xref: /netbsd-src/sys/dev/usb/if_urtw.c (revision bdc22b2e01993381dcefeff2bc9b56ca75a4235c)
1 /*	$NetBSD: if_urtw.c,v 1.15 2018/06/26 06:48:02 msaitoh Exp $	*/
2 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
3 
4 /*-
5  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
6  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __KERNEL_RCSID(0, "$NetBSD: if_urtw.c,v 1.15 2018/06/26 06:48:02 msaitoh Exp $");
23 
24 #ifdef _KERNEL_OPT
25 #include "opt_usb.h"
26 #endif
27 
28 #include <sys/param.h>
29 #include <sys/sockio.h>
30 #include <sys/proc.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/callout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 
41 #include <machine/endian.h>
42 #include <net/bpf.h>
43 #include <net/if.h>
44 #include <net/if_arp.h>
45 #include <net/if_dl.h>
46 #include <net/if_ether.h>
47 #include <net/if_media.h>
48 #include <net/if_types.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/if_inarp.h>
54 #include <netinet/ip.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 
59 #include <dev/usb/usb.h>
60 #include <dev/usb/usbdi.h>
61 #include <dev/usb/usbdi_util.h>
62 #include <dev/usb/usbdivar.h>
63 #include <dev/usb/usbdevs.h>
64 
65 #include "if_urtwreg.h"
66 
67 #ifdef URTW_DEBUG
68 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
69 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
70 int urtw_debug = 0;
71 #else
72 #define	DPRINTF(x)
73 #define	DPRINTFN(n, x)
74 #endif
75 
76 /*
77  * Recognized device vendors/products.
78  */
79 static const struct urtw_type {
80 	struct usb_devno	dev;
81 	uint8_t			rev;
82 } urtw_devs[] = {
83 #define	URTW_DEV_RTL8187(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
85 #define	URTW_DEV_RTL8187B(v, p)	\
86 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
87 	/* Realtek RTL8187 devices. */
88 	URTW_DEV_RTL8187(ASUSTEK,	P5B_WIFI),
89 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
90 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GC_2),
91 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
92 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
93 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
94 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
95 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
96 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
97 	/* Realtek RTL8187B devices. */
98 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
99 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
101 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
102 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
103 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
104 #undef	URTW_DEV_RTL8187
105 #undef	URTW_DEV_RTL8187B
106 };
107 #define	urtw_lookup(v, p)	\
108 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
109 
110 /*
111  * Helper read/write macros.
112  */
113 #define urtw_read8_m(sc, val, data)	do {			\
114 	error = urtw_read8_c(sc, val, data, 0);			\
115 	if (error != 0)						\
116 		goto fail;					\
117 } while (0)
118 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
119 	error = urtw_read8_c(sc, val, data, idx);		\
120 	if (error != 0)						\
121 		goto fail;					\
122 } while (0)
123 #define urtw_write8_m(sc, val, data)	do {			\
124 	error = urtw_write8_c(sc, val, data, 0);		\
125 	if (error != 0)						\
126 		goto fail;					\
127 } while (0)
128 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
129 	error = urtw_write8_c(sc, val, data, idx);		\
130 	if (error != 0)						\
131 		goto fail;					\
132 } while (0)
133 #define urtw_read16_m(sc, val, data)	do {			\
134 	error = urtw_read16_c(sc, val, data, 0);		\
135 	if (error != 0)						\
136 		goto fail;					\
137 } while (0)
138 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
139 	error = urtw_read16_c(sc, val, data, idx);		\
140 	if (error != 0)						\
141 		goto fail;					\
142 } while (0)
143 #define urtw_write16_m(sc, val, data)	do {			\
144 	error = urtw_write16_c(sc, val, data, 0);		\
145 	if (error != 0)						\
146 		goto fail;					\
147 } while (0)
148 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
149 	error = urtw_write16_c(sc, val, data, idx);		\
150 	if (error != 0)						\
151 		goto fail;					\
152 } while (0)
153 #define urtw_read32_m(sc, val, data)	do {			\
154 	error = urtw_read32_c(sc, val, data, 0);		\
155 	if (error != 0)						\
156 		goto fail;					\
157 } while (0)
158 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
159 	error = urtw_read32_c(sc, val, data, idx);		\
160 	if (error != 0)						\
161 		goto fail;					\
162 } while (0)
163 #define urtw_write32_m(sc, val, data)	do {			\
164 	error = urtw_write32_c(sc, val, data, 0);		\
165 	if (error != 0)						\
166 		goto fail;					\
167 } while (0)
168 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
169 	error = urtw_write32_c(sc, val, data, idx);		\
170 	if (error != 0)						\
171 		goto fail;					\
172 } while (0)
173 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
174 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
175 	if (error != 0)						\
176 		goto fail;					\
177 } while (0)
178 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
179 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
180 	if (error != 0)						\
181 		goto fail;					\
182 } while (0)
183 #define urtw_8225_write(sc, val, data)	do {			\
184 	error = urtw_8225_write_c(sc, val, data);		\
185 	if (error != 0)						\
186 		goto fail;					\
187 } while (0)
188 
189 struct urtw_pair {
190 	uint32_t	reg;
191 	uint32_t	val;
192 };
193 
194 struct urtw_pair_idx {
195 	uint8_t		reg;
196 	uint8_t		val;
197 	uint8_t		idx;
198 };
199 
200 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
201 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
202 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
203 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
204 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
205 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
206 	{ 0xff, 0x00, 0 },
207 
208 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
209 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
210 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
211 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
212 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
213 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
214 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
215 	{ 0xf8, 0x08, 1 },
216 
217 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
218 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
219 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
220 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
221 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
222 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
223 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
224 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
225 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
226 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
227 
228 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
229 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
230 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
231 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
232 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
233 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
234 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
235 
236 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
237 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
238 };
239 
240 static uint8_t urtw_8225_agc[] = {
241 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
242 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
243 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
244 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
245 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
246 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
247 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
248 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
249 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
250 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
251 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
252 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
253 };
254 
255 static uint32_t urtw_8225_channel[] = {
256 	0x0000,		/* dummy channel 0 */
257 	0x085c,		/* 1 */
258 	0x08dc,		/* 2 */
259 	0x095c,		/* 3 */
260 	0x09dc,		/* 4 */
261 	0x0a5c,		/* 5 */
262 	0x0adc,		/* 6 */
263 	0x0b5c,		/* 7 */
264 	0x0bdc,		/* 8 */
265 	0x0c5c,		/* 9 */
266 	0x0cdc,		/* 10 */
267 	0x0d5c,		/* 11 */
268 	0x0ddc,		/* 12 */
269 	0x0e5c,		/* 13 */
270 	0x0f72,		/* 14 */
271 };
272 
273 static uint8_t urtw_8225_gain[] = {
274 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
275 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
276 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
277 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
278 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
279 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
280 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
281 };
282 
283 static struct urtw_pair urtw_8225_rf_part1[] = {
284 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
285 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
286 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
287 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
288 };
289 
290 static struct urtw_pair urtw_8225_rf_part2[] = {
291 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
292 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
293 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
294 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
295 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
296 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
297 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
298 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
299 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
300 	{ 0x27, 0x88 }
301 };
302 
303 static struct urtw_pair urtw_8225_rf_part3[] = {
304 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
305 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
306 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
307 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
308 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
309 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
310 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
311 };
312 
313 static uint16_t urtw_8225_rxgain[] = {
314 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
315 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
316 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
317 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
318 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
319 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
320 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
321 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
322 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
323 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
324 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
325 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
326 };
327 
328 static uint8_t urtw_8225_threshold[] = {
329 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
330 };
331 
332 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
333 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
334 };
335 
336 static uint8_t urtw_8225_txpwr_cck[] = {
337 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
338 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
339 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
340 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
341 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
342 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
343 };
344 
345 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
346 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
347 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
348 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
349 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
350 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
351 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
352 };
353 
354 static uint8_t urtw_8225_txpwr_ofdm[] = {
355 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
356 };
357 
358 static uint8_t urtw_8225v2_agc[] = {
359 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
360 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
361 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
362 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
363 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
364 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
365 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
366 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
367 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
368 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
369 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
370 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
371 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
372 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
373 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
374 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
375 };
376 
377 static uint8_t urtw_8225v2_ofdm[] = {
378 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
379 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
380 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
381 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
382 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
383 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
384 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
385 	0x6d, 0x3c, 0xfb, 0x07
386 };
387 
388 static uint8_t urtw_8225v2_gain_bg[] = {
389 	0x23, 0x15, 0xa5,		/* -82-1dbm */
390 	0x23, 0x15, 0xb5,		/* -82-2dbm */
391 	0x23, 0x15, 0xc5,		/* -82-3dbm */
392 	0x33, 0x15, 0xc5,		/* -78dbm */
393 	0x43, 0x15, 0xc5,		/* -74dbm */
394 	0x53, 0x15, 0xc5,		/* -70dbm */
395 	0x63, 0x15, 0xc5,		/* -66dbm */
396 };
397 
398 static struct urtw_pair urtw_8225v2_rf_part1[] = {
399 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
400 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
401 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
402 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
403 };
404 
405 static struct urtw_pair urtw_8225v2_rf_part2[] = {
406 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
407 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
408 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
409 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
410 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
411 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
412 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
413 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
414 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
415 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
416 };
417 
418 static struct urtw_pair urtw_8225v2_rf_part3[] = {
419 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
420 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
421 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
422 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
423 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
424 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
425 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
426 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
427 };
428 
429 static uint16_t urtw_8225v2_rxgain[] = {
430 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
431 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
432 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
433 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
434 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
435 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
436 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
437 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
438 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
439 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
440 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
441 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
442 };
443 
444 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
445 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
446 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
447 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
448 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
449 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
450 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
451 };
452 
453 static uint8_t urtw_8225v2_txpwr_cck[] = {
454 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
455 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
456 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
457 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
458 };
459 
460 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
461 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
463 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
464 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
465 };
466 
467 static struct urtw_pair urtw_8225v2_b_rf[] = {
468 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
469 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
470 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
471 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
472 	{ 0x00, 0x01b7 }
473 };
474 
475 static struct urtw_pair urtw_ratetable[] = {
476 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
477 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
478 	{ 96, 10 }, { 108, 11 }
479 };
480 
481 int		urtw_init(struct ifnet *);
482 void		urtw_stop(struct ifnet *, int);
483 int		urtw_ioctl(struct ifnet *, u_long, void *);
484 void		urtw_start(struct ifnet *);
485 int		urtw_alloc_rx_data_list(struct urtw_softc *);
486 void		urtw_free_rx_data_list(struct urtw_softc *);
487 int		urtw_alloc_tx_data_list(struct urtw_softc *);
488 void		urtw_free_tx_data_list(struct urtw_softc *);
489 void		urtw_rxeof(struct usbd_xfer *, void *,
490 		    usbd_status);
491 int		urtw_tx_start(struct urtw_softc *,
492 		    struct ieee80211_node *, struct mbuf *, int);
493 void		urtw_txeof_low(struct usbd_xfer *, void *,
494 		    usbd_status);
495 void		urtw_txeof_normal(struct usbd_xfer *, void *,
496 		    usbd_status);
497 void		urtw_next_scan(void *);
498 void		urtw_task(void *);
499 void		urtw_ledusbtask(void *);
500 void		urtw_ledtask(void *);
501 int		urtw_media_change(struct ifnet *);
502 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
503 void		urtw_watchdog(struct ifnet *);
504 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
505 int		urtw_isbmode(uint16_t);
506 uint16_t	urtw_rate2rtl(int);
507 uint16_t	urtw_rtl2rate(int);
508 usbd_status	urtw_set_rate(struct urtw_softc *);
509 usbd_status	urtw_update_msr(struct urtw_softc *);
510 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
511 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
512 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
513 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
514 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
515 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
516 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
517 usbd_status	urtw_eprom_ck(struct urtw_softc *);
518 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
519 		    int);
520 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
521 		    uint32_t *);
522 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
523 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
524 usbd_status	urtw_get_macaddr(struct urtw_softc *);
525 usbd_status	urtw_get_txpwr(struct urtw_softc *);
526 usbd_status	urtw_get_rfchip(struct urtw_softc *);
527 usbd_status	urtw_led_init(struct urtw_softc *);
528 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
529 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
530 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
531 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
532 		    uint32_t);
533 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
534 		    uint32_t);
535 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
536 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
537 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
538 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
539 		    uint16_t);
540 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
541 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
542 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
543 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
544 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
545 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
546 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
547 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
548 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
549 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
550 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
551 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
552 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
553 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
554 usbd_status	urtw_open_pipes(struct urtw_softc *);
555 usbd_status	urtw_close_pipes(struct urtw_softc *);
556 usbd_status	urtw_intr_enable(struct urtw_softc *);
557 usbd_status	urtw_intr_disable(struct urtw_softc *);
558 usbd_status	urtw_reset(struct urtw_softc *);
559 usbd_status	urtw_led_on(struct urtw_softc *, int);
560 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
561 usbd_status	urtw_led_blink(struct urtw_softc *);
562 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
563 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
564 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
565 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
566 usbd_status	urtw_rx_setconf(struct urtw_softc *);
567 usbd_status	urtw_rx_enable(struct urtw_softc *);
568 usbd_status	urtw_tx_enable(struct urtw_softc *);
569 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
570 usbd_status	urtw_8187b_reset(struct urtw_softc *);
571 int		urtw_8187b_init(struct ifnet *);
572 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
573 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
574 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
575 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
576 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
577 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
578 int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
579 int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
580 
581 int urtw_match(device_t, cfdata_t, void *);
582 void urtw_attach(device_t, device_t, void *);
583 int urtw_detach(device_t, int);
584 int urtw_activate(device_t, enum devact);
585 
586 CFATTACH_DECL_NEW(urtw, sizeof(struct urtw_softc),
587 	urtw_match,
588 	urtw_attach,
589 	urtw_detach,
590 	urtw_activate
591 );
592 
593 int
594 urtw_match(device_t parent, cfdata_t match, void *aux)
595 {
596 	struct usb_attach_arg *uaa = aux;
597 
598 	return urtw_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
599 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
600 }
601 
602 void
603 urtw_attach(device_t parent, device_t self, void *aux)
604 {
605 	struct urtw_softc *sc = device_private(self);
606 	struct usb_attach_arg *uaa = aux;
607 	struct ieee80211com *ic = &sc->sc_ic;
608 	struct ifnet *ifp = &sc->sc_if;
609 	usbd_status error;
610 	uint8_t data8;
611 	uint32_t data;
612 	int i;
613 
614 	sc->sc_dev = self;
615 	sc->sc_udev = uaa->uaa_device;
616 	sc->sc_hwrev = urtw_lookup(uaa->uaa_vendor, uaa->uaa_product)->rev;
617 
618 	aprint_naive("\n");
619 	aprint_normal(": ");
620 
621 	if (sc->sc_hwrev & URTW_HWREV_8187) {
622 		urtw_read32_m(sc, URTW_TX_CONF, &data);
623 		data &= URTW_TX_HWREV_MASK;
624 		switch (data) {
625 		case URTW_TX_HWREV_8187_D:
626 			sc->sc_hwrev |= URTW_HWREV_8187_D;
627 			aprint_normal("RTL8187 rev D");
628 			break;
629 		case URTW_TX_HWREV_8187B_D:
630 			/*
631 			 * Detect Realtek RTL8187B devices that use
632 			 * USB IDs of RTL8187.
