xref: /openbsd-src/sys/dev/usb/if_urtw.c (revision 50b7afb2c2c0993b0894d4e34bf857cb13ed9c80)
1 /*	$OpenBSD: if_urtw.c,v 1.47 2014/07/13 15:52:49 mpi Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
5  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include "bpfilter.h"
21 
22 #include <sys/param.h>
23 #include <sys/sockio.h>
24 #include <sys/mbuf.h>
25 #include <sys/kernel.h>
26 #include <sys/socket.h>
27 #include <sys/systm.h>
28 #include <sys/malloc.h>
29 #include <sys/timeout.h>
30 #include <sys/conf.h>
31 #include <sys/device.h>
32 
33 #include <machine/bus.h>
34 #include <machine/endian.h>
35 #if NBPFILTER > 0
36 #include <net/bpf.h>
37 #endif
38 #include <net/if.h>
39 #include <net/if_arp.h>
40 #include <net/if_dl.h>
41 #include <net/if_media.h>
42 #include <net/if_types.h>
43 
44 #include <netinet/in.h>
45 #include <netinet/if_ether.h>
46 
47 #include <net80211/ieee80211_var.h>
48 #include <net80211/ieee80211_radiotap.h>
49 
50 #include <dev/usb/usb.h>
51 #include <dev/usb/usbdi.h>
52 #include <dev/usb/usbdi_util.h>
53 #include <dev/usb/usbdevs.h>
54 
55 #include <dev/usb/if_urtwreg.h>
56 
57 #ifdef URTW_DEBUG
58 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
59 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
60 int urtw_debug = 0;
61 #else
62 #define	DPRINTF(x)
63 #define	DPRINTFN(n, x)
64 #endif
65 
66 /*
67  * Recognized device vendors/products.
68  */
69 static const struct urtw_type {
70 	struct usb_devno	dev;
71 	uint8_t			rev;
72 } urtw_devs[] = {
73 #define	URTW_DEV_RTL8187(v, p)	\
74 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
75 #define	URTW_DEV_RTL8187B(v, p)	\
76 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
77 	/* Realtek RTL8187 devices. */
78 	URTW_DEV_RTL8187(ASUS,		P5B_WIFI),
79 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
80 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GCV2),
81 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
82 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
83 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
84 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
85 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
86 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
87 	/* Realtek RTL8187B devices. */
88 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
89 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
90 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
91 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
92 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
93 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
94 #undef	URTW_DEV_RTL8187
95 #undef	URTW_DEV_RTL8187B
96 };
97 #define	urtw_lookup(v, p)	\
98 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
99 
100 /*
101  * Helper read/write macros.
102  */
103 #define urtw_read8_m(sc, val, data)	do {			\
104 	error = urtw_read8_c(sc, val, data, 0);			\
105 	if (error != 0)						\
106 		goto fail;					\
107 } while (0)
108 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
109 	error = urtw_read8_c(sc, val, data, idx);		\
110 	if (error != 0)						\
111 		goto fail;					\
112 } while (0)
113 #define urtw_write8_m(sc, val, data)	do {			\
114 	error = urtw_write8_c(sc, val, data, 0);		\
115 	if (error != 0)						\
116 		goto fail;					\
117 } while (0)
118 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
119 	error = urtw_write8_c(sc, val, data, idx);		\
120 	if (error != 0)						\
121 		goto fail;					\
122 } while (0)
123 #define urtw_read16_m(sc, val, data)	do {			\
124 	error = urtw_read16_c(sc, val, data, 0);		\
125 	if (error != 0)						\
126 		goto fail;					\
127 } while (0)
128 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
129 	error = urtw_read16_c(sc, val, data, idx);		\
130 	if (error != 0)						\
131 		goto fail;					\
132 } while (0)
133 #define urtw_write16_m(sc, val, data)	do {			\
134 	error = urtw_write16_c(sc, val, data, 0);		\
135 	if (error != 0)						\
136 		goto fail;					\
137 } while (0)
138 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
139 	error = urtw_write16_c(sc, val, data, idx);		\
140 	if (error != 0)						\
141 		goto fail;					\
142 } while (0)
143 #define urtw_read32_m(sc, val, data)	do {			\
144 	error = urtw_read32_c(sc, val, data, 0);		\
145 	if (error != 0)						\
146 		goto fail;					\
147 } while (0)
148 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
149 	error = urtw_read32_c(sc, val, data, idx);		\
150 	if (error != 0)						\
151 		goto fail;					\
152 } while (0)
153 #define urtw_write32_m(sc, val, data)	do {			\
154 	error = urtw_write32_c(sc, val, data, 0);		\
155 	if (error != 0)						\
156 		goto fail;					\
157 } while (0)
158 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
159 	error = urtw_write32_c(sc, val, data, idx);		\
160 	if (error != 0)						\
161 		goto fail;					\
162 } while (0)
163 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
164 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
165 	if (error != 0)						\
166 		goto fail;					\
167 } while (0)
168 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
169 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
170 	if (error != 0)						\
171 		goto fail;					\
172 } while (0)
173 #define urtw_8225_write(sc, val, data)	do {			\
174 	error = urtw_8225_write_c(sc, val, data);		\
175 	if (error != 0)						\
176 		goto fail;					\
177 } while (0)
178 
179 struct urtw_pair {
180 	uint32_t	reg;
181 	uint32_t	val;
182 };
183 
184 struct urtw_pair_idx {
185 	uint8_t		reg;
186 	uint8_t		val;
187 	uint8_t		idx;
188 };
189 
190 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
191 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
192 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
193 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
194 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
195 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
196 	{ 0xff, 0x00, 0 },
197 
198 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
199 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
200 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
201 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
202 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
203 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
204 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
205 	{ 0xf8, 0x08, 1 },
206 
207 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
208 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
209 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
210 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
211 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
212 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
213 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
214 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
215 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
216 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
217 
218 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
219 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
220 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
221 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
222 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
223 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
224 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
225 
226 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
227 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
228 };
229 
230 static uint8_t urtw_8225_agc[] = {
231 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
232 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
233 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
234 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
235 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
236 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
237 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
238 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
239 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
240 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
241 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
242 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
243 };
244 
245 static uint32_t urtw_8225_channel[] = {
246 	0x0000,		/* dummy channel 0 */
247 	0x085c,		/* 1 */
248 	0x08dc,		/* 2 */
249 	0x095c,		/* 3 */
250 	0x09dc,		/* 4 */
251 	0x0a5c,		/* 5 */
252 	0x0adc,		/* 6 */
253 	0x0b5c,		/* 7 */
254 	0x0bdc,		/* 8 */
255 	0x0c5c,		/* 9 */
256 	0x0cdc,		/* 10 */
257 	0x0d5c,		/* 11 */
258 	0x0ddc,		/* 12 */
259 	0x0e5c,		/* 13 */
260 	0x0f72,		/* 14 */
261 };
262 
263 static uint8_t urtw_8225_gain[] = {
264 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
265 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
266 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
267 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
268 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
269 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
270 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
271 };
272 
273 static struct urtw_pair urtw_8225_rf_part1[] = {
274 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
275 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
276 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
277 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
278 };
279 
280 static struct urtw_pair urtw_8225_rf_part2[] = {
281 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
282 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
283 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
284 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
285 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
286 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
287 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
288 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
289 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
290 	{ 0x27, 0x88 }
291 };
292 
293 static struct urtw_pair urtw_8225_rf_part3[] = {
294 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
295 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
296 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
297 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
298 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
299 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
300 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
301 };
302 
303 static uint16_t urtw_8225_rxgain[] = {
304 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
305 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
306 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
307 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
308 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
309 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
310 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
311 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
312 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
313 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
314 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
315 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
316 };
317 
318 static uint8_t urtw_8225_threshold[] = {
319 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
320 };
321 
322 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
323 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
324 };
325 
326 static uint8_t urtw_8225_txpwr_cck[] = {
327 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
328 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
329 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
330 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
331 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
332 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
333 };
334 
335 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
336 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
337 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
338 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
339 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
340 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
341 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
342 };
343 
