sys/dev/usb/wlan/if_urtwn.c

   1 /*      $OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $   */
   2
   3 /*-
   4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
   5  * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/cdefs.h>
  21 __FBSDID("$FreeBSD$");
  22
  23 /*
  24  * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
  25  */
  26
  27 #include <sys/param.h>
  28 #include <sys/sockio.h>
  29 #include <sys/sysctl.h>
  30 #include <sys/lock.h>
  31 #include <sys/mutex.h>
  32 #include <sys/mbuf.h>
  33 #include <sys/kernel.h>
  34 #include <sys/socket.h>
  35 #include <sys/systm.h>
  36 #include <sys/malloc.h>
  37 #include <sys/module.h>
  38 #include <sys/bus.h>
  39 #include <sys/endian.h>
  40 #include <sys/linker.h>
  41 #include <sys/firmware.h>
  42 #include <sys/kdb.h>
  43
  44 #include <machine/bus.h>
  45 #include <machine/resource.h>
  46 #include <sys/rman.h>
  47
  48 #include <net/bpf.h>
  49 #include <net/if.h>
  50 #include <net/if_arp.h>
  51 #include <net/ethernet.h>
  52 #include <net/if_dl.h>
  53 #include <net/if_media.h>
  54 #include <net/if_types.h>
  55
  56 #include <netinet/in.h>
  57 #include <netinet/in_systm.h>
  58 #include <netinet/in_var.h>
  59 #include <netinet/if_ether.h>
  60 #include <netinet/ip.h>
  61
  62 #include <net80211/ieee80211_var.h>
  63 #include <net80211/ieee80211_regdomain.h>
  64 #include <net80211/ieee80211_radiotap.h>
  65 #include <net80211/ieee80211_ratectl.h>
  66
  67 #include <dev/usb/usb.h>
  68 #include <dev/usb/usbdi.h>
  69 #include "usbdevs.h"
  70
  71 #define USB_DEBUG_VAR urtwn_debug
  72 #include <dev/usb/usb_debug.h>
  73
  74 #include <dev/usb/wlan/if_urtwnreg.h>
  75
  76 #ifdef USB_DEBUG
  77 static int urtwn_debug = 0;
  78
  79 SYSCTL_NODE(_hw_usb, OID_AUTO, urtwn, CTLFLAG_RW, 0, "USB urtwn");
  80 SYSCTL_INT(_hw_usb_urtwn, OID_AUTO, debug, CTLFLAG_RW, &urtwn_debug, 0,
  81     "Debug level");
  82 #endif
  83
  84 #define URTWN_RSSI(r)  (r) - 110
  85 #define IEEE80211_HAS_ADDR4(wh) \
  86         (((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
  87
  88 /* various supported device vendors/products */
  89 static const STRUCT_USB_HOST_ID urtwn_devs[] = {
  90 #define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
  91 #define URTWN_RTL8188E_DEV(v,p) \
  92         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
  93 #define URTWN_RTL8188E  1
  94         URTWN_DEV(ABOCOM,       RTL8188CU_1),
  95         URTWN_DEV(ABOCOM,       RTL8188CU_2),
  96         URTWN_DEV(ABOCOM,       RTL8192CU),
  97         URTWN_DEV(ASUS,         RTL8192CU),
  98         URTWN_DEV(ASUS,         USBN10NANO),
  99         URTWN_DEV(AZUREWAVE,    RTL8188CE_1),
 100         URTWN_DEV(AZUREWAVE,    RTL8188CE_2),
 101         URTWN_DEV(AZUREWAVE,    RTL8188CU),
 102         URTWN_DEV(BELKIN,       F7D2102),
 103         URTWN_DEV(BELKIN,       RTL8188CU),
 104         URTWN_DEV(BELKIN,       RTL8192CU),
 105         URTWN_DEV(CHICONY,      RTL8188CUS_1),
 106         URTWN_DEV(CHICONY,      RTL8188CUS_2),
 107         URTWN_DEV(CHICONY,      RTL8188CUS_3),
 108         URTWN_DEV(CHICONY,      RTL8188CUS_4),
 109         URTWN_DEV(CHICONY,      RTL8188CUS_5),
 110         URTWN_DEV(COREGA,       RTL8192CU),
 111         URTWN_DEV(DLINK,        RTL8188CU),
 112         URTWN_DEV(DLINK,        RTL8192CU_1),
 113         URTWN_DEV(DLINK,        RTL8192CU_2),
 114         URTWN_DEV(DLINK,        RTL8192CU_3),
 115         URTWN_DEV(DLINK,        DWA131B),
 116         URTWN_DEV(EDIMAX,       EW7811UN),
 117         URTWN_DEV(EDIMAX,       RTL8192CU),
 118         URTWN_DEV(FEIXUN,       RTL8188CU),
 119         URTWN_DEV(FEIXUN,       RTL8192CU),
 120         URTWN_DEV(GUILLEMOT,    HWNUP150),
 121         URTWN_DEV(HAWKING,      RTL8192CU),
 122         URTWN_DEV(HP3,          RTL8188CU),
 123         URTWN_DEV(NETGEAR,      WNA1000M),
 124         URTWN_DEV(NETGEAR,      RTL8192CU),
 125         URTWN_DEV(NETGEAR4,     RTL8188CU),
 126         URTWN_DEV(NOVATECH,     RTL8188CU),
 127         URTWN_DEV(PLANEX2,      RTL8188CU_1),
 128         URTWN_DEV(PLANEX2,      RTL8188CU_2),
 129         URTWN_DEV(PLANEX2,      RTL8188CU_3),
 130         URTWN_DEV(PLANEX2,      RTL8188CU_4),
 131         URTWN_DEV(PLANEX2,      RTL8188CUS),
 132         URTWN_DEV(PLANEX2,      RTL8192CU),
 133         URTWN_DEV(REALTEK,      RTL8188CE_0),
 134         URTWN_DEV(REALTEK,      RTL8188CE_1),
 135         URTWN_DEV(REALTEK,      RTL8188CTV),
 136         URTWN_DEV(REALTEK,      RTL8188CU_0),
 137         URTWN_DEV(REALTEK,      RTL8188CU_1),
 138         URTWN_DEV(REALTEK,      RTL8188CU_2),
 139         URTWN_DEV(REALTEK,      RTL8188CU_3),
 140         URTWN_DEV(REALTEK,      RTL8188CU_COMBO),
 141         URTWN_DEV(REALTEK,      RTL8188CUS),
 142         URTWN_DEV(REALTEK,      RTL8188RU_1),
 143         URTWN_DEV(REALTEK,      RTL8188RU_2),
 144         URTWN_DEV(REALTEK,      RTL8188RU_3),
 145         URTWN_DEV(REALTEK,      RTL8191CU),
 146         URTWN_DEV(REALTEK,      RTL8192CE),
 147         URTWN_DEV(REALTEK,      RTL8192CU),
 148         URTWN_DEV(SITECOMEU,    RTL8188CU_1),
 149         URTWN_DEV(SITECOMEU,    RTL8188CU_2),
 150         URTWN_DEV(SITECOMEU,    RTL8192CU),
 151         URTWN_DEV(TRENDNET,     RTL8188CU),
 152         URTWN_DEV(TRENDNET,     RTL8192CU),
 153         URTWN_DEV(ZYXEL,        RTL8192CU),
 154         /* URTWN_RTL8188E */
 155         URTWN_RTL8188E_DEV(DLINK,       DWA125D1),
 156         URTWN_RTL8188E_DEV(REALTEK,     RTL8188ETV),
 157         URTWN_RTL8188E_DEV(REALTEK,     RTL8188EU),
 158 #undef URTWN_RTL8188E_DEV
 159 #undef URTWN_DEV
 160 };
 161
 162 static device_probe_t   urtwn_match;
 163 static device_attach_t  urtwn_attach;
 164 static device_detach_t  urtwn_detach;
 165
 166 static usb_callback_t   urtwn_bulk_tx_callback;
 167 static usb_callback_t   urtwn_bulk_rx_callback;
 168
 169 static usb_error_t      urtwn_do_request(struct urtwn_softc *sc,
 170                             struct usb_device_request *req, void *data);
 171 static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
 172                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 173                     const uint8_t [IEEE80211_ADDR_LEN],
 174                     const uint8_t [IEEE80211_ADDR_LEN]);
 175 static void             urtwn_vap_delete(struct ieee80211vap *);
 176 static struct mbuf *    urtwn_rx_frame(struct urtwn_softc *, uint8_t *, int,
 177                             int *);
 178 static struct mbuf *    urtwn_rxeof(struct usb_xfer *, struct urtwn_data *,
 179                             int *, int8_t *);
 180 static void             urtwn_txeof(struct usb_xfer *, struct urtwn_data *);
 181 static int              urtwn_alloc_list(struct urtwn_softc *,
 182                             struct urtwn_data[], int, int);
 183 static int              urtwn_alloc_rx_list(struct urtwn_softc *);
 184 static int              urtwn_alloc_tx_list(struct urtwn_softc *);
 185 static void             urtwn_free_tx_list(struct urtwn_softc *);
 186 static void             urtwn_free_rx_list(struct urtwn_softc *);
 187 static void             urtwn_free_list(struct urtwn_softc *,
 188                             struct urtwn_data data[], int);
 189 static struct urtwn_data *      _urtwn_getbuf(struct urtwn_softc *);
 190 static struct urtwn_data *      urtwn_getbuf(struct urtwn_softc *);
 191 static int              urtwn_write_region_1(struct urtwn_softc *, uint16_t,
 192                             uint8_t *, int);
 193 static void             urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
 194 static void             urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
 195 static void             urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
 196 static int              urtwn_read_region_1(struct urtwn_softc *, uint16_t,
 197                             uint8_t *, int);
 198 static uint8_t          urtwn_read_1(struct urtwn_softc *, uint16_t);
 199 static uint16_t         urtwn_read_2(struct urtwn_softc *, uint16_t);
 200 static uint32_t         urtwn_read_4(struct urtwn_softc *, uint16_t);
 201 static int              urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
 202                             const void *, int);
 203 static void             urtwn_r92c_rf_write(struct urtwn_softc *, int,
 204                             uint8_t, uint32_t);
 205 static void             urtwn_r88e_rf_write(struct urtwn_softc *, int,
 206                             uint8_t, uint32_t);
 207 static uint32_t         urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
 208 static int              urtwn_llt_write(struct urtwn_softc *, uint32_t,
 209                             uint32_t);
 210 static uint8_t          urtwn_efuse_read_1(struct urtwn_softc *, uint16_t);
 211 static void             urtwn_efuse_read(struct urtwn_softc *);
 212 static void             urtwn_efuse_switch_power(struct urtwn_softc *);
 213 static int              urtwn_read_chipid(struct urtwn_softc *);
 214 static void             urtwn_read_rom(struct urtwn_softc *);
 215 static void             urtwn_r88e_read_rom(struct urtwn_softc *);
 216 static int              urtwn_ra_init(struct urtwn_softc *);
 217 static void             urtwn_tsf_sync_enable(struct urtwn_softc *);
 218 static void             urtwn_set_led(struct urtwn_softc *, int, int);
 219 static int              urtwn_newstate(struct ieee80211vap *,
 220                             enum ieee80211_state, int);
 221 static void             urtwn_watchdog(void *);
 222 static void             urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
 223 static int8_t           urtwn_get_rssi(struct urtwn_softc *, int, void *);
 224 static int8_t           urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
 225 static int              urtwn_tx_start(struct urtwn_softc *,
 226                             struct ieee80211_node *, struct mbuf *,
 227                             struct urtwn_data *);
 228 static void             urtwn_start(struct ifnet *);
 229 static void             urtwn_start_locked(struct ifnet *,
 230                             struct urtwn_softc *);
 231 static int              urtwn_ioctl(struct ifnet *, u_long, caddr_t);
 232 static int              urtwn_r92c_power_on(struct urtwn_softc *);
 233 static int              urtwn_r88e_power_on(struct urtwn_softc *);
 234 static int              urtwn_llt_init(struct urtwn_softc *);
 235 static void             urtwn_fw_reset(struct urtwn_softc *);
 236 static void             urtwn_r88e_fw_reset(struct urtwn_softc *);
 237 static int              urtwn_fw_loadpage(struct urtwn_softc *, int,
 238                             const uint8_t *, int);
 239 static int              urtwn_load_firmware(struct urtwn_softc *);
 240 static int              urtwn_r92c_dma_init(struct urtwn_softc *);
 241 static int              urtwn_r88e_dma_init(struct urtwn_softc *);
 242 static void             urtwn_mac_init(struct urtwn_softc *);
 243 static void             urtwn_bb_init(struct urtwn_softc *);
 244 static void             urtwn_rf_init(struct urtwn_softc *);
 245 static void             urtwn_cam_init(struct urtwn_softc *);
 246 static void             urtwn_pa_bias_init(struct urtwn_softc *);
 247 static void             urtwn_rxfilter_init(struct urtwn_softc *);
 248 static void             urtwn_edca_init(struct urtwn_softc *);
 249 static void             urtwn_write_txpower(struct urtwn_softc *, int,
 250                             uint16_t[]);
 251 static void             urtwn_get_txpower(struct urtwn_softc *, int,
 252                             struct ieee80211_channel *,
 253                             struct ieee80211_channel *, uint16_t[]);
 254 static void             urtwn_r88e_get_txpower(struct urtwn_softc *, int,
 255                             struct ieee80211_channel *,
 256                             struct ieee80211_channel *, uint16_t[]);
 257 static void             urtwn_set_txpower(struct urtwn_softc *,
 258                             struct ieee80211_channel *,
 259                             struct ieee80211_channel *);
 260 static void             urtwn_scan_start(struct ieee80211com *);
 261 static void             urtwn_scan_end(struct ieee80211com *);
 262 static void             urtwn_set_channel(struct ieee80211com *);
 263 static void             urtwn_set_chan(struct urtwn_softc *,
 264                             struct ieee80211_channel *,
 265                             struct ieee80211_channel *);
 266 static void             urtwn_update_mcast(struct ifnet *);
 267 static void             urtwn_iq_calib(struct urtwn_softc *);
 268 static void             urtwn_lc_calib(struct urtwn_softc *);
 269 static void             urtwn_init(void *);
 270 static void             urtwn_init_locked(void *);
 271 static void             urtwn_stop(struct ifnet *);
 272 static void             urtwn_stop_locked(struct ifnet *);
 273 static void             urtwn_abort_xfers(struct urtwn_softc *);
 274 static int              urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 275                             const struct ieee80211_bpf_params *);
 276 static void             urtwn_ms_delay(struct urtwn_softc *);
 277
 278 /* Aliases. */
 279 #define urtwn_bb_write  urtwn_write_4
 280 #define urtwn_bb_read   urtwn_read_4
 281
 282 static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
 283         [URTWN_BULK_RX] = {
 284                 .type = UE_BULK,
 285                 .endpoint = UE_ADDR_ANY,
 286                 .direction = UE_DIR_IN,
 287                 .bufsize = URTWN_RXBUFSZ,
 288                 .flags = {
 289                         .pipe_bof = 1,
 290                         .short_xfer_ok = 1
 291                 },
 292                 .callback = urtwn_bulk_rx_callback,
 293         },
 294         [URTWN_BULK_TX_BE] = {
 295                 .type = UE_BULK,
 296                 .endpoint = 0x03,
 297                 .direction = UE_DIR_OUT,
 298                 .bufsize = URTWN_TXBUFSZ,
 299                 .flags = {
 300                         .ext_buffer = 1,
 301                         .pipe_bof = 1,
 302                         .force_short_xfer = 1
 303                 },
 304                 .callback = urtwn_bulk_tx_callback,
 305                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 306         },
 307         [URTWN_BULK_TX_BK] = {
 308                 .type = UE_BULK,
 309                 .endpoint = 0x03,
 310                 .direction = UE_DIR_OUT,
 311                 .bufsize = URTWN_TXBUFSZ,
 312                 .flags = {
 313                         .ext_buffer = 1,
 314                         .pipe_bof = 1,
 315                         .force_short_xfer = 1,
 316                 },
 317                 .callback = urtwn_bulk_tx_callback,
 318                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 319         },
 320         [URTWN_BULK_TX_VI] = {
 321                 .type = UE_BULK,
 322                 .endpoint = 0x02,
 323                 .direction = UE_DIR_OUT,
 324                 .bufsize = URTWN_TXBUFSZ,
 325                 .flags = {
 326                         .ext_buffer = 1,
 327                         .pipe_bof = 1,
 328                         .force_short_xfer = 1
 329                 },
 330                 .callback = urtwn_bulk_tx_callback,
 331                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 332         },
 333         [URTWN_BULK_TX_VO] = {
 334                 .type = UE_BULK,
 335                 .endpoint = 0x02,
 336                 .direction = UE_DIR_OUT,
 337                 .bufsize = URTWN_TXBUFSZ,
 338                 .flags = {
 339                         .ext_buffer = 1,
 340                         .pipe_bof = 1,
 341                         .force_short_xfer = 1
 342                 },
 343                 .callback = urtwn_bulk_tx_callback,
 344                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 345         },
 346 };
 347
 348 static int
 349 urtwn_match(device_t self)
 350 {
 351         struct usb_attach_arg *uaa = device_get_ivars(self);
 352
 353         if (uaa->usb_mode != USB_MODE_HOST)
 354                 return (ENXIO);
 355         if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
 356                 return (ENXIO);
 357         if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
 358                 return (ENXIO);
 359
 360         return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
 361 }
 362
 363 static int
 364 urtwn_attach(device_t self)
 365 {
 366         struct usb_attach_arg *uaa = device_get_ivars(self);
 367         struct urtwn_softc *sc = device_get_softc(self);
 368         struct ifnet *ifp;
 369         struct ieee80211com *ic;
 370         uint8_t iface_index, bands;
 371         int error;
 372
 373         device_set_usb_desc(self);
 374         sc->sc_udev = uaa->device;
 375         sc->sc_dev = self;
 376         if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
 377                 sc->chip |= URTWN_CHIP_88E;
 378
