if_urtwn.c revision 299965
1/*	$OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
6 * Copyright (c) 2015 Andriy Voskoboinyk <avos@FreeBSD.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/dev/urtwn/if_urtwn.c 299965 2016-05-16 19:10:59Z avos $");
23
24/*
25 * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
26 */
27
28#include "opt_wlan.h"
29#include "opt_urtwn.h"
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/lock.h>
35#include <sys/mutex.h>
36#include <sys/condvar.h>
37#include <sys/mbuf.h>
38#include <sys/kernel.h>
39#include <sys/socket.h>
40#include <sys/systm.h>
41#include <sys/malloc.h>
42#include <sys/module.h>
43#include <sys/bus.h>
44#include <sys/endian.h>
45#include <sys/linker.h>
46#include <sys/firmware.h>
47#include <sys/kdb.h>
48
49#include <machine/bus.h>
50#include <machine/resource.h>
51#include <sys/rman.h>
52
53#include <net/bpf.h>
54#include <net/if.h>
55#include <net/if_var.h>
56#include <net/if_arp.h>
57#include <net/ethernet.h>
58#include <net/if_dl.h>
59#include <net/if_media.h>
60#include <net/if_types.h>
61
62#include <netinet/in.h>
63#include <netinet/in_systm.h>
64#include <netinet/in_var.h>
65#include <netinet/if_ether.h>
66#include <netinet/ip.h>
67
68#include <net80211/ieee80211_var.h>
69#include <net80211/ieee80211_regdomain.h>
70#include <net80211/ieee80211_radiotap.h>
71#include <net80211/ieee80211_ratectl.h>
72#ifdef	IEEE80211_SUPPORT_SUPERG
73#include <net80211/ieee80211_superg.h>
74#endif
75
76#include <dev/usb/usb.h>
77#include <dev/usb/usbdi.h>
78#include <dev/usb/usb_device.h>
79#include "usbdevs.h"
80
81#include <dev/usb/usb_debug.h>
82
83#include <dev/urtwn/if_urtwnreg.h>
84#include <dev/urtwn/if_urtwnvar.h>
85
86#ifdef USB_DEBUG
87enum {
88	URTWN_DEBUG_XMIT	= 0x00000001,	/* basic xmit operation */
89	URTWN_DEBUG_RECV	= 0x00000002,	/* basic recv operation */
90	URTWN_DEBUG_STATE	= 0x00000004,	/* 802.11 state transitions */
91	URTWN_DEBUG_RA		= 0x00000008,	/* f/w rate adaptation setup */
92	URTWN_DEBUG_USB		= 0x00000010,	/* usb requests */
93	URTWN_DEBUG_FIRMWARE	= 0x00000020,	/* firmware(9) loading debug */
94	URTWN_DEBUG_BEACON	= 0x00000040,	/* beacon handling */
95	URTWN_DEBUG_INTR	= 0x00000080,	/* ISR */
96	URTWN_DEBUG_TEMP	= 0x00000100,	/* temperature calibration */
97	URTWN_DEBUG_ROM		= 0x00000200,	/* various ROM info */
98	URTWN_DEBUG_KEY		= 0x00000400,	/* crypto keys management */
99	URTWN_DEBUG_TXPWR	= 0x00000800,	/* dump Tx power values */
100	URTWN_DEBUG_RSSI	= 0x00001000,	/* dump RSSI lookups */
101	URTWN_DEBUG_ANY		= 0xffffffff
102};
103
104#define URTWN_DPRINTF(_sc, _m, ...) do {			\
105	if ((_sc)->sc_debug & (_m))				\
106		device_printf((_sc)->sc_dev, __VA_ARGS__);	\
107} while(0)
108
109#else
110#define URTWN_DPRINTF(_sc, _m, ...)	do { (void) sc; } while (0)
111#endif
112
113#define	IEEE80211_HAS_ADDR4(wh)	IEEE80211_IS_DSTODS(wh)
114
115static int urtwn_enable_11n = 1;
116TUNABLE_INT("hw.usb.urtwn.enable_11n", &urtwn_enable_11n);
117
118/* various supported device vendors/products */
119static const STRUCT_USB_HOST_ID urtwn_devs[] = {
120#define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
121#define	URTWN_RTL8188E_DEV(v,p)	\
122	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
123#define URTWN_RTL8188E  1
124	URTWN_DEV(ABOCOM,	RTL8188CU_1),
125	URTWN_DEV(ABOCOM,	RTL8188CU_2),
126	URTWN_DEV(ABOCOM,	RTL8192CU),
127	URTWN_DEV(ASUS,		RTL8192CU),
128	URTWN_DEV(ASUS,		USBN10NANO),
129	URTWN_DEV(AZUREWAVE,	RTL8188CE_1),
130	URTWN_DEV(AZUREWAVE,	RTL8188CE_2),
131	URTWN_DEV(AZUREWAVE,	RTL8188CU),
132	URTWN_DEV(BELKIN,	F7D2102),
133	URTWN_DEV(BELKIN,	RTL8188CU),
134	URTWN_DEV(BELKIN,	RTL8192CU),
135	URTWN_DEV(CHICONY,	RTL8188CUS_1),
136	URTWN_DEV(CHICONY,	RTL8188CUS_2),
137	URTWN_DEV(CHICONY,	RTL8188CUS_3),
138	URTWN_DEV(CHICONY,	RTL8188CUS_4),
139	URTWN_DEV(CHICONY,	RTL8188CUS_5),
140	URTWN_DEV(COREGA,	RTL8192CU),
141	URTWN_DEV(DLINK,	RTL8188CU),
142	URTWN_DEV(DLINK,	RTL8192CU_1),
143	URTWN_DEV(DLINK,	RTL8192CU_2),
144	URTWN_DEV(DLINK,	RTL8192CU_3),
145	URTWN_DEV(DLINK,	DWA131B),
146	URTWN_DEV(EDIMAX,	EW7811UN),
147	URTWN_DEV(EDIMAX,	RTL8192CU),
148	URTWN_DEV(FEIXUN,	RTL8188CU),
149	URTWN_DEV(FEIXUN,	RTL8192CU),
150	URTWN_DEV(GUILLEMOT,	HWNUP150),
151	URTWN_DEV(HAWKING,	RTL8192CU),
152	URTWN_DEV(HP3,		RTL8188CU),
153	URTWN_DEV(NETGEAR,	WNA1000M),
154	URTWN_DEV(NETGEAR,	RTL8192CU),
155	URTWN_DEV(NETGEAR4,	RTL8188CU),
156	URTWN_DEV(NOVATECH,	RTL8188CU),
157	URTWN_DEV(PLANEX2,	RTL8188CU_1),
158	URTWN_DEV(PLANEX2,	RTL8188CU_2),
159	URTWN_DEV(PLANEX2,	RTL8188CU_3),
160	URTWN_DEV(PLANEX2,	RTL8188CU_4),
161	URTWN_DEV(PLANEX2,	RTL8188CUS),
162	URTWN_DEV(PLANEX2,	RTL8192CU),
163	URTWN_DEV(REALTEK,	RTL8188CE_0),
164	URTWN_DEV(REALTEK,	RTL8188CE_1),
165	URTWN_DEV(REALTEK,	RTL8188CTV),
166	URTWN_DEV(REALTEK,	RTL8188CU_0),
167	URTWN_DEV(REALTEK,	RTL8188CU_1),
168	URTWN_DEV(REALTEK,	RTL8188CU_2),
169	URTWN_DEV(REALTEK,	RTL8188CU_3),
170	URTWN_DEV(REALTEK,	RTL8188CU_COMBO),
171	URTWN_DEV(REALTEK,	RTL8188CUS),
172	URTWN_DEV(REALTEK,	RTL8188RU_1),
173	URTWN_DEV(REALTEK,	RTL8188RU_2),
174	URTWN_DEV(REALTEK,	RTL8188RU_3),
175	URTWN_DEV(REALTEK,	RTL8191CU),
176	URTWN_DEV(REALTEK,	RTL8192CE),
177	URTWN_DEV(REALTEK,	RTL8192CU),
178	URTWN_DEV(SITECOMEU,	RTL8188CU_1),
179	URTWN_DEV(SITECOMEU,	RTL8188CU_2),
180	URTWN_DEV(SITECOMEU,	RTL8192CU),
181	URTWN_DEV(TRENDNET,	RTL8188CU),
182	URTWN_DEV(TRENDNET,	RTL8192CU),
183	URTWN_DEV(ZYXEL,	RTL8192CU),
184	/* URTWN_RTL8188E */
185	URTWN_RTL8188E_DEV(ABOCOM,	RTL8188EU),
186	URTWN_RTL8188E_DEV(DLINK,	DWA123D1),
187	URTWN_RTL8188E_DEV(DLINK,	DWA125D1),
188	URTWN_RTL8188E_DEV(ELECOM,	WDC150SU2M),
189	URTWN_RTL8188E_DEV(REALTEK,	RTL8188ETV),
190	URTWN_RTL8188E_DEV(REALTEK,	RTL8188EU),
191#undef URTWN_RTL8188E_DEV
192#undef URTWN_DEV
193};
194
195static device_probe_t	urtwn_match;
196static device_attach_t	urtwn_attach;
197static device_detach_t	urtwn_detach;
198
199static usb_callback_t   urtwn_bulk_tx_callback;
200static usb_callback_t	urtwn_bulk_rx_callback;
201
202static void		urtwn_sysctlattach(struct urtwn_softc *);
203static void		urtwn_drain_mbufq(struct urtwn_softc *);
204static usb_error_t	urtwn_do_request(struct urtwn_softc *,
205			    struct usb_device_request *, void *);
206static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
207		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
208                    const uint8_t [IEEE80211_ADDR_LEN],
209                    const uint8_t [IEEE80211_ADDR_LEN]);
210static void		urtwn_vap_delete(struct ieee80211vap *);
211static struct mbuf *	urtwn_rx_copy_to_mbuf(struct urtwn_softc *,
212			    struct r92c_rx_stat *, int);
213static struct mbuf *	urtwn_report_intr(struct usb_xfer *,
214			    struct urtwn_data *);
215static struct mbuf *	urtwn_rxeof(struct urtwn_softc *, uint8_t *, int);
216static void		urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
217			    void *);
218static struct ieee80211_node *urtwn_rx_frame(struct urtwn_softc *,
219			    struct mbuf *, int8_t *);
220static void		urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
221			    int);
222static int		urtwn_alloc_list(struct urtwn_softc *,
223			    struct urtwn_data[], int, int);
224static int		urtwn_alloc_rx_list(struct urtwn_softc *);
225static int		urtwn_alloc_tx_list(struct urtwn_softc *);
226static void		urtwn_free_list(struct urtwn_softc *,
227			    struct urtwn_data data[], int);
228static void		urtwn_free_rx_list(struct urtwn_softc *);
229static void		urtwn_free_tx_list(struct urtwn_softc *);
230static struct urtwn_data *	_urtwn_getbuf(struct urtwn_softc *);
231static struct urtwn_data *	urtwn_getbuf(struct urtwn_softc *);
232static usb_error_t	urtwn_write_region_1(struct urtwn_softc *, uint16_t,
233			    uint8_t *, int);
234static usb_error_t	urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
235static usb_error_t	urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
236static usb_error_t	urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
237static usb_error_t	urtwn_read_region_1(struct urtwn_softc *, uint16_t,
238			    uint8_t *, int);
239static uint8_t		urtwn_read_1(struct urtwn_softc *, uint16_t);
240static uint16_t		urtwn_read_2(struct urtwn_softc *, uint16_t);
241static uint32_t		urtwn_read_4(struct urtwn_softc *, uint16_t);
242static int		urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
243			    const void *, int);
244static void		urtwn_cmdq_cb(void *, int);
245static int		urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
246			    size_t, CMD_FUNC_PROTO);
247static void		urtwn_r92c_rf_write(struct urtwn_softc *, int,
248			    uint8_t, uint32_t);
249static void		urtwn_r88e_rf_write(struct urtwn_softc *, int,
250			    uint8_t, uint32_t);
251static uint32_t		urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
252static int		urtwn_llt_write(struct urtwn_softc *, uint32_t,
253			    uint32_t);
254static int		urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
255static int		urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
256			    uint8_t, uint8_t);
257#ifdef USB_DEBUG
258static void		urtwn_dump_rom_contents(struct urtwn_softc *,
259			    uint8_t *, uint16_t);
260#endif
261static int		urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
262			    uint16_t);
263static int		urtwn_efuse_switch_power(struct urtwn_softc *);
264static int		urtwn_read_chipid(struct urtwn_softc *);
265static int		urtwn_read_rom(struct urtwn_softc *);
266static int		urtwn_r88e_read_rom(struct urtwn_softc *);
267static int		urtwn_ra_init(struct urtwn_softc *);
268static void		urtwn_init_beacon(struct urtwn_softc *,
269			    struct urtwn_vap *);
270static int		urtwn_setup_beacon(struct urtwn_softc *,
271			    struct ieee80211_node *);
272static void		urtwn_update_beacon(struct ieee80211vap *, int);
273static int		urtwn_tx_beacon(struct urtwn_softc *sc,
274			    struct urtwn_vap *);
275static int		urtwn_key_alloc(struct ieee80211vap *,
276			    struct ieee80211_key *, ieee80211_keyix *,
277			    ieee80211_keyix *);
278static void		urtwn_key_set_cb(struct urtwn_softc *,
279			    union sec_param *);
280static void		urtwn_key_del_cb(struct urtwn_softc *,
281			    union sec_param *);
282static int		urtwn_key_set(struct ieee80211vap *,
283			    const struct ieee80211_key *);
284static int		urtwn_key_delete(struct ieee80211vap *,
285			    const struct ieee80211_key *);
286static void		urtwn_tsf_task_adhoc(void *, int);
287static void		urtwn_tsf_sync_enable(struct urtwn_softc *,
288			    struct ieee80211vap *);
289static void		urtwn_get_tsf(struct urtwn_softc *, uint64_t *);
290static void		urtwn_set_led(struct urtwn_softc *, int, int);
291static void		urtwn_set_mode(struct urtwn_softc *, uint8_t);
292static void		urtwn_ibss_recv_mgmt(struct ieee80211_node *,
293			    struct mbuf *, int,
294			    const struct ieee80211_rx_stats *, int, int);
295static int		urtwn_newstate(struct ieee80211vap *,
296			    enum ieee80211_state, int);
297static void		urtwn_calib_to(void *);
298static void		urtwn_calib_cb(struct urtwn_softc *,
299			    union sec_param *);
300static void		urtwn_watchdog(void *);
301static void		urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
302static int8_t		urtwn_get_rssi(struct urtwn_softc *, int, void *);
303static int8_t		urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
304static int		urtwn_tx_data(struct urtwn_softc *,
305			    struct ieee80211_node *, struct mbuf *,
306			    struct urtwn_data *);
307static int		urtwn_tx_raw(struct urtwn_softc *,
308			    struct ieee80211_node *, struct mbuf *,
309			    struct urtwn_data *,
310			    const struct ieee80211_bpf_params *);
311static void		urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
312			    uint8_t, struct urtwn_data *);
313static int		urtwn_transmit(struct ieee80211com *, struct mbuf *);
314static void		urtwn_start(struct urtwn_softc *);
315static void		urtwn_parent(struct ieee80211com *);
316static int		urtwn_r92c_power_on(struct urtwn_softc *);
317static int		urtwn_r88e_power_on(struct urtwn_softc *);
318static void		urtwn_r92c_power_off(struct urtwn_softc *);
319static void		urtwn_r88e_power_off(struct urtwn_softc *);
320static int		urtwn_llt_init(struct urtwn_softc *);
321#ifndef URTWN_WITHOUT_UCODE
322static void		urtwn_fw_reset(struct urtwn_softc *);
323static void		urtwn_r88e_fw_reset(struct urtwn_softc *);
324static int		urtwn_fw_loadpage(struct urtwn_softc *, int,
325			    const uint8_t *, int);
326static int		urtwn_load_firmware(struct urtwn_softc *);
327#endif
328static int		urtwn_dma_init(struct urtwn_softc *);
329static int		urtwn_mac_init(struct urtwn_softc *);
330static void		urtwn_bb_init(struct urtwn_softc *);
331static void		urtwn_rf_init(struct urtwn_softc *);
332static void		urtwn_cam_init(struct urtwn_softc *);
333static int		urtwn_cam_write(struct urtwn_softc *, uint32_t,
334			    uint32_t);
335static void		urtwn_pa_bias_init(struct urtwn_softc *);
336static void		urtwn_rxfilter_init(struct urtwn_softc *);
337static void		urtwn_edca_init(struct urtwn_softc *);
338static void		urtwn_write_txpower(struct urtwn_softc *, int,
339			    uint16_t[]);
340static void		urtwn_get_txpower(struct urtwn_softc *, int,
341		      	    struct ieee80211_channel *,
342			    struct ieee80211_channel *, uint16_t[]);
343static void		urtwn_r88e_get_txpower(struct urtwn_softc *, int,
344		      	    struct ieee80211_channel *,
345			    struct ieee80211_channel *, uint16_t[]);
346static void		urtwn_set_txpower(struct urtwn_softc *,
347		    	    struct ieee80211_channel *,
348			    struct ieee80211_channel *);
349static void		urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
350static void		urtwn_set_gain(struct urtwn_softc *, uint8_t);
351static void		urtwn_scan_start(struct ieee80211com *);
352static void		urtwn_scan_end(struct ieee80211com *);
353static void		urtwn_set_channel(struct ieee80211com *);
354static int		urtwn_wme_update(struct ieee80211com *);
355static void		urtwn_update_slot(struct ieee80211com *);
356static void		urtwn_update_slot_cb(struct urtwn_softc *,
357			    union sec_param *);
358static void		urtwn_update_aifs(struct urtwn_softc *, uint8_t);
359static uint8_t		urtwn_get_multi_pos(const uint8_t[]);
360static void		urtwn_set_multi(struct urtwn_softc *);
361static void		urtwn_set_promisc(struct urtwn_softc *);
362static void		urtwn_update_promisc(struct ieee80211com *);
363static void		urtwn_update_mcast(struct ieee80211com *);
364static struct ieee80211_node *urtwn_node_alloc(struct ieee80211vap *,
365			    const uint8_t mac[IEEE80211_ADDR_LEN]);
366static void		urtwn_newassoc(struct ieee80211_node *, int);
367static void		urtwn_node_free(struct ieee80211_node *);
368static void		urtwn_set_chan(struct urtwn_softc *,
369		    	    struct ieee80211_channel *,
370			    struct ieee80211_channel *);
371static void		urtwn_iq_calib(struct urtwn_softc *);
372static void		urtwn_lc_calib(struct urtwn_softc *);
373static void		urtwn_temp_calib(struct urtwn_softc *);
374static int		urtwn_init(struct urtwn_softc *);
375static void		urtwn_stop(struct urtwn_softc *);
376static void		urtwn_abort_xfers(struct urtwn_softc *);
377static int		urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
378			    const struct ieee80211_bpf_params *);
379static void		urtwn_ms_delay(struct urtwn_softc *);
380
381/* Aliases. */
382#define	urtwn_bb_write	urtwn_write_4
383#define urtwn_bb_read	urtwn_read_4
384
385static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
386	[URTWN_BULK_RX] = {
387		.type = UE_BULK,
388		.endpoint = UE_ADDR_ANY,
389		.direction = UE_DIR_IN,
390		.bufsize = URTWN_RXBUFSZ,
391		.flags = {
392			.pipe_bof = 1,
393			.short_xfer_ok = 1
394		},
395		.callback = urtwn_bulk_rx_callback,
396	},
397	[URTWN_BULK_TX_BE] = {
398		.type = UE_BULK,
399		.endpoint = 0x03,
400		.direction = UE_DIR_OUT,
401		.bufsize = URTWN_TXBUFSZ,
402		.flags = {
403			.ext_buffer = 1,
404			.pipe_bof = 1,
405			.force_short_xfer = 1
406		},
407		.callback = urtwn_bulk_tx_callback,
408		.timeout = URTWN_TX_TIMEOUT,	/* ms */
409	},
410	[URTWN_BULK_TX_BK] = {
411		.type = UE_BULK,
412		.endpoint = 0x03,
413		.direction = UE_DIR_OUT,
414		.bufsize = URTWN_TXBUFSZ,
415		.flags = {
416			.ext_buffer = 1,
417			.pipe_bof = 1,
418			.force_short_xfer = 1,
419		},
420		.callback = urtwn_bulk_tx_callback,
421		.timeout = URTWN_TX_TIMEOUT,	/* ms */
422	},
423	[URTWN_BULK_TX_VI] = {
424		.type = UE_BULK,
425		.endpoint = 0x02,
426		.direction = UE_DIR_OUT,
427		.bufsize = URTWN_TXBUFSZ,
428		.flags = {
429			.ext_buffer = 1,
430			.pipe_bof = 1,
431			.force_short_xfer = 1
432		},
433		.callback = urtwn_bulk_tx_callback,
434		.timeout = URTWN_TX_TIMEOUT,	/* ms */
435	},
436	[URTWN_BULK_TX_VO] = {
437		.type = UE_BULK,
438		.endpoint = 0x02,
439		.direction = UE_DIR_OUT,
440		.bufsize = URTWN_TXBUFSZ,
441		.flags = {
442			.ext_buffer = 1,
443			.pipe_bof = 1,
444			.force_short_xfer = 1
445		},
446		.callback = urtwn_bulk_tx_callback,
447		.timeout = URTWN_TX_TIMEOUT,	/* ms */
448	},
449};
450
451static const struct wme_to_queue {
452	uint16_t reg;
453	uint8_t qid;
454} wme2queue[WME_NUM_AC] = {
455	{ R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
456	{ R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
457	{ R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
458	{ R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
459};
460
461static int
462urtwn_match(device_t self)
463{
464	struct usb_attach_arg *uaa = device_get_ivars(self);
465
466	if (uaa->usb_mode != USB_MODE_HOST)
467		return (ENXIO);
468	if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
469		return (ENXIO);
470	if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
471		return (ENXIO);
472
473	return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
474}
475
476static void
477urtwn_update_chw(struct ieee80211com *ic)
478{
479}
480
481static int
482urtwn_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
483{
484
485	/* We're driving this ourselves (eventually); don't involve net80211 */
486	return (0);
487}
488
489static int
490urtwn_attach(device_t self)
491{
492	struct usb_attach_arg *uaa = device_get_ivars(self);
493	struct urtwn_softc *sc = device_get_softc(self);
494	struct ieee80211com *ic = &sc->sc_ic;
495	uint8_t bands[IEEE80211_MODE_BYTES];
496	int error;
497
498	device_set_usb_desc(self);
499	sc->sc_udev = uaa->device;
500	sc->sc_dev = self;
501	if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
502		sc->chip |= URTWN_CHIP_88E;
503
504#ifdef USB_DEBUG
505	int debug;
506	if (resource_int_value(device_get_name(sc->sc_dev),
507	    device_get_unit(sc->sc_dev), "debug", &debug) == 0)
508		sc->sc_debug = debug;
509#endif
510
511	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
512	    MTX_NETWORK_LOCK, MTX_DEF);
513	URTWN_CMDQ_LOCK_INIT(sc);
514	URTWN_NT_LOCK_INIT(sc);
515	callout_init(&sc->sc_calib_to, 0);
516	callout_init(&sc->sc_watchdog_ch, 0);
517	mbufq_init(&sc->sc_snd, ifqmaxlen);
518
519	sc->sc_iface_index = URTWN_IFACE_INDEX;
520	error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
521	    sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
522	if (error) {
523		device_printf(self, "could not allocate USB transfers, "
524		    "err=%s\n", usbd_errstr(error));
525		goto detach;
526	}
527
528	URTWN_LOCK(sc);
529
530	error = urtwn_read_chipid(sc);
531	if (error) {
532		device_printf(sc->sc_dev, "unsupported test chip\n");
533		URTWN_UNLOCK(sc);
534		goto detach;
535	}
536
