xref: /openbsd-src/sys/dev/ic/rtwn.c (revision 3374c67d44f9b75b98444cbf63020f777792342e)
1 /*	$OpenBSD: rtwn.c,v 1.54 2022/12/27 20:13:03 patrick Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
6  * Copyright (c) 2016 Nathanial Sloss <nathanialsloss@yahoo.com.au>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 /*
22  * Driver for Realtek 802.11b/g/n chipsets.
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/task.h>
34 #include <sys/timeout.h>
35 #include <sys/conf.h>
36 #include <sys/device.h>
37 #include <sys/endian.h>
38 
39 #include <machine/bus.h>
40 #include <machine/intr.h>
41 
42 #if NBPFILTER > 0
43 #include <net/bpf.h>
44 #endif
45 #include <net/if.h>
46 #include <net/if_dl.h>
47 #include <net/if_media.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/if_ether.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_radiotap.h>
54 
55 #include <dev/ic/r92creg.h>
56 #include <dev/ic/rtwnvar.h>
57 
58 #define RTWN_RIDX_CCK1		0
59 #define RTWN_RIDX_CCK2		1
60 #define RTWN_RIDX_CCK11		3
61 #define RTWN_RIDX_OFDM6		4
62 #define RTWN_RIDX_OFDM54	11
63 #define RTWN_RIDX_MCS0		12
64 #define RTWN_RIDX_MCS8		(RTWN_RIDX_MCS0 + 8)
65 #define RTWN_RIDX_MCS15		27
66 #define RTWN_RIDX_MAX		27
67 
68 #define RTWN_POWER_CCK1		0
69 #define RTWN_POWER_CCK2		1
70 #define RTWN_POWER_CCK55	2
71 #define RTWN_POWER_CCK11	3
72 #define RTWN_POWER_OFDM6	4
73 #define RTWN_POWER_OFDM9	5
74 #define RTWN_POWER_OFDM12	6
75 #define RTWN_POWER_OFDM18	7
76 #define RTWN_POWER_OFDM24	8
77 #define RTWN_POWER_OFDM36	9
78 #define RTWN_POWER_OFDM48	10
79 #define RTWN_POWER_OFDM54	11
80 #define RTWN_POWER_MCS(mcs)	(12 + (mcs))
81 #define RTWN_POWER_COUNT	28
82 
83 
84 #ifdef RTWN_DEBUG
85 #define DPRINTF(x)	do { if (rtwn_debug) printf x; } while (0)
86 #define DPRINTFN(n, x)	do { if (rtwn_debug >= (n)) printf x; } while (0)
87 int rtwn_debug = 0;
88 #else
89 #define DPRINTF(x)
90 #define DPRINTFN(n, x)
91 #endif
92 
93 /* Registers to save and restore during IQ calibration. */
94 struct rtwn_iq_cal_regs {
95 	uint32_t	adda[16];
96 	uint8_t		txpause;
97 	uint8_t		bcn_ctrl;
98 	uint8_t		bcn_ctrl1;
99 	uint32_t	gpio_muxcfg;
100 	uint32_t	ofdm0_trxpathena;
101 	uint32_t	ofdm0_trmuxpar;
102 	uint32_t	fpga0_rfifacesw0;
103 	uint32_t	fpga0_rfifacesw1;
104 	uint32_t	fpga0_rfifaceoe0;
105 	uint32_t	fpga0_rfifaceoe1;
106 	uint32_t	config_ant_a;
107 	uint32_t	config_ant_b;
108 	uint32_t	cck0_afesetting;
109 };
110 
111 void		rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
112 void		rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
113 void		rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
114 uint8_t		rtwn_read_1(struct rtwn_softc *, uint16_t);
115 uint16_t	rtwn_read_2(struct rtwn_softc *, uint16_t);
116 uint32_t	rtwn_read_4(struct rtwn_softc *, uint16_t);
117 int		rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
118 void		rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
119 uint32_t	rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
120 void		rtwn_cam_write(struct rtwn_softc *, uint32_t, uint32_t);
121 uint8_t		rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
122 void		rtwn_efuse_read(struct rtwn_softc *, uint8_t *, size_t);
123 void		rtwn_efuse_switch_power(struct rtwn_softc *);
124 int		rtwn_read_chipid(struct rtwn_softc *);
125 void		rtwn_read_rom(struct rtwn_softc *);
126 void		rtwn_r92c_read_rom(struct rtwn_softc *);
127 void		rtwn_r92e_read_rom(struct rtwn_softc *);
128 void		rtwn_r88e_read_rom(struct rtwn_softc *);
129 void		rtwn_r23a_read_rom(struct rtwn_softc *);
130 int		rtwn_media_change(struct ifnet *);
131 int		rtwn_ra_init(struct rtwn_softc *);
132 int		rtwn_r92c_ra_init(struct rtwn_softc *, u_int8_t, u_int32_t,
133 		    int, uint32_t, int);
134 int		rtwn_r88e_ra_init(struct rtwn_softc *, u_int8_t, u_int32_t,
135 		    int, uint32_t, int);
136 void		rtwn_tsf_sync_enable(struct rtwn_softc *);
137 void		rtwn_set_led(struct rtwn_softc *, int, int);
138 void		rtwn_set_nettype(struct rtwn_softc *, enum ieee80211_opmode);
139 void		rtwn_update_short_preamble(struct ieee80211com *);
140 void		rtwn_r92c_update_short_preamble(struct rtwn_softc *);
141 void		rtwn_r88e_update_short_preamble(struct rtwn_softc *);
142 int8_t		rtwn_r88e_get_rssi(struct rtwn_softc *, int, void *);
143 void		rtwn_watchdog(struct ifnet *);
144 void		rtwn_fw_reset(struct rtwn_softc *);
145 void		rtwn_r92c_fw_reset(struct rtwn_softc *);
146 void		rtwn_r88e_fw_reset(struct rtwn_softc *);
147 int		rtwn_load_firmware(struct rtwn_softc *);
148 void		rtwn_rf_init(struct rtwn_softc *);
149 void		rtwn_cam_init(struct rtwn_softc *);
150 void		rtwn_pa_bias_init(struct rtwn_softc *);
151 void		rtwn_rxfilter_init(struct rtwn_softc *);
152 void		rtwn_edca_init(struct rtwn_softc *);
153 void		rtwn_rate_fallback_init(struct rtwn_softc *);
154 void		rtwn_write_txpower(struct rtwn_softc *, int, uint16_t *);
155 void		rtwn_get_txpower(struct rtwn_softc *sc, int,
156 		    struct ieee80211_channel *, struct ieee80211_channel *,
157 		    uint16_t *);
158 void		rtwn_r92c_get_txpower(struct rtwn_softc *, int,
159 		    struct ieee80211_channel *, struct ieee80211_channel *,
160 		    uint16_t *);
161 void		rtwn_r92e_get_txpower(struct rtwn_softc *, int,
162 		    struct ieee80211_channel *,
163 		    struct ieee80211_channel *, uint16_t *);
164 void		rtwn_r88e_get_txpower(struct rtwn_softc *, int,
165 		    struct ieee80211_channel *,
166 		    struct ieee80211_channel *, uint16_t *);
167 void		rtwn_set_txpower(struct rtwn_softc *,
168 		    struct ieee80211_channel *, struct ieee80211_channel *);
169 void		rtwn_set_chan(struct rtwn_softc *,
170 		    struct ieee80211_channel *, struct ieee80211_channel *);
171 int		rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
172 		    uint16_t[2]);
173 void		rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
174     		    uint16_t rx[2][2], struct rtwn_iq_cal_regs *);
175 int		rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
176 		    uint16_t[2][2], uint16_t[2][2], int);
177 void		rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
178 		    uint16_t[2], int);
179 void		rtwn_iq_calib(struct rtwn_softc *);
180 void		rtwn_lc_calib(struct rtwn_softc *);
181 void		rtwn_temp_calib(struct rtwn_softc *);
182 void		rtwn_enable_intr(struct rtwn_softc *);
183 void		rtwn_disable_intr(struct rtwn_softc *);
184 int		rtwn_init(struct ifnet *);
185 void		rtwn_init_task(void *);
186 void		rtwn_stop(struct ifnet *);
187 
188 /* Aliases. */
189 #define	rtwn_bb_write	rtwn_write_4
190 #define rtwn_bb_read	rtwn_read_4
191 
192 /*
193  * Macro to convert 4-bit signed integer to 8-bit signed integer.
194  */
195 #define RTWN_SIGN4TO8(val)	(((val) & 0x08) ? (val) | 0xf0 : (val))
196 
197 int
198 rtwn_attach(struct device *pdev, struct rtwn_softc *sc)
199 {
200 	struct ieee80211com *ic = &sc->sc_ic;
201 	struct ifnet *ifp = &ic->ic_if;
202 	int i, error;
203 
204 	sc->sc_pdev = pdev;
205 
206 	task_set(&sc->init_task, rtwn_init_task, sc);
207 
208 	error = rtwn_read_chipid(sc);
209 	if (error != 0) {
210 		printf("%s: unsupported chip\n", sc->sc_pdev->dv_xname);
211 		return (ENXIO);
212 	}
213 
214 	/* Determine number of Tx/Rx chains. */
215 	if (sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_92E)) {
216 		sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
217 		sc->nrxchains = 2;
218 	} else {
219 		sc->ntxchains = 1;
220 		sc->nrxchains = 1;
221 	}
222 
223 	rtwn_read_rom(sc);
224 
225 	if (sc->chip & RTWN_CHIP_PCI) {
226 		printf("%s: MAC/BB RTL%s, RF 6052 %dT%dR, address %s\n",
227 		    sc->sc_pdev->dv_xname,
228 		    (sc->chip & RTWN_CHIP_92C) ? "8192CE" :
229 		    (sc->chip & RTWN_CHIP_88E) ? "8188EE" :
230 		    (sc->chip & RTWN_CHIP_92E) ? "8192EE" :
231 		    (sc->chip & RTWN_CHIP_23A) ? "8723AE" :
232 		    (sc->chip & RTWN_CHIP_23B) ? "8723BE" : "8188CE",
233 		    sc->ntxchains, sc->nrxchains,
234 		    ether_sprintf(ic->ic_myaddr));
235 	} else if (sc->chip & RTWN_CHIP_USB) {
236 		printf("%s: MAC/BB RTL%s, RF 6052 %dT%dR, address %s\n",
237 		    sc->sc_pdev->dv_xname,
238 		    (sc->chip & RTWN_CHIP_92C) ? "8192CU" :
239 		    (sc->chip & RTWN_CHIP_92E) ? "8192EU" :
240 		    (sc->chip & RTWN_CHIP_88E) ? "8188EU" :
241 		    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
242 		    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ?
243 		    "8188CE-VAU" : "8188CUS",
244 		    sc->ntxchains, sc->nrxchains,
245 		    ether_sprintf(ic->ic_myaddr));
246 	} else {
247 		printf("%s: unsupported chip\n", sc->sc_pdev->dv_xname);
248 		return (ENXIO);
249 	}
250 
251 	ic->ic_phytype = IEEE80211_T_OFDM;	/* Not only, but not used. */
252 	ic->ic_opmode = IEEE80211_M_STA;	/* Default to BSS mode. */
253 	ic->ic_state = IEEE80211_S_INIT;
254 
255 	/* Set device capabilities. */
256 	ic->ic_caps =
257 	    IEEE80211_C_MONITOR |	/* Monitor mode supported. */
258 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
259 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
260 	    IEEE80211_C_WEP |		/* WEP. */
261 	    IEEE80211_C_RSN;		/* WPA/RSN. */
262 
263 	/* Set HT capabilities. */
264 	ic->ic_htcaps =
265 	    IEEE80211_HTCAP_CBW20_40 |
266 	    IEEE80211_HTCAP_DSSSCCK40;
267 	/* Set supported HT rates. */
268 	for (i = 0; i < sc->nrxchains; i++)
269 		ic->ic_sup_mcs[i] = 0xff;
270 
271 	/* Set supported .11b and .11g rates. */
272 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
273 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
274 
275 	/* Set supported .11b and .11g channels (1 through 14). */
276 	for (i = 1; i <= 14; i++) {
277 		ic->ic_channels[i].ic_freq =
278 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
279 		ic->ic_channels[i].ic_flags =
280 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
281 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
282 	}
283 
284 #ifdef notyet
285 	/*
286 	 * The number of STAs that we can support is limited by the number
287 	 * of CAM entries used for hardware crypto.