 379         mtx_init(&sc->sc_mtx, device_get_nameunit(self),
 380             MTX_NETWORK_LOCK, MTX_DEF);
 381         callout_init(&sc->sc_watchdog_ch, 0);
 382
 383         iface_index = URTWN_IFACE_INDEX;
 384         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
 385             urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
 386         if (error) {
 387                 device_printf(self, "could not allocate USB transfers, "
 388                     "err=%s\n", usbd_errstr(error));
 389                 goto detach;
 390         }
 391
 392         URTWN_LOCK(sc);
 393
 394         error = urtwn_read_chipid(sc);
 395         if (error) {
 396                 device_printf(sc->sc_dev, "unsupported test chip\n");
 397                 URTWN_UNLOCK(sc);
 398                 goto detach;
 399         }
 400
 401         /* Determine number of Tx/Rx chains. */
 402         if (sc->chip & URTWN_CHIP_92C) {
 403                 sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
 404                 sc->nrxchains = 2;
 405         } else {
 406                 sc->ntxchains = 1;
 407                 sc->nrxchains = 1;
 408         }
 409
 410         if (sc->chip & URTWN_CHIP_88E)
 411                 urtwn_r88e_read_rom(sc);
 412         else
 413                 urtwn_read_rom(sc);
 414
 415         device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
 416             (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
 417             (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
 418             (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
 419             (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
 420             "8188CUS", sc->ntxchains, sc->nrxchains);
 421
 422         URTWN_UNLOCK(sc);
 423
 424         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 425         if (ifp == NULL) {
 426                 device_printf(sc->sc_dev, "can not if_alloc()\n");
 427                 goto detach;
 428         }
 429         ic = ifp->if_l2com;
 430
 431         ifp->if_softc = sc;
 432         if_initname(ifp, "urtwn", device_get_unit(sc->sc_dev));
 433         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 434         ifp->if_init = urtwn_init;
 435         ifp->if_ioctl = urtwn_ioctl;
 436         ifp->if_start = urtwn_start;
 437         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 438         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 439         IFQ_SET_READY(&ifp->if_snd);
 440
 441         ic->ic_ifp = ifp;
 442         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 443         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 444
 445         /* set device capabilities */
 446         ic->ic_caps =
 447                   IEEE80211_C_STA               /* station mode */
 448                 | IEEE80211_C_MONITOR           /* monitor mode */
 449                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 450                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 451                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 452                 | IEEE80211_C_WPA               /* 802.11i */
 453                 ;
 454
 455         bands = 0;
 456         setbit(&bands, IEEE80211_MODE_11B);
 457         setbit(&bands, IEEE80211_MODE_11G);
 458         ieee80211_init_channels(ic, NULL, &bands);
 459
 460         ieee80211_ifattach(ic, sc->sc_bssid);
 461         ic->ic_raw_xmit = urtwn_raw_xmit;
 462         ic->ic_scan_start = urtwn_scan_start;
 463         ic->ic_scan_end = urtwn_scan_end;
 464         ic->ic_set_channel = urtwn_set_channel;
 465
 466         ic->ic_vap_create = urtwn_vap_create;
 467         ic->ic_vap_delete = urtwn_vap_delete;
 468         ic->ic_update_mcast = urtwn_update_mcast;
 469
 470         ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
 471             sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
 472             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 473             URTWN_RX_RADIOTAP_PRESENT);
 474
 475         if (bootverbose)
 476                 ieee80211_announce(ic);
 477
 478         return (0);
 479
 480 detach:
 481         urtwn_detach(self);
 482         return (ENXIO);                 /* failure */
 483 }
 484
 485 static int
 486 urtwn_detach(device_t self)
 487 {
 488         struct urtwn_softc *sc = device_get_softc(self);
 489         struct ifnet *ifp = sc->sc_ifp;
 490         struct ieee80211com *ic = ifp->if_l2com;
 491         unsigned int x;
 492
 493         /* Prevent further ioctls. */
 494         URTWN_LOCK(sc);
 495         sc->sc_flags |= URTWN_DETACHED;
 496         URTWN_UNLOCK(sc);
 497
 498         urtwn_stop(ifp);
 499
 500         callout_drain(&sc->sc_watchdog_ch);
 501
 502         /* Prevent further allocations from RX/TX data lists. */
 503         URTWN_LOCK(sc);
 504         STAILQ_INIT(&sc->sc_tx_active);
 505         STAILQ_INIT(&sc->sc_tx_inactive);
 506         STAILQ_INIT(&sc->sc_tx_pending);
 507
 508         STAILQ_INIT(&sc->sc_rx_active);
 509         STAILQ_INIT(&sc->sc_rx_inactive);
 510         URTWN_UNLOCK(sc);
 511
 512         /* drain USB transfers */
 513         for (x = 0; x != URTWN_N_TRANSFER; x++)
 514                 usbd_transfer_drain(sc->sc_xfer[x]);
 515
 516         /* Free data buffers. */
 517         URTWN_LOCK(sc);
 518         urtwn_free_tx_list(sc);
 519         urtwn_free_rx_list(sc);
 520         URTWN_UNLOCK(sc);
 521
 522         /* stop all USB transfers */
 523         usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
 524         ieee80211_ifdetach(ic);
 525
 526         if_free(ifp);
 527         mtx_destroy(&sc->sc_mtx);
 528
 529         return (0);
 530 }
 531
 532 static void
 533 urtwn_free_tx_list(struct urtwn_softc *sc)
 534 {
 535         urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
 536 }
 537
 538 static void
 539 urtwn_free_rx_list(struct urtwn_softc *sc)
 540 {
 541         urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
 542 }
 543
 544 static void
 545 urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
 546 {
 547         int i;
 548
 549         for (i = 0; i < ndata; i++) {
 550                 struct urtwn_data *dp = &data[i];
 551
 552                 if (dp->buf != NULL) {
 553                         free(dp->buf, M_USBDEV);
 554                         dp->buf = NULL;
 555                 }
 556                 if (dp->ni != NULL) {
 557                         ieee80211_free_node(dp->ni);
 558                         dp->ni = NULL;
 559                 }
 560         }
 561 }
 562
 563 static usb_error_t
 564 urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
 565     void *data)
 566 {
 567         usb_error_t err;
 568         int ntries = 10;
 569
 570         URTWN_ASSERT_LOCKED(sc);
 571
 572         while (ntries--) {
 573                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
 574                     req, data, 0, NULL, 250 /* ms */);
 575                 if (err == 0)
 576                         break;
 577
 578                 DPRINTFN(1, "Control request failed, %s (retrying)\n",
 579                     usbd_errstr(err));
 580                 usb_pause_mtx(&sc->sc_mtx, hz / 100);
 581         }
 582         return (err);
 583 }
 584
 585 static struct ieee80211vap *
 586 urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 587     enum ieee80211_opmode opmode, int flags,
 588     const uint8_t bssid[IEEE80211_ADDR_LEN],
 589     const uint8_t mac[IEEE80211_ADDR_LEN])
 590 {
 591         struct urtwn_vap *uvp;
 592         struct ieee80211vap *vap;
 593
 594         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
 595                 return (NULL);
 596
 597         uvp = (struct urtwn_vap *) malloc(sizeof(struct urtwn_vap),
 598             M_80211_VAP, M_NOWAIT | M_ZERO);
 599         if (uvp == NULL)
 600                 return (NULL);
 601         vap = &uvp->vap;
 602         /* enable s/w bmiss handling for sta mode */
 603
 604         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
 605             flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
 606                 /* out of memory */
 607                 free(uvp, M_80211_VAP);
 608                 return (NULL);
 609         }
 610
 611         /* override state transition machine */
 612         uvp->newstate = vap->iv_newstate;
 613         vap->iv_newstate = urtwn_newstate;
 614
 615         /* complete setup */
 616         ieee80211_vap_attach(vap, ieee80211_media_change,
 617             ieee80211_media_status);
 618         ic->ic_opmode = opmode;
 619         return (vap);
 620 }
 621
 622 static void
 623 urtwn_vap_delete(struct ieee80211vap *vap)
 624 {
 625         struct urtwn_vap *uvp = URTWN_VAP(vap);
 626
 627         ieee80211_vap_detach(vap);
 628         free(uvp, M_80211_VAP);
 629 }
 630
 631 static struct mbuf *
 632 urtwn_rx_frame(struct urtwn_softc *sc, uint8_t *buf, int pktlen, int *rssi_p)
 633 {
 634         struct ifnet *ifp = sc->sc_ifp;
 635         struct ieee80211com *ic = ifp->if_l2com;
 636         struct ieee80211_frame *wh;
 637         struct mbuf *m;
 638         struct r92c_rx_stat *stat;
 639         uint32_t rxdw0, rxdw3;
 640         uint8_t rate;
 641         int8_t rssi = 0;
 642         int infosz;
 643
 644         /*
 645          * don't pass packets to the ieee80211 framework if the driver isn't
 646          * RUNNING.
 647          */
 648         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
 649                 return (NULL);
 650
 651         stat = (struct r92c_rx_stat *)buf;
 652         rxdw0 = le32toh(stat->rxdw0);
 653         rxdw3 = le32toh(stat->rxdw3);
 654
 655         if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
 656                 /*
 657                  * This should not happen since we setup our Rx filter
 658                  * to not receive these frames.
 659                  */
 660                 ifp->if_ierrors++;
 661                 return (NULL);
 662         }
 663
 664         rate = MS(rxdw3, R92C_RXDW3_RATE);
 665         infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
 666
 667         /* Get RSSI from PHY status descriptor if present. */
 668         if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
 669                 if (sc->chip & URTWN_CHIP_88E)
 670                         rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
 671                 else
 672                         rssi = urtwn_get_rssi(sc, rate, &stat[1]);
 673                 /* Update our average RSSI. */
 674                 urtwn_update_avgrssi(sc, rate, rssi);
 675                 /*
 676                  * Convert the RSSI to a range that will be accepted
 677                  * by net80211.
 678                  */
 679                 rssi = URTWN_RSSI(rssi);
 680         }
 681
 682         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 683         if (m == NULL) {
 684                 device_printf(sc->sc_dev, "could not create RX mbuf\n");
 685                 return (NULL);
 686         }
 687
 688         /* Finalize mbuf. */
 689         m->m_pkthdr.rcvif = ifp;
 690         wh = (struct ieee80211_frame *)((uint8_t *)&stat[1] + infosz);
 691         memcpy(mtod(m, uint8_t *), wh, pktlen);
 692         m->m_pkthdr.len = m->m_len = pktlen;
 693
 694         if (ieee80211_radiotap_active(ic)) {
 695                 struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
 696
 697                 tap->wr_flags = 0;
 698                 /* Map HW rate index to 802.11 rate. */
 699                 if (!(rxdw3 & R92C_RXDW3_HT)) {
 700                         switch (rate) {
 701                         /* CCK. */
 702                         case  0: tap->wr_rate =   2; break;
 703                         case  1: tap->wr_rate =   4; break;
 704                         case  2: tap->wr_rate =  11; break;
 705                         case  3: tap->wr_rate =  22; break;
 706                         /* OFDM. */
 707                         case  4: tap->wr_rate =  12; break;
 708                         case  5: tap->wr_rate =  18; break;
 709                         case  6: tap->wr_rate =  24; break;
 710                         case  7: tap->wr_rate =  36; break;
 711                         case  8: tap->wr_rate =  48; break;
 712                         case  9: tap->wr_rate =  72; break;
 713                         case 10: tap->wr_rate =  96; break;
 714                         case 11: tap->wr_rate = 108; break;
 715                         }
 716                 } else if (rate >= 12) {        /* MCS0~15. */
 717                         /* Bit 7 set means HT MCS instead of rate. */
 718                         tap->wr_rate = 0x80 | (rate - 12);
 719                 }
 720                 tap->wr_dbm_antsignal = rssi;
 721                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
 722                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
 723         }
 724
 725         *rssi_p = rssi;
 726
 727         return (m);
 728 }
 729
 730 static struct mbuf *
 731 urtwn_rxeof(struct usb_xfer *xfer, struct urtwn_data *data, int *rssi,
 732     int8_t *nf)
 733 {
 734         struct urtwn_softc *sc = data->sc;
 735         struct ifnet *ifp = sc->sc_ifp;
 736         struct r92c_rx_stat *stat;
 737         struct mbuf *m, *m0 = NULL, *prevm = NULL;
 738         uint32_t rxdw0;
 739         uint8_t *buf;
 740         int len, totlen, pktlen, infosz, npkts;
 741
 742         usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
 743
 744         if (len < sizeof(*stat)) {
 745                 ifp->if_ierrors++;
 746                 return (NULL);
 747         }
 748
 749         buf = data->buf;
 750         /* Get the number of encapsulated frames. */
 751         stat = (struct r92c_rx_stat *)buf;
 752         npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
 753         DPRINTFN(6, "Rx %d frames in one chunk\n", npkts);
 754
 755         /* Process all of them. */
 756         while (npkts-- > 0) {
 757                 if (len < sizeof(*stat))
 758                         break;
 759                 stat = (struct r92c_rx_stat *)buf;
 760                 rxdw0 = le32toh(stat->rxdw0);
 761
 762                 pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
 763                 if (pktlen == 0)
 764                         break;
 765
 766                 infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
 767
 768                 /* Make sure everything fits in xfer. */
 769                 totlen = sizeof(*stat) + infosz + pktlen;
 770                 if (totlen > len)
 771                         break;
 772
 773                 m = urtwn_rx_frame(sc, buf, pktlen, rssi);
 774                 if (m0 == NULL)
 775                         m0 = m;
 776                 if (prevm == NULL)
 777                         prevm = m;
 778                 else {
 779                         prevm->m_next = m;
 780                         prevm = m;
 781                 }
 782
 783                 /* Next chunk is 128-byte aligned. */
 784                 totlen = (totlen + 127) & ~127;
 785                 buf += totlen;
 786                 len -= totlen;
 787         }
 788
 789         return (m0);
 790 }
 791
 792 static void
 793 urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
 794 {
 795         struct urtwn_softc *sc = usbd_xfer_softc(xfer);
 796         struct ifnet *ifp = sc->sc_ifp;
 797         struct ieee80211com *ic = ifp->if_l2com;
 798         struct ieee80211_frame *wh;
 799         struct ieee80211_node *ni;
 800         struct mbuf *m = NULL, *next;
 801         struct urtwn_data *data;
 802         int8_t nf;
 803         int rssi = 1;
 804
 805         URTWN_ASSERT_LOCKED(sc);
 806
 807         switch (USB_GET_STATE(xfer)) {
 808         case USB_ST_TRANSFERRED:
 809                 data = STAILQ_FIRST(&sc->sc_rx_active);
 810                 if (data == NULL)
 811                         goto tr_setup;
 812                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
 813                 m = urtwn_rxeof(xfer, data, &rssi, &nf);
 814                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
 815                 /* FALLTHROUGH */
 816         case USB_ST_SETUP:
 817 tr_setup:
 818                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
 819                 if (data == NULL) {
 820                         KASSERT(m == NULL, ("mbuf isn't NULL"));
 821                         return;
 822                 }
 823                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
 824                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
 825                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
 826                     usbd_xfer_max_len(xfer));
 827                 usbd_transfer_submit(xfer);
 828
 829                 /*
 830                  * To avoid LOR we should unlock our private mutex here to call
 831                  * ieee80211_input() because here is at the end of a USB
 832                  * callback and safe to unlock.
