if_urtwn.c revision 298359
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 * Copyright (c) 2015 Andriy Voskoboinyk <avos@FreeBSD.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/dev/urtwn/if_urtwn.c 298359 2016-04-20 18:29:30Z avos $");
23
24/*
25 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
26 */
27
28#include "opt_wlan.h"
29#include "opt_urtwn.h"
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/lock.h>
35#include <sys/mutex.h>
36#include <sys/condvar.h>
37#include <sys/mbuf.h>
38#include <sys/kernel.h>
39#include <sys/socket.h>
40#include <sys/systm.h>
41#include <sys/malloc.h>
42#include <sys/module.h>
43#include <sys/bus.h>
44#include <sys/endian.h>
45#include <sys/linker.h>
46#include <sys/firmware.h>
47#include <sys/kdb.h>
48
49#include <machine/bus.h>
50#include <machine/resource.h>
51#include <sys/rman.h>
52
53#include <net/bpf.h>
54#include <net/if.h>
55#include <net/if_var.h>
56#include <net/if_arp.h>
57#include <net/ethernet.h>
58#include <net/if_dl.h>
59#include <net/if_media.h>
60#include <net/if_types.h>
61
62#include <netinet/in.h>
63#include <netinet/in_systm.h>
64#include <netinet/in_var.h>
65#include <netinet/if_ether.h>
66#include <netinet/ip.h>
67
68#include <net80211/ieee80211_var.h>
69#include <net80211/ieee80211_regdomain.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_ratectl.h>
72#ifdef	IEEE80211_SUPPORT_SUPERG
73#include <net80211/ieee80211_superg.h>
74#endif
75
76#include <dev/usb/usb.h>
77#include <dev/usb/usbdi.h>
78#include <dev/usb/usb_device.h>
79#include "usbdevs.h"
80
81#include <dev/usb/usb_debug.h>
82
83#include <dev/urtwn/if_urtwnreg.h>
84#include <dev/urtwn/if_urtwnvar.h>
85
86#ifdef USB_DEBUG
87enum {
88	URTWN_DEBUG_XMIT	= 0x00000001,	/* basic xmit operation */
89	URTWN_DEBUG_RECV	= 0x00000002,	/* basic recv operation */
90	URTWN_DEBUG_STATE	= 0x00000004,	/* 802.11 state transitions */
91	URTWN_DEBUG_RA		= 0x00000008,	/* f/w rate adaptation setup */
92	URTWN_DEBUG_USB		= 0x00000010,	/* usb requests */
93	URTWN_DEBUG_FIRMWARE	= 0x00000020,	/* firmware(9) loading debug */
94	URTWN_DEBUG_BEACON	= 0x00000040,	/* beacon handling */
95	URTWN_DEBUG_INTR	= 0x00000080,	/* ISR */
96	URTWN_DEBUG_TEMP	= 0x00000100,	/* temperature calibration */
97	URTWN_DEBUG_ROM		= 0x00000200,	/* various ROM info */
98	URTWN_DEBUG_KEY		= 0x00000400,	/* crypto keys management */
99	URTWN_DEBUG_TXPWR	= 0x00000800,	/* dump Tx power values */
100	URTWN_DEBUG_RSSI	= 0x00001000,	/* dump RSSI lookups */
101	URTWN_DEBUG_ANY		= 0xffffffff
102};
103
104#define URTWN_DPRINTF(_sc, _m, ...) do {			\
105	if ((_sc)->sc_debug & (_m))				\
106		device_printf((_sc)->sc_dev, __VA_ARGS__);	\
107} while(0)
108
109#else
110#define URTWN_DPRINTF(_sc, _m, ...)	do { (void) sc; } while (0)
111#endif
112
113#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
114
115static int urtwn_enable_11n = 1;
116TUNABLE_INT("hw.usb.urtwn.enable_11n", &urtwn_enable_11n);
117
118/* various supported device vendors/products */
119static const STRUCT_USB_HOST_ID urtwn_devs[] = {
120#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
121#define	URTWN_RTL8188E_DEV(v,p)	\
122	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
123#define URTWN_RTL8188E  1
124	URTWN_DEV(ABOCOM,	RTL8188CU_1),
125	URTWN_DEV(ABOCOM,	RTL8188CU_2),
126	URTWN_DEV(ABOCOM,	RTL8192CU),
127	URTWN_DEV(ASUS,		RTL8192CU),
128	URTWN_DEV(ASUS,		USBN10NANO),
129	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
130	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
131	URTWN_DEV(AZUREWAVE,	RTL8188CU),
132	URTWN_DEV(BELKIN,	F7D2102),
133	URTWN_DEV(BELKIN,	RTL8188CU),
134	URTWN_DEV(BELKIN,	RTL8192CU),
135	URTWN_DEV(CHICONY,	RTL8188CUS_1),
136	URTWN_DEV(CHICONY,	RTL8188CUS_2),
137	URTWN_DEV(CHICONY,	RTL8188CUS_3),
138	URTWN_DEV(CHICONY,	RTL8188CUS_4),
139	URTWN_DEV(CHICONY,	RTL8188CUS_5),
140	URTWN_DEV(COREGA,	RTL8192CU),
141	URTWN_DEV(DLINK,	RTL8188CU),
142	URTWN_DEV(DLINK,	RTL8192CU_1),
143	URTWN_DEV(DLINK,	RTL8192CU_2),
144	URTWN_DEV(DLINK,	RTL8192CU_3),
145	URTWN_DEV(DLINK,	DWA131B),
146	URTWN_DEV(EDIMAX,	EW7811UN),
147	URTWN_DEV(EDIMAX,	RTL8192CU),
148	URTWN_DEV(FEIXUN,	RTL8188CU),
149	URTWN_DEV(FEIXUN,	RTL8192CU),
150	URTWN_DEV(GUILLEMOT,	HWNUP150),
151	URTWN_DEV(HAWKING,	RTL8192CU),
152	URTWN_DEV(HP3,		RTL8188CU),
153	URTWN_DEV(NETGEAR,	WNA1000M),
154	URTWN_DEV(NETGEAR,	RTL8192CU),
155	URTWN_DEV(NETGEAR4,	RTL8188CU),
156	URTWN_DEV(NOVATECH,	RTL8188CU),
157	URTWN_DEV(PLANEX2,	RTL8188CU_1),
158	URTWN_DEV(PLANEX2,	RTL8188CU_2),
159	URTWN_DEV(PLANEX2,	RTL8188CU_3),
160	URTWN_DEV(PLANEX2,	RTL8188CU_4),
161	URTWN_DEV(PLANEX2,	RTL8188CUS),
162	URTWN_DEV(PLANEX2,	RTL8192CU),
163	URTWN_DEV(REALTEK,	RTL8188CE_0),
164	URTWN_DEV(REALTEK,	RTL8188CE_1),
165	URTWN_DEV(REALTEK,	RTL8188CTV),
166	URTWN_DEV(REALTEK,	RTL8188CU_0),
167	URTWN_DEV(REALTEK,	RTL8188CU_1),
168	URTWN_DEV(REALTEK,	RTL8188CU_2),
169	URTWN_DEV(REALTEK,	RTL8188CU_3),
170	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
171	URTWN_DEV(REALTEK,	RTL8188CUS),
172	URTWN_DEV(REALTEK,	RTL8188RU_1),
173	URTWN_DEV(REALTEK,	RTL8188RU_2),
174	URTWN_DEV(REALTEK,	RTL8188RU_3),
175	URTWN_DEV(REALTEK,	RTL8191CU),
176	URTWN_DEV(REALTEK,	RTL8192CE),
177	URTWN_DEV(REALTEK,	RTL8192CU),
178	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
179	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
180	URTWN_DEV(SITECOMEU,	RTL8192CU),
181	URTWN_DEV(TRENDNET,	RTL8188CU),
182	URTWN_DEV(TRENDNET,	RTL8192CU),
183	URTWN_DEV(ZYXEL,	RTL8192CU),
184	/* URTWN_RTL8188E */
185	URTWN_RTL8188E_DEV(ABOCOM,	RTL8188EU),
186	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
187	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
188	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
189	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
190	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
191#undef URTWN_RTL8188E_DEV
192#undef URTWN_DEV
193};
194
195static device_probe_t	urtwn_match;
196static device_attach_t	urtwn_attach;
197static device_detach_t	urtwn_detach;
198
199static usb_callback_t   urtwn_bulk_tx_callback;
200static usb_callback_t	urtwn_bulk_rx_callback;
201
202static void		urtwn_sysctlattach(struct urtwn_softc *);
203static void		urtwn_drain_mbufq(struct urtwn_softc *);
204static usb_error_t	urtwn_do_request(struct urtwn_softc *,
205			    struct usb_device_request *, void *);
206static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
207		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
208                    const uint8_t [IEEE80211_ADDR_LEN],
209                    const uint8_t [IEEE80211_ADDR_LEN]);
210static void		urtwn_vap_delete(struct ieee80211vap *);
211static struct mbuf *	urtwn_rx_copy_to_mbuf(struct urtwn_softc *,
212			    struct r92c_rx_stat *, int);
213static struct mbuf *	urtwn_report_intr(struct usb_xfer *,
214			    struct urtwn_data *);
215static struct mbuf *	urtwn_rxeof(struct urtwn_softc *, uint8_t *, int);
216static void		urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
217			    void *);
218static struct ieee80211_node *urtwn_rx_frame(struct urtwn_softc *,
219			    struct mbuf *, int8_t *);
220static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
221			    int);
222static int		urtwn_alloc_list(struct urtwn_softc *,
223			    struct urtwn_data[], int, int);
224static int		urtwn_alloc_rx_list(struct urtwn_softc *);
225static int		urtwn_alloc_tx_list(struct urtwn_softc *);
226static void		urtwn_free_list(struct urtwn_softc *,
227			    struct urtwn_data data[], int);
228static void		urtwn_free_rx_list(struct urtwn_softc *);
229static void		urtwn_free_tx_list(struct urtwn_softc *);
230static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
231static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
232static usb_error_t	urtwn_write_region_1(struct urtwn_softc *, uint16_t,
233			    uint8_t *, int);
234static usb_error_t	urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
235static usb_error_t	urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
236static usb_error_t	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
237static usb_error_t	urtwn_read_region_1(struct urtwn_softc *, uint16_t,
238			    uint8_t *, int);
239static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
240static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
241static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
242static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
243			    const void *, int);
244static void		urtwn_cmdq_cb(void *, int);
245static int		urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
246			    size_t, CMD_FUNC_PROTO);
247static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
248			    uint8_t, uint32_t);
249static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
250			    uint8_t, uint32_t);
251static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
252static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
253			    uint32_t);
254static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
255static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
256			    uint8_t, uint8_t);
257#ifdef USB_DEBUG
258static void		urtwn_dump_rom_contents(struct urtwn_softc *,
259			    uint8_t *, uint16_t);
260#endif
261static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
262			    uint16_t);
263static int		urtwn_efuse_switch_power(struct urtwn_softc *);
264static int		urtwn_read_chipid(struct urtwn_softc *);
265static int		urtwn_read_rom(struct urtwn_softc *);
266static int		urtwn_r88e_read_rom(struct urtwn_softc *);
267static int		urtwn_ra_init(struct urtwn_softc *);
268static void		urtwn_init_beacon(struct urtwn_softc *,
269			    struct urtwn_vap *);
270static int		urtwn_setup_beacon(struct urtwn_softc *,
271			    struct ieee80211_node *);
272static void		urtwn_update_beacon(struct ieee80211vap *, int);
273static int		urtwn_tx_beacon(struct urtwn_softc *sc,
274			    struct urtwn_vap *);
275static int		urtwn_key_alloc(struct ieee80211vap *,
276			    struct ieee80211_key *, ieee80211_keyix *,
277			    ieee80211_keyix *);
278static void		urtwn_key_set_cb(struct urtwn_softc *,
279			    union sec_param *);
280static void		urtwn_key_del_cb(struct urtwn_softc *,
281			    union sec_param *);
282static int		urtwn_key_set(struct ieee80211vap *,
283			    const struct ieee80211_key *);
284static int		urtwn_key_delete(struct ieee80211vap *,
285			    const struct ieee80211_key *);
286static void		urtwn_tsf_task_adhoc(void *, int);
287static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
288			    struct ieee80211vap *);
289static void		urtwn_get_tsf(struct urtwn_softc *, uint64_t *);
290static void		urtwn_set_led(struct urtwn_softc *, int, int);
291static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
292static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
293			    struct mbuf *, int,
294			    const struct ieee80211_rx_stats *, int, int);
295static int		urtwn_newstate(struct ieee80211vap *,
296			    enum ieee80211_state, int);
297static void		urtwn_calib_to(void *);
298static void		urtwn_calib_cb(struct urtwn_softc *,
299			    union sec_param *);
300static void		urtwn_watchdog(void *);
301static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
302static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
303static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
304static int		urtwn_tx_data(struct urtwn_softc *,
305			    struct ieee80211_node *, struct mbuf *,
306			    struct urtwn_data *);
307static int		urtwn_tx_raw(struct urtwn_softc *,
308			    struct ieee80211_node *, struct mbuf *,
309			    struct urtwn_data *,
310			    const struct ieee80211_bpf_params *);
311static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
312			    uint8_t, struct urtwn_data *);
313static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
314static void		urtwn_start(struct urtwn_softc *);
315static void		urtwn_parent(struct ieee80211com *);
316static int		urtwn_r92c_power_on(struct urtwn_softc *);
317static int		urtwn_r88e_power_on(struct urtwn_softc *);
318static void		urtwn_r92c_power_off(struct urtwn_softc *);
319static void		urtwn_r88e_power_off(struct urtwn_softc *);
320static int		urtwn_llt_init(struct urtwn_softc *);
321#ifndef URTWN_WITHOUT_UCODE
322static void		urtwn_fw_reset(struct urtwn_softc *);
323static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
324static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
325			    const uint8_t *, int);
326static int		urtwn_load_firmware(struct urtwn_softc *);
327#endif
328static int		urtwn_dma_init(struct urtwn_softc *);
329static int		urtwn_mac_init(struct urtwn_softc *);
330static void		urtwn_bb_init(struct urtwn_softc *);
331static void		urtwn_rf_init(struct urtwn_softc *);
332static void		urtwn_cam_init(struct urtwn_softc *);
333static int		urtwn_cam_write(struct urtwn_softc *, uint32_t,
334			    uint32_t);
335static void		urtwn_pa_bias_init(struct urtwn_softc *);
336static void		urtwn_rxfilter_init(struct urtwn_softc *);
337static void		urtwn_edca_init(struct urtwn_softc *);
338static void		urtwn_write_txpower(struct urtwn_softc *, int,
339			    uint16_t[]);
340static void		urtwn_get_txpower(struct urtwn_softc *, int,
341		      	    struct ieee80211_channel *,
342			    struct ieee80211_channel *, uint16_t[]);
343static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
344		      	    struct ieee80211_channel *,
345			    struct ieee80211_channel *, uint16_t[]);
346static void		urtwn_set_txpower(struct urtwn_softc *,
347		    	    struct ieee80211_channel *,
348			    struct ieee80211_channel *);
349static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
350static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
351static void		urtwn_scan_start(struct ieee80211com *);
352static void		urtwn_scan_end(struct ieee80211com *);
353static void		urtwn_set_channel(struct ieee80211com *);
354static int		urtwn_wme_update(struct ieee80211com *);
355static void		urtwn_update_slot(struct ieee80211com *);
356static void		urtwn_update_slot_cb(struct urtwn_softc *,
357			    union sec_param *);
358static void		urtwn_update_aifs(struct urtwn_softc *, uint8_t);
359static void		urtwn_set_promisc(struct urtwn_softc *);
360static void		urtwn_update_promisc(struct ieee80211com *);
361static void		urtwn_update_mcast(struct ieee80211com *);
362static struct ieee80211_node *urtwn_node_alloc(struct ieee80211vap *,
363			    const uint8_t mac[IEEE80211_ADDR_LEN]);
364static void		urtwn_newassoc(struct ieee80211_node *, int);
365static void		urtwn_node_free(struct ieee80211_node *);
366static void		urtwn_set_chan(struct urtwn_softc *,
367		    	    struct ieee80211_channel *,
368			    struct ieee80211_channel *);
369static void		urtwn_iq_calib(struct urtwn_softc *);
370static void		urtwn_lc_calib(struct urtwn_softc *);
371static void		urtwn_temp_calib(struct urtwn_softc *);
372static int		urtwn_init(struct urtwn_softc *);
373static void		urtwn_stop(struct urtwn_softc *);
374static void		urtwn_abort_xfers(struct urtwn_softc *);
375static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
376			    const struct ieee80211_bpf_params *);
377static void		urtwn_ms_delay(struct urtwn_softc *);
378
379/* Aliases. */
380#define	urtwn_bb_write	urtwn_write_4
381#define urtwn_bb_read	urtwn_read_4
382
383static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
384	[URTWN_BULK_RX] = {
385		.type = UE_BULK,
386		.endpoint = UE_ADDR_ANY,
387		.direction = UE_DIR_IN,
388		.bufsize = URTWN_RXBUFSZ,
389		.flags = {
390			.pipe_bof = 1,
391			.short_xfer_ok = 1
392		},
393		.callback = urtwn_bulk_rx_callback,
394	},
395	[URTWN_BULK_TX_BE] = {
396		.type = UE_BULK,
397		.endpoint = 0x03,
398		.direction = UE_DIR_OUT,
399		.bufsize = URTWN_TXBUFSZ,
400		.flags = {
401			.ext_buffer = 1,
402			.pipe_bof = 1,
403			.force_short_xfer = 1
404		},
405		.callback = urtwn_bulk_tx_callback,
406		.timeout = URTWN_TX_TIMEOUT,	/* ms */
407	},
408	[URTWN_BULK_TX_BK] = {
409		.type = UE_BULK,
410		.endpoint = 0x03,
411		.direction = UE_DIR_OUT,
412		.bufsize = URTWN_TXBUFSZ,
413		.flags = {
414			.ext_buffer = 1,
415			.pipe_bof = 1,
416			.force_short_xfer = 1,
417		},
418		.callback = urtwn_bulk_tx_callback,
419		.timeout = URTWN_TX_TIMEOUT,	/* ms */
420	},
421	[URTWN_BULK_TX_VI] = {
422		.type = UE_BULK,
423		.endpoint = 0x02,
424		.direction = UE_DIR_OUT,
425		.bufsize = URTWN_TXBUFSZ,
426		.flags = {
427			.ext_buffer = 1,
428			.pipe_bof = 1,
429			.force_short_xfer = 1
430		},
431		.callback = urtwn_bulk_tx_callback,
432		.timeout = URTWN_TX_TIMEOUT,	/* ms */
433	},
434	[URTWN_BULK_TX_VO] = {
435		.type = UE_BULK,
436		.endpoint = 0x02,
437		.direction = UE_DIR_OUT,
438		.bufsize = URTWN_TXBUFSZ,
439		.flags = {
440			.ext_buffer = 1,
441			.pipe_bof = 1,
442			.force_short_xfer = 1
443		},
444		.callback = urtwn_bulk_tx_callback,
445		.timeout = URTWN_TX_TIMEOUT,	/* ms */
446	},
447};
448
449static const struct wme_to_queue {
450	uint16_t reg;
451	uint8_t qid;
452} wme2queue[WME_NUM_AC] = {
453	{ R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
454	{ R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
455	{ R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
456	{ R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
457};
458
459static int
460urtwn_match(device_t self)
461{
462	struct usb_attach_arg *uaa = device_get_ivars(self);
463
464	if (uaa->usb_mode != USB_MODE_HOST)
465		return (ENXIO);
466	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
467		return (ENXIO);
468	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
469		return (ENXIO);
470
471	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
472}
473
474static void
475urtwn_update_chw(struct ieee80211com *ic)
476{
477}
478
479static int
480urtwn_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
481{
482
483	/* We're driving this ourselves (eventually); don't involve net80211 */
484	return (0);
485}
486
487static int
488urtwn_attach(device_t self)
489{
490	struct usb_attach_arg *uaa = device_get_ivars(self);
491	struct urtwn_softc *sc = device_get_softc(self);
492	struct ieee80211com *ic = &sc->sc_ic;
493	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
494	int error;
495
496	device_set_usb_desc(self);
497	sc->sc_udev = uaa->device;
498	sc->sc_dev = self;
499	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
500		sc->chip |= URTWN_CHIP_88E;
501
502#ifdef USB_DEBUG
503	int debug;
504	if (resource_int_value(device_get_name(sc->sc_dev),
505	    device_get_unit(sc->sc_dev), "debug", &debug) == 0)
506		sc->sc_debug = debug;
507#endif
508
509	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
510	    MTX_NETWORK_LOCK, MTX_DEF);
511	URTWN_CMDQ_LOCK_INIT(sc);
512	URTWN_NT_LOCK_INIT(sc);
513	callout_init(&sc->sc_calib_to, 0);
514	callout_init(&sc->sc_watchdog_ch, 0);
515	mbufq_init(&sc->sc_snd, ifqmaxlen);
516
517	sc->sc_iface_index = URTWN_IFACE_INDEX;
518	error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
519	    sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
520	if (error) {
521		device_printf(self, "could not allocate USB transfers, "
522		    "err=%s\n", usbd_errstr(error));
523		goto detach;
524	}
525
526	URTWN_LOCK(sc);
527
528	error = urtwn_read_chipid(sc);
529	if (error) {
530		device_printf(sc->sc_dev, "unsupported test chip\n");
531		URTWN_UNLOCK(sc);
532		goto detach;
533	}
534
535	/* Determine number of Tx/Rx chains. */
