xref: /netbsd-src/sys/dev/usb/if_urtw.c (revision 7330f729ccf0bd976a06f95fad452fe774fc7fd1)
1 /*	$NetBSD: if_urtw.c,v 1.19 2019/09/14 12:40:31 maxv Exp $	*/
2 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
3 
4 /*-
5  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
6  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __KERNEL_RCSID(0, "$NetBSD: if_urtw.c,v 1.19 2019/09/14 12:40:31 maxv Exp $");
23 
24 #ifdef _KERNEL_OPT
25 #include "opt_usb.h"
26 #endif
27 
28 #include <sys/param.h>
29 #include <sys/sockio.h>
30 #include <sys/proc.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/callout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 
41 #include <machine/endian.h>
42 #include <net/bpf.h>
43 #include <net/if.h>
44 #include <net/if_arp.h>
45 #include <net/if_dl.h>
46 #include <net/if_ether.h>
47 #include <net/if_media.h>
48 #include <net/if_types.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/if_inarp.h>
54 #include <netinet/ip.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 
59 #include <dev/usb/usb.h>
60 #include <dev/usb/usbdi.h>
61 #include <dev/usb/usbdi_util.h>
62 #include <dev/usb/usbdivar.h>
63 #include <dev/usb/usbdevs.h>
64 
65 #include "if_urtwreg.h"
66 
67 #ifdef URTW_DEBUG
68 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
69 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
70 int urtw_debug = 0;
71 #else
72 #define	DPRINTF(x)
73 #define	DPRINTFN(n, x)
74 #endif
75 
76 /*
77  * Recognized device vendors/products.
78  */
79 static const struct urtw_type {
80 	struct usb_devno	dev;
81 	uint8_t			rev;
82 } urtw_devs[] = {
83 #define	URTW_DEV_RTL8187(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
85 #define	URTW_DEV_RTL8187B(v, p)	\
86 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
87 	/* Realtek RTL8187 devices. */
88 	URTW_DEV_RTL8187(ASUSTEK,	P5B_WIFI),
89 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
90 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GC_2),
91 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
92 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
93 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
94 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
95 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
96 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
97 	/* Realtek RTL8187B devices. */
98 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
99 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
101 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
102 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
103 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
104 #undef	URTW_DEV_RTL8187
105 #undef	URTW_DEV_RTL8187B
106 };
107 #define	urtw_lookup(v, p)	\
108 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
109 
110 /*
111  * Helper read/write macros.
112  */
113 #define urtw_read8_m(sc, val, data)	do {			\
114 	error = urtw_read8_c(sc, val, data, 0);			\
115 	if (error != 0)						\
116 		goto fail;					\
117 } while (0)
118 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
119 	error = urtw_read8_c(sc, val, data, idx);		\
120 	if (error != 0)						\
121 		goto fail;					\
122 } while (0)
123 #define urtw_write8_m(sc, val, data)	do {			\
124 	error = urtw_write8_c(sc, val, data, 0);		\
125 	if (error != 0)						\
126 		goto fail;					\
127 } while (0)
128 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
129 	error = urtw_write8_c(sc, val, data, idx);		\
130 	if (error != 0)						\
131 		goto fail;					\
132 } while (0)
133 #define urtw_read16_m(sc, val, data)	do {			\
134 	error = urtw_read16_c(sc, val, data, 0);		\
135 	if (error != 0)						\
136 		goto fail;					\
137 } while (0)
138 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
139 	error = urtw_read16_c(sc, val, data, idx);		\
140 	if (error != 0)						\
141 		goto fail;					\
142 } while (0)
143 #define urtw_write16_m(sc, val, data)	do {			\
144 	error = urtw_write16_c(sc, val, data, 0);		\
145 	if (error != 0)						\
146 		goto fail;					\
147 } while (0)
148 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
149 	error = urtw_write16_c(sc, val, data, idx);		\
150 	if (error != 0)						\
151 		goto fail;					\
152 } while (0)
153 #define urtw_read32_m(sc, val, data)	do {			\
154 	error = urtw_read32_c(sc, val, data, 0);		\
155 	if (error != 0)						\
156 		goto fail;					\
157 } while (0)
158 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
159 	error = urtw_read32_c(sc, val, data, idx);		\
160 	if (error != 0)						\
161 		goto fail;					\
162 } while (0)
163 #define urtw_write32_m(sc, val, data)	do {			\
164 	error = urtw_write32_c(sc, val, data, 0);		\
165 	if (error != 0)						\
166 		goto fail;					\
167 } while (0)
168 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
169 	error = urtw_write32_c(sc, val, data, idx);		\
170 	if (error != 0)						\
171 		goto fail;					\
172 } while (0)
173 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
174 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
175 	if (error != 0)						\
176 		goto fail;					\
177 } while (0)
178 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
179 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
180 	if (error != 0)						\
181 		goto fail;					\
182 } while (0)
183 #define urtw_8225_write(sc, val, data)	do {			\
184 	error = urtw_8225_write_c(sc, val, data);		\
185 	if (error != 0)						\
186 		goto fail;					\
187 } while (0)
188 
189 struct urtw_pair {
190 	uint32_t	reg;
191 	uint32_t	val;
192 };
193 
194 struct urtw_pair_idx {
195 	uint8_t		reg;
196 	uint8_t		val;
197 	uint8_t		idx;
198 };
199 
200 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
201 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
202 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
203 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
204 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
205 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
206 	{ 0xff, 0x00, 0 },
207 
208 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
209 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
210 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
211 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
212 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
213 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
214 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
215 	{ 0xf8, 0x08, 1 },
216 
217 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
218 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
219 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
220 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
221 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
222 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
223 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
224 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
225 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
226 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
227 
228 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
229 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
230 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
231 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
232 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
233 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
234 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
235 
236 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
237 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
238 };
239 
240 static uint8_t urtw_8225_agc[] = {
241 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
242 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
243 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
244 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
245 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
246 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
247 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
248 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
249 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
250 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
251 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
252 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
253 };
254 
255 static uint32_t urtw_8225_channel[] = {
256 	0x0000,		/* dummy channel 0 */
257 	0x085c,		/* 1 */
258 	0x08dc,		/* 2 */
259 	0x095c,		/* 3 */
260 	0x09dc,		/* 4 */
261 	0x0a5c,		/* 5 */
262 	0x0adc,		/* 6 */
263 	0x0b5c,		/* 7 */
264 	0x0bdc,		/* 8 */
265 	0x0c5c,		/* 9 */
266 	0x0cdc,		/* 10 */
267 	0x0d5c,		/* 11 */
268 	0x0ddc,		/* 12 */
269 	0x0e5c,		/* 13 */
270 	0x0f72,		/* 14 */
271 };
272 
273 static uint8_t urtw_8225_gain[] = {
274 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
275 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
276 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
277 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
278 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
279 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
280 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
281 };
282 
283 static struct urtw_pair urtw_8225_rf_part1[] = {
284 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
285 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
286 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
287 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
288 };
289 
290 static struct urtw_pair urtw_8225_rf_part2[] = {
291 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
292 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
293 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
294 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
295 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
296 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
297 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
298 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
299 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
300 	{ 0x27, 0x88 }
301 };
302 
303 static struct urtw_pair urtw_8225_rf_part3[] = {
304 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
305 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
306 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
307 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
308 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
309 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
310 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
311 };
312 
313 static uint16_t urtw_8225_rxgain[] = {
314 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
315 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
316 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
317 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
318 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
319 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
320 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
321 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
322 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
323 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
324 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
325 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
326 };
327 
328 static uint8_t urtw_8225_threshold[] = {
329 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
330 };
331 
332 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
333 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
334 };
335 
336 static uint8_t urtw_8225_txpwr_cck[] = {
337 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
338 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
339 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
340 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
341 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
342 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
343 };
344 
345 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
346 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
347 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
348 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
349 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
350 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
351 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
352 };
353 
354 static uint8_t urtw_8225_txpwr_ofdm[] = {
355 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
356 };
357 
358 static uint8_t urtw_8225v2_agc[] = {
359 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
360 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
361 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
362 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
363 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
364 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
365 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
366 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
367 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
368 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
369 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
370 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
371 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
372 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
373 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
374 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
375 };
376 
377 static uint8_t urtw_8225v2_ofdm[] = {
378 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
379 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
380 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
381 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
382 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
383 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
384 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
385 	0x6d, 0x3c, 0xfb, 0x07
386 };
387 
388 static uint8_t urtw_8225v2_gain_bg[] = {
389 	0x23, 0x15, 0xa5,		/* -82-1dbm */
390 	0x23, 0x15, 0xb5,		/* -82-2dbm */
391 	0x23, 0x15, 0xc5,		/* -82-3dbm */
392 	0x33, 0x15, 0xc5,		/* -78dbm */
393 	0x43, 0x15, 0xc5,		/* -74dbm */
394 	0x53, 0x15, 0xc5,		/* -70dbm */
395 	0x63, 0x15, 0xc5,		/* -66dbm */
396 };
397 
398 static struct urtw_pair urtw_8225v2_rf_part1[] = {
399 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
400 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
401 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
402 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
403 };
404 
405 static struct urtw_pair urtw_8225v2_rf_part2[] = {
406 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
407 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
408 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
409 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
410 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
411 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
412 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
413 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
414 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
415 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
416 };
417 
418 static struct urtw_pair urtw_8225v2_rf_part3[] = {
419 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
420 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
421 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
422 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
423 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
424 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
425 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
426 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
427 };
428 
429 static uint16_t urtw_8225v2_rxgain[] = {
430 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
431 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
432 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
433 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
434 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
435 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
436 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
437 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
438 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
439 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
440 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
441 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
442 };
443 
444 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
445 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
446 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
447 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
448 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
449 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
450 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
451 };
452 
453 static uint8_t urtw_8225v2_txpwr_cck[] = {
454 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
455 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
456 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
457 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
458 };
459 
460 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
461 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
463 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
464 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
465 };
466 
467 static struct urtw_pair urtw_8225v2_b_rf[] = {
468 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
469 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
470 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
471 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
472 	{ 0x00, 0x01b7 }
473 };
474 
475 static struct urtw_pair urtw_ratetable[] = {
476 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
477 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
478 	{ 96, 10 }, { 108, 11 }
479 };
480 
481 int		urtw_init(struct ifnet *);
482 void		urtw_stop(struct ifnet *, int);
483 int		urtw_ioctl(struct ifnet *, u_long, void *);
484 void		urtw_start(struct ifnet *);
485 int		urtw_alloc_rx_data_list(struct urtw_softc *);
486 void		urtw_free_rx_data_list(struct urtw_softc *);
487 int		urtw_alloc_tx_data_list(struct urtw_softc *);
488 void		urtw_free_tx_data_list(struct urtw_softc *);
489 void		urtw_rxeof(struct usbd_xfer *, void *,
490 		    usbd_status);
491 int		urtw_tx_start(struct urtw_softc *,
492 		    struct ieee80211_node *, struct mbuf *, int);
493 void		urtw_txeof_low(struct usbd_xfer *, void *,
494 		    usbd_status);
495 void		urtw_txeof_normal(struct usbd_xfer *, void *,
496 		    usbd_status);
497 void		urtw_next_scan(void *);
498 void		urtw_task(void *);
499 void		urtw_ledusbtask(void *);
500 void		urtw_ledtask(void *);
501 int		urtw_media_change(struct ifnet *);
502 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
503 void		urtw_watchdog(struct ifnet *);
504 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
505 int		urtw_isbmode(uint16_t);
506 uint16_t	urtw_rate2rtl(int);
507 uint16_t	urtw_rtl2rate(int);
508 usbd_status	urtw_set_rate(struct urtw_softc *);
509 usbd_status	urtw_update_msr(struct urtw_softc *);
510 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
511 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
512 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
513 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
514 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
515 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
516 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
517 usbd_status	urtw_eprom_ck(struct urtw_softc *);
518 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
519 		    int);
520 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
521 		    uint32_t *);
522 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
523 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
524 usbd_status	urtw_get_macaddr(struct urtw_softc *);
525 usbd_status	urtw_get_txpwr(struct urtw_softc *);
526 usbd_status	urtw_get_rfchip(struct urtw_softc *);
527 usbd_status	urtw_led_init(struct urtw_softc *);
528 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
529 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
530 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
531 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
532 		    uint32_t);
533 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
534 		    uint32_t);
535 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
536 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
537 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
538 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
539 		    uint16_t);
540 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
541 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
542 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
543 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
544 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
545 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
546 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
547 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
548 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
549 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
550 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
551 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
552 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
553 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
554 usbd_status	urtw_open_pipes(struct urtw_softc *);
555 usbd_status	urtw_close_pipes(struct urtw_softc *);
556 usbd_status	urtw_intr_enable(struct urtw_softc *);
557 usbd_status	urtw_intr_disable(struct urtw_softc *);
558 usbd_status	urtw_reset(struct urtw_softc *);
559 usbd_status	urtw_led_on(struct urtw_softc *, int);
560 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
561 usbd_status	urtw_led_blink(struct urtw_softc *);
562 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
563 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
564 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
565 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
566 usbd_status	urtw_rx_setconf(struct urtw_softc *);
567 usbd_status	urtw_rx_enable(struct urtw_softc *);
568 usbd_status	urtw_tx_enable(struct urtw_softc *);
569 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
570 usbd_status	urtw_8187b_reset(struct urtw_softc *);
571 int		urtw_8187b_init(struct ifnet *);
572 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
573 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
574 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
575 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
576 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
577 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
578 int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
579 int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
580 
581 int urtw_match(device_t, cfdata_t, void *);
582 void urtw_attach(device_t, device_t, void *);
583 int urtw_detach(device_t, int);
584 int urtw_activate(device_t, enum devact);
585 
586 CFATTACH_DECL_NEW(urtw, sizeof(struct urtw_softc),
587 	urtw_match,
588 	urtw_attach,
589 	urtw_detach,
590 	urtw_activate
591 );
592 
593 int
594 urtw_match(device_t parent, cfdata_t match, void *aux)
595 {
596 	struct usb_attach_arg *uaa = aux;
597 
598 	return urtw_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
599 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
600 }
601 
602 void
603 urtw_attach(device_t parent, device_t self, void *aux)
604 {
605 	struct urtw_softc *sc = device_private(self);
606 	struct usb_attach_arg *uaa = aux;
607 	struct ieee80211com *ic = &sc->sc_ic;
608 	struct ifnet *ifp = &sc->sc_if;
609 	usbd_status error;
610 	uint8_t data8;
611 	uint32_t data;
612 	int i;
613 
614 	sc->sc_dev = self;
615 	sc->sc_udev = uaa->uaa_device;
616 	sc->sc_hwrev = urtw_lookup(uaa->uaa_vendor, uaa->uaa_product)->rev;
617 	sc->sc_init_state = URTW_INIT_NONE;
618 
619 	aprint_naive("\n");
620 	aprint_normal(": ");
621 
622 	if (sc->sc_hwrev & URTW_HWREV_8187) {
623 		urtw_read32_m(sc, URTW_TX_CONF, &data);
624 		data &= URTW_TX_HWREV_MASK;
625 		switch (data) {
626 		case URTW_TX_HWREV_8187_D:
627 			sc->sc_hwrev |= URTW_HWREV_8187_D;
628 			aprint_normal("RTL8187 rev D");
629 			break;
630 		case URTW_TX_HWREV_8187B_D:
631 			/*
632 			 * Detect Realtek RTL8187B devices that use
633 			 * USB IDs of RTL8187.