537	/* Determine number of Tx/Rx chains. */
538	if (sc->chip & URTWN_CHIP_92C) {
539		sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
540		sc->nrxchains = 2;
541	} else {
542		sc->ntxchains = 1;
543		sc->nrxchains = 1;
544	}
545
546	if (sc->chip & URTWN_CHIP_88E)
547		error = urtwn_r88e_read_rom(sc);
548	else
549		error = urtwn_read_rom(sc);
550	if (error != 0) {
551		device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
552		    __func__, error);
553		URTWN_UNLOCK(sc);
554		goto detach;
555	}
556
557	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
558	    (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
559	    (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
560	    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
561	    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
562	    "8188CUS", sc->ntxchains, sc->nrxchains);
563
564	URTWN_UNLOCK(sc);
565
566	ic->ic_softc = sc;
567	ic->ic_name = device_get_nameunit(self);
568	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
569	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
570
571	/* set device capabilities */
572	ic->ic_caps =
573		  IEEE80211_C_STA		/* station mode */
574		| IEEE80211_C_MONITOR		/* monitor mode */
575		| IEEE80211_C_IBSS		/* adhoc mode */
576		| IEEE80211_C_HOSTAP		/* hostap mode */
577		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
578		| IEEE80211_C_SHSLOT		/* short slot time supported */
579#if 0
580		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
581#endif
582		| IEEE80211_C_WPA		/* 802.11i */
583		| IEEE80211_C_WME		/* 802.11e */
584		| IEEE80211_C_SWAMSDUTX		/* Do software A-MSDU TX */
585		| IEEE80211_C_FF		/* Atheros fast-frames */
586		;
587
588	ic->ic_cryptocaps =
589	    IEEE80211_CRYPTO_WEP |
590	    IEEE80211_CRYPTO_TKIP |
591	    IEEE80211_CRYPTO_AES_CCM;
592
593	/* Assume they're all 11n capable for now */
594	if (urtwn_enable_11n) {
595		device_printf(self, "enabling 11n\n");
596		ic->ic_htcaps = IEEE80211_HTC_HT |
597#if 0
598		    IEEE80211_HTC_AMPDU |
599#endif
600		    IEEE80211_HTC_AMSDU |
601		    IEEE80211_HTCAP_MAXAMSDU_3839 |
602		    IEEE80211_HTCAP_SMPS_OFF;
603		/* no HT40 just yet */
604		// ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
605
606		/* XXX TODO: verify chains versus streams for urtwn */
607		ic->ic_txstream = sc->ntxchains;
608		ic->ic_rxstream = sc->nrxchains;
609	}
610
611	memset(bands, 0, sizeof(bands));
612	setbit(bands, IEEE80211_MODE_11B);
613	setbit(bands, IEEE80211_MODE_11G);
614	if (urtwn_enable_11n)
615		setbit(bands, IEEE80211_MODE_11NG);
616	ieee80211_init_channels(ic, NULL, bands);
617
618	ieee80211_ifattach(ic);
619	ic->ic_raw_xmit = urtwn_raw_xmit;
620	ic->ic_scan_start = urtwn_scan_start;
621	ic->ic_scan_end = urtwn_scan_end;
622	ic->ic_set_channel = urtwn_set_channel;
623	ic->ic_transmit = urtwn_transmit;
624	ic->ic_parent = urtwn_parent;
625	ic->ic_vap_create = urtwn_vap_create;
626	ic->ic_vap_delete = urtwn_vap_delete;
627	ic->ic_wme.wme_update = urtwn_wme_update;
628	ic->ic_updateslot = urtwn_update_slot;
629	ic->ic_update_promisc = urtwn_update_promisc;
630	ic->ic_update_mcast = urtwn_update_mcast;
631	if (sc->chip & URTWN_CHIP_88E) {
632		ic->ic_node_alloc = urtwn_node_alloc;
633		ic->ic_newassoc = urtwn_newassoc;
634		sc->sc_node_free = ic->ic_node_free;
635		ic->ic_node_free = urtwn_node_free;
636	}
637	ic->ic_update_chw = urtwn_update_chw;
638	ic->ic_ampdu_enable = urtwn_ampdu_enable;
639
640	ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
641	    sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
642	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
643	    URTWN_RX_RADIOTAP_PRESENT);
644
645	TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
646
647	urtwn_sysctlattach(sc);
648
649	if (bootverbose)
650		ieee80211_announce(ic);
651
652	return (0);
653
654detach:
655	urtwn_detach(self);
656	return (ENXIO);			/* failure */
657}
658
659static void
660urtwn_sysctlattach(struct urtwn_softc *sc)
661{
662#ifdef USB_DEBUG
663	struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
664	struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
665
666	SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
667	    "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
668	    "control debugging printfs");
669#endif
670}
671
672static int
673urtwn_detach(device_t self)
674{
675	struct urtwn_softc *sc = device_get_softc(self);
676	struct ieee80211com *ic = &sc->sc_ic;
677	unsigned int x;
678
679	/* Prevent further ioctls. */
680	URTWN_LOCK(sc);
681	sc->sc_flags |= URTWN_DETACHED;
682	URTWN_UNLOCK(sc);
683
684	urtwn_stop(sc);
685
686	callout_drain(&sc->sc_watchdog_ch);
687	callout_drain(&sc->sc_calib_to);
688
689	/* stop all USB transfers */
690	usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
691
692	/* Prevent further allocations from RX/TX data lists. */
693	URTWN_LOCK(sc);
694	STAILQ_INIT(&sc->sc_tx_active);
695	STAILQ_INIT(&sc->sc_tx_inactive);
696	STAILQ_INIT(&sc->sc_tx_pending);
697
698	STAILQ_INIT(&sc->sc_rx_active);
699	STAILQ_INIT(&sc->sc_rx_inactive);
700	URTWN_UNLOCK(sc);
701
702	/* drain USB transfers */
703	for (x = 0; x != URTWN_N_TRANSFER; x++)
704		usbd_transfer_drain(sc->sc_xfer[x]);
705
706	/* Free data buffers. */
707	URTWN_LOCK(sc);
708	urtwn_free_tx_list(sc);
709	urtwn_free_rx_list(sc);
710	URTWN_UNLOCK(sc);
711
712	if (ic->ic_softc == sc) {
713		ieee80211_draintask(ic, &sc->cmdq_task);
714		ieee80211_ifdetach(ic);
715	}
716
717	URTWN_NT_LOCK_DESTROY(sc);
718	URTWN_CMDQ_LOCK_DESTROY(sc);
719	mtx_destroy(&sc->sc_mtx);
720
721	return (0);
722}
723
724static void
725urtwn_drain_mbufq(struct urtwn_softc *sc)
726{
727	struct mbuf *m;
728	struct ieee80211_node *ni;
729	URTWN_ASSERT_LOCKED(sc);
730	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
731		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
732		m->m_pkthdr.rcvif = NULL;
733		ieee80211_free_node(ni);
734		m_freem(m);
735	}
736}
737
738static usb_error_t
739urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
740    void *data)
741{
742	usb_error_t err;
743	int ntries = 10;
744
745	URTWN_ASSERT_LOCKED(sc);
746
747	while (ntries--) {
748		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
749		    req, data, 0, NULL, 250 /* ms */);
750		if (err == 0)
751			break;
752
753		URTWN_DPRINTF(sc, URTWN_DEBUG_USB,
754		    "%s: control request failed, %s (retries left: %d)\n",
755		    __func__, usbd_errstr(err), ntries);
756		usb_pause_mtx(&sc->sc_mtx, hz / 100);
757	}
758	return (err);
759}
760
761static struct ieee80211vap *
762urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
763    enum ieee80211_opmode opmode, int flags,
764    const uint8_t bssid[IEEE80211_ADDR_LEN],
765    const uint8_t mac[IEEE80211_ADDR_LEN])
766{
767	struct urtwn_softc *sc = ic->ic_softc;
768	struct urtwn_vap *uvp;
769	struct ieee80211vap *vap;
770
771	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
772		return (NULL);
773
774	uvp = malloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
775	vap = &uvp->vap;
776	/* enable s/w bmiss handling for sta mode */
777
778	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
779	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
780		/* out of memory */
781		free(uvp, M_80211_VAP);
782		return (NULL);
783	}
784
785	if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
786		urtwn_init_beacon(sc, uvp);
787
788	/* override state transition machine */
789	uvp->newstate = vap->iv_newstate;
790	vap->iv_newstate = urtwn_newstate;
791	vap->iv_update_beacon = urtwn_update_beacon;
792	vap->iv_key_alloc = urtwn_key_alloc;
793	vap->iv_key_set = urtwn_key_set;
794	vap->iv_key_delete = urtwn_key_delete;
795
796	/* 802.11n parameters */
797	vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
798	vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
799
800	if (opmode == IEEE80211_M_IBSS) {
801		uvp->recv_mgmt = vap->iv_recv_mgmt;
802		vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
803		TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
804	}
805
806	if (URTWN_CHIP_HAS_RATECTL(sc))
807		ieee80211_ratectl_init(vap);
808	/* complete setup */
809	ieee80211_vap_attach(vap, ieee80211_media_change,
810	    ieee80211_media_status, mac);
811	ic->ic_opmode = opmode;
812	return (vap);
813}
814
815static void
816urtwn_vap_delete(struct ieee80211vap *vap)
817{
818	struct ieee80211com *ic = vap->iv_ic;
819	struct urtwn_softc *sc = ic->ic_softc;
820	struct urtwn_vap *uvp = URTWN_VAP(vap);
821
822	if (uvp->bcn_mbuf != NULL)
823		m_freem(uvp->bcn_mbuf);
824	if (vap->iv_opmode == IEEE80211_M_IBSS)
825		ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
826	if (URTWN_CHIP_HAS_RATECTL(sc))
827		ieee80211_ratectl_deinit(vap);
828	ieee80211_vap_detach(vap);
829	free(uvp, M_80211_VAP);
830}
831
832static struct mbuf *
833urtwn_rx_copy_to_mbuf(struct urtwn_softc *sc, struct r92c_rx_stat *stat,
834    int totlen)
835{
836	struct ieee80211com *ic = &sc->sc_ic;
837	struct mbuf *m;
838	uint32_t rxdw0;
839	int pktlen;
840
841	/*
842	 * don't pass packets to the ieee80211 framework if the driver isn't
843	 * RUNNING.
844	 */
845	if (!(sc->sc_flags & URTWN_RUNNING))
846		return (NULL);
847
848	rxdw0 = le32toh(stat->rxdw0);
849	if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
850		/*
851		 * This should not happen since we setup our Rx filter
852		 * to not receive these frames.
853		 */
854		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
855		    "%s: RX flags error (%s)\n", __func__,
856		    rxdw0 & R92C_RXDW0_CRCERR ? "CRC" : "ICV");
857		goto fail;
858	}
859
860	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
861	if (pktlen < sizeof(struct ieee80211_frame_ack)) {
862		URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
863		    "%s: frame is too short: %d\n", __func__, pktlen);
864		goto fail;
865	}
866
867	if (__predict_false(totlen > MCLBYTES)) {
868		/* convert to m_getjcl if this happens */
869		device_printf(sc->sc_dev, "%s: frame too long: %d (%d)\n",
870		    __func__, pktlen, totlen);
871		goto fail;
872	}
873
874	m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
875	if (__predict_false(m == NULL)) {
876		device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
877		    __func__);
878		goto fail;
879	}
880
881	/* Finalize mbuf. */
882	memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
883	m->m_pkthdr.len = m->m_len = totlen;
884
885	return (m);
886fail:
887	counter_u64_add(ic->ic_ierrors, 1);
888	return (NULL);
889}
890
891static struct mbuf *
892urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data)
893{
894	struct urtwn_softc *sc = data->sc;
895	struct ieee80211com *ic = &sc->sc_ic;
896	struct r92c_rx_stat *stat;
897	uint8_t *buf;
898	int len;
899
900	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
901
902	if (len < sizeof(*stat)) {
903		counter_u64_add(ic->ic_ierrors, 1);
904		return (NULL);
905	}
906
907	buf = data->buf;
908	stat = (struct r92c_rx_stat *)buf;
909
910	/*
911	 * For 88E chips we can tie the FF flushing here;
912	 * this is where we do know exactly how deep the
913	 * transmit queue is.
914	 *
915	 * But it won't work for R92 chips, so we can't
916	 * take the easy way out.
917	 */
918
919	if (sc->chip & URTWN_CHIP_88E) {
920		int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
921
922		switch (report_sel) {
923		case R88E_RXDW3_RPT_RX:
924			return (urtwn_rxeof(sc, buf, len));
925		case R88E_RXDW3_RPT_TX1:
926			urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
927			break;
928		default:
929			URTWN_DPRINTF(sc, URTWN_DEBUG_INTR,
930			    "%s: case %d was not handled\n", __func__,
931			    report_sel);
932			break;
933		}
934	} else
935		return (urtwn_rxeof(sc, buf, len));
936
937	return (NULL);
938}
939
940static struct mbuf *
941urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len)
942{
943	struct r92c_rx_stat *stat;
944	struct mbuf *m, *m0 = NULL, *prevm = NULL;
945	uint32_t rxdw0;
946	int totlen, pktlen, infosz, npkts;
947
948	/* Get the number of encapsulated frames. */
949	stat = (struct r92c_rx_stat *)buf;
950	npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
951	URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
952	    "%s: Rx %d frames in one chunk\n", __func__, npkts);
953
954	/* Process all of them. */
955	while (npkts-- > 0) {
956		if (len < sizeof(*stat))
957			break;
958		stat = (struct r92c_rx_stat *)buf;
959		rxdw0 = le32toh(stat->rxdw0);
960
961		pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
962		if (pktlen == 0)
963			break;
964
965		infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
966
967		/* Make sure everything fits in xfer. */
968		totlen = sizeof(*stat) + infosz + pktlen;
969		if (totlen > len)
970			break;
971
972		m = urtwn_rx_copy_to_mbuf(sc, stat, totlen);
973		if (m0 == NULL)
974			m0 = m;
975		if (prevm == NULL)
976			prevm = m;
977		else {
978			prevm->m_next = m;
979			prevm = m;
980		}
981
982		/* Next chunk is 128-byte aligned. */
983		totlen = (totlen + 127) & ~127;
984		buf += totlen;
985		len -= totlen;
986	}
987
988	return (m0);
989}
990
991static void
992urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
993{
994	struct r88e_tx_rpt_ccx *rpt = arg;
995	struct ieee80211vap *vap;
996	struct ieee80211_node *ni;
997	uint8_t macid;
998	int ntries;
999
1000	macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
1001	ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
1002
1003	URTWN_NT_LOCK(sc);
1004	ni = sc->node_list[macid];
1005	if (ni != NULL) {
1006		vap = ni->ni_vap;
1007		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: frame for macid %d was"
1008		    "%s sent (%d retries)\n", __func__, macid,
1009		    (rpt->rptb1 & R88E_RPTB1_PKT_OK) ? "" : " not",
1010		    ntries);
1011
1012		if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
1013			ieee80211_ratectl_tx_complete(vap, ni,
1014			    IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
1015		} else {
1016			ieee80211_ratectl_tx_complete(vap, ni,
1017			    IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
1018		}
1019	} else {
1020		URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: macid %d, ni is NULL\n",
1021		    __func__, macid);
1022	}
1023	URTWN_NT_UNLOCK(sc);
1024}
1025
1026static struct ieee80211_node *
1027urtwn_rx_frame(struct urtwn_softc *sc, struct mbuf *m, int8_t *rssi_p)
1028{
1029	struct ieee80211com *ic = &sc->sc_ic;
1030	struct ieee80211_frame_min *wh;
1031	struct r92c_rx_stat *stat;
1032	uint32_t rxdw0, rxdw3;
1033	uint8_t rate, cipher;
1034	int8_t rssi = -127;
1035	int infosz;
1036
1037	stat = mtod(m, struct r92c_rx_stat *);
1038	rxdw0 = le32toh(stat->rxdw0);
1039	rxdw3 = le32toh(stat->rxdw3);
1040
1041	rate = MS(rxdw3, R92C_RXDW3_RATE);
1042	cipher = MS(rxdw0, R92C_RXDW0_CIPHER);
1043	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1044
1045	/* Get RSSI from PHY status descriptor if present. */
1046	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1047		if (sc->chip & URTWN_CHIP_88E)
1048			rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
1049		else
1050			rssi = urtwn_get_rssi(sc, rate, &stat[1]);
1051		URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: rssi=%d\n", __func__, rssi);
1052		/* Update our average RSSI. */
1053		urtwn_update_avgrssi(sc, rate, rssi);
1054	}
1055
1056	if (ieee80211_radiotap_active(ic)) {
1057		struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1058
1059		tap->wr_flags = 0;
1060
1061		urtwn_get_tsf(sc, &tap->wr_tsft);
1062		if (__predict_false(le32toh((uint32_t)tap->wr_tsft) <
1063				    le32toh(stat->rxdw5))) {
1064			tap->wr_tsft = le32toh(tap->wr_tsft  >> 32) - 1;
1065			tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
1066		} else
1067			tap->wr_tsft &= 0xffffffff00000000;
1068		tap->wr_tsft += stat->rxdw5;
1069
1070		/* XXX 20/40? */
1071		/* XXX shortgi? */
1072
1073		/* Map HW rate index to 802.11 rate. */
1074		if (!(rxdw3 & R92C_RXDW3_HT)) {
1075			tap->wr_rate = ridx2rate[rate];
1076		} else if (rate >= 12) {	/* MCS0~15. */
1077			/* Bit 7 set means HT MCS instead of rate. */
1078			tap->wr_rate = 0x80 | (rate - 12);
1079		}
1080
1081		/* XXX TODO: this isn't right; should use the last good RSSI */
1082		tap->wr_dbm_antsignal = rssi;
1083		tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
1084	}
1085
1086	*rssi_p = rssi;
1087
1088	/* Drop descriptor. */
1089	m_adj(m, sizeof(*stat) + infosz);
1090	wh = mtod(m, struct ieee80211_frame_min *);
1091
1092	if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
1093	    cipher != R92C_CAM_ALGO_NONE) {
1094		m->m_flags |= M_WEP;
1095	}
1096
1097	if (m->m_len >= sizeof(*wh))
1098		return (ieee80211_find_rxnode(ic, wh));
1099
1100	return (NULL);
1101}
1102
1103static void
1104urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1105{
1106	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1107	struct ieee80211com *ic = &sc->sc_ic;
1108	struct ieee80211_node *ni;
1109	struct mbuf *m = NULL, *next;
1110	struct urtwn_data *data;
1111	int8_t nf, rssi;
1112
1113	URTWN_ASSERT_LOCKED(sc);
1114
1115	switch (USB_GET_STATE(xfer)) {
1116	case USB_ST_TRANSFERRED:
1117		data = STAILQ_FIRST(&sc->sc_rx_active);
1118		if (data == NULL)
1119			goto tr_setup;
1120		STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1121		m = urtwn_report_intr(xfer, data);
1122		STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1123		/* FALLTHROUGH */
1124	case USB_ST_SETUP:
1125tr_setup:
1126		data = STAILQ_FIRST(&sc->sc_rx_inactive);
1127		if (data == NULL) {
1128			KASSERT(m == NULL, ("mbuf isn't NULL"));
1129			goto finish;
1130		}
1131		STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1132		STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1133		usbd_xfer_set_frame_data(xfer, 0, data->buf,
1134		    usbd_xfer_max_len(xfer));
1135		usbd_transfer_submit(xfer);
1136
1137		/*
1138		 * To avoid LOR we should unlock our private mutex here to call
1139		 * ieee80211_input() because here is at the end of a USB
1140		 * callback and safe to unlock.
1141		 */
1142		while (m != NULL) {
1143			next = m->m_next;
1144			m->m_next = NULL;
1145
1146			ni = urtwn_rx_frame(sc, m, &rssi);
1147
1148			/* Store a global last-good RSSI */
1149			if (rssi != -127)
1150				sc->last_rssi = rssi;
1151
1152			URTWN_UNLOCK(sc);
1153
1154			nf = URTWN_NOISE_FLOOR;
1155			if (ni != NULL) {
1156				if (rssi != -127)
1157					URTWN_NODE(ni)->last_rssi = rssi;
1158				if (ni->ni_flags & IEEE80211_NODE_HT)
1159					m->m_flags |= M_AMPDU;
1160				(void)ieee80211_input(ni, m,
1161				    URTWN_NODE(ni)->last_rssi - nf, nf);
1162				ieee80211_free_node(ni);
1163			} else {
1164				/* Use last good global RSSI */
1165				(void)ieee80211_input_all(ic, m,
1166				    sc->last_rssi - nf, nf);
1167			}
1168			URTWN_LOCK(sc);
1169			m = next;
1170		}
1171		break;
1172	default:
1173		/* needs it to the inactive queue due to a error. */
1174		data = STAILQ_FIRST(&sc->sc_rx_active);
1175		if (data != NULL) {
1176			STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1177			STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1178		}
1179		if (error != USB_ERR_CANCELLED) {
1180			usbd_xfer_set_stall(xfer);
1181			counter_u64_add(ic->ic_ierrors, 1);
1182			goto tr_setup;
1183		}
1184		break;
1185	}
1186finish:
1187	/* Finished receive; age anything left on the FF queue by a little bump */
1188	/*
1189	 * XXX TODO: just make this a callout timer schedule so we can
1190	 * flush the FF staging queue if we're approaching idle.