633 			 */
634 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
635 			aprint_normal("RTL8187B rev B (early)");
636 			break;
637 		default:
638 			sc->sc_hwrev |= URTW_HWREV_8187_B;
639 			aprint_normal("RTL8187 rev 0x%02x", data >> 25);
640 			break;
641 		}
642 	} else {
643 		/* RTL8187B hwrev register. */
644 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
645 		switch (data8) {
646 		case URTW_8187B_HWREV_8187B_B:
647 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
648 			aprint_normal("RTL8187B rev B");
649 			break;
650 		case URTW_8187B_HWREV_8187B_D:
651 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
652 			aprint_normal("RTL8187B rev D");
653 			break;
654 		case URTW_8187B_HWREV_8187B_E:
655 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
656 			aprint_normal("RTL8187B rev E");
657 			break;
658 		default:
659 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
660 			aprint_normal("RTL8187B rev 0x%02x", data8);
661 			break;
662 		}
663 	}
664 
665 	urtw_read32_m(sc, URTW_RX, &data);
666 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
667 	    URTW_EEPROM_93C46;
668 
669 	error = urtw_get_rfchip(sc);
670 	if (error != 0)
671 		goto fail;
672 	error = urtw_get_macaddr(sc);
673 	if (error != 0)
674 		goto fail;
675 	error = urtw_get_txpwr(sc);
676 	if (error != 0)
677 		goto fail;
678 	error = urtw_led_init(sc);		/* XXX incompleted */
679 	if (error != 0)
680 		goto fail;
681 
682 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
683 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
684 	sc->sc_currate = 3;
685 	/* XXX for what? */
686 	sc->sc_preamble_mode = 2;
687 
688 	usb_init_task(&sc->sc_task, urtw_task, sc, 0);
689 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc, 0);
690 	callout_init(&sc->scan_to, 0);
691 	callout_setfunc(&sc->scan_to, urtw_next_scan, sc);
692 	callout_init(&sc->sc_led_ch, 0);
693 	callout_setfunc(&sc->sc_led_ch, urtw_ledtask, sc);
694 
695 	ic->ic_ifp = ifp;
696 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
697 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
698 	ic->ic_state = IEEE80211_S_INIT;
699 
700 	/* set device capabilities */
701 	ic->ic_caps =
702 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
703 	    IEEE80211_C_TXPMGT |	/* tx power management */
704 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
705 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
706 	    IEEE80211_C_WEP |		/* s/w WEP */
707 	    IEEE80211_C_WPA;		/* WPA/RSN */
708 
709 	/* set supported .11b and .11g rates */
710 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
711 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
712 
713 	/* set supported .11b and .11g channels (1 through 14) */
714 	for (i = 1; i <= 14; i++) {
715 		ic->ic_channels[i].ic_freq =
716 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
717 		ic->ic_channels[i].ic_flags =
718 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
719 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
720 	}
721 
722 	ifp->if_softc = sc;
723 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
724 	if (sc->sc_hwrev & URTW_HWREV_8187) {
725 		ifp->if_init = urtw_init;
726 	} else {
727 		ifp->if_init = urtw_8187b_init;
728 	}
729 	ifp->if_ioctl = urtw_ioctl;
730 	ifp->if_start = urtw_start;
731 	ifp->if_watchdog = urtw_watchdog;
732 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
733 	IFQ_SET_READY(&ifp->if_snd);
734 	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
735 
736 	if_attach(ifp);
737 	ieee80211_ifattach(ic);
738 
739 	/* override state transition machine */
740 	sc->sc_newstate = ic->ic_newstate;
741 	ic->ic_newstate = urtw_newstate;
742 	ieee80211_media_init(ic, urtw_media_change, ieee80211_media_status);
743 
744 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
745 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
746 	    &sc->sc_drvbpf);
747 
748 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
749 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
750 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
751 
752 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
753 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
754 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
755 
756 	aprint_normal(", address %s\n", ether_sprintf(ic->ic_myaddr));
757 
758 	ieee80211_announce(ic);
759 
760 	return;
761 fail:
762 	aprint_error(": %s failed!\n", __func__);
763 	sc->sc_dying = true;
764 }
765 
766 int
767 urtw_detach(device_t self, int flags)
768 {
769 	struct urtw_softc *sc = device_private(self);
770 	struct ifnet *ifp = &sc->sc_if;
771 	int s;
772 
773 	s = splusb();
774 
775 	sc->sc_dying = true;
776 
777 	callout_destroy(&sc->scan_to);
778 	callout_destroy(&sc->sc_led_ch);
779 
780 	usb_rem_task(sc->sc_udev, &sc->sc_task);
781 	usb_rem_task(sc->sc_udev, &sc->sc_ledtask);
782 
783 	if (ifp->if_softc != NULL) {
784 		bpf_detach(ifp);
785 		ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
786 		if_detach(ifp);
787 	}
788 
789 	/* abort and free xfers */
790 	urtw_free_tx_data_list(sc);
791 	urtw_free_rx_data_list(sc);
792 	urtw_close_pipes(sc);
793 
794 	splx(s);
795 
796 	return 0;
797 }
798 
799 int
800 urtw_activate(device_t self, enum devact act)
801 {
802 	struct urtw_softc *sc = device_private(self);
803 
804 	switch (act) {
805 	case DVACT_DEACTIVATE:
806 		sc->sc_dying = true;
807 		break;
808 	}
809 
810 	return 0;
811 }
812 
813 usbd_status
814 urtw_close_pipes(struct urtw_softc *sc)
815 {
816 	usbd_status error = 0;
817 
818 	if (sc->sc_rxpipe != NULL) {
819 		error = usbd_close_pipe(sc->sc_rxpipe);
820 		if (error != 0)
821 			goto fail;
822 		sc->sc_rxpipe = NULL;
823 	}
824 	if (sc->sc_txpipe_low != NULL) {
825 		error = usbd_close_pipe(sc->sc_txpipe_low);
826 		if (error != 0)
827 			goto fail;
828 		sc->sc_txpipe_low = NULL;
829 	}
830 	if (sc->sc_txpipe_normal != NULL) {
831 		error = usbd_close_pipe(sc->sc_txpipe_normal);
832 		if (error != 0)
833 			goto fail;
834 		sc->sc_txpipe_normal = NULL;
835 	}
836 fail:
837 	return error;
838 }
839 
840 usbd_status
841 urtw_open_pipes(struct urtw_softc *sc)
842 {
843 	usbd_status error;
844 
845 	/*
846 	 * NB: there is no way to distinguish each pipes so we need to hardcode
847 	 * pipe numbers
848 	 */
849 
850 	/* tx pipe - low priority packets */
851 	if (sc->sc_hwrev & URTW_HWREV_8187)
852 		error = usbd_open_pipe(sc->sc_iface, 0x2,
853 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
854 	else
855 		error = usbd_open_pipe(sc->sc_iface, 0x6,
856 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
857 	if (error != 0) {
858 		printf("%s: could not open Tx low pipe: %s\n",
859 		    device_xname(sc->sc_dev), usbd_errstr(error));
860 		goto fail;
861 	}
862 	/* tx pipe - normal priority packets */
863 	if (sc->sc_hwrev & URTW_HWREV_8187)
864 		error = usbd_open_pipe(sc->sc_iface, 0x3,
865 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
866 	else
867 		error = usbd_open_pipe(sc->sc_iface, 0x7,
868 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
869 	if (error != 0) {
870 		printf("%s: could not open Tx normal pipe: %s\n",
871 		    device_xname(sc->sc_dev), usbd_errstr(error));
872 		goto fail;
873 	}
874 	/* rx pipe */
875 	if (sc->sc_hwrev & URTW_HWREV_8187)
876 		error = usbd_open_pipe(sc->sc_iface, 0x81,
877 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
878 	else
879 		error = usbd_open_pipe(sc->sc_iface, 0x83,
880 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
881 	if (error != 0) {
882 		printf("%s: could not open Rx pipe: %s\n",
883 		    device_xname(sc->sc_dev), usbd_errstr(error));
884 		goto fail;
885 	}
886 
887 	return 0;
888 fail:
889 	(void)urtw_close_pipes(sc);
890 	return error;
891 }
892 
893 int
894 urtw_alloc_rx_data_list(struct urtw_softc *sc)
895 {
896 	int i, error;
897 
898 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
899 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
900 
901 		data->sc = sc;
902 
903 		error = usbd_create_xfer(sc->sc_rxpipe, MCLBYTES,
904 		    0, 0, &data->xfer);
905 		if (error) {
906 
907 			printf("%s: could not allocate rx xfer\n",
908 			    device_xname(sc->sc_dev));
909 			error = ENOMEM;
910 			goto fail;
911 		}
912 
913 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
914 		if (data->m == NULL) {
915 			printf("%s: could not allocate rx mbuf\n",
916 			    device_xname(sc->sc_dev));
917 			error = ENOMEM;
918 			goto fail;
919 		}
920 		MCLGET(data->m, M_DONTWAIT);
921 		if (!(data->m->m_flags & M_EXT)) {
922 			printf("%s: could not allocate rx mbuf cluster\n",
923 			    device_xname(sc->sc_dev));
924 			error = ENOMEM;
925 			goto fail;
926 		}
927 		data->buf = mtod(data->m, uint8_t *);
928 	}
929 
930 	return 0;
931 
932 fail:
933 	urtw_free_rx_data_list(sc);
934 	return error;
935 }
936 
937 void
938 urtw_free_rx_data_list(struct urtw_softc *sc)
939 {
940 	int i;
941 
942 	/* Make sure no transfers are pending. */
943 	if (sc->sc_rxpipe != NULL)
944 		usbd_abort_pipe(sc->sc_rxpipe);
945 
946 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
947 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
948 
949 		if (data->xfer != NULL) {
950 			usbd_destroy_xfer(data->xfer);
951 			data->xfer = NULL;
952 		}
953 		if (data->m != NULL) {
954 			m_freem(data->m);
955 			data->m = NULL;
956 		}
957 	}
958 }
959 
960 int
961 urtw_alloc_tx_data_list(struct urtw_softc *sc)
962 {
963 	int i, error;
964 
965 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
966 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
967 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
968 
969 			data->sc = sc;
970 			data->ni = NULL;
971 
972 			error = usbd_create_xfer((j == URTW_PRIORITY_LOW) ?