634 			 */
635 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
636 			aprint_normal("RTL8187B rev B (early)");
637 			break;
638 		default:
639 			sc->sc_hwrev |= URTW_HWREV_8187_B;
640 			aprint_normal("RTL8187 rev 0x%02x", data >> 25);
641 			break;
642 		}
643 	} else {
644 		/* RTL8187B hwrev register. */
645 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
646 		switch (data8) {
647 		case URTW_8187B_HWREV_8187B_B:
648 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
649 			aprint_normal("RTL8187B rev B");
650 			break;
651 		case URTW_8187B_HWREV_8187B_D:
652 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
653 			aprint_normal("RTL8187B rev D");
654 			break;
655 		case URTW_8187B_HWREV_8187B_E:
656 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
657 			aprint_normal("RTL8187B rev E");
658 			break;
659 		default:
660 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
661 			aprint_normal("RTL8187B rev 0x%02x", data8);
662 			break;
663 		}
664 	}
665 
666 	urtw_read32_m(sc, URTW_RX, &data);
667 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
668 	    URTW_EEPROM_93C46;
669 
670 	error = urtw_get_rfchip(sc);
671 	if (error != 0)
672 		goto fail;
673 	error = urtw_get_macaddr(sc);
674 	if (error != 0)
675 		goto fail;
676 	error = urtw_get_txpwr(sc);
677 	if (error != 0)
678 		goto fail;
679 	error = urtw_led_init(sc);		/* XXX incompleted */
680 	if (error != 0)
681 		goto fail;
682 
683 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
684 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
685 	sc->sc_currate = 3;
686 	/* XXX for what? */
687 	sc->sc_preamble_mode = 2;
688 
689 	usb_init_task(&sc->sc_task, urtw_task, sc, 0);
690 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc, 0);
691 	callout_init(&sc->scan_to, 0);
692 	callout_setfunc(&sc->scan_to, urtw_next_scan, sc);
693 	callout_init(&sc->sc_led_ch, 0);
694 	callout_setfunc(&sc->sc_led_ch, urtw_ledtask, sc);
695 
696 	ic->ic_ifp = ifp;
697 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
698 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
699 	ic->ic_state = IEEE80211_S_INIT;
700 
701 	/* set device capabilities */
702 	ic->ic_caps =
703 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
704 	    IEEE80211_C_TXPMGT |	/* tx power management */
705 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
706 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
707 	    IEEE80211_C_WEP |		/* s/w WEP */
708 	    IEEE80211_C_WPA;		/* WPA/RSN */
709 
710 	/* set supported .11b and .11g rates */
711 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
712 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
713 
714 	/* set supported .11b and .11g channels (1 through 14) */
715 	for (i = 1; i <= 14; i++) {
716 		ic->ic_channels[i].ic_freq =
717 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
718 		ic->ic_channels[i].ic_flags =
719 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
720 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
721 	}
722 
723 	ifp->if_softc = sc;
724 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
725 	if (sc->sc_hwrev & URTW_HWREV_8187) {
726 		ifp->if_init = urtw_init;
727 	} else {
728 		ifp->if_init = urtw_8187b_init;
729 	}
730 	ifp->if_ioctl = urtw_ioctl;
731 	ifp->if_start = urtw_start;
732 	ifp->if_watchdog = urtw_watchdog;
733 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
734 	IFQ_SET_READY(&ifp->if_snd);
735 	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
736 
737 	if_attach(ifp);
738 	ieee80211_ifattach(ic);
739 
740 	/* override state transition machine */
741 	sc->sc_newstate = ic->ic_newstate;
742 	ic->ic_newstate = urtw_newstate;
743 	ieee80211_media_init(ic, urtw_media_change, ieee80211_media_status);
744 
745 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
746 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
747 	    &sc->sc_drvbpf);
748 
749 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
750 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
751 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
752 
753 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
754 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
755 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
756 
757 	aprint_normal(", address %s\n", ether_sprintf(ic->ic_myaddr));
758 
759 	ieee80211_announce(ic);
760 
761 	sc->sc_init_state = URTW_INIT_INITED;
762 
763 	return;
764 fail:
765 	aprint_error(": %s failed!\n", __func__);
766 	sc->sc_dying = true;
767 }
768 
769 int
770 urtw_detach(device_t self, int flags)
771 {
772 	struct urtw_softc *sc = device_private(self);
773 	struct ifnet *ifp = &sc->sc_if;
774 	int s;
775 
776 	s = splusb();
777 
778 	sc->sc_dying = true;
779 
780 	if (sc->sc_init_state < URTW_INIT_INITED)
781 		goto out;
782 
783 	callout_halt(&sc->scan_to, NULL);
784 	callout_halt(&sc->sc_led_ch, NULL);
785 	callout_destroy(&sc->scan_to);
786 	callout_destroy(&sc->sc_led_ch);
787 
788 	usb_rem_task_wait(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER, NULL);
789 	usb_rem_task_wait(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER,
790 	    NULL);
791 
792 	if (ifp->if_softc != NULL) {
793 		bpf_detach(ifp);
794 		ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
795 		if_detach(ifp);
796 	}
797 
798 	/* abort and free xfers */
799 	urtw_free_tx_data_list(sc);
800 	urtw_free_rx_data_list(sc);
801 	urtw_close_pipes(sc);
802 
803 out:
804 	splx(s);
805 	return 0;
806 }
807 
808 int
809 urtw_activate(device_t self, enum devact act)
810 {
811 	struct urtw_softc *sc = device_private(self);
812 
813 	switch (act) {
814 	case DVACT_DEACTIVATE:
815 		sc->sc_dying = true;
816 		break;
817 	}
818 
819 	return 0;
820 }
821 
822 usbd_status
823 urtw_close_pipes(struct urtw_softc *sc)
824 {
825 	usbd_status error = 0;
826 
827 	if (sc->sc_rxpipe != NULL) {
828 		error = usbd_close_pipe(sc->sc_rxpipe);
829 		if (error != 0)
830 			goto fail;
831 		sc->sc_rxpipe = NULL;
832 	}
833 	if (sc->sc_txpipe_low != NULL) {
834 		error = usbd_close_pipe(sc->sc_txpipe_low);
835 		if (error != 0)
836 			goto fail;
837 		sc->sc_txpipe_low = NULL;
838 	}
839 	if (sc->sc_txpipe_normal != NULL) {
840 		error = usbd_close_pipe(sc->sc_txpipe_normal);
841 		if (error != 0)
842 			goto fail;
843 		sc->sc_txpipe_normal = NULL;
844 	}
845 fail:
846 	return error;
847 }
848 
849 usbd_status
850 urtw_open_pipes(struct urtw_softc *sc)
851 {
852 	usbd_status error;
853 
854 	/*
855 	 * NB: there is no way to distinguish each pipes so we need to hardcode
856 	 * pipe numbers
857 	 */
858 
859 	/* tx pipe - low priority packets */
860 	if (sc->sc_hwrev & URTW_HWREV_8187)
861 		error = usbd_open_pipe(sc->sc_iface, 0x2,
862 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
863 	else
864 		error = usbd_open_pipe(sc->sc_iface, 0x6,
865 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
866 	if (error != 0) {
867 		printf("%s: could not open Tx low pipe: %s\n",
868 		    device_xname(sc->sc_dev), usbd_errstr(error));
869 		goto fail;
870 	}
871 	/* tx pipe - normal priority packets */
872 	if (sc->sc_hwrev & URTW_HWREV_8187)
873 		error = usbd_open_pipe(sc->sc_iface, 0x3,
874 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
875 	else
876 		error = usbd_open_pipe(sc->sc_iface, 0x7,
877 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
878 	if (error != 0) {
879 		printf("%s: could not open Tx normal pipe: %s\n",
880 		    device_xname(sc->sc_dev), usbd_errstr(error));
881 		goto fail;
882 	}
883 	/* rx pipe */
884 	if (sc->sc_hwrev & URTW_HWREV_8187)
885 		error = usbd_open_pipe(sc->sc_iface, 0x81,
886 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
887 	else
888 		error = usbd_open_pipe(sc->sc_iface, 0x83,
889 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
890 	if (error != 0) {
891 		printf("%s: could not open Rx pipe: %s\n",
892 		    device_xname(sc->sc_dev), usbd_errstr(error));
893 		goto fail;
894 	}
895 
896 	return 0;
897 fail:
898 	(void)urtw_close_pipes(sc);
899 	return error;
900 }
901 
902 int
903 urtw_alloc_rx_data_list(struct urtw_softc *sc)
904 {
905 	int i, error;
906 
907 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
908 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
909 
910 		data->sc = sc;
911 
912 		error = usbd_create_xfer(sc->sc_rxpipe, MCLBYTES,
913 		    0, 0, &data->xfer);
914 		if (error) {
915 
916 			printf("%s: could not allocate rx xfer\n",
917 			    device_xname(sc->sc_dev));
918 			error = ENOMEM;
919 			goto fail;
920 		}
921 
922 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
923 		if (data->m == NULL) {
924 			printf("%s: could not allocate rx mbuf\n",
925 			    device_xname(sc->sc_dev));
926 			error = ENOMEM;
927 			goto fail;
928 		}
929 		MCLGET(data->m, M_DONTWAIT);
930 		if (!(data->m->m_flags & M_EXT)) {
931 			printf("%s: could not allocate rx mbuf cluster\n",
932 			    device_xname(sc->sc_dev));
933 			error = ENOMEM;
934 			goto fail;
935 		}
936 		data->buf = mtod(data->m, uint8_t *);
937 	}
938 
939 	return 0;
940 
941 fail:
942 	urtw_free_rx_data_list(sc);
943 	return error;
944 }
945 
946 void
947 urtw_free_rx_data_list(struct urtw_softc *sc)
948 {
949 	int i;
950 
951 	/* Make sure no transfers are pending. */
952 	if (sc->sc_rxpipe != NULL)
953 		usbd_abort_pipe(sc->sc_rxpipe);
954 
955 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
956 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
957 
958 		if (data->xfer != NULL) {
959 			usbd_destroy_xfer(data->xfer);
960 			data->xfer = NULL;
961 		}
962 		if (data->m != NULL) {
963 			m_freem(data->m);
964 			data->m = NULL;
965 		}
966 	}
967 }
968 
969 int
970 urtw_alloc_tx_data_list(struct urtw_softc *sc)
971 {
972 	int i, error;
973 
974 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
975 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
976 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
977 
978 			data->sc = sc;
979 			data->ni = NULL;
980 
981 			error = usbd_create_xfer((j == URTW_PRIORITY_LOW) ?
982 			    sc->sc_txpipe_low : sc->sc_txpipe_normal,
983 			    URTW_TX_MAXSIZE, USBD_FORCE_SHORT_XFER, 0,
984 			    &data->xfer);
985 			if (error) {
986 				printf("%s: could not allocate tx xfer\n",
987 				    device_xname(sc->sc_dev));
988 				goto fail;
989 			}
990 
991 			data->buf = usbd_get_buffer(data->xfer);
992 
993 			if (((unsigned long)data->buf) % 4)
994 				printf("%s: warn: unaligned buffer %p\n",
995 				    device_xname(sc->sc_dev), data->buf);
996 		}
997 	}
998 
999 	return 0;
1000 
1001 fail:
1002 	urtw_free_tx_data_list(sc);
1003 	return error;
1004 }
1005 
1006 void
1007 urtw_free_tx_data_list(struct urtw_softc *sc)
1008 {
1009 	int i;
1010 
1011 	/* Make sure no transfers are pending. */
1012 	if (sc->sc_txpipe_low != NULL)
1013 		usbd_abort_pipe(sc->sc_txpipe_low);
1014 	if (sc->sc_txpipe_normal != NULL)
1015 		usbd_abort_pipe(sc->sc_txpipe_normal);
1016 
1017 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
1018 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1019 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
1020 
1021 			if (data->xfer != NULL) {
1022 				usbd_destroy_xfer(data->xfer);
1023 				data->xfer = NULL;
1024 			}
1025 			if (data->ni != NULL) {
1026 				ieee80211_free_node(data->ni);
1027 				data->ni = NULL;
1028 			}
1029 		}
1030 	}
1031 }
1032 
1033 int
1034 urtw_media_change(struct ifnet *ifp)
1035 {
1036 	int error;
1037 
1038 	error = ieee80211_media_change(ifp);
1039 	if (error != ENETRESET)
1040 		return error;
1041 
1042 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1043 	    (IFF_UP | IFF_RUNNING))
1044 		ifp->if_init(ifp);
1045 
1046 	return 0;
1047 }
1048 
1049 int
1050 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1051 {
1052 	struct urtw_softc *sc = ic->ic_ifp->if_softc;
1053 
1054 	/*
1055 	 * XXXSMP: This does not wait for the task, if it is in flight,
1056 	 * to complete.  If this code works at all, it must rely on the
1057 	 * kernel lock to serialize with the USB task thread.
