xref: /openbsd-src/sys/dev/ic/rtwn.c (revision 4b70baf6e17fc8b27fc1f7fa7929335753fa94c3)
1 /*	$OpenBSD: rtwn.c,v 1.46 2019/04/25 01:52:13 kevlo Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
6  * Copyright (c) 2016 Nathanial Sloss <nathanialsloss@yahoo.com.au>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 /*
22  * Driver for Realtek 802.11b/g/n chipsets.
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/task.h>
34 #include <sys/timeout.h>
35 #include <sys/conf.h>
36 #include <sys/device.h>
37 #include <sys/endian.h>
38 
39 #include <machine/bus.h>
40 #include <machine/intr.h>
41 
42 #if NBPFILTER > 0
43 #include <net/bpf.h>
44 #endif
45 #include <net/if.h>
46 #include <net/if_dl.h>
47 #include <net/if_media.h>
48 
49 #include <netinet/in.h>
50 #include <netinet/if_ether.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_radiotap.h>
54 
55 #include <dev/ic/r92creg.h>
56 #include <dev/ic/rtwnvar.h>
57 
58 #define RTWN_RIDX_CCK1		0
59 #define RTWN_RIDX_CCK2		1
60 #define RTWN_RIDX_CCK11		3
61 #define RTWN_RIDX_OFDM6		4
62 #define RTWN_RIDX_OFDM54	11
63 #define RTWN_RIDX_MCS0		12
64 #define RTWN_RIDX_MCS8		(RTWN_RIDX_MCS0 + 8)
65 #define RTWN_RIDX_MCS15		27
66 #define RTWN_RIDX_MAX		27
67 
68 #define RTWN_POWER_CCK1		0
69 #define RTWN_POWER_CCK2		1
70 #define RTWN_POWER_CCK55	2
71 #define RTWN_POWER_CCK11	3
72 #define RTWN_POWER_OFDM6	4
73 #define RTWN_POWER_OFDM9	5
74 #define RTWN_POWER_OFDM12	6
75 #define RTWN_POWER_OFDM18	7
76 #define RTWN_POWER_OFDM24	8
77 #define RTWN_POWER_OFDM36	9
78 #define RTWN_POWER_OFDM48	10
79 #define RTWN_POWER_OFDM54	11
80 #define RTWN_POWER_MCS(mcs)	(12 + (mcs))
81 #define RTWN_POWER_COUNT	28
82 
83 
84 #ifdef RTWN_DEBUG
85 #define DPRINTF(x)	do { if (rtwn_debug) printf x; } while (0)
86 #define DPRINTFN(n, x)	do { if (rtwn_debug >= (n)) printf x; } while (0)
87 int rtwn_debug = 0;
88 #else
89 #define DPRINTF(x)
90 #define DPRINTFN(n, x)
91 #endif
92 
93 /* Registers to save and restore during IQ calibration. */
94 struct rtwn_iq_cal_regs {
95 	uint32_t	adda[16];
96 	uint8_t		txpause;
97 	uint8_t		bcn_ctrl;
98 	uint8_t		bcn_ctrl1;
99 	uint32_t	gpio_muxcfg;
100 	uint32_t	ofdm0_trxpathena;
101 	uint32_t	ofdm0_trmuxpar;
102 	uint32_t	fpga0_rfifacesw0;
103 	uint32_t	fpga0_rfifacesw1;
104 	uint32_t	fpga0_rfifaceoe0;
105 	uint32_t	fpga0_rfifaceoe1;
106 	uint32_t	config_ant_a;
107 	uint32_t	config_ant_b;
108 	uint32_t	cck0_afesetting;
109 };
110 
111 void		rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
112 void		rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
113 void		rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
114 uint8_t		rtwn_read_1(struct rtwn_softc *, uint16_t);
115 uint16_t	rtwn_read_2(struct rtwn_softc *, uint16_t);
116 uint32_t	rtwn_read_4(struct rtwn_softc *, uint16_t);
117 int		rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
118 void		rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
119 uint32_t	rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
120 void		rtwn_cam_write(struct rtwn_softc *, uint32_t, uint32_t);
121 uint8_t		rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
122 void		rtwn_efuse_read(struct rtwn_softc *, uint8_t *, size_t);
123 void		rtwn_efuse_switch_power(struct rtwn_softc *);
124 int		rtwn_read_chipid(struct rtwn_softc *);
125 void		rtwn_read_rom(struct rtwn_softc *);
126 void		rtwn_r92c_read_rom(struct rtwn_softc *);
127 void		rtwn_r92e_read_rom(struct rtwn_softc *);
128 void		rtwn_r88e_read_rom(struct rtwn_softc *);
129 void		rtwn_r23a_read_rom(struct rtwn_softc *);
130 int		rtwn_media_change(struct ifnet *);
131 int		rtwn_ra_init(struct rtwn_softc *);
132 int		rtwn_r92c_ra_init(struct rtwn_softc *, u_int8_t, u_int32_t,
133 		    int, uint32_t, int);
134 int		rtwn_r88e_ra_init(struct rtwn_softc *, u_int8_t, u_int32_t,
135 		    int, uint32_t, int);
136 void		rtwn_tsf_sync_enable(struct rtwn_softc *);
137 void		rtwn_set_led(struct rtwn_softc *, int, int);
138 void		rtwn_set_nettype(struct rtwn_softc *, enum ieee80211_opmode);
139 void		rtwn_update_short_preamble(struct ieee80211com *);
140 void		rtwn_r92c_update_short_preamble(struct rtwn_softc *);
141 void		rtwn_r88e_update_short_preamble(struct rtwn_softc *);
142 int8_t		rtwn_r88e_get_rssi(struct rtwn_softc *, int, void *);
143 void		rtwn_watchdog(struct ifnet *);
144 void		rtwn_fw_reset(struct rtwn_softc *);
145 void		rtwn_r92c_fw_reset(struct rtwn_softc *);
146 void		rtwn_r88e_fw_reset(struct rtwn_softc *);
147 int		rtwn_load_firmware(struct rtwn_softc *);
148 void		rtwn_rf_init(struct rtwn_softc *);
149 void		rtwn_cam_init(struct rtwn_softc *);
150 void		rtwn_pa_bias_init(struct rtwn_softc *);
151 void		rtwn_rxfilter_init(struct rtwn_softc *);
152 void		rtwn_edca_init(struct rtwn_softc *);
153 void		rtwn_rate_fallback_init(struct rtwn_softc *);
154 void		rtwn_write_txpower(struct rtwn_softc *, int, uint16_t[]);
155 void		rtwn_get_txpower(struct rtwn_softc *sc, int,
156 		    struct ieee80211_channel *, struct ieee80211_channel *,
157 		    uint16_t[]);
158 void		rtwn_r92c_get_txpower(struct rtwn_softc *, int,
159 		    struct ieee80211_channel *, struct ieee80211_channel *,
160 		    uint16_t[]);
161 void		rtwn_r92e_get_txpower(struct rtwn_softc *, int,
162 		    struct ieee80211_channel *,
163 		    struct ieee80211_channel *, uint16_t[]);
164 void		rtwn_r88e_get_txpower(struct rtwn_softc *, int,
165 		    struct ieee80211_channel *,
166 		    struct ieee80211_channel *, uint16_t[]);
167 void		rtwn_set_txpower(struct rtwn_softc *,
168 		    struct ieee80211_channel *, struct ieee80211_channel *);
169 void		rtwn_set_chan(struct rtwn_softc *,
170 		    struct ieee80211_channel *, struct ieee80211_channel *);
171 int		rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
172 		    uint16_t[2]);
173 void		rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
174     		    uint16_t rx[2][2], struct rtwn_iq_cal_regs *);
175 int		rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
176 		    uint16_t[2][2], uint16_t[2][2], int);
177 void		rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
178 		    uint16_t[2], int);
179 void		rtwn_iq_calib(struct rtwn_softc *);
180 void		rtwn_lc_calib(struct rtwn_softc *);
181 void		rtwn_temp_calib(struct rtwn_softc *);
182 void		rtwn_enable_intr(struct rtwn_softc *);
183 void		rtwn_disable_intr(struct rtwn_softc *);
184 int		rtwn_init(struct ifnet *);
185 void		rtwn_init_task(void *);
186 void		rtwn_stop(struct ifnet *);
187 
188 /* Aliases. */
189 #define	rtwn_bb_write	rtwn_write_4
190 #define rtwn_bb_read	rtwn_read_4
191 
192 /*
193  * Macro to convert 4-bit signed integer to 8-bit signed integer.
194  */
195 #define RTWN_SIGN4TO8(val)	(((val) & 0x08) ? (val) | 0xf0 : (val))
196 
197 int
198 rtwn_attach(struct device *pdev, struct rtwn_softc *sc)
199 {
200 	struct ieee80211com *ic = &sc->sc_ic;
201 	struct ifnet *ifp = &ic->ic_if;
202 	int i, error;
203 
204 	sc->sc_pdev = pdev;
205 
206 	task_set(&sc->init_task, rtwn_init_task, sc);
207 
208 	error = rtwn_read_chipid(sc);
209 	if (error != 0) {
210 		printf("%s: unsupported chip\n", sc->sc_pdev->dv_xname);
211 		return (ENXIO);
212 	}
213 
214 	/* Determine number of Tx/Rx chains. */
215 	if (sc->chip & RTWN_CHIP_92C) {
216 		sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
217 		sc->nrxchains = 2;
218 	} else if (sc->chip & RTWN_CHIP_92E) {
219 		sc->ntxchains = 2;
220 		sc->nrxchains = 2;
221 	} else {
222 		sc->ntxchains = 1;
223 		sc->nrxchains = 1;
224 	}
225 
226 	rtwn_read_rom(sc);
227 
228 	if (sc->chip & RTWN_CHIP_PCI) {
229 		printf("%s: MAC/BB RTL%s, RF 6052 %dT%dR, address %s\n",
230 		    sc->sc_pdev->dv_xname,
231 		    (sc->chip & RTWN_CHIP_92C) ? "8192CE" :
232 		    (sc->chip & RTWN_CHIP_88E) ? "8188EE" :
233 		    (sc->chip & RTWN_CHIP_92E) ? "8192EE" :
234 		    (sc->chip & RTWN_CHIP_23A) ? "8723AE" :
235 		    (sc->chip & RTWN_CHIP_23B) ? "8723BE" : "8188CE",
236 		    sc->ntxchains, sc->nrxchains,
237 		    ether_sprintf(ic->ic_myaddr));
238 	} else if (sc->chip & RTWN_CHIP_USB) {
239 		printf("%s: MAC/BB RTL%s, RF 6052 %dT%dR, address %s\n",
240 		    sc->sc_pdev->dv_xname,
241 		    (sc->chip & RTWN_CHIP_92C) ? "8192CU" :
242 		    (sc->chip & RTWN_CHIP_92E) ? "8192EU" :
243 		    (sc->chip & RTWN_CHIP_88E) ? "8188EU" :
244 		    (sc->board_type == R92C_BOARD_TYPE_HIGHPA) ? "8188RU" :
245 		    (sc->board_type == R92C_BOARD_TYPE_MINICARD) ?
246 		    "8188CE-VAU" : "8188CUS",
247 		    sc->ntxchains, sc->nrxchains,
248 		    ether_sprintf(ic->ic_myaddr));
249 	} else {
250 		printf("%s: unsupported chip\n", sc->sc_pdev->dv_xname);
251 		return (ENXIO);
252 	}
253 
254 	ic->ic_phytype = IEEE80211_T_OFDM;	/* Not only, but not used. */
255 	ic->ic_opmode = IEEE80211_M_STA;	/* Default to BSS mode. */
256 	ic->ic_state = IEEE80211_S_INIT;
257 
258 	/* Set device capabilities. */
259 	ic->ic_caps =
260 	    IEEE80211_C_MONITOR |	/* Monitor mode supported. */
261 	    IEEE80211_C_SHPREAMBLE |	/* Short preamble supported. */
262 	    IEEE80211_C_SHSLOT |	/* Short slot time supported. */
263 	    IEEE80211_C_WEP |		/* WEP. */
264 	    IEEE80211_C_RSN;		/* WPA/RSN. */
265 
266 	/* Set HT capabilities. */
267 	ic->ic_htcaps =
268 	    IEEE80211_HTCAP_CBW20_40 |
269 	    IEEE80211_HTCAP_DSSSCCK40;
270 	/* Set supported HT rates. */
271 	for (i = 0; i < sc->nrxchains; i++)
272 		ic->ic_sup_mcs[i] = 0xff;
273 
274 	/* Set supported .11b and .11g rates. */
275 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
276 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
277 
278 	/* Set supported .11b and .11g channels (1 through 14). */
279 	for (i = 1; i <= 14; i++) {
280 		ic->ic_channels[i].ic_freq =
281 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
282 		ic->ic_channels[i].ic_flags =
283 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
284 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
285 	}
286 
287 #ifdef notyet
288 	/*
289 	 * The number of STAs that we can support is limited by the number
290 	 * of CAM entries used for hardware crypto.