973 			    sc->sc_txpipe_low : sc->sc_txpipe_normal,
974 			    URTW_TX_MAXSIZE, USBD_FORCE_SHORT_XFER, 0,
975 			    &data->xfer);
976 			if (error) {
977 				printf("%s: could not allocate tx xfer\n",
978 				    device_xname(sc->sc_dev));
979 				goto fail;
980 			}
981 
982 			data->buf = usbd_get_buffer(data->xfer);
983 
984 			if (((unsigned long)data->buf) % 4)
985 				printf("%s: warn: unaligned buffer %p\n",
986 				    device_xname(sc->sc_dev), data->buf);
987 		}
988 	}
989 
990 	return 0;
991 
992 fail:
993 	urtw_free_tx_data_list(sc);
994 	return error;
995 }
996 
997 void
998 urtw_free_tx_data_list(struct urtw_softc *sc)
999 {
1000 	int i;
1001 
1002 	/* Make sure no transfers are pending. */
1003 	if (sc->sc_txpipe_low != NULL)
1004 		usbd_abort_pipe(sc->sc_txpipe_low);
1005 	if (sc->sc_txpipe_normal != NULL)
1006 		usbd_abort_pipe(sc->sc_txpipe_normal);
1007 
1008 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
1009 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1010 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
1011 
1012 			if (data->xfer != NULL) {
1013 				usbd_destroy_xfer(data->xfer);
1014 				data->xfer = NULL;
1015 			}
1016 			if (data->ni != NULL) {
1017 				ieee80211_free_node(data->ni);
1018 				data->ni = NULL;
1019 			}
1020 		}
1021 	}
1022 }
1023 
1024 int
1025 urtw_media_change(struct ifnet *ifp)
1026 {
1027 	int error;
1028 
1029 	error = ieee80211_media_change(ifp);
1030 	if (error != ENETRESET)
1031 		return error;
1032 
1033 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1034 	    (IFF_UP | IFF_RUNNING))
1035 		ifp->if_init(ifp);
1036 
1037 	return 0;
1038 }
1039 
1040 int
1041 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1042 {
1043 	struct urtw_softc *sc = ic->ic_ifp->if_softc;
1044 
1045 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1046 	callout_stop(&sc->scan_to);
1047 
1048 	/* do it in a process context */
1049 	sc->sc_state = nstate;
1050 	sc->sc_arg = arg;
1051 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
1052 
1053 	return 0;
1054 }
1055 
1056 usbd_status
1057 urtw_led_init(struct urtw_softc *sc)
1058 {
1059 	uint32_t rev;
1060 	usbd_status error;
1061 
1062 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1063 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1064 	if (error != 0)
1065 		goto fail;
1066 
1067 	switch (rev & URTW_EPROM_CID_MASK) {
1068 	case URTW_EPROM_CID_ALPHA0:
1069 		sc->sc_strategy = URTW_SW_LED_MODE1;
1070 		break;
1071 	case URTW_EPROM_CID_SERCOMM_PS:
1072 		sc->sc_strategy = URTW_SW_LED_MODE3;
1073 		break;
1074 	case URTW_EPROM_CID_HW_LED:
1075 		sc->sc_strategy = URTW_HW_LED;
1076 		break;
1077 	case URTW_EPROM_CID_RSVD0:
1078 	case URTW_EPROM_CID_RSVD1:
1079 	default:
1080 		sc->sc_strategy = URTW_SW_LED_MODE0;
1081 		break;
1082 	}
1083 
1084 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1085 
1086 fail:
1087 	return error;
1088 }
1089 
1090 usbd_status
1091 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1092     uint16_t data)
1093 {
1094 	usb_device_request_t req;
1095 
1096 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1097 	req.bRequest = URTW_8187_SETREGS_REQ;
1098 	USETW(req.wValue, addr);
1099 	USETW(req.wIndex, index);
1100 	USETW(req.wLength, sizeof(uint16_t));
1101 
1102 	return usbd_do_request(sc->sc_udev, &req, &data);
1103 }
1104 
1105 usbd_status
1106 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1107 {
1108 	int i;
1109 	int16_t bit;
1110 	uint8_t rlen = 12, wlen = 6;
1111 	uint16_t o1, o2, o3, tmp;
1112 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1113 	uint32_t mask = 0x80000000, value = 0;
1114 	usbd_status error;
1115 
1116 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1117 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1118 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1119 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1120 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1121 	o1 &= ~0xf;
1122 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1123 	DELAY(5);
1124 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1125 	DELAY(5);
1126 
1127 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1128 		bit = ((d2w & mask) != 0) ? 1 : 0;
1129 
1130 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1131 		DELAY(2);
1132 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1133 		    URTW_BB_HOST_BANG_CLK);
1134 		DELAY(2);
1135 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1136 		    URTW_BB_HOST_BANG_CLK);
1137 		DELAY(2);
1138 		mask = mask >> 1;
1139 		if (i == 2)
1140 			break;
1141 		bit = ((d2w & mask) != 0) ? 1 : 0;
1142 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1143 		    URTW_BB_HOST_BANG_CLK);
1144 		DELAY(2);
1145 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1146 		    URTW_BB_HOST_BANG_CLK);
1147 		DELAY(2);
1148 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1149 		DELAY(1);
1150 	}
1151 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1152 	    URTW_BB_HOST_BANG_CLK);
1153 	DELAY(2);
1154 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1155 	DELAY(2);
1156 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1157 	DELAY(2);
1158 
1159 	mask = 0x800;
1160 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1161 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1162 		    o1 | URTW_BB_HOST_BANG_RW);
1163 		DELAY(2);
1164 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1165 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1166 		DELAY(2);
1167 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1168 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1169 		DELAY(2);
1170 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1171 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1172 		DELAY(2);
1173 
1174 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1175 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1176 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1177 		    o1 | URTW_BB_HOST_BANG_RW);
1178 		DELAY(2);
1179 	}
1180 
1181 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1182 	    URTW_BB_HOST_BANG_RW);
1183 	DELAY(2);
1184 
1185 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1186 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1187 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1188 
1189 	if (data != NULL)
1190 		*data = value;
1191 fail:
1192 	return error;
1193 }
1194 
1195 usbd_status
1196 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1197 {
1198 	uint16_t d80, d82, d84;
1199 	usbd_status error;
1200 
1201 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1202 	d80 &= 0xfff3;
1203 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1204 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1205 	d84 &= 0xfff0;
1206 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1207 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1208 	DELAY(10);
1209 
1210 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1211 	DELAY(2);
1212 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1213 	DELAY(10);
1214 
1215 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1216 	if (error != 0)
1217 		goto fail;
1218 
1219 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1220 	DELAY(10);
1221 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1222 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1223 	usbd_delay_ms(sc->sc_udev, 2);
1224 fail:
1225 	return error;
1226 }
1227 
1228 usbd_status
1229 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1230 {
1231 	uint32_t data;
1232 	usbd_status error;
1233 
1234 	*ret = 1;
1235 
1236 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1237 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1238 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1239 	usbd_delay_ms(sc->sc_udev, 500);
1240 
1241 	urtw_8225_write(sc, 0x0, 0x1b7);
1242 
1243 	error = urtw_8225_read(sc, 0x8, &data);
1244 	if (error != 0)
1245 		goto fail;
1246 	if (data != 0x588)
1247 		*ret = 0;
1248 	else {
1249 		error = urtw_8225_read(sc, 0x9, &data);
1250 		if (error != 0)
1251 			goto fail;
1252 		if (data != 0x700)
1253 			*ret = 0;
1254 	}
1255 
1256 	urtw_8225_write(sc, 0x0, 0xb7);
1257 fail:
1258 	return error;
1259 }
1260 
1261 usbd_status
1262 urtw_get_rfchip(struct urtw_softc *sc)
1263 {
1264 	struct urtw_rf *rf = &sc->sc_rf;
1265 	int ret;
1266 	uint32_t data;
1267 	usbd_status error;
1268 
1269 	rf->rf_sc = sc;
1270 
1271 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1272 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1273 		if (error != 0)
1274 			panic("unsupported RF chip");
1275 			/* NOTREACHED */
1276 		switch (data & 0xff) {
1277 		case URTW_EPROM_RFCHIPID_RTL8225U:
1278 			error = urtw_8225_isv2(sc, &ret);
1279 			if (error != 0)
1280 				goto fail;
1281 			if (ret == 0) {
1282 				rf->init = urtw_8225_rf_init;
1283 				rf->set_chan = urtw_8225_rf_set_chan;
1284 				rf->set_sens = urtw_8225_rf_set_sens;
1285 				printf(", RFv1");
1286 			} else {
1287 				rf->init = urtw_8225v2_rf_init;
1288 				rf->set_chan = urtw_8225v2_rf_set_chan;
1289 				rf->set_sens = NULL;
1290 				printf(", RFv2");
1291 			}
1292 			break;
1293 		default:
1294 			goto fail;
1295 		}
1296 	} else {
1297 		rf->init = urtw_8225v2_b_rf_init;
1298 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1299 		rf->set_sens = NULL;
1300 	}
1301 
1302 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1303 	rf->sens = URTW_8225_RF_DEF_SENS;
1304 
1305 	return 0;
1306 
1307 fail:
1308 	panic("unsupported RF chip %d", data & 0xff);
1309 	/* NOTREACHED */
1310 }
1311 
1312 usbd_status
1313 urtw_get_txpwr(struct urtw_softc *sc)
1314 {
1315 	int i, j;
1316 	uint32_t data;
1317 	usbd_status error;
1318 
1319 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1320 	if (error != 0)
1321 		goto fail;
1322 	sc->sc_txpwr_cck_base = data & 0xf;
1323 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1324 
1325 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1326 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1327 		if (error != 0)
1328 			goto fail;
1329 		sc->sc_txpwr_cck[i] = data & 0xf;
1330 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1331 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1332 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1333 	}
1334 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1335 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1336 		if (error != 0)
1337 			goto fail;
1338 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1339 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1340 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1341 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1342 	}
1343 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1344 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1345 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1346 			    &data);
1347 			if (error != 0)
1348 				goto fail;
1349 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1350 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1351 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1352 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1353 			    (data & 0xf000) >> 12;
1354 		}
1355 	} else {
1356 		/* Channel 11. */
1357 		error = urtw_eprom_read32(sc, 0x1b, &data);
1358 		if (error != 0)
1359 			goto fail;
1360 		sc->sc_txpwr_cck[11] = data & 0xf;
1361 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1362 
1363 		/* Channel 12. */
1364 		error = urtw_eprom_read32(sc, 0xa, &data);
1365 		if (error != 0)
1366 			goto fail;
1367 		sc->sc_txpwr_cck[12] = data & 0xf;
1368 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1369 
1370 		/* Channel 13, 14. */
1371 		error = urtw_eprom_read32(sc, 0x1c, &data);
1372 		if (error != 0)
1373 			goto fail;
1374 		sc->sc_txpwr_cck[13] = data & 0xf;
1375 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1376 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1377 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1378 	}
1379 fail:
1380 	return error;
1381 }
1382 
1383 usbd_status
1384 urtw_get_macaddr(struct urtw_softc *sc)
1385 {
1386 	struct ieee80211com *ic = &sc->sc_ic;
1387 	usbd_status error;
1388 	uint32_t data;
1389 
1390 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1391 	if (error != 0)
1392 		goto fail;
1393 	ic->ic_myaddr[0] = data & 0xff;
1394 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1395 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1396 	if (error != 0)
1397 		goto fail;
1398 	ic->ic_myaddr[2] = data & 0xff;
1399 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1400 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1401 	if (error != 0)
1402 		goto fail;
1403 	ic->ic_myaddr[4] = data & 0xff;
1404 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1405 fail:
1406 	return error;
1407 }
1408 
1409 usbd_status
1410 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1411 {
1412 #define URTW_READCMD_LEN		3
1413 	int addrlen, i;
1414 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1415 	usbd_status error;
1416 
1417 	/* NB: make sure the buffer is initialized */
1418 	*data = 0;
1419 
1420 	/* enable EPROM programming */
1421 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1422 	DELAY(URTW_EPROM_DELAY);
1423 
1424 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1425 	if (error != 0)
1426 		goto fail;
1427 	error = urtw_eprom_ck(sc);
1428 	if (error != 0)
1429 		goto fail;
1430 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1431 	if (error != 0)
1432 		goto fail;
1433 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1434 		addrlen = 8;
1435 		addrstr[0] = addr & (1 << 7);
1436 		addrstr[1] = addr & (1 << 6);
1437 		addrstr[2] = addr & (1 << 5);
1438 		addrstr[3] = addr & (1 << 4);
1439 		addrstr[4] = addr & (1 << 3);
1440 		addrstr[5] = addr & (1 << 2);
1441 		addrstr[6] = addr & (1 << 1);
1442 		addrstr[7] = addr & (1 << 0);
1443 	} else {
1444 		addrlen=6;
1445 		addrstr[0] = addr & (1 << 5);
1446 		addrstr[1] = addr & (1 << 4);
1447 		addrstr[2] = addr & (1 << 3);
1448 		addrstr[3] = addr & (1 << 2);
1449 		addrstr[4] = addr & (1 << 1);
1450 		addrstr[5] = addr & (1 << 0);
1451 	}
1452 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1453 	if (error != 0)
1454 		goto fail;
1455 
1456 	error = urtw_eprom_writebit(sc, 0);
1457 	if (error != 0)
1458 		goto fail;
1459 
1460 	for (i = 0; i < 16; i++) {
1461 		error = urtw_eprom_ck(sc);
1462 		if (error != 0)
1463 			goto fail;
1464 		error = urtw_eprom_readbit(sc, &data16);
1465 		if (error != 0)
1466 			goto fail;
1467 
1468 		(*data) |= (data16 << (15 - i));
1469 	}
1470 
1471 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1472 	if (error != 0)
1473 		goto fail;
1474 	error = urtw_eprom_ck(sc);
1475 	if (error != 0)
1476 		goto fail;
1477 
1478 	/* now disable EPROM programming */
1479 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1480 fail:
1481 	return error;
1482 #undef URTW_READCMD_LEN
1483 }
1484 
1485 usbd_status
1486 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1487 {
1488 	uint8_t data8;
1489 	usbd_status error;
1490 
1491 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1492 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1493 	DELAY(URTW_EPROM_DELAY);
1494 
1495 fail:
1496 	return error;
1497 }
1498 
1499 usbd_status
1500 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1501 {
1502 	int i = 0;
1503 	usbd_status error = 0;
1504 
1505 	for (i = 0; i < buflen; i++) {
1506 		error = urtw_eprom_writebit(sc, buf[i]);
1507 		if (error != 0)
1508 			goto fail;
1509 		error = urtw_eprom_ck(sc);
1510 		if (error != 0)
1511 			goto fail;
1512 	}
1513 fail:
1514 	return error;
1515 }
1516 
1517 usbd_status
1518 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1519 {
1520 	uint8_t data;
1521 	usbd_status error;
1522 
1523 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1524 	if (bit != 0)
1525 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1526 	else
1527 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1528 	DELAY(URTW_EPROM_DELAY);
1529 fail:
1530 	return error;
1531 }
1532 
1533 usbd_status
1534 urtw_eprom_ck(struct urtw_softc *sc)
1535 {
1536 	uint8_t data;
1537 	usbd_status error;
1538 
1539 	/* masking */
1540 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1541 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1542 	DELAY(URTW_EPROM_DELAY);
1543 	/* unmasking */
1544 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1545 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1546 	DELAY(URTW_EPROM_DELAY);
1547 fail:
1548 	return error;
1549 }
1550 
1551 usbd_status