1058 	 */
1059 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1060 	callout_stop(&sc->scan_to);
1061 
1062 	/* do it in a process context */
1063 	sc->sc_state = nstate;
1064 	sc->sc_arg = arg;
1065 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
1066 
1067 	return 0;
1068 }
1069 
1070 usbd_status
1071 urtw_led_init(struct urtw_softc *sc)
1072 {
1073 	uint32_t rev;
1074 	usbd_status error;
1075 
1076 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1077 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1078 	if (error != 0)
1079 		goto fail;
1080 
1081 	switch (rev & URTW_EPROM_CID_MASK) {
1082 	case URTW_EPROM_CID_ALPHA0:
1083 		sc->sc_strategy = URTW_SW_LED_MODE1;
1084 		break;
1085 	case URTW_EPROM_CID_SERCOMM_PS:
1086 		sc->sc_strategy = URTW_SW_LED_MODE3;
1087 		break;
1088 	case URTW_EPROM_CID_HW_LED:
1089 		sc->sc_strategy = URTW_HW_LED;
1090 		break;
1091 	case URTW_EPROM_CID_RSVD0:
1092 	case URTW_EPROM_CID_RSVD1:
1093 	default:
1094 		sc->sc_strategy = URTW_SW_LED_MODE0;
1095 		break;
1096 	}
1097 
1098 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1099 
1100 fail:
1101 	return error;
1102 }
1103 
1104 usbd_status
1105 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1106     uint16_t data)
1107 {
1108 	usb_device_request_t req;
1109 
1110 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1111 	req.bRequest = URTW_8187_SETREGS_REQ;
1112 	USETW(req.wValue, addr);
1113 	USETW(req.wIndex, index);
1114 	USETW(req.wLength, sizeof(uint16_t));
1115 
1116 	return usbd_do_request(sc->sc_udev, &req, &data);
1117 }
1118 
1119 usbd_status
1120 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1121 {
1122 	int i;
1123 	int16_t bit;
1124 	uint8_t rlen = 12, wlen = 6;
1125 	uint16_t o1, o2, o3, tmp;
1126 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1127 	uint32_t mask = 0x80000000, value = 0;
1128 	usbd_status error;
1129 
1130 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1131 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1132 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1133 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1134 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1135 	o1 &= ~0xf;
1136 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1137 	DELAY(5);
1138 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1139 	DELAY(5);
1140 
1141 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1142 		bit = ((d2w & mask) != 0) ? 1 : 0;
1143 
1144 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1145 		DELAY(2);
1146 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1147 		    URTW_BB_HOST_BANG_CLK);
1148 		DELAY(2);
1149 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1150 		    URTW_BB_HOST_BANG_CLK);
1151 		DELAY(2);
1152 		mask = mask >> 1;
1153 		if (i == 2)
1154 			break;
1155 		bit = ((d2w & mask) != 0) ? 1 : 0;
1156 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1157 		    URTW_BB_HOST_BANG_CLK);
1158 		DELAY(2);
1159 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1160 		    URTW_BB_HOST_BANG_CLK);
1161 		DELAY(2);
1162 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1163 		DELAY(1);
1164 	}
1165 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1166 	    URTW_BB_HOST_BANG_CLK);
1167 	DELAY(2);
1168 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1169 	DELAY(2);
1170 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1171 	DELAY(2);
1172 
1173 	mask = 0x800;
1174 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1175 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1176 		    o1 | URTW_BB_HOST_BANG_RW);
1177 		DELAY(2);
1178 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1179 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1180 		DELAY(2);
1181 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1182 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1183 		DELAY(2);
1184 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1185 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1186 		DELAY(2);
1187 
1188 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1189 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1190 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1191 		    o1 | URTW_BB_HOST_BANG_RW);
1192 		DELAY(2);
1193 	}
1194 
1195 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1196 	    URTW_BB_HOST_BANG_RW);
1197 	DELAY(2);
1198 
1199 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1200 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1201 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1202 
1203 	if (data != NULL)
1204 		*data = value;
1205 fail:
1206 	return error;
1207 }
1208 
1209 usbd_status
1210 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1211 {
1212 	uint16_t d80, d82, d84;
1213 	usbd_status error;
1214 
1215 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1216 	d80 &= 0xfff3;
1217 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1218 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1219 	d84 &= 0xfff0;
1220 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1221 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1222 	DELAY(10);
1223 
1224 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1225 	DELAY(2);
1226 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1227 	DELAY(10);
1228 
1229 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1230 	if (error != 0)
1231 		goto fail;
1232 
1233 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1234 	DELAY(10);
1235 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1236 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1237 	usbd_delay_ms(sc->sc_udev, 2);
1238 fail:
1239 	return error;
1240 }
1241 
1242 usbd_status
1243 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1244 {
1245 	uint32_t data;
1246 	usbd_status error;
1247 
1248 	*ret = 1;
1249 
1250 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1251 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1252 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1253 	usbd_delay_ms(sc->sc_udev, 500);
1254 
1255 	urtw_8225_write(sc, 0x0, 0x1b7);
1256 
1257 	error = urtw_8225_read(sc, 0x8, &data);
1258 	if (error != 0)
1259 		goto fail;
1260 	if (data != 0x588)
1261 		*ret = 0;
1262 	else {
1263 		error = urtw_8225_read(sc, 0x9, &data);
1264 		if (error != 0)
1265 			goto fail;
1266 		if (data != 0x700)
1267 			*ret = 0;
1268 	}
1269 
1270 	urtw_8225_write(sc, 0x0, 0xb7);
1271 fail:
1272 	return error;
1273 }
1274 
1275 usbd_status
1276 urtw_get_rfchip(struct urtw_softc *sc)
1277 {
1278 	struct urtw_rf *rf = &sc->sc_rf;
1279 	int ret;
1280 	uint32_t data;
1281 	usbd_status error;
1282 
1283 	rf->rf_sc = sc;
1284 
1285 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1286 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1287 		if (error != 0)
1288 			return error;
1289 		switch (data & 0xff) {
1290 		case URTW_EPROM_RFCHIPID_RTL8225U:
1291 			error = urtw_8225_isv2(sc, &ret);
1292 			if (error != 0)
1293 				goto fail;
1294 			if (ret == 0) {
1295 				rf->init = urtw_8225_rf_init;
1296 				rf->set_chan = urtw_8225_rf_set_chan;
1297 				rf->set_sens = urtw_8225_rf_set_sens;
1298 				printf(", RFv1");
1299 			} else {
1300 				rf->init = urtw_8225v2_rf_init;
1301 				rf->set_chan = urtw_8225v2_rf_set_chan;
1302 				rf->set_sens = NULL;
1303 				printf(", RFv2");
1304 			}
1305 			break;
1306 		default:
1307 			goto fail;
1308 		}
1309 	} else {
1310 		rf->init = urtw_8225v2_b_rf_init;
1311 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1312 		rf->set_sens = NULL;
1313 	}
1314 
1315 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1316 	rf->sens = URTW_8225_RF_DEF_SENS;
1317 
1318 	return 0;
1319 
1320 fail:
1321 	aprint_error(": unsupported RF chip %d", data & 0xff);
1322 	return USBD_INVAL;
1323 }
1324 
1325 usbd_status
1326 urtw_get_txpwr(struct urtw_softc *sc)
1327 {
1328 	int i, j;
1329 	uint32_t data;
1330 	usbd_status error;
1331 
1332 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1333 	if (error != 0)
1334 		goto fail;
1335 	sc->sc_txpwr_cck_base = data & 0xf;
1336 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1337 
1338 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1339 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1340 		if (error != 0)
1341 			goto fail;
1342 		sc->sc_txpwr_cck[i] = data & 0xf;
1343 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1344 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1345 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1346 	}
1347 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1348 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1349 		if (error != 0)
1350 			goto fail;
1351 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1352 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1353 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1354 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1355 	}
1356 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1357 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1358 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1359 			    &data);
1360 			if (error != 0)
1361 				goto fail;
1362 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1363 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1364 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1365 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1366 			    (data & 0xf000) >> 12;
1367 		}
1368 	} else {
1369 		/* Channel 11. */
1370 		error = urtw_eprom_read32(sc, 0x1b, &data);
1371 		if (error != 0)
1372 			goto fail;
1373 		sc->sc_txpwr_cck[11] = data & 0xf;
1374 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1375 
1376 		/* Channel 12. */
1377 		error = urtw_eprom_read32(sc, 0xa, &data);
1378 		if (error != 0)
1379 			goto fail;
1380 		sc->sc_txpwr_cck[12] = data & 0xf;
1381 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1382 
1383 		/* Channel 13, 14. */
1384 		error = urtw_eprom_read32(sc, 0x1c, &data);
1385 		if (error != 0)
1386 			goto fail;
1387 		sc->sc_txpwr_cck[13] = data & 0xf;
1388 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1389 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1390 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1391 	}
1392 fail:
1393 	return error;
1394 }
1395 
1396 usbd_status
1397 urtw_get_macaddr(struct urtw_softc *sc)
1398 {
1399 	struct ieee80211com *ic = &sc->sc_ic;
1400 	usbd_status error;
1401 	uint32_t data;
1402 
1403 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1404 	if (error != 0)
1405 		goto fail;
1406 	ic->ic_myaddr[0] = data & 0xff;
1407 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1408 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1409 	if (error != 0)
1410 		goto fail;
1411 	ic->ic_myaddr[2] = data & 0xff;
1412 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1413 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1414 	if (error != 0)
1415 		goto fail;
1416 	ic->ic_myaddr[4] = data & 0xff;
1417 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1418 fail:
1419 	return error;
1420 }
1421 
1422 usbd_status
1423 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1424 {
1425 #define URTW_READCMD_LEN		3
1426 	int addrlen, i;
1427 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1428 	usbd_status error;
1429 
1430 	/* NB: make sure the buffer is initialized */
1431 	*data = 0;
1432 
1433 	/* enable EPROM programming */
1434 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1435 	DELAY(URTW_EPROM_DELAY);
1436 
1437 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1438 	if (error != 0)
1439 		goto fail;
1440 	error = urtw_eprom_ck(sc);
1441 	if (error != 0)
1442 		goto fail;
1443 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1444 	if (error != 0)
1445 		goto fail;
1446 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1447 		addrlen = 8;
1448 		addrstr[0] = addr & (1 << 7);
1449 		addrstr[1] = addr & (1 << 6);
1450 		addrstr[2] = addr & (1 << 5);
1451 		addrstr[3] = addr & (1 << 4);
1452 		addrstr[4] = addr & (1 << 3);
1453 		addrstr[5] = addr & (1 << 2);
1454 		addrstr[6] = addr & (1 << 1);
1455 		addrstr[7] = addr & (1 << 0);
1456 	} else {
1457 		addrlen=6;
1458 		addrstr[0] = addr & (1 << 5);
1459 		addrstr[1] = addr & (1 << 4);
1460 		addrstr[2] = addr & (1 << 3);
1461 		addrstr[3] = addr & (1 << 2);
1462 		addrstr[4] = addr & (1 << 1);
1463 		addrstr[5] = addr & (1 << 0);
1464 	}
1465 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1466 	if (error != 0)
1467 		goto fail;
1468 
1469 	error = urtw_eprom_writebit(sc, 0);
1470 	if (error != 0)
1471 		goto fail;
1472 
1473 	for (i = 0; i < 16; i++) {
1474 		error = urtw_eprom_ck(sc);
1475 		if (error != 0)
1476 			goto fail;
1477 		error = urtw_eprom_readbit(sc, &data16);
1478 		if (error != 0)
1479 			goto fail;
1480 
1481 		(*data) |= (data16 << (15 - i));
1482 	}
1483 
1484 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1485 	if (error != 0)
1486 		goto fail;
1487 	error = urtw_eprom_ck(sc);
1488 	if (error != 0)
1489 		goto fail;
1490 
1491 	/* now disable EPROM programming */
1492 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1493 fail:
1494 	return error;
1495 #undef URTW_READCMD_LEN
1496 }
1497 
1498 usbd_status
1499 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1500 {
1501 	uint8_t data8;
1502 	usbd_status error;
1503 
1504 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1505 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1506 	DELAY(URTW_EPROM_DELAY);
1507 
1508 fail:
1509 	return error;
1510 }
1511 
1512 usbd_status
1513 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1514 {
1515 	int i = 0;
1516 	usbd_status error = 0;
1517 
1518 	for (i = 0; i < buflen; i++) {
1519 		error = urtw_eprom_writebit(sc, buf[i]);
1520 		if (error != 0)
1521 			goto fail;
1522 		error = urtw_eprom_ck(sc);
1523 		if (error != 0)
1524 			goto fail;
1525 	}
1526 fail:
1527 	return error;
1528 }
1529 
1530 usbd_status
1531 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1532 {
1533 	uint8_t data;
1534 	usbd_status error;
1535 
1536 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1537 	if (bit != 0)
1538 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1539 	else
1540 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1541 	DELAY(URTW_EPROM_DELAY);
1542 fail:
1543 	return error;
1544 }
1545 
1546 usbd_status
1547 urtw_eprom_ck(struct urtw_softc *sc)
1548 {
1549 	uint8_t data;
1550 	usbd_status error;
1551 
1552 	/* masking */
1553 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1554 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1555 	DELAY(URTW_EPROM_DELAY);
1556 	/* unmasking */
1557 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1558 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1559 	DELAY(URTW_EPROM_DELAY);
1560 fail:
1561 	return error;
1562 }
1563 
1564 usbd_status
1565 urtw_eprom_cs(struct urtw_softc *sc, int able)
1566 {
1567 	uint8_t data;
1568 	usbd_status error;
1569 
1570 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1571 	if (able == URTW_EPROM_ENABLE)
1572 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1573 	else
1574 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1575 	DELAY(URTW_EPROM_DELAY);
1576 fail:
1577 	return error;
1578 }
1579 
1580 usbd_status
1581 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1582 {
1583 	usb_device_request_t req;
1584 	usbd_status error;
1585 
1586 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1587 	req.bRequest = URTW_8187_GETREGS_REQ;
1588 	USETW(req.wValue, val | 0xff00);
1589 	USETW(req.wIndex, idx & 0x03);
1590 	USETW(req.wLength, sizeof(uint8_t));
1591 
1592 	error = usbd_do_request(sc->sc_udev, &req, data);
1593 	return error;
1594 }
1595 
1596 usbd_status
