sys/bus/u4b/wlan/if_urtwn.c

   1 /*      $OpenBSD: if_urtwn.c,v 1.16 2011/02/10 17:26:40 jakemsr Exp $   */
   2
   3 /*-
   4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
   5  * Copyright (c) 2014 Kevin Lo <kevlo@FreeBSD.org>
   6  * Copyright (c) 2015 Andriy Voskoboinyk <avos@FreeBSD.org>
   7  *
   8  * Permission to use, copy, modify, and distribute this software for any
   9  * purpose with or without fee is hereby granted, provided that the above
  10  * copyright notice and this permission notice appear in all copies.
  11  *
  12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19  */
  20
  21 #include <sys/cdefs.h>
  22 __FBSDID("$FreeBSD$");
  23
  24 /*
  25  * Driver for Realtek RTL8188CE-VAU/RTL8188CUS/RTL8188EU/RTL8188RU/RTL8192CU.
  26  */
  27
  28 #if defined(__DragonFly__)
  29 #else
  30 #include "opt_wlan.h"
  31 #include "opt_urtwn.h"
  32 #endif
  33
  34 #include <sys/param.h>
  35 #include <sys/sockio.h>
  36 #include <sys/sysctl.h>
  37 #include <sys/lock.h>
  38 #include <sys/mutex.h>
  39 #include <sys/condvar.h>
  40 #include <sys/mbuf.h>
  41 #include <sys/kernel.h>
  42 #include <sys/socket.h>
  43 #include <sys/systm.h>
  44 #include <sys/malloc.h>
  45 #include <sys/module.h>
  46 #include <sys/bus.h>
  47 #include <sys/endian.h>
  48 #include <sys/linker.h>
  49 #include <sys/firmware.h>
  50 #if defined(__DragonFly__)
  51 #else
  52 #include <sys/kdb.h>
  53
  54 #include <machine/bus.h>
  55 #include <machine/resource.h>
  56 #endif
  57
  58 #include <sys/rman.h>
  59
  60 #include <net/bpf.h>
  61 #include <net/if.h>
  62 #include <net/if_var.h>
  63 #include <net/if_arp.h>
  64 #include <net/ethernet.h>
  65 #include <net/if_dl.h>
  66 #include <net/if_media.h>
  67 #include <net/if_types.h>
  68
  69 #include <netinet/in.h>
  70 #include <netinet/in_systm.h>
  71 #include <netinet/in_var.h>
  72 #include <netinet/if_ether.h>
  73 #include <netinet/ip.h>
  74
  75 #include <netproto/802_11/ieee80211_var.h>
  76 #include <netproto/802_11/ieee80211_regdomain.h>
  77 #include <netproto/802_11/ieee80211_radiotap.h>
  78 #include <netproto/802_11/ieee80211_ratectl.h>
  79 #ifdef  IEEE80211_SUPPORT_SUPERG
  80 #include <netproto/802_11/ieee80211_superg.h>
  81 #endif
  82
  83 #include <bus/u4b/usb.h>
  84 #include <bus/u4b/usbdi.h>
  85 #include <bus/u4b/usb_device.h>
  86 #include "usbdevs.h"
  87
  88 #include <bus/u4b/usb_debug.h>
  89
  90 #include <bus/u4b/wlan/if_urtwnreg.h>
  91 #include <bus/u4b/wlan/if_urtwnvar.h>
  92
  93 #ifdef USB_DEBUG
  94 enum {
  95         URTWN_DEBUG_XMIT        = 0x00000001,   /* basic xmit operation */
  96         URTWN_DEBUG_RECV        = 0x00000002,   /* basic recv operation */
  97         URTWN_DEBUG_STATE       = 0x00000004,   /* 802.11 state transitions */
  98         URTWN_DEBUG_RA          = 0x00000008,   /* f/w rate adaptation setup */
  99         URTWN_DEBUG_USB         = 0x00000010,   /* usb requests */
 100         URTWN_DEBUG_FIRMWARE    = 0x00000020,   /* firmware(9) loading debug */
 101         URTWN_DEBUG_BEACON      = 0x00000040,   /* beacon handling */
 102         URTWN_DEBUG_INTR        = 0x00000080,   /* ISR */
 103         URTWN_DEBUG_TEMP        = 0x00000100,   /* temperature calibration */
 104         URTWN_DEBUG_ROM         = 0x00000200,   /* various ROM info */
 105         URTWN_DEBUG_KEY         = 0x00000400,   /* crypto keys management */
 106         URTWN_DEBUG_TXPWR       = 0x00000800,   /* dump Tx power values */
 107         URTWN_DEBUG_RSSI        = 0x00001000,   /* dump RSSI lookups */
 108         URTWN_DEBUG_ANY         = 0xffffffff
 109 };
 110
 111 #define URTWN_DPRINTF(_sc, _m, ...) do {                        \
 112         if ((_sc)->sc_debug & (_m))                             \
 113                 device_printf((_sc)->sc_dev, __VA_ARGS__);      \
 114 } while(0)
 115
 116 #else
 117 #define URTWN_DPRINTF(_sc, _m, ...)     do { (void) sc; } while (0)
 118 #endif
 119
 120 #define IEEE80211_HAS_ADDR4(wh) IEEE80211_IS_DSTODS(wh)
 121
 122 static int urtwn_enable_11n = 1;
 123 TUNABLE_INT("hw.usb.urtwn.enable_11n", &urtwn_enable_11n);
 124
 125 /* various supported device vendors/products */
 126 static const STRUCT_USB_HOST_ID urtwn_devs[] = {
 127 #define URTWN_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
 128 #define URTWN_RTL8188E_DEV(v,p) \
 129         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTWN_RTL8188E) }
 130 #define URTWN_RTL8188E  1
 131         URTWN_DEV(ABOCOM,       RTL8188CU_1),
 132         URTWN_DEV(ABOCOM,       RTL8188CU_2),
 133         URTWN_DEV(ABOCOM,       RTL8192CU),
 134         URTWN_DEV(ASUS,         RTL8192CU),
 135         URTWN_DEV(ASUS,         USBN10NANO),
 136         URTWN_DEV(AZUREWAVE,    RTL8188CE_1),
 137         URTWN_DEV(AZUREWAVE,    RTL8188CE_2),
 138         URTWN_DEV(AZUREWAVE,    RTL8188CU),
 139         URTWN_DEV(BELKIN,       F7D2102),
 140         URTWN_DEV(BELKIN,       RTL8188CU),
 141         URTWN_DEV(BELKIN,       RTL8192CU),
 142         URTWN_DEV(CHICONY,      RTL8188CUS_1),
 143         URTWN_DEV(CHICONY,      RTL8188CUS_2),
 144         URTWN_DEV(CHICONY,      RTL8188CUS_3),
 145         URTWN_DEV(CHICONY,      RTL8188CUS_4),
 146         URTWN_DEV(CHICONY,      RTL8188CUS_5),
 147         URTWN_DEV(COREGA,       RTL8192CU),
 148         URTWN_DEV(DLINK,        RTL8188CU),
 149         URTWN_DEV(DLINK,        RTL8192CU_1),
 150         URTWN_DEV(DLINK,        RTL8192CU_2),
 151         URTWN_DEV(DLINK,        RTL8192CU_3),
 152         URTWN_DEV(DLINK,        DWA131B),
 153         URTWN_DEV(EDIMAX,       EW7811UN),
 154         URTWN_DEV(EDIMAX,       RTL8192CU),
 155         URTWN_DEV(FEIXUN,       RTL8188CU),
 156         URTWN_DEV(FEIXUN,       RTL8192CU),
 157         URTWN_DEV(GUILLEMOT,    HWNUP150),
 158         URTWN_DEV(HAWKING,      RTL8192CU),
 159         URTWN_DEV(HP3,          RTL8188CU),
 160         URTWN_DEV(NETGEAR,      WNA1000M),
 161         URTWN_DEV(NETGEAR,      RTL8192CU),
 162         URTWN_DEV(NETGEAR4,     RTL8188CU),
 163         URTWN_DEV(NOVATECH,     RTL8188CU),
 164         URTWN_DEV(PLANEX2,      RTL8188CU_1),
 165         URTWN_DEV(PLANEX2,      RTL8188CU_2),
 166         URTWN_DEV(PLANEX2,      RTL8188CU_3),
 167         URTWN_DEV(PLANEX2,      RTL8188CU_4),
 168         URTWN_DEV(PLANEX2,      RTL8188CUS),
 169         URTWN_DEV(PLANEX2,      RTL8192CU),
 170         URTWN_DEV(REALTEK,      RTL8188CE_0),
 171         URTWN_DEV(REALTEK,      RTL8188CE_1),
 172         URTWN_DEV(REALTEK,      RTL8188CTV),
 173         URTWN_DEV(REALTEK,      RTL8188CU_0),
 174         URTWN_DEV(REALTEK,      RTL8188CU_1),
 175         URTWN_DEV(REALTEK,      RTL8188CU_2),
 176         URTWN_DEV(REALTEK,      RTL8188CU_3),
 177         URTWN_DEV(REALTEK,      RTL8188CU_COMBO),
 178         URTWN_DEV(REALTEK,      RTL8188CUS),
 179         URTWN_DEV(REALTEK,      RTL8188RU_1),
 180         URTWN_DEV(REALTEK,      RTL8188RU_2),
 181         URTWN_DEV(REALTEK,      RTL8188RU_3),
 182         URTWN_DEV(REALTEK,      RTL8191CU),
 183         URTWN_DEV(REALTEK,      RTL8192CE),
 184         URTWN_DEV(REALTEK,      RTL8192CU),
 185         URTWN_DEV(SITECOMEU,    RTL8188CU_1),
 186         URTWN_DEV(SITECOMEU,    RTL8188CU_2),
 187         URTWN_DEV(SITECOMEU,    RTL8192CU),
 188         URTWN_DEV(TRENDNET,     RTL8188CU),
 189         URTWN_DEV(TRENDNET,     RTL8192CU),
 190         URTWN_DEV(ZYXEL,        RTL8192CU),
 191         /* URTWN_RTL8188E */
 192         URTWN_RTL8188E_DEV(ABOCOM,      RTL8188EU),
 193         URTWN_RTL8188E_DEV(DLINK,       DWA123D1),
 194         URTWN_RTL8188E_DEV(DLINK,       DWA125D1),
 195         URTWN_RTL8188E_DEV(ELECOM,      WDC150SU2M),
 196         URTWN_RTL8188E_DEV(REALTEK,     RTL8188ETV),
 197         URTWN_RTL8188E_DEV(REALTEK,     RTL8188EU),
 198 #undef URTWN_RTL8188E_DEV
 199 #undef URTWN_DEV
 200 };
 201
 202 static device_probe_t   urtwn_match;
 203 static device_attach_t  urtwn_attach;
 204 static device_detach_t  urtwn_detach;
 205
 206 static usb_callback_t   urtwn_bulk_tx_callback;
 207 static usb_callback_t   urtwn_bulk_rx_callback;
 208
 209 static void             urtwn_sysctlattach(struct urtwn_softc *);
 210 static void             urtwn_drain_mbufq(struct urtwn_softc *);
 211 static usb_error_t      urtwn_do_request(struct urtwn_softc *,
 212                             struct usb_device_request *, void *);
 213 static struct ieee80211vap *urtwn_vap_create(struct ieee80211com *,
 214                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 215                     const uint8_t [IEEE80211_ADDR_LEN],
 216                     const uint8_t [IEEE80211_ADDR_LEN]);
 217 static void             urtwn_vap_delete(struct ieee80211vap *);
 218 static struct mbuf *    urtwn_rx_copy_to_mbuf(struct urtwn_softc *,
 219                             struct r92c_rx_stat *, int);
 220 static struct mbuf *    urtwn_report_intr(struct usb_xfer *,
 221                             struct urtwn_data *);
 222 static struct mbuf *    urtwn_rxeof(struct urtwn_softc *, uint8_t *, int);
 223 static void             urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *,
 224                             void *);
 225 static struct ieee80211_node *urtwn_rx_frame(struct urtwn_softc *,
 226                             struct mbuf *, int8_t *);
 227 static void             urtwn_txeof(struct urtwn_softc *, struct urtwn_data *,
 228                             int);
 229 static int              urtwn_alloc_list(struct urtwn_softc *,
 230                             struct urtwn_data[], int, int);
 231 static int              urtwn_alloc_rx_list(struct urtwn_softc *);
 232 static int              urtwn_alloc_tx_list(struct urtwn_softc *);
 233 static void             urtwn_free_list(struct urtwn_softc *,
 234                             struct urtwn_data data[], int);
 235 static void             urtwn_free_rx_list(struct urtwn_softc *);
 236 static void             urtwn_free_tx_list(struct urtwn_softc *);
 237 static struct urtwn_data *      _urtwn_getbuf(struct urtwn_softc *);
 238 static struct urtwn_data *      urtwn_getbuf(struct urtwn_softc *);
 239 static usb_error_t      urtwn_write_region_1(struct urtwn_softc *, uint16_t,
 240                             uint8_t *, int);
 241 static usb_error_t      urtwn_write_1(struct urtwn_softc *, uint16_t, uint8_t);
 242 static usb_error_t      urtwn_write_2(struct urtwn_softc *, uint16_t, uint16_t);
 243 static usb_error_t      urtwn_write_4(struct urtwn_softc *, uint16_t, uint32_t);
 244 static usb_error_t      urtwn_read_region_1(struct urtwn_softc *, uint16_t,
 245                             uint8_t *, int);
 246 static uint8_t          urtwn_read_1(struct urtwn_softc *, uint16_t);
 247 static uint16_t         urtwn_read_2(struct urtwn_softc *, uint16_t);
 248 static uint32_t         urtwn_read_4(struct urtwn_softc *, uint16_t);
 249 static int              urtwn_fw_cmd(struct urtwn_softc *, uint8_t,
 250                             const void *, int);
 251 static void             urtwn_cmdq_cb(void *, int);
 252 static int              urtwn_cmd_sleepable(struct urtwn_softc *, const void *,
 253                             size_t, CMD_FUNC_PROTO);
 254 static void             urtwn_r92c_rf_write(struct urtwn_softc *, int,
 255                             uint8_t, uint32_t);
 256 static void             urtwn_r88e_rf_write(struct urtwn_softc *, int,
 257                             uint8_t, uint32_t);
 258 static uint32_t         urtwn_rf_read(struct urtwn_softc *, int, uint8_t);
 259 static int              urtwn_llt_write(struct urtwn_softc *, uint32_t,
 260                             uint32_t);
 261 static int              urtwn_efuse_read_next(struct urtwn_softc *, uint8_t *);
 262 static int              urtwn_efuse_read_data(struct urtwn_softc *, uint8_t *,
 263                             uint8_t, uint8_t);
 264 #ifdef USB_DEBUG
 265 static void             urtwn_dump_rom_contents(struct urtwn_softc *,
 266                             uint8_t *, uint16_t);
 267 #endif
 268 static int              urtwn_efuse_read(struct urtwn_softc *, uint8_t *,
 269                             uint16_t);
 270 static int              urtwn_efuse_switch_power(struct urtwn_softc *);
 271 static int              urtwn_read_chipid(struct urtwn_softc *);
 272 static int              urtwn_read_rom(struct urtwn_softc *);
 273 static int              urtwn_r88e_read_rom(struct urtwn_softc *);
 274 static int              urtwn_ra_init(struct urtwn_softc *);
 275 static void             urtwn_init_beacon(struct urtwn_softc *,
 276                             struct urtwn_vap *);
 277 static int              urtwn_setup_beacon(struct urtwn_softc *,
 278                             struct ieee80211_node *);
 279 static void             urtwn_update_beacon(struct ieee80211vap *, int);
 280 static int              urtwn_tx_beacon(struct urtwn_softc *sc,
 281                             struct urtwn_vap *);
 282 static int              urtwn_key_alloc(struct ieee80211vap *,
 283                             struct ieee80211_key *, ieee80211_keyix *,
 284                             ieee80211_keyix *);
 285 static void             urtwn_key_set_cb(struct urtwn_softc *,
 286                             union sec_param *);
 287 static void             urtwn_key_del_cb(struct urtwn_softc *,
 288                             union sec_param *);
 289 static int              urtwn_key_set(struct ieee80211vap *,
 290                             const struct ieee80211_key *);
 291 static int              urtwn_key_delete(struct ieee80211vap *,
 292                             const struct ieee80211_key *);
 293 static void             urtwn_tsf_task_adhoc(void *, int);
 294 static void             urtwn_tsf_sync_enable(struct urtwn_softc *,
 295                             struct ieee80211vap *);
 296 static void             urtwn_get_tsf(struct urtwn_softc *, uint64_t *);
 297 static void             urtwn_set_led(struct urtwn_softc *, int, int);
 298 static void             urtwn_set_mode(struct urtwn_softc *, uint8_t);
 299 static void             urtwn_ibss_recv_mgmt(struct ieee80211_node *,
 300                             struct mbuf *, int,
 301                             const struct ieee80211_rx_stats *, int, int);
 302 static int              urtwn_newstate(struct ieee80211vap *,
 303                             enum ieee80211_state, int);
 304 static void             urtwn_calib_to(void *);
 305 static void             urtwn_calib_cb(struct urtwn_softc *,
 306                             union sec_param *);
 307 static void             urtwn_watchdog(void *);
 308 static void             urtwn_update_avgrssi(struct urtwn_softc *, int, int8_t);
 309 static int8_t           urtwn_get_rssi(struct urtwn_softc *, int, void *);
 310 static int8_t           urtwn_r88e_get_rssi(struct urtwn_softc *, int, void *);
 311 static int              urtwn_tx_data(struct urtwn_softc *,
 312                             struct ieee80211_node *, struct mbuf *,
 313                             struct urtwn_data *);
 314 static int              urtwn_tx_raw(struct urtwn_softc *,
 315                             struct ieee80211_node *, struct mbuf *,
 316                             struct urtwn_data *,
 317                             const struct ieee80211_bpf_params *);
 318 static void             urtwn_tx_start(struct urtwn_softc *, struct mbuf *,
 319                             uint8_t, struct urtwn_data *);
 320 static int              urtwn_transmit(struct ieee80211com *, struct mbuf *);
 321 static void             urtwn_start(struct urtwn_softc *);
 322 static void             urtwn_parent(struct ieee80211com *);
 323 static int              urtwn_r92c_power_on(struct urtwn_softc *);
 324 static int              urtwn_r88e_power_on(struct urtwn_softc *);
 325 static void             urtwn_r92c_power_off(struct urtwn_softc *);
 326 static void             urtwn_r88e_power_off(struct urtwn_softc *);
 327 static int              urtwn_llt_init(struct urtwn_softc *);
 328 #ifndef URTWN_WITHOUT_UCODE
 329 static void             urtwn_fw_reset(struct urtwn_softc *);
 330 static void             urtwn_r88e_fw_reset(struct urtwn_softc *);
 331 static int              urtwn_fw_loadpage(struct urtwn_softc *, int,
 332                             const uint8_t *, int);
 333 static int              urtwn_load_firmware(struct urtwn_softc *);
 334 #endif
 335 static int              urtwn_dma_init(struct urtwn_softc *);
 336 static int              urtwn_mac_init(struct urtwn_softc *);
 337 static void             urtwn_bb_init(struct urtwn_softc *);
 338 static void             urtwn_rf_init(struct urtwn_softc *);
 339 static void             urtwn_cam_init(struct urtwn_softc *);
 340 static int              urtwn_cam_write(struct urtwn_softc *, uint32_t,
 341                             uint32_t);
 342 static void             urtwn_pa_bias_init(struct urtwn_softc *);
 343 static void             urtwn_rxfilter_init(struct urtwn_softc *);
 344 static void             urtwn_edca_init(struct urtwn_softc *);
 345 static void             urtwn_write_txpower(struct urtwn_softc *, int,
 346                             uint16_t[]);
 347 static void             urtwn_get_txpower(struct urtwn_softc *, int,
 348                             struct ieee80211_channel *,
 349                             struct ieee80211_channel *, uint16_t[]);
 350 static void             urtwn_r88e_get_txpower(struct urtwn_softc *, int,
 351                             struct ieee80211_channel *,
 352                             struct ieee80211_channel *, uint16_t[]);
 353 static void             urtwn_set_txpower(struct urtwn_softc *,
 354                             struct ieee80211_channel *,
 355                             struct ieee80211_channel *);
 356 static void             urtwn_set_rx_bssid_all(struct urtwn_softc *, int);
 357 static void             urtwn_set_gain(struct urtwn_softc *, uint8_t);
 358 static void             urtwn_scan_start(struct ieee80211com *);
 359 static void             urtwn_scan_end(struct ieee80211com *);
 360 static void             urtwn_set_channel(struct ieee80211com *);
 361 static int              urtwn_wme_update(struct ieee80211com *);
 362 static void             urtwn_update_slot(struct ieee80211com *);
 363 static void             urtwn_update_slot_cb(struct urtwn_softc *,
 364                             union sec_param *);
 365 static void             urtwn_update_aifs(struct urtwn_softc *, uint8_t);
 366 static uint8_t          urtwn_get_multi_pos(const uint8_t[]);
 367 static void             urtwn_set_multi(struct urtwn_softc *);
 368 static void             urtwn_set_promisc(struct urtwn_softc *);
 369 static void             urtwn_update_promisc(struct ieee80211com *);
 370 static void             urtwn_update_mcast(struct ieee80211com *);
 371 static struct ieee80211_node *urtwn_node_alloc(struct ieee80211vap *,
 372                             const uint8_t mac[IEEE80211_ADDR_LEN]);
 373 static void             urtwn_newassoc(struct ieee80211_node *, int);
 374 static void             urtwn_node_free(struct ieee80211_node *);
 375 static void             urtwn_set_chan(struct urtwn_softc *,
 376                             struct ieee80211_channel *,
 377                             struct ieee80211_channel *);
 378 static void             urtwn_iq_calib(struct urtwn_softc *);
 379 static void             urtwn_lc_calib(struct urtwn_softc *);
 380 static void             urtwn_temp_calib(struct urtwn_softc *);
 381 static int              urtwn_init(struct urtwn_softc *);
 382 static void             urtwn_stop(struct urtwn_softc *);
 383 static void             urtwn_abort_xfers(struct urtwn_softc *);
 384 static int              urtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
 385                             const struct ieee80211_bpf_params *);
 386 static void             urtwn_ms_delay(struct urtwn_softc *);
 387
 388 /* Aliases. */
 389 #define urtwn_bb_write  urtwn_write_4
 390 #define urtwn_bb_read   urtwn_read_4
 391
 392 static const struct usb_config urtwn_config[URTWN_N_TRANSFER] = {
 393         [URTWN_BULK_RX] = {
 394                 .type = UE_BULK,
 395                 .endpoint = UE_ADDR_ANY,
 396                 .direction = UE_DIR_IN,
 397                 .bufsize = URTWN_RXBUFSZ,
 398                 .flags = {
 399                         .pipe_bof = 1,
 400                         .short_xfer_ok = 1
 401                 },
 402                 .callback = urtwn_bulk_rx_callback,
 403         },
 404         [URTWN_BULK_TX_BE] = {
 405                 .type = UE_BULK,
 406                 .endpoint = 0x03,
 407                 .direction = UE_DIR_OUT,
 408                 .bufsize = URTWN_TXBUFSZ,
 409                 .flags = {
 410                         .ext_buffer = 1,
 411                         .pipe_bof = 1,
 412                         .force_short_xfer = 1
 413                 },
 414                 .callback = urtwn_bulk_tx_callback,
 415                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 416         },
 417         [URTWN_BULK_TX_BK] = {
 418                 .type = UE_BULK,
 419                 .endpoint = 0x03,
 420                 .direction = UE_DIR_OUT,
 421                 .bufsize = URTWN_TXBUFSZ,
 422                 .flags = {
 423                         .ext_buffer = 1,
 424                         .pipe_bof = 1,
 425                         .force_short_xfer = 1,
 426                 },
 427                 .callback = urtwn_bulk_tx_callback,
 428                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 429         },
 430         [URTWN_BULK_TX_VI] = {
 431                 .type = UE_BULK,
 432                 .endpoint = 0x02,
 433                 .direction = UE_DIR_OUT,
 434                 .bufsize = URTWN_TXBUFSZ,
 435                 .flags = {
 436                         .ext_buffer = 1,
 437                         .pipe_bof = 1,
 438                         .force_short_xfer = 1
 439                 },
 440                 .callback = urtwn_bulk_tx_callback,
 441                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 442         },
 443         [URTWN_BULK_TX_VO] = {
 444                 .type = UE_BULK,
 445                 .endpoint = 0x02,
 446                 .direction = UE_DIR_OUT,
 447                 .bufsize = URTWN_TXBUFSZ,
 448                 .flags = {
 449                         .ext_buffer = 1,
 450                         .pipe_bof = 1,
 451                         .force_short_xfer = 1
 452                 },
 453                 .callback = urtwn_bulk_tx_callback,
 454                 .timeout = URTWN_TX_TIMEOUT,    /* ms */
 455         },
 456 };
 457
 458 static const struct wme_to_queue {
 459         uint16_t reg;
 460         uint8_t qid;
 461 } wme2queue[WME_NUM_AC] = {
 462         { R92C_EDCA_BE_PARAM, URTWN_BULK_TX_BE},
 463         { R92C_EDCA_BK_PARAM, URTWN_BULK_TX_BK},
 464         { R92C_EDCA_VI_PARAM, URTWN_BULK_TX_VI},
 465         { R92C_EDCA_VO_PARAM, URTWN_BULK_TX_VO}
 466 };
 467
 468 static int
 469 urtwn_match(device_t self)
 470 {
 471         struct usb_attach_arg *uaa = device_get_ivars(self);
 472
 473         if (uaa->usb_mode != USB_MODE_HOST)
 474                 return (ENXIO);
 475         if (uaa->info.bConfigIndex != URTWN_CONFIG_INDEX)
 476                 return (ENXIO);
 477         if (uaa->info.bIfaceIndex != URTWN_IFACE_INDEX)
 478                 return (ENXIO);
 479
 480         return (usbd_lookup_id_by_uaa(urtwn_devs, sizeof(urtwn_devs), uaa));
 481 }
 482
 483 static void
 484 urtwn_update_chw(struct ieee80211com *ic)
 485 {
 486 }
 487
 488 static int
 489 urtwn_ampdu_enable(struct ieee80211_node *ni, struct ieee80211_tx_ampdu *tap)
 490 {
 491
 492         /* We're driving this ourselves (eventually); don't involve net80211 */
 493         return (0);
 494 }
 495
 496 static int
 497 urtwn_attach(device_t self)
 498 {
 499         struct usb_attach_arg *uaa = device_get_ivars(self);
 500         struct urtwn_softc *sc = device_get_softc(self);
 501         struct ieee80211com *ic = &sc->sc_ic;
 502         uint8_t bands[IEEE80211_MODE_BYTES];
 503         int error;
 504
 505         device_set_usb_desc(self);
 506         sc->sc_udev = uaa->device;
 507         sc->sc_dev = self;
 508         if (USB_GET_DRIVER_INFO(uaa) == URTWN_RTL8188E)
 509                 sc->chip |= URTWN_CHIP_88E;
 510
 511 #ifdef USB_DEBUG
 512         int debug;
 513         if (resource_int_value(device_get_name(sc->sc_dev),
 514             device_get_unit(sc->sc_dev), "debug", &debug) == 0)
 515                 sc->sc_debug = debug;
 516 #endif
 517
 518 #if defined(__DragonFly__)
 519         lockinit(&sc->sc_mtx, device_get_nameunit(self), 0, 0);
 520 #else
 521         mtx_init(&sc->sc_mtx, device_get_nameunit(self),
 522             MTX_NETWORK_LOCK, MTX_DEF);
 523 #endif
 524         URTWN_CMDQ_LOCK_INIT(sc);
 525         URTWN_NT_LOCK_INIT(sc);
 526 #if defined(__DragonFly__)
 527         callout_init(&sc->sc_calib_to);
 528         callout_init(&sc->sc_watchdog_ch);
 529 #else
 530         callout_init(&sc->sc_calib_to, 0);
 531         callout_init(&sc->sc_watchdog_ch, 0);
 532 #endif
 533         mbufq_init(&sc->sc_snd, ifqmaxlen);
 534
 535         sc->sc_iface_index = URTWN_IFACE_INDEX;
 536         error = usbd_transfer_setup(uaa->device, &sc->sc_iface_index,
 537             sc->sc_xfer, urtwn_config, URTWN_N_TRANSFER, sc, &sc->sc_mtx);
 538         if (error) {
 539                 device_printf(self, "could not allocate USB transfers, "
 540                     "err=%s\n", usbd_errstr(error));
 541                 goto detach;
 542         }
 543
 544         URTWN_LOCK(sc);
 545
 546         error = urtwn_read_chipid(sc);
 547         if (error) {
 548                 device_printf(sc->sc_dev, "unsupported test chip\n");
 549                 URTWN_UNLOCK(sc);
 550                 goto detach;
 551         }
 552
 553         /* Determine number of Tx/Rx chains. */
 554         if (sc->chip & URTWN_CHIP_92C) {
 555                 sc->ntxchains = (sc->chip & URTWN_CHIP_92C_1T2R) ? 1 : 2;