536	if (sc->chip & URTWN_CHIP_92C) {
537		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
538		sc->nrxchains = 2;
539	} else {
540		sc->ntxchains = 1;
541		sc->nrxchains = 1;
542	}
543
544	if (sc->chip & URTWN_CHIP_88E)
545		error = urtwn_r88e_read_rom(sc);
546	else
547		error = urtwn_read_rom(sc);
548	if (error != 0) {
549		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
550		    __func__, error);
551		URTWN_UNLOCK(sc);
552		goto detach;
553	}
554
555	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
556	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
557	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
558	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
559	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
560	    "8188CUS", sc->ntxchains, sc->nrxchains);
561
562	URTWN_UNLOCK(sc);
563
564	ic->ic_softc = sc;
565	ic->ic_name = device_get_nameunit(self);
566	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
567	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
568
569	/* set device capabilities */
570	ic->ic_caps =
571		  IEEE80211_C_STA		/* station mode */
572		| IEEE80211_C_MONITOR		/* monitor mode */
573		| IEEE80211_C_IBSS		/* adhoc mode */
574		| IEEE80211_C_HOSTAP		/* hostap mode */
575		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
576		| IEEE80211_C_SHSLOT		/* short slot time supported */
577#if 0
578		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
579#endif
580		| IEEE80211_C_WPA		/* 802.11i */
581		| IEEE80211_C_WME		/* 802.11e */
582		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
583		| IEEE80211_C_FF		/* Atheros fast-frames */
584		;
585
586	ic->ic_cryptocaps =
587	    IEEE80211_CRYPTO_WEP |
588	    IEEE80211_CRYPTO_TKIP |
589	    IEEE80211_CRYPTO_AES_CCM;
590
591	/* Assume they're all 11n capable for now */
592	if (urtwn_enable_11n) {
593		device_printf(self, "enabling 11n\n");
594		ic->ic_htcaps = IEEE80211_HTC_HT |
595#if 0
596		    IEEE80211_HTC_AMPDU |
597#endif
598		    IEEE80211_HTC_AMSDU |
599		    IEEE80211_HTCAP_MAXAMSDU_3839 |
600		    IEEE80211_HTCAP_SMPS_OFF;
601		/* no HT40 just yet */
602		// ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
603
604		/* XXX TODO: verify chains versus streams for urtwn */
605		ic->ic_txstream = sc->ntxchains;
606		ic->ic_rxstream = sc->nrxchains;
607	}
608
609	memset(bands, 0, sizeof(bands));
610	setbit(bands, IEEE80211_MODE_11B);
611	setbit(bands, IEEE80211_MODE_11G);
612	if (urtwn_enable_11n)
613		setbit(bands, IEEE80211_MODE_11NG);
614	ieee80211_init_channels(ic, NULL, bands);
615
616	ieee80211_ifattach(ic);
617	ic->ic_raw_xmit = urtwn_raw_xmit;
618	ic->ic_scan_start = urtwn_scan_start;
619	ic->ic_scan_end = urtwn_scan_end;
620	ic->ic_set_channel = urtwn_set_channel;
621	ic->ic_transmit = urtwn_transmit;
622	ic->ic_parent = urtwn_parent;
623	ic->ic_vap_create = urtwn_vap_create;
624	ic->ic_vap_delete = urtwn_vap_delete;
625	ic->ic_wme.wme_update = urtwn_wme_update;
626	ic->ic_updateslot = urtwn_update_slot;
627	ic->ic_update_promisc = urtwn_update_promisc;
628	ic->ic_update_mcast = urtwn_update_mcast;
629	if (sc->chip & URTWN_CHIP_88E) {
630		ic->ic_node_alloc = urtwn_node_alloc;
631		ic->ic_newassoc = urtwn_newassoc;
632		sc->sc_node_free = ic->ic_node_free;
633		ic->ic_node_free = urtwn_node_free;
634	}
635	ic->ic_update_chw = urtwn_update_chw;
636	ic->ic_ampdu_enable = urtwn_ampdu_enable;
637
638	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
639	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
640	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
641	    URTWN_RX_RADIOTAP_PRESENT);
642
643	TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
644
645	urtwn_sysctlattach(sc);
646
647	if (bootverbose)
648		ieee80211_announce(ic);
649
650	return (0);
651
652detach:
653	urtwn_detach(self);
654	return (ENXIO);			/* failure */
655}
656
657static void
658urtwn_sysctlattach(struct urtwn_softc *sc)
659{
660#ifdef USB_DEBUG
661	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
662	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
663
664	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
665	    "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
666	    "control debugging printfs");
667#endif
668}
669
670static int
671urtwn_detach(device_t self)
672{
673	struct urtwn_softc *sc = device_get_softc(self);
674	struct ieee80211com *ic = &sc->sc_ic;
675	unsigned int x;
676
677	/* Prevent further ioctls. */
678	URTWN_LOCK(sc);
679	sc->sc_flags |= URTWN_DETACHED;
680	URTWN_UNLOCK(sc);
681
682	urtwn_stop(sc);
683
684	callout_drain(&sc->sc_watchdog_ch);
685	callout_drain(&sc->sc_calib_to);
686
687	/* stop all USB transfers */
688	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
689
690	/* Prevent further allocations from RX/TX data lists. */
691	URTWN_LOCK(sc);
692	STAILQ_INIT(&sc->sc_tx_active);
693	STAILQ_INIT(&sc->sc_tx_inactive);
694	STAILQ_INIT(&sc->sc_tx_pending);
695
696	STAILQ_INIT(&sc->sc_rx_active);
697	STAILQ_INIT(&sc->sc_rx_inactive);
698	URTWN_UNLOCK(sc);
699
700	/* drain USB transfers */
701	for (x = 0; x != URTWN_N_TRANSFER; x++)
702		usbd_transfer_drain(sc->sc_xfer[x]);
703
704	/* Free data buffers. */
705	URTWN_LOCK(sc);
706	urtwn_free_tx_list(sc);
707	urtwn_free_rx_list(sc);
708	URTWN_UNLOCK(sc);
709
710	if (ic->ic_softc == sc) {
711		ieee80211_draintask(ic, &sc->cmdq_task);
712		ieee80211_ifdetach(ic);
713	}
714
715	URTWN_NT_LOCK_DESTROY(sc);
716	URTWN_CMDQ_LOCK_DESTROY(sc);
717	mtx_destroy(&sc->sc_mtx);
718
719	return (0);
720}
721
722static void
723urtwn_drain_mbufq(struct urtwn_softc *sc)
724{
725	struct mbuf *m;
726	struct ieee80211_node *ni;
727	URTWN_ASSERT_LOCKED(sc);
728	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
729		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
730		m->m_pkthdr.rcvif = NULL;
731		ieee80211_free_node(ni);
732		m_freem(m);
733	}
734}
735
736static usb_error_t
737urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
738    void *data)
739{
740	usb_error_t err;
741	int ntries = 10;
742
743	URTWN_ASSERT_LOCKED(sc);
744
745	while (ntries--) {
746		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
747		    req, data, 0, NULL, 250 /* ms */);
748		if (err == 0)
749			break;
750
751		URTWN_DPRINTF(sc, URTWN_DEBUG_USB,
752		    "%s: control request failed, %s (retries left: %d)\n",
753		    __func__, usbd_errstr(err), ntries);
754		usb_pause_mtx(&sc->sc_mtx, hz / 100);
755	}
756	return (err);
757}
758
759static struct ieee80211vap *
760urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
761    enum ieee80211_opmode opmode, int flags,
762    const uint8_t bssid[IEEE80211_ADDR_LEN],
763    const uint8_t mac[IEEE80211_ADDR_LEN])
764{
765	struct urtwn_softc *sc = ic->ic_softc;
766	struct urtwn_vap *uvp;
767	struct ieee80211vap *vap;
768
769	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
770		return (NULL);
771
772	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
773	vap = &uvp->vap;
774	/* enable s/w bmiss handling for sta mode */
775
776	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
777	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
778		/* out of memory */
779		free(uvp, M_80211_VAP);
780		return (NULL);
781	}
782
783	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
784		urtwn_init_beacon(sc, uvp);
785
786	/* override state transition machine */
787	uvp->newstate = vap->iv_newstate;
788	vap->iv_newstate = urtwn_newstate;
789	vap->iv_update_beacon = urtwn_update_beacon;
790	vap->iv_key_alloc = urtwn_key_alloc;
791	vap->iv_key_set = urtwn_key_set;
792	vap->iv_key_delete = urtwn_key_delete;
793
794	/* 802.11n parameters */
795	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
796	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
797
798	if (opmode == IEEE80211_M_IBSS) {
799		uvp->recv_mgmt = vap->iv_recv_mgmt;
800		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
801		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
802	}
803
804	if (URTWN_CHIP_HAS_RATECTL(sc))
805		ieee80211_ratectl_init(vap);
806	/* complete setup */
807	ieee80211_vap_attach(vap, ieee80211_media_change,
808	    ieee80211_media_status, mac);
809	ic->ic_opmode = opmode;
810	return (vap);
811}
812
813static void
814urtwn_vap_delete(struct ieee80211vap *vap)
815{
816	struct ieee80211com *ic = vap->iv_ic;
817	struct urtwn_softc *sc = ic->ic_softc;
818	struct urtwn_vap *uvp = URTWN_VAP(vap);
819
820	if (uvp->bcn_mbuf != NULL)
821		m_freem(uvp->bcn_mbuf);
822	if (vap->iv_opmode == IEEE80211_M_IBSS)
823		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
824	if (URTWN_CHIP_HAS_RATECTL(sc))
825		ieee80211_ratectl_deinit(vap);
826	ieee80211_vap_detach(vap);
827	free(uvp, M_80211_VAP);
828}
829
830static struct mbuf *
831urtwn_rx_copy_to_mbuf(struct urtwn_softc *sc, struct r92c_rx_stat *stat,
832    int totlen)
833{
834	struct ieee80211com *ic = &sc->sc_ic;
835	struct mbuf *m;
836	uint32_t rxdw0;
837	int pktlen;
838
839	/*
840	 * don't pass packets to the ieee80211 framework if the driver isn't
841	 * RUNNING.
842	 */
843	if (!(sc->sc_flags & URTWN_RUNNING))
844		return (NULL);
845
846	rxdw0 = le32toh(stat->rxdw0);
847	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
848		/*
849		 * This should not happen since we setup our Rx filter
850		 * to not receive these frames.
851		 */
852		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
853		    "%s: RX flags error (%s)\n", __func__,
854		    rxdw0 & R92C_RXDW0_CRCERR ? "CRC" : "ICV");
855		goto fail;
856	}
857
858	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
859	if (pktlen < sizeof(struct ieee80211_frame_ack)) {
860		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
861		    "%s: frame is too short: %d\n", __func__, pktlen);
862		goto fail;
863	}
864
865	if (__predict_false(totlen > MCLBYTES)) {
866		/* convert to m_getjcl if this happens */
867		device_printf(sc->sc_dev, "%s: frame too long: %d (%d)\n",
868		    __func__, pktlen, totlen);
869		goto fail;
870	}
871
872	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
873	if (__predict_false(m == NULL)) {
874		device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
875		    __func__);
876		goto fail;
877	}
878
879	/* Finalize mbuf. */
880	memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
881	m->m_pkthdr.len = m->m_len = totlen;
882
883	return (m);
884fail:
885	counter_u64_add(ic->ic_ierrors, 1);
886	return (NULL);
887}
888
889static struct mbuf *
890urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data)
891{
892	struct urtwn_softc *sc = data->sc;
893	struct ieee80211com *ic = &sc->sc_ic;
894	struct r92c_rx_stat *stat;
895	uint8_t *buf;
896	int len;
897
898	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
899
900	if (len < sizeof(*stat)) {
901		counter_u64_add(ic->ic_ierrors, 1);
902		return (NULL);
903	}
904
905	buf = data->buf;
906	stat = (struct r92c_rx_stat *)buf;
907
908	/*
909	 * For 88E chips we can tie the FF flushing here;
910	 * this is where we do know exactly how deep the
911	 * transmit queue is.
912	 *
913	 * But it won't work for R92 chips, so we can't
914	 * take the easy way out.
915	 */
916
917	if (sc->chip & URTWN_CHIP_88E) {
918		int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
919
920		switch (report_sel) {
921		case R88E_RXDW3_RPT_RX:
922			return (urtwn_rxeof(sc, buf, len));
923		case R88E_RXDW3_RPT_TX1:
924			urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
925			break;
926		default:
927			URTWN_DPRINTF(sc, URTWN_DEBUG_INTR,
928			    "%s: case %d was not handled\n", __func__,
929			    report_sel);
930			break;
931		}
932	} else
933		return (urtwn_rxeof(sc, buf, len));
934
935	return (NULL);
936}
937
938static struct mbuf *
939urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len)
940{
941	struct r92c_rx_stat *stat;
942	struct mbuf *m, *m0 = NULL, *prevm = NULL;
943	uint32_t rxdw0;
944	int totlen, pktlen, infosz, npkts;
945
946	/* Get the number of encapsulated frames. */
947	stat = (struct r92c_rx_stat *)buf;
948	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
949	URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
950	    "%s: Rx %d frames in one chunk\n", __func__, npkts);
951
952	/* Process all of them. */
953	while (npkts-- > 0) {
954		if (len < sizeof(*stat))
955			break;
956		stat = (struct r92c_rx_stat *)buf;
957		rxdw0 = le32toh(stat->rxdw0);
958
959		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
960		if (pktlen == 0)
961			break;
962
963		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
964
965		/* Make sure everything fits in xfer. */
966		totlen = sizeof(*stat) + infosz + pktlen;
967		if (totlen > len)
968			break;
969
970		m = urtwn_rx_copy_to_mbuf(sc, stat, totlen);
971		if (m0 == NULL)
972			m0 = m;
973		if (prevm == NULL)
974			prevm = m;
975		else {
976			prevm->m_next = m;
977			prevm = m;
978		}
979
980		/* Next chunk is 128-byte aligned. */
981		totlen = (totlen + 127) & ~127;
982		buf += totlen;
983		len -= totlen;
984	}
985
986	return (m0);
987}
988
989static void
990urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
991{
992	struct r88e_tx_rpt_ccx *rpt = arg;
993	struct ieee80211vap *vap;
994	struct ieee80211_node *ni;
995	uint8_t macid;
996	int ntries;
997
998	macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
999	ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
1000
1001	URTWN_NT_LOCK(sc);
1002	ni = sc->node_list[macid];
1003	if (ni != NULL) {
1004		vap = ni->ni_vap;
1005		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: frame for macid %d was"
1006		    "%s sent (%d retries)\n", __func__, macid,
1007		    (rpt->rptb1 & R88E_RPTB1_PKT_OK) ? "" : " not",
1008		    ntries);
1009
1010		if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
1011			ieee80211_ratectl_tx_complete(vap, ni,
1012			    IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
1013		} else {
1014			ieee80211_ratectl_tx_complete(vap, ni,
1015			    IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
1016		}
1017	} else {
1018		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: macid %d, ni is NULL\n",
1019		    __func__, macid);
1020	}
1021	URTWN_NT_UNLOCK(sc);
1022}
1023
1024static struct ieee80211_node *
1025urtwn_rx_frame(struct urtwn_softc *sc, struct mbuf *m, int8_t *rssi_p)
1026{
1027	struct ieee80211com *ic = &sc->sc_ic;
1028	struct ieee80211_frame_min *wh;
1029	struct r92c_rx_stat *stat;
1030	uint32_t rxdw0, rxdw3;
1031	uint8_t rate, cipher;
1032	int8_t rssi = -127;
1033	int infosz;
1034
1035	stat = mtod(m, struct r92c_rx_stat *);
1036	rxdw0 = le32toh(stat->rxdw0);
1037	rxdw3 = le32toh(stat->rxdw3);
1038
1039	rate = MS(rxdw3, R92C_RXDW3_RATE);
1040	cipher = MS(rxdw0, R92C_RXDW0_CIPHER);
1041	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1042
1043	/* Get RSSI from PHY status descriptor if present. */
1044	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1045		if (sc->chip & URTWN_CHIP_88E)
1046			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
1047		else
1048			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
1049		URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: rssi=%d\n", __func__, rssi);
1050		/* Update our average RSSI. */
1051		urtwn_update_avgrssi(sc, rate, rssi);
1052	}
1053
1054	if (ieee80211_radiotap_active(ic)) {
1055		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1056
1057		tap->wr_flags = 0;
1058
1059		urtwn_get_tsf(sc, &tap->wr_tsft);
1060		if (__predict_false(le32toh((uint32_t)tap->wr_tsft) <
1061				    le32toh(stat->rxdw5))) {
1062			tap->wr_tsft = le32toh(tap->wr_tsft  >> 32) - 1;
1063			tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
1064		} else
1065			tap->wr_tsft &= 0xffffffff00000000;
1066		tap->wr_tsft += stat->rxdw5;
1067
1068		/* XXX 20/40? */
1069		/* XXX shortgi? */
1070
1071		/* Map HW rate index to 802.11 rate. */
1072		if (!(rxdw3 & R92C_RXDW3_HT)) {
1073			tap->wr_rate = ridx2rate[rate];
1074		} else if (rate >= 12) {	/* MCS0~15. */
1075			/* Bit 7 set means HT MCS instead of rate. */
1076			tap->wr_rate = 0x80 | (rate - 12);
1077		}
1078
1079		/* XXX TODO: this isn't right; should use the last good RSSI */
1080		tap->wr_dbm_antsignal = rssi;
1081		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
1082	}
1083
1084	*rssi_p = rssi;
1085
1086	/* Drop descriptor. */
1087	m_adj(m, sizeof(*stat) + infosz);
1088	wh = mtod(m, struct ieee80211_frame_min *);
1089
1090	if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
1091	    cipher != R92C_CAM_ALGO_NONE) {
1092		m->m_flags |= M_WEP;
1093	}
1094
1095	if (m->m_len >= sizeof(*wh))
1096		return (ieee80211_find_rxnode(ic, wh));
1097
1098	return (NULL);
1099}
1100
1101static void
1102urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1103{
1104	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1105	struct ieee80211com *ic = &sc->sc_ic;
1106	struct ieee80211_node *ni;
1107	struct mbuf *m = NULL, *next;
1108	struct urtwn_data *data;
1109	int8_t nf, rssi;
1110
1111	URTWN_ASSERT_LOCKED(sc);
1112
1113	switch (USB_GET_STATE(xfer)) {
1114	case USB_ST_TRANSFERRED:
1115		data = STAILQ_FIRST(&sc->sc_rx_active);
1116		if (data == NULL)
1117			goto tr_setup;
1118		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1119		m = urtwn_report_intr(xfer, data);
1120		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1121		/* FALLTHROUGH */
1122	case USB_ST_SETUP:
1123tr_setup:
1124		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1125		if (data == NULL) {
1126			KASSERT(m == NULL, ("mbuf isn't NULL"));
1127			goto finish;
1128		}
1129		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1130		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1131		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1132		    usbd_xfer_max_len(xfer));
1133		usbd_transfer_submit(xfer);
1134
1135		/*
1136		 * To avoid LOR we should unlock our private mutex here to call
1137		 * ieee80211_input() because here is at the end of a USB
1138		 * callback and safe to unlock.
1139		 */
1140		while (m != NULL) {
1141			next = m->m_next;
1142			m->m_next = NULL;
1143
1144			ni = urtwn_rx_frame(sc, m, &rssi);
1145
1146			/* Store a global last-good RSSI */
1147			if (rssi != -127)
1148				sc->last_rssi = rssi;
1149
1150			URTWN_UNLOCK(sc);
1151
1152			nf = URTWN_NOISE_FLOOR;
1153			if (ni != NULL) {
1154				if (rssi != -127)
1155					URTWN_NODE(ni)->last_rssi = rssi;
1156				if (ni->ni_flags & IEEE80211_NODE_HT)
1157					m->m_flags |= M_AMPDU;
1158				(void)ieee80211_input(ni, m,
1159				    URTWN_NODE(ni)->last_rssi - nf, nf);
1160				ieee80211_free_node(ni);
1161			} else {
1162				/* Use last good global RSSI */
1163				(void)ieee80211_input_all(ic, m,
1164				    sc->last_rssi - nf, nf);
1165			}
1166			URTWN_LOCK(sc);
1167			m = next;
1168		}
1169		break;
1170	default:
1171		/* needs it to the inactive queue due to a error. */
1172		data = STAILQ_FIRST(&sc->sc_rx_active);
1173		if (data != NULL) {
1174			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1175			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1176		}
1177		if (error != USB_ERR_CANCELLED) {
1178			usbd_xfer_set_stall(xfer);
1179			counter_u64_add(ic->ic_ierrors, 1);
1180			goto tr_setup;
1181		}
1182		break;
1183	}
1184finish:
1185	/* Finished receive; age anything left on the FF queue by a little bump */
1186	/*
1187	 * XXX TODO: just make this a callout timer schedule so we can
1188	 * flush the FF staging queue if we're approaching idle.
