xref: /openbsd-src/sys/dev/ic/rtwn.c (revision 0b7734b3d77bb9b21afec6f4621cae6c805dbd45)
1 /*	$OpenBSD: rtwn.c,v 1.9 2016/06/17 10:53:55 stsp Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*
21  * Driver for Realtek RTL8188CE
22  */
23 
24 #include "bpfilter.h"
25 
26 #include <sys/param.h>
27 #include <sys/sockio.h>
28 #include <sys/mbuf.h>
29 #include <sys/kernel.h>
30 #include <sys/socket.h>
31 #include <sys/systm.h>
32 #include <sys/task.h>
33 #include <sys/timeout.h>
34 #include <sys/conf.h>
35 #include <sys/device.h>
36 #include <sys/endian.h>
37 
38 #include <machine/bus.h>
39 #include <machine/intr.h>
40 
41 #if NBPFILTER > 0
42 #include <net/bpf.h>
43 #endif
44 #include <net/if.h>
45 #include <net/if_dl.h>
46 #include <net/if_media.h>
47 
48 #include <netinet/in.h>
49 #include <netinet/if_ether.h>
50 
51 #include <net80211/ieee80211_var.h>
52 #include <net80211/ieee80211_radiotap.h>
53 
54 #include <dev/ic/r92creg.h>
55 #include <dev/ic/rtwnvar.h>
56 
57 #define RTWN_RIDX_COUNT	28
58 
59 #ifdef RTWN_DEBUG
60 #define DPRINTF(x)	do { if (rtwn_debug) printf x; } while (0)
61 #define DPRINTFN(n, x)	do { if (rtwn_debug >= (n)) printf x; } while (0)
62 int rtwn_debug = 0;
63 #else
64 #define DPRINTF(x)
65 #define DPRINTFN(n, x)
66 #endif
67 
68 void		rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
69 void		rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
70 void		rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
71 uint8_t		rtwn_read_1(struct rtwn_softc *, uint16_t);
72 uint16_t	rtwn_read_2(struct rtwn_softc *, uint16_t);
73 uint32_t	rtwn_read_4(struct rtwn_softc *, uint16_t);
74 int		rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
75 void		rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
76 uint32_t	rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
77 void		rtwn_cam_write(struct rtwn_softc *, uint32_t, uint32_t);
78 uint8_t		rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
79 void		rtwn_efuse_read(struct rtwn_softc *);
80 void		rtwn_efuse_switch_power(struct rtwn_softc *);
81 int		rtwn_read_chipid(struct rtwn_softc *, uint32_t);
82 void		rtwn_read_rom(struct rtwn_softc *);
83 void		rtwn_r88e_read_rom(struct rtwn_softc *);
84 int		rtwn_media_change(struct ifnet *);
85 int		rtwn_ra_init(struct rtwn_softc *);
86 int		rtwn_r92c_ra_init(struct rtwn_softc *, u_int8_t, u_int32_t,
87 		    int, uint32_t, int);
88 int		rtwn_r88e_ra_init(struct rtwn_softc *, u_int8_t, u_int32_t,
89 		    int, uint32_t, int);
90 void		rtwn_tsf_sync_enable(struct rtwn_softc *);
91 void		rtwn_set_led(struct rtwn_softc *, int, int);
92 void		rtwn_updateedca(struct ieee80211com *);
93 void		rtwn_update_avgrssi(struct rtwn_softc *, int, int8_t);
94 int8_t		rtwn_r88e_get_rssi(struct rtwn_softc *, int, void *);
95 void		rtwn_watchdog(struct ifnet *);
96 void		rtwn_r88e_fw_reset(struct rtwn_softc *);
97 int		rtwn_load_firmware(struct rtwn_softc *);
98 void		rtwn_rf_init(struct rtwn_softc *);
99 void		rtwn_cam_init(struct rtwn_softc *);
100 void		rtwn_pa_bias_init(struct rtwn_softc *);
101 void		rtwn_rxfilter_init(struct rtwn_softc *);
102 void		rtwn_edca_init(struct rtwn_softc *);
103 void		rtwn_write_txpower(struct rtwn_softc *, int, uint16_t[]);
104 void		rtwn_get_txpower(struct rtwn_softc *, int,
105 		    struct ieee80211_channel *, struct ieee80211_channel *,
106 		    uint16_t[]);
107 void		rtwn_r88e_get_txpower(struct rtwn_softc *, int,
108 		    struct ieee80211_channel *,
109 		    struct ieee80211_channel *, uint16_t[]);
110 void		rtwn_set_txpower(struct rtwn_softc *,
111 		    struct ieee80211_channel *, struct ieee80211_channel *);
112 void		rtwn_set_chan(struct rtwn_softc *,
113 		    struct ieee80211_channel *, struct ieee80211_channel *);
114 int		rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
115 		    uint16_t[2]);
116 void		rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
117 		    uint16_t[2][2]);
118 int		rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
119 		    uint16_t[2][2], uint16_t[2][2], int);
120 void		rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
121 		    uint16_t[2], int);
122 void		rtwn_iq_calib(struct rtwn_softc *);
123 void		rtwn_lc_calib(struct rtwn_softc *);
124 void		rtwn_temp_calib(struct rtwn_softc *);
125 void		rtwn_enable_intr(struct rtwn_softc *);
126 void		rtwn_disable_intr(struct rtwn_softc *);
127 int		rtwn_init(struct ifnet *);
128 void		rtwn_init_task(void *);
129 void		rtwn_stop(struct ifnet *);
130 
131 /* Aliases. */
132 #define	rtwn_bb_write	rtwn_write_4
133 #define rtwn_bb_read	rtwn_read_4
134 
135 int
136 rtwn_attach(struct device *pdev, struct rtwn_softc *sc, uint32_t chip_type)
137 {
138 	struct ieee80211com *ic = &sc->sc_ic;
139 	struct ifnet *ifp = &ic->ic_if;
140 	int i, error;
141 
142 	sc->sc_pdev = pdev;
143 
144 	task_set(&sc->init_task, rtwn_init_task, sc);
145 
146 	sc->chip = 0;
147 	error = rtwn_read_chipid(sc, chip_type);
148 	if (error != 0) {
149 		printf("%s: unsupported chip\n", sc->sc_pdev->dv_xname);
150 		return (ENXIO);
151 	}
152 
153 	/* Determine number of Tx/Rx chains. */
154 	if (sc->chip & RTWN_CHIP_92C) {
155 		sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
156 		sc->nrxchains = 2;
157 	} else if (sc->chip & RTWN_CHIP_88C) {
158 		sc->ntxchains = 1;
159 		sc->nrxchains = 1;
160 	}
161 
162 	if (sc->chip & RTWN_CHIP_88E)
163 		rtwn_r88e_read_rom(sc);
164 	else
165 		rtwn_read_rom(sc);
166 
167 	if (sc->chip & RTWN_CHIP_PCI) {
168 		printf("%s: MAC/BB RTL%s, RF 6052 %dT%dR, address %s\n",
169 		    sc->sc_pdev->dv_xname,
170 		    (sc->chip & RTWN_CHIP_92C) ? "8192CE" :
171 		    (sc->chip & RTWN_CHIP_88E) ? "8188EE" : "8188CE",
172 		    sc->ntxchains, sc->nrxchains,
173 		    ether_sprintf(ic->ic_myaddr));
174 	} else if (sc->chip & RTWN_CHIP_USB) {
175 		printf("%s: MAC/BB RTL%s, RF 6052 %dT%dR, address %s\n",
176 		    sc->sc_pdev->dv_xname,
177 		    (sc->chip & RTWN_CHIP_92C) ? "8192CU" :
178 		    (sc->chip & RTWN_CHIP_88E) ? "8188EU" :
179 		    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
180 		    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ?
181 		    "8188CE-VAU" : "8188CUS",
182 		    sc->ntxchains, sc->nrxchains,
183 		    ether_sprintf(ic->ic_myaddr));
184 	} else {
185 		printf("%s: unsupported chip\n", sc->sc_pdev->dv_xname);
186 		return (ENXIO);
187 	}
188 
189 	ic->ic_phytype = IEEE80211_T_OFDM;	/* Not only, but not used. */
190 	ic->ic_opmode = IEEE80211_M_STA;	/* Default to BSS mode. */
191 	ic->ic_state = IEEE80211_S_INIT;
192 
193 	/* Set device capabilities. */
194 	ic->ic_caps =
195 	    IEEE80211_C_MONITOR |	/* Monitor mode supported. */
196 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
197 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
198 	    IEEE80211_C_WEP |		/* WEP. */
199 	    IEEE80211_C_RSN;		/* WPA/RSN. */
200 
201 	/* Set HT capabilities. */
202 	ic->ic_htcaps =
203 	    IEEE80211_HTCAP_CBW20_40 |
204 	    IEEE80211_HTCAP_DSSSCCK40;
205 	/* Set supported HT rates. */
206 	for (i = 0; i < sc->nrxchains; i++)
207 		ic->ic_sup_mcs[i] = 0xff;
208 
209 	/* Set supported .11b and .11g rates. */
210 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
211 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
212 
213 	/* Set supported .11b and .11g channels (1 through 14). */
214 	for (i = 1; i <= 14; i++) {
215 		ic->ic_channels[i].ic_freq =
216 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
217 		ic->ic_channels[i].ic_flags =
218 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
219 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
220 	}
221 
222 #ifdef notyet
223 	/*
224 	 * The number of STAs that we can support is limited by the number
225 	 * of CAM entries used for hardware crypto.