 556                 sc->nrxchains = 2;
 557         } else {
 558                 sc->ntxchains = 1;
 559                 sc->nrxchains = 1;
 560         }
 561
 562         if (sc->chip & URTWN_CHIP_88E)
 563                 error = urtwn_r88e_read_rom(sc);
 564         else
 565                 error = urtwn_read_rom(sc);
 566         if (error != 0) {
 567                 device_printf(sc->sc_dev, "%s: cannot read rom, error %d\n",
 568                     __func__, error);
 569                 URTWN_UNLOCK(sc);
 570                 goto detach;
 571         }
 572
 573         device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
 574             (sc->chip & URTWN_CHIP_92C) ? "8192CU" :
 575             (sc->chip & URTWN_CHIP_88E) ? "8188EU" :
 576             (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
 577             (sc->board_type == R92C_BOARD_TYPE_MINICARD) ? "8188CE-VAU" :
 578             "8188CUS", sc->ntxchains, sc->nrxchains);
 579
 580         URTWN_UNLOCK(sc);
 581
 582         ic->ic_softc = sc;
 583         ic->ic_name = device_get_nameunit(self);
 584         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 585         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 586
 587         /* set device capabilities */
 588         ic->ic_caps =
 589                   IEEE80211_C_STA               /* station mode */
 590                 | IEEE80211_C_MONITOR           /* monitor mode */
 591                 | IEEE80211_C_IBSS              /* adhoc mode */
 592                 | IEEE80211_C_HOSTAP            /* hostap mode */
 593                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
 594                 | IEEE80211_C_SHSLOT            /* short slot time supported */
 595 #if 0
 596                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
 597 #endif
 598                 | IEEE80211_C_WPA               /* 802.11i */
 599                 | IEEE80211_C_WME               /* 802.11e */
 600                 | IEEE80211_C_SWAMSDUTX         /* Do software A-MSDU TX */
 601                 | IEEE80211_C_FF                /* Atheros fast-frames */
 602                 ;
 603
 604         ic->ic_cryptocaps =
 605             IEEE80211_CRYPTO_WEP |
 606             IEEE80211_CRYPTO_TKIP |
 607             IEEE80211_CRYPTO_AES_CCM;
 608
 609         /* Assume they're all 11n capable for now */
 610         if (urtwn_enable_11n) {
 611                 device_printf(self, "enabling 11n\n");
 612                 ic->ic_htcaps = IEEE80211_HTC_HT |
 613 #if 0
 614                     IEEE80211_HTC_AMPDU |
 615 #endif
 616                     IEEE80211_HTC_AMSDU |
 617                     IEEE80211_HTCAP_MAXAMSDU_3839 |
 618                     IEEE80211_HTCAP_SMPS_OFF;
 619                 /* no HT40 just yet */
 620                 // ic->ic_htcaps |= IEEE80211_HTCAP_CHWIDTH40;
 621
 622                 /* XXX TODO: verify chains versus streams for urtwn */
 623                 ic->ic_txstream = sc->ntxchains;
 624                 ic->ic_rxstream = sc->nrxchains;
 625         }
 626
 627         memset(bands, 0, sizeof(bands));
 628         setbit(bands, IEEE80211_MODE_11B);
 629         setbit(bands, IEEE80211_MODE_11G);
 630         if (urtwn_enable_11n)
 631                 setbit(bands, IEEE80211_MODE_11NG);
 632         ieee80211_init_channels(ic, NULL, bands);
 633
 634         ieee80211_ifattach(ic);
 635         ic->ic_raw_xmit = urtwn_raw_xmit;
 636         ic->ic_scan_start = urtwn_scan_start;
 637         ic->ic_scan_end = urtwn_scan_end;
 638         ic->ic_set_channel = urtwn_set_channel;
 639         ic->ic_transmit = urtwn_transmit;
 640         ic->ic_parent = urtwn_parent;
 641         ic->ic_vap_create = urtwn_vap_create;
 642         ic->ic_vap_delete = urtwn_vap_delete;
 643         ic->ic_wme.wme_update = urtwn_wme_update;
 644         ic->ic_updateslot = urtwn_update_slot;
 645         ic->ic_update_promisc = urtwn_update_promisc;
 646         ic->ic_update_mcast = urtwn_update_mcast;
 647         if (sc->chip & URTWN_CHIP_88E) {
 648                 ic->ic_node_alloc = urtwn_node_alloc;
 649                 ic->ic_newassoc = urtwn_newassoc;
 650                 sc->sc_node_free = ic->ic_node_free;
 651                 ic->ic_node_free = urtwn_node_free;
 652         }
 653         ic->ic_update_chw = urtwn_update_chw;
 654         ic->ic_ampdu_enable = urtwn_ampdu_enable;
 655
 656         ieee80211_radiotap_attach(ic, &sc->sc_txtap.wt_ihdr,
 657             sizeof(sc->sc_txtap), URTWN_TX_RADIOTAP_PRESENT,
 658             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 659             URTWN_RX_RADIOTAP_PRESENT);
 660
 661         TASK_INIT(&sc->cmdq_task, 0, urtwn_cmdq_cb, sc);
 662
 663         urtwn_sysctlattach(sc);
 664
 665         if (bootverbose)
 666                 ieee80211_announce(ic);
 667
 668         return (0);
 669
 670 detach:
 671         urtwn_detach(self);
 672         return (ENXIO);                 /* failure */
 673 }
 674
 675 static void
 676 urtwn_sysctlattach(struct urtwn_softc *sc)
 677 {
 678 #ifdef USB_DEBUG
 679         struct sysctl_ctx_list *ctx = device_get_sysctl_ctx(sc->sc_dev);
 680         struct sysctl_oid *tree = device_get_sysctl_tree(sc->sc_dev);
 681
 682         SYSCTL_ADD_U32(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
 683             "debug", CTLFLAG_RW, &sc->sc_debug, sc->sc_debug,
 684             "control debugging printfs");
 685 #endif
 686 }
 687
 688 static int
 689 urtwn_detach(device_t self)
 690 {
 691         struct urtwn_softc *sc = device_get_softc(self);
 692         struct ieee80211com *ic = &sc->sc_ic;
 693         unsigned int x;
 694
 695         /* Prevent further ioctls. */
 696         URTWN_LOCK(sc);
 697         sc->sc_flags |= URTWN_DETACHED;
 698         URTWN_UNLOCK(sc);
 699
 700         urtwn_stop(sc);
 701
 702         callout_drain(&sc->sc_watchdog_ch);
 703         callout_drain(&sc->sc_calib_to);
 704
 705         /* stop all USB transfers */
 706         usbd_transfer_unsetup(sc->sc_xfer, URTWN_N_TRANSFER);
 707
 708         /* Prevent further allocations from RX/TX data lists. */
 709         URTWN_LOCK(sc);
 710         STAILQ_INIT(&sc->sc_tx_active);
 711         STAILQ_INIT(&sc->sc_tx_inactive);
 712         STAILQ_INIT(&sc->sc_tx_pending);
 713
 714         STAILQ_INIT(&sc->sc_rx_active);
 715         STAILQ_INIT(&sc->sc_rx_inactive);
 716         URTWN_UNLOCK(sc);
 717
 718         /* drain USB transfers */
 719         for (x = 0; x != URTWN_N_TRANSFER; x++)
 720                 usbd_transfer_drain(sc->sc_xfer[x]);
 721
 722         /* Free data buffers. */
 723         URTWN_LOCK(sc);
 724         urtwn_free_tx_list(sc);
 725         urtwn_free_rx_list(sc);
 726         URTWN_UNLOCK(sc);
 727
 728         if (ic->ic_softc == sc) {
 729                 ieee80211_draintask(ic, &sc->cmdq_task);
 730                 ieee80211_ifdetach(ic);
 731         }
 732
 733         URTWN_NT_LOCK_DESTROY(sc);
 734         URTWN_CMDQ_LOCK_DESTROY(sc);
 735         lockuninit(&sc->sc_mtx);
 736
 737         return (0);
 738 }
 739
 740 static void
 741 urtwn_drain_mbufq(struct urtwn_softc *sc)
 742 {
 743         struct mbuf *m;
 744         struct ieee80211_node *ni;
 745         URTWN_ASSERT_LOCKED(sc);
 746         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 747                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
 748                 m->m_pkthdr.rcvif = NULL;
 749                 ieee80211_free_node(ni);
 750                 m_freem(m);
 751         }
 752 }
 753
 754 static usb_error_t
 755 urtwn_do_request(struct urtwn_softc *sc, struct usb_device_request *req,
 756     void *data)
 757 {
 758         usb_error_t err;
 759         int ntries = 10;
 760
 761         URTWN_ASSERT_LOCKED(sc);
 762
 763         while (ntries--) {
 764                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
 765                     req, data, 0, NULL, 250 /* ms */);
 766                 if (err == 0)
 767                         break;
 768
 769                 URTWN_DPRINTF(sc, URTWN_DEBUG_USB,
 770                     "%s: control request failed, %s (retries left: %d)\n",
 771                     __func__, usbd_errstr(err), ntries);
 772                 usb_pause_mtx(&sc->sc_mtx, hz / 100);
 773         }
 774         return (err);
 775 }
 776
 777 static struct ieee80211vap *
 778 urtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 779     enum ieee80211_opmode opmode, int flags,
 780     const uint8_t bssid[IEEE80211_ADDR_LEN],
 781     const uint8_t mac[IEEE80211_ADDR_LEN])
 782 {
 783         struct urtwn_softc *sc = ic->ic_softc;
 784         struct urtwn_vap *uvp;
 785         struct ieee80211vap *vap;
 786
 787         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
 788                 return (NULL);
 789
 790         uvp = kmalloc(sizeof(struct urtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 791         vap = &uvp->vap;
 792         /* enable s/w bmiss handling for sta mode */
 793
 794         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
 795             flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
 796                 /* out of memory */
 797                 kfree(uvp, M_80211_VAP);
 798                 return (NULL);
 799         }
 800
 801         if (opmode == IEEE80211_M_HOSTAP || opmode == IEEE80211_M_IBSS)
 802                 urtwn_init_beacon(sc, uvp);
 803
 804         /* override state transition machine */
 805         uvp->newstate = vap->iv_newstate;
 806         vap->iv_newstate = urtwn_newstate;
 807         vap->iv_update_beacon = urtwn_update_beacon;
 808         vap->iv_key_alloc = urtwn_key_alloc;
 809         vap->iv_key_set = urtwn_key_set;
 810         vap->iv_key_delete = urtwn_key_delete;
 811
 812         /* 802.11n parameters */
 813         vap->iv_ampdu_density = IEEE80211_HTCAP_MPDUDENSITY_16;
 814         vap->iv_ampdu_rxmax = IEEE80211_HTCAP_MAXRXAMPDU_64K;
 815
 816         if (opmode == IEEE80211_M_IBSS) {
 817                 uvp->recv_mgmt = vap->iv_recv_mgmt;
 818                 vap->iv_recv_mgmt = urtwn_ibss_recv_mgmt;
 819                 TASK_INIT(&uvp->tsf_task_adhoc, 0, urtwn_tsf_task_adhoc, vap);
 820         }
 821
 822         if (URTWN_CHIP_HAS_RATECTL(sc))
 823                 ieee80211_ratectl_init(vap);
 824         /* complete setup */
 825         ieee80211_vap_attach(vap, ieee80211_media_change,
 826             ieee80211_media_status, mac);
 827         ic->ic_opmode = opmode;
 828         return (vap);
 829 }
 830
 831 static void
 832 urtwn_vap_delete(struct ieee80211vap *vap)
 833 {
 834         struct ieee80211com *ic = vap->iv_ic;
 835         struct urtwn_softc *sc = ic->ic_softc;
 836         struct urtwn_vap *uvp = URTWN_VAP(vap);
 837
 838         if (uvp->bcn_mbuf != NULL)
 839                 m_freem(uvp->bcn_mbuf);
 840         if (vap->iv_opmode == IEEE80211_M_IBSS)
 841                 ieee80211_draintask(ic, &uvp->tsf_task_adhoc);
 842         if (URTWN_CHIP_HAS_RATECTL(sc))
 843                 ieee80211_ratectl_deinit(vap);
 844         ieee80211_vap_detach(vap);
 845         kfree(uvp, M_80211_VAP);
 846 }
 847
 848 static struct mbuf *
 849 urtwn_rx_copy_to_mbuf(struct urtwn_softc *sc, struct r92c_rx_stat *stat,
 850     int totlen)
 851 {
 852         /* ic is not used, remove to fix gcc warning */
 853         /* struct ieee80211com *ic = &sc->sc_ic; */
 854         struct mbuf *m;
 855         uint32_t rxdw0;
 856         int pktlen;
 857
 858         /*
 859          * don't pass packets to the ieee80211 framework if the driver isn't
 860          * RUNNING.
 861          */
 862         if (!(sc->sc_flags & URTWN_RUNNING))
 863                 return (NULL);
 864
 865         rxdw0 = le32toh(stat->rxdw0);
 866         if (rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR)) {
 867                 /*
 868                  * This should not happen since we setup our Rx filter
 869                  * to not receive these frames.
 870                  */
 871                 URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
 872                     "%s: RX flags error (%s)\n", __func__,
 873                     rxdw0 & R92C_RXDW0_CRCERR ? "CRC" : "ICV");
 874                 goto fail;
 875         }
 876
 877         pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
 878         if (pktlen < sizeof(struct ieee80211_frame_ack)) {
 879                 URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
 880                     "%s: frame is too short: %d\n", __func__, pktlen);
 881                 goto fail;
 882         }
 883
 884         if (__predict_false(totlen > MCLBYTES)) {
 885                 /* convert to m_getjcl if this happens */
 886                 device_printf(sc->sc_dev, "%s: frame too long: %d (%d)\n",
 887                     __func__, pktlen, totlen);
 888                 goto fail;
 889         }
 890
 891         m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 892         if (__predict_false(m == NULL)) {
 893                 device_printf(sc->sc_dev, "%s: could not allocate RX mbuf\n",
 894                     __func__);
 895                 goto fail;
 896         }
 897
 898         /* Finalize mbuf. */
 899         memcpy(mtod(m, uint8_t *), (uint8_t *)stat, totlen);
 900         m->m_pkthdr.len = m->m_len = totlen;
 901
 902         return (m);
 903 fail:
 904 #if defined(__DragonFly__)
 905         /* unimplemented */
 906 #else
 907         counter_u64_add(ic->ic_ierrors, 1);
 908 #endif
 909         return (NULL);
 910 }
 911
 912 static struct mbuf *
 913 urtwn_report_intr(struct usb_xfer *xfer, struct urtwn_data *data)
 914 {
 915         struct urtwn_softc *sc = data->sc;
 916         /* ic not used, remove to fix gcc error */
 917         /* struct ieee80211com *ic = &sc->sc_ic;*/
 918         struct r92c_rx_stat *stat;
 919         uint8_t *buf;
 920         int len;
 921
 922         usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
 923
 924         if (len < sizeof(*stat)) {
 925 #if defined(__DragonFly__)
 926                 /* unimplemented */
 927 #else
 928                 counter_u64_add(ic->ic_ierrors, 1);
 929 #endif
 930                 return (NULL);
 931         }
 932
 933         buf = data->buf;
 934         stat = (struct r92c_rx_stat *)buf;
 935
 936         /*
 937          * For 88E chips we can tie the FF flushing here;
 938          * this is where we do know exactly how deep the
 939          * transmit queue is.
 940          *
 941          * But it won't work for R92 chips, so we can't
 942          * take the easy way out.
 943          */
 944
 945         if (sc->chip & URTWN_CHIP_88E) {
 946                 int report_sel = MS(le32toh(stat->rxdw3), R88E_RXDW3_RPT);
 947
 948                 switch (report_sel) {
 949                 case R88E_RXDW3_RPT_RX:
 950                         return (urtwn_rxeof(sc, buf, len));
 951                 case R88E_RXDW3_RPT_TX1:
 952                         urtwn_r88e_ratectl_tx_complete(sc, &stat[1]);
 953                         break;
 954                 default:
 955                         URTWN_DPRINTF(sc, URTWN_DEBUG_INTR,
 956                             "%s: case %d was not handled\n", __func__,
 957                             report_sel);
 958                         break;
 959                 }
 960         } else
 961                 return (urtwn_rxeof(sc, buf, len));
 962
 963         return (NULL);
 964 }
 965
 966 static struct mbuf *
 967 urtwn_rxeof(struct urtwn_softc *sc, uint8_t *buf, int len)
 968 {
 969         struct r92c_rx_stat *stat;
 970         struct mbuf *m, *m0 = NULL, *prevm = NULL;
 971         uint32_t rxdw0;
 972         int totlen, pktlen, infosz, npkts;
 973
 974         /* Get the number of encapsulated frames. */
 975         stat = (struct r92c_rx_stat *)buf;
 976         npkts = MS(le32toh(stat->rxdw2), R92C_RXDW2_PKTCNT);
 977         URTWN_DPRINTF(sc, URTWN_DEBUG_RECV,
 978             "%s: Rx %d frames in one chunk\n", __func__, npkts);
 979
 980         /* Process all of them. */
 981         while (npkts-- > 0) {
 982                 if (len < sizeof(*stat))
 983                         break;
 984                 stat = (struct r92c_rx_stat *)buf;
 985                 rxdw0 = le32toh(stat->rxdw0);
 986
 987                 pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
 988                 if (pktlen == 0)
 989                         break;
 990
 991                 infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
 992
 993                 /* Make sure everything fits in xfer. */
 994                 totlen = sizeof(*stat) + infosz + pktlen;
 995                 if (totlen > len)
 996                         break;
 997
 998                 m = urtwn_rx_copy_to_mbuf(sc, stat, totlen);
 999                 if (m0 == NULL)
1000                         m0 = m;
1001                 if (prevm == NULL)
1002                         prevm = m;
1003                 else {
1004                         prevm->m_next = m;
1005                         prevm = m;
1006                 }
1007
1008                 /* Next chunk is 128-byte aligned. */
1009                 totlen = (totlen + 127) & ~127;
1010                 buf += totlen;
1011                 len -= totlen;
1012         }
1013
1014         return (m0);
1015 }
1016
1017 static void
1018 urtwn_r88e_ratectl_tx_complete(struct urtwn_softc *sc, void *arg)
1019 {
1020         struct r88e_tx_rpt_ccx *rpt = arg;
1021         struct ieee80211vap *vap;
1022         struct ieee80211_node *ni;
1023         uint8_t macid;
1024         int ntries;
1025
1026         macid = MS(rpt->rptb1, R88E_RPTB1_MACID);
1027         ntries = MS(rpt->rptb2, R88E_RPTB2_RETRY_CNT);
1028
1029         URTWN_NT_LOCK(sc);
1030         ni = sc->node_list[macid];
1031         if (ni != NULL) {
1032                 vap = ni->ni_vap;
1033                 URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: frame for macid %d was"
1034                     "%s sent (%d retries)\n", __func__, macid,
1035                     (rpt->rptb1 & R88E_RPTB1_PKT_OK) ? "" : " not",
1036                     ntries);
1037
1038                 if (rpt->rptb1 & R88E_RPTB1_PKT_OK) {
1039                         ieee80211_ratectl_tx_complete(vap, ni,
1040                             IEEE80211_RATECTL_TX_SUCCESS, &ntries, NULL);
1041                 } else {
1042                         ieee80211_ratectl_tx_complete(vap, ni,
1043                             IEEE80211_RATECTL_TX_FAILURE, &ntries, NULL);
1044                 }
1045         } else {
1046                 URTWN_DPRINTF(sc, URTWN_DEBUG_INTR, "%s: macid %d, ni is NULL\n",
1047                     __func__, macid);
1048         }
1049         URTWN_NT_UNLOCK(sc);
1050 }
1051
1052 static struct ieee80211_node *
1053 urtwn_rx_frame(struct urtwn_softc *sc, struct mbuf *m, int8_t *rssi_p)
1054 {
1055         struct ieee80211com *ic = &sc->sc_ic;
1056         struct ieee80211_frame_min *wh;
1057         struct r92c_rx_stat *stat;
1058         uint32_t rxdw0, rxdw3;
1059         uint8_t rate, cipher;
1060         int8_t rssi = -127;
1061         int infosz;
1062
1063         stat = mtod(m, struct r92c_rx_stat *);
1064         rxdw0 = le32toh(stat->rxdw0);
1065         rxdw3 = le32toh(stat->rxdw3);
1066
1067         rate = MS(rxdw3, R92C_RXDW3_RATE);
1068         cipher = MS(rxdw0, R92C_RXDW0_CIPHER);
1069         infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1070
1071         /* Get RSSI from PHY status descriptor if present. */
1072         if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1073                 if (sc->chip & URTWN_CHIP_88E)
1074                         rssi = urtwn_r88e_get_rssi(sc, rate, &stat[1]);
1075                 else
1076                         rssi = urtwn_get_rssi(sc, rate, &stat[1]);
1077                 URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: rssi=%d\n", __func__, rssi);
1078                 /* Update our average RSSI. */
1079                 urtwn_update_avgrssi(sc, rate, rssi);
1080         }
1081
1082         if (ieee80211_radiotap_active(ic)) {
1083                 struct urtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1084
1085                 tap->wr_flags = 0;
1086
1087                 urtwn_get_tsf(sc, &tap->wr_tsft);
1088                 if (__predict_false(le32toh((uint32_t)tap->wr_tsft) <
1089                                     le32toh(stat->rxdw5))) {
1090                         tap->wr_tsft = le32toh(tap->wr_tsft  >> 32) - 1;
1091                         tap->wr_tsft = (uint64_t)htole32(tap->wr_tsft) << 32;
1092                 } else
1093                         tap->wr_tsft &= 0xffffffff00000000;
1094                 tap->wr_tsft += stat->rxdw5;
1095
1096                 /* XXX 20/40? */
1097                 /* XXX shortgi? */
1098
1099                 /* Map HW rate index to 802.11 rate. */
1100                 if (!(rxdw3 & R92C_RXDW3_HT)) {
1101                         tap->wr_rate = ridx2rate[rate];
1102                 } else if (rate >= 12) {        /* MCS0~15. */
1103                         /* Bit 7 set means HT MCS instead of rate. */
1104                         tap->wr_rate = 0x80 | (rate - 12);
1105                 }
1106
1107                 /* XXX TODO: this isn't right; should use the last good RSSI */
1108                 tap->wr_dbm_antsignal = rssi;
1109                 tap->wr_dbm_antnoise = URTWN_NOISE_FLOOR;
1110         }
1111
1112         *rssi_p = rssi;
1113
1114         /* Drop descriptor. */
1115         m_adj(m, sizeof(*stat) + infosz);
1116         wh = mtod(m, struct ieee80211_frame_min *);
1117
1118         if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) &&
1119             cipher != R92C_CAM_ALGO_NONE) {
1120                 m->m_flags |= M_WEP;
1121         }
1122
1123         if (m->m_len >= sizeof(*wh))
1124                 return (ieee80211_find_rxnode(ic, wh));
1125
1126         return (NULL);
1127 }
1128
1129 static void
1130 urtwn_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
1131 {
1132         struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1133         struct ieee80211com *ic = &sc->sc_ic;
1134         struct ieee80211_node *ni;
1135         struct mbuf *m = NULL, *next;
1136         struct urtwn_data *data;
1137         int8_t nf, rssi;
1138
1139         URTWN_ASSERT_LOCKED(sc);
1140
1141         switch (USB_GET_STATE(xfer)) {
1142         case USB_ST_TRANSFERRED:
1143                 data = STAILQ_FIRST(&sc->sc_rx_active);
1144                 if (data == NULL)
1145                         goto tr_setup;
1146                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1147                 m = urtwn_report_intr(xfer, data);
1148                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1149                 /* FALLTHROUGH */
1150         case USB_ST_SETUP:
1151 tr_setup:
1152                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
1153                 if (data == NULL) {
1154                         KASSERT(m == NULL, ("mbuf isn't NULL"));
1155                         goto finish;
1156                 }
1157                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
1158                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
1159                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
1160                     usbd_xfer_max_len(xfer));
1161                 usbd_transfer_submit(xfer);
1162
1163                 /*
1164                  * To avoid LOR we should unlock our private mutex here to call
1165                  * ieee80211_input() because here is at the end of a USB
1166                  * callback and safe to unlock.
1167                  */
1168                 while (m != NULL) {
1169                         next = m->m_next;
1170                         m->m_next = NULL;
1171
1172                         ni = urtwn_rx_frame(sc, m, &rssi);
1173
1174                         /* Store a global last-good RSSI */
1175                         if (rssi != -127)
1176                                 sc->last_rssi = rssi;
1177
1178                         URTWN_UNLOCK(sc);
1179
1180                         nf = URTWN_NOISE_FLOOR;
1181                         if (ni != NULL) {
1182                                 if (rssi != -127)
1183                                         URTWN_NODE(ni)->last_rssi = rssi;
1184                                 if (ni->ni_flags & IEEE80211_NODE_HT)
1185                                         m->m_flags |= M_AMPDU;
1186                                 (void)ieee80211_input(ni, m,
1187                                     URTWN_NODE(ni)->last_rssi - nf, nf);
1188                                 ieee80211_free_node(ni);
1189                         } else {
1190                                 /* Use last good global RSSI */
1191                                 (void)ieee80211_input_all(ic, m,
1192                                     sc->last_rssi - nf, nf);
1193                         }
1194                         URTWN_LOCK(sc);
1195                         m = next;
1196                 }
1197                 break;
1198         default:
1199                 /* needs it to the inactive queue due to a error. */
1200                 data = STAILQ_FIRST(&sc->sc_rx_active);
1201                 if (data != NULL) {
1202                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
1203                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
1204                 }
1205                 if (error != USB_ERR_CANCELLED) {
1206                         usbd_xfer_set_stall(xfer);
1207 #if defined(__DragonFly__)
1208                         /* unimplemented */
1209 #else
1210                         counter_u64_add(ic->ic_ierrors, 1);
1211 #endif
1212                         goto tr_setup;
1213                 }
1214                 break;
1215         }
1216 finish:
1217         /* Finished receive; age anything left on the FF queue by a little bump */
1218         /*
1219          * XXX TODO: just make this a callout timer schedule so we can
1220          * flush the FF staging queue if we're approaching idle.
