xref: /freebsd/sys/dev/rtwn/if_rtwn.c (revision 907b59d76938e654f0d040a888e8dfca3de1e222)
1 /*	$OpenBSD: if_rtwn.c,v 1.6 2015/08/28 00:03:53 deraadt Exp $	*/
2 
3 /*-
4  * Copyright (c) 2010 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2015 Stefan Sperling <stsp@openbsd.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
22 
23 /*
24  * Driver for Realtek RTL8188CE
25  */
26 
27 #include <sys/param.h>
28 #include <sys/sysctl.h>
29 #include <sys/sockio.h>
30 #include <sys/mbuf.h>
31 #include <sys/kernel.h>
32 #include <sys/socket.h>
33 #include <sys/systm.h>
34 #include <sys/malloc.h>
35 #include <sys/lock.h>
36 #include <sys/mutex.h>
37 #include <sys/module.h>
38 #include <sys/bus.h>
39 #include <sys/endian.h>
40 #include <sys/firmware.h>
41 
42 #include <machine/bus.h>
43 #include <machine/resource.h>
44 #include <sys/rman.h>
45 
46 #include <dev/pci/pcireg.h>
47 #include <dev/pci/pcivar.h>
48 
49 #include <net/bpf.h>
50 #include <net/if.h>
51 #include <net/if_var.h>
52 #include <net/if_arp.h>
53 #include <net/ethernet.h>
54 #include <net/if_dl.h>
55 #include <net/if_media.h>
56 #include <net/if_types.h>
57 
58 #include <net80211/ieee80211_var.h>
59 #include <net80211/ieee80211_radiotap.h>
60 #include <net80211/ieee80211_regdomain.h>
61 #include <net80211/ieee80211_ratectl.h>
62 
63 #include <netinet/in.h>
64 #include <netinet/in_systm.h>
65 #include <netinet/in_var.h>
66 #include <netinet/ip.h>
67 #include <netinet/if_ether.h>
68 
69 #include <dev/rtwn/if_rtwnreg.h>
70 
71 #define	RTWN_DEBUG
72 #ifdef RTWN_DEBUG
73 #define	DPRINTF(x)	do { if (sc->sc_debug > 0) printf x; } while (0)
74 #define	DPRINTFN(n, x)	do { if (sc->sc_debug >= (n)) printf x; } while (0)
75 #else
76 #define	DPRINTF(x)
77 #define	DPRINTFN(n, x)
78 #endif
79 
80 /*
81  * PCI configuration space registers.
82  */
83 #define	RTWN_PCI_IOBA		0x10	/* i/o mapped base */
84 #define	RTWN_PCI_MMBA		0x18	/* memory mapped base */
85 
86 #define RTWN_INT_ENABLE	(R92C_IMR_ROK | R92C_IMR_VODOK | R92C_IMR_VIDOK | \
87 			R92C_IMR_BEDOK | R92C_IMR_BKDOK | R92C_IMR_MGNTDOK | \
88 			R92C_IMR_HIGHDOK | R92C_IMR_BDOK | R92C_IMR_RDU | \
89 			R92C_IMR_RXFOVW)
90 
91 struct rtwn_ident {
92 	uint16_t	vendor;
93 	uint16_t	device;
94 	const char	*name;
95 };
96 
97 
98 static const struct rtwn_ident rtwn_ident_table[] = {
99 	{ 0x10ec, 0x8176, "Realtek RTL8188CE" },
100 	{ 0, 0, NULL }
101 };
102 
103 
104 static void	rtwn_dma_map_addr(void *, bus_dma_segment_t *, int, int);
105 static void	rtwn_setup_rx_desc(struct rtwn_softc *, struct r92c_rx_desc *,
106 		    bus_addr_t, size_t, int);
107 static int	rtwn_alloc_rx_list(struct rtwn_softc *);
108 static void	rtwn_reset_rx_list(struct rtwn_softc *);
109 static void	rtwn_free_rx_list(struct rtwn_softc *);
110 static int	rtwn_alloc_tx_list(struct rtwn_softc *, int);
111 static void	rtwn_reset_tx_list(struct rtwn_softc *, int);
112 static void	rtwn_free_tx_list(struct rtwn_softc *, int);
113 static struct ieee80211vap *rtwn_vap_create(struct ieee80211com *,
114 		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
115 		    const uint8_t [IEEE80211_ADDR_LEN],
116 		    const uint8_t [IEEE80211_ADDR_LEN]);
117 static void	rtwn_vap_delete(struct ieee80211vap *);
118 static void	rtwn_write_1(struct rtwn_softc *, uint16_t, uint8_t);
119 static void	rtwn_write_2(struct rtwn_softc *, uint16_t, uint16_t);
120 static void	rtwn_write_4(struct rtwn_softc *, uint16_t, uint32_t);
121 static uint8_t	rtwn_read_1(struct rtwn_softc *, uint16_t);
122 static uint16_t	rtwn_read_2(struct rtwn_softc *, uint16_t);
123 static uint32_t	rtwn_read_4(struct rtwn_softc *, uint16_t);
124 static int	rtwn_fw_cmd(struct rtwn_softc *, uint8_t, const void *, int);
125 static void	rtwn_rf_write(struct rtwn_softc *, int, uint8_t, uint32_t);
126 static uint32_t	rtwn_rf_read(struct rtwn_softc *, int, uint8_t);
127 static int	rtwn_llt_write(struct rtwn_softc *, uint32_t, uint32_t);
128 static uint8_t	rtwn_efuse_read_1(struct rtwn_softc *, uint16_t);
129 static void	rtwn_efuse_read(struct rtwn_softc *);
130 static int	rtwn_read_chipid(struct rtwn_softc *);
131 static void	rtwn_read_rom(struct rtwn_softc *);
132 static int	rtwn_ra_init(struct rtwn_softc *);
133 static void	rtwn_tsf_sync_enable(struct rtwn_softc *);
134 static void	rtwn_set_led(struct rtwn_softc *, int, int);
135 static void	rtwn_calib_to(void *);
136 static int	rtwn_newstate(struct ieee80211vap *, enum ieee80211_state, int);
137 static int	rtwn_updateedca(struct ieee80211com *);
138 static void	rtwn_update_avgrssi(struct rtwn_softc *, int, int8_t);
139 static int8_t	rtwn_get_rssi(struct rtwn_softc *, int, void *);
140 static void	rtwn_rx_frame(struct rtwn_softc *, struct r92c_rx_desc *,
141 		    struct rtwn_rx_data *, int);
142 static int	rtwn_tx(struct rtwn_softc *, struct mbuf *,
143 		    struct ieee80211_node *);
144 static void	rtwn_tx_done(struct rtwn_softc *, int);
145 static int	rtwn_raw_xmit(struct ieee80211_node *, struct mbuf *,
146 		    const struct ieee80211_bpf_params *);
147 static int	rtwn_transmit(struct ieee80211com *, struct mbuf *);
148 static void	rtwn_parent(struct ieee80211com *);
149 static void	rtwn_start(struct rtwn_softc *sc);
150 static void	rtwn_watchdog(void *);
151 static int	rtwn_power_on(struct rtwn_softc *);
152 static int	rtwn_llt_init(struct rtwn_softc *);
153 static void	rtwn_fw_reset(struct rtwn_softc *);
154 static void	rtwn_fw_loadpage(struct rtwn_softc *, int, const uint8_t *,
155 		    int);
156 static int	rtwn_load_firmware(struct rtwn_softc *);
157 static int	rtwn_dma_init(struct rtwn_softc *);
158 static void	rtwn_mac_init(struct rtwn_softc *);
159 static void	rtwn_bb_init(struct rtwn_softc *);
160 static void	rtwn_rf_init(struct rtwn_softc *);
161 static void	rtwn_cam_init(struct rtwn_softc *);
162 static void	rtwn_pa_bias_init(struct rtwn_softc *);
163 static void	rtwn_rxfilter_init(struct rtwn_softc *);
164 static void	rtwn_edca_init(struct rtwn_softc *);
165 static void	rtwn_write_txpower(struct rtwn_softc *, int, uint16_t[]);
166 static void	rtwn_get_txpower(struct rtwn_softc *, int,
167 		    struct ieee80211_channel *, struct ieee80211_channel *,
168 		    uint16_t[]);
169 static void	rtwn_set_txpower(struct rtwn_softc *,
170 		    struct ieee80211_channel *, struct ieee80211_channel *);
171 static void	rtwn_set_rx_bssid_all(struct rtwn_softc *, int);
172 static void	rtwn_set_gain(struct rtwn_softc *, uint8_t);
173 static void	rtwn_scan_start(struct ieee80211com *);
174 static void	rtwn_scan_end(struct ieee80211com *);
175 static void	rtwn_getradiocaps(struct ieee80211com *, int, int *,
176 		    struct ieee80211_channel[]);
177 static void	rtwn_set_channel(struct ieee80211com *);
178 static void	rtwn_update_mcast(struct ieee80211com *);
179 static void	rtwn_set_chan(struct rtwn_softc *,
180 		    struct ieee80211_channel *, struct ieee80211_channel *);
181 static int	rtwn_iq_calib_chain(struct rtwn_softc *, int, uint16_t[2],
182 		    uint16_t[2]);
183 static void	rtwn_iq_calib_run(struct rtwn_softc *, int, uint16_t[2][2],
184 		    uint16_t[2][2]);
185 static int	rtwn_iq_calib_compare_results(uint16_t[2][2], uint16_t[2][2],
186 		    uint16_t[2][2], uint16_t[2][2], int);
187 static void	rtwn_iq_calib_write_results(struct rtwn_softc *, uint16_t[2],
188 		    uint16_t[2], int);
189 static void	rtwn_iq_calib(struct rtwn_softc *);
190 static void	rtwn_lc_calib(struct rtwn_softc *);
191 static void	rtwn_temp_calib(struct rtwn_softc *);
192 static int	rtwn_init(struct rtwn_softc *);
193 static void	rtwn_stop_locked(struct rtwn_softc *);
194 static void	rtwn_stop(struct rtwn_softc *);
195 static void	rtwn_intr(void *);
196 
197 /* Aliases. */
198 #define	rtwn_bb_write	rtwn_write_4
199 #define rtwn_bb_read	rtwn_read_4
200 
201 static int	rtwn_probe(device_t);
202 static int	rtwn_attach(device_t);
203 static int	rtwn_detach(device_t);
204 static int	rtwn_shutdown(device_t);
205 static int	rtwn_suspend(device_t);
206 static int	rtwn_resume(device_t);
207 
208 static device_method_t rtwn_methods[] = {
209 	/* Device interface */
210 	DEVMETHOD(device_probe,		rtwn_probe),
211 	DEVMETHOD(device_attach,	rtwn_attach),
212 	DEVMETHOD(device_detach,	rtwn_detach),
213 	DEVMETHOD(device_shutdown,	rtwn_shutdown),
214 	DEVMETHOD(device_suspend,	rtwn_suspend),
215 	DEVMETHOD(device_resume,	rtwn_resume),
216 
217 	DEVMETHOD_END
218 };
219 
220 static driver_t rtwn_driver = {
221 	"rtwn",
222 	rtwn_methods,
223 	sizeof (struct rtwn_softc)
224 };
225 static devclass_t rtwn_devclass;
226 
227 DRIVER_MODULE(rtwn, pci, rtwn_driver, rtwn_devclass, NULL, NULL);
228 
229 MODULE_VERSION(rtwn, 1);
230 
231 MODULE_DEPEND(rtwn, pci,  1, 1, 1);
232 MODULE_DEPEND(rtwn, wlan, 1, 1, 1);
233 MODULE_DEPEND(rtwn, firmware, 1, 1, 1);
234 
235 static const uint8_t rtwn_chan_2ghz[] =
236 	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
237 
238 static int
239 rtwn_probe(device_t dev)
240 {
241 	const struct rtwn_ident *ident;
242 
243 	for (ident = rtwn_ident_table; ident->name != NULL; ident++) {
244 		if (pci_get_vendor(dev) == ident->vendor &&
245 		    pci_get_device(dev) == ident->device) {
246 			device_set_desc(dev, ident->name);
247 			return (BUS_PROBE_DEFAULT);
248 		}
249 	}
250 	return (ENXIO);
251 }
252 
253 static int
254 rtwn_attach(device_t dev)
255 {
256 	struct rtwn_softc *sc = device_get_softc(dev);
257 	struct ieee80211com *ic = &sc->sc_ic;
258 	uint32_t lcsr;
259 	int i, count, error, rid;
260 
261 	sc->sc_dev = dev;
262 	sc->sc_debug = 0;
263 
264 	/*
265 	 * Get the offset of the PCI Express Capability Structure in PCI
266 	 * Configuration Space.
267 	 */
268 	error = pci_find_cap(dev, PCIY_EXPRESS, &sc->sc_cap_off);
269 	if (error != 0) {
270 		device_printf(dev, "PCIe capability structure not found!\n");
271 		return (error);
272 	}
273 
274 	/* Enable bus-mastering. */
275 	pci_enable_busmaster(dev);
276 
277 	rid = PCIR_BAR(2);
278 	sc->mem = bus_alloc_resource_any(dev, SYS_RES_MEMORY, &rid,
279 	    RF_ACTIVE);
280 	if (sc->mem == NULL) {
281 		device_printf(dev, "can't map mem space\n");
282 		return (ENOMEM);
283 	}
284 	sc->sc_st = rman_get_bustag(sc->mem);
285 	sc->sc_sh = rman_get_bushandle(sc->mem);
286 
287 	/* Install interrupt handler. */
288 	count = 1;
289 	rid = 0;
290 	if (pci_alloc_msi(dev, &count) == 0)
291 		rid = 1;
292 	sc->irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &rid, RF_ACTIVE |
293 	    (rid != 0 ? 0 : RF_SHAREABLE));
294 	if (sc->irq == NULL) {
295 		device_printf(dev, "can't map interrupt\n");
296 		return (ENXIO);
297 	}
298 
299 	RTWN_LOCK_INIT(sc);
300 	callout_init_mtx(&sc->calib_to, &sc->sc_mtx, 0);
301 	callout_init_mtx(&sc->watchdog_to, &sc->sc_mtx, 0);
302 	mbufq_init(&sc->sc_snd, ifqmaxlen);
303 
304 	error = rtwn_read_chipid(sc);
305 	if (error != 0) {
306 		device_printf(dev, "unsupported test chip\n");
307 		goto fail;
308 	}
309 
310 	/* Disable PCIe Active State Power Management (ASPM). */
311 	lcsr = pci_read_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, 4);
312 	lcsr &= ~PCIEM_LINK_CTL_ASPMC;
313 	pci_write_config(sc->sc_dev, sc->sc_cap_off + PCIER_LINK_CTL, lcsr, 4);
314 
315 	/* Allocate Tx/Rx buffers. */
316 	error = rtwn_alloc_rx_list(sc);
317 	if (error != 0) {
318 		device_printf(dev, "could not allocate Rx buffers\n");
319 		goto fail;
320 	}
321 	for (i = 0; i < RTWN_NTXQUEUES; i++) {
322 		error = rtwn_alloc_tx_list(sc, i);
323 		if (error != 0) {
324 			device_printf(dev, "could not allocate Tx buffers\n");
325 			goto fail;
326 		}
327 	}
328 
329 	/* Determine number of Tx/Rx chains. */
330 	if (sc->chip & RTWN_CHIP_92C) {
331 		sc->ntxchains = (sc->chip & RTWN_CHIP_92C_1T2R) ? 1 : 2;
332 		sc->nrxchains = 2;
333 	} else {
334 		sc->ntxchains = 1;
335 		sc->nrxchains = 1;
336 	}
337 	rtwn_read_rom(sc);
338 
339 	device_printf(sc->sc_dev, "MAC/BB RTL%s, RF 6052 %dT%dR\n",
340 	    (sc->chip & RTWN_CHIP_92C) ? "8192CE" : "8188CE",
341 	    sc->ntxchains, sc->nrxchains);
342 
343 	ic->ic_softc = sc;
344 	ic->ic_name = device_get_nameunit(dev);
345 	ic->ic_opmode = IEEE80211_M_STA;
346 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
347 
348 	/* set device capabilities */
349 	ic->ic_caps =
350 		  IEEE80211_C_STA		/* station mode */
351 		| IEEE80211_C_MONITOR		/* monitor mode */
352 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
353 		| IEEE80211_C_SHSLOT		/* short slot time supported */
354 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
355 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
356 		| IEEE80211_C_WME		/* 802.11e */
357 		;
358 
359 	/* XXX TODO: setup regdomain if R92C_CHANNEL_PLAN_BY_HW bit is set. */
360 
361 	rtwn_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
362 	    ic->ic_channels);
363 
364 	ieee80211_ifattach(ic);
365 
366 	ic->ic_wme.wme_update = rtwn_updateedca;
367 	ic->ic_update_mcast = rtwn_update_mcast;
368 	ic->ic_scan_start = rtwn_scan_start;
369 	ic->ic_scan_end = rtwn_scan_end;
370 	ic->ic_getradiocaps = rtwn_getradiocaps;
371 	ic->ic_set_channel = rtwn_set_channel;
372 	ic->ic_raw_xmit = rtwn_raw_xmit;
373 	ic->ic_transmit = rtwn_transmit;
374 	ic->ic_parent = rtwn_parent;
375 	ic->ic_vap_create = rtwn_vap_create;
376 	ic->ic_vap_delete = rtwn_vap_delete;
377 
378 	ieee80211_radiotap_attach(ic,
379 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
380 		RTWN_TX_RADIOTAP_PRESENT,
381 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
382 		RTWN_RX_RADIOTAP_PRESENT);
383 
384 	/*
385 	 * Hook our interrupt after all initialization is complete.
