The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/rtwn/if_rtwn.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $OpenBSD: if_rtwn.c,v 1.6 2015/08/28 00:03:53 deraadt Exp $     */
    2 
    3 /*-
    4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
    5  * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
    6  *
    7  * Permission to use, copy, modify, and distribute this software for any
    8  * purpose with or without fee is hereby granted, provided that the above
    9  * copyright notice and this permission notice appear in all copies.
   10  *
   11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   18  */
   19 
   20 #include <sys/cdefs.h>
   21 __FBSDID("$FreeBSD: releng/11.2/sys/dev/rtwn/if_rtwn.c 302035 2016-06-20 22:45:19Z avos $");
   22 
   23 /*
   24  * Driver for Realtek RTL8188CE
   25  */
   26 
   27 #include <sys/param.h>
   28 #include <sys/sysctl.h>
   29 #include <sys/sockio.h>
   30 #include <sys/mbuf.h>
   31 #include <sys/kernel.h>
   32 #include <sys/socket.h>
   33 #include <sys/systm.h>
   34 #include <sys/malloc.h>
   35 #include <sys/lock.h>
   36 #include <sys/mutex.h>
   37 #include <sys/module.h>
   38 #include <sys/bus.h>
   39 #include <sys/endian.h>
   40 #include <sys/firmware.h>
   41 
   42 #include <machine/bus.h>
   43 #include <machine/resource.h>
   44 #include <sys/rman.h>
   45 
   46 #include <dev/pci/pcireg.h>
   47 #include <dev/pci/pcivar.h>
   48 
   49 #include <net/bpf.h>
   50 #include <net/if.h>
   51 #include <net/if_var.h>
   52 #include <net/if_arp.h>
   53 #include <net/ethernet.h>
   54 #include <net/if_dl.h>
   55 #include <net/if_media.h>
   56 #include <net/if_types.h>
   57 
   58 #include <net80211/ieee80211_var.h>
   59 #include <net80211/ieee80211_radiotap.h>
   60 #include <net80211/ieee80211_regdomain.h>
   61 #include <net80211/ieee80211_ratectl.h>
   62 
   63 #include <netinet/in.h>
   64 #include <netinet/in_systm.h>
   65 #include <netinet/in_var.h>
   66 #include <netinet/ip.h>
   67 #include <netinet/if_ether.h>
   68 
   69 #include <dev/rtwn/if_rtwnreg.h>
   70 
   71 #define RTWN_DEBUG
   72 #ifdef RTWN_DEBUG
   73 #define DPRINTF(x)      do { if (sc->sc_debug > 0) printf x; } while (0)
   74 #define DPRINTFN(n, x)  do { if (sc->sc_debug >= (n)) printf x; } while (0)
   75 #else
   76 #define DPRINTF(x)
   77 #define DPRINTFN(n, x)
   78 #endif
   79 
   80 /*
   81  * PCI configuration space registers.
   82  */
   83 #define RTWN_PCI_IOBA           0x10    /* i/o mapped base */
   84 #define RTWN_PCI_MMBA           0x18    /* memory mapped base */
   85 
   86 #define RTWN_INT_ENABLE (R92C_IMR_ROK | R92C_IMR_VODOK | R92C_IMR_VIDOK | \
   87                         R92C_IMR_BEDOK | R92C_IMR_BKDOK | R92C_IMR_MGNTDOK | \
   88                         R92C_IMR_HIGHDOK | R92C_IMR_BDOK | R92C_IMR_RDU | \
   89                         R92C_IMR_RXFOVW)
   90 
   91 struct rtwn_ident {
   92         uint16_t        vendor;
   93         uint16_t        device;
   94         const char      *name;
   95 };
   96 
   97 
   98 static const struct rtwn_ident rtwn_ident_table[] = {
   99         { 0x10ec, 0x8176, "Realtek RTL8188CE" },
  100         { 0, 0, NULL }
  101 };
  102 
  103 
  104 static void     rtwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
  105 static void     rtwn_setup_rx_desc(struct rtwn_softc *, struct r92c_rx_desc *,
  106                     bus_addr_t, size_t, int);
  107 static int      rtwn_alloc_rx_list(struct rtwn_softc *);
  108 static void     rtwn_reset_rx_list(struct rtwn_softc *);
  109 static void     rtwn_free_rx_list(struct rtwn_softc *);
  110 static int      rtwn_alloc_tx_list(struct rtwn_softc *, int);
  111 static void     rtwn_reset_tx_list(struct rtwn_softc *, int);
  112 static void     rtwn_free_tx_list(struct rtwn_softc *, int);
  113 static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
  114                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
  115                     const uint8_t [IEEE80211_ADDR_LEN],
  116                     const uint8_t [IEEE80211_ADDR_LEN]);
  117 static void     rtwn_vap_delete(struct ieee80211vap *);
  118 static void     rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
  119 static void     rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
  120 static void     rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
  121 static uint8_t  rtwn_read_1(struct rtwn_softc *, uint16_t);
  122 static uint16_t rtwn_read_2(struct rtwn_softc *, uint16_t);
  123 static uint32_t rtwn_read_4(struct rtwn_softc *, uint16_t);
  124 static int      rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
  125 static void     rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
  126 static uint32_t rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
  127 static int      rtwn_llt_write(struct rtwn_softc *, uint32_t, uint32_t);
  128 static uint8_t  rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
  129 static void     rtwn_efuse_read(struct rtwn_softc *);
  130 static int      rtwn_read_chipid(struct rtwn_softc *);
  131 static void     rtwn_read_rom(struct rtwn_softc *);
  132 static int      rtwn_ra_init(struct rtwn_softc *);
  133 static void     rtwn_tsf_sync_enable(struct rtwn_softc *);
  134 static void     rtwn_set_led(struct rtwn_softc *, int, int);
  135 static void     rtwn_calib_to(void *);
  136 static int      rtwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
  137 static int      rtwn_updateedca(struct ieee80211com *);
  138 static void     rtwn_update_avgrssi(struct rtwn_softc *, int, int8_t);
  139 static int8_t   rtwn_get_rssi(struct rtwn_softc *, int, void *);
  140 static void     rtwn_rx_frame(struct rtwn_softc *, struct r92c_rx_desc *,
  141                     struct rtwn_rx_data *, int);
  142 static int      rtwn_tx(struct rtwn_softc *, struct mbuf *,
  143                     struct ieee80211_node *);
  144 static void     rtwn_tx_done(struct rtwn_softc *, int);
  145 static int      rtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
  146                     const struct ieee80211_bpf_params *);
  147 static int      rtwn_transmit(struct ieee80211com *, struct mbuf *);
  148 static void     rtwn_parent(struct ieee80211com *);
  149 static void     rtwn_start(struct rtwn_softc *sc);
  150 static void     rtwn_watchdog(void *);
  151 static int      rtwn_power_on(struct rtwn_softc *);
  152 static int      rtwn_llt_init(struct rtwn_softc *);
  153 static void     rtwn_fw_reset(struct rtwn_softc *);
  154 static void     rtwn_fw_loadpage(struct rtwn_softc *, int, const uint8_t *,
  155                     int);
  156 static int      rtwn_load_firmware(struct rtwn_softc *);
  157 static int      rtwn_dma_init(struct rtwn_softc *);
  158 static void     rtwn_mac_init(struct rtwn_softc *);
  159 static void     rtwn_bb_init(struct rtwn_softc *);
  160 static void     rtwn_rf_init(struct rtwn_softc *);
  161 static void     rtwn_cam_init(struct rtwn_softc *);
  162 static void     rtwn_pa_bias_init(struct rtwn_softc *);
  163 static void     rtwn_rxfilter_init(struct rtwn_softc *);
  164 static void     rtwn_edca_init(struct rtwn_softc *);
  165 static void     rtwn_write_txpower(struct rtwn_softc *, int, uint16_t[]);
  166 static void     rtwn_get_txpower(struct rtwn_softc *, int,
  167                     struct ieee80211_channel *, struct ieee80211_channel *,
  168                     uint16_t[]);
  169 static void     rtwn_set_txpower(struct rtwn_softc *,
  170                     struct ieee80211_channel *, struct ieee80211_channel *);
  171 static void     rtwn_set_rx_bssid_all(struct rtwn_softc *, int);
  172 static void     rtwn_set_gain(struct rtwn_softc *, uint8_t);
  173 static void     rtwn_scan_start(struct ieee80211com *);
  174 static void     rtwn_scan_end(struct ieee80211com *);
  175 static void     rtwn_getradiocaps(struct ieee80211com *, int, int *,
  176                     struct ieee80211_channel[]);
  177 static void     rtwn_set_channel(struct ieee80211com *);
  178 static void     rtwn_update_mcast(struct ieee80211com *);
  179 static void     rtwn_set_chan(struct rtwn_softc *,
  180                     struct ieee80211_channel *, struct ieee80211_channel *);
  181 static int      rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
  182                     uint16_t[2]);
  183 static void     rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
  184                     uint16_t[2][2]);
  185 static int      rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
  186                     uint16_t[2][2], uint16_t[2][2], int);
  187 static void     rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
  188                     uint16_t[2], int);
  189 static void     rtwn_iq_calib(struct rtwn_softc *);
  190 static void     rtwn_lc_calib(struct rtwn_softc *);
  191 static void     rtwn_temp_calib(struct rtwn_softc *);
  192 static int      rtwn_init(struct rtwn_softc *);
  193 static void     rtwn_stop_locked(struct rtwn_softc *);
  194 static void     rtwn_stop(struct rtwn_softc *);
  195 static void     rtwn_intr(void *);
  196 
  197 /* Aliases. */
  198 #define rtwn_bb_write   rtwn_write_4
  199 #define rtwn_bb_read    rtwn_read_4
  200 
  201 static int      rtwn_probe(device_t);
  202 static int      rtwn_attach(device_t);
  203 static int      rtwn_detach(device_t);
  204 static int      rtwn_shutdown(device_t);
  205 static int      rtwn_suspend(device_t);
  206 static int      rtwn_resume(device_t);
  207 
  208 static device_method_t rtwn_methods[] = {
  209         /* Device interface */
  210         DEVMETHOD(device_probe,         rtwn_probe),
  211         DEVMETHOD(device_attach,        rtwn_attach),
  212         DEVMETHOD(device_detach,        rtwn_detach),
  213         DEVMETHOD(device_shutdown,      rtwn_shutdown),
  214         DEVMETHOD(device_suspend,       rtwn_suspend),
  215         DEVMETHOD(device_resume,        rtwn_resume),
  216 
  217         DEVMETHOD_END
  218 };
  219 
  220 static driver_t rtwn_driver = {
  221         "rtwn",
  222         rtwn_methods,
  223         sizeof (struct rtwn_softc)
  224 };
  225 static devclass_t rtwn_devclass;
  226 
  227 DRIVER_MODULE(rtwn, pci, rtwn_driver, rtwn_devclass, NULL, NULL);
  228 
  229 MODULE_VERSION(rtwn, 1);
  230 
  231 MODULE_DEPEND(rtwn, pci,  1, 1, 1);
  232 MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
  233 MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
  234 
  235 static const uint8_t rtwn_chan_2ghz[] =
  236         { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
  237 
  238 static int
  239 rtwn_probe(device_t dev)
  240 {
  241         const struct rtwn_ident *ident;
  242 
  243         for (ident = rtwn_ident_table; ident->name != NULL; ident++) {
  244                 if (pci_get_vendor(dev) == ident->vendor &&
  245                     pci_get_device(dev) == ident->device) {
  246                         device_set_desc(dev, ident->name);
  247                         return (BUS_PROBE_DEFAULT);
  248                 }
  249         }
  250         return (ENXIO);
  251 }
  252 
  253 static int
  254 rtwn_attach(device_t dev)
  255 {
  256         struct rtwn_softc *sc = device_get_softc(dev);
  257         struct ieee80211com *ic = &sc->sc_ic;
  258         uint32_t lcsr;
  259         int i, count, error, rid;
  260 
  261         sc->sc_dev = dev;
  262         sc->sc_debug = 0;
  263 
  264         /*
  265          * Get the offset of the PCI Express Capability Structure in PCI
  266          * Configuration Space.
  267          */
  268         error = pci_find_cap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
  269         if (error != 0) {
  270                 device_printf(dev, "PCIe capability structure not found!\n");
  271                 return (error);
  272         }
  273 
  274         /* Enable bus-mastering. */
  275         pci_enable_busmaster(dev);
  276 
  277         rid = PCIR_BAR(2);
  278         sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
  279             RF_ACTIVE);
  280         if (sc->mem == NULL) {
  281                 device_printf(dev, "can't map mem space\n");
  282                 return (ENOMEM);
  283         }
  284         sc->sc_st = rman_get_bustag(sc->mem);
  285         sc->sc_sh = rman_get_bushandle(sc->mem);
  286 
  287         /* Install interrupt handler. */
  288         count = 1;
  289         rid = 0;
  290         if (pci_alloc_msi(dev, &count) == 0)
  291                 rid = 1;
  292         sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
  293             (rid != 0 ? 0 : RF_SHAREABLE));
  294         if (sc->irq == NULL) {
  295                 device_printf(dev, "can't map interrupt\n");
  296                 return (ENXIO);
  297         }
  298 
  299         RTWN_LOCK_INIT(sc);
  300         callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
  301         callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
  302         mbufq_init(&sc->sc_snd, ifqmaxlen);
  303 
  304         error = rtwn_read_chipid(sc);
  305         if (error != 0) {
  306                 device_printf(dev, "unsupported test chip\n");
  307                 goto fail;
  308         }
  309 
  310         /* Disable PCIe Active State Power Management (ASPM). */
  311         lcsr = pci_read_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, 4);
  312         lcsr &= ~PCIEM_LINK_CTL_ASPMC;
  313         pci_write_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, lcsr, 4);
  314 
  315         /* Allocate Tx/Rx buffers. */
  316         error = rtwn_alloc_rx_list(sc);
  317         if (error != 0) {
  318                 device_printf(dev, "could not allocate Rx buffers\n");
  319                 goto fail;
  320         }
  321         for (i = 0; i < RTWN_NTXQUEUES; i++) {
  322                 error = rtwn_alloc_tx_list(sc, i);
  323                 if (error != 0) {
  324                         device_printf(dev, "could not allocate Tx buffers\n");
  325                         goto fail;
  326                 }
  327         }
  328 
  329         /* Determine number of Tx/Rx chains. */
  330         if (sc->chip & RTWN_CHIP_92C) {
  331                 sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
  332                 sc->nrxchains = 2;
  333         } else {
  334                 sc->ntxchains = 1;
  335                 sc->nrxchains = 1;
  336         }
  337         rtwn_read_rom(sc);
  338 
  339         device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
  340             (sc->chip & RTWN_CHIP_92C) ? "8192CE" : "8188CE",
  341             sc->ntxchains, sc->nrxchains);
  342 
  343         ic->ic_softc = sc;
  344         ic->ic_name = device_get_nameunit(dev);
  345         ic->ic_opmode = IEEE80211_M_STA;
  346         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
  347 
  348         /* set device capabilities */
  349         ic->ic_caps =
  350                   IEEE80211_C_STA               /* station mode */
  351                 | IEEE80211_C_MONITOR           /* monitor mode */
  352                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
  353                 | IEEE80211_C_SHSLOT            /* short slot time supported */
  354                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
  355                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
  356                 | IEEE80211_C_WME               /* 802.11e */
  357                 ;
  358 
  359         /* XXX TODO: setup regdomain if R92C_CHANNEL_PLAN_BY_HW bit is set. */
  360 
  361         rtwn_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
  362             ic->ic_channels);
  363 
  364         ieee80211_ifattach(ic);
  365 
  366         ic->ic_wme.wme_update = rtwn_updateedca;
  367         ic->ic_update_mcast = rtwn_update_mcast;
  368         ic->ic_scan_start = rtwn_scan_start;
  369         ic->ic_scan_end = rtwn_scan_end;
  370         ic->ic_getradiocaps = rtwn_getradiocaps;
  371         ic->ic_set_channel = rtwn_set_channel;
  372         ic->ic_raw_xmit = rtwn_raw_xmit;
  373         ic->ic_transmit = rtwn_transmit;
  374         ic->ic_parent = rtwn_parent;
  375         ic->ic_vap_create = rtwn_vap_create;
  376         ic->ic_vap_delete = rtwn_vap_delete;
  377 
  378         ieee80211_radiotap_attach(ic,
  379             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
  380                 RTWN_TX_RADIOTAP_PRESENT,
  381             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
  382                 RTWN_RX_RADIOTAP_PRESENT);
  383 
  384         /*
  385          * Hook our interrupt after all initialization is complete.
