sys/dev/rtwn/if_rtwn.c

   1 /*      $OpenBSD: if_rtwn.c,v 1.6 2015/08/28 00:03:53 deraadt Exp $     */
   2
   3 /*-
   4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
   5  * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/cdefs.h>
  21 __FBSDID("$FreeBSD$");
  22
  23 /*
  24  * Driver for Realtek RTL8188CE
  25  */
  26
  27 #include <sys/param.h>
  28 #include <sys/sysctl.h>
  29 #include <sys/sockio.h>
  30 #include <sys/mbuf.h>
  31 #include <sys/kernel.h>
  32 #include <sys/socket.h>
  33 #include <sys/systm.h>
  34 #include <sys/malloc.h>
  35 #include <sys/lock.h>
  36 #include <sys/mutex.h>
  37 #include <sys/module.h>
  38 #include <sys/bus.h>
  39 #include <sys/endian.h>
  40 #include <sys/firmware.h>
  41
  42 #include <machine/bus.h>
  43 #include <machine/resource.h>
  44 #include <sys/rman.h>
  45
  46 #include <dev/pci/pcireg.h>
  47 #include <dev/pci/pcivar.h>
  48
  49 #include <net/bpf.h>
  50 #include <net/if.h>
  51 #include <net/if_var.h>
  52 #include <net/if_arp.h>
  53 #include <net/ethernet.h>
  54 #include <net/if_dl.h>
  55 #include <net/if_media.h>
  56 #include <net/if_types.h>
  57
  58 #include <net80211/ieee80211_var.h>
  59 #include <net80211/ieee80211_radiotap.h>
  60 #include <net80211/ieee80211_regdomain.h>
  61 #include <net80211/ieee80211_ratectl.h>
  62
  63 #include <netinet/in.h>
  64 #include <netinet/in_systm.h>
  65 #include <netinet/in_var.h>
  66 #include <netinet/ip.h>
  67 #include <netinet/if_ether.h>
  68
  69 #include <dev/rtwn/if_rtwnreg.h>
  70
  71 #define RTWN_DEBUG
  72 #ifdef RTWN_DEBUG
  73 #define DPRINTF(x)      do { if (sc->sc_debug > 0) printf x; } while (0)
  74 #define DPRINTFN(n, x)  do { if (sc->sc_debug >= (n)) printf x; } while (0)
  75 #else
  76 #define DPRINTF(x)
  77 #define DPRINTFN(n, x)
  78 #endif
  79
  80 /*
  81  * PCI configuration space registers.
  82  */
  83 #define RTWN_PCI_IOBA           0x10    /* i/o mapped base */
  84 #define RTWN_PCI_MMBA           0x18    /* memory mapped base */
  85
  86 #define RTWN_INT_ENABLE (R92C_IMR_ROK | R92C_IMR_VODOK | R92C_IMR_VIDOK | \
  87                         R92C_IMR_BEDOK | R92C_IMR_BKDOK | R92C_IMR_MGNTDOK | \
  88                         R92C_IMR_HIGHDOK | R92C_IMR_BDOK | R92C_IMR_RDU | \
  89                         R92C_IMR_RXFOVW)
  90
  91 struct rtwn_ident {
  92         uint16_t        vendor;
  93         uint16_t        device;
  94         const char      *name;
  95 };
  96
  97
  98 static const struct rtwn_ident rtwn_ident_table[] = {
  99         { 0x10ec, 0x8176, "Realtek RTL8188CE" },
 100         { 0, 0, NULL }
 101 };
 102
 103
 104 static void     rtwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
 105 static void     rtwn_setup_rx_desc(struct rtwn_softc *, struct r92c_rx_desc *,
 106                     bus_addr_t, size_t, int);
 107 static int      rtwn_alloc_rx_list(struct rtwn_softc *);
 108 static void     rtwn_reset_rx_list(struct rtwn_softc *);
 109 static void     rtwn_free_rx_list(struct rtwn_softc *);
 110 static int      rtwn_alloc_tx_list(struct rtwn_softc *, int);
 111 static void     rtwn_reset_tx_list(struct rtwn_softc *, int);
 112 static void     rtwn_free_tx_list(struct rtwn_softc *, int);
 113 static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
 114                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 115                     const uint8_t [IEEE80211_ADDR_LEN],
 116                     const uint8_t [IEEE80211_ADDR_LEN]);
 117 static void     rtwn_vap_delete(struct ieee80211vap *);
 118 static void     rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
 119 static void     rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
 120 static void     rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
 121 static uint8_t  rtwn_read_1(struct rtwn_softc *, uint16_t);
 122 static uint16_t rtwn_read_2(struct rtwn_softc *, uint16_t);
 123 static uint32_t rtwn_read_4(struct rtwn_softc *, uint16_t);
 124 static int      rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
 125 static void     rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
 126 static uint32_t rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
 127 static int      rtwn_llt_write(struct rtwn_softc *, uint32_t, uint32_t);
 128 static uint8_t  rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
 129 static void     rtwn_efuse_read(struct rtwn_softc *);
 130 static int      rtwn_read_chipid(struct rtwn_softc *);
 131 static void     rtwn_read_rom(struct rtwn_softc *);
 132 static int      rtwn_ra_init(struct rtwn_softc *);
 133 static void     rtwn_tsf_sync_enable(struct rtwn_softc *);
 134 static void     rtwn_set_led(struct rtwn_softc *, int, int);
 135 static void     rtwn_calib_to(void *);
 136 static int      rtwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 137 static int      rtwn_updateedca(struct ieee80211com *);
 138 static void     rtwn_update_avgrssi(struct rtwn_softc *, int, int8_t);
 139 static int8_t   rtwn_get_rssi(struct rtwn_softc *, int, void *);
 140 static void     rtwn_rx_frame(struct rtwn_softc *, struct r92c_rx_desc *,
 141                     struct rtwn_rx_data *, int);
 142 static int      rtwn_tx(struct rtwn_softc *, struct mbuf *,
 143                     struct ieee80211_node *);
 144 static void     rtwn_tx_done(struct rtwn_softc *, int);
 145 static int      rtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 146                     const struct ieee80211_bpf_params *);
 147 static int      rtwn_transmit(struct ieee80211com *, struct mbuf *);
 148 static void     rtwn_parent(struct ieee80211com *);
 149 static void     rtwn_start(struct rtwn_softc *sc);
 150 static void     rtwn_watchdog(void *);
 151 static int      rtwn_power_on(struct rtwn_softc *);
 152 static int      rtwn_llt_init(struct rtwn_softc *);
 153 static void     rtwn_fw_reset(struct rtwn_softc *);
 154 static void     rtwn_fw_loadpage(struct rtwn_softc *, int, const uint8_t *,
 155                     int);
 156 static int      rtwn_load_firmware(struct rtwn_softc *);
 157 static int      rtwn_dma_init(struct rtwn_softc *);
 158 static void     rtwn_mac_init(struct rtwn_softc *);
 159 static void     rtwn_bb_init(struct rtwn_softc *);
 160 static void     rtwn_rf_init(struct rtwn_softc *);
 161 static void     rtwn_cam_init(struct rtwn_softc *);
 162 static void     rtwn_pa_bias_init(struct rtwn_softc *);
 163 static void     rtwn_rxfilter_init(struct rtwn_softc *);
 164 static void     rtwn_edca_init(struct rtwn_softc *);
 165 static void     rtwn_write_txpower(struct rtwn_softc *, int, uint16_t[]);
 166 static void     rtwn_get_txpower(struct rtwn_softc *, int,
 167                     struct ieee80211_channel *, struct ieee80211_channel *,
 168                     uint16_t[]);
 169 static void     rtwn_set_txpower(struct rtwn_softc *,
 170                     struct ieee80211_channel *, struct ieee80211_channel *);
 171 static void     rtwn_set_rx_bssid_all(struct rtwn_softc *, int);
 172 static void     rtwn_set_gain(struct rtwn_softc *, uint8_t);
 173 static void     rtwn_scan_start(struct ieee80211com *);
 174 static void     rtwn_scan_end(struct ieee80211com *);
 175 static void     rtwn_getradiocaps(struct ieee80211com *, int, int *,
 176                     struct ieee80211_channel[]);
 177 static void     rtwn_set_channel(struct ieee80211com *);
 178 static void     rtwn_update_mcast(struct ieee80211com *);
 179 static void     rtwn_set_chan(struct rtwn_softc *,
 180                     struct ieee80211_channel *, struct ieee80211_channel *);
 181 static int      rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
 182                     uint16_t[2]);
 183 static void     rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
 184                     uint16_t[2][2]);
 185 static int      rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
 186                     uint16_t[2][2], uint16_t[2][2], int);
 187 static void     rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
 188                     uint16_t[2], int);
 189 static void     rtwn_iq_calib(struct rtwn_softc *);
 190 static void     rtwn_lc_calib(struct rtwn_softc *);
 191 static void     rtwn_temp_calib(struct rtwn_softc *);
 192 static int      rtwn_init(struct rtwn_softc *);
 193 static void     rtwn_stop_locked(struct rtwn_softc *);
 194 static void     rtwn_stop(struct rtwn_softc *);
 195 static void     rtwn_intr(void *);
 196
 197 /* Aliases. */
 198 #define rtwn_bb_write   rtwn_write_4
 199 #define rtwn_bb_read    rtwn_read_4
 200
 201 static int      rtwn_probe(device_t);
 202 static int      rtwn_attach(device_t);
 203 static int      rtwn_detach(device_t);
 204 static int      rtwn_shutdown(device_t);
 205 static int      rtwn_suspend(device_t);
 206 static int      rtwn_resume(device_t);
 207
 208 static device_method_t rtwn_methods[] = {
 209         /* Device interface */
 210         DEVMETHOD(device_probe,         rtwn_probe),
 211         DEVMETHOD(device_attach,        rtwn_attach),
 212         DEVMETHOD(device_detach,        rtwn_detach),
 213         DEVMETHOD(device_shutdown,      rtwn_shutdown),
 214         DEVMETHOD(device_suspend,       rtwn_suspend),
 215         DEVMETHOD(device_resume,        rtwn_resume),
 216
 217         DEVMETHOD_END
 218 };
 219
 220 static driver_t rtwn_driver = {
 221         "rtwn",
 222         rtwn_methods,
 223         sizeof (struct rtwn_softc)
 224 };
 225 static devclass_t rtwn_devclass;
 226
 227 DRIVER_MODULE(rtwn, pci, rtwn_driver, rtwn_devclass, NULL, NULL);
 228
 229 MODULE_VERSION(rtwn, 1);
 230
 231 MODULE_DEPEND(rtwn, pci,  1, 1, 1);
 232 MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
 233 MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
 234
 235 static const uint8_t rtwn_chan_2ghz[] =
 236         { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
 237
 238 static int
 239 rtwn_probe(device_t dev)
 240 {
 241         const struct rtwn_ident *ident;
 242
 243         for (ident = rtwn_ident_table; ident->name != NULL; ident++) {
 244                 if (pci_get_vendor(dev) == ident->vendor &&
 245                     pci_get_device(dev) == ident->device) {
 246                         device_set_desc(dev, ident->name);
 247                         return (BUS_PROBE_DEFAULT);
 248                 }
 249         }
 250         return (ENXIO);
 251 }
 252
 253 static int
 254 rtwn_attach(device_t dev)
 255 {
 256         struct rtwn_softc *sc = device_get_softc(dev);
 257         struct ieee80211com *ic = &sc->sc_ic;
 258         uint32_t lcsr;
 259         int i, count, error, rid;
 260
 261         sc->sc_dev = dev;
 262         sc->sc_debug = 0;
 263
 264         /*
 265          * Get the offset of the PCI Express Capability Structure in PCI
 266          * Configuration Space.
 267          */
 268         error = pci_find_cap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
 269         if (error != 0) {
 270                 device_printf(dev, "PCIe capability structure not found!\n");
 271                 return (error);
 272         }
 273
 274         /* Enable bus-mastering. */
 275         pci_enable_busmaster(dev);
 276
 277         rid = PCIR_BAR(2);
 278         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
 279             RF_ACTIVE);
 280         if (sc->mem == NULL) {
 281                 device_printf(dev, "can't map mem space\n");
 282                 return (ENOMEM);
 283         }
 284         sc->sc_st = rman_get_bustag(sc->mem);
 285         sc->sc_sh = rman_get_bushandle(sc->mem);
 286
 287         /* Install interrupt handler. */
 288         count = 1;
 289         rid = 0;
 290         if (pci_alloc_msi(dev, &count) == 0)
 291                 rid = 1;
 292         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
 293             (rid != 0 ? 0 : RF_SHAREABLE));
 294         if (sc->irq == NULL) {
 295                 device_printf(dev, "can't map interrupt\n");
 296                 return (ENXIO);
 297         }
 298
 299         RTWN_LOCK_INIT(sc);
 300         callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
 301         callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
 302         mbufq_init(&sc->sc_snd, ifqmaxlen);
 303
 304         error = rtwn_read_chipid(sc);
 305         if (error != 0) {
 306                 device_printf(dev, "unsupported test chip\n");
 307                 goto fail;
 308         }
 309
 310         /* Disable PCIe Active State Power Management (ASPM). */
 311         lcsr = pci_read_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, 4);
 312         lcsr &= ~PCIEM_LINK_CTL_ASPMC;
 313         pci_write_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, lcsr, 4);
 314
 315         /* Allocate Tx/Rx buffers. */
 316         error = rtwn_alloc_rx_list(sc);
 317         if (error != 0) {
 318                 device_printf(dev, "could not allocate Rx buffers\n");
 319                 goto fail;
 320         }
 321         for (i = 0; i < RTWN_NTXQUEUES; i++) {
 322                 error = rtwn_alloc_tx_list(sc, i);
 323                 if (error != 0) {
 324                         device_printf(dev, "could not allocate Tx buffers\n");
 325                         goto fail;
 326                 }
 327         }
 328
 329         /* Determine number of Tx/Rx chains. */
 330         if (sc->chip & RTWN_CHIP_92C) {
 331                 sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
 332                 sc->nrxchains = 2;
 333         } else {
 334                 sc->ntxchains = 1;
 335                 sc->nrxchains = 1;
 336         }
 337         rtwn_read_rom(sc);
 338
 339         device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
 340             (sc->chip & RTWN_CHIP_92C) ? "8192CE" : "8188CE",
 341             sc->ntxchains, sc->nrxchains);
 342
 343         ic->ic_softc = sc;
 344         ic->ic_name = device_get_nameunit(dev);
 345         ic->ic_opmode = IEEE80211_M_STA;
 346         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
 347
 348         /* set device capabilities */
 349         ic->ic_caps =
 350                   IEEE80211_C_STA               /* station mode */
 351                 | IEEE80211_C_MONITOR           /* monitor mode */
 352                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 353                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 354                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
 355                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 356                 | IEEE80211_C_WME               /* 802.11e */
 357                 ;
 358
 359         /* XXX TODO: setup regdomain if R92C_CHANNEL_PLAN_BY_HW bit is set. */
 360
 361         rtwn_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
 362             ic->ic_channels);
 363
 364         ieee80211_ifattach(ic);
 365
 366         ic->ic_wme.wme_update = rtwn_updateedca;
 367         ic->ic_update_mcast = rtwn_update_mcast;
 368         ic->ic_scan_start = rtwn_scan_start;
 369         ic->ic_scan_end = rtwn_scan_end;
 370         ic->ic_getradiocaps = rtwn_getradiocaps;
 371         ic->ic_set_channel = rtwn_set_channel;
 372         ic->ic_raw_xmit = rtwn_raw_xmit;
 373         ic->ic_transmit = rtwn_transmit;
 374         ic->ic_parent = rtwn_parent;
 375         ic->ic_vap_create = rtwn_vap_create;
 376         ic->ic_vap_delete = rtwn_vap_delete;
 377
 378         ieee80211_radiotap_attach(ic,
 379             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 380                 RTWN_TX_RADIOTAP_PRESENT,
 381             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 382                 RTWN_RX_RADIOTAP_PRESENT);
 383
 384         /*
 385          * Hook our interrupt after all initialization is complete.
