xref: /netbsd-src/sys/dev/usb/if_urtw.c (revision afab4e300d3a9fb07dd8c80daf53d0feb3345706)
1 /*	$NetBSD: if_urtw.c,v 1.26 2022/03/03 06:06:52 riastradh Exp $	*/
2 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
3 
4 /*-
5  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
6  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __KERNEL_RCSID(0, "$NetBSD: if_urtw.c,v 1.26 2022/03/03 06:06:52 riastradh Exp $");
23 
24 #ifdef _KERNEL_OPT
25 #include "opt_usb.h"
26 #endif
27 
28 #include <sys/param.h>
29 #include <sys/sockio.h>
30 #include <sys/proc.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/callout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 
41 #include <machine/endian.h>
42 #include <net/bpf.h>
43 #include <net/if.h>
44 #include <net/if_arp.h>
45 #include <net/if_dl.h>
46 #include <net/if_ether.h>
47 #include <net/if_media.h>
48 #include <net/if_types.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/if_inarp.h>
54 #include <netinet/ip.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 
59 #include <dev/usb/usb.h>
60 #include <dev/usb/usbdi.h>
61 #include <dev/usb/usbdi_util.h>
62 #include <dev/usb/usbdivar.h>
63 #include <dev/usb/usbdevs.h>
64 
65 #include "if_urtwreg.h"
66 
67 #ifdef URTW_DEBUG
68 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
69 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
70 int urtw_debug = 0;
71 #else
72 #define	DPRINTF(x)
73 #define	DPRINTFN(n, x)
74 #endif
75 
76 /*
77  * Recognized device vendors/products.
78  */
79 static const struct urtw_type {
80 	struct usb_devno	dev;
81 	uint8_t			rev;
82 } urtw_devs[] = {
83 #define	URTW_DEV_RTL8187(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
85 #define	URTW_DEV_RTL8187B(v, p)	\
86 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
87 	/* Realtek RTL8187 devices. */
88 	URTW_DEV_RTL8187(ASUSTEK,	P5B_WIFI),
89 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
90 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GC_2),
91 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
92 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
93 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
94 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
95 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
96 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
97 	/* Realtek RTL8187B devices. */
98 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
99 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
101 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
102 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
103 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
104 #undef	URTW_DEV_RTL8187
105 #undef	URTW_DEV_RTL8187B
106 };
107 #define	urtw_lookup(v, p)	\
108 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
109 
110 /*
111  * Helper read/write macros.
112  */
113 #define urtw_read8_m(sc, val, data)	do {			\
114 	error = urtw_read8_c(sc, val, data, 0);			\
115 	if (error != 0)						\
116 		goto fail;					\
117 } while (0)
118 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
119 	error = urtw_read8_c(sc, val, data, idx);		\
120 	if (error != 0)						\
121 		goto fail;					\
122 } while (0)
123 #define urtw_write8_m(sc, val, data)	do {			\
124 	error = urtw_write8_c(sc, val, data, 0);		\
125 	if (error != 0)						\
126 		goto fail;					\
127 } while (0)
128 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
129 	error = urtw_write8_c(sc, val, data, idx);		\
130 	if (error != 0)						\
131 		goto fail;					\
132 } while (0)
133 #define urtw_read16_m(sc, val, data)	do {			\
134 	error = urtw_read16_c(sc, val, data, 0);		\
135 	if (error != 0)						\
136 		goto fail;					\
137 } while (0)
138 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
139 	error = urtw_read16_c(sc, val, data, idx);		\
140 	if (error != 0)						\
141 		goto fail;					\
142 } while (0)
143 #define urtw_write16_m(sc, val, data)	do {			\
144 	error = urtw_write16_c(sc, val, data, 0);		\
145 	if (error != 0)						\
146 		goto fail;					\
147 } while (0)
148 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
149 	error = urtw_write16_c(sc, val, data, idx);		\
150 	if (error != 0)						\
151 		goto fail;					\
152 } while (0)
153 #define urtw_read32_m(sc, val, data)	do {			\
154 	error = urtw_read32_c(sc, val, data, 0);		\
155 	if (error != 0)						\
156 		goto fail;					\
157 } while (0)
158 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
159 	error = urtw_read32_c(sc, val, data, idx);		\
160 	if (error != 0)						\
161 		goto fail;					\
162 } while (0)
163 #define urtw_write32_m(sc, val, data)	do {			\
164 	error = urtw_write32_c(sc, val, data, 0);		\
165 	if (error != 0)						\
166 		goto fail;					\
167 } while (0)
168 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
169 	error = urtw_write32_c(sc, val, data, idx);		\
170 	if (error != 0)						\
171 		goto fail;					\
172 } while (0)
173 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
174 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
175 	if (error != 0)						\
176 		goto fail;					\
177 } while (0)
178 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
179 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
180 	if (error != 0)						\
181 		goto fail;					\
182 } while (0)
183 #define urtw_8225_write(sc, val, data)	do {			\
184 	error = urtw_8225_write_c(sc, val, data);		\
185 	if (error != 0)						\
186 		goto fail;					\
187 } while (0)
188 
189 struct urtw_pair {
190 	uint32_t	reg;
191 	uint32_t	val;
192 };
193 
194 struct urtw_pair_idx {
195 	uint8_t		reg;
196 	uint8_t		val;
197 	uint8_t		idx;
198 };
199 
200 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
201 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
202 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
203 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
204 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
205 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
206 	{ 0xff, 0x00, 0 },
207 
208 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
209 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
210 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
211 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
212 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
213 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
214 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
215 	{ 0xf8, 0x08, 1 },
216 
217 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
218 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
219 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
220 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
221 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
222 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
223 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
224 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
225 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
226 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
227 
228 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
229 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
230 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
231 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
232 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
233 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
234 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
235 
236 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
237 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
238 };
239 
240 static uint8_t urtw_8225_agc[] = {
241 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
242 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
243 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
244 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
245 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
246 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
247 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
248 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
249 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
250 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
251 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
252 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
253 };
254 
255 static uint32_t urtw_8225_channel[] = {
256 	0x0000,		/* dummy channel 0 */
257 	0x085c,		/* 1 */
258 	0x08dc,		/* 2 */
259 	0x095c,		/* 3 */
260 	0x09dc,		/* 4 */
261 	0x0a5c,		/* 5 */
262 	0x0adc,		/* 6 */
263 	0x0b5c,		/* 7 */
264 	0x0bdc,		/* 8 */
265 	0x0c5c,		/* 9 */
266 	0x0cdc,		/* 10 */
267 	0x0d5c,		/* 11 */
268 	0x0ddc,		/* 12 */
269 	0x0e5c,		/* 13 */
270 	0x0f72,		/* 14 */
271 };
272 
273 static uint8_t urtw_8225_gain[] = {
274 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
275 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
276 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
277 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
278 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
279 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
280 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
281 };
282 
283 static struct urtw_pair urtw_8225_rf_part1[] = {
284 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
285 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
286 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
287 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
288 };
289 
290 static struct urtw_pair urtw_8225_rf_part2[] = {
291 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
292 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
293 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
294 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
295 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
296 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
297 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
298 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
299 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
300 	{ 0x27, 0x88 }
301 };
302 
303 static struct urtw_pair urtw_8225_rf_part3[] = {
304 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
305 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
306 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
307 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
308 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
309 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
310 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
311 };
312 
313 static uint16_t urtw_8225_rxgain[] = {
314 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
315 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
316 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
317 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
318 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
319 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
320 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
321 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
322 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
323 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
324 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
325 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
326 };
327 
328 static uint8_t urtw_8225_threshold[] = {
329 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
330 };
331 
332 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
333 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
334 };
335 
336 static uint8_t urtw_8225_txpwr_cck[] = {
337 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
338 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
339 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
340 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
341 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
342 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
343 };
344 
345 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
346 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
347 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
348 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
349 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
350 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
351 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
352 };
353 
354 static uint8_t urtw_8225_txpwr_ofdm[] = {
355 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
356 };
357 
358 static uint8_t urtw_8225v2_agc[] = {
359 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
360 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
361 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
362 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
363 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
364 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
365 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
366 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
367 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
368 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
369 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
370 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
371 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
372 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
373 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
374 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
375 };
376 
377 static uint8_t urtw_8225v2_ofdm[] = {
378 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
379 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
380 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
381 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
382 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
383 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
384 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
385 	0x6d, 0x3c, 0xfb, 0x07
386 };
387 
388 static uint8_t urtw_8225v2_gain_bg[] = {
389 	0x23, 0x15, 0xa5,		/* -82-1dbm */
390 	0x23, 0x15, 0xb5,		/* -82-2dbm */
391 	0x23, 0x15, 0xc5,		/* -82-3dbm */
392 	0x33, 0x15, 0xc5,		/* -78dbm */
393 	0x43, 0x15, 0xc5,		/* -74dbm */
394 	0x53, 0x15, 0xc5,		/* -70dbm */
395 	0x63, 0x15, 0xc5,		/* -66dbm */
396 };
397 
398 static struct urtw_pair urtw_8225v2_rf_part1[] = {
399 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
400 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
401 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
402 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
403 };
404 
405 static struct urtw_pair urtw_8225v2_rf_part2[] = {
406 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
407 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
408 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
409 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
410 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
411 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
412 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
413 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
414 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
415 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
416 };
417 
418 static struct urtw_pair urtw_8225v2_rf_part3[] = {
419 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
420 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
421 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
422 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
423 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
424 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
425 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
426 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
427 };
428 
429 static uint16_t urtw_8225v2_rxgain[] = {
430 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
431 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
432 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
433 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
434 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
435 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
436 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
437 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
438 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
439 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
440 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
441 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
442 };
443 
444 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
445 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
446 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
447 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
448 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
449 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
450 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
451 };
452 
453 static uint8_t urtw_8225v2_txpwr_cck[] = {
454 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
455 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
456 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
457 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
458 };
459 
460 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
461 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
463 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
464 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
465 };
466 
467 static struct urtw_pair urtw_8225v2_b_rf[] = {
468 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
469 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
470 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
471 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
472 	{ 0x00, 0x01b7 }
473 };
474 
475 static struct urtw_pair urtw_ratetable[] = {
476 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
477 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
478 	{ 96, 10 }, { 108, 11 }
479 };
480 
481 static int		urtw_init(struct ifnet *);
482 static void		urtw_stop(struct ifnet *, int);
483 static int		urtw_ioctl(struct ifnet *, u_long, void *);
484 static void		urtw_start(struct ifnet *);
485 static int		urtw_alloc_rx_data_list(struct urtw_softc *);
486 static void		urtw_free_rx_data_list(struct urtw_softc *);
487 static int		urtw_alloc_tx_data_list(struct urtw_softc *);
488 static void		urtw_free_tx_data_list(struct urtw_softc *);
489 static void		urtw_rxeof(struct usbd_xfer *, void *,
490 		    usbd_status);
491 static int		urtw_tx_start(struct urtw_softc *,
492 		    struct ieee80211_node *, struct mbuf *, int);
493 static void		urtw_txeof_low(struct usbd_xfer *, void *,
494 		    usbd_status);
495 static void		urtw_txeof_normal(struct usbd_xfer *, void *,
496 		    usbd_status);
497 static void		urtw_next_scan(void *);
498 static void		urtw_task(void *);
499 static void		urtw_ledusbtask(void *);
500 static void		urtw_ledtask(void *);
501 static int		urtw_media_change(struct ifnet *);
502 static int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
503 static void		urtw_watchdog(struct ifnet *);
504 static void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
505 static int		urtw_isbmode(uint16_t);
506 static uint16_t	urtw_rate2rtl(int);
507 static uint16_t	urtw_rtl2rate(int);
508 static usbd_status	urtw_set_rate(struct urtw_softc *);
509 static usbd_status	urtw_update_msr(struct urtw_softc *);
510 static usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
511 static usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
512 static usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
513 static usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
514 static usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
515 static usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
516 static usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
517 static usbd_status	urtw_eprom_ck(struct urtw_softc *);
518 static usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
519 		    int);
520 static usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
521 		    uint32_t *);
522 static usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
523 static usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
524 static usbd_status	urtw_get_macaddr(struct urtw_softc *);
525 static usbd_status	urtw_get_txpwr(struct urtw_softc *);
526 static usbd_status	urtw_get_rfchip(struct urtw_softc *);
527 static usbd_status	urtw_led_init(struct urtw_softc *);
528 static usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
529 static usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
530 static usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
531 static usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
532 		    uint32_t);
533 static usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
534 		    uint32_t);
535 static usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
536 static usbd_status	urtw_8225_usb_init(struct urtw_softc *);
537 static usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
538 static usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
539 		    uint16_t);
540 static usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
541 static usbd_status	urtw_8225_rf_init(struct urtw_rf *);
542 static usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
543 static usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
544 static usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
545 static usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
546 static usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
547 static usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
548 static usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
549 static usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
550 static usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
551 static usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
552 static usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
553 static usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
554 static usbd_status	urtw_open_pipes(struct urtw_softc *);
555 static usbd_status	urtw_close_pipes(struct urtw_softc *);
556 static usbd_status	urtw_intr_enable(struct urtw_softc *);
557 static usbd_status	urtw_intr_disable(struct urtw_softc *);
558 static usbd_status	urtw_reset(struct urtw_softc *);
559 static usbd_status	urtw_led_on(struct urtw_softc *, int);
560 static usbd_status	urtw_led_ctl(struct urtw_softc *, int);
561 static usbd_status	urtw_led_blink(struct urtw_softc *);
562 static usbd_status	urtw_led_mode0(struct urtw_softc *, int);
563 static usbd_status	urtw_led_mode1(struct urtw_softc *, int);
564 static usbd_status	urtw_led_mode2(struct urtw_softc *, int);
565 static usbd_status	urtw_led_mode3(struct urtw_softc *, int);
566 static usbd_status	urtw_rx_setconf(struct urtw_softc *);
567 static usbd_status	urtw_rx_enable(struct urtw_softc *);
568 static usbd_status	urtw_tx_enable(struct urtw_softc *);
569 static usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
570 static usbd_status	urtw_8187b_reset(struct urtw_softc *);
571 static int		urtw_8187b_init(struct ifnet *);
572 static usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
573 static usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
574 static usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
575 static usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
576 static usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
577 static usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
578 static int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
579 static int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
580 
581 static int urtw_match(device_t, cfdata_t, void *);
582 static void urtw_attach(device_t, device_t, void *);
583 static int urtw_detach(device_t, int);
584 static int urtw_activate(device_t, enum devact);
585 
586 CFATTACH_DECL_NEW(urtw, sizeof(struct urtw_softc),
587 	urtw_match,
588 	urtw_attach,
589 	urtw_detach,
590 	urtw_activate
591 );
592 
593 static int
594 urtw_match(device_t parent, cfdata_t match, void *aux)
595 {
596 	struct usb_attach_arg *uaa = aux;
597 
598 	return urtw_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
599 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
600 }
601 
602 static void
603 urtw_attach(device_t parent, device_t self, void *aux)
604 {
605 	struct urtw_softc *sc = device_private(self);
606 	struct usb_attach_arg *uaa = aux;
607 	struct ieee80211com *ic = &sc->sc_ic;
608 	struct ifnet *ifp = &sc->sc_if;
609 	usbd_status error;
610 	uint8_t data8;
611 	uint32_t data;
612 	int i;
613 
614 	sc->sc_dev = self;
615 	sc->sc_udev = uaa->uaa_device;
616 	sc->sc_hwrev = urtw_lookup(uaa->uaa_vendor, uaa->uaa_product)->rev;
617 	sc->sc_init_state = URTW_INIT_NONE;
618 
619 	aprint_naive("\n");
620 	aprint_normal(": ");
621 
622 	if (sc->sc_hwrev & URTW_HWREV_8187) {
623 		urtw_read32_m(sc, URTW_TX_CONF, &data);
624 		data &= URTW_TX_HWREV_MASK;
625 		switch (data) {
626 		case URTW_TX_HWREV_8187_D:
627 			sc->sc_hwrev |= URTW_HWREV_8187_D;
628 			aprint_normal("RTL8187 rev D");
629 			break;
630 		case URTW_TX_HWREV_8187B_D:
631 			/*
632 			 * Detect Realtek RTL8187B devices that use
633 			 * USB IDs of RTL8187.
