2125
2126static void
2127urtwn_update_beacon(struct ieee80211vap *vap, int item)
2128{
2129	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2130	struct urtwn_vap *uvp = URTWN_VAP(vap);
2131	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
2132	struct ieee80211_node *ni = vap->iv_bss;
2133	int mcast = 0;
2134
2135	URTWN_LOCK(sc);
2136	if (uvp->bcn_mbuf == NULL) {
2137		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
2138		if (uvp->bcn_mbuf == NULL) {
2139			device_printf(sc->sc_dev,
2140			    "%s: could not allocate beacon frame\n", __func__);
2141			URTWN_UNLOCK(sc);
2142			return;
2143		}
2144	}
2145	URTWN_UNLOCK(sc);
2146
2147	if (item == IEEE80211_BEACON_TIM)
2148		mcast = 1;	/* XXX */
2149
2150	setbit(bo->bo_flags, item);
2151	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
2152
2153	URTWN_LOCK(sc);
2154	urtwn_tx_beacon(sc, uvp);
2155	URTWN_UNLOCK(sc);
2156}
2157
2158/*
2159 * Push a beacon frame into the chip. Beacon will
2160 * be repeated by the chip every R92C_BCN_INTERVAL.
2161 */
2162static int
2163urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2164{
2165	struct r92c_tx_desc *desc = &uvp->bcn_desc;
2166	struct urtwn_data *bf;
2167
2168	URTWN_ASSERT_LOCKED(sc);
2169
2170	bf = urtwn_getbuf(sc);
2171	if (bf == NULL)
2172		return (ENOMEM);
2173
2174	memcpy(bf->buf, desc, sizeof(*desc));
2175	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
2176
2177	sc->sc_txtimer = 5;
2178	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2179
2180	return (0);
2181}
2182
2183static int
2184urtwn_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
2185    ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
2186{
2187	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2188	uint8_t i;
2189
2190	if (!(&vap->iv_nw_keys[0] <= k &&
2191	     k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
2192		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2193			URTWN_LOCK(sc);
2194			/*
2195			 * First 4 slots for group keys,
2196			 * what is left - for pairwise.
2197			 * XXX incompatible with IBSS RSN.
2198			 */
2199			for (i = IEEE80211_WEP_NKID;
2200			     i < R92C_CAM_ENTRY_COUNT; i++) {
2201				if ((sc->keys_bmap & (1 << i)) == 0) {
2202					sc->keys_bmap |= 1 << i;
2203					*keyix = i;
2204					break;
2205				}
2206			}
2207			URTWN_UNLOCK(sc);
2208			if (i == R92C_CAM_ENTRY_COUNT) {
2209				device_printf(sc->sc_dev,
2210				    "%s: no free space in the key table\n",
2211				    __func__);
2212				return 0;
2213			}
2214		} else
2215			*keyix = 0;
2216	} else {
2217		*keyix = k - vap->iv_nw_keys;
2218	}
2219	*rxkeyix = *keyix;
2220	return 1;
2221}
2222
2223static void
2224urtwn_key_set_cb(struct urtwn_softc *sc, union sec_param *data)
2225{
2226	struct ieee80211_key *k = &data->key;
2227	uint8_t algo, keyid;
2228	int i, error;
2229
2230	if (k->wk_keyix < IEEE80211_WEP_NKID)
2231		keyid = k->wk_keyix;
2232	else
2233		keyid = 0;
2234
2235	/* Map net80211 cipher to HW crypto algorithm. */
2236	switch (k->wk_cipher->ic_cipher) {
2237	case IEEE80211_CIPHER_WEP:
2238		if (k->wk_keylen < 8)
2239			algo = R92C_CAM_ALGO_WEP40;
2240		else
2241			algo = R92C_CAM_ALGO_WEP104;
2242		break;
2243	case IEEE80211_CIPHER_TKIP:
2244		algo = R92C_CAM_ALGO_TKIP;
2245		break;
2246	case IEEE80211_CIPHER_AES_CCM:
2247		algo = R92C_CAM_ALGO_AES;
2248		break;
2249	default:
2250		device_printf(sc->sc_dev, "%s: undefined cipher %d\n",
2251		    __func__, k->wk_cipher->ic_cipher);
2252		return;
2253	}
2254
2255	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2256	    "%s: keyix %d, keyid %d, algo %d/%d, flags %04X, len %d, "
2257	    "macaddr %s\n", __func__, k->wk_keyix, keyid,
2258	    k->wk_cipher->ic_cipher, algo, k->wk_flags, k->wk_keylen,
2259	    ether_sprintf(k->wk_macaddr));
2260
2261	/* Write key. */
2262	for (i = 0; i < 4; i++) {
2263		error = urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i),
2264		    LE_READ_4(&k->wk_key[i * 4]));
2265		if (error != 0)
2266			goto fail;
2267	}
2268
2269	/* Write CTL0 last since that will validate the CAM entry. */
2270	error = urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix),
2271	    LE_READ_4(&k->wk_macaddr[2]));
2272	if (error != 0)
2273		goto fail;
2274	error = urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix),
2275	    SM(R92C_CAM_ALGO, algo) |
2276	    SM(R92C_CAM_KEYID, keyid) |
2277	    SM(R92C_CAM_MACLO, LE_READ_2(&k->wk_macaddr[0])) |
2278	    R92C_CAM_VALID);
2279	if (error != 0)
2280		goto fail;
2281
2282	return;
2283
2284fail:
2285	device_printf(sc->sc_dev, "%s fails, error %d\n", __func__, error);
2286}
2287
2288static void
2289urtwn_key_del_cb(struct urtwn_softc *sc, union sec_param *data)
2290{
2291	struct ieee80211_key *k = &data->key;
2292	int i;
2293
2294	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2295	    "%s: keyix %d, flags %04X, macaddr %s\n", __func__,
2296	    k->wk_keyix, k->wk_flags, ether_sprintf(k->wk_macaddr));
2297
2298	urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix), 0);
2299	urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix), 0);
2300
2301	/* Clear key. */
2302	for (i = 0; i < 4; i++)
2303		urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i), 0);
2304	sc->keys_bmap &= ~(1 << k->wk_keyix);
2305}
2306
2307static int
2308urtwn_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
2309{
2310	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2311
2312	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2313		/* Not for us. */
2314		return (1);
2315	}
2316
2317	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_set_cb));
2318}
2319
2320static int
2321urtwn_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
2322{
2323	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2324
2325	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2326		/* Not for us. */
2327		return (1);
2328	}
2329
2330	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_del_cb));
2331}
2332
2333static void
2334urtwn_tsf_task_adhoc(void *arg, int pending)
2335{
2336	struct ieee80211vap *vap = arg;
2337	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2338	struct ieee80211_node *ni;
2339	uint32_t reg;
2340
2341	URTWN_LOCK(sc);
2342	ni = ieee80211_ref_node(vap->iv_bss);
2343	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
2344
2345	/* Accept beacons with the same BSSID. */
2346	urtwn_set_rx_bssid_all(sc, 0);
2347
2348	/* Enable synchronization. */
2349	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
2350	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2351
2352	/* Synchronize. */
2353	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
2354
2355	/* Disable synchronization. */
2356	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
2357	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2358
2359	/* Remove beacon filter. */
2360	urtwn_set_rx_bssid_all(sc, 1);
2361
2362	/* Enable beaconing. */
2363	urtwn_write_1(sc, R92C_MBID_NUM,
2364	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2365	reg |= R92C_BCN_CTRL_EN_BCN;
2366
2367	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2368	ieee80211_free_node(ni);
2369	URTWN_UNLOCK(sc);
2370}
2371
2372static void
2373urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
2374{
2375	struct ieee80211com *ic = &sc->sc_ic;
2376	struct urtwn_vap *uvp = URTWN_VAP(vap);
2377
2378	/* Reset TSF. */
2379	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2380
2381	switch (vap->iv_opmode) {
2382	case IEEE80211_M_STA:
2383		/* Enable TSF synchronization. */
2384		urtwn_write_1(sc, R92C_BCN_CTRL,
2385		    urtwn_read_1(sc, R92C_BCN_CTRL) &
2386		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
2387		break;
2388	case IEEE80211_M_IBSS:
2389		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
2390		break;
2391	case IEEE80211_M_HOSTAP:
2392		/* Enable beaconing. */
2393		urtwn_write_1(sc, R92C_MBID_NUM,
2394		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2395		urtwn_write_1(sc, R92C_BCN_CTRL,
2396		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
2397		break;
2398	default:
2399		device_printf(sc->sc_dev, "undefined opmode %d\n",
2400		    vap->iv_opmode);
2401		return;
2402	}
2403}
2404
2405static void
2406urtwn_get_tsf(struct urtwn_softc *sc, uint64_t *buf)
2407{
2408	urtwn_read_region_1(sc, R92C_TSFTR, (uint8_t *)buf, sizeof(*buf));
2409}
2410
2411static void
2412urtwn_set_led(struct urtwn_softc *sc, int led, int on)
2413{
2414	uint8_t reg;
2415
2416	if (led == URTWN_LED_LINK) {
2417		if (sc->chip & URTWN_CHIP_88E) {
2418			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
2419			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
2420			if (!on) {
2421				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
2422				urtwn_write_1(sc, R92C_LEDCFG2,
2423				    reg | R92C_LEDCFG0_DIS);
2424				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
2425				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
2426				    0xfe);
2427			}
2428		} else {
2429			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
2430			if (!on)
2431				reg |= R92C_LEDCFG0_DIS;
2432			urtwn_write_1(sc, R92C_LEDCFG0, reg);
2433		}
2434		sc->ledlink = on;       /* Save LED state. */
2435	}
2436}
2437
2438static void
2439urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
2440{
2441	uint8_t reg;
2442
2443	reg = urtwn_read_1(sc, R92C_MSR);
2444	reg = (reg & ~R92C_MSR_MASK) | mode;
2445	urtwn_write_1(sc, R92C_MSR, reg);
2446}
2447
2448static void
2449urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2450    const struct ieee80211_rx_stats *rxs,
2451    int rssi, int nf)
2452{
2453	struct ieee80211vap *vap = ni->ni_vap;
2454	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2455	struct urtwn_vap *uvp = URTWN_VAP(vap);
2456	uint64_t ni_tstamp, curr_tstamp;
2457
2458	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2459
2460	if (vap->iv_state == IEEE80211_S_RUN &&
2461	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2462	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2463		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2464		URTWN_LOCK(sc);
2465		urtwn_get_tsf(sc, &curr_tstamp);
2466		URTWN_UNLOCK(sc);
2467		curr_tstamp = le64toh(curr_tstamp);
2468
2469		if (ni_tstamp >= curr_tstamp)
2470			(void) ieee80211_ibss_merge(ni);
2471	}
2472}
2473
2474static int
2475urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2476{
2477	struct urtwn_vap *uvp = URTWN_VAP(vap);
2478	struct ieee80211com *ic = vap->iv_ic;
2479	struct urtwn_softc *sc = ic->ic_softc;
2480	struct ieee80211_node *ni;
2481	enum ieee80211_state ostate;
2482	uint32_t reg;
2483	uint8_t mode;
2484	int error = 0;
2485
2486	ostate = vap->iv_state;
2487	URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s -> %s\n",
2488	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
2489
2490	IEEE80211_UNLOCK(ic);
2491	URTWN_LOCK(sc);
2492	callout_stop(&sc->sc_watchdog_ch);
2493
2494	if (ostate == IEEE80211_S_RUN) {
2495		/* Stop calibration. */
2496		callout_stop(&sc->sc_calib_to);
2497
2498		/* Turn link LED off. */
2499		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2500
2501		/* Set media status to 'No Link'. */
2502		urtwn_set_mode(sc, R92C_MSR_NOLINK);
2503
2504		/* Stop Rx of data frames. */
2505		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2506
2507		/* Disable TSF synchronization. */
2508		urtwn_write_1(sc, R92C_BCN_CTRL,
2509		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2510		    R92C_BCN_CTRL_DIS_TSF_UDT0);
2511
2512		/* Disable beaconing. */
2513		urtwn_write_1(sc, R92C_MBID_NUM,
2514		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2515
2516		/* Reset TSF. */
2517		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2518
2519		/* Reset EDCA parameters. */
2520		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2521		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2522		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2523		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2524	}
2525
2526	switch (nstate) {
2527	case IEEE80211_S_INIT:
2528		/* Turn link LED off. */
2529		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2530		break;
2531	case IEEE80211_S_SCAN:
2532		/* Pause AC Tx queues. */
2533		urtwn_write_1(sc, R92C_TXPAUSE,
2534		    urtwn_read_1(sc, R92C_TXPAUSE) | R92C_TX_QUEUE_AC);