288 	 */
289 	ic->ic_max_nnodes = R92C_CAM_ENTRY_COUNT - 4;
290 	if (ic->ic_max_nnodes > IEEE80211_CACHE_SIZE)
291 		ic->ic_max_nnodes = IEEE80211_CACHE_SIZE;
292 #endif
293 
294 	ifp->if_softc = sc;
295 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
296 	ifp->if_ioctl = rtwn_ioctl;
297 	ifp->if_start = rtwn_start;
298 	ifp->if_watchdog = rtwn_watchdog;
299 	memcpy(ifp->if_xname, sc->sc_pdev->dv_xname, IFNAMSIZ);
300 
301 	if_attach(ifp);
302 	ieee80211_ifattach(ifp);
303 	ic->ic_updateslot = rtwn_updateslot;
304 	ic->ic_updateedca = rtwn_updateedca;
305 #ifdef notyet
306 	ic->ic_set_key = rtwn_set_key;
307 	ic->ic_delete_key = rtwn_delete_key;
308 #endif
309 	/* Override state transition machine. */
310 	sc->sc_newstate = ic->ic_newstate;
311 	ic->ic_newstate = rtwn_newstate;
312 	ieee80211_media_init(ifp, rtwn_media_change, ieee80211_media_status);
313 
314 	return (0);
315 }
316 
317 int
318 rtwn_detach(struct rtwn_softc *sc, int flags)
319 {
320 	struct ifnet *ifp = &sc->sc_ic.ic_if;
321 	int s;
322 
323 	s = splnet();
324 
325 	task_del(systq, &sc->init_task);
326 
327 	if (ifp->if_softc != NULL) {
328 		ieee80211_ifdetach(ifp);
329 		if_detach(ifp);
330 	}
331 
332 	splx(s);
333 
334 	return (0);
335 }
336 
337 int
338 rtwn_activate(struct rtwn_softc *sc, int act)
339 {
340 	struct ifnet *ifp = &sc->sc_ic.ic_if;
341 
342 	switch (act) {
343 	case DVACT_QUIESCE: /* rtwn_stop() may sleep */
344 		if (ifp->if_flags & IFF_RUNNING)
345 			rtwn_stop(ifp);
346 		break;
347 	case DVACT_WAKEUP:
348 		rtwn_init_task(sc);
349 		break;
350 	}
351 	return (0);
352 }
353 
354 void
355 rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
356 {
357 	sc->sc_ops.write_1(sc->sc_ops.cookie, addr, val);
358 }
359 
360 void
361 rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
362 {
363 	sc->sc_ops.write_2(sc->sc_ops.cookie, addr, val);
364 }
365 
366 void
367 rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
368 {
369 	sc->sc_ops.write_4(sc->sc_ops.cookie, addr, val);
370 }
371 
372 uint8_t
373 rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
374 {
375 	return sc->sc_ops.read_1(sc->sc_ops.cookie, addr);
376 }
377 
378 uint16_t
379 rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
380 {
381 	return sc->sc_ops.read_2(sc->sc_ops.cookie, addr);
382 }
383 
384 uint32_t
385 rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
386 {
387 	return sc->sc_ops.read_4(sc->sc_ops.cookie, addr);
388 }
389 
390 int
391 rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
392 {
393 	struct r92c_fw_cmd cmd;
394 	int ntries;
395 
396 	/* Wait for current FW box to be empty. */
397 	for (ntries = 0; ntries < 100; ntries++) {
398 		if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
399 			break;
400 		DELAY(10);
401 	}
402 	if (ntries == 100) {
403 		printf("%s: could not send firmware command %d\n",
404 		    sc->sc_pdev->dv_xname, id);
405 		return (ETIMEDOUT);
406 	}
407 	memset(&cmd, 0, sizeof(cmd));
408 	cmd.id = id;
409 	if (len > 3)
410 		cmd.id |= R92C_CMD_FLAG_EXT;
411 	KASSERT(len <= sizeof(cmd.msg));
412 	memcpy(cmd.msg, buf, len);
413 
414 	/* Write the first word last since that will trigger the FW. */
415 	if (sc->chip & RTWN_CHIP_92E)
416 		rtwn_write_2(sc, R88E_HMEBOX_EXT(sc->fwcur),
417 		    *((uint8_t *)&cmd + 4));
418 	else
419 		rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur),
420 		    *((uint8_t *)&cmd + 4));
421 	rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
422 
423 	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
424 
425 	if (sc->chip & RTWN_CHIP_PCI) {
426 		/* Give firmware some time for processing. */
427 		DELAY(2000);
428 	}
429 
430 	return (0);
431 }
432 
433 void
434 rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
435 {
436 	uint32_t param_addr;
437 
438 	if (sc->chip & RTWN_CHIP_92E) {
439 		rtwn_write_4(sc, R92C_FPGA0_POWER_SAVE,
440 		    rtwn_read_4(sc, R92C_FPGA0_POWER_SAVE) & ~0x20000);
441 	}
442 
443 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
444 		param_addr = SM(R88E_LSSI_PARAM_ADDR, addr);
445 	else
446 		param_addr = SM(R92C_LSSI_PARAM_ADDR, addr);
447 
448 	rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
449 	    param_addr | SM(R92C_LSSI_PARAM_DATA, val));
450 
451 	DELAY(1);
452 
453 	if (sc->chip & RTWN_CHIP_92E) {
454 		rtwn_write_4(sc, R92C_FPGA0_POWER_SAVE,
455 		    rtwn_read_4(sc, R92C_FPGA0_POWER_SAVE) | 0x20000);
456 	}
457 }
458 
459 uint32_t
460 rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
461 {
462 	uint32_t reg[R92C_MAX_CHAINS], val;
463 
464 	reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
465 	if (chain != 0)
466 		reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
467 
468 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
469 	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
470 	DELAY(1000);
471 
472 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
473 	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
474 	    R92C_HSSI_PARAM2_READ_EDGE);
475 	DELAY(1000);
476 
477 	if (!(sc->chip & RTWN_CHIP_88E)) {
478 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
479 		    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
480 		DELAY(1000);
481 	}
482 
483 	if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
484 		val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
485 	else
486 		val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
487 	return (MS(val, R92C_LSSI_READBACK_DATA));
488 }
489 
490 void
491 rtwn_cam_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
492 {
493 	rtwn_write_4(sc, R92C_CAMWRITE, data);
494 	rtwn_write_4(sc, R92C_CAMCMD,
495 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
496 	    SM(R92C_CAMCMD_ADDR, addr));
497 }
498 
499 uint8_t
500 rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
501 {
502 	uint32_t reg;
503 	int ntries;
504 
505 	reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
506 	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
507 	reg &= ~R92C_EFUSE_CTRL_VALID;
508 	rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
509 	/* Wait for read operation to complete. */
510 	for (ntries = 0; ntries < 100; ntries++) {
511 		reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
512 		if (reg & R92C_EFUSE_CTRL_VALID)
513 			return (MS(reg, R92C_EFUSE_CTRL_DATA));
514 		DELAY(5);
515 	}
516 	printf("%s: could not read efuse byte at address 0x%x\n",
517 	    sc->sc_pdev->dv_xname, addr);
518 	return (0xff);
519 }
520 
521 void
522 rtwn_efuse_read(struct rtwn_softc *sc, uint8_t *rom, size_t size)
523 {
524 	uint8_t off, msk, tmp;
525 	uint16_t addr = 0;
526 	uint32_t reg;
527 	int i, len;
528 
529 	if (!(sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C)))
530 		rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
531 
532 	rtwn_efuse_switch_power(sc);
533 
534 	memset(rom, 0xff, size);
535 	len = (sc->chip & RTWN_CHIP_88E) ? 256 : 512;
536 	while (addr < len) {
537 		reg = rtwn_efuse_read_1(sc, addr);
538 		if (reg == 0xff)
539 			break;
540 		addr++;
541 
542 		/* Check for extended header. */
543 		if ((sc->sc_flags & RTWN_FLAG_EXT_HDR) &&
544 		    (reg & 0x1f) == 0x0f) {
545 			tmp = (reg & 0xe0) >> 5;
546 			reg = rtwn_efuse_read_1(sc, addr);
547 			addr++;
548 			if ((reg & 0x0f) != 0x0f)
549 				off = ((reg & 0xf0) >> 1) | tmp;
550 			else
551 				continue;
552 		} else
553 			off = reg >> 4;
554 		msk = reg & 0xf;
555 		for (i = 0; i < 4; i++) {
556 			if (msk & (1 << i))
557 				continue;
558 			rom[off * 8 + i * 2 + 0] = rtwn_efuse_read_1(sc, addr);
559 			addr++;
560 			rom[off * 8 + i * 2 + 1] = rtwn_efuse_read_1(sc, addr);
561 			addr++;
562 		}
563 	}
564 #ifdef RTWN_DEBUG
565 	if (rtwn_debug >= 2) {
566 		/* Dump ROM content. */
567 		printf("\n");
568 		for (i = 0; i < size; i++)
569 			printf("%02x:", rom[i]);
570 		printf("\n");
571 	}
572 #endif
573 	if (!(sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C)))
574 		rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
575 }
576 
577 void
578 rtwn_efuse_switch_power(struct rtwn_softc *sc)
579 {
580 	uint16_t reg;
581 
582 	if (!(sc->chip & RTWN_CHIP_92E)) {
583 		reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
584 		if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
585 			rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
586 			    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
587 		}
588 	}
589 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
590 	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
591 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
592 		    reg | R92C_SYS_FUNC_EN_ELDR);
593 	}
594 	reg = rtwn_read_2(sc, R92C_SYS_CLKR);
595 	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
596 	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
597 		rtwn_write_2(sc, R92C_SYS_CLKR,
598 		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
599 	}
600 }
601 
602 int
603 rtwn_read_chipid(struct rtwn_softc *sc)
604 {
605 	uint32_t reg;
606 
607 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) {
608 		sc->sc_flags |= RTWN_FLAG_EXT_HDR;
609 		return (0);
610 	}
611 
612 	reg = rtwn_read_4(sc, R92C_SYS_CFG);
613 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
614 		/* Unsupported test chip. */
615 		return (EIO);
616 
617 	if ((sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C)) != 0) {
618 		if (reg & R92C_SYS_CFG_TYPE_92C) {
619 			sc->chip &= ~RTWN_CHIP_88C;
620 			/* Check if it is a castrated 8192C. */
621 			if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
622 			    R92C_HPON_FSM_CHIP_BONDING_ID) ==
623 			    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
624 				sc->chip |= RTWN_CHIP_92C_1T2R;
625 		} else
626 			sc->chip &= ~RTWN_CHIP_92C;
627 
628 		if (reg & R92C_SYS_CFG_VENDOR_UMC) {
629 			sc->chip |= RTWN_CHIP_UMC;
630 			if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
631 				sc->chip |= RTWN_CHIP_UMC_A_CUT;
632 		}
633 
634 		return (0);
635 	} else if (sc->chip & RTWN_CHIP_23A) {
636 		sc->sc_flags |= RTWN_FLAG_EXT_HDR;
637 
638 		if ((reg & 0xf000) == 0)
639 			sc->chip |= RTWN_CHIP_UMC_A_CUT;
640 		return (0);
641 	}
642 
643 	return (ENXIO); /* unsupported chip */
644 }
645 
646 void
647 rtwn_read_rom(struct rtwn_softc *sc)
648 {
649 	if (sc->chip & RTWN_CHIP_88E)
650 		rtwn_r88e_read_rom(sc);
651 	else if (sc->chip & RTWN_CHIP_92E)
652 		rtwn_r92e_read_rom(sc);
653 	else if (sc->chip & RTWN_CHIP_23A)
654 		rtwn_r23a_read_rom(sc);
655 	else
656 		rtwn_r92c_read_rom(sc);
657 }
658 
659 void
660 rtwn_r92c_read_rom(struct rtwn_softc *sc)
661 {
662 	struct ieee80211com *ic = &sc->sc_ic;
663 	struct r92c_rom *rom = &sc->sc_r92c_rom;
664 
665 	/* Read full ROM image. */
666 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r92c_rom,
667 	    sizeof(sc->sc_r92c_rom));
668 
669 	/* XXX Weird but this is what the vendor driver does. */
670 	sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
671 	DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
672 
673 	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
674 	DPRINTF(("board type=%d\n", sc->board_type));
675 
676 	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
677 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
678 
679 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
680 }
681 
682 void
683 rtwn_r92e_read_rom(struct rtwn_softc *sc)
684 {
685 	struct ieee80211com *ic = &sc->sc_ic;
686 	struct r92e_rom *rom = &sc->sc_r92e_rom;
687 
688 	/* Read full ROM image. */
689 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r92e_rom,
690 	    sizeof(sc->sc_r92e_rom));
691 
692 	sc->crystal_cap = rom->xtal_k;
693 	DPRINTF(("crystal cap=0x%x\n", sc->crystal_cap));
694 
695 	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
696 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
697 
698 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
699 }
700 
701 void
702 rtwn_r88e_read_rom(struct rtwn_softc *sc)
703 {
704 	struct ieee80211com *ic = &sc->sc_ic;
705 	struct r88e_rom *rom = &sc->sc_r88e_rom;
706 
707 	/* Read full ROM image. */
708 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r88e_rom,
709 	    sizeof(sc->sc_r88e_rom));
710 
711 	sc->crystal_cap = (sc->chip & RTWN_CHIP_PCI) ? 0x20 : rom->xtal;
712 	DPRINTF(("Crystal cap=0x%x\n", sc->crystal_cap));
713 
714 	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
715 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
716 
717 	if (sc->chip & RTWN_CHIP_PCI)
718 		IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->r88ee_rom.macaddr);
719 	else
720 		IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->r88eu_rom.macaddr);
721 }
722 
723 void
724 rtwn_r23a_read_rom(struct rtwn_softc *sc)
725 {
726 	struct ieee80211com *ic = &sc->sc_ic;
727 	struct r23a_rom *rom = &sc->sc_r23a_rom;
728 
729 	/* Read full ROM image. */
730 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r23a_rom,
731 	    sizeof(sc->sc_r23a_rom));
732 
733 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
734 }
735 
736 int
737 rtwn_media_change(struct ifnet *ifp)
738 {
739 	int error;
740 
741 	error = ieee80211_media_change(ifp);
742 	if (error != ENETRESET)
743 		return (error);
744 
745 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
746 	    (IFF_UP | IFF_RUNNING)) {
747 		rtwn_stop(ifp);
748 		error = rtwn_init(ifp);
749 	}
750 	return (error);
751 }
752 
753 /*
754  * Initialize rate adaptation.
755  */
756 int
757 rtwn_ra_init(struct rtwn_softc *sc)
758 {
759 	static const uint8_t map[] =
760 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
761 	struct ieee80211com *ic = &sc->sc_ic;
762 	struct ieee80211_node *ni = ic->ic_bss;
763 	struct ieee80211_rateset *rs = &ni->ni_rates;
764 	uint32_t rates, basicrates;
765 	uint8_t mode;
766 	int maxrate, maxbasicrate, i, j;
767 	int error = 0;
768 
769 	/* Get normal and basic rates mask. */
770 	rates = basicrates = 0;
771 	maxrate = maxbasicrate = 0;
772 	for (i = 0; i < rs->rs_nrates; i++) {
773 		/* Convert 802.11 rate to HW rate index. */
774 		for (j = 0; j < nitems(map); j++)
775 			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
776 				break;
777 		if (j == nitems(map))	/* Unknown rate, skip. */
778 			continue;
779 		rates |= 1 << j;
780 		if (j > maxrate)
781 			maxrate = j;
782 		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
783 			basicrates |= 1 << j;
784 			if (j > maxbasicrate)
785 				maxbasicrate = j;
786 		}
787 	}
788 	if (ic->ic_curmode == IEEE80211_MODE_11B)
789 		mode = R92C_RAID_11B;
790 	else
791 		mode = R92C_RAID_11BG;
792 	DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
793 	    mode, rates, basicrates));
794 
795 	if (sc->chip & RTWN_CHIP_PCI) {
796 		/* Configure Automatic Rate Fallback Register. */
797 		if (ic->ic_curmode == IEEE80211_MODE_11B) {
798 			if (rates & 0x0c)
799 				rtwn_write_4(sc, R92C_ARFR(0), rates & 0x05);
800 			else
801 				rtwn_write_4(sc, R92C_ARFR(0), rates & 0x07);
802 		} else
803 			rtwn_write_4(sc, R92C_ARFR(0), rates & 0x07f5);
804 	}
805 
806 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) {
807 		error = rtwn_r88e_ra_init(sc, mode, rates, maxrate,
808 		    basicrates, maxbasicrate);
809 		/* We use AMRR with this chip. Start with the lowest rate. */
810 		ni->ni_txrate = 0;
811 	} else {
812 		if (sc->chip & RTWN_CHIP_PCI) {
813 			ni->ni_txrate = 0; /* AMRR will raise. */
814 			/* Set initial MRR rates. */
815 			rtwn_write_1(sc,
816 			    R92C_INIDATA_RATE_SEL(R92C_MACID_BC), maxbasicrate);
817 			rtwn_write_1(sc,
818 			    R92C_INIDATA_RATE_SEL(R92C_MACID_BSS), 0);
819 		} else {
820 			error = rtwn_r92c_ra_init(sc, mode, rates, maxrate,
821 			    basicrates, maxbasicrate);
822 			/* No AMRR support. Indicate highest supported rate. */
823 			ni->ni_txrate = rs->rs_nrates - 1;
824 		}
825 	}
826 	return (error);
827 }
828 
829 /*
830  * Initialize rate adaptation in firmware.
831  */
832 int rtwn_r92c_ra_init(struct rtwn_softc *sc, u_int8_t mode, u_int32_t rates,
833     int maxrate, uint32_t basicrates, int maxbasicrate)
834 {
835 	struct r92c_fw_cmd_macid_cfg cmd;
836 	int error;
837 
838 	/* Set rates mask for group addressed frames. */
839 	cmd.macid = R92C_MACID_BC | R92C_MACID_VALID;
840 	cmd.mask = htole32(mode << 28 | basicrates);
841 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
842 	if (error != 0) {
843 		printf("%s: could not add broadcast station\n",
844 		    sc->sc_pdev->dv_xname);
845 		return (error);
846 	}
847 	/* Set initial MRR rate. */
848 	DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
849 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(R92C_MACID_BC),
850 	    maxbasicrate);
851 
852 	/* Set rates mask for unicast frames. */
853 	cmd.macid = R92C_MACID_BSS | R92C_MACID_VALID;
854 	cmd.mask = htole32(mode << 28 | rates);
855 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
856 	if (error != 0) {
857 		printf("%s: could not add BSS station\n",
858 		    sc->sc_pdev->dv_xname);
859 		return (error);
860 	}
861 	/* Set initial MRR rate. */
862 	DPRINTF(("maxrate=%d\n", maxrate));
863 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(R92C_MACID_BSS),
864 	    maxrate);
865 
866 	return (0);
867 }
868 
869 int
870 rtwn_r88e_ra_init(struct rtwn_softc *sc, u_int8_t mode, u_int32_t rates,
871     int maxrate, uint32_t basicrates, int maxbasicrate)
872 {
873 	u_int32_t reg;
874 
875 	rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, maxbasicrate);
876 
877 	reg = rtwn_read_4(sc, R92C_RRSR);
878 	reg = RW(reg, R92C_RRSR_RATE_BITMAP, rates);
879 	rtwn_write_4(sc, R92C_RRSR, reg);
880 
881 	/*
882 	 * Workaround for performance problems with firmware rate adaptation:
883 	 * If the AP only supports 11b rates, disable mixed B/G mode.