634 			 */
635 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
636 			aprint_normal("RTL8187B rev B (early)");
637 			break;
638 		default:
639 			sc->sc_hwrev |= URTW_HWREV_8187_B;
640 			aprint_normal("RTL8187 rev 0x%02x", data >> 25);
641 			break;
642 		}
643 	} else {
644 		/* RTL8187B hwrev register. */
645 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
646 		switch (data8) {
647 		case URTW_8187B_HWREV_8187B_B:
648 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
649 			aprint_normal("RTL8187B rev B");
650 			break;
651 		case URTW_8187B_HWREV_8187B_D:
652 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
653 			aprint_normal("RTL8187B rev D");
654 			break;
655 		case URTW_8187B_HWREV_8187B_E:
656 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
657 			aprint_normal("RTL8187B rev E");
658 			break;
659 		default:
660 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
661 			aprint_normal("RTL8187B rev 0x%02x", data8);
662 			break;
663 		}
664 	}
665 
666 	urtw_read32_m(sc, URTW_RX, &data);
667 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
668 	    URTW_EEPROM_93C46;
669 
670 	error = urtw_get_rfchip(sc);
671 	if (error != 0)
672 		goto fail;
673 	error = urtw_get_macaddr(sc);
674 	if (error != 0)
675 		goto fail;
676 	error = urtw_get_txpwr(sc);
677 	if (error != 0)
678 		goto fail;
679 	error = urtw_led_init(sc);		/* XXX incompleted */
680 	if (error != 0)
681 		goto fail;
682 
683 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
684 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
685 	sc->sc_currate = 3;
686 	/* XXX for what? */
687 	sc->sc_preamble_mode = 2;
688 
689 	usb_init_task(&sc->sc_task, urtw_task, sc, 0);
690 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc, 0);
691 	callout_init(&sc->scan_to, 0);
692 	callout_setfunc(&sc->scan_to, urtw_next_scan, sc);
693 	callout_init(&sc->sc_led_ch, 0);
694 	callout_setfunc(&sc->sc_led_ch, urtw_ledtask, sc);
695 
696 	ic->ic_ifp = ifp;
697 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
698 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
699 	ic->ic_state = IEEE80211_S_INIT;
700 
701 	/* set device capabilities */
702 	ic->ic_caps =
703 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
704 	    IEEE80211_C_TXPMGT |	/* tx power management */
705 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
706 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
707 	    IEEE80211_C_WEP |		/* s/w WEP */
708 	    IEEE80211_C_WPA;		/* WPA/RSN */
709 
710 	/* set supported .11b and .11g rates */
711 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
712 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
713 
714 	/* set supported .11b and .11g channels (1 through 14) */
715 	for (i = 1; i <= 14; i++) {
716 		ic->ic_channels[i].ic_freq =
717 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
718 		ic->ic_channels[i].ic_flags =
719 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
720 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
721 	}
722 
723 	ifp->if_softc = sc;
724 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
725 	if (sc->sc_hwrev & URTW_HWREV_8187) {
726 		ifp->if_init = urtw_init;
727 	} else {
728 		ifp->if_init = urtw_8187b_init;
729 	}
730 	ifp->if_ioctl = urtw_ioctl;
731 	ifp->if_start = urtw_start;
732 	ifp->if_watchdog = urtw_watchdog;
733 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
734 	IFQ_SET_READY(&ifp->if_snd);
735 	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
736 
737 	if_attach(ifp);
738 	ieee80211_ifattach(ic);
739 
740 	/* override state transition machine */
741 	sc->sc_newstate = ic->ic_newstate;
742 	ic->ic_newstate = urtw_newstate;
743 
744 	/* XXX media locking needs revisiting */
745 	mutex_init(&sc->sc_media_mtx, MUTEX_DEFAULT, IPL_SOFTUSB);
746 	ieee80211_media_init_with_lock(ic,
747 	    urtw_media_change, ieee80211_media_status, &sc->sc_media_mtx);
748 
749 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
750 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
751 	    &sc->sc_drvbpf);
752 
753 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
754 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
755 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
756 
757 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
758 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
759 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
760 
761 	aprint_normal(", address %s\n", ether_sprintf(ic->ic_myaddr));
762 
763 	ieee80211_announce(ic);
764 
765 	sc->sc_init_state = URTW_INIT_INITED;
766 
767 	return;
768 fail:
769 	aprint_error(": %s failed!\n", __func__);
770 	sc->sc_dying = true;
771 }
772 
773 static int
774 urtw_detach(device_t self, int flags)
775 {
776 	struct urtw_softc *sc = device_private(self);
777 	struct ifnet *ifp = &sc->sc_if;
778 	int s;
779 
780 	s = splusb();
781 
782 	sc->sc_dying = true;
783 
784 	if (sc->sc_init_state < URTW_INIT_INITED)
785 		goto out;
786 
787 	callout_halt(&sc->scan_to, NULL);
788 	callout_halt(&sc->sc_led_ch, NULL);
789 	callout_destroy(&sc->scan_to);
790 	callout_destroy(&sc->sc_led_ch);
791 
792 	usb_rem_task_wait(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER, NULL);
793 	usb_rem_task_wait(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER,
794 	    NULL);
795 
796 	if (ifp->if_softc != NULL) {
797 		bpf_detach(ifp);
798 		ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
799 		if_detach(ifp);
800 	}
801 
802 	/* abort and free xfers */
803 	urtw_free_tx_data_list(sc);
804 	urtw_free_rx_data_list(sc);
805 	urtw_close_pipes(sc);
806 
807 out:
808 	splx(s);
809 	return 0;
810 }
811 
812 static int
813 urtw_activate(device_t self, enum devact act)
814 {
815 	struct urtw_softc *sc = device_private(self);
816 
817 	switch (act) {
818 	case DVACT_DEACTIVATE:
819 		sc->sc_dying = true;
820 		break;
821 	}
822 
823 	return 0;
824 }
825 
826 static usbd_status
827 urtw_close_pipes(struct urtw_softc *sc)
828 {
829 	usbd_status error = 0;
830 
831 	if (sc->sc_rxpipe != NULL) {
832 		usbd_close_pipe(sc->sc_rxpipe);
833 		sc->sc_rxpipe = NULL;
834 	}
835 	if (sc->sc_txpipe_low != NULL) {
836 		usbd_close_pipe(sc->sc_txpipe_low);
837 		sc->sc_txpipe_low = NULL;
838 	}
839 	if (sc->sc_txpipe_normal != NULL) {
840 		usbd_close_pipe(sc->sc_txpipe_normal);
841 		sc->sc_txpipe_normal = NULL;
842 	}
843 	return error;
844 }
845 
846 static usbd_status
847 urtw_open_pipes(struct urtw_softc *sc)
848 {
849 	usbd_status error;
850 
851 	/*
852 	 * NB: there is no way to distinguish each pipes so we need to hardcode
853 	 * pipe numbers
854 	 */
855 
856 	/* tx pipe - low priority packets */
857 	if (sc->sc_hwrev & URTW_HWREV_8187)
858 		error = usbd_open_pipe(sc->sc_iface, 0x2,
859 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
860 	else
861 		error = usbd_open_pipe(sc->sc_iface, 0x6,
862 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
863 	if (error != 0) {
864 		printf("%s: could not open Tx low pipe: %s\n",
865 		    device_xname(sc->sc_dev), usbd_errstr(error));
866 		goto fail;
867 	}
868 	/* tx pipe - normal priority packets */
869 	if (sc->sc_hwrev & URTW_HWREV_8187)
870 		error = usbd_open_pipe(sc->sc_iface, 0x3,
871 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
872 	else
873 		error = usbd_open_pipe(sc->sc_iface, 0x7,
874 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
875 	if (error != 0) {
876 		printf("%s: could not open Tx normal pipe: %s\n",
877 		    device_xname(sc->sc_dev), usbd_errstr(error));
878 		goto fail;
879 	}
880 	/* rx pipe */
881 	if (sc->sc_hwrev & URTW_HWREV_8187)
882 		error = usbd_open_pipe(sc->sc_iface, 0x81,
883 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
884 	else
885 		error = usbd_open_pipe(sc->sc_iface, 0x83,
886 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
887 	if (error != 0) {
888 		printf("%s: could not open Rx pipe: %s\n",
889 		    device_xname(sc->sc_dev), usbd_errstr(error));
890 		goto fail;
891 	}
892 
893 	return 0;
894 fail:
895 	(void)urtw_close_pipes(sc);
896 	return error;
897 }
898 
899 static int
900 urtw_alloc_rx_data_list(struct urtw_softc *sc)
901 {
902 	int i, error;
903 
904 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
905 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
906 
907 		data->sc = sc;
908 
909 		error = usbd_create_xfer(sc->sc_rxpipe, MCLBYTES,
910 		    0, 0, &data->xfer);
911 		if (error) {
912 
913 			printf("%s: could not allocate rx xfer\n",
914 			    device_xname(sc->sc_dev));
915 			error = ENOMEM;
916 			goto fail;
917 		}
918 
919 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
920 		if (data->m == NULL) {
921 			printf("%s: could not allocate rx mbuf\n",
922 			    device_xname(sc->sc_dev));
923 			error = ENOMEM;
924 			goto fail;
925 		}
926 		MCLGET(data->m, M_DONTWAIT);
927 		if (!(data->m->m_flags & M_EXT)) {
928 			printf("%s: could not allocate rx mbuf cluster\n",
929 			    device_xname(sc->sc_dev));
930 			error = ENOMEM;
931 			goto fail;
932 		}
933 		data->buf = mtod(data->m, uint8_t *);
934 	}
935 
936 	return 0;
937 
938 fail:
939 	urtw_free_rx_data_list(sc);
940 	return error;
941 }
942 
943 static void
944 urtw_free_rx_data_list(struct urtw_softc *sc)
945 {
946 	int i;
947 
948 	/* Make sure no transfers are pending. */
949 	if (sc->sc_rxpipe != NULL)
950 		usbd_abort_pipe(sc->sc_rxpipe);
951 
952 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
953 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
954 
955 		if (data->xfer != NULL) {
956 			usbd_destroy_xfer(data->xfer);
957 			data->xfer = NULL;
958 		}
959 		if (data->m != NULL) {
960 			m_freem(data->m);
961 			data->m = NULL;
962 		}
963 	}
964 }
965 
966 static int
967 urtw_alloc_tx_data_list(struct urtw_softc *sc)
968 {
969 	int i, error;
970 
971 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
972 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
973 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
974 
975 			data->sc = sc;
976 			data->ni = NULL;
977 
978 			error = usbd_create_xfer((j == URTW_PRIORITY_LOW) ?
979 			    sc->sc_txpipe_low : sc->sc_txpipe_normal,
980 			    URTW_TX_MAXSIZE, USBD_FORCE_SHORT_XFER, 0,
981 			    &data->xfer);
982 			if (error) {
983 				printf("%s: could not allocate tx xfer\n",
984 				    device_xname(sc->sc_dev));
985 				goto fail;
986 			}
987 
988 			data->buf = usbd_get_buffer(data->xfer);
989 
990 			if (((unsigned long)data->buf) % 4)
991 				printf("%s: warn: unaligned buffer %p\n",
992 				    device_xname(sc->sc_dev), data->buf);
993 		}
994 	}
995 
996 	return 0;
997 
998 fail:
999 	urtw_free_tx_data_list(sc);
1000 	return error;
1001 }
1002 
1003 static void
1004 urtw_free_tx_data_list(struct urtw_softc *sc)
1005 {
1006 	int i;
1007 
1008 	/* Make sure no transfers are pending. */
1009 	if (sc->sc_txpipe_low != NULL)
1010 		usbd_abort_pipe(sc->sc_txpipe_low);
1011 	if (sc->sc_txpipe_normal != NULL)
1012 		usbd_abort_pipe(sc->sc_txpipe_normal);
1013 
1014 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
1015 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1016 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
1017 
1018 			if (data->xfer != NULL) {
1019 				usbd_destroy_xfer(data->xfer);
1020 				data->xfer = NULL;
1021 			}
1022 			if (data->ni != NULL) {
1023 				ieee80211_free_node(data->ni);
1024 				data->ni = NULL;
1025 			}
1026 		}
1027 	}
1028 }
1029 
1030 static int
1031 urtw_media_change(struct ifnet *ifp)
1032 {
1033 	int error;
1034 
1035 	error = ieee80211_media_change(ifp);
1036 	if (error != ENETRESET)
1037 		return error;
1038 
1039 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1040 	    (IFF_UP | IFF_RUNNING))
1041 		if_init(ifp);
1042 
1043 	return 0;
1044 }
1045 
1046 static int
1047 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1048 {
1049 	struct urtw_softc *sc = ic->ic_ifp->if_softc;
1050 
1051 	/*
1052 	 * XXXSMP: This does not wait for the task, if it is in flight,
1053 	 * to complete.  If this code works at all, it must rely on the
1054 	 * kernel lock to serialize with the USB task thread.