1552 urtw_eprom_cs(struct urtw_softc *sc, int able)
1553 {
1554 	uint8_t data;
1555 	usbd_status error;
1556 
1557 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1558 	if (able == URTW_EPROM_ENABLE)
1559 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1560 	else
1561 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1562 	DELAY(URTW_EPROM_DELAY);
1563 fail:
1564 	return error;
1565 }
1566 
1567 usbd_status
1568 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1569 {
1570 	usb_device_request_t req;
1571 	usbd_status error;
1572 
1573 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1574 	req.bRequest = URTW_8187_GETREGS_REQ;
1575 	USETW(req.wValue, val | 0xff00);
1576 	USETW(req.wIndex, idx & 0x03);
1577 	USETW(req.wLength, sizeof(uint8_t));
1578 
1579 	error = usbd_do_request(sc->sc_udev, &req, data);
1580 	return error;
1581 }
1582 
1583 usbd_status
1584 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1585 {
1586 	usb_device_request_t req;
1587 	usbd_status error;
1588 
1589 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1590 	req.bRequest = URTW_8187_GETREGS_REQ;
1591 	USETW(req.wValue, val | 0xfe00);
1592 	USETW(req.wIndex, 0);
1593 	USETW(req.wLength, sizeof(uint8_t));
1594 
1595 	error = usbd_do_request(sc->sc_udev, &req, data);
1596 	return error;
1597 }
1598 
1599 usbd_status
1600 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1601 {
1602 	usb_device_request_t req;
1603 	usbd_status error;
1604 
1605 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1606 	req.bRequest = URTW_8187_GETREGS_REQ;
1607 	USETW(req.wValue, val | 0xff00);
1608 	USETW(req.wIndex, idx & 0x03);
1609 	USETW(req.wLength, sizeof(uint16_t));
1610 
1611 	error = usbd_do_request(sc->sc_udev, &req, data);
1612 	return error;
1613 }
1614 
1615 usbd_status
1616 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1617 {
1618 	usb_device_request_t req;
1619 	usbd_status error;
1620 
1621 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1622 	req.bRequest = URTW_8187_GETREGS_REQ;
1623 	USETW(req.wValue, val | 0xff00);
1624 	USETW(req.wIndex, idx & 0x03);
1625 	USETW(req.wLength, sizeof(uint32_t));
1626 
1627 	error = usbd_do_request(sc->sc_udev, &req, data);
1628 	return error;
1629 }
1630 
1631 usbd_status
1632 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1633 {
1634 	usb_device_request_t req;
1635 
1636 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1637 	req.bRequest = URTW_8187_SETREGS_REQ;
1638 	USETW(req.wValue, val | 0xff00);
1639 	USETW(req.wIndex, idx & 0x03);
1640 	USETW(req.wLength, sizeof(uint8_t));
1641 
1642 	return usbd_do_request(sc->sc_udev, &req, &data);
1643 }
1644 
1645 usbd_status
1646 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1647 {
1648 	usb_device_request_t req;
1649 
1650 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1651 	req.bRequest = URTW_8187_SETREGS_REQ;
1652 	USETW(req.wValue, val | 0xfe00);
1653 	USETW(req.wIndex, 0);
1654 	USETW(req.wLength, sizeof(uint8_t));
1655 
1656 	return usbd_do_request(sc->sc_udev, &req, &data);
1657 }
1658 
1659 usbd_status
1660 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1661 {
1662 	usb_device_request_t req;
1663 
1664 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1665 	req.bRequest = URTW_8187_SETREGS_REQ;
1666 	USETW(req.wValue, val | 0xff00);
1667 	USETW(req.wIndex, idx & 0x03);
1668 	USETW(req.wLength, sizeof(uint16_t));
1669 
1670 	return usbd_do_request(sc->sc_udev, &req, &data);
1671 }
1672 
1673 usbd_status
1674 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1675 {
1676 	usb_device_request_t req;
1677 
1678 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1679 	req.bRequest = URTW_8187_SETREGS_REQ;
1680 	USETW(req.wValue, val | 0xff00);
1681 	USETW(req.wIndex, idx & 0x03);
1682 	USETW(req.wLength, sizeof(uint32_t));
1683 
1684 	return usbd_do_request(sc->sc_udev, &req, &data);
1685 }
1686 
1687 static usbd_status
1688 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1689 {
1690 	uint8_t data;
1691 	usbd_status error;
1692 
1693 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1694 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1695 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1696 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1697 fail:
1698 	return error;
1699 }
1700 
1701 usbd_status
1702 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1703 {
1704 	uint8_t data;
1705 	usbd_status error;
1706 
1707 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1708 	if (error)
1709 		goto fail;
1710 
1711 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1712 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1713 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1714 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1715 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1716 
1717 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1718 	if (error)
1719 		goto fail;
1720 fail:
1721 	return error;
1722 }
1723 
1724 usbd_status
1725 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1726 {
1727 	uint8_t data;
1728 	usbd_status error;
1729 
1730 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1731 	if (error)
1732 		goto fail;
1733 
1734 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1735 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1736 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1737 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1738 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1739 
1740 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1741 	if (error)
1742 		goto fail;
1743 fail:
1744 	return error;
1745 }
1746 
1747 usbd_status
1748 urtw_intr_disable(struct urtw_softc *sc)
1749 {
1750 	usbd_status error;
1751 
1752 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1753 
1754 fail:
1755 	return error;
1756 }
1757 
1758 usbd_status
1759 urtw_reset(struct urtw_softc *sc)
1760 {
1761 	uint8_t data;
1762 	usbd_status error;
1763 
1764 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1765 	if (error)
1766 		goto fail;
1767 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1768 	if (error)
1769 		goto fail;
1770 
1771 	error = urtw_intr_disable(sc);
1772 	if (error)
1773 		goto fail;
1774 	usbd_delay_ms(sc->sc_udev, 100);
1775 
1776 	error = urtw_write8e(sc, 0x18, 0x10);
1777 	if (error != 0)
1778 		goto fail;
1779 	error = urtw_write8e(sc, 0x18, 0x11);
1780 	if (error != 0)
1781 		goto fail;
1782 	error = urtw_write8e(sc, 0x18, 0x00);
1783 	if (error != 0)
1784 		goto fail;
1785 	usbd_delay_ms(sc->sc_udev, 100);
1786 
1787 	urtw_read8_m(sc, URTW_CMD, &data);
1788 	data = (data & 2) | URTW_CMD_RST;
1789 	urtw_write8_m(sc, URTW_CMD, data);
1790 	usbd_delay_ms(sc->sc_udev, 100);
1791 
1792 	urtw_read8_m(sc, URTW_CMD, &data);
1793 	if (data & URTW_CMD_RST) {
1794 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
1795 		goto fail;
1796 	}
1797 
1798 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1799 	if (error)
1800 		goto fail;
1801 	usbd_delay_ms(sc->sc_udev, 100);
1802 
1803 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1804 	if (error)
1805 		goto fail;
1806 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1807 	if (error)
1808 		goto fail;
1809 fail:
1810 	return error;
1811 }
1812 
1813 usbd_status
1814 urtw_led_on(struct urtw_softc *sc, int type)
1815 {
1816 	usbd_status error;
1817 
1818 	if (type == URTW_LED_GPIO) {
1819 		switch (sc->sc_gpio_ledpin) {
1820 		case URTW_LED_PIN_GPIO0:
1821 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1822 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1823 			break;
1824 		default:
1825 			panic("unsupported LED PIN type 0x%x",
1826 			    sc->sc_gpio_ledpin);
1827 			/* NOTREACHED */
1828 		}
1829 	} else {
1830 		panic("unsupported LED type 0x%x", type);
1831 		/* NOTREACHED */
1832 	}
1833 
1834 	sc->sc_gpio_ledon = 1;
1835 fail:
1836 	return error;
1837 }
1838 
1839 static usbd_status
1840 urtw_led_off(struct urtw_softc *sc, int type)
1841 {
1842 	usbd_status error;
1843 
1844 	if (type == URTW_LED_GPIO) {
1845 		switch (sc->sc_gpio_ledpin) {
1846 		case URTW_LED_PIN_GPIO0:
1847 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1848 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1849 			break;
1850 		default:
1851 			panic("unsupported LED PIN type 0x%x",
1852 			    sc->sc_gpio_ledpin);
1853 			/* NOTREACHED */
1854 		}
1855 	} else {
1856 		panic("unsupported LED type 0x%x", type);
1857 		/* NOTREACHED */
1858 	}
1859 
1860 	sc->sc_gpio_ledon = 0;
1861 
1862 fail:
1863 	return error;
1864 }
1865 
1866 usbd_status
1867 urtw_led_mode0(struct urtw_softc *sc, int mode)
1868 {
1869 	switch (mode) {
1870 	case URTW_LED_CTL_POWER_ON:
1871 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1872 		break;
1873 	case URTW_LED_CTL_TX:
1874 		if (sc->sc_gpio_ledinprogress == 1)
1875 			return 0;
1876 
1877 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1878 		sc->sc_gpio_blinktime = 2;
1879 		break;
1880 	case URTW_LED_CTL_LINK:
1881 		sc->sc_gpio_ledstate = URTW_LED_ON;
1882 		break;
1883 	default:
1884 		panic("unsupported LED mode 0x%x", mode);
1885 		/* NOTREACHED */
1886 	}
1887 
1888 	switch (sc->sc_gpio_ledstate) {
1889 	case URTW_LED_ON:
1890 		if (sc->sc_gpio_ledinprogress != 0)
1891 			break;
1892 		urtw_led_on(sc, URTW_LED_GPIO);
1893 		break;
1894 	case URTW_LED_BLINK_NORMAL:
1895 		if (sc->sc_gpio_ledinprogress != 0)
1896 			break;
1897 		sc->sc_gpio_ledinprogress = 1;
1898 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1899 			URTW_LED_OFF : URTW_LED_ON;
1900 		if (!sc->sc_dying)
1901 			callout_schedule(&sc->sc_led_ch, mstohz(100));
1902 		break;
1903 	case URTW_LED_POWER_ON_BLINK:
1904 		urtw_led_on(sc, URTW_LED_GPIO);
1905 		usbd_delay_ms(sc->sc_udev, 100);
1906 		urtw_led_off(sc, URTW_LED_GPIO);
1907 		break;
1908 	default:
1909 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1910 		/* NOTREACHED */
1911 	}
1912 	return 0;
1913 }
1914 
1915 usbd_status
1916 urtw_led_mode1(struct urtw_softc *sc, int mode)
1917 {
1918 	return USBD_INVAL;
1919 }
1920 
1921 usbd_status
1922 urtw_led_mode2(struct urtw_softc *sc, int mode)
1923 {
1924 	return USBD_INVAL;
1925 }
1926 
1927 usbd_status
1928 urtw_led_mode3(struct urtw_softc *sc, int mode)
1929 {
1930 	return USBD_INVAL;
1931 }
1932 
1933 void
1934 urtw_ledusbtask(void *arg)
1935 {
1936 	struct urtw_softc *sc = arg;
1937 
1938 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1939 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1940 
1941 	urtw_led_blink(sc);
1942 }
1943 
1944 void
1945 urtw_ledtask(void *arg)
1946 {
1947 	struct urtw_softc *sc = arg;
1948 
1949 	/*
1950 	 * NB: to change a status of the led we need at least a sleep so we
1951 	 * can't do it here
1952 	 */
1953 	usb_add_task(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER);
1954 }
1955 
1956 usbd_status
1957 urtw_led_ctl(struct urtw_softc *sc, int mode)
1958 {
1959 	usbd_status error = 0;
1960 
1961 	switch (sc->sc_strategy) {
1962 	case URTW_SW_LED_MODE0:
1963 		error = urtw_led_mode0(sc, mode);
1964 		break;
1965 	case URTW_SW_LED_MODE1:
1966 		error = urtw_led_mode1(sc, mode);
1967 		break;
1968 	case URTW_SW_LED_MODE2:
1969 		error = urtw_led_mode2(sc, mode);
1970 		break;
1971 	case URTW_SW_LED_MODE3:
1972 		error = urtw_led_mode3(sc, mode);
1973 		break;
1974 	default:
1975 		panic("unsupported LED mode %d", sc->sc_strategy);
1976 		/* NOTREACHED */
1977 	}
1978 
1979 	return error;
1980 }
1981 
1982 usbd_status
1983 urtw_led_blink(struct urtw_softc *sc)
1984 {
1985 	uint8_t ing = 0;
1986 
1987 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1988 		(void)urtw_led_on(sc, URTW_LED_GPIO);
1989 	else
1990 		(void)urtw_led_off(sc, URTW_LED_GPIO);
1991 	sc->sc_gpio_blinktime--;
1992 	if (sc->sc_gpio_blinktime == 0)
1993 		ing = 1;
1994 	else {
1995 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
1996 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
1997 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
1998 			ing = 1;
1999 	}
2000 	if (ing == 1) {
2001 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2002 		    sc->sc_gpio_ledon == 0)
2003 			(void)urtw_led_on(sc, URTW_LED_GPIO);
2004 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2005 		    sc->sc_gpio_ledon == 1)
2006 			(void)urtw_led_off(sc, URTW_LED_GPIO);
2007 
2008 		sc->sc_gpio_blinktime = 0;
2009 		sc->sc_gpio_ledinprogress = 0;
2010 		return 0;
2011 	}
2012 
2013 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2014 	    URTW_LED_ON : URTW_LED_OFF;
2015 
2016 	switch (sc->sc_gpio_ledstate) {
2017 	case URTW_LED_BLINK_NORMAL:
2018 		if (!sc->sc_dying)
2019 			callout_schedule(&sc->sc_led_ch, mstohz(100));
2020 		break;
2021 	default:
2022 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2023 		/* NOTREACHED */
2024 	}
2025 	return 0;
2026 }
2027 
2028 usbd_status
2029 urtw_update_msr(struct urtw_softc *sc)
2030 {
2031 	struct ieee80211com *ic = &sc->sc_ic;
2032 	uint8_t data;
2033 	usbd_status error;
2034 
2035 	urtw_read8_m(sc, URTW_MSR, &data);
2036 	data &= ~URTW_MSR_LINK_MASK;
2037 
2038 	/* Should always be set. */
2039 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2040 		data |= URTW_MSR_LINK_ENEDCA;
2041 
2042 	if (sc->sc_state == IEEE80211_S_RUN) {
2043 		switch (ic->ic_opmode) {
2044 		case IEEE80211_M_STA:
2045 		case IEEE80211_M_MONITOR:
2046 			data |= URTW_MSR_LINK_STA;
2047 			break;
2048 		default:
2049 			panic("unsupported operation mode 0x%x",
2050 			    ic->ic_opmode);
2051 			/* NOTREACHED */
2052 		}
2053 	} else
2054 		data |= URTW_MSR_LINK_NONE;
2055 
2056 	urtw_write8_m(sc, URTW_MSR, data);
2057 fail:
2058 	return error;
2059 }
2060 
2061 uint16_t
2062 urtw_rate2rtl(int rate)
2063 {
2064 	unsigned int i;
2065 
2066 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2067 		if (rate == urtw_ratetable[i].reg)
2068 			return urtw_ratetable[i].val;
2069 	}
2070 
2071 	return 3;
2072 }
2073 
2074 uint16_t
2075 urtw_rtl2rate(int rate)
2076 {
2077 	unsigned int i;
2078 
2079 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2080 		if (rate == urtw_ratetable[i].val)
2081 			return urtw_ratetable[i].reg;
2082 	}
2083 
2084 	return 0;
2085 }
2086 
2087 usbd_status
2088 urtw_set_rate(struct urtw_softc *sc)
2089 {
2090 	int i, basic_rate, min_rr_rate, max_rr_rate;
2091 	uint16_t data;
2092 	usbd_status error;
2093 
2094 	basic_rate = urtw_rate2rtl(48);
2095 	min_rr_rate = urtw_rate2rtl(12);
2096 	max_rr_rate = urtw_rate2rtl(48);
2097 
2098 	urtw_write8_m(sc, URTW_RESP_RATE,
2099 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2100 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2101 
2102 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2103 	data &= ~URTW_BRSR_MBR_8185;
2104 
2105 	for (i = 0; i <= basic_rate; i++)
2106 		data |= (1 << i);
2107 
2108 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2109 fail:
2110 	return error;
2111 }
2112 
2113 usbd_status
2114 urtw_intr_enable(struct urtw_softc *sc)
2115 {
2116 	usbd_status error;
2117 
2118 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2119 fail:
2120 	return error;
2121 }
2122 
2123 usbd_status
2124 urtw_rx_setconf(struct urtw_softc *sc)
2125 {
2126 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2127 	struct ieee80211com *ic = &sc->sc_ic;
2128 	uint32_t data;
2129 	usbd_status error;
2130 
2131 	urtw_read32_m(sc, URTW_RX, &data);
2132 	data = data &~ URTW_RX_FILTER_MASK;
2133 #if 0
2134 	data = data | URTW_RX_FILTER_CTL;
2135 #endif
2136 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2137 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2138 
2139 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2140 		data = data | URTW_RX_FILTER_ICVERR;
2141 		data = data | URTW_RX_FILTER_PWR;
2142 	}
2143 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2144 		data = data | URTW_RX_FILTER_CRCERR;
2145 
2146 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2147 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2148 		data = data | URTW_RX_FILTER_ALLMAC;
2149 	} else {
2150 		data = data | URTW_RX_FILTER_NICMAC;
2151 		data = data | URTW_RX_CHECK_BSSID;
2152 	}
2153 
2154 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2155 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2156 	data = data &~ URTW_MAX_RX_DMA_MASK;
2157 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2158 
2159 	urtw_write32_m(sc, URTW_RX, data);
2160 fail:
2161 	return error;
2162 }
2163 
2164 usbd_status
2165 urtw_rx_enable(struct urtw_softc *sc)
2166 {
2167 	int i;
2168 	struct urtw_rx_data *rx_data;
2169 	uint8_t data;
2170 	usbd_status error;
2171 
2172 	/*
2173 	 * Start up the receive pipe.