 386          */
 387         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
 388             NULL, rtwn_intr, sc, &sc->sc_ih);
 389         if (error != 0) {
 390                 device_printf(dev, "can't establish interrupt, error %d\n",
 391                     error);
 392                 goto fail;
 393         }
 394
 395         if (bootverbose)
 396                 ieee80211_announce(ic);
 397
 398         return (0);
 399
 400 fail:
 401         rtwn_detach(dev);
 402         return (error);
 403 }
 404
 405
 406 static int
 407 rtwn_detach(device_t dev)
 408 {
 409         struct rtwn_softc *sc = device_get_softc(dev);
 410         int i;
 411
 412         if (sc->sc_ic.ic_softc != NULL) {
 413                 rtwn_stop(sc);
 414
 415                 callout_drain(&sc->calib_to);
 416                 callout_drain(&sc->watchdog_to);
 417                 ieee80211_ifdetach(&sc->sc_ic);
 418                 mbufq_drain(&sc->sc_snd);
 419         }
 420
 421         /* Uninstall interrupt handler. */
 422         if (sc->irq != NULL) {
 423                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
 424                 bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
 425                     sc->irq);
 426                 pci_release_msi(dev);
 427         }
 428
 429         /* Free Tx/Rx buffers. */
 430         for (i = 0; i < RTWN_NTXQUEUES; i++)
 431                 rtwn_free_tx_list(sc, i);
 432         rtwn_free_rx_list(sc);
 433
 434         if (sc->mem != NULL)
 435                 bus_release_resource(dev, SYS_RES_MEMORY,
 436                     rman_get_rid(sc->mem), sc->mem);
 437
 438         RTWN_LOCK_DESTROY(sc);
 439         return (0);
 440 }
 441
 442 static int
 443 rtwn_shutdown(device_t dev)
 444 {
 445
 446         return (0);
 447 }
 448
 449 static int
 450 rtwn_suspend(device_t dev)
 451 {
 452         return (0);
 453 }
 454
 455 static int
 456 rtwn_resume(device_t dev)
 457 {
 458
 459         return (0);
 460 }
 461
 462 static void
 463 rtwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
 464 {
 465
 466         if (error != 0)
 467                 return;
 468         KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
 469         *(bus_addr_t *)arg = segs[0].ds_addr;
 470 }
 471
 472 static void
 473 rtwn_setup_rx_desc(struct rtwn_softc *sc, struct r92c_rx_desc *desc,
 474     bus_addr_t addr, size_t len, int idx)
 475 {
 476
 477         memset(desc, 0, sizeof(*desc));
 478         desc->rxdw0 = htole32(SM(R92C_RXDW0_PKTLEN, len) |
 479                 ((idx == RTWN_RX_LIST_COUNT - 1) ? R92C_RXDW0_EOR : 0));
 480         desc->rxbufaddr = htole32(addr);
 481         bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
 482             BUS_SPACE_BARRIER_WRITE);
 483         desc->rxdw0 |= htole32(R92C_RXDW0_OWN);
 484 }
 485
 486 static int
 487 rtwn_alloc_rx_list(struct rtwn_softc *sc)
 488 {
 489         struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
 490         struct rtwn_rx_data *rx_data;
 491         bus_size_t size;
 492         int i, error;
 493
 494         /* Allocate Rx descriptors. */
 495         size = sizeof(struct r92c_rx_desc) * RTWN_RX_LIST_COUNT;
 496         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
 497             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
 498             size, 1, size, 0, NULL, NULL, &rx_ring->desc_dmat);
 499         if (error != 0) {
 500                 device_printf(sc->sc_dev, "could not create rx desc DMA tag\n");
 501                 goto fail;
 502         }
 503
 504         error = bus_dmamem_alloc(rx_ring->desc_dmat, (void **)&rx_ring->desc,
 505             BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT,
 506             &rx_ring->desc_map);
 507         if (error != 0) {
 508                 device_printf(sc->sc_dev, "could not allocate rx desc\n");
 509                 goto fail;
 510         }
 511         error = bus_dmamap_load(rx_ring->desc_dmat, rx_ring->desc_map,
 512             rx_ring->desc, size, rtwn_dma_map_addr, &rx_ring->paddr, 0);
 513         if (error != 0) {
 514                 device_printf(sc->sc_dev, "could not load rx desc DMA map\n");
 515                 goto fail;
 516         }
 517         bus_dmamap_sync(rx_ring->desc_dmat, rx_ring->desc_map,
 518             BUS_DMASYNC_PREWRITE);
 519
 520         /* Create RX buffer DMA tag. */
 521         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
 522             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
 523             1, MCLBYTES, 0, NULL, NULL, &rx_ring->data_dmat);
 524         if (error != 0) {
 525                 device_printf(sc->sc_dev, "could not create rx buf DMA tag\n");
 526                 goto fail;
 527         }
 528
 529         /* Allocate Rx buffers. */
 530         for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
 531                 rx_data = &rx_ring->rx_data[i];
 532                 error = bus_dmamap_create(rx_ring->data_dmat, 0, &rx_data->map);
 533                 if (error != 0) {
 534                         device_printf(sc->sc_dev,
 535                             "could not create rx buf DMA map\n");
 536                         goto fail;
 537                 }
 538
 539                 rx_data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 540                 if (rx_data->m == NULL) {
 541                         device_printf(sc->sc_dev,
 542                             "could not allocate rx mbuf\n");
 543                         error = ENOMEM;
 544                         goto fail;
 545                 }
 546
 547                 error = bus_dmamap_load(rx_ring->data_dmat, rx_data->map,
 548                     mtod(rx_data->m, void *), MCLBYTES, rtwn_dma_map_addr,
 549                     &rx_data->paddr, BUS_DMA_NOWAIT);
 550                 if (error != 0) {
 551                         device_printf(sc->sc_dev,
 552                             "could not load rx buf DMA map");
 553                         goto fail;
 554                 }
 555
 556                 rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
 557                     MCLBYTES, i);
 558         }
 559         return (0);
 560
 561 fail:
 562         rtwn_free_rx_list(sc);
 563         return (error);
 564 }
 565
 566 static void
 567 rtwn_reset_rx_list(struct rtwn_softc *sc)
 568 {
 569         struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
 570         struct rtwn_rx_data *rx_data;
 571         int i;
 572
 573         for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
 574                 rx_data = &rx_ring->rx_data[i];
 575                 rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
 576                     MCLBYTES, i);
 577         }
 578 }
 579
 580 static void
 581 rtwn_free_rx_list(struct rtwn_softc *sc)
 582 {
 583         struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
 584         struct rtwn_rx_data *rx_data;
 585         int i;
 586
 587         if (rx_ring->desc_dmat != NULL) {
 588                 if (rx_ring->desc != NULL) {
 589                         bus_dmamap_sync(rx_ring->desc_dmat,
 590                             rx_ring->desc_map,
 591                             BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
 592                         bus_dmamap_unload(rx_ring->desc_dmat,
 593                             rx_ring->desc_map);
 594                         bus_dmamem_free(rx_ring->desc_dmat, rx_ring->desc,
 595                             rx_ring->desc_map);
 596                         rx_ring->desc = NULL;
 597                 }
 598                 bus_dma_tag_destroy(rx_ring->desc_dmat);
 599                 rx_ring->desc_dmat = NULL;
 600         }
 601
 602         for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
 603                 rx_data = &rx_ring->rx_data[i];
 604
 605                 if (rx_data->m != NULL) {
 606                         bus_dmamap_sync(rx_ring->data_dmat,
 607                             rx_data->map, BUS_DMASYNC_POSTREAD);
 608                         bus_dmamap_unload(rx_ring->data_dmat, rx_data->map);
 609                         m_freem(rx_data->m);
 610                         rx_data->m = NULL;
 611                 }
 612                 bus_dmamap_destroy(rx_ring->data_dmat, rx_data->map);
 613                 rx_data->map = NULL;
 614         }
 615         if (rx_ring->data_dmat != NULL) {
 616                 bus_dma_tag_destroy(rx_ring->data_dmat);
 617                 rx_ring->data_dmat = NULL;
 618         }
 619 }
 620
 621 static int
 622 rtwn_alloc_tx_list(struct rtwn_softc *sc, int qid)
 623 {
 624         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
 625         struct rtwn_tx_data *tx_data;
 626         bus_size_t size;
 627         int i, error;
 628
 629         size = sizeof(struct r92c_tx_desc) * RTWN_TX_LIST_COUNT;
 630         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), PAGE_SIZE, 0,
 631             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
 632             size, 1, size, 0, NULL, NULL, &tx_ring->desc_dmat);
 633         if (error != 0) {
 634                 device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
 635                 goto fail;
 636         }
 637
 638         error = bus_dmamem_alloc(tx_ring->desc_dmat, (void **)&tx_ring->desc,
 639             BUS_DMA_NOWAIT | BUS_DMA_ZERO, &tx_ring->desc_map);
 640         if (error != 0) {
 641                 device_printf(sc->sc_dev, "can't map tx ring DMA memory\n");
 642                 goto fail;
 643         }
 644         error = bus_dmamap_load(tx_ring->desc_dmat, tx_ring->desc_map,
 645             tx_ring->desc, size, rtwn_dma_map_addr, &tx_ring->paddr,
 646             BUS_DMA_NOWAIT);
 647         if (error != 0) {
 648                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
 649                 goto fail;
 650         }
 651         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
 652             BUS_DMASYNC_PREWRITE);
 653
 654         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
 655             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
 656             1, MCLBYTES, 0, NULL, NULL, &tx_ring->data_dmat);
 657         if (error != 0) {
 658                 device_printf(sc->sc_dev, "could not create tx buf DMA tag\n");
 659                 goto fail;
 660         }
 661
 662         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
 663                 struct r92c_tx_desc *desc = &tx_ring->desc[i];
 664
 665                 /* setup tx desc */
 666                 desc->nextdescaddr = htole32(tx_ring->paddr +
 667                     + sizeof(struct r92c_tx_desc)
 668                     * ((i + 1) % RTWN_TX_LIST_COUNT));
 669                 tx_data = &tx_ring->tx_data[i];
 670                 error = bus_dmamap_create(tx_ring->data_dmat, 0, &tx_data->map);
 671                 if (error != 0) {
 672                         device_printf(sc->sc_dev,
 673                             "could not create tx buf DMA map\n");
 674                         goto fail;
 675                 }
 676                 tx_data->m = NULL;
 677                 tx_data->ni = NULL;
 678         }
 679         return (0);
 680
 681 fail:
 682         rtwn_free_tx_list(sc, qid);
 683         return (error);
 684 }
 685
 686 static void
 687 rtwn_reset_tx_list(struct rtwn_softc *sc, int qid)
 688 {
 689         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
 690         int i;
 691
 692         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
 693                 struct r92c_tx_desc *desc = &tx_ring->desc[i];
 694                 struct rtwn_tx_data *tx_data = &tx_ring->tx_data[i];
 695
 696                 memset(desc, 0, sizeof(*desc) -
 697                     (sizeof(desc->reserved) + sizeof(desc->nextdescaddr64) +
 698                     sizeof(desc->nextdescaddr)));
 699
 700                 if (tx_data->m != NULL) {
 701                         bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
 702                             BUS_DMASYNC_POSTWRITE);
 703                         bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
 704                         m_freem(tx_data->m);
 705                         tx_data->m = NULL;
 706                 }
 707                 if (tx_data->ni != NULL) {
 708                         ieee80211_free_node(tx_data->ni);
 709                         tx_data->ni = NULL;
 710                 }
 711         }
 712
 713         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
 714             BUS_DMASYNC_POSTWRITE);
 715
 716         sc->qfullmsk &= ~(1 << qid);
 717         tx_ring->queued = 0;
 718         tx_ring->cur = 0;
 719 }
 720
 721 static void
 722 rtwn_free_tx_list(struct rtwn_softc *sc, int qid)
 723 {
 724         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
 725         struct rtwn_tx_data *tx_data;
 726         int i;
 727
 728         if (tx_ring->desc_dmat != NULL) {
 729                 if (tx_ring->desc != NULL) {
 730                         bus_dmamap_sync(tx_ring->desc_dmat,
 731                             tx_ring->desc_map, BUS_DMASYNC_POSTWRITE);
 732                         bus_dmamap_unload(tx_ring->desc_dmat,
 733                             tx_ring->desc_map);
 734                         bus_dmamem_free(tx_ring->desc_dmat, tx_ring->desc,
 735                             tx_ring->desc_map);
 736                 }
 737                 bus_dma_tag_destroy(tx_ring->desc_dmat);
 738         }
 739
 740         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
 741                 tx_data = &tx_ring->tx_data[i];
 742
 743                 if (tx_data->m != NULL) {
 744                         bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
 745                             BUS_DMASYNC_POSTWRITE);
 746                         bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
 747                         m_freem(tx_data->m);
 748                         tx_data->m = NULL;
 749                 }
 750         }
 751         if (tx_ring->data_dmat != NULL) {
 752                 bus_dma_tag_destroy(tx_ring->data_dmat);
 753                 tx_ring->data_dmat = NULL;
 754         }
 755
 756         sc->qfullmsk &= ~(1 << qid);
 757         tx_ring->queued = 0;
 758         tx_ring->cur = 0;
 759 }
 760
 761
 762 static struct ieee80211vap *
 763 rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 764     enum ieee80211_opmode opmode, int flags,
 765     const uint8_t bssid[IEEE80211_ADDR_LEN],
 766     const uint8_t mac[IEEE80211_ADDR_LEN])
 767 {
 768         struct rtwn_vap *rvp;
 769         struct ieee80211vap *vap;
 770
 771         if (!TAILQ_EMPTY(&ic->ic_vaps))
 772                 return (NULL);
 773
 774         rvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 775         vap = &rvp->vap;
 776         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
 777             flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
 778                 /* out of memory */
 779                  free(rvp, M_80211_VAP);
 780                  return (NULL);
 781         }
 782
 783         /* Override state transition machine. */
 784         rvp->newstate = vap->iv_newstate;
 785         vap->iv_newstate = rtwn_newstate;
 786
 787         /* Complete setup. */
 788         ieee80211_vap_attach(vap, ieee80211_media_change,
 789             ieee80211_media_status, mac);
 790         ic->ic_opmode = opmode;
 791         return (vap);
 792 }
 793
 794 static void
 795 rtwn_vap_delete(struct ieee80211vap *vap)
 796 {
 797         struct rtwn_vap *rvp = RTWN_VAP(vap);
 798
 799         ieee80211_vap_detach(vap);
 800         free(rvp, M_80211_VAP);
 801 }
 802
 803 static void
 804 rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
 805 {
 806
 807         bus_space_write_1(sc->sc_st, sc->sc_sh, addr, val);
 808 }
 809
 810 static void
 811 rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
 812 {
 813
 814         val = htole16(val);
 815         bus_space_write_2(sc->sc_st, sc->sc_sh, addr, val);
 816 }
 817
 818 static void
 819 rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
 820 {
 821
 822         val = htole32(val);
 823         bus_space_write_4(sc->sc_st, sc->sc_sh, addr, val);
 824 }
 825
 826 static uint8_t
 827 rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
 828 {
 829
 830         return (bus_space_read_1(sc->sc_st, sc->sc_sh, addr));
 831 }
 832
 833 static uint16_t
 834 rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
 835 {
 836
 837         return (bus_space_read_2(sc->sc_st, sc->sc_sh, addr));
 838 }
 839
 840 static uint32_t
 841 rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
 842 {
 843
 844         return (bus_space_read_4(sc->sc_st, sc->sc_sh, addr));
 845 }
 846
 847 static int
 848 rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
 849 {
 850         struct r92c_fw_cmd cmd;
 851         int ntries;
 852
 853         /* Wait for current FW box to be empty. */
 854         for (ntries = 0; ntries < 100; ntries++) {
 855                 if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
 856                         break;
 857                 DELAY(1);
 858         }
 859         if (ntries == 100) {
 860                 device_printf(sc->sc_dev,
 861                     "could not send firmware command %d\n", id);
 862                 return (ETIMEDOUT);
 863         }
 864         memset(&cmd, 0, sizeof(cmd));
 865         cmd.id = id;
 866         if (len > 3)
 867                 cmd.id |= R92C_CMD_FLAG_EXT;
 868         KASSERT(len <= sizeof(cmd.msg), ("rtwn_fw_cmd\n"));
 869         memcpy(cmd.msg, buf, len);
 870
 871         /* Write the first word last since that will trigger the FW. */
 872         rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur), *((uint8_t *)&cmd + 4));
 873         rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
 874
 875         sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
 876
 877         /* Give firmware some time for processing. */
 878         DELAY(2000);
 879
 880         return (0);
 881 }
 882
 883 static void
 884 rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
 885 {
 886         rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
 887             SM(R92C_LSSI_PARAM_ADDR, addr) |
 888             SM(R92C_LSSI_PARAM_DATA, val));