1055 	 */
1056 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1057 	callout_stop(&sc->scan_to);
1058 
1059 	/* do it in a process context */
1060 	sc->sc_state = nstate;
1061 	sc->sc_arg = arg;
1062 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
1063 
1064 	return 0;
1065 }
1066 
1067 static usbd_status
1068 urtw_led_init(struct urtw_softc *sc)
1069 {
1070 	uint32_t rev;
1071 	usbd_status error;
1072 
1073 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1074 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1075 	if (error != 0)
1076 		goto fail;
1077 
1078 	switch (rev & URTW_EPROM_CID_MASK) {
1079 	case URTW_EPROM_CID_ALPHA0:
1080 		sc->sc_strategy = URTW_SW_LED_MODE1;
1081 		break;
1082 	case URTW_EPROM_CID_SERCOMM_PS:
1083 		sc->sc_strategy = URTW_SW_LED_MODE3;
1084 		break;
1085 	case URTW_EPROM_CID_HW_LED:
1086 		sc->sc_strategy = URTW_HW_LED;
1087 		break;
1088 	case URTW_EPROM_CID_RSVD0:
1089 	case URTW_EPROM_CID_RSVD1:
1090 	default:
1091 		sc->sc_strategy = URTW_SW_LED_MODE0;
1092 		break;
1093 	}
1094 
1095 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1096 
1097 fail:
1098 	return error;
1099 }
1100 
1101 static usbd_status
1102 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1103     uint16_t data)
1104 {
1105 	usb_device_request_t req;
1106 
1107 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1108 	req.bRequest = URTW_8187_SETREGS_REQ;
1109 	USETW(req.wValue, addr);
1110 	USETW(req.wIndex, index);
1111 	USETW(req.wLength, sizeof(uint16_t));
1112 
1113 	return usbd_do_request(sc->sc_udev, &req, &data);
1114 }
1115 
1116 static usbd_status
1117 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1118 {
1119 	int i;
1120 	int16_t bit;
1121 	uint8_t rlen = 12, wlen = 6;
1122 	uint16_t o1, o2, o3, tmp;
1123 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1124 	uint32_t mask = 0x80000000, value = 0;
1125 	usbd_status error;
1126 
1127 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1128 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1129 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1130 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1131 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1132 	o1 &= ~0xf;
1133 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1134 	DELAY(5);
1135 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1136 	DELAY(5);
1137 
1138 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1139 		bit = ((d2w & mask) != 0) ? 1 : 0;
1140 
1141 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1142 		DELAY(2);
1143 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1144 		    URTW_BB_HOST_BANG_CLK);
1145 		DELAY(2);
1146 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1147 		    URTW_BB_HOST_BANG_CLK);
1148 		DELAY(2);
1149 		mask = mask >> 1;
1150 		if (i == 2)
1151 			break;
1152 		bit = ((d2w & mask) != 0) ? 1 : 0;
1153 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1154 		    URTW_BB_HOST_BANG_CLK);
1155 		DELAY(2);
1156 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1157 		    URTW_BB_HOST_BANG_CLK);
1158 		DELAY(2);
1159 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1160 		DELAY(1);
1161 	}
1162 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1163 	    URTW_BB_HOST_BANG_CLK);
1164 	DELAY(2);
1165 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1166 	DELAY(2);
1167 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1168 	DELAY(2);
1169 
1170 	mask = 0x800;
1171 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1172 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1173 		    o1 | URTW_BB_HOST_BANG_RW);
1174 		DELAY(2);
1175 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1176 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1177 		DELAY(2);
1178 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1179 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1180 		DELAY(2);
1181 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1182 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1183 		DELAY(2);
1184 
1185 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1186 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1187 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1188 		    o1 | URTW_BB_HOST_BANG_RW);
1189 		DELAY(2);
1190 	}
1191 
1192 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1193 	    URTW_BB_HOST_BANG_RW);
1194 	DELAY(2);
1195 
1196 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1197 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1198 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1199 
1200 	if (data != NULL)
1201 		*data = value;
1202 fail:
1203 	return error;
1204 }
1205 
1206 static usbd_status
1207 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1208 {
1209 	uint16_t d80, d82, d84;
1210 	usbd_status error;
1211 
1212 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1213 	d80 &= 0xfff3;
1214 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1215 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1216 	d84 &= 0xfff0;
1217 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1218 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1219 	DELAY(10);
1220 
1221 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1222 	DELAY(2);
1223 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1224 	DELAY(10);
1225 
1226 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1227 	if (error != 0)
1228 		goto fail;
1229 
1230 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1231 	DELAY(10);
1232 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1233 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1234 	usbd_delay_ms(sc->sc_udev, 2);
1235 fail:
1236 	return error;
1237 }
1238 
1239 static usbd_status
1240 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1241 {
1242 	uint32_t data;
1243 	usbd_status error;
1244 
1245 	*ret = 1;
1246 
1247 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1248 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1249 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1250 	usbd_delay_ms(sc->sc_udev, 500);
1251 
1252 	urtw_8225_write(sc, 0x0, 0x1b7);
1253 
1254 	error = urtw_8225_read(sc, 0x8, &data);
1255 	if (error != 0)
1256 		goto fail;
1257 	if (data != 0x588)
1258 		*ret = 0;
1259 	else {
1260 		error = urtw_8225_read(sc, 0x9, &data);
1261 		if (error != 0)
1262 			goto fail;
1263 		if (data != 0x700)
1264 			*ret = 0;
1265 	}
1266 
1267 	urtw_8225_write(sc, 0x0, 0xb7);
1268 fail:
1269 	return error;
1270 }
1271 
1272 static usbd_status
1273 urtw_get_rfchip(struct urtw_softc *sc)
1274 {
1275 	struct urtw_rf *rf = &sc->sc_rf;
1276 	int ret;
1277 	uint32_t data;
1278 	usbd_status error;
1279 
1280 	rf->rf_sc = sc;
1281 
1282 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1283 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1284 		if (error != 0)
1285 			return error;
1286 		switch (data & 0xff) {
1287 		case URTW_EPROM_RFCHIPID_RTL8225U:
1288 			error = urtw_8225_isv2(sc, &ret);
1289 			if (error != 0)
1290 				goto fail;
1291 			if (ret == 0) {
1292 				rf->init = urtw_8225_rf_init;
1293 				rf->set_chan = urtw_8225_rf_set_chan;
1294 				rf->set_sens = urtw_8225_rf_set_sens;
1295 				printf(", RFv1");
1296 			} else {
1297 				rf->init = urtw_8225v2_rf_init;
1298 				rf->set_chan = urtw_8225v2_rf_set_chan;
1299 				rf->set_sens = NULL;
1300 				printf(", RFv2");
1301 			}
1302 			break;
1303 		default:
1304 			goto fail;
1305 		}
1306 	} else {
1307 		rf->init = urtw_8225v2_b_rf_init;
1308 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1309 		rf->set_sens = NULL;
1310 	}
1311 
1312 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1313 	rf->sens = URTW_8225_RF_DEF_SENS;
1314 
1315 	return 0;
1316 
1317 fail:
1318 	aprint_error(": unsupported RF chip %d", data & 0xff);
1319 	return USBD_INVAL;
1320 }
1321 
1322 static usbd_status
1323 urtw_get_txpwr(struct urtw_softc *sc)
1324 {
1325 	int i, j;
1326 	uint32_t data;
1327 	usbd_status error;
1328 
1329 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1330 	if (error != 0)
1331 		goto fail;
1332 	sc->sc_txpwr_cck_base = data & 0xf;
1333 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1334 
1335 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1336 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1337 		if (error != 0)
1338 			goto fail;
1339 		sc->sc_txpwr_cck[i] = data & 0xf;
1340 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1341 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1342 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1343 	}
1344 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1345 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1346 		if (error != 0)
1347 			goto fail;
1348 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1349 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1350 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1351 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1352 	}
1353 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1354 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1355 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1356 			    &data);
1357 			if (error != 0)
1358 				goto fail;
1359 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1360 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1361 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1362 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1363 			    (data & 0xf000) >> 12;
1364 		}
1365 	} else {
1366 		/* Channel 11. */
1367 		error = urtw_eprom_read32(sc, 0x1b, &data);
1368 		if (error != 0)
1369 			goto fail;
1370 		sc->sc_txpwr_cck[11] = data & 0xf;
1371 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1372 
1373 		/* Channel 12. */
1374 		error = urtw_eprom_read32(sc, 0xa, &data);
1375 		if (error != 0)
1376 			goto fail;
1377 		sc->sc_txpwr_cck[12] = data & 0xf;
1378 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1379 
1380 		/* Channel 13, 14. */
1381 		error = urtw_eprom_read32(sc, 0x1c, &data);
1382 		if (error != 0)
1383 			goto fail;
1384 		sc->sc_txpwr_cck[13] = data & 0xf;
1385 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1386 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1387 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1388 	}
1389 fail:
1390 	return error;
1391 }
1392 
1393 static usbd_status
1394 urtw_get_macaddr(struct urtw_softc *sc)
1395 {
1396 	struct ieee80211com *ic = &sc->sc_ic;
1397 	usbd_status error;
1398 	uint32_t data;
1399 
1400 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1401 	if (error != 0)
1402 		goto fail;
1403 	ic->ic_myaddr[0] = data & 0xff;
1404 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1405 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1406 	if (error != 0)
1407 		goto fail;
1408 	ic->ic_myaddr[2] = data & 0xff;
1409 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1410 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1411 	if (error != 0)
1412 		goto fail;
1413 	ic->ic_myaddr[4] = data & 0xff;
1414 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1415 fail:
1416 	return error;
1417 }
1418 
1419 static usbd_status
1420 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1421 {
1422 #define URTW_READCMD_LEN		3
1423 	int addrlen, i;
1424 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1425 	usbd_status error;
1426 
1427 	/* NB: make sure the buffer is initialized */
1428 	*data = 0;
1429 
1430 	/* enable EPROM programming */
1431 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1432 	DELAY(URTW_EPROM_DELAY);
1433 
1434 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1435 	if (error != 0)
1436 		goto fail;
1437 	error = urtw_eprom_ck(sc);
1438 	if (error != 0)
1439 		goto fail;
1440 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1441 	if (error != 0)
1442 		goto fail;
1443 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1444 		addrlen = 8;
1445 		addrstr[0] = addr & (1 << 7);
1446 		addrstr[1] = addr & (1 << 6);
1447 		addrstr[2] = addr & (1 << 5);
1448 		addrstr[3] = addr & (1 << 4);
1449 		addrstr[4] = addr & (1 << 3);
1450 		addrstr[5] = addr & (1 << 2);
1451 		addrstr[6] = addr & (1 << 1);
1452 		addrstr[7] = addr & (1 << 0);
1453 	} else {
1454 		addrlen=6;
1455 		addrstr[0] = addr & (1 << 5);
1456 		addrstr[1] = addr & (1 << 4);
1457 		addrstr[2] = addr & (1 << 3);
1458 		addrstr[3] = addr & (1 << 2);
1459 		addrstr[4] = addr & (1 << 1);
1460 		addrstr[5] = addr & (1 << 0);
1461 	}
1462 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1463 	if (error != 0)
1464 		goto fail;
1465 
1466 	error = urtw_eprom_writebit(sc, 0);
1467 	if (error != 0)
1468 		goto fail;
1469 
1470 	for (i = 0; i < 16; i++) {
1471 		error = urtw_eprom_ck(sc);
1472 		if (error != 0)
1473 			goto fail;
1474 		error = urtw_eprom_readbit(sc, &data16);
1475 		if (error != 0)
1476 			goto fail;
1477 
1478 		(*data) |= (data16 << (15 - i));
1479 	}
1480 
1481 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1482 	if (error != 0)
1483 		goto fail;
1484 	error = urtw_eprom_ck(sc);
1485 	if (error != 0)
1486 		goto fail;
1487 
1488 	/* now disable EPROM programming */
1489 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1490 fail:
1491 	return error;
1492 #undef URTW_READCMD_LEN
1493 }
1494 
1495 static usbd_status
1496 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1497 {
1498 	uint8_t data8;
1499 	usbd_status error;
1500 
1501 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1502 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1503 	DELAY(URTW_EPROM_DELAY);
1504 
1505 fail:
1506 	return error;
1507 }
1508 
1509 static usbd_status
1510 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1511 {
1512 	int i = 0;
1513 	usbd_status error = 0;
1514 
1515 	for (i = 0; i < buflen; i++) {
1516 		error = urtw_eprom_writebit(sc, buf[i]);
1517 		if (error != 0)
1518 			goto fail;
1519 		error = urtw_eprom_ck(sc);
1520 		if (error != 0)
1521 			goto fail;
1522 	}
1523 fail:
1524 	return error;
1525 }
1526 
1527 static usbd_status
1528 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1529 {
1530 	uint8_t data;
1531 	usbd_status error;
1532 
1533 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1534 	if (bit != 0)
1535 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1536 	else
1537 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1538 	DELAY(URTW_EPROM_DELAY);
1539 fail:
1540 	return error;
1541 }
1542 
1543 static usbd_status
1544 urtw_eprom_ck(struct urtw_softc *sc)
1545 {
1546 	uint8_t data;
1547 	usbd_status error;
1548 
1549 	/* masking */
1550 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1551 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1552 	DELAY(URTW_EPROM_DELAY);
1553 	/* unmasking */
1554 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1555 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1556 	DELAY(URTW_EPROM_DELAY);
1557 fail:
1558 	return error;
1559 }
1560 
1561 static usbd_status
1562 urtw_eprom_cs(struct urtw_softc *sc, int able)
1563 {
1564 	uint8_t data;
1565 	usbd_status error;
1566 
1567 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1568 	if (able == URTW_EPROM_ENABLE)
1569 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1570 	else
1571 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1572 	DELAY(URTW_EPROM_DELAY);
1573 fail:
1574 	return error;
1575 }
1576 
1577 static usbd_status
1578 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1579 {
1580 	usb_device_request_t req;
1581 	usbd_status error;
1582 
1583 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1584 	req.bRequest = URTW_8187_GETREGS_REQ;
1585 	USETW(req.wValue, val | 0xff00);
1586 	USETW(req.wIndex, idx & 0x03);
1587 	USETW(req.wLength, sizeof(uint8_t));
1588 
1589 	error = usbd_do_request(sc->sc_udev, &req, data);
1590 	return error;
1591 }
1592 
1593 static usbd_status
1594 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1595 {
