xref: /openbsd-src/sys/dev/usb/if_urtw.c (revision 43003dfe3ad45d1698bed8a37f2b0f5b14f20d4f)
1 /*	$OpenBSD: if_urtw.c,v 1.27 2009/08/02 10:38:34 miod Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
5  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include "bpfilter.h"
21 
22 #include <sys/param.h>
23 #include <sys/sockio.h>
24 #include <sys/proc.h>
25 #include <sys/mbuf.h>
26 #include <sys/kernel.h>
27 #include <sys/socket.h>
28 #include <sys/systm.h>
29 #include <sys/malloc.h>
30 #include <sys/timeout.h>
31 #include <sys/conf.h>
32 #include <sys/device.h>
33 
34 #include <machine/bus.h>
35 #include <machine/endian.h>
36 #if NBPFILTER > 0
37 #include <net/bpf.h>
38 #endif
39 #include <net/if.h>
40 #include <net/if_arp.h>
41 #include <net/if_dl.h>
42 #include <net/if_media.h>
43 #include <net/if_types.h>
44 
45 #include <netinet/in.h>
46 #include <netinet/in_systm.h>
47 #include <netinet/in_var.h>
48 #include <netinet/if_ether.h>
49 #include <netinet/ip.h>
50 
51 #include <net80211/ieee80211_var.h>
52 #include <net80211/ieee80211_radiotap.h>
53 
54 #include <dev/usb/usb.h>
55 #include <dev/usb/usbdi.h>
56 #include <dev/usb/usbdi_util.h>
57 #include <dev/usb/usbdevs.h>
58 
59 #include <dev/usb/if_urtwreg.h>
60 
61 #ifdef USB_DEBUG
62 #define	URTW_DEBUG
63 #endif
64 
65 #ifdef URTW_DEBUG
66 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
67 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
68 int urtw_debug = 0;
69 #else
70 #define	DPRINTF(x)
71 #define	DPRINTFN(n, x)
72 #endif
73 
74 /*
75  * Recognized device vendors/products.
76  */
77 static const struct urtw_type {
78 	struct usb_devno	dev;
79 	uint8_t			rev;
80 } urtw_devs[] = {
81 #define	URTW_DEV_RTL8187(v, p)	\
82 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
83 #define	URTW_DEV_RTL8187B(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
85 	/* Realtek RTL8187 devices. */
86 	URTW_DEV_RTL8187(ASUS,		P5B_WIFI),
87 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
88 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GCV2),
89 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
90 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
91 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
92 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
93 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
94 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
95 	/* Realtek RTL8187B devices. */
96 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
97 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
98 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
99 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
101 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
102 #undef	URTW_DEV_RTL8187
103 #undef	URTW_DEV_RTL8187B
104 };
105 #define	urtw_lookup(v, p)	\
106 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
107 
108 /*
109  * Helper read/write macros.
110  */
111 #define urtw_read8_m(sc, val, data)	do {			\
112 	error = urtw_read8_c(sc, val, data, 0);			\
113 	if (error != 0)						\
114 		goto fail;					\
115 } while (0)
116 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
117 	error = urtw_read8_c(sc, val, data, idx);		\
118 	if (error != 0)						\
119 		goto fail;					\
120 } while (0)
121 #define urtw_write8_m(sc, val, data)	do {			\
122 	error = urtw_write8_c(sc, val, data, 0);		\
123 	if (error != 0)						\
124 		goto fail;					\
125 } while (0)
126 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
127 	error = urtw_write8_c(sc, val, data, idx);		\
128 	if (error != 0)						\
129 		goto fail;					\
130 } while (0)
131 #define urtw_read16_m(sc, val, data)	do {			\
132 	error = urtw_read16_c(sc, val, data, 0);		\
133 	if (error != 0)						\
134 		goto fail;					\
135 } while (0)
136 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
137 	error = urtw_read16_c(sc, val, data, idx);		\
138 	if (error != 0)						\
139 		goto fail;					\
140 } while (0)
141 #define urtw_write16_m(sc, val, data)	do {			\
142 	error = urtw_write16_c(sc, val, data, 0);		\
143 	if (error != 0)						\
144 		goto fail;					\
145 } while (0)
146 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
147 	error = urtw_write16_c(sc, val, data, idx);		\
148 	if (error != 0)						\
149 		goto fail;					\
150 } while (0)
151 #define urtw_read32_m(sc, val, data)	do {			\
152 	error = urtw_read32_c(sc, val, data, 0);		\
153 	if (error != 0)						\
154 		goto fail;					\
155 } while (0)
156 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
157 	error = urtw_read32_c(sc, val, data, idx);		\
158 	if (error != 0)						\
159 		goto fail;					\
160 } while (0)
161 #define urtw_write32_m(sc, val, data)	do {			\
162 	error = urtw_write32_c(sc, val, data, 0);		\
163 	if (error != 0)						\
164 		goto fail;					\
165 } while (0)
166 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
167 	error = urtw_write32_c(sc, val, data, idx);		\
168 	if (error != 0)						\
169 		goto fail;					\
170 } while (0)
171 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
172 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
173 	if (error != 0)						\
174 		goto fail;					\
175 } while (0)
176 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
177 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
178 	if (error != 0)						\
179 		goto fail;					\
180 } while (0)
181 #define urtw_8225_write(sc, val, data)	do {			\
182 	error = urtw_8225_write_c(sc, val, data);		\
183 	if (error != 0)						\
184 		goto fail;					\
185 } while (0)
186 
187 struct urtw_pair {
188 	uint32_t	reg;
189 	uint32_t	val;
190 };
191 
192 struct urtw_pair_idx {
193 	uint8_t		reg;
194 	uint8_t		val;
195 	uint8_t		idx;
196 };
197 
198 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
199 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
200 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
201 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
202 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
203 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
204 	{ 0xff, 0x00, 0 },
205 
206 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
207 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
208 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
209 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
210 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
211 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
212 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
213 	{ 0xf8, 0x08, 1 },
214 
215 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
216 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
217 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
218 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
219 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
220 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
221 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
222 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
223 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
224 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
225 
226 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
227 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
228 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
229 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
230 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
231 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
232 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
233 
234 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
235 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
236 };
237 
238 static uint8_t urtw_8225_agc[] = {
239 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
240 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
241 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
242 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
243 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
244 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
245 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
246 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
247 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
248 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
249 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
250 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
251 };
252 
253 static uint32_t urtw_8225_channel[] = {
254 	0x0000,		/* dummy channel 0 */
255 	0x085c,		/* 1 */
256 	0x08dc,		/* 2 */
257 	0x095c,		/* 3 */
258 	0x09dc,		/* 4 */
259 	0x0a5c,		/* 5 */
260 	0x0adc,		/* 6 */
261 	0x0b5c,		/* 7 */
262 	0x0bdc,		/* 8 */
263 	0x0c5c,		/* 9 */
264 	0x0cdc,		/* 10 */
265 	0x0d5c,		/* 11 */
266 	0x0ddc,		/* 12 */
267 	0x0e5c,		/* 13 */
268 	0x0f72,		/* 14 */
269 };
270 
271 static uint8_t urtw_8225_gain[] = {
272 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
273 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
274 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
275 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
276 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
277 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
278 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
279 };
280 
281 static struct urtw_pair urtw_8225_rf_part1[] = {
282 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
283 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
284 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
285 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
286 };
287 
288 static struct urtw_pair urtw_8225_rf_part2[] = {
289 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
290 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
291 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
292 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
293 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
294 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
295 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
296 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
297 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
298 	{ 0x27, 0x88 }
299 };
300 
301 static struct urtw_pair urtw_8225_rf_part3[] = {
302 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
303 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
304 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
305 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
306 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
307 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
308 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
309 };
310 
311 static uint16_t urtw_8225_rxgain[] = {
312 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
313 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
314 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
315 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
316 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
317 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
318 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
319 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
320 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
321 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
322 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
323 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
324 };
325 
326 static uint8_t urtw_8225_threshold[] = {
327 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
328 };
329 
330 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
331 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
332 };
333 
334 static uint8_t urtw_8225_txpwr_cck[] = {
335 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
336 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
337 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
338 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
339 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
340 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
341 };
342 
343 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
344 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
345 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
346 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
347 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
348 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
349 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
350 };
351 
352 static uint8_t urtw_8225_txpwr_ofdm[] = {
353 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
354 };
355 
356 static uint8_t urtw_8225v2_agc[] = {
357 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
358 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
359 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
360 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
361 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
362 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
363 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
364 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
365 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
366 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
367 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
368 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
369 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
370 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
371 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
372 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
373 };
374 
375 static uint8_t urtw_8225v2_ofdm[] = {
376 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
377 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
378 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
379 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
380 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
381 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
382 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
383 	0x6d, 0x3c, 0xfb, 0x07
384 };
385 
386 static uint8_t urtw_8225v2_gain_bg[] = {
387 	0x23, 0x15, 0xa5,		/* -82-1dbm */
388 	0x23, 0x15, 0xb5,		/* -82-2dbm */
389 	0x23, 0x15, 0xc5,		/* -82-3dbm */
390 	0x33, 0x15, 0xc5,		/* -78dbm */
391 	0x43, 0x15, 0xc5,		/* -74dbm */
392 	0x53, 0x15, 0xc5,		/* -70dbm */
393 	0x63, 0x15, 0xc5,		/* -66dbm */
394 };
395 
396 static struct urtw_pair urtw_8225v2_rf_part1[] = {
397 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
398 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
399 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
400 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
401 };
402 
403 static struct urtw_pair urtw_8225v2_rf_part2[] = {
404 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
405 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
406 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
407 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
408 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
409 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
410 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
411 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
412 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
413 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
414 };
415 
416 static struct urtw_pair urtw_8225v2_rf_part3[] = {
417 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
418 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
419 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
420 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
421 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
422 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
423 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
424 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
425 };
426 
427 static uint16_t urtw_8225v2_rxgain[] = {
428 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
429 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
430 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
431 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
432 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
433 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
434 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
435 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
436 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
437 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
438 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
439 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
440 };
441 
442 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
443 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
444 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
445 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
446 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
447 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
448 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
449 };
450 
451 static uint8_t urtw_8225v2_txpwr_cck[] = {
452 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
453 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
454 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
455 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
456 };
457 
458 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
459 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
460 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
461 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
463 };
464 
465 static struct urtw_pair urtw_8225v2_b_rf[] = {
466 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
467 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
468 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
469 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
470 	{ 0x00, 0x01b7 }
471 };
472 
473 static struct urtw_pair urtw_ratetable[] = {
474 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
475 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
476 	{ 96, 10 }, { 108, 11 }
477 };
478 
479 int		urtw_init(struct ifnet *);
480 void		urtw_stop(struct ifnet *, int);
481 int		urtw_ioctl(struct ifnet *, u_long, caddr_t);
482 void		urtw_start(struct ifnet *);
483 int		urtw_alloc_rx_data_list(struct urtw_softc *);
484 void		urtw_free_rx_data_list(struct urtw_softc *);
485 int		urtw_alloc_tx_data_list(struct urtw_softc *);
486 void		urtw_free_tx_data_list(struct urtw_softc *);
487 void		urtw_rxeof(usbd_xfer_handle, usbd_private_handle,
488 		    usbd_status);
489 int		urtw_tx_start(struct urtw_softc *,
490 		    struct ieee80211_node *, struct mbuf *, int);
491 void		urtw_txeof_low(usbd_xfer_handle, usbd_private_handle,
492 		    usbd_status);
493 void		urtw_txeof_normal(usbd_xfer_handle, usbd_private_handle,
494 		    usbd_status);
495 void		urtw_next_scan(void *);
496 void		urtw_task(void *);
497 void		urtw_ledusbtask(void *);
498 void		urtw_ledtask(void *);
499 int		urtw_media_change(struct ifnet *);
500 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
501 void		urtw_watchdog(struct ifnet *);
502 void		urtw_set_multi(struct urtw_softc *);
503 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
504 int		urtw_isbmode(uint16_t);
505 uint16_t	urtw_rate2rtl(int rate);
506 uint16_t	urtw_rtl2rate(int);
507 usbd_status	urtw_set_rate(struct urtw_softc *);
508 usbd_status	urtw_update_msr(struct urtw_softc *);
509 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
510 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
511 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
512 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
513 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
514 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
515 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
516 usbd_status	urtw_eprom_ck(struct urtw_softc *);
517 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
518 		    int);
519 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
520 		    uint32_t *);
521 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
522 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
523 usbd_status	urtw_get_macaddr(struct urtw_softc *);
524 usbd_status	urtw_get_txpwr(struct urtw_softc *);
525 usbd_status	urtw_get_rfchip(struct urtw_softc *);
526 usbd_status	urtw_led_init(struct urtw_softc *);
527 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
528 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
529 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
530 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
531 		    uint32_t);
532 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
533 		    uint32_t);
534 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
535 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
536 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
537 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
538 		    uint16_t);
539 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
540 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
541 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
542 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
543 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
544 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
545 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
546 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
547 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
548 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
549 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
550 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
551 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
552 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
553 usbd_status	urtw_open_pipes(struct urtw_softc *);
554 usbd_status	urtw_close_pipes(struct urtw_softc *);
555 usbd_status	urtw_intr_enable(struct urtw_softc *);
556 usbd_status	urtw_intr_disable(struct urtw_softc *);
557 usbd_status	urtw_reset(struct urtw_softc *);
558 usbd_status	urtw_led_on(struct urtw_softc *, int);
559 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
560 usbd_status	urtw_led_blink(struct urtw_softc *);
561 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
562 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
563 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
564 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
565 usbd_status	urtw_rx_setconf(struct urtw_softc *);
566 usbd_status	urtw_rx_enable(struct urtw_softc *);
567 usbd_status	urtw_tx_enable(struct urtw_softc *);
568 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
569 usbd_status	urtw_8187b_reset(struct urtw_softc *);
570 int		urtw_8187b_init(struct ifnet *);
571 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
572 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
573 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
574 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
575 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
576 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
577 
578 int urtw_match(struct device *, void *, void *);
579 void urtw_attach(struct device *, struct device *, void *);
580 int urtw_detach(struct device *, int);
581 int urtw_activate(struct device *, enum devact);
582 
583 struct cfdriver urtw_cd = {
584 	NULL, "urtw", DV_IFNET
585 };
586 
587 const struct cfattach urtw_ca = {
588 	sizeof(struct urtw_softc),
589 	urtw_match,
590 	urtw_attach,
591 	urtw_detach,
592 	urtw_activate,
593 };
594 
595 int
596 urtw_match(struct device *parent, void *match, void *aux)
597 {
598 	struct usb_attach_arg *uaa = aux;
599 
600 	if (uaa->iface != NULL)
601 		return (UMATCH_NONE);
602 
603 	return ((urtw_lookup(uaa->vendor, uaa->product) != NULL) ?