1189	 */
1190#ifdef	IEEE80211_SUPPORT_SUPERG
1191	URTWN_UNLOCK(sc);
1192	ieee80211_ff_age_all(ic, 1);
1193	URTWN_LOCK(sc);
1194#endif
1195
1196	/* Kick-start more transmit in case we stalled */
1197	urtwn_start(sc);
1198}
1199
1200static void
1201urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
1202{
1203
1204	URTWN_ASSERT_LOCKED(sc);
1205
1206	if (data->ni != NULL)	/* not a beacon frame */
1207		ieee80211_tx_complete(data->ni, data->m, status);
1208
1209	if (sc->sc_tx_n_active > 0)
1210		sc->sc_tx_n_active--;
1211
1212	data->ni = NULL;
1213	data->m = NULL;
1214
1215	sc->sc_txtimer = 0;
1216
1217	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1218}
1219
1220static int
1221urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1222    int ndata, int maxsz)
1223{
1224	int i, error;
1225
1226	for (i = 0; i < ndata; i++) {
1227		struct urtwn_data *dp = &data[i];
1228		dp->sc = sc;
1229		dp->m = NULL;
1230		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1231		if (dp->buf == NULL) {
1232			device_printf(sc->sc_dev,
1233			    "could not allocate buffer\n");
1234			error = ENOMEM;
1235			goto fail;
1236		}
1237		dp->ni = NULL;
1238	}
1239
1240	return (0);
1241fail:
1242	urtwn_free_list(sc, data, ndata);
1243	return (error);
1244}
1245
1246static int
1247urtwn_alloc_rx_list(struct urtwn_softc *sc)
1248{
1249        int error, i;
1250
1251	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1252	    URTWN_RXBUFSZ);
1253	if (error != 0)
1254		return (error);
1255
1256	STAILQ_INIT(&sc->sc_rx_active);
1257	STAILQ_INIT(&sc->sc_rx_inactive);
1258
1259	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1260		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1261
1262	return (0);
1263}
1264
1265static int
1266urtwn_alloc_tx_list(struct urtwn_softc *sc)
1267{
1268	int error, i;
1269
1270	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1271	    URTWN_TXBUFSZ);
1272	if (error != 0)
1273		return (error);
1274
1275	STAILQ_INIT(&sc->sc_tx_active);
1276	STAILQ_INIT(&sc->sc_tx_inactive);
1277	STAILQ_INIT(&sc->sc_tx_pending);
1278
1279	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1280		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1281
1282	return (0);
1283}
1284
1285static void
1286urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1287{
1288	int i;
1289
1290	for (i = 0; i < ndata; i++) {
1291		struct urtwn_data *dp = &data[i];
1292
1293		if (dp->buf != NULL) {
1294			free(dp->buf, M_USBDEV);
1295			dp->buf = NULL;
1296		}
1297		if (dp->ni != NULL) {
1298			ieee80211_free_node(dp->ni);
1299			dp->ni = NULL;
1300		}
1301	}
1302}
1303
1304static void
1305urtwn_free_rx_list(struct urtwn_softc *sc)
1306{
1307	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1308}
1309
1310static void
1311urtwn_free_tx_list(struct urtwn_softc *sc)
1312{
1313	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1314}
1315
1316static void
1317urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1318{
1319	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1320#ifdef	IEEE80211_SUPPORT_SUPERG
1321	struct ieee80211com *ic = &sc->sc_ic;
1322#endif
1323	struct urtwn_data *data;
1324
1325	URTWN_ASSERT_LOCKED(sc);
1326
1327	switch (USB_GET_STATE(xfer)){
1328	case USB_ST_TRANSFERRED:
1329		data = STAILQ_FIRST(&sc->sc_tx_active);
1330		if (data == NULL)
1331			goto tr_setup;
1332		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1333		urtwn_txeof(sc, data, 0);
1334		/* FALLTHROUGH */
1335	case USB_ST_SETUP:
1336tr_setup:
1337		data = STAILQ_FIRST(&sc->sc_tx_pending);
1338		if (data == NULL) {
1339			URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1340			    "%s: empty pending queue\n", __func__);
1341			sc->sc_tx_n_active = 0;
1342			goto finish;
1343		}
1344		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1345		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1346		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1347		usbd_transfer_submit(xfer);
1348		sc->sc_tx_n_active++;
1349		break;
1350	default:
1351		data = STAILQ_FIRST(&sc->sc_tx_active);
1352		if (data == NULL)
1353			goto tr_setup;
1354		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1355		urtwn_txeof(sc, data, 1);
1356		if (error != USB_ERR_CANCELLED) {
1357			usbd_xfer_set_stall(xfer);
1358			goto tr_setup;
1359		}
1360		break;
1361	}
1362finish:
1363#ifdef	IEEE80211_SUPPORT_SUPERG
1364	/*
1365	 * If the TX active queue drops below a certain
1366	 * threshold, ensure we age fast-frames out so they're
1367	 * transmitted.
1368	 */
1369	if (sc->sc_tx_n_active <= 1) {
1370		/* XXX ew - net80211 should defer this for us! */
1371
1372		/*
1373		 * Note: this sc_tx_n_active currently tracks
1374		 * the number of pending transmit submissions
1375		 * and not the actual depth of the TX frames
1376		 * pending to the hardware.  That means that
1377		 * we're going to end up with some sub-optimal
1378		 * aggregation behaviour.
1379		 */
1380		/*
1381		 * XXX TODO: just make this a callout timer schedule so we can
1382		 * flush the FF staging queue if we're approaching idle.
1383		 */
1384		URTWN_UNLOCK(sc);
1385		ieee80211_ff_flush(ic, WME_AC_VO);
1386		ieee80211_ff_flush(ic, WME_AC_VI);
1387		ieee80211_ff_flush(ic, WME_AC_BE);
1388		ieee80211_ff_flush(ic, WME_AC_BK);
1389		URTWN_LOCK(sc);
1390	}
1391#endif
1392	/* Kick-start more transmit */
1393	urtwn_start(sc);
1394}
1395
1396static struct urtwn_data *
1397_urtwn_getbuf(struct urtwn_softc *sc)
1398{
1399	struct urtwn_data *bf;
1400
1401	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1402	if (bf != NULL)
1403		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1404	else {
1405		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1406		    "%s: out of xmit buffers\n", __func__);
1407	}
1408	return (bf);
1409}
1410
1411static struct urtwn_data *
1412urtwn_getbuf(struct urtwn_softc *sc)
1413{
1414        struct urtwn_data *bf;
1415
1416	URTWN_ASSERT_LOCKED(sc);
1417
1418	bf = _urtwn_getbuf(sc);
1419	if (bf == NULL) {
1420		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: stop queue\n",
1421		    __func__);
1422	}
1423	return (bf);
1424}
1425
1426static usb_error_t
1427urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1428    int len)
1429{
1430	usb_device_request_t req;
1431
1432	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1433	req.bRequest = R92C_REQ_REGS;
1434	USETW(req.wValue, addr);
1435	USETW(req.wIndex, 0);
1436	USETW(req.wLength, len);
1437	return (urtwn_do_request(sc, &req, buf));
1438}
1439
1440static usb_error_t
1441urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1442{
1443	return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1444}
1445
1446static usb_error_t
1447urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1448{
1449	val = htole16(val);
1450	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1451}
1452
1453static usb_error_t
1454urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1455{
1456	val = htole32(val);
1457	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1458}
1459
1460static usb_error_t
1461urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1462    int len)
1463{
1464	usb_device_request_t req;
1465
1466	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1467	req.bRequest = R92C_REQ_REGS;
1468	USETW(req.wValue, addr);
1469	USETW(req.wIndex, 0);
1470	USETW(req.wLength, len);
1471	return (urtwn_do_request(sc, &req, buf));
1472}
1473
1474static uint8_t
1475urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1476{
1477	uint8_t val;
1478
1479	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1480		return (0xff);
1481	return (val);
1482}
1483
1484static uint16_t
1485urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1486{
1487	uint16_t val;
1488
1489	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1490		return (0xffff);
1491	return (le16toh(val));
1492}
1493
1494static uint32_t
1495urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1496{
1497	uint32_t val;
1498
1499	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1500		return (0xffffffff);
1501	return (le32toh(val));
1502}
1503
1504static int
1505urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1506{
1507	struct r92c_fw_cmd cmd;
1508	usb_error_t error;
1509	int ntries;
1510
1511	if (!(sc->sc_flags & URTWN_FW_LOADED)) {
1512		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE, "%s: firmware "
1513		    "was not loaded; command (id %d) will be discarded\n",
1514		    __func__, id);
1515		return (0);
1516	}
1517
1518	/* Wait for current FW box to be empty. */
1519	for (ntries = 0; ntries < 100; ntries++) {
1520		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1521			break;
1522		urtwn_ms_delay(sc);
1523	}
1524	if (ntries == 100) {
1525		device_printf(sc->sc_dev,
1526		    "could not send firmware command\n");
1527		return (ETIMEDOUT);
1528	}
1529	memset(&cmd, 0, sizeof(cmd));
1530	cmd.id = id;
1531	if (len > 3)
1532		cmd.id |= R92C_CMD_FLAG_EXT;
1533	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1534	memcpy(cmd.msg, buf, len);
1535
1536	/* Write the first word last since that will trigger the FW. */
1537	error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1538	    (uint8_t *)&cmd + 4, 2);
1539	if (error != USB_ERR_NORMAL_COMPLETION)
1540		return (EIO);
1541	error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1542	    (uint8_t *)&cmd + 0, 4);
1543	if (error != USB_ERR_NORMAL_COMPLETION)
1544		return (EIO);
1545
1546	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1547	return (0);
1548}
1549
1550static void
1551urtwn_cmdq_cb(void *arg, int pending)
1552{
1553	struct urtwn_softc *sc = arg;
1554	struct urtwn_cmdq *item;
1555
1556	/*
1557	 * Device must be powered on (via urtwn_power_on())
1558	 * before any command may be sent.
1559	 */
1560	URTWN_LOCK(sc);
1561	if (!(sc->sc_flags & URTWN_RUNNING)) {
1562		URTWN_UNLOCK(sc);
1563		return;
1564	}
1565
1566	URTWN_CMDQ_LOCK(sc);
1567	while (sc->cmdq[sc->cmdq_first].func != NULL) {
1568		item = &sc->cmdq[sc->cmdq_first];
1569		sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1570		URTWN_CMDQ_UNLOCK(sc);
1571
1572		item->func(sc, &item->data);
1573
1574		URTWN_CMDQ_LOCK(sc);
1575		memset(item, 0, sizeof (*item));
1576	}
1577	URTWN_CMDQ_UNLOCK(sc);
1578	URTWN_UNLOCK(sc);
1579}
1580
1581static int
1582urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1583    CMD_FUNC_PROTO)
1584{
1585	struct ieee80211com *ic = &sc->sc_ic;
1586
1587	KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1588
1589	URTWN_CMDQ_LOCK(sc);
1590	if (sc->cmdq[sc->cmdq_last].func != NULL) {
1591		device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1592		URTWN_CMDQ_UNLOCK(sc);
1593
1594		return (EAGAIN);
1595	}
1596
1597	if (ptr != NULL)
1598		memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1599	sc->cmdq[sc->cmdq_last].func = func;
1600	sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1601	URTWN_CMDQ_UNLOCK(sc);
1602
1603	ieee80211_runtask(ic, &sc->cmdq_task);
1604
1605	return (0);
1606}
1607
1608static __inline void
1609urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1610{
1611
1612	sc->sc_rf_write(sc, chain, addr, val);
1613}
1614
1615static void
1616urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1617    uint32_t val)
1618{
1619	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1620	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1621	    SM(R92C_LSSI_PARAM_DATA, val));
1622}
1623
1624static void
1625urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1626uint32_t val)
1627{
1628	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1629	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1630	    SM(R92C_LSSI_PARAM_DATA, val));
1631}
1632
1633static uint32_t
1634urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1635{
1636	uint32_t reg[R92C_MAX_CHAINS], val;
1637
1638	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1639	if (chain != 0)
1640		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1641
1642	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1643	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1644	urtwn_ms_delay(sc);
1645
1646	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1647	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1648	    R92C_HSSI_PARAM2_READ_EDGE);
1649	urtwn_ms_delay(sc);
1650
1651	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1652	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1653	urtwn_ms_delay(sc);
1654
1655	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1656		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1657	else
1658		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1659	return (MS(val, R92C_LSSI_READBACK_DATA));
1660}
1661
1662static int
1663urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1664{
1665	usb_error_t error;
1666	int ntries;
1667
1668	error = urtwn_write_4(sc, R92C_LLT_INIT,
1669	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1670	    SM(R92C_LLT_INIT_ADDR, addr) |
1671	    SM(R92C_LLT_INIT_DATA, data));
1672	if (error != USB_ERR_NORMAL_COMPLETION)
1673		return (EIO);
1674	/* Wait for write operation to complete. */
1675	for (ntries = 0; ntries < 20; ntries++) {
1676		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1677		    R92C_LLT_INIT_OP_NO_ACTIVE)
1678			return (0);
1679		urtwn_ms_delay(sc);
1680	}
1681	return (ETIMEDOUT);
1682}
1683
1684static int
1685urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1686{
1687	uint32_t reg;
1688	usb_error_t error;
1689	int ntries;
1690
1691	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1692		return (EFAULT);
1693
1694	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1695	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1696	reg &= ~R92C_EFUSE_CTRL_VALID;
1697
1698	error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1699	if (error != USB_ERR_NORMAL_COMPLETION)
1700		return (EIO);
1701	/* Wait for read operation to complete. */
1702	for (ntries = 0; ntries < 100; ntries++) {
1703		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1704		if (reg & R92C_EFUSE_CTRL_VALID)
1705			break;
1706		urtwn_ms_delay(sc);
1707	}
1708	if (ntries == 100) {
1709		device_printf(sc->sc_dev,
1710		    "could not read efuse byte at address 0x%x\n",
1711		    sc->last_rom_addr);
1712		return (ETIMEDOUT);
1713	}
1714
1715	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1716	sc->last_rom_addr++;
1717
1718	return (0);
1719}
1720
1721static int
1722urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1723    uint8_t msk)
1724{
1725	uint8_t reg;
1726	int i, error;
1727
1728	for (i = 0; i < 4; i++) {
1729		if (msk & (1 << i))
1730			continue;
1731		error = urtwn_efuse_read_next(sc, &reg);
1732		if (error != 0)
1733			return (error);
1734		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1735		    off * 8 + i * 2, reg);
1736		rom[off * 8 + i * 2 + 0] = reg;
1737
1738		error = urtwn_efuse_read_next(sc, &reg);
1739		if (error != 0)
1740			return (error);
1741		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1742		    off * 8 + i * 2 + 1, reg);
1743		rom[off * 8 + i * 2 + 1] = reg;
1744	}
1745
1746	return (0);
1747}
1748
1749#ifdef USB_DEBUG
1750static void
1751urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1752{
1753	int i;
1754
1755	/* Dump ROM contents. */
1756	device_printf(sc->sc_dev, "%s:", __func__);
1757	for (i = 0; i < size; i++) {
1758		if (i % 32 == 0)
1759			printf("\n%03X: ", i);
1760		else if (i % 4 == 0)
1761			printf(" ");
1762
1763		printf("%02X", rom[i]);
1764	}
1765	printf("\n");
1766}
1767#endif
1768
1769static int
1770urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1771{
1772#define URTWN_CHK(res) do {	\
1773	if ((error = res) != 0)	\
1774		goto end;	\
1775} while(0)
1776	uint8_t msk, off, reg;
1777	int error;
1778
1779	URTWN_CHK(urtwn_efuse_switch_power(sc));
1780
1781	/* Read full ROM image. */
1782	sc->last_rom_addr = 0;
1783	memset(rom, 0xff, size);
1784
1785	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1786	while (reg != 0xff) {
1787		/* check for extended header */
1788		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1789			off = reg >> 5;
1790			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1791
1792			if ((reg & 0x0f) != 0x0f)
1793				off = ((reg & 0xf0) >> 1) | off;
1794			else
1795				continue;
1796		} else
1797			off = reg >> 4;
1798		msk = reg & 0xf;
1799
1800		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1801		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1802	}
1803
1804end:
1805
1806#ifdef USB_DEBUG
1807	if (sc->sc_debug & URTWN_DEBUG_ROM)
1808		urtwn_dump_rom_contents(sc, rom, size);
1809#endif
1810
1811	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1812
1813	if (error != 0) {
1814		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1815		    __func__);
1816	}
1817
1818	return (error);
1819#undef URTWN_CHK
1820}
1821
1822static int
1823urtwn_efuse_switch_power(struct urtwn_softc *sc)
1824{
1825	usb_error_t error;
1826	uint32_t reg;
1827
1828	error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1829	if (error != USB_ERR_NORMAL_COMPLETION)
1830		return (EIO);
1831
1832	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1833	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1834		error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1835		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1836		if (error != USB_ERR_NORMAL_COMPLETION)
1837			return (EIO);
1838	}
1839	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1840	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1841		error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1842		    reg | R92C_SYS_FUNC_EN_ELDR);
1843		if (error != USB_ERR_NORMAL_COMPLETION)
1844			return (EIO);
1845	}
1846	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1847	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1848	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1849		error = urtwn_write_2(sc, R92C_SYS_CLKR,
1850		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1851		if (error != USB_ERR_NORMAL_COMPLETION)
1852			return (EIO);
1853	}
1854
1855	return (0);
1856}
1857
1858static int
1859urtwn_read_chipid(struct urtwn_softc *sc)
1860{
1861	uint32_t reg;
1862
1863	if (sc->chip & URTWN_CHIP_88E)
1864		return (0);
1865
1866	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1867	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1868		return (EIO);
1869
1870	if (reg & R92C_SYS_CFG_TYPE_92C) {
1871		sc->chip |= URTWN_CHIP_92C;
1872		/* Check if it is a castrated 8192C. */
1873		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1874		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1875		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1876			sc->chip |= URTWN_CHIP_92C_1T2R;
1877	}
1878	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1879		sc->chip |= URTWN_CHIP_UMC;
1880		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1881			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1882	}
1883	return (0);
1884}
1885
1886static int
1887urtwn_read_rom(struct urtwn_softc *sc)
1888{
1889	struct r92c_rom *rom = &sc->rom.r92c_rom;
1890	int error;
1891
1892	/* Read full ROM image. */
1893	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1894	if (error != 0)
1895		return (error);
1896
1897	/* XXX Weird but this is what the vendor driver does. */
1898	sc->last_rom_addr = 0x1fa;
1899	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1900	if (error != 0)
1901		return (error);
1902	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: PA setting=0x%x\n", __func__,
1903	    sc->pa_setting);
1904
1905	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1906
1907	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1908	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type=%d\n",
1909	    __func__, sc->regulatory);
1910	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1911
1912	sc->sc_rf_write = urtwn_r92c_rf_write;
1913	sc->sc_power_on = urtwn_r92c_power_on;
1914	sc->sc_power_off = urtwn_r92c_power_off;
1915
1916	return (0);
1917}
1918
1919static int
1920urtwn_r88e_read_rom(struct urtwn_softc *sc)
1921{
1922	struct r88e_rom *rom = &sc->rom.r88e_rom;
1923	int error;
1924
1925	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));
1926	if (error != 0)
1927		return (error);
1928
1929	sc->bw20_tx_pwr_diff = (rom->tx_pwr_diff >> 4);
1930	if (sc->bw20_tx_pwr_diff & 0x08)
1931		sc->bw20_tx_pwr_diff |= 0xf0;
1932	sc->ofdm_tx_pwr_diff = (rom->tx_pwr_diff & 0xf);
1933	if (sc->ofdm_tx_pwr_diff & 0x08)
1934		sc->ofdm_tx_pwr_diff |= 0xf0;
1935	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
1936	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type %d\n",
1937	    __func__,sc->regulatory);
1938	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1939
1940	sc->sc_rf_write = urtwn_r88e_rf_write;
1941	sc->sc_power_on = urtwn_r88e_power_on;
1942	sc->sc_power_off = urtwn_r88e_power_off;
1943
1944	return (0);
1945}
1946
1947/*
1948 * Initialize rate adaptation in firmware.