1596 	usb_device_request_t req;
1597 	usbd_status error;
1598 
1599 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1600 	req.bRequest = URTW_8187_GETREGS_REQ;
1601 	USETW(req.wValue, val | 0xfe00);
1602 	USETW(req.wIndex, 0);
1603 	USETW(req.wLength, sizeof(uint8_t));
1604 
1605 	error = usbd_do_request(sc->sc_udev, &req, data);
1606 	return error;
1607 }
1608 
1609 static usbd_status
1610 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1611 {
1612 	usb_device_request_t req;
1613 	usbd_status error;
1614 
1615 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1616 	req.bRequest = URTW_8187_GETREGS_REQ;
1617 	USETW(req.wValue, val | 0xff00);
1618 	USETW(req.wIndex, idx & 0x03);
1619 	USETW(req.wLength, sizeof(uint16_t));
1620 
1621 	error = usbd_do_request(sc->sc_udev, &req, data);
1622 	return error;
1623 }
1624 
1625 static usbd_status
1626 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1627 {
1628 	usb_device_request_t req;
1629 	usbd_status error;
1630 
1631 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1632 	req.bRequest = URTW_8187_GETREGS_REQ;
1633 	USETW(req.wValue, val | 0xff00);
1634 	USETW(req.wIndex, idx & 0x03);
1635 	USETW(req.wLength, sizeof(uint32_t));
1636 
1637 	error = usbd_do_request(sc->sc_udev, &req, data);
1638 	return error;
1639 }
1640 
1641 static usbd_status
1642 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1643 {
1644 	usb_device_request_t req;
1645 
1646 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1647 	req.bRequest = URTW_8187_SETREGS_REQ;
1648 	USETW(req.wValue, val | 0xff00);
1649 	USETW(req.wIndex, idx & 0x03);
1650 	USETW(req.wLength, sizeof(uint8_t));
1651 
1652 	return usbd_do_request(sc->sc_udev, &req, &data);
1653 }
1654 
1655 static usbd_status
1656 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1657 {
1658 	usb_device_request_t req;
1659 
1660 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1661 	req.bRequest = URTW_8187_SETREGS_REQ;
1662 	USETW(req.wValue, val | 0xfe00);
1663 	USETW(req.wIndex, 0);
1664 	USETW(req.wLength, sizeof(uint8_t));
1665 
1666 	return usbd_do_request(sc->sc_udev, &req, &data);
1667 }
1668 
1669 static usbd_status
1670 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1671 {
1672 	usb_device_request_t req;
1673 
1674 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1675 	req.bRequest = URTW_8187_SETREGS_REQ;
1676 	USETW(req.wValue, val | 0xff00);
1677 	USETW(req.wIndex, idx & 0x03);
1678 	USETW(req.wLength, sizeof(uint16_t));
1679 
1680 	return usbd_do_request(sc->sc_udev, &req, &data);
1681 }
1682 
1683 static usbd_status
1684 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1685 {
1686 	usb_device_request_t req;
1687 
1688 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1689 	req.bRequest = URTW_8187_SETREGS_REQ;
1690 	USETW(req.wValue, val | 0xff00);
1691 	USETW(req.wIndex, idx & 0x03);
1692 	USETW(req.wLength, sizeof(uint32_t));
1693 
1694 	return usbd_do_request(sc->sc_udev, &req, &data);
1695 }
1696 
1697 static usbd_status
1698 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1699 {
1700 	uint8_t data;
1701 	usbd_status error;
1702 
1703 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1704 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1705 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1706 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1707 fail:
1708 	return error;
1709 }
1710 
1711 static usbd_status
1712 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1713 {
1714 	uint8_t data;
1715 	usbd_status error;
1716 
1717 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1718 	if (error)
1719 		goto fail;
1720 
1721 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1722 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1723 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1724 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1725 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1726 
1727 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1728 	if (error)
1729 		goto fail;
1730 fail:
1731 	return error;
1732 }
1733 
1734 static usbd_status
1735 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1736 {
1737 	uint8_t data;
1738 	usbd_status error;
1739 
1740 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1741 	if (error)
1742 		goto fail;
1743 
1744 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1745 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1746 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1747 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1748 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1749 
1750 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1751 	if (error)
1752 		goto fail;
1753 fail:
1754 	return error;
1755 }
1756 
1757 static usbd_status
1758 urtw_intr_disable(struct urtw_softc *sc)
1759 {
1760 	usbd_status error;
1761 
1762 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1763 
1764 fail:
1765 	return error;
1766 }
1767 
1768 static usbd_status
1769 urtw_reset(struct urtw_softc *sc)
1770 {
1771 	uint8_t data;
1772 	usbd_status error;
1773 
1774 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1775 	if (error)
1776 		goto fail;
1777 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1778 	if (error)
1779 		goto fail;
1780 
1781 	error = urtw_intr_disable(sc);
1782 	if (error)
1783 		goto fail;
1784 	usbd_delay_ms(sc->sc_udev, 100);
1785 
1786 	error = urtw_write8e(sc, 0x18, 0x10);
1787 	if (error != 0)
1788 		goto fail;
1789 	error = urtw_write8e(sc, 0x18, 0x11);
1790 	if (error != 0)
1791 		goto fail;
1792 	error = urtw_write8e(sc, 0x18, 0x00);
1793 	if (error != 0)
1794 		goto fail;
1795 	usbd_delay_ms(sc->sc_udev, 100);
1796 
1797 	urtw_read8_m(sc, URTW_CMD, &data);
1798 	data = (data & 2) | URTW_CMD_RST;
1799 	urtw_write8_m(sc, URTW_CMD, data);
1800 	usbd_delay_ms(sc->sc_udev, 100);
1801 
1802 	urtw_read8_m(sc, URTW_CMD, &data);
1803 	if (data & URTW_CMD_RST) {
1804 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
1805 		goto fail;
1806 	}
1807 
1808 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1809 	if (error)
1810 		goto fail;
1811 	usbd_delay_ms(sc->sc_udev, 100);
1812 
1813 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1814 	if (error)
1815 		goto fail;
1816 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1817 	if (error)
1818 		goto fail;
1819 fail:
1820 	return error;
1821 }
1822 
1823 static usbd_status
1824 urtw_led_on(struct urtw_softc *sc, int type)
1825 {
1826 	usbd_status error;
1827 
1828 	if (type == URTW_LED_GPIO) {
1829 		switch (sc->sc_gpio_ledpin) {
1830 		case URTW_LED_PIN_GPIO0:
1831 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1832 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1833 			break;
1834 		default:
1835 			panic("unsupported LED PIN type %#x",
1836 			    sc->sc_gpio_ledpin);
1837 			/* NOTREACHED */
1838 		}
1839 	} else {
1840 		panic("unsupported LED type %#x", type);
1841 		/* NOTREACHED */
1842 	}
1843 
1844 	sc->sc_gpio_ledon = 1;
1845 fail:
1846 	return error;
1847 }
1848 
1849 static usbd_status
1850 urtw_led_off(struct urtw_softc *sc, int type)
1851 {
1852 	usbd_status error;
1853 
1854 	if (type == URTW_LED_GPIO) {
1855 		switch (sc->sc_gpio_ledpin) {
1856 		case URTW_LED_PIN_GPIO0:
1857 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1858 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1859 			break;
1860 		default:
1861 			panic("unsupported LED PIN type %#x",
1862 			    sc->sc_gpio_ledpin);
1863 			/* NOTREACHED */
1864 		}
1865 	} else {
1866 		panic("unsupported LED type %#x", type);
1867 		/* NOTREACHED */
1868 	}
1869 
1870 	sc->sc_gpio_ledon = 0;
1871 
1872 fail:
1873 	return error;
1874 }
1875 
1876 static usbd_status
1877 urtw_led_mode0(struct urtw_softc *sc, int mode)
1878 {
1879 	switch (mode) {
1880 	case URTW_LED_CTL_POWER_ON:
1881 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1882 		break;
1883 	case URTW_LED_CTL_TX:
1884 		if (sc->sc_gpio_ledinprogress == 1)
1885 			return 0;
1886 
1887 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1888 		sc->sc_gpio_blinktime = 2;
1889 		break;
1890 	case URTW_LED_CTL_LINK:
1891 		sc->sc_gpio_ledstate = URTW_LED_ON;
1892 		break;
1893 	default:
1894 		panic("unsupported LED mode %#x", mode);
1895 		/* NOTREACHED */
1896 	}
1897 
1898 	switch (sc->sc_gpio_ledstate) {
1899 	case URTW_LED_ON:
1900 		if (sc->sc_gpio_ledinprogress != 0)
1901 			break;
1902 		urtw_led_on(sc, URTW_LED_GPIO);
1903 		break;
1904 	case URTW_LED_BLINK_NORMAL:
1905 		if (sc->sc_gpio_ledinprogress != 0)
1906 			break;
1907 		sc->sc_gpio_ledinprogress = 1;
1908 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1909 			URTW_LED_OFF : URTW_LED_ON;
1910 		if (!sc->sc_dying)
1911 			callout_schedule(&sc->sc_led_ch, mstohz(100));
1912 		break;
1913 	case URTW_LED_POWER_ON_BLINK:
1914 		urtw_led_on(sc, URTW_LED_GPIO);
1915 		usbd_delay_ms(sc->sc_udev, 100);
1916 		urtw_led_off(sc, URTW_LED_GPIO);
1917 		break;
1918 	default:
1919 		panic("unknown LED status %#x", sc->sc_gpio_ledstate);
1920 		/* NOTREACHED */
1921 	}
1922 	return 0;
1923 }
1924 
1925 static usbd_status
1926 urtw_led_mode1(struct urtw_softc *sc, int mode)
1927 {
1928 	return USBD_INVAL;
1929 }
1930 
1931 static usbd_status
1932 urtw_led_mode2(struct urtw_softc *sc, int mode)
1933 {
1934 	return USBD_INVAL;
1935 }
1936 
1937 static usbd_status
1938 urtw_led_mode3(struct urtw_softc *sc, int mode)
1939 {
1940 	return USBD_INVAL;
1941 }
1942 
1943 static void
1944 urtw_ledusbtask(void *arg)
1945 {
1946 	struct urtw_softc *sc = arg;
1947 
1948 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1949 		panic("could not process a LED strategy %#x", sc->sc_strategy);
1950 
1951 	urtw_led_blink(sc);
1952 }
1953 
1954 static void
1955 urtw_ledtask(void *arg)
1956 {
1957 	struct urtw_softc *sc = arg;
1958 
1959 	/*
1960 	 * NB: to change a status of the led we need at least a sleep so we
1961 	 * can't do it here
1962 	 */
1963 	usb_add_task(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER);
1964 }
1965 
1966 static usbd_status
1967 urtw_led_ctl(struct urtw_softc *sc, int mode)
1968 {
1969 	usbd_status error = 0;
1970 
1971 	switch (sc->sc_strategy) {
1972 	case URTW_SW_LED_MODE0:
1973 		error = urtw_led_mode0(sc, mode);
1974 		break;
1975 	case URTW_SW_LED_MODE1:
1976 		error = urtw_led_mode1(sc, mode);
1977 		break;
1978 	case URTW_SW_LED_MODE2:
1979 		error = urtw_led_mode2(sc, mode);
1980 		break;
1981 	case URTW_SW_LED_MODE3:
1982 		error = urtw_led_mode3(sc, mode);
1983 		break;
1984 	default:
1985 		panic("unsupported LED mode %d", sc->sc_strategy);
1986 		/* NOTREACHED */
1987 	}
1988 
1989 	return error;
1990 }
1991 
1992 static usbd_status
1993 urtw_led_blink(struct urtw_softc *sc)
1994 {
1995 	uint8_t ing = 0;
1996 
1997 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1998 		(void)urtw_led_on(sc, URTW_LED_GPIO);
1999 	else
2000 		(void)urtw_led_off(sc, URTW_LED_GPIO);
2001 	sc->sc_gpio_blinktime--;
2002 	if (sc->sc_gpio_blinktime == 0)
2003 		ing = 1;
2004 	else {
2005 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
2006 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
2007 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
2008 			ing = 1;
2009 	}
2010 	if (ing == 1) {
2011 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2012 		    sc->sc_gpio_ledon == 0)
2013 			(void)urtw_led_on(sc, URTW_LED_GPIO);
2014 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2015 		    sc->sc_gpio_ledon == 1)
2016 			(void)urtw_led_off(sc, URTW_LED_GPIO);
2017 
2018 		sc->sc_gpio_blinktime = 0;
2019 		sc->sc_gpio_ledinprogress = 0;
2020 		return 0;
2021 	}
2022 
2023 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2024 	    URTW_LED_ON : URTW_LED_OFF;
2025 
2026 	switch (sc->sc_gpio_ledstate) {
2027 	case URTW_LED_BLINK_NORMAL:
2028 		if (!sc->sc_dying)
2029 			callout_schedule(&sc->sc_led_ch, mstohz(100));
2030 		break;
2031 	default:
2032 		panic("unknown LED status %#x", sc->sc_gpio_ledstate);
2033 		/* NOTREACHED */
2034 	}
2035 	return 0;
2036 }
2037 
2038 static usbd_status
2039 urtw_update_msr(struct urtw_softc *sc)
2040 {
2041 	struct ieee80211com *ic = &sc->sc_ic;
2042 	uint8_t data;
2043 	usbd_status error;
2044 
2045 	urtw_read8_m(sc, URTW_MSR, &data);
2046 	data &= ~URTW_MSR_LINK_MASK;
2047 
2048 	/* Should always be set. */
2049 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2050 		data |= URTW_MSR_LINK_ENEDCA;
2051 
2052 	if (sc->sc_state == IEEE80211_S_RUN) {
2053 		switch (ic->ic_opmode) {
2054 		case IEEE80211_M_STA:
2055 		case IEEE80211_M_MONITOR:
2056 			data |= URTW_MSR_LINK_STA;
2057 			break;
2058 		default:
2059 			panic("unsupported operation mode %#x",
2060 			    ic->ic_opmode);
2061 			/* NOTREACHED */
2062 		}
2063 	} else
2064 		data |= URTW_MSR_LINK_NONE;
2065 
2066 	urtw_write8_m(sc, URTW_MSR, data);
2067 fail:
2068 	return error;
2069 }
2070 
2071 static uint16_t
2072 urtw_rate2rtl(int rate)
2073 {
2074 	unsigned int i;
2075 
2076 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2077 		if (rate == urtw_ratetable[i].reg)
2078 			return urtw_ratetable[i].val;
2079 	}
2080 
2081 	return 3;
2082 }
2083 
2084 static uint16_t
2085 urtw_rtl2rate(int rate)
2086 {
2087 	unsigned int i;
2088 
2089 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2090 		if (rate == urtw_ratetable[i].val)
2091 			return urtw_ratetable[i].reg;
2092 	}
2093 
2094 	return 0;
2095 }
2096 
2097 static usbd_status
2098 urtw_set_rate(struct urtw_softc *sc)
2099 {
2100 	int i, basic_rate, min_rr_rate, max_rr_rate;
2101 	uint16_t data;
2102 	usbd_status error;
2103 
2104 	basic_rate = urtw_rate2rtl(48);
2105 	min_rr_rate = urtw_rate2rtl(12);
2106 	max_rr_rate = urtw_rate2rtl(48);
2107 
2108 	urtw_write8_m(sc, URTW_RESP_RATE,
2109 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2110 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2111 
2112 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2113 	data &= ~URTW_BRSR_MBR_8185;
2114 
2115 	for (i = 0; i <= basic_rate; i++)
2116 		data |= (1 << i);
2117 
2118 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2119 fail:
2120 	return error;
2121 }
2122 
2123 static usbd_status
2124 urtw_intr_enable(struct urtw_softc *sc)
2125 {
2126 	usbd_status error;
2127 
2128 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2129 fail:
2130 	return error;
2131 }
2132 
2133 static usbd_status
2134 urtw_rx_setconf(struct urtw_softc *sc)
2135 {
2136 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2137 	struct ieee80211com *ic = &sc->sc_ic;
2138 	uint32_t data;
2139 	usbd_status error;
2140 
2141 	urtw_read32_m(sc, URTW_RX, &data);
2142 	data = data &~ URTW_RX_FILTER_MASK;
2143 #if 0
2144 	data = data | URTW_RX_FILTER_CTL;
2145 #endif
2146 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2147 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2148 
2149 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2150 		data = data | URTW_RX_FILTER_ICVERR;
2151 		data = data | URTW_RX_FILTER_PWR;
2152 	}
2153 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2154 		data = data | URTW_RX_FILTER_CRCERR;
2155 
2156 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2157 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2158 		data = data | URTW_RX_FILTER_ALLMAC;
2159 	} else {
2160 		data = data | URTW_RX_FILTER_NICMAC;
2161 		data = data | URTW_RX_CHECK_BSSID;
2162 	}
2163 
2164 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2165 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2166 	data = data &~ URTW_MAX_RX_DMA_MASK;
2167 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2168 
2169 	urtw_write32_m(sc, URTW_RX, data);
2170 fail:
2171 	return error;
2172 }
2173 
2174 static usbd_status
2175 urtw_rx_enable(struct urtw_softc *sc)
2176 {
2177 	int i;
2178 	struct urtw_rx_data *rx_data;
2179 	uint8_t data;
2180 	usbd_status error;
2181 
2182 	/*
2183 	 * Start up the receive pipe.