386 	 */
387 	error = bus_setup_intr(dev, sc->irq, INTR_TYPE_NET | INTR_MPSAFE,
388 	    NULL, rtwn_intr, sc, &sc->sc_ih);
389 	if (error != 0) {
390 		device_printf(dev, "can't establish interrupt, error %d\n",
391 		    error);
392 		goto fail;
393 	}
394 
395 	if (bootverbose)
396 		ieee80211_announce(ic);
397 
398 	return (0);
399 
400 fail:
401 	rtwn_detach(dev);
402 	return (error);
403 }
404 
405 
406 static int
407 rtwn_detach(device_t dev)
408 {
409 	struct rtwn_softc *sc = device_get_softc(dev);
410 	int i;
411 
412 	if (sc->sc_ic.ic_softc != NULL) {
413 		rtwn_stop(sc);
414 
415 		callout_drain(&sc->calib_to);
416 		callout_drain(&sc->watchdog_to);
417 		ieee80211_ifdetach(&sc->sc_ic);
418 		mbufq_drain(&sc->sc_snd);
419 	}
420 
421 	/* Uninstall interrupt handler. */
422 	if (sc->irq != NULL) {
423 		bus_teardown_intr(dev, sc->irq, sc->sc_ih);
424 		bus_release_resource(dev, SYS_RES_IRQ, rman_get_rid(sc->irq),
425 		    sc->irq);
426 		pci_release_msi(dev);
427 	}
428 
429 	/* Free Tx/Rx buffers. */
430 	for (i = 0; i < RTWN_NTXQUEUES; i++)
431 		rtwn_free_tx_list(sc, i);
432 	rtwn_free_rx_list(sc);
433 
434 	if (sc->mem != NULL)
435 		bus_release_resource(dev, SYS_RES_MEMORY,
436 		    rman_get_rid(sc->mem), sc->mem);
437 
438 	RTWN_LOCK_DESTROY(sc);
439 	return (0);
440 }
441 
442 static int
443 rtwn_shutdown(device_t dev)
444 {
445 
446 	return (0);
447 }
448 
449 static int
450 rtwn_suspend(device_t dev)
451 {
452 	return (0);
453 }
454 
455 static int
456 rtwn_resume(device_t dev)
457 {
458 
459 	return (0);
460 }
461 
462 static void
463 rtwn_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nsegs, int error)
464 {
465 
466 	if (error != 0)
467 		return;
468 	KASSERT(nsegs == 1, ("too many DMA segments, %d should be 1", nsegs));
469 	*(bus_addr_t *)arg = segs[0].ds_addr;
470 }
471 
472 static void
473 rtwn_setup_rx_desc(struct rtwn_softc *sc, struct r92c_rx_desc *desc,
474     bus_addr_t addr, size_t len, int idx)
475 {
476 
477 	memset(desc, 0, sizeof(*desc));
478 	desc->rxdw0 = htole32(SM(R92C_RXDW0_PKTLEN, len) |
479 		((idx == RTWN_RX_LIST_COUNT - 1) ? R92C_RXDW0_EOR : 0));
480 	desc->rxbufaddr = htole32(addr);
481 	bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
482 	    BUS_SPACE_BARRIER_WRITE);
483 	desc->rxdw0 |= htole32(R92C_RXDW0_OWN);
484 }
485 
486 static int
487 rtwn_alloc_rx_list(struct rtwn_softc *sc)
488 {
489 	struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
490 	struct rtwn_rx_data *rx_data;
491 	bus_size_t size;
492 	int i, error;
493 
494 	/* Allocate Rx descriptors. */
495 	size = sizeof(struct r92c_rx_desc) * RTWN_RX_LIST_COUNT;
496 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
497 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
498 	    size, 1, size, 0, NULL, NULL, &rx_ring->desc_dmat);
499 	if (error != 0) {
500 		device_printf(sc->sc_dev, "could not create rx desc DMA tag\n");
501 		goto fail;
502 	}
503 
504 	error = bus_dmamem_alloc(rx_ring->desc_dmat, (void **)&rx_ring->desc,
505 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO | BUS_DMA_COHERENT,
506 	    &rx_ring->desc_map);
507 	if (error != 0) {
508 		device_printf(sc->sc_dev, "could not allocate rx desc\n");
509 		goto fail;
510 	}
511 	error = bus_dmamap_load(rx_ring->desc_dmat, rx_ring->desc_map,
512 	    rx_ring->desc, size, rtwn_dma_map_addr, &rx_ring->paddr, 0);
513 	if (error != 0) {
514 		device_printf(sc->sc_dev, "could not load rx desc DMA map\n");
515 		goto fail;
516 	}
517 	bus_dmamap_sync(rx_ring->desc_dmat, rx_ring->desc_map,
518 	    BUS_DMASYNC_PREWRITE);
519 
520 	/* Create RX buffer DMA tag. */
521 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
522 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
523 	    1, MCLBYTES, 0, NULL, NULL, &rx_ring->data_dmat);
524 	if (error != 0) {
525 		device_printf(sc->sc_dev, "could not create rx buf DMA tag\n");
526 		goto fail;
527 	}
528 
529 	/* Allocate Rx buffers. */
530 	for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
531 		rx_data = &rx_ring->rx_data[i];
532 		error = bus_dmamap_create(rx_ring->data_dmat, 0, &rx_data->map);
533 		if (error != 0) {
534 			device_printf(sc->sc_dev,
535 			    "could not create rx buf DMA map\n");
536 			goto fail;
537 		}
538 
539 		rx_data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
540 		if (rx_data->m == NULL) {
541 			device_printf(sc->sc_dev,
542 			    "could not allocate rx mbuf\n");
543 			error = ENOMEM;
544 			goto fail;
545 		}
546 
547 		error = bus_dmamap_load(rx_ring->data_dmat, rx_data->map,
548 		    mtod(rx_data->m, void *), MCLBYTES, rtwn_dma_map_addr,
549 		    &rx_data->paddr, BUS_DMA_NOWAIT);
550 		if (error != 0) {
551 			device_printf(sc->sc_dev,
552 			    "could not load rx buf DMA map");
553 			goto fail;
554 		}
555 
556 		rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
557 		    MCLBYTES, i);
558 	}
559 	return (0);
560 
561 fail:
562 	rtwn_free_rx_list(sc);
563 	return (error);
564 }
565 
566 static void
567 rtwn_reset_rx_list(struct rtwn_softc *sc)
568 {
569 	struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
570 	struct rtwn_rx_data *rx_data;
571 	int i;
572 
573 	for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
574 		rx_data = &rx_ring->rx_data[i];
575 		rtwn_setup_rx_desc(sc, &rx_ring->desc[i], rx_data->paddr,
576 		    MCLBYTES, i);
577 	}
578 }
579 
580 static void
581 rtwn_free_rx_list(struct rtwn_softc *sc)
582 {
583 	struct rtwn_rx_ring *rx_ring = &sc->rx_ring;
584 	struct rtwn_rx_data *rx_data;
585 	int i;
586 
587 	if (rx_ring->desc_dmat != NULL) {
588 		if (rx_ring->desc != NULL) {
589 			bus_dmamap_sync(rx_ring->desc_dmat,
590 			    rx_ring->desc_map,
591 			    BUS_DMASYNC_POSTREAD | BUS_DMASYNC_POSTWRITE);
592 			bus_dmamap_unload(rx_ring->desc_dmat,
593 			    rx_ring->desc_map);
594 			bus_dmamem_free(rx_ring->desc_dmat, rx_ring->desc,
595 			    rx_ring->desc_map);
596 			rx_ring->desc = NULL;
597 		}
598 		bus_dma_tag_destroy(rx_ring->desc_dmat);
599 		rx_ring->desc_dmat = NULL;
600 	}
601 
602 	for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
603 		rx_data = &rx_ring->rx_data[i];
604 
605 		if (rx_data->m != NULL) {
606 			bus_dmamap_sync(rx_ring->data_dmat,
607 			    rx_data->map, BUS_DMASYNC_POSTREAD);
608 			bus_dmamap_unload(rx_ring->data_dmat, rx_data->map);
609 			m_freem(rx_data->m);
610 			rx_data->m = NULL;
611 		}
612 		bus_dmamap_destroy(rx_ring->data_dmat, rx_data->map);
613 		rx_data->map = NULL;
614 	}
615 	if (rx_ring->data_dmat != NULL) {
616 		bus_dma_tag_destroy(rx_ring->data_dmat);
617 		rx_ring->data_dmat = NULL;
618 	}
619 }
620 
621 static int
622 rtwn_alloc_tx_list(struct rtwn_softc *sc, int qid)
623 {
624 	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
625 	struct rtwn_tx_data *tx_data;
626 	bus_size_t size;
627 	int i, error;
628 
629 	size = sizeof(struct r92c_tx_desc) * RTWN_TX_LIST_COUNT;
630 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), PAGE_SIZE, 0,
631 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
632 	    size, 1, size, 0, NULL, NULL, &tx_ring->desc_dmat);
633 	if (error != 0) {
634 		device_printf(sc->sc_dev, "could not create tx ring DMA tag\n");
635 		goto fail;
636 	}
637 
638 	error = bus_dmamem_alloc(tx_ring->desc_dmat, (void **)&tx_ring->desc,
639 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &tx_ring->desc_map);
640 	if (error != 0) {
641 		device_printf(sc->sc_dev, "can't map tx ring DMA memory\n");
642 		goto fail;
643 	}
644 	error = bus_dmamap_load(tx_ring->desc_dmat, tx_ring->desc_map,
645 	    tx_ring->desc, size, rtwn_dma_map_addr, &tx_ring->paddr,
646 	    BUS_DMA_NOWAIT);
647 	if (error != 0) {
648 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
649 		goto fail;
650 	}
651 	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
652 	    BUS_DMASYNC_PREWRITE);
653 
654 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
655 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
656 	    1, MCLBYTES, 0, NULL, NULL, &tx_ring->data_dmat);
657 	if (error != 0) {
658 		device_printf(sc->sc_dev, "could not create tx buf DMA tag\n");
659 		goto fail;
660 	}
661 
662 	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
663 		struct r92c_tx_desc *desc = &tx_ring->desc[i];
664 
665 		/* setup tx desc */
666 		desc->nextdescaddr = htole32(tx_ring->paddr +
667 		    + sizeof(struct r92c_tx_desc)
668 		    * ((i + 1) % RTWN_TX_LIST_COUNT));
669 		tx_data = &tx_ring->tx_data[i];
670 		error = bus_dmamap_create(tx_ring->data_dmat, 0, &tx_data->map);
671 		if (error != 0) {
672 			device_printf(sc->sc_dev,
673 			    "could not create tx buf DMA map\n");
674 			goto fail;
675 		}
676 		tx_data->m = NULL;
677 		tx_data->ni = NULL;
678 	}
679 	return (0);
680 
681 fail:
682 	rtwn_free_tx_list(sc, qid);
683 	return (error);
684 }
685 
686 static void
687 rtwn_reset_tx_list(struct rtwn_softc *sc, int qid)
688 {
689 	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
690 	int i;
691 
692 	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
693 		struct r92c_tx_desc *desc = &tx_ring->desc[i];
694 		struct rtwn_tx_data *tx_data = &tx_ring->tx_data[i];
695 
696 		memset(desc, 0, sizeof(*desc) -
697 		    (sizeof(desc->reserved) + sizeof(desc->nextdescaddr64) +
698 		    sizeof(desc->nextdescaddr)));
699 
700 		if (tx_data->m != NULL) {
701 			bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
702 			    BUS_DMASYNC_POSTWRITE);
703 			bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
704 			m_freem(tx_data->m);
705 			tx_data->m = NULL;
706 		}
707 		if (tx_data->ni != NULL) {
708 			ieee80211_free_node(tx_data->ni);
709 			tx_data->ni = NULL;
710 		}
711 	}
712 
713 	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
714 	    BUS_DMASYNC_POSTWRITE);
715 
716 	sc->qfullmsk &= ~(1 << qid);
717 	tx_ring->queued = 0;
718 	tx_ring->cur = 0;
719 }
720 
721 static void
722 rtwn_free_tx_list(struct rtwn_softc *sc, int qid)
723 {
724 	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
725 	struct rtwn_tx_data *tx_data;
726 	int i;
727 
728 	if (tx_ring->desc_dmat != NULL) {
729 		if (tx_ring->desc != NULL) {
730 			bus_dmamap_sync(tx_ring->desc_dmat,
731 			    tx_ring->desc_map, BUS_DMASYNC_POSTWRITE);
732 			bus_dmamap_unload(tx_ring->desc_dmat,
733 			    tx_ring->desc_map);
734 			bus_dmamem_free(tx_ring->desc_dmat, tx_ring->desc,
735 			    tx_ring->desc_map);
736 		}
737 		bus_dma_tag_destroy(tx_ring->desc_dmat);
738 	}
739 
740 	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
741 		tx_data = &tx_ring->tx_data[i];
742 
743 		if (tx_data->m != NULL) {
744 			bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
745 			    BUS_DMASYNC_POSTWRITE);
746 			bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
747 			m_freem(tx_data->m);
748 			tx_data->m = NULL;
749 		}
750 	}
751 	if (tx_ring->data_dmat != NULL) {
752 		bus_dma_tag_destroy(tx_ring->data_dmat);
753 		tx_ring->data_dmat = NULL;
754 	}
755 
756 	sc->qfullmsk &= ~(1 << qid);
757 	tx_ring->queued = 0;
758 	tx_ring->cur = 0;
759 }
760 
761 
762 static struct ieee80211vap *
763 rtwn_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
764     enum ieee80211_opmode opmode, int flags,
765     const uint8_t bssid[IEEE80211_ADDR_LEN],
766     const uint8_t mac[IEEE80211_ADDR_LEN])
767 {
768 	struct rtwn_vap *rvp;
769 	struct ieee80211vap *vap;
770 
771 	if (!TAILQ_EMPTY(&ic->ic_vaps))
772 		return (NULL);
773 
774 	rvp = malloc(sizeof(struct rtwn_vap), M_80211_VAP, M_WAITOK | M_ZERO);
775 	vap = &rvp->vap;
776 	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
777 	    flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
778 		/* out of memory */
779 		 free(rvp, M_80211_VAP);
780 		 return (NULL);
781 	}
782 
783 	/* Override state transition machine. */
784 	rvp->newstate = vap->iv_newstate;
785 	vap->iv_newstate = rtwn_newstate;
786 
787 	/* Complete setup. */
788 	ieee80211_vap_attach(vap, ieee80211_media_change,
789 	    ieee80211_media_status, mac);
790 	ic->ic_opmode = opmode;
791 	return (vap);
792 }
793 
794 static void
795 rtwn_vap_delete(struct ieee80211vap *vap)
796 {
797 	struct rtwn_vap *rvp = RTWN_VAP(vap);
798 
799 	ieee80211_vap_detach(vap);
800 	free(rvp, M_80211_VAP);
801 }
802 
803 static void
804 rtwn_write_1(struct rtwn_softc *sc, uint16_t addr, uint8_t val)
805 {
806 
807 	bus_space_write_1(sc->sc_st, sc->sc_sh, addr, val);
808 }
809 
810 static void
811 rtwn_write_2(struct rtwn_softc *sc, uint16_t addr, uint16_t val)
812 {
813 
814 	val = htole16(val);
815 	bus_space_write_2(sc->sc_st, sc->sc_sh, addr, val);
816 }
817 
818 static void
819 rtwn_write_4(struct rtwn_softc *sc, uint16_t addr, uint32_t val)
820 {
821 
822 	val = htole32(val);
823 	bus_space_write_4(sc->sc_st, sc->sc_sh, addr, val);
824 }
825 
826 static uint8_t
827 rtwn_read_1(struct rtwn_softc *sc, uint16_t addr)
828 {
829 
830 	return (bus_space_read_1(sc->sc_st, sc->sc_sh, addr));
831 }
832 
833 static uint16_t
834 rtwn_read_2(struct rtwn_softc *sc, uint16_t addr)
835 {
836 
837 	return (bus_space_read_2(sc->sc_st, sc->sc_sh, addr));
838 }
839 
840 static uint32_t
841 rtwn_read_4(struct rtwn_softc *sc, uint16_t addr)
842 {
843 
844 	return (bus_space_read_4(sc->sc_st, sc->sc_sh, addr));
845 }
846 
847 static int
848 rtwn_fw_cmd(struct rtwn_softc *sc, uint8_t id, const void *buf, int len)
849 {
850 	struct r92c_fw_cmd cmd;
851 	int ntries;
852 
853 	/* Wait for current FW box to be empty. */
854 	for (ntries = 0; ntries < 100; ntries++) {
855 		if (!(rtwn_read_1(sc, R92C_HMETFR) & (1 << sc->fwcur)))
856 			break;
857 		DELAY(1);
858 	}
859 	if (ntries == 100) {
860 		device_printf(sc->sc_dev,
861 		    "could not send firmware command %d\n", id);
862 		return (ETIMEDOUT);
863 	}
864 	memset(&cmd, 0, sizeof(cmd));
865 	cmd.id = id;
866 	if (len > 3)
867 		cmd.id |= R92C_CMD_FLAG_EXT;
868 	KASSERT(len <= sizeof(cmd.msg), ("rtwn_fw_cmd\n"));
869 	memcpy(cmd.msg, buf, len);
870 
871 	/* Write the first word last since that will trigger the FW. */
872 	rtwn_write_2(sc, R92C_HMEBOX_EXT(sc->fwcur), *((uint8_t *)&cmd + 4));
873 	rtwn_write_4(sc, R92C_HMEBOX(sc->fwcur), *((uint8_t *)&cmd + 0));
874 
875 	sc->fwcur = (sc->fwcur + 1) % R92C_H2C_NBOX;
876 
877 	/* Give firmware some time for processing. */
878 	DELAY(2000);
879 
880 	return (0);
881 }
882 
883 static void
884 rtwn_rf_write(struct rtwn_softc *sc, int chain, uint8_t addr, uint32_t val)
885 {
886 	rtwn_bb_write(sc, R92C_LSSI_PARAM(chain),
887 	    SM(R92C_LSSI_PARAM_ADDR, addr) |
888 	    SM(R92C_LSSI_PARAM_DATA, val));
889 }
890 
891 static uint32_t
892 rtwn_rf_read(struct rtwn_softc *sc, int chain, uint8_t addr)
893 {
894 	uint32_t reg[R92C_MAX_CHAINS], val;
895 
896 	reg[0] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(0));
897 	if (chain != 0)
898 		reg[chain] = rtwn_bb_read(sc, R92C_HSSI_PARAM2(chain));
899 
900 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
901 	    reg[0] & ~R92C_HSSI_PARAM2_READ_EDGE);
902 	DELAY(1000);
903 
904 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(chain),
905 	    RW(reg[chain], R92C_HSSI_PARAM2_READ_ADDR, addr) |
906 	    R92C_HSSI_PARAM2_READ_EDGE);
907 	DELAY(1000);
908 
909 	rtwn_bb_write(sc, R92C_HSSI_PARAM2(0),
910 	    reg[0] | R92C_HSSI_PARAM2_READ_EDGE);
911 	DELAY(1000);
912 
913 	if (rtwn_bb_read(sc, R92C_HSSI_PARAM1(chain)) & R92C_HSSI_PARAM1_PI)
914 		val = rtwn_bb_read(sc, R92C_HSPI_READBACK(chain));
915 	else
916 		val = rtwn_bb_read(sc, R92C_LSSI_READBACK(chain));
917 	return (MS(val, R92C_LSSI_READBACK_DATA));
918 }
919 
920 static int
921 rtwn_llt_write(struct rtwn_softc *sc, uint32_t addr, uint32_t data)
922 {
923 	int ntries;
924 
925 	rtwn_write_4(sc, R92C_LLT_INIT,
926 	    SM(R92C_LLT_INIT_OP, R92C_LLT_INIT_OP_WRITE) |
927 	    SM(R92C_LLT_INIT_ADDR, addr) |
928 	    SM(R92C_LLT_INIT_DATA, data));
929 	/* Wait for write operation to complete. */
930 	for (ntries = 0; ntries < 20; ntries++) {
931 		if (MS(rtwn_read_4(sc, R92C_LLT_INIT), R92C_LLT_INIT_OP) ==
932 		    R92C_LLT_INIT_OP_NO_ACTIVE)
933 			return (0);
934 		DELAY(5);
935 	}
936 	return (ETIMEDOUT);
937 }
938 
939 static uint8_t
940 rtwn_efuse_read_1(struct rtwn_softc *sc, uint16_t addr)
941 {
942 	uint32_t reg;
943 	int ntries;
944 
945 	reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
946 	reg = RW(reg, R92C_EFUSE_CTRL_ADDR, addr);
947 	reg &= ~R92C_EFUSE_CTRL_VALID;
948 	rtwn_write_4(sc, R92C_EFUSE_CTRL, reg);
949 	/* Wait for read operation to complete. */
950 	for (ntries = 0; ntries < 100; ntries++) {
951 		reg = rtwn_read_4(sc, R92C_EFUSE_CTRL);
952 		if (reg & R92C_EFUSE_CTRL_VALID)
953 			return (MS(reg, R92C_EFUSE_CTRL_DATA));
954 		DELAY(5);
955 	}
956 	device_printf(sc->sc_dev,
957 	    "could not read efuse byte at address 0x%x\n", addr);
958 	return (0xff);
959 }
960 
961 static void
962 rtwn_efuse_read(struct rtwn_softc *sc)
963 {
964 	uint8_t *rom = (uint8_t *)&sc->rom;
965 	uint16_t addr = 0;
966 	uint32_t reg;
967 	uint8_t off, msk;
968 	int i;
969 
970 	reg = rtwn_read_2(sc, R92C_SYS_ISO_CTRL);
971 	if (!(reg & R92C_SYS_ISO_CTRL_PWC_EV12V)) {
972 		rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
973 		    reg | R92C_SYS_ISO_CTRL_PWC_EV12V);
974 	}
975 	reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
976 	if (!(reg & R92C_SYS_FUNC_EN_ELDR)) {
977 		rtwn_write_2(sc, R92C_SYS_FUNC_EN,
978 		    reg | R92C_SYS_FUNC_EN_ELDR);
979 	}
980 	reg = rtwn_read_2(sc, R92C_SYS_CLKR);
981 	if ((reg & (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) !=
982 	    (R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M)) {
983 		rtwn_write_2(sc, R92C_SYS_CLKR,
984 		    reg | R92C_SYS_CLKR_LOADER_EN | R92C_SYS_CLKR_ANA8M);
985 	}
986 	memset(&sc->rom, 0xff, sizeof(sc->rom));
987 	while (addr < 512) {
988 		reg = rtwn_efuse_read_1(sc, addr);
989 		if (reg == 0xff)
990 			break;
991 		addr++;
992 		off = reg >> 4;
993 		msk = reg & 0xf;
994 		for (i = 0; i < 4; i++) {
995 			if (msk & (1 << i))
996 				continue;
997 			rom[off * 8 + i * 2 + 0] =
998 			    rtwn_efuse_read_1(sc, addr);
999 			addr++;
1000 			rom[off * 8 + i * 2 + 1] =
1001 			    rtwn_efuse_read_1(sc, addr);
1002 			addr++;
1003 		}
1004 	}
1005 #ifdef RTWN_DEBUG
1006 	if (sc->sc_debug >= 2) {
1007 		/* Dump ROM content. */
1008 		printf("\n");
1009 		for (i = 0; i < sizeof(sc->rom); i++)
1010 			printf("%02x:", rom[i]);
1011 		printf("\n");
1012 	}
1013 #endif
1014 }
1015 
1016 static int
1017 rtwn_read_chipid(struct rtwn_softc *sc)
1018 {
1019 	uint32_t reg;
1020 
1021 	reg = rtwn_read_4(sc, R92C_SYS_CFG);
1022 	if (reg & R92C_SYS_CFG_TRP_VAUX_EN)
1023 		/* Unsupported test chip. */
1024 		return (EIO);
1025 
1026 	if (reg & R92C_SYS_CFG_TYPE_92C) {
1027 		sc->chip |= RTWN_CHIP_92C;
1028 		/* Check if it is a castrated 8192C. */
1029 		if (MS(rtwn_read_4(sc, R92C_HPON_FSM),
1030 		    R92C_HPON_FSM_CHIP_BONDING_ID) ==
1031 		    R92C_HPON_FSM_CHIP_BONDING_ID_92C_1T2R)
1032 			sc->chip |= RTWN_CHIP_92C_1T2R;
1033 	}
1034 	if (reg & R92C_SYS_CFG_VENDOR_UMC) {
1035 		sc->chip |= RTWN_CHIP_UMC;
1036 		if (MS(reg, R92C_SYS_CFG_CHIP_VER_RTL) == 0)
1037 			sc->chip |= RTWN_CHIP_UMC_A_CUT;
1038 	}
1039 	return (0);
1040 }
1041 
1042 static void
1043 rtwn_read_rom(struct rtwn_softc *sc)
1044 {
1045 	struct r92c_rom *rom = &sc->rom;
1046 
1047 	/* Read full ROM image. */
1048 	rtwn_efuse_read(sc);
1049 
1050 	if (rom->id != 0x8129)
1051 		device_printf(sc->sc_dev, "invalid EEPROM ID 0x%x\n", rom->id);
1052 
1053 	/* XXX Weird but this is what the vendor driver does. */
1054 	sc->pa_setting = rtwn_efuse_read_1(sc, 0x1fa);
1055 	DPRINTF(("PA setting=0x%x\n", sc->pa_setting));
1056 
1057 	sc->board_type = MS(rom->rf_opt1, R92C_ROM_RF1_BOARD_TYPE);
1058 
1059 	sc->regulatory = MS(rom->rf_opt1, R92C_ROM_RF1_REGULATORY);
1060 	DPRINTF(("regulatory type=%d\n", sc->regulatory));
1061 
1062 	IEEE80211_ADDR_COPY(sc->sc_ic.ic_macaddr, rom->macaddr);
1063 }
1064 
1065 static __inline uint8_t
1066 rate2ridx(uint8_t rate)
1067 {
1068 	switch (rate) {
1069 	case 12:	return 4;
1070 	case 18:	return 5;
1071 	case 24:	return 6;
1072 	case 36:	return 7;
1073 	case 48:	return 8;
1074 	case 72:	return 9;
1075 	case 96:	return 10;
1076 	case 108:	return 11;
1077 	case 2:		return 0;
1078 	case 4:		return 1;
1079 	case 11:	return 2;
1080 	case 22:	return 3;
1081 	default:	return RTWN_RIDX_UNKNOWN;
1082 	}
1083 }
1084 
1085 /*
1086  * Initialize rate adaptation in firmware.