344 static uint8_t urtw_8225_txpwr_ofdm[] = {
345 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
346 };
347 
348 static uint8_t urtw_8225v2_agc[] = {
349 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
350 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
351 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
352 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
353 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
354 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
355 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
356 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
357 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
358 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
359 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
360 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
361 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
362 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
363 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
364 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
365 };
366 
367 static uint8_t urtw_8225v2_ofdm[] = {
368 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
369 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
370 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
371 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
372 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
373 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
374 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
375 	0x6d, 0x3c, 0xfb, 0x07
376 };
377 
378 static uint8_t urtw_8225v2_gain_bg[] = {
379 	0x23, 0x15, 0xa5,		/* -82-1dbm */
380 	0x23, 0x15, 0xb5,		/* -82-2dbm */
381 	0x23, 0x15, 0xc5,		/* -82-3dbm */
382 	0x33, 0x15, 0xc5,		/* -78dbm */
383 	0x43, 0x15, 0xc5,		/* -74dbm */
384 	0x53, 0x15, 0xc5,		/* -70dbm */
385 	0x63, 0x15, 0xc5,		/* -66dbm */
386 };
387 
388 static struct urtw_pair urtw_8225v2_rf_part1[] = {
389 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
390 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
391 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
392 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
393 };
394 
395 static struct urtw_pair urtw_8225v2_rf_part2[] = {
396 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
397 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
398 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
399 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
400 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
401 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
402 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
403 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
404 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
405 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
406 };
407 
408 static struct urtw_pair urtw_8225v2_rf_part3[] = {
409 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
410 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
411 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
412 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
413 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
414 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
415 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
416 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
417 };
418 
419 static uint16_t urtw_8225v2_rxgain[] = {
420 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
421 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
422 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
423 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
424 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
425 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
426 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
427 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
428 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
429 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
430 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
431 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
432 };
433 
434 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
435 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
436 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
437 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
438 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
439 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
440 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
441 };
442 
443 static uint8_t urtw_8225v2_txpwr_cck[] = {
444 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
445 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
446 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
447 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
448 };
449 
450 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
451 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
452 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
453 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
454 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
455 };
456 
457 static struct urtw_pair urtw_8225v2_b_rf[] = {
458 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
459 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
460 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
461 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
462 	{ 0x00, 0x01b7 }
463 };
464 
465 static struct urtw_pair urtw_ratetable[] = {
466 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
467 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
468 	{ 96, 10 }, { 108, 11 }
469 };
470 
471 int		urtw_init(struct ifnet *);
472 void		urtw_stop(struct ifnet *, int);
473 int		urtw_ioctl(struct ifnet *, u_long, caddr_t);
474 void		urtw_start(struct ifnet *);
475 int		urtw_alloc_rx_data_list(struct urtw_softc *);
476 void		urtw_free_rx_data_list(struct urtw_softc *);
477 int		urtw_alloc_tx_data_list(struct urtw_softc *);
478 void		urtw_free_tx_data_list(struct urtw_softc *);
479 void		urtw_rxeof(struct usbd_xfer *, void *,
480 		    usbd_status);
481 int		urtw_tx_start(struct urtw_softc *,
482 		    struct ieee80211_node *, struct mbuf *, int);
483 void		urtw_txeof_low(struct usbd_xfer *, void *,
484 		    usbd_status);
485 void		urtw_txeof_normal(struct usbd_xfer *, void *,
486 		    usbd_status);
487 void		urtw_next_scan(void *);
488 void		urtw_task(void *);
489 void		urtw_ledusbtask(void *);
490 void		urtw_ledtask(void *);
491 int		urtw_media_change(struct ifnet *);
492 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
493 void		urtw_watchdog(struct ifnet *);
494 void		urtw_set_multi(struct urtw_softc *);
495 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
496 int		urtw_isbmode(uint16_t);
497 uint16_t	urtw_rate2rtl(int rate);
498 uint16_t	urtw_rtl2rate(int);
499 usbd_status	urtw_set_rate(struct urtw_softc *);
500 usbd_status	urtw_update_msr(struct urtw_softc *);
501 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
502 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
503 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
504 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
505 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
506 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
507 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
508 usbd_status	urtw_eprom_ck(struct urtw_softc *);
509 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
510 		    int);
511 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
512 		    uint32_t *);
513 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
514 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
515 usbd_status	urtw_get_macaddr(struct urtw_softc *);
516 usbd_status	urtw_get_txpwr(struct urtw_softc *);
517 usbd_status	urtw_get_rfchip(struct urtw_softc *);
518 usbd_status	urtw_led_init(struct urtw_softc *);
519 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
520 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
521 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
522 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
523 		    uint32_t);
524 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
525 		    uint32_t);
526 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
527 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
528 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
529 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
530 		    uint16_t);
531 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
532 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
533 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
534 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
535 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
536 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
537 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
538 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
539 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
540 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
541 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
542 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
543 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
544 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
545 usbd_status	urtw_open_pipes(struct urtw_softc *);
546 usbd_status	urtw_close_pipes(struct urtw_softc *);
547 usbd_status	urtw_intr_enable(struct urtw_softc *);
548 usbd_status	urtw_intr_disable(struct urtw_softc *);
549 usbd_status	urtw_reset(struct urtw_softc *);
550 usbd_status	urtw_led_on(struct urtw_softc *, int);
551 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
552 usbd_status	urtw_led_blink(struct urtw_softc *);
553 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
554 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
555 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
556 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
557 usbd_status	urtw_rx_setconf(struct urtw_softc *);
558 usbd_status	urtw_rx_enable(struct urtw_softc *);
559 usbd_status	urtw_tx_enable(struct urtw_softc *);
560 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
561 usbd_status	urtw_8187b_reset(struct urtw_softc *);
562 int		urtw_8187b_init(struct ifnet *);
563 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
564 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
565 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
566 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
567 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
568 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
569 int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
570 int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
571 
572 int urtw_match(struct device *, void *, void *);
573 void urtw_attach(struct device *, struct device *, void *);
574 int urtw_detach(struct device *, int);
575 
576 struct cfdriver urtw_cd = {
577 	NULL, "urtw", DV_IFNET
578 };
579 
580 const struct cfattach urtw_ca = {
581 	sizeof(struct urtw_softc), urtw_match, urtw_attach, urtw_detach
582 };
583 
584 int
585 urtw_match(struct device *parent, void *match, void *aux)
586 {
587 	struct usb_attach_arg *uaa = aux;
588 
589 	if (uaa->iface != NULL)
590 		return (UMATCH_NONE);
591 
592 	return ((urtw_lookup(uaa->vendor, uaa->product) != NULL) ?
593 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE);
594 }
595 
596 void
597 urtw_attach(struct device *parent, struct device *self, void *aux)
598 {
599 	struct urtw_softc *sc = (struct urtw_softc *)self;
600 	struct usb_attach_arg *uaa = aux;
601 	struct ieee80211com *ic = &sc->sc_ic;
602 	struct ifnet *ifp = &ic->ic_if;
603 	usbd_status error;
604 	uint8_t data8;
605 	uint32_t data;
606 	int i;
607 
608 	sc->sc_udev = uaa->device;
609 	sc->sc_hwrev = urtw_lookup(uaa->vendor, uaa->product)->rev;
610 
611 	printf("%s: ", sc->sc_dev.dv_xname);
612 
613 	if (sc->sc_hwrev & URTW_HWREV_8187) {
614 		urtw_read32_m(sc, URTW_TX_CONF, &data);
615 		data &= URTW_TX_HWREV_MASK;
616 		switch (data) {
617 		case URTW_TX_HWREV_8187_D:
618 			sc->sc_hwrev |= URTW_HWREV_8187_D;
619 			printf("RTL8187 rev D");
620 			break;
621 		case URTW_TX_HWREV_8187B_D:
622 			/*
623 			 * Detect Realtek RTL8187B devices that use
624 			 * USB IDs of RTL8187.