1221          */
1222 #ifdef  IEEE80211_SUPPORT_SUPERG
1223         URTWN_UNLOCK(sc);
1224         ieee80211_ff_age_all(ic, 1);
1225         URTWN_LOCK(sc);
1226 #endif
1227
1228         /* Kick-start more transmit in case we stalled */
1229         urtwn_start(sc);
1230 }
1231
1232 static void
1233 urtwn_txeof(struct urtwn_softc *sc, struct urtwn_data *data, int status)
1234 {
1235
1236         URTWN_ASSERT_LOCKED(sc);
1237
1238         if (data->ni != NULL)   /* not a beacon frame */
1239                 ieee80211_tx_complete(data->ni, data->m, status);
1240
1241         if (sc->sc_tx_n_active > 0)
1242                 sc->sc_tx_n_active--;
1243
1244         data->ni = NULL;
1245         data->m = NULL;
1246
1247         sc->sc_txtimer = 0;
1248
1249         STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
1250 }
1251
1252 static int
1253 urtwn_alloc_list(struct urtwn_softc *sc, struct urtwn_data data[],
1254     int ndata, int maxsz)
1255 {
1256         int i, error;
1257
1258         for (i = 0; i < ndata; i++) {
1259                 struct urtwn_data *dp = &data[i];
1260                 dp->sc = sc;
1261                 dp->m = NULL;
1262                 dp->buf = kmalloc(maxsz, M_USBDEV, M_INTWAIT);
1263                 if (dp->buf == NULL) {
1264                         device_printf(sc->sc_dev,
1265                             "could not allocate buffer\n");
1266                         error = ENOMEM;
1267                         goto fail;
1268                 }
1269                 dp->ni = NULL;
1270         }
1271
1272         return (0);
1273 fail:
1274         urtwn_free_list(sc, data, ndata);
1275         return (error);
1276 }
1277
1278 static int
1279 urtwn_alloc_rx_list(struct urtwn_softc *sc)
1280 {
1281         int error, i;
1282
1283         error = urtwn_alloc_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT,
1284             URTWN_RXBUFSZ);
1285         if (error != 0)
1286                 return (error);
1287
1288         STAILQ_INIT(&sc->sc_rx_active);
1289         STAILQ_INIT(&sc->sc_rx_inactive);
1290
1291         for (i = 0; i < URTWN_RX_LIST_COUNT; i++)
1292                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1293
1294         return (0);
1295 }
1296
1297 static int
1298 urtwn_alloc_tx_list(struct urtwn_softc *sc)
1299 {
1300         int error, i;
1301
1302         error = urtwn_alloc_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT,
1303             URTWN_TXBUFSZ);
1304         if (error != 0)
1305                 return (error);
1306
1307         STAILQ_INIT(&sc->sc_tx_active);
1308         STAILQ_INIT(&sc->sc_tx_inactive);
1309         STAILQ_INIT(&sc->sc_tx_pending);
1310
1311         for (i = 0; i < URTWN_TX_LIST_COUNT; i++)
1312                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i], next);
1313
1314         return (0);
1315 }
1316
1317 static void
1318 urtwn_free_list(struct urtwn_softc *sc, struct urtwn_data data[], int ndata)
1319 {
1320         int i;
1321
1322         for (i = 0; i < ndata; i++) {
1323                 struct urtwn_data *dp = &data[i];
1324
1325                 if (dp->buf != NULL) {
1326                         kfree(dp->buf, M_USBDEV);
1327                         dp->buf = NULL;
1328                 }
1329                 if (dp->ni != NULL) {
1330                         ieee80211_free_node(dp->ni);
1331                         dp->ni = NULL;
1332                 }
1333         }
1334 }
1335
1336 static void
1337 urtwn_free_rx_list(struct urtwn_softc *sc)
1338 {
1339         urtwn_free_list(sc, sc->sc_rx, URTWN_RX_LIST_COUNT);
1340 }
1341
1342 static void
1343 urtwn_free_tx_list(struct urtwn_softc *sc)
1344 {
1345         urtwn_free_list(sc, sc->sc_tx, URTWN_TX_LIST_COUNT);
1346 }
1347
1348 static void
1349 urtwn_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
1350 {
1351         struct urtwn_softc *sc = usbd_xfer_softc(xfer);
1352 #ifdef  IEEE80211_SUPPORT_SUPERG
1353         struct ieee80211com *ic = &sc->sc_ic;
1354 #endif
1355         struct urtwn_data *data;
1356
1357         URTWN_ASSERT_LOCKED(sc);
1358
1359         switch (USB_GET_STATE(xfer)){
1360         case USB_ST_TRANSFERRED:
1361                 data = STAILQ_FIRST(&sc->sc_tx_active);
1362                 if (data == NULL)
1363                         goto tr_setup;
1364                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1365                 urtwn_txeof(sc, data, 0);
1366                 /* FALLTHROUGH */
1367         case USB_ST_SETUP:
1368 tr_setup:
1369                 data = STAILQ_FIRST(&sc->sc_tx_pending);
1370                 if (data == NULL) {
1371                         URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1372                             "%s: empty pending queue\n", __func__);
1373                         sc->sc_tx_n_active = 0;
1374                         goto finish;
1375                 }
1376                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
1377                 STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
1378                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
1379                 usbd_transfer_submit(xfer);
1380                 sc->sc_tx_n_active++;
1381                 break;
1382         default:
1383                 data = STAILQ_FIRST(&sc->sc_tx_active);
1384                 if (data == NULL)
1385                         goto tr_setup;
1386                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
1387                 urtwn_txeof(sc, data, 1);
1388                 if (error != USB_ERR_CANCELLED) {
1389                         usbd_xfer_set_stall(xfer);
1390                         goto tr_setup;
1391                 }
1392                 break;
1393         }
1394 finish:
1395 #ifdef  IEEE80211_SUPPORT_SUPERG
1396         /*
1397          * If the TX active queue drops below a certain
1398          * threshold, ensure we age fast-frames out so they're
1399          * transmitted.
1400          */
1401         if (sc->sc_tx_n_active <= 1) {
1402                 /* XXX ew - net80211 should defer this for us! */
1403
1404                 /*
1405                  * Note: this sc_tx_n_active currently tracks
1406                  * the number of pending transmit submissions
1407                  * and not the actual depth of the TX frames
1408                  * pending to the hardware.  That means that
1409                  * we're going to end up with some sub-optimal
1410                  * aggregation behaviour.
1411                  */
1412                 /*
1413                  * XXX TODO: just make this a callout timer schedule so we can
1414                  * flush the FF staging queue if we're approaching idle.
1415                  */
1416                 URTWN_UNLOCK(sc);
1417                 ieee80211_ff_flush(ic, WME_AC_VO);
1418                 ieee80211_ff_flush(ic, WME_AC_VI);
1419                 ieee80211_ff_flush(ic, WME_AC_BE);
1420                 ieee80211_ff_flush(ic, WME_AC_BK);
1421                 URTWN_LOCK(sc);
1422         }
1423 #endif
1424         /* Kick-start more transmit */
1425         urtwn_start(sc);
1426 }
1427
1428 static struct urtwn_data *
1429 _urtwn_getbuf(struct urtwn_softc *sc)
1430 {
1431         struct urtwn_data *bf;
1432
1433         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
1434         if (bf != NULL)
1435                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
1436         else {
1437                 URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT,
1438                     "%s: out of xmit buffers\n", __func__);
1439         }
1440         return (bf);
1441 }
1442
1443 static struct urtwn_data *
1444 urtwn_getbuf(struct urtwn_softc *sc)
1445 {
1446         struct urtwn_data *bf;
1447
1448         URTWN_ASSERT_LOCKED(sc);
1449
1450         bf = _urtwn_getbuf(sc);
1451         if (bf == NULL) {
1452                 URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: stop queue\n",
1453                     __func__);
1454         }
1455         return (bf);
1456 }
1457
1458 static usb_error_t
1459 urtwn_write_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1460     int len)
1461 {
1462         usb_device_request_t req;
1463
1464         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1465         req.bRequest = R92C_REQ_REGS;
1466         USETW(req.wValue, addr);
1467         USETW(req.wIndex, 0);
1468         USETW(req.wLength, len);
1469         return (urtwn_do_request(sc, &req, buf));
1470 }
1471
1472 static usb_error_t
1473 urtwn_write_1(struct urtwn_softc *sc, uint16_t addr, uint8_t val)
1474 {
1475         return (urtwn_write_region_1(sc, addr, &val, sizeof(val)));
1476 }
1477
1478 static usb_error_t
1479 urtwn_write_2(struct urtwn_softc *sc, uint16_t addr, uint16_t val)
1480 {
1481         val = htole16(val);
1482         return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1483 }
1484
1485 static usb_error_t
1486 urtwn_write_4(struct urtwn_softc *sc, uint16_t addr, uint32_t val)
1487 {
1488         val = htole32(val);
1489         return (urtwn_write_region_1(sc, addr, (uint8_t *)&val, sizeof(val)));
1490 }
1491
1492 static usb_error_t
1493 urtwn_read_region_1(struct urtwn_softc *sc, uint16_t addr, uint8_t *buf,
1494     int len)
1495 {
1496         usb_device_request_t req;
1497
1498         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1499         req.bRequest = R92C_REQ_REGS;
1500         USETW(req.wValue, addr);
1501         USETW(req.wIndex, 0);
1502         USETW(req.wLength, len);
1503         return (urtwn_do_request(sc, &req, buf));
1504 }
1505
1506 static uint8_t
1507 urtwn_read_1(struct urtwn_softc *sc, uint16_t addr)
1508 {
1509         uint8_t val;
1510
1511         if (urtwn_read_region_1(sc, addr, &val, 1) != 0)
1512                 return (0xff);
1513         return (val);
1514 }
1515
1516 static uint16_t
1517 urtwn_read_2(struct urtwn_softc *sc, uint16_t addr)
1518 {
1519         uint16_t val;
1520
1521         if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 2) != 0)
1522                 return (0xffff);
1523         return (le16toh(val));
1524 }
1525
1526 static uint32_t
1527 urtwn_read_4(struct urtwn_softc *sc, uint16_t addr)
1528 {
1529         uint32_t val;
1530
1531         if (urtwn_read_region_1(sc, addr, (uint8_t *)&val, 4) != 0)
1532                 return (0xffffffff);
1533         return (le32toh(val));
1534 }
1535
1536 static int
1537 urtwn_fw_cmd(struct urtwn_softc *sc, uint8_t id, const void *buf, int len)
1538 {
1539         struct r92c_fw_cmd cmd;
1540         usb_error_t error;
1541         int ntries;
1542
1543         if (!(sc->sc_flags & URTWN_FW_LOADED)) {
1544                 URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE, "%s: firmware "
1545                     "was not loaded; command (id %d) will be discarded\n",
1546                     __func__, id);
1547                 return (0);
1548         }
1549
1550         /* Wait for current FW box to be empty. */
1551         for (ntries = 0; ntries < 100; ntries++) {
1552                 if (!(urtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
1553                         break;
1554                 urtwn_ms_delay(sc);
1555         }
1556         if (ntries == 100) {
1557                 device_printf(sc->sc_dev,
1558                     "could not send firmware command\n");
1559                 return (ETIMEDOUT);
1560         }
1561         memset(&cmd, 0, sizeof(cmd));
1562         cmd.id = id;
1563         if (len > 3)
1564                 cmd.id |= R92C_CMD_FLAG_EXT;
1565         KASSERT(len <= sizeof(cmd.msg), ("urtwn_fw_cmd\n"));
1566         memcpy(cmd.msg, buf, len);
1567
1568         /* Write the first word last since that will trigger the FW. */
1569         error = urtwn_write_region_1(sc, R92C_HMEBOX_EXT(sc->fwcur),
1570             (uint8_t *)&cmd + 4, 2);
1571         if (error != USB_ERR_NORMAL_COMPLETION)
1572                 return (EIO);
1573         error = urtwn_write_region_1(sc, R92C_HMEBOX(sc->fwcur),
1574             (uint8_t *)&cmd + 0, 4);
1575         if (error != USB_ERR_NORMAL_COMPLETION)
1576                 return (EIO);
1577
1578         sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
1579         return (0);
1580 }
1581
1582 static void
1583 urtwn_cmdq_cb(void *arg, int pending)
1584 {
1585         struct urtwn_softc *sc = arg;
1586         struct urtwn_cmdq *item;
1587
1588         /*
1589          * Device must be powered on (via urtwn_power_on())
1590          * before any command may be sent.
1591          */
1592         URTWN_LOCK(sc);
1593         if (!(sc->sc_flags & URTWN_RUNNING)) {
1594                 URTWN_UNLOCK(sc);
1595                 return;
1596         }
1597
1598         URTWN_CMDQ_LOCK(sc);
1599         while (sc->cmdq[sc->cmdq_first].func != NULL) {
1600                 item = &sc->cmdq[sc->cmdq_first];
1601                 sc->cmdq_first = (sc->cmdq_first + 1) % URTWN_CMDQ_SIZE;
1602                 URTWN_CMDQ_UNLOCK(sc);
1603
1604                 item->func(sc, &item->data);
1605
1606                 URTWN_CMDQ_LOCK(sc);
1607                 memset(item, 0, sizeof (*item));
1608         }
1609         URTWN_CMDQ_UNLOCK(sc);
1610         URTWN_UNLOCK(sc);
1611 }
1612
1613 static int
1614 urtwn_cmd_sleepable(struct urtwn_softc *sc, const void *ptr, size_t len,
1615     CMD_FUNC_PROTO)
1616 {
1617         struct ieee80211com *ic = &sc->sc_ic;
1618
1619         KASSERT(len <= sizeof(union sec_param), ("buffer overflow"));
1620
1621         URTWN_CMDQ_LOCK(sc);
1622         if (sc->cmdq[sc->cmdq_last].func != NULL) {
1623                 device_printf(sc->sc_dev, "%s: cmdq overflow\n", __func__);
1624                 URTWN_CMDQ_UNLOCK(sc);
1625
1626                 return (EAGAIN);
1627         }
1628
1629         if (ptr != NULL)
1630                 memcpy(&sc->cmdq[sc->cmdq_last].data, ptr, len);
1631         sc->cmdq[sc->cmdq_last].func = func;
1632         sc->cmdq_last = (sc->cmdq_last + 1) % URTWN_CMDQ_SIZE;
1633         URTWN_CMDQ_UNLOCK(sc);
1634
1635         ieee80211_runtask(ic, &sc->cmdq_task);
1636
1637         return (0);
1638 }
1639
1640 static __inline void
1641 urtwn_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
1642 {
1643
1644         sc->sc_rf_write(sc, chain, addr, val);
1645 }
1646
1647 static void
1648 urtwn_r92c_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1649     uint32_t val)
1650 {
1651         urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1652             SM(R92C_LSSI_PARAM_ADDR, addr) |
1653             SM(R92C_LSSI_PARAM_DATA, val));
1654 }
1655
1656 static void
1657 urtwn_r88e_rf_write(struct urtwn_softc *sc, int chain, uint8_t addr,
1658 uint32_t val)
1659 {
1660         urtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
1661             SM(R88E_LSSI_PARAM_ADDR, addr) |
1662             SM(R92C_LSSI_PARAM_DATA, val));
1663 }
1664
1665 static uint32_t
1666 urtwn_rf_read(struct urtwn_softc *sc, int chain, uint8_t addr)
1667 {
1668         uint32_t reg[R92C_MAX_CHAINS], val;
1669
1670         reg[0] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
1671         if (chain != 0)
1672                 reg[chain] = urtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
1673
1674         urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1675             reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
1676         urtwn_ms_delay(sc);
1677
1678         urtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
1679             RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
1680             R92C_HSSI_PARAM2_READ_EDGE);
1681         urtwn_ms_delay(sc);
1682
1683         urtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
1684             reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
1685         urtwn_ms_delay(sc);
1686
1687         if (urtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
1688                 val = urtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
1689         else
1690                 val = urtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
1691         return (MS(val, R92C_LSSI_READBACK_DATA));
1692 }
1693
1694 static int
1695 urtwn_llt_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
1696 {
1697         usb_error_t error;
1698         int ntries;
1699
1700         error = urtwn_write_4(sc, R92C_LLT_INIT,
1701             SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
1702             SM(R92C_LLT_INIT_ADDR, addr) |
1703             SM(R92C_LLT_INIT_DATA, data));
1704         if (error != USB_ERR_NORMAL_COMPLETION)
1705                 return (EIO);
1706         /* Wait for write operation to complete. */
1707         for (ntries = 0; ntries < 20; ntries++) {
1708                 if (MS(urtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
1709                     R92C_LLT_INIT_OP_NO_ACTIVE)
1710                         return (0);
1711                 urtwn_ms_delay(sc);
1712         }
1713         return (ETIMEDOUT);
1714 }
1715
1716 static int
1717 urtwn_efuse_read_next(struct urtwn_softc *sc, uint8_t *val)
1718 {
1719         uint32_t reg;
1720         usb_error_t error;
1721         int ntries;
1722
1723         if (sc->last_rom_addr >= URTWN_EFUSE_MAX_LEN)
1724                 return (EFAULT);
1725
1726         reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1727         reg = RW(reg, R92C_EFUSE_CTRL_ADDR, sc->last_rom_addr);
1728         reg &= ~R92C_EFUSE_CTRL_VALID;
1729
1730         error = urtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
1731         if (error != USB_ERR_NORMAL_COMPLETION)
1732                 return (EIO);
1733         /* Wait for read operation to complete. */
1734         for (ntries = 0; ntries < 100; ntries++) {
1735                 reg = urtwn_read_4(sc, R92C_EFUSE_CTRL);
1736                 if (reg & R92C_EFUSE_CTRL_VALID)
1737                         break;
1738                 urtwn_ms_delay(sc);
1739         }
1740         if (ntries == 100) {
1741                 device_printf(sc->sc_dev,
1742                     "could not read efuse byte at address 0x%x\n",
1743                     sc->last_rom_addr);
1744                 return (ETIMEDOUT);
1745         }
1746
1747         *val = MS(reg, R92C_EFUSE_CTRL_DATA);
1748         sc->last_rom_addr++;
1749
1750         return (0);
1751 }
1752
1753 static int
1754 urtwn_efuse_read_data(struct urtwn_softc *sc, uint8_t *rom, uint8_t off,
1755     uint8_t msk)
1756 {
1757         uint8_t reg;
1758         int i, error;
1759
1760         for (i = 0; i < 4; i++) {
1761                 if (msk & (1 << i))
1762                         continue;
1763                 error = urtwn_efuse_read_next(sc, &reg);
1764                 if (error != 0)
1765                         return (error);
1766                 URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1767                     off * 8 + i * 2, reg);
1768                 rom[off * 8 + i * 2 + 0] = reg;
1769
1770                 error = urtwn_efuse_read_next(sc, &reg);
1771                 if (error != 0)
1772                         return (error);
1773                 URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "rom[0x%03X] == 0x%02X\n",
1774                     off * 8 + i * 2 + 1, reg);
1775                 rom[off * 8 + i * 2 + 1] = reg;
1776         }
1777
1778         return (0);
1779 }
1780
1781 #ifdef USB_DEBUG
1782 static void
1783 urtwn_dump_rom_contents(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1784 {
1785         int i;
1786
1787         /* Dump ROM contents. */
1788         device_printf(sc->sc_dev, "%s:", __func__);
1789         for (i = 0; i < size; i++) {
1790                 if (i % 32 == 0)
1791                         printf("\n%03X: ", i);
1792                 else if (i % 4 == 0)
1793                         printf(" ");
1794
1795                 printf("%02X", rom[i]);
1796         }
1797         printf("\n");
1798 }
1799 #endif
1800
1801 static int
1802 urtwn_efuse_read(struct urtwn_softc *sc, uint8_t *rom, uint16_t size)
1803 {
1804 #define URTWN_CHK(res) do {     \
1805         if ((error = res) != 0) \
1806                 goto end;       \
1807 } while(0)
1808         uint8_t msk, off, reg;
1809         int error;
1810
1811         URTWN_CHK(urtwn_efuse_switch_power(sc));
1812
1813         /* Read full ROM image. */
1814         sc->last_rom_addr = 0;
1815         memset(rom, 0xff, size);
1816
1817         URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1818         while (reg != 0xff) {
1819                 /* check for extended header */
1820                 if ((sc->chip & URTWN_CHIP_88E) && (reg & 0x1f) == 0x0f) {
1821                         off = reg >> 5;
1822                         URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1823
1824                         if ((reg & 0x0f) != 0x0f)
1825                                 off = ((reg & 0xf0) >> 1) | off;
1826                         else
1827                                 continue;
1828                 } else
1829                         off = reg >> 4;
1830                 msk = reg & 0xf;
1831
1832                 URTWN_CHK(urtwn_efuse_read_data(sc, rom, off, msk));
1833                 URTWN_CHK(urtwn_efuse_read_next(sc, &reg));
1834         }
1835
1836 end:
1837
1838 #ifdef USB_DEBUG
1839         if (sc->sc_debug & URTWN_DEBUG_ROM)
1840                 urtwn_dump_rom_contents(sc, rom, size);
1841 #endif
1842
1843         urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
1844
1845         if (error != 0) {
1846                 device_printf(sc->sc_dev, "%s: error while reading ROM\n",
1847                     __func__);
1848         }
1849
1850         return (error);
1851 #undef URTWN_CHK
1852 }
1853
1854 static int
1855 urtwn_efuse_switch_power(struct urtwn_softc *sc)
1856 {
1857         usb_error_t error;
1858         uint32_t reg;
1859
1860         error = urtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
1861         if (error != USB_ERR_NORMAL_COMPLETION)
1862                 return (EIO);
1863
1864         reg = urtwn_read_2(sc, R92C_SYS_ISO_CTRL);
1865         if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
1866                 error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1867                     reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
1868                 if (error != USB_ERR_NORMAL_COMPLETION)
1869                         return (EIO);
1870         }
1871         reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
1872         if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
1873                 error = urtwn_write_2(sc, R92C_SYS_FUNC_EN,
1874                     reg | R92C_SYS_FUNC_EN_ELDR);
1875                 if (error != USB_ERR_NORMAL_COMPLETION)
1876                         return (EIO);
1877         }
1878         reg = urtwn_read_2(sc, R92C_SYS_CLKR);
1879         if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
1880             (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
1881                 error = urtwn_write_2(sc, R92C_SYS_CLKR,
1882                     reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
1883                 if (error != USB_ERR_NORMAL_COMPLETION)
1884                         return (EIO);
1885         }
1886
1887         return (0);
1888 }
1889
1890 static int
1891 urtwn_read_chipid(struct urtwn_softc *sc)
1892 {
1893         uint32_t reg;
1894
1895         if (sc->chip & URTWN_CHIP_88E)
1896                 return (0);
1897
1898         reg = urtwn_read_4(sc, R92C_SYS_CFG);
1899         if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1900                 return (EIO);
1901
1902         if (reg & R92C_SYS_CFG_TYPE_92C) {
1903                 sc->chip |= URTWN_CHIP_92C;
1904                 /* Check if it is a castrated 8192C. */
1905                 if (MS(urtwn_read_4(sc, R92C_HPON_FSM),
1906                     R92C_HPON_FSM_CHIP_BONDING_ID) ==
1907                     R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1908                         sc->chip |= URTWN_CHIP_92C_1T2R;
1909         }
1910         if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1911                 sc->chip |= URTWN_CHIP_UMC;
1912                 if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1913                         sc->chip |= URTWN_CHIP_UMC_A_CUT;
1914         }
1915         return (0);
1916 }
1917
1918 static int
1919 urtwn_read_rom(struct urtwn_softc *sc)
1920 {
1921         struct r92c_rom *rom = &sc->rom.r92c_rom;
1922         int error;
1923
1924         /* Read full ROM image. */
1925         error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(*rom));
1926         if (error != 0)
1927                 return (error);
1928
1929         /* XXX Weird but this is what the vendor driver does. */
1930         sc->last_rom_addr = 0x1fa;
1931         error = urtwn_efuse_read_next(sc, &sc->pa_setting);
1932         if (error != 0)
1933                 return (error);
1934         URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: PA setting=0x%x\n", __func__,
1935             sc->pa_setting);
1936
1937         sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1938
1939         sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1940         URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type=%d\n",
1941             __func__, sc->regulatory);
1942         IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1943
1944         sc->sc_rf_write = urtwn_r92c_rf_write;
1945         sc->sc_power_on = urtwn_r92c_power_on;
1946         sc->sc_power_off = urtwn_r92c_power_off;
1947
1948         return (0);
1949 }
1950
1951 static int
1952 urtwn_r88e_read_rom(struct urtwn_softc *sc)
1953 {
1954         struct r88e_rom *rom = &sc->rom.r88e_rom;
1955         int error;
1956
1957         error = urtwn_efuse_read(sc, (uint8_t *)rom, sizeof(sc->rom.r88e_rom));
1958         if (error != 0)
1959                 return (error);
1960
1961         sc->bw20_tx_pwr_diff = (rom->tx_pwr_diff >> 4);
1962         if (sc->bw20_tx_pwr_diff & 0x08)
1963                 sc->bw20_tx_pwr_diff |= 0xf0;
1964         sc->ofdm_tx_pwr_diff = (rom->tx_pwr_diff & 0xf);
1965         if (sc->ofdm_tx_pwr_diff & 0x08)
1966                 sc->ofdm_tx_pwr_diff |= 0xf0;
1967         sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
1968         URTWN_DPRINTF(sc, URTWN_DEBUG_ROM, "%s: regulatory type %d\n",
1969             __func__,sc->regulatory);
1970         IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1971
1972         sc->sc_rf_write = urtwn_r88e_rf_write;
1973         sc->sc_power_on = urtwn_r88e_power_on;
1974         sc->sc_power_off = urtwn_r88e_power_off;
1975
1976         return (0);
1977 }
1978
1979 static __inline uint8_t
1980 rate2ridx(uint8_t rate)
1981 {
1982         if (rate & IEEE80211_RATE_MCS) {
1983                 /* 11n rates start at idx 12 */
1984                 return ((rate & 0xf) + 12);
1985         }
1986         switch (rate) {
1987         /* 11g */
1988         case 12:        return 4;
1989         case 18:        return 5;
1990         case 24:        return 6;
1991         case 36:        return 7;
1992         case 48:        return 8;
1993         case 72:        return 9;
1994         case 96:        return 10;
1995         case 108:       return 11;
1996         /* 11b */
1997         case 2:         return 0;
1998         case 4:         return 1;
1999         case 11:        return 2;
2000         case 22:        return 3;
2001         default:        return URTWN_RIDX_UNKNOWN;
2002         }
2003 }
2004
2005 /*
2006  * Initialize rate adaptation in firmware.