2535		break;
2536	case IEEE80211_S_AUTH:
2537		urtwn_set_chan(sc, ic->ic_curchan, NULL);
2538		break;
2539	case IEEE80211_S_RUN:
2540		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2541			/* Turn link LED on. */
2542			urtwn_set_led(sc, URTWN_LED_LINK, 1);
2543			break;
2544		}
2545
2546		ni = ieee80211_ref_node(vap->iv_bss);
2547
2548		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2549		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
2550			device_printf(sc->sc_dev,
2551			    "%s: could not move to RUN state\n", __func__);
2552			error = EINVAL;
2553			goto end_run;
2554		}
2555
2556		switch (vap->iv_opmode) {
2557		case IEEE80211_M_STA:
2558			mode = R92C_MSR_INFRA;
2559			break;
2560		case IEEE80211_M_IBSS:
2561			mode = R92C_MSR_ADHOC;
2562			break;
2563		case IEEE80211_M_HOSTAP:
2564			mode = R92C_MSR_AP;
2565			break;
2566		default:
2567			device_printf(sc->sc_dev, "undefined opmode %d\n",
2568			    vap->iv_opmode);
2569			error = EINVAL;
2570			goto end_run;
2571		}
2572
2573		/* Set media status to 'Associated'. */
2574		urtwn_set_mode(sc, mode);
2575
2576		/* Set BSSID. */
2577		urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
2578		urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
2579
2580		if (ic->ic_curmode == IEEE80211_MODE_11B)
2581			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2582		else	/* 802.11b/g */
2583			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2584
2585		/* Enable Rx of data frames. */
2586		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2587
2588		/* Flush all AC queues. */
2589		urtwn_write_1(sc, R92C_TXPAUSE, 0);
2590
2591		/* Set beacon interval. */
2592		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2593
2594		/* Allow Rx from our BSSID only. */
2595		if (ic->ic_promisc == 0) {
2596			reg = urtwn_read_4(sc, R92C_RCR);
2597
2598			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2599				reg |= R92C_RCR_CBSSID_DATA;
2600			if (vap->iv_opmode != IEEE80211_M_IBSS)
2601				reg |= R92C_RCR_CBSSID_BCN;
2602
2603			urtwn_write_4(sc, R92C_RCR, reg);
2604		}
2605
2606		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2607		    vap->iv_opmode == IEEE80211_M_IBSS) {
2608			error = urtwn_setup_beacon(sc, ni);
2609			if (error != 0) {
2610				device_printf(sc->sc_dev,
2611				    "unable to push beacon into the chip, "
2612				    "error %d\n", error);
2613				goto end_run;
2614			}
2615		}
2616
2617		/* Enable TSF synchronization. */
2618		urtwn_tsf_sync_enable(sc, vap);
2619
2620		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2621		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2622		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2623		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2624		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2625		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2626
2627		/* Intialize rate adaptation. */
2628		if (!(sc->chip & URTWN_CHIP_88E))
2629			urtwn_ra_init(sc);
2630		/* Turn link LED on. */
2631		urtwn_set_led(sc, URTWN_LED_LINK, 1);
2632
2633		sc->avg_pwdb = -1;	/* Reset average RSSI. */
2634		/* Reset temperature calibration state machine. */
2635		sc->sc_flags &= ~URTWN_TEMP_MEASURED;
2636		sc->thcal_lctemp = 0;
2637		/* Start periodic calibration. */
2638		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2639
2640end_run:
2641		ieee80211_free_node(ni);
2642		break;
2643	default:
2644		break;
2645	}
2646
2647	URTWN_UNLOCK(sc);
2648	IEEE80211_LOCK(ic);
2649	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2650}
2651
2652static void
2653urtwn_calib_to(void *arg)
2654{
2655	struct urtwn_softc *sc = arg;
2656
2657	/* Do it in a process context. */
2658	urtwn_cmd_sleepable(sc, NULL, 0, urtwn_calib_cb);
2659}
2660
2661static void
2662urtwn_calib_cb(struct urtwn_softc *sc, union sec_param *data)
2663{
2664	/* Do temperature compensation. */
2665	urtwn_temp_calib(sc);
2666
2667	if ((urtwn_read_1(sc, R92C_MSR) & R92C_MSR_MASK) != R92C_MSR_NOLINK)
2668		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2669}
2670
2671static void
2672urtwn_watchdog(void *arg)
2673{
2674	struct urtwn_softc *sc = arg;
2675
2676	if (sc->sc_txtimer > 0) {
2677		if (--sc->sc_txtimer == 0) {
2678			device_printf(sc->sc_dev, "device timeout\n");
2679			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2680			return;
2681		}
2682		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2683	}
2684}
2685
2686static void
2687urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2688{
2689	int pwdb;
2690
2691	/* Convert antenna signal to percentage. */
2692	if (rssi <= -100 || rssi >= 20)
2693		pwdb = 0;
2694	else if (rssi >= 0)
2695		pwdb = 100;
2696	else
2697		pwdb = 100 + rssi;
2698	if (!(sc->chip & URTWN_CHIP_88E)) {
2699		if (rate <= URTWN_RIDX_CCK11) {
2700			/* CCK gain is smaller than OFDM/MCS gain. */
2701			pwdb += 6;
2702			if (pwdb > 100)
2703				pwdb = 100;
2704			if (pwdb <= 14)
2705				pwdb -= 4;
2706			else if (pwdb <= 26)
2707				pwdb -= 8;
2708			else if (pwdb <= 34)
2709				pwdb -= 6;
2710			else if (pwdb <= 42)
2711				pwdb -= 2;
2712		}
2713	}
2714	if (sc->avg_pwdb == -1)	/* Init. */
2715		sc->avg_pwdb = pwdb;
2716	else if (sc->avg_pwdb < pwdb)
2717		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2718	else
2719		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2720	URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: PWDB %d, EMA %d\n", __func__,
2721	    pwdb, sc->avg_pwdb);
2722}
2723
2724static int8_t
2725urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2726{
2727	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2728	struct r92c_rx_phystat *phy;
2729	struct r92c_rx_cck *cck;
2730	uint8_t rpt;
2731	int8_t rssi;
2732
2733	if (rate <= URTWN_RIDX_CCK11) {
2734		cck = (struct r92c_rx_cck *)physt;
2735		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2736			rpt = (cck->agc_rpt >> 5) & 0x3;
2737			rssi = (cck->agc_rpt & 0x1f) << 1;
2738		} else {
2739			rpt = (cck->agc_rpt >> 6) & 0x3;
2740			rssi = cck->agc_rpt & 0x3e;
2741		}
2742		rssi = cckoff[rpt] - rssi;
2743	} else {	/* OFDM/HT. */
2744		phy = (struct r92c_rx_phystat *)physt;
2745		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2746	}
2747	return (rssi);
2748}
2749
2750static int8_t
2751urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2752{
2753	struct r92c_rx_phystat *phy;
2754	struct r88e_rx_cck *cck;
2755	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2756	int8_t rssi;
2757
2758	rssi = 0;
2759	if (rate <= URTWN_RIDX_CCK11) {
2760		cck = (struct r88e_rx_cck *)physt;
2761		cck_agc_rpt = cck->agc_rpt;
2762		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2763		vga_idx = cck_agc_rpt & 0x1f;
2764		switch (lna_idx) {
2765		case 7:
2766			if (vga_idx <= 27)
2767				rssi = -100 + 2* (27 - vga_idx);
2768			else
2769				rssi = -100;
2770			break;
2771		case 6:
2772			rssi = -48 + 2 * (2 - vga_idx);
2773			break;
2774		case 5:
2775			rssi = -42 + 2 * (7 - vga_idx);
2776			break;
2777		case 4:
2778			rssi = -36 + 2 * (7 - vga_idx);
2779			break;
2780		case 3:
2781			rssi = -24 + 2 * (7 - vga_idx);
2782			break;
2783		case 2:
2784			rssi = -12 + 2 * (5 - vga_idx);
2785			break;
2786		case 1:
2787			rssi = 8 - (2 * vga_idx);
2788			break;
2789		case 0:
2790			rssi = 14 - (2 * vga_idx);
2791			break;
2792		}
2793		rssi += 6;
2794	} else {	/* OFDM/HT. */
2795		phy = (struct r92c_rx_phystat *)physt;
2796		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2797	}
2798	return (rssi);
2799}
2800
2801static __inline uint8_t
2802rate2ridx(uint8_t rate)
2803{
2804	if (rate & IEEE80211_RATE_MCS) {
2805		/* 11n rates start at idx 12 */
2806		return ((rate & 0xf) + 12);
2807	}
2808	switch (rate) {
2809	/* 11g */
2810	case 12:	return 4;
2811	case 18:	return 5;
2812	case 24:	return 6;
2813	case 36:	return 7;
2814	case 48:	return 8;
2815	case 72:	return 9;
2816	case 96:	return 10;
2817	case 108:	return 11;
2818	/* 11b */
2819	case 2:		return 0;
2820	case 4:		return 1;
2821	case 11:	return 2;
2822	case 22:	return 3;
2823	default:	return 0;
2824	}
2825}
2826
2827static int
2828urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2829    struct mbuf *m, struct urtwn_data *data)
2830{
2831	const struct ieee80211_txparam *tp;
2832	struct ieee80211com *ic = &sc->sc_ic;
2833	struct ieee80211vap *vap = ni->ni_vap;
2834	struct ieee80211_key *k = NULL;
2835	struct ieee80211_channel *chan;
2836	struct ieee80211_frame *wh;
2837	struct r92c_tx_desc *txd;
2838	uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2839	int hasqos, ismcast;
2840
2841	URTWN_ASSERT_LOCKED(sc);
2842
2843	/*
2844	 * Software crypto.
2845	 */
2846	wh = mtod(m, struct ieee80211_frame *);
2847	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2848	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2849	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2850	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2851
2852	/* Select TX ring for this frame. */
2853	if (hasqos) {
2854		tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2855		tid &= IEEE80211_QOS_TID;
2856	} else
2857		tid = 0;
2858
2859	chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2860		ni->ni_chan : ic->ic_curchan;
2861	tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2862
2863	/* Choose a TX rate index. */
2864	if (type == IEEE80211_FC0_TYPE_MGT)
2865		rate = tp->mgmtrate;
2866	else if (ismcast)
2867		rate = tp->mcastrate;
2868	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2869		rate = tp->ucastrate;
2870	else if (m->m_flags & M_EAPOL)
2871		rate = tp->mgmtrate;
2872	else {
2873		if (URTWN_CHIP_HAS_RATECTL(sc)) {
2874			/* XXX pass pktlen */
2875			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2876			rate = ni->ni_txrate;
2877		} else {
2878			/* XXX TODO: drop the default rate for 11b/11g? */
2879			if (ni->ni_flags & IEEE80211_NODE_HT)
2880				rate = IEEE80211_RATE_MCS | 0x4; /* MCS4 */
2881			else if (ic->ic_curmode != IEEE80211_MODE_11B)
2882				rate = 108;
2883			else
2884				rate = 22;
2885		}
2886	}
2887
2888	/*
2889	 * XXX TODO: this should be per-node, for 11b versus 11bg
2890	 * nodes in hostap mode
2891	 */
2892	ridx = rate2ridx(rate);
2893	if (ni->ni_flags & IEEE80211_NODE_HT)
2894		raid = R92C_RAID_11GN;
2895	else if (ic->ic_curmode != IEEE80211_MODE_11B)
2896		raid = R92C_RAID_11BG;
2897	else
2898		raid = R92C_RAID_11B;
2899
2900	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2901		k = ieee80211_crypto_encap(ni, m);
2902		if (k == NULL) {
2903			device_printf(sc->sc_dev,
2904			    "ieee80211_crypto_encap returns NULL.\n");
2905			return (ENOBUFS);
2906		}
2907
2908		/* in case packet header moved, reset pointer */
2909		wh = mtod(m, struct ieee80211_frame *);
2910	}
2911
2912	/* Fill Tx descriptor. */
2913	txd = (struct r92c_tx_desc *)data->buf;
2914	memset(txd, 0, sizeof(*txd));
2915
2916	txd->txdw0 |= htole32(
2917	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2918	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2919	if (ismcast)
2920		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2921
2922	if (!ismcast) {
2923		if (sc->chip & URTWN_CHIP_88E) {
2924			struct urtwn_node *un = URTWN_NODE(ni);
2925			macid = un->id;
2926		} else
2927			macid = URTWN_MACID_BSS;
2928
2929		if (type == IEEE80211_FC0_TYPE_DATA) {
2930			qsel = tid % URTWN_MAX_TID;
2931
2932			if (sc->chip & URTWN_CHIP_88E) {
2933				txd->txdw2 |= htole32(
2934				    R88E_TXDW2_AGGBK |
2935				    R88E_TXDW2_CCX_RPT);
2936			} else
2937				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2938
2939			/* protmode, non-HT */
2940			/* XXX TODO: noack frames? */
2941			if ((rate & 0x80) == 0 &&
2942			    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2943				switch (ic->ic_protmode) {
2944				case IEEE80211_PROT_CTSONLY:
2945					txd->txdw4 |= htole32(
2946					    R92C_TXDW4_CTS2SELF |
2947					    R92C_TXDW4_HWRTSEN);
2948					break;
2949				case IEEE80211_PROT_RTSCTS:
2950					txd->txdw4 |= htole32(
2951					    R92C_TXDW4_RTSEN |
2952					    R92C_TXDW4_HWRTSEN);
2953					break;
2954				default:
2955					break;
2956				}
2957			}
2958
2959			/* protmode, HT */
2960			/* XXX TODO: noack frames? */
2961			if ((rate & 0x80) &&
2962			    (ic->ic_htprotmode == IEEE80211_PROT_RTSCTS)) {
2963				txd->txdw4 |= htole32(
