xref: /netbsd-src/sys/dev/usb/if_urtw.c (revision fdd524d4ccd2bb0c6f67401e938dabf773eb0372)
1 /*	$NetBSD: if_urtw.c,v 1.10 2016/06/10 13:27:15 ozaki-r Exp $	*/
2 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
3 
4 /*-
5  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
6  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __KERNEL_RCSID(0, "$NetBSD: if_urtw.c,v 1.10 2016/06/10 13:27:15 ozaki-r Exp $");
23 
24 #include <sys/param.h>
25 #include <sys/sockio.h>
26 #include <sys/proc.h>
27 #include <sys/mbuf.h>
28 #include <sys/kernel.h>
29 #include <sys/socket.h>
30 #include <sys/systm.h>
31 #include <sys/callout.h>
32 #include <sys/conf.h>
33 #include <sys/device.h>
34 #include <sys/module.h>
35 #include <sys/bus.h>
36 
37 #include <machine/endian.h>
38 #include <net/bpf.h>
39 #include <net/if.h>
40 #include <net/if_arp.h>
41 #include <net/if_dl.h>
42 #include <net/if_ether.h>
43 #include <net/if_media.h>
44 #include <net/if_types.h>
45 
46 #include <netinet/in.h>
47 #include <netinet/in_systm.h>
48 #include <netinet/in_var.h>
49 #include <netinet/if_inarp.h>
50 #include <netinet/ip.h>
51 
52 #include <net80211/ieee80211_var.h>
53 #include <net80211/ieee80211_radiotap.h>
54 
55 #include <dev/usb/usb.h>
56 #include <dev/usb/usbdi.h>
57 #include <dev/usb/usbdi_util.h>
58 #include <dev/usb/usbdivar.h>
59 #include <dev/usb/usbdevs.h>
60 
61 #include "if_urtwreg.h"
62 
63 #ifdef URTW_DEBUG
64 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
65 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
66 int urtw_debug = 0;
67 #else
68 #define	DPRINTF(x)
69 #define	DPRINTFN(n, x)
70 #endif
71 
72 /*
73  * Recognized device vendors/products.
74  */
75 static const struct urtw_type {
76 	struct usb_devno	dev;
77 	uint8_t			rev;
78 } urtw_devs[] = {
79 #define	URTW_DEV_RTL8187(v, p)	\
80 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
81 #define	URTW_DEV_RTL8187B(v, p)	\
82 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
83 	/* Realtek RTL8187 devices. */
84 	URTW_DEV_RTL8187(ASUSTEK,	P5B_WIFI),
85 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
86 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GC_2),
87 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
88 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
89 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
90 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
91 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
92 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
93 	/* Realtek RTL8187B devices. */
94 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
95 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
96 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
97 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
98 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
99 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
100 #undef	URTW_DEV_RTL8187
101 #undef	URTW_DEV_RTL8187B
102 };
103 #define	urtw_lookup(v, p)	\
104 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
105 
106 /*
107  * Helper read/write macros.
108  */
109 #define urtw_read8_m(sc, val, data)	do {			\
110 	error = urtw_read8_c(sc, val, data, 0);			\
111 	if (error != 0)						\
112 		goto fail;					\
113 } while (0)
114 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
115 	error = urtw_read8_c(sc, val, data, idx);		\
116 	if (error != 0)						\
117 		goto fail;					\
118 } while (0)
119 #define urtw_write8_m(sc, val, data)	do {			\
120 	error = urtw_write8_c(sc, val, data, 0);		\
121 	if (error != 0)						\
122 		goto fail;					\
123 } while (0)
124 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
125 	error = urtw_write8_c(sc, val, data, idx);		\
126 	if (error != 0)						\
127 		goto fail;					\
128 } while (0)
129 #define urtw_read16_m(sc, val, data)	do {			\
130 	error = urtw_read16_c(sc, val, data, 0);		\
131 	if (error != 0)						\
132 		goto fail;					\
133 } while (0)
134 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
135 	error = urtw_read16_c(sc, val, data, idx);		\
136 	if (error != 0)						\
137 		goto fail;					\
138 } while (0)
139 #define urtw_write16_m(sc, val, data)	do {			\
140 	error = urtw_write16_c(sc, val, data, 0);		\
141 	if (error != 0)						\
142 		goto fail;					\
143 } while (0)
144 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
145 	error = urtw_write16_c(sc, val, data, idx);		\
146 	if (error != 0)						\
147 		goto fail;					\
148 } while (0)
149 #define urtw_read32_m(sc, val, data)	do {			\
150 	error = urtw_read32_c(sc, val, data, 0);		\
151 	if (error != 0)						\
152 		goto fail;					\
153 } while (0)
154 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
155 	error = urtw_read32_c(sc, val, data, idx);		\
156 	if (error != 0)						\
157 		goto fail;					\
158 } while (0)
159 #define urtw_write32_m(sc, val, data)	do {			\
160 	error = urtw_write32_c(sc, val, data, 0);		\
161 	if (error != 0)						\
162 		goto fail;					\
163 } while (0)
164 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
165 	error = urtw_write32_c(sc, val, data, idx);		\
166 	if (error != 0)						\
167 		goto fail;					\
168 } while (0)
169 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
170 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
171 	if (error != 0)						\
172 		goto fail;					\
173 } while (0)
174 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
175 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
176 	if (error != 0)						\
177 		goto fail;					\
178 } while (0)
179 #define urtw_8225_write(sc, val, data)	do {			\
180 	error = urtw_8225_write_c(sc, val, data);		\
181 	if (error != 0)						\
182 		goto fail;					\
183 } while (0)
184 
185 struct urtw_pair {
186 	uint32_t	reg;
187 	uint32_t	val;
188 };
189 
190 struct urtw_pair_idx {
191 	uint8_t		reg;
192 	uint8_t		val;
193 	uint8_t		idx;
194 };
195 
196 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
197 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
198 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
199 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
200 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
201 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
202 	{ 0xff, 0x00, 0 },
203 
204 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
205 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
206 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
207 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
208 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
209 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
210 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
211 	{ 0xf8, 0x08, 1 },
212 
213 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
214 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
215 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
216 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
217 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
218 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
219 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
220 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
221 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
222 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
223 
224 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
225 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
226 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
227 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
228 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
229 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
230 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
231 
232 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
233 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
234 };
235 
236 static uint8_t urtw_8225_agc[] = {
237 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
238 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
239 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
240 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
241 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
242 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
243 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
244 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
245 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
246 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
247 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
248 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
249 };
250 
251 static uint32_t urtw_8225_channel[] = {
252 	0x0000,		/* dummy channel 0 */
253 	0x085c,		/* 1 */
254 	0x08dc,		/* 2 */
255 	0x095c,		/* 3 */
256 	0x09dc,		/* 4 */
257 	0x0a5c,		/* 5 */
258 	0x0adc,		/* 6 */
259 	0x0b5c,		/* 7 */
260 	0x0bdc,		/* 8 */
261 	0x0c5c,		/* 9 */
262 	0x0cdc,		/* 10 */
263 	0x0d5c,		/* 11 */
264 	0x0ddc,		/* 12 */
265 	0x0e5c,		/* 13 */
266 	0x0f72,		/* 14 */
267 };
268 
269 static uint8_t urtw_8225_gain[] = {
270 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
271 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
272 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
273 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
274 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
275 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
276 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
277 };
278 
279 static struct urtw_pair urtw_8225_rf_part1[] = {
280 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
281 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
282 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
283 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
284 };
285 
286 static struct urtw_pair urtw_8225_rf_part2[] = {
287 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
288 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
289 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
290 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
291 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
292 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
293 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
294 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
295 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
296 	{ 0x27, 0x88 }
297 };
298 
299 static struct urtw_pair urtw_8225_rf_part3[] = {
300 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
301 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
302 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
303 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
304 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
305 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
306 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
307 };
308 
309 static uint16_t urtw_8225_rxgain[] = {
310 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
311 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
312 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
313 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
314 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
315 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
316 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
317 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
318 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
319 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
320 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
321 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
322 };
323 
324 static uint8_t urtw_8225_threshold[] = {
325 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
326 };
327 
328 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
329 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
330 };
331 
332 static uint8_t urtw_8225_txpwr_cck[] = {
333 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
334 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
335 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
336 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
337 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
338 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
339 };
340 
341 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
342 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
343 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
344 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
345 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
346 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
347 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
348 };
349 
350 static uint8_t urtw_8225_txpwr_ofdm[] = {
351 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
352 };
353 
354 static uint8_t urtw_8225v2_agc[] = {
355 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
356 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
357 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
358 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
359 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
360 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
361 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
362 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
363 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
364 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
365 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
366 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
367 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
368 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
369 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
370 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
371 };
372 
373 static uint8_t urtw_8225v2_ofdm[] = {
374 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
375 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
376 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
377 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
378 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
379 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
380 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
381 	0x6d, 0x3c, 0xfb, 0x07
382 };
383 
384 static uint8_t urtw_8225v2_gain_bg[] = {
385 	0x23, 0x15, 0xa5,		/* -82-1dbm */
386 	0x23, 0x15, 0xb5,		/* -82-2dbm */
387 	0x23, 0x15, 0xc5,		/* -82-3dbm */
388 	0x33, 0x15, 0xc5,		/* -78dbm */
389 	0x43, 0x15, 0xc5,		/* -74dbm */
390 	0x53, 0x15, 0xc5,		/* -70dbm */
391 	0x63, 0x15, 0xc5,		/* -66dbm */
392 };
393 
394 static struct urtw_pair urtw_8225v2_rf_part1[] = {
395 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
396 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
397 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
398 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
399 };
400 
401 static struct urtw_pair urtw_8225v2_rf_part2[] = {
402 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
403 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
404 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
405 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
406 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
407 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
408 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
409 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
410 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
411 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
412 };
413 
414 static struct urtw_pair urtw_8225v2_rf_part3[] = {
415 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
416 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
417 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
418 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
419 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
420 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
421 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
422 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
423 };
424 
425 static uint16_t urtw_8225v2_rxgain[] = {
426 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
427 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
428 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
429 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
430 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
431 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
432 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
433 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
434 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
435 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
436 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
437 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
438 };
439 
440 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
441 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
442 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
443 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
444 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
445 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
446 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
447 };
448 
449 static uint8_t urtw_8225v2_txpwr_cck[] = {
450 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
451 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
452 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
453 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
454 };
455 
456 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
457 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
458 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
459 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
460 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
461 };
462 
463 static struct urtw_pair urtw_8225v2_b_rf[] = {
464 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
465 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
466 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
467 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
468 	{ 0x00, 0x01b7 }
469 };
470 
471 static struct urtw_pair urtw_ratetable[] = {
472 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
473 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
474 	{ 96, 10 }, { 108, 11 }
475 };
476 
477 int		urtw_init(struct ifnet *);
478 void		urtw_stop(struct ifnet *, int);
479 int		urtw_ioctl(struct ifnet *, u_long, void *);
480 void		urtw_start(struct ifnet *);
481 int		urtw_alloc_rx_data_list(struct urtw_softc *);
482 void		urtw_free_rx_data_list(struct urtw_softc *);
483 int		urtw_alloc_tx_data_list(struct urtw_softc *);
484 void		urtw_free_tx_data_list(struct urtw_softc *);
485 void		urtw_rxeof(struct usbd_xfer *, void *,
486 		    usbd_status);
487 int		urtw_tx_start(struct urtw_softc *,
488 		    struct ieee80211_node *, struct mbuf *, int);
489 void		urtw_txeof_low(struct usbd_xfer *, void *,
490 		    usbd_status);
491 void		urtw_txeof_normal(struct usbd_xfer *, void *,
492 		    usbd_status);
493 void		urtw_next_scan(void *);
494 void		urtw_task(void *);
495 void		urtw_ledusbtask(void *);
496 void		urtw_ledtask(void *);
497 int		urtw_media_change(struct ifnet *);
498 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
499 void		urtw_watchdog(struct ifnet *);
500 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
501 int		urtw_isbmode(uint16_t);
502 uint16_t	urtw_rate2rtl(int);
503 uint16_t	urtw_rtl2rate(int);
504 usbd_status	urtw_set_rate(struct urtw_softc *);
505 usbd_status	urtw_update_msr(struct urtw_softc *);
506 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
507 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
508 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
509 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
510 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
511 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
512 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
513 usbd_status	urtw_eprom_ck(struct urtw_softc *);
514 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
515 		    int);
516 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
517 		    uint32_t *);
518 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
519 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
520 usbd_status	urtw_get_macaddr(struct urtw_softc *);
521 usbd_status	urtw_get_txpwr(struct urtw_softc *);
522 usbd_status	urtw_get_rfchip(struct urtw_softc *);
523 usbd_status	urtw_led_init(struct urtw_softc *);
524 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
525 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
526 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
527 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
528 		    uint32_t);
529 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
530 		    uint32_t);
531 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
532 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
533 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
534 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
535 		    uint16_t);
536 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
537 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
538 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
539 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
540 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
541 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
542 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
543 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
544 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
545 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
546 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
547 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
548 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
549 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
550 usbd_status	urtw_open_pipes(struct urtw_softc *);
551 usbd_status	urtw_close_pipes(struct urtw_softc *);
552 usbd_status	urtw_intr_enable(struct urtw_softc *);
553 usbd_status	urtw_intr_disable(struct urtw_softc *);
554 usbd_status	urtw_reset(struct urtw_softc *);
555 usbd_status	urtw_led_on(struct urtw_softc *, int);
556 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
557 usbd_status	urtw_led_blink(struct urtw_softc *);
558 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
559 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
560 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
561 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
562 usbd_status	urtw_rx_setconf(struct urtw_softc *);
563 usbd_status	urtw_rx_enable(struct urtw_softc *);
564 usbd_status	urtw_tx_enable(struct urtw_softc *);
565 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
566 usbd_status	urtw_8187b_reset(struct urtw_softc *);
567 int		urtw_8187b_init(struct ifnet *);
568 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
569 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
570 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
571 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
572 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
573 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
574 int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
575 int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
576 
577 int urtw_match(device_t, cfdata_t, void *);
578 void urtw_attach(device_t, device_t, void *);
579 int urtw_detach(device_t, int);
580 int urtw_activate(device_t, enum devact);
581 
582 CFATTACH_DECL_NEW(urtw, sizeof(struct urtw_softc),
583 	urtw_match,
584 	urtw_attach,
585 	urtw_detach,
586 	urtw_activate
587 );
588 
589 int
590 urtw_match(device_t parent, cfdata_t match, void *aux)
591 {
592 	struct usb_attach_arg *uaa = aux;
593 
594 	return urtw_lookup(uaa->uaa_vendor, uaa->uaa_product) != NULL ?