 833                  */
 834                 URTWN_UNLOCK(sc);
 835                 while (m != NULL) {
 836                         next = m->m_next;
 837                         m->m_next = NULL;
 838                         wh = mtod(m, struct ieee80211_frame *);
 839                         ni = ieee80211_find_rxnode(ic,
 840                             (struct ieee80211_frame_min *)wh);
 841                         nf = URTWN_NOISE_FLOOR;
 842                         if (ni != NULL) {
 843                                 (void)ieee80211_input(ni, m, rssi, nf);
 844                                 ieee80211_free_node(ni);
 845                         } else
 846                                 (void)ieee80211_input_all(ic, m, rssi, nf);
 847                         m = next;
 848                 }
 849                 URTWN_LOCK(sc);
 850                 break;
 851         default:
 852                 /* needs it to the inactive queue due to a error. */
 853                 data = STAILQ_FIRST(&sc->sc_rx_active);
 854                 if (data != NULL) {
 855                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
 856                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
 857                 }
 858                 if (error != USB_ERR_CANCELLED) {
 859                         usbd_xfer_set_stall(xfer);
 860                         ifp->if_ierrors++;
 861                         goto tr_setup;
 862                 }
 863                 break;
 864         }
 865 }
 866
 867 static void
 868 urtwn_txeof(struct usb_xfer *xfer, struct urtwn_data *data)
 869 {
 870         struct urtwn_softc *sc = usbd_xfer_softc(xfer);
 871         struct ifnet *ifp = sc->sc_ifp;
 872         struct mbuf *m;
 873
 874         URTWN_ASSERT_LOCKED(sc);
 875
 876         /*
 877          * Do any tx complete callback.  Note this must be done before releasing
 878          * the node reference.
 879          */
 880         if (data->m) {
 881                 m = data->m;
 882                 if (m->m_flags & M_TXCB) {
 883                         /* XXX status? */
 884                         ieee80211_process_callback(data->ni, m, 0);
 885                 }
 886                 m_freem(m);
 887                 data->m = NULL;
 888         }
 889         if (data->ni) {
 890                 ieee80211_free_node(data->ni);
 891                 data->ni = NULL;
 892         }
 893         sc->sc_txtimer = 0;
 894         ifp->if_opackets++;
 895         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
 896 }
 897
 898 static void
 899 urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
 900 {
 901         struct urtwn_softc *sc = usbd_xfer_softc(xfer);
 902         struct ifnet *ifp = sc->sc_ifp;
 903         struct urtwn_data *data;
 904
 905         URTWN_ASSERT_LOCKED(sc);
 906
 907         switch (USB_GET_STATE(xfer)){
 908         case USB_ST_TRANSFERRED:
 909                 data = STAILQ_FIRST(&sc->sc_tx_active);
 910                 if (data == NULL)
 911                         goto tr_setup;
 912                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
 913                 urtwn_txeof(xfer, data);
 914                 STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
 915                 /* FALLTHROUGH */
 916         case USB_ST_SETUP:
 917 tr_setup:
 918                 data = STAILQ_FIRST(&sc->sc_tx_pending);
 919                 if (data == NULL) {
 920                         DPRINTF("%s: empty pending queue\n", __func__);
 921                         return;
 922                 }
 923                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
 924                 STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
 925                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
 926                 usbd_transfer_submit(xfer);
 927                 urtwn_start_locked(ifp, sc);
 928                 break;
 929         default:
 930                 data = STAILQ_FIRST(&sc->sc_tx_active);
 931                 if (data == NULL)
 932                         goto tr_setup;
 933                 if (data->ni != NULL) {
 934                         ieee80211_free_node(data->ni);
 935                         data->ni = NULL;
 936                         ifp->if_oerrors++;
 937                 }
 938                 if (error != USB_ERR_CANCELLED) {
 939                         usbd_xfer_set_stall(xfer);
 940                         goto tr_setup;
 941                 }
 942                 break;
 943         }
 944 }
 945
 946 static struct urtwn_data *
 947 _urtwn_getbuf(struct urtwn_softc *sc)
 948 {
 949         struct urtwn_data *bf;
 950
 951         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
 952         if (bf != NULL)
 953                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
 954         else
 955                 bf = NULL;
 956         if (bf == NULL)
 957                 DPRINTF("%s: %s\n", __func__, "out of xmit buffers");
 958         return (bf);
 959 }
 960
 961 static struct urtwn_data *
 962 urtwn_getbuf(struct urtwn_softc *sc)
 963 {
 964         struct urtwn_data *bf;
 965
 966         URTWN_ASSERT_LOCKED(sc);
 967
 968         bf = _urtwn_getbuf(sc);
 969         if (bf == NULL) {
 970                 struct ifnet *ifp = sc->sc_ifp;
 971                 DPRINTF("%s: stop queue\n", __func__);
 972                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
 973         }
 974         return (bf);
 975 }
 976
 977 static int
 978 urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
 979     int len)
 980 {
 981         usb_device_request_t req;
 982
 983         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
 984         req.bRequest = R92C_REQ_REGS;
 985         USETW(req.wValue, addr);
 986         USETW(req.wIndex, 0);
 987         USETW(req.wLength, len);
 988         return (urtwn_do_request(sc, &req, buf));
 989 }
 990
 991 static void
 992 urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
 993 {
 994         urtwn_write_region_1(sc, addr, &val, 1);
 995 }
 996
 997
 998 static void
 999 urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1000 {
1001         val = htole16(val);
1002         urtwn_write_region_1(sc, addr, (uint8_t *)&val, 2);
1003 }
1004
1005 static void
1006 urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1007 {
1008         val = htole32(val);
1009         urtwn_write_region_1(sc, addr, (uint8_t *)&val, 4);
1010 }
1011
1012 static int
1013 urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1014     int len)
1015 {
1016         usb_device_request_t req;
1017
1018         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1019         req.bRequest = R92C_REQ_REGS;
1020         USETW(req.wValue, addr);
1021         USETW(req.wIndex, 0);
1022         USETW(req.wLength, len);
1023         return (urtwn_do_request(sc, &req, buf));
1024 }
1025
1026 static uint8_t
1027 urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1028 {
1029         uint8_t val;
1030
1031         if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1032                 return (0xff);
1033         return (val);
1034 }
1035
1036 static uint16_t
1037 urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1038 {
1039         uint16_t val;
1040
1041         if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1042                 return (0xffff);
1043         return (le16toh(val));
1044 }
1045
1046 static uint32_t
1047 urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1048 {
1049         uint32_t val;
1050
1051         if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1052                 return (0xffffffff);
1053         return (le32toh(val));
1054 }
1055
1056 static int
1057 urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1058 {
1059         struct r92c_fw_cmd cmd;
1060         int ntries;
1061
1062         /* Wait for current FW box to be empty. */
1063         for (ntries = 0; ntries < 100; ntries++) {
1064                 if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1065                         break;
1066                 urtwn_ms_delay(sc);
1067         }
1068         if (ntries == 100) {
1069                 device_printf(sc->sc_dev,
1070                     "could not send firmware command\n");
1071                 return (ETIMEDOUT);
1072         }
1073         memset(&cmd, 0, sizeof(cmd));
1074         cmd.id = id;
1075         if (len > 3)
1076                 cmd.id |= R92C_CMD_FLAG_EXT;
1077         KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1078         memcpy(cmd.msg, buf, len);
1079
1080         /* Write the first word last since that will trigger the FW. */
1081         urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1082             (uint8_t *)&cmd + 4, 2);
1083         urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1084             (uint8_t *)&cmd + 0, 4);
1085
1086         sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1087         return (0);
1088 }
1089
1090 static __inline void
1091 urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1092 {
1093
1094         sc->sc_rf_write(sc, chain, addr, val);
1095 }
1096
1097 static void
1098 urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1099     uint32_t val)
1100 {
1101         urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1102             SM(R92C_LSSI_PARAM_ADDR, addr) |
1103             SM(R92C_LSSI_PARAM_DATA, val));
1104 }
1105
1106 static void
1107 urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1108 uint32_t val)
1109 {
1110         urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1111             SM(R88E_LSSI_PARAM_ADDR, addr) |
1112             SM(R92C_LSSI_PARAM_DATA, val));
1113 }
1114
1115 static uint32_t
1116 urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1117 {
1118         uint32_t reg[R92C_MAX_CHAINS], val;
1119
1120         reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1121         if (chain != 0)
1122                 reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1123
1124         urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1125             reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1126         urtwn_ms_delay(sc);
1127
1128         urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1129             RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1130             R92C_HSSI_PARAM2_READ_EDGE);
1131         urtwn_ms_delay(sc);
1132
1133         urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1134             reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1135         urtwn_ms_delay(sc);
1136
1137         if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1138                 val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1139         else
1140                 val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1141         return (MS(val, R92C_LSSI_READBACK_DATA));
1142 }
1143
1144 static int
1145 urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1146 {
1147         int ntries;
1148
1149         urtwn_write_4(sc, R92C_LLT_INIT,
1150             SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1151             SM(R92C_LLT_INIT_ADDR, addr) |
1152             SM(R92C_LLT_INIT_DATA, data));
1153         /* Wait for write operation to complete. */
1154         for (ntries = 0; ntries < 20; ntries++) {
1155                 if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1156                     R92C_LLT_INIT_OP_NO_ACTIVE)
1157                         return (0);
1158                 urtwn_ms_delay(sc);
1159         }
1160         return (ETIMEDOUT);
1161 }
1162
1163 static uint8_t
1164 urtwn_efuse_read_1(struct urtwn_softc *sc, uint16_t addr)
1165 {
1166         uint32_t reg;
1167         int ntries;
1168
1169         reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1170         reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
1171         reg &= ~R92C_EFUSE_CTRL_VALID;
1172         urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1173         /* Wait for read operation to complete. */
1174         for (ntries = 0; ntries < 100; ntries++) {
1175                 reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1176                 if (reg & R92C_EFUSE_CTRL_VALID)
1177                         return (MS(reg, R92C_EFUSE_CTRL_DATA));
1178                 urtwn_ms_delay(sc);
1179         }
1180         device_printf(sc->sc_dev,
1181             "could not read efuse byte at address 0x%x\n", addr);
1182         return (0xff);
1183 }
1184
1185 static void
1186 urtwn_efuse_read(struct urtwn_softc *sc)
1187 {
1188         uint8_t *rom = (uint8_t *)&sc->rom;
1189         uint16_t addr = 0;
1190         uint32_t reg;
1191         uint8_t off, msk, vol;
1192         int i;
1193
1194         urtwn_efuse_switch_power(sc);
1195
1196         memset(&sc->rom, 0xff, sizeof(sc->rom));
1197         while (addr < 512) {
1198                 reg = urtwn_efuse_read_1(sc, addr);
1199                 if (reg == 0xff)
1200                         break;
1201                 addr++;
1202                 off = reg >> 4;
1203                 msk = reg & 0xf;
1204                 for (i = 0; i < 4; i++) {
1205                         if (msk & (1 << i))
1206                                 continue;
1207                         rom[off * 8 + i * 2 + 0] =
1208                             urtwn_efuse_read_1(sc, addr);
1209                         addr++;
1210                         rom[off * 8 + i * 2 + 1] =
1211                             urtwn_efuse_read_1(sc, addr);
1212                         addr++;
1213                 }
1214         }
1215 #ifdef URTWN_DEBUG
1216         if (urtwn_debug >= 2) {
1217                 /* Dump ROM content. */
1218                 printf("\n");
1219                 for (i = 0; i < sizeof(sc->rom); i++)
1220                         printf("%02x:", rom[i]);
1221                 printf("\n");
1222         }
1223 #endif
1224         /* Disable LDO 2.5V. */
1225         vol = urtwn_read_1(sc, R92C_EFUSE_TEST + 3);
1226         urtwn_write_1(sc, R92C_EFUSE_TEST + 3, vol & ~(0x80));
1227
1228 }
1229 static void
1230 urtwn_efuse_switch_power(struct urtwn_softc *sc)
1231 {
1232         uint32_t reg;
1233
1234         if (sc->chip & URTWN_CHIP_88E)
1235                 urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1236
1237         reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1238         if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1239                 urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1240                     reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1241         }
1242         reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1243         if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1244                 urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1245                     reg | R92C_SYS_FUNC_EN_ELDR);
1246         }
1247         reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1248         if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1249             (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1250                 urtwn_write_2(sc, R92C_SYS_CLKR,
1251                     reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1252         }
1253
1254         if (!(sc->chip & URTWN_CHIP_88E)) {
1255                 uint8_t vol;
1256
1257                 /* Enable LDO 2.5V. */
1258                 vol = urtwn_read_1(sc, R92C_EFUSE_TEST + 3);
1259                 vol &= 0x0f;
1260                 vol |= 0x30;
1261                 urtwn_write_1(sc, R92C_EFUSE_TEST + 3, (vol | 0x80));
1262         }
1263 }
1264
1265 static int
1266 urtwn_read_chipid(struct urtwn_softc *sc)
1267 {
1268         uint32_t reg;
1269
1270         if (sc->chip & URTWN_CHIP_88E)
1271                 return (0);
1272
1273         reg = urtwn_read_4(sc, R92C_SYS_CFG);
1274         if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1275                 return (EIO);
1276
1277         if (reg & R92C_SYS_CFG_TYPE_92C) {
1278                 sc->chip |= URTWN_CHIP_92C;
1279                 /* Check if it is a castrated 8192C. */
1280                 if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1281                     R92C_HPON_FSM_CHIP_BONDING_ID) ==
1282                     R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1283                         sc->chip |= URTWN_CHIP_92C_1T2R;
1284         }
1285         if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1286                 sc->chip |= URTWN_CHIP_UMC;
1287                 if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1288                         sc->chip |= URTWN_CHIP_UMC_A_CUT;
1289         }
1290         return (0);
1291 }
1292
1293 static void
1294 urtwn_read_rom(struct urtwn_softc *sc)
1295 {
1296         struct r92c_rom *rom = &sc->rom;
1297
1298         /* Read full ROM image. */
1299         urtwn_efuse_read(sc);
1300
1301         /* XXX Weird but this is what the vendor driver does. */
1302         sc->pa_setting = urtwn_efuse_read_1(sc, 0x1fa);
1303         DPRINTF("PA setting=0x%x\n", sc->pa_setting);
1304
1305         sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1306
1307         sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1308         DPRINTF("regulatory type=%d\n", sc->regulatory);
1309         IEEE80211_ADDR_COPY(sc->sc_bssid, rom->macaddr);
1310
1311         sc->sc_rf_write = urtwn_r92c_rf_write;
1312         sc->sc_power_on = urtwn_r92c_power_on;
1313         sc->sc_dma_init = urtwn_r92c_dma_init;
1314 }
1315
1316 static void
1317 urtwn_r88e_read_rom(struct urtwn_softc *sc)
1318 {
1319         uint8_t *rom = sc->r88e_rom;
1320         uint16_t addr = 0;
1321         uint32_t reg;
1322         uint8_t off, msk, tmp;
1323         int i;
1324
1325         off = 0;
1326         urtwn_efuse_switch_power(sc);
1327
1328         /* Read full ROM image. */
1329         memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
1330         while (addr < 512) {
1331                 reg = urtwn_efuse_read_1(sc, addr);
1332                 if (reg == 0xff)
1333                         break;
1334                 addr++;
1335                 if ((reg & 0x1f) == 0x0f) {
1336                         tmp = (reg & 0xe0) >> 5;
1337                         reg = urtwn_efuse_read_1(sc, addr);
1338                         if ((reg & 0x0f) != 0x0f)
1339                                 off = ((reg & 0xf0) >> 1) | tmp;
1340                         addr++;
1341                 } else
1342                         off = reg >> 4;
1343                 msk = reg & 0xf;
1344                 for (i = 0; i < 4; i++) {
1345                         if (msk & (1 << i))
1346                                 continue;
1347                         rom[off * 8 + i * 2 + 0] =
1348                             urtwn_efuse_read_1(sc, addr);
1349                         addr++;
1350                         rom[off * 8 + i * 2 + 1] =
1351                             urtwn_efuse_read_1(sc, addr);
1352                         addr++;
1353                 }
1354         }
1355
1356         urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1357
1358         addr = 0x10;
1359         for (i = 0; i < 6; i++)
1360                 sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
1361         for (i = 0; i < 5; i++)
1362                 sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
1363         sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
1364         if (sc->bw20_tx_pwr_diff & 0x08)
1365                 sc->bw20_tx_pwr_diff |= 0xf0;
1366         sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
1367         if (sc->ofdm_tx_pwr_diff & 0x08)
1368                 sc->ofdm_tx_pwr_diff |= 0xf0;
1369         sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
1370         IEEE80211_ADDR_COPY(sc->sc_bssid, &sc->r88e_rom[0xd7]);
1371
1372         sc->sc_rf_write = urtwn_r88e_rf_write;
1373         sc->sc_power_on = urtwn_r88e_power_on;
1374         sc->sc_dma_init = urtwn_r88e_dma_init;
1375 }
1376
1377 /*
1378  * Initialize rate adaptation in firmware.