2964				    R92C_TXDW4_RTSEN |
2965				    R92C_TXDW4_HWRTSEN);
2966			}
2967
2968			/* XXX TODO: rtsrate is configurable? 24mbit may
2969			 * be a bit high for RTS rate? */
2970			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2971			    URTWN_RIDX_OFDM24));
2972
2973			txd->txdw5 |= htole32(0x0001ff00);
2974		} else	/* IEEE80211_FC0_TYPE_MGT */
2975			qsel = R92C_TXDW1_QSEL_MGNT;
2976	} else {
2977		macid = URTWN_MACID_BC;
2978		qsel = R92C_TXDW1_QSEL_MGNT;
2979	}
2980
2981	txd->txdw1 |= htole32(
2982	    SM(R92C_TXDW1_QSEL, qsel) |
2983	    SM(R92C_TXDW1_RAID, raid));
2984
2985	/* XXX TODO: 40MHZ flag? */
2986	/* XXX TODO: AMPDU flag? (AGG_ENABLE or AGG_BREAK?) Density shift? */
2987	/* XXX Short preamble? */
2988	/* XXX Short-GI? */
2989
2990	if (sc->chip & URTWN_CHIP_88E)
2991		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2992	else
2993		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2994
2995	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2996
2997	/* Force this rate if needed. */
2998	if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
2999	    (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) ||
3000	    (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
3001		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3002
3003	if (!hasqos) {
3004		/* Use HW sequence numbering for non-QoS frames. */
3005		if (sc->chip & URTWN_CHIP_88E)
3006			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3007		else
3008			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3009	} else {
3010		/* Set sequence number. */
3011		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3012	}
3013
3014	if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3015		uint8_t cipher;
3016
3017		switch (k->wk_cipher->ic_cipher) {
3018		case IEEE80211_CIPHER_WEP:
3019		case IEEE80211_CIPHER_TKIP:
3020			cipher = R92C_TXDW1_CIPHER_RC4;
3021			break;
3022		case IEEE80211_CIPHER_AES_CCM:
3023			cipher = R92C_TXDW1_CIPHER_AES;
3024			break;
3025		default:
3026			device_printf(sc->sc_dev, "%s: unknown cipher %d\n",
3027			    __func__, k->wk_cipher->ic_cipher);
3028			return (EINVAL);
3029		}
3030
3031		txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3032	}
3033
3034	if (ieee80211_radiotap_active_vap(vap)) {
3035		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3036
3037		tap->wt_flags = 0;
3038		if (k != NULL)
3039			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3040		ieee80211_radiotap_tx(vap, m);
3041	}
3042
3043	data->ni = ni;
3044
3045	urtwn_tx_start(sc, m, type, data);
3046
3047	return (0);
3048}
3049
3050static int
3051urtwn_tx_raw(struct urtwn_softc *sc, struct ieee80211_node *ni,
3052    struct mbuf *m, struct urtwn_data *data,
3053    const struct ieee80211_bpf_params *params)
3054{
3055	struct ieee80211vap *vap = ni->ni_vap;
3056	struct ieee80211_key *k = NULL;
3057	struct ieee80211_frame *wh;
3058	struct r92c_tx_desc *txd;
3059	uint8_t cipher, ridx, type;
3060
3061	/* Encrypt the frame if need be. */
3062	cipher = R92C_TXDW1_CIPHER_NONE;
3063	if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
3064		/* Retrieve key for TX. */
3065		k = ieee80211_crypto_encap(ni, m);
3066		if (k == NULL)
3067			return (ENOBUFS);
3068
3069		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3070			switch (k->wk_cipher->ic_cipher) {
3071			case IEEE80211_CIPHER_WEP:
3072			case IEEE80211_CIPHER_TKIP:
3073				cipher = R92C_TXDW1_CIPHER_RC4;
3074				break;
3075			case IEEE80211_CIPHER_AES_CCM:
3076				cipher = R92C_TXDW1_CIPHER_AES;
3077				break;
3078			default:
3079				device_printf(sc->sc_dev,
3080				    "%s: unknown cipher %d\n",
3081				    __func__, k->wk_cipher->ic_cipher);
3082				return (EINVAL);
3083			}
3084		}
3085	}
3086
3087	/* XXX TODO: 11n checks, matching urtwn_tx_data() */
3088
3089	wh = mtod(m, struct ieee80211_frame *);
3090	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3091
3092	/* Fill Tx descriptor. */
3093	txd = (struct r92c_tx_desc *)data->buf;
3094	memset(txd, 0, sizeof(*txd));
3095
3096	txd->txdw0 |= htole32(
3097	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
3098	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
3099	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3100		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
3101
3102	if (params->ibp_flags & IEEE80211_BPF_RTS)
3103		txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
3104	if (params->ibp_flags & IEEE80211_BPF_CTS)
3105		txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
3106	if (txd->txdw4 & htole32(R92C_TXDW4_RTSEN | R92C_TXDW4_CTS2SELF)) {
3107		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
3108		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
3109		    URTWN_RIDX_OFDM24));
3110	}
3111
3112	if (sc->chip & URTWN_CHIP_88E)
3113		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
3114	else
3115		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
3116
3117	/* XXX TODO: rate index/config (RAID) for 11n? */
3118	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
3119	txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3120
3121	/* Choose a TX rate index. */
3122	ridx = rate2ridx(params->ibp_rate0);
3123	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3124	txd->txdw5 |= htole32(0x0001ff00);
3125	txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3126
3127	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
3128		/* Use HW sequence numbering for non-QoS frames. */
3129		if (sc->chip & URTWN_CHIP_88E)
3130			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3131		else
3132			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3133	} else {
3134		/* Set sequence number. */
3135		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3136	}
3137
3138	if (ieee80211_radiotap_active_vap(vap)) {
3139		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3140
3141		tap->wt_flags = 0;
3142		if (k != NULL)
3143			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3144		ieee80211_radiotap_tx(vap, m);
3145	}
3146
3147	data->ni = ni;
3148
3149	urtwn_tx_start(sc, m, type, data);
3150
3151	return (0);
3152}
3153
3154static void
3155urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
3156    struct urtwn_data *data)
3157{
3158	struct usb_xfer *xfer;
3159	struct r92c_tx_desc *txd;
3160	uint16_t ac, sum;
3161	int i, xferlen;
3162
3163	URTWN_ASSERT_LOCKED(sc);
3164
3165	ac = M_WME_GETAC(m);
3166
3167	switch (type) {
3168	case IEEE80211_FC0_TYPE_CTL:
3169	case IEEE80211_FC0_TYPE_MGT:
3170		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
3171		break;
3172	default:
3173		xfer = sc->sc_xfer[wme2queue[ac].qid];
3174		break;
3175	}
3176
3177	txd = (struct r92c_tx_desc *)data->buf;
3178	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
3179
3180	/* Compute Tx descriptor checksum. */
3181	sum = 0;
3182	for (i = 0; i < sizeof(*txd) / 2; i++)
3183		sum ^= ((uint16_t *)txd)[i];
3184	txd->txdsum = sum;	/* NB: already little endian. */
3185
3186	xferlen = sizeof(*txd) + m->m_pkthdr.len;
3187	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
3188
3189	data->buflen = xferlen;
3190	data->m = m;
3191
3192	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
3193	usbd_transfer_start(xfer);
3194}
3195
3196static int
3197urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
3198{
3199	struct urtwn_softc *sc = ic->ic_softc;
3200	int error;
3201
3202	URTWN_LOCK(sc);
3203	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
3204		URTWN_UNLOCK(sc);
3205		return (ENXIO);
3206	}
3207	error = mbufq_enqueue(&sc->sc_snd, m);
3208	if (error) {
3209		URTWN_UNLOCK(sc);
3210		return (error);
3211	}
3212	urtwn_start(sc);
3213	URTWN_UNLOCK(sc);
3214
3215	return (0);
3216}
3217
3218static void
3219urtwn_start(struct urtwn_softc *sc)
3220{
3221	struct ieee80211_node *ni;
3222	struct mbuf *m;
3223	struct urtwn_data *bf;
3224
3225	URTWN_ASSERT_LOCKED(sc);
3226	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3227		bf = urtwn_getbuf(sc);
3228		if (bf == NULL) {
3229			mbufq_prepend(&sc->sc_snd, m);
3230			break;
3231		}
3232		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3233		m->m_pkthdr.rcvif = NULL;
3234
3235		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
3236		    __func__,
3237		    m);
3238
3239		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
3240			if_inc_counter(ni->ni_vap->iv_ifp,
3241			    IFCOUNTER_OERRORS, 1);
3242			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3243			m_freem(m);
3244			ieee80211_free_node(ni);
3245			break;
3246		}
3247		sc->sc_txtimer = 5;
3248		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3249	}
3250}
3251
3252static void
3253urtwn_parent(struct ieee80211com *ic)
3254{
3255	struct urtwn_softc *sc = ic->ic_softc;
3256
3257	URTWN_LOCK(sc);
3258	if (sc->sc_flags & URTWN_DETACHED) {
3259		URTWN_UNLOCK(sc);
3260		return;
3261	}
3262	URTWN_UNLOCK(sc);
3263
3264	if (ic->ic_nrunning > 0) {
3265		if (urtwn_init(sc) != 0) {
3266			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3267			if (vap != NULL)
3268				ieee80211_stop(vap);
3269		} else
3270			ieee80211_start_all(ic);
3271	} else
3272		urtwn_stop(sc);
3273}
3274
3275static __inline int
3276urtwn_power_on(struct urtwn_softc *sc)
3277{
3278
3279	return sc->sc_power_on(sc);
3280}
3281
3282static int
3283urtwn_r92c_power_on(struct urtwn_softc *sc)
3284{
3285	uint32_t reg;
3286	usb_error_t error;
3287	int ntries;
3288
3289	/* Wait for autoload done bit. */
3290	for (ntries = 0; ntries < 1000; ntries++) {
3291		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
3292			break;
3293		urtwn_ms_delay(sc);
3294	}
3295	if (ntries == 1000) {
3296		device_printf(sc->sc_dev,
3297		    "timeout waiting for chip autoload\n");
3298		return (ETIMEDOUT);
3299	}
3300
3301	/* Unlock ISO/CLK/Power control register. */
3302	error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
3303	if (error != USB_ERR_NORMAL_COMPLETION)
3304		return (EIO);
3305	/* Move SPS into PWM mode. */
3306	error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
3307	if (error != USB_ERR_NORMAL_COMPLETION)
3308		return (EIO);
3309	urtwn_ms_delay(sc);
3310
3311	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
3312	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
3313		error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3314		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
3315		if (error != USB_ERR_NORMAL_COMPLETION)
3316			return (EIO);
3317		urtwn_ms_delay(sc);
3318		error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3319		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
3320		    ~R92C_SYS_ISO_CTRL_MD2PP);
3321		if (error != USB_ERR_NORMAL_COMPLETION)
3322			return (EIO);
3323	}
3324
3325	/* Auto enable WLAN. */
3326	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3327	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3328	if (error != USB_ERR_NORMAL_COMPLETION)
3329		return (EIO);
3330	for (ntries = 0; ntries < 1000; ntries++) {
3331		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3332		    R92C_APS_FSMCO_APFM_ONMAC))
3333			break;
3334		urtwn_ms_delay(sc);
3335	}
3336	if (ntries == 1000) {
3337		device_printf(sc->sc_dev,
3338		    "timeout waiting for MAC auto ON\n");
3339		return (ETIMEDOUT);
3340	}
3341
3342	/* Enable radio, GPIO and LED functions. */
3343	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3344	    R92C_APS_FSMCO_AFSM_HSUS |
3345	    R92C_APS_FSMCO_PDN_EN |
3346	    R92C_APS_FSMCO_PFM_ALDN);
3347	if (error != USB_ERR_NORMAL_COMPLETION)
3348		return (EIO);
3349	/* Release RF digital isolation. */
3350	error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
3351	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
3352	if (error != USB_ERR_NORMAL_COMPLETION)
3353		return (EIO);
3354
3355	/* Initialize MAC. */
3356	error = urtwn_write_1(sc, R92C_APSD_CTRL,
3357	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
3358	if (error != USB_ERR_NORMAL_COMPLETION)
3359		return (EIO);
3360	for (ntries = 0; ntries < 200; ntries++) {
3361		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
3362		    R92C_APSD_CTRL_OFF_STATUS))
3363			break;
3364		urtwn_ms_delay(sc);
3365	}
3366	if (ntries == 200) {
3367		device_printf(sc->sc_dev,
3368		    "timeout waiting for MAC initialization\n");
3369		return (ETIMEDOUT);
