if_rtwn.c revision 295865
1/*	$OpenBSD: if_rtwn.c,v 1.6 2015/08/28 00:03:53 deraadt Exp $	*/
2
3/*-
4 * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/rtwn/if_rtwn.c 295865 2016-02-21 18:51:48Z avos $");
22
23/*
24 * Driver for Realtek RTL8188CE
25 */
26
27#include <sys/param.h>
28#include <sys/sysctl.h>
29#include <sys/sockio.h>
30#include <sys/mbuf.h>
31#include <sys/kernel.h>
32#include <sys/socket.h>
33#include <sys/systm.h>
34#include <sys/malloc.h>
35#include <sys/lock.h>
36#include <sys/mutex.h>
37#include <sys/module.h>
38#include <sys/bus.h>
39#include <sys/endian.h>
40#include <sys/firmware.h>
41
42#include <machine/bus.h>
43#include <machine/resource.h>
44#include <sys/rman.h>
45
46#include <dev/pci/pcireg.h>
47#include <dev/pci/pcivar.h>
48
49#include <net/bpf.h>
50#include <net/if.h>
51#include <net/if_var.h>
52#include <net/if_arp.h>
53#include <net/ethernet.h>
54#include <net/if_dl.h>
55#include <net/if_media.h>
56#include <net/if_types.h>
57
58#include <net80211/ieee80211_var.h>
59#include <net80211/ieee80211_radiotap.h>
60#include <net80211/ieee80211_regdomain.h>
61#include <net80211/ieee80211_ratectl.h>
62
63#include <netinet/in.h>
64#include <netinet/in_systm.h>
65#include <netinet/in_var.h>
66#include <netinet/ip.h>
67#include <netinet/if_ether.h>
68
69#include <dev/rtwn/if_rtwnreg.h>
70
71#define	RTWN_DEBUG
72#ifdef RTWN_DEBUG
73#define	DPRINTF(x)	do { if (sc->sc_debug > 0) printf x; } while (0)
74#define	DPRINTFN(n, x)	do { if (sc->sc_debug >= (n)) printf x; } while (0)
75#else
76#define	DPRINTF(x)
77#define	DPRINTFN(n, x)
78#endif
79
80/*
81 * PCI configuration space registers.
82 */
83#define	RTWN_PCI_IOBA		0x10	/* i/o mapped base */
84#define	RTWN_PCI_MMBA		0x18	/* memory mapped base */
85
86#define RTWN_INT_ENABLE	(R92C_IMR_ROK | R92C_IMR_VODOK | R92C_IMR_VIDOK | \
87			R92C_IMR_BEDOK | R92C_IMR_BKDOK | R92C_IMR_MGNTDOK | \
88			R92C_IMR_HIGHDOK | R92C_IMR_BDOK | R92C_IMR_RDU | \
89			R92C_IMR_RXFOVW)
90
91struct rtwn_ident {
92	uint16_t	vendor;
93	uint16_t	device;
94	const char	*name;
95};
96
97
98static const struct rtwn_ident rtwn_ident_table[] = {
99	{ 0x10ec, 0x8176, "Realtek RTL8188CE" },
100	{ 0, 0, NULL }
101};
102
103
104static void	rtwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
105static void	rtwn_setup_rx_desc(struct rtwn_softc *, struct r92c_rx_desc *,
106		    bus_addr_t, size_t, int);
107static int	rtwn_alloc_rx_list(struct rtwn_softc *);
108static void	rtwn_reset_rx_list(struct rtwn_softc *);
109static void	rtwn_free_rx_list(struct rtwn_softc *);
110static int	rtwn_alloc_tx_list(struct rtwn_softc *, int);
111static void	rtwn_reset_tx_list(struct rtwn_softc *, int);
112static void	rtwn_free_tx_list(struct rtwn_softc *, int);
113static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
114		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
115		    const uint8_t [IEEE80211_ADDR_LEN],
116		    const uint8_t [IEEE80211_ADDR_LEN]);
117static void	rtwn_vap_delete(struct ieee80211vap *);
118static void	rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
119static void	rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
120static void	rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
121static uint8_t	rtwn_read_1(struct rtwn_softc *, uint16_t);
122static uint16_t	rtwn_read_2(struct rtwn_softc *, uint16_t);
123static uint32_t	rtwn_read_4(struct rtwn_softc *, uint16_t);
124static int	rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
125static void	rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
126static uint32_t	rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
127static int	rtwn_llt_write(struct rtwn_softc *, uint32_t, uint32_t);
128static uint8_t	rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
129static void	rtwn_efuse_read(struct rtwn_softc *);
130static int	rtwn_read_chipid(struct rtwn_softc *);
131static void	rtwn_read_rom(struct rtwn_softc *);
132static int	rtwn_ra_init(struct rtwn_softc *);
133static void	rtwn_tsf_sync_enable(struct rtwn_softc *);
134static void	rtwn_set_led(struct rtwn_softc *, int, int);
135static void	rtwn_calib_to(void *);
136static int	rtwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
137static int	rtwn_updateedca(struct ieee80211com *);
138static void	rtwn_update_avgrssi(struct rtwn_softc *, int, int8_t);
139static int8_t	rtwn_get_rssi(struct rtwn_softc *, int, void *);
140static void	rtwn_rx_frame(struct rtwn_softc *, struct r92c_rx_desc *,
141		    struct rtwn_rx_data *, int);
142static int	rtwn_tx(struct rtwn_softc *, struct mbuf *,
143		    struct ieee80211_node *);
144static void	rtwn_tx_done(struct rtwn_softc *, int);
145static int	rtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
146		    const struct ieee80211_bpf_params *);
147static int	rtwn_transmit(struct ieee80211com *, struct mbuf *);
148static void	rtwn_parent(struct ieee80211com *);
149static void	rtwn_start(struct rtwn_softc *sc);
150static void	rtwn_watchdog(void *);
151static int	rtwn_power_on(struct rtwn_softc *);
152static int	rtwn_llt_init(struct rtwn_softc *);
153static void	rtwn_fw_reset(struct rtwn_softc *);
154static void	rtwn_fw_loadpage(struct rtwn_softc *, int, const uint8_t *,
155		    int);
156static int	rtwn_load_firmware(struct rtwn_softc *);
157static int	rtwn_dma_init(struct rtwn_softc *);
158static void	rtwn_mac_init(struct rtwn_softc *);
159static void	rtwn_bb_init(struct rtwn_softc *);
160static void	rtwn_rf_init(struct rtwn_softc *);
161static void	rtwn_cam_init(struct rtwn_softc *);
162static void	rtwn_pa_bias_init(struct rtwn_softc *);
163static void	rtwn_rxfilter_init(struct rtwn_softc *);
164static void	rtwn_edca_init(struct rtwn_softc *);
165static void	rtwn_write_txpower(struct rtwn_softc *, int, uint16_t[]);
166static void	rtwn_get_txpower(struct rtwn_softc *, int,
167		    struct ieee80211_channel *, struct ieee80211_channel *,
168		    uint16_t[]);
169static void	rtwn_set_txpower(struct rtwn_softc *,
170		    struct ieee80211_channel *, struct ieee80211_channel *);
171static void	rtwn_set_rx_bssid_all(struct rtwn_softc *, int);
172static void	rtwn_set_gain(struct rtwn_softc *, uint8_t);
173static void	rtwn_scan_start(struct ieee80211com *);
174static void	rtwn_scan_end(struct ieee80211com *);
175static void	rtwn_set_channel(struct ieee80211com *);
176static void	rtwn_update_mcast(struct ieee80211com *);
177static void	rtwn_set_chan(struct rtwn_softc *,
178		    struct ieee80211_channel *, struct ieee80211_channel *);
179static int	rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
180		    uint16_t[2]);
181static void	rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
182		    uint16_t[2][2]);
183static int	rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
184		    uint16_t[2][2], uint16_t[2][2], int);
185static void	rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
186		    uint16_t[2], int);
187static void	rtwn_iq_calib(struct rtwn_softc *);
188static void	rtwn_lc_calib(struct rtwn_softc *);
189static void	rtwn_temp_calib(struct rtwn_softc *);
190static int	rtwn_init(struct rtwn_softc *);
191static void	rtwn_stop_locked(struct rtwn_softc *);
192static void	rtwn_stop(struct rtwn_softc *);
193static void	rtwn_intr(void *);
194
195/* Aliases. */
196#define	rtwn_bb_write	rtwn_write_4
197#define rtwn_bb_read	rtwn_read_4
198
199static int	rtwn_probe(device_t);
200static int	rtwn_attach(device_t);
201static int	rtwn_detach(device_t);
202static int	rtwn_shutdown(device_t);
203static int	rtwn_suspend(device_t);
204static int	rtwn_resume(device_t);
205
206static device_method_t rtwn_methods[] = {
207	/* Device interface */
208	DEVMETHOD(device_probe,		rtwn_probe),
209	DEVMETHOD(device_attach,	rtwn_attach),
210	DEVMETHOD(device_detach,	rtwn_detach),
211	DEVMETHOD(device_shutdown,	rtwn_shutdown),
212	DEVMETHOD(device_suspend,	rtwn_suspend),
213	DEVMETHOD(device_resume,	rtwn_resume),
214
215	DEVMETHOD_END
216};
217
218static driver_t rtwn_driver = {
219	"rtwn",
220	rtwn_methods,
221	sizeof (struct rtwn_softc)
222};
223static devclass_t rtwn_devclass;
224
225DRIVER_MODULE(rtwn, pci, rtwn_driver, rtwn_devclass, NULL, NULL);
226
227MODULE_VERSION(rtwn, 1);
228
229MODULE_DEPEND(rtwn, pci,  1, 1, 1);
230MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
231MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
232
233static int
234rtwn_probe(device_t dev)
235{
236	const struct rtwn_ident *ident;
237
238	for (ident = rtwn_ident_table; ident->name != NULL; ident++) {
239		if (pci_get_vendor(dev) == ident->vendor &&
240		    pci_get_device(dev) == ident->device) {
241			device_set_desc(dev, ident->name);
242			return (BUS_PROBE_DEFAULT);
243		}
244	}
245	return (ENXIO);
246}
247
248static int
249rtwn_attach(device_t dev)
250{
251	struct rtwn_softc *sc = device_get_softc(dev);
252	struct ieee80211com *ic = &sc->sc_ic;
253	uint32_t lcsr;
254	uint8_t bands[howmany(IEEE80211_MODE_MAX, 8)];
255	int i, count, error, rid;
256
257	sc->sc_dev = dev;
258	sc->sc_debug = 0;
259
260	/*
261	 * Get the offset of the PCI Express Capability Structure in PCI
262	 * Configuration Space.
263	 */
264	error = pci_find_cap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
265	if (error != 0) {
266		device_printf(dev, "PCIe capability structure not found!\n");
267		return (error);
268	}
269
270	/* Enable bus-mastering. */
271	pci_enable_busmaster(dev);
272
273	rid = PCIR_BAR(2);
274	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
275	    RF_ACTIVE);
276	if (sc->mem == NULL) {
277		device_printf(dev, "can't map mem space\n");
278		return (ENOMEM);
279	}
280	sc->sc_st = rman_get_bustag(sc->mem);
281	sc->sc_sh = rman_get_bushandle(sc->mem);
282
283	/* Install interrupt handler. */
284	count = 1;
285	rid = 0;
286	if (pci_alloc_msi(dev, &count) == 0)
287		rid = 1;
288	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
289	    (rid != 0 ? 0 : RF_SHAREABLE));
290	if (sc->irq == NULL) {
291		device_printf(dev, "can't map interrupt\n");
292		return (ENXIO);
293	}
294
295	RTWN_LOCK_INIT(sc);
296	callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
297	callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
298	mbufq_init(&sc->sc_snd, ifqmaxlen);
299
300	error = rtwn_read_chipid(sc);
301	if (error != 0) {
302		device_printf(dev, "unsupported test chip\n");
303		goto fail;
304	}
305
306	/* Disable PCIe Active State Power Management (ASPM). */
307	lcsr = pci_read_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, 4);
308	lcsr &= ~PCIEM_LINK_CTL_ASPMC;
309	pci_write_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, lcsr, 4);
310
311	/* Allocate Tx/Rx buffers. */
312	error = rtwn_alloc_rx_list(sc);
313	if (error != 0) {
314		device_printf(dev, "could not allocate Rx buffers\n");
315		goto fail;
316	}
317	for (i = 0; i < RTWN_NTXQUEUES; i++) {
318		error = rtwn_alloc_tx_list(sc, i);
319		if (error != 0) {
320			device_printf(dev, "could not allocate Tx buffers\n");
321			goto fail;
322		}
323	}
324
325	/* Determine number of Tx/Rx chains. */
326	if (sc->chip & RTWN_CHIP_92C) {
327		sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
328		sc->nrxchains = 2;
329	} else {
330		sc->ntxchains = 1;
331		sc->nrxchains = 1;
332	}
333	rtwn_read_rom(sc);
334
335	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
336	    (sc->chip & RTWN_CHIP_92C) ? "8192CE" : "8188CE",
337	    sc->ntxchains, sc->nrxchains);
338
339	ic->ic_softc = sc;
340	ic->ic_name = device_get_nameunit(dev);
341	ic->ic_opmode = IEEE80211_M_STA;
342	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
343
344	/* set device capabilities */
345	ic->ic_caps =
346		  IEEE80211_C_STA		/* station mode */
347		| IEEE80211_C_MONITOR		/* monitor mode */
348		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
349		| IEEE80211_C_SHSLOT		/* short slot time supported */
350		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
351		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
352		| IEEE80211_C_WME		/* 802.11e */
353		;
354
355	memset(bands, 0, sizeof(bands));
356	setbit(bands, IEEE80211_MODE_11B);
357	setbit(bands, IEEE80211_MODE_11G);
358	ieee80211_init_channels(ic, NULL, bands);
359
360	ieee80211_ifattach(ic);
361
362	ic->ic_wme.wme_update = rtwn_updateedca;
363	ic->ic_update_mcast = rtwn_update_mcast;
364	ic->ic_scan_start =rtwn_scan_start;
365	ic->ic_scan_end = rtwn_scan_end;
366	ic->ic_set_channel = rtwn_set_channel;
367	ic->ic_raw_xmit = rtwn_raw_xmit;
368	ic->ic_transmit = rtwn_transmit;
369	ic->ic_parent = rtwn_parent;
370	ic->ic_vap_create = rtwn_vap_create;
371	ic->ic_vap_delete = rtwn_vap_delete;
372
373	ieee80211_radiotap_attach(ic,
374	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
375		RTWN_TX_RADIOTAP_PRESENT,
376	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
377		RTWN_RX_RADIOTAP_PRESENT);
378
379	/*
380	 * Hook our interrupt after all initialization is complete.