595 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
596 }
597 
598 void
599 urtw_attach(device_t parent, device_t self, void *aux)
600 {
601 	struct urtw_softc *sc = device_private(self);
602 	struct usb_attach_arg *uaa = aux;
603 	struct ieee80211com *ic = &sc->sc_ic;
604 	struct ifnet *ifp = &sc->sc_if;
605 	usbd_status error;
606 	uint8_t data8;
607 	uint32_t data;
608 	int i;
609 
610 	sc->sc_dev = self;
611 	sc->sc_udev = uaa->uaa_device;
612 	sc->sc_hwrev = urtw_lookup(uaa->uaa_vendor, uaa->uaa_product)->rev;
613 
614 	printf(": ");
615 
616 	if (sc->sc_hwrev & URTW_HWREV_8187) {
617 		urtw_read32_m(sc, URTW_TX_CONF, &data);
618 		data &= URTW_TX_HWREV_MASK;
619 		switch (data) {
620 		case URTW_TX_HWREV_8187_D:
621 			sc->sc_hwrev |= URTW_HWREV_8187_D;
622 			printf("RTL8187 rev D");
623 			break;
624 		case URTW_TX_HWREV_8187B_D:
625 			/*
626 			 * Detect Realtek RTL8187B devices that use
627 			 * USB IDs of RTL8187.
628 			 */
629 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
630 			printf("RTL8187B rev B (early)");
631 			break;
632 		default:
633 			sc->sc_hwrev |= URTW_HWREV_8187_B;
634 			printf("RTL8187 rev 0x%02x", data >> 25);
635 			break;
636 		}
637 	} else {
638 		/* RTL8187B hwrev register. */
639 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
640 		switch (data8) {
641 		case URTW_8187B_HWREV_8187B_B:
642 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
643 			printf("RTL8187B rev B");
644 			break;
645 		case URTW_8187B_HWREV_8187B_D:
646 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
647 			printf("RTL8187B rev D");
648 			break;
649 		case URTW_8187B_HWREV_8187B_E:
650 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
651 			printf("RTL8187B rev E");
652 			break;
653 		default:
654 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
655 			printf("RTL8187B rev 0x%02x", data8);
656 			break;
657 		}
658 	}
659 
660 	urtw_read32_m(sc, URTW_RX, &data);
661 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
662 	    URTW_EEPROM_93C46;
663 
664 	error = urtw_get_rfchip(sc);
665 	if (error != 0)
666 		goto fail;
667 	error = urtw_get_macaddr(sc);
668 	if (error != 0)
669 		goto fail;
670 	error = urtw_get_txpwr(sc);
671 	if (error != 0)
672 		goto fail;
673 	error = urtw_led_init(sc);		/* XXX incompleted */
674 	if (error != 0)
675 		goto fail;
676 
677 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
678 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
679 	sc->sc_currate = 3;
680 	/* XXX for what? */
681 	sc->sc_preamble_mode = 2;
682 
683 	usb_init_task(&sc->sc_task, urtw_task, sc, 0);
684 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc, 0);
685 	callout_init(&sc->scan_to, 0);
686 	callout_setfunc(&sc->scan_to, urtw_next_scan, sc);
687 	callout_init(&sc->sc_led_ch, 0);
688 	callout_setfunc(&sc->sc_led_ch, urtw_ledtask, sc);
689 
690 	ic->ic_ifp = ifp;
691 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
692 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
693 	ic->ic_state = IEEE80211_S_INIT;
694 
695 	/* set device capabilities */
696 	ic->ic_caps =
697 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
698 	    IEEE80211_C_TXPMGT |	/* tx power management */
699 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
700 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
701 	    IEEE80211_C_WEP |		/* s/w WEP */
702 	    IEEE80211_C_WPA;		/* WPA/RSN */
703 
704 	/* set supported .11b and .11g rates */
705 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
706 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
707 
708 	/* set supported .11b and .11g channels (1 through 14) */
709 	for (i = 1; i <= 14; i++) {
710 		ic->ic_channels[i].ic_freq =
711 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
712 		ic->ic_channels[i].ic_flags =
713 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
714 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
715 	}
716 
717 	ifp->if_softc = sc;
718 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
719 	if (sc->sc_hwrev & URTW_HWREV_8187) {
720 		ifp->if_init = urtw_init;
721 	} else {
722 		ifp->if_init = urtw_8187b_init;
723 	}
724 	ifp->if_ioctl = urtw_ioctl;
725 	ifp->if_start = urtw_start;
726 	ifp->if_watchdog = urtw_watchdog;
727 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
728 	IFQ_SET_READY(&ifp->if_snd);
729 	memcpy(ifp->if_xname, device_xname(self), IFNAMSIZ);
730 
731 	if_attach(ifp);
732 	ieee80211_ifattach(ic);
733 
734 	/* override state transition machine */
735 	sc->sc_newstate = ic->ic_newstate;
736 	ic->ic_newstate = urtw_newstate;
737 	ieee80211_media_init(ic, urtw_media_change, ieee80211_media_status);
738 
739 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
740 	    sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
741 	    &sc->sc_drvbpf);
742 
743 	sc->sc_rxtap_len = sizeof(sc->sc_rxtapu);
744 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
745 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
746 
747 	sc->sc_txtap_len = sizeof(sc->sc_txtapu);
748 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
749 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
750 
751 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
752 
753 	ieee80211_announce(ic);
754 
755 	return;
756 fail:
757 	printf(": %s failed!\n", __func__);
758 	sc->sc_dying = true;
759 }
760 
761 int
762 urtw_detach(device_t self, int flags)
763 {
764 	struct urtw_softc *sc = device_private(self);
765 	struct ifnet *ifp = &sc->sc_if;
766 	int s;
767 
768 	s = splusb();
769 
770 	sc->sc_dying = true;
771 
772 	callout_destroy(&sc->scan_to);
773 	callout_destroy(&sc->sc_led_ch);
774 
775 	usb_rem_task(sc->sc_udev, &sc->sc_task);
776 	usb_rem_task(sc->sc_udev, &sc->sc_ledtask);
777 
778 	if (ifp->if_softc != NULL) {
779 		bpf_detach(ifp);
780 		ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
781 		if_detach(ifp);
782 	}
783 
784 	/* abort and free xfers */
785 	urtw_free_tx_data_list(sc);
786 	urtw_free_rx_data_list(sc);
787 	urtw_close_pipes(sc);
788 
789 	splx(s);
790 
791 	return 0;
792 }
793 
794 int
795 urtw_activate(device_t self, enum devact act)
796 {
797 	struct urtw_softc *sc = device_private(self);
798 
799 	switch (act) {
800 	case DVACT_DEACTIVATE:
801 		sc->sc_dying = true;
802 		break;
803 	}
804 
805 	return 0;
806 }
807 
808 usbd_status
809 urtw_close_pipes(struct urtw_softc *sc)
810 {
811 	usbd_status error = 0;
812 
813 	if (sc->sc_rxpipe != NULL) {
814 		error = usbd_close_pipe(sc->sc_rxpipe);
815 		if (error != 0)
816 			goto fail;
817 		sc->sc_rxpipe = NULL;
818 	}
819 	if (sc->sc_txpipe_low != NULL) {
820 		error = usbd_close_pipe(sc->sc_txpipe_low);
821 		if (error != 0)
822 			goto fail;
823 		sc->sc_txpipe_low = NULL;
824 	}
825 	if (sc->sc_txpipe_normal != NULL) {
826 		error = usbd_close_pipe(sc->sc_txpipe_normal);
827 		if (error != 0)
828 			goto fail;
829 		sc->sc_txpipe_normal = NULL;
830 	}
831 fail:
832 	return error;
833 }
834 
835 usbd_status
836 urtw_open_pipes(struct urtw_softc *sc)
837 {
838 	usbd_status error;
839 
840 	/*
841 	 * NB: there is no way to distinguish each pipes so we need to hardcode
842 	 * pipe numbers
843 	 */
844 
845 	/* tx pipe - low priority packets */
846 	if (sc->sc_hwrev & URTW_HWREV_8187)
847 		error = usbd_open_pipe(sc->sc_iface, 0x2,
848 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
849 	else
850 		error = usbd_open_pipe(sc->sc_iface, 0x6,
851 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
852 	if (error != 0) {
853 		printf("%s: could not open Tx low pipe: %s\n",
854 		    device_xname(sc->sc_dev), usbd_errstr(error));
855 		goto fail;
856 	}
857 	/* tx pipe - normal priority packets */
858 	if (sc->sc_hwrev & URTW_HWREV_8187)
859 		error = usbd_open_pipe(sc->sc_iface, 0x3,
860 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
861 	else
862 		error = usbd_open_pipe(sc->sc_iface, 0x7,
863 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
864 	if (error != 0) {
865 		printf("%s: could not open Tx normal pipe: %s\n",
866 		    device_xname(sc->sc_dev), usbd_errstr(error));
867 		goto fail;
868 	}
869 	/* rx pipe */
870 	if (sc->sc_hwrev & URTW_HWREV_8187)
871 		error = usbd_open_pipe(sc->sc_iface, 0x81,
872 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
873 	else
874 		error = usbd_open_pipe(sc->sc_iface, 0x83,
875 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
876 	if (error != 0) {
877 		printf("%s: could not open Rx pipe: %s\n",
878 		    device_xname(sc->sc_dev), usbd_errstr(error));
879 		goto fail;
880 	}
881 
882 	return 0;
883 fail:
884 	(void)urtw_close_pipes(sc);
885 	return error;
886 }
887 
888 int
889 urtw_alloc_rx_data_list(struct urtw_softc *sc)
890 {
891 	int i, error;
892 
893 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
894 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
895 
896 		data->sc = sc;
897 
898 		error = usbd_create_xfer(sc->sc_rxpipe, MCLBYTES,
899 		    USBD_SHORT_XFER_OK, 0, &data->xfer);
900 		if (error) {
901 
902 			printf("%s: could not allocate rx xfer\n",
903 			    device_xname(sc->sc_dev));
904 			error = ENOMEM;
905 			goto fail;
906 		}
907 
908 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
909 		if (data->m == NULL) {
910 			printf("%s: could not allocate rx mbuf\n",
911 			    device_xname(sc->sc_dev));
912 			error = ENOMEM;
913 			goto fail;
914 		}
915 		MCLGET(data->m, M_DONTWAIT);
916 		if (!(data->m->m_flags & M_EXT)) {
917 			printf("%s: could not allocate rx mbuf cluster\n",
918 			    device_xname(sc->sc_dev));
919 			error = ENOMEM;
920 			goto fail;
921 		}
922 		data->buf = mtod(data->m, uint8_t *);
923 	}
924 
925 	return 0;
926 
927 fail:
928 	urtw_free_rx_data_list(sc);
929 	return error;
930 }
931 
932 void
933 urtw_free_rx_data_list(struct urtw_softc *sc)
934 {
935 	int i;
936 
937 	/* Make sure no transfers are pending. */
938 	if (sc->sc_rxpipe != NULL)
939 		usbd_abort_pipe(sc->sc_rxpipe);
940 
941 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
942 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
943 
944 		if (data->xfer != NULL) {
945 			usbd_destroy_xfer(data->xfer);
946 			data->xfer = NULL;
947 		}
948 		if (data->m != NULL) {
949 			m_freem(data->m);
950 			data->m = NULL;
951 		}
952 	}
953 }
954 
955 int
956 urtw_alloc_tx_data_list(struct urtw_softc *sc)
957 {
958 	int i, error;
959 
960 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
961 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
962 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
963 
964 			data->sc = sc;
965 			data->ni = NULL;
966 
967 			error = usbd_create_xfer((j == URTW_PRIORITY_LOW) ?