 889 }
 890
 891 static uint32_t
 892 rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
 893 {
 894         uint32_t reg[R92C_MAX_CHAINS], val;
 895
 896         reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
 897         if (chain != 0)
 898                 reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
 899
 900         rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
 901             reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
 902         DELAY(1000);
 903
 904         rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
 905             RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
 906             R92C_HSSI_PARAM2_READ_EDGE);
 907         DELAY(1000);
 908
 909         rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
 910             reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
 911         DELAY(1000);
 912
 913         if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
 914                 val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
 915         else
 916                 val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
 917         return (MS(val, R92C_LSSI_READBACK_DATA));
 918 }
 919
 920 static int
 921 rtwn_llt_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
 922 {
 923         int ntries;
 924
 925         rtwn_write_4(sc, R92C_LLT_INIT,
 926             SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
 927             SM(R92C_LLT_INIT_ADDR, addr) |
 928             SM(R92C_LLT_INIT_DATA, data));
 929         /* Wait for write operation to complete. */
 930         for (ntries = 0; ntries < 20; ntries++) {
 931                 if (MS(rtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
 932                     R92C_LLT_INIT_OP_NO_ACTIVE)
 933                         return (0);
 934                 DELAY(5);
 935         }
 936         return (ETIMEDOUT);
 937 }
 938
 939 static uint8_t
 940 rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
 941 {
 942         uint32_t reg;
 943         int ntries;
 944
 945         reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
 946         reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
 947         reg &= ~R92C_EFUSE_CTRL_VALID;
 948         rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
 949         /* Wait for read operation to complete. */
 950         for (ntries = 0; ntries < 100; ntries++) {
 951                 reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
 952                 if (reg & R92C_EFUSE_CTRL_VALID)
 953                         return (MS(reg, R92C_EFUSE_CTRL_DATA));
 954                 DELAY(5);
 955         }
 956         device_printf(sc->sc_dev,
 957             "could not read efuse byte at address 0x%x\n", addr);
 958         return (0xff);
 959 }
 960
 961 static void
 962 rtwn_efuse_read(struct rtwn_softc *sc)
 963 {
 964         uint8_t *rom = (uint8_t *)&sc->rom;
 965         uint16_t addr = 0;
 966         uint32_t reg;
 967         uint8_t off, msk;
 968         int i;
 969
 970         reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
 971         if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
 972                 rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
 973                     reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
 974         }
 975         reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
 976         if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
 977                 rtwn_write_2(sc, R92C_SYS_FUNC_EN,
 978                     reg | R92C_SYS_FUNC_EN_ELDR);
 979         }
 980         reg = rtwn_read_2(sc, R92C_SYS_CLKR);
 981         if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
 982             (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
 983                 rtwn_write_2(sc, R92C_SYS_CLKR,
 984                     reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
 985         }
 986         memset(&sc->rom, 0xff, sizeof(sc->rom));
 987         while (addr < 512) {
 988                 reg = rtwn_efuse_read_1(sc, addr);
 989                 if (reg == 0xff)
 990                         break;
 991                 addr++;
 992                 off = reg >> 4;
 993                 msk = reg & 0xf;
 994                 for (i = 0; i < 4; i++) {
 995                         if (msk & (1 << i))
 996                                 continue;
 997                         rom[off * 8 + i * 2 + 0] =
 998                             rtwn_efuse_read_1(sc, addr);
 999                         addr++;
1000                         rom[off * 8 + i * 2 + 1] =
1001                             rtwn_efuse_read_1(sc, addr);
1002                         addr++;
1003                 }
1004         }
1005 #ifdef RTWN_DEBUG
1006         if (sc->sc_debug >= 2) {
1007                 /* Dump ROM content. */
1008                 printf("\n");
1009                 for (i = 0; i < sizeof(sc->rom); i++)
1010                         printf("%02x:", rom[i]);
1011                 printf("\n");
1012         }
1013 #endif
1014 }
1015
1016 static int
1017 rtwn_read_chipid(struct rtwn_softc *sc)
1018 {
1019         uint32_t reg;
1020
1021         reg = rtwn_read_4(sc, R92C_SYS_CFG);
1022         if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1023                 /* Unsupported test chip. */
1024                 return (EIO);
1025
1026         if (reg & R92C_SYS_CFG_TYPE_92C) {
1027                 sc->chip |= RTWN_CHIP_92C;
1028                 /* Check if it is a castrated 8192C. */
1029                 if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
1030                     R92C_HPON_FSM_CHIP_BONDING_ID) ==
1031                     R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1032                         sc->chip |= RTWN_CHIP_92C_1T2R;
1033         }
1034         if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1035                 sc->chip |= RTWN_CHIP_UMC;
1036                 if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1037                         sc->chip |= RTWN_CHIP_UMC_A_CUT;
1038         }
1039         return (0);
1040 }
1041
1042 static void
1043 rtwn_read_rom(struct rtwn_softc *sc)
1044 {
1045         struct r92c_rom *rom = &sc->rom;
1046
1047         /* Read full ROM image. */
1048         rtwn_efuse_read(sc);
1049
1050         if (rom->id != 0x8129)
1051                 device_printf(sc->sc_dev, "invalid EEPROM ID 0x%x\n", rom->id);
1052
1053         /* XXX Weird but this is what the vendor driver does. */
1054         sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
1055         DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
1056
1057         sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1058
1059         sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1060         DPRINTF(("regulatory type=%d\n", sc->regulatory));
1061
1062         IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1063 }
1064
1065 static __inline uint8_t
1066 rate2ridx(uint8_t rate)
1067 {
1068         switch (rate) {
1069         case 12:        return 4;
1070         case 18:        return 5;
1071         case 24:        return 6;
1072         case 36:        return 7;
1073         case 48:        return 8;
1074         case 72:        return 9;
1075         case 96:        return 10;
1076         case 108:       return 11;
1077         case 2:         return 0;
1078         case 4:         return 1;
1079         case 11:        return 2;
1080         case 22:        return 3;
1081         default:        return RTWN_RIDX_UNKNOWN;
1082         }
1083 }
1084
1085 /*
1086  * Initialize rate adaptation in firmware.
1087  */
1088 static int
1089 rtwn_ra_init(struct rtwn_softc *sc)
1090 {
1091         struct ieee80211com *ic = &sc->sc_ic;
1092         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1093         struct ieee80211_node *ni = ieee80211_ref_node(vap->iv_bss);
1094         struct ieee80211_rateset *rs = &ni->ni_rates;
1095         struct r92c_fw_cmd_macid_cfg cmd;
1096         uint32_t rates, basicrates;
1097         uint8_t maxrate, maxbasicrate, mode, ridx;
1098         int error, i;
1099
1100         /* Get normal and basic rates mask. */
1101         rates = basicrates = 0;
1102         maxrate = maxbasicrate = 0;
1103         for (i = 0; i < rs->rs_nrates; i++) {
1104                 /* Convert 802.11 rate to HW rate index. */
1105                 ridx = rate2ridx(IEEE80211_RV(rs->rs_rates[i]));
1106                 if (ridx == RTWN_RIDX_UNKNOWN)  /* Unknown rate, skip. */
1107                         continue;
1108                 rates |= 1 << ridx;
1109                 if (ridx > maxrate)
1110                         maxrate = ridx;
1111                 if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1112                         basicrates |= 1 << ridx;
1113                         if (ridx > maxbasicrate)
1114                                 maxbasicrate = ridx;
1115                 }
1116         }
1117         if (ic->ic_curmode == IEEE80211_MODE_11B)
1118                 mode = R92C_RAID_11B;
1119         else
1120                 mode = R92C_RAID_11BG;
1121         DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1122             mode, rates, basicrates));
1123
1124         /* Set rates mask for group addressed frames. */
1125         cmd.macid = RTWN_MACID_BC | RTWN_MACID_VALID;
1126         cmd.mask = htole32(mode << 28 | basicrates);
1127         error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1128         if (error != 0) {
1129                 device_printf(sc->sc_dev,
1130                     "could not add broadcast station\n");
1131                 return (error);
1132         }
1133         /* Set initial MRR rate. */
1134         DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
1135         rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BC),
1136             maxbasicrate);
1137
1138         /* Set rates mask for unicast frames. */
1139         cmd.macid = RTWN_MACID_BSS | RTWN_MACID_VALID;
1140         cmd.mask = htole32(mode << 28 | rates);
1141         error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1142         if (error != 0) {
1143                 device_printf(sc->sc_dev, "could not add BSS station\n");
1144                 return (error);
1145         }
1146         /* Set initial MRR rate. */
1147         DPRINTF(("maxrate=%d\n", maxrate));
1148         rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BSS),
1149             maxrate);
1150
1151         /* Configure Automatic Rate Fallback Register. */
1152         if (ic->ic_curmode == IEEE80211_MODE_11B) {
1153                 if (rates & 0x0c)
1154                         rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0d));
1155                 else
1156                         rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0f));
1157         } else
1158                 rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0ff5));
1159
1160         /* Indicate highest supported rate. */
1161         ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1162         return (0);
1163 }
1164
1165 static void
1166 rtwn_tsf_sync_enable(struct rtwn_softc *sc)
1167 {
1168         struct ieee80211com *ic = &sc->sc_ic;
1169         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1170         struct ieee80211_node *ni = vap->iv_bss;
1171         uint64_t tsf;
1172
1173         /* Enable TSF synchronization. */
1174         rtwn_write_1(sc, R92C_BCN_CTRL,
1175             rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1176
1177         rtwn_write_1(sc, R92C_BCN_CTRL,
1178             rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1179
1180         /* Set initial TSF. */
1181         memcpy(&tsf, ni->ni_tstamp.data, 8);
1182         tsf = le64toh(tsf);
1183         tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1184         tsf -= IEEE80211_DUR_TU;
1185         rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1186         rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1187
1188         rtwn_write_1(sc, R92C_BCN_CTRL,
1189             rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1190 }
1191
1192 static void
1193 rtwn_set_led(struct rtwn_softc *sc, int led, int on)
1194 {
1195         uint8_t reg;
1196
1197         if (led == RTWN_LED_LINK) {
1198                 reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1199                 if (!on)
1200                         reg |= R92C_LEDCFG2_DIS;
1201                 else
1202                         reg |= R92C_LEDCFG2_EN;
1203                 rtwn_write_1(sc, R92C_LEDCFG2, reg);
1204                 sc->ledlink = on;       /* Save LED state. */
1205         }
1206 }
1207
1208 static void
1209 rtwn_calib_to(void *arg)
1210 {
1211         struct rtwn_softc *sc = arg;
1212         struct r92c_fw_cmd_rssi cmd;
1213
1214         if (sc->avg_pwdb != -1) {
1215                 /* Indicate Rx signal strength to FW for rate adaptation. */
1216                 memset(&cmd, 0, sizeof(cmd));
1217                 cmd.macid = 0;  /* BSS. */
1218                 cmd.pwdb = sc->avg_pwdb;
1219                 DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
1220                 rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
1221         }
1222
1223         /* Do temperature compensation. */
1224         rtwn_temp_calib(sc);
1225
1226         callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
1227 }
1228
1229 static int
1230 rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1231 {
1232         struct rtwn_vap *rvp = RTWN_VAP(vap);
1233         struct ieee80211com *ic = vap->iv_ic;
1234         struct ieee80211_node *ni = vap->iv_bss;
1235         struct rtwn_softc *sc = ic->ic_softc;
1236         uint32_t reg;
1237
1238         IEEE80211_UNLOCK(ic);
1239         RTWN_LOCK(sc);
1240
1241         if (vap->iv_state == IEEE80211_S_RUN) {
1242                 /* Stop calibration. */
1243                 callout_stop(&sc->calib_to);
1244
1245                 /* Turn link LED off. */
1246                 rtwn_set_led(sc, RTWN_LED_LINK, 0);
1247
1248                 /* Set media status to 'No Link'. */
1249                 reg = rtwn_read_4(sc, R92C_CR);
1250                 reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1251                 rtwn_write_4(sc, R92C_CR, reg);
1252
1253                 /* Stop Rx of data frames. */
1254                 rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1255
1256                 /* Rest TSF. */
1257                 rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1258
1259                 /* Disable TSF synchronization. */
1260                 rtwn_write_1(sc, R92C_BCN_CTRL,
1261                     rtwn_read_1(sc, R92C_BCN_CTRL) |
1262                     R92C_BCN_CTRL_DIS_TSF_UDT0);
1263
1264                 /* Reset EDCA parameters. */
1265                 rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1266                 rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1267                 rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1268                 rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1269         }
1270         switch (nstate) {
1271         case IEEE80211_S_INIT:
1272                 /* Turn link LED off. */
1273                 rtwn_set_led(sc, RTWN_LED_LINK, 0);
1274                 break;
1275         case IEEE80211_S_SCAN:
1276                 /* Make link LED blink during scan. */
1277                 rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1278
1279                 /* Pause AC Tx queues. */
1280                 rtwn_write_1(sc, R92C_TXPAUSE,
1281                     rtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1282                 break;
1283         case IEEE80211_S_AUTH:
1284                 rtwn_set_chan(sc, ic->ic_curchan, NULL);
1285                 break;
1286         case IEEE80211_S_RUN:
1287                 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1288                         /* Enable Rx of data frames. */
1289                         rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1290
1291                         /* Turn link LED on. */
1292                         rtwn_set_led(sc, RTWN_LED_LINK, 1);
1293                         break;
1294                 }
1295
1296                 /* Set media status to 'Associated'. */
1297                 reg = rtwn_read_4(sc, R92C_CR);
1298                 reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1299                 rtwn_write_4(sc, R92C_CR, reg);
1300
1301                 /* Set BSSID. */
1302                 rtwn_write_4(sc, R92C_BSSID + 0, le32dec(&ni->ni_bssid[0]));
1303                 rtwn_write_4(sc, R92C_BSSID + 4, le16dec(&ni->ni_bssid[4]));
1304
1305                 if (ic->ic_curmode == IEEE80211_MODE_11B)
1306                         rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1307                 else    /* 802.11b/g */
1308                         rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1309
1310                 /* Enable Rx of data frames. */
1311                 rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1312
1313                 /* Flush all AC queues. */
1314                 rtwn_write_1(sc, R92C_TXPAUSE, 0);
1315
1316                 /* Set beacon interval. */
1317                 rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1318
1319                 /* Allow Rx from our BSSID only. */
1320                 rtwn_write_4(sc, R92C_RCR,
1321                     rtwn_read_4(sc, R92C_RCR) |
1322                     R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1323
1324                 /* Enable TSF synchronization. */
1325                 rtwn_tsf_sync_enable(sc);
1326
1327                 rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1328                 rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1329                 rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1330                 rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1331                 rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1332                 rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1333
1334                 /* Intialize rate adaptation. */
1335                 rtwn_ra_init(sc);
1336                 /* Turn link LED on. */