1597 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1598 {
1599 	usb_device_request_t req;
1600 	usbd_status error;
1601 
1602 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1603 	req.bRequest = URTW_8187_GETREGS_REQ;
1604 	USETW(req.wValue, val | 0xfe00);
1605 	USETW(req.wIndex, 0);
1606 	USETW(req.wLength, sizeof(uint8_t));
1607 
1608 	error = usbd_do_request(sc->sc_udev, &req, data);
1609 	return error;
1610 }
1611 
1612 usbd_status
1613 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1614 {
1615 	usb_device_request_t req;
1616 	usbd_status error;
1617 
1618 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1619 	req.bRequest = URTW_8187_GETREGS_REQ;
1620 	USETW(req.wValue, val | 0xff00);
1621 	USETW(req.wIndex, idx & 0x03);
1622 	USETW(req.wLength, sizeof(uint16_t));
1623 
1624 	error = usbd_do_request(sc->sc_udev, &req, data);
1625 	return error;
1626 }
1627 
1628 usbd_status
1629 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1630 {
1631 	usb_device_request_t req;
1632 	usbd_status error;
1633 
1634 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1635 	req.bRequest = URTW_8187_GETREGS_REQ;
1636 	USETW(req.wValue, val | 0xff00);
1637 	USETW(req.wIndex, idx & 0x03);
1638 	USETW(req.wLength, sizeof(uint32_t));
1639 
1640 	error = usbd_do_request(sc->sc_udev, &req, data);
1641 	return error;
1642 }
1643 
1644 usbd_status
1645 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1646 {
1647 	usb_device_request_t req;
1648 
1649 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1650 	req.bRequest = URTW_8187_SETREGS_REQ;
1651 	USETW(req.wValue, val | 0xff00);
1652 	USETW(req.wIndex, idx & 0x03);
1653 	USETW(req.wLength, sizeof(uint8_t));
1654 
1655 	return usbd_do_request(sc->sc_udev, &req, &data);
1656 }
1657 
1658 usbd_status
1659 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1660 {
1661 	usb_device_request_t req;
1662 
1663 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1664 	req.bRequest = URTW_8187_SETREGS_REQ;
1665 	USETW(req.wValue, val | 0xfe00);
1666 	USETW(req.wIndex, 0);
1667 	USETW(req.wLength, sizeof(uint8_t));
1668 
1669 	return usbd_do_request(sc->sc_udev, &req, &data);
1670 }
1671 
1672 usbd_status
1673 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1674 {
1675 	usb_device_request_t req;
1676 
1677 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1678 	req.bRequest = URTW_8187_SETREGS_REQ;
1679 	USETW(req.wValue, val | 0xff00);
1680 	USETW(req.wIndex, idx & 0x03);
1681 	USETW(req.wLength, sizeof(uint16_t));
1682 
1683 	return usbd_do_request(sc->sc_udev, &req, &data);
1684 }
1685 
1686 usbd_status
1687 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1688 {
1689 	usb_device_request_t req;
1690 
1691 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1692 	req.bRequest = URTW_8187_SETREGS_REQ;
1693 	USETW(req.wValue, val | 0xff00);
1694 	USETW(req.wIndex, idx & 0x03);
1695 	USETW(req.wLength, sizeof(uint32_t));
1696 
1697 	return usbd_do_request(sc->sc_udev, &req, &data);
1698 }
1699 
1700 static usbd_status
1701 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1702 {
1703 	uint8_t data;
1704 	usbd_status error;
1705 
1706 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1707 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1708 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1709 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1710 fail:
1711 	return error;
1712 }
1713 
1714 usbd_status
1715 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1716 {
1717 	uint8_t data;
1718 	usbd_status error;
1719 
1720 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1721 	if (error)
1722 		goto fail;
1723 
1724 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1725 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1726 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1727 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1728 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1729 
1730 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1731 	if (error)
1732 		goto fail;
1733 fail:
1734 	return error;
1735 }
1736 
1737 usbd_status
1738 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1739 {
1740 	uint8_t data;
1741 	usbd_status error;
1742 
1743 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1744 	if (error)
1745 		goto fail;
1746 
1747 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1748 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1749 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1750 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1751 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1752 
1753 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1754 	if (error)
1755 		goto fail;
1756 fail:
1757 	return error;
1758 }
1759 
1760 usbd_status
1761 urtw_intr_disable(struct urtw_softc *sc)
1762 {
1763 	usbd_status error;
1764 
1765 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1766 
1767 fail:
1768 	return error;
1769 }
1770 
1771 usbd_status
1772 urtw_reset(struct urtw_softc *sc)
1773 {
1774 	uint8_t data;
1775 	usbd_status error;
1776 
1777 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1778 	if (error)
1779 		goto fail;
1780 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1781 	if (error)
1782 		goto fail;
1783 
1784 	error = urtw_intr_disable(sc);
1785 	if (error)
1786 		goto fail;
1787 	usbd_delay_ms(sc->sc_udev, 100);
1788 
1789 	error = urtw_write8e(sc, 0x18, 0x10);
1790 	if (error != 0)
1791 		goto fail;
1792 	error = urtw_write8e(sc, 0x18, 0x11);
1793 	if (error != 0)
1794 		goto fail;
1795 	error = urtw_write8e(sc, 0x18, 0x00);
1796 	if (error != 0)
1797 		goto fail;
1798 	usbd_delay_ms(sc->sc_udev, 100);
1799 
1800 	urtw_read8_m(sc, URTW_CMD, &data);
1801 	data = (data & 2) | URTW_CMD_RST;
1802 	urtw_write8_m(sc, URTW_CMD, data);
1803 	usbd_delay_ms(sc->sc_udev, 100);
1804 
1805 	urtw_read8_m(sc, URTW_CMD, &data);
1806 	if (data & URTW_CMD_RST) {
1807 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
1808 		goto fail;
1809 	}
1810 
1811 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1812 	if (error)
1813 		goto fail;
1814 	usbd_delay_ms(sc->sc_udev, 100);
1815 
1816 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1817 	if (error)
1818 		goto fail;
1819 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1820 	if (error)
1821 		goto fail;
1822 fail:
1823 	return error;
1824 }
1825 
1826 usbd_status
1827 urtw_led_on(struct urtw_softc *sc, int type)
1828 {
1829 	usbd_status error;
1830 
1831 	if (type == URTW_LED_GPIO) {
1832 		switch (sc->sc_gpio_ledpin) {
1833 		case URTW_LED_PIN_GPIO0:
1834 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1835 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1836 			break;
1837 		default:
1838 			panic("unsupported LED PIN type 0x%x",
1839 			    sc->sc_gpio_ledpin);
1840 			/* NOTREACHED */
1841 		}
1842 	} else {
1843 		panic("unsupported LED type 0x%x", type);
1844 		/* NOTREACHED */
1845 	}
1846 
1847 	sc->sc_gpio_ledon = 1;
1848 fail:
1849 	return error;
1850 }
1851 
1852 static usbd_status
1853 urtw_led_off(struct urtw_softc *sc, int type)
1854 {
1855 	usbd_status error;
1856 
1857 	if (type == URTW_LED_GPIO) {
1858 		switch (sc->sc_gpio_ledpin) {
1859 		case URTW_LED_PIN_GPIO0:
1860 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1861 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1862 			break;
1863 		default:
1864 			panic("unsupported LED PIN type 0x%x",
1865 			    sc->sc_gpio_ledpin);
1866 			/* NOTREACHED */
1867 		}
1868 	} else {
1869 		panic("unsupported LED type 0x%x", type);
1870 		/* NOTREACHED */
1871 	}
1872 
1873 	sc->sc_gpio_ledon = 0;
1874 
1875 fail:
1876 	return error;
1877 }
1878 
1879 usbd_status
1880 urtw_led_mode0(struct urtw_softc *sc, int mode)
1881 {
1882 	switch (mode) {
1883 	case URTW_LED_CTL_POWER_ON:
1884 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1885 		break;
1886 	case URTW_LED_CTL_TX:
1887 		if (sc->sc_gpio_ledinprogress == 1)
1888 			return 0;
1889 
1890 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1891 		sc->sc_gpio_blinktime = 2;
1892 		break;
1893 	case URTW_LED_CTL_LINK:
1894 		sc->sc_gpio_ledstate = URTW_LED_ON;
1895 		break;
1896 	default:
1897 		panic("unsupported LED mode 0x%x", mode);
1898 		/* NOTREACHED */
1899 	}
1900 
1901 	switch (sc->sc_gpio_ledstate) {
1902 	case URTW_LED_ON:
1903 		if (sc->sc_gpio_ledinprogress != 0)
1904 			break;
1905 		urtw_led_on(sc, URTW_LED_GPIO);
1906 		break;
1907 	case URTW_LED_BLINK_NORMAL:
1908 		if (sc->sc_gpio_ledinprogress != 0)
1909 			break;
1910 		sc->sc_gpio_ledinprogress = 1;
1911 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1912 			URTW_LED_OFF : URTW_LED_ON;
1913 		if (!sc->sc_dying)
1914 			callout_schedule(&sc->sc_led_ch, mstohz(100));
1915 		break;
1916 	case URTW_LED_POWER_ON_BLINK:
1917 		urtw_led_on(sc, URTW_LED_GPIO);
1918 		usbd_delay_ms(sc->sc_udev, 100);
1919 		urtw_led_off(sc, URTW_LED_GPIO);
1920 		break;
1921 	default:
1922 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1923 		/* NOTREACHED */
1924 	}
1925 	return 0;
1926 }
1927 
1928 usbd_status
1929 urtw_led_mode1(struct urtw_softc *sc, int mode)
1930 {
1931 	return USBD_INVAL;
1932 }
1933 
1934 usbd_status
1935 urtw_led_mode2(struct urtw_softc *sc, int mode)
1936 {
1937 	return USBD_INVAL;
1938 }
1939 
1940 usbd_status
1941 urtw_led_mode3(struct urtw_softc *sc, int mode)
1942 {
1943 	return USBD_INVAL;
1944 }
1945 
1946 void
1947 urtw_ledusbtask(void *arg)
1948 {
1949 	struct urtw_softc *sc = arg;
1950 
1951 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1952 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1953 
1954 	urtw_led_blink(sc);
1955 }
1956 
1957 void
1958 urtw_ledtask(void *arg)
1959 {
1960 	struct urtw_softc *sc = arg;
1961 
1962 	/*
1963 	 * NB: to change a status of the led we need at least a sleep so we
1964 	 * can't do it here
1965 	 */
1966 	usb_add_task(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER);
1967 }
1968 
1969 usbd_status
1970 urtw_led_ctl(struct urtw_softc *sc, int mode)
1971 {
1972 	usbd_status error = 0;
1973 
1974 	switch (sc->sc_strategy) {
1975 	case URTW_SW_LED_MODE0:
1976 		error = urtw_led_mode0(sc, mode);
1977 		break;
1978 	case URTW_SW_LED_MODE1:
1979 		error = urtw_led_mode1(sc, mode);
1980 		break;
1981 	case URTW_SW_LED_MODE2:
1982 		error = urtw_led_mode2(sc, mode);
1983 		break;
1984 	case URTW_SW_LED_MODE3:
1985 		error = urtw_led_mode3(sc, mode);
1986 		break;
1987 	default:
1988 		panic("unsupported LED mode %d", sc->sc_strategy);
1989 		/* NOTREACHED */
1990 	}
1991 
1992 	return error;
1993 }
1994 
1995 usbd_status
1996 urtw_led_blink(struct urtw_softc *sc)
1997 {
1998 	uint8_t ing = 0;
1999 
2000 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
2001 		(void)urtw_led_on(sc, URTW_LED_GPIO);
2002 	else
2003 		(void)urtw_led_off(sc, URTW_LED_GPIO);
2004 	sc->sc_gpio_blinktime--;
2005 	if (sc->sc_gpio_blinktime == 0)
2006 		ing = 1;
2007 	else {
2008 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
2009 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
2010 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
2011 			ing = 1;
2012 	}
2013 	if (ing == 1) {
2014 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2015 		    sc->sc_gpio_ledon == 0)
2016 			(void)urtw_led_on(sc, URTW_LED_GPIO);
2017 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2018 		    sc->sc_gpio_ledon == 1)
2019 			(void)urtw_led_off(sc, URTW_LED_GPIO);
2020 
2021 		sc->sc_gpio_blinktime = 0;
2022 		sc->sc_gpio_ledinprogress = 0;
2023 		return 0;
2024 	}
2025 
2026 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2027 	    URTW_LED_ON : URTW_LED_OFF;
2028 
2029 	switch (sc->sc_gpio_ledstate) {
2030 	case URTW_LED_BLINK_NORMAL:
2031 		if (!sc->sc_dying)
2032 			callout_schedule(&sc->sc_led_ch, mstohz(100));
2033 		break;
2034 	default:
2035 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2036 		/* NOTREACHED */
2037 	}
2038 	return 0;
2039 }
2040 
2041 usbd_status
2042 urtw_update_msr(struct urtw_softc *sc)
2043 {
2044 	struct ieee80211com *ic = &sc->sc_ic;
2045 	uint8_t data;
2046 	usbd_status error;
2047 
2048 	urtw_read8_m(sc, URTW_MSR, &data);
2049 	data &= ~URTW_MSR_LINK_MASK;
2050 
2051 	/* Should always be set. */
2052 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2053 		data |= URTW_MSR_LINK_ENEDCA;
2054 
2055 	if (sc->sc_state == IEEE80211_S_RUN) {
2056 		switch (ic->ic_opmode) {
2057 		case IEEE80211_M_STA:
2058 		case IEEE80211_M_MONITOR:
2059 			data |= URTW_MSR_LINK_STA;
2060 			break;
2061 		default:
2062 			panic("unsupported operation mode 0x%x",
2063 			    ic->ic_opmode);
2064 			/* NOTREACHED */
2065 		}
2066 	} else
2067 		data |= URTW_MSR_LINK_NONE;
2068 
2069 	urtw_write8_m(sc, URTW_MSR, data);
2070 fail:
2071 	return error;
2072 }
2073 
2074 uint16_t
2075 urtw_rate2rtl(int rate)
2076 {
2077 	unsigned int i;
2078 
2079 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2080 		if (rate == urtw_ratetable[i].reg)
2081 			return urtw_ratetable[i].val;
2082 	}
2083 
2084 	return 3;
2085 }
2086 
2087 uint16_t
2088 urtw_rtl2rate(int rate)
2089 {
2090 	unsigned int i;
2091 
2092 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2093 		if (rate == urtw_ratetable[i].val)
2094 			return urtw_ratetable[i].reg;
2095 	}
2096 
2097 	return 0;
2098 }
2099 
2100 usbd_status
2101 urtw_set_rate(struct urtw_softc *sc)
2102 {
2103 	int i, basic_rate, min_rr_rate, max_rr_rate;
2104 	uint16_t data;
2105 	usbd_status error;
2106 
2107 	basic_rate = urtw_rate2rtl(48);
2108 	min_rr_rate = urtw_rate2rtl(12);
2109 	max_rr_rate = urtw_rate2rtl(48);
2110 
2111 	urtw_write8_m(sc, URTW_RESP_RATE,
2112 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2113 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2114 
2115 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2116 	data &= ~URTW_BRSR_MBR_8185;
2117 
2118 	for (i = 0; i <= basic_rate; i++)
2119 		data |= (1 << i);
2120 
2121 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2122 fail:
2123 	return error;
2124 }
2125 
2126 usbd_status
2127 urtw_intr_enable(struct urtw_softc *sc)
2128 {
2129 	usbd_status error;
2130 
2131 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2132 fail:
2133 	return error;
2134 }
2135 
2136 usbd_status
2137 urtw_rx_setconf(struct urtw_softc *sc)
2138 {
2139 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2140 	struct ieee80211com *ic = &sc->sc_ic;
2141 	uint32_t data;
2142 	usbd_status error;
2143 
2144 	urtw_read32_m(sc, URTW_RX, &data);
2145 	data = data &~ URTW_RX_FILTER_MASK;
2146 #if 0
2147 	data = data | URTW_RX_FILTER_CTL;
2148 #endif
2149 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2150 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2151 
2152 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2153 		data = data | URTW_RX_FILTER_ICVERR;
2154 		data = data | URTW_RX_FILTER_PWR;
2155 	}
2156 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2157 		data = data | URTW_RX_FILTER_CRCERR;
2158 
2159 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2160 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2161 		data = data | URTW_RX_FILTER_ALLMAC;
2162 	} else {
2163 		data = data | URTW_RX_FILTER_NICMAC;
2164 		data = data | URTW_RX_CHECK_BSSID;
2165 	}
2166 
2167 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2168 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2169 	data = data &~ URTW_MAX_RX_DMA_MASK;
2170 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2171 
2172 	urtw_write32_m(sc, URTW_RX, data);
2173 fail:
2174 	return error;
2175 }
2176 
2177 usbd_status
2178 urtw_rx_enable(struct urtw_softc *sc)
2179 {
2180 	int i;
2181 	struct urtw_rx_data *rx_data;
2182 	uint8_t data;
2183 	usbd_status error;
2184 
2185 	/*
2186 	 * Start up the receive pipe.