1191	 */
1192#ifdef	IEEE80211_SUPPORT_SUPERG
1193	URTWN_UNLOCK(sc);
1194	ieee80211_ff_age_all(ic, 1);
1195	URTWN_LOCK(sc);
1196#endif
1197
1198	/* Kick-start more transmit in case we stalled */
1199	urtwn_start(sc);
1200}
1201
1202static void
1203urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
1204{
1205
1206	URTWN_ASSERT_LOCKED(sc);
1207
1208	if (data->ni != NULL)	/* not a beacon frame */
1209		ieee80211_tx_complete(data->ni, data->m, status);
1210
1211	if (sc->sc_tx_n_active > 0)
1212		sc->sc_tx_n_active--;
1213
1214	data->ni = NULL;
1215	data->m = NULL;
1216
1217	sc->sc_txtimer = 0;
1218
1219	STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1220}
1221
1222static int
1223urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1224    int ndata, int maxsz)
1225{
1226	int i, error;
1227
1228	for (i = 0; i < ndata; i++) {
1229		struct urtwn_data *dp = &data[i];
1230		dp->sc = sc;
1231		dp->m = NULL;
1232		dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
1233		if (dp->buf == NULL) {
1234			device_printf(sc->sc_dev,
1235			    "could not allocate buffer\n");
1236			error = ENOMEM;
1237			goto fail;
1238		}
1239		dp->ni = NULL;
1240	}
1241
1242	return (0);
1243fail:
1244	urtwn_free_list(sc, data, ndata);
1245	return (error);
1246}
1247
1248static int
1249urtwn_alloc_rx_list(struct urtwn_softc *sc)
1250{
1251        int error, i;
1252
1253	error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1254	    URTWN_RXBUFSZ);
1255	if (error != 0)
1256		return (error);
1257
1258	STAILQ_INIT(&sc->sc_rx_active);
1259	STAILQ_INIT(&sc->sc_rx_inactive);
1260
1261	for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1262		STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1263
1264	return (0);
1265}
1266
1267static int
1268urtwn_alloc_tx_list(struct urtwn_softc *sc)
1269{
1270	int error, i;
1271
1272	error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1273	    URTWN_TXBUFSZ);
1274	if (error != 0)
1275		return (error);
1276
1277	STAILQ_INIT(&sc->sc_tx_active);
1278	STAILQ_INIT(&sc->sc_tx_inactive);
1279	STAILQ_INIT(&sc->sc_tx_pending);
1280
1281	for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1282		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1283
1284	return (0);
1285}
1286
1287static void
1288urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1289{
1290	int i;
1291
1292	for (i = 0; i < ndata; i++) {
1293		struct urtwn_data *dp = &data[i];
1294
1295		if (dp->buf != NULL) {
1296			free(dp->buf, M_USBDEV);
1297			dp->buf = NULL;
1298		}
1299		if (dp->ni != NULL) {
1300			ieee80211_free_node(dp->ni);
1301			dp->ni = NULL;
1302		}
1303	}
1304}
1305
1306static void
1307urtwn_free_rx_list(struct urtwn_softc *sc)
1308{
1309	urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1310}
1311
1312static void
1313urtwn_free_tx_list(struct urtwn_softc *sc)
1314{
1315	urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1316}
1317
1318static void
1319urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1320{
1321	struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1322#ifdef	IEEE80211_SUPPORT_SUPERG
1323	struct ieee80211com *ic = &sc->sc_ic;
1324#endif
1325	struct urtwn_data *data;
1326
1327	URTWN_ASSERT_LOCKED(sc);
1328
1329	switch (USB_GET_STATE(xfer)){
1330	case USB_ST_TRANSFERRED:
1331		data = STAILQ_FIRST(&sc->sc_tx_active);
1332		if (data == NULL)
1333			goto tr_setup;
1334		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1335		urtwn_txeof(sc, data, 0);
1336		/* FALLTHROUGH */
1337	case USB_ST_SETUP:
1338tr_setup:
1339		data = STAILQ_FIRST(&sc->sc_tx_pending);
1340		if (data == NULL) {
1341			URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1342			    "%s: empty pending queue\n", __func__);
1343			sc->sc_tx_n_active = 0;
1344			goto finish;
1345		}
1346		STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1347		STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1348		usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1349		usbd_transfer_submit(xfer);
1350		sc->sc_tx_n_active++;
1351		break;
1352	default:
1353		data = STAILQ_FIRST(&sc->sc_tx_active);
1354		if (data == NULL)
1355			goto tr_setup;
1356		STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1357		urtwn_txeof(sc, data, 1);
1358		if (error != USB_ERR_CANCELLED) {
1359			usbd_xfer_set_stall(xfer);
1360			goto tr_setup;
1361		}
1362		break;
1363	}
1364finish:
1365#ifdef	IEEE80211_SUPPORT_SUPERG
1366	/*
1367	 * If the TX active queue drops below a certain
1368	 * threshold, ensure we age fast-frames out so they're
1369	 * transmitted.
1370	 */
1371	if (sc->sc_tx_n_active <= 1) {
1372		/* XXX ew - net80211 should defer this for us! */
1373
1374		/*
1375		 * Note: this sc_tx_n_active currently tracks
1376		 * the number of pending transmit submissions
1377		 * and not the actual depth of the TX frames
1378		 * pending to the hardware.  That means that
1379		 * we're going to end up with some sub-optimal
1380		 * aggregation behaviour.
1381		 */
1382		/*
1383		 * XXX TODO: just make this a callout timer schedule so we can
1384		 * flush the FF staging queue if we're approaching idle.
1385		 */
1386		URTWN_UNLOCK(sc);
1387		ieee80211_ff_flush(ic, WME_AC_VO);
1388		ieee80211_ff_flush(ic, WME_AC_VI);
1389		ieee80211_ff_flush(ic, WME_AC_BE);
1390		ieee80211_ff_flush(ic, WME_AC_BK);
1391		URTWN_LOCK(sc);
1392	}
1393#endif
1394	/* Kick-start more transmit */
1395	urtwn_start(sc);
1396}
1397
1398static struct urtwn_data *
1399_urtwn_getbuf(struct urtwn_softc *sc)
1400{
1401	struct urtwn_data *bf;
1402
1403	bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1404	if (bf != NULL)
1405		STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1406	else {
1407		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1408		    "%s: out of xmit buffers\n", __func__);
1409	}
1410	return (bf);
1411}
1412
1413static struct urtwn_data *
1414urtwn_getbuf(struct urtwn_softc *sc)
1415{
1416        struct urtwn_data *bf;
1417
1418	URTWN_ASSERT_LOCKED(sc);
1419
1420	bf = _urtwn_getbuf(sc);
1421	if (bf == NULL) {
1422		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: stop queue\n",
1423		    __func__);
1424	}
1425	return (bf);
1426}
1427
1428static usb_error_t
1429urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1430    int len)
1431{
1432	usb_device_request_t req;
1433
1434	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1435	req.bRequest = R92C_REQ_REGS;
1436	USETW(req.wValue, addr);
1437	USETW(req.wIndex, 0);
1438	USETW(req.wLength, len);
1439	return (urtwn_do_request(sc, &req, buf));
1440}
1441
1442static usb_error_t
1443urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1444{
1445	return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1446}
1447
1448static usb_error_t
1449urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1450{
1451	val = htole16(val);
1452	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1453}
1454
1455static usb_error_t
1456urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1457{
1458	val = htole32(val);
1459	return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1460}
1461
1462static usb_error_t
1463urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1464    int len)
1465{
1466	usb_device_request_t req;
1467
1468	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1469	req.bRequest = R92C_REQ_REGS;
1470	USETW(req.wValue, addr);
1471	USETW(req.wIndex, 0);
1472	USETW(req.wLength, len);
1473	return (urtwn_do_request(sc, &req, buf));
1474}
1475
1476static uint8_t
1477urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1478{
1479	uint8_t val;
1480
1481	if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1482		return (0xff);
1483	return (val);
1484}
1485
1486static uint16_t
1487urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1488{
1489	uint16_t val;
1490
1491	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1492		return (0xffff);
1493	return (le16toh(val));
1494}
1495
1496static uint32_t
1497urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1498{
1499	uint32_t val;
1500
1501	if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1502		return (0xffffffff);
1503	return (le32toh(val));
1504}
1505
1506static int
1507urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1508{
1509	struct r92c_fw_cmd cmd;
1510	usb_error_t error;
1511	int ntries;
1512
1513	if (!(sc->sc_flags & URTWN_FW_LOADED)) {
1514		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE, "%s: firmware "
1515		    "was not loaded; command (id %d) will be discarded\n",
1516		    __func__, id);
1517		return (0);
1518	}
1519
1520	/* Wait for current FW box to be empty. */
1521	for (ntries = 0; ntries < 100; ntries++) {
1522		if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1523			break;
1524		urtwn_ms_delay(sc);
1525	}
1526	if (ntries == 100) {
1527		device_printf(sc->sc_dev,
1528		    "could not send firmware command\n");
1529		return (ETIMEDOUT);
1530	}
1531	memset(&cmd, 0, sizeof(cmd));
1532	cmd.id = id;
1533	if (len > 3)
1534		cmd.id |= R92C_CMD_FLAG_EXT;
1535	KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1536	memcpy(cmd.msg, buf, len);
1537
1538	/* Write the first word last since that will trigger the FW. */
1539	error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1540	    (uint8_t *)&cmd + 4, 2);
1541	if (error != USB_ERR_NORMAL_COMPLETION)
1542		return (EIO);
1543	error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1544	    (uint8_t *)&cmd + 0, 4);
1545	if (error != USB_ERR_NORMAL_COMPLETION)
1546		return (EIO);
1547
1548	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1549	return (0);
1550}
1551
1552static void
1553urtwn_cmdq_cb(void *arg, int pending)
1554{
1555	struct urtwn_softc *sc = arg;
1556	struct urtwn_cmdq *item;
1557
1558	/*
1559	 * Device must be powered on (via urtwn_power_on())
1560	 * before any command may be sent.
1561	 */
1562	URTWN_LOCK(sc);
1563	if (!(sc->sc_flags & URTWN_RUNNING)) {
1564		URTWN_UNLOCK(sc);
1565		return;
1566	}
1567
1568	URTWN_CMDQ_LOCK(sc);
1569	while (sc->cmdq[sc->cmdq_first].func != NULL) {
1570		item = &sc->cmdq[sc->cmdq_first];
1571		sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1572		URTWN_CMDQ_UNLOCK(sc);
1573
1574		item->func(sc, &item->data);
1575
1576		URTWN_CMDQ_LOCK(sc);
1577		memset(item, 0, sizeof (*item));
1578	}
1579	URTWN_CMDQ_UNLOCK(sc);
1580	URTWN_UNLOCK(sc);
1581}
1582
1583static int
1584urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1585    CMD_FUNC_PROTO)
1586{
1587	struct ieee80211com *ic = &sc->sc_ic;
1588
1589	KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1590
1591	URTWN_CMDQ_LOCK(sc);
1592	if (sc->cmdq[sc->cmdq_last].func != NULL) {
1593		device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1594		URTWN_CMDQ_UNLOCK(sc);
1595
1596		return (EAGAIN);
1597	}
1598
1599	if (ptr != NULL)
1600		memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1601	sc->cmdq[sc->cmdq_last].func = func;
1602	sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1603	URTWN_CMDQ_UNLOCK(sc);
1604
1605	ieee80211_runtask(ic, &sc->cmdq_task);
1606
1607	return (0);
1608}
1609
1610static __inline void
1611urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1612{
1613
1614	sc->sc_rf_write(sc, chain, addr, val);
1615}
1616
1617static void
1618urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1619    uint32_t val)
1620{
1621	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1622	    SM(R92C_LSSI_PARAM_ADDR, addr) |
1623	    SM(R92C_LSSI_PARAM_DATA, val));
1624}
1625
1626static void
1627urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1628uint32_t val)
1629{
1630	urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1631	    SM(R88E_LSSI_PARAM_ADDR, addr) |
1632	    SM(R92C_LSSI_PARAM_DATA, val));
1633}
1634
1635static uint32_t
1636urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1637{
1638	uint32_t reg[R92C_MAX_CHAINS], val;
1639
1640	reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1641	if (chain != 0)
1642		reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1643
1644	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1645	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1646	urtwn_ms_delay(sc);
1647
1648	urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1649	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1650	    R92C_HSSI_PARAM2_READ_EDGE);
1651	urtwn_ms_delay(sc);
1652
1653	urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1654	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1655	urtwn_ms_delay(sc);
1656
1657	if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1658		val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1659	else
1660		val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1661	return (MS(val, R92C_LSSI_READBACK_DATA));
1662}
1663
1664static int
1665urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1666{
1667	usb_error_t error;
1668	int ntries;
1669
1670	error = urtwn_write_4(sc, R92C_LLT_INIT,
1671	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1672	    SM(R92C_LLT_INIT_ADDR, addr) |
1673	    SM(R92C_LLT_INIT_DATA, data));
1674	if (error != USB_ERR_NORMAL_COMPLETION)
1675		return (EIO);
1676	/* Wait for write operation to complete. */
1677	for (ntries = 0; ntries < 20; ntries++) {
1678		if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1679		    R92C_LLT_INIT_OP_NO_ACTIVE)
1680			return (0);
1681		urtwn_ms_delay(sc);
1682	}
1683	return (ETIMEDOUT);
1684}
1685
1686static int
1687urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1688{
1689	uint32_t reg;
1690	usb_error_t error;
1691	int ntries;
1692
1693	if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1694		return (EFAULT);
1695
1696	reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1697	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1698	reg &= ~R92C_EFUSE_CTRL_VALID;
1699
1700	error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1701	if (error != USB_ERR_NORMAL_COMPLETION)
1702		return (EIO);
1703	/* Wait for read operation to complete. */
1704	for (ntries = 0; ntries < 100; ntries++) {
1705		reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1706		if (reg & R92C_EFUSE_CTRL_VALID)
1707			break;
1708		urtwn_ms_delay(sc);
1709	}
1710	if (ntries == 100) {
1711		device_printf(sc->sc_dev,
1712		    "could not read efuse byte at address 0x%x\n",
1713		    sc->last_rom_addr);
1714		return (ETIMEDOUT);
1715	}
1716
1717	*val = MS(reg, R92C_EFUSE_CTRL_DATA);
1718	sc->last_rom_addr++;
1719
1720	return (0);
1721}
1722
1723static int
1724urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1725    uint8_t msk)
1726{
1727	uint8_t reg;
1728	int i, error;
1729
1730	for (i = 0; i < 4; i++) {
1731		if (msk & (1 << i))
1732			continue;
1733		error = urtwn_efuse_read_next(sc, &reg);
1734		if (error != 0)
1735			return (error);
1736		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1737		    off * 8 + i * 2, reg);
1738		rom[off * 8 + i * 2 + 0] = reg;
1739
1740		error = urtwn_efuse_read_next(sc, &reg);
1741		if (error != 0)
1742			return (error);
1743		URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1744		    off * 8 + i * 2 + 1, reg);
1745		rom[off * 8 + i * 2 + 1] = reg;
1746	}
1747
1748	return (0);
1749}
1750
1751#ifdef USB_DEBUG
1752static void
1753urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1754{
1755	int i;
1756
1757	/* Dump ROM contents. */
1758	device_printf(sc->sc_dev, "%s:", __func__);
1759	for (i = 0; i < size; i++) {
1760		if (i % 32 == 0)
1761			printf("\n%03X: ", i);
1762		else if (i % 4 == 0)
1763			printf(" ");
1764
1765		printf("%02X", rom[i]);
1766	}
1767	printf("\n");
1768}
1769#endif
1770
1771static int
1772urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1773{
1774#define URTWN_CHK(res) do {	\
1775	if ((error = res) != 0)	\
1776		goto end;	\
1777} while(0)
1778	uint8_t msk, off, reg;
1779	int error;
1780
1781	URTWN_CHK(urtwn_efuse_switch_power(sc));
1782
1783	/* Read full ROM image. */
1784	sc->last_rom_addr = 0;
1785	memset(rom, 0xff, size);
1786
1787	URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1788	while (reg != 0xff) {
1789		/* check for extended header */
1790		if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1791			off = reg >> 5;
1792			URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1793
1794			if ((reg & 0x0f) != 0x0f)
1795				off = ((reg & 0xf0) >> 1) | off;
1796			else
1797				continue;
1798		} else
1799			off = reg >> 4;
1800		msk = reg & 0xf;
1801
1802		URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1803		URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1804	}
1805
1806end:
1807
1808#ifdef USB_DEBUG
1809	if (sc->sc_debug & URTWN_DEBUG_ROM)
1810		urtwn_dump_rom_contents(sc, rom, size);
1811#endif
1812
1813	urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1814
1815	if (error != 0) {
1816		device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1817		    __func__);
1818	}
1819
1820	return (error);
1821#undef URTWN_CHK
1822}
1823
1824static int
1825urtwn_efuse_switch_power(struct urtwn_softc *sc)
1826{
1827	usb_error_t error;
1828	uint32_t reg;
1829
1830	error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1831	if (error != USB_ERR_NORMAL_COMPLETION)
1832		return (EIO);
1833
1834	reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1835	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1836		error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1837		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1838		if (error != USB_ERR_NORMAL_COMPLETION)
1839			return (EIO);
1840	}
1841	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1842	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1843		error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1844		    reg | R92C_SYS_FUNC_EN_ELDR);
1845		if (error != USB_ERR_NORMAL_COMPLETION)
1846			return (EIO);
1847	}
1848	reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1849	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1850	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1851		error = urtwn_write_2(sc, R92C_SYS_CLKR,
1852		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1853		if (error != USB_ERR_NORMAL_COMPLETION)
1854			return (EIO);
1855	}
1856
1857	return (0);
1858}
1859
1860static int
1861urtwn_read_chipid(struct urtwn_softc *sc)
1862{
1863	uint32_t reg;
1864
1865	if (sc->chip & URTWN_CHIP_88E)
1866		return (0);
1867
1868	reg = urtwn_read_4(sc, R92C_SYS_CFG);
1869	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1870		return (EIO);
1871
1872	if (reg & R92C_SYS_CFG_TYPE_92C) {
1873		sc->chip |= URTWN_CHIP_92C;
1874		/* Check if it is a castrated 8192C. */
1875		if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1876		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1877		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1878			sc->chip |= URTWN_CHIP_92C_1T2R;
1879	}
1880	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1881		sc->chip |= URTWN_CHIP_UMC;
1882		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1883			sc->chip |= URTWN_CHIP_UMC_A_CUT;
1884	}
1885	return (0);
1886}
1887
1888static int
1889urtwn_read_rom(struct urtwn_softc *sc)
1890{
1891	struct r92c_rom *rom = &sc->rom.r92c_rom;
1892	int error;
1893
1894	/* Read full ROM image. */
1895	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1896	if (error != 0)
1897		return (error);
1898
1899	/* XXX Weird but this is what the vendor driver does. */
1900	sc->last_rom_addr = 0x1fa;
1901	error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1902	if (error != 0)
1903		return (error);
1904	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: PA setting=0x%x\n", __func__,
1905	    sc->pa_setting);
1906
1907	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1908
1909	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1910	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type=%d\n",
1911	    __func__, sc->regulatory);
1912	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1913
1914	sc->sc_rf_write = urtwn_r92c_rf_write;
1915	sc->sc_power_on = urtwn_r92c_power_on;
1916	sc->sc_power_off = urtwn_r92c_power_off;
1917
1918	return (0);
1919}
1920
1921static int
1922urtwn_r88e_read_rom(struct urtwn_softc *sc)
1923{
1924	struct r88e_rom *rom = &sc->rom.r88e_rom;
1925	int error;
1926
1927	error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));
1928	if (error != 0)
1929		return (error);
1930
1931	sc->bw20_tx_pwr_diff = (rom->tx_pwr_diff >> 4);
1932	if (sc->bw20_tx_pwr_diff & 0x08)
1933		sc->bw20_tx_pwr_diff |= 0xf0;
1934	sc->ofdm_tx_pwr_diff = (rom->tx_pwr_diff & 0xf);
1935	if (sc->ofdm_tx_pwr_diff & 0x08)
1936		sc->ofdm_tx_pwr_diff |= 0xf0;
1937	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
1938	URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type %d\n",
1939	    __func__,sc->regulatory);
1940	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1941
1942	sc->sc_rf_write = urtwn_r88e_rf_write;
1943	sc->sc_power_on = urtwn_r88e_power_on;
1944	sc->sc_power_off = urtwn_r88e_power_off;
1945
1946	return (0);
1947}
1948
1949static __inline uint8_t
1950rate2ridx(uint8_t rate)
1951{
1952	if (rate & IEEE80211_RATE_MCS) {
1953		/* 11n rates start at idx 12 */
1954		return ((rate & 0xf) + 12);
1955	}
1956	switch (rate) {
1957	/* 11g */
1958	case 12:	return 4;
1959	case 18:	return 5;
1960	case 24:	return 6;
1961	case 36:	return 7;
1962	case 48:	return 8;
1963	case 72:	return 9;
1964	case 96:	return 10;
1965	case 108:	return 11;
1966	/* 11b */
1967	case 2:		return 0;
1968	case 4:		return 1;
1969	case 11:	return 2;
1970	case 22:	return 3;
1971	default:	return URTWN_RIDX_UNKNOWN;
1972	}
1973}
1974
1975/*
1976 * Initialize rate adaptation in firmware.