968 			    sc->sc_txpipe_low : sc->sc_txpipe_normal,
969 			    URTW_TX_MAXSIZE, USBD_FORCE_SHORT_XFER, 0,
970 			    &data->xfer);
971 			if (error) {
972 				printf("%s: could not allocate tx xfer\n",
973 				    device_xname(sc->sc_dev));
974 				goto fail;
975 			}
976 
977 			data->buf = usbd_get_buffer(data->xfer);
978 
979 			if (((unsigned long)data->buf) % 4)
980 				printf("%s: warn: unaligned buffer %p\n",
981 				    device_xname(sc->sc_dev), data->buf);
982 		}
983 	}
984 
985 	return 0;
986 
987 fail:
988 	urtw_free_tx_data_list(sc);
989 	return error;
990 }
991 
992 void
993 urtw_free_tx_data_list(struct urtw_softc *sc)
994 {
995 	int i;
996 
997 	/* Make sure no transfers are pending. */
998 	if (sc->sc_txpipe_low != NULL)
999 		usbd_abort_pipe(sc->sc_txpipe_low);
1000 	if (sc->sc_txpipe_normal != NULL)
1001 		usbd_abort_pipe(sc->sc_txpipe_normal);
1002 
1003 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
1004 		for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1005 			struct urtw_tx_data *data = &sc->sc_tx_data[j][i];
1006 
1007 			if (data->xfer != NULL) {
1008 				usbd_destroy_xfer(data->xfer);
1009 				data->xfer = NULL;
1010 			}
1011 			if (data->ni != NULL) {
1012 				ieee80211_free_node(data->ni);
1013 				data->ni = NULL;
1014 			}
1015 		}
1016 	}
1017 }
1018 
1019 int
1020 urtw_media_change(struct ifnet *ifp)
1021 {
1022 	int error;
1023 
1024 	error = ieee80211_media_change(ifp);
1025 	if (error != ENETRESET)
1026 		return error;
1027 
1028 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1029 	    (IFF_UP | IFF_RUNNING))
1030 		ifp->if_init(ifp);
1031 
1032 	return 0;
1033 }
1034 
1035 int
1036 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1037 {
1038 	struct urtw_softc *sc = ic->ic_ifp->if_softc;
1039 
1040 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1041 	callout_stop(&sc->scan_to);
1042 
1043 	/* do it in a process context */
1044 	sc->sc_state = nstate;
1045 	sc->sc_arg = arg;
1046 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
1047 
1048 	return 0;
1049 }
1050 
1051 usbd_status
1052 urtw_led_init(struct urtw_softc *sc)
1053 {
1054 	uint32_t rev;
1055 	usbd_status error;
1056 
1057 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1058 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1059 	if (error != 0)
1060 		goto fail;
1061 
1062 	switch (rev & URTW_EPROM_CID_MASK) {
1063 	case URTW_EPROM_CID_ALPHA0:
1064 		sc->sc_strategy = URTW_SW_LED_MODE1;
1065 		break;
1066 	case URTW_EPROM_CID_SERCOMM_PS:
1067 		sc->sc_strategy = URTW_SW_LED_MODE3;
1068 		break;
1069 	case URTW_EPROM_CID_HW_LED:
1070 		sc->sc_strategy = URTW_HW_LED;
1071 		break;
1072 	case URTW_EPROM_CID_RSVD0:
1073 	case URTW_EPROM_CID_RSVD1:
1074 	default:
1075 		sc->sc_strategy = URTW_SW_LED_MODE0;
1076 		break;
1077 	}
1078 
1079 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1080 
1081 fail:
1082 	return error;
1083 }
1084 
1085 usbd_status
1086 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1087     uint16_t data)
1088 {
1089 	usb_device_request_t req;
1090 
1091 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1092 	req.bRequest = URTW_8187_SETREGS_REQ;
1093 	USETW(req.wValue, addr);
1094 	USETW(req.wIndex, index);
1095 	USETW(req.wLength, sizeof(uint16_t));
1096 
1097 	return usbd_do_request(sc->sc_udev, &req, &data);
1098 }
1099 
1100 usbd_status
1101 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1102 {
1103 	int i;
1104 	int16_t bit;
1105 	uint8_t rlen = 12, wlen = 6;
1106 	uint16_t o1, o2, o3, tmp;
1107 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1108 	uint32_t mask = 0x80000000, value = 0;
1109 	usbd_status error;
1110 
1111 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1112 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1113 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1114 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1115 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1116 	o1 &= ~0xf;
1117 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1118 	DELAY(5);
1119 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1120 	DELAY(5);
1121 
1122 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1123 		bit = ((d2w & mask) != 0) ? 1 : 0;
1124 
1125 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1126 		DELAY(2);
1127 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1128 		    URTW_BB_HOST_BANG_CLK);
1129 		DELAY(2);
1130 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1131 		    URTW_BB_HOST_BANG_CLK);
1132 		DELAY(2);
1133 		mask = mask >> 1;
1134 		if (i == 2)
1135 			break;
1136 		bit = ((d2w & mask) != 0) ? 1 : 0;
1137 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1138 		    URTW_BB_HOST_BANG_CLK);
1139 		DELAY(2);
1140 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1141 		    URTW_BB_HOST_BANG_CLK);
1142 		DELAY(2);
1143 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1144 		DELAY(1);
1145 	}
1146 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1147 	    URTW_BB_HOST_BANG_CLK);
1148 	DELAY(2);
1149 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1150 	DELAY(2);
1151 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1152 	DELAY(2);
1153 
1154 	mask = 0x800;
1155 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1156 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1157 		    o1 | URTW_BB_HOST_BANG_RW);
1158 		DELAY(2);
1159 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1160 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1161 		DELAY(2);
1162 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1163 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1164 		DELAY(2);
1165 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1166 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1167 		DELAY(2);
1168 
1169 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1170 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1171 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1172 		    o1 | URTW_BB_HOST_BANG_RW);
1173 		DELAY(2);
1174 	}
1175 
1176 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1177 	    URTW_BB_HOST_BANG_RW);
1178 	DELAY(2);
1179 
1180 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1181 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1182 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1183 
1184 	if (data != NULL)
1185 		*data = value;
1186 fail:
1187 	return error;
1188 }
1189 
1190 usbd_status
1191 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1192 {
1193 	uint16_t d80, d82, d84;
1194 	usbd_status error;
1195 
1196 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1197 	d80 &= 0xfff3;
1198 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1199 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1200 	d84 &= 0xfff0;
1201 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1202 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1203 	DELAY(10);
1204 
1205 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1206 	DELAY(2);
1207 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1208 	DELAY(10);
1209 
1210 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1211 	if (error != 0)
1212 		goto fail;
1213 
1214 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1215 	DELAY(10);
1216 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1217 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1218 	usbd_delay_ms(sc->sc_udev, 2);
1219 fail:
1220 	return error;
1221 }
1222 
1223 usbd_status
1224 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1225 {
1226 	uint32_t data;
1227 	usbd_status error;
1228 
1229 	*ret = 1;
1230 
1231 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1232 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1233 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1234 	usbd_delay_ms(sc->sc_udev, 500);
1235 
1236 	urtw_8225_write(sc, 0x0, 0x1b7);
1237 
1238 	error = urtw_8225_read(sc, 0x8, &data);
1239 	if (error != 0)
1240 		goto fail;
1241 	if (data != 0x588)
1242 		*ret = 0;
1243 	else {
1244 		error = urtw_8225_read(sc, 0x9, &data);
1245 		if (error != 0)
1246 			goto fail;
1247 		if (data != 0x700)
1248 			*ret = 0;
1249 	}
1250 
1251 	urtw_8225_write(sc, 0x0, 0xb7);
1252 fail:
1253 	return error;
1254 }
1255 
1256 usbd_status
1257 urtw_get_rfchip(struct urtw_softc *sc)
1258 {
1259 	struct urtw_rf *rf = &sc->sc_rf;
1260 	int ret;
1261 	uint32_t data;
1262 	usbd_status error;
1263 
1264 	rf->rf_sc = sc;
1265 
1266 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1267 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1268 		if (error != 0)
1269 			panic("unsupported RF chip");
1270 			/* NOTREACHED */
1271 		switch (data & 0xff) {
1272 		case URTW_EPROM_RFCHIPID_RTL8225U:
1273 			error = urtw_8225_isv2(sc, &ret);
1274 			if (error != 0)
1275 				goto fail;
1276 			if (ret == 0) {
1277 				rf->init = urtw_8225_rf_init;
1278 				rf->set_chan = urtw_8225_rf_set_chan;
1279 				rf->set_sens = urtw_8225_rf_set_sens;
1280 				printf(", RFv1");
1281 			} else {
1282 				rf->init = urtw_8225v2_rf_init;
1283 				rf->set_chan = urtw_8225v2_rf_set_chan;
1284 				rf->set_sens = NULL;
1285 				printf(", RFv2");
1286 			}
1287 			break;
1288 		default:
1289 			goto fail;
1290 		}
1291 	} else {
1292 		rf->init = urtw_8225v2_b_rf_init;
1293 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1294 		rf->set_sens = NULL;
1295 	}
1296 
1297 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1298 	rf->sens = URTW_8225_RF_DEF_SENS;
1299 
1300 	return 0;
1301 
1302 fail:
1303 	panic("unsupported RF chip %d", data & 0xff);
1304 	/* NOTREACHED */
1305 }
1306 
1307 usbd_status
1308 urtw_get_txpwr(struct urtw_softc *sc)
1309 {
1310 	int i, j;
1311 	uint32_t data;
1312 	usbd_status error;
1313 
1314 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1315 	if (error != 0)
1316 		goto fail;
1317 	sc->sc_txpwr_cck_base = data & 0xf;
1318 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1319 
1320 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1321 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1322 		if (error != 0)
1323 			goto fail;
1324 		sc->sc_txpwr_cck[i] = data & 0xf;
1325 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1326 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1327 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1328 	}
1329 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1330 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1331 		if (error != 0)
1332 			goto fail;
1333 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1334 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1335 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1336 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1337 	}
1338 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1339 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1340 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1341 			    &data);
1342 			if (error != 0)
1343 				goto fail;
1344 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1345 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1346 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1347 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1348 			    (data & 0xf000) >> 12;
1349 		}
1350 	} else {
1351 		/* Channel 11. */
1352 		error = urtw_eprom_read32(sc, 0x1b, &data);
1353 		if (error != 0)
1354 			goto fail;
1355 		sc->sc_txpwr_cck[11] = data & 0xf;
1356 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1357 
1358 		/* Channel 12. */
1359 		error = urtw_eprom_read32(sc, 0xa, &data);
1360 		if (error != 0)
1361 			goto fail;
1362 		sc->sc_txpwr_cck[12] = data & 0xf;
1363 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1364 
1365 		/* Channel 13, 14. */
1366 		error = urtw_eprom_read32(sc, 0x1c, &data);
1367 		if (error != 0)
1368 			goto fail;
1369 		sc->sc_txpwr_cck[13] = data & 0xf;
1370 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1371 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1372 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1373 	}
1374 fail:
1375 	return error;
1376 }
1377 
1378 usbd_status
1379 urtw_get_macaddr(struct urtw_softc *sc)
1380 {
1381 	struct ieee80211com *ic = &sc->sc_ic;
1382 	usbd_status error;
1383 	uint32_t data;
1384 
1385 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1386 	if (error != 0)
1387 		goto fail;
1388 	ic->ic_myaddr[0] = data & 0xff;
1389 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1390 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1391 	if (error != 0)
1392 		goto fail;
1393 	ic->ic_myaddr[2] = data & 0xff;
1394 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1395 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1396 	if (error != 0)
1397 		goto fail;
1398 	ic->ic_myaddr[4] = data & 0xff;
1399 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1400 fail:
1401 	return error;
1402 }
1403 
1404 usbd_status
1405 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1406 {
1407 #define URTW_READCMD_LEN		3
1408 	int addrlen, i;
1409 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1410 	usbd_status error;
1411 
1412 	/* NB: make sure the buffer is initialized */
1413 	*data = 0;
1414 
1415 	/* enable EPROM programming */
1416 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1417 	DELAY(URTW_EPROM_DELAY);
1418 
1419 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1420 	if (error != 0)
1421 		goto fail;
1422 	error = urtw_eprom_ck(sc);
1423 	if (error != 0)
1424 		goto fail;
1425 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1426 	if (error != 0)
1427 		goto fail;
1428 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1429 		addrlen = 8;
1430 		addrstr[0] = addr & (1 << 7);
1431 		addrstr[1] = addr & (1 << 6);
1432 		addrstr[2] = addr & (1 << 5);
1433 		addrstr[3] = addr & (1 << 4);
1434 		addrstr[4] = addr & (1 << 3);
1435 		addrstr[5] = addr & (1 << 2);
1436 		addrstr[6] = addr & (1 << 1);
1437 		addrstr[7] = addr & (1 << 0);
1438 	} else {
1439 		addrlen=6;
1440 		addrstr[0] = addr & (1 << 5);
1441 		addrstr[1] = addr & (1 << 4);
1442 		addrstr[2] = addr & (1 << 3);
1443 		addrstr[3] = addr & (1 << 2);
1444 		addrstr[4] = addr & (1 << 1);
1445 		addrstr[5] = addr & (1 << 0);
1446 	}
1447 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1448 	if (error != 0)
1449 		goto fail;
1450 
1451 	error = urtw_eprom_writebit(sc, 0);
1452 	if (error != 0)
1453 		goto fail;
1454 
1455 	for (i = 0; i < 16; i++) {
1456 		error = urtw_eprom_ck(sc);
1457 		if (error != 0)
1458 			goto fail;
1459 		error = urtw_eprom_readbit(sc, &data16);
1460 		if (error != 0)
1461 			goto fail;
1462 
1463 		(*data) |= (data16 << (15 - i));
1464 	}
1465 
1466 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1467 	if (error != 0)
1468 		goto fail;
1469 	error = urtw_eprom_ck(sc);
1470 	if (error != 0)
1471 		goto fail;
1472 
1473 	/* now disable EPROM programming */
1474 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1475 fail:
1476 	return error;
1477 #undef URTW_READCMD_LEN
1478 }
1479 
1480 usbd_status
1481 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1482 {
1483 	uint8_t data8;
1484 	usbd_status error;
1485 
1486 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1487 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1488 	DELAY(URTW_EPROM_DELAY);
1489 
1490 fail:
1491 	return error;
1492 }
1493 
1494 usbd_status
1495 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1496 {
1497 	int i = 0;
1498 	usbd_status error = 0;
1499 
1500 	for (i = 0; i < buflen; i++) {
1501 		error = urtw_eprom_writebit(sc, buf[i]);
1502 		if (error != 0)
1503 			goto fail;
1504 		error = urtw_eprom_ck(sc);
1505 		if (error != 0)
1506 			goto fail;
1507 	}
1508 fail:
1509 	return error;
1510 }
1511 
1512 usbd_status
1513 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1514 {
1515 	uint8_t data;
1516 	usbd_status error;
1517 
1518 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1519 	if (bit != 0)
1520 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1521 	else
1522 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1523 	DELAY(URTW_EPROM_DELAY);
1524 fail:
1525 	return error;
1526 }
1527 
1528 usbd_status
1529 urtw_eprom_ck(struct urtw_softc *sc)
1530 {
1531 	uint8_t data;
1532 	usbd_status error;
1533 
1534 	/* masking */
1535 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1536 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1537 	DELAY(URTW_EPROM_DELAY);
1538 	/* unmasking */
1539 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1540 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1541 	DELAY(URTW_EPROM_DELAY);
1542 fail:
1543 	return error;
1544 }
1545 
1546 usbd_status