2187 	 */
2188 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2189 		rx_data = &sc->sc_rx_data[i];
2190 
2191 		usbd_setup_xfer(rx_data->xfer, rx_data, rx_data->buf, MCLBYTES,
2192 		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2193 		error = usbd_transfer(rx_data->xfer);
2194 		if (error != USBD_IN_PROGRESS && error != 0) {
2195 			printf("%s: could not queue Rx transfer\n",
2196 			    device_xname(sc->sc_dev));
2197 			goto fail;
2198 		}
2199 	}
2200 
2201 	error = urtw_rx_setconf(sc);
2202 	if (error != 0)
2203 		goto fail;
2204 
2205 	urtw_read8_m(sc, URTW_CMD, &data);
2206 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2207 fail:
2208 	return error;
2209 }
2210 
2211 usbd_status
2212 urtw_tx_enable(struct urtw_softc *sc)
2213 {
2214 	uint8_t data8;
2215 	uint32_t data;
2216 	usbd_status error;
2217 
2218 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2219 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2220 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2221 		    URTW_CW_CONF_PERPACKET_RETRY);
2222 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2223 
2224 		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2225 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2226 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2227 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2228 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2229 
2230 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2231 		data &= ~URTW_TX_LOOPBACK_MASK;
2232 		data |= URTW_TX_LOOPBACK_NONE;
2233 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2234 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2235 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2236 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2237 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2238 		data &= ~URTW_TX_SWPLCPLEN;
2239 		data |= URTW_TX_NOICV;
2240 		urtw_write32_m(sc, URTW_TX_CONF, data);
2241 	} else {
2242 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2243 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2244 		    URTW_TX_LONGRETRY;
2245 		urtw_write32_m(sc, URTW_TX_CONF, data);
2246 	}
2247 
2248 	urtw_read8_m(sc, URTW_CMD, &data8);
2249 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2250 fail:
2251 	return error;
2252 }
2253 
2254 int
2255 urtw_init(struct ifnet *ifp)
2256 {
2257 	struct urtw_softc *sc = ifp->if_softc;
2258 	struct urtw_rf *rf = &sc->sc_rf;
2259 	struct ieee80211com *ic = &sc->sc_ic;
2260 	usbd_status error;
2261 
2262 	urtw_stop(ifp, 0);
2263 
2264 	error = urtw_reset(sc);
2265 	if (error)
2266 		goto fail;
2267 
2268 	urtw_write8_m(sc, 0x85, 0);
2269 	urtw_write8_m(sc, URTW_GPIO, 0);
2270 
2271 	/* for led */
2272 	urtw_write8_m(sc, 0x85, 4);
2273 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2274 	if (error != 0)
2275 		goto fail;
2276 
2277 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2278 	if (error)
2279 		goto fail;
2280 
2281 	/* applying MAC address again. */
2282 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2283 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2284 	if (error)
2285 		goto fail;
2286 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2287 	if (error)
2288 		goto fail;
2289 
2290 	error = urtw_update_msr(sc);
2291 	if (error)
2292 		goto fail;
2293 
2294 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2295 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2296 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2297 	error = urtw_set_rate(sc);
2298 	if (error != 0)
2299 		goto fail;
2300 
2301 	error = rf->init(rf);
2302 	if (error != 0)
2303 		goto fail;
2304 	if (rf->set_sens != NULL)
2305 		rf->set_sens(rf);
2306 
2307 	urtw_write16_m(sc, 0x5e, 1);
2308 	urtw_write16_m(sc, 0xfe, 0x10);
2309 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2310 	urtw_write8_m(sc, 0xff, 0x60);
2311 	urtw_write16_m(sc, 0x5e, 0);
2312 	urtw_write8_m(sc, 0x85, 4);
2313 
2314 	error = urtw_intr_enable(sc);
2315 	if (error != 0)
2316 		goto fail;
2317 
2318 	/* reset softc variables */
2319 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
2320 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
2321 	}
2322 	sc->sc_txtimer = 0;
2323 
2324 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2325 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2326 		if (error != 0) {
2327 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
2328 			    ", err=%s\n", usbd_errstr(error));
2329 			goto fail;
2330 		}
2331 		/* get the first interface handle */
2332 		error = usbd_device2interface_handle(sc->sc_udev,
2333 		    URTW_IFACE_INDEX, &sc->sc_iface);
2334 		if (error != 0) {
2335 			printf("%s: could not get interface handle\n",
2336 			    device_xname(sc->sc_dev));
2337 			goto fail;
2338 		}
2339 		error = urtw_open_pipes(sc);
2340 		if (error != 0)
2341 			goto fail;
2342 		error = urtw_alloc_rx_data_list(sc);
2343 		if (error != 0)
2344 			goto fail;
2345 		error = urtw_alloc_tx_data_list(sc);
2346 		if (error != 0)
2347 			goto fail;
2348 		sc->sc_flags |= URTW_INIT_ONCE;
2349 	}
2350 
2351 	error = urtw_rx_enable(sc);
2352 	if (error != 0)
2353 		goto fail;
2354 	error = urtw_tx_enable(sc);
2355 	if (error != 0)
2356 		goto fail;
2357 
2358 	ifp->if_flags &= ~IFF_OACTIVE;
2359 	ifp->if_flags |= IFF_RUNNING;
2360 
2361 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2362 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2363 	else
2364 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2365 
2366 	return 0;
2367 fail:
2368 	return error;
2369 }
2370 
2371 int
2372 urtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2373 {
2374 #define IS_RUNNING(ifp) \
2375 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
2376 
2377 	struct urtw_softc *sc = ifp->if_softc;
2378 	struct ieee80211com *ic = &sc->sc_ic;
2379 	int s, error = 0;
2380 
2381 	if (sc->sc_dying)
2382 		return ENXIO;
2383 
2384 	s = splnet();
2385 
2386 	switch (cmd) {
2387 	case SIOCSIFFLAGS:
2388 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2389 			break;
2390 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2391 		case IFF_UP|IFF_RUNNING:
2392 			break;
2393 		case IFF_UP:
2394 			ifp->if_init(ifp);
2395 			break;
2396 		case IFF_RUNNING:
2397 			urtw_stop(ifp, 1);
2398 			break;
2399 		case 0:
2400 			break;
2401 		}
2402 		break;
2403 
2404 	case SIOCADDMULTI:
2405 	case SIOCDELMULTI:
2406 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
2407 			error = 0;
2408 		break;
2409 
2410 	default:
2411 		error = ieee80211_ioctl(ic, cmd, data);
2412 		break;
2413 	}
2414 
2415 	if (error == ENETRESET) {
2416 		if (IS_RUNNING(ifp) &&
2417 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2418 			ifp->if_init(ifp);
2419 		error = 0;
2420 	}
2421 
2422 	splx(s);
2423 
2424 	return error;
2425 #undef IS_RUNNING
2426 }
2427 
2428 void
2429 urtw_start(struct ifnet *ifp)
2430 {
2431 	struct urtw_softc *sc = ifp->if_softc;
2432 	struct ieee80211com *ic = &sc->sc_ic;
2433 	struct ieee80211_node *ni;
2434 	struct ether_header *eh;
2435 	struct mbuf *m0;
2436 
2437 	/*
2438 	 * net80211 may still try to send management frames even if the
2439 	 * IFF_RUNNING flag is not set...