381	 */
382	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
383	    NULL, rtwn_intr, sc, &sc->sc_ih);
384	if (error != 0) {
385		device_printf(dev, "can't establish interrupt, error %d\n",
386		    error);
387		goto fail;
388	}
389
390	if (bootverbose)
391		ieee80211_announce(ic);
392
393	return (0);
394
395fail:
396	rtwn_detach(dev);
397	return (error);
398}
399
400
401static int
402rtwn_detach(device_t dev)
403{
404	struct rtwn_softc *sc = device_get_softc(dev);
405	int i;
406
407	if (sc->sc_ic.ic_softc != NULL) {
408		rtwn_stop(sc);
409
410		callout_drain(&sc->calib_to);
411		callout_drain(&sc->watchdog_to);
412		ieee80211_ifdetach(&sc->sc_ic);
413		mbufq_drain(&sc->sc_snd);
414	}
415
416	/* Uninstall interrupt handler. */
417	if (sc->irq != NULL) {
418		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
419		bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
420		    sc->irq);
421		pci_release_msi(dev);
422	}
423
424	/* Free Tx/Rx buffers. */
425	for (i = 0; i < RTWN_NTXQUEUES; i++)
426		rtwn_free_tx_list(sc, i);
427	rtwn_free_rx_list(sc);
428
429	if (sc->mem != NULL)
430		bus_release_resource(dev, SYS_RES_MEMORY,
431		    rman_get_rid(sc->mem), sc->mem);
432
433	RTWN_LOCK_DESTROY(sc);
434	return (0);
435}
436
437static int
438rtwn_shutdown(device_t dev)
439{
440
441	return (0);
442}
443
444static int
445rtwn_suspend(device_t dev)
446{
447	return (0);
448}
449
450static int
451rtwn_resume(device_t dev)
452{
453
454	return (0);
455}
456
457static void
458rtwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
459{
460
461	if (error != 0)
462		return;
463	KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
464	*(bus_addr_t *)arg = segs[0].ds_addr;
465}
466
467static void
468rtwn_setup_rx_desc(struct rtwn_softc *sc, struct r92c_rx_desc *desc,
469    bus_addr_t addr, size_t len, int idx)
470{
471
472	memset(desc, 0, sizeof(*desc));
473	desc->rxdw0 = htole32(SM(R92C_RXDW0_PKTLEN, len) |
474		((idx == RTWN_RX_LIST_COUNT - 1) ? R92C_RXDW0_EOR : 0));
475	desc->rxbufaddr = htole32(addr);
476	bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
477	    BUS_SPACE_BARRIER_WRITE);
478	desc->rxdw0 |= htole32(R92C_RXDW0_OWN);
479}
480
481static int
482rtwn_alloc_rx_list(struct rtwn_softc *sc)
483{
484	struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
485	struct rtwn_rx_data *rx_data;
486	bus_size_t size;
487	int i, error;
488
489	/* Allocate Rx descriptors. */
490	size = sizeof(struct r92c_rx_desc) * RTWN_RX_LIST_COUNT;
491	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
492	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
493	    size, 1, size, 0, NULL, NULL, &rx_ring->desc_dmat);
494	if (error != 0) {
495		device_printf(sc->sc_dev, "could not create rx desc DMA tag\n");
496		goto fail;
497	}
498
499	error = bus_dmamem_alloc(rx_ring->desc_dmat, (void **)&rx_ring->desc,
500	    BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT,
501	    &rx_ring->desc_map);
502	if (error != 0) {
503		device_printf(sc->sc_dev, "could not allocate rx desc\n");
504		goto fail;
505	}
506	error = bus_dmamap_load(rx_ring->desc_dmat, rx_ring->desc_map,
507	    rx_ring->desc, size, rtwn_dma_map_addr, &rx_ring->paddr, 0);
508	if (error != 0) {
509		device_printf(sc->sc_dev, "could not load rx desc DMA map\n");
510		goto fail;
511	}
512	bus_dmamap_sync(rx_ring->desc_dmat, rx_ring->desc_map,
513	    BUS_DMASYNC_PREWRITE);
514
515	/* Create RX buffer DMA tag. */
516	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
517	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
518	    1, MCLBYTES, 0, NULL, NULL, &rx_ring->data_dmat);
519	if (error != 0) {
520		device_printf(sc->sc_dev, "could not create rx buf DMA tag\n");
521		goto fail;
522	}
523
524	/* Allocate Rx buffers. */
525	for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
526		rx_data = &rx_ring->rx_data[i];
527		error = bus_dmamap_create(rx_ring->data_dmat, 0, &rx_data->map);
528		if (error != 0) {
529			device_printf(sc->sc_dev,
530			    "could not create rx buf DMA map\n");
531			goto fail;
532		}
533
534		rx_data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
535		if (rx_data->m == NULL) {
536			device_printf(sc->sc_dev,
537			    "could not allocate rx mbuf\n");
538			error = ENOMEM;
539			goto fail;
540		}
541
542		error = bus_dmamap_load(rx_ring->data_dmat, rx_data->map,
543		    mtod(rx_data->m, void *), MCLBYTES, rtwn_dma_map_addr,
544		    &rx_data->paddr, BUS_DMA_NOWAIT);
545		if (error != 0) {
546			device_printf(sc->sc_dev,
547			    "could not load rx buf DMA map");
548			goto fail;
549		}
550
551		rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
552		    MCLBYTES, i);
553	}
554	return (0);
555
556fail:
557	rtwn_free_rx_list(sc);
558	return (error);
559}
560
561static void
562rtwn_reset_rx_list(struct rtwn_softc *sc)
563{
564	struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
565	struct rtwn_rx_data *rx_data;
566	int i;
567
568	for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
569		rx_data = &rx_ring->rx_data[i];
570		rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
571		    MCLBYTES, i);
572	}
573}
574
575static void
576rtwn_free_rx_list(struct rtwn_softc *sc)
577{
578	struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
579	struct rtwn_rx_data *rx_data;
580	int i;
581
582	if (rx_ring->desc_dmat != NULL) {
583		if (rx_ring->desc != NULL) {
584			bus_dmamap_unload(rx_ring->desc_dmat,
585			    rx_ring->desc_map);
586			bus_dmamem_free(rx_ring->desc_dmat, rx_ring->desc,
587			    rx_ring->desc_map);
588			rx_ring->desc = NULL;
589		}
590		bus_dma_tag_destroy(rx_ring->desc_dmat);
591		rx_ring->desc_dmat = NULL;
592	}
593
594	for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
595		rx_data = &rx_ring->rx_data[i];
596
597		if (rx_data->m != NULL) {
598			bus_dmamap_unload(rx_ring->data_dmat, rx_data->map);
599			m_freem(rx_data->m);
600			rx_data->m = NULL;
601		}
602		bus_dmamap_destroy(rx_ring->data_dmat, rx_data->map);
603		rx_data->map = NULL;
604	}
605	if (rx_ring->data_dmat != NULL) {
606		bus_dma_tag_destroy(rx_ring->data_dmat);
607		rx_ring->data_dmat = NULL;
608	}
609}
610
611static int
612rtwn_alloc_tx_list(struct rtwn_softc *sc, int qid)
613{
614	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
615	struct rtwn_tx_data *tx_data;
616	bus_size_t size;
617	int i, error;
618
619	size = sizeof(struct r92c_tx_desc) * RTWN_TX_LIST_COUNT;
620	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), PAGE_SIZE, 0,
621	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
622	    size, 1, size, 0, NULL, NULL, &tx_ring->desc_dmat);
623	if (error != 0) {
624		device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
625		goto fail;
626	}
627
628	error = bus_dmamem_alloc(tx_ring->desc_dmat, (void **)&tx_ring->desc,
629	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &tx_ring->desc_map);
630	if (error != 0) {
631		device_printf(sc->sc_dev, "can't map tx ring DMA memory\n");
632		goto fail;
633	}
634	error = bus_dmamap_load(tx_ring->desc_dmat, tx_ring->desc_map,
635	    tx_ring->desc, size, rtwn_dma_map_addr, &tx_ring->paddr,
636	    BUS_DMA_NOWAIT);
637	if (error != 0) {
638		device_printf(sc->sc_dev, "could not load desc DMA map\n");
639		goto fail;
640	}
641
642	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
643	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
644	    1, MCLBYTES, 0, NULL, NULL, &tx_ring->data_dmat);
645	if (error != 0) {
646		device_printf(sc->sc_dev, "could not create tx buf DMA tag\n");
647		goto fail;
648	}
649
650	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
651		struct r92c_tx_desc *desc = &tx_ring->desc[i];
652
653		/* setup tx desc */
654		desc->nextdescaddr = htole32(tx_ring->paddr +
655		    + sizeof(struct r92c_tx_desc)
656		    * ((i + 1) % RTWN_TX_LIST_COUNT));
657		tx_data = &tx_ring->tx_data[i];
658		error = bus_dmamap_create(tx_ring->data_dmat, 0, &tx_data->map);
659		if (error != 0) {
660			device_printf(sc->sc_dev,
661			    "could not create tx buf DMA map\n");
662			goto fail;
663		}
664		tx_data->m = NULL;
665		tx_data->ni = NULL;
666	}
667	return (0);
668
669fail:
670	rtwn_free_tx_list(sc, qid);
671	return (error);
672}
673
674static void
675rtwn_reset_tx_list(struct rtwn_softc *sc, int qid)
676{
677	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
678	int i;
679
680	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
681		struct r92c_tx_desc *desc = &tx_ring->desc[i];
682		struct rtwn_tx_data *tx_data = &tx_ring->tx_data[i];
683
684		memset(desc, 0, sizeof(*desc) -
685		    (sizeof(desc->reserved) + sizeof(desc->nextdescaddr64) +
686		    sizeof(desc->nextdescaddr)));
687
688		if (tx_data->m != NULL) {
689			bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
690			m_freem(tx_data->m);
691			tx_data->m = NULL;
692		}
693		if (tx_data->ni != NULL) {
694			ieee80211_free_node(tx_data->ni);
695			tx_data->ni = NULL;
696		}
697	}
698
699	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
700	    BUS_DMASYNC_POSTWRITE);
701
702	sc->qfullmsk &= ~(1 << qid);
703	tx_ring->queued = 0;
704	tx_ring->cur = 0;
705}
706
707static void
708rtwn_free_tx_list(struct rtwn_softc *sc, int qid)
709{
710	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
711	struct rtwn_tx_data *tx_data;
712	int i;
713
714	if (tx_ring->desc_dmat != NULL) {
715		if (tx_ring->desc != NULL) {
716			bus_dmamap_unload(tx_ring->desc_dmat,
717			    tx_ring->desc_map);
718			bus_dmamem_free(tx_ring->desc_dmat, tx_ring->desc,
719			    tx_ring->desc_map);
720		}
721		bus_dma_tag_destroy(tx_ring->desc_dmat);
722	}
723
724	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
725		tx_data = &tx_ring->tx_data[i];
726
727		if (tx_data->m != NULL) {
728			bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
729			m_freem(tx_data->m);
730			tx_data->m = NULL;
731		}
732	}
733	if (tx_ring->data_dmat != NULL) {
734		bus_dma_tag_destroy(tx_ring->data_dmat);
735		tx_ring->data_dmat = NULL;
736	}
737
738	sc->qfullmsk &= ~(1 << qid);
739	tx_ring->queued = 0;
740	tx_ring->cur = 0;
741}
742
743
744static struct ieee80211vap *
745rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
746    enum ieee80211_opmode opmode, int flags,
747    const uint8_t bssid[IEEE80211_ADDR_LEN],
748    const uint8_t mac[IEEE80211_ADDR_LEN])
749{
750	struct rtwn_vap *rvp;
751	struct ieee80211vap *vap;
752
753	if (!TAILQ_EMPTY(&ic->ic_vaps))
754		return (NULL);
755
756	rvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
757	vap = &rvp->vap;
758	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
759	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
760		/* out of memory */
761		 free(rvp, M_80211_VAP);
762		 return (NULL);
763	}
764
765	/* Override state transition machine. */
766	rvp->newstate = vap->iv_newstate;
767	vap->iv_newstate = rtwn_newstate;
768
769	/* Complete setup. */
770	ieee80211_vap_attach(vap, ieee80211_media_change,
771	    ieee80211_media_status, mac);
772	ic->ic_opmode = opmode;
773	return (vap);
774}
775
776static void
777rtwn_vap_delete(struct ieee80211vap *vap)
778{
779	struct rtwn_vap *rvp = RTWN_VAP(vap);
780
781	ieee80211_vap_detach(vap);
782	free(rvp, M_80211_VAP);
783}
784
785static void
786rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
787{
788
789	bus_space_write_1(sc->sc_st, sc->sc_sh, addr, val);
790}
791
792static void
793rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
794{
795
796	val = htole16(val);
797	bus_space_write_2(sc->sc_st, sc->sc_sh, addr, val);
798}
799
800static void
801rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
802{
803
804	val = htole32(val);
805	bus_space_write_4(sc->sc_st, sc->sc_sh, addr, val);
806}
807
808static uint8_t
809rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
810{
811
812	return (bus_space_read_1(sc->sc_st, sc->sc_sh, addr));
813}
814
815static uint16_t
816rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
817{
818
819	return (bus_space_read_2(sc->sc_st, sc->sc_sh, addr));
820}
821
822static uint32_t
823rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
824{
825
826	return (bus_space_read_4(sc->sc_st, sc->sc_sh, addr));
827}
828
829static int
830rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
831{
832	struct r92c_fw_cmd cmd;
833	int ntries;
834
835	/* Wait for current FW box to be empty. */
836	for (ntries = 0; ntries < 100; ntries++) {
837		if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
838			break;
839		DELAY(1);
840	}
841	if (ntries == 100) {
842		device_printf(sc->sc_dev,
843		    "could not send firmware command %d\n", id);
844		return (ETIMEDOUT);
845	}
846	memset(&cmd, 0, sizeof(cmd));
847	cmd.id = id;
848	if (len > 3)
849		cmd.id |= R92C_CMD_FLAG_EXT;
850	KASSERT(len <= sizeof(cmd.msg), ("rtwn_fw_cmd\n"));
851	memcpy(cmd.msg, buf, len);
852
853	/* Write the first word last since that will trigger the FW. */
854	rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur), *((uint8_t *)&cmd + 4));
855	rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
856
857	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
858
859	/* Give firmware some time for processing. */
860	DELAY(2000);
861
862	return (0);
863}
864
865static void
866rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
867{
868	rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
869	    SM(R92C_LSSI_PARAM_ADDR, addr) |
870	    SM(R92C_LSSI_PARAM_DATA, val));
871}
872
873static uint32_t
874rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
875{
876	uint32_t reg[R92C_MAX_CHAINS], val;
877
878	reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
879	if (chain != 0)
880		reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
881
882	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
883	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
884	DELAY(1000);
885
886	rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
887	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
888	    R92C_HSSI_PARAM2_READ_EDGE);
889	DELAY(1000);
890
891	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
892	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
893	DELAY(1000);
894
895	if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
896		val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
897	else
898		val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
899	return (MS(val, R92C_LSSI_READBACK_DATA));
900}
901
902static int
903rtwn_llt_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
904{
905	int ntries;
906
907	rtwn_write_4(sc, R92C_LLT_INIT,
908	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
909	    SM(R92C_LLT_INIT_ADDR, addr) |
910	    SM(R92C_LLT_INIT_DATA, data));
911	/* Wait for write operation to complete. */
912	for (ntries = 0; ntries < 20; ntries++) {
913		if (MS(rtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
914		    R92C_LLT_INIT_OP_NO_ACTIVE)
915			return (0);
916		DELAY(5);
917	}
918	return (ETIMEDOUT);
919}
920
921static uint8_t
922rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
923{
924	uint32_t reg;
925	int ntries;
926
927	reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
928	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
929	reg &= ~R92C_EFUSE_CTRL_VALID;
930	rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
931	/* Wait for read operation to complete. */
932	for (ntries = 0; ntries < 100; ntries++) {
933		reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
934		if (reg & R92C_EFUSE_CTRL_VALID)
935			return (MS(reg, R92C_EFUSE_CTRL_DATA));
936		DELAY(5);
937	}
938	device_printf(sc->sc_dev,
939	    "could not read efuse byte at address 0x%x\n", addr);