1087  */
1088 static int
1089 rtwn_ra_init(struct rtwn_softc *sc)
1090 {
1091 	struct ieee80211com *ic = &sc->sc_ic;
1092 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1093 	struct ieee80211_node *ni = ieee80211_ref_node(vap->iv_bss);
1094 	struct ieee80211_rateset *rs = &ni->ni_rates;
1095 	struct r92c_fw_cmd_macid_cfg cmd;
1096 	uint32_t rates, basicrates;
1097 	uint8_t maxrate, maxbasicrate, mode, ridx;
1098 	int error, i;
1099 
1100 	/* Get normal and basic rates mask. */
1101 	rates = basicrates = 0;
1102 	maxrate = maxbasicrate = 0;
1103 	for (i = 0; i < rs->rs_nrates; i++) {
1104 		/* Convert 802.11 rate to HW rate index. */
1105 		ridx = rate2ridx(IEEE80211_RV(rs->rs_rates[i]));
1106 		if (ridx == RTWN_RIDX_UNKNOWN)	/* Unknown rate, skip. */
1107 			continue;
1108 		rates |= 1 << ridx;
1109 		if (ridx > maxrate)
1110 			maxrate = ridx;
1111 		if (rs->rs_rates[i] & IEEE80211_RATE_BASIC) {
1112 			basicrates |= 1 << ridx;
1113 			if (ridx > maxbasicrate)
1114 				maxbasicrate = ridx;
1115 		}
1116 	}
1117 	if (ic->ic_curmode == IEEE80211_MODE_11B)
1118 		mode = R92C_RAID_11B;
1119 	else
1120 		mode = R92C_RAID_11BG;
1121 	DPRINTF(("mode=0x%x rates=0x%08x, basicrates=0x%08x\n",
1122 	    mode, rates, basicrates));
1123 
1124 	/* Set rates mask for group addressed frames. */
1125 	cmd.macid = RTWN_MACID_BC | RTWN_MACID_VALID;
1126 	cmd.mask = htole32(mode << 28 | basicrates);
1127 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1128 	if (error != 0) {
1129 		device_printf(sc->sc_dev,
1130 		    "could not add broadcast station\n");
1131 		return (error);
1132 	}
1133 	/* Set initial MRR rate. */
1134 	DPRINTF(("maxbasicrate=%d\n", maxbasicrate));
1135 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BC),
1136 	    maxbasicrate);
1137 
1138 	/* Set rates mask for unicast frames. */
1139 	cmd.macid = RTWN_MACID_BSS | RTWN_MACID_VALID;
1140 	cmd.mask = htole32(mode << 28 | rates);
1141 	error = rtwn_fw_cmd(sc, R92C_CMD_MACID_CONFIG, &cmd, sizeof(cmd));
1142 	if (error != 0) {
1143 		device_printf(sc->sc_dev, "could not add BSS station\n");
1144 		return (error);
1145 	}
1146 	/* Set initial MRR rate. */
1147 	DPRINTF(("maxrate=%d\n", maxrate));
1148 	rtwn_write_1(sc, R92C_INIDATA_RATE_SEL(RTWN_MACID_BSS),
1149 	    maxrate);
1150 
1151 	/* Configure Automatic Rate Fallback Register. */
1152 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1153 		if (rates & 0x0c)
1154 			rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0d));
1155 		else
1156 			rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0f));
1157 	} else
1158 		rtwn_write_4(sc, R92C_ARFR(0), htole32(rates & 0x0ff5));
1159 
1160 	/* Indicate highest supported rate. */
1161 	ni->ni_txrate = rs->rs_rates[rs->rs_nrates - 1];
1162 	return (0);
1163 }
1164 
1165 static void
1166 rtwn_tsf_sync_enable(struct rtwn_softc *sc)
1167 {
1168 	struct ieee80211com *ic = &sc->sc_ic;
1169 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1170 	struct ieee80211_node *ni = vap->iv_bss;
1171 	uint64_t tsf;
1172 
1173 	/* Enable TSF synchronization. */
1174 	rtwn_write_1(sc, R92C_BCN_CTRL,
1175 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_DIS_TSF_UDT0);
1176 
1177 	rtwn_write_1(sc, R92C_BCN_CTRL,
1178 	    rtwn_read_1(sc, R92C_BCN_CTRL) & ~R92C_BCN_CTRL_EN_BCN);
1179 
1180 	/* Set initial TSF. */
1181 	memcpy(&tsf, ni->ni_tstamp.data, 8);
1182 	tsf = le64toh(tsf);
1183 	tsf = tsf - (tsf % (vap->iv_bss->ni_intval * IEEE80211_DUR_TU));
1184 	tsf -= IEEE80211_DUR_TU;
1185 	rtwn_write_4(sc, R92C_TSFTR + 0, tsf);
1186 	rtwn_write_4(sc, R92C_TSFTR + 4, tsf >> 32);
1187 
1188 	rtwn_write_1(sc, R92C_BCN_CTRL,
1189 	    rtwn_read_1(sc, R92C_BCN_CTRL) | R92C_BCN_CTRL_EN_BCN);
1190 }
1191 
1192 static void
1193 rtwn_set_led(struct rtwn_softc *sc, int led, int on)
1194 {
1195 	uint8_t reg;
1196 
1197 	if (led == RTWN_LED_LINK) {
1198 		reg = rtwn_read_1(sc, R92C_LEDCFG2) & 0xf0;
1199 		if (!on)
1200 			reg |= R92C_LEDCFG2_DIS;
1201 		else
1202 			reg |= R92C_LEDCFG2_EN;
1203 		rtwn_write_1(sc, R92C_LEDCFG2, reg);
1204 		sc->ledlink = on;	/* Save LED state. */
1205 	}
1206 }
1207 
1208 static void
1209 rtwn_calib_to(void *arg)
1210 {
1211 	struct rtwn_softc *sc = arg;
1212 	struct r92c_fw_cmd_rssi cmd;
1213 
1214 	if (sc->avg_pwdb != -1) {
1215 		/* Indicate Rx signal strength to FW for rate adaptation. */
1216 		memset(&cmd, 0, sizeof(cmd));
1217 		cmd.macid = 0;	/* BSS. */
1218 		cmd.pwdb = sc->avg_pwdb;
1219 		DPRINTFN(3, ("sending RSSI command avg=%d\n", sc->avg_pwdb));
1220 		rtwn_fw_cmd(sc, R92C_CMD_RSSI_SETTING, &cmd, sizeof(cmd));
1221 	}
1222 
1223 	/* Do temperature compensation. */
1224 	rtwn_temp_calib(sc);
1225 
1226 	callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
1227 }
1228 
1229 static int
1230 rtwn_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1231 {
1232 	struct rtwn_vap *rvp = RTWN_VAP(vap);
1233 	struct ieee80211com *ic = vap->iv_ic;
1234 	struct ieee80211_node *ni = vap->iv_bss;
1235 	struct rtwn_softc *sc = ic->ic_softc;
1236 	uint32_t reg;
1237 
1238 	IEEE80211_UNLOCK(ic);
1239 	RTWN_LOCK(sc);
1240 
1241 	if (vap->iv_state == IEEE80211_S_RUN) {
1242 		/* Stop calibration. */
1243 		callout_stop(&sc->calib_to);
1244 
1245 		/* Turn link LED off. */
1246 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1247 
1248 		/* Set media status to 'No Link'. */
1249 		reg = rtwn_read_4(sc, R92C_CR);
1250 		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_NOLINK);
1251 		rtwn_write_4(sc, R92C_CR, reg);
1252 
1253 		/* Stop Rx of data frames. */
1254 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0);
1255 
1256 		/* Rest TSF. */
1257 		rtwn_write_1(sc, R92C_DUAL_TSF_RST, 0x03);
1258 
1259 		/* Disable TSF synchronization. */
1260 		rtwn_write_1(sc, R92C_BCN_CTRL,
1261 		    rtwn_read_1(sc, R92C_BCN_CTRL) |
1262 		    R92C_BCN_CTRL_DIS_TSF_UDT0);
1263 
1264 		/* Reset EDCA parameters. */
1265 		rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3217);
1266 		rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4317);
1267 		rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x00105320);
1268 		rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a444);
1269 	}
1270 	switch (nstate) {
1271 	case IEEE80211_S_INIT:
1272 		/* Turn link LED off. */
1273 		rtwn_set_led(sc, RTWN_LED_LINK, 0);
1274 		break;
1275 	case IEEE80211_S_SCAN:
1276 		/* Make link LED blink during scan. */
1277 		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
1278 
1279 		/* Pause AC Tx queues. */
1280 		rtwn_write_1(sc, R92C_TXPAUSE,
1281 		    rtwn_read_1(sc, R92C_TXPAUSE) | 0x0f);
1282 		break;
1283 	case IEEE80211_S_AUTH:
1284 		rtwn_set_chan(sc, ic->ic_curchan, NULL);
1285 		break;
1286 	case IEEE80211_S_RUN:
1287 		if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1288 			/* Enable Rx of data frames. */
1289 			rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1290 
1291 			/* Turn link LED on. */
1292 			rtwn_set_led(sc, RTWN_LED_LINK, 1);
1293 			break;
1294 		}
1295 
1296 		/* Set media status to 'Associated'. */
1297 		reg = rtwn_read_4(sc, R92C_CR);
1298 		reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
1299 		rtwn_write_4(sc, R92C_CR, reg);
1300 
1301 		/* Set BSSID. */
1302 		rtwn_write_4(sc, R92C_BSSID + 0, le32dec(&ni->ni_bssid[0]));
1303 		rtwn_write_4(sc, R92C_BSSID + 4, le16dec(&ni->ni_bssid[4]));
1304 
1305 		if (ic->ic_curmode == IEEE80211_MODE_11B)
1306 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 0);
1307 		else	/* 802.11b/g */
1308 			rtwn_write_1(sc, R92C_INIRTS_RATE_SEL, 3);
1309 
1310 		/* Enable Rx of data frames. */
1311 		rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
1312 
1313 		/* Flush all AC queues. */
1314 		rtwn_write_1(sc, R92C_TXPAUSE, 0);
1315 
1316 		/* Set beacon interval. */
1317 		rtwn_write_2(sc, R92C_BCN_INTERVAL, ni->ni_intval);
1318 
1319 		/* Allow Rx from our BSSID only. */
1320 		rtwn_write_4(sc, R92C_RCR,
1321 		    rtwn_read_4(sc, R92C_RCR) |
1322 		    R92C_RCR_CBSSID_DATA | R92C_RCR_CBSSID_BCN);
1323 
1324 		/* Enable TSF synchronization. */
1325 		rtwn_tsf_sync_enable(sc);
1326 
1327 		rtwn_write_1(sc, R92C_SIFS_CCK + 1, 10);
1328 		rtwn_write_1(sc, R92C_SIFS_OFDM + 1, 10);
1329 		rtwn_write_1(sc, R92C_SPEC_SIFS + 1, 10);
1330 		rtwn_write_1(sc, R92C_MAC_SPEC_SIFS + 1, 10);
1331 		rtwn_write_1(sc, R92C_R2T_SIFS + 1, 10);
1332 		rtwn_write_1(sc, R92C_T2T_SIFS + 1, 10);
1333 
1334 		/* Intialize rate adaptation. */
1335 		rtwn_ra_init(sc);
1336 		/* Turn link LED on. */
1337 		rtwn_set_led(sc, RTWN_LED_LINK, 1);
1338 
1339 		sc->avg_pwdb = -1;	/* Reset average RSSI. */
1340 		/* Reset temperature calibration state machine. */
1341 		sc->thcal_state = 0;
1342 		sc->thcal_lctemp = 0;
1343 		/* Start periodic calibration. */
1344 		callout_reset(&sc->calib_to, hz * 2, rtwn_calib_to, sc);
1345 		break;
1346 	default:
1347 		break;
1348 	}
1349 	RTWN_UNLOCK(sc);
1350 	IEEE80211_LOCK(ic);
1351 	return (rvp->newstate(vap, nstate, arg));
1352 }
1353 
1354 static int
1355 rtwn_updateedca(struct ieee80211com *ic)
1356 {
1357 	struct rtwn_softc *sc = ic->ic_softc;
1358 	const uint16_t aci2reg[WME_NUM_AC] = {
1359 		R92C_EDCA_BE_PARAM,
1360 		R92C_EDCA_BK_PARAM,
1361 		R92C_EDCA_VI_PARAM,
1362 		R92C_EDCA_VO_PARAM
1363 	};
1364 	int aci, aifs, slottime;
1365 
1366 	IEEE80211_LOCK(ic);
1367 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1368 	for (aci = 0; aci < WME_NUM_AC; aci++) {
1369 		const struct wmeParams *ac =
1370 		    &ic->ic_wme.wme_chanParams.cap_wmeParams[aci];
1371 		/* AIFS[AC] = AIFSN[AC] * aSlotTime + aSIFSTime. */
1372 		aifs = ac->wmep_aifsn * slottime + 10;
1373 		rtwn_write_4(sc, aci2reg[aci],
1374 		    SM(R92C_EDCA_PARAM_TXOP, ac->wmep_txopLimit) |
1375 		    SM(R92C_EDCA_PARAM_ECWMIN, ac->wmep_logcwmin) |
1376 		    SM(R92C_EDCA_PARAM_ECWMAX, ac->wmep_logcwmax) |
1377 		    SM(R92C_EDCA_PARAM_AIFS, aifs));
1378 	}
1379 	IEEE80211_UNLOCK(ic);
1380 	return (0);
1381 }
1382 
1383 static void
1384 rtwn_update_avgrssi(struct rtwn_softc *sc, int rate, int8_t rssi)
1385 {
1386 	int pwdb;
1387 
1388 	/* Convert antenna signal to percentage. */
1389 	if (rssi <= -100 || rssi >= 20)
1390 		pwdb = 0;
1391 	else if (rssi >= 0)
1392 		pwdb = 100;
1393 	else
1394 		pwdb = 100 + rssi;
1395 	if (RTWN_RATE_IS_CCK(rate)) {
1396 		/* CCK gain is smaller than OFDM/MCS gain. */
1397 		pwdb += 6;
1398 		if (pwdb > 100)
1399 			pwdb = 100;
1400 		if (pwdb <= 14)
1401 			pwdb -= 4;
1402 		else if (pwdb <= 26)
1403 			pwdb -= 8;
1404 		else if (pwdb <= 34)
1405 			pwdb -= 6;
1406 		else if (pwdb <= 42)
1407 			pwdb -= 2;
1408 	}
1409 	if (sc->avg_pwdb == -1)	/* Init. */
1410 		sc->avg_pwdb = pwdb;
1411 	else if (sc->avg_pwdb < pwdb)
1412 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20) + 1;
1413 	else
1414 		sc->avg_pwdb = ((sc->avg_pwdb * 19 + pwdb) / 20);
1415 	DPRINTFN(4, ("PWDB=%d EMA=%d\n", pwdb, sc->avg_pwdb));
1416 }
1417 
1418 static int8_t
1419 rtwn_get_rssi(struct rtwn_softc *sc, int rate, void *physt)
1420 {
1421 	static const int8_t cckoff[] = { 16, -12, -26, -46 };
1422 	struct r92c_rx_phystat *phy;
1423 	struct r92c_rx_cck *cck;
1424 	uint8_t rpt;
1425 	int8_t rssi;
1426 
1427 	if (RTWN_RATE_IS_CCK(rate)) {
1428 		cck = (struct r92c_rx_cck *)physt;
1429 		if (sc->sc_flags & RTWN_FLAG_CCK_HIPWR) {
1430 			rpt = (cck->agc_rpt >> 5) & 0x3;
1431 			rssi = (cck->agc_rpt & 0x1f) << 1;
1432 		} else {
1433 			rpt = (cck->agc_rpt >> 6) & 0x3;
1434 			rssi = cck->agc_rpt & 0x3e;
1435 		}
1436 		rssi = cckoff[rpt] - rssi;
1437 	} else {	/* OFDM/HT. */
1438 		phy = (struct r92c_rx_phystat *)physt;
1439 		rssi = ((le32toh(phy->phydw1) >> 1) & 0x7f) - 110;
1440 	}
1441 	return (rssi);
1442 }
1443 
1444 static void
1445 rtwn_rx_frame(struct rtwn_softc *sc, struct r92c_rx_desc *rx_desc,
1446     struct rtwn_rx_data *rx_data, int desc_idx)
1447 {
1448 	struct ieee80211com *ic = &sc->sc_ic;
1449 	struct ieee80211_frame_min *wh;
1450 	struct ieee80211_node *ni;
1451 	struct r92c_rx_phystat *phy = NULL;
1452 	uint32_t rxdw0, rxdw3;
1453 	struct mbuf *m, *m1;
1454 	bus_dma_segment_t segs[1];
1455 	bus_addr_t physaddr;
1456 	uint8_t rate;
1457 	int8_t rssi = 0, nf;
1458 	int infosz, nsegs, pktlen, shift, error;
1459 
1460 	rxdw0 = le32toh(rx_desc->rxdw0);
1461 	rxdw3 = le32toh(rx_desc->rxdw3);
1462 
1463 	if (__predict_false(rxdw0 & (R92C_RXDW0_CRCERR | R92C_RXDW0_ICVERR))) {
1464 		/*
1465 		 * This should not happen since we setup our Rx filter
1466 		 * to not receive these frames.