1547 urtw_eprom_cs(struct urtw_softc *sc, int able)
1548 {
1549 	uint8_t data;
1550 	usbd_status error;
1551 
1552 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1553 	if (able == URTW_EPROM_ENABLE)
1554 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1555 	else
1556 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1557 	DELAY(URTW_EPROM_DELAY);
1558 fail:
1559 	return error;
1560 }
1561 
1562 usbd_status
1563 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1564 {
1565 	usb_device_request_t req;
1566 	usbd_status error;
1567 
1568 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1569 	req.bRequest = URTW_8187_GETREGS_REQ;
1570 	USETW(req.wValue, val | 0xff00);
1571 	USETW(req.wIndex, idx & 0x03);
1572 	USETW(req.wLength, sizeof(uint8_t));
1573 
1574 	error = usbd_do_request(sc->sc_udev, &req, data);
1575 	return error;
1576 }
1577 
1578 usbd_status
1579 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1580 {
1581 	usb_device_request_t req;
1582 	usbd_status error;
1583 
1584 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1585 	req.bRequest = URTW_8187_GETREGS_REQ;
1586 	USETW(req.wValue, val | 0xfe00);
1587 	USETW(req.wIndex, 0);
1588 	USETW(req.wLength, sizeof(uint8_t));
1589 
1590 	error = usbd_do_request(sc->sc_udev, &req, data);
1591 	return error;
1592 }
1593 
1594 usbd_status
1595 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1596 {
1597 	usb_device_request_t req;
1598 	usbd_status error;
1599 
1600 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1601 	req.bRequest = URTW_8187_GETREGS_REQ;
1602 	USETW(req.wValue, val | 0xff00);
1603 	USETW(req.wIndex, idx & 0x03);
1604 	USETW(req.wLength, sizeof(uint16_t));
1605 
1606 	error = usbd_do_request(sc->sc_udev, &req, data);
1607 	return error;
1608 }
1609 
1610 usbd_status
1611 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1612 {
1613 	usb_device_request_t req;
1614 	usbd_status error;
1615 
1616 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1617 	req.bRequest = URTW_8187_GETREGS_REQ;
1618 	USETW(req.wValue, val | 0xff00);
1619 	USETW(req.wIndex, idx & 0x03);
1620 	USETW(req.wLength, sizeof(uint32_t));
1621 
1622 	error = usbd_do_request(sc->sc_udev, &req, data);
1623 	return error;
1624 }
1625 
1626 usbd_status
1627 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1628 {
1629 	usb_device_request_t req;
1630 
1631 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1632 	req.bRequest = URTW_8187_SETREGS_REQ;
1633 	USETW(req.wValue, val | 0xff00);
1634 	USETW(req.wIndex, idx & 0x03);
1635 	USETW(req.wLength, sizeof(uint8_t));
1636 
1637 	return usbd_do_request(sc->sc_udev, &req, &data);
1638 }
1639 
1640 usbd_status
1641 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1642 {
1643 	usb_device_request_t req;
1644 
1645 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1646 	req.bRequest = URTW_8187_SETREGS_REQ;
1647 	USETW(req.wValue, val | 0xfe00);
1648 	USETW(req.wIndex, 0);
1649 	USETW(req.wLength, sizeof(uint8_t));
1650 
1651 	return usbd_do_request(sc->sc_udev, &req, &data);
1652 }
1653 
1654 usbd_status
1655 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1656 {
1657 	usb_device_request_t req;
1658 
1659 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1660 	req.bRequest = URTW_8187_SETREGS_REQ;
1661 	USETW(req.wValue, val | 0xff00);
1662 	USETW(req.wIndex, idx & 0x03);
1663 	USETW(req.wLength, sizeof(uint16_t));
1664 
1665 	return usbd_do_request(sc->sc_udev, &req, &data);
1666 }
1667 
1668 usbd_status
1669 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1670 {
1671 	usb_device_request_t req;
1672 
1673 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1674 	req.bRequest = URTW_8187_SETREGS_REQ;
1675 	USETW(req.wValue, val | 0xff00);
1676 	USETW(req.wIndex, idx & 0x03);
1677 	USETW(req.wLength, sizeof(uint32_t));
1678 
1679 	return usbd_do_request(sc->sc_udev, &req, &data);
1680 }
1681 
1682 static usbd_status
1683 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1684 {
1685 	uint8_t data;
1686 	usbd_status error;
1687 
1688 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1689 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1690 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1691 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1692 fail:
1693 	return error;
1694 }
1695 
1696 usbd_status
1697 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1698 {
1699 	uint8_t data;
1700 	usbd_status error;
1701 
1702 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1703 	if (error)
1704 		goto fail;
1705 
1706 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1707 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1708 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1709 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1710 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1711 
1712 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1713 	if (error)
1714 		goto fail;
1715 fail:
1716 	return error;
1717 }
1718 
1719 usbd_status
1720 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1721 {
1722 	uint8_t data;
1723 	usbd_status error;
1724 
1725 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1726 	if (error)
1727 		goto fail;
1728 
1729 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1730 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1731 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1732 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1733 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1734 
1735 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1736 	if (error)
1737 		goto fail;
1738 fail:
1739 	return error;
1740 }
1741 
1742 usbd_status
1743 urtw_intr_disable(struct urtw_softc *sc)
1744 {
1745 	usbd_status error;
1746 
1747 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1748 
1749 fail:
1750 	return error;
1751 }
1752 
1753 usbd_status
1754 urtw_reset(struct urtw_softc *sc)
1755 {
1756 	uint8_t data;
1757 	usbd_status error;
1758 
1759 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1760 	if (error)
1761 		goto fail;
1762 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1763 	if (error)
1764 		goto fail;
1765 
1766 	error = urtw_intr_disable(sc);
1767 	if (error)
1768 		goto fail;
1769 	usbd_delay_ms(sc->sc_udev, 100);
1770 
1771 	error = urtw_write8e(sc, 0x18, 0x10);
1772 	if (error != 0)
1773 		goto fail;
1774 	error = urtw_write8e(sc, 0x18, 0x11);
1775 	if (error != 0)
1776 		goto fail;
1777 	error = urtw_write8e(sc, 0x18, 0x00);
1778 	if (error != 0)
1779 		goto fail;
1780 	usbd_delay_ms(sc->sc_udev, 100);
1781 
1782 	urtw_read8_m(sc, URTW_CMD, &data);
1783 	data = (data & 2) | URTW_CMD_RST;
1784 	urtw_write8_m(sc, URTW_CMD, data);
1785 	usbd_delay_ms(sc->sc_udev, 100);
1786 
1787 	urtw_read8_m(sc, URTW_CMD, &data);
1788 	if (data & URTW_CMD_RST) {
1789 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
1790 		goto fail;
1791 	}
1792 
1793 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1794 	if (error)
1795 		goto fail;
1796 	usbd_delay_ms(sc->sc_udev, 100);
1797 
1798 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1799 	if (error)
1800 		goto fail;
1801 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1802 	if (error)
1803 		goto fail;
1804 fail:
1805 	return error;
1806 }
1807 
1808 usbd_status
1809 urtw_led_on(struct urtw_softc *sc, int type)
1810 {
1811 	usbd_status error;
1812 
1813 	if (type == URTW_LED_GPIO) {
1814 		switch (sc->sc_gpio_ledpin) {
1815 		case URTW_LED_PIN_GPIO0:
1816 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1817 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1818 			break;
1819 		default:
1820 			panic("unsupported LED PIN type 0x%x",
1821 			    sc->sc_gpio_ledpin);
1822 			/* NOTREACHED */
1823 		}
1824 	} else {
1825 		panic("unsupported LED type 0x%x", type);
1826 		/* NOTREACHED */
1827 	}
1828 
1829 	sc->sc_gpio_ledon = 1;
1830 fail:
1831 	return error;
1832 }
1833 
1834 static usbd_status
1835 urtw_led_off(struct urtw_softc *sc, int type)
1836 {
1837 	usbd_status error;
1838 
1839 	if (type == URTW_LED_GPIO) {
1840 		switch (sc->sc_gpio_ledpin) {
1841 		case URTW_LED_PIN_GPIO0:
1842 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1843 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1844 			break;
1845 		default:
1846 			panic("unsupported LED PIN type 0x%x",
1847 			    sc->sc_gpio_ledpin);
1848 			/* NOTREACHED */
1849 		}
1850 	} else {
1851 		panic("unsupported LED type 0x%x", type);
1852 		/* NOTREACHED */
1853 	}
1854 
1855 	sc->sc_gpio_ledon = 0;
1856 
1857 fail:
1858 	return error;
1859 }
1860 
1861 usbd_status
1862 urtw_led_mode0(struct urtw_softc *sc, int mode)
1863 {
1864 	switch (mode) {
1865 	case URTW_LED_CTL_POWER_ON:
1866 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1867 		break;
1868 	case URTW_LED_CTL_TX:
1869 		if (sc->sc_gpio_ledinprogress == 1)
1870 			return 0;
1871 
1872 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1873 		sc->sc_gpio_blinktime = 2;
1874 		break;
1875 	case URTW_LED_CTL_LINK:
1876 		sc->sc_gpio_ledstate = URTW_LED_ON;
1877 		break;
1878 	default:
1879 		panic("unsupported LED mode 0x%x", mode);
1880 		/* NOTREACHED */
1881 	}
1882 
1883 	switch (sc->sc_gpio_ledstate) {
1884 	case URTW_LED_ON:
1885 		if (sc->sc_gpio_ledinprogress != 0)
1886 			break;
1887 		urtw_led_on(sc, URTW_LED_GPIO);
1888 		break;
1889 	case URTW_LED_BLINK_NORMAL:
1890 		if (sc->sc_gpio_ledinprogress != 0)
1891 			break;
1892 		sc->sc_gpio_ledinprogress = 1;
1893 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1894 			URTW_LED_OFF : URTW_LED_ON;
1895 		if (!sc->sc_dying)
1896 			callout_schedule(&sc->sc_led_ch, mstohz(100));
1897 		break;
1898 	case URTW_LED_POWER_ON_BLINK:
1899 		urtw_led_on(sc, URTW_LED_GPIO);
1900 		usbd_delay_ms(sc->sc_udev, 100);
1901 		urtw_led_off(sc, URTW_LED_GPIO);
1902 		break;
1903 	default:
1904 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1905 		/* NOTREACHED */
1906 	}
1907 	return 0;
1908 }
1909 
1910 usbd_status
1911 urtw_led_mode1(struct urtw_softc *sc, int mode)
1912 {
1913 	return USBD_INVAL;
1914 }
1915 
1916 usbd_status
1917 urtw_led_mode2(struct urtw_softc *sc, int mode)
1918 {
1919 	return USBD_INVAL;
1920 }
1921 
1922 usbd_status
1923 urtw_led_mode3(struct urtw_softc *sc, int mode)
1924 {
1925 	return USBD_INVAL;
1926 }
1927 
1928 void
1929 urtw_ledusbtask(void *arg)
1930 {
1931 	struct urtw_softc *sc = arg;
1932 
1933 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1934 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1935 
1936 	urtw_led_blink(sc);
1937 }
1938 
1939 void
1940 urtw_ledtask(void *arg)
1941 {
1942 	struct urtw_softc *sc = arg;
1943 
1944 	/*
1945 	 * NB: to change a status of the led we need at least a sleep so we
1946 	 * can't do it here
1947 	 */
1948 	usb_add_task(sc->sc_udev, &sc->sc_ledtask, USB_TASKQ_DRIVER);
1949 }
1950 
1951 usbd_status
1952 urtw_led_ctl(struct urtw_softc *sc, int mode)
1953 {
1954 	usbd_status error = 0;
1955 
1956 	switch (sc->sc_strategy) {
1957 	case URTW_SW_LED_MODE0:
1958 		error = urtw_led_mode0(sc, mode);
1959 		break;
1960 	case URTW_SW_LED_MODE1:
1961 		error = urtw_led_mode1(sc, mode);
1962 		break;
1963 	case URTW_SW_LED_MODE2:
1964 		error = urtw_led_mode2(sc, mode);
1965 		break;
1966 	case URTW_SW_LED_MODE3:
1967 		error = urtw_led_mode3(sc, mode);
1968 		break;
1969 	default:
1970 		panic("unsupported LED mode %d", sc->sc_strategy);
1971 		/* NOTREACHED */
1972 	}
1973 
1974 	return error;
1975 }
1976 
1977 usbd_status
1978 urtw_led_blink(struct urtw_softc *sc)
1979 {
1980 	uint8_t ing = 0;
1981 
1982 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1983 		(void)urtw_led_on(sc, URTW_LED_GPIO);
1984 	else
1985 		(void)urtw_led_off(sc, URTW_LED_GPIO);
1986 	sc->sc_gpio_blinktime--;
1987 	if (sc->sc_gpio_blinktime == 0)
1988 		ing = 1;
1989 	else {
1990 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
1991 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
1992 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
1993 			ing = 1;
1994 	}
1995 	if (ing == 1) {
1996 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
1997 		    sc->sc_gpio_ledon == 0)
1998 			(void)urtw_led_on(sc, URTW_LED_GPIO);
1999 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2000 		    sc->sc_gpio_ledon == 1)
2001 			(void)urtw_led_off(sc, URTW_LED_GPIO);
2002 
2003 		sc->sc_gpio_blinktime = 0;
2004 		sc->sc_gpio_ledinprogress = 0;
2005 		return 0;
2006 	}
2007 
2008 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2009 	    URTW_LED_ON : URTW_LED_OFF;
2010 
2011 	switch (sc->sc_gpio_ledstate) {
2012 	case URTW_LED_BLINK_NORMAL:
2013 		if (!sc->sc_dying)
2014 			callout_schedule(&sc->sc_led_ch, mstohz(100));
2015 		break;
2016 	default:
2017 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2018 		/* NOTREACHED */
2019 	}
2020 	return 0;
2021 }
2022 
2023 usbd_status
2024 urtw_update_msr(struct urtw_softc *sc)
2025 {
2026 	struct ieee80211com *ic = &sc->sc_ic;
2027 	uint8_t data;
2028 	usbd_status error;
2029 
2030 	urtw_read8_m(sc, URTW_MSR, &data);
2031 	data &= ~URTW_MSR_LINK_MASK;
2032 
2033 	/* Should always be set. */
2034 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2035 		data |= URTW_MSR_LINK_ENEDCA;
2036 
2037 	if (sc->sc_state == IEEE80211_S_RUN) {
2038 		switch (ic->ic_opmode) {
2039 		case IEEE80211_M_STA:
2040 		case IEEE80211_M_MONITOR:
2041 			data |= URTW_MSR_LINK_STA;
2042 			break;
2043 		default:
2044 			panic("unsupported operation mode 0x%x",
2045 			    ic->ic_opmode);
2046 			/* NOTREACHED */
2047 		}
2048 	} else
2049 		data |= URTW_MSR_LINK_NONE;
2050 
2051 	urtw_write8_m(sc, URTW_MSR, data);
2052 fail:
2053 	return error;
2054 }
2055 
2056 uint16_t
2057 urtw_rate2rtl(int rate)
2058 {
2059 	unsigned int i;
2060 
2061 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2062 		if (rate == urtw_ratetable[i].reg)
2063 			return urtw_ratetable[i].val;
2064 	}
2065 
2066 	return 3;
2067 }
2068 
2069 uint16_t
2070 urtw_rtl2rate(int rate)
2071 {
2072 	unsigned int i;
2073 
2074 	for (i = 0; i < __arraycount(urtw_ratetable); i++) {
2075 		if (rate == urtw_ratetable[i].val)
2076 			return urtw_ratetable[i].reg;
2077 	}
2078 
2079 	return 0;
2080 }
2081 
2082 usbd_status
2083 urtw_set_rate(struct urtw_softc *sc)
2084 {
2085 	int i, basic_rate, min_rr_rate, max_rr_rate;
2086 	uint16_t data;
2087 	usbd_status error;
2088 
2089 	basic_rate = urtw_rate2rtl(48);
2090 	min_rr_rate = urtw_rate2rtl(12);
2091 	max_rr_rate = urtw_rate2rtl(48);
2092 
2093 	urtw_write8_m(sc, URTW_RESP_RATE,
2094 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2095 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2096 
2097 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2098 	data &= ~URTW_BRSR_MBR_8185;
2099 
2100 	for (i = 0; i <= basic_rate; i++)
2101 		data |= (1 << i);
2102 
2103 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2104 fail:
2105 	return error;
2106 }
2107 
2108 usbd_status
2109 urtw_intr_enable(struct urtw_softc *sc)
2110 {
2111 	usbd_status error;
2112 
2113 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2114 fail:
2115 	return error;
2116 }
2117 
2118 usbd_status
2119 urtw_rx_setconf(struct urtw_softc *sc)
2120 {
2121 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2122 	struct ieee80211com *ic = &sc->sc_ic;
2123 	uint32_t data;
2124 	usbd_status error;
2125 
2126 	urtw_read32_m(sc, URTW_RX, &data);
2127 	data = data &~ URTW_RX_FILTER_MASK;
2128 #if 0
2129 	data = data | URTW_RX_FILTER_CTL;
2130 #endif
2131 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2132 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2133 
2134 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2135 		data = data | URTW_RX_FILTER_ICVERR;
2136 		data = data | URTW_RX_FILTER_PWR;
2137 	}
2138 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2139 		data = data | URTW_RX_FILTER_CRCERR;
2140 
2141 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2142 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2143 		data = data | URTW_RX_FILTER_ALLMAC;
2144 	} else {
2145 		data = data | URTW_RX_FILTER_NICMAC;
2146 		data = data | URTW_RX_CHECK_BSSID;
2147 	}
2148 
2149 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2150 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2151 	data = data &~ URTW_MAX_RX_DMA_MASK;
2152 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2153 
2154 	urtw_write32_m(sc, URTW_RX, data);
2155 fail:
2156 	return error;
2157 }
2158 
2159 usbd_status
2160 urtw_rx_enable(struct urtw_softc *sc)
2161 {
2162 	int i;
2163 	struct urtw_rx_data *rx_data;
2164 	uint8_t data;
2165 	usbd_status error;
2166 
2167 	/*
2168 	 * Start up the receive pipe.