604 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE);
605 }
606 
607 void
608 urtw_attach(struct device *parent, struct device *self, void *aux)
609 {
610 	struct urtw_softc *sc = (struct urtw_softc *)self;
611 	struct usb_attach_arg *uaa = aux;
612 	struct ieee80211com *ic = &sc->sc_ic;
613 	struct ifnet *ifp = &ic->ic_if;
614 	usbd_status error;
615 	uint8_t data8;
616 	uint32_t data;
617 	int i;
618 
619 	sc->sc_udev = uaa->device;
620 	sc->sc_hwrev = urtw_lookup(uaa->vendor, uaa->product)->rev;
621 
622 	printf("%s: ", sc->sc_dev.dv_xname);
623 
624 	if (sc->sc_hwrev & URTW_HWREV_8187) {
625 		urtw_read32_m(sc, URTW_TX_CONF, &data);
626 		data &= URTW_TX_HWREV_MASK;
627 		switch (data) {
628 		case URTW_TX_HWREV_8187_D:
629 			sc->sc_hwrev |= URTW_HWREV_8187_D;
630 			printf("RTL8187 rev D");
631 			break;
632 		case URTW_TX_HWREV_8187B_D:
633 			/*
634 			 * Detect Realtek RTL8187B devices that use
635 			 * USB IDs of RTL8187.
636 			 */
637 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
638 			printf("RTL8187B rev B (early)");
639 			break;
640 		default:
641 			sc->sc_hwrev |= URTW_HWREV_8187_B;
642 			printf("RTL8187 rev 0x%02x", data >> 25);
643 			break;
644 		}
645 	} else {
646 		/* RTL8187B hwrev register. */
647 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
648 		switch (data8) {
649 		case URTW_8187B_HWREV_8187B_B:
650 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
651 			printf("RTL8187B rev B");
652 			break;
653 		case URTW_8187B_HWREV_8187B_D:
654 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
655 			printf("RTL8187B rev D");
656 			break;
657 		case URTW_8187B_HWREV_8187B_E:
658 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
659 			printf("RTL8187B rev E");
660 			break;
661 		default:
662 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
663 			printf("RTL8187B rev 0x%02x", data8);
664 			break;
665 		}
666 	}
667 
668 	urtw_read32_m(sc, URTW_RX, &data);
669 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
670 	    URTW_EEPROM_93C46;
671 
672 	error = urtw_get_rfchip(sc);
673 	if (error != 0)
674 		goto fail;
675 	error = urtw_get_macaddr(sc);
676 	if (error != 0)
677 		goto fail;
678 	error = urtw_get_txpwr(sc);
679 	if (error != 0)
680 		goto fail;
681 	error = urtw_led_init(sc);		/* XXX incompleted */
682 	if (error != 0)
683 		goto fail;
684 
685 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
686 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
687 	sc->sc_currate = 3;
688 	/* XXX for what? */
689 	sc->sc_preamble_mode = 2;
690 
691 	usb_init_task(&sc->sc_task, urtw_task, sc);
692 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc);
693 	timeout_set(&sc->scan_to, urtw_next_scan, sc);
694 	timeout_set(&sc->sc_led_ch, urtw_ledtask, sc);
695 
696 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
697 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
698 	ic->ic_state = IEEE80211_S_INIT;
699 
700 	/* set device capabilities */
701 	ic->ic_caps =
702 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
703 	    IEEE80211_C_TXPMGT |	/* tx power management */
704 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
705 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
706 	    IEEE80211_C_WEP |		/* s/w WEP */
707 	    IEEE80211_C_RSN;		/* WPA/RSN */
708 
709 	/* set supported .11b and .11g rates */
710 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
711 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
712 
713 	/* set supported .11b and .11g channels (1 through 14) */
714 	for (i = 1; i <= 14; i++) {
715 		ic->ic_channels[i].ic_freq =
716 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
717 		ic->ic_channels[i].ic_flags =
718 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
719 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
720 	}
721 
722 	ifp->if_softc = sc;
723 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
724 	if (sc->sc_hwrev & URTW_HWREV_8187) {
725 		ifp->if_init = urtw_init;
726 	} else {
727 		ifp->if_init = urtw_8187b_init;
728 	}
729 	ifp->if_ioctl = urtw_ioctl;
730 	ifp->if_start = urtw_start;
731 	ifp->if_watchdog = urtw_watchdog;
732 	IFQ_SET_READY(&ifp->if_snd);
733 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
734 
735 	if_attach(ifp);
736 	ieee80211_ifattach(ifp);
737 
738 	/* override state transition machine */
739 	sc->sc_newstate = ic->ic_newstate;
740 	ic->ic_newstate = urtw_newstate;
741 	ieee80211_media_init(ifp, urtw_media_change, ieee80211_media_status);
742 
743 #if NBPFILTER > 0
744 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
745 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
746 
747 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
748 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
749 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
750 
751 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
752 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
753 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
754 #endif
755 
756 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
757 	    &sc->sc_dev);
758 
759 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
760 
761 	return;
762 fail:
763 	printf(": %s failed!\n", __func__);
764 }
765 
766 int
767 urtw_detach(struct device *self, int flags)
768 {
769 	struct urtw_softc *sc = (struct urtw_softc *)self;
770 	struct ifnet *ifp = &sc->sc_ic.ic_if;
771 	int s;
772 
773 	s = splusb();
774 
775 	ieee80211_ifdetach(ifp);	/* free all nodes */
776 	if_detach(ifp);
777 
778 	usb_rem_task(sc->sc_udev, &sc->sc_task);
779 	usb_rem_task(sc->sc_udev, &sc->sc_ledtask);
780 	timeout_del(&sc->scan_to);
781 	timeout_del(&sc->sc_led_ch);
782 
783 	/* abort and free xfers */
784 	urtw_free_tx_data_list(sc);
785 	urtw_free_rx_data_list(sc);
786 	urtw_close_pipes(sc);
787 
788 	splx(s);
789 
790 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
791 	    &sc->sc_dev);
792 
793 	return (0);
794 }
795 
796 int
797 urtw_activate(struct device *self, enum devact act)
798 {
799 	switch (act) {
800 	case DVACT_ACTIVATE:
801 		break;
802 	case DVACT_DEACTIVATE:
803 		break;
804 	}
805 
806 	return (0);
807 }
808 
809 usbd_status
810 urtw_close_pipes(struct urtw_softc *sc)
811 {
812 	usbd_status error = 0;
813 
814 	if (sc->sc_rxpipe != NULL) {
815 		error = usbd_close_pipe(sc->sc_rxpipe);
816 		if (error != 0)
817 			goto fail;
818 		sc->sc_rxpipe = NULL;
819 	}
820 	if (sc->sc_txpipe_low != NULL) {
821 		error = usbd_close_pipe(sc->sc_txpipe_low);
822 		if (error != 0)
823 			goto fail;
824 		sc->sc_txpipe_low = NULL;
825 	}
826 	if (sc->sc_txpipe_normal != NULL) {
827 		error = usbd_close_pipe(sc->sc_txpipe_normal);
828 		if (error != 0)
829 			goto fail;
830 		sc->sc_txpipe_normal = NULL;
831 	}
832 fail:
833 	return (error);
834 }
835 
836 usbd_status
837 urtw_open_pipes(struct urtw_softc *sc)
838 {
839 	usbd_status error;
840 
841 	/*
842 	 * NB: there is no way to distinguish each pipes so we need to hardcode
843 	 * pipe numbers
844 	 */
845 
846 	/* tx pipe - low priority packets */
847 	if (sc->sc_hwrev & URTW_HWREV_8187)
848 		error = usbd_open_pipe(sc->sc_iface, 0x2,
849 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
850 	else
851 		error = usbd_open_pipe(sc->sc_iface, 0x6,
852 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
853 	if (error != 0) {
854 		printf("%s: could not open Tx low pipe: %s\n",
855 		    sc->sc_dev.dv_xname, usbd_errstr(error));
856 		goto fail;
857 	}
858 	/* tx pipe - normal priority packets */
859 	if (sc->sc_hwrev & URTW_HWREV_8187)
860 		error = usbd_open_pipe(sc->sc_iface, 0x3,
861 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
862 	else
863 		error = usbd_open_pipe(sc->sc_iface, 0x7,
864 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
865 	if (error != 0) {
866 		printf("%s: could not open Tx normal pipe: %s\n",
867 		    sc->sc_dev.dv_xname, usbd_errstr(error));
868 		goto fail;
869 	}
870 	/* rx pipe */
871 	if (sc->sc_hwrev & URTW_HWREV_8187)
872 		error = usbd_open_pipe(sc->sc_iface, 0x81,
873 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
874 	else
875 		error = usbd_open_pipe(sc->sc_iface, 0x83,
876 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
877 	if (error != 0) {
878 		printf("%s: could not open Rx pipe: %s\n",
879 		    sc->sc_dev.dv_xname, usbd_errstr(error));
880 		goto fail;
881 	}
882 
883 	return (0);
884 fail:
885 	(void)urtw_close_pipes(sc);
886 	return (error);
887 }
888 
889 int
890 urtw_alloc_rx_data_list(struct urtw_softc *sc)
891 {
892 	int i, error;
893 
894 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
895 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
896 
897 		data->sc = sc;
898 
899 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
900 		if (data->xfer == NULL) {
901 			printf("%s: could not allocate rx xfer\n",
902 			    sc->sc_dev.dv_xname);
903 			error = ENOMEM;
904 			goto fail;
905 		}
906 
907 		if (usbd_alloc_buffer(data->xfer, URTW_RX_MAXSIZE) == NULL) {
908 			printf("%s: could not allocate rx buffer\n",
909 			    sc->sc_dev.dv_xname);
910 			error = ENOMEM;
911 			goto fail;
912 		}
913 
914 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
915 		if (data->m == NULL) {
916 			printf("%s: could not allocate rx mbuf\n",
917 			    sc->sc_dev.dv_xname);
918 			error = ENOMEM;
919 			goto fail;
920 		}
921 		MCLGET(data->m, M_DONTWAIT);
922 		if (!(data->m->m_flags & M_EXT)) {
923 			printf("%s: could not allocate rx mbuf cluster\n",
924 			    sc->sc_dev.dv_xname);
925 			error = ENOMEM;
926 			goto fail;
927 		}
928 		data->buf = mtod(data->m, uint8_t *);
929 	}
930 
931 	return (0);
932 
933 fail:
934 	urtw_free_rx_data_list(sc);
935 	return (error);
936 }
937 
938 void
939 urtw_free_rx_data_list(struct urtw_softc *sc)
940 {
941 	int i;
942 
943 	/* Make sure no transfers are pending. */
944 	if (sc->sc_rxpipe != NULL)
945 		usbd_abort_pipe(sc->sc_rxpipe);
946 
947 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
948 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
949 
950 		if (data->xfer != NULL) {
951 			usbd_free_xfer(data->xfer);
952 			data->xfer = NULL;
953 		}
954 		if (data->m != NULL) {
955 			m_freem(data->m);
956 			data->m = NULL;
957 		}
958 	}
959 }
960 
961 int
962 urtw_alloc_tx_data_list(struct urtw_softc *sc)
963 {
964 	int i, error;
965 
966 	for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
967 		struct urtw_tx_data *data = &sc->sc_tx_data[i];
968 
969 		data->sc = sc;
970 		data->ni = NULL;
971 
972 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
973 		if (data->xfer == NULL) {
974 			printf("%s: could not allocate tx xfer\n",
975 			    sc->sc_dev.dv_xname);
976 			error = ENOMEM;
977 			goto fail;
978 		}
979 
980 		data->buf = usbd_alloc_buffer(data->xfer, URTW_TX_MAXSIZE);
981 		if (data->buf == NULL) {
982 			printf("%s: could not allocate tx buffer\n",
983 			    sc->sc_dev.dv_xname);
984 			error = ENOMEM;
985 			goto fail;
986 		}
987 
988 		if (((unsigned long)data->buf) % 4)
989 			printf("%s: warn: unaligned buffer %p\n",
990 			    sc->sc_dev.dv_xname, data->buf);
991 	}
992 
993 	return (0);
994 
995 fail:
996 	urtw_free_tx_data_list(sc);
997 	return (error);
998 }
999 
1000 void
1001 urtw_free_tx_data_list(struct urtw_softc *sc)
1002 {
1003 	struct ieee80211com *ic = &sc->sc_ic;
1004 	int i;
1005 
1006 	/* Make sure no transfers are pending. */
1007 	if (sc->sc_txpipe_low != NULL)
1008 		usbd_abort_pipe(sc->sc_txpipe_low);
1009 	if (sc->sc_txpipe_normal != NULL)
1010 		usbd_abort_pipe(sc->sc_txpipe_normal);
1011 
1012 	for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1013 		struct urtw_tx_data *data = &sc->sc_tx_data[i];
1014 
1015 		if (data->xfer != NULL) {
1016 			usbd_free_xfer(data->xfer);
1017 			data->xfer = NULL;
1018 		}
1019 		if (data->ni != NULL) {
1020 			ieee80211_release_node(ic, data->ni);
1021 			data->ni = NULL;
1022 		}
1023 	}
1024 }
1025 
1026 int
1027 urtw_media_change(struct ifnet *ifp)
1028 {
1029 	int error;
1030 
1031 	error = ieee80211_media_change(ifp);
1032 	if (error != ENETRESET)
1033 		return (error);
1034 
1035 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1036 	    (IFF_UP | IFF_RUNNING))
1037 		ifp->if_init(ifp);
1038 
1039 	return (0);
1040 }
1041 
1042 int
1043 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1044 {
1045 	struct urtw_softc *sc = ic->ic_if.if_softc;
1046 
1047 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1048 	timeout_del(&sc->scan_to);
1049 
1050 	/* do it in a process context */
1051 	sc->sc_state = nstate;
1052 	sc->sc_arg = arg;
1053 	usb_add_task(sc->sc_udev, &sc->sc_task);
1054 
1055 	return (0);
1056 }
1057 
1058 usbd_status
1059 urtw_led_init(struct urtw_softc *sc)
1060 {
1061 	uint32_t rev;
1062 	usbd_status error;
1063 
1064 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1065 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1066 	if (error != 0)
1067 		goto fail;
1068 
1069 	switch (rev & URTW_EPROM_CID_MASK) {
1070 	case URTW_EPROM_CID_ALPHA0:
1071 		sc->sc_strategy = URTW_SW_LED_MODE1;
1072 		break;
1073 	case URTW_EPROM_CID_SERCOMM_PS:
1074 		sc->sc_strategy = URTW_SW_LED_MODE3;
1075 		break;
1076 	case URTW_EPROM_CID_HW_LED:
1077 		sc->sc_strategy = URTW_HW_LED;
1078 		break;
1079 	case URTW_EPROM_CID_RSVD0:
1080 	case URTW_EPROM_CID_RSVD1:
1081 	default:
1082 		sc->sc_strategy = URTW_SW_LED_MODE0;
1083 		break;
1084 	}
1085 
1086 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1087 
1088 fail:
1089 	return (error);
1090 }
1091 
1092 usbd_status
1093 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1094     uint16_t data)
1095 {
1096 	usb_device_request_t req;
1097 
1098 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1099 	req.bRequest = URTW_8187_SETREGS_REQ;
1100 	USETW(req.wValue, addr);
1101 	USETW(req.wIndex, index);
1102 	USETW(req.wLength, sizeof(uint16_t));
1103 
1104 	return (usbd_do_request(sc->sc_udev, &req, &data));
1105 }
1106 
1107 usbd_status
1108 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1109 {
1110 	int i;
1111 	int16_t bit;
1112 	uint8_t rlen = 12, wlen = 6;
1113 	uint16_t o1, o2, o3, tmp;
1114 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1115 	uint32_t mask = 0x80000000, value = 0;
1116 	usbd_status error;
1117 
1118 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1119 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1120 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1121 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1122 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1123 	o1 &= ~0xf;
1124 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1125 	DELAY(5);
1126 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1127 	DELAY(5);