1467 		 */
1468 		counter_u64_add(ic->ic_ierrors, 1);
1469 		return;
1470 	}
1471 
1472 	pktlen = MS(rxdw0, R92C_RXDW0_PKTLEN);
1473 	if (__predict_false(pktlen < sizeof(struct ieee80211_frame_ack) ||
1474 	    pktlen > MCLBYTES)) {
1475 		counter_u64_add(ic->ic_ierrors, 1);
1476 		return;
1477 	}
1478 
1479 	rate = MS(rxdw3, R92C_RXDW3_RATE);
1480 	infosz = MS(rxdw0, R92C_RXDW0_INFOSZ) * 8;
1481 	if (infosz > sizeof(struct r92c_rx_phystat))
1482 		infosz = sizeof(struct r92c_rx_phystat);
1483 	shift = MS(rxdw0, R92C_RXDW0_SHIFT);
1484 
1485 	/* Get RSSI from PHY status descriptor if present. */
1486 	if (infosz != 0 && (rxdw0 & R92C_RXDW0_PHYST)) {
1487 		phy = mtod(rx_data->m, struct r92c_rx_phystat *);
1488 		rssi = rtwn_get_rssi(sc, rate, phy);
1489 		/* Update our average RSSI. */
1490 		rtwn_update_avgrssi(sc, rate, rssi);
1491 	}
1492 
1493 	DPRINTFN(5, ("Rx frame len=%d rate=%d infosz=%d shift=%d rssi=%d\n",
1494 	    pktlen, rate, infosz, shift, rssi));
1495 
1496 	m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1497 	if (m1 == NULL) {
1498 		counter_u64_add(ic->ic_ierrors, 1);
1499 		return;
1500 	}
1501 	bus_dmamap_unload(sc->rx_ring.data_dmat, rx_data->map);
1502 
1503 	error = bus_dmamap_load(sc->rx_ring.data_dmat, rx_data->map,
1504 	     mtod(m1, void *), MCLBYTES, rtwn_dma_map_addr,
1505 	     &physaddr, 0);
1506 	if (error != 0) {
1507 		m_freem(m1);
1508 
1509 		if (bus_dmamap_load_mbuf_sg(sc->rx_ring.data_dmat,
1510 		    rx_data->map, rx_data->m, segs, &nsegs, 0))
1511 			panic("%s: could not load old RX mbuf",
1512 			    device_get_name(sc->sc_dev));
1513 
1514 		/* Physical address may have changed. */
1515 		rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
1516 		counter_u64_add(ic->ic_ierrors, 1);
1517 		return;
1518 	}
1519 
1520 	/* Finalize mbuf. */
1521 	m = rx_data->m;
1522 	rx_data->m = m1;
1523 	m->m_pkthdr.len = m->m_len = pktlen + infosz + shift;
1524 
1525 	/* Update RX descriptor. */
1526 	rtwn_setup_rx_desc(sc, rx_desc, physaddr, MCLBYTES, desc_idx);
1527 
1528 	/* Get ieee80211 frame header. */
1529 	if (rxdw0 & R92C_RXDW0_PHYST)
1530 		m_adj(m, infosz + shift);
1531 	else
1532 		m_adj(m, shift);
1533 
1534 	nf = -95;
1535 	if (ieee80211_radiotap_active(ic)) {
1536 		struct rtwn_rx_radiotap_header *tap = &sc->sc_rxtap;
1537 
1538 		tap->wr_flags = 0;
1539 		if (!(rxdw3 & R92C_RXDW3_HT)) {
1540 			tap->wr_rate = ridx2rate[rate];
1541 		} else if (rate >= 12) {	/* MCS0~15. */
1542 			/* Bit 7 set means HT MCS instead of rate. */
1543 			tap->wr_rate = 0x80 | (rate - 12);
1544 		}
1545 		tap->wr_dbm_antsignal = rssi;
1546 		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1547 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1548 	}
1549 
1550 	RTWN_UNLOCK(sc);
1551 	wh = mtod(m, struct ieee80211_frame_min *);
1552 	if (m->m_len >= sizeof(*wh))
1553 		ni = ieee80211_find_rxnode(ic, wh);
1554 	else
1555 		ni = NULL;
1556 
1557 	/* Send the frame to the 802.11 layer. */
1558 	if (ni != NULL) {
1559 		(void)ieee80211_input(ni, m, rssi - nf, nf);
1560 		/* Node is no longer needed. */
1561 		ieee80211_free_node(ni);
1562 	} else
1563 		(void)ieee80211_input_all(ic, m, rssi - nf, nf);
1564 
1565 	RTWN_LOCK(sc);
1566 }
1567 
1568 static int
1569 rtwn_tx(struct rtwn_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1570 {
1571 	struct ieee80211com *ic = &sc->sc_ic;
1572 	struct ieee80211vap *vap = ni->ni_vap;
1573 	struct ieee80211_frame *wh;
1574 	struct ieee80211_key *k = NULL;
1575 	struct rtwn_tx_ring *tx_ring;
1576 	struct rtwn_tx_data *data;
1577 	struct r92c_tx_desc *txd;
1578 	bus_dma_segment_t segs[1];
1579 	uint16_t qos;
1580 	uint8_t raid, type, tid, qid;
1581 	int nsegs, error;
1582 
1583 	wh = mtod(m, struct ieee80211_frame *);
1584 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1585 
1586 	/* Encrypt the frame if need be. */
1587 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1588 		k = ieee80211_crypto_encap(ni, m);
1589 		if (k == NULL) {
1590 			m_freem(m);
1591 			return (ENOBUFS);
1592 		}
1593 		/* 802.11 header may have moved. */
1594 		wh = mtod(m, struct ieee80211_frame *);
1595 	}
1596 
1597 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1598 		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
1599 		tid = qos & IEEE80211_QOS_TID;
1600 	} else {
1601 		qos = 0;
1602 		tid = 0;
1603 	}
1604 
1605 	switch (type) {
1606 	case IEEE80211_FC0_TYPE_CTL:
1607 	case IEEE80211_FC0_TYPE_MGT:
1608 		qid = RTWN_VO_QUEUE;
1609 		break;
1610 	default:
1611 		qid = M_WME_GETAC(m);
1612 		break;
1613 	}
1614 
1615 	/* Grab a Tx buffer from the ring. */
1616 	tx_ring = &sc->tx_ring[qid];
1617 	data = &tx_ring->tx_data[tx_ring->cur];
1618 	if (data->m != NULL) {
1619 		m_freem(m);
1620 		return (ENOBUFS);
1621 	}
1622 
1623 	/* Fill Tx descriptor. */
1624 	txd = &tx_ring->desc[tx_ring->cur];
1625 	if (htole32(txd->txdw0) & R92C_RXDW0_OWN) {
1626 		m_freem(m);
1627 		return (ENOBUFS);
1628 	}
1629 	txd->txdw0 = htole32(
1630 	    SM(R92C_TXDW0_PKTLEN, m->m_pkthdr.len) |
1631 	    SM(R92C_TXDW0_OFFSET, sizeof(*txd)) |
1632 	    R92C_TXDW0_FSG | R92C_TXDW0_LSG);
1633 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1634 		txd->txdw0 |= htole32(R92C_TXDW0_BMCAST);
1635 
1636 	txd->txdw1 = 0;
1637 	txd->txdw4 = 0;
1638 	txd->txdw5 = 0;
1639 
1640 	/* XXX TODO: rate control; implement low-rate for EAPOL */
1641 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1642 	    type == IEEE80211_FC0_TYPE_DATA) {
1643 		if (ic->ic_curmode == IEEE80211_MODE_11B)
1644 			raid = R92C_RAID_11B;
1645 		else
1646 			raid = R92C_RAID_11BG;
1647 		txd->txdw1 |= htole32(
1648 		    SM(R92C_TXDW1_MACID, RTWN_MACID_BSS) |
1649 		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_BE) |
1650 		    SM(R92C_TXDW1_RAID, raid) |
1651 		    R92C_TXDW1_AGGBK);
1652 
1653 		if (ic->ic_flags & IEEE80211_F_USEPROT) {
1654 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY) {
1655 				txd->txdw4 |= htole32(R92C_TXDW4_CTS2SELF |
1656 				    R92C_TXDW4_HWRTSEN);
1657 			} else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS) {
1658 				txd->txdw4 |= htole32(R92C_TXDW4_RTSEN |
1659 				    R92C_TXDW4_HWRTSEN);
1660 			}
1661 		}
1662 
1663 		/* XXX TODO: implement rate control */
1664 
1665 		/* Send RTS at OFDM24. */
1666 		txd->txdw4 |= htole32(SM(R92C_TXDW4_RTSRATE,
1667 		    RTWN_RIDX_OFDM24));
1668 		txd->txdw5 |= htole32(SM(R92C_TXDW5_RTSRATE_FBLIMIT, 0xf));
1669 		/* Send data at OFDM54. */
1670 		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE,
1671 		    RTWN_RIDX_OFDM54));
1672 		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE_FBLIMIT, 0x1f));
1673 
1674 	} else {
1675 		txd->txdw1 |= htole32(
1676 		    SM(R92C_TXDW1_MACID, 0) |
1677 		    SM(R92C_TXDW1_QSEL, R92C_TXDW1_QSEL_MGNT) |
1678 		    SM(R92C_TXDW1_RAID, R92C_RAID_11B));
1679 
1680 		/* Force CCK1. */
1681 		txd->txdw4 |= htole32(R92C_TXDW4_DRVRATE);
1682 		txd->txdw5 |= htole32(SM(R92C_TXDW5_DATARATE, RTWN_RIDX_CCK1));
1683 	}
1684 	/* Set sequence number (already little endian). */
1685 	txd->txdseq = htole16(M_SEQNO_GET(m) % IEEE80211_SEQ_RANGE);
1686 
1687 	if (!qos) {
1688 		/* Use HW sequence numbering for non-QoS frames. */
1689 		txd->txdw4  |= htole32(R92C_TXDW4_HWSEQ);
1690 		txd->txdseq |= htole16(0x8000);
1691 	} else
1692 		txd->txdw4 |= htole32(R92C_TXDW4_QOS);
1693 
1694 	error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map, m, segs,
1695 	    &nsegs, BUS_DMA_NOWAIT);
1696 	if (error != 0 && error != EFBIG) {
1697 		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n", error);
1698 		m_freem(m);
1699 		return (error);
1700 	}
1701 	if (error != 0) {
1702 		struct mbuf *mnew;
1703 
1704 		mnew = m_defrag(m, M_NOWAIT);
1705 		if (mnew == NULL) {
1706 			device_printf(sc->sc_dev,
1707 			    "can't defragment mbuf\n");
1708 			m_freem(m);
1709 			return (ENOBUFS);
1710 		}
1711 		m = mnew;
1712 
1713 		error = bus_dmamap_load_mbuf_sg(tx_ring->data_dmat, data->map,
1714 		    m, segs, &nsegs, BUS_DMA_NOWAIT);
1715 		if (error != 0) {
1716 			device_printf(sc->sc_dev,
1717 			    "can't map mbuf (error %d)\n", error);
1718 			m_freem(m);
1719 			return (error);
1720 		}
1721 	}
1722 
1723 	txd->txbufaddr = htole32(segs[0].ds_addr);
1724 	txd->txbufsize = htole16(m->m_pkthdr.len);
1725 	bus_space_barrier(sc->sc_st, sc->sc_sh, 0, sc->sc_mapsize,
1726 	    BUS_SPACE_BARRIER_WRITE);
1727 	txd->txdw0 |= htole32(R92C_TXDW0_OWN);
1728 
1729 	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
1730 	    BUS_DMASYNC_POSTWRITE);
1731 	bus_dmamap_sync(tx_ring->data_dmat, data->map, BUS_DMASYNC_POSTWRITE);
1732 
1733 	data->m = m;
1734 	data->ni = ni;
1735 
1736 	if (ieee80211_radiotap_active_vap(vap)) {
1737 		struct rtwn_tx_radiotap_header *tap = &sc->sc_txtap;
1738 
1739 		tap->wt_flags = 0;
1740 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1741 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1742 
1743 		ieee80211_radiotap_tx(vap, m);
1744 	}
1745 
1746 	tx_ring->cur = (tx_ring->cur + 1) % RTWN_TX_LIST_COUNT;
1747 	tx_ring->queued++;
1748 
1749 	if (tx_ring->queued >= (RTWN_TX_LIST_COUNT - 1))
1750 		sc->qfullmsk |= (1 << qid);
1751 
1752 	/* Kick TX. */
1753 	rtwn_write_2(sc, R92C_PCIE_CTRL_REG, (1 << qid));
1754 	return (0);
1755 }
1756 
1757 static void
1758 rtwn_tx_done(struct rtwn_softc *sc, int qid)
1759 {
1760 	struct rtwn_tx_ring *tx_ring = &sc->tx_ring[qid];
1761 	struct rtwn_tx_data *tx_data;
1762 	struct r92c_tx_desc *tx_desc;
1763 	int i;
1764 
1765 	bus_dmamap_sync(tx_ring->desc_dmat, tx_ring->desc_map,
1766 	    BUS_DMASYNC_POSTREAD);
1767 
1768 	for (i = 0; i < RTWN_TX_LIST_COUNT; i++) {
1769 		tx_data = &tx_ring->tx_data[i];
1770 		if (tx_data->m == NULL)
1771 			continue;
1772 
1773 		tx_desc = &tx_ring->desc[i];
1774 		if (le32toh(tx_desc->txdw0) & R92C_TXDW0_OWN)
1775 			continue;
1776 
1777 		/* Unmap and free mbuf. */
1778 		bus_dmamap_sync(tx_ring->data_dmat, tx_data->map,
1779 		    BUS_DMASYNC_POSTWRITE);
1780 		bus_dmamap_unload(tx_ring->data_dmat, tx_data->map);
1781 
1782 		/*
1783 		 * XXX TODO: figure out whether the transmit succeeded or not.
1784 		 * .. and then notify rate control.