625 			 */
626 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
627 			printf("RTL8187B rev B (early)");
628 			break;
629 		default:
630 			sc->sc_hwrev |= URTW_HWREV_8187_B;
631 			printf("RTL8187 rev 0x%02x", data >> 25);
632 			break;
633 		}
634 	} else {
635 		/* RTL8187B hwrev register. */
636 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
637 		switch (data8) {
638 		case URTW_8187B_HWREV_8187B_B:
639 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
640 			printf("RTL8187B rev B");
641 			break;
642 		case URTW_8187B_HWREV_8187B_D:
643 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
644 			printf("RTL8187B rev D");
645 			break;
646 		case URTW_8187B_HWREV_8187B_E:
647 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
648 			printf("RTL8187B rev E");
649 			break;
650 		default:
651 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
652 			printf("RTL8187B rev 0x%02x", data8);
653 			break;
654 		}
655 	}
656 
657 	urtw_read32_m(sc, URTW_RX, &data);
658 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
659 	    URTW_EEPROM_93C46;
660 
661 	error = urtw_get_rfchip(sc);
662 	if (error != 0)
663 		goto fail;
664 	error = urtw_get_macaddr(sc);
665 	if (error != 0)
666 		goto fail;
667 	error = urtw_get_txpwr(sc);
668 	if (error != 0)
669 		goto fail;
670 	error = urtw_led_init(sc);		/* XXX incompleted */
671 	if (error != 0)
672 		goto fail;
673 
674 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
675 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
676 	sc->sc_currate = 3;
677 	/* XXX for what? */
678 	sc->sc_preamble_mode = 2;
679 
680 	usb_init_task(&sc->sc_task, urtw_task, sc, USB_TASK_TYPE_GENERIC);
681 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc,
682 	    USB_TASK_TYPE_GENERIC);
683 	timeout_set(&sc->scan_to, urtw_next_scan, sc);
684 	timeout_set(&sc->sc_led_ch, urtw_ledtask, sc);
685 
686 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
687 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
688 	ic->ic_state = IEEE80211_S_INIT;
689 
690 	/* set device capabilities */
691 	ic->ic_caps =
692 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
693 	    IEEE80211_C_TXPMGT |	/* tx power management */
694 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
695 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
696 	    IEEE80211_C_WEP |		/* s/w WEP */
697 	    IEEE80211_C_RSN;		/* WPA/RSN */
698 
699 	/* set supported .11b and .11g rates */
700 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
701 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
702 
703 	/* set supported .11b and .11g channels (1 through 14) */
704 	for (i = 1; i <= 14; i++) {
705 		ic->ic_channels[i].ic_freq =
706 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
707 		ic->ic_channels[i].ic_flags =
708 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
709 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
710 	}
711 
712 	ifp->if_softc = sc;
713 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
714 	if (sc->sc_hwrev & URTW_HWREV_8187) {
715 		sc->sc_init = urtw_init;
716 	} else {
717 		sc->sc_init = urtw_8187b_init;
718 	}
719 	ifp->if_ioctl = urtw_ioctl;
720 	ifp->if_start = urtw_start;
721 	ifp->if_watchdog = urtw_watchdog;
722 	IFQ_SET_READY(&ifp->if_snd);
723 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
724 
725 	if_attach(ifp);
726 	ieee80211_ifattach(ifp);
727 
728 	/* override state transition machine */
729 	sc->sc_newstate = ic->ic_newstate;
730 	ic->ic_newstate = urtw_newstate;
731 	ieee80211_media_init(ifp, urtw_media_change, ieee80211_media_status);
732 
733 #if NBPFILTER > 0
734 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
735 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
736 
737 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
738 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
739 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
740 
741 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
742 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
743 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
744 #endif
745 
746 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
747 
748 	return;
749 fail:
750 	printf(": %s failed!\n", __func__);
751 }
752 
753 int
754 urtw_detach(struct device *self, int flags)
755 {
756 	struct urtw_softc *sc = (struct urtw_softc *)self;
757 	struct ifnet *ifp = &sc->sc_ic.ic_if;
758 	int s;
759 
760 	s = splusb();
761 
762 	if (timeout_initialized(&sc->scan_to))
763 		timeout_del(&sc->scan_to);
764 	if (timeout_initialized(&sc->sc_led_ch))
765 		timeout_del(&sc->sc_led_ch);
766 
767 	usb_rem_wait_task(sc->sc_udev, &sc->sc_task);
768 	usb_rem_wait_task(sc->sc_udev, &sc->sc_ledtask);
769 
770 	usbd_ref_wait(sc->sc_udev);
771 
772 	if (ifp->if_softc != NULL) {
773 		ieee80211_ifdetach(ifp);	/* free all nodes */
774 		if_detach(ifp);
775 	}
776 
777 	/* abort and free xfers */
778 	urtw_free_tx_data_list(sc);
779 	urtw_free_rx_data_list(sc);
780 	urtw_close_pipes(sc);
781 
782 	splx(s);
783 
784 	return (0);
785 }
786 
787 usbd_status
788 urtw_close_pipes(struct urtw_softc *sc)
789 {
790 	usbd_status error = 0;
791 
792 	if (sc->sc_rxpipe != NULL) {
793 		error = usbd_close_pipe(sc->sc_rxpipe);
794 		if (error != 0)
795 			goto fail;
796 		sc->sc_rxpipe = NULL;
797 	}
798 	if (sc->sc_txpipe_low != NULL) {
799 		error = usbd_close_pipe(sc->sc_txpipe_low);
800 		if (error != 0)
801 			goto fail;
802 		sc->sc_txpipe_low = NULL;
803 	}
804 	if (sc->sc_txpipe_normal != NULL) {
805 		error = usbd_close_pipe(sc->sc_txpipe_normal);
806 		if (error != 0)
807 			goto fail;
808 		sc->sc_txpipe_normal = NULL;
809 	}
810 fail:
811 	return (error);
812 }
813 
814 usbd_status
815 urtw_open_pipes(struct urtw_softc *sc)
816 {
817 	usbd_status error;
818 
819 	/*
820 	 * NB: there is no way to distinguish each pipes so we need to hardcode
821 	 * pipe numbers
822 	 */
823 
824 	/* tx pipe - low priority packets */
825 	if (sc->sc_hwrev & URTW_HWREV_8187)
826 		error = usbd_open_pipe(sc->sc_iface, 0x2,
827 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
828 	else
829 		error = usbd_open_pipe(sc->sc_iface, 0x6,
830 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
831 	if (error != 0) {
832 		printf("%s: could not open Tx low pipe: %s\n",
833 		    sc->sc_dev.dv_xname, usbd_errstr(error));
834 		goto fail;
835 	}
836 	/* tx pipe - normal priority packets */
837 	if (sc->sc_hwrev & URTW_HWREV_8187)
838 		error = usbd_open_pipe(sc->sc_iface, 0x3,
839 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
840 	else
841 		error = usbd_open_pipe(sc->sc_iface, 0x7,
842 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
843 	if (error != 0) {
844 		printf("%s: could not open Tx normal pipe: %s\n",
845 		    sc->sc_dev.dv_xname, usbd_errstr(error));
846 		goto fail;
847 	}
848 	/* rx pipe */
849 	if (sc->sc_hwrev & URTW_HWREV_8187)
850 		error = usbd_open_pipe(sc->sc_iface, 0x81,
851 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
852 	else
853 		error = usbd_open_pipe(sc->sc_iface, 0x83,
854 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
855 	if (error != 0) {
856 		printf("%s: could not open Rx pipe: %s\n",
857 		    sc->sc_dev.dv_xname, usbd_errstr(error));
858 		goto fail;
859 	}
860 
861 	return (0);
862 fail:
863 	(void)urtw_close_pipes(sc);
864 	return (error);
865 }
866 
867 int
868 urtw_alloc_rx_data_list(struct urtw_softc *sc)
869 {