  386          */
  387         error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
  388             NULL, rtwn_intr, sc, &sc->sc_ih);
  389         if (error != 0) {
  390                 device_printf(dev, "can't establish interrupt, error %d\n",
  391                     error);
  392                 goto fail;
  393         }
  394 
  395         if (bootverbose)
  396                 ieee80211_announce(ic);
  397 
  398         return (0);
  399 
  400 fail:
  401         rtwn_detach(dev);
  402         return (error);
  403 }
  404         
  405 
  406 static int
  407 rtwn_detach(device_t dev)
  408 {
  409         struct rtwn_softc *sc = device_get_softc(dev);
  410         int i;
  411 
  412         if (sc->sc_ic.ic_softc != NULL) {
  413                 rtwn_stop(sc);
  414 
  415                 callout_drain(&sc->calib_to);
  416                 callout_drain(&sc->watchdog_to);
  417                 ieee80211_ifdetach(&sc->sc_ic);
  418                 mbufq_drain(&sc->sc_snd);
  419         }
  420 
  421         /* Uninstall interrupt handler. */
  422         if (sc->irq != NULL) {
  423                 bus_teardown_intr(dev, sc->irq, sc->sc_ih);
  424                 bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
  425                     sc->irq);
  426                 pci_release_msi(dev);
  427         }
  428 
  429         /* Free Tx/Rx buffers. */
  430         for (i = 0; i < RTWN_NTXQUEUES; i++)
  431                 rtwn_free_tx_list(sc, i);
  432         rtwn_free_rx_list(sc);
  433 
  434         if (sc->mem != NULL)
  435                 bus_release_resource(dev, SYS_RES_MEMORY,
  436                     rman_get_rid(sc->mem), sc->mem);
  437 
  438         RTWN_LOCK_DESTROY(sc);
  439         return (0);
  440 }
  441 
  442 static int
  443 rtwn_shutdown(device_t dev)
  444 {
  445 
  446         return (0);
  447 }
  448 
  449 static int
  450 rtwn_suspend(device_t dev)
  451 {
  452         return (0);
  453 }
  454 
  455 static int
  456 rtwn_resume(device_t dev)
  457 {
  458 
  459         return (0);
  460 }
  461 
  462 static void
  463 rtwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
  464 {
  465 
  466         if (error != 0)
  467                 return;
  468         KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
  469         *(bus_addr_t *)arg = segs[0].ds_addr;
  470 }
  471 
  472 static void
  473 rtwn_setup_rx_desc(struct rtwn_softc *sc, struct r92c_rx_desc *desc,
  474     bus_addr_t addr, size_t len, int idx)
  475 {
  476 
  477         memset(desc, 0, sizeof(*desc));
  478         desc->rxdw0 = htole32(SM(R92C_RXDW0_PKTLEN, len) |
  479                 ((idx == RTWN_RX_LIST_COUNT - 1) ? R92C_RXDW0_EOR : 0));
  480         desc->rxbufaddr = htole32(addr);
  481         bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
  482             BUS_SPACE_BARRIER_WRITE);
  483         desc->rxdw0 |= htole32(R92C_RXDW0_OWN);
  484 }
  485 
  486 static int
  487 rtwn_alloc_rx_list(struct rtwn_softc *sc)
  488 {
  489         struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
  490         struct rtwn_rx_data *rx_data;
  491         bus_size_t size;
  492         int i, error;
  493 
  494         /* Allocate Rx descriptors. */
  495         size = sizeof(struct r92c_rx_desc) * RTWN_RX_LIST_COUNT;
  496         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
  497             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
  498             size, 1, size, 0, NULL, NULL, &rx_ring->desc_dmat);
  499         if (error != 0) {
  500                 device_printf(sc->sc_dev, "could not create rx desc DMA tag\n");
  501                 goto fail;
  502         }
  503 
  504         error = bus_dmamem_alloc(rx_ring->desc_dmat, (void **)&rx_ring->desc,
  505             BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT,
  506             &rx_ring->desc_map);
  507         if (error != 0) {
  508                 device_printf(sc->sc_dev, "could not allocate rx desc\n");
  509                 goto fail;
  510         }
  511         error = bus_dmamap_load(rx_ring->desc_dmat, rx_ring->desc_map,
  512             rx_ring->desc, size, rtwn_dma_map_addr, &rx_ring->paddr, 0);
  513         if (error != 0) {
  514                 device_printf(sc->sc_dev, "could not load rx desc DMA map\n");
  515                 goto fail;
  516         }
  517         bus_dmamap_sync(rx_ring->desc_dmat, rx_ring->desc_map,
  518             BUS_DMASYNC_PREWRITE);
  519 
  520         /* Create RX buffer DMA tag. */
  521         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
  522             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
  523             1, MCLBYTES, 0, NULL, NULL, &rx_ring->data_dmat);
  524         if (error != 0) {
  525                 device_printf(sc->sc_dev, "could not create rx buf DMA tag\n");
  526                 goto fail;
  527         }
  528 
  529         /* Allocate Rx buffers. */
  530         for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
  531                 rx_data = &rx_ring->rx_data[i];
  532                 error = bus_dmamap_create(rx_ring->data_dmat, 0, &rx_data->map);
  533                 if (error != 0) {
  534                         device_printf(sc->sc_dev,
  535                             "could not create rx buf DMA map\n");
  536                         goto fail;
  537                 }
  538 
  539                 rx_data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
  540                 if (rx_data->m == NULL) {
  541                         device_printf(sc->sc_dev,
  542                             "could not allocate rx mbuf\n");
  543                         error = ENOMEM;
  544                         goto fail;
  545                 }
  546 
  547                 error = bus_dmamap_load(rx_ring->data_dmat, rx_data->map,
  548                     mtod(rx_data->m, void *), MCLBYTES, rtwn_dma_map_addr,
  549                     &rx_data->paddr, BUS_DMA_NOWAIT);
  550                 if (error != 0) {
  551                         device_printf(sc->sc_dev,
  552                             "could not load rx buf DMA map");
  553                         goto fail;
  554                 }
  555 
  556                 rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
  557                     MCLBYTES, i);
  558         }
  559         return (0);
  560 
  561 fail:
  562         rtwn_free_rx_list(sc);
  563         return (error);
  564 }
  565 
  566 static void
  567 rtwn_reset_rx_list(struct rtwn_softc *sc)
  568 {
  569         struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
  570         struct rtwn_rx_data *rx_data;
  571         int i;
  572 
  573         for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
  574                 rx_data = &rx_ring->rx_data[i];
  575                 rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
  576                     MCLBYTES, i);
  577         }
  578 }
  579 
  580 static void
  581 rtwn_free_rx_list(struct rtwn_softc *sc)
  582 {
  583         struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
  584         struct rtwn_rx_data *rx_data;
  585         int i;
  586 
  587         if (rx_ring->desc_dmat != NULL) {
  588                 if (rx_ring->desc != NULL) {
  589                         bus_dmamap_sync(rx_ring->desc_dmat,
  590                             rx_ring->desc_map,
  591                             BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
  592                         bus_dmamap_unload(rx_ring->desc_dmat,
  593                             rx_ring->desc_map);
  594                         bus_dmamem_free(rx_ring->desc_dmat, rx_ring->desc,
  595                             rx_ring->desc_map);
  596                         rx_ring->desc = NULL;
  597                 }
  598                 bus_dma_tag_destroy(rx_ring->desc_dmat);
  599                 rx_ring->desc_dmat = NULL;
  600         }
  601 
  602         for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
  603                 rx_data = &rx_ring->rx_data[i];
  604 
  605                 if (rx_data->m != NULL) {
  606                         bus_dmamap_sync(rx_ring->data_dmat,
  607                             rx_data->map, BUS_DMASYNC_POSTREAD);
  608                         bus_dmamap_unload(rx_ring->data_dmat, rx_data->map);
  609                         m_freem(rx_data->m);
  610                         rx_data->m = NULL;
  611                 }
  612                 bus_dmamap_destroy(rx_ring->data_dmat, rx_data->map);
  613                 rx_data->map = NULL;
  614         }
  615         if (rx_ring->data_dmat != NULL) {
  616                 bus_dma_tag_destroy(rx_ring->data_dmat);
  617                 rx_ring->data_dmat = NULL;
  618         }
  619 }
  620 
  621 static int
  622 rtwn_alloc_tx_list(struct rtwn_softc *sc, int qid)
  623 {
  624         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
  625         struct rtwn_tx_data *tx_data;
  626         bus_size_t size;
  627         int i, error;
  628 
  629         size = sizeof(struct r92c_tx_desc) * RTWN_TX_LIST_COUNT;
  630         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), PAGE_SIZE, 0,
  631             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
  632             size, 1, size, 0, NULL, NULL, &tx_ring->desc_dmat);
  633         if (error != 0) {
  634                 device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
  635                 goto fail;
  636         }
  637 
  638         error = bus_dmamem_alloc(tx_ring->desc_dmat, (void **)&tx_ring->desc,
  639             BUS_DMA_NOWAIT | BUS_DMA_ZERO, &tx_ring->desc_map);
  640         if (error != 0) {
  641                 device_printf(sc->sc_dev, "can't map tx ring DMA memory\n");
  642                 goto fail;
  643         }
  644         error = bus_dmamap_load(tx_ring->desc_dmat, tx_ring->desc_map,
  645             tx_ring->desc, size, rtwn_dma_map_addr, &tx_ring->paddr,
  646             BUS_DMA_NOWAIT);
  647         if (error != 0) {
  648                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
  649                 goto fail;
  650         }
  651         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
  652             BUS_DMASYNC_PREWRITE);
  653 
  654         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
  655             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
  656             1, MCLBYTES, 0, NULL, NULL, &tx_ring->data_dmat);
  657         if (error != 0) {
  658                 device_printf(sc->sc_dev, "could not create tx buf DMA tag\n");
  659                 goto fail;
  660         }
  661 
  662         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
  663                 struct r92c_tx_desc *desc = &tx_ring->desc[i];
  664 
  665                 /* setup tx desc */
  666                 desc->nextdescaddr = htole32(tx_ring->paddr +
  667                     + sizeof(struct r92c_tx_desc)
  668                     * ((i + 1) % RTWN_TX_LIST_COUNT));
  669                 tx_data = &tx_ring->tx_data[i];
  670                 error = bus_dmamap_create(tx_ring->data_dmat, 0, &tx_data->map);
  671                 if (error != 0) {
  672                         device_printf(sc->sc_dev,
  673                             "could not create tx buf DMA map\n");
  674                         goto fail;
  675                 }
  676                 tx_data->m = NULL;
  677                 tx_data->ni = NULL;
  678         }
  679         return (0);
  680 
  681 fail:
  682         rtwn_free_tx_list(sc, qid);
  683         return (error);
  684 }
  685 
  686 static void
  687 rtwn_reset_tx_list(struct rtwn_softc *sc, int qid)
  688 {
  689         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
  690         int i;
  691 
  692         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
  693                 struct r92c_tx_desc *desc = &tx_ring->desc[i];
  694                 struct rtwn_tx_data *tx_data = &tx_ring->tx_data[i];
  695 
  696                 memset(desc, 0, sizeof(*desc) -
  697                     (sizeof(desc->reserved) + sizeof(desc->nextdescaddr64) +
  698                     sizeof(desc->nextdescaddr)));
  699 
  700                 if (tx_data->m != NULL) {
  701                         bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
  702                             BUS_DMASYNC_POSTWRITE);
  703                         bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
  704                         m_freem(tx_data->m);
  705                         tx_data->m = NULL;
  706                 }
  707                 if (tx_data->ni != NULL) {
  708                         ieee80211_free_node(tx_data->ni);
  709                         tx_data->ni = NULL;
  710                 }
  711         }
  712 
  713         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
  714             BUS_DMASYNC_POSTWRITE);
  715 
  716         sc->qfullmsk &= ~(1 << qid);
  717         tx_ring->queued = 0;
  718         tx_ring->cur = 0;
  719 }
  720 
  721 static void
  722 rtwn_free_tx_list(struct rtwn_softc *sc, int qid)
  723 {
  724         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
  725         struct rtwn_tx_data *tx_data;
  726         int i;
  727 
  728         if (tx_ring->desc_dmat != NULL) {
  729                 if (tx_ring->desc != NULL) {
  730                         bus_dmamap_sync(tx_ring->desc_dmat,
  731                             tx_ring->desc_map, BUS_DMASYNC_POSTWRITE);
  732                         bus_dmamap_unload(tx_ring->desc_dmat,
  733                             tx_ring->desc_map);
  734                         bus_dmamem_free(tx_ring->desc_dmat, tx_ring->desc,
  735                             tx_ring->desc_map);
  736                 }
  737                 bus_dma_tag_destroy(tx_ring->desc_dmat);
  738         }
  739 
  740         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
  741                 tx_data = &tx_ring->tx_data[i];
  742 
  743                 if (tx_data->m != NULL) {
  744                         bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
  745                             BUS_DMASYNC_POSTWRITE);
  746                         bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
  747                         m_freem(tx_data->m);
  748                         tx_data->m = NULL;
  749                 }
  750         }
  751         if (tx_ring->data_dmat != NULL) {
  752                 bus_dma_tag_destroy(tx_ring->data_dmat);
  753                 tx_ring->data_dmat = NULL;
  754         }
  755 
  756         sc->qfullmsk &= ~(1 << qid);
  757         tx_ring->queued = 0;
  758         tx_ring->cur = 0;
  759 }
  760 
  761 
  762 static struct ieee80211vap *
  763 rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
  764     enum ieee80211_opmode opmode, int flags,
  765     const uint8_t bssid[IEEE80211_ADDR_LEN],
  766     const uint8_t mac[IEEE80211_ADDR_LEN])
  767 {
  768         struct rtwn_vap *rvp;
  769         struct ieee80211vap *vap;
  770 
  771         if (!TAILQ_EMPTY(&ic->ic_vaps))
  772                 return (NULL);
  773 
  774         rvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
  775         vap = &rvp->vap;
  776         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
  777             flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
  778                 /* out of memory */
  779                  free(rvp, M_80211_VAP);
  780                  return (NULL);
  781         }
  782 
  783         /* Override state transition machine. */
  784         rvp->newstate = vap->iv_newstate;
  785         vap->iv_newstate = rtwn_newstate;
  786 
  787         /* Complete setup. */
  788         ieee80211_vap_attach(vap, ieee80211_media_change,
  789             ieee80211_media_status, mac);
  790         ic->ic_opmode = opmode;
  791         return (vap);
  792 }
  793 
  794 static void
  795 rtwn_vap_delete(struct ieee80211vap *vap)
  796 {
  797         struct rtwn_vap *rvp = RTWN_VAP(vap);
  798 
  799         ieee80211_vap_detach(vap);
  800         free(rvp, M_80211_VAP);
  801 }
  802 
  803 static void
  804 rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
  805 {
  806 
  807         bus_space_write_1(sc->sc_st, sc->sc_sh, addr, val);
  808 }
  809 
  810 static void
  811 rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
  812 {
  813 
  814         val = htole16(val);
  815         bus_space_write_2(sc->sc_st, sc->sc_sh, addr, val);
  816 }
  817 
  818 static void
  819 rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
  820 {
  821 
  822         val = htole32(val);
  823         bus_space_write_4(sc->sc_st, sc->sc_sh, addr, val);
  824 }
  825 
  826 static uint8_t
  827 rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
  828 {
  829 
  830         return (bus_space_read_1(sc->sc_st, sc->sc_sh, addr));
  831 }
  832 
  833 static uint16_t
  834 rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
  835 {
  836 
  837         return (bus_space_read_2(sc->sc_st, sc->sc_sh, addr));
  838 }
  839 
  840 static uint32_t
  841 rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
  842 {
  843 
  844         return (bus_space_read_4(sc->sc_st, sc->sc_sh, addr));
  845 }
  846 
  847 static int
  848 rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
  849 {
  850         struct r92c_fw_cmd cmd;
  851         int ntries;
  852 
  853         /* Wait for current FW box to be empty. */
  854         for (ntries = 0; ntries < 100; ntries++) {
  855                 if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
  856                         break;
  857                 DELAY(1);
  858         }
  859         if (ntries == 100) {
  860                 device_printf(sc->sc_dev,
  861                     "could not send firmware command %d\n", id);
  862                 return (ETIMEDOUT);
  863         }
  864         memset(&cmd, 0, sizeof(cmd));
  865         cmd.id = id;
  866         if (len > 3)
  867                 cmd.id |= R92C_CMD_FLAG_EXT;
  868         KASSERT(len <= sizeof(cmd.msg), ("rtwn_fw_cmd\n"));
  869         memcpy(cmd.msg, buf, len);
  870 
  871         /* Write the first word last since that will trigger the FW. */
  872         rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur), *((uint8_t *)&cmd + 4));
  873         rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
  874 
  875         sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
  876 
  877         /* Give firmware some time for processing. */
  878         DELAY(2000);
  879 
  880         return (0);
  881 }
  882 
  883 static void
  884 rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
  885 {
  886         rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
  887             SM(R92C_LSSI_PARAM_ADDR, addr) |
  888             SM(R92C_LSSI_PARAM_DATA, val));
  889 }
  890 
  891 static uint32_t
  892 rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
  893 {
  894         uint32_t reg[R92C_MAX_CHAINS], val;
  895 
  896         reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
  897         if (chain != 0)
  898                 reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
  899 
  900         rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
  901             reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
  902         DELAY(1000);
  903 
  904         rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
  905             RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
  906             R92C_HSSI_PARAM2_READ_EDGE);
  907         DELAY(1000);
  908 
  909         rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
  910             reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
  911         DELAY(1000);
  912 
  913         if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
  914                 val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
  915         else
  916                 val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
  917         return (MS(val, R92C_LSSI_READBACK_DATA));
  918 }
  919 
  920 static int
  921 rtwn_llt_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
  922 {
  923         int ntries;
  924 
  925         rtwn_write_4(sc, R92C_LLT_INIT,
  926             SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
  927             SM(R92C_LLT_INIT_ADDR, addr) |
  928             SM(R92C_LLT_INIT_DATA, data));
  929         /* Wait for write operation to complete. */
  930         for (ntries = 0; ntries < 20; ntries++) {
  931                 if (MS(rtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
  932                     R92C_LLT_INIT_OP_NO_ACTIVE)
  933                         return (0);
  934                 DELAY(5);
  935         }
  936         return (ETIMEDOUT);
  937 }
  938 
  939 static uint8_t
  940 rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
  941 {
  942         uint32_t reg;
  943         int ntries;
  944 
  945         reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
  946         reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
  947         reg &= ~R92C_EFUSE_CTRL_VALID;
  948         rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
  949         /* Wait for read operation to complete. */
  950         for (ntries = 0; ntries < 100; ntries++) {
  951                 reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
  952                 if (reg & R92C_EFUSE_CTRL_VALID)