1379  */
1380 static int
1381 urtwn_ra_init(struct urtwn_softc *sc)
1382 {
1383         static const uint8_t map[] =
1384             { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
1385         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1386         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1387         struct ieee80211_node *ni;
1388         struct ieee80211_rateset *rs;
1389         struct r92c_fw_cmd_macid_cfg cmd;
1390         uint32_t rates, basicrates;
1391         uint8_t mode;
1392         int maxrate, maxbasicrate, error, i, j;
1393
1394         ni = ieee80211_ref_node(vap->iv_bss);
1395         rs = &ni->ni_rates;
1396
1397         /* Get normal and basic rates mask. */
1398         rates = basicrates = 0;
1399         maxrate = maxbasicrate = 0;
1400         for (i = 0; i < rs->rs_nrates; i++) {
1401                 /* Convert 802.11 rate to HW rate index. */
1402                 for (j = 0; j < nitems(map); j++)
1403                         if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
1404                                 break;
1405                 if (j == nitems(map))   /* Unknown rate, skip. */
1406                         continue;
1407                 rates |= 1 << j;
1408                 if (j > maxrate)
1409                         maxrate = j;
1410                 if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1411                         basicrates |= 1 << j;
1412                         if (j > maxbasicrate)
1413                                 maxbasicrate = j;
1414                 }
1415         }
1416         if (ic->ic_curmode == IEEE80211_MODE_11B)
1417                 mode = R92C_RAID_11B;
1418         else
1419                 mode = R92C_RAID_11BG;
1420         DPRINTF("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1421             mode, rates, basicrates);
1422
1423         /* Set rates mask for group addressed frames. */
1424         cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
1425         cmd.mask = htole32(mode << 28 | basicrates);
1426         error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1427         if (error != 0) {
1428                 ieee80211_free_node(ni);
1429                 device_printf(sc->sc_dev,
1430                     "could not add broadcast station\n");
1431                 return (error);
1432         }
1433         /* Set initial MRR rate. */
1434         DPRINTF("maxbasicrate=%d\n", maxbasicrate);
1435         urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
1436             maxbasicrate);
1437
1438         /* Set rates mask for unicast frames. */
1439         cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
1440         cmd.mask = htole32(mode << 28 | rates);
1441         error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1442         if (error != 0) {
1443                 ieee80211_free_node(ni);
1444                 device_printf(sc->sc_dev, "could not add BSS station\n");
1445                 return (error);
1446         }
1447         /* Set initial MRR rate. */
1448         DPRINTF("maxrate=%d\n", maxrate);
1449         urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
1450             maxrate);
1451
1452         /* Indicate highest supported rate. */
1453         ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1454         ieee80211_free_node(ni);
1455
1456         return (0);
1457 }
1458
1459 void
1460 urtwn_tsf_sync_enable(struct urtwn_softc *sc)
1461 {
1462         struct ifnet *ifp = sc->sc_ifp;
1463         struct ieee80211com *ic = ifp->if_l2com;
1464         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1465         struct ieee80211_node *ni = vap->iv_bss;
1466
1467         uint64_t tsf;
1468
1469         /* Enable TSF synchronization. */
1470         urtwn_write_1(sc, R92C_BCN_CTRL,
1471             urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1472
1473         urtwn_write_1(sc, R92C_BCN_CTRL,
1474             urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1475
1476         /* Set initial TSF. */
1477         memcpy(&tsf, ni->ni_tstamp.data, 8);
1478         tsf = le64toh(tsf);
1479         tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1480         tsf -= IEEE80211_DUR_TU;
1481         urtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1482         urtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1483
1484         urtwn_write_1(sc, R92C_BCN_CTRL,
1485             urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1486 }
1487
1488 static void
1489 urtwn_set_led(struct urtwn_softc *sc, int led, int on)
1490 {
1491         uint8_t reg;
1492
1493         if (led == URTWN_LED_LINK) {
1494                 if (sc->chip & URTWN_CHIP_88E) {
1495                         reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1496                         urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
1497                         if (!on) {
1498                                 reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
1499                                 urtwn_write_1(sc, R92C_LEDCFG2,
1500                                     reg | R92C_LEDCFG0_DIS);
1501                                 urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
1502                                     urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
1503                                     0xfe);
1504                         }
1505                 } else {
1506                         reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
1507                         if (!on)
1508                                 reg |= R92C_LEDCFG0_DIS;
1509                         urtwn_write_1(sc, R92C_LEDCFG0, reg);
1510                 }
1511                 sc->ledlink = on;       /* Save LED state. */
1512         }
1513 }
1514
1515 static int
1516 urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1517 {
1518         struct urtwn_vap *uvp = URTWN_VAP(vap);
1519         struct ieee80211com *ic = vap->iv_ic;
1520         struct urtwn_softc *sc = ic->ic_ifp->if_softc;
1521         struct ieee80211_node *ni;
1522         enum ieee80211_state ostate;
1523         uint32_t reg;
1524
1525         ostate = vap->iv_state;
1526         DPRINTF("%s -> %s\n", ieee80211_state_name[ostate],
1527             ieee80211_state_name[nstate]);
1528
1529         IEEE80211_UNLOCK(ic);
1530         URTWN_LOCK(sc);
1531         callout_stop(&sc->sc_watchdog_ch);
1532
1533         if (ostate == IEEE80211_S_RUN) {
1534                 /* Turn link LED off. */
1535                 urtwn_set_led(sc, URTWN_LED_LINK, 0);
1536
1537                 /* Set media status to 'No Link'. */
1538                 reg = urtwn_read_4(sc, R92C_CR);
1539                 reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1540                 urtwn_write_4(sc, R92C_CR, reg);
1541
1542                 /* Stop Rx of data frames. */
1543                 urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1544
1545                 /* Rest TSF. */
1546                 urtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1547
1548                 /* Disable TSF synchronization. */
1549                 urtwn_write_1(sc, R92C_BCN_CTRL,
1550                     urtwn_read_1(sc, R92C_BCN_CTRL) |
1551                     R92C_BCN_CTRL_DIS_TSF_UDT0);
1552
1553                 /* Reset EDCA parameters. */
1554                 urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1555                 urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1556                 urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1557                 urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1558         }
1559
1560         switch (nstate) {
1561         case IEEE80211_S_INIT:
1562                 /* Turn link LED off. */
1563                 urtwn_set_led(sc, URTWN_LED_LINK, 0);
1564                 break;
1565         case IEEE80211_S_SCAN:
1566                 if (ostate != IEEE80211_S_SCAN) {
1567                         /* Allow Rx from any BSSID. */
1568                         urtwn_write_4(sc, R92C_RCR,
1569                             urtwn_read_4(sc, R92C_RCR) &
1570                             ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1571
1572                         /* Set gain for scanning. */
1573                         reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1574                         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1575                         urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1576
1577                         if (!(sc->chip & URTWN_CHIP_88E)) {
1578                                 reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1579                                 reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1580                                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1581                         }
1582                 }
1583                 /* Pause AC Tx queues. */
1584                 urtwn_write_1(sc, R92C_TXPAUSE,
1585                     urtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1586                 break;
1587         case IEEE80211_S_AUTH:
1588                 /* Set initial gain under link. */
1589                 reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1590                 reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1591                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1592
1593                 if (!(sc->chip & URTWN_CHIP_88E)) {
1594                         reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1595                         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1596                         urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1597                 }
1598                 urtwn_set_chan(sc, ic->ic_curchan, NULL);
1599                 break;
1600         case IEEE80211_S_RUN:
1601                 if (vap->iv_opmode == IEEE80211_M_MONITOR) {
1602                         /* Enable Rx of data frames. */
1603                         urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1604
1605                         /* Turn link LED on. */
1606                         urtwn_set_led(sc, URTWN_LED_LINK, 1);
1607                         break;
1608                 }
1609
1610                 ni = ieee80211_ref_node(vap->iv_bss);
1611                 /* Set media status to 'Associated'. */
1612                 reg = urtwn_read_4(sc, R92C_CR);
1613                 reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1614                 urtwn_write_4(sc, R92C_CR, reg);
1615
1616                 /* Set BSSID. */
1617                 urtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1618                 urtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1619
1620                 if (ic->ic_curmode == IEEE80211_MODE_11B)
1621                         urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1622                 else    /* 802.11b/g */
1623                         urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1624
1625                 /* Enable Rx of data frames. */
1626                 urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1627
1628                 /* Flush all AC queues. */
1629                 urtwn_write_1(sc, R92C_TXPAUSE, 0);
1630
1631                 /* Set beacon interval. */
1632                 urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1633
1634                 /* Allow Rx from our BSSID only. */
1635                 urtwn_write_4(sc, R92C_RCR,
1636                     urtwn_read_4(sc, R92C_RCR) |
1637                     R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1638
1639                 /* Enable TSF synchronization. */
1640                 urtwn_tsf_sync_enable(sc);
1641
1642                 urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1643                 urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1644                 urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1645                 urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1646                 urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1647                 urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1648
1649                 /* Intialize rate adaptation. */
1650                 if (sc->chip & URTWN_CHIP_88E)
1651                         ni->ni_txrate =
1652                             ni->ni_rates.rs_rates[ni->ni_rates.rs_nrates-1];
1653                 else
1654                         urtwn_ra_init(sc);
1655                 /* Turn link LED on. */
1656                 urtwn_set_led(sc, URTWN_LED_LINK, 1);
1657
1658                 sc->avg_pwdb = -1;      /* Reset average RSSI. */
1659                 /* Reset temperature calibration state machine. */
1660                 sc->thcal_state = 0;
1661                 sc->thcal_lctemp = 0;
1662                 ieee80211_free_node(ni);
1663                 break;
1664         default:
1665                 break;
1666         }
1667         URTWN_UNLOCK(sc);
1668         IEEE80211_LOCK(ic);
1669         return(uvp->newstate(vap, nstate, arg));
1670 }
1671
1672 static void
1673 urtwn_watchdog(void *arg)
1674 {
1675         struct urtwn_softc *sc = arg;
1676         struct ifnet *ifp = sc->sc_ifp;
1677
1678         if (sc->sc_txtimer > 0) {
1679                 if (--sc->sc_txtimer == 0) {
1680                         device_printf(sc->sc_dev, "device timeout\n");
1681                         ifp->if_oerrors++;
1682                         return;
1683                 }
1684                 callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1685         }
1686 }
1687
1688 static void
1689 urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
1690 {
1691         int pwdb;
1692
1693         /* Convert antenna signal to percentage. */
1694         if (rssi <= -100 || rssi >= 20)
1695                 pwdb = 0;
1696         else if (rssi >= 0)
1697                 pwdb = 100;
1698         else
1699                 pwdb = 100 + rssi;
1700         if (!(sc->chip & URTWN_CHIP_88E)) {
1701                 if (rate <= 3) {
1702                         /* CCK gain is smaller than OFDM/MCS gain. */
1703                         pwdb += 6;
1704                         if (pwdb > 100)
1705                                 pwdb = 100;
1706                         if (pwdb <= 14)
1707                                 pwdb -= 4;
1708                         else if (pwdb <= 26)
1709                                 pwdb -= 8;
1710                         else if (pwdb <= 34)
1711                                 pwdb -= 6;
1712                         else if (pwdb <= 42)
1713                                 pwdb -= 2;
1714                 }
1715         }
1716         if (sc->avg_pwdb == -1) /* Init. */
1717                 sc->avg_pwdb = pwdb;
1718         else if (sc->avg_pwdb < pwdb)
1719                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1720         else
1721                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1722         DPRINTFN(4, "PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb);
1723 }
1724
1725 static int8_t
1726 urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1727 {
1728         static const int8_t cckoff[] = { 16, -12, -26, -46 };
1729         struct r92c_rx_phystat *phy;
1730         struct r92c_rx_cck *cck;
1731         uint8_t rpt;
1732         int8_t rssi;
1733
1734         if (rate <= 3) {
1735                 cck = (struct r92c_rx_cck *)physt;
1736                 if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
1737                         rpt = (cck->agc_rpt >> 5) & 0x3;
1738                         rssi = (cck->agc_rpt & 0x1f) << 1;
1739                 } else {
1740                         rpt = (cck->agc_rpt >> 6) & 0x3;
1741                         rssi = cck->agc_rpt & 0x3e;
1742                 }
1743                 rssi = cckoff[rpt] - rssi;
1744         } else {        /* OFDM/HT. */
1745                 phy = (struct r92c_rx_phystat *)physt;
1746                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1747         }
1748         return (rssi);
1749 }
1750
1751 static int8_t
1752 urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
1753 {
1754         struct r92c_rx_phystat *phy;
1755         struct r88e_rx_cck *cck;
1756         uint8_t cck_agc_rpt, lna_idx, vga_idx;
1757         int8_t rssi;
1758
1759         rssi = 0;
1760         if (rate <= 3) {
1761                 cck = (struct r88e_rx_cck *)physt;
1762                 cck_agc_rpt = cck->agc_rpt;
1763                 lna_idx = (cck_agc_rpt & 0xe0) >> 5;
1764                 vga_idx = cck_agc_rpt & 0x1f;
1765                 switch (lna_idx) {
1766                 case 7:
1767                         if (vga_idx <= 27)
1768                                 rssi = -100 + 2* (27 - vga_idx);
1769                         else
1770                                 rssi = -100;
1771                         break;
1772                 case 6:
1773                         rssi = -48 + 2 * (2 - vga_idx);
1774                         break;
1775                 case 5:
1776                         rssi = -42 + 2 * (7 - vga_idx);
1777                         break;
1778                 case 4:
1779                         rssi = -36 + 2 * (7 - vga_idx);
1780                         break;
1781                 case 3:
1782                         rssi = -24 + 2 * (7 - vga_idx);
1783                         break;
1784                 case 2:
1785                         rssi = -12 + 2 * (5 - vga_idx);
1786                         break;
1787                 case 1:
1788                         rssi = 8 - (2 * vga_idx);
1789                         break;
1790                 case 0:
1791                         rssi = 14 - (2 * vga_idx);
1792                         break;
1793                 }
1794                 rssi += 6;
1795         } else {        /* OFDM/HT. */
1796                 phy = (struct r92c_rx_phystat *)physt;
1797                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1798         }
1799         return (rssi);
1800 }
1801
1802
1803 static int
1804 urtwn_tx_start(struct urtwn_softc *sc, struct ieee80211_node *ni,
1805     struct mbuf *m0, struct urtwn_data *data)
1806 {
1807         struct ifnet *ifp = sc->sc_ifp;
1808         struct ieee80211_frame *wh;
1809         struct ieee80211_key *k;
1810         struct ieee80211com *ic = ifp->if_l2com;
1811         struct ieee80211vap *vap = ni->ni_vap;
1812         struct usb_xfer *xfer;
1813         struct r92c_tx_desc *txd;
1814         uint8_t raid, type;
1815         uint16_t sum;
1816         int i, hasqos, xferlen;
1817         struct usb_xfer *urtwn_pipes[4] = {
1818                 sc->sc_xfer[URTWN_BULK_TX_BE],
1819                 sc->sc_xfer[URTWN_BULK_TX_BK],
1820                 sc->sc_xfer[URTWN_BULK_TX_VI],
1821                 sc->sc_xfer[URTWN_BULK_TX_VO]
1822         };
1823
1824         URTWN_ASSERT_LOCKED(sc);
1825
1826         /*
1827          * Software crypto.