870 	int i, error;
871 
872 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
873 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
874 
875 		data->sc = sc;
876 
877 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
878 		if (data->xfer == NULL) {
879 			printf("%s: could not allocate rx xfer\n",
880 			    sc->sc_dev.dv_xname);
881 			error = ENOMEM;
882 			goto fail;
883 		}
884 
885 		if (usbd_alloc_buffer(data->xfer, URTW_RX_MAXSIZE) == NULL) {
886 			printf("%s: could not allocate rx buffer\n",
887 			    sc->sc_dev.dv_xname);
888 			error = ENOMEM;
889 			goto fail;
890 		}
891 
892 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
893 		if (data->m == NULL) {
894 			printf("%s: could not allocate rx mbuf\n",
895 			    sc->sc_dev.dv_xname);
896 			error = ENOMEM;
897 			goto fail;
898 		}
899 		MCLGET(data->m, M_DONTWAIT);
900 		if (!(data->m->m_flags & M_EXT)) {
901 			printf("%s: could not allocate rx mbuf cluster\n",
902 			    sc->sc_dev.dv_xname);
903 			error = ENOMEM;
904 			goto fail;
905 		}
906 		data->buf = mtod(data->m, uint8_t *);
907 	}
908 
909 	return (0);
910 
911 fail:
912 	urtw_free_rx_data_list(sc);
913 	return (error);
914 }
915 
916 void
917 urtw_free_rx_data_list(struct urtw_softc *sc)
918 {
919 	int i;
920 
921 	/* Make sure no transfers are pending. */
922 	if (sc->sc_rxpipe != NULL)
923 		usbd_abort_pipe(sc->sc_rxpipe);
924 
925 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
926 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
927 
928 		if (data->xfer != NULL) {
929 			usbd_free_xfer(data->xfer);
930 			data->xfer = NULL;
931 		}
932 		if (data->m != NULL) {
933 			m_freem(data->m);
934 			data->m = NULL;
935 		}
936 	}
937 }
938 
939 int
940 urtw_alloc_tx_data_list(struct urtw_softc *sc)
941 {
942 	int i, error;
943 
944 	for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
945 		struct urtw_tx_data *data = &sc->sc_tx_data[i];
946 
947 		data->sc = sc;
948 		data->ni = NULL;
949 
950 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
951 		if (data->xfer == NULL) {
952 			printf("%s: could not allocate tx xfer\n",
953 			    sc->sc_dev.dv_xname);
954 			error = ENOMEM;
955 			goto fail;
956 		}
957 
958 		data->buf = usbd_alloc_buffer(data->xfer, URTW_TX_MAXSIZE);
959 		if (data->buf == NULL) {
960 			printf("%s: could not allocate tx buffer\n",
961 			    sc->sc_dev.dv_xname);
962 			error = ENOMEM;
963 			goto fail;
964 		}
965 
966 		if (((unsigned long)data->buf) % 4)
967 			printf("%s: warn: unaligned buffer %p\n",
968 			    sc->sc_dev.dv_xname, data->buf);
969 	}
970 
971 	return (0);
972 
973 fail:
974 	urtw_free_tx_data_list(sc);
975 	return (error);
976 }
977 
978 void
979 urtw_free_tx_data_list(struct urtw_softc *sc)
980 {
981 	struct ieee80211com *ic = &sc->sc_ic;
982 	int i;
983 
984 	/* Make sure no transfers are pending. */
985 	if (sc->sc_txpipe_low != NULL)
986 		usbd_abort_pipe(sc->sc_txpipe_low);
987 	if (sc->sc_txpipe_normal != NULL)
988 		usbd_abort_pipe(sc->sc_txpipe_normal);
989 
990 	for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
991 		struct urtw_tx_data *data = &sc->sc_tx_data[i];
992 
993 		if (data->xfer != NULL) {
994 			usbd_free_xfer(data->xfer);
995 			data->xfer = NULL;
996 		}
997 		if (data->ni != NULL) {
998 			ieee80211_release_node(ic, data->ni);
999 			data->ni = NULL;
1000 		}
1001 	}
1002 }
1003 
1004 int
1005 urtw_media_change(struct ifnet *ifp)
1006 {
1007 	struct urtw_softc *sc = ifp->if_softc;
1008 	int error;
1009 
1010 	error = ieee80211_media_change(ifp);
1011 	if (error != ENETRESET)
1012 		return (error);
1013 
1014 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1015 	    (IFF_UP | IFF_RUNNING))
1016 		sc->sc_init(ifp);
1017 
1018 	return (0);
1019 }
1020 
1021 int
1022 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1023 {
1024 	struct urtw_softc *sc = ic->ic_if.if_softc;
1025 
1026 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1027 	timeout_del(&sc->scan_to);
1028 
1029 	/* do it in a process context */
1030 	sc->sc_state = nstate;
1031 	sc->sc_arg = arg;
1032 	usb_add_task(sc->sc_udev, &sc->sc_task);
1033 
1034 	return (0);
1035 }
1036 
1037 usbd_status
1038 urtw_led_init(struct urtw_softc *sc)
1039 {
1040 	uint32_t rev;
1041 	usbd_status error;
1042 
1043 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1044 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1045 	if (error != 0)
1046 		goto fail;
1047 
1048 	switch (rev & URTW_EPROM_CID_MASK) {
1049 	case URTW_EPROM_CID_ALPHA0:
1050 		sc->sc_strategy = URTW_SW_LED_MODE1;
1051 		break;
1052 	case URTW_EPROM_CID_SERCOMM_PS:
1053 		sc->sc_strategy = URTW_SW_LED_MODE3;
1054 		break;
1055 	case URTW_EPROM_CID_HW_LED:
1056 		sc->sc_strategy = URTW_HW_LED;
1057 		break;
1058 	case URTW_EPROM_CID_RSVD0:
1059 	case URTW_EPROM_CID_RSVD1:
1060 	default:
1061 		sc->sc_strategy = URTW_SW_LED_MODE0;
1062 		break;
1063 	}
1064 
1065 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1066 
1067 fail:
1068 	return (error);
1069 }
1070 
1071 usbd_status
1072 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1073     uint16_t data)
1074 {
1075 	usb_device_request_t req;
1076 
1077 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1078 	req.bRequest = URTW_8187_SETREGS_REQ;
1079 	USETW(req.wValue, addr);
1080 	USETW(req.wIndex, index);
1081 	USETW(req.wLength, sizeof(uint16_t));
1082 
1083 	return (usbd_do_request(sc->sc_udev, &req, &data));
1084 }
1085 
1086 usbd_status
1087 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1088 {
1089 	int i;
1090 	int16_t bit;
1091 	uint8_t rlen = 12, wlen = 6;
1092 	uint16_t o1, o2, o3, tmp;
1093 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1094 	uint32_t mask = 0x80000000, value = 0;
1095 	usbd_status error;
1096 
1097 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1098 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1099 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1100 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1101 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1102 	o1 &= ~0xf;
1103 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1104 	DELAY(5);
1105 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1106 	DELAY(5);
1107 
1108 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1109 		bit = ((d2w & mask) != 0) ? 1 : 0;
1110 
1111 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1112 		DELAY(2);
1113 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1114 		    URTW_BB_HOST_BANG_CLK);
1115 		DELAY(2);
1116 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1117 		    URTW_BB_HOST_BANG_CLK);
1118 		DELAY(2);
1119 		mask = mask >> 1;
1120 		if (i == 2)
1121 			break;
1122 		bit = ((d2w & mask) != 0) ? 1 : 0;
1123 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1124 		    URTW_BB_HOST_BANG_CLK);
1125 		DELAY(2);
1126 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1127 		    URTW_BB_HOST_BANG_CLK);
1128 		DELAY(2);
1129 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1130 		DELAY(1);
1131 	}
1132 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1133 	    URTW_BB_HOST_BANG_CLK);
1134 	DELAY(2);
1135 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1136 	DELAY(2);
1137 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1138 	DELAY(2);
1139 
1140 	mask = 0x800;
1141 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1142 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1143 		    o1 | URTW_BB_HOST_BANG_RW);