2169 	 */
2170 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2171 		rx_data = &sc->sc_rx_data[i];
2172 
2173 		usbd_setup_xfer(rx_data->xfer, rx_data, rx_data->buf, MCLBYTES,
2174 		    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2175 		error = usbd_transfer(rx_data->xfer);
2176 		if (error != USBD_IN_PROGRESS && error != 0) {
2177 			printf("%s: could not queue Rx transfer\n",
2178 			    device_xname(sc->sc_dev));
2179 			goto fail;
2180 		}
2181 	}
2182 
2183 	error = urtw_rx_setconf(sc);
2184 	if (error != 0)
2185 		goto fail;
2186 
2187 	urtw_read8_m(sc, URTW_CMD, &data);
2188 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2189 fail:
2190 	return error;
2191 }
2192 
2193 usbd_status
2194 urtw_tx_enable(struct urtw_softc *sc)
2195 {
2196 	uint8_t data8;
2197 	uint32_t data;
2198 	usbd_status error;
2199 
2200 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2201 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2202 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2203 		    URTW_CW_CONF_PERPACKET_RETRY);
2204 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2205 
2206  		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2207 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2208 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2209 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2210 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2211 
2212 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2213 		data &= ~URTW_TX_LOOPBACK_MASK;
2214 		data |= URTW_TX_LOOPBACK_NONE;
2215 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2216 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2217 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2218 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2219 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2220 		data &= ~URTW_TX_SWPLCPLEN;
2221 		data |= URTW_TX_NOICV;
2222 		urtw_write32_m(sc, URTW_TX_CONF, data);
2223 	} else {
2224 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2225 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2226 		    URTW_TX_LONGRETRY;
2227 		urtw_write32_m(sc, URTW_TX_CONF, data);
2228 	}
2229 
2230 	urtw_read8_m(sc, URTW_CMD, &data8);
2231 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2232 fail:
2233 	return error;
2234 }
2235 
2236 int
2237 urtw_init(struct ifnet *ifp)
2238 {
2239 	struct urtw_softc *sc = ifp->if_softc;
2240 	struct urtw_rf *rf = &sc->sc_rf;
2241 	struct ieee80211com *ic = &sc->sc_ic;
2242 	usbd_status error;
2243 
2244 	urtw_stop(ifp, 0);
2245 
2246 	error = urtw_reset(sc);
2247 	if (error)
2248 		goto fail;
2249 
2250 	urtw_write8_m(sc, 0x85, 0);
2251 	urtw_write8_m(sc, URTW_GPIO, 0);
2252 
2253 	/* for led */
2254 	urtw_write8_m(sc, 0x85, 4);
2255 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2256 	if (error != 0)
2257 		goto fail;
2258 
2259 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2260 	if (error)
2261 		goto fail;
2262 
2263 	/* applying MAC address again. */
2264 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2265 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2266 	if (error)
2267 		goto fail;
2268 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2269 	if (error)
2270 		goto fail;
2271 
2272 	error = urtw_update_msr(sc);
2273 	if (error)
2274 		goto fail;
2275 
2276 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2277 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2278 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2279 	error = urtw_set_rate(sc);
2280 	if (error != 0)
2281 		goto fail;
2282 
2283 	error = rf->init(rf);
2284 	if (error != 0)
2285 		goto fail;
2286 	if (rf->set_sens != NULL)
2287 		rf->set_sens(rf);
2288 
2289 	urtw_write16_m(sc, 0x5e, 1);
2290 	urtw_write16_m(sc, 0xfe, 0x10);
2291 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2292 	urtw_write8_m(sc, 0xff, 0x60);
2293 	urtw_write16_m(sc, 0x5e, 0);
2294 	urtw_write8_m(sc, 0x85, 4);
2295 
2296 	error = urtw_intr_enable(sc);
2297 	if (error != 0)
2298 		goto fail;
2299 
2300 	/* reset softc variables */
2301 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
2302 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
2303 	}
2304 	sc->sc_txtimer = 0;
2305 
2306 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2307 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2308 		if (error != 0) {
2309 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
2310 			    ", err=%s\n", usbd_errstr(error));
2311 			goto fail;
2312 		}
2313 		/* get the first interface handle */
2314 		error = usbd_device2interface_handle(sc->sc_udev,
2315 		    URTW_IFACE_INDEX, &sc->sc_iface);
2316 		if (error != 0) {
2317 			printf("%s: could not get interface handle\n",
2318 			    device_xname(sc->sc_dev));
2319 			goto fail;
2320 		}
2321 		error = urtw_open_pipes(sc);
2322 		if (error != 0)
2323 			goto fail;
2324 		error = urtw_alloc_rx_data_list(sc);
2325 		if (error != 0)
2326 			goto fail;
2327 		error = urtw_alloc_tx_data_list(sc);
2328 		if (error != 0)
2329 			goto fail;
2330 		sc->sc_flags |= URTW_INIT_ONCE;
2331 	}
2332 
2333 	error = urtw_rx_enable(sc);
2334 	if (error != 0)
2335 		goto fail;
2336 	error = urtw_tx_enable(sc);
2337 	if (error != 0)
2338 		goto fail;
2339 
2340 	ifp->if_flags &= ~IFF_OACTIVE;
2341 	ifp->if_flags |= IFF_RUNNING;
2342 
2343 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2344 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2345 	else
2346 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2347 
2348 	return 0;
2349 fail:
2350 	return error;
2351 }
2352 
2353 int
2354 urtw_ioctl(struct ifnet *ifp, u_long cmd, void *data)
2355 {
2356 #define IS_RUNNING(ifp) \
2357 	(((ifp)->if_flags & IFF_UP) && ((ifp)->if_flags & IFF_RUNNING))
2358 
2359 	struct urtw_softc *sc = ifp->if_softc;
2360 	struct ieee80211com *ic = &sc->sc_ic;
2361 	int s, error = 0;
2362 
2363 	if (sc->sc_dying)
2364 		return ENXIO;
2365 
2366 	s = splnet();
2367 
2368 	switch (cmd) {
2369 	case SIOCSIFFLAGS:
2370 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
2371 			break;
2372 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
2373 		case IFF_UP|IFF_RUNNING:
2374 			break;
2375 		case IFF_UP:
2376 			ifp->if_init(ifp);
2377 			break;
2378 		case IFF_RUNNING:
2379 			urtw_stop(ifp, 1);
2380 			break;
2381 		case 0:
2382 			break;
2383 		}
2384 		break;
2385 
2386 	case SIOCADDMULTI:
2387 	case SIOCDELMULTI:
2388 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
2389 			error = 0;
2390 		break;
2391 
2392 	default:
2393 		error = ieee80211_ioctl(ic, cmd, data);
2394 		break;
2395 	}
2396 
2397 	if (error == ENETRESET) {
2398 		if (IS_RUNNING(ifp) &&
2399 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2400 			ifp->if_init(ifp);
2401 		error = 0;
2402 	}
2403 
2404 	splx(s);
2405 
2406 	return error;
2407 #undef IS_RUNNING
2408 }
2409 
2410 void
2411 urtw_start(struct ifnet *ifp)
2412 {
2413 	struct urtw_softc *sc = ifp->if_softc;
2414 	struct ieee80211com *ic = &sc->sc_ic;
2415 	struct ieee80211_node *ni;
2416 	struct ether_header *eh;
2417 	struct mbuf *m0;
2418 
2419 	/*
2420 	 * net80211 may still try to send management frames even if the
2421 	 * IFF_RUNNING flag is not set...