1128 
1129 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1130 		bit = ((d2w & mask) != 0) ? 1 : 0;
1131 
1132 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1133 		DELAY(2);
1134 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1135 		    URTW_BB_HOST_BANG_CLK);
1136 		DELAY(2);
1137 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1138 		    URTW_BB_HOST_BANG_CLK);
1139 		DELAY(2);
1140 		mask = mask >> 1;
1141 		if (i == 2)
1142 			break;
1143 		bit = ((d2w & mask) != 0) ? 1 : 0;
1144 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1145 		    URTW_BB_HOST_BANG_CLK);
1146 		DELAY(2);
1147 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1148 		    URTW_BB_HOST_BANG_CLK);
1149 		DELAY(2);
1150 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1151 		DELAY(1);
1152 	}
1153 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1154 	    URTW_BB_HOST_BANG_CLK);
1155 	DELAY(2);
1156 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1157 	DELAY(2);
1158 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1159 	DELAY(2);
1160 
1161 	mask = 0x800;
1162 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1163 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1164 		    o1 | URTW_BB_HOST_BANG_RW);
1165 		DELAY(2);
1166 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1167 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1168 		DELAY(2);
1169 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1170 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1171 		DELAY(2);
1172 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1173 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1174 		DELAY(2);
1175 
1176 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1177 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1178 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1179 		    o1 | URTW_BB_HOST_BANG_RW);
1180 		DELAY(2);
1181 	}
1182 
1183 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1184 	    URTW_BB_HOST_BANG_RW);
1185 	DELAY(2);
1186 
1187 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1188 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1189 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1190 
1191 	if (data != NULL)
1192 		*data = value;
1193 fail:
1194 	return (error);
1195 }
1196 
1197 usbd_status
1198 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1199 {
1200 	uint16_t d80, d82, d84;
1201 	usbd_status error;
1202 
1203 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1204 	d80 &= 0xfff3;
1205 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1206 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1207 	d84 &= 0xfff0;
1208 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1209 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1210 	DELAY(10);
1211 
1212 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1213 	DELAY(2);
1214 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1215 	DELAY(10);
1216 
1217 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1218 	if (error != 0)
1219 		goto fail;
1220 
1221 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1222 	DELAY(10);
1223 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1224 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1225 	usbd_delay_ms(sc->sc_udev, 2);
1226 fail:
1227 	return (error);
1228 }
1229 
1230 usbd_status
1231 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1232 {
1233 	uint32_t data;
1234 	usbd_status error;
1235 
1236 	*ret = 1;
1237 
1238 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1239 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1240 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1241 	usbd_delay_ms(sc->sc_udev, 500);
1242 
1243 	urtw_8225_write(sc, 0x0, 0x1b7);
1244 
1245 	error = urtw_8225_read(sc, 0x8, &data);
1246 	if (error != 0)
1247 		goto fail;
1248 	if (data != 0x588)
1249 		*ret = 0;
1250 	else {
1251 		error = urtw_8225_read(sc, 0x9, &data);
1252 		if (error != 0)
1253 			goto fail;
1254 		if (data != 0x700)
1255 			*ret = 0;
1256 	}
1257 
1258 	urtw_8225_write(sc, 0x0, 0xb7);
1259 fail:
1260 	return (error);
1261 }
1262 
1263 usbd_status
1264 urtw_get_rfchip(struct urtw_softc *sc)
1265 {
1266 	struct urtw_rf *rf = &sc->sc_rf;
1267 	int ret;
1268 	uint32_t data;
1269 	usbd_status error;
1270 
1271 	rf->rf_sc = sc;
1272 
1273 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1274 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1275 		if (error != 0)
1276 			panic("unsupported RF chip");
1277 			/* NOTREACHED */
1278 		switch (data & 0xff) {
1279 		case URTW_EPROM_RFCHIPID_RTL8225U:
1280 			error = urtw_8225_isv2(sc, &ret);
1281 			if (error != 0)
1282 				goto fail;
1283 			if (ret == 0) {
1284 				rf->init = urtw_8225_rf_init;
1285 				rf->set_chan = urtw_8225_rf_set_chan;
1286 				rf->set_sens = urtw_8225_rf_set_sens;
1287 				printf(", RFv1");
1288 			} else {
1289 				rf->init = urtw_8225v2_rf_init;
1290 				rf->set_chan = urtw_8225v2_rf_set_chan;
1291 				rf->set_sens = NULL;
1292 				printf(", RFv2");
1293 			}
1294 			break;
1295 		default:
1296 			goto fail;
1297 		}
1298 	} else {
1299 		rf->init = urtw_8225v2_b_rf_init;
1300 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1301 		rf->set_sens = NULL;
1302 	}
1303 
1304 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1305 	rf->sens = URTW_8225_RF_DEF_SENS;
1306 
1307 	return (0);
1308 
1309 fail:
1310 	panic("unsupported RF chip %d\n", data & 0xff);
1311 	/* NOTREACHED */
1312 }
1313 
1314 usbd_status
1315 urtw_get_txpwr(struct urtw_softc *sc)
1316 {
1317 	int i, j;
1318 	uint32_t data;
1319 	usbd_status error;
1320 
1321 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1322 	if (error != 0)
1323 		goto fail;
1324 	sc->sc_txpwr_cck_base = data & 0xf;
1325 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1326 
1327 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1328 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1329 		if (error != 0)
1330 			goto fail;
1331 		sc->sc_txpwr_cck[i] = data & 0xf;
1332 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1333 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1334 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1335 	}
1336 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1337 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1338 		if (error != 0)
1339 			goto fail;
1340 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1341 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1342 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1343 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1344 	}
1345 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1346 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1347 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1348 			    &data);
1349 			if (error != 0)
1350 				goto fail;
1351 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1352 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1353 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1354 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1355 			    (data & 0xf000) >> 12;
1356 		}
1357 	} else {
1358 		/* Channel 11. */
1359 		error = urtw_eprom_read32(sc, 0x1b, &data);
1360 		if (error != 0)
1361 			goto fail;
1362 		sc->sc_txpwr_cck[11] = data & 0xf;
1363 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1364 
1365 		/* Channel 12. */
1366 		error = urtw_eprom_read32(sc, 0xa, &data);
1367 		if (error != 0)
1368 			goto fail;
1369 		sc->sc_txpwr_cck[12] = data & 0xf;
1370 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1371 
1372 		/* Channel 13, 14. */
1373 		error = urtw_eprom_read32(sc, 0x1c, &data);
1374 		if (error != 0)
1375 			goto fail;
1376 		sc->sc_txpwr_cck[13] = data & 0xf;
1377 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1378 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1379 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1380 	}
1381 fail:
1382 	return (error);
1383 }
1384 
1385 usbd_status
1386 urtw_get_macaddr(struct urtw_softc *sc)
1387 {
1388 	struct ieee80211com *ic = &sc->sc_ic;
1389 	usbd_status error;
1390 	uint32_t data;
1391 
1392 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1393 	if (error != 0)
1394 		goto fail;
1395 	ic->ic_myaddr[0] = data & 0xff;
1396 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1397 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1398 	if (error != 0)
1399 		goto fail;
1400 	ic->ic_myaddr[2] = data & 0xff;
1401 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1402 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1403 	if (error != 0)
1404 		goto fail;
1405 	ic->ic_myaddr[4] = data & 0xff;
1406 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1407 fail:
1408 	return (error);
1409 }
1410 
1411 usbd_status
1412 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1413 {
1414 #define URTW_READCMD_LEN		3
1415 	int addrlen, i;
1416 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1417 	usbd_status error;
1418 
1419 	/* NB: make sure the buffer is initialized */
1420 	*data = 0;
1421 
1422 	/* enable EPROM programming */
1423 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1424 	DELAY(URTW_EPROM_DELAY);
1425 
1426 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1427 	if (error != 0)
1428 		goto fail;
1429 	error = urtw_eprom_ck(sc);
1430 	if (error != 0)
1431 		goto fail;
1432 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1433 	if (error != 0)
1434 		goto fail;
1435 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1436 		addrlen = 8;
1437 		addrstr[0] = addr & (1 << 7);
1438 		addrstr[1] = addr & (1 << 6);
1439 		addrstr[2] = addr & (1 << 5);
1440 		addrstr[3] = addr & (1 << 4);
1441 		addrstr[4] = addr & (1 << 3);
1442 		addrstr[5] = addr & (1 << 2);
1443 		addrstr[6] = addr & (1 << 1);
1444 		addrstr[7] = addr & (1 << 0);
1445 	} else {
1446 		addrlen=6;
1447 		addrstr[0] = addr & (1 << 5);
1448 		addrstr[1] = addr & (1 << 4);
1449 		addrstr[2] = addr & (1 << 3);
1450 		addrstr[3] = addr & (1 << 2);
1451 		addrstr[4] = addr & (1 << 1);
1452 		addrstr[5] = addr & (1 << 0);
1453 	}
1454 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1455 	if (error != 0)
1456 		goto fail;
1457 
1458 	error = urtw_eprom_writebit(sc, 0);
1459 	if (error != 0)
1460 		goto fail;
1461 
1462 	for (i = 0; i < 16; i++) {
1463 		error = urtw_eprom_ck(sc);
1464 		if (error != 0)
1465 			goto fail;
1466 		error = urtw_eprom_readbit(sc, &data16);
1467 		if (error != 0)
1468 			goto fail;
1469 
1470 		(*data) |= (data16 << (15 - i));
1471 	}
1472 
1473 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1474 	if (error != 0)
1475 		goto fail;
1476 	error = urtw_eprom_ck(sc);
1477 	if (error != 0)
1478 		goto fail;
1479 
1480 	/* now disable EPROM programming */
1481 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1482 fail:
1483 	return (error);
1484 #undef URTW_READCMD_LEN
1485 }
1486 
1487 usbd_status
1488 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1489 {
1490 	uint8_t data8;
1491 	usbd_status error;
1492 
1493 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1494 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1495 	DELAY(URTW_EPROM_DELAY);
1496 
1497 fail:
1498 	return (error);
1499 }
1500 
1501 usbd_status
1502 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1503 {
1504 	int i = 0;
1505 	usbd_status error = 0;
1506 
1507 	for (i = 0; i < buflen; i++) {
1508 		error = urtw_eprom_writebit(sc, buf[i]);
1509 		if (error != 0)
1510 			goto fail;
1511 		error = urtw_eprom_ck(sc);
1512 		if (error != 0)
1513 			goto fail;
1514 	}
1515 fail:
1516 	return (error);
1517 }
1518 
1519 usbd_status
1520 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1521 {
1522 	uint8_t data;
1523 	usbd_status error;
1524 
1525 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1526 	if (bit != 0)
1527 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1528 	else
1529 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1530 	DELAY(URTW_EPROM_DELAY);
1531 fail:
1532 	return (error);
1533 }
1534 
1535 usbd_status
1536 urtw_eprom_ck(struct urtw_softc *sc)
1537 {
1538 	uint8_t data;
1539 	usbd_status error;
1540 
1541 	/* masking */
1542 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1543 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1544 	DELAY(URTW_EPROM_DELAY);
1545 	/* unmasking */
1546 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1547 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1548 	DELAY(URTW_EPROM_DELAY);
1549 fail:
1550 	return (error);
1551 }
1552 
1553 usbd_status
1554 urtw_eprom_cs(struct urtw_softc *sc, int able)
1555 {
1556 	uint8_t data;
1557 	usbd_status error;
1558 
1559 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1560 	if (able == URTW_EPROM_ENABLE)
1561 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1562 	else
1563 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1564 	DELAY(URTW_EPROM_DELAY);
1565 fail:
1566 	return (error);
1567 }
1568 
1569 usbd_status
1570 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1571 {
1572 	usb_device_request_t req;
1573 	usbd_status error;
1574 
1575 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1576 	req.bRequest = URTW_8187_GETREGS_REQ;
1577 	USETW(req.wValue, val | 0xff00);
1578 	USETW(req.wIndex, idx & 0x03);
1579 	USETW(req.wLength, sizeof(uint8_t));
1580 
1581 	error = usbd_do_request(sc->sc_udev, &req, data);
1582 	return (error);
1583 }
1584 
1585 usbd_status
1586 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1587 {
1588 	usb_device_request_t req;
1589 	usbd_status error;
1590 
1591 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1592 	req.bRequest = URTW_8187_GETREGS_REQ;
1593 	USETW(req.wValue, val | 0xfe00);
1594 	USETW(req.wIndex, 0);
1595 	USETW(req.wLength, sizeof(uint8_t));
1596 
1597 	error = usbd_do_request(sc->sc_udev, &req, data);
1598 	return (error);
1599 }
1600 
1601 usbd_status
1602 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1603 {
1604 	usb_device_request_t req;
1605 	usbd_status error;
1606 
1607 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1608 	req.bRequest = URTW_8187_GETREGS_REQ;
1609 	USETW(req.wValue, val | 0xff00);
1610 	USETW(req.wIndex, idx & 0x03);
1611 	USETW(req.wLength, sizeof(uint16_t));
1612 
1613 	error = usbd_do_request(sc->sc_udev, &req, data);
1614 	return (error);
1615 }
1616 
1617 usbd_status
1618 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1619 {
1620 	usb_device_request_t req;
1621 	usbd_status error;
1622 
1623 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1624 	req.bRequest = URTW_8187_GETREGS_REQ;
1625 	USETW(req.wValue, val | 0xff00);
1626 	USETW(req.wIndex, idx & 0x03);