  953                         return (MS(reg, R92C_EFUSE_CTRL_DATA));
  954                 DELAY(5);
  955         }
  956         device_printf(sc->sc_dev,
  957             "could not read efuse byte at address 0x%x\n", addr);
  958         return (0xff);
  959 }
  960 
  961 static void
  962 rtwn_efuse_read(struct rtwn_softc *sc)
  963 {
  964         uint8_t *rom = (uint8_t *)&sc->rom;
  965         uint16_t addr = 0;
  966         uint32_t reg;
  967         uint8_t off, msk;
  968         int i;
  969 
  970         reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
  971         if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
  972                 rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
  973                     reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
  974         }
  975         reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
  976         if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
  977                 rtwn_write_2(sc, R92C_SYS_FUNC_EN,
  978                     reg | R92C_SYS_FUNC_EN_ELDR);
  979         }
  980         reg = rtwn_read_2(sc, R92C_SYS_CLKR);
  981         if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
  982             (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
  983                 rtwn_write_2(sc, R92C_SYS_CLKR,
  984                     reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
  985         }
  986         memset(&sc->rom, 0xff, sizeof(sc->rom));
  987         while (addr < 512) {
  988                 reg = rtwn_efuse_read_1(sc, addr);
  989                 if (reg == 0xff)
  990                         break;
  991                 addr++;
  992                 off = reg >> 4;
  993                 msk = reg & 0xf;
  994                 for (i = 0; i < 4; i++) {
  995                         if (msk & (1 << i))
  996                                 continue;
  997                         rom[off * 8 + i * 2 + 0] =
  998                             rtwn_efuse_read_1(sc, addr);
  999                         addr++;
 1000                         rom[off * 8 + i * 2 + 1] =
 1001                             rtwn_efuse_read_1(sc, addr);
 1002                         addr++;
 1003                 }
 1004         }
 1005 #ifdef RTWN_DEBUG
 1006         if (sc->sc_debug >= 2) {
 1007                 /* Dump ROM content. */
 1008                 printf("\n");
 1009                 for (i = 0; i < sizeof(sc->rom); i++)
 1010                         printf("%02x:", rom[i]);
 1011                 printf("\n");
 1012         }
 1013 #endif
 1014 }
 1015 
 1016 static int
 1017 rtwn_read_chipid(struct rtwn_softc *sc)
 1018 {
 1019         uint32_t reg;
 1020 
 1021         reg = rtwn_read_4(sc, R92C_SYS_CFG);
 1022         if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
 1023                 /* Unsupported test chip. */
 1024                 return (EIO);
 1025 
 1026         if (reg & R92C_SYS_CFG_TYPE_92C) {
 1027                 sc->chip |= RTWN_CHIP_92C;
 1028                 /* Check if it is a castrated 8192C. */
 1029                 if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
 1030                     R92C_HPON_FSM_CHIP_BONDING_ID) ==
 1031                     R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
 1032                         sc->chip |= RTWN_CHIP_92C_1T2R;
 1033         }
 1034         if (reg & R92C_SYS_CFG_VENDOR_UMC) {
 1035                 sc->chip |= RTWN_CHIP_UMC;
 1036                 if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
 1037                         sc->chip |= RTWN_CHIP_UMC_A_CUT;
 1038         }
 1039         return (0);
 1040 }
 1041 
 1042 static void
 1043 rtwn_read_rom(struct rtwn_softc *sc)
 1044 {
 1045         struct r92c_rom *rom = &sc->rom;
 1046 
 1047         /* Read full ROM image. */
 1048         rtwn_efuse_read(sc);
 1049 
 1050         if (rom->id != 0x8129)
 1051                 device_printf(sc->sc_dev, "invalid EEPROM ID 0x%x\n", rom->id);
 1052 
 1053         /* XXX Weird but this is what the vendor driver does. */
 1054         sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
 1055         DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
 1056 
 1057         sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
 1058 
 1059         sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
 1060         DPRINTF(("regulatory type=%d\n", sc->regulatory));
 1061 
 1062         IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
 1063 }
 1064 
 1065 static __inline uint8_t
 1066 rate2ridx(uint8_t rate)
 1067 {
 1068         switch (rate) {
 1069         case 12:        return 4;
 1070         case 18:        return 5;
 1071         case 24:        return 6;
 1072         case 36:        return 7;
 1073         case 48:        return 8;
 1074         case 72:        return 9;
 1075         case 96:        return 10;
 1076         case 108:       return 11;
 1077         case 2:         return 0;
 1078         case 4:         return 1;
 1079         case 11:        return 2;
 1080         case 22:        return 3;
 1081         default:        return RTWN_RIDX_UNKNOWN;
 1082         }
 1083 }
 1084 
 1085 /*
 1086  * Initialize rate adaptation in firmware.
 1087  */
 1088 static int
 1089 rtwn_ra_init(struct rtwn_softc *sc)
 1090 {
 1091         struct ieee80211com *ic = &sc->sc_ic;
 1092         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 1093         struct ieee80211_node *ni = ieee80211_ref_node(vap->iv_bss);
 1094         struct ieee80211_rateset *rs = &ni->ni_rates;
 1095         struct r92c_fw_cmd_macid_cfg cmd;
 1096         uint32_t rates, basicrates;
 1097         uint8_t maxrate, maxbasicrate, mode, ridx;
 1098         int error, i;
 1099 
 1100         /* Get normal and basic rates mask. */
 1101         rates = basicrates = 0;
 1102         maxrate = maxbasicrate = 0;
 1103         for (i = 0; i < rs->rs_nrates; i++) {
 1104                 /* Convert 802.11 rate to HW rate index. */
 1105                 ridx = rate2ridx(IEEE80211_RV(rs->rs_rates[i]));
 1106                 if (ridx == RTWN_RIDX_UNKNOWN)  /* Unknown rate, skip. */
 1107                         continue;
 1108                 rates |= 1 << ridx;
 1109                 if (ridx > maxrate)
 1110                         maxrate = ridx;
 1111                 if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
 1112                         basicrates |= 1 << ridx;
 1113                         if (ridx > maxbasicrate)
 1114                                 maxbasicrate = ridx;
 1115                 }
 1116         }
 1117         if (ic->ic_curmode == IEEE80211_MODE_11B)
 1118                 mode = R92C_RAID_11B;
 1119         else
 1120                 mode = R92C_RAID_11BG;
 1121         DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
 1122             mode, rates, basicrates));
 1123 
 1124         /* Set rates mask for group addressed frames. */
 1125         cmd.macid = RTWN_MACID_BC | RTWN_MACID_VALID;
 1126         cmd.mask = htole32(mode << 28 | basicrates);
 1127         error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
 1128         if (error != 0) {
 1129                 device_printf(sc->sc_dev,
 1130                     "could not add broadcast station\n");
 1131                 return (error);
 1132         }
 1133         /* Set initial MRR rate. */
 1134         DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
 1135         rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BC),
 1136             maxbasicrate);
 1137 
 1138         /* Set rates mask for unicast frames. */
 1139         cmd.macid = RTWN_MACID_BSS | RTWN_MACID_VALID;
 1140         cmd.mask = htole32(mode << 28 | rates);
 1141         error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
 1142         if (error != 0) {
 1143                 device_printf(sc->sc_dev, "could not add BSS station\n");
 1144                 return (error);
 1145         }
 1146         /* Set initial MRR rate. */
 1147         DPRINTF(("maxrate=%d\n", maxrate));
 1148         rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BSS),
 1149             maxrate);
 1150 
 1151         /* Configure Automatic Rate Fallback Register. */
 1152         if (ic->ic_curmode == IEEE80211_MODE_11B) {
 1153                 if (rates & 0x0c)
 1154                         rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0d));
 1155                 else
 1156                         rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0f));
 1157         } else
 1158                 rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0ff5));
 1159 
 1160         /* Indicate highest supported rate. */
 1161         ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
 1162         return (0);
 1163 }
 1164 
 1165 static void
 1166 rtwn_tsf_sync_enable(struct rtwn_softc *sc)
 1167 {
 1168         struct ieee80211com *ic = &sc->sc_ic;
 1169         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 1170         struct ieee80211_node *ni = vap->iv_bss;
 1171         uint64_t tsf;
 1172 
 1173         /* Enable TSF synchronization. */
 1174         rtwn_write_1(sc, R92C_BCN_CTRL,
 1175             rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
 1176 
 1177         rtwn_write_1(sc, R92C_BCN_CTRL,
 1178             rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
 1179 
 1180         /* Set initial TSF. */
 1181         memcpy(&tsf, ni->ni_tstamp.data, 8);
 1182         tsf = le64toh(tsf);
 1183         tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
 1184         tsf -= IEEE80211_DUR_TU;
 1185         rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
 1186         rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
 1187 
 1188         rtwn_write_1(sc, R92C_BCN_CTRL,
 1189             rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
 1190 }
 1191 
 1192 static void
 1193 rtwn_set_led(struct rtwn_softc *sc, int led, int on)
 1194 {
 1195         uint8_t reg;
 1196 
 1197         if (led == RTWN_LED_LINK) {
 1198                 reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
 1199                 if (!on)
 1200                         reg |= R92C_LEDCFG2_DIS;
 1201                 else
 1202                         reg |= R92C_LEDCFG2_EN;
 1203                 rtwn_write_1(sc, R92C_LEDCFG2, reg);
 1204                 sc->ledlink = on;       /* Save LED state. */
 1205         }
 1206 }
 1207 
 1208 static void
 1209 rtwn_calib_to(void *arg)
 1210 {
 1211         struct rtwn_softc *sc = arg;
 1212         struct r92c_fw_cmd_rssi cmd;
 1213 
 1214         if (sc->avg_pwdb != -1) {
 1215                 /* Indicate Rx signal strength to FW for rate adaptation. */
 1216                 memset(&cmd, 0, sizeof(cmd));
 1217                 cmd.macid = 0;  /* BSS. */
 1218                 cmd.pwdb = sc->avg_pwdb;
 1219                 DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
 1220                 rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
 1221         }
 1222 
 1223         /* Do temperature compensation. */
 1224         rtwn_temp_calib(sc);
 1225 
 1226         callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
 1227 }
 1228 
 1229 static int
 1230 rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
 1231 {
 1232         struct rtwn_vap *rvp = RTWN_VAP(vap);
 1233         struct ieee80211com *ic = vap->iv_ic;
 1234         struct ieee80211_node *ni = vap->iv_bss;
 1235         struct rtwn_softc *sc = ic->ic_softc;
 1236         uint32_t reg;
 1237 
 1238         IEEE80211_UNLOCK(ic);
 1239         RTWN_LOCK(sc);
 1240 
 1241         if (vap->iv_state == IEEE80211_S_RUN) {
 1242                 /* Stop calibration. */
 1243                 callout_stop(&sc->calib_to);
 1244 
 1245                 /* Turn link LED off. */
 1246                 rtwn_set_led(sc, RTWN_LED_LINK, 0);
 1247 
 1248                 /* Set media status to 'No Link'. */
 1249                 reg = rtwn_read_4(sc, R92C_CR);
 1250                 reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
 1251                 rtwn_write_4(sc, R92C_CR, reg);
 1252 
 1253                 /* Stop Rx of data frames. */
 1254                 rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
 1255 
 1256                 /* Rest TSF. */
 1257                 rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
 1258 
 1259                 /* Disable TSF synchronization. */
 1260                 rtwn_write_1(sc, R92C_BCN_CTRL,
 1261                     rtwn_read_1(sc, R92C_BCN_CTRL) |
 1262                     R92C_BCN_CTRL_DIS_TSF_UDT0);
 1263 
 1264                 /* Reset EDCA parameters. */
 1265                 rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
 1266                 rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
 1267                 rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
 1268                 rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
 1269         }
 1270         switch (nstate) {
 1271         case IEEE80211_S_INIT:
 1272                 /* Turn link LED off. */
 1273                 rtwn_set_led(sc, RTWN_LED_LINK, 0);
 1274                 break;
 1275         case IEEE80211_S_SCAN:
 1276                 /* Make link LED blink during scan. */
 1277                 rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
 1278 
 1279                 /* Pause AC Tx queues. */
 1280                 rtwn_write_1(sc, R92C_TXPAUSE,
 1281                     rtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
 1282                 break;
 1283         case IEEE80211_S_AUTH:
 1284                 rtwn_set_chan(sc, ic->ic_curchan, NULL);
 1285                 break;
 1286         case IEEE80211_S_RUN:
 1287                 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
 1288                         /* Enable Rx of data frames. */
 1289                         rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
 1290 
 1291                         /* Turn link LED on. */
 1292                         rtwn_set_led(sc, RTWN_LED_LINK, 1);
 1293                         break;
 1294                 }
 1295 
 1296                 /* Set media status to 'Associated'. */
 1297                 reg = rtwn_read_4(sc, R92C_CR);
 1298                 reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
 1299                 rtwn_write_4(sc, R92C_CR, reg);
 1300 
 1301                 /* Set BSSID. */
 1302                 rtwn_write_4(sc, R92C_BSSID + 0, le32dec(&ni->ni_bssid[0]));
 1303                 rtwn_write_4(sc, R92C_BSSID + 4, le16dec(&ni->ni_bssid[4]));
 1304 
 1305                 if (ic->ic_curmode == IEEE80211_MODE_11B)
 1306                         rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
 1307                 else    /* 802.11b/g */
 1308                         rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
 1309 
 1310                 /* Enable Rx of data frames. */
 1311                 rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
 1312 
 1313                 /* Flush all AC queues. */
 1314                 rtwn_write_1(sc, R92C_TXPAUSE, 0);
 1315 
 1316                 /* Set beacon interval. */
 1317                 rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
 1318 
 1319                 /* Allow Rx from our BSSID only. */
 1320                 rtwn_write_4(sc, R92C_RCR,
 1321                     rtwn_read_4(sc, R92C_RCR) |
 1322                     R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
 1323 
 1324                 /* Enable TSF synchronization. */
 1325                 rtwn_tsf_sync_enable(sc);
 1326 
 1327                 rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
 1328                 rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
 1329                 rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
 1330                 rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
 1331                 rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
 1332                 rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
 1333 
 1334                 /* Intialize rate adaptation. */
 1335                 rtwn_ra_init(sc);
 1336                 /* Turn link LED on. */
 1337                 rtwn_set_led(sc, RTWN_LED_LINK, 1);
 1338 
 1339                 sc->avg_pwdb = -1;      /* Reset average RSSI. */
 1340                 /* Reset temperature calibration state machine. */
 1341                 sc->thcal_state = 0;
 1342                 sc->thcal_lctemp = 0;
 1343                 /* Start periodic calibration. */
 1344                 callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
 1345                 break;
 1346         default:
 1347                 break;
 1348         }
 1349         RTWN_UNLOCK(sc);
 1350         IEEE80211_LOCK(ic);
 1351         return (rvp->newstate(vap, nstate, arg));
 1352 }
 1353 
 1354 static int
 1355 rtwn_updateedca(struct ieee80211com *ic)
 1356 {
 1357         struct rtwn_softc *sc = ic->ic_softc;
 1358         const uint16_t aci2reg[WME_NUM_AC] = {
 1359                 R92C_EDCA_BE_PARAM,
 1360                 R92C_EDCA_BK_PARAM,
 1361                 R92C_EDCA_VI_PARAM,
 1362                 R92C_EDCA_VO_PARAM
 1363         };
 1364         int aci, aifs, slottime;
 1365 
 1366         IEEE80211_LOCK(ic);
 1367         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
 1368         for (aci = 0; aci < WME_NUM_AC; aci++) {
 1369                 const struct wmeParams *ac =
 1370                     &ic->ic_wme.wme_chanParams.cap_wmeParams[aci];
 1371                 /* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
 1372                 aifs = ac->wmep_aifsn * slottime + 10;
 1373                 rtwn_write_4(sc, aci2reg[aci],
 1374                     SM(R92C_EDCA_PARAM_TXOP, ac->wmep_txopLimit) |
 1375                     SM(R92C_EDCA_PARAM_ECWMIN, ac->wmep_logcwmin) |
 1376                     SM(R92C_EDCA_PARAM_ECWMAX, ac->wmep_logcwmax) |
 1377                     SM(R92C_EDCA_PARAM_AIFS, aifs));
 1378         }
 1379         IEEE80211_UNLOCK(ic);
 1380         return (0);
 1381 }
 1382 
 1383 static void
 1384 rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
 1385 {
 1386         int pwdb;
 1387 
 1388         /* Convert antenna signal to percentage. */
 1389         if (rssi <= -100 || rssi >= 20)
 1390                 pwdb = 0;
 1391         else if (rssi >= 0)
 1392                 pwdb = 100;
 1393         else
 1394                 pwdb = 100 + rssi;
 1395         if (RTWN_RATE_IS_CCK(rate)) {
 1396                 /* CCK gain is smaller than OFDM/MCS gain. */
 1397                 pwdb += 6;
 1398                 if (pwdb > 100)
 1399                         pwdb = 100;
 1400                 if (pwdb <= 14)
 1401                         pwdb -= 4;
 1402                 else if (pwdb <= 26)
 1403                         pwdb -= 8;
 1404                 else if (pwdb <= 34)
 1405                         pwdb -= 6;
 1406                 else if (pwdb <= 42)
 1407                         pwdb -= 2;
 1408         }
 1409         if (sc->avg_pwdb == -1) /* Init. */
 1410                 sc->avg_pwdb = pwdb;
 1411         else if (sc->avg_pwdb < pwdb)
 1412                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
 1413         else
 1414                 sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
 1415         DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
 1416 }
 1417 
 1418 static int8_t
 1419 rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
 1420 {
 1421         static const int8_t cckoff[] = { 16, -12, -26, -46 };
 1422         struct r92c_rx_phystat *phy;
 1423         struct r92c_rx_cck *cck;
 1424         uint8_t rpt;
 1425         int8_t rssi;
 1426 
 1427         if (RTWN_RATE_IS_CCK(rate)) {
 1428                 cck = (struct r92c_rx_cck *)physt;
 1429                 if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
 1430                         rpt = (cck->agc_rpt >> 5) & 0x3;
 1431                         rssi = (cck->agc_rpt & 0x1f) << 1;
 1432                 } else {
 1433                         rpt = (cck->agc_rpt >> 6) & 0x3;
 1434                         rssi = cck->agc_rpt & 0x3e;
 1435                 }
 1436                 rssi = cckoff[rpt] - rssi;
 1437         } else {        /* OFDM/HT. */
 1438                 phy = (struct r92c_rx_phystat *)physt;
 1439                 rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
 1440         }
 1441         return (rssi);
 1442 }
 1443 
 1444 static void
 1445 rtwn_rx_frame(struct rtwn_softc *sc, struct r92c_rx_desc *rx_desc,
 1446     struct rtwn_rx_data *rx_data, int desc_idx)
 1447 {
 1448         struct ieee80211com *ic = &sc->sc_ic;
 1449         struct ieee80211_frame_min *wh;
 1450         struct ieee80211_node *ni;
 1451         struct r92c_rx_phystat *phy = NULL;
 1452         uint32_t rxdw0, rxdw3;
 1453         struct mbuf *m, *m1;
 1454         bus_dma_segment_t segs[1];
 1455         bus_addr_t physaddr;
 1456         uint8_t rate;
 1457         int8_t rssi = 0, nf;
 1458         int infosz, nsegs, pktlen, shift, error;
 1459 
 1460         rxdw0 = le32toh(rx_desc->rxdw0);
 1461         rxdw3 = le32toh(rx_desc->rxdw3);
 1462 
 1463         if (__predict_false(rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR))) {
 1464                 /*
 1465                  * This should not happen since we setup our Rx filter
 1466                  * to not receive these frames.