2422 	 */
2423 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2424 		return;
2425 
2426 	for (;;) {
2427 		IF_POLL(&ic->ic_mgtq, m0);
2428 		if (m0 != NULL) {
2429 
2430 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2431 			    URTW_TX_DATA_LIST_COUNT) {
2432 				ifp->if_flags |= IFF_OACTIVE;
2433 				break;
2434 			}
2435 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2436 			ni = M_GETCTX(m0, struct ieee80211_node *);
2437 			M_CLEARCTX(m0);
2438 			bpf_mtap3(ic->ic_rawbpf, m0);
2439 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2440 			    != 0)
2441 				break;
2442 		} else {
2443 			if (ic->ic_state != IEEE80211_S_RUN)
2444 				break;
2445 			IFQ_POLL(&ifp->if_snd, m0);
2446 			if (m0 == NULL)
2447 				break;
2448 			if (sc->sc_tx_queued[URTW_PRIORITY_NORMAL] >=
2449 			    URTW_TX_DATA_LIST_COUNT) {
2450 				ifp->if_flags |= IFF_OACTIVE;
2451 				break;
2452 			}
2453 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2454 			if (m0->m_len < sizeof(struct ether_header) &&
2455 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
2456 				continue;
2457 
2458 			eh = mtod(m0, struct ether_header *);
2459 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
2460 			if (ni == NULL) {
2461 				m_freem(m0);
2462 				continue;
2463 			}
2464 			bpf_mtap(ifp, m0);
2465 			m0 = ieee80211_encap(ic, m0, ni);
2466 			if (m0 == NULL) {
2467 				ieee80211_free_node(ni);
2468 				continue;
2469 			}
2470 			bpf_mtap3(ic->ic_rawbpf, m0);
2471 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2472 			    != 0) {
2473 				ieee80211_free_node(ni);
2474 				ifp->if_oerrors++;
2475 				break;
2476 			}
2477 		}
2478 		sc->sc_txtimer = 5;
2479 		ifp->if_timer = 1;
2480 	}
2481 }
2482 
2483 void
2484 urtw_watchdog(struct ifnet *ifp)
2485 {
2486 	struct urtw_softc *sc = ifp->if_softc;
2487 
2488 	ifp->if_timer = 0;
2489 
2490 	if (sc->sc_txtimer > 0) {
2491 		if (--sc->sc_txtimer == 0) {
2492 			printf("%s: device timeout\n", device_xname(sc->sc_dev));
2493 			ifp->if_oerrors++;
2494 			return;
2495 		}
2496 		ifp->if_timer = 1;
2497 	}
2498 
2499 	ieee80211_watchdog(&sc->sc_ic);
2500 }
2501 
2502 void
2503 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2504     usbd_status status)
2505 {
2506 	struct urtw_tx_data *data = priv;
2507 	struct urtw_softc *sc = data->sc;
2508 	struct ieee80211com *ic = &sc->sc_ic;
2509 	struct ifnet *ifp = ic->ic_ifp;
2510 	int s;
2511 
2512 	if (status != USBD_NORMAL_COMPLETION) {
2513 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2514 			return;
2515 
2516 		printf("%s: could not transmit buffer: %s\n",
2517 		    device_xname(sc->sc_dev), usbd_errstr(status));
2518 
2519 		if (status == USBD_STALLED)
2520 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2521 
2522 		ifp->if_oerrors++;
2523 		return;
2524 	}
2525 
2526 	s = splnet();
2527 
2528 	ieee80211_free_node(data->ni);
2529 	data->ni = NULL;
2530 
2531 	sc->sc_txtimer = 0;
2532 	ifp->if_opackets++;
2533 
2534 	sc->sc_tx_queued[URTW_PRIORITY_LOW]--;
2535 	ifp->if_flags &= ~IFF_OACTIVE;
2536 	urtw_start(ifp);
2537 
2538 	splx(s);
2539 }
2540 
2541 void
2542 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2543     usbd_status status)
2544 {
2545 	struct urtw_tx_data *data = priv;
2546 	struct urtw_softc *sc = data->sc;
2547 	struct ieee80211com *ic = &sc->sc_ic;
2548 	struct ifnet *ifp = ic->ic_ifp;
2549 	int s;
2550 
2551 	if (status != USBD_NORMAL_COMPLETION) {
2552 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2553 			return;
2554 
2555 		printf("%s: could not transmit buffer: %s\n",
2556 		    device_xname(sc->sc_dev), usbd_errstr(status));
2557 
2558 		if (status == USBD_STALLED)
2559 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2560 
2561 		ifp->if_oerrors++;
2562 		return;
2563 	}
2564 
2565 	s = splnet();
2566 
2567 	ieee80211_free_node(data->ni);
2568 	data->ni = NULL;
2569 
2570 	sc->sc_txtimer = 0;
2571 	ifp->if_opackets++;
2572 
2573 	sc->sc_tx_queued[URTW_PRIORITY_NORMAL]--;
2574 	ifp->if_flags &= ~IFF_OACTIVE;
2575 	urtw_start(ifp);
2576 
2577 	splx(s);
2578 }
2579 
2580 int
2581 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2582     int prior)
2583 {
2584 	struct ieee80211com *ic = &sc->sc_ic;
2585 	struct urtw_tx_data *data;
2586 	struct ieee80211_frame *wh;
2587 	struct ieee80211_key *k;
2588 	usbd_status error;
2589 	int xferlen;
2590 
2591 	wh = mtod(m0, struct ieee80211_frame *);
2592 
2593 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2594 		k = ieee80211_crypto_encap(ic, ni, m0);
2595 		if (k == NULL) {
2596 			m_freem(m0);
2597 			return ENOBUFS;
2598 		}
2599 		/* packet header may have moved, reset our local pointer */
2600 		wh = mtod(m0, struct ieee80211_frame *);
2601 	}
2602 
2603 	if (sc->sc_drvbpf != NULL) {
2604 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2605 
2606 		tap->wt_flags = 0;
2607 		tap->wt_rate = 0;
2608 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2609 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2610 
2611 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
2612 	}
2613 
2614 	if (sc->sc_hwrev & URTW_HWREV_8187)
2615 		xferlen = m0->m_pkthdr.len + 4 * 3;
2616 	else
2617 		xferlen = m0->m_pkthdr.len + 4 * 8;
2618 
2619 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2620 		xferlen += 1;
2621 
2622 	data = &sc->sc_tx_data[prior][sc->sc_txidx[prior]];
2623 	sc->sc_txidx[prior] =
2624 	    (sc->sc_txidx[prior] + 1) % URTW_TX_DATA_LIST_COUNT;
2625 
2626 	memset(data->buf, 0, URTW_TX_MAXSIZE);
2627 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2628 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2629 	data->buf[1] |= (1 << 7);
2630 
2631 	/* XXX sc_preamble_mode is always 2. */
2632 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2633 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2634 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2635 		data->buf[2] |= 1;
2636 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2637 	    prior == URTW_PRIORITY_LOW)
2638 		panic("TODO tx.");
2639 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2640 		data->buf[2] |= (1 << 1);
2641 	/* RTS rate - 10 means we use a basic rate. */
2642 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2643 	/*
2644 	 * XXX currently TX rate control depends on the rate value of
2645 	 * RX descriptor because I don't know how to we can control TX rate
2646 	 * in more smart way.  Please fix me you find a thing.
2647 	 */
2648 	data->buf[3] = sc->sc_currate;
2649 	if (prior == URTW_PRIORITY_NORMAL) {
2650 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2651 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2652 		else if (ic->ic_fixed_rate != -1)
2653 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2654 	}
2655 
2656 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2657 		data->buf[8] = 3;		/* CW minimum */
2658 		data->buf[8] |= (7 << 4);	/* CW maximum */
2659 		data->buf[9] |= 11;		/* retry limitation */
2660 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2661 	} else {
2662 		data->buf[21] |= 11;		/* retry limitation */
2663 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2664 	}
2665 
2666 	data->ni = ni;
2667 
2668 	/* mbuf is no longer needed. */
2669 	m_freem(m0);
2670 
2671 	usbd_setup_xfer(data->xfer, data, data->buf, xferlen,
2672 	    USBD_FORCE_SHORT_XFER, URTW_DATA_TIMEOUT,
2673 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2674 	error = usbd_transfer(data->xfer);
2675 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2676 		printf("%s: could not send frame: %s\n",
2677 		    device_xname(sc->sc_dev), usbd_errstr(error));
2678 		return EIO;
2679 	}
2680 
2681 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2682 	if (error != 0)
2683 		printf("%s: could not control LED (%d)\n",
2684 		    device_xname(sc->sc_dev), error);
2685 
2686 	sc->sc_tx_queued[prior]++;
2687 
2688 	return 0;
2689 }
2690 
2691 usbd_status
2692 urtw_8225_usb_init(struct urtw_softc *sc)
2693 {
2694 	uint8_t data;
2695 	usbd_status error;
2696 
2697 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2698 	urtw_write8_m(sc, URTW_GPIO, 0);
2699 	error = urtw_read8e(sc, 0x53, &data);
2700 	if (error)
2701 		goto fail;
2702 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2703 	if (error)
2704 		goto fail;
2705 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2706 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2707 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2708 
2709 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2710 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2711 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2712 
2713 	usbd_delay_ms(sc->sc_udev, 500);
2714 fail:
2715 	return error;
2716 }
2717 
2718 usbd_status
2719 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2720 {
2721 	usbd_status error = 0;
2722 
2723 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2724 fail:
2725 	return error;
2726 }
2727 
2728 usbd_status
2729 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2730 {
2731 	uint32_t phyw;
2732 	usbd_status error;
2733 
2734 	phyw = ((data << 8) | (addr | 0x80));
2735 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2736 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2737 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2738 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2739 	/*
2740 	 * Delay removed from 8185 to 8187.
2741 	 * usbd_delay_ms(sc->sc_udev, 1);
2742 	 */
2743 fail:
2744 	return error;
2745 }
2746 
2747 usbd_status
2748 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2749 {
2750 	data = data & 0xff;
2751 	return urtw_8187_write_phy(sc, addr, data);
2752 }
2753 
2754 usbd_status
2755 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2756 {
2757 	data = data & 0xff;
2758 	return urtw_8187_write_phy(sc, addr, data | 0x10000);
2759 }
2760 
2761 usbd_status
2762 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2763 {
2764 	usbd_status error;
2765 
2766 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2767 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2768 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2769 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2770 fail:
2771 	return error;
2772 }
2773 
2774 usbd_status
2775 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2776 {
2777 	int i, idx, set;
2778 	uint8_t *cck_pwltable;
2779 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2780 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2781 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2782 	usbd_status error;
2783 
2784 	cck_pwrlvl_max = 11;
2785 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2786 	ofdm_pwrlvl_min = 10;
2787 
2788 	/* CCK power setting */
2789 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2790 	idx = cck_pwrlvl % 6;
2791 	set = cck_pwrlvl / 6;
2792 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2793 	    urtw_8225_txpwr_cck;
2794 
2795 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2796 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2797 	for (i = 0; i < 8; i++) {
2798 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2799 		    cck_pwltable[idx * 8 + i]);
2800 	}
2801 	usbd_delay_ms(sc->sc_udev, 1);
2802 
2803 	/* OFDM power setting */
2804 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2805 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2806 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2807 
2808 	idx = ofdm_pwrlvl % 6;
2809 	set = ofdm_pwrlvl / 6;
2810 
2811 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2812 	if (error)
2813 		goto fail;
2814 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2815 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2816 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2817 
2818 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2819 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2820 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2821 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2822 	usbd_delay_ms(sc->sc_udev, 1);
2823 fail:
2824 	return error;
2825 }
2826 
2827 usbd_status
2828 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2829 {
2830 	usbd_status error;
2831 
2832 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2833 	usbd_delay_ms(sc->sc_udev, 1);
2834 fail:
2835 	return error;
2836 }
2837 
2838 usbd_status
2839 urtw_8225_rf_init(struct urtw_rf *rf)
2840 {
2841 	struct urtw_softc *sc = rf->rf_sc;
2842 	unsigned int i;
2843 	uint16_t data;
2844 	usbd_status error;
2845 
2846 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2847 	if (error)
2848 		goto fail;
2849 
2850 	error = urtw_8225_usb_init(sc);
2851 	if (error)
2852 		goto fail;
2853 
2854 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2855 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2856 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2857 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2858 
2859 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2860 	if (error)
2861 		goto fail;
2862 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2863 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2864 	if (error)
2865 		goto fail;
2866 
2867 	error = urtw_8185_rf_pins_enable(sc);
2868 	if (error)
2869 		goto fail;
2870 
2871 	usbd_delay_ms(sc->sc_udev, 500);
2872 
2873 	for (i = 0; i < __arraycount(urtw_8225_rf_part1); i++) {
2874 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2875 		    urtw_8225_rf_part1[i].val);
2876 	}
2877 	usbd_delay_ms(sc->sc_udev, 50);
2878 	urtw_8225_write(sc, 0x2, 0xc4d);
2879 	usbd_delay_ms(sc->sc_udev, 200);
2880 	urtw_8225_write(sc, 0x2, 0x44d);
2881 	usbd_delay_ms(sc->sc_udev, 200);
2882 	urtw_8225_write(sc, 0x0, 0x127);
2883 
2884 	for (i = 0; i < __arraycount(urtw_8225_rxgain); i++) {
2885 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2886 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2887 	}
2888 
2889 	urtw_8225_write(sc, 0x0, 0x27);
2890 	urtw_8225_write(sc, 0x0, 0x22f);
2891 
2892 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
2893 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2894 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2895 	}
2896 
2897 	for (i = 0; i < __arraycount(urtw_8225_rf_part2); i++) {
2898 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2899 		    urtw_8225_rf_part2[i].val);
2900 		usbd_delay_ms(sc->sc_udev, 1);
2901 	}
2902 
2903 	error = urtw_8225_setgain(sc, 4);
2904 	if (error)
2905 		goto fail;
2906 
2907 	for (i = 0; i < __arraycount(urtw_8225_rf_part3); i++) {
2908 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2909 		    urtw_8225_rf_part3[i].val);
2910 		usbd_delay_ms(sc->sc_udev, 1);
2911 	}
2912 
2913 	urtw_write8_m(sc, 0x5b, 0x0d);
2914 