884 	 */
885 	if (mode != R92C_RAID_11B && maxrate <= 3 /* 11M */)
886 		sc->sc_flags |= RTWN_FLAG_FORCE_RAID_11B;
887 
888 	return (0);
889 }
890 
891 void
892 rtwn_tsf_sync_enable(struct rtwn_softc *sc)
893 {
894 	struct ieee80211_node *ni = sc->sc_ic.ic_bss;
895 	uint64_t tsf;
896 
897 	/* Enable TSF synchronization. */
898 	rtwn_write_1(sc, R92C_BCN_CTRL,
899 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
900 
901 	rtwn_write_1(sc, R92C_BCN_CTRL,
902 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
903 
904 	/* Set initial TSF. */
905 	memcpy(&tsf, ni->ni_tstamp, sizeof(tsf));
906 	tsf = letoh64(tsf);
907 	tsf = tsf - (tsf % (ni->ni_intval * IEEE80211_DUR_TU));
908 	tsf -= IEEE80211_DUR_TU;
909 	rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
910 	rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
911 
912 	rtwn_write_1(sc, R92C_BCN_CTRL,
913 	    rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
914 }
915 
916 void
917 rtwn_set_led(struct rtwn_softc *sc, int led, int on)
918 {
919 	uint8_t reg;
920 
921 	if (led != RTWN_LED_LINK)
922 		return; /* not supported */
923 
924 	if (sc->chip & RTWN_CHIP_PCI) {
925 		reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
926 		if (!on)
927 			reg |= R92C_LEDCFG2_DIS;
928 		else
929 			reg |= R92C_LEDCFG2_EN;
930 		rtwn_write_1(sc, R92C_LEDCFG2, reg);
931 	} else if (sc->chip & RTWN_CHIP_USB) {
932 		if (sc->chip & RTWN_CHIP_92E) {
933 			rtwn_write_1(sc, 0x64, rtwn_read_1(sc, 0x64) & 0xfe);
934 			reg = rtwn_read_1(sc, R92C_LEDCFG1) & R92E_LEDSON;
935 			rtwn_write_1(sc, R92C_LEDCFG1, reg |
936 			    (R92C_LEDCFG0_DIS << 1));
937 			if (on) {
938 				reg = rtwn_read_1(sc, R92C_LEDCFG1) &
939 				    R92E_LEDSON;
940 				rtwn_write_1(sc, R92C_LEDCFG1, reg);
941 			}
942 		} else if (sc->chip & RTWN_CHIP_88E) {
943 			reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
944 			rtwn_write_1(sc, R92C_LEDCFG2, reg | R92C_LEDCFG2_EN);
945 			if (!on) {
946 				reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
947 				rtwn_write_1(sc, R92C_LEDCFG2,
948 				    reg | R92C_LEDCFG0_DIS);
949 				rtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
950 				    rtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
951 				    0xfe);
952 			}
953 		} else {
954 			reg = rtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
955 			if (!on)
956 				reg |= R92C_LEDCFG0_DIS;
957 			rtwn_write_1(sc, R92C_LEDCFG0, reg);
958 		}
959 	}
960 	sc->ledlink = on;	/* Save LED state. */
961 }
962 
963 void
964 rtwn_set_nettype(struct rtwn_softc *sc, enum ieee80211_opmode opmode)
965 {
966 	uint8_t msr;
967 
968 	msr = rtwn_read_1(sc, R92C_MSR) & ~R92C_MSR_NETTYPE_MASK;
969 
970 	switch (opmode) {
971 	case IEEE80211_M_MONITOR:
972 		msr |= R92C_MSR_NETTYPE_NOLINK;
973 		break;
974 	case IEEE80211_M_STA:
975 		msr |= R92C_MSR_NETTYPE_INFRA;
976 		break;
977 	default:
978 		break;
979 	}
980 
981 	rtwn_write_1(sc, R92C_MSR, msr);
982 }
983 
984 void
985 rtwn_calib(struct rtwn_softc *sc)
986 {
987 
988 	if (sc->avg_pwdb != -1) {
989 		DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
990 
991 		/* Indicate Rx signal strength to FW for rate adaptation. */
992 		if (sc->chip & RTWN_CHIP_92E) {
993 			struct r92e_fw_cmd_rssi cmd;
994 
995 			memset(&cmd, 0, sizeof(cmd));
996 			cmd.macid = 0;	/* BSS. */
997 			cmd.pwdb = sc->avg_pwdb;
998 			rtwn_fw_cmd(sc, R92E_CMD_RSSI_REPORT, &cmd,
999 			    sizeof(cmd));
1000 		} else {
1001 			struct r92c_fw_cmd_rssi cmd;
1002 
1003 			memset(&cmd, 0, sizeof(cmd));
1004 			cmd.macid = 0;	/* BSS. */
1005 			cmd.pwdb = sc->avg_pwdb;
1006 			rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd,
1007 			    sizeof(cmd));
1008 		}
1009 	}
1010 
1011 	/* Do temperature compensation. */
1012 	rtwn_temp_calib(sc);
1013 
1014 	sc->sc_ops.next_calib(sc->sc_ops.cookie);
1015 }
1016 
1017 void
1018 rtwn_next_scan(struct rtwn_softc *sc)
1019 {
1020 	struct ieee80211com *ic = &sc->sc_ic;
1021 	int s;
1022 
1023 	s = splnet();
1024 	if (ic->ic_state == IEEE80211_S_SCAN)
1025 		ieee80211_next_scan(&ic->ic_if);
1026 	splx(s);
1027 }
1028 
1029 int
1030 rtwn_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1031 {
1032 	struct rtwn_softc *sc = ic->ic_softc;
1033 	struct ieee80211_node *ni;
1034 	enum ieee80211_state ostate;
1035 	uint32_t reg;
1036 	int s, error;
1037 
1038 	s = splnet();
1039 	ostate = ic->ic_state;
1040 
1041 	if (nstate != ostate)
1042 		DPRINTF(("newstate %s -> %s\n",
1043 		    ieee80211_state_name[ostate],
1044 		    ieee80211_state_name[nstate]));
1045 
1046 	if (ostate == IEEE80211_S_RUN) {
1047 		/* Stop calibration. */
1048 		sc->sc_ops.cancel_calib(sc->sc_ops.cookie);
1049 
1050 		/* Turn link LED off. */
1051 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1052 
1053 		/* Set media status to 'No Link'. */
1054 		rtwn_set_nettype(sc, IEEE80211_M_MONITOR);
1055 
1056 		/* Stop Rx of data frames. */
1057 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1058 
1059 		/* Rest TSF. */
1060 		rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1061 
1062 		/* Disable TSF synchronization. */
1063 		rtwn_write_1(sc, R92C_BCN_CTRL,
1064 		    rtwn_read_1(sc, R92C_BCN_CTRL) |
1065 		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1066 
1067 		/* Reset EDCA parameters. */
1068 		rtwn_edca_init(sc);
1069 
1070 		rtwn_updateslot(ic);
1071 		rtwn_update_short_preamble(ic);
1072 
1073 		/* Disable 11b-only AP workaround (see rtwn_r88e_ra_init). */
1074 		sc->sc_flags &= ~RTWN_FLAG_FORCE_RAID_11B;
1075 	}
1076 	switch (nstate) {
1077 	case IEEE80211_S_INIT:
1078 		/* Turn link LED off. */
1079 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1080 		break;
1081 	case IEEE80211_S_SCAN:
1082 		if (ostate != IEEE80211_S_SCAN) {
1083 			/* Allow Rx from any BSSID. */
1084 			rtwn_write_4(sc, R92C_RCR,
1085 			    rtwn_read_4(sc, R92C_RCR) &
1086 			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1087 
1088 			/* Set gain for scanning. */
1089 			reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1090 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1091 			rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1092 
1093 			if (!(sc->chip & RTWN_CHIP_88E)) {
1094 				reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1095 				reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1096 				rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1097 			}
1098 		}
1099 
1100 		/* Make link LED blink during scan. */
1101 		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1102 
1103 		/* Pause AC Tx queues. */
1104 		rtwn_write_1(sc, R92C_TXPAUSE,
1105 		    rtwn_read_1(sc, R92C_TXPAUSE) | R92C_TXPAUSE_AC_VO |
1106 		    R92C_TXPAUSE_AC_VI | R92C_TXPAUSE_AC_BE |
1107 		    R92C_TXPAUSE_AC_BK);
1108 
1109 		rtwn_set_chan(sc, ic->ic_bss->ni_chan, NULL);
1110 		sc->sc_ops.next_scan(sc->sc_ops.cookie);
1111 		break;
1112 
1113 	case IEEE80211_S_AUTH:
1114 		/* Set initial gain under link. */
1115 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1116 		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1117 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1118 
1119 		if (!(sc->chip & RTWN_CHIP_88E)) {
1120 			reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1121 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1122 			rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1123 		}
1124 
1125 		rtwn_set_chan(sc, ic->ic_bss->ni_chan, NULL);
1126 		break;
1127 	case IEEE80211_S_ASSOC:
1128 		break;
1129 	case IEEE80211_S_RUN:
1130 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1131 			rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
1132 
1133 			/* Enable Rx of data frames. */
1134 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1135 
1136 			/* Enable Rx of control frames. */
1137 			rtwn_write_2(sc, R92C_RXFLTMAP1, 0xffff);
1138 
1139 			rtwn_write_4(sc, R92C_RCR,
1140 			    rtwn_read_4(sc, R92C_RCR) |
1141 			    R92C_RCR_AAP | R92C_RCR_ADF | R92C_RCR_ACF |
1142 			    R92C_RCR_AMF);
1143 
1144 			/* Turn link LED on. */
1145 			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1146 			break;
1147 		}
1148 		ni = ic->ic_bss;
1149 
1150 		/* Set media status to 'Associated'. */
1151 		rtwn_set_nettype(sc, IEEE80211_M_STA);
1152 
1153 		/* Set BSSID. */
1154 		rtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1155 		rtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1156 
1157 		if (ic->ic_curmode == IEEE80211_MODE_11B)
1158 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1159 		else	/* 802.11b/g */
1160 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1161 
1162 		rtwn_updateslot(ic);
1163 		rtwn_update_short_preamble(ic);
1164 
1165 		/* Enable Rx of data frames. */
1166 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1167 
1168 		/* Flush all AC queues. */
1169 		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
1170 
1171 		/* Set beacon interval. */
1172 		rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1173 
1174 		/* Allow Rx from our BSSID only. */
1175 		rtwn_write_4(sc, R92C_RCR,
1176 		    rtwn_read_4(sc, R92C_RCR) |
1177 		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1178 
1179 		/* Enable TSF synchronization. */
1180 		rtwn_tsf_sync_enable(sc);
1181 
1182 		/* Initialize rate adaptation. */
1183 		rtwn_ra_init(sc);
1184 
1185 		/* Turn link LED on. */
1186 		rtwn_set_led(sc, RTWN_LED_LINK, 1);
1187 
1188 		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1189 		/* Reset temperature calibration state machine. */
1190 		sc->thcal_state = 0;
1191 		sc->thcal_lctemp = 0;
1192 		/* Start periodic calibration. */
1193 		sc->sc_ops.next_calib(sc->sc_ops.cookie);
1194 		break;
1195 	}
1196 
1197 	error = sc->sc_newstate(ic, nstate, arg);
1198 	splx(s);
1199 
1200 	return (error);
1201 }
1202 
1203 void
1204 rtwn_update_short_preamble(struct ieee80211com *ic)
1205 {
1206 	struct rtwn_softc *sc = ic->ic_softc;
1207 
1208 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
1209 		rtwn_r88e_update_short_preamble(sc);
1210 	else
1211 		rtwn_r92c_update_short_preamble(sc);
1212 }
1213 
1214 void
1215 rtwn_r92c_update_short_preamble(struct rtwn_softc *sc)
1216 {
1217 	uint32_t reg;
1218 
1219 	reg = rtwn_read_4(sc, R92C_RRSR);
1220 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1221 		reg |= R92C_RRSR_SHORT;
1222 	else
1223 		reg &= ~R92C_RRSR_SHORT;
1224 	rtwn_write_4(sc, R92C_RRSR, reg);
1225 }
1226 
1227 void
1228 rtwn_r88e_update_short_preamble(struct rtwn_softc *sc)
1229 {
1230 	uint32_t reg;
1231 
1232 	reg = rtwn_read_4(sc, R92C_WMAC_TRXPTCL_CTL);
1233 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1234 		reg |= R92C_WMAC_TRXPTCL_CTL_SHORT;
1235 	else
1236 		reg &= ~R92C_WMAC_TRXPTCL_CTL_SHORT;
1237 	rtwn_write_4(sc, R92C_WMAC_TRXPTCL_CTL, reg);
1238 }
1239 
1240 void
1241 rtwn_updateslot(struct ieee80211com *ic)
1242 {
1243 	struct rtwn_softc *sc = ic->ic_softc;
1244 	int s;
1245 
1246 	s = splnet();
1247 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1248 		rtwn_write_1(sc, R92C_SLOT, IEEE80211_DUR_DS_SHSLOT);
1249 	else
1250 		rtwn_write_1(sc, R92C_SLOT, IEEE80211_DUR_DS_SLOT);
1251 	splx(s);
1252 }