1977 */
1978static int
1979urtwn_ra_init(struct urtwn_softc *sc)
1980{
1981	struct ieee80211com *ic = &sc->sc_ic;
1982	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1983	struct ieee80211_node *ni;
1984	struct ieee80211_rateset *rs, *rs_ht;
1985	struct r92c_fw_cmd_macid_cfg cmd;
1986	uint32_t rates, basicrates;
1987	uint8_t mode, ridx;
1988	int maxrate, maxbasicrate, error, i;
1989
1990	ni = ieee80211_ref_node(vap->iv_bss);
1991	rs = &ni->ni_rates;
1992	rs_ht = (struct ieee80211_rateset *) &ni->ni_htrates;
1993
1994	/* Get normal and basic rates mask. */
1995	rates = basicrates = 0;
1996	maxrate = maxbasicrate = 0;
1997
1998	/* This is for 11bg */
1999	for (i = 0; i < rs->rs_nrates; i++) {
2000		/* Convert 802.11 rate to HW rate index. */
2001		ridx = rate2ridx(IEEE80211_RV(rs->rs_rates[i]));
2002		if (ridx == URTWN_RIDX_UNKNOWN)	/* Unknown rate, skip. */
2003			continue;
2004		rates |= 1 << ridx;
2005		if (ridx > maxrate)
2006			maxrate = ridx;
2007		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
2008			basicrates |= 1 << ridx;
2009			if (ridx > maxbasicrate)
2010				maxbasicrate = ridx;
2011		}
2012	}
2013
2014	/* If we're doing 11n, enable 11n rates */
2015	if (ni->ni_flags & IEEE80211_NODE_HT) {
2016		for (i = 0; i < rs_ht->rs_nrates; i++) {
2017			if ((rs_ht->rs_rates[i] & 0x7f) > 0xf)
2018				continue;
2019			/* 11n rates start at index 12 */
2020			ridx = ((rs_ht->rs_rates[i]) & 0xf) + 12;
2021			rates |= (1 << ridx);
2022
2023			/* Guard against the rate table being oddly ordered */
2024			if (ridx > maxrate)
2025				maxrate = ridx;
2026		}
2027	}
2028
2029#if 0
2030	if (ic->ic_curmode == IEEE80211_MODE_11NG)
2031		raid = R92C_RAID_11GN;
2032#endif
2033	/* NB: group addressed frames are done at 11bg rates for now */
2034	if (ic->ic_curmode == IEEE80211_MODE_11B)
2035		mode = R92C_RAID_11B;
2036	else
2037		mode = R92C_RAID_11BG;
2038	/* XXX misleading 'mode' value here for unicast frames */
2039	URTWN_DPRINTF(sc, URTWN_DEBUG_RA,
2040	    "%s: mode 0x%x, rates 0x%08x, basicrates 0x%08x\n", __func__,
2041	    mode, rates, basicrates);
2042
2043	/* Set rates mask for group addressed frames. */
2044	cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
2045	cmd.mask = htole32(mode << 28 | basicrates);
2046	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2047	if (error != 0) {
2048		ieee80211_free_node(ni);
2049		device_printf(sc->sc_dev,
2050		    "could not add broadcast station\n");
2051		return (error);
2052	}
2053
2054	/* Set initial MRR rate. */
2055	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxbasicrate %d\n", __func__,
2056	    maxbasicrate);
2057	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
2058	    maxbasicrate);
2059
2060	/* Set rates mask for unicast frames. */
2061	if (ni->ni_flags & IEEE80211_NODE_HT)
2062		mode = R92C_RAID_11GN;
2063	else if (ic->ic_curmode == IEEE80211_MODE_11B)
2064		mode = R92C_RAID_11B;
2065	else
2066		mode = R92C_RAID_11BG;
2067	cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
2068	cmd.mask = htole32(mode << 28 | rates);
2069	error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2070	if (error != 0) {
2071		ieee80211_free_node(ni);
2072		device_printf(sc->sc_dev, "could not add BSS station\n");
2073		return (error);
2074	}
2075	/* Set initial MRR rate. */
2076	URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxrate %d\n", __func__,
2077	    maxrate);
2078	urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
2079	    maxrate);
2080
2081	/* Indicate highest supported rate. */
2082	if (ni->ni_flags & IEEE80211_NODE_HT)
2083		ni->ni_txrate = rs_ht->rs_rates[rs_ht->rs_nrates - 1]
2084		    | IEEE80211_RATE_MCS;
2085	else
2086		ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
2087	ieee80211_free_node(ni);
2088
2089	return (0);
2090}
2091
2092static void
2093urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2094{
2095	struct r92c_tx_desc *txd = &uvp->bcn_desc;
2096
2097	txd->txdw0 = htole32(
2098	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
2099	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2100	txd->txdw1 = htole32(
2101	    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
2102	    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
2103
2104	if (sc->chip & URTWN_CHIP_88E) {
2105		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
2106		txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
2107	} else {
2108		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
2109		txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2110	}
2111
2112	txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
2113	txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
2114}
2115
2116static int
2117urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
2118{
2119 	struct ieee80211vap *vap = ni->ni_vap;
2120	struct urtwn_vap *uvp = URTWN_VAP(vap);
2121	struct mbuf *m;
2122	int error;
2123
2124	URTWN_ASSERT_LOCKED(sc);
2125
2126	if (ni->ni_chan == IEEE80211_CHAN_ANYC)
2127		return (EINVAL);
2128
2129	m = ieee80211_beacon_alloc(ni);
2130	if (m == NULL) {
2131		device_printf(sc->sc_dev,
2132		    "%s: could not allocate beacon frame\n", __func__);
2133		return (ENOMEM);
2134	}
2135
2136	if (uvp->bcn_mbuf != NULL)
2137		m_freem(uvp->bcn_mbuf);
2138
2139	uvp->bcn_mbuf = m;
2140
2141	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2142		return (error);
2143
2144	/* XXX bcnq stuck workaround */
2145	if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2146		return (error);
2147
2148	URTWN_DPRINTF(sc, URTWN_DEBUG_BEACON, "%s: beacon was %srecognized\n",
2149	    __func__, urtwn_read_1(sc, R92C_TDECTRL + 2) &
2150	    (R92C_TDECTRL_BCN_VALID >> 16) ? "" : "not ");
2151
2152	return (0);
2153}
2154
2155static void
2156urtwn_update_beacon(struct ieee80211vap *vap, int item)
2157{
2158	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2159	struct urtwn_vap *uvp = URTWN_VAP(vap);
2160	struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
2161	struct ieee80211_node *ni = vap->iv_bss;
2162	int mcast = 0;
2163
2164	URTWN_LOCK(sc);
2165	if (uvp->bcn_mbuf == NULL) {
2166		uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
2167		if (uvp->bcn_mbuf == NULL) {
2168			device_printf(sc->sc_dev,
2169			    "%s: could not allocate beacon frame\n", __func__);
2170			URTWN_UNLOCK(sc);
2171			return;
2172		}
2173	}
2174	URTWN_UNLOCK(sc);
2175
2176	if (item == IEEE80211_BEACON_TIM)
2177		mcast = 1;	/* XXX */
2178
2179	setbit(bo->bo_flags, item);
2180	ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
2181
2182	URTWN_LOCK(sc);
2183	urtwn_tx_beacon(sc, uvp);
2184	URTWN_UNLOCK(sc);
2185}
2186
2187/*
2188 * Push a beacon frame into the chip. Beacon will
2189 * be repeated by the chip every R92C_BCN_INTERVAL.
2190 */
2191static int
2192urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2193{
2194	struct r92c_tx_desc *desc = &uvp->bcn_desc;
2195	struct urtwn_data *bf;
2196
2197	URTWN_ASSERT_LOCKED(sc);
2198
2199	bf = urtwn_getbuf(sc);
2200	if (bf == NULL)
2201		return (ENOMEM);
2202
2203	memcpy(bf->buf, desc, sizeof(*desc));
2204	urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
2205
2206	sc->sc_txtimer = 5;
2207	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2208
2209	return (0);
2210}
2211
2212static int
2213urtwn_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
2214    ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
2215{
2216	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2217	uint8_t i;
2218
2219	if (!(&vap->iv_nw_keys[0] <= k &&
2220	     k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
2221		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2222			URTWN_LOCK(sc);
2223			/*
2224			 * First 4 slots for group keys,
2225			 * what is left - for pairwise.
2226			 * XXX incompatible with IBSS RSN.
2227			 */
2228			for (i = IEEE80211_WEP_NKID;
2229			     i < R92C_CAM_ENTRY_COUNT; i++) {
2230				if ((sc->keys_bmap & (1 << i)) == 0) {
2231					sc->keys_bmap |= 1 << i;
2232					*keyix = i;
2233					break;
2234				}
2235			}
2236			URTWN_UNLOCK(sc);
2237			if (i == R92C_CAM_ENTRY_COUNT) {
2238				device_printf(sc->sc_dev,
2239				    "%s: no free space in the key table\n",
2240				    __func__);
2241				return 0;
2242			}
2243		} else
2244			*keyix = 0;
2245	} else {
2246		*keyix = k - vap->iv_nw_keys;
2247	}
2248	*rxkeyix = *keyix;
2249	return 1;
2250}
2251
2252static void
2253urtwn_key_set_cb(struct urtwn_softc *sc, union sec_param *data)
2254{
2255	struct ieee80211_key *k = &data->key;
2256	uint8_t algo, keyid;
2257	int i, error;
2258
2259	if (k->wk_keyix < IEEE80211_WEP_NKID)
2260		keyid = k->wk_keyix;
2261	else
2262		keyid = 0;
2263
2264	/* Map net80211 cipher to HW crypto algorithm. */
2265	switch (k->wk_cipher->ic_cipher) {
2266	case IEEE80211_CIPHER_WEP:
2267		if (k->wk_keylen < 8)
2268			algo = R92C_CAM_ALGO_WEP40;
2269		else
2270			algo = R92C_CAM_ALGO_WEP104;
2271		break;
2272	case IEEE80211_CIPHER_TKIP:
2273		algo = R92C_CAM_ALGO_TKIP;
2274		break;
2275	case IEEE80211_CIPHER_AES_CCM:
2276		algo = R92C_CAM_ALGO_AES;
2277		break;
2278	default:
2279		device_printf(sc->sc_dev, "%s: undefined cipher %d\n",
2280		    __func__, k->wk_cipher->ic_cipher);
2281		return;
2282	}
2283
2284	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2285	    "%s: keyix %d, keyid %d, algo %d/%d, flags %04X, len %d, "
2286	    "macaddr %s\n", __func__, k->wk_keyix, keyid,
2287	    k->wk_cipher->ic_cipher, algo, k->wk_flags, k->wk_keylen,
2288	    ether_sprintf(k->wk_macaddr));
2289
2290	/* Write key. */
2291	for (i = 0; i < 4; i++) {
2292		error = urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i),
2293		    le32dec(&k->wk_key[i * 4]));
2294		if (error != 0)
2295			goto fail;
2296	}
2297
2298	/* Write CTL0 last since that will validate the CAM entry. */
2299	error = urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix),
2300	    le32dec(&k->wk_macaddr[2]));
2301	if (error != 0)
2302		goto fail;
2303	error = urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix),
2304	    SM(R92C_CAM_ALGO, algo) |
2305	    SM(R92C_CAM_KEYID, keyid) |
2306	    SM(R92C_CAM_MACLO, le16dec(&k->wk_macaddr[0])) |
2307	    R92C_CAM_VALID);
2308	if (error != 0)
2309		goto fail;
2310
2311	return;
2312
2313fail:
2314	device_printf(sc->sc_dev, "%s fails, error %d\n", __func__, error);
2315}
2316
2317static void
2318urtwn_key_del_cb(struct urtwn_softc *sc, union sec_param *data)
2319{
2320	struct ieee80211_key *k = &data->key;
2321	int i;
2322
2323	URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2324	    "%s: keyix %d, flags %04X, macaddr %s\n", __func__,
2325	    k->wk_keyix, k->wk_flags, ether_sprintf(k->wk_macaddr));
2326
2327	urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix), 0);
2328	urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix), 0);
2329
2330	/* Clear key. */
2331	for (i = 0; i < 4; i++)
2332		urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i), 0);
2333	sc->keys_bmap &= ~(1 << k->wk_keyix);
2334}
2335
2336static int
2337urtwn_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
2338{
2339	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2340
2341	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2342		/* Not for us. */
2343		return (1);
2344	}
2345
2346	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_set_cb));
2347}
2348
2349static int
2350urtwn_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
2351{
2352	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2353
2354	if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2355		/* Not for us. */
2356		return (1);
2357	}
2358
2359	return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_del_cb));
2360}
2361
2362static void
2363urtwn_tsf_task_adhoc(void *arg, int pending)
2364{
2365	struct ieee80211vap *vap = arg;
2366	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2367	struct ieee80211_node *ni;
2368	uint32_t reg;
2369
2370	URTWN_LOCK(sc);
2371	ni = ieee80211_ref_node(vap->iv_bss);
2372	reg = urtwn_read_1(sc, R92C_BCN_CTRL);
2373
2374	/* Accept beacons with the same BSSID. */
2375	urtwn_set_rx_bssid_all(sc, 0);
2376
2377	/* Enable synchronization. */
2378	reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
2379	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2380
2381	/* Synchronize. */
2382	usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
2383
2384	/* Disable synchronization. */
2385	reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
2386	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2387
2388	/* Remove beacon filter. */
2389	urtwn_set_rx_bssid_all(sc, 1);
2390
2391	/* Enable beaconing. */
2392	urtwn_write_1(sc, R92C_MBID_NUM,
2393	    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2394	reg |= R92C_BCN_CTRL_EN_BCN;
2395
2396	urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2397	ieee80211_free_node(ni);
2398	URTWN_UNLOCK(sc);
2399}
2400
2401static void
2402urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
2403{
2404	struct ieee80211com *ic = &sc->sc_ic;
2405	struct urtwn_vap *uvp = URTWN_VAP(vap);
2406
2407	/* Reset TSF. */
2408	urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2409
2410	switch (vap->iv_opmode) {
2411	case IEEE80211_M_STA:
2412		/* Enable TSF synchronization. */
2413		urtwn_write_1(sc, R92C_BCN_CTRL,
2414		    urtwn_read_1(sc, R92C_BCN_CTRL) &
2415		    ~R92C_BCN_CTRL_DIS_TSF_UDT0);
2416		break;
2417	case IEEE80211_M_IBSS:
2418		ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
2419		break;
2420	case IEEE80211_M_HOSTAP:
2421		/* Enable beaconing. */
2422		urtwn_write_1(sc, R92C_MBID_NUM,
2423		    urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2424		urtwn_write_1(sc, R92C_BCN_CTRL,
2425		    urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
2426		break;
2427	default:
2428		device_printf(sc->sc_dev, "undefined opmode %d\n",
2429		    vap->iv_opmode);
2430		return;
2431	}
2432}
2433
2434static void
2435urtwn_get_tsf(struct urtwn_softc *sc, uint64_t *buf)
2436{
2437	urtwn_read_region_1(sc, R92C_TSFTR, (uint8_t *)buf, sizeof(*buf));
2438}
2439
2440static void
2441urtwn_set_led(struct urtwn_softc *sc, int led, int on)
2442{
2443	uint8_t reg;
2444
2445	if (led == URTWN_LED_LINK) {
2446		if (sc->chip & URTWN_CHIP_88E) {
2447			reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
2448			urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
2449			if (!on) {
2450				reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
2451				urtwn_write_1(sc, R92C_LEDCFG2,
2452				    reg | R92C_LEDCFG0_DIS);
2453				urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
2454				    urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
2455				    0xfe);
2456			}
2457		} else {
2458			reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
2459			if (!on)
2460				reg |= R92C_LEDCFG0_DIS;
2461			urtwn_write_1(sc, R92C_LEDCFG0, reg);
2462		}
2463		sc->ledlink = on;       /* Save LED state. */
2464	}
2465}
2466
2467static void
2468urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
2469{
2470	uint8_t reg;
2471
2472	reg = urtwn_read_1(sc, R92C_MSR);
2473	reg = (reg & ~R92C_MSR_MASK) | mode;
2474	urtwn_write_1(sc, R92C_MSR, reg);
2475}
2476
2477static void
2478urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2479    const struct ieee80211_rx_stats *rxs,
2480    int rssi, int nf)
2481{
2482	struct ieee80211vap *vap = ni->ni_vap;
2483	struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2484	struct urtwn_vap *uvp = URTWN_VAP(vap);
2485	uint64_t ni_tstamp, curr_tstamp;
2486
2487	uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2488
2489	if (vap->iv_state == IEEE80211_S_RUN &&
2490	    (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2491	    subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2492		ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2493		URTWN_LOCK(sc);
2494		urtwn_get_tsf(sc, &curr_tstamp);
2495		URTWN_UNLOCK(sc);
2496		curr_tstamp = le64toh(curr_tstamp);
2497
2498		if (ni_tstamp >= curr_tstamp)
2499			(void) ieee80211_ibss_merge(ni);
2500	}
2501}
2502
2503static int
2504urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2505{
2506	struct urtwn_vap *uvp = URTWN_VAP(vap);
2507	struct ieee80211com *ic = vap->iv_ic;
2508	struct urtwn_softc *sc = ic->ic_softc;
2509	struct ieee80211_node *ni;
2510	enum ieee80211_state ostate;
2511	uint32_t reg;
2512	uint8_t mode;
2513	int error = 0;
2514
2515	ostate = vap->iv_state;
2516	URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s -> %s\n",
2517	    ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
2518
2519	IEEE80211_UNLOCK(ic);
2520	URTWN_LOCK(sc);
2521	callout_stop(&sc->sc_watchdog_ch);
2522
2523	if (ostate == IEEE80211_S_RUN) {
2524		/* Stop calibration. */
2525		callout_stop(&sc->sc_calib_to);
2526
2527		/* Turn link LED off. */
2528		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2529
2530		/* Set media status to 'No Link'. */
2531		urtwn_set_mode(sc, R92C_MSR_NOLINK);
2532
2533		/* Stop Rx of data frames. */
2534		urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2535
2536		/* Disable TSF synchronization. */
2537		urtwn_write_1(sc, R92C_BCN_CTRL,
2538		    (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2539		    R92C_BCN_CTRL_DIS_TSF_UDT0);
2540
2541		/* Disable beaconing. */
2542		urtwn_write_1(sc, R92C_MBID_NUM,
2543		    urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2544
2545		/* Reset TSF. */
2546		urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2547
2548		/* Reset EDCA parameters. */
2549		urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2550		urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2551		urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2552		urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2553	}
2554
2555	switch (nstate) {
2556	case IEEE80211_S_INIT:
2557		/* Turn link LED off. */
2558		urtwn_set_led(sc, URTWN_LED_LINK, 0);
2559		break;
2560	case IEEE80211_S_SCAN:
2561		/* Pause AC Tx queues. */
2562		urtwn_write_1(sc, R92C_TXPAUSE,
2563		    urtwn_read_1(sc, R92C_TXPAUSE) | R92C_TX_QUEUE_AC);
2564		break;
2565	case IEEE80211_S_AUTH:
2566		urtwn_set_chan(sc, ic->ic_curchan, NULL);
2567		break;
2568	case IEEE80211_S_RUN:
2569		if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2570			/* Turn link LED on. */
2571			urtwn_set_led(sc, URTWN_LED_LINK, 1);
2572			break;
2573		}
2574
2575		ni = ieee80211_ref_node(vap->iv_bss);
2576
2577		if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2578		    ni->ni_chan == IEEE80211_CHAN_ANYC) {
2579			device_printf(sc->sc_dev,
2580			    "%s: could not move to RUN state\n", __func__);
2581			error = EINVAL;
2582			goto end_run;
2583		}
2584
2585		switch (vap->iv_opmode) {
2586		case IEEE80211_M_STA:
2587			mode = R92C_MSR_INFRA;
2588			break;
2589		case IEEE80211_M_IBSS:
2590			mode = R92C_MSR_ADHOC;
2591			break;
2592		case IEEE80211_M_HOSTAP:
2593			mode = R92C_MSR_AP;
2594			break;
2595		default:
2596			device_printf(sc->sc_dev, "undefined opmode %d\n",
2597			    vap->iv_opmode);
2598			error = EINVAL;
2599			goto end_run;
2600		}
2601
2602		/* Set media status to 'Associated'. */
2603		urtwn_set_mode(sc, mode);
2604
2605		/* Set BSSID. */
2606		urtwn_write_4(sc, R92C_BSSID + 0, le32dec(&ni->ni_bssid[0]));
2607		urtwn_write_4(sc, R92C_BSSID + 4, le16dec(&ni->ni_bssid[4]));
2608
2609		if (ic->ic_curmode == IEEE80211_MODE_11B)
2610			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2611		else	/* 802.11b/g */
2612			urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2613
2614		/* Enable Rx of data frames. */
2615		urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2616
2617		/* Flush all AC queues. */
2618		urtwn_write_1(sc, R92C_TXPAUSE, 0);
2619
2620		/* Set beacon interval. */
2621		urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2622
2623		/* Allow Rx from our BSSID only. */
2624		if (ic->ic_promisc == 0) {
2625			reg = urtwn_read_4(sc, R92C_RCR);
2626
2627			if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2628				reg |= R92C_RCR_CBSSID_DATA;
2629			if (vap->iv_opmode != IEEE80211_M_IBSS)
2630				reg |= R92C_RCR_CBSSID_BCN;
2631
2632			urtwn_write_4(sc, R92C_RCR, reg);
2633		}
2634
2635		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2636		    vap->iv_opmode == IEEE80211_M_IBSS) {
2637			error = urtwn_setup_beacon(sc, ni);
2638			if (error != 0) {
2639				device_printf(sc->sc_dev,
2640				    "unable to push beacon into the chip, "
2641				    "error %d\n", error);
2642				goto end_run;
2643			}
2644		}
2645
2646		/* Enable TSF synchronization. */
2647		urtwn_tsf_sync_enable(sc, vap);
2648
2649		urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2650		urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2651		urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2652		urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2653		urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2654		urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2655
2656		/* Intialize rate adaptation. */
2657		if (!(sc->chip & URTWN_CHIP_88E))
2658			urtwn_ra_init(sc);
2659		/* Turn link LED on. */
2660		urtwn_set_led(sc, URTWN_LED_LINK, 1);
2661
2662		sc->avg_pwdb = -1;	/* Reset average RSSI. */
2663		/* Reset temperature calibration state machine. */
2664		sc->sc_flags &= ~URTWN_TEMP_MEASURED;
2665		sc->thcal_lctemp = 0;
2666		/* Start periodic calibration. */
2667		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2668
2669end_run:
2670		ieee80211_free_node(ni);
2671		break;
2672	default:
2673		break;
2674	}
2675
2676	URTWN_UNLOCK(sc);
2677	IEEE80211_LOCK(ic);
2678	return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2679}
2680
2681static void
2682urtwn_calib_to(void *arg)
2683{
2684	struct urtwn_softc *sc = arg;
2685
2686	/* Do it in a process context. */
2687	urtwn_cmd_sleepable(sc, NULL, 0, urtwn_calib_cb);
2688}
2689
2690static void
2691urtwn_calib_cb(struct urtwn_softc *sc, union sec_param *data)
2692{
2693	/* Do temperature compensation. */
2694	urtwn_temp_calib(sc);
2695
2696	if ((urtwn_read_1(sc, R92C_MSR) & R92C_MSR_MASK) != R92C_MSR_NOLINK)
2697		callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2698}
2699
2700static void
2701urtwn_watchdog(void *arg)
2702{
2703	struct urtwn_softc *sc = arg;
2704
2705	if (sc->sc_txtimer > 0) {
2706		if (--sc->sc_txtimer == 0) {
2707			device_printf(sc->sc_dev, "device timeout\n");
2708			counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2709			return;
2710		}
2711		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2712	}
2713}
2714
2715static void
2716urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2717{
2718	int pwdb;
2719
2720	/* Convert antenna signal to percentage. */
2721	if (rssi <= -100 || rssi >= 20)
2722		pwdb = 0;
2723	else if (rssi >= 0)
2724		pwdb = 100;
2725	else
2726		pwdb = 100 + rssi;
2727	if (!(sc->chip & URTWN_CHIP_88E)) {
2728		if (rate <= URTWN_RIDX_CCK11) {
2729			/* CCK gain is smaller than OFDM/MCS gain. */
2730			pwdb += 6;
2731			if (pwdb > 100)
2732				pwdb = 100;
2733			if (pwdb <= 14)
2734				pwdb -= 4;
2735			else if (pwdb <= 26)
2736				pwdb -= 8;
2737			else if (pwdb <= 34)
2738				pwdb -= 6;
2739			else if (pwdb <= 42)
2740				pwdb -= 2;
2741		}
2742	}
2743	if (sc->avg_pwdb == -1)	/* Init. */
2744		sc->avg_pwdb = pwdb;
2745	else if (sc->avg_pwdb < pwdb)
2746		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2747	else
2748		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2749	URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: PWDB %d, EMA %d\n", __func__,
2750	    pwdb, sc->avg_pwdb);
2751}
2752
2753static int8_t
2754urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2755{
2756	static const int8_t cckoff[] = { 16, -12, -26, -46 };
2757	struct r92c_rx_phystat *phy;
2758	struct r92c_rx_cck *cck;
2759	uint8_t rpt;
2760	int8_t rssi;
2761
2762	if (rate <= URTWN_RIDX_CCK11) {
2763		cck = (struct r92c_rx_cck *)physt;
2764		if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2765			rpt = (cck->agc_rpt >> 5) & 0x3;
2766			rssi = (cck->agc_rpt & 0x1f) << 1;
2767		} else {
2768			rpt = (cck->agc_rpt >> 6) & 0x3;
2769			rssi = cck->agc_rpt & 0x3e;
2770		}
2771		rssi = cckoff[rpt] - rssi;
2772	} else {	/* OFDM/HT. */
2773		phy = (struct r92c_rx_phystat *)physt;
2774		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2775	}
2776	return (rssi);
2777}
2778
2779static int8_t
2780urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2781{
2782	struct r92c_rx_phystat *phy;
2783	struct r88e_rx_cck *cck;
2784	uint8_t cck_agc_rpt, lna_idx, vga_idx;
2785	int8_t rssi;
2786
2787	rssi = 0;
2788	if (rate <= URTWN_RIDX_CCK11) {
2789		cck = (struct r88e_rx_cck *)physt;
2790		cck_agc_rpt = cck->agc_rpt;
2791		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2792		vga_idx = cck_agc_rpt & 0x1f;
2793		switch (lna_idx) {
2794		case 7:
2795			if (vga_idx <= 27)
2796				rssi = -100 + 2* (27 - vga_idx);
2797			else
2798				rssi = -100;
2799			break;
2800		case 6:
2801			rssi = -48 + 2 * (2 - vga_idx);
2802			break;
2803		case 5:
2804			rssi = -42 + 2 * (7 - vga_idx);
2805			break;
2806		case 4:
2807			rssi = -36 + 2 * (7 - vga_idx);
2808			break;
2809		case 3:
2810			rssi = -24 + 2 * (7 - vga_idx);
2811			break;
2812		case 2:
2813			rssi = -12 + 2 * (5 - vga_idx);
2814			break;
2815		case 1:
2816			rssi = 8 - (2 * vga_idx);
2817			break;
2818		case 0:
2819			rssi = 14 - (2 * vga_idx);
2820			break;
2821		}
2822		rssi += 6;
2823	} else {	/* OFDM/HT. */
2824		phy = (struct r92c_rx_phystat *)physt;
2825		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2826	}
2827	return (rssi);
2828}
2829
2830static int
2831urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2832    struct mbuf *m, struct urtwn_data *data)
2833{
2834	const struct ieee80211_txparam *tp;
2835	struct ieee80211com *ic = &sc->sc_ic;
2836	struct ieee80211vap *vap = ni->ni_vap;
2837	struct ieee80211_key *k = NULL;
2838	struct ieee80211_channel *chan;
2839	struct ieee80211_frame *wh;
2840	struct r92c_tx_desc *txd;
2841	uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2842	int hasqos, ismcast;
2843
2844	URTWN_ASSERT_LOCKED(sc);
2845
2846	/*
2847	 * Software crypto.