3370	}
3371
3372	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3373	reg = urtwn_read_2(sc, R92C_CR);
3374	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3375	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3376	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3377	    R92C_CR_ENSEC;
3378	error = urtwn_write_2(sc, R92C_CR, reg);
3379	if (error != USB_ERR_NORMAL_COMPLETION)
3380		return (EIO);
3381
3382	error = urtwn_write_1(sc, 0xfe10, 0x19);
3383	if (error != USB_ERR_NORMAL_COMPLETION)
3384		return (EIO);
3385	return (0);
3386}
3387
3388static int
3389urtwn_r88e_power_on(struct urtwn_softc *sc)
3390{
3391	uint32_t reg;
3392	usb_error_t error;
3393	int ntries;
3394
3395	/* Wait for power ready bit. */
3396	for (ntries = 0; ntries < 5000; ntries++) {
3397		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
3398			break;
3399		urtwn_ms_delay(sc);
3400	}
3401	if (ntries == 5000) {
3402		device_printf(sc->sc_dev,
3403		    "timeout waiting for chip power up\n");
3404		return (ETIMEDOUT);
3405	}
3406
3407	/* Reset BB. */
3408	error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3409	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
3410	    R92C_SYS_FUNC_EN_BB_GLB_RST));
3411	if (error != USB_ERR_NORMAL_COMPLETION)
3412		return (EIO);
3413
3414	error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3415	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3416	if (error != USB_ERR_NORMAL_COMPLETION)
3417		return (EIO);
3418
3419	/* Disable HWPDN. */
3420	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3421	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
3422	if (error != USB_ERR_NORMAL_COMPLETION)
3423		return (EIO);
3424
3425	/* Disable WL suspend. */
3426	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3427	    urtwn_read_2(sc, R92C_APS_FSMCO) &
3428	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
3429	if (error != USB_ERR_NORMAL_COMPLETION)
3430		return (EIO);
3431
3432	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3433	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3434	if (error != USB_ERR_NORMAL_COMPLETION)
3435		return (EIO);
3436	for (ntries = 0; ntries < 5000; ntries++) {
3437		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3438		    R92C_APS_FSMCO_APFM_ONMAC))
3439			break;
3440		urtwn_ms_delay(sc);
3441	}
3442	if (ntries == 5000)
3443		return (ETIMEDOUT);
3444
3445	/* Enable LDO normal mode. */
3446	error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
3447	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~R92C_LPLDO_CTRL_SLEEP);
3448	if (error != USB_ERR_NORMAL_COMPLETION)
3449		return (EIO);
3450
3451	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3452	error = urtwn_write_2(sc, R92C_CR, 0);
3453	if (error != USB_ERR_NORMAL_COMPLETION)
3454		return (EIO);
3455	reg = urtwn_read_2(sc, R92C_CR);
3456	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3457	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3458	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
3459	error = urtwn_write_2(sc, R92C_CR, reg);
3460	if (error != USB_ERR_NORMAL_COMPLETION)
3461		return (EIO);
3462
3463	return (0);
3464}
3465
3466static __inline void
3467urtwn_power_off(struct urtwn_softc *sc)
3468{
3469
3470	return sc->sc_power_off(sc);
3471}
3472
3473static void
3474urtwn_r92c_power_off(struct urtwn_softc *sc)
3475{
3476	uint32_t reg;
3477
3478	/* Block all Tx queues. */
3479	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3480
3481	/* Disable RF */
3482	urtwn_rf_write(sc, 0, 0, 0);
3483
3484	urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
3485
3486	/* Reset BB state machine */
3487	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3488	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA |
3489	    R92C_SYS_FUNC_EN_BB_GLB_RST);
3490	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3491	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
3492
3493	/*
3494	 * Reset digital sequence
3495	 */
3496#ifndef URTWN_WITHOUT_UCODE
3497	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
3498		/* Reset MCU ready status */
3499		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3500
3501		/* If firmware in ram code, do reset */
3502		urtwn_fw_reset(sc);
3503	}
3504#endif
3505
3506	/* Reset MAC and Enable 8051 */
3507	urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1,
3508	    (R92C_SYS_FUNC_EN_CPUEN |
3509	     R92C_SYS_FUNC_EN_ELDR |
3510	     R92C_SYS_FUNC_EN_HWPDN) >> 8);
3511
3512	/* Reset MCU ready status */
3513	urtwn_write_1(sc, R92C_MCUFWDL, 0);
3514
3515	/* Disable MAC clock */
3516	urtwn_write_2(sc, R92C_SYS_CLKR,
3517	    R92C_SYS_CLKR_ANAD16V_EN |
3518	    R92C_SYS_CLKR_ANA8M |
3519	    R92C_SYS_CLKR_LOADER_EN |
3520	    R92C_SYS_CLKR_80M_SSC_DIS |
3521	    R92C_SYS_CLKR_SYS_EN |
3522	    R92C_SYS_CLKR_RING_EN |
3523	    0x4000);
3524
3525	/* Disable AFE PLL */
3526	urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80);
3527
3528	/* Gated AFE DIG_CLOCK */
3529	urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880F);
3530
3531	/* Isolated digital to PON */
3532	urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3533	    R92C_SYS_ISO_CTRL_MD2PP |
3534	    R92C_SYS_ISO_CTRL_PA2PCIE |
3535	    R92C_SYS_ISO_CTRL_PD2CORE |
3536	    R92C_SYS_ISO_CTRL_IP2MAC |
3537	    R92C_SYS_ISO_CTRL_DIOP |
3538	    R92C_SYS_ISO_CTRL_DIOE);
3539
3540	/*
3541	 * Pull GPIO PIN to balance level and LED control
3542	 */
3543	/* 1. Disable GPIO[7:0] */
3544	urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000);
3545
3546	reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00;
3547	reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000;
3548	urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg);
3549
3550	/* Disable GPIO[10:8] */
3551	urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00);
3552
3553	reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0;
3554	reg |= (((reg & 0x000f) << 4) | 0x0780);
3555	urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg);
3556
3557	/* Disable LED0 & 1 */
3558	urtwn_write_2(sc, R92C_LEDCFG0, 0x8080);
3559
3560	/*
3561	 * Reset digital sequence
3562	 */
3563	/* Disable ELDR clock */
3564	urtwn_write_2(sc, R92C_SYS_CLKR,
3565	    R92C_SYS_CLKR_ANAD16V_EN |
3566	    R92C_SYS_CLKR_ANA8M |
3567	    R92C_SYS_CLKR_LOADER_EN |
3568	    R92C_SYS_CLKR_80M_SSC_DIS |
3569	    R92C_SYS_CLKR_SYS_EN |
3570	    R92C_SYS_CLKR_RING_EN |
3571	    0x4000);
3572
3573	/* Isolated ELDR to PON */
3574	urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1,
3575	    (R92C_SYS_ISO_CTRL_DIOR |
3576	     R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8);
3577
3578	/*
3579	 * Disable analog sequence
3580	 */
3581	/* Disable A15 power */
3582	urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF);
3583	/* Disable digital core power */
3584	urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3585	    urtwn_read_1(sc, R92C_LDOV12D_CTRL) &
3586	      ~R92C_LDOV12D_CTRL_LDV12_EN);
3587
3588	/* Enter PFM mode */
3589	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
3590
3591	/* Set USB suspend */
3592	urtwn_write_2(sc, R92C_APS_FSMCO,
3593	    R92C_APS_FSMCO_APDM_HOST |
3594	    R92C_APS_FSMCO_AFSM_HSUS |
3595	    R92C_APS_FSMCO_PFM_ALDN);
3596
3597	/* Lock ISO/CLK/Power control register. */
3598	urtwn_write_1(sc, R92C_RSV_CTRL, 0x0E);
3599}
3600
3601static void
3602urtwn_r88e_power_off(struct urtwn_softc *sc)
3603{
3604	uint8_t reg;
3605	int ntries;
3606
3607	/* Disable any kind of TX reports. */
3608	urtwn_write_1(sc, R88E_TX_RPT_CTRL,
3609	    urtwn_read_1(sc, R88E_TX_RPT_CTRL) &
3610	      ~(R88E_TX_RPT1_ENA | R88E_TX_RPT2_ENA));
3611
3612	/* Stop Rx. */
3613	urtwn_write_1(sc, R92C_CR, 0);
3614
3615	/* Move card to Low Power State. */
3616	/* Block all Tx queues. */
3617	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3618
3619	for (ntries = 0; ntries < 20; ntries++) {
3620		/* Should be zero if no packet is transmitting. */
3621		if (urtwn_read_4(sc, R88E_SCH_TXCMD) == 0)
3622			break;
3623
3624		urtwn_ms_delay(sc);
3625	}
3626	if (ntries == 20) {
3627		device_printf(sc->sc_dev, "%s: failed to block Tx queues\n",
3628		    __func__);
3629		return;
3630	}
3631
3632	/* CCK and OFDM are disabled, and clock are gated. */
3633	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3634	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~R92C_SYS_FUNC_EN_BBRSTB);
3635
3636	urtwn_ms_delay(sc);
3637
3638	/* Reset MAC TRX */
3639	urtwn_write_1(sc, R92C_CR,
3640	    R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3641	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN |
3642	    R92C_CR_PROTOCOL_EN | R92C_CR_SCHEDULE_EN);
3643
3644	/* check if removed later */
3645	urtwn_write_1(sc, R92C_CR + 1,
3646	    urtwn_read_1(sc, R92C_CR + 1) & ~(R92C_CR_ENSEC >> 8));
3647
3648	/* Respond TxOK to scheduler */
3649	urtwn_write_1(sc, R92C_DUAL_TSF_RST,
3650	    urtwn_read_1(sc, R92C_DUAL_TSF_RST) | 0x20);
3651
3652	/* If firmware in ram code, do reset. */
3653#ifndef URTWN_WITHOUT_UCODE
3654	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY)
3655		urtwn_r88e_fw_reset(sc);
3656#endif
3657
3658	/* Reset MCU ready status. */
3659	urtwn_write_1(sc, R92C_MCUFWDL, 0x00);
3660
3661	/* Disable 32k. */
3662	urtwn_write_1(sc, R88E_32K_CTRL,
3663	    urtwn_read_1(sc, R88E_32K_CTRL) & ~0x01);
3664
3665	/* Move card to Disabled state. */
3666	/* Turn off RF. */
3667	urtwn_write_1(sc, R92C_RF_CTRL, 0);
3668
3669	/* LDO Sleep mode. */
3670	urtwn_write_1(sc, R92C_LPLDO_CTRL,
3671	    urtwn_read_1(sc, R92C_LPLDO_CTRL) | R92C_LPLDO_CTRL_SLEEP);
3672
3673	/* Turn off MAC by HW state machine */
3674	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3675	    urtwn_read_1(sc, R92C_APS_FSMCO + 1) |
3676	    (R92C_APS_FSMCO_APFM_OFF >> 8));
3677
3678	for (ntries = 0; ntries < 20; ntries++) {
3679		/* Wait until it will be disabled. */
3680		if ((urtwn_read_1(sc, R92C_APS_FSMCO + 1) &
3681		    (R92C_APS_FSMCO_APFM_OFF >> 8)) == 0)
3682			break;
3683
3684		urtwn_ms_delay(sc);
3685	}
3686	if (ntries == 20) {
3687		device_printf(sc->sc_dev, "%s: could not turn off MAC\n",
3688		    __func__);
3689		return;
3690	}
3691
3692	/* schmit trigger */
3693	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3694	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3695
3696	/* Enable WL suspend. */
3697	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3698	    (urtwn_read_1(sc, R92C_APS_FSMCO + 1) & ~0x10) | 0x08);
3699
3700	/* Enable bandgap mbias in suspend. */
3701	urtwn_write_1(sc, R92C_APS_FSMCO + 3, 0);
3702
3703	/* Clear SIC_EN register. */
3704	urtwn_write_1(sc, R92C_GPIO_MUXCFG + 1,
3705	    urtwn_read_1(sc, R92C_GPIO_MUXCFG + 1) & ~0x10);
3706
3707	/* Set USB suspend enable local register */
3708	urtwn_write_1(sc, R92C_USB_SUSPEND,
3709	    urtwn_read_1(sc, R92C_USB_SUSPEND) | 0x10);
3710
3711	/* Reset MCU IO Wrapper. */
3712	reg = urtwn_read_1(sc, R92C_RSV_CTRL + 1);
3713	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg & ~0x08);
3714	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg | 0x08);
3715
3716	/* marked as 'For Power Consumption' code. */
3717	urtwn_write_1(sc, R92C_GPIO_OUT, urtwn_read_1(sc, R92C_GPIO_IN));
3718	urtwn_write_1(sc, R92C_GPIO_IOSEL, 0xff);
3719
3720	urtwn_write_1(sc, R92C_GPIO_IO_SEL,
3721	    urtwn_read_1(sc, R92C_GPIO_IO_SEL) << 4);
3722	urtwn_write_1(sc, R92C_GPIO_MOD,
3723	    urtwn_read_1(sc, R92C_GPIO_MOD) | 0x0f);
3724
3725	/* Set LNA, TRSW, EX_PA Pin to output mode. */
3726	urtwn_write_4(sc, R88E_BB_PAD_CTRL, 0x00080808);
3727}
3728
3729static int
3730urtwn_llt_init(struct urtwn_softc *sc)
3731{
3732	int i, error, page_count, pktbuf_count;
3733
3734	page_count = (sc->chip & URTWN_CHIP_88E) ?
3735	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
3736	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
3737	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
3738
3739	/* Reserve pages [0; page_count]. */
3740	for (i = 0; i < page_count; i++) {
3741		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3742			return (error);
3743	}
3744	/* NB: 0xff indicates end-of-list. */
3745	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
3746		return (error);
3747	/*
3748	 * Use pages [page_count + 1; pktbuf_count - 1]
3749	 * as ring buffer.