1253 
1254 void
1255 rtwn_updateedca(struct ieee80211com *ic)
1256 {
1257 	struct rtwn_softc *sc = ic->ic_softc;
1258 	const uint16_t aci2reg[EDCA_NUM_AC] = {
1259 		R92C_EDCA_BE_PARAM,
1260 		R92C_EDCA_BK_PARAM,
1261 		R92C_EDCA_VI_PARAM,
1262 		R92C_EDCA_VO_PARAM
1263 	};
1264 	struct ieee80211_edca_ac_params *ac;
1265 	int s, aci, aifs, slottime;
1266 	uint8_t acm = 0;
1267 
1268 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1269 		slottime = IEEE80211_DUR_DS_SHSLOT;
1270 	else
1271 		slottime = IEEE80211_DUR_DS_SLOT;
1272 	s = splnet();
1273 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1274 		ac = &ic->ic_edca_ac[aci];
1275 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1276 		aifs = ac->ac_aifsn * slottime + IEEE80211_DUR_DS_SIFS;
1277 		rtwn_write_4(sc, aci2reg[aci],
1278 		    SM(R92C_EDCA_PARAM_TXOP, ac->ac_txoplimit) |
1279 		    SM(R92C_EDCA_PARAM_ECWMIN, ac->ac_ecwmin) |
1280 		    SM(R92C_EDCA_PARAM_ECWMAX, ac->ac_ecwmax) |
1281 		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1282 
1283 		/* Is admission control mandatory for this queue? */
1284 		if (ac->ac_acm) {
1285 			switch (aci) {
1286 			case EDCA_AC_BE:
1287 				acm |= R92C_ACMHW_BEQEN;
1288 				break;
1289 			case EDCA_AC_VI:
1290 				acm |= R92C_ACMHW_VIQEN;
1291 				break;
1292 			case EDCA_AC_VO:
1293 				acm |= R92C_ACMHW_VOQEN;
1294 				break;
1295 			default:
1296 				break;
1297 			}
1298 		}
1299 	}
1300 	splx(s);
1301 
1302 	/* Enable hardware admission control. */
1303 	rtwn_write_1(sc, R92C_ACMHWCTRL, R92C_ACMHW_HWEN | acm);
1304 }
1305 
1306 int
1307 rtwn_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1308     struct ieee80211_key *k)
1309 {
1310 	struct rtwn_softc *sc = ic->ic_softc;
1311 	static const uint8_t etherzeroaddr[6] = { 0 };
1312 	const uint8_t *macaddr;
1313 	uint8_t keybuf[16], algo;
1314 	int i, entry;
1315 
1316 	/* Defer setting of WEP keys until interface is brought up. */
1317 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
1318 	    (IFF_UP | IFF_RUNNING))
1319 		return (0);
1320 
1321 	/* Map net80211 cipher to HW crypto algorithm. */
1322 	switch (k->k_cipher) {
1323 	case IEEE80211_CIPHER_WEP40:
1324 		algo = R92C_CAM_ALGO_WEP40;
1325 		break;
1326 	case IEEE80211_CIPHER_WEP104:
1327 		algo = R92C_CAM_ALGO_WEP104;
1328 		break;
1329 	case IEEE80211_CIPHER_TKIP:
1330 		algo = R92C_CAM_ALGO_TKIP;
1331 		break;
1332 	case IEEE80211_CIPHER_CCMP:
1333 		algo = R92C_CAM_ALGO_AES;
1334 		break;
1335 	default:
1336 		/* Fallback to software crypto for other ciphers. */
1337 		return (ieee80211_set_key(ic, ni, k));
1338 	}
1339 	if (k->k_flags & IEEE80211_KEY_GROUP) {
1340 		macaddr = etherzeroaddr;
1341 		entry = k->k_id;
1342 	} else {
1343 		macaddr = ic->ic_bss->ni_macaddr;
1344 		entry = 4;
1345 	}
1346 	/* Write key. */
1347 	memset(keybuf, 0, sizeof(keybuf));
1348 	memcpy(keybuf, k->k_key, MIN(k->k_len, sizeof(keybuf)));
1349 	for (i = 0; i < 4; i++) {
1350 		rtwn_cam_write(sc, R92C_CAM_KEY(entry, i),
1351 		    LE_READ_4(&keybuf[i * 4]));
1352 	}
1353 	/* Write CTL0 last since that will validate the CAM entry. */
1354 	rtwn_cam_write(sc, R92C_CAM_CTL1(entry),
1355 	    LE_READ_4(&macaddr[2]));
1356 	rtwn_cam_write(sc, R92C_CAM_CTL0(entry),
1357 	    SM(R92C_CAM_ALGO, algo) |
1358 	    SM(R92C_CAM_KEYID, k->k_id) |
1359 	    SM(R92C_CAM_MACLO, LE_READ_2(&macaddr[0])) |
1360 	    R92C_CAM_VALID);
1361 
1362 	return (0);
1363 }
1364 
1365 void
1366 rtwn_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1367     struct ieee80211_key *k)
1368 {
1369 	struct rtwn_softc *sc = ic->ic_softc;
1370 	int i, entry;
1371 
1372 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
1373 	    ic->ic_state != IEEE80211_S_RUN)
1374 		return;	/* Nothing to do. */
1375 
1376 	if (k->k_flags & IEEE80211_KEY_GROUP)
1377 		entry = k->k_id;
1378 	else
1379 		entry = 4;
1380 	rtwn_cam_write(sc, R92C_CAM_CTL0(entry), 0);
1381 	rtwn_cam_write(sc, R92C_CAM_CTL1(entry), 0);
1382 	/* Clear key. */
1383 	for (i = 0; i < 4; i++)
1384 		rtwn_cam_write(sc, R92C_CAM_KEY(entry, i), 0);
1385 }
1386 
1387 void
1388 rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
1389 {
1390 	int pwdb;
1391 
1392 	/* Convert antenna signal to percentage. */
1393 	if (rssi <= -100 || rssi >= 20)
1394 		pwdb = 0;
1395 	else if (rssi >= 0)
1396 		pwdb = 100;
1397 	else
1398 		pwdb = 100 + rssi;
1399 	if (sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C)) {
1400 		if (rate <= 3) {
1401 			/* CCK gain is smaller than OFDM/MCS gain. */
1402 			pwdb += 6;
1403 			if (pwdb > 100)
1404 				pwdb = 100;
1405 			if (pwdb <= 14)
1406 				pwdb -= 4;
1407 			else if (pwdb <= 26)
1408 				pwdb -= 8;
1409 			else if (pwdb <= 34)
1410 				pwdb -= 6;
1411 			else if (pwdb <= 42)
1412 				pwdb -= 2;
1413 		}
1414 	}
1415 	if (sc->avg_pwdb == -1)	/* Init. */
1416 		sc->avg_pwdb = pwdb;
1417 	else if (sc->avg_pwdb < pwdb)
1418 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1419 	else
1420 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1421 	DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
1422 }
1423 
1424 int8_t
1425 rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1426 {
1427 	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1428 	struct r92c_rx_phystat *phy;
1429 	struct r92c_rx_cck *cck;
1430 	uint8_t rpt;
1431 	int8_t rssi;
1432 
1433 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
1434 		return rtwn_r88e_get_rssi(sc, rate, physt);
1435 
1436 	if (rate <= 3) {
1437 		cck = (struct r92c_rx_cck *)physt;
1438 		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1439 			rpt = (cck->agc_rpt >> 5) & 0x3;
1440 			rssi = (cck->agc_rpt & 0x1f) << 1;
1441 		} else {
1442 			rpt = (cck->agc_rpt >> 6) & 0x3;
1443 			rssi = cck->agc_rpt & 0x3e;
1444 		}
1445 		rssi = cckoff[rpt] - rssi;
1446 	} else {	/* OFDM/HT. */
1447 		phy = (struct r92c_rx_phystat *)physt;
1448 		rssi = ((letoh32(phy->phydw1) >> 1) & 0x7f) - 110;
1449 	}
1450 	return (rssi);
1451 }
1452 
1453 int8_t
1454 rtwn_r88e_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1455 {
1456 	static const int8_t cckoff[] = { 20, 14, 10, -4, -16, -22, -38, -40 };
1457 	struct r88e_rx_phystat *phy;
1458 	uint8_t rpt;
1459 	int8_t rssi;
1460 
1461 	phy = (struct r88e_rx_phystat *)physt;
1462 
1463 	if (rate <= 3) {
1464 		rpt = (phy->agc_rpt >> 5) & 0x7;
1465 		rssi = (phy->agc_rpt & 0x1f) << 1;
1466 		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1467 			if (rpt == 2)
1468 				rssi -= 6;
1469 		}
1470 		rssi = (phy->agc_rpt & 0x1f) > 27 ? -94 : cckoff[rpt] - rssi;
1471 	} else {	/* OFDM/HT. */
1472 		rssi = ((le32toh(phy->sq_rpt) >> 1) & 0x7f) - 110;
1473 	}
1474 	return (rssi);
1475 }
1476 
1477 void
1478 rtwn_start(struct ifnet *ifp)
1479 {
1480 	struct rtwn_softc *sc = ifp->if_softc;
1481 	struct ieee80211com *ic = &sc->sc_ic;
1482 	struct ieee80211_node *ni;
1483 	struct mbuf *m;
1484 
1485 	if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
1486 		return;
1487 
1488 	for (;;) {
1489 		if (sc->sc_ops.is_oactive(sc->sc_ops.cookie)) {
1490 			ifq_set_oactive(&ifp->if_snd);
1491 			break;
1492 		}
1493 		/* Send pending management frames first. */
1494 		m = mq_dequeue(&ic->ic_mgtq);
1495 		if (m != NULL) {
1496 			ni = m->m_pkthdr.ph_cookie;
1497 			goto sendit;
1498 		}
1499 		if (ic->ic_state != IEEE80211_S_RUN)
1500 			break;
1501 
1502 		/* Encapsulate and send data frames. */
1503 		m = ifq_dequeue(&ifp->if_snd);
1504 		if (m == NULL)
1505 			break;
1506 #if NBPFILTER > 0
1507 		if (ifp->if_bpf != NULL)
1508 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1509 #endif
1510 		if ((m = ieee80211_encap(ifp, m, &ni)) == NULL)
1511 			continue;
1512 sendit:
1513 #if NBPFILTER > 0
1514 		if (ic->ic_rawbpf != NULL)
1515 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1516 #endif
1517 		if (sc->sc_ops.tx(sc->sc_ops.cookie, m, ni) != 0) {
1518 			ieee80211_release_node(ic, ni);
1519 			ifp->if_oerrors++;
1520 			continue;
1521 		}
1522 
1523 		sc->sc_tx_timer = 5;
1524 		ifp->if_timer = 1;
1525 	}
1526 }
1527 
1528 void
1529 rtwn_watchdog(struct ifnet *ifp)
1530 {
1531 	struct rtwn_softc *sc = ifp->if_softc;
1532 
1533 	ifp->if_timer = 0;
1534 
1535 	if (sc->sc_tx_timer > 0) {
1536 		if (--sc->sc_tx_timer == 0) {
1537 			printf("%s: device timeout\n", sc->sc_pdev->dv_xname);
1538 			task_add(systq, &sc->init_task);
1539 			ifp->if_oerrors++;
1540 			return;
1541 		}
1542 		ifp->if_timer = 1;
1543 	}
1544 	ieee80211_watchdog(ifp);
1545 }
1546 
1547 int
1548 rtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1549 {
1550 	struct rtwn_softc *sc = ifp->if_softc;
1551 	struct ieee80211com *ic = &sc->sc_ic;
1552 	int s, error = 0;
1553 
1554 	s = splnet();
1555 	/*
1556 	 * Prevent processes from entering this function while another
1557 	 * process is tsleep'ing in it.
1558 	 */
1559 	while ((sc->sc_flags & RTWN_FLAG_BUSY) && error == 0)
1560 		error = tsleep_nsec(&sc->sc_flags, PCATCH, "rtwnioc", INFSLP);
1561 	if (error != 0) {
1562 		splx(s);
1563 		return error;
1564 	}
1565 	sc->sc_flags |= RTWN_FLAG_BUSY;
1566 
1567 	switch (cmd) {
1568 	case SIOCSIFADDR:
1569 		ifp->if_flags |= IFF_UP;
1570 		/* FALLTHROUGH */
1571 	case SIOCSIFFLAGS:
1572 		if (ifp->if_flags & IFF_UP) {
1573 			if (!(ifp->if_flags & IFF_RUNNING))
1574 				rtwn_init(ifp);
1575 		} else {
1576 			if (ifp->if_flags & IFF_RUNNING)
1577 				rtwn_stop(ifp);
1578 		}
1579 		break;
1580 	case SIOCS80211CHANNEL:
1581 		error = ieee80211_ioctl(ifp, cmd, data);
1582 		if (error == ENETRESET &&
1583 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
1584 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1585 			    (IFF_UP | IFF_RUNNING))
1586 				rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
1587 			error = 0;
1588 		}
1589 		break;
1590 	default:
1591 		error = ieee80211_ioctl(ifp, cmd, data);
1592 	}
1593 
1594 	if (error == ENETRESET) {
1595 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1596 		    (IFF_UP | IFF_RUNNING)) {
1597 			rtwn_stop(ifp);
1598 			rtwn_init(ifp);
1599 		}
1600 		error = 0;
1601 	}
1602 	sc->sc_flags &= ~RTWN_FLAG_BUSY;
1603 	wakeup(&sc->sc_flags);
1604 	splx(s);
1605 
1606 	return (error);
1607 }
1608 
1609 void
1610 rtwn_fw_reset(struct rtwn_softc *sc)
1611 {
1612 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
1613 		rtwn_r88e_fw_reset(sc);
1614 	else
1615 		rtwn_r92c_fw_reset(sc);
1616 }
1617 
1618 void
1619 rtwn_r92c_fw_reset(struct rtwn_softc *sc)
1620 {
1621 	uint16_t reg;
1622 	int ntries;
1623 
1624 	/* Tell 8051 to reset itself. */
1625 	rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
1626 
1627 	/* Wait until 8051 resets by itself. */
1628 	for (ntries = 0; ntries < 100; ntries++) {
1629 		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1630 		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
1631 			goto sleep;
1632 		DELAY(50);
1633 	}
1634 	/* Force 8051 reset. */
1635 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1636 sleep:
1637 	if (sc->chip & RTWN_CHIP_PCI) {
1638 		/*
1639 		 * We must sleep for one second to let the firmware settle.
1640 		 * Accessing registers too early will hang the whole system.