 1467                  */
 1468                 counter_u64_add(ic->ic_ierrors, 1);
 1469                 return;
 1470         }
 1471 
 1472         pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
 1473         if (__predict_false(pktlen < sizeof(struct ieee80211_frame_ack) ||
 1474             pktlen > MCLBYTES)) {
 1475                 counter_u64_add(ic->ic_ierrors, 1);
 1476                 return;
 1477         }
 1478 
 1479         rate = MS(rxdw3, R92C_RXDW3_RATE);
 1480         infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
 1481         if (infosz > sizeof(struct r92c_rx_phystat))
 1482                 infosz = sizeof(struct r92c_rx_phystat);
 1483         shift = MS(rxdw0, R92C_RXDW0_SHIFT);
 1484 
 1485         /* Get RSSI from PHY status descriptor if present. */
 1486         if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
 1487                 phy = mtod(rx_data->m, struct r92c_rx_phystat *);
 1488                 rssi = rtwn_get_rssi(sc, rate, phy);
 1489                 /* Update our average RSSI. */
 1490                 rtwn_update_avgrssi(sc, rate, rssi);
 1491         }
 1492 
 1493         DPRINTFN(5, ("Rx frame len=%d rate=%d infosz=%d shift=%d rssi=%d\n",
 1494             pktlen, rate, infosz, shift, rssi));
 1495 
 1496         m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 1497         if (m1 == NULL) {
 1498                 counter_u64_add(ic->ic_ierrors, 1);
 1499                 return;
 1500         }
 1501         bus_dmamap_unload(sc->rx_ring.data_dmat, rx_data->map);
 1502 
 1503         error = bus_dmamap_load(sc->rx_ring.data_dmat, rx_data->map,
 1504              mtod(m1, void *), MCLBYTES, rtwn_dma_map_addr,
 1505              &physaddr, 0);
 1506         if (error != 0) {
 1507                 m_freem(m1);
 1508 
 1509                 if (bus_dmamap_load_mbuf_sg(sc->rx_ring.data_dmat,
 1510                     rx_data->map, rx_data->m, segs, &nsegs, 0)) 
 1511                         panic("%s: could not load old RX mbuf",
 1512                             device_get_name(sc->sc_dev));
 1513 
 1514                 /* Physical address may have changed. */
 1515                 rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
 1516                 counter_u64_add(ic->ic_ierrors, 1);
 1517                 return;
 1518         }
 1519 
 1520         /* Finalize mbuf. */
 1521         m = rx_data->m;
 1522         rx_data->m = m1;
 1523         m->m_pkthdr.len = m->m_len = pktlen + infosz + shift;
 1524 
 1525         /* Update RX descriptor. */
 1526         rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
 1527 
 1528         /* Get ieee80211 frame header. */
 1529         if (rxdw0 & R92C_RXDW0_PHYST)
 1530                 m_adj(m, infosz + shift);
 1531         else
 1532                 m_adj(m, shift);
 1533 
 1534         nf = -95;
 1535         if (ieee80211_radiotap_active(ic)) {
 1536                 struct rtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
 1537 
 1538                 tap->wr_flags = 0;
 1539                 if (!(rxdw3 & R92C_RXDW3_HT)) {
 1540                         tap->wr_rate = ridx2rate[rate];
 1541                 } else if (rate >= 12) {        /* MCS0~15. */
 1542                         /* Bit 7 set means HT MCS instead of rate. */
 1543                         tap->wr_rate = 0x80 | (rate - 12);
 1544                 }
 1545                 tap->wr_dbm_antsignal = rssi;
 1546                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
 1547                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
 1548         }
 1549 
 1550         RTWN_UNLOCK(sc);
 1551         wh = mtod(m, struct ieee80211_frame_min *);
 1552         if (m->m_len >= sizeof(*wh))
 1553                 ni = ieee80211_find_rxnode(ic, wh);
 1554         else
 1555                 ni = NULL;
 1556 
 1557         /* Send the frame to the 802.11 layer. */
 1558         if (ni != NULL) {
 1559                 (void)ieee80211_input(ni, m, rssi - nf, nf);
 1560                 /* Node is no longer needed. */
 1561                 ieee80211_free_node(ni);
 1562         } else
 1563                 (void)ieee80211_input_all(ic, m, rssi - nf, nf);
 1564 
 1565         RTWN_LOCK(sc);
 1566 }
 1567 
 1568 static int
 1569 rtwn_tx(struct rtwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
 1570 {
 1571         struct ieee80211com *ic = &sc->sc_ic;
 1572         struct ieee80211vap *vap = ni->ni_vap;
 1573         struct ieee80211_frame *wh;
 1574         struct ieee80211_key *k = NULL;
 1575         struct rtwn_tx_ring *tx_ring;
 1576         struct rtwn_tx_data *data;
 1577         struct r92c_tx_desc *txd;
 1578         bus_dma_segment_t segs[1];
 1579         uint16_t qos;
 1580         uint8_t raid, type, tid, qid;
 1581         int nsegs, error;
 1582 
 1583         wh = mtod(m, struct ieee80211_frame *);
 1584         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 1585 
 1586         /* Encrypt the frame if need be. */
 1587         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 1588                 k = ieee80211_crypto_encap(ni, m);
 1589                 if (k == NULL) {
 1590                         m_freem(m);
 1591                         return (ENOBUFS);
 1592                 }
 1593                 /* 802.11 header may have moved. */
 1594                 wh = mtod(m, struct ieee80211_frame *);
 1595         }
 1596 
 1597         if (IEEE80211_QOS_HAS_SEQ(wh)) {
 1598                 qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
 1599                 tid = qos & IEEE80211_QOS_TID;
 1600         } else {
 1601                 qos = 0;
 1602                 tid = 0;
 1603         }
 1604 
 1605         switch (type) {
 1606         case IEEE80211_FC0_TYPE_CTL:
 1607         case IEEE80211_FC0_TYPE_MGT:
 1608                 qid = RTWN_VO_QUEUE;
 1609                 break;
 1610         default:
 1611                 qid = M_WME_GETAC(m);
 1612                 break;
 1613         }
 1614 
 1615         /* Grab a Tx buffer from the ring. */
 1616         tx_ring = &sc->tx_ring[qid];
 1617         data = &tx_ring->tx_data[tx_ring->cur];
 1618         if (data->m != NULL) {
 1619                 m_freem(m);
 1620                 return (ENOBUFS);
 1621         }
 1622 
 1623         /* Fill Tx descriptor. */
 1624         txd = &tx_ring->desc[tx_ring->cur];
 1625         if (htole32(txd->txdw0) & R92C_RXDW0_OWN) {
 1626                 m_freem(m);
 1627                 return (ENOBUFS);
 1628         }
 1629         txd->txdw0 = htole32(
 1630             SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len) |
 1631             SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
 1632             R92C_TXDW0_FSG | R92C_TXDW0_LSG);
 1633         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
 1634                 txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
 1635 
 1636         txd->txdw1 = 0;
 1637         txd->txdw4 = 0;
 1638         txd->txdw5 = 0;
 1639 
 1640         /* XXX TODO: rate control; implement low-rate for EAPOL */
 1641         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 1642             type == IEEE80211_FC0_TYPE_DATA) {
 1643                 if (ic->ic_curmode == IEEE80211_MODE_11B)
 1644                         raid = R92C_RAID_11B;
 1645                 else
 1646                         raid = R92C_RAID_11BG;
 1647                 txd->txdw1 |= htole32(
 1648                     SM(R92C_TXDW1_MACID, RTWN_MACID_BSS) |
 1649                     SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
 1650                     SM(R92C_TXDW1_RAID, raid) |
 1651                     R92C_TXDW1_AGGBK);
 1652 
 1653                 if (ic->ic_flags & IEEE80211_F_USEPROT) {
 1654                         if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
 1655                                 txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
 1656                                     R92C_TXDW4_HWRTSEN);
 1657                         } else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
 1658                                 txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
 1659                                     R92C_TXDW4_HWRTSEN);
 1660                         }
 1661                 }
 1662 
 1663                 /* XXX TODO: implement rate control */
 1664 
 1665                 /* Send RTS at OFDM24. */
 1666                 txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
 1667                     RTWN_RIDX_OFDM24));
 1668                 txd->txdw5 |= htole32(SM(R92C_TXDW5_RTSRATE_FBLIMIT, 0xf));
 1669                 /* Send data at OFDM54. */
 1670                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE,
 1671                     RTWN_RIDX_OFDM54));
 1672                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE_FBLIMIT, 0x1f));
 1673 
 1674         } else {
 1675                 txd->txdw1 |= htole32(
 1676                     SM(R92C_TXDW1_MACID, 0) |
 1677                     SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
 1678                     SM(R92C_TXDW1_RAID, R92C_RAID_11B));
 1679 
 1680                 /* Force CCK1. */
 1681                 txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
 1682                 txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, RTWN_RIDX_CCK1));
 1683         }
 1684         /* Set sequence number (already little endian). */
 1685         txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
 1686         
 1687         if (!qos) {
 1688                 /* Use HW sequence numbering for non-QoS frames. */
 1689                 txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
 1690                 txd->txdseq |= htole16(0x8000);
 1691         } else
 1692                 txd->txdw4 |= htole32(R92C_TXDW4_QOS);
 1693 
 1694         error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map, m, segs,
 1695             &nsegs, BUS_DMA_NOWAIT);
 1696         if (error != 0 && error != EFBIG) {
 1697                 device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", error);
 1698                 m_freem(m);
 1699                 return (error);
 1700         }
 1701         if (error != 0) {
 1702                 struct mbuf *mnew;
 1703 
 1704                 mnew = m_defrag(m, M_NOWAIT);
 1705                 if (mnew == NULL) {
 1706                         device_printf(sc->sc_dev,
 1707                             "can't defragment mbuf\n");
 1708                         m_freem(m);
 1709                         return (ENOBUFS);
 1710                 }
 1711                 m = mnew;
 1712 
 1713                 error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map,
 1714                     m, segs, &nsegs, BUS_DMA_NOWAIT);
 1715                 if (error != 0) {
 1716                         device_printf(sc->sc_dev,
 1717                             "can't map mbuf (error %d)\n", error);
 1718                         m_freem(m);
 1719                         return (error);
 1720                 }
 1721         }
 1722 
 1723         txd->txbufaddr = htole32(segs[0].ds_addr);
 1724         txd->txbufsize = htole16(m->m_pkthdr.len);
 1725         bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
 1726             BUS_SPACE_BARRIER_WRITE);
 1727         txd->txdw0 |= htole32(R92C_TXDW0_OWN);
 1728 
 1729         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
 1730             BUS_DMASYNC_POSTWRITE);
 1731         bus_dmamap_sync(tx_ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
 1732 
 1733         data->m = m;
 1734         data->ni = ni;
 1735 
 1736         if (ieee80211_radiotap_active_vap(vap)) {
 1737                 struct rtwn_tx_radiotap_header *tap = &sc->sc_txtap;
 1738 
 1739                 tap->wt_flags = 0;
 1740                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
 1741                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
 1742 
 1743                 ieee80211_radiotap_tx(vap, m);
 1744         }
 1745 
 1746         tx_ring->cur = (tx_ring->cur + 1) % RTWN_TX_LIST_COUNT;
 1747         tx_ring->queued++;
 1748 
 1749         if (tx_ring->queued >= (RTWN_TX_LIST_COUNT - 1))
 1750                 sc->qfullmsk |= (1 << qid);
 1751 
 1752         /* Kick TX. */
 1753         rtwn_write_2(sc, R92C_PCIE_CTRL_REG, (1 << qid));
 1754         return (0);
 1755 }
 1756 
 1757 static void
 1758 rtwn_tx_done(struct rtwn_softc *sc, int qid)
 1759 {
 1760         struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
 1761         struct rtwn_tx_data *tx_data;
 1762         struct r92c_tx_desc *tx_desc;
 1763         int i;
 1764 
 1765         bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
 1766             BUS_DMASYNC_POSTREAD);
 1767 
 1768         for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
 1769                 tx_data = &tx_ring->tx_data[i];
 1770                 if (tx_data->m == NULL)
 1771                         continue;
 1772 
 1773                 tx_desc = &tx_ring->desc[i];
 1774                 if (le32toh(tx_desc->txdw0) & R92C_TXDW0_OWN)
 1775                         continue;
 1776 
 1777                 /* Unmap and free mbuf. */
 1778                 bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
 1779                     BUS_DMASYNC_POSTWRITE);
 1780                 bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
 1781 
 1782                 /*
 1783                  * XXX TODO: figure out whether the transmit succeeded or not.
 1784                  * .. and then notify rate control.