226 	 */
227 	ic->ic_max_nnodes = R92C_CAM_ENTRY_COUNT - 4;
228 	if (ic->ic_max_nnodes > IEEE80211_CACHE_SIZE)
229 		ic->ic_max_nnodes = IEEE80211_CACHE_SIZE;
230 #endif
231 
232 	ifp->if_softc = sc;
233 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
234 	ifp->if_ioctl = rtwn_ioctl;
235 	ifp->if_start = rtwn_start;
236 	ifp->if_watchdog = rtwn_watchdog;
237 	memcpy(ifp->if_xname, sc->sc_pdev->dv_xname, IFNAMSIZ);
238 
239 	if_attach(ifp);
240 	ieee80211_ifattach(ifp);
241 	ic->ic_updateedca = rtwn_updateedca;
242 #ifdef notyet
243 	ic->ic_set_key = rtwn_set_key;
244 	ic->ic_delete_key = rtwn_delete_key;
245 #endif
246 	/* Override state transition machine. */
247 	sc->sc_newstate = ic->ic_newstate;
248 	ic->ic_newstate = rtwn_newstate;
249 	ieee80211_media_init(ifp, rtwn_media_change, ieee80211_media_status);
250 
251 	return (0);
252 }
253 
254 int
255 rtwn_detach(struct rtwn_softc *sc, int flags)
256 {
257 	struct ifnet *ifp = &sc->sc_ic.ic_if;
258 	int s;
259 
260 	s = splnet();
261 
262 	task_del(systq, &sc->init_task);
263 
264 	if (ifp->if_softc != NULL) {
265 		ieee80211_ifdetach(ifp);
266 		if_detach(ifp);
267 	}
268 
269 	splx(s);
270 
271 	return (0);
272 }
273 
274 int
275 rtwn_activate(struct rtwn_softc *sc, int act)
276 {
277 	struct ifnet *ifp = &sc->sc_ic.ic_if;
278 
279 	switch (act) {
280 	case DVACT_QUIESCE: /* rtwn_stop() may sleep */
281 		if (ifp->if_flags & IFF_RUNNING)
282 			rtwn_stop(ifp);
283 		break;
284 	case DVACT_WAKEUP:
285 		rtwn_init_task(sc);
286 		break;
287 	}
288 	return (0);
289 }
290 
291 void
292 rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
293 {
294 	sc->sc_ops.write_1(sc->sc_ops.cookie, addr, val);
295 }
296 
297 void
298 rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
299 {
300 	val = htole16(val);
301 	sc->sc_ops.write_2(sc->sc_ops.cookie, addr, val);
302 }
303 
304 void
305 rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
306 {
307 	val = htole32(val);
308 	sc->sc_ops.write_4(sc->sc_ops.cookie, addr, val);
309 }
310 
311 uint8_t
312 rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
313 {
314 	return sc->sc_ops.read_1(sc->sc_ops.cookie, addr);
315 }
316 
317 uint16_t
318 rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
319 {
320 	return sc->sc_ops.read_2(sc->sc_ops.cookie, addr);
321 }
322 
323 uint32_t
324 rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
325 {
326 	return sc->sc_ops.read_4(sc->sc_ops.cookie, addr);
327 }
328 
329 int
330 rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
331 {
332 	struct r92c_fw_cmd cmd;
333 	int ntries;
334 
335 	/* Wait for current FW box to be empty. */
336 	for (ntries = 0; ntries < 100; ntries++) {
337 		if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
338 			break;
339 		DELAY(1);
340 	}
341 	if (ntries == 100) {
342 		printf("%s: could not send firmware command %d\n",
343 		    sc->sc_pdev->dv_xname, id);
344 		return (ETIMEDOUT);
345 	}
346 	memset(&cmd, 0, sizeof(cmd));
347 	cmd.id = id;
348 	if (len > 3)
349 		cmd.id |= R92C_CMD_FLAG_EXT;
350 	KASSERT(len <= sizeof(cmd.msg));
351 	memcpy(cmd.msg, buf, len);
352 
353 	/* Write the first word last since that will trigger the FW. */
354 	rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur), *((uint8_t *)&cmd + 4));
355 	rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
356 
357 	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
358 
359 	if (sc->chip & RTWN_CHIP_PCI) {
360 		/* Give firmware some time for processing. */
361 		DELAY(2000);
362 	}
363 
364 	return (0);
365 }
366 
367 void
368 rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
369 {
370 	uint32_t param_addr;
371 
372 	if (sc->chip & RTWN_CHIP_88E)
373 		param_addr = SM(R88E_LSSI_PARAM_ADDR, addr);
374 	else
375 		param_addr = SM(R92C_LSSI_PARAM_ADDR, addr);
376 
377 	rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
378 	    param_addr | SM(R92C_LSSI_PARAM_DATA, val));
379 }
380 
381 uint32_t
382 rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
383 {
384 	uint32_t reg[R92C_MAX_CHAINS], val;
385 
386 	reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
387 	if (chain != 0)
388 		reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
389 
390 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
391 	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
392 	DELAY(1000);
393 
394 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
395 	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
396 	    R92C_HSSI_PARAM2_READ_EDGE);
397 	DELAY(1000);
398 
399 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
400 	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
401 	DELAY(1000);
402 
403 	if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
404 		val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
405 	else
406 		val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
407 	return (MS(val, R92C_LSSI_READBACK_DATA));
408 }
409 
410 void
411 rtwn_cam_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
412 {
413 	rtwn_write_4(sc, R92C_CAMWRITE, data);
414 	rtwn_write_4(sc, R92C_CAMCMD,
415 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
416 	    SM(R92C_CAMCMD_ADDR, addr));
417 }
418 
419 uint8_t
420 rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
421 {
422 	uint32_t reg;
423 	int ntries;
424 
425 	reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
426 	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
427 	reg &= ~R92C_EFUSE_CTRL_VALID;
428 	rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
429 	/* Wait for read operation to complete. */
430 	for (ntries = 0; ntries < 100; ntries++) {
431 		reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
432 		if (reg & R92C_EFUSE_CTRL_VALID)
433 			return (MS(reg, R92C_EFUSE_CTRL_DATA));
434 		DELAY(5);
435 	}
436 	printf("%s: could not read efuse byte at address 0x%x\n",
437 	    sc->sc_pdev->dv_xname, addr);
438 	return (0xff);
439 }
440 
441 void
442 rtwn_efuse_read(struct rtwn_softc *sc)
443 {
444 	uint8_t *rom = (uint8_t *)&sc->rom;
445 	uint16_t addr = 0;
446 	uint32_t reg;
447 	uint8_t off, msk;
448 	int i;
449 
450 	rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
451 	rtwn_efuse_switch_power(sc);
452 
453 	memset(&sc->rom, 0xff, sizeof(sc->rom));
454 	while (addr < 512) {
455 		reg = rtwn_efuse_read_1(sc, addr);
456 		if (reg == 0xff)
457 			break;
458 		addr++;
459 		off = reg >> 4;
460 		msk = reg & 0xf;
461 		for (i = 0; i < 4; i++) {
462 			if (msk & (1 << i))
463 				continue;
464 			rom[off * 8 + i * 2 + 0] =
465 			    rtwn_efuse_read_1(sc, addr);
466 			addr++;
467 			rom[off * 8 + i * 2 + 1] =
468 			    rtwn_efuse_read_1(sc, addr);
469 			addr++;
470 		}
471 	}
472 #ifdef RTWN_DEBUG
473 	if (rtwn_debug >= 2) {
474 		/* Dump ROM content. */
475 		printf("\n");
476 		for (i = 0; i < sizeof(sc->rom); i++)
477 			printf("%02x:", rom[i]);
478 		printf("\n");
479 	}
480 #endif
481 	rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
482 }
483 
484 void
485 rtwn_efuse_switch_power(struct rtwn_softc *sc)
486 {
487 	uint16_t reg;
488 
489 	reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
490 	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
491 		rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
492 		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
493 	}
494 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
495 	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
496 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
497 		    reg | R92C_SYS_FUNC_EN_ELDR);
498 	}
499 	reg = rtwn_read_2(sc, R92C_SYS_CLKR);
500 	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
501 	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
502 		rtwn_write_2(sc, R92C_SYS_CLKR,
503 		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
504 	}
505 }
506 
507 int
508 rtwn_read_chipid(struct rtwn_softc *sc, uint32_t chip_type)
509 {
510 	uint32_t reg;
511 
512 	if (chip_type & RTWN_CHIP_88E) {
513 		sc->chip = chip_type;
514 		return (0);
515 	}
516 
517 	reg = rtwn_read_4(sc, R92C_SYS_CFG);
518 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
519 		/* Unsupported test chip. */
520 		return (EIO);
521 
522 	if ((chip_type & (RTWN_CHIP_92C | RTWN_CHIP_88C)) != 0) {
523 		if (reg & R92C_SYS_CFG_TYPE_92C) {
524 			sc->chip = RTWN_CHIP_92C;
525 			/* Check if it is a castrated 8192C. */
526 			if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
527 			    R92C_HPON_FSM_CHIP_BONDING_ID) ==
528 			    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
529 				sc->chip |= RTWN_CHIP_92C_1T2R;
530 		} else
531 			sc->chip = RTWN_CHIP_88C;
532 
533 		if (reg & R92C_SYS_CFG_VENDOR_UMC) {
534 			sc->chip |= RTWN_CHIP_UMC;
535 			if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
536 				sc->chip |= RTWN_CHIP_UMC_A_CUT;
537 		}
538 
539 		sc->chip |= (chip_type & (RTWN_CHIP_USB | RTWN_CHIP_PCI));
540 		return (0);
541 	}
542 
543 	return (ENXIO); /* unsupported chip */
544 }
545 
546 void
547 rtwn_read_rom(struct rtwn_softc *sc)
548 {
549 	struct ieee80211com *ic = &sc->sc_ic;
550 	struct r92c_rom *rom = &sc->rom;
551 
552 	/* Read full ROM image. */
553 	rtwn_efuse_read(sc);
554 
555 	/* XXX Weird but this is what the vendor driver does. */
556 	sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
557 	DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
558 
559 	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
560 	DPRINTF(("board type=%d\n", sc->board_type));
561 
562 	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
563 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
564 
565 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
566 }
567 
568 void
569 rtwn_r88e_read_rom(struct rtwn_softc *sc)
570 {
571 	struct ieee80211com *ic = &sc->sc_ic;
572 	uint8_t *rom = sc->r88e_rom;
573 	uint16_t addr = 0;
574 	uint32_t reg;
575 	uint8_t off, msk, tmp;
576 	int i;
577 
578 	off = 0;
579 
580 	rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
581 	rtwn_efuse_switch_power(sc);
582 
583 	/* Read full ROM image. */
584 	memset(&sc->r88e_rom, 0xff, sizeof(sc->r88e_rom));
585 	while (addr < 512) {
586 		reg = rtwn_efuse_read_1(sc, addr);
587 		if (reg == 0xff)
588 			break;
589 		addr++;
590 		if ((reg & 0x1f) == 0x0f) {
591 			tmp = (reg & 0xe0) >> 5;
592 			reg = rtwn_efuse_read_1(sc, addr);
593 			if ((reg & 0x0f) != 0x0f)
594 				off = ((reg & 0xf0) >> 1) | tmp;
595 			addr++;
596 		} else
597 			off = reg >> 4;
598 		msk = reg & 0xf;
599 		for (i = 0; i < 4; i++) {
600 			if (msk & (1 << i))
601 				continue;
602 			rom[off * 8 + i * 2 + 0] =
603 			    rtwn_efuse_read_1(sc, addr);
604 			addr++;
605 			rom[off * 8 + i * 2 + 1] =
606 			    rtwn_efuse_read_1(sc, addr);
607 			addr++;
608 		}
609 	}
610 
611 	rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
612 
613 	addr = 0x10;
614 	for (i = 0; i < 6; i++)
615 		sc->cck_tx_pwr[i] = sc->r88e_rom[addr++];
616 	for (i = 0; i < 5; i++)
617 		sc->ht40_tx_pwr[i] = sc->r88e_rom[addr++];
618 	sc->bw20_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf0) >> 4;
619 	if (sc->bw20_tx_pwr_diff & 0x08)
620 		sc->bw20_tx_pwr_diff |= 0xf0;
621 	sc->ofdm_tx_pwr_diff = (sc->r88e_rom[addr] & 0xf);
622 	if (sc->ofdm_tx_pwr_diff & 0x08)
623 		sc->ofdm_tx_pwr_diff |= 0xf0;
624 	sc->regulatory = MS(sc->r88e_rom[0xc1], R92C_ROM_RF1_REGULATORY);
625 	IEEE80211_ADDR_COPY(ic->ic_myaddr, &sc->r88e_rom[0xd7]);
626 }
627 
628 int
629 rtwn_media_change(struct ifnet *ifp)
630 {
631 	int error;
632 
633 	error = ieee80211_media_change(ifp);
634 	if (error != ENETRESET)
635 		return (error);
636 
637 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
638 	    (IFF_UP | IFF_RUNNING)) {
639 		rtwn_stop(ifp);
640 		rtwn_init(ifp);
641 	}
642 	return (0);
643 }
644 
645 /*
646  * Initialize rate adaptation in firmware.
647  */
648 int
649 rtwn_ra_init(struct rtwn_softc *sc)
650 {
651 	static const uint8_t map[] =
652 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
653 	struct ieee80211com *ic = &sc->sc_ic;
654 	struct ieee80211_node *ni = ic->ic_bss;
655 	struct ieee80211_rateset *rs = &ni->ni_rates;
656 	uint32_t rates, basicrates;
657 	uint8_t mode;
658 	int maxrate, maxbasicrate, error, i, j;
659 
660 	/* Get normal and basic rates mask. */
661 	rates = basicrates = 0;
662 	maxrate = maxbasicrate = 0;
663 	for (i = 0; i < rs->rs_nrates; i++) {
664 		/* Convert 802.11 rate to HW rate index. */
665 		for (j = 0; j < nitems(map); j++)
666 			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
667 				break;
668 		if (j == nitems(map))	/* Unknown rate, skip. */
669 			continue;
670 		rates |= 1 << j;
671 		if (j > maxrate)
672 			maxrate = j;
673 		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
674 			basicrates |= 1 << j;
675 			if (j > maxbasicrate)
676 				maxbasicrate = j;
677 		}
678 	}
679 	if (ic->ic_curmode == IEEE80211_MODE_11B)
680 		mode = R92C_RAID_11B;
681 	else
682 		mode = R92C_RAID_11BG;
683 	DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
684 	    mode, rates, basicrates));
685 
686 	if (sc->chip & RTWN_CHIP_PCI) {
687 		/* Configure Automatic Rate Fallback Register. */
688 		if (ic->ic_curmode == IEEE80211_MODE_11B) {
689 			if (rates & 0x0c)
690 				rtwn_write_4(sc, R92C_ARFR(0),
691 				    htole32(rates & 0x0d));
692 			else
693 				rtwn_write_4(sc, R92C_ARFR(0),
694 				    htole32(rates & 0x0f));
695 		} else
696 			rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0ff5));
697 	}
698 
699 	if (sc->chip & RTWN_CHIP_88E)
700 		error = rtwn_r88e_ra_init(sc, mode, rates, maxrate,
701 		    basicrates, maxbasicrate);
702 	else
703 		error = rtwn_r92c_ra_init(sc, mode, rates, maxrate,
704 		    basicrates, maxbasicrate);
705 
706 	/* Indicate highest supported rate. */
707 	ni->ni_txrate = rs->rs_nrates - 1;
708 	return (error);
709 }
710 
711 int rtwn_r92c_ra_init(struct rtwn_softc *sc, u_int8_t mode, u_int32_t rates,
712     int maxrate, uint32_t basicrates, int maxbasicrate)
713 {
714 	struct r92c_fw_cmd_macid_cfg cmd;
715 	int error;
716 
717 	/* Set rates mask for group addressed frames. */
718 	cmd.macid = R92C_MACID_BC | R92C_MACID_VALID;
719 	cmd.mask = htole32(mode << 28 | basicrates);
720 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
721 	if (error != 0) {
722 		printf("%s: could not add broadcast station\n",
723 		    sc->sc_pdev->dv_xname);
724 		return (error);
725 	}
726 	/* Set initial MRR rate. */
727 	DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
728 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(R92C_MACID_BC),
729 	    maxbasicrate);
730 
731 	/* Set rates mask for unicast frames. */
732 	cmd.macid = R92C_MACID_BSS | R92C_MACID_VALID;
733 	cmd.mask = htole32(mode << 28 | rates);
734 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
735 	if (error != 0) {
736 		printf("%s: could not add BSS station\n",
737 		    sc->sc_pdev->dv_xname);
738 		return (error);
739 	}
740 	/* Set initial MRR rate. */
741 	DPRINTF(("maxrate=%d\n", maxrate));
742 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(R92C_MACID_BSS),
743 	    maxrate);
744 
745 	return (0);
746 }
747 
748 int
749 rtwn_r88e_ra_init(struct rtwn_softc *sc, u_int8_t mode, u_int32_t rates,
750     int maxrate, uint32_t basicrates, int maxbasicrate)
751 {
752 	u_int32_t reg;
753 
754 	rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, maxbasicrate);
755 
756 	reg = rtwn_read_4(sc, R92C_RRSR);
757 	reg = RW(reg, R92C_RRSR_RATE_BITMAP, rates);
758 	rtwn_write_4(sc, R92C_RRSR, reg);
759 
760 	/*
761 	 * Workaround for performance problems with firmware rate adaptation:
762 	 * If the AP only supports 11b rates, disable mixed B/G mode.