1641 		 */
1642 		tsleep_nsec(&reg, 0, "rtwnrst", SEC_TO_NSEC(1));
1643 	}
1644 }
1645 
1646 void
1647 rtwn_r88e_fw_reset(struct rtwn_softc *sc)
1648 {
1649 	uint16_t reg;
1650 
1651 	/* Reset MCU IO wrapper. */
1652 	rtwn_write_1(sc, R92C_RSV_CTRL,
1653 	    rtwn_read_1(sc, R92C_RSV_CTRL) & ~R92C_RSV_CTRL_WLOCK_00);
1654 	if (sc->chip & RTWN_CHIP_88E) {
1655 		rtwn_write_2(sc, R92C_RSV_CTRL,
1656 		    rtwn_read_2(sc, R92C_RSV_CTRL) & ~R88E_RSV_CTRL_MCU_RST);
1657 	} else {
1658 		rtwn_write_2(sc, R92C_RSV_CTRL,
1659 		    rtwn_read_2(sc, R92C_RSV_CTRL) & ~R88E_RSV_CTRL_MIO_EN);
1660 	}
1661 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1662 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1663 
1664 	/* Enable MCU IO wrapper. */
1665 	rtwn_write_1(sc, R92C_RSV_CTRL,
1666 	    rtwn_read_1(sc, R92C_RSV_CTRL) & ~R92C_RSV_CTRL_WLOCK_00);
1667 	if (sc->chip & RTWN_CHIP_88E) {
1668 		rtwn_write_2(sc, R92C_RSV_CTRL,
1669 		    rtwn_read_2(sc, R92C_RSV_CTRL) | R88E_RSV_CTRL_MCU_RST);
1670 	} else {
1671 		rtwn_write_2(sc, R92C_RSV_CTRL,
1672 		    rtwn_read_2(sc, R92C_RSV_CTRL) | R88E_RSV_CTRL_MIO_EN);
1673 	}
1674 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
1675 }
1676 
1677 int
1678 rtwn_load_firmware(struct rtwn_softc *sc)
1679 {
1680 	const struct r92c_fw_hdr *hdr;
1681 	u_char *fw, *ptr;
1682 	size_t len0, len;
1683 	uint32_t reg;
1684 	int mlen, ntries, page, error;
1685 
1686 	/* Read firmware image from the filesystem. */
1687 	error = sc->sc_ops.load_firmware(sc->sc_ops.cookie, &fw, &len0);
1688 	if (error)
1689 		return (error);
1690 	len = len0;
1691 	if (len < sizeof(*hdr)) {
1692 		printf("%s: firmware too short\n", sc->sc_pdev->dv_xname);
1693 		error = EINVAL;
1694 		goto fail;
1695 	}
1696 	ptr = fw;
1697 	hdr = (const struct r92c_fw_hdr *)ptr;
1698 	/* Check if there is a valid FW header and skip it. */
1699 	if ((letoh16(hdr->signature) >> 4) == 0x230 ||
1700 	    (letoh16(hdr->signature) >> 4) == 0x88c ||
1701 	    (letoh16(hdr->signature) >> 4) == 0x88e ||
1702 	    (letoh16(hdr->signature) >> 4) == 0x92c ||
1703 	    (letoh16(hdr->signature) >> 4) == 0x92e) {
1704 		DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
1705 		    letoh16(hdr->version), letoh16(hdr->subversion),
1706 		    hdr->month, hdr->date, hdr->hour, hdr->minute));
1707 		ptr += sizeof(*hdr);
1708 		len -= sizeof(*hdr);
1709 	}
1710 
1711 	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
1712 		rtwn_write_1(sc, R92C_MCUFWDL, 0);
1713 		rtwn_fw_reset(sc);
1714 	}
1715 
1716 	if (sc->chip & RTWN_CHIP_PCI) {
1717 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1718 		    rtwn_read_2(sc, R92C_SYS_FUNC_EN) | R92C_SYS_FUNC_EN_CPUEN);
1719 	}
1720 
1721 	/* Enable FW download. */
1722 	rtwn_write_1(sc, R92C_MCUFWDL,
1723 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
1724 	rtwn_write_4(sc, R92C_MCUFWDL,
1725 	    rtwn_read_4(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_ROM_DLEN);
1726 
1727 	/* Reset the FWDL checksum. */
1728 	rtwn_write_1(sc, R92C_MCUFWDL,
1729 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
1730 
1731 	DELAY(50);
1732 	for (page = 0; len > 0; page++) {
1733 		mlen = MIN(len, R92C_FW_PAGE_SIZE);
1734 		error = sc->sc_ops.fw_loadpage(sc->sc_ops.cookie, page, ptr,
1735 		    mlen);
1736 		if (error != 0) {
1737 			printf("%s: could not load firmware page %d\n",
1738 			    sc->sc_pdev->dv_xname, page);
1739 			goto fail;
1740 		}
1741 		ptr += mlen;
1742 		len -= mlen;
1743 	}
1744 
1745 	/* Wait for checksum report. */
1746 	for (ntries = 0; ntries < 1000; ntries++) {
1747 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
1748 			break;
1749 		DELAY(5);
1750 	}
1751 	if (ntries == 1000) {
1752 		printf("%s: timeout waiting for checksum report\n",
1753 		    sc->sc_pdev->dv_xname);
1754 		error = ETIMEDOUT;
1755 		goto fail;
1756 	}
1757 
1758 	/* Disable FW download. */
1759 	rtwn_write_1(sc, R92C_MCUFWDL,
1760 	    rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
1761 
1762 	/* Reserved for fw extension. */
1763 	if (!(sc->chip & RTWN_CHIP_92E))
1764 		rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
1765 
1766 	reg = rtwn_read_4(sc, R92C_MCUFWDL);
1767 	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
1768 	rtwn_write_4(sc, R92C_MCUFWDL, reg);
1769 	if (sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C | RTWN_CHIP_23A)) {
1770 		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1771 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1772 		    reg & ~R92C_SYS_FUNC_EN_CPUEN);
1773 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1774 		    reg | R92C_SYS_FUNC_EN_CPUEN);
1775 	} else
1776 		rtwn_fw_reset(sc);
1777 	/* Wait for firmware readiness. */
1778 	for (ntries = 0; ntries < 1000; ntries++) {
1779 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
1780 			break;
1781 		DELAY(10);
1782 	}
1783 	if (ntries == 1000) {
1784 		printf("%s: timeout waiting for firmware readiness\n",
1785 		    sc->sc_pdev->dv_xname);
1786 		error = ETIMEDOUT;
1787 		goto fail;
1788 	}
1789 fail:
1790 	free(fw, M_DEVBUF, len0);
1791 	return (error);
1792 }
1793 
1794 void
1795 rtwn_rf_init(struct rtwn_softc *sc)
1796 {
1797 	const struct r92c_rf_prog *prog;
1798 	uint32_t reg, type;
1799 	int i, j, idx, off;
1800 
1801 	/* Select RF programming based on board type. */
1802 	if (sc->chip & RTWN_CHIP_88E)
1803 		prog = rtl8188eu_rf_prog;
1804 	else if (sc->chip & RTWN_CHIP_92E)
1805 		prog = rtl8192e_rf_prog;
1806 	else if (!(sc->chip & RTWN_CHIP_92C)) {
1807 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
1808 			prog = rtl8188ce_rf_prog;
1809 		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
1810 			prog = rtl8188ru_rf_prog;
1811 		else
1812 			prog = rtl8188cu_rf_prog;
1813 	} else
1814 		prog = rtl8192ce_rf_prog;
1815 
1816 	for (i = 0; i < sc->nrxchains; i++) {
1817 		/* Save RF_ENV control type. */
1818 		idx = i / 2;
1819 		off = (i % 2) * 16;
1820 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
1821 		type = (reg >> off) & 0x10;
1822 
1823 		/* Set RF_ENV enable. */
1824 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
1825 		reg |= 0x100000;
1826 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
1827 		DELAY(50);
1828 		/* Set RF_ENV output high. */
1829 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
1830 		reg |= 0x10;
1831 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
1832 		DELAY(50);
1833 		/* Set address and data lengths of RF registers. */
1834 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
1835 		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
1836 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
1837 		DELAY(50);
1838 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
1839 		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
1840 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
1841 		DELAY(50);
1842 
1843 		/* Write RF initialization values for this chain. */
1844 		for (j = 0; j < prog[i].count; j++) {
1845 			switch (prog[i].regs[j]) {
1846 			case 0xfe:
1847 				DELAY(50000);
1848 				continue;
1849 			case 0xfd:
1850 				DELAY(5000);
1851 				continue;
1852 			case 0xfc:
1853 				DELAY(1000);
1854 				continue;
1855 			case 0xfb:
1856 				DELAY(50);
1857 				continue;
1858 			case 0xfa:
1859 				DELAY(5);
1860 				continue;
1861 			case 0xf9:
1862 				DELAY(1);
1863 				continue;
1864 			}
1865 			rtwn_rf_write(sc, i, prog[i].regs[j],
1866 			    prog[i].vals[j]);
1867 			DELAY(5);
1868 		}
1869 
1870 		/* Restore RF_ENV control type. */
1871 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
1872 		reg &= ~(0x10 << off) | (type << off);
1873 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
1874 
1875 		/* Cache RF register CHNLBW. */
1876 		sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
1877 	}
1878 
1879 	/* magic value for HP 8188EEs */
1880 	if (sc->chip == (RTWN_CHIP_88E | RTWN_CHIP_PCI)) {
1881 		struct r88e_rom *rom = &sc->sc_r88e_rom;
1882 		if (rom->r88ee_rom.svid == 0x103c &&
1883 		    rom->r88ee_rom.smid == 0x197d)
1884 			rtwn_rf_write(sc, 0, 0x52, 0x7e4bd);
1885 	}
1886 
1887 	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
1888 	    RTWN_CHIP_UMC_A_CUT) {
1889 		rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
1890 		rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
1891 	} else if (sc->chip & RTWN_CHIP_23A) {
1892 		rtwn_rf_write(sc, 0, 0x0C, 0x894ae);
1893 		rtwn_rf_write(sc, 0, 0x0A, 0x1af31);
1894 		rtwn_rf_write(sc, 0, R92C_RF_IPA, 0x8f425);
1895 		rtwn_rf_write(sc, 0, R92C_RF_SYN_G(1), 0x4f200);
1896 		rtwn_rf_write(sc, 0, R92C_RF_RCK1, 0x44053);
1897 		rtwn_rf_write(sc, 0, R92C_RF_RCK2, 0x80201);
1898 	}
1899 }
1900 
1901 void
1902 rtwn_cam_init(struct rtwn_softc *sc)
1903 {
1904 	/* Invalidate all CAM entries. */
1905 	rtwn_write_4(sc, R92C_CAMCMD,
1906 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
1907 }
1908 
1909 void
1910 rtwn_pa_bias_init(struct rtwn_softc *sc)
1911 {
1912 	uint8_t reg;
1913 	int i;
1914 
1915 	for (i = 0; i < sc->nrxchains; i++) {
1916 		if (sc->pa_setting & (1 << i))
1917 			continue;
1918 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
1919 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
1920 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
1921 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
1922 	}
1923 	if (!(sc->pa_setting & 0x10)) {
1924 		reg = rtwn_read_1(sc, 0x16);
1925 		reg = (reg & ~0xf0) | 0x90;
1926 		rtwn_write_1(sc, 0x16, reg);
1927 	}
1928 }
1929 
1930 void
1931 rtwn_rxfilter_init(struct rtwn_softc *sc)
1932 {
1933 	/* Initialize Rx filter. */
1934 	rtwn_write_4(sc, R92C_RCR,
1935 	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
1936 	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
1937 	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
1938 	/* Accept all multicast frames. */
1939 	rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
1940 	rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
1941 	/* Accept all management frames. */
1942 	rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
1943 	/* Reject all control frames. */
1944 	rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
1945 	/* Accept all data frames. */
1946 	rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1947 }
1948 
1949 void
1950 rtwn_edca_init(struct rtwn_softc *sc)
1951 {
1952 	struct ieee80211com *ic = &sc->sc_ic;
1953 	int mode, aci;
1954 
1955 	/* Set SIFS; 0x10 = 16 usec (SIFS 11g), 0x0a = 10 usec (SIFS 11b) */
1956 	rtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
1957 	rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
1958 	rtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
1959 	rtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
1960 	rtwn_write_2(sc, R92C_RESP_SIFS_CCK, 0x100a);
1961 	rtwn_write_2(sc, R92C_RESP_SIFS_OFDM, 0x100a);
1962 
1963 	if (ic->ic_curmode == IEEE80211_MODE_AUTO)
1964 		mode = IEEE80211_MODE_11G; /* XXX */
1965 	else
1966 		mode = ic->ic_curmode;
1967 	for (aci = 0; aci < EDCA_NUM_AC; aci++)
1968 		memcpy(&ic->ic_edca_ac[aci], &ieee80211_edca_table[mode][aci],
1969 		    sizeof(struct ieee80211_edca_ac_params));
1970 	rtwn_updateedca(ic);
1971 
1972 	if (sc->chip & RTWN_CHIP_PCI) {
1973 		/* linux magic */
1974 		rtwn_write_4(sc, R92C_FAST_EDCA_CTRL, 0x086666);
1975 	}
1976 
1977 	rtwn_write_4(sc, R92C_EDCA_RANDOM_GEN, arc4random());
1978 }
1979 
1980 void
1981 rtwn_rate_fallback_init(struct rtwn_softc *sc)
1982 {
1983 	if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
1984 		if (sc->chip & RTWN_CHIP_PCI) {
1985 			rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
1986 			rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
1987 			rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
1988 			rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
1989 		} else if (sc->chip & RTWN_CHIP_USB) {
1990 			rtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
1991 			rtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
1992 			rtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
1993 			rtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
1994 		}
1995 	}
1996 }
1997 
1998 void
1999 rtwn_write_txpower(struct rtwn_softc *sc, int chain,
2000     uint16_t power[RTWN_POWER_COUNT])
2001 {
2002 	uint32_t reg;
2003 
2004 	/* Write per-CCK rate Tx power. */
2005 	if (chain == 0) {
2006 		reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2007 		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[RTWN_POWER_CCK1]);
2008 		rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2009 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2010 		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[RTWN_POWER_CCK2]);
2011 		reg = RW(reg, R92C_TXAGC_A_CCK55, power[RTWN_POWER_CCK55]);
2012 		reg = RW(reg, R92C_TXAGC_A_CCK11, power[RTWN_POWER_CCK11]);
2013 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2014 	} else {
2015 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2016 		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[RTWN_POWER_CCK1]);
2017 		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[RTWN_POWER_CCK2]);
2018 		reg = RW(reg, R92C_TXAGC_B_CCK55, power[RTWN_POWER_CCK55]);
2019 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2020 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2021 		reg = RW(reg, R92C_TXAGC_B_CCK11, power[RTWN_POWER_CCK11]);
2022 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2023 	}
2024 	/* Write per-OFDM rate Tx power. */
2025 	rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2026 	    SM(R92C_TXAGC_RATE06, power[RTWN_POWER_OFDM6]) |
2027 	    SM(R92C_TXAGC_RATE09, power[RTWN_POWER_OFDM9]) |
2028 	    SM(R92C_TXAGC_RATE12, power[RTWN_POWER_OFDM12]) |