 1785                  */
 1786                 ieee80211_tx_complete(tx_data->ni, tx_data->m, 0);
 1787                 tx_data->ni = NULL;
 1788                 tx_data->m = NULL;
 1789 
 1790                 if (--tx_ring->queued)
 1791                         sc->sc_tx_timer = 5;
 1792                 else
 1793                         sc->sc_tx_timer = 0;
 1794         }
 1795 
 1796         if (tx_ring->queued < (RTWN_TX_LIST_COUNT - 1))
 1797                 sc->qfullmsk &= ~(1 << qid);
 1798         rtwn_start(sc);
 1799 }
 1800 
 1801 static int
 1802 rtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1803     const struct ieee80211_bpf_params *params)
 1804 {
 1805         struct ieee80211com *ic = ni->ni_ic;
 1806         struct rtwn_softc *sc = ic->ic_softc;
 1807 
 1808         RTWN_LOCK(sc);
 1809 
 1810         /* Prevent management frames from being sent if we're not ready. */
 1811         if (!(sc->sc_flags & RTWN_RUNNING)) {
 1812                 RTWN_UNLOCK(sc);
 1813                 m_freem(m);
 1814                 return (ENETDOWN);
 1815         }
 1816 
 1817         if (rtwn_tx(sc, m, ni) != 0) {
 1818                 RTWN_UNLOCK(sc);
 1819                 return (EIO);
 1820         }
 1821         sc->sc_tx_timer = 5;
 1822         RTWN_UNLOCK(sc);
 1823         return (0);
 1824 }
 1825 
 1826 static int
 1827 rtwn_transmit(struct ieee80211com *ic, struct mbuf *m)   
 1828 {
 1829         struct rtwn_softc *sc = ic->ic_softc;
 1830         int error;
 1831 
 1832         RTWN_LOCK(sc);
 1833         if ((sc->sc_flags & RTWN_RUNNING) == 0) {
 1834                 RTWN_UNLOCK(sc);
 1835                 return (ENXIO);
 1836         }
 1837         error = mbufq_enqueue(&sc->sc_snd, m);
 1838         if (error) {
 1839                 RTWN_UNLOCK(sc);
 1840                 return (error);
 1841         }
 1842         rtwn_start(sc);
 1843         RTWN_UNLOCK(sc);
 1844         return (0);
 1845 }
 1846 
 1847 static void
 1848 rtwn_parent(struct ieee80211com *ic)
 1849 {
 1850         struct rtwn_softc *sc = ic->ic_softc;
 1851         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 1852 
 1853         if (ic->ic_nrunning > 0) {
 1854                 if (rtwn_init(sc) == 0)
 1855                         ieee80211_start_all(ic);
 1856                 else
 1857                         ieee80211_stop(vap);
 1858         } else
 1859                 rtwn_stop(sc);
 1860 }
 1861 
 1862 static void
 1863 rtwn_start(struct rtwn_softc *sc)
 1864 {
 1865         struct ieee80211_node *ni;
 1866         struct mbuf *m;
 1867 
 1868         RTWN_LOCK_ASSERT(sc);
 1869 
 1870         if ((sc->sc_flags & RTWN_RUNNING) == 0)
 1871                 return;
 1872 
 1873         while (sc->qfullmsk == 0 && (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 1874                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
 1875                 if (rtwn_tx(sc, m, ni) != 0) {
 1876                         if_inc_counter(ni->ni_vap->iv_ifp,
 1877                             IFCOUNTER_OERRORS, 1);
 1878                         ieee80211_free_node(ni);
 1879                         continue;
 1880                 }
 1881                 sc->sc_tx_timer = 5;
 1882         }
 1883 }
 1884 
 1885 static void
 1886 rtwn_watchdog(void *arg)
 1887 {
 1888         struct rtwn_softc *sc = arg;
 1889         struct ieee80211com *ic = &sc->sc_ic;
 1890 
 1891         RTWN_LOCK_ASSERT(sc);
 1892 
 1893         KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
 1894 
 1895         if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
 1896                 ic_printf(ic, "device timeout\n");
 1897                 ieee80211_restart_all(ic);
 1898                 return;
 1899         }
 1900         callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
 1901 }
 1902 
 1903 static int
 1904 rtwn_power_on(struct rtwn_softc *sc)
 1905 {
 1906         uint32_t reg;
 1907         int ntries;
 1908 
 1909         /* Wait for autoload done bit. */
 1910         for (ntries = 0; ntries < 1000; ntries++) {
 1911                 if (rtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
 1912                         break;
 1913                 DELAY(5);
 1914         }
 1915         if (ntries == 1000) {
 1916                 device_printf(sc->sc_dev,
 1917                     "timeout waiting for chip autoload\n");
 1918                 return (ETIMEDOUT);
 1919         }
 1920 
 1921         /* Unlock ISO/CLK/Power control register. */
 1922         rtwn_write_1(sc, R92C_RSV_CTRL, 0);
 1923 
 1924         /* TODO: check if we need this for 8188CE */
 1925         if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
 1926                 /* bt coex */
 1927                 reg = rtwn_read_4(sc, R92C_APS_FSMCO);
 1928                 reg |= (R92C_APS_FSMCO_SOP_ABG |
 1929                         R92C_APS_FSMCO_SOP_AMB |
 1930                         R92C_APS_FSMCO_XOP_BTCK);
 1931                 rtwn_write_4(sc, R92C_APS_FSMCO, reg);
 1932         }
 1933 
 1934         /* Move SPS into PWM mode. */
 1935         rtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
 1936 
 1937         /* Set low byte to 0x0f, leave others unchanged. */
 1938         rtwn_write_4(sc, R92C_AFE_XTAL_CTRL,
 1939             (rtwn_read_4(sc, R92C_AFE_XTAL_CTRL) & 0xffffff00) | 0x0f);
 1940 
 1941         /* TODO: check if we need this for 8188CE */
 1942         if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
 1943                 /* bt coex */
 1944                 reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL);
 1945                 reg &= (~0x00024800); /* XXX magic from linux */
 1946                 rtwn_write_4(sc, R92C_AFE_XTAL_CTRL, reg);
 1947         }
 1948 
 1949         rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
 1950           (rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & 0xff) |
 1951           R92C_SYS_ISO_CTRL_PWC_EV12V | R92C_SYS_ISO_CTRL_DIOR);
 1952         DELAY(200);
 1953 
 1954         /* TODO: linux does additional btcoex stuff here */
 1955 
 1956         /* Auto enable WLAN. */
 1957         rtwn_write_2(sc, R92C_APS_FSMCO,
 1958             rtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
 1959         for (ntries = 0; ntries < 1000; ntries++) {
 1960                 if (!(rtwn_read_2(sc, R92C_APS_FSMCO) &
 1961                     R92C_APS_FSMCO_APFM_ONMAC))
 1962                         break;
 1963                 DELAY(5);
 1964         }
 1965         if (ntries == 1000) {
 1966                 device_printf(sc->sc_dev, "timeout waiting for MAC auto ON\n");
 1967                 return (ETIMEDOUT);
 1968         }
 1969 
 1970         /* Enable radio, GPIO and LED functions. */
 1971         rtwn_write_2(sc, R92C_APS_FSMCO,
 1972             R92C_APS_FSMCO_AFSM_PCIE |
 1973             R92C_APS_FSMCO_PDN_EN |
 1974             R92C_APS_FSMCO_PFM_ALDN);
 1975         /* Release RF digital isolation. */
 1976         rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
 1977             rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
 1978 
 1979         if (sc->chip & RTWN_CHIP_92C)
 1980                 rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x77);
 1981         else
 1982                 rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x22);
 1983 
 1984         rtwn_write_4(sc, R92C_INT_MIG, 0);
 1985 
 1986         if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
 1987                 /* bt coex */
 1988                 reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL + 2);
 1989                 reg &= 0xfd; /* XXX magic from linux */
 1990                 rtwn_write_4(sc, R92C_AFE_XTAL_CTRL + 2, reg);
 1991         }
 1992 
 1993         rtwn_write_1(sc, R92C_GPIO_MUXCFG,
 1994             rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_RFKILL);
 1995 
 1996         reg = rtwn_read_1(sc, R92C_GPIO_IO_SEL);
 1997         if (!(reg & R92C_GPIO_IO_SEL_RFKILL)) {
 1998                 device_printf(sc->sc_dev,
 1999                     "radio is disabled by hardware switch\n");
 2000                 return (EPERM);
 2001         }
 2002 
 2003         /* Initialize MAC. */
 2004         reg = rtwn_read_1(sc, R92C_APSD_CTRL);
 2005         rtwn_write_1(sc, R92C_APSD_CTRL,
 2006             rtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
 2007         for (ntries = 0; ntries < 200; ntries++) {
 2008                 if (!(rtwn_read_1(sc, R92C_APSD_CTRL) &
 2009                     R92C_APSD_CTRL_OFF_STATUS))
 2010                         break;
 2011                 DELAY(500);
 2012         }
 2013         if (ntries == 200) {
 2014                 device_printf(sc->sc_dev,
 2015                     "timeout waiting for MAC initialization\n");
 2016                 return (ETIMEDOUT);
 2017         }
 2018 
 2019         /* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
 2020         reg = rtwn_read_2(sc, R92C_CR);
 2021         reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
 2022             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
 2023             R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
 2024             R92C_CR_ENSEC;
 2025         rtwn_write_2(sc, R92C_CR, reg);
 2026 
 2027         rtwn_write_1(sc, 0xfe10, 0x19);
 2028 
 2029         return (0);
 2030 }
 2031 
 2032 static int
 2033 rtwn_llt_init(struct rtwn_softc *sc)
 2034 {
 2035         int i, error;
 2036 
 2037         /* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
 2038         for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
 2039                 if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
 2040                         return (error);
 2041         }
 2042         /* NB: 0xff indicates end-of-list. */
 2043         if ((error = rtwn_llt_write(sc, i, 0xff)) != 0)
 2044                 return (error);
 2045         /*
 2046          * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
 2047          * as ring buffer.
 2048          */
 2049         for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
 2050                 if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
 2051                         return (error);
 2052         }
 2053         /* Make the last page point to the beginning of the ring buffer. */
 2054         error = rtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
 2055         return (error);
 2056 }
 2057 
 2058 static void
 2059 rtwn_fw_reset(struct rtwn_softc *sc)
 2060 {
 2061         uint16_t reg;
 2062         int ntries;
 2063 
 2064         /* Tell 8051 to reset itself. */
 2065         rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
 2066 
 2067         /* Wait until 8051 resets by itself. */
 2068         for (ntries = 0; ntries < 100; ntries++) {
 2069                 reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
 2070                 if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
 2071                         goto sleep;
 2072                 DELAY(50);
 2073         }
 2074         /* Force 8051 reset. */
 2075         rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
 2076 sleep:
 2077         /* 
 2078          * We must sleep for one second to let the firmware settle.
 2079          * Accessing registers too early will hang the whole system.
 2080          */
 2081         if (msleep(&reg, &sc->sc_mtx, 0, "rtwnrst", hz)) {
 2082                 device_printf(sc->sc_dev, "timeout waiting for firmware "
 2083                     "initialization to complete\n");
 2084         }
 2085 }
 2086 
 2087 static void
 2088 rtwn_fw_loadpage(struct rtwn_softc *sc, int page, const uint8_t *buf, int len)
 2089 {
 2090         uint32_t reg;
 2091         int off, mlen, i;
 2092 
 2093         reg = rtwn_read_4(sc, R92C_MCUFWDL);
 2094         reg = RW(reg, R92C_MCUFWDL_PAGE, page);
 2095         rtwn_write_4(sc, R92C_MCUFWDL, reg);
 2096 
 2097         DELAY(5);
 2098 
 2099         off = R92C_FW_START_ADDR;
 2100         while (len > 0) {
 2101                 if (len > 196)
 2102                         mlen = 196;
 2103                 else if (len > 4)
 2104                         mlen = 4;
 2105                 else
 2106                         mlen = 1;
 2107                 for (i = 0; i < mlen; i++)
 2108                         rtwn_write_1(sc, off++, buf[i]);
 2109                 buf += mlen;
 2110                 len -= mlen;
 2111         }
 2112 }
 2113 
 2114 static int
 2115 rtwn_load_firmware(struct rtwn_softc *sc)
 2116 {
 2117         const struct firmware *fw;
 2118         const struct r92c_fw_hdr *hdr;
 2119         const char *name;
 2120         const u_char *ptr;
 2121         size_t len;
 2122         uint32_t reg;
 2123         int mlen, ntries, page, error = 0;
 2124 
 2125         /* Read firmware image from the filesystem. */
 2126         if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
 2127             RTWN_CHIP_UMC_A_CUT)
 2128                 name = "rtwn-rtl8192cfwU";
 2129         else
 2130                 name = "rtwn-rtl8192cfwU_B";
 2131         RTWN_UNLOCK(sc);
 2132         fw = firmware_get(name);
 2133         RTWN_LOCK(sc);
 2134         if (fw == NULL) {
 2135                 device_printf(sc->sc_dev,
 2136                     "could not read firmware %s\n", name);
 2137                 return (ENOENT);
 2138         }
 2139         len = fw->datasize;
 2140         if (len < sizeof(*hdr)) {
 2141                 device_printf(sc->sc_dev, "firmware too short\n");
 2142                 error = EINVAL;
 2143                 goto fail;
 2144         }
 2145         ptr = fw->data;
 2146         hdr = (const struct r92c_fw_hdr *)ptr;
 2147         /* Check if there is a valid FW header and skip it. */
 2148         if ((le16toh(hdr->signature) >> 4) == 0x88c ||
 2149             (le16toh(hdr->signature) >> 4) == 0x92c) {
 2150                 DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
 2151                     le16toh(hdr->version), le16toh(hdr->subversion),
 2152                     hdr->month, hdr->date, hdr->hour, hdr->minute));
 2153                 ptr += sizeof(*hdr);
 2154                 len -= sizeof(*hdr);
 2155         }
 2156 
 2157         if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
 2158                 rtwn_fw_reset(sc);
 2159 
 2160         /* Enable FW download. */
 2161         rtwn_write_2(sc, R92C_SYS_FUNC_EN,
 2162             rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
 2163             R92C_SYS_FUNC_EN_CPUEN);
 2164         rtwn_write_1(sc, R92C_MCUFWDL,
 2165             rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
 2166         rtwn_write_1(sc, R92C_MCUFWDL + 2,
 2167             rtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
 2168 
 2169         /* Reset the FWDL checksum. */
 2170         rtwn_write_1(sc, R92C_MCUFWDL,
 2171             rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
 2172 
 2173         for (page = 0; len > 0; page++) {
 2174                 mlen = MIN(len, R92C_FW_PAGE_SIZE);
 2175                 rtwn_fw_loadpage(sc, page, ptr, mlen);
 2176                 ptr += mlen;
 2177                 len -= mlen;
 2178         }
 2179 
 2180         /* Disable FW download. */
 2181         rtwn_write_1(sc, R92C_MCUFWDL,
 2182             rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
 2183         rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
 2184 
 2185         /* Wait for checksum report. */
 2186         for (ntries = 0; ntries < 1000; ntries++) {
 2187                 if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
 2188                         break;
 2189                 DELAY(5);
 2190         }
 2191         if (ntries == 1000) {
 2192                 device_printf(sc->sc_dev,
 2193                     "timeout waiting for checksum report\n");
 2194                 error = ETIMEDOUT;
 2195                 goto fail;
 2196         }
 2197 
 2198         reg = rtwn_read_4(sc, R92C_MCUFWDL);
 2199         reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
 2200         rtwn_write_4(sc, R92C_MCUFWDL, reg);
 2201         /* Wait for firmware readiness. */
 2202         for (ntries = 0; ntries < 2000; ntries++) {
 2203                 if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
 2204                         break;
 2205                 DELAY(50);
 2206         }
 2207         if (ntries == 1000) {
 2208                 device_printf(sc->sc_dev,
 2209                     "timeout waiting for firmware readiness\n");
 2210                 error = ETIMEDOUT;
 2211                 goto fail;
 2212         }
 2213 fail:
 2214         firmware_put(fw, FIRMWARE_UNLOAD);
 2215         return (error);
 2216 }
 2217 
 2218 static int
 2219 rtwn_dma_init(struct rtwn_softc *sc)
 2220 {
 2221         uint32_t reg;
 2222         int error;
 2223 
 2224         /* Initialize LLT table. */
 2225         error = rtwn_llt_init(sc);
 2226         if (error != 0)
 2227                 return error;
 2228 
 2229         /* Set number of pages for normal priority queue. */
 2230         rtwn_write_2(sc, R92C_RQPN_NPQ, 0);
 2231         rtwn_write_4(sc, R92C_RQPN,
 2232             /* Set number of pages for public queue. */
 2233             SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
 2234             /* Set number of pages for high priority queue. */
 2235             SM(R92C_RQPN_HPQ, R92C_HPQ_NPAGES) |
 2236             /* Set number of pages for low priority queue. */
 2237             SM(R92C_RQPN_LPQ, R92C_LPQ_NPAGES) |
 2238             /* Load values. */
 2239             R92C_RQPN_LD);
 2240 
 2241         rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
 2242         rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
 2243         rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
 2244         rtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
 2245         rtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
 2246 
 2247         reg = rtwn_read_2(sc, R92C_TRXDMA_CTRL);
 2248         reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
 2249         reg |= 0xF771; 
 2250         rtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
 2251 
 2252         rtwn_write_4(sc, R92C_TCR, R92C_TCR_CFENDFORM | (1 << 12) | (1 << 13));
 2253 
 2254         /* Configure Tx DMA. */
 2255         rtwn_write_4(sc, R92C_BKQ_DESA, sc->tx_ring[RTWN_BK_QUEUE].paddr);
 2256         rtwn_write_4(sc, R92C_BEQ_DESA, sc->tx_ring[RTWN_BE_QUEUE].paddr);
 2257         rtwn_write_4(sc, R92C_VIQ_DESA, sc->tx_ring[RTWN_VI_QUEUE].paddr);
 2258         rtwn_write_4(sc, R92C_VOQ_DESA, sc->tx_ring[RTWN_VO_QUEUE].paddr);
 2259         rtwn_write_4(sc, R92C_BCNQ_DESA, sc->tx_ring[RTWN_BEACON_QUEUE].paddr);
 2260         rtwn_write_4(sc, R92C_MGQ_DESA, sc->tx_ring[RTWN_MGNT_QUEUE].paddr);
 2261         rtwn_write_4(sc, R92C_HQ_DESA, sc->tx_ring[RTWN_HIGH_QUEUE].paddr);
 2262 
 2263         /* Configure Rx DMA. */
 2264         rtwn_write_4(sc, R92C_RX_DESA, sc->rx_ring.paddr);
 2265 
 2266         /* Set Tx/Rx transfer page boundary. */
 2267         rtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
 2268 
 2269         /* Set Tx/Rx transfer page size. */
 2270         rtwn_write_1(sc, R92C_PBP,
 2271             SM(R92C_PBP_PSRX, R92C_PBP_128) |
 2272             SM(R92C_PBP_PSTX, R92C_PBP_128));
 2273         return (0);
 2274 }
 2275 
 2276 static void
 2277 rtwn_mac_init(struct rtwn_softc *sc)
 2278 {
 2279         int i;
 2280 
 2281         /* Write MAC initialization values. */
 2282         for (i = 0; i < nitems(rtl8192ce_mac); i++)
 2283                 rtwn_write_1(sc, rtl8192ce_mac[i].reg, rtl8192ce_mac[i].val);
 2284 }
 2285 
 2286 static void
 2287 rtwn_bb_init(struct rtwn_softc *sc)
 2288 {
 2289         const struct rtwn_bb_prog *prog;
 2290         uint32_t reg;
 2291         int i;
 2292 
 2293         /* Enable BB and RF. */
 2294         rtwn_write_2(sc, R92C_SYS_FUNC_EN,
 2295             rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
 2296             R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
 2297             R92C_SYS_FUNC_EN_DIO_RF);
 2298 
 2299         rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
 2300 
 2301         rtwn_write_1(sc, R92C_RF_CTRL,
 2302             R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
 2303 
 2304         rtwn_write_1(sc, R92C_SYS_FUNC_EN,
 2305             R92C_SYS_FUNC_EN_DIO_PCIE | R92C_SYS_FUNC_EN_PCIEA |
 2306             R92C_SYS_FUNC_EN_PPLL | R92C_SYS_FUNC_EN_BB_GLB_RST |
 2307             R92C_SYS_FUNC_EN_BBRSTB);
 2308 
 2309         rtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
 2310 
 2311         rtwn_write_4(sc, R92C_LEDCFG0,
 2312             rtwn_read_4(sc, R92C_LEDCFG0) | 0x00800000);
 2313 
 2314         /* Select BB programming. */ 
 2315         prog = (sc->chip & RTWN_CHIP_92C) ?