1949 */
1950static int
1951urtwn_ra_init(struct urtwn_softc *sc)
1952{
1953	struct ieee80211com *ic = &sc->sc_ic;
1954	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1955	struct ieee80211_node *ni;
1956	struct ieee80211_rateset *rs, *rs_ht;
1957	struct r92c_fw_cmd_macid_cfg cmd;
1958	uint32_t rates, basicrates;
1959	uint8_t mode;
1960	int maxrate, maxbasicrate, error, i, j;
1961
1962	ni = ieee80211_ref_node(vap->iv_bss);
1963	rs = &ni->ni_rates;
1964	rs_ht = (struct ieee80211_rateset *) &ni->ni_htrates;
1965
1966	/* Get normal and basic rates mask. */
1967	rates = basicrates = 0;
1968	maxrate = maxbasicrate = 0;
1969
1970	/* This is for 11bg */
1971	for (i = 0; i < rs->rs_nrates; i++) {
1972		/* Convert 802.11 rate to HW rate index. */
1973		for (j = 0; j < nitems(ridx2rate); j++)
1974			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) ==
1975			    ridx2rate[j])
1976				break;
1977		if (j == nitems(ridx2rate))	/* Unknown rate, skip. */
1978			continue;
1979		rates |= 1 << j;
1980		if (j > maxrate)
1981			maxrate = j;
1982		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1983			basicrates |= 1 << j;
1984			if (j > maxbasicrate)
1985				maxbasicrate = j;
1986		}
1987	}
1988
1989	/* If we're doing 11n, enable 11n rates */
1990	if (ni->ni_flags & IEEE80211_NODE_HT) {
1991		for (i = 0; i < rs_ht->rs_nrates; i++) {
1992			if ((rs_ht->rs_rates[i] & 0x7f) > 0xf)
1993				continue;
1994			/* 11n rates start at index 12 */
1995			j = ((rs_ht->rs_rates[i]) & 0xf) + 12;
1996			rates |= (1 << j);
1997
1998			/* Guard against the rate table being oddly ordered */
1999			if (j > maxrate)
2000				maxrate = j;
2001		}
2002	}
2003
2004#if 0
2005	if (ic->ic_curmode == IEEE80211_MODE_11NG)
2006		raid = R92C_RAID_11GN;
2007#endif
2008	/* NB: group addressed frames are done at 11bg rates for now */
2009	if (ic->ic_curmode == IEEE80211_MODE_11B)
2010		mode = R92C_RAID_11B;
2011	else
2012		mode = R92C_RAID_11BG;
2013	/* XXX misleading 'mode' value here for unicast frames */
2014	URTWN_DPRINTF(sc, URTWN_DEBUG_RA,
2015	    "%s: mode 0x%x, rates 0x%08x, basicrates 0x%08x\n", __func__,
2016	    mode, rates, basicrates);
2017
2018	/* Set rates mask for group addressed frames. */
2019	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
2020	cmd.mask = htole32(mode << 28 | basicrates);
2021	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2022	if (error != 0) {
2023		ieee80211_free_node(ni);
2024		device_printf(sc->sc_dev,
2025		    "could not add broadcast station\n");
2026		return (error);
2027	}
2028
2029	/* Set initial MRR rate. */
2030	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxbasicrate %d\n", __func__,
2031	    maxbasicrate);
2032	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
2033	    maxbasicrate);
2034
2035	/* Set rates mask for unicast frames. */
2036	if (ni->ni_flags & IEEE80211_NODE_HT)
2037		mode = R92C_RAID_11GN;
2038	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2039		mode = R92C_RAID_11B;
2040	else
2041		mode = R92C_RAID_11BG;
2042	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
2043	cmd.mask = htole32(mode << 28 | rates);
2044	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2045	if (error != 0) {
2046		ieee80211_free_node(ni);
2047		device_printf(sc->sc_dev, "could not add BSS station\n");
2048		return (error);
2049	}
2050	/* Set initial MRR rate. */
2051	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxrate %d\n", __func__,
2052	    maxrate);
2053	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
2054	    maxrate);
2055
2056	/* Indicate highest supported rate. */
2057	if (ni->ni_flags & IEEE80211_NODE_HT)
2058		ni->ni_txrate = rs_ht->rs_rates[rs_ht->rs_nrates - 1]
2059		    | IEEE80211_RATE_MCS;
2060	else
2061		ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
2062	ieee80211_free_node(ni);
2063
2064	return (0);
2065}
2066
2067static void
2068urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2069{
2070	struct r92c_tx_desc *txd = &uvp->bcn_desc;
2071
2072	txd->txdw0 = htole32(
2073	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
2074	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2075	txd->txdw1 = htole32(
2076	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
2077	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
2078
2079	if (sc->chip & URTWN_CHIP_88E) {
2080		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
2081		txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
2082	} else {
2083		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
2084		txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2085	}
2086
2087	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
2088	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
2089}
2090
2091static int
2092urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
2093{
2094 	struct ieee80211vap *vap = ni->ni_vap;
2095	struct urtwn_vap *uvp = URTWN_VAP(vap);
2096	struct mbuf *m;
2097	int error;
2098
2099	URTWN_ASSERT_LOCKED(sc);
2100
2101	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
2102		return (EINVAL);
2103
2104	m = ieee80211_beacon_alloc(ni);
2105	if (m == NULL) {
2106		device_printf(sc->sc_dev,
2107		    "%s: could not allocate beacon frame\n", __func__);
2108		return (ENOMEM);
2109	}
2110
2111	if (uvp->bcn_mbuf != NULL)
2112		m_freem(uvp->bcn_mbuf);
2113
2114	uvp->bcn_mbuf = m;
2115
2116	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2117		return (error);
2118
2119	/* XXX bcnq stuck workaround */
2120	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2121		return (error);
2122
2123	URTWN_DPRINTF(sc, URTWN_DEBUG_BEACON, "%s: beacon was %srecognized\n",
2124	    __func__, urtwn_read_1(sc, R92C_TDECTRL + 2) &
2125	    (R92C_TDECTRL_BCN_VALID >> 16) ? "" : "not ");
2126
2127	return (0);
2128}
2129
2130static void
2131urtwn_update_beacon(struct ieee80211vap *vap, int item)
2132{
2133	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2134	struct urtwn_vap *uvp = URTWN_VAP(vap);
2135	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
2136	struct ieee80211_node *ni = vap->iv_bss;
2137	int mcast = 0;
2138
2139	URTWN_LOCK(sc);
2140	if (uvp->bcn_mbuf == NULL) {
2141		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
2142		if (uvp->bcn_mbuf == NULL) {
2143			device_printf(sc->sc_dev,
2144			    "%s: could not allocate beacon frame\n", __func__);
2145			URTWN_UNLOCK(sc);
2146			return;
2147		}
2148	}
2149	URTWN_UNLOCK(sc);
2150
2151	if (item == IEEE80211_BEACON_TIM)
2152		mcast = 1;	/* XXX */
2153
2154	setbit(bo->bo_flags, item);
2155	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
2156
2157	URTWN_LOCK(sc);
2158	urtwn_tx_beacon(sc, uvp);
2159	URTWN_UNLOCK(sc);
2160}
2161
2162/*
2163 * Push a beacon frame into the chip. Beacon will
2164 * be repeated by the chip every R92C_BCN_INTERVAL.
2165 */
2166static int
2167urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2168{
2169	struct r92c_tx_desc *desc = &uvp->bcn_desc;
2170	struct urtwn_data *bf;
2171
2172	URTWN_ASSERT_LOCKED(sc);
2173
2174	bf = urtwn_getbuf(sc);
2175	if (bf == NULL)
2176		return (ENOMEM);
2177
2178	memcpy(bf->buf, desc, sizeof(*desc));
2179	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
2180
2181	sc->sc_txtimer = 5;
2182	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2183
2184	return (0);
2185}
2186
2187static int
2188urtwn_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
2189    ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
2190{
2191	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2192	uint8_t i;
2193
2194	if (!(&vap->iv_nw_keys[0] <= k &&
2195	     k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
2196		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2197			URTWN_LOCK(sc);
2198			/*
2199			 * First 4 slots for group keys,
2200			 * what is left - for pairwise.
2201			 * XXX incompatible with IBSS RSN.
2202			 */
2203			for (i = IEEE80211_WEP_NKID;
2204			     i < R92C_CAM_ENTRY_COUNT; i++) {
2205				if ((sc->keys_bmap & (1 << i)) == 0) {
2206					sc->keys_bmap |= 1 << i;
2207					*keyix = i;
2208					break;
2209				}
2210			}
2211			URTWN_UNLOCK(sc);
2212			if (i == R92C_CAM_ENTRY_COUNT) {
2213				device_printf(sc->sc_dev,
2214				    "%s: no free space in the key table\n",
2215				    __func__);
2216				return 0;
2217			}
2218		} else
2219			*keyix = 0;
2220	} else {
2221		*keyix = k - vap->iv_nw_keys;
2222	}
2223	*rxkeyix = *keyix;
2224	return 1;
2225}
2226
2227static void
2228urtwn_key_set_cb(struct urtwn_softc *sc, union sec_param *data)
2229{
2230	struct ieee80211_key *k = &data->key;
2231	uint8_t algo, keyid;
2232	int i, error;
2233
2234	if (k->wk_keyix < IEEE80211_WEP_NKID)
2235		keyid = k->wk_keyix;
2236	else
2237		keyid = 0;
2238
2239	/* Map net80211 cipher to HW crypto algorithm. */
2240	switch (k->wk_cipher->ic_cipher) {
2241	case IEEE80211_CIPHER_WEP:
2242		if (k->wk_keylen < 8)
2243			algo = R92C_CAM_ALGO_WEP40;
2244		else
2245			algo = R92C_CAM_ALGO_WEP104;
2246		break;
2247	case IEEE80211_CIPHER_TKIP:
2248		algo = R92C_CAM_ALGO_TKIP;
2249		break;
2250	case IEEE80211_CIPHER_AES_CCM:
2251		algo = R92C_CAM_ALGO_AES;
2252		break;
2253	default:
2254		device_printf(sc->sc_dev, "%s: undefined cipher %d\n",
2255		    __func__, k->wk_cipher->ic_cipher);
2256		return;
2257	}
2258
2259	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2260	    "%s: keyix %d, keyid %d, algo %d/%d, flags %04X, len %d, "
2261	    "macaddr %s\n", __func__, k->wk_keyix, keyid,
2262	    k->wk_cipher->ic_cipher, algo, k->wk_flags, k->wk_keylen,
2263	    ether_sprintf(k->wk_macaddr));
2264
2265	/* Write key. */
2266	for (i = 0; i < 4; i++) {
2267		error = urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i),
2268		    le32dec(&k->wk_key[i * 4]));
2269		if (error != 0)
2270			goto fail;
2271	}
2272
2273	/* Write CTL0 last since that will validate the CAM entry. */
2274	error = urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix),
2275	    le32dec(&k->wk_macaddr[2]));
2276	if (error != 0)
2277		goto fail;
2278	error = urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix),
2279	    SM(R92C_CAM_ALGO, algo) |
2280	    SM(R92C_CAM_KEYID, keyid) |
2281	    SM(R92C_CAM_MACLO, le16dec(&k->wk_macaddr[0])) |
2282	    R92C_CAM_VALID);
2283	if (error != 0)
2284		goto fail;
2285
2286	return;
2287
2288fail:
2289	device_printf(sc->sc_dev, "%s fails, error %d\n", __func__, error);
2290}
2291
2292static void
2293urtwn_key_del_cb(struct urtwn_softc *sc, union sec_param *data)
2294{
2295	struct ieee80211_key *k = &data->key;
2296	int i;
2297
2298	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2299	    "%s: keyix %d, flags %04X, macaddr %s\n", __func__,
2300	    k->wk_keyix, k->wk_flags, ether_sprintf(k->wk_macaddr));
2301
2302	urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix), 0);
2303	urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix), 0);
2304
2305	/* Clear key. */
2306	for (i = 0; i < 4; i++)
2307		urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i), 0);
2308	sc->keys_bmap &= ~(1 << k->wk_keyix);
2309}
2310
2311static int
2312urtwn_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
2313{
2314	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2315
2316	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2317		/* Not for us. */
2318		return (1);
2319	}
2320
2321	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_set_cb));
2322}
2323
2324static int
2325urtwn_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
2326{
2327	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2328
2329	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2330		/* Not for us. */
2331		return (1);
2332	}
2333
2334	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_del_cb));
2335}
2336
2337static void
2338urtwn_tsf_task_adhoc(void *arg, int pending)
2339{
2340	struct ieee80211vap *vap = arg;
2341	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2342	struct ieee80211_node *ni;
2343	uint32_t reg;
2344
2345	URTWN_LOCK(sc);
2346	ni = ieee80211_ref_node(vap->iv_bss);
2347	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
2348
2349	/* Accept beacons with the same BSSID. */
2350	urtwn_set_rx_bssid_all(sc, 0);
2351
2352	/* Enable synchronization. */
2353	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
2354	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2355
2356	/* Synchronize. */
2357	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
2358
2359	/* Disable synchronization. */
2360	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
2361	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2362
2363	/* Remove beacon filter. */
2364	urtwn_set_rx_bssid_all(sc, 1);
2365
2366	/* Enable beaconing. */
2367	urtwn_write_1(sc, R92C_MBID_NUM,
2368	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2369	reg |= R92C_BCN_CTRL_EN_BCN;
2370
2371	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2372	ieee80211_free_node(ni);
2373	URTWN_UNLOCK(sc);
2374}
2375
2376static void
2377urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
2378{
2379	struct ieee80211com *ic = &sc->sc_ic;
2380	struct urtwn_vap *uvp = URTWN_VAP(vap);
2381
2382	/* Reset TSF. */
2383	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2384
2385	switch (vap->iv_opmode) {
2386	case IEEE80211_M_STA:
2387		/* Enable TSF synchronization. */
2388		urtwn_write_1(sc, R92C_BCN_CTRL,
2389		    urtwn_read_1(sc, R92C_BCN_CTRL) &
2390		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
2391		break;
2392	case IEEE80211_M_IBSS:
2393		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
2394		break;
2395	case IEEE80211_M_HOSTAP:
2396		/* Enable beaconing. */
2397		urtwn_write_1(sc, R92C_MBID_NUM,
2398		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2399		urtwn_write_1(sc, R92C_BCN_CTRL,
2400		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
2401		break;
2402	default:
2403		device_printf(sc->sc_dev, "undefined opmode %d\n",
2404		    vap->iv_opmode);
2405		return;
2406	}
2407}
2408
2409static void
2410urtwn_get_tsf(struct urtwn_softc *sc, uint64_t *buf)
2411{
2412	urtwn_read_region_1(sc, R92C_TSFTR, (uint8_t *)buf, sizeof(*buf));
2413}
2414
2415static void
2416urtwn_set_led(struct urtwn_softc *sc, int led, int on)
2417{
2418	uint8_t reg;
2419
2420	if (led == URTWN_LED_LINK) {
2421		if (sc->chip & URTWN_CHIP_88E) {
2422			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
2423			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
2424			if (!on) {
2425				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
2426				urtwn_write_1(sc, R92C_LEDCFG2,
2427				    reg | R92C_LEDCFG0_DIS);
2428				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
2429				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
2430				    0xfe);
2431			}
2432		} else {
2433			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
2434			if (!on)
2435				reg |= R92C_LEDCFG0_DIS;
2436			urtwn_write_1(sc, R92C_LEDCFG0, reg);
2437		}
2438		sc->ledlink = on;       /* Save LED state. */
2439	}
2440}
2441
2442static void
2443urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
2444{
2445	uint8_t reg;
2446
2447	reg = urtwn_read_1(sc, R92C_MSR);
2448	reg = (reg & ~R92C_MSR_MASK) | mode;
2449	urtwn_write_1(sc, R92C_MSR, reg);
2450}
2451
2452static void
2453urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2454    const struct ieee80211_rx_stats *rxs,
2455    int rssi, int nf)
2456{
2457	struct ieee80211vap *vap = ni->ni_vap;
2458	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2459	struct urtwn_vap *uvp = URTWN_VAP(vap);
2460	uint64_t ni_tstamp, curr_tstamp;
2461
2462	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2463
2464	if (vap->iv_state == IEEE80211_S_RUN &&
2465	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2466	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2467		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2468		URTWN_LOCK(sc);
2469		urtwn_get_tsf(sc, &curr_tstamp);
2470		URTWN_UNLOCK(sc);
2471		curr_tstamp = le64toh(curr_tstamp);
2472
2473		if (ni_tstamp >= curr_tstamp)
2474			(void) ieee80211_ibss_merge(ni);
2475	}
2476}
2477
2478static int
2479urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2480{
2481	struct urtwn_vap *uvp = URTWN_VAP(vap);
2482	struct ieee80211com *ic = vap->iv_ic;
2483	struct urtwn_softc *sc = ic->ic_softc;
2484	struct ieee80211_node *ni;
2485	enum ieee80211_state ostate;
2486	uint32_t reg;
2487	uint8_t mode;
2488	int error = 0;
2489
2490	ostate = vap->iv_state;
2491	URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s -> %s\n",
2492	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
2493
2494	IEEE80211_UNLOCK(ic);
2495	URTWN_LOCK(sc);
2496	callout_stop(&sc->sc_watchdog_ch);
2497
2498	if (ostate == IEEE80211_S_RUN) {
2499		/* Stop calibration. */
2500		callout_stop(&sc->sc_calib_to);
2501
2502		/* Turn link LED off. */
2503		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2504
2505		/* Set media status to 'No Link'. */
2506		urtwn_set_mode(sc, R92C_MSR_NOLINK);
2507
2508		/* Stop Rx of data frames. */
2509		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2510
2511		/* Disable TSF synchronization. */
2512		urtwn_write_1(sc, R92C_BCN_CTRL,
2513		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2514		    R92C_BCN_CTRL_DIS_TSF_UDT0);
2515
2516		/* Disable beaconing. */
2517		urtwn_write_1(sc, R92C_MBID_NUM,
2518		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2519
2520		/* Reset TSF. */
2521		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2522
2523		/* Reset EDCA parameters. */
2524		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2525		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2526		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2527		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2528	}
2529
2530	switch (nstate) {
2531	case IEEE80211_S_INIT:
2532		/* Turn link LED off. */
2533		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2534		break;
2535	case IEEE80211_S_SCAN:
2536		/* Pause AC Tx queues. */
2537		urtwn_write_1(sc, R92C_TXPAUSE,
2538		    urtwn_read_1(sc, R92C_TXPAUSE) | R92C_TX_QUEUE_AC);
2539		break;
2540	case IEEE80211_S_AUTH:
2541		urtwn_set_chan(sc, ic->ic_curchan, NULL);
2542		break;
2543	case IEEE80211_S_RUN:
2544		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2545			/* Turn link LED on. */
2546			urtwn_set_led(sc, URTWN_LED_LINK, 1);
2547			break;
2548		}
2549
2550		ni = ieee80211_ref_node(vap->iv_bss);
2551
2552		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2553		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
2554			device_printf(sc->sc_dev,
2555			    "%s: could not move to RUN state\n", __func__);
2556			error = EINVAL;
2557			goto end_run;
2558		}
2559
2560		switch (vap->iv_opmode) {
2561		case IEEE80211_M_STA:
2562			mode = R92C_MSR_INFRA;
2563			break;
2564		case IEEE80211_M_IBSS:
2565			mode = R92C_MSR_ADHOC;
2566			break;
2567		case IEEE80211_M_HOSTAP:
2568			mode = R92C_MSR_AP;
2569			break;
2570		default:
2571			device_printf(sc->sc_dev, "undefined opmode %d\n",
2572			    vap->iv_opmode);
2573			error = EINVAL;
2574			goto end_run;
2575		}
2576
2577		/* Set media status to 'Associated'. */
2578		urtwn_set_mode(sc, mode);
2579
2580		/* Set BSSID. */
2581		urtwn_write_4(sc, R92C_BSSID + 0, le32dec(&ni->ni_bssid[0]));
2582		urtwn_write_4(sc, R92C_BSSID + 4, le16dec(&ni->ni_bssid[4]));
2583
2584		if (ic->ic_curmode == IEEE80211_MODE_11B)
2585			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2586		else	/* 802.11b/g */
2587			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2588
2589		/* Enable Rx of data frames. */
2590		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2591
2592		/* Flush all AC queues. */
2593		urtwn_write_1(sc, R92C_TXPAUSE, 0);
2594
2595		/* Set beacon interval. */
2596		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2597
2598		/* Allow Rx from our BSSID only. */
2599		if (ic->ic_promisc == 0) {
2600			reg = urtwn_read_4(sc, R92C_RCR);
2601
2602			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2603				reg |= R92C_RCR_CBSSID_DATA;
2604			if (vap->iv_opmode != IEEE80211_M_IBSS)
2605				reg |= R92C_RCR_CBSSID_BCN;
2606
2607			urtwn_write_4(sc, R92C_RCR, reg);
2608		}
2609
2610		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2611		    vap->iv_opmode == IEEE80211_M_IBSS) {
2612			error = urtwn_setup_beacon(sc, ni);
2613			if (error != 0) {
2614				device_printf(sc->sc_dev,
2615				    "unable to push beacon into the chip, "
2616				    "error %d\n", error);
2617				goto end_run;
2618			}
2619		}
2620
2621		/* Enable TSF synchronization. */
2622		urtwn_tsf_sync_enable(sc, vap);
2623
2624		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2625		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2626		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2627		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2628		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2629		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2630
2631		/* Intialize rate adaptation. */
2632		if (!(sc->chip & URTWN_CHIP_88E))
2633			urtwn_ra_init(sc);
2634		/* Turn link LED on. */
2635		urtwn_set_led(sc, URTWN_LED_LINK, 1);
2636
2637		sc->avg_pwdb = -1;	/* Reset average RSSI. */
2638		/* Reset temperature calibration state machine. */
2639		sc->sc_flags &= ~URTWN_TEMP_MEASURED;
2640		sc->thcal_lctemp = 0;
2641		/* Start periodic calibration. */
2642		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2643
2644end_run:
2645		ieee80211_free_node(ni);
2646		break;
2647	default:
2648		break;
2649	}
2650
2651	URTWN_UNLOCK(sc);
2652	IEEE80211_LOCK(ic);
2653	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2654}
2655
2656static void
2657urtwn_calib_to(void *arg)
2658{
2659	struct urtwn_softc *sc = arg;
2660
2661	/* Do it in a process context. */
2662	urtwn_cmd_sleepable(sc, NULL, 0, urtwn_calib_cb);
2663}
2664
2665static void
2666urtwn_calib_cb(struct urtwn_softc *sc, union sec_param *data)
2667{
2668	/* Do temperature compensation. */
2669	urtwn_temp_calib(sc);
2670
2671	if ((urtwn_read_1(sc, R92C_MSR) & R92C_MSR_MASK) != R92C_MSR_NOLINK)
2672		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2673}
2674
2675static void
2676urtwn_watchdog(void *arg)
2677{
2678	struct urtwn_softc *sc = arg;
2679
2680	if (sc->sc_txtimer > 0) {
2681		if (--sc->sc_txtimer == 0) {
2682			device_printf(sc->sc_dev, "device timeout\n");
2683			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2684			return;
2685		}
2686		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2687	}
2688}
2689
2690static void
2691urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2692{
2693	int pwdb;
2694
2695	/* Convert antenna signal to percentage. */
2696	if (rssi <= -100 || rssi >= 20)
2697		pwdb = 0;
2698	else if (rssi >= 0)
2699		pwdb = 100;
2700	else
2701		pwdb = 100 + rssi;
2702	if (!(sc->chip & URTWN_CHIP_88E)) {
2703		if (rate <= URTWN_RIDX_CCK11) {
2704			/* CCK gain is smaller than OFDM/MCS gain. */
2705			pwdb += 6;
2706			if (pwdb > 100)
2707				pwdb = 100;
2708			if (pwdb <= 14)
2709				pwdb -= 4;
2710			else if (pwdb <= 26)
2711				pwdb -= 8;
2712			else if (pwdb <= 34)
2713				pwdb -= 6;
2714			else if (pwdb <= 42)
2715				pwdb -= 2;
2716		}
2717	}
2718	if (sc->avg_pwdb == -1)	/* Init. */
2719		sc->avg_pwdb = pwdb;
2720	else if (sc->avg_pwdb < pwdb)
2721		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2722	else
2723		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2724	URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: PWDB %d, EMA %d\n", __func__,
2725	    pwdb, sc->avg_pwdb);
2726}
2727
2728static int8_t
2729urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2730{
2731	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2732	struct r92c_rx_phystat *phy;
2733	struct r92c_rx_cck *cck;
2734	uint8_t rpt;
2735	int8_t rssi;
2736
2737	if (rate <= URTWN_RIDX_CCK11) {
2738		cck = (struct r92c_rx_cck *)physt;
2739		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2740			rpt = (cck->agc_rpt >> 5) & 0x3;
2741			rssi = (cck->agc_rpt & 0x1f) << 1;
2742		} else {
2743			rpt = (cck->agc_rpt >> 6) & 0x3;
2744			rssi = cck->agc_rpt & 0x3e;
2745		}
2746		rssi = cckoff[rpt] - rssi;
2747	} else {	/* OFDM/HT. */
2748		phy = (struct r92c_rx_phystat *)physt;
2749		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2750	}
2751	return (rssi);
2752}
2753
2754static int8_t
2755urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2756{
2757	struct r92c_rx_phystat *phy;
2758	struct r88e_rx_cck *cck;
2759	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2760	int8_t rssi;
2761
2762	rssi = 0;
2763	if (rate <= URTWN_RIDX_CCK11) {
2764		cck = (struct r88e_rx_cck *)physt;
2765		cck_agc_rpt = cck->agc_rpt;
2766		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2767		vga_idx = cck_agc_rpt & 0x1f;
2768		switch (lna_idx) {
2769		case 7:
2770			if (vga_idx <= 27)
2771				rssi = -100 + 2* (27 - vga_idx);
2772			else
2773				rssi = -100;
2774			break;
2775		case 6:
2776			rssi = -48 + 2 * (2 - vga_idx);
2777			break;
2778		case 5:
2779			rssi = -42 + 2 * (7 - vga_idx);
2780			break;
2781		case 4:
2782			rssi = -36 + 2 * (7 - vga_idx);
2783			break;
2784		case 3:
2785			rssi = -24 + 2 * (7 - vga_idx);
2786			break;
2787		case 2:
2788			rssi = -12 + 2 * (5 - vga_idx);
2789			break;
2790		case 1:
2791			rssi = 8 - (2 * vga_idx);
2792			break;
2793		case 0:
2794			rssi = 14 - (2 * vga_idx);
2795			break;
2796		}
2797		rssi += 6;
2798	} else {	/* OFDM/HT. */
2799		phy = (struct r92c_rx_phystat *)physt;
2800		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2801	}
2802	return (rssi);
2803}
2804
2805static __inline uint8_t
2806rate2ridx(uint8_t rate)
2807{
2808	if (rate & IEEE80211_RATE_MCS) {
2809		/* 11n rates start at idx 12 */
2810		return ((rate & 0xf) + 12);
2811	}
2812	switch (rate) {
2813	/* 11g */
2814	case 12:	return 4;
2815	case 18:	return 5;
2816	case 24:	return 6;
2817	case 36:	return 7;
2818	case 48:	return 8;
2819	case 72:	return 9;
2820	case 96:	return 10;
2821	case 108:	return 11;
2822	/* 11b */
2823	case 2:		return 0;
2824	case 4:		return 1;
2825	case 11:	return 2;
2826	case 22:	return 3;
2827	default:	return 0;
2828	}
2829}
2830
2831static int
2832urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2833    struct mbuf *m, struct urtwn_data *data)
2834{
2835	const struct ieee80211_txparam *tp;
2836	struct ieee80211com *ic = &sc->sc_ic;
2837	struct ieee80211vap *vap = ni->ni_vap;
2838	struct ieee80211_key *k = NULL;
2839	struct ieee80211_channel *chan;
2840	struct ieee80211_frame *wh;
2841	struct r92c_tx_desc *txd;
2842	uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2843	int hasqos, ismcast;
2844
2845	URTWN_ASSERT_LOCKED(sc);
2846
2847	/*
2848	 * Software crypto.