2029 	    SM(R92C_TXAGC_RATE18, power[RTWN_POWER_OFDM18]));
2030 	rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2031 	    SM(R92C_TXAGC_RATE24, power[RTWN_POWER_OFDM24]) |
2032 	    SM(R92C_TXAGC_RATE36, power[RTWN_POWER_OFDM36]) |
2033 	    SM(R92C_TXAGC_RATE48, power[RTWN_POWER_OFDM48]) |
2034 	    SM(R92C_TXAGC_RATE54, power[RTWN_POWER_OFDM54]));
2035 	/* Write per-MCS Tx power. */
2036 	rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2037 	    SM(R92C_TXAGC_MCS00,  power[RTWN_POWER_MCS( 0)]) |
2038 	    SM(R92C_TXAGC_MCS01,  power[RTWN_POWER_MCS( 1)]) |
2039 	    SM(R92C_TXAGC_MCS02,  power[RTWN_POWER_MCS( 2)]) |
2040 	    SM(R92C_TXAGC_MCS03,  power[RTWN_POWER_MCS( 3)]));
2041 	rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2042 	    SM(R92C_TXAGC_MCS04,  power[RTWN_POWER_MCS( 4)]) |
2043 	    SM(R92C_TXAGC_MCS05,  power[RTWN_POWER_MCS( 5)]) |
2044 	    SM(R92C_TXAGC_MCS06,  power[RTWN_POWER_MCS( 6)]) |
2045 	    SM(R92C_TXAGC_MCS07,  power[RTWN_POWER_MCS( 7)]));
2046 	if (sc->ntxchains > 1) {
2047 		rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2048 		    SM(R92C_TXAGC_MCS08,  power[RTWN_POWER_MCS( 8)]) |
2049 		    SM(R92C_TXAGC_MCS09,  power[RTWN_POWER_MCS( 9)]) |
2050 		    SM(R92C_TXAGC_MCS10,  power[RTWN_POWER_MCS(10)]) |
2051 		    SM(R92C_TXAGC_MCS11,  power[RTWN_POWER_MCS(11)]));
2052 		rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2053 		    SM(R92C_TXAGC_MCS12,  power[RTWN_POWER_MCS(12)]) |
2054 		    SM(R92C_TXAGC_MCS13,  power[RTWN_POWER_MCS(13)]) |
2055 		    SM(R92C_TXAGC_MCS14,  power[RTWN_POWER_MCS(14)]) |
2056 		    SM(R92C_TXAGC_MCS15,  power[RTWN_POWER_MCS(15)]));
2057 	}
2058 }
2059 
2060 void
2061 rtwn_get_txpower(struct rtwn_softc *sc, int chain, struct ieee80211_channel *c,
2062     struct ieee80211_channel *extc, uint16_t power[RTWN_POWER_COUNT])
2063 {
2064 	if (sc->chip & RTWN_CHIP_88E)
2065 		rtwn_r88e_get_txpower(sc, chain, c, extc, power);
2066 	else if (sc->chip & RTWN_CHIP_92E)
2067 		rtwn_r92e_get_txpower(sc, chain, c, extc, power);
2068 	else
2069 		rtwn_r92c_get_txpower(sc, chain, c, extc, power);
2070 }
2071 
2072 void
2073 rtwn_r92c_get_txpower(struct rtwn_softc *sc, int chain,
2074     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2075     uint16_t power[RTWN_POWER_COUNT])
2076 {
2077 	struct ieee80211com *ic = &sc->sc_ic;
2078 	struct r92c_rom *rom = &sc->sc_r92c_rom;
2079 	uint16_t cckpow, ofdmpow, htpow, diff, max;
2080 	const struct r92c_txpwr *base;
2081 	int ridx, chan, group;
2082 
2083 	/* Determine channel group. */
2084 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2085 	if (chan <= 3)
2086 		group = 0;
2087 	else if (chan <= 9)
2088 		group = 1;
2089 	else
2090 		group = 2;
2091 
2092 	/* Get original Tx power based on board type and RF chain. */
2093 	if (!(sc->chip & RTWN_CHIP_92C)) {
2094 		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2095 			base = &rtl8188ru_txagc[chain];
2096 		else
2097 			base = &rtl8192cu_txagc[chain];
2098 	} else
2099 		base = &rtl8192cu_txagc[chain];
2100 
2101 	memset(power, 0, RTWN_POWER_COUNT * sizeof(power[0]));
2102 	if (sc->regulatory == 0) {
2103 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
2104 			power[ridx] = base->pwr[0][ridx];
2105 	}
2106 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_MAX; ridx++) {
2107 		if (sc->regulatory == 3) {
2108 			power[ridx] = base->pwr[0][ridx];
2109 			/* Apply vendor limits. */
2110 			if (extc != NULL)
2111 				max = rom->ht40_max_pwr[group];
2112 			else
2113 				max = rom->ht20_max_pwr[group];
2114 			max = (max >> (chain * 4)) & 0xf;
2115 			if (power[ridx] > max)
2116 				power[ridx] = max;
2117 		} else if (sc->regulatory == 1) {
2118 			if (extc == NULL)
2119 				power[ridx] = base->pwr[group][ridx];
2120 		} else if (sc->regulatory != 2)
2121 			power[ridx] = base->pwr[0][ridx];
2122 	}
2123 
2124 	/* Compute per-CCK rate Tx power. */
2125 	cckpow = rom->cck_tx_pwr[chain][group];
2126 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2127 		power[ridx] += cckpow;
2128 		if (power[ridx] > R92C_MAX_TX_PWR)
2129 			power[ridx] = R92C_MAX_TX_PWR;
2130 	}
2131 
2132 	htpow = rom->ht40_1s_tx_pwr[chain][group];
2133 	if (sc->ntxchains > 1) {
2134 		/* Apply reduction for 2 spatial streams. */
2135 		diff = rom->ht40_2s_tx_pwr_diff[group];
2136 		diff = (diff >> (chain * 4)) & 0xf;
2137 		htpow = (htpow > diff) ? htpow - diff : 0;
2138 	}
2139 
2140 	/* Compute per-OFDM rate Tx power. */
2141 	diff = rom->ofdm_tx_pwr_diff[group];
2142 	diff = (diff >> (chain * 4)) & 0xf;
2143 	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2144 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2145 		power[ridx] += ofdmpow;
2146 		if (power[ridx] > R92C_MAX_TX_PWR)
2147 			power[ridx] = R92C_MAX_TX_PWR;
2148 	}
2149 
2150 	/* Compute per-MCS Tx power. */
2151 	if (extc == NULL) {
2152 		diff = rom->ht20_tx_pwr_diff[group];
2153 		diff = (diff >> (chain * 4)) & 0xf;
2154 		htpow += diff;	/* HT40->HT20 correction. */
2155 	}
2156 	for (ridx = RTWN_RIDX_MCS0; ridx <= RTWN_RIDX_MCS15; ridx++) {
2157 		power[ridx] += htpow;
2158 		if (power[ridx] > R92C_MAX_TX_PWR)
2159 			power[ridx] = R92C_MAX_TX_PWR;
2160 	}
2161 #ifdef RTWN_DEBUG
2162 	if (rtwn_debug >= 4) {
2163 		/* Dump per-rate Tx power values. */
2164 		printf("Tx power for chain %d:\n", chain);
2165 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_MAX; ridx++)
2166 			printf("Rate %d = %u\n", ridx, power[ridx]);
2167 	}
2168 #endif
2169 }
2170 
2171 void
2172 rtwn_r92e_get_txpower(struct rtwn_softc *sc, int chain,
2173     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2174     uint16_t power[RTWN_POWER_COUNT])
2175 {
2176 	struct ieee80211com *ic = &sc->sc_ic;
2177 	struct r92e_rom *rom = &sc->sc_r92e_rom;
2178 	struct r92e_tx_pwr *txpwr;
2179 	uint8_t cckpow, htpow, htpow2s = 0, ofdmpow;
2180 	int8_t diff;
2181 	int ridx, chan, group;
2182 
2183 	/* Determine channel group. */
2184 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2185 	if (chan <= 2)
2186 		group = 0;
2187 	else if (chan <= 5)
2188 		group = 1;
2189 	else if (chan <= 8)
2190 		group = 2;
2191 	else if (chan <= 11)
2192 		group = 3;
2193 	else
2194 		group = 4;
2195 
2196 	memset(power, 0, RTWN_POWER_COUNT * sizeof(power[0]));
2197 
2198 	if (chain == 0)
2199 		txpwr = &rom->txpwr_a;
2200 	else
2201 		txpwr = &rom->txpwr_b;
2202 
2203 	/* Compute per-CCK rate Tx power. */
2204 	cckpow = txpwr->cck_tx_pwr[group];
2205 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2206 		power[ridx] = cckpow;
2207 		if (power[ridx] > R92C_MAX_TX_PWR)
2208 			power[ridx] = R92C_MAX_TX_PWR;
2209 	}
2210 
2211 	htpow = txpwr->ht40_tx_pwr[group];
2212 
2213 	/* Compute per-OFDM rate Tx power. */
2214 	diff = RTWN_SIGN4TO8(MS(txpwr->ht20_ofdm_tx_pwr_diff,
2215 	    R92E_ROM_TXPWR_OFDM_DIFF));
2216 	ofdmpow = htpow + diff;
2217 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2218 		power[ridx] = ofdmpow;
2219 		if (power[ridx] > R92C_MAX_TX_PWR)
2220 			power[ridx] = R92C_MAX_TX_PWR;
2221 	}
2222 
2223 	/* Compute per-MCS Tx power. */
2224 	if (extc == NULL) {
2225 		diff = RTWN_SIGN4TO8(MS(txpwr->ht20_ofdm_tx_pwr_diff,
2226 		    R92E_ROM_TXPWR_HT20_DIFF));
2227 		htpow += diff;
2228 		if (sc->ntxchains > 1) {
2229 			diff = RTWN_SIGN4TO8(MS(
2230 			    txpwr->pwr_diff[0].ht40_ht20_tx_pwr_diff,
2231 			    R92E_ROM_TXPWR_HT20_2S_DIFF));
2232 			htpow2s = htpow + diff;
2233 		}
2234 	}
2235 
2236 	for (ridx = RTWN_RIDX_MCS0; ridx < RTWN_RIDX_MCS15; ridx++) {
2237 		power[ridx] = (ridx < RTWN_RIDX_MCS8) ? htpow : htpow2s;
2238 		if (power[ridx] > R92C_MAX_TX_PWR)
2239 			power[ridx] = R92C_MAX_TX_PWR;
2240 	}
2241 }
2242 
2243 void
2244 rtwn_r88e_get_txpower(struct rtwn_softc *sc, int chain,
2245     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2246     uint16_t power[RTWN_POWER_COUNT])
2247 {
2248 	struct ieee80211com *ic = &sc->sc_ic;
2249 	struct r88e_rom *rom = &sc->sc_r88e_rom;
2250 	uint8_t cckpow, htpow, ofdmpow;
2251 	int8_t diff;
2252 	int ridx, chan, group;
2253 
2254 	/* Determine channel group. */
2255 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2256 	if (chan <= 2)
2257 		group = 0;
2258 	else if (chan <= 5)
2259 		group = 1;
2260 	else if (chan <= 8)
2261 		group = 2;
2262 	else if (chan <= 11)
2263 		group = 3;
2264 	else if (chan <= 13)
2265 		group = 4;
2266 	else
2267 		group = 5;
2268 
2269 	memset(power, 0, RTWN_POWER_COUNT * sizeof(power[0]));
2270 
2271 	/* Compute per-CCK rate Tx power. */
2272 	cckpow = rom->txpwr.cck_tx_pwr[group];
2273 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2274 		power[ridx] = (ridx == RTWN_RIDX_CCK2) ? cckpow - 9 : cckpow;
2275 		if (power[ridx] > R92C_MAX_TX_PWR)
2276 			power[ridx] = R92C_MAX_TX_PWR;
2277 	}
2278 
2279 	htpow = (group == 5) ? rom->txpwr.ht40_tx_pwr[group - 1] :
2280 	    rom->txpwr.ht40_tx_pwr[group];
2281 
2282 	/* Compute per-OFDM rate Tx power. */
2283 	diff = RTWN_SIGN4TO8(MS(rom->txpwr.ht20_ofdm_tx_pwr_diff,
2284 	    R88E_ROM_TXPWR_OFDM_DIFF));
2285 	ofdmpow = htpow + diff;
2286 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2287 		power[ridx] = ofdmpow;
2288 		if (power[ridx] > R92C_MAX_TX_PWR)
2289 			power[ridx] = R92C_MAX_TX_PWR;
2290 	}
2291 
2292 	/* Compute per-MCS Tx power. */
2293 	if (extc == NULL) {
2294 		diff = RTWN_SIGN4TO8(MS(rom->txpwr.ht20_ofdm_tx_pwr_diff,
2295 		    R88E_ROM_TXPWR_HT20_DIFF));
2296 		htpow += diff;
2297 	}
2298 	for (ridx = RTWN_RIDX_MCS0; ridx < RTWN_RIDX_MCS8; ridx++) {
2299 		power[ridx] = htpow;
2300 		if (power[ridx] > R92C_MAX_TX_PWR)
2301 			power[ridx] = R92C_MAX_TX_PWR;
2302 	}
2303 }
2304 
2305 void
2306 rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
2307     struct ieee80211_channel *extc)
2308 {
2309 	uint16_t power[RTWN_POWER_COUNT];
2310 	int i;
2311 
2312 	for (i = 0; i < sc->ntxchains; i++) {
2313 		/* Compute per-rate Tx power values. */
2314 		rtwn_get_txpower(sc, i, c, extc, power);
2315 		/* Write per-rate Tx power values to hardware. */
2316 		rtwn_write_txpower(sc, i, power);
2317 	}
2318 }
2319 
2320 void
2321 rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
2322     struct ieee80211_channel *extc)
2323 {
2324 	struct ieee80211com *ic = &sc->sc_ic;
2325 	u_int chan;
2326 	uint32_t reg;
2327 	int i;
2328 
2329 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2330 
2331 	/* Set Tx power for this new channel. */
2332 	rtwn_set_txpower(sc, c, extc);
2333 
2334 	if (extc != NULL) {
2335 		/* Is secondary channel below or above primary? */
2336 		int prichlo = c->ic_freq < extc->ic_freq;
2337 
2338 		if (sc->chip & RTWN_CHIP_92E) {
2339 			reg = rtwn_read_2(sc, R92C_WMAC_TRXPTCL_CTL);
2340 			reg &= ~R92C_WMAC_TRXPTCL_CTL_BW_MASK;
2341 			reg |= R92C_WMAC_TRXPTCL_CTL_BW_40;
2342 			rtwn_write_2(sc, R92C_WMAC_TRXPTCL_CTL, reg);
2343 			rtwn_write_1(sc, R92E_DATA_SC, 0);
2344 		} else {
2345 			rtwn_write_1(sc, R92C_BWOPMODE,
2346 			    rtwn_read_1(sc, R92C_BWOPMODE) &
2347 			    ~R92C_BWOPMODE_20MHZ);
2348 		}
2349 
2350 		reg = rtwn_read_1(sc, R92C_RRSR + 2);
2351 		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2352 		rtwn_write_1(sc, R92C_RRSR + 2, reg);
2353 
2354 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2355 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2356 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2357 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2358 
2359 		/* Set CCK side band. */
2360 		reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2361 		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2362 		rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2363 
2364 		reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
2365 		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2366 		rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2367 
2368 		if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
2369 			rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2370 			    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2371 			    ~R92C_FPGA0_ANAPARAM2_CBW20);
2372 		}
2373 
2374 		reg = rtwn_bb_read(sc, 0x818);
2375 		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2376 		rtwn_bb_write(sc, 0x818, reg);
2377 
2378 		/* Select 40MHz bandwidth. */
2379 		for (i = 0; i < sc->nrxchains; i++) {
2380 			rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2381 			    (sc->rf_chnlbw[i] & ~0xfff) | chan);
2382 		}
2383 	} else {
2384 		if (sc->chip & RTWN_CHIP_92E) {
2385 			reg = rtwn_read_2(sc, R92C_WMAC_TRXPTCL_CTL);
2386 			reg &= ~R92C_WMAC_TRXPTCL_CTL_BW_MASK;
2387 			rtwn_write_2(sc, R92C_WMAC_TRXPTCL_CTL, reg);
2388 			rtwn_write_1(sc, R92E_DATA_SC, 0);
2389 		} else {
2390 			rtwn_write_1(sc, R92C_BWOPMODE,
2391 			    rtwn_read_1(sc, R92C_BWOPMODE) |
2392 			    R92C_BWOPMODE_20MHZ);
2393 		}
2394 
2395 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2396 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2397 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2398 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2399 
2400 		if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
2401 			rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2402 			    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2403 			    R92C_FPGA0_ANAPARAM2_CBW20);
2404 		} else if (sc->chip & RTWN_CHIP_92E) {
2405 			reg = rtwn_read_4(sc, R92C_OFDM0_TX_PSDO_NOISE_WEIGHT);
2406 			reg &= ~0xc0000000;
2407 			rtwn_write_4(sc, R92C_OFDM0_TX_PSDO_NOISE_WEIGHT, reg);
2408 		}
2409 
2410 		/* Select 20MHz bandwidth. */
2411 		for (i = 0; i < sc->nrxchains; i++) {
2412 			rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2413 			    (sc->rf_chnlbw[i] & ~0xfff) | chan |
2414 			    ((sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) ?