1828          */
1829         wh = mtod(m0, struct ieee80211_frame *);
1830         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1831
1832         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1833                 k = ieee80211_crypto_encap(ni, m0);
1834                 if (k == NULL) {
1835                         device_printf(sc->sc_dev,
1836                             "ieee80211_crypto_encap returns NULL.\n");
1837                         /* XXX we don't expect the fragmented frames */
1838                         m_freem(m0);
1839                         return (ENOBUFS);
1840                 }
1841
1842                 /* in case packet header moved, reset pointer */
1843                 wh = mtod(m0, struct ieee80211_frame *);
1844         }
1845
1846         switch (type) {
1847         case IEEE80211_FC0_TYPE_CTL:
1848         case IEEE80211_FC0_TYPE_MGT:
1849                 xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
1850                 break;
1851         default:
1852                 KASSERT(M_WME_GETAC(m0) < 4,
1853                     ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1854                 xfer = urtwn_pipes[M_WME_GETAC(m0)];
1855                 break;
1856         }
1857
1858         hasqos = 0;
1859
1860         /* Fill Tx descriptor. */
1861         txd = (struct r92c_tx_desc *)data->buf;
1862         memset(txd, 0, sizeof(*txd));
1863
1864         txd->txdw0 |= htole32(
1865             SM(R92C_TXDW0_PKTLEN, m0->m_pkthdr.len) |
1866             SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1867             R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1868         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1869                 txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1870         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1871             type == IEEE80211_FC0_TYPE_DATA) {
1872                 if (ic->ic_curmode == IEEE80211_MODE_11B)
1873                         raid = R92C_RAID_11B;
1874                 else
1875                         raid = R92C_RAID_11BG;
1876                 if (sc->chip & URTWN_CHIP_88E) {
1877                         txd->txdw1 |= htole32(
1878                             SM(R88E_TXDW1_MACID, URTWN_MACID_BSS) |
1879                             SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1880                             SM(R92C_TXDW1_RAID, raid));
1881                         txd->txdw2 |= htole32(R88E_TXDW2_AGGBK);
1882                 } else {
1883                         txd->txdw1 |= htole32(
1884                             SM(R92C_TXDW1_MACID, URTWN_MACID_BSS) |
1885                             SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1886                             SM(R92C_TXDW1_RAID, raid) | R92C_TXDW1_AGGBK);
1887                 }
1888                 if (ic->ic_flags & IEEE80211_F_USEPROT) {
1889                         if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1890                                 txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1891                                     R92C_TXDW4_HWRTSEN);
1892                         } else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1893                                 txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1894                                     R92C_TXDW4_HWRTSEN);
1895                         }
1896                 }
1897                 /* Send RTS at OFDM24. */
1898                 txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE, 8));
1899                 txd->txdw5 |= htole32(0x0001ff00);
1900                 /* Send data at OFDM54. */
1901                 if (sc->chip & URTWN_CHIP_88E)
1902                         txd->txdw5 |= htole32(0x13 & 0x3f);
1903                 else
1904                         txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 11));
1905         } else {
1906                 txd->txdw1 |= htole32(
1907                     SM(R92C_TXDW1_MACID, 0) |
1908                     SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1909                     SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1910
1911                 /* Force CCK1. */
1912                 txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1913                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, 0));
1914         }
1915         /* Set sequence number (already little endian). */
1916         txd->txdseq |= *(uint16_t *)wh->i_seq;
1917
1918         if (!hasqos) {
1919                 /* Use HW sequence numbering for non-QoS frames. */
1920                 txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1921                 txd->txdseq |= htole16(0x8000);
1922         } else
1923                 txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1924
1925         /* Compute Tx descriptor checksum. */
1926         sum = 0;
1927         for (i = 0; i < sizeof(*txd) / 2; i++)
1928                 sum ^= ((uint16_t *)txd)[i];
1929         txd->txdsum = sum;      /* NB: already little endian. */
1930
1931         if (ieee80211_radiotap_active_vap(vap)) {
1932                 struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1933
1934                 tap->wt_flags = 0;
1935                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1936                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1937                 ieee80211_radiotap_tx(vap, m0);
1938         }
1939
1940         xferlen = sizeof(*txd) + m0->m_pkthdr.len;
1941         m_copydata(m0, 0, m0->m_pkthdr.len, (caddr_t)&txd[1]);
1942
1943         data->buflen = xferlen;
1944         data->ni = ni;
1945         data->m = m0;
1946
1947         STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1948         usbd_transfer_start(xfer);
1949         return (0);
1950 }
1951
1952 static void
1953 urtwn_start(struct ifnet *ifp)
1954 {
1955         struct urtwn_softc *sc = ifp->if_softc;
1956
1957         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1958                 return;
1959         URTWN_LOCK(sc);
1960         urtwn_start_locked(ifp, sc);
1961         URTWN_UNLOCK(sc);
1962 }
1963
1964 static void
1965 urtwn_start_locked(struct ifnet *ifp, struct urtwn_softc *sc)
1966 {
1967         struct ieee80211_node *ni;
1968         struct mbuf *m;
1969         struct urtwn_data *bf;
1970
1971         URTWN_ASSERT_LOCKED(sc);
1972         for (;;) {
1973                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1974                 if (m == NULL)
1975                         break;
1976                 bf = urtwn_getbuf(sc);
1977                 if (bf == NULL) {
1978                         IFQ_DRV_PREPEND(&ifp->if_snd, m);
1979                         break;
1980                 }
1981                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1982                 m->m_pkthdr.rcvif = NULL;
1983
1984                 if (urtwn_tx_start(sc, ni, m, bf) != 0) {
1985                         ifp->if_oerrors++;
1986                         STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1987                         ieee80211_free_node(ni);
1988                         break;
1989                 }
1990
1991                 sc->sc_txtimer = 5;
1992                 callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
1993         }
1994 }
1995
1996 static int
1997 urtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1998 {
1999         struct urtwn_softc *sc = ifp->if_softc;
2000         struct ieee80211com *ic = ifp->if_l2com;
2001         struct ifreq *ifr = (struct ifreq *) data;
2002         int error = 0, startall = 0;
2003
2004         URTWN_LOCK(sc);
2005         error = (sc->sc_flags & URTWN_DETACHED) ? ENXIO : 0;
2006         URTWN_UNLOCK(sc);
2007         if (error != 0)
2008                 return (error);
2009
2010         switch (cmd) {
2011         case SIOCSIFFLAGS:
2012                 if (ifp->if_flags & IFF_UP) {
2013                         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2014                                 urtwn_init(ifp->if_softc);
2015                                 startall = 1;
2016                         }
2017                 } else {
2018                         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2019                                 urtwn_stop(ifp);
2020                 }
2021                 if (startall)
2022                         ieee80211_start_all(ic);
2023                 break;
2024         case SIOCGIFMEDIA:
2025                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2026                 break;
2027         case SIOCGIFADDR:
2028                 error = ether_ioctl(ifp, cmd, data);
2029                 break;
2030         default:
2031                 error = EINVAL;
2032                 break;
2033         }
2034         return (error);
2035 }
2036
2037 static int
2038 urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
2039     int ndata, int maxsz)
2040 {
2041         int i, error;
2042
2043         for (i = 0; i < ndata; i++) {
2044                 struct urtwn_data *dp = &data[i];
2045                 dp->sc = sc;
2046                 dp->m = NULL;
2047                 dp->buf = malloc(maxsz, M_USBDEV, M_NOWAIT);
2048                 if (dp->buf == NULL) {
2049                         device_printf(sc->sc_dev,
2050                             "could not allocate buffer\n");
2051                         error = ENOMEM;
2052                         goto fail;
2053                 }
2054                 dp->ni = NULL;
2055         }
2056
2057         return (0);
2058 fail:
2059         urtwn_free_list(sc, data, ndata);
2060         return (error);
2061 }
2062
2063 static int
2064 urtwn_alloc_rx_list(struct urtwn_softc *sc)
2065 {
2066         int error, i;
2067
2068         error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
2069             URTWN_RXBUFSZ);
2070         if (error != 0)
2071                 return (error);
2072
2073         STAILQ_INIT(&sc->sc_rx_active);
2074         STAILQ_INIT(&sc->sc_rx_inactive);
2075
2076         for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
2077                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
2078
2079         return (0);
2080 }
2081
2082 static int
2083 urtwn_alloc_tx_list(struct urtwn_softc *sc)
2084 {
2085         int error, i;
2086
2087         error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
2088             URTWN_TXBUFSZ);
2089         if (error != 0)
2090                 return (error);
2091
2092         STAILQ_INIT(&sc->sc_tx_active);
2093         STAILQ_INIT(&sc->sc_tx_inactive);
2094         STAILQ_INIT(&sc->sc_tx_pending);
2095
2096         for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
2097                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
2098
2099         return (0);
2100 }
2101
2102 static __inline int
2103 urtwn_power_on(struct urtwn_softc *sc)
2104 {
2105
2106         return sc->sc_power_on(sc);
2107 }
2108
2109 static int
2110 urtwn_r92c_power_on(struct urtwn_softc *sc)
2111 {
2112         uint32_t reg;
2113         int ntries;
2114
2115         /* Wait for autoload done bit. */
2116         for (ntries = 0; ntries < 1000; ntries++) {
2117                 if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
2118                         break;
2119                 urtwn_ms_delay(sc);
2120         }
2121         if (ntries == 1000) {
2122                 device_printf(sc->sc_dev,
2123                     "timeout waiting for chip autoload\n");
2124                 return (ETIMEDOUT);
2125         }
2126
2127         /* Unlock ISO/CLK/Power control register. */
2128         urtwn_write_1(sc, R92C_RSV_CTRL, 0);
2129         /* Move SPS into PWM mode. */
2130         urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
2131         urtwn_ms_delay(sc);
2132
2133         reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
2134         if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
2135                 urtwn_write_1(sc, R92C_LDOV12D_CTRL,
2136                     reg | R92C_LDOV12D_CTRL_LDV12_EN);
2137                 urtwn_ms_delay(sc);
2138                 urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
2139                     urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
2140                     ~R92C_SYS_ISO_CTRL_MD2PP);
2141         }
2142
2143         /* Auto enable WLAN. */
2144         urtwn_write_2(sc, R92C_APS_FSMCO,
2145             urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2146         for (ntries = 0; ntries < 1000; ntries++) {
2147                 if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2148                     R92C_APS_FSMCO_APFM_ONMAC))
2149                         break;
2150                 urtwn_ms_delay(sc);
2151         }
2152         if (ntries == 1000) {
2153                 device_printf(sc->sc_dev,
2154                     "timeout waiting for MAC auto ON\n");
2155                 return (ETIMEDOUT);
2156         }
2157
2158         /* Enable radio, GPIO and LED functions. */
2159         urtwn_write_2(sc, R92C_APS_FSMCO,
2160             R92C_APS_FSMCO_AFSM_HSUS |
2161             R92C_APS_FSMCO_PDN_EN |
2162             R92C_APS_FSMCO_PFM_ALDN);
2163         /* Release RF digital isolation. */
2164         urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
2165             urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
2166
2167         /* Initialize MAC. */
2168         urtwn_write_1(sc, R92C_APSD_CTRL,
2169             urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2170         for (ntries = 0; ntries < 200; ntries++) {
2171                 if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
2172                     R92C_APSD_CTRL_OFF_STATUS))
2173                         break;
2174                 urtwn_ms_delay(sc);
2175         }
2176         if (ntries == 200) {
2177                 device_printf(sc->sc_dev,
2178                     "timeout waiting for MAC initialization\n");
2179                 return (ETIMEDOUT);
2180         }
2181
2182         /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2183         reg = urtwn_read_2(sc, R92C_CR);
2184         reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2185             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2186             R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2187             R92C_CR_ENSEC;
2188         urtwn_write_2(sc, R92C_CR, reg);
2189
2190         urtwn_write_1(sc, 0xfe10, 0x19);
2191         return (0);
2192 }
2193
2194 static int
2195 urtwn_r88e_power_on(struct urtwn_softc *sc)
2196 {
2197         uint32_t reg;
2198         int ntries;
2199
2200         /* Wait for power ready bit. */
2201         for (ntries = 0; ntries < 5000; ntries++) {
2202                 if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
2203                         break;
2204                 urtwn_ms_delay(sc);
2205         }
2206         if (ntries == 5000) {
2207                 device_printf(sc->sc_dev,
2208                     "timeout waiting for chip power up\n");
2209                 return (ETIMEDOUT);
2210         }
2211
2212         /* Reset BB. */
2213         urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2214             urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
2215             R92C_SYS_FUNC_EN_BB_GLB_RST));
2216
2217         urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
2218             urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
2219
2220         /* Disable HWPDN. */
2221         urtwn_write_2(sc, R92C_APS_FSMCO,
2222             urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
2223
2224         /* Disable WL suspend. */
2225         urtwn_write_2(sc, R92C_APS_FSMCO,
2226             urtwn_read_2(sc, R92C_APS_FSMCO) &
2227             ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
2228
2229         urtwn_write_2(sc, R92C_APS_FSMCO,
2230             urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
2231         for (ntries = 0; ntries < 5000; ntries++) {
2232                 if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
2233                     R92C_APS_FSMCO_APFM_ONMAC))
2234                         break;
2235                 urtwn_ms_delay(sc);
2236         }
2237         if (ntries == 5000)
2238                 return (ETIMEDOUT);
2239
2240         /* Enable LDO normal mode. */
2241         urtwn_write_1(sc, R92C_LPLDO_CTRL,
2242             urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~0x10);
2243
2244         /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2245         urtwn_write_2(sc, R92C_CR, 0);
2246         reg = urtwn_read_2(sc, R92C_CR);
2247         reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2248             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2249             R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
2250         urtwn_write_2(sc, R92C_CR, reg);
2251
2252         return (0);
2253 }
2254
2255 static int
2256 urtwn_llt_init(struct urtwn_softc *sc)
2257 {
2258         int i, error, page_count, pktbuf_count;
2259
2260         page_count = (sc->chip & URTWN_CHIP_88E) ?