2848	 */
2849	wh = mtod(m, struct ieee80211_frame *);
2850	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2851	subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2852	hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2853	ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2854
2855	/* Select TX ring for this frame. */
2856	if (hasqos) {
2857		tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2858		tid &= IEEE80211_QOS_TID;
2859	} else
2860		tid = 0;
2861
2862	chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2863		ni->ni_chan : ic->ic_curchan;
2864	tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2865
2866	/* Choose a TX rate index. */
2867	if (type == IEEE80211_FC0_TYPE_MGT)
2868		rate = tp->mgmtrate;
2869	else if (ismcast)
2870		rate = tp->mcastrate;
2871	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2872		rate = tp->ucastrate;
2873	else if (m->m_flags & M_EAPOL)
2874		rate = tp->mgmtrate;
2875	else {
2876		if (URTWN_CHIP_HAS_RATECTL(sc)) {
2877			/* XXX pass pktlen */
2878			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2879			rate = ni->ni_txrate;
2880		} else {
2881			/* XXX TODO: drop the default rate for 11b/11g? */
2882			if (ni->ni_flags & IEEE80211_NODE_HT)
2883				rate = IEEE80211_RATE_MCS | 0x4; /* MCS4 */
2884			else if (ic->ic_curmode != IEEE80211_MODE_11B)
2885				rate = 108;
2886			else
2887				rate = 22;
2888		}
2889	}
2890
2891	/*
2892	 * XXX TODO: this should be per-node, for 11b versus 11bg
2893	 * nodes in hostap mode
2894	 */
2895	ridx = rate2ridx(rate);
2896	if (ni->ni_flags & IEEE80211_NODE_HT)
2897		raid = R92C_RAID_11GN;
2898	else if (ic->ic_curmode != IEEE80211_MODE_11B)
2899		raid = R92C_RAID_11BG;
2900	else
2901		raid = R92C_RAID_11B;
2902
2903	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2904		k = ieee80211_crypto_encap(ni, m);
2905		if (k == NULL) {
2906			device_printf(sc->sc_dev,
2907			    "ieee80211_crypto_encap returns NULL.\n");
2908			return (ENOBUFS);
2909		}
2910
2911		/* in case packet header moved, reset pointer */
2912		wh = mtod(m, struct ieee80211_frame *);
2913	}
2914
2915	/* Fill Tx descriptor. */
2916	txd = (struct r92c_tx_desc *)data->buf;
2917	memset(txd, 0, sizeof(*txd));
2918
2919	txd->txdw0 |= htole32(
2920	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2921	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2922	if (ismcast)
2923		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2924
2925	if (!ismcast) {
2926		if (sc->chip & URTWN_CHIP_88E) {
2927			struct urtwn_node *un = URTWN_NODE(ni);
2928			macid = un->id;
2929		} else
2930			macid = URTWN_MACID_BSS;
2931
2932		if (type == IEEE80211_FC0_TYPE_DATA) {
2933			qsel = tid % URTWN_MAX_TID;
2934
2935			if (sc->chip & URTWN_CHIP_88E) {
2936				txd->txdw2 |= htole32(
2937				    R88E_TXDW2_AGGBK |
2938				    R88E_TXDW2_CCX_RPT);
2939			} else
2940				txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2941
2942			/* protmode, non-HT */
2943			/* XXX TODO: noack frames? */
2944			if ((rate & 0x80) == 0 &&
2945			    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2946				switch (ic->ic_protmode) {
2947				case IEEE80211_PROT_CTSONLY:
2948					txd->txdw4 |= htole32(
2949					    R92C_TXDW4_CTS2SELF |
2950					    R92C_TXDW4_HWRTSEN);
2951					break;
2952				case IEEE80211_PROT_RTSCTS:
2953					txd->txdw4 |= htole32(
2954					    R92C_TXDW4_RTSEN |
2955					    R92C_TXDW4_HWRTSEN);
2956					break;
2957				default:
2958					break;
2959				}
2960			}
2961
2962			/* protmode, HT */
2963			/* XXX TODO: noack frames? */
2964			if ((rate & 0x80) &&
2965			    (ic->ic_htprotmode == IEEE80211_PROT_RTSCTS)) {
2966				txd->txdw4 |= htole32(
2967				    R92C_TXDW4_RTSEN |
2968				    R92C_TXDW4_HWRTSEN);
2969			}
2970
2971			/* XXX TODO: rtsrate is configurable? 24mbit may
2972			 * be a bit high for RTS rate? */
2973			txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
2974			    URTWN_RIDX_OFDM24));
2975
2976			txd->txdw5 |= htole32(0x0001ff00);
2977		} else	/* IEEE80211_FC0_TYPE_MGT */
2978			qsel = R92C_TXDW1_QSEL_MGNT;
2979	} else {
2980		macid = URTWN_MACID_BC;
2981		qsel = R92C_TXDW1_QSEL_MGNT;
2982	}
2983
2984	txd->txdw1 |= htole32(
2985	    SM(R92C_TXDW1_QSEL, qsel) |
2986	    SM(R92C_TXDW1_RAID, raid));
2987
2988	/* XXX TODO: 40MHZ flag? */
2989	/* XXX TODO: AMPDU flag? (AGG_ENABLE or AGG_BREAK?) Density shift? */
2990	/* XXX Short preamble? */
2991	/* XXX Short-GI? */
2992
2993	if (sc->chip & URTWN_CHIP_88E)
2994		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
2995	else
2996		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
2997
2998	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
2999
3000	/* Force this rate if needed. */
3001	if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
3002	    (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) ||
3003	    (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
3004		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3005
3006	if (!hasqos) {
3007		/* Use HW sequence numbering for non-QoS frames. */
3008		if (sc->chip & URTWN_CHIP_88E)
3009			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3010		else
3011			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3012	} else {
3013		/* Set sequence number. */
3014		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3015	}
3016
3017	if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3018		uint8_t cipher;
3019
3020		switch (k->wk_cipher->ic_cipher) {
3021		case IEEE80211_CIPHER_WEP:
3022		case IEEE80211_CIPHER_TKIP:
3023			cipher = R92C_TXDW1_CIPHER_RC4;
3024			break;
3025		case IEEE80211_CIPHER_AES_CCM:
3026			cipher = R92C_TXDW1_CIPHER_AES;
3027			break;
3028		default:
3029			device_printf(sc->sc_dev, "%s: unknown cipher %d\n",
3030			    __func__, k->wk_cipher->ic_cipher);
3031			return (EINVAL);
3032		}
3033
3034		txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3035	}
3036
3037	if (ieee80211_radiotap_active_vap(vap)) {
3038		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3039
3040		tap->wt_flags = 0;
3041		if (k != NULL)
3042			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3043		ieee80211_radiotap_tx(vap, m);
3044	}
3045
3046	data->ni = ni;
3047
3048	urtwn_tx_start(sc, m, type, data);
3049
3050	return (0);
3051}
3052
3053static int
3054urtwn_tx_raw(struct urtwn_softc *sc, struct ieee80211_node *ni,
3055    struct mbuf *m, struct urtwn_data *data,
3056    const struct ieee80211_bpf_params *params)
3057{
3058	struct ieee80211vap *vap = ni->ni_vap;
3059	struct ieee80211_key *k = NULL;
3060	struct ieee80211_frame *wh;
3061	struct r92c_tx_desc *txd;
3062	uint8_t cipher, ridx, type;
3063
3064	/* Encrypt the frame if need be. */
3065	cipher = R92C_TXDW1_CIPHER_NONE;
3066	if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
3067		/* Retrieve key for TX. */
3068		k = ieee80211_crypto_encap(ni, m);
3069		if (k == NULL)
3070			return (ENOBUFS);
3071
3072		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3073			switch (k->wk_cipher->ic_cipher) {
3074			case IEEE80211_CIPHER_WEP:
3075			case IEEE80211_CIPHER_TKIP:
3076				cipher = R92C_TXDW1_CIPHER_RC4;
3077				break;
3078			case IEEE80211_CIPHER_AES_CCM:
3079				cipher = R92C_TXDW1_CIPHER_AES;
3080				break;
3081			default:
3082				device_printf(sc->sc_dev,
3083				    "%s: unknown cipher %d\n",
3084				    __func__, k->wk_cipher->ic_cipher);
3085				return (EINVAL);
3086			}
3087		}
3088	}
3089
3090	/* XXX TODO: 11n checks, matching urtwn_tx_data() */
3091
3092	wh = mtod(m, struct ieee80211_frame *);
3093	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3094
3095	/* Fill Tx descriptor. */
3096	txd = (struct r92c_tx_desc *)data->buf;
3097	memset(txd, 0, sizeof(*txd));
3098
3099	txd->txdw0 |= htole32(
3100	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
3101	    R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
3102	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3103		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
3104
3105	if (params->ibp_flags & IEEE80211_BPF_RTS)
3106		txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
3107	if (params->ibp_flags & IEEE80211_BPF_CTS)
3108		txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
3109	if (txd->txdw4 & htole32(R92C_TXDW4_RTSEN | R92C_TXDW4_CTS2SELF)) {
3110		txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
3111		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
3112		    URTWN_RIDX_OFDM24));
3113	}
3114
3115	if (sc->chip & URTWN_CHIP_88E)
3116		txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
3117	else
3118		txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
3119
3120	/* XXX TODO: rate index/config (RAID) for 11n? */
3121	txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
3122	txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3123
3124	/* Choose a TX rate index. */
3125	ridx = rate2ridx(params->ibp_rate0);
3126	txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3127	txd->txdw5 |= htole32(0x0001ff00);
3128	txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3129
3130	if (!IEEE80211_QOS_HAS_SEQ(wh)) {
3131		/* Use HW sequence numbering for non-QoS frames. */
3132		if (sc->chip & URTWN_CHIP_88E)
3133			txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3134		else
3135			txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3136	} else {
3137		/* Set sequence number. */
3138		txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3139	}
3140
3141	if (ieee80211_radiotap_active_vap(vap)) {
3142		struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3143
3144		tap->wt_flags = 0;
3145		if (k != NULL)
3146			tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3147		ieee80211_radiotap_tx(vap, m);
3148	}
3149
3150	data->ni = ni;
3151
3152	urtwn_tx_start(sc, m, type, data);
3153
3154	return (0);
3155}
3156
3157static void
3158urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
3159    struct urtwn_data *data)
3160{
3161	struct usb_xfer *xfer;
3162	struct r92c_tx_desc *txd;
3163	uint16_t ac, sum;
3164	int i, xferlen;
3165
3166	URTWN_ASSERT_LOCKED(sc);
3167
3168	ac = M_WME_GETAC(m);
3169
3170	switch (type) {
3171	case IEEE80211_FC0_TYPE_CTL:
3172	case IEEE80211_FC0_TYPE_MGT:
3173		xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
3174		break;
3175	default:
3176		xfer = sc->sc_xfer[wme2queue[ac].qid];
3177		break;
3178	}
3179
3180	txd = (struct r92c_tx_desc *)data->buf;
3181	txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
3182
3183	/* Compute Tx descriptor checksum. */
3184	sum = 0;
3185	for (i = 0; i < sizeof(*txd) / 2; i++)
3186		sum ^= ((uint16_t *)txd)[i];
3187	txd->txdsum = sum;	/* NB: already little endian. */
3188
3189	xferlen = sizeof(*txd) + m->m_pkthdr.len;
3190	m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
3191
3192	data->buflen = xferlen;
3193	data->m = m;
3194
3195	STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
3196	usbd_transfer_start(xfer);
3197}
3198
3199static int
3200urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
3201{
3202	struct urtwn_softc *sc = ic->ic_softc;
3203	int error;
3204
3205	URTWN_LOCK(sc);
3206	if ((sc->sc_flags & URTWN_RUNNING) == 0) {
3207		URTWN_UNLOCK(sc);
3208		return (ENXIO);
3209	}
3210	error = mbufq_enqueue(&sc->sc_snd, m);
3211	if (error) {
3212		URTWN_UNLOCK(sc);
3213		return (error);
3214	}
3215	urtwn_start(sc);
3216	URTWN_UNLOCK(sc);
3217
3218	return (0);
3219}
3220
3221static void
3222urtwn_start(struct urtwn_softc *sc)
3223{
3224	struct ieee80211_node *ni;
3225	struct mbuf *m;
3226	struct urtwn_data *bf;
3227
3228	URTWN_ASSERT_LOCKED(sc);
3229	while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3230		bf = urtwn_getbuf(sc);
3231		if (bf == NULL) {
3232			mbufq_prepend(&sc->sc_snd, m);
3233			break;
3234		}
3235		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3236		m->m_pkthdr.rcvif = NULL;
3237
3238		URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
3239		    __func__,
3240		    m);
3241
3242		if (urtwn_tx_data(sc, ni, m, bf) != 0) {
3243			if_inc_counter(ni->ni_vap->iv_ifp,
3244			    IFCOUNTER_OERRORS, 1);
3245			STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3246			m_freem(m);
3247			ieee80211_free_node(ni);
3248			break;
3249		}
3250		sc->sc_txtimer = 5;
3251		callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3252	}
3253}
3254
3255static void
3256urtwn_parent(struct ieee80211com *ic)
3257{
3258	struct urtwn_softc *sc = ic->ic_softc;
3259
3260	URTWN_LOCK(sc);
3261	if (sc->sc_flags & URTWN_DETACHED) {
3262		URTWN_UNLOCK(sc);
3263		return;
3264	}
3265	URTWN_UNLOCK(sc);
3266
3267	if (ic->ic_nrunning > 0) {
3268		if (urtwn_init(sc) != 0) {
3269			struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3270			if (vap != NULL)
3271				ieee80211_stop(vap);
3272		} else
3273			ieee80211_start_all(ic);
3274	} else
3275		urtwn_stop(sc);
3276}
3277
3278static __inline int
3279urtwn_power_on(struct urtwn_softc *sc)
3280{
3281
3282	return sc->sc_power_on(sc);
3283}
3284
3285static int
3286urtwn_r92c_power_on(struct urtwn_softc *sc)
3287{
3288	uint32_t reg;
3289	usb_error_t error;
3290	int ntries;
3291
3292	/* Wait for autoload done bit. */
3293	for (ntries = 0; ntries < 1000; ntries++) {
3294		if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
3295			break;
3296		urtwn_ms_delay(sc);
3297	}
3298	if (ntries == 1000) {
3299		device_printf(sc->sc_dev,
3300		    "timeout waiting for chip autoload\n");
3301		return (ETIMEDOUT);
3302	}
3303
3304	/* Unlock ISO/CLK/Power control register. */
3305	error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
3306	if (error != USB_ERR_NORMAL_COMPLETION)
3307		return (EIO);
3308	/* Move SPS into PWM mode. */
3309	error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
3310	if (error != USB_ERR_NORMAL_COMPLETION)
3311		return (EIO);
3312	urtwn_ms_delay(sc);
3313
3314	reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
3315	if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
3316		error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3317		    reg | R92C_LDOV12D_CTRL_LDV12_EN);
3318		if (error != USB_ERR_NORMAL_COMPLETION)
3319			return (EIO);
3320		urtwn_ms_delay(sc);
3321		error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3322		    urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
3323		    ~R92C_SYS_ISO_CTRL_MD2PP);
3324		if (error != USB_ERR_NORMAL_COMPLETION)
3325			return (EIO);
3326	}
3327
3328	/* Auto enable WLAN. */
3329	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3330	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3331	if (error != USB_ERR_NORMAL_COMPLETION)
3332		return (EIO);
3333	for (ntries = 0; ntries < 1000; ntries++) {
3334		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3335		    R92C_APS_FSMCO_APFM_ONMAC))
3336			break;
3337		urtwn_ms_delay(sc);
3338	}
3339	if (ntries == 1000) {
3340		device_printf(sc->sc_dev,
3341		    "timeout waiting for MAC auto ON\n");
3342		return (ETIMEDOUT);
3343	}
3344
3345	/* Enable radio, GPIO and LED functions. */
3346	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3347	    R92C_APS_FSMCO_AFSM_HSUS |
3348	    R92C_APS_FSMCO_PDN_EN |
3349	    R92C_APS_FSMCO_PFM_ALDN);
3350	if (error != USB_ERR_NORMAL_COMPLETION)
3351		return (EIO);
3352	/* Release RF digital isolation. */
3353	error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
3354	    urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
3355	if (error != USB_ERR_NORMAL_COMPLETION)
3356		return (EIO);
3357
3358	/* Initialize MAC. */
3359	error = urtwn_write_1(sc, R92C_APSD_CTRL,
3360	    urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
3361	if (error != USB_ERR_NORMAL_COMPLETION)
3362		return (EIO);
3363	for (ntries = 0; ntries < 200; ntries++) {
3364		if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
3365		    R92C_APSD_CTRL_OFF_STATUS))
3366			break;
3367		urtwn_ms_delay(sc);
3368	}
3369	if (ntries == 200) {
3370		device_printf(sc->sc_dev,
3371		    "timeout waiting for MAC initialization\n");
3372		return (ETIMEDOUT);
3373	}
3374
3375	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3376	reg = urtwn_read_2(sc, R92C_CR);
3377	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3378	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3379	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3380	    R92C_CR_ENSEC;
3381	error = urtwn_write_2(sc, R92C_CR, reg);
3382	if (error != USB_ERR_NORMAL_COMPLETION)
3383		return (EIO);
3384
3385	error = urtwn_write_1(sc, 0xfe10, 0x19);
3386	if (error != USB_ERR_NORMAL_COMPLETION)
3387		return (EIO);
3388	return (0);
3389}
3390
3391static int
3392urtwn_r88e_power_on(struct urtwn_softc *sc)
3393{
3394	uint32_t reg;
3395	usb_error_t error;
3396	int ntries;
3397
3398	/* Wait for power ready bit. */
3399	for (ntries = 0; ntries < 5000; ntries++) {
3400		if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
3401			break;
3402		urtwn_ms_delay(sc);
3403	}
3404	if (ntries == 5000) {
3405		device_printf(sc->sc_dev,
3406		    "timeout waiting for chip power up\n");
3407		return (ETIMEDOUT);
3408	}
3409
3410	/* Reset BB. */
3411	error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3412	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
3413	    R92C_SYS_FUNC_EN_BB_GLB_RST));
3414	if (error != USB_ERR_NORMAL_COMPLETION)
3415		return (EIO);
3416
3417	error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3418	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3419	if (error != USB_ERR_NORMAL_COMPLETION)
3420		return (EIO);
3421
3422	/* Disable HWPDN. */
3423	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3424	    urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
3425	if (error != USB_ERR_NORMAL_COMPLETION)
3426		return (EIO);
3427
3428	/* Disable WL suspend. */
3429	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3430	    urtwn_read_2(sc, R92C_APS_FSMCO) &
3431	    ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
3432	if (error != USB_ERR_NORMAL_COMPLETION)
3433		return (EIO);
3434
3435	error = urtwn_write_2(sc, R92C_APS_FSMCO,
3436	    urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3437	if (error != USB_ERR_NORMAL_COMPLETION)
3438		return (EIO);
3439	for (ntries = 0; ntries < 5000; ntries++) {
3440		if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3441		    R92C_APS_FSMCO_APFM_ONMAC))
3442			break;
3443		urtwn_ms_delay(sc);
3444	}
3445	if (ntries == 5000)
3446		return (ETIMEDOUT);
3447
3448	/* Enable LDO normal mode. */
3449	error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
3450	    urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~R92C_LPLDO_CTRL_SLEEP);
3451	if (error != USB_ERR_NORMAL_COMPLETION)
3452		return (EIO);
3453
3454	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3455	error = urtwn_write_2(sc, R92C_CR, 0);
3456	if (error != USB_ERR_NORMAL_COMPLETION)
3457		return (EIO);
3458	reg = urtwn_read_2(sc, R92C_CR);
3459	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3460	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3461	    R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
3462	error = urtwn_write_2(sc, R92C_CR, reg);
3463	if (error != USB_ERR_NORMAL_COMPLETION)