2415 			    R88E_RF_CHNLBW_BW20 : R92C_RF_CHNLBW_BW20));
2416 		}
2417 	}
2418 
2419 	if (sc->chip == (RTWN_CHIP_88E | RTWN_CHIP_PCI))
2420 		DELAY(25000);
2421 }
2422 
2423 int
2424 rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
2425     uint16_t rx[2])
2426 {
2427 	uint32_t status;
2428 	int offset = chain * 0x20;
2429 	uint32_t iqk_tone_92c[] = {
2430 		0x10008c1f, 0x10008c1f, 0x82140102, 0x28160202, 0x10008c22
2431 	};
2432 	uint32_t iqk_tone_92e[] = {
2433 		0x18008c1c, 0x38008c1c, 0x82140303, 0x68160000, 0x38008c1c
2434 	};
2435 	uint32_t *iqk_tone;
2436 
2437 	if (sc->chip & RTWN_CHIP_92E)
2438 		iqk_tone = iqk_tone_92e;
2439 	else
2440 		iqk_tone = iqk_tone_92c;
2441 
2442 	if (chain == 0) {	/* IQ calibration for chain 0. */
2443 		/* IQ calibration settings for chain 0. */
2444 		rtwn_bb_write(sc, R92C_TX_IQK_TONE_A, iqk_tone[0]);
2445 		rtwn_bb_write(sc, R92C_RX_IQK_TONE_B, iqk_tone[1]);
2446 		rtwn_bb_write(sc, R92C_TX_IQK_PI_A, iqk_tone[2]);
2447 
2448 		if (sc->ntxchains > 1) {
2449 			rtwn_bb_write(sc, R92C_RX_IQK_PI_A, iqk_tone[3]);
2450 			/* IQ calibration settings for chain 1. */
2451 			rtwn_bb_write(sc, R92C_TX_IQK_TONE_B, iqk_tone[4]);
2452 			rtwn_bb_write(sc, R92C_RX_IQK_TONE_B, iqk_tone[4]);
2453 			rtwn_bb_write(sc, R92C_TX_IQK_PI_B, 0x82140102);
2454 			rtwn_bb_write(sc, R92C_RX_IQK_PI_B, 0x28160202);
2455 		} else
2456 			rtwn_bb_write(sc, R92C_RX_IQK_PI_A, 0x28160502);
2457 
2458 		/* LO calibration settings. */
2459 		if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
2460 			rtwn_bb_write(sc, R92C_IQK_AGC_RSP, 0x00462911);
2461 		else
2462 			rtwn_bb_write(sc, R92C_IQK_AGC_RSP, 0x001028d1);
2463 		/* We're doing LO and IQ calibration in one shot. */
2464 		rtwn_bb_write(sc, R92C_IQK_AGC_PTS, 0xf9000000);
2465 		rtwn_bb_write(sc, R92C_IQK_AGC_PTS, 0xf8000000);
2466 
2467 	} else {		/* IQ calibration for chain 1. */
2468 		/* We're doing LO and IQ calibration in one shot. */
2469 		rtwn_bb_write(sc, R92C_IQK_AGC_CONT, 0x00000002);
2470 		rtwn_bb_write(sc, R92C_IQK_AGC_CONT, 0x00000000);
2471 	}
2472 
2473 	/* Give LO and IQ calibrations the time to complete. */
2474 	DELAY(1000);
2475 
2476 	/* Read IQ calibration status. */
2477 	status = rtwn_bb_read(sc, 0xeac);
2478 
2479 	if (status & (1 << (28 + chain * 3)))
2480 		return (0);	/* Tx failed. */
2481 	/* Read Tx IQ calibration results. */
2482 	tx[0] = (rtwn_bb_read(sc, R92C_TX_POWER_BEFORE_IQK_A + offset) >> 16)
2483 	    & 0x3ff;
2484 	tx[1] = (rtwn_bb_read(sc, R92C_TX_POWER_AFTER_IQK_A + offset) >> 16)
2485 	    & 0x3ff;
2486 	if (tx[0] == 0x142 || tx[1] == 0x042)
2487 		return (0);	/* Tx failed. */
2488 
2489 	if (status & (1 << (27 + chain * 3)))
2490 		return (1);	/* Rx failed. */
2491 	/* Read Rx IQ calibration results. */
2492 	rx[0] = (rtwn_bb_read(sc, R92C_RX_POWER_BEFORE_IQK_A_2 + offset) >> 16)
2493 	    & 0x3ff;
2494 	rx[1] = (rtwn_bb_read(sc, R92C_RX_POWER_AFTER_IQK_A_2 + offset) >> 16)
2495 	    & 0x3ff;
2496 	if (rx[0] == 0x132 || rx[1] == 0x036)
2497 		return (1);	/* Rx failed. */
2498 
2499 	return (3);	/* Both Tx and Rx succeeded. */
2500 }
2501 
2502 void
2503 rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
2504     uint16_t rx[2][2], struct rtwn_iq_cal_regs *iq_cal_regs)
2505 {
2506 	static const uint16_t reg_adda[16] = {
2507 		0x85c, 0xe6c, 0xe70, 0xe74,
2508 		0xe78, 0xe7c, 0xe80, 0xe84,
2509 		0xe88, 0xe8c, 0xed0, 0xed4,
2510 		0xed8, 0xedc, 0xee0, 0xeec
2511 	};
2512 	static const uint32_t adda_92c[] = {
2513 		0x0b1b25a0, 0x0bdb25a0, 0x04db25a4, 0x0b1b25a4
2514 	};
2515 	static const uint32_t adda_92e[] = {
2516 		0x0fc01616, 0x0fc01616, 0x0fc01616, 0x0fc01616
2517 	};
2518 	const uint32_t *adda_vals;
2519 
2520 	int i, chain;
2521 	uint32_t hssi_param1, reg;
2522 	uint8_t xa_agc, xb_agc;
2523 
2524 	xa_agc = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0)) & 0xff;
2525 	xb_agc = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1)) & 0xff;
2526 
2527 	if (sc->chip & RTWN_CHIP_92E)
2528 		adda_vals = adda_92e;
2529 	else
2530 		adda_vals = adda_92c;
2531 
2532 	if (n == 0) {
2533 		for (i = 0; i < nitems(reg_adda); i++)
2534 			iq_cal_regs->adda[i] = rtwn_bb_read(sc, reg_adda[i]);
2535 
2536 		iq_cal_regs->txpause = rtwn_read_1(sc, R92C_TXPAUSE);
2537 		iq_cal_regs->bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
2538 		iq_cal_regs->bcn_ctrl1 = rtwn_read_1(sc, R92C_BCN_CTRL1);
2539 		iq_cal_regs->gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
2540 	}
2541 
2542 	if (sc->ntxchains == 1) {
2543 		rtwn_bb_write(sc, reg_adda[0], adda_vals[0]);
2544 		for (i = 1; i < nitems(reg_adda); i++)
2545 			rtwn_bb_write(sc, reg_adda[i], adda_vals[1]);
2546 	} else {
2547 		for (i = 0; i < nitems(reg_adda); i++)
2548 			rtwn_bb_write(sc, reg_adda[i], adda_vals[2]);
2549 	}
2550 
2551 	if (n == 0) {
2552 		iq_cal_regs->ofdm0_trxpathena =
2553 		    rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2554 		iq_cal_regs->ofdm0_trmuxpar =
2555 		    rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
2556 		iq_cal_regs->fpga0_rfifacesw0 =
2557 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(0));
2558 		iq_cal_regs->fpga0_rfifacesw1 =
2559 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
2560 		iq_cal_regs->fpga0_rfifaceoe0 =
2561 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(0));
2562 		iq_cal_regs->fpga0_rfifaceoe1 =
2563 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(1));
2564 		iq_cal_regs->config_ant_a =
2565 		    rtwn_bb_read(sc, R92C_CONFIG_ANT_A);
2566 		iq_cal_regs->config_ant_b =
2567 		    rtwn_bb_read(sc, R92C_CONFIG_ANT_B);
2568 		iq_cal_regs->cck0_afesetting =
2569 		    rtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2570 	}
2571 
2572 	if (sc->chip & RTWN_CHIP_92E) {
2573 		rtwn_write_4(sc, R92C_CCK0_AFESETTING, rtwn_read_4(sc,
2574 		    R92C_CCK0_AFESETTING) | 0x0f000000);
2575 	} else {
2576 		hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
2577 		if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2578 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2579 			    hssi_param1 | R92C_HSSI_PARAM1_PI);
2580 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2581 			    hssi_param1 | R92C_HSSI_PARAM1_PI);
2582 		}
2583 	}
2584 
2585 	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
2586 	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
2587 
2588 	if (sc->chip & RTWN_CHIP_92E) {
2589 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22208200);
2590 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(0),
2591 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(0)) | (1 << 10) |
2592 		    (1 << 26));
2593 
2594 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(0), rtwn_bb_read(sc,
2595 		    R92C_FPGA0_RFIFACEOE(0)) | (1 << 10));
2596 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(1), rtwn_bb_read(sc,
2597 		    R92C_FPGA0_RFIFACEOE(1)) | (1 << 10));
2598 	} else {
2599 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
2600 
2601 		if (sc->ntxchains > 1) {
2602 			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2603 			rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
2604 		}
2605 
2606 		rtwn_write_1(sc, R92C_TXPAUSE, R92C_TXPAUSE_AC_VO |
2607 		    R92C_TXPAUSE_AC_VI | R92C_TXPAUSE_AC_BE |
2608 		    R92C_TXPAUSE_AC_BK | R92C_TXPAUSE_MGNT |
2609 		    R92C_TXPAUSE_HIGH);
2610 	}
2611 	rtwn_write_1(sc, R92C_BCN_CTRL,
2612 	    iq_cal_regs->bcn_ctrl & ~(R92C_BCN_CTRL_EN_BCN));
2613 	rtwn_write_1(sc, R92C_BCN_CTRL1,
2614 	    iq_cal_regs->bcn_ctrl1 & ~(R92C_BCN_CTRL_EN_BCN));
2615 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2616 	    iq_cal_regs->gpio_muxcfg & ~(R92C_GPIO_MUXCFG_ENBT));
2617 
2618 	rtwn_bb_write(sc, R92C_CONFIG_ANT_A, 0x00080000);
2619 	if (sc->ntxchains > 1)
2620 		rtwn_bb_write(sc, R92C_CONFIG_ANT_B, 0x00080000);
2621 
2622 	rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x80800000);
2623 	rtwn_bb_write(sc, R92C_TX_IQK, 0x01007c00);
2624 	rtwn_bb_write(sc, R92C_RX_IQK, 0x01004800);
2625 
2626 	rtwn_bb_write(sc, R92C_CONFIG_ANT_A, 0x00080000);
2627 
2628 	for (chain = 0; chain < sc->ntxchains; chain++) {
2629 		if (chain > 0) {
2630 			/* Put chain 0 on standby. */
2631 			rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x00);
2632 			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2633 			rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x80800000);
2634 
2635 			/* Enable chain 1. */
2636 			for (i = 0; i < nitems(reg_adda); i++)
2637 				rtwn_bb_write(sc, reg_adda[i], adda_vals[3]);
2638 		}
2639 
2640 		/* Run IQ calibration twice. */
2641 		for (i = 0; i < 2; i++) {
2642 			int ret;
2643 
2644 			ret = rtwn_iq_calib_chain(sc, chain,
2645 			    tx[chain], rx[chain]);
2646 			if (ret == 0) {
2647 				DPRINTF(("%s: chain %d: Tx failed.\n",
2648 				    __func__, chain));
2649 				tx[chain][0] = 0xff;
2650 				tx[chain][1] = 0xff;
2651 				rx[chain][0] = 0xff;
2652 				rx[chain][1] = 0xff;
2653 			} else if (ret == 1) {
2654 				DPRINTF(("%s: chain %d: Rx failed.\n",
2655 				    __func__, chain));
2656 				rx[chain][0] = 0xff;
2657 				rx[chain][1] = 0xff;
2658 			} else if (ret == 3) {
2659 				DPRINTF(("%s: chain %d: Both Tx and Rx "
2660 				    "succeeded.\n", __func__, chain));
2661 			}
2662 		}
2663 
2664 		DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
2665 		    "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
2666 		    tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
2667 	}
2668 
2669 	rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x00);
2670 
2671 	if (!(sc->chip & RTWN_CHIP_92E)) {
2672 		rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
2673 		if (sc->ntxchains > 1)
2674 			rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
2675 	}
2676 
2677 	if (n != 0) {
2678 		if (!(sc->chip & RTWN_CHIP_92E)) {
2679 			if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2680 				rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2681 				    hssi_param1);
2682 				rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2683 				    hssi_param1);
2684 			}
2685 		}
2686 
2687 		for (i = 0; i < nitems(reg_adda); i++)
2688 			rtwn_bb_write(sc, reg_adda[i], iq_cal_regs->adda[i]);
2689 
2690 		rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs->txpause);
2691 		rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs->bcn_ctrl);
2692 		rtwn_write_1(sc, R92C_BCN_CTRL1, iq_cal_regs->bcn_ctrl1);
2693 		rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs->gpio_muxcfg);
2694 
2695 		rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
2696 		    iq_cal_regs->ofdm0_trxpathena);
2697 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(0),
2698 		    iq_cal_regs->fpga0_rfifacesw0);
2699 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
2700 		    iq_cal_regs->fpga0_rfifacesw1);
2701 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(0),
2702 		    iq_cal_regs->fpga0_rfifaceoe0);
2703 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(1),
2704 		    iq_cal_regs->fpga0_rfifaceoe1);
2705 		rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR,
2706 		    iq_cal_regs->ofdm0_trmuxpar);
2707 		rtwn_bb_write(sc, R92C_CONFIG_ANT_A,
2708 		    iq_cal_regs->config_ant_a);
2709 		rtwn_bb_write(sc, R92C_CONFIG_ANT_B,
2710 		    iq_cal_regs->config_ant_b);
2711 		rtwn_bb_write(sc, R92C_CCK0_AFESETTING,
2712 		    iq_cal_regs->cck0_afesetting);
2713 
2714 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
2715 		reg &= ~0xff;
2716 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg | 0x50);
2717 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg | xa_agc);
2718 
2719 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
2720 		reg &= ~0xff;
2721 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg | 0x50);
2722 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg | xb_agc);
2723 
2724 		rtwn_bb_write(sc, R92C_TX_IQK_TONE_A, 0x01008c00);
2725 		rtwn_bb_write(sc, R92C_RX_IQK_TONE_A, 0x01008c00);
2726 	}
2727 }
2728 
2729 #define RTWN_IQ_CAL_MAX_TOLERANCE 5
2730 int
2731 rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
2732     uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
2733 {
2734 	int chain, i, tx_ok[2], rx_ok[2];
2735 
2736 	tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
2737 	for (chain = 0; chain < ntxchains; chain++) {
2738 		for (i = 0; i < 2; i++)	{
2739 			if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
2740 			    rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
2741 				continue;
2742 
2743 			tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
2744 			    RTWN_IQ_CAL_MAX_TOLERANCE);
2745 
2746 			rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
2747 			    RTWN_IQ_CAL_MAX_TOLERANCE);
2748 		}
2749 	}
2750 
2751 	if (ntxchains > 1)
2752 		return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
2753 	else
2754 		return (tx_ok[0] && rx_ok[0]);
2755 }
2756 #undef RTWN_IQ_CAL_MAX_TOLERANCE
2757 
2758 void
2759 rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
2760     uint16_t rx[2], int chain)
2761 {
2762 	uint32_t reg, val, x;
2763 	long y, tx_c;
2764 
2765 	if (tx[0] == 0xff || tx[1] == 0xff)
2766 		return;
2767 
2768 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
2769 	val = ((reg >> 22) & 0x3ff);
2770 	x = tx[0];
2771 	if (x & 0x00000200)
2772 		x |= 0xfffffc00;
2773 	reg &= ~0x3ff;
2774 	reg |= (((x * val) >> 8) & 0x3ff);
2775 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
2776 
2777 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
2778 	if (((x * val) >> 7) & 0x01)
2779 		reg |= 0x80000000;
2780 	else
2781 		reg &= ~0x80000000;
2782 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
2783 
2784 	y = tx[1];
2785 	if (y & 0x00000200)
2786 		y |= 0xfffffc00;
2787 	tx_c = (y * val) >> 8;
2788 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
2789 	reg &= ~0xf0000000;
2790 	reg |= ((tx_c & 0x3c0) << 22);
2791 	rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
2792 
2793 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
2794 	reg &= ~0x003f0000;
2795 	reg |= ((tx_c & 0x3f) << 16);
2796 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
2797 
2798 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
2799 	if (((y * val) >> 7) & 0x01)
2800 		reg |= 0x20000000;
2801 	else
2802 		reg &= ~0x20000000;
2803 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
2804 
2805 	if (rx[0] == 0xff || rx[1] == 0xff)
2806 		return;
2807 
2808 	reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
2809 	reg &= ~0x3ff;
2810 	reg |= (rx[0] & 0x3ff);
2811 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
2812 
2813 	reg &= ~0xfc00;
2814 	reg |= ((rx[1] & 0x03f) << 10);
2815 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
2816 
2817 	if (chain == 0) {
2818 		reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
2819 		reg &= ~0xf0000000;
2820 		reg |= ((rx[1] & 0x3c0) << 22);
2821 		rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
2822 	} else {
2823 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
2824 		reg &= ~0xf000;
2825 		reg |= ((rx[1] & 0x3c0) << 6);
2826 		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
2827 	}
2828 }
2829 
2830 #define RTWN_IQ_CAL_NRUN	3
2831 void
2832 rtwn_iq_calib(struct rtwn_softc *sc)
2833 {
2834 	uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
2835 	int n, valid;
2836 	struct rtwn_iq_cal_regs regs;
2837 
2838 	valid = 0;
2839 	memset(&regs, 0, sizeof(regs));
2840 	for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
2841 		rtwn_iq_calib_run(sc, n, tx[n], rx[n], &regs);
2842 
2843 		if (n == 0)
2844 			continue;
2845 
2846 		/* Valid results remain stable after consecutive runs. */
2847 		valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
2848 		    tx[n], rx[n], sc->ntxchains);
2849 		if (valid)
2850 			break;
2851 	}
2852 
2853 	if (valid) {
2854 		rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
2855 		if (sc->ntxchains > 1)
2856 			rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
2857 	}
2858 }
2859 #undef RTWN_IQ_CAL_NRUN
2860 
2861 void
2862 rtwn_lc_calib(struct rtwn_softc *sc)
2863 {
2864 	uint32_t rf_ac[2];
2865 	uint8_t txmode;
2866 	int i;
2867 
2868 	txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2869 	if ((txmode & 0x70) != 0) {
2870 		/* Disable all continuous Tx. */
2871 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2872 
2873 		/* Set RF mode to standby mode. */
2874 		for (i = 0; i < sc->nrxchains; i++) {
2875 			rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
2876 			rtwn_rf_write(sc, i, R92C_RF_AC,
2877 			    RW(rf_ac[i], R92C_RF_AC_MODE,
2878 				R92C_RF_AC_MODE_STANDBY));
2879 		}
2880 	} else {
2881 		/* Block all Tx queues. */
2882 		rtwn_write_1(sc, R92C_TXPAUSE, R92C_TXPAUSE_ALL);
2883 	}
2884 	/* Start calibration. */
2885 	rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2886 	    rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2887 
2888 	/* Give calibration the time to complete. */
2889 	DELAY(100);
2890 
2891 	/* Restore configuration. */
2892 	if ((txmode & 0x70) != 0) {
2893 		/* Restore Tx mode. */
2894 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2895 		/* Restore RF mode. */
2896 		for (i = 0; i < sc->nrxchains; i++)
2897 			rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2898 	} else {
2899 		/* Unblock all Tx queues. */
2900 		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2901 	}
2902 }
2903 
2904 void
2905 rtwn_temp_calib(struct rtwn_softc *sc)
2906 {
2907 	int temp, t_meter_reg, t_meter_val;
2908 
2909 	if (sc->chip & RTWN_CHIP_92E) {
2910 		t_meter_reg = R92E_RF_T_METER;
2911 		t_meter_val = 0x37cf8;
2912 	} else {
2913 		t_meter_reg = R92C_RF_T_METER;
2914 		t_meter_val = 0x60;
2915 	}
2916 
2917 	if (sc->thcal_state == 0) {
2918 		/* Start measuring temperature. */
2919 		rtwn_rf_write(sc, 0, t_meter_reg, t_meter_val);
2920 		sc->thcal_state = 1;
2921 		return;
2922 	}
2923 	sc->thcal_state = 0;
2924 
2925 	/* Read measured temperature. */
2926 	temp = rtwn_rf_read(sc, 0, t_meter_reg) & 0x1f;
2927 	if (temp == 0)	/* Read failed, skip. */
2928 		return;
2929 	DPRINTFN(2, ("temperature=%d\n", temp));
2930 
2931 	/*
2932 	 * Redo IQ and LC calibration if temperature changed significantly
2933 	 * since last calibration.
