xref: /netbsd-src/sys/dev/usb/if_urtw.c (revision 53b02e147d4ed531c0d2a5ca9b3e8026ba3e99b5)
1 /*	$NetBSD: if_urtw.c,v 1.24 2020/03/15 23:04:51 thorpej Exp $	*/
2 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
3 
4 /*-
5  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
6  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __KERNEL_RCSID(0, "$NetBSD: if_urtw.c,v 1.24 2020/03/15 23:04:51 thorpej Exp $");
23 
24 #ifdef _KERNEL_OPT
25 #include "opt_usb.h"
26 #endif
27 
28 #include <sys/param.h>
29 #include <sys/sockio.h>
30 #include <sys/proc.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/callout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 
41 #include <machine/endian.h>
42 #include <net/bpf.h>
43 #include <net/if.h>
44 #include <net/if_arp.h>
45 #include <net/if_dl.h>
46 #include <net/if_ether.h>
47 #include <net/if_media.h>
48 #include <net/if_types.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/if_inarp.h>
54 #include <netinet/ip.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 
59 #include <dev/usb/usb.h>
60 #include <dev/usb/usbdi.h>
61 #include <dev/usb/usbdi_util.h>
62 #include <dev/usb/usbdivar.h>
63 #include <dev/usb/usbdevs.h>
64 
65 #include "if_urtwreg.h"
66 
67 #ifdef URTW_DEBUG
68 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
69 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
70 int urtw_debug = 0;
71 #else
72 #define	DPRINTF(x)
73 #define	DPRINTFN(n, x)
74 #endif
75 
76 /*
77  * Recognized device vendors/products.
78  */
79 static const struct urtw_type {
80 	struct usb_devno	dev;
81 	uint8_t			rev;
82 } urtw_devs[] = {
83 #define	URTW_DEV_RTL8187(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
85 #define	URTW_DEV_RTL8187B(v, p)	\
86 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
87 	/* Realtek RTL8187 devices. */
88 	URTW_DEV_RTL8187(ASUSTEK,	P5B_WIFI),
89 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
90 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GC_2),
91 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
92 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
93 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
94 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
95 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
96 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
97 	/* Realtek RTL8187B devices. */
98 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
99 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
101 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
102 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
103 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
104 #undef	URTW_DEV_RTL8187
105 #undef	URTW_DEV_RTL8187B
106 };
107 #define	urtw_lookup(v, p)	\
108 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
109 
110 /*
111  * Helper read/write macros.
112  */
113 #define urtw_read8_m(sc, val, data)	do {			\
114 	error = urtw_read8_c(sc, val, data, 0);			\
115 	if (error != 0)						\
116 		goto fail;					\
117 } while (0)
118 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
119 	error = urtw_read8_c(sc, val, data, idx);		\
120 	if (error != 0)						\
121 		goto fail;					\
122 } while (0)
123 #define urtw_write8_m(sc, val, data)	do {			\
124 	error = urtw_write8_c(sc, val, data, 0);		\
125 	if (error != 0)						\
126 		goto fail;					\
127 } while (0)
128 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
129 	error = urtw_write8_c(sc, val, data, idx);		\
130 	if (error != 0)						\
131 		goto fail;					\
132 } while (0)
133 #define urtw_read16_m(sc, val, data)	do {			\
134 	error = urtw_read16_c(sc, val, data, 0);		\
135 	if (error != 0)						\
136 		goto fail;					\
137 } while (0)
138 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
139 	error = urtw_read16_c(sc, val, data, idx);		\
140 	if (error != 0)						\
141 		goto fail;					\
142 } while (0)
143 #define urtw_write16_m(sc, val, data)	do {			\
144 	error = urtw_write16_c(sc, val, data, 0);		\
145 	if (error != 0)						\
146 		goto fail;					\
147 } while (0)
148 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
149 	error = urtw_write16_c(sc, val, data, idx);		\
150 	if (error != 0)						\
151 		goto fail;					\
152 } while (0)
153 #define urtw_read32_m(sc, val, data)	do {			\
154 	error = urtw_read32_c(sc, val, data, 0);		\
155 	if (error != 0)						\
156 		goto fail;					\
157 } while (0)
158 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
159 	error = urtw_read32_c(sc, val, data, idx);		\
160 	if (error != 0)						\
161 		goto fail;					\
162 } while (0)
163 #define urtw_write32_m(sc, val, data)	do {			\
164 	error = urtw_write32_c(sc, val, data, 0);		\
165 	if (error != 0)						\
166 		goto fail;					\
167 } while (0)
168 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
169 	error = urtw_write32_c(sc, val, data, idx);		\
170 	if (error != 0)						\
171 		goto fail;					\
172 } while (0)
173 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
174 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
175 	if (error != 0)						\
176 		goto fail;					\
177 } while (0)
178 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
179 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
180 	if (error != 0)						\
181 		goto fail;					\
182 } while (0)
183 #define urtw_8225_write(sc, val, data)	do {			\
184 	error = urtw_8225_write_c(sc, val, data);		\
185 	if (error != 0)						\
186 		goto fail;					\
187 } while (0)
188 
189 struct urtw_pair {
190 	uint32_t	reg;
191 	uint32_t	val;
192 };
193 
194 struct urtw_pair_idx {
195 	uint8_t		reg;
196 	uint8_t		val;
197 	uint8_t		idx;
198 };
199 
200 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
201 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
202 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
203 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
204 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
205 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
206 	{ 0xff, 0x00, 0 },
207 
208 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
209 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
210 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
211 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
212 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
213 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
214 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
215 	{ 0xf8, 0x08, 1 },
216 
217 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
218 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
219 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
220 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
221 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
222 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
223 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
224 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
225 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
226 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
227 
228 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
229 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
230 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
231 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
232 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
233 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
234 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
235 
236 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
237 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
238 };
239 
240 static uint8_t urtw_8225_agc[] = {
241 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
242 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
243 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
244 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
245 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
246 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
247 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
248 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
249 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
250 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
251 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
252 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
253 };
254 
255 static uint32_t urtw_8225_channel[] = {
256 	0x0000,		/* dummy channel 0 */
257 	0x085c,		/* 1 */
258 	0x08dc,		/* 2 */
259 	0x095c,		/* 3 */
260 	0x09dc,		/* 4 */
261 	0x0a5c,		/* 5 */
262 	0x0adc,		/* 6 */
263 	0x0b5c,		/* 7 */
264 	0x0bdc,		/* 8 */
265 	0x0c5c,		/* 9 */
266 	0x0cdc,		/* 10 */
267 	0x0d5c,		/* 11 */
268 	0x0ddc,		/* 12 */
269 	0x0e5c,		/* 13 */
270 	0x0f72,		/* 14 */
271 };
272 
273 static uint8_t urtw_8225_gain[] = {
274 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
275 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
276 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
277 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
278 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
279 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
280 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
281 };
282 
283 static struct urtw_pair urtw_8225_rf_part1[] = {
284 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
285 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
286 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
287 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
288 };
289 
290 static struct urtw_pair urtw_8225_rf_part2[] = {
291 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
292 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
293 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
294 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
295 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
296 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
297 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
298 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
299 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
300 	{ 0x27, 0x88 }
301 };
302 
303 static struct urtw_pair urtw_8225_rf_part3[] = {
304 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
305 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
306 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
307 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
308 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
309 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
310 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
311 };
312 
313 static uint16_t urtw_8225_rxgain[] = {
314 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
315 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
316 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
317 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
318 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
319 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
320 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
321 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
322 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
323 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
324 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
325 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
326 };
327 
328 static uint8_t urtw_8225_threshold[] = {
329 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
330 };
331 
332 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
333 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
334 };
335 
336 static uint8_t urtw_8225_txpwr_cck[] = {
337 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
338 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
339 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
340 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
341 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
342 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
343 };
344 
345 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
346 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
347 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
348 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
349 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
350 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
351 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
352 };
353 
354 static uint8_t urtw_8225_txpwr_ofdm[] = {
355 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
356 };
357 
358 static uint8_t urtw_8225v2_agc[] = {
359 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
360 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
361 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
362 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
363 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
364 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
365 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
366 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
367 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
368 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
369 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
370 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
371 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
372 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
373 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
374 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
375 };
376 
377 static uint8_t urtw_8225v2_ofdm[] = {
378 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
379 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
380 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
381 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
382 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
383 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
384 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
385 	0x6d, 0x3c, 0xfb, 0x07
386 };
387 
388 static uint8_t urtw_8225v2_gain_bg[] = {
389 	0x23, 0x15, 0xa5,		/* -82-1dbm */
390 	0x23, 0x15, 0xb5,		/* -82-2dbm */
391 	0x23, 0x15, 0xc5,		/* -82-3dbm */
392 	0x33, 0x15, 0xc5,		/* -78dbm */
393 	0x43, 0x15, 0xc5,		/* -74dbm */
394 	0x53, 0x15, 0xc5,		/* -70dbm */
395 	0x63, 0x15, 0xc5,		/* -66dbm */
396 };
397 
398 static struct urtw_pair urtw_8225v2_rf_part1[] = {
399 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
400 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
401 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
402 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
403 };
404 
405 static struct urtw_pair urtw_8225v2_rf_part2[] = {
406 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
407 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
408 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
409 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
410 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
411 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
412 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
413 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
414 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
415 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
416 };
417 
418 static struct urtw_pair urtw_8225v2_rf_part3[] = {
419 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
420 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
421 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
422 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
423 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
424 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
425 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
426 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
427 };
428 
429 static uint16_t urtw_8225v2_rxgain[] = {
430 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
431 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
432 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
433 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
434 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
435 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
436 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
437 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
438 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
439 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
440 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
441 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
442 };
443 
444 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
445 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
446 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
447 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
448 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
449 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
450 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
451 };
452 
453 static uint8_t urtw_8225v2_txpwr_cck[] = {
454 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
455 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
456 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
457 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
458 };
459 
460 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
461 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
463 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
464 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
465 };
466 
467 static struct urtw_pair urtw_8225v2_b_rf[] = {
468 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
469 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
470 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
471 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
472 	{ 0x00, 0x01b7 }
473 };
474 
475 static struct urtw_pair urtw_ratetable[] = {
476 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
477 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
478 	{ 96, 10 }, { 108, 11 }
479 };
480 
481 static int		urtw_init(struct ifnet *);
482 static void		urtw_stop(struct ifnet *, int);
483 static int		urtw_ioctl(struct ifnet *, u_long, void *);
484 static void		urtw_start(struct ifnet *);
485 static int		urtw_alloc_rx_data_list(struct urtw_softc *);
486 static void		urtw_free_rx_data_list(struct urtw_softc *);
487 static int		urtw_alloc_tx_data_list(struct urtw_softc *);
488 static void		urtw_free_tx_data_list(struct urtw_softc *);
489 static void		urtw_rxeof(struct usbd_xfer *, void *,
490 		    usbd_status);
491 static int		urtw_tx_start(struct urtw_softc *,
492 		    struct ieee80211_node *, struct mbuf *, int);
493 static void		urtw_txeof_low(struct usbd_xfer *, void *,
494 		    usbd_status);
495 static void		urtw_txeof_normal(struct usbd_xfer *, void *,
496 		    usbd_status);
497 static void		urtw_next_scan(void *);
498 static void		urtw_task(void *);
499 static void		urtw_ledusbtask(void *);
500 static void		urtw_ledtask(void *);
501 static int		urtw_media_change(struct ifnet *);
502 static int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
503 static void		urtw_watchdog(struct ifnet *);
504 static void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
505 static int		urtw_isbmode(uint16_t);
506 static uint16_t	urtw_rate2rtl(int);
507 static uint16_t	urtw_rtl2rate(int);
508 static usbd_status	urtw_set_rate(struct urtw_softc *);
509 static usbd_status	urtw_update_msr(struct urtw_softc *);
510 static usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
511 static usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
512 static usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
513 static usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
514 static usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
515 static usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
516 static usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
517 static usbd_status	urtw_eprom_ck(struct urtw_softc *);
518 static usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
519 		    int);
520 static usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
521 		    uint32_t *);
522 static usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
523 static usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
524 static usbd_status	urtw_get_macaddr(struct urtw_softc *);
525 static usbd_status	urtw_get_txpwr(struct urtw_softc *);
526 static usbd_status	urtw_get_rfchip(struct urtw_softc *);
527 static usbd_status	urtw_led_init(struct urtw_softc *);
528 static usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
529 static usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
530 static usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
531 static usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
532 		    uint32_t);
533 static usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
534 		    uint32_t);
535 static usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
536 static usbd_status	urtw_8225_usb_init(struct urtw_softc *);
537 static usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
538 static usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
539 		    uint16_t);
540 static usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
541 static usbd_status	urtw_8225_rf_init(struct urtw_rf *);
542 static usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
543 static usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
544 static usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
545 static usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
546 static usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
547 static usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
548 static usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
549 static usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
550 static usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
551 static usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
552 static usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
553 static usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
554 static usbd_status	urtw_open_pipes(struct urtw_softc *);
555 static usbd_status	urtw_close_pipes(struct urtw_softc *);
556 static usbd_status	urtw_intr_enable(struct urtw_softc *);
557 static usbd_status	urtw_intr_disable(struct urtw_softc *);
558 static usbd_status	urtw_reset(struct urtw_softc *);
559 static usbd_status	urtw_led_on(struct urtw_softc *, int);
560 static usbd_status	urtw_led_ctl(struct urtw_softc *, int);
561 static usbd_status	urtw_led_blink(struct urtw_softc *);
562 static usbd_status	urtw_led_mode0(struct urtw_softc *, int);
563 static usbd_status	urtw_led_mode1(struct urtw_softc *, int);
564 static usbd_status	urtw_led_mode2(struct urtw_softc *, int);
565 static usbd_status	urtw_led_mode3(struct urtw_softc *, int);
566 static usbd_status	urtw_rx_setconf(struct urtw_softc *);
567 static usbd_status	urtw_rx_enable(struct urtw_softc *);
568 static usbd_status	urtw_tx_enable(struct urtw_softc *);
569 static usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
570 static usbd_status	urtw_8187b_reset(struct urtw_softc *);
571 static int		urtw_8187b_init(struct ifnet *);
572 static usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
573 static usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
574 static usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
575 static usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
576 static usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
577 static usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
578 static int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
579 static int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
580 
581 static int urtw_match(device_t, cfdata_t, void *);
582 static void urtw_attach(device_t, device_t, void *);
583 static int urtw_detach(device_t, int);
584 static int urtw_activate(device_t, enum devact);
585 
586 CFATTACH_DECL_NEW(urtw, sizeof(struct urtw_softc),
587 	urtw_match,
588 	urtw_attach,
589 	urtw_detach,
590 	urtw_activate
591 );
592 
593 static int
594 urtw_match(device_t parent, cfdata_t match, void *aux)
595 {
596 	struct usb_attach_arg *uaa = aux;
597 
598 	return urtw_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
599 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
600 }
601 
602 static void
603 urtw_attach(device_t parent, device_t self, void *aux)
604 {
605 	struct urtw_softc *sc = device_private(self);
606 	struct usb_attach_arg *uaa = aux;
607 	struct ieee80211com *ic = &sc->sc_ic;
608 	struct ifnet *ifp = &sc->sc_if;
609 	usbd_status error;
610 	uint8_t data8;
611 	uint32_t data;
612 	int i;
613 
614 	sc->sc_dev = self;
615 	sc->sc_udev = uaa->uaa_device;
616 	sc->sc_hwrev = urtw_lookup(uaa->uaa_vendor, uaa->uaa_product)->rev;
617 	sc->sc_init_state = URTW_INIT_NONE;
618 
619 	aprint_naive("\n");
620 	aprint_normal(": ");
621 
622 	if (sc->sc_hwrev & URTW_HWREV_8187) {
623 		urtw_read32_m(sc, URTW_TX_CONF, &data);
624 		data &= URTW_TX_HWREV_MASK;
625 		switch (data) {
626 		case URTW_TX_HWREV_8187_D:
627 			sc->sc_hwrev |= URTW_HWREV_8187_D;
628 			aprint_normal("RTL8187 rev D");
629 			break;
630 		case URTW_TX_HWREV_8187B_D:
631 			/*
632 			 * Detect Realtek RTL8187B devices that use
633 			 * USB IDs of RTL8187.