291 	 */
292 	ic->ic_max_nnodes = R92C_CAM_ENTRY_COUNT - 4;
293 	if (ic->ic_max_nnodes > IEEE80211_CACHE_SIZE)
294 		ic->ic_max_nnodes = IEEE80211_CACHE_SIZE;
295 #endif
296 
297 	ifp->if_softc = sc;
298 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
299 	ifp->if_ioctl = rtwn_ioctl;
300 	ifp->if_start = rtwn_start;
301 	ifp->if_watchdog = rtwn_watchdog;
302 	memcpy(ifp->if_xname, sc->sc_pdev->dv_xname, IFNAMSIZ);
303 
304 	if_attach(ifp);
305 	ieee80211_ifattach(ifp);
306 	ic->ic_updateslot = rtwn_updateslot;
307 	ic->ic_updateedca = rtwn_updateedca;
308 #ifdef notyet
309 	ic->ic_set_key = rtwn_set_key;
310 	ic->ic_delete_key = rtwn_delete_key;
311 #endif
312 	/* Override state transition machine. */
313 	sc->sc_newstate = ic->ic_newstate;
314 	ic->ic_newstate = rtwn_newstate;
315 	ieee80211_media_init(ifp, rtwn_media_change, ieee80211_media_status);
316 
317 	return (0);
318 }
319 
320 int
321 rtwn_detach(struct rtwn_softc *sc, int flags)
322 {
323 	struct ifnet *ifp = &sc->sc_ic.ic_if;
324 	int s;
325 
326 	s = splnet();
327 
328 	task_del(systq, &sc->init_task);
329 
330 	if (ifp->if_softc != NULL) {
331 		ieee80211_ifdetach(ifp);
332 		if_detach(ifp);
333 	}
334 
335 	splx(s);
336 
337 	return (0);
338 }
339 
340 int
341 rtwn_activate(struct rtwn_softc *sc, int act)
342 {
343 	struct ifnet *ifp = &sc->sc_ic.ic_if;
344 
345 	switch (act) {
346 	case DVACT_QUIESCE: /* rtwn_stop() may sleep */
347 		if (ifp->if_flags & IFF_RUNNING)
348 			rtwn_stop(ifp);
349 		break;
350 	case DVACT_WAKEUP:
351 		rtwn_init_task(sc);
352 		break;
353 	}
354 	return (0);
355 }
356 
357 void
358 rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
359 {
360 	sc->sc_ops.write_1(sc->sc_ops.cookie, addr, val);
361 }
362 
363 void
364 rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
365 {
366 	sc->sc_ops.write_2(sc->sc_ops.cookie, addr, val);
367 }
368 
369 void
370 rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
371 {
372 	sc->sc_ops.write_4(sc->sc_ops.cookie, addr, val);
373 }
374 
375 uint8_t
376 rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
377 {
378 	return sc->sc_ops.read_1(sc->sc_ops.cookie, addr);
379 }
380 
381 uint16_t
382 rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
383 {
384 	return sc->sc_ops.read_2(sc->sc_ops.cookie, addr);
385 }
386 
387 uint32_t
388 rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
389 {
390 	return sc->sc_ops.read_4(sc->sc_ops.cookie, addr);
391 }
392 
393 int
394 rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
395 {
396 	struct r92c_fw_cmd cmd;
397 	int ntries;
398 
399 	/* Wait for current FW box to be empty. */
400 	for (ntries = 0; ntries < 100; ntries++) {
401 		if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
402 			break;
403 		DELAY(10);
404 	}
405 	if (ntries == 100) {
406 		printf("%s: could not send firmware command %d\n",
407 		    sc->sc_pdev->dv_xname, id);
408 		return (ETIMEDOUT);
409 	}
410 	memset(&cmd, 0, sizeof(cmd));
411 	cmd.id = id;
412 	if (len > 3)
413 		cmd.id |= R92C_CMD_FLAG_EXT;
414 	KASSERT(len <= sizeof(cmd.msg));
415 	memcpy(cmd.msg, buf, len);
416 
417 	/* Write the first word last since that will trigger the FW. */
418 	if (sc->chip & RTWN_CHIP_92E)
419 		rtwn_write_2(sc, R88E_HMEBOX_EXT(sc->fwcur),
420 		    *((uint8_t *)&cmd + 4));
421 	else
422 		rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur),
423 		    *((uint8_t *)&cmd + 4));
424 	rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
425 
426 	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
427 
428 	if (sc->chip & RTWN_CHIP_PCI) {
429 		/* Give firmware some time for processing. */
430 		DELAY(2000);
431 	}
432 
433 	return (0);
434 }
435 
436 void
437 rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
438 {
439 	uint32_t param_addr;
440 
441 	if (sc->chip & RTWN_CHIP_92E) {
442 		rtwn_write_4(sc, R92C_FPGA0_POWER_SAVE,
443 		    rtwn_read_4(sc, R92C_FPGA0_POWER_SAVE) & ~0x20000);
444 	}
445 
446 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
447 		param_addr = SM(R88E_LSSI_PARAM_ADDR, addr);
448 	else
449 		param_addr = SM(R92C_LSSI_PARAM_ADDR, addr);
450 
451 	rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
452 	    param_addr | SM(R92C_LSSI_PARAM_DATA, val));
453 
454 	DELAY(1);
455 
456 	if (sc->chip & RTWN_CHIP_92E) {
457 		rtwn_write_4(sc, R92C_FPGA0_POWER_SAVE,
458 		    rtwn_read_4(sc, R92C_FPGA0_POWER_SAVE) | 0x20000);
459 	}
460 }
461 
462 uint32_t
463 rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
464 {
465 	uint32_t reg[R92C_MAX_CHAINS], val;
466 
467 	reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
468 	if (chain != 0)
469 		reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
470 
471 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
472 	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
473 	DELAY(1000);
474 
475 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
476 	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
477 	    R92C_HSSI_PARAM2_READ_EDGE);
478 	DELAY(1000);
479 
480 	if (!(sc->chip & RTWN_CHIP_88E)) {
481 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
482 		    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
483 		DELAY(1000);
484 	}
485 
486 	if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
487 		val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
488 	else
489 		val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
490 	return (MS(val, R92C_LSSI_READBACK_DATA));
491 }
492 
493 void
494 rtwn_cam_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
495 {
496 	rtwn_write_4(sc, R92C_CAMWRITE, data);
497 	rtwn_write_4(sc, R92C_CAMCMD,
498 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_WRITE |
499 	    SM(R92C_CAMCMD_ADDR, addr));
500 }
501 
502 uint8_t
503 rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
504 {
505 	uint32_t reg;
506 	int ntries;
507 
508 	reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
509 	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
510 	reg &= ~R92C_EFUSE_CTRL_VALID;
511 	rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
512 	/* Wait for read operation to complete. */
513 	for (ntries = 0; ntries < 100; ntries++) {
514 		reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
515 		if (reg & R92C_EFUSE_CTRL_VALID)
516 			return (MS(reg, R92C_EFUSE_CTRL_DATA));
517 		DELAY(5);
518 	}
519 	printf("%s: could not read efuse byte at address 0x%x\n",
520 	    sc->sc_pdev->dv_xname, addr);
521 	return (0xff);
522 }
523 
524 void
525 rtwn_efuse_read(struct rtwn_softc *sc, uint8_t *rom, size_t size)
526 {
527 	uint8_t off, msk, tmp;
528 	uint16_t addr = 0;
529 	uint32_t reg;
530 	int i, len;
531 
532 	rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_ON);
533 	rtwn_efuse_switch_power(sc);
534 
535 	memset(rom, 0xff, size);
536 	len = (sc->chip & RTWN_CHIP_88E) ? 256 : 512;
537 	while (addr < len) {
538 		reg = rtwn_efuse_read_1(sc, addr);
539 		if (reg == 0xff)
540 			break;
541 		addr++;
542 
543 		/* Check for extended header. */
544 		if ((sc->sc_flags & RTWN_FLAG_EXT_HDR) &&
545 		    (reg & 0x1f) == 0x0f) {
546 			tmp = (reg & 0xe0) >> 5;
547 			reg = rtwn_efuse_read_1(sc, addr);
548 			addr++;
549 			if ((reg & 0x0f) != 0x0f)
550 				off = ((reg & 0xf0) >> 1) | tmp;
551 			else
552 				continue;
553 		} else
554 			off = reg >> 4;
555 		msk = reg & 0xf;
556 		for (i = 0; i < 4; i++) {
557 			if (msk & (1 << i))
558 				continue;
559 			rom[off * 8 + i * 2 + 0] = rtwn_efuse_read_1(sc, addr);
560 			addr++;
561 			rom[off * 8 + i * 2 + 1] = rtwn_efuse_read_1(sc, addr);
562 			addr++;
563 		}
564 	}
565 #ifdef RTWN_DEBUG
566 	if (rtwn_debug >= 2) {
567 		/* Dump ROM content. */
568 		printf("\n");
569 		for (i = 0; i < size; i++)
570 			printf("%02x:", rom[i]);
571 		printf("\n");
572 	}
573 #endif
574 	rtwn_write_1(sc, R92C_EFUSE_ACCESS, R92C_EFUSE_ACCESS_OFF);
575 }
576 
577 void
578 rtwn_efuse_switch_power(struct rtwn_softc *sc)
579 {
580 	uint16_t reg;
581 
582 	if (!(sc->chip & RTWN_CHIP_92E)) {
583 		reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
584 		if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
585 			rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
586 			    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
587 		}
588 	}
589 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
590 	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
591 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
592 		    reg | R92C_SYS_FUNC_EN_ELDR);
593 	}
594 	reg = rtwn_read_2(sc, R92C_SYS_CLKR);
595 	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
596 	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
597 		rtwn_write_2(sc, R92C_SYS_CLKR,
598 		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
599 	}
600 }
601 
602 int
603 rtwn_read_chipid(struct rtwn_softc *sc)
604 {
605 	uint32_t reg;
606 
607 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) {
608 		sc->sc_flags |= RTWN_FLAG_EXT_HDR;
609 		return (0);
610 	}
611 
612 	reg = rtwn_read_4(sc, R92C_SYS_CFG);
613 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
614 		/* Unsupported test chip. */
615 		return (EIO);
616 
617 	if ((sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C)) != 0) {
618 		if (reg & R92C_SYS_CFG_TYPE_92C) {
619 			sc->chip &= ~RTWN_CHIP_88C;
620 			/* Check if it is a castrated 8192C. */
621 			if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
622 			    R92C_HPON_FSM_CHIP_BONDING_ID) ==
623 			    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
624 				sc->chip |= RTWN_CHIP_92C_1T2R;
625 		} else
626 			sc->chip &= ~RTWN_CHIP_92C;
627 
628 		if (reg & R92C_SYS_CFG_VENDOR_UMC) {
629 			sc->chip |= RTWN_CHIP_UMC;
630 			if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
631 				sc->chip |= RTWN_CHIP_UMC_A_CUT;
632 		}
633 
634 		return (0);
635 	} else if (sc->chip & RTWN_CHIP_23A) {
636 		sc->sc_flags |= RTWN_FLAG_EXT_HDR;
637 
638 		if ((reg & 0xf000) == 0)
639 			sc->chip |= RTWN_CHIP_UMC_A_CUT;
640 		return (0);
641 	}
642 
643 	return (ENXIO); /* unsupported chip */
644 }
645 
646 void
647 rtwn_read_rom(struct rtwn_softc *sc)
648 {
649 	if (sc->chip & RTWN_CHIP_88E)
650 		rtwn_r88e_read_rom(sc);
651 	else if (sc->chip & RTWN_CHIP_92E)
652 		rtwn_r92e_read_rom(sc);
653 	else if (sc->chip & RTWN_CHIP_23A)
654 		rtwn_r23a_read_rom(sc);
655 	else
656 		rtwn_r92c_read_rom(sc);
657 }
658 
659 void
660 rtwn_r92c_read_rom(struct rtwn_softc *sc)
661 {
662 	struct ieee80211com *ic = &sc->sc_ic;
663 	struct r92c_rom *rom = &sc->sc_r92c_rom;
664 
665 	/* Read full ROM image. */
666 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r92c_rom,
667 	    sizeof(sc->sc_r92c_rom));
668 
669 	/* XXX Weird but this is what the vendor driver does. */
670 	sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
671 	DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
672 
673 	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
674 	DPRINTF(("board type=%d\n", sc->board_type));
675 
676 	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
677 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
678 
679 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
680 }
681 
682 void
683 rtwn_r92e_read_rom(struct rtwn_softc *sc)
684 {
685 	struct ieee80211com *ic = &sc->sc_ic;
686 	struct r92e_rom *rom = &sc->sc_r92e_rom;
687 
688 	/* Read full ROM image. */
689 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r92e_rom,
690 	    sizeof(sc->sc_r92e_rom));
691 
692 	sc->crystal_cap = rom->xtal_k;
693 	DPRINTF(("crystal cap=0x%x\n", sc->crystal_cap));
694 
695 	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
696 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
697 
698 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
699 }
700 
701 void
702 rtwn_r88e_read_rom(struct rtwn_softc *sc)
703 {
704 	struct ieee80211com *ic = &sc->sc_ic;
705 	struct r88e_rom *rom = &sc->sc_r88e_rom;
706 
707 	/* Read full ROM image. */
708 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r88e_rom,
709 	    sizeof(sc->sc_r88e_rom));
710 
711 	sc->crystal_cap = (sc->chip & RTWN_CHIP_PCI) ? 0x20 : rom->xtal;
712 	DPRINTF(("Crystal cap=0x%x\n", sc->crystal_cap));
713 
714 	sc->regulatory = MS(rom->rf_board_opt, R92C_ROM_RF1_REGULATORY);
715 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
716 
717 	if (sc->chip & RTWN_CHIP_PCI)
718 		IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->r88ee_rom.macaddr);
719 	else
720 		IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->r88eu_rom.macaddr);
721 }
722 
723 void
724 rtwn_r23a_read_rom(struct rtwn_softc *sc)
725 {
726 	struct ieee80211com *ic = &sc->sc_ic;
727 	struct r23a_rom *rom = &sc->sc_r23a_rom;
728 
729 	/* Read full ROM image. */
730 	rtwn_efuse_read(sc, (uint8_t *)&sc->sc_r23a_rom,
731 	    sizeof(sc->sc_r23a_rom));
732 
733 	IEEE80211_ADDR_COPY(ic->ic_myaddr, rom->macaddr);
734 }
735 
736 int
737 rtwn_media_change(struct ifnet *ifp)
738 {
739 	int error;
740 
741 	error = ieee80211_media_change(ifp);
742 	if (error != ENETRESET)
743 		return (error);
744 
745 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
746 	    (IFF_UP | IFF_RUNNING)) {
747 		rtwn_stop(ifp);
748 		error = rtwn_init(ifp);
749 	}
750 	return (error);
751 }
752 
753 /*
754  * Initialize rate adaptation.
755  */
756 int
757 rtwn_ra_init(struct rtwn_softc *sc)
758 {
759 	static const uint8_t map[] =
760 	    { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 };
761 	struct ieee80211com *ic = &sc->sc_ic;
762 	struct ieee80211_node *ni = ic->ic_bss;
763 	struct ieee80211_rateset *rs = &ni->ni_rates;
764 	uint32_t rates, basicrates;
765 	uint8_t mode;
766 	int maxrate, maxbasicrate, i, j;
767 	int error = 0;
768 
769 	/* Get normal and basic rates mask. */
770 	rates = basicrates = 0;
771 	maxrate = maxbasicrate = 0;
772 	for (i = 0; i < rs->rs_nrates; i++) {
773 		/* Convert 802.11 rate to HW rate index. */
774 		for (j = 0; j < nitems(map); j++)
775 			if ((rs->rs_rates[i] & IEEE80211_RATE_VAL) == map[j])
776 				break;
777 		if (j == nitems(map))	/* Unknown rate, skip. */
778 			continue;
779 		rates |= 1 << j;
780 		if (j > maxrate)
781 			maxrate = j;
782 		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
783 			basicrates |= 1 << j;
784 			if (j > maxbasicrate)
785 				maxbasicrate = j;
786 		}
787 	}
788 	if (ic->ic_curmode == IEEE80211_MODE_11B)
789 		mode = R92C_RAID_11B;
790 	else
791 		mode = R92C_RAID_11BG;
792 	DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
793 	    mode, rates, basicrates));
794 
795 	if (sc->chip & RTWN_CHIP_PCI) {
796 		/* Configure Automatic Rate Fallback Register. */
797 		if (ic->ic_curmode == IEEE80211_MODE_11B) {
798 			if (rates & 0x0c)
799 				rtwn_write_4(sc, R92C_ARFR(0), rates & 0x05);
800 			else
801 				rtwn_write_4(sc, R92C_ARFR(0), rates & 0x07);
802 		} else
803 			rtwn_write_4(sc, R92C_ARFR(0), rates & 0x07f5);
804 	}
805 
806 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) {
807 		error = rtwn_r88e_ra_init(sc, mode, rates, maxrate,
808 		    basicrates, maxbasicrate);
809 		/* We use AMRR with this chip. Start with the lowest rate. */
810 		ni->ni_txrate = 0;
811 	} else {
812 		if (sc->chip & RTWN_CHIP_PCI) {
813 			ni->ni_txrate = 0; /* AMRR will raise. */
814 			/* Set initial MRR rates. */
815 			rtwn_write_1(sc,
816 			    R92C_INIDATA_RATE_SEL(R92C_MACID_BC), maxbasicrate);
817 			rtwn_write_1(sc,
818 			    R92C_INIDATA_RATE_SEL(R92C_MACID_BSS), 0);
819 		} else {
820 			error = rtwn_r92c_ra_init(sc, mode, rates, maxrate,
821 			    basicrates, maxbasicrate);
822 			/* No AMRR support. Indicate highest supported rate. */
823 			ni->ni_txrate = rs->rs_nrates - 1;
824 		}
825 	}
826 	return (error);
827 }
828 
829 /*
830  * Initialize rate adaptation in firmware.
831  */
832 int rtwn_r92c_ra_init(struct rtwn_softc *sc, u_int8_t mode, u_int32_t rates,
833     int maxrate, uint32_t basicrates, int maxbasicrate)
834 {
835 	struct r92c_fw_cmd_macid_cfg cmd;
836 	int error;
837 
838 	/* Set rates mask for group addressed frames. */
839 	cmd.macid = R92C_MACID_BC | R92C_MACID_VALID;
840 	cmd.mask = htole32(mode << 28 | basicrates);
841 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
842 	if (error != 0) {
843 		printf("%s: could not add broadcast station\n",
844 		    sc->sc_pdev->dv_xname);
845 		return (error);
846 	}
847 	/* Set initial MRR rate. */
848 	DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
849 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(R92C_MACID_BC),
850 	    maxbasicrate);
851 
852 	/* Set rates mask for unicast frames. */
853 	cmd.macid = R92C_MACID_BSS | R92C_MACID_VALID;
854 	cmd.mask = htole32(mode << 28 | rates);
855 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
856 	if (error != 0) {
857 		printf("%s: could not add BSS station\n",
858 		    sc->sc_pdev->dv_xname);
859 		return (error);
860 	}
861 	/* Set initial MRR rate. */
862 	DPRINTF(("maxrate=%d\n", maxrate));
863 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(R92C_MACID_BSS),
864 	    maxrate);
865 
866 	return (0);
867 }
868 
869 int
870 rtwn_r88e_ra_init(struct rtwn_softc *sc, u_int8_t mode, u_int32_t rates,
871     int maxrate, uint32_t basicrates, int maxbasicrate)
872 {
873 	u_int32_t reg;
874 
875 	rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, maxbasicrate);
876 
877 	reg = rtwn_read_4(sc, R92C_RRSR);
878 	reg = RW(reg, R92C_RRSR_RATE_BITMAP, rates);
879 	rtwn_write_4(sc, R92C_RRSR, reg);
880 
881 	/*
882 	 * Workaround for performance problems with firmware rate adaptation:
883 	 * If the AP only supports 11b rates, disable mixed B/G mode.