1337                 rtwn_set_led(sc, RTWN_LED_LINK, 1);
1338
1339                 sc->avg_pwdb = -1;      /* Reset average RSSI. */
1340                 /* Reset temperature calibration state machine. */
1341                 sc->thcal_state = 0;
1342                 sc->thcal_lctemp = 0;
1343                 /* Start periodic calibration. */
1344                 callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
1345                 break;
1346         default:
1347                 break;
1348         }
1349         RTWN_UNLOCK(sc);
1350         IEEE80211_LOCK(ic);
1351         return (rvp->newstate(vap, nstate, arg));
1352 }
1353
1354 static int
1355 rtwn_updateedca(struct ieee80211com *ic)
1356 {
1357         struct rtwn_softc *sc = ic->ic_softc;
1358         const uint16_t aci2reg[WME_NUM_AC] = {
1359                 R92C_EDCA_BE_PARAM,
1360                 R92C_EDCA_BK_PARAM,
1361                 R92C_EDCA_VI_PARAM,
1362                 R92C_EDCA_VO_PARAM
1363         };
1364         int aci, aifs, slottime;
1365
1366         IEEE80211_LOCK(ic);
1367         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1368         for (aci = 0; aci < WME_NUM_AC; aci++) {
1369                 const struct wmeParams *ac =
1370                     &ic->ic_wme.wme_chanParams.cap_wmeParams[aci];
1371                 /* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1372                 aifs = ac->wmep_aifsn * slottime + 10;
1373                 rtwn_write_4(sc, aci2reg[aci],
1374                     SM(R92C_EDCA_PARAM_TXOP, ac->wmep_txopLimit) |
1375                     SM(R92C_EDCA_PARAM_ECWMIN, ac->wmep_logcwmin) |
1376                     SM(R92C_EDCA_PARAM_ECWMAX, ac->wmep_logcwmax) |
1377                     SM(R92C_EDCA_PARAM_AIFS, aifs));
1378         }
1379         IEEE80211_UNLOCK(ic);
1380         return (0);
1381 }
1382
1383 static void
1384 rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
1385 {
1386         int pwdb;
1387
1388         /* Convert antenna signal to percentage. */
1389         if (rssi <= -100 || rssi >= 20)
1390                 pwdb = 0;
1391         else if (rssi >= 0)
1392                 pwdb = 100;
1393         else
1394                 pwdb = 100 + rssi;
1395         if (RTWN_RATE_IS_CCK(rate)) {
1396                 /* CCK gain is smaller than OFDM/MCS gain. */
1397                 pwdb += 6;
1398                 if (pwdb > 100)
1399                         pwdb = 100;
1400                 if (pwdb <= 14)
1401                         pwdb -= 4;
1402                 else if (pwdb <= 26)
1403                         pwdb -= 8;
1404                 else if (pwdb <= 34)
1405                         pwdb -= 6;
1406                 else if (pwdb <= 42)
1407                         pwdb -= 2;
1408         }
1409         if (sc->avg_pwdb == -1) /* Init. */
1410                 sc->avg_pwdb = pwdb;
1411         else if (sc->avg_pwdb < pwdb)
1412                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1413         else
1414                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1415         DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
1416 }
1417
1418 static int8_t
1419 rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1420 {
1421         static const int8_t cckoff[] = { 16, -12, -26, -46 };
1422         struct r92c_rx_phystat *phy;
1423         struct r92c_rx_cck *cck;
1424         uint8_t rpt;
1425         int8_t rssi;
1426
1427         if (RTWN_RATE_IS_CCK(rate)) {
1428                 cck = (struct r92c_rx_cck *)physt;
1429                 if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1430                         rpt = (cck->agc_rpt >> 5) & 0x3;
1431                         rssi = (cck->agc_rpt & 0x1f) << 1;
1432                 } else {
1433                         rpt = (cck->agc_rpt >> 6) & 0x3;
1434                         rssi = cck->agc_rpt & 0x3e;
1435                 }
1436                 rssi = cckoff[rpt] - rssi;
1437         } else {        /* OFDM/HT. */
1438                 phy = (struct r92c_rx_phystat *)physt;
1439                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1440         }
1441         return (rssi);
1442 }
1443
1444 static void
1445 rtwn_rx_frame(struct rtwn_softc *sc, struct r92c_rx_desc *rx_desc,
1446     struct rtwn_rx_data *rx_data, int desc_idx)
1447 {
1448         struct ieee80211com *ic = &sc->sc_ic;
1449         struct ieee80211_frame_min *wh;
1450         struct ieee80211_node *ni;
1451         struct r92c_rx_phystat *phy = NULL;
1452         uint32_t rxdw0, rxdw3;
1453         struct mbuf *m, *m1;
1454         bus_dma_segment_t segs[1];
1455         bus_addr_t physaddr;
1456         uint8_t rate;
1457         int8_t rssi = 0, nf;
1458         int infosz, nsegs, pktlen, shift, error;
1459
1460         rxdw0 = le32toh(rx_desc->rxdw0);
1461         rxdw3 = le32toh(rx_desc->rxdw3);
1462
1463         if (__predict_false(rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR))) {
1464                 /*
1465                  * This should not happen since we setup our Rx filter
1466                  * to not receive these frames.
1467                  */
1468                 counter_u64_add(ic->ic_ierrors, 1);
1469                 return;
1470         }
1471
1472         pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
1473         if (__predict_false(pktlen < sizeof(struct ieee80211_frame_ack) ||
1474             pktlen > MCLBYTES)) {
1475                 counter_u64_add(ic->ic_ierrors, 1);
1476                 return;
1477         }
1478
1479         rate = MS(rxdw3, R92C_RXDW3_RATE);
1480         infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1481         if (infosz > sizeof(struct r92c_rx_phystat))
1482                 infosz = sizeof(struct r92c_rx_phystat);
1483         shift = MS(rxdw0, R92C_RXDW0_SHIFT);
1484
1485         /* Get RSSI from PHY status descriptor if present. */
1486         if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1487                 phy = mtod(rx_data->m, struct r92c_rx_phystat *);
1488                 rssi = rtwn_get_rssi(sc, rate, phy);
1489                 /* Update our average RSSI. */
1490                 rtwn_update_avgrssi(sc, rate, rssi);
1491         }
1492
1493         DPRINTFN(5, ("Rx frame len=%d rate=%d infosz=%d shift=%d rssi=%d\n",
1494             pktlen, rate, infosz, shift, rssi));
1495
1496         m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1497         if (m1 == NULL) {
1498                 counter_u64_add(ic->ic_ierrors, 1);
1499                 return;
1500         }
1501         bus_dmamap_unload(sc->rx_ring.data_dmat, rx_data->map);
1502
1503         error = bus_dmamap_load(sc->rx_ring.data_dmat, rx_data->map,
1504              mtod(m1, void *), MCLBYTES, rtwn_dma_map_addr,
1505              &physaddr, 0);
1506         if (error != 0) {
1507                 m_freem(m1);
1508
1509                 if (bus_dmamap_load_mbuf_sg(sc->rx_ring.data_dmat,
1510                     rx_data->map, rx_data->m, segs, &nsegs, 0))
1511                         panic("%s: could not load old RX mbuf",
1512                             device_get_name(sc->sc_dev));
1513
1514                 /* Physical address may have changed. */
1515                 rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
1516                 counter_u64_add(ic->ic_ierrors, 1);
1517                 return;
1518         }
1519
1520         /* Finalize mbuf. */
1521         m = rx_data->m;
1522         rx_data->m = m1;
1523         m->m_pkthdr.len = m->m_len = pktlen + infosz + shift;
1524
1525         /* Update RX descriptor. */
1526         rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
1527
1528         /* Get ieee80211 frame header. */
1529         if (rxdw0 & R92C_RXDW0_PHYST)
1530                 m_adj(m, infosz + shift);
1531         else
1532                 m_adj(m, shift);
1533
1534         nf = -95;
1535         if (ieee80211_radiotap_active(ic)) {
1536                 struct rtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1537
1538                 tap->wr_flags = 0;
1539                 if (!(rxdw3 & R92C_RXDW3_HT)) {
1540                         tap->wr_rate = ridx2rate[rate];
1541                 } else if (rate >= 12) {        /* MCS0~15. */
1542                         /* Bit 7 set means HT MCS instead of rate. */
1543                         tap->wr_rate = 0x80 | (rate - 12);
1544                 }
1545                 tap->wr_dbm_antsignal = rssi;
1546                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1547                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1548         }
1549
1550         RTWN_UNLOCK(sc);
1551         wh = mtod(m, struct ieee80211_frame_min *);
1552         if (m->m_len >= sizeof(*wh))
1553                 ni = ieee80211_find_rxnode(ic, wh);
1554         else
1555                 ni = NULL;
1556
1557         /* Send the frame to the 802.11 layer. */
1558         if (ni != NULL) {
1559                 (void)ieee80211_input(ni, m, rssi - nf, nf);
1560                 /* Node is no longer needed. */
1561                 ieee80211_free_node(ni);
1562         } else
1563                 (void)ieee80211_input_all(ic, m, rssi - nf, nf);
1564
1565         RTWN_LOCK(sc);
1566 }
1567
1568 static int
1569 rtwn_tx(struct rtwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1570 {
1571         struct ieee80211com *ic = &sc->sc_ic;
1572         struct ieee80211vap *vap = ni->ni_vap;
1573         struct ieee80211_frame *wh;
1574         struct ieee80211_key *k = NULL;
1575         struct rtwn_tx_ring *tx_ring;
1576         struct rtwn_tx_data *data;
1577         struct r92c_tx_desc *txd;
1578         bus_dma_segment_t segs[1];
1579         uint16_t qos;
1580         uint8_t raid, type, tid, qid;
1581         int nsegs, error;
1582
1583         wh = mtod(m, struct ieee80211_frame *);
1584         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1585
1586         /* Encrypt the frame if need be. */
1587         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1588                 k = ieee80211_crypto_encap(ni, m);
1589                 if (k == NULL) {
1590                         m_freem(m);
1591                         return (ENOBUFS);
1592                 }
1593                 /* 802.11 header may have moved. */
1594                 wh = mtod(m, struct ieee80211_frame *);
1595         }
1596
1597         if (IEEE80211_QOS_HAS_SEQ(wh)) {
1598                 qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
1599                 tid = qos & IEEE80211_QOS_TID;
1600         } else {
1601                 qos = 0;
1602                 tid = 0;
1603         }
1604
1605         switch (type) {
1606         case IEEE80211_FC0_TYPE_CTL:
1607         case IEEE80211_FC0_TYPE_MGT:
1608                 qid = RTWN_VO_QUEUE;
1609                 break;
1610         default:
1611                 qid = M_WME_GETAC(m);
1612                 break;
1613         }
1614
1615         /* Grab a Tx buffer from the ring. */
1616         tx_ring = &sc->tx_ring[qid];
1617         data = &tx_ring->tx_data[tx_ring->cur];
1618         if (data->m != NULL) {
1619                 m_freem(m);
1620                 return (ENOBUFS);
1621         }
1622
1623         /* Fill Tx descriptor. */
1624         txd = &tx_ring->desc[tx_ring->cur];
1625         if (htole32(txd->txdw0) & R92C_RXDW0_OWN) {
1626                 m_freem(m);
1627                 return (ENOBUFS);
1628         }
1629         txd->txdw0 = htole32(
1630             SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len) |
1631             SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1632             R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1633         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1634                 txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1635
1636         txd->txdw1 = 0;
1637         txd->txdw4 = 0;
1638         txd->txdw5 = 0;
1639
1640         /* XXX TODO: rate control; implement low-rate for EAPOL */
1641         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1642             type == IEEE80211_FC0_TYPE_DATA) {
1643                 if (ic->ic_curmode == IEEE80211_MODE_11B)
1644                         raid = R92C_RAID_11B;
1645                 else
1646                         raid = R92C_RAID_11BG;
1647                 txd->txdw1 |= htole32(
1648                     SM(R92C_TXDW1_MACID, RTWN_MACID_BSS) |
1649                     SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1650                     SM(R92C_TXDW1_RAID, raid) |
1651                     R92C_TXDW1_AGGBK);
1652
1653                 if (ic->ic_flags & IEEE80211_F_USEPROT) {
1654                         if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1655                                 txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1656                                     R92C_TXDW4_HWRTSEN);
1657                         } else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1658                                 txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1659                                     R92C_TXDW4_HWRTSEN);
1660                         }
1661                 }
1662
1663                 /* XXX TODO: implement rate control */
1664
1665                 /* Send RTS at OFDM24. */
1666                 txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
1667                     RTWN_RIDX_OFDM24));
1668                 txd->txdw5 |= htole32(SM(R92C_TXDW5_RTSRATE_FBLIMIT, 0xf));
1669                 /* Send data at OFDM54. */
1670                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE,
1671                     RTWN_RIDX_OFDM54));
1672                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE_FBLIMIT, 0x1f));
1673
1674         } else {
1675                 txd->txdw1 |= htole32(
1676                     SM(R92C_TXDW1_MACID, 0) |
1677                     SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1678                     SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1679
1680                 /* Force CCK1. */
1681                 txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1682                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, RTWN_RIDX_CCK1));
1683         }
1684         /* Set sequence number (already little endian). */
1685         txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
1686
1687         if (!qos) {
1688                 /* Use HW sequence numbering for non-QoS frames. */
1689                 txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1690                 txd->txdseq |= htole16(0x8000);
1691         } else
1692                 txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1693
1694         error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map, m, segs,
1695             &nsegs, BUS_DMA_NOWAIT);
1696         if (error != 0 && error != EFBIG) {
1697                 device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", error);
1698                 m_freem(m);
1699                 return (error);
1700         }
1701         if (error != 0) {
1702                 struct mbuf *mnew;
1703
1704                 mnew = m_defrag(m, M_NOWAIT);
1705                 if (mnew == NULL) {
1706                         device_printf(sc->sc_dev,
1707                             "can't defragment mbuf\n");
1708                         m_freem(m);
1709                         return (ENOBUFS);
1710                 }
1711                 m = mnew;
1712
1713                 error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map,
1714                     m, segs, &nsegs, BUS_DMA_NOWAIT);
1715                 if (error != 0) {
1716                         device_printf(sc->sc_dev,
1717                             "can't map mbuf (error %d)\n", error);
1718                         m_freem(m);
1719                         return (error);
1720                 }
1721         }
1722
1723         txd->txbufaddr = htole32(segs[0].ds_addr);
1724         txd->txbufsize = htole16(m->m_pkthdr.len);
1725         bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
1726             BUS_SPACE_BARRIER_WRITE);
1727         txd->txdw0 |= htole32(R92C_TXDW0_OWN);
1728
1729         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
1730             BUS_DMASYNC_POSTWRITE);
1731         bus_dmamap_sync(tx_ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1732
1733         data->m = m;
1734         data->ni = ni;
1735
1736         if (ieee80211_radiotap_active_vap(vap)) {
1737                 struct rtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1738
1739                 tap->wt_flags = 0;
1740                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1741                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1742
1743                 ieee80211_radiotap_tx(vap, m);
1744         }
1745
1746         tx_ring->cur = (tx_ring->cur + 1) % RTWN_TX_LIST_COUNT;
1747         tx_ring->queued++;
1748
1749         if (tx_ring->queued >= (RTWN_TX_LIST_COUNT - 1))
1750                 sc->qfullmsk |= (1 << qid);
1751
1752         /* Kick TX. */
1753         rtwn_write_2(sc, R92C_PCIE_CTRL_REG, (1 << qid));
1754         return (0);
1755 }
1756
1757 static void
1758 rtwn_tx_done(struct rtwn_softc *sc, int qid)
1759 {
1760         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
1761         struct rtwn_tx_data *tx_data;
1762         struct r92c_tx_desc *tx_desc;
1763         int i;
1764
1765         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
1766             BUS_DMASYNC_POSTREAD);
1767
1768         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
1769                 tx_data = &tx_ring->tx_data[i];
1770                 if (tx_data->m == NULL)
1771                         continue;
1772
1773                 tx_desc = &tx_ring->desc[i];
1774                 if (le32toh(tx_desc->txdw0) & R92C_TXDW0_OWN)
1775                         continue;
1776
1777                 /* Unmap and free mbuf. */
1778                 bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
1779                     BUS_DMASYNC_POSTWRITE);
1780                 bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
1781
1782                 /*
1783                  * XXX TODO: figure out whether the transmit succeeded or not.