2007  */
2008 static int
2009 urtwn_ra_init(struct urtwn_softc *sc)
2010 {
2011         struct ieee80211com *ic = &sc->sc_ic;
2012         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2013         struct ieee80211_node *ni;
2014         struct ieee80211_rateset *rs, *rs_ht;
2015         struct r92c_fw_cmd_macid_cfg cmd;
2016         uint32_t rates, basicrates;
2017         uint8_t mode, ridx;
2018         int maxrate, maxbasicrate, error, i;
2019
2020         ni = ieee80211_ref_node(vap->iv_bss);
2021         rs = &ni->ni_rates;
2022         rs_ht = (struct ieee80211_rateset *) &ni->ni_htrates;
2023
2024         /* Get normal and basic rates mask. */
2025         rates = basicrates = 0;
2026         maxrate = maxbasicrate = 0;
2027
2028         /* This is for 11bg */
2029         for (i = 0; i < rs->rs_nrates; i++) {
2030                 /* Convert 802.11 rate to HW rate index. */
2031                 ridx = rate2ridx(IEEE80211_RV(rs->rs_rates[i]));
2032                 if (ridx == URTWN_RIDX_UNKNOWN) /* Unknown rate, skip. */
2033                         continue;
2034                 rates |= 1 << ridx;
2035                 if (ridx > maxrate)
2036                         maxrate = ridx;
2037                 if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
2038                         basicrates |= 1 << ridx;
2039                         if (ridx > maxbasicrate)
2040                                 maxbasicrate = ridx;
2041                 }
2042         }
2043
2044         /* If we're doing 11n, enable 11n rates */
2045         if (ni->ni_flags & IEEE80211_NODE_HT) {
2046                 for (i = 0; i < rs_ht->rs_nrates; i++) {
2047                         if ((rs_ht->rs_rates[i] & 0x7f) > 0xf)
2048                                 continue;
2049                         /* 11n rates start at index 12 */
2050                         ridx = ((rs_ht->rs_rates[i]) & 0xf) + 12;
2051                         rates |= (1 << ridx);
2052
2053                         /* Guard against the rate table being oddly ordered */
2054                         if (ridx > maxrate)
2055                                 maxrate = ridx;
2056                 }
2057         }
2058
2059 #if 0
2060         if (ic->ic_curmode == IEEE80211_MODE_11NG)
2061                 raid = R92C_RAID_11GN;
2062 #endif
2063         /* NB: group addressed frames are done at 11bg rates for now */
2064         if (ic->ic_curmode == IEEE80211_MODE_11B)
2065                 mode = R92C_RAID_11B;
2066         else
2067                 mode = R92C_RAID_11BG;
2068         /* XXX misleading 'mode' value here for unicast frames */
2069         URTWN_DPRINTF(sc, URTWN_DEBUG_RA,
2070             "%s: mode 0x%x, rates 0x%08x, basicrates 0x%08x\n", __func__,
2071             mode, rates, basicrates);
2072
2073         /* Set rates mask for group addressed frames. */
2074         cmd.macid = URTWN_MACID_BC | URTWN_MACID_VALID;
2075         cmd.mask = htole32(mode << 28 | basicrates);
2076         error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2077         if (error != 0) {
2078                 ieee80211_free_node(ni);
2079                 device_printf(sc->sc_dev,
2080                     "could not add broadcast station\n");
2081                 return (error);
2082         }
2083
2084         /* Set initial MRR rate. */
2085         URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxbasicrate %d\n", __func__,
2086             maxbasicrate);
2087         urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BC),
2088             maxbasicrate);
2089
2090         /* Set rates mask for unicast frames. */
2091         if (ni->ni_flags & IEEE80211_NODE_HT)
2092                 mode = R92C_RAID_11GN;
2093         else if (ic->ic_curmode == IEEE80211_MODE_11B)
2094                 mode = R92C_RAID_11B;
2095         else
2096                 mode = R92C_RAID_11BG;
2097         cmd.macid = URTWN_MACID_BSS | URTWN_MACID_VALID;
2098         cmd.mask = htole32(mode << 28 | rates);
2099         error = urtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
2100         if (error != 0) {
2101                 ieee80211_free_node(ni);
2102                 device_printf(sc->sc_dev, "could not add BSS station\n");
2103                 return (error);
2104         }
2105         /* Set initial MRR rate. */
2106         URTWN_DPRINTF(sc, URTWN_DEBUG_RA, "%s: maxrate %d\n", __func__,
2107             maxrate);
2108         urtwn_write_1(sc, R92C_INIDATA_RATE_SEL(URTWN_MACID_BSS),
2109             maxrate);
2110
2111         /* Indicate highest supported rate. */
2112         if (ni->ni_flags & IEEE80211_NODE_HT)
2113                 ni->ni_txrate = rs_ht->rs_rates[rs_ht->rs_nrates - 1]
2114                     | IEEE80211_RATE_MCS;
2115         else
2116                 ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
2117         ieee80211_free_node(ni);
2118
2119         return (0);
2120 }
2121
2122 static void
2123 urtwn_init_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2124 {
2125         struct r92c_tx_desc *txd = &uvp->bcn_desc;
2126
2127         txd->txdw0 = htole32(
2128             SM(R92C_TXDW0_OFFSET, sizeof(*txd)) | R92C_TXDW0_BMCAST |
2129             R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2130         txd->txdw1 = htole32(
2131             SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BEACON) |
2132             SM(R92C_TXDW1_RAID, R92C_RAID_11B));
2133
2134         if (sc->chip & URTWN_CHIP_88E) {
2135                 txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
2136                 txd->txdseq |= htole16(R88E_TXDSEQ_HWSEQ_EN);
2137         } else {
2138                 txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
2139                 txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
2140         }
2141
2142         txd->txdw4 = htole32(R92C_TXDW4_DRVRATE);
2143         txd->txdw5 = htole32(SM(R92C_TXDW5_DATARATE, URTWN_RIDX_CCK1));
2144 }
2145
2146 static int
2147 urtwn_setup_beacon(struct urtwn_softc *sc, struct ieee80211_node *ni)
2148 {
2149         struct ieee80211vap *vap = ni->ni_vap;
2150         struct urtwn_vap *uvp = URTWN_VAP(vap);
2151         struct mbuf *m;
2152         int error;
2153
2154         URTWN_ASSERT_LOCKED(sc);
2155
2156         if (ni->ni_chan == IEEE80211_CHAN_ANYC)
2157                 return (EINVAL);
2158
2159         m = ieee80211_beacon_alloc(ni);
2160         if (m == NULL) {
2161                 device_printf(sc->sc_dev,
2162                     "%s: could not allocate beacon frame\n", __func__);
2163                 return (ENOMEM);
2164         }
2165
2166         if (uvp->bcn_mbuf != NULL)
2167                 m_freem(uvp->bcn_mbuf);
2168
2169         uvp->bcn_mbuf = m;
2170
2171         if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2172                 return (error);
2173
2174         /* XXX bcnq stuck workaround */
2175         if ((error = urtwn_tx_beacon(sc, uvp)) != 0)
2176                 return (error);
2177
2178         URTWN_DPRINTF(sc, URTWN_DEBUG_BEACON, "%s: beacon was %srecognized\n",
2179             __func__, urtwn_read_1(sc, R92C_TDECTRL + 2) &
2180             (R92C_TDECTRL_BCN_VALID >> 16) ? "" : "not ");
2181
2182         return (0);
2183 }
2184
2185 static void
2186 urtwn_update_beacon(struct ieee80211vap *vap, int item)
2187 {
2188         struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2189         struct urtwn_vap *uvp = URTWN_VAP(vap);
2190         struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
2191         struct ieee80211_node *ni = vap->iv_bss;
2192         int mcast = 0;
2193
2194         URTWN_LOCK(sc);
2195         if (uvp->bcn_mbuf == NULL) {
2196                 uvp->bcn_mbuf = ieee80211_beacon_alloc(ni);
2197                 if (uvp->bcn_mbuf == NULL) {
2198                         device_printf(sc->sc_dev,
2199                             "%s: could not allocate beacon frame\n", __func__);
2200                         URTWN_UNLOCK(sc);
2201                         return;
2202                 }
2203         }
2204         URTWN_UNLOCK(sc);
2205
2206         if (item == IEEE80211_BEACON_TIM)
2207                 mcast = 1;      /* XXX */
2208
2209         setbit(bo->bo_flags, item);
2210         ieee80211_beacon_update(ni, uvp->bcn_mbuf, mcast);
2211
2212         URTWN_LOCK(sc);
2213         urtwn_tx_beacon(sc, uvp);
2214         URTWN_UNLOCK(sc);
2215 }
2216
2217 /*
2218  * Push a beacon frame into the chip. Beacon will
2219  * be repeated by the chip every R92C_BCN_INTERVAL.
2220  */
2221 static int
2222 urtwn_tx_beacon(struct urtwn_softc *sc, struct urtwn_vap *uvp)
2223 {
2224         struct r92c_tx_desc *desc = &uvp->bcn_desc;
2225         struct urtwn_data *bf;
2226
2227         URTWN_ASSERT_LOCKED(sc);
2228
2229         bf = urtwn_getbuf(sc);
2230         if (bf == NULL)
2231                 return (ENOMEM);
2232
2233         memcpy(bf->buf, desc, sizeof(*desc));
2234         urtwn_tx_start(sc, uvp->bcn_mbuf, IEEE80211_FC0_TYPE_MGT, bf);
2235
2236         sc->sc_txtimer = 5;
2237         callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2238
2239         return (0);
2240 }
2241
2242 static int
2243 urtwn_key_alloc(struct ieee80211vap *vap, struct ieee80211_key *k,
2244     ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
2245 {
2246         struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2247         uint8_t i;
2248
2249         if (!(&vap->iv_nw_keys[0] <= k &&
2250              k < &vap->iv_nw_keys[IEEE80211_WEP_NKID])) {
2251                 if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
2252                         URTWN_LOCK(sc);
2253                         /*
2254                          * First 4 slots for group keys,
2255                          * what is left - for pairwise.
2256                          * XXX incompatible with IBSS RSN.
2257                          */
2258                         for (i = IEEE80211_WEP_NKID;
2259                              i < R92C_CAM_ENTRY_COUNT; i++) {
2260                                 if ((sc->keys_bmap & (1 << i)) == 0) {
2261                                         sc->keys_bmap |= 1 << i;
2262                                         *keyix = i;
2263                                         break;
2264                                 }
2265                         }
2266                         URTWN_UNLOCK(sc);
2267                         if (i == R92C_CAM_ENTRY_COUNT) {
2268                                 device_printf(sc->sc_dev,
2269                                     "%s: no free space in the key table\n",
2270                                     __func__);
2271                                 return 0;
2272                         }
2273                 } else
2274                         *keyix = 0;
2275         } else {
2276                 *keyix = k - vap->iv_nw_keys;
2277         }
2278         *rxkeyix = *keyix;
2279         return 1;
2280 }
2281
2282 static void
2283 urtwn_key_set_cb(struct urtwn_softc *sc, union sec_param *data)
2284 {
2285         struct ieee80211_key *k = &data->key;
2286         uint8_t algo, keyid;
2287         int i, error;
2288
2289         if (k->wk_keyix < IEEE80211_WEP_NKID)
2290                 keyid = k->wk_keyix;
2291         else
2292                 keyid = 0;
2293
2294         /* Map net80211 cipher to HW crypto algorithm. */
2295         switch (k->wk_cipher->ic_cipher) {
2296         case IEEE80211_CIPHER_WEP:
2297                 if (k->wk_keylen < 8)
2298                         algo = R92C_CAM_ALGO_WEP40;
2299                 else
2300                         algo = R92C_CAM_ALGO_WEP104;
2301                 break;
2302         case IEEE80211_CIPHER_TKIP:
2303                 algo = R92C_CAM_ALGO_TKIP;
2304                 break;
2305         case IEEE80211_CIPHER_AES_CCM:
2306                 algo = R92C_CAM_ALGO_AES;
2307                 break;
2308         default:
2309                 device_printf(sc->sc_dev, "%s: undefined cipher %d\n",
2310                     __func__, k->wk_cipher->ic_cipher);
2311                 return;
2312         }
2313
2314         URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2315             "%s: keyix %d, keyid %d, algo %d/%d, flags %04X, len %d, "
2316             "macaddr %s\n", __func__, k->wk_keyix, keyid,
2317             k->wk_cipher->ic_cipher, algo, k->wk_flags, k->wk_keylen,
2318             ether_sprintf(k->wk_macaddr));
2319
2320         /* Write key. */
2321         for (i = 0; i < 4; i++) {
2322                 error = urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i),
2323                     le32dec(&k->wk_key[i * 4]));
2324                 if (error != 0)
2325                         goto fail;
2326         }
2327
2328         /* Write CTL0 last since that will validate the CAM entry. */
2329         error = urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix),
2330             le32dec(&k->wk_macaddr[2]));
2331         if (error != 0)
2332                 goto fail;
2333         error = urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix),
2334             SM(R92C_CAM_ALGO, algo) |
2335             SM(R92C_CAM_KEYID, keyid) |
2336             SM(R92C_CAM_MACLO, le16dec(&k->wk_macaddr[0])) |
2337             R92C_CAM_VALID);
2338         if (error != 0)
2339                 goto fail;
2340
2341         return;
2342
2343 fail:
2344         device_printf(sc->sc_dev, "%s fails, error %d\n", __func__, error);
2345 }
2346
2347 static void
2348 urtwn_key_del_cb(struct urtwn_softc *sc, union sec_param *data)
2349 {
2350         struct ieee80211_key *k = &data->key;
2351         int i;
2352
2353         URTWN_DPRINTF(sc, URTWN_DEBUG_KEY,
2354             "%s: keyix %d, flags %04X, macaddr %s\n", __func__,
2355             k->wk_keyix, k->wk_flags, ether_sprintf(k->wk_macaddr));
2356
2357         urtwn_cam_write(sc, R92C_CAM_CTL0(k->wk_keyix), 0);
2358         urtwn_cam_write(sc, R92C_CAM_CTL1(k->wk_keyix), 0);
2359
2360         /* Clear key. */
2361         for (i = 0; i < 4; i++)
2362                 urtwn_cam_write(sc, R92C_CAM_KEY(k->wk_keyix, i), 0);
2363         sc->keys_bmap &= ~(1 << k->wk_keyix);
2364 }
2365
2366 static int
2367 urtwn_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k)
2368 {
2369         struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2370
2371         if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2372                 /* Not for us. */
2373                 return (1);
2374         }
2375
2376         return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_set_cb));
2377 }
2378
2379 static int
2380 urtwn_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
2381 {
2382         struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2383
2384         if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
2385                 /* Not for us. */
2386                 return (1);
2387         }
2388
2389         return (!urtwn_cmd_sleepable(sc, k, sizeof(*k), urtwn_key_del_cb));
2390 }
2391
2392 static void
2393 urtwn_tsf_task_adhoc(void *arg, int pending)
2394 {
2395         struct ieee80211vap *vap = arg;
2396         struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2397         struct ieee80211_node *ni;
2398         uint32_t reg;
2399
2400         URTWN_LOCK(sc);
2401         ni = ieee80211_ref_node(vap->iv_bss);
2402         reg = urtwn_read_1(sc, R92C_BCN_CTRL);
2403
2404         /* Accept beacons with the same BSSID. */
2405         urtwn_set_rx_bssid_all(sc, 0);
2406
2407         /* Enable synchronization. */
2408         reg &= ~R92C_BCN_CTRL_DIS_TSF_UDT0;
2409         urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2410
2411         /* Synchronize. */
2412         usb_pause_mtx(&sc->sc_mtx, hz * ni->ni_intval * 5 / 1000);
2413
2414         /* Disable synchronization. */
2415         reg |= R92C_BCN_CTRL_DIS_TSF_UDT0;
2416         urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2417
2418         /* Remove beacon filter. */
2419         urtwn_set_rx_bssid_all(sc, 1);
2420
2421         /* Enable beaconing. */
2422         urtwn_write_1(sc, R92C_MBID_NUM,
2423             urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2424         reg |= R92C_BCN_CTRL_EN_BCN;
2425
2426         urtwn_write_1(sc, R92C_BCN_CTRL, reg);
2427         ieee80211_free_node(ni);
2428         URTWN_UNLOCK(sc);
2429 }
2430
2431 static void
2432 urtwn_tsf_sync_enable(struct urtwn_softc *sc, struct ieee80211vap *vap)
2433 {
2434         struct ieee80211com *ic = &sc->sc_ic;
2435         struct urtwn_vap *uvp = URTWN_VAP(vap);
2436
2437         /* Reset TSF. */
2438         urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2439
2440         switch (vap->iv_opmode) {
2441         case IEEE80211_M_STA:
2442                 /* Enable TSF synchronization. */
2443                 urtwn_write_1(sc, R92C_BCN_CTRL,
2444                     urtwn_read_1(sc, R92C_BCN_CTRL) &
2445                     ~R92C_BCN_CTRL_DIS_TSF_UDT0);
2446                 break;
2447         case IEEE80211_M_IBSS:
2448                 ieee80211_runtask(ic, &uvp->tsf_task_adhoc);
2449                 break;
2450         case IEEE80211_M_HOSTAP:
2451                 /* Enable beaconing. */
2452                 urtwn_write_1(sc, R92C_MBID_NUM,
2453                     urtwn_read_1(sc, R92C_MBID_NUM) | R92C_MBID_TXBCN_RPT0);
2454                 urtwn_write_1(sc, R92C_BCN_CTRL,
2455                     urtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
2456                 break;
2457         default:
2458                 device_printf(sc->sc_dev, "undefined opmode %d\n",
2459                     vap->iv_opmode);
2460                 return;
2461         }
2462 }
2463
2464 static void
2465 urtwn_get_tsf(struct urtwn_softc *sc, uint64_t *buf)
2466 {
2467         urtwn_read_region_1(sc, R92C_TSFTR, (uint8_t *)buf, sizeof(*buf));
2468 }
2469
2470 static void
2471 urtwn_set_led(struct urtwn_softc *sc, int led, int on)
2472 {
2473         uint8_t reg;
2474
2475         if (led == URTWN_LED_LINK) {
2476                 if (sc->chip & URTWN_CHIP_88E) {
2477                         reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
2478                         urtwn_write_1(sc, R92C_LEDCFG2, reg | 0x60);
2479                         if (!on) {
2480                                 reg = urtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
2481                                 urtwn_write_1(sc, R92C_LEDCFG2,
2482                                     reg | R92C_LEDCFG0_DIS);
2483                                 urtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
2484                                     urtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
2485                                     0xfe);
2486                         }
2487                 } else {
2488                         reg = urtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
2489                         if (!on)
2490                                 reg |= R92C_LEDCFG0_DIS;
2491                         urtwn_write_1(sc, R92C_LEDCFG0, reg);
2492                 }
2493                 sc->ledlink = on;       /* Save LED state. */
2494         }
2495 }
2496
2497 static void
2498 urtwn_set_mode(struct urtwn_softc *sc, uint8_t mode)
2499 {
2500         uint8_t reg;
2501
2502         reg = urtwn_read_1(sc, R92C_MSR);
2503         reg = (reg & ~R92C_MSR_MASK) | mode;
2504         urtwn_write_1(sc, R92C_MSR, reg);
2505 }
2506
2507 static void
2508 urtwn_ibss_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2509     const struct ieee80211_rx_stats *rxs,
2510     int rssi, int nf)
2511 {
2512         struct ieee80211vap *vap = ni->ni_vap;
2513         struct urtwn_softc *sc = vap->iv_ic->ic_softc;
2514         struct urtwn_vap *uvp = URTWN_VAP(vap);
2515         uint64_t ni_tstamp, curr_tstamp;
2516
2517         uvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2518
2519         if (vap->iv_state == IEEE80211_S_RUN &&
2520             (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2521             subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2522                 ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2523                 URTWN_LOCK(sc);
2524                 urtwn_get_tsf(sc, &curr_tstamp);
2525                 URTWN_UNLOCK(sc);
2526                 curr_tstamp = le64toh(curr_tstamp);
2527
2528                 if (ni_tstamp >= curr_tstamp)
2529                         (void) ieee80211_ibss_merge(ni);
2530         }
2531 }
2532
2533 static int
2534 urtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2535 {
2536         struct urtwn_vap *uvp = URTWN_VAP(vap);
2537         struct ieee80211com *ic = vap->iv_ic;
2538         struct urtwn_softc *sc = ic->ic_softc;
2539         struct ieee80211_node *ni;
2540         enum ieee80211_state ostate;
2541         uint32_t reg;
2542         uint8_t mode;
2543         int error = 0;
2544
2545         ostate = vap->iv_state;
2546         URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s -> %s\n",
2547             ieee80211_state_name[ostate], ieee80211_state_name[nstate]);
2548
2549         IEEE80211_UNLOCK(ic);
2550         URTWN_LOCK(sc);
2551         callout_stop(&sc->sc_watchdog_ch);
2552
2553         if (ostate == IEEE80211_S_RUN) {
2554                 /* Stop calibration. */
2555                 callout_stop(&sc->sc_calib_to);
2556
2557                 /* Turn link LED off. */
2558                 urtwn_set_led(sc, URTWN_LED_LINK, 0);
2559
2560                 /* Set media status to 'No Link'. */
2561                 urtwn_set_mode(sc, R92C_MSR_NOLINK);
2562
2563                 /* Stop Rx of data frames. */
2564                 urtwn_write_2(sc, R92C_RXFLTMAP2, 0);
2565
2566                 /* Disable TSF synchronization. */
2567                 urtwn_write_1(sc, R92C_BCN_CTRL,
2568                     (urtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN) |
2569                     R92C_BCN_CTRL_DIS_TSF_UDT0);
2570
2571                 /* Disable beaconing. */
2572                 urtwn_write_1(sc, R92C_MBID_NUM,
2573                     urtwn_read_1(sc, R92C_MBID_NUM) & ~R92C_MBID_TXBCN_RPT0);
2574
2575                 /* Reset TSF. */
2576                 urtwn_write_1(sc, R92C_DUAL_TSF_RST, R92C_DUAL_TSF_RST0);
2577
2578                 /* Reset EDCA parameters. */
2579                 urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
2580                 urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
2581                 urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
2582                 urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
2583         }
2584
2585         switch (nstate) {
2586         case IEEE80211_S_INIT:
2587                 /* Turn link LED off. */
2588                 urtwn_set_led(sc, URTWN_LED_LINK, 0);
2589                 break;
2590         case IEEE80211_S_SCAN:
2591                 /* Pause AC Tx queues. */
2592                 urtwn_write_1(sc, R92C_TXPAUSE,
2593                     urtwn_read_1(sc, R92C_TXPAUSE) | R92C_TX_QUEUE_AC);
2594                 break;
2595         case IEEE80211_S_AUTH:
2596                 urtwn_set_chan(sc, ic->ic_curchan, NULL);
2597                 break;
2598         case IEEE80211_S_RUN:
2599                 if (vap->iv_opmode == IEEE80211_M_MONITOR) {
2600                         /* Turn link LED on. */
2601                         urtwn_set_led(sc, URTWN_LED_LINK, 1);
2602                         break;
2603                 }
2604
2605                 ni = ieee80211_ref_node(vap->iv_bss);
2606
2607                 if (ic->ic_bsschan == IEEE80211_CHAN_ANYC ||
2608                     ni->ni_chan == IEEE80211_CHAN_ANYC) {
2609                         device_printf(sc->sc_dev,
2610                             "%s: could not move to RUN state\n", __func__);
2611                         error = EINVAL;
2612                         goto end_run;
2613                 }
2614
2615                 switch (vap->iv_opmode) {
2616                 case IEEE80211_M_STA:
2617                         mode = R92C_MSR_INFRA;
2618                         break;
2619                 case IEEE80211_M_IBSS:
2620                         mode = R92C_MSR_ADHOC;
2621                         break;
2622                 case IEEE80211_M_HOSTAP:
2623                         mode = R92C_MSR_AP;
2624                         break;
2625                 default:
2626                         device_printf(sc->sc_dev, "undefined opmode %d\n",
2627                             vap->iv_opmode);
2628                         error = EINVAL;
2629                         goto end_run;
2630                 }
2631
2632                 /* Set media status to 'Associated'. */
2633                 urtwn_set_mode(sc, mode);
2634
2635                 /* Set BSSID. */
2636                 urtwn_write_4(sc, R92C_BSSID + 0, le32dec(&ni->ni_bssid[0]));
2637                 urtwn_write_4(sc, R92C_BSSID + 4, le16dec(&ni->ni_bssid[4]));
2638
2639                 if (ic->ic_curmode == IEEE80211_MODE_11B)
2640                         urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
2641                 else    /* 802.11b/g */
2642                         urtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
2643
2644                 /* Enable Rx of data frames. */
2645                 urtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2646
2647                 /* Flush all AC queues. */
2648                 urtwn_write_1(sc, R92C_TXPAUSE, 0);
2649
2650                 /* Set beacon interval. */
2651                 urtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
2652
2653                 /* Allow Rx from our BSSID only. */
2654                 if (ic->ic_promisc == 0) {
2655                         reg = urtwn_read_4(sc, R92C_RCR);
2656
2657                         if (vap->iv_opmode != IEEE80211_M_HOSTAP)
2658                                 reg |= R92C_RCR_CBSSID_DATA;
2659                         if (vap->iv_opmode != IEEE80211_M_IBSS)
2660                                 reg |= R92C_RCR_CBSSID_BCN;
2661
2662                         urtwn_write_4(sc, R92C_RCR, reg);
2663                 }
2664
2665                 if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
2666                     vap->iv_opmode == IEEE80211_M_IBSS) {
2667                         error = urtwn_setup_beacon(sc, ni);
2668                         if (error != 0) {
2669                                 device_printf(sc->sc_dev,
2670                                     "unable to push beacon into the chip, "
2671                                     "error %d\n", error);
2672                                 goto end_run;
2673                         }
2674                 }
2675
2676                 /* Enable TSF synchronization. */
2677                 urtwn_tsf_sync_enable(sc, vap);
2678
2679                 urtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
2680                 urtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
2681                 urtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
2682                 urtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
2683                 urtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
2684                 urtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
2685
2686                 /* Intialize rate adaptation. */
2687                 if (!(sc->chip & URTWN_CHIP_88E))
2688                         urtwn_ra_init(sc);
2689                 /* Turn link LED on. */
2690                 urtwn_set_led(sc, URTWN_LED_LINK, 1);
2691
2692                 sc->avg_pwdb = -1;      /* Reset average RSSI. */
2693                 /* Reset temperature calibration state machine. */
2694                 sc->sc_flags &= ~URTWN_TEMP_MEASURED;
2695                 sc->thcal_lctemp = 0;
2696                 /* Start periodic calibration. */
2697                 callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2698
2699 end_run:
2700                 ieee80211_free_node(ni);
2701                 break;
2702         default:
2703                 break;
2704         }
2705
2706         URTWN_UNLOCK(sc);
2707         IEEE80211_LOCK(ic);
2708         return (error != 0 ? error : uvp->newstate(vap, nstate, arg));
2709 }
2710
2711 static void
2712 urtwn_calib_to(void *arg)
2713 {
2714         struct urtwn_softc *sc = arg;
2715
2716         /* Do it in a process context. */
2717         urtwn_cmd_sleepable(sc, NULL, 0, urtwn_calib_cb);
2718 }
2719
2720 static void
2721 urtwn_calib_cb(struct urtwn_softc *sc, union sec_param *data)
2722 {
2723         /* Do temperature compensation. */
2724         urtwn_temp_calib(sc);
2725
2726         if ((urtwn_read_1(sc, R92C_MSR) & R92C_MSR_MASK) != R92C_MSR_NOLINK)
2727                 callout_reset(&sc->sc_calib_to, 2*hz, urtwn_calib_to, sc);
2728 }
2729
2730 static void
2731 urtwn_watchdog(void *arg)
2732 {
2733         struct urtwn_softc *sc = arg;
2734
2735         if (sc->sc_txtimer > 0) {
2736                 if (--sc->sc_txtimer == 0) {
2737                         device_printf(sc->sc_dev, "device timeout\n");
2738 #if defined(__DragonFly__)
2739                         /* unimplemented */
2740 #else
2741                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2742 #endif
2743                         return;
2744                 }
2745                 callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
2746         }
2747 }
2748
2749 static void
2750 urtwn_update_avgrssi(struct urtwn_softc *sc, int rate, int8_t rssi)
2751 {
2752         int pwdb;
2753
2754         /* Convert antenna signal to percentage. */
2755         if (rssi <= -100 || rssi >= 20)
2756                 pwdb = 0;
2757         else if (rssi >= 0)
2758                 pwdb = 100;
2759         else
2760                 pwdb = 100 + rssi;
2761         if (!(sc->chip & URTWN_CHIP_88E)) {
2762                 if (rate <= URTWN_RIDX_CCK11) {
2763                         /* CCK gain is smaller than OFDM/MCS gain. */
2764                         pwdb += 6;
2765                         if (pwdb > 100)
2766                                 pwdb = 100;
2767                         if (pwdb <= 14)
2768                                 pwdb -= 4;
2769                         else if (pwdb <= 26)
2770                                 pwdb -= 8;
2771                         else if (pwdb <= 34)
2772                                 pwdb -= 6;
2773                         else if (pwdb <= 42)
2774                                 pwdb -= 2;
2775                 }
2776         }
2777         if (sc->avg_pwdb == -1) /* Init. */
2778                 sc->avg_pwdb = pwdb;
2779         else if (sc->avg_pwdb < pwdb)
2780                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
2781         else
2782                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
2783         URTWN_DPRINTF(sc, URTWN_DEBUG_RSSI, "%s: PWDB %d, EMA %d\n", __func__,
2784             pwdb, sc->avg_pwdb);
2785 }
2786
2787 static int8_t
2788 urtwn_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2789 {
2790         static const int8_t cckoff[] = { 16, -12, -26, -46 };
2791         struct r92c_rx_phystat *phy;
2792         struct r92c_rx_cck *cck;
2793         uint8_t rpt;
2794         int8_t rssi;
2795
2796         if (rate <= URTWN_RIDX_CCK11) {
2797                 cck = (struct r92c_rx_cck *)physt;
2798                 if (sc->sc_flags & URTWN_FLAG_CCK_HIPWR) {
2799                         rpt = (cck->agc_rpt >> 5) & 0x3;
2800                         rssi = (cck->agc_rpt & 0x1f) << 1;
2801                 } else {
2802                         rpt = (cck->agc_rpt >> 6) & 0x3;
2803                         rssi = cck->agc_rpt & 0x3e;
2804                 }
2805                 rssi = cckoff[rpt] - rssi;
2806         } else {        /* OFDM/HT. */
2807                 phy = (struct r92c_rx_phystat *)physt;
2808                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2809         }
2810         return (rssi);
2811 }
2812
2813 static int8_t
2814 urtwn_r88e_get_rssi(struct urtwn_softc *sc, int rate, void *physt)
2815 {
2816         struct r92c_rx_phystat *phy;
2817         struct r88e_rx_cck *cck;
2818         uint8_t cck_agc_rpt, lna_idx, vga_idx;
2819         int8_t rssi;
2820
2821         rssi = 0;
2822         if (rate <= URTWN_RIDX_CCK11) {
2823                 cck = (struct r88e_rx_cck *)physt;
2824                 cck_agc_rpt = cck->agc_rpt;
2825                 lna_idx = (cck_agc_rpt & 0xe0) >> 5;
2826                 vga_idx = cck_agc_rpt & 0x1f;
2827                 switch (lna_idx) {
2828                 case 7:
2829                         if (vga_idx <= 27)
2830                                 rssi = -100 + 2* (27 - vga_idx);
2831                         else
2832                                 rssi = -100;
2833                         break;
2834                 case 6:
2835                         rssi = -48 + 2 * (2 - vga_idx);
2836                         break;
2837                 case 5:
2838                         rssi = -42 + 2 * (7 - vga_idx);
2839                         break;
2840                 case 4:
2841                         rssi = -36 + 2 * (7 - vga_idx);
2842                         break;
2843                 case 3:
2844                         rssi = -24 + 2 * (7 - vga_idx);
2845                         break;
2846                 case 2:
2847                         rssi = -12 + 2 * (5 - vga_idx);
2848                         break;
2849                 case 1:
2850                         rssi = 8 - (2 * vga_idx);
2851                         break;
2852                 case 0:
2853                         rssi = 14 - (2 * vga_idx);
2854                         break;
2855                 }
2856                 rssi += 6;
2857         } else {        /* OFDM/HT. */
2858                 phy = (struct r92c_rx_phystat *)physt;
2859                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
2860         }
2861         return (rssi);
2862 }
2863
2864 static int
2865 urtwn_tx_data(struct urtwn_softc *sc, struct ieee80211_node *ni,
2866     struct mbuf *m, struct urtwn_data *data)
2867 {
2868         const struct ieee80211_txparam *tp;
2869         struct ieee80211com *ic = &sc->sc_ic;
2870         struct ieee80211vap *vap = ni->ni_vap;
2871         struct ieee80211_key *k = NULL;
2872         struct ieee80211_channel *chan;
2873         struct ieee80211_frame *wh;
2874         struct r92c_tx_desc *txd;
2875         uint8_t macid, raid, rate, ridx, subtype, type, tid, qsel;
2876         int hasqos, ismcast;
2877
2878         URTWN_ASSERT_LOCKED(sc);
2879
2880         /*
2881          * Software crypto.