3750	 */
3751	for (++i; i < pktbuf_count - 1; i++) {
3752		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3753			return (error);
3754	}
3755	/* Make the last page point to the beginning of the ring buffer. */
3756	error = urtwn_llt_write(sc, i, page_count + 1);
3757	return (error);
3758}
3759
3760#ifndef URTWN_WITHOUT_UCODE
3761static void
3762urtwn_fw_reset(struct urtwn_softc *sc)
3763{
3764	uint16_t reg;
3765	int ntries;
3766
3767	/* Tell 8051 to reset itself. */
3768	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
3769
3770	/* Wait until 8051 resets by itself. */
3771	for (ntries = 0; ntries < 100; ntries++) {
3772		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3773		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
3774			return;
3775		urtwn_ms_delay(sc);
3776	}
3777	/* Force 8051 reset. */
3778	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3779}
3780
3781static void
3782urtwn_r88e_fw_reset(struct urtwn_softc *sc)
3783{
3784	uint16_t reg;
3785
3786	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3787	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3788	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
3789}
3790
3791static int
3792urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
3793{
3794	uint32_t reg;
3795	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
3796	int off, mlen;
3797
3798	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3799	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
3800	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3801
3802	off = R92C_FW_START_ADDR;
3803	while (len > 0) {
3804		if (len > 196)
3805			mlen = 196;
3806		else if (len > 4)
3807			mlen = 4;
3808		else
3809			mlen = 1;
3810		/* XXX fix this deconst */
3811		error = urtwn_write_region_1(sc, off,
3812		    __DECONST(uint8_t *, buf), mlen);
3813		if (error != USB_ERR_NORMAL_COMPLETION)
3814			break;
3815		off += mlen;
3816		buf += mlen;
3817		len -= mlen;
3818	}
3819	return (error);
3820}
3821
3822static int
3823urtwn_load_firmware(struct urtwn_softc *sc)
3824{
3825	const struct firmware *fw;
3826	const struct r92c_fw_hdr *hdr;
3827	const char *imagename;
3828	const u_char *ptr;
3829	size_t len;
3830	uint32_t reg;
3831	int mlen, ntries, page, error;
3832
3833	URTWN_UNLOCK(sc);
3834	/* Read firmware image from the filesystem. */
3835	if (sc->chip & URTWN_CHIP_88E)
3836		imagename = "urtwn-rtl8188eufw";
3837	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3838		    URTWN_CHIP_UMC_A_CUT)
3839		imagename = "urtwn-rtl8192cfwU";
3840	else
3841		imagename = "urtwn-rtl8192cfwT";
3842
3843	fw = firmware_get(imagename);
3844	URTWN_LOCK(sc);
3845	if (fw == NULL) {
3846		device_printf(sc->sc_dev,
3847		    "failed loadfirmware of file %s\n", imagename);
3848		return (ENOENT);
3849	}
3850
3851	len = fw->datasize;
3852
3853	if (len < sizeof(*hdr)) {
3854		device_printf(sc->sc_dev, "firmware too short\n");
3855		error = EINVAL;
3856		goto fail;
3857	}
3858	ptr = fw->data;
3859	hdr = (const struct r92c_fw_hdr *)ptr;
3860	/* Check if there is a valid FW header and skip it. */
3861	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
3862	    (le16toh(hdr->signature) >> 4) == 0x88e ||
3863	    (le16toh(hdr->signature) >> 4) == 0x92c) {
3864		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE,
3865		    "FW V%d.%d %02d-%02d %02d:%02d\n",
3866		    le16toh(hdr->version), le16toh(hdr->subversion),
3867		    hdr->month, hdr->date, hdr->hour, hdr->minute);
3868		ptr += sizeof(*hdr);
3869		len -= sizeof(*hdr);
3870	}
3871
3872	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
3873		if (sc->chip & URTWN_CHIP_88E)
3874			urtwn_r88e_fw_reset(sc);
3875		else
3876			urtwn_fw_reset(sc);
3877		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3878	}
3879
3880	if (!(sc->chip & URTWN_CHIP_88E)) {
3881		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3882		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3883		    R92C_SYS_FUNC_EN_CPUEN);
3884	}
3885	urtwn_write_1(sc, R92C_MCUFWDL,
3886	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
3887	urtwn_write_1(sc, R92C_MCUFWDL + 2,
3888	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
3889
3890	/* Reset the FWDL checksum. */
3891	urtwn_write_1(sc, R92C_MCUFWDL,
3892	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
3893
3894	for (page = 0; len > 0; page++) {
3895		mlen = min(len, R92C_FW_PAGE_SIZE);
3896		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
3897		if (error != 0) {
3898			device_printf(sc->sc_dev,
3899			    "could not load firmware page\n");
3900			goto fail;
3901		}
3902		ptr += mlen;
3903		len -= mlen;
3904	}
3905	urtwn_write_1(sc, R92C_MCUFWDL,
3906	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
3907	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
3908
3909	/* Wait for checksum report. */
3910	for (ntries = 0; ntries < 1000; ntries++) {
3911		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
3912			break;
3913		urtwn_ms_delay(sc);
3914	}
3915	if (ntries == 1000) {
3916		device_printf(sc->sc_dev,
3917		    "timeout waiting for checksum report\n");
3918		error = ETIMEDOUT;
3919		goto fail;
3920	}
3921
3922	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3923	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
3924	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3925	if (sc->chip & URTWN_CHIP_88E)
3926		urtwn_r88e_fw_reset(sc);
3927	/* Wait for firmware readiness. */
3928	for (ntries = 0; ntries < 1000; ntries++) {
3929		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3930			break;
3931		urtwn_ms_delay(sc);
3932	}
3933	if (ntries == 1000) {
3934		device_printf(sc->sc_dev,
3935		    "timeout waiting for firmware readiness\n");
3936		error = ETIMEDOUT;
3937		goto fail;
3938	}
3939fail:
3940	firmware_put(fw, FIRMWARE_UNLOAD);
3941	return (error);
3942}
3943#endif
3944
3945static int
3946urtwn_dma_init(struct urtwn_softc *sc)
3947{
3948	struct usb_endpoint *ep, *ep_end;
3949	usb_error_t usb_err;
3950	uint32_t reg;
3951	int hashq, hasnq, haslq, nqueues, ntx;
3952	int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3953
3954	/* Initialize LLT table. */
3955	error = urtwn_llt_init(sc);
3956	if (error != 0)
3957		return (error);
3958
3959	/* Determine the number of bulk-out pipes. */
3960	ntx = 0;
3961	ep = sc->sc_udev->endpoints;
3962	ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
3963	for (; ep != ep_end; ep++) {
3964		if ((ep->edesc == NULL) ||
3965		    (ep->iface_index != sc->sc_iface_index))
3966			continue;
3967		if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
3968			ntx++;
3969	}
3970	if (ntx == 0) {
3971		device_printf(sc->sc_dev,
3972		    "%d: invalid number of Tx bulk pipes\n", ntx);
3973		return (EIO);
3974	}
3975
3976	/* Get Tx queues to USB endpoints mapping. */
3977	hashq = hasnq = haslq = nqueues = 0;
3978	switch (ntx) {
3979	case 1: hashq = 1; break;
3980	case 2: hashq = hasnq = 1; break;
3981	case 3: case 4: hashq = hasnq = haslq = 1; break;
3982	}
3983	nqueues = hashq + hasnq + haslq;
3984	if (nqueues == 0)
3985		return (EIO);
3986
3987	npubqpages = nqpages = nrempages = pagecount = 0;
3988	if (sc->chip & URTWN_CHIP_88E)
3989		tx_boundary = R88E_TX_PAGE_BOUNDARY;
3990	else {
3991		pagecount = R92C_TX_PAGE_COUNT;
3992		npubqpages = R92C_PUBQ_NPAGES;
3993		tx_boundary = R92C_TX_PAGE_BOUNDARY;
3994	}
3995
3996	/* Set number of pages for normal priority queue. */
3997	if (sc->chip & URTWN_CHIP_88E) {
3998		usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
3999		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4000			return (EIO);
4001		usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
4002		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4003			return (EIO);
4004	} else {
4005		/* Get the number of pages for each queue. */
4006		nqpages = (pagecount - npubqpages) / nqueues;
4007		/*
4008		 * The remaining pages are assigned to the high priority
4009		 * queue.
4010		 */
4011		nrempages = (pagecount - npubqpages) % nqueues;
4012		usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
4013		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4014			return (EIO);
4015		usb_err = urtwn_write_4(sc, R92C_RQPN,
4016		    /* Set number of pages for public queue. */
4017		    SM(R92C_RQPN_PUBQ, npubqpages) |
4018		    /* Set number of pages for high priority queue. */
4019		    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
4020		    /* Set number of pages for low priority queue. */
4021		    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
4022		    /* Load values. */
4023		    R92C_RQPN_LD);
4024		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4025			return (EIO);
4026	}
4027
4028	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
4029	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4030		return (EIO);
4031	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
4032	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4033		return (EIO);
4034	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
4035	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4036		return (EIO);
4037	usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
4038	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4039		return (EIO);
4040	usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
4041	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4042		return (EIO);
4043
4044	/* Set queue to USB pipe mapping. */
4045	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
4046	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
4047	if (nqueues == 1) {
4048		if (hashq)
4049			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
4050		else if (hasnq)
4051			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
4052		else
4053			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
4054	} else if (nqueues == 2) {
4055		/*
4056		 * All 2-endpoints configs have high and normal
4057		 * priority queues.
4058		 */
4059		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
4060	} else
4061		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
4062	usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
4063	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4064		return (EIO);
4065
4066	/* Set Tx/Rx transfer page boundary. */
4067	usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
4068	    (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
4069	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4070		return (EIO);
4071
4072	/* Set Tx/Rx transfer page size. */
4073	usb_err = urtwn_write_1(sc, R92C_PBP,
4074	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
4075	    SM(R92C_PBP_PSTX, R92C_PBP_128));
4076	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4077		return (EIO);
4078
4079	return (0);
4080}
4081
4082static int
4083urtwn_mac_init(struct urtwn_softc *sc)
4084{
4085	usb_error_t error;
4086	int i;
4087
4088	/* Write MAC initialization values. */
4089	if (sc->chip & URTWN_CHIP_88E) {
4090		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
4091			error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
4092			    rtl8188eu_mac[i].val);
4093			if (error != USB_ERR_NORMAL_COMPLETION)
4094				return (EIO);
4095		}
4096		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
4097	} else {
4098		for (i = 0; i < nitems(rtl8192cu_mac); i++)
4099			error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
4100			    rtl8192cu_mac[i].val);
4101			if (error != USB_ERR_NORMAL_COMPLETION)
4102				return (EIO);
4103	}
4104
4105	return (0);
4106}
4107
4108static void
4109urtwn_bb_init(struct urtwn_softc *sc)
4110{
4111	const struct urtwn_bb_prog *prog;
4112	uint32_t reg;
4113	uint8_t crystalcap;
4114	int i;
4115
4116	/* Enable BB and RF. */
4117	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
4118	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
4119	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
4120	    R92C_SYS_FUNC_EN_DIO_RF);
4121
4122	if (!(sc->chip & URTWN_CHIP_88E))
4123		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
4124
4125	urtwn_write_1(sc, R92C_RF_CTRL,
4126	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
4127	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
4128	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
4129	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
4130
4131	if (!(sc->chip & URTWN_CHIP_88E)) {
4132		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
4133		urtwn_write_1(sc, 0x15, 0xe9);
4134		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
4135	}
4136
4137	/* Select BB programming based on board type. */
4138	if (sc->chip & URTWN_CHIP_88E)
4139		prog = &rtl8188eu_bb_prog;
4140	else if (!(sc->chip & URTWN_CHIP_92C)) {
4141		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4142			prog = &rtl8188ce_bb_prog;
4143		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4144			prog = &rtl8188ru_bb_prog;
4145		else
4146			prog = &rtl8188cu_bb_prog;
4147	} else {
4148		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4149			prog = &rtl8192ce_bb_prog;
4150		else
4151			prog = &rtl8192cu_bb_prog;
4152	}
4153	/* Write BB initialization values. */
4154	for (i = 0; i < prog->count; i++) {
4155		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
4156		urtwn_ms_delay(sc);
4157	}
4158
4159	if (sc->chip & URTWN_CHIP_92C_1T2R) {
4160		/* 8192C 1T only configuration. */
4161		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
4162		reg = (reg & ~0x00000003) | 0x2;
4163		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
4164
4165		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
4166		reg = (reg & ~0x00300033) | 0x00200022;
4167		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
4168
4169		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
4170		reg = (reg & ~0xff000000) | 0x45 << 24;
4171		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
4172
4173		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
4174		reg = (reg & ~0x000000ff) | 0x23;
4175		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
4176
4177		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
4178		reg = (reg & ~0x00000030) | 1 << 4;
4179		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
4180
4181		reg = urtwn_bb_read(sc, 0xe74);
4182		reg = (reg & ~0x0c000000) | 2 << 26;
4183		urtwn_bb_write(sc, 0xe74, reg);
4184		reg = urtwn_bb_read(sc, 0xe78);
4185		reg = (reg & ~0x0c000000) | 2 << 26;
4186		urtwn_bb_write(sc, 0xe78, reg);
4187		reg = urtwn_bb_read(sc, 0xe7c);
4188		reg = (reg & ~0x0c000000) | 2 << 26;
4189		urtwn_bb_write(sc, 0xe7c, reg);
4190		reg = urtwn_bb_read(sc, 0xe80);
4191		reg = (reg & ~0x0c000000) | 2 << 26;
4192		urtwn_bb_write(sc, 0xe80, reg);
4193		reg = urtwn_bb_read(sc, 0xe88);
4194		reg = (reg & ~0x0c000000) | 2 << 26;
4195		urtwn_bb_write(sc, 0xe88, reg);
4196	}
4197
4198	/* Write AGC values. */
4199	for (i = 0; i < prog->agccount; i++) {
4200		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
4201		    prog->agcvals[i]);
4202		urtwn_ms_delay(sc);
4203	}
4204
4205	if (sc->chip & URTWN_CHIP_88E) {
4206		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
4207		urtwn_ms_delay(sc);
4208		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
4209		urtwn_ms_delay(sc);
4210
4211		crystalcap = sc->rom.r88e_rom.crystalcap;
4212		if (crystalcap == 0xff)
4213			crystalcap = 0x20;
4214		crystalcap &= 0x3f;
4215		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
4216		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
4217		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
4218		    crystalcap | crystalcap << 6));
4219	} else {
4220		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
4221		    R92C_HSSI_PARAM2_CCK_HIPWR)
4222			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
4223	}
4224}
4225
4226static void
4227urtwn_rf_init(struct urtwn_softc *sc)
4228{
4229	const struct urtwn_rf_prog *prog;
4230	uint32_t reg, type;
4231	int i, j, idx, off;
4232
4233	/* Select RF programming based on board type. */
4234	if (sc->chip & URTWN_CHIP_88E)
4235		prog = rtl8188eu_rf_prog;
4236	else if (!(sc->chip & URTWN_CHIP_92C)) {
4237		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4238			prog = rtl8188ce_rf_prog;
4239		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4240			prog = rtl8188ru_rf_prog;
4241		else
4242			prog = rtl8188cu_rf_prog;
4243	} else
4244		prog = rtl8192ce_rf_prog;
4245
4246	for (i = 0; i < sc->nrxchains; i++) {
4247		/* Save RF_ENV control type. */
4248		idx = i / 2;
4249		off = (i % 2) * 16;
4250		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4251		type = (reg >> off) & 0x10;
4252
4253		/* Set RF_ENV enable. */
4254		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4255		reg |= 0x100000;
4256		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4257		urtwn_ms_delay(sc);
4258		/* Set RF_ENV output high. */
4259		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4260		reg |= 0x10;
4261		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4262		urtwn_ms_delay(sc);
4263		/* Set address and data lengths of RF registers. */
4264		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4265		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
4266		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4267		urtwn_ms_delay(sc);
4268		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4269		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
4270		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4271		urtwn_ms_delay(sc);
4272
4273		/* Write RF initialization values for this chain. */
4274		for (j = 0; j < prog[i].count; j++) {
4275			if (prog[i].regs[j] >= 0xf9 &&
4276			    prog[i].regs[j] <= 0xfe) {
4277				/*
4278				 * These are fake RF registers offsets that
4279				 * indicate a delay is required.
