xref: /netbsd-src/sys/dev/usb/if_urtw.c (revision f3cfa6f6ce31685c6c4a758bc430e69eb99f50a4)
1 /*	$NetBSD: if_urtw.c,v 1.18 2018/09/12 21:57:18 christos Exp $	*/
2 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
3 
4 /*-
5  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
6  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __KERNEL_RCSID(0, "$NetBSD: if_urtw.c,v 1.18 2018/09/12 21:57:18 christos Exp $");
23 
24 #ifdef _KERNEL_OPT
25 #include "opt_usb.h"
26 #endif
27 
28 #include <sys/param.h>
29 #include <sys/sockio.h>
30 #include <sys/proc.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/callout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 
41 #include <machine/endian.h>
42 #include <net/bpf.h>
43 #include <net/if.h>
44 #include <net/if_arp.h>
45 #include <net/if_dl.h>
46 #include <net/if_ether.h>
47 #include <net/if_media.h>
48 #include <net/if_types.h>
49 
50 #include <netinet/in.h>
51 #include <netinet/in_systm.h>
52 #include <netinet/in_var.h>
53 #include <netinet/if_inarp.h>
54 #include <netinet/ip.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 
59 #include <dev/usb/usb.h>
60 #include <dev/usb/usbdi.h>
61 #include <dev/usb/usbdi_util.h>
62 #include <dev/usb/usbdivar.h>
63 #include <dev/usb/usbdevs.h>
64 
65 #include "if_urtwreg.h"
66 
67 #ifdef URTW_DEBUG
68 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
69 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
70 int urtw_debug = 0;
71 #else
72 #define	DPRINTF(x)
73 #define	DPRINTFN(n, x)
74 #endif
75 
76 /*
77  * Recognized device vendors/products.
78  */
79 static const struct urtw_type {
80 	struct usb_devno	dev;
81 	uint8_t			rev;
82 } urtw_devs[] = {
83 #define	URTW_DEV_RTL8187(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
85 #define	URTW_DEV_RTL8187B(v, p)	\
86 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
87 	/* Realtek RTL8187 devices. */
88 	URTW_DEV_RTL8187(ASUSTEK,	P5B_WIFI),
89 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
90 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GC_2),
91 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
92 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
93 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
94 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
95 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
96 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
97 	/* Realtek RTL8187B devices. */
98 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
99 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
101 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
102 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
103 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
104 #undef	URTW_DEV_RTL8187
105 #undef	URTW_DEV_RTL8187B
106 };
107 #define	urtw_lookup(v, p)	\
108 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
109 
110 /*
111  * Helper read/write macros.
112  */
113 #define urtw_read8_m(sc, val, data)	do {			\
114 	error = urtw_read8_c(sc, val, data, 0);			\
115 	if (error != 0)						\
116 		goto fail;					\
117 } while (0)
118 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
119 	error = urtw_read8_c(sc, val, data, idx);		\
120 	if (error != 0)						\
121 		goto fail;					\
122 } while (0)
123 #define urtw_write8_m(sc, val, data)	do {			\
124 	error = urtw_write8_c(sc, val, data, 0);		\
125 	if (error != 0)						\
126 		goto fail;					\
127 } while (0)
128 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
129 	error = urtw_write8_c(sc, val, data, idx);		\
130 	if (error != 0)						\
131 		goto fail;					\
132 } while (0)
133 #define urtw_read16_m(sc, val, data)	do {			\
134 	error = urtw_read16_c(sc, val, data, 0);		\
135 	if (error != 0)						\
136 		goto fail;					\
137 } while (0)
138 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
139 	error = urtw_read16_c(sc, val, data, idx);		\
140 	if (error != 0)						\
141 		goto fail;					\
142 } while (0)
143 #define urtw_write16_m(sc, val, data)	do {			\
144 	error = urtw_write16_c(sc, val, data, 0);		\
145 	if (error != 0)						\
146 		goto fail;					\
147 } while (0)
148 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
149 	error = urtw_write16_c(sc, val, data, idx);		\
150 	if (error != 0)						\
151 		goto fail;					\
152 } while (0)
153 #define urtw_read32_m(sc, val, data)	do {			\
154 	error = urtw_read32_c(sc, val, data, 0);		\
155 	if (error != 0)						\
156 		goto fail;					\
157 } while (0)
158 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
159 	error = urtw_read32_c(sc, val, data, idx);		\
160 	if (error != 0)						\
161 		goto fail;					\
162 } while (0)
163 #define urtw_write32_m(sc, val, data)	do {			\
164 	error = urtw_write32_c(sc, val, data, 0);		\
165 	if (error != 0)						\
166 		goto fail;					\
167 } while (0)
168 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
169 	error = urtw_write32_c(sc, val, data, idx);		\
170 	if (error != 0)						\
171 		goto fail;					\
172 } while (0)
173 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
174 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
175 	if (error != 0)						\
176 		goto fail;					\
177 } while (0)
178 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
179 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
180 	if (error != 0)						\
181 		goto fail;					\
182 } while (0)
183 #define urtw_8225_write(sc, val, data)	do {			\
184 	error = urtw_8225_write_c(sc, val, data);		\
185 	if (error != 0)						\
186 		goto fail;					\
187 } while (0)
188 
189 struct urtw_pair {
190 	uint32_t	reg;
191 	uint32_t	val;
192 };
193 
194 struct urtw_pair_idx {
195 	uint8_t		reg;
196 	uint8_t		val;
197 	uint8_t		idx;
198 };
199 
200 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
201 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
202 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
203 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
204 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
205 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
206 	{ 0xff, 0x00, 0 },
207 
208 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
209 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
210 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
211 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
212 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
213 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
214 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
215 	{ 0xf8, 0x08, 1 },
216 
217 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
218 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
219 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
220 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
221 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
222 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
223 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
224 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
225 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
226 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
227 
228 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
229 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
230 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
231 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
232 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
233 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
234 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
235 
236 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
237 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
238 };
239 
240 static uint8_t urtw_8225_agc[] = {
241 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
242 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
243 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
244 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
245 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
246 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
247 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
248 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
249 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
250 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
251 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
252 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
253 };
254 
255 static uint32_t urtw_8225_channel[] = {
256 	0x0000,		/* dummy channel 0 */
257 	0x085c,		/* 1 */
258 	0x08dc,		/* 2 */
259 	0x095c,		/* 3 */
260 	0x09dc,		/* 4 */
261 	0x0a5c,		/* 5 */
262 	0x0adc,		/* 6 */
263 	0x0b5c,		/* 7 */
264 	0x0bdc,		/* 8 */
265 	0x0c5c,		/* 9 */
266 	0x0cdc,		/* 10 */
267 	0x0d5c,		/* 11 */
268 	0x0ddc,		/* 12 */
269 	0x0e5c,		/* 13 */
270 	0x0f72,		/* 14 */
271 };
272 
273 static uint8_t urtw_8225_gain[] = {
274 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
275 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
276 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
277 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
278 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
279 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
280 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
281 };
282 
283 static struct urtw_pair urtw_8225_rf_part1[] = {
284 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
285 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
286 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
287 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
288 };
289 
290 static struct urtw_pair urtw_8225_rf_part2[] = {
291 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
292 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
293 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
294 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
295 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
296 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
297 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
298 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
299 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
300 	{ 0x27, 0x88 }
301 };
302 
303 static struct urtw_pair urtw_8225_rf_part3[] = {
304 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
305 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
306 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
307 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
308 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
309 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
310 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
311 };
312 
313 static uint16_t urtw_8225_rxgain[] = {
314 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
315 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
316 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
317 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
318 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
319 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
320 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
321 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
322 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
323 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
324 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
325 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
326 };
327 
328 static uint8_t urtw_8225_threshold[] = {
329 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
330 };
331 
332 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
333 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
334 };
335 
336 static uint8_t urtw_8225_txpwr_cck[] = {
337 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
338 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
339 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
340 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
341 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
342 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
343 };
344 
345 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
346 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
347 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
348 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
349 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
350 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
351 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
352 };
353 
354 static uint8_t urtw_8225_txpwr_ofdm[] = {
355 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
356 };
357 
358 static uint8_t urtw_8225v2_agc[] = {
359 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
360 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
361 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
362 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
363 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
364 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
365 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
366 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
367 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
368 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
369 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
370 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
371 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
372 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
373 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
374 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
375 };
376 
377 static uint8_t urtw_8225v2_ofdm[] = {
378 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
379 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
380 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
381 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
382 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
383 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
384 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
385 	0x6d, 0x3c, 0xfb, 0x07
386 };
387 
388 static uint8_t urtw_8225v2_gain_bg[] = {
389 	0x23, 0x15, 0xa5,		/* -82-1dbm */
390 	0x23, 0x15, 0xb5,		/* -82-2dbm */
391 	0x23, 0x15, 0xc5,		/* -82-3dbm */
392 	0x33, 0x15, 0xc5,		/* -78dbm */
393 	0x43, 0x15, 0xc5,		/* -74dbm */
394 	0x53, 0x15, 0xc5,		/* -70dbm */
395 	0x63, 0x15, 0xc5,		/* -66dbm */
396 };
397 
398 static struct urtw_pair urtw_8225v2_rf_part1[] = {
399 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
400 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
401 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
402 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
403 };
404 
405 static struct urtw_pair urtw_8225v2_rf_part2[] = {
406 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
407 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
408 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
409 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
410 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
411 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
412 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
413 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
414 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
415 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
416 };
417 
418 static struct urtw_pair urtw_8225v2_rf_part3[] = {
419 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
420 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
421 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
422 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
423 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
424 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
425 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
426 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
427 };
428 
429 static uint16_t urtw_8225v2_rxgain[] = {
430 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
431 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
432 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
433 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
434 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
435 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
436 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
437 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
438 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
439 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
440 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
441 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
442 };
443 
444 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
445 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
446 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
447 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
448 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
449 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
450 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
451 };
452 
453 static uint8_t urtw_8225v2_txpwr_cck[] = {
454 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
455 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
456 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
457 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
458 };
459 
460 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
461 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
463 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
464 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
465 };
466 
467 static struct urtw_pair urtw_8225v2_b_rf[] = {
468 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
469 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
470 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
471 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
472 	{ 0x00, 0x01b7 }
473 };
474 
475 static struct urtw_pair urtw_ratetable[] = {
476 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
477 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
478 	{ 96, 10 }, { 108, 11 }
479 };
480 
481 int		urtw_init(struct ifnet *);
482 void		urtw_stop(struct ifnet *, int);
483 int		urtw_ioctl(struct ifnet *, u_long, void *);
484 void		urtw_start(struct ifnet *);
485 int		urtw_alloc_rx_data_list(struct urtw_softc *);
486 void		urtw_free_rx_data_list(struct urtw_softc *);
487 int		urtw_alloc_tx_data_list(struct urtw_softc *);
488 void		urtw_free_tx_data_list(struct urtw_softc *);
489 void		urtw_rxeof(struct usbd_xfer *, void *,
490 		    usbd_status);
491 int		urtw_tx_start(struct urtw_softc *,
492 		    struct ieee80211_node *, struct mbuf *, int);
493 void		urtw_txeof_low(struct usbd_xfer *, void *,
494 		    usbd_status);
495 void		urtw_txeof_normal(struct usbd_xfer *, void *,
496 		    usbd_status);
497 void		urtw_next_scan(void *);
498 void		urtw_task(void *);
499 void		urtw_ledusbtask(void *);
500 void		urtw_ledtask(void *);
501 int		urtw_media_change(struct ifnet *);
502 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
503 void		urtw_watchdog(struct ifnet *);
504 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
505 int		urtw_isbmode(uint16_t);
506 uint16_t	urtw_rate2rtl(int);
507 uint16_t	urtw_rtl2rate(int);
508 usbd_status	urtw_set_rate(struct urtw_softc *);
509 usbd_status	urtw_update_msr(struct urtw_softc *);
510 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
511 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
512 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
513 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
514 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
515 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
516 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
517 usbd_status	urtw_eprom_ck(struct urtw_softc *);
518 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
519 		    int);
520 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
521 		    uint32_t *);
522 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
523 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
524 usbd_status	urtw_get_macaddr(struct urtw_softc *);
525 usbd_status	urtw_get_txpwr(struct urtw_softc *);
526 usbd_status	urtw_get_rfchip(struct urtw_softc *);
527 usbd_status	urtw_led_init(struct urtw_softc *);
528 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
529 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
530 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
531 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
532 		    uint32_t);
533 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
534 		    uint32_t);
535 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
536 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
537 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
538 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
539 		    uint16_t);
540 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
541 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
542 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
543 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
544 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
545 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
546 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
547 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
548 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
549 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
550 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
551 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
552 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
553 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
554 usbd_status	urtw_open_pipes(struct urtw_softc *);
555 usbd_status	urtw_close_pipes(struct urtw_softc *);
556 usbd_status	urtw_intr_enable(struct urtw_softc *);
557 usbd_status	urtw_intr_disable(struct urtw_softc *);
558 usbd_status	urtw_reset(struct urtw_softc *);
559 usbd_status	urtw_led_on(struct urtw_softc *, int);
560 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
561 usbd_status	urtw_led_blink(struct urtw_softc *);
562 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
563 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
564 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
565 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
566 usbd_status	urtw_rx_setconf(struct urtw_softc *);
567 usbd_status	urtw_rx_enable(struct urtw_softc *);
568 usbd_status	urtw_tx_enable(struct urtw_softc *);
569 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
570 usbd_status	urtw_8187b_reset(struct urtw_softc *);
571 int		urtw_8187b_init(struct ifnet *);
572 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
573 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
574 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
575 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
576 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
577 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
578 int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
579 int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
580 
581 int urtw_match(device_t, cfdata_t, void *);
582 void urtw_attach(device_t, device_t, void *);
583 int urtw_detach(device_t, int);
584 int urtw_activate(device_t, enum devact);
585 
586 CFATTACH_DECL_NEW(urtw, sizeof(struct urtw_softc),
587 	urtw_match,
588 	urtw_attach,
589 	urtw_detach,
590 	urtw_activate
591 );
592 
593 int
594 urtw_match(device_t parent, cfdata_t match, void *aux)
595 {
596 	struct usb_attach_arg *uaa = aux;
597 
598 	return urtw_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
599 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
600 }
601 
602 void
603 urtw_attach(device_t parent, device_t self, void *aux)
604 {
605 	struct urtw_softc *sc = device_private(self);
606 	struct usb_attach_arg *uaa = aux;
607 	struct ieee80211com *ic = &sc->sc_ic;
608 	struct ifnet *ifp = &sc->sc_if;
609 	usbd_status error;
610 	uint8_t data8;
611 	uint32_t data;
612 	int i;
613 
614 	sc->sc_dev = self;
615 	sc->sc_udev = uaa->uaa_device;
616 	sc->sc_hwrev = urtw_lookup(uaa->uaa_vendor, uaa->uaa_product)->rev;
617 
618 	aprint_naive("\n");
619 	aprint_normal(": ");
620 
621 	if (sc->sc_hwrev & URTW_HWREV_8187) {
622 		urtw_read32_m(sc, URTW_TX_CONF, &data);
623 		data &= URTW_TX_HWREV_MASK;
624 		switch (data) {
625 		case URTW_TX_HWREV_8187_D:
626 			sc->sc_hwrev |= URTW_HWREV_8187_D;
627 			aprint_normal("RTL8187 rev D");
628 			break;
629 		case URTW_TX_HWREV_8187B_D:
630 			/*
631 			 * Detect Realtek RTL8187B devices that use
632 			 * USB IDs of RTL8187.