3464		return (EIO);
3465
3466	return (0);
3467}
3468
3469static __inline void
3470urtwn_power_off(struct urtwn_softc *sc)
3471{
3472
3473	return sc->sc_power_off(sc);
3474}
3475
3476static void
3477urtwn_r92c_power_off(struct urtwn_softc *sc)
3478{
3479	uint32_t reg;
3480
3481	/* Block all Tx queues. */
3482	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3483
3484	/* Disable RF */
3485	urtwn_rf_write(sc, 0, 0, 0);
3486
3487	urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
3488
3489	/* Reset BB state machine */
3490	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3491	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA |
3492	    R92C_SYS_FUNC_EN_BB_GLB_RST);
3493	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3494	    R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
3495
3496	/*
3497	 * Reset digital sequence
3498	 */
3499#ifndef URTWN_WITHOUT_UCODE
3500	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
3501		/* Reset MCU ready status */
3502		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3503
3504		/* If firmware in ram code, do reset */
3505		urtwn_fw_reset(sc);
3506	}
3507#endif
3508
3509	/* Reset MAC and Enable 8051 */
3510	urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1,
3511	    (R92C_SYS_FUNC_EN_CPUEN |
3512	     R92C_SYS_FUNC_EN_ELDR |
3513	     R92C_SYS_FUNC_EN_HWPDN) >> 8);
3514
3515	/* Reset MCU ready status */
3516	urtwn_write_1(sc, R92C_MCUFWDL, 0);
3517
3518	/* Disable MAC clock */
3519	urtwn_write_2(sc, R92C_SYS_CLKR,
3520	    R92C_SYS_CLKR_ANAD16V_EN |
3521	    R92C_SYS_CLKR_ANA8M |
3522	    R92C_SYS_CLKR_LOADER_EN |
3523	    R92C_SYS_CLKR_80M_SSC_DIS |
3524	    R92C_SYS_CLKR_SYS_EN |
3525	    R92C_SYS_CLKR_RING_EN |
3526	    0x4000);
3527
3528	/* Disable AFE PLL */
3529	urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80);
3530
3531	/* Gated AFE DIG_CLOCK */
3532	urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880F);
3533
3534	/* Isolated digital to PON */
3535	urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3536	    R92C_SYS_ISO_CTRL_MD2PP |
3537	    R92C_SYS_ISO_CTRL_PA2PCIE |
3538	    R92C_SYS_ISO_CTRL_PD2CORE |
3539	    R92C_SYS_ISO_CTRL_IP2MAC |
3540	    R92C_SYS_ISO_CTRL_DIOP |
3541	    R92C_SYS_ISO_CTRL_DIOE);
3542
3543	/*
3544	 * Pull GPIO PIN to balance level and LED control
3545	 */
3546	/* 1. Disable GPIO[7:0] */
3547	urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000);
3548
3549	reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00;
3550	reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000;
3551	urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg);
3552
3553	/* Disable GPIO[10:8] */
3554	urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00);
3555
3556	reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0;
3557	reg |= (((reg & 0x000f) << 4) | 0x0780);
3558	urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg);
3559
3560	/* Disable LED0 & 1 */
3561	urtwn_write_2(sc, R92C_LEDCFG0, 0x8080);
3562
3563	/*
3564	 * Reset digital sequence
3565	 */
3566	/* Disable ELDR clock */
3567	urtwn_write_2(sc, R92C_SYS_CLKR,
3568	    R92C_SYS_CLKR_ANAD16V_EN |
3569	    R92C_SYS_CLKR_ANA8M |
3570	    R92C_SYS_CLKR_LOADER_EN |
3571	    R92C_SYS_CLKR_80M_SSC_DIS |
3572	    R92C_SYS_CLKR_SYS_EN |
3573	    R92C_SYS_CLKR_RING_EN |
3574	    0x4000);
3575
3576	/* Isolated ELDR to PON */
3577	urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1,
3578	    (R92C_SYS_ISO_CTRL_DIOR |
3579	     R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8);
3580
3581	/*
3582	 * Disable analog sequence
3583	 */
3584	/* Disable A15 power */
3585	urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF);
3586	/* Disable digital core power */
3587	urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3588	    urtwn_read_1(sc, R92C_LDOV12D_CTRL) &
3589	      ~R92C_LDOV12D_CTRL_LDV12_EN);
3590
3591	/* Enter PFM mode */
3592	urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
3593
3594	/* Set USB suspend */
3595	urtwn_write_2(sc, R92C_APS_FSMCO,
3596	    R92C_APS_FSMCO_APDM_HOST |
3597	    R92C_APS_FSMCO_AFSM_HSUS |
3598	    R92C_APS_FSMCO_PFM_ALDN);
3599
3600	/* Lock ISO/CLK/Power control register. */
3601	urtwn_write_1(sc, R92C_RSV_CTRL, 0x0E);
3602}
3603
3604static void
3605urtwn_r88e_power_off(struct urtwn_softc *sc)
3606{
3607	uint8_t reg;
3608	int ntries;
3609
3610	/* Disable any kind of TX reports. */
3611	urtwn_write_1(sc, R88E_TX_RPT_CTRL,
3612	    urtwn_read_1(sc, R88E_TX_RPT_CTRL) &
3613	      ~(R88E_TX_RPT1_ENA | R88E_TX_RPT2_ENA));
3614
3615	/* Stop Rx. */
3616	urtwn_write_1(sc, R92C_CR, 0);
3617
3618	/* Move card to Low Power State. */
3619	/* Block all Tx queues. */
3620	urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3621
3622	for (ntries = 0; ntries < 20; ntries++) {
3623		/* Should be zero if no packet is transmitting. */
3624		if (urtwn_read_4(sc, R88E_SCH_TXCMD) == 0)
3625			break;
3626
3627		urtwn_ms_delay(sc);
3628	}
3629	if (ntries == 20) {
3630		device_printf(sc->sc_dev, "%s: failed to block Tx queues\n",
3631		    __func__);
3632		return;
3633	}
3634
3635	/* CCK and OFDM are disabled, and clock are gated. */
3636	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3637	    urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~R92C_SYS_FUNC_EN_BBRSTB);
3638
3639	urtwn_ms_delay(sc);
3640
3641	/* Reset MAC TRX */
3642	urtwn_write_1(sc, R92C_CR,
3643	    R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3644	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN |
3645	    R92C_CR_PROTOCOL_EN | R92C_CR_SCHEDULE_EN);
3646
3647	/* check if removed later */
3648	urtwn_write_1(sc, R92C_CR + 1,
3649	    urtwn_read_1(sc, R92C_CR + 1) & ~(R92C_CR_ENSEC >> 8));
3650
3651	/* Respond TxOK to scheduler */
3652	urtwn_write_1(sc, R92C_DUAL_TSF_RST,
3653	    urtwn_read_1(sc, R92C_DUAL_TSF_RST) | 0x20);
3654
3655	/* If firmware in ram code, do reset. */
3656#ifndef URTWN_WITHOUT_UCODE
3657	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY)
3658		urtwn_r88e_fw_reset(sc);
3659#endif
3660
3661	/* Reset MCU ready status. */
3662	urtwn_write_1(sc, R92C_MCUFWDL, 0x00);
3663
3664	/* Disable 32k. */
3665	urtwn_write_1(sc, R88E_32K_CTRL,
3666	    urtwn_read_1(sc, R88E_32K_CTRL) & ~0x01);
3667
3668	/* Move card to Disabled state. */
3669	/* Turn off RF. */
3670	urtwn_write_1(sc, R92C_RF_CTRL, 0);
3671
3672	/* LDO Sleep mode. */
3673	urtwn_write_1(sc, R92C_LPLDO_CTRL,
3674	    urtwn_read_1(sc, R92C_LPLDO_CTRL) | R92C_LPLDO_CTRL_SLEEP);
3675
3676	/* Turn off MAC by HW state machine */
3677	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3678	    urtwn_read_1(sc, R92C_APS_FSMCO + 1) |
3679	    (R92C_APS_FSMCO_APFM_OFF >> 8));
3680
3681	for (ntries = 0; ntries < 20; ntries++) {
3682		/* Wait until it will be disabled. */
3683		if ((urtwn_read_1(sc, R92C_APS_FSMCO + 1) &
3684		    (R92C_APS_FSMCO_APFM_OFF >> 8)) == 0)
3685			break;
3686
3687		urtwn_ms_delay(sc);
3688	}
3689	if (ntries == 20) {
3690		device_printf(sc->sc_dev, "%s: could not turn off MAC\n",
3691		    __func__);
3692		return;
3693	}
3694
3695	/* schmit trigger */
3696	urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3697	    urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3698
3699	/* Enable WL suspend. */
3700	urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3701	    (urtwn_read_1(sc, R92C_APS_FSMCO + 1) & ~0x10) | 0x08);
3702
3703	/* Enable bandgap mbias in suspend. */
3704	urtwn_write_1(sc, R92C_APS_FSMCO + 3, 0);
3705
3706	/* Clear SIC_EN register. */
3707	urtwn_write_1(sc, R92C_GPIO_MUXCFG + 1,
3708	    urtwn_read_1(sc, R92C_GPIO_MUXCFG + 1) & ~0x10);
3709
3710	/* Set USB suspend enable local register */
3711	urtwn_write_1(sc, R92C_USB_SUSPEND,
3712	    urtwn_read_1(sc, R92C_USB_SUSPEND) | 0x10);
3713
3714	/* Reset MCU IO Wrapper. */
3715	reg = urtwn_read_1(sc, R92C_RSV_CTRL + 1);
3716	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg & ~0x08);
3717	urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg | 0x08);
3718
3719	/* marked as 'For Power Consumption' code. */
3720	urtwn_write_1(sc, R92C_GPIO_OUT, urtwn_read_1(sc, R92C_GPIO_IN));
3721	urtwn_write_1(sc, R92C_GPIO_IOSEL, 0xff);
3722
3723	urtwn_write_1(sc, R92C_GPIO_IO_SEL,
3724	    urtwn_read_1(sc, R92C_GPIO_IO_SEL) << 4);
3725	urtwn_write_1(sc, R92C_GPIO_MOD,
3726	    urtwn_read_1(sc, R92C_GPIO_MOD) | 0x0f);
3727
3728	/* Set LNA, TRSW, EX_PA Pin to output mode. */
3729	urtwn_write_4(sc, R88E_BB_PAD_CTRL, 0x00080808);
3730}
3731
3732static int
3733urtwn_llt_init(struct urtwn_softc *sc)
3734{
3735	int i, error, page_count, pktbuf_count;
3736
3737	page_count = (sc->chip & URTWN_CHIP_88E) ?
3738	    R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
3739	pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
3740	    R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
3741
3742	/* Reserve pages [0; page_count]. */
3743	for (i = 0; i < page_count; i++) {
3744		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3745			return (error);
3746	}
3747	/* NB: 0xff indicates end-of-list. */
3748	if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
3749		return (error);
3750	/*
3751	 * Use pages [page_count + 1; pktbuf_count - 1]
3752	 * as ring buffer.
3753	 */
3754	for (++i; i < pktbuf_count - 1; i++) {
3755		if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3756			return (error);
3757	}
3758	/* Make the last page point to the beginning of the ring buffer. */
3759	error = urtwn_llt_write(sc, i, page_count + 1);
3760	return (error);
3761}
3762
3763#ifndef URTWN_WITHOUT_UCODE
3764static void
3765urtwn_fw_reset(struct urtwn_softc *sc)
3766{
3767	uint16_t reg;
3768	int ntries;
3769
3770	/* Tell 8051 to reset itself. */
3771	urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
3772
3773	/* Wait until 8051 resets by itself. */
3774	for (ntries = 0; ntries < 100; ntries++) {
3775		reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3776		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
3777			return;
3778		urtwn_ms_delay(sc);
3779	}
3780	/* Force 8051 reset. */
3781	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3782}
3783
3784static void
3785urtwn_r88e_fw_reset(struct urtwn_softc *sc)
3786{
3787	uint16_t reg;
3788
3789	reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3790	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3791	urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
3792}
3793
3794static int
3795urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
3796{
3797	uint32_t reg;
3798	usb_error_t error = USB_ERR_NORMAL_COMPLETION;
3799	int off, mlen;
3800
3801	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3802	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
3803	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3804
3805	off = R92C_FW_START_ADDR;
3806	while (len > 0) {
3807		if (len > 196)
3808			mlen = 196;
3809		else if (len > 4)
3810			mlen = 4;
3811		else
3812			mlen = 1;
3813		/* XXX fix this deconst */
3814		error = urtwn_write_region_1(sc, off,
3815		    __DECONST(uint8_t *, buf), mlen);
3816		if (error != USB_ERR_NORMAL_COMPLETION)
3817			break;
3818		off += mlen;
3819		buf += mlen;
3820		len -= mlen;
3821	}
3822	return (error);
3823}
3824
3825static int
3826urtwn_load_firmware(struct urtwn_softc *sc)
3827{
3828	const struct firmware *fw;
3829	const struct r92c_fw_hdr *hdr;
3830	const char *imagename;
3831	const u_char *ptr;
3832	size_t len;
3833	uint32_t reg;
3834	int mlen, ntries, page, error;
3835
3836	URTWN_UNLOCK(sc);
3837	/* Read firmware image from the filesystem. */
3838	if (sc->chip & URTWN_CHIP_88E)
3839		imagename = "urtwn-rtl8188eufw";
3840	else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3841		    URTWN_CHIP_UMC_A_CUT)
3842		imagename = "urtwn-rtl8192cfwU";
3843	else
3844		imagename = "urtwn-rtl8192cfwT";
3845
3846	fw = firmware_get(imagename);
3847	URTWN_LOCK(sc);
3848	if (fw == NULL) {
3849		device_printf(sc->sc_dev,
3850		    "failed loadfirmware of file %s\n", imagename);
3851		return (ENOENT);
3852	}
3853
3854	len = fw->datasize;
3855
3856	if (len < sizeof(*hdr)) {
3857		device_printf(sc->sc_dev, "firmware too short\n");
3858		error = EINVAL;
3859		goto fail;
3860	}
3861	ptr = fw->data;
3862	hdr = (const struct r92c_fw_hdr *)ptr;
3863	/* Check if there is a valid FW header and skip it. */
3864	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
3865	    (le16toh(hdr->signature) >> 4) == 0x88e ||
3866	    (le16toh(hdr->signature) >> 4) == 0x92c) {
3867		URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE,
3868		    "FW V%d.%d %02d-%02d %02d:%02d\n",
3869		    le16toh(hdr->version), le16toh(hdr->subversion),
3870		    hdr->month, hdr->date, hdr->hour, hdr->minute);
3871		ptr += sizeof(*hdr);
3872		len -= sizeof(*hdr);
3873	}
3874
3875	if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
3876		if (sc->chip & URTWN_CHIP_88E)
3877			urtwn_r88e_fw_reset(sc);
3878		else
3879			urtwn_fw_reset(sc);
3880		urtwn_write_1(sc, R92C_MCUFWDL, 0);
3881	}
3882
3883	if (!(sc->chip & URTWN_CHIP_88E)) {
3884		urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3885		    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3886		    R92C_SYS_FUNC_EN_CPUEN);
3887	}
3888	urtwn_write_1(sc, R92C_MCUFWDL,
3889	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
3890	urtwn_write_1(sc, R92C_MCUFWDL + 2,
3891	    urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
3892
3893	/* Reset the FWDL checksum. */
3894	urtwn_write_1(sc, R92C_MCUFWDL,
3895	    urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
3896
3897	for (page = 0; len > 0; page++) {
3898		mlen = min(len, R92C_FW_PAGE_SIZE);
3899		error = urtwn_fw_loadpage(sc, page, ptr, mlen);
3900		if (error != 0) {
3901			device_printf(sc->sc_dev,
3902			    "could not load firmware page\n");
3903			goto fail;
3904		}
3905		ptr += mlen;
3906		len -= mlen;
3907	}
3908	urtwn_write_1(sc, R92C_MCUFWDL,
3909	    urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
3910	urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
3911
3912	/* Wait for checksum report. */
3913	for (ntries = 0; ntries < 1000; ntries++) {
3914		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
3915			break;
3916		urtwn_ms_delay(sc);
3917	}
3918	if (ntries == 1000) {
3919		device_printf(sc->sc_dev,
3920		    "timeout waiting for checksum report\n");
3921		error = ETIMEDOUT;
3922		goto fail;
3923	}
3924
3925	reg = urtwn_read_4(sc, R92C_MCUFWDL);
3926	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
3927	urtwn_write_4(sc, R92C_MCUFWDL, reg);
3928	if (sc->chip & URTWN_CHIP_88E)
3929		urtwn_r88e_fw_reset(sc);
3930	/* Wait for firmware readiness. */
3931	for (ntries = 0; ntries < 1000; ntries++) {
3932		if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3933			break;
3934		urtwn_ms_delay(sc);
3935	}
3936	if (ntries == 1000) {
3937		device_printf(sc->sc_dev,
3938		    "timeout waiting for firmware readiness\n");
3939		error = ETIMEDOUT;
3940		goto fail;
3941	}
3942fail:
3943	firmware_put(fw, FIRMWARE_UNLOAD);
3944	return (error);
3945}
3946#endif
3947
3948static int
3949urtwn_dma_init(struct urtwn_softc *sc)
3950{
3951	struct usb_endpoint *ep, *ep_end;
3952	usb_error_t usb_err;
3953	uint32_t reg;
3954	int hashq, hasnq, haslq, nqueues, ntx;
3955	int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3956
3957	/* Initialize LLT table. */
3958	error = urtwn_llt_init(sc);
3959	if (error != 0)
3960		return (error);
3961
3962	/* Determine the number of bulk-out pipes. */
3963	ntx = 0;
3964	ep = sc->sc_udev->endpoints;
3965	ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
3966	for (; ep != ep_end; ep++) {
3967		if ((ep->edesc == NULL) ||
3968		    (ep->iface_index != sc->sc_iface_index))
3969			continue;
3970		if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
3971			ntx++;
3972	}
3973	if (ntx == 0) {
3974		device_printf(sc->sc_dev,
3975		    "%d: invalid number of Tx bulk pipes\n", ntx);
3976		return (EIO);
3977	}
3978
3979	/* Get Tx queues to USB endpoints mapping. */
3980	hashq = hasnq = haslq = nqueues = 0;
3981	switch (ntx) {
3982	case 1: hashq = 1; break;
3983	case 2: hashq = hasnq = 1; break;
3984	case 3: case 4: hashq = hasnq = haslq = 1; break;
3985	}
3986	nqueues = hashq + hasnq + haslq;
3987	if (nqueues == 0)
3988		return (EIO);
3989
3990	npubqpages = nqpages = nrempages = pagecount = 0;
3991	if (sc->chip & URTWN_CHIP_88E)
3992		tx_boundary = R88E_TX_PAGE_BOUNDARY;
3993	else {
3994		pagecount = R92C_TX_PAGE_COUNT;
3995		npubqpages = R92C_PUBQ_NPAGES;
3996		tx_boundary = R92C_TX_PAGE_BOUNDARY;
3997	}
3998
3999	/* Set number of pages for normal priority queue. */
4000	if (sc->chip & URTWN_CHIP_88E) {
4001		usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
4002		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4003			return (EIO);
4004		usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
4005		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4006			return (EIO);
4007	} else {
4008		/* Get the number of pages for each queue. */
4009		nqpages = (pagecount - npubqpages) / nqueues;
4010		/*
4011		 * The remaining pages are assigned to the high priority
4012		 * queue.
4013		 */
4014		nrempages = (pagecount - npubqpages) % nqueues;
4015		usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
4016		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4017			return (EIO);
4018		usb_err = urtwn_write_4(sc, R92C_RQPN,
4019		    /* Set number of pages for public queue. */
4020		    SM(R92C_RQPN_PUBQ, npubqpages) |
4021		    /* Set number of pages for high priority queue. */
4022		    SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
4023		    /* Set number of pages for low priority queue. */
4024		    SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
4025		    /* Load values. */
4026		    R92C_RQPN_LD);
4027		if (usb_err != USB_ERR_NORMAL_COMPLETION)
4028			return (EIO);
4029	}
4030
4031	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
4032	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4033		return (EIO);
4034	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
4035	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4036		return (EIO);
4037	usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
4038	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4039		return (EIO);
4040	usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
4041	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4042		return (EIO);
4043	usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
4044	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4045		return (EIO);
4046
4047	/* Set queue to USB pipe mapping. */
4048	reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
4049	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
4050	if (nqueues == 1) {
4051		if (hashq)
4052			reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
4053		else if (hasnq)
4054			reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
4055		else
4056			reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
4057	} else if (nqueues == 2) {
4058		/*
4059		 * All 2-endpoints configs have high and normal
4060		 * priority queues.