884 	 */
885 	if (mode != R92C_RAID_11B && maxrate <= 3 /* 11M */)
886 		sc->sc_flags |= RTWN_FLAG_FORCE_RAID_11B;
887 
888 	return (0);
889 }
890 
891 void
892 rtwn_tsf_sync_enable(struct rtwn_softc *sc)
893 {
894 	struct ieee80211_node *ni = sc->sc_ic.ic_bss;
895 	uint64_t tsf;
896 
897 	/* Enable TSF synchronization. */
898 	rtwn_write_1(sc, R92C_BCN_CTRL,
899 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
900 
901 	rtwn_write_1(sc, R92C_BCN_CTRL,
902 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
903 
904 	/* Set initial TSF. */
905 	memcpy(&tsf, ni->ni_tstamp, sizeof(tsf));
906 	tsf = letoh64(tsf);
907 	tsf = tsf - (tsf % (ni->ni_intval * IEEE80211_DUR_TU));
908 	tsf -= IEEE80211_DUR_TU;
909 	rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
910 	rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
911 
912 	rtwn_write_1(sc, R92C_BCN_CTRL,
913 	    rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
914 }
915 
916 void
917 rtwn_set_led(struct rtwn_softc *sc, int led, int on)
918 {
919 	uint8_t reg;
920 
921 	if (led != RTWN_LED_LINK)
922 		return; /* not supported */
923 
924 	if (sc->chip & RTWN_CHIP_PCI) {
925 		reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
926 		if (!on)
927 			reg |= R92C_LEDCFG2_DIS;
928 		else
929 			reg |= R92C_LEDCFG2_EN;
930 		rtwn_write_1(sc, R92C_LEDCFG2, reg);
931 	} else if (sc->chip & RTWN_CHIP_USB) {
932 		if (sc->chip & RTWN_CHIP_92E) {
933 			rtwn_write_1(sc, 0x64, rtwn_read_1(sc, 0x64) & 0xfe);
934 			reg = rtwn_read_1(sc, R92C_LEDCFG1) & R92E_LEDSON;
935 			rtwn_write_1(sc, R92C_LEDCFG1, reg |
936 			    (R92C_LEDCFG0_DIS << 1));
937 			if (on) {
938 				reg = rtwn_read_1(sc, R92C_LEDCFG1) &
939 				    R92E_LEDSON;
940 				rtwn_write_1(sc, R92C_LEDCFG1, reg);
941 			}
942 		} else if (sc->chip & RTWN_CHIP_88E) {
943 			reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
944 			rtwn_write_1(sc, R92C_LEDCFG2, reg | R92C_LEDCFG2_EN);
945 			if (!on) {
946 				reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0x90;
947 				rtwn_write_1(sc, R92C_LEDCFG2,
948 				    reg | R92C_LEDCFG0_DIS);
949 				rtwn_write_1(sc, R92C_MAC_PINMUX_CFG,
950 				    rtwn_read_1(sc, R92C_MAC_PINMUX_CFG) &
951 				    0xfe);
952 			}
953 		} else {
954 			reg = rtwn_read_1(sc, R92C_LEDCFG0) & 0x70;
955 			if (!on)
956 				reg |= R92C_LEDCFG0_DIS;
957 			rtwn_write_1(sc, R92C_LEDCFG0, reg);
958 		}
959 	}
960 	sc->ledlink = on;	/* Save LED state. */
961 }
962 
963 void
964 rtwn_set_nettype(struct rtwn_softc *sc, enum ieee80211_opmode opmode)
965 {
966 	uint8_t msr;
967 
968 	msr = rtwn_read_1(sc, R92C_MSR) & ~R92C_MSR_NETTYPE_MASK;
969 
970 	switch (opmode) {
971 	case IEEE80211_M_MONITOR:
972 		msr |= R92C_MSR_NETTYPE_NOLINK;
973 		break;
974 	case IEEE80211_M_STA:
975 		msr |= R92C_MSR_NETTYPE_INFRA;
976 		break;
977 	default:
978 		break;
979 	}
980 
981 	rtwn_write_1(sc, R92C_MSR, msr);
982 }
983 
984 void
985 rtwn_calib(struct rtwn_softc *sc)
986 {
987 
988 	if (sc->avg_pwdb != -1) {
989 		DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
990 
991 		/* Indicate Rx signal strength to FW for rate adaptation. */
992 		if (sc->chip & RTWN_CHIP_92E) {
993 			struct r92e_fw_cmd_rssi cmd;
994 
995 			memset(&cmd, 0, sizeof(cmd));
996 			cmd.macid = 0;	/* BSS. */
997 			cmd.pwdb = sc->avg_pwdb;
998 			rtwn_fw_cmd(sc, R92E_CMD_RSSI_REPORT, &cmd,
999 			    sizeof(cmd));
1000 		} else {
1001 			struct r92c_fw_cmd_rssi cmd;
1002 
1003 			memset(&cmd, 0, sizeof(cmd));
1004 			cmd.macid = 0;	/* BSS. */
1005 			cmd.pwdb = sc->avg_pwdb;
1006 			rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd,
1007 			    sizeof(cmd));
1008 		}
1009 	}
1010 
1011 	/* Do temperature compensation. */
1012 	rtwn_temp_calib(sc);
1013 
1014 	sc->sc_ops.next_calib(sc->sc_ops.cookie);
1015 }
1016 
1017 void
1018 rtwn_next_scan(struct rtwn_softc *sc)
1019 {
1020 	struct ieee80211com *ic = &sc->sc_ic;
1021 	int s;
1022 
1023 	s = splnet();
1024 	if (ic->ic_state == IEEE80211_S_SCAN)
1025 		ieee80211_next_scan(&ic->ic_if);
1026 	splx(s);
1027 }
1028 
1029 int
1030 rtwn_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1031 {
1032 	struct rtwn_softc *sc = ic->ic_softc;
1033 	struct ieee80211_node *ni;
1034 	enum ieee80211_state ostate;
1035 	uint32_t reg;
1036 	int s, error;
1037 
1038 	s = splnet();
1039 	ostate = ic->ic_state;
1040 
1041 	if (nstate != ostate)
1042 		DPRINTF(("newstate %s -> %s\n",
1043 		    ieee80211_state_name[ostate],
1044 		    ieee80211_state_name[nstate]));
1045 
1046 	if (ostate == IEEE80211_S_RUN) {
1047 		/* Stop calibration. */
1048 		sc->sc_ops.cancel_calib(sc->sc_ops.cookie);
1049 
1050 		/* Turn link LED off. */
1051 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1052 
1053 		/* Set media status to 'No Link'. */
1054 		rtwn_set_nettype(sc, IEEE80211_M_MONITOR);
1055 
1056 		/* Stop Rx of data frames. */
1057 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1058 
1059 		/* Rest TSF. */
1060 		rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1061 
1062 		/* Disable TSF synchronization. */
1063 		rtwn_write_1(sc, R92C_BCN_CTRL,
1064 		    rtwn_read_1(sc, R92C_BCN_CTRL) |
1065 		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1066 
1067 		/* Reset EDCA parameters. */
1068 		rtwn_edca_init(sc);
1069 
1070 		rtwn_updateslot(ic);
1071 		rtwn_update_short_preamble(ic);
1072 
1073 		/* Disable 11b-only AP workaround (see rtwn_r88e_ra_init). */
1074 		sc->sc_flags &= ~RTWN_FLAG_FORCE_RAID_11B;
1075 	}
1076 	switch (nstate) {
1077 	case IEEE80211_S_INIT:
1078 		/* Turn link LED off. */
1079 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1080 		break;
1081 	case IEEE80211_S_SCAN:
1082 		if (ostate != IEEE80211_S_SCAN) {
1083 			/* Allow Rx from any BSSID. */
1084 			rtwn_write_4(sc, R92C_RCR,
1085 			    rtwn_read_4(sc, R92C_RCR) &
1086 			    ~(R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN));
1087 
1088 			/* Set gain for scanning. */
1089 			reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1090 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1091 			rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1092 
1093 			if (!(sc->chip & RTWN_CHIP_88E)) {
1094 				reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1095 				reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x20);
1096 				rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1097 			}
1098 		}
1099 
1100 		/* Make link LED blink during scan. */
1101 		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1102 
1103 		/* Pause AC Tx queues. */
1104 		rtwn_write_1(sc, R92C_TXPAUSE,
1105 		    rtwn_read_1(sc, R92C_TXPAUSE) | R92C_TXPAUSE_AC_VO |
1106 		    R92C_TXPAUSE_AC_VI | R92C_TXPAUSE_AC_BE |
1107 		    R92C_TXPAUSE_AC_BK);
1108 
1109 		rtwn_set_chan(sc, ic->ic_bss->ni_chan, NULL);
1110 		sc->sc_ops.next_scan(sc->sc_ops.cookie);
1111 		break;
1112 
1113 	case IEEE80211_S_AUTH:
1114 		/* Set initial gain under link. */
1115 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
1116 		reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1117 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
1118 
1119 		if (!(sc->chip & RTWN_CHIP_88E)) {
1120 			reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
1121 			reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, 0x32);
1122 			rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
1123 		}
1124 
1125 		rtwn_set_chan(sc, ic->ic_bss->ni_chan, NULL);
1126 		break;
1127 	case IEEE80211_S_ASSOC:
1128 		break;
1129 	case IEEE80211_S_RUN:
1130 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1131 			rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
1132 
1133 			/* Enable Rx of data frames. */
1134 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1135 
1136 			/* Enable Rx of control frames. */
1137 			rtwn_write_2(sc, R92C_RXFLTMAP1, 0xffff);
1138 
1139 			rtwn_write_4(sc, R92C_RCR,
1140 			    rtwn_read_4(sc, R92C_RCR) |
1141 			    R92C_RCR_AAP | R92C_RCR_ADF | R92C_RCR_ACF |
1142 			    R92C_RCR_AMF);
1143 
1144 			/* Turn link LED on. */
1145 			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1146 			break;
1147 		}
1148 		ni = ic->ic_bss;
1149 
1150 		/* Set media status to 'Associated'. */
1151 		rtwn_set_nettype(sc, IEEE80211_M_STA);
1152 
1153 		/* Set BSSID. */
1154 		rtwn_write_4(sc, R92C_BSSID + 0, LE_READ_4(&ni->ni_bssid[0]));
1155 		rtwn_write_4(sc, R92C_BSSID + 4, LE_READ_2(&ni->ni_bssid[4]));
1156 
1157 		if (ic->ic_curmode == IEEE80211_MODE_11B)
1158 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1159 		else	/* 802.11b/g */
1160 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1161 
1162 		rtwn_updateslot(ic);
1163 		rtwn_update_short_preamble(ic);
1164 
1165 		/* Enable Rx of data frames. */
1166 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1167 
1168 		/* Flush all AC queues. */
1169 		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
1170 
1171 		/* Set beacon interval. */
1172 		rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1173 
1174 		/* Allow Rx from our BSSID only. */
1175 		rtwn_write_4(sc, R92C_RCR,
1176 		    rtwn_read_4(sc, R92C_RCR) |
1177 		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1178 
1179 		/* Enable TSF synchronization. */
1180 		rtwn_tsf_sync_enable(sc);
1181 
1182 		/* Intialize rate adaptation. */
1183 		rtwn_ra_init(sc);
1184 
1185 		/* Turn link LED on. */
1186 		rtwn_set_led(sc, RTWN_LED_LINK, 1);
1187 
1188 		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1189 		/* Reset temperature calibration state machine. */
1190 		sc->thcal_state = 0;
1191 		sc->thcal_lctemp = 0;
1192 		/* Start periodic calibration. */
1193 		sc->sc_ops.next_calib(sc->sc_ops.cookie);
1194 		break;
1195 	}
1196 
1197 	error = sc->sc_newstate(ic, nstate, arg);
1198 	splx(s);
1199 
1200 	return (error);
1201 }
1202 
1203 void
1204 rtwn_update_short_preamble(struct ieee80211com *ic)
1205 {
1206 	struct rtwn_softc *sc = ic->ic_softc;
1207 
1208 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
1209 		rtwn_r88e_update_short_preamble(sc);
1210 	else
1211 		rtwn_r92c_update_short_preamble(sc);
1212 }
1213 
1214 void
1215 rtwn_r92c_update_short_preamble(struct rtwn_softc *sc)
1216 {
1217 	uint32_t reg;
1218 
1219 	reg = rtwn_read_4(sc, R92C_RRSR);
1220 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1221 		reg |= R92C_RRSR_SHORT;
1222 	else
1223 		reg &= ~R92C_RRSR_SHORT;
1224 	rtwn_write_4(sc, R92C_RRSR, reg);
1225 }
1226 
1227 void
1228 rtwn_r88e_update_short_preamble(struct rtwn_softc *sc)
1229 {
1230 	uint32_t reg;
1231 
1232 	reg = rtwn_read_4(sc, R92C_WMAC_TRXPTCL_CTL);
1233 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1234 		reg |= R92C_WMAC_TRXPTCL_CTL_SHORT;
1235 	else
1236 		reg &= ~R92C_WMAC_TRXPTCL_CTL_SHORT;
1237 	rtwn_write_4(sc, R92C_WMAC_TRXPTCL_CTL, reg);
1238 }
1239 
1240 void
1241 rtwn_updateslot(struct ieee80211com *ic)
1242 {
1243 	struct rtwn_softc *sc = ic->ic_softc;
1244 	int s;
1245 
1246 	s = splnet();
1247 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1248 		rtwn_write_1(sc, R92C_SLOT, IEEE80211_DUR_DS_SHSLOT);
1249 	else
1250 		rtwn_write_1(sc, R92C_SLOT, IEEE80211_DUR_DS_SLOT);
1251 	splx(s);