1784                  * .. and then notify rate control.
1785                  */
1786                 ieee80211_tx_complete(tx_data->ni, tx_data->m, 0);
1787                 tx_data->ni = NULL;
1788                 tx_data->m = NULL;
1789
1790                 if (--tx_ring->queued)
1791                         sc->sc_tx_timer = 5;
1792                 else
1793                         sc->sc_tx_timer = 0;
1794         }
1795
1796         if (tx_ring->queued < (RTWN_TX_LIST_COUNT - 1))
1797                 sc->qfullmsk &= ~(1 << qid);
1798         rtwn_start(sc);
1799 }
1800
1801 static int
1802 rtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1803     const struct ieee80211_bpf_params *params)
1804 {
1805         struct ieee80211com *ic = ni->ni_ic;
1806         struct rtwn_softc *sc = ic->ic_softc;
1807
1808         RTWN_LOCK(sc);
1809
1810         /* Prevent management frames from being sent if we're not ready. */
1811         if (!(sc->sc_flags & RTWN_RUNNING)) {
1812                 RTWN_UNLOCK(sc);
1813                 m_freem(m);
1814                 return (ENETDOWN);
1815         }
1816
1817         if (rtwn_tx(sc, m, ni) != 0) {
1818                 RTWN_UNLOCK(sc);
1819                 return (EIO);
1820         }
1821         sc->sc_tx_timer = 5;
1822         RTWN_UNLOCK(sc);
1823         return (0);
1824 }
1825
1826 static int
1827 rtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
1828 {
1829         struct rtwn_softc *sc = ic->ic_softc;
1830         int error;
1831
1832         RTWN_LOCK(sc);
1833         if ((sc->sc_flags & RTWN_RUNNING) == 0) {
1834                 RTWN_UNLOCK(sc);
1835                 return (ENXIO);
1836         }
1837         error = mbufq_enqueue(&sc->sc_snd, m);
1838         if (error) {
1839                 RTWN_UNLOCK(sc);
1840                 return (error);
1841         }
1842         rtwn_start(sc);
1843         RTWN_UNLOCK(sc);
1844         return (0);
1845 }
1846
1847 static void
1848 rtwn_parent(struct ieee80211com *ic)
1849 {
1850         struct rtwn_softc *sc = ic->ic_softc;
1851         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1852
1853         if (ic->ic_nrunning > 0) {
1854                 if (rtwn_init(sc) == 0)
1855                         ieee80211_start_all(ic);
1856                 else
1857                         ieee80211_stop(vap);
1858         } else
1859                 rtwn_stop(sc);
1860 }
1861
1862 static void
1863 rtwn_start(struct rtwn_softc *sc)
1864 {
1865         struct ieee80211_node *ni;
1866         struct mbuf *m;
1867
1868         RTWN_LOCK_ASSERT(sc);
1869
1870         if ((sc->sc_flags & RTWN_RUNNING) == 0)
1871                 return;
1872
1873         while (sc->qfullmsk == 0 && (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
1874                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1875                 if (rtwn_tx(sc, m, ni) != 0) {
1876                         if_inc_counter(ni->ni_vap->iv_ifp,
1877                             IFCOUNTER_OERRORS, 1);
1878                         ieee80211_free_node(ni);
1879                         continue;
1880                 }
1881                 sc->sc_tx_timer = 5;
1882         }
1883 }
1884
1885 static void
1886 rtwn_watchdog(void *arg)
1887 {
1888         struct rtwn_softc *sc = arg;
1889         struct ieee80211com *ic = &sc->sc_ic;
1890
1891         RTWN_LOCK_ASSERT(sc);
1892
1893         KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
1894
1895         if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
1896                 ic_printf(ic, "device timeout\n");
1897                 ieee80211_restart_all(ic);
1898                 return;
1899         }
1900         callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
1901 }
1902
1903 static int
1904 rtwn_power_on(struct rtwn_softc *sc)
1905 {
1906         uint32_t reg;
1907         int ntries;
1908
1909         /* Wait for autoload done bit. */
1910         for (ntries = 0; ntries < 1000; ntries++) {
1911                 if (rtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1912                         break;
1913                 DELAY(5);
1914         }
1915         if (ntries == 1000) {
1916                 device_printf(sc->sc_dev,
1917                     "timeout waiting for chip autoload\n");
1918                 return (ETIMEDOUT);
1919         }
1920
1921         /* Unlock ISO/CLK/Power control register. */
1922         rtwn_write_1(sc, R92C_RSV_CTRL, 0);
1923
1924         /* TODO: check if we need this for 8188CE */
1925         if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1926                 /* bt coex */
1927                 reg = rtwn_read_4(sc, R92C_APS_FSMCO);
1928                 reg |= (R92C_APS_FSMCO_SOP_ABG |
1929                         R92C_APS_FSMCO_SOP_AMB |
1930                         R92C_APS_FSMCO_XOP_BTCK);
1931                 rtwn_write_4(sc, R92C_APS_FSMCO, reg);
1932         }
1933
1934         /* Move SPS into PWM mode. */
1935         rtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1936
1937         /* Set low byte to 0x0f, leave others unchanged. */
1938         rtwn_write_4(sc, R92C_AFE_XTAL_CTRL,
1939             (rtwn_read_4(sc, R92C_AFE_XTAL_CTRL) & 0xffffff00) | 0x0f);
1940
1941         /* TODO: check if we need this for 8188CE */
1942         if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1943                 /* bt coex */
1944                 reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL);
1945                 reg &= (~0x00024800); /* XXX magic from linux */
1946                 rtwn_write_4(sc, R92C_AFE_XTAL_CTRL, reg);
1947         }
1948
1949         rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1950           (rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & 0xff) |
1951           R92C_SYS_ISO_CTRL_PWC_EV12V | R92C_SYS_ISO_CTRL_DIOR);
1952         DELAY(200);
1953
1954         /* TODO: linux does additional btcoex stuff here */
1955
1956         /* Auto enable WLAN. */
1957         rtwn_write_2(sc, R92C_APS_FSMCO,
1958             rtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1959         for (ntries = 0; ntries < 1000; ntries++) {
1960                 if (!(rtwn_read_2(sc, R92C_APS_FSMCO) &
1961                     R92C_APS_FSMCO_APFM_ONMAC))
1962                         break;
1963                 DELAY(5);
1964         }
1965         if (ntries == 1000) {
1966                 device_printf(sc->sc_dev, "timeout waiting for MAC auto ON\n");
1967                 return (ETIMEDOUT);
1968         }
1969
1970         /* Enable radio, GPIO and LED functions. */
1971         rtwn_write_2(sc, R92C_APS_FSMCO,
1972             R92C_APS_FSMCO_AFSM_PCIE |
1973             R92C_APS_FSMCO_PDN_EN |
1974             R92C_APS_FSMCO_PFM_ALDN);
1975         /* Release RF digital isolation. */
1976         rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1977             rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1978
1979         if (sc->chip & RTWN_CHIP_92C)
1980                 rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x77);
1981         else
1982                 rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x22);
1983
1984         rtwn_write_4(sc, R92C_INT_MIG, 0);
1985
1986         if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1987                 /* bt coex */
1988                 reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL + 2);
1989                 reg &= 0xfd; /* XXX magic from linux */
1990                 rtwn_write_4(sc, R92C_AFE_XTAL_CTRL + 2, reg);
1991         }
1992
1993         rtwn_write_1(sc, R92C_GPIO_MUXCFG,
1994             rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_RFKILL);
1995
1996         reg = rtwn_read_1(sc, R92C_GPIO_IO_SEL);
1997         if (!(reg & R92C_GPIO_IO_SEL_RFKILL)) {
1998                 device_printf(sc->sc_dev,
1999                     "radio is disabled by hardware switch\n");
2000                 return (EPERM);
2001         }
2002
2003         /* Initialize MAC. */
2004         reg = rtwn_read_1(sc, R92C_APSD_CTRL);
2005         rtwn_write_1(sc, R92C_APSD_CTRL,
2006             rtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2007         for (ntries = 0; ntries < 200; ntries++) {
2008                 if (!(rtwn_read_1(sc, R92C_APSD_CTRL) &
2009                     R92C_APSD_CTRL_OFF_STATUS))
2010                         break;
2011                 DELAY(500);
2012         }
2013         if (ntries == 200) {
2014                 device_printf(sc->sc_dev,
2015                     "timeout waiting for MAC initialization\n");
2016                 return (ETIMEDOUT);
2017         }
2018
2019         /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2020         reg = rtwn_read_2(sc, R92C_CR);
2021         reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2022             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2023             R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2024             R92C_CR_ENSEC;
2025         rtwn_write_2(sc, R92C_CR, reg);
2026
2027         rtwn_write_1(sc, 0xfe10, 0x19);
2028
2029         return (0);
2030 }
2031
2032 static int
2033 rtwn_llt_init(struct rtwn_softc *sc)
2034 {
2035         int i, error;
2036
2037         /* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
2038         for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
2039                 if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
2040                         return (error);
2041         }
2042         /* NB: 0xff indicates end-of-list. */
2043         if ((error = rtwn_llt_write(sc, i, 0xff)) != 0)
2044                 return (error);
2045         /*
2046          * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
2047          * as ring buffer.
2048          */
2049         for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
2050                 if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
2051                         return (error);
2052         }
2053         /* Make the last page point to the beginning of the ring buffer. */
2054         error = rtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
2055         return (error);
2056 }
2057
2058 static void
2059 rtwn_fw_reset(struct rtwn_softc *sc)
2060 {
2061         uint16_t reg;
2062         int ntries;
2063
2064         /* Tell 8051 to reset itself. */
2065         rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2066
2067         /* Wait until 8051 resets by itself. */
2068         for (ntries = 0; ntries < 100; ntries++) {
2069                 reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
2070                 if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2071                         goto sleep;
2072                 DELAY(50);
2073         }
2074         /* Force 8051 reset. */
2075         rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2076 sleep:
2077         /*
2078          * We must sleep for one second to let the firmware settle.
2079          * Accessing registers too early will hang the whole system.
2080          */
2081         if (msleep(&reg, &sc->sc_mtx, 0, "rtwnrst", hz)) {
2082                 device_printf(sc->sc_dev, "timeout waiting for firmware "
2083                     "initialization to complete\n");
2084         }
2085 }
2086
2087 static void
2088 rtwn_fw_loadpage(struct rtwn_softc *sc, int page, const uint8_t *buf, int len)
2089 {
2090         uint32_t reg;
2091         int off, mlen, i;
2092
2093         reg = rtwn_read_4(sc, R92C_MCUFWDL);
2094         reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2095         rtwn_write_4(sc, R92C_MCUFWDL, reg);
2096
2097         DELAY(5);
2098
2099         off = R92C_FW_START_ADDR;
2100         while (len > 0) {
2101                 if (len > 196)
2102                         mlen = 196;
2103                 else if (len > 4)
2104                         mlen = 4;
2105                 else
2106                         mlen = 1;
2107                 for (i = 0; i < mlen; i++)
2108                         rtwn_write_1(sc, off++, buf[i]);
2109                 buf += mlen;
2110                 len -= mlen;
2111         }
2112 }
2113
2114 static int
2115 rtwn_load_firmware(struct rtwn_softc *sc)
2116 {
2117         const struct firmware *fw;
2118         const struct r92c_fw_hdr *hdr;
2119         const char *name;
2120         const u_char *ptr;
2121         size_t len;
2122         uint32_t reg;
2123         int mlen, ntries, page, error = 0;
2124
2125         /* Read firmware image from the filesystem. */
2126         if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
2127             RTWN_CHIP_UMC_A_CUT)
2128                 name = "rtwn-rtl8192cfwU";
2129         else
2130                 name = "rtwn-rtl8192cfwU_B";
2131         RTWN_UNLOCK(sc);
2132         fw = firmware_get(name);
2133         RTWN_LOCK(sc);
2134         if (fw == NULL) {
2135                 device_printf(sc->sc_dev,
2136                     "could not read firmware %s\n", name);
2137                 return (ENOENT);
2138         }
2139         len = fw->datasize;
2140         if (len < sizeof(*hdr)) {
2141                 device_printf(sc->sc_dev, "firmware too short\n");
2142                 error = EINVAL;
2143                 goto fail;
2144         }
2145         ptr = fw->data;
2146         hdr = (const struct r92c_fw_hdr *)ptr;
2147         /* Check if there is a valid FW header and skip it. */
2148         if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2149             (le16toh(hdr->signature) >> 4) == 0x92c) {
2150                 DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
2151                     le16toh(hdr->version), le16toh(hdr->subversion),
2152                     hdr->month, hdr->date, hdr->hour, hdr->minute));
2153                 ptr += sizeof(*hdr);
2154                 len -= sizeof(*hdr);
2155         }
2156
2157         if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
2158                 rtwn_fw_reset(sc);
2159
2160         /* Enable FW download. */
2161         rtwn_write_2(sc, R92C_SYS_FUNC_EN,
2162             rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2163             R92C_SYS_FUNC_EN_CPUEN);
2164         rtwn_write_1(sc, R92C_MCUFWDL,
2165             rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2166         rtwn_write_1(sc, R92C_MCUFWDL + 2,
2167             rtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2168
2169         /* Reset the FWDL checksum. */
2170         rtwn_write_1(sc, R92C_MCUFWDL,
2171             rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2172
2173         for (page = 0; len > 0; page++) {
2174                 mlen = MIN(len, R92C_FW_PAGE_SIZE);
2175                 rtwn_fw_loadpage(sc, page, ptr, mlen);
2176                 ptr += mlen;
2177                 len -= mlen;
2178         }
2179
2180         /* Disable FW download. */
2181         rtwn_write_1(sc, R92C_MCUFWDL,
2182             rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2183         rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2184
2185         /* Wait for checksum report. */
2186         for (ntries = 0; ntries < 1000; ntries++) {
2187                 if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2188                         break;
2189                 DELAY(5);
2190         }
2191         if (ntries == 1000) {
2192                 device_printf(sc->sc_dev,
2193                     "timeout waiting for checksum report\n");
2194                 error = ETIMEDOUT;
2195                 goto fail;
2196         }
2197
2198         reg = rtwn_read_4(sc, R92C_MCUFWDL);
2199         reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2200         rtwn_write_4(sc, R92C_MCUFWDL, reg);
2201         /* Wait for firmware readiness. */
2202         for (ntries = 0; ntries < 2000; ntries++) {
2203                 if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2204                         break;
2205                 DELAY(50);
2206         }
2207         if (ntries == 2000) {
2208                 device_printf(sc->sc_dev,
2209                     "timeout waiting for firmware readiness\n");
2210                 error = ETIMEDOUT;
2211                 goto fail;
2212         }
2213 fail:
2214         firmware_put(fw, FIRMWARE_UNLOAD);
2215         return (error);
2216 }
2217
2218 static int
2219 rtwn_dma_init(struct rtwn_softc *sc)
2220 {
2221         uint32_t reg;
2222         int error;
2223
2224         /* Initialize LLT table. */
2225         error = rtwn_llt_init(sc);
2226         if (error != 0)
2227                 return error;
2228
2229         /* Set number of pages for normal priority queue. */
2230         rtwn_write_2(sc, R92C_RQPN_NPQ, 0);
2231         rtwn_write_4(sc, R92C_RQPN,
2232             /* Set number of pages for public queue. */
2233             SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2234             /* Set number of pages for high priority queue. */
2235             SM(R92C_RQPN_HPQ, R92C_HPQ_NPAGES) |
2236             /* Set number of pages for low priority queue. */
2237             SM(R92C_RQPN_LPQ, R92C_LPQ_NPAGES) |
2238             /* Load values. */
2239             R92C_RQPN_LD);
2240
2241         rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2242         rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2243         rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2244         rtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2245         rtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2246
2247         reg = rtwn_read_2(sc, R92C_TRXDMA_CTRL);
2248         reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2249         reg |= 0xF771;
2250         rtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2251
2252         rtwn_write_4(sc, R92C_TCR, R92C_TCR_CFENDFORM | (1 << 12) | (1 << 13));
2253
2254         /* Configure Tx DMA. */
2255         rtwn_write_4(sc, R92C_BKQ_DESA, sc->tx_ring[RTWN_BK_QUEUE].paddr);
2256         rtwn_write_4(sc, R92C_BEQ_DESA, sc->tx_ring[RTWN_BE_QUEUE].paddr);
2257         rtwn_write_4(sc, R92C_VIQ_DESA, sc->tx_ring[RTWN_VI_QUEUE].paddr);
2258         rtwn_write_4(sc, R92C_VOQ_DESA, sc->tx_ring[RTWN_VO_QUEUE].paddr);
2259         rtwn_write_4(sc, R92C_BCNQ_DESA, sc->tx_ring[RTWN_BEACON_QUEUE].paddr);
2260         rtwn_write_4(sc, R92C_MGQ_DESA, sc->tx_ring[RTWN_MGNT_QUEUE].paddr);
2261         rtwn_write_4(sc, R92C_HQ_DESA, sc->tx_ring[RTWN_HIGH_QUEUE].paddr);
2262
2263         /* Configure Rx DMA. */
2264         rtwn_write_4(sc, R92C_RX_DESA, sc->rx_ring.paddr);
2265
2266         /* Set Tx/Rx transfer page boundary. */
2267         rtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2268
2269         /* Set Tx/Rx transfer page size. */
2270         rtwn_write_1(sc, R92C_PBP,
2271             SM(R92C_PBP_PSRX, R92C_PBP_128) |
2272             SM(R92C_PBP_PSTX, R92C_PBP_128));
2273         return (0);
2274 }
2275
2276 static void
2277 rtwn_mac_init(struct rtwn_softc *sc)
2278 {
2279         int i;
2280
2281         /* Write MAC initialization values. */
2282         for (i = 0; i < nitems(rtl8192ce_mac); i++)
2283                 rtwn_write_1(sc, rtl8192ce_mac[i].reg, rtl8192ce_mac[i].val);
2284 }
2285
2286 static void
2287 rtwn_bb_init(struct rtwn_softc *sc)
2288 {
2289         const struct rtwn_bb_prog *prog;
2290         uint32_t reg;
2291         int i;
2292
2293         /* Enable BB and RF. */
2294         rtwn_write_2(sc, R92C_SYS_FUNC_EN,
2295             rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2296             R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2297             R92C_SYS_FUNC_EN_DIO_RF);
2298
2299         rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2300
2301         rtwn_write_1(sc, R92C_RF_CTRL,
2302             R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2303
2304         rtwn_write_1(sc, R92C_SYS_FUNC_EN,
2305             R92C_SYS_FUNC_EN_DIO_PCIE | R92C_SYS_FUNC_EN_PCIEA |
2306             R92C_SYS_FUNC_EN_PPLL | R92C_SYS_FUNC_EN_BB_GLB_RST |
2307             R92C_SYS_FUNC_EN_BBRSTB);
2308
2309         rtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2310
2311         rtwn_write_4(sc, R92C_LEDCFG0,
2312             rtwn_read_4(sc, R92C_LEDCFG0) | 0x00800000);
2313
2314         /* Select BB programming. */
2315         prog = (sc->chip & RTWN_CHIP_92C) ?