4280				 */
4281				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
4282				continue;
4283			}
4284			urtwn_rf_write(sc, i, prog[i].regs[j],
4285			    prog[i].vals[j]);
4286			urtwn_ms_delay(sc);
4287		}
4288
4289		/* Restore RF_ENV control type. */
4290		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4291		reg &= ~(0x10 << off) | (type << off);
4292		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
4293
4294		/* Cache RF register CHNLBW. */
4295		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
4296	}
4297
4298	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
4299	    URTWN_CHIP_UMC_A_CUT) {
4300		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
4301		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
4302	}
4303}
4304
4305static void
4306urtwn_cam_init(struct urtwn_softc *sc)
4307{
4308	/* Invalidate all CAM entries. */
4309	urtwn_write_4(sc, R92C_CAMCMD,
4310	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
4311}
4312
4313static int
4314urtwn_cam_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
4315{
4316	usb_error_t error;
4317
4318	error = urtwn_write_4(sc, R92C_CAMWRITE, data);
4319	if (error != USB_ERR_NORMAL_COMPLETION)
4320		return (EIO);
4321	error = urtwn_write_4(sc, R92C_CAMCMD,
4322	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
4323	    SM(R92C_CAMCMD_ADDR, addr));
4324	if (error != USB_ERR_NORMAL_COMPLETION)
4325		return (EIO);
4326
4327	return (0);
4328}
4329
4330static void
4331urtwn_pa_bias_init(struct urtwn_softc *sc)
4332{
4333	uint8_t reg;
4334	int i;
4335
4336	for (i = 0; i < sc->nrxchains; i++) {
4337		if (sc->pa_setting & (1 << i))
4338			continue;
4339		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
4340		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
4341		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
4342		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
4343	}
4344	if (!(sc->pa_setting & 0x10)) {
4345		reg = urtwn_read_1(sc, 0x16);
4346		reg = (reg & ~0xf0) | 0x90;
4347		urtwn_write_1(sc, 0x16, reg);
4348	}
4349}
4350
4351static void
4352urtwn_rxfilter_init(struct urtwn_softc *sc)
4353{
4354	struct ieee80211com *ic = &sc->sc_ic;
4355	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4356	uint32_t rcr;
4357	uint16_t filter;
4358
4359	URTWN_ASSERT_LOCKED(sc);
4360
4361	/* Accept all multicast frames. */
4362	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
4363	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
4364
4365	/* Filter for management frames. */
4366	filter = 0x7f3f;
4367	switch (vap->iv_opmode) {
4368	case IEEE80211_M_STA:
4369		filter &= ~(
4370		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
4371		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
4372		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
4373		break;
4374	case IEEE80211_M_HOSTAP:
4375		filter &= ~(
4376		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
4377		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP));
4378		break;
4379	case IEEE80211_M_MONITOR:
4380	case IEEE80211_M_IBSS:
4381		break;
4382	default:
4383		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4384		    __func__, vap->iv_opmode);
4385		break;
4386	}
4387	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
4388
4389	/* Reject all control frames. */
4390	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
4391
4392	/* Reject all data frames. */
4393	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
4394
4395	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
4396	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
4397	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
4398
4399	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
4400		/* Accept all frames. */
4401		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
4402		       R92C_RCR_AAP;
4403	}
4404
4405	/* Set Rx filter. */
4406	urtwn_write_4(sc, R92C_RCR, rcr);
4407
4408	if (ic->ic_promisc != 0) {
4409		/* Update Rx filter. */
4410		urtwn_set_promisc(sc);
4411	}
4412}
4413
4414static void
4415urtwn_edca_init(struct urtwn_softc *sc)
4416{
4417	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
4418	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
4419	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
4420	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
4421	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
4422	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
4423	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
4424	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
4425}
4426
4427static void
4428urtwn_write_txpower(struct urtwn_softc *sc, int chain,
4429    uint16_t power[URTWN_RIDX_COUNT])
4430{
4431	uint32_t reg;
4432
4433	/* Write per-CCK rate Tx power. */
4434	if (chain == 0) {
4435		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
4436		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
4437		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
4438		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4439		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
4440		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
4441		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
4442		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4443	} else {
4444		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
4445		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
4446		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
4447		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
4448		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
4449		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4450		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
4451		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4452	}
4453	/* Write per-OFDM rate Tx power. */
4454	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
4455	    SM(R92C_TXAGC_RATE06, power[ 4]) |
4456	    SM(R92C_TXAGC_RATE09, power[ 5]) |
4457	    SM(R92C_TXAGC_RATE12, power[ 6]) |
4458	    SM(R92C_TXAGC_RATE18, power[ 7]));
4459	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
4460	    SM(R92C_TXAGC_RATE24, power[ 8]) |
4461	    SM(R92C_TXAGC_RATE36, power[ 9]) |
4462	    SM(R92C_TXAGC_RATE48, power[10]) |
4463	    SM(R92C_TXAGC_RATE54, power[11]));
4464	/* Write per-MCS Tx power. */
4465	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
4466	    SM(R92C_TXAGC_MCS00,  power[12]) |
4467	    SM(R92C_TXAGC_MCS01,  power[13]) |
4468	    SM(R92C_TXAGC_MCS02,  power[14]) |
4469	    SM(R92C_TXAGC_MCS03,  power[15]));
4470	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
4471	    SM(R92C_TXAGC_MCS04,  power[16]) |
4472	    SM(R92C_TXAGC_MCS05,  power[17]) |
4473	    SM(R92C_TXAGC_MCS06,  power[18]) |
4474	    SM(R92C_TXAGC_MCS07,  power[19]));
4475	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
4476	    SM(R92C_TXAGC_MCS08,  power[20]) |
4477	    SM(R92C_TXAGC_MCS09,  power[21]) |
4478	    SM(R92C_TXAGC_MCS10,  power[22]) |
4479	    SM(R92C_TXAGC_MCS11,  power[23]));
4480	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
4481	    SM(R92C_TXAGC_MCS12,  power[24]) |
4482	    SM(R92C_TXAGC_MCS13,  power[25]) |
4483	    SM(R92C_TXAGC_MCS14,  power[26]) |
4484	    SM(R92C_TXAGC_MCS15,  power[27]));
4485}
4486
4487static void
4488urtwn_get_txpower(struct urtwn_softc *sc, int chain,
4489    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4490    uint16_t power[URTWN_RIDX_COUNT])
4491{
4492	struct ieee80211com *ic = &sc->sc_ic;
4493	struct r92c_rom *rom = &sc->rom.r92c_rom;
4494	uint16_t cckpow, ofdmpow, htpow, diff, max;
4495	const struct urtwn_txpwr *base;
4496	int ridx, chan, group;
4497
4498	/* Determine channel group. */
4499	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4500	if (chan <= 3)
4501		group = 0;
4502	else if (chan <= 9)
4503		group = 1;
4504	else
4505		group = 2;
4506
4507	/* Get original Tx power based on board type and RF chain. */
4508	if (!(sc->chip & URTWN_CHIP_92C)) {
4509		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4510			base = &rtl8188ru_txagc[chain];
4511		else
4512			base = &rtl8192cu_txagc[chain];
4513	} else
4514		base = &rtl8192cu_txagc[chain];
4515
4516	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4517	if (sc->regulatory == 0) {
4518		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4519			power[ridx] = base->pwr[0][ridx];
4520	}
4521	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4522		if (sc->regulatory == 3) {
4523			power[ridx] = base->pwr[0][ridx];
4524			/* Apply vendor limits. */
4525			if (extc != NULL)
4526				max = rom->ht40_max_pwr[group];
4527			else
4528				max = rom->ht20_max_pwr[group];
4529			max = (max >> (chain * 4)) & 0xf;
4530			if (power[ridx] > max)
4531				power[ridx] = max;
4532		} else if (sc->regulatory == 1) {
4533			if (extc == NULL)
4534				power[ridx] = base->pwr[group][ridx];
4535		} else if (sc->regulatory != 2)
4536			power[ridx] = base->pwr[0][ridx];
4537	}
4538
4539	/* Compute per-CCK rate Tx power. */
4540	cckpow = rom->cck_tx_pwr[chain][group];
4541	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4542		power[ridx] += cckpow;
4543		if (power[ridx] > R92C_MAX_TX_PWR)
4544			power[ridx] = R92C_MAX_TX_PWR;
4545	}
4546
4547	htpow = rom->ht40_1s_tx_pwr[chain][group];
4548	if (sc->ntxchains > 1) {
4549		/* Apply reduction for 2 spatial streams. */
4550		diff = rom->ht40_2s_tx_pwr_diff[group];
4551		diff = (diff >> (chain * 4)) & 0xf;
4552		htpow = (htpow > diff) ? htpow - diff : 0;
4553	}
4554
4555	/* Compute per-OFDM rate Tx power. */
4556	diff = rom->ofdm_tx_pwr_diff[group];
4557	diff = (diff >> (chain * 4)) & 0xf;
4558	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
4559	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4560		power[ridx] += ofdmpow;
4561		if (power[ridx] > R92C_MAX_TX_PWR)
4562			power[ridx] = R92C_MAX_TX_PWR;
4563	}
4564
4565	/* Compute per-MCS Tx power. */
4566	if (extc == NULL) {
4567		diff = rom->ht20_tx_pwr_diff[group];
4568		diff = (diff >> (chain * 4)) & 0xf;
4569		htpow += diff;	/* HT40->HT20 correction. */
4570	}
4571	for (ridx = 12; ridx <= 27; ridx++) {
4572		power[ridx] += htpow;
4573		if (power[ridx] > R92C_MAX_TX_PWR)
4574			power[ridx] = R92C_MAX_TX_PWR;
4575	}
4576#ifdef USB_DEBUG
4577	if (sc->sc_debug & URTWN_DEBUG_TXPWR) {
4578		/* Dump per-rate Tx power values. */
4579		printf("Tx power for chain %d:\n", chain);
4580		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
4581			printf("Rate %d = %u\n", ridx, power[ridx]);
4582	}
4583#endif
4584}
4585
4586static void
4587urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
4588    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4589    uint16_t power[URTWN_RIDX_COUNT])
4590{
4591	struct ieee80211com *ic = &sc->sc_ic;
4592	struct r88e_rom *rom = &sc->rom.r88e_rom;
4593	uint16_t cckpow, ofdmpow, bw20pow, htpow;
4594	const struct urtwn_r88e_txpwr *base;
4595	int ridx, chan, group;
4596
4597	/* Determine channel group. */
4598	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4599	if (chan <= 2)
4600		group = 0;
4601	else if (chan <= 5)
4602		group = 1;
4603	else if (chan <= 8)
4604		group = 2;
4605	else if (chan <= 11)
4606		group = 3;
4607	else if (chan <= 13)
4608		group = 4;
4609	else
4610		group = 5;
4611
4612	/* Get original Tx power based on board type and RF chain. */
4613	base = &rtl8188eu_txagc[chain];
4614
4615	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4616	if (sc->regulatory == 0) {
4617		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4618			power[ridx] = base->pwr[0][ridx];
4619	}
4620	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4621		if (sc->regulatory == 3)
4622			power[ridx] = base->pwr[0][ridx];
4623		else if (sc->regulatory == 1) {
4624			if (extc == NULL)
4625				power[ridx] = base->pwr[group][ridx];
4626		} else if (sc->regulatory != 2)
4627			power[ridx] = base->pwr[0][ridx];
4628	}
4629
4630	/* Compute per-CCK rate Tx power. */
4631	cckpow = rom->cck_tx_pwr[group];
4632	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4633		power[ridx] += cckpow;
4634		if (power[ridx] > R92C_MAX_TX_PWR)
4635			power[ridx] = R92C_MAX_TX_PWR;
4636	}
4637
4638	htpow = rom->ht40_tx_pwr[group];
4639
4640	/* Compute per-OFDM rate Tx power. */
4641	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
4642	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4643		power[ridx] += ofdmpow;
4644		if (power[ridx] > R92C_MAX_TX_PWR)
4645			power[ridx] = R92C_MAX_TX_PWR;
4646	}
4647
4648	bw20pow = htpow + sc->bw20_tx_pwr_diff;
4649	for (ridx = 12; ridx <= 27; ridx++) {
4650		power[ridx] += bw20pow;
4651		if (power[ridx] > R92C_MAX_TX_PWR)
4652			power[ridx] = R92C_MAX_TX_PWR;
4653	}
4654}
4655
4656static void
4657urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
4658    struct ieee80211_channel *extc)
4659{
4660	uint16_t power[URTWN_RIDX_COUNT];
4661	int i;
4662
4663	for (i = 0; i < sc->ntxchains; i++) {
4664		/* Compute per-rate Tx power values. */
4665		if (sc->chip & URTWN_CHIP_88E)
4666			urtwn_r88e_get_txpower(sc, i, c, extc, power);
4667		else
4668			urtwn_get_txpower(sc, i, c, extc, power);
4669		/* Write per-rate Tx power values to hardware. */
4670		urtwn_write_txpower(sc, i, power);
4671	}
4672}
4673
4674static void