634 			 */
635 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
636 			aprint_normal("RTL8187B rev B (early)");
637 			break;
638 		default:
639 			sc->sc_hwrev |= URTW_HWREV_8187_B;
640 			aprint_normal("RTL8187 rev 0x%02x", data >> 25);
641 			break;
642 		}
643 	} else {
644 		/* RTL8187B hwrev register. */
645 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
646 		switch (data8) {
647 		case URTW_8187B_HWREV_8187B_B:
648 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
649 			aprint_normal("RTL8187B rev B");
650 			break;
651 		case URTW_8187B_HWREV_8187B_D:
652 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
653 			aprint_normal("RTL8187B rev D");
654 			break;
655 		case URTW_8187B_HWREV_8187B_E:
656 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
657 			aprint_normal("RTL8187B rev E");
658 			break;
659 		default:
660 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
661 			aprint_normal("RTL8187B rev 0x%02x", data8);
662 			break;
663 		}
664 	}
665 
666 	urtw_read32_m(sc, URTW_RX, &data);
667 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
668 	    URTW_EEPROM_93C46;
669 
670 	error = urtw_get_rfchip(sc);
671 	if (error != 0)
672 		goto fail;
673 	error = urtw_get_macaddr(sc);
674 	if (error != 0)
675 		goto fail;
676 	error = urtw_get_txpwr(sc);
677 	if (error != 0)
678 		goto fail;
679 	error = urtw_led_init(sc);		/* XXX incompleted */
680 	if (error != 0)
681 		goto fail;
682 
683 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
684 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
685 	sc->sc_currate = 3;
686 	/* XXX for what? */
687 	sc->sc_preamble_mode = 2;
688 
689 	usb_init_task(&sc->sc_task, urtw_task, sc, 0);
690 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc, 0);
691 	callout_init(&sc->scan_to, 0);
692 	callout_setfunc(&sc->scan_to, urtw_next_scan, sc);
693 	callout_init(&sc->sc_led_ch, 0);
694 	callout_setfunc(&sc->sc_led_ch, urtw_ledtask, sc);
695 
696 	ic->ic_ifp = ifp;
697 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
698 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
699 	ic->ic_state = IEEE80211_S_INIT;
700 
701 	/* set device capabilities */
702 	ic->ic_caps =
703 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
704 	    IEEE80211_C_TXPMGT |	/* tx power management */
705 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
706 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
707 	    IEEE80211_C_WEP |		/* s/w WEP */
708 	    IEEE80211_C_WPA;		/* WPA/RSN */
709 
710 	/* set supported .11b and .11g rates */
711 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
712 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
713 
714 	/* set supported .11b and .11g channels (1 through 14) */
715 	for (i = 1; i <= 14; i++) {
716 		ic->ic_channels[i].ic_freq =
717 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
718 		ic->ic_channels[i].ic_flags =
719 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
720 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
721 	}
722 
723 	ifp->if_softc = sc;
724 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
725 	if (sc->sc_hwrev & URTW_HWREV_8187) {
726 		ifp->if_init = urtw_init;
727 	} else {
728 		ifp->if_init = urtw_8187b_init;
729 	}
730 	ifp->if_ioctl = urtw_ioctl;
731 	ifp->if_start = urtw_start;
732 	ifp->if_watchdog = urtw_watchdog;
733 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
734 	IFQ_SET_READY(&ifp->if_snd);
735 	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
736 
737 	if_attach(ifp);
738 	ieee80211_ifattach(ic);
739 
740 	/* override state transition machine */
741 	sc->sc_newstate = ic->ic_newstate;
742 	ic->ic_newstate = urtw_newstate;
743 
744 	/* XXX media locking needs revisiting */
745 	mutex_init(&sc->sc_media_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
746 	ieee80211_media_init_with_lock(ic,
747 	    urtw_media_change, ieee80211_media_status, &sc->sc_media_mtx);
748 
749 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
750 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
751 	    &sc->sc_drvbpf);
752 
753 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
754 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
755 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
756 
757 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
758 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
759 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
760 
761 	aprint_normal(", address %s\n", ether_sprintf(ic->ic_myaddr));
762 
763 	ieee80211_announce(ic);
764 
765 	sc->sc_init_state = URTW_INIT_INITED;
766 
767 	return;
768 fail:
769 	aprint_error(": %s failed!\n", __func__);
770 	sc->sc_dying = true;
771 }
772 
773 static int
774 urtw_detach(device_t self, int flags)
775 {
776 	struct urtw_softc *sc = device_private(self);
777 	struct ifnet *ifp = &sc->sc_if;
778 	int s;
779 
780 	s = splusb();
781 
782 	sc->sc_dying = true;
783 
784 	if (sc->sc_init_state < URTW_INIT_INITED)
785 		goto out;
786 
787 	callout_halt(&sc->scan_to, NULL);
788 	callout_halt(&sc->sc_led_ch, NULL);
789 	callout_destroy(&sc->scan_to);
790 	callout_destroy(&sc->sc_led_ch);
791 
792 	usb_rem_task_wait(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER, NULL);
793 	usb_rem_task_wait(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER,
794 	    NULL);
795 
796 	if (ifp->if_softc != NULL) {
797 		bpf_detach(ifp);
798 		ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
799 		if_detach(ifp);
800 	}
801 
802 	/* abort and free xfers */
803 	urtw_free_tx_data_list(sc);
804 	urtw_free_rx_data_list(sc);
805 	urtw_close_pipes(sc);
806 
807 out:
808 	splx(s);
809 	return 0;
810 }
811 
812 static int
813 urtw_activate(device_t self, enum devact act)
814 {
815 	struct urtw_softc *sc = device_private(self);
816 
817 	switch (act) {
818 	case DVACT_DEACTIVATE:
819 		sc->sc_dying = true;
820 		break;
821 	}
822 
823 	return 0;
824 }
825 
826 static usbd_status
827 urtw_close_pipes(struct urtw_softc *sc)
828 {
829 	usbd_status error = 0;
830 
831 	if (sc->sc_rxpipe != NULL) {
832 		error = usbd_close_pipe(sc->sc_rxpipe);
833 		if (error != 0)
834 			goto fail;
835 		sc->sc_rxpipe = NULL;
836 	}
837 	if (sc->sc_txpipe_low != NULL) {
838 		error = usbd_close_pipe(sc->sc_txpipe_low);
839 		if (error != 0)
840 			goto fail;
841 		sc->sc_txpipe_low = NULL;
842 	}
843 	if (sc->sc_txpipe_normal != NULL) {
844 		error = usbd_close_pipe(sc->sc_txpipe_normal);
845 		if (error != 0)
846 			goto fail;
847 		sc->sc_txpipe_normal = NULL;
848 	}
849 fail:
850 	return error;
851 }
852 
853 static usbd_status
854 urtw_open_pipes(struct urtw_softc *sc)
855 {
856 	usbd_status error;
857 
858 	/*
859 	 * NB: there is no way to distinguish each pipes so we need to hardcode
860 	 * pipe numbers
861 	 */
862 
863 	/* tx pipe - low priority packets */
864 	if (sc->sc_hwrev & URTW_HWREV_8187)
865 		error = usbd_open_pipe(sc->sc_iface, 0x2,
866 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
867 	else
868 		error = usbd_open_pipe(sc->sc_iface, 0x6,
869 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
870 	if (error != 0) {
871 		printf("%s: could not open Tx low pipe: %s\n",
872 		    device_xname(sc->sc_dev), usbd_errstr(error));
873 		goto fail;
874 	}
875 	/* tx pipe - normal priority packets */
876 	if (sc->sc_hwrev & URTW_HWREV_8187)
877 		error = usbd_open_pipe(sc->sc_iface, 0x3,
878 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
879 	else
880 		error = usbd_open_pipe(sc->sc_iface, 0x7,
881 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
882 	if (error != 0) {
883 		printf("%s: could not open Tx normal pipe: %s\n",
884 		    device_xname(sc->sc_dev), usbd_errstr(error));
885 		goto fail;
886 	}
887 	/* rx pipe */
888 	if (sc->sc_hwrev & URTW_HWREV_8187)
889 		error = usbd_open_pipe(sc->sc_iface, 0x81,
890 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
891 	else
892 		error = usbd_open_pipe(sc->sc_iface, 0x83,
893 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
894 	if (error != 0) {
895 		printf("%s: could not open Rx pipe: %s\n",
896 		    device_xname(sc->sc_dev), usbd_errstr(error));
897 		goto fail;
898 	}
899 
900 	return 0;
901 fail:
902 	(void)urtw_close_pipes(sc);
903 	return error;
904 }
905 
906 static int
907 urtw_alloc_rx_data_list(struct urtw_softc *sc)
908 {
909 	int i, error;
910 
911 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
912 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
913 
914 		data->sc = sc;
915 
916 		error = usbd_create_xfer(sc->sc_rxpipe, MCLBYTES,
917 		    0, 0, &data->xfer);
918 		if (error) {
919 
920 			printf("%s: could not allocate rx xfer\n",
921 			    device_xname(sc->sc_dev));
922 			error = ENOMEM;
923 			goto fail;
924 		}
925 
926 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
927 		if (data->m == NULL) {
928 			printf("%s: could not allocate rx mbuf\n",
929 			    device_xname(sc->sc_dev));
930 			error = ENOMEM;
931 			goto fail;
932 		}
933 		MCLGET(data->m, M_DONTWAIT);
934 		if (!(data->m->m_flags & M_EXT)) {
935 			printf("%s: could not allocate rx mbuf cluster\n",
936 			    device_xname(sc->sc_dev));
937 			error = ENOMEM;
938 			goto fail;
939 		}
940 		data->buf = mtod(data->m, uint8_t *);
941 	}
942 
943 	return 0;
944 
945 fail:
946 	urtw_free_rx_data_list(sc);
947 	return error;
948 }
949 
950 static void
951 urtw_free_rx_data_list(struct urtw_softc *sc)
952 {
953 	int i;
954 
955 	/* Make sure no transfers are pending. */
956 	if (sc->sc_rxpipe != NULL)
957 		usbd_abort_pipe(sc->sc_rxpipe);
958 
959 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
960 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
961 
962 		if (data->xfer != NULL) {
963 			usbd_destroy_xfer(data->xfer);
964 			data->xfer = NULL;
965 		}
966 		if (data->m != NULL) {
967 			m_freem(data->m);
968 			data->m = NULL;
969 		}
970 	}
971 }
972 
973 static int
974 urtw_alloc_tx_data_list(struct urtw_softc *sc)
975 {
976 	int i, error;
977 
978 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
979 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
980 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
981 
982 			data->sc = sc;
983 			data->ni = NULL;
984 
985 			error = usbd_create_xfer((j == URTW_PRIORITY_LOW) ?
986 			    sc->sc_txpipe_low : sc->sc_txpipe_normal,
987 			    URTW_TX_MAXSIZE, USBD_FORCE_SHORT_XFER, 0,
988 			    &data->xfer);
989 			if (error) {
990 				printf("%s: could not allocate tx xfer\n",
991 				    device_xname(sc->sc_dev));
992 				goto fail;
993 			}
994 
995 			data->buf = usbd_get_buffer(data->xfer);
996 
997 			if (((unsigned long)data->buf) % 4)
998 				printf("%s: warn: unaligned buffer %p\n",
999 				    device_xname(sc->sc_dev), data->buf);
1000 		}
1001 	}
1002 
1003 	return 0;
1004 
1005 fail:
1006 	urtw_free_tx_data_list(sc);
1007 	return error;
1008 }
1009 
1010 static void
1011 urtw_free_tx_data_list(struct urtw_softc *sc)
1012 {
1013 	int i;
1014 
1015 	/* Make sure no transfers are pending. */
1016 	if (sc->sc_txpipe_low != NULL)
1017 		usbd_abort_pipe(sc->sc_txpipe_low);
1018 	if (sc->sc_txpipe_normal != NULL)
1019 		usbd_abort_pipe(sc->sc_txpipe_normal);
1020 
1021 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
1022 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1023 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
1024 
1025 			if (data->xfer != NULL) {
1026 				usbd_destroy_xfer(data->xfer);
1027 				data->xfer = NULL;
1028 			}
1029 			if (data->ni != NULL) {
1030 				ieee80211_free_node(data->ni);
1031 				data->ni = NULL;
1032 			}
1033 		}
1034 	}
1035 }
1036 
1037 static int
1038 urtw_media_change(struct ifnet *ifp)
1039 {
1040 	int error;
1041 
1042 	error = ieee80211_media_change(ifp);
1043 	if (error != ENETRESET)
1044 		return error;
1045 
1046 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1047 	    (IFF_UP | IFF_RUNNING))
1048 		ifp->if_init(ifp);
1049 
1050 	return 0;
1051 }
1052 
1053 static int
1054 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1055 {
1056 	struct urtw_softc *sc = ic->ic_ifp->if_softc;
1057 
1058 	/*
1059 	 * XXXSMP: This does not wait for the task, if it is in flight,
1060 	 * to complete.  If this code works at all, it must rely on the
1061 	 * kernel lock to serialize with the USB task thread.