4061		 */
4062		reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
4063	} else
4064		reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
4065	usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
4066	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4067		return (EIO);
4068
4069	/* Set Tx/Rx transfer page boundary. */
4070	usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
4071	    (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
4072	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4073		return (EIO);
4074
4075	/* Set Tx/Rx transfer page size. */
4076	usb_err = urtwn_write_1(sc, R92C_PBP,
4077	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
4078	    SM(R92C_PBP_PSTX, R92C_PBP_128));
4079	if (usb_err != USB_ERR_NORMAL_COMPLETION)
4080		return (EIO);
4081
4082	return (0);
4083}
4084
4085static int
4086urtwn_mac_init(struct urtwn_softc *sc)
4087{
4088	usb_error_t error;
4089	int i;
4090
4091	/* Write MAC initialization values. */
4092	if (sc->chip & URTWN_CHIP_88E) {
4093		for (i = 0; i < nitems(rtl8188eu_mac); i++) {
4094			error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
4095			    rtl8188eu_mac[i].val);
4096			if (error != USB_ERR_NORMAL_COMPLETION)
4097				return (EIO);
4098		}
4099		urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
4100	} else {
4101		for (i = 0; i < nitems(rtl8192cu_mac); i++)
4102			error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
4103			    rtl8192cu_mac[i].val);
4104			if (error != USB_ERR_NORMAL_COMPLETION)
4105				return (EIO);
4106	}
4107
4108	return (0);
4109}
4110
4111static void
4112urtwn_bb_init(struct urtwn_softc *sc)
4113{
4114	const struct urtwn_bb_prog *prog;
4115	uint32_t reg;
4116	uint8_t crystalcap;
4117	int i;
4118
4119	/* Enable BB and RF. */
4120	urtwn_write_2(sc, R92C_SYS_FUNC_EN,
4121	    urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
4122	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
4123	    R92C_SYS_FUNC_EN_DIO_RF);
4124
4125	if (!(sc->chip & URTWN_CHIP_88E))
4126		urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
4127
4128	urtwn_write_1(sc, R92C_RF_CTRL,
4129	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
4130	urtwn_write_1(sc, R92C_SYS_FUNC_EN,
4131	    R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
4132	    R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
4133
4134	if (!(sc->chip & URTWN_CHIP_88E)) {
4135		urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
4136		urtwn_write_1(sc, 0x15, 0xe9);
4137		urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
4138	}
4139
4140	/* Select BB programming based on board type. */
4141	if (sc->chip & URTWN_CHIP_88E)
4142		prog = &rtl8188eu_bb_prog;
4143	else if (!(sc->chip & URTWN_CHIP_92C)) {
4144		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4145			prog = &rtl8188ce_bb_prog;
4146		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4147			prog = &rtl8188ru_bb_prog;
4148		else
4149			prog = &rtl8188cu_bb_prog;
4150	} else {
4151		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4152			prog = &rtl8192ce_bb_prog;
4153		else
4154			prog = &rtl8192cu_bb_prog;
4155	}
4156	/* Write BB initialization values. */
4157	for (i = 0; i < prog->count; i++) {
4158		urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
4159		urtwn_ms_delay(sc);
4160	}
4161
4162	if (sc->chip & URTWN_CHIP_92C_1T2R) {
4163		/* 8192C 1T only configuration. */
4164		reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
4165		reg = (reg & ~0x00000003) | 0x2;
4166		urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
4167
4168		reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
4169		reg = (reg & ~0x00300033) | 0x00200022;
4170		urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
4171
4172		reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
4173		reg = (reg & ~0xff000000) | 0x45 << 24;
4174		urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
4175
4176		reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
4177		reg = (reg & ~0x000000ff) | 0x23;
4178		urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
4179
4180		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
4181		reg = (reg & ~0x00000030) | 1 << 4;
4182		urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
4183
4184		reg = urtwn_bb_read(sc, 0xe74);
4185		reg = (reg & ~0x0c000000) | 2 << 26;
4186		urtwn_bb_write(sc, 0xe74, reg);
4187		reg = urtwn_bb_read(sc, 0xe78);
4188		reg = (reg & ~0x0c000000) | 2 << 26;
4189		urtwn_bb_write(sc, 0xe78, reg);
4190		reg = urtwn_bb_read(sc, 0xe7c);
4191		reg = (reg & ~0x0c000000) | 2 << 26;
4192		urtwn_bb_write(sc, 0xe7c, reg);
4193		reg = urtwn_bb_read(sc, 0xe80);
4194		reg = (reg & ~0x0c000000) | 2 << 26;
4195		urtwn_bb_write(sc, 0xe80, reg);
4196		reg = urtwn_bb_read(sc, 0xe88);
4197		reg = (reg & ~0x0c000000) | 2 << 26;
4198		urtwn_bb_write(sc, 0xe88, reg);
4199	}
4200
4201	/* Write AGC values. */
4202	for (i = 0; i < prog->agccount; i++) {
4203		urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
4204		    prog->agcvals[i]);
4205		urtwn_ms_delay(sc);
4206	}
4207
4208	if (sc->chip & URTWN_CHIP_88E) {
4209		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
4210		urtwn_ms_delay(sc);
4211		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
4212		urtwn_ms_delay(sc);
4213
4214		crystalcap = sc->rom.r88e_rom.crystalcap;
4215		if (crystalcap == 0xff)
4216			crystalcap = 0x20;
4217		crystalcap &= 0x3f;
4218		reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
4219		urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
4220		    RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
4221		    crystalcap | crystalcap << 6));
4222	} else {
4223		if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
4224		    R92C_HSSI_PARAM2_CCK_HIPWR)
4225			sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
4226	}
4227}
4228
4229static void
4230urtwn_rf_init(struct urtwn_softc *sc)
4231{
4232	const struct urtwn_rf_prog *prog;
4233	uint32_t reg, type;
4234	int i, j, idx, off;
4235
4236	/* Select RF programming based on board type. */
4237	if (sc->chip & URTWN_CHIP_88E)
4238		prog = rtl8188eu_rf_prog;
4239	else if (!(sc->chip & URTWN_CHIP_92C)) {
4240		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4241			prog = rtl8188ce_rf_prog;
4242		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4243			prog = rtl8188ru_rf_prog;
4244		else
4245			prog = rtl8188cu_rf_prog;
4246	} else
4247		prog = rtl8192ce_rf_prog;
4248
4249	for (i = 0; i < sc->nrxchains; i++) {
4250		/* Save RF_ENV control type. */
4251		idx = i / 2;
4252		off = (i % 2) * 16;
4253		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4254		type = (reg >> off) & 0x10;
4255
4256		/* Set RF_ENV enable. */
4257		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4258		reg |= 0x100000;
4259		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4260		urtwn_ms_delay(sc);
4261		/* Set RF_ENV output high. */
4262		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4263		reg |= 0x10;
4264		urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4265		urtwn_ms_delay(sc);
4266		/* Set address and data lengths of RF registers. */
4267		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4268		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
4269		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4270		urtwn_ms_delay(sc);
4271		reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4272		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
4273		urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4274		urtwn_ms_delay(sc);
4275
4276		/* Write RF initialization values for this chain. */
4277		for (j = 0; j < prog[i].count; j++) {
4278			if (prog[i].regs[j] >= 0xf9 &&
4279			    prog[i].regs[j] <= 0xfe) {
4280				/*
4281				 * These are fake RF registers offsets that
4282				 * indicate a delay is required.
4283				 */
4284				usb_pause_mtx(&sc->sc_mtx, hz / 20);	/* 50ms */
4285				continue;
4286			}
4287			urtwn_rf_write(sc, i, prog[i].regs[j],
4288			    prog[i].vals[j]);
4289			urtwn_ms_delay(sc);
4290		}
4291
4292		/* Restore RF_ENV control type. */
4293		reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4294		reg &= ~(0x10 << off) | (type << off);
4295		urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
4296
4297		/* Cache RF register CHNLBW. */
4298		sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
4299	}
4300
4301	if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
4302	    URTWN_CHIP_UMC_A_CUT) {
4303		urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
4304		urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
4305	}
4306}
4307
4308static void
4309urtwn_cam_init(struct urtwn_softc *sc)
4310{
4311	/* Invalidate all CAM entries. */
4312	urtwn_write_4(sc, R92C_CAMCMD,
4313	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
4314}
4315
4316static int
4317urtwn_cam_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
4318{
4319	usb_error_t error;
4320
4321	error = urtwn_write_4(sc, R92C_CAMWRITE, data);
4322	if (error != USB_ERR_NORMAL_COMPLETION)
4323		return (EIO);
4324	error = urtwn_write_4(sc, R92C_CAMCMD,
4325	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
4326	    SM(R92C_CAMCMD_ADDR, addr));
4327	if (error != USB_ERR_NORMAL_COMPLETION)
4328		return (EIO);
4329
4330	return (0);
4331}
4332
4333static void
4334urtwn_pa_bias_init(struct urtwn_softc *sc)
4335{
4336	uint8_t reg;
4337	int i;
4338
4339	for (i = 0; i < sc->nrxchains; i++) {
4340		if (sc->pa_setting & (1 << i))
4341			continue;
4342		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
4343		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
4344		urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
4345		urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
4346	}
4347	if (!(sc->pa_setting & 0x10)) {
4348		reg = urtwn_read_1(sc, 0x16);
4349		reg = (reg & ~0xf0) | 0x90;
4350		urtwn_write_1(sc, 0x16, reg);
4351	}
4352}
4353
4354static void
4355urtwn_rxfilter_init(struct urtwn_softc *sc)
4356{
4357	struct ieee80211com *ic = &sc->sc_ic;
4358	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4359	uint32_t rcr;
4360	uint16_t filter;
4361
4362	URTWN_ASSERT_LOCKED(sc);
4363
4364	/* Setup multicast filter. */
4365	urtwn_set_multi(sc);
4366
4367	/* Filter for management frames. */
4368	filter = 0x7f3f;
4369	switch (vap->iv_opmode) {
4370	case IEEE80211_M_STA:
4371		filter &= ~(
4372		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
4373		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
4374		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
4375		break;
4376	case IEEE80211_M_HOSTAP:
4377		filter &= ~(
4378		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
4379		    R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP));
4380		break;
4381	case IEEE80211_M_MONITOR:
4382	case IEEE80211_M_IBSS:
4383		break;
4384	default:
4385		device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4386		    __func__, vap->iv_opmode);
4387		break;
4388	}
4389	urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
4390
4391	/* Reject all control frames. */
4392	urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
4393
4394	/* Reject all data frames. */
4395	urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
4396
4397	rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
4398	      R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
4399	      R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
4400
4401	if (vap->iv_opmode == IEEE80211_M_MONITOR) {
4402		/* Accept all frames. */
4403		rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
4404		       R92C_RCR_AAP;
4405	}
4406
4407	/* Set Rx filter. */
4408	urtwn_write_4(sc, R92C_RCR, rcr);
4409
4410	if (ic->ic_promisc != 0) {
4411		/* Update Rx filter. */
4412		urtwn_set_promisc(sc);
4413	}
4414}
4415
4416static void
4417urtwn_edca_init(struct urtwn_softc *sc)
4418{
4419	urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
4420	urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
4421	urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
4422	urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
4423	urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
4424	urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
4425	urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
4426	urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
4427}
4428
4429static void
4430urtwn_write_txpower(struct urtwn_softc *sc, int chain,
4431    uint16_t power[URTWN_RIDX_COUNT])
4432{
4433	uint32_t reg;
4434
4435	/* Write per-CCK rate Tx power. */
4436	if (chain == 0) {
4437		reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
4438		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
4439		urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
4440		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4441		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
4442		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
4443		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
4444		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4445	} else {
4446		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
4447		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
4448		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
4449		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
4450		urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
4451		reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4452		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
4453		urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4454	}
4455	/* Write per-OFDM rate Tx power. */
4456	urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
4457	    SM(R92C_TXAGC_RATE06, power[ 4]) |
4458	    SM(R92C_TXAGC_RATE09, power[ 5]) |
4459	    SM(R92C_TXAGC_RATE12, power[ 6]) |
4460	    SM(R92C_TXAGC_RATE18, power[ 7]));
4461	urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
4462	    SM(R92C_TXAGC_RATE24, power[ 8]) |
4463	    SM(R92C_TXAGC_RATE36, power[ 9]) |
4464	    SM(R92C_TXAGC_RATE48, power[10]) |
4465	    SM(R92C_TXAGC_RATE54, power[11]));
4466	/* Write per-MCS Tx power. */
4467	urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
4468	    SM(R92C_TXAGC_MCS00,  power[12]) |
4469	    SM(R92C_TXAGC_MCS01,  power[13]) |
4470	    SM(R92C_TXAGC_MCS02,  power[14]) |
4471	    SM(R92C_TXAGC_MCS03,  power[15]));
4472	urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
4473	    SM(R92C_TXAGC_MCS04,  power[16]) |
4474	    SM(R92C_TXAGC_MCS05,  power[17]) |
4475	    SM(R92C_TXAGC_MCS06,  power[18]) |
4476	    SM(R92C_TXAGC_MCS07,  power[19]));
4477	urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
4478	    SM(R92C_TXAGC_MCS08,  power[20]) |
4479	    SM(R92C_TXAGC_MCS09,  power[21]) |
4480	    SM(R92C_TXAGC_MCS10,  power[22]) |
4481	    SM(R92C_TXAGC_MCS11,  power[23]));
4482	urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
4483	    SM(R92C_TXAGC_MCS12,  power[24]) |
4484	    SM(R92C_TXAGC_MCS13,  power[25]) |
4485	    SM(R92C_TXAGC_MCS14,  power[26]) |
4486	    SM(R92C_TXAGC_MCS15,  power[27]));
4487}
4488
4489static void
4490urtwn_get_txpower(struct urtwn_softc *sc, int chain,
4491    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4492    uint16_t power[URTWN_RIDX_COUNT])
4493{
4494	struct ieee80211com *ic = &sc->sc_ic;
4495	struct r92c_rom *rom = &sc->rom.r92c_rom;
4496	uint16_t cckpow, ofdmpow, htpow, diff, max;
4497	const struct urtwn_txpwr *base;
4498	int ridx, chan, group;
4499
4500	/* Determine channel group. */
4501	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4502	if (chan <= 3)
4503		group = 0;
4504	else if (chan <= 9)
4505		group = 1;
4506	else
4507		group = 2;
4508
4509	/* Get original Tx power based on board type and RF chain. */
4510	if (!(sc->chip & URTWN_CHIP_92C)) {
4511		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4512			base = &rtl8188ru_txagc[chain];
4513		else
4514			base = &rtl8192cu_txagc[chain];
4515	} else
4516		base = &rtl8192cu_txagc[chain];
4517
4518	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4519	if (sc->regulatory == 0) {
4520		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4521			power[ridx] = base->pwr[0][ridx];
4522	}
4523	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4524		if (sc->regulatory == 3) {
4525			power[ridx] = base->pwr[0][ridx];
4526			/* Apply vendor limits. */
4527			if (extc != NULL)
4528				max = rom->ht40_max_pwr[group];
4529			else
4530				max = rom->ht20_max_pwr[group];
4531			max = (max >> (chain * 4)) & 0xf;
4532			if (power[ridx] > max)
4533				power[ridx] = max;
4534		} else if (sc->regulatory == 1) {
4535			if (extc == NULL)
4536				power[ridx] = base->pwr[group][ridx];
4537		} else if (sc->regulatory != 2)
4538			power[ridx] = base->pwr[0][ridx];
4539	}
4540
4541	/* Compute per-CCK rate Tx power. */
4542	cckpow = rom->cck_tx_pwr[chain][group];
4543	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4544		power[ridx] += cckpow;
4545		if (power[ridx] > R92C_MAX_TX_PWR)
4546			power[ridx] = R92C_MAX_TX_PWR;
4547	}
4548
4549	htpow = rom->ht40_1s_tx_pwr[chain][group];
4550	if (sc->ntxchains > 1) {
4551		/* Apply reduction for 2 spatial streams. */
4552		diff = rom->ht40_2s_tx_pwr_diff[group];
4553		diff = (diff >> (chain * 4)) & 0xf;
4554		htpow = (htpow > diff) ? htpow - diff : 0;
4555	}
4556
4557	/* Compute per-OFDM rate Tx power. */
4558	diff = rom->ofdm_tx_pwr_diff[group];
4559	diff = (diff >> (chain * 4)) & 0xf;
4560	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
4561	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4562		power[ridx] += ofdmpow;
4563		if (power[ridx] > R92C_MAX_TX_PWR)
4564			power[ridx] = R92C_MAX_TX_PWR;
4565	}
4566
4567	/* Compute per-MCS Tx power. */
4568	if (extc == NULL) {
4569		diff = rom->ht20_tx_pwr_diff[group];
4570		diff = (diff >> (chain * 4)) & 0xf;
4571		htpow += diff;	/* HT40->HT20 correction. */
4572	}
4573	for (ridx = 12; ridx <= 27; ridx++) {
4574		power[ridx] += htpow;
4575		if (power[ridx] > R92C_MAX_TX_PWR)
4576			power[ridx] = R92C_MAX_TX_PWR;
4577	}
4578#ifdef USB_DEBUG
4579	if (sc->sc_debug & URTWN_DEBUG_TXPWR) {
4580		/* Dump per-rate Tx power values. */
4581		printf("Tx power for chain %d:\n", chain);
4582		for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
4583			printf("Rate %d = %u\n", ridx, power[ridx]);
4584	}
4585#endif
4586}
4587
4588static void
4589urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
4590    struct ieee80211_channel *c, struct ieee80211_channel *extc,
4591    uint16_t power[URTWN_RIDX_COUNT])
4592{
4593	struct ieee80211com *ic = &sc->sc_ic;
4594	struct r88e_rom *rom = &sc->rom.r88e_rom;
4595	uint16_t cckpow, ofdmpow, bw20pow, htpow;
4596	const struct urtwn_r88e_txpwr *base;
4597	int ridx, chan, group;
4598
4599	/* Determine channel group. */
4600	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
4601	if (chan <= 2)
4602		group = 0;
4603	else if (chan <= 5)
4604		group = 1;
4605	else if (chan <= 8)
4606		group = 2;
4607	else if (chan <= 11)
4608		group = 3;
4609	else if (chan <= 13)
4610		group = 4;
4611	else
4612		group = 5;
4613
4614	/* Get original Tx power based on board type and RF chain. */
4615	base = &rtl8188eu_txagc[chain];
4616
4617	memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4618	if (sc->regulatory == 0) {
4619		for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4620			power[ridx] = base->pwr[0][ridx];
4621	}
4622	for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4623		if (sc->regulatory == 3)
4624			power[ridx] = base->pwr[0][ridx];
4625		else if (sc->regulatory == 1) {
4626			if (extc == NULL)
4627				power[ridx] = base->pwr[group][ridx];
4628		} else if (sc->regulatory != 2)
4629			power[ridx] = base->pwr[0][ridx];
4630	}
4631
4632	/* Compute per-CCK rate Tx power. */
4633	cckpow = rom->cck_tx_pwr[group];
4634	for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4635		power[ridx] += cckpow;
4636		if (power[ridx] > R92C_MAX_TX_PWR)
4637			power[ridx] = R92C_MAX_TX_PWR;
4638	}
4639
4640	htpow = rom->ht40_tx_pwr[group];
4641
4642	/* Compute per-OFDM rate Tx power. */
4643	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
4644	for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4645		power[ridx] += ofdmpow;
4646		if (power[ridx] > R92C_MAX_TX_PWR)
4647			power[ridx] = R92C_MAX_TX_PWR;
4648	}
4649
4650	bw20pow = htpow + sc->bw20_tx_pwr_diff;
4651	for (ridx = 12; ridx <= 27; ridx++) {
4652		power[ridx] += bw20pow;
4653		if (power[ridx] > R92C_MAX_TX_PWR)
4654			power[ridx] = R92C_MAX_TX_PWR;
4655	}
4656}
4657
4658static void
4659urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
4660    struct ieee80211_channel *extc)
4661{
4662	uint16_t power[URTWN_RIDX_COUNT];
4663	int i;
4664
4665	for (i = 0; i < sc->ntxchains; i++) {
4666		/* Compute per-rate Tx power values. */
4667		if (sc->chip & URTWN_CHIP_88E)
4668			urtwn_r88e_get_txpower(sc, i, c, extc, power);
4669		else
4670			urtwn_get_txpower(sc, i, c, extc, power);
4671		/* Write per-rate Tx power values to hardware. */
4672		urtwn_write_txpower(sc, i, power);
4673	}
4674}
4675
4676static void
4677urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
4678{
4679	uint32_t reg;
4680
4681	reg = urtwn_read_4(sc, R92C_RCR);
4682	if (enable)
4683		reg &= ~R92C_RCR_CBSSID_BCN;
4684	else
4685		reg |= R92C_RCR_CBSSID_BCN;
4686	urtwn_write_4(sc, R92C_RCR, reg);
4687}
4688
4689static void
4690urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
4691{
4692	uint32_t reg;
4693
4694	reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
4695	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4696	urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
4697
4698	if (!(sc->chip & URTWN_CHIP_88E)) {
4699		reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
4700		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4701		urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
4702	}
4703}
4704
4705static void
4706urtwn_scan_start(struct ieee80211com *ic)
4707{
4708	struct urtwn_softc *sc = ic->ic_softc;
4709
4710	URTWN_LOCK(sc);
4711	/* Receive beacons / probe responses from any BSSID. */
4712	if (ic->ic_opmode != IEEE80211_M_IBSS)
4713		urtwn_set_rx_bssid_all(sc, 1);
4714
4715	/* Set gain for scanning. */
4716	urtwn_set_gain(sc, 0x20);
4717	URTWN_UNLOCK(sc);
4718}
4719
4720static void
4721urtwn_scan_end(struct ieee80211com *ic)
4722{
4723	struct urtwn_softc *sc = ic->ic_softc;
4724
4725	URTWN_LOCK(sc);
4726	/* Restore limitations. */
4727	if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
4728		urtwn_set_rx_bssid_all(sc, 0);
4729
4730	/* Set gain under link. */
4731	urtwn_set_gain(sc, 0x32);
4732	URTWN_UNLOCK(sc);
4733}
4734
4735static void
4736urtwn_set_channel(struct ieee80211com *ic)
4737{
4738	struct urtwn_softc *sc = ic->ic_softc;
4739	struct ieee80211_channel *c = ic->ic_curchan;
4740	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4741
4742	URTWN_LOCK(sc);
4743	if (vap->iv_state == IEEE80211_S_SCAN) {
4744		/* Make link LED blink during scan. */
4745		urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
4746	}
4747	urtwn_set_chan(sc, c, NULL);
4748	sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
4749	sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
4750	sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
4751	sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
4752	URTWN_UNLOCK(sc);
4753}
4754
4755static int
4756urtwn_wme_update(struct ieee80211com *ic)
4757{
4758	const struct wmeParams *wmep =
4759	    ic->ic_wme.wme_chanParams.cap_wmeParams;
4760	struct urtwn_softc *sc = ic->ic_softc;
4761	uint8_t aifs, acm, slottime;
4762	int ac;
4763
4764	acm = 0;
4765	slottime = IEEE80211_GET_SLOTTIME(ic);
4766
4767	URTWN_LOCK(sc);
4768	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4769		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4770		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4771		urtwn_write_4(sc, wme2queue[ac].reg,
4772		    SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
4773		    SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
4774		    SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
4775		    SM(R92C_EDCA_PARAM_AIFS, aifs));
4776		if (ac != WME_AC_BE)
4777			acm |= wmep[ac].wmep_acm << ac;
4778	}
4779
4780	if (acm != 0)
4781		acm |= R92C_ACMHWCTRL_EN;
4782	urtwn_write_1(sc, R92C_ACMHWCTRL,
4783	    (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
4784	    acm);
4785
4786	URTWN_UNLOCK(sc);
4787
4788	return 0;
4789}
4790
4791static void
4792urtwn_update_slot(struct ieee80211com *ic)
4793{
4794	urtwn_cmd_sleepable(ic->ic_softc, NULL, 0, urtwn_update_slot_cb);
4795}
4796
4797static void
4798urtwn_update_slot_cb(struct urtwn_softc *sc, union sec_param *data)
4799{
4800	struct ieee80211com *ic = &sc->sc_ic;
4801	uint8_t slottime;
4802
4803	slottime = IEEE80211_GET_SLOTTIME(ic);
4804
4805	URTWN_DPRINTF(sc, URTWN_DEBUG_ANY, "%s: setting slot time to %uus\n",
4806	    __func__, slottime);
4807
4808	urtwn_write_1(sc, R92C_SLOT, slottime);
4809	urtwn_update_aifs(sc, slottime);
4810}
4811
4812static void
4813urtwn_update_aifs(struct urtwn_softc *sc, uint8_t slottime)
4814{
4815	const struct wmeParams *wmep =
4816	    sc->sc_ic.ic_wme.wme_chanParams.cap_wmeParams;
4817	uint8_t aifs, ac;
4818
4819	for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4820		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4821		aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4822		urtwn_write_1(sc, wme2queue[ac].reg, aifs);
4823        }
4824}
4825
4826static uint8_t
4827urtwn_get_multi_pos(const uint8_t maddr[])
4828{
4829	uint64_t mask = 0x00004d101df481b4;
4830	uint8_t pos = 0x27;	/* initial value */
4831	int i, j;
4832
4833	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
4834		for (j = (i == 0) ? 1 : 0; j < 8; j++)
4835			if ((maddr[i] >> j) & 1)
4836				pos ^= (mask >> (i * 8 + j - 1));
4837
4838	pos &= 0x3f;
4839
4840	return (pos);
4841}
4842
4843static void
4844urtwn_set_multi(struct urtwn_softc *sc)
4845{
4846	struct ieee80211com *ic = &sc->sc_ic;
4847	uint32_t mfilt[2];
4848
4849	URTWN_ASSERT_LOCKED(sc);
4850
4851	/* general structure was copied from ath(4). */
4852	if (ic->ic_allmulti == 0) {
4853		struct ieee80211vap *vap;
4854		struct ifnet *ifp;
4855		struct ifmultiaddr *ifma;
4856
4857		/*
4858		 * Merge multicast addresses to form the hardware filter.