1252 }
1253 
1254 void
1255 rtwn_updateedca(struct ieee80211com *ic)
1256 {
1257 	struct rtwn_softc *sc = ic->ic_softc;
1258 	const uint16_t aci2reg[EDCA_NUM_AC] = {
1259 		R92C_EDCA_BE_PARAM,
1260 		R92C_EDCA_BK_PARAM,
1261 		R92C_EDCA_VI_PARAM,
1262 		R92C_EDCA_VO_PARAM
1263 	};
1264 	struct ieee80211_edca_ac_params *ac;
1265 	int s, aci, aifs, slottime;
1266 	uint8_t acm = 0;
1267 
1268 	if (ic->ic_flags & IEEE80211_F_SHSLOT)
1269 		slottime = IEEE80211_DUR_DS_SHSLOT;
1270 	else
1271 		slottime = IEEE80211_DUR_DS_SLOT;
1272 	s = splnet();
1273 	for (aci = 0; aci < EDCA_NUM_AC; aci++) {
1274 		ac = &ic->ic_edca_ac[aci];
1275 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1276 		aifs = ac->ac_aifsn * slottime + IEEE80211_DUR_DS_SIFS;
1277 		rtwn_write_4(sc, aci2reg[aci],
1278 		    SM(R92C_EDCA_PARAM_TXOP, ac->ac_txoplimit) |
1279 		    SM(R92C_EDCA_PARAM_ECWMIN, ac->ac_ecwmin) |
1280 		    SM(R92C_EDCA_PARAM_ECWMAX, ac->ac_ecwmax) |
1281 		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1282 
1283 		/* Is admission control mandatory for this queue? */
1284 		if (ac->ac_acm) {
1285 			switch (aci) {
1286 			case EDCA_AC_BE:
1287 				acm |= R92C_ACMHW_BEQEN;
1288 				break;
1289 			case EDCA_AC_VI:
1290 				acm |= R92C_ACMHW_VIQEN;
1291 				break;
1292 			case EDCA_AC_VO:
1293 				acm |= R92C_ACMHW_VOQEN;
1294 				break;
1295 			default:
1296 				break;
1297 			}
1298 		}
1299 	}
1300 	splx(s);
1301 
1302 	/* Enable hardware admission control. */
1303 	rtwn_write_1(sc, R92C_ACMHWCTRL, R92C_ACMHW_HWEN | acm);
1304 }
1305 
1306 int
1307 rtwn_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1308     struct ieee80211_key *k)
1309 {
1310 	struct rtwn_softc *sc = ic->ic_softc;
1311 	static const uint8_t etherzeroaddr[6] = { 0 };
1312 	const uint8_t *macaddr;
1313 	uint8_t keybuf[16], algo;
1314 	int i, entry;
1315 
1316 	/* Defer setting of WEP keys until interface is brought up. */
1317 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
1318 	    (IFF_UP | IFF_RUNNING))
1319 		return (0);
1320 
1321 	/* Map net80211 cipher to HW crypto algorithm. */
1322 	switch (k->k_cipher) {
1323 	case IEEE80211_CIPHER_WEP40:
1324 		algo = R92C_CAM_ALGO_WEP40;
1325 		break;
1326 	case IEEE80211_CIPHER_WEP104:
1327 		algo = R92C_CAM_ALGO_WEP104;
1328 		break;
1329 	case IEEE80211_CIPHER_TKIP:
1330 		algo = R92C_CAM_ALGO_TKIP;
1331 		break;
1332 	case IEEE80211_CIPHER_CCMP:
1333 		algo = R92C_CAM_ALGO_AES;
1334 		break;
1335 	default:
1336 		/* Fallback to software crypto for other ciphers. */
1337 		return (ieee80211_set_key(ic, ni, k));
1338 	}
1339 	if (k->k_flags & IEEE80211_KEY_GROUP) {
1340 		macaddr = etherzeroaddr;
1341 		entry = k->k_id;
1342 	} else {
1343 		macaddr = ic->ic_bss->ni_macaddr;
1344 		entry = 4;
1345 	}
1346 	/* Write key. */
1347 	memset(keybuf, 0, sizeof(keybuf));
1348 	memcpy(keybuf, k->k_key, MIN(k->k_len, sizeof(keybuf)));
1349 	for (i = 0; i < 4; i++) {
1350 		rtwn_cam_write(sc, R92C_CAM_KEY(entry, i),
1351 		    LE_READ_4(&keybuf[i * 4]));
1352 	}
1353 	/* Write CTL0 last since that will validate the CAM entry. */
1354 	rtwn_cam_write(sc, R92C_CAM_CTL1(entry),
1355 	    LE_READ_4(&macaddr[2]));
1356 	rtwn_cam_write(sc, R92C_CAM_CTL0(entry),
1357 	    SM(R92C_CAM_ALGO, algo) |
1358 	    SM(R92C_CAM_KEYID, k->k_id) |
1359 	    SM(R92C_CAM_MACLO, LE_READ_2(&macaddr[0])) |
1360 	    R92C_CAM_VALID);
1361 
1362 	return (0);
1363 }
1364 
1365 void
1366 rtwn_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
1367     struct ieee80211_key *k)
1368 {
1369 	struct rtwn_softc *sc = ic->ic_softc;
1370 	int i, entry;
1371 
1372 	if (!(ic->ic_if.if_flags & IFF_RUNNING) ||
1373 	    ic->ic_state != IEEE80211_S_RUN)
1374 		return;	/* Nothing to do. */
1375 
1376 	if (k->k_flags & IEEE80211_KEY_GROUP)
1377 		entry = k->k_id;
1378 	else
1379 		entry = 4;
1380 	rtwn_cam_write(sc, R92C_CAM_CTL0(entry), 0);
1381 	rtwn_cam_write(sc, R92C_CAM_CTL1(entry), 0);
1382 	/* Clear key. */
1383 	for (i = 0; i < 4; i++)
1384 		rtwn_cam_write(sc, R92C_CAM_KEY(entry, i), 0);
1385 }
1386 
1387 void
1388 rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
1389 {
1390 	int pwdb;
1391 
1392 	/* Convert antenna signal to percentage. */
1393 	if (rssi <= -100 || rssi >= 20)
1394 		pwdb = 0;
1395 	else if (rssi >= 0)
1396 		pwdb = 100;
1397 	else
1398 		pwdb = 100 + rssi;
1399 	if (sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C)) {
1400 		if (rate <= 3) {
1401 			/* CCK gain is smaller than OFDM/MCS gain. */
1402 			pwdb += 6;
1403 			if (pwdb > 100)
1404 				pwdb = 100;
1405 			if (pwdb <= 14)
1406 				pwdb -= 4;
1407 			else if (pwdb <= 26)
1408 				pwdb -= 8;
1409 			else if (pwdb <= 34)
1410 				pwdb -= 6;
1411 			else if (pwdb <= 42)
1412 				pwdb -= 2;
1413 		}
1414 	}
1415 	if (sc->avg_pwdb == -1)	/* Init. */
1416 		sc->avg_pwdb = pwdb;
1417 	else if (sc->avg_pwdb < pwdb)
1418 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1419 	else
1420 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1421 	DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
1422 }
1423 
1424 int8_t
1425 rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1426 {
1427 	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1428 	struct r92c_rx_phystat *phy;
1429 	struct r92c_rx_cck *cck;
1430 	uint8_t rpt;
1431 	int8_t rssi;
1432 
1433 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
1434 		return rtwn_r88e_get_rssi(sc, rate, physt);
1435 
1436 	if (rate <= 3) {
1437 		cck = (struct r92c_rx_cck *)physt;
1438 		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1439 			rpt = (cck->agc_rpt >> 5) & 0x3;
1440 			rssi = (cck->agc_rpt & 0x1f) << 1;
1441 		} else {
1442 			rpt = (cck->agc_rpt >> 6) & 0x3;
1443 			rssi = cck->agc_rpt & 0x3e;
1444 		}
1445 		rssi = cckoff[rpt] - rssi;
1446 	} else {	/* OFDM/HT. */
1447 		phy = (struct r92c_rx_phystat *)physt;
1448 		rssi = ((letoh32(phy->phydw1) >> 1) & 0x7f) - 110;
1449 	}
1450 	return (rssi);
1451 }
1452 
1453 int8_t
1454 rtwn_r88e_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1455 {
1456 	static const int8_t cckoff[] = { 20, 14, 10, -4, -16, -22, -38, -40 };
1457 	struct r88e_rx_phystat *phy;
1458 	uint8_t rpt;
1459 	int8_t rssi;
1460 
1461 	phy = (struct r88e_rx_phystat *)physt;
1462 
1463 	if (rate <= 3) {
1464 		rpt = (phy->agc_rpt >> 5) & 0x7;
1465 		rssi = (phy->agc_rpt & 0x1f) << 1;
1466 		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1467 			if (rpt == 2)
1468 				rssi -= 6;
1469 		}
1470 		rssi = (phy->agc_rpt & 0x1f) > 27 ? -94 : cckoff[rpt] - rssi;
1471 	} else {	/* OFDM/HT. */
1472 		rssi = ((le32toh(phy->sq_rpt) >> 1) & 0x7f) - 110;
1473 	}
1474 	return (rssi);
1475 }
1476 
1477 void
1478 rtwn_start(struct ifnet *ifp)
1479 {
1480 	struct rtwn_softc *sc = ifp->if_softc;
1481 	struct ieee80211com *ic = &sc->sc_ic;
1482 	struct ieee80211_node *ni;
1483 	struct mbuf *m;
1484 
1485 	if (!(ifp->if_flags & IFF_RUNNING) || ifq_is_oactive(&ifp->if_snd))
1486 		return;
1487 
1488 	for (;;) {
1489 		if (sc->sc_ops.is_oactive(sc->sc_ops.cookie)) {
1490 			ifq_set_oactive(&ifp->if_snd);
1491 			break;
1492 		}
1493 		/* Send pending management frames first. */
1494 		m = mq_dequeue(&ic->ic_mgtq);
1495 		if (m != NULL) {
1496 			ni = m->m_pkthdr.ph_cookie;
1497 			goto sendit;
1498 		}
1499 		if (ic->ic_state != IEEE80211_S_RUN)
1500 			break;
1501 
1502 		/* Encapsulate and send data frames. */
1503 		IFQ_DEQUEUE(&ifp->if_snd, m);
1504 		if (m == NULL)
1505 			break;
1506 #if NBPFILTER > 0
1507 		if (ifp->if_bpf != NULL)
1508 			bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT);
1509 #endif
1510 		if ((m = ieee80211_encap(ifp, m, &ni)) == NULL)
1511 			continue;
1512 sendit:
1513 #if NBPFILTER > 0
1514 		if (ic->ic_rawbpf != NULL)
1515 			bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT);
1516 #endif
1517 		if (sc->sc_ops.tx(sc->sc_ops.cookie, m, ni) != 0) {
1518 			ieee80211_release_node(ic, ni);
1519 			ifp->if_oerrors++;
1520 			continue;
1521 		}
1522 
1523 		sc->sc_tx_timer = 5;
1524 		ifp->if_timer = 1;
1525 	}
1526 }
1527 
1528 void
1529 rtwn_watchdog(struct ifnet *ifp)
1530 {
1531 	struct rtwn_softc *sc = ifp->if_softc;
1532 
1533 	ifp->if_timer = 0;
1534 
1535 	if (sc->sc_tx_timer > 0) {
1536 		if (--sc->sc_tx_timer == 0) {
1537 			printf("%s: device timeout\n", sc->sc_pdev->dv_xname);
1538 			task_add(systq, &sc->init_task);
1539 			ifp->if_oerrors++;
1540 			return;
1541 		}
1542 		ifp->if_timer = 1;
1543 	}
1544 	ieee80211_watchdog(ifp);
1545 }
1546 
1547 int
1548 rtwn_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1549 {
1550 	struct rtwn_softc *sc = ifp->if_softc;
1551 	struct ieee80211com *ic = &sc->sc_ic;
1552 	int s, error = 0;
1553 
1554 	s = splnet();
1555 	/*
1556 	 * Prevent processes from entering this function while another
1557 	 * process is tsleep'ing in it.
1558 	 */
1559 	while ((sc->sc_flags & RTWN_FLAG_BUSY) && error == 0)
1560 		error = tsleep(&sc->sc_flags, PCATCH, "rtwnioc", 0);
1561 	if (error != 0) {
1562 		splx(s);
1563 		return error;
1564 	}
1565 	sc->sc_flags |= RTWN_FLAG_BUSY;
1566 
1567 	switch (cmd) {
1568 	case SIOCSIFADDR:
1569 		ifp->if_flags |= IFF_UP;
1570 		/* FALLTHROUGH */
1571 	case SIOCSIFFLAGS:
1572 		if (ifp->if_flags & IFF_UP) {
1573 			if (!(ifp->if_flags & IFF_RUNNING))
1574 				rtwn_init(ifp);
1575 		} else {
1576 			if (ifp->if_flags & IFF_RUNNING)
1577 				rtwn_stop(ifp);
1578 		}
1579 		break;
1580 	case SIOCS80211CHANNEL:
1581 		error = ieee80211_ioctl(ifp, cmd, data);
1582 		if (error == ENETRESET &&
1583 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
1584 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1585 			    (IFF_UP | IFF_RUNNING))
1586 				rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
1587 			error = 0;
1588 		}
1589 		break;
1590 	default:
1591 		error = ieee80211_ioctl(ifp, cmd, data);
1592 	}
1593 
1594 	if (error == ENETRESET) {
1595 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1596 		    (IFF_UP | IFF_RUNNING)) {
1597 			rtwn_stop(ifp);
1598 			rtwn_init(ifp);
1599 		}
1600 		error = 0;
1601 	}
1602 	sc->sc_flags &= ~RTWN_FLAG_BUSY;
1603 	wakeup(&sc->sc_flags);
1604 	splx(s);
1605 
1606 	return (error);
1607 }
1608 
1609 void
1610 rtwn_fw_reset(struct rtwn_softc *sc)
1611 {
1612 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
1613 		rtwn_r88e_fw_reset(sc);
1614 	else
1615 		rtwn_r92c_fw_reset(sc);
1616 }
1617 
1618 void
1619 rtwn_r92c_fw_reset(struct rtwn_softc *sc)
1620 {
1621 	uint16_t reg;
1622 	int ntries;
1623 
1624 	/* Tell 8051 to reset itself. */
1625 	rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
1626 
1627 	/* Wait until 8051 resets by itself. */
1628 	for (ntries = 0; ntries < 100; ntries++) {
1629 		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1630 		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
1631 			goto sleep;
1632 		DELAY(50);
1633 	}
1634 	/* Force 8051 reset. */
1635 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1636 sleep:
1637 	if (sc->chip & RTWN_CHIP_PCI) {
1638 		/*
1639 		 * We must sleep for one second to let the firmware settle.
1640 		 * Accessing registers too early will hang the whole system.