940	return (0xff);
941}
942
943static void
944rtwn_efuse_read(struct rtwn_softc *sc)
945{
946	uint8_t *rom = (uint8_t *)&sc->rom;
947	uint16_t addr = 0;
948	uint32_t reg;
949	uint8_t off, msk;
950	int i;
951
952	reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
953	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
954		rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
955		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
956	}
957	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
958	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
959		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
960		    reg | R92C_SYS_FUNC_EN_ELDR);
961	}
962	reg = rtwn_read_2(sc, R92C_SYS_CLKR);
963	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
964	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
965		rtwn_write_2(sc, R92C_SYS_CLKR,
966		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
967	}
968	memset(&sc->rom, 0xff, sizeof(sc->rom));
969	while (addr < 512) {
970		reg = rtwn_efuse_read_1(sc, addr);
971		if (reg == 0xff)
972			break;
973		addr++;
974		off = reg >> 4;
975		msk = reg & 0xf;
976		for (i = 0; i < 4; i++) {
977			if (msk & (1 << i))
978				continue;
979			rom[off * 8 + i * 2 + 0] =
980			    rtwn_efuse_read_1(sc, addr);
981			addr++;
982			rom[off * 8 + i * 2 + 1] =
983			    rtwn_efuse_read_1(sc, addr);
984			addr++;
985		}
986	}
987#ifdef RTWN_DEBUG
988	if (sc->sc_debug >= 2) {
989		/* Dump ROM content. */
990		printf("\n");
991		for (i = 0; i < sizeof(sc->rom); i++)
992			printf("%02x:", rom[i]);
993		printf("\n");
994	}
995#endif
996}
997
998static int
999rtwn_read_chipid(struct rtwn_softc *sc)
1000{
1001	uint32_t reg;
1002
1003	reg = rtwn_read_4(sc, R92C_SYS_CFG);
1004	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1005		/* Unsupported test chip. */
1006		return (EIO);
1007
1008	if (reg & R92C_SYS_CFG_TYPE_92C) {
1009		sc->chip |= RTWN_CHIP_92C;
1010		/* Check if it is a castrated 8192C. */
1011		if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
1012		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1013		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1014			sc->chip |= RTWN_CHIP_92C_1T2R;
1015	}
1016	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1017		sc->chip |= RTWN_CHIP_UMC;
1018		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1019			sc->chip |= RTWN_CHIP_UMC_A_CUT;
1020	}
1021	return (0);
1022}
1023
1024static void
1025rtwn_read_rom(struct rtwn_softc *sc)
1026{
1027	struct r92c_rom *rom = &sc->rom;
1028
1029	/* Read full ROM image. */
1030	rtwn_efuse_read(sc);
1031
1032	if (rom->id != 0x8129)
1033		device_printf(sc->sc_dev, "invalid EEPROM ID 0x%x\n", rom->id);
1034
1035	/* XXX Weird but this is what the vendor driver does. */
1036	sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
1037	DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
1038
1039	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1040
1041	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1042	DPRINTF(("regulatory type=%d\n", sc->regulatory));
1043
1044	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1045}
1046
1047/*
1048 * Initialize rate adaptation in firmware.
1049 */
1050static int
1051rtwn_ra_init(struct rtwn_softc *sc)
1052{
1053	static const uint8_t map[] =
1054	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1055	struct ieee80211com *ic = &sc->sc_ic;
1056	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1057	struct ieee80211_node *ni = ieee80211_ref_node(vap->iv_bss);
1058	struct ieee80211_rateset *rs = &ni->ni_rates;
1059	struct r92c_fw_cmd_macid_cfg cmd;
1060	uint32_t rates, basicrates;
1061	uint8_t mode;
1062	int maxrate, maxbasicrate, error, i, j;
1063
1064	/* Get normal and basic rates mask. */
1065	rates = basicrates = 0;
1066	maxrate = maxbasicrate = 0;
1067	for (i = 0; i < rs->rs_nrates; i++) {
1068		/* Convert 802.11 rate to HW rate index. */
1069		for (j = 0; j < nitems(map); j++)
1070			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1071				break;
1072		if (j == nitems(map))	/* Unknown rate, skip. */
1073			continue;
1074		rates |= 1 << j;
1075		if (j > maxrate)
1076			maxrate = j;
1077		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1078			basicrates |= 1 << j;
1079			if (j > maxbasicrate)
1080				maxbasicrate = j;
1081		}
1082	}
1083	if (ic->ic_curmode == IEEE80211_MODE_11B)
1084		mode = R92C_RAID_11B;
1085	else
1086		mode = R92C_RAID_11BG;
1087	DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1088	    mode, rates, basicrates));
1089
1090	/* Set rates mask for group addressed frames. */
1091	cmd.macid = RTWN_MACID_BC | RTWN_MACID_VALID;
1092	cmd.mask = htole32(mode << 28 | basicrates);
1093	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1094	if (error != 0) {
1095		device_printf(sc->sc_dev,
1096		    "could not add broadcast station\n");
1097		return (error);
1098	}
1099	/* Set initial MRR rate. */
1100	DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
1101	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BC),
1102	    maxbasicrate);
1103
1104	/* Set rates mask for unicast frames. */
1105	cmd.macid = RTWN_MACID_BSS | RTWN_MACID_VALID;
1106	cmd.mask = htole32(mode << 28 | rates);
1107	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1108	if (error != 0) {
1109		device_printf(sc->sc_dev, "could not add BSS station\n");
1110		return (error);
1111	}
1112	/* Set initial MRR rate. */
1113	DPRINTF(("maxrate=%d\n", maxrate));
1114	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BSS),
1115	    maxrate);
1116
1117	/* Configure Automatic Rate Fallback Register. */
1118	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1119		if (rates & 0x0c)
1120			rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0d));
1121		else
1122			rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0f));
1123	} else
1124		rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0ff5));
1125
1126	/* Indicate highest supported rate. */
1127	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1128	return (0);
1129}
1130
1131static void
1132rtwn_tsf_sync_enable(struct rtwn_softc *sc)
1133{
1134	struct ieee80211com *ic = &sc->sc_ic;
1135	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1136	struct ieee80211_node *ni = vap->iv_bss;
1137	uint64_t tsf;
1138
1139	/* Enable TSF synchronization. */
1140	rtwn_write_1(sc, R92C_BCN_CTRL,
1141	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1142
1143	rtwn_write_1(sc, R92C_BCN_CTRL,
1144	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1145
1146	/* Set initial TSF. */
1147	memcpy(&tsf, ni->ni_tstamp.data, 8);
1148	tsf = le64toh(tsf);
1149	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1150	tsf -= IEEE80211_DUR_TU;
1151	rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1152	rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1153
1154	rtwn_write_1(sc, R92C_BCN_CTRL,
1155	    rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1156}
1157
1158static void
1159rtwn_set_led(struct rtwn_softc *sc, int led, int on)
1160{
1161	uint8_t reg;
1162
1163	if (led == RTWN_LED_LINK) {
1164		reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1165		if (!on)
1166			reg |= R92C_LEDCFG2_DIS;
1167		else
1168			reg |= R92C_LEDCFG2_EN;
1169		rtwn_write_1(sc, R92C_LEDCFG2, reg);
1170		sc->ledlink = on;	/* Save LED state. */
1171	}
1172}
1173
1174static void
1175rtwn_calib_to(void *arg)
1176{
1177	struct rtwn_softc *sc = arg;
1178	struct r92c_fw_cmd_rssi cmd;
1179
1180	if (sc->avg_pwdb != -1) {
1181		/* Indicate Rx signal strength to FW for rate adaptation. */
1182		memset(&cmd, 0, sizeof(cmd));
1183		cmd.macid = 0;	/* BSS. */
1184		cmd.pwdb = sc->avg_pwdb;
1185		DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
1186		rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
1187	}
1188
1189	/* Do temperature compensation. */
1190	rtwn_temp_calib(sc);
1191
1192	callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
1193}
1194
1195static int
1196rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1197{
1198	struct rtwn_vap *rvp = RTWN_VAP(vap);
1199	struct ieee80211com *ic = vap->iv_ic;
1200	struct ieee80211_node *ni = vap->iv_bss;
1201	struct rtwn_softc *sc = ic->ic_softc;
1202	uint32_t reg;
1203
1204	IEEE80211_UNLOCK(ic);
1205	RTWN_LOCK(sc);
1206
1207	if (vap->iv_state == IEEE80211_S_RUN) {
1208		/* Stop calibration. */
1209		callout_stop(&sc->calib_to);
1210
1211		/* Turn link LED off. */
1212		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1213
1214		/* Set media status to 'No Link'. */
1215		reg = rtwn_read_4(sc, R92C_CR);
1216		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1217		rtwn_write_4(sc, R92C_CR, reg);
1218
1219		/* Stop Rx of data frames. */
1220		rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1221
1222		/* Rest TSF. */
1223		rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1224
1225		/* Disable TSF synchronization. */
1226		rtwn_write_1(sc, R92C_BCN_CTRL,
1227		    rtwn_read_1(sc, R92C_BCN_CTRL) |
1228		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1229
1230		/* Reset EDCA parameters. */
1231		rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1232		rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1233		rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1234		rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1235	}
1236	switch (nstate) {
1237	case IEEE80211_S_INIT:
1238		/* Turn link LED off. */
1239		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1240		break;
1241	case IEEE80211_S_SCAN:
1242		/* Make link LED blink during scan. */
1243		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1244
1245		/* Pause AC Tx queues. */
1246		rtwn_write_1(sc, R92C_TXPAUSE,
1247		    rtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1248		break;
1249	case IEEE80211_S_AUTH:
1250		rtwn_set_chan(sc, ic->ic_curchan, NULL);
1251		break;
1252	case IEEE80211_S_RUN:
1253		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1254			/* Enable Rx of data frames. */
1255			rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1256
1257			/* Turn link LED on. */
1258			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1259			break;
1260		}
1261
1262		/* Set media status to 'Associated'. */
1263		reg = rtwn_read_4(sc, R92C_CR);
1264		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1265		rtwn_write_4(sc, R92C_CR, reg);
1266
1267		/* Set BSSID. */
1268		rtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1269		rtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1270
1271		if (ic->ic_curmode == IEEE80211_MODE_11B)
1272			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1273		else	/* 802.11b/g */
1274			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1275
1276		/* Enable Rx of data frames. */
1277		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1278
1279		/* Flush all AC queues. */
1280		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1281
1282		/* Set beacon interval. */
1283		rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1284
1285		/* Allow Rx from our BSSID only. */
1286		rtwn_write_4(sc, R92C_RCR,
1287		    rtwn_read_4(sc, R92C_RCR) |
1288		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1289
1290		/* Enable TSF synchronization. */
1291		rtwn_tsf_sync_enable(sc);
1292
1293		rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1294		rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1295		rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1296		rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1297		rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1298		rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1299
1300		/* Intialize rate adaptation. */
1301		rtwn_ra_init(sc);
1302		/* Turn link LED on. */
1303		rtwn_set_led(sc, RTWN_LED_LINK, 1);
1304
1305		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1306		/* Reset temperature calibration state machine. */
1307		sc->thcal_state = 0;
1308		sc->thcal_lctemp = 0;
1309		/* Start periodic calibration. */
1310		callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
1311		break;
1312	default:
1313		break;
1314	}
1315	RTWN_UNLOCK(sc);
1316	IEEE80211_LOCK(ic);
1317	return (rvp->newstate(vap, nstate, arg));
1318}
1319
1320static int
1321rtwn_updateedca(struct ieee80211com *ic)
1322{
1323	struct rtwn_softc *sc = ic->ic_softc;
1324	const uint16_t aci2reg[WME_NUM_AC] = {
1325		R92C_EDCA_BE_PARAM,
1326		R92C_EDCA_BK_PARAM,
1327		R92C_EDCA_VI_PARAM,
1328		R92C_EDCA_VO_PARAM
1329	};
1330	int aci, aifs, slottime;
1331
1332	IEEE80211_LOCK(ic);
1333	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1334	for (aci = 0; aci < WME_NUM_AC; aci++) {
1335		const struct wmeParams *ac =
1336		    &ic->ic_wme.wme_chanParams.cap_wmeParams[aci];
1337		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1338		aifs = ac->wmep_aifsn * slottime + 10;
1339		rtwn_write_4(sc, aci2reg[aci],
1340		    SM(R92C_EDCA_PARAM_TXOP, ac->wmep_txopLimit) |
1341		    SM(R92C_EDCA_PARAM_ECWMIN, ac->wmep_logcwmin) |
1342		    SM(R92C_EDCA_PARAM_ECWMAX, ac->wmep_logcwmax) |
1343		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1344	}
1345	IEEE80211_UNLOCK(ic);
1346	return (0);
1347}
1348
1349static void
1350rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
1351{
1352	int pwdb;
1353
1354	/* Convert antenna signal to percentage. */
1355	if (rssi <= -100 || rssi >= 20)
1356		pwdb = 0;
1357	else if (rssi >= 0)
1358		pwdb = 100;
1359	else
1360		pwdb = 100 + rssi;
1361	if (rate <= 3) {
1362		/* CCK gain is smaller than OFDM/MCS gain. */
1363		pwdb += 6;
1364		if (pwdb > 100)
1365			pwdb = 100;
1366		if (pwdb <= 14)
1367			pwdb -= 4;
1368		else if (pwdb <= 26)
1369			pwdb -= 8;
1370		else if (pwdb <= 34)
1371			pwdb -= 6;
1372		else if (pwdb <= 42)
1373			pwdb -= 2;
1374	}
1375	if (sc->avg_pwdb == -1)	/* Init. */
1376		sc->avg_pwdb = pwdb;
1377	else if (sc->avg_pwdb < pwdb)
1378		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1379	else
1380		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1381	DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
1382}
1383
1384static int8_t
1385rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1386{
1387	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1388	struct r92c_rx_phystat *phy;
1389	struct r92c_rx_cck *cck;
1390	uint8_t rpt;
1391	int8_t rssi;
1392
1393	if (rate <= 3) {
1394		cck = (struct r92c_rx_cck *)physt;
1395		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1396			rpt = (cck->agc_rpt >> 5) & 0x3;
1397			rssi = (cck->agc_rpt & 0x1f) << 1;
1398		} else {
1399			rpt = (cck->agc_rpt >> 6) & 0x3;
1400			rssi = cck->agc_rpt & 0x3e;
1401		}
1402		rssi = cckoff[rpt] - rssi;
1403	} else {	/* OFDM/HT. */
1404		phy = (struct r92c_rx_phystat *)physt;
1405		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1406	}
1407	return (rssi);
1408}
1409
1410static void
1411rtwn_rx_frame(struct rtwn_softc *sc, struct r92c_rx_desc *rx_desc,
1412    struct rtwn_rx_data *rx_data, int desc_idx)
1413{
1414	struct ieee80211com *ic = &sc->sc_ic;
1415	struct ieee80211_frame_min *wh;
1416	struct ieee80211_node *ni;
1417	struct r92c_rx_phystat *phy = NULL;
1418	uint32_t rxdw0, rxdw3;
1419	struct mbuf *m, *m1;
1420	bus_dma_segment_t segs[1];
1421	bus_addr_t physaddr;
1422	uint8_t rate;
1423	int8_t rssi = 0, nf;
1424	int infosz, nsegs, pktlen, shift, error;
1425
1426	rxdw0 = le32toh(rx_desc->rxdw0);
1427	rxdw3 = le32toh(rx_desc->rxdw3);
1428
1429	if (__predict_false(rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR))) {
1430		/*
1431		 * This should not happen since we setup our Rx filter
1432		 * to not receive these frames.