1785 		 */
1786 		ieee80211_tx_complete(tx_data->ni, tx_data->m, 0);
1787 		tx_data->ni = NULL;
1788 		tx_data->m = NULL;
1789 
1790 		if (--tx_ring->queued)
1791 			sc->sc_tx_timer = 5;
1792 		else
1793 			sc->sc_tx_timer = 0;
1794 	}
1795 
1796 	if (tx_ring->queued < (RTWN_TX_LIST_COUNT - 1))
1797 		sc->qfullmsk &= ~(1 << qid);
1798 	rtwn_start(sc);
1799 }
1800 
1801 static int
1802 rtwn_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1803     const struct ieee80211_bpf_params *params)
1804 {
1805 	struct ieee80211com *ic = ni->ni_ic;
1806 	struct rtwn_softc *sc = ic->ic_softc;
1807 
1808 	RTWN_LOCK(sc);
1809 
1810 	/* Prevent management frames from being sent if we're not ready. */
1811 	if (!(sc->sc_flags & RTWN_RUNNING)) {
1812 		RTWN_UNLOCK(sc);
1813 		m_freem(m);
1814 		return (ENETDOWN);
1815 	}
1816 
1817 	if (rtwn_tx(sc, m, ni) != 0) {
1818 		RTWN_UNLOCK(sc);
1819 		return (EIO);
1820 	}
1821 	sc->sc_tx_timer = 5;
1822 	RTWN_UNLOCK(sc);
1823 	return (0);
1824 }
1825 
1826 static int
1827 rtwn_transmit(struct ieee80211com *ic, struct mbuf *m)
1828 {
1829 	struct rtwn_softc *sc = ic->ic_softc;
1830 	int error;
1831 
1832 	RTWN_LOCK(sc);
1833 	if ((sc->sc_flags & RTWN_RUNNING) == 0) {
1834 		RTWN_UNLOCK(sc);
1835 		return (ENXIO);
1836 	}
1837 	error = mbufq_enqueue(&sc->sc_snd, m);
1838 	if (error) {
1839 		RTWN_UNLOCK(sc);
1840 		return (error);
1841 	}
1842 	rtwn_start(sc);
1843 	RTWN_UNLOCK(sc);
1844 	return (0);
1845 }
1846 
1847 static void
1848 rtwn_parent(struct ieee80211com *ic)
1849 {
1850 	struct rtwn_softc *sc = ic->ic_softc;
1851 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1852 
1853 	if (ic->ic_nrunning > 0) {
1854 		if (rtwn_init(sc) == 0)
1855 			ieee80211_start_all(ic);
1856 		else
1857 			ieee80211_stop(vap);
1858 	} else
1859 		rtwn_stop(sc);
1860 }
1861 
1862 static void
1863 rtwn_start(struct rtwn_softc *sc)
1864 {
1865 	struct ieee80211_node *ni;
1866 	struct mbuf *m;
1867 
1868 	RTWN_LOCK_ASSERT(sc);
1869 
1870 	if ((sc->sc_flags & RTWN_RUNNING) == 0)
1871 		return;
1872 
1873 	while (sc->qfullmsk == 0 && (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
1874 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1875 		if (rtwn_tx(sc, m, ni) != 0) {
1876 			if_inc_counter(ni->ni_vap->iv_ifp,
1877 			    IFCOUNTER_OERRORS, 1);
1878 			ieee80211_free_node(ni);
1879 			continue;
1880 		}
1881 		sc->sc_tx_timer = 5;
1882 	}
1883 }
1884 
1885 static void
1886 rtwn_watchdog(void *arg)
1887 {
1888 	struct rtwn_softc *sc = arg;
1889 	struct ieee80211com *ic = &sc->sc_ic;
1890 
1891 	RTWN_LOCK_ASSERT(sc);
1892 
1893 	KASSERT(sc->sc_flags & RTWN_RUNNING, ("not running"));
1894 
1895 	if (sc->sc_tx_timer != 0 && --sc->sc_tx_timer == 0) {
1896 		ic_printf(ic, "device timeout\n");
1897 		ieee80211_restart_all(ic);
1898 		return;
1899 	}
1900 	callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
1901 }
1902 
1903 static int
1904 rtwn_power_on(struct rtwn_softc *sc)
1905 {
1906 	uint32_t reg;
1907 	int ntries;
1908 
1909 	/* Wait for autoload done bit. */
1910 	for (ntries = 0; ntries < 1000; ntries++) {
1911 		if (rtwn_read_1(sc, R92C_APS_FSMCO) & R92C_APS_FSMCO_PFM_ALDN)
1912 			break;
1913 		DELAY(5);
1914 	}
1915 	if (ntries == 1000) {
1916 		device_printf(sc->sc_dev,
1917 		    "timeout waiting for chip autoload\n");
1918 		return (ETIMEDOUT);
1919 	}
1920 
1921 	/* Unlock ISO/CLK/Power control register. */
1922 	rtwn_write_1(sc, R92C_RSV_CTRL, 0);
1923 
1924 	/* TODO: check if we need this for 8188CE */
1925 	if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1926 		/* bt coex */
1927 		reg = rtwn_read_4(sc, R92C_APS_FSMCO);
1928 		reg |= (R92C_APS_FSMCO_SOP_ABG |
1929 			R92C_APS_FSMCO_SOP_AMB |
1930 			R92C_APS_FSMCO_XOP_BTCK);
1931 		rtwn_write_4(sc, R92C_APS_FSMCO, reg);
1932 	}
1933 
1934 	/* Move SPS into PWM mode. */
1935 	rtwn_write_1(sc, R92C_SPS0_CTRL, 0x2b);
1936 
1937 	/* Set low byte to 0x0f, leave others unchanged. */
1938 	rtwn_write_4(sc, R92C_AFE_XTAL_CTRL,
1939 	    (rtwn_read_4(sc, R92C_AFE_XTAL_CTRL) & 0xffffff00) | 0x0f);
1940 
1941 	/* TODO: check if we need this for 8188CE */
1942 	if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1943 		/* bt coex */
1944 		reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL);
1945 		reg &= (~0x00024800); /* XXX magic from linux */
1946 		rtwn_write_4(sc, R92C_AFE_XTAL_CTRL, reg);
1947 	}
1948 
1949 	rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1950 	  (rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & 0xff) |
1951 	  R92C_SYS_ISO_CTRL_PWC_EV12V | R92C_SYS_ISO_CTRL_DIOR);
1952 	DELAY(200);
1953 
1954 	/* TODO: linux does additional btcoex stuff here */
1955 
1956 	/* Auto enable WLAN. */
1957 	rtwn_write_2(sc, R92C_APS_FSMCO,
1958 	    rtwn_read_2(sc, R92C_APS_FSMCO) | R92C_APS_FSMCO_APFM_ONMAC);
1959 	for (ntries = 0; ntries < 1000; ntries++) {
1960 		if (!(rtwn_read_2(sc, R92C_APS_FSMCO) &
1961 		    R92C_APS_FSMCO_APFM_ONMAC))
1962 			break;
1963 		DELAY(5);
1964 	}
1965 	if (ntries == 1000) {
1966 		device_printf(sc->sc_dev, "timeout waiting for MAC auto ON\n");
1967 		return (ETIMEDOUT);
1968 	}
1969 
1970 	/* Enable radio, GPIO and LED functions. */
1971 	rtwn_write_2(sc, R92C_APS_FSMCO,
1972 	    R92C_APS_FSMCO_AFSM_PCIE |
1973 	    R92C_APS_FSMCO_PDN_EN |
1974 	    R92C_APS_FSMCO_PFM_ALDN);
1975 	/* Release RF digital isolation. */
1976 	rtwn_write_2(sc, R92C_SYS_ISO_CTRL,
1977 	    rtwn_read_2(sc, R92C_SYS_ISO_CTRL) & ~R92C_SYS_ISO_CTRL_DIOR);
1978 
1979 	if (sc->chip & RTWN_CHIP_92C)
1980 		rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x77);
1981 	else
1982 		rtwn_write_1(sc, R92C_PCIE_CTRL_REG + 3, 0x22);
1983 
1984 	rtwn_write_4(sc, R92C_INT_MIG, 0);
1985 
1986 	if (sc->board_type != R92C_BOARD_TYPE_DONGLE) {
1987 		/* bt coex */
1988 		reg = rtwn_read_4(sc, R92C_AFE_XTAL_CTRL + 2);
1989 		reg &= 0xfd; /* XXX magic from linux */
1990 		rtwn_write_4(sc, R92C_AFE_XTAL_CTRL + 2, reg);
1991 	}
1992 
1993 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
1994 	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_RFKILL);
1995 
1996 	reg = rtwn_read_1(sc, R92C_GPIO_IO_SEL);
1997 	if (!(reg & R92C_GPIO_IO_SEL_RFKILL)) {
1998 		device_printf(sc->sc_dev,
1999 		    "radio is disabled by hardware switch\n");
2000 		return (EPERM);
2001 	}
2002 
2003 	/* Initialize MAC. */
2004 	reg = rtwn_read_1(sc, R92C_APSD_CTRL);
2005 	rtwn_write_1(sc, R92C_APSD_CTRL,
2006 	    rtwn_read_1(sc, R92C_APSD_CTRL) & ~R92C_APSD_CTRL_OFF);
2007 	for (ntries = 0; ntries < 200; ntries++) {
2008 		if (!(rtwn_read_1(sc, R92C_APSD_CTRL) &
2009 		    R92C_APSD_CTRL_OFF_STATUS))
2010 			break;
2011 		DELAY(500);
2012 	}
2013 	if (ntries == 200) {
2014 		device_printf(sc->sc_dev,
2015 		    "timeout waiting for MAC initialization\n");
2016 		return (ETIMEDOUT);
2017 	}
2018 
2019 	/* Enable MAC DMA/WMAC/SCHEDULE/SEC blocks. */
2020 	reg = rtwn_read_2(sc, R92C_CR);
2021 	reg |= R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
2022 	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
2023 	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
2024 	    R92C_CR_ENSEC;
2025 	rtwn_write_2(sc, R92C_CR, reg);
2026 
2027 	rtwn_write_1(sc, 0xfe10, 0x19);
2028 
2029 	return (0);
2030 }
2031 
2032 static int
2033 rtwn_llt_init(struct rtwn_softc *sc)
2034 {
2035 	int i, error;
2036 
2037 	/* Reserve pages [0; R92C_TX_PAGE_COUNT]. */
2038 	for (i = 0; i < R92C_TX_PAGE_COUNT; i++) {
2039 		if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
2040 			return (error);
2041 	}
2042 	/* NB: 0xff indicates end-of-list. */
2043 	if ((error = rtwn_llt_write(sc, i, 0xff)) != 0)
2044 		return (error);
2045 	/*
2046 	 * Use pages [R92C_TX_PAGE_COUNT + 1; R92C_TXPKTBUF_COUNT - 1]
2047 	 * as ring buffer.
2048 	 */
2049 	for (++i; i < R92C_TXPKTBUF_COUNT - 1; i++) {
2050 		if ((error = rtwn_llt_write(sc, i, i + 1)) != 0)
2051 			return (error);
2052 	}
2053 	/* Make the last page point to the beginning of the ring buffer. */
2054 	error = rtwn_llt_write(sc, i, R92C_TX_PAGE_COUNT + 1);
2055 	return (error);
2056 }
2057 
2058 static void
2059 rtwn_fw_reset(struct rtwn_softc *sc)
2060 {
2061 	uint16_t reg;
2062 	int ntries;
2063 
2064 	/* Tell 8051 to reset itself. */
2065 	rtwn_write_1(sc, R92C_HMETFR + 3, 0x20);
2066 
2067 	/* Wait until 8051 resets by itself. */
2068 	for (ntries = 0; ntries < 100; ntries++) {
2069 		reg = rtwn_read_2(sc, R92C_SYS_FUNC_EN);
2070 		if (!(reg & R92C_SYS_FUNC_EN_CPUEN))
2071 			goto sleep;
2072 		DELAY(50);
2073 	}
2074 	/* Force 8051 reset. */
2075 	rtwn_write_2(sc, R92C_SYS_FUNC_EN, reg & ~R92C_SYS_FUNC_EN_CPUEN);
2076 sleep:
2077 	/*
2078 	 * We must sleep for one second to let the firmware settle.
2079 	 * Accessing registers too early will hang the whole system.
2080 	 */
2081 	if (msleep(&reg, &sc->sc_mtx, 0, "rtwnrst", hz)) {
2082 		device_printf(sc->sc_dev, "timeout waiting for firmware "
2083 		    "initialization to complete\n");
2084 	}
2085 }
2086 
2087 static void
2088 rtwn_fw_loadpage(struct rtwn_softc *sc, int page, const uint8_t *buf, int len)
2089 {
2090 	uint32_t reg;
2091 	int off, mlen, i;
2092 
2093 	reg = rtwn_read_4(sc, R92C_MCUFWDL);
2094 	reg = RW(reg, R92C_MCUFWDL_PAGE, page);
2095 	rtwn_write_4(sc, R92C_MCUFWDL, reg);
2096 
2097 	DELAY(5);
2098 
2099 	off = R92C_FW_START_ADDR;
2100 	while (len > 0) {
2101 		if (len > 196)
2102 			mlen = 196;
2103 		else if (len > 4)
2104 			mlen = 4;
2105 		else
2106 			mlen = 1;
2107 		for (i = 0; i < mlen; i++)
2108 			rtwn_write_1(sc, off++, buf[i]);
2109 		buf += mlen;
2110 		len -= mlen;
2111 	}
2112 }
2113 
2114 static int
2115 rtwn_load_firmware(struct rtwn_softc *sc)
2116 {
2117 	const struct firmware *fw;
2118 	const struct r92c_fw_hdr *hdr;
2119 	const char *name;
2120 	const u_char *ptr;
2121 	size_t len;
2122 	uint32_t reg;
2123 	int mlen, ntries, page, error = 0;
2124 
2125 	/* Read firmware image from the filesystem. */
2126 	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
2127 	    RTWN_CHIP_UMC_A_CUT)
2128 		name = "rtwn-rtl8192cfwU";
2129 	else
2130 		name = "rtwn-rtl8192cfwU_B";
2131 	RTWN_UNLOCK(sc);
2132 	fw = firmware_get(name);
2133 	RTWN_LOCK(sc);
2134 	if (fw == NULL) {
2135 		device_printf(sc->sc_dev,
2136 		    "could not read firmware %s\n", name);
2137 		return (ENOENT);
2138 	}
2139 	len = fw->datasize;
2140 	if (len < sizeof(*hdr)) {
2141 		device_printf(sc->sc_dev, "firmware too short\n");
2142 		error = EINVAL;
2143 		goto fail;
2144 	}
2145 	ptr = fw->data;
2146 	hdr = (const struct r92c_fw_hdr *)ptr;
2147 	/* Check if there is a valid FW header and skip it. */
2148 	if ((le16toh(hdr->signature) >> 4) == 0x88c ||
2149 	    (le16toh(hdr->signature) >> 4) == 0x92c) {
2150 		DPRINTF(("FW V%d.%d %02d-%02d %02d:%02d\n",
2151 		    le16toh(hdr->version), le16toh(hdr->subversion),
2152 		    hdr->month, hdr->date, hdr->hour, hdr->minute));
2153 		ptr += sizeof(*hdr);
2154 		len -= sizeof(*hdr);
2155 	}
2156 
2157 	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
2158 		rtwn_fw_reset(sc);
2159 
2160 	/* Enable FW download. */
2161 	rtwn_write_2(sc, R92C_SYS_FUNC_EN,
2162 	    rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2163 	    R92C_SYS_FUNC_EN_CPUEN);
2164 	rtwn_write_1(sc, R92C_MCUFWDL,
2165 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_EN);
2166 	rtwn_write_1(sc, R92C_MCUFWDL + 2,
2167 	    rtwn_read_1(sc, R92C_MCUFWDL + 2) & ~0x08);
2168 
2169 	/* Reset the FWDL checksum. */
2170 	rtwn_write_1(sc, R92C_MCUFWDL,
2171 	    rtwn_read_1(sc, R92C_MCUFWDL) | R92C_MCUFWDL_CHKSUM_RPT);
2172 
2173 	for (page = 0; len > 0; page++) {
2174 		mlen = MIN(len, R92C_FW_PAGE_SIZE);
2175 		rtwn_fw_loadpage(sc, page, ptr, mlen);
2176 		ptr += mlen;
2177 		len -= mlen;
2178 	}
2179 
2180 	/* Disable FW download. */
2181 	rtwn_write_1(sc, R92C_MCUFWDL,
2182 	    rtwn_read_1(sc, R92C_MCUFWDL) & ~R92C_MCUFWDL_EN);
2183 	rtwn_write_1(sc, R92C_MCUFWDL + 1, 0);
2184 
2185 	/* Wait for checksum report. */
2186 	for (ntries = 0; ntries < 1000; ntries++) {
2187 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_CHKSUM_RPT)
2188 			break;
2189 		DELAY(5);
2190 	}
2191 	if (ntries == 1000) {
2192 		device_printf(sc->sc_dev,
2193 		    "timeout waiting for checksum report\n");
2194 		error = ETIMEDOUT;
2195 		goto fail;
2196 	}
2197 
2198 	reg = rtwn_read_4(sc, R92C_MCUFWDL);
2199 	reg = (reg & ~R92C_MCUFWDL_WINTINI_RDY) | R92C_MCUFWDL_RDY;
2200 	rtwn_write_4(sc, R92C_MCUFWDL, reg);
2201 	/* Wait for firmware readiness. */
2202 	for (ntries = 0; ntries < 2000; ntries++) {
2203 		if (rtwn_read_4(sc, R92C_MCUFWDL) & R92C_MCUFWDL_WINTINI_RDY)
2204 			break;
2205 		DELAY(50);
2206 	}
2207 	if (ntries == 1000) {
2208 		device_printf(sc->sc_dev,
2209 		    "timeout waiting for firmware readiness\n");
2210 		error = ETIMEDOUT;
2211 		goto fail;
2212 	}
2213 fail:
2214 	firmware_put(fw, FIRMWARE_UNLOAD);
2215 	return (error);
2216 }
2217 
2218 static int
2219 rtwn_dma_init(struct rtwn_softc *sc)
2220 {
2221 	uint32_t reg;
2222 	int error;
2223 
2224 	/* Initialize LLT table. */
2225 	error = rtwn_llt_init(sc);
2226 	if (error != 0)
2227 		return error;
2228 
2229 	/* Set number of pages for normal priority queue. */
2230 	rtwn_write_2(sc, R92C_RQPN_NPQ, 0);
2231 	rtwn_write_4(sc, R92C_RQPN,
2232 	    /* Set number of pages for public queue. */
2233 	    SM(R92C_RQPN_PUBQ, R92C_PUBQ_NPAGES) |
2234 	    /* Set number of pages for high priority queue. */
2235 	    SM(R92C_RQPN_HPQ, R92C_HPQ_NPAGES) |
2236 	    /* Set number of pages for low priority queue. */
2237 	    SM(R92C_RQPN_LPQ, R92C_LPQ_NPAGES) |
2238 	    /* Load values. */
2239 	    R92C_RQPN_LD);
2240 
2241 	rtwn_write_1(sc, R92C_TXPKTBUF_BCNQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2242 	rtwn_write_1(sc, R92C_TXPKTBUF_MGQ_BDNY, R92C_TX_PAGE_BOUNDARY);
2243 	rtwn_write_1(sc, R92C_TXPKTBUF_WMAC_LBK_BF_HD, R92C_TX_PAGE_BOUNDARY);
2244 	rtwn_write_1(sc, R92C_TRXFF_BNDY, R92C_TX_PAGE_BOUNDARY);
2245 	rtwn_write_1(sc, R92C_TDECTRL + 1, R92C_TX_PAGE_BOUNDARY);
2246 
2247 	reg = rtwn_read_2(sc, R92C_TRXDMA_CTRL);
2248 	reg &= ~R92C_TRXDMA_CTRL_QMAP_M;
2249 	reg |= 0xF771;
2250 	rtwn_write_2(sc, R92C_TRXDMA_CTRL, reg);
2251 
2252 	rtwn_write_4(sc, R92C_TCR, R92C_TCR_CFENDFORM | (1 << 12) | (1 << 13));
2253 
2254 	/* Configure Tx DMA. */
2255 	rtwn_write_4(sc, R92C_BKQ_DESA, sc->tx_ring[RTWN_BK_QUEUE].paddr);
2256 	rtwn_write_4(sc, R92C_BEQ_DESA, sc->tx_ring[RTWN_BE_QUEUE].paddr);
2257 	rtwn_write_4(sc, R92C_VIQ_DESA, sc->tx_ring[RTWN_VI_QUEUE].paddr);
2258 	rtwn_write_4(sc, R92C_VOQ_DESA, sc->tx_ring[RTWN_VO_QUEUE].paddr);
2259 	rtwn_write_4(sc, R92C_BCNQ_DESA, sc->tx_ring[RTWN_BEACON_QUEUE].paddr);
2260 	rtwn_write_4(sc, R92C_MGQ_DESA, sc->tx_ring[RTWN_MGNT_QUEUE].paddr);
2261 	rtwn_write_4(sc, R92C_HQ_DESA, sc->tx_ring[RTWN_HIGH_QUEUE].paddr);
2262 
2263 	/* Configure Rx DMA. */
2264 	rtwn_write_4(sc, R92C_RX_DESA, sc->rx_ring.paddr);
2265 
2266 	/* Set Tx/Rx transfer page boundary. */
2267 	rtwn_write_2(sc, R92C_TRXFF_BNDY + 2, 0x27ff);
2268 
2269 	/* Set Tx/Rx transfer page size. */
2270 	rtwn_write_1(sc, R92C_PBP,
2271 	    SM(R92C_PBP_PSRX, R92C_PBP_128) |
2272 	    SM(R92C_PBP_PSTX, R92C_PBP_128));
2273 	return (0);
2274 }
2275 
2276 static void
2277 rtwn_mac_init(struct rtwn_softc *sc)
2278 {
2279 	int i;
2280 
2281 	/* Write MAC initialization values. */
2282 	for (i = 0; i < nitems(rtl8192ce_mac); i++)
2283 		rtwn_write_1(sc, rtl8192ce_mac[i].reg, rtl8192ce_mac[i].val);
2284 }
2285 
2286 static void
2287 rtwn_bb_init(struct rtwn_softc *sc)
2288 {
2289 	const struct rtwn_bb_prog *prog;
2290 	uint32_t reg;
2291 	int i;
2292 
2293 	/* Enable BB and RF. */
2294 	rtwn_write_2(sc, R92C_SYS_FUNC_EN,
2295 	    rtwn_read_2(sc, R92C_SYS_FUNC_EN) |
2296 	    R92C_SYS_FUNC_EN_BBRSTB | R92C_SYS_FUNC_EN_BB_GLB_RST |
2297 	    R92C_SYS_FUNC_EN_DIO_RF);
2298 
2299 	rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0xdb83);
2300 
2301 	rtwn_write_1(sc, R92C_RF_CTRL,
2302 	    R92C_RF_CTRL_EN | R92C_RF_CTRL_RSTB | R92C_RF_CTRL_SDMRSTB);
2303 
2304 	rtwn_write_1(sc, R92C_SYS_FUNC_EN,
2305 	    R92C_SYS_FUNC_EN_DIO_PCIE | R92C_SYS_FUNC_EN_PCIEA |
2306 	    R92C_SYS_FUNC_EN_PPLL | R92C_SYS_FUNC_EN_BB_GLB_RST |
2307 	    R92C_SYS_FUNC_EN_BBRSTB);
2308 
2309 	rtwn_write_1(sc, R92C_AFE_XTAL_CTRL + 1, 0x80);
2310 
2311 	rtwn_write_4(sc, R92C_LEDCFG0,
2312 	    rtwn_read_4(sc, R92C_LEDCFG0) | 0x00800000);
2313 
2314 	/* Select BB programming. */
2315 	prog = (sc->chip & RTWN_CHIP_92C) ?