1627 	USETW(req.wLength, sizeof(uint32_t));
1628 
1629 	error = usbd_do_request(sc->sc_udev, &req, data);
1630 	return (error);
1631 }
1632 
1633 usbd_status
1634 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1635 {
1636 	usb_device_request_t req;
1637 
1638 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1639 	req.bRequest = URTW_8187_SETREGS_REQ;
1640 	USETW(req.wValue, val | 0xff00);
1641 	USETW(req.wIndex, idx & 0x03);
1642 	USETW(req.wLength, sizeof(uint8_t));
1643 
1644 	return (usbd_do_request(sc->sc_udev, &req, &data));
1645 }
1646 
1647 usbd_status
1648 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1649 {
1650 	usb_device_request_t req;
1651 
1652 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1653 	req.bRequest = URTW_8187_SETREGS_REQ;
1654 	USETW(req.wValue, val | 0xfe00);
1655 	USETW(req.wIndex, 0);
1656 	USETW(req.wLength, sizeof(uint8_t));
1657 
1658 	return (usbd_do_request(sc->sc_udev, &req, &data));
1659 }
1660 
1661 usbd_status
1662 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1663 {
1664 	usb_device_request_t req;
1665 
1666 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1667 	req.bRequest = URTW_8187_SETREGS_REQ;
1668 	USETW(req.wValue, val | 0xff00);
1669 	USETW(req.wIndex, idx & 0x03);
1670 	USETW(req.wLength, sizeof(uint16_t));
1671 
1672 	return (usbd_do_request(sc->sc_udev, &req, &data));
1673 }
1674 
1675 usbd_status
1676 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1677 {
1678 	usb_device_request_t req;
1679 
1680 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1681 	req.bRequest = URTW_8187_SETREGS_REQ;
1682 	USETW(req.wValue, val | 0xff00);
1683 	USETW(req.wIndex, idx & 0x03);
1684 	USETW(req.wLength, sizeof(uint32_t));
1685 
1686 	return (usbd_do_request(sc->sc_udev, &req, &data));
1687 }
1688 
1689 static usbd_status
1690 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1691 {
1692 	uint8_t data;
1693 	usbd_status error;
1694 
1695 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1696 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1697 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1698 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1699 fail:
1700 	return (error);
1701 }
1702 
1703 usbd_status
1704 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1705 {
1706 	uint8_t data;
1707 	usbd_status error;
1708 
1709 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1710 	if (error)
1711 		goto fail;
1712 
1713 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1714 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1715 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1716 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1717 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1718 
1719 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1720 	if (error)
1721 		goto fail;
1722 fail:
1723 	return (error);
1724 }
1725 
1726 usbd_status
1727 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1728 {
1729 	uint8_t data;
1730 	usbd_status error;
1731 
1732 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1733 	if (error)
1734 		goto fail;
1735 
1736 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1737 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1738 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1739 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1740 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1741 
1742 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1743 	if (error)
1744 		goto fail;
1745 fail:
1746 	return (error);
1747 }
1748 
1749 usbd_status
1750 urtw_intr_disable(struct urtw_softc *sc)
1751 {
1752 	usbd_status error;
1753 
1754 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1755 fail:
1756 	return (error);
1757 }
1758 
1759 usbd_status
1760 urtw_reset(struct urtw_softc *sc)
1761 {
1762 	uint8_t data;
1763 	usbd_status error;
1764 
1765 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1766 	if (error)
1767 		goto fail;
1768 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1769 	if (error)
1770 		goto fail;
1771 
1772 	error = urtw_intr_disable(sc);
1773 	if (error)
1774 		goto fail;
1775 	usbd_delay_ms(sc->sc_udev, 100);
1776 
1777 	error = urtw_write8e(sc, 0x18, 0x10);
1778 	if (error != 0)
1779 		goto fail;
1780 	error = urtw_write8e(sc, 0x18, 0x11);
1781 	if (error != 0)
1782 		goto fail;
1783 	error = urtw_write8e(sc, 0x18, 0x00);
1784 	if (error != 0)
1785 		goto fail;
1786 	usbd_delay_ms(sc->sc_udev, 100);
1787 
1788 	urtw_read8_m(sc, URTW_CMD, &data);
1789 	data = (data & 2) | URTW_CMD_RST;
1790 	urtw_write8_m(sc, URTW_CMD, data);
1791 	usbd_delay_ms(sc->sc_udev, 100);
1792 
1793 	urtw_read8_m(sc, URTW_CMD, &data);
1794 	if (data & URTW_CMD_RST) {
1795 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
1796 		goto fail;
1797 	}
1798 
1799 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1800 	if (error)
1801 		goto fail;
1802 	usbd_delay_ms(sc->sc_udev, 100);
1803 
1804 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1805 	if (error)
1806 		goto fail;
1807 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1808 	if (error)
1809 		goto fail;
1810 fail:
1811 	return (error);
1812 }
1813 
1814 usbd_status
1815 urtw_led_on(struct urtw_softc *sc, int type)
1816 {
1817 	usbd_status error;
1818 
1819 	if (type == URTW_LED_GPIO) {
1820 		switch (sc->sc_gpio_ledpin) {
1821 		case URTW_LED_PIN_GPIO0:
1822 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1823 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1824 			break;
1825 		default:
1826 			panic("unsupported LED PIN type 0x%x",
1827 			    sc->sc_gpio_ledpin);
1828 			/* NOTREACHED */
1829 		}
1830 	} else {
1831 		panic("unsupported LED type 0x%x", type);
1832 		/* NOTREACHED */
1833 	}
1834 
1835 	sc->sc_gpio_ledon = 1;
1836 fail:
1837 	return (error);
1838 }
1839 
1840 static usbd_status
1841 urtw_led_off(struct urtw_softc *sc, int type)
1842 {
1843 	usbd_status error;
1844 
1845 	if (type == URTW_LED_GPIO) {
1846 		switch (sc->sc_gpio_ledpin) {
1847 		case URTW_LED_PIN_GPIO0:
1848 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1849 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1850 			break;
1851 		default:
1852 			panic("unsupported LED PIN type 0x%x",
1853 			    sc->sc_gpio_ledpin);
1854 			/* NOTREACHED */
1855 		}
1856 	} else {
1857 		panic("unsupported LED type 0x%x", type);
1858 		/* NOTREACHED */
1859 	}
1860 
1861 	sc->sc_gpio_ledon = 0;
1862 
1863 fail:
1864 	return (error);
1865 }
1866 
1867 usbd_status
1868 urtw_led_mode0(struct urtw_softc *sc, int mode)
1869 {
1870 	struct timeval t;
1871 
1872 	switch (mode) {
1873 	case URTW_LED_CTL_POWER_ON:
1874 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1875 		break;
1876 	case URTW_LED_CTL_TX:
1877 		if (sc->sc_gpio_ledinprogress == 1)
1878 			return (0);
1879 
1880 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1881 		sc->sc_gpio_blinktime = 2;
1882 		break;
1883 	case URTW_LED_CTL_LINK:
1884 		sc->sc_gpio_ledstate = URTW_LED_ON;
1885 		break;
1886 	default:
1887 		panic("unsupported LED mode 0x%x", mode);
1888 		/* NOTREACHED */
1889 	}
1890 
1891 	switch (sc->sc_gpio_ledstate) {
1892 	case URTW_LED_ON:
1893 		if (sc->sc_gpio_ledinprogress != 0)
1894 			break;
1895 		urtw_led_on(sc, URTW_LED_GPIO);
1896 		break;
1897 	case URTW_LED_BLINK_NORMAL:
1898 		if (sc->sc_gpio_ledinprogress != 0)
1899 			break;
1900 		sc->sc_gpio_ledinprogress = 1;
1901 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1902 			URTW_LED_OFF : URTW_LED_ON;
1903 		t.tv_sec = 0;
1904 		t.tv_usec = 100 * 1000L;
1905 		timeout_add(&sc->sc_led_ch, tvtohz(&t));
1906 		break;
1907 	case URTW_LED_POWER_ON_BLINK:
1908 		urtw_led_on(sc, URTW_LED_GPIO);
1909 		usbd_delay_ms(sc->sc_udev, 100);
1910 		urtw_led_off(sc, URTW_LED_GPIO);
1911 		break;
1912 	default:
1913 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1914 		/* NOTREACHED */
1915 	}
1916 	return (0);
1917 }
1918 
1919 usbd_status
1920 urtw_led_mode1(struct urtw_softc *sc, int mode)
1921 {
1922 	return (USBD_INVAL);
1923 }
1924 
1925 usbd_status
1926 urtw_led_mode2(struct urtw_softc *sc, int mode)
1927 {
1928 	return (USBD_INVAL);
1929 }
1930 
1931 usbd_status
1932 urtw_led_mode3(struct urtw_softc *sc, int mode)
1933 {
1934 	return (USBD_INVAL);
1935 }
1936 
1937 void
1938 urtw_ledusbtask(void *arg)
1939 {
1940 	struct urtw_softc *sc = arg;
1941 
1942 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1943 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1944 
1945 	urtw_led_blink(sc);
1946 }
1947 
1948 void
1949 urtw_ledtask(void *arg)
1950 {
1951 	struct urtw_softc *sc = arg;
1952 
1953 	/*
1954 	 * NB: to change a status of the led we need at least a sleep so we
1955 	 * can't do it here
1956 	 */
1957 	usb_add_task(sc->sc_udev, &sc->sc_ledtask);
1958 }
1959 
1960 usbd_status
1961 urtw_led_ctl(struct urtw_softc *sc, int mode)
1962 {
1963 	usbd_status error = 0;
1964 
1965 	switch (sc->sc_strategy) {
1966 	case URTW_SW_LED_MODE0:
1967 		error = urtw_led_mode0(sc, mode);
1968 		break;
1969 	case URTW_SW_LED_MODE1:
1970 		error = urtw_led_mode1(sc, mode);
1971 		break;
1972 	case URTW_SW_LED_MODE2:
1973 		error = urtw_led_mode2(sc, mode);
1974 		break;
1975 	case URTW_SW_LED_MODE3:
1976 		error = urtw_led_mode3(sc, mode);
1977 		break;
1978 	default:
1979 		panic("unsupported LED mode %d\n", sc->sc_strategy);
1980 		/* NOTREACHED */
1981 	}
1982 
1983 	return (error);
1984 }
1985 
1986 usbd_status
1987 urtw_led_blink(struct urtw_softc *sc)
1988 {
1989 	struct timeval t;
1990 	uint8_t ing = 0;
1991 	usbd_status error;
1992 
1993 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1994 		error = urtw_led_on(sc, URTW_LED_GPIO);
1995 	else
1996 		error = urtw_led_off(sc, URTW_LED_GPIO);
1997 	sc->sc_gpio_blinktime--;
1998 	if (sc->sc_gpio_blinktime == 0)
1999 		ing = 1;
2000 	else {
2001 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
2002 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
2003 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
2004 			ing = 1;
2005 	}
2006 	if (ing == 1) {
2007 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2008 		    sc->sc_gpio_ledon == 0)
2009 			error = urtw_led_on(sc, URTW_LED_GPIO);
2010 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2011 		    sc->sc_gpio_ledon == 1)
2012 			error = urtw_led_off(sc, URTW_LED_GPIO);
2013 
2014 		sc->sc_gpio_blinktime = 0;
2015 		sc->sc_gpio_ledinprogress = 0;
2016 		return (0);
2017 	}
2018 
2019 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2020 	    URTW_LED_ON : URTW_LED_OFF;
2021 
2022 	switch (sc->sc_gpio_ledstate) {
2023 	case URTW_LED_BLINK_NORMAL:
2024 		t.tv_sec = 0;
2025 		t.tv_usec = 100 * 1000L;
2026 		timeout_add(&sc->sc_led_ch, tvtohz(&t));
2027 		break;
2028 	default:
2029 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2030 		/* NOTREACHED */
2031 	}
2032 	return (0);
2033 }
2034 
2035 usbd_status
2036 urtw_update_msr(struct urtw_softc *sc)
2037 {
2038 	struct ieee80211com *ic = &sc->sc_ic;
2039 	uint8_t data;
2040 	usbd_status error;
2041 
2042 	urtw_read8_m(sc, URTW_MSR, &data);
2043 	data &= ~URTW_MSR_LINK_MASK;
2044 
2045 	/* Should always be set. */
2046 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2047 		data |= URTW_MSR_LINK_ENEDCA;
2048 
2049 	if (sc->sc_state == IEEE80211_S_RUN) {
2050 		switch (ic->ic_opmode) {
2051 		case IEEE80211_M_STA:
2052 		case IEEE80211_M_MONITOR:
2053 			data |= URTW_MSR_LINK_STA;
2054 			break;
2055 		default:
2056 			panic("unsupported operation mode 0x%x\n",
2057 			    ic->ic_opmode);
2058 			/* NOTREACHED */
2059 		}
2060 	} else
2061 		data |= URTW_MSR_LINK_NONE;
2062 
2063 	urtw_write8_m(sc, URTW_MSR, data);
2064 fail:
2065 	return (error);
2066 }
2067 
2068 uint16_t
2069 urtw_rate2rtl(int rate)
2070 {
2071 	int i;
2072 
2073 	for (i = 0; i < nitems(urtw_ratetable); i++) {
2074 		if (rate == urtw_ratetable[i].reg)
2075 			return (urtw_ratetable[i].val);
2076 	}
2077 
2078 	return (3);
2079 }
2080 
2081 uint16_t
2082 urtw_rtl2rate(int rate)
2083 {
2084 	int i;
2085 
2086 	for (i = 0; i < nitems(urtw_ratetable); i++) {
2087 		if (rate == urtw_ratetable[i].val)
2088 			return (urtw_ratetable[i].reg);
2089 	}
2090 
2091 	return (0);
2092 }
2093 
2094 usbd_status
2095 urtw_set_rate(struct urtw_softc *sc)
2096 {
2097 	int i, basic_rate, min_rr_rate, max_rr_rate;
2098 	uint16_t data;
2099 	usbd_status error;
2100 
2101 	basic_rate = urtw_rate2rtl(48);
2102 	min_rr_rate = urtw_rate2rtl(12);
2103 	max_rr_rate = urtw_rate2rtl(48);
2104 
2105 	urtw_write8_m(sc, URTW_RESP_RATE,
2106 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2107 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2108 
2109 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2110 	data &= ~URTW_BRSR_MBR_8185;
2111 
2112 	for (i = 0; i <= basic_rate; i++)
2113 		data |= (1 << i);
2114 
2115 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2116 fail:
2117 	return (error);
2118 }
2119 
2120 usbd_status
2121 urtw_intr_enable(struct urtw_softc *sc)
2122 {
2123 	usbd_status error;
2124 
2125 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2126 fail:
2127 	return (error);
2128 }
2129 
2130 usbd_status
2131 urtw_rx_setconf(struct urtw_softc *sc)
2132 {
2133 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2134 	struct ieee80211com *ic = &sc->sc_ic;
2135 	uint32_t data;
2136 	usbd_status error;
2137 
2138 	urtw_read32_m(sc, URTW_RX, &data);
2139 	data = data &~ URTW_RX_FILTER_MASK;
2140 #if 0
2141 	data = data | URTW_RX_FILTER_CTL;
2142 #endif
2143 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2144 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2145 
2146 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2147 		data = data | URTW_RX_FILTER_ICVERR;
2148 		data = data | URTW_RX_FILTER_PWR;
2149 	}
2150 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2151 		data = data | URTW_RX_FILTER_CRCERR;
2152 
2153 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2154 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2155 		data = data | URTW_RX_FILTER_ALLMAC;
2156 	} else {
2157 		data = data | URTW_RX_FILTER_NICMAC;
2158 		data = data | URTW_RX_CHECK_BSSID;
2159 	}
2160 
2161 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2162 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2163 	data = data &~ URTW_MAX_RX_DMA_MASK;
2164 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2165 
2166 	urtw_write32_m(sc, URTW_RX, data);
2167 fail:
2168 	return (error);
2169 }
2170 
2171 usbd_status
2172 urtw_rx_enable(struct urtw_softc *sc)
2173 {
2174 	int i;
2175 	struct urtw_rx_data *rx_data;
2176 	uint8_t data;
2177 	usbd_status error;
2178 
2179 	/*
2180 	 * Start up the receive pipe.