1433		 */
1434		counter_u64_add(ic->ic_ierrors, 1);
1435		return;
1436	}
1437
1438	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
1439	if (__predict_false(pktlen < sizeof(struct ieee80211_frame_ack) ||
1440	    pktlen > MCLBYTES)) {
1441		counter_u64_add(ic->ic_ierrors, 1);
1442		return;
1443	}
1444
1445	rate = MS(rxdw3, R92C_RXDW3_RATE);
1446	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1447	if (infosz > sizeof(struct r92c_rx_phystat))
1448		infosz = sizeof(struct r92c_rx_phystat);
1449	shift = MS(rxdw0, R92C_RXDW0_SHIFT);
1450
1451	/* Get RSSI from PHY status descriptor if present. */
1452	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1453		phy = mtod(rx_data->m, struct r92c_rx_phystat *);
1454		rssi = rtwn_get_rssi(sc, rate, phy);
1455		/* Update our average RSSI. */
1456		rtwn_update_avgrssi(sc, rate, rssi);
1457	}
1458
1459	DPRINTFN(5, ("Rx frame len=%d rate=%d infosz=%d shift=%d rssi=%d\n",
1460	    pktlen, rate, infosz, shift, rssi));
1461
1462	m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1463	if (m1 == NULL) {
1464		counter_u64_add(ic->ic_ierrors, 1);
1465		return;
1466	}
1467	bus_dmamap_unload(sc->rx_ring.data_dmat, rx_data->map);
1468
1469	error = bus_dmamap_load(sc->rx_ring.data_dmat, rx_data->map,
1470	     mtod(m1, void *), MCLBYTES, rtwn_dma_map_addr,
1471	     &physaddr, 0);
1472	if (error != 0) {
1473		m_freem(m1);
1474
1475		if (bus_dmamap_load_mbuf_sg(sc->rx_ring.data_dmat,
1476		    rx_data->map, rx_data->m, segs, &nsegs, 0))
1477			panic("%s: could not load old RX mbuf",
1478			    device_get_name(sc->sc_dev));
1479
1480		/* Physical address may have changed. */
1481		rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
1482		counter_u64_add(ic->ic_ierrors, 1);
1483		return;
1484	}
1485
1486	/* Finalize mbuf. */
1487	m = rx_data->m;
1488	rx_data->m = m1;
1489	m->m_pkthdr.len = m->m_len = pktlen + infosz + shift;
1490
1491	/* Update RX descriptor. */
1492	rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
1493
1494	/* Get ieee80211 frame header. */
1495	if (rxdw0 & R92C_RXDW0_PHYST)
1496		m_adj(m, infosz + shift);
1497	else
1498		m_adj(m, shift);
1499
1500	nf = -95;
1501	if (ieee80211_radiotap_active(ic)) {
1502		struct rtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1503
1504		tap->wr_flags = 0;
1505		if (!(rxdw3 & R92C_RXDW3_HT)) {
1506			switch (rate) {
1507			/* CCK. */
1508			case  0: tap->wr_rate =   2; break;
1509			case  1: tap->wr_rate =   4; break;
1510			case  2: tap->wr_rate =  11; break;
1511			case  3: tap->wr_rate =  22; break;
1512			/* OFDM. */
1513			case  4: tap->wr_rate =  12; break;
1514			case  5: tap->wr_rate =  18; break;
1515			case  6: tap->wr_rate =  24; break;
1516			case  7: tap->wr_rate =  36; break;
1517			case  8: tap->wr_rate =  48; break;
1518			case  9: tap->wr_rate =  72; break;
1519			case 10: tap->wr_rate =  96; break;
1520			case 11: tap->wr_rate = 108; break;
1521			}
1522		} else if (rate >= 12) {	/* MCS0~15. */
1523			/* Bit 7 set means HT MCS instead of rate. */
1524			tap->wr_rate = 0x80 | (rate - 12);
1525		}
1526		tap->wr_dbm_antsignal = rssi;
1527		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1528		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1529	}
1530
1531	RTWN_UNLOCK(sc);
1532	wh = mtod(m, struct ieee80211_frame_min *);
1533	if (m->m_len >= sizeof(*wh))
1534		ni = ieee80211_find_rxnode(ic, wh);
1535	else
1536		ni = NULL;
1537
1538	/* Send the frame to the 802.11 layer. */
1539	if (ni != NULL) {
1540		(void)ieee80211_input(ni, m, rssi - nf, nf);
1541		/* Node is no longer needed. */
1542		ieee80211_free_node(ni);
1543	} else
1544		(void)ieee80211_input_all(ic, m, rssi - nf, nf);
1545
1546	RTWN_LOCK(sc);
1547}
1548
1549static int
1550rtwn_tx(struct rtwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1551{
1552	struct ieee80211com *ic = &sc->sc_ic;
1553	struct ieee80211vap *vap = ni->ni_vap;
1554	struct ieee80211_frame *wh;
1555	struct ieee80211_key *k = NULL;
1556	struct rtwn_tx_ring *tx_ring;
1557	struct rtwn_tx_data *data;
1558	struct r92c_tx_desc *txd;
1559	bus_dma_segment_t segs[1];
1560	uint16_t qos;
1561	uint8_t raid, type, tid, qid;
1562	int nsegs, error;
1563
1564	wh = mtod(m, struct ieee80211_frame *);
1565	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1566
1567	/* Encrypt the frame if need be. */
1568	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1569		k = ieee80211_crypto_encap(ni, m);
1570		if (k == NULL) {
1571			m_freem(m);
1572			return (ENOBUFS);
1573		}
1574		/* 802.11 header may have moved. */
1575		wh = mtod(m, struct ieee80211_frame *);
1576	}
1577
1578	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1579		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
1580		tid = qos & IEEE80211_QOS_TID;
1581	} else {
1582		qos = 0;
1583		tid = 0;
1584	}
1585
1586	switch (type) {
1587	case IEEE80211_FC0_TYPE_CTL:
1588	case IEEE80211_FC0_TYPE_MGT:
1589		qid = RTWN_VO_QUEUE;
1590		break;
1591	default:
1592		qid = M_WME_GETAC(m);
1593		break;
1594	}
1595
1596	/* Grab a Tx buffer from the ring. */
1597	tx_ring = &sc->tx_ring[qid];
1598	data = &tx_ring->tx_data[tx_ring->cur];
1599	if (data->m != NULL) {
1600		m_freem(m);
1601		return (ENOBUFS);
1602	}
1603
1604	/* Fill Tx descriptor. */
1605	txd = &tx_ring->desc[tx_ring->cur];
1606	if (htole32(txd->txdw0) & R92C_RXDW0_OWN) {
1607		m_freem(m);
1608		return (ENOBUFS);
1609	}
1610	txd->txdw0 = htole32(
1611	    SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len) |
1612	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1613	    R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1614	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1615		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1616
1617	txd->txdw1 = 0;
1618	txd->txdw4 = 0;
1619	txd->txdw5 = 0;
1620
1621	/* XXX TODO: rate control; implement low-rate for EAPOL */
1622	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1623	    type == IEEE80211_FC0_TYPE_DATA) {
1624		if (ic->ic_curmode == IEEE80211_MODE_11B)
1625			raid = R92C_RAID_11B;
1626		else
1627			raid = R92C_RAID_11BG;
1628		txd->txdw1 |= htole32(
1629		    SM(R92C_TXDW1_MACID, RTWN_MACID_BSS) |
1630		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1631		    SM(R92C_TXDW1_RAID, raid) |
1632		    R92C_TXDW1_AGGBK);
1633
1634		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1635			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1636				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1637				    R92C_TXDW4_HWRTSEN);
1638			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1639				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1640				    R92C_TXDW4_HWRTSEN);
1641			}
1642		}
1643
1644		/* XXX TODO: implement rate control */
1645
1646		/* Send RTS at OFDM24. */
1647		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1648		txd->txdw5 |= htole32(SM(R92C_TXDW5_RTSRATE_FBLIMIT, 0xf));
1649		/* Send data at OFDM54. */
1650		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1651		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE_FBLIMIT, 0x1f));
1652
1653	} else {
1654		txd->txdw1 |= htole32(
1655		    SM(R92C_TXDW1_MACID, 0) |
1656		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1657		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1658
1659		/* Force CCK1. */
1660		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1661		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1662	}
1663	/* Set sequence number (already little endian). */
1664	txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
1665
1666	if (!qos) {
1667		/* Use HW sequence numbering for non-QoS frames. */
1668		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1669		txd->txdseq |= htole16(0x8000);
1670	} else
1671		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1672
1673	error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map, m, segs,
1674	    &nsegs, BUS_DMA_NOWAIT);
1675	if (error != 0 && error != EFBIG) {
1676		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", error);
1677		m_freem(m);
1678		return (error);
1679	}
1680	if (error != 0) {
1681		struct mbuf *mnew;
1682
1683		mnew = m_defrag(m, M_NOWAIT);
1684		if (mnew == NULL) {
1685			device_printf(sc->sc_dev,
1686			    "can't defragment mbuf\n");
1687			m_freem(m);
1688			return (ENOBUFS);
1689		}
1690		m = mnew;
1691
1692		error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map,
1693		    m, segs, &nsegs, BUS_DMA_NOWAIT);
1694		if (error != 0) {
1695			device_printf(sc->sc_dev,
1696			    "can't map mbuf (error %d)\n", error);
1697			m_freem(m);
1698			return (error);
1699		}
1700	}
1701
1702	txd->txbufaddr = htole32(segs[0].ds_addr);
1703	txd->txbufsize = htole16(m->m_pkthdr.len);
1704	bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
1705	    BUS_SPACE_BARRIER_WRITE);
1706	txd->txdw0 |= htole32(R92C_TXDW0_OWN);
1707
1708	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
1709	    BUS_DMASYNC_POSTWRITE);
1710	bus_dmamap_sync(tx_ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1711
1712	data->m = m;
1713	data->ni = ni;
1714
1715	if (ieee80211_radiotap_active_vap(vap)) {
1716		struct rtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1717
1718		tap->wt_flags = 0;
1719		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1720		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1721
1722		ieee80211_radiotap_tx(vap, m);
1723	}
1724
1725	tx_ring->cur = (tx_ring->cur + 1) % RTWN_TX_LIST_COUNT;
1726	tx_ring->queued++;
1727
1728	if (tx_ring->queued >= (RTWN_TX_LIST_COUNT - 1))
1729		sc->qfullmsk |= (1 << qid);
1730
1731	/* Kick TX. */
1732	rtwn_write_2(sc, R92C_PCIE_CTRL_REG, (1 << qid));
1733	return (0);
1734}
1735
1736static void
1737rtwn_tx_done(struct rtwn_softc *sc, int qid)
1738{
1739	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
1740	struct rtwn_tx_data *tx_data;
1741	struct r92c_tx_desc *tx_desc;
1742	int i;
1743
1744	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
1745	    BUS_DMASYNC_POSTREAD);
1746
1747	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
1748		tx_data = &tx_ring->tx_data[i];
1749		if (tx_data->m == NULL)
1750			continue;
1751
1752		tx_desc = &tx_ring->desc[i];
1753		if (le32toh(tx_desc->txdw0) & R92C_TXDW0_OWN)
1754			continue;
1755
1756		bus_dmamap_unload(tx_ring->desc_dmat, tx_ring->desc_map);
1757
1758		/*
1759		 * XXX TODO: figure out whether the transmit succeeded or not.
1760		 * .. and then notify rate control.