2261             R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
2262         pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
2263             R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
2264
2265         /* Reserve pages [0; page_count]. */
2266         for (i = 0; i < page_count; i++) {
2267                 if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2268                         return (error);
2269         }
2270         /* NB: 0xff indicates end-of-list. */
2271         if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
2272                 return (error);
2273         /*
2274          * Use pages [page_count + 1; pktbuf_count - 1]
2275          * as ring buffer.
2276          */
2277         for (++i; i < pktbuf_count - 1; i++) {
2278                 if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
2279                         return (error);
2280         }
2281         /* Make the last page point to the beginning of the ring buffer. */
2282         error = urtwn_llt_write(sc, i, page_count + 1);
2283         return (error);
2284 }
2285
2286 static void
2287 urtwn_fw_reset(struct urtwn_softc *sc)
2288 {
2289         uint16_t reg;
2290         int ntries;
2291
2292         /* Tell 8051 to reset itself. */
2293         urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2294
2295         /* Wait until 8051 resets by itself. */
2296         for (ntries = 0; ntries < 100; ntries++) {
2297                 reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2298                 if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2299                         return;
2300                 urtwn_ms_delay(sc);
2301         }
2302         /* Force 8051 reset. */
2303         urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2304 }
2305
2306 static void
2307 urtwn_r88e_fw_reset(struct urtwn_softc *sc)
2308 {
2309         uint16_t reg;
2310
2311         reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
2312         urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2313         urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
2314 }
2315
2316 static int
2317 urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
2318 {
2319         uint32_t reg;
2320         int off, mlen, error = 0;
2321
2322         reg = urtwn_read_4(sc, R92C_MCUFWDL);
2323         reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2324         urtwn_write_4(sc, R92C_MCUFWDL, reg);
2325
2326         off = R92C_FW_START_ADDR;
2327         while (len > 0) {
2328                 if (len > 196)
2329                         mlen = 196;
2330                 else if (len > 4)
2331                         mlen = 4;
2332                 else
2333                         mlen = 1;
2334                 /* XXX fix this deconst */
2335                 error = urtwn_write_region_1(sc, off,
2336                     __DECONST(uint8_t *, buf), mlen);
2337                 if (error != 0)
2338                         break;
2339                 off += mlen;
2340                 buf += mlen;
2341                 len -= mlen;
2342         }
2343         return (error);
2344 }
2345
2346 static int
2347 urtwn_load_firmware(struct urtwn_softc *sc)
2348 {
2349         const struct firmware *fw;
2350         const struct r92c_fw_hdr *hdr;
2351         const char *imagename;
2352         const u_char *ptr;
2353         size_t len;
2354         uint32_t reg;
2355         int mlen, ntries, page, error;
2356
2357         URTWN_UNLOCK(sc);
2358         /* Read firmware image from the filesystem. */
2359         if (sc->chip & URTWN_CHIP_88E)
2360                 imagename = "urtwn-rtl8188eufw";
2361         else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2362                     URTWN_CHIP_UMC_A_CUT)
2363                 imagename = "urtwn-rtl8192cfwU";
2364         else
2365                 imagename = "urtwn-rtl8192cfwT";
2366
2367         fw = firmware_get(imagename);
2368         URTWN_LOCK(sc);
2369         if (fw == NULL) {
2370                 device_printf(sc->sc_dev,
2371                     "failed loadfirmware of file %s\n", imagename);
2372                 return (ENOENT);
2373         }
2374
2375         len = fw->datasize;
2376
2377         if (len < sizeof(*hdr)) {
2378                 device_printf(sc->sc_dev, "firmware too short\n");
2379                 error = EINVAL;
2380                 goto fail;
2381         }
2382         ptr = fw->data;
2383         hdr = (const struct r92c_fw_hdr *)ptr;
2384         /* Check if there is a valid FW header and skip it. */
2385         if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2386             (le16toh(hdr->signature) >> 4) == 0x88e ||
2387             (le16toh(hdr->signature) >> 4) == 0x92c) {
2388                 DPRINTF("FW V%d.%d %02d-%02d %02d:%02d\n",
2389                     le16toh(hdr->version), le16toh(hdr->subversion),
2390                     hdr->month, hdr->date, hdr->hour, hdr->minute);
2391                 ptr += sizeof(*hdr);
2392                 len -= sizeof(*hdr);
2393         }
2394
2395         if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
2396                 if (sc->chip & URTWN_CHIP_88E)
2397                         urtwn_r88e_fw_reset(sc);
2398                 else
2399                         urtwn_fw_reset(sc);
2400                 urtwn_write_1(sc, R92C_MCUFWDL, 0);
2401         }
2402
2403         if (!(sc->chip & URTWN_CHIP_88E)) {
2404                 urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2405                     urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2406                     R92C_SYS_FUNC_EN_CPUEN);
2407         }
2408         urtwn_write_1(sc, R92C_MCUFWDL,
2409             urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2410         urtwn_write_1(sc, R92C_MCUFWDL + 2,
2411             urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2412
2413         /* Reset the FWDL checksum. */
2414         urtwn_write_1(sc, R92C_MCUFWDL,
2415             urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2416
2417         for (page = 0; len > 0; page++) {
2418                 mlen = min(len, R92C_FW_PAGE_SIZE);
2419                 error = urtwn_fw_loadpage(sc, page, ptr, mlen);
2420                 if (error != 0) {
2421                         device_printf(sc->sc_dev,
2422                             "could not load firmware page\n");
2423                         goto fail;
2424                 }
2425                 ptr += mlen;
2426                 len -= mlen;
2427         }
2428         urtwn_write_1(sc, R92C_MCUFWDL,
2429             urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2430         urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2431
2432         /* Wait for checksum report. */
2433         for (ntries = 0; ntries < 1000; ntries++) {
2434                 if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2435                         break;
2436                 urtwn_ms_delay(sc);
2437         }
2438         if (ntries == 1000) {
2439                 device_printf(sc->sc_dev,
2440                     "timeout waiting for checksum report\n");
2441                 error = ETIMEDOUT;
2442                 goto fail;
2443         }
2444
2445         reg = urtwn_read_4(sc, R92C_MCUFWDL);
2446         reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2447         urtwn_write_4(sc, R92C_MCUFWDL, reg);
2448         if (sc->chip & URTWN_CHIP_88E)
2449                 urtwn_r88e_fw_reset(sc);
2450         /* Wait for firmware readiness. */
2451         for (ntries = 0; ntries < 1000; ntries++) {
2452                 if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2453                         break;
2454                 urtwn_ms_delay(sc);
2455         }
2456         if (ntries == 1000) {
2457                 device_printf(sc->sc_dev,
2458                     "timeout waiting for firmware readiness\n");
2459                 error = ETIMEDOUT;
2460                 goto fail;
2461         }
2462 fail:
2463         firmware_put(fw, FIRMWARE_UNLOAD);
2464         return (error);
2465 }
2466
2467 static __inline int
2468 urtwn_dma_init(struct urtwn_softc *sc)
2469 {
2470
2471         return sc->sc_dma_init(sc);
2472 }
2473
2474 static int
2475 urtwn_r92c_dma_init(struct urtwn_softc *sc)
2476 {
2477         int hashq, hasnq, haslq, nqueues, nqpages, nrempages;
2478         uint32_t reg;
2479         int error;
2480
2481         /* Initialize LLT table. */
2482         error = urtwn_llt_init(sc);
2483         if (error != 0)
2484                 return (error);
2485
2486         /* Get Tx queues to USB endpoints mapping. */
2487         hashq = hasnq = haslq = 0;
2488         reg = urtwn_read_2(sc, R92C_USB_EP + 1);
2489         DPRINTFN(2, "USB endpoints mapping 0x%x\n", reg);
2490         if (MS(reg, R92C_USB_EP_HQ) != 0)
2491                 hashq = 1;
2492         if (MS(reg, R92C_USB_EP_NQ) != 0)
2493                 hasnq = 1;
2494         if (MS(reg, R92C_USB_EP_LQ) != 0)
2495                 haslq = 1;
2496         nqueues = hashq + hasnq + haslq;
2497         if (nqueues == 0)
2498                 return (EIO);
2499         /* Get the number of pages for each queue. */
2500         nqpages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) / nqueues;
2501         /* The remaining pages are assigned to the high priority queue. */
2502         nrempages = (R92C_TX_PAGE_COUNT - R92C_PUBQ_NPAGES) % nqueues;
2503
2504         /* Set number of pages for normal priority queue. */
2505         urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
2506         urtwn_write_4(sc, R92C_RQPN,
2507             /* Set number of pages for public queue. */
2508             SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2509             /* Set number of pages for high priority queue. */
2510             SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
2511             /* Set number of pages for low priority queue. */
2512             SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
2513             /* Load values. */
2514             R92C_RQPN_LD);
2515
2516         urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2517         urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2518         urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2519         urtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2520         urtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2521
2522         /* Set queue to USB pipe mapping. */
2523         reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2524         reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2525         if (nqueues == 1) {
2526                 if (hashq)
2527                         reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
2528                 else if (hasnq)
2529                         reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
2530                 else
2531                         reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2532         } else if (nqueues == 2) {
2533                 /* All 2-endpoints configs have a high priority queue. */
2534                 if (!hashq)
2535                         return (EIO);
2536                 if (hasnq)
2537                         reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2538                 else
2539                         reg |= R92C_TRXDMA_CTRL_QMAP_HQ_LQ;
2540         } else
2541                 reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2542         urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2543
2544         /* Set Tx/Rx transfer page boundary. */
2545         urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2546
2547         /* Set Tx/Rx transfer page size. */
2548         urtwn_write_1(sc, R92C_PBP,
2549             SM(R92C_PBP_PSRX, R92C_PBP_128) |
2550             SM(R92C_PBP_PSTX, R92C_PBP_128));
2551         return (0);
2552 }
2553
2554 static int
2555 urtwn_r88e_dma_init(struct urtwn_softc *sc)
2556 {
2557         struct usb_interface *iface;
2558         uint32_t reg;
2559         int nqueues;
2560         int error;
2561
2562         /* Initialize LLT table. */
2563         error = urtwn_llt_init(sc);
2564         if (error != 0)
2565                 return (error);
2566
2567         /* Get Tx queues to USB endpoints mapping. */
2568         iface = usbd_get_iface(sc->sc_udev, 0);
2569         nqueues = iface->idesc->bNumEndpoints - 1;
2570         if (nqueues == 0)
2571                 return (EIO);
2572
2573         /* Set number of pages for normal priority queue. */
2574         urtwn_write_2(sc, R92C_RQPN_NPQ, 0x000d);
2575         urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
2576
2577         urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2578         urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R88E_TX_PAGE_BOUNDARY);
2579         urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R88E_TX_PAGE_BOUNDARY);
2580         urtwn_write_1(sc, R92C_TRXFF_BNDY, R88E_TX_PAGE_BOUNDARY);
2581         urtwn_write_1(sc, R92C_TDECTRL + 1, R88E_TX_PAGE_BOUNDARY);
2582
2583         /* Set queue to USB pipe mapping. */
2584         reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
2585         reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2586         if (nqueues == 1)
2587                 reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
2588         else if (nqueues == 2)
2589                 reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
2590         else
2591                 reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
2592         urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2593
2594         /* Set Tx/Rx transfer page boundary. */
2595         urtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x23ff);
2596
2597         /* Set Tx/Rx transfer page size. */
2598         urtwn_write_1(sc, R92C_PBP,
2599             SM(R92C_PBP_PSRX, R92C_PBP_128) |
2600             SM(R92C_PBP_PSTX, R92C_PBP_128));
2601
2602         return (0);
2603 }
2604
2605 static void
2606 urtwn_mac_init(struct urtwn_softc *sc)
2607 {
2608         int i;
2609
2610         /* Write MAC initialization values. */
2611         if (sc->chip & URTWN_CHIP_88E) {
2612                 for (i = 0; i < nitems(rtl8188eu_mac); i++) {
2613                         urtwn_write_1(sc, rtl8188eu_mac[i].reg,
2614                             rtl8188eu_mac[i].val);
2615                 }
2616                 urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
2617         } else {
2618                 for (i = 0; i < nitems(rtl8192cu_mac); i++)
2619                         urtwn_write_1(sc, rtl8192cu_mac[i].reg,
2620                             rtl8192cu_mac[i].val);
2621         }
2622 }
2623
2624 static void
2625 urtwn_bb_init(struct urtwn_softc *sc)
2626 {
2627         const struct urtwn_bb_prog *prog;
2628         uint32_t reg;
2629         uint8_t crystalcap;
2630         int i;
2631
2632         /* Enable BB and RF. */
2633         urtwn_write_2(sc, R92C_SYS_FUNC_EN,
2634             urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2635             R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2636             R92C_SYS_FUNC_EN_DIO_RF);
2637
2638         if (!(sc->chip & URTWN_CHIP_88E))
2639                 urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2640
2641         urtwn_write_1(sc, R92C_RF_CTRL,
2642             R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2643         urtwn_write_1(sc, R92C_SYS_FUNC_EN,
2644             R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
2645             R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
2646
2647         if (!(sc->chip & URTWN_CHIP_88E)) {
2648                 urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
2649                 urtwn_write_1(sc, 0x15, 0xe9);
2650                 urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2651         }
2652
2653         /* Select BB programming based on board type. */
2654         if (sc->chip & URTWN_CHIP_88E)
2655                 prog = &rtl8188eu_bb_prog;
2656         else if (!(sc->chip & URTWN_CHIP_92C)) {
2657                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2658                         prog = &rtl8188ce_bb_prog;
2659                 else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2660                         prog = &rtl8188ru_bb_prog;
2661                 else
2662                         prog = &rtl8188cu_bb_prog;
2663         } else {
2664                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2665                         prog = &rtl8192ce_bb_prog;
2666                 else
2667                         prog = &rtl8192cu_bb_prog;
2668         }
2669         /* Write BB initialization values. */
2670         for (i = 0; i < prog->count; i++) {
2671                 urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2672                 urtwn_ms_delay(sc);
2673         }
2674
2675         if (sc->chip & URTWN_CHIP_92C_1T2R) {
2676                 /* 8192C 1T only configuration. */
2677                 reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2678                 reg = (reg & ~0x00000003) | 0x2;
2679                 urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2680
2681                 reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2682                 reg = (reg & ~0x00300033) | 0x00200022;
2683                 urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2684
2685                 reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2686                 reg = (reg & ~0xff000000) | 0x45 << 24;
2687                 urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2688
2689                 reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2690                 reg = (reg & ~0x000000ff) | 0x23;
2691                 urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2692
2693                 reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2694                 reg = (reg & ~0x00000030) | 1 << 4;
2695                 urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2696
2697                 reg = urtwn_bb_read(sc, 0xe74);
2698                 reg = (reg & ~0x0c000000) | 2 << 26;
2699                 urtwn_bb_write(sc, 0xe74, reg);
2700                 reg = urtwn_bb_read(sc, 0xe78);
2701                 reg = (reg & ~0x0c000000) | 2 << 26;
2702                 urtwn_bb_write(sc, 0xe78, reg);