763 	 */
764 	if (mode != R92C_RAID_11B && maxrate <= 3 /* 11M */)
765 		sc->sc_flags |= RTWN_FLAG_FORCE_RAID_11B;
766 
767 	return (0);
768 }
769 
770 void
771 rtwn_tsf_sync_enable(struct rtwn_softc *sc)
772 {
773 	struct ieee80211_node *ni = sc->sc_ic.ic_bss;
774 	uint64_t tsf;
775 
776 	/* Enable TSF synchronization. */
777 	rtwn_write_1(sc, R92C_BCN_CTRL,
778 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
779 
780 	rtwn_write_1(sc, R92C_BCN_CTRL,
781 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
782 
783 	/* Set initial TSF. */
784 	memcpy(&tsf, ni->ni_tstamp, 8);
785 	tsf = letoh64(tsf);
786 	tsf = tsf - (tsf % (ni->ni_intval * IEEE80211_DUR_TU));
787 	tsf -= IEEE80211_DUR_TU;
788 	rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
789 	rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
790 
791 	rtwn_write_1(sc, R92C_BCN_CTRL,
792 	    rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
793 }
794 
795 void
796 rtwn_set_led(struct rtwn_softc *sc, int led, int on)
797 {
798 	uint8_t reg;
799 
800 	if (led != RTWN_LED_LINK)
801 		return; /* not supported */
802 
803 	if (sc->chip & RTWN_CHIP_PCI) {
804 		reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
805 		if (!on)
806 			reg |= R92C_LEDCFG2_DIS;
807 		else
808 			reg |= R92C_LEDCFG2_EN;
809 		rtwn_write_1(sc, R92C_LEDCFG2, reg);
810 	} else if (sc->chip & RTWN_CHIP_USB) {
811 		if (sc->chip & RTWN_CHIP_88E) {
812 			reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
813 			rtwn_write_1(sc, R92C_LEDCFG2, reg | R92C_LEDCFG2_EN);
814 			if (!on) {
815 				reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
816 				rtwn_write_1(sc, R92C_LEDCFG2,
817 				    reg | R92C_LEDCFG0_DIS);
818 				rtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
819 				    rtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
820 				    0xfe);
821 			}
822 		} else {
823 			reg = rtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
824 			if (!on)
825 				reg |= R92C_LEDCFG0_DIS;
826 			rtwn_write_1(sc, R92C_LEDCFG0, reg);
827 		}
828 	}
829 	sc->ledlink = on;	/* Save LED state. */
830 }
831 
832 void
833 rtwn_calib(struct rtwn_softc *sc)
834 {
835 	struct r92c_fw_cmd_rssi cmd;
836 
837 	if (sc->avg_pwdb != -1) {
838 		/* Indicate Rx signal strength to FW for rate adaptation. */
839 		memset(&cmd, 0, sizeof(cmd));
840 		cmd.macid = 0;	/* BSS. */
841 		cmd.pwdb = sc->avg_pwdb;
842 		DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
843 		rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
844 	}
845 
846 	/* Do temperature compensation. */
847 	rtwn_temp_calib(sc);
848 
849 	sc->sc_ops.next_calib(sc->sc_ops.cookie);
850 }
851 
852 void
853 rtwn_next_scan(struct rtwn_softc *sc)
854 {
855 	struct ieee80211com *ic = &sc->sc_ic;
856 	int s;
857 
858 	s = splnet();
859 	if (ic->ic_state == IEEE80211_S_SCAN)
860 		ieee80211_next_scan(&ic->ic_if);
861 	splx(s);
862 }
863 
864 int
865 rtwn_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
866 {
867 	struct rtwn_softc *sc = ic->ic_softc;
868 	struct ieee80211_node *ni;
869 	enum ieee80211_state ostate;
870 	uint32_t reg;
871 	int s, error;
872 
873 	s = splnet();
874 	ostate = ic->ic_state;
875 
876 	if (nstate != ostate)
877 		DPRINTF(("newstate %s -> %s\n",
878 		    ieee80211_state_name[ostate],
879 		    ieee80211_state_name[nstate]));
880 
881 	if (ostate == IEEE80211_S_RUN) {
882 		/* Stop calibration. */
883 		sc->sc_ops.cancel_calib(sc->sc_ops.cookie);
884 
885 		/* Turn link LED off. */
886 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
887 
888 		/* Set media status to 'No Link'. */
889 		reg = rtwn_read_4(sc, R92C_CR);
890 		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
891 		rtwn_write_4(sc, R92C_CR, reg);
892 
893 		/* Stop Rx of data frames. */
894 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
895 
896 		/* Rest TSF. */
897 		rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
898 
899 		/* Disable TSF synchronization. */
900 		rtwn_write_1(sc, R92C_BCN_CTRL,
901 		    rtwn_read_1(sc, R92C_BCN_CTRL) |
902 		    R92C_BCN_CTRL_DIS_TSF_UDT0);
903 
904 		/* Reset EDCA parameters. */
905 		rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
906 		rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
907 		rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
908 		rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
909 
910 		/* Disable 11b-only AP workaround (see rtwn_r88e_ra_init). */
911 		sc->sc_flags &= ~RTWN_FLAG_FORCE_RAID_11B;
912 	}
913 	switch (nstate) {
914 	case IEEE80211_S_INIT:
915 		/* Turn link LED off. */
916 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
917 		break;
918 	case IEEE80211_S_SCAN:
919 		if (ostate != IEEE80211_S_SCAN) {
920 			/* Allow Rx from any BSSID. */
921 			rtwn_write_4(sc, R92C_RCR,
922 			    rtwn_read_4(sc, R92C_RCR) &
923 			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
924 
925 			/* Set gain for scanning. */
926 			reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
927 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
928 			rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
929 
930 			if (!(sc->chip & RTWN_CHIP_88E)) {
931 				reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
932 				reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
933 				rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
934 			}
935 		}
936 
937 		/* Make link LED blink during scan. */
938 		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
939 
940 		/* Pause AC Tx queues. */
941 		rtwn_write_1(sc, R92C_TXPAUSE,
942 		    rtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
943 
944 		rtwn_set_chan(sc, ic->ic_bss->ni_chan, NULL);
945 		sc->sc_ops.next_scan(sc->sc_ops.cookie);
946 		break;
947 
948 	case IEEE80211_S_AUTH:
949 		/* Set initial gain under link. */
950 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
951 		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
952 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
953 
954 		if (!(sc->chip & RTWN_CHIP_88E)) {
955 			reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
956 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
957 			rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
958 		}
959 
960 		rtwn_set_chan(sc, ic->ic_bss->ni_chan, NULL);
961 		break;
962 	case IEEE80211_S_ASSOC:
963 		break;
964 	case IEEE80211_S_RUN:
965 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
966 			rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
967 
968 			/* Enable Rx of data frames. */
969 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
970 
971 			/* Turn link LED on. */
972 			rtwn_set_led(sc, RTWN_LED_LINK, 1);
973 			break;
974 		}
975 		ni = ic->ic_bss;
976 
977 		/* Set media status to 'Associated'. */
978 		reg = rtwn_read_4(sc, R92C_CR);
979 		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
980 		rtwn_write_4(sc, R92C_CR, reg);
981 
982 		/* Set BSSID. */
983 		rtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
984 		rtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
985 
986 		if (ic->ic_curmode == IEEE80211_MODE_11B)
987 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
988 		else	/* 802.11b/g */
989 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
990 
991 		/* Enable Rx of data frames. */
992 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
993 
994 		/* Flush all AC queues. */
995 		rtwn_write_1(sc, R92C_TXPAUSE, 0);
996 
997 		/* Set beacon interval. */
998 		rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
999 
1000 		/* Allow Rx from our BSSID only. */
1001 		rtwn_write_4(sc, R92C_RCR,
1002 		    rtwn_read_4(sc, R92C_RCR) |
1003 		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1004 
1005 		/* Enable TSF synchronization. */
1006 		rtwn_tsf_sync_enable(sc);
1007 
1008 		rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1009 		rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1010 		rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1011 		rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1012 		rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1013 		rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1014 
1015 		/* Intialize rate adaptation. */
1016 		rtwn_ra_init(sc);
1017 		/* Turn link LED on. */
1018 		rtwn_set_led(sc, RTWN_LED_LINK, 1);
1019 
1020 		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1021 		/* Reset temperature calibration state machine. */
1022 		sc->thcal_state = 0;
1023 		sc->thcal_lctemp = 0;
1024 		/* Start periodic calibration. */
1025 		sc->sc_ops.next_calib(sc->sc_ops.cookie);
1026 		break;
1027 	}
1028 
1029 	error = sc->sc_newstate(ic, nstate, arg);
1030 	splx(s);
1031 
1032 	return (error);
1033 }
1034 
1035 void
1036 rtwn_updateedca(struct ieee80211com *ic)
1037 {
1038 	struct rtwn_softc *sc = ic->ic_softc;
1039 	const uint16_t aci2reg[EDCA_NUM_AC] = {
1040 		R92C_EDCA_BE_PARAM,
1041 		R92C_EDCA_BK_PARAM,
1042 		R92C_EDCA_VI_PARAM,
1043 		R92C_EDCA_VO_PARAM
1044 	};
1045 	struct ieee80211_edca_ac_params *ac;
1046 	int s, aci, aifs, slottime;
1047 
1048 	s = splnet();
1049 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1050 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1051 		ac = &ic->ic_edca_ac[aci];
1052 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1053 		aifs = ac->ac_aifsn * slottime + 10;
1054 		rtwn_write_4(sc, aci2reg[aci],
1055 		    SM(R92C_EDCA_PARAM_TXOP, ac->ac_txoplimit) |
1056 		    SM(R92C_EDCA_PARAM_ECWMIN, ac->ac_ecwmin) |
1057 		    SM(R92C_EDCA_PARAM_ECWMAX, ac->ac_ecwmax) |
1058 		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1059 	}
1060 	splx(s);
1061 }
1062 
1063 int
1064 rtwn_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1065     struct ieee80211_key *k)
1066 {
1067 	struct rtwn_softc *sc = ic->ic_softc;
1068 	static const uint8_t etherzeroaddr[6] = { 0 };
1069 	const uint8_t *macaddr;