1761		 */
1762		ieee80211_tx_complete(tx_data->ni, tx_data->m, 0);
1763		tx_data->ni = NULL;
1764		tx_data->m = NULL;
1765
1766		sc->sc_tx_timer = 0;
1767		tx_ring->queued--;
1768	}
1769
1770	if (tx_ring->queued < (RTWN_TX_LIST_COUNT - 1))
1771		sc->qfullmsk &= ~(1 << qid);
1772	rtwn_start(sc);
1773}
1774
1775static int
1776rtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1777    const struct ieee80211_bpf_params *params)
1778{
1779	struct ieee80211com *ic = ni->ni_ic;
1780	struct rtwn_softc *sc = ic->ic_softc;
1781
1782	RTWN_LOCK(sc);
1783
1784	/* Prevent management frames from being sent if we're not ready. */
1785	if (!(sc->sc_flags & RTWN_RUNNING)) {
1786		RTWN_UNLOCK(sc);
1787		m_freem(m);
1788		return (ENETDOWN);
1789	}
1790
1791	if (rtwn_tx(sc, m, ni) != 0) {
1792		m_freem(m);
1793		RTWN_UNLOCK(sc);
1794		return (EIO);
1795	}
1796	sc->sc_tx_timer = 5;
1797	RTWN_UNLOCK(sc);
1798	return (0);
1799}
1800
1801static int
1802rtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
1803{
1804	struct rtwn_softc *sc = ic->ic_softc;
1805	int error;
1806
1807	RTWN_LOCK(sc);
1808	if ((sc->sc_flags & RTWN_RUNNING) == 0) {
1809		RTWN_UNLOCK(sc);
1810		return (ENXIO);
1811	}
1812	error = mbufq_enqueue(&sc->sc_snd, m);
1813	if (error) {
1814		RTWN_UNLOCK(sc);
1815		return (error);
1816	}
1817	rtwn_start(sc);
1818	RTWN_UNLOCK(sc);
1819	return (0);
1820}
1821
1822static void
1823rtwn_parent(struct ieee80211com *ic)
1824{
1825	struct rtwn_softc *sc = ic->ic_softc;
1826	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1827
1828	if (ic->ic_nrunning > 0) {
1829		if (rtwn_init(sc) == 0)
1830			ieee80211_start_all(ic);
1831		else
1832			ieee80211_stop(vap);
1833	} else
1834		rtwn_stop(sc);
1835}
1836
1837static void
1838rtwn_start(struct rtwn_softc *sc)
1839{
1840	struct ieee80211_node *ni;
1841	struct mbuf *m;
1842
1843	RTWN_LOCK_ASSERT(sc);
1844
1845	if ((sc->sc_flags & RTWN_RUNNING) == 0)
1846		return;
1847
1848	while (sc->qfullmsk == 0 && (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
1849		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1850		if (rtwn_tx(sc, m, ni) != 0) {
1851			if_inc_counter(ni->ni_vap->iv_ifp,
1852			    IFCOUNTER_OERRORS, 1);
1853			ieee80211_free_node(ni);
1854			continue;
1855		}
1856		sc->sc_tx_timer = 5;
1857	}
1858}
1859
1860static void
1861rtwn_watchdog(void *arg)
1862{
1863	struct rtwn_softc *sc = arg;
1864	struct ieee80211com *ic = &sc->sc_ic;
1865
1866	RTWN_LOCK_ASSERT(sc);
1867
1868	KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
1869
1870	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
1871		ic_printf(ic, "device timeout\n");
1872		ieee80211_restart_all(ic);
1873		return;
1874	}
1875	callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
1876}
1877
1878static int
1879rtwn_power_on(struct rtwn_softc *sc)
1880{
1881	uint32_t reg;
1882	int ntries;
1883
1884	/* Wait for autoload done bit. */
1885	for (ntries = 0; ntries < 1000; ntries++) {
1886		if (rtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1887			break;
1888		DELAY(5);
1889	}
1890	if (ntries == 1000) {
1891		device_printf(sc->sc_dev,
1892		    "timeout waiting for chip autoload\n");
1893		return (ETIMEDOUT);
1894	}
1895
1896	/* Unlock ISO/CLK/Power control register. */
1897	rtwn_write_1(sc, R92C_RSV_CTRL, 0);
1898
1899	/* TODO: check if we need this for 8188CE */
1900	if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1901		/* bt coex */
1902		reg = rtwn_read_4(sc, R92C_APS_FSMCO);
1903		reg |= (R92C_APS_FSMCO_SOP_ABG |
1904			R92C_APS_FSMCO_SOP_AMB |
1905			R92C_APS_FSMCO_XOP_BTCK);
1906		rtwn_write_4(sc, R92C_APS_FSMCO, reg);
1907	}
1908
1909	/* Move SPS into PWM mode. */
1910	rtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1911
1912	/* Set low byte to 0x0f, leave others unchanged. */
1913	rtwn_write_4(sc, R92C_AFE_XTAL_CTRL,
1914	    (rtwn_read_4(sc, R92C_AFE_XTAL_CTRL) & 0xffffff00) | 0x0f);
1915
1916	/* TODO: check if we need this for 8188CE */
1917	if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1918		/* bt coex */
1919		reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL);
1920		reg &= (~0x00024800); /* XXX magic from linux */
1921		rtwn_write_4(sc, R92C_AFE_XTAL_CTRL, reg);
1922	}
1923
1924	rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1925	  (rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & 0xff) |
1926	  R92C_SYS_ISO_CTRL_PWC_EV12V | R92C_SYS_ISO_CTRL_DIOR);
1927	DELAY(200);
1928
1929	/* TODO: linux does additional btcoex stuff here */
1930
1931	/* Auto enable WLAN. */
1932	rtwn_write_2(sc, R92C_APS_FSMCO,
1933	    rtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1934	for (ntries = 0; ntries < 1000; ntries++) {
1935		if (!(rtwn_read_2(sc, R92C_APS_FSMCO) &
1936		    R92C_APS_FSMCO_APFM_ONMAC))
1937			break;
1938		DELAY(5);
1939	}
1940	if (ntries == 1000) {
1941		device_printf(sc->sc_dev, "timeout waiting for MAC auto ON\n");
1942		return (ETIMEDOUT);
1943	}
1944
1945	/* Enable radio, GPIO and LED functions. */
1946	rtwn_write_2(sc, R92C_APS_FSMCO,
1947	    R92C_APS_FSMCO_AFSM_PCIE |
1948	    R92C_APS_FSMCO_PDN_EN |
1949	    R92C_APS_FSMCO_PFM_ALDN);
1950	/* Release RF digital isolation. */
1951	rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1952	    rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1953
1954	if (sc->chip & RTWN_CHIP_92C)
1955		rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x77);
1956	else
1957		rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x22);
1958
1959	rtwn_write_4(sc, R92C_INT_MIG, 0);
1960
1961	if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1962		/* bt coex */
1963		reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL + 2);
1964		reg &= 0xfd; /* XXX magic from linux */
1965		rtwn_write_4(sc, R92C_AFE_XTAL_CTRL + 2, reg);
1966	}
1967
1968	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
1969	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_RFKILL);
1970
1971	reg = rtwn_read_1(sc, R92C_GPIO_IO_SEL);
1972	if (!(reg & R92C_GPIO_IO_SEL_RFKILL)) {
1973		device_printf(sc->sc_dev,
1974		    "radio is disabled by hardware switch\n");
1975		return (EPERM);
1976	}
1977
1978	/* Initialize MAC. */
1979	reg = rtwn_read_1(sc, R92C_APSD_CTRL);
1980	rtwn_write_1(sc, R92C_APSD_CTRL,
1981	    rtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
1982	for (ntries = 0; ntries < 200; ntries++) {
1983		if (!(rtwn_read_1(sc, R92C_APSD_CTRL) &
1984		    R92C_APSD_CTRL_OFF_STATUS))
1985			break;
1986		DELAY(500);
1987	}
1988	if (ntries == 200) {
1989		device_printf(sc->sc_dev,
1990		    "timeout waiting for MAC initialization\n");
1991		return (ETIMEDOUT);
1992	}
1993
1994	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
1995	reg = rtwn_read_2(sc, R92C_CR);
1996	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
1997	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
1998	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
1999	    R92C_CR_ENSEC;
2000	rtwn_write_2(sc, R92C_CR, reg);
2001
2002	rtwn_write_1(sc, 0xfe10, 0x19);
2003
2004	return (0);
2005}
2006
2007static int
2008rtwn_llt_init(struct rtwn_softc *sc)
2009{
2010	int i, error;
2011
2012	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
2013	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
2014		if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
2015			return (error);
2016	}
2017	/* NB: 0xff indicates end-of-list. */
2018	if ((error = rtwn_llt_write(sc, i, 0xff)) != 0)
2019		return (error);
2020	/*
2021	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
2022	 * as ring buffer.
2023	 */
2024	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
2025		if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
2026			return (error);
2027	}
2028	/* Make the last page point to the beginning of the ring buffer. */
2029	error = rtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
2030	return (error);
2031}
2032
2033static void
2034rtwn_fw_reset(struct rtwn_softc *sc)
2035{
2036	uint16_t reg;
2037	int ntries;
2038
2039	/* Tell 8051 to reset itself. */
2040	rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2041
2042	/* Wait until 8051 resets by itself. */
2043	for (ntries = 0; ntries < 100; ntries++) {
2044		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
2045		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2046			goto sleep;
2047		DELAY(50);
2048	}
2049	/* Force 8051 reset. */
2050	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2051sleep:
2052	/*
2053	 * We must sleep for one second to let the firmware settle.
2054	 * Accessing registers too early will hang the whole system.
2055	 */
2056	if (msleep(&reg, &sc->sc_mtx, 0, "rtwnrst", hz)) {
2057		device_printf(sc->sc_dev, "timeout waiting for firmware "
2058		    "initialization to complete\n");
2059	}
2060}
2061
2062static void
2063rtwn_fw_loadpage(struct rtwn_softc *sc, int page, const uint8_t *buf, int len)
2064{
2065	uint32_t reg;
2066	int off, mlen, i;
2067
2068	reg = rtwn_read_4(sc, R92C_MCUFWDL);
2069	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2070	rtwn_write_4(sc, R92C_MCUFWDL, reg);
2071
2072	DELAY(5);
2073
2074	off = R92C_FW_START_ADDR;
2075	while (len > 0) {
2076		if (len > 196)
2077			mlen = 196;
2078		else if (len > 4)
2079			mlen = 4;
2080		else
2081			mlen = 1;
2082		for (i = 0; i < mlen; i++)
2083			rtwn_write_1(sc, off++, buf[i]);
2084		buf += mlen;
2085		len -= mlen;
2086	}
2087}
2088
2089static int
2090rtwn_load_firmware(struct rtwn_softc *sc)
2091{
2092	const struct firmware *fw;
2093	const struct r92c_fw_hdr *hdr;
2094	const char *name;
2095	const u_char *ptr;
2096	size_t len;
2097	uint32_t reg;
2098	int mlen, ntries, page, error = 0;
2099
2100	/* Read firmware image from the filesystem. */
2101	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
2102	    RTWN_CHIP_UMC_A_CUT)
2103		name = "rtwn-rtl8192cfwU";
2104	else
2105		name = "rtwn-rtl8192cfwU_B";
2106	RTWN_UNLOCK(sc);
2107	fw = firmware_get(name);
2108	RTWN_LOCK(sc);
2109	if (fw == NULL) {
2110		device_printf(sc->sc_dev,
2111		    "could not read firmware %s\n", name);
2112		return (ENOENT);
2113	}
2114	len = fw->datasize;
2115	if (len < sizeof(*hdr)) {
2116		device_printf(sc->sc_dev, "firmware too short\n");
2117		error = EINVAL;
2118		goto fail;
2119	}
2120	ptr = fw->data;
2121	hdr = (const struct r92c_fw_hdr *)ptr;
2122	/* Check if there is a valid FW header and skip it. */
2123	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2124	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2125		DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
2126		    le16toh(hdr->version), le16toh(hdr->subversion),
2127		    hdr->month, hdr->date, hdr->hour, hdr->minute));
2128		ptr += sizeof(*hdr);
2129		len -= sizeof(*hdr);
2130	}
2131
2132	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
2133		rtwn_fw_reset(sc);
2134
2135	/* Enable FW download. */
2136	rtwn_write_2(sc, R92C_SYS_FUNC_EN,
2137	    rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2138	    R92C_SYS_FUNC_EN_CPUEN);
2139	rtwn_write_1(sc, R92C_MCUFWDL,
2140	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2141	rtwn_write_1(sc, R92C_MCUFWDL + 2,
2142	    rtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2143
2144	/* Reset the FWDL checksum. */
2145	rtwn_write_1(sc, R92C_MCUFWDL,
2146	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2147
2148	for (page = 0; len > 0; page++) {
2149		mlen = MIN(len, R92C_FW_PAGE_SIZE);
2150		rtwn_fw_loadpage(sc, page, ptr, mlen);
2151		ptr += mlen;
2152		len -= mlen;
2153	}
2154
2155	/* Disable FW download. */
2156	rtwn_write_1(sc, R92C_MCUFWDL,
2157	    rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2158	rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2159
2160	/* Wait for checksum report. */
2161	for (ntries = 0; ntries < 1000; ntries++) {
2162		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2163			break;
2164		DELAY(5);
2165	}
2166	if (ntries == 1000) {
2167		device_printf(sc->sc_dev,
2168		    "timeout waiting for checksum report\n");
2169		error = ETIMEDOUT;
2170		goto fail;
2171	}
2172
2173	reg = rtwn_read_4(sc, R92C_MCUFWDL);
2174	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2175	rtwn_write_4(sc, R92C_MCUFWDL, reg);
2176	/* Wait for firmware readiness. */
2177	for (ntries = 0; ntries < 2000; ntries++) {
2178		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2179			break;
2180		DELAY(50);
2181	}
2182	if (ntries == 1000) {
2183		device_printf(sc->sc_dev,
2184		    "timeout waiting for firmware readiness\n");
2185		error = ETIMEDOUT;
2186		goto fail;
2187	}
2188fail:
2189	firmware_put(fw, FIRMWARE_UNLOAD);
2190	return (error);
2191}
2192
2193static int
2194rtwn_dma_init(struct rtwn_softc *sc)
2195{
2196	uint32_t reg;
2197	int error;
2198
2199	/* Initialize LLT table. */
2200	error = rtwn_llt_init(sc);
2201	if (error != 0)
2202		return error;
2203
2204	/* Set number of pages for normal priority queue. */
2205	rtwn_write_2(sc, R92C_RQPN_NPQ, 0);
2206	rtwn_write_4(sc, R92C_RQPN,
2207	    /* Set number of pages for public queue. */
2208	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2209	    /* Set number of pages for high priority queue. */
2210	    SM(R92C_RQPN_HPQ, R92C_HPQ_NPAGES) |
2211	    /* Set number of pages for low priority queue. */
2212	    SM(R92C_RQPN_LPQ, R92C_LPQ_NPAGES) |
2213	    /* Load values. */
2214	    R92C_RQPN_LD);
2215
2216	rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2217	rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2218	rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2219	rtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2220	rtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2221
2222	reg = rtwn_read_2(sc, R92C_TRXDMA_CTRL);
2223	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2224	reg |= 0xF771;
2225	rtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2226
2227	rtwn_write_4(sc, R92C_TCR, R92C_TCR_CFENDFORM | (1 << 12) | (1 << 13));
2228
2229	/* Configure Tx DMA. */
2230	rtwn_write_4(sc, R92C_BKQ_DESA, sc->tx_ring[RTWN_BK_QUEUE].paddr);
2231	rtwn_write_4(sc, R92C_BEQ_DESA, sc->tx_ring[RTWN_BE_QUEUE].paddr);
2232	rtwn_write_4(sc, R92C_VIQ_DESA, sc->tx_ring[RTWN_VI_QUEUE].paddr);
2233	rtwn_write_4(sc, R92C_VOQ_DESA, sc->tx_ring[RTWN_VO_QUEUE].paddr);
2234	rtwn_write_4(sc, R92C_BCNQ_DESA, sc->tx_ring[RTWN_BEACON_QUEUE].paddr);
2235	rtwn_write_4(sc, R92C_MGQ_DESA, sc->tx_ring[RTWN_MGNT_QUEUE].paddr);
2236	rtwn_write_4(sc, R92C_HQ_DESA, sc->tx_ring[RTWN_HIGH_QUEUE].paddr);
2237
2238	/* Configure Rx DMA. */
2239	rtwn_write_4(sc, R92C_RX_DESA, sc->rx_ring.paddr);
2240
2241	/* Set Tx/Rx transfer page boundary. */
2242	rtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2243
2244	/* Set Tx/Rx transfer page size. */
2245	rtwn_write_1(sc, R92C_PBP,
2246	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2247	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2248	return (0);
2249}
2250
2251static void
2252rtwn_mac_init(struct rtwn_softc *sc)
2253{
2254	int i;
2255
2256	/* Write MAC initialization values. */
2257	for (i = 0; i < nitems(rtl8192ce_mac); i++)
2258		rtwn_write_1(sc, rtl8192ce_mac[i].reg, rtl8192ce_mac[i].val);
2259}
2260
2261static void
2262rtwn_bb_init(struct rtwn_softc *sc)
2263{
2264	const struct rtwn_bb_prog *prog;
2265	uint32_t reg;
2266	int i;
2267
2268	/* Enable BB and RF. */
2269	rtwn_write_2(sc, R92C_SYS_FUNC_EN,
2270	    rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2271	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2272	    R92C_SYS_FUNC_EN_DIO_RF);
2273
2274	rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2275
2276	rtwn_write_1(sc, R92C_RF_CTRL,
2277	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2278
2279	rtwn_write_1(sc, R92C_SYS_FUNC_EN,
2280	    R92C_SYS_FUNC_EN_DIO_PCIE | R92C_SYS_FUNC_EN_PCIEA |
2281	    R92C_SYS_FUNC_EN_PPLL | R92C_SYS_FUNC_EN_BB_GLB_RST |
2282	    R92C_SYS_FUNC_EN_BBRSTB);
2283
2284	rtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2285
2286	rtwn_write_4(sc, R92C_LEDCFG0,
2287	    rtwn_read_4(sc, R92C_LEDCFG0) | 0x00800000);
2288
2289	/* Select BB programming. */
2290	prog = (sc->chip & RTWN_CHIP_92C) ?