633 			 */
634 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
635 			aprint_normal("RTL8187B rev B (early)");
636 			break;
637 		default:
638 			sc->sc_hwrev |= URTW_HWREV_8187_B;
639 			aprint_normal("RTL8187 rev 0x%02x", data >> 25);
640 			break;
641 		}
642 	} else {
643 		/* RTL8187B hwrev register. */
644 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
645 		switch (data8) {
646 		case URTW_8187B_HWREV_8187B_B:
647 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
648 			aprint_normal("RTL8187B rev B");
649 			break;
650 		case URTW_8187B_HWREV_8187B_D:
651 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
652 			aprint_normal("RTL8187B rev D");
653 			break;
654 		case URTW_8187B_HWREV_8187B_E:
655 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
656 			aprint_normal("RTL8187B rev E");
657 			break;
658 		default:
659 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
660 			aprint_normal("RTL8187B rev 0x%02x", data8);
661 			break;
662 		}
663 	}
664 
665 	urtw_read32_m(sc, URTW_RX, &data);
666 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
667 	    URTW_EEPROM_93C46;
668 
669 	error = urtw_get_rfchip(sc);
670 	if (error != 0)
671 		goto fail;
672 	error = urtw_get_macaddr(sc);
673 	if (error != 0)
674 		goto fail;
675 	error = urtw_get_txpwr(sc);
676 	if (error != 0)
677 		goto fail;
678 	error = urtw_led_init(sc);		/* XXX incompleted */
679 	if (error != 0)
680 		goto fail;
681 
682 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
683 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
684 	sc->sc_currate = 3;
685 	/* XXX for what? */
686 	sc->sc_preamble_mode = 2;
687 
688 	usb_init_task(&sc->sc_task, urtw_task, sc, 0);
689 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc, 0);
690 	callout_init(&sc->scan_to, 0);
691 	callout_setfunc(&sc->scan_to, urtw_next_scan, sc);
692 	callout_init(&sc->sc_led_ch, 0);
693 	callout_setfunc(&sc->sc_led_ch, urtw_ledtask, sc);
694 
695 	ic->ic_ifp = ifp;
696 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
697 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
698 	ic->ic_state = IEEE80211_S_INIT;
699 
700 	/* set device capabilities */
701 	ic->ic_caps =
702 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
703 	    IEEE80211_C_TXPMGT |	/* tx power management */
704 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
705 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
706 	    IEEE80211_C_WEP |		/* s/w WEP */
707 	    IEEE80211_C_WPA;		/* WPA/RSN */
708 
709 	/* set supported .11b and .11g rates */
710 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
711 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
712 
713 	/* set supported .11b and .11g channels (1 through 14) */
714 	for (i = 1; i <= 14; i++) {
715 		ic->ic_channels[i].ic_freq =
716 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
717 		ic->ic_channels[i].ic_flags =
718 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
719 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
720 	}
721 
722 	ifp->if_softc = sc;
723 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
724 	if (sc->sc_hwrev & URTW_HWREV_8187) {
725 		ifp->if_init = urtw_init;
726 	} else {
727 		ifp->if_init = urtw_8187b_init;
728 	}
729 	ifp->if_ioctl = urtw_ioctl;
730 	ifp->if_start = urtw_start;
731 	ifp->if_watchdog = urtw_watchdog;
732 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
733 	IFQ_SET_READY(&ifp->if_snd);
734 	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
735 
736 	if_attach(ifp);
737 	ieee80211_ifattach(ic);
738 
739 	/* override state transition machine */
740 	sc->sc_newstate = ic->ic_newstate;
741 	ic->ic_newstate = urtw_newstate;
742 	ieee80211_media_init(ic, urtw_media_change, ieee80211_media_status);
743 
744 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
745 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
746 	    &sc->sc_drvbpf);
747 
748 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
749 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
750 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
751 
752 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
753 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
754 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
755 
756 	aprint_normal(", address %s\n", ether_sprintf(ic->ic_myaddr));
757 
758 	ieee80211_announce(ic);
759 
760 	return;
761 fail:
762 	aprint_error(": %s failed!\n", __func__);
763 	sc->sc_dying = true;
764 }
765 
766 int
767 urtw_detach(device_t self, int flags)
768 {
769 	struct urtw_softc *sc = device_private(self);
770 	struct ifnet *ifp = &sc->sc_if;
771 	int s;
772 
773 	s = splusb();
774 
775 	sc->sc_dying = true;
776 
777 	callout_halt(&sc->scan_to, NULL);
778 	callout_halt(&sc->sc_led_ch, NULL);
779 	callout_destroy(&sc->scan_to);
780 	callout_destroy(&sc->sc_led_ch);
781 
782 	usb_rem_task_wait(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER, NULL);
783 	usb_rem_task_wait(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER,
784 	    NULL);
785 
786 	if (ifp->if_softc != NULL) {
787 		bpf_detach(ifp);
788 		ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
789 		if_detach(ifp);
790 	}
791 
792 	/* abort and free xfers */
793 	urtw_free_tx_data_list(sc);
794 	urtw_free_rx_data_list(sc);
795 	urtw_close_pipes(sc);
796 
797 	splx(s);
798 
799 	return 0;
800 }
801 
802 int
803 urtw_activate(device_t self, enum devact act)
804 {
805 	struct urtw_softc *sc = device_private(self);
806 
807 	switch (act) {
808 	case DVACT_DEACTIVATE:
809 		sc->sc_dying = true;
810 		break;
811 	}
812 
813 	return 0;
814 }
815 
816 usbd_status
817 urtw_close_pipes(struct urtw_softc *sc)
818 {
819 	usbd_status error = 0;
820 
821 	if (sc->sc_rxpipe != NULL) {
822 		error = usbd_close_pipe(sc->sc_rxpipe);
823 		if (error != 0)
824 			goto fail;
825 		sc->sc_rxpipe = NULL;
826 	}
827 	if (sc->sc_txpipe_low != NULL) {
828 		error = usbd_close_pipe(sc->sc_txpipe_low);
829 		if (error != 0)
830 			goto fail;
831 		sc->sc_txpipe_low = NULL;
832 	}
833 	if (sc->sc_txpipe_normal != NULL) {
834 		error = usbd_close_pipe(sc->sc_txpipe_normal);
835 		if (error != 0)
836 			goto fail;
837 		sc->sc_txpipe_normal = NULL;
838 	}
839 fail:
840 	return error;
841 }
842 
843 usbd_status
844 urtw_open_pipes(struct urtw_softc *sc)
845 {
846 	usbd_status error;
847 
848 	/*
849 	 * NB: there is no way to distinguish each pipes so we need to hardcode
850 	 * pipe numbers
851 	 */
852 
853 	/* tx pipe - low priority packets */
854 	if (sc->sc_hwrev & URTW_HWREV_8187)
855 		error = usbd_open_pipe(sc->sc_iface, 0x2,
856 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
857 	else
858 		error = usbd_open_pipe(sc->sc_iface, 0x6,
859 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
860 	if (error != 0) {
861 		printf("%s: could not open Tx low pipe: %s\n",
862 		    device_xname(sc->sc_dev), usbd_errstr(error));
863 		goto fail;
864 	}
865 	/* tx pipe - normal priority packets */
866 	if (sc->sc_hwrev & URTW_HWREV_8187)
867 		error = usbd_open_pipe(sc->sc_iface, 0x3,
868 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
869 	else
870 		error = usbd_open_pipe(sc->sc_iface, 0x7,
871 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
872 	if (error != 0) {
873 		printf("%s: could not open Tx normal pipe: %s\n",
874 		    device_xname(sc->sc_dev), usbd_errstr(error));
875 		goto fail;
876 	}
877 	/* rx pipe */
878 	if (sc->sc_hwrev & URTW_HWREV_8187)
879 		error = usbd_open_pipe(sc->sc_iface, 0x81,
880 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
881 	else
882 		error = usbd_open_pipe(sc->sc_iface, 0x83,
883 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
884 	if (error != 0) {
885 		printf("%s: could not open Rx pipe: %s\n",
886 		    device_xname(sc->sc_dev), usbd_errstr(error));
887 		goto fail;
888 	}
889 
890 	return 0;
891 fail:
892 	(void)urtw_close_pipes(sc);
893 	return error;
894 }
895 
896 int
897 urtw_alloc_rx_data_list(struct urtw_softc *sc)
898 {
899 	int i, error;
900 
901 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
902 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
903 
904 		data->sc = sc;
905 
906 		error = usbd_create_xfer(sc->sc_rxpipe, MCLBYTES,
907 		    0, 0, &data->xfer);
908 		if (error) {
909 
910 			printf("%s: could not allocate rx xfer\n",
911 			    device_xname(sc->sc_dev));
912 			error = ENOMEM;
913 			goto fail;
914 		}
915 
916 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
917 		if (data->m == NULL) {
918 			printf("%s: could not allocate rx mbuf\n",
919 			    device_xname(sc->sc_dev));
920 			error = ENOMEM;
921 			goto fail;
922 		}
923 		MCLGET(data->m, M_DONTWAIT);
924 		if (!(data->m->m_flags & M_EXT)) {
925 			printf("%s: could not allocate rx mbuf cluster\n",
926 			    device_xname(sc->sc_dev));
927 			error = ENOMEM;
928 			goto fail;
929 		}
930 		data->buf = mtod(data->m, uint8_t *);
931 	}
932 
933 	return 0;
934 
935 fail:
936 	urtw_free_rx_data_list(sc);
937 	return error;
938 }
939 
940 void
941 urtw_free_rx_data_list(struct urtw_softc *sc)
942 {
943 	int i;
944 
945 	/* Make sure no transfers are pending. */
946 	if (sc->sc_rxpipe != NULL)
947 		usbd_abort_pipe(sc->sc_rxpipe);
948 
949 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
950 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
951 
952 		if (data->xfer != NULL) {
953 			usbd_destroy_xfer(data->xfer);
954 			data->xfer = NULL;
955 		}
956 		if (data->m != NULL) {
957 			m_freem(data->m);
958 			data->m = NULL;
959 		}
960 	}
961 }
962 
963 int
964 urtw_alloc_tx_data_list(struct urtw_softc *sc)
965 {
966 	int i, error;
967 
968 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
969 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
970 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
971 
972 			data->sc = sc;
973 			data->ni = NULL;
974 
975 			error = usbd_create_xfer((j == URTW_PRIORITY_LOW) ?
976 			    sc->sc_txpipe_low : sc->sc_txpipe_normal,
977 			    URTW_TX_MAXSIZE, USBD_FORCE_SHORT_XFER, 0,
978 			    &data->xfer);
979 			if (error) {
980 				printf("%s: could not allocate tx xfer\n",
981 				    device_xname(sc->sc_dev));
982 				goto fail;
983 			}
984 
985 			data->buf = usbd_get_buffer(data->xfer);
986 
987 			if (((unsigned long)data->buf) % 4)
988 				printf("%s: warn: unaligned buffer %p\n",
989 				    device_xname(sc->sc_dev), data->buf);
990 		}
991 	}
992 
993 	return 0;
994 
995 fail:
996 	urtw_free_tx_data_list(sc);
997 	return error;
998 }
999 
1000 void
1001 urtw_free_tx_data_list(struct urtw_softc *sc)
1002 {
1003 	int i;
1004 
1005 	/* Make sure no transfers are pending. */
1006 	if (sc->sc_txpipe_low != NULL)
1007 		usbd_abort_pipe(sc->sc_txpipe_low);
1008 	if (sc->sc_txpipe_normal != NULL)
1009 		usbd_abort_pipe(sc->sc_txpipe_normal);
1010 
1011 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
1012 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1013 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
1014 
1015 			if (data->xfer != NULL) {
1016 				usbd_destroy_xfer(data->xfer);
1017 				data->xfer = NULL;
1018 			}
1019 			if (data->ni != NULL) {
1020 				ieee80211_free_node(data->ni);
1021 				data->ni = NULL;
1022 			}
1023 		}
1024 	}
1025 }
1026 
1027 int
1028 urtw_media_change(struct ifnet *ifp)
1029 {
1030 	int error;
1031 
1032 	error = ieee80211_media_change(ifp);
1033 	if (error != ENETRESET)
1034 		return error;
1035 
1036 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1037 	    (IFF_UP | IFF_RUNNING))
1038 		ifp->if_init(ifp);
1039 
1040 	return 0;
1041 }
1042 
1043 int
1044 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1045 {
1046 	struct urtw_softc *sc = ic->ic_ifp->if_softc;
1047 
1048 	/*
1049 	 * XXXSMP: This does not wait for the task, if it is in flight,
1050 	 * to complete.  If this code works at all, it must rely on the
1051 	 * kernel lock to serialize with the USB task thread.