1144 		DELAY(2);
1145 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1146 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1147 		DELAY(2);
1148 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1149 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1150 		DELAY(2);
1151 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1152 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1153 		DELAY(2);
1154 
1155 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1156 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1157 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1158 		    o1 | URTW_BB_HOST_BANG_RW);
1159 		DELAY(2);
1160 	}
1161 
1162 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1163 	    URTW_BB_HOST_BANG_RW);
1164 	DELAY(2);
1165 
1166 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1167 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1168 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1169 
1170 	if (data != NULL)
1171 		*data = value;
1172 fail:
1173 	return (error);
1174 }
1175 
1176 usbd_status
1177 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1178 {
1179 	uint16_t d80, d82, d84;
1180 	usbd_status error;
1181 
1182 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1183 	d80 &= 0xfff3;
1184 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1185 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1186 	d84 &= 0xfff0;
1187 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1188 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1189 	DELAY(10);
1190 
1191 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1192 	DELAY(2);
1193 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1194 	DELAY(10);
1195 
1196 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1197 	if (error != 0)
1198 		goto fail;
1199 
1200 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1201 	DELAY(10);
1202 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1203 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1204 	usbd_delay_ms(sc->sc_udev, 2);
1205 fail:
1206 	return (error);
1207 }
1208 
1209 usbd_status
1210 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1211 {
1212 	uint32_t data;
1213 	usbd_status error;
1214 
1215 	*ret = 1;
1216 
1217 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1218 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1219 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1220 	usbd_delay_ms(sc->sc_udev, 500);
1221 
1222 	urtw_8225_write(sc, 0x0, 0x1b7);
1223 
1224 	error = urtw_8225_read(sc, 0x8, &data);
1225 	if (error != 0)
1226 		goto fail;
1227 	if (data != 0x588)
1228 		*ret = 0;
1229 	else {
1230 		error = urtw_8225_read(sc, 0x9, &data);
1231 		if (error != 0)
1232 			goto fail;
1233 		if (data != 0x700)
1234 			*ret = 0;
1235 	}
1236 
1237 	urtw_8225_write(sc, 0x0, 0xb7);
1238 fail:
1239 	return (error);
1240 }
1241 
1242 usbd_status
1243 urtw_get_rfchip(struct urtw_softc *sc)
1244 {
1245 	struct urtw_rf *rf = &sc->sc_rf;
1246 	int ret;
1247 	uint32_t data;
1248 	usbd_status error;
1249 
1250 	rf->rf_sc = sc;
1251 
1252 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1253 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1254 		if (error != 0)
1255 			panic("unsupported RF chip");
1256 			/* NOTREACHED */
1257 		switch (data & 0xff) {
1258 		case URTW_EPROM_RFCHIPID_RTL8225U:
1259 			error = urtw_8225_isv2(sc, &ret);
1260 			if (error != 0)
1261 				goto fail;
1262 			if (ret == 0) {
1263 				rf->init = urtw_8225_rf_init;
1264 				rf->set_chan = urtw_8225_rf_set_chan;
1265 				rf->set_sens = urtw_8225_rf_set_sens;
1266 				printf(", RFv1");
1267 			} else {
1268 				rf->init = urtw_8225v2_rf_init;
1269 				rf->set_chan = urtw_8225v2_rf_set_chan;
1270 				rf->set_sens = NULL;
1271 				printf(", RFv2");
1272 			}
1273 			break;
1274 		default:
1275 			goto fail;
1276 		}
1277 	} else {
1278 		rf->init = urtw_8225v2_b_rf_init;
1279 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1280 		rf->set_sens = NULL;
1281 	}
1282 
1283 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1284 	rf->sens = URTW_8225_RF_DEF_SENS;
1285 
1286 	return (0);
1287 
1288 fail:
1289 	panic("unsupported RF chip %d", data & 0xff);
1290 	/* NOTREACHED */
1291 }
1292 
1293 usbd_status
1294 urtw_get_txpwr(struct urtw_softc *sc)
1295 {
1296 	int i, j;
1297 	uint32_t data;
1298 	usbd_status error;
1299 
1300 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1301 	if (error != 0)
1302 		goto fail;
1303 	sc->sc_txpwr_cck_base = data & 0xf;
1304 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1305 
1306 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1307 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1308 		if (error != 0)
1309 			goto fail;
1310 		sc->sc_txpwr_cck[i] = data & 0xf;
1311 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1312 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1313 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1314 	}
1315 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1316 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1317 		if (error != 0)
1318 			goto fail;
1319 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1320 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1321 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1322 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1323 	}
1324 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1325 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1326 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1327 			    &data);
1328 			if (error != 0)
1329 				goto fail;
1330 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1331 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1332 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1333 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1334 			    (data & 0xf000) >> 12;
1335 		}
1336 	} else {
1337 		/* Channel 11. */
1338 		error = urtw_eprom_read32(sc, 0x1b, &data);
1339 		if (error != 0)
1340 			goto fail;
1341 		sc->sc_txpwr_cck[11] = data & 0xf;
1342 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1343 
1344 		/* Channel 12. */
1345 		error = urtw_eprom_read32(sc, 0xa, &data);
1346 		if (error != 0)
1347 			goto fail;
1348 		sc->sc_txpwr_cck[12] = data & 0xf;
1349 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1350 
1351 		/* Channel 13, 14. */
1352 		error = urtw_eprom_read32(sc, 0x1c, &data);
1353 		if (error != 0)
1354 			goto fail;
1355 		sc->sc_txpwr_cck[13] = data & 0xf;
1356 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1357 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1358 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1359 	}
1360 fail:
1361 	return (error);
1362 }
1363 
1364 usbd_status
1365 urtw_get_macaddr(struct urtw_softc *sc)
1366 {
1367 	struct ieee80211com *ic = &sc->sc_ic;
1368 	usbd_status error;
1369 	uint32_t data;
1370 
1371 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1372 	if (error != 0)
1373 		goto fail;
1374 	ic->ic_myaddr[0] = data & 0xff;
1375 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1376 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1377 	if (error != 0)
1378 		goto fail;
1379 	ic->ic_myaddr[2] = data & 0xff;
1380 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1381 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1382 	if (error != 0)
1383 		goto fail;
1384 	ic->ic_myaddr[4] = data & 0xff;