2882          */
2883         wh = mtod(m, struct ieee80211_frame *);
2884         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2885         subtype = wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK;
2886         hasqos = IEEE80211_QOS_HAS_SEQ(wh);
2887         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
2888
2889         /* Select TX ring for this frame. */
2890         if (hasqos) {
2891                 tid = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
2892                 tid &= IEEE80211_QOS_TID;
2893         } else
2894                 tid = 0;
2895
2896         chan = (ni->ni_chan != IEEE80211_CHAN_ANYC) ?
2897                 ni->ni_chan : ic->ic_curchan;
2898         tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
2899
2900         /* Choose a TX rate index. */
2901         if (type == IEEE80211_FC0_TYPE_MGT)
2902                 rate = tp->mgmtrate;
2903         else if (ismcast)
2904                 rate = tp->mcastrate;
2905         else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2906                 rate = tp->ucastrate;
2907         else if (m->m_flags & M_EAPOL)
2908                 rate = tp->mgmtrate;
2909         else {
2910                 if (URTWN_CHIP_HAS_RATECTL(sc)) {
2911                         /* XXX pass pktlen */
2912                         (void) ieee80211_ratectl_rate(ni, NULL, 0);
2913                         rate = ni->ni_txrate;
2914                 } else {
2915                         /* XXX TODO: drop the default rate for 11b/11g? */
2916                         if (ni->ni_flags & IEEE80211_NODE_HT)
2917                                 rate = IEEE80211_RATE_MCS | 0x4; /* MCS4 */
2918                         else if (ic->ic_curmode != IEEE80211_MODE_11B)
2919                                 rate = 108;
2920                         else
2921                                 rate = 22;
2922                 }
2923         }
2924
2925         /*
2926          * XXX TODO: this should be per-node, for 11b versus 11bg
2927          * nodes in hostap mode
2928          */
2929         ridx = rate2ridx(rate);
2930         if (ni->ni_flags & IEEE80211_NODE_HT)
2931                 raid = R92C_RAID_11GN;
2932         else if (ic->ic_curmode != IEEE80211_MODE_11B)
2933                 raid = R92C_RAID_11BG;
2934         else
2935                 raid = R92C_RAID_11B;
2936
2937         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2938                 k = ieee80211_crypto_encap(ni, m);
2939                 if (k == NULL) {
2940                         device_printf(sc->sc_dev,
2941                             "ieee80211_crypto_encap returns NULL.\n");
2942                         return (ENOBUFS);
2943                 }
2944
2945                 /* in case packet header moved, reset pointer */
2946                 wh = mtod(m, struct ieee80211_frame *);
2947         }
2948
2949         /* Fill Tx descriptor. */
2950         txd = (struct r92c_tx_desc *)data->buf;
2951         memset(txd, 0, sizeof(*txd));
2952
2953         txd->txdw0 |= htole32(
2954             SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
2955             R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
2956         if (ismcast)
2957                 txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
2958
2959         if (!ismcast) {
2960                 if (sc->chip & URTWN_CHIP_88E) {
2961                         struct urtwn_node *un = URTWN_NODE(ni);
2962                         macid = un->id;
2963                 } else
2964                         macid = URTWN_MACID_BSS;
2965
2966                 if (type == IEEE80211_FC0_TYPE_DATA) {
2967                         qsel = tid % URTWN_MAX_TID;
2968
2969                         if (sc->chip & URTWN_CHIP_88E) {
2970                                 txd->txdw2 |= htole32(
2971                                     R88E_TXDW2_AGGBK |
2972                                     R88E_TXDW2_CCX_RPT);
2973                         } else
2974                                 txd->txdw1 |= htole32(R92C_TXDW1_AGGBK);
2975
2976                         /* protmode, non-HT */
2977                         /* XXX TODO: noack frames? */
2978                         if ((rate & 0x80) == 0 &&
2979                             (ic->ic_flags & IEEE80211_F_USEPROT)) {
2980                                 switch (ic->ic_protmode) {
2981                                 case IEEE80211_PROT_CTSONLY:
2982                                         txd->txdw4 |= htole32(
2983                                             R92C_TXDW4_CTS2SELF |
2984                                             R92C_TXDW4_HWRTSEN);
2985                                         break;
2986                                 case IEEE80211_PROT_RTSCTS:
2987                                         txd->txdw4 |= htole32(
2988                                             R92C_TXDW4_RTSEN |
2989                                             R92C_TXDW4_HWRTSEN);
2990                                         break;
2991                                 default:
2992                                         break;
2993                                 }
2994                         }
2995
2996                         /* protmode, HT */
2997                         /* XXX TODO: noack frames? */
2998                         if ((rate & 0x80) &&
2999                             (ic->ic_htprotmode == IEEE80211_PROT_RTSCTS)) {
3000                                 txd->txdw4 |= htole32(
3001                                     R92C_TXDW4_RTSEN |
3002                                     R92C_TXDW4_HWRTSEN);
3003                         }
3004
3005                         /* XXX TODO: rtsrate is configurable? 24mbit may
3006                          * be a bit high for RTS rate? */
3007                         txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
3008                             URTWN_RIDX_OFDM24));
3009
3010                         txd->txdw5 |= htole32(0x0001ff00);
3011                 } else  /* IEEE80211_FC0_TYPE_MGT */
3012                         qsel = R92C_TXDW1_QSEL_MGNT;
3013         } else {
3014                 macid = URTWN_MACID_BC;
3015                 qsel = R92C_TXDW1_QSEL_MGNT;
3016         }
3017
3018         txd->txdw1 |= htole32(
3019             SM(R92C_TXDW1_QSEL, qsel) |
3020             SM(R92C_TXDW1_RAID, raid));
3021
3022         /* XXX TODO: 40MHZ flag? */
3023         /* XXX TODO: AMPDU flag? (AGG_ENABLE or AGG_BREAK?) Density shift? */
3024         /* XXX Short preamble? */
3025         /* XXX Short-GI? */
3026
3027         if (sc->chip & URTWN_CHIP_88E)
3028                 txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, macid));
3029         else
3030                 txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, macid));
3031
3032         txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3033
3034         /* Force this rate if needed. */
3035         if (URTWN_CHIP_HAS_RATECTL(sc) || ismcast ||
3036             (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) ||
3037             (m->m_flags & M_EAPOL) || type != IEEE80211_FC0_TYPE_DATA)
3038                 txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3039
3040         if (!hasqos) {
3041                 /* Use HW sequence numbering for non-QoS frames. */
3042                 if (sc->chip & URTWN_CHIP_88E)
3043                         txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3044                 else
3045                         txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3046         } else {
3047                 /* Set sequence number. */
3048                 txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3049         }
3050
3051         if (k != NULL && !(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3052                 uint8_t cipher;
3053
3054                 switch (k->wk_cipher->ic_cipher) {
3055                 case IEEE80211_CIPHER_WEP:
3056                 case IEEE80211_CIPHER_TKIP:
3057                         cipher = R92C_TXDW1_CIPHER_RC4;
3058                         break;
3059                 case IEEE80211_CIPHER_AES_CCM:
3060                         cipher = R92C_TXDW1_CIPHER_AES;
3061                         break;
3062                 default:
3063                         device_printf(sc->sc_dev, "%s: unknown cipher %d\n",
3064                             __func__, k->wk_cipher->ic_cipher);
3065                         return (EINVAL);
3066                 }
3067
3068                 txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3069         }
3070
3071         if (ieee80211_radiotap_active_vap(vap)) {
3072                 struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3073
3074                 tap->wt_flags = 0;
3075                 if (k != NULL)
3076                         tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3077                 ieee80211_radiotap_tx(vap, m);
3078         }
3079
3080         data->ni = ni;
3081
3082         urtwn_tx_start(sc, m, type, data);
3083
3084         return (0);
3085 }
3086
3087 static int
3088 urtwn_tx_raw(struct urtwn_softc *sc, struct ieee80211_node *ni,
3089     struct mbuf *m, struct urtwn_data *data,
3090     const struct ieee80211_bpf_params *params)
3091 {
3092         struct ieee80211vap *vap = ni->ni_vap;
3093         struct ieee80211_key *k = NULL;
3094         struct ieee80211_frame *wh;
3095         struct r92c_tx_desc *txd;
3096         uint8_t cipher, ridx, type;
3097
3098         /* Encrypt the frame if need be. */
3099         cipher = R92C_TXDW1_CIPHER_NONE;
3100         if (params->ibp_flags & IEEE80211_BPF_CRYPTO) {
3101                 /* Retrieve key for TX. */
3102                 k = ieee80211_crypto_encap(ni, m);
3103                 if (k == NULL)
3104                         return (ENOBUFS);
3105
3106                 if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
3107                         switch (k->wk_cipher->ic_cipher) {
3108                         case IEEE80211_CIPHER_WEP:
3109                         case IEEE80211_CIPHER_TKIP:
3110                                 cipher = R92C_TXDW1_CIPHER_RC4;
3111                                 break;
3112                         case IEEE80211_CIPHER_AES_CCM:
3113                                 cipher = R92C_TXDW1_CIPHER_AES;
3114                                 break;
3115                         default:
3116                                 device_printf(sc->sc_dev,
3117                                     "%s: unknown cipher %d\n",
3118                                     __func__, k->wk_cipher->ic_cipher);
3119                                 return (EINVAL);
3120                         }
3121                 }
3122         }
3123
3124         /* XXX TODO: 11n checks, matching urtwn_tx_data() */
3125
3126         wh = mtod(m, struct ieee80211_frame *);
3127         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3128
3129         /* Fill Tx descriptor. */
3130         txd = (struct r92c_tx_desc *)data->buf;
3131         memset(txd, 0, sizeof(*txd));
3132
3133         txd->txdw0 |= htole32(
3134             SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
3135             R92C_TXDW0_OWN | R92C_TXDW0_FSG | R92C_TXDW0_LSG);
3136         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3137                 txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
3138
3139         if (params->ibp_flags & IEEE80211_BPF_RTS)
3140                 txd->txdw4 |= htole32(R92C_TXDW4_RTSEN);
3141         if (params->ibp_flags & IEEE80211_BPF_CTS)
3142                 txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF);
3143         if (txd->txdw4 & htole32(R92C_TXDW4_RTSEN | R92C_TXDW4_CTS2SELF)) {
3144                 txd->txdw4 |= htole32(R92C_TXDW4_HWRTSEN);
3145                 txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
3146                     URTWN_RIDX_OFDM24));
3147         }
3148
3149         if (sc->chip & URTWN_CHIP_88E)
3150                 txd->txdw1 |= htole32(SM(R88E_TXDW1_MACID, URTWN_MACID_BC));
3151         else
3152                 txd->txdw1 |= htole32(SM(R92C_TXDW1_MACID, URTWN_MACID_BC));
3153
3154         /* XXX TODO: rate index/config (RAID) for 11n? */
3155         txd->txdw1 |= htole32(SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT));
3156         txd->txdw1 |= htole32(SM(R92C_TXDW1_CIPHER, cipher));
3157
3158         /* Choose a TX rate index. */
3159         ridx = rate2ridx(params->ibp_rate0);
3160         txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, ridx));
3161         txd->txdw5 |= htole32(0x0001ff00);
3162         txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
3163
3164         if (!IEEE80211_QOS_HAS_SEQ(wh)) {
3165                 /* Use HW sequence numbering for non-QoS frames. */
3166                 if (sc->chip & URTWN_CHIP_88E)
3167                         txd->txdseq = htole16(R88E_TXDSEQ_HWSEQ_EN);
3168                 else
3169                         txd->txdw4 |= htole32(R92C_TXDW4_HWSEQ_EN);
3170         } else {
3171                 /* Set sequence number. */
3172                 txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
3173         }
3174
3175         if (ieee80211_radiotap_active_vap(vap)) {
3176                 struct urtwn_tx_radiotap_header *tap = &sc->sc_txtap;
3177
3178                 tap->wt_flags = 0;
3179                 if (k != NULL)
3180                         tap->wt_flags |= IEEE80211_RADIOTAP_F_WEP;
3181                 ieee80211_radiotap_tx(vap, m);
3182         }
3183
3184         data->ni = ni;
3185
3186         urtwn_tx_start(sc, m, type, data);
3187
3188         return (0);
3189 }
3190
3191 static void
3192 urtwn_tx_start(struct urtwn_softc *sc, struct mbuf *m, uint8_t type,
3193     struct urtwn_data *data)
3194 {
3195         struct usb_xfer *xfer;
3196         struct r92c_tx_desc *txd;
3197         uint16_t ac, sum;
3198         int i, xferlen;
3199
3200         URTWN_ASSERT_LOCKED(sc);
3201
3202         ac = M_WME_GETAC(m);
3203
3204         switch (type) {
3205         case IEEE80211_FC0_TYPE_CTL:
3206         case IEEE80211_FC0_TYPE_MGT:
3207                 xfer = sc->sc_xfer[URTWN_BULK_TX_VO];
3208                 break;
3209         default:
3210                 xfer = sc->sc_xfer[wme2queue[ac].qid];
3211                 break;
3212         }
3213
3214         txd = (struct r92c_tx_desc *)data->buf;
3215         txd->txdw0 |= htole32(SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len));
3216
3217         /* Compute Tx descriptor checksum. */
3218         sum = 0;
3219         for (i = 0; i < sizeof(*txd) / 2; i++)
3220                 sum ^= ((uint16_t *)txd)[i];
3221         txd->txdsum = sum;      /* NB: already little endian. */
3222
3223         xferlen = sizeof(*txd) + m->m_pkthdr.len;
3224         m_copydata(m, 0, m->m_pkthdr.len, (caddr_t)&txd[1]);
3225
3226         data->buflen = xferlen;
3227         data->m = m;
3228
3229         STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
3230         usbd_transfer_start(xfer);
3231 }
3232
3233 static int
3234 urtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
3235 {
3236         struct urtwn_softc *sc = ic->ic_softc;
3237         int error;
3238
3239         URTWN_LOCK(sc);
3240         if ((sc->sc_flags & URTWN_RUNNING) == 0) {
3241                 URTWN_UNLOCK(sc);
3242                 return (ENXIO);
3243         }
3244         error = mbufq_enqueue(&sc->sc_snd, m);
3245         if (error) {
3246                 URTWN_UNLOCK(sc);
3247                 return (error);
3248         }
3249         urtwn_start(sc);
3250         URTWN_UNLOCK(sc);
3251
3252         return (0);
3253 }
3254
3255 static void
3256 urtwn_start(struct urtwn_softc *sc)
3257 {
3258         struct ieee80211_node *ni;
3259         struct mbuf *m;
3260         struct urtwn_data *bf;
3261
3262         URTWN_ASSERT_LOCKED(sc);
3263         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3264                 bf = urtwn_getbuf(sc);
3265                 if (bf == NULL) {
3266                         mbufq_prepend(&sc->sc_snd, m);
3267                         break;
3268                 }
3269                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3270                 m->m_pkthdr.rcvif = NULL;
3271
3272                 URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
3273                     __func__,
3274                     m);
3275
3276                 if (urtwn_tx_data(sc, ni, m, bf) != 0) {
3277                         if_inc_counter(ni->ni_vap->iv_ifp,
3278                             IFCOUNTER_OERRORS, 1);
3279                         STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
3280                         m_freem(m);
3281                         ieee80211_free_node(ni);
3282                         break;
3283                 }
3284                 sc->sc_txtimer = 5;
3285                 callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
3286         }
3287 }
3288
3289 static void
3290 urtwn_parent(struct ieee80211com *ic)
3291 {
3292         struct urtwn_softc *sc = ic->ic_softc;
3293
3294         URTWN_LOCK(sc);
3295         if (sc->sc_flags & URTWN_DETACHED) {
3296                 URTWN_UNLOCK(sc);
3297                 return;
3298         }
3299         URTWN_UNLOCK(sc);
3300
3301         if (ic->ic_nrunning > 0) {
3302                 if (urtwn_init(sc) != 0) {
3303                         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3304                         if (vap != NULL)
3305                                 ieee80211_stop(vap);
3306                 } else
3307                         ieee80211_start_all(ic);
3308         } else
3309                 urtwn_stop(sc);
3310 }
3311
3312 static __inline int
3313 urtwn_power_on(struct urtwn_softc *sc)
3314 {
3315
3316         return sc->sc_power_on(sc);
3317 }
3318
3319 static int
3320 urtwn_r92c_power_on(struct urtwn_softc *sc)
3321 {
3322         uint32_t reg;
3323         usb_error_t error;
3324         int ntries;
3325
3326         /* Wait for autoload done bit. */
3327         for (ntries = 0; ntries < 1000; ntries++) {
3328                 if (urtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
3329                         break;
3330                 urtwn_ms_delay(sc);
3331         }
3332         if (ntries == 1000) {
3333                 device_printf(sc->sc_dev,
3334                     "timeout waiting for chip autoload\n");
3335                 return (ETIMEDOUT);
3336         }
3337
3338         /* Unlock ISO/CLK/Power control register. */
3339         error = urtwn_write_1(sc, R92C_RSV_CTRL, 0);
3340         if (error != USB_ERR_NORMAL_COMPLETION)
3341                 return (EIO);
3342         /* Move SPS into PWM mode. */
3343         error = urtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
3344         if (error != USB_ERR_NORMAL_COMPLETION)
3345                 return (EIO);
3346         urtwn_ms_delay(sc);
3347
3348         reg = urtwn_read_1(sc, R92C_LDOV12D_CTRL);
3349         if (!(reg & R92C_LDOV12D_CTRL_LDV12_EN)) {
3350                 error = urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3351                     reg | R92C_LDOV12D_CTRL_LDV12_EN);
3352                 if (error != USB_ERR_NORMAL_COMPLETION)
3353                         return (EIO);
3354                 urtwn_ms_delay(sc);
3355                 error = urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3356                     urtwn_read_1(sc, R92C_SYS_ISO_CTRL) &
3357                     ~R92C_SYS_ISO_CTRL_MD2PP);
3358                 if (error != USB_ERR_NORMAL_COMPLETION)
3359                         return (EIO);
3360         }
3361
3362         /* Auto enable WLAN. */
3363         error = urtwn_write_2(sc, R92C_APS_FSMCO,
3364             urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3365         if (error != USB_ERR_NORMAL_COMPLETION)
3366                 return (EIO);
3367         for (ntries = 0; ntries < 1000; ntries++) {
3368                 if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3369                     R92C_APS_FSMCO_APFM_ONMAC))
3370                         break;
3371                 urtwn_ms_delay(sc);
3372         }
3373         if (ntries == 1000) {
3374                 device_printf(sc->sc_dev,
3375                     "timeout waiting for MAC auto ON\n");
3376                 return (ETIMEDOUT);
3377         }
3378
3379         /* Enable radio, GPIO and LED functions. */
3380         error = urtwn_write_2(sc, R92C_APS_FSMCO,
3381             R92C_APS_FSMCO_AFSM_HSUS |
3382             R92C_APS_FSMCO_PDN_EN |
3383             R92C_APS_FSMCO_PFM_ALDN);
3384         if (error != USB_ERR_NORMAL_COMPLETION)
3385                 return (EIO);
3386         /* Release RF digital isolation. */
3387         error = urtwn_write_2(sc, R92C_SYS_ISO_CTRL,
3388             urtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
3389         if (error != USB_ERR_NORMAL_COMPLETION)
3390                 return (EIO);
3391
3392         /* Initialize MAC. */
3393         error = urtwn_write_1(sc, R92C_APSD_CTRL,
3394             urtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
3395         if (error != USB_ERR_NORMAL_COMPLETION)
3396                 return (EIO);
3397         for (ntries = 0; ntries < 200; ntries++) {
3398                 if (!(urtwn_read_1(sc, R92C_APSD_CTRL) &
3399                     R92C_APSD_CTRL_OFF_STATUS))
3400                         break;
3401                 urtwn_ms_delay(sc);
3402         }
3403         if (ntries == 200) {
3404                 device_printf(sc->sc_dev,
3405                     "timeout waiting for MAC initialization\n");
3406                 return (ETIMEDOUT);
3407         }
3408
3409         /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3410         reg = urtwn_read_2(sc, R92C_CR);
3411         reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3412             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3413             R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3414             R92C_CR_ENSEC;
3415         error = urtwn_write_2(sc, R92C_CR, reg);
3416         if (error != USB_ERR_NORMAL_COMPLETION)
3417                 return (EIO);
3418
3419         error = urtwn_write_1(sc, 0xfe10, 0x19);
3420         if (error != USB_ERR_NORMAL_COMPLETION)
3421                 return (EIO);
3422         return (0);
3423 }
3424
3425 static int
3426 urtwn_r88e_power_on(struct urtwn_softc *sc)
3427 {
3428         uint32_t reg;
3429         usb_error_t error;
3430         int ntries;
3431
3432         /* Wait for power ready bit. */
3433         for (ntries = 0; ntries < 5000; ntries++) {
3434                 if (urtwn_read_4(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_SUS_HOST)
3435                         break;
3436                 urtwn_ms_delay(sc);
3437         }
3438         if (ntries == 5000) {
3439                 device_printf(sc->sc_dev,
3440                     "timeout waiting for chip power up\n");
3441                 return (ETIMEDOUT);
3442         }
3443
3444         /* Reset BB. */
3445         error = urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3446             urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~(R92C_SYS_FUNC_EN_BBRSTB |
3447             R92C_SYS_FUNC_EN_BB_GLB_RST));
3448         if (error != USB_ERR_NORMAL_COMPLETION)
3449                 return (EIO);
3450
3451         error = urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3452             urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3453         if (error != USB_ERR_NORMAL_COMPLETION)
3454                 return (EIO);
3455
3456         /* Disable HWPDN. */
3457         error = urtwn_write_2(sc, R92C_APS_FSMCO,
3458             urtwn_read_2(sc, R92C_APS_FSMCO) & ~R92C_APS_FSMCO_APDM_HPDN);
3459         if (error != USB_ERR_NORMAL_COMPLETION)
3460                 return (EIO);
3461
3462         /* Disable WL suspend. */
3463         error = urtwn_write_2(sc, R92C_APS_FSMCO,
3464             urtwn_read_2(sc, R92C_APS_FSMCO) &
3465             ~(R92C_APS_FSMCO_AFSM_HSUS | R92C_APS_FSMCO_AFSM_PCIE));
3466         if (error != USB_ERR_NORMAL_COMPLETION)
3467                 return (EIO);
3468
3469         error = urtwn_write_2(sc, R92C_APS_FSMCO,
3470             urtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
3471         if (error != USB_ERR_NORMAL_COMPLETION)
3472                 return (EIO);
3473         for (ntries = 0; ntries < 5000; ntries++) {
3474                 if (!(urtwn_read_2(sc, R92C_APS_FSMCO) &