2181 	 */
2182 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2183 		rx_data = &sc->sc_rx_data[i];
2184 
2185 		usbd_setup_xfer(rx_data->xfer, sc->sc_rxpipe, rx_data,
2186 		    rx_data->buf, MCLBYTES, USBD_SHORT_XFER_OK,
2187 		    USBD_NO_TIMEOUT, urtw_rxeof);
2188 		error = usbd_transfer(rx_data->xfer);
2189 		if (error != USBD_IN_PROGRESS && error != 0) {
2190 			printf("%s: could not queue Rx transfer\n",
2191 			    sc->sc_dev.dv_xname);
2192 			goto fail;
2193 		}
2194 	}
2195 
2196 	error = urtw_rx_setconf(sc);
2197 	if (error != 0)
2198 		goto fail;
2199 
2200 	urtw_read8_m(sc, URTW_CMD, &data);
2201 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2202 fail:
2203 	return (error);
2204 }
2205 
2206 usbd_status
2207 urtw_tx_enable(struct urtw_softc *sc)
2208 {
2209 	uint8_t data8;
2210 	uint32_t data;
2211 	usbd_status error;
2212 
2213 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2214 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2215 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2216 		    URTW_CW_CONF_PERPACKET_RETRY);
2217 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2218 
2219  		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2220 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2221 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2222 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2223 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2224 
2225 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2226 		data &= ~URTW_TX_LOOPBACK_MASK;
2227 		data |= URTW_TX_LOOPBACK_NONE;
2228 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2229 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2230 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2231 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2232 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2233 		data &= ~URTW_TX_SWPLCPLEN;
2234 		data |= URTW_TX_NOICV;
2235 		urtw_write32_m(sc, URTW_TX_CONF, data);
2236 	} else {
2237 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2238 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2239 		    URTW_TX_LONGRETRY;
2240 		urtw_write32_m(sc, URTW_TX_CONF, data);
2241 	}
2242 
2243 	urtw_read8_m(sc, URTW_CMD, &data8);
2244 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2245 fail:
2246 	return (error);
2247 }
2248 
2249 int
2250 urtw_init(struct ifnet *ifp)
2251 {
2252 	struct urtw_softc *sc = ifp->if_softc;
2253 	struct urtw_rf *rf = &sc->sc_rf;
2254 	struct ieee80211com *ic = &sc->sc_ic;
2255 	usbd_status error;
2256 	int ret;
2257 
2258 	urtw_stop(ifp, 0);
2259 
2260 	error = urtw_reset(sc);
2261 	if (error)
2262 		goto fail;
2263 
2264 	urtw_write8_m(sc, 0x85, 0);
2265 	urtw_write8_m(sc, URTW_GPIO, 0);
2266 
2267 	/* for led */
2268 	urtw_write8_m(sc, 0x85, 4);
2269 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2270 	if (error != 0)
2271 		goto fail;
2272 
2273 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2274 	if (error)
2275 		goto fail;
2276 
2277 	/* applying MAC address again. */
2278 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2279 	urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)ic->ic_myaddr)[0]);
2280 	urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)ic->ic_myaddr)[1] & 0xffff);
2281 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2282 	if (error)
2283 		goto fail;
2284 
2285 	error = urtw_update_msr(sc);
2286 	if (error)
2287 		goto fail;
2288 
2289 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2290 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2291 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2292 	error = urtw_set_rate(sc);
2293 	if (error != 0)
2294 		goto fail;
2295 
2296 	error = rf->init(rf);
2297 	if (error != 0)
2298 		goto fail;
2299 	if (rf->set_sens != NULL)
2300 		rf->set_sens(rf);
2301 
2302 	urtw_write16_m(sc, 0x5e, 1);
2303 	urtw_write16_m(sc, 0xfe, 0x10);
2304 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2305 	urtw_write8_m(sc, 0xff, 0x60);
2306 	urtw_write16_m(sc, 0x5e, 0);
2307 	urtw_write8_m(sc, 0x85, 4);
2308 
2309 	error = urtw_intr_enable(sc);
2310 	if (error != 0)
2311 		goto fail;
2312 
2313 	/* reset softc variables */
2314 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
2315 	sc->sc_txtimer = 0;
2316 
2317 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2318 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2319 		if (error != 0) {
2320 			printf("%s: could not set configuration no\n",
2321 			    sc->sc_dev.dv_xname);
2322 			goto fail;
2323 		}
2324 		/* get the first interface handle */
2325 		error = usbd_device2interface_handle(sc->sc_udev,
2326 		    URTW_IFACE_INDEX, &sc->sc_iface);
2327 		if (error != 0) {
2328 			printf("%s: could not get interface handle\n",
2329 			    sc->sc_dev.dv_xname);
2330 			goto fail;
2331 		}
2332 		error = urtw_open_pipes(sc);
2333 		if (error != 0)
2334 			goto fail;
2335 		ret = urtw_alloc_rx_data_list(sc);
2336 		if (error != 0)
2337 			goto fail;
2338 		ret = urtw_alloc_tx_data_list(sc);
2339 		if (error != 0)
2340 			goto fail;
2341 		sc->sc_flags |= URTW_INIT_ONCE;
2342 	}
2343 
2344 	error = urtw_rx_enable(sc);
2345 	if (error != 0)
2346 		goto fail;
2347 	error = urtw_tx_enable(sc);
2348 	if (error != 0)
2349 		goto fail;
2350 
2351 	ifp->if_flags &= ~IFF_OACTIVE;
2352 	ifp->if_flags |= IFF_RUNNING;
2353 
2354 	ifp->if_timer = 1;
2355 
2356 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2357 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2358 	else
2359 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2360 
2361 	return (0);
2362 fail:
2363 	return (error);
2364 }
2365 
2366 void
2367 urtw_set_multi(struct urtw_softc *sc)
2368 {
2369 	struct arpcom *ac = &sc->sc_ic.ic_ac;
2370 	struct ifnet *ifp = &ac->ac_if;
2371 
2372 	/*
2373 	 * XXX don't know how to set a device.  Lack of docs.  Just try to set
2374 	 * IFF_ALLMULTI flag here.
2375 	 */
2376 	ifp->if_flags |= IFF_ALLMULTI;
2377 }
2378 
2379 int
2380 urtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2381 {
2382 	struct urtw_softc *sc = ifp->if_softc;
2383 	struct ieee80211com *ic = &sc->sc_ic;
2384 	struct ifaddr *ifa;
2385 	struct ifreq *ifr;
2386 	int s, error = 0;
2387 
2388 	s = splnet();
2389 
2390 	switch (cmd) {
2391 	case SIOCSIFADDR:
2392 		ifa = (struct ifaddr *)data;
2393 		ifp->if_flags |= IFF_UP;
2394 #ifdef INET
2395 		if (ifa->ifa_addr->sa_family == AF_INET)
2396 			arp_ifinit(&ic->ic_ac, ifa);
2397 #endif
2398 		/* FALLTHROUGH */
2399 	case SIOCSIFFLAGS:
2400 		if (ifp->if_flags & IFF_UP) {
2401 			/*
2402 			 * If only the PROMISC or ALLMULTI flag changes, then
2403 			 * don't do a full re-init of the chip, just update
2404 			 * the Rx filter.
2405 			 */
2406 			if ((ifp->if_flags & IFF_RUNNING) &&
2407 			    ((ifp->if_flags ^ sc->sc_if_flags) &
2408 			    (IFF_ALLMULTI | IFF_PROMISC)) != 0) {
2409 				urtw_set_multi(sc);
2410 			} else {
2411 				if (!(ifp->if_flags & IFF_RUNNING))
2412 					ifp->if_init(ifp);
2413 			}
2414 		} else {
2415 			if (ifp->if_flags & IFF_RUNNING)
2416 				urtw_stop(ifp, 1);
2417 		}
2418 		sc->sc_if_flags = ifp->if_flags;
2419 		break;
2420 
2421 	case SIOCADDMULTI:
2422 	case SIOCDELMULTI:
2423 		ifr = (struct ifreq *)data;
2424 		error = (cmd == SIOCADDMULTI) ?
2425 		    ether_addmulti(ifr, &ic->ic_ac) :
2426 		    ether_delmulti(ifr, &ic->ic_ac);
2427 		if (error == ENETRESET) {
2428 			if (ifp->if_flags & IFF_RUNNING)
2429 				urtw_set_multi(sc);
2430 			error = 0;
2431 		}
2432 		break;
2433 
2434 	case SIOCS80211CHANNEL:
2435 		/*
2436 		 * This allows for fast channel switching in monitor mode
2437 		 * (used by kismet). In IBSS mode, we must explicitly reset
2438 		 * the interface to generate a new beacon frame.
2439 		 */
2440 		error = ieee80211_ioctl(ifp, cmd, data);
2441 		if (error == ENETRESET &&
2442 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2443 			urtw_set_chan(sc, ic->ic_ibss_chan);
2444 			error = 0;
2445 		}
2446 		break;
2447 
2448 	default:
2449 		error = ieee80211_ioctl(ifp, cmd, data);
2450 	}
2451 
2452 	if (error == ENETRESET) {
2453 		if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
2454 		    (IFF_RUNNING | IFF_UP))
2455 			ifp->if_init(ifp);
2456 		error = 0;
2457 	}
2458 
2459 	splx(s);
2460 
2461 	return (error);
2462 }
2463 
2464 void
2465 urtw_start(struct ifnet *ifp)
2466 {
2467 	struct urtw_softc *sc = ifp->if_softc;
2468 	struct ieee80211com *ic = &sc->sc_ic;
2469 	struct ieee80211_node *ni;
2470 	struct mbuf *m0;
2471 
2472 	/*
2473 	 * net80211 may still try to send management frames even if the
2474 	 * IFF_RUNNING flag is not set...