1641 		 */
1642 		tsleep(&reg, 0, "rtwnrst", hz);
1643 	}
1644 }
1645 
1646 void
1647 rtwn_r88e_fw_reset(struct rtwn_softc *sc)
1648 {
1649 	uint16_t reg;
1650 
1651 	/* Reset MCU IO wrapper. */
1652 	rtwn_write_1(sc, R92C_RSV_CTRL,
1653 	    rtwn_read_1(sc, R92C_RSV_CTRL) & ~R92C_RSV_CTRL_WLOCK_00);
1654 	if (sc->chip & RTWN_CHIP_88E) {
1655 		rtwn_write_2(sc, R92C_RSV_CTRL,
1656 		    rtwn_read_2(sc, R92C_RSV_CTRL) & ~R88E_RSV_CTRL_MCU_RST);
1657 	} else {
1658 		rtwn_write_2(sc, R92C_RSV_CTRL,
1659 		    rtwn_read_2(sc, R92C_RSV_CTRL) & ~R88E_RSV_CTRL_MIO_EN);
1660 	}
1661 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1662 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
1663 
1664 	/* Enable MCU IO wrapper. */
1665 	rtwn_write_1(sc, R92C_RSV_CTRL,
1666 	    rtwn_read_1(sc, R92C_RSV_CTRL) & ~R92C_RSV_CTRL_WLOCK_00);
1667 	if (sc->chip & RTWN_CHIP_88E) {
1668 		rtwn_write_2(sc, R92C_RSV_CTRL,
1669 		    rtwn_read_2(sc, R92C_RSV_CTRL) | R88E_RSV_CTRL_MCU_RST);
1670 	} else {
1671 		rtwn_write_2(sc, R92C_RSV_CTRL,
1672 		    rtwn_read_2(sc, R92C_RSV_CTRL) | R88E_RSV_CTRL_MIO_EN);
1673 	}
1674 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg | R92C_SYS_FUNC_EN_CPUEN);
1675 }
1676 
1677 int
1678 rtwn_load_firmware(struct rtwn_softc *sc)
1679 {
1680 	const struct r92c_fw_hdr *hdr;
1681 	u_char *fw, *ptr;
1682 	size_t len0, len;
1683 	uint32_t reg;
1684 	int mlen, ntries, page, error;
1685 
1686 	/* Read firmware image from the filesystem. */
1687 	error = sc->sc_ops.load_firmware(sc->sc_ops.cookie, &fw, &len0);
1688 	if (error)
1689 		return (error);
1690 	len = len0;
1691 	if (len < sizeof(*hdr)) {
1692 		printf("%s: firmware too short\n", sc->sc_pdev->dv_xname);
1693 		error = EINVAL;
1694 		goto fail;
1695 	}
1696 	ptr = fw;
1697 	hdr = (const struct r92c_fw_hdr *)ptr;
1698 	/* Check if there is a valid FW header and skip it. */
1699 	if ((letoh16(hdr->signature) >> 4) == 0x230 ||
1700 	    (letoh16(hdr->signature) >> 4) == 0x88c ||
1701 	    (letoh16(hdr->signature) >> 4) == 0x88e ||
1702 	    (letoh16(hdr->signature) >> 4) == 0x92c ||
1703 	    (letoh16(hdr->signature) >> 4) == 0x92e) {
1704 		DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
1705 		    letoh16(hdr->version), letoh16(hdr->subversion),
1706 		    hdr->month, hdr->date, hdr->hour, hdr->minute));
1707 		ptr += sizeof(*hdr);
1708 		len -= sizeof(*hdr);
1709 	}
1710 
1711 	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL) {
1712 		rtwn_write_1(sc, R92C_MCUFWDL, 0);
1713 		rtwn_fw_reset(sc);
1714 	}
1715 
1716 	if (sc->chip & RTWN_CHIP_PCI) {
1717 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1718 		    rtwn_read_2(sc, R92C_SYS_FUNC_EN) | R92C_SYS_FUNC_EN_CPUEN);
1719 	}
1720 
1721 	/* Enable FW download. */
1722 	rtwn_write_1(sc, R92C_MCUFWDL,
1723 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
1724 	rtwn_write_4(sc, R92C_MCUFWDL,
1725 	    rtwn_read_4(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_ROM_DLEN);
1726 
1727 	/* Reset the FWDL checksum. */
1728 	rtwn_write_1(sc, R92C_MCUFWDL,
1729 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
1730 
1731 	DELAY(50);
1732 	for (page = 0; len > 0; page++) {
1733 		mlen = MIN(len, R92C_FW_PAGE_SIZE);
1734 		error = sc->sc_ops.fw_loadpage(sc->sc_ops.cookie, page, ptr,
1735 		    mlen);
1736 		if (error != 0) {
1737 			printf("%s: could not load firmware page %d\n",
1738 			    sc->sc_pdev->dv_xname, page);
1739 			goto fail;
1740 		}
1741 		ptr += mlen;
1742 		len -= mlen;
1743 	}
1744 
1745 	/* Wait for checksum report. */
1746 	for (ntries = 0; ntries < 1000; ntries++) {
1747 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
1748 			break;
1749 		DELAY(5);
1750 	}
1751 	if (ntries == 1000) {
1752 		printf("%s: timeout waiting for checksum report\n",
1753 		    sc->sc_pdev->dv_xname);
1754 		error = ETIMEDOUT;
1755 		goto fail;
1756 	}
1757 
1758 	/* Disable FW download. */
1759 	rtwn_write_1(sc, R92C_MCUFWDL,
1760 	    rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
1761 	rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
1762 
1763 	reg = rtwn_read_4(sc, R92C_MCUFWDL);
1764 	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
1765 	rtwn_write_4(sc, R92C_MCUFWDL, reg);
1766 	if (sc->chip & (RTWN_CHIP_92C | RTWN_CHIP_88C | RTWN_CHIP_23A)) {
1767 		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
1768 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1769 		    reg & ~R92C_SYS_FUNC_EN_CPUEN);
1770 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
1771 		    reg | R92C_SYS_FUNC_EN_CPUEN);
1772 	} else
1773 		rtwn_fw_reset(sc);
1774 	/* Wait for firmware readiness. */
1775 	for (ntries = 0; ntries < 1000; ntries++) {
1776 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
1777 			break;
1778 		DELAY(10);
1779 	}
1780 	if (ntries == 1000) {
1781 		printf("%s: timeout waiting for firmware readiness\n",
1782 		    sc->sc_pdev->dv_xname);
1783 		error = ETIMEDOUT;
1784 		goto fail;
1785 	}
1786 fail:
1787 	free(fw, M_DEVBUF, len0);
1788 	return (error);
1789 }
1790 
1791 void
1792 rtwn_rf_init(struct rtwn_softc *sc)
1793 {
1794 	const struct r92c_rf_prog *prog;
1795 	uint32_t reg, type;
1796 	int i, j, idx, off;
1797 
1798 	/* Select RF programming based on board type. */
1799 	if (sc->chip & RTWN_CHIP_88E)
1800 		prog = rtl8188eu_rf_prog;
1801 	else if (sc->chip & RTWN_CHIP_92E)
1802 		prog = rtl8192e_rf_prog;
1803 	else if (!(sc->chip & RTWN_CHIP_92C)) {
1804 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
1805 			prog = rtl8188ce_rf_prog;
1806 		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
1807 			prog = rtl8188ru_rf_prog;
1808 		else
1809 			prog = rtl8188cu_rf_prog;
1810 	} else
1811 		prog = rtl8192ce_rf_prog;
1812 
1813 	for (i = 0; i < sc->nrxchains; i++) {
1814 		/* Save RF_ENV control type. */
1815 		idx = i / 2;
1816 		off = (i % 2) * 16;
1817 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
1818 		type = (reg >> off) & 0x10;
1819 
1820 		/* Set RF_ENV enable. */
1821 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
1822 		reg |= 0x100000;
1823 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
1824 		DELAY(50);
1825 		/* Set RF_ENV output high. */
1826 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
1827 		reg |= 0x10;
1828 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
1829 		DELAY(50);
1830 		/* Set address and data lengths of RF registers. */
1831 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
1832 		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
1833 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
1834 		DELAY(50);
1835 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
1836 		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
1837 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
1838 		DELAY(50);
1839 
1840 		/* Write RF initialization values for this chain. */
1841 		for (j = 0; j < prog[i].count; j++) {
1842 			switch (prog[i].regs[j]) {
1843 			case 0xfe:
1844 				DELAY(50000);
1845 				continue;
1846 			case 0xfd:
1847 				DELAY(5000);
1848 				continue;
1849 			case 0xfc:
1850 				DELAY(1000);
1851 				continue;
1852 			case 0xfb:
1853 				DELAY(50);
1854 				continue;
1855 			case 0xfa:
1856 				DELAY(5);
1857 				continue;
1858 			case 0xf9:
1859 				DELAY(1);
1860 				continue;
1861 			}
1862 			rtwn_rf_write(sc, i, prog[i].regs[j],
1863 			    prog[i].vals[j]);
1864 			DELAY(5);
1865 		}
1866 
1867 		/* Restore RF_ENV control type. */
1868 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
1869 		reg &= ~(0x10 << off) | (type << off);
1870 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
1871 
1872 		/* Cache RF register CHNLBW. */
1873 		sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
1874 	}
1875 
1876 	/* magic value for HP 8188EEs */
1877 	if (sc->chip == (RTWN_CHIP_88E | RTWN_CHIP_PCI)) {
1878 		struct r88e_rom *rom = &sc->sc_r88e_rom;
1879 		if (rom->r88ee_rom.svid == 0x103c &&
1880 		    rom->r88ee_rom.smid == 0x197d)
1881 			rtwn_rf_write(sc, 0, 0x52, 0x7e4bd);
1882 	}
1883 
1884 	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
1885 	    RTWN_CHIP_UMC_A_CUT) {
1886 		rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
1887 		rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
1888 	} else if (sc->chip & RTWN_CHIP_23A) {
1889 		rtwn_rf_write(sc, 0, 0x0C, 0x894ae);
1890 		rtwn_rf_write(sc, 0, 0x0A, 0x1af31);
1891 		rtwn_rf_write(sc, 0, R92C_RF_IPA, 0x8f425);
1892 		rtwn_rf_write(sc, 0, R92C_RF_SYN_G(1), 0x4f200);
1893 		rtwn_rf_write(sc, 0, R92C_RF_RCK1, 0x44053);
1894 		rtwn_rf_write(sc, 0, R92C_RF_RCK2, 0x80201);
1895 	}
1896 }
1897 
1898 void
1899 rtwn_cam_init(struct rtwn_softc *sc)
1900 {
1901 	/* Invalidate all CAM entries. */
1902 	rtwn_write_4(sc, R92C_CAMCMD,
1903 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
1904 }
1905 
1906 void
1907 rtwn_pa_bias_init(struct rtwn_softc *sc)
1908 {
1909 	uint8_t reg;
1910 	int i;
1911 
1912 	for (i = 0; i < sc->nrxchains; i++) {
1913 		if (sc->pa_setting & (1 << i))
1914 			continue;
1915 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
1916 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
1917 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
1918 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
1919 	}
1920 	if (!(sc->pa_setting & 0x10)) {
1921 		reg = rtwn_read_1(sc, 0x16);
1922 		reg = (reg & ~0xf0) | 0x90;
1923 		rtwn_write_1(sc, 0x16, reg);
1924 	}
1925 }
1926 
1927 void
1928 rtwn_rxfilter_init(struct rtwn_softc *sc)
1929 {
1930 	/* Initialize Rx filter. */
1931 	rtwn_write_4(sc, R92C_RCR,
1932 	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
1933 	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
1934 	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
1935 	/* Accept all multicast frames. */
1936 	rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
1937 	rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
1938 	/* Accept all management frames. */
1939 	rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
1940 	/* Reject all control frames. */
1941 	rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
1942 	/* Accept all data frames. */
1943 	rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1944 }
1945 
1946 void
1947 rtwn_edca_init(struct rtwn_softc *sc)
1948 {
1949 	struct ieee80211com *ic = &sc->sc_ic;
1950 	int mode, aci;
1951 
1952 	/* Set SIFS; 0x10 = 16 usec (SIFS 11g), 0x0a = 10 usec (SIFS 11b) */
1953 	rtwn_write_2(sc, R92C_SPEC_SIFS, 0x100a);
1954 	rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x100a);
1955 	rtwn_write_2(sc, R92C_SIFS_CCK, 0x100a);
1956 	rtwn_write_2(sc, R92C_SIFS_OFDM, 0x100a);
1957 	rtwn_write_2(sc, R92C_RESP_SIFS_CCK, 0x100a);
1958 	rtwn_write_2(sc, R92C_RESP_SIFS_OFDM, 0x100a);
1959 
1960 	if (ic->ic_curmode == IEEE80211_MODE_AUTO)
1961 		mode = IEEE80211_MODE_11G; /* XXX */
1962 	else
1963 		mode = ic->ic_curmode;
1964 	for (aci = 0; aci < EDCA_NUM_AC; aci++)
1965 		memcpy(&ic->ic_edca_ac[aci], &ieee80211_edca_table[mode][aci],
1966 		    sizeof(struct ieee80211_edca_ac_params));
1967 	rtwn_updateedca(ic);
1968 
1969 	if (sc->chip & RTWN_CHIP_PCI) {
1970 		/* linux magic */
1971 		rtwn_write_4(sc, R92C_FAST_EDCA_CTRL, 0x086666);
1972 	}
1973 
1974 	rtwn_write_4(sc, R92C_EDCA_RANDOM_GEN, arc4random());
1975 }
1976 
1977 void
1978 rtwn_rate_fallback_init(struct rtwn_softc *sc)
1979 {
1980 	if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
1981 		if (sc->chip & RTWN_CHIP_PCI) {
1982 			rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
1983 			rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
1984 			rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
1985 			rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
1986 		} else if (sc->chip & RTWN_CHIP_USB) {
1987 			rtwn_write_4(sc, R92C_DARFRC + 0, 0x00000000);
1988 			rtwn_write_4(sc, R92C_DARFRC + 4, 0x10080404);
1989 			rtwn_write_4(sc, R92C_RARFRC + 0, 0x04030201);
1990 			rtwn_write_4(sc, R92C_RARFRC + 4, 0x08070605);
1991 		}
1992 	}
1993 }
1994 
1995 void
1996 rtwn_write_txpower(struct rtwn_softc *sc, int chain,
1997     uint16_t power[RTWN_POWER_COUNT])
1998 {
1999 	uint32_t reg;
2000 
2001 	/* Write per-CCK rate Tx power. */
2002 	if (chain == 0) {
2003 		reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2004 		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[RTWN_POWER_CCK1]);
2005 		rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2006 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2007 		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[RTWN_POWER_CCK2]);
2008 		reg = RW(reg, R92C_TXAGC_A_CCK55, power[RTWN_POWER_CCK55]);
2009 		reg = RW(reg, R92C_TXAGC_A_CCK11, power[RTWN_POWER_CCK11]);
2010 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2011 	} else {
2012 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2013 		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[RTWN_POWER_CCK1]);
2014 		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[RTWN_POWER_CCK2]);
2015 		reg = RW(reg, R92C_TXAGC_B_CCK55, power[RTWN_POWER_CCK55]);
2016 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2017 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2018 		reg = RW(reg, R92C_TXAGC_B_CCK11, power[RTWN_POWER_CCK11]);
2019 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2020 	}
2021 	/* Write per-OFDM rate Tx power. */
2022 	rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2023 	    SM(R92C_TXAGC_RATE06, power[RTWN_POWER_OFDM6]) |
2024 	    SM(R92C_TXAGC_RATE09, power[RTWN_POWER_OFDM9]) |
2025 	    SM(R92C_TXAGC_RATE12, power[RTWN_POWER_OFDM12]) |
2026 	    SM(R92C_TXAGC_RATE18, power[RTWN_POWER_OFDM18]));
2027 	rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2028 	    SM(R92C_TXAGC_RATE24, power[RTWN_POWER_OFDM24]) |