2440 	 */
2441 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2442 		return;
2443 
2444 	for (;;) {
2445 		IF_POLL(&ic->ic_mgtq, m0);
2446 		if (m0 != NULL) {
2447 
2448 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2449 			    URTW_TX_DATA_LIST_COUNT) {
2450 				ifp->if_flags |= IFF_OACTIVE;
2451 				break;
2452 			}
2453 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2454 			ni = M_GETCTX(m0, struct ieee80211_node *);
2455 			M_CLEARCTX(m0);
2456 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2457 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2458 			    != 0)
2459 				break;
2460 		} else {
2461 			if (ic->ic_state != IEEE80211_S_RUN)
2462 				break;
2463 			IFQ_POLL(&ifp->if_snd, m0);
2464 			if (m0 == NULL)
2465 				break;
2466 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2467 			    URTW_TX_DATA_LIST_COUNT) {
2468 				ifp->if_flags |= IFF_OACTIVE;
2469 				break;
2470 			}
2471 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2472 			if (m0->m_len < sizeof(struct ether_header) &&
2473 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
2474 				continue;
2475 
2476 			eh = mtod(m0, struct ether_header *);
2477 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2478 			if (ni == NULL) {
2479 				m_freem(m0);
2480 				continue;
2481 			}
2482 			bpf_mtap(ifp, m0, BPF_D_OUT);
2483 			m0 = ieee80211_encap(ic, m0, ni);
2484 			if (m0 == NULL) {
2485 				ieee80211_free_node(ni);
2486 				continue;
2487 			}
2488 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2489 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2490 			    != 0) {
2491 				ieee80211_free_node(ni);
2492 				ifp->if_oerrors++;
2493 				break;
2494 			}
2495 		}
2496 		sc->sc_txtimer = 5;
2497 		ifp->if_timer = 1;
2498 	}
2499 }
2500 
2501 void
2502 urtw_watchdog(struct ifnet *ifp)
2503 {
2504 	struct urtw_softc *sc = ifp->if_softc;
2505 
2506 	ifp->if_timer = 0;
2507 
2508 	if (sc->sc_txtimer > 0) {
2509 		if (--sc->sc_txtimer == 0) {
2510 			printf("%s: device timeout\n", device_xname(sc->sc_dev));
2511 			ifp->if_oerrors++;
2512 			return;
2513 		}
2514 		ifp->if_timer = 1;
2515 	}
2516 
2517 	ieee80211_watchdog(&sc->sc_ic);
2518 }
2519 
2520 void
2521 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2522     usbd_status status)
2523 {
2524 	struct urtw_tx_data *data = priv;
2525 	struct urtw_softc *sc = data->sc;
2526 	struct ieee80211com *ic = &sc->sc_ic;
2527 	struct ifnet *ifp = ic->ic_ifp;
2528 	int s;
2529 
2530 	if (status != USBD_NORMAL_COMPLETION) {
2531 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2532 			return;
2533 
2534 		printf("%s: could not transmit buffer: %s\n",
2535 		    device_xname(sc->sc_dev), usbd_errstr(status));
2536 
2537 		if (status == USBD_STALLED)
2538 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2539 
2540 		ifp->if_oerrors++;
2541 		return;
2542 	}
2543 
2544 	s = splnet();
2545 
2546 	ieee80211_free_node(data->ni);
2547 	data->ni = NULL;
2548 
2549 	sc->sc_txtimer = 0;
2550 	ifp->if_opackets++;
2551 
2552 	sc->sc_tx_queued[URTW_PRIORITY_LOW]--;
2553 	ifp->if_flags &= ~IFF_OACTIVE;
2554 	urtw_start(ifp);
2555 
2556 	splx(s);
2557 }
2558 
2559 void
2560 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2561     usbd_status status)
2562 {
2563 	struct urtw_tx_data *data = priv;
2564 	struct urtw_softc *sc = data->sc;
2565 	struct ieee80211com *ic = &sc->sc_ic;
2566 	struct ifnet *ifp = ic->ic_ifp;
2567 	int s;
2568 
2569 	if (status != USBD_NORMAL_COMPLETION) {
2570 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2571 			return;
2572 
2573 		printf("%s: could not transmit buffer: %s\n",
2574 		    device_xname(sc->sc_dev), usbd_errstr(status));
2575 
2576 		if (status == USBD_STALLED)
2577 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2578 
2579 		ifp->if_oerrors++;
2580 		return;
2581 	}
2582 
2583 	s = splnet();
2584 
2585 	ieee80211_free_node(data->ni);
2586 	data->ni = NULL;
2587 
2588 	sc->sc_txtimer = 0;
2589 	ifp->if_opackets++;
2590 
2591 	sc->sc_tx_queued[URTW_PRIORITY_NORMAL]--;
2592 	ifp->if_flags &= ~IFF_OACTIVE;
2593 	urtw_start(ifp);
2594 
2595 	splx(s);
2596 }
2597 
2598 int
2599 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2600     int prior)
2601 {
2602 	struct ieee80211com *ic = &sc->sc_ic;
2603 	struct urtw_tx_data *data;
2604 	struct ieee80211_frame *wh;
2605 	struct ieee80211_key *k;
2606 	usbd_status error;
2607 	int xferlen;
2608 
2609 	wh = mtod(m0, struct ieee80211_frame *);
2610 
2611 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2612 		k = ieee80211_crypto_encap(ic, ni, m0);
2613 		if (k == NULL) {
2614 			m_freem(m0);
2615 			return ENOBUFS;
2616 		}
2617 		/* packet header may have moved, reset our local pointer */
2618 		wh = mtod(m0, struct ieee80211_frame *);
2619 	}
2620 
2621 	if (sc->sc_drvbpf != NULL) {
2622 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2623 
2624 		tap->wt_flags = 0;
2625 		tap->wt_rate = 0;
2626 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2627 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2628 
2629 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
2630 	}
2631 
2632 	if (sc->sc_hwrev & URTW_HWREV_8187)
2633 		xferlen = m0->m_pkthdr.len + 4 * 3;
2634 	else
2635 		xferlen = m0->m_pkthdr.len + 4 * 8;
2636 
2637 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2638 		xferlen += 1;
2639 
2640 	data = &sc->sc_tx_data[prior][sc->sc_txidx[prior]];
2641 	sc->sc_txidx[prior] =
2642 	    (sc->sc_txidx[prior] + 1) % URTW_TX_DATA_LIST_COUNT;
2643 
2644 	memset(data->buf, 0, URTW_TX_MAXSIZE);
2645 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2646 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2647 	data->buf[1] |= (1 << 7);
2648 
2649 	/* XXX sc_preamble_mode is always 2. */
2650 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2651 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2652 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2653 		data->buf[2] |= 1;
2654 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2655 	    prior == URTW_PRIORITY_LOW)
2656 		panic("TODO tx.");
2657 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2658 		data->buf[2] |= (1 << 1);
2659 	/* RTS rate - 10 means we use a basic rate. */
2660 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2661 	/*
2662 	 * XXX currently TX rate control depends on the rate value of
2663 	 * RX descriptor because I don't know how to we can control TX rate
2664 	 * in more smart way.  Please fix me you find a thing.
2665 	 */
2666 	data->buf[3] = sc->sc_currate;
2667 	if (prior == URTW_PRIORITY_NORMAL) {
2668 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2669 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2670 		else if (ic->ic_fixed_rate != -1)
2671 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2672 	}
2673 
2674 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2675 		data->buf[8] = 3;		/* CW minimum */
2676 		data->buf[8] |= (7 << 4);	/* CW maximum */
2677 		data->buf[9] |= 11;		/* retry limitation */
2678 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2679 	} else {
2680 		data->buf[21] |= 11;		/* retry limitation */
2681 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2682 	}
2683 
2684 	data->ni = ni;
2685 
2686 	/* mbuf is no longer needed. */
2687 	m_freem(m0);
2688 
2689 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2690 	    USBD_FORCE_SHORT_XFER, URTW_DATA_TIMEOUT,
2691 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2692 	error = usbd_transfer(data->xfer);
2693 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2694 		printf("%s: could not send frame: %s\n",
2695 		    device_xname(sc->sc_dev), usbd_errstr(error));
2696 		return EIO;
2697 	}
2698 
2699 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2700 	if (error != 0)
2701 		printf("%s: could not control LED (%d)\n",
2702 		    device_xname(sc->sc_dev), error);
2703 
2704 	sc->sc_tx_queued[prior]++;
2705 
2706 	return 0;
2707 }
2708 
2709 usbd_status
2710 urtw_8225_usb_init(struct urtw_softc *sc)
2711 {
2712 	uint8_t data;
2713 	usbd_status error;
2714 
2715 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2716 	urtw_write8_m(sc, URTW_GPIO, 0);
2717 	error = urtw_read8e(sc, 0x53, &data);
2718 	if (error)
2719 		goto fail;
2720 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2721 	if (error)
2722 		goto fail;
2723 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2724 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2725 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2726 
2727 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2728 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2729 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2730 
2731 	usbd_delay_ms(sc->sc_udev, 500);
2732 fail:
2733 	return error;
2734 }
2735 
2736 usbd_status
2737 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2738 {
2739 	usbd_status error = 0;
2740 
2741 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2742 fail:
2743 	return error;
2744 }
2745 
2746 usbd_status
2747 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2748 {
2749 	uint32_t phyw;
2750 	usbd_status error;
2751 
2752 	phyw = ((data << 8) | (addr | 0x80));
2753 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2754 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2755 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2756 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2757 	/*
2758 	 * Delay removed from 8185 to 8187.
2759 	 * usbd_delay_ms(sc->sc_udev, 1);
2760 	 */
2761 fail:
2762 	return error;
2763 }
2764 
2765 usbd_status
2766 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2767 {
2768 	data = data & 0xff;
2769 	return urtw_8187_write_phy(sc, addr, data);
2770 }
2771 
2772 usbd_status
2773 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2774 {
2775 	data = data & 0xff;
2776 	return urtw_8187_write_phy(sc, addr, data | 0x10000);
2777 }
2778 
2779 usbd_status
2780 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2781 {
2782 	usbd_status error;
2783 
2784 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2785 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2786 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2787 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2788 fail:
2789 	return error;
2790 }
2791 
2792 usbd_status
2793 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2794 {
2795 	int i, idx, set;
2796 	uint8_t *cck_pwltable;
2797 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2798 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2799 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2800 	usbd_status error;
2801 
2802 	cck_pwrlvl_max = 11;
2803 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2804 	ofdm_pwrlvl_min = 10;
2805 
2806 	/* CCK power setting */
2807 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2808 	idx = cck_pwrlvl % 6;
2809 	set = cck_pwrlvl / 6;
2810 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2811 	    urtw_8225_txpwr_cck;
2812 
2813 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2814 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2815 	for (i = 0; i < 8; i++) {
2816 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2817 		    cck_pwltable[idx * 8 + i]);
2818 	}
2819 	usbd_delay_ms(sc->sc_udev, 1);
2820 
2821 	/* OFDM power setting */
2822 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2823 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2824 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2825 
2826 	idx = ofdm_pwrlvl % 6;
2827 	set = ofdm_pwrlvl / 6;
2828 
2829 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2830 	if (error)
2831 		goto fail;
2832 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2833 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2834 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2835 
2836 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2837 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2838 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2839 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2840 	usbd_delay_ms(sc->sc_udev, 1);
2841 fail:
2842 	return error;
2843 }
2844 
2845 usbd_status
2846 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2847 {
2848 	usbd_status error;
2849 
2850 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2851 	usbd_delay_ms(sc->sc_udev, 1);
2852 fail:
2853 	return error;
2854 }
2855 
2856 usbd_status
2857 urtw_8225_rf_init(struct urtw_rf *rf)
2858 {
2859 	struct urtw_softc *sc = rf->rf_sc;
2860 	unsigned int i;
2861 	uint16_t data;
2862 	usbd_status error;
2863 
2864 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2865 	if (error)
2866 		goto fail;
2867 
2868 	error = urtw_8225_usb_init(sc);
2869 	if (error)
2870 		goto fail;
2871 
2872 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2873 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2874 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2875 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2876 
2877 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2878 	if (error)
2879 		goto fail;
2880 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2881 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2882 	if (error)
2883 		goto fail;
2884 
2885 	error = urtw_8185_rf_pins_enable(sc);
2886 	if (error)
2887 		goto fail;
2888 
2889 	usbd_delay_ms(sc->sc_udev, 500);
2890 
2891 	for (i = 0; i < __arraycount(urtw_8225_rf_part1); i++) {
2892 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2893 		    urtw_8225_rf_part1[i].val);
2894 	}
2895 	usbd_delay_ms(sc->sc_udev, 50);
2896 	urtw_8225_write(sc, 0x2, 0xc4d);
2897 	usbd_delay_ms(sc->sc_udev, 200);
2898 	urtw_8225_write(sc, 0x2, 0x44d);
2899 	usbd_delay_ms(sc->sc_udev, 200);
2900 	urtw_8225_write(sc, 0x0, 0x127);
2901 
2902 	for (i = 0; i < __arraycount(urtw_8225_rxgain); i++) {
2903 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2904 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2905 	}
2906 
2907 	urtw_8225_write(sc, 0x0, 0x27);
2908 	urtw_8225_write(sc, 0x0, 0x22f);
2909 
2910 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
2911 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2912 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2913 	}
2914 
2915 	for (i = 0; i < __arraycount(urtw_8225_rf_part2); i++) {
2916 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2917 		    urtw_8225_rf_part2[i].val);
2918 		usbd_delay_ms(sc->sc_udev, 1);
2919 	}
2920 
2921 	error = urtw_8225_setgain(sc, 4);
2922 	if (error)
2923 		goto fail;
2924 
2925 	for (i = 0; i < __arraycount(urtw_8225_rf_part3); i++) {
2926 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2927 		    urtw_8225_rf_part3[i].val);
2928 		usbd_delay_ms(sc->sc_udev, 1);
2929 	}
2930 
2931 	urtw_write8_m(sc, 0x5b, 0x0d);