1052 	 */
1053 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1054 	callout_stop(&sc->scan_to);
1055 
1056 	/* do it in a process context */
1057 	sc->sc_state = nstate;
1058 	sc->sc_arg = arg;
1059 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
1060 
1061 	return 0;
1062 }
1063 
1064 usbd_status
1065 urtw_led_init(struct urtw_softc *sc)
1066 {
1067 	uint32_t rev;
1068 	usbd_status error;
1069 
1070 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1071 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1072 	if (error != 0)
1073 		goto fail;
1074 
1075 	switch (rev & URTW_EPROM_CID_MASK) {
1076 	case URTW_EPROM_CID_ALPHA0:
1077 		sc->sc_strategy = URTW_SW_LED_MODE1;
1078 		break;
1079 	case URTW_EPROM_CID_SERCOMM_PS:
1080 		sc->sc_strategy = URTW_SW_LED_MODE3;
1081 		break;
1082 	case URTW_EPROM_CID_HW_LED:
1083 		sc->sc_strategy = URTW_HW_LED;
1084 		break;
1085 	case URTW_EPROM_CID_RSVD0:
1086 	case URTW_EPROM_CID_RSVD1:
1087 	default:
1088 		sc->sc_strategy = URTW_SW_LED_MODE0;
1089 		break;
1090 	}
1091 
1092 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1093 
1094 fail:
1095 	return error;
1096 }
1097 
1098 usbd_status
1099 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1100     uint16_t data)
1101 {
1102 	usb_device_request_t req;
1103 
1104 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1105 	req.bRequest = URTW_8187_SETREGS_REQ;
1106 	USETW(req.wValue, addr);
1107 	USETW(req.wIndex, index);
1108 	USETW(req.wLength, sizeof(uint16_t));
1109 
1110 	return usbd_do_request(sc->sc_udev, &req, &data);
1111 }
1112 
1113 usbd_status
1114 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1115 {
1116 	int i;
1117 	int16_t bit;
1118 	uint8_t rlen = 12, wlen = 6;
1119 	uint16_t o1, o2, o3, tmp;
1120 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1121 	uint32_t mask = 0x80000000, value = 0;
1122 	usbd_status error;
1123 
1124 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1125 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1126 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1127 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1128 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1129 	o1 &= ~0xf;
1130 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1131 	DELAY(5);
1132 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1133 	DELAY(5);
1134 
1135 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1136 		bit = ((d2w & mask) != 0) ? 1 : 0;
1137 
1138 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1139 		DELAY(2);
1140 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1141 		    URTW_BB_HOST_BANG_CLK);
1142 		DELAY(2);
1143 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1144 		    URTW_BB_HOST_BANG_CLK);
1145 		DELAY(2);
1146 		mask = mask >> 1;
1147 		if (i == 2)
1148 			break;
1149 		bit = ((d2w & mask) != 0) ? 1 : 0;
1150 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1151 		    URTW_BB_HOST_BANG_CLK);
1152 		DELAY(2);
1153 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1154 		    URTW_BB_HOST_BANG_CLK);
1155 		DELAY(2);
1156 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1157 		DELAY(1);
1158 	}
1159 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1160 	    URTW_BB_HOST_BANG_CLK);
1161 	DELAY(2);
1162 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1163 	DELAY(2);
1164 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1165 	DELAY(2);
1166 
1167 	mask = 0x800;
1168 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1169 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1170 		    o1 | URTW_BB_HOST_BANG_RW);
1171 		DELAY(2);
1172 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1173 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1174 		DELAY(2);
1175 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1176 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1177 		DELAY(2);
1178 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1179 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1180 		DELAY(2);
1181 
1182 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1183 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1184 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1185 		    o1 | URTW_BB_HOST_BANG_RW);
1186 		DELAY(2);
1187 	}
1188 
1189 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1190 	    URTW_BB_HOST_BANG_RW);
1191 	DELAY(2);
1192 
1193 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1194 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1195 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1196 
1197 	if (data != NULL)
1198 		*data = value;
1199 fail:
1200 	return error;
1201 }
1202 
1203 usbd_status
1204 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1205 {
1206 	uint16_t d80, d82, d84;
1207 	usbd_status error;
1208 
1209 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1210 	d80 &= 0xfff3;
1211 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1212 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1213 	d84 &= 0xfff0;
1214 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1215 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1216 	DELAY(10);
1217 
1218 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1219 	DELAY(2);
1220 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1221 	DELAY(10);
1222 
1223 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1224 	if (error != 0)
1225 		goto fail;
1226 
1227 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1228 	DELAY(10);
1229 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1230 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1231 	usbd_delay_ms(sc->sc_udev, 2);
1232 fail:
1233 	return error;
1234 }
1235 
1236 usbd_status
1237 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1238 {
1239 	uint32_t data;
1240 	usbd_status error;
1241 
1242 	*ret = 1;
1243 
1244 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1245 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1246 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1247 	usbd_delay_ms(sc->sc_udev, 500);
1248 
1249 	urtw_8225_write(sc, 0x0, 0x1b7);
1250 
1251 	error = urtw_8225_read(sc, 0x8, &data);
1252 	if (error != 0)
1253 		goto fail;
1254 	if (data != 0x588)
1255 		*ret = 0;
1256 	else {
1257 		error = urtw_8225_read(sc, 0x9, &data);
1258 		if (error != 0)
1259 			goto fail;
1260 		if (data != 0x700)
1261 			*ret = 0;
1262 	}
1263 
1264 	urtw_8225_write(sc, 0x0, 0xb7);
1265 fail:
1266 	return error;
1267 }
1268 
1269 usbd_status
1270 urtw_get_rfchip(struct urtw_softc *sc)
1271 {
1272 	struct urtw_rf *rf = &sc->sc_rf;
1273 	int ret;
1274 	uint32_t data;
1275 	usbd_status error;
1276 
1277 	rf->rf_sc = sc;
1278 
1279 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1280 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1281 		if (error != 0)
1282 			panic("unsupported RF chip");
1283 			/* NOTREACHED */
1284 		switch (data & 0xff) {
1285 		case URTW_EPROM_RFCHIPID_RTL8225U:
1286 			error = urtw_8225_isv2(sc, &ret);
1287 			if (error != 0)
1288 				goto fail;
1289 			if (ret == 0) {
1290 				rf->init = urtw_8225_rf_init;
1291 				rf->set_chan = urtw_8225_rf_set_chan;
1292 				rf->set_sens = urtw_8225_rf_set_sens;
1293 				printf(", RFv1");
1294 			} else {
1295 				rf->init = urtw_8225v2_rf_init;
1296 				rf->set_chan = urtw_8225v2_rf_set_chan;
1297 				rf->set_sens = NULL;
1298 				printf(", RFv2");
1299 			}
1300 			break;
1301 		default:
1302 			goto fail;
1303 		}
1304 	} else {
1305 		rf->init = urtw_8225v2_b_rf_init;
1306 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1307 		rf->set_sens = NULL;
1308 	}
1309 
1310 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1311 	rf->sens = URTW_8225_RF_DEF_SENS;
1312 
1313 	return 0;
1314 
1315 fail:
1316 	panic("unsupported RF chip %d", data & 0xff);
1317 	/* NOTREACHED */
1318 }
1319 
1320 usbd_status
1321 urtw_get_txpwr(struct urtw_softc *sc)
1322 {
1323 	int i, j;
1324 	uint32_t data;
1325 	usbd_status error;
1326 
1327 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1328 	if (error != 0)
1329 		goto fail;
1330 	sc->sc_txpwr_cck_base = data & 0xf;
1331 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1332 
1333 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1334 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1335 		if (error != 0)
1336 			goto fail;
1337 		sc->sc_txpwr_cck[i] = data & 0xf;
1338 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1339 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1340 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1341 	}
1342 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1343 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1344 		if (error != 0)
1345 			goto fail;
1346 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1347 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1348 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1349 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1350 	}
1351 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1352 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1353 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1354 			    &data);
1355 			if (error != 0)
1356 				goto fail;
1357 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1358 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1359 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1360 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1361 			    (data & 0xf000) >> 12;
1362 		}
1363 	} else {
1364 		/* Channel 11. */
1365 		error = urtw_eprom_read32(sc, 0x1b, &data);
1366 		if (error != 0)
1367 			goto fail;
1368 		sc->sc_txpwr_cck[11] = data & 0xf;
1369 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1370 
1371 		/* Channel 12. */
1372 		error = urtw_eprom_read32(sc, 0xa, &data);
1373 		if (error != 0)
1374 			goto fail;
1375 		sc->sc_txpwr_cck[12] = data & 0xf;
1376 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1377 
1378 		/* Channel 13, 14. */
1379 		error = urtw_eprom_read32(sc, 0x1c, &data);
1380 		if (error != 0)
1381 			goto fail;
1382 		sc->sc_txpwr_cck[13] = data & 0xf;
1383 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1384 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1385 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1386 	}
1387 fail:
1388 	return error;
1389 }
1390 
1391 usbd_status
1392 urtw_get_macaddr(struct urtw_softc *sc)
1393 {
1394 	struct ieee80211com *ic = &sc->sc_ic;
1395 	usbd_status error;
1396 	uint32_t data;
1397 
1398 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1399 	if (error != 0)
1400 		goto fail;
1401 	ic->ic_myaddr[0] = data & 0xff;
1402 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1403 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1404 	if (error != 0)
1405 		goto fail;
1406 	ic->ic_myaddr[2] = data & 0xff;
1407 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1408 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1409 	if (error != 0)
1410 		goto fail;
1411 	ic->ic_myaddr[4] = data & 0xff;
1412 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1413 fail:
1414 	return error;
1415 }
1416 
1417 usbd_status
1418 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1419 {
1420 #define URTW_READCMD_LEN		3
1421 	int addrlen, i;
1422 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1423 	usbd_status error;
1424 
1425 	/* NB: make sure the buffer is initialized */
1426 	*data = 0;
1427 
1428 	/* enable EPROM programming */
1429 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1430 	DELAY(URTW_EPROM_DELAY);
1431 
1432 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1433 	if (error != 0)
1434 		goto fail;
1435 	error = urtw_eprom_ck(sc);
1436 	if (error != 0)
1437 		goto fail;
1438 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1439 	if (error != 0)
1440 		goto fail;
1441 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1442 		addrlen = 8;
1443 		addrstr[0] = addr & (1 << 7);
1444 		addrstr[1] = addr & (1 << 6);
1445 		addrstr[2] = addr & (1 << 5);
1446 		addrstr[3] = addr & (1 << 4);
1447 		addrstr[4] = addr & (1 << 3);
1448 		addrstr[5] = addr & (1 << 2);
1449 		addrstr[6] = addr & (1 << 1);
1450 		addrstr[7] = addr & (1 << 0);
1451 	} else {
1452 		addrlen=6;
1453 		addrstr[0] = addr & (1 << 5);
1454 		addrstr[1] = addr & (1 << 4);
1455 		addrstr[2] = addr & (1 << 3);
1456 		addrstr[3] = addr & (1 << 2);
1457 		addrstr[4] = addr & (1 << 1);
1458 		addrstr[5] = addr & (1 << 0);
1459 	}
1460 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1461 	if (error != 0)
1462 		goto fail;
1463 
1464 	error = urtw_eprom_writebit(sc, 0);
1465 	if (error != 0)
1466 		goto fail;
1467 
1468 	for (i = 0; i < 16; i++) {
1469 		error = urtw_eprom_ck(sc);
1470 		if (error != 0)
1471 			goto fail;
1472 		error = urtw_eprom_readbit(sc, &data16);
1473 		if (error != 0)
1474 			goto fail;
1475 
1476 		(*data) |= (data16 << (15 - i));
1477 	}
1478 
1479 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1480 	if (error != 0)
1481 		goto fail;
1482 	error = urtw_eprom_ck(sc);
1483 	if (error != 0)
1484 		goto fail;
1485 
1486 	/* now disable EPROM programming */
1487 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1488 fail:
1489 	return error;
1490 #undef URTW_READCMD_LEN
1491 }
1492 
1493 usbd_status
1494 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1495 {
1496 	uint8_t data8;
1497 	usbd_status error;
1498 
1499 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1500 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1501 	DELAY(URTW_EPROM_DELAY);
1502 
1503 fail:
1504 	return error;
1505 }
1506 
1507 usbd_status
1508 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1509 {
1510 	int i = 0;
1511 	usbd_status error = 0;
1512 
1513 	for (i = 0; i < buflen; i++) {
1514 		error = urtw_eprom_writebit(sc, buf[i]);
1515 		if (error != 0)
1516 			goto fail;
1517 		error = urtw_eprom_ck(sc);
1518 		if (error != 0)
1519 			goto fail;
1520 	}
1521 fail:
1522 	return error;
1523 }
1524 
1525 usbd_status
1526 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1527 {
1528 	uint8_t data;
1529 	usbd_status error;
1530 
1531 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1532 	if (bit != 0)
1533 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1534 	else
1535 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1536 	DELAY(URTW_EPROM_DELAY);
1537 fail:
1538 	return error;
1539 }
1540 
1541 usbd_status
1542 urtw_eprom_ck(struct urtw_softc *sc)
1543 {
1544 	uint8_t data;
1545 	usbd_status error;
1546 
1547 	/* masking */
1548 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1549 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1550 	DELAY(URTW_EPROM_DELAY);
1551 	/* unmasking */
1552 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1553 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1554 	DELAY(URTW_EPROM_DELAY);
1555 fail:
1556 	return error;
1557 }
1558 
1559 usbd_status
1560 urtw_eprom_cs(struct urtw_softc *sc, int able)
1561 {
1562 	uint8_t data;
1563 	usbd_status error;
1564 
1565 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1566 	if (able == URTW_EPROM_ENABLE)
1567 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1568 	else
1569 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1570 	DELAY(URTW_EPROM_DELAY);
1571 fail:
1572 	return error;
1573 }
1574 
1575 usbd_status
1576 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1577 {
1578 	usb_device_request_t req;
1579 	usbd_status error;
1580 
1581 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1582 	req.bRequest = URTW_8187_GETREGS_REQ;
1583 	USETW(req.wValue, val | 0xff00);
1584 	USETW(req.wIndex, idx & 0x03);
1585 	USETW(req.wLength, sizeof(uint8_t));
1586 
1587 	error = usbd_do_request(sc->sc_udev, &req, data);
1588 	return error;
1589 }
1590 
1591 usbd_status