1062 	 */
1063 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1064 	callout_stop(&sc->scan_to);
1065 
1066 	/* do it in a process context */
1067 	sc->sc_state = nstate;
1068 	sc->sc_arg = arg;
1069 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
1070 
1071 	return 0;
1072 }
1073 
1074 static usbd_status
1075 urtw_led_init(struct urtw_softc *sc)
1076 {
1077 	uint32_t rev;
1078 	usbd_status error;
1079 
1080 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1081 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1082 	if (error != 0)
1083 		goto fail;
1084 
1085 	switch (rev & URTW_EPROM_CID_MASK) {
1086 	case URTW_EPROM_CID_ALPHA0:
1087 		sc->sc_strategy = URTW_SW_LED_MODE1;
1088 		break;
1089 	case URTW_EPROM_CID_SERCOMM_PS:
1090 		sc->sc_strategy = URTW_SW_LED_MODE3;
1091 		break;
1092 	case URTW_EPROM_CID_HW_LED:
1093 		sc->sc_strategy = URTW_HW_LED;
1094 		break;
1095 	case URTW_EPROM_CID_RSVD0:
1096 	case URTW_EPROM_CID_RSVD1:
1097 	default:
1098 		sc->sc_strategy = URTW_SW_LED_MODE0;
1099 		break;
1100 	}
1101 
1102 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1103 
1104 fail:
1105 	return error;
1106 }
1107 
1108 static usbd_status
1109 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1110     uint16_t data)
1111 {
1112 	usb_device_request_t req;
1113 
1114 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1115 	req.bRequest = URTW_8187_SETREGS_REQ;
1116 	USETW(req.wValue, addr);
1117 	USETW(req.wIndex, index);
1118 	USETW(req.wLength, sizeof(uint16_t));
1119 
1120 	return usbd_do_request(sc->sc_udev, &req, &data);
1121 }
1122 
1123 static usbd_status
1124 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1125 {
1126 	int i;
1127 	int16_t bit;
1128 	uint8_t rlen = 12, wlen = 6;
1129 	uint16_t o1, o2, o3, tmp;
1130 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1131 	uint32_t mask = 0x80000000, value = 0;
1132 	usbd_status error;
1133 
1134 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1135 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1136 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1137 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1138 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1139 	o1 &= ~0xf;
1140 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1141 	DELAY(5);
1142 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1143 	DELAY(5);
1144 
1145 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1146 		bit = ((d2w & mask) != 0) ? 1 : 0;
1147 
1148 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1149 		DELAY(2);
1150 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1151 		    URTW_BB_HOST_BANG_CLK);
1152 		DELAY(2);
1153 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1154 		    URTW_BB_HOST_BANG_CLK);
1155 		DELAY(2);
1156 		mask = mask >> 1;
1157 		if (i == 2)
1158 			break;
1159 		bit = ((d2w & mask) != 0) ? 1 : 0;
1160 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1161 		    URTW_BB_HOST_BANG_CLK);
1162 		DELAY(2);
1163 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1164 		    URTW_BB_HOST_BANG_CLK);
1165 		DELAY(2);
1166 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1167 		DELAY(1);
1168 	}
1169 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1170 	    URTW_BB_HOST_BANG_CLK);
1171 	DELAY(2);
1172 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1173 	DELAY(2);
1174 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1175 	DELAY(2);
1176 
1177 	mask = 0x800;
1178 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1179 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1180 		    o1 | URTW_BB_HOST_BANG_RW);
1181 		DELAY(2);
1182 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1183 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1184 		DELAY(2);
1185 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1186 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1187 		DELAY(2);
1188 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1189 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1190 		DELAY(2);
1191 
1192 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1193 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1194 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1195 		    o1 | URTW_BB_HOST_BANG_RW);
1196 		DELAY(2);
1197 	}
1198 
1199 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1200 	    URTW_BB_HOST_BANG_RW);
1201 	DELAY(2);
1202 
1203 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1204 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1205 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1206 
1207 	if (data != NULL)
1208 		*data = value;
1209 fail:
1210 	return error;
1211 }
1212 
1213 static usbd_status
1214 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1215 {
1216 	uint16_t d80, d82, d84;
1217 	usbd_status error;
1218 
1219 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1220 	d80 &= 0xfff3;
1221 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1222 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1223 	d84 &= 0xfff0;
1224 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1225 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1226 	DELAY(10);
1227 
1228 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1229 	DELAY(2);
1230 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1231 	DELAY(10);
1232 
1233 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1234 	if (error != 0)
1235 		goto fail;
1236 
1237 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1238 	DELAY(10);
1239 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1240 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1241 	usbd_delay_ms(sc->sc_udev, 2);
1242 fail:
1243 	return error;
1244 }
1245 
1246 static usbd_status
1247 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1248 {
1249 	uint32_t data;
1250 	usbd_status error;
1251 
1252 	*ret = 1;
1253 
1254 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1255 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1256 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1257 	usbd_delay_ms(sc->sc_udev, 500);
1258 
1259 	urtw_8225_write(sc, 0x0, 0x1b7);
1260 
1261 	error = urtw_8225_read(sc, 0x8, &data);
1262 	if (error != 0)
1263 		goto fail;
1264 	if (data != 0x588)
1265 		*ret = 0;
1266 	else {
1267 		error = urtw_8225_read(sc, 0x9, &data);
1268 		if (error != 0)
1269 			goto fail;
1270 		if (data != 0x700)
1271 			*ret = 0;
1272 	}
1273 
1274 	urtw_8225_write(sc, 0x0, 0xb7);
1275 fail:
1276 	return error;
1277 }
1278 
1279 static usbd_status
1280 urtw_get_rfchip(struct urtw_softc *sc)
1281 {
1282 	struct urtw_rf *rf = &sc->sc_rf;
1283 	int ret;
1284 	uint32_t data;
1285 	usbd_status error;
1286 
1287 	rf->rf_sc = sc;
1288 
1289 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1290 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1291 		if (error != 0)
1292 			return error;
1293 		switch (data & 0xff) {
1294 		case URTW_EPROM_RFCHIPID_RTL8225U:
1295 			error = urtw_8225_isv2(sc, &ret);
1296 			if (error != 0)
1297 				goto fail;
1298 			if (ret == 0) {
1299 				rf->init = urtw_8225_rf_init;
1300 				rf->set_chan = urtw_8225_rf_set_chan;
1301 				rf->set_sens = urtw_8225_rf_set_sens;
1302 				printf(", RFv1");
1303 			} else {
1304 				rf->init = urtw_8225v2_rf_init;
1305 				rf->set_chan = urtw_8225v2_rf_set_chan;
1306 				rf->set_sens = NULL;
1307 				printf(", RFv2");
1308 			}
1309 			break;
1310 		default:
1311 			goto fail;
1312 		}
1313 	} else {
1314 		rf->init = urtw_8225v2_b_rf_init;
1315 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1316 		rf->set_sens = NULL;
1317 	}
1318 
1319 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1320 	rf->sens = URTW_8225_RF_DEF_SENS;
1321 
1322 	return 0;
1323 
1324 fail:
1325 	aprint_error(": unsupported RF chip %d", data & 0xff);
1326 	return USBD_INVAL;
1327 }
1328 
1329 static usbd_status
1330 urtw_get_txpwr(struct urtw_softc *sc)
1331 {
1332 	int i, j;
1333 	uint32_t data;
1334 	usbd_status error;
1335 
1336 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1337 	if (error != 0)
1338 		goto fail;
1339 	sc->sc_txpwr_cck_base = data & 0xf;
1340 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1341 
1342 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1343 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1344 		if (error != 0)
1345 			goto fail;
1346 		sc->sc_txpwr_cck[i] = data & 0xf;
1347 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1348 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1349 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1350 	}
1351 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1352 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1353 		if (error != 0)
1354 			goto fail;
1355 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1356 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1357 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1358 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1359 	}
1360 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1361 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1362 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1363 			    &data);
1364 			if (error != 0)
1365 				goto fail;
1366 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1367 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1368 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1369 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1370 			    (data & 0xf000) >> 12;
1371 		}
1372 	} else {
1373 		/* Channel 11. */
1374 		error = urtw_eprom_read32(sc, 0x1b, &data);
1375 		if (error != 0)
1376 			goto fail;
1377 		sc->sc_txpwr_cck[11] = data & 0xf;
1378 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1379 
1380 		/* Channel 12. */
1381 		error = urtw_eprom_read32(sc, 0xa, &data);
1382 		if (error != 0)
1383 			goto fail;
1384 		sc->sc_txpwr_cck[12] = data & 0xf;
1385 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1386 
1387 		/* Channel 13, 14. */
1388 		error = urtw_eprom_read32(sc, 0x1c, &data);
1389 		if (error != 0)
1390 			goto fail;
1391 		sc->sc_txpwr_cck[13] = data & 0xf;
1392 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1393 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1394 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1395 	}
1396 fail:
1397 	return error;
1398 }
1399 
1400 static usbd_status
1401 urtw_get_macaddr(struct urtw_softc *sc)
1402 {
1403 	struct ieee80211com *ic = &sc->sc_ic;
1404 	usbd_status error;
1405 	uint32_t data;
1406 
1407 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1408 	if (error != 0)
1409 		goto fail;
1410 	ic->ic_myaddr[0] = data & 0xff;
1411 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1412 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1413 	if (error != 0)
1414 		goto fail;
1415 	ic->ic_myaddr[2] = data & 0xff;
1416 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1417 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1418 	if (error != 0)
1419 		goto fail;
1420 	ic->ic_myaddr[4] = data & 0xff;
1421 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1422 fail:
1423 	return error;
1424 }
1425 
1426 static usbd_status
1427 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1428 {
1429 #define URTW_READCMD_LEN		3
1430 	int addrlen, i;
1431 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1432 	usbd_status error;
1433 
1434 	/* NB: make sure the buffer is initialized */
1435 	*data = 0;
1436 
1437 	/* enable EPROM programming */
1438 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1439 	DELAY(URTW_EPROM_DELAY);
1440 
1441 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1442 	if (error != 0)
1443 		goto fail;
1444 	error = urtw_eprom_ck(sc);
1445 	if (error != 0)
1446 		goto fail;
1447 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1448 	if (error != 0)
1449 		goto fail;
1450 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1451 		addrlen = 8;
1452 		addrstr[0] = addr & (1 << 7);
1453 		addrstr[1] = addr & (1 << 6);
1454 		addrstr[2] = addr & (1 << 5);
1455 		addrstr[3] = addr & (1 << 4);
1456 		addrstr[4] = addr & (1 << 3);
1457 		addrstr[5] = addr & (1 << 2);
1458 		addrstr[6] = addr & (1 << 1);
1459 		addrstr[7] = addr & (1 << 0);
1460 	} else {
1461 		addrlen=6;
1462 		addrstr[0] = addr & (1 << 5);
1463 		addrstr[1] = addr & (1 << 4);
1464 		addrstr[2] = addr & (1 << 3);
1465 		addrstr[3] = addr & (1 << 2);
1466 		addrstr[4] = addr & (1 << 1);
1467 		addrstr[5] = addr & (1 << 0);
1468 	}
1469 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1470 	if (error != 0)
1471 		goto fail;
1472 
1473 	error = urtw_eprom_writebit(sc, 0);
1474 	if (error != 0)
1475 		goto fail;
1476 
1477 	for (i = 0; i < 16; i++) {
1478 		error = urtw_eprom_ck(sc);
1479 		if (error != 0)
1480 			goto fail;
1481 		error = urtw_eprom_readbit(sc, &data16);
1482 		if (error != 0)
1483 			goto fail;
1484 
1485 		(*data) |= (data16 << (15 - i));
1486 	}
1487 
1488 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1489 	if (error != 0)
1490 		goto fail;
1491 	error = urtw_eprom_ck(sc);
1492 	if (error != 0)
1493 		goto fail;
1494 
1495 	/* now disable EPROM programming */
1496 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1497 fail:
1498 	return error;
1499 #undef URTW_READCMD_LEN
1500 }
1501 
1502 static usbd_status
1503 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1504 {
1505 	uint8_t data8;
1506 	usbd_status error;
1507 
1508 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1509 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1510 	DELAY(URTW_EPROM_DELAY);
1511 
1512 fail:
1513 	return error;
1514 }
1515 
1516 static usbd_status
1517 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1518 {
1519 	int i = 0;
1520 	usbd_status error = 0;
1521 
1522 	for (i = 0; i < buflen; i++) {
1523 		error = urtw_eprom_writebit(sc, buf[i]);
1524 		if (error != 0)
1525 			goto fail;
1526 		error = urtw_eprom_ck(sc);
1527 		if (error != 0)
1528 			goto fail;
1529 	}
1530 fail:
1531 	return error;
1532 }
1533 
1534 static usbd_status
1535 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1536 {
1537 	uint8_t data;
1538 	usbd_status error;
1539 
1540 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1541 	if (bit != 0)
1542 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1543 	else
1544 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1545 	DELAY(URTW_EPROM_DELAY);
1546 fail:
1547 	return error;
1548 }
1549 
1550 static usbd_status
1551 urtw_eprom_ck(struct urtw_softc *sc)
1552 {
1553 	uint8_t data;
1554 	usbd_status error;
1555 
1556 	/* masking */
1557 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1558 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1559 	DELAY(URTW_EPROM_DELAY);
1560 	/* unmasking */
1561 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1562 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1563 	DELAY(URTW_EPROM_DELAY);
1564 fail:
1565 	return error;
1566 }
1567 
1568 static usbd_status
1569 urtw_eprom_cs(struct urtw_softc *sc, int able)
1570 {
1571 	uint8_t data;
1572 	usbd_status error;
1573 
1574 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1575 	if (able == URTW_EPROM_ENABLE)
1576 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1577 	else
1578 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1579 	DELAY(URTW_EPROM_DELAY);
1580 fail:
1581 	return error;
1582 }
1583 
1584 static usbd_status
1585 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1586 {
1587 	usb_device_request_t req;
1588 	usbd_status error;
1589 
1590 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1591 	req.bRequest = URTW_8187_GETREGS_REQ;
1592 	USETW(req.wValue, val | 0xff00);
1593 	USETW(req.wIndex, idx & 0x03);
1594 	USETW(req.wLength, sizeof(uint8_t));
1595 
1596 	error = usbd_do_request(sc->sc_udev, &req, data);
1597 	return error;
1598 }
1599 
1600 static usbd_status
1601 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1602 {