2174 	 */
2175 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2176 		rx_data = &sc->sc_rx_data[i];
2177 
2178 		usbd_setup_xfer(rx_data->xfer, rx_data, rx_data->buf, MCLBYTES,
2179 		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2180 		error = usbd_transfer(rx_data->xfer);
2181 		if (error != USBD_IN_PROGRESS && error != 0) {
2182 			printf("%s: could not queue Rx transfer\n",
2183 			    device_xname(sc->sc_dev));
2184 			goto fail;
2185 		}
2186 	}
2187 
2188 	error = urtw_rx_setconf(sc);
2189 	if (error != 0)
2190 		goto fail;
2191 
2192 	urtw_read8_m(sc, URTW_CMD, &data);
2193 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2194 fail:
2195 	return error;
2196 }
2197 
2198 usbd_status
2199 urtw_tx_enable(struct urtw_softc *sc)
2200 {
2201 	uint8_t data8;
2202 	uint32_t data;
2203 	usbd_status error;
2204 
2205 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2206 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2207 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2208 		    URTW_CW_CONF_PERPACKET_RETRY);
2209 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2210 
2211 		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2212 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2213 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2214 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2215 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2216 
2217 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2218 		data &= ~URTW_TX_LOOPBACK_MASK;
2219 		data |= URTW_TX_LOOPBACK_NONE;
2220 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2221 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2222 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2223 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2224 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2225 		data &= ~URTW_TX_SWPLCPLEN;
2226 		data |= URTW_TX_NOICV;
2227 		urtw_write32_m(sc, URTW_TX_CONF, data);
2228 	} else {
2229 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2230 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2231 		    URTW_TX_LONGRETRY;
2232 		urtw_write32_m(sc, URTW_TX_CONF, data);
2233 	}
2234 
2235 	urtw_read8_m(sc, URTW_CMD, &data8);
2236 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2237 fail:
2238 	return error;
2239 }
2240 
2241 int
2242 urtw_init(struct ifnet *ifp)
2243 {
2244 	struct urtw_softc *sc = ifp->if_softc;
2245 	struct urtw_rf *rf = &sc->sc_rf;
2246 	struct ieee80211com *ic = &sc->sc_ic;
2247 	usbd_status error;
2248 
2249 	urtw_stop(ifp, 0);
2250 
2251 	error = urtw_reset(sc);
2252 	if (error)
2253 		goto fail;
2254 
2255 	urtw_write8_m(sc, 0x85, 0);
2256 	urtw_write8_m(sc, URTW_GPIO, 0);
2257 
2258 	/* for led */
2259 	urtw_write8_m(sc, 0x85, 4);
2260 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2261 	if (error != 0)
2262 		goto fail;
2263 
2264 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2265 	if (error)
2266 		goto fail;
2267 
2268 	/* applying MAC address again. */
2269 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2270 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2271 	if (error)
2272 		goto fail;
2273 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2274 	if (error)
2275 		goto fail;
2276 
2277 	error = urtw_update_msr(sc);
2278 	if (error)
2279 		goto fail;
2280 
2281 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2282 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2283 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2284 	error = urtw_set_rate(sc);
2285 	if (error != 0)
2286 		goto fail;
2287 
2288 	error = rf->init(rf);
2289 	if (error != 0)
2290 		goto fail;
2291 	if (rf->set_sens != NULL)
2292 		rf->set_sens(rf);
2293 
2294 	urtw_write16_m(sc, 0x5e, 1);
2295 	urtw_write16_m(sc, 0xfe, 0x10);
2296 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2297 	urtw_write8_m(sc, 0xff, 0x60);
2298 	urtw_write16_m(sc, 0x5e, 0);
2299 	urtw_write8_m(sc, 0x85, 4);
2300 
2301 	error = urtw_intr_enable(sc);
2302 	if (error != 0)
2303 		goto fail;
2304 
2305 	/* reset softc variables */
2306 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
2307 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
2308 	}
2309 	sc->sc_txtimer = 0;
2310 
2311 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2312 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2313 		if (error != 0) {
2314 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
2315 			    ", err=%s\n", usbd_errstr(error));
2316 			goto fail;
2317 		}
2318 		/* get the first interface handle */
2319 		error = usbd_device2interface_handle(sc->sc_udev,
2320 		    URTW_IFACE_INDEX, &sc->sc_iface);
2321 		if (error != 0) {
2322 			printf("%s: could not get interface handle\n",
2323 			    device_xname(sc->sc_dev));
2324 			goto fail;
2325 		}
2326 		error = urtw_open_pipes(sc);
2327 		if (error != 0)
2328 			goto fail;
2329 		error = urtw_alloc_rx_data_list(sc);
2330 		if (error != 0)
2331 			goto fail;
2332 		error = urtw_alloc_tx_data_list(sc);
2333 		if (error != 0)
2334 			goto fail;
2335 		sc->sc_flags |= URTW_INIT_ONCE;
2336 	}
2337 
2338 	error = urtw_rx_enable(sc);
2339 	if (error != 0)
2340 		goto fail;
2341 	error = urtw_tx_enable(sc);
2342 	if (error != 0)
2343 		goto fail;
2344 
2345 	ifp->if_flags &= ~IFF_OACTIVE;
2346 	ifp->if_flags |= IFF_RUNNING;
2347 
2348 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2349 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2350 	else
2351 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2352 
2353 	return 0;
2354 fail:
2355 	return error;
2356 }
2357 
2358 int
2359 urtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2360 {
2361 #define IS_RUNNING(ifp) \
2362 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
2363 
2364 	struct urtw_softc *sc = ifp->if_softc;
2365 	struct ieee80211com *ic = &sc->sc_ic;
2366 	int s, error = 0;
2367 
2368 	if (sc->sc_dying)
2369 		return ENXIO;
2370 
2371 	s = splnet();
2372 
2373 	switch (cmd) {
2374 	case SIOCSIFFLAGS:
2375 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2376 			break;
2377 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2378 		case IFF_UP|IFF_RUNNING:
2379 			break;
2380 		case IFF_UP:
2381 			ifp->if_init(ifp);
2382 			break;
2383 		case IFF_RUNNING:
2384 			urtw_stop(ifp, 1);
2385 			break;
2386 		case 0:
2387 			break;
2388 		}
2389 		break;
2390 
2391 	case SIOCADDMULTI:
2392 	case SIOCDELMULTI:
2393 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
2394 			error = 0;
2395 		break;
2396 
2397 	default:
2398 		error = ieee80211_ioctl(ic, cmd, data);
2399 		break;
2400 	}
2401 
2402 	if (error == ENETRESET) {
2403 		if (IS_RUNNING(ifp) &&
2404 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2405 			ifp->if_init(ifp);
2406 		error = 0;
2407 	}
2408 
2409 	splx(s);
2410 
2411 	return error;
2412 #undef IS_RUNNING
2413 }
2414 
2415 void
2416 urtw_start(struct ifnet *ifp)
2417 {
2418 	struct urtw_softc *sc = ifp->if_softc;
2419 	struct ieee80211com *ic = &sc->sc_ic;
2420 	struct ieee80211_node *ni;
2421 	struct ether_header *eh;
2422 	struct mbuf *m0;
2423 
2424 	/*
2425 	 * net80211 may still try to send management frames even if the
2426 	 * IFF_RUNNING flag is not set...