2475 	 */
2476 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2477 		return;
2478 
2479 	for (;;) {
2480 		IF_POLL(&ic->ic_mgtq, m0);
2481 		if (m0 != NULL) {
2482 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2483 			    sc->sc_tx_normal_queued >=
2484 			    URTW_TX_DATA_LIST_COUNT) {
2485 				ifp->if_flags |= IFF_OACTIVE;
2486 				break;
2487 			}
2488 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2489 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
2490 			m0->m_pkthdr.rcvif = NULL;
2491 #if NBPFILTER > 0
2492 			if (ic->ic_rawbpf != NULL)
2493 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2494 #endif
2495 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2496 			    != 0)
2497 				break;
2498 		} else {
2499 			if (ic->ic_state != IEEE80211_S_RUN)
2500 				break;
2501 			IFQ_POLL(&ifp->if_snd, m0);
2502 			if (m0 == NULL)
2503 				break;
2504 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2505 			    sc->sc_tx_normal_queued >=
2506 			    URTW_TX_DATA_LIST_COUNT) {
2507 				ifp->if_flags |= IFF_OACTIVE;
2508 				break;
2509 			}
2510 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2511 #if NBPFILTER > 0
2512 			if (ifp->if_bpf != NULL)
2513 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2514 #endif
2515 			m0 = ieee80211_encap(ifp, m0, &ni);
2516 			if (m0 == NULL)
2517 				continue;
2518 #if NBPFILTER > 0
2519 			if (ic->ic_rawbpf != NULL)
2520 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2521 #endif
2522 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2523 			    != 0) {
2524 				if (ni != NULL)
2525 					ieee80211_release_node(ic, ni);
2526 				ifp->if_oerrors++;
2527 				break;
2528 			}
2529 		}
2530 		sc->sc_txtimer = 5;
2531 	}
2532 }
2533 
2534 void
2535 urtw_watchdog(struct ifnet *ifp)
2536 {
2537 	struct urtw_softc *sc = ifp->if_softc;
2538 
2539 	ifp->if_timer = 0;
2540 
2541 	if (sc->sc_txtimer > 0) {
2542 		if (--sc->sc_txtimer == 0) {
2543 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2544 			ifp->if_oerrors++;
2545 			return;
2546 		}
2547 		ifp->if_timer = 1;
2548 	}
2549 
2550 	ieee80211_watchdog(ifp);
2551 }
2552 
2553 void
2554 urtw_txeof_low(usbd_xfer_handle xfer, usbd_private_handle priv,
2555     usbd_status status)
2556 {
2557 	struct urtw_tx_data *data = priv;
2558 	struct urtw_softc *sc = data->sc;
2559 	struct ieee80211com *ic = &sc->sc_ic;
2560 	struct ifnet *ifp = &ic->ic_if;
2561 	int s;
2562 
2563 	if (status != USBD_NORMAL_COMPLETION) {
2564 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2565 			return;
2566 
2567 		printf("%s: could not transmit buffer: %s\n",
2568 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2569 
2570 		if (status == USBD_STALLED)
2571 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2572 
2573 		ifp->if_oerrors++;
2574 		return;
2575 	}
2576 
2577 	s = splnet();
2578 
2579 	ieee80211_release_node(ic, data->ni);
2580 	data->ni = NULL;
2581 
2582 	sc->sc_txtimer = 0;
2583 	ifp->if_opackets++;
2584 
2585 	sc->sc_tx_low_queued--;
2586 	ifp->if_flags &= ~IFF_OACTIVE;
2587 	urtw_start(ifp);
2588 
2589 	splx(s);
2590 }
2591 
2592 void
2593 urtw_txeof_normal(usbd_xfer_handle xfer, usbd_private_handle priv,
2594     usbd_status status)
2595 {
2596 	struct urtw_tx_data *data = priv;
2597 	struct urtw_softc *sc = data->sc;
2598 	struct ieee80211com *ic = &sc->sc_ic;
2599 	struct ifnet *ifp = &ic->ic_if;
2600 	int s;
2601 
2602 	if (status != USBD_NORMAL_COMPLETION) {
2603 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2604 			return;
2605 
2606 		printf("%s: could not transmit buffer: %s\n",
2607 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2608 
2609 		if (status == USBD_STALLED)
2610 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2611 
2612 		ifp->if_oerrors++;
2613 		return;
2614 	}
2615 
2616 	s = splnet();
2617 
2618 	ieee80211_release_node(ic, data->ni);
2619 	data->ni = NULL;
2620 
2621 	sc->sc_txtimer = 0;
2622 	ifp->if_opackets++;
2623 
2624 	sc->sc_tx_normal_queued--;
2625 	ifp->if_flags &= ~IFF_OACTIVE;
2626 	urtw_start(ifp);
2627 
2628 	splx(s);
2629 }
2630 
2631 int
2632 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2633     int prior)
2634 {
2635 	struct ieee80211com *ic = &sc->sc_ic;
2636 	struct urtw_tx_data *data;
2637 	struct ieee80211_frame *wh;
2638 	struct ieee80211_key *k;
2639 	usbd_status error;
2640 	int xferlen;
2641 
2642 	wh = mtod(m0, struct ieee80211_frame *);
2643 
2644 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2645 		k = ieee80211_get_txkey(ic, wh, ni);
2646 
2647 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2648 			return (ENOBUFS);
2649 
2650 		/* packet header may have moved, reset our local pointer */
2651 		wh = mtod(m0, struct ieee80211_frame *);
2652 	}
2653 
2654 #if NBPFILTER > 0
2655 	if (sc->sc_drvbpf != NULL) {
2656 		struct mbuf mb;
2657 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2658 
2659 		tap->wt_flags = 0;
2660 		tap->wt_rate = 0;
2661 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2662 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2663 
2664 		mb.m_data = (caddr_t)tap;
2665 		mb.m_len = sc->sc_txtap_len;
2666 		mb.m_next = m0;
2667 		mb.m_nextpkt = NULL;
2668 		mb.m_type = 0;
2669 		mb.m_flags = 0;
2670 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
2671 	}
2672 #endif
2673 
2674 	if (sc->sc_hwrev & URTW_HWREV_8187)
2675 		xferlen = m0->m_pkthdr.len + 4 * 3;
2676 	else
2677 		xferlen = m0->m_pkthdr.len + 4 * 8;
2678 
2679 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2680 		xferlen += 1;
2681 
2682 	data = &sc->sc_tx_data[sc->sc_txidx];
2683 	sc->sc_txidx = (sc->sc_txidx + 1) % URTW_TX_DATA_LIST_COUNT;
2684 
2685 	bzero(data->buf, URTW_TX_MAXSIZE);
2686 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2687 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2688 	data->buf[1] |= (1 << 7);
2689 
2690 	/* XXX sc_preamble_mode is always 2. */
2691 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2692 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2693 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2694 		data->buf[2] |= 1;
2695 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2696 	    prior == URTW_PRIORITY_LOW)
2697 		panic("TODO tx.");
2698 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2699 		data->buf[2] |= (1 << 1);
2700 	/* RTS rate - 10 means we use a basic rate. */
2701 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2702 	/*
2703 	 * XXX currently TX rate control depends on the rate value of
2704 	 * RX descriptor because I don't know how to we can control TX rate
2705 	 * in more smart way.  Please fix me you find a thing.
2706 	 */
2707 	data->buf[3] = sc->sc_currate;
2708 	if (prior == URTW_PRIORITY_NORMAL) {
2709 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2710 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2711 		else if (ic->ic_fixed_rate != -1)
2712 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2713 	}
2714 
2715 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2716 		data->buf[8] = 3;		/* CW minimum */
2717 		data->buf[8] |= (7 << 4);	/* CW maximum */
2718 		data->buf[9] |= 11;		/* retry limitation */
2719 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2720 	} else {
2721 		data->buf[21] |= 11;		/* retry limitation */
2722 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2723 	}
2724 
2725 	data->ni = ni;
2726 
2727 	/* mbuf is no longer needed. */
2728 	m_freem(m0);
2729 
2730 	usbd_setup_xfer(data->xfer,
2731 	    (prior == URTW_PRIORITY_LOW) ? sc->sc_txpipe_low :
2732 	    sc->sc_txpipe_normal, data, data->buf, xferlen,
2733 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, URTW_DATA_TIMEOUT,
2734 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2735 	error = usbd_transfer(data->xfer);
2736 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2737 		printf("%s: could not send frame: %s\n",
2738 		    sc->sc_dev.dv_xname, usbd_errstr(error));
2739 		return (EIO);
2740 	}
2741 
2742 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2743 	if (error != 0)
2744 		printf("%s: could not control LED (%d)\n",
2745 		    sc->sc_dev.dv_xname, error);
2746 
2747 	if (prior == URTW_PRIORITY_LOW)
2748 		sc->sc_tx_low_queued++;
2749 	else
2750 		sc->sc_tx_normal_queued++;
2751 
2752 	return (0);
2753 }
2754 
2755 usbd_status
2756 urtw_8225_usb_init(struct urtw_softc *sc)
2757 {
2758 	uint8_t data;
2759 	usbd_status error;
2760 
2761 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2762 	urtw_write8_m(sc, URTW_GPIO, 0);
2763 	error = urtw_read8e(sc, 0x53, &data);
2764 	if (error)
2765 		goto fail;
2766 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2767 	if (error)
2768 		goto fail;
2769 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2770 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2771 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2772 
2773 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2774 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2775 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2776 
2777 	usbd_delay_ms(sc->sc_udev, 500);
2778 fail:
2779 	return (error);
2780 }
2781 
2782 usbd_status
2783 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2784 {
2785 	usbd_status error = 0;
2786 
2787 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2788 fail:
2789 	return (error);
2790 }
2791 
2792 usbd_status
2793 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2794 {
2795 	uint32_t phyw;
2796 	usbd_status error;
2797 
2798 	phyw = ((data << 8) | (addr | 0x80));
2799 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2800 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2801 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2802 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2803 	/*
2804 	 * Delay removed from 8185 to 8187.
2805 	 * usbd_delay_ms(sc->sc_udev, 1);
2806 	 */
2807 fail:
2808 	return (error);
2809 }
2810 
2811 usbd_status
2812 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2813 {
2814 	data = data & 0xff;
2815 	return (urtw_8187_write_phy(sc, addr, data));
2816 }
2817 
2818 usbd_status
2819 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2820 {
2821 	data = data & 0xff;
2822 	return (urtw_8187_write_phy(sc, addr, data | 0x10000));
2823 }
2824 
2825 usbd_status
2826 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2827 {
2828 	usbd_status error;
2829 
2830 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2831 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2832 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2833 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2834 fail:
2835 	return (error);
2836 }
2837 
2838 usbd_status
2839 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2840 {
2841 	int i, idx, set;
2842 	uint8_t *cck_pwltable;
2843 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2844 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2845 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2846 	usbd_status error;
2847 
2848 	cck_pwrlvl_max = 11;
2849 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2850 	ofdm_pwrlvl_min = 10;
2851 
2852 	/* CCK power setting */
2853 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2854 	idx = cck_pwrlvl % 6;
2855 	set = cck_pwrlvl / 6;
2856 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2857 	    urtw_8225_txpwr_cck;
2858 
2859 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2860 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2861 	for (i = 0; i < 8; i++) {
2862 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2863 		    cck_pwltable[idx * 8 + i]);
2864 	}
2865 	usbd_delay_ms(sc->sc_udev, 1);
2866 
2867 	/* OFDM power setting */
2868 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2869 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2870 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2871 
2872 	idx = ofdm_pwrlvl % 6;
2873 	set = ofdm_pwrlvl / 6;
2874 
2875 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2876 	if (error)
2877 		goto fail;
2878 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2879 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2880 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2881 
2882 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2883 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2884 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2885 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2886 	usbd_delay_ms(sc->sc_udev, 1);
2887 fail:
2888 	return (error);
2889 }
2890 
2891 usbd_status
2892 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2893 {
2894 	usbd_status error;
2895 
2896 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2897 	usbd_delay_ms(sc->sc_udev, 1);
2898 fail:
2899 	return (error);
2900 }
2901 
2902 usbd_status
2903 urtw_8225_rf_init(struct urtw_rf *rf)
2904 {
2905 	struct urtw_softc *sc = rf->rf_sc;
2906 	int i;
2907 	uint16_t data;
2908 	usbd_status error;
2909 
2910 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2911 	if (error)
2912 		goto fail;
2913 
2914 	error = urtw_8225_usb_init(sc);
2915 	if (error)
2916 		goto fail;
2917 
2918 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2919 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2920 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2921 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2922 
2923 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2924 	if (error)
2925 		goto fail;
2926 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2927 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2928 	if (error)
2929 		goto fail;
2930 
2931 	error = urtw_8185_rf_pins_enable(sc);
2932 	if (error)
2933 		goto fail;
2934 
2935 	usbd_delay_ms(sc->sc_udev, 500);
2936 
2937 	for (i = 0; i < nitems(urtw_8225_rf_part1); i++) {
2938 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2939 		    urtw_8225_rf_part1[i].val);
2940 	}
2941 	usbd_delay_ms(sc->sc_udev, 50);
2942 	urtw_8225_write(sc, 0x2, 0xc4d);
2943 	usbd_delay_ms(sc->sc_udev, 200);
2944 	urtw_8225_write(sc, 0x2, 0x44d);
2945 	usbd_delay_ms(sc->sc_udev, 200);
2946 	urtw_8225_write(sc, 0x0, 0x127);
2947 
2948 	for (i = 0; i < nitems(urtw_8225_rxgain); i++) {
2949 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2950 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2951 	}
2952 
2953 	urtw_8225_write(sc, 0x0, 0x27);
2954 	urtw_8225_write(sc, 0x0, 0x22f);
2955 
2956 	for (i = 0; i < nitems(urtw_8225_agc); i++) {
2957 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2958 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2959 	}
2960 
2961 	for (i = 0; i < nitems(urtw_8225_rf_part2); i++) {
2962 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2963 		    urtw_8225_rf_part2[i].val);
2964 		usbd_delay_ms(sc->sc_udev, 1);
2965 	}
2966 
2967 	error = urtw_8225_setgain(sc, 4);
2968 	if (error)
2969 		goto fail;
2970 
2971 	for (i = 0; i < nitems(urtw_8225_rf_part3); i++) {
2972 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2973 		    urtw_8225_rf_part3[i].val);
2974 		usbd_delay_ms(sc->sc_udev, 1);
2975 	}
2976 