2184 	 */
2185 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2186 		rx_data = &sc->sc_rx_data[i];
2187 
2188 		usbd_setup_xfer(rx_data->xfer, rx_data, rx_data->buf, MCLBYTES,
2189 		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2190 		error = usbd_transfer(rx_data->xfer);
2191 		if (error != USBD_IN_PROGRESS && error != 0) {
2192 			printf("%s: could not queue Rx transfer\n",
2193 			    device_xname(sc->sc_dev));
2194 			goto fail;
2195 		}
2196 	}
2197 
2198 	error = urtw_rx_setconf(sc);
2199 	if (error != 0)
2200 		goto fail;
2201 
2202 	urtw_read8_m(sc, URTW_CMD, &data);
2203 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2204 fail:
2205 	return error;
2206 }
2207 
2208 static usbd_status
2209 urtw_tx_enable(struct urtw_softc *sc)
2210 {
2211 	uint8_t data8;
2212 	uint32_t data;
2213 	usbd_status error;
2214 
2215 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2216 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2217 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2218 		    URTW_CW_CONF_PERPACKET_RETRY);
2219 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2220 
2221 		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2222 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2223 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2224 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2225 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2226 
2227 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2228 		data &= ~URTW_TX_LOOPBACK_MASK;
2229 		data |= URTW_TX_LOOPBACK_NONE;
2230 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2231 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2232 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2233 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2234 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2235 		data &= ~URTW_TX_SWPLCPLEN;
2236 		data |= URTW_TX_NOICV;
2237 		urtw_write32_m(sc, URTW_TX_CONF, data);
2238 	} else {
2239 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2240 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2241 		    URTW_TX_LONGRETRY;
2242 		urtw_write32_m(sc, URTW_TX_CONF, data);
2243 	}
2244 
2245 	urtw_read8_m(sc, URTW_CMD, &data8);
2246 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2247 fail:
2248 	return error;
2249 }
2250 
2251 static int
2252 urtw_init(struct ifnet *ifp)
2253 {
2254 	struct urtw_softc *sc = ifp->if_softc;
2255 	struct urtw_rf *rf = &sc->sc_rf;
2256 	struct ieee80211com *ic = &sc->sc_ic;
2257 	usbd_status error;
2258 
2259 	urtw_stop(ifp, 0);
2260 
2261 	error = urtw_reset(sc);
2262 	if (error)
2263 		goto fail;
2264 
2265 	urtw_write8_m(sc, 0x85, 0);
2266 	urtw_write8_m(sc, URTW_GPIO, 0);
2267 
2268 	/* for led */
2269 	urtw_write8_m(sc, 0x85, 4);
2270 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2271 	if (error != 0)
2272 		goto fail;
2273 
2274 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2275 	if (error)
2276 		goto fail;
2277 
2278 	/* applying MAC address again. */
2279 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2280 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2281 	if (error)
2282 		goto fail;
2283 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2284 	if (error)
2285 		goto fail;
2286 
2287 	error = urtw_update_msr(sc);
2288 	if (error)
2289 		goto fail;
2290 
2291 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2292 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2293 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2294 	error = urtw_set_rate(sc);
2295 	if (error != 0)
2296 		goto fail;
2297 
2298 	error = rf->init(rf);
2299 	if (error != 0)
2300 		goto fail;
2301 	if (rf->set_sens != NULL)
2302 		rf->set_sens(rf);
2303 
2304 	urtw_write16_m(sc, 0x5e, 1);
2305 	urtw_write16_m(sc, 0xfe, 0x10);
2306 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2307 	urtw_write8_m(sc, 0xff, 0x60);
2308 	urtw_write16_m(sc, 0x5e, 0);
2309 	urtw_write8_m(sc, 0x85, 4);
2310 
2311 	error = urtw_intr_enable(sc);
2312 	if (error != 0)
2313 		goto fail;
2314 
2315 	/* reset softc variables */
2316 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
2317 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
2318 	}
2319 	sc->sc_txtimer = 0;
2320 
2321 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2322 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2323 		if (error != 0) {
2324 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
2325 			    ", err=%s\n", usbd_errstr(error));
2326 			goto fail;
2327 		}
2328 		/* get the first interface handle */
2329 		error = usbd_device2interface_handle(sc->sc_udev,
2330 		    URTW_IFACE_INDEX, &sc->sc_iface);
2331 		if (error != 0) {
2332 			printf("%s: could not get interface handle\n",
2333 			    device_xname(sc->sc_dev));
2334 			goto fail;
2335 		}
2336 		error = urtw_open_pipes(sc);
2337 		if (error != 0)
2338 			goto fail;
2339 		error = urtw_alloc_rx_data_list(sc);
2340 		if (error != 0)
2341 			goto fail;
2342 		error = urtw_alloc_tx_data_list(sc);
2343 		if (error != 0)
2344 			goto fail;
2345 		sc->sc_flags |= URTW_INIT_ONCE;
2346 	}
2347 
2348 	error = urtw_rx_enable(sc);
2349 	if (error != 0)
2350 		goto fail;
2351 	error = urtw_tx_enable(sc);
2352 	if (error != 0)
2353 		goto fail;
2354 
2355 	ifp->if_flags &= ~IFF_OACTIVE;
2356 	ifp->if_flags |= IFF_RUNNING;
2357 
2358 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2359 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2360 	else
2361 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2362 
2363 	return 0;
2364 fail:
2365 	return error;
2366 }
2367 
2368 static int
2369 urtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2370 {
2371 #define IS_RUNNING(ifp) \
2372 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
2373 
2374 	struct urtw_softc *sc = ifp->if_softc;
2375 	struct ieee80211com *ic = &sc->sc_ic;
2376 	int s, error = 0;
2377 
2378 	if (sc->sc_dying)
2379 		return ENXIO;
2380 
2381 	s = splnet();
2382 
2383 	switch (cmd) {
2384 	case SIOCSIFFLAGS:
2385 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2386 			break;
2387 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2388 		case IFF_UP|IFF_RUNNING:
2389 			break;
2390 		case IFF_UP:
2391 			if_init(ifp);
2392 			break;
2393 		case IFF_RUNNING:
2394 			urtw_stop(ifp, 1);
2395 			break;
2396 		case 0:
2397 			break;
2398 		}
2399 		break;
2400 
2401 	case SIOCADDMULTI:
2402 	case SIOCDELMULTI:
2403 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
2404 			error = 0;
2405 		break;
2406 
2407 	default:
2408 		error = ieee80211_ioctl(ic, cmd, data);
2409 		break;
2410 	}
2411 
2412 	if (error == ENETRESET) {
2413 		if (IS_RUNNING(ifp) &&
2414 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2415 			if_init(ifp);
2416 		error = 0;
2417 	}
2418 
2419 	splx(s);
2420 
2421 	return error;
2422 #undef IS_RUNNING
2423 }
2424 
2425 static void
2426 urtw_start(struct ifnet *ifp)
2427 {
2428 	struct urtw_softc *sc = ifp->if_softc;
2429 	struct ieee80211com *ic = &sc->sc_ic;
2430 	struct ieee80211_node *ni;
2431 	struct ether_header *eh;
2432 	struct mbuf *m0;
2433 
2434 	/*
2435 	 * net80211 may still try to send management frames even if the
2436 	 * IFF_RUNNING flag is not set...