4675urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
4676{
4677	uint32_t reg;
4678
4679	reg = urtwn_read_4(sc, R92C_RCR);
4680	if (enable)
4681		reg &= ~R92C_RCR_CBSSID_BCN;
4682	else
4683		reg |= R92C_RCR_CBSSID_BCN;
4684	urtwn_write_4(sc, R92C_RCR, reg);
4685}
4686
4687static void
4688urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
4689{
4690	uint32_t reg;
4691
4692	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
4693	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4694	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
4695
4696	if (!(sc->chip & URTWN_CHIP_88E)) {
4697		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
4698		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4699		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
4700	}
4701}
4702
4703static void
4704urtwn_scan_start(struct ieee80211com *ic)
4705{
4706	struct urtwn_softc *sc = ic->ic_softc;
4707
4708	URTWN_LOCK(sc);
4709	/* Receive beacons / probe responses from any BSSID. */
4710	if (ic->ic_opmode != IEEE80211_M_IBSS)
4711		urtwn_set_rx_bssid_all(sc, 1);
4712
4713	/* Set gain for scanning. */
4714	urtwn_set_gain(sc, 0x20);
4715	URTWN_UNLOCK(sc);
4716}
4717
4718static void
4719urtwn_scan_end(struct ieee80211com *ic)
4720{
4721	struct urtwn_softc *sc = ic->ic_softc;
4722
4723	URTWN_LOCK(sc);
4724	/* Restore limitations. */
4725	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
4726		urtwn_set_rx_bssid_all(sc, 0);
4727
4728	/* Set gain under link. */
4729	urtwn_set_gain(sc, 0x32);
4730	URTWN_UNLOCK(sc);
4731}
4732
4733static void
4734urtwn_set_channel(struct ieee80211com *ic)
4735{
4736	struct urtwn_softc *sc = ic->ic_softc;
4737	struct ieee80211_channel *c = ic->ic_curchan;
4738	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4739
4740	URTWN_LOCK(sc);
4741	if (vap->iv_state == IEEE80211_S_SCAN) {
4742		/* Make link LED blink during scan. */
4743		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
4744	}
4745	urtwn_set_chan(sc, c, NULL);
4746	sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
4747	sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
4748	sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
4749	sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
4750	URTWN_UNLOCK(sc);
4751}
4752
4753static int
4754urtwn_wme_update(struct ieee80211com *ic)
4755{
4756	const struct wmeParams *wmep =
4757	    ic->ic_wme.wme_chanParams.cap_wmeParams;
4758	struct urtwn_softc *sc = ic->ic_softc;
4759	uint8_t aifs, acm, slottime;
4760	int ac;
4761
4762	acm = 0;
4763	slottime = IEEE80211_GET_SLOTTIME(ic);
4764
4765	URTWN_LOCK(sc);
4766	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4767		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4768		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4769		urtwn_write_4(sc, wme2queue[ac].reg,
4770		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
4771		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
4772		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
4773		    SM(R92C_EDCA_PARAM_AIFS, aifs));
4774		if (ac != WME_AC_BE)
4775			acm |= wmep[ac].wmep_acm << ac;
4776	}
4777
4778	if (acm != 0)
4779		acm |= R92C_ACMHWCTRL_EN;
4780	urtwn_write_1(sc, R92C_ACMHWCTRL,
4781	    (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
4782	    acm);
4783
4784	URTWN_UNLOCK(sc);
4785
4786	return 0;
4787}
4788
4789static void
4790urtwn_update_slot(struct ieee80211com *ic)
4791{
4792	urtwn_cmd_sleepable(ic->ic_softc, NULL, 0, urtwn_update_slot_cb);
4793}
4794
4795static void
4796urtwn_update_slot_cb(struct urtwn_softc *sc, union sec_param *data)
4797{
4798	struct ieee80211com *ic = &sc->sc_ic;
4799	uint8_t slottime;
4800
4801	slottime = IEEE80211_GET_SLOTTIME(ic);
4802
4803	URTWN_DPRINTF(sc, URTWN_DEBUG_ANY, "%s: setting slot time to %uus\n",
4804	    __func__, slottime);
4805
4806	urtwn_write_1(sc, R92C_SLOT, slottime);
4807	urtwn_update_aifs(sc, slottime);
4808}
4809
4810static void
4811urtwn_update_aifs(struct urtwn_softc *sc, uint8_t slottime)
4812{
4813	const struct wmeParams *wmep =
4814	    sc->sc_ic.ic_wme.wme_chanParams.cap_wmeParams;
4815	uint8_t aifs, ac;
4816
4817	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4818		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4819		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4820		urtwn_write_1(sc, wme2queue[ac].reg, aifs);
4821        }
4822}
4823
4824static void
4825urtwn_set_promisc(struct urtwn_softc *sc)
4826{
4827	struct ieee80211com *ic = &sc->sc_ic;
4828	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4829	uint32_t rcr, mask1, mask2;
4830
4831	URTWN_ASSERT_LOCKED(sc);
4832
4833	if (vap->iv_opmode == IEEE80211_M_MONITOR)
4834		return;
4835
4836	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
4837	mask2 = R92C_RCR_APM;
4838
4839	if (vap->iv_state == IEEE80211_S_RUN) {
4840		switch (vap->iv_opmode) {
4841		case IEEE80211_M_STA:
4842			mask2 |= R92C_RCR_CBSSID_DATA;
4843			/* FALLTHROUGH */
4844		case IEEE80211_M_HOSTAP:
4845			mask2 |= R92C_RCR_CBSSID_BCN;
4846			break;
4847		case IEEE80211_M_IBSS:
4848			mask2 |= R92C_RCR_CBSSID_DATA;
4849			break;
4850		default:
4851			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4852			    __func__, vap->iv_opmode);
4853			return;
4854		}
4855	}
4856
4857	rcr = urtwn_read_4(sc, R92C_RCR);
4858	if (ic->ic_promisc == 0)
4859		rcr = (rcr & ~mask1) | mask2;
4860	else
4861		rcr = (rcr & ~mask2) | mask1;
4862	urtwn_write_4(sc, R92C_RCR, rcr);
4863}
4864
4865static void
4866urtwn_update_promisc(struct ieee80211com *ic)
4867{
4868	struct urtwn_softc *sc = ic->ic_softc;
4869
4870	URTWN_LOCK(sc);
4871	if (sc->sc_flags & URTWN_RUNNING)
4872		urtwn_set_promisc(sc);
4873	URTWN_UNLOCK(sc);
4874}
4875
4876static void
4877urtwn_update_mcast(struct ieee80211com *ic)
4878{
4879	/* XXX do nothing?  */
4880}
4881
4882static struct ieee80211_node *
4883urtwn_node_alloc(struct ieee80211vap *vap,
4884    const uint8_t mac[IEEE80211_ADDR_LEN])
4885{
4886	struct urtwn_node *un;
4887
4888	un = malloc(sizeof (struct urtwn_node), M_80211_NODE,
4889	    M_NOWAIT | M_ZERO);
4890
4891	if (un == NULL)
4892		return NULL;
4893
4894	un->id = URTWN_MACID_UNDEFINED;
4895
4896	return &un->ni;
4897}
4898
4899static void
4900urtwn_newassoc(struct ieee80211_node *ni, int isnew)
4901{
4902	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4903	struct urtwn_node *un = URTWN_NODE(ni);
4904	uint8_t id;
4905
4906	/* Only do this bit for R88E chips */
4907	if (! (sc->chip & URTWN_CHIP_88E))
4908		return;
4909
4910	if (!isnew)
4911		return;
4912
4913	URTWN_NT_LOCK(sc);
4914	for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
4915		if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
4916			un->id = id;
4917			sc->node_list[id] = ni;
4918			break;
4919		}
4920	}
4921	URTWN_NT_UNLOCK(sc);
4922
4923	if (id > URTWN_MACID_MAX(sc)) {
4924		device_printf(sc->sc_dev, "%s: node table is full\n",
4925		    __func__);
4926	}
4927}
4928
4929static void
4930urtwn_node_free(struct ieee80211_node *ni)
4931{
4932	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4933	struct urtwn_node *un = URTWN_NODE(ni);
4934
4935	URTWN_NT_LOCK(sc);
4936	if (un->id != URTWN_MACID_UNDEFINED)
4937		sc->node_list[un->id] = NULL;
4938	URTWN_NT_UNLOCK(sc);
4939
4940	sc->sc_node_free(ni);
4941}
4942
4943static void
4944urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
4945    struct ieee80211_channel *extc)
4946{
4947	struct ieee80211com *ic = &sc->sc_ic;
4948	uint32_t reg;
4949	u_int chan;
4950	int i;
4951
4952	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4953	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
4954		device_printf(sc->sc_dev,
4955		    "%s: invalid channel %x\n", __func__, chan);
4956		return;
4957	}
4958
4959	/* Set Tx power for this new channel. */
4960	urtwn_set_txpower(sc, c, extc);
4961
4962	for (i = 0; i < sc->nrxchains; i++) {
4963		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
4964		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
4965	}
4966#ifndef IEEE80211_NO_HT
4967	if (extc != NULL) {
4968		/* Is secondary channel below or above primary? */
4969		int prichlo = c->ic_freq < extc->ic_freq;
4970
4971		urtwn_write_1(sc, R92C_BWOPMODE,
4972		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
4973
4974		reg = urtwn_read_1(sc, R92C_RRSR + 2);
4975		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
4976		urtwn_write_1(sc, R92C_RRSR + 2, reg);
4977
4978		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4979		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
4980		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4981		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
4982
4983		/* Set CCK side band. */
4984		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
4985		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
4986		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
4987
4988		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
4989		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
4990		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
4991
4992		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4993		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
4994		    ~R92C_FPGA0_ANAPARAM2_CBW20);
4995
4996		reg = urtwn_bb_read(sc, 0x818);
4997		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
4998		urtwn_bb_write(sc, 0x818, reg);
4999
5000		/* Select 40MHz bandwidth. */
5001		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5002		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
5003	} else
5004#endif
5005	{
5006		urtwn_write_1(sc, R92C_BWOPMODE,
5007		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
5008
5009		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
5010		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
5011		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
5012		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
5013
5014		if (!(sc->chip & URTWN_CHIP_88E)) {
5015			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5016			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
5017			    R92C_FPGA0_ANAPARAM2_CBW20);
5018		}
5019
5020		/* Select 20MHz bandwidth. */
5021		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5022		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
5023		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
5024		    R92C_RF_CHNLBW_BW20));
5025	}
5026}
5027
5028static void
5029urtwn_iq_calib(struct urtwn_softc *sc)
5030{
5031	/* TODO */
5032}
5033
5034static void
5035urtwn_lc_calib(struct urtwn_softc *sc)
5036{
5037	uint32_t rf_ac[2];
5038	uint8_t txmode;
5039	int i;
5040
5041	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
5042	if ((txmode & 0x70) != 0) {
5043		/* Disable all continuous Tx. */
5044		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
5045
5046		/* Set RF mode to standby mode. */
5047		for (i = 0; i < sc->nrxchains; i++) {
5048			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
5049			urtwn_rf_write(sc, i, R92C_RF_AC,
5050			    RW(rf_ac[i], R92C_RF_AC_MODE,
5051				R92C_RF_AC_MODE_STANDBY));
5052		}
5053	} else {
5054		/* Block all Tx queues. */
5055		urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
5056	}
5057	/* Start calibration. */
5058	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5059	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
5060
5061	/* Give calibration the time to complete. */
5062	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
5063
5064	/* Restore configuration. */
5065	if ((txmode & 0x70) != 0) {
5066		/* Restore Tx mode. */
5067		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
5068		/* Restore RF mode. */
5069		for (i = 0; i < sc->nrxchains; i++)
5070			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
5071	} else {
5072		/* Unblock all Tx queues. */
5073		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
5074	}
5075}
5076
5077static void
5078urtwn_temp_calib(struct urtwn_softc *sc)
5079{
5080	uint8_t temp;
5081
5082	URTWN_ASSERT_LOCKED(sc);
5083
5084	if (!(sc->sc_flags & URTWN_TEMP_MEASURED)) {
5085		/* Start measuring temperature. */
5086		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5087		    "%s: start measuring temperature\n", __func__);
5088		if (sc->chip & URTWN_CHIP_88E) {
5089			urtwn_rf_write(sc, 0, R88E_RF_T_METER,
5090			    R88E_RF_T_METER_START);
5091		} else {
5092			urtwn_rf_write(sc, 0, R92C_RF_T_METER,
5093			    R92C_RF_T_METER_START);
5094		}
5095		sc->sc_flags |= URTWN_TEMP_MEASURED;
5096		return;
5097	}
5098	sc->sc_flags &= ~URTWN_TEMP_MEASURED;
5099
5100	/* Read measured temperature. */
5101	if (sc->chip & URTWN_CHIP_88E) {
5102		temp = MS(urtwn_rf_read(sc, 0, R88E_RF_T_METER),
5103		    R88E_RF_T_METER_VAL);
5104	} else {
5105		temp = MS(urtwn_rf_read(sc, 0, R92C_RF_T_METER),
5106		    R92C_RF_T_METER_VAL);
5107	}
5108	if (temp == 0) {	/* Read failed, skip. */
5109		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5110		    "%s: temperature read failed, skipping\n", __func__);
5111		return;
5112	}
5113
5114	URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5115	    "%s: temperature: previous %u, current %u\n",
5116	    __func__, sc->thcal_lctemp, temp);
5117
5118	/*
5119	 * Redo LC calibration if temperature changed significantly since
5120	 * last calibration.