2849	 */
2850	wh = mtod(m, struct ieee80211_frame *);
2851	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2852	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2853	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2854	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2855
2856	/* Select TX ring for this frame. */
2857	if (hasqos) {
2858		tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2859		tid &= IEEE80211_QOS_TID;
2860	} else
2861		tid = 0;
2862
2863	chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2864		ni->ni_chan : ic->ic_curchan;
2865	tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2866
2867	/* Choose a TX rate index. */
2868	if (type == IEEE80211_FC0_TYPE_MGT)
2869		rate = tp->mgmtrate;
2870	else if (ismcast)
2871		rate = tp->mcastrate;
2872	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2873		rate = tp->ucastrate;
2874	else if (m->m_flags & M_EAPOL)
2875		rate = tp->mgmtrate;
2876	else {
2877		if (URTWN_CHIP_HAS_RATECTL(sc)) {
2878			/* XXX pass pktlen */
2879			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2880			rate = ni->ni_txrate;
2881		} else {
2882			/* XXX TODO: drop the default rate for 11b/11g? */
2883			if (ni->ni_flags & IEEE80211_NODE_HT)
2884				rate = IEEE80211_RATE_MCS | 0x4; /* MCS4 */
2885			else if (ic->ic_curmode != IEEE80211_MODE_11B)
2886				rate = 108;
2887			else
2888				rate = 22;
2889		}
2890	}
2891
2892	/*
2893	 * XXX TODO: this should be per-node, for 11b versus 11bg
2894	 * nodes in hostap mode
2895	 */
2896	ridx = rate2ridx(rate);
2897	if (ni->ni_flags & IEEE80211_NODE_HT)
2898		raid = R92C_RAID_11GN;
2899	else if (ic->ic_curmode != IEEE80211_MODE_11B)
2900		raid = R92C_RAID_11BG;
2901	else
2902		raid = R92C_RAID_11B;
2903
2904	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2905		k = ieee80211_crypto_encap(ni, m);
2906		if (k == NULL) {
2907			device_printf(sc->sc_dev,
2908			    "ieee80211_crypto_encap returns NULL.\n");
2909			return (ENOBUFS);
2910		}
2911
2912		/* in case packet header moved, reset pointer */
2913		wh = mtod(m, struct ieee80211_frame *);
2914	}
2915
2916	/* Fill Tx descriptor. */
2917	txd = (struct r92c_tx_desc *)data->buf;
2918	memset(txd, 0, sizeof(*txd));
2919
2920	txd->txdw0 |= htole32(
2921	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2922	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2923	if (ismcast)
2924		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2925
2926	if (!ismcast) {
2927		if (sc->chip & URTWN_CHIP_88E) {
2928			struct urtwn_node *un = URTWN_NODE(ni);
2929			macid = un->id;
2930		} else
2931			macid = URTWN_MACID_BSS;
2932
2933		if (type == IEEE80211_FC0_TYPE_DATA) {
2934			qsel = tid % URTWN_MAX_TID;
2935
2936			if (sc->chip & URTWN_CHIP_88E) {
2937				txd->txdw2 |= htole32(
2938				    R88E_TXDW2_AGGBK |
2939				    R88E_TXDW2_CCX_RPT);
2940			} else
2941				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2942
2943			/* protmode, non-HT */
2944			/* XXX TODO: noack frames? */
2945			if ((rate & 0x80) == 0 &&
2946			    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2947				switch (ic->ic_protmode) {
2948				case IEEE80211_PROT_CTSONLY:
2949					txd->txdw4 |= htole32(
2950					    R92C_TXDW4_CTS2SELF |
2951					    R92C_TXDW4_HWRTSEN);
2952					break;
2953				case IEEE80211_PROT_RTSCTS:
2954					txd->txdw4 |= htole32(
2955					    R92C_TXDW4_RTSEN |
2956					    R92C_TXDW4_HWRTSEN);
2957					break;
2958				default:
2959					break;
2960				}
2961			}
2962
2963			/* protmode, HT */
2964			/* XXX TODO: noack frames? */
2965			if ((rate & 0x80) &&
2966			    (ic->ic_htprotmode == IEEE80211_PROT_RTSCTS)) {
2967				txd->txdw4 |= htole32(
2968				    R92C_TXDW4_RTSEN |
2969				    R92C_TXDW4_HWRTSEN);
2970			}
2971
2972			/* XXX TODO: rtsrate is configurable? 24mbit may
2973			 * be a bit high for RTS rate? */
2974			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2975			    URTWN_RIDX_OFDM24));
2976
2977			txd->txdw5 |= htole32(0x0001ff00);
2978		} else	/* IEEE80211_FC0_TYPE_MGT */
2979			qsel = R92C_TXDW1_QSEL_MGNT;
2980	} else {
2981		macid = URTWN_MACID_BC;
2982		qsel = R92C_TXDW1_QSEL_MGNT;
2983	}
2984
2985	txd->txdw1 |= htole32(
2986	    SM(R92C_TXDW1_QSEL, qsel) |
2987	    SM(R92C_TXDW1_RAID, raid));
2988
2989	/* XXX TODO: 40MHZ flag? */
2990	/* XXX TODO: AMPDU flag? (AGG_ENABLE or AGG_BREAK?) Density shift? */
2991	/* XXX Short preamble? */
2992	/* XXX Short-GI? */
2993
2994	if (sc->chip & URTWN_CHIP_88E)
2995		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2996	else
2997		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2998
2999	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3000
3001	/* Force this rate if needed. */
3002	if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
3003	    (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) ||
3004	    (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
3005		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3006
3007	if (!hasqos) {
3008		/* Use HW sequence numbering for non-QoS frames. */
3009		if (sc->chip & URTWN_CHIP_88E)
3010			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3011		else
3012			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3013	} else {
3014		/* Set sequence number. */
3015		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3016	}
3017
3018	if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3019		uint8_t cipher;
3020
3021		switch (k->wk_cipher->ic_cipher) {
3022		case IEEE80211_CIPHER_WEP:
3023		case IEEE80211_CIPHER_TKIP:
3024			cipher = R92C_TXDW1_CIPHER_RC4;
3025			break;
3026		case IEEE80211_CIPHER_AES_CCM:
3027			cipher = R92C_TXDW1_CIPHER_AES;
3028			break;
3029		default:
3030			device_printf(sc->sc_dev, "%s: unknown cipher %d\n",
3031			    __func__, k->wk_cipher->ic_cipher);
3032			return (EINVAL);
3033		}
3034
3035		txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3036	}
3037
3038	if (ieee80211_radiotap_active_vap(vap)) {
3039		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3040
3041		tap->wt_flags = 0;
3042		if (k != NULL)
3043			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3044		ieee80211_radiotap_tx(vap, m);
3045	}
3046
3047	data->ni = ni;
3048
3049	urtwn_tx_start(sc, m, type, data);
3050
3051	return (0);
3052}
3053
3054static int
3055urtwn_tx_raw(struct urtwn_softc *sc, struct ieee80211_node *ni,
3056    struct mbuf *m, struct urtwn_data *data,
3057    const struct ieee80211_bpf_params *params)
3058{
3059	struct ieee80211vap *vap = ni->ni_vap;
3060	struct ieee80211_key *k = NULL;
3061	struct ieee80211_frame *wh;
3062	struct r92c_tx_desc *txd;
3063	uint8_t cipher, ridx, type;
3064
3065	/* Encrypt the frame if need be. */
3066	cipher = R92C_TXDW1_CIPHER_NONE;
3067	if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
3068		/* Retrieve key for TX. */
3069		k = ieee80211_crypto_encap(ni, m);
3070		if (k == NULL)
3071			return (ENOBUFS);
3072
3073		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3074			switch (k->wk_cipher->ic_cipher) {
3075			case IEEE80211_CIPHER_WEP:
3076			case IEEE80211_CIPHER_TKIP:
3077				cipher = R92C_TXDW1_CIPHER_RC4;
3078				break;
3079			case IEEE80211_CIPHER_AES_CCM:
3080				cipher = R92C_TXDW1_CIPHER_AES;
3081				break;
3082			default:
3083				device_printf(sc->sc_dev,
3084				    "%s: unknown cipher %d\n",
3085				    __func__, k->wk_cipher->ic_cipher);
3086				return (EINVAL);
3087			}
3088		}
3089	}
3090
3091	/* XXX TODO: 11n checks, matching urtwn_tx_data() */
3092
3093	wh = mtod(m, struct ieee80211_frame *);
3094	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3095
3096	/* Fill Tx descriptor. */
3097	txd = (struct r92c_tx_desc *)data->buf;
3098	memset(txd, 0, sizeof(*txd));
3099
3100	txd->txdw0 |= htole32(
3101	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
3102	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
3103	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3104		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
3105
3106	if (params->ibp_flags & IEEE80211_BPF_RTS)
3107		txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
3108	if (params->ibp_flags & IEEE80211_BPF_CTS)
3109		txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
3110	if (txd->txdw4 & htole32(R92C_TXDW4_RTSEN | R92C_TXDW4_CTS2SELF)) {
3111		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
3112		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
3113		    URTWN_RIDX_OFDM24));
3114	}
3115
3116	if (sc->chip & URTWN_CHIP_88E)
3117		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
3118	else
3119		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
3120
3121	/* XXX TODO: rate index/config (RAID) for 11n? */
3122	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
3123	txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3124
3125	/* Choose a TX rate index. */
3126	ridx = rate2ridx(params->ibp_rate0);
3127	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3128	txd->txdw5 |= htole32(0x0001ff00);
3129	txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3130
3131	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
3132		/* Use HW sequence numbering for non-QoS frames. */
3133		if (sc->chip & URTWN_CHIP_88E)
3134			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3135		else
3136			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3137	} else {
3138		/* Set sequence number. */
3139		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3140	}
3141
3142	if (ieee80211_radiotap_active_vap(vap)) {
3143		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3144
3145		tap->wt_flags = 0;
3146		if (k != NULL)
3147			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3148		ieee80211_radiotap_tx(vap, m);
3149	}
3150
3151	data->ni = ni;
3152
3153	urtwn_tx_start(sc, m, type, data);
3154
3155	return (0);
3156}
3157
3158static void
3159urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
3160    struct urtwn_data *data)
3161{
3162	struct usb_xfer *xfer;
3163	struct r92c_tx_desc *txd;
3164	uint16_t ac, sum;
3165	int i, xferlen;
3166
3167	URTWN_ASSERT_LOCKED(sc);
3168
3169	ac = M_WME_GETAC(m);
3170
3171	switch (type) {
3172	case IEEE80211_FC0_TYPE_CTL:
3173	case IEEE80211_FC0_TYPE_MGT:
3174		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
3175		break;
3176	default:
3177		xfer = sc->sc_xfer[wme2queue[ac].qid];
3178		break;
3179	}
3180
3181	txd = (struct r92c_tx_desc *)data->buf;
3182	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
3183
3184	/* Compute Tx descriptor checksum. */
3185	sum = 0;
3186	for (i = 0; i < sizeof(*txd) / 2; i++)
3187		sum ^= ((uint16_t *)txd)[i];
3188	txd->txdsum = sum;	/* NB: already little endian. */
3189
3190	xferlen = sizeof(*txd) + m->m_pkthdr.len;
3191	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
3192
3193	data->buflen = xferlen;
3194	data->m = m;
3195
3196	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
3197	usbd_transfer_start(xfer);
3198}
3199
3200static int
3201urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
3202{
3203	struct urtwn_softc *sc = ic->ic_softc;
3204	int error;
3205
3206	URTWN_LOCK(sc);
3207	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
3208		URTWN_UNLOCK(sc);
3209		return (ENXIO);
3210	}
3211	error = mbufq_enqueue(&sc->sc_snd, m);
3212	if (error) {
3213		URTWN_UNLOCK(sc);
3214		return (error);
3215	}
3216	urtwn_start(sc);
3217	URTWN_UNLOCK(sc);
3218
3219	return (0);
3220}
3221
3222static void
3223urtwn_start(struct urtwn_softc *sc)
3224{
3225	struct ieee80211_node *ni;
3226	struct mbuf *m;
3227	struct urtwn_data *bf;
3228
3229	URTWN_ASSERT_LOCKED(sc);
3230	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3231		bf = urtwn_getbuf(sc);
3232		if (bf == NULL) {
3233			mbufq_prepend(&sc->sc_snd, m);
3234			break;
3235		}
3236		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3237		m->m_pkthdr.rcvif = NULL;
3238
3239		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
3240		    __func__,
3241		    m);
3242
3243		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
3244			if_inc_counter(ni->ni_vap->iv_ifp,
3245			    IFCOUNTER_OERRORS, 1);
3246			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3247			m_freem(m);
3248			ieee80211_free_node(ni);
3249			break;
3250		}
3251		sc->sc_txtimer = 5;
3252		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3253	}
3254}
3255
3256static void
3257urtwn_parent(struct ieee80211com *ic)
3258{
3259	struct urtwn_softc *sc = ic->ic_softc;
3260
3261	URTWN_LOCK(sc);
3262	if (sc->sc_flags & URTWN_DETACHED) {
3263		URTWN_UNLOCK(sc);
3264		return;
3265	}
3266	URTWN_UNLOCK(sc);
3267
3268	if (ic->ic_nrunning > 0) {
3269		if (urtwn_init(sc) != 0) {
3270			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3271			if (vap != NULL)
3272				ieee80211_stop(vap);
3273		} else
3274			ieee80211_start_all(ic);
3275	} else
3276		urtwn_stop(sc);
3277}
3278
3279static __inline int
3280urtwn_power_on(struct urtwn_softc *sc)
3281{
3282
3283	return sc->sc_power_on(sc);
3284}
3285
3286static int
3287urtwn_r92c_power_on(struct urtwn_softc *sc)
3288{
3289	uint32_t reg;
3290	usb_error_t error;
3291	int ntries;
3292
3293	/* Wait for autoload done bit. */
3294	for (ntries = 0; ntries < 1000; ntries++) {
3295		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
3296			break;
3297		urtwn_ms_delay(sc);
3298	}
3299	if (ntries == 1000) {
3300		device_printf(sc->sc_dev,
3301		    "timeout waiting for chip autoload\n");
3302		return (ETIMEDOUT);
3303	}
3304
3305	/* Unlock ISO/CLK/Power control register. */
3306	error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
3307	if (error != USB_ERR_NORMAL_COMPLETION)
3308		return (EIO);
3309	/* Move SPS into PWM mode. */
3310	error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
3311	if (error != USB_ERR_NORMAL_COMPLETION)
3312		return (EIO);
3313	urtwn_ms_delay(sc);
3314
3315	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
3316	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
3317		error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3318		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
3319		if (error != USB_ERR_NORMAL_COMPLETION)
3320			return (EIO);
3321		urtwn_ms_delay(sc);
3322		error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3323		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
3324		    ~R92C_SYS_ISO_CTRL_MD2PP);
3325		if (error != USB_ERR_NORMAL_COMPLETION)
3326			return (EIO);
3327	}
3328
3329	/* Auto enable WLAN. */
3330	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3331	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3332	if (error != USB_ERR_NORMAL_COMPLETION)
3333		return (EIO);
3334	for (ntries = 0; ntries < 1000; ntries++) {
3335		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3336		    R92C_APS_FSMCO_APFM_ONMAC))
3337			break;
3338		urtwn_ms_delay(sc);
3339	}
3340	if (ntries == 1000) {
3341		device_printf(sc->sc_dev,
3342		    "timeout waiting for MAC auto ON\n");
3343		return (ETIMEDOUT);
3344	}
3345
3346	/* Enable radio, GPIO and LED functions. */
3347	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3348	    R92C_APS_FSMCO_AFSM_HSUS |
3349	    R92C_APS_FSMCO_PDN_EN |
3350	    R92C_APS_FSMCO_PFM_ALDN);
3351	if (error != USB_ERR_NORMAL_COMPLETION)
3352		return (EIO);
3353	/* Release RF digital isolation. */
3354	error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
3355	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
3356	if (error != USB_ERR_NORMAL_COMPLETION)
3357		return (EIO);
3358
3359	/* Initialize MAC. */
3360	error = urtwn_write_1(sc, R92C_APSD_CTRL,
3361	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
3362	if (error != USB_ERR_NORMAL_COMPLETION)
3363		return (EIO);
3364	for (ntries = 0; ntries < 200; ntries++) {
3365		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
3366		    R92C_APSD_CTRL_OFF_STATUS))
3367			break;
3368		urtwn_ms_delay(sc);
3369	}
3370	if (ntries == 200) {
3371		device_printf(sc->sc_dev,
3372		    "timeout waiting for MAC initialization\n");
3373		return (ETIMEDOUT);
3374	}
3375
3376	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3377	reg = urtwn_read_2(sc, R92C_CR);
3378	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3379	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3380	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3381	    R92C_CR_ENSEC;
3382	error = urtwn_write_2(sc, R92C_CR, reg);
3383	if (error != USB_ERR_NORMAL_COMPLETION)
3384		return (EIO);
3385
3386	error = urtwn_write_1(sc, 0xfe10, 0x19);
3387	if (error != USB_ERR_NORMAL_COMPLETION)
3388		return (EIO);
3389	return (0);
3390}
3391
3392static int
3393urtwn_r88e_power_on(struct urtwn_softc *sc)
3394{
3395	uint32_t reg;
3396	usb_error_t error;
3397	int ntries;
3398
3399	/* Wait for power ready bit. */
3400	for (ntries = 0; ntries < 5000; ntries++) {
3401		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
3402			break;
3403		urtwn_ms_delay(sc);
3404	}
3405	if (ntries == 5000) {
3406		device_printf(sc->sc_dev,
3407		    "timeout waiting for chip power up\n");
3408		return (ETIMEDOUT);
3409	}
3410
3411	/* Reset BB. */
3412	error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3413	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
3414	    R92C_SYS_FUNC_EN_BB_GLB_RST));
3415	if (error != USB_ERR_NORMAL_COMPLETION)
3416		return (EIO);
3417
3418	error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3419	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3420	if (error != USB_ERR_NORMAL_COMPLETION)
3421		return (EIO);
3422
3423	/* Disable HWPDN. */
3424	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3425	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
3426	if (error != USB_ERR_NORMAL_COMPLETION)
3427		return (EIO);
3428
3429	/* Disable WL suspend. */
3430	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3431	    urtwn_read_2(sc, R92C_APS_FSMCO) &
3432	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
3433	if (error != USB_ERR_NORMAL_COMPLETION)
3434		return (EIO);
3435
3436	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3437	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3438	if (error != USB_ERR_NORMAL_COMPLETION)
3439		return (EIO);
3440	for (ntries = 0; ntries < 5000; ntries++) {
3441		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3442		    R92C_APS_FSMCO_APFM_ONMAC))
3443			break;
3444		urtwn_ms_delay(sc);
3445	}
3446	if (ntries == 5000)
3447		return (ETIMEDOUT);
3448
3449	/* Enable LDO normal mode. */
3450	error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
3451	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~R92C_LPLDO_CTRL_SLEEP);
3452	if (error != USB_ERR_NORMAL_COMPLETION)
3453		return (EIO);
3454
3455	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3456	error = urtwn_write_2(sc, R92C_CR, 0);
3457	if (error != USB_ERR_NORMAL_COMPLETION)
3458		return (EIO);
3459	reg = urtwn_read_2(sc, R92C_CR);
3460	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3461	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3462	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
3463	error = urtwn_write_2(sc, R92C_CR, reg);
3464	if (error != USB_ERR_NORMAL_COMPLETION)
3465		return (EIO);