2703                 reg = urtwn_bb_read(sc, 0xe7c);
2704                 reg = (reg & ~0x0c000000) | 2 << 26;
2705                 urtwn_bb_write(sc, 0xe7c, reg);
2706                 reg = urtwn_bb_read(sc, 0xe80);
2707                 reg = (reg & ~0x0c000000) | 2 << 26;
2708                 urtwn_bb_write(sc, 0xe80, reg);
2709                 reg = urtwn_bb_read(sc, 0xe88);
2710                 reg = (reg & ~0x0c000000) | 2 << 26;
2711                 urtwn_bb_write(sc, 0xe88, reg);
2712         }
2713
2714         /* Write AGC values. */
2715         for (i = 0; i < prog->agccount; i++) {
2716                 urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2717                     prog->agcvals[i]);
2718                 urtwn_ms_delay(sc);
2719         }
2720
2721         if (sc->chip & URTWN_CHIP_88E) {
2722                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
2723                 urtwn_ms_delay(sc);
2724                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
2725                 urtwn_ms_delay(sc);
2726
2727                 crystalcap = sc->r88e_rom[0xb9];
2728                 if (crystalcap == 0xff)
2729                         crystalcap = 0x20;
2730                 crystalcap &= 0x3f;
2731                 reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
2732                 urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
2733                     RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
2734                     crystalcap | crystalcap << 6));
2735         } else {
2736                 if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2737                     R92C_HSSI_PARAM2_CCK_HIPWR)
2738                         sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
2739         }
2740 }
2741
2742 void
2743 urtwn_rf_init(struct urtwn_softc *sc)
2744 {
2745         const struct urtwn_rf_prog *prog;
2746         uint32_t reg, type;
2747         int i, j, idx, off;
2748
2749         /* Select RF programming based on board type. */
2750         if (sc->chip & URTWN_CHIP_88E)
2751                 prog = rtl8188eu_rf_prog;
2752         else if (!(sc->chip & URTWN_CHIP_92C)) {
2753                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2754                         prog = rtl8188ce_rf_prog;
2755                 else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2756                         prog = rtl8188ru_rf_prog;
2757                 else
2758                         prog = rtl8188cu_rf_prog;
2759         } else
2760                 prog = rtl8192ce_rf_prog;
2761
2762         for (i = 0; i < sc->nrxchains; i++) {
2763                 /* Save RF_ENV control type. */
2764                 idx = i / 2;
2765                 off = (i % 2) * 16;
2766                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2767                 type = (reg >> off) & 0x10;
2768
2769                 /* Set RF_ENV enable. */
2770                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2771                 reg |= 0x100000;
2772                 urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2773                 urtwn_ms_delay(sc);
2774                 /* Set RF_ENV output high. */
2775                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2776                 reg |= 0x10;
2777                 urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2778                 urtwn_ms_delay(sc);
2779                 /* Set address and data lengths of RF registers. */
2780                 reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2781                 reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2782                 urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2783                 urtwn_ms_delay(sc);
2784                 reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2785                 reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2786                 urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2787                 urtwn_ms_delay(sc);
2788
2789                 /* Write RF initialization values for this chain. */
2790                 for (j = 0; j < prog[i].count; j++) {
2791                         if (prog[i].regs[j] >= 0xf9 &&
2792                             prog[i].regs[j] <= 0xfe) {
2793                                 /*
2794                                  * These are fake RF registers offsets that
2795                                  * indicate a delay is required.
2796                                  */
2797                                 usb_pause_mtx(&sc->sc_mtx, hz / 20);    /* 50ms */
2798                                 continue;
2799                         }
2800                         urtwn_rf_write(sc, i, prog[i].regs[j],
2801                             prog[i].vals[j]);
2802                         urtwn_ms_delay(sc);
2803                 }
2804
2805                 /* Restore RF_ENV control type. */
2806                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2807                 reg &= ~(0x10 << off) | (type << off);
2808                 urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2809
2810                 /* Cache RF register CHNLBW. */
2811                 sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2812         }
2813
2814         if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
2815             URTWN_CHIP_UMC_A_CUT) {
2816                 urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2817                 urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2818         }
2819 }
2820
2821 static void
2822 urtwn_cam_init(struct urtwn_softc *sc)
2823 {
2824         /* Invalidate all CAM entries. */
2825         urtwn_write_4(sc, R92C_CAMCMD,
2826             R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2827 }
2828
2829 static void
2830 urtwn_pa_bias_init(struct urtwn_softc *sc)
2831 {
2832         uint8_t reg;
2833         int i;
2834
2835         for (i = 0; i < sc->nrxchains; i++) {
2836                 if (sc->pa_setting & (1 << i))
2837                         continue;
2838                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2839                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2840                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2841                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2842         }
2843         if (!(sc->pa_setting & 0x10)) {
2844                 reg = urtwn_read_1(sc, 0x16);
2845                 reg = (reg & ~0xf0) | 0x90;
2846                 urtwn_write_1(sc, 0x16, reg);
2847         }
2848 }
2849
2850 static void
2851 urtwn_rxfilter_init(struct urtwn_softc *sc)
2852 {
2853         /* Initialize Rx filter. */
2854         /* TODO: use better filter for monitor mode. */
2855         urtwn_write_4(sc, R92C_RCR,
2856             R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2857             R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2858             R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2859         /* Accept all multicast frames. */
2860         urtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2861         urtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2862         /* Accept all management frames. */
2863         urtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2864         /* Reject all control frames. */
2865         urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2866         /* Accept all data frames. */
2867         urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2868 }
2869
2870 static void
2871 urtwn_edca_init(struct urtwn_softc *sc)
2872 {
2873         urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
2874         urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
2875         urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
2876         urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
2877         urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2878         urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2879         urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
2880         urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
2881 }
2882
2883 void
2884 urtwn_write_txpower(struct urtwn_softc *sc, int chain,
2885     uint16_t power[URTWN_RIDX_COUNT])
2886 {
2887         uint32_t reg;
2888
2889         /* Write per-CCK rate Tx power. */
2890         if (chain == 0) {
2891                 reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2892                 reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2893                 urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2894                 reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2895                 reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2896                 reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2897                 reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2898                 urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2899         } else {
2900                 reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2901                 reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2902                 reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2903                 reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2904                 urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2905                 reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2906                 reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2907                 urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2908         }
2909         /* Write per-OFDM rate Tx power. */
2910         urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2911             SM(R92C_TXAGC_RATE06, power[ 4]) |
2912             SM(R92C_TXAGC_RATE09, power[ 5]) |
2913             SM(R92C_TXAGC_RATE12, power[ 6]) |
2914             SM(R92C_TXAGC_RATE18, power[ 7]));
2915         urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2916             SM(R92C_TXAGC_RATE24, power[ 8]) |
2917             SM(R92C_TXAGC_RATE36, power[ 9]) |
2918             SM(R92C_TXAGC_RATE48, power[10]) |
2919             SM(R92C_TXAGC_RATE54, power[11]));
2920         /* Write per-MCS Tx power. */
2921         urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2922             SM(R92C_TXAGC_MCS00,  power[12]) |
2923             SM(R92C_TXAGC_MCS01,  power[13]) |
2924             SM(R92C_TXAGC_MCS02,  power[14]) |
2925             SM(R92C_TXAGC_MCS03,  power[15]));
2926         urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2927             SM(R92C_TXAGC_MCS04,  power[16]) |
2928             SM(R92C_TXAGC_MCS05,  power[17]) |
2929             SM(R92C_TXAGC_MCS06,  power[18]) |
2930             SM(R92C_TXAGC_MCS07,  power[19]));
2931         urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2932             SM(R92C_TXAGC_MCS08,  power[20]) |
2933             SM(R92C_TXAGC_MCS09,  power[21]) |
2934             SM(R92C_TXAGC_MCS10,  power[22]) |
2935             SM(R92C_TXAGC_MCS11,  power[23]));
2936         urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2937             SM(R92C_TXAGC_MCS12,  power[24]) |
2938             SM(R92C_TXAGC_MCS13,  power[25]) |
2939             SM(R92C_TXAGC_MCS14,  power[26]) |
2940             SM(R92C_TXAGC_MCS15,  power[27]));
2941 }
2942
2943 void
2944 urtwn_get_txpower(struct urtwn_softc *sc, int chain,
2945     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2946     uint16_t power[URTWN_RIDX_COUNT])
2947 {
2948         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2949         struct r92c_rom *rom = &sc->rom;
2950         uint16_t cckpow, ofdmpow, htpow, diff, max;
2951         const struct urtwn_txpwr *base;
2952         int ridx, chan, group;
2953
2954         /* Determine channel group. */
2955         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
2956         if (chan <= 3)
2957                 group = 0;
2958         else if (chan <= 9)
2959                 group = 1;
2960         else
2961                 group = 2;
2962
2963         /* Get original Tx power based on board type and RF chain. */
2964         if (!(sc->chip & URTWN_CHIP_92C)) {
2965                 if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2966                         base = &rtl8188ru_txagc[chain];
2967                 else
2968                         base = &rtl8192cu_txagc[chain];
2969         } else
2970                 base = &rtl8192cu_txagc[chain];
2971
2972         memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
2973         if (sc->regulatory == 0) {
2974                 for (ridx = 0; ridx <= 3; ridx++)
2975                         power[ridx] = base->pwr[0][ridx];
2976         }
2977         for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
2978                 if (sc->regulatory == 3) {
2979                         power[ridx] = base->pwr[0][ridx];
2980                         /* Apply vendor limits. */
2981                         if (extc != NULL)
2982                                 max = rom->ht40_max_pwr[group];
2983                         else
2984                                 max = rom->ht20_max_pwr[group];
2985                         max = (max >> (chain * 4)) & 0xf;
2986                         if (power[ridx] > max)
2987                                 power[ridx] = max;
2988                 } else if (sc->regulatory == 1) {
2989                         if (extc == NULL)
2990                                 power[ridx] = base->pwr[group][ridx];
2991                 } else if (sc->regulatory != 2)
2992                         power[ridx] = base->pwr[0][ridx];
2993         }
2994
2995         /* Compute per-CCK rate Tx power. */
2996         cckpow = rom->cck_tx_pwr[chain][group];
2997         for (ridx = 0; ridx <= 3; ridx++) {
2998                 power[ridx] += cckpow;
2999                 if (power[ridx] > R92C_MAX_TX_PWR)
3000                         power[ridx] = R92C_MAX_TX_PWR;
3001         }
3002
3003         htpow = rom->ht40_1s_tx_pwr[chain][group];
3004         if (sc->ntxchains > 1) {
3005                 /* Apply reduction for 2 spatial streams. */
3006                 diff = rom->ht40_2s_tx_pwr_diff[group];
3007                 diff = (diff >> (chain * 4)) & 0xf;
3008                 htpow = (htpow > diff) ? htpow - diff : 0;
3009         }
3010
3011         /* Compute per-OFDM rate Tx power. */
3012         diff = rom->ofdm_tx_pwr_diff[group];
3013         diff = (diff >> (chain * 4)) & 0xf;
3014         ofdmpow = htpow + diff; /* HT->OFDM correction. */
3015         for (ridx = 4; ridx <= 11; ridx++) {
3016                 power[ridx] += ofdmpow;
3017                 if (power[ridx] > R92C_MAX_TX_PWR)
3018                         power[ridx] = R92C_MAX_TX_PWR;
3019         }
3020
3021         /* Compute per-MCS Tx power. */
3022         if (extc == NULL) {
3023                 diff = rom->ht20_tx_pwr_diff[group];
3024                 diff = (diff >> (chain * 4)) & 0xf;
3025                 htpow += diff;  /* HT40->HT20 correction. */
3026         }
3027         for (ridx = 12; ridx <= 27; ridx++) {
3028                 power[ridx] += htpow;
3029                 if (power[ridx] > R92C_MAX_TX_PWR)
3030                         power[ridx] = R92C_MAX_TX_PWR;
3031         }
3032 #ifdef URTWN_DEBUG
3033         if (urtwn_debug >= 4) {
3034                 /* Dump per-rate Tx power values. */
3035                 printf("Tx power for chain %d:\n", chain);
3036                 for (ridx = 0; ridx < URTWN_RIDX_COUNT; ridx++)
3037                         printf("Rate %d = %u\n", ridx, power[ridx]);
3038         }
3039 #endif
3040 }
3041
3042 void
3043 urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
3044     struct ieee80211_channel *c, struct ieee80211_channel *extc,
3045     uint16_t power[URTWN_RIDX_COUNT])
3046 {
3047         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3048         uint16_t cckpow, ofdmpow, bw20pow, htpow;
3049         const struct urtwn_r88e_txpwr *base;
3050         int ridx, chan, group;
3051
3052         /* Determine channel group. */
3053         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
3054         if (chan <= 2)
3055                 group = 0;
3056         else if (chan <= 5)
3057                 group = 1;
3058         else if (chan <= 8)
3059                 group = 2;
3060         else if (chan <= 11)
3061                 group = 3;
3062         else if (chan <= 13)
3063                 group = 4;
3064         else
3065                 group = 5;
3066
3067         /* Get original Tx power based on board type and RF chain. */
3068         base = &rtl8188eu_txagc[chain];
3069
3070         memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
3071         if (sc->regulatory == 0) {
3072                 for (ridx = 0; ridx <= 3; ridx++)
3073                         power[ridx] = base->pwr[0][ridx];
3074         }
3075         for (ridx = 4; ridx < URTWN_RIDX_COUNT; ridx++) {
3076                 if (sc->regulatory == 3)
3077                         power[ridx] = base->pwr[0][ridx];
3078                 else if (sc->regulatory == 1) {
3079                         if (extc == NULL)
3080                                 power[ridx] = base->pwr[group][ridx];
3081                 } else if (sc->regulatory != 2)
3082                         power[ridx] = base->pwr[0][ridx];
3083         }
3084
3085         /* Compute per-CCK rate Tx power. */
3086         cckpow = sc->cck_tx_pwr[group];
3087         for (ridx = 0; ridx <= 3; ridx++) {
3088                 power[ridx] += cckpow;
3089                 if (power[ridx] > R92C_MAX_TX_PWR)
3090                         power[ridx] = R92C_MAX_TX_PWR;
3091         }
3092
3093         htpow = sc->ht40_tx_pwr[group];
3094
3095         /* Compute per-OFDM rate Tx power. */
3096         ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
3097         for (ridx = 4; ridx <= 11; ridx++) {
3098                 power[ridx] += ofdmpow;
3099                 if (power[ridx] > R92C_MAX_TX_PWR)
3100                         power[ridx] = R92C_MAX_TX_PWR;
3101         }
3102
3103         bw20pow = htpow + sc->bw20_tx_pwr_diff;
3104         for (ridx = 12; ridx <= 27; ridx++) {
3105                 power[ridx] += bw20pow;
3106                 if (power[ridx] > R92C_MAX_TX_PWR)
3107                         power[ridx] = R92C_MAX_TX_PWR;
3108         }
3109 }
3110