1592 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1593 {
1594 	usb_device_request_t req;
1595 	usbd_status error;
1596 
1597 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1598 	req.bRequest = URTW_8187_GETREGS_REQ;
1599 	USETW(req.wValue, val | 0xfe00);
1600 	USETW(req.wIndex, 0);
1601 	USETW(req.wLength, sizeof(uint8_t));
1602 
1603 	error = usbd_do_request(sc->sc_udev, &req, data);
1604 	return error;
1605 }
1606 
1607 usbd_status
1608 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1609 {
1610 	usb_device_request_t req;
1611 	usbd_status error;
1612 
1613 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1614 	req.bRequest = URTW_8187_GETREGS_REQ;
1615 	USETW(req.wValue, val | 0xff00);
1616 	USETW(req.wIndex, idx & 0x03);
1617 	USETW(req.wLength, sizeof(uint16_t));
1618 
1619 	error = usbd_do_request(sc->sc_udev, &req, data);
1620 	return error;
1621 }
1622 
1623 usbd_status
1624 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1625 {
1626 	usb_device_request_t req;
1627 	usbd_status error;
1628 
1629 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1630 	req.bRequest = URTW_8187_GETREGS_REQ;
1631 	USETW(req.wValue, val | 0xff00);
1632 	USETW(req.wIndex, idx & 0x03);
1633 	USETW(req.wLength, sizeof(uint32_t));
1634 
1635 	error = usbd_do_request(sc->sc_udev, &req, data);
1636 	return error;
1637 }
1638 
1639 usbd_status
1640 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1641 {
1642 	usb_device_request_t req;
1643 
1644 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1645 	req.bRequest = URTW_8187_SETREGS_REQ;
1646 	USETW(req.wValue, val | 0xff00);
1647 	USETW(req.wIndex, idx & 0x03);
1648 	USETW(req.wLength, sizeof(uint8_t));
1649 
1650 	return usbd_do_request(sc->sc_udev, &req, &data);
1651 }
1652 
1653 usbd_status
1654 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1655 {
1656 	usb_device_request_t req;
1657 
1658 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1659 	req.bRequest = URTW_8187_SETREGS_REQ;
1660 	USETW(req.wValue, val | 0xfe00);
1661 	USETW(req.wIndex, 0);
1662 	USETW(req.wLength, sizeof(uint8_t));
1663 
1664 	return usbd_do_request(sc->sc_udev, &req, &data);
1665 }
1666 
1667 usbd_status
1668 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1669 {
1670 	usb_device_request_t req;
1671 
1672 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1673 	req.bRequest = URTW_8187_SETREGS_REQ;
1674 	USETW(req.wValue, val | 0xff00);
1675 	USETW(req.wIndex, idx & 0x03);
1676 	USETW(req.wLength, sizeof(uint16_t));
1677 
1678 	return usbd_do_request(sc->sc_udev, &req, &data);
1679 }
1680 
1681 usbd_status
1682 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1683 {
1684 	usb_device_request_t req;
1685 
1686 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1687 	req.bRequest = URTW_8187_SETREGS_REQ;
1688 	USETW(req.wValue, val | 0xff00);
1689 	USETW(req.wIndex, idx & 0x03);
1690 	USETW(req.wLength, sizeof(uint32_t));
1691 
1692 	return usbd_do_request(sc->sc_udev, &req, &data);
1693 }
1694 
1695 static usbd_status
1696 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1697 {
1698 	uint8_t data;
1699 	usbd_status error;
1700 
1701 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1702 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1703 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1704 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1705 fail:
1706 	return error;
1707 }
1708 
1709 usbd_status
1710 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1711 {
1712 	uint8_t data;
1713 	usbd_status error;
1714 
1715 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1716 	if (error)
1717 		goto fail;
1718 
1719 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1720 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1721 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1722 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1723 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1724 
1725 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1726 	if (error)
1727 		goto fail;
1728 fail:
1729 	return error;
1730 }
1731 
1732 usbd_status
1733 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1734 {
1735 	uint8_t data;
1736 	usbd_status error;
1737 
1738 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1739 	if (error)
1740 		goto fail;
1741 
1742 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1743 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1744 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1745 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1746 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1747 
1748 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1749 	if (error)
1750 		goto fail;
1751 fail:
1752 	return error;
1753 }
1754 
1755 usbd_status
1756 urtw_intr_disable(struct urtw_softc *sc)
1757 {
1758 	usbd_status error;
1759 
1760 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1761 
1762 fail:
1763 	return error;
1764 }
1765 
1766 usbd_status
1767 urtw_reset(struct urtw_softc *sc)
1768 {
1769 	uint8_t data;
1770 	usbd_status error;
1771 
1772 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1773 	if (error)
1774 		goto fail;
1775 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1776 	if (error)
1777 		goto fail;
1778 
1779 	error = urtw_intr_disable(sc);
1780 	if (error)
1781 		goto fail;
1782 	usbd_delay_ms(sc->sc_udev, 100);
1783 
1784 	error = urtw_write8e(sc, 0x18, 0x10);
1785 	if (error != 0)
1786 		goto fail;
1787 	error = urtw_write8e(sc, 0x18, 0x11);
1788 	if (error != 0)
1789 		goto fail;
1790 	error = urtw_write8e(sc, 0x18, 0x00);
1791 	if (error != 0)
1792 		goto fail;
1793 	usbd_delay_ms(sc->sc_udev, 100);
1794 
1795 	urtw_read8_m(sc, URTW_CMD, &data);
1796 	data = (data & 2) | URTW_CMD_RST;
1797 	urtw_write8_m(sc, URTW_CMD, data);
1798 	usbd_delay_ms(sc->sc_udev, 100);
1799 
1800 	urtw_read8_m(sc, URTW_CMD, &data);
1801 	if (data & URTW_CMD_RST) {
1802 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
1803 		goto fail;
1804 	}
1805 
1806 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1807 	if (error)
1808 		goto fail;
1809 	usbd_delay_ms(sc->sc_udev, 100);
1810 
1811 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1812 	if (error)
1813 		goto fail;
1814 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1815 	if (error)
1816 		goto fail;
1817 fail:
1818 	return error;
1819 }
1820 
1821 usbd_status
1822 urtw_led_on(struct urtw_softc *sc, int type)
1823 {
1824 	usbd_status error;
1825 
1826 	if (type == URTW_LED_GPIO) {
1827 		switch (sc->sc_gpio_ledpin) {
1828 		case URTW_LED_PIN_GPIO0:
1829 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1830 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1831 			break;
1832 		default:
1833 			panic("unsupported LED PIN type 0x%x",
1834 			    sc->sc_gpio_ledpin);
1835 			/* NOTREACHED */
1836 		}
1837 	} else {
1838 		panic("unsupported LED type 0x%x", type);
1839 		/* NOTREACHED */
1840 	}
1841 
1842 	sc->sc_gpio_ledon = 1;
1843 fail:
1844 	return error;
1845 }
1846 
1847 static usbd_status
1848 urtw_led_off(struct urtw_softc *sc, int type)
1849 {
1850 	usbd_status error;
1851 
1852 	if (type == URTW_LED_GPIO) {
1853 		switch (sc->sc_gpio_ledpin) {
1854 		case URTW_LED_PIN_GPIO0:
1855 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1856 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1857 			break;
1858 		default:
1859 			panic("unsupported LED PIN type 0x%x",
1860 			    sc->sc_gpio_ledpin);
1861 			/* NOTREACHED */
1862 		}
1863 	} else {
1864 		panic("unsupported LED type 0x%x", type);
1865 		/* NOTREACHED */
1866 	}
1867 
1868 	sc->sc_gpio_ledon = 0;
1869 
1870 fail:
1871 	return error;
1872 }
1873 
1874 usbd_status
1875 urtw_led_mode0(struct urtw_softc *sc, int mode)
1876 {
1877 	switch (mode) {
1878 	case URTW_LED_CTL_POWER_ON:
1879 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1880 		break;
1881 	case URTW_LED_CTL_TX:
1882 		if (sc->sc_gpio_ledinprogress == 1)
1883 			return 0;
1884 
1885 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1886 		sc->sc_gpio_blinktime = 2;
1887 		break;
1888 	case URTW_LED_CTL_LINK:
1889 		sc->sc_gpio_ledstate = URTW_LED_ON;
1890 		break;
1891 	default:
1892 		panic("unsupported LED mode 0x%x", mode);
1893 		/* NOTREACHED */
1894 	}
1895 
1896 	switch (sc->sc_gpio_ledstate) {
1897 	case URTW_LED_ON:
1898 		if (sc->sc_gpio_ledinprogress != 0)
1899 			break;
1900 		urtw_led_on(sc, URTW_LED_GPIO);
1901 		break;
1902 	case URTW_LED_BLINK_NORMAL:
1903 		if (sc->sc_gpio_ledinprogress != 0)
1904 			break;
1905 		sc->sc_gpio_ledinprogress = 1;
1906 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1907 			URTW_LED_OFF : URTW_LED_ON;
1908 		if (!sc->sc_dying)
1909 			callout_schedule(&sc->sc_led_ch, mstohz(100));
1910 		break;
1911 	case URTW_LED_POWER_ON_BLINK:
1912 		urtw_led_on(sc, URTW_LED_GPIO);
1913 		usbd_delay_ms(sc->sc_udev, 100);
1914 		urtw_led_off(sc, URTW_LED_GPIO);
1915 		break;
1916 	default:
1917 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1918 		/* NOTREACHED */
1919 	}
1920 	return 0;
1921 }
1922 
1923 usbd_status
1924 urtw_led_mode1(struct urtw_softc *sc, int mode)
1925 {
1926 	return USBD_INVAL;
1927 }
1928 
1929 usbd_status
1930 urtw_led_mode2(struct urtw_softc *sc, int mode)
1931 {
1932 	return USBD_INVAL;
1933 }
1934 
1935 usbd_status
1936 urtw_led_mode3(struct urtw_softc *sc, int mode)
1937 {
1938 	return USBD_INVAL;
1939 }
1940 
1941 void
1942 urtw_ledusbtask(void *arg)
1943 {
1944 	struct urtw_softc *sc = arg;
1945 
1946 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1947 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1948 
1949 	urtw_led_blink(sc);
1950 }
1951 
1952 void
1953 urtw_ledtask(void *arg)
1954 {
1955 	struct urtw_softc *sc = arg;
1956 
1957 	/*
1958 	 * NB: to change a status of the led we need at least a sleep so we
1959 	 * can't do it here
1960 	 */
1961 	usb_add_task(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER);
1962 }
1963 
1964 usbd_status
1965 urtw_led_ctl(struct urtw_softc *sc, int mode)
1966 {
1967 	usbd_status error = 0;
1968 
1969 	switch (sc->sc_strategy) {
1970 	case URTW_SW_LED_MODE0:
1971 		error = urtw_led_mode0(sc, mode);
1972 		break;
1973 	case URTW_SW_LED_MODE1:
1974 		error = urtw_led_mode1(sc, mode);
1975 		break;
1976 	case URTW_SW_LED_MODE2:
1977 		error = urtw_led_mode2(sc, mode);
1978 		break;
1979 	case URTW_SW_LED_MODE3:
1980 		error = urtw_led_mode3(sc, mode);
1981 		break;
1982 	default:
1983 		panic("unsupported LED mode %d", sc->sc_strategy);
1984 		/* NOTREACHED */
1985 	}
1986 
1987 	return error;
1988 }
1989 
1990 usbd_status
1991 urtw_led_blink(struct urtw_softc *sc)
1992 {
1993 	uint8_t ing = 0;
1994 
1995 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1996 		(void)urtw_led_on(sc, URTW_LED_GPIO);
1997 	else
1998 		(void)urtw_led_off(sc, URTW_LED_GPIO);
1999 	sc->sc_gpio_blinktime--;
2000 	if (sc->sc_gpio_blinktime == 0)
2001 		ing = 1;
2002 	else {
2003 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
2004 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
2005 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
2006 			ing = 1;
2007 	}
2008 	if (ing == 1) {
2009 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2010 		    sc->sc_gpio_ledon == 0)
2011 			(void)urtw_led_on(sc, URTW_LED_GPIO);
2012 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2013 		    sc->sc_gpio_ledon == 1)
2014 			(void)urtw_led_off(sc, URTW_LED_GPIO);
2015 
2016 		sc->sc_gpio_blinktime = 0;
2017 		sc->sc_gpio_ledinprogress = 0;
2018 		return 0;
2019 	}
2020 
2021 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2022 	    URTW_LED_ON : URTW_LED_OFF;
2023 
2024 	switch (sc->sc_gpio_ledstate) {
2025 	case URTW_LED_BLINK_NORMAL:
2026 		if (!sc->sc_dying)
2027 			callout_schedule(&sc->sc_led_ch, mstohz(100));
2028 		break;
2029 	default:
2030 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2031 		/* NOTREACHED */
2032 	}
2033 	return 0;
2034 }
2035 
2036 usbd_status
2037 urtw_update_msr(struct urtw_softc *sc)
2038 {
2039 	struct ieee80211com *ic = &sc->sc_ic;
2040 	uint8_t data;
2041 	usbd_status error;
2042 
2043 	urtw_read8_m(sc, URTW_MSR, &data);
2044 	data &= ~URTW_MSR_LINK_MASK;
2045 
2046 	/* Should always be set. */
2047 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2048 		data |= URTW_MSR_LINK_ENEDCA;
2049 
2050 	if (sc->sc_state == IEEE80211_S_RUN) {
2051 		switch (ic->ic_opmode) {
2052 		case IEEE80211_M_STA:
2053 		case IEEE80211_M_MONITOR:
2054 			data |= URTW_MSR_LINK_STA;
2055 			break;
2056 		default:
2057 			panic("unsupported operation mode 0x%x",
2058 			    ic->ic_opmode);
2059 			/* NOTREACHED */
2060 		}
2061 	} else
2062 		data |= URTW_MSR_LINK_NONE;
2063 
2064 	urtw_write8_m(sc, URTW_MSR, data);
2065 fail:
2066 	return error;
2067 }
2068 
2069 uint16_t
2070 urtw_rate2rtl(int rate)
2071 {
2072 	unsigned int i;
2073 
2074 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2075 		if (rate == urtw_ratetable[i].reg)
2076 			return urtw_ratetable[i].val;
2077 	}
2078 
2079 	return 3;
2080 }
2081 
2082 uint16_t
2083 urtw_rtl2rate(int rate)
2084 {
2085 	unsigned int i;
2086 
2087 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2088 		if (rate == urtw_ratetable[i].val)
2089 			return urtw_ratetable[i].reg;
2090 	}
2091 
2092 	return 0;
2093 }
2094 
2095 usbd_status
2096 urtw_set_rate(struct urtw_softc *sc)
2097 {
2098 	int i, basic_rate, min_rr_rate, max_rr_rate;
2099 	uint16_t data;
2100 	usbd_status error;
2101 
2102 	basic_rate = urtw_rate2rtl(48);
2103 	min_rr_rate = urtw_rate2rtl(12);
2104 	max_rr_rate = urtw_rate2rtl(48);
2105 
2106 	urtw_write8_m(sc, URTW_RESP_RATE,
2107 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2108 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2109 
2110 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2111 	data &= ~URTW_BRSR_MBR_8185;
2112 
2113 	for (i = 0; i <= basic_rate; i++)
2114 		data |= (1 << i);
2115 
2116 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2117 fail:
2118 	return error;
2119 }
2120 
2121 usbd_status
2122 urtw_intr_enable(struct urtw_softc *sc)
2123 {
2124 	usbd_status error;
2125 
2126 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2127 fail:
2128 	return error;
2129 }
2130 
2131 usbd_status
2132 urtw_rx_setconf(struct urtw_softc *sc)
2133 {
2134 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2135 	struct ieee80211com *ic = &sc->sc_ic;
2136 	uint32_t data;
2137 	usbd_status error;
2138 
2139 	urtw_read32_m(sc, URTW_RX, &data);
2140 	data = data &~ URTW_RX_FILTER_MASK;
2141 #if 0
2142 	data = data | URTW_RX_FILTER_CTL;
2143 #endif
2144 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2145 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2146 
2147 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2148 		data = data | URTW_RX_FILTER_ICVERR;
2149 		data = data | URTW_RX_FILTER_PWR;
2150 	}
2151 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2152 		data = data | URTW_RX_FILTER_CRCERR;
2153 
2154 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2155 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2156 		data = data | URTW_RX_FILTER_ALLMAC;
2157 	} else {
2158 		data = data | URTW_RX_FILTER_NICMAC;
2159 		data = data | URTW_RX_CHECK_BSSID;
2160 	}
2161 
2162 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2163 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2164 	data = data &~ URTW_MAX_RX_DMA_MASK;
2165 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2166 
2167 	urtw_write32_m(sc, URTW_RX, data);
2168 fail:
2169 	return error;
2170 }
2171 
2172 usbd_status
2173 urtw_rx_enable(struct urtw_softc *sc)
2174 {
2175 	int i;
2176 	struct urtw_rx_data *rx_data;
2177 	uint8_t data;
2178 	usbd_status error;
2179 
2180 	/*
2181 	 * Start up the receive pipe.