2977 	urtw_write8_m(sc, 0x5b, 0x0d);
2978 
2979 	error = urtw_8225_set_txpwrlvl(sc, 1);
2980 	if (error)
2981 		goto fail;
2982 
2983 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2984 	usbd_delay_ms(sc->sc_udev, 1);
2985 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2986 	usbd_delay_ms(sc->sc_udev, 1);
2987 
2988 	/* TX ant A, 0x0 for B */
2989 	error = urtw_8185_tx_antenna(sc, 0x3);
2990 	if (error)
2991 		goto fail;
2992 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2993 
2994 	error = urtw_8225_rf_set_chan(rf, 1);
2995 fail:
2996 	return (error);
2997 }
2998 
2999 usbd_status
3000 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
3001 {
3002 	struct urtw_softc *sc = rf->rf_sc;
3003 	struct ieee80211com *ic = &sc->sc_ic;
3004 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3005 	usbd_status error;
3006 
3007 	error = urtw_8225_set_txpwrlvl(sc, chan);
3008 	if (error)
3009 		goto fail;
3010 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3011 	usbd_delay_ms(sc->sc_udev, 10);
3012 
3013 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3014 
3015 	if (sc->sc_state == IEEE80211_S_ASSOC &&
3016 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3017 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3018 	else
3019 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3020 
3021 	if (IEEE80211_IS_CHAN_G(c)) {
3022 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3023 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3024 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3025 	} else {
3026 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3027 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3028 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3029 	}
3030 
3031 fail:
3032 	return (error);
3033 }
3034 
3035 usbd_status
3036 urtw_8225_rf_set_sens(struct urtw_rf *rf)
3037 {
3038 	struct urtw_softc *sc = rf->rf_sc;
3039 	usbd_status error;
3040 
3041 	if (rf->sens < 0 || rf->sens > 6)
3042 		return (-1);
3043 
3044 	if (rf->sens > 4)
3045 		urtw_8225_write(sc, 0x0c, 0x850);
3046 	else
3047 		urtw_8225_write(sc, 0x0c, 0x50);
3048 
3049 	rf->sens = 6 - rf->sens;
3050 	error = urtw_8225_setgain(sc, rf->sens);
3051 	if (error)
3052 		goto fail;
3053 
3054 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3055 
3056 fail:
3057 	return (error);
3058 }
3059 
3060 void
3061 urtw_stop(struct ifnet *ifp, int disable)
3062 {
3063 	struct urtw_softc *sc = ifp->if_softc;
3064 	struct ieee80211com *ic = &sc->sc_ic;
3065 	uint8_t data;
3066 	usbd_status error;
3067 
3068 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3069 
3070 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3071 
3072 	timeout_del(&sc->scan_to);
3073 	timeout_del(&sc->sc_led_ch);
3074 
3075 	urtw_intr_disable(sc);
3076 	urtw_read8_m(sc, URTW_CMD, &data);
3077 	data &= ~URTW_CMD_TX_ENABLE;
3078 	data &= ~URTW_CMD_RX_ENABLE;
3079 	urtw_write8_m(sc, URTW_CMD, data);
3080 
3081 	if (sc->sc_rxpipe != NULL)
3082 		usbd_abort_pipe(sc->sc_rxpipe);
3083 	if (sc->sc_txpipe_low != NULL)
3084 		usbd_abort_pipe(sc->sc_txpipe_low);
3085 	if (sc->sc_txpipe_normal != NULL)
3086 		usbd_abort_pipe(sc->sc_txpipe_normal);
3087 
3088 fail:
3089 	return;
3090 }
3091 
3092 int
3093 urtw_isbmode(uint16_t rate)
3094 {
3095 	rate = urtw_rtl2rate(rate);
3096 
3097 	return (((rate <= 22 && rate != 12 && rate != 18) ||
3098 	    rate == 44) ? (1) : (0));
3099 }
3100 
3101 void
3102 urtw_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
3103 {
3104 	struct urtw_rx_data *data = priv;
3105 	struct urtw_softc *sc = data->sc;
3106 	struct ieee80211com *ic = &sc->sc_ic;
3107 	struct ifnet *ifp = &ic->ic_if;
3108 	struct ieee80211_frame *wh;
3109 	struct ieee80211_node *ni;
3110 	struct ieee80211_rxinfo rxi;
3111 	struct mbuf *m, *mnew;
3112 	uint8_t *desc, quality, rate;
3113 	int actlen, flen, len, nf, rssi, s;
3114 
3115 	if (status != USBD_NORMAL_COMPLETION) {
3116 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3117 			return;
3118 
3119 		if (status == USBD_STALLED)
3120 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3121 		ifp->if_ierrors++;
3122 		goto skip;
3123 	}
3124 
3125 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3126 	if (actlen < URTW_MIN_RXBUFSZ) {
3127 		ifp->if_ierrors++;
3128 		goto skip;
3129 	}
3130 
3131 	if (sc->sc_hwrev & URTW_HWREV_8187)
3132 		/* 4 dword and 4 byte CRC */
3133 		len = actlen - (4 * 4);
3134 	else
3135 		/* 5 dword and 4 byte CRC */
3136 		len = actlen - (4 * 5);
3137 
3138 	desc = data->buf + len;
3139 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3140 	if (flen > actlen) {
3141 		ifp->if_ierrors++;
3142 		goto skip;
3143 	}
3144 
3145 	rate = (desc[2] & 0xf0) >> 4;
3146 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3147 		quality = desc[4] & 0xff;
3148 		rssi = (desc[6] & 0xfe) >> 1;
3149 
3150 		/* XXX correct? */
3151 		if (!urtw_isbmode(rate)) {
3152 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3153 			rssi = ((90 - rssi) * 100) / 65;
3154 		} else {
3155 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3156 			rssi = ((95 - rssi) * 100) / 65;
3157 		}
3158 	} else {
3159 		quality = desc[12];
3160 		rssi = 14 - desc[14] / 2;
3161 	}
3162 
3163 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3164 	if (mnew == NULL) {
3165 		printf("%s: could not allocate rx mbuf\n",
3166 		    sc->sc_dev.dv_xname);
3167 		ifp->if_ierrors++;
3168 		goto skip;
3169 	}
3170 	MCLGET(mnew, M_DONTWAIT);
3171 	if (!(mnew->m_flags & M_EXT)) {
3172 		printf("%s: could not allocate rx mbuf cluster\n",
3173 		    sc->sc_dev.dv_xname);
3174 		m_freem(mnew);
3175 		ifp->if_ierrors++;
3176 		goto skip;
3177 	}
3178 
3179 	m = data->m;
3180 	data->m = mnew;
3181 	data->buf = mtod(mnew, uint8_t *);
3182 
3183 	/* finalize mbuf */
3184 	m->m_pkthdr.rcvif = ifp;
3185 	m->m_pkthdr.len = m->m_len = flen - 4;
3186 
3187 	s = splnet();
3188 
3189 #if NBPFILTER > 0
3190 	if (sc->sc_drvbpf != NULL) {
3191 		struct mbuf mb;
3192 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3193 
3194 		/* XXX Are variables correct? */
3195 		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
3196 		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
3197 		tap->wr_dbm_antsignal = (int8_t)rssi;
3198 
3199 		mb.m_data = (caddr_t)tap;
3200 		mb.m_len = sc->sc_rxtap_len;
3201 		mb.m_next = m;
3202 		mb.m_nextpkt = NULL;
3203 		mb.m_type = 0;
3204 		mb.m_flags = 0;
3205 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
3206 	}
3207 #endif
3208 	wh = mtod(m, struct ieee80211_frame *);
3209 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3210 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3211 	ni = ieee80211_find_rxnode(ic, wh);
3212 
3213 	/* XXX correct? */
3214 	if (!urtw_isbmode(rate)) {
3215 		if (quality > 127)
3216 			quality = 0;
3217 		else if (quality < 27)
3218 			quality = 100;
3219 		else
3220 			quality = 127 - quality;
3221 	} else
3222 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3223 
3224 	nf = quality;
3225 
3226 	/* send the frame to the 802.11 layer */
3227 	rxi.rxi_flags = 0;
3228 	rxi.rxi_rssi = rssi;
3229 	rxi.rxi_tstamp = 0;
3230 	ieee80211_input(ifp, m, ni, &rxi);
3231 
3232 	/* node is no longer needed */
3233 	ieee80211_release_node(ic, ni);
3234 
3235 	splx(s);
3236 
3237 skip:	/* setup a new transfer */
3238 	usbd_setup_xfer(xfer, sc->sc_rxpipe, data, data->buf, MCLBYTES,
3239 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3240 	(void)usbd_transfer(xfer);
3241 }
3242 
3243 usbd_status
3244 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3245 {
3246 	uint8_t *gainp;
3247 	usbd_status error;
3248 
3249 	/* XXX for A? */
3250 	gainp = urtw_8225v2_gain_bg;
3251 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3252 	usbd_delay_ms(sc->sc_udev, 1);
3253 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3254 	usbd_delay_ms(sc->sc_udev, 1);
3255 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3256 	usbd_delay_ms(sc->sc_udev, 1);
3257 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3258 	usbd_delay_ms(sc->sc_udev, 1);
3259 fail:
3260 	return (error);
3261 }
3262 
3263 usbd_status
3264 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3265 {
3266 	int i;
3267 	uint8_t *cck_pwrtable;
3268 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3269 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3270 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3271 	usbd_status error;
3272 
3273 	/* CCK power setting */
3274 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3275 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3276 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3277 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3278 	    urtw_8225v2_txpwr_cck;
3279 
3280 	for (i = 0; i < 8; i++) {
3281 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3282 	}
3283 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3284 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3285 	usbd_delay_ms(sc->sc_udev, 1);
3286 
3287 	/* OFDM power setting */
3288 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3289 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3290 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3291 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3292 
3293 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3294 	if (error)
3295 		goto fail;
3296 
3297 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3298 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3299 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3300 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3301 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3302 
3303 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3304 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3305 	usbd_delay_ms(sc->sc_udev, 1);
3306 fail:
3307 	return (error);
3308 }
3309 
3310 usbd_status
3311 urtw_8225v2_rf_init(struct urtw_rf *rf)
3312 {
3313 	struct urtw_softc *sc = rf->rf_sc;
3314 	int i;
3315 	uint16_t data;
3316 	uint32_t data32;
3317 	usbd_status error;
3318 
3319 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3320 	if (error)
3321 		goto fail;
3322 
3323 	error = urtw_8225_usb_init(sc);
3324 	if (error)
3325 		goto fail;
3326 
3327 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3328 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3329 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3330 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3331 
3332 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3333 	if (error)
3334 		goto fail;
3335 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3336 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3337 	if (error)
3338 		goto fail;
3339 
3340 	error = urtw_8185_rf_pins_enable(sc);
3341 	if (error)
3342 		goto fail;
3343 
3344 	usbd_delay_ms(sc->sc_udev, 1000);
3345 
3346 	for (i = 0; i < nitems(urtw_8225v2_rf_part1); i++) {
3347 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3348 		    urtw_8225v2_rf_part1[i].val);
3349 		usbd_delay_ms(sc->sc_udev, 1);
3350 	}
3351 	usbd_delay_ms(sc->sc_udev, 50);
3352 
3353 	urtw_8225_write(sc, 0x0, 0x1b7);
3354 
3355 	for (i = 0; i < nitems(urtw_8225v2_rxgain); i++) {
3356 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3357 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3358 	}
3359 
3360 	urtw_8225_write(sc, 0x3, 0x2);
3361 	urtw_8225_write(sc, 0x5, 0x4);
3362 	urtw_8225_write(sc, 0x0, 0xb7);
3363 	urtw_8225_write(sc, 0x2, 0xc4d);
3364 	usbd_delay_ms(sc->sc_udev, 100);
3365 	urtw_8225_write(sc, 0x2, 0x44d);
3366 	usbd_delay_ms(sc->sc_udev, 100);
3367 
3368 	error = urtw_8225_read(sc, 0x6, &data32);
3369 	if (error != 0)
3370 		goto fail;
3371 	if (data32 != 0xe6)
3372 		printf("%s: expect 0xe6!! (0x%x)\n", sc->sc_dev.dv_xname,
3373 		    data32);
3374 	if (!(data32 & 0x80)) {
3375 		urtw_8225_write(sc, 0x02, 0x0c4d);
3376 		usbd_delay_ms(sc->sc_udev, 200);
3377 		urtw_8225_write(sc, 0x02, 0x044d);
3378 		usbd_delay_ms(sc->sc_udev, 100);
3379 		error = urtw_8225_read(sc, 0x6, &data32);
3380 		if (error != 0)
3381 			goto fail;
3382 		if (!(data32 & 0x80))
3383 			printf("%s: RF calibration failed\n",
3384 			    sc->sc_dev.dv_xname);
3385 	}
3386 	usbd_delay_ms(sc->sc_udev, 100);
3387 
3388 	urtw_8225_write(sc, 0x0, 0x2bf);
3389 	for (i = 0; i < nitems(urtw_8225_agc); i++) {
3390 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3391 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3392 	}
3393 
3394 	for (i = 0; i < nitems(urtw_8225v2_rf_part2); i++) {
3395 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3396 		    urtw_8225v2_rf_part2[i].val);
3397 	}
3398 
3399 	error = urtw_8225v2_setgain(sc, 4);
3400 	if (error)
3401 		goto fail;
3402 
3403 	for (i = 0; i < nitems(urtw_8225v2_rf_part3); i++) {
3404 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3405 		    urtw_8225v2_rf_part3[i].val);
3406 	}
3407 
3408 	urtw_write8_m(sc, 0x5b, 0x0d);
3409 
3410 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3411 	if (error)
3412 		goto fail;
3413 
3414 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3415 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3416 
3417 	/* TX ant A, 0x0 for B */
3418 	error = urtw_8185_tx_antenna(sc, 0x3);
3419 	if (error)
3420 		goto fail;
3421 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3422 
3423 	error = urtw_8225_rf_set_chan(rf, 1);
3424 fail:
3425 	return (error);
3426 }
3427 
3428 usbd_status
3429 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3430 {
3431 	struct urtw_softc *sc = rf->rf_sc;
3432 	struct ieee80211com *ic = &sc->sc_ic;
3433 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3434 	usbd_status error;
3435 
3436 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3437 	if (error)
3438 		goto fail;
3439 
3440 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3441 	usbd_delay_ms(sc->sc_udev, 10);
3442 
3443 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3444 
3445 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3446 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3447 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3448 	else
3449 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3450 
3451 	if (IEEE80211_IS_CHAN_G(c)) {
3452 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3453 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3454 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3455 	} else {
3456 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3457 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3458 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3459 	}
3460 
3461 fail:
3462 	return (error);
3463 }
3464 
3465 void
3466 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3467 {
3468 	struct urtw_rf *rf = &sc->sc_rf;
3469 	struct ieee80211com *ic = &sc->sc_ic;
3470 	usbd_status error = 0;
3471 	uint32_t data;
3472 	u_int chan;
3473 
3474 	chan = ieee80211_chan2ieee(ic, c);
3475 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3476 		return;
3477 	/*
3478 	 * During changing the channel we need to temporary disable
3479 	 * TX.