1603 	usb_device_request_t req;
1604 	usbd_status error;
1605 
1606 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1607 	req.bRequest = URTW_8187_GETREGS_REQ;
1608 	USETW(req.wValue, val | 0xfe00);
1609 	USETW(req.wIndex, 0);
1610 	USETW(req.wLength, sizeof(uint8_t));
1611 
1612 	error = usbd_do_request(sc->sc_udev, &req, data);
1613 	return error;
1614 }
1615 
1616 static usbd_status
1617 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1618 {
1619 	usb_device_request_t req;
1620 	usbd_status error;
1621 
1622 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1623 	req.bRequest = URTW_8187_GETREGS_REQ;
1624 	USETW(req.wValue, val | 0xff00);
1625 	USETW(req.wIndex, idx & 0x03);
1626 	USETW(req.wLength, sizeof(uint16_t));
1627 
1628 	error = usbd_do_request(sc->sc_udev, &req, data);
1629 	return error;
1630 }
1631 
1632 static usbd_status
1633 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1634 {
1635 	usb_device_request_t req;
1636 	usbd_status error;
1637 
1638 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1639 	req.bRequest = URTW_8187_GETREGS_REQ;
1640 	USETW(req.wValue, val | 0xff00);
1641 	USETW(req.wIndex, idx & 0x03);
1642 	USETW(req.wLength, sizeof(uint32_t));
1643 
1644 	error = usbd_do_request(sc->sc_udev, &req, data);
1645 	return error;
1646 }
1647 
1648 static usbd_status
1649 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1650 {
1651 	usb_device_request_t req;
1652 
1653 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1654 	req.bRequest = URTW_8187_SETREGS_REQ;
1655 	USETW(req.wValue, val | 0xff00);
1656 	USETW(req.wIndex, idx & 0x03);
1657 	USETW(req.wLength, sizeof(uint8_t));
1658 
1659 	return usbd_do_request(sc->sc_udev, &req, &data);
1660 }
1661 
1662 static usbd_status
1663 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1664 {
1665 	usb_device_request_t req;
1666 
1667 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1668 	req.bRequest = URTW_8187_SETREGS_REQ;
1669 	USETW(req.wValue, val | 0xfe00);
1670 	USETW(req.wIndex, 0);
1671 	USETW(req.wLength, sizeof(uint8_t));
1672 
1673 	return usbd_do_request(sc->sc_udev, &req, &data);
1674 }
1675 
1676 static usbd_status
1677 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1678 {
1679 	usb_device_request_t req;
1680 
1681 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1682 	req.bRequest = URTW_8187_SETREGS_REQ;
1683 	USETW(req.wValue, val | 0xff00);
1684 	USETW(req.wIndex, idx & 0x03);
1685 	USETW(req.wLength, sizeof(uint16_t));
1686 
1687 	return usbd_do_request(sc->sc_udev, &req, &data);
1688 }
1689 
1690 static usbd_status
1691 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1692 {
1693 	usb_device_request_t req;
1694 
1695 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1696 	req.bRequest = URTW_8187_SETREGS_REQ;
1697 	USETW(req.wValue, val | 0xff00);
1698 	USETW(req.wIndex, idx & 0x03);
1699 	USETW(req.wLength, sizeof(uint32_t));
1700 
1701 	return usbd_do_request(sc->sc_udev, &req, &data);
1702 }
1703 
1704 static usbd_status
1705 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1706 {
1707 	uint8_t data;
1708 	usbd_status error;
1709 
1710 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1711 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1712 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1713 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1714 fail:
1715 	return error;
1716 }
1717 
1718 static usbd_status
1719 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1720 {
1721 	uint8_t data;
1722 	usbd_status error;
1723 
1724 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1725 	if (error)
1726 		goto fail;
1727 
1728 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1729 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1730 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1731 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1732 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1733 
1734 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1735 	if (error)
1736 		goto fail;
1737 fail:
1738 	return error;
1739 }
1740 
1741 static usbd_status
1742 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1743 {
1744 	uint8_t data;
1745 	usbd_status error;
1746 
1747 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1748 	if (error)
1749 		goto fail;
1750 
1751 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1752 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1753 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1754 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1755 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1756 
1757 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1758 	if (error)
1759 		goto fail;
1760 fail:
1761 	return error;
1762 }
1763 
1764 static usbd_status
1765 urtw_intr_disable(struct urtw_softc *sc)
1766 {
1767 	usbd_status error;
1768 
1769 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1770 
1771 fail:
1772 	return error;
1773 }
1774 
1775 static usbd_status
1776 urtw_reset(struct urtw_softc *sc)
1777 {
1778 	uint8_t data;
1779 	usbd_status error;
1780 
1781 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1782 	if (error)
1783 		goto fail;
1784 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1785 	if (error)
1786 		goto fail;
1787 
1788 	error = urtw_intr_disable(sc);
1789 	if (error)
1790 		goto fail;
1791 	usbd_delay_ms(sc->sc_udev, 100);
1792 
1793 	error = urtw_write8e(sc, 0x18, 0x10);
1794 	if (error != 0)
1795 		goto fail;
1796 	error = urtw_write8e(sc, 0x18, 0x11);
1797 	if (error != 0)
1798 		goto fail;
1799 	error = urtw_write8e(sc, 0x18, 0x00);
1800 	if (error != 0)
1801 		goto fail;
1802 	usbd_delay_ms(sc->sc_udev, 100);
1803 
1804 	urtw_read8_m(sc, URTW_CMD, &data);
1805 	data = (data & 2) | URTW_CMD_RST;
1806 	urtw_write8_m(sc, URTW_CMD, data);
1807 	usbd_delay_ms(sc->sc_udev, 100);
1808 
1809 	urtw_read8_m(sc, URTW_CMD, &data);
1810 	if (data & URTW_CMD_RST) {
1811 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
1812 		goto fail;
1813 	}
1814 
1815 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1816 	if (error)
1817 		goto fail;
1818 	usbd_delay_ms(sc->sc_udev, 100);
1819 
1820 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1821 	if (error)
1822 		goto fail;
1823 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1824 	if (error)
1825 		goto fail;
1826 fail:
1827 	return error;
1828 }
1829 
1830 static usbd_status
1831 urtw_led_on(struct urtw_softc *sc, int type)
1832 {
1833 	usbd_status error;
1834 
1835 	if (type == URTW_LED_GPIO) {
1836 		switch (sc->sc_gpio_ledpin) {
1837 		case URTW_LED_PIN_GPIO0:
1838 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1839 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1840 			break;
1841 		default:
1842 			panic("unsupported LED PIN type %#x",
1843 			    sc->sc_gpio_ledpin);
1844 			/* NOTREACHED */
1845 		}
1846 	} else {
1847 		panic("unsupported LED type %#x", type);
1848 		/* NOTREACHED */
1849 	}
1850 
1851 	sc->sc_gpio_ledon = 1;
1852 fail:
1853 	return error;
1854 }
1855 
1856 static usbd_status
1857 urtw_led_off(struct urtw_softc *sc, int type)
1858 {
1859 	usbd_status error;
1860 
1861 	if (type == URTW_LED_GPIO) {
1862 		switch (sc->sc_gpio_ledpin) {
1863 		case URTW_LED_PIN_GPIO0:
1864 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1865 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1866 			break;
1867 		default:
1868 			panic("unsupported LED PIN type %#x",
1869 			    sc->sc_gpio_ledpin);
1870 			/* NOTREACHED */
1871 		}
1872 	} else {
1873 		panic("unsupported LED type %#x", type);
1874 		/* NOTREACHED */
1875 	}
1876 
1877 	sc->sc_gpio_ledon = 0;
1878 
1879 fail:
1880 	return error;
1881 }
1882 
1883 static usbd_status
1884 urtw_led_mode0(struct urtw_softc *sc, int mode)
1885 {
1886 	switch (mode) {
1887 	case URTW_LED_CTL_POWER_ON:
1888 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1889 		break;
1890 	case URTW_LED_CTL_TX:
1891 		if (sc->sc_gpio_ledinprogress == 1)
1892 			return 0;
1893 
1894 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1895 		sc->sc_gpio_blinktime = 2;
1896 		break;
1897 	case URTW_LED_CTL_LINK:
1898 		sc->sc_gpio_ledstate = URTW_LED_ON;
1899 		break;
1900 	default:
1901 		panic("unsupported LED mode %#x", mode);
1902 		/* NOTREACHED */
1903 	}
1904 
1905 	switch (sc->sc_gpio_ledstate) {
1906 	case URTW_LED_ON:
1907 		if (sc->sc_gpio_ledinprogress != 0)
1908 			break;
1909 		urtw_led_on(sc, URTW_LED_GPIO);
1910 		break;
1911 	case URTW_LED_BLINK_NORMAL:
1912 		if (sc->sc_gpio_ledinprogress != 0)
1913 			break;
1914 		sc->sc_gpio_ledinprogress = 1;
1915 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1916 			URTW_LED_OFF : URTW_LED_ON;
1917 		if (!sc->sc_dying)
1918 			callout_schedule(&sc->sc_led_ch, mstohz(100));
1919 		break;
1920 	case URTW_LED_POWER_ON_BLINK:
1921 		urtw_led_on(sc, URTW_LED_GPIO);
1922 		usbd_delay_ms(sc->sc_udev, 100);
1923 		urtw_led_off(sc, URTW_LED_GPIO);
1924 		break;
1925 	default:
1926 		panic("unknown LED status %#x", sc->sc_gpio_ledstate);
1927 		/* NOTREACHED */
1928 	}
1929 	return 0;
1930 }
1931 
1932 static usbd_status
1933 urtw_led_mode1(struct urtw_softc *sc, int mode)
1934 {
1935 	return USBD_INVAL;
1936 }
1937 
1938 static usbd_status
1939 urtw_led_mode2(struct urtw_softc *sc, int mode)
1940 {
1941 	return USBD_INVAL;
1942 }
1943 
1944 static usbd_status
1945 urtw_led_mode3(struct urtw_softc *sc, int mode)
1946 {
1947 	return USBD_INVAL;
1948 }
1949 
1950 static void
1951 urtw_ledusbtask(void *arg)
1952 {
1953 	struct urtw_softc *sc = arg;
1954 
1955 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1956 		panic("could not process a LED strategy %#x", sc->sc_strategy);
1957 
1958 	urtw_led_blink(sc);
1959 }
1960 
1961 static void
1962 urtw_ledtask(void *arg)
1963 {
1964 	struct urtw_softc *sc = arg;
1965 
1966 	/*
1967 	 * NB: to change a status of the led we need at least a sleep so we
1968 	 * can't do it here
1969 	 */
1970 	usb_add_task(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER);
1971 }
1972 
1973 static usbd_status
1974 urtw_led_ctl(struct urtw_softc *sc, int mode)
1975 {
1976 	usbd_status error = 0;
1977 
1978 	switch (sc->sc_strategy) {
1979 	case URTW_SW_LED_MODE0:
1980 		error = urtw_led_mode0(sc, mode);
1981 		break;
1982 	case URTW_SW_LED_MODE1:
1983 		error = urtw_led_mode1(sc, mode);
1984 		break;
1985 	case URTW_SW_LED_MODE2:
1986 		error = urtw_led_mode2(sc, mode);
1987 		break;
1988 	case URTW_SW_LED_MODE3:
1989 		error = urtw_led_mode3(sc, mode);
1990 		break;
1991 	default:
1992 		panic("unsupported LED mode %d", sc->sc_strategy);
1993 		/* NOTREACHED */
1994 	}
1995 
1996 	return error;
1997 }
1998 
1999 static usbd_status
2000 urtw_led_blink(struct urtw_softc *sc)
2001 {
2002 	uint8_t ing = 0;
2003 
2004 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
2005 		(void)urtw_led_on(sc, URTW_LED_GPIO);
2006 	else
2007 		(void)urtw_led_off(sc, URTW_LED_GPIO);
2008 	sc->sc_gpio_blinktime--;
2009 	if (sc->sc_gpio_blinktime == 0)
2010 		ing = 1;
2011 	else {
2012 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
2013 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
2014 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
2015 			ing = 1;
2016 	}
2017 	if (ing == 1) {
2018 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2019 		    sc->sc_gpio_ledon == 0)
2020 			(void)urtw_led_on(sc, URTW_LED_GPIO);
2021 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2022 		    sc->sc_gpio_ledon == 1)
2023 			(void)urtw_led_off(sc, URTW_LED_GPIO);
2024 
2025 		sc->sc_gpio_blinktime = 0;
2026 		sc->sc_gpio_ledinprogress = 0;
2027 		return 0;
2028 	}
2029 
2030 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2031 	    URTW_LED_ON : URTW_LED_OFF;
2032 
2033 	switch (sc->sc_gpio_ledstate) {
2034 	case URTW_LED_BLINK_NORMAL:
2035 		if (!sc->sc_dying)
2036 			callout_schedule(&sc->sc_led_ch, mstohz(100));
2037 		break;
2038 	default:
2039 		panic("unknown LED status %#x", sc->sc_gpio_ledstate);
2040 		/* NOTREACHED */
2041 	}
2042 	return 0;
2043 }
2044 
2045 static usbd_status
2046 urtw_update_msr(struct urtw_softc *sc)
2047 {
2048 	struct ieee80211com *ic = &sc->sc_ic;
2049 	uint8_t data;
2050 	usbd_status error;
2051 
2052 	urtw_read8_m(sc, URTW_MSR, &data);
2053 	data &= ~URTW_MSR_LINK_MASK;
2054 
2055 	/* Should always be set. */
2056 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2057 		data |= URTW_MSR_LINK_ENEDCA;
2058 
2059 	if (sc->sc_state == IEEE80211_S_RUN) {
2060 		switch (ic->ic_opmode) {
2061 		case IEEE80211_M_STA:
2062 		case IEEE80211_M_MONITOR:
2063 			data |= URTW_MSR_LINK_STA;
2064 			break;
2065 		default:
2066 			panic("unsupported operation mode %#x",
2067 			    ic->ic_opmode);
2068 			/* NOTREACHED */
2069 		}
2070 	} else
2071 		data |= URTW_MSR_LINK_NONE;
2072 
2073 	urtw_write8_m(sc, URTW_MSR, data);
2074 fail:
2075 	return error;
2076 }
2077 
2078 static uint16_t
2079 urtw_rate2rtl(int rate)
2080 {
2081 	unsigned int i;
2082 
2083 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2084 		if (rate == urtw_ratetable[i].reg)
2085 			return urtw_ratetable[i].val;
2086 	}
2087 
2088 	return 3;
2089 }
2090 
2091 static uint16_t
2092 urtw_rtl2rate(int rate)
2093 {
2094 	unsigned int i;
2095 
2096 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2097 		if (rate == urtw_ratetable[i].val)
2098 			return urtw_ratetable[i].reg;
2099 	}
2100 
2101 	return 0;
2102 }
2103 
2104 static usbd_status
2105 urtw_set_rate(struct urtw_softc *sc)
2106 {
2107 	int i, basic_rate, min_rr_rate, max_rr_rate;
2108 	uint16_t data;
2109 	usbd_status error;
2110 
2111 	basic_rate = urtw_rate2rtl(48);
2112 	min_rr_rate = urtw_rate2rtl(12);
2113 	max_rr_rate = urtw_rate2rtl(48);
2114 
2115 	urtw_write8_m(sc, URTW_RESP_RATE,
2116 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2117 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2118 
2119 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2120 	data &= ~URTW_BRSR_MBR_8185;
2121 
2122 	for (i = 0; i <= basic_rate; i++)
2123 		data |= (1 << i);
2124 
2125 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2126 fail:
2127 	return error;
2128 }
2129 
2130 static usbd_status
2131 urtw_intr_enable(struct urtw_softc *sc)
2132 {
2133 	usbd_status error;
2134 
2135 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2136 fail:
2137 	return error;
2138 }
2139 
2140 static usbd_status
2141 urtw_rx_setconf(struct urtw_softc *sc)
2142 {
2143 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2144 	struct ieee80211com *ic = &sc->sc_ic;
2145 	uint32_t data;
2146 	usbd_status error;
2147 
2148 	urtw_read32_m(sc, URTW_RX, &data);
2149 	data = data &~ URTW_RX_FILTER_MASK;
2150 #if 0
2151 	data = data | URTW_RX_FILTER_CTL;
2152 #endif
2153 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2154 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2155 
2156 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2157 		data = data | URTW_RX_FILTER_ICVERR;
2158 		data = data | URTW_RX_FILTER_PWR;
2159 	}
2160 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2161 		data = data | URTW_RX_FILTER_CRCERR;
2162 
2163 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2164 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2165 		data = data | URTW_RX_FILTER_ALLMAC;
2166 	} else {
2167 		data = data | URTW_RX_FILTER_NICMAC;
2168 		data = data | URTW_RX_CHECK_BSSID;
2169 	}
2170 
2171 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2172 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2173 	data = data &~ URTW_MAX_RX_DMA_MASK;
2174 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2175 
2176 	urtw_write32_m(sc, URTW_RX, data);
2177 fail:
2178 	return error;
2179 }
2180 
2181 static usbd_status
2182 urtw_rx_enable(struct urtw_softc *sc)
2183 {
2184 	int i;
2185 	struct urtw_rx_data *rx_data;
2186 	uint8_t data;
2187 	usbd_status error;
2188 
2189 	/*
2190 	 * Start up the receive pipe.