2932 
2933 	error = urtw_8225_set_txpwrlvl(sc, 1);
2934 	if (error)
2935 		goto fail;
2936 
2937 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2938 	usbd_delay_ms(sc->sc_udev, 1);
2939 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2940 	usbd_delay_ms(sc->sc_udev, 1);
2941 
2942 	/* TX ant A, 0x0 for B */
2943 	error = urtw_8185_tx_antenna(sc, 0x3);
2944 	if (error)
2945 		goto fail;
2946 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2947 
2948 	error = urtw_8225_rf_set_chan(rf, 1);
2949 fail:
2950 	return error;
2951 }
2952 
2953 usbd_status
2954 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2955 {
2956 	struct urtw_softc *sc = rf->rf_sc;
2957 	struct ieee80211com *ic = &sc->sc_ic;
2958 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2959 	usbd_status error;
2960 
2961 	error = urtw_8225_set_txpwrlvl(sc, chan);
2962 	if (error)
2963 		goto fail;
2964 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2965 	usbd_delay_ms(sc->sc_udev, 10);
2966 
2967 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2968 
2969 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2970 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2971 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2972 	else
2973 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2974 
2975 	if (IEEE80211_IS_CHAN_G(c)) {
2976 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2977 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
2978 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2979 	} else {
2980 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2981 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
2982 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2983 	}
2984 
2985 fail:
2986 	return error;
2987 }
2988 
2989 usbd_status
2990 urtw_8225_rf_set_sens(struct urtw_rf *rf)
2991 {
2992 	struct urtw_softc *sc = rf->rf_sc;
2993 	usbd_status error;
2994 
2995 	if (rf->sens > 6)
2996 		return -1;
2997 
2998 	if (rf->sens > 4)
2999 		urtw_8225_write(sc, 0x0c, 0x850);
3000 	else
3001 		urtw_8225_write(sc, 0x0c, 0x50);
3002 
3003 	rf->sens = 6 - rf->sens;
3004 	error = urtw_8225_setgain(sc, rf->sens);
3005 	if (error)
3006 		goto fail;
3007 
3008 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3009 
3010 fail:
3011 	return error;
3012 }
3013 
3014 void
3015 urtw_stop(struct ifnet *ifp, int disable)
3016 {
3017 	struct urtw_softc *sc = ifp->if_softc;
3018 	struct ieee80211com *ic = &sc->sc_ic;
3019 	uint8_t data;
3020 	usbd_status error;
3021 
3022 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3023 
3024 	sc->sc_txtimer = 0;
3025 	ifp->if_timer = 0;
3026 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3027 
3028 	callout_stop(&sc->scan_to);
3029 	callout_stop(&sc->sc_led_ch);
3030 
3031 	urtw_intr_disable(sc);
3032 	urtw_read8_m(sc, URTW_CMD, &data);
3033 	data &= ~URTW_CMD_TX_ENABLE;
3034 	data &= ~URTW_CMD_RX_ENABLE;
3035 	urtw_write8_m(sc, URTW_CMD, data);
3036 
3037 	if (sc->sc_rxpipe != NULL)
3038 		usbd_abort_pipe(sc->sc_rxpipe);
3039 	if (sc->sc_txpipe_low != NULL)
3040 		usbd_abort_pipe(sc->sc_txpipe_low);
3041 	if (sc->sc_txpipe_normal != NULL)
3042 		usbd_abort_pipe(sc->sc_txpipe_normal);
3043 
3044 fail:
3045 	return;
3046 }
3047 
3048 int
3049 urtw_isbmode(uint16_t rate)
3050 {
3051 	rate = urtw_rtl2rate(rate);
3052 
3053 	return ((rate <= 22 && rate != 12 && rate != 18) ||
3054 	    rate == 44) ? 1 : 0;
3055 }
3056 
3057 void
3058 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3059 {
3060 	struct urtw_rx_data *data = priv;
3061 	struct urtw_softc *sc = data->sc;
3062 	struct ieee80211com *ic = &sc->sc_ic;
3063 	struct ifnet *ifp = ic->ic_ifp;
3064 	struct ieee80211_frame *wh;
3065 	struct ieee80211_node *ni;
3066 	struct mbuf *m, *mnew;
3067 	uint8_t *desc, quality, rate;
3068 	int actlen, flen, len, rssi, s;
3069 
3070 	if (status != USBD_NORMAL_COMPLETION) {
3071 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3072 			return;
3073 
3074 		if (status == USBD_STALLED)
3075 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3076 		ifp->if_ierrors++;
3077 		goto skip;
3078 	}
3079 
3080 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3081 	if (actlen < URTW_MIN_RXBUFSZ) {
3082 		ifp->if_ierrors++;
3083 		goto skip;
3084 	}
3085 
3086 	if (sc->sc_hwrev & URTW_HWREV_8187)
3087 		/* 4 dword and 4 byte CRC */
3088 		len = actlen - (4 * 4);
3089 	else
3090 		/* 5 dword and 4 byte CRC */
3091 		len = actlen - (4 * 5);
3092 
3093 	desc = data->buf + len;
3094 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3095 	if (flen > actlen) {
3096 		ifp->if_ierrors++;
3097 		goto skip;
3098 	}
3099 
3100 	rate = (desc[2] & 0xf0) >> 4;
3101 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3102 		quality = desc[4] & 0xff;
3103 		rssi = (desc[6] & 0xfe) >> 1;
3104 
3105 		/* XXX correct? */
3106 		if (!urtw_isbmode(rate)) {
3107 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3108 			rssi = ((90 - rssi) * 100) / 65;
3109 		} else {
3110 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3111 			rssi = ((95 - rssi) * 100) / 65;
3112 		}
3113 	} else {
3114 		quality = desc[12];
3115 		rssi = 14 - desc[14] / 2;
3116 	}
3117 
3118 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3119 	if (mnew == NULL) {
3120 		printf("%s: could not allocate rx mbuf\n",
3121 		    device_xname(sc->sc_dev));
3122 		ifp->if_ierrors++;
3123 		goto skip;
3124 	}
3125 	MCLGET(mnew, M_DONTWAIT);
3126 	if (!(mnew->m_flags & M_EXT)) {
3127 		printf("%s: could not allocate rx mbuf cluster\n",
3128 		    device_xname(sc->sc_dev));
3129 		m_freem(mnew);
3130 		ifp->if_ierrors++;
3131 		goto skip;
3132 	}
3133 
3134 	m = data->m;
3135 	data->m = mnew;
3136 	data->buf = mtod(mnew, uint8_t *);
3137 
3138 	/* finalize mbuf */
3139 	m_set_rcvif(m, ifp);
3140 	m->m_pkthdr.len = m->m_len = flen - 4;
3141 
3142 	s = splnet();
3143 
3144 	if (sc->sc_drvbpf != NULL) {
3145 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3146 
3147 		/* XXX Are variables correct? */
3148 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3149 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3150 		tap->wr_dbm_antsignal = (int8_t)rssi;
3151 
3152 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
3153 	}
3154 	wh = mtod(m, struct ieee80211_frame *);
3155 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3156 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3157 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3158 
3159 	/* XXX correct? */
3160 	if (!urtw_isbmode(rate)) {
3161 		if (quality > 127)
3162 			quality = 0;
3163 		else if (quality < 27)
3164 			quality = 100;
3165 		else
3166 			quality = 127 - quality;
3167 	} else
3168 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3169 
3170 	/* send the frame to the 802.11 layer */
3171 	ieee80211_input(ic, m, ni, rssi, 0);
3172 
3173 	/* node is no longer needed */
3174 	ieee80211_free_node(ni);
3175 
3176 	splx(s);
3177 
3178 skip:	/* setup a new transfer */
3179 	usbd_setup_xfer(xfer, data, data->buf, MCLBYTES,
3180 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3181 	(void)usbd_transfer(xfer);
3182 }
3183 
3184 usbd_status
3185 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3186 {
3187 	uint8_t *gainp;
3188 	usbd_status error;
3189 
3190 	/* XXX for A? */
3191 	gainp = urtw_8225v2_gain_bg;
3192 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3193 	usbd_delay_ms(sc->sc_udev, 1);
3194 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3195 	usbd_delay_ms(sc->sc_udev, 1);
3196 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3197 	usbd_delay_ms(sc->sc_udev, 1);
3198 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3199 	usbd_delay_ms(sc->sc_udev, 1);
3200 fail:
3201 	return error;
3202 }
3203 
3204 usbd_status
3205 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3206 {
3207 	int i;
3208 	uint8_t *cck_pwrtable;
3209 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3210 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3211 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3212 	usbd_status error;
3213 
3214 	/* CCK power setting */
3215 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3216 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3217 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3218 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3219 	    urtw_8225v2_txpwr_cck;
3220 
3221 	for (i = 0; i < 8; i++) {
3222 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3223 	}
3224 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3225 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3226 	usbd_delay_ms(sc->sc_udev, 1);
3227 
3228 	/* OFDM power setting */
3229 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3230 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3231 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3232 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3233 
3234 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3235 	if (error)
3236 		goto fail;
3237 
3238 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3239 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3240 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3241 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3242 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3243 
3244 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3245 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3246 	usbd_delay_ms(sc->sc_udev, 1);
3247 fail:
3248 	return error;
3249 }
3250 
3251 usbd_status
3252 urtw_8225v2_rf_init(struct urtw_rf *rf)
3253 {
3254 	struct urtw_softc *sc = rf->rf_sc;
3255 	int i;
3256 	uint16_t data;
3257 	uint32_t data32;
3258 	usbd_status error;
3259 
3260 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3261 	if (error)
3262 		goto fail;
3263 
3264 	error = urtw_8225_usb_init(sc);
3265 	if (error)
3266 		goto fail;
3267 
3268 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3269 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3270 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3271 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3272 
3273 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3274 	if (error)
3275 		goto fail;
3276 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3277 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3278 	if (error)
3279 		goto fail;
3280 
3281 	error = urtw_8185_rf_pins_enable(sc);
3282 	if (error)
3283 		goto fail;
3284 
3285 	usbd_delay_ms(sc->sc_udev, 1000);
3286 
3287 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part1); i++) {
3288 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3289 		    urtw_8225v2_rf_part1[i].val);
3290 		usbd_delay_ms(sc->sc_udev, 1);
3291 	}
3292 	usbd_delay_ms(sc->sc_udev, 50);
3293 
3294 	urtw_8225_write(sc, 0x0, 0x1b7);
3295 
3296 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3297 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3298 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3299 	}
3300 
3301 	urtw_8225_write(sc, 0x3, 0x2);
3302 	urtw_8225_write(sc, 0x5, 0x4);
3303 	urtw_8225_write(sc, 0x0, 0xb7);
3304 	urtw_8225_write(sc, 0x2, 0xc4d);
3305 	usbd_delay_ms(sc->sc_udev, 100);
3306 	urtw_8225_write(sc, 0x2, 0x44d);
3307 	usbd_delay_ms(sc->sc_udev, 100);
3308 
3309 	error = urtw_8225_read(sc, 0x6, &data32);
3310 	if (error != 0)
3311 		goto fail;
3312 	if (data32 != 0xe6)
3313 		printf("%s: expect 0xe6!! (0x%x)\n", device_xname(sc->sc_dev),
3314 		    data32);
3315 	if (!(data32 & 0x80)) {
3316 		urtw_8225_write(sc, 0x02, 0x0c4d);
3317 		usbd_delay_ms(sc->sc_udev, 200);
3318 		urtw_8225_write(sc, 0x02, 0x044d);
3319 		usbd_delay_ms(sc->sc_udev, 100);
3320 		error = urtw_8225_read(sc, 0x6, &data32);
3321 		if (error != 0)
3322 			goto fail;
3323 		if (!(data32 & 0x80))
3324 			printf("%s: RF calibration failed\n",
3325 			    device_xname(sc->sc_dev));
3326 	}
3327 	usbd_delay_ms(sc->sc_udev, 100);
3328 
3329 	urtw_8225_write(sc, 0x0, 0x2bf);
3330 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
3331 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3332 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3333 	}
3334 
3335 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part2); i++) {
3336 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3337 		    urtw_8225v2_rf_part2[i].val);
3338 	}
3339 
3340 	error = urtw_8225v2_setgain(sc, 4);
3341 	if (error)
3342 		goto fail;
3343 
3344 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part3); i++) {
3345 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3346 		    urtw_8225v2_rf_part3[i].val);
3347 	}
3348 
3349 	urtw_write8_m(sc, 0x5b, 0x0d);
3350 
3351 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3352 	if (error)
3353 		goto fail;
3354 
3355 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3356 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3357 
3358 	/* TX ant A, 0x0 for B */
3359 	error = urtw_8185_tx_antenna(sc, 0x3);
3360 	if (error)
3361 		goto fail;
3362 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3363 
3364 	error = urtw_8225_rf_set_chan(rf, 1);
3365 fail:
3366 	return error;
3367 }
3368 
3369 usbd_status
3370 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3371 {
3372 	struct urtw_softc *sc = rf->rf_sc;
3373 	struct ieee80211com *ic = &sc->sc_ic;
3374 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3375 	usbd_status error;
3376 
3377 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3378 	if (error)
3379 		goto fail;
3380 
3381 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3382 	usbd_delay_ms(sc->sc_udev, 10);
3383 
3384 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3385 
3386 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3387 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3388 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3389 	else
3390 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3391 
3392 	if (IEEE80211_IS_CHAN_G(c)) {
3393 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3394 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3395 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3396 	} else {
3397 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3398 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3399 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3400 	}
3401 
3402 fail:
3403 	return error;
3404 }
3405 
3406 void
3407 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3408 {
3409 	struct urtw_rf *rf = &sc->sc_rf;
3410 	struct ieee80211com *ic = &sc->sc_ic;
3411 	usbd_status error = 0;
3412 	uint32_t data;
3413 	u_int chan;
3414 
3415 	chan = ieee80211_chan2ieee(ic, c);
3416 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3417 		return;
3418 	/*
3419 	 * During changing the channel we need to temporary disable
3420 	 * TX.