2316 	    &rtl8192ce_bb_prog_2t : &rtl8192ce_bb_prog_1t;
2317 
2318 	/* Write BB initialization values. */
2319 	for (i = 0; i < prog->count; i++) {
2320 		rtwn_bb_write(sc, prog->regs[i], prog->vals[i]);
2321 		DELAY(1);
2322 	}
2323 
2324 	if (sc->chip & RTWN_CHIP_92C_1T2R) {
2325 		/* 8192C 1T only configuration. */
2326 		reg = rtwn_bb_read(sc, R92C_FPGA0_TXINFO);
2327 		reg = (reg & ~0x00000003) | 0x2;
2328 		rtwn_bb_write(sc, R92C_FPGA0_TXINFO, reg);
2329 
2330 		reg = rtwn_bb_read(sc, R92C_FPGA1_TXINFO);
2331 		reg = (reg & ~0x00300033) | 0x00200022;
2332 		rtwn_bb_write(sc, R92C_FPGA1_TXINFO, reg);
2333 
2334 		reg = rtwn_bb_read(sc, R92C_CCK0_AFESETTING);
2335 		reg = (reg & ~0xff000000) | 0x45 << 24;
2336 		rtwn_bb_write(sc, R92C_CCK0_AFESETTING, reg);
2337 
2338 		reg = rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2339 		reg = (reg & ~0x000000ff) | 0x23;
2340 		rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, reg);
2341 
2342 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCPARAM1);
2343 		reg = (reg & ~0x00000030) | 1 << 4;
2344 		rtwn_bb_write(sc, R92C_OFDM0_AGCPARAM1, reg);
2345 
2346 		reg = rtwn_bb_read(sc, 0xe74);
2347 		reg = (reg & ~0x0c000000) | 2 << 26;
2348 		rtwn_bb_write(sc, 0xe74, reg);
2349 		reg = rtwn_bb_read(sc, 0xe78);
2350 		reg = (reg & ~0x0c000000) | 2 << 26;
2351 		rtwn_bb_write(sc, 0xe78, reg);
2352 		reg = rtwn_bb_read(sc, 0xe7c);
2353 		reg = (reg & ~0x0c000000) | 2 << 26;
2354 		rtwn_bb_write(sc, 0xe7c, reg);
2355 		reg = rtwn_bb_read(sc, 0xe80);
2356 		reg = (reg & ~0x0c000000) | 2 << 26;
2357 		rtwn_bb_write(sc, 0xe80, reg);
2358 		reg = rtwn_bb_read(sc, 0xe88);
2359 		reg = (reg & ~0x0c000000) | 2 << 26;
2360 		rtwn_bb_write(sc, 0xe88, reg);
2361 	}
2362 
2363 	/* Write AGC values. */
2364 	for (i = 0; i < prog->agccount; i++) {
2365 		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE,
2366 		    prog->agcvals[i]);
2367 		DELAY(1);
2368 	}
2369 
2370 	if (rtwn_bb_read(sc, R92C_HSSI_PARAM2(0)) &
2371 	    R92C_HSSI_PARAM2_CCK_HIPWR)
2372 		sc->sc_flags |= RTWN_FLAG_CCK_HIPWR;
2373 }
2374 
2375 static void
2376 rtwn_rf_init(struct rtwn_softc *sc)
2377 {
2378 	const struct rtwn_rf_prog *prog;
2379 	uint32_t reg, type;
2380 	int i, j, idx, off;
2381 
2382 	/* Select RF programming based on board type. */
2383 	if (!(sc->chip & RTWN_CHIP_92C)) {
2384 		if (sc->board_type == R92C_BOARD_TYPE_MINICARD)
2385 			prog = rtl8188ce_rf_prog;
2386 		else if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2387 			prog = rtl8188ru_rf_prog;
2388 		else
2389 			prog = rtl8188cu_rf_prog;
2390 	} else
2391 		prog = rtl8192ce_rf_prog;
2392 
2393 	for (i = 0; i < sc->nrxchains; i++) {
2394 		/* Save RF_ENV control type. */
2395 		idx = i / 2;
2396 		off = (i % 2) * 16;
2397 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2398 		type = (reg >> off) & 0x10;
2399 
2400 		/* Set RF_ENV enable. */
2401 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2402 		reg |= 0x100000;
2403 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2404 		DELAY(1);
2405 		/* Set RF_ENV output high. */
2406 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACEOE(i));
2407 		reg |= 0x10;
2408 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACEOE(i), reg);
2409 		DELAY(1);
2410 		/* Set address and data lengths of RF registers. */
2411 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2412 		reg &= ~R92C_HSSI_PARAM2_ADDR_LENGTH;
2413 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2414 		DELAY(1);
2415 		reg = rtwn_bb_read(sc, R92C_HSSI_PARAM2(i));
2416 		reg &= ~R92C_HSSI_PARAM2_DATA_LENGTH;
2417 		rtwn_bb_write(sc, R92C_HSSI_PARAM2(i), reg);
2418 		DELAY(1);
2419 
2420 		/* Write RF initialization values for this chain. */
2421 		for (j = 0; j < prog[i].count; j++) {
2422 			if (prog[i].regs[j] >= 0xf9 &&
2423 			    prog[i].regs[j] <= 0xfe) {
2424 				/*
2425 				 * These are fake RF registers offsets that
2426 				 * indicate a delay is required.
2427 				 */
2428 				DELAY(50);
2429 				continue;
2430 			}
2431 			rtwn_rf_write(sc, i, prog[i].regs[j],
2432 			    prog[i].vals[j]);
2433 			DELAY(1);
2434 		}
2435 
2436 		/* Restore RF_ENV control type. */
2437 		reg = rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(idx));
2438 		reg &= ~(0x10 << off) | (type << off);
2439 		rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(idx), reg);
2440 
2441 		/* Cache RF register CHNLBW. */
2442 		sc->rf_chnlbw[i] = rtwn_rf_read(sc, i, R92C_RF_CHNLBW);
2443 	}
2444 
2445 	if ((sc->chip & (RTWN_CHIP_UMC_A_CUT | RTWN_CHIP_92C)) ==
2446 	    RTWN_CHIP_UMC_A_CUT) {
2447 		rtwn_rf_write(sc, 0, R92C_RF_RX_G1, 0x30255);
2448 		rtwn_rf_write(sc, 0, R92C_RF_RX_G2, 0x50a00);
2449 	}
2450 }
2451 
2452 static void
2453 rtwn_cam_init(struct rtwn_softc *sc)
2454 {
2455 	/* Invalidate all CAM entries. */
2456 	rtwn_write_4(sc, R92C_CAMCMD,
2457 	    R92C_CAMCMD_POLLING | R92C_CAMCMD_CLR);
2458 }
2459 
2460 static void
2461 rtwn_pa_bias_init(struct rtwn_softc *sc)
2462 {
2463 	uint8_t reg;
2464 	int i;
2465 
2466 	for (i = 0; i < sc->nrxchains; i++) {
2467 		if (sc->pa_setting & (1 << i))
2468 			continue;
2469 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x0f406);
2470 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x4f406);
2471 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0x8f406);
2472 		rtwn_rf_write(sc, i, R92C_RF_IPA, 0xcf406);
2473 	}
2474 	if (!(sc->pa_setting & 0x10)) {
2475 		reg = rtwn_read_1(sc, 0x16);
2476 		reg = (reg & ~0xf0) | 0x90;
2477 		rtwn_write_1(sc, 0x16, reg);
2478 	}
2479 }
2480 
2481 static void
2482 rtwn_rxfilter_init(struct rtwn_softc *sc)
2483 {
2484 	/* Initialize Rx filter. */
2485 	/* TODO: use better filter for monitor mode. */
2486 	rtwn_write_4(sc, R92C_RCR,
2487 	    R92C_RCR_AAP | R92C_RCR_APM | R92C_RCR_AM | R92C_RCR_AB |
2488 	    R92C_RCR_APP_ICV | R92C_RCR_AMF | R92C_RCR_HTC_LOC_CTRL |
2489 	    R92C_RCR_APP_MIC | R92C_RCR_APP_PHYSTS);
2490 	/* Accept all multicast frames. */
2491 	rtwn_write_4(sc, R92C_MAR + 0, 0xffffffff);
2492 	rtwn_write_4(sc, R92C_MAR + 4, 0xffffffff);
2493 	/* Accept all management frames. */
2494 	rtwn_write_2(sc, R92C_RXFLTMAP0, 0xffff);
2495 	/* Reject all control frames. */
2496 	rtwn_write_2(sc, R92C_RXFLTMAP1, 0x0000);
2497 	/* Accept all data frames. */
2498 	rtwn_write_2(sc, R92C_RXFLTMAP2, 0xffff);
2499 }
2500 
2501 static void
2502 rtwn_edca_init(struct rtwn_softc *sc)
2503 {
2504 
2505 	rtwn_write_2(sc, R92C_SPEC_SIFS, 0x1010);
2506 	rtwn_write_2(sc, R92C_MAC_SPEC_SIFS, 0x1010);
2507 	rtwn_write_2(sc, R92C_SIFS_CCK, 0x1010);
2508 	rtwn_write_2(sc, R92C_SIFS_OFDM, 0x0e0e);
2509 	rtwn_write_4(sc, R92C_EDCA_BE_PARAM, 0x005ea42b);
2510 	rtwn_write_4(sc, R92C_EDCA_BK_PARAM, 0x0000a44f);
2511 	rtwn_write_4(sc, R92C_EDCA_VI_PARAM, 0x005e4322);
2512 	rtwn_write_4(sc, R92C_EDCA_VO_PARAM, 0x002f3222);
2513 }
2514 
2515 static void
2516 rtwn_write_txpower(struct rtwn_softc *sc, int chain,
2517     uint16_t power[RTWN_RIDX_COUNT])
2518 {
2519 	uint32_t reg;
2520 
2521 	/* Write per-CCK rate Tx power. */
2522 	if (chain == 0) {
2523 		reg = rtwn_bb_read(sc, R92C_TXAGC_A_CCK1_MCS32);
2524 		reg = RW(reg, R92C_TXAGC_A_CCK1,  power[0]);
2525 		rtwn_bb_write(sc, R92C_TXAGC_A_CCK1_MCS32, reg);
2526 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2527 		reg = RW(reg, R92C_TXAGC_A_CCK2,  power[1]);
2528 		reg = RW(reg, R92C_TXAGC_A_CCK55, power[2]);
2529 		reg = RW(reg, R92C_TXAGC_A_CCK11, power[3]);
2530 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2531 	} else {
2532 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK1_55_MCS32);
2533 		reg = RW(reg, R92C_TXAGC_B_CCK1,  power[0]);
2534 		reg = RW(reg, R92C_TXAGC_B_CCK2,  power[1]);
2535 		reg = RW(reg, R92C_TXAGC_B_CCK55, power[2]);
2536 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK1_55_MCS32, reg);
2537 		reg = rtwn_bb_read(sc, R92C_TXAGC_B_CCK11_A_CCK2_11);
2538 		reg = RW(reg, R92C_TXAGC_B_CCK11, power[3]);
2539 		rtwn_bb_write(sc, R92C_TXAGC_B_CCK11_A_CCK2_11, reg);
2540 	}
2541 	/* Write per-OFDM rate Tx power. */
2542 	rtwn_bb_write(sc, R92C_TXAGC_RATE18_06(chain),
2543 	    SM(R92C_TXAGC_RATE06, power[ 4]) |
2544 	    SM(R92C_TXAGC_RATE09, power[ 5]) |
2545 	    SM(R92C_TXAGC_RATE12, power[ 6]) |
2546 	    SM(R92C_TXAGC_RATE18, power[ 7]));
2547 	rtwn_bb_write(sc, R92C_TXAGC_RATE54_24(chain),
2548 	    SM(R92C_TXAGC_RATE24, power[ 8]) |
2549 	    SM(R92C_TXAGC_RATE36, power[ 9]) |
2550 	    SM(R92C_TXAGC_RATE48, power[10]) |
2551 	    SM(R92C_TXAGC_RATE54, power[11]));
2552 	/* Write per-MCS Tx power. */
2553 	rtwn_bb_write(sc, R92C_TXAGC_MCS03_MCS00(chain),
2554 	    SM(R92C_TXAGC_MCS00,  power[12]) |
2555 	    SM(R92C_TXAGC_MCS01,  power[13]) |
2556 	    SM(R92C_TXAGC_MCS02,  power[14]) |
2557 	    SM(R92C_TXAGC_MCS03,  power[15]));
2558 	rtwn_bb_write(sc, R92C_TXAGC_MCS07_MCS04(chain),
2559 	    SM(R92C_TXAGC_MCS04,  power[16]) |
2560 	    SM(R92C_TXAGC_MCS05,  power[17]) |
2561 	    SM(R92C_TXAGC_MCS06,  power[18]) |
2562 	    SM(R92C_TXAGC_MCS07,  power[19]));
2563 	rtwn_bb_write(sc, R92C_TXAGC_MCS11_MCS08(chain),
2564 	    SM(R92C_TXAGC_MCS08,  power[20]) |
2565 	    SM(R92C_TXAGC_MCS09,  power[21]) |
2566 	    SM(R92C_TXAGC_MCS10,  power[22]) |
2567 	    SM(R92C_TXAGC_MCS11,  power[23]));
2568 	rtwn_bb_write(sc, R92C_TXAGC_MCS15_MCS12(chain),
2569 	    SM(R92C_TXAGC_MCS12,  power[24]) |
2570 	    SM(R92C_TXAGC_MCS13,  power[25]) |
2571 	    SM(R92C_TXAGC_MCS14,  power[26]) |
2572 	    SM(R92C_TXAGC_MCS15,  power[27]));
2573 }
2574 
2575 static void
2576 rtwn_get_txpower(struct rtwn_softc *sc, int chain,
2577     struct ieee80211_channel *c, struct ieee80211_channel *extc,
2578     uint16_t power[RTWN_RIDX_COUNT])
2579 {
2580 	struct ieee80211com *ic = &sc->sc_ic;
2581 	struct r92c_rom *rom = &sc->rom;
2582 	uint16_t cckpow, ofdmpow, htpow, diff, max;
2583 	const struct rtwn_txpwr *base;
2584 	int ridx, chan, group;
2585 
2586 	/* Determine channel group. */
2587 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2588 	if (chan <= 3)
2589 		group = 0;
2590 	else if (chan <= 9)
2591 		group = 1;
2592 	else
2593 		group = 2;
2594 
2595 	/* Get original Tx power based on board type and RF chain. */
2596 	if (!(sc->chip & RTWN_CHIP_92C)) {
2597 		if (sc->board_type == R92C_BOARD_TYPE_HIGHPA)
2598 			base = &rtl8188ru_txagc[chain];
2599 		else
2600 			base = &rtl8192cu_txagc[chain];
2601 	} else
2602 		base = &rtl8192cu_txagc[chain];
2603 
2604 	memset(power, 0, RTWN_RIDX_COUNT * sizeof(power[0]));
2605 	if (sc->regulatory == 0) {
2606 		for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++)
2607 			power[ridx] = base->pwr[0][ridx];
2608 	}
2609 	for (ridx = RTWN_RIDX_OFDM6; ridx < RTWN_RIDX_COUNT; ridx++) {
2610 		if (sc->regulatory == 3) {
2611 			power[ridx] = base->pwr[0][ridx];
2612 			/* Apply vendor limits. */
2613 			if (extc != NULL)
2614 				max = rom->ht40_max_pwr[group];
2615 			else
2616 				max = rom->ht20_max_pwr[group];
2617 			max = (max >> (chain * 4)) & 0xf;
2618 			if (power[ridx] > max)
2619 				power[ridx] = max;
2620 		} else if (sc->regulatory == 1) {
2621 			if (extc == NULL)
2622 				power[ridx] = base->pwr[group][ridx];
2623 		} else if (sc->regulatory != 2)
2624 			power[ridx] = base->pwr[0][ridx];
2625 	}
2626 
2627 	/* Compute per-CCK rate Tx power. */
2628 	cckpow = rom->cck_tx_pwr[chain][group];
2629 	for (ridx = RTWN_RIDX_CCK1; ridx <= RTWN_RIDX_CCK11; ridx++) {
2630 		power[ridx] += cckpow;
2631 		if (power[ridx] > R92C_MAX_TX_PWR)
2632 			power[ridx] = R92C_MAX_TX_PWR;
2633 	}
2634 
2635 	htpow = rom->ht40_1s_tx_pwr[chain][group];
2636 	if (sc->ntxchains > 1) {
2637 		/* Apply reduction for 2 spatial streams. */
2638 		diff = rom->ht40_2s_tx_pwr_diff[group];
2639 		diff = (diff >> (chain * 4)) & 0xf;
2640 		htpow = (htpow > diff) ? htpow - diff : 0;
2641 	}
2642 
2643 	/* Compute per-OFDM rate Tx power. */
2644 	diff = rom->ofdm_tx_pwr_diff[group];
2645 	diff = (diff >> (chain * 4)) & 0xf;
2646 	ofdmpow = htpow + diff;	/* HT->OFDM correction. */
2647 	for (ridx = RTWN_RIDX_OFDM6; ridx <= RTWN_RIDX_OFDM54; ridx++) {
2648 		power[ridx] += ofdmpow;
2649 		if (power[ridx] > R92C_MAX_TX_PWR)
2650 			power[ridx] = R92C_MAX_TX_PWR;
2651 	}
2652 
2653 	/* Compute per-MCS Tx power. */
2654 	if (extc == NULL) {
2655 		diff = rom->ht20_tx_pwr_diff[group];
2656 		diff = (diff >> (chain * 4)) & 0xf;
2657 		htpow += diff;	/* HT40->HT20 correction. */
2658 	}
2659 	for (ridx = RTWN_RIDX_MCS0; ridx <= RTWN_RIDX_MCS15; ridx++) {
2660 		power[ridx] += htpow;
2661 		if (power[ridx] > R92C_MAX_TX_PWR)
2662 			power[ridx] = R92C_MAX_TX_PWR;
2663 	}
2664 #ifdef RTWN_DEBUG
2665 	if (sc->sc_debug >= 4) {
2666 		/* Dump per-rate Tx power values. */
2667 		printf("Tx power for chain %d:\n", chain);
2668 		for (ridx = RTWN_RIDX_CCK1; ridx < RTWN_RIDX_COUNT; ridx++)
2669 			printf("Rate %d = %u\n", ridx, power[ridx]);
2670 	}
2671 #endif
2672 }
2673 
2674 static void
2675 rtwn_set_txpower(struct rtwn_softc *sc, struct ieee80211_channel *c,
2676     struct ieee80211_channel *extc)
2677 {
2678 	uint16_t power[RTWN_RIDX_COUNT];
2679 	int i;
2680 
2681 	for (i = 0; i < sc->ntxchains; i++) {
2682 		/* Compute per-rate Tx power values. */
2683 		rtwn_get_txpower(sc, i, c, extc, power);
2684 		/* Write per-rate Tx power values to hardware. */
2685 		rtwn_write_txpower(sc, i, power);
2686 	}
2687 }
2688 
2689 static void
2690 rtwn_set_rx_bssid_all(struct rtwn_softc *sc, int enable)
2691 {
2692 	uint32_t reg;
2693 
2694 	reg = rtwn_read_4(sc, R92C_RCR);
2695 	if (enable)
2696 		reg &= ~R92C_RCR_CBSSID_BCN;
2697 	else
2698 		reg |= R92C_RCR_CBSSID_BCN;