2316             &rtl8192ce_bb_prog_2t : &rtl8192ce_bb_prog_1t;
2317
2318         /* Write BB initialization values. */
2319         for (i = 0; i < prog->count; i++) {
2320                 rtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2321                 DELAY(1);
2322         }
2323
2324         if (sc->chip & RTWN_CHIP_92C_1T2R) {
2325                 /* 8192C 1T only configuration. */
2326                 reg = rtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2327                 reg = (reg & ~0x00000003) | 0x2;
2328                 rtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2329
2330                 reg = rtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2331                 reg = (reg & ~0x00300033) | 0x00200022;
2332                 rtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2333
2334                 reg = rtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2335                 reg = (reg & ~0xff000000) | 0x45 << 24;
2336                 rtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2337
2338                 reg = rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2339                 reg = (reg & ~0x000000ff) | 0x23;
2340                 rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2341
2342                 reg = rtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2343                 reg = (reg & ~0x00000030) | 1 << 4;
2344                 rtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2345
2346                 reg = rtwn_bb_read(sc, 0xe74);
2347                 reg = (reg & ~0x0c000000) | 2 << 26;
2348                 rtwn_bb_write(sc, 0xe74, reg);
2349                 reg = rtwn_bb_read(sc, 0xe78);
2350                 reg = (reg & ~0x0c000000) | 2 << 26;
2351                 rtwn_bb_write(sc, 0xe78, reg);
2352                 reg = rtwn_bb_read(sc, 0xe7c);
2353                 reg = (reg & ~0x0c000000) | 2 << 26;
2354                 rtwn_bb_write(sc, 0xe7c, reg);
2355                 reg = rtwn_bb_read(sc, 0xe80);
2356                 reg = (reg & ~0x0c000000) | 2 << 26;
2357                 rtwn_bb_write(sc, 0xe80, reg);
2358                 reg = rtwn_bb_read(sc, 0xe88);
2359                 reg = (reg & ~0x0c000000) | 2 << 26;
2360                 rtwn_bb_write(sc, 0xe88, reg);
2361         }
2362
2363         /* Write AGC values. */
2364         for (i = 0; i < prog->agccount; i++) {
2365                 rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2366                     prog->agcvals[i]);
2367                 DELAY(1);
2368         }
2369
2370         if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2371             R92C_HSSI_PARAM2_CCK_HIPWR)
2372                 sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
2373 }
2374
2375 static void
2376 rtwn_rf_init(struct rtwn_softc *sc)
2377 {
2378         const struct rtwn_rf_prog *prog;
2379         uint32_t reg, type;
2380         int i, j, idx, off;
2381
2382         /* Select RF programming based on board type. */
2383         if (!(sc->chip & RTWN_CHIP_92C)) {
2384                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2385                         prog = rtl8188ce_rf_prog;
2386                 else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2387                         prog = rtl8188ru_rf_prog;
2388                 else
2389                         prog = rtl8188cu_rf_prog;
2390         } else
2391                 prog = rtl8192ce_rf_prog;
2392
2393         for (i = 0; i < sc->nrxchains; i++) {
2394                 /* Save RF_ENV control type. */
2395                 idx = i / 2;
2396                 off = (i % 2) * 16;
2397                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2398                 type = (reg >> off) & 0x10;
2399
2400                 /* Set RF_ENV enable. */
2401                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2402                 reg |= 0x100000;
2403                 rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2404                 DELAY(1);
2405                 /* Set RF_ENV output high. */
2406                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2407                 reg |= 0x10;
2408                 rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2409                 DELAY(1);
2410                 /* Set address and data lengths of RF registers. */
2411                 reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2412                 reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2413                 rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2414                 DELAY(1);
2415                 reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2416                 reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2417                 rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2418                 DELAY(1);
2419
2420                 /* Write RF initialization values for this chain. */
2421                 for (j = 0; j < prog[i].count; j++) {
2422                         if (prog[i].regs[j] >= 0xf9 &&
2423                             prog[i].regs[j] <= 0xfe) {
2424                                 /*
2425                                  * These are fake RF registers offsets that
2426                                  * indicate a delay is required.
2427                                  */
2428                                 DELAY(50);
2429                                 continue;
2430                         }
2431                         rtwn_rf_write(sc, i, prog[i].regs[j],
2432                             prog[i].vals[j]);
2433                         DELAY(1);
2434                 }
2435
2436                 /* Restore RF_ENV control type. */
2437                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2438                 reg &= ~(0x10 << off) | (type << off);
2439                 rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2440
2441                 /* Cache RF register CHNLBW. */
2442                 sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2443         }
2444
2445         if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
2446             RTWN_CHIP_UMC_A_CUT) {
2447                 rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2448                 rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2449         }
2450 }
2451
2452 static void
2453 rtwn_cam_init(struct rtwn_softc *sc)
2454 {
2455         /* Invalidate all CAM entries. */
2456         rtwn_write_4(sc, R92C_CAMCMD,
2457             R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2458 }
2459
2460 static void
2461 rtwn_pa_bias_init(struct rtwn_softc *sc)
2462 {
2463         uint8_t reg;
2464         int i;
2465
2466         for (i = 0; i < sc->nrxchains; i++) {
2467                 if (sc->pa_setting & (1 << i))
2468                         continue;
2469                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2470                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2471                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2472                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2473         }
2474         if (!(sc->pa_setting & 0x10)) {
2475                 reg = rtwn_read_1(sc, 0x16);
2476                 reg = (reg & ~0xf0) | 0x90;
2477                 rtwn_write_1(sc, 0x16, reg);
2478         }
2479 }
2480
2481 static void
2482 rtwn_rxfilter_init(struct rtwn_softc *sc)
2483 {
2484         /* Initialize Rx filter. */
2485         /* TODO: use better filter for monitor mode. */
2486         rtwn_write_4(sc, R92C_RCR,
2487             R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2488             R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2489             R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2490         /* Accept all multicast frames. */
2491         rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2492         rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2493         /* Accept all management frames. */
2494         rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2495         /* Reject all control frames. */
2496         rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2497         /* Accept all data frames. */
2498         rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2499 }
2500
2501 static void
2502 rtwn_edca_init(struct rtwn_softc *sc)
2503 {
2504
2505         rtwn_write_2(sc, R92C_SPEC_SIFS, 0x1010);
2506         rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x1010);
2507         rtwn_write_2(sc, R92C_SIFS_CCK, 0x1010);
2508         rtwn_write_2(sc, R92C_SIFS_OFDM, 0x0e0e);
2509         rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2510         rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2511         rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4322);
2512         rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3222);
2513 }
2514
2515 static void
2516 rtwn_write_txpower(struct rtwn_softc *sc, int chain,
2517     uint16_t power[RTWN_RIDX_COUNT])
2518 {
2519         uint32_t reg;
2520
2521         /* Write per-CCK rate Tx power. */
2522         if (chain == 0) {
2523                 reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2524                 reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2525                 rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2526                 reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2527                 reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2528                 reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2529                 reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2530                 rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2531         } else {
2532                 reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2533                 reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2534                 reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2535                 reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2536                 rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2537                 reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2538                 reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2539                 rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2540         }
2541         /* Write per-OFDM rate Tx power. */
2542         rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2543             SM(R92C_TXAGC_RATE06, power[ 4]) |
2544             SM(R92C_TXAGC_RATE09, power[ 5]) |
2545             SM(R92C_TXAGC_RATE12, power[ 6]) |
2546             SM(R92C_TXAGC_RATE18, power[ 7]));
2547         rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2548             SM(R92C_TXAGC_RATE24, power[ 8]) |
2549             SM(R92C_TXAGC_RATE36, power[ 9]) |
2550             SM(R92C_TXAGC_RATE48, power[10]) |
2551             SM(R92C_TXAGC_RATE54, power[11]));
2552         /* Write per-MCS Tx power. */
2553         rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2554             SM(R92C_TXAGC_MCS00,  power[12]) |
2555             SM(R92C_TXAGC_MCS01,  power[13]) |
2556             SM(R92C_TXAGC_MCS02,  power[14]) |
2557             SM(R92C_TXAGC_MCS03,  power[15]));
2558         rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2559             SM(R92C_TXAGC_MCS04,  power[16]) |
2560             SM(R92C_TXAGC_MCS05,  power[17]) |
2561             SM(R92C_TXAGC_MCS06,  power[18]) |
2562             SM(R92C_TXAGC_MCS07,  power[19]));
2563         rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2564             SM(R92C_TXAGC_MCS08,  power[20]) |
2565             SM(R92C_TXAGC_MCS09,  power[21]) |
2566             SM(R92C_TXAGC_MCS10,  power[22]) |
2567             SM(R92C_TXAGC_MCS11,  power[23]));
2568         rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2569             SM(R92C_TXAGC_MCS12,  power[24]) |
2570             SM(R92C_TXAGC_MCS13,  power[25]) |
2571             SM(R92C_TXAGC_MCS14,  power[26]) |
2572             SM(R92C_TXAGC_MCS15,  power[27]));
2573 }
2574
2575 static void
2576 rtwn_get_txpower(struct rtwn_softc *sc, int chain,
2577     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2578     uint16_t power[RTWN_RIDX_COUNT])
2579 {
2580         struct ieee80211com *ic = &sc->sc_ic;
2581         struct r92c_rom *rom = &sc->rom;
2582         uint16_t cckpow, ofdmpow, htpow, diff, max;
2583         const struct rtwn_txpwr *base;
2584         int ridx, chan, group;
2585
2586         /* Determine channel group. */
2587         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
2588         if (chan <= 3)
2589                 group = 0;
2590         else if (chan <= 9)
2591                 group = 1;
2592         else
2593                 group = 2;
2594
2595         /* Get original Tx power based on board type and RF chain. */
2596         if (!(sc->chip & RTWN_CHIP_92C)) {
2597                 if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2598                         base = &rtl8188ru_txagc[chain];
2599                 else
2600                         base = &rtl8192cu_txagc[chain];
2601         } else
2602                 base = &rtl8192cu_txagc[chain];
2603
2604         memset(power, 0, RTWN_RIDX_COUNT * sizeof(power[0]));
2605         if (sc->regulatory == 0) {
2606                 for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
2607                         power[ridx] = base->pwr[0][ridx];
2608         }
2609         for (ridx = RTWN_RIDX_OFDM6; ridx < RTWN_RIDX_COUNT; ridx++) {
2610                 if (sc->regulatory == 3) {
2611                         power[ridx] = base->pwr[0][ridx];
2612                         /* Apply vendor limits. */
2613                         if (extc != NULL)
2614                                 max = rom->ht40_max_pwr[group];
2615                         else
2616                                 max = rom->ht20_max_pwr[group];
2617                         max = (max >> (chain * 4)) & 0xf;
2618                         if (power[ridx] > max)
2619                                 power[ridx] = max;
2620                 } else if (sc->regulatory == 1) {
2621                         if (extc == NULL)
2622                                 power[ridx] = base->pwr[group][ridx];
2623                 } else if (sc->regulatory != 2)
2624                         power[ridx] = base->pwr[0][ridx];
2625         }
2626
2627         /* Compute per-CCK rate Tx power. */
2628         cckpow = rom->cck_tx_pwr[chain][group];
2629         for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2630                 power[ridx] += cckpow;
2631                 if (power[ridx] > R92C_MAX_TX_PWR)
2632                         power[ridx] = R92C_MAX_TX_PWR;
2633         }
2634
2635         htpow = rom->ht40_1s_tx_pwr[chain][group];
2636         if (sc->ntxchains > 1) {
2637                 /* Apply reduction for 2 spatial streams. */
2638                 diff = rom->ht40_2s_tx_pwr_diff[group];
2639                 diff = (diff >> (chain * 4)) & 0xf;
2640                 htpow = (htpow > diff) ? htpow - diff : 0;
2641         }
2642
2643         /* Compute per-OFDM rate Tx power. */
2644         diff = rom->ofdm_tx_pwr_diff[group];
2645         diff = (diff >> (chain * 4)) & 0xf;
2646         ofdmpow = htpow + diff; /* HT->OFDM correction. */
2647         for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2648                 power[ridx] += ofdmpow;
2649                 if (power[ridx] > R92C_MAX_TX_PWR)
2650                         power[ridx] = R92C_MAX_TX_PWR;
2651         }
2652
2653         /* Compute per-MCS Tx power. */
2654         if (extc == NULL) {
2655                 diff = rom->ht20_tx_pwr_diff[group];
2656                 diff = (diff >> (chain * 4)) & 0xf;
2657                 htpow += diff;  /* HT40->HT20 correction. */
2658         }
2659         for (ridx = RTWN_RIDX_MCS0; ridx <= RTWN_RIDX_MCS15; ridx++) {
2660                 power[ridx] += htpow;
2661                 if (power[ridx] > R92C_MAX_TX_PWR)
2662                         power[ridx] = R92C_MAX_TX_PWR;
2663         }
2664 #ifdef RTWN_DEBUG
2665         if (sc->sc_debug >= 4) {
2666                 /* Dump per-rate Tx power values. */
2667                 printf("Tx power for chain %d:\n", chain);
2668                 for (ridx = RTWN_RIDX_CCK1; ridx < RTWN_RIDX_COUNT; ridx++)
2669                         printf("Rate %d = %u\n", ridx, power[ridx]);
2670         }
2671 #endif
2672 }
2673
2674 static void
2675 rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
2676     struct ieee80211_channel *extc)
2677 {
2678         uint16_t power[RTWN_RIDX_COUNT];
2679         int i;
2680
2681         for (i = 0; i < sc->ntxchains; i++) {
2682                 /* Compute per-rate Tx power values. */
2683                 rtwn_get_txpower(sc, i, c, extc, power);
2684                 /* Write per-rate Tx power values to hardware. */
2685                 rtwn_write_txpower(sc, i, power);
2686         }
2687 }
2688
2689 static void