2182 	 */
2183 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2184 		rx_data = &sc->sc_rx_data[i];
2185 
2186 		usbd_setup_xfer(rx_data->xfer, rx_data, rx_data->buf, MCLBYTES,
2187 		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2188 		error = usbd_transfer(rx_data->xfer);
2189 		if (error != USBD_IN_PROGRESS && error != 0) {
2190 			printf("%s: could not queue Rx transfer\n",
2191 			    device_xname(sc->sc_dev));
2192 			goto fail;
2193 		}
2194 	}
2195 
2196 	error = urtw_rx_setconf(sc);
2197 	if (error != 0)
2198 		goto fail;
2199 
2200 	urtw_read8_m(sc, URTW_CMD, &data);
2201 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2202 fail:
2203 	return error;
2204 }
2205 
2206 usbd_status
2207 urtw_tx_enable(struct urtw_softc *sc)
2208 {
2209 	uint8_t data8;
2210 	uint32_t data;
2211 	usbd_status error;
2212 
2213 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2214 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2215 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2216 		    URTW_CW_CONF_PERPACKET_RETRY);
2217 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2218 
2219 		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2220 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2221 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2222 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2223 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2224 
2225 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2226 		data &= ~URTW_TX_LOOPBACK_MASK;
2227 		data |= URTW_TX_LOOPBACK_NONE;
2228 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2229 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2230 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2231 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2232 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2233 		data &= ~URTW_TX_SWPLCPLEN;
2234 		data |= URTW_TX_NOICV;
2235 		urtw_write32_m(sc, URTW_TX_CONF, data);
2236 	} else {
2237 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2238 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2239 		    URTW_TX_LONGRETRY;
2240 		urtw_write32_m(sc, URTW_TX_CONF, data);
2241 	}
2242 
2243 	urtw_read8_m(sc, URTW_CMD, &data8);
2244 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2245 fail:
2246 	return error;
2247 }
2248 
2249 int
2250 urtw_init(struct ifnet *ifp)
2251 {
2252 	struct urtw_softc *sc = ifp->if_softc;
2253 	struct urtw_rf *rf = &sc->sc_rf;
2254 	struct ieee80211com *ic = &sc->sc_ic;
2255 	usbd_status error;
2256 
2257 	urtw_stop(ifp, 0);
2258 
2259 	error = urtw_reset(sc);
2260 	if (error)
2261 		goto fail;
2262 
2263 	urtw_write8_m(sc, 0x85, 0);
2264 	urtw_write8_m(sc, URTW_GPIO, 0);
2265 
2266 	/* for led */
2267 	urtw_write8_m(sc, 0x85, 4);
2268 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2269 	if (error != 0)
2270 		goto fail;
2271 
2272 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2273 	if (error)
2274 		goto fail;
2275 
2276 	/* applying MAC address again. */
2277 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2278 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2279 	if (error)
2280 		goto fail;
2281 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2282 	if (error)
2283 		goto fail;
2284 
2285 	error = urtw_update_msr(sc);
2286 	if (error)
2287 		goto fail;
2288 
2289 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2290 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2291 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2292 	error = urtw_set_rate(sc);
2293 	if (error != 0)
2294 		goto fail;
2295 
2296 	error = rf->init(rf);
2297 	if (error != 0)
2298 		goto fail;
2299 	if (rf->set_sens != NULL)
2300 		rf->set_sens(rf);
2301 
2302 	urtw_write16_m(sc, 0x5e, 1);
2303 	urtw_write16_m(sc, 0xfe, 0x10);
2304 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2305 	urtw_write8_m(sc, 0xff, 0x60);
2306 	urtw_write16_m(sc, 0x5e, 0);
2307 	urtw_write8_m(sc, 0x85, 4);
2308 
2309 	error = urtw_intr_enable(sc);
2310 	if (error != 0)
2311 		goto fail;
2312 
2313 	/* reset softc variables */
2314 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
2315 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
2316 	}
2317 	sc->sc_txtimer = 0;
2318 
2319 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2320 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2321 		if (error != 0) {
2322 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
2323 			    ", err=%s\n", usbd_errstr(error));
2324 			goto fail;
2325 		}
2326 		/* get the first interface handle */
2327 		error = usbd_device2interface_handle(sc->sc_udev,
2328 		    URTW_IFACE_INDEX, &sc->sc_iface);
2329 		if (error != 0) {
2330 			printf("%s: could not get interface handle\n",
2331 			    device_xname(sc->sc_dev));
2332 			goto fail;
2333 		}
2334 		error = urtw_open_pipes(sc);
2335 		if (error != 0)
2336 			goto fail;
2337 		error = urtw_alloc_rx_data_list(sc);
2338 		if (error != 0)
2339 			goto fail;
2340 		error = urtw_alloc_tx_data_list(sc);
2341 		if (error != 0)
2342 			goto fail;
2343 		sc->sc_flags |= URTW_INIT_ONCE;
2344 	}
2345 
2346 	error = urtw_rx_enable(sc);
2347 	if (error != 0)
2348 		goto fail;
2349 	error = urtw_tx_enable(sc);
2350 	if (error != 0)
2351 		goto fail;
2352 
2353 	ifp->if_flags &= ~IFF_OACTIVE;
2354 	ifp->if_flags |= IFF_RUNNING;
2355 
2356 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2357 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2358 	else
2359 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2360 
2361 	return 0;
2362 fail:
2363 	return error;
2364 }
2365 
2366 int
2367 urtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2368 {
2369 #define IS_RUNNING(ifp) \
2370 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
2371 
2372 	struct urtw_softc *sc = ifp->if_softc;
2373 	struct ieee80211com *ic = &sc->sc_ic;
2374 	int s, error = 0;
2375 
2376 	if (sc->sc_dying)
2377 		return ENXIO;
2378 
2379 	s = splnet();
2380 
2381 	switch (cmd) {
2382 	case SIOCSIFFLAGS:
2383 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2384 			break;
2385 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2386 		case IFF_UP|IFF_RUNNING:
2387 			break;
2388 		case IFF_UP:
2389 			ifp->if_init(ifp);
2390 			break;
2391 		case IFF_RUNNING:
2392 			urtw_stop(ifp, 1);
2393 			break;
2394 		case 0:
2395 			break;
2396 		}
2397 		break;
2398 
2399 	case SIOCADDMULTI:
2400 	case SIOCDELMULTI:
2401 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
2402 			error = 0;
2403 		break;
2404 
2405 	default:
2406 		error = ieee80211_ioctl(ic, cmd, data);
2407 		break;
2408 	}
2409 
2410 	if (error == ENETRESET) {
2411 		if (IS_RUNNING(ifp) &&
2412 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2413 			ifp->if_init(ifp);
2414 		error = 0;
2415 	}
2416 
2417 	splx(s);
2418 
2419 	return error;
2420 #undef IS_RUNNING
2421 }
2422 
2423 void
2424 urtw_start(struct ifnet *ifp)
2425 {
2426 	struct urtw_softc *sc = ifp->if_softc;
2427 	struct ieee80211com *ic = &sc->sc_ic;
2428 	struct ieee80211_node *ni;
2429 	struct ether_header *eh;
2430 	struct mbuf *m0;
2431 
2432 	/*
2433 	 * net80211 may still try to send management frames even if the
2434 	 * IFF_RUNNING flag is not set...