3466
3467	return (0);
3468}
3469
3470static __inline void
3471urtwn_power_off(struct urtwn_softc *sc)
3472{
3473
3474	return sc->sc_power_off(sc);
3475}
3476
3477static void
3478urtwn_r92c_power_off(struct urtwn_softc *sc)
3479{
3480	uint32_t reg;
3481
3482	/* Block all Tx queues. */
3483	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3484
3485	/* Disable RF */
3486	urtwn_rf_write(sc, 0, 0, 0);
3487
3488	urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
3489
3490	/* Reset BB state machine */
3491	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3492	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA |
3493	    R92C_SYS_FUNC_EN_BB_GLB_RST);
3494	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3495	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
3496
3497	/*
3498	 * Reset digital sequence
3499	 */
3500#ifndef URTWN_WITHOUT_UCODE
3501	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
3502		/* Reset MCU ready status */
3503		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3504
3505		/* If firmware in ram code, do reset */
3506		urtwn_fw_reset(sc);
3507	}
3508#endif
3509
3510	/* Reset MAC and Enable 8051 */
3511	urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1,
3512	    (R92C_SYS_FUNC_EN_CPUEN |
3513	     R92C_SYS_FUNC_EN_ELDR |
3514	     R92C_SYS_FUNC_EN_HWPDN) >> 8);
3515
3516	/* Reset MCU ready status */
3517	urtwn_write_1(sc, R92C_MCUFWDL, 0);
3518
3519	/* Disable MAC clock */
3520	urtwn_write_2(sc, R92C_SYS_CLKR,
3521	    R92C_SYS_CLKR_ANAD16V_EN |
3522	    R92C_SYS_CLKR_ANA8M |
3523	    R92C_SYS_CLKR_LOADER_EN |
3524	    R92C_SYS_CLKR_80M_SSC_DIS |
3525	    R92C_SYS_CLKR_SYS_EN |
3526	    R92C_SYS_CLKR_RING_EN |
3527	    0x4000);
3528
3529	/* Disable AFE PLL */
3530	urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80);
3531
3532	/* Gated AFE DIG_CLOCK */
3533	urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880F);
3534
3535	/* Isolated digital to PON */
3536	urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3537	    R92C_SYS_ISO_CTRL_MD2PP |
3538	    R92C_SYS_ISO_CTRL_PA2PCIE |
3539	    R92C_SYS_ISO_CTRL_PD2CORE |
3540	    R92C_SYS_ISO_CTRL_IP2MAC |
3541	    R92C_SYS_ISO_CTRL_DIOP |
3542	    R92C_SYS_ISO_CTRL_DIOE);
3543
3544	/*
3545	 * Pull GPIO PIN to balance level and LED control
3546	 */
3547	/* 1. Disable GPIO[7:0] */
3548	urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000);
3549
3550	reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00;
3551	reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000;
3552	urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg);
3553
3554	/* Disable GPIO[10:8] */
3555	urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00);
3556
3557	reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0;
3558	reg |= (((reg & 0x000f) << 4) | 0x0780);
3559	urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg);
3560
3561	/* Disable LED0 & 1 */
3562	urtwn_write_2(sc, R92C_LEDCFG0, 0x8080);
3563
3564	/*
3565	 * Reset digital sequence
3566	 */
3567	/* Disable ELDR clock */
3568	urtwn_write_2(sc, R92C_SYS_CLKR,
3569	    R92C_SYS_CLKR_ANAD16V_EN |
3570	    R92C_SYS_CLKR_ANA8M |
3571	    R92C_SYS_CLKR_LOADER_EN |
3572	    R92C_SYS_CLKR_80M_SSC_DIS |
3573	    R92C_SYS_CLKR_SYS_EN |
3574	    R92C_SYS_CLKR_RING_EN |
3575	    0x4000);
3576
3577	/* Isolated ELDR to PON */
3578	urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1,
3579	    (R92C_SYS_ISO_CTRL_DIOR |
3580	     R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8);
3581
3582	/*
3583	 * Disable analog sequence
3584	 */
3585	/* Disable A15 power */
3586	urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF);
3587	/* Disable digital core power */
3588	urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3589	    urtwn_read_1(sc, R92C_LDOV12D_CTRL) &
3590	      ~R92C_LDOV12D_CTRL_LDV12_EN);
3591
3592	/* Enter PFM mode */
3593	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
3594
3595	/* Set USB suspend */
3596	urtwn_write_2(sc, R92C_APS_FSMCO,
3597	    R92C_APS_FSMCO_APDM_HOST |
3598	    R92C_APS_FSMCO_AFSM_HSUS |
3599	    R92C_APS_FSMCO_PFM_ALDN);
3600
3601	/* Lock ISO/CLK/Power control register. */
3602	urtwn_write_1(sc, R92C_RSV_CTRL, 0x0E);
3603}
3604
3605static void
3606urtwn_r88e_power_off(struct urtwn_softc *sc)
3607{
3608	uint8_t reg;
3609	int ntries;
3610
3611	/* Disable any kind of TX reports. */
3612	urtwn_write_1(sc, R88E_TX_RPT_CTRL,
3613	    urtwn_read_1(sc, R88E_TX_RPT_CTRL) &
3614	      ~(R88E_TX_RPT1_ENA | R88E_TX_RPT2_ENA));
3615
3616	/* Stop Rx. */
3617	urtwn_write_1(sc, R92C_CR, 0);
3618
3619	/* Move card to Low Power State. */
3620	/* Block all Tx queues. */
3621	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3622
3623	for (ntries = 0; ntries < 20; ntries++) {
3624		/* Should be zero if no packet is transmitting. */
3625		if (urtwn_read_4(sc, R88E_SCH_TXCMD) == 0)
3626			break;
3627
3628		urtwn_ms_delay(sc);
3629	}
3630	if (ntries == 20) {
3631		device_printf(sc->sc_dev, "%s: failed to block Tx queues\n",
3632		    __func__);
3633		return;
3634	}
3635
3636	/* CCK and OFDM are disabled, and clock are gated. */
3637	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3638	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~R92C_SYS_FUNC_EN_BBRSTB);
3639
3640	urtwn_ms_delay(sc);
3641
3642	/* Reset MAC TRX */
3643	urtwn_write_1(sc, R92C_CR,
3644	    R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3645	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN |
3646	    R92C_CR_PROTOCOL_EN | R92C_CR_SCHEDULE_EN);
3647
3648	/* check if removed later */
3649	urtwn_write_1(sc, R92C_CR + 1,
3650	    urtwn_read_1(sc, R92C_CR + 1) & ~(R92C_CR_ENSEC >> 8));
3651
3652	/* Respond TxOK to scheduler */
3653	urtwn_write_1(sc, R92C_DUAL_TSF_RST,
3654	    urtwn_read_1(sc, R92C_DUAL_TSF_RST) | 0x20);
3655
3656	/* If firmware in ram code, do reset. */
3657#ifndef URTWN_WITHOUT_UCODE
3658	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY)
3659		urtwn_r88e_fw_reset(sc);
3660#endif
3661
3662	/* Reset MCU ready status. */
3663	urtwn_write_1(sc, R92C_MCUFWDL, 0x00);
3664
3665	/* Disable 32k. */
3666	urtwn_write_1(sc, R88E_32K_CTRL,
3667	    urtwn_read_1(sc, R88E_32K_CTRL) & ~0x01);
3668
3669	/* Move card to Disabled state. */
3670	/* Turn off RF. */
3671	urtwn_write_1(sc, R92C_RF_CTRL, 0);
3672
3673	/* LDO Sleep mode. */
3674	urtwn_write_1(sc, R92C_LPLDO_CTRL,
3675	    urtwn_read_1(sc, R92C_LPLDO_CTRL) | R92C_LPLDO_CTRL_SLEEP);
3676
3677	/* Turn off MAC by HW state machine */
3678	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3679	    urtwn_read_1(sc, R92C_APS_FSMCO + 1) |
3680	    (R92C_APS_FSMCO_APFM_OFF >> 8));
3681
3682	for (ntries = 0; ntries < 20; ntries++) {
3683		/* Wait until it will be disabled. */
3684		if ((urtwn_read_1(sc, R92C_APS_FSMCO + 1) &
3685		    (R92C_APS_FSMCO_APFM_OFF >> 8)) == 0)
3686			break;
3687
3688		urtwn_ms_delay(sc);
3689	}
3690	if (ntries == 20) {
3691		device_printf(sc->sc_dev, "%s: could not turn off MAC\n",
3692		    __func__);
3693		return;
3694	}
3695
3696	/* schmit trigger */
3697	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3698	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3699
3700	/* Enable WL suspend. */
3701	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3702	    (urtwn_read_1(sc, R92C_APS_FSMCO + 1) & ~0x10) | 0x08);
3703
3704	/* Enable bandgap mbias in suspend. */
3705	urtwn_write_1(sc, R92C_APS_FSMCO + 3, 0);
3706
3707	/* Clear SIC_EN register. */
3708	urtwn_write_1(sc, R92C_GPIO_MUXCFG + 1,
3709	    urtwn_read_1(sc, R92C_GPIO_MUXCFG + 1) & ~0x10);
3710
3711	/* Set USB suspend enable local register */
3712	urtwn_write_1(sc, R92C_USB_SUSPEND,
3713	    urtwn_read_1(sc, R92C_USB_SUSPEND) | 0x10);
3714
3715	/* Reset MCU IO Wrapper. */
3716	reg = urtwn_read_1(sc, R92C_RSV_CTRL + 1);
3717	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg & ~0x08);
3718	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg | 0x08);
3719
3720	/* marked as 'For Power Consumption' code. */
3721	urtwn_write_1(sc, R92C_GPIO_OUT, urtwn_read_1(sc, R92C_GPIO_IN));
3722	urtwn_write_1(sc, R92C_GPIO_IOSEL, 0xff);
3723
3724	urtwn_write_1(sc, R92C_GPIO_IO_SEL,
3725	    urtwn_read_1(sc, R92C_GPIO_IO_SEL) << 4);
3726	urtwn_write_1(sc, R92C_GPIO_MOD,
3727	    urtwn_read_1(sc, R92C_GPIO_MOD) | 0x0f);
3728
3729	/* Set LNA, TRSW, EX_PA Pin to output mode. */
3730	urtwn_write_4(sc, R88E_BB_PAD_CTRL, 0x00080808);
3731}
3732
3733static int
3734urtwn_llt_init(struct urtwn_softc *sc)
3735{
3736	int i, error, page_count, pktbuf_count;
3737
3738	page_count = (sc->chip & URTWN_CHIP_88E) ?
3739	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
3740	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
3741	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
3742
3743	/* Reserve pages [0; page_count]. */
3744	for (i = 0; i < page_count; i++) {
3745		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3746			return (error);
3747	}
3748	/* NB: 0xff indicates end-of-list. */
3749	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
3750		return (error);
3751	/*
3752	 * Use pages [page_count + 1; pktbuf_count - 1]
3753	 * as ring buffer.
3754	 */
3755	for (++i; i < pktbuf_count - 1; i++) {
3756		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3757			return (error);
3758	}
3759	/* Make the last page point to the beginning of the ring buffer. */
3760	error = urtwn_llt_write(sc, i, page_count + 1);
3761	return (error);
3762}
3763
3764#ifndef URTWN_WITHOUT_UCODE
3765static void
3766urtwn_fw_reset(struct urtwn_softc *sc)
3767{
3768	uint16_t reg;
3769	int ntries;
3770
3771	/* Tell 8051 to reset itself. */
3772	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
3773
3774	/* Wait until 8051 resets by itself. */
3775	for (ntries = 0; ntries < 100; ntries++) {
3776		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3777		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
3778			return;
3779		urtwn_ms_delay(sc);
3780	}
3781	/* Force 8051 reset. */
3782	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3783}
3784
3785static void
3786urtwn_r88e_fw_reset(struct urtwn_softc *sc)
3787{
3788	uint16_t reg;
3789
3790	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3791	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3792	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
3793}
3794
3795static int
3796urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
3797{
3798	uint32_t reg;
3799	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
3800	int off, mlen;
3801
3802	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3803	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
3804	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3805
3806	off = R92C_FW_START_ADDR;
3807	while (len > 0) {
3808		if (len > 196)
3809			mlen = 196;
3810		else if (len > 4)
3811			mlen = 4;
3812		else
3813			mlen = 1;
3814		/* XXX fix this deconst */
3815		error = urtwn_write_region_1(sc, off,
3816		    __DECONST(uint8_t *, buf), mlen);
3817		if (error != USB_ERR_NORMAL_COMPLETION)
3818			break;
3819		off += mlen;
3820		buf += mlen;
3821		len -= mlen;
3822	}
3823	return (error);
3824}
3825
3826static int
3827urtwn_load_firmware(struct urtwn_softc *sc)
3828{
3829	const struct firmware *fw;
3830	const struct r92c_fw_hdr *hdr;
3831	const char *imagename;
3832	const u_char *ptr;
3833	size_t len;
3834	uint32_t reg;
3835	int mlen, ntries, page, error;
3836
3837	URTWN_UNLOCK(sc);
3838	/* Read firmware image from the filesystem. */
3839	if (sc->chip & URTWN_CHIP_88E)
3840		imagename = "urtwn-rtl8188eufw";
3841	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3842		    URTWN_CHIP_UMC_A_CUT)
3843		imagename = "urtwn-rtl8192cfwU";
3844	else
3845		imagename = "urtwn-rtl8192cfwT";
3846
3847	fw = firmware_get(imagename);
3848	URTWN_LOCK(sc);
3849	if (fw == NULL) {
3850		device_printf(sc->sc_dev,
3851		    "failed loadfirmware of file %s\n", imagename);
3852		return (ENOENT);
3853	}
3854
3855	len = fw->datasize;
3856
3857	if (len < sizeof(*hdr)) {
3858		device_printf(sc->sc_dev, "firmware too short\n");
3859		error = EINVAL;
3860		goto fail;
3861	}
3862	ptr = fw->data;
3863	hdr = (const struct r92c_fw_hdr *)ptr;
3864	/* Check if there is a valid FW header and skip it. */
3865	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
3866	    (le16toh(hdr->signature) >> 4) == 0x88e ||
3867	    (le16toh(hdr->signature) >> 4) == 0x92c) {
3868		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE,
3869		    "FW V%d.%d %02d-%02d %02d:%02d\n",
3870		    le16toh(hdr->version), le16toh(hdr->subversion),
3871		    hdr->month, hdr->date, hdr->hour, hdr->minute);
3872		ptr += sizeof(*hdr);
3873		len -= sizeof(*hdr);
3874	}
3875
3876	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
3877		if (sc->chip & URTWN_CHIP_88E)
3878			urtwn_r88e_fw_reset(sc);
3879		else
3880			urtwn_fw_reset(sc);
3881		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3882	}
3883
3884	if (!(sc->chip & URTWN_CHIP_88E)) {
3885		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3886		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3887		    R92C_SYS_FUNC_EN_CPUEN);
3888	}
3889	urtwn_write_1(sc, R92C_MCUFWDL,
3890	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
3891	urtwn_write_1(sc, R92C_MCUFWDL + 2,
3892	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
3893
3894	/* Reset the FWDL checksum. */
3895	urtwn_write_1(sc, R92C_MCUFWDL,
3896	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
3897
3898	for (page = 0; len > 0; page++) {
3899		mlen = min(len, R92C_FW_PAGE_SIZE);
3900		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
3901		if (error != 0) {
3902			device_printf(sc->sc_dev,
3903			    "could not load firmware page\n");
3904			goto fail;
3905		}
3906		ptr += mlen;
3907		len -= mlen;
3908	}
3909	urtwn_write_1(sc, R92C_MCUFWDL,
3910	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
3911	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
3912
3913	/* Wait for checksum report. */
3914	for (ntries = 0; ntries < 1000; ntries++) {
3915		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
3916			break;
3917		urtwn_ms_delay(sc);
3918	}
3919	if (ntries == 1000) {
3920		device_printf(sc->sc_dev,
3921		    "timeout waiting for checksum report\n");
3922		error = ETIMEDOUT;
3923		goto fail;
3924	}
3925
3926	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3927	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
3928	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3929	if (sc->chip & URTWN_CHIP_88E)
3930		urtwn_r88e_fw_reset(sc);
3931	/* Wait for firmware readiness. */
3932	for (ntries = 0; ntries < 1000; ntries++) {
3933		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3934			break;
3935		urtwn_ms_delay(sc);
3936	}
3937	if (ntries == 1000) {
3938		device_printf(sc->sc_dev,
3939		    "timeout waiting for firmware readiness\n");
3940		error = ETIMEDOUT;
3941		goto fail;
3942	}
3943fail:
3944	firmware_put(fw, FIRMWARE_UNLOAD);
3945	return (error);
3946}
3947#endif
3948
3949static int
3950urtwn_dma_init(struct urtwn_softc *sc)
3951{
3952	struct usb_endpoint *ep, *ep_end;
3953	usb_error_t usb_err;
3954	uint32_t reg;
3955	int hashq, hasnq, haslq, nqueues, ntx;
3956	int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3957
3958	/* Initialize LLT table. */
3959	error = urtwn_llt_init(sc);
3960	if (error != 0)
3961		return (error);
3962
3963	/* Determine the number of bulk-out pipes. */
3964	ntx = 0;
3965	ep = sc->sc_udev->endpoints;
3966	ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
3967	for (; ep != ep_end; ep++) {
3968		if ((ep->edesc == NULL) ||
3969		    (ep->iface_index != sc->sc_iface_index))
3970			continue;
3971		if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
3972			ntx++;
3973	}
3974	if (ntx == 0) {
3975		device_printf(sc->sc_dev,
3976		    "%d: invalid number of Tx bulk pipes\n", ntx);
3977		return (EIO);
3978	}
3979
3980	/* Get Tx queues to USB endpoints mapping. */
3981	hashq = hasnq = haslq = nqueues = 0;
3982	switch (ntx) {
3983	case 1: hashq = 1; break;
3984	case 2: hashq = hasnq = 1; break;
3985	case 3: case 4: hashq = hasnq = haslq = 1; break;
3986	}
3987	nqueues = hashq + hasnq + haslq;
3988	if (nqueues == 0)
3989		return (EIO);
3990
3991	npubqpages = nqpages = nrempages = pagecount = 0;
3992	if (sc->chip & URTWN_CHIP_88E)
3993		tx_boundary = R88E_TX_PAGE_BOUNDARY;
3994	else {
3995		pagecount = R92C_TX_PAGE_COUNT;
3996		npubqpages = R92C_PUBQ_NPAGES;
3997		tx_boundary = R92C_TX_PAGE_BOUNDARY;
3998	}
3999
4000	/* Set number of pages for normal priority queue. */
4001	if (sc->chip & URTWN_CHIP_88E) {
4002		usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
4003		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4004			return (EIO);
4005		usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
4006		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4007			return (EIO);
4008	} else {
4009		/* Get the number of pages for each queue. */
4010		nqpages = (pagecount - npubqpages) / nqueues;
4011		/*
4012		 * The remaining pages are assigned to the high priority
4013		 * queue.
4014		 */
4015		nrempages = (pagecount - npubqpages) % nqueues;
4016		usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
4017		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4018			return (EIO);
4019		usb_err = urtwn_write_4(sc, R92C_RQPN,
4020		    /* Set number of pages for public queue. */
4021		    SM(R92C_RQPN_PUBQ, npubqpages) |
4022		    /* Set number of pages for high priority queue. */
4023		    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
4024		    /* Set number of pages for low priority queue. */
4025		    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
4026		    /* Load values. */
4027		    R92C_RQPN_LD);
4028		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4029			return (EIO);
4030	}
4031
4032	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
4033	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4034		return (EIO);
4035	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
4036	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4037		return (EIO);
4038	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
4039	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4040		return (EIO);
4041	usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
4042	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4043		return (EIO);
4044	usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
4045	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4046		return (EIO);
4047
4048	/* Set queue to USB pipe mapping. */
4049	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
4050	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
4051	if (nqueues == 1) {
4052		if (hashq)
4053			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
4054		else if (hasnq)
4055			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
4056		else
4057			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
4058	} else if (nqueues == 2) {
4059		/*
4060		 * All 2-endpoints configs have high and normal
4061		 * priority queues.