2690 rtwn_set_rx_bssid_all(struct rtwn_softc *sc, int enable)
2691 {
2692         uint32_t reg;
2693
2694         reg = rtwn_read_4(sc, R92C_RCR);
2695         if (enable)
2696                 reg &= ~R92C_RCR_CBSSID_BCN;
2697         else
2698                 reg |= R92C_RCR_CBSSID_BCN;
2699         rtwn_write_4(sc, R92C_RCR, reg);
2700 }
2701
2702 static void
2703 rtwn_set_gain(struct rtwn_softc *sc, uint8_t gain)
2704 {
2705         uint32_t reg;
2706
2707         reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
2708         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
2709         rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
2710
2711         reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
2712         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
2713         rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
2714 }
2715
2716 static void
2717 rtwn_scan_start(struct ieee80211com *ic)
2718 {
2719         struct rtwn_softc *sc = ic->ic_softc;
2720
2721         RTWN_LOCK(sc);
2722         /* Receive beacons / probe responses from any BSSID. */
2723         rtwn_set_rx_bssid_all(sc, 1);
2724         /* Set gain for scanning. */
2725         rtwn_set_gain(sc, 0x20);
2726         RTWN_UNLOCK(sc);
2727 }
2728
2729 static void
2730 rtwn_scan_end(struct ieee80211com *ic)
2731 {
2732         struct rtwn_softc *sc = ic->ic_softc;
2733
2734         RTWN_LOCK(sc);
2735         /* Restore limitations. */
2736         rtwn_set_rx_bssid_all(sc, 0);
2737         /* Set gain under link. */
2738         rtwn_set_gain(sc, 0x32);
2739         RTWN_UNLOCK(sc);
2740 }
2741
2742 static void
2743 rtwn_getradiocaps(struct ieee80211com *ic,
2744     int maxchans, int *nchans, struct ieee80211_channel chans[])
2745 {
2746         uint8_t bands[IEEE80211_MODE_BYTES];
2747
2748         memset(bands, 0, sizeof(bands));
2749         setbit(bands, IEEE80211_MODE_11B);
2750         setbit(bands, IEEE80211_MODE_11G);
2751         ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
2752             rtwn_chan_2ghz, nitems(rtwn_chan_2ghz), bands, 0);
2753 }
2754
2755 static void
2756 rtwn_set_channel(struct ieee80211com *ic)
2757 {
2758         struct rtwn_softc *sc = ic->ic_softc;
2759         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2760
2761         RTWN_LOCK(sc);
2762         if (vap->iv_state == IEEE80211_S_SCAN) {
2763                 /* Make link LED blink during scan. */
2764                 rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
2765         }
2766         rtwn_set_chan(sc, ic->ic_curchan, NULL);
2767         RTWN_UNLOCK(sc);
2768 }
2769
2770 static void
2771 rtwn_update_mcast(struct ieee80211com *ic)
2772 {
2773
2774         /* XXX do nothing?  */
2775 }
2776
2777 static void
2778 rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
2779     struct ieee80211_channel *extc)
2780 {
2781         struct ieee80211com *ic = &sc->sc_ic;
2782         u_int chan;
2783         int i;
2784
2785         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
2786         if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2787                 device_printf(sc->sc_dev,
2788                     "%s: invalid channel %x\n", __func__, chan);
2789                 return;
2790         }
2791
2792         /* Set Tx power for this new channel. */
2793         rtwn_set_txpower(sc, c, extc);
2794
2795         for (i = 0; i < sc->nrxchains; i++) {
2796                 rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2797                     RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2798         }
2799 #ifndef IEEE80211_NO_HT
2800         if (extc != NULL) {
2801                 uint32_t reg;
2802
2803                 /* Is secondary channel below or above primary? */
2804                 int prichlo = c->ic_freq < extc->ic_freq;
2805
2806                 rtwn_write_1(sc, R92C_BWOPMODE,
2807                     rtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2808
2809                 reg = rtwn_read_1(sc, R92C_RRSR + 2);
2810                 reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2811                 rtwn_write_1(sc, R92C_RRSR + 2, reg);
2812
2813                 rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2814                     rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2815                 rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2816                     rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2817
2818                 /* Set CCK side band. */
2819                 reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2820                 reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2821                 rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2822
2823                 reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
2824                 reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2825                 rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2826
2827                 rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2828                     rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2829                     ~R92C_FPGA0_ANAPARAM2_CBW20);
2830
2831                 reg = rtwn_bb_read(sc, 0x818);
2832                 reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2833                 rtwn_bb_write(sc, 0x818, reg);
2834
2835                 /* Select 40MHz bandwidth. */
2836                 rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2837                     (sc->rf_chnlbw[0] & ~0xfff) | chan);
2838         } else
2839 #endif
2840         {
2841                 rtwn_write_1(sc, R92C_BWOPMODE,
2842                     rtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2843
2844                 rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2845                     rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2846                 rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2847                     rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2848
2849                 rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2850                     rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2851                     R92C_FPGA0_ANAPARAM2_CBW20);
2852
2853                 /* Select 20MHz bandwidth. */
2854                 rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2855                     (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2856         }
2857 }
2858
2859 static int
2860 rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
2861     uint16_t rx[2])
2862 {
2863         uint32_t status;
2864         int offset = chain * 0x20;
2865
2866         if (chain == 0) {       /* IQ calibration for chain 0. */
2867                 /* IQ calibration settings for chain 0. */
2868                 rtwn_bb_write(sc, 0xe30, 0x10008c1f);
2869                 rtwn_bb_write(sc, 0xe34, 0x10008c1f);
2870                 rtwn_bb_write(sc, 0xe38, 0x82140102);
2871
2872                 if (sc->ntxchains > 1) {
2873                         rtwn_bb_write(sc, 0xe3c, 0x28160202);   /* 2T */
2874                         /* IQ calibration settings for chain 1. */
2875                         rtwn_bb_write(sc, 0xe50, 0x10008c22);
2876                         rtwn_bb_write(sc, 0xe54, 0x10008c22);
2877                         rtwn_bb_write(sc, 0xe58, 0x82140102);
2878                         rtwn_bb_write(sc, 0xe5c, 0x28160202);
2879                 } else
2880                         rtwn_bb_write(sc, 0xe3c, 0x28160502);   /* 1T */
2881
2882                 /* LO calibration settings. */
2883                 rtwn_bb_write(sc, 0xe4c, 0x001028d1);
2884                 /* We're doing LO and IQ calibration in one shot. */
2885                 rtwn_bb_write(sc, 0xe48, 0xf9000000);
2886                 rtwn_bb_write(sc, 0xe48, 0xf8000000);
2887
2888         } else {                /* IQ calibration for chain 1. */
2889                 /* We're doing LO and IQ calibration in one shot. */
2890                 rtwn_bb_write(sc, 0xe60, 0x00000002);
2891                 rtwn_bb_write(sc, 0xe60, 0x00000000);
2892         }
2893
2894         /* Give LO and IQ calibrations the time to complete. */
2895         DELAY(1000);
2896
2897         /* Read IQ calibration status. */
2898         status = rtwn_bb_read(sc, 0xeac);
2899
2900         if (status & (1 << (28 + chain * 3)))
2901                 return (0);     /* Tx failed. */
2902         /* Read Tx IQ calibration results. */
2903         tx[0] = (rtwn_bb_read(sc, 0xe94 + offset) >> 16) & 0x3ff;
2904         tx[1] = (rtwn_bb_read(sc, 0xe9c + offset) >> 16) & 0x3ff;
2905         if (tx[0] == 0x142 || tx[1] == 0x042)
2906                 return (0);     /* Tx failed. */
2907
2908         if (status & (1 << (27 + chain * 3)))
2909                 return (1);     /* Rx failed. */
2910         /* Read Rx IQ calibration results. */
2911         rx[0] = (rtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff;
2912         rx[1] = (rtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff;
2913         if (rx[0] == 0x132 || rx[1] == 0x036)
2914                 return (1);     /* Rx failed. */
2915
2916         return (3);     /* Both Tx and Rx succeeded. */
2917 }
2918
2919 static void
2920 rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
2921     uint16_t rx[2][2])
2922 {
2923         /* Registers to save and restore during IQ calibration. */
2924         struct iq_cal_regs {
2925                 uint32_t        adda[16];
2926                 uint8_t         txpause;
2927                 uint8_t         bcn_ctrl;
2928                 uint8_t         ustime_tsf;
2929                 uint32_t        gpio_muxcfg;
2930                 uint32_t        ofdm0_trxpathena;
2931                 uint32_t        ofdm0_trmuxpar;
2932                 uint32_t        fpga0_rfifacesw1;
2933         } iq_cal_regs;
2934         static const uint16_t reg_adda[16] = {
2935                 0x85c, 0xe6c, 0xe70, 0xe74,
2936                 0xe78, 0xe7c, 0xe80, 0xe84,
2937                 0xe88, 0xe8c, 0xed0, 0xed4,
2938                 0xed8, 0xedc, 0xee0, 0xeec
2939         };
2940         int i, chain;
2941         uint32_t hssi_param1;
2942
2943         if (n == 0) {
2944                 for (i = 0; i < nitems(reg_adda); i++)
2945                         iq_cal_regs.adda[i] = rtwn_bb_read(sc, reg_adda[i]);
2946
2947                 iq_cal_regs.txpause = rtwn_read_1(sc, R92C_TXPAUSE);
2948                 iq_cal_regs.bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
2949                 iq_cal_regs.ustime_tsf = rtwn_read_1(sc, R92C_USTIME_TSF);
2950                 iq_cal_regs.gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
2951         }
2952
2953         if (sc->ntxchains == 1) {
2954                 rtwn_bb_write(sc, reg_adda[0], 0x0b1b25a0);
2955                 for (i = 1; i < nitems(reg_adda); i++)
2956                         rtwn_bb_write(sc, reg_adda[i], 0x0bdb25a0);
2957         } else {
2958                 for (i = 0; i < nitems(reg_adda); i++)
2959                         rtwn_bb_write(sc, reg_adda[i], 0x04db25a4);
2960         }
2961
2962         hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
2963         if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2964                 rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2965                     hssi_param1 | R92C_HSSI_PARAM1_PI);
2966                 rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2967                     hssi_param1 | R92C_HSSI_PARAM1_PI);
2968         }
2969
2970         if (n == 0) {
2971                 iq_cal_regs.ofdm0_trxpathena =
2972                     rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2973                 iq_cal_regs.ofdm0_trmuxpar =
2974                     rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
2975                 iq_cal_regs.fpga0_rfifacesw1 =
2976                     rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
2977         }
2978
2979         rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
2980         rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
2981         rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
2982         if (sc->ntxchains > 1) {
2983                 rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2984                 rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
2985         }
2986
2987         rtwn_write_1(sc, R92C_TXPAUSE, 0x3f);
2988         rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl & ~(0x08));
2989         rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf & ~(0x08));
2990         rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2991             iq_cal_regs.gpio_muxcfg & ~(0x20));
2992
2993         rtwn_bb_write(sc, 0x0b68, 0x00080000);
2994         if (sc->ntxchains > 1)
2995                 rtwn_bb_write(sc, 0x0b6c, 0x00080000);
2996
2997         rtwn_bb_write(sc, 0x0e28, 0x80800000);
2998         rtwn_bb_write(sc, 0x0e40, 0x01007c00);
2999         rtwn_bb_write(sc, 0x0e44, 0x01004800);
3000
3001         rtwn_bb_write(sc, 0x0b68, 0x00080000);
3002
3003         for (chain = 0; chain < sc->ntxchains; chain++) {
3004                 if (chain > 0) {
3005                         /* Put chain 0 on standby. */
3006                         rtwn_bb_write(sc, 0x0e28, 0x00);
3007                         rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
3008                         rtwn_bb_write(sc, 0x0e28, 0x80800000);
3009
3010                         /* Enable chain 1. */
3011                         for (i = 0; i < nitems(reg_adda); i++)
3012                                 rtwn_bb_write(sc, reg_adda[i], 0x0b1b25a4);
3013                 }
3014
3015                 /* Run IQ calibration twice. */
3016                 for (i = 0; i < 2; i++) {
3017                         int ret;
3018
3019                         ret = rtwn_iq_calib_chain(sc, chain,
3020                             tx[chain], rx[chain]);
3021                         if (ret == 0) {
3022                                 DPRINTF(("%s: chain %d: Tx failed.\n",
3023                                     __func__, chain));
3024                                 tx[chain][0] = 0xff;
3025                                 tx[chain][1] = 0xff;
3026                                 rx[chain][0] = 0xff;
3027                                 rx[chain][1] = 0xff;
3028                         } else if (ret == 1) {
3029                                 DPRINTF(("%s: chain %d: Rx failed.\n",
3030                                     __func__, chain));
3031                                 rx[chain][0] = 0xff;
3032                                 rx[chain][1] = 0xff;
3033                         } else if (ret == 3) {
3034                                 DPRINTF(("%s: chain %d: Both Tx and Rx "
3035                                     "succeeded.\n", __func__, chain));
3036                         }
3037                 }
3038
3039                 DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
3040                     "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
3041                     tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
3042         }
3043
3044         rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
3045             iq_cal_regs.ofdm0_trxpathena);
3046         rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
3047             iq_cal_regs.fpga0_rfifacesw1);
3048         rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, iq_cal_regs.ofdm0_trmuxpar);
3049
3050         rtwn_bb_write(sc, 0x0e28, 0x00);
3051         rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
3052         if (sc->ntxchains > 1)
3053                 rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
3054
3055         if (n != 0) {
3056                 if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
3057                         rtwn_bb_write(sc, R92C_HSSI_PARAM1(0), hssi_param1);
3058                         rtwn_bb_write(sc, R92C_HSSI_PARAM1(1), hssi_param1);
3059                 }
3060
3061                 for (i = 0; i < nitems(reg_adda); i++)
3062                         rtwn_bb_write(sc, reg_adda[i], iq_cal_regs.adda[i]);
3063
3064                 rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs.txpause);
3065                 rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl);
3066                 rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf);
3067                 rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs.gpio_muxcfg);
3068         }
3069 }
3070
3071 #define RTWN_IQ_CAL_MAX_TOLERANCE 5
3072 static int
3073 rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
3074     uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
3075 {
3076         int chain, i, tx_ok[2], rx_ok[2];
3077
3078         tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
3079         for (chain = 0; chain < ntxchains; chain++) {
3080                 for (i = 0; i < 2; i++) {
3081                         if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
3082                             rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