1070 	uint8_t keybuf[16], algo;
1071 	int i, entry;
1072 
1073 	/* Defer setting of WEP keys until interface is brought up. */
1074 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
1075 	    (IFF_UP | IFF_RUNNING))
1076 		return (0);
1077 
1078 	/* Map net80211 cipher to HW crypto algorithm. */
1079 	switch (k->k_cipher) {
1080 	case IEEE80211_CIPHER_WEP40:
1081 		algo = R92C_CAM_ALGO_WEP40;
1082 		break;
1083 	case IEEE80211_CIPHER_WEP104:
1084 		algo = R92C_CAM_ALGO_WEP104;
1085 		break;
1086 	case IEEE80211_CIPHER_TKIP:
1087 		algo = R92C_CAM_ALGO_TKIP;
1088 		break;
1089 	case IEEE80211_CIPHER_CCMP:
1090 		algo = R92C_CAM_ALGO_AES;
1091 		break;
1092 	default:
1093 		/* Fallback to software crypto for other ciphers. */
1094 		return (ieee80211_set_key(ic, ni, k));
1095 	}
1096 	if (k->k_flags & IEEE80211_KEY_GROUP) {
1097 		macaddr = etherzeroaddr;
1098 		entry = k->k_id;
1099 	} else {
1100 		macaddr = ic->ic_bss->ni_macaddr;
1101 		entry = 4;
1102 	}
1103 	/* Write key. */
1104 	memset(keybuf, 0, sizeof(keybuf));
1105 	memcpy(keybuf, k->k_key, MIN(k->k_len, sizeof(keybuf)));
1106 	for (i = 0; i < 4; i++) {
1107 		rtwn_cam_write(sc, R92C_CAM_KEY(entry, i),
1108 		    LE_READ_4(&keybuf[i * 4]));
1109 	}
1110 	/* Write CTL0 last since that will validate the CAM entry. */
1111 	rtwn_cam_write(sc, R92C_CAM_CTL1(entry),
1112 	    LE_READ_4(&macaddr[2]));
1113 	rtwn_cam_write(sc, R92C_CAM_CTL0(entry),
1114 	    SM(R92C_CAM_ALGO, algo) |
1115 	    SM(R92C_CAM_KEYID, k->k_id) |
1116 	    SM(R92C_CAM_MACLO, LE_READ_2(&macaddr[0])) |
1117 	    R92C_CAM_VALID);
1118 
1119 	return (0);
1120 }
1121 
1122 void
1123 rtwn_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1124     struct ieee80211_key *k)
1125 {
1126 	struct rtwn_softc *sc = ic->ic_softc;
1127 	int i, entry;
1128 
1129 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
1130 	    ic->ic_state != IEEE80211_S_RUN)
1131 		return;	/* Nothing to do. */
1132 
1133 	if (k->k_flags & IEEE80211_KEY_GROUP)
1134 		entry = k->k_id;
1135 	else
1136 		entry = 4;
1137 	rtwn_cam_write(sc, R92C_CAM_CTL0(entry), 0);
1138 	rtwn_cam_write(sc, R92C_CAM_CTL1(entry), 0);
1139 	/* Clear key. */
1140 	for (i = 0; i < 4; i++)
1141 		rtwn_cam_write(sc, R92C_CAM_KEY(entry, i), 0);
1142 }
1143 
1144 void
1145 rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
1146 {
1147 	int pwdb;
1148 
1149 	/* Convert antenna signal to percentage. */
1150 	if (rssi <= -100 || rssi >= 20)
1151 		pwdb = 0;
1152 	else if (rssi >= 0)
1153 		pwdb = 100;
1154 	else
1155 		pwdb = 100 + rssi;
1156 	if (rate <= 3) {
1157 		/* CCK gain is smaller than OFDM/MCS gain. */
1158 		pwdb += 6;
1159 		if (pwdb > 100)
1160 			pwdb = 100;
1161 		if (pwdb <= 14)
1162 			pwdb -= 4;
1163 		else if (pwdb <= 26)
1164 			pwdb -= 8;
1165 		else if (pwdb <= 34)
1166 			pwdb -= 6;
1167 		else if (pwdb <= 42)
1168 			pwdb -= 2;
1169 	}
1170 	if (sc->avg_pwdb == -1)	/* Init. */
1171 		sc->avg_pwdb = pwdb;
1172 	else if (sc->avg_pwdb < pwdb)
1173 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1174 	else
1175 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1176 	DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
1177 }
1178 
1179 int8_t
1180 rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1181 {
1182 	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1183 	struct r92c_rx_phystat *phy;
1184 	struct r92c_rx_cck *cck;
1185 	uint8_t rpt;
1186 	int8_t rssi;
1187 
1188 	if (sc->chip & RTWN_CHIP_88E)
1189 		return rtwn_r88e_get_rssi(sc, rate, physt);
1190 
1191 	if (rate <= 3) {
1192 		cck = (struct r92c_rx_cck *)physt;
1193 		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1194 			rpt = (cck->agc_rpt >> 5) & 0x3;
1195 			rssi = (cck->agc_rpt & 0x1f) << 1;
1196 		} else {
1197 			rpt = (cck->agc_rpt >> 6) & 0x3;
1198 			rssi = cck->agc_rpt & 0x3e;
1199 		}
1200 		rssi = cckoff[rpt] - rssi;
1201 	} else {	/* OFDM/HT. */
1202 		phy = (struct r92c_rx_phystat *)physt;
1203 		rssi = ((letoh32(phy->phydw1) >> 1) & 0x7f) - 110;
1204 	}
1205 	return (rssi);
1206 }
1207 
1208 int8_t
1209 rtwn_r88e_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1210 {
1211 	struct r92c_rx_phystat *phy;
1212 	struct r88e_rx_cck *cck;
1213 	uint8_t cck_agc_rpt, lna_idx, vga_idx;
1214 	int8_t rssi;
1215 
1216 	rssi = 0;
1217 	if (rate <= 3) {
1218 		cck = (struct r88e_rx_cck *)physt;
1219 		cck_agc_rpt = cck->agc_rpt;
1220 		lna_idx = (cck_agc_rpt & 0xe0) >> 5;
1221 		vga_idx = cck_agc_rpt & 0x1f;
1222 		switch (lna_idx) {
1223 		case 7:
1224 			if (vga_idx <= 27)
1225 				rssi = -100 + 2* (27 - vga_idx);
1226 			else
1227 				rssi = -100;
1228 			break;
1229 		case 6:
1230 			rssi = -48 + 2 * (2 - vga_idx);
1231 			break;
1232 		case 5:
1233 			rssi = -42 + 2 * (7 - vga_idx);
1234 			break;
1235 		case 4:
1236 			rssi = -36 + 2 * (7 - vga_idx);
1237 			break;
1238 		case 3:
1239 			rssi = -24 + 2 * (7 - vga_idx);
1240 			break;
1241 		case 2:
1242 			rssi = -12 + 2 * (5 - vga_idx);
1243 			break;
1244 		case 1:
1245 			rssi = 8 - (2 * vga_idx);
1246 			break;
1247 		case 0:
1248 			rssi = 14 - (2 * vga_idx);
1249 			break;
1250 		}
1251 		rssi += 6;
1252 	} else {	/* OFDM/HT. */
1253 		phy = (struct r92c_rx_phystat *)physt;
1254 		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1255 	}
1256 	return (rssi);
1257 }
1258 
1259 void
1260 rtwn_start(struct ifnet *ifp)
1261 {
1262 	struct rtwn_softc *sc = ifp->if_softc;
1263 	struct ieee80211com *ic = &sc->sc_ic;
1264 	struct ieee80211_node *ni;
1265 	struct mbuf *m;
1266 
1267 	if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
1268 		return;
1269 
1270 	for (;;) {
1271 		if (sc->sc_ops.is_oactive(sc->sc_ops.cookie)) {
1272 			ifq_set_oactive(&ifp->if_snd);
1273 			break;
1274 		}
1275 		/* Send pending management frames first. */
1276 		m = mq_dequeue(&ic->ic_mgtq);
1277 		if (m != NULL) {
1278 			ni = m->m_pkthdr.ph_cookie;
1279 			goto sendit;
1280 		}
1281 		if (ic->ic_state != IEEE80211_S_RUN)
1282 			break;
1283 
1284 		/* Encapsulate and send data frames. */
1285 		IFQ_DEQUEUE(&ifp->if_snd, m);
1286 		if (m == NULL)
1287 			break;
1288 #if NBPFILTER > 0
1289 		if (ifp->if_bpf != NULL)
1290 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1291 #endif
1292 		if ((m = ieee80211_encap(ifp, m, &ni)) == NULL)
1293 			continue;
1294 sendit:
1295 #if NBPFILTER > 0
1296 		if (ic->ic_rawbpf != NULL)
1297 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1298 #endif
1299 		if (sc->sc_ops.tx(sc->sc_ops.cookie, m, ni) != 0) {
1300 			ieee80211_release_node(ic, ni);
1301 			ifp->if_oerrors++;
1302 			continue;
1303 		}
1304 
1305 		sc->sc_tx_timer = 5;
1306 		ifp->if_timer = 1;
1307 	}
1308 }
1309 
1310 void
1311 rtwn_watchdog(struct ifnet *ifp)
1312 {
1313 	struct rtwn_softc *sc = ifp->if_softc;
1314 
1315 	ifp->if_timer = 0;
1316 
1317 	if (sc->sc_tx_timer > 0) {
1318 		if (--sc->sc_tx_timer == 0) {
1319 			printf("%s: device timeout\n", sc->sc_pdev->dv_xname);
1320 			task_add(systq, &sc->init_task);
1321 			ifp->if_oerrors++;
1322 			return;
1323 		}
1324 		ifp->if_timer = 1;
1325 	}
1326 	ieee80211_watchdog(ifp);
1327 }
1328 
1329 int
1330 rtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1331 {
1332 	struct rtwn_softc *sc = ifp->if_softc;
1333 	struct ieee80211com *ic = &sc->sc_ic;
1334 	struct ifreq *ifr;
1335 	int s, error = 0;
1336 
1337 	s = splnet();
1338 	/*
1339 	 * Prevent processes from entering this function while another
1340 	 * process is tsleep'ing in it.
1341 	 */
1342 	while ((sc->sc_flags & RTWN_FLAG_BUSY) && error == 0)
1343 		error = tsleep(&sc->sc_flags, PCATCH, "rtwnioc", 0);
1344 	if (error != 0) {
1345 		splx(s);
1346 		return error;
1347 	}
1348 	sc->sc_flags |= RTWN_FLAG_BUSY;
1349 
1350 	switch (cmd) {
1351 	case SIOCSIFADDR:
1352 		ifp->if_flags |= IFF_UP;
1353 		/* FALLTHROUGH */
1354 	case SIOCSIFFLAGS:
1355 		if (ifp->if_flags & IFF_UP) {
1356 			if (!(ifp->if_flags & IFF_RUNNING))
1357 				rtwn_init(ifp);
1358 		} else {
1359 			if (ifp->if_flags & IFF_RUNNING)
1360 				rtwn_stop(ifp);
1361 		}
1362 		break;
1363 	case SIOCADDMULTI:
1364 	case SIOCDELMULTI:
1365 		ifr = (struct ifreq *)data;
1366 		error = (cmd == SIOCADDMULTI) ?
1367 		    ether_addmulti(ifr, &ic->ic_ac) :
1368 		    ether_delmulti(ifr, &ic->ic_ac);
1369 		if (error == ENETRESET)
1370 			error = 0;
1371 		break;
1372 	case SIOCS80211CHANNEL:
1373 		error = ieee80211_ioctl(ifp, cmd, data);
1374 		if (error == ENETRESET &&
1375 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
1376 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1377 			    (IFF_UP | IFF_RUNNING))
1378 				rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
1379 			error = 0;
1380 		}
1381 		break;
1382 	default:
1383 		error = ieee80211_ioctl(ifp, cmd, data);
1384 	}
1385 
1386 	if (error == ENETRESET) {
1387 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1388 		    (IFF_UP | IFF_RUNNING)) {
1389 			rtwn_stop(ifp);
1390 			rtwn_init(ifp);
1391 		}
1392 		error = 0;
1393 	}
1394 	sc->sc_flags &= ~RTWN_FLAG_BUSY;
1395 	wakeup(&sc->sc_flags);
1396 	splx(s);
1397 
1398 	return (error);
1399 }
1400 
1401 void
1402 rtwn_fw_reset(struct rtwn_softc *sc)
1403 {
1404 	uint16_t reg;
1405 	int ntries;
1406 
1407 	/* Tell 8051 to reset itself. */
1408 	rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
1409 
1410 	/* Wait until 8051 resets by itself. */
1411 	for (ntries = 0; ntries < 100; ntries++) {
1412 		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1413 		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
1414 			goto sleep;
1415 		DELAY(50);
1416 	}
1417 	/* Force 8051 reset. */
1418 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1419 sleep:
1420 	if (sc->chip & RTWN_CHIP_PCI) {
1421 		/*
1422 		 * We must sleep for one second to let the firmware settle.
1423 		 * Accessing registers too early will hang the whole system.