2427 	 */
2428 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2429 		return;
2430 
2431 	for (;;) {
2432 		IF_POLL(&ic->ic_mgtq, m0);
2433 		if (m0 != NULL) {
2434 
2435 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2436 			    URTW_TX_DATA_LIST_COUNT) {
2437 				ifp->if_flags |= IFF_OACTIVE;
2438 				break;
2439 			}
2440 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2441 			ni = M_GETCTX(m0, struct ieee80211_node *);
2442 			M_CLEARCTX(m0);
2443 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2444 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2445 			    != 0)
2446 				break;
2447 		} else {
2448 			if (ic->ic_state != IEEE80211_S_RUN)
2449 				break;
2450 			IFQ_POLL(&ifp->if_snd, m0);
2451 			if (m0 == NULL)
2452 				break;
2453 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2454 			    URTW_TX_DATA_LIST_COUNT) {
2455 				ifp->if_flags |= IFF_OACTIVE;
2456 				break;
2457 			}
2458 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2459 			if (m0->m_len < sizeof(struct ether_header) &&
2460 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
2461 				continue;
2462 
2463 			eh = mtod(m0, struct ether_header *);
2464 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2465 			if (ni == NULL) {
2466 				m_freem(m0);
2467 				continue;
2468 			}
2469 			bpf_mtap(ifp, m0, BPF_D_OUT);
2470 			m0 = ieee80211_encap(ic, m0, ni);
2471 			if (m0 == NULL) {
2472 				ieee80211_free_node(ni);
2473 				continue;
2474 			}
2475 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2476 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2477 			    != 0) {
2478 				ieee80211_free_node(ni);
2479 				ifp->if_oerrors++;
2480 				break;
2481 			}
2482 		}
2483 		sc->sc_txtimer = 5;
2484 		ifp->if_timer = 1;
2485 	}
2486 }
2487 
2488 void
2489 urtw_watchdog(struct ifnet *ifp)
2490 {
2491 	struct urtw_softc *sc = ifp->if_softc;
2492 
2493 	ifp->if_timer = 0;
2494 
2495 	if (sc->sc_txtimer > 0) {
2496 		if (--sc->sc_txtimer == 0) {
2497 			printf("%s: device timeout\n", device_xname(sc->sc_dev));
2498 			ifp->if_oerrors++;
2499 			return;
2500 		}
2501 		ifp->if_timer = 1;
2502 	}
2503 
2504 	ieee80211_watchdog(&sc->sc_ic);
2505 }
2506 
2507 void
2508 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2509     usbd_status status)
2510 {
2511 	struct urtw_tx_data *data = priv;
2512 	struct urtw_softc *sc = data->sc;
2513 	struct ieee80211com *ic = &sc->sc_ic;
2514 	struct ifnet *ifp = ic->ic_ifp;
2515 	int s;
2516 
2517 	if (status != USBD_NORMAL_COMPLETION) {
2518 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2519 			return;
2520 
2521 		printf("%s: could not transmit buffer: %s\n",
2522 		    device_xname(sc->sc_dev), usbd_errstr(status));
2523 
2524 		if (status == USBD_STALLED)
2525 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2526 
2527 		ifp->if_oerrors++;
2528 		return;
2529 	}
2530 
2531 	s = splnet();
2532 
2533 	ieee80211_free_node(data->ni);
2534 	data->ni = NULL;
2535 
2536 	sc->sc_txtimer = 0;
2537 	ifp->if_opackets++;
2538 
2539 	sc->sc_tx_queued[URTW_PRIORITY_LOW]--;
2540 	ifp->if_flags &= ~IFF_OACTIVE;
2541 	urtw_start(ifp);
2542 
2543 	splx(s);
2544 }
2545 
2546 void
2547 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2548     usbd_status status)
2549 {
2550 	struct urtw_tx_data *data = priv;
2551 	struct urtw_softc *sc = data->sc;
2552 	struct ieee80211com *ic = &sc->sc_ic;
2553 	struct ifnet *ifp = ic->ic_ifp;
2554 	int s;
2555 
2556 	if (status != USBD_NORMAL_COMPLETION) {
2557 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2558 			return;
2559 
2560 		printf("%s: could not transmit buffer: %s\n",
2561 		    device_xname(sc->sc_dev), usbd_errstr(status));
2562 
2563 		if (status == USBD_STALLED)
2564 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2565 
2566 		ifp->if_oerrors++;
2567 		return;
2568 	}
2569 
2570 	s = splnet();
2571 
2572 	ieee80211_free_node(data->ni);
2573 	data->ni = NULL;
2574 
2575 	sc->sc_txtimer = 0;
2576 	ifp->if_opackets++;
2577 
2578 	sc->sc_tx_queued[URTW_PRIORITY_NORMAL]--;
2579 	ifp->if_flags &= ~IFF_OACTIVE;
2580 	urtw_start(ifp);
2581 
2582 	splx(s);
2583 }
2584 
2585 int
2586 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2587     int prior)
2588 {
2589 	struct ieee80211com *ic = &sc->sc_ic;
2590 	struct urtw_tx_data *data;
2591 	struct ieee80211_frame *wh;
2592 	struct ieee80211_key *k;
2593 	usbd_status error;
2594 	int xferlen;
2595 
2596 	wh = mtod(m0, struct ieee80211_frame *);
2597 
2598 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2599 		k = ieee80211_crypto_encap(ic, ni, m0);
2600 		if (k == NULL) {
2601 			m_freem(m0);
2602 			return ENOBUFS;
2603 		}
2604 		/* packet header may have moved, reset our local pointer */
2605 		wh = mtod(m0, struct ieee80211_frame *);
2606 	}
2607 
2608 	if (sc->sc_drvbpf != NULL) {
2609 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2610 
2611 		tap->wt_flags = 0;
2612 		tap->wt_rate = 0;
2613 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2614 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2615 
2616 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
2617 	}
2618 
2619 	if (sc->sc_hwrev & URTW_HWREV_8187)
2620 		xferlen = m0->m_pkthdr.len + 4 * 3;
2621 	else
2622 		xferlen = m0->m_pkthdr.len + 4 * 8;
2623 
2624 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2625 		xferlen += 1;
2626 
2627 	data = &sc->sc_tx_data[prior][sc->sc_txidx[prior]];
2628 	sc->sc_txidx[prior] =
2629 	    (sc->sc_txidx[prior] + 1) % URTW_TX_DATA_LIST_COUNT;
2630 
2631 	memset(data->buf, 0, URTW_TX_MAXSIZE);
2632 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2633 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2634 	data->buf[1] |= (1 << 7);
2635 
2636 	/* XXX sc_preamble_mode is always 2. */
2637 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2638 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2639 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2640 		data->buf[2] |= 1;
2641 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2642 	    prior == URTW_PRIORITY_LOW)
2643 		panic("TODO tx.");
2644 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2645 		data->buf[2] |= (1 << 1);
2646 	/* RTS rate - 10 means we use a basic rate. */
2647 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2648 	/*
2649 	 * XXX currently TX rate control depends on the rate value of
2650 	 * RX descriptor because I don't know how to we can control TX rate
2651 	 * in more smart way.  Please fix me you find a thing.
2652 	 */
2653 	data->buf[3] = sc->sc_currate;
2654 	if (prior == URTW_PRIORITY_NORMAL) {
2655 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2656 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2657 		else if (ic->ic_fixed_rate != -1)
2658 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2659 	}
2660 
2661 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2662 		data->buf[8] = 3;		/* CW minimum */
2663 		data->buf[8] |= (7 << 4);	/* CW maximum */
2664 		data->buf[9] |= 11;		/* retry limitation */
2665 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2666 	} else {
2667 		data->buf[21] |= 11;		/* retry limitation */
2668 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2669 	}
2670 
2671 	data->ni = ni;
2672 
2673 	/* mbuf is no longer needed. */
2674 	m_freem(m0);
2675 
2676 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2677 	    USBD_FORCE_SHORT_XFER, URTW_DATA_TIMEOUT,
2678 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2679 	error = usbd_transfer(data->xfer);
2680 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2681 		printf("%s: could not send frame: %s\n",
2682 		    device_xname(sc->sc_dev), usbd_errstr(error));
2683 		return EIO;
2684 	}
2685 
2686 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2687 	if (error != 0)
2688 		printf("%s: could not control LED (%d)\n",
2689 		    device_xname(sc->sc_dev), error);
2690 
2691 	sc->sc_tx_queued[prior]++;
2692 
2693 	return 0;
2694 }
2695 
2696 usbd_status
2697 urtw_8225_usb_init(struct urtw_softc *sc)
2698 {
2699 	uint8_t data;
2700 	usbd_status error;
2701 
2702 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2703 	urtw_write8_m(sc, URTW_GPIO, 0);
2704 	error = urtw_read8e(sc, 0x53, &data);
2705 	if (error)
2706 		goto fail;
2707 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2708 	if (error)
2709 		goto fail;
2710 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2711 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2712 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2713 
2714 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2715 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2716 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2717 
2718 	usbd_delay_ms(sc->sc_udev, 500);
2719 fail:
2720 	return error;
2721 }
2722 
2723 usbd_status
2724 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2725 {
2726 	usbd_status error = 0;
2727 
2728 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2729 fail:
2730 	return error;
2731 }
2732 
2733 usbd_status
2734 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2735 {
2736 	uint32_t phyw;
2737 	usbd_status error;
2738 
2739 	phyw = ((data << 8) | (addr | 0x80));
2740 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2741 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2742 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2743 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2744 	/*
2745 	 * Delay removed from 8185 to 8187.
2746 	 * usbd_delay_ms(sc->sc_udev, 1);
2747 	 */
2748 fail:
2749 	return error;
2750 }
2751 
2752 usbd_status
2753 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2754 {
2755 	data = data & 0xff;
2756 	return urtw_8187_write_phy(sc, addr, data);
2757 }
2758 
2759 usbd_status
2760 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2761 {
2762 	data = data & 0xff;
2763 	return urtw_8187_write_phy(sc, addr, data | 0x10000);
2764 }
2765 
2766 usbd_status
2767 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2768 {
2769 	usbd_status error;
2770 
2771 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2772 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2773 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2774 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2775 fail:
2776 	return error;
2777 }
2778 
2779 usbd_status
2780 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2781 {
2782 	int i, idx, set;
2783 	uint8_t *cck_pwltable;
2784 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2785 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2786 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2787 	usbd_status error;
2788 
2789 	cck_pwrlvl_max = 11;
2790 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2791 	ofdm_pwrlvl_min = 10;
2792 
2793 	/* CCK power setting */
2794 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2795 	idx = cck_pwrlvl % 6;
2796 	set = cck_pwrlvl / 6;
2797 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2798 	    urtw_8225_txpwr_cck;
2799 
2800 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2801 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2802 	for (i = 0; i < 8; i++) {
2803 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2804 		    cck_pwltable[idx * 8 + i]);
2805 	}
2806 	usbd_delay_ms(sc->sc_udev, 1);
2807 
2808 	/* OFDM power setting */
2809 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2810 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2811 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2812 
2813 	idx = ofdm_pwrlvl % 6;
2814 	set = ofdm_pwrlvl / 6;
2815 
2816 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2817 	if (error)
2818 		goto fail;
2819 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2820 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2821 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2822 
2823 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2824 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2825 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2826 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2827 	usbd_delay_ms(sc->sc_udev, 1);
2828 fail:
2829 	return error;
2830 }
2831 
2832 usbd_status
2833 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2834 {
2835 	usbd_status error;
2836 
2837 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2838 	usbd_delay_ms(sc->sc_udev, 1);
2839 fail:
2840 	return error;
2841 }
2842 
2843 usbd_status
2844 urtw_8225_rf_init(struct urtw_rf *rf)
2845 {
2846 	struct urtw_softc *sc = rf->rf_sc;
2847 	unsigned int i;
2848 	uint16_t data;
2849 	usbd_status error;
2850 
2851 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2852 	if (error)
2853 		goto fail;
2854 
2855 	error = urtw_8225_usb_init(sc);
2856 	if (error)
2857 		goto fail;
2858 
2859 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2860 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2861 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2862 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2863 
2864 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2865 	if (error)
2866 		goto fail;
2867 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2868 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2869 	if (error)
2870 		goto fail;
2871 
2872 	error = urtw_8185_rf_pins_enable(sc);
2873 	if (error)
2874 		goto fail;
2875 
2876 	usbd_delay_ms(sc->sc_udev, 500);
2877 
2878 	for (i = 0; i < __arraycount(urtw_8225_rf_part1); i++) {
2879 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2880 		    urtw_8225_rf_part1[i].val);
2881 	}
2882 	usbd_delay_ms(sc->sc_udev, 50);
2883 	urtw_8225_write(sc, 0x2, 0xc4d);
2884 	usbd_delay_ms(sc->sc_udev, 200);
2885 	urtw_8225_write(sc, 0x2, 0x44d);
2886 	usbd_delay_ms(sc->sc_udev, 200);
2887 	urtw_8225_write(sc, 0x0, 0x127);
2888 
2889 	for (i = 0; i < __arraycount(urtw_8225_rxgain); i++) {
2890 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2891 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2892 	}
2893 
2894 	urtw_8225_write(sc, 0x0, 0x27);
2895 	urtw_8225_write(sc, 0x0, 0x22f);
2896 
2897 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
2898 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2899 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2900 	}
2901 
2902 	for (i = 0; i < __arraycount(urtw_8225_rf_part2); i++) {
2903 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2904 		    urtw_8225_rf_part2[i].val);
2905 		usbd_delay_ms(sc->sc_udev, 1);
2906 	}
2907 
2908 	error = urtw_8225_setgain(sc, 4);
2909 	if (error)
2910 		goto fail;
2911 
2912 	for (i = 0; i < __arraycount(urtw_8225_rf_part3); i++) {
2913 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2914 		    urtw_8225_rf_part3[i].val);
2915 		usbd_delay_ms(sc->sc_udev, 1);
2916 	}
2917 
2918 	urtw_write8_m(sc, 0x5b, 0x0d);