2437 	 */
2438 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2439 		return;
2440 
2441 	for (;;) {
2442 		IF_POLL(&ic->ic_mgtq, m0);
2443 		if (m0 != NULL) {
2444 
2445 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2446 			    URTW_TX_DATA_LIST_COUNT) {
2447 				ifp->if_flags |= IFF_OACTIVE;
2448 				break;
2449 			}
2450 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2451 			ni = M_GETCTX(m0, struct ieee80211_node *);
2452 			M_CLEARCTX(m0);
2453 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2454 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2455 			    != 0)
2456 				break;
2457 		} else {
2458 			if (ic->ic_state != IEEE80211_S_RUN)
2459 				break;
2460 			IFQ_POLL(&ifp->if_snd, m0);
2461 			if (m0 == NULL)
2462 				break;
2463 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2464 			    URTW_TX_DATA_LIST_COUNT) {
2465 				ifp->if_flags |= IFF_OACTIVE;
2466 				break;
2467 			}
2468 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2469 			if (m0->m_len < sizeof(struct ether_header) &&
2470 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
2471 				continue;
2472 
2473 			eh = mtod(m0, struct ether_header *);
2474 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2475 			if (ni == NULL) {
2476 				m_freem(m0);
2477 				continue;
2478 			}
2479 			bpf_mtap(ifp, m0, BPF_D_OUT);
2480 			m0 = ieee80211_encap(ic, m0, ni);
2481 			if (m0 == NULL) {
2482 				ieee80211_free_node(ni);
2483 				continue;
2484 			}
2485 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2486 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2487 			    != 0) {
2488 				ieee80211_free_node(ni);
2489 				if_statinc(ifp, if_oerrors);
2490 				break;
2491 			}
2492 		}
2493 		sc->sc_txtimer = 5;
2494 		ifp->if_timer = 1;
2495 	}
2496 }
2497 
2498 static void
2499 urtw_watchdog(struct ifnet *ifp)
2500 {
2501 	struct urtw_softc *sc = ifp->if_softc;
2502 
2503 	ifp->if_timer = 0;
2504 
2505 	if (sc->sc_txtimer > 0) {
2506 		if (--sc->sc_txtimer == 0) {
2507 			printf("%s: device timeout\n", device_xname(sc->sc_dev));
2508 			if_statinc(ifp, if_oerrors);
2509 			return;
2510 		}
2511 		ifp->if_timer = 1;
2512 	}
2513 
2514 	ieee80211_watchdog(&sc->sc_ic);
2515 }
2516 
2517 static void
2518 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2519     usbd_status status)
2520 {
2521 	struct urtw_tx_data *data = priv;
2522 	struct urtw_softc *sc = data->sc;
2523 	struct ieee80211com *ic = &sc->sc_ic;
2524 	struct ifnet *ifp = ic->ic_ifp;
2525 	int s;
2526 
2527 	if (status != USBD_NORMAL_COMPLETION) {
2528 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2529 			return;
2530 
2531 		printf("%s: could not transmit buffer: %s\n",
2532 		    device_xname(sc->sc_dev), usbd_errstr(status));
2533 
2534 		if (status == USBD_STALLED)
2535 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2536 
2537 		if_statinc(ifp, if_oerrors);
2538 		return;
2539 	}
2540 
2541 	s = splnet();
2542 
2543 	ieee80211_free_node(data->ni);
2544 	data->ni = NULL;
2545 
2546 	sc->sc_txtimer = 0;
2547 	if_statinc(ifp, if_opackets);
2548 
2549 	sc->sc_tx_queued[URTW_PRIORITY_LOW]--;
2550 	ifp->if_flags &= ~IFF_OACTIVE;
2551 	urtw_start(ifp);
2552 
2553 	splx(s);
2554 }
2555 
2556 static void
2557 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2558     usbd_status status)
2559 {
2560 	struct urtw_tx_data *data = priv;
2561 	struct urtw_softc *sc = data->sc;
2562 	struct ieee80211com *ic = &sc->sc_ic;
2563 	struct ifnet *ifp = ic->ic_ifp;
2564 	int s;
2565 
2566 	if (status != USBD_NORMAL_COMPLETION) {
2567 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2568 			return;
2569 
2570 		printf("%s: could not transmit buffer: %s\n",
2571 		    device_xname(sc->sc_dev), usbd_errstr(status));
2572 
2573 		if (status == USBD_STALLED)
2574 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2575 
2576 		if_statinc(ifp, if_oerrors);
2577 		return;
2578 	}
2579 
2580 	s = splnet();
2581 
2582 	ieee80211_free_node(data->ni);
2583 	data->ni = NULL;
2584 
2585 	sc->sc_txtimer = 0;
2586 	if_statinc(ifp, if_opackets);
2587 
2588 	sc->sc_tx_queued[URTW_PRIORITY_NORMAL]--;
2589 	ifp->if_flags &= ~IFF_OACTIVE;
2590 	urtw_start(ifp);
2591 
2592 	splx(s);
2593 }
2594 
2595 static int
2596 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2597     int prior)
2598 {
2599 	struct ieee80211com *ic = &sc->sc_ic;
2600 	struct urtw_tx_data *data;
2601 	struct ieee80211_frame *wh;
2602 	struct ieee80211_key *k;
2603 	usbd_status error;
2604 	int xferlen;
2605 
2606 	wh = mtod(m0, struct ieee80211_frame *);
2607 
2608 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2609 		k = ieee80211_crypto_encap(ic, ni, m0);
2610 		if (k == NULL) {
2611 			m_freem(m0);
2612 			return ENOBUFS;
2613 		}
2614 		/* packet header may have moved, reset our local pointer */
2615 		wh = mtod(m0, struct ieee80211_frame *);
2616 	}
2617 
2618 	if (sc->sc_drvbpf != NULL) {
2619 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2620 
2621 		tap->wt_flags = 0;
2622 		tap->wt_rate = 0;
2623 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2624 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2625 
2626 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
2627 	}
2628 
2629 	if (sc->sc_hwrev & URTW_HWREV_8187)
2630 		xferlen = m0->m_pkthdr.len + 4 * 3;
2631 	else
2632 		xferlen = m0->m_pkthdr.len + 4 * 8;
2633 
2634 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2635 		xferlen += 1;
2636 
2637 	data = &sc->sc_tx_data[prior][sc->sc_txidx[prior]];
2638 	sc->sc_txidx[prior] =
2639 	    (sc->sc_txidx[prior] + 1) % URTW_TX_DATA_LIST_COUNT;
2640 
2641 	memset(data->buf, 0, URTW_TX_MAXSIZE);
2642 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2643 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2644 	data->buf[1] |= (1 << 7);
2645 
2646 	/* XXX sc_preamble_mode is always 2. */
2647 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2648 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2649 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2650 		data->buf[2] |= 1;
2651 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2652 	    prior == URTW_PRIORITY_LOW)
2653 		panic("TODO tx.");
2654 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2655 		data->buf[2] |= (1 << 1);
2656 	/* RTS rate - 10 means we use a basic rate. */
2657 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2658 	/*
2659 	 * XXX currently TX rate control depends on the rate value of
2660 	 * RX descriptor because I don't know how to we can control TX rate
2661 	 * in more smart way.  Please fix me you find a thing.
2662 	 */
2663 	data->buf[3] = sc->sc_currate;
2664 	if (prior == URTW_PRIORITY_NORMAL) {
2665 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2666 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2667 		else if (ic->ic_fixed_rate != -1)
2668 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2669 	}
2670 
2671 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2672 		data->buf[8] = 3;		/* CW minimum */
2673 		data->buf[8] |= (7 << 4);	/* CW maximum */
2674 		data->buf[9] |= 11;		/* retry limitation */
2675 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2676 	} else {
2677 		data->buf[21] |= 11;		/* retry limitation */
2678 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2679 	}
2680 
2681 	data->ni = ni;
2682 
2683 	/* mbuf is no longer needed. */
2684 	m_freem(m0);
2685 
2686 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2687 	    USBD_FORCE_SHORT_XFER, URTW_DATA_TIMEOUT,
2688 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2689 	error = usbd_transfer(data->xfer);
2690 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2691 		printf("%s: could not send frame: %s\n",
2692 		    device_xname(sc->sc_dev), usbd_errstr(error));
2693 		return EIO;
2694 	}
2695 
2696 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2697 	if (error != 0)
2698 		printf("%s: could not control LED (%d)\n",
2699 		    device_xname(sc->sc_dev), error);
2700 
2701 	sc->sc_tx_queued[prior]++;
2702 
2703 	return 0;
2704 }
2705 
2706 static usbd_status
2707 urtw_8225_usb_init(struct urtw_softc *sc)
2708 {
2709 	uint8_t data;
2710 	usbd_status error;
2711 
2712 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2713 	urtw_write8_m(sc, URTW_GPIO, 0);
2714 	error = urtw_read8e(sc, 0x53, &data);
2715 	if (error)
2716 		goto fail;
2717 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2718 	if (error)
2719 		goto fail;
2720 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2721 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2722 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2723 
2724 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2725 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2726 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2727 
2728 	usbd_delay_ms(sc->sc_udev, 500);
2729 fail:
2730 	return error;
2731 }
2732 
2733 static usbd_status
2734 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2735 {
2736 	usbd_status error = 0;
2737 
2738 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2739 fail:
2740 	return error;
2741 }
2742 
2743 static usbd_status
2744 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2745 {
2746 	uint32_t phyw;
2747 	usbd_status error;
2748 
2749 	phyw = ((data << 8) | (addr | 0x80));
2750 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2751 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2752 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2753 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2754 	/*
2755 	 * Delay removed from 8185 to 8187.
2756 	 * usbd_delay_ms(sc->sc_udev, 1);
2757 	 */
2758 fail:
2759 	return error;
2760 }
2761 
2762 static usbd_status
2763 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2764 {
2765 	data = data & 0xff;
2766 	return urtw_8187_write_phy(sc, addr, data);
2767 }
2768 
2769 static usbd_status
2770 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2771 {
2772 	data = data & 0xff;
2773 	return urtw_8187_write_phy(sc, addr, data | 0x10000);
2774 }
2775 
2776 static usbd_status
2777 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2778 {
2779 	usbd_status error;
2780 
2781 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2782 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2783 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2784 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2785 fail:
2786 	return error;
2787 }
2788 
2789 static usbd_status
2790 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2791 {
2792 	int i, idx, set;
2793 	uint8_t *cck_pwltable;
2794 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2795 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2796 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2797 	usbd_status error;
2798 
2799 	cck_pwrlvl_max = 11;
2800 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2801 	ofdm_pwrlvl_min = 10;
2802 
2803 	/* CCK power setting */
2804 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2805 	idx = cck_pwrlvl % 6;
2806 	set = cck_pwrlvl / 6;
2807 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2808 	    urtw_8225_txpwr_cck;
2809 
2810 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2811 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2812 	for (i = 0; i < 8; i++) {
2813 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2814 		    cck_pwltable[idx * 8 + i]);
2815 	}
2816 	usbd_delay_ms(sc->sc_udev, 1);
2817 
2818 	/* OFDM power setting */
2819 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2820 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2821 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2822 
2823 	idx = ofdm_pwrlvl % 6;
2824 	set = ofdm_pwrlvl / 6;
2825 
2826 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2827 	if (error)
2828 		goto fail;
2829 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2830 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2831 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2832 
2833 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2834 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2835 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2836 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2837 	usbd_delay_ms(sc->sc_udev, 1);
2838 fail:
2839 	return error;
2840 }
2841 
2842 static usbd_status
2843 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2844 {
2845 	usbd_status error;
2846 
2847 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2848 	usbd_delay_ms(sc->sc_udev, 1);
2849 fail:
2850 	return error;
2851 }
2852 
2853 static usbd_status
2854 urtw_8225_rf_init(struct urtw_rf *rf)
2855 {
2856 	struct urtw_softc *sc = rf->rf_sc;
2857 	unsigned int i;
2858 	uint16_t data;
2859 	usbd_status error;
2860 
2861 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2862 	if (error)
2863 		goto fail;
2864 
2865 	error = urtw_8225_usb_init(sc);
2866 	if (error)
2867 		goto fail;
2868 
2869 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2870 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2871 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2872 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2873 
2874 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2875 	if (error)
2876 		goto fail;
2877 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2878 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2879 	if (error)
2880 		goto fail;
2881 
2882 	error = urtw_8185_rf_pins_enable(sc);
2883 	if (error)
2884 		goto fail;
2885 
2886 	usbd_delay_ms(sc->sc_udev, 500);
2887 
2888 	for (i = 0; i < __arraycount(urtw_8225_rf_part1); i++) {
2889 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2890 		    urtw_8225_rf_part1[i].val);
2891 	}
2892 	usbd_delay_ms(sc->sc_udev, 50);
2893 	urtw_8225_write(sc, 0x2, 0xc4d);
2894 	usbd_delay_ms(sc->sc_udev, 200);
2895 	urtw_8225_write(sc, 0x2, 0x44d);
2896 	usbd_delay_ms(sc->sc_udev, 200);
2897 	urtw_8225_write(sc, 0x0, 0x127);
2898 
2899 	for (i = 0; i < __arraycount(urtw_8225_rxgain); i++) {
2900 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2901 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2902 	}
2903 
2904 	urtw_8225_write(sc, 0x0, 0x27);
2905 	urtw_8225_write(sc, 0x0, 0x22f);
2906 
2907 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
2908 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2909 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2910 	}
2911 
2912 	for (i = 0; i < __arraycount(urtw_8225_rf_part2); i++) {
2913 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2914 		    urtw_8225_rf_part2[i].val);
2915 		usbd_delay_ms(sc->sc_udev, 1);
2916 	}
2917 
2918 	error = urtw_8225_setgain(sc, 4);
2919 	if (error)
2920 		goto fail;
2921 
2922 	for (i = 0; i < __arraycount(urtw_8225_rf_part3); i++) {
2923 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2924 		    urtw_8225_rf_part3[i].val);
2925 		usbd_delay_ms(sc->sc_udev, 1);
2926 	}
2927 