1424 		 */
1425 		tsleep(&reg, 0, "rtwnrst", hz);
1426 	}
1427 }
1428 
1429 void
1430 rtwn_r88e_fw_reset(struct rtwn_softc *sc)
1431 {
1432 	uint16_t reg;
1433 
1434 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1435 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1436 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
1437 }
1438 
1439 int
1440 rtwn_load_firmware(struct rtwn_softc *sc)
1441 {
1442 	const struct r92c_fw_hdr *hdr;
1443 	u_char *fw, *ptr;
1444 	size_t len;
1445 	uint32_t reg;
1446 	int mlen, ntries, page, error;
1447 
1448 	/* Read firmware image from the filesystem. */
1449 	error = sc->sc_ops.load_firmware(sc->sc_ops.cookie, &fw, &len);
1450 	if (error)
1451 		return (error);
1452 	if (len < sizeof(*hdr)) {
1453 		printf("%s: firmware too short\n", sc->sc_pdev->dv_xname);
1454 		error = EINVAL;
1455 		goto fail;
1456 	}
1457 	ptr = fw;
1458 	hdr = (const struct r92c_fw_hdr *)ptr;
1459 	/* Check if there is a valid FW header and skip it. */
1460 	if ((letoh16(hdr->signature) >> 4) == 0x88c ||
1461 	    (letoh16(hdr->signature) >> 4) == 0x88e ||
1462 	    (letoh16(hdr->signature) >> 4) == 0x92c) {
1463 		DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
1464 		    letoh16(hdr->version), letoh16(hdr->subversion),
1465 		    hdr->month, hdr->date, hdr->hour, hdr->minute));
1466 		ptr += sizeof(*hdr);
1467 		len -= sizeof(*hdr);
1468 	}
1469 
1470 	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
1471 		if (sc->chip & RTWN_CHIP_88E)
1472 			rtwn_r88e_fw_reset(sc);
1473 		else
1474 			rtwn_fw_reset(sc);
1475 		rtwn_write_1(sc, R92C_MCUFWDL, 0);
1476 	}
1477 
1478 	/* Enable FW download. */
1479 	if (!(sc->chip & RTWN_CHIP_88E))
1480 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1481 		    rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
1482 		    R92C_SYS_FUNC_EN_CPUEN);
1483 
1484 	rtwn_write_1(sc, R92C_MCUFWDL,
1485 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
1486 	rtwn_write_1(sc, R92C_MCUFWDL + 2,
1487 	    rtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
1488 
1489 	/* Reset the FWDL checksum. */
1490 	rtwn_write_1(sc, R92C_MCUFWDL,
1491 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
1492 
1493 	for (page = 0; len > 0; page++) {
1494 		mlen = MIN(len, R92C_FW_PAGE_SIZE);
1495 		error = sc->sc_ops.fw_loadpage(sc->sc_ops.cookie, page, ptr,
1496 		    mlen);
1497 		if (error != 0) {
1498 			printf("%s: could not load firmware page %d\n",
1499 			    sc->sc_pdev->dv_xname, page);
1500 			goto fail;
1501 		}
1502 		ptr += mlen;
1503 		len -= mlen;
1504 	}
1505 
1506 	/* Disable FW download. */
1507 	rtwn_write_1(sc, R92C_MCUFWDL,
1508 	    rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
1509 	rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
1510 
1511 	/* Wait for checksum report. */
1512 	for (ntries = 0; ntries < 1000; ntries++) {
1513 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
1514 			break;
1515 		DELAY(5);
1516 	}
1517 	if (ntries == 1000) {
1518 		printf("%s: timeout waiting for checksum report\n",
1519 		    sc->sc_pdev->dv_xname);
1520 		error = ETIMEDOUT;
1521 		goto fail;
1522 	}
1523 
1524 	reg = rtwn_read_4(sc, R92C_MCUFWDL);
1525 	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
1526 	rtwn_write_4(sc, R92C_MCUFWDL, reg);
1527 	if (sc->chip & RTWN_CHIP_88E)
1528 		rtwn_r88e_fw_reset(sc);
1529 	/* Wait for firmware readiness. */
1530 	for (ntries = 0; ntries < 1000; ntries++) {
1531 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
1532 			break;
1533 		DELAY(10);
1534 	}
1535 	if (ntries == 1000) {
1536 		printf("%s: timeout waiting for firmware readiness\n",
1537 		    sc->sc_pdev->dv_xname);
1538 		error = ETIMEDOUT;
1539 		goto fail;
1540 	}
1541  fail:
1542 	free(fw, M_DEVBUF, len);
1543 	return (error);
1544 }
1545 
1546 void
1547 rtwn_rf_init(struct rtwn_softc *sc)
1548 {
1549 	const struct r92c_rf_prog *prog;
1550 	uint32_t reg, type;
1551 	int i, j, idx, off;
1552 
1553 	/* Select RF programming based on board type. */
1554 	if (sc->chip & RTWN_CHIP_88E)
1555 		prog = rtl8188eu_rf_prog;
1556 	else if (!(sc->chip & RTWN_CHIP_92C)) {
1557 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
1558 			prog = rtl8188ce_rf_prog;
1559 		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
1560 			prog = rtl8188ru_rf_prog;
1561 		else
1562 			prog = rtl8188cu_rf_prog;
1563 	} else
1564 		prog = rtl8192ce_rf_prog;
1565 
1566 	for (i = 0; i < sc->nrxchains; i++) {
1567 		/* Save RF_ENV control type. */
1568 		idx = i / 2;
1569 		off = (i % 2) * 16;
1570 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
1571 		type = (reg >> off) & 0x10;
1572 
1573 		/* Set RF_ENV enable. */
1574 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
1575 		reg |= 0x100000;
1576 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
1577 		DELAY(1);
1578 		/* Set RF_ENV output high. */
1579 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
1580 		reg |= 0x10;
1581 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
1582 		DELAY(1);
1583 		/* Set address and data lengths of RF registers. */
1584 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
1585 		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
1586 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
1587 		DELAY(1);
1588 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
1589 		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
1590 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
1591 		DELAY(1);
1592 
1593 		/* Write RF initialization values for this chain. */
1594 		for (j = 0; j < prog[i].count; j++) {
1595 			if (prog[i].regs[j] >= 0xf9 &&
1596 			    prog[i].regs[j] <= 0xfe) {
1597 				/*
1598 				 * These are fake RF registers offsets that
1599 				 * indicate a delay is required.
1600 				 */
1601 				DELAY(50);
1602 				continue;
1603 			}
1604 			rtwn_rf_write(sc, i, prog[i].regs[j],
1605 			    prog[i].vals[j]);
1606 			DELAY(1);
1607 		}
1608 
1609 		/* Restore RF_ENV control type. */
1610 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
1611 		reg &= ~(0x10 << off) | (type << off);
1612 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
1613 
1614 		/* Cache RF register CHNLBW. */
1615 		sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
1616 	}
1617 
1618 	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
1619 	    RTWN_CHIP_UMC_A_CUT) {
1620 		rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
1621 		rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
1622 	}
1623 }
1624 
1625 void
1626 rtwn_cam_init(struct rtwn_softc *sc)
1627 {
1628 	/* Invalidate all CAM entries. */
1629 	rtwn_write_4(sc, R92C_CAMCMD,
1630 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
1631 }
1632 
1633 void
1634 rtwn_pa_bias_init(struct rtwn_softc *sc)
1635 {
1636 	uint8_t reg;
1637 	int i;
1638 
1639 	for (i = 0; i < sc->nrxchains; i++) {
1640 		if (sc->pa_setting & (1 << i))
1641 			continue;
1642 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
1643 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
1644 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
1645 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
1646 	}
1647 	if (!(sc->pa_setting & 0x10)) {
1648 		reg = rtwn_read_1(sc, 0x16);
1649 		reg = (reg & ~0xf0) | 0x90;
1650 		rtwn_write_1(sc, 0x16, reg);
1651 	}
1652 }
1653 
1654 void
1655 rtwn_rxfilter_init(struct rtwn_softc *sc)
1656 {
1657 	/* Initialize Rx filter. */
1658 	/* TODO: use better filter for monitor mode. */
1659 	rtwn_write_4(sc, R92C_RCR,
1660 	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
1661 	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
1662 	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
1663 	/* Accept all multicast frames. */
1664 	rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
1665 	rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
1666 	/* Accept all management frames. */
1667 	rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
1668 	/* Reject all control frames. */
1669 	rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
1670 	/* Accept all data frames. */
1671 	rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1672 }
1673 
1674 void
1675 rtwn_edca_init(struct rtwn_softc *sc)
1676 {
1677 	/* XXX Use the same values for PCI and USB? */
1678 	if (sc->chip & RTWN_CHIP_PCI) {
1679 		rtwn_write_2(sc, R92C_SPEC_SIFS, 0x1010);
1680 		rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x1010);
1681 		rtwn_write_2(sc, R92C_SIFS_CCK, 0x1010);
1682 		rtwn_write_2(sc, R92C_SIFS_OFDM, 0x0e0e);
1683 		rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
1684 		rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
1685 		rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4322);
1686 		rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3222);
1687 	} else if (sc->chip & RTWN_CHIP_USB) {
1688 		rtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
1689 		rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
1690 		rtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
1691 		rtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
1692 		rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
1693 		rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
1694 		rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005ea324);
1695 		rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002fa226);
1696 	}
1697 }
1698 
1699 void
1700 rtwn_write_txpower(struct rtwn_softc *sc, int chain,
1701     uint16_t power[RTWN_RIDX_COUNT])
1702 {
1703 	uint32_t reg;
1704 
1705 	/* Write per-CCK rate Tx power. */
1706 	if (chain == 0) {
1707 		reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
1708 		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
1709 		rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
1710 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
1711 		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
1712 		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
1713 		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
1714 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
1715 	} else {
1716 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
1717 		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
1718 		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
1719 		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
1720 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
1721 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
1722 		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
1723 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
1724 	}
1725 	/* Write per-OFDM rate Tx power. */
1726 	rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
1727 	    SM(R92C_TXAGC_RATE06, power[ 4]) |
1728 	    SM(R92C_TXAGC_RATE09, power[ 5]) |
1729 	    SM(R92C_TXAGC_RATE12, power[ 6]) |
1730 	    SM(R92C_TXAGC_RATE18, power[ 7]));
1731 	rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
1732 	    SM(R92C_TXAGC_RATE24, power[ 8]) |
1733 	    SM(R92C_TXAGC_RATE36, power[ 9]) |
1734 	    SM(R92C_TXAGC_RATE48, power[10]) |
1735 	    SM(R92C_TXAGC_RATE54, power[11]));
1736 	/* Write per-MCS Tx power. */
1737 	rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
1738 	    SM(R92C_TXAGC_MCS00,  power[12]) |
1739 	    SM(R92C_TXAGC_MCS01,  power[13]) |
1740 	    SM(R92C_TXAGC_MCS02,  power[14]) |
1741 	    SM(R92C_TXAGC_MCS03,  power[15]));
1742 	rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
1743 	    SM(R92C_TXAGC_MCS04,  power[16]) |
1744 	    SM(R92C_TXAGC_MCS05,  power[17]) |
1745 	    SM(R92C_TXAGC_MCS06,  power[18]) |