2919 
2920 	error = urtw_8225_set_txpwrlvl(sc, 1);
2921 	if (error)
2922 		goto fail;
2923 
2924 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2925 	usbd_delay_ms(sc->sc_udev, 1);
2926 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2927 	usbd_delay_ms(sc->sc_udev, 1);
2928 
2929 	/* TX ant A, 0x0 for B */
2930 	error = urtw_8185_tx_antenna(sc, 0x3);
2931 	if (error)
2932 		goto fail;
2933 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2934 
2935 	error = urtw_8225_rf_set_chan(rf, 1);
2936 fail:
2937 	return error;
2938 }
2939 
2940 usbd_status
2941 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2942 {
2943 	struct urtw_softc *sc = rf->rf_sc;
2944 	struct ieee80211com *ic = &sc->sc_ic;
2945 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2946 	usbd_status error;
2947 
2948 	error = urtw_8225_set_txpwrlvl(sc, chan);
2949 	if (error)
2950 		goto fail;
2951 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2952 	usbd_delay_ms(sc->sc_udev, 10);
2953 
2954 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2955 
2956 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2957 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2958 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2959 	else
2960 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2961 
2962 	if (IEEE80211_IS_CHAN_G(c)) {
2963 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2964 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
2965 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2966 	} else {
2967 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2968 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
2969 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2970 	}
2971 
2972 fail:
2973 	return error;
2974 }
2975 
2976 usbd_status
2977 urtw_8225_rf_set_sens(struct urtw_rf *rf)
2978 {
2979 	struct urtw_softc *sc = rf->rf_sc;
2980 	usbd_status error;
2981 
2982 	if (rf->sens > 6)
2983 		return -1;
2984 
2985 	if (rf->sens > 4)
2986 		urtw_8225_write(sc, 0x0c, 0x850);
2987 	else
2988 		urtw_8225_write(sc, 0x0c, 0x50);
2989 
2990 	rf->sens = 6 - rf->sens;
2991 	error = urtw_8225_setgain(sc, rf->sens);
2992 	if (error)
2993 		goto fail;
2994 
2995 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
2996 
2997 fail:
2998 	return error;
2999 }
3000 
3001 void
3002 urtw_stop(struct ifnet *ifp, int disable)
3003 {
3004 	struct urtw_softc *sc = ifp->if_softc;
3005 	struct ieee80211com *ic = &sc->sc_ic;
3006 	uint8_t data;
3007 	usbd_status error;
3008 
3009 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3010 
3011 	sc->sc_txtimer = 0;
3012 	ifp->if_timer = 0;
3013 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3014 
3015 	callout_stop(&sc->scan_to);
3016 	callout_stop(&sc->sc_led_ch);
3017 
3018 	urtw_intr_disable(sc);
3019 	urtw_read8_m(sc, URTW_CMD, &data);
3020 	data &= ~URTW_CMD_TX_ENABLE;
3021 	data &= ~URTW_CMD_RX_ENABLE;
3022 	urtw_write8_m(sc, URTW_CMD, data);
3023 
3024 	if (sc->sc_rxpipe != NULL)
3025 		usbd_abort_pipe(sc->sc_rxpipe);
3026 	if (sc->sc_txpipe_low != NULL)
3027 		usbd_abort_pipe(sc->sc_txpipe_low);
3028 	if (sc->sc_txpipe_normal != NULL)
3029 		usbd_abort_pipe(sc->sc_txpipe_normal);
3030 
3031 fail:
3032 	return;
3033 }
3034 
3035 int
3036 urtw_isbmode(uint16_t rate)
3037 {
3038 	rate = urtw_rtl2rate(rate);
3039 
3040 	return ((rate <= 22 && rate != 12 && rate != 18) ||
3041 	    rate == 44) ? 1 : 0;
3042 }
3043 
3044 void
3045 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3046 {
3047 	struct urtw_rx_data *data = priv;
3048 	struct urtw_softc *sc = data->sc;
3049 	struct ieee80211com *ic = &sc->sc_ic;
3050 	struct ifnet *ifp = ic->ic_ifp;
3051 	struct ieee80211_frame *wh;
3052 	struct ieee80211_node *ni;
3053 	struct mbuf *m, *mnew;
3054 	uint8_t *desc, quality, rate;
3055 	int actlen, flen, len, rssi, s;
3056 
3057 	if (status != USBD_NORMAL_COMPLETION) {
3058 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3059 			return;
3060 
3061 		if (status == USBD_STALLED)
3062 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3063 		ifp->if_ierrors++;
3064 		goto skip;
3065 	}
3066 
3067 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3068 	if (actlen < URTW_MIN_RXBUFSZ) {
3069 		ifp->if_ierrors++;
3070 		goto skip;
3071 	}
3072 
3073 	if (sc->sc_hwrev & URTW_HWREV_8187)
3074 		/* 4 dword and 4 byte CRC */
3075 		len = actlen - (4 * 4);
3076 	else
3077 		/* 5 dword and 4 byte CRC */
3078 		len = actlen - (4 * 5);
3079 
3080 	desc = data->buf + len;
3081 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3082 	if (flen > actlen) {
3083 		ifp->if_ierrors++;
3084 		goto skip;
3085 	}
3086 
3087 	rate = (desc[2] & 0xf0) >> 4;
3088 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3089 		quality = desc[4] & 0xff;
3090 		rssi = (desc[6] & 0xfe) >> 1;
3091 
3092 		/* XXX correct? */
3093 		if (!urtw_isbmode(rate)) {
3094 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3095 			rssi = ((90 - rssi) * 100) / 65;
3096 		} else {
3097 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3098 			rssi = ((95 - rssi) * 100) / 65;
3099 		}
3100 	} else {
3101 		quality = desc[12];
3102 		rssi = 14 - desc[14] / 2;
3103 	}
3104 
3105 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3106 	if (mnew == NULL) {
3107 		printf("%s: could not allocate rx mbuf\n",
3108 		    device_xname(sc->sc_dev));
3109 		ifp->if_ierrors++;
3110 		goto skip;
3111 	}
3112 	MCLGET(mnew, M_DONTWAIT);
3113 	if (!(mnew->m_flags & M_EXT)) {
3114 		printf("%s: could not allocate rx mbuf cluster\n",
3115 		    device_xname(sc->sc_dev));
3116 		m_freem(mnew);
3117 		ifp->if_ierrors++;
3118 		goto skip;
3119 	}
3120 
3121 	m = data->m;
3122 	data->m = mnew;
3123 	data->buf = mtod(mnew, uint8_t *);
3124 
3125 	/* finalize mbuf */
3126 	m_set_rcvif(m, ifp);
3127 	m->m_pkthdr.len = m->m_len = flen - 4;
3128 
3129 	s = splnet();
3130 
3131 	if (sc->sc_drvbpf != NULL) {
3132 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3133 
3134 		/* XXX Are variables correct? */
3135 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3136 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3137 		tap->wr_dbm_antsignal = (int8_t)rssi;
3138 
3139 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
3140 	}
3141 	wh = mtod(m, struct ieee80211_frame *);
3142 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3143 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3144 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3145 
3146 	/* XXX correct? */
3147 	if (!urtw_isbmode(rate)) {
3148 		if (quality > 127)
3149 			quality = 0;
3150 		else if (quality < 27)
3151 			quality = 100;
3152 		else
3153 			quality = 127 - quality;
3154 	} else
3155 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3156 
3157 	/* send the frame to the 802.11 layer */
3158 	ieee80211_input(ic, m, ni, rssi, 0);
3159 
3160 	/* node is no longer needed */
3161 	ieee80211_free_node(ni);
3162 
3163 	splx(s);
3164 
3165 skip:	/* setup a new transfer */
3166 	usbd_setup_xfer(xfer, data, data->buf, MCLBYTES,
3167 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3168 	(void)usbd_transfer(xfer);
3169 }
3170 
3171 usbd_status
3172 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3173 {
3174 	uint8_t *gainp;
3175 	usbd_status error;
3176 
3177 	/* XXX for A? */
3178 	gainp = urtw_8225v2_gain_bg;
3179 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3180 	usbd_delay_ms(sc->sc_udev, 1);
3181 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3182 	usbd_delay_ms(sc->sc_udev, 1);
3183 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3184 	usbd_delay_ms(sc->sc_udev, 1);
3185 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3186 	usbd_delay_ms(sc->sc_udev, 1);
3187 fail:
3188 	return error;
3189 }
3190 
3191 usbd_status
3192 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3193 {
3194 	int i;
3195 	uint8_t *cck_pwrtable;
3196 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3197 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3198 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3199 	usbd_status error;
3200 
3201 	/* CCK power setting */
3202 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3203 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3204 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3205 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3206 	    urtw_8225v2_txpwr_cck;
3207 
3208 	for (i = 0; i < 8; i++) {
3209 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3210 	}
3211 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3212 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3213 	usbd_delay_ms(sc->sc_udev, 1);
3214 
3215 	/* OFDM power setting */
3216 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3217 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3218 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3219 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3220 
3221 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3222 	if (error)
3223 		goto fail;
3224 
3225 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3226 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3227 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3228 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3229 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3230 
3231 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3232 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3233 	usbd_delay_ms(sc->sc_udev, 1);
3234 fail:
3235 	return error;
3236 }
3237 
3238 usbd_status
3239 urtw_8225v2_rf_init(struct urtw_rf *rf)
3240 {
3241 	struct urtw_softc *sc = rf->rf_sc;
3242 	int i;
3243 	uint16_t data;
3244 	uint32_t data32;
3245 	usbd_status error;
3246 
3247 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3248 	if (error)
3249 		goto fail;
3250 
3251 	error = urtw_8225_usb_init(sc);
3252 	if (error)
3253 		goto fail;
3254 
3255 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3256 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3257 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3258 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3259 
3260 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3261 	if (error)
3262 		goto fail;
3263 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3264 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3265 	if (error)
3266 		goto fail;
3267 
3268 	error = urtw_8185_rf_pins_enable(sc);
3269 	if (error)
3270 		goto fail;
3271 
3272 	usbd_delay_ms(sc->sc_udev, 1000);
3273 
3274 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part1); i++) {
3275 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3276 		    urtw_8225v2_rf_part1[i].val);
3277 		usbd_delay_ms(sc->sc_udev, 1);
3278 	}
3279 	usbd_delay_ms(sc->sc_udev, 50);
3280 
3281 	urtw_8225_write(sc, 0x0, 0x1b7);
3282 
3283 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3284 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3285 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3286 	}
3287 
3288 	urtw_8225_write(sc, 0x3, 0x2);
3289 	urtw_8225_write(sc, 0x5, 0x4);
3290 	urtw_8225_write(sc, 0x0, 0xb7);
3291 	urtw_8225_write(sc, 0x2, 0xc4d);
3292 	usbd_delay_ms(sc->sc_udev, 100);
3293 	urtw_8225_write(sc, 0x2, 0x44d);
3294 	usbd_delay_ms(sc->sc_udev, 100);
3295 
3296 	error = urtw_8225_read(sc, 0x6, &data32);
3297 	if (error != 0)
3298 		goto fail;
3299 	if (data32 != 0xe6)
3300 		printf("%s: expect 0xe6!! (0x%x)\n", device_xname(sc->sc_dev),
3301 		    data32);
3302 	if (!(data32 & 0x80)) {
3303 		urtw_8225_write(sc, 0x02, 0x0c4d);
3304 		usbd_delay_ms(sc->sc_udev, 200);
3305 		urtw_8225_write(sc, 0x02, 0x044d);
3306 		usbd_delay_ms(sc->sc_udev, 100);
3307 		error = urtw_8225_read(sc, 0x6, &data32);
3308 		if (error != 0)
3309 			goto fail;
3310 		if (!(data32 & 0x80))
3311 			printf("%s: RF calibration failed\n",
3312 			    device_xname(sc->sc_dev));
3313 	}
3314 	usbd_delay_ms(sc->sc_udev, 100);
3315 
3316 	urtw_8225_write(sc, 0x0, 0x2bf);
3317 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
3318 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3319 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3320 	}
3321 
3322 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part2); i++) {
3323 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3324 		    urtw_8225v2_rf_part2[i].val);
3325 	}
3326 
3327 	error = urtw_8225v2_setgain(sc, 4);
3328 	if (error)
3329 		goto fail;
3330 
3331 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part3); i++) {
3332 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3333 		    urtw_8225v2_rf_part3[i].val);
3334 	}
3335 
3336 	urtw_write8_m(sc, 0x5b, 0x0d);
3337 
3338 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3339 	if (error)
3340 		goto fail;
3341 
3342 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3343 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3344 
3345 	/* TX ant A, 0x0 for B */
3346 	error = urtw_8185_tx_antenna(sc, 0x3);
3347 	if (error)
3348 		goto fail;
3349 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3350 
3351 	error = urtw_8225_rf_set_chan(rf, 1);
3352 fail:
3353 	return error;
3354 }
3355 
3356 usbd_status
3357 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3358 {
3359 	struct urtw_softc *sc = rf->rf_sc;
3360 	struct ieee80211com *ic = &sc->sc_ic;
3361 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3362 	usbd_status error;
3363 
3364 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3365 	if (error)
3366 		goto fail;
3367 
3368 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3369 	usbd_delay_ms(sc->sc_udev, 10);
3370 
3371 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3372 
3373 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3374 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3375 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3376 	else
3377 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3378 
3379 	if (IEEE80211_IS_CHAN_G(c)) {
3380 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3381 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3382 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3383 	} else {
3384 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3385 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3386 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3387 	}
3388 
3389 fail:
3390 	return error;
3391 }
3392 
3393 void
3394 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3395 {
3396 	struct urtw_rf *rf = &sc->sc_rf;
3397 	struct ieee80211com *ic = &sc->sc_ic;
3398 	usbd_status error = 0;
3399 	uint32_t data;
3400 	u_int chan;
3401 
3402 	chan = ieee80211_chan2ieee(ic, c);
3403 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3404 		return;
3405 	/*
3406 	 * During changing the channel we need to temporary disable
3407 	 * TX.