3111 void
3112 urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
3113     struct ieee80211_channel *extc)
3114 {
3115         uint16_t power[URTWN_RIDX_COUNT];
3116         int i;
3117
3118         for (i = 0; i < sc->ntxchains; i++) {
3119                 /* Compute per-rate Tx power values. */
3120                 if (sc->chip & URTWN_CHIP_88E)
3121                         urtwn_r88e_get_txpower(sc, i, c, extc, power);
3122                 else
3123                         urtwn_get_txpower(sc, i, c, extc, power);
3124                 /* Write per-rate Tx power values to hardware. */
3125                 urtwn_write_txpower(sc, i, power);
3126         }
3127 }
3128
3129 static void
3130 urtwn_scan_start(struct ieee80211com *ic)
3131 {
3132         /* XXX do nothing?  */
3133 }
3134
3135 static void
3136 urtwn_scan_end(struct ieee80211com *ic)
3137 {
3138         /* XXX do nothing?  */
3139 }
3140
3141 static void
3142 urtwn_set_channel(struct ieee80211com *ic)
3143 {
3144         struct urtwn_softc *sc = ic->ic_ifp->if_softc;
3145         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3146
3147         URTWN_LOCK(sc);
3148         if (vap->iv_state == IEEE80211_S_SCAN) {
3149                 /* Make link LED blink during scan. */
3150                 urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
3151         }
3152         urtwn_set_chan(sc, ic->ic_curchan, NULL);
3153         URTWN_UNLOCK(sc);
3154 }
3155
3156 static void
3157 urtwn_update_mcast(struct ifnet *ifp)
3158 {
3159         /* XXX do nothing?  */
3160 }
3161
3162 static void
3163 urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
3164     struct ieee80211_channel *extc)
3165 {
3166         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3167         uint32_t reg;
3168         u_int chan;
3169         int i;
3170
3171         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
3172         if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
3173                 device_printf(sc->sc_dev,
3174                     "%s: invalid channel %x\n", __func__, chan);
3175                 return;
3176         }
3177
3178         /* Set Tx power for this new channel. */
3179         urtwn_set_txpower(sc, c, extc);
3180
3181         for (i = 0; i < sc->nrxchains; i++) {
3182                 urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
3183                     RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
3184         }
3185 #ifndef IEEE80211_NO_HT
3186         if (extc != NULL) {
3187                 /* Is secondary channel below or above primary? */
3188                 int prichlo = c->ic_freq < extc->ic_freq;
3189
3190                 urtwn_write_1(sc, R92C_BWOPMODE,
3191                     urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
3192
3193                 reg = urtwn_read_1(sc, R92C_RRSR + 2);
3194                 reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
3195                 urtwn_write_1(sc, R92C_RRSR + 2, reg);
3196
3197                 urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3198                     urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
3199                 urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3200                     urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
3201
3202                 /* Set CCK side band. */
3203                 reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
3204                 reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
3205                 urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
3206
3207                 reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
3208                 reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
3209                 urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
3210
3211                 urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3212                     urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
3213                     ~R92C_FPGA0_ANAPARAM2_CBW20);
3214
3215                 reg = urtwn_bb_read(sc, 0x818);
3216                 reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
3217                 urtwn_bb_write(sc, 0x818, reg);
3218
3219                 /* Select 40MHz bandwidth. */
3220                 urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3221                     (sc->rf_chnlbw[0] & ~0xfff) | chan);
3222         } else
3223 #endif
3224         {
3225                 urtwn_write_1(sc, R92C_BWOPMODE,
3226                     urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
3227
3228                 urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
3229                     urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
3230                 urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
3231                     urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
3232
3233                 if (!(sc->chip & URTWN_CHIP_88E)) {
3234                         urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
3235                             urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
3236                             R92C_FPGA0_ANAPARAM2_CBW20);
3237                 }
3238
3239                 /* Select 20MHz bandwidth. */
3240                 urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3241                     (sc->rf_chnlbw[0] & ~0xfff) | chan |
3242                     ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
3243                     R92C_RF_CHNLBW_BW20));
3244         }
3245 }
3246
3247 static void
3248 urtwn_iq_calib(struct urtwn_softc *sc)
3249 {
3250         /* TODO */
3251 }
3252
3253 static void
3254 urtwn_lc_calib(struct urtwn_softc *sc)
3255 {
3256         uint32_t rf_ac[2];
3257         uint8_t txmode;
3258         int i;
3259
3260         txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3261         if ((txmode & 0x70) != 0) {
3262                 /* Disable all continuous Tx. */
3263                 urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3264
3265                 /* Set RF mode to standby mode. */
3266                 for (i = 0; i < sc->nrxchains; i++) {
3267                         rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
3268                         urtwn_rf_write(sc, i, R92C_RF_AC,
3269                             RW(rf_ac[i], R92C_RF_AC_MODE,
3270                                 R92C_RF_AC_MODE_STANDBY));
3271                 }
3272         } else {
3273                 /* Block all Tx queues. */
3274                 urtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3275         }
3276         /* Start calibration. */
3277         urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3278             urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3279
3280         /* Give calibration the time to complete. */
3281         usb_pause_mtx(&sc->sc_mtx, hz / 10);            /* 100ms */
3282
3283         /* Restore configuration. */
3284         if ((txmode & 0x70) != 0) {
3285                 /* Restore Tx mode. */
3286                 urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3287                 /* Restore RF mode. */
3288                 for (i = 0; i < sc->nrxchains; i++)
3289                         urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3290         } else {
3291                 /* Unblock all Tx queues. */
3292                 urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3293         }
3294 }
3295
3296 static void
3297 urtwn_init_locked(void *arg)
3298 {
3299         struct urtwn_softc *sc = arg;
3300         struct ifnet *ifp = sc->sc_ifp;
3301         uint32_t reg;
3302         int error;
3303
3304         URTWN_ASSERT_LOCKED(sc);
3305
3306         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3307                 urtwn_stop_locked(ifp);
3308
3309         /* Init firmware commands ring. */
3310         sc->fwcur = 0;
3311
3312         /* Allocate Tx/Rx buffers. */
3313         error = urtwn_alloc_rx_list(sc);
3314         if (error != 0)
3315                 goto fail;
3316
3317         error = urtwn_alloc_tx_list(sc);
3318         if (error != 0)
3319                 goto fail;
3320
3321         /* Power on adapter. */
3322         error = urtwn_power_on(sc);
3323         if (error != 0)
3324                 goto fail;
3325
3326         /* Initialize DMA. */
3327         error = urtwn_dma_init(sc);
3328         if (error != 0)
3329                 goto fail;
3330
3331         /* Set info size in Rx descriptors (in 64-bit words). */
3332         urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3333
3334         /* Init interrupts. */
3335         if (sc->chip & URTWN_CHIP_88E) {
3336                 urtwn_write_4(sc, R88E_HISR, 0xffffffff);
3337                 urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
3338                     R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
3339                 urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
3340                     R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
3341                 urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3342                     urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3343                     R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3344         } else {
3345                 urtwn_write_4(sc, R92C_HISR, 0xffffffff);
3346                 urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
3347         }
3348
3349         /* Set MAC address. */
3350         urtwn_write_region_1(sc, R92C_MACID, IF_LLADDR(ifp),
3351             IEEE80211_ADDR_LEN);
3352
3353         /* Set initial network type. */
3354         reg = urtwn_read_4(sc, R92C_CR);
3355         reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3356         urtwn_write_4(sc, R92C_CR, reg);
3357
3358         urtwn_rxfilter_init(sc);
3359
3360         reg = urtwn_read_4(sc, R92C_RRSR);
3361         reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
3362         urtwn_write_4(sc, R92C_RRSR, reg);
3363
3364         /* Set short/long retry limits. */
3365         urtwn_write_2(sc, R92C_RL,
3366             SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3367
3368         /* Initialize EDCA parameters. */
3369         urtwn_edca_init(sc);
3370
3371         /* Setup rate fallback. */
3372         if (!(sc->chip & URTWN_CHIP_88E)) {
3373                 urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
3374                 urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
3375                 urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
3376                 urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
3377         }
3378
3379         urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3380             urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3381             R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3382         /* Set ACK timeout. */
3383         urtwn_write_1(sc, R92C_ACKTO, 0x40);
3384
3385         /* Setup USB aggregation. */
3386         reg = urtwn_read_4(sc, R92C_TDECTRL);
3387         reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
3388         urtwn_write_4(sc, R92C_TDECTRL, reg);
3389         urtwn_write_1(sc, R92C_TRXDMA_CTRL,
3390             urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
3391             R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
3392         urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
3393         if (sc->chip & URTWN_CHIP_88E)
3394                 urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
3395         else {
3396                 urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
3397                 urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3398                     urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
3399                     R92C_USB_SPECIAL_OPTION_AGG_EN);
3400                 urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
3401                 urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
3402         }
3403
3404         /* Initialize beacon parameters. */
3405         urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
3406         urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3407         urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3408         urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3409         urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3410
3411         if (!(sc->chip & URTWN_CHIP_88E)) {
3412                 /* Setup AMPDU aggregation. */
3413                 urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631); /* MCS7~0 */
3414                 urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3415                 urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3416
3417                 urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3418         }
3419
3420         /* Load 8051 microcode. */
3421         error = urtwn_load_firmware(sc);
3422         if (error != 0)
3423                 goto fail;
3424
3425         /* Initialize MAC/BB/RF blocks. */
3426         urtwn_mac_init(sc);
3427         urtwn_bb_init(sc);
3428         urtwn_rf_init(sc);
3429
3430         if (sc->chip & URTWN_CHIP_88E) {
3431                 urtwn_write_2(sc, R92C_CR,
3432                     urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3433                     R92C_CR_MACRXEN);
3434         }
3435
3436         /* Turn CCK and OFDM blocks on. */
3437         reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3438         reg |= R92C_RFMOD_CCK_EN;
3439         urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3440         reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3441         reg |= R92C_RFMOD_OFDM_EN;
3442         urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3443
3444         /* Clear per-station keys table. */
3445         urtwn_cam_init(sc);
3446
3447         /* Enable hardware sequence numbering. */
3448         urtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3449
3450         /* Perform LO and IQ calibrations. */
3451         urtwn_iq_calib(sc);
3452         /* Perform LC calibration. */
3453         urtwn_lc_calib(sc);
3454
3455         /* Fix USB interference issue. */
3456         if (!(sc->chip & URTWN_CHIP_88E)) {
3457                 urtwn_write_1(sc, 0xfe40, 0xe0);
3458                 urtwn_write_1(sc, 0xfe41, 0x8d);
3459                 urtwn_write_1(sc, 0xfe42, 0x80);
3460
3461                 urtwn_pa_bias_init(sc);
3462         }
3463
3464         /* Initialize GPIO setting. */
3465         urtwn_write_1(sc, R92C_GPIO_MUXCFG,
3466             urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3467
3468         /* Fix for lower temperature. */
3469         if (!(sc->chip & URTWN_CHIP_88E))
3470                 urtwn_write_1(sc, 0x15, 0xe9);
3471
3472         usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
3473
3474         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3475         ifp->if_drv_flags |= IFF_DRV_RUNNING;
3476
3477         callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3478 fail:
3479         return;
3480 }
3481
3482 static void
3483 urtwn_init(void *arg)
3484 {
3485         struct urtwn_softc *sc = arg;
3486
3487         URTWN_LOCK(sc);
3488         urtwn_init_locked(arg);
3489         URTWN_UNLOCK(sc);
3490 }
3491
3492 static void
3493 urtwn_stop_locked(struct ifnet *ifp)
3494 {
3495         struct urtwn_softc *sc = ifp->if_softc;
3496
3497         URTWN_ASSERT_LOCKED(sc);
3498
3499         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
3500
3501         callout_stop(&sc->sc_watchdog_ch);
3502         urtwn_abort_xfers(sc);
3503 }
3504
3505 static void
3506 urtwn_stop(struct ifnet *ifp)
3507 {
3508         struct urtwn_softc *sc = ifp->if_softc;
3509
3510         URTWN_LOCK(sc);
3511         urtwn_stop_locked(ifp);
3512         URTWN_UNLOCK(sc);
3513 }
3514
3515 static void
3516 urtwn_abort_xfers(struct urtwn_softc *sc)
3517 {
3518         int i;
3519
3520         URTWN_ASSERT_LOCKED(sc);
3521
3522         /* abort any pending transfers */
3523         for (i = 0; i < URTWN_N_TRANSFER; i++)
3524                 usbd_transfer_stop(sc->sc_xfer[i]);
3525 }
3526
3527 static int
3528 urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3529     const struct ieee80211_bpf_params *params)
3530 {
3531         struct ieee80211com *ic = ni->ni_ic;
3532         struct ifnet *ifp = ic->ic_ifp;
3533         struct urtwn_softc *sc = ifp->if_softc;
3534         struct urtwn_data *bf;
3535
3536         /* prevent management frames from being sent if we're not ready */
3537         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
3538                 m_freem(m);
3539                 ieee80211_free_node(ni);
3540                 return (ENETDOWN);
3541         }
3542         URTWN_LOCK(sc);
3543         bf = urtwn_getbuf(sc);
3544         if (bf == NULL) {
3545                 ieee80211_free_node(ni);
3546                 m_freem(m);
3547                 URTWN_UNLOCK(sc);
3548                 return (ENOBUFS);
3549         }
3550
3551         ifp->if_opackets++;
3552         if (urtwn_tx_start(sc, ni, m, bf) != 0) {
3553                 ieee80211_free_node(ni);
3554                 ifp->if_oerrors++;
3555                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3556                 URTWN_UNLOCK(sc);
3557                 return (EIO);
3558         }
3559         URTWN_UNLOCK(sc);
3560
3561         sc->sc_txtimer = 5;
3562         return (0);
3563 }
3564
3565 static void
3566 urtwn_ms_delay(struct urtwn_softc *sc)
3567 {
3568         usb_pause_mtx(&sc->sc_mtx, hz / 1000);
3569 }
3570
3571 static device_method_t urtwn_methods[] = {
3572         /* Device interface */
3573         DEVMETHOD(device_probe,         urtwn_match),
3574         DEVMETHOD(device_attach,        urtwn_attach),
3575         DEVMETHOD(device_detach,        urtwn_detach),
3576
3577         DEVMETHOD_END
3578 };
3579
3580 static driver_t urtwn_driver = {
3581         "urtwn",
3582         urtwn_methods,
3583         sizeof(struct urtwn_softc)
3584 };
3585
3586 static devclass_t urtwn_devclass;
3587
3588 DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
3589 MODULE_DEPEND(urtwn, usb, 1, 1, 1);
3590 MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
3591 MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
3592 MODULE_VERSION(urtwn, 1);