5121	 */
5122	if (sc->thcal_lctemp == 0) {
5123		/* First LC calibration is performed in urtwn_init(). */
5124		sc->thcal_lctemp = temp;
5125	} else if (abs(temp - sc->thcal_lctemp) > 1) {
5126		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5127		    "%s: LC calib triggered by temp: %u -> %u\n",
5128		    __func__, sc->thcal_lctemp, temp);
5129		urtwn_lc_calib(sc);
5130		/* Record temperature of last LC calibration. */
5131		sc->thcal_lctemp = temp;
5132	}
5133}
5134
5135static int
5136urtwn_init(struct urtwn_softc *sc)
5137{
5138	struct ieee80211com *ic = &sc->sc_ic;
5139	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5140	uint8_t macaddr[IEEE80211_ADDR_LEN];
5141	uint32_t reg;
5142	usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
5143	int error;
5144
5145	URTWN_LOCK(sc);
5146	if (sc->sc_flags & URTWN_RUNNING) {
5147		URTWN_UNLOCK(sc);
5148		return (0);
5149	}
5150
5151	/* Init firmware commands ring. */
5152	sc->fwcur = 0;
5153
5154	/* Allocate Tx/Rx buffers. */
5155	error = urtwn_alloc_rx_list(sc);
5156	if (error != 0)
5157		goto fail;
5158
5159	error = urtwn_alloc_tx_list(sc);
5160	if (error != 0)
5161		goto fail;
5162
5163	/* Power on adapter. */
5164	error = urtwn_power_on(sc);
5165	if (error != 0)
5166		goto fail;
5167
5168	/* Initialize DMA. */
5169	error = urtwn_dma_init(sc);
5170	if (error != 0)
5171		goto fail;
5172
5173	/* Set info size in Rx descriptors (in 64-bit words). */
5174	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
5175
5176	/* Init interrupts. */
5177	if (sc->chip & URTWN_CHIP_88E) {
5178		usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
5179		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5180			goto fail;
5181		usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
5182		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
5183		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5184			goto fail;
5185		usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
5186		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
5187		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5188			goto fail;
5189		usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5190		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5191		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
5192		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5193			goto fail;
5194	} else {
5195		usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
5196		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5197			goto fail;
5198		usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
5199		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5200			goto fail;
5201	}
5202
5203	/* Set MAC address. */
5204	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
5205	usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
5206	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5207		goto fail;
5208
5209	/* Set initial network type. */
5210	urtwn_set_mode(sc, R92C_MSR_INFRA);
5211
5212	/* Initialize Rx filter. */
5213	urtwn_rxfilter_init(sc);
5214
5215	/* Set response rate. */
5216	reg = urtwn_read_4(sc, R92C_RRSR);
5217	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
5218	urtwn_write_4(sc, R92C_RRSR, reg);
5219
5220	/* Set short/long retry limits. */
5221	urtwn_write_2(sc, R92C_RL,
5222	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
5223
5224	/* Initialize EDCA parameters. */
5225	urtwn_edca_init(sc);
5226
5227	/* Setup rate fallback. */
5228	if (!(sc->chip & URTWN_CHIP_88E)) {
5229		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
5230		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
5231		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
5232		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
5233	}
5234
5235	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
5236	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
5237	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
5238	/* Set ACK timeout. */
5239	urtwn_write_1(sc, R92C_ACKTO, 0x40);
5240
5241	/* Setup USB aggregation. */
5242	reg = urtwn_read_4(sc, R92C_TDECTRL);
5243	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
5244	urtwn_write_4(sc, R92C_TDECTRL, reg);
5245	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
5246	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
5247	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
5248	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
5249	if (sc->chip & URTWN_CHIP_88E)
5250		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
5251	else {
5252		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
5253		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5254		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5255		    R92C_USB_SPECIAL_OPTION_AGG_EN);
5256		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
5257		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
5258	}
5259
5260	/* Initialize beacon parameters. */
5261	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
5262	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
5263	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
5264	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
5265	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
5266
5267	if (!(sc->chip & URTWN_CHIP_88E)) {
5268		/* Setup AMPDU aggregation. */
5269		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
5270		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
5271		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
5272
5273		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
5274	}
5275
5276#ifndef URTWN_WITHOUT_UCODE
5277	/* Load 8051 microcode. */
5278	error = urtwn_load_firmware(sc);
5279	if (error == 0)
5280		sc->sc_flags |= URTWN_FW_LOADED;
5281#endif
5282
5283	/* Initialize MAC/BB/RF blocks. */
5284	error = urtwn_mac_init(sc);
5285	if (error != 0) {
5286		device_printf(sc->sc_dev,
5287		    "%s: error while initializing MAC block\n", __func__);
5288		goto fail;
5289	}
5290	urtwn_bb_init(sc);
5291	urtwn_rf_init(sc);
5292
5293	/* Reinitialize Rx filter (D3845 is not committed yet). */
5294	urtwn_rxfilter_init(sc);
5295
5296	if (sc->chip & URTWN_CHIP_88E) {
5297		urtwn_write_2(sc, R92C_CR,
5298		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
5299		    R92C_CR_MACRXEN);
5300	}
5301
5302	/* Turn CCK and OFDM blocks on. */
5303	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5304	reg |= R92C_RFMOD_CCK_EN;
5305	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5306	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5307		goto fail;
5308	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5309	reg |= R92C_RFMOD_OFDM_EN;
5310	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5311	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5312		goto fail;
5313
5314	/* Clear per-station keys table. */
5315	urtwn_cam_init(sc);
5316
5317	/* Enable decryption / encryption. */
5318	urtwn_write_2(sc, R92C_SECCFG,
5319	    R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
5320	    R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXDEC_ENA |
5321	    R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
5322
5323	/*
5324	 * Install static keys (if any).
5325	 * Must be called after urtwn_cam_init().
5326	 */
5327	ieee80211_runtask(ic, &sc->cmdq_task);
5328
5329	/* Enable hardware sequence numbering. */
5330	urtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
5331
5332	/* Enable per-packet TX report. */
5333	if (sc->chip & URTWN_CHIP_88E) {
5334		urtwn_write_1(sc, R88E_TX_RPT_CTRL,
5335		    urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
5336	}
5337
5338	/* Perform LO and IQ calibrations. */
5339	urtwn_iq_calib(sc);
5340	/* Perform LC calibration. */
5341	urtwn_lc_calib(sc);
5342
5343	/* Fix USB interference issue. */
5344	if (!(sc->chip & URTWN_CHIP_88E)) {
5345		urtwn_write_1(sc, 0xfe40, 0xe0);
5346		urtwn_write_1(sc, 0xfe41, 0x8d);
5347		urtwn_write_1(sc, 0xfe42, 0x80);
5348
5349		urtwn_pa_bias_init(sc);
5350	}
5351
5352	/* Initialize GPIO setting. */
5353	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
5354	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
5355
5356	/* Fix for lower temperature. */
5357	if (!(sc->chip & URTWN_CHIP_88E))
5358		urtwn_write_1(sc, 0x15, 0xe9);
5359
5360	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
5361
5362	sc->sc_flags |= URTWN_RUNNING;
5363
5364	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5365fail:
5366	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5367		error = EIO;
5368
5369	URTWN_UNLOCK(sc);
5370
5371	return (error);
5372}
5373
5374static void
5375urtwn_stop(struct urtwn_softc *sc)
5376{
5377
5378	URTWN_LOCK(sc);
5379	if (!(sc->sc_flags & URTWN_RUNNING)) {
5380		URTWN_UNLOCK(sc);
5381		return;
5382	}
5383
5384	sc->sc_flags &= ~(URTWN_RUNNING | URTWN_FW_LOADED |
5385	    URTWN_TEMP_MEASURED);
5386	sc->thcal_lctemp = 0;
5387	callout_stop(&sc->sc_watchdog_ch);
5388
5389	urtwn_abort_xfers(sc);
5390	urtwn_drain_mbufq(sc);
5391	urtwn_power_off(sc);
5392	URTWN_UNLOCK(sc);
5393}
5394
5395static void
5396urtwn_abort_xfers(struct urtwn_softc *sc)
5397{
5398	int i;
5399
5400	URTWN_ASSERT_LOCKED(sc);
5401
5402	/* abort any pending transfers */
5403	for (i = 0; i < URTWN_N_TRANSFER; i++)
5404		usbd_transfer_stop(sc->sc_xfer[i]);
5405}
5406
5407static int
5408urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5409    const struct ieee80211_bpf_params *params)
5410{
5411	struct ieee80211com *ic = ni->ni_ic;
5412	struct urtwn_softc *sc = ic->ic_softc;
5413	struct urtwn_data *bf;
5414	int error;
5415
5416	URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
5417	    __func__,
5418	    m);
5419
5420	/* prevent management frames from being sent if we're not ready */
5421	URTWN_LOCK(sc);
5422	if (!(sc->sc_flags & URTWN_RUNNING)) {
5423		error = ENETDOWN;
5424		goto end;
5425	}
5426
5427	bf = urtwn_getbuf(sc);
5428	if (bf == NULL) {
5429		error = ENOBUFS;
5430		goto end;
5431	}
5432
5433	if (params == NULL) {
5434		/*
5435		 * Legacy path; interpret frame contents to decide
5436		 * precisely how to send the frame.
5437		 */
5438		error = urtwn_tx_data(sc, ni, m, bf);
5439	} else {
5440		/*
5441		 * Caller supplied explicit parameters to use in
5442		 * sending the frame.
5443		 */
5444		error = urtwn_tx_raw(sc, ni, m, bf, params);
5445	}
5446	if (error != 0) {
5447		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
5448		goto end;
5449	}
5450
5451	sc->sc_txtimer = 5;
5452	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5453
5454end:
5455	if (error != 0)
5456		m_freem(m);
5457
5458	URTWN_UNLOCK(sc);
5459
5460	return (error);
5461}
5462
5463static void
5464urtwn_ms_delay(struct urtwn_softc *sc)
5465{
5466	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
5467}
5468
5469static device_method_t urtwn_methods[] = {
5470	/* Device interface */
5471	DEVMETHOD(device_probe,		urtwn_match),
5472	DEVMETHOD(device_attach,	urtwn_attach),
5473	DEVMETHOD(device_detach,	urtwn_detach),
5474
5475	DEVMETHOD_END
5476};
5477
5478static driver_t urtwn_driver = {
5479	"urtwn",
5480	urtwn_methods,
5481	sizeof(struct urtwn_softc)
5482};
5483
5484static devclass_t urtwn_devclass;
5485
5486DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
5487MODULE_DEPEND(urtwn, usb, 1, 1, 1);
5488MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
5489#ifndef URTWN_WITHOUT_UCODE
5490MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
5491#endif
5492MODULE_VERSION(urtwn, 1);
5493USB_PNP_HOST_INFO(urtwn_devs);
5494