2291	    &rtl8192ce_bb_prog_2t : &rtl8192ce_bb_prog_1t;
2292
2293	/* Write BB initialization values. */
2294	for (i = 0; i < prog->count; i++) {
2295		rtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2296		DELAY(1);
2297	}
2298
2299	if (sc->chip & RTWN_CHIP_92C_1T2R) {
2300		/* 8192C 1T only configuration. */
2301		reg = rtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2302		reg = (reg & ~0x00000003) | 0x2;
2303		rtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2304
2305		reg = rtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2306		reg = (reg & ~0x00300033) | 0x00200022;
2307		rtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2308
2309		reg = rtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2310		reg = (reg & ~0xff000000) | 0x45 << 24;
2311		rtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2312
2313		reg = rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2314		reg = (reg & ~0x000000ff) | 0x23;
2315		rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2316
2317		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2318		reg = (reg & ~0x00000030) | 1 << 4;
2319		rtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2320
2321		reg = rtwn_bb_read(sc, 0xe74);
2322		reg = (reg & ~0x0c000000) | 2 << 26;
2323		rtwn_bb_write(sc, 0xe74, reg);
2324		reg = rtwn_bb_read(sc, 0xe78);
2325		reg = (reg & ~0x0c000000) | 2 << 26;
2326		rtwn_bb_write(sc, 0xe78, reg);
2327		reg = rtwn_bb_read(sc, 0xe7c);
2328		reg = (reg & ~0x0c000000) | 2 << 26;
2329		rtwn_bb_write(sc, 0xe7c, reg);
2330		reg = rtwn_bb_read(sc, 0xe80);
2331		reg = (reg & ~0x0c000000) | 2 << 26;
2332		rtwn_bb_write(sc, 0xe80, reg);
2333		reg = rtwn_bb_read(sc, 0xe88);
2334		reg = (reg & ~0x0c000000) | 2 << 26;
2335		rtwn_bb_write(sc, 0xe88, reg);
2336	}
2337
2338	/* Write AGC values. */
2339	for (i = 0; i < prog->agccount; i++) {
2340		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2341		    prog->agcvals[i]);
2342		DELAY(1);
2343	}
2344
2345	if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2346	    R92C_HSSI_PARAM2_CCK_HIPWR)
2347		sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
2348}
2349
2350static void
2351rtwn_rf_init(struct rtwn_softc *sc)
2352{
2353	const struct rtwn_rf_prog *prog;
2354	uint32_t reg, type;
2355	int i, j, idx, off;
2356
2357	/* Select RF programming based on board type. */
2358	if (!(sc->chip & RTWN_CHIP_92C)) {
2359		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2360			prog = rtl8188ce_rf_prog;
2361		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2362			prog = rtl8188ru_rf_prog;
2363		else
2364			prog = rtl8188cu_rf_prog;
2365	} else
2366		prog = rtl8192ce_rf_prog;
2367
2368	for (i = 0; i < sc->nrxchains; i++) {
2369		/* Save RF_ENV control type. */
2370		idx = i / 2;
2371		off = (i % 2) * 16;
2372		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2373		type = (reg >> off) & 0x10;
2374
2375		/* Set RF_ENV enable. */
2376		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2377		reg |= 0x100000;
2378		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2379		DELAY(1);
2380		/* Set RF_ENV output high. */
2381		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2382		reg |= 0x10;
2383		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2384		DELAY(1);
2385		/* Set address and data lengths of RF registers. */
2386		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2387		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2388		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2389		DELAY(1);
2390		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2391		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2392		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2393		DELAY(1);
2394
2395		/* Write RF initialization values for this chain. */
2396		for (j = 0; j < prog[i].count; j++) {
2397			if (prog[i].regs[j] >= 0xf9 &&
2398			    prog[i].regs[j] <= 0xfe) {
2399				/*
2400				 * These are fake RF registers offsets that
2401				 * indicate a delay is required.
2402				 */
2403				DELAY(50);
2404				continue;
2405			}
2406			rtwn_rf_write(sc, i, prog[i].regs[j],
2407			    prog[i].vals[j]);
2408			DELAY(1);
2409		}
2410
2411		/* Restore RF_ENV control type. */
2412		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2413		reg &= ~(0x10 << off) | (type << off);
2414		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2415
2416		/* Cache RF register CHNLBW. */
2417		sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2418	}
2419
2420	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
2421	    RTWN_CHIP_UMC_A_CUT) {
2422		rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2423		rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2424	}
2425}
2426
2427static void
2428rtwn_cam_init(struct rtwn_softc *sc)
2429{
2430	/* Invalidate all CAM entries. */
2431	rtwn_write_4(sc, R92C_CAMCMD,
2432	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2433}
2434
2435static void
2436rtwn_pa_bias_init(struct rtwn_softc *sc)
2437{
2438	uint8_t reg;
2439	int i;
2440
2441	for (i = 0; i < sc->nrxchains; i++) {
2442		if (sc->pa_setting & (1 << i))
2443			continue;
2444		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2445		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2446		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2447		rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2448	}
2449	if (!(sc->pa_setting & 0x10)) {
2450		reg = rtwn_read_1(sc, 0x16);
2451		reg = (reg & ~0xf0) | 0x90;
2452		rtwn_write_1(sc, 0x16, reg);
2453	}
2454}
2455
2456static void
2457rtwn_rxfilter_init(struct rtwn_softc *sc)
2458{
2459	/* Initialize Rx filter. */
2460	/* TODO: use better filter for monitor mode. */
2461	rtwn_write_4(sc, R92C_RCR,
2462	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2463	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2464	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2465	/* Accept all multicast frames. */
2466	rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2467	rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2468	/* Accept all management frames. */
2469	rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2470	/* Reject all control frames. */
2471	rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2472	/* Accept all data frames. */
2473	rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2474}
2475
2476static void
2477rtwn_edca_init(struct rtwn_softc *sc)
2478{
2479
2480	rtwn_write_2(sc, R92C_SPEC_SIFS, 0x1010);
2481	rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x1010);
2482	rtwn_write_2(sc, R92C_SIFS_CCK, 0x1010);
2483	rtwn_write_2(sc, R92C_SIFS_OFDM, 0x0e0e);
2484	rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2485	rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2486	rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4322);
2487	rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3222);
2488}
2489
2490static void
2491rtwn_write_txpower(struct rtwn_softc *sc, int chain,
2492    uint16_t power[RTWN_RIDX_COUNT])
2493{
2494	uint32_t reg;
2495
2496	/* Write per-CCK rate Tx power. */
2497	if (chain == 0) {
2498		reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2499		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2500		rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2501		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2502		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2503		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2504		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2505		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2506	} else {
2507		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2508		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2509		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2510		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2511		rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2512		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2513		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2514		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2515	}
2516	/* Write per-OFDM rate Tx power. */
2517	rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2518	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2519	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2520	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2521	    SM(R92C_TXAGC_RATE18, power[ 7]));
2522	rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2523	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2524	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2525	    SM(R92C_TXAGC_RATE48, power[10]) |
2526	    SM(R92C_TXAGC_RATE54, power[11]));
2527	/* Write per-MCS Tx power. */
2528	rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2529	    SM(R92C_TXAGC_MCS00,  power[12]) |
2530	    SM(R92C_TXAGC_MCS01,  power[13]) |
2531	    SM(R92C_TXAGC_MCS02,  power[14]) |
2532	    SM(R92C_TXAGC_MCS03,  power[15]));
2533	rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2534	    SM(R92C_TXAGC_MCS04,  power[16]) |
2535	    SM(R92C_TXAGC_MCS05,  power[17]) |
2536	    SM(R92C_TXAGC_MCS06,  power[18]) |
2537	    SM(R92C_TXAGC_MCS07,  power[19]));
2538	rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2539	    SM(R92C_TXAGC_MCS08,  power[20]) |
2540	    SM(R92C_TXAGC_MCS09,  power[21]) |
2541	    SM(R92C_TXAGC_MCS10,  power[22]) |
2542	    SM(R92C_TXAGC_MCS11,  power[23]));
2543	rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2544	    SM(R92C_TXAGC_MCS12,  power[24]) |
2545	    SM(R92C_TXAGC_MCS13,  power[25]) |
2546	    SM(R92C_TXAGC_MCS14,  power[26]) |
2547	    SM(R92C_TXAGC_MCS15,  power[27]));
2548}
2549
2550static void
2551rtwn_get_txpower(struct rtwn_softc *sc, int chain,
2552    struct ieee80211_channel *c, struct ieee80211_channel *extc,
2553    uint16_t power[RTWN_RIDX_COUNT])
2554{
2555	struct ieee80211com *ic = &sc->sc_ic;
2556	struct r92c_rom *rom = &sc->rom;
2557	uint16_t cckpow, ofdmpow, htpow, diff, max;
2558	const struct rtwn_txpwr *base;
2559	int ridx, chan, group;
2560
2561	/* Determine channel group. */
2562	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2563	if (chan <= 3)
2564		group = 0;
2565	else if (chan <= 9)
2566		group = 1;
2567	else
2568		group = 2;
2569
2570	/* Get original Tx power based on board type and RF chain. */
2571	if (!(sc->chip & RTWN_CHIP_92C)) {
2572		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2573			base = &rtl8188ru_txagc[chain];
2574		else
2575			base = &rtl8192cu_txagc[chain];
2576	} else
2577		base = &rtl8192cu_txagc[chain];
2578
2579	memset(power, 0, RTWN_RIDX_COUNT * sizeof(power[0]));
2580	if (sc->regulatory == 0) {
2581		for (ridx = 0; ridx <= 3; ridx++)
2582			power[ridx] = base->pwr[0][ridx];
2583	}
2584	for (ridx = 4; ridx < RTWN_RIDX_COUNT; ridx++) {
2585		if (sc->regulatory == 3) {
2586			power[ridx] = base->pwr[0][ridx];
2587			/* Apply vendor limits. */
2588			if (extc != NULL)
2589				max = rom->ht40_max_pwr[group];
2590			else
2591				max = rom->ht20_max_pwr[group];
2592			max = (max >> (chain * 4)) & 0xf;
2593			if (power[ridx] > max)
2594				power[ridx] = max;
2595		} else if (sc->regulatory == 1) {
2596			if (extc == NULL)
2597				power[ridx] = base->pwr[group][ridx];
2598		} else if (sc->regulatory != 2)
2599			power[ridx] = base->pwr[0][ridx];
2600	}
2601
2602	/* Compute per-CCK rate Tx power. */
2603	cckpow = rom->cck_tx_pwr[chain][group];
2604	for (ridx = 0; ridx <= 3; ridx++) {
2605		power[ridx] += cckpow;
2606		if (power[ridx] > R92C_MAX_TX_PWR)
2607			power[ridx] = R92C_MAX_TX_PWR;
2608	}
2609
2610	htpow = rom->ht40_1s_tx_pwr[chain][group];
2611	if (sc->ntxchains > 1) {
2612		/* Apply reduction for 2 spatial streams. */
2613		diff = rom->ht40_2s_tx_pwr_diff[group];
2614		diff = (diff >> (chain * 4)) & 0xf;
2615		htpow = (htpow > diff) ? htpow - diff : 0;
2616	}
2617
2618	/* Compute per-OFDM rate Tx power. */
2619	diff = rom->ofdm_tx_pwr_diff[group];
2620	diff = (diff >> (chain * 4)) & 0xf;
2621	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2622	for (ridx = 4; ridx <= 11; ridx++) {
2623		power[ridx] += ofdmpow;
2624		if (power[ridx] > R92C_MAX_TX_PWR)
2625			power[ridx] = R92C_MAX_TX_PWR;
2626	}
2627
2628	/* Compute per-MCS Tx power. */
2629	if (extc == NULL) {
2630		diff = rom->ht20_tx_pwr_diff[group];
2631		diff = (diff >> (chain * 4)) & 0xf;
2632		htpow += diff;	/* HT40->HT20 correction. */
2633	}
2634	for (ridx = 12; ridx <= 27; ridx++) {
2635		power[ridx] += htpow;
2636		if (power[ridx] > R92C_MAX_TX_PWR)
2637			power[ridx] = R92C_MAX_TX_PWR;
2638	}
2639#ifdef RTWN_DEBUG
2640	if (sc->sc_debug >= 4) {
2641		/* Dump per-rate Tx power values. */
2642		printf("Tx power for chain %d:\n", chain);
2643		for (ridx = 0; ridx < RTWN_RIDX_COUNT; ridx++)
2644			printf("Rate %d = %u\n", ridx, power[ridx]);
2645	}
2646#endif
2647}
2648
2649static void
2650rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
2651    struct ieee80211_channel *extc)
2652{
2653	uint16_t power[RTWN_RIDX_COUNT];
2654	int i;
2655
2656	for (i = 0; i < sc->ntxchains; i++) {
2657		/* Compute per-rate Tx power values. */
2658		rtwn_get_txpower(sc, i, c, extc, power);
2659		/* Write per-rate Tx power values to hardware. */
2660		rtwn_write_txpower(sc, i, power);
2661	}
2662}
2663
2664static void
2665rtwn_set_rx_bssid_all(struct rtwn_softc *sc, int enable)