2435 	 */
2436 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2437 		return;
2438 
2439 	for (;;) {
2440 		IF_POLL(&ic->ic_mgtq, m0);
2441 		if (m0 != NULL) {
2442 
2443 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2444 			    URTW_TX_DATA_LIST_COUNT) {
2445 				ifp->if_flags |= IFF_OACTIVE;
2446 				break;
2447 			}
2448 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2449 			ni = M_GETCTX(m0, struct ieee80211_node *);
2450 			M_CLEARCTX(m0);
2451 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2452 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2453 			    != 0)
2454 				break;
2455 		} else {
2456 			if (ic->ic_state != IEEE80211_S_RUN)
2457 				break;
2458 			IFQ_POLL(&ifp->if_snd, m0);
2459 			if (m0 == NULL)
2460 				break;
2461 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2462 			    URTW_TX_DATA_LIST_COUNT) {
2463 				ifp->if_flags |= IFF_OACTIVE;
2464 				break;
2465 			}
2466 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2467 			if (m0->m_len < sizeof(struct ether_header) &&
2468 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
2469 				continue;
2470 
2471 			eh = mtod(m0, struct ether_header *);
2472 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2473 			if (ni == NULL) {
2474 				m_freem(m0);
2475 				continue;
2476 			}
2477 			bpf_mtap(ifp, m0, BPF_D_OUT);
2478 			m0 = ieee80211_encap(ic, m0, ni);
2479 			if (m0 == NULL) {
2480 				ieee80211_free_node(ni);
2481 				continue;
2482 			}
2483 			bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
2484 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2485 			    != 0) {
2486 				ieee80211_free_node(ni);
2487 				ifp->if_oerrors++;
2488 				break;
2489 			}
2490 		}
2491 		sc->sc_txtimer = 5;
2492 		ifp->if_timer = 1;
2493 	}
2494 }
2495 
2496 void
2497 urtw_watchdog(struct ifnet *ifp)
2498 {
2499 	struct urtw_softc *sc = ifp->if_softc;
2500 
2501 	ifp->if_timer = 0;
2502 
2503 	if (sc->sc_txtimer > 0) {
2504 		if (--sc->sc_txtimer == 0) {
2505 			printf("%s: device timeout\n", device_xname(sc->sc_dev));
2506 			ifp->if_oerrors++;
2507 			return;
2508 		}
2509 		ifp->if_timer = 1;
2510 	}
2511 
2512 	ieee80211_watchdog(&sc->sc_ic);
2513 }
2514 
2515 void
2516 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2517     usbd_status status)
2518 {
2519 	struct urtw_tx_data *data = priv;
2520 	struct urtw_softc *sc = data->sc;
2521 	struct ieee80211com *ic = &sc->sc_ic;
2522 	struct ifnet *ifp = ic->ic_ifp;
2523 	int s;
2524 
2525 	if (status != USBD_NORMAL_COMPLETION) {
2526 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2527 			return;
2528 
2529 		printf("%s: could not transmit buffer: %s\n",
2530 		    device_xname(sc->sc_dev), usbd_errstr(status));
2531 
2532 		if (status == USBD_STALLED)
2533 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2534 
2535 		ifp->if_oerrors++;
2536 		return;
2537 	}
2538 
2539 	s = splnet();
2540 
2541 	ieee80211_free_node(data->ni);
2542 	data->ni = NULL;
2543 
2544 	sc->sc_txtimer = 0;
2545 	ifp->if_opackets++;
2546 
2547 	sc->sc_tx_queued[URTW_PRIORITY_LOW]--;
2548 	ifp->if_flags &= ~IFF_OACTIVE;
2549 	urtw_start(ifp);
2550 
2551 	splx(s);
2552 }
2553 
2554 void
2555 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2556     usbd_status status)
2557 {
2558 	struct urtw_tx_data *data = priv;
2559 	struct urtw_softc *sc = data->sc;
2560 	struct ieee80211com *ic = &sc->sc_ic;
2561 	struct ifnet *ifp = ic->ic_ifp;
2562 	int s;
2563 
2564 	if (status != USBD_NORMAL_COMPLETION) {
2565 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2566 			return;
2567 
2568 		printf("%s: could not transmit buffer: %s\n",
2569 		    device_xname(sc->sc_dev), usbd_errstr(status));
2570 
2571 		if (status == USBD_STALLED)
2572 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2573 
2574 		ifp->if_oerrors++;
2575 		return;
2576 	}
2577 
2578 	s = splnet();
2579 
2580 	ieee80211_free_node(data->ni);
2581 	data->ni = NULL;
2582 
2583 	sc->sc_txtimer = 0;
2584 	ifp->if_opackets++;
2585 
2586 	sc->sc_tx_queued[URTW_PRIORITY_NORMAL]--;
2587 	ifp->if_flags &= ~IFF_OACTIVE;
2588 	urtw_start(ifp);
2589 
2590 	splx(s);
2591 }
2592 
2593 int
2594 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2595     int prior)
2596 {
2597 	struct ieee80211com *ic = &sc->sc_ic;
2598 	struct urtw_tx_data *data;
2599 	struct ieee80211_frame *wh;
2600 	struct ieee80211_key *k;
2601 	usbd_status error;
2602 	int xferlen;
2603 
2604 	wh = mtod(m0, struct ieee80211_frame *);
2605 
2606 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2607 		k = ieee80211_crypto_encap(ic, ni, m0);
2608 		if (k == NULL) {
2609 			m_freem(m0);
2610 			return ENOBUFS;
2611 		}
2612 		/* packet header may have moved, reset our local pointer */
2613 		wh = mtod(m0, struct ieee80211_frame *);
2614 	}
2615 
2616 	if (sc->sc_drvbpf != NULL) {
2617 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2618 
2619 		tap->wt_flags = 0;
2620 		tap->wt_rate = 0;
2621 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2622 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2623 
2624 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
2625 	}
2626 
2627 	if (sc->sc_hwrev & URTW_HWREV_8187)
2628 		xferlen = m0->m_pkthdr.len + 4 * 3;
2629 	else
2630 		xferlen = m0->m_pkthdr.len + 4 * 8;
2631 
2632 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2633 		xferlen += 1;
2634 
2635 	data = &sc->sc_tx_data[prior][sc->sc_txidx[prior]];
2636 	sc->sc_txidx[prior] =
2637 	    (sc->sc_txidx[prior] + 1) % URTW_TX_DATA_LIST_COUNT;
2638 
2639 	memset(data->buf, 0, URTW_TX_MAXSIZE);
2640 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2641 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2642 	data->buf[1] |= (1 << 7);
2643 
2644 	/* XXX sc_preamble_mode is always 2. */
2645 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2646 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2647 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2648 		data->buf[2] |= 1;
2649 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2650 	    prior == URTW_PRIORITY_LOW)
2651 		panic("TODO tx.");
2652 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2653 		data->buf[2] |= (1 << 1);
2654 	/* RTS rate - 10 means we use a basic rate. */
2655 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2656 	/*
2657 	 * XXX currently TX rate control depends on the rate value of
2658 	 * RX descriptor because I don't know how to we can control TX rate
2659 	 * in more smart way.  Please fix me you find a thing.
2660 	 */
2661 	data->buf[3] = sc->sc_currate;
2662 	if (prior == URTW_PRIORITY_NORMAL) {
2663 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2664 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2665 		else if (ic->ic_fixed_rate != -1)
2666 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2667 	}
2668 
2669 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2670 		data->buf[8] = 3;		/* CW minimum */
2671 		data->buf[8] |= (7 << 4);	/* CW maximum */
2672 		data->buf[9] |= 11;		/* retry limitation */
2673 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2674 	} else {
2675 		data->buf[21] |= 11;		/* retry limitation */
2676 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2677 	}
2678 
2679 	data->ni = ni;
2680 
2681 	/* mbuf is no longer needed. */
2682 	m_freem(m0);
2683 
2684 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2685 	    USBD_FORCE_SHORT_XFER, URTW_DATA_TIMEOUT,
2686 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2687 	error = usbd_transfer(data->xfer);
2688 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2689 		printf("%s: could not send frame: %s\n",
2690 		    device_xname(sc->sc_dev), usbd_errstr(error));
2691 		return EIO;
2692 	}
2693 
2694 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2695 	if (error != 0)
2696 		printf("%s: could not control LED (%d)\n",
2697 		    device_xname(sc->sc_dev), error);
2698 
2699 	sc->sc_tx_queued[prior]++;
2700 
2701 	return 0;
2702 }
2703 
2704 usbd_status
2705 urtw_8225_usb_init(struct urtw_softc *sc)
2706 {
2707 	uint8_t data;
2708 	usbd_status error;
2709 
2710 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2711 	urtw_write8_m(sc, URTW_GPIO, 0);
2712 	error = urtw_read8e(sc, 0x53, &data);
2713 	if (error)
2714 		goto fail;
2715 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2716 	if (error)
2717 		goto fail;
2718 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2719 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2720 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2721 
2722 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2723 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2724 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2725 
2726 	usbd_delay_ms(sc->sc_udev, 500);
2727 fail:
2728 	return error;
2729 }
2730 
2731 usbd_status
2732 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2733 {
2734 	usbd_status error = 0;
2735 
2736 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2737 fail:
2738 	return error;
2739 }
2740 
2741 usbd_status
2742 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2743 {
2744 	uint32_t phyw;
2745 	usbd_status error;
2746 
2747 	phyw = ((data << 8) | (addr | 0x80));
2748 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2749 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2750 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2751 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2752 	/*
2753 	 * Delay removed from 8185 to 8187.
2754 	 * usbd_delay_ms(sc->sc_udev, 1);
2755 	 */
2756 fail:
2757 	return error;
2758 }
2759 
2760 usbd_status
2761 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2762 {
2763 	data = data & 0xff;
2764 	return urtw_8187_write_phy(sc, addr, data);
2765 }
2766 
2767 usbd_status
2768 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2769 {
2770 	data = data & 0xff;
2771 	return urtw_8187_write_phy(sc, addr, data | 0x10000);
2772 }
2773 
2774 usbd_status
2775 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2776 {
2777 	usbd_status error;
2778 
2779 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2780 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2781 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2782 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2783 fail:
2784 	return error;
2785 }
2786 
2787 usbd_status
2788 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2789 {
2790 	int i, idx, set;
2791 	uint8_t *cck_pwltable;
2792 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2793 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2794 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2795 	usbd_status error;
2796 
2797 	cck_pwrlvl_max = 11;
2798 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2799 	ofdm_pwrlvl_min = 10;
2800 
2801 	/* CCK power setting */
2802 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2803 	idx = cck_pwrlvl % 6;
2804 	set = cck_pwrlvl / 6;
2805 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2806 	    urtw_8225_txpwr_cck;
2807 
2808 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2809 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2810 	for (i = 0; i < 8; i++) {
2811 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2812 		    cck_pwltable[idx * 8 + i]);
2813 	}
2814 	usbd_delay_ms(sc->sc_udev, 1);
2815 
2816 	/* OFDM power setting */
2817 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2818 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2819 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2820 
2821 	idx = ofdm_pwrlvl % 6;
2822 	set = ofdm_pwrlvl / 6;
2823 
2824 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2825 	if (error)
2826 		goto fail;
2827 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2828 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2829 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2830 
2831 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2832 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2833 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2834 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2835 	usbd_delay_ms(sc->sc_udev, 1);
2836 fail:
2837 	return error;
2838 }
2839 
2840 usbd_status
2841 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2842 {
2843 	usbd_status error;
2844 
2845 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2846 	usbd_delay_ms(sc->sc_udev, 1);
2847 fail:
2848 	return error;
2849 }
2850 
2851 usbd_status
2852 urtw_8225_rf_init(struct urtw_rf *rf)
2853 {
2854 	struct urtw_softc *sc = rf->rf_sc;
2855 	unsigned int i;
2856 	uint16_t data;
2857 	usbd_status error;
2858 
2859 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2860 	if (error)
2861 		goto fail;
2862 
2863 	error = urtw_8225_usb_init(sc);
2864 	if (error)
2865 		goto fail;
2866 
2867 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2868 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2869 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2870 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2871 
2872 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2873 	if (error)
2874 		goto fail;
2875 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2876 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2877 	if (error)
2878 		goto fail;
2879 
2880 	error = urtw_8185_rf_pins_enable(sc);
2881 	if (error)
2882 		goto fail;
2883 
2884 	usbd_delay_ms(sc->sc_udev, 500);
2885 
2886 	for (i = 0; i < __arraycount(urtw_8225_rf_part1); i++) {
2887 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2888 		    urtw_8225_rf_part1[i].val);
2889 	}
2890 	usbd_delay_ms(sc->sc_udev, 50);
2891 	urtw_8225_write(sc, 0x2, 0xc4d);
2892 	usbd_delay_ms(sc->sc_udev, 200);
2893 	urtw_8225_write(sc, 0x2, 0x44d);
2894 	usbd_delay_ms(sc->sc_udev, 200);
2895 	urtw_8225_write(sc, 0x0, 0x127);
2896 
2897 	for (i = 0; i < __arraycount(urtw_8225_rxgain); i++) {
2898 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2899 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2900 	}
2901 
2902 	urtw_8225_write(sc, 0x0, 0x27);
2903 	urtw_8225_write(sc, 0x0, 0x22f);
2904 
2905 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
2906 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2907 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2908 	}
2909 
2910 	for (i = 0; i < __arraycount(urtw_8225_rf_part2); i++) {
2911 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2912 		    urtw_8225_rf_part2[i].val);
2913 		usbd_delay_ms(sc->sc_udev, 1);
2914 	}
2915 
2916 	error = urtw_8225_setgain(sc, 4);
2917 	if (error)
2918 		goto fail;
2919 
2920 	for (i = 0; i < __arraycount(urtw_8225_rf_part3); i++) {
2921 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2922 		    urtw_8225_rf_part3[i].val);
2923 		usbd_delay_ms(sc->sc_udev, 1);
2924 	}
2925 
2926 	urtw_write8_m(sc, 0x5b, 0x0d);