 2316             &rtl8192ce_bb_prog_2t : &rtl8192ce_bb_prog_1t;
 2317 
 2318         /* Write BB initialization values. */
 2319         for (i = 0; i < prog->count; i++) {
 2320                 rtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
 2321                 DELAY(1);
 2322         }
 2323 
 2324         if (sc->chip & RTWN_CHIP_92C_1T2R) {
 2325                 /* 8192C 1T only configuration. */
 2326                 reg = rtwn_bb_read(sc, R92C_FPGA0_TXINFO);
 2327                 reg = (reg & ~0x00000003) | 0x2;
 2328                 rtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
 2329 
 2330                 reg = rtwn_bb_read(sc, R92C_FPGA1_TXINFO);
 2331                 reg = (reg & ~0x00300033) | 0x00200022;
 2332                 rtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
 2333 
 2334                 reg = rtwn_bb_read(sc, R92C_CCK0_AFESETTING);
 2335                 reg = (reg & ~0xff000000) | 0x45 << 24;
 2336                 rtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
 2337 
 2338                 reg = rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
 2339                 reg = (reg & ~0x000000ff) | 0x23;
 2340                 rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
 2341 
 2342                 reg = rtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
 2343                 reg = (reg & ~0x00000030) | 1 << 4;
 2344                 rtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
 2345 
 2346                 reg = rtwn_bb_read(sc, 0xe74);
 2347                 reg = (reg & ~0x0c000000) | 2 << 26;
 2348                 rtwn_bb_write(sc, 0xe74, reg);
 2349                 reg = rtwn_bb_read(sc, 0xe78);
 2350                 reg = (reg & ~0x0c000000) | 2 << 26;
 2351                 rtwn_bb_write(sc, 0xe78, reg);
 2352                 reg = rtwn_bb_read(sc, 0xe7c);
 2353                 reg = (reg & ~0x0c000000) | 2 << 26;
 2354                 rtwn_bb_write(sc, 0xe7c, reg);
 2355                 reg = rtwn_bb_read(sc, 0xe80);
 2356                 reg = (reg & ~0x0c000000) | 2 << 26;
 2357                 rtwn_bb_write(sc, 0xe80, reg);
 2358                 reg = rtwn_bb_read(sc, 0xe88);
 2359                 reg = (reg & ~0x0c000000) | 2 << 26;
 2360                 rtwn_bb_write(sc, 0xe88, reg);
 2361         }
 2362 
 2363         /* Write AGC values. */
 2364         for (i = 0; i < prog->agccount; i++) {
 2365                 rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
 2366                     prog->agcvals[i]);
 2367                 DELAY(1);
 2368         }
 2369 
 2370         if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
 2371             R92C_HSSI_PARAM2_CCK_HIPWR)
 2372                 sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
 2373 }
 2374 
 2375 static void
 2376 rtwn_rf_init(struct rtwn_softc *sc)
 2377 {
 2378         const struct rtwn_rf_prog *prog;
 2379         uint32_t reg, type;
 2380         int i, j, idx, off;
 2381 
 2382         /* Select RF programming based on board type. */
 2383         if (!(sc->chip & RTWN_CHIP_92C)) {
 2384                 if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
 2385                         prog = rtl8188ce_rf_prog;
 2386                 else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
 2387                         prog = rtl8188ru_rf_prog;
 2388                 else
 2389                         prog = rtl8188cu_rf_prog;
 2390         } else
 2391                 prog = rtl8192ce_rf_prog;
 2392 
 2393         for (i = 0; i < sc->nrxchains; i++) {
 2394                 /* Save RF_ENV control type. */
 2395                 idx = i / 2;
 2396                 off = (i % 2) * 16;
 2397                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
 2398                 type = (reg >> off) & 0x10;
 2399 
 2400                 /* Set RF_ENV enable. */
 2401                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
 2402                 reg |= 0x100000;
 2403                 rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
 2404                 DELAY(1);
 2405                 /* Set RF_ENV output high. */
 2406                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
 2407                 reg |= 0x10;
 2408                 rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
 2409                 DELAY(1);
 2410                 /* Set address and data lengths of RF registers. */
 2411                 reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
 2412                 reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
 2413                 rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
 2414                 DELAY(1);
 2415                 reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
 2416                 reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
 2417                 rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
 2418                 DELAY(1);
 2419 
 2420                 /* Write RF initialization values for this chain. */
 2421                 for (j = 0; j < prog[i].count; j++) {
 2422                         if (prog[i].regs[j] >= 0xf9 &&
 2423                             prog[i].regs[j] <= 0xfe) {
 2424                                 /*
 2425                                  * These are fake RF registers offsets that
 2426                                  * indicate a delay is required.
 2427                                  */
 2428                                 DELAY(50);
 2429                                 continue;
 2430                         }
 2431                         rtwn_rf_write(sc, i, prog[i].regs[j],
 2432                             prog[i].vals[j]);
 2433                         DELAY(1);
 2434                 }
 2435 
 2436                 /* Restore RF_ENV control type. */
 2437                 reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
 2438                 reg &= ~(0x10 << off) | (type << off);
 2439                 rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
 2440 
 2441                 /* Cache RF register CHNLBW. */
 2442                 sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
 2443         }
 2444 
 2445         if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
 2446             RTWN_CHIP_UMC_A_CUT) {
 2447                 rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
 2448                 rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
 2449         }
 2450 }
 2451 
 2452 static void
 2453 rtwn_cam_init(struct rtwn_softc *sc)
 2454 {
 2455         /* Invalidate all CAM entries. */
 2456         rtwn_write_4(sc, R92C_CAMCMD,
 2457             R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
 2458 }
 2459 
 2460 static void
 2461 rtwn_pa_bias_init(struct rtwn_softc *sc)
 2462 {
 2463         uint8_t reg;
 2464         int i;
 2465 
 2466         for (i = 0; i < sc->nrxchains; i++) {
 2467                 if (sc->pa_setting & (1 << i))
 2468                         continue;
 2469                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
 2470                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
 2471                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
 2472                 rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
 2473         }
 2474         if (!(sc->pa_setting & 0x10)) {
 2475                 reg = rtwn_read_1(sc, 0x16);
 2476                 reg = (reg & ~0xf0) | 0x90;
 2477                 rtwn_write_1(sc, 0x16, reg);
 2478         }
 2479 }
 2480 
 2481 static void
 2482 rtwn_rxfilter_init(struct rtwn_softc *sc)
 2483 {
 2484         /* Initialize Rx filter. */
 2485         /* TODO: use better filter for monitor mode. */
 2486         rtwn_write_4(sc, R92C_RCR,
 2487             R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
 2488             R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
 2489             R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
 2490         /* Accept all multicast frames. */
 2491         rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
 2492         rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
 2493         /* Accept all management frames. */
 2494         rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
 2495         /* Reject all control frames. */
 2496         rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
 2497         /* Accept all data frames. */
 2498         rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
 2499 }
 2500 
 2501 static void
 2502 rtwn_edca_init(struct rtwn_softc *sc)
 2503 {
 2504 
 2505         rtwn_write_2(sc, R92C_SPEC_SIFS, 0x1010);
 2506         rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x1010);
 2507         rtwn_write_2(sc, R92C_SIFS_CCK, 0x1010);
 2508         rtwn_write_2(sc, R92C_SIFS_OFDM, 0x0e0e);
 2509         rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
 2510         rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
 2511         rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4322);
 2512         rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3222);
 2513 }
 2514 
 2515 static void
 2516 rtwn_write_txpower(struct rtwn_softc *sc, int chain,
 2517     uint16_t power[RTWN_RIDX_COUNT])
 2518 {
 2519         uint32_t reg;
 2520 
 2521         /* Write per-CCK rate Tx power. */
 2522         if (chain == 0) {
 2523                 reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
 2524                 reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
 2525                 rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
 2526                 reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
 2527                 reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
 2528                 reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
 2529                 reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
 2530                 rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
 2531         } else {
 2532                 reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
 2533                 reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
 2534                 reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
 2535                 reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
 2536                 rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
 2537                 reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
 2538                 reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
 2539                 rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
 2540         }
 2541         /* Write per-OFDM rate Tx power. */
 2542         rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
 2543             SM(R92C_TXAGC_RATE06, power[ 4]) |
 2544             SM(R92C_TXAGC_RATE09, power[ 5]) |
 2545             SM(R92C_TXAGC_RATE12, power[ 6]) |
 2546             SM(R92C_TXAGC_RATE18, power[ 7]));
 2547         rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
 2548             SM(R92C_TXAGC_RATE24, power[ 8]) |
 2549             SM(R92C_TXAGC_RATE36, power[ 9]) |
 2550             SM(R92C_TXAGC_RATE48, power[10]) |
 2551             SM(R92C_TXAGC_RATE54, power[11]));
 2552         /* Write per-MCS Tx power. */
 2553         rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
 2554             SM(R92C_TXAGC_MCS00,  power[12]) |
 2555             SM(R92C_TXAGC_MCS01,  power[13]) |
 2556             SM(R92C_TXAGC_MCS02,  power[14]) |
 2557             SM(R92C_TXAGC_MCS03,  power[15]));
 2558         rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
 2559             SM(R92C_TXAGC_MCS04,  power[16]) |
 2560             SM(R92C_TXAGC_MCS05,  power[17]) |
 2561             SM(R92C_TXAGC_MCS06,  power[18]) |
 2562             SM(R92C_TXAGC_MCS07,  power[19]));
 2563         rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
 2564             SM(R92C_TXAGC_MCS08,  power[20]) |
 2565             SM(R92C_TXAGC_MCS09,  power[21]) |
 2566             SM(R92C_TXAGC_MCS10,  power[22]) |
 2567             SM(R92C_TXAGC_MCS11,  power[23]));
 2568         rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
 2569             SM(R92C_TXAGC_MCS12,  power[24]) |
 2570             SM(R92C_TXAGC_MCS13,  power[25]) |
 2571             SM(R92C_TXAGC_MCS14,  power[26]) |
 2572             SM(R92C_TXAGC_MCS15,  power[27]));
 2573 }
 2574 
 2575 static void
 2576 rtwn_get_txpower(struct rtwn_softc *sc, int chain,
 2577     struct ieee80211_channel *c, struct ieee80211_channel *extc,
 2578     uint16_t power[RTWN_RIDX_COUNT])
 2579 {
 2580         struct ieee80211com *ic = &sc->sc_ic;
 2581         struct r92c_rom *rom = &sc->rom;
 2582         uint16_t cckpow, ofdmpow, htpow, diff, max;
 2583         const struct rtwn_txpwr *base;
 2584         int ridx, chan, group;
 2585 
 2586         /* Determine channel group. */
 2587         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
 2588         if (chan <= 3)
 2589                 group = 0;
 2590         else if (chan <= 9)
 2591                 group = 1;
 2592         else
 2593                 group = 2;
 2594 
 2595         /* Get original Tx power based on board type and RF chain. */
 2596         if (!(sc->chip & RTWN_CHIP_92C)) {
 2597                 if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
 2598                         base = &rtl8188ru_txagc[chain];
 2599                 else
 2600                         base = &rtl8192cu_txagc[chain];
 2601         } else
 2602                 base = &rtl8192cu_txagc[chain];
 2603 
 2604         memset(power, 0, RTWN_RIDX_COUNT * sizeof(power[0]));
 2605         if (sc->regulatory == 0) {
 2606                 for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
 2607                         power[ridx] = base->pwr[0][ridx];
 2608         }
 2609         for (ridx = RTWN_RIDX_OFDM6; ridx < RTWN_RIDX_COUNT; ridx++) {
 2610                 if (sc->regulatory == 3) {
 2611                         power[ridx] = base->pwr[0][ridx];
 2612                         /* Apply vendor limits. */
 2613                         if (extc != NULL)
 2614                                 max = rom->ht40_max_pwr[group];
 2615                         else
 2616                                 max = rom->ht20_max_pwr[group];
 2617                         max = (max >> (chain * 4)) & 0xf;
 2618                         if (power[ridx] > max)
 2619                                 power[ridx] = max;
 2620                 } else if (sc->regulatory == 1) {
 2621                         if (extc == NULL)
 2622                                 power[ridx] = base->pwr[group][ridx];
 2623                 } else if (sc->regulatory != 2)
 2624                         power[ridx] = base->pwr[0][ridx];
 2625         }
 2626 
 2627         /* Compute per-CCK rate Tx power. */
 2628         cckpow = rom->cck_tx_pwr[chain][group];
 2629         for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
 2630                 power[ridx] += cckpow;
 2631                 if (power[ridx] > R92C_MAX_TX_PWR)
 2632                         power[ridx] = R92C_MAX_TX_PWR;
 2633         }
 2634 
 2635         htpow = rom->ht40_1s_tx_pwr[chain][group];
 2636         if (sc->ntxchains > 1) {
 2637                 /* Apply reduction for 2 spatial streams. */
 2638                 diff = rom->ht40_2s_tx_pwr_diff[group];
 2639                 diff = (diff >> (chain * 4)) & 0xf;
 2640                 htpow = (htpow > diff) ? htpow - diff : 0;
 2641         }
 2642 
 2643         /* Compute per-OFDM rate Tx power. */
 2644         diff = rom->ofdm_tx_pwr_diff[group];
 2645         diff = (diff >> (chain * 4)) & 0xf;
 2646         ofdmpow = htpow + diff; /* HT->OFDM correction. */
 2647         for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
 2648                 power[ridx] += ofdmpow;
 2649                 if (power[ridx] > R92C_MAX_TX_PWR)
 2650                         power[ridx] = R92C_MAX_TX_PWR;
 2651         }
 2652 
 2653         /* Compute per-MCS Tx power. */
 2654         if (extc == NULL) {
 2655                 diff = rom->ht20_tx_pwr_diff[group];
 2656                 diff = (diff >> (chain * 4)) & 0xf;
 2657                 htpow += diff;  /* HT40->HT20 correction. */
 2658         }
 2659         for (ridx = RTWN_RIDX_MCS0; ridx <= RTWN_RIDX_MCS15; ridx++) {
 2660                 power[ridx] += htpow;
 2661                 if (power[ridx] > R92C_MAX_TX_PWR)
 2662                         power[ridx] = R92C_MAX_TX_PWR;
 2663         }
 2664 #ifdef RTWN_DEBUG
 2665         if (sc->sc_debug >= 4) {
 2666                 /* Dump per-rate Tx power values. */
 2667                 printf("Tx power for chain %d:\n", chain);
 2668                 for (ridx = RTWN_RIDX_CCK1; ridx < RTWN_RIDX_COUNT; ridx++)
 2669                         printf("Rate %d = %u\n", ridx, power[ridx]);
 2670         }
 2671 #endif
 2672 }
 2673 
 2674 static void
 2675 rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
 2676     struct ieee80211_channel *extc)
 2677 {
 2678         uint16_t power[RTWN_RIDX_COUNT];
 2679         int i;
 2680 
 2681         for (i = 0; i < sc->ntxchains; i++) {
 2682                 /* Compute per-rate Tx power values. */
 2683                 rtwn_get_txpower(sc, i, c, extc, power);
 2684                 /* Write per-rate Tx power values to hardware. */
 2685                 rtwn_write_txpower(sc, i, power);
 2686         }
 2687 }
 2688 
 2689 static void
 2690 rtwn_set_rx_bssid_all(struct rtwn_softc *sc, int enable)
 2691 {
 2692         uint32_t reg;