2666{
2667	uint32_t reg;
2668
2669	reg = rtwn_read_4(sc, R92C_RCR);
2670	if (enable)
2671		reg &= ~R92C_RCR_CBSSID_BCN;
2672	else
2673		reg |= R92C_RCR_CBSSID_BCN;
2674	rtwn_write_4(sc, R92C_RCR, reg);
2675}
2676
2677static void
2678rtwn_set_gain(struct rtwn_softc *sc, uint8_t gain)
2679{
2680	uint32_t reg;
2681
2682	reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
2683	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
2684	rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
2685
2686	reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
2687	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
2688	rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
2689}
2690
2691static void
2692rtwn_scan_start(struct ieee80211com *ic)
2693{
2694	struct rtwn_softc *sc = ic->ic_softc;
2695
2696	RTWN_LOCK(sc);
2697	/* Receive beacons / probe responses from any BSSID. */
2698	rtwn_set_rx_bssid_all(sc, 1);
2699	/* Set gain for scanning. */
2700	rtwn_set_gain(sc, 0x20);
2701	RTWN_UNLOCK(sc);
2702}
2703
2704static void
2705rtwn_scan_end(struct ieee80211com *ic)
2706{
2707	struct rtwn_softc *sc = ic->ic_softc;
2708
2709	RTWN_LOCK(sc);
2710	/* Restore limitations. */
2711	rtwn_set_rx_bssid_all(sc, 0);
2712	/* Set gain under link. */
2713	rtwn_set_gain(sc, 0x32);
2714	RTWN_UNLOCK(sc);
2715}
2716
2717static void
2718rtwn_set_channel(struct ieee80211com *ic)
2719{
2720	struct rtwn_softc *sc = ic->ic_softc;
2721	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2722
2723	RTWN_LOCK(sc);
2724	if (vap->iv_state == IEEE80211_S_SCAN) {
2725		/* Make link LED blink during scan. */
2726		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
2727	}
2728	rtwn_set_chan(sc, ic->ic_curchan, NULL);
2729	RTWN_UNLOCK(sc);
2730}
2731
2732static void
2733rtwn_update_mcast(struct ieee80211com *ic)
2734{
2735
2736	/* XXX do nothing?  */
2737}
2738
2739static void
2740rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
2741    struct ieee80211_channel *extc)
2742{
2743	struct ieee80211com *ic = &sc->sc_ic;
2744	u_int chan;
2745	int i;
2746
2747	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2748	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2749		device_printf(sc->sc_dev,
2750		    "%s: invalid channel %x\n", __func__, chan);
2751		return;
2752	}
2753
2754	/* Set Tx power for this new channel. */
2755	rtwn_set_txpower(sc, c, extc);
2756
2757	for (i = 0; i < sc->nrxchains; i++) {
2758		rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2759		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2760	}
2761#ifndef IEEE80211_NO_HT
2762	if (extc != NULL) {
2763		uint32_t reg;
2764
2765		/* Is secondary channel below or above primary? */
2766		int prichlo = c->ic_freq < extc->ic_freq;
2767
2768		rtwn_write_1(sc, R92C_BWOPMODE,
2769		    rtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2770
2771		reg = rtwn_read_1(sc, R92C_RRSR + 2);
2772		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2773		rtwn_write_1(sc, R92C_RRSR + 2, reg);
2774
2775		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2776		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2777		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2778		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2779
2780		/* Set CCK side band. */
2781		reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2782		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2783		rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2784
2785		reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
2786		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2787		rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2788
2789		rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2790		    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2791		    ~R92C_FPGA0_ANAPARAM2_CBW20);
2792
2793		reg = rtwn_bb_read(sc, 0x818);
2794		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2795		rtwn_bb_write(sc, 0x818, reg);
2796
2797		/* Select 40MHz bandwidth. */
2798		rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2799		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2800	} else
2801#endif
2802	{
2803		rtwn_write_1(sc, R92C_BWOPMODE,
2804		    rtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2805
2806		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2807		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2808		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2809		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2810
2811		rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2812		    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2813		    R92C_FPGA0_ANAPARAM2_CBW20);
2814
2815		/* Select 20MHz bandwidth. */
2816		rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2817		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2818	}
2819}
2820
2821static int
2822rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
2823    uint16_t rx[2])
2824{
2825	uint32_t status;
2826	int offset = chain * 0x20;
2827
2828	if (chain == 0) {	/* IQ calibration for chain 0. */
2829		/* IQ calibration settings for chain 0. */
2830		rtwn_bb_write(sc, 0xe30, 0x10008c1f);
2831		rtwn_bb_write(sc, 0xe34, 0x10008c1f);
2832		rtwn_bb_write(sc, 0xe38, 0x82140102);
2833
2834		if (sc->ntxchains > 1) {
2835			rtwn_bb_write(sc, 0xe3c, 0x28160202);	/* 2T */
2836			/* IQ calibration settings for chain 1. */
2837			rtwn_bb_write(sc, 0xe50, 0x10008c22);
2838			rtwn_bb_write(sc, 0xe54, 0x10008c22);
2839			rtwn_bb_write(sc, 0xe58, 0x82140102);
2840			rtwn_bb_write(sc, 0xe5c, 0x28160202);
2841		} else
2842			rtwn_bb_write(sc, 0xe3c, 0x28160502);	/* 1T */
2843
2844		/* LO calibration settings. */
2845		rtwn_bb_write(sc, 0xe4c, 0x001028d1);
2846		/* We're doing LO and IQ calibration in one shot. */
2847		rtwn_bb_write(sc, 0xe48, 0xf9000000);
2848		rtwn_bb_write(sc, 0xe48, 0xf8000000);
2849
2850	} else {		/* IQ calibration for chain 1. */
2851		/* We're doing LO and IQ calibration in one shot. */
2852		rtwn_bb_write(sc, 0xe60, 0x00000002);
2853		rtwn_bb_write(sc, 0xe60, 0x00000000);
2854	}
2855
2856	/* Give LO and IQ calibrations the time to complete. */
2857	DELAY(1000);
2858
2859	/* Read IQ calibration status. */
2860	status = rtwn_bb_read(sc, 0xeac);
2861
2862	if (status & (1 << (28 + chain * 3)))
2863		return (0);	/* Tx failed. */
2864	/* Read Tx IQ calibration results. */
2865	tx[0] = (rtwn_bb_read(sc, 0xe94 + offset) >> 16) & 0x3ff;
2866	tx[1] = (rtwn_bb_read(sc, 0xe9c + offset) >> 16) & 0x3ff;
2867	if (tx[0] == 0x142 || tx[1] == 0x042)
2868		return (0);	/* Tx failed. */
2869
2870	if (status & (1 << (27 + chain * 3)))
2871		return (1);	/* Rx failed. */
2872	/* Read Rx IQ calibration results. */
2873	rx[0] = (rtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff;
2874	rx[1] = (rtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff;
2875	if (rx[0] == 0x132 || rx[1] == 0x036)
2876		return (1);	/* Rx failed. */
2877
2878	return (3);	/* Both Tx and Rx succeeded. */
2879}
2880
2881static void
2882rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
2883    uint16_t rx[2][2])
2884{
2885	/* Registers to save and restore during IQ calibration. */
2886	struct iq_cal_regs {
2887		uint32_t	adda[16];
2888		uint8_t		txpause;
2889		uint8_t		bcn_ctrl;
2890		uint8_t		ustime_tsf;
2891		uint32_t	gpio_muxcfg;
2892		uint32_t	ofdm0_trxpathena;
2893		uint32_t	ofdm0_trmuxpar;
2894		uint32_t	fpga0_rfifacesw1;
2895	} iq_cal_regs;
2896	static const uint16_t reg_adda[16] = {
2897		0x85c, 0xe6c, 0xe70, 0xe74,
2898		0xe78, 0xe7c, 0xe80, 0xe84,
2899		0xe88, 0xe8c, 0xed0, 0xed4,
2900		0xed8, 0xedc, 0xee0, 0xeec
2901	};
2902	int i, chain;
2903	uint32_t hssi_param1;
2904
2905	if (n == 0) {
2906		for (i = 0; i < nitems(reg_adda); i++)
2907			iq_cal_regs.adda[i] = rtwn_bb_read(sc, reg_adda[i]);
2908
2909		iq_cal_regs.txpause = rtwn_read_1(sc, R92C_TXPAUSE);
2910		iq_cal_regs.bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
2911		iq_cal_regs.ustime_tsf = rtwn_read_1(sc, R92C_USTIME_TSF);
2912		iq_cal_regs.gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
2913	}
2914
2915	if (sc->ntxchains == 1) {
2916		rtwn_bb_write(sc, reg_adda[0], 0x0b1b25a0);
2917		for (i = 1; i < nitems(reg_adda); i++)
2918			rtwn_bb_write(sc, reg_adda[i], 0x0bdb25a0);
2919	} else {
2920		for (i = 0; i < nitems(reg_adda); i++)
2921			rtwn_bb_write(sc, reg_adda[i], 0x04db25a4);
2922	}
2923
2924	hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
2925	if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2926		rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2927		    hssi_param1 | R92C_HSSI_PARAM1_PI);
2928		rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2929		    hssi_param1 | R92C_HSSI_PARAM1_PI);
2930	}
2931
2932	if (n == 0) {
2933		iq_cal_regs.ofdm0_trxpathena =
2934		    rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2935		iq_cal_regs.ofdm0_trmuxpar =
2936		    rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
2937		iq_cal_regs.fpga0_rfifacesw1 =
2938		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
2939	}
2940
2941	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
2942	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
2943	rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
2944	if (sc->ntxchains > 1) {
2945		rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2946		rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
2947	}
2948
2949	rtwn_write_1(sc, R92C_TXPAUSE, 0x3f);
2950	rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl & ~(0x08));
2951	rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf & ~(0x08));
2952	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2953	    iq_cal_regs.gpio_muxcfg & ~(0x20));
2954
2955	rtwn_bb_write(sc, 0x0b68, 0x00080000);
2956	if (sc->ntxchains > 1)
2957		rtwn_bb_write(sc, 0x0b6c, 0x00080000);
2958
2959	rtwn_bb_write(sc, 0x0e28, 0x80800000);
2960	rtwn_bb_write(sc, 0x0e40, 0x01007c00);
2961	rtwn_bb_write(sc, 0x0e44, 0x01004800);
2962
2963	rtwn_bb_write(sc, 0x0b68, 0x00080000);
2964
2965	for (chain = 0; chain < sc->ntxchains; chain++) {
2966		if (chain > 0) {
2967			/* Put chain 0 on standby. */
2968			rtwn_bb_write(sc, 0x0e28, 0x00);
2969			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2970			rtwn_bb_write(sc, 0x0e28, 0x80800000);
2971
2972			/* Enable chain 1. */
2973			for (i = 0; i < nitems(reg_adda); i++)
2974				rtwn_bb_write(sc, reg_adda[i], 0x0b1b25a4);
2975		}
2976
2977		/* Run IQ calibration twice. */
2978		for (i = 0; i < 2; i++) {
2979			int ret;
2980
2981			ret = rtwn_iq_calib_chain(sc, chain,
2982			    tx[chain], rx[chain]);
2983			if (ret == 0) {
2984				DPRINTF(("%s: chain %d: Tx failed.\n",
2985				    __func__, chain));
2986				tx[chain][0] = 0xff;
2987				tx[chain][1] = 0xff;
2988				rx[chain][0] = 0xff;
2989				rx[chain][1] = 0xff;
2990			} else if (ret == 1) {
2991				DPRINTF(("%s: chain %d: Rx failed.\n",
2992				    __func__, chain));
2993				rx[chain][0] = 0xff;
2994				rx[chain][1] = 0xff;
2995			} else if (ret == 3) {
2996				DPRINTF(("%s: chain %d: Both Tx and Rx "
2997				    "succeeded.\n", __func__, chain));
2998			}
2999		}
3000
3001		DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
3002		    "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
3003		    tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
3004	}
3005
3006	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
3007	    iq_cal_regs.ofdm0_trxpathena);
3008	rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
3009	    iq_cal_regs.fpga0_rfifacesw1);
3010	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, iq_cal_regs.ofdm0_trmuxpar);
3011
3012	rtwn_bb_write(sc, 0x0e28, 0x00);
3013	rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
3014	if (sc->ntxchains > 1)
3015		rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
3016
3017	if (n != 0) {
3018		if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
3019			rtwn_bb_write(sc, R92C_HSSI_PARAM1(0), hssi_param1);
3020			rtwn_bb_write(sc, R92C_HSSI_PARAM1(1), hssi_param1);
3021		}
3022
3023		for (i = 0; i < nitems(reg_adda); i++)
3024			rtwn_bb_write(sc, reg_adda[i], iq_cal_regs.adda[i]);
3025
3026		rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs.txpause);
3027		rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl);
3028		rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf);
3029		rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs.gpio_muxcfg);
3030	}
3031}
3032
3033#define RTWN_IQ_CAL_MAX_TOLERANCE 5
3034static int
3035rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
3036    uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
3037{
3038	int chain, i, tx_ok[2], rx_ok[2];
3039
3040	tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
3041	for (chain = 0; chain < ntxchains; chain++) {
3042		for (i = 0; i < 2; i++)	{
3043			if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
3044			    rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
3045				continue;
3046
3047			tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
3048			    RTWN_IQ_CAL_MAX_TOLERANCE);
3049
3050			rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
3051			    RTWN_IQ_CAL_MAX_TOLERANCE);
3052		}
3053	}
3054
3055	if (ntxchains > 1)
3056		return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
3057	else
3058		return (tx_ok[0] && rx_ok[0]);
3059}