2191 	 */
2192 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2193 		rx_data = &sc->sc_rx_data[i];
2194 
2195 		usbd_setup_xfer(rx_data->xfer, rx_data, rx_data->buf, MCLBYTES,
2196 		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2197 		error = usbd_transfer(rx_data->xfer);
2198 		if (error != USBD_IN_PROGRESS && error != 0) {
2199 			printf("%s: could not queue Rx transfer\n",
2200 			    device_xname(sc->sc_dev));
2201 			goto fail;
2202 		}
2203 	}
2204 
2205 	error = urtw_rx_setconf(sc);
2206 	if (error != 0)
2207 		goto fail;
2208 
2209 	urtw_read8_m(sc, URTW_CMD, &data);
2210 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2211 fail:
2212 	return error;
2213 }
2214 
2215 static usbd_status
2216 urtw_tx_enable(struct urtw_softc *sc)
2217 {
2218 	uint8_t data8;
2219 	uint32_t data;
2220 	usbd_status error;
2221 
2222 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2223 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2224 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2225 		    URTW_CW_CONF_PERPACKET_RETRY);
2226 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2227 
2228 		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2229 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2230 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2231 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2232 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2233 
2234 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2235 		data &= ~URTW_TX_LOOPBACK_MASK;
2236 		data |= URTW_TX_LOOPBACK_NONE;
2237 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2238 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2239 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2240 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2241 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2242 		data &= ~URTW_TX_SWPLCPLEN;
2243 		data |= URTW_TX_NOICV;
2244 		urtw_write32_m(sc, URTW_TX_CONF, data);
2245 	} else {
2246 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2247 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2248 		    URTW_TX_LONGRETRY;
2249 		urtw_write32_m(sc, URTW_TX_CONF, data);
2250 	}
2251 
2252 	urtw_read8_m(sc, URTW_CMD, &data8);
2253 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2254 fail:
2255 	return error;
2256 }
2257 
2258 static int
2259 urtw_init(struct ifnet *ifp)
2260 {
2261 	struct urtw_softc *sc = ifp->if_softc;
2262 	struct urtw_rf *rf = &sc->sc_rf;
2263 	struct ieee80211com *ic = &sc->sc_ic;
2264 	usbd_status error;
2265 
2266 	urtw_stop(ifp, 0);
2267 
2268 	error = urtw_reset(sc);
2269 	if (error)
2270 		goto fail;
2271 
2272 	urtw_write8_m(sc, 0x85, 0);
2273 	urtw_write8_m(sc, URTW_GPIO, 0);
2274 
2275 	/* for led */
2276 	urtw_write8_m(sc, 0x85, 4);
2277 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2278 	if (error != 0)
2279 		goto fail;
2280 
2281 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2282 	if (error)
2283 		goto fail;
2284 
2285 	/* applying MAC address again. */
2286 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2287 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2288 	if (error)
2289 		goto fail;
2290 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2291 	if (error)
2292 		goto fail;
2293 
2294 	error = urtw_update_msr(sc);
2295 	if (error)
2296 		goto fail;
2297 
2298 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2299 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2300 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2301 	error = urtw_set_rate(sc);
2302 	if (error != 0)
2303 		goto fail;
2304 
2305 	error = rf->init(rf);
2306 	if (error != 0)
2307 		goto fail;
2308 	if (rf->set_sens != NULL)
2309 		rf->set_sens(rf);
2310 
2311 	urtw_write16_m(sc, 0x5e, 1);
2312 	urtw_write16_m(sc, 0xfe, 0x10);
2313 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2314 	urtw_write8_m(sc, 0xff, 0x60);
2315 	urtw_write16_m(sc, 0x5e, 0);
2316 	urtw_write8_m(sc, 0x85, 4);
2317 
2318 	error = urtw_intr_enable(sc);
2319 	if (error != 0)
2320 		goto fail;
2321 
2322 	/* reset softc variables */
2323 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
2324 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
2325 	}
2326 	sc->sc_txtimer = 0;
2327 
2328 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2329 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2330 		if (error != 0) {
2331 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
2332 			    ", err=%s\n", usbd_errstr(error));
2333 			goto fail;
2334 		}
2335 		/* get the first interface handle */
2336 		error = usbd_device2interface_handle(sc->sc_udev,
2337 		    URTW_IFACE_INDEX, &sc->sc_iface);
2338 		if (error != 0) {
2339 			printf("%s: could not get interface handle\n",
2340 			    device_xname(sc->sc_dev));
2341 			goto fail;
2342 		}
2343 		error = urtw_open_pipes(sc);
2344 		if (error != 0)
2345 			goto fail;
2346 		error = urtw_alloc_rx_data_list(sc);
2347 		if (error != 0)
2348 			goto fail;
2349 		error = urtw_alloc_tx_data_list(sc);
2350 		if (error != 0)
2351 			goto fail;
2352 		sc->sc_flags |= URTW_INIT_ONCE;
2353 	}
2354 
2355 	error = urtw_rx_enable(sc);
2356 	if (error != 0)
2357 		goto fail;
2358 	error = urtw_tx_enable(sc);
2359 	if (error != 0)
2360 		goto fail;
2361 
2362 	ifp->if_flags &= ~IFF_OACTIVE;
2363 	ifp->if_flags |= IFF_RUNNING;
2364 
2365 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2366 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2367 	else
2368 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2369 
2370 	return 0;
2371 fail:
2372 	return error;
2373 }
2374 
2375 static int
2376 urtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2377 {
2378 #define IS_RUNNING(ifp) \
2379 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
2380 
2381 	struct urtw_softc *sc = ifp->if_softc;
2382 	struct ieee80211com *ic = &sc->sc_ic;
2383 	int s, error = 0;
2384 
2385 	if (sc->sc_dying)
2386 		return ENXIO;
2387 
2388 	s = splnet();
2389 
2390 	switch (cmd) {
2391 	case SIOCSIFFLAGS:
2392 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2393 			break;
2394 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2395 		case IFF_UP|IFF_RUNNING:
2396 			break;
2397 		case IFF_UP:
2398 			ifp->if_init(ifp);
2399 			break;
2400 		case IFF_RUNNING:
2401 			urtw_stop(ifp, 1);
2402 			break;
2403 		case 0:
2404 			break;
2405 		}
2406 		break;
2407 
2408 	case SIOCADDMULTI:
2409 	case SIOCDELMULTI:
2410 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
2411 			error = 0;
2412 		break;
2413 
2414 	default:
2415 		error = ieee80211_ioctl(ic, cmd, data);
2416 		break;
2417 	}
2418 
2419 	if (error == ENETRESET) {
2420 		if (IS_RUNNING(ifp) &&
2421 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2422 			ifp->if_init(ifp);
2423 		error = 0;
2424 	}
2425 
2426 	splx(s);
2427 
2428 	return error;
2429 #undef IS_RUNNING
2430 }
2431 
2432 static void
2433 urtw_start(struct ifnet *ifp)
2434 {
2435 	struct urtw_softc *sc = ifp->if_softc;
2436 	struct ieee80211com *ic = &sc->sc_ic;
2437 	struct ieee80211_node *ni;
2438 	struct ether_header *eh;
2439 	struct mbuf *m0;
2440 
2441 	/*
2442 	 * net80211 may still try to send management frames even if the
2443 	 * IFF_RUNNING flag is not set...