2928 	urtw_write8_m(sc, 0x5b, 0x0d);
2929 
2930 	error = urtw_8225_set_txpwrlvl(sc, 1);
2931 	if (error)
2932 		goto fail;
2933 
2934 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2935 	usbd_delay_ms(sc->sc_udev, 1);
2936 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2937 	usbd_delay_ms(sc->sc_udev, 1);
2938 
2939 	/* TX ant A, 0x0 for B */
2940 	error = urtw_8185_tx_antenna(sc, 0x3);
2941 	if (error)
2942 		goto fail;
2943 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2944 
2945 	error = urtw_8225_rf_set_chan(rf, 1);
2946 fail:
2947 	return error;
2948 }
2949 
2950 static usbd_status
2951 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2952 {
2953 	struct urtw_softc *sc = rf->rf_sc;
2954 	struct ieee80211com *ic = &sc->sc_ic;
2955 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2956 	usbd_status error;
2957 
2958 	error = urtw_8225_set_txpwrlvl(sc, chan);
2959 	if (error)
2960 		goto fail;
2961 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2962 	usbd_delay_ms(sc->sc_udev, 10);
2963 
2964 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2965 
2966 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2967 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2968 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2969 	else
2970 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2971 
2972 	if (IEEE80211_IS_CHAN_G(c)) {
2973 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2974 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
2975 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2976 	} else {
2977 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2978 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
2979 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2980 	}
2981 
2982 fail:
2983 	return error;
2984 }
2985 
2986 static usbd_status
2987 urtw_8225_rf_set_sens(struct urtw_rf *rf)
2988 {
2989 	struct urtw_softc *sc = rf->rf_sc;
2990 	usbd_status error;
2991 
2992 	if (rf->sens > 6)
2993 		return -1;
2994 
2995 	if (rf->sens > 4)
2996 		urtw_8225_write(sc, 0x0c, 0x850);
2997 	else
2998 		urtw_8225_write(sc, 0x0c, 0x50);
2999 
3000 	rf->sens = 6 - rf->sens;
3001 	error = urtw_8225_setgain(sc, rf->sens);
3002 	if (error)
3003 		goto fail;
3004 
3005 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3006 
3007 fail:
3008 	return error;
3009 }
3010 
3011 static void
3012 urtw_stop(struct ifnet *ifp, int disable)
3013 {
3014 	struct urtw_softc *sc = ifp->if_softc;
3015 	struct ieee80211com *ic = &sc->sc_ic;
3016 	uint8_t data;
3017 	usbd_status error;
3018 
3019 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3020 
3021 	sc->sc_txtimer = 0;
3022 	ifp->if_timer = 0;
3023 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3024 
3025 	callout_stop(&sc->scan_to);
3026 	callout_stop(&sc->sc_led_ch);
3027 
3028 	urtw_intr_disable(sc);
3029 	urtw_read8_m(sc, URTW_CMD, &data);
3030 	data &= ~URTW_CMD_TX_ENABLE;
3031 	data &= ~URTW_CMD_RX_ENABLE;
3032 	urtw_write8_m(sc, URTW_CMD, data);
3033 
3034 	if (sc->sc_rxpipe != NULL)
3035 		usbd_abort_pipe(sc->sc_rxpipe);
3036 	if (sc->sc_txpipe_low != NULL)
3037 		usbd_abort_pipe(sc->sc_txpipe_low);
3038 	if (sc->sc_txpipe_normal != NULL)
3039 		usbd_abort_pipe(sc->sc_txpipe_normal);
3040 
3041 fail:
3042 	return;
3043 }
3044 
3045 static int
3046 urtw_isbmode(uint16_t rate)
3047 {
3048 	rate = urtw_rtl2rate(rate);
3049 
3050 	return ((rate <= 22 && rate != 12 && rate != 18) ||
3051 	    rate == 44) ? 1 : 0;
3052 }
3053 
3054 static void
3055 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3056 {
3057 	struct urtw_rx_data *data = priv;
3058 	struct urtw_softc *sc = data->sc;
3059 	struct ieee80211com *ic = &sc->sc_ic;
3060 	struct ifnet *ifp = ic->ic_ifp;
3061 	struct ieee80211_frame *wh;
3062 	struct ieee80211_node *ni;
3063 	struct mbuf *m, *mnew;
3064 	uint8_t *desc, quality, rate;
3065 	int actlen, flen, len, rssi, s;
3066 
3067 	if (status != USBD_NORMAL_COMPLETION) {
3068 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3069 			return;
3070 
3071 		if (status == USBD_STALLED)
3072 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3073 		if_statinc(ifp, if_ierrors);
3074 		goto skip;
3075 	}
3076 
3077 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3078 	if (actlen < URTW_MIN_RXBUFSZ) {
3079 		if_statinc(ifp, if_ierrors);
3080 		goto skip;
3081 	}
3082 
3083 	if (sc->sc_hwrev & URTW_HWREV_8187)
3084 		/* 4 dword and 4 byte CRC */
3085 		len = actlen - (4 * 4);
3086 	else
3087 		/* 5 dword and 4 byte CRC */
3088 		len = actlen - (4 * 5);
3089 
3090 	desc = data->buf + len;
3091 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3092 	if (flen > actlen) {
3093 		if_statinc(ifp, if_ierrors);
3094 		goto skip;
3095 	}
3096 
3097 	rate = (desc[2] & 0xf0) >> 4;
3098 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3099 		quality = desc[4] & 0xff;
3100 		rssi = (desc[6] & 0xfe) >> 1;
3101 
3102 		/* XXX correct? */
3103 		if (!urtw_isbmode(rate)) {
3104 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3105 			rssi = ((90 - rssi) * 100) / 65;
3106 		} else {
3107 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3108 			rssi = ((95 - rssi) * 100) / 65;
3109 		}
3110 	} else {
3111 		quality = desc[12];
3112 		rssi = 14 - desc[14] / 2;
3113 	}
3114 
3115 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3116 	if (mnew == NULL) {
3117 		printf("%s: could not allocate rx mbuf\n",
3118 		    device_xname(sc->sc_dev));
3119 		if_statinc(ifp, if_ierrors);
3120 		goto skip;
3121 	}
3122 	MCLGET(mnew, M_DONTWAIT);
3123 	if (!(mnew->m_flags & M_EXT)) {
3124 		printf("%s: could not allocate rx mbuf cluster\n",
3125 		    device_xname(sc->sc_dev));
3126 		m_freem(mnew);
3127 		if_statinc(ifp, if_ierrors);
3128 		goto skip;
3129 	}
3130 
3131 	m = data->m;
3132 	data->m = mnew;
3133 	data->buf = mtod(mnew, uint8_t *);
3134 
3135 	/* finalize mbuf */
3136 	m_set_rcvif(m, ifp);
3137 	m->m_pkthdr.len = m->m_len = flen - 4;
3138 
3139 	s = splnet();
3140 
3141 	if (sc->sc_drvbpf != NULL) {
3142 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3143 
3144 		/* XXX Are variables correct? */
3145 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3146 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3147 		tap->wr_dbm_antsignal = (int8_t)rssi;
3148 
3149 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
3150 	}
3151 	wh = mtod(m, struct ieee80211_frame *);
3152 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3153 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3154 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3155 
3156 	/* XXX correct? */
3157 	if (!urtw_isbmode(rate)) {
3158 		if (quality > 127)
3159 			quality = 0;
3160 		else if (quality < 27)
3161 			quality = 100;
3162 		else
3163 			quality = 127 - quality;
3164 	} else
3165 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3166 
3167 	/* send the frame to the 802.11 layer */
3168 	ieee80211_input(ic, m, ni, rssi, 0);
3169 
3170 	/* node is no longer needed */
3171 	ieee80211_free_node(ni);
3172 
3173 	splx(s);
3174 
3175 skip:	/* setup a new transfer */
3176 	usbd_setup_xfer(xfer, data, data->buf, MCLBYTES,
3177 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3178 	(void)usbd_transfer(xfer);
3179 }
3180 
3181 static usbd_status
3182 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3183 {
3184 	uint8_t *gainp;
3185 	usbd_status error;
3186 
3187 	/* XXX for A? */
3188 	gainp = urtw_8225v2_gain_bg;
3189 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3190 	usbd_delay_ms(sc->sc_udev, 1);
3191 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3192 	usbd_delay_ms(sc->sc_udev, 1);
3193 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3194 	usbd_delay_ms(sc->sc_udev, 1);
3195 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3196 	usbd_delay_ms(sc->sc_udev, 1);
3197 fail:
3198 	return error;
3199 }
3200 
3201 static usbd_status
3202 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3203 {
3204 	int i;
3205 	uint8_t *cck_pwrtable;
3206 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3207 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3208 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3209 	usbd_status error;
3210 
3211 	/* CCK power setting */
3212 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3213 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3214 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3215 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3216 	    urtw_8225v2_txpwr_cck;
3217 
3218 	for (i = 0; i < 8; i++) {
3219 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3220 	}
3221 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3222 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3223 	usbd_delay_ms(sc->sc_udev, 1);
3224 
3225 	/* OFDM power setting */
3226 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3227 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3228 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3229 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3230 
3231 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3232 	if (error)
3233 		goto fail;
3234 
3235 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3236 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3237 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3238 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3239 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3240 
3241 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3242 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3243 	usbd_delay_ms(sc->sc_udev, 1);
3244 fail:
3245 	return error;
3246 }
3247 
3248 static usbd_status
3249 urtw_8225v2_rf_init(struct urtw_rf *rf)
3250 {
3251 	struct urtw_softc *sc = rf->rf_sc;
3252 	int i;
3253 	uint16_t data;
3254 	uint32_t data32;
3255 	usbd_status error;
3256 
3257 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3258 	if (error)
3259 		goto fail;
3260 
3261 	error = urtw_8225_usb_init(sc);
3262 	if (error)
3263 		goto fail;
3264 
3265 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3266 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3267 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3268 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3269 
3270 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3271 	if (error)
3272 		goto fail;
3273 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3274 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3275 	if (error)
3276 		goto fail;
3277 
3278 	error = urtw_8185_rf_pins_enable(sc);
3279 	if (error)
3280 		goto fail;
3281 
3282 	usbd_delay_ms(sc->sc_udev, 1000);
3283 
3284 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part1); i++) {
3285 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3286 		    urtw_8225v2_rf_part1[i].val);
3287 		usbd_delay_ms(sc->sc_udev, 1);
3288 	}
3289 	usbd_delay_ms(sc->sc_udev, 50);
3290 
3291 	urtw_8225_write(sc, 0x0, 0x1b7);
3292 
3293 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3294 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3295 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3296 	}
3297 
3298 	urtw_8225_write(sc, 0x3, 0x2);
3299 	urtw_8225_write(sc, 0x5, 0x4);
3300 	urtw_8225_write(sc, 0x0, 0xb7);
3301 	urtw_8225_write(sc, 0x2, 0xc4d);
3302 	usbd_delay_ms(sc->sc_udev, 100);
3303 	urtw_8225_write(sc, 0x2, 0x44d);
3304 	usbd_delay_ms(sc->sc_udev, 100);
3305 
3306 	error = urtw_8225_read(sc, 0x6, &data32);
3307 	if (error != 0)
3308 		goto fail;
3309 	if (data32 != 0xe6)
3310 		printf("%s: expect 0xe6!! (%#x)\n", device_xname(sc->sc_dev),
3311 		    data32);
3312 	if (!(data32 & 0x80)) {
3313 		urtw_8225_write(sc, 0x02, 0x0c4d);
3314 		usbd_delay_ms(sc->sc_udev, 200);
3315 		urtw_8225_write(sc, 0x02, 0x044d);
3316 		usbd_delay_ms(sc->sc_udev, 100);
3317 		error = urtw_8225_read(sc, 0x6, &data32);
3318 		if (error != 0)
3319 			goto fail;
3320 		if (!(data32 & 0x80))
3321 			printf("%s: RF calibration failed\n",
3322 			    device_xname(sc->sc_dev));
3323 	}
3324 	usbd_delay_ms(sc->sc_udev, 100);
3325 
3326 	urtw_8225_write(sc, 0x0, 0x2bf);
3327 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
3328 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3329 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3330 	}
3331 
3332 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part2); i++) {
3333 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3334 		    urtw_8225v2_rf_part2[i].val);
3335 	}
3336 
3337 	error = urtw_8225v2_setgain(sc, 4);
3338 	if (error)
3339 		goto fail;
3340 
3341 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part3); i++) {
3342 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3343 		    urtw_8225v2_rf_part3[i].val);
3344 	}
3345 
3346 	urtw_write8_m(sc, 0x5b, 0x0d);
3347 
3348 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3349 	if (error)
3350 		goto fail;
3351 
3352 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3353 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3354 
3355 	/* TX ant A, 0x0 for B */
3356 	error = urtw_8185_tx_antenna(sc, 0x3);
3357 	if (error)
3358 		goto fail;
3359 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3360 
3361 	error = urtw_8225_rf_set_chan(rf, 1);
3362 fail:
3363 	return error;
3364 }
3365 
3366 static usbd_status
3367 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3368 {
3369 	struct urtw_softc *sc = rf->rf_sc;
3370 	struct ieee80211com *ic = &sc->sc_ic;
3371 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3372 	usbd_status error;
3373 
3374 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3375 	if (error)
3376 		goto fail;
3377 
3378 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3379 	usbd_delay_ms(sc->sc_udev, 10);
3380 
3381 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3382 
3383 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3384 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3385 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3386 	else
3387 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3388 
3389 	if (IEEE80211_IS_CHAN_G(c)) {
3390 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3391 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3392 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3393 	} else {
3394 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3395 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3396 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3397 	}
3398 
3399 fail:
3400 	return error;
3401 }
3402 
3403 static void
3404 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3405 {
3406 	struct urtw_rf *rf = &sc->sc_rf;
3407 	struct ieee80211com *ic = &sc->sc_ic;
3408 	usbd_status error = 0;
3409 	uint32_t data;
3410 	u_int chan;
3411 
3412 	chan = ieee80211_chan2ieee(ic, c);
3413 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3414 		return;
3415 	/*
3416 	 * During changing the channel we need to temporary disable
3417 	 * TX.