3475                     R92C_APS_FSMCO_APFM_ONMAC))
3476                         break;
3477                 urtwn_ms_delay(sc);
3478         }
3479         if (ntries == 5000)
3480                 return (ETIMEDOUT);
3481
3482         /* Enable LDO normal mode. */
3483         error = urtwn_write_1(sc, R92C_LPLDO_CTRL,
3484             urtwn_read_1(sc, R92C_LPLDO_CTRL) & ~R92C_LPLDO_CTRL_SLEEP);
3485         if (error != USB_ERR_NORMAL_COMPLETION)
3486                 return (EIO);
3487
3488         /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
3489         error = urtwn_write_2(sc, R92C_CR, 0);
3490         if (error != USB_ERR_NORMAL_COMPLETION)
3491                 return (EIO);
3492         reg = urtwn_read_2(sc, R92C_CR);
3493         reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3494             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3495             R92C_CR_SCHEDULE_EN | R92C_CR_ENSEC | R92C_CR_CALTMR_EN;
3496         error = urtwn_write_2(sc, R92C_CR, reg);
3497         if (error != USB_ERR_NORMAL_COMPLETION)
3498                 return (EIO);
3499
3500         return (0);
3501 }
3502
3503 static __inline void
3504 urtwn_power_off(struct urtwn_softc *sc)
3505 {
3506
3507         return sc->sc_power_off(sc);
3508 }
3509
3510 static void
3511 urtwn_r92c_power_off(struct urtwn_softc *sc)
3512 {
3513         uint32_t reg;
3514
3515         /* Block all Tx queues. */
3516         urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3517
3518         /* Disable RF */
3519         urtwn_rf_write(sc, 0, 0, 0);
3520
3521         urtwn_write_1(sc, R92C_APSD_CTRL, R92C_APSD_CTRL_OFF);
3522
3523         /* Reset BB state machine */
3524         urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3525             R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA |
3526             R92C_SYS_FUNC_EN_BB_GLB_RST);
3527         urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3528             R92C_SYS_FUNC_EN_USBD | R92C_SYS_FUNC_EN_USBA);
3529
3530         /*
3531          * Reset digital sequence
3532          */
3533 #ifndef URTWN_WITHOUT_UCODE
3534         if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY) {
3535                 /* Reset MCU ready status */
3536                 urtwn_write_1(sc, R92C_MCUFWDL, 0);
3537
3538                 /* If firmware in ram code, do reset */
3539                 urtwn_fw_reset(sc);
3540         }
3541 #endif
3542
3543         /* Reset MAC and Enable 8051 */
3544         urtwn_write_1(sc, R92C_SYS_FUNC_EN + 1,
3545             (R92C_SYS_FUNC_EN_CPUEN |
3546              R92C_SYS_FUNC_EN_ELDR |
3547              R92C_SYS_FUNC_EN_HWPDN) >> 8);
3548
3549         /* Reset MCU ready status */
3550         urtwn_write_1(sc, R92C_MCUFWDL, 0);
3551
3552         /* Disable MAC clock */
3553         urtwn_write_2(sc, R92C_SYS_CLKR,
3554             R92C_SYS_CLKR_ANAD16V_EN |
3555             R92C_SYS_CLKR_ANA8M |
3556             R92C_SYS_CLKR_LOADER_EN |
3557             R92C_SYS_CLKR_80M_SSC_DIS |
3558             R92C_SYS_CLKR_SYS_EN |
3559             R92C_SYS_CLKR_RING_EN |
3560             0x4000);
3561
3562         /* Disable AFE PLL */
3563         urtwn_write_1(sc, R92C_AFE_PLL_CTRL, 0x80);
3564
3565         /* Gated AFE DIG_CLOCK */
3566         urtwn_write_2(sc, R92C_AFE_XTAL_CTRL, 0x880F);
3567
3568         /* Isolated digital to PON */
3569         urtwn_write_1(sc, R92C_SYS_ISO_CTRL,
3570             R92C_SYS_ISO_CTRL_MD2PP |
3571             R92C_SYS_ISO_CTRL_PA2PCIE |
3572             R92C_SYS_ISO_CTRL_PD2CORE |
3573             R92C_SYS_ISO_CTRL_IP2MAC |
3574             R92C_SYS_ISO_CTRL_DIOP |
3575             R92C_SYS_ISO_CTRL_DIOE);
3576
3577         /*
3578          * Pull GPIO PIN to balance level and LED control
3579          */
3580         /* 1. Disable GPIO[7:0] */
3581         urtwn_write_2(sc, R92C_GPIO_IOSEL, 0x0000);
3582
3583         reg = urtwn_read_4(sc, R92C_GPIO_PIN_CTRL) & ~0x0000ff00;
3584         reg |= ((reg << 8) & 0x0000ff00) | 0x00ff0000;
3585         urtwn_write_4(sc, R92C_GPIO_PIN_CTRL, reg);
3586
3587         /* Disable GPIO[10:8] */
3588         urtwn_write_1(sc, R92C_MAC_PINMUX_CFG, 0x00);
3589
3590         reg = urtwn_read_2(sc, R92C_GPIO_IO_SEL) & ~0x00f0;
3591         reg |= (((reg & 0x000f) << 4) | 0x0780);
3592         urtwn_write_2(sc, R92C_GPIO_IO_SEL, reg);
3593
3594         /* Disable LED0 & 1 */
3595         urtwn_write_2(sc, R92C_LEDCFG0, 0x8080);
3596
3597         /*
3598          * Reset digital sequence
3599          */
3600         /* Disable ELDR clock */
3601         urtwn_write_2(sc, R92C_SYS_CLKR,
3602             R92C_SYS_CLKR_ANAD16V_EN |
3603             R92C_SYS_CLKR_ANA8M |
3604             R92C_SYS_CLKR_LOADER_EN |
3605             R92C_SYS_CLKR_80M_SSC_DIS |
3606             R92C_SYS_CLKR_SYS_EN |
3607             R92C_SYS_CLKR_RING_EN |
3608             0x4000);
3609
3610         /* Isolated ELDR to PON */
3611         urtwn_write_1(sc, R92C_SYS_ISO_CTRL + 1,
3612             (R92C_SYS_ISO_CTRL_DIOR |
3613              R92C_SYS_ISO_CTRL_PWC_EV12V) >> 8);
3614
3615         /*
3616          * Disable analog sequence
3617          */
3618         /* Disable A15 power */
3619         urtwn_write_1(sc, R92C_LDOA15_CTRL, R92C_LDOA15_CTRL_OBUF);
3620         /* Disable digital core power */
3621         urtwn_write_1(sc, R92C_LDOV12D_CTRL,
3622             urtwn_read_1(sc, R92C_LDOV12D_CTRL) &
3623               ~R92C_LDOV12D_CTRL_LDV12_EN);
3624
3625         /* Enter PFM mode */
3626         urtwn_write_1(sc, R92C_SPS0_CTRL, 0x23);
3627
3628         /* Set USB suspend */
3629         urtwn_write_2(sc, R92C_APS_FSMCO,
3630             R92C_APS_FSMCO_APDM_HOST |
3631             R92C_APS_FSMCO_AFSM_HSUS |
3632             R92C_APS_FSMCO_PFM_ALDN);
3633
3634         /* Lock ISO/CLK/Power control register. */
3635         urtwn_write_1(sc, R92C_RSV_CTRL, 0x0E);
3636 }
3637
3638 static void
3639 urtwn_r88e_power_off(struct urtwn_softc *sc)
3640 {
3641         uint8_t reg;
3642         int ntries;
3643
3644         /* Disable any kind of TX reports. */
3645         urtwn_write_1(sc, R88E_TX_RPT_CTRL,
3646             urtwn_read_1(sc, R88E_TX_RPT_CTRL) &
3647               ~(R88E_TX_RPT1_ENA | R88E_TX_RPT2_ENA));
3648
3649         /* Stop Rx. */
3650         urtwn_write_1(sc, R92C_CR, 0);
3651
3652         /* Move card to Low Power State. */
3653         /* Block all Tx queues. */
3654         urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
3655
3656         for (ntries = 0; ntries < 20; ntries++) {
3657                 /* Should be zero if no packet is transmitting. */
3658                 if (urtwn_read_4(sc, R88E_SCH_TXCMD) == 0)
3659                         break;
3660
3661                 urtwn_ms_delay(sc);
3662         }
3663         if (ntries == 20) {
3664                 device_printf(sc->sc_dev, "%s: failed to block Tx queues\n",
3665                     __func__);
3666                 return;
3667         }
3668
3669         /* CCK and OFDM are disabled, and clock are gated. */
3670         urtwn_write_1(sc, R92C_SYS_FUNC_EN,
3671             urtwn_read_1(sc, R92C_SYS_FUNC_EN) & ~R92C_SYS_FUNC_EN_BBRSTB);
3672
3673         urtwn_ms_delay(sc);
3674
3675         /* Reset MAC TRX */
3676         urtwn_write_1(sc, R92C_CR,
3677             R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3678             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN |
3679             R92C_CR_PROTOCOL_EN | R92C_CR_SCHEDULE_EN);
3680
3681         /* check if removed later */
3682         urtwn_write_1(sc, R92C_CR + 1,
3683             urtwn_read_1(sc, R92C_CR + 1) & ~(R92C_CR_ENSEC >> 8));
3684
3685         /* Respond TxOK to scheduler */
3686         urtwn_write_1(sc, R92C_DUAL_TSF_RST,
3687             urtwn_read_1(sc, R92C_DUAL_TSF_RST) | 0x20);
3688
3689         /* If firmware in ram code, do reset. */
3690 #ifndef URTWN_WITHOUT_UCODE
3691         if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RDY)
3692                 urtwn_r88e_fw_reset(sc);
3693 #endif
3694
3695         /* Reset MCU ready status. */
3696         urtwn_write_1(sc, R92C_MCUFWDL, 0x00);
3697
3698         /* Disable 32k. */
3699         urtwn_write_1(sc, R88E_32K_CTRL,
3700             urtwn_read_1(sc, R88E_32K_CTRL) & ~0x01);
3701
3702         /* Move card to Disabled state. */
3703         /* Turn off RF. */
3704         urtwn_write_1(sc, R92C_RF_CTRL, 0);
3705
3706         /* LDO Sleep mode. */
3707         urtwn_write_1(sc, R92C_LPLDO_CTRL,
3708             urtwn_read_1(sc, R92C_LPLDO_CTRL) | R92C_LPLDO_CTRL_SLEEP);
3709
3710         /* Turn off MAC by HW state machine */
3711         urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3712             urtwn_read_1(sc, R92C_APS_FSMCO + 1) |
3713             (R92C_APS_FSMCO_APFM_OFF >> 8));
3714
3715         for (ntries = 0; ntries < 20; ntries++) {
3716                 /* Wait until it will be disabled. */
3717                 if ((urtwn_read_1(sc, R92C_APS_FSMCO + 1) &
3718                     (R92C_APS_FSMCO_APFM_OFF >> 8)) == 0)
3719                         break;
3720
3721                 urtwn_ms_delay(sc);
3722         }
3723         if (ntries == 20) {
3724                 device_printf(sc->sc_dev, "%s: could not turn off MAC\n",
3725                     __func__);
3726                 return;
3727         }
3728
3729         /* schmit trigger */
3730         urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 2,
3731             urtwn_read_1(sc, R92C_AFE_XTAL_CTRL + 2) | 0x80);
3732
3733         /* Enable WL suspend. */
3734         urtwn_write_1(sc, R92C_APS_FSMCO + 1,
3735             (urtwn_read_1(sc, R92C_APS_FSMCO + 1) & ~0x10) | 0x08);
3736
3737         /* Enable bandgap mbias in suspend. */
3738         urtwn_write_1(sc, R92C_APS_FSMCO + 3, 0);
3739
3740         /* Clear SIC_EN register. */
3741         urtwn_write_1(sc, R92C_GPIO_MUXCFG + 1,
3742             urtwn_read_1(sc, R92C_GPIO_MUXCFG + 1) & ~0x10);
3743
3744         /* Set USB suspend enable local register */
3745         urtwn_write_1(sc, R92C_USB_SUSPEND,
3746             urtwn_read_1(sc, R92C_USB_SUSPEND) | 0x10);
3747
3748         /* Reset MCU IO Wrapper. */
3749         reg = urtwn_read_1(sc, R92C_RSV_CTRL + 1);
3750         urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg & ~0x08);
3751         urtwn_write_1(sc, R92C_RSV_CTRL + 1, reg | 0x08);
3752
3753         /* marked as 'For Power Consumption' code. */
3754         urtwn_write_1(sc, R92C_GPIO_OUT, urtwn_read_1(sc, R92C_GPIO_IN));
3755         urtwn_write_1(sc, R92C_GPIO_IOSEL, 0xff);
3756
3757         urtwn_write_1(sc, R92C_GPIO_IO_SEL,
3758             urtwn_read_1(sc, R92C_GPIO_IO_SEL) << 4);
3759         urtwn_write_1(sc, R92C_GPIO_MOD,
3760             urtwn_read_1(sc, R92C_GPIO_MOD) | 0x0f);
3761
3762         /* Set LNA, TRSW, EX_PA Pin to output mode. */
3763         urtwn_write_4(sc, R88E_BB_PAD_CTRL, 0x00080808);
3764 }
3765
3766 static int
3767 urtwn_llt_init(struct urtwn_softc *sc)
3768 {
3769         int i, error, page_count, pktbuf_count;
3770
3771         page_count = (sc->chip & URTWN_CHIP_88E) ?
3772             R88E_TX_PAGE_COUNT : R92C_TX_PAGE_COUNT;
3773         pktbuf_count = (sc->chip & URTWN_CHIP_88E) ?
3774             R88E_TXPKTBUF_COUNT : R92C_TXPKTBUF_COUNT;
3775
3776         /* Reserve pages [0; page_count]. */
3777         for (i = 0; i < page_count; i++) {
3778                 if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3779                         return (error);
3780         }
3781         /* NB: 0xff indicates end-of-list. */
3782         if ((error = urtwn_llt_write(sc, i, 0xff)) != 0)
3783                 return (error);
3784         /*
3785          * Use pages [page_count + 1; pktbuf_count - 1]
3786          * as ring buffer.
3787          */
3788         for (++i; i < pktbuf_count - 1; i++) {
3789                 if ((error = urtwn_llt_write(sc, i, i + 1)) != 0)
3790                         return (error);
3791         }
3792         /* Make the last page point to the beginning of the ring buffer. */
3793         error = urtwn_llt_write(sc, i, page_count + 1);
3794         return (error);
3795 }
3796
3797 #ifndef URTWN_WITHOUT_UCODE
3798 static void
3799 urtwn_fw_reset(struct urtwn_softc *sc)
3800 {
3801         uint16_t reg;
3802         int ntries;
3803
3804         /* Tell 8051 to reset itself. */
3805         urtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
3806
3807         /* Wait until 8051 resets by itself. */
3808         for (ntries = 0; ntries < 100; ntries++) {
3809                 reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3810                 if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
3811                         return;
3812                 urtwn_ms_delay(sc);
3813         }
3814         /* Force 8051 reset. */
3815         urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3816 }
3817
3818 static void
3819 urtwn_r88e_fw_reset(struct urtwn_softc *sc)
3820 {
3821         uint16_t reg;
3822
3823         reg = urtwn_read_2(sc, R92C_SYS_FUNC_EN);
3824         urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
3825         urtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
3826 }
3827
3828 static int
3829 urtwn_fw_loadpage(struct urtwn_softc *sc, int page, const uint8_t *buf, int len)
3830 {
3831         uint32_t reg;
3832         usb_error_t error = USB_ERR_NORMAL_COMPLETION;
3833         int off, mlen;
3834
3835         reg = urtwn_read_4(sc, R92C_MCUFWDL);
3836         reg = RW(reg, R92C_MCUFWDL_PAGE, page);
3837         urtwn_write_4(sc, R92C_MCUFWDL, reg);
3838
3839         off = R92C_FW_START_ADDR;
3840         while (len > 0) {
3841                 if (len > 196)
3842                         mlen = 196;
3843                 else if (len > 4)
3844                         mlen = 4;
3845                 else
3846                         mlen = 1;
3847                 /* XXX fix this deconst */
3848                 error = urtwn_write_region_1(sc, off,
3849                     __DECONST(uint8_t *, buf), mlen);
3850                 if (error != USB_ERR_NORMAL_COMPLETION)
3851                         break;
3852                 off += mlen;
3853                 buf += mlen;
3854                 len -= mlen;
3855         }
3856         return (error);
3857 }
3858
3859 static int
3860 urtwn_load_firmware(struct urtwn_softc *sc)
3861 {
3862         const struct firmware *fw;
3863         const struct r92c_fw_hdr *hdr;
3864         const char *imagename;
3865         const u_char *ptr;
3866         size_t len;
3867         uint32_t reg;
3868         int mlen, ntries, page, error;
3869
3870         URTWN_UNLOCK(sc);
3871         /* Read firmware image from the filesystem. */
3872         if (sc->chip & URTWN_CHIP_88E)
3873                 imagename = "urtwn-rtl8188eufw";
3874         else if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
3875                     URTWN_CHIP_UMC_A_CUT)
3876                 imagename = "urtwn-rtl8192cfwU";
3877         else
3878                 imagename = "urtwn-rtl8192cfwT";
3879
3880         fw = firmware_get(imagename);
3881         URTWN_LOCK(sc);
3882         if (fw == NULL) {
3883                 device_printf(sc->sc_dev,
3884                     "failed loadfirmware of file %s\n", imagename);
3885                 return (ENOENT);
3886         }
3887
3888         len = fw->datasize;
3889
3890         if (len < sizeof(*hdr)) {
3891                 device_printf(sc->sc_dev, "firmware too short\n");
3892                 error = EINVAL;
3893                 goto fail;
3894         }
3895         ptr = fw->data;
3896         hdr = (const struct r92c_fw_hdr *)ptr;
3897         /* Check if there is a valid FW header and skip it. */
3898         if ((le16toh(hdr->signature) >> 4) == 0x88c ||
3899             (le16toh(hdr->signature) >> 4) == 0x88e ||
3900             (le16toh(hdr->signature) >> 4) == 0x92c) {
3901                 URTWN_DPRINTF(sc, URTWN_DEBUG_FIRMWARE,
3902                     "FW V%d.%d %02d-%02d %02d:%02d\n",
3903                     le16toh(hdr->version), le16toh(hdr->subversion),
3904                     hdr->month, hdr->date, hdr->hour, hdr->minute);
3905                 ptr += sizeof(*hdr);
3906                 len -= sizeof(*hdr);
3907         }
3908
3909         if (urtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
3910                 if (sc->chip & URTWN_CHIP_88E)
3911                         urtwn_r88e_fw_reset(sc);
3912                 else
3913                         urtwn_fw_reset(sc);
3914                 urtwn_write_1(sc, R92C_MCUFWDL, 0);
3915         }
3916
3917         if (!(sc->chip & URTWN_CHIP_88E)) {
3918                 urtwn_write_2(sc, R92C_SYS_FUNC_EN,
3919                     urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
3920                     R92C_SYS_FUNC_EN_CPUEN);
3921         }
3922         urtwn_write_1(sc, R92C_MCUFWDL,
3923             urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
3924         urtwn_write_1(sc, R92C_MCUFWDL + 2,
3925             urtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
3926
3927         /* Reset the FWDL checksum. */
3928         urtwn_write_1(sc, R92C_MCUFWDL,
3929             urtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
3930
3931         for (page = 0; len > 0; page++) {
3932                 mlen = min(len, R92C_FW_PAGE_SIZE);
3933                 error = urtwn_fw_loadpage(sc, page, ptr, mlen);
3934                 if (error != 0) {
3935                         device_printf(sc->sc_dev,
3936                             "could not load firmware page\n");
3937                         goto fail;
3938                 }
3939                 ptr += mlen;
3940                 len -= mlen;
3941         }
3942         urtwn_write_1(sc, R92C_MCUFWDL,
3943             urtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
3944         urtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
3945
3946         /* Wait for checksum report. */
3947         for (ntries = 0; ntries < 1000; ntries++) {
3948                 if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
3949                         break;
3950                 urtwn_ms_delay(sc);
3951         }
3952         if (ntries == 1000) {
3953                 device_printf(sc->sc_dev,
3954                     "timeout waiting for checksum report\n");
3955                 error = ETIMEDOUT;
3956                 goto fail;
3957         }
3958
3959         reg = urtwn_read_4(sc, R92C_MCUFWDL);
3960         reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
3961         urtwn_write_4(sc, R92C_MCUFWDL, reg);
3962         if (sc->chip & URTWN_CHIP_88E)
3963                 urtwn_r88e_fw_reset(sc);
3964         /* Wait for firmware readiness. */
3965         for (ntries = 0; ntries < 1000; ntries++) {
3966                 if (urtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
3967                         break;
3968                 urtwn_ms_delay(sc);
3969         }
3970         if (ntries == 1000) {
3971                 device_printf(sc->sc_dev,
3972                     "timeout waiting for firmware readiness\n");
3973                 error = ETIMEDOUT;
3974                 goto fail;
3975         }
3976 fail:
3977         firmware_put(fw, FIRMWARE_UNLOAD);
3978         return (error);
3979 }
3980 #endif
3981
3982 static int
3983 urtwn_dma_init(struct urtwn_softc *sc)
3984 {
3985         struct usb_endpoint *ep, *ep_end;
3986         usb_error_t usb_err;
3987         uint32_t reg;
3988         int hashq, hasnq, haslq, nqueues, ntx;
3989         int error, pagecount, npubqpages, nqpages, nrempages, tx_boundary;
3990
3991         /* Initialize LLT table. */
3992         error = urtwn_llt_init(sc);
3993         if (error != 0)
3994                 return (error);
3995
3996         /* Determine the number of bulk-out pipes. */
3997         ntx = 0;
3998         ep = sc->sc_udev->endpoints;
3999         ep_end = sc->sc_udev->endpoints + sc->sc_udev->endpoints_max;
4000         for (; ep != ep_end; ep++) {
4001                 if ((ep->edesc == NULL) ||
4002                     (ep->iface_index != sc->sc_iface_index))
4003                         continue;
4004                 if (UE_GET_DIR(ep->edesc->bEndpointAddress) == UE_DIR_OUT)
4005                         ntx++;
4006         }
4007         if (ntx == 0) {
4008                 device_printf(sc->sc_dev,
4009                     "%d: invalid number of Tx bulk pipes\n", ntx);
4010                 return (EIO);
4011         }
4012
4013         /* Get Tx queues to USB endpoints mapping. */
4014         hashq = hasnq = haslq = nqueues = 0;
4015         switch (ntx) {
4016         case 1: hashq = 1; break;
4017         case 2: hashq = hasnq = 1; break;
4018         case 3: case 4: hashq = hasnq = haslq = 1; break;
4019         }
4020         nqueues = hashq + hasnq + haslq;
4021         if (nqueues == 0)
4022                 return (EIO);
4023
4024         npubqpages = nqpages = nrempages = pagecount = 0;
4025         if (sc->chip & URTWN_CHIP_88E)
4026                 tx_boundary = R88E_TX_PAGE_BOUNDARY;
4027         else {
4028                 pagecount = R92C_TX_PAGE_COUNT;
4029                 npubqpages = R92C_PUBQ_NPAGES;
4030                 tx_boundary = R92C_TX_PAGE_BOUNDARY;
4031         }
4032
4033         /* Set number of pages for normal priority queue. */
4034         if (sc->chip & URTWN_CHIP_88E) {
4035                 usb_err = urtwn_write_2(sc, R92C_RQPN_NPQ, 0xd);
4036                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
4037                         return (EIO);
4038                 usb_err = urtwn_write_4(sc, R92C_RQPN, 0x808e000d);
4039                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
4040                         return (EIO);
4041         } else {
4042                 /* Get the number of pages for each queue. */
4043                 nqpages = (pagecount - npubqpages) / nqueues;
4044                 /*
4045                  * The remaining pages are assigned to the high priority
4046                  * queue.
4047                  */
4048                 nrempages = (pagecount - npubqpages) % nqueues;
4049                 usb_err = urtwn_write_1(sc, R92C_RQPN_NPQ, hasnq ? nqpages : 0);
4050                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
4051                         return (EIO);
4052                 usb_err = urtwn_write_4(sc, R92C_RQPN,
4053                     /* Set number of pages for public queue. */
4054                     SM(R92C_RQPN_PUBQ, npubqpages) |
4055                     /* Set number of pages for high priority queue. */
4056                     SM(R92C_RQPN_HPQ, hashq ? nqpages + nrempages : 0) |
4057                     /* Set number of pages for low priority queue. */
4058                     SM(R92C_RQPN_LPQ, haslq ? nqpages : 0) |
4059                     /* Load values. */
4060                     R92C_RQPN_LD);
4061                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
4062                         return (EIO);
4063         }
4064
4065         usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, tx_boundary);
4066         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4067                 return (EIO);
4068         usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, tx_boundary);
4069         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4070                 return (EIO);
4071         usb_err = urtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, tx_boundary);
4072         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4073                 return (EIO);
4074         usb_err = urtwn_write_1(sc, R92C_TRXFF_BNDY, tx_boundary);
4075         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4076                 return (EIO);
4077         usb_err = urtwn_write_1(sc, R92C_TDECTRL + 1, tx_boundary);
4078         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4079                 return (EIO);
4080
4081         /* Set queue to USB pipe mapping. */
4082         reg = urtwn_read_2(sc, R92C_TRXDMA_CTRL);
4083         reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
4084         if (nqueues == 1) {
4085                 if (hashq)
4086                         reg |= R92C_TRXDMA_CTRL_QMAP_HQ;
4087                 else if (hasnq)
4088                         reg |= R92C_TRXDMA_CTRL_QMAP_NQ;
4089                 else
4090                         reg |= R92C_TRXDMA_CTRL_QMAP_LQ;
4091         } else if (nqueues == 2) {
4092                 /*
4093                  * All 2-endpoints configs have high and normal
4094                  * priority queues.