3480 	 */
3481 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3482 	data &= ~URTW_TX_LOOPBACK_MASK;
3483 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3484 	error = rf->set_chan(rf, chan);
3485 	if (error != 0) {
3486 		printf("%s could not change the channel\n",
3487 		    sc->sc_dev.dv_xname);
3488 		return;
3489 	}
3490 	usbd_delay_ms(sc->sc_udev, 10);
3491 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3492 
3493 fail:	return;
3494 
3495 }
3496 
3497 void
3498 urtw_next_scan(void *arg)
3499 {
3500 	struct urtw_softc *sc = arg;
3501 	struct ieee80211com *ic = &sc->sc_ic;
3502 	struct ifnet *ifp = &ic->ic_if;
3503 
3504 	if (ic->ic_state == IEEE80211_S_SCAN)
3505 		ieee80211_next_scan(ifp);
3506 }
3507 
3508 void
3509 urtw_task(void *arg)
3510 {
3511 	struct urtw_softc *sc = arg;
3512 	struct ieee80211com *ic = &sc->sc_ic;
3513 	struct ieee80211_node *ni;
3514 	enum ieee80211_state ostate;
3515 	usbd_status error = 0;
3516 
3517 	ostate = ic->ic_state;
3518 
3519 	switch (sc->sc_state) {
3520 	case IEEE80211_S_INIT:
3521 		if (ostate == IEEE80211_S_RUN) {
3522 			/* turn link LED off */
3523 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3524 		}
3525 		break;
3526 
3527 	case IEEE80211_S_SCAN:
3528 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3529 		timeout_add_msec(&sc->scan_to, 200);
3530 		break;
3531 
3532 	case IEEE80211_S_AUTH:
3533 	case IEEE80211_S_ASSOC:
3534 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3535 		break;
3536 
3537 	case IEEE80211_S_RUN:
3538 		ni = ic->ic_bss;
3539 
3540 		/* setting bssid. */
3541 		urtw_write32_m(sc, URTW_BSSID, ((uint32_t *)ni->ni_bssid)[0]);
3542 		urtw_write16_m(sc, URTW_BSSID + 4,
3543 		    ((uint16_t *)ni->ni_bssid)[2]);
3544 		urtw_update_msr(sc);
3545 		/* XXX maybe the below would be incorrect. */
3546 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3547 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3548 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3549 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3550 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3551 		if (error != 0)
3552 			printf("%s: could not control LED (%d)\n",
3553 			    sc->sc_dev.dv_xname, error);
3554 		break;
3555 	}
3556 
3557 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3558 
3559 fail:
3560 	if (error != 0)
3561 		DPRINTF(("%s: error duing processing RUN state.",
3562 		    sc->sc_dev.dv_xname));
3563 }
3564 
3565 usbd_status
3566 urtw_8187b_update_wmm(struct urtw_softc *sc)
3567 {
3568 	struct ieee80211com *ic = &sc->sc_ic;
3569 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3570 	uint32_t data;
3571 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3572 	usbd_status error;
3573 
3574 	sifs = 0xa;
3575 	if (IEEE80211_IS_CHAN_G(c))
3576 		slot = 0x9;
3577 	else
3578 		slot = 0x14;
3579 
3580 	aifs = (2 * slot) + sifs;
3581 	ecwmin = 3;
3582 	ecwmax = 7;
3583 
3584 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3585 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3586 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3587 
3588 	urtw_write32_m(sc, URTW_AC_VO, data);
3589 	urtw_write32_m(sc, URTW_AC_VI, data);
3590 	urtw_write32_m(sc, URTW_AC_BE, data);
3591 	urtw_write32_m(sc, URTW_AC_BK, data);
3592 
3593 fail:
3594 	return (error);
3595 }
3596 
3597 usbd_status
3598 urtw_8187b_reset(struct urtw_softc *sc)
3599 {
3600 	uint8_t data;
3601 	usbd_status error;
3602 
3603 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3604 	if (error)
3605 		goto fail;
3606 
3607 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3608 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3609 		URTW_CONFIG3_GNT_SELECT);
3610 
3611 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3612 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3613 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3614 
3615 	urtw_write8_m(sc, 0x61, 0x10);
3616 	urtw_read8_m(sc, 0x62, &data);
3617 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3618 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3619 
3620 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3621 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3622 
3623 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3624 	if (error)
3625 		goto fail;
3626 
3627 	urtw_read8_m(sc, URTW_CMD, &data);
3628 	data = (data & 2) | URTW_CMD_RST;
3629 	urtw_write8_m(sc, URTW_CMD, data);
3630 	usbd_delay_ms(sc->sc_udev, 100);
3631 
3632 	urtw_read8_m(sc, URTW_CMD, &data);
3633 	if (data & URTW_CMD_RST) {
3634 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
3635 		goto fail;
3636 	}
3637 
3638 fail:
3639 	return (error);
3640 }
3641 
3642 int
3643 urtw_8187b_init(struct ifnet *ifp)
3644 {
3645 	struct urtw_softc *sc = ifp->if_softc;
3646 	struct urtw_rf *rf = &sc->sc_rf;
3647 	struct ieee80211com *ic = &sc->sc_ic;
3648 	int ret;
3649 	uint8_t data;
3650 	usbd_status error;
3651 
3652 	urtw_stop(ifp, 0);
3653 
3654 	error = urtw_8187b_update_wmm(sc);
3655 	if (error != 0)
3656 		goto fail;
3657 	error = urtw_8187b_reset(sc);
3658 	if (error)
3659 		goto fail;
3660 
3661 	/* Applying MAC address again. */
3662 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3663 	if (error)
3664 		goto fail;
3665 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
3666 	urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)ic->ic_myaddr)[0]);
3667 	urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)ic->ic_myaddr)[1] & 0xffff);
3668 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3669 	if (error)
3670 		goto fail;
3671 
3672 	error = urtw_update_msr(sc);
3673 	if (error)
3674 		goto fail;
3675 
3676 	error = rf->init(rf);
3677 	if (error != 0)
3678 		goto fail;
3679 
3680 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3681 		URTW_CMD_RX_ENABLE);
3682 	error = urtw_intr_enable(sc);
3683 	if (error != 0)
3684 		goto fail;
3685 
3686 	error = urtw_write8e(sc, 0x41, 0xf4);
3687 	if (error != 0)
3688 		goto fail;
3689 	error = urtw_write8e(sc, 0x40, 0x00);
3690 	if (error != 0)
3691 		goto fail;
3692 	error = urtw_write8e(sc, 0x42, 0x00);
3693 	if (error != 0)
3694 		goto fail;
3695 	error = urtw_write8e(sc, 0x42, 0x01);
3696 	if (error != 0)
3697 		goto fail;
3698 	error = urtw_write8e(sc, 0x40, 0x0f);
3699 	if (error != 0)
3700 		goto fail;
3701 	error = urtw_write8e(sc, 0x42, 0x00);
3702 	if (error != 0)
3703 		goto fail;
3704 	error = urtw_write8e(sc, 0x42, 0x01);
3705 	if (error != 0)
3706 		goto fail;
3707 
3708 	urtw_read8_m(sc, 0xdb, &data);
3709 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3710 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3711 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3712 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3713 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3714 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3715 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3716 	urtw_write8_m(sc, 0x61, 0);
3717 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3718 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3719 	urtw_write8_m(sc, 0xda, 0x10);
3720 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3721 
3722 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3723 
3724 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3725 
3726 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3727 
3728 	/* Reset softc variables. */
3729 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
3730 	sc->sc_txtimer = 0;
3731 
3732 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3733 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3734 		if (error != 0) {
3735 			printf("%s: could not set configuration no\n",
3736 			    sc->sc_dev.dv_xname);
3737 			goto fail;
3738 		}
3739 		/* Get the first interface handle. */
3740 		error = usbd_device2interface_handle(sc->sc_udev,
3741 		    URTW_IFACE_INDEX, &sc->sc_iface);
3742 		if (error != 0) {
3743 			printf("%s: could not get interface handle\n",
3744 			    sc->sc_dev.dv_xname);
3745 			goto fail;
3746 		}
3747 		error = urtw_open_pipes(sc);
3748 		if (error != 0)
3749 			goto fail;
3750 		ret = urtw_alloc_rx_data_list(sc);
3751 		if (error != 0)
3752 			goto fail;
3753 		ret = urtw_alloc_tx_data_list(sc);
3754 		if (error != 0)
3755 			goto fail;
3756 		sc->sc_flags |= URTW_INIT_ONCE;
3757 	}
3758 
3759 	error = urtw_rx_enable(sc);
3760 	if (error != 0)
3761 		goto fail;
3762 	error = urtw_tx_enable(sc);
3763 	if (error != 0)
3764 		goto fail;
3765 
3766 	ifp->if_flags &= ~IFF_OACTIVE;
3767 	ifp->if_flags |= IFF_RUNNING;
3768 
3769 	ifp->if_timer = 1;
3770 
3771 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3772 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3773 	else
3774 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3775 
3776 fail:
3777 	return (error);
3778 }
3779 
3780 usbd_status
3781 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3782 {
3783 	int i;
3784 	usbd_status error;
3785 
3786 	for (i = 0; i < nitems(urtw_8187b_regtbl); i++) {
3787 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3788 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3789 	}
3790 
3791 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3792 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3793 
3794 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3795 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3796 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3797 
3798 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3799 
3800 fail:
3801 	return (error);
3802 }
3803 
3804 usbd_status
3805 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3806 {
3807 	usbd_status error;
3808 
3809 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3810 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3811 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3812 	usbd_delay_ms(sc->sc_udev, 100);
3813 
3814 fail:
3815 	return (error);
3816 }
3817 
3818 usbd_status
3819 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3820 {
3821 	struct ieee80211com *ic = &sc->sc_ic;
3822 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3823 	uint8_t aifs, difs, eifs, sifs, slot;
3824 	usbd_status error;
3825 
3826 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3827 
3828 	sifs = 0xa;
3829 	if (IEEE80211_IS_CHAN_G(c)) {
3830 		slot = 0x9;
3831 		difs = 0x1c;
3832 		eifs = 0x5b;
3833 	} else {
3834 		slot = 0x14;
3835 		difs = 0x32;
3836 		eifs = 0x5b;
3837 	}
3838 	aifs = (2 * slot) + sifs;
3839 
3840 	urtw_write8_m(sc, URTW_SLOT, slot);
3841 
3842 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3843 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3844 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3845 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3846 
3847 	urtw_write8_m(sc, URTW_DIFS, difs);
3848 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3849 
3850 fail:
3851 	return (error);
3852 }
3853 
3854 usbd_status
3855 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3856 {
3857 	struct urtw_softc *sc = rf->rf_sc;
3858 	int i;
3859 	uint8_t data;
3860 	usbd_status error;
3861 
3862 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3863 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3864 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3865 	urtw_write8_m(sc, URTW_CW_CONF, data |
3866 		URTW_CW_CONF_PERPACKET_RETRY);
3867 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3868 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3869 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3870 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3871 
3872 	/* Auto rate fallback control. */
3873 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3874 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3875 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3876 		URTW_RATE_FALLBACK_ENABLE);
3877 
3878 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3879 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3880 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3881 
3882 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3883 	if (error)
3884 		goto fail;
3885 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3886 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3887 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3888 	if (error)
3889 		goto fail;
3890 
3891 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3892 	urtw_8225v2_b_config_mac(sc);
3893 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3894 
3895 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3896 	if (error)
3897 		goto fail;
3898 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3899 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3900 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3901 	if (error)
3902 		goto fail;
3903 
3904 	urtw_8225v2_b_init_rfe(sc);
3905 
3906 	for (i = 0; i < nitems(urtw_8225v2_b_rf); i++) {
3907 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3908 		    urtw_8225v2_b_rf[i].val);
3909 	}
3910 
3911 	for (i = 0; i < nitems(urtw_8225v2_rxgain); i++) {
3912 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3913 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3914 	}
3915 
3916 	urtw_8225_write(sc, 0x03, 0x080);
3917 	urtw_8225_write(sc, 0x05, 0x004);
3918 	urtw_8225_write(sc, 0x00, 0x0b7);
3919 	urtw_8225_write(sc, 0x02, 0xc4d);
3920 	urtw_8225_write(sc, 0x02, 0x44d);
3921 	urtw_8225_write(sc, 0x00, 0x2bf);
3922 
3923 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3924 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3925 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3926 
3927 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3928 	for (i = 0; i < nitems(urtw_8225v2_agc); i++) {
3929 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3930 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3931 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3932 	}
3933 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3934 
3935 	for (i = 0; i < nitems(urtw_8225v2_ofdm); i++)
3936 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3937 
3938 	urtw_8225v2_b_update_chan(sc);
3939 
3940 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3941 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3942 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3943 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3944 
3945 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3946 fail:
3947 	return (error);
3948 }
3949 
3950 usbd_status
3951 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3952 {
3953 	struct urtw_softc *sc = rf->rf_sc;
3954 	usbd_status error;
3955 
3956 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3957 	if (error)
3958 		goto fail;
3959 
3960 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3961 	/*
3962 	 * Delay removed from 8185 to 8187.
3963 	 * usbd_delay_ms(sc->sc_udev, 10);
3964 	 */
3965 
3966 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3967 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3968 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3969 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3970 
3971 fail:
3972 	return (error);
3973 }
3974 
3975 usbd_status
3976 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3977 {
3978 	int i;
3979 	uint8_t *cck_pwrtable;
3980 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3981 	    ofdm_pwrlvl_max;
3982 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3983 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3984 	usbd_status error;
3985 
3986 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3987 		cck_pwrlvl_min = 0;
3988 		cck_pwrlvl_max = 15;
3989 		ofdm_pwrlvl_min = 2;
3990 		ofdm_pwrlvl_max = 17;
3991 	} else {
3992 		cck_pwrlvl_min = 7;
3993 		cck_pwrlvl_max = 22;
3994 		ofdm_pwrlvl_min = 10;
3995 		ofdm_pwrlvl_max = 25;
3996 	}
3997 
3998 	/* CCK power setting */
3999 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
4000 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
4001 
4002 	cck_pwrlvl += sc->sc_txpwr_cck_base;
4003 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
4004 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
4005 
4006 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
4007 	    urtw_8225v2_txpwr_cck;
4008 
4009 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4010 		if (cck_pwrlvl <= 6)
4011 			; /* do nothing */
4012 		else if (cck_pwrlvl <= 11)
4013 			cck_pwrtable += 8;
4014 		else
4015 			cck_pwrtable += 16;
4016 	} else {
4017 		if (cck_pwrlvl <= 5)
4018 			; /* do nothing */
4019 		else if (cck_pwrlvl <= 11)
4020 			cck_pwrtable += 8;
4021 		else if (cck_pwrlvl <= 17)
4022 			cck_pwrtable += 16;
4023 		else
4024 			cck_pwrtable += 24;
4025 	}
4026 
4027 	for (i = 0; i < 8; i++) {
4028 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
4029 	}
4030 
4031 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
4032 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
4033 	/*
4034 	 * Delay removed from 8185 to 8187.
4035 	 * usbd_delay_ms(sc->sc_udev, 1);
4036 	 */
4037 
4038 	/* OFDM power setting */
4039 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
4040 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
4041 
4042 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
4043 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
4044 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
4045 
4046 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
4047 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
4048 
4049 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4050 		if (ofdm_pwrlvl <= 11) {
4051 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4052 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4053 		} else {
4054 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4055 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4056 		}
4057 	} else {
4058 		if (ofdm_pwrlvl <= 11) {
4059 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4060 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4061 		} else if (ofdm_pwrlvl <= 17) {
4062 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4063 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4064 		} else {
4065 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4066 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4067 		}
4068 	}
4069 
4070 	/*
4071 	 * Delay removed from 8185 to 8187.
4072 	 * usbd_delay_ms(sc->sc_udev, 1);
4073 	 */
4074 fail:
4075 	return (error);
4076 }
4077 
4078