1385 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1386 fail:
1387 	return (error);
1388 }
1389 
1390 usbd_status
1391 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1392 {
1393 #define URTW_READCMD_LEN		3
1394 	int addrlen, i;
1395 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1396 	usbd_status error;
1397 
1398 	/* NB: make sure the buffer is initialized */
1399 	*data = 0;
1400 
1401 	/* enable EPROM programming */
1402 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1403 	DELAY(URTW_EPROM_DELAY);
1404 
1405 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1406 	if (error != 0)
1407 		goto fail;
1408 	error = urtw_eprom_ck(sc);
1409 	if (error != 0)
1410 		goto fail;
1411 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1412 	if (error != 0)
1413 		goto fail;
1414 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1415 		addrlen = 8;
1416 		addrstr[0] = addr & (1 << 7);
1417 		addrstr[1] = addr & (1 << 6);
1418 		addrstr[2] = addr & (1 << 5);
1419 		addrstr[3] = addr & (1 << 4);
1420 		addrstr[4] = addr & (1 << 3);
1421 		addrstr[5] = addr & (1 << 2);
1422 		addrstr[6] = addr & (1 << 1);
1423 		addrstr[7] = addr & (1 << 0);
1424 	} else {
1425 		addrlen=6;
1426 		addrstr[0] = addr & (1 << 5);
1427 		addrstr[1] = addr & (1 << 4);
1428 		addrstr[2] = addr & (1 << 3);
1429 		addrstr[3] = addr & (1 << 2);
1430 		addrstr[4] = addr & (1 << 1);
1431 		addrstr[5] = addr & (1 << 0);
1432 	}
1433 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1434 	if (error != 0)
1435 		goto fail;
1436 
1437 	error = urtw_eprom_writebit(sc, 0);
1438 	if (error != 0)
1439 		goto fail;
1440 
1441 	for (i = 0; i < 16; i++) {
1442 		error = urtw_eprom_ck(sc);
1443 		if (error != 0)
1444 			goto fail;
1445 		error = urtw_eprom_readbit(sc, &data16);
1446 		if (error != 0)
1447 			goto fail;
1448 
1449 		(*data) |= (data16 << (15 - i));
1450 	}
1451 
1452 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1453 	if (error != 0)
1454 		goto fail;
1455 	error = urtw_eprom_ck(sc);
1456 	if (error != 0)
1457 		goto fail;
1458 
1459 	/* now disable EPROM programming */
1460 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1461 fail:
1462 	return (error);
1463 #undef URTW_READCMD_LEN
1464 }
1465 
1466 usbd_status
1467 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1468 {
1469 	uint8_t data8;
1470 	usbd_status error;
1471 
1472 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1473 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1474 	DELAY(URTW_EPROM_DELAY);
1475 
1476 fail:
1477 	return (error);
1478 }
1479 
1480 usbd_status
1481 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1482 {
1483 	int i = 0;
1484 	usbd_status error = 0;
1485 
1486 	for (i = 0; i < buflen; i++) {
1487 		error = urtw_eprom_writebit(sc, buf[i]);
1488 		if (error != 0)
1489 			goto fail;
1490 		error = urtw_eprom_ck(sc);
1491 		if (error != 0)
1492 			goto fail;
1493 	}
1494 fail:
1495 	return (error);
1496 }
1497 
1498 usbd_status
1499 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1500 {
1501 	uint8_t data;
1502 	usbd_status error;
1503 
1504 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1505 	if (bit != 0)
1506 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1507 	else
1508 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1509 	DELAY(URTW_EPROM_DELAY);
1510 fail:
1511 	return (error);
1512 }
1513 
1514 usbd_status
1515 urtw_eprom_ck(struct urtw_softc *sc)
1516 {
1517 	uint8_t data;
1518 	usbd_status error;
1519 
1520 	/* masking */
1521 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1522 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1523 	DELAY(URTW_EPROM_DELAY);
1524 	/* unmasking */
1525 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1526 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1527 	DELAY(URTW_EPROM_DELAY);
1528 fail:
1529 	return (error);
1530 }
1531 
1532 usbd_status
1533 urtw_eprom_cs(struct urtw_softc *sc, int able)
1534 {
1535 	uint8_t data;
1536 	usbd_status error;
1537 
1538 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1539 	if (able == URTW_EPROM_ENABLE)
1540 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1541 	else
1542 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1543 	DELAY(URTW_EPROM_DELAY);
1544 fail:
1545 	return (error);
1546 }
1547 
1548 usbd_status
1549 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1550 {
1551 	usb_device_request_t req;
1552 	usbd_status error;
1553 
1554 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1555 	req.bRequest = URTW_8187_GETREGS_REQ;
1556 	USETW(req.wValue, val | 0xff00);
1557 	USETW(req.wIndex, idx & 0x03);
1558 	USETW(req.wLength, sizeof(uint8_t));
1559 
1560 	error = usbd_do_request(sc->sc_udev, &req, data);
1561 	return (error);
1562 }
1563 
1564 usbd_status
1565 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1566 {
1567 	usb_device_request_t req;
1568 	usbd_status error;
1569 
1570 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1571 	req.bRequest = URTW_8187_GETREGS_REQ;
1572 	USETW(req.wValue, val | 0xfe00);
1573 	USETW(req.wIndex, 0);
1574 	USETW(req.wLength, sizeof(uint8_t));
1575 
1576 	error = usbd_do_request(sc->sc_udev, &req, data);
1577 	return (error);
1578 }
1579 
1580 usbd_status
1581 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1582 {
1583 	usb_device_request_t req;
1584 	usbd_status error;
1585 
1586 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1587 	req.bRequest = URTW_8187_GETREGS_REQ;
1588 	USETW(req.wValue, val | 0xff00);
1589 	USETW(req.wIndex, idx & 0x03);
1590 	USETW(req.wLength, sizeof(uint16_t));
1591 
1592 	error = usbd_do_request(sc->sc_udev, &req, data);
1593 	return (error);
1594 }
1595 
1596 usbd_status
1597 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1598 {
1599 	usb_device_request_t req;
1600 	usbd_status error;
1601 
1602 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1603 	req.bRequest = URTW_8187_GETREGS_REQ;
1604 	USETW(req.wValue, val | 0xff00);
1605 	USETW(req.wIndex, idx & 0x03);
1606 	USETW(req.wLength, sizeof(uint32_t));
1607 
1608 	error = usbd_do_request(sc->sc_udev, &req, data);
1609 	return (error);
1610 }
1611 
1612 usbd_status
1613 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1614 {
1615 	usb_device_request_t req;
1616 
1617 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1618 	req.bRequest = URTW_8187_SETREGS_REQ;
1619 	USETW(req.wValue, val | 0xff00);
1620 	USETW(req.wIndex, idx & 0x03);
1621 	USETW(req.wLength, sizeof(uint8_t));
1622 
1623 	return (usbd_do_request(sc->sc_udev, &req, &data));
1624 }
1625 
1626 usbd_status
1627 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1628 {
1629 	usb_device_request_t req;
1630 
1631 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1632 	req.bRequest = URTW_8187_SETREGS_REQ;
1633 	USETW(req.wValue, val | 0xfe00);
1634 	USETW(req.wIndex, 0);
1635 	USETW(req.wLength, sizeof(uint8_t));
1636 
1637 	return (usbd_do_request(sc->sc_udev, &req, &data));
1638 }
1639 
1640 usbd_status
1641 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1642 {
1643 	usb_device_request_t req;
1644 
1645 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1646 	req.bRequest = URTW_8187_SETREGS_REQ;
1647 	USETW(req.wValue, val | 0xff00);
1648 	USETW(req.wIndex, idx & 0x03);
1649 	USETW(req.wLength, sizeof(uint16_t));
1650 
1651 	return (usbd_do_request(sc->sc_udev, &req, &data));
1652 }
1653 
1654 usbd_status