4859		 */
4860		mfilt[0] = mfilt[1] = 0;
4861		TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
4862			ifp = vap->iv_ifp;
4863			if_maddr_rlock(ifp);
4864			TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
4865				caddr_t dl;
4866				uint8_t pos;
4867
4868				dl = LLADDR((struct sockaddr_dl *)
4869				    ifma->ifma_addr);
4870				pos = urtwn_get_multi_pos(dl);
4871
4872				mfilt[pos / 32] |= (1 << (pos % 32));
4873			}
4874			if_maddr_runlock(ifp);
4875		}
4876	} else
4877		mfilt[0] = mfilt[1] = ~0;
4878
4879
4880	urtwn_write_4(sc, R92C_MAR + 0, mfilt[0]);
4881	urtwn_write_4(sc, R92C_MAR + 4, mfilt[1]);
4882
4883	URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s: MC filter %08x:%08x\n",
4884	     __func__, mfilt[0], mfilt[1]);
4885}
4886
4887static void
4888urtwn_set_promisc(struct urtwn_softc *sc)
4889{
4890	struct ieee80211com *ic = &sc->sc_ic;
4891	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4892	uint32_t rcr, mask1, mask2;
4893
4894	URTWN_ASSERT_LOCKED(sc);
4895
4896	if (vap->iv_opmode == IEEE80211_M_MONITOR)
4897		return;
4898
4899	mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
4900	mask2 = R92C_RCR_APM;
4901
4902	if (vap->iv_state == IEEE80211_S_RUN) {
4903		switch (vap->iv_opmode) {
4904		case IEEE80211_M_STA:
4905			mask2 |= R92C_RCR_CBSSID_DATA;
4906			/* FALLTHROUGH */
4907		case IEEE80211_M_HOSTAP:
4908			mask2 |= R92C_RCR_CBSSID_BCN;
4909			break;
4910		case IEEE80211_M_IBSS:
4911			mask2 |= R92C_RCR_CBSSID_DATA;
4912			break;
4913		default:
4914			device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4915			    __func__, vap->iv_opmode);
4916			return;
4917		}
4918	}
4919
4920	rcr = urtwn_read_4(sc, R92C_RCR);
4921	if (ic->ic_promisc == 0)
4922		rcr = (rcr & ~mask1) | mask2;
4923	else
4924		rcr = (rcr & ~mask2) | mask1;
4925	urtwn_write_4(sc, R92C_RCR, rcr);
4926}
4927
4928static void
4929urtwn_update_promisc(struct ieee80211com *ic)
4930{
4931	struct urtwn_softc *sc = ic->ic_softc;
4932
4933	URTWN_LOCK(sc);
4934	if (sc->sc_flags & URTWN_RUNNING)
4935		urtwn_set_promisc(sc);
4936	URTWN_UNLOCK(sc);
4937}
4938
4939static void
4940urtwn_update_mcast(struct ieee80211com *ic)
4941{
4942	struct urtwn_softc *sc = ic->ic_softc;
4943
4944	URTWN_LOCK(sc);
4945	if (sc->sc_flags & URTWN_RUNNING)
4946		urtwn_set_multi(sc);
4947	URTWN_UNLOCK(sc);
4948}
4949
4950static struct ieee80211_node *
4951urtwn_node_alloc(struct ieee80211vap *vap,
4952    const uint8_t mac[IEEE80211_ADDR_LEN])
4953{
4954	struct urtwn_node *un;
4955
4956	un = malloc(sizeof (struct urtwn_node), M_80211_NODE,
4957	    M_NOWAIT | M_ZERO);
4958
4959	if (un == NULL)
4960		return NULL;
4961
4962	un->id = URTWN_MACID_UNDEFINED;
4963
4964	return &un->ni;
4965}
4966
4967static void
4968urtwn_newassoc(struct ieee80211_node *ni, int isnew)
4969{
4970	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
4971	struct urtwn_node *un = URTWN_NODE(ni);
4972	uint8_t id;
4973
4974	/* Only do this bit for R88E chips */
4975	if (! (sc->chip & URTWN_CHIP_88E))
4976		return;
4977
4978	if (!isnew)
4979		return;
4980
4981	URTWN_NT_LOCK(sc);
4982	for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
4983		if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
4984			un->id = id;
4985			sc->node_list[id] = ni;
4986			break;
4987		}
4988	}
4989	URTWN_NT_UNLOCK(sc);
4990
4991	if (id > URTWN_MACID_MAX(sc)) {
4992		device_printf(sc->sc_dev, "%s: node table is full\n",
4993		    __func__);
4994	}
4995}
4996
4997static void
4998urtwn_node_free(struct ieee80211_node *ni)
4999{
5000	struct urtwn_softc *sc = ni->ni_ic->ic_softc;
5001	struct urtwn_node *un = URTWN_NODE(ni);
5002
5003	URTWN_NT_LOCK(sc);
5004	if (un->id != URTWN_MACID_UNDEFINED)
5005		sc->node_list[un->id] = NULL;
5006	URTWN_NT_UNLOCK(sc);
5007
5008	sc->sc_node_free(ni);
5009}
5010
5011static void
5012urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
5013    struct ieee80211_channel *extc)
5014{
5015	struct ieee80211com *ic = &sc->sc_ic;
5016	uint32_t reg;
5017	u_int chan;
5018	int i;
5019
5020	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
5021	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
5022		device_printf(sc->sc_dev,
5023		    "%s: invalid channel %x\n", __func__, chan);
5024		return;
5025	}
5026
5027	/* Set Tx power for this new channel. */
5028	urtwn_set_txpower(sc, c, extc);
5029
5030	for (i = 0; i < sc->nrxchains; i++) {
5031		urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
5032		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
5033	}
5034#ifndef IEEE80211_NO_HT
5035	if (extc != NULL) {
5036		/* Is secondary channel below or above primary? */
5037		int prichlo = c->ic_freq < extc->ic_freq;
5038
5039		urtwn_write_1(sc, R92C_BWOPMODE,
5040		    urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
5041
5042		reg = urtwn_read_1(sc, R92C_RRSR + 2);
5043		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
5044		urtwn_write_1(sc, R92C_RRSR + 2, reg);
5045
5046		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
5047		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
5048		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
5049		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
5050
5051		/* Set CCK side band. */
5052		reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
5053		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
5054		urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
5055
5056		reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
5057		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
5058		urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
5059
5060		urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5061		    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
5062		    ~R92C_FPGA0_ANAPARAM2_CBW20);
5063
5064		reg = urtwn_bb_read(sc, 0x818);
5065		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
5066		urtwn_bb_write(sc, 0x818, reg);
5067
5068		/* Select 40MHz bandwidth. */
5069		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5070		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
5071	} else
5072#endif
5073	{
5074		urtwn_write_1(sc, R92C_BWOPMODE,
5075		    urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
5076
5077		urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
5078		    urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
5079		urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
5080		    urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
5081
5082		if (!(sc->chip & URTWN_CHIP_88E)) {
5083			urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5084			    urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
5085			    R92C_FPGA0_ANAPARAM2_CBW20);
5086		}
5087
5088		/* Select 20MHz bandwidth. */
5089		urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5090		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
5091		    ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
5092		    R92C_RF_CHNLBW_BW20));
5093	}
5094}
5095
5096static void
5097urtwn_iq_calib(struct urtwn_softc *sc)
5098{
5099	/* TODO */
5100}
5101
5102static void
5103urtwn_lc_calib(struct urtwn_softc *sc)
5104{
5105	uint32_t rf_ac[2];
5106	uint8_t txmode;
5107	int i;
5108
5109	txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
5110	if ((txmode & 0x70) != 0) {
5111		/* Disable all continuous Tx. */
5112		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
5113
5114		/* Set RF mode to standby mode. */
5115		for (i = 0; i < sc->nrxchains; i++) {
5116			rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
5117			urtwn_rf_write(sc, i, R92C_RF_AC,
5118			    RW(rf_ac[i], R92C_RF_AC_MODE,
5119				R92C_RF_AC_MODE_STANDBY));
5120		}
5121	} else {
5122		/* Block all Tx queues. */
5123		urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
5124	}
5125	/* Start calibration. */
5126	urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5127	    urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
5128
5129	/* Give calibration the time to complete. */
5130	usb_pause_mtx(&sc->sc_mtx, hz / 10);		/* 100ms */
5131
5132	/* Restore configuration. */
5133	if ((txmode & 0x70) != 0) {
5134		/* Restore Tx mode. */
5135		urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
5136		/* Restore RF mode. */
5137		for (i = 0; i < sc->nrxchains; i++)
5138			urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
5139	} else {
5140		/* Unblock all Tx queues. */
5141		urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
5142	}
5143}
5144
5145static void
5146urtwn_temp_calib(struct urtwn_softc *sc)
5147{
5148	uint8_t temp;
5149
5150	URTWN_ASSERT_LOCKED(sc);
5151
5152	if (!(sc->sc_flags & URTWN_TEMP_MEASURED)) {
5153		/* Start measuring temperature. */
5154		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5155		    "%s: start measuring temperature\n", __func__);
5156		if (sc->chip & URTWN_CHIP_88E) {
5157			urtwn_rf_write(sc, 0, R88E_RF_T_METER,
5158			    R88E_RF_T_METER_START);
5159		} else {
5160			urtwn_rf_write(sc, 0, R92C_RF_T_METER,
5161			    R92C_RF_T_METER_START);
5162		}
5163		sc->sc_flags |= URTWN_TEMP_MEASURED;
5164		return;
5165	}
5166	sc->sc_flags &= ~URTWN_TEMP_MEASURED;
5167
5168	/* Read measured temperature. */
5169	if (sc->chip & URTWN_CHIP_88E) {
5170		temp = MS(urtwn_rf_read(sc, 0, R88E_RF_T_METER),
5171		    R88E_RF_T_METER_VAL);
5172	} else {
5173		temp = MS(urtwn_rf_read(sc, 0, R92C_RF_T_METER),
5174		    R92C_RF_T_METER_VAL);
5175	}
5176	if (temp == 0) {	/* Read failed, skip. */
5177		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5178		    "%s: temperature read failed, skipping\n", __func__);
5179		return;
5180	}
5181
5182	URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5183	    "%s: temperature: previous %u, current %u\n",
5184	    __func__, sc->thcal_lctemp, temp);
5185
5186	/*
5187	 * Redo LC calibration if temperature changed significantly since
5188	 * last calibration.
5189	 */
5190	if (sc->thcal_lctemp == 0) {
5191		/* First LC calibration is performed in urtwn_init(). */
5192		sc->thcal_lctemp = temp;
5193	} else if (abs(temp - sc->thcal_lctemp) > 1) {
5194		URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5195		    "%s: LC calib triggered by temp: %u -> %u\n",
5196		    __func__, sc->thcal_lctemp, temp);
5197		urtwn_lc_calib(sc);
5198		/* Record temperature of last LC calibration. */
5199		sc->thcal_lctemp = temp;
5200	}
5201}
5202
5203static int
5204urtwn_init(struct urtwn_softc *sc)
5205{
5206	struct ieee80211com *ic = &sc->sc_ic;
5207	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5208	uint8_t macaddr[IEEE80211_ADDR_LEN];
5209	uint32_t reg;
5210	usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
5211	int error;
5212
5213	URTWN_LOCK(sc);
5214	if (sc->sc_flags & URTWN_RUNNING) {
5215		URTWN_UNLOCK(sc);
5216		return (0);
5217	}
5218
5219	/* Init firmware commands ring. */
5220	sc->fwcur = 0;
5221
5222	/* Allocate Tx/Rx buffers. */
5223	error = urtwn_alloc_rx_list(sc);
5224	if (error != 0)
5225		goto fail;
5226
5227	error = urtwn_alloc_tx_list(sc);
5228	if (error != 0)
5229		goto fail;
5230
5231	/* Power on adapter. */
5232	error = urtwn_power_on(sc);
5233	if (error != 0)
5234		goto fail;
5235
5236	/* Initialize DMA. */
5237	error = urtwn_dma_init(sc);
5238	if (error != 0)
5239		goto fail;
5240
5241	/* Set info size in Rx descriptors (in 64-bit words). */
5242	urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
5243
5244	/* Init interrupts. */
5245	if (sc->chip & URTWN_CHIP_88E) {
5246		usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
5247		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5248			goto fail;
5249		usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
5250		    R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
5251		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5252			goto fail;
5253		usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
5254		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
5255		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5256			goto fail;
5257		usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5258		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5259		    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
5260		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5261			goto fail;
5262	} else {
5263		usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
5264		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5265			goto fail;
5266		usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
5267		if (usb_err != USB_ERR_NORMAL_COMPLETION)
5268			goto fail;
5269	}
5270
5271	/* Set MAC address. */
5272	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
5273	usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
5274	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5275		goto fail;
5276
5277	/* Set initial network type. */
5278	urtwn_set_mode(sc, R92C_MSR_INFRA);
5279
5280	/* Initialize Rx filter. */
5281	urtwn_rxfilter_init(sc);
5282
5283	/* Set response rate. */
5284	reg = urtwn_read_4(sc, R92C_RRSR);
5285	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
5286	urtwn_write_4(sc, R92C_RRSR, reg);
5287
5288	/* Set short/long retry limits. */
5289	urtwn_write_2(sc, R92C_RL,
5290	    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
5291
5292	/* Initialize EDCA parameters. */
5293	urtwn_edca_init(sc);
5294
5295	/* Setup rate fallback. */
5296	if (!(sc->chip & URTWN_CHIP_88E)) {
5297		urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
5298		urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
5299		urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
5300		urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
5301	}
5302
5303	urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
5304	    urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
5305	    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
5306	/* Set ACK timeout. */
5307	urtwn_write_1(sc, R92C_ACKTO, 0x40);
5308
5309	/* Setup USB aggregation. */
5310	reg = urtwn_read_4(sc, R92C_TDECTRL);
5311	reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
5312	urtwn_write_4(sc, R92C_TDECTRL, reg);
5313	urtwn_write_1(sc, R92C_TRXDMA_CTRL,
5314	    urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
5315	    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
5316	urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
5317	if (sc->chip & URTWN_CHIP_88E)
5318		urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
5319	else {
5320		urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
5321		urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5322		    urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5323		    R92C_USB_SPECIAL_OPTION_AGG_EN);
5324		urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
5325		urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
5326	}
5327
5328	/* Initialize beacon parameters. */
5329	urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
5330	urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
5331	urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
5332	urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
5333	urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
5334
5335	if (!(sc->chip & URTWN_CHIP_88E)) {
5336		/* Setup AMPDU aggregation. */
5337		urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
5338		urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
5339		urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
5340
5341		urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
5342	}
5343
5344#ifndef URTWN_WITHOUT_UCODE
5345	/* Load 8051 microcode. */
5346	error = urtwn_load_firmware(sc);
5347	if (error == 0)
5348		sc->sc_flags |= URTWN_FW_LOADED;
5349#endif
5350
5351	/* Initialize MAC/BB/RF blocks. */
5352	error = urtwn_mac_init(sc);
5353	if (error != 0) {
5354		device_printf(sc->sc_dev,
5355		    "%s: error while initializing MAC block\n", __func__);
5356		goto fail;
5357	}
5358	urtwn_bb_init(sc);
5359	urtwn_rf_init(sc);
5360
5361	/* Reinitialize Rx filter (D3845 is not committed yet). */
5362	urtwn_rxfilter_init(sc);
5363
5364	if (sc->chip & URTWN_CHIP_88E) {
5365		urtwn_write_2(sc, R92C_CR,
5366		    urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
5367		    R92C_CR_MACRXEN);
5368	}
5369
5370	/* Turn CCK and OFDM blocks on. */
5371	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5372	reg |= R92C_RFMOD_CCK_EN;
5373	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5374	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5375		goto fail;
5376	reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5377	reg |= R92C_RFMOD_OFDM_EN;
5378	usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5379	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5380		goto fail;
5381
5382	/* Clear per-station keys table. */
5383	urtwn_cam_init(sc);
5384
5385	/* Enable decryption / encryption. */
5386	urtwn_write_2(sc, R92C_SECCFG,
5387	    R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
5388	    R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXDEC_ENA |
5389	    R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
5390
5391	/*
5392	 * Install static keys (if any).
5393	 * Must be called after urtwn_cam_init().
5394	 */
5395	ieee80211_runtask(ic, &sc->cmdq_task);
5396
5397	/* Enable hardware sequence numbering. */
5398	urtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
5399
5400	/* Enable per-packet TX report. */
5401	if (sc->chip & URTWN_CHIP_88E) {
5402		urtwn_write_1(sc, R88E_TX_RPT_CTRL,
5403		    urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
5404	}
5405
5406	/* Perform LO and IQ calibrations. */
5407	urtwn_iq_calib(sc);
5408	/* Perform LC calibration. */
5409	urtwn_lc_calib(sc);
5410
5411	/* Fix USB interference issue. */
5412	if (!(sc->chip & URTWN_CHIP_88E)) {
5413		urtwn_write_1(sc, 0xfe40, 0xe0);
5414		urtwn_write_1(sc, 0xfe41, 0x8d);
5415		urtwn_write_1(sc, 0xfe42, 0x80);
5416
5417		urtwn_pa_bias_init(sc);
5418	}
5419
5420	/* Initialize GPIO setting. */
5421	urtwn_write_1(sc, R92C_GPIO_MUXCFG,
5422	    urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
5423
5424	/* Fix for lower temperature. */
5425	if (!(sc->chip & URTWN_CHIP_88E))
5426		urtwn_write_1(sc, 0x15, 0xe9);
5427
5428	usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
5429
5430	sc->sc_flags |= URTWN_RUNNING;
5431
5432	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5433fail:
5434	if (usb_err != USB_ERR_NORMAL_COMPLETION)
5435		error = EIO;
5436
5437	URTWN_UNLOCK(sc);
5438
5439	return (error);
5440}
5441
5442static void
5443urtwn_stop(struct urtwn_softc *sc)
5444{
5445
5446	URTWN_LOCK(sc);
5447	if (!(sc->sc_flags & URTWN_RUNNING)) {
5448		URTWN_UNLOCK(sc);
5449		return;
5450	}
5451
5452	sc->sc_flags &= ~(URTWN_RUNNING | URTWN_FW_LOADED |
5453	    URTWN_TEMP_MEASURED);
5454	sc->thcal_lctemp = 0;
5455	callout_stop(&sc->sc_watchdog_ch);
5456
5457	urtwn_abort_xfers(sc);
5458	urtwn_drain_mbufq(sc);
5459	urtwn_power_off(sc);
5460	URTWN_UNLOCK(sc);
5461}
5462
5463static void
5464urtwn_abort_xfers(struct urtwn_softc *sc)
5465{
5466	int i;
5467
5468	URTWN_ASSERT_LOCKED(sc);
5469
5470	/* abort any pending transfers */
5471	for (i = 0; i < URTWN_N_TRANSFER; i++)
5472		usbd_transfer_stop(sc->sc_xfer[i]);
5473}
5474
5475static int
5476urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5477    const struct ieee80211_bpf_params *params)
5478{
5479	struct ieee80211com *ic = ni->ni_ic;
5480	struct urtwn_softc *sc = ic->ic_softc;
5481	struct urtwn_data *bf;
5482	int error;
5483
5484	URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
5485	    __func__,
5486	    m);
5487
5488	/* prevent management frames from being sent if we're not ready */
5489	URTWN_LOCK(sc);
5490	if (!(sc->sc_flags & URTWN_RUNNING)) {
5491		error = ENETDOWN;
5492		goto end;
5493	}
5494
5495	bf = urtwn_getbuf(sc);
5496	if (bf == NULL) {
5497		error = ENOBUFS;
5498		goto end;
5499	}
5500
5501	if (params == NULL) {
5502		/*
5503		 * Legacy path; interpret frame contents to decide
5504		 * precisely how to send the frame.
5505		 */
5506		error = urtwn_tx_data(sc, ni, m, bf);
5507	} else {
5508		/*
5509		 * Caller supplied explicit parameters to use in
5510		 * sending the frame.
5511		 */
5512		error = urtwn_tx_raw(sc, ni, m, bf, params);
5513	}
5514	if (error != 0) {
5515		STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
5516		goto end;
5517	}
5518
5519	sc->sc_txtimer = 5;
5520	callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5521
5522end:
5523	if (error != 0)
5524		m_freem(m);
5525
5526	URTWN_UNLOCK(sc);
5527
5528	return (error);
5529}
5530
5531static void
5532urtwn_ms_delay(struct urtwn_softc *sc)
5533{
5534	usb_pause_mtx(&sc->sc_mtx, hz / 1000);
5535}
5536
5537static device_method_t urtwn_methods[] = {
5538	/* Device interface */
5539	DEVMETHOD(device_probe,		urtwn_match),
5540	DEVMETHOD(device_attach,	urtwn_attach),
5541	DEVMETHOD(device_detach,	urtwn_detach),
5542
5543	DEVMETHOD_END
5544};
5545
5546static driver_t urtwn_driver = {
5547	"urtwn",
5548	urtwn_methods,
5549	sizeof(struct urtwn_softc)
5550};
5551
5552static devclass_t urtwn_devclass;
5553
5554DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
5555MODULE_DEPEND(urtwn, usb, 1, 1, 1);
5556MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
5557#ifndef URTWN_WITHOUT_UCODE
5558MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
5559#endif
5560MODULE_VERSION(urtwn, 1);
5561USB_PNP_HOST_INFO(urtwn_devs);
5562