3421 	 */
3422 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3423 	data &= ~URTW_TX_LOOPBACK_MASK;
3424 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3425 	error = rf->set_chan(rf, chan);
3426 	if (error != 0) {
3427 		printf("%s could not change the channel\n",
3428 		    device_xname(sc->sc_dev));
3429 		return;
3430 	}
3431 	usbd_delay_ms(sc->sc_udev, 10);
3432 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3433 
3434 fail:	return;
3435 
3436 }
3437 
3438 void
3439 urtw_next_scan(void *arg)
3440 {
3441 	struct urtw_softc *sc = arg;
3442 	struct ieee80211com *ic = &sc->sc_ic;
3443 	int s;
3444 
3445 	if (sc->sc_dying)
3446 		return;
3447 
3448 	s = splnet();
3449 	if (ic->ic_state == IEEE80211_S_SCAN)
3450 		ieee80211_next_scan(ic);
3451 	splx(s);
3452 }
3453 
3454 void
3455 urtw_task(void *arg)
3456 {
3457 	struct urtw_softc *sc = arg;
3458 	struct ieee80211com *ic = &sc->sc_ic;
3459 	struct ieee80211_node *ni;
3460 	enum ieee80211_state ostate;
3461 	usbd_status error = 0;
3462 
3463 	if (sc->sc_dying)
3464 		return;
3465 
3466 	ostate = ic->ic_state;
3467 
3468 	switch (sc->sc_state) {
3469 	case IEEE80211_S_INIT:
3470 		if (ostate == IEEE80211_S_RUN) {
3471 			/* turn link LED off */
3472 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3473 		}
3474 		break;
3475 
3476 	case IEEE80211_S_SCAN:
3477 		urtw_set_chan(sc, ic->ic_curchan);
3478 		if (!sc->sc_dying)
3479 			callout_schedule(&sc->scan_to, mstohz(200));
3480 		break;
3481 
3482 	case IEEE80211_S_AUTH:
3483 	case IEEE80211_S_ASSOC:
3484 		urtw_set_chan(sc, ic->ic_curchan);
3485 		break;
3486 
3487 	case IEEE80211_S_RUN:
3488 		ni = ic->ic_bss;
3489 
3490 		urtw_set_chan(sc, ic->ic_curchan);
3491 
3492 		/* setting bssid. */
3493 		error = urtw_set_bssid(sc, ni->ni_bssid);
3494 		if (error != 0)
3495 			goto fail;
3496 		urtw_update_msr(sc);
3497 		/* XXX maybe the below would be incorrect. */
3498 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3499 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3500 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3501 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3502 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3503 		if (error != 0)
3504 			printf("%s: could not control LED (%d)\n",
3505 			    device_xname(sc->sc_dev), error);
3506 		break;
3507 	}
3508 
3509 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3510 
3511 fail:
3512 	if (error != 0) {
3513 		DPRINTF(("%s: error duing processing RUN state.",
3514 		    device_xname(sc->sc_dev)));
3515 	}
3516 }
3517 
3518 usbd_status
3519 urtw_8187b_update_wmm(struct urtw_softc *sc)
3520 {
3521 	struct ieee80211com *ic = &sc->sc_ic;
3522 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3523 	uint32_t data;
3524 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3525 	usbd_status error;
3526 
3527 	sifs = 0xa;
3528 	if (IEEE80211_IS_CHAN_G(c))
3529 		slot = 0x9;
3530 	else
3531 		slot = 0x14;
3532 
3533 	aifs = (2 * slot) + sifs;
3534 	ecwmin = 3;
3535 	ecwmax = 7;
3536 
3537 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3538 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3539 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3540 
3541 	urtw_write32_m(sc, URTW_AC_VO, data);
3542 	urtw_write32_m(sc, URTW_AC_VI, data);
3543 	urtw_write32_m(sc, URTW_AC_BE, data);
3544 	urtw_write32_m(sc, URTW_AC_BK, data);
3545 
3546 fail:
3547 	return error;
3548 }
3549 
3550 usbd_status
3551 urtw_8187b_reset(struct urtw_softc *sc)
3552 {
3553 	uint8_t data;
3554 	usbd_status error;
3555 
3556 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3557 	if (error)
3558 		goto fail;
3559 
3560 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3561 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3562 		URTW_CONFIG3_GNT_SELECT);
3563 
3564 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3565 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3566 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3567 
3568 	urtw_write8_m(sc, 0x61, 0x10);
3569 	urtw_read8_m(sc, 0x62, &data);
3570 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3571 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3572 
3573 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3574 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3575 
3576 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3577 	if (error)
3578 		goto fail;
3579 
3580 	urtw_read8_m(sc, URTW_CMD, &data);
3581 	data = (data & 2) | URTW_CMD_RST;
3582 	urtw_write8_m(sc, URTW_CMD, data);
3583 	usbd_delay_ms(sc->sc_udev, 100);
3584 
3585 	urtw_read8_m(sc, URTW_CMD, &data);
3586 	if (data & URTW_CMD_RST) {
3587 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
3588 		goto fail;
3589 	}
3590 
3591 fail:
3592 	return error;
3593 }
3594 
3595 int
3596 urtw_8187b_init(struct ifnet *ifp)
3597 {
3598 	struct urtw_softc *sc = ifp->if_softc;
3599 	struct urtw_rf *rf = &sc->sc_rf;
3600 	struct ieee80211com *ic = &sc->sc_ic;
3601 	uint8_t data;
3602 	usbd_status error;
3603 
3604 	urtw_stop(ifp, 0);
3605 
3606 	error = urtw_8187b_update_wmm(sc);
3607 	if (error != 0)
3608 		goto fail;
3609 	error = urtw_8187b_reset(sc);
3610 	if (error)
3611 		goto fail;
3612 
3613 	/* Applying MAC address again. */
3614 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3615 	if (error)
3616 		goto fail;
3617 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3618 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3619 	if (error)
3620 		goto fail;
3621 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3622 	if (error)
3623 		goto fail;
3624 
3625 	error = urtw_update_msr(sc);
3626 	if (error)
3627 		goto fail;
3628 
3629 	error = rf->init(rf);
3630 	if (error != 0)
3631 		goto fail;
3632 
3633 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3634 		URTW_CMD_RX_ENABLE);
3635 	error = urtw_intr_enable(sc);
3636 	if (error != 0)
3637 		goto fail;
3638 
3639 	error = urtw_write8e(sc, 0x41, 0xf4);
3640 	if (error != 0)
3641 		goto fail;
3642 	error = urtw_write8e(sc, 0x40, 0x00);
3643 	if (error != 0)
3644 		goto fail;
3645 	error = urtw_write8e(sc, 0x42, 0x00);
3646 	if (error != 0)
3647 		goto fail;
3648 	error = urtw_write8e(sc, 0x42, 0x01);
3649 	if (error != 0)
3650 		goto fail;
3651 	error = urtw_write8e(sc, 0x40, 0x0f);
3652 	if (error != 0)
3653 		goto fail;
3654 	error = urtw_write8e(sc, 0x42, 0x00);
3655 	if (error != 0)
3656 		goto fail;
3657 	error = urtw_write8e(sc, 0x42, 0x01);
3658 	if (error != 0)
3659 		goto fail;
3660 
3661 	urtw_read8_m(sc, 0xdb, &data);
3662 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3663 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3664 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3665 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3666 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3667 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3668 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3669 	urtw_write8_m(sc, 0x61, 0);
3670 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3671 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3672 	urtw_write8_m(sc, 0xda, 0x10);
3673 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3674 
3675 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3676 
3677 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3678 
3679 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3680 
3681 	/* Reset softc variables. */
3682 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
3683 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
3684 	}
3685 	sc->sc_txtimer = 0;
3686 
3687 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3688 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3689 		if (error != 0) {
3690 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
3691 			    ", err=%s\n", usbd_errstr(error));
3692 
3693 			goto fail;
3694 		}
3695 		/* Get the first interface handle. */
3696 		error = usbd_device2interface_handle(sc->sc_udev,
3697 		    URTW_IFACE_INDEX, &sc->sc_iface);
3698 		if (error != 0) {
3699 			printf("%s: could not get interface handle\n",
3700 			    device_xname(sc->sc_dev));
3701 			goto fail;
3702 		}
3703 		error = urtw_open_pipes(sc);
3704 		if (error != 0)
3705 			goto fail;
3706 		error = urtw_alloc_rx_data_list(sc);
3707 		if (error != 0)
3708 			goto fail;
3709 		error = urtw_alloc_tx_data_list(sc);
3710 		if (error != 0)
3711 			goto fail;
3712 		sc->sc_flags |= URTW_INIT_ONCE;
3713 	}
3714 
3715 	error = urtw_rx_enable(sc);
3716 	if (error != 0)
3717 		goto fail;
3718 	error = urtw_tx_enable(sc);
3719 	if (error != 0)
3720 		goto fail;
3721 
3722 	ifp->if_flags &= ~IFF_OACTIVE;
3723 	ifp->if_flags |= IFF_RUNNING;
3724 
3725 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3726 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3727 	else
3728 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3729 
3730 fail:
3731 	return error;
3732 }
3733 
3734 usbd_status
3735 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3736 {
3737 	int i;
3738 	usbd_status error;
3739 
3740 	for (i = 0; i < __arraycount(urtw_8187b_regtbl); i++) {
3741 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3742 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3743 	}
3744 
3745 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3746 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3747 
3748 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3749 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3750 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3751 
3752 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3753 
3754 fail:
3755 	return error;
3756 }
3757 
3758 usbd_status
3759 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3760 {
3761 	usbd_status error;
3762 
3763 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3764 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3765 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3766 	usbd_delay_ms(sc->sc_udev, 100);
3767 
3768 fail:
3769 	return error;
3770 }
3771 
3772 usbd_status
3773 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3774 {
3775 	struct ieee80211com *ic = &sc->sc_ic;
3776 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3777 	uint8_t aifs, difs, eifs, sifs, slot;
3778 	usbd_status error;
3779 
3780 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3781 
3782 	sifs = 0xa;
3783 	if (IEEE80211_IS_CHAN_G(c)) {
3784 		slot = 0x9;
3785 		difs = 0x1c;
3786 		eifs = 0x5b;
3787 	} else {
3788 		slot = 0x14;
3789 		difs = 0x32;
3790 		eifs = 0x5b;
3791 	}
3792 	aifs = (2 * slot) + sifs;
3793 
3794 	urtw_write8_m(sc, URTW_SLOT, slot);
3795 
3796 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3797 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3798 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3799 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3800 
3801 	urtw_write8_m(sc, URTW_DIFS, difs);
3802 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3803 
3804 fail:
3805 	return error;
3806 }
3807 
3808 usbd_status
3809 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3810 {
3811 	struct urtw_softc *sc = rf->rf_sc;
3812 	unsigned int i;
3813 	uint8_t data;
3814 	usbd_status error;
3815 
3816 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3817 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3818 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3819 	urtw_write8_m(sc, URTW_CW_CONF, data |
3820 		URTW_CW_CONF_PERPACKET_RETRY);
3821 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3822 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3823 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3824 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3825 
3826 	/* Auto rate fallback control. */
3827 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3828 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3829 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3830 		URTW_RATE_FALLBACK_ENABLE);
3831 
3832 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3833 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3834 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3835 
3836 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3837 	if (error)
3838 		goto fail;
3839 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3840 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3841 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3842 	if (error)
3843 		goto fail;
3844 
3845 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3846 	urtw_8225v2_b_config_mac(sc);
3847 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3848 
3849 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3850 	if (error)
3851 		goto fail;
3852 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3853 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3854 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3855 	if (error)
3856 		goto fail;
3857 
3858 	urtw_8225v2_b_init_rfe(sc);
3859 
3860 	for (i = 0; i < __arraycount(urtw_8225v2_b_rf); i++) {
3861 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3862 		    urtw_8225v2_b_rf[i].val);
3863 	}
3864 
3865 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3866 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3867 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3868 	}
3869 
3870 	urtw_8225_write(sc, 0x03, 0x080);
3871 	urtw_8225_write(sc, 0x05, 0x004);
3872 	urtw_8225_write(sc, 0x00, 0x0b7);
3873 	urtw_8225_write(sc, 0x02, 0xc4d);
3874 	urtw_8225_write(sc, 0x02, 0x44d);
3875 	urtw_8225_write(sc, 0x00, 0x2bf);
3876 
3877 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3878 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3879 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3880 
3881 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3882 	for (i = 0; i < __arraycount(urtw_8225v2_agc); i++) {
3883 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3884 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3885 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3886 	}
3887 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3888 
3889 	for (i = 0; i < __arraycount(urtw_8225v2_ofdm); i++)
3890 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3891 
3892 	urtw_8225v2_b_update_chan(sc);
3893 
3894 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3895 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3896 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3897 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3898 
3899 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3900 fail:
3901 	return error;
3902 }
3903 
3904 usbd_status
3905 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3906 {
3907 	struct urtw_softc *sc = rf->rf_sc;
3908 	usbd_status error;
3909 
3910 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3911 	if (error)
3912 		goto fail;
3913 
3914 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3915 	/*
3916 	 * Delay removed from 8185 to 8187.
3917 	 * usbd_delay_ms(sc->sc_udev, 10);
3918 	 */
3919 
3920 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3921 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3922 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3923 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3924 
3925 fail:
3926 	return error;
3927 }
3928 
3929 usbd_status
3930 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3931 {
3932 	int i;
3933 	uint8_t *cck_pwrtable;
3934 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3935 	    ofdm_pwrlvl_max;
3936 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3937 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3938 	usbd_status error;
3939 
3940 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3941 		cck_pwrlvl_min = 0;
3942 		cck_pwrlvl_max = 15;
3943 		ofdm_pwrlvl_min = 2;
3944 		ofdm_pwrlvl_max = 17;
3945 	} else {
3946 		cck_pwrlvl_min = 7;
3947 		cck_pwrlvl_max = 22;
3948 		ofdm_pwrlvl_min = 10;
3949 		ofdm_pwrlvl_max = 25;
3950 	}
3951 
3952 	/* CCK power setting */
3953 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
3954 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
3955 
3956 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3957 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3958 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
3959 
3960 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3961 	    urtw_8225v2_txpwr_cck;
3962 
3963 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3964 		if (cck_pwrlvl <= 6)
3965 			; /* do nothing */
3966 		else if (cck_pwrlvl <= 11)
3967 			cck_pwrtable += 8;
3968 		else
3969 			cck_pwrtable += 16;
3970 	} else {
3971 		if (cck_pwrlvl <= 5)
3972 			; /* do nothing */
3973 		else if (cck_pwrlvl <= 11)
3974 			cck_pwrtable += 8;
3975 		else if (cck_pwrlvl <= 17)
3976 			cck_pwrtable += 16;
3977 		else
3978 			cck_pwrtable += 24;
3979 	}
3980 
3981 	for (i = 0; i < 8; i++) {
3982 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3983 	}
3984 
3985 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3986 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3987 	/*
3988 	 * Delay removed from 8185 to 8187.
3989 	 * usbd_delay_ms(sc->sc_udev, 1);
3990 	 */
3991 
3992 	/* OFDM power setting */
3993 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3994 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3995 
3996 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3997 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3998 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
3999 
4000 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
4001 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
4002 
4003 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4004 		if (ofdm_pwrlvl <= 11) {
4005 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4006 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4007 		} else {
4008 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4009 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4010 		}
4011 	} else {
4012 		if (ofdm_pwrlvl <= 11) {
4013 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4014 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4015 		} else if (ofdm_pwrlvl <= 17) {
4016 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4017 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4018 		} else {
4019 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4020 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4021 		}
4022 	}
4023 
4024 	/*
4025 	 * Delay removed from 8185 to 8187.
4026 	 * usbd_delay_ms(sc->sc_udev, 1);
4027 	 */
4028 fail:
4029 	return error;
4030 }
4031 
4032 int
4033 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4034 {
4035 	int error;
4036 
4037 	urtw_write32_m(sc, URTW_BSSID,
4038 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4039 	urtw_write16_m(sc, URTW_BSSID + 4,
4040 	    bssid[4] | bssid[5] << 8);
4041 
4042 	return 0;
4043 
4044 fail:
4045 	return error;
4046 }
4047 
4048 int
4049 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4050 {
4051 	int error;
4052 
4053 	urtw_write32_m(sc, URTW_MAC0,
4054 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4055 	urtw_write16_m(sc, URTW_MAC4,
4056 	    addr[4] | addr[5] << 8);
4057 
4058 	return 0;
4059 
4060 fail:
4061 	return error;
4062 }
4063 
4064 MODULE(MODULE_CLASS_DRIVER, if_urtw, NULL);
4065 
4066 #ifdef _MODULE
4067 #include "ioconf.c"
4068 #endif
4069 
4070 static int
4071 if_urtw_modcmd(modcmd_t cmd, void *aux)
4072 {
4073 	int error = 0;
4074 
4075 	switch (cmd) {
4076 	case MODULE_CMD_INIT:
4077 #ifdef _MODULE
4078 		error = config_init_component(cfdriver_ioconf_urtw,
4079 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4080 #endif
4081 		return error;
4082 	case MODULE_CMD_FINI:
4083 #ifdef _MODULE
4084 		error = config_fini_component(cfdriver_ioconf_urtw,
4085 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4086 #endif
4087 		return error;
4088 	default:
4089 		return ENOTTY;
4090 	}
4091 }
4092