1746 	    SM(R92C_TXAGC_MCS07,  power[19]));
1747 	rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
1748 	    SM(R92C_TXAGC_MCS08,  power[20]) |
1749 	    SM(R92C_TXAGC_MCS09,  power[21]) |
1750 	    SM(R92C_TXAGC_MCS10,  power[22]) |
1751 	    SM(R92C_TXAGC_MCS11,  power[23]));
1752 	rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
1753 	    SM(R92C_TXAGC_MCS12,  power[24]) |
1754 	    SM(R92C_TXAGC_MCS13,  power[25]) |
1755 	    SM(R92C_TXAGC_MCS14,  power[26]) |
1756 	    SM(R92C_TXAGC_MCS15,  power[27]));
1757 }
1758 
1759 void
1760 rtwn_get_txpower(struct rtwn_softc *sc, int chain,
1761     struct ieee80211_channel *c, struct ieee80211_channel *extc,
1762     uint16_t power[RTWN_RIDX_COUNT])
1763 {
1764 	struct ieee80211com *ic = &sc->sc_ic;
1765 	struct r92c_rom *rom = &sc->rom;
1766 	uint16_t cckpow, ofdmpow, htpow, diff, max;
1767 	const struct r92c_txpwr *base;
1768 	int ridx, chan, group;
1769 
1770 	/* Determine channel group. */
1771 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
1772 	if (chan <= 3)
1773 		group = 0;
1774 	else if (chan <= 9)
1775 		group = 1;
1776 	else
1777 		group = 2;
1778 
1779 	/* Get original Tx power based on board type and RF chain. */
1780 	if (!(sc->chip & RTWN_CHIP_92C)) {
1781 		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
1782 			base = &rtl8188ru_txagc[chain];
1783 		else
1784 			base = &rtl8192cu_txagc[chain];
1785 	} else
1786 		base = &rtl8192cu_txagc[chain];
1787 
1788 	memset(power, 0, RTWN_RIDX_COUNT * sizeof(power[0]));
1789 	if (sc->regulatory == 0) {
1790 		for (ridx = 0; ridx <= 3; ridx++)
1791 			power[ridx] = base->pwr[0][ridx];
1792 	}
1793 	for (ridx = 4; ridx < RTWN_RIDX_COUNT; ridx++) {
1794 		if (sc->regulatory == 3) {
1795 			power[ridx] = base->pwr[0][ridx];
1796 			/* Apply vendor limits. */
1797 			if (extc != NULL)
1798 				max = rom->ht40_max_pwr[group];
1799 			else
1800 				max = rom->ht20_max_pwr[group];
1801 			max = (max >> (chain * 4)) & 0xf;
1802 			if (power[ridx] > max)
1803 				power[ridx] = max;
1804 		} else if (sc->regulatory == 1) {
1805 			if (extc == NULL)
1806 				power[ridx] = base->pwr[group][ridx];
1807 		} else if (sc->regulatory != 2)
1808 			power[ridx] = base->pwr[0][ridx];
1809 	}
1810 
1811 	/* Compute per-CCK rate Tx power. */
1812 	cckpow = rom->cck_tx_pwr[chain][group];
1813 	for (ridx = 0; ridx <= 3; ridx++) {
1814 		power[ridx] += cckpow;
1815 		if (power[ridx] > R92C_MAX_TX_PWR)
1816 			power[ridx] = R92C_MAX_TX_PWR;
1817 	}
1818 
1819 	htpow = rom->ht40_1s_tx_pwr[chain][group];
1820 	if (sc->ntxchains > 1) {
1821 		/* Apply reduction for 2 spatial streams. */
1822 		diff = rom->ht40_2s_tx_pwr_diff[group];
1823 		diff = (diff >> (chain * 4)) & 0xf;
1824 		htpow = (htpow > diff) ? htpow - diff : 0;
1825 	}
1826 
1827 	/* Compute per-OFDM rate Tx power. */
1828 	diff = rom->ofdm_tx_pwr_diff[group];
1829 	diff = (diff >> (chain * 4)) & 0xf;
1830 	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
1831 	for (ridx = 4; ridx <= 11; ridx++) {
1832 		power[ridx] += ofdmpow;
1833 		if (power[ridx] > R92C_MAX_TX_PWR)
1834 			power[ridx] = R92C_MAX_TX_PWR;
1835 	}
1836 
1837 	/* Compute per-MCS Tx power. */
1838 	if (extc == NULL) {
1839 		diff = rom->ht20_tx_pwr_diff[group];
1840 		diff = (diff >> (chain * 4)) & 0xf;
1841 		htpow += diff;	/* HT40->HT20 correction. */
1842 	}
1843 	for (ridx = 12; ridx <= 27; ridx++) {
1844 		power[ridx] += htpow;
1845 		if (power[ridx] > R92C_MAX_TX_PWR)
1846 			power[ridx] = R92C_MAX_TX_PWR;
1847 	}
1848 #ifdef RTWN_DEBUG
1849 	if (rtwn_debug >= 4) {
1850 		/* Dump per-rate Tx power values. */
1851 		printf("Tx power for chain %d:\n", chain);
1852 		for (ridx = 0; ridx < RTWN_RIDX_COUNT; ridx++)
1853 			printf("Rate %d = %u\n", ridx, power[ridx]);
1854 	}
1855 #endif
1856 }
1857 
1858 void
1859 rtwn_r88e_get_txpower(struct rtwn_softc *sc, int chain,
1860     struct ieee80211_channel *c, struct ieee80211_channel *extc,
1861     uint16_t power[RTWN_RIDX_COUNT])
1862 {
1863 	struct ieee80211com *ic = &sc->sc_ic;
1864 	uint16_t cckpow, ofdmpow, bw20pow, htpow;
1865 	const struct r88e_txpwr *base;
1866 	int ridx, chan, group;
1867 
1868 	/* Determine channel group. */
1869 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
1870 	if (chan <= 2)
1871 		group = 0;
1872 	else if (chan <= 5)
1873 		group = 1;
1874 	else if (chan <= 8)
1875 		group = 2;
1876 	else if (chan <= 11)
1877 		group = 3;
1878 	else if (chan <= 13)
1879 		group = 4;
1880 	else
1881 		group = 5;
1882 
1883 	/* Get original Tx power based on board type and RF chain. */
1884 	base = &rtl8188eu_txagc[chain];
1885 
1886 	memset(power, 0, RTWN_RIDX_COUNT * sizeof(power[0]));
1887 	if (sc->regulatory == 0) {
1888 		for (ridx = 0; ridx <= 3; ridx++)
1889 			power[ridx] = base->pwr[0][ridx];
1890 	}
1891 	for (ridx = 4; ridx < RTWN_RIDX_COUNT; ridx++) {
1892 		if (sc->regulatory == 3)
1893 			power[ridx] = base->pwr[0][ridx];
1894 		else if (sc->regulatory == 1) {
1895 			if (extc == NULL)
1896 				power[ridx] = base->pwr[group][ridx];
1897 		} else if (sc->regulatory != 2)
1898 			power[ridx] = base->pwr[0][ridx];
1899 	}
1900 
1901 	/* Compute per-CCK rate Tx power. */
1902 	cckpow = sc->cck_tx_pwr[group];
1903 	for (ridx = 0; ridx <= 3; ridx++) {
1904 		power[ridx] += cckpow;
1905 		if (power[ridx] > R92C_MAX_TX_PWR)
1906 			power[ridx] = R92C_MAX_TX_PWR;
1907 	}
1908 
1909 	htpow = sc->ht40_tx_pwr[group];
1910 
1911 	/* Compute per-OFDM rate Tx power. */
1912 	ofdmpow = htpow + sc->ofdm_tx_pwr_diff;
1913 	for (ridx = 4; ridx <= 11; ridx++) {
1914 		power[ridx] += ofdmpow;
1915 		if (power[ridx] > R92C_MAX_TX_PWR)
1916 			power[ridx] = R92C_MAX_TX_PWR;
1917 	}
1918 
1919 	bw20pow = htpow + sc->bw20_tx_pwr_diff;
1920 	for (ridx = 12; ridx <= 27; ridx++) {
1921 		power[ridx] += bw20pow;
1922 		if (power[ridx] > R92C_MAX_TX_PWR)
1923 			power[ridx] = R92C_MAX_TX_PWR;
1924 	}
1925 }
1926 
1927 void
1928 rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
1929     struct ieee80211_channel *extc)
1930 {
1931 	uint16_t power[RTWN_RIDX_COUNT];
1932 	int i;
1933 
1934 	for (i = 0; i < sc->ntxchains; i++) {
1935 		/* Compute per-rate Tx power values. */
1936 		if (sc->chip & RTWN_CHIP_88E)
1937 			rtwn_r88e_get_txpower(sc, i, c, extc, power);
1938 		else
1939 			rtwn_get_txpower(sc, i, c, extc, power);
1940 		/* Write per-rate Tx power values to hardware. */
1941 		rtwn_write_txpower(sc, i, power);
1942 	}
1943 }
1944 
1945 void
1946 rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
1947     struct ieee80211_channel *extc)
1948 {
1949 	struct ieee80211com *ic = &sc->sc_ic;
1950 	u_int chan;
1951 	int i;
1952 
1953 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
1954 
1955 	/* Set Tx power for this new channel. */
1956 	rtwn_set_txpower(sc, c, extc);
1957 
1958 	for (i = 0; i < sc->nrxchains; i++) {
1959 		rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
1960 		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
1961 	}
1962 	if (extc != NULL) {
1963 		uint32_t reg;
1964 
1965 		/* Is secondary channel below or above primary? */
1966 		int prichlo = c->ic_freq < extc->ic_freq;
1967 
1968 		rtwn_write_1(sc, R92C_BWOPMODE,
1969 		    rtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
1970 
1971 		reg = rtwn_read_1(sc, R92C_RRSR + 2);
1972 		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
1973 		rtwn_write_1(sc, R92C_RRSR + 2, reg);
1974 
1975 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
1976 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
1977 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
1978 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
1979 
1980 		/* Set CCK side band. */
1981 		reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
1982 		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
1983 		rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
1984 
1985 		reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
1986 		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
1987 		rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
1988 
1989 		rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
1990 		    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
1991 		    ~R92C_FPGA0_ANAPARAM2_CBW20);
1992 
1993 		reg = rtwn_bb_read(sc, 0x818);
1994 		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
1995 		rtwn_bb_write(sc, 0x818, reg);
1996 
1997 		/* Select 40MHz bandwidth. */
1998 		rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
1999 		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2000 	} else {
2001 		rtwn_write_1(sc, R92C_BWOPMODE,
2002 		    rtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2003 
2004 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2005 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2006 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2007 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2008 
2009 		if (!(sc->chip & RTWN_CHIP_88E)) {
2010 			rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2011 			    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2012 			    R92C_FPGA0_ANAPARAM2_CBW20);
2013 		}
2014 
2015 		/* Select 20MHz bandwidth. */
2016 		rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2017 		    (sc->rf_chnlbw[0] & ~0xfff) | chan |
2018 		    ((sc->chip & RTWN_CHIP_88E) ? R88E_RF_CHNLBW_BW20 :
2019 		    R92C_RF_CHNLBW_BW20));
2020 	}
2021 }
2022 
2023 int
2024 rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
2025     uint16_t rx[2])
2026 {
2027 	uint32_t status;
2028 	int offset = chain * 0x20;
2029 
2030 	if (chain == 0) {	/* IQ calibration for chain 0. */
2031 		/* IQ calibration settings for chain 0. */
2032 		rtwn_bb_write(sc, 0xe30, 0x10008c1f);
2033 		rtwn_bb_write(sc, 0xe34, 0x10008c1f);
2034 		rtwn_bb_write(sc, 0xe38, 0x82140102);
2035 
2036 		if (sc->ntxchains > 1) {
2037 			rtwn_bb_write(sc, 0xe3c, 0x28160202);	/* 2T */
2038 			/* IQ calibration settings for chain 1. */
2039 			rtwn_bb_write(sc, 0xe50, 0x10008c22);
2040 			rtwn_bb_write(sc, 0xe54, 0x10008c22);
2041 			rtwn_bb_write(sc, 0xe58, 0x82140102);
2042 			rtwn_bb_write(sc, 0xe5c, 0x28160202);
2043 		} else
2044 			rtwn_bb_write(sc, 0xe3c, 0x28160502);	/* 1T */
2045 
2046 		/* LO calibration settings. */
2047 		rtwn_bb_write(sc, 0xe4c, 0x001028d1);
2048 		/* We're doing LO and IQ calibration in one shot. */
2049 		rtwn_bb_write(sc, 0xe48, 0xf9000000);
2050 		rtwn_bb_write(sc, 0xe48, 0xf8000000);
2051 
2052 	} else {		/* IQ calibration for chain 1. */
2053 		/* We're doing LO and IQ calibration in one shot. */
2054 		rtwn_bb_write(sc, 0xe60, 0x00000002);
2055 		rtwn_bb_write(sc, 0xe60, 0x00000000);
2056 	}
2057 
2058 	/* Give LO and IQ calibrations the time to complete. */
2059 	DELAY(1000);
2060 
2061 	/* Read IQ calibration status. */
2062 	status = rtwn_bb_read(sc, 0xeac);
2063 
2064 	if (status & (1 << (28 + chain * 3)))
2065 		return (0);	/* Tx failed. */
2066 	/* Read Tx IQ calibration results. */
2067 	tx[0] = (rtwn_bb_read(sc, 0xe94 + offset) >> 16) & 0x3ff;
2068 	tx[1] = (rtwn_bb_read(sc, 0xe9c + offset) >> 16) & 0x3ff;
2069 	if (tx[0] == 0x142 || tx[1] == 0x042)
2070 		return (0);	/* Tx failed. */
2071 
2072 	if (status & (1 << (27 + chain * 3)))
2073 		return (1);	/* Rx failed. */
2074 	/* Read Rx IQ calibration results. */
2075 	rx[0] = (rtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff;
2076 	rx[1] = (rtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff;
2077 	if (rx[0] == 0x132 || rx[1] == 0x036)
2078 		return (1);	/* Rx failed. */
2079 
2080 	return (3);	/* Both Tx and Rx succeeded. */
2081 }
2082 