2934 	 */
2935 	if (sc->thcal_lctemp == 0) {
2936 		/* First calibration is performed in rtwn_init(). */
2937 		sc->thcal_lctemp = temp;
2938 	} else if (abs(temp - sc->thcal_lctemp) > 1) {
2939 		DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
2940 		    sc->thcal_lctemp, temp));
2941 		rtwn_iq_calib(sc);
2942 		rtwn_lc_calib(sc);
2943 		/* Record temperature of last calibration. */
2944 		sc->thcal_lctemp = temp;
2945 	}
2946 }
2947 
2948 void
2949 rtwn_enable_intr(struct rtwn_softc *sc)
2950 {
2951 	if (sc->chip & RTWN_CHIP_92E) {
2952 		rtwn_write_4(sc, R88E_HISR, 0xffffffff);
2953 		rtwn_write_4(sc, R88E_HISRE, 0xffffffff);
2954 		rtwn_write_4(sc, R88E_HIMR, 0);
2955 		rtwn_write_4(sc, R88E_HIMRE, 0);
2956 	} else if (sc->chip & RTWN_CHIP_88E) {
2957 		rtwn_write_4(sc, R88E_HISR, 0xffffffff);
2958 		if (sc->chip & RTWN_CHIP_USB) {
2959 			rtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM |
2960 			R88E_HIMR_CPWM2 | R88E_HIMR_TBDER |
2961 			R88E_HIMR_PSTIMEOUT);
2962 			rtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
2963 			    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR |
2964 			    R88E_HIMRE_TXERR);
2965 		} else {
2966 			rtwn_write_4(sc, R88E_HIMR,
2967 			    RTWN_88E_INT_ENABLE);
2968 			rtwn_write_4(sc, R88E_HIMRE,
2969 			    R88E_HIMRE_RXFOVW);
2970 			rtwn_write_1(sc, R92C_C2HEVT_CLEAR, 0);
2971 			rtwn_write_4(sc, R92C_HSIMR,
2972 			    R88E_HSIMR_PDN_INT_EN | R88E_HSIMR_RON_INT_EN);
2973 		}
2974 
2975 		if (sc->chip & RTWN_CHIP_USB) {
2976 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2977 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2978 			    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
2979 		}
2980 	} else {
2981 		uint32_t imask = 0;
2982 
2983 		if (sc->chip & RTWN_CHIP_USB)
2984 			imask = 0xffffffff;
2985 		else if (sc->chip & RTWN_CHIP_PCI)
2986 			imask = RTWN_92C_INT_ENABLE;
2987 		else
2988 			panic("unknown chip type 0x%x", sc->chip);
2989 
2990 		/* CLear pending interrupts. */
2991 		rtwn_write_4(sc, R92C_HISR, 0xffffffff);
2992 
2993 		/* Enable interrupts. */
2994 		rtwn_write_4(sc, R92C_HIMR, imask);
2995 	}
2996 }
2997 
2998 void
2999 rtwn_disable_intr(struct rtwn_softc *sc)
3000 {
3001 	if (sc->chip & RTWN_CHIP_88E) {
3002 		rtwn_write_4(sc, R88E_HISR, 0x00000000);
3003 		rtwn_write_4(sc, R88E_HIMR, 0x00000000);
3004 		rtwn_write_4(sc, R88E_HIMRE, 0x00000000);
3005 		if (sc->chip & RTWN_CHIP_USB) {
3006 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3007 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) &
3008 			    ~R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3009 		}
3010 	} else {
3011 		rtwn_write_4(sc, R92C_HISR, 0x00000000);
3012 		rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3013 	}
3014 }
3015 
3016 int
3017 rtwn_init(struct ifnet *ifp)
3018 {
3019 	struct rtwn_softc *sc = ifp->if_softc;
3020 	struct ieee80211com *ic = &sc->sc_ic;
3021 	uint32_t reg;
3022 	int i, error;
3023 
3024 	/* Init firmware commands ring. */
3025 	sc->fwcur = 0;
3026 
3027 	error = sc->sc_ops.alloc_buffers(sc->sc_ops.cookie);
3028 	if (error)
3029 		goto fail;
3030 
3031 	/* Power on adapter. */
3032 	error = sc->sc_ops.power_on(sc->sc_ops.cookie);
3033 	if (error != 0) {
3034 		printf("%s: could not power on adapter\n",
3035 		    sc->sc_pdev->dv_xname);
3036 		goto fail;
3037 	}
3038 
3039 	/* Initialize DMA. */
3040 	error = sc->sc_ops.dma_init(sc->sc_ops.cookie);
3041 	if (error != 0) {
3042 		printf("%s: could not initialize DMA\n",
3043 		    sc->sc_pdev->dv_xname);
3044 		goto fail;
3045 	}
3046 
3047 	/* Set info size in Rx descriptors (in 64-bit words). */
3048 	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3049 
3050 	if (sc->chip & RTWN_CHIP_USB) {
3051 		/* Init interrupts. */
3052 		rtwn_enable_intr(sc);
3053 	} else if (sc->chip & RTWN_CHIP_PCI) {
3054 		rtwn_disable_intr(sc);
3055 	}
3056 
3057 	/* Set MAC address. */
3058 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
3059 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3060 		rtwn_write_1(sc, R92C_MACID + i, ic->ic_myaddr[i]);
3061 
3062 	/* Set initial network type. */
3063 	rtwn_set_nettype(sc, IEEE80211_M_MONITOR);
3064 
3065 	rtwn_rxfilter_init(sc);
3066 
3067 	reg = rtwn_read_4(sc, R92C_RRSR);
3068 	if (sc->chip & RTWN_CHIP_USB) {
3069 		reg = RW(reg, R92C_RRSR_RATE_BITMAP,
3070 		    R92C_RRSR_RATE_CCK_ONLY_1M);
3071 	} else {
3072 		reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
3073 	}
3074 	rtwn_write_4(sc, R92C_RRSR, reg);
3075 
3076 	/* Set short/long retry limits. */
3077 	if (sc->chip & RTWN_CHIP_USB) {
3078 		rtwn_write_2(sc, R92C_RL,
3079 		    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3080 	} else {
3081 		rtwn_write_2(sc, R92C_RL,
3082 		    SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
3083 	}
3084 
3085 	/* Initialize EDCA parameters. */
3086 	rtwn_edca_init(sc);
3087 
3088 	/* Set data and response automatic rate fallback retry counts. */
3089 	rtwn_rate_fallback_init(sc);
3090 
3091 	if (sc->chip & RTWN_CHIP_USB) {
3092 		rtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3093 		    rtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3094 		    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3095 	} else {
3096 		rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
3097 	}
3098 
3099 	/* Set ACK timeout. */
3100 	rtwn_write_1(sc, R92C_ACKTO, 0x40);
3101 
3102 	/* Setup USB aggregation. */
3103 	if (sc->chip & RTWN_CHIP_USB)
3104 		sc->sc_ops.aggr_init(sc->sc_ops.cookie);
3105 
3106 	/* Initialize beacon parameters. */
3107 	rtwn_write_2(sc, R92C_BCN_CTRL,
3108 	    (R92C_BCN_CTRL_DIS_TSF_UDT0 << 8) | R92C_BCN_CTRL_DIS_TSF_UDT0);
3109 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3110 	rtwn_write_1(sc, R92C_DRVERLYINT, R92C_DRVERLYINT_INIT_TIME);
3111 	rtwn_write_1(sc, R92C_BCNDMATIM, R92C_BCNDMATIM_INIT_TIME);
3112 	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3113 
3114 	if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
3115 		/* Setup AMPDU aggregation. */
3116 		rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3117 		rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3118 		rtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3119 
3120 		rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3121 	}
3122 
3123 	if (sc->chip & RTWN_CHIP_PCI) {
3124 		/* Reset H2C protection register. */
3125 		rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
3126 	}
3127 
3128 	/* Load 8051 microcode. */
3129 	error = rtwn_load_firmware(sc);
3130 	if (error != 0)
3131 		goto fail;
3132 
3133 	/* Initialize MAC/BB/RF blocks. */
3134 	sc->sc_ops.mac_init(sc->sc_ops.cookie);
3135 	sc->sc_ops.bb_init(sc->sc_ops.cookie);
3136 	rtwn_rf_init(sc);
3137 
3138 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) {
3139 		rtwn_write_2(sc, R92C_CR,
3140 		    rtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3141 		    R92C_CR_MACRXEN);
3142 	}
3143 
3144 	/* Turn CCK and OFDM blocks on. */
3145 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3146 	reg |= R92C_RFMOD_CCK_EN;
3147 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3148 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3149 	reg |= R92C_RFMOD_OFDM_EN;
3150 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3151 
3152 	/* Clear per-station keys table. */
3153 	rtwn_cam_init(sc);
3154 
3155 	/* Enable decryption / encryption. */
3156 	if (sc->chip & RTWN_CHIP_USB) {
3157 		rtwn_write_2(sc, R92C_SECCFG,
3158 		    R92C_SECCFG_TXUCKEY_DEF | R92C_SECCFG_RXUCKEY_DEF |
3159 		    R92C_SECCFG_TXENC_ENA | R92C_SECCFG_RXENC_ENA |
3160 		    R92C_SECCFG_TXBCKEY_DEF | R92C_SECCFG_RXBCKEY_DEF);
3161 	}
3162 
3163 	/* Enable hardware sequence numbering. */
3164 	rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3165 
3166 	if (sc->chip & RTWN_CHIP_92E) {
3167 		rtwn_write_1(sc, R92C_QUEUE_CTRL,
3168 		    rtwn_read_1(sc, R92C_QUEUE_CTRL) & ~0x08);
3169 	}
3170 
3171 	/* Perform LO and IQ calibrations. */
3172 	rtwn_iq_calib(sc);
3173 	/* Perform LC calibration. */
3174 	rtwn_lc_calib(sc);
3175 
3176 	/* Fix USB interference issue. */
3177 	if (sc->chip & RTWN_CHIP_USB) {
3178 		if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
3179 			rtwn_write_1(sc, 0xfe40, 0xe0);
3180 			rtwn_write_1(sc, 0xfe41, 0x8d);
3181 			rtwn_write_1(sc, 0xfe42, 0x80);
3182 
3183 			rtwn_pa_bias_init(sc);
3184 		}
3185 	}
3186 
3187 	/* Initialize GPIO setting. */
3188 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
3189 	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3190 
3191 	/* Fix for lower temperature. */
3192 	if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)))
3193 		rtwn_write_1(sc, 0x15, 0xe9);
3194 
3195 	/* Set default channel. */
3196 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
3197 	rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
3198 
3199 	if (sc->chip & RTWN_CHIP_PCI)
3200 		rtwn_enable_intr(sc);
3201 
3202 	error = sc->sc_ops.init(sc->sc_ops.cookie);
3203 	if (error)
3204 		goto fail;
3205 
3206 	/* We're ready to go. */
3207 	ifq_clr_oactive(&ifp->if_snd);
3208 	ifp->if_flags |= IFF_RUNNING;
3209 
3210 	if ((ic->ic_flags & IEEE80211_F_WEPON) &&
3211 	    (sc->chip & RTWN_CHIP_USB)) {
3212 		/* Install WEP keys. */
3213 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
3214 			ic->ic_set_key(ic, NULL, &ic->ic_nw_keys[i]);
3215 		sc->sc_ops.wait_async(sc->sc_ops.cookie);
3216 	}
3217 
3218 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3219 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3220 	else
3221 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3222 	return (0);
3223 fail:
3224 	rtwn_stop(ifp);
3225 	return (error);
3226 }
3227 
3228 void
3229 rtwn_init_task(void *arg1)
3230 {
3231 	struct rtwn_softc *sc = arg1;
3232 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3233 	int s;
3234 
3235 	s = splnet();
3236 	while (sc->sc_flags & RTWN_FLAG_BUSY)
3237 		tsleep_nsec(&sc->sc_flags, 0, "rtwnpwr", INFSLP);
3238 	sc->sc_flags |= RTWN_FLAG_BUSY;
3239 
3240 	rtwn_stop(ifp);
3241 
3242 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_UP)
3243 		rtwn_init(ifp);
3244 
3245 	sc->sc_flags &= ~RTWN_FLAG_BUSY;
3246 	wakeup(&sc->sc_flags);
3247 	splx(s);
3248 }
3249 
3250 void
3251 rtwn_stop(struct ifnet *ifp)
3252 {
3253 	struct rtwn_softc *sc = ifp->if_softc;
3254 	struct ieee80211com *ic = &sc->sc_ic;
3255 	int s;
3256 
3257 	sc->sc_tx_timer = 0;
3258 	ifp->if_timer = 0;
3259 	ifp->if_flags &= ~IFF_RUNNING;
3260 	ifq_clr_oactive(&ifp->if_snd);
3261 
3262 	s = splnet();
3263 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3264 	splx(s);
3265 
3266 	sc->sc_ops.wait_async(sc->sc_ops.cookie);
3267 
3268 	s = splnet();
3269 
3270 	sc->sc_ops.cancel_scan(sc->sc_ops.cookie);
3271 	sc->sc_ops.cancel_calib(sc->sc_ops.cookie);
3272 
3273 	task_del(systq, &sc->init_task);
3274 
3275 	splx(s);
3276 
3277 	sc->sc_ops.stop(sc->sc_ops.cookie);
3278 }
3279