4095                  */
4096                 reg |= R92C_TRXDMA_CTRL_QMAP_HQ_NQ;
4097         } else
4098                 reg |= R92C_TRXDMA_CTRL_QMAP_3EP;
4099         usb_err = urtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
4100         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4101                 return (EIO);
4102
4103         /* Set Tx/Rx transfer page boundary. */
4104         usb_err = urtwn_write_2(sc, R92C_TRXFF_BNDY + 2,
4105             (sc->chip & URTWN_CHIP_88E) ? 0x23ff : 0x27ff);
4106         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4107                 return (EIO);
4108
4109         /* Set Tx/Rx transfer page size. */
4110         usb_err = urtwn_write_1(sc, R92C_PBP,
4111             SM(R92C_PBP_PSRX, R92C_PBP_128) |
4112             SM(R92C_PBP_PSTX, R92C_PBP_128));
4113         if (usb_err != USB_ERR_NORMAL_COMPLETION)
4114                 return (EIO);
4115
4116         return (0);
4117 }
4118
4119 static int
4120 urtwn_mac_init(struct urtwn_softc *sc)
4121 {
4122         usb_error_t error;
4123         int i;
4124
4125         /* Write MAC initialization values. */
4126         if (sc->chip & URTWN_CHIP_88E) {
4127                 for (i = 0; i < nitems(rtl8188eu_mac); i++) {
4128                         error = urtwn_write_1(sc, rtl8188eu_mac[i].reg,
4129                             rtl8188eu_mac[i].val);
4130                         if (error != USB_ERR_NORMAL_COMPLETION)
4131                                 return (EIO);
4132                 }
4133                 urtwn_write_1(sc, R92C_MAX_AGGR_NUM, 0x07);
4134         } else {
4135                 for (i = 0; i < nitems(rtl8192cu_mac); i++)
4136                         error = urtwn_write_1(sc, rtl8192cu_mac[i].reg,
4137                             rtl8192cu_mac[i].val);
4138                         if (error != USB_ERR_NORMAL_COMPLETION)
4139                                 return (EIO);
4140         }
4141
4142         return (0);
4143 }
4144
4145 static void
4146 urtwn_bb_init(struct urtwn_softc *sc)
4147 {
4148         const struct urtwn_bb_prog *prog;
4149         uint32_t reg;
4150         uint8_t crystalcap;
4151         int i;
4152
4153         /* Enable BB and RF. */
4154         urtwn_write_2(sc, R92C_SYS_FUNC_EN,
4155             urtwn_read_2(sc, R92C_SYS_FUNC_EN) |
4156             R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
4157             R92C_SYS_FUNC_EN_DIO_RF);
4158
4159         if (!(sc->chip & URTWN_CHIP_88E))
4160                 urtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
4161
4162         urtwn_write_1(sc, R92C_RF_CTRL,
4163             R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
4164         urtwn_write_1(sc, R92C_SYS_FUNC_EN,
4165             R92C_SYS_FUNC_EN_USBA | R92C_SYS_FUNC_EN_USBD |
4166             R92C_SYS_FUNC_EN_BB_GLB_RST | R92C_SYS_FUNC_EN_BBRSTB);
4167
4168         if (!(sc->chip & URTWN_CHIP_88E)) {
4169                 urtwn_write_1(sc, R92C_LDOHCI12_CTRL, 0x0f);
4170                 urtwn_write_1(sc, 0x15, 0xe9);
4171                 urtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
4172         }
4173
4174         /* Select BB programming based on board type. */
4175         if (sc->chip & URTWN_CHIP_88E)
4176                 prog = &rtl8188eu_bb_prog;
4177         else if (!(sc->chip & URTWN_CHIP_92C)) {
4178                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4179                         prog = &rtl8188ce_bb_prog;
4180                 else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4181                         prog = &rtl8188ru_bb_prog;
4182                 else
4183                         prog = &rtl8188cu_bb_prog;
4184         } else {
4185                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4186                         prog = &rtl8192ce_bb_prog;
4187                 else
4188                         prog = &rtl8192cu_bb_prog;
4189         }
4190         /* Write BB initialization values. */
4191         for (i = 0; i < prog->count; i++) {
4192                 urtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
4193                 urtwn_ms_delay(sc);
4194         }
4195
4196         if (sc->chip & URTWN_CHIP_92C_1T2R) {
4197                 /* 8192C 1T only configuration. */
4198                 reg = urtwn_bb_read(sc, R92C_FPGA0_TXINFO);
4199                 reg = (reg & ~0x00000003) | 0x2;
4200                 urtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
4201
4202                 reg = urtwn_bb_read(sc, R92C_FPGA1_TXINFO);
4203                 reg = (reg & ~0x00300033) | 0x00200022;
4204                 urtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
4205
4206                 reg = urtwn_bb_read(sc, R92C_CCK0_AFESETTING);
4207                 reg = (reg & ~0xff000000) | 0x45 << 24;
4208                 urtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
4209
4210                 reg = urtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
4211                 reg = (reg & ~0x000000ff) | 0x23;
4212                 urtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
4213
4214                 reg = urtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
4215                 reg = (reg & ~0x00000030) | 1 << 4;
4216                 urtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
4217
4218                 reg = urtwn_bb_read(sc, 0xe74);
4219                 reg = (reg & ~0x0c000000) | 2 << 26;
4220                 urtwn_bb_write(sc, 0xe74, reg);
4221                 reg = urtwn_bb_read(sc, 0xe78);
4222                 reg = (reg & ~0x0c000000) | 2 << 26;
4223                 urtwn_bb_write(sc, 0xe78, reg);
4224                 reg = urtwn_bb_read(sc, 0xe7c);
4225                 reg = (reg & ~0x0c000000) | 2 << 26;
4226                 urtwn_bb_write(sc, 0xe7c, reg);
4227                 reg = urtwn_bb_read(sc, 0xe80);
4228                 reg = (reg & ~0x0c000000) | 2 << 26;
4229                 urtwn_bb_write(sc, 0xe80, reg);
4230                 reg = urtwn_bb_read(sc, 0xe88);
4231                 reg = (reg & ~0x0c000000) | 2 << 26;
4232                 urtwn_bb_write(sc, 0xe88, reg);
4233         }
4234
4235         /* Write AGC values. */
4236         for (i = 0; i < prog->agccount; i++) {
4237                 urtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
4238                     prog->agcvals[i]);
4239                 urtwn_ms_delay(sc);
4240         }
4241
4242         if (sc->chip & URTWN_CHIP_88E) {
4243                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553422);
4244                 urtwn_ms_delay(sc);
4245                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), 0x69553420);
4246                 urtwn_ms_delay(sc);
4247
4248                 crystalcap = sc->rom.r88e_rom.crystalcap;
4249                 if (crystalcap == 0xff)
4250                         crystalcap = 0x20;
4251                 crystalcap &= 0x3f;
4252                 reg = urtwn_bb_read(sc, R92C_AFE_XTAL_CTRL);
4253                 urtwn_bb_write(sc, R92C_AFE_XTAL_CTRL,
4254                     RW(reg, R92C_AFE_XTAL_CTRL_ADDR,
4255                     crystalcap | crystalcap << 6));
4256         } else {
4257                 if (urtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
4258                     R92C_HSSI_PARAM2_CCK_HIPWR)
4259                         sc->sc_flags |= URTWN_FLAG_CCK_HIPWR;
4260         }
4261 }
4262
4263 static void
4264 urtwn_rf_init(struct urtwn_softc *sc)
4265 {
4266         const struct urtwn_rf_prog *prog;
4267         uint32_t reg, type;
4268         int i, j, idx, off;
4269
4270         /* Select RF programming based on board type. */
4271         if (sc->chip & URTWN_CHIP_88E)
4272                 prog = rtl8188eu_rf_prog;
4273         else if (!(sc->chip & URTWN_CHIP_92C)) {
4274                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
4275                         prog = rtl8188ce_rf_prog;
4276                 else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4277                         prog = rtl8188ru_rf_prog;
4278                 else
4279                         prog = rtl8188cu_rf_prog;
4280         } else
4281                 prog = rtl8192ce_rf_prog;
4282
4283         for (i = 0; i < sc->nrxchains; i++) {
4284                 /* Save RF_ENV control type. */
4285                 idx = i / 2;
4286                 off = (i % 2) * 16;
4287                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4288                 type = (reg >> off) & 0x10;
4289
4290                 /* Set RF_ENV enable. */
4291                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4292                 reg |= 0x100000;
4293                 urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4294                 urtwn_ms_delay(sc);
4295                 /* Set RF_ENV output high. */
4296                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
4297                 reg |= 0x10;
4298                 urtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
4299                 urtwn_ms_delay(sc);
4300                 /* Set address and data lengths of RF registers. */
4301                 reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4302                 reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
4303                 urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4304                 urtwn_ms_delay(sc);
4305                 reg = urtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
4306                 reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
4307                 urtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
4308                 urtwn_ms_delay(sc);
4309
4310                 /* Write RF initialization values for this chain. */
4311                 for (j = 0; j < prog[i].count; j++) {
4312                         if (prog[i].regs[j] >= 0xf9 &&
4313                             prog[i].regs[j] <= 0xfe) {
4314                                 /*
4315                                  * These are fake RF registers offsets that
4316                                  * indicate a delay is required.
4317                                  */
4318                                 usb_pause_mtx(&sc->sc_mtx, hz / 20);    /* 50ms */
4319                                 continue;
4320                         }
4321                         urtwn_rf_write(sc, i, prog[i].regs[j],
4322                             prog[i].vals[j]);
4323                         urtwn_ms_delay(sc);
4324                 }
4325
4326                 /* Restore RF_ENV control type. */
4327                 reg = urtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
4328                 reg &= ~(0x10 << off) | (type << off);
4329                 urtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
4330
4331                 /* Cache RF register CHNLBW. */
4332                 sc->rf_chnlbw[i] = urtwn_rf_read(sc, i, R92C_RF_CHNLBW);
4333         }
4334
4335         if ((sc->chip & (URTWN_CHIP_UMC_A_CUT | URTWN_CHIP_92C)) ==
4336             URTWN_CHIP_UMC_A_CUT) {
4337                 urtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
4338                 urtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
4339         }
4340 }
4341
4342 static void
4343 urtwn_cam_init(struct urtwn_softc *sc)
4344 {
4345         /* Invalidate all CAM entries. */
4346         urtwn_write_4(sc, R92C_CAMCMD,
4347             R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
4348 }
4349
4350 static int
4351 urtwn_cam_write(struct urtwn_softc *sc, uint32_t addr, uint32_t data)
4352 {
4353         usb_error_t error;
4354
4355         error = urtwn_write_4(sc, R92C_CAMWRITE, data);
4356         if (error != USB_ERR_NORMAL_COMPLETION)
4357                 return (EIO);
4358         error = urtwn_write_4(sc, R92C_CAMCMD,
4359             R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
4360             SM(R92C_CAMCMD_ADDR, addr));
4361         if (error != USB_ERR_NORMAL_COMPLETION)
4362                 return (EIO);
4363
4364         return (0);
4365 }
4366
4367 static void
4368 urtwn_pa_bias_init(struct urtwn_softc *sc)
4369 {
4370         uint8_t reg;
4371         int i;
4372
4373         for (i = 0; i < sc->nrxchains; i++) {
4374                 if (sc->pa_setting & (1 << i))
4375                         continue;
4376                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
4377                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
4378                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
4379                 urtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
4380         }
4381         if (!(sc->pa_setting & 0x10)) {
4382                 reg = urtwn_read_1(sc, 0x16);
4383                 reg = (reg & ~0xf0) | 0x90;
4384                 urtwn_write_1(sc, 0x16, reg);
4385         }
4386 }
4387
4388 static void
4389 urtwn_rxfilter_init(struct urtwn_softc *sc)
4390 {
4391         struct ieee80211com *ic = &sc->sc_ic;
4392         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4393         uint32_t rcr;
4394         uint16_t filter;
4395
4396         URTWN_ASSERT_LOCKED(sc);
4397
4398         /* Setup multicast filter. */
4399         urtwn_set_multi(sc);
4400
4401         /* Filter for management frames. */
4402         filter = 0x7f3f;
4403         switch (vap->iv_opmode) {
4404         case IEEE80211_M_STA:
4405                 filter &= ~(
4406                     R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_REQ) |
4407                     R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_REQ) |
4408                     R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_PROBE_REQ));
4409                 break;
4410         case IEEE80211_M_HOSTAP:
4411                 filter &= ~(
4412                     R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_ASSOC_RESP) |
4413                     R92C_RXFLTMAP_SUBTYPE(IEEE80211_FC0_SUBTYPE_REASSOC_RESP));
4414                 break;
4415         case IEEE80211_M_MONITOR:
4416         case IEEE80211_M_IBSS:
4417                 break;
4418         default:
4419                 device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4420                     __func__, vap->iv_opmode);
4421                 break;
4422         }
4423         urtwn_write_2(sc, R92C_RXFLTMAP0, filter);
4424
4425         /* Reject all control frames. */
4426         urtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
4427
4428         /* Reject all data frames. */
4429         urtwn_write_2(sc, R92C_RXFLTMAP2, 0x0000);
4430
4431         rcr = R92C_RCR_AM | R92C_RCR_AB | R92C_RCR_APM |
4432               R92C_RCR_HTC_LOC_CTRL | R92C_RCR_APP_PHYSTS |
4433               R92C_RCR_APP_ICV | R92C_RCR_APP_MIC;
4434
4435         if (vap->iv_opmode == IEEE80211_M_MONITOR) {
4436                 /* Accept all frames. */
4437                 rcr |= R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF |
4438                        R92C_RCR_AAP;
4439         }
4440
4441         /* Set Rx filter. */
4442         urtwn_write_4(sc, R92C_RCR, rcr);
4443
4444         if (ic->ic_promisc != 0) {
4445                 /* Update Rx filter. */
4446                 urtwn_set_promisc(sc);
4447         }
4448 }
4449
4450 static void
4451 urtwn_edca_init(struct urtwn_softc *sc)
4452 {
4453         urtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
4454         urtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
4455         urtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
4456         urtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
4457         urtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
4458         urtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
4459         urtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
4460         urtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
4461 }
4462
4463 static void
4464 urtwn_write_txpower(struct urtwn_softc *sc, int chain,
4465     uint16_t power[URTWN_RIDX_COUNT])
4466 {
4467         uint32_t reg;
4468
4469         /* Write per-CCK rate Tx power. */
4470         if (chain == 0) {
4471                 reg = urtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
4472                 reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
4473                 urtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
4474                 reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4475                 reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
4476                 reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
4477                 reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
4478                 urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4479         } else {
4480                 reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
4481                 reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
4482                 reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
4483                 reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
4484                 urtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
4485                 reg = urtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
4486                 reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
4487                 urtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
4488         }
4489         /* Write per-OFDM rate Tx power. */
4490         urtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
4491             SM(R92C_TXAGC_RATE06, power[ 4]) |
4492             SM(R92C_TXAGC_RATE09, power[ 5]) |
4493             SM(R92C_TXAGC_RATE12, power[ 6]) |
4494             SM(R92C_TXAGC_RATE18, power[ 7]));
4495         urtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
4496             SM(R92C_TXAGC_RATE24, power[ 8]) |
4497             SM(R92C_TXAGC_RATE36, power[ 9]) |
4498             SM(R92C_TXAGC_RATE48, power[10]) |
4499             SM(R92C_TXAGC_RATE54, power[11]));
4500         /* Write per-MCS Tx power. */
4501         urtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
4502             SM(R92C_TXAGC_MCS00,  power[12]) |
4503             SM(R92C_TXAGC_MCS01,  power[13]) |
4504             SM(R92C_TXAGC_MCS02,  power[14]) |
4505             SM(R92C_TXAGC_MCS03,  power[15]));
4506         urtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
4507             SM(R92C_TXAGC_MCS04,  power[16]) |
4508             SM(R92C_TXAGC_MCS05,  power[17]) |
4509             SM(R92C_TXAGC_MCS06,  power[18]) |
4510             SM(R92C_TXAGC_MCS07,  power[19]));
4511         urtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
4512             SM(R92C_TXAGC_MCS08,  power[20]) |
4513             SM(R92C_TXAGC_MCS09,  power[21]) |
4514             SM(R92C_TXAGC_MCS10,  power[22]) |
4515             SM(R92C_TXAGC_MCS11,  power[23]));
4516         urtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
4517             SM(R92C_TXAGC_MCS12,  power[24]) |
4518             SM(R92C_TXAGC_MCS13,  power[25]) |
4519             SM(R92C_TXAGC_MCS14,  power[26]) |
4520             SM(R92C_TXAGC_MCS15,  power[27]));
4521 }
4522
4523 static void
4524 urtwn_get_txpower(struct urtwn_softc *sc, int chain,
4525     struct ieee80211_channel *c, struct ieee80211_channel *extc,
4526     uint16_t power[URTWN_RIDX_COUNT])
4527 {
4528         struct ieee80211com *ic = &sc->sc_ic;
4529         struct r92c_rom *rom = &sc->rom.r92c_rom;
4530         uint16_t cckpow, ofdmpow, htpow, diff, max;
4531         const struct urtwn_txpwr *base;
4532         int ridx, chan, group;
4533
4534         /* Determine channel group. */
4535         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
4536         if (chan <= 3)
4537                 group = 0;
4538         else if (chan <= 9)
4539                 group = 1;
4540         else
4541                 group = 2;
4542
4543         /* Get original Tx power based on board type and RF chain. */
4544         if (!(sc->chip & URTWN_CHIP_92C)) {
4545                 if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
4546                         base = &rtl8188ru_txagc[chain];
4547                 else
4548                         base = &rtl8192cu_txagc[chain];
4549         } else
4550                 base = &rtl8192cu_txagc[chain];
4551
4552         memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4553         if (sc->regulatory == 0) {
4554                 for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4555                         power[ridx] = base->pwr[0][ridx];
4556         }
4557         for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4558                 if (sc->regulatory == 3) {
4559                         power[ridx] = base->pwr[0][ridx];
4560                         /* Apply vendor limits. */
4561                         if (extc != NULL)
4562                                 max = rom->ht40_max_pwr[group];
4563                         else
4564                                 max = rom->ht20_max_pwr[group];
4565                         max = (max >> (chain * 4)) & 0xf;
4566                         if (power[ridx] > max)
4567                                 power[ridx] = max;
4568                 } else if (sc->regulatory == 1) {
4569                         if (extc == NULL)
4570                                 power[ridx] = base->pwr[group][ridx];
4571                 } else if (sc->regulatory != 2)
4572                         power[ridx] = base->pwr[0][ridx];
4573         }
4574
4575         /* Compute per-CCK rate Tx power. */
4576         cckpow = rom->cck_tx_pwr[chain][group];
4577         for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4578                 power[ridx] += cckpow;
4579                 if (power[ridx] > R92C_MAX_TX_PWR)
4580                         power[ridx] = R92C_MAX_TX_PWR;
4581         }
4582
4583         htpow = rom->ht40_1s_tx_pwr[chain][group];
4584         if (sc->ntxchains > 1) {
4585                 /* Apply reduction for 2 spatial streams. */
4586                 diff = rom->ht40_2s_tx_pwr_diff[group];
4587                 diff = (diff >> (chain * 4)) & 0xf;
4588                 htpow = (htpow > diff) ? htpow - diff : 0;
4589         }
4590
4591         /* Compute per-OFDM rate Tx power. */
4592         diff = rom->ofdm_tx_pwr_diff[group];
4593         diff = (diff >> (chain * 4)) & 0xf;
4594         ofdmpow = htpow + diff; /* HT->OFDM correction. */
4595         for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4596                 power[ridx] += ofdmpow;
4597                 if (power[ridx] > R92C_MAX_TX_PWR)
4598                         power[ridx] = R92C_MAX_TX_PWR;
4599         }
4600
4601         /* Compute per-MCS Tx power. */
4602         if (extc == NULL) {
4603                 diff = rom->ht20_tx_pwr_diff[group];
4604                 diff = (diff >> (chain * 4)) & 0xf;
4605                 htpow += diff;  /* HT40->HT20 correction. */
4606         }
4607         for (ridx = 12; ridx <= 27; ridx++) {
4608                 power[ridx] += htpow;
4609                 if (power[ridx] > R92C_MAX_TX_PWR)
4610                         power[ridx] = R92C_MAX_TX_PWR;
4611         }
4612 #ifdef USB_DEBUG
4613         if (sc->sc_debug & URTWN_DEBUG_TXPWR) {
4614                 /* Dump per-rate Tx power values. */
4615                 printf("Tx power for chain %d:\n", chain);
4616                 for (ridx = URTWN_RIDX_CCK1; ridx < URTWN_RIDX_COUNT; ridx++)
4617                         printf("Rate %d = %u\n", ridx, power[ridx]);
4618         }
4619 #endif
4620 }
4621
4622 static void
4623 urtwn_r88e_get_txpower(struct urtwn_softc *sc, int chain,
4624     struct ieee80211_channel *c, struct ieee80211_channel *extc,
4625     uint16_t power[URTWN_RIDX_COUNT])
4626 {
4627         struct ieee80211com *ic = &sc->sc_ic;
4628         struct r88e_rom *rom = &sc->rom.r88e_rom;
4629         uint16_t cckpow, ofdmpow, bw20pow, htpow;
4630         const struct urtwn_r88e_txpwr *base;
4631         int ridx, chan, group;
4632
4633         /* Determine channel group. */
4634         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
4635         if (chan <= 2)
4636                 group = 0;
4637         else if (chan <= 5)
4638                 group = 1;
4639         else if (chan <= 8)
4640                 group = 2;
4641         else if (chan <= 11)
4642                 group = 3;
4643         else if (chan <= 13)
4644                 group = 4;
4645         else
4646                 group = 5;
4647
4648         /* Get original Tx power based on board type and RF chain. */
4649         base = &rtl8188eu_txagc[chain];
4650
4651         memset(power, 0, URTWN_RIDX_COUNT * sizeof(power[0]));
4652         if (sc->regulatory == 0) {
4653                 for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++)
4654                         power[ridx] = base->pwr[0][ridx];
4655         }
4656         for (ridx = URTWN_RIDX_OFDM6; ridx < URTWN_RIDX_COUNT; ridx++) {
4657                 if (sc->regulatory == 3)
4658                         power[ridx] = base->pwr[0][ridx];
4659                 else if (sc->regulatory == 1) {
4660                         if (extc == NULL)
4661                                 power[ridx] = base->pwr[group][ridx];
4662                 } else if (sc->regulatory != 2)
4663                         power[ridx] = base->pwr[0][ridx];
4664         }
4665
4666         /* Compute per-CCK rate Tx power. */
4667         cckpow = rom->cck_tx_pwr[group];
4668         for (ridx = URTWN_RIDX_CCK1; ridx <= URTWN_RIDX_CCK11; ridx++) {
4669                 power[ridx] += cckpow;
4670                 if (power[ridx] > R92C_MAX_TX_PWR)
4671                         power[ridx] = R92C_MAX_TX_PWR;
4672         }
4673
4674         htpow = rom->ht40_tx_pwr[group];
4675
4676         /* Compute per-OFDM rate Tx power. */
4677         ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
4678         for (ridx = URTWN_RIDX_OFDM6; ridx <= URTWN_RIDX_OFDM54; ridx++) {
4679                 power[ridx] += ofdmpow;
4680                 if (power[ridx] > R92C_MAX_TX_PWR)
4681                         power[ridx] = R92C_MAX_TX_PWR;
4682         }
4683
4684         bw20pow = htpow + sc->bw20_tx_pwr_diff;
4685         for (ridx = 12; ridx <= 27; ridx++) {
4686                 power[ridx] += bw20pow;
4687                 if (power[ridx] > R92C_MAX_TX_PWR)
4688                         power[ridx] = R92C_MAX_TX_PWR;
4689         }
4690 }
4691
4692 static void
4693 urtwn_set_txpower(struct urtwn_softc *sc, struct ieee80211_channel *c,
4694     struct ieee80211_channel *extc)
4695 {
4696         uint16_t power[URTWN_RIDX_COUNT];
4697         int i;
4698
4699         for (i = 0; i < sc->ntxchains; i++) {
4700                 /* Compute per-rate Tx power values. */
4701                 if (sc->chip & URTWN_CHIP_88E)
4702                         urtwn_r88e_get_txpower(sc, i, c, extc, power);
4703                 else
4704                         urtwn_get_txpower(sc, i, c, extc, power);
4705                 /* Write per-rate Tx power values to hardware. */
4706                 urtwn_write_txpower(sc, i, power);
4707         }
4708 }
4709
4710 static void
4711 urtwn_set_rx_bssid_all(struct urtwn_softc *sc, int enable)
4712 {
4713         uint32_t reg;
4714
4715         reg = urtwn_read_4(sc, R92C_RCR);
4716         if (enable)
4717                 reg &= ~R92C_RCR_CBSSID_BCN;
4718         else
4719                 reg |= R92C_RCR_CBSSID_BCN;
4720         urtwn_write_4(sc, R92C_RCR, reg);
4721 }
4722
4723 static void
4724 urtwn_set_gain(struct urtwn_softc *sc, uint8_t gain)
4725 {
4726         uint32_t reg;
4727
4728         reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
4729         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4730         urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
4731
4732         if (!(sc->chip & URTWN_CHIP_88E)) {
4733                 reg = urtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
4734                 reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
4735                 urtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
4736         }
4737 }
4738
4739 static void
4740 urtwn_scan_start(struct ieee80211com *ic)
4741 {
4742         struct urtwn_softc *sc = ic->ic_softc;
4743
4744         URTWN_LOCK(sc);
4745         /* Receive beacons / probe responses from any BSSID. */
4746         if (ic->ic_opmode != IEEE80211_M_IBSS)
4747                 urtwn_set_rx_bssid_all(sc, 1);
4748
4749         /* Set gain for scanning. */
4750         urtwn_set_gain(sc, 0x20);
4751         URTWN_UNLOCK(sc);
4752 }
4753
4754 static void
4755 urtwn_scan_end(struct ieee80211com *ic)
4756 {
4757         struct urtwn_softc *sc = ic->ic_softc;
4758
4759         URTWN_LOCK(sc);
4760         /* Restore limitations. */
4761         if (ic->ic_promisc == 0 && ic->ic_opmode != IEEE80211_M_IBSS)
4762                 urtwn_set_rx_bssid_all(sc, 0);
4763
4764         /* Set gain under link. */
4765         urtwn_set_gain(sc, 0x32);
4766         URTWN_UNLOCK(sc);
4767 }
4768
4769 static void
4770 urtwn_set_channel(struct ieee80211com *ic)
4771 {
4772         struct urtwn_softc *sc = ic->ic_softc;
4773         struct ieee80211_channel *c = ic->ic_curchan;
4774         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4775
4776         URTWN_LOCK(sc);
4777         if (vap->iv_state == IEEE80211_S_SCAN) {
4778                 /* Make link LED blink during scan. */
4779                 urtwn_set_led(sc, URTWN_LED_LINK, !sc->ledlink);
4780         }
4781         urtwn_set_chan(sc, c, NULL);
4782         sc->sc_rxtap.wr_chan_freq = htole16(c->ic_freq);
4783         sc->sc_rxtap.wr_chan_flags = htole16(c->ic_flags);
4784         sc->sc_txtap.wt_chan_freq = htole16(c->ic_freq);
4785         sc->sc_txtap.wt_chan_flags = htole16(c->ic_flags);
4786         URTWN_UNLOCK(sc);
4787 }
4788
4789 static int
4790 urtwn_wme_update(struct ieee80211com *ic)
4791 {
4792         const struct wmeParams *wmep =
4793             ic->ic_wme.wme_chanParams.cap_wmeParams;
4794         struct urtwn_softc *sc = ic->ic_softc;
4795         uint8_t aifs, acm, slottime;
4796         int ac;
4797
4798         acm = 0;
4799         slottime = IEEE80211_GET_SLOTTIME(ic);
4800
4801         URTWN_LOCK(sc);
4802         for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4803                 /* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4804                 aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4805                 urtwn_write_4(sc, wme2queue[ac].reg,
4806                     SM(R92C_EDCA_PARAM_TXOP, wmep[ac].wmep_txopLimit) |
4807                     SM(R92C_EDCA_PARAM_ECWMIN, wmep[ac].wmep_logcwmin) |
4808                     SM(R92C_EDCA_PARAM_ECWMAX, wmep[ac].wmep_logcwmax) |
4809                     SM(R92C_EDCA_PARAM_AIFS, aifs));
4810                 if (ac != WME_AC_BE)
4811                         acm |= wmep[ac].wmep_acm << ac;
4812         }
4813
4814         if (acm != 0)
4815                 acm |= R92C_ACMHWCTRL_EN;
4816         urtwn_write_1(sc, R92C_ACMHWCTRL,
4817             (urtwn_read_1(sc, R92C_ACMHWCTRL) & ~R92C_ACMHWCTRL_ACM_MASK) |
4818             acm);
4819
4820         URTWN_UNLOCK(sc);
4821
4822         return 0;
4823 }
4824
4825 static void
4826 urtwn_update_slot(struct ieee80211com *ic)
4827 {
4828         urtwn_cmd_sleepable(ic->ic_softc, NULL, 0, urtwn_update_slot_cb);
4829 }
4830
4831 static void
4832 urtwn_update_slot_cb(struct urtwn_softc *sc, union sec_param *data)
4833 {
4834         struct ieee80211com *ic = &sc->sc_ic;
4835         uint8_t slottime;
4836
4837         slottime = IEEE80211_GET_SLOTTIME(ic);
4838
4839         URTWN_DPRINTF(sc, URTWN_DEBUG_ANY, "%s: setting slot time to %uus\n",
4840             __func__, slottime);
4841
4842         urtwn_write_1(sc, R92C_SLOT, slottime);
4843         urtwn_update_aifs(sc, slottime);
4844 }
4845
4846 static void
4847 urtwn_update_aifs(struct urtwn_softc *sc, uint8_t slottime)
4848 {
4849         const struct wmeParams *wmep =
4850             sc->sc_ic.ic_wme.wme_chanParams.cap_wmeParams;
4851         uint8_t aifs, ac;
4852
4853         for (ac = WME_AC_BE; ac < WME_NUM_AC; ac++) {
4854                 /* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
4855                 aifs = wmep[ac].wmep_aifsn * slottime + IEEE80211_DUR_SIFS;
4856                 urtwn_write_1(sc, wme2queue[ac].reg, aifs);
4857         }
4858 }
4859
4860 static uint8_t
4861 urtwn_get_multi_pos(const uint8_t maddr[])
4862 {
4863         uint64_t mask = 0x00004d101df481b4;
4864         uint8_t pos = 0x27;     /* initial value */
4865         int i, j;
4866
4867         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
4868                 for (j = (i == 0) ? 1 : 0; j < 8; j++)
4869                         if ((maddr[i] >> j) & 1)
4870                                 pos ^= (mask >> (i * 8 + j - 1));
4871
4872         pos &= 0x3f;
4873
4874         return (pos);
4875 }
4876
4877 static void
4878 urtwn_set_multi(struct urtwn_softc *sc)
4879 {
4880         struct ieee80211com *ic = &sc->sc_ic;
4881         uint32_t mfilt[2];
4882
4883         URTWN_ASSERT_LOCKED(sc);
4884
4885         /* general structure was copied from ath(4). */
4886         if (ic->ic_allmulti == 0) {
4887                 struct ieee80211vap *vap;
4888                 struct ifnet *ifp;
4889                 struct ifmultiaddr *ifma;
4890
4891                 /*
4892                  * Merge multicast addresses to form the hardware filter.