3083                                 continue;
3084
3085                         tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
3086                             RTWN_IQ_CAL_MAX_TOLERANCE);
3087
3088                         rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
3089                             RTWN_IQ_CAL_MAX_TOLERANCE);
3090                 }
3091         }
3092
3093         if (ntxchains > 1)
3094                 return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
3095         else
3096                 return (tx_ok[0] && rx_ok[0]);
3097 }
3098 #undef RTWN_IQ_CAL_MAX_TOLERANCE
3099
3100 static void
3101 rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
3102     uint16_t rx[2], int chain)
3103 {
3104         uint32_t reg, val, x;
3105         long y, tx_c;
3106
3107         if (tx[0] == 0xff || tx[1] == 0xff)
3108                 return;
3109
3110         reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
3111         val = ((reg >> 22) & 0x3ff);
3112         x = tx[0];
3113         if (x & 0x0200)
3114                 x |= 0xfc00;
3115         reg = (((x * val) >> 8) & 0x3ff);
3116         rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
3117
3118         reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
3119         if (((x * val) >> 7) & 0x01)
3120                 reg |= 0x80000000;
3121         else
3122                 reg &= ~0x80000000;
3123         rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
3124
3125         y = tx[1];
3126         if (y & 0x00000200)
3127                 y |= 0xfffffc00;
3128         tx_c = (y * val) >> 8;
3129         reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
3130         reg |= ((((tx_c & 0x3c0) >> 6) << 24) & 0xf0000000);
3131         rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
3132
3133         reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
3134         reg |= (((tx_c & 0x3f) << 16) & 0x003F0000);
3135         rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
3136
3137         reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
3138         if (((y * val) >> 7) & 0x01)
3139                 reg |= 0x20000000;
3140         else
3141                 reg &= ~0x20000000;
3142         rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
3143
3144         if (rx[0] == 0xff || rx[1] == 0xff)
3145                 return;
3146
3147         reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
3148         reg |= (rx[0] & 0x3ff);
3149         rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
3150         reg |= (((rx[1] & 0x03f) << 8) & 0xFC00);
3151         rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
3152
3153         if (chain == 0) {
3154                 reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
3155                 reg |= (((rx[1] & 0xf) >> 6) & 0x000f);
3156                 rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
3157         } else {
3158                 reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
3159                 reg |= ((((rx[1] & 0xf) >> 6) << 12) & 0xf000);
3160                 rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
3161         }
3162 }
3163
3164 #define RTWN_IQ_CAL_NRUN        3
3165 static void
3166 rtwn_iq_calib(struct rtwn_softc *sc)
3167 {
3168         uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
3169         int n, valid;
3170
3171         valid = 0;
3172         for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
3173                 rtwn_iq_calib_run(sc, n, tx[n], rx[n]);
3174
3175                 if (n == 0)
3176                         continue;
3177
3178                 /* Valid results remain stable after consecutive runs. */
3179                 valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
3180                     tx[n], rx[n], sc->ntxchains);
3181                 if (valid)
3182                         break;
3183         }
3184
3185         if (valid) {
3186                 rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
3187                 if (sc->ntxchains > 1)
3188                         rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
3189         }
3190 }
3191 #undef RTWN_IQ_CAL_NRUN
3192
3193 static void
3194 rtwn_lc_calib(struct rtwn_softc *sc)
3195 {
3196         uint32_t rf_ac[2];
3197         uint8_t txmode;
3198         int i;
3199
3200         txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3201         if ((txmode & 0x70) != 0) {
3202                 /* Disable all continuous Tx. */
3203                 rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3204
3205                 /* Set RF mode to standby mode. */
3206                 for (i = 0; i < sc->nrxchains; i++) {
3207                         rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
3208                         rtwn_rf_write(sc, i, R92C_RF_AC,
3209                             RW(rf_ac[i], R92C_RF_AC_MODE,
3210                                 R92C_RF_AC_MODE_STANDBY));
3211                 }
3212         } else {
3213                 /* Block all Tx queues. */
3214                 rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3215         }
3216         /* Start calibration. */
3217         rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3218             rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3219
3220         /* Give calibration the time to complete. */
3221         DELAY(100);
3222
3223         /* Restore configuration. */
3224         if ((txmode & 0x70) != 0) {
3225                 /* Restore Tx mode. */
3226                 rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3227                 /* Restore RF mode. */
3228                 for (i = 0; i < sc->nrxchains; i++)
3229                         rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3230         } else {
3231                 /* Unblock all Tx queues. */
3232                 rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3233         }
3234 }
3235
3236 static void
3237 rtwn_temp_calib(struct rtwn_softc *sc)
3238 {
3239         int temp;
3240
3241         if (sc->thcal_state == 0) {
3242                 /* Start measuring temperature. */
3243                 rtwn_rf_write(sc, 0, R92C_RF_T_METER, 0x60);
3244                 sc->thcal_state = 1;
3245                 return;
3246         }
3247         sc->thcal_state = 0;
3248
3249         /* Read measured temperature. */
3250         temp = rtwn_rf_read(sc, 0, R92C_RF_T_METER) & 0x1f;
3251         if (temp == 0)  /* Read failed, skip. */
3252                 return;
3253         DPRINTFN(2, ("temperature=%d\n", temp));
3254
3255         /*
3256          * Redo IQ and LC calibration if temperature changed significantly
3257          * since last calibration.
3258          */
3259         if (sc->thcal_lctemp == 0) {
3260                 /* First calibration is performed in rtwn_init(). */
3261                 sc->thcal_lctemp = temp;
3262         } else if (abs(temp - sc->thcal_lctemp) > 1) {
3263                 DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
3264                     sc->thcal_lctemp, temp));
3265                 rtwn_iq_calib(sc);
3266                 rtwn_lc_calib(sc);
3267                 /* Record temperature of last calibration. */
3268                 sc->thcal_lctemp = temp;
3269         }
3270 }
3271
3272 static int
3273 rtwn_init(struct rtwn_softc *sc)
3274 {
3275         struct ieee80211com *ic = &sc->sc_ic;
3276         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3277         uint32_t reg;
3278         uint8_t macaddr[IEEE80211_ADDR_LEN];
3279         int i, error;
3280
3281         RTWN_LOCK(sc);
3282
3283         if (sc->sc_flags & RTWN_RUNNING) {
3284                 RTWN_UNLOCK(sc);
3285                 return 0;
3286         }
3287         sc->sc_flags |= RTWN_RUNNING;
3288
3289         /* Init firmware commands ring. */
3290         sc->fwcur = 0;
3291
3292         /* Power on adapter. */
3293         error = rtwn_power_on(sc);
3294         if (error != 0) {
3295                 device_printf(sc->sc_dev, "could not power on adapter\n");
3296                 goto fail;
3297         }
3298
3299         /* Initialize DMA. */
3300         error = rtwn_dma_init(sc);
3301         if (error != 0) {
3302                 device_printf(sc->sc_dev, "could not initialize DMA\n");
3303                 goto fail;
3304         }
3305
3306         /* Set info size in Rx descriptors (in 64-bit words). */
3307         rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3308
3309         /* Disable interrupts. */
3310         rtwn_write_4(sc, R92C_HISR, 0x00000000);
3311         rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3312
3313         /* Set MAC address. */
3314         IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3315         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3316                 rtwn_write_1(sc, R92C_MACID + i, macaddr[i]);
3317
3318         /* Set initial network type. */
3319         reg = rtwn_read_4(sc, R92C_CR);
3320         reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3321         rtwn_write_4(sc, R92C_CR, reg);
3322
3323         rtwn_rxfilter_init(sc);
3324
3325         reg = rtwn_read_4(sc, R92C_RRSR);
3326         reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
3327         rtwn_write_4(sc, R92C_RRSR, reg);
3328
3329         /* Set short/long retry limits. */
3330         rtwn_write_2(sc, R92C_RL,
3331             SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
3332
3333         /* Initialize EDCA parameters. */
3334         rtwn_edca_init(sc);
3335
3336         /* Set data and response automatic rate fallback retry counts. */
3337         rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
3338         rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
3339         rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
3340         rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
3341
3342         rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
3343
3344         /* Set ACK timeout. */
3345         rtwn_write_1(sc, R92C_ACKTO, 0x40);
3346
3347         /* Initialize beacon parameters. */
3348         rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3349         rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3350         rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3351         rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3352
3353         /* Setup AMPDU aggregation. */
3354         rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);  /* MCS7~0 */
3355         rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3356
3357         rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3358         rtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
3359
3360         rtwn_write_4(sc, R92C_PIFS, 0x1c);
3361         rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
3362
3363         /* Load 8051 microcode. */
3364         error = rtwn_load_firmware(sc);
3365         if (error != 0)
3366                 goto fail;
3367
3368         /* Initialize MAC/BB/RF blocks. */
3369         rtwn_mac_init(sc);
3370         rtwn_bb_init(sc);
3371         rtwn_rf_init(sc);
3372
3373         /* Turn CCK and OFDM blocks on. */
3374         reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3375         reg |= R92C_RFMOD_CCK_EN;
3376         rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3377         reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3378         reg |= R92C_RFMOD_OFDM_EN;
3379         rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3380
3381         /* Clear per-station keys table. */
3382         rtwn_cam_init(sc);
3383
3384         /* Enable hardware sequence numbering. */
3385         rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3386
3387         /* Perform LO and IQ calibrations. */
3388         rtwn_iq_calib(sc);
3389         /* Perform LC calibration. */
3390         rtwn_lc_calib(sc);
3391
3392         rtwn_pa_bias_init(sc);
3393
3394         /* Initialize GPIO setting. */
3395         rtwn_write_1(sc, R92C_GPIO_MUXCFG,
3396             rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3397
3398         /* Fix for lower temperature. */
3399         rtwn_write_1(sc, 0x15, 0xe9);
3400
3401         /* CLear pending interrupts. */
3402         rtwn_write_4(sc, R92C_HISR, 0xffffffff);
3403
3404         /* Enable interrupts. */
3405         rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
3406
3407         callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
3408
3409 fail:
3410         if (error != 0)
3411                 rtwn_stop_locked(sc);
3412
3413         RTWN_UNLOCK(sc);
3414
3415         return error;
3416 }
3417
3418 static void
3419 rtwn_stop_locked(struct rtwn_softc *sc)
3420 {
3421         uint16_t reg;
3422         int i;
3423
3424         RTWN_LOCK_ASSERT(sc);
3425
3426         if (!(sc->sc_flags & RTWN_RUNNING))
3427                 return;
3428
3429         sc->sc_tx_timer = 0;
3430         callout_stop(&sc->watchdog_to);
3431         callout_stop(&sc->calib_to);
3432         sc->sc_flags &= ~RTWN_RUNNING;
3433
3434         /* Disable interrupts. */
3435         rtwn_write_4(sc, R92C_HISR, 0x00000000);
3436         rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3437
3438         /* Stop hardware. */
3439         rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3440         rtwn_write_1(sc, R92C_RF_CTRL, 0x00);
3441         reg = rtwn_read_1(sc, R92C_SYS_FUNC_EN);
3442         reg |= R92C_SYS_FUNC_EN_BB_GLB_RST;
3443         rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
3444         reg &= ~R92C_SYS_FUNC_EN_BB_GLB_RST;
3445         rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
3446         reg = rtwn_read_2(sc, R92C_CR);
3447         reg &= ~(R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3448             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3449             R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3450             R92C_CR_ENSEC);
3451         rtwn_write_2(sc, R92C_CR, reg);
3452         if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
3453                 rtwn_fw_reset(sc);
3454         /* TODO: linux does additional btcoex stuff here */
3455         rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0x80); /* linux magic number */
3456         rtwn_write_1(sc, R92C_SPS0_CTRL, 0x23); /* ditto */
3457         rtwn_write_1(sc, R92C_AFE_XTAL_CTRL, 0x0e); /* different with btcoex */
3458         rtwn_write_1(sc, R92C_RSV_CTRL, 0x0e);
3459         rtwn_write_1(sc, R92C_APS_FSMCO, R92C_APS_FSMCO_PDN_EN);
3460
3461         for (i = 0; i < RTWN_NTXQUEUES; i++)
3462                 rtwn_reset_tx_list(sc, i);
3463         rtwn_reset_rx_list(sc);
3464 }
3465
3466 static void
3467 rtwn_stop(struct rtwn_softc *sc)
3468 {
3469         RTWN_LOCK(sc);
3470         rtwn_stop_locked(sc);
3471         RTWN_UNLOCK(sc);
3472 }
3473
3474 static void
3475 rtwn_intr(void *arg)
3476 {
3477         struct rtwn_softc *sc = arg;
3478         uint32_t status;
3479         int i;
3480
3481         RTWN_LOCK(sc);
3482         status = rtwn_read_4(sc, R92C_HISR);
3483         if (status == 0 || status == 0xffffffff) {
3484                 RTWN_UNLOCK(sc);
3485                 return;
3486         }
3487
3488         /* Disable interrupts. */
3489         rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3490
3491         /* Ack interrupts. */
3492         rtwn_write_4(sc, R92C_HISR, status);
3493
3494         /* Vendor driver treats RX errors like ROK... */
3495         if (status & (R92C_IMR_ROK | R92C_IMR_RXFOVW | R92C_IMR_RDU)) {
3496                 bus_dmamap_sync(sc->rx_ring.desc_dmat, sc->rx_ring.desc_map,
3497                     BUS_DMASYNC_POSTREAD);
3498
3499                 for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
3500                         struct r92c_rx_desc *rx_desc = &sc->rx_ring.desc[i];
3501                         struct rtwn_rx_data *rx_data = &sc->rx_ring.rx_data[i];
3502
3503                         if (le32toh(rx_desc->rxdw0) & R92C_RXDW0_OWN)
3504                                 continue;
3505
3506                         rtwn_rx_frame(sc, rx_desc, rx_data, i);
3507                 }
3508         }
3509
3510         if (status & R92C_IMR_BDOK)
3511                 rtwn_tx_done(sc, RTWN_BEACON_QUEUE);
3512         if (status & R92C_IMR_HIGHDOK)
3513                 rtwn_tx_done(sc, RTWN_HIGH_QUEUE);
3514         if (status & R92C_IMR_MGNTDOK)
3515                 rtwn_tx_done(sc, RTWN_MGNT_QUEUE);
3516         if (status & R92C_IMR_BKDOK)
3517                 rtwn_tx_done(sc, RTWN_BK_QUEUE);
3518         if (status & R92C_IMR_BEDOK)
3519                 rtwn_tx_done(sc, RTWN_BE_QUEUE);
3520         if (status & R92C_IMR_VIDOK)
3521                 rtwn_tx_done(sc, RTWN_VI_QUEUE);
3522         if (status & R92C_IMR_VODOK)
3523                 rtwn_tx_done(sc, RTWN_VO_QUEUE);
3524
3525         /* Enable interrupts. */
3526         rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
3527
3528         RTWN_UNLOCK(sc);
3529 }