 2693 
 2694         reg = rtwn_read_4(sc, R92C_RCR);
 2695         if (enable)
 2696                 reg &= ~R92C_RCR_CBSSID_BCN;
 2697         else
 2698                 reg |= R92C_RCR_CBSSID_BCN;
 2699         rtwn_write_4(sc, R92C_RCR, reg);
 2700 }
 2701 
 2702 static void
 2703 rtwn_set_gain(struct rtwn_softc *sc, uint8_t gain)
 2704 {
 2705         uint32_t reg;
 2706 
 2707         reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
 2708         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
 2709         rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
 2710 
 2711         reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
 2712         reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
 2713         rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
 2714 }
 2715 
 2716 static void
 2717 rtwn_scan_start(struct ieee80211com *ic)
 2718 {
 2719         struct rtwn_softc *sc = ic->ic_softc;
 2720 
 2721         RTWN_LOCK(sc);
 2722         /* Receive beacons / probe responses from any BSSID. */
 2723         rtwn_set_rx_bssid_all(sc, 1);
 2724         /* Set gain for scanning. */
 2725         rtwn_set_gain(sc, 0x20);
 2726         RTWN_UNLOCK(sc);
 2727 }
 2728 
 2729 static void
 2730 rtwn_scan_end(struct ieee80211com *ic)
 2731 {
 2732         struct rtwn_softc *sc = ic->ic_softc;
 2733 
 2734         RTWN_LOCK(sc);
 2735         /* Restore limitations. */
 2736         rtwn_set_rx_bssid_all(sc, 0);
 2737         /* Set gain under link. */
 2738         rtwn_set_gain(sc, 0x32);
 2739         RTWN_UNLOCK(sc);
 2740 }
 2741 
 2742 static void
 2743 rtwn_getradiocaps(struct ieee80211com *ic,
 2744     int maxchans, int *nchans, struct ieee80211_channel chans[])
 2745 {
 2746         uint8_t bands[IEEE80211_MODE_BYTES];
 2747 
 2748         memset(bands, 0, sizeof(bands));
 2749         setbit(bands, IEEE80211_MODE_11B);
 2750         setbit(bands, IEEE80211_MODE_11G);
 2751         ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
 2752             rtwn_chan_2ghz, nitems(rtwn_chan_2ghz), bands, 0);
 2753 }
 2754 
 2755 static void
 2756 rtwn_set_channel(struct ieee80211com *ic)
 2757 {
 2758         struct rtwn_softc *sc = ic->ic_softc;
 2759         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 2760 
 2761         RTWN_LOCK(sc);
 2762         if (vap->iv_state == IEEE80211_S_SCAN) {
 2763                 /* Make link LED blink during scan. */
 2764                 rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
 2765         }
 2766         rtwn_set_chan(sc, ic->ic_curchan, NULL);
 2767         RTWN_UNLOCK(sc);
 2768 }
 2769 
 2770 static void
 2771 rtwn_update_mcast(struct ieee80211com *ic)
 2772 {
 2773 
 2774         /* XXX do nothing?  */
 2775 }
 2776 
 2777 static void
 2778 rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
 2779     struct ieee80211_channel *extc)
 2780 {
 2781         struct ieee80211com *ic = &sc->sc_ic;
 2782         u_int chan;
 2783         int i;
 2784 
 2785         chan = ieee80211_chan2ieee(ic, c);      /* XXX center freq! */
 2786         if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
 2787                 device_printf(sc->sc_dev,
 2788                     "%s: invalid channel %x\n", __func__, chan);
 2789                 return;
 2790         }
 2791 
 2792         /* Set Tx power for this new channel. */
 2793         rtwn_set_txpower(sc, c, extc);
 2794 
 2795         for (i = 0; i < sc->nrxchains; i++) {
 2796                 rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
 2797                     RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
 2798         }
 2799 #ifndef IEEE80211_NO_HT
 2800         if (extc != NULL) {
 2801                 uint32_t reg;
 2802 
 2803                 /* Is secondary channel below or above primary? */
 2804                 int prichlo = c->ic_freq < extc->ic_freq;
 2805 
 2806                 rtwn_write_1(sc, R92C_BWOPMODE,
 2807                     rtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
 2808 
 2809                 reg = rtwn_read_1(sc, R92C_RRSR + 2);
 2810                 reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
 2811                 rtwn_write_1(sc, R92C_RRSR + 2, reg);
 2812 
 2813                 rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
 2814                     rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
 2815                 rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
 2816                     rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
 2817 
 2818                 /* Set CCK side band. */
 2819                 reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
 2820                 reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
 2821                 rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
 2822 
 2823                 reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
 2824                 reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
 2825                 rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
 2826 
 2827                 rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
 2828                     rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
 2829                     ~R92C_FPGA0_ANAPARAM2_CBW20);
 2830 
 2831                 reg = rtwn_bb_read(sc, 0x818);
 2832                 reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
 2833                 rtwn_bb_write(sc, 0x818, reg);
 2834 
 2835                 /* Select 40MHz bandwidth. */
 2836                 rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
 2837                     (sc->rf_chnlbw[0] & ~0xfff) | chan);
 2838         } else
 2839 #endif
 2840         {
 2841                 rtwn_write_1(sc, R92C_BWOPMODE,
 2842                     rtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
 2843 
 2844                 rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
 2845                     rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
 2846                 rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
 2847                     rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
 2848 
 2849                 rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
 2850                     rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
 2851                     R92C_FPGA0_ANAPARAM2_CBW20);
 2852 
 2853                 /* Select 20MHz bandwidth. */
 2854                 rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
 2855                     (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
 2856         }
 2857 }
 2858 
 2859 static int
 2860 rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
 2861     uint16_t rx[2])
 2862 {
 2863         uint32_t status;
 2864         int offset = chain * 0x20;
 2865 
 2866         if (chain == 0) {       /* IQ calibration for chain 0. */
 2867                 /* IQ calibration settings for chain 0. */
 2868                 rtwn_bb_write(sc, 0xe30, 0x10008c1f);
 2869                 rtwn_bb_write(sc, 0xe34, 0x10008c1f);
 2870                 rtwn_bb_write(sc, 0xe38, 0x82140102);
 2871 
 2872                 if (sc->ntxchains > 1) {
 2873                         rtwn_bb_write(sc, 0xe3c, 0x28160202);   /* 2T */
 2874                         /* IQ calibration settings for chain 1. */
 2875                         rtwn_bb_write(sc, 0xe50, 0x10008c22);
 2876                         rtwn_bb_write(sc, 0xe54, 0x10008c22);
 2877                         rtwn_bb_write(sc, 0xe58, 0x82140102);
 2878                         rtwn_bb_write(sc, 0xe5c, 0x28160202);
 2879                 } else
 2880                         rtwn_bb_write(sc, 0xe3c, 0x28160502);   /* 1T */
 2881 
 2882                 /* LO calibration settings. */
 2883                 rtwn_bb_write(sc, 0xe4c, 0x001028d1);
 2884                 /* We're doing LO and IQ calibration in one shot. */
 2885                 rtwn_bb_write(sc, 0xe48, 0xf9000000);
 2886                 rtwn_bb_write(sc, 0xe48, 0xf8000000);
 2887 
 2888         } else {                /* IQ calibration for chain 1. */
 2889                 /* We're doing LO and IQ calibration in one shot. */
 2890                 rtwn_bb_write(sc, 0xe60, 0x00000002);
 2891                 rtwn_bb_write(sc, 0xe60, 0x00000000);
 2892         }
 2893 
 2894         /* Give LO and IQ calibrations the time to complete. */
 2895         DELAY(1000);
 2896 
 2897         /* Read IQ calibration status. */
 2898         status = rtwn_bb_read(sc, 0xeac);
 2899 
 2900         if (status & (1 << (28 + chain * 3)))
 2901                 return (0);     /* Tx failed. */
 2902         /* Read Tx IQ calibration results. */
 2903         tx[0] = (rtwn_bb_read(sc, 0xe94 + offset) >> 16) & 0x3ff;
 2904         tx[1] = (rtwn_bb_read(sc, 0xe9c + offset) >> 16) & 0x3ff;
 2905         if (tx[0] == 0x142 || tx[1] == 0x042)
 2906                 return (0);     /* Tx failed. */
 2907 
 2908         if (status & (1 << (27 + chain * 3)))
 2909                 return (1);     /* Rx failed. */
 2910         /* Read Rx IQ calibration results. */
 2911         rx[0] = (rtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff;
 2912         rx[1] = (rtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff;
 2913         if (rx[0] == 0x132 || rx[1] == 0x036)
 2914                 return (1);     /* Rx failed. */
 2915 
 2916         return (3);     /* Both Tx and Rx succeeded. */
 2917 }
 2918 
 2919 static void
 2920 rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
 2921     uint16_t rx[2][2])
 2922 {
 2923         /* Registers to save and restore during IQ calibration. */
 2924         struct iq_cal_regs {
 2925                 uint32_t        adda[16];
 2926                 uint8_t         txpause;
 2927                 uint8_t         bcn_ctrl;
 2928                 uint8_t         ustime_tsf;
 2929                 uint32_t        gpio_muxcfg;
 2930                 uint32_t        ofdm0_trxpathena;
 2931                 uint32_t        ofdm0_trmuxpar;
 2932                 uint32_t        fpga0_rfifacesw1;
 2933         } iq_cal_regs;
 2934         static const uint16_t reg_adda[16] = {
 2935                 0x85c, 0xe6c, 0xe70, 0xe74,
 2936                 0xe78, 0xe7c, 0xe80, 0xe84,
 2937                 0xe88, 0xe8c, 0xed0, 0xed4,
 2938                 0xed8, 0xedc, 0xee0, 0xeec
 2939         };
 2940         int i, chain;
 2941         uint32_t hssi_param1;
 2942 
 2943         if (n == 0) {
 2944                 for (i = 0; i < nitems(reg_adda); i++)
 2945                         iq_cal_regs.adda[i] = rtwn_bb_read(sc, reg_adda[i]);
 2946 
 2947                 iq_cal_regs.txpause = rtwn_read_1(sc, R92C_TXPAUSE);
 2948                 iq_cal_regs.bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
 2949                 iq_cal_regs.ustime_tsf = rtwn_read_1(sc, R92C_USTIME_TSF);
 2950                 iq_cal_regs.gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
 2951         }
 2952 
 2953         if (sc->ntxchains == 1) {
 2954                 rtwn_bb_write(sc, reg_adda[0], 0x0b1b25a0);
 2955                 for (i = 1; i < nitems(reg_adda); i++)
 2956                         rtwn_bb_write(sc, reg_adda[i], 0x0bdb25a0);
 2957         } else {
 2958                 for (i = 0; i < nitems(reg_adda); i++)
 2959                         rtwn_bb_write(sc, reg_adda[i], 0x04db25a4);
 2960         }
 2961 
 2962         hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
 2963         if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
 2964                 rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
 2965                     hssi_param1 | R92C_HSSI_PARAM1_PI);
 2966                 rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
 2967                     hssi_param1 | R92C_HSSI_PARAM1_PI);
 2968         }
 2969 
 2970         if (n == 0) {
 2971                 iq_cal_regs.ofdm0_trxpathena =
 2972                     rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
 2973                 iq_cal_regs.ofdm0_trmuxpar =
 2974                     rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
 2975                 iq_cal_regs.fpga0_rfifacesw1 =
 2976                     rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
 2977         }
 2978 
 2979         rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
 2980         rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
 2981         rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
 2982         if (sc->ntxchains > 1) {
 2983                 rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
 2984                 rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
 2985         }
 2986 
 2987         rtwn_write_1(sc, R92C_TXPAUSE, 0x3f);
 2988         rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl & ~(0x08));
 2989         rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf & ~(0x08));
 2990         rtwn_write_1(sc, R92C_GPIO_MUXCFG,
 2991             iq_cal_regs.gpio_muxcfg & ~(0x20));
 2992 
 2993         rtwn_bb_write(sc, 0x0b68, 0x00080000);
 2994         if (sc->ntxchains > 1)
 2995                 rtwn_bb_write(sc, 0x0b6c, 0x00080000);
 2996 
 2997         rtwn_bb_write(sc, 0x0e28, 0x80800000);
 2998         rtwn_bb_write(sc, 0x0e40, 0x01007c00);
 2999         rtwn_bb_write(sc, 0x0e44, 0x01004800);
 3000 
 3001         rtwn_bb_write(sc, 0x0b68, 0x00080000);
 3002 
 3003         for (chain = 0; chain < sc->ntxchains; chain++) {
 3004                 if (chain > 0) {
 3005                         /* Put chain 0 on standby. */
 3006                         rtwn_bb_write(sc, 0x0e28, 0x00);
 3007                         rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
 3008                         rtwn_bb_write(sc, 0x0e28, 0x80800000);
 3009 
 3010                         /* Enable chain 1. */
 3011                         for (i = 0; i < nitems(reg_adda); i++)
 3012                                 rtwn_bb_write(sc, reg_adda[i], 0x0b1b25a4);
 3013                 }
 3014 
 3015                 /* Run IQ calibration twice. */
 3016                 for (i = 0; i < 2; i++) {
 3017                         int ret;
 3018 
 3019                         ret = rtwn_iq_calib_chain(sc, chain,
 3020                             tx[chain], rx[chain]);
 3021                         if (ret == 0) {
 3022                                 DPRINTF(("%s: chain %d: Tx failed.\n",
 3023                                     __func__, chain));
 3024                                 tx[chain][0] = 0xff;
 3025                                 tx[chain][1] = 0xff;
 3026                                 rx[chain][0] = 0xff;
 3027                                 rx[chain][1] = 0xff;
 3028                         } else if (ret == 1) {
 3029                                 DPRINTF(("%s: chain %d: Rx failed.\n",
 3030                                     __func__, chain));
 3031                                 rx[chain][0] = 0xff;
 3032                                 rx[chain][1] = 0xff;
 3033                         } else if (ret == 3) {
 3034                                 DPRINTF(("%s: chain %d: Both Tx and Rx "
 3035                                     "succeeded.\n", __func__, chain));
 3036                         }
 3037                 }
 3038 
 3039                 DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
 3040                     "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
 3041                     tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
 3042         }
 3043 
 3044         rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
 3045             iq_cal_regs.ofdm0_trxpathena); 
 3046         rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
 3047             iq_cal_regs.fpga0_rfifacesw1);
 3048         rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, iq_cal_regs.ofdm0_trmuxpar);
 3049 
 3050         rtwn_bb_write(sc, 0x0e28, 0x00);
 3051         rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
 3052         if (sc->ntxchains > 1)
 3053                 rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
 3054 
 3055         if (n != 0) {
 3056                 if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
 3057                         rtwn_bb_write(sc, R92C_HSSI_PARAM1(0), hssi_param1);
 3058                         rtwn_bb_write(sc, R92C_HSSI_PARAM1(1), hssi_param1);
 3059                 }
 3060 
 3061                 for (i = 0; i < nitems(reg_adda); i++)
 3062                         rtwn_bb_write(sc, reg_adda[i], iq_cal_regs.adda[i]);
 3063 
 3064                 rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs.txpause);
 3065                 rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl);
 3066                 rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf);
 3067                 rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs.gpio_muxcfg);
 3068         }
 3069 }
 3070 
 3071 #define RTWN_IQ_CAL_MAX_TOLERANCE 5
 3072 static int
 3073 rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
 3074     uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
 3075 {
 3076         int chain, i, tx_ok[2], rx_ok[2];
 3077 
 3078         tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
 3079         for (chain = 0; chain < ntxchains; chain++) {
 3080                 for (i = 0; i < 2; i++) {
 3081                         if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
 3082                             rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
 3083                                 continue;
 3084 