2444 	 */
2445 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2446 		return;
2447 
2448 	for (;;) {
2449 		IF_POLL(&ic->ic_mgtq, m0);
2450 		if (m0 != NULL) {
2451 
2452 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2453 			    URTW_TX_DATA_LIST_COUNT) {
2454 				ifp->if_flags |= IFF_OACTIVE;
2455 				break;
2456 			}
2457 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2458 			ni = M_GETCTX(m0, struct ieee80211_node *);
2459 			M_CLEARCTX(m0);
2460 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2461 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2462 			    != 0)
2463 				break;
2464 		} else {
2465 			if (ic->ic_state != IEEE80211_S_RUN)
2466 				break;
2467 			IFQ_POLL(&ifp->if_snd, m0);
2468 			if (m0 == NULL)
2469 				break;
2470 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2471 			    URTW_TX_DATA_LIST_COUNT) {
2472 				ifp->if_flags |= IFF_OACTIVE;
2473 				break;
2474 			}
2475 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2476 			if (m0->m_len < sizeof(struct ether_header) &&
2477 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
2478 				continue;
2479 
2480 			eh = mtod(m0, struct ether_header *);
2481 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2482 			if (ni == NULL) {
2483 				m_freem(m0);
2484 				continue;
2485 			}
2486 			bpf_mtap(ifp, m0, BPF_D_OUT);
2487 			m0 = ieee80211_encap(ic, m0, ni);
2488 			if (m0 == NULL) {
2489 				ieee80211_free_node(ni);
2490 				continue;
2491 			}
2492 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2493 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2494 			    != 0) {
2495 				ieee80211_free_node(ni);
2496 				if_statinc(ifp, if_oerrors);
2497 				break;
2498 			}
2499 		}
2500 		sc->sc_txtimer = 5;
2501 		ifp->if_timer = 1;
2502 	}
2503 }
2504 
2505 static void
2506 urtw_watchdog(struct ifnet *ifp)
2507 {
2508 	struct urtw_softc *sc = ifp->if_softc;
2509 
2510 	ifp->if_timer = 0;
2511 
2512 	if (sc->sc_txtimer > 0) {
2513 		if (--sc->sc_txtimer == 0) {
2514 			printf("%s: device timeout\n", device_xname(sc->sc_dev));
2515 			if_statinc(ifp, if_oerrors);
2516 			return;
2517 		}
2518 		ifp->if_timer = 1;
2519 	}
2520 
2521 	ieee80211_watchdog(&sc->sc_ic);
2522 }
2523 
2524 static void
2525 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2526     usbd_status status)
2527 {
2528 	struct urtw_tx_data *data = priv;
2529 	struct urtw_softc *sc = data->sc;
2530 	struct ieee80211com *ic = &sc->sc_ic;
2531 	struct ifnet *ifp = ic->ic_ifp;
2532 	int s;
2533 
2534 	if (status != USBD_NORMAL_COMPLETION) {
2535 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2536 			return;
2537 
2538 		printf("%s: could not transmit buffer: %s\n",
2539 		    device_xname(sc->sc_dev), usbd_errstr(status));
2540 
2541 		if (status == USBD_STALLED)
2542 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2543 
2544 		if_statinc(ifp, if_oerrors);
2545 		return;
2546 	}
2547 
2548 	s = splnet();
2549 
2550 	ieee80211_free_node(data->ni);
2551 	data->ni = NULL;
2552 
2553 	sc->sc_txtimer = 0;
2554 	if_statinc(ifp, if_opackets);
2555 
2556 	sc->sc_tx_queued[URTW_PRIORITY_LOW]--;
2557 	ifp->if_flags &= ~IFF_OACTIVE;
2558 	urtw_start(ifp);
2559 
2560 	splx(s);
2561 }
2562 
2563 static void
2564 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2565     usbd_status status)
2566 {
2567 	struct urtw_tx_data *data = priv;
2568 	struct urtw_softc *sc = data->sc;
2569 	struct ieee80211com *ic = &sc->sc_ic;
2570 	struct ifnet *ifp = ic->ic_ifp;
2571 	int s;
2572 
2573 	if (status != USBD_NORMAL_COMPLETION) {
2574 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2575 			return;
2576 
2577 		printf("%s: could not transmit buffer: %s\n",
2578 		    device_xname(sc->sc_dev), usbd_errstr(status));
2579 
2580 		if (status == USBD_STALLED)
2581 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2582 
2583 		if_statinc(ifp, if_oerrors);
2584 		return;
2585 	}
2586 
2587 	s = splnet();
2588 
2589 	ieee80211_free_node(data->ni);
2590 	data->ni = NULL;
2591 
2592 	sc->sc_txtimer = 0;
2593 	if_statinc(ifp, if_opackets);
2594 
2595 	sc->sc_tx_queued[URTW_PRIORITY_NORMAL]--;
2596 	ifp->if_flags &= ~IFF_OACTIVE;
2597 	urtw_start(ifp);
2598 
2599 	splx(s);
2600 }
2601 
2602 static int
2603 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2604     int prior)
2605 {
2606 	struct ieee80211com *ic = &sc->sc_ic;
2607 	struct urtw_tx_data *data;
2608 	struct ieee80211_frame *wh;
2609 	struct ieee80211_key *k;
2610 	usbd_status error;
2611 	int xferlen;
2612 
2613 	wh = mtod(m0, struct ieee80211_frame *);
2614 
2615 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2616 		k = ieee80211_crypto_encap(ic, ni, m0);
2617 		if (k == NULL) {
2618 			m_freem(m0);
2619 			return ENOBUFS;
2620 		}
2621 		/* packet header may have moved, reset our local pointer */
2622 		wh = mtod(m0, struct ieee80211_frame *);
2623 	}
2624 
2625 	if (sc->sc_drvbpf != NULL) {
2626 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2627 
2628 		tap->wt_flags = 0;
2629 		tap->wt_rate = 0;
2630 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2631 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2632 
2633 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
2634 	}
2635 
2636 	if (sc->sc_hwrev & URTW_HWREV_8187)
2637 		xferlen = m0->m_pkthdr.len + 4 * 3;
2638 	else
2639 		xferlen = m0->m_pkthdr.len + 4 * 8;
2640 
2641 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2642 		xferlen += 1;
2643 
2644 	data = &sc->sc_tx_data[prior][sc->sc_txidx[prior]];
2645 	sc->sc_txidx[prior] =
2646 	    (sc->sc_txidx[prior] + 1) % URTW_TX_DATA_LIST_COUNT;
2647 
2648 	memset(data->buf, 0, URTW_TX_MAXSIZE);
2649 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2650 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2651 	data->buf[1] |= (1 << 7);
2652 
2653 	/* XXX sc_preamble_mode is always 2. */
2654 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2655 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2656 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2657 		data->buf[2] |= 1;
2658 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2659 	    prior == URTW_PRIORITY_LOW)
2660 		panic("TODO tx.");
2661 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2662 		data->buf[2] |= (1 << 1);
2663 	/* RTS rate - 10 means we use a basic rate. */
2664 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2665 	/*
2666 	 * XXX currently TX rate control depends on the rate value of
2667 	 * RX descriptor because I don't know how to we can control TX rate
2668 	 * in more smart way.  Please fix me you find a thing.
2669 	 */
2670 	data->buf[3] = sc->sc_currate;
2671 	if (prior == URTW_PRIORITY_NORMAL) {
2672 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2673 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2674 		else if (ic->ic_fixed_rate != -1)
2675 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2676 	}
2677 
2678 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2679 		data->buf[8] = 3;		/* CW minimum */
2680 		data->buf[8] |= (7 << 4);	/* CW maximum */
2681 		data->buf[9] |= 11;		/* retry limitation */
2682 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2683 	} else {
2684 		data->buf[21] |= 11;		/* retry limitation */
2685 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2686 	}
2687 
2688 	data->ni = ni;
2689 
2690 	/* mbuf is no longer needed. */
2691 	m_freem(m0);
2692 
2693 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2694 	    USBD_FORCE_SHORT_XFER, URTW_DATA_TIMEOUT,
2695 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2696 	error = usbd_transfer(data->xfer);
2697 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2698 		printf("%s: could not send frame: %s\n",
2699 		    device_xname(sc->sc_dev), usbd_errstr(error));
2700 		return EIO;
2701 	}
2702 
2703 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2704 	if (error != 0)
2705 		printf("%s: could not control LED (%d)\n",
2706 		    device_xname(sc->sc_dev), error);
2707 
2708 	sc->sc_tx_queued[prior]++;
2709 
2710 	return 0;
2711 }
2712 
2713 static usbd_status
2714 urtw_8225_usb_init(struct urtw_softc *sc)
2715 {
2716 	uint8_t data;
2717 	usbd_status error;
2718 
2719 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2720 	urtw_write8_m(sc, URTW_GPIO, 0);
2721 	error = urtw_read8e(sc, 0x53, &data);
2722 	if (error)
2723 		goto fail;
2724 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2725 	if (error)
2726 		goto fail;
2727 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2728 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2729 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2730 
2731 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2732 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2733 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2734 
2735 	usbd_delay_ms(sc->sc_udev, 500);
2736 fail:
2737 	return error;
2738 }
2739 
2740 static usbd_status
2741 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2742 {
2743 	usbd_status error = 0;
2744 
2745 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2746 fail:
2747 	return error;
2748 }
2749 
2750 static usbd_status
2751 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2752 {
2753 	uint32_t phyw;
2754 	usbd_status error;
2755 
2756 	phyw = ((data << 8) | (addr | 0x80));
2757 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2758 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2759 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2760 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2761 	/*
2762 	 * Delay removed from 8185 to 8187.
2763 	 * usbd_delay_ms(sc->sc_udev, 1);
2764 	 */
2765 fail:
2766 	return error;
2767 }
2768 
2769 static usbd_status
2770 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2771 {
2772 	data = data & 0xff;
2773 	return urtw_8187_write_phy(sc, addr, data);
2774 }
2775 
2776 static usbd_status
2777 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2778 {
2779 	data = data & 0xff;
2780 	return urtw_8187_write_phy(sc, addr, data | 0x10000);
2781 }
2782 
2783 static usbd_status
2784 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2785 {
2786 	usbd_status error;
2787 
2788 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2789 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2790 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2791 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2792 fail:
2793 	return error;
2794 }
2795 
2796 static usbd_status
2797 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2798 {
2799 	int i, idx, set;
2800 	uint8_t *cck_pwltable;
2801 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2802 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2803 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2804 	usbd_status error;
2805 
2806 	cck_pwrlvl_max = 11;
2807 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2808 	ofdm_pwrlvl_min = 10;
2809 
2810 	/* CCK power setting */
2811 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2812 	idx = cck_pwrlvl % 6;
2813 	set = cck_pwrlvl / 6;
2814 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2815 	    urtw_8225_txpwr_cck;
2816 
2817 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2818 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2819 	for (i = 0; i < 8; i++) {
2820 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2821 		    cck_pwltable[idx * 8 + i]);
2822 	}
2823 	usbd_delay_ms(sc->sc_udev, 1);
2824 
2825 	/* OFDM power setting */
2826 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2827 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2828 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2829 
2830 	idx = ofdm_pwrlvl % 6;
2831 	set = ofdm_pwrlvl / 6;
2832 
2833 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2834 	if (error)
2835 		goto fail;
2836 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2837 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2838 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2839 
2840 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2841 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2842 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2843 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2844 	usbd_delay_ms(sc->sc_udev, 1);
2845 fail:
2846 	return error;
2847 }
2848 
2849 static usbd_status
2850 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2851 {
2852 	usbd_status error;
2853 
2854 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2855 	usbd_delay_ms(sc->sc_udev, 1);
2856 fail:
2857 	return error;
2858 }
2859 
2860 static usbd_status
2861 urtw_8225_rf_init(struct urtw_rf *rf)
2862 {
2863 	struct urtw_softc *sc = rf->rf_sc;
2864 	unsigned int i;
2865 	uint16_t data;
2866 	usbd_status error;
2867 
2868 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2869 	if (error)
2870 		goto fail;
2871 
2872 	error = urtw_8225_usb_init(sc);
2873 	if (error)
2874 		goto fail;
2875 
2876 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2877 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2878 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2879 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2880 
2881 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2882 	if (error)
2883 		goto fail;
2884 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2885 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2886 	if (error)
2887 		goto fail;
2888 
2889 	error = urtw_8185_rf_pins_enable(sc);
2890 	if (error)
2891 		goto fail;
2892 
2893 	usbd_delay_ms(sc->sc_udev, 500);
2894 
2895 	for (i = 0; i < __arraycount(urtw_8225_rf_part1); i++) {
2896 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2897 		    urtw_8225_rf_part1[i].val);
2898 	}
2899 	usbd_delay_ms(sc->sc_udev, 50);
2900 	urtw_8225_write(sc, 0x2, 0xc4d);
2901 	usbd_delay_ms(sc->sc_udev, 200);
2902 	urtw_8225_write(sc, 0x2, 0x44d);
2903 	usbd_delay_ms(sc->sc_udev, 200);
2904 	urtw_8225_write(sc, 0x0, 0x127);
2905 
2906 	for (i = 0; i < __arraycount(urtw_8225_rxgain); i++) {
2907 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2908 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2909 	}
2910 
2911 	urtw_8225_write(sc, 0x0, 0x27);
2912 	urtw_8225_write(sc, 0x0, 0x22f);
2913 
2914 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
2915 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2916 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2917 	}
2918 
2919 	for (i = 0; i < __arraycount(urtw_8225_rf_part2); i++) {
2920 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2921 		    urtw_8225_rf_part2[i].val);
2922 		usbd_delay_ms(sc->sc_udev, 1);
2923 	}
2924 
2925 	error = urtw_8225_setgain(sc, 4);
2926 	if (error)
2927 		goto fail;
2928 
2929 	for (i = 0; i < __arraycount(urtw_8225_rf_part3); i++) {
2930 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2931 		    urtw_8225_rf_part3[i].val);
2932 		usbd_delay_ms(sc->sc_udev, 1);
2933 	}
2934 