4062		 */
4063		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
4064	} else
4065		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
4066	usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
4067	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4068		return (EIO);
4069
4070	/* Set Tx/Rx transfer page boundary. */
4071	usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
4072	    (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
4073	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4074		return (EIO);
4075
4076	/* Set Tx/Rx transfer page size. */
4077	usb_err = urtwn_write_1(sc, R92C_PBP,
4078	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
4079	    SM(R92C_PBP_PSTX, R92C_PBP_128));
4080	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4081		return (EIO);
4082
4083	return (0);
4084}
4085
4086static int
4087urtwn_mac_init(struct urtwn_softc *sc)
4088{
4089	usb_error_t error;
4090	int i;
4091
4092	/* Write MAC initialization values. */
4093	if (sc->chip & URTWN_CHIP_88E) {
4094		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
4095			error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
4096			    rtl8188eu_mac[i].val);
4097			if (error != USB_ERR_NORMAL_COMPLETION)
4098				return (EIO);
4099		}
4100		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
4101	} else {
4102		for (i = 0; i < nitems(rtl8192cu_mac); i++)
4103			error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
4104			    rtl8192cu_mac[i].val);
4105			if (error != USB_ERR_NORMAL_COMPLETION)
4106				return (EIO);
4107	}
4108
4109	return (0);
4110}
4111
4112static void
4113urtwn_bb_init(struct urtwn_softc *sc)
4114{
4115	const struct urtwn_bb_prog *prog;
4116	uint32_t reg;
4117	uint8_t crystalcap;
4118	int i;
4119
4120	/* Enable BB and RF. */
4121	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
4122	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
4123	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
4124	    R92C_SYS_FUNC_EN_DIO_RF);
4125
4126	if (!(sc->chip & URTWN_CHIP_88E))
4127		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
4128
4129	urtwn_write_1(sc, R92C_RF_CTRL,
4130	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
4131	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
4132	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
4133	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
4134
4135	if (!(sc->chip & URTWN_CHIP_88E)) {
4136		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
4137		urtwn_write_1(sc, 0x15, 0xe9);
4138		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
4139	}
4140
4141	/* Select BB programming based on board type. */
4142	if (sc->chip & URTWN_CHIP_88E)
4143		prog = &rtl8188eu_bb_prog;
4144	else if (!(sc->chip & URTWN_CHIP_92C)) {
4145		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4146			prog = &rtl8188ce_bb_prog;
4147		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4148			prog = &rtl8188ru_bb_prog;
4149		else
4150			prog = &rtl8188cu_bb_prog;
4151	} else {
4152		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4153			prog = &rtl8192ce_bb_prog;
4154		else
4155			prog = &rtl8192cu_bb_prog;
4156	}
4157	/* Write BB initialization values. */
4158	for (i = 0; i < prog->count; i++) {
4159		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
4160		urtwn_ms_delay(sc);
4161	}
4162
4163	if (sc->chip & URTWN_CHIP_92C_1T2R) {
4164		/* 8192C 1T only configuration. */
4165		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
4166		reg = (reg & ~0x00000003) | 0x2;
4167		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
4168
4169		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
4170		reg = (reg & ~0x00300033) | 0x00200022;
4171		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
4172
4173		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
4174		reg = (reg & ~0xff000000) | 0x45 << 24;
4175		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
4176
4177		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
4178		reg = (reg & ~0x000000ff) | 0x23;
4179		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
4180
4181		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
4182		reg = (reg & ~0x00000030) | 1 << 4;
4183		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
4184
4185		reg = urtwn_bb_read(sc, 0xe74);
4186		reg = (reg & ~0x0c000000) | 2 << 26;
4187		urtwn_bb_write(sc, 0xe74, reg);
4188		reg = urtwn_bb_read(sc, 0xe78);
4189		reg = (reg & ~0x0c000000) | 2 << 26;
4190		urtwn_bb_write(sc, 0xe78, reg);
4191		reg = urtwn_bb_read(sc, 0xe7c);
4192		reg = (reg & ~0x0c000000) | 2 << 26;
4193		urtwn_bb_write(sc, 0xe7c, reg);
4194		reg = urtwn_bb_read(sc, 0xe80);
4195		reg = (reg & ~0x0c000000) | 2 << 26;
4196		urtwn_bb_write(sc, 0xe80, reg);
4197		reg = urtwn_bb_read(sc, 0xe88);
4198		reg = (reg & ~0x0c000000) | 2 << 26;
4199		urtwn_bb_write(sc, 0xe88, reg);
4200	}
4201
4202	/* Write AGC values. */
4203	for (i = 0; i < prog->agccount; i++) {
4204		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
4205		    prog->agcvals[i]);
4206		urtwn_ms_delay(sc);
4207	}
4208
4209	if (sc->chip & URTWN_CHIP_88E) {
4210		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
4211		urtwn_ms_delay(sc);
4212		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
4213		urtwn_ms_delay(sc);
4214
4215		crystalcap = sc->rom.r88e_rom.crystalcap;
4216		if (crystalcap == 0xff)
4217			crystalcap = 0x20;
4218		crystalcap &= 0x3f;
4219		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
4220		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
4221		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
4222		    crystalcap | crystalcap << 6));
4223	} else {
4224		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
4225		    R92C_HSSI_PARAM2_CCK_HIPWR)
4226			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
4227	}
4228}
4229
4230static void
4231urtwn_rf_init(struct urtwn_softc *sc)
4232{
4233	const struct urtwn_rf_prog *prog;
4234	uint32_t reg, type;
4235	int i, j, idx, off;
4236
4237	/* Select RF programming based on board type. */
4238	if (sc->chip & URTWN_CHIP_88E)
4239		prog = rtl8188eu_rf_prog;
4240	else if (!(sc->chip & URTWN_CHIP_92C)) {
4241		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4242			prog = rtl8188ce_rf_prog;
4243		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4244			prog = rtl8188ru_rf_prog;
4245		else
4246			prog = rtl8188cu_rf_prog;
4247	} else
4248		prog = rtl8192ce_rf_prog;
4249
4250	for (i = 0; i < sc->nrxchains; i++) {
4251		/* Save RF_ENV control type. */
4252		idx = i / 2;
4253		off = (i % 2) * 16;
4254		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4255		type = (reg >> off) & 0x10;
4256
4257		/* Set RF_ENV enable. */
4258		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4259		reg |= 0x100000;
4260		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4261		urtwn_ms_delay(sc);
4262		/* Set RF_ENV output high. */
4263		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4264		reg |= 0x10;
4265		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4266		urtwn_ms_delay(sc);
4267		/* Set address and data lengths of RF registers. */
4268		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4269		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
4270		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4271		urtwn_ms_delay(sc);
4272		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4273		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
4274		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4275		urtwn_ms_delay(sc);
4276
4277		/* Write RF initialization values for this chain. */
4278		for (j = 0; j < prog[i].count; j++) {
4279			if (prog[i].regs[j] >= 0xf9 &&
4280			    prog[i].regs[j] <= 0xfe) {
4281				/*
4282				 * These are fake RF registers offsets that
4283				 * indicate a delay is required.
4284				 */
4285				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
4286				continue;
4287			}
4288			urtwn_rf_write(sc, i, prog[i].regs[j],
4289			    prog[i].vals[j]);
4290			urtwn_ms_delay(sc);
4291		}
4292
4293		/* Restore RF_ENV control type. */
4294		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4295		reg &= ~(0x10 << off) | (type << off);
4296		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
4297
4298		/* Cache RF register CHNLBW. */
4299		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
4300	}
4301
4302	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
4303	    URTWN_CHIP_UMC_A_CUT) {
4304		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
4305		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
4306	}
4307}
4308
4309static void
4310urtwn_cam_init(struct urtwn_softc *sc)
4311{
4312	/* Invalidate all CAM entries. */
4313	urtwn_write_4(sc, R92C_CAMCMD,
4314	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
4315}
4316
4317static int
4318urtwn_cam_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
4319{
4320	usb_error_t error;
4321
4322	error = urtwn_write_4(sc, R92C_CAMWRITE, data);
4323	if (error != USB_ERR_NORMAL_COMPLETION)
4324		return (EIO);
4325	error = urtwn_write_4(sc, R92C_CAMCMD,
4326	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
4327	    SM(R92C_CAMCMD_ADDR, addr));
4328	if (error != USB_ERR_NORMAL_COMPLETION)
4329		return (EIO);
4330
4331	return (0);
4332}
4333
4334static void
4335urtwn_pa_bias_init(struct urtwn_softc *sc)
4336{
4337	uint8_t reg;
4338	int i;
4339
4340	for (i = 0; i < sc->nrxchains; i++) {
4341		if (sc->pa_setting & (1 << i))
4342			continue;
4343		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
4344		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
4345		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
4346		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
4347	}
4348	if (!(sc->pa_setting & 0x10)) {
4349		reg = urtwn_read_1(sc, 0x16);
4350		reg = (reg & ~0xf0) | 0x90;
4351		urtwn_write_1(sc, 0x16, reg);
4352	}
4353}
4354
4355static void
4356urtwn_rxfilter_init(struct urtwn_softc *sc)
4357{
4358	struct ieee80211com *ic = &sc->sc_ic;
4359	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4360	uint32_t rcr;
4361	uint16_t filter;
4362
4363	URTWN_ASSERT_LOCKED(sc);
4364
4365	/* Accept all multicast frames. */
4366	urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
4367	urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
4368
4369	/* Filter for management frames. */
4370	filter = 0x7f3f;
4371	switch (vap->iv_opmode) {
4372	case IEEE80211_M_STA:
4373		filter &= ~(
4374		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
4375		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
4376		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
4377		break;
4378	case IEEE80211_M_HOSTAP:
4379		filter &= ~(
4380		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
4381		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP));
4382		break;
4383	case IEEE80211_M_MONITOR:
4384	case IEEE80211_M_IBSS:
4385		break;
4386	default:
4387		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4388		    __func__, vap->iv_opmode);
4389		break;
4390	}
4391	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
4392
4393	/* Reject all control frames. */
4394	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
4395
4396	/* Reject all data frames. */
4397	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
4398
4399	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
4400	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
4401	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
4402
4403	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
4404		/* Accept all frames. */
4405		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
4406		       R92C_RCR_AAP;
4407	}
4408
4409	/* Set Rx filter. */
4410	urtwn_write_4(sc, R92C_RCR, rcr);
4411
4412	if (ic->ic_promisc != 0) {
4413		/* Update Rx filter. */
4414		urtwn_set_promisc(sc);
4415	}
4416}
4417
4418static void
4419urtwn_edca_init(struct urtwn_softc *sc)
4420{
4421	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
4422	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
4423	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
4424	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
4425	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
4426	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
4427	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
4428	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
4429}
4430
4431static void
4432urtwn_write_txpower(struct urtwn_softc *sc, int chain,
4433    uint16_t power[URTWN_RIDX_COUNT])
4434{
4435	uint32_t reg;
4436
4437	/* Write per-CCK rate Tx power. */
4438	if (chain == 0) {
4439		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
4440		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
4441		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
4442		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4443		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
4444		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
4445		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
4446		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4447	} else {
4448		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
4449		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
4450		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
4451		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
4452		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
4453		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4454		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
4455		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4456	}
4457	/* Write per-OFDM rate Tx power. */
4458	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
4459	    SM(R92C_TXAGC_RATE06, power[ 4]) |
4460	    SM(R92C_TXAGC_RATE09, power[ 5]) |
4461	    SM(R92C_TXAGC_RATE12, power[ 6]) |
4462	    SM(R92C_TXAGC_RATE18, power[ 7]));
4463	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
4464	    SM(R92C_TXAGC_RATE24, power[ 8]) |
4465	    SM(R92C_TXAGC_RATE36, power[ 9]) |
4466	    SM(R92C_TXAGC_RATE48, power[10]) |
4467	    SM(R92C_TXAGC_RATE54, power[11]));
4468	/* Write per-MCS Tx power. */
4469	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
4470	    SM(R92C_TXAGC_MCS00,  power[12]) |
4471	    SM(R92C_TXAGC_MCS01,  power[13]) |
4472	    SM(R92C_TXAGC_MCS02,  power[14]) |
4473	    SM(R92C_TXAGC_MCS03,  power[15]));
4474	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
4475	    SM(R92C_TXAGC_MCS04,  power[16]) |
4476	    SM(R92C_TXAGC_MCS05,  power[17]) |
4477	    SM(R92C_TXAGC_MCS06,  power[18]) |
4478	    SM(R92C_TXAGC_MCS07,  power[19]));
4479	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
4480	    SM(R92C_TXAGC_MCS08,  power[20]) |
4481	    SM(R92C_TXAGC_MCS09,  power[21]) |
4482	    SM(R92C_TXAGC_MCS10,  power[22]) |
4483	    SM(R92C_TXAGC_MCS11,  power[23]));
4484	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
4485	    SM(R92C_TXAGC_MCS12,  power[24]) |
4486	    SM(R92C_TXAGC_MCS13,  power[25]) |
4487	    SM(R92C_TXAGC_MCS14,  power[26]) |
4488	    SM(R92C_TXAGC_MCS15,  power[27]));
4489}
4490
4491static void
4492urtwn_get_txpower(struct urtwn_softc *sc, int chain,
4493    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4494    uint16_t power[URTWN_RIDX_COUNT])
4495{
4496	struct ieee80211com *ic = &sc->sc_ic;
4497	struct r92c_rom *rom = &sc->rom.r92c_rom;
4498	uint16_t cckpow, ofdmpow, htpow, diff, max;
4499	const struct urtwn_txpwr *base;
4500	int ridx, chan, group;
4501
4502	/* Determine channel group. */
4503	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4504	if (chan <= 3)
4505		group = 0;
4506	else if (chan <= 9)
4507		group = 1;
4508	else
4509		group = 2;
4510
4511	/* Get original Tx power based on board type and RF chain. */
4512	if (!(sc->chip & URTWN_CHIP_92C)) {
4513		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4514			base = &rtl8188ru_txagc[chain];
4515		else
4516			base = &rtl8192cu_txagc[chain];
4517	} else
4518		base = &rtl8192cu_txagc[chain];
4519
4520	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4521	if (sc->regulatory == 0) {
4522		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4523			power[ridx] = base->pwr[0][ridx];
4524	}
4525	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4526		if (sc->regulatory == 3) {
4527			power[ridx] = base->pwr[0][ridx];
4528			/* Apply vendor limits. */
4529			if (extc != NULL)
4530				max = rom->ht40_max_pwr[group];
4531			else
4532				max = rom->ht20_max_pwr[group];
4533			max = (max >> (chain * 4)) & 0xf;
4534			if (power[ridx] > max)
4535				power[ridx] = max;
4536		} else if (sc->regulatory == 1) {
4537			if (extc == NULL)
4538				power[ridx] = base->pwr[group][ridx];
4539		} else if (sc->regulatory != 2)
4540			power[ridx] = base->pwr[0][ridx];
4541	}
4542
4543	/* Compute per-CCK rate Tx power. */
4544	cckpow = rom->cck_tx_pwr[chain][group];
4545	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4546		power[ridx] += cckpow;
4547		if (power[ridx] > R92C_MAX_TX_PWR)
4548			power[ridx] = R92C_MAX_TX_PWR;
4549	}
4550
4551	htpow = rom->ht40_1s_tx_pwr[chain][group];
4552	if (sc->ntxchains > 1) {
4553		/* Apply reduction for 2 spatial streams. */
4554		diff = rom->ht40_2s_tx_pwr_diff[group];
4555		diff = (diff >> (chain * 4)) & 0xf;
4556		htpow = (htpow > diff) ? htpow - diff : 0;
4557	}
4558
4559	/* Compute per-OFDM rate Tx power. */
4560	diff = rom->ofdm_tx_pwr_diff[group];
4561	diff = (diff >> (chain * 4)) & 0xf;
4562	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
4563	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4564		power[ridx] += ofdmpow;
4565		if (power[ridx] > R92C_MAX_TX_PWR)
4566			power[ridx] = R92C_MAX_TX_PWR;
4567	}
4568
4569	/* Compute per-MCS Tx power. */
4570	if (extc == NULL) {
4571		diff = rom->ht20_tx_pwr_diff[group];
4572		diff = (diff >> (chain * 4)) & 0xf;
4573		htpow += diff;	/* HT40->HT20 correction. */
4574	}
4575	for (ridx = 12; ridx <= 27; ridx++) {
4576		power[ridx] += htpow;
4577		if (power[ridx] > R92C_MAX_TX_PWR)
4578			power[ridx] = R92C_MAX_TX_PWR;
4579	}
4580#ifdef USB_DEBUG
4581	if (sc->sc_debug & URTWN_DEBUG_TXPWR) {
4582		/* Dump per-rate Tx power values. */
4583		printf("Tx power for chain %d:\n", chain);
4584		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
4585			printf("Rate %d = %u\n", ridx, power[ridx]);
4586	}
4587#endif
4588}
4589
4590static void
4591urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
4592    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4593    uint16_t power[URTWN_RIDX_COUNT])
4594{
4595	struct ieee80211com *ic = &sc->sc_ic;
4596	struct r88e_rom *rom = &sc->rom.r88e_rom;
4597	uint16_t cckpow, ofdmpow, bw20pow, htpow;
4598	const struct urtwn_r88e_txpwr *base;
4599	int ridx, chan, group;
4600
4601	/* Determine channel group. */
4602	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4603	if (chan <= 2)
4604		group = 0;
4605	else if (chan <= 5)
4606		group = 1;
4607	else if (chan <= 8)
4608		group = 2;
4609	else if (chan <= 11)
4610		group = 3;
4611	else if (chan <= 13)
4612		group = 4;
4613	else
4614		group = 5;
4615
4616	/* Get original Tx power based on board type and RF chain. */
4617	base = &rtl8188eu_txagc[chain];
4618
4619	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4620	if (sc->regulatory == 0) {
4621		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4622			power[ridx] = base->pwr[0][ridx];
4623	}
4624	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4625		if (sc->regulatory == 3)
4626			power[ridx] = base->pwr[0][ridx];
4627		else if (sc->regulatory == 1) {
4628			if (extc == NULL)
4629				power[ridx] = base->pwr[group][ridx];
4630		} else if (sc->regulatory != 2)
4631			power[ridx] = base->pwr[0][ridx];
4632	}
4633
4634	/* Compute per-CCK rate Tx power. */
4635	cckpow = rom->cck_tx_pwr[group];
4636	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4637		power[ridx] += cckpow;
4638		if (power[ridx] > R92C_MAX_TX_PWR)
4639			power[ridx] = R92C_MAX_TX_PWR;
4640	}
4641
4642	htpow = rom->ht40_tx_pwr[group];
4643
4644	/* Compute per-OFDM rate Tx power. */
4645	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
4646	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4647		power[ridx] += ofdmpow;
4648		if (power[ridx] > R92C_MAX_TX_PWR)
4649			power[ridx] = R92C_MAX_TX_PWR;
4650	}
4651
4652	bw20pow = htpow + sc->bw20_tx_pwr_diff;
4653	for (ridx = 12; ridx <= 27; ridx++) {
4654		power[ridx] += bw20pow;
4655		if (power[ridx] > R92C_MAX_TX_PWR)
4656			power[ridx] = R92C_MAX_TX_PWR;
4657	}
4658}
4659
4660static void
4661urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
4662    struct ieee80211_channel *extc)
4663{
4664	uint16_t power[URTWN_RIDX_COUNT];
4665	int i;
4666
4667	for (i = 0; i < sc->ntxchains; i++) {
4668		/* Compute per-rate Tx power values. */
4669		if (sc->chip & URTWN_CHIP_88E)
4670			urtwn_r88e_get_txpower(sc, i, c, extc, power);
4671		else
4672			urtwn_get_txpower(sc, i, c, extc, power);
4673		/* Write per-rate Tx power values to hardware. */
4674		urtwn_write_txpower(sc, i, power);
4675	}
4676}
4677
4678static void
4679urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
4680{
4681	uint32_t reg;
4682
4683	reg = urtwn_read_4(sc, R92C_RCR);
4684	if (enable)
4685		reg &= ~R92C_RCR_CBSSID_BCN;
4686	else
4687		reg |= R92C_RCR_CBSSID_BCN;
4688	urtwn_write_4(sc, R92C_RCR, reg);
4689}
4690
4691static void
4692urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
4693{
4694	uint32_t reg;
4695
4696	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
4697	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4698	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
4699
4700	if (!(sc->chip & URTWN_CHIP_88E)) {
4701		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
4702		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4703		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
4704	}
4705}
4706
4707static void
4708urtwn_scan_start(struct ieee80211com *ic)
4709{
4710	struct urtwn_softc *sc = ic->ic_softc;
4711
4712	URTWN_LOCK(sc);
4713	/* Receive beacons / probe responses from any BSSID. */
4714	if (ic->ic_opmode != IEEE80211_M_IBSS)
4715		urtwn_set_rx_bssid_all(sc, 1);
4716
4717	/* Set gain for scanning. */
4718	urtwn_set_gain(sc, 0x20);
4719	URTWN_UNLOCK(sc);
4720}
4721
4722static void
4723urtwn_scan_end(struct ieee80211com *ic)
4724{
4725	struct urtwn_softc *sc = ic->ic_softc;
4726
4727	URTWN_LOCK(sc);
4728	/* Restore limitations. */
4729	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
4730		urtwn_set_rx_bssid_all(sc, 0);
4731
4732	/* Set gain under link. */
4733	urtwn_set_gain(sc, 0x32);
4734	URTWN_UNLOCK(sc);
4735}
4736
4737static void
4738urtwn_set_channel(struct ieee80211com *ic)
4739{
4740	struct urtwn_softc *sc = ic->ic_softc;
4741	struct ieee80211_channel *c = ic->ic_curchan;
4742	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4743
4744	URTWN_LOCK(sc);
4745	if (vap->iv_state == IEEE80211_S_SCAN) {