3408 	 */
3409 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3410 	data &= ~URTW_TX_LOOPBACK_MASK;
3411 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3412 	error = rf->set_chan(rf, chan);
3413 	if (error != 0) {
3414 		printf("%s could not change the channel\n",
3415 		    device_xname(sc->sc_dev));
3416 		return;
3417 	}
3418 	usbd_delay_ms(sc->sc_udev, 10);
3419 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3420 
3421 fail:	return;
3422 
3423 }
3424 
3425 void
3426 urtw_next_scan(void *arg)
3427 {
3428 	struct urtw_softc *sc = arg;
3429 	struct ieee80211com *ic = &sc->sc_ic;
3430 	int s;
3431 
3432 	if (sc->sc_dying)
3433 		return;
3434 
3435 	s = splnet();
3436 	if (ic->ic_state == IEEE80211_S_SCAN)
3437 		ieee80211_next_scan(ic);
3438 	splx(s);
3439 }
3440 
3441 void
3442 urtw_task(void *arg)
3443 {
3444 	struct urtw_softc *sc = arg;
3445 	struct ieee80211com *ic = &sc->sc_ic;
3446 	struct ieee80211_node *ni;
3447 	enum ieee80211_state ostate;
3448 	usbd_status error = 0;
3449 
3450 	if (sc->sc_dying)
3451 		return;
3452 
3453 	ostate = ic->ic_state;
3454 
3455 	switch (sc->sc_state) {
3456 	case IEEE80211_S_INIT:
3457 		if (ostate == IEEE80211_S_RUN) {
3458 			/* turn link LED off */
3459 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3460 		}
3461 		break;
3462 
3463 	case IEEE80211_S_SCAN:
3464 		urtw_set_chan(sc, ic->ic_curchan);
3465 		if (!sc->sc_dying)
3466 			callout_schedule(&sc->scan_to, mstohz(200));
3467 		break;
3468 
3469 	case IEEE80211_S_AUTH:
3470 	case IEEE80211_S_ASSOC:
3471 		urtw_set_chan(sc, ic->ic_curchan);
3472 		break;
3473 
3474 	case IEEE80211_S_RUN:
3475 		ni = ic->ic_bss;
3476 
3477 		urtw_set_chan(sc, ic->ic_curchan);
3478 
3479 		/* setting bssid. */
3480 		error = urtw_set_bssid(sc, ni->ni_bssid);
3481 		if (error != 0)
3482 			goto fail;
3483 		urtw_update_msr(sc);
3484 		/* XXX maybe the below would be incorrect. */
3485 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3486 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3487 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3488 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3489 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3490 		if (error != 0)
3491 			printf("%s: could not control LED (%d)\n",
3492 			    device_xname(sc->sc_dev), error);
3493 		break;
3494 	}
3495 
3496 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3497 
3498 fail:
3499 	if (error != 0) {
3500 		DPRINTF(("%s: error duing processing RUN state.",
3501 		    device_xname(sc->sc_dev)));
3502 	}
3503 }
3504 
3505 usbd_status
3506 urtw_8187b_update_wmm(struct urtw_softc *sc)
3507 {
3508 	struct ieee80211com *ic = &sc->sc_ic;
3509 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3510 	uint32_t data;
3511 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3512 	usbd_status error;
3513 
3514 	sifs = 0xa;
3515 	if (IEEE80211_IS_CHAN_G(c))
3516 		slot = 0x9;
3517 	else
3518 		slot = 0x14;
3519 
3520 	aifs = (2 * slot) + sifs;
3521 	ecwmin = 3;
3522 	ecwmax = 7;
3523 
3524 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3525 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3526 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3527 
3528 	urtw_write32_m(sc, URTW_AC_VO, data);
3529 	urtw_write32_m(sc, URTW_AC_VI, data);
3530 	urtw_write32_m(sc, URTW_AC_BE, data);
3531 	urtw_write32_m(sc, URTW_AC_BK, data);
3532 
3533 fail:
3534 	return error;
3535 }
3536 
3537 usbd_status
3538 urtw_8187b_reset(struct urtw_softc *sc)
3539 {
3540 	uint8_t data;
3541 	usbd_status error;
3542 
3543 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3544 	if (error)
3545 		goto fail;
3546 
3547 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3548 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3549 		URTW_CONFIG3_GNT_SELECT);
3550 
3551 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3552 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3553 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3554 
3555 	urtw_write8_m(sc, 0x61, 0x10);
3556 	urtw_read8_m(sc, 0x62, &data);
3557 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3558 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3559 
3560 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3561 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3562 
3563 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3564 	if (error)
3565 		goto fail;
3566 
3567 	urtw_read8_m(sc, URTW_CMD, &data);
3568 	data = (data & 2) | URTW_CMD_RST;
3569 	urtw_write8_m(sc, URTW_CMD, data);
3570 	usbd_delay_ms(sc->sc_udev, 100);
3571 
3572 	urtw_read8_m(sc, URTW_CMD, &data);
3573 	if (data & URTW_CMD_RST) {
3574 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
3575 		goto fail;
3576 	}
3577 
3578 fail:
3579 	return error;
3580 }
3581 
3582 int
3583 urtw_8187b_init(struct ifnet *ifp)
3584 {
3585 	struct urtw_softc *sc = ifp->if_softc;
3586 	struct urtw_rf *rf = &sc->sc_rf;
3587 	struct ieee80211com *ic = &sc->sc_ic;
3588 	uint8_t data;
3589 	usbd_status error;
3590 
3591 	urtw_stop(ifp, 0);
3592 
3593 	error = urtw_8187b_update_wmm(sc);
3594 	if (error != 0)
3595 		goto fail;
3596 	error = urtw_8187b_reset(sc);
3597 	if (error)
3598 		goto fail;
3599 
3600 	/* Applying MAC address again. */
3601 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3602 	if (error)
3603 		goto fail;
3604 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3605 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3606 	if (error)
3607 		goto fail;
3608 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3609 	if (error)
3610 		goto fail;
3611 
3612 	error = urtw_update_msr(sc);
3613 	if (error)
3614 		goto fail;
3615 
3616 	error = rf->init(rf);
3617 	if (error != 0)
3618 		goto fail;
3619 
3620 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3621 		URTW_CMD_RX_ENABLE);
3622 	error = urtw_intr_enable(sc);
3623 	if (error != 0)
3624 		goto fail;
3625 
3626 	error = urtw_write8e(sc, 0x41, 0xf4);
3627 	if (error != 0)
3628 		goto fail;
3629 	error = urtw_write8e(sc, 0x40, 0x00);
3630 	if (error != 0)
3631 		goto fail;
3632 	error = urtw_write8e(sc, 0x42, 0x00);
3633 	if (error != 0)
3634 		goto fail;
3635 	error = urtw_write8e(sc, 0x42, 0x01);
3636 	if (error != 0)
3637 		goto fail;
3638 	error = urtw_write8e(sc, 0x40, 0x0f);
3639 	if (error != 0)
3640 		goto fail;
3641 	error = urtw_write8e(sc, 0x42, 0x00);
3642 	if (error != 0)
3643 		goto fail;
3644 	error = urtw_write8e(sc, 0x42, 0x01);
3645 	if (error != 0)
3646 		goto fail;
3647 
3648 	urtw_read8_m(sc, 0xdb, &data);
3649 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3650 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3651 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3652 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3653 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3654 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3655 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3656 	urtw_write8_m(sc, 0x61, 0);
3657 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3658 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3659 	urtw_write8_m(sc, 0xda, 0x10);
3660 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3661 
3662 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3663 
3664 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3665 
3666 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3667 
3668 	/* Reset softc variables. */
3669 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
3670 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
3671 	}
3672 	sc->sc_txtimer = 0;
3673 
3674 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3675 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3676 		if (error != 0) {
3677 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
3678 			    ", err=%s\n", usbd_errstr(error));
3679 
3680 			goto fail;
3681 		}
3682 		/* Get the first interface handle. */
3683 		error = usbd_device2interface_handle(sc->sc_udev,
3684 		    URTW_IFACE_INDEX, &sc->sc_iface);
3685 		if (error != 0) {
3686 			printf("%s: could not get interface handle\n",
3687 			    device_xname(sc->sc_dev));
3688 			goto fail;
3689 		}
3690 		error = urtw_open_pipes(sc);
3691 		if (error != 0)
3692 			goto fail;
3693 		error = urtw_alloc_rx_data_list(sc);
3694 		if (error != 0)
3695 			goto fail;
3696 		error = urtw_alloc_tx_data_list(sc);
3697 		if (error != 0)
3698 			goto fail;
3699 		sc->sc_flags |= URTW_INIT_ONCE;
3700 	}
3701 
3702 	error = urtw_rx_enable(sc);
3703 	if (error != 0)
3704 		goto fail;
3705 	error = urtw_tx_enable(sc);
3706 	if (error != 0)
3707 		goto fail;
3708 
3709 	ifp->if_flags &= ~IFF_OACTIVE;
3710 	ifp->if_flags |= IFF_RUNNING;
3711 
3712 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3713 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3714 	else
3715 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3716 
3717 fail:
3718 	return error;
3719 }
3720 
3721 usbd_status
3722 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3723 {
3724 	int i;
3725 	usbd_status error;
3726 
3727 	for (i = 0; i < __arraycount(urtw_8187b_regtbl); i++) {
3728 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3729 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3730 	}
3731 
3732 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3733 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3734 
3735 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3736 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3737 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3738 
3739 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3740 
3741 fail:
3742 	return error;
3743 }
3744 
3745 usbd_status
3746 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3747 {
3748 	usbd_status error;
3749 
3750 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3751 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3752 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3753 	usbd_delay_ms(sc->sc_udev, 100);
3754 
3755 fail:
3756 	return error;
3757 }
3758 
3759 usbd_status
3760 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3761 {
3762 	struct ieee80211com *ic = &sc->sc_ic;
3763 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3764 	uint8_t aifs, difs, eifs, sifs, slot;
3765 	usbd_status error;
3766 
3767 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3768 
3769 	sifs = 0xa;
3770 	if (IEEE80211_IS_CHAN_G(c)) {
3771 		slot = 0x9;
3772 		difs = 0x1c;
3773 		eifs = 0x5b;
3774 	} else {
3775 		slot = 0x14;
3776 		difs = 0x32;
3777 		eifs = 0x5b;
3778 	}
3779 	aifs = (2 * slot) + sifs;
3780 
3781 	urtw_write8_m(sc, URTW_SLOT, slot);
3782 
3783 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3784 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3785 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3786 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3787 
3788 	urtw_write8_m(sc, URTW_DIFS, difs);
3789 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3790 
3791 fail:
3792 	return error;
3793 }
3794 
3795 usbd_status
3796 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3797 {
3798 	struct urtw_softc *sc = rf->rf_sc;
3799 	unsigned int i;
3800 	uint8_t data;
3801 	usbd_status error;
3802 
3803 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3804 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3805 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3806 	urtw_write8_m(sc, URTW_CW_CONF, data |
3807 		URTW_CW_CONF_PERPACKET_RETRY);
3808 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3809 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3810 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3811 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3812 
3813 	/* Auto rate fallback control. */
3814 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3815 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3816 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3817 		URTW_RATE_FALLBACK_ENABLE);
3818 
3819 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3820 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3821 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3822 
3823 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3824 	if (error)
3825 		goto fail;
3826 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3827 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3828 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3829 	if (error)
3830 		goto fail;
3831 
3832 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3833 	urtw_8225v2_b_config_mac(sc);
3834 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3835 
3836 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3837 	if (error)
3838 		goto fail;
3839 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3840 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3841 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3842 	if (error)
3843 		goto fail;
3844 
3845 	urtw_8225v2_b_init_rfe(sc);
3846 
3847 	for (i = 0; i < __arraycount(urtw_8225v2_b_rf); i++) {
3848 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3849 		    urtw_8225v2_b_rf[i].val);
3850 	}
3851 
3852 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3853 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3854 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3855 	}
3856 
3857 	urtw_8225_write(sc, 0x03, 0x080);
3858 	urtw_8225_write(sc, 0x05, 0x004);
3859 	urtw_8225_write(sc, 0x00, 0x0b7);
3860 	urtw_8225_write(sc, 0x02, 0xc4d);
3861 	urtw_8225_write(sc, 0x02, 0x44d);
3862 	urtw_8225_write(sc, 0x00, 0x2bf);
3863 
3864 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3865 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3866 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3867 
3868 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3869 	for (i = 0; i < __arraycount(urtw_8225v2_agc); i++) {
3870 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3871 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3872 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3873 	}
3874 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3875 
3876 	for (i = 0; i < __arraycount(urtw_8225v2_ofdm); i++)
3877 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3878 
3879 	urtw_8225v2_b_update_chan(sc);
3880 
3881 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3882 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3883 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3884 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3885 
3886 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3887 fail:
3888 	return error;
3889 }
3890 
3891 usbd_status
3892 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3893 {
3894 	struct urtw_softc *sc = rf->rf_sc;
3895 	usbd_status error;
3896 
3897 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3898 	if (error)
3899 		goto fail;
3900 
3901 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3902 	/*
3903 	 * Delay removed from 8185 to 8187.
3904 	 * usbd_delay_ms(sc->sc_udev, 10);
3905 	 */
3906 
3907 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3908 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3909 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3910 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3911 
3912 fail:
3913 	return error;
3914 }
3915 
3916 usbd_status
3917 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3918 {
3919 	int i;
3920 	uint8_t *cck_pwrtable;
3921 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3922 	    ofdm_pwrlvl_max;
3923 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3924 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3925 	usbd_status error;
3926 
3927 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3928 		cck_pwrlvl_min = 0;
3929 		cck_pwrlvl_max = 15;
3930 		ofdm_pwrlvl_min = 2;
3931 		ofdm_pwrlvl_max = 17;
3932 	} else {
3933 		cck_pwrlvl_min = 7;
3934 		cck_pwrlvl_max = 22;
3935 		ofdm_pwrlvl_min = 10;
3936 		ofdm_pwrlvl_max = 25;
3937 	}
3938 
3939 	/* CCK power setting */
3940 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
3941 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
3942 
3943 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3944 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3945 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
3946 
3947 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3948 	    urtw_8225v2_txpwr_cck;
3949 
3950 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3951 		if (cck_pwrlvl <= 6)
3952 			; /* do nothing */
3953 		else if (cck_pwrlvl <= 11)
3954 			cck_pwrtable += 8;
3955 		else
3956 			cck_pwrtable += 16;
3957 	} else {
3958 		if (cck_pwrlvl <= 5)
3959 			; /* do nothing */
3960 		else if (cck_pwrlvl <= 11)
3961 			cck_pwrtable += 8;
3962 		else if (cck_pwrlvl <= 17)
3963 			cck_pwrtable += 16;
3964 		else
3965 			cck_pwrtable += 24;
3966 	}
3967 
3968 	for (i = 0; i < 8; i++) {
3969 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3970 	}
3971 
3972 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3973 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3974 	/*
3975 	 * Delay removed from 8185 to 8187.
3976 	 * usbd_delay_ms(sc->sc_udev, 1);
3977 	 */
3978 
3979 	/* OFDM power setting */
3980 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3981 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3982 
3983 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3984 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3985 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
3986 
3987 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3988 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3989 
3990 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3991 		if (ofdm_pwrlvl <= 11) {
3992 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
3993 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
3994 		} else {
3995 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3996 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3997 		}
3998 	} else {
3999 		if (ofdm_pwrlvl <= 11) {
4000 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4001 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4002 		} else if (ofdm_pwrlvl <= 17) {
4003 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4004 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4005 		} else {
4006 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4007 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4008 		}
4009 	}
4010 
4011 	/*
4012 	 * Delay removed from 8185 to 8187.
4013 	 * usbd_delay_ms(sc->sc_udev, 1);
4014 	 */
4015 fail:
4016 	return error;
4017 }
4018 
4019 int
4020 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4021 {
4022 	int error;
4023 
4024 	urtw_write32_m(sc, URTW_BSSID,
4025 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4026 	urtw_write16_m(sc, URTW_BSSID + 4,
4027 	    bssid[4] | bssid[5] << 8);
4028 
4029 	return 0;
4030 
4031 fail:
4032 	return error;
4033 }
4034 
4035 int
4036 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4037 {
4038 	int error;
4039 
4040 	urtw_write32_m(sc, URTW_MAC0,
4041 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4042 	urtw_write16_m(sc, URTW_MAC4,
4043 	    addr[4] | addr[5] << 8);
4044 
4045 	return 0;
4046 
4047 fail:
4048 	return error;
4049 }
4050 
4051 MODULE(MODULE_CLASS_DRIVER, if_urtw, "bpf");
4052 
4053 #ifdef _MODULE
4054 #include "ioconf.c"
4055 #endif
4056 
4057 static int
4058 if_urtw_modcmd(modcmd_t cmd, void *aux)
4059 {
4060 	int error = 0;
4061 
4062 	switch (cmd) {
4063 	case MODULE_CMD_INIT:
4064 #ifdef _MODULE
4065 		error = config_init_component(cfdriver_ioconf_urtw,
4066 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4067 #endif
4068 		return error;
4069 	case MODULE_CMD_FINI:
4070 #ifdef _MODULE
4071 		error = config_fini_component(cfdriver_ioconf_urtw,
4072 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4073 #endif
4074 		return error;
4075 	default:
4076 		return ENOTTY;
4077 	}
4078 }
4079