2083 void
2084 rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
2085     uint16_t rx[2][2])
2086 {
2087 	/* Registers to save and restore during IQ calibration. */
2088 	struct iq_cal_regs {
2089 		uint32_t	adda[16];
2090 		uint8_t		txpause;
2091 		uint8_t		bcn_ctrl;
2092 		uint8_t		ustime_tsf;
2093 		uint32_t	gpio_muxcfg;
2094 		uint32_t	ofdm0_trxpathena;
2095 		uint32_t	ofdm0_trmuxpar;
2096 		uint32_t	fpga0_rfifacesw1;
2097 	} iq_cal_regs;
2098 	static const uint16_t reg_adda[16] = {
2099 		0x85c, 0xe6c, 0xe70, 0xe74,
2100 		0xe78, 0xe7c, 0xe80, 0xe84,
2101 		0xe88, 0xe8c, 0xed0, 0xed4,
2102 		0xed8, 0xedc, 0xee0, 0xeec
2103 	};
2104 	int i, chain;
2105 	uint32_t hssi_param1;
2106 
2107 	if (n == 0) {
2108 		for (i = 0; i < nitems(reg_adda); i++)
2109 			iq_cal_regs.adda[i] = rtwn_bb_read(sc, reg_adda[i]);
2110 
2111 		iq_cal_regs.txpause = rtwn_read_1(sc, R92C_TXPAUSE);
2112 		iq_cal_regs.bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
2113 		iq_cal_regs.ustime_tsf = rtwn_read_1(sc, R92C_USTIME_TSF);
2114 		iq_cal_regs.gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
2115 	}
2116 
2117 	if (sc->ntxchains == 1) {
2118 		rtwn_bb_write(sc, reg_adda[0], 0x0b1b25a0);
2119 		for (i = 1; i < nitems(reg_adda); i++)
2120 			rtwn_bb_write(sc, reg_adda[i], 0x0bdb25a0);
2121 	} else {
2122 		for (i = 0; i < nitems(reg_adda); i++)
2123 			rtwn_bb_write(sc, reg_adda[i], 0x04db25a4);
2124 	}
2125 
2126 	hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
2127 	if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2128 		rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2129 		    hssi_param1 | R92C_HSSI_PARAM1_PI);
2130 		rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2131 		    hssi_param1 | R92C_HSSI_PARAM1_PI);
2132 	}
2133 
2134 	if (n == 0) {
2135 		iq_cal_regs.ofdm0_trxpathena =
2136 		    rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2137 		iq_cal_regs.ofdm0_trmuxpar =
2138 		    rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
2139 		iq_cal_regs.fpga0_rfifacesw1 =
2140 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
2141 	}
2142 
2143 	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
2144 	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
2145 	rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
2146 	if (sc->ntxchains > 1) {
2147 		rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2148 		rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
2149 	}
2150 
2151 	rtwn_write_1(sc, R92C_TXPAUSE, 0x3f);
2152 	rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl & ~(0x08));
2153 	rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf & ~(0x08));
2154 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2155 	    iq_cal_regs.gpio_muxcfg & ~(0x20));
2156 
2157 	rtwn_bb_write(sc, 0x0b68, 0x00080000);
2158 	if (sc->ntxchains > 1)
2159 		rtwn_bb_write(sc, 0x0b6c, 0x00080000);
2160 
2161 	rtwn_bb_write(sc, 0x0e28, 0x80800000);
2162 	rtwn_bb_write(sc, 0x0e40, 0x01007c00);
2163 	rtwn_bb_write(sc, 0x0e44, 0x01004800);
2164 
2165 	rtwn_bb_write(sc, 0x0b68, 0x00080000);
2166 
2167 	for (chain = 0; chain < sc->ntxchains; chain++) {
2168 		if (chain > 0) {
2169 			/* Put chain 0 on standby. */
2170 			rtwn_bb_write(sc, 0x0e28, 0x00);
2171 			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2172 			rtwn_bb_write(sc, 0x0e28, 0x80800000);
2173 
2174 			/* Enable chain 1. */
2175 			for (i = 0; i < nitems(reg_adda); i++)
2176 				rtwn_bb_write(sc, reg_adda[i], 0x0b1b25a4);
2177 		}
2178 
2179 		/* Run IQ calibration twice. */
2180 		for (i = 0; i < 2; i++) {
2181 			int ret;
2182 
2183 			ret = rtwn_iq_calib_chain(sc, chain,
2184 			    tx[chain], rx[chain]);
2185 			if (ret == 0) {
2186 				DPRINTF(("%s: chain %d: Tx failed.\n",
2187 				    __func__, chain));
2188 				tx[chain][0] = 0xff;
2189 				tx[chain][1] = 0xff;
2190 				rx[chain][0] = 0xff;
2191 				rx[chain][1] = 0xff;
2192 			} else if (ret == 1) {
2193 				DPRINTF(("%s: chain %d: Rx failed.\n",
2194 				    __func__, chain));
2195 				rx[chain][0] = 0xff;
2196 				rx[chain][1] = 0xff;
2197 			} else if (ret == 3) {
2198 				DPRINTF(("%s: chain %d: Both Tx and Rx "
2199 				    "succeeded.\n", __func__, chain));
2200 			}
2201 		}
2202 
2203 		DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
2204 		    "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
2205 		    tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
2206 	}
2207 
2208 	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
2209 	    iq_cal_regs.ofdm0_trxpathena);
2210 	rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
2211 	    iq_cal_regs.fpga0_rfifacesw1);
2212 	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, iq_cal_regs.ofdm0_trmuxpar);
2213 
2214 	rtwn_bb_write(sc, 0x0e28, 0x00);
2215 	rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
2216 	if (sc->ntxchains > 1)
2217 		rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
2218 
2219 	if (n != 0) {
2220 		if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2221 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(0), hssi_param1);
2222 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(1), hssi_param1);
2223 		}
2224 
2225 		for (i = 0; i < nitems(reg_adda); i++)
2226 			rtwn_bb_write(sc, reg_adda[i], iq_cal_regs.adda[i]);
2227 
2228 		rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs.txpause);
2229 		rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl);
2230 		rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf);
2231 		rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs.gpio_muxcfg);
2232 	}
2233 }
2234 
2235 #define RTWN_IQ_CAL_MAX_TOLERANCE 5
2236 int
2237 rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
2238     uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
2239 {
2240 	int chain, i, tx_ok[2], rx_ok[2];
2241 
2242 	tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
2243 	for (chain = 0; chain < ntxchains; chain++) {
2244 		for (i = 0; i < 2; i++)	{
2245 			if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
2246 			    rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
2247 				continue;
2248 
2249 			tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
2250 			    RTWN_IQ_CAL_MAX_TOLERANCE);
2251 
2252 			rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
2253 			    RTWN_IQ_CAL_MAX_TOLERANCE);
2254 		}
2255 	}
2256 
2257 	if (ntxchains > 1)
2258 		return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
2259 	else
2260 		return (tx_ok[0] && rx_ok[0]);
2261 }
2262 #undef RTWN_IQ_CAL_MAX_TOLERANCE
2263 
2264 void
2265 rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
2266     uint16_t rx[2], int chain)
2267 {
2268 	uint32_t reg, val, x;
2269 	long y, tx_c;
2270 
2271 	if (tx[0] == 0xff || tx[1] == 0xff)
2272 		return;
2273 
2274 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
2275 	val = ((reg >> 22) & 0x3ff);
2276 	x = tx[0];
2277 	if (x & 0x0200)
2278 		x |= 0xfc00;
2279 	reg = (((x * val) >> 8) & 0x3ff);
2280 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
2281 
2282 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
2283 	if (((x * val) >> 7) & 0x01)
2284 		reg |= 0x80000000;
2285 	else
2286 		reg &= ~0x80000000;
2287 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
2288 
2289 	y = tx[1];
2290 	if (y & 0x00000200)
2291 		y |= 0xfffffc00;
2292 	tx_c = (y * val) >> 8;
2293 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
2294 	reg |= ((((tx_c & 0x3c0) >> 6) << 24) & 0xf0000000);
2295 	rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
2296 
2297 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
2298 	reg |= (((tx_c & 0x3f) << 16) & 0x003F0000);
2299 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
2300 
2301 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
2302 	if (((y * val) >> 7) & 0x01)
2303 		reg |= 0x20000000;
2304 	else
2305 		reg &= ~0x20000000;
2306 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
2307 
2308 	if (rx[0] == 0xff || rx[1] == 0xff)
2309 		return;
2310 
2311 	reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
2312 	reg |= (rx[0] & 0x3ff);
2313 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
2314 	reg |= (((rx[1] & 0x03f) << 8) & 0xFC00);
2315 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
2316 
2317 	if (chain == 0) {
2318 		reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
2319 		reg |= (((rx[1] & 0xf) >> 6) & 0x000f);
2320 		rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
2321 	} else {
2322 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
2323 		reg |= ((((rx[1] & 0xf) >> 6) << 12) & 0xf000);
2324 		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
2325 	}
2326 }
2327 
2328 #define RTWN_IQ_CAL_NRUN	3
2329 void
2330 rtwn_iq_calib(struct rtwn_softc *sc)
2331 {
2332 	uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
2333 	int n, valid;
2334 
2335 	/* FIXME IQ calib breaks Rx on USB devices. */
2336 	if (sc->chip & RTWN_CHIP_USB)
2337 		return;
2338 
2339 	valid = 0;
2340 	for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
2341 		rtwn_iq_calib_run(sc, n, tx[n], rx[n]);
2342 
2343 		if (n == 0)
2344 			continue;
2345 
2346 		/* Valid results remain stable after consecutive runs. */
2347 		valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
2348 		    tx[n], rx[n], sc->ntxchains);
2349 		if (valid)
2350 			break;
2351 	}
2352 
2353 	if (valid) {
2354 		rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
2355 		if (sc->ntxchains > 1)
2356 			rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
2357 	}
2358 }
2359 #undef RTWN_IQ_CAL_NRUN
2360 
2361 void
2362 rtwn_lc_calib(struct rtwn_softc *sc)
2363 {
2364 	uint32_t rf_ac[2];
2365 	uint8_t txmode;
2366 	int i;
2367 
2368 	txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2369 	if ((txmode & 0x70) != 0) {
2370 		/* Disable all continuous Tx. */
2371 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2372 
2373 		/* Set RF mode to standby mode. */
2374 		for (i = 0; i < sc->nrxchains; i++) {
2375 			rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
2376 			rtwn_rf_write(sc, i, R92C_RF_AC,
2377 			    RW(rf_ac[i], R92C_RF_AC_MODE,
2378 				R92C_RF_AC_MODE_STANDBY));
2379 		}
2380 	} else {
2381 		/* Block all Tx queues. */
2382 		rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
2383 	}
2384 	/* Start calibration. */
2385 	rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2386 	    rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2387 
2388 	/* Give calibration the time to complete. */
2389 	DELAY(100);
2390 
2391 	/* Restore configuration. */
2392 	if ((txmode & 0x70) != 0) {
2393 		/* Restore Tx mode. */
2394 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2395 		/* Restore RF mode. */
2396 		for (i = 0; i < sc->nrxchains; i++)
2397 			rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2398 	} else {
2399 		/* Unblock all Tx queues. */
2400 		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2401 	}
2402 }
2403 
2404 void
2405 rtwn_temp_calib(struct rtwn_softc *sc)
2406 {
2407 	int temp;
2408 
2409 	if (sc->thcal_state == 0) {
2410 		/* Start measuring temperature. */
2411 		rtwn_rf_write(sc, 0, R92C_RF_T_METER, 0x60);
2412 		sc->thcal_state = 1;
2413 		return;
2414 	}
2415 	sc->thcal_state = 0;
2416 
2417 	/* Read measured temperature. */
2418 	temp = rtwn_rf_read(sc, 0, R92C_RF_T_METER) & 0x1f;
2419 	if (temp == 0)	/* Read failed, skip. */
2420 		return;
2421 	DPRINTFN(2, ("temperature=%d\n", temp));
2422 
2423 	/*
2424 	 * Redo IQ and LC calibration if temperature changed significantly
2425 	 * since last calibration.