1655 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1656 {
1657 	usb_device_request_t req;
1658 
1659 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1660 	req.bRequest = URTW_8187_SETREGS_REQ;
1661 	USETW(req.wValue, val | 0xff00);
1662 	USETW(req.wIndex, idx & 0x03);
1663 	USETW(req.wLength, sizeof(uint32_t));
1664 
1665 	return (usbd_do_request(sc->sc_udev, &req, &data));
1666 }
1667 
1668 static usbd_status
1669 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1670 {
1671 	uint8_t data;
1672 	usbd_status error;
1673 
1674 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1675 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1676 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1677 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1678 fail:
1679 	return (error);
1680 }
1681 
1682 usbd_status
1683 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1684 {
1685 	uint8_t data;
1686 	usbd_status error;
1687 
1688 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1689 	if (error)
1690 		goto fail;
1691 
1692 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1693 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1694 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1695 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1696 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1697 
1698 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1699 	if (error)
1700 		goto fail;
1701 fail:
1702 	return (error);
1703 }
1704 
1705 usbd_status
1706 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1707 {
1708 	uint8_t data;
1709 	usbd_status error;
1710 
1711 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1712 	if (error)
1713 		goto fail;
1714 
1715 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1716 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1717 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1718 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1719 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1720 
1721 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1722 	if (error)
1723 		goto fail;
1724 fail:
1725 	return (error);
1726 }
1727 
1728 usbd_status
1729 urtw_intr_disable(struct urtw_softc *sc)
1730 {
1731 	usbd_status error;
1732 
1733 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1734 fail:
1735 	return (error);
1736 }
1737 
1738 usbd_status
1739 urtw_reset(struct urtw_softc *sc)
1740 {
1741 	uint8_t data;
1742 	usbd_status error;
1743 
1744 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1745 	if (error)
1746 		goto fail;
1747 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1748 	if (error)
1749 		goto fail;
1750 
1751 	error = urtw_intr_disable(sc);
1752 	if (error)
1753 		goto fail;
1754 	usbd_delay_ms(sc->sc_udev, 100);
1755 
1756 	error = urtw_write8e(sc, 0x18, 0x10);
1757 	if (error != 0)
1758 		goto fail;
1759 	error = urtw_write8e(sc, 0x18, 0x11);
1760 	if (error != 0)
1761 		goto fail;
1762 	error = urtw_write8e(sc, 0x18, 0x00);
1763 	if (error != 0)
1764 		goto fail;
1765 	usbd_delay_ms(sc->sc_udev, 100);
1766 
1767 	urtw_read8_m(sc, URTW_CMD, &data);
1768 	data = (data & 2) | URTW_CMD_RST;
1769 	urtw_write8_m(sc, URTW_CMD, data);
1770 	usbd_delay_ms(sc->sc_udev, 100);
1771 
1772 	urtw_read8_m(sc, URTW_CMD, &data);
1773 	if (data & URTW_CMD_RST) {
1774 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
1775 		goto fail;
1776 	}
1777 
1778 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1779 	if (error)
1780 		goto fail;
1781 	usbd_delay_ms(sc->sc_udev, 100);
1782 
1783 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1784 	if (error)
1785 		goto fail;
1786 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1787 	if (error)
1788 		goto fail;
1789 fail:
1790 	return (error);
1791 }
1792 
1793 usbd_status
1794 urtw_led_on(struct urtw_softc *sc, int type)
1795 {
1796 	usbd_status error;
1797 
1798 	if (type == URTW_LED_GPIO) {
1799 		switch (sc->sc_gpio_ledpin) {
1800 		case URTW_LED_PIN_GPIO0:
1801 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1802 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1803 			break;
1804 		default:
1805 			panic("unsupported LED PIN type 0x%x",
1806 			    sc->sc_gpio_ledpin);
1807 			/* NOTREACHED */
1808 		}
1809 	} else {
1810 		panic("unsupported LED type 0x%x", type);
1811 		/* NOTREACHED */
1812 	}
1813 
1814 	sc->sc_gpio_ledon = 1;
1815 fail:
1816 	return (error);
1817 }
1818 
1819 static usbd_status
1820 urtw_led_off(struct urtw_softc *sc, int type)
1821 {
1822 	usbd_status error;
1823 
1824 	if (type == URTW_LED_GPIO) {
1825 		switch (sc->sc_gpio_ledpin) {
1826 		case URTW_LED_PIN_GPIO0:
1827 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1828 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1829 			break;
1830 		default:
1831 			panic("unsupported LED PIN type 0x%x",
1832 			    sc->sc_gpio_ledpin);
1833 			/* NOTREACHED */
1834 		}
1835 	} else {
1836 		panic("unsupported LED type 0x%x", type);
1837 		/* NOTREACHED */
1838 	}
1839 
1840 	sc->sc_gpio_ledon = 0;
1841 
1842 fail:
1843 	return (error);
1844 }
1845 
1846 usbd_status
1847 urtw_led_mode0(struct urtw_softc *sc, int mode)
1848 {
1849 	struct timeval t;
1850 
1851 	switch (mode) {
1852 	case URTW_LED_CTL_POWER_ON:
1853 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1854 		break;
1855 	case URTW_LED_CTL_TX:
1856 		if (sc->sc_gpio_ledinprogress == 1)
1857 			return (0);
1858 
1859 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1860 		sc->sc_gpio_blinktime = 2;
1861 		break;
1862 	case URTW_LED_CTL_LINK:
1863 		sc->sc_gpio_ledstate = URTW_LED_ON;
1864 		break;
1865 	default:
1866 		panic("unsupported LED mode 0x%x", mode);
1867 		/* NOTREACHED */
1868 	}
1869 
1870 	switch (sc->sc_gpio_ledstate) {
1871 	case URTW_LED_ON:
1872 		if (sc->sc_gpio_ledinprogress != 0)
1873 			break;
1874 		urtw_led_on(sc, URTW_LED_GPIO);
1875 		break;
1876 	case URTW_LED_BLINK_NORMAL:
1877 		if (sc->sc_gpio_ledinprogress != 0)
1878 			break;
1879 		sc->sc_gpio_ledinprogress = 1;
1880 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1881 			URTW_LED_OFF : URTW_LED_ON;
1882 		t.tv_sec = 0;
1883 		t.tv_usec = 100 * 1000L;
1884 		if (!usbd_is_dying(sc->sc_udev))
1885 			timeout_add(&sc->sc_led_ch, tvtohz(&t));
1886 		break;
1887 	case URTW_LED_POWER_ON_BLINK:
1888 		urtw_led_on(sc, URTW_LED_GPIO);
1889 		usbd_delay_ms(sc->sc_udev, 100);
1890 		urtw_led_off(sc, URTW_LED_GPIO);
1891 		break;
1892 	default:
1893 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1894 		/* NOTREACHED */
1895 	}
1896 	return (0);
1897 }
1898 
1899 usbd_status
1900 urtw_led_mode1(struct urtw_softc *sc, int mode)
1901 {
1902 	return (USBD_INVAL);
1903 }
1904 
1905 usbd_status
1906 urtw_led_mode2(struct urtw_softc *sc, int mode)
1907 {
1908 	return (USBD_INVAL);
1909 }
1910 
1911 usbd_status
1912 urtw_led_mode3(struct urtw_softc *sc, int mode)
1913 {
1914 	return (USBD_INVAL);
1915 }
1916 
1917 void
1918 urtw_ledusbtask(void *arg)
1919 {
1920 	struct urtw_softc *sc = arg;
1921 
1922 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1923 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1924 
1925 	urtw_led_blink(sc);
1926 }
1927 
1928 void
1929 urtw_ledtask(void *arg)
1930 {
1931 	struct urtw_softc *sc = arg;
1932 
1933 	/*
1934 	 * NB: to change a status of the led we need at least a sleep so we
1935 	 * can't do it here
1936 	 */
1937 	usb_add_task(sc->sc_udev, &sc->sc_ledtask);
1938 }
1939 
1940 usbd_status