2935 	urtw_write8_m(sc, 0x5b, 0x0d);
2936 
2937 	error = urtw_8225_set_txpwrlvl(sc, 1);
2938 	if (error)
2939 		goto fail;
2940 
2941 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2942 	usbd_delay_ms(sc->sc_udev, 1);
2943 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2944 	usbd_delay_ms(sc->sc_udev, 1);
2945 
2946 	/* TX ant A, 0x0 for B */
2947 	error = urtw_8185_tx_antenna(sc, 0x3);
2948 	if (error)
2949 		goto fail;
2950 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2951 
2952 	error = urtw_8225_rf_set_chan(rf, 1);
2953 fail:
2954 	return error;
2955 }
2956 
2957 static usbd_status
2958 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2959 {
2960 	struct urtw_softc *sc = rf->rf_sc;
2961 	struct ieee80211com *ic = &sc->sc_ic;
2962 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2963 	usbd_status error;
2964 
2965 	error = urtw_8225_set_txpwrlvl(sc, chan);
2966 	if (error)
2967 		goto fail;
2968 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2969 	usbd_delay_ms(sc->sc_udev, 10);
2970 
2971 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2972 
2973 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2974 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2975 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2976 	else
2977 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2978 
2979 	if (IEEE80211_IS_CHAN_G(c)) {
2980 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2981 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
2982 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2983 	} else {
2984 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2985 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
2986 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2987 	}
2988 
2989 fail:
2990 	return error;
2991 }
2992 
2993 static usbd_status
2994 urtw_8225_rf_set_sens(struct urtw_rf *rf)
2995 {
2996 	struct urtw_softc *sc = rf->rf_sc;
2997 	usbd_status error;
2998 
2999 	if (rf->sens > 6)
3000 		return -1;
3001 
3002 	if (rf->sens > 4)
3003 		urtw_8225_write(sc, 0x0c, 0x850);
3004 	else
3005 		urtw_8225_write(sc, 0x0c, 0x50);
3006 
3007 	rf->sens = 6 - rf->sens;
3008 	error = urtw_8225_setgain(sc, rf->sens);
3009 	if (error)
3010 		goto fail;
3011 
3012 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3013 
3014 fail:
3015 	return error;
3016 }
3017 
3018 static void
3019 urtw_stop(struct ifnet *ifp, int disable)
3020 {
3021 	struct urtw_softc *sc = ifp->if_softc;
3022 	struct ieee80211com *ic = &sc->sc_ic;
3023 	uint8_t data;
3024 	usbd_status error;
3025 
3026 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3027 
3028 	sc->sc_txtimer = 0;
3029 	ifp->if_timer = 0;
3030 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3031 
3032 	callout_stop(&sc->scan_to);
3033 	callout_stop(&sc->sc_led_ch);
3034 
3035 	urtw_intr_disable(sc);
3036 	urtw_read8_m(sc, URTW_CMD, &data);
3037 	data &= ~URTW_CMD_TX_ENABLE;
3038 	data &= ~URTW_CMD_RX_ENABLE;
3039 	urtw_write8_m(sc, URTW_CMD, data);
3040 
3041 	if (sc->sc_rxpipe != NULL)
3042 		usbd_abort_pipe(sc->sc_rxpipe);
3043 	if (sc->sc_txpipe_low != NULL)
3044 		usbd_abort_pipe(sc->sc_txpipe_low);
3045 	if (sc->sc_txpipe_normal != NULL)
3046 		usbd_abort_pipe(sc->sc_txpipe_normal);
3047 
3048 fail:
3049 	return;
3050 }
3051 
3052 static int
3053 urtw_isbmode(uint16_t rate)
3054 {
3055 	rate = urtw_rtl2rate(rate);
3056 
3057 	return ((rate <= 22 && rate != 12 && rate != 18) ||
3058 	    rate == 44) ? 1 : 0;
3059 }
3060 
3061 static void
3062 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3063 {
3064 	struct urtw_rx_data *data = priv;
3065 	struct urtw_softc *sc = data->sc;
3066 	struct ieee80211com *ic = &sc->sc_ic;
3067 	struct ifnet *ifp = ic->ic_ifp;
3068 	struct ieee80211_frame *wh;
3069 	struct ieee80211_node *ni;
3070 	struct mbuf *m, *mnew;
3071 	uint8_t *desc, quality, rate;
3072 	int actlen, flen, len, rssi, s;
3073 
3074 	if (status != USBD_NORMAL_COMPLETION) {
3075 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3076 			return;
3077 
3078 		if (status == USBD_STALLED)
3079 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3080 		if_statinc(ifp, if_ierrors);
3081 		goto skip;
3082 	}
3083 
3084 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3085 	if (actlen < URTW_MIN_RXBUFSZ) {
3086 		if_statinc(ifp, if_ierrors);
3087 		goto skip;
3088 	}
3089 
3090 	if (sc->sc_hwrev & URTW_HWREV_8187)
3091 		/* 4 dword and 4 byte CRC */
3092 		len = actlen - (4 * 4);
3093 	else
3094 		/* 5 dword and 4 byte CRC */
3095 		len = actlen - (4 * 5);
3096 
3097 	desc = data->buf + len;
3098 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3099 	if (flen > actlen) {
3100 		if_statinc(ifp, if_ierrors);
3101 		goto skip;
3102 	}
3103 
3104 	rate = (desc[2] & 0xf0) >> 4;
3105 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3106 		quality = desc[4] & 0xff;
3107 		rssi = (desc[6] & 0xfe) >> 1;
3108 
3109 		/* XXX correct? */
3110 		if (!urtw_isbmode(rate)) {
3111 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3112 			rssi = ((90 - rssi) * 100) / 65;
3113 		} else {
3114 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3115 			rssi = ((95 - rssi) * 100) / 65;
3116 		}
3117 	} else {
3118 		quality = desc[12];
3119 		rssi = 14 - desc[14] / 2;
3120 	}
3121 
3122 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3123 	if (mnew == NULL) {
3124 		printf("%s: could not allocate rx mbuf\n",
3125 		    device_xname(sc->sc_dev));
3126 		if_statinc(ifp, if_ierrors);
3127 		goto skip;
3128 	}
3129 	MCLGET(mnew, M_DONTWAIT);
3130 	if (!(mnew->m_flags & M_EXT)) {
3131 		printf("%s: could not allocate rx mbuf cluster\n",
3132 		    device_xname(sc->sc_dev));
3133 		m_freem(mnew);
3134 		if_statinc(ifp, if_ierrors);
3135 		goto skip;
3136 	}
3137 
3138 	m = data->m;
3139 	data->m = mnew;
3140 	data->buf = mtod(mnew, uint8_t *);
3141 
3142 	/* finalize mbuf */
3143 	m_set_rcvif(m, ifp);
3144 	m->m_pkthdr.len = m->m_len = flen - 4;
3145 
3146 	s = splnet();
3147 
3148 	if (sc->sc_drvbpf != NULL) {
3149 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3150 
3151 		/* XXX Are variables correct? */
3152 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3153 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3154 		tap->wr_dbm_antsignal = (int8_t)rssi;
3155 
3156 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
3157 	}
3158 	wh = mtod(m, struct ieee80211_frame *);
3159 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3160 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3161 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3162 
3163 	/* XXX correct? */
3164 	if (!urtw_isbmode(rate)) {
3165 		if (quality > 127)
3166 			quality = 0;
3167 		else if (quality < 27)
3168 			quality = 100;
3169 		else
3170 			quality = 127 - quality;
3171 	} else
3172 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3173 
3174 	/* send the frame to the 802.11 layer */
3175 	ieee80211_input(ic, m, ni, rssi, 0);
3176 
3177 	/* node is no longer needed */
3178 	ieee80211_free_node(ni);
3179 
3180 	splx(s);
3181 
3182 skip:	/* setup a new transfer */
3183 	usbd_setup_xfer(xfer, data, data->buf, MCLBYTES,
3184 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3185 	(void)usbd_transfer(xfer);
3186 }
3187 
3188 static usbd_status
3189 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3190 {
3191 	uint8_t *gainp;
3192 	usbd_status error;
3193 
3194 	/* XXX for A? */
3195 	gainp = urtw_8225v2_gain_bg;
3196 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3197 	usbd_delay_ms(sc->sc_udev, 1);
3198 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3199 	usbd_delay_ms(sc->sc_udev, 1);
3200 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3201 	usbd_delay_ms(sc->sc_udev, 1);
3202 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3203 	usbd_delay_ms(sc->sc_udev, 1);
3204 fail:
3205 	return error;
3206 }
3207 
3208 static usbd_status
3209 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3210 {
3211 	int i;
3212 	uint8_t *cck_pwrtable;
3213 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3214 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3215 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3216 	usbd_status error;
3217 
3218 	/* CCK power setting */
3219 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3220 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3221 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3222 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3223 	    urtw_8225v2_txpwr_cck;
3224 
3225 	for (i = 0; i < 8; i++) {
3226 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3227 	}
3228 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3229 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3230 	usbd_delay_ms(sc->sc_udev, 1);
3231 
3232 	/* OFDM power setting */
3233 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3234 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3235 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3236 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3237 
3238 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3239 	if (error)
3240 		goto fail;
3241 
3242 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3243 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3244 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3245 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3246 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3247 
3248 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3249 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3250 	usbd_delay_ms(sc->sc_udev, 1);
3251 fail:
3252 	return error;
3253 }
3254 
3255 static usbd_status
3256 urtw_8225v2_rf_init(struct urtw_rf *rf)
3257 {
3258 	struct urtw_softc *sc = rf->rf_sc;
3259 	int i;
3260 	uint16_t data;
3261 	uint32_t data32;
3262 	usbd_status error;
3263 
3264 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3265 	if (error)
3266 		goto fail;
3267 
3268 	error = urtw_8225_usb_init(sc);
3269 	if (error)
3270 		goto fail;
3271 
3272 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3273 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3274 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3275 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3276 
3277 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3278 	if (error)
3279 		goto fail;
3280 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3281 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3282 	if (error)
3283 		goto fail;
3284 
3285 	error = urtw_8185_rf_pins_enable(sc);
3286 	if (error)
3287 		goto fail;
3288 
3289 	usbd_delay_ms(sc->sc_udev, 1000);
3290 
3291 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part1); i++) {
3292 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3293 		    urtw_8225v2_rf_part1[i].val);
3294 		usbd_delay_ms(sc->sc_udev, 1);
3295 	}
3296 	usbd_delay_ms(sc->sc_udev, 50);
3297 
3298 	urtw_8225_write(sc, 0x0, 0x1b7);
3299 
3300 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3301 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3302 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3303 	}
3304 
3305 	urtw_8225_write(sc, 0x3, 0x2);
3306 	urtw_8225_write(sc, 0x5, 0x4);
3307 	urtw_8225_write(sc, 0x0, 0xb7);
3308 	urtw_8225_write(sc, 0x2, 0xc4d);
3309 	usbd_delay_ms(sc->sc_udev, 100);
3310 	urtw_8225_write(sc, 0x2, 0x44d);
3311 	usbd_delay_ms(sc->sc_udev, 100);
3312 
3313 	error = urtw_8225_read(sc, 0x6, &data32);
3314 	if (error != 0)
3315 		goto fail;
3316 	if (data32 != 0xe6)
3317 		printf("%s: expect 0xe6!! (%#x)\n", device_xname(sc->sc_dev),
3318 		    data32);
3319 	if (!(data32 & 0x80)) {
3320 		urtw_8225_write(sc, 0x02, 0x0c4d);
3321 		usbd_delay_ms(sc->sc_udev, 200);
3322 		urtw_8225_write(sc, 0x02, 0x044d);
3323 		usbd_delay_ms(sc->sc_udev, 100);
3324 		error = urtw_8225_read(sc, 0x6, &data32);
3325 		if (error != 0)
3326 			goto fail;
3327 		if (!(data32 & 0x80))
3328 			printf("%s: RF calibration failed\n",
3329 			    device_xname(sc->sc_dev));
3330 	}
3331 	usbd_delay_ms(sc->sc_udev, 100);
3332 
3333 	urtw_8225_write(sc, 0x0, 0x2bf);
3334 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
3335 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3336 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3337 	}
3338 
3339 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part2); i++) {
3340 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3341 		    urtw_8225v2_rf_part2[i].val);
3342 	}
3343 
3344 	error = urtw_8225v2_setgain(sc, 4);
3345 	if (error)
3346 		goto fail;
3347 
3348 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part3); i++) {
3349 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3350 		    urtw_8225v2_rf_part3[i].val);
3351 	}
3352 
3353 	urtw_write8_m(sc, 0x5b, 0x0d);
3354 
3355 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3356 	if (error)
3357 		goto fail;
3358 
3359 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3360 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3361 
3362 	/* TX ant A, 0x0 for B */
3363 	error = urtw_8185_tx_antenna(sc, 0x3);
3364 	if (error)
3365 		goto fail;
3366 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3367 
3368 	error = urtw_8225_rf_set_chan(rf, 1);
3369 fail:
3370 	return error;
3371 }
3372 
3373 static usbd_status
3374 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3375 {
3376 	struct urtw_softc *sc = rf->rf_sc;
3377 	struct ieee80211com *ic = &sc->sc_ic;
3378 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3379 	usbd_status error;
3380 
3381 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3382 	if (error)
3383 		goto fail;
3384 
3385 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3386 	usbd_delay_ms(sc->sc_udev, 10);
3387 
3388 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3389 
3390 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3391 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3392 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3393 	else
3394 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3395 
3396 	if (IEEE80211_IS_CHAN_G(c)) {
3397 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3398 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3399 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3400 	} else {
3401 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3402 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3403 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3404 	}
3405 
3406 fail:
3407 	return error;
3408 }
3409 
3410 static void
3411 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3412 {
3413 	struct urtw_rf *rf = &sc->sc_rf;
3414 	struct ieee80211com *ic = &sc->sc_ic;
3415 	usbd_status error = 0;
3416 	uint32_t data;
3417 	u_int chan;
3418 
3419 	chan = ieee80211_chan2ieee(ic, c);
3420 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3421 		return;
3422 	/*
3423 	 * During changing the channel we need to temporary disable
3424 	 * TX.