2927 
2928 	error = urtw_8225_set_txpwrlvl(sc, 1);
2929 	if (error)
2930 		goto fail;
2931 
2932 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2933 	usbd_delay_ms(sc->sc_udev, 1);
2934 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2935 	usbd_delay_ms(sc->sc_udev, 1);
2936 
2937 	/* TX ant A, 0x0 for B */
2938 	error = urtw_8185_tx_antenna(sc, 0x3);
2939 	if (error)
2940 		goto fail;
2941 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2942 
2943 	error = urtw_8225_rf_set_chan(rf, 1);
2944 fail:
2945 	return error;
2946 }
2947 
2948 usbd_status
2949 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2950 {
2951 	struct urtw_softc *sc = rf->rf_sc;
2952 	struct ieee80211com *ic = &sc->sc_ic;
2953 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2954 	usbd_status error;
2955 
2956 	error = urtw_8225_set_txpwrlvl(sc, chan);
2957 	if (error)
2958 		goto fail;
2959 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2960 	usbd_delay_ms(sc->sc_udev, 10);
2961 
2962 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2963 
2964 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2965 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2966 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2967 	else
2968 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2969 
2970 	if (IEEE80211_IS_CHAN_G(c)) {
2971 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2972 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
2973 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2974 	} else {
2975 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2976 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
2977 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2978 	}
2979 
2980 fail:
2981 	return error;
2982 }
2983 
2984 usbd_status
2985 urtw_8225_rf_set_sens(struct urtw_rf *rf)
2986 {
2987 	struct urtw_softc *sc = rf->rf_sc;
2988 	usbd_status error;
2989 
2990 	if (rf->sens > 6)
2991 		return -1;
2992 
2993 	if (rf->sens > 4)
2994 		urtw_8225_write(sc, 0x0c, 0x850);
2995 	else
2996 		urtw_8225_write(sc, 0x0c, 0x50);
2997 
2998 	rf->sens = 6 - rf->sens;
2999 	error = urtw_8225_setgain(sc, rf->sens);
3000 	if (error)
3001 		goto fail;
3002 
3003 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3004 
3005 fail:
3006 	return error;
3007 }
3008 
3009 void
3010 urtw_stop(struct ifnet *ifp, int disable)
3011 {
3012 	struct urtw_softc *sc = ifp->if_softc;
3013 	struct ieee80211com *ic = &sc->sc_ic;
3014 	uint8_t data;
3015 	usbd_status error;
3016 
3017 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3018 
3019 	sc->sc_txtimer = 0;
3020 	ifp->if_timer = 0;
3021 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3022 
3023 	callout_stop(&sc->scan_to);
3024 	callout_stop(&sc->sc_led_ch);
3025 
3026 	urtw_intr_disable(sc);
3027 	urtw_read8_m(sc, URTW_CMD, &data);
3028 	data &= ~URTW_CMD_TX_ENABLE;
3029 	data &= ~URTW_CMD_RX_ENABLE;
3030 	urtw_write8_m(sc, URTW_CMD, data);
3031 
3032 	if (sc->sc_rxpipe != NULL)
3033 		usbd_abort_pipe(sc->sc_rxpipe);
3034 	if (sc->sc_txpipe_low != NULL)
3035 		usbd_abort_pipe(sc->sc_txpipe_low);
3036 	if (sc->sc_txpipe_normal != NULL)
3037 		usbd_abort_pipe(sc->sc_txpipe_normal);
3038 
3039 fail:
3040 	return;
3041 }
3042 
3043 int
3044 urtw_isbmode(uint16_t rate)
3045 {
3046 	rate = urtw_rtl2rate(rate);
3047 
3048 	return ((rate <= 22 && rate != 12 && rate != 18) ||
3049 	    rate == 44) ? 1 : 0;
3050 }
3051 
3052 void
3053 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3054 {
3055 	struct urtw_rx_data *data = priv;
3056 	struct urtw_softc *sc = data->sc;
3057 	struct ieee80211com *ic = &sc->sc_ic;
3058 	struct ifnet *ifp = ic->ic_ifp;
3059 	struct ieee80211_frame *wh;
3060 	struct ieee80211_node *ni;
3061 	struct mbuf *m, *mnew;
3062 	uint8_t *desc, quality, rate;
3063 	int actlen, flen, len, rssi, s;
3064 
3065 	if (status != USBD_NORMAL_COMPLETION) {
3066 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3067 			return;
3068 
3069 		if (status == USBD_STALLED)
3070 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3071 		ifp->if_ierrors++;
3072 		goto skip;
3073 	}
3074 
3075 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3076 	if (actlen < URTW_MIN_RXBUFSZ) {
3077 		ifp->if_ierrors++;
3078 		goto skip;
3079 	}
3080 
3081 	if (sc->sc_hwrev & URTW_HWREV_8187)
3082 		/* 4 dword and 4 byte CRC */
3083 		len = actlen - (4 * 4);
3084 	else
3085 		/* 5 dword and 4 byte CRC */
3086 		len = actlen - (4 * 5);
3087 
3088 	desc = data->buf + len;
3089 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3090 	if (flen > actlen) {
3091 		ifp->if_ierrors++;
3092 		goto skip;
3093 	}
3094 
3095 	rate = (desc[2] & 0xf0) >> 4;
3096 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3097 		quality = desc[4] & 0xff;
3098 		rssi = (desc[6] & 0xfe) >> 1;
3099 
3100 		/* XXX correct? */
3101 		if (!urtw_isbmode(rate)) {
3102 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3103 			rssi = ((90 - rssi) * 100) / 65;
3104 		} else {
3105 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3106 			rssi = ((95 - rssi) * 100) / 65;
3107 		}
3108 	} else {
3109 		quality = desc[12];
3110 		rssi = 14 - desc[14] / 2;
3111 	}
3112 
3113 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3114 	if (mnew == NULL) {
3115 		printf("%s: could not allocate rx mbuf\n",
3116 		    device_xname(sc->sc_dev));
3117 		ifp->if_ierrors++;
3118 		goto skip;
3119 	}
3120 	MCLGET(mnew, M_DONTWAIT);
3121 	if (!(mnew->m_flags & M_EXT)) {
3122 		printf("%s: could not allocate rx mbuf cluster\n",
3123 		    device_xname(sc->sc_dev));
3124 		m_freem(mnew);
3125 		ifp->if_ierrors++;
3126 		goto skip;
3127 	}
3128 
3129 	m = data->m;
3130 	data->m = mnew;
3131 	data->buf = mtod(mnew, uint8_t *);
3132 
3133 	/* finalize mbuf */
3134 	m_set_rcvif(m, ifp);
3135 	m->m_pkthdr.len = m->m_len = flen - 4;
3136 
3137 	s = splnet();
3138 
3139 	if (sc->sc_drvbpf != NULL) {
3140 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3141 
3142 		/* XXX Are variables correct? */
3143 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3144 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3145 		tap->wr_dbm_antsignal = (int8_t)rssi;
3146 
3147 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
3148 	}
3149 	wh = mtod(m, struct ieee80211_frame *);
3150 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3151 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3152 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3153 
3154 	/* XXX correct? */
3155 	if (!urtw_isbmode(rate)) {
3156 		if (quality > 127)
3157 			quality = 0;
3158 		else if (quality < 27)
3159 			quality = 100;
3160 		else
3161 			quality = 127 - quality;
3162 	} else
3163 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3164 
3165 	/* send the frame to the 802.11 layer */
3166 	ieee80211_input(ic, m, ni, rssi, 0);
3167 
3168 	/* node is no longer needed */
3169 	ieee80211_free_node(ni);
3170 
3171 	splx(s);
3172 
3173 skip:	/* setup a new transfer */
3174 	usbd_setup_xfer(xfer, data, data->buf, MCLBYTES,
3175 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3176 	(void)usbd_transfer(xfer);
3177 }
3178 
3179 usbd_status
3180 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3181 {
3182 	uint8_t *gainp;
3183 	usbd_status error;
3184 
3185 	/* XXX for A? */
3186 	gainp = urtw_8225v2_gain_bg;
3187 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3188 	usbd_delay_ms(sc->sc_udev, 1);
3189 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3190 	usbd_delay_ms(sc->sc_udev, 1);
3191 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3192 	usbd_delay_ms(sc->sc_udev, 1);
3193 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3194 	usbd_delay_ms(sc->sc_udev, 1);
3195 fail:
3196 	return error;
3197 }
3198 
3199 usbd_status
3200 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3201 {
3202 	int i;
3203 	uint8_t *cck_pwrtable;
3204 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3205 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3206 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3207 	usbd_status error;
3208 
3209 	/* CCK power setting */
3210 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3211 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3212 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3213 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3214 	    urtw_8225v2_txpwr_cck;
3215 
3216 	for (i = 0; i < 8; i++) {
3217 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3218 	}
3219 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3220 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3221 	usbd_delay_ms(sc->sc_udev, 1);
3222 
3223 	/* OFDM power setting */
3224 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3225 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3226 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3227 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3228 
3229 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3230 	if (error)
3231 		goto fail;
3232 
3233 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3234 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3235 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3236 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3237 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3238 
3239 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3240 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3241 	usbd_delay_ms(sc->sc_udev, 1);
3242 fail:
3243 	return error;
3244 }
3245 
3246 usbd_status
3247 urtw_8225v2_rf_init(struct urtw_rf *rf)
3248 {
3249 	struct urtw_softc *sc = rf->rf_sc;
3250 	int i;
3251 	uint16_t data;
3252 	uint32_t data32;
3253 	usbd_status error;
3254 
3255 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3256 	if (error)
3257 		goto fail;
3258 
3259 	error = urtw_8225_usb_init(sc);
3260 	if (error)
3261 		goto fail;
3262 
3263 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3264 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3265 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3266 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3267 
3268 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3269 	if (error)
3270 		goto fail;
3271 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3272 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3273 	if (error)
3274 		goto fail;
3275 
3276 	error = urtw_8185_rf_pins_enable(sc);
3277 	if (error)
3278 		goto fail;
3279 
3280 	usbd_delay_ms(sc->sc_udev, 1000);
3281 
3282 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part1); i++) {
3283 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3284 		    urtw_8225v2_rf_part1[i].val);
3285 		usbd_delay_ms(sc->sc_udev, 1);
3286 	}
3287 	usbd_delay_ms(sc->sc_udev, 50);
3288 
3289 	urtw_8225_write(sc, 0x0, 0x1b7);
3290 
3291 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3292 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3293 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3294 	}
3295 
3296 	urtw_8225_write(sc, 0x3, 0x2);
3297 	urtw_8225_write(sc, 0x5, 0x4);
3298 	urtw_8225_write(sc, 0x0, 0xb7);
3299 	urtw_8225_write(sc, 0x2, 0xc4d);
3300 	usbd_delay_ms(sc->sc_udev, 100);
3301 	urtw_8225_write(sc, 0x2, 0x44d);
3302 	usbd_delay_ms(sc->sc_udev, 100);
3303 
3304 	error = urtw_8225_read(sc, 0x6, &data32);
3305 	if (error != 0)
3306 		goto fail;
3307 	if (data32 != 0xe6)
3308 		printf("%s: expect 0xe6!! (0x%x)\n", device_xname(sc->sc_dev),
3309 		    data32);
3310 	if (!(data32 & 0x80)) {
3311 		urtw_8225_write(sc, 0x02, 0x0c4d);
3312 		usbd_delay_ms(sc->sc_udev, 200);
3313 		urtw_8225_write(sc, 0x02, 0x044d);
3314 		usbd_delay_ms(sc->sc_udev, 100);
3315 		error = urtw_8225_read(sc, 0x6, &data32);
3316 		if (error != 0)
3317 			goto fail;
3318 		if (!(data32 & 0x80))
3319 			printf("%s: RF calibration failed\n",
3320 			    device_xname(sc->sc_dev));
3321 	}
3322 	usbd_delay_ms(sc->sc_udev, 100);
3323 
3324 	urtw_8225_write(sc, 0x0, 0x2bf);
3325 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
3326 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3327 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3328 	}
3329 
3330 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part2); i++) {
3331 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3332 		    urtw_8225v2_rf_part2[i].val);
3333 	}
3334 
3335 	error = urtw_8225v2_setgain(sc, 4);
3336 	if (error)
3337 		goto fail;
3338 
3339 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part3); i++) {
3340 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3341 		    urtw_8225v2_rf_part3[i].val);
3342 	}
3343 
3344 	urtw_write8_m(sc, 0x5b, 0x0d);
3345 
3346 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3347 	if (error)
3348 		goto fail;
3349 
3350 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3351 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3352 
3353 	/* TX ant A, 0x0 for B */
3354 	error = urtw_8185_tx_antenna(sc, 0x3);
3355 	if (error)
3356 		goto fail;
3357 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3358 
3359 	error = urtw_8225_rf_set_chan(rf, 1);
3360 fail:
3361 	return error;
3362 }
3363 
3364 usbd_status
3365 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3366 {
3367 	struct urtw_softc *sc = rf->rf_sc;
3368 	struct ieee80211com *ic = &sc->sc_ic;
3369 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3370 	usbd_status error;
3371 
3372 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3373 	if (error)
3374 		goto fail;
3375 
3376 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3377 	usbd_delay_ms(sc->sc_udev, 10);
3378 
3379 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3380 
3381 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3382 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3383 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3384 	else
3385 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3386 
3387 	if (IEEE80211_IS_CHAN_G(c)) {
3388 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3389 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3390 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3391 	} else {
3392 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3393 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3394 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3395 	}
3396 
3397 fail:
3398 	return error;
3399 }
3400 
3401 void
3402 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3403 {
3404 	struct urtw_rf *rf = &sc->sc_rf;
3405 	struct ieee80211com *ic = &sc->sc_ic;
3406 	usbd_status error = 0;
3407 	uint32_t data;
3408 	u_int chan;
3409 
3410 	chan = ieee80211_chan2ieee(ic, c);
3411 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3412 		return;
3413 	/*
3414 	 * During changing the channel we need to temporary disable
3415 	 * TX.