2699 	rtwn_write_4(sc, R92C_RCR, reg);
2700 }
2701 
2702 static void
2703 rtwn_set_gain(struct rtwn_softc *sc, uint8_t gain)
2704 {
2705 	uint32_t reg;
2706 
2707 	reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(0));
2708 	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
2709 	rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(0), reg);
2710 
2711 	reg = rtwn_bb_read(sc, R92C_OFDM0_AGCCORE1(1));
2712 	reg = RW(reg, R92C_OFDM0_AGCCORE1_GAIN, gain);
2713 	rtwn_bb_write(sc, R92C_OFDM0_AGCCORE1(1), reg);
2714 }
2715 
2716 static void
2717 rtwn_scan_start(struct ieee80211com *ic)
2718 {
2719 	struct rtwn_softc *sc = ic->ic_softc;
2720 
2721 	RTWN_LOCK(sc);
2722 	/* Receive beacons / probe responses from any BSSID. */
2723 	rtwn_set_rx_bssid_all(sc, 1);
2724 	/* Set gain for scanning. */
2725 	rtwn_set_gain(sc, 0x20);
2726 	RTWN_UNLOCK(sc);
2727 }
2728 
2729 static void
2730 rtwn_scan_end(struct ieee80211com *ic)
2731 {
2732 	struct rtwn_softc *sc = ic->ic_softc;
2733 
2734 	RTWN_LOCK(sc);
2735 	/* Restore limitations. */
2736 	rtwn_set_rx_bssid_all(sc, 0);
2737 	/* Set gain under link. */
2738 	rtwn_set_gain(sc, 0x32);
2739 	RTWN_UNLOCK(sc);
2740 }
2741 
2742 static void
2743 rtwn_getradiocaps(struct ieee80211com *ic,
2744     int maxchans, int *nchans, struct ieee80211_channel chans[])
2745 {
2746 	uint8_t bands[IEEE80211_MODE_BYTES];
2747 
2748 	memset(bands, 0, sizeof(bands));
2749 	setbit(bands, IEEE80211_MODE_11B);
2750 	setbit(bands, IEEE80211_MODE_11G);
2751 	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
2752 	    rtwn_chan_2ghz, nitems(rtwn_chan_2ghz), bands, 0);
2753 }
2754 
2755 static void
2756 rtwn_set_channel(struct ieee80211com *ic)
2757 {
2758 	struct rtwn_softc *sc = ic->ic_softc;
2759 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2760 
2761 	RTWN_LOCK(sc);
2762 	if (vap->iv_state == IEEE80211_S_SCAN) {
2763 		/* Make link LED blink during scan. */
2764 		rtwn_set_led(sc, RTWN_LED_LINK, !sc->ledlink);
2765 	}
2766 	rtwn_set_chan(sc, ic->ic_curchan, NULL);
2767 	RTWN_UNLOCK(sc);
2768 }
2769 
2770 static void
2771 rtwn_update_mcast(struct ieee80211com *ic)
2772 {
2773 
2774 	/* XXX do nothing?  */
2775 }
2776 
2777 static void
2778 rtwn_set_chan(struct rtwn_softc *sc, struct ieee80211_channel *c,
2779     struct ieee80211_channel *extc)
2780 {
2781 	struct ieee80211com *ic = &sc->sc_ic;
2782 	u_int chan;
2783 	int i;
2784 
2785 	chan = ieee80211_chan2ieee(ic, c);	/* XXX center freq! */
2786 	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2787 		device_printf(sc->sc_dev,
2788 		    "%s: invalid channel %x\n", __func__, chan);
2789 		return;
2790 	}
2791 
2792 	/* Set Tx power for this new channel. */
2793 	rtwn_set_txpower(sc, c, extc);
2794 
2795 	for (i = 0; i < sc->nrxchains; i++) {
2796 		rtwn_rf_write(sc, i, R92C_RF_CHNLBW,
2797 		    RW(sc->rf_chnlbw[i], R92C_RF_CHNLBW_CHNL, chan));
2798 	}
2799 #ifndef IEEE80211_NO_HT
2800 	if (extc != NULL) {
2801 		uint32_t reg;
2802 
2803 		/* Is secondary channel below or above primary? */
2804 		int prichlo = c->ic_freq < extc->ic_freq;
2805 
2806 		rtwn_write_1(sc, R92C_BWOPMODE,
2807 		    rtwn_read_1(sc, R92C_BWOPMODE) & ~R92C_BWOPMODE_20MHZ);
2808 
2809 		reg = rtwn_read_1(sc, R92C_RRSR + 2);
2810 		reg = (reg & ~0x6f) | (prichlo ? 1 : 2) << 5;
2811 		rtwn_write_1(sc, R92C_RRSR + 2, reg);
2812 
2813 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2814 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) | R92C_RFMOD_40MHZ);
2815 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2816 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) | R92C_RFMOD_40MHZ);
2817 
2818 		/* Set CCK side band. */
2819 		reg = rtwn_bb_read(sc, R92C_CCK0_SYSTEM);
2820 		reg = (reg & ~0x00000010) | (prichlo ? 0 : 1) << 4;
2821 		rtwn_bb_write(sc, R92C_CCK0_SYSTEM, reg);
2822 
2823 		reg = rtwn_bb_read(sc, R92C_OFDM1_LSTF);
2824 		reg = (reg & ~0x00000c00) | (prichlo ? 1 : 2) << 10;
2825 		rtwn_bb_write(sc, R92C_OFDM1_LSTF, reg);
2826 
2827 		rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2828 		    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) &
2829 		    ~R92C_FPGA0_ANAPARAM2_CBW20);
2830 
2831 		reg = rtwn_bb_read(sc, 0x818);
2832 		reg = (reg & ~0x0c000000) | (prichlo ? 2 : 1) << 26;
2833 		rtwn_bb_write(sc, 0x818, reg);
2834 
2835 		/* Select 40MHz bandwidth. */
2836 		rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2837 		    (sc->rf_chnlbw[0] & ~0xfff) | chan);
2838 	} else
2839 #endif
2840 	{
2841 		rtwn_write_1(sc, R92C_BWOPMODE,
2842 		    rtwn_read_1(sc, R92C_BWOPMODE) | R92C_BWOPMODE_20MHZ);
2843 
2844 		rtwn_bb_write(sc, R92C_FPGA0_RFMOD,
2845 		    rtwn_bb_read(sc, R92C_FPGA0_RFMOD) & ~R92C_RFMOD_40MHZ);
2846 		rtwn_bb_write(sc, R92C_FPGA1_RFMOD,
2847 		    rtwn_bb_read(sc, R92C_FPGA1_RFMOD) & ~R92C_RFMOD_40MHZ);
2848 
2849 		rtwn_bb_write(sc, R92C_FPGA0_ANAPARAM2,
2850 		    rtwn_bb_read(sc, R92C_FPGA0_ANAPARAM2) |
2851 		    R92C_FPGA0_ANAPARAM2_CBW20);
2852 
2853 		/* Select 20MHz bandwidth. */
2854 		rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
2855 		    (sc->rf_chnlbw[0] & ~0xfff) | R92C_RF_CHNLBW_BW20 | chan);
2856 	}
2857 }
2858 
2859 static int
2860 rtwn_iq_calib_chain(struct rtwn_softc *sc, int chain, uint16_t tx[2],
2861     uint16_t rx[2])
2862 {
2863 	uint32_t status;
2864 	int offset = chain * 0x20;
2865 
2866 	if (chain == 0) {	/* IQ calibration for chain 0. */
2867 		/* IQ calibration settings for chain 0. */
2868 		rtwn_bb_write(sc, 0xe30, 0x10008c1f);
2869 		rtwn_bb_write(sc, 0xe34, 0x10008c1f);
2870 		rtwn_bb_write(sc, 0xe38, 0x82140102);
2871 
2872 		if (sc->ntxchains > 1) {
2873 			rtwn_bb_write(sc, 0xe3c, 0x28160202);	/* 2T */
2874 			/* IQ calibration settings for chain 1. */
2875 			rtwn_bb_write(sc, 0xe50, 0x10008c22);
2876 			rtwn_bb_write(sc, 0xe54, 0x10008c22);
2877 			rtwn_bb_write(sc, 0xe58, 0x82140102);
2878 			rtwn_bb_write(sc, 0xe5c, 0x28160202);
2879 		} else
2880 			rtwn_bb_write(sc, 0xe3c, 0x28160502);	/* 1T */
2881 
2882 		/* LO calibration settings. */
2883 		rtwn_bb_write(sc, 0xe4c, 0x001028d1);
2884 		/* We're doing LO and IQ calibration in one shot. */
2885 		rtwn_bb_write(sc, 0xe48, 0xf9000000);
2886 		rtwn_bb_write(sc, 0xe48, 0xf8000000);
2887 
2888 	} else {		/* IQ calibration for chain 1. */
2889 		/* We're doing LO and IQ calibration in one shot. */
2890 		rtwn_bb_write(sc, 0xe60, 0x00000002);
2891 		rtwn_bb_write(sc, 0xe60, 0x00000000);
2892 	}
2893 
2894 	/* Give LO and IQ calibrations the time to complete. */
2895 	DELAY(1000);
2896 
2897 	/* Read IQ calibration status. */
2898 	status = rtwn_bb_read(sc, 0xeac);
2899 
2900 	if (status & (1 << (28 + chain * 3)))
2901 		return (0);	/* Tx failed. */
2902 	/* Read Tx IQ calibration results. */
2903 	tx[0] = (rtwn_bb_read(sc, 0xe94 + offset) >> 16) & 0x3ff;
2904 	tx[1] = (rtwn_bb_read(sc, 0xe9c + offset) >> 16) & 0x3ff;
2905 	if (tx[0] == 0x142 || tx[1] == 0x042)
2906 		return (0);	/* Tx failed. */
2907 
2908 	if (status & (1 << (27 + chain * 3)))
2909 		return (1);	/* Rx failed. */
2910 	/* Read Rx IQ calibration results. */
2911 	rx[0] = (rtwn_bb_read(sc, 0xea4 + offset) >> 16) & 0x3ff;
2912 	rx[1] = (rtwn_bb_read(sc, 0xeac + offset) >> 16) & 0x3ff;
2913 	if (rx[0] == 0x132 || rx[1] == 0x036)
2914 		return (1);	/* Rx failed. */
2915 
2916 	return (3);	/* Both Tx and Rx succeeded. */
2917 }
2918 
2919 static void
2920 rtwn_iq_calib_run(struct rtwn_softc *sc, int n, uint16_t tx[2][2],
2921     uint16_t rx[2][2])
2922 {
2923 	/* Registers to save and restore during IQ calibration. */
2924 	struct iq_cal_regs {
2925 		uint32_t	adda[16];
2926 		uint8_t		txpause;
2927 		uint8_t		bcn_ctrl;
2928 		uint8_t		ustime_tsf;
2929 		uint32_t	gpio_muxcfg;
2930 		uint32_t	ofdm0_trxpathena;
2931 		uint32_t	ofdm0_trmuxpar;
2932 		uint32_t	fpga0_rfifacesw1;
2933 	} iq_cal_regs;
2934 	static const uint16_t reg_adda[16] = {
2935 		0x85c, 0xe6c, 0xe70, 0xe74,
2936 		0xe78, 0xe7c, 0xe80, 0xe84,
2937 		0xe88, 0xe8c, 0xed0, 0xed4,
2938 		0xed8, 0xedc, 0xee0, 0xeec
2939 	};
2940 	int i, chain;
2941 	uint32_t hssi_param1;
2942 
2943 	if (n == 0) {
2944 		for (i = 0; i < nitems(reg_adda); i++)
2945 			iq_cal_regs.adda[i] = rtwn_bb_read(sc, reg_adda[i]);
2946 
2947 		iq_cal_regs.txpause = rtwn_read_1(sc, R92C_TXPAUSE);
2948 		iq_cal_regs.bcn_ctrl = rtwn_read_1(sc, R92C_BCN_CTRL);
2949 		iq_cal_regs.ustime_tsf = rtwn_read_1(sc, R92C_USTIME_TSF);
2950 		iq_cal_regs.gpio_muxcfg = rtwn_read_4(sc, R92C_GPIO_MUXCFG);
2951 	}
2952 
2953 	if (sc->ntxchains == 1) {
2954 		rtwn_bb_write(sc, reg_adda[0], 0x0b1b25a0);
2955 		for (i = 1; i < nitems(reg_adda); i++)
2956 			rtwn_bb_write(sc, reg_adda[i], 0x0bdb25a0);
2957 	} else {
2958 		for (i = 0; i < nitems(reg_adda); i++)
2959 			rtwn_bb_write(sc, reg_adda[i], 0x04db25a4);
2960 	}
2961 
2962 	hssi_param1 = rtwn_bb_read(sc, R92C_HSSI_PARAM1(0));
2963 	if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
2964 		rtwn_bb_write(sc, R92C_HSSI_PARAM1(0),
2965 		    hssi_param1 | R92C_HSSI_PARAM1_PI);
2966 		rtwn_bb_write(sc, R92C_HSSI_PARAM1(1),
2967 		    hssi_param1 | R92C_HSSI_PARAM1_PI);
2968 	}
2969 
2970 	if (n == 0) {
2971 		iq_cal_regs.ofdm0_trxpathena =
2972 		    rtwn_bb_read(sc, R92C_OFDM0_TRXPATHENA);
2973 		iq_cal_regs.ofdm0_trmuxpar =
2974 		    rtwn_bb_read(sc, R92C_OFDM0_TRMUXPAR);
2975 		iq_cal_regs.fpga0_rfifacesw1 =
2976 		    rtwn_bb_read(sc, R92C_FPGA0_RFIFACESW(1));
2977 	}
2978 
2979 	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA, 0x03a05600);
2980 	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, 0x000800e4);
2981 	rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1), 0x22204000);
2982 	if (sc->ntxchains > 1) {
2983 		rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
2984 		rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00010000);
2985 	}
2986 
2987 	rtwn_write_1(sc, R92C_TXPAUSE, 0x3f);
2988 	rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl & ~(0x08));
2989 	rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf & ~(0x08));
2990 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
2991 	    iq_cal_regs.gpio_muxcfg & ~(0x20));
2992 
2993 	rtwn_bb_write(sc, 0x0b68, 0x00080000);
2994 	if (sc->ntxchains > 1)
2995 		rtwn_bb_write(sc, 0x0b6c, 0x00080000);
2996 
2997 	rtwn_bb_write(sc, 0x0e28, 0x80800000);
2998 	rtwn_bb_write(sc, 0x0e40, 0x01007c00);
2999 	rtwn_bb_write(sc, 0x0e44, 0x01004800);
3000 
3001 	rtwn_bb_write(sc, 0x0b68, 0x00080000);
3002 
3003 	for (chain = 0; chain < sc->ntxchains; chain++) {
3004 		if (chain > 0) {
3005 			/* Put chain 0 on standby. */
3006 			rtwn_bb_write(sc, 0x0e28, 0x00);
3007 			rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00010000);
3008 			rtwn_bb_write(sc, 0x0e28, 0x80800000);
3009 
3010 			/* Enable chain 1. */
3011 			for (i = 0; i < nitems(reg_adda); i++)
3012 				rtwn_bb_write(sc, reg_adda[i], 0x0b1b25a4);
3013 		}
3014 
3015 		/* Run IQ calibration twice. */
3016 		for (i = 0; i < 2; i++) {
3017 			int ret;
3018 
3019 			ret = rtwn_iq_calib_chain(sc, chain,
3020 			    tx[chain], rx[chain]);
3021 			if (ret == 0) {
3022 				DPRINTF(("%s: chain %d: Tx failed.\n",
3023 				    __func__, chain));
3024 				tx[chain][0] = 0xff;
3025 				tx[chain][1] = 0xff;
3026 				rx[chain][0] = 0xff;
3027 				rx[chain][1] = 0xff;
3028 			} else if (ret == 1) {
3029 				DPRINTF(("%s: chain %d: Rx failed.\n",
3030 				    __func__, chain));
3031 				rx[chain][0] = 0xff;
3032 				rx[chain][1] = 0xff;
3033 			} else if (ret == 3) {
3034 				DPRINTF(("%s: chain %d: Both Tx and Rx "
3035 				    "succeeded.\n", __func__, chain));
3036 			}
3037 		}
3038 
3039 		DPRINTF(("%s: results for run %d chain %d: tx[0]=0x%x, "
3040 		    "tx[1]=0x%x rx[0]=0x%x rx[1]=0x%x\n", __func__, n, chain,
3041 		    tx[chain][0], tx[chain][1], rx[chain][0], rx[chain][1]));
3042 	}
3043 
3044 	rtwn_bb_write(sc, R92C_OFDM0_TRXPATHENA,
3045 	    iq_cal_regs.ofdm0_trxpathena);
3046 	rtwn_bb_write(sc, R92C_FPGA0_RFIFACESW(1),
3047 	    iq_cal_regs.fpga0_rfifacesw1);
3048 	rtwn_bb_write(sc, R92C_OFDM0_TRMUXPAR, iq_cal_regs.ofdm0_trmuxpar);
3049 
3050 	rtwn_bb_write(sc, 0x0e28, 0x00);
3051 	rtwn_bb_write(sc, R92C_LSSI_PARAM(0), 0x00032ed3);
3052 	if (sc->ntxchains > 1)
3053 		rtwn_bb_write(sc, R92C_LSSI_PARAM(1), 0x00032ed3);
3054 
3055 	if (n != 0) {
3056 		if (!(hssi_param1 & R92C_HSSI_PARAM1_PI)) {
3057 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(0), hssi_param1);
3058 			rtwn_bb_write(sc, R92C_HSSI_PARAM1(1), hssi_param1);
3059 		}
3060 
3061 		for (i = 0; i < nitems(reg_adda); i++)
3062 			rtwn_bb_write(sc, reg_adda[i], iq_cal_regs.adda[i]);
3063 
3064 		rtwn_write_1(sc, R92C_TXPAUSE, iq_cal_regs.txpause);
3065 		rtwn_write_1(sc, R92C_BCN_CTRL, iq_cal_regs.bcn_ctrl);
3066 		rtwn_write_1(sc, R92C_USTIME_TSF, iq_cal_regs.ustime_tsf);
3067 		rtwn_write_4(sc, R92C_GPIO_MUXCFG, iq_cal_regs.gpio_muxcfg);
3068 	}
3069 }
3070 
3071 #define RTWN_IQ_CAL_MAX_TOLERANCE 5
3072 static int
3073 rtwn_iq_calib_compare_results(uint16_t tx1[2][2], uint16_t rx1[2][2],
3074     uint16_t tx2[2][2], uint16_t rx2[2][2], int ntxchains)
3075 {
3076 	int chain, i, tx_ok[2], rx_ok[2];
3077 
3078 	tx_ok[0] = tx_ok[1] = rx_ok[0] = rx_ok[1] = 0;
3079 	for (chain = 0; chain < ntxchains; chain++) {
3080 		for (i = 0; i < 2; i++)	{
3081 			if (tx1[chain][i] == 0xff || tx2[chain][i] == 0xff ||
3082 			    rx1[chain][i] == 0xff || rx2[chain][i] == 0xff)
3083 				continue;
3084 
3085 			tx_ok[chain] = (abs(tx1[chain][i] - tx2[chain][i]) <=
3086 			    RTWN_IQ_CAL_MAX_TOLERANCE);
3087 
3088 			rx_ok[chain] = (abs(rx1[chain][i] - rx2[chain][i]) <=
3089 			    RTWN_IQ_CAL_MAX_TOLERANCE);