3425 	 */
3426 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3427 	data &= ~URTW_TX_LOOPBACK_MASK;
3428 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3429 	error = rf->set_chan(rf, chan);
3430 	if (error != 0) {
3431 		printf("%s could not change the channel\n",
3432 		    device_xname(sc->sc_dev));
3433 		return;
3434 	}
3435 	usbd_delay_ms(sc->sc_udev, 10);
3436 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3437 
3438 fail:	return;
3439 
3440 }
3441 
3442 static void
3443 urtw_next_scan(void *arg)
3444 {
3445 	struct urtw_softc *sc = arg;
3446 	struct ieee80211com *ic = &sc->sc_ic;
3447 	int s;
3448 
3449 	if (sc->sc_dying)
3450 		return;
3451 
3452 	s = splnet();
3453 	if (ic->ic_state == IEEE80211_S_SCAN)
3454 		ieee80211_next_scan(ic);
3455 	splx(s);
3456 }
3457 
3458 static void
3459 urtw_task(void *arg)
3460 {
3461 	struct urtw_softc *sc = arg;
3462 	struct ieee80211com *ic = &sc->sc_ic;
3463 	struct ieee80211_node *ni;
3464 	enum ieee80211_state ostate;
3465 	usbd_status error = 0;
3466 
3467 	if (sc->sc_dying)
3468 		return;
3469 
3470 	ostate = ic->ic_state;
3471 
3472 	switch (sc->sc_state) {
3473 	case IEEE80211_S_INIT:
3474 		if (ostate == IEEE80211_S_RUN) {
3475 			/* turn link LED off */
3476 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3477 		}
3478 		break;
3479 
3480 	case IEEE80211_S_SCAN:
3481 		urtw_set_chan(sc, ic->ic_curchan);
3482 		if (!sc->sc_dying)
3483 			callout_schedule(&sc->scan_to, mstohz(200));
3484 		break;
3485 
3486 	case IEEE80211_S_AUTH:
3487 	case IEEE80211_S_ASSOC:
3488 		urtw_set_chan(sc, ic->ic_curchan);
3489 		break;
3490 
3491 	case IEEE80211_S_RUN:
3492 		ni = ic->ic_bss;
3493 
3494 		urtw_set_chan(sc, ic->ic_curchan);
3495 
3496 		/* setting bssid. */
3497 		error = urtw_set_bssid(sc, ni->ni_bssid);
3498 		if (error != 0)
3499 			goto fail;
3500 		urtw_update_msr(sc);
3501 		/* XXX maybe the below would be incorrect. */
3502 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3503 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3504 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3505 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3506 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3507 		if (error != 0)
3508 			printf("%s: could not control LED (%d)\n",
3509 			    device_xname(sc->sc_dev), error);
3510 		break;
3511 	}
3512 
3513 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3514 
3515 fail:
3516 	if (error != 0) {
3517 		DPRINTF(("%s: error duing processing RUN state.",
3518 		    device_xname(sc->sc_dev)));
3519 	}
3520 }
3521 
3522 static usbd_status
3523 urtw_8187b_update_wmm(struct urtw_softc *sc)
3524 {
3525 	struct ieee80211com *ic = &sc->sc_ic;
3526 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3527 	uint32_t data;
3528 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3529 	usbd_status error;
3530 
3531 	sifs = 0xa;
3532 	if (IEEE80211_IS_CHAN_G(c))
3533 		slot = 0x9;
3534 	else
3535 		slot = 0x14;
3536 
3537 	aifs = (2 * slot) + sifs;
3538 	ecwmin = 3;
3539 	ecwmax = 7;
3540 
3541 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3542 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3543 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3544 
3545 	urtw_write32_m(sc, URTW_AC_VO, data);
3546 	urtw_write32_m(sc, URTW_AC_VI, data);
3547 	urtw_write32_m(sc, URTW_AC_BE, data);
3548 	urtw_write32_m(sc, URTW_AC_BK, data);
3549 
3550 fail:
3551 	return error;
3552 }
3553 
3554 static usbd_status
3555 urtw_8187b_reset(struct urtw_softc *sc)
3556 {
3557 	uint8_t data;
3558 	usbd_status error;
3559 
3560 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3561 	if (error)
3562 		goto fail;
3563 
3564 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3565 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3566 		URTW_CONFIG3_GNT_SELECT);
3567 
3568 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3569 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3570 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3571 
3572 	urtw_write8_m(sc, 0x61, 0x10);
3573 	urtw_read8_m(sc, 0x62, &data);
3574 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3575 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3576 
3577 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3578 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3579 
3580 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3581 	if (error)
3582 		goto fail;
3583 
3584 	urtw_read8_m(sc, URTW_CMD, &data);
3585 	data = (data & 2) | URTW_CMD_RST;
3586 	urtw_write8_m(sc, URTW_CMD, data);
3587 	usbd_delay_ms(sc->sc_udev, 100);
3588 
3589 	urtw_read8_m(sc, URTW_CMD, &data);
3590 	if (data & URTW_CMD_RST) {
3591 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
3592 		goto fail;
3593 	}
3594 
3595 fail:
3596 	return error;
3597 }
3598 
3599 static int
3600 urtw_8187b_init(struct ifnet *ifp)
3601 {
3602 	struct urtw_softc *sc = ifp->if_softc;
3603 	struct urtw_rf *rf = &sc->sc_rf;
3604 	struct ieee80211com *ic = &sc->sc_ic;
3605 	uint8_t data;
3606 	usbd_status error;
3607 
3608 	urtw_stop(ifp, 0);
3609 
3610 	error = urtw_8187b_update_wmm(sc);
3611 	if (error != 0)
3612 		goto fail;
3613 	error = urtw_8187b_reset(sc);
3614 	if (error)
3615 		goto fail;
3616 
3617 	/* Applying MAC address again. */
3618 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3619 	if (error)
3620 		goto fail;
3621 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3622 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3623 	if (error)
3624 		goto fail;
3625 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3626 	if (error)
3627 		goto fail;
3628 
3629 	error = urtw_update_msr(sc);
3630 	if (error)
3631 		goto fail;
3632 
3633 	error = rf->init(rf);
3634 	if (error != 0)
3635 		goto fail;
3636 
3637 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3638 		URTW_CMD_RX_ENABLE);
3639 	error = urtw_intr_enable(sc);
3640 	if (error != 0)
3641 		goto fail;
3642 
3643 	error = urtw_write8e(sc, 0x41, 0xf4);
3644 	if (error != 0)
3645 		goto fail;
3646 	error = urtw_write8e(sc, 0x40, 0x00);
3647 	if (error != 0)
3648 		goto fail;
3649 	error = urtw_write8e(sc, 0x42, 0x00);
3650 	if (error != 0)
3651 		goto fail;
3652 	error = urtw_write8e(sc, 0x42, 0x01);
3653 	if (error != 0)
3654 		goto fail;
3655 	error = urtw_write8e(sc, 0x40, 0x0f);
3656 	if (error != 0)
3657 		goto fail;
3658 	error = urtw_write8e(sc, 0x42, 0x00);
3659 	if (error != 0)
3660 		goto fail;
3661 	error = urtw_write8e(sc, 0x42, 0x01);
3662 	if (error != 0)
3663 		goto fail;
3664 
3665 	urtw_read8_m(sc, 0xdb, &data);
3666 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3667 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3668 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3669 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3670 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3671 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3672 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3673 	urtw_write8_m(sc, 0x61, 0);
3674 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3675 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3676 	urtw_write8_m(sc, 0xda, 0x10);
3677 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3678 
3679 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3680 
3681 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3682 
3683 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3684 
3685 	/* Reset softc variables. */
3686 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
3687 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
3688 	}
3689 	sc->sc_txtimer = 0;
3690 
3691 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3692 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3693 		if (error != 0) {
3694 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
3695 			    ", err=%s\n", usbd_errstr(error));
3696 
3697 			goto fail;
3698 		}
3699 		/* Get the first interface handle. */
3700 		error = usbd_device2interface_handle(sc->sc_udev,
3701 		    URTW_IFACE_INDEX, &sc->sc_iface);
3702 		if (error != 0) {
3703 			printf("%s: could not get interface handle\n",
3704 			    device_xname(sc->sc_dev));
3705 			goto fail;
3706 		}
3707 		error = urtw_open_pipes(sc);
3708 		if (error != 0)
3709 			goto fail;
3710 		error = urtw_alloc_rx_data_list(sc);
3711 		if (error != 0)
3712 			goto fail;
3713 		error = urtw_alloc_tx_data_list(sc);
3714 		if (error != 0)
3715 			goto fail;
3716 		sc->sc_flags |= URTW_INIT_ONCE;
3717 	}
3718 
3719 	error = urtw_rx_enable(sc);
3720 	if (error != 0)
3721 		goto fail;
3722 	error = urtw_tx_enable(sc);
3723 	if (error != 0)
3724 		goto fail;
3725 
3726 	ifp->if_flags &= ~IFF_OACTIVE;
3727 	ifp->if_flags |= IFF_RUNNING;
3728 
3729 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3730 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3731 	else
3732 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3733 
3734 fail:
3735 	return error;
3736 }
3737 
3738 static usbd_status
3739 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3740 {
3741 	int i;
3742 	usbd_status error;
3743 
3744 	for (i = 0; i < __arraycount(urtw_8187b_regtbl); i++) {
3745 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3746 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3747 	}
3748 
3749 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3750 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3751 
3752 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3753 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3754 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3755 
3756 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3757 
3758 fail:
3759 	return error;
3760 }
3761 
3762 static usbd_status
3763 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3764 {
3765 	usbd_status error;
3766 
3767 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3768 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3769 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3770 	usbd_delay_ms(sc->sc_udev, 100);
3771 
3772 fail:
3773 	return error;
3774 }
3775 
3776 static usbd_status
3777 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3778 {
3779 	struct ieee80211com *ic = &sc->sc_ic;
3780 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3781 	uint8_t aifs, difs, eifs, sifs, slot;
3782 	usbd_status error;
3783 
3784 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3785 
3786 	sifs = 0xa;
3787 	if (IEEE80211_IS_CHAN_G(c)) {
3788 		slot = 0x9;
3789 		difs = 0x1c;
3790 		eifs = 0x5b;
3791 	} else {
3792 		slot = 0x14;
3793 		difs = 0x32;
3794 		eifs = 0x5b;
3795 	}
3796 	aifs = (2 * slot) + sifs;
3797 
3798 	urtw_write8_m(sc, URTW_SLOT, slot);
3799 
3800 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3801 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3802 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3803 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3804 
3805 	urtw_write8_m(sc, URTW_DIFS, difs);
3806 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3807 
3808 fail:
3809 	return error;
3810 }
3811 
3812 static usbd_status
3813 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3814 {
3815 	struct urtw_softc *sc = rf->rf_sc;
3816 	unsigned int i;
3817 	uint8_t data;
3818 	usbd_status error;
3819 
3820 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3821 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3822 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3823 	urtw_write8_m(sc, URTW_CW_CONF, data |
3824 		URTW_CW_CONF_PERPACKET_RETRY);
3825 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3826 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3827 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3828 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3829 
3830 	/* Auto rate fallback control. */
3831 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3832 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3833 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3834 		URTW_RATE_FALLBACK_ENABLE);
3835 
3836 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3837 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3838 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3839 
3840 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3841 	if (error)
3842 		goto fail;
3843 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3844 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3845 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3846 	if (error)
3847 		goto fail;
3848 
3849 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3850 	urtw_8225v2_b_config_mac(sc);
3851 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3852 
3853 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3854 	if (error)
3855 		goto fail;
3856 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3857 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3858 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3859 	if (error)
3860 		goto fail;
3861 
3862 	urtw_8225v2_b_init_rfe(sc);
3863 
3864 	for (i = 0; i < __arraycount(urtw_8225v2_b_rf); i++) {
3865 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3866 		    urtw_8225v2_b_rf[i].val);
3867 	}
3868 
3869 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3870 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3871 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3872 	}
3873 
3874 	urtw_8225_write(sc, 0x03, 0x080);
3875 	urtw_8225_write(sc, 0x05, 0x004);
3876 	urtw_8225_write(sc, 0x00, 0x0b7);
3877 	urtw_8225_write(sc, 0x02, 0xc4d);
3878 	urtw_8225_write(sc, 0x02, 0x44d);
3879 	urtw_8225_write(sc, 0x00, 0x2bf);
3880 
3881 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3882 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3883 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3884 
3885 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3886 	for (i = 0; i < __arraycount(urtw_8225v2_agc); i++) {
3887 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3888 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3889 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3890 	}
3891 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3892 
3893 	for (i = 0; i < __arraycount(urtw_8225v2_ofdm); i++)
3894 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3895 
3896 	urtw_8225v2_b_update_chan(sc);
3897 
3898 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3899 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3900 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3901 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3902 
3903 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3904 fail:
3905 	return error;
3906 }
3907 
3908 static usbd_status
3909 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3910 {
3911 	struct urtw_softc *sc = rf->rf_sc;
3912 	usbd_status error;
3913 
3914 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3915 	if (error)
3916 		goto fail;
3917 
3918 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3919 	/*
3920 	 * Delay removed from 8185 to 8187.
3921 	 * usbd_delay_ms(sc->sc_udev, 10);
3922 	 */
3923 
3924 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3925 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3926 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3927 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3928 
3929 fail:
3930 	return error;
3931 }
3932 
3933 static usbd_status
3934 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3935 {
3936 	int i;
3937 	uint8_t *cck_pwrtable;
3938 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3939 	    ofdm_pwrlvl_max;
3940 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3941 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3942 	usbd_status error;
3943 
3944 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3945 		cck_pwrlvl_min = 0;
3946 		cck_pwrlvl_max = 15;
3947 		ofdm_pwrlvl_min = 2;
3948 		ofdm_pwrlvl_max = 17;
3949 	} else {
3950 		cck_pwrlvl_min = 7;
3951 		cck_pwrlvl_max = 22;
3952 		ofdm_pwrlvl_min = 10;
3953 		ofdm_pwrlvl_max = 25;
3954 	}
3955 
3956 	/* CCK power setting */
3957 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
3958 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
3959 
3960 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3961 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3962 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
3963 
3964 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3965 	    urtw_8225v2_txpwr_cck;
3966 
3967 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3968 		if (cck_pwrlvl <= 6)
3969 			; /* do nothing */
3970 		else if (cck_pwrlvl <= 11)
3971 			cck_pwrtable += 8;
3972 		else
3973 			cck_pwrtable += 16;
3974 	} else {
3975 		if (cck_pwrlvl <= 5)
3976 			; /* do nothing */
3977 		else if (cck_pwrlvl <= 11)
3978 			cck_pwrtable += 8;
3979 		else if (cck_pwrlvl <= 17)
3980 			cck_pwrtable += 16;
3981 		else
3982 			cck_pwrtable += 24;
3983 	}
3984 
3985 	for (i = 0; i < 8; i++) {
3986 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3987 	}
3988 
3989 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3990 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3991 	/*
3992 	 * Delay removed from 8185 to 8187.
3993 	 * usbd_delay_ms(sc->sc_udev, 1);
3994 	 */
3995 
3996 	/* OFDM power setting */
3997 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3998 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3999 
4000 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
4001 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
4002 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
4003 
4004 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
4005 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
4006 
4007 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4008 		if (ofdm_pwrlvl <= 11) {
4009 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4010 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4011 		} else {
4012 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4013 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4014 		}
4015 	} else {
4016 		if (ofdm_pwrlvl <= 11) {
4017 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4018 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4019 		} else if (ofdm_pwrlvl <= 17) {
4020 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4021 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4022 		} else {
4023 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4024 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4025 		}
4026 	}
4027 
4028 	/*
4029 	 * Delay removed from 8185 to 8187.
4030 	 * usbd_delay_ms(sc->sc_udev, 1);
4031 	 */
4032 fail:
4033 	return error;
4034 }
4035 
4036 static int
4037 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4038 {
4039 	int error;
4040 
4041 	urtw_write32_m(sc, URTW_BSSID,
4042 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4043 	urtw_write16_m(sc, URTW_BSSID + 4,
4044 	    bssid[4] | bssid[5] << 8);
4045 
4046 	return 0;
4047 
4048 fail:
4049 	return error;
4050 }
4051 
4052 static int
4053 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4054 {
4055 	int error;
4056 
4057 	urtw_write32_m(sc, URTW_MAC0,
4058 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4059 	urtw_write16_m(sc, URTW_MAC4,
4060 	    addr[4] | addr[5] << 8);
4061 
4062 	return 0;
4063 
4064 fail:
4065 	return error;
4066 }
4067 
4068 MODULE(MODULE_CLASS_DRIVER, if_urtw, NULL);
4069 
4070 #ifdef _MODULE
4071 #include "ioconf.c"
4072 #endif
4073 
4074 static int
4075 if_urtw_modcmd(modcmd_t cmd, void *aux)
4076 {
4077 	int error = 0;
4078 
4079 	switch (cmd) {
4080 	case MODULE_CMD_INIT:
4081 #ifdef _MODULE
4082 		error = config_init_component(cfdriver_ioconf_urtw,
4083 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4084 #endif
4085 		return error;
4086 	case MODULE_CMD_FINI:
4087 #ifdef _MODULE
4088 		error = config_fini_component(cfdriver_ioconf_urtw,
4089 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4090 #endif
4091 		return error;
4092 	default:
4093 		return ENOTTY;
4094 	}
4095 }
4096