 3085                         tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
 3086                             RTWN_IQ_CAL_MAX_TOLERANCE);
 3087 
 3088                         rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
 3089                             RTWN_IQ_CAL_MAX_TOLERANCE);
 3090                 }
 3091         }
 3092 
 3093         if (ntxchains > 1)
 3094                 return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
 3095         else
 3096                 return (tx_ok[0] && rx_ok[0]);
 3097 }
 3098 #undef RTWN_IQ_CAL_MAX_TOLERANCE
 3099 
 3100 static void
 3101 rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
 3102     uint16_t rx[2], int chain)
 3103 {
 3104         uint32_t reg, val, x;
 3105         long y, tx_c;
 3106 
 3107         if (tx[0] == 0xff || tx[1] == 0xff)
 3108                 return;
 3109 
 3110         reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain)); 
 3111         val = ((reg >> 22) & 0x3ff);
 3112         x = tx[0];
 3113         if (x & 0x0200)
 3114                 x |= 0xfc00;
 3115         reg = (((x * val) >> 8) & 0x3ff);
 3116         rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
 3117 
 3118         reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
 3119         if (((x * val) >> 7) & 0x01)
 3120                 reg |= 0x80000000;
 3121         else
 3122                 reg &= ~0x80000000;
 3123         rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
 3124 
 3125         y = tx[1];
 3126         if (y & 0x00000200)
 3127                 y |= 0xfffffc00;
 3128         tx_c = (y * val) >> 8;
 3129         reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
 3130         reg |= ((((tx_c & 0x3c0) >> 6) << 24) & 0xf0000000);
 3131         rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
 3132 
 3133         reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain)); 
 3134         reg |= (((tx_c & 0x3f) << 16) & 0x003F0000);
 3135         rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
 3136 
 3137         reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
 3138         if (((y * val) >> 7) & 0x01)
 3139                 reg |= 0x20000000;
 3140         else
 3141                 reg &= ~0x20000000;
 3142         rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
 3143 
 3144         if (rx[0] == 0xff || rx[1] == 0xff)
 3145                 return;
 3146 
 3147         reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
 3148         reg |= (rx[0] & 0x3ff);
 3149         rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
 3150         reg |= (((rx[1] & 0x03f) << 8) & 0xFC00);
 3151         rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
 3152 
 3153         if (chain == 0) {
 3154                 reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
 3155                 reg |= (((rx[1] & 0xf) >> 6) & 0x000f);
 3156                 rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
 3157         } else {
 3158                 reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
 3159                 reg |= ((((rx[1] & 0xf) >> 6) << 12) & 0xf000);
 3160                 rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
 3161         }
 3162 }
 3163 
 3164 #define RTWN_IQ_CAL_NRUN        3
 3165 static void
 3166 rtwn_iq_calib(struct rtwn_softc *sc)
 3167 {
 3168         uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
 3169         int n, valid;
 3170 
 3171         valid = 0;
 3172         for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
 3173                 rtwn_iq_calib_run(sc, n, tx[n], rx[n]);
 3174 
 3175                 if (n == 0)
 3176                         continue;
 3177 
 3178                 /* Valid results remain stable after consecutive runs. */
 3179                 valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
 3180                     tx[n], rx[n], sc->ntxchains);
 3181                 if (valid)
 3182                         break;
 3183         }
 3184 
 3185         if (valid) {
 3186                 rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
 3187                 if (sc->ntxchains > 1)
 3188                         rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
 3189         }
 3190 }
 3191 #undef RTWN_IQ_CAL_NRUN
 3192 
 3193 static void
 3194 rtwn_lc_calib(struct rtwn_softc *sc)
 3195 {
 3196         uint32_t rf_ac[2];
 3197         uint8_t txmode;
 3198         int i;
 3199 
 3200         txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
 3201         if ((txmode & 0x70) != 0) {
 3202                 /* Disable all continuous Tx. */
 3203                 rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
 3204 
 3205                 /* Set RF mode to standby mode. */
 3206                 for (i = 0; i < sc->nrxchains; i++) {
 3207                         rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
 3208                         rtwn_rf_write(sc, i, R92C_RF_AC,
 3209                             RW(rf_ac[i], R92C_RF_AC_MODE,
 3210                                 R92C_RF_AC_MODE_STANDBY));
 3211                 }
 3212         } else {
 3213                 /* Block all Tx queues. */
 3214                 rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
 3215         }
 3216         /* Start calibration. */
 3217         rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
 3218             rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
 3219 
 3220         /* Give calibration the time to complete. */
 3221         DELAY(100);
 3222 
 3223         /* Restore configuration. */
 3224         if ((txmode & 0x70) != 0) {
 3225                 /* Restore Tx mode. */
 3226                 rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
 3227                 /* Restore RF mode. */
 3228                 for (i = 0; i < sc->nrxchains; i++)
 3229                         rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
 3230         } else {
 3231                 /* Unblock all Tx queues. */
 3232                 rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
 3233         }
 3234 }
 3235 
 3236 static void
 3237 rtwn_temp_calib(struct rtwn_softc *sc)
 3238 {
 3239         int temp;
 3240 
 3241         if (sc->thcal_state == 0) {
 3242                 /* Start measuring temperature. */
 3243                 rtwn_rf_write(sc, 0, R92C_RF_T_METER, 0x60);
 3244                 sc->thcal_state = 1;
 3245                 return;
 3246         }
 3247         sc->thcal_state = 0;
 3248 
 3249         /* Read measured temperature. */
 3250         temp = rtwn_rf_read(sc, 0, R92C_RF_T_METER) & 0x1f;
 3251         if (temp == 0)  /* Read failed, skip. */
 3252                 return;
 3253         DPRINTFN(2, ("temperature=%d\n", temp));
 3254 
 3255         /*
 3256          * Redo IQ and LC calibration if temperature changed significantly
 3257          * since last calibration.
 3258          */
 3259         if (sc->thcal_lctemp == 0) {
 3260                 /* First calibration is performed in rtwn_init(). */
 3261                 sc->thcal_lctemp = temp;
 3262         } else if (abs(temp - sc->thcal_lctemp) > 1) {
 3263                 DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
 3264                     sc->thcal_lctemp, temp));
 3265                 rtwn_iq_calib(sc);
 3266                 rtwn_lc_calib(sc);
 3267                 /* Record temperature of last calibration. */
 3268                 sc->thcal_lctemp = temp;
 3269         }
 3270 }
 3271 
 3272 static int
 3273 rtwn_init(struct rtwn_softc *sc)
 3274 {
 3275         struct ieee80211com *ic = &sc->sc_ic;
 3276         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 3277         uint32_t reg;
 3278         uint8_t macaddr[IEEE80211_ADDR_LEN];
 3279         int i, error;
 3280 
 3281         RTWN_LOCK(sc);
 3282 
 3283         if (sc->sc_flags & RTWN_RUNNING) {
 3284                 RTWN_UNLOCK(sc);
 3285                 return 0;
 3286         }
 3287         sc->sc_flags |= RTWN_RUNNING;
 3288 
 3289         /* Init firmware commands ring. */
 3290         sc->fwcur = 0;
 3291 
 3292         /* Power on adapter. */
 3293         error = rtwn_power_on(sc);
 3294         if (error != 0) {
 3295                 device_printf(sc->sc_dev, "could not power on adapter\n");
 3296                 goto fail;
 3297         }
 3298 
 3299         /* Initialize DMA. */
 3300         error = rtwn_dma_init(sc);
 3301         if (error != 0) {
 3302                 device_printf(sc->sc_dev, "could not initialize DMA\n");
 3303                 goto fail;
 3304         }
 3305 
 3306         /* Set info size in Rx descriptors (in 64-bit words). */
 3307         rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
 3308 
 3309         /* Disable interrupts. */
 3310         rtwn_write_4(sc, R92C_HISR, 0x00000000);
 3311         rtwn_write_4(sc, R92C_HIMR, 0x00000000);
 3312 
 3313         /* Set MAC address. */
 3314         IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
 3315         for (i = 0; i < IEEE80211_ADDR_LEN; i++)
 3316                 rtwn_write_1(sc, R92C_MACID + i, macaddr[i]);
 3317 
 3318         /* Set initial network type. */
 3319         reg = rtwn_read_4(sc, R92C_CR);
 3320         reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
 3321         rtwn_write_4(sc, R92C_CR, reg);
 3322 
 3323         rtwn_rxfilter_init(sc);
 3324 
 3325         reg = rtwn_read_4(sc, R92C_RRSR);
 3326         reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
 3327         rtwn_write_4(sc, R92C_RRSR, reg);
 3328 
 3329         /* Set short/long retry limits. */
 3330         rtwn_write_2(sc, R92C_RL,
 3331             SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
 3332 
 3333         /* Initialize EDCA parameters. */
 3334         rtwn_edca_init(sc);
 3335 
 3336         /* Set data and response automatic rate fallback retry counts. */
 3337         rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
 3338         rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
 3339         rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
 3340         rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
 3341 
 3342         rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
 3343 
 3344         /* Set ACK timeout. */
 3345         rtwn_write_1(sc, R92C_ACKTO, 0x40);
 3346 
 3347         /* Initialize beacon parameters. */
 3348         rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
 3349         rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
 3350         rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
 3351         rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
 3352 
 3353         /* Setup AMPDU aggregation. */
 3354         rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);  /* MCS7~0 */
 3355         rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
 3356 
 3357         rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
 3358         rtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
 3359 
 3360         rtwn_write_4(sc, R92C_PIFS, 0x1c);
 3361         rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
 3362 
 3363         /* Load 8051 microcode. */
 3364         error = rtwn_load_firmware(sc);
 3365         if (error != 0)
 3366                 goto fail;
 3367 
 3368         /* Initialize MAC/BB/RF blocks. */
 3369         rtwn_mac_init(sc);
 3370         rtwn_bb_init(sc);
 3371         rtwn_rf_init(sc);
 3372 
 3373         /* Turn CCK and OFDM blocks on. */
 3374         reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
 3375         reg |= R92C_RFMOD_CCK_EN;
 3376         rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
 3377         reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
 3378         reg |= R92C_RFMOD_OFDM_EN;
 3379         rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
 3380 
 3381         /* Clear per-station keys table. */
 3382         rtwn_cam_init(sc);
 3383 
 3384         /* Enable hardware sequence numbering. */
 3385         rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
 3386 
 3387         /* Perform LO and IQ calibrations. */
 3388         rtwn_iq_calib(sc);
 3389         /* Perform LC calibration. */
 3390         rtwn_lc_calib(sc);
 3391 
 3392         rtwn_pa_bias_init(sc);
 3393 
 3394         /* Initialize GPIO setting. */
 3395         rtwn_write_1(sc, R92C_GPIO_MUXCFG,
 3396             rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
 3397 
 3398         /* Fix for lower temperature. */
 3399         rtwn_write_1(sc, 0x15, 0xe9);
 3400 
 3401         /* CLear pending interrupts. */
 3402         rtwn_write_4(sc, R92C_HISR, 0xffffffff);
 3403 
 3404         /* Enable interrupts. */
 3405         rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
 3406 
 3407         callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
 3408 
 3409 fail:
 3410         if (error != 0)
 3411                 rtwn_stop_locked(sc);
 3412 
 3413         RTWN_UNLOCK(sc);
 3414 
 3415         return error;
 3416 }
 3417 
 3418 static void
 3419 rtwn_stop_locked(struct rtwn_softc *sc)
 3420 {
 3421         uint16_t reg;
 3422         int i;
 3423 
 3424         RTWN_LOCK_ASSERT(sc);
 3425 
 3426         if (!(sc->sc_flags & RTWN_RUNNING))
 3427                 return;
 3428 
 3429         sc->sc_tx_timer = 0;
 3430         callout_stop(&sc->watchdog_to);
 3431         callout_stop(&sc->calib_to);
 3432         sc->sc_flags &= ~RTWN_RUNNING;
 3433 
 3434         /* Disable interrupts. */
 3435         rtwn_write_4(sc, R92C_HISR, 0x00000000);
 3436         rtwn_write_4(sc, R92C_HIMR, 0x00000000);
 3437 
 3438         /* Stop hardware. */
 3439         rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
 3440         rtwn_write_1(sc, R92C_RF_CTRL, 0x00);
 3441         reg = rtwn_read_1(sc, R92C_SYS_FUNC_EN);
 3442         reg |= R92C_SYS_FUNC_EN_BB_GLB_RST;
 3443         rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
 3444         reg &= ~R92C_SYS_FUNC_EN_BB_GLB_RST;
 3445         rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
 3446         reg = rtwn_read_2(sc, R92C_CR);
 3447         reg &= ~(R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
 3448             R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
 3449             R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
 3450             R92C_CR_ENSEC);
 3451         rtwn_write_2(sc, R92C_CR, reg);
 3452         if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
 3453                 rtwn_fw_reset(sc);
 3454         /* TODO: linux does additional btcoex stuff here */
 3455         rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0x80); /* linux magic number */
 3456         rtwn_write_1(sc, R92C_SPS0_CTRL, 0x23); /* ditto */
 3457         rtwn_write_1(sc, R92C_AFE_XTAL_CTRL, 0x0e); /* different with btcoex */
 3458         rtwn_write_1(sc, R92C_RSV_CTRL, 0x0e);
 3459         rtwn_write_1(sc, R92C_APS_FSMCO, R92C_APS_FSMCO_PDN_EN);
 3460 
 3461         for (i = 0; i < RTWN_NTXQUEUES; i++)
 3462                 rtwn_reset_tx_list(sc, i);
 3463         rtwn_reset_rx_list(sc);
 3464 }
 3465 
 3466 static void
 3467 rtwn_stop(struct rtwn_softc *sc)
 3468 {
 3469         RTWN_LOCK(sc);
 3470         rtwn_stop_locked(sc);
 3471         RTWN_UNLOCK(sc);
 3472 }
 3473 
 3474 static void
 3475 rtwn_intr(void *arg)
 3476 {
 3477         struct rtwn_softc *sc = arg;
 3478         uint32_t status;
 3479         int i;
 3480 
 3481         RTWN_LOCK(sc);
 3482         status = rtwn_read_4(sc, R92C_HISR);
 3483         if (status == 0 || status == 0xffffffff) {
 3484                 RTWN_UNLOCK(sc);
 3485                 return;
 3486         }
 3487 
 3488         /* Disable interrupts. */
 3489         rtwn_write_4(sc, R92C_HIMR, 0x00000000);
 3490 
 3491         /* Ack interrupts. */
 3492         rtwn_write_4(sc, R92C_HISR, status);
 3493 
 3494         /* Vendor driver treats RX errors like ROK... */
 3495         if (status & (R92C_IMR_ROK | R92C_IMR_RXFOVW | R92C_IMR_RDU)) {
 3496                 bus_dmamap_sync(sc->rx_ring.desc_dmat, sc->rx_ring.desc_map,
 3497                     BUS_DMASYNC_POSTREAD);
 3498 
 3499                 for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
 3500                         struct r92c_rx_desc *rx_desc = &sc->rx_ring.desc[i];
 3501                         struct rtwn_rx_data *rx_data = &sc->rx_ring.rx_data[i];
 3502 
 3503                         if (le32toh(rx_desc->rxdw0) & R92C_RXDW0_OWN)
 3504                                 continue;
 3505 
 3506                         rtwn_rx_frame(sc, rx_desc, rx_data, i);
 3507                 }
 3508         }
 3509 
 3510         if (status & R92C_IMR_BDOK)
 3511                 rtwn_tx_done(sc, RTWN_BEACON_QUEUE);
 3512         if (status & R92C_IMR_HIGHDOK)
 3513                 rtwn_tx_done(sc, RTWN_HIGH_QUEUE);
 3514         if (status & R92C_IMR_MGNTDOK)
 3515                 rtwn_tx_done(sc, RTWN_MGNT_QUEUE);
 3516         if (status & R92C_IMR_BKDOK)
 3517                 rtwn_tx_done(sc, RTWN_BK_QUEUE);
 3518         if (status & R92C_IMR_BEDOK)
 3519                 rtwn_tx_done(sc, RTWN_BE_QUEUE);
 3520         if (status & R92C_IMR_VIDOK)
 3521                 rtwn_tx_done(sc, RTWN_VI_QUEUE);
 3522         if (status & R92C_IMR_VODOK)
 3523                 rtwn_tx_done(sc, RTWN_VO_QUEUE);
 3524 
 3525         /* Enable interrupts. */
 3526         rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
 3527 
 3528         RTWN_UNLOCK(sc);
 3529 }

Cache object: 338cb71469d9889493b720b115716bdc


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.