2029 	    SM(R92C_TXAGC_RATE36, power[RTWN_POWER_OFDM36]) |
2030 	    SM(R92C_TXAGC_RATE48, power[RTWN_POWER_OFDM48]) |
2031 	    SM(R92C_TXAGC_RATE54, power[RTWN_POWER_OFDM54]));
2032 	/* Write per-MCS Tx power. */
2033 	rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2034 	    SM(R92C_TXAGC_MCS00,  power[RTWN_POWER_MCS( 0)]) |
2035 	    SM(R92C_TXAGC_MCS01,  power[RTWN_POWER_MCS( 1)]) |
2036 	    SM(R92C_TXAGC_MCS02,  power[RTWN_POWER_MCS( 2)]) |
2037 	    SM(R92C_TXAGC_MCS03,  power[RTWN_POWER_MCS( 3)]));
2038 	rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2039 	    SM(R92C_TXAGC_MCS04,  power[RTWN_POWER_MCS( 4)]) |
2040 	    SM(R92C_TXAGC_MCS05,  power[RTWN_POWER_MCS( 5)]) |
2041 	    SM(R92C_TXAGC_MCS06,  power[RTWN_POWER_MCS( 6)]) |
2042 	    SM(R92C_TXAGC_MCS07,  power[RTWN_POWER_MCS( 7)]));
2043 	if (sc->ntxchains > 1) {
2044 		rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2045 		    SM(R92C_TXAGC_MCS08,  power[RTWN_POWER_MCS( 8)]) |
2046 		    SM(R92C_TXAGC_MCS09,  power[RTWN_POWER_MCS( 9)]) |
2047 		    SM(R92C_TXAGC_MCS10,  power[RTWN_POWER_MCS(10)]) |
2048 		    SM(R92C_TXAGC_MCS11,  power[RTWN_POWER_MCS(11)]));
2049 		rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2050 		    SM(R92C_TXAGC_MCS12,  power[RTWN_POWER_MCS(12)]) |
2051 		    SM(R92C_TXAGC_MCS13,  power[RTWN_POWER_MCS(13)]) |
2052 		    SM(R92C_TXAGC_MCS14,  power[RTWN_POWER_MCS(14)]) |
2053 		    SM(R92C_TXAGC_MCS15,  power[RTWN_POWER_MCS(15)]));
2054 	}
2055 }
2056 
2057 void
2058 rtwn_get_txpower(struct rtwn_softc *sc, int chain, struct ieee80211_channel *c,
2059     struct ieee80211_channel *extc, uint16_t power[RTWN_POWER_COUNT])
2060 {
2061 	if (sc->chip & RTWN_CHIP_88E)
2062 		rtwn_r88e_get_txpower(sc, chain, c, extc, power);
2063 	else if (sc->chip & RTWN_CHIP_92E)
2064 		rtwn_r92e_get_txpower(sc, chain, c, extc, power);
2065 	else
2066 		rtwn_r92c_get_txpower(sc, chain, c, extc, power);
2067 }
2068 
2069 void
2070 rtwn_r92c_get_txpower(struct rtwn_softc *sc, int chain,
2071     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2072     uint16_t power[RTWN_POWER_COUNT])
2073 {
2074 	struct ieee80211com *ic = &sc->sc_ic;
2075 	struct r92c_rom *rom = &sc->sc_r92c_rom;
2076 	uint16_t cckpow, ofdmpow, htpow, diff, max;
2077 	const struct r92c_txpwr *base;
2078 	int ridx, chan, group;
2079 
2080 	/* Determine channel group. */
2081 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2082 	if (chan <= 3)
2083 		group = 0;
2084 	else if (chan <= 9)
2085 		group = 1;
2086 	else
2087 		group = 2;
2088 
2089 	/* Get original Tx power based on board type and RF chain. */
2090 	if (!(sc->chip & RTWN_CHIP_92C)) {
2091 		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2092 			base = &rtl8188ru_txagc[chain];
2093 		else
2094 			base = &rtl8192cu_txagc[chain];
2095 	} else
2096 		base = &rtl8192cu_txagc[chain];
2097 
2098 	memset(power, 0, RTWN_POWER_COUNT * sizeof(power[0]));
2099 	if (sc->regulatory == 0) {
2100 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
2101 			power[ridx] = base->pwr[0][ridx];
2102 	}
2103 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_MAX; ridx++) {
2104 		if (sc->regulatory == 3) {
2105 			power[ridx] = base->pwr[0][ridx];
2106 			/* Apply vendor limits. */
2107 			if (extc != NULL)
2108 				max = rom->ht40_max_pwr[group];
2109 			else
2110 				max = rom->ht20_max_pwr[group];
2111 			max = (max >> (chain * 4)) & 0xf;
2112 			if (power[ridx] > max)
2113 				power[ridx] = max;
2114 		} else if (sc->regulatory == 1) {
2115 			if (extc == NULL)
2116 				power[ridx] = base->pwr[group][ridx];
2117 		} else if (sc->regulatory != 2)
2118 			power[ridx] = base->pwr[0][ridx];
2119 	}
2120 
2121 	/* Compute per-CCK rate Tx power. */
2122 	cckpow = rom->cck_tx_pwr[chain][group];
2123 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2124 		power[ridx] += cckpow;
2125 		if (power[ridx] > R92C_MAX_TX_PWR)
2126 			power[ridx] = R92C_MAX_TX_PWR;
2127 	}
2128 
2129 	htpow = rom->ht40_1s_tx_pwr[chain][group];
2130 	if (sc->ntxchains > 1) {
2131 		/* Apply reduction for 2 spatial streams. */
2132 		diff = rom->ht40_2s_tx_pwr_diff[group];
2133 		diff = (diff >> (chain * 4)) & 0xf;
2134 		htpow = (htpow > diff) ? htpow - diff : 0;
2135 	}
2136 
2137 	/* Compute per-OFDM rate Tx power. */
2138 	diff = rom->ofdm_tx_pwr_diff[group];
2139 	diff = (diff >> (chain * 4)) & 0xf;
2140 	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2141 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2142 		power[ridx] += ofdmpow;
2143 		if (power[ridx] > R92C_MAX_TX_PWR)
2144 			power[ridx] = R92C_MAX_TX_PWR;
2145 	}
2146 
2147 	/* Compute per-MCS Tx power. */
2148 	if (extc == NULL) {
2149 		diff = rom->ht20_tx_pwr_diff[group];
2150 		diff = (diff >> (chain * 4)) & 0xf;
2151 		htpow += diff;	/* HT40->HT20 correction. */
2152 	}
2153 	for (ridx = RTWN_RIDX_MCS0; ridx <= RTWN_RIDX_MCS15; ridx++) {
2154 		power[ridx] += htpow;
2155 		if (power[ridx] > R92C_MAX_TX_PWR)
2156 			power[ridx] = R92C_MAX_TX_PWR;
2157 	}
2158 #ifdef RTWN_DEBUG
2159 	if (rtwn_debug >= 4) {
2160 		/* Dump per-rate Tx power values. */
2161 		printf("Tx power for chain %d:\n", chain);
2162 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_MAX; ridx++)
2163 			printf("Rate %d = %u\n", ridx, power[ridx]);
2164 	}
2165 #endif
2166 }
2167 
2168 void
2169 rtwn_r92e_get_txpower(struct rtwn_softc *sc, int chain,
2170     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2171     uint16_t power[RTWN_POWER_COUNT])
2172 {
2173 	struct ieee80211com *ic = &sc->sc_ic;
2174 	struct r92e_rom *rom = &sc->sc_r92e_rom;
2175 	struct r92e_tx_pwr *txpwr;
2176 	uint8_t cckpow, htpow, htpow2s = 0, ofdmpow;
2177 	int8_t diff;
2178 	int ridx, chan, group;
2179 
2180 	/* Determine channel group. */
2181 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2182 	if (chan <= 2)
2183 		group = 0;
2184 	else if (chan <= 5)
2185 		group = 1;
2186 	else if (chan <= 8)
2187 		group = 2;
2188 	else if (chan <= 11)
2189 		group = 3;
2190 	else
2191 		group = 4;
2192 
2193 	memset(power, 0, RTWN_POWER_COUNT * sizeof(power[0]));
2194 
2195 	if (chain == 0)
2196 		txpwr = &rom->txpwr_a;
2197 	else
2198 		txpwr = &rom->txpwr_b;
2199 
2200 	/* Compute per-CCK rate Tx power. */
2201 	cckpow = txpwr->cck_tx_pwr[group];
2202 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2203 		power[ridx] = cckpow;
2204 		if (power[ridx] > R92C_MAX_TX_PWR)
2205 			power[ridx] = R92C_MAX_TX_PWR;
2206 	}
2207 
2208 	htpow = txpwr->ht40_tx_pwr[group];
2209 
2210 	/* Compute per-OFDM rate Tx power. */
2211 	diff = RTWN_SIGN4TO8(MS(txpwr->ht20_ofdm_tx_pwr_diff,
2212 	    R92E_ROM_TXPWR_OFDM_DIFF));
2213 	ofdmpow = htpow + diff;
2214 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2215 		power[ridx] = ofdmpow;
2216 		if (power[ridx] > R92C_MAX_TX_PWR)
2217 			power[ridx] = R92C_MAX_TX_PWR;
2218 	}
2219 
2220 	/* Compute per-MCS Tx power. */
2221 	if (extc == NULL) {
2222 		diff = RTWN_SIGN4TO8(MS(txpwr->ht20_ofdm_tx_pwr_diff,
2223 		    R92E_ROM_TXPWR_HT20_DIFF));
2224 		htpow += diff;
2225 		if (sc->ntxchains > 1) {
2226 			diff = RTWN_SIGN4TO8(MS(
2227 			    txpwr->pwr_diff[0].ht40_ht20_tx_pwr_diff,
2228 			    R92E_ROM_TXPWR_HT20_2S_DIFF));
2229 			htpow2s = htpow + diff;
2230 		}
2231 	}
2232 
2233 	for (ridx = RTWN_RIDX_MCS0; ridx < RTWN_RIDX_MCS15; ridx++) {
2234 		power[ridx] = (ridx < RTWN_RIDX_MCS8) ? htpow : htpow2s;
2235 		if (power[ridx] > R92C_MAX_TX_PWR)
2236 			power[ridx] = R92C_MAX_TX_PWR;
2237 	}
2238 }
2239 
2240 void
2241 rtwn_r88e_get_txpower(struct rtwn_softc *sc, int chain,
2242     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2243     uint16_t power[RTWN_POWER_COUNT])
2244 {
2245 	struct ieee80211com *ic = &sc->sc_ic;
2246 	struct r88e_rom *rom = &sc->sc_r88e_rom;
2247 	uint8_t cckpow, htpow, ofdmpow;
2248 	int8_t diff;
2249 	int ridx, chan, group;
2250 
2251 	/* Determine channel group. */
2252 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2253 	if (chan <= 2)
2254 		group = 0;
2255 	else if (chan <= 5)
2256 		group = 1;
2257 	else if (chan <= 8)
2258 		group = 2;
2259 	else if (chan <= 11)
2260 		group = 3;
2261 	else if (chan <= 13)
2262 		group = 4;
2263 	else
2264 		group = 5;
2265 
2266 	memset(power, 0, RTWN_POWER_COUNT * sizeof(power[0]));
2267 
2268 	/* Compute per-CCK rate Tx power. */
2269 	cckpow = rom->txpwr.cck_tx_pwr[group];
2270 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2271 		power[ridx] = (ridx == RTWN_RIDX_CCK2) ? cckpow - 9 : cckpow;
2272 		if (power[ridx] > R92C_MAX_TX_PWR)
2273 			power[ridx] = R92C_MAX_TX_PWR;
2274 	}
2275 
2276 	htpow = (group == 5) ? rom->txpwr.ht40_tx_pwr[group - 1] :
2277 	    rom->txpwr.ht40_tx_pwr[group];
2278 
2279 	/* Compute per-OFDM rate Tx power. */
2280 	diff = RTWN_SIGN4TO8(MS(rom->txpwr.ht20_ofdm_tx_pwr_diff,
2281 	    R88E_ROM_TXPWR_OFDM_DIFF));
2282 	ofdmpow = htpow + diff;
2283 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2284 		power[ridx] = ofdmpow;
2285 		if (power[ridx] > R92C_MAX_TX_PWR)
2286 			power[ridx] = R92C_MAX_TX_PWR;
2287 	}
2288 
2289 	/* Compute per-MCS Tx power. */
2290 	if (extc == NULL) {
2291 		diff = RTWN_SIGN4TO8(MS(rom->txpwr.ht20_ofdm_tx_pwr_diff,
2292 		    R88E_ROM_TXPWR_HT20_DIFF));
2293 		htpow += diff;
2294 	}
2295 	for (ridx = RTWN_RIDX_MCS0; ridx < RTWN_RIDX_MCS8; ridx++) {
2296 		power[ridx] = htpow;
2297 		if (power[ridx] > R92C_MAX_TX_PWR)
2298 			power[ridx] = R92C_MAX_TX_PWR;
2299 	}
2300 }
2301 
2302 void
2303 rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
2304     struct ieee80211_channel *extc)
2305 {
2306 	uint16_t power[RTWN_POWER_COUNT];
2307 	int i;
2308 
2309 	for (i = 0; i < sc->ntxchains; i++) {
2310 		/* Compute per-rate Tx power values. */
2311 		rtwn_get_txpower(sc, i, c, extc, power);
2312 		/* Write per-rate Tx power values to hardware. */
2313 		rtwn_write_txpower(sc, i, power);
2314 	}
2315 }
2316 
2317 void
2318 rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
2319     struct ieee80211_channel *extc)
2320 {
2321 	struct ieee80211com *ic = &sc->sc_ic;
2322 	u_int chan;
2323 	uint32_t reg;
2324 	int i;
2325 
2326 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2327 
2328 	/* Set Tx power for this new channel. */
2329 	rtwn_set_txpower(sc, c, extc);
2330 
2331 	if (extc != NULL) {
2332 		uint32_t reg;
2333 
2334 		/* Is secondary channel below or above primary? */
2335 		int prichlo = c->ic_freq < extc->ic_freq;
2336 
2337 		if (sc->chip & RTWN_CHIP_92E) {
2338 			uint16_t reg;
2339 			reg = rtwn_read_2(sc, R92C_WMAC_TRXPTCL_CTL);
2340 			reg &= ~R92C_WMAC_TRXPTCL_CTL_BW_MASK;
2341 			reg |= R92C_WMAC_TRXPTCL_CTL_BW_40;
2342 			rtwn_write_2(sc, R92C_WMAC_TRXPTCL_CTL, reg);
2343 			rtwn_write_1(sc, R92E_DATA_SC, 0);
2344 		} else {
2345 			rtwn_write_1(sc, R92C_BWOPMODE,
2346 			    rtwn_read_1(sc, R92C_BWOPMODE) &
2347 			    ~R92C_BWOPMODE_20MHZ);
2348 		}
2349 
2350 		reg = rtwn_read_1(sc, R92C_RRSR + 2);
2351 		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2352 		rtwn_write_1(sc, R92C_RRSR + 2, reg);
2353 
2354 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2355 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2356 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2357 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2358 
2359 		/* Set CCK side band. */
2360 		reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2361 		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2362 		rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2363 
2364 		reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
2365 		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2366 		rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2367 
2368 		if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
2369 			rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2370 			    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2371 			    ~R92C_FPGA0_ANAPARAM2_CBW20);
2372 		}
2373 
2374 		reg = rtwn_bb_read(sc, 0x818);
2375 		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2376 		rtwn_bb_write(sc, 0x818, reg);
2377 
2378 		/* Select 40MHz bandwidth. */
2379 		for (i = 0; i < sc->nrxchains; i++) {
2380 			rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2381 			    (sc->rf_chnlbw[i] & ~0xfff) | chan);
2382 		}
2383 	} else {
2384 		if (sc->chip & RTWN_CHIP_92E) {
2385 			uint16_t reg;
2386 			reg = rtwn_read_2(sc, R92C_WMAC_TRXPTCL_CTL);
2387 			reg &= ~R92C_WMAC_TRXPTCL_CTL_BW_MASK;
2388 			rtwn_write_2(sc, R92C_WMAC_TRXPTCL_CTL, reg);
2389 			rtwn_write_1(sc, R92E_DATA_SC, 0);
2390 		} else {
2391 			rtwn_write_1(sc, R92C_BWOPMODE,
2392 			    rtwn_read_1(sc, R92C_BWOPMODE) |
2393 			    R92C_BWOPMODE_20MHZ);
2394 		}
2395 
2396 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2397 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2398 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2399 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2400 
2401 		if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
2402 			rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2403 			    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2404 			    R92C_FPGA0_ANAPARAM2_CBW20);
2405 		} else if (sc->chip & RTWN_CHIP_92E) {
2406 			reg = rtwn_read_4(sc, R92C_OFDM0_TX_PSDO_NOISE_WEIGHT);
2407 			reg &= ~0xc0000000;
2408 			rtwn_write_4(sc, R92C_OFDM0_TX_PSDO_NOISE_WEIGHT, reg);
2409 		}
2410 
2411 		/* Select 20MHz bandwidth. */
2412 		for (i = 0; i < sc->nrxchains; i++) {
2413 			rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2414 			    (sc->rf_chnlbw[i] & ~0xfff) | chan |
2415 			    ((sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) ?