3090 		}
3091 	}
3092 
3093 	if (ntxchains > 1)
3094 		return (tx_ok[0] && tx_ok[1] && rx_ok[0] && rx_ok[1]);
3095 	else
3096 		return (tx_ok[0] && rx_ok[0]);
3097 }
3098 #undef RTWN_IQ_CAL_MAX_TOLERANCE
3099 
3100 static void
3101 rtwn_iq_calib_write_results(struct rtwn_softc *sc, uint16_t tx[2],
3102     uint16_t rx[2], int chain)
3103 {
3104 	uint32_t reg, val, x;
3105 	long y, tx_c;
3106 
3107 	if (tx[0] == 0xff || tx[1] == 0xff)
3108 		return;
3109 
3110 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
3111 	val = ((reg >> 22) & 0x3ff);
3112 	x = tx[0];
3113 	if (x & 0x0200)
3114 		x |= 0xfc00;
3115 	reg = (((x * val) >> 8) & 0x3ff);
3116 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
3117 
3118 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
3119 	if (((x * val) >> 7) & 0x01)
3120 		reg |= 0x80000000;
3121 	else
3122 		reg &= ~0x80000000;
3123 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
3124 
3125 	y = tx[1];
3126 	if (y & 0x00000200)
3127 		y |= 0xfffffc00;
3128 	tx_c = (y * val) >> 8;
3129 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXAFE(chain));
3130 	reg |= ((((tx_c & 0x3c0) >> 6) << 24) & 0xf0000000);
3131 	rtwn_bb_write(sc, R92C_OFDM0_TXAFE(chain), reg);
3132 
3133 	reg = rtwn_bb_read(sc, R92C_OFDM0_TXIQIMBALANCE(chain));
3134 	reg |= (((tx_c & 0x3f) << 16) & 0x003F0000);
3135 	rtwn_bb_write(sc, R92C_OFDM0_TXIQIMBALANCE(chain), reg);
3136 
3137 	reg = rtwn_bb_read(sc, R92C_OFDM0_ECCATHRESHOLD);
3138 	if (((y * val) >> 7) & 0x01)
3139 		reg |= 0x20000000;
3140 	else
3141 		reg &= ~0x20000000;
3142 	rtwn_bb_write(sc, R92C_OFDM0_ECCATHRESHOLD, reg);
3143 
3144 	if (rx[0] == 0xff || rx[1] == 0xff)
3145 		return;
3146 
3147 	reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQIMBALANCE(chain));
3148 	reg |= (rx[0] & 0x3ff);
3149 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
3150 	reg |= (((rx[1] & 0x03f) << 8) & 0xFC00);
3151 	rtwn_bb_write(sc, R92C_OFDM0_RXIQIMBALANCE(chain), reg);
3152 
3153 	if (chain == 0) {
3154 		reg = rtwn_bb_read(sc, R92C_OFDM0_RXIQEXTANTA);
3155 		reg |= (((rx[1] & 0xf) >> 6) & 0x000f);
3156 		rtwn_bb_write(sc, R92C_OFDM0_RXIQEXTANTA, reg);
3157 	} else {
3158 		reg = rtwn_bb_read(sc, R92C_OFDM0_AGCRSSITABLE);
3159 		reg |= ((((rx[1] & 0xf) >> 6) << 12) & 0xf000);
3160 		rtwn_bb_write(sc, R92C_OFDM0_AGCRSSITABLE, reg);
3161 	}
3162 }
3163 
3164 #define RTWN_IQ_CAL_NRUN	3
3165 static void
3166 rtwn_iq_calib(struct rtwn_softc *sc)
3167 {
3168 	uint16_t tx[RTWN_IQ_CAL_NRUN][2][2], rx[RTWN_IQ_CAL_NRUN][2][2];
3169 	int n, valid;
3170 
3171 	valid = 0;
3172 	for (n = 0; n < RTWN_IQ_CAL_NRUN; n++) {
3173 		rtwn_iq_calib_run(sc, n, tx[n], rx[n]);
3174 
3175 		if (n == 0)
3176 			continue;
3177 
3178 		/* Valid results remain stable after consecutive runs. */
3179 		valid = rtwn_iq_calib_compare_results(tx[n - 1], rx[n - 1],
3180 		    tx[n], rx[n], sc->ntxchains);
3181 		if (valid)
3182 			break;
3183 	}
3184 
3185 	if (valid) {
3186 		rtwn_iq_calib_write_results(sc, tx[n][0], rx[n][0], 0);
3187 		if (sc->ntxchains > 1)
3188 			rtwn_iq_calib_write_results(sc, tx[n][1], rx[n][1], 1);
3189 	}
3190 }
3191 #undef RTWN_IQ_CAL_NRUN
3192 
3193 static void
3194 rtwn_lc_calib(struct rtwn_softc *sc)
3195 {
3196 	uint32_t rf_ac[2];
3197 	uint8_t txmode;
3198 	int i;
3199 
3200 	txmode = rtwn_read_1(sc, R92C_OFDM1_LSTF + 3);
3201 	if ((txmode & 0x70) != 0) {
3202 		/* Disable all continuous Tx. */
3203 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode & ~0x70);
3204 
3205 		/* Set RF mode to standby mode. */
3206 		for (i = 0; i < sc->nrxchains; i++) {
3207 			rf_ac[i] = rtwn_rf_read(sc, i, R92C_RF_AC);
3208 			rtwn_rf_write(sc, i, R92C_RF_AC,
3209 			    RW(rf_ac[i], R92C_RF_AC_MODE,
3210 				R92C_RF_AC_MODE_STANDBY));
3211 		}
3212 	} else {
3213 		/* Block all Tx queues. */
3214 		rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3215 	}
3216 	/* Start calibration. */
3217 	rtwn_rf_write(sc, 0, R92C_RF_CHNLBW,
3218 	    rtwn_rf_read(sc, 0, R92C_RF_CHNLBW) | R92C_RF_CHNLBW_LCSTART);
3219 
3220 	/* Give calibration the time to complete. */
3221 	DELAY(100);
3222 
3223 	/* Restore configuration. */
3224 	if ((txmode & 0x70) != 0) {
3225 		/* Restore Tx mode. */
3226 		rtwn_write_1(sc, R92C_OFDM1_LSTF + 3, txmode);
3227 		/* Restore RF mode. */
3228 		for (i = 0; i < sc->nrxchains; i++)
3229 			rtwn_rf_write(sc, i, R92C_RF_AC, rf_ac[i]);
3230 	} else {
3231 		/* Unblock all Tx queues. */
3232 		rtwn_write_1(sc, R92C_TXPAUSE, 0x00);
3233 	}
3234 }
3235 
3236 static void
3237 rtwn_temp_calib(struct rtwn_softc *sc)
3238 {
3239 	int temp;
3240 
3241 	if (sc->thcal_state == 0) {
3242 		/* Start measuring temperature. */
3243 		rtwn_rf_write(sc, 0, R92C_RF_T_METER, 0x60);
3244 		sc->thcal_state = 1;
3245 		return;
3246 	}
3247 	sc->thcal_state = 0;
3248 
3249 	/* Read measured temperature. */
3250 	temp = rtwn_rf_read(sc, 0, R92C_RF_T_METER) & 0x1f;
3251 	if (temp == 0)	/* Read failed, skip. */
3252 		return;
3253 	DPRINTFN(2, ("temperature=%d\n", temp));
3254 
3255 	/*
3256 	 * Redo IQ and LC calibration if temperature changed significantly
3257 	 * since last calibration.
3258 	 */
3259 	if (sc->thcal_lctemp == 0) {
3260 		/* First calibration is performed in rtwn_init(). */
3261 		sc->thcal_lctemp = temp;
3262 	} else if (abs(temp - sc->thcal_lctemp) > 1) {
3263 		DPRINTF(("IQ/LC calib triggered by temp: %d -> %d\n",
3264 		    sc->thcal_lctemp, temp));
3265 		rtwn_iq_calib(sc);
3266 		rtwn_lc_calib(sc);
3267 		/* Record temperature of last calibration. */
3268 		sc->thcal_lctemp = temp;
3269 	}
3270 }
3271 
3272 static int
3273 rtwn_init(struct rtwn_softc *sc)
3274 {
3275 	struct ieee80211com *ic = &sc->sc_ic;
3276 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3277 	uint32_t reg;
3278 	uint8_t macaddr[IEEE80211_ADDR_LEN];
3279 	int i, error;
3280 
3281 	RTWN_LOCK(sc);
3282 
3283 	if (sc->sc_flags & RTWN_RUNNING) {
3284 		RTWN_UNLOCK(sc);
3285 		return 0;
3286 	}
3287 	sc->sc_flags |= RTWN_RUNNING;
3288 
3289 	/* Init firmware commands ring. */
3290 	sc->fwcur = 0;
3291 
3292 	/* Power on adapter. */
3293 	error = rtwn_power_on(sc);
3294 	if (error != 0) {
3295 		device_printf(sc->sc_dev, "could not power on adapter\n");
3296 		goto fail;
3297 	}
3298 
3299 	/* Initialize DMA. */
3300 	error = rtwn_dma_init(sc);
3301 	if (error != 0) {
3302 		device_printf(sc->sc_dev, "could not initialize DMA\n");
3303 		goto fail;
3304 	}
3305 
3306 	/* Set info size in Rx descriptors (in 64-bit words). */
3307 	rtwn_write_1(sc, R92C_RX_DRVINFO_SZ, 4);
3308 
3309 	/* Disable interrupts. */
3310 	rtwn_write_4(sc, R92C_HISR, 0x00000000);
3311 	rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3312 
3313 	/* Set MAC address. */
3314 	IEEE80211_ADDR_COPY(macaddr, vap ? vap->iv_myaddr : ic->ic_macaddr);
3315 	for (i = 0; i < IEEE80211_ADDR_LEN; i++)
3316 		rtwn_write_1(sc, R92C_MACID + i, macaddr[i]);
3317 
3318 	/* Set initial network type. */
3319 	reg = rtwn_read_4(sc, R92C_CR);
3320 	reg = RW(reg, R92C_CR_NETTYPE, R92C_CR_NETTYPE_INFRA);
3321 	rtwn_write_4(sc, R92C_CR, reg);
3322 
3323 	rtwn_rxfilter_init(sc);
3324 
3325 	reg = rtwn_read_4(sc, R92C_RRSR);
3326 	reg = RW(reg, R92C_RRSR_RATE_BITMAP, R92C_RRSR_RATE_ALL);
3327 	rtwn_write_4(sc, R92C_RRSR, reg);
3328 
3329 	/* Set short/long retry limits. */
3330 	rtwn_write_2(sc, R92C_RL,
3331 	    SM(R92C_RL_SRL, 0x07) | SM(R92C_RL_LRL, 0x07));
3332 
3333 	/* Initialize EDCA parameters. */
3334 	rtwn_edca_init(sc);
3335 
3336 	/* Set data and response automatic rate fallback retry counts. */
3337 	rtwn_write_4(sc, R92C_DARFRC + 0, 0x01000000);
3338 	rtwn_write_4(sc, R92C_DARFRC + 4, 0x07060504);
3339 	rtwn_write_4(sc, R92C_RARFRC + 0, 0x01000000);
3340 	rtwn_write_4(sc, R92C_RARFRC + 4, 0x07060504);
3341 
3342 	rtwn_write_2(sc, R92C_FWHW_TXQ_CTRL, 0x1f80);
3343 
3344 	/* Set ACK timeout. */
3345 	rtwn_write_1(sc, R92C_ACKTO, 0x40);
3346 
3347 	/* Initialize beacon parameters. */
3348 	rtwn_write_2(sc, R92C_TBTT_PROHIBIT, 0x6404);
3349 	rtwn_write_1(sc, R92C_DRVERLYINT, 0x05);
3350 	rtwn_write_1(sc, R92C_BCNDMATIM, 0x02);
3351 	rtwn_write_2(sc, R92C_BCNTCFG, 0x660f);
3352 
3353 	/* Setup AMPDU aggregation. */
3354 	rtwn_write_4(sc, R92C_AGGLEN_LMT, 0x99997631);	/* MCS7~0 */
3355 	rtwn_write_1(sc, R92C_AGGR_BREAK_TIME, 0x16);
3356 
3357 	rtwn_write_1(sc, R92C_BCN_MAX_ERR, 0xff);
3358 	rtwn_write_1(sc, R92C_BCN_CTRL, R92C_BCN_CTRL_DIS_TSF_UDT0);
3359 
3360 	rtwn_write_4(sc, R92C_PIFS, 0x1c);
3361 	rtwn_write_4(sc, R92C_MCUTST_1, 0x0);
3362 
3363 	/* Load 8051 microcode. */
3364 	error = rtwn_load_firmware(sc);
3365 	if (error != 0)
3366 		goto fail;
3367 
3368 	/* Initialize MAC/BB/RF blocks. */
3369 	rtwn_mac_init(sc);
3370 	rtwn_bb_init(sc);
3371 	rtwn_rf_init(sc);
3372 
3373 	/* Turn CCK and OFDM blocks on. */
3374 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3375 	reg |= R92C_RFMOD_CCK_EN;
3376 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3377 	reg = rtwn_bb_read(sc, R92C_FPGA0_RFMOD);
3378 	reg |= R92C_RFMOD_OFDM_EN;
3379 	rtwn_bb_write(sc, R92C_FPGA0_RFMOD, reg);
3380 
3381 	/* Clear per-station keys table. */
3382 	rtwn_cam_init(sc);
3383 
3384 	/* Enable hardware sequence numbering. */
3385 	rtwn_write_1(sc, R92C_HWSEQ_CTRL, 0xff);
3386 
3387 	/* Perform LO and IQ calibrations. */
3388 	rtwn_iq_calib(sc);
3389 	/* Perform LC calibration. */
3390 	rtwn_lc_calib(sc);
3391 
3392 	rtwn_pa_bias_init(sc);
3393 
3394 	/* Initialize GPIO setting. */
3395 	rtwn_write_1(sc, R92C_GPIO_MUXCFG,
3396 	    rtwn_read_1(sc, R92C_GPIO_MUXCFG) & ~R92C_GPIO_MUXCFG_ENBT);
3397 
3398 	/* Fix for lower temperature. */
3399 	rtwn_write_1(sc, 0x15, 0xe9);
3400 
3401 	/* CLear pending interrupts. */
3402 	rtwn_write_4(sc, R92C_HISR, 0xffffffff);
3403 
3404 	/* Enable interrupts. */
3405 	rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
3406 
3407 	callout_reset(&sc->watchdog_to, hz, rtwn_watchdog, sc);
3408 
3409 fail:
3410 	if (error != 0)
3411 		rtwn_stop_locked(sc);
3412 
3413 	RTWN_UNLOCK(sc);
3414 
3415 	return error;
3416 }
3417 
3418 static void
3419 rtwn_stop_locked(struct rtwn_softc *sc)
3420 {
3421 	uint16_t reg;
3422 	int i;
3423 
3424 	RTWN_LOCK_ASSERT(sc);
3425 
3426 	if (!(sc->sc_flags & RTWN_RUNNING))
3427 		return;
3428 
3429 	sc->sc_tx_timer = 0;
3430 	callout_stop(&sc->watchdog_to);
3431 	callout_stop(&sc->calib_to);
3432 	sc->sc_flags &= ~RTWN_RUNNING;
3433 
3434 	/* Disable interrupts. */
3435 	rtwn_write_4(sc, R92C_HISR, 0x00000000);
3436 	rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3437 
3438 	/* Stop hardware. */
3439 	rtwn_write_1(sc, R92C_TXPAUSE, 0xff);
3440 	rtwn_write_1(sc, R92C_RF_CTRL, 0x00);
3441 	reg = rtwn_read_1(sc, R92C_SYS_FUNC_EN);
3442 	reg |= R92C_SYS_FUNC_EN_BB_GLB_RST;
3443 	rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
3444 	reg &= ~R92C_SYS_FUNC_EN_BB_GLB_RST;
3445 	rtwn_write_1(sc, R92C_SYS_FUNC_EN, reg);
3446 	reg = rtwn_read_2(sc, R92C_CR);
3447 	reg &= ~(R92C_CR_HCI_TXDMA_EN | R92C_CR_HCI_RXDMA_EN |
3448 	    R92C_CR_TXDMA_EN | R92C_CR_RXDMA_EN | R92C_CR_PROTOCOL_EN |
3449 	    R92C_CR_SCHEDULE_EN | R92C_CR_MACTXEN | R92C_CR_MACRXEN |
3450 	    R92C_CR_ENSEC);
3451 	rtwn_write_2(sc, R92C_CR, reg);
3452 	if (rtwn_read_1(sc, R92C_MCUFWDL) & R92C_MCUFWDL_RAM_DL_SEL)
3453 		rtwn_fw_reset(sc);
3454 	/* TODO: linux does additional btcoex stuff here */
3455 	rtwn_write_2(sc, R92C_AFE_PLL_CTRL, 0x80); /* linux magic number */
3456 	rtwn_write_1(sc, R92C_SPS0_CTRL, 0x23); /* ditto */
3457 	rtwn_write_1(sc, R92C_AFE_XTAL_CTRL, 0x0e); /* different with btcoex */
3458 	rtwn_write_1(sc, R92C_RSV_CTRL, 0x0e);
3459 	rtwn_write_1(sc, R92C_APS_FSMCO, R92C_APS_FSMCO_PDN_EN);
3460 
3461 	for (i = 0; i < RTWN_NTXQUEUES; i++)
3462 		rtwn_reset_tx_list(sc, i);
3463 	rtwn_reset_rx_list(sc);
3464 }
3465 
3466 static void
3467 rtwn_stop(struct rtwn_softc *sc)
3468 {
3469 	RTWN_LOCK(sc);
3470 	rtwn_stop_locked(sc);
3471 	RTWN_UNLOCK(sc);
3472 }
3473 
3474 static void
3475 rtwn_intr(void *arg)
3476 {
3477 	struct rtwn_softc *sc = arg;
3478 	uint32_t status;
3479 	int i;
3480 
3481 	RTWN_LOCK(sc);
3482 	status = rtwn_read_4(sc, R92C_HISR);
3483 	if (status == 0 || status == 0xffffffff) {
3484 		RTWN_UNLOCK(sc);
3485 		return;
3486 	}
3487 
3488 	/* Disable interrupts. */
3489 	rtwn_write_4(sc, R92C_HIMR, 0x00000000);
3490 
3491 	/* Ack interrupts. */
3492 	rtwn_write_4(sc, R92C_HISR, status);
3493 
3494 	/* Vendor driver treats RX errors like ROK... */
3495 	if (status & (R92C_IMR_ROK | R92C_IMR_RXFOVW | R92C_IMR_RDU)) {
3496 		bus_dmamap_sync(sc->rx_ring.desc_dmat, sc->rx_ring.desc_map,
3497 		    BUS_DMASYNC_POSTREAD);
3498 
3499 		for (i = 0; i < RTWN_RX_LIST_COUNT; i++) {
3500 			struct r92c_rx_desc *rx_desc = &sc->rx_ring.desc[i];
3501 			struct rtwn_rx_data *rx_data = &sc->rx_ring.rx_data[i];
3502 
3503 			if (le32toh(rx_desc->rxdw0) & R92C_RXDW0_OWN)
3504 				continue;
3505 
3506 			rtwn_rx_frame(sc, rx_desc, rx_data, i);
3507 		}
3508 	}
3509 
3510 	if (status & R92C_IMR_BDOK)
3511 		rtwn_tx_done(sc, RTWN_BEACON_QUEUE);
3512 	if (status & R92C_IMR_HIGHDOK)
3513 		rtwn_tx_done(sc, RTWN_HIGH_QUEUE);
3514 	if (status & R92C_IMR_MGNTDOK)
3515 		rtwn_tx_done(sc, RTWN_MGNT_QUEUE);
3516 	if (status & R92C_IMR_BKDOK)
3517 		rtwn_tx_done(sc, RTWN_BK_QUEUE);
3518 	if (status & R92C_IMR_BEDOK)
3519 		rtwn_tx_done(sc, RTWN_BE_QUEUE);
3520 	if (status & R92C_IMR_VIDOK)
3521 		rtwn_tx_done(sc, RTWN_VI_QUEUE);
3522 	if (status & R92C_IMR_VODOK)
3523 		rtwn_tx_done(sc, RTWN_VO_QUEUE);
3524 
3525 	/* Enable interrupts. */
3526 	rtwn_write_4(sc, R92C_HIMR, RTWN_INT_ENABLE);
3527 
3528 	RTWN_UNLOCK(sc);
3529 }
3530