2915 	error = urtw_8225_set_txpwrlvl(sc, 1);
2916 	if (error)
2917 		goto fail;
2918 
2919 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2920 	usbd_delay_ms(sc->sc_udev, 1);
2921 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2922 	usbd_delay_ms(sc->sc_udev, 1);
2923 
2924 	/* TX ant A, 0x0 for B */
2925 	error = urtw_8185_tx_antenna(sc, 0x3);
2926 	if (error)
2927 		goto fail;
2928 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2929 
2930 	error = urtw_8225_rf_set_chan(rf, 1);
2931 fail:
2932 	return error;
2933 }
2934 
2935 usbd_status
2936 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2937 {
2938 	struct urtw_softc *sc = rf->rf_sc;
2939 	struct ieee80211com *ic = &sc->sc_ic;
2940 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2941 	usbd_status error;
2942 
2943 	error = urtw_8225_set_txpwrlvl(sc, chan);
2944 	if (error)
2945 		goto fail;
2946 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2947 	usbd_delay_ms(sc->sc_udev, 10);
2948 
2949 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2950 
2951 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2952 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2953 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2954 	else
2955 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2956 
2957 	if (IEEE80211_IS_CHAN_G(c)) {
2958 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2959 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
2960 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2961 	} else {
2962 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2963 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
2964 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2965 	}
2966 
2967 fail:
2968 	return error;
2969 }
2970 
2971 usbd_status
2972 urtw_8225_rf_set_sens(struct urtw_rf *rf)
2973 {
2974 	struct urtw_softc *sc = rf->rf_sc;
2975 	usbd_status error;
2976 
2977 	if (rf->sens > 6)
2978 		return -1;
2979 
2980 	if (rf->sens > 4)
2981 		urtw_8225_write(sc, 0x0c, 0x850);
2982 	else
2983 		urtw_8225_write(sc, 0x0c, 0x50);
2984 
2985 	rf->sens = 6 - rf->sens;
2986 	error = urtw_8225_setgain(sc, rf->sens);
2987 	if (error)
2988 		goto fail;
2989 
2990 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
2991 
2992 fail:
2993 	return error;
2994 }
2995 
2996 void
2997 urtw_stop(struct ifnet *ifp, int disable)
2998 {
2999 	struct urtw_softc *sc = ifp->if_softc;
3000 	struct ieee80211com *ic = &sc->sc_ic;
3001 	uint8_t data;
3002 	usbd_status error;
3003 
3004 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3005 
3006 	sc->sc_txtimer = 0;
3007 	ifp->if_timer = 0;
3008 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3009 
3010 	callout_stop(&sc->scan_to);
3011 	callout_stop(&sc->sc_led_ch);
3012 
3013 	urtw_intr_disable(sc);
3014 	urtw_read8_m(sc, URTW_CMD, &data);
3015 	data &= ~URTW_CMD_TX_ENABLE;
3016 	data &= ~URTW_CMD_RX_ENABLE;
3017 	urtw_write8_m(sc, URTW_CMD, data);
3018 
3019 	if (sc->sc_rxpipe != NULL)
3020 		usbd_abort_pipe(sc->sc_rxpipe);
3021 	if (sc->sc_txpipe_low != NULL)
3022 		usbd_abort_pipe(sc->sc_txpipe_low);
3023 	if (sc->sc_txpipe_normal != NULL)
3024 		usbd_abort_pipe(sc->sc_txpipe_normal);
3025 
3026 fail:
3027 	return;
3028 }
3029 
3030 int
3031 urtw_isbmode(uint16_t rate)
3032 {
3033 	rate = urtw_rtl2rate(rate);
3034 
3035 	return ((rate <= 22 && rate != 12 && rate != 18) ||
3036 	    rate == 44) ? 1 : 0;
3037 }
3038 
3039 void
3040 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3041 {
3042 	struct urtw_rx_data *data = priv;
3043 	struct urtw_softc *sc = data->sc;
3044 	struct ieee80211com *ic = &sc->sc_ic;
3045 	struct ifnet *ifp = ic->ic_ifp;
3046 	struct ieee80211_frame *wh;
3047 	struct ieee80211_node *ni;
3048 	struct mbuf *m, *mnew;
3049 	uint8_t *desc, quality, rate;
3050 	int actlen, flen, len, rssi, s;
3051 
3052 	if (status != USBD_NORMAL_COMPLETION) {
3053 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3054 			return;
3055 
3056 		if (status == USBD_STALLED)
3057 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3058 		ifp->if_ierrors++;
3059 		goto skip;
3060 	}
3061 
3062 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3063 	if (actlen < URTW_MIN_RXBUFSZ) {
3064 		ifp->if_ierrors++;
3065 		goto skip;
3066 	}
3067 
3068 	if (sc->sc_hwrev & URTW_HWREV_8187)
3069 		/* 4 dword and 4 byte CRC */
3070 		len = actlen - (4 * 4);
3071 	else
3072 		/* 5 dword and 4 byte CRC */
3073 		len = actlen - (4 * 5);
3074 
3075 	desc = data->buf + len;
3076 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3077 	if (flen > actlen) {
3078 		ifp->if_ierrors++;
3079 		goto skip;
3080 	}
3081 
3082 	rate = (desc[2] & 0xf0) >> 4;
3083 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3084 		quality = desc[4] & 0xff;
3085 		rssi = (desc[6] & 0xfe) >> 1;
3086 
3087 		/* XXX correct? */
3088 		if (!urtw_isbmode(rate)) {
3089 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3090 			rssi = ((90 - rssi) * 100) / 65;
3091 		} else {
3092 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3093 			rssi = ((95 - rssi) * 100) / 65;
3094 		}
3095 	} else {
3096 		quality = desc[12];
3097 		rssi = 14 - desc[14] / 2;
3098 	}
3099 
3100 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3101 	if (mnew == NULL) {
3102 		printf("%s: could not allocate rx mbuf\n",
3103 		    device_xname(sc->sc_dev));
3104 		ifp->if_ierrors++;
3105 		goto skip;
3106 	}
3107 	MCLGET(mnew, M_DONTWAIT);
3108 	if (!(mnew->m_flags & M_EXT)) {
3109 		printf("%s: could not allocate rx mbuf cluster\n",
3110 		    device_xname(sc->sc_dev));
3111 		m_freem(mnew);
3112 		ifp->if_ierrors++;
3113 		goto skip;
3114 	}
3115 
3116 	m = data->m;
3117 	data->m = mnew;
3118 	data->buf = mtod(mnew, uint8_t *);
3119 
3120 	/* finalize mbuf */
3121 	m_set_rcvif(m, ifp);
3122 	m->m_pkthdr.len = m->m_len = flen - 4;
3123 
3124 	s = splnet();
3125 
3126 	if (sc->sc_drvbpf != NULL) {
3127 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3128 
3129 		/* XXX Are variables correct? */
3130 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3131 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3132 		tap->wr_dbm_antsignal = (int8_t)rssi;
3133 
3134 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
3135 	}
3136 	wh = mtod(m, struct ieee80211_frame *);
3137 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3138 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3139 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
3140 
3141 	/* XXX correct? */
3142 	if (!urtw_isbmode(rate)) {
3143 		if (quality > 127)
3144 			quality = 0;
3145 		else if (quality < 27)
3146 			quality = 100;
3147 		else
3148 			quality = 127 - quality;
3149 	} else
3150 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3151 
3152 	/* send the frame to the 802.11 layer */
3153 	ieee80211_input(ic, m, ni, rssi, 0);
3154 
3155 	/* node is no longer needed */
3156 	ieee80211_free_node(ni);
3157 
3158 	splx(s);
3159 
3160 skip:	/* setup a new transfer */
3161 	usbd_setup_xfer(xfer, data, data->buf, MCLBYTES,
3162 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3163 	(void)usbd_transfer(xfer);
3164 }
3165 
3166 usbd_status
3167 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3168 {
3169 	uint8_t *gainp;
3170 	usbd_status error;
3171 
3172 	/* XXX for A? */
3173 	gainp = urtw_8225v2_gain_bg;
3174 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3175 	usbd_delay_ms(sc->sc_udev, 1);
3176 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3177 	usbd_delay_ms(sc->sc_udev, 1);
3178 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3179 	usbd_delay_ms(sc->sc_udev, 1);
3180 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3181 	usbd_delay_ms(sc->sc_udev, 1);
3182 fail:
3183 	return error;
3184 }
3185 
3186 usbd_status
3187 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3188 {
3189 	int i;
3190 	uint8_t *cck_pwrtable;
3191 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3192 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3193 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3194 	usbd_status error;
3195 
3196 	/* CCK power setting */
3197 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3198 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3199 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3200 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3201 	    urtw_8225v2_txpwr_cck;
3202 
3203 	for (i = 0; i < 8; i++) {
3204 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3205 	}
3206 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3207 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3208 	usbd_delay_ms(sc->sc_udev, 1);
3209 
3210 	/* OFDM power setting */
3211 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3212 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3213 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3214 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3215 
3216 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3217 	if (error)
3218 		goto fail;
3219 
3220 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3221 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3222 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3223 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3224 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3225 
3226 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3227 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3228 	usbd_delay_ms(sc->sc_udev, 1);
3229 fail:
3230 	return error;
3231 }
3232 
3233 usbd_status
3234 urtw_8225v2_rf_init(struct urtw_rf *rf)
3235 {
3236 	struct urtw_softc *sc = rf->rf_sc;
3237 	int i;
3238 	uint16_t data;
3239 	uint32_t data32;
3240 	usbd_status error;
3241 
3242 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3243 	if (error)
3244 		goto fail;
3245 
3246 	error = urtw_8225_usb_init(sc);
3247 	if (error)
3248 		goto fail;
3249 
3250 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3251 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3252 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3253 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3254 
3255 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3256 	if (error)
3257 		goto fail;
3258 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3259 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3260 	if (error)
3261 		goto fail;
3262 
3263 	error = urtw_8185_rf_pins_enable(sc);
3264 	if (error)
3265 		goto fail;
3266 
3267 	usbd_delay_ms(sc->sc_udev, 1000);
3268 
3269 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part1); i++) {
3270 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3271 		    urtw_8225v2_rf_part1[i].val);
3272 		usbd_delay_ms(sc->sc_udev, 1);
3273 	}
3274 	usbd_delay_ms(sc->sc_udev, 50);
3275 
3276 	urtw_8225_write(sc, 0x0, 0x1b7);
3277 
3278 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3279 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3280 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3281 	}
3282 
3283 	urtw_8225_write(sc, 0x3, 0x2);
3284 	urtw_8225_write(sc, 0x5, 0x4);
3285 	urtw_8225_write(sc, 0x0, 0xb7);
3286 	urtw_8225_write(sc, 0x2, 0xc4d);
3287 	usbd_delay_ms(sc->sc_udev, 100);
3288 	urtw_8225_write(sc, 0x2, 0x44d);
3289 	usbd_delay_ms(sc->sc_udev, 100);
3290 
3291 	error = urtw_8225_read(sc, 0x6, &data32);
3292 	if (error != 0)
3293 		goto fail;
3294 	if (data32 != 0xe6)
3295 		printf("%s: expect 0xe6!! (0x%x)\n", device_xname(sc->sc_dev),
3296 		    data32);
3297 	if (!(data32 & 0x80)) {
3298 		urtw_8225_write(sc, 0x02, 0x0c4d);
3299 		usbd_delay_ms(sc->sc_udev, 200);
3300 		urtw_8225_write(sc, 0x02, 0x044d);
3301 		usbd_delay_ms(sc->sc_udev, 100);
3302 		error = urtw_8225_read(sc, 0x6, &data32);
3303 		if (error != 0)
3304 			goto fail;
3305 		if (!(data32 & 0x80))
3306 			printf("%s: RF calibration failed\n",
3307 			    device_xname(sc->sc_dev));
3308 	}
3309 	usbd_delay_ms(sc->sc_udev, 100);
3310 
3311 	urtw_8225_write(sc, 0x0, 0x2bf);
3312 	for (i = 0; i < __arraycount(urtw_8225_agc); i++) {
3313 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3314 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3315 	}
3316 
3317 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part2); i++) {
3318 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3319 		    urtw_8225v2_rf_part2[i].val);
3320 	}
3321 
3322 	error = urtw_8225v2_setgain(sc, 4);
3323 	if (error)
3324 		goto fail;
3325 
3326 	for (i = 0; i < __arraycount(urtw_8225v2_rf_part3); i++) {
3327 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3328 		    urtw_8225v2_rf_part3[i].val);
3329 	}
3330 
3331 	urtw_write8_m(sc, 0x5b, 0x0d);
3332 
3333 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3334 	if (error)
3335 		goto fail;
3336 
3337 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3338 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3339 
3340 	/* TX ant A, 0x0 for B */
3341 	error = urtw_8185_tx_antenna(sc, 0x3);
3342 	if (error)
3343 		goto fail;
3344 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3345 
3346 	error = urtw_8225_rf_set_chan(rf, 1);
3347 fail:
3348 	return error;
3349 }
3350 
3351 usbd_status
3352 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3353 {
3354 	struct urtw_softc *sc = rf->rf_sc;
3355 	struct ieee80211com *ic = &sc->sc_ic;
3356 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3357 	usbd_status error;
3358 
3359 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3360 	if (error)
3361 		goto fail;
3362 
3363 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3364 	usbd_delay_ms(sc->sc_udev, 10);
3365 
3366 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3367 
3368 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3369 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3370 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3371 	else
3372 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3373 
3374 	if (IEEE80211_IS_CHAN_G(c)) {
3375 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3376 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3377 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3378 	} else {
3379 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3380 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3381 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3382 	}
3383 
3384 fail:
3385 	return error;
3386 }
3387 
3388 void
3389 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3390 {
3391 	struct urtw_rf *rf = &sc->sc_rf;
3392 	struct ieee80211com *ic = &sc->sc_ic;
3393 	usbd_status error = 0;
3394 	uint32_t data;
3395 	u_int chan;
3396 
3397 	chan = ieee80211_chan2ieee(ic, c);
3398 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3399 		return;
3400 	/*
3401 	 * During changing the channel we need to temporary disable
3402 	 * TX.