2416 			    R88E_RF_CHNLBW_BW20 : R92C_RF_CHNLBW_BW20));
2417 		}
2418 	}
2419 
2420 	if (sc->chip == (RTWN_CHIP_88E | RTWN_CHIP_PCI))
2421 		DELAY(25000);
2422 }
2423 
2424 int
2425 rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
2426     uint16_t rx[2])
2427 {
2428 	uint32_t status;
2429 	int offset = chain * 0x20;
2430 	uint32_t iqk_tone_92c[] = {
2431 		0x10008c1f, 0x10008c1f, 0x82140102, 0x28160202, 0x10008c22
2432 	};
2433 	uint32_t iqk_tone_92e[] = {
2434 		0x18008c1c, 0x38008c1c, 0x82140303, 0x68160000, 0x38008c1c
2435 	};
2436 	uint32_t *iqk_tone;
2437 
2438 	if (sc->chip & RTWN_CHIP_92E)
2439 		iqk_tone = iqk_tone_92e;
2440 	else
2441 		iqk_tone = iqk_tone_92c;
2442 
2443 	if (chain == 0) {	/* IQ calibration for chain 0. */
2444 		/* IQ calibration settings for chain 0. */
2445 		rtwn_bb_write(sc, R92C_TX_IQK_TONE_A, iqk_tone[0]);
2446 		rtwn_bb_write(sc, R92C_RX_IQK_TONE_B, iqk_tone[1]);
2447 		rtwn_bb_write(sc, R92C_TX_IQK_PI_A, iqk_tone[2]);
2448 
2449 		if (sc->ntxchains > 1) {
2450 			rtwn_bb_write(sc, R92C_RX_IQK_PI_A, iqk_tone[3]);
2451 			/* IQ calibration settings for chain 1. */
2452 			rtwn_bb_write(sc, R92C_TX_IQK_TONE_B, iqk_tone[4]);
2453 			rtwn_bb_write(sc, R92C_RX_IQK_TONE_B, iqk_tone[4]);
2454 			rtwn_bb_write(sc, R92C_TX_IQK_PI_B, 0x82140102);
2455 			rtwn_bb_write(sc, R92C_RX_IQK_PI_B, 0x28160202);
2456 		} else
2457 			rtwn_bb_write(sc, R92C_RX_IQK_PI_A, 0x28160502);
2458 
2459 		/* LO calibration settings. */
2460 		if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))
2461 			rtwn_bb_write(sc, R92C_IQK_AGC_RSP, 0x00462911);
2462 		else
2463 			rtwn_bb_write(sc, R92C_IQK_AGC_RSP, 0x001028d1);
2464 		/* We're doing LO and IQ calibration in one shot. */
2465 		rtwn_bb_write(sc, R92C_IQK_AGC_PTS, 0xf9000000);
2466 		rtwn_bb_write(sc, R92C_IQK_AGC_PTS, 0xf8000000);
2467 
2468 	} else {		/* IQ calibration for chain 1. */
2469 		/* We're doing LO and IQ calibration in one shot. */
2470 		rtwn_bb_write(sc, R92C_IQK_AGC_CONT, 0x00000002);
2471 		rtwn_bb_write(sc, R92C_IQK_AGC_CONT, 0x00000000);
2472 	}
2473 
2474 	/* Give LO and IQ calibrations the time to complete. */
2475 	DELAY(1000);
2476 
2477 	/* Read IQ calibration status. */
2478 	status = rtwn_bb_read(sc, 0xeac);
2479 
2480 	if (status & (1 << (28 + chain * 3)))
2481 		return (0);	/* Tx failed. */
2482 	/* Read Tx IQ calibration results. */
2483 	tx[0] = (rtwn_bb_read(sc, R92C_TX_POWER_BEFORE_IQK_A + offset) >> 16)
2484 	    & 0x3ff;
2485 	tx[1] = (rtwn_bb_read(sc, R92C_TX_POWER_AFTER_IQK_A + offset) >> 16)
2486 	    & 0x3ff;
2487 	if (tx[0] == 0x142 || tx[1] == 0x042)
2488 		return (0);	/* Tx failed. */
2489 
2490 	if (status & (1 << (27 + chain * 3)))
2491 		return (1);	/* Rx failed. */
2492 	/* Read Rx IQ calibration results. */
2493 	rx[0] = (rtwn_bb_read(sc, R92C_RX_POWER_BEFORE_IQK_A_2 + offset) >> 16)
2494 	    & 0x3ff;
2495 	rx[1] = (rtwn_bb_read(sc, R92C_RX_POWER_AFTER_IQK_A_2 + offset) >> 16)
2496 	    & 0x3ff;
2497 	if (rx[0] == 0x132 || rx[1] == 0x036)
2498 		return (1);	/* Rx failed. */
2499 
2500 	return (3);	/* Both Tx and Rx succeeded. */
2501 }
2502 
2503 void
2504 rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
2505     uint16_t rx[2][2], struct rtwn_iq_cal_regs *iq_cal_regs)
2506 {
2507 	static const uint16_t reg_adda[16] = {
2508 		0x85c, 0xe6c, 0xe70, 0xe74,
2509 		0xe78, 0xe7c, 0xe80, 0xe84,
2510 		0xe88, 0xe8c, 0xed0, 0xed4,
2511 		0xed8, 0xedc, 0xee0, 0xeec
2512 	};
2513 	static const uint32_t adda_92c[] = {
2514 		0x0b1b25a0, 0x0bdb25a0, 0x04db25a4, 0x0b1b25a4
2515 	};
2516 	static const uint32_t adda_92e[] = {
2517 		0x0fc01616, 0x0fc01616, 0x0fc01616, 0x0fc01616
2518 	};
2519 	const uint32_t *adda_vals;
2520 
2521 	int i, chain;
2522 	uint32_t hssi_param1, reg;
2523 	uint8_t xa_agc, xb_agc;
2524 
2525 	xa_agc = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0)) & 0xff;
2526 	xb_agc = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1)) & 0xff;
2527 
2528 	if (sc->chip & RTWN_CHIP_92E)
2529 		adda_vals = adda_92e;
2530 	else
2531 		adda_vals = adda_92c;
2532 
2533 	if (n == 0) {
2534 		for (i = 0; i < nitems(reg_adda); i++)
2535 			iq_cal_regs->adda[i] = rtwn_bb_read(sc, reg_adda[i]);
2536 
2537 		iq_cal_regs->txpause = rtwn_read_1(sc, R92C_TXPAUSE);
2538 		iq_cal_regs->bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
2539 		iq_cal_regs->bcn_ctrl1 = rtwn_read_1(sc, R92C_BCN_CTRL1);
2540 		iq_cal_regs->gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
2541 	}
2542 
2543 	if (sc->ntxchains == 1) {
2544 		rtwn_bb_write(sc, reg_adda[0], adda_vals[0]);
2545 		for (i = 1; i < nitems(reg_adda); i++)
2546 			rtwn_bb_write(sc, reg_adda[i], adda_vals[1]);
2547 	} else {
2548 		for (i = 0; i < nitems(reg_adda); i++)
2549 			rtwn_bb_write(sc, reg_adda[i], adda_vals[2]);
2550 	}
2551 
2552 	if (n == 0) {
2553 		iq_cal_regs->ofdm0_trxpathena =
2554 		    rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2555 		iq_cal_regs->ofdm0_trmuxpar =
2556 		    rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
2557 		iq_cal_regs->fpga0_rfifacesw0 =
2558 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(0));
2559 		iq_cal_regs->fpga0_rfifacesw1 =
2560 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
2561 		iq_cal_regs->fpga0_rfifaceoe0 =
2562 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(0));
2563 		iq_cal_regs->fpga0_rfifaceoe1 =
2564 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(1));
2565 		iq_cal_regs->config_ant_a =
2566 		    rtwn_bb_read(sc, R92C_CONFIG_ANT_A);
2567 		iq_cal_regs->config_ant_b =
2568 		    rtwn_bb_read(sc, R92C_CONFIG_ANT_B);
2569 		iq_cal_regs->cck0_afesetting =
2570 		    rtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2571 	}
2572 
2573 	if (sc->chip & RTWN_CHIP_92E) {
2574 		rtwn_write_4(sc, R92C_CCK0_AFESETTING, rtwn_read_4(sc,
2575 		    R92C_CCK0_AFESETTING) | 0x0f000000);
2576 	} else {
2577 		hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
2578 		if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2579 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2580 			    hssi_param1 | R92C_HSSI_PARAM1_PI);
2581 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2582 			    hssi_param1 | R92C_HSSI_PARAM1_PI);
2583 		}
2584 	}
2585 
2586 	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
2587 	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
2588 
2589 	if (sc->chip & RTWN_CHIP_92E) {
2590 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22208200);
2591 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(0),
2592 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(0)) | (1 << 10) |
2593 		    (1 << 26));
2594 
2595 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(0), rtwn_bb_read(sc,
2596 		    R92C_FPGA0_RFIFACEOE(0)) | (1 << 10));
2597 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(1), rtwn_bb_read(sc,
2598 		    R92C_FPGA0_RFIFACEOE(1)) | (1 << 10));
2599 	} else {
2600 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
2601 
2602 		if (sc->ntxchains > 1) {
2603 			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2604 			rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
2605 		}
2606 
2607 		rtwn_write_1(sc, R92C_TXPAUSE, R92C_TXPAUSE_AC_VO |
2608 		    R92C_TXPAUSE_AC_VI | R92C_TXPAUSE_AC_BE |
2609 		    R92C_TXPAUSE_AC_BK | R92C_TXPAUSE_MGNT |
2610 		    R92C_TXPAUSE_HIGH);
2611 	}
2612 	rtwn_write_1(sc, R92C_BCN_CTRL,
2613 	    iq_cal_regs->bcn_ctrl & ~(R92C_BCN_CTRL_EN_BCN));
2614 	rtwn_write_1(sc, R92C_BCN_CTRL1,
2615 	    iq_cal_regs->bcn_ctrl1 & ~(R92C_BCN_CTRL_EN_BCN));
2616 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2617 	    iq_cal_regs->gpio_muxcfg & ~(R92C_GPIO_MUXCFG_ENBT));
2618 
2619 	rtwn_bb_write(sc, R92C_CONFIG_ANT_A, 0x00080000);
2620 	if (sc->ntxchains > 1)
2621 		rtwn_bb_write(sc, R92C_CONFIG_ANT_B, 0x00080000);
2622 
2623 	rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x80800000);
2624 	rtwn_bb_write(sc, R92C_TX_IQK, 0x01007c00);
2625 	rtwn_bb_write(sc, R92C_RX_IQK, 0x01004800);
2626 
2627 	rtwn_bb_write(sc, R92C_CONFIG_ANT_A, 0x00080000);
2628 
2629 	for (chain = 0; chain < sc->ntxchains; chain++) {
2630 		if (chain > 0) {
2631 			/* Put chain 0 on standby. */
2632 			rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x00);
2633 			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2634 			rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x80800000);
2635 
2636 			/* Enable chain 1. */
2637 			for (i = 0; i < nitems(reg_adda); i++)
2638 				rtwn_bb_write(sc, reg_adda[i], adda_vals[3]);
2639 		}
2640 
2641 		/* Run IQ calibration twice. */
2642 		for (i = 0; i < 2; i++) {
2643 			int ret;
2644 
2645 			ret = rtwn_iq_calib_chain(sc, chain,
2646 			    tx[chain], rx[chain]);
2647 			if (ret == 0) {
2648 				DPRINTF(("%s: chain %d: Tx failed.\n",
2649 				    __func__, chain));
2650 				tx[chain][0] = 0xff;
2651 				tx[chain][1] = 0xff;
2652 				rx[chain][0] = 0xff;
2653 				rx[chain][1] = 0xff;
2654 			} else if (ret == 1) {
2655 				DPRINTF(("%s: chain %d: Rx failed.\n",
2656 				    __func__, chain));
2657 				rx[chain][0] = 0xff;
2658 				rx[chain][1] = 0xff;
2659 			} else if (ret == 3) {
2660 				DPRINTF(("%s: chain %d: Both Tx and Rx "
2661 				    "succeeded.\n", __func__, chain));
2662 			}
2663 		}
2664 
2665 		DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
2666 		    "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
2667 		    tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
2668 	}
2669 
2670 	rtwn_bb_write(sc, R92C_FPGA0_IQK, 0x00);
2671 
2672 	if (!(sc->chip & RTWN_CHIP_92E)) {
2673 		rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
2674 		if (sc->ntxchains > 1)
2675 			rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
2676 	}
2677 
2678 	if (n != 0) {
2679 		if (!(sc->chip & RTWN_CHIP_92E)) {
2680 			if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2681 				rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2682 				    hssi_param1);
2683 				rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2684 				    hssi_param1);
2685 			}
2686 		}
2687 
2688 		for (i = 0; i < nitems(reg_adda); i++)
2689 			rtwn_bb_write(sc, reg_adda[i], iq_cal_regs->adda[i]);
2690 
2691 		rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs->txpause);
2692 		rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs->bcn_ctrl);
2693 		rtwn_write_1(sc, R92C_BCN_CTRL1, iq_cal_regs->bcn_ctrl1);
2694 		rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs->gpio_muxcfg);
2695 
2696 		rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
2697 		    iq_cal_regs->ofdm0_trxpathena);
2698 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(0),
2699 		    iq_cal_regs->fpga0_rfifacesw0);
2700 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
2701 		    iq_cal_regs->fpga0_rfifacesw1);
2702 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(0),
2703 		    iq_cal_regs->fpga0_rfifaceoe0);
2704 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(1),
2705 		    iq_cal_regs->fpga0_rfifaceoe1);
2706 		rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR,
2707 		    iq_cal_regs->ofdm0_trmuxpar);
2708 		rtwn_bb_write(sc, R92C_CONFIG_ANT_A,
2709 		    iq_cal_regs->config_ant_a);
2710 		rtwn_bb_write(sc, R92C_CONFIG_ANT_B,
2711 		    iq_cal_regs->config_ant_b);
2712 		rtwn_bb_write(sc, R92C_CCK0_AFESETTING,
2713 		    iq_cal_regs->cck0_afesetting);
2714 
2715 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
2716 		reg &= ~0xff;
2717 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg | 0x50);
2718 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg | xa_agc);
2719 
2720 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
2721 		reg &= ~0xff;
2722 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg | 0x50);
2723 		rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg | xb_agc);
2724 
2725 		rtwn_bb_write(sc, R92C_TX_IQK_TONE_A, 0x01008c00);
2726 		rtwn_bb_write(sc, R92C_RX_IQK_TONE_A, 0x01008c00);
2727 	}
2728 }
2729 
2730 #define RTWN_IQ_CAL_MAX_TOLERANCE 5
2731 int
2732 rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
2733     uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
2734 {
2735 	int chain, i, tx_ok[2], rx_ok[2];
2736 
2737 	tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
2738 	for (chain = 0; chain < ntxchains; chain++) {
2739 		for (i = 0; i < 2; i++)	{
2740 			if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
2741 			    rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
2742 				continue;
2743 
2744 			tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
2745 			    RTWN_IQ_CAL_MAX_TOLERANCE);
2746 
2747 			rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
2748 			    RTWN_IQ_CAL_MAX_TOLERANCE);
2749 		}
2750 	}
2751 
2752 	if (ntxchains > 1)
2753 		return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
2754 	else
2755 		return (tx_ok[0] && rx_ok[0]);
2756 }
2757 #undef RTWN_IQ_CAL_MAX_TOLERANCE
2758 
2759 void
2760 rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
2761     uint16_t rx[2], int chain)
2762 {
2763 	uint32_t reg, val, x;
2764 	long y, tx_c;
2765 
2766 	if (tx[0] == 0xff || tx[1] == 0xff)
2767 		return;
2768 
2769 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
2770 	val = ((reg >> 22) & 0x3ff);
2771 	x = tx[0];
2772 	if (x & 0x00000200)
2773 		x |= 0xfffffc00;
2774 	reg &= ~0x3ff;
2775 	reg |= (((x * val) >> 8) & 0x3ff);
2776 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
2777 
2778 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
2779 	if (((x * val) >> 7) & 0x01)
2780 		reg |= 0x80000000;
2781 	else
2782 		reg &= ~0x80000000;
2783 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
2784 
2785 	y = tx[1];
2786 	if (y & 0x00000200)
2787 		y |= 0xfffffc00;
2788 	tx_c = (y * val) >> 8;
2789 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
2790 	reg &= ~0xf0000000;
2791 	reg |= ((tx_c & 0x3c0) << 22);
2792 	rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
2793 
2794 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
2795 	reg &= ~0x003f0000;
2796 	reg |= ((tx_c & 0x3f) << 16);
2797 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
2798 
2799 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
2800 	if (((y * val) >> 7) & 0x01)
2801 		reg |= 0x20000000;
2802 	else
2803 		reg &= ~0x20000000;
2804 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
2805 
2806 	if (rx[0] == 0xff || rx[1] == 0xff)
2807 		return;
2808 
2809 	reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
2810 	reg &= ~0x3ff;
2811 	reg |= (rx[0] & 0x3ff);
2812 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
2813 
2814 	reg &= ~0xfc00;
2815 	reg |= ((rx[1] & 0x03f) << 10);
2816 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
2817 
2818 	if (chain == 0) {
2819 		reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
2820 		reg &= ~0xf0000000;
2821 		reg |= ((rx[1] & 0x3c0) << 22);
2822 		rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
2823 	} else {
2824 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
2825 		reg &= ~0xf000;
2826 		reg |= ((rx[1] & 0x3c0) << 6);
2827 		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
2828 	}
2829 }
2830 
2831 #define RTWN_IQ_CAL_NRUN	3
2832 void
2833 rtwn_iq_calib(struct rtwn_softc *sc)
2834 {
2835 	uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
2836 	int n, valid;
2837 	struct rtwn_iq_cal_regs regs;
2838 
2839 	valid = 0;
2840 	memset(&regs, 0, sizeof(regs));
2841 	for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
2842 		rtwn_iq_calib_run(sc, n, tx[n], rx[n], &regs);
2843 
2844 		if (n == 0)
2845 			continue;
2846 
2847 		/* Valid results remain stable after consecutive runs. */
2848 		valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
2849 		    tx[n], rx[n], sc->ntxchains);
2850 		if (valid)
2851 			break;
2852 	}
2853 
2854 	if (valid) {
2855 		rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
2856 		if (sc->ntxchains > 1)
2857 			rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
2858 	}
2859 }
2860 #undef RTWN_IQ_CAL_NRUN
2861 
2862 void
2863 rtwn_lc_calib(struct rtwn_softc *sc)
2864 {
2865 	uint32_t rf_ac[2];
2866 	uint8_t txmode;
2867 	int i;
2868 
2869 	txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
2870 	if ((txmode & 0x70) != 0) {
2871 		/* Disable all continuous Tx. */
2872 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
2873 
2874 		/* Set RF mode to standby mode. */
2875 		for (i = 0; i < sc->nrxchains; i++) {
2876 			rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
2877 			rtwn_rf_write(sc, i, R92C_RF_AC,
2878 			    RW(rf_ac[i], R92C_RF_AC_MODE,
2879 				R92C_RF_AC_MODE_STANDBY));
2880 		}
2881 	} else {
2882 		/* Block all Tx queues. */
2883 		rtwn_write_1(sc, R92C_TXPAUSE, R92C_TXPAUSE_ALL);
2884 	}
2885 	/* Start calibration. */
2886 	rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2887 	    rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
2888 
2889 	/* Give calibration the time to complete. */
2890 	DELAY(100);
2891 
2892 	/* Restore configuration. */
2893 	if ((txmode & 0x70) != 0) {
2894 		/* Restore Tx mode. */
2895 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
2896 		/* Restore RF mode. */
2897 		for (i = 0; i < sc->nrxchains; i++)
2898 			rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
2899 	} else {
2900 		/* Unblock all Tx queues. */
2901 		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
2902 	}
2903 }
2904 
2905 void
2906 rtwn_temp_calib(struct rtwn_softc *sc)
2907 {
2908 	int temp, t_meter_reg, t_meter_val;
2909 
2910 	if (sc->chip & RTWN_CHIP_92E) {
2911 		t_meter_reg = R92E_RF_T_METER;
2912 		t_meter_val = 0x37cf8;
2913 	} else {
2914 		t_meter_reg = R92C_RF_T_METER;
2915 		t_meter_val = 0x60;
2916 	}
2917 
2918 	if (sc->thcal_state == 0) {
2919 		/* Start measuring temperature. */
2920 		rtwn_rf_write(sc, 0, t_meter_reg, t_meter_val);
2921 		sc->thcal_state = 1;
2922 		return;
2923 	}
2924 	sc->thcal_state = 0;
2925 
2926 	/* Read measured temperature. */
2927 	temp = rtwn_rf_read(sc, 0, t_meter_reg) & 0x1f;
2928 	if (temp == 0)	/* Read failed, skip. */
2929 		return;
2930 	DPRINTFN(2, ("temperature=%d\n", temp));
2931 
2932 	/*
2933 	 * Redo IQ and LC calibration if temperature changed significantly
2934 	 * since last calibration.