4746		/* Make link LED blink during scan. */
4747		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
4748	}
4749	urtwn_set_chan(sc, c, NULL);
4750	sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
4751	sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
4752	sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
4753	sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
4754	URTWN_UNLOCK(sc);
4755}
4756
4757static int
4758urtwn_wme_update(struct ieee80211com *ic)
4759{
4760	const struct wmeParams *wmep =
4761	    ic->ic_wme.wme_chanParams.cap_wmeParams;
4762	struct urtwn_softc *sc = ic->ic_softc;
4763	uint8_t aifs, acm, slottime;
4764	int ac;
4765
4766	acm = 0;
4767	slottime = IEEE80211_GET_SLOTTIME(ic);
4768
4769	URTWN_LOCK(sc);
4770	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4771		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4772		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4773		urtwn_write_4(sc, wme2queue[ac].reg,
4774		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
4775		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
4776		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
4777		    SM(R92C_EDCA_PARAM_AIFS, aifs));
4778		if (ac != WME_AC_BE)
4779			acm |= wmep[ac].wmep_acm << ac;
4780	}
4781
4782	if (acm != 0)
4783		acm |= R92C_ACMHWCTRL_EN;
4784	urtwn_write_1(sc, R92C_ACMHWCTRL,
4785	    (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
4786	    acm);
4787
4788	URTWN_UNLOCK(sc);
4789
4790	return 0;
4791}
4792
4793static void
4794urtwn_update_slot(struct ieee80211com *ic)
4795{
4796	urtwn_cmd_sleepable(ic->ic_softc, NULL, 0, urtwn_update_slot_cb);
4797}
4798
4799static void
4800urtwn_update_slot_cb(struct urtwn_softc *sc, union sec_param *data)
4801{
4802	struct ieee80211com *ic = &sc->sc_ic;
4803	uint8_t slottime;
4804
4805	slottime = IEEE80211_GET_SLOTTIME(ic);
4806
4807	URTWN_DPRINTF(sc, URTWN_DEBUG_ANY, "%s: setting slot time to %uus\n",
4808	    __func__, slottime);
4809
4810	urtwn_write_1(sc, R92C_SLOT, slottime);
4811	urtwn_update_aifs(sc, slottime);
4812}
4813
4814static void
4815urtwn_update_aifs(struct urtwn_softc *sc, uint8_t slottime)
4816{
4817	const struct wmeParams *wmep =
4818	    sc->sc_ic.ic_wme.wme_chanParams.cap_wmeParams;
4819	uint8_t aifs, ac;
4820
4821	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4822		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4823		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4824		urtwn_write_1(sc, wme2queue[ac].reg, aifs);
4825        }
4826}
4827
4828static void
4829urtwn_set_promisc(struct urtwn_softc *sc)
4830{
4831	struct ieee80211com *ic = &sc->sc_ic;
4832	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4833	uint32_t rcr, mask1, mask2;
4834
4835	URTWN_ASSERT_LOCKED(sc);
4836
4837	if (vap->iv_opmode == IEEE80211_M_MONITOR)
4838		return;
4839
4840	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
4841	mask2 = R92C_RCR_APM;
4842
4843	if (vap->iv_state == IEEE80211_S_RUN) {
4844		switch (vap->iv_opmode) {
4845		case IEEE80211_M_STA:
4846			mask2 |= R92C_RCR_CBSSID_DATA;
4847			/* FALLTHROUGH */
4848		case IEEE80211_M_HOSTAP:
4849			mask2 |= R92C_RCR_CBSSID_BCN;
4850			break;
4851		case IEEE80211_M_IBSS:
4852			mask2 |= R92C_RCR_CBSSID_DATA;
4853			break;
4854		default:
4855			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4856			    __func__, vap->iv_opmode);
4857			return;
4858		}
4859	}
4860
4861	rcr = urtwn_read_4(sc, R92C_RCR);
4862	if (ic->ic_promisc == 0)
4863		rcr = (rcr & ~mask1) | mask2;
4864	else
4865		rcr = (rcr & ~mask2) | mask1;
4866	urtwn_write_4(sc, R92C_RCR, rcr);
4867}
4868
4869static void
4870urtwn_update_promisc(struct ieee80211com *ic)
4871{
4872	struct urtwn_softc *sc = ic->ic_softc;
4873
4874	URTWN_LOCK(sc);
4875	if (sc->sc_flags & URTWN_RUNNING)
4876		urtwn_set_promisc(sc);
4877	URTWN_UNLOCK(sc);
4878}
4879
4880static void
4881urtwn_update_mcast(struct ieee80211com *ic)
4882{
4883	/* XXX do nothing?  */
4884}
4885
4886static struct ieee80211_node *
4887urtwn_node_alloc(struct ieee80211vap *vap,
4888    const uint8_t mac[IEEE80211_ADDR_LEN])
4889{
4890	struct urtwn_node *un;
4891
4892	un = malloc(sizeof (struct urtwn_node), M_80211_NODE,
4893	    M_NOWAIT | M_ZERO);
4894
4895	if (un == NULL)
4896		return NULL;
4897
4898	un->id = URTWN_MACID_UNDEFINED;
4899
4900	return &un->ni;
4901}
4902
4903static void
4904urtwn_newassoc(struct ieee80211_node *ni, int isnew)
4905{
4906	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4907	struct urtwn_node *un = URTWN_NODE(ni);
4908	uint8_t id;
4909
4910	/* Only do this bit for R88E chips */
4911	if (! (sc->chip & URTWN_CHIP_88E))
4912		return;
4913
4914	if (!isnew)
4915		return;
4916
4917	URTWN_NT_LOCK(sc);
4918	for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
4919		if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
4920			un->id = id;
4921			sc->node_list[id] = ni;
4922			break;
4923		}
4924	}
4925	URTWN_NT_UNLOCK(sc);
4926
4927	if (id > URTWN_MACID_MAX(sc)) {
4928		device_printf(sc->sc_dev, "%s: node table is full\n",
4929		    __func__);
4930	}
4931}
4932
4933static void
4934urtwn_node_free(struct ieee80211_node *ni)
4935{
4936	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4937	struct urtwn_node *un = URTWN_NODE(ni);
4938
4939	URTWN_NT_LOCK(sc);
4940	if (un->id != URTWN_MACID_UNDEFINED)
4941		sc->node_list[un->id] = NULL;
4942	URTWN_NT_UNLOCK(sc);
4943
4944	sc->sc_node_free(ni);
4945}
4946
4947static void
4948urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
4949    struct ieee80211_channel *extc)
4950{
4951	struct ieee80211com *ic = &sc->sc_ic;
4952	uint32_t reg;
4953	u_int chan;
4954	int i;
4955
4956	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4957	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
4958		device_printf(sc->sc_dev,
4959		    "%s: invalid channel %x\n", __func__, chan);
4960		return;
4961	}
4962
4963	/* Set Tx power for this new channel. */
4964	urtwn_set_txpower(sc, c, extc);
4965
4966	for (i = 0; i < sc->nrxchains; i++) {
4967		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
4968		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
4969	}
4970#ifndef IEEE80211_NO_HT
4971	if (extc != NULL) {
4972		/* Is secondary channel below or above primary? */
4973		int prichlo = c->ic_freq < extc->ic_freq;
4974
4975		urtwn_write_1(sc, R92C_BWOPMODE,
4976		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
4977
4978		reg = urtwn_read_1(sc, R92C_RRSR + 2);
4979		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
4980		urtwn_write_1(sc, R92C_RRSR + 2, reg);
4981
4982		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
4983		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
4984		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
4985		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
4986
4987		/* Set CCK side band. */
4988		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
4989		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
4990		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
4991
4992		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
4993		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
4994		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
4995
4996		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
4997		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
4998		    ~R92C_FPGA0_ANAPARAM2_CBW20);
4999
5000		reg = urtwn_bb_read(sc, 0x818);
5001		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
5002		urtwn_bb_write(sc, 0x818, reg);
5003
5004		/* Select 40MHz bandwidth. */
5005		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5006		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
5007	} else
5008#endif
5009	{
5010		urtwn_write_1(sc, R92C_BWOPMODE,
5011		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
5012
5013		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
5014		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
5015		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
5016		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
5017
5018		if (!(sc->chip & URTWN_CHIP_88E)) {
5019			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5020			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
5021			    R92C_FPGA0_ANAPARAM2_CBW20);
5022		}
5023
5024		/* Select 20MHz bandwidth. */
5025		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5026		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
5027		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
5028		    R92C_RF_CHNLBW_BW20));
5029	}
5030}
5031
5032static void
5033urtwn_iq_calib(struct urtwn_softc *sc)
5034{
5035	/* TODO */
5036}
5037
5038static void
5039urtwn_lc_calib(struct urtwn_softc *sc)
5040{
5041	uint32_t rf_ac[2];
5042	uint8_t txmode;
5043	int i;
5044
5045	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
5046	if ((txmode & 0x70) != 0) {
5047		/* Disable all continuous Tx. */
5048		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
5049
5050		/* Set RF mode to standby mode. */
5051		for (i = 0; i < sc->nrxchains; i++) {
5052			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
5053			urtwn_rf_write(sc, i, R92C_RF_AC,
5054			    RW(rf_ac[i], R92C_RF_AC_MODE,
5055				R92C_RF_AC_MODE_STANDBY));
5056		}
5057	} else {
5058		/* Block all Tx queues. */
5059		urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
5060	}
5061	/* Start calibration. */
5062	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5063	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
5064
5065	/* Give calibration the time to complete. */
5066	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
5067
5068	/* Restore configuration. */
5069	if ((txmode & 0x70) != 0) {
5070		/* Restore Tx mode. */
5071		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
5072		/* Restore RF mode. */
5073		for (i = 0; i < sc->nrxchains; i++)
5074			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
5075	} else {
5076		/* Unblock all Tx queues. */
5077		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
5078	}
5079}
5080
5081static void
5082urtwn_temp_calib(struct urtwn_softc *sc)
5083{
5084	uint8_t temp;
5085
5086	URTWN_ASSERT_LOCKED(sc);
5087
5088	if (!(sc->sc_flags & URTWN_TEMP_MEASURED)) {
5089		/* Start measuring temperature. */
5090		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5091		    "%s: start measuring temperature\n", __func__);
5092		if (sc->chip & URTWN_CHIP_88E) {
5093			urtwn_rf_write(sc, 0, R88E_RF_T_METER,
5094			    R88E_RF_T_METER_START);
5095		} else {
5096			urtwn_rf_write(sc, 0, R92C_RF_T_METER,
5097			    R92C_RF_T_METER_START);
5098		}
5099		sc->sc_flags |= URTWN_TEMP_MEASURED;
5100		return;
5101	}
5102	sc->sc_flags &= ~URTWN_TEMP_MEASURED;
5103
5104	/* Read measured temperature. */
5105	if (sc->chip & URTWN_CHIP_88E) {
5106		temp = MS(urtwn_rf_read(sc, 0, R88E_RF_T_METER),
5107		    R88E_RF_T_METER_VAL);
5108	} else {
5109		temp = MS(urtwn_rf_read(sc, 0, R92C_RF_T_METER),
5110		    R92C_RF_T_METER_VAL);
5111	}
5112	if (temp == 0) {	/* Read failed, skip. */
5113		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5114		    "%s: temperature read failed, skipping\n", __func__);
5115		return;
5116	}
5117
5118	URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5119	    "%s: temperature: previous %u, current %u\n",
5120	    __func__, sc->thcal_lctemp, temp);
5121
5122	/*
5123	 * Redo LC calibration if temperature changed significantly since
5124	 * last calibration.
5125	 */
5126	if (sc->thcal_lctemp == 0) {
5127		/* First LC calibration is performed in urtwn_init(). */
5128		sc->thcal_lctemp = temp;
5129	} else if (abs(temp - sc->thcal_lctemp) > 1) {
5130		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5131		    "%s: LC calib triggered by temp: %u -> %u\n",
5132		    __func__, sc->thcal_lctemp, temp);
5133		urtwn_lc_calib(sc);
5134		/* Record temperature of last LC calibration. */
5135		sc->thcal_lctemp = temp;
5136	}
5137}
5138
5139static int
5140urtwn_init(struct urtwn_softc *sc)
5141{
5142	struct ieee80211com *ic = &sc->sc_ic;
5143	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5144	uint8_t macaddr[IEEE80211_ADDR_LEN];
5145	uint32_t reg;
5146	usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
5147	int error;
5148
5149	URTWN_LOCK(sc);
5150	if (sc->sc_flags & URTWN_RUNNING) {
5151		URTWN_UNLOCK(sc);
5152		return (0);
5153	}
5154
5155	/* Init firmware commands ring. */
5156	sc->fwcur = 0;
5157
5158	/* Allocate Tx/Rx buffers. */
5159	error = urtwn_alloc_rx_list(sc);
5160	if (error != 0)
5161		goto fail;
5162
5163	error = urtwn_alloc_tx_list(sc);
5164	if (error != 0)
5165		goto fail;
5166
5167	/* Power on adapter. */
5168	error = urtwn_power_on(sc);
5169	if (error != 0)
5170		goto fail;
5171
5172	/* Initialize DMA. */
5173	error = urtwn_dma_init(sc);
5174	if (error != 0)
5175		goto fail;
5176
5177	/* Set info size in Rx descriptors (in 64-bit words). */
5178	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
5179
5180	/* Init interrupts. */
5181	if (sc->chip & URTWN_CHIP_88E) {
5182		usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
5183		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5184			goto fail;
5185		usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
5186		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
5187		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5188			goto fail;
5189		usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
5190		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
5191		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5192			goto fail;
5193		usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5194		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5195		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
5196		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5197			goto fail;
5198	} else {
5199		usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
5200		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5201			goto fail;
5202		usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
5203		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5204			goto fail;
5205	}
5206
5207	/* Set MAC address. */
5208	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
5209	usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
5210	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5211		goto fail;
5212
5213	/* Set initial network type. */
5214	urtwn_set_mode(sc, R92C_MSR_INFRA);
5215
5216	/* Initialize Rx filter. */
5217	urtwn_rxfilter_init(sc);
5218
5219	/* Set response rate. */
5220	reg = urtwn_read_4(sc, R92C_RRSR);
5221	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
5222	urtwn_write_4(sc, R92C_RRSR, reg);
5223
5224	/* Set short/long retry limits. */
5225	urtwn_write_2(sc, R92C_RL,
5226	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
5227
5228	/* Initialize EDCA parameters. */
5229	urtwn_edca_init(sc);
5230
5231	/* Setup rate fallback. */
5232	if (!(sc->chip & URTWN_CHIP_88E)) {
5233		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
5234		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
5235		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
5236		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
5237	}
5238
5239	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
5240	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
5241	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
5242	/* Set ACK timeout. */
5243	urtwn_write_1(sc, R92C_ACKTO, 0x40);
5244
5245	/* Setup USB aggregation. */
5246	reg = urtwn_read_4(sc, R92C_TDECTRL);
5247	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
5248	urtwn_write_4(sc, R92C_TDECTRL, reg);
5249	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
5250	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
5251	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
5252	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
5253	if (sc->chip & URTWN_CHIP_88E)
5254		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
5255	else {
5256		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
5257		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5258		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5259		    R92C_USB_SPECIAL_OPTION_AGG_EN);
5260		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
5261		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
5262	}
5263
5264	/* Initialize beacon parameters. */
5265	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
5266	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
5267	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
5268	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
5269	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
5270
5271	if (!(sc->chip & URTWN_CHIP_88E)) {
5272		/* Setup AMPDU aggregation. */
5273		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
5274		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
5275		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
5276
5277		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
5278	}
5279
5280#ifndef URTWN_WITHOUT_UCODE
5281	/* Load 8051 microcode. */
5282	error = urtwn_load_firmware(sc);
5283	if (error == 0)
5284		sc->sc_flags |= URTWN_FW_LOADED;
5285#endif
5286
5287	/* Initialize MAC/BB/RF blocks. */
5288	error = urtwn_mac_init(sc);
5289	if (error != 0) {
5290		device_printf(sc->sc_dev,
5291		    "%s: error while initializing MAC block\n", __func__);
5292		goto fail;
5293	}
5294	urtwn_bb_init(sc);
5295	urtwn_rf_init(sc);
5296
5297	/* Reinitialize Rx filter (D3845 is not committed yet). */
5298	urtwn_rxfilter_init(sc);
5299
5300	if (sc->chip & URTWN_CHIP_88E) {
5301		urtwn_write_2(sc, R92C_CR,
5302		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
5303		    R92C_CR_MACRXEN);
5304	}
5305
5306	/* Turn CCK and OFDM blocks on. */
5307	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5308	reg |= R92C_RFMOD_CCK_EN;
5309	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5310	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5311		goto fail;
5312	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5313	reg |= R92C_RFMOD_OFDM_EN;
5314	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5315	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5316		goto fail;
5317
5318	/* Clear per-station keys table. */
5319	urtwn_cam_init(sc);
5320
5321	/* Enable decryption / encryption. */
5322	urtwn_write_2(sc, R92C_SECCFG,
5323	    R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
5324	    R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXDEC_ENA |
5325	    R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
5326
5327	/*
5328	 * Install static keys (if any).
5329	 * Must be called after urtwn_cam_init().
5330	 */
5331	ieee80211_runtask(ic, &sc->cmdq_task);
5332
5333	/* Enable hardware sequence numbering. */
5334	urtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
5335
5336	/* Enable per-packet TX report. */
5337	if (sc->chip & URTWN_CHIP_88E) {
5338		urtwn_write_1(sc, R88E_TX_RPT_CTRL,
5339		    urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
5340	}
5341
5342	/* Perform LO and IQ calibrations. */
5343	urtwn_iq_calib(sc);
5344	/* Perform LC calibration. */
5345	urtwn_lc_calib(sc);
5346
5347	/* Fix USB interference issue. */
5348	if (!(sc->chip & URTWN_CHIP_88E)) {
5349		urtwn_write_1(sc, 0xfe40, 0xe0);
5350		urtwn_write_1(sc, 0xfe41, 0x8d);
5351		urtwn_write_1(sc, 0xfe42, 0x80);
5352
5353		urtwn_pa_bias_init(sc);
5354	}
5355
5356	/* Initialize GPIO setting. */
5357	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
5358	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
5359
5360	/* Fix for lower temperature. */
5361	if (!(sc->chip & URTWN_CHIP_88E))
5362		urtwn_write_1(sc, 0x15, 0xe9);
5363
5364	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
5365
5366	sc->sc_flags |= URTWN_RUNNING;
5367
5368	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5369fail:
5370	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5371		error = EIO;
5372
5373	URTWN_UNLOCK(sc);
5374
5375	return (error);
5376}
5377
5378static void
5379urtwn_stop(struct urtwn_softc *sc)
5380{
5381
5382	URTWN_LOCK(sc);
5383	if (!(sc->sc_flags & URTWN_RUNNING)) {
5384		URTWN_UNLOCK(sc);
5385		return;
5386	}
5387
5388	sc->sc_flags &= ~(URTWN_RUNNING | URTWN_FW_LOADED |
5389	    URTWN_TEMP_MEASURED);
5390	sc->thcal_lctemp = 0;
5391	callout_stop(&sc->sc_watchdog_ch);
5392
5393	urtwn_abort_xfers(sc);
5394	urtwn_drain_mbufq(sc);
5395	urtwn_power_off(sc);
5396	URTWN_UNLOCK(sc);
5397}
5398
5399static void
5400urtwn_abort_xfers(struct urtwn_softc *sc)
5401{
5402	int i;
5403
5404	URTWN_ASSERT_LOCKED(sc);
5405
5406	/* abort any pending transfers */
5407	for (i = 0; i < URTWN_N_TRANSFER; i++)
5408		usbd_transfer_stop(sc->sc_xfer[i]);
5409}
5410
5411static int
5412urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5413    const struct ieee80211_bpf_params *params)
5414{
5415	struct ieee80211com *ic = ni->ni_ic;
5416	struct urtwn_softc *sc = ic->ic_softc;
5417	struct urtwn_data *bf;
5418	int error;
5419
5420	URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
5421	    __func__,
5422	    m);
5423
5424	/* prevent management frames from being sent if we're not ready */
5425	URTWN_LOCK(sc);
5426	if (!(sc->sc_flags & URTWN_RUNNING)) {
5427		error = ENETDOWN;
5428		goto end;
5429	}
5430
5431	bf = urtwn_getbuf(sc);
5432	if (bf == NULL) {
5433		error = ENOBUFS;
5434		goto end;
5435	}
5436
5437	if (params == NULL) {
5438		/*
5439		 * Legacy path; interpret frame contents to decide
5440		 * precisely how to send the frame.
5441		 */
5442		error = urtwn_tx_data(sc, ni, m, bf);
5443	} else {
5444		/*
5445		 * Caller supplied explicit parameters to use in
5446		 * sending the frame.
5447		 */
5448		error = urtwn_tx_raw(sc, ni, m, bf, params);
5449	}
5450	if (error != 0) {
5451		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
5452		goto end;
5453	}
5454
5455	sc->sc_txtimer = 5;
5456	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5457
5458end:
5459	if (error != 0)
5460		m_freem(m);
5461
5462	URTWN_UNLOCK(sc);
5463
5464	return (error);
5465}
5466
5467static void
5468urtwn_ms_delay(struct urtwn_softc *sc)
5469{
5470	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
5471}
5472
5473static device_method_t urtwn_methods[] = {
5474	/* Device interface */
5475	DEVMETHOD(device_probe,		urtwn_match),
5476	DEVMETHOD(device_attach,	urtwn_attach),
5477	DEVMETHOD(device_detach,	urtwn_detach),
5478
5479	DEVMETHOD_END
5480};
5481
5482static driver_t urtwn_driver = {
5483	"urtwn",
5484	urtwn_methods,
5485	sizeof(struct urtwn_softc)
5486};
5487
5488static devclass_t urtwn_devclass;
5489
5490DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
5491MODULE_DEPEND(urtwn, usb, 1, 1, 1);
5492MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
5493#ifndef URTWN_WITHOUT_UCODE
5494MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
5495#endif
5496MODULE_VERSION(urtwn, 1);
5497USB_PNP_HOST_INFO(urtwn_devs);
5498