3403 	 */
3404 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3405 	data &= ~URTW_TX_LOOPBACK_MASK;
3406 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3407 	error = rf->set_chan(rf, chan);
3408 	if (error != 0) {
3409 		printf("%s could not change the channel\n",
3410 		    device_xname(sc->sc_dev));
3411 		return;
3412 	}
3413 	usbd_delay_ms(sc->sc_udev, 10);
3414 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3415 
3416 fail:	return;
3417 
3418 }
3419 
3420 void
3421 urtw_next_scan(void *arg)
3422 {
3423 	struct urtw_softc *sc = arg;
3424 	struct ieee80211com *ic = &sc->sc_ic;
3425 	int s;
3426 
3427 	if (sc->sc_dying)
3428 		return;
3429 
3430 	s = splnet();
3431 	if (ic->ic_state == IEEE80211_S_SCAN)
3432 		ieee80211_next_scan(ic);
3433 	splx(s);
3434 }
3435 
3436 void
3437 urtw_task(void *arg)
3438 {
3439 	struct urtw_softc *sc = arg;
3440 	struct ieee80211com *ic = &sc->sc_ic;
3441 	struct ieee80211_node *ni;
3442 	enum ieee80211_state ostate;
3443 	usbd_status error = 0;
3444 
3445 	if (sc->sc_dying)
3446 		return;
3447 
3448 	ostate = ic->ic_state;
3449 
3450 	switch (sc->sc_state) {
3451 	case IEEE80211_S_INIT:
3452 		if (ostate == IEEE80211_S_RUN) {
3453 			/* turn link LED off */
3454 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3455 		}
3456 		break;
3457 
3458 	case IEEE80211_S_SCAN:
3459 		urtw_set_chan(sc, ic->ic_curchan);
3460 		if (!sc->sc_dying)
3461 			callout_schedule(&sc->scan_to, mstohz(200));
3462 		break;
3463 
3464 	case IEEE80211_S_AUTH:
3465 	case IEEE80211_S_ASSOC:
3466 		urtw_set_chan(sc, ic->ic_curchan);
3467 		break;
3468 
3469 	case IEEE80211_S_RUN:
3470 		ni = ic->ic_bss;
3471 
3472 		urtw_set_chan(sc, ic->ic_curchan);
3473 
3474 		/* setting bssid. */
3475 		error = urtw_set_bssid(sc, ni->ni_bssid);
3476 		if (error != 0)
3477 			goto fail;
3478 		urtw_update_msr(sc);
3479 		/* XXX maybe the below would be incorrect. */
3480 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3481 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3482 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3483 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3484 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3485 		if (error != 0)
3486 			printf("%s: could not control LED (%d)\n",
3487 			    device_xname(sc->sc_dev), error);
3488 		break;
3489 	}
3490 
3491 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3492 
3493 fail:
3494 	if (error != 0) {
3495 		DPRINTF(("%s: error duing processing RUN state.",
3496 		    device_xname(sc->sc_dev)));
3497 	}
3498 }
3499 
3500 usbd_status
3501 urtw_8187b_update_wmm(struct urtw_softc *sc)
3502 {
3503 	struct ieee80211com *ic = &sc->sc_ic;
3504 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3505 	uint32_t data;
3506 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3507 	usbd_status error;
3508 
3509 	sifs = 0xa;
3510 	if (IEEE80211_IS_CHAN_G(c))
3511 		slot = 0x9;
3512 	else
3513 		slot = 0x14;
3514 
3515 	aifs = (2 * slot) + sifs;
3516 	ecwmin = 3;
3517 	ecwmax = 7;
3518 
3519 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3520 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3521 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3522 
3523 	urtw_write32_m(sc, URTW_AC_VO, data);
3524 	urtw_write32_m(sc, URTW_AC_VI, data);
3525 	urtw_write32_m(sc, URTW_AC_BE, data);
3526 	urtw_write32_m(sc, URTW_AC_BK, data);
3527 
3528 fail:
3529 	return error;
3530 }
3531 
3532 usbd_status
3533 urtw_8187b_reset(struct urtw_softc *sc)
3534 {
3535 	uint8_t data;
3536 	usbd_status error;
3537 
3538 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3539 	if (error)
3540 		goto fail;
3541 
3542 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3543 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3544 		URTW_CONFIG3_GNT_SELECT);
3545 
3546 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3547 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3548 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3549 
3550 	urtw_write8_m(sc, 0x61, 0x10);
3551 	urtw_read8_m(sc, 0x62, &data);
3552 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3553 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3554 
3555 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3556 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3557 
3558 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3559 	if (error)
3560 		goto fail;
3561 
3562 	urtw_read8_m(sc, URTW_CMD, &data);
3563 	data = (data & 2) | URTW_CMD_RST;
3564 	urtw_write8_m(sc, URTW_CMD, data);
3565 	usbd_delay_ms(sc->sc_udev, 100);
3566 
3567 	urtw_read8_m(sc, URTW_CMD, &data);
3568 	if (data & URTW_CMD_RST) {
3569 		printf("%s: reset timeout\n", device_xname(sc->sc_dev));
3570 		goto fail;
3571 	}
3572 
3573 fail:
3574 	return error;
3575 }
3576 
3577 int
3578 urtw_8187b_init(struct ifnet *ifp)
3579 {
3580 	struct urtw_softc *sc = ifp->if_softc;
3581 	struct urtw_rf *rf = &sc->sc_rf;
3582 	struct ieee80211com *ic = &sc->sc_ic;
3583 	uint8_t data;
3584 	usbd_status error;
3585 
3586 	urtw_stop(ifp, 0);
3587 
3588 	error = urtw_8187b_update_wmm(sc);
3589 	if (error != 0)
3590 		goto fail;
3591 	error = urtw_8187b_reset(sc);
3592 	if (error)
3593 		goto fail;
3594 
3595 	/* Applying MAC address again. */
3596 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3597 	if (error)
3598 		goto fail;
3599 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3600 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3601 	if (error)
3602 		goto fail;
3603 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3604 	if (error)
3605 		goto fail;
3606 
3607 	error = urtw_update_msr(sc);
3608 	if (error)
3609 		goto fail;
3610 
3611 	error = rf->init(rf);
3612 	if (error != 0)
3613 		goto fail;
3614 
3615 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3616 		URTW_CMD_RX_ENABLE);
3617 	error = urtw_intr_enable(sc);
3618 	if (error != 0)
3619 		goto fail;
3620 
3621 	error = urtw_write8e(sc, 0x41, 0xf4);
3622 	if (error != 0)
3623 		goto fail;
3624 	error = urtw_write8e(sc, 0x40, 0x00);
3625 	if (error != 0)
3626 		goto fail;
3627 	error = urtw_write8e(sc, 0x42, 0x00);
3628 	if (error != 0)
3629 		goto fail;
3630 	error = urtw_write8e(sc, 0x42, 0x01);
3631 	if (error != 0)
3632 		goto fail;
3633 	error = urtw_write8e(sc, 0x40, 0x0f);
3634 	if (error != 0)
3635 		goto fail;
3636 	error = urtw_write8e(sc, 0x42, 0x00);
3637 	if (error != 0)
3638 		goto fail;
3639 	error = urtw_write8e(sc, 0x42, 0x01);
3640 	if (error != 0)
3641 		goto fail;
3642 
3643 	urtw_read8_m(sc, 0xdb, &data);
3644 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3645 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3646 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3647 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3648 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3649 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3650 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3651 	urtw_write8_m(sc, 0x61, 0);
3652 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3653 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3654 	urtw_write8_m(sc, 0xda, 0x10);
3655 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3656 
3657 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3658 
3659 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3660 
3661 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3662 
3663 	/* Reset softc variables. */
3664 	for (size_t j = 0; j < URTW_PRIORITY_MAX; j++) {
3665 		sc->sc_txidx[j] = sc->sc_tx_queued[j] = 0;
3666 	}
3667 	sc->sc_txtimer = 0;
3668 
3669 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3670 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3671 		if (error != 0) {
3672 			aprint_error_dev(sc->sc_dev, "failed to set configuration"
3673 			    ", err=%s\n", usbd_errstr(error));
3674 
3675 			goto fail;
3676 		}
3677 		/* Get the first interface handle. */
3678 		error = usbd_device2interface_handle(sc->sc_udev,
3679 		    URTW_IFACE_INDEX, &sc->sc_iface);
3680 		if (error != 0) {
3681 			printf("%s: could not get interface handle\n",
3682 			    device_xname(sc->sc_dev));
3683 			goto fail;
3684 		}
3685 		error = urtw_open_pipes(sc);
3686 		if (error != 0)
3687 			goto fail;
3688 		error = urtw_alloc_rx_data_list(sc);
3689 		if (error != 0)
3690 			goto fail;
3691 		error = urtw_alloc_tx_data_list(sc);
3692 		if (error != 0)
3693 			goto fail;
3694 		sc->sc_flags |= URTW_INIT_ONCE;
3695 	}
3696 
3697 	error = urtw_rx_enable(sc);
3698 	if (error != 0)
3699 		goto fail;
3700 	error = urtw_tx_enable(sc);
3701 	if (error != 0)
3702 		goto fail;
3703 
3704 	ifp->if_flags &= ~IFF_OACTIVE;
3705 	ifp->if_flags |= IFF_RUNNING;
3706 
3707 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3708 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3709 	else
3710 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3711 
3712 fail:
3713 	return error;
3714 }
3715 
3716 usbd_status
3717 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3718 {
3719 	int i;
3720 	usbd_status error;
3721 
3722 	for (i = 0; i < __arraycount(urtw_8187b_regtbl); i++) {
3723 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3724 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3725 	}
3726 
3727 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3728 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3729 
3730 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3731 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3732 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3733 
3734 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3735 
3736 fail:
3737 	return error;
3738 }
3739 
3740 usbd_status
3741 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3742 {
3743 	usbd_status error;
3744 
3745 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3746 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3747 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3748 	usbd_delay_ms(sc->sc_udev, 100);
3749 
3750 fail:
3751 	return error;
3752 }
3753 
3754 usbd_status
3755 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3756 {
3757 	struct ieee80211com *ic = &sc->sc_ic;
3758 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3759 	uint8_t aifs, difs, eifs, sifs, slot;
3760 	usbd_status error;
3761 
3762 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3763 
3764 	sifs = 0xa;
3765 	if (IEEE80211_IS_CHAN_G(c)) {
3766 		slot = 0x9;
3767 		difs = 0x1c;
3768 		eifs = 0x5b;
3769 	} else {
3770 		slot = 0x14;
3771 		difs = 0x32;
3772 		eifs = 0x5b;
3773 	}
3774 	aifs = (2 * slot) + sifs;
3775 
3776 	urtw_write8_m(sc, URTW_SLOT, slot);
3777 
3778 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3779 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3780 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3781 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3782 
3783 	urtw_write8_m(sc, URTW_DIFS, difs);
3784 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3785 
3786 fail:
3787 	return error;
3788 }
3789 
3790 usbd_status
3791 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3792 {
3793 	struct urtw_softc *sc = rf->rf_sc;
3794 	unsigned int i;
3795 	uint8_t data;
3796 	usbd_status error;
3797 
3798 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3799 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3800 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3801 	urtw_write8_m(sc, URTW_CW_CONF, data |
3802 		URTW_CW_CONF_PERPACKET_RETRY);
3803 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3804 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3805 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3806 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3807 
3808 	/* Auto rate fallback control. */
3809 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3810 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3811 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3812 		URTW_RATE_FALLBACK_ENABLE);
3813 
3814 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3815 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3816 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3817 
3818 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3819 	if (error)
3820 		goto fail;
3821 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3822 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3823 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3824 	if (error)
3825 		goto fail;
3826 
3827 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3828 	urtw_8225v2_b_config_mac(sc);
3829 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3830 
3831 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3832 	if (error)
3833 		goto fail;
3834 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3835 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3836 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3837 	if (error)
3838 		goto fail;
3839 
3840 	urtw_8225v2_b_init_rfe(sc);
3841 
3842 	for (i = 0; i < __arraycount(urtw_8225v2_b_rf); i++) {
3843 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3844 		    urtw_8225v2_b_rf[i].val);
3845 	}
3846 
3847 	for (i = 0; i < __arraycount(urtw_8225v2_rxgain); i++) {
3848 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3849 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3850 	}
3851 
3852 	urtw_8225_write(sc, 0x03, 0x080);
3853 	urtw_8225_write(sc, 0x05, 0x004);
3854 	urtw_8225_write(sc, 0x00, 0x0b7);
3855 	urtw_8225_write(sc, 0x02, 0xc4d);
3856 	urtw_8225_write(sc, 0x02, 0x44d);
3857 	urtw_8225_write(sc, 0x00, 0x2bf);
3858 
3859 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3860 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3861 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3862 
3863 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3864 	for (i = 0; i < __arraycount(urtw_8225v2_agc); i++) {
3865 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3866 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3867 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3868 	}
3869 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3870 
3871 	for (i = 0; i < __arraycount(urtw_8225v2_ofdm); i++)
3872 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3873 
3874 	urtw_8225v2_b_update_chan(sc);
3875 
3876 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3877 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3878 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3879 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3880 
3881 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3882 fail:
3883 	return error;
3884 }
3885 
3886 usbd_status
3887 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3888 {
3889 	struct urtw_softc *sc = rf->rf_sc;
3890 	usbd_status error;
3891 
3892 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3893 	if (error)
3894 		goto fail;
3895 
3896 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3897 	/*
3898 	 * Delay removed from 8185 to 8187.
3899 	 * usbd_delay_ms(sc->sc_udev, 10);
3900 	 */
3901 
3902 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3903 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3904 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3905 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3906 
3907 fail:
3908 	return error;
3909 }
3910 
3911 usbd_status
3912 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3913 {
3914 	int i;
3915 	uint8_t *cck_pwrtable;
3916 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3917 	    ofdm_pwrlvl_max;
3918 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3919 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3920 	usbd_status error;
3921 
3922 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3923 		cck_pwrlvl_min = 0;
3924 		cck_pwrlvl_max = 15;
3925 		ofdm_pwrlvl_min = 2;
3926 		ofdm_pwrlvl_max = 17;
3927 	} else {
3928 		cck_pwrlvl_min = 7;
3929 		cck_pwrlvl_max = 22;
3930 		ofdm_pwrlvl_min = 10;
3931 		ofdm_pwrlvl_max = 25;
3932 	}
3933 
3934 	/* CCK power setting */
3935 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
3936 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
3937 
3938 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3939 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3940 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
3941 
3942 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3943 	    urtw_8225v2_txpwr_cck;
3944 
3945 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3946 		if (cck_pwrlvl <= 6)
3947 			; /* do nothing */
3948 		else if (cck_pwrlvl <= 11)
3949 			cck_pwrtable += 8;
3950 		else
3951 			cck_pwrtable += 16;
3952 	} else {
3953 		if (cck_pwrlvl <= 5)
3954 			; /* do nothing */
3955 		else if (cck_pwrlvl <= 11)
3956 			cck_pwrtable += 8;
3957 		else if (cck_pwrlvl <= 17)
3958 			cck_pwrtable += 16;
3959 		else
3960 			cck_pwrtable += 24;
3961 	}
3962 
3963 	for (i = 0; i < 8; i++) {
3964 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3965 	}
3966 
3967 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3968 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3969 	/*
3970 	 * Delay removed from 8185 to 8187.
3971 	 * usbd_delay_ms(sc->sc_udev, 1);
3972 	 */
3973 
3974 	/* OFDM power setting */
3975 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3976 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3977 
3978 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3979 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3980 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
3981 
3982 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3983 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3984 
3985 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3986 		if (ofdm_pwrlvl <= 11) {
3987 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
3988 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
3989 		} else {
3990 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3991 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3992 		}
3993 	} else {
3994 		if (ofdm_pwrlvl <= 11) {
3995 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3996 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3997 		} else if (ofdm_pwrlvl <= 17) {
3998 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
3999 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4000 		} else {
4001 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4002 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4003 		}
4004 	}
4005 
4006 	/*
4007 	 * Delay removed from 8185 to 8187.
4008 	 * usbd_delay_ms(sc->sc_udev, 1);
4009 	 */
4010 fail:
4011 	return error;
4012 }
4013 
4014 int
4015 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4016 {
4017 	int error;
4018 
4019 	urtw_write32_m(sc, URTW_BSSID,
4020 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4021 	urtw_write16_m(sc, URTW_BSSID + 4,
4022 	    bssid[4] | bssid[5] << 8);
4023 
4024 	return 0;
4025 
4026 fail:
4027 	return error;
4028 }
4029 
4030 int
4031 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4032 {
4033 	int error;
4034 
4035 	urtw_write32_m(sc, URTW_MAC0,
4036 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4037 	urtw_write16_m(sc, URTW_MAC4,
4038 	    addr[4] | addr[5] << 8);
4039 
4040 	return 0;
4041 
4042 fail:
4043 	return error;
4044 }
4045 
4046 MODULE(MODULE_CLASS_DRIVER, if_urtw, "bpf");
4047 
4048 #ifdef _MODULE
4049 #include "ioconf.c"
4050 #endif
4051 
4052 static int
4053 if_urtw_modcmd(modcmd_t cmd, void *aux)
4054 {
4055 	int error = 0;
4056 
4057 	switch (cmd) {
4058 	case MODULE_CMD_INIT:
4059 #ifdef _MODULE
4060 		error = config_init_component(cfdriver_ioconf_urtw,
4061 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4062 #endif
4063 		return error;
4064 	case MODULE_CMD_FINI:
4065 #ifdef _MODULE
4066 		error = config_fini_component(cfdriver_ioconf_urtw,
4067 		    cfattach_ioconf_urtw, cfdata_ioconf_urtw);
4068 #endif
4069 		return error;
4070 	default:
4071 		return ENOTTY;
4072 	}
4073 }
4074