3418 	 */
3419 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3420 	data &= ~URTW_TX_LOOPBACK_MASK;
3421 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3422 	error = rf->set_chan(rf, chan);
3423 	if (error != 0) {
3424 		printf("%s could not change the channel\n",
3425 		    device_xname(sc->sc_dev));
3426 		return;
3427 	}
3428 	usbd_delay_ms(sc->sc_udev, 10);
3429 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3430 
3431 fail:	return;
3432 
3433 }
3434 
3435 static void
3436 urtw_next_scan(void *arg)
3437 {
3438 	struct urtw_softc *sc = arg;
3439 	struct ieee80211com *ic = &sc->sc_ic;
3440 	int s;
3441 
3442 	if (sc->sc_dying)
3443 		return;
3444 
3445 	s = splnet();
3446 	if (ic->ic_state == IEEE80211_S_SCAN)
3447 		ieee80211_next_scan(ic);
3448 	splx(s);
3449 }
3450 
3451 static void
3452 urtw_task(void *arg)
3453 {
3454 	struct urtw_softc *sc = arg;
3455 	struct ieee80211com *ic = &sc->sc_ic;
3456 	struct ieee80211_node *ni;
3457 	enum ieee80211_state ostate;
3458 	usbd_status error = 0;
3459 
3460 	if (sc->sc_dying)
3461 		return;
3462 
3463 	ostate = ic->ic_state;
3464 
3465 	switch (sc->sc_state) {
3466 	case IEEE80211_S_INIT:
3467 		if (ostate == IEEE80211_S_RUN) {
3468 			/* turn link LED off */
3469 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3470 		}
3471 		break;
3472 
3473 	case IEEE80211_S_SCAN:
3474 		urtw_set_chan(sc, ic->ic_curchan);
3475 		if (!sc->sc_dying)
3476 			callout_schedule(&sc->scan_to, mstohz(200));
3477 		break;
3478 
3479 	case IEEE80211_S_AUTH:
3480 	case IEEE80211_S_ASSOC:
3481 		urtw_set_chan(sc, ic->ic_curchan);
3482 		break;
3483 
3484 	case IEEE80211_S_RUN:
3485 		ni = ic->ic_bss;
3486 
3487 		urtw_set_chan(sc, ic->ic_curchan);
3488 
3489 		/* setting bssid. */
3490 		error = urtw_set_bssid(sc, ni->ni_bssid);
3491 		if (error != 0)
3492 			goto fail;
3493 		urtw_update_msr(sc);
3494 		/* XXX maybe the below would be incorrect. */
3495 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3496 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3497 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3498 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3499 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3500 		if (error != 0)
3501 			printf("%s: could not control LED (%d)\n",
3502 			    device_xname(sc->sc_dev), error);
3503 		break;
3504 	}
3505 
3506 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3507 
3508 fail:
3509 	if (error != 0) {
3510 		DPRINTF(("%s: error duing processing RUN state.",
3511 		    device_xname(sc->sc_dev)));
3512 	}
3513 }
3514 
3515 static usbd_status
3516 urtw_8187b_update_wmm(struct urtw_softc *sc)
3517 {
3518 	struct ieee80211com *ic = &sc->sc_ic;
3519 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3520 	uint32_t data;
3521 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3522 	usbd_status error;
3523 
3524 	sifs = 0xa;
3525 	if (IEEE80211_IS_CHAN_G(c))
3526 		slot = 0x9;
3527 	else
3528 		slot = 0x14;
3529 
3530 	aifs = (2 * slot) + sifs;
3531 	ecwmin = 3;
3532 	ecwmax = 7;
3533 
3534 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3535 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3536 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3537 
3538 	urtw_write32_m(sc, URTW_AC_VO, data);
3539 	urtw_write32_m(sc, URTW_AC_VI, data);
3540 	urtw_write32_m(sc, URTW_AC_BE, data);
3541 	urtw_write32_m(sc, URTW_AC_BK, data);
3542 
3543 fail:
3544 	return error;
3545 }
3546 
3547 static usbd_status
3548 urtw_8187b_reset(struct urtw_softc *sc)
3549 {
3550 	uint8_t data;
3551 	usbd_status error;
3552 
3553 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3554 	if (error)
3555 		goto fail;
3556 
3557 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3558 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3559 		URTW_CONFIG3_GNT_SELECT);
3560 
3561 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3562 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3563 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3564 
3565 	urtw_write8_m(sc, 0x61, 0x10);
3566 	urtw_read8_m(sc, 0x62, &data);
3567 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3568 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3569 
3570 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3571 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3572 
3573 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3574 	if (error)
3575 		goto fail;
3576 
3577 	urtw_read8_m(sc, URTW_CMD, &data);
3578 	data = (data & 2) | URTW_CMD_RST;
3579 	urtw_write8_m(sc, URTW_CMD, data);
3580 	usbd_delay_ms(sc->sc_udev, 100);
3581 
3582 	urtw_read8_m(sc, URTW_CMD, &data);
3583 	if (data & URTW_CMD_RST) {
3584 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
3585 		goto fail;
3586 	}
3587 
3588 fail:
3589 	return error;
3590 }
3591 
3592 static int
3593 urtw_8187b_init(struct ifnet *ifp)
3594 {
3595 	struct urtw_softc *sc = ifp->if_softc;
3596 	struct urtw_rf *rf = &sc->sc_rf;
3597 	struct ieee80211com *ic = &sc->sc_ic;
3598 	uint8_t data;
3599 	usbd_status error;
3600 
3601 	urtw_stop(ifp, 0);
3602 
3603 	error = urtw_8187b_update_wmm(sc);
3604 	if (error != 0)
3605 		goto fail;
3606 	error = urtw_8187b_reset(sc);
3607 	if (error)
3608 		goto fail;
3609 
3610 	/* Applying MAC address again. */
3611 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3612 	if (error)
3613 		goto fail;
3614 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3615 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3616 	if (error)
3617 		goto fail;
3618 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3619 	if (error)
3620 		goto fail;
3621 
3622 	error = urtw_update_msr(sc);
3623 	if (error)
3624 		goto fail;
3625 
3626 	error = rf->init(rf);
3627 	if (error != 0)
3628 		goto fail;
3629 
3630 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3631 		URTW_CMD_RX_ENABLE);
3632 	error = urtw_intr_enable(sc);
3633 	if (error != 0)
3634 		goto fail;
3635 
3636 	error = urtw_write8e(sc, 0x41, 0xf4);
3637 	if (error != 0)
3638 		goto fail;
3639 	error = urtw_write8e(sc, 0x40, 0x00);
3640 	if (error != 0)
3641 		goto fail;
3642 	error = urtw_write8e(sc, 0x42, 0x00);
3643 	if (error != 0)
3644 		goto fail;
3645 	error = urtw_write8e(sc, 0x42, 0x01);
3646 	if (error != 0)
3647 		goto fail;
3648 	error = urtw_write8e(sc, 0x40, 0x0f);
3649 	if (error != 0)
3650 		goto fail;
3651 	error = urtw_write8e(sc, 0x42, 0x00);
3652 	if (error != 0)
3653 		goto fail;
3654 	error = urtw_write8e(sc, 0x42, 0x01);
3655 	if (error != 0)
3656 		goto fail;
3657 
3658 	urtw_read8_m(sc, 0xdb, &data);
3659 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3660 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3661 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3662 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3663 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3664 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3665 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3666 	urtw_write8_m(sc, 0x61, 0);
3667 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3668 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3669 	urtw_write8_m(sc, 0xda, 0x10);
3670 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3671 
3672 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3673 
3674 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3675 
3676 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3677 
3678 	/* Reset softc variables. */
3679 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
3680 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
3681 	}
3682 	sc->sc_txtimer = 0;
3683 
3684 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3685 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3686 		if (error != 0) {
3687 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
3688 			    ", err=%s\n", usbd_errstr(error));
3689 
3690 			goto fail;
3691 		}
3692 		/* Get the first interface handle. */
3693 		error = usbd_device2interface_handle(sc->sc_udev,
3694 		    URTW_IFACE_INDEX, &sc->sc_iface);
3695 		if (error != 0) {
3696 			printf("%s: could not get interface handle\n",
3697 			    device_xname(sc->sc_dev));
3698 			goto fail;
3699 		}
3700 		error = urtw_open_pipes(sc);
3701 		if (error != 0)
3702 			goto fail;
3703 		error = urtw_alloc_rx_data_list(sc);
3704 		if (error != 0)
3705 			goto fail;
3706 		error = urtw_alloc_tx_data_list(sc);
3707 		if (error != 0)
3708 			goto fail;
3709 		sc->sc_flags |= URTW_INIT_ONCE;
3710 	}
3711 
3712 	error = urtw_rx_enable(sc);
3713 	if (error != 0)
3714 		goto fail;
3715 	error = urtw_tx_enable(sc);
3716 	if (error != 0)
3717 		goto fail;
3718 
3719 	ifp->if_flags &= ~IFF_OACTIVE;
3720 	ifp->if_flags |= IFF_RUNNING;
3721 
3722 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3723 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3724 	else
3725 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3726 
3727 fail:
3728 	return error;
3729 }
3730 
3731 static usbd_status
3732 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3733 {
3734 	int i;
3735 	usbd_status error;
3736 
3737 	for (i = 0; i < __arraycount(urtw_8187b_regtbl); i++) {
3738 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3739 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3740 	}
3741 
3742 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3743 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3744 
3745 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3746 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3747 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3748 
3749 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3750 
3751 fail:
3752 	return error;
3753 }
3754 
3755 static usbd_status
3756 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3757 {
3758 	usbd_status error;
3759 
3760 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3761 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3762 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3763 	usbd_delay_ms(sc->sc_udev, 100);
3764 
3765 fail:
3766 	return error;
3767 }
3768 
3769 static usbd_status
3770 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3771 {
3772 	struct ieee80211com *ic = &sc->sc_ic;
3773 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3774 	uint8_t aifs, difs, eifs, sifs, slot;
3775 	usbd_status error;
3776 
3777 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3778 
3779 	sifs = 0xa;
3780 	if (IEEE80211_IS_CHAN_G(c)) {
3781 		slot = 0x9;
3782 		difs = 0x1c;
3783 		eifs = 0x5b;
3784 	} else {
3785 		slot = 0x14;
3786 		difs = 0x32;
3787 		eifs = 0x5b;
3788 	}
3789 	aifs = (2 * slot) + sifs;
3790 
3791 	urtw_write8_m(sc, URTW_SLOT, slot);
3792 
3793 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3794 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3795 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3796 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3797 
3798 	urtw_write8_m(sc, URTW_DIFS, difs);
3799 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3800 
3801 fail:
3802 	return error;
3803 }
3804 
3805 static usbd_status
3806 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3807 {
3808 	struct urtw_softc *sc = rf->rf_sc;
3809 	unsigned int i;
3810 	uint8_t data;
3811 	usbd_status error;
3812 
3813 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3814 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3815 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3816 	urtw_write8_m(sc, URTW_CW_CONF, data |
3817 		URTW_CW_CONF_PERPACKET_RETRY);
3818 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3819 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3820 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3821 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3822 
3823 	/* Auto rate fallback control. */
3824 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3825 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3826 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3827 		URTW_RATE_FALLBACK_ENABLE);
3828 
3829 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3830 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3831 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3832 
3833 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3834 	if (error)
3835 		goto fail;
3836 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3837 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3838 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3839 	if (error)
3840 		goto fail;
3841 
3842 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3843 	urtw_8225v2_b_config_mac(sc);
3844 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3845 
3846 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3847 	if (error)
3848 		goto fail;
3849 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3850 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3851 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3852 	if (error)
3853 		goto fail;
3854 
3855 	urtw_8225v2_b_init_rfe(sc);
3856 
3857 	for (i = 0; i < __arraycount(urtw_8225v2_b_rf); i++) {
3858 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3859 		    urtw_8225v2_b_rf[i].val);
3860 	}
3861 
3862 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3863 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3864 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3865 	}
3866 
3867 	urtw_8225_write(sc, 0x03, 0x080);
3868 	urtw_8225_write(sc, 0x05, 0x004);
3869 	urtw_8225_write(sc, 0x00, 0x0b7);
3870 	urtw_8225_write(sc, 0x02, 0xc4d);
3871 	urtw_8225_write(sc, 0x02, 0x44d);
3872 	urtw_8225_write(sc, 0x00, 0x2bf);
3873 
3874 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3875 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3876 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3877 
3878 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3879 	for (i = 0; i < __arraycount(urtw_8225v2_agc); i++) {
3880 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3881 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3882 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3883 	}
3884 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3885 
3886 	for (i = 0; i < __arraycount(urtw_8225v2_ofdm); i++)
3887 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3888 
3889 	urtw_8225v2_b_update_chan(sc);
3890 
3891 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3892 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3893 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3894 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3895 
3896 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3897 fail:
3898 	return error;
3899 }
3900 
3901 static usbd_status
3902 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3903 {
3904 	struct urtw_softc *sc = rf->rf_sc;
3905 	usbd_status error;
3906 
3907 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3908 	if (error)
3909 		goto fail;
3910 
3911 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3912 	/*
3913 	 * Delay removed from 8185 to 8187.
3914 	 * usbd_delay_ms(sc->sc_udev, 10);
3915 	 */
3916 
3917 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3918 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3919 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3920 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3921 
3922 fail:
3923 	return error;
3924 }
3925 
3926 static usbd_status
3927 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3928 {
3929 	int i;
3930 	uint8_t *cck_pwrtable;
3931 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3932 	    ofdm_pwrlvl_max;
3933 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3934 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3935 	usbd_status error;
3936 
3937 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3938 		cck_pwrlvl_min = 0;
3939 		cck_pwrlvl_max = 15;
3940 		ofdm_pwrlvl_min = 2;
3941 		ofdm_pwrlvl_max = 17;
3942 	} else {
3943 		cck_pwrlvl_min = 7;
3944 		cck_pwrlvl_max = 22;
3945 		ofdm_pwrlvl_min = 10;
3946 		ofdm_pwrlvl_max = 25;
3947 	}
3948 
3949 	/* CCK power setting */
3950 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
3951 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
3952 
3953 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3954 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3955 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
3956 
3957 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3958 	    urtw_8225v2_txpwr_cck;
3959 
3960 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3961 		if (cck_pwrlvl <= 6)
3962 			; /* do nothing */
3963 		else if (cck_pwrlvl <= 11)
3964 			cck_pwrtable += 8;
3965 		else
3966 			cck_pwrtable += 16;
3967 	} else {
3968 		if (cck_pwrlvl <= 5)
3969 			; /* do nothing */
3970 		else if (cck_pwrlvl <= 11)
3971 			cck_pwrtable += 8;
3972 		else if (cck_pwrlvl <= 17)
3973 			cck_pwrtable += 16;
3974 		else
3975 			cck_pwrtable += 24;
3976 	}
3977 
3978 	for (i = 0; i < 8; i++) {
3979 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3980 	}
3981 
3982 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3983 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3984 	/*
3985 	 * Delay removed from 8185 to 8187.
3986 	 * usbd_delay_ms(sc->sc_udev, 1);
3987 	 */
3988 
3989 	/* OFDM power setting */
3990 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3991 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3992 
3993 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3994 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3995 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
3996 
3997 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3998 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3999 
4000 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4001 		if (ofdm_pwrlvl <= 11) {
4002 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4003 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4004 		} else {
4005 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4006 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4007 		}
4008 	} else {
4009 		if (ofdm_pwrlvl <= 11) {
4010 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4011 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4012 		} else if (ofdm_pwrlvl <= 17) {
4013 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4014 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4015 		} else {
4016 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4017 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4018 		}
4019 	}
4020 
4021 	/*
4022 	 * Delay removed from 8185 to 8187.
4023 	 * usbd_delay_ms(sc->sc_udev, 1);
4024 	 */
4025 fail:
4026 	return error;
4027 }
4028 
4029 static int
4030 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4031 {
4032 	int error;
4033 
4034 	urtw_write32_m(sc, URTW_BSSID,
4035 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4036 	urtw_write16_m(sc, URTW_BSSID + 4,
4037 	    bssid[4] | bssid[5] << 8);
4038 
4039 	return 0;
4040 
4041 fail:
4042 	return error;
4043 }
4044 
4045 static int
4046 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4047 {
4048 	int error;
4049 
4050 	urtw_write32_m(sc, URTW_MAC0,
4051 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4052 	urtw_write16_m(sc, URTW_MAC4,
4053 	    addr[4] | addr[5] << 8);
4054 
4055 	return 0;
4056 
4057 fail:
4058 	return error;
4059 }
4060 
4061 MODULE(MODULE_CLASS_DRIVER, if_urtw, NULL);
4062 
4063 #ifdef _MODULE
4064 #include "ioconf.c"
4065 #endif
4066 
4067 static int
4068 if_urtw_modcmd(modcmd_t cmd, void *aux)
4069 {
4070 	int error = 0;
4071 
4072 	switch (cmd) {
4073 	case MODULE_CMD_INIT:
4074 #ifdef _MODULE
4075 		error = config_init_component(cfdriver_ioconf_urtw,
4076 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4077 #endif
4078 		return error;
4079 	case MODULE_CMD_FINI:
4080 #ifdef _MODULE
4081 		error = config_fini_component(cfdriver_ioconf_urtw,
4082 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4083 #endif
4084 		return error;
4085 	default:
4086 		return ENOTTY;
4087 	}
4088 }
4089