4893                  */
4894                 mfilt[0] = mfilt[1] = 0;
4895                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next) {
4896                         ifp = vap->iv_ifp;
4897 #if defined(__DragonFly__)
4898                         /* XXX not implemented */
4899 #else
4900                         if_maddr_rlock(ifp);
4901 #endif
4902                         TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
4903                                 caddr_t dl;
4904                                 uint8_t pos;
4905
4906                                 dl = LLADDR((struct sockaddr_dl *)
4907                                     ifma->ifma_addr);
4908                                 pos = urtwn_get_multi_pos(dl);
4909
4910                                 mfilt[pos / 32] |= (1 << (pos % 32));
4911                         }
4912 #if defined(__DragonFly__)
4913                         /* XXX not implemented */
4914 #else
4915                         if_maddr_runlock(ifp);
4916 #endif
4917                 }
4918         } else
4919                 mfilt[0] = mfilt[1] = ~0;
4920
4921
4922         urtwn_write_4(sc, R92C_MAR + 0, mfilt[0]);
4923         urtwn_write_4(sc, R92C_MAR + 4, mfilt[1]);
4924
4925         URTWN_DPRINTF(sc, URTWN_DEBUG_STATE, "%s: MC filter %08x:%08x\n",
4926              __func__, mfilt[0], mfilt[1]);
4927 }
4928
4929 static void
4930 urtwn_set_promisc(struct urtwn_softc *sc)
4931 {
4932         struct ieee80211com *ic = &sc->sc_ic;
4933         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4934         uint32_t rcr, mask1, mask2;
4935
4936         URTWN_ASSERT_LOCKED(sc);
4937
4938         if (vap->iv_opmode == IEEE80211_M_MONITOR)
4939                 return;
4940
4941         mask1 = R92C_RCR_ACF | R92C_RCR_ADF | R92C_RCR_AMF | R92C_RCR_AAP;
4942         mask2 = R92C_RCR_APM;
4943
4944         if (vap->iv_state == IEEE80211_S_RUN) {
4945                 switch (vap->iv_opmode) {
4946                 case IEEE80211_M_STA:
4947                         mask2 |= R92C_RCR_CBSSID_DATA;
4948                         /* FALLTHROUGH */
4949                 case IEEE80211_M_HOSTAP:
4950                         mask2 |= R92C_RCR_CBSSID_BCN;
4951                         break;
4952                 case IEEE80211_M_IBSS:
4953                         mask2 |= R92C_RCR_CBSSID_DATA;
4954                         break;
4955                 default:
4956                         device_printf(sc->sc_dev, "%s: undefined opmode %d\n",
4957                             __func__, vap->iv_opmode);
4958                         return;
4959                 }
4960         }
4961
4962         rcr = urtwn_read_4(sc, R92C_RCR);
4963         if (ic->ic_promisc == 0)
4964                 rcr = (rcr & ~mask1) | mask2;
4965         else
4966                 rcr = (rcr & ~mask2) | mask1;
4967         urtwn_write_4(sc, R92C_RCR, rcr);
4968 }
4969
4970 static void
4971 urtwn_update_promisc(struct ieee80211com *ic)
4972 {
4973         struct urtwn_softc *sc = ic->ic_softc;
4974
4975         URTWN_LOCK(sc);
4976         if (sc->sc_flags & URTWN_RUNNING)
4977                 urtwn_set_promisc(sc);
4978         URTWN_UNLOCK(sc);
4979 }
4980
4981 static void
4982 urtwn_update_mcast(struct ieee80211com *ic)
4983 {
4984         struct urtwn_softc *sc = ic->ic_softc;
4985
4986         URTWN_LOCK(sc);
4987         if (sc->sc_flags & URTWN_RUNNING)
4988                 urtwn_set_multi(sc);
4989         URTWN_UNLOCK(sc);
4990 }
4991
4992 static struct ieee80211_node *
4993 urtwn_node_alloc(struct ieee80211vap *vap,
4994     const uint8_t mac[IEEE80211_ADDR_LEN])
4995 {
4996         struct urtwn_node *un;
4997
4998         un = kmalloc(sizeof (struct urtwn_node), M_80211_NODE,
4999                      M_INTWAIT | M_ZERO);
5000
5001         if (un == NULL)
5002                 return NULL;
5003
5004         un->id = URTWN_MACID_UNDEFINED;
5005
5006         return &un->ni;
5007 }
5008
5009 static void
5010 urtwn_newassoc(struct ieee80211_node *ni, int isnew)
5011 {
5012         struct urtwn_softc *sc = ni->ni_ic->ic_softc;
5013         struct urtwn_node *un = URTWN_NODE(ni);
5014         uint8_t id;
5015
5016         /* Only do this bit for R88E chips */
5017         if (! (sc->chip & URTWN_CHIP_88E))
5018                 return;
5019
5020         if (!isnew)
5021                 return;
5022
5023         URTWN_NT_LOCK(sc);
5024         for (id = 0; id <= URTWN_MACID_MAX(sc); id++) {
5025                 if (id != URTWN_MACID_BC && sc->node_list[id] == NULL) {
5026                         un->id = id;
5027                         sc->node_list[id] = ni;
5028                         break;
5029                 }
5030         }
5031         URTWN_NT_UNLOCK(sc);
5032
5033         if (id > URTWN_MACID_MAX(sc)) {
5034                 device_printf(sc->sc_dev, "%s: node table is full\n",
5035                     __func__);
5036         }
5037 }
5038
5039 static void
5040 urtwn_node_free(struct ieee80211_node *ni)
5041 {
5042         struct urtwn_softc *sc = ni->ni_ic->ic_softc;
5043         struct urtwn_node *un = URTWN_NODE(ni);
5044
5045         URTWN_NT_LOCK(sc);
5046         if (un->id != URTWN_MACID_UNDEFINED)
5047                 sc->node_list[un->id] = NULL;
5048         URTWN_NT_UNLOCK(sc);
5049
5050         sc->sc_node_free(ni);
5051 }
5052
5053 static void
5054 urtwn_set_chan(struct urtwn_softc *sc, struct ieee80211_channel *c,
5055     struct ieee80211_channel *extc)
5056 {
5057         struct ieee80211com *ic = &sc->sc_ic;
5058         uint32_t reg;
5059         u_int chan;
5060         int i;
5061
5062         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
5063         if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
5064                 device_printf(sc->sc_dev,
5065                     "%s: invalid channel %x\n", __func__, chan);
5066                 return;
5067         }
5068
5069         /* Set Tx power for this new channel. */
5070         urtwn_set_txpower(sc, c, extc);
5071
5072         for (i = 0; i < sc->nrxchains; i++) {
5073                 urtwn_rf_write(sc, i, R92C_RF_CHNLBW,
5074                     RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
5075         }
5076 #ifndef IEEE80211_NO_HT
5077         if (extc != NULL) {
5078                 /* Is secondary channel below or above primary? */
5079                 int prichlo = c->ic_freq < extc->ic_freq;
5080
5081                 urtwn_write_1(sc, R92C_BWOPMODE,
5082                     urtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
5083
5084                 reg = urtwn_read_1(sc, R92C_RRSR + 2);
5085                 reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
5086                 urtwn_write_1(sc, R92C_RRSR + 2, reg);
5087
5088                 urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
5089                     urtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
5090                 urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
5091                     urtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
5092
5093                 /* Set CCK side band. */
5094                 reg = urtwn_bb_read(sc, R92C_CCK0_SYSTEM);
5095                 reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
5096                 urtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
5097
5098                 reg = urtwn_bb_read(sc, R92C_OFDM1_LSTF);
5099                 reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
5100                 urtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
5101
5102                 urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5103                     urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
5104                     ~R92C_FPGA0_ANAPARAM2_CBW20);
5105
5106                 reg = urtwn_bb_read(sc, 0x818);
5107                 reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
5108                 urtwn_bb_write(sc, 0x818, reg);
5109
5110                 /* Select 40MHz bandwidth. */
5111                 urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5112                     (sc->rf_chnlbw[0] & ~0xfff) | chan);
5113         } else
5114 #endif
5115         {
5116                 urtwn_write_1(sc, R92C_BWOPMODE,
5117                     urtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
5118
5119                 urtwn_bb_write(sc, R92C_FPGA0_RFMOD,
5120                     urtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
5121                 urtwn_bb_write(sc, R92C_FPGA1_RFMOD,
5122                     urtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
5123
5124                 if (!(sc->chip & URTWN_CHIP_88E)) {
5125                         urtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
5126                             urtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
5127                             R92C_FPGA0_ANAPARAM2_CBW20);
5128                 }
5129
5130                 /* Select 20MHz bandwidth. */
5131                 urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5132                     (sc->rf_chnlbw[0] & ~0xfff) | chan |
5133                     ((sc->chip & URTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
5134                     R92C_RF_CHNLBW_BW20));
5135         }
5136 }
5137
5138 static void
5139 urtwn_iq_calib(struct urtwn_softc *sc)
5140 {
5141         /* TODO */
5142 }
5143
5144 static void
5145 urtwn_lc_calib(struct urtwn_softc *sc)
5146 {
5147         uint32_t rf_ac[2];
5148         uint8_t txmode;
5149         int i;
5150
5151         txmode = urtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
5152         if ((txmode & 0x70) != 0) {
5153                 /* Disable all continuous Tx. */
5154                 urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
5155
5156                 /* Set RF mode to standby mode. */
5157                 for (i = 0; i < sc->nrxchains; i++) {
5158                         rf_ac[i] = urtwn_rf_read(sc, i, R92C_RF_AC);
5159                         urtwn_rf_write(sc, i, R92C_RF_AC,
5160                             RW(rf_ac[i], R92C_RF_AC_MODE,
5161                                 R92C_RF_AC_MODE_STANDBY));
5162                 }
5163         } else {
5164                 /* Block all Tx queues. */
5165                 urtwn_write_1(sc, R92C_TXPAUSE, R92C_TX_QUEUE_ALL);
5166         }
5167         /* Start calibration. */
5168         urtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
5169             urtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
5170
5171         /* Give calibration the time to complete. */
5172         usb_pause_mtx(&sc->sc_mtx, hz / 10);            /* 100ms */
5173
5174         /* Restore configuration. */
5175         if ((txmode & 0x70) != 0) {
5176                 /* Restore Tx mode. */
5177                 urtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
5178                 /* Restore RF mode. */
5179                 for (i = 0; i < sc->nrxchains; i++)
5180                         urtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
5181         } else {
5182                 /* Unblock all Tx queues. */
5183                 urtwn_write_1(sc, R92C_TXPAUSE, 0x00);
5184         }
5185 }
5186
5187 static void
5188 urtwn_temp_calib(struct urtwn_softc *sc)
5189 {
5190         uint8_t temp;
5191
5192         URTWN_ASSERT_LOCKED(sc);
5193
5194         if (!(sc->sc_flags & URTWN_TEMP_MEASURED)) {
5195                 /* Start measuring temperature. */
5196                 URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5197                     "%s: start measuring temperature\n", __func__);
5198                 if (sc->chip & URTWN_CHIP_88E) {
5199                         urtwn_rf_write(sc, 0, R88E_RF_T_METER,
5200                             R88E_RF_T_METER_START);
5201                 } else {
5202                         urtwn_rf_write(sc, 0, R92C_RF_T_METER,
5203                             R92C_RF_T_METER_START);
5204                 }
5205                 sc->sc_flags |= URTWN_TEMP_MEASURED;
5206                 return;
5207         }
5208         sc->sc_flags &= ~URTWN_TEMP_MEASURED;
5209
5210         /* Read measured temperature. */
5211         if (sc->chip & URTWN_CHIP_88E) {
5212                 temp = MS(urtwn_rf_read(sc, 0, R88E_RF_T_METER),
5213                     R88E_RF_T_METER_VAL);
5214         } else {
5215                 temp = MS(urtwn_rf_read(sc, 0, R92C_RF_T_METER),
5216                     R92C_RF_T_METER_VAL);
5217         }
5218         if (temp == 0) {        /* Read failed, skip. */
5219                 URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5220                     "%s: temperature read failed, skipping\n", __func__);
5221                 return;
5222         }
5223
5224         URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5225             "%s: temperature: previous %u, current %u\n",
5226             __func__, sc->thcal_lctemp, temp);
5227
5228         /*
5229          * Redo LC calibration if temperature changed significantly since
5230          * last calibration.
5231          */
5232         if (sc->thcal_lctemp == 0) {
5233                 /* First LC calibration is performed in urtwn_init(). */
5234                 sc->thcal_lctemp = temp;
5235         } else if (abs(temp - sc->thcal_lctemp) > 1) {
5236                 URTWN_DPRINTF(sc, URTWN_DEBUG_TEMP,
5237                     "%s: LC calib triggered by temp: %u -> %u\n",
5238                     __func__, sc->thcal_lctemp, temp);
5239                 urtwn_lc_calib(sc);
5240                 /* Record temperature of last LC calibration. */
5241                 sc->thcal_lctemp = temp;
5242         }
5243 }
5244
5245 static int
5246 urtwn_init(struct urtwn_softc *sc)
5247 {
5248         struct ieee80211com *ic = &sc->sc_ic;
5249         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5250         uint8_t macaddr[IEEE80211_ADDR_LEN];
5251         uint32_t reg;
5252         usb_error_t usb_err = USB_ERR_NORMAL_COMPLETION;
5253         int error;
5254
5255         URTWN_LOCK(sc);
5256         if (sc->sc_flags & URTWN_RUNNING) {
5257                 URTWN_UNLOCK(sc);
5258                 return (0);
5259         }
5260
5261         /* Init firmware commands ring. */
5262         sc->fwcur = 0;
5263
5264         /* Allocate Tx/Rx buffers. */
5265         error = urtwn_alloc_rx_list(sc);
5266         if (error != 0)
5267                 goto fail;
5268
5269         error = urtwn_alloc_tx_list(sc);
5270         if (error != 0)
5271                 goto fail;
5272
5273         /* Power on adapter. */
5274         error = urtwn_power_on(sc);
5275         if (error != 0)
5276                 goto fail;
5277
5278         /* Initialize DMA. */
5279         error = urtwn_dma_init(sc);
5280         if (error != 0)
5281                 goto fail;
5282
5283         /* Set info size in Rx descriptors (in 64-bit words). */
5284         urtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
5285
5286         /* Init interrupts. */
5287         if (sc->chip & URTWN_CHIP_88E) {
5288                 usb_err = urtwn_write_4(sc, R88E_HISR, 0xffffffff);
5289                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
5290                         goto fail;
5291                 usb_err = urtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM | R88E_HIMR_CPWM2 |
5292                     R88E_HIMR_TBDER | R88E_HIMR_PSTIMEOUT);
5293                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
5294                         goto fail;
5295                 usb_err = urtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
5296                     R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR | R88E_HIMRE_TXERR);
5297                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
5298                         goto fail;
5299                 usb_err = urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5300                     urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5301                     R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
5302                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
5303                         goto fail;
5304         } else {
5305                 usb_err = urtwn_write_4(sc, R92C_HISR, 0xffffffff);
5306                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
5307                         goto fail;
5308                 usb_err = urtwn_write_4(sc, R92C_HIMR, 0xffffffff);
5309                 if (usb_err != USB_ERR_NORMAL_COMPLETION)
5310                         goto fail;
5311         }
5312
5313         /* Set MAC address. */
5314         IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
5315         usb_err = urtwn_write_region_1(sc, R92C_MACID, macaddr, IEEE80211_ADDR_LEN);
5316         if (usb_err != USB_ERR_NORMAL_COMPLETION)
5317                 goto fail;
5318
5319         /* Set initial network type. */
5320         urtwn_set_mode(sc, R92C_MSR_INFRA);
5321
5322         /* Initialize Rx filter. */
5323         urtwn_rxfilter_init(sc);
5324
5325         /* Set response rate. */
5326         reg = urtwn_read_4(sc, R92C_RRSR);
5327         reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_CCK_ONLY_1M);
5328         urtwn_write_4(sc, R92C_RRSR, reg);
5329
5330         /* Set short/long retry limits. */
5331         urtwn_write_2(sc, R92C_RL,
5332             SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
5333
5334         /* Initialize EDCA parameters. */
5335         urtwn_edca_init(sc);
5336
5337         /* Setup rate fallback. */
5338         if (!(sc->chip & URTWN_CHIP_88E)) {
5339                 urtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
5340                 urtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
5341                 urtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
5342                 urtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
5343         }
5344
5345         urtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
5346             urtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
5347             R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
5348         /* Set ACK timeout. */
5349         urtwn_write_1(sc, R92C_ACKTO, 0x40);
5350
5351         /* Setup USB aggregation. */
5352         reg = urtwn_read_4(sc, R92C_TDECTRL);
5353         reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
5354         urtwn_write_4(sc, R92C_TDECTRL, reg);
5355         urtwn_write_1(sc, R92C_TRXDMA_CTRL,
5356             urtwn_read_1(sc, R92C_TRXDMA_CTRL) |
5357             R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
5358         urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
5359         if (sc->chip & URTWN_CHIP_88E)
5360                 urtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
5361         else {
5362                 urtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
5363                 urtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
5364                     urtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
5365                     R92C_USB_SPECIAL_OPTION_AGG_EN);
5366                 urtwn_write_1(sc, R92C_USB_AGG_TH, 8);
5367                 urtwn_write_1(sc, R92C_USB_AGG_TO, 6);
5368         }
5369
5370         /* Initialize beacon parameters. */
5371         urtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
5372         urtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
5373         urtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
5374         urtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
5375         urtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
5376
5377         if (!(sc->chip & URTWN_CHIP_88E)) {
5378                 /* Setup AMPDU aggregation. */
5379                 urtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631); /* MCS7~0 */
5380                 urtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
5381                 urtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
5382
5383                 urtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
5384         }
5385
5386 #ifndef URTWN_WITHOUT_UCODE
5387         /* Load 8051 microcode. */
5388         error = urtwn_load_firmware(sc);
5389         if (error == 0)
5390                 sc->sc_flags |= URTWN_FW_LOADED;
5391 #endif
5392
5393         /* Initialize MAC/BB/RF blocks. */
5394         error = urtwn_mac_init(sc);
5395         if (error != 0) {
5396                 device_printf(sc->sc_dev,
5397                     "%s: error while initializing MAC block\n", __func__);
5398                 goto fail;
5399         }
5400         urtwn_bb_init(sc);
5401         urtwn_rf_init(sc);
5402
5403         /* Reinitialize Rx filter (D3845 is not committed yet). */
5404         urtwn_rxfilter_init(sc);
5405
5406         if (sc->chip & URTWN_CHIP_88E) {
5407                 urtwn_write_2(sc, R92C_CR,
5408                     urtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
5409                     R92C_CR_MACRXEN);
5410         }
5411
5412         /* Turn CCK and OFDM blocks on. */
5413         reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5414         reg |= R92C_RFMOD_CCK_EN;
5415         usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5416         if (usb_err != USB_ERR_NORMAL_COMPLETION)
5417                 goto fail;
5418         reg = urtwn_bb_read(sc, R92C_FPGA0_RFMOD);
5419         reg |= R92C_RFMOD_OFDM_EN;
5420         usb_err = urtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
5421         if (usb_err != USB_ERR_NORMAL_COMPLETION)
5422                 goto fail;
5423
5424         /* Clear per-station keys table. */
5425         urtwn_cam_init(sc);
5426
5427         /* Enable decryption / encryption. */
5428         urtwn_write_2(sc, R92C_SECCFG,
5429             R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
5430             R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXDEC_ENA |
5431             R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
5432
5433         /*
5434          * Install static keys (if any).
5435          * Must be called after urtwn_cam_init().
5436          */
5437         ieee80211_runtask(ic, &sc->cmdq_task);
5438
5439         /* Enable hardware sequence numbering. */
5440         urtwn_write_1(sc, R92C_HWSEQ_CTRL, R92C_TX_QUEUE_ALL);
5441
5442         /* Enable per-packet TX report. */
5443         if (sc->chip & URTWN_CHIP_88E) {
5444                 urtwn_write_1(sc, R88E_TX_RPT_CTRL,
5445                     urtwn_read_1(sc, R88E_TX_RPT_CTRL) | R88E_TX_RPT1_ENA);
5446         }
5447
5448         /* Perform LO and IQ calibrations. */
5449         urtwn_iq_calib(sc);
5450         /* Perform LC calibration. */
5451         urtwn_lc_calib(sc);
5452
5453         /* Fix USB interference issue. */
5454         if (!(sc->chip & URTWN_CHIP_88E)) {
5455                 urtwn_write_1(sc, 0xfe40, 0xe0);
5456                 urtwn_write_1(sc, 0xfe41, 0x8d);
5457                 urtwn_write_1(sc, 0xfe42, 0x80);
5458
5459                 urtwn_pa_bias_init(sc);
5460         }
5461
5462         /* Initialize GPIO setting. */
5463         urtwn_write_1(sc, R92C_GPIO_MUXCFG,
5464             urtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
5465
5466         /* Fix for lower temperature. */
5467         if (!(sc->chip & URTWN_CHIP_88E))
5468                 urtwn_write_1(sc, 0x15, 0xe9);
5469
5470         usbd_transfer_start(sc->sc_xfer[URTWN_BULK_RX]);
5471
5472         sc->sc_flags |= URTWN_RUNNING;
5473
5474         callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5475 fail:
5476         if (usb_err != USB_ERR_NORMAL_COMPLETION)
5477                 error = EIO;
5478
5479         URTWN_UNLOCK(sc);
5480
5481         return (error);
5482 }
5483
5484 static void
5485 urtwn_stop(struct urtwn_softc *sc)
5486 {
5487
5488         URTWN_LOCK(sc);
5489         if (!(sc->sc_flags & URTWN_RUNNING)) {
5490                 URTWN_UNLOCK(sc);
5491                 return;
5492         }
5493
5494         sc->sc_flags &= ~(URTWN_RUNNING | URTWN_FW_LOADED |
5495             URTWN_TEMP_MEASURED);
5496         sc->thcal_lctemp = 0;
5497         callout_stop(&sc->sc_watchdog_ch);
5498
5499         urtwn_abort_xfers(sc);
5500         urtwn_drain_mbufq(sc);
5501         urtwn_power_off(sc);
5502         URTWN_UNLOCK(sc);
5503 }
5504
5505 static void
5506 urtwn_abort_xfers(struct urtwn_softc *sc)
5507 {
5508         int i;
5509
5510         URTWN_ASSERT_LOCKED(sc);
5511
5512         /* abort any pending transfers */
5513         for (i = 0; i < URTWN_N_TRANSFER; i++)
5514                 usbd_transfer_stop(sc->sc_xfer[i]);
5515 }
5516
5517 static int
5518 urtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
5519     const struct ieee80211_bpf_params *params)
5520 {
5521         struct ieee80211com *ic = ni->ni_ic;
5522         struct urtwn_softc *sc = ic->ic_softc;
5523         struct urtwn_data *bf;
5524         int error;
5525
5526         URTWN_DPRINTF(sc, URTWN_DEBUG_XMIT, "%s: called; m=%p\n",
5527             __func__,
5528             m);
5529
5530         /* prevent management frames from being sent if we're not ready */
5531         URTWN_LOCK(sc);
5532         if (!(sc->sc_flags & URTWN_RUNNING)) {
5533                 error = ENETDOWN;
5534                 goto end;
5535         }
5536
5537         bf = urtwn_getbuf(sc);
5538         if (bf == NULL) {
5539                 error = ENOBUFS;
5540                 goto end;
5541         }
5542
5543         if (params == NULL) {
5544                 /*
5545                  * Legacy path; interpret frame contents to decide
5546                  * precisely how to send the frame.
5547                  */
5548                 error = urtwn_tx_data(sc, ni, m, bf);
5549         } else {
5550                 /*
5551                  * Caller supplied explicit parameters to use in
5552                  * sending the frame.
5553                  */
5554                 error = urtwn_tx_raw(sc, ni, m, bf, params);
5555         }
5556         if (error != 0) {
5557                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
5558                 goto end;
5559         }
5560
5561         sc->sc_txtimer = 5;
5562         callout_reset(&sc->sc_watchdog_ch, hz, urtwn_watchdog, sc);
5563
5564 end:
5565         if (error != 0)
5566                 m_freem(m);
5567
5568         URTWN_UNLOCK(sc);
5569
5570         return (error);
5571 }
5572
5573 static void
5574 urtwn_ms_delay(struct urtwn_softc *sc)
5575 {
5576         usb_pause_mtx(&sc->sc_mtx, hz / 1000);
5577 }
5578
5579 static device_method_t urtwn_methods[] = {
5580         /* Device interface */
5581         DEVMETHOD(device_probe,         urtwn_match),
5582         DEVMETHOD(device_attach,        urtwn_attach),
5583         DEVMETHOD(device_detach,        urtwn_detach),
5584
5585         DEVMETHOD_END
5586 };
5587
5588 static driver_t urtwn_driver = {
5589         "urtwn",
5590         urtwn_methods,
5591         sizeof(struct urtwn_softc)
5592 };
5593
5594 static devclass_t urtwn_devclass;
5595
5596 DRIVER_MODULE(urtwn, uhub, urtwn_driver, urtwn_devclass, NULL, NULL);
5597 MODULE_DEPEND(urtwn, usb, 1, 1, 1);
5598 MODULE_DEPEND(urtwn, wlan, 1, 1, 1);
5599 #ifndef URTWN_WITHOUT_UCODE
5600 MODULE_DEPEND(urtwn, firmware, 1, 1, 1);
5601 #endif
5602 MODULE_VERSION(urtwn, 1);
5603 #if defined(__DragonFly__)
5604 /* USB_PNP_HOST_INFO() not implemented */
5605 #else
5606 USB_PNP_HOST_INFO(urtwn_devs);
5607 #endif