2935 	 */
2936 	if (sc->thcal_lctemp == 0) {
2937 		/* First calibration is performed in rtwn_init(). */
2938 		sc->thcal_lctemp = temp;
2939 	} else if (abs(temp - sc->thcal_lctemp) > 1) {
2940 		DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
2941 		    sc->thcal_lctemp, temp));
2942 		rtwn_iq_calib(sc);
2943 		rtwn_lc_calib(sc);
2944 		/* Record temperature of last calibration. */
2945 		sc->thcal_lctemp = temp;
2946 	}
2947 }
2948 
2949 void
2950 rtwn_enable_intr(struct rtwn_softc *sc)
2951 {
2952 	if (sc->chip & RTWN_CHIP_92E) {
2953 		rtwn_write_4(sc, R88E_HIMR, 0);
2954 		rtwn_write_4(sc, R88E_HIMRE, 0);
2955 	} else if (sc->chip & RTWN_CHIP_88E) {
2956 		rtwn_write_4(sc, R88E_HISR, 0xffffffff);
2957 		if (sc->chip & RTWN_CHIP_USB) {
2958 			rtwn_write_4(sc, R88E_HIMR, R88E_HIMR_CPWM |
2959 			R88E_HIMR_CPWM2 | R88E_HIMR_TBDER |
2960 			R88E_HIMR_PSTIMEOUT);
2961 			rtwn_write_4(sc, R88E_HIMRE, R88E_HIMRE_RXFOVW |
2962 			    R88E_HIMRE_TXFOVW | R88E_HIMRE_RXERR |
2963 			    R88E_HIMRE_TXERR);
2964 		} else {
2965 			rtwn_write_4(sc, R88E_HIMR,
2966 			    RTWN_88E_INT_ENABLE);
2967 			rtwn_write_4(sc, R88E_HIMRE,
2968 			    R88E_HIMRE_RXFOVW);
2969 			rtwn_write_1(sc, R92C_C2HEVT_CLEAR, 0);
2970 			rtwn_write_4(sc, R92C_HSIMR,
2971 			    R88E_HSIMR_PDN_INT_EN | R88E_HSIMR_RON_INT_EN);
2972 		}
2973 
2974 		if (sc->chip & RTWN_CHIP_USB) {
2975 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
2976 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) |
2977 			    R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
2978 		}
2979 	} else {
2980 		uint32_t imask = 0;
2981 
2982 		if (sc->chip & RTWN_CHIP_USB)
2983 			imask = 0xffffffff;
2984 		else if (sc->chip & RTWN_CHIP_PCI)
2985 			imask = RTWN_92C_INT_ENABLE;
2986 		else
2987 			panic("unknown chip type 0x%x", sc->chip);
2988 
2989 		/* CLear pending interrupts. */
2990 		rtwn_write_4(sc, R92C_HISR, 0xffffffff);
2991 
2992 		/* Enable interrupts. */
2993 		rtwn_write_4(sc, R92C_HIMR, imask);
2994 	}
2995 }
2996 
2997 void
2998 rtwn_disable_intr(struct rtwn_softc *sc)
2999 {
3000 	if (sc->chip & RTWN_CHIP_88E) {
3001 		rtwn_write_4(sc, R88E_HISR, 0x00000000);
3002 		rtwn_write_4(sc, R88E_HIMR, 0x00000000);
3003 		rtwn_write_4(sc, R88E_HIMRE, 0x00000000);
3004 		if (sc->chip & RTWN_CHIP_USB) {
3005 			rtwn_write_1(sc, R92C_USB_SPECIAL_OPTION,
3006 			    rtwn_read_1(sc, R92C_USB_SPECIAL_OPTION) &
3007 			    ~R92C_USB_SPECIAL_OPTION_INT_BULK_SEL);
3008 		}
3009 	} else {
3010 		rtwn_write_4(sc, R92C_HISR, 0x00000000);
3011 		rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3012 	}
3013 }
3014 
3015 int
3016 rtwn_init(struct ifnet *ifp)
3017 {
3018 	struct rtwn_softc *sc = ifp->if_softc;
3019 	struct ieee80211com *ic = &sc->sc_ic;
3020 	uint32_t reg;
3021 	int i, error;
3022 
3023 	/* Init firmware commands ring. */
3024 	sc->fwcur = 0;
3025 
3026 	error = sc->sc_ops.alloc_buffers(sc->sc_ops.cookie);
3027 	if (error)
3028 		goto fail;
3029 
3030 	/* Power on adapter. */
3031 	error = sc->sc_ops.power_on(sc->sc_ops.cookie);
3032 	if (error != 0) {
3033 		printf("%s: could not power on adapter\n",
3034 		    sc->sc_pdev->dv_xname);
3035 		goto fail;
3036 	}
3037 
3038 	/* Initialize DMA. */
3039 	error = sc->sc_ops.dma_init(sc->sc_ops.cookie);
3040 	if (error != 0) {
3041 		printf("%s: could not initialize DMA\n",
3042 		    sc->sc_pdev->dv_xname);
3043 		goto fail;
3044 	}
3045 
3046 	/* Set info size in Rx descriptors (in 64-bit words). */
3047 	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3048 
3049 	if (sc->chip & RTWN_CHIP_USB) {
3050 		/* Init interrupts. */
3051 		rtwn_enable_intr(sc);
3052 	} else if (sc->chip & RTWN_CHIP_PCI) {
3053 		rtwn_disable_intr(sc);
3054 	}
3055 
3056 	/* Set MAC address. */
3057 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
3058 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3059 		rtwn_write_1(sc, R92C_MACID + i, ic->ic_myaddr[i]);
3060 
3061 	/* Set initial network type. */
3062 	rtwn_set_nettype(sc, IEEE80211_M_MONITOR);
3063 
3064 	rtwn_rxfilter_init(sc);
3065 
3066 	reg = rtwn_read_4(sc, R92C_RRSR);
3067 	if (sc->chip & RTWN_CHIP_USB) {
3068 		reg = RW(reg, R92C_RRSR_RATE_BITMAP,
3069 		    R92C_RRSR_RATE_CCK_ONLY_1M);
3070 	} else {
3071 		reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
3072 	}
3073 	rtwn_write_4(sc, R92C_RRSR, reg);
3074 
3075 	/* Set short/long retry limits. */
3076 	if (sc->chip & RTWN_CHIP_USB) {
3077 		rtwn_write_2(sc, R92C_RL,
3078 		    SM(R92C_RL_SRL, 0x30) | SM(R92C_RL_LRL, 0x30));
3079 	} else {
3080 		rtwn_write_2(sc, R92C_RL,
3081 		    SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
3082 	}
3083 
3084 	/* Initialize EDCA parameters. */
3085 	rtwn_edca_init(sc);
3086 
3087 	/* Set data and response automatic rate fallback retry counts. */
3088 	rtwn_rate_fallback_init(sc);
3089 
3090 	if (sc->chip & RTWN_CHIP_USB) {
3091 		rtwn_write_1(sc, R92C_FWHW_TXQ_CTRL,
3092 		    rtwn_read_1(sc, R92C_FWHW_TXQ_CTRL) |
3093 		    R92C_FWHW_TXQ_CTRL_AMPDU_RTY_NEW);
3094 	} else {
3095 		rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
3096 	}
3097 
3098 	/* Set ACK timeout. */
3099 	rtwn_write_1(sc, R92C_ACKTO, 0x40);
3100 
3101 	/* Setup USB aggregation. */
3102 	if (sc->chip & RTWN_CHIP_USB)
3103 		sc->sc_ops.aggr_init(sc->sc_ops.cookie);
3104 
3105 	/* Initialize beacon parameters. */
3106 	rtwn_write_2(sc, R92C_BCN_CTRL,
3107 	    (R92C_BCN_CTRL_DIS_TSF_UDT0 << 8) | R92C_BCN_CTRL_DIS_TSF_UDT0);
3108 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3109 	rtwn_write_1(sc, R92C_DRVERLYINT, R92C_DRVERLYINT_INIT_TIME);
3110 	rtwn_write_1(sc, R92C_BCNDMATIM, R92C_BCNDMATIM_INIT_TIME);
3111 	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3112 
3113 	if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
3114 		/* Setup AMPDU aggregation. */
3115 		rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3116 		rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3117 		rtwn_write_2(sc, R92C_MAX_AGGR_NUM, 0x0708);
3118 
3119 		rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3120 	}
3121 
3122 	if (sc->chip & RTWN_CHIP_PCI) {
3123 		/* Reset H2C protection register. */
3124 		rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
3125 	}
3126 
3127 	/* Load 8051 microcode. */
3128 	error = rtwn_load_firmware(sc);
3129 	if (error != 0)
3130 		goto fail;
3131 
3132 	/* Initialize MAC/BB/RF blocks. */
3133 	sc->sc_ops.mac_init(sc->sc_ops.cookie);
3134 	sc->sc_ops.bb_init(sc->sc_ops.cookie);
3135 	rtwn_rf_init(sc);
3136 
3137 	if (sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)) {
3138 		rtwn_write_2(sc, R92C_CR,
3139 		    rtwn_read_2(sc, R92C_CR) | R92C_CR_MACTXEN |
3140 		    R92C_CR_MACRXEN);
3141 	}
3142 
3143 	/* Turn CCK and OFDM blocks on. */
3144 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3145 	reg |= R92C_RFMOD_CCK_EN;
3146 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3147 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3148 	reg |= R92C_RFMOD_OFDM_EN;
3149 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3150 
3151 	/* Clear per-station keys table. */
3152 	rtwn_cam_init(sc);
3153 
3154 	/* Enable hardware sequence numbering. */
3155 	rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3156 
3157 	if (sc->chip & RTWN_CHIP_92E) {
3158 		rtwn_write_4(sc, R92C_BAR_MODE_CTRL, 0x0201ffff);
3159 		rtwn_write_1(sc, R92C_NAV_UPPER, 0);
3160 
3161 		rtwn_write_1(sc, R92C_QUEUE_CTRL,
3162 		    rtwn_read_1(sc, R92C_QUEUE_CTRL) & ~0x08);
3163 	}
3164 
3165 	/* Perform LO and IQ calibrations. */
3166 	rtwn_iq_calib(sc);
3167 	/* Perform LC calibration. */
3168 	rtwn_lc_calib(sc);
3169 
3170 	/* Fix USB interference issue. */
3171 	if (sc->chip & RTWN_CHIP_USB) {
3172 		if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E))) {
3173 			rtwn_write_1(sc, 0xfe40, 0xe0);
3174 			rtwn_write_1(sc, 0xfe41, 0x8d);
3175 			rtwn_write_1(sc, 0xfe42, 0x80);
3176 
3177 			rtwn_pa_bias_init(sc);
3178 		}
3179 	}
3180 
3181 	/* Initialize GPIO setting. */
3182 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
3183 	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3184 
3185 	/* Fix for lower temperature. */
3186 	if (!(sc->chip & (RTWN_CHIP_88E | RTWN_CHIP_92E)))
3187 		rtwn_write_1(sc, 0x15, 0xe9);
3188 
3189 	/* Set default channel. */
3190 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
3191 	rtwn_set_chan(sc, ic->ic_ibss_chan, NULL);
3192 
3193 	if (sc->chip & RTWN_CHIP_PCI)
3194 		rtwn_enable_intr(sc);
3195 
3196 	error = sc->sc_ops.init(sc->sc_ops.cookie);
3197 	if (error)
3198 		goto fail;
3199 
3200 	/* We're ready to go. */
3201 	ifq_clr_oactive(&ifp->if_snd);
3202 	ifp->if_flags |= IFF_RUNNING;
3203 
3204 #ifdef notyet
3205 	if (ic->ic_flags & IEEE80211_F_WEPON) {
3206 		/* Install WEP keys. */
3207 		for (i = 0; i < IEEE80211_WEP_NKID; i++)
3208 			ic->ic_set_key(ic, NULL, &ic->ic_nw_keys[i]);
3209 		sc->sc_ops.wait_async(sc->sc_ops.cookie);
3210 	}
3211 #endif
3212 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3213 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3214 	else
3215 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3216 	return (0);
3217 fail:
3218 	rtwn_stop(ifp);
3219 	return (error);
3220 }
3221 
3222 void
3223 rtwn_init_task(void *arg1)
3224 {
3225 	struct rtwn_softc *sc = arg1;
3226 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3227 	int s;
3228 
3229 	s = splnet();
3230 	while (sc->sc_flags & RTWN_FLAG_BUSY)
3231 		tsleep(&sc->sc_flags, 0, "rtwnpwr", 0);
3232 	sc->sc_flags |= RTWN_FLAG_BUSY;
3233 
3234 	rtwn_stop(ifp);
3235 
3236 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == IFF_UP)
3237 		rtwn_init(ifp);
3238 
3239 	sc->sc_flags &= ~RTWN_FLAG_BUSY;
3240 	wakeup(&sc->sc_flags);
3241 	splx(s);
3242 }
3243 
3244 void
3245 rtwn_stop(struct ifnet *ifp)
3246 {
3247 	struct rtwn_softc *sc = ifp->if_softc;
3248 	struct ieee80211com *ic = &sc->sc_ic;
3249 	int s;
3250 
3251 	sc->sc_tx_timer = 0;
3252 	ifp->if_timer = 0;
3253 	ifp->if_flags &= ~IFF_RUNNING;
3254 	ifq_clr_oactive(&ifp->if_snd);
3255 
3256 	s = splnet();
3257 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3258 	splx(s);
3259 
3260 	sc->sc_ops.wait_async(sc->sc_ops.cookie);
3261 
3262 	s = splnet();
3263 
3264 	sc->sc_ops.cancel_scan(sc->sc_ops.cookie);
3265 	sc->sc_ops.cancel_calib(sc->sc_ops.cookie);
3266 
3267 	task_del(systq, &sc->init_task);
3268 
3269 	splx(s);
3270 
3271 	sc->sc_ops.stop(sc->sc_ops.cookie);
3272 }
3273