3416 	 */
3417 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3418 	data &= ~URTW_TX_LOOPBACK_MASK;
3419 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3420 	error = rf->set_chan(rf, chan);
3421 	if (error != 0) {
3422 		printf("%s could not change the channel\n",
3423 		    device_xname(sc->sc_dev));
3424 		return;
3425 	}
3426 	usbd_delay_ms(sc->sc_udev, 10);
3427 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3428 
3429 fail:	return;
3430 
3431 }
3432 
3433 void
3434 urtw_next_scan(void *arg)
3435 {
3436 	struct urtw_softc *sc = arg;
3437 	struct ieee80211com *ic = &sc->sc_ic;
3438 	int s;
3439 
3440 	if (sc->sc_dying)
3441 		return;
3442 
3443 	s = splnet();
3444 	if (ic->ic_state == IEEE80211_S_SCAN)
3445 		ieee80211_next_scan(ic);
3446 	splx(s);
3447 }
3448 
3449 void
3450 urtw_task(void *arg)
3451 {
3452 	struct urtw_softc *sc = arg;
3453 	struct ieee80211com *ic = &sc->sc_ic;
3454 	struct ieee80211_node *ni;
3455 	enum ieee80211_state ostate;
3456 	usbd_status error = 0;
3457 
3458 	if (sc->sc_dying)
3459 		return;
3460 
3461 	ostate = ic->ic_state;
3462 
3463 	switch (sc->sc_state) {
3464 	case IEEE80211_S_INIT:
3465 		if (ostate == IEEE80211_S_RUN) {
3466 			/* turn link LED off */
3467 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3468 		}
3469 		break;
3470 
3471 	case IEEE80211_S_SCAN:
3472 		urtw_set_chan(sc, ic->ic_curchan);
3473 		if (!sc->sc_dying)
3474 			callout_schedule(&sc->scan_to, mstohz(200));
3475 		break;
3476 
3477 	case IEEE80211_S_AUTH:
3478 	case IEEE80211_S_ASSOC:
3479 		urtw_set_chan(sc, ic->ic_curchan);
3480 		break;
3481 
3482 	case IEEE80211_S_RUN:
3483 		ni = ic->ic_bss;
3484 
3485 		urtw_set_chan(sc, ic->ic_curchan);
3486 
3487 		/* setting bssid. */
3488 		error = urtw_set_bssid(sc, ni->ni_bssid);
3489 		if (error != 0)
3490 			goto fail;
3491 		urtw_update_msr(sc);
3492 		/* XXX maybe the below would be incorrect. */
3493 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3494 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3495 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3496 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3497 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3498 		if (error != 0)
3499 			printf("%s: could not control LED (%d)\n",
3500 			    device_xname(sc->sc_dev), error);
3501 		break;
3502 	}
3503 
3504 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3505 
3506 fail:
3507 	if (error != 0) {
3508 		DPRINTF(("%s: error duing processing RUN state.",
3509 		    device_xname(sc->sc_dev)));
3510 	}
3511 }
3512 
3513 usbd_status
3514 urtw_8187b_update_wmm(struct urtw_softc *sc)
3515 {
3516 	struct ieee80211com *ic = &sc->sc_ic;
3517 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3518 	uint32_t data;
3519 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3520 	usbd_status error;
3521 
3522 	sifs = 0xa;
3523 	if (IEEE80211_IS_CHAN_G(c))
3524 		slot = 0x9;
3525 	else
3526 		slot = 0x14;
3527 
3528 	aifs = (2 * slot) + sifs;
3529 	ecwmin = 3;
3530 	ecwmax = 7;
3531 
3532 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3533 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3534 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3535 
3536 	urtw_write32_m(sc, URTW_AC_VO, data);
3537 	urtw_write32_m(sc, URTW_AC_VI, data);
3538 	urtw_write32_m(sc, URTW_AC_BE, data);
3539 	urtw_write32_m(sc, URTW_AC_BK, data);
3540 
3541 fail:
3542 	return error;
3543 }
3544 
3545 usbd_status
3546 urtw_8187b_reset(struct urtw_softc *sc)
3547 {
3548 	uint8_t data;
3549 	usbd_status error;
3550 
3551 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3552 	if (error)
3553 		goto fail;
3554 
3555 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3556 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3557 		URTW_CONFIG3_GNT_SELECT);
3558 
3559 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3560 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3561 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3562 
3563 	urtw_write8_m(sc, 0x61, 0x10);
3564 	urtw_read8_m(sc, 0x62, &data);
3565 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3566 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3567 
3568 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3569 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3570 
3571 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3572 	if (error)
3573 		goto fail;
3574 
3575 	urtw_read8_m(sc, URTW_CMD, &data);
3576 	data = (data & 2) | URTW_CMD_RST;
3577 	urtw_write8_m(sc, URTW_CMD, data);
3578 	usbd_delay_ms(sc->sc_udev, 100);
3579 
3580 	urtw_read8_m(sc, URTW_CMD, &data);
3581 	if (data & URTW_CMD_RST) {
3582 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
3583 		goto fail;
3584 	}
3585 
3586 fail:
3587 	return error;
3588 }
3589 
3590 int
3591 urtw_8187b_init(struct ifnet *ifp)
3592 {
3593 	struct urtw_softc *sc = ifp->if_softc;
3594 	struct urtw_rf *rf = &sc->sc_rf;
3595 	struct ieee80211com *ic = &sc->sc_ic;
3596 	uint8_t data;
3597 	usbd_status error;
3598 
3599 	urtw_stop(ifp, 0);
3600 
3601 	error = urtw_8187b_update_wmm(sc);
3602 	if (error != 0)
3603 		goto fail;
3604 	error = urtw_8187b_reset(sc);
3605 	if (error)
3606 		goto fail;
3607 
3608 	/* Applying MAC address again. */
3609 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3610 	if (error)
3611 		goto fail;
3612 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3613 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3614 	if (error)
3615 		goto fail;
3616 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3617 	if (error)
3618 		goto fail;
3619 
3620 	error = urtw_update_msr(sc);
3621 	if (error)
3622 		goto fail;
3623 
3624 	error = rf->init(rf);
3625 	if (error != 0)
3626 		goto fail;
3627 
3628 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3629 		URTW_CMD_RX_ENABLE);
3630 	error = urtw_intr_enable(sc);
3631 	if (error != 0)
3632 		goto fail;
3633 
3634 	error = urtw_write8e(sc, 0x41, 0xf4);
3635 	if (error != 0)
3636 		goto fail;
3637 	error = urtw_write8e(sc, 0x40, 0x00);
3638 	if (error != 0)
3639 		goto fail;
3640 	error = urtw_write8e(sc, 0x42, 0x00);
3641 	if (error != 0)
3642 		goto fail;
3643 	error = urtw_write8e(sc, 0x42, 0x01);
3644 	if (error != 0)
3645 		goto fail;
3646 	error = urtw_write8e(sc, 0x40, 0x0f);
3647 	if (error != 0)
3648 		goto fail;
3649 	error = urtw_write8e(sc, 0x42, 0x00);
3650 	if (error != 0)
3651 		goto fail;
3652 	error = urtw_write8e(sc, 0x42, 0x01);
3653 	if (error != 0)
3654 		goto fail;
3655 
3656 	urtw_read8_m(sc, 0xdb, &data);
3657 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3658 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3659 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3660 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3661 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3662 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3663 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3664 	urtw_write8_m(sc, 0x61, 0);
3665 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3666 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3667 	urtw_write8_m(sc, 0xda, 0x10);
3668 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3669 
3670 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3671 
3672 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3673 
3674 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3675 
3676 	/* Reset softc variables. */
3677 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
3678 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
3679 	}
3680 	sc->sc_txtimer = 0;
3681 
3682 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3683 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3684 		if (error != 0) {
3685 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
3686 			    ", err=%s\n", usbd_errstr(error));
3687 
3688 			goto fail;
3689 		}
3690 		/* Get the first interface handle. */
3691 		error = usbd_device2interface_handle(sc->sc_udev,
3692 		    URTW_IFACE_INDEX, &sc->sc_iface);
3693 		if (error != 0) {
3694 			printf("%s: could not get interface handle\n",
3695 			    device_xname(sc->sc_dev));
3696 			goto fail;
3697 		}
3698 		error = urtw_open_pipes(sc);
3699 		if (error != 0)
3700 			goto fail;
3701 		error = urtw_alloc_rx_data_list(sc);
3702 		if (error != 0)
3703 			goto fail;
3704 		error = urtw_alloc_tx_data_list(sc);
3705 		if (error != 0)
3706 			goto fail;
3707 		sc->sc_flags |= URTW_INIT_ONCE;
3708 	}
3709 
3710 	error = urtw_rx_enable(sc);
3711 	if (error != 0)
3712 		goto fail;
3713 	error = urtw_tx_enable(sc);
3714 	if (error != 0)
3715 		goto fail;
3716 
3717 	ifp->if_flags &= ~IFF_OACTIVE;
3718 	ifp->if_flags |= IFF_RUNNING;
3719 
3720 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3721 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3722 	else
3723 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3724 
3725 fail:
3726 	return error;
3727 }
3728 
3729 usbd_status
3730 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3731 {
3732 	int i;
3733 	usbd_status error;
3734 
3735 	for (i = 0; i < __arraycount(urtw_8187b_regtbl); i++) {
3736 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3737 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3738 	}
3739 
3740 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3741 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3742 
3743 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3744 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3745 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3746 
3747 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3748 
3749 fail:
3750 	return error;
3751 }
3752 
3753 usbd_status
3754 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3755 {
3756 	usbd_status error;
3757 
3758 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3759 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3760 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3761 	usbd_delay_ms(sc->sc_udev, 100);
3762 
3763 fail:
3764 	return error;
3765 }
3766 
3767 usbd_status
3768 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3769 {
3770 	struct ieee80211com *ic = &sc->sc_ic;
3771 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3772 	uint8_t aifs, difs, eifs, sifs, slot;
3773 	usbd_status error;
3774 
3775 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3776 
3777 	sifs = 0xa;
3778 	if (IEEE80211_IS_CHAN_G(c)) {
3779 		slot = 0x9;
3780 		difs = 0x1c;
3781 		eifs = 0x5b;
3782 	} else {
3783 		slot = 0x14;
3784 		difs = 0x32;
3785 		eifs = 0x5b;
3786 	}
3787 	aifs = (2 * slot) + sifs;
3788 
3789 	urtw_write8_m(sc, URTW_SLOT, slot);
3790 
3791 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3792 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3793 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3794 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3795 
3796 	urtw_write8_m(sc, URTW_DIFS, difs);
3797 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3798 
3799 fail:
3800 	return error;
3801 }
3802 
3803 usbd_status
3804 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3805 {
3806 	struct urtw_softc *sc = rf->rf_sc;
3807 	unsigned int i;
3808 	uint8_t data;
3809 	usbd_status error;
3810 
3811 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3812 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3813 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3814 	urtw_write8_m(sc, URTW_CW_CONF, data |
3815 		URTW_CW_CONF_PERPACKET_RETRY);
3816 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3817 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3818 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3819 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3820 
3821 	/* Auto rate fallback control. */
3822 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3823 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3824 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3825 		URTW_RATE_FALLBACK_ENABLE);
3826 
3827 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3828 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3829 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3830 
3831 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3832 	if (error)
3833 		goto fail;
3834 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3835 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3836 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3837 	if (error)
3838 		goto fail;
3839 
3840 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3841 	urtw_8225v2_b_config_mac(sc);
3842 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3843 
3844 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3845 	if (error)
3846 		goto fail;
3847 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3848 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3849 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3850 	if (error)
3851 		goto fail;
3852 
3853 	urtw_8225v2_b_init_rfe(sc);
3854 
3855 	for (i = 0; i < __arraycount(urtw_8225v2_b_rf); i++) {
3856 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3857 		    urtw_8225v2_b_rf[i].val);
3858 	}
3859 
3860 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3861 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3862 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3863 	}
3864 
3865 	urtw_8225_write(sc, 0x03, 0x080);
3866 	urtw_8225_write(sc, 0x05, 0x004);
3867 	urtw_8225_write(sc, 0x00, 0x0b7);
3868 	urtw_8225_write(sc, 0x02, 0xc4d);
3869 	urtw_8225_write(sc, 0x02, 0x44d);
3870 	urtw_8225_write(sc, 0x00, 0x2bf);
3871 
3872 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3873 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3874 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3875 
3876 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3877 	for (i = 0; i < __arraycount(urtw_8225v2_agc); i++) {
3878 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3879 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3880 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3881 	}
3882 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3883 
3884 	for (i = 0; i < __arraycount(urtw_8225v2_ofdm); i++)
3885 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3886 
3887 	urtw_8225v2_b_update_chan(sc);
3888 
3889 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3890 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3891 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3892 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3893 
3894 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3895 fail:
3896 	return error;
3897 }
3898 
3899 usbd_status
3900 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3901 {
3902 	struct urtw_softc *sc = rf->rf_sc;
3903 	usbd_status error;
3904 
3905 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3906 	if (error)
3907 		goto fail;
3908 
3909 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3910 	/*
3911 	 * Delay removed from 8185 to 8187.
3912 	 * usbd_delay_ms(sc->sc_udev, 10);
3913 	 */
3914 
3915 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3916 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3917 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3918 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3919 
3920 fail:
3921 	return error;
3922 }
3923 
3924 usbd_status
3925 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3926 {
3927 	int i;
3928 	uint8_t *cck_pwrtable;
3929 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3930 	    ofdm_pwrlvl_max;
3931 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3932 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3933 	usbd_status error;
3934 
3935 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3936 		cck_pwrlvl_min = 0;
3937 		cck_pwrlvl_max = 15;
3938 		ofdm_pwrlvl_min = 2;
3939 		ofdm_pwrlvl_max = 17;
3940 	} else {
3941 		cck_pwrlvl_min = 7;
3942 		cck_pwrlvl_max = 22;
3943 		ofdm_pwrlvl_min = 10;
3944 		ofdm_pwrlvl_max = 25;
3945 	}
3946 
3947 	/* CCK power setting */
3948 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
3949 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
3950 
3951 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3952 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3953 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
3954 
3955 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3956 	    urtw_8225v2_txpwr_cck;
3957 
3958 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3959 		if (cck_pwrlvl <= 6)
3960 			; /* do nothing */
3961 		else if (cck_pwrlvl <= 11)
3962 			cck_pwrtable += 8;
3963 		else
3964 			cck_pwrtable += 16;
3965 	} else {
3966 		if (cck_pwrlvl <= 5)
3967 			; /* do nothing */
3968 		else if (cck_pwrlvl <= 11)
3969 			cck_pwrtable += 8;
3970 		else if (cck_pwrlvl <= 17)
3971 			cck_pwrtable += 16;
3972 		else
3973 			cck_pwrtable += 24;
3974 	}
3975 
3976 	for (i = 0; i < 8; i++) {
3977 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3978 	}
3979 
3980 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3981 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3982 	/*
3983 	 * Delay removed from 8185 to 8187.
3984 	 * usbd_delay_ms(sc->sc_udev, 1);
3985 	 */
3986 
3987 	/* OFDM power setting */
3988 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3989 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3990 
3991 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3992 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3993 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
3994 
3995 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3996 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3997 
3998 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3999 		if (ofdm_pwrlvl <= 11) {
4000 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4001 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4002 		} else {
4003 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4004 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4005 		}
4006 	} else {
4007 		if (ofdm_pwrlvl <= 11) {
4008 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4009 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4010 		} else if (ofdm_pwrlvl <= 17) {
4011 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4012 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4013 		} else {
4014 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4015 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4016 		}
4017 	}
4018 
4019 	/*
4020 	 * Delay removed from 8185 to 8187.
4021 	 * usbd_delay_ms(sc->sc_udev, 1);
4022 	 */
4023 fail:
4024 	return error;
4025 }
4026 
4027 int
4028 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4029 {
4030 	int error;
4031 
4032 	urtw_write32_m(sc, URTW_BSSID,
4033 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4034 	urtw_write16_m(sc, URTW_BSSID + 4,
4035 	    bssid[4] | bssid[5] << 8);
4036 
4037 	return 0;
4038 
4039 fail:
4040 	return error;
4041 }
4042 
4043 int
4044 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4045 {
4046 	int error;
4047 
4048 	urtw_write32_m(sc, URTW_MAC0,
4049 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4050 	urtw_write16_m(sc, URTW_MAC4,
4051 	    addr[4] | addr[5] << 8);
4052 
4053 	return 0;
4054 
4055 fail:
4056 	return error;
4057 }
4058 
4059 MODULE(MODULE_CLASS_DRIVER, if_urtw, NULL);
4060 
4061 #ifdef _MODULE
4062 #include "ioconf.c"
4063 #endif
4064 
4065 static int
4066 if_urtw_modcmd(modcmd_t cmd, void *aux)
4067 {
4068 	int error = 0;
4069 
4070 	switch (cmd) {
4071 	case MODULE_CMD_INIT:
4072 #ifdef _MODULE
4073 		error = config_init_component(cfdriver_ioconf_urtw,
4074 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4075 #endif
4076 		return error;
4077 	case MODULE_CMD_FINI:
4078 #ifdef _MODULE
4079 		error = config_fini_component(cfdriver_ioconf_urtw,
4080 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4081 #endif
4082 		return error;
4083 	default:
4084 		return ENOTTY;
4085 	}
4086 }
4087