3060#undef RTWN_IQ_CAL_MAX_TOLERANCE
3061
3062static void
3063rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
3064    uint16_t rx[2], int chain)
3065{
3066	uint32_t reg, val, x;
3067	long y, tx_c;
3068
3069	if (tx[0] == 0xff || tx[1] == 0xff)
3070		return;
3071
3072	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
3073	val = ((reg >> 22) & 0x3ff);
3074	x = tx[0];
3075	if (x & 0x0200)
3076		x |= 0xfc00;
3077	reg = (((x * val) >> 8) & 0x3ff);
3078	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
3079
3080	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
3081	if (((x * val) >> 7) & 0x01)
3082		reg |= 0x80000000;
3083	else
3084		reg &= ~0x80000000;
3085	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
3086
3087	y = tx[1];
3088	if (y & 0x00000200)
3089		y |= 0xfffffc00;
3090	tx_c = (y * val) >> 8;
3091	reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
3092	reg |= ((((tx_c & 0x3c0) >> 6) << 24) & 0xf0000000);
3093	rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
3094
3095	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
3096	reg |= (((tx_c & 0x3f) << 16) & 0x003F0000);
3097	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
3098
3099	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
3100	if (((y * val) >> 7) & 0x01)
3101		reg |= 0x20000000;
3102	else
3103		reg &= ~0x20000000;
3104	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
3105
3106	if (rx[0] == 0xff || rx[1] == 0xff)
3107		return;
3108
3109	reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
3110	reg |= (rx[0] & 0x3ff);
3111	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
3112	reg |= (((rx[1] & 0x03f) << 8) & 0xFC00);
3113	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
3114
3115	if (chain == 0) {
3116		reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
3117		reg |= (((rx[1] & 0xf) >> 6) & 0x000f);
3118		rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
3119	} else {
3120		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
3121		reg |= ((((rx[1] & 0xf) >> 6) << 12) & 0xf000);
3122		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
3123	}
3124}
3125
3126#define RTWN_IQ_CAL_NRUN	3
3127static void
3128rtwn_iq_calib(struct rtwn_softc *sc)
3129{
3130	uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
3131	int n, valid;
3132
3133	valid = 0;
3134	for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
3135		rtwn_iq_calib_run(sc, n, tx[n], rx[n]);
3136
3137		if (n == 0)
3138			continue;
3139
3140		/* Valid results remain stable after consecutive runs. */
3141		valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
3142		    tx[n], rx[n], sc->ntxchains);
3143		if (valid)
3144			break;
3145	}
3146
3147	if (valid) {
3148		rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
3149		if (sc->ntxchains > 1)
3150			rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
3151	}
3152}
3153#undef RTWN_IQ_CAL_NRUN
3154
3155static void
3156rtwn_lc_calib(struct rtwn_softc *sc)
3157{
3158	uint32_t rf_ac[2];
3159	uint8_t txmode;
3160	int i;
3161
3162	txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3163	if ((txmode & 0x70) != 0) {
3164		/* Disable all continuous Tx. */
3165		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3166
3167		/* Set RF mode to standby mode. */
3168		for (i = 0; i < sc->nrxchains; i++) {
3169			rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
3170			rtwn_rf_write(sc, i, R92C_RF_AC,
3171			    RW(rf_ac[i], R92C_RF_AC_MODE,
3172				R92C_RF_AC_MODE_STANDBY));
3173		}
3174	} else {
3175		/* Block all Tx queues. */
3176		rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3177	}
3178	/* Start calibration. */
3179	rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3180	    rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3181
3182	/* Give calibration the time to complete. */
3183	DELAY(100);
3184
3185	/* Restore configuration. */
3186	if ((txmode & 0x70) != 0) {
3187		/* Restore Tx mode. */
3188		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3189		/* Restore RF mode. */
3190		for (i = 0; i < sc->nrxchains; i++)
3191			rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3192	} else {
3193		/* Unblock all Tx queues. */
3194		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3195	}
3196}
3197
3198static void
3199rtwn_temp_calib(struct rtwn_softc *sc)
3200{
3201	int temp;
3202
3203	if (sc->thcal_state == 0) {
3204		/* Start measuring temperature. */
3205		rtwn_rf_write(sc, 0, R92C_RF_T_METER, 0x60);
3206		sc->thcal_state = 1;
3207		return;
3208	}
3209	sc->thcal_state = 0;
3210
3211	/* Read measured temperature. */
3212	temp = rtwn_rf_read(sc, 0, R92C_RF_T_METER) & 0x1f;
3213	if (temp == 0)	/* Read failed, skip. */
3214		return;
3215	DPRINTFN(2, ("temperature=%d\n", temp));
3216
3217	/*
3218	 * Redo IQ and LC calibration if temperature changed significantly
3219	 * since last calibration.
3220	 */
3221	if (sc->thcal_lctemp == 0) {
3222		/* First calibration is performed in rtwn_init(). */
3223		sc->thcal_lctemp = temp;
3224	} else if (abs(temp - sc->thcal_lctemp) > 1) {
3225		DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
3226		    sc->thcal_lctemp, temp));
3227		rtwn_iq_calib(sc);
3228		rtwn_lc_calib(sc);
3229		/* Record temperature of last calibration. */
3230		sc->thcal_lctemp = temp;
3231	}
3232}
3233
3234static int
3235rtwn_init(struct rtwn_softc *sc)
3236{
3237	struct ieee80211com *ic = &sc->sc_ic;
3238	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3239	uint32_t reg;
3240	uint8_t macaddr[IEEE80211_ADDR_LEN];
3241	int i, error;
3242
3243	RTWN_LOCK(sc);
3244
3245	if (sc->sc_flags & RTWN_RUNNING) {
3246		RTWN_UNLOCK(sc);
3247		return 0;
3248	}
3249	sc->sc_flags |= RTWN_RUNNING;
3250
3251	/* Init firmware commands ring. */
3252	sc->fwcur = 0;
3253
3254	/* Power on adapter. */
3255	error = rtwn_power_on(sc);
3256	if (error != 0) {
3257		device_printf(sc->sc_dev, "could not power on adapter\n");
3258		goto fail;
3259	}
3260
3261	/* Initialize DMA. */
3262	error = rtwn_dma_init(sc);
3263	if (error != 0) {
3264		device_printf(sc->sc_dev, "could not initialize DMA\n");
3265		goto fail;
3266	}
3267
3268	/* Set info size in Rx descriptors (in 64-bit words). */
3269	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3270
3271	/* Disable interrupts. */
3272	rtwn_write_4(sc, R92C_HISR, 0x00000000);
3273	rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3274
3275	/* Set MAC address. */
3276	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3277	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3278		rtwn_write_1(sc, R92C_MACID + i, macaddr[i]);
3279
3280	/* Set initial network type. */
3281	reg = rtwn_read_4(sc, R92C_CR);
3282	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3283	rtwn_write_4(sc, R92C_CR, reg);
3284
3285	rtwn_rxfilter_init(sc);
3286
3287	reg = rtwn_read_4(sc, R92C_RRSR);
3288	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
3289	rtwn_write_4(sc, R92C_RRSR, reg);
3290
3291	/* Set short/long retry limits. */
3292	rtwn_write_2(sc, R92C_RL,
3293	    SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
3294
3295	/* Initialize EDCA parameters. */
3296	rtwn_edca_init(sc);
3297
3298	/* Set data and response automatic rate fallback retry counts. */
3299	rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
3300	rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
3301	rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
3302	rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
3303
3304	rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
3305
3306	/* Set ACK timeout. */
3307	rtwn_write_1(sc, R92C_ACKTO, 0x40);
3308
3309	/* Initialize beacon parameters. */
3310	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3311	rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3312	rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3313	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3314
3315	/* Setup AMPDU aggregation. */
3316	rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3317	rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3318
3319	rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3320	rtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
3321
3322	rtwn_write_4(sc, R92C_PIFS, 0x1c);
3323	rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
3324
3325	/* Load 8051 microcode. */
3326	error = rtwn_load_firmware(sc);
3327	if (error != 0)
3328		goto fail;
3329
3330	/* Initialize MAC/BB/RF blocks. */
3331	rtwn_mac_init(sc);
3332	rtwn_bb_init(sc);
3333	rtwn_rf_init(sc);
3334
3335	/* Turn CCK and OFDM blocks on. */
3336	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3337	reg |= R92C_RFMOD_CCK_EN;
3338	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3339	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3340	reg |= R92C_RFMOD_OFDM_EN;
3341	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3342
3343	/* Clear per-station keys table. */
3344	rtwn_cam_init(sc);
3345
3346	/* Enable hardware sequence numbering. */
3347	rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3348
3349	/* Perform LO and IQ calibrations. */
3350	rtwn_iq_calib(sc);
3351	/* Perform LC calibration. */
3352	rtwn_lc_calib(sc);
3353
3354	rtwn_pa_bias_init(sc);
3355
3356	/* Initialize GPIO setting. */
3357	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
3358	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3359
3360	/* Fix for lower temperature. */
3361	rtwn_write_1(sc, 0x15, 0xe9);
3362
3363	/* CLear pending interrupts. */
3364	rtwn_write_4(sc, R92C_HISR, 0xffffffff);
3365
3366	/* Enable interrupts. */
3367	rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
3368
3369	callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
3370
3371fail:
3372	if (error != 0)
3373		rtwn_stop_locked(sc);
3374
3375	RTWN_UNLOCK(sc);
3376
3377	return error;
3378}
3379
3380static void
3381rtwn_stop_locked(struct rtwn_softc *sc)
3382{
3383	uint16_t reg;
3384	int i;
3385
3386	RTWN_LOCK_ASSERT(sc);
3387
3388	if (!(sc->sc_flags & RTWN_RUNNING))
3389		return;
3390
3391	sc->sc_tx_timer = 0;
3392	callout_stop(&sc->watchdog_to);
3393	callout_stop(&sc->calib_to);
3394	sc->sc_flags &= ~RTWN_RUNNING;
3395
3396	/* Disable interrupts. */
3397	rtwn_write_4(sc, R92C_HISR, 0x00000000);
3398	rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3399
3400	/* Stop hardware. */
3401	rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3402	rtwn_write_1(sc, R92C_RF_CTRL, 0x00);
3403	reg = rtwn_read_1(sc, R92C_SYS_FUNC_EN);
3404	reg |= R92C_SYS_FUNC_EN_BB_GLB_RST;
3405	rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
3406	reg &= ~R92C_SYS_FUNC_EN_BB_GLB_RST;
3407	rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
3408	reg = rtwn_read_2(sc, R92C_CR);
3409	reg &= ~(R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3410	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3411	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3412	    R92C_CR_ENSEC);
3413	rtwn_write_2(sc, R92C_CR, reg);
3414	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
3415		rtwn_fw_reset(sc);
3416	/* TODO: linux does additional btcoex stuff here */
3417	rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0x80); /* linux magic number */
3418	rtwn_write_1(sc, R92C_SPS0_CTRL, 0x23); /* ditto */
3419	rtwn_write_1(sc, R92C_AFE_XTAL_CTRL, 0x0e); /* different with btcoex */
3420	rtwn_write_1(sc, R92C_RSV_CTRL, 0x0e);
3421	rtwn_write_1(sc, R92C_APS_FSMCO, R92C_APS_FSMCO_PDN_EN);
3422
3423	for (i = 0; i < RTWN_NTXQUEUES; i++)
3424		rtwn_reset_tx_list(sc, i);
3425	rtwn_reset_rx_list(sc);
3426}
3427
3428static void
3429rtwn_stop(struct rtwn_softc *sc)
3430{
3431	RTWN_LOCK(sc);
3432	rtwn_stop_locked(sc);
3433	RTWN_UNLOCK(sc);
3434}
3435
3436static void
3437rtwn_intr(void *arg)
3438{
3439	struct rtwn_softc *sc = arg;
3440	uint32_t status;
3441	int i;
3442
3443	RTWN_LOCK(sc);
3444	status = rtwn_read_4(sc, R92C_HISR);
3445	if (status == 0 || status == 0xffffffff) {
3446		RTWN_UNLOCK(sc);
3447		return;
3448	}
3449
3450	/* Disable interrupts. */
3451	rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3452
3453	/* Ack interrupts. */
3454	rtwn_write_4(sc, R92C_HISR, status);
3455
3456	/* Vendor driver treats RX errors like ROK... */
3457	if (status & (R92C_IMR_ROK | R92C_IMR_RXFOVW | R92C_IMR_RDU)) {
3458		bus_dmamap_sync(sc->rx_ring.desc_dmat, sc->rx_ring.desc_map,
3459		    BUS_DMASYNC_POSTREAD);
3460
3461		for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
3462			struct r92c_rx_desc *rx_desc = &sc->rx_ring.desc[i];
3463			struct rtwn_rx_data *rx_data = &sc->rx_ring.rx_data[i];
3464
3465			if (le32toh(rx_desc->rxdw0) & R92C_RXDW0_OWN)
3466				continue;
3467
3468			rtwn_rx_frame(sc, rx_desc, rx_data, i);
3469		}
3470	}
3471
3472	if (status & R92C_IMR_BDOK)
3473		rtwn_tx_done(sc, RTWN_BEACON_QUEUE);
3474	if (status & R92C_IMR_HIGHDOK)
3475		rtwn_tx_done(sc, RTWN_HIGH_QUEUE);
3476	if (status & R92C_IMR_MGNTDOK)
3477		rtwn_tx_done(sc, RTWN_MGNT_QUEUE);
3478	if (status & R92C_IMR_BKDOK)
3479		rtwn_tx_done(sc, RTWN_BK_QUEUE);
3480	if (status & R92C_IMR_BEDOK)
3481		rtwn_tx_done(sc, RTWN_BE_QUEUE);
3482	if (status & R92C_IMR_VIDOK)
3483		rtwn_tx_done(sc, RTWN_VI_QUEUE);
3484	if (status & R92C_IMR_VODOK)
3485		rtwn_tx_done(sc, RTWN_VO_QUEUE);
3486
3487	/* Enable interrupts. */
3488	rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
3489
3490	RTWN_UNLOCK(sc);
3491}
3492