2426 	 */
2427 	if (sc->thcal_lctemp == 0) {
2428 		/* First calibration is performed in rtwn_init(). */
2429 		sc->thcal_lctemp = temp;
2430 	} else if (abs(temp - sc->thcal_lctemp) > 1) {
2431 		DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
2432 		    sc->thcal_lctemp, temp));
2433 		rtwn_iq_calib(sc);
2434 		rtwn_lc_calib(sc);
2435 		/* Record temperature of last calibration. */
2436 		sc->thcal_lctemp = temp;
2437 	}
2438 }
2439 
2440 void
2441 rtwn_enable_intr(struct rtwn_softc *sc)
2442 {
2443 	if (sc->chip & RTWN_CHIP_88E) {
2444 		rtwn_write_4(sc, R88E_HISR, 0xffffffff);
2445 		rtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM |
2446 		R88E_HIMR_CPWM2 | R88E_HIMR_TBDER |
2447 		R88E_HIMR_PSTIMEOUT);
2448 		rtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
2449 		    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR |
2450 		    R88E_HIMRE_TXERR);
2451 		if (sc->chip & RTWN_CHIP_USB) {
2452 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2453 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2454 			    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
2455 		}
2456 	} else {
2457 		uint32_t imask = 0;
2458 
2459 		if (sc->chip & RTWN_CHIP_USB)
2460 			imask = 0xffffffff;
2461 		else if (sc->chip & RTWN_CHIP_PCI)
2462 			imask = RTWN_INT_ENABLE;
2463 		else
2464 			panic("unknown chip type 0x%x", sc->chip);
2465 
2466 		/* CLear pending interrupts. */
2467 		rtwn_write_4(sc, R92C_HISR, 0xffffffff);
2468 
2469 		/* Enable interrupts. */
2470 		rtwn_write_4(sc, R92C_HIMR, imask);
2471 	}
2472 }
2473 
2474 void
2475 rtwn_disable_intr(struct rtwn_softc *sc)
2476 {
2477 	if (sc->chip & RTWN_CHIP_88E) {
2478 		rtwn_write_4(sc, R88E_HISR, 0x00000000);
2479 		rtwn_write_4(sc, R88E_HIMR, 0x00000000);
2480 		rtwn_write_4(sc, R88E_HIMRE, 0x00000000);
2481 		if (sc->chip & RTWN_CHIP_USB) {
2482 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2483 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) &
2484 			    ~R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
2485 		}
2486 	} else {
2487 		rtwn_write_4(sc, R92C_HISR, 0x00000000);
2488 		rtwn_write_4(sc, R92C_HIMR, 0x00000000);
2489 	}
2490 }
2491 
2492 int
2493 rtwn_init(struct ifnet *ifp)
2494 {
2495 	struct rtwn_softc *sc = ifp->if_softc;
2496 	struct ieee80211com *ic = &sc->sc_ic;
2497 	uint32_t reg;
2498 	int i, error;
2499 
2500 	/* Init firmware commands ring. */
2501 	sc->fwcur = 0;
2502 
2503 	error = sc->sc_ops.alloc_buffers(sc->sc_ops.cookie);
2504 	if (error)
2505 		goto fail;
2506 
2507 	/* Power on adapter. */
2508 	error = sc->sc_ops.power_on(sc->sc_ops.cookie);
2509 	if (error != 0) {
2510 		printf("%s: could not power on adapter\n",
2511 		    sc->sc_pdev->dv_xname);
2512 		goto fail;
2513 	}
2514 
2515 	/* Initialize DMA. */
2516 	error = sc->sc_ops.dma_init(sc->sc_ops.cookie);
2517 	if (error != 0) {
2518 		printf("%s: could not initialize DMA\n",
2519 		    sc->sc_pdev->dv_xname);
2520 		goto fail;
2521 	}
2522 
2523 	/* Set info size in Rx descriptors (in 64-bit words). */
2524 	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
2525 
2526 	if (sc->chip & RTWN_CHIP_USB) {
2527 		/* Init interrupts. */
2528 		rtwn_enable_intr(sc);
2529 	} else if (sc->chip & RTWN_CHIP_PCI) {
2530 		rtwn_disable_intr(sc);
2531 	}
2532 
2533 	/* Set MAC address. */
2534 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2535 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
2536 		rtwn_write_1(sc, R92C_MACID + i, ic->ic_myaddr[i]);
2537 
2538 	/* Set initial network type. */
2539 	reg = rtwn_read_4(sc, R92C_CR);
2540 	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
2541 	rtwn_write_4(sc, R92C_CR, reg);
2542 
2543 	rtwn_rxfilter_init(sc);
2544 
2545 	reg = rtwn_read_4(sc, R92C_RRSR);
2546 	if (sc->chip & RTWN_CHIP_USB) {
2547 		reg = RW(reg, R92C_RRSR_RATE_BITMAP,
2548 		    R92C_RRSR_RATE_CCK_ONLY_1M);
2549 	} else {
2550 		reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
2551 	}
2552 	rtwn_write_4(sc, R92C_RRSR, reg);
2553 
2554 	/* Set short/long retry limits. */
2555 	if (sc->chip & RTWN_CHIP_USB) {
2556 		rtwn_write_2(sc, R92C_RL,
2557 		    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
2558 	} else {
2559 		rtwn_write_2(sc, R92C_RL,
2560 		    SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
2561 	}
2562 
2563 	/* Initialize EDCA parameters. */
2564 	rtwn_edca_init(sc);
2565 
2566 	/* Set data and response automatic rate fallback retry counts. */
2567 	if (!(sc->chip & RTWN_CHIP_88E)) {
2568 		/* XXX Use the same values for PCI and USB? */
2569 		if (sc->chip & RTWN_CHIP_PCI) {
2570 			rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
2571 			rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
2572 			rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
2573 			rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
2574 		} else if (sc->chip & RTWN_CHIP_USB) {
2575 			rtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
2576 			rtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
2577 			rtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
2578 			rtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
2579 		}
2580 	}
2581 
2582 	if (sc->chip & RTWN_CHIP_USB) {
2583 		rtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
2584 		    rtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
2585 		    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
2586 	} else {
2587 		rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
2588 	}
2589 
2590 	/* Set ACK timeout. */
2591 	rtwn_write_1(sc, R92C_ACKTO, 0x40);
2592 
2593 	if (sc->chip & RTWN_CHIP_USB) {
2594 		/* Setup USB aggregation. */
2595 		reg = rtwn_read_4(sc, R92C_TDECTRL);
2596 		reg = RW(reg, R92C_TDECTRL_BLK_DESC_NUM, 6);
2597 		rtwn_write_4(sc, R92C_TDECTRL, reg);
2598 		rtwn_write_1(sc, R92C_TRXDMA_CTRL,
2599 		    rtwn_read_1(sc, R92C_TRXDMA_CTRL) |
2600 		    R92C_TRXDMA_CTRL_RXDMA_AGG_EN);
2601 		rtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH, 48);
2602 		if (sc->chip & RTWN_CHIP_88E) {
2603 			rtwn_write_1(sc, R92C_RXDMA_AGG_PG_TH + 1, 4);
2604 		} else {
2605 			rtwn_write_1(sc, R92C_USB_DMA_AGG_TO, 4);
2606 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2607 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2608 			    R92C_USB_SPECIAL_OPTION_AGG_EN);
2609 			rtwn_write_1(sc, R92C_USB_AGG_TH, 8);
2610 			rtwn_write_1(sc, R92C_USB_AGG_TO, 6);
2611 		}
2612 	}
2613 
2614 	/* Initialize beacon parameters. */
2615 	rtwn_write_2(sc, R92C_BCN_CTRL, 0x1010);
2616 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
2617 	rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
2618 	rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
2619 	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
2620 
2621 	if (!(sc->chip & RTWN_CHIP_88E)) {
2622 		/* Setup AMPDU aggregation. */
2623 		rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
2624 		rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
2625 		rtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
2626 
2627 		rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
2628 	}
2629 
2630 	if (sc->chip & RTWN_CHIP_PCI) { /* also for USB? */
2631 		rtwn_write_4(sc, R92C_PIFS, 0x1c);
2632 		rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
2633 	}
2634 
2635 	/* Load 8051 microcode. */
2636 	error = rtwn_load_firmware(sc);
2637 	if (error != 0)
2638 		goto fail;
2639 
2640 	/* Initialize MAC/BB/RF blocks. */
2641 	sc->sc_ops.mac_init(sc->sc_ops.cookie);
2642 	sc->sc_ops.bb_init(sc->sc_ops.cookie);
2643 	rtwn_rf_init(sc);
2644 
2645 	if (sc->chip & RTWN_CHIP_88E) {
2646 		rtwn_write_2(sc, R92C_CR,
2647 		    rtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
2648 		    R92C_CR_MACRXEN);
2649 	}
2650 
2651 	/* Turn CCK and OFDM blocks on. */
2652 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2653 	reg |= R92C_RFMOD_CCK_EN;
2654 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2655 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
2656 	reg |= R92C_RFMOD_OFDM_EN;
2657 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
2658 
2659 	/* Clear per-station keys table. */
2660 	rtwn_cam_init(sc);
2661 
2662 	/* Enable hardware sequence numbering. */
2663 	rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
2664 
2665 	/* Perform LO and IQ calibrations. */
2666 	rtwn_iq_calib(sc);
2667 	/* Perform LC calibration. */
2668 	rtwn_lc_calib(sc);
2669 
2670 	/* Fix USB interference issue. */
2671 	if ((sc->chip & RTWN_CHIP_USB) && !(sc->chip & RTWN_CHIP_88E)) {
2672 		rtwn_write_1(sc, 0xfe40, 0xe0);
2673 		rtwn_write_1(sc, 0xfe41, 0x8d);
2674 		rtwn_write_1(sc, 0xfe42, 0x80);
2675 
2676 		rtwn_pa_bias_init(sc);
2677 	}
2678 
2679 	/* Initialize GPIO setting. */
2680 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2681 	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
2682 
2683 	/* Fix for lower temperature. */
2684 	if (!(sc->chip & RTWN_CHIP_88E))
2685 		rtwn_write_1(sc, 0x15, 0xe9);
2686 
2687 	/* Set default channel. */
2688 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2689 	rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
2690 
2691 	if (sc->chip & RTWN_CHIP_PCI)
2692 		rtwn_enable_intr(sc);
2693 
2694 	error = sc->sc_ops.init(sc->sc_ops.cookie);
2695 	if (error)
2696 		goto fail;
2697 
2698 	/* We're ready to go. */
2699 	ifq_clr_oactive(&ifp->if_snd);
2700 	ifp->if_flags |= IFF_RUNNING;
2701 
2702 #ifdef notyet
2703 	if (ic->ic_flags & IEEE80211_F_WEPON) {
2704 		/* Install WEP keys. */
2705 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
2706 			ic->ic_set_key(ic, NULL, &ic->ic_nw_keys[i]);
2707 		sc->sc_ops.wait_async(sc->sc_ops.cookie);
2708 	}
2709 #endif
2710 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2711 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2712 	else
2713 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2714 	return (0);
2715  fail:
2716 	rtwn_stop(ifp);
2717 	return (error);
2718 }
2719 
2720 void
2721 rtwn_init_task(void *arg1)
2722 {
2723 	struct rtwn_softc *sc = arg1;
2724 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2725 	int s;
2726 
2727 	s = splnet();
2728 	while (sc->sc_flags & RTWN_FLAG_BUSY)
2729 		tsleep(&sc->sc_flags, 0, "rtwnpwr", 0);
2730 	sc->sc_flags |= RTWN_FLAG_BUSY;
2731 
2732 	rtwn_stop(ifp);
2733 
2734 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_UP)
2735 		rtwn_init(ifp);
2736 
2737 	sc->sc_flags &= ~RTWN_FLAG_BUSY;
2738 	wakeup(&sc->sc_flags);
2739 	splx(s);
2740 }
2741 
2742 void
2743 rtwn_stop(struct ifnet *ifp)
2744 {
2745 	struct rtwn_softc *sc = ifp->if_softc;
2746 	struct ieee80211com *ic = &sc->sc_ic;
2747 	int s;
2748 
2749 	sc->sc_tx_timer = 0;
2750 	ifp->if_timer = 0;
2751 	ifp->if_flags &= ~IFF_RUNNING;
2752 	ifq_clr_oactive(&ifp->if_snd);
2753 
2754 	s = splnet();
2755 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2756 	splx(s);
2757 
2758 	sc->sc_ops.wait_async(sc->sc_ops.cookie);
2759 
2760 	s = splnet();
2761 
2762 	sc->sc_ops.cancel_scan(sc->sc_ops.cookie);
2763 	sc->sc_ops.cancel_calib(sc->sc_ops.cookie);
2764 
2765 	task_del(systq, &sc->init_task);
2766 
2767 	splx(s);
2768 
2769 	sc->sc_ops.stop(sc->sc_ops.cookie);
2770 }
2771