1941 urtw_led_ctl(struct urtw_softc *sc, int mode)
1942 {
1943 	usbd_status error = 0;
1944 
1945 	switch (sc->sc_strategy) {
1946 	case URTW_SW_LED_MODE0:
1947 		error = urtw_led_mode0(sc, mode);
1948 		break;
1949 	case URTW_SW_LED_MODE1:
1950 		error = urtw_led_mode1(sc, mode);
1951 		break;
1952 	case URTW_SW_LED_MODE2:
1953 		error = urtw_led_mode2(sc, mode);
1954 		break;
1955 	case URTW_SW_LED_MODE3:
1956 		error = urtw_led_mode3(sc, mode);
1957 		break;
1958 	default:
1959 		panic("unsupported LED mode %d", sc->sc_strategy);
1960 		/* NOTREACHED */
1961 	}
1962 
1963 	return (error);
1964 }
1965 
1966 usbd_status
1967 urtw_led_blink(struct urtw_softc *sc)
1968 {
1969 	struct timeval t;
1970 	uint8_t ing = 0;
1971 	usbd_status error;
1972 
1973 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1974 		error = urtw_led_on(sc, URTW_LED_GPIO);
1975 	else
1976 		error = urtw_led_off(sc, URTW_LED_GPIO);
1977 	sc->sc_gpio_blinktime--;
1978 	if (sc->sc_gpio_blinktime == 0)
1979 		ing = 1;
1980 	else {
1981 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
1982 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
1983 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
1984 			ing = 1;
1985 	}
1986 	if (ing == 1) {
1987 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
1988 		    sc->sc_gpio_ledon == 0)
1989 			error = urtw_led_on(sc, URTW_LED_GPIO);
1990 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
1991 		    sc->sc_gpio_ledon == 1)
1992 			error = urtw_led_off(sc, URTW_LED_GPIO);
1993 
1994 		sc->sc_gpio_blinktime = 0;
1995 		sc->sc_gpio_ledinprogress = 0;
1996 		return (0);
1997 	}
1998 
1999 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2000 	    URTW_LED_ON : URTW_LED_OFF;
2001 
2002 	switch (sc->sc_gpio_ledstate) {
2003 	case URTW_LED_BLINK_NORMAL:
2004 		t.tv_sec = 0;
2005 		t.tv_usec = 100 * 1000L;
2006 		if (!usbd_is_dying(sc->sc_udev))
2007 			timeout_add(&sc->sc_led_ch, tvtohz(&t));
2008 		break;
2009 	default:
2010 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2011 		/* NOTREACHED */
2012 	}
2013 	return (0);
2014 }
2015 
2016 usbd_status
2017 urtw_update_msr(struct urtw_softc *sc)
2018 {
2019 	struct ieee80211com *ic = &sc->sc_ic;
2020 	uint8_t data;
2021 	usbd_status error;
2022 
2023 	urtw_read8_m(sc, URTW_MSR, &data);
2024 	data &= ~URTW_MSR_LINK_MASK;
2025 
2026 	/* Should always be set. */
2027 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2028 		data |= URTW_MSR_LINK_ENEDCA;
2029 
2030 	if (sc->sc_state == IEEE80211_S_RUN) {
2031 		switch (ic->ic_opmode) {
2032 		case IEEE80211_M_STA:
2033 		case IEEE80211_M_MONITOR:
2034 			data |= URTW_MSR_LINK_STA;
2035 			break;
2036 		default:
2037 			panic("unsupported operation mode 0x%x",
2038 			    ic->ic_opmode);
2039 			/* NOTREACHED */
2040 		}
2041 	} else
2042 		data |= URTW_MSR_LINK_NONE;
2043 
2044 	urtw_write8_m(sc, URTW_MSR, data);
2045 fail:
2046 	return (error);
2047 }
2048 
2049 uint16_t
2050 urtw_rate2rtl(int rate)
2051 {
2052 	int i;
2053 
2054 	for (i = 0; i < nitems(urtw_ratetable); i++) {
2055 		if (rate == urtw_ratetable[i].reg)
2056 			return (urtw_ratetable[i].val);
2057 	}
2058 
2059 	return (3);
2060 }
2061 
2062 uint16_t
2063 urtw_rtl2rate(int rate)
2064 {
2065 	int i;
2066 
2067 	for (i = 0; i < nitems(urtw_ratetable); i++) {
2068 		if (rate == urtw_ratetable[i].val)
2069 			return (urtw_ratetable[i].reg);
2070 	}
2071 
2072 	return (0);
2073 }
2074 
2075 usbd_status
2076 urtw_set_rate(struct urtw_softc *sc)
2077 {
2078 	int i, basic_rate, min_rr_rate, max_rr_rate;
2079 	uint16_t data;
2080 	usbd_status error;
2081 
2082 	basic_rate = urtw_rate2rtl(48);
2083 	min_rr_rate = urtw_rate2rtl(12);
2084 	max_rr_rate = urtw_rate2rtl(48);
2085 
2086 	urtw_write8_m(sc, URTW_RESP_RATE,
2087 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2088 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2089 
2090 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2091 	data &= ~URTW_BRSR_MBR_8185;
2092 
2093 	for (i = 0; i <= basic_rate; i++)
2094 		data |= (1 << i);
2095 
2096 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2097 fail:
2098 	return (error);
2099 }
2100 
2101 usbd_status
2102 urtw_intr_enable(struct urtw_softc *sc)
2103 {
2104 	usbd_status error;
2105 
2106 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2107 fail:
2108 	return (error);
2109 }
2110 
2111 usbd_status
2112 urtw_rx_setconf(struct urtw_softc *sc)
2113 {
2114 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2115 	struct ieee80211com *ic = &sc->sc_ic;
2116 	uint32_t data;
2117 	usbd_status error;
2118 
2119 	urtw_read32_m(sc, URTW_RX, &data);
2120 	data = data &~ URTW_RX_FILTER_MASK;
2121 #if 0
2122 	data = data | URTW_RX_FILTER_CTL;
2123 #endif
2124 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2125 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2126 
2127 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2128 		data = data | URTW_RX_FILTER_ICVERR;
2129 		data = data | URTW_RX_FILTER_PWR;
2130 	}
2131 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2132 		data = data | URTW_RX_FILTER_CRCERR;
2133 
2134 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2135 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2136 		data = data | URTW_RX_FILTER_ALLMAC;
2137 	} else {
2138 		data = data | URTW_RX_FILTER_NICMAC;
2139 		data = data | URTW_RX_CHECK_BSSID;
2140 	}
2141 
2142 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2143 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2144 	data = data &~ URTW_MAX_RX_DMA_MASK;
2145 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2146 
2147 	urtw_write32_m(sc, URTW_RX, data);
2148 fail:
2149 	return (error);
2150 }
2151 
2152 usbd_status
2153 urtw_rx_enable(struct urtw_softc *sc)
2154 {
2155 	int i;
2156 	struct urtw_rx_data *rx_data;
2157 	uint8_t data;
2158 	usbd_status error;
2159 
2160 	/*
2161 	 * Start up the receive pipe.
2162 	 */
2163 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2164 		rx_data = &sc->sc_rx_data[i];
2165 
2166 		usbd_setup_xfer(rx_data->xfer, sc->sc_rxpipe, rx_data,
2167 		    rx_data->buf, MCLBYTES, USBD_SHORT_XFER_OK,
2168 		    USBD_NO_TIMEOUT, urtw_rxeof);
2169 		error = usbd_transfer(rx_data->xfer);
2170 		if (error != USBD_IN_PROGRESS && error != 0) {
2171 			printf("%s: could not queue Rx transfer\n",
2172 			    sc->sc_dev.dv_xname);
2173 			goto fail;
2174 		}
2175 	}
2176 
2177 	error = urtw_rx_setconf(sc);
2178 	if (error != 0)
2179 		goto fail;
2180 
2181 	urtw_read8_m(sc, URTW_CMD, &data);
2182 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2183 fail:
2184 	return (error);
2185 }
2186 
2187 usbd_status
2188 urtw_tx_enable(struct urtw_softc *sc)
2189 {
2190 	uint8_t data8;
2191 	uint32_t data;
2192 	usbd_status error;
2193 
2194 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2195 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2196 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2197 		    URTW_CW_CONF_PERPACKET_RETRY);
2198 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2199 
2200  		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2201 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2202 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2203 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2204 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2205 
2206 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2207 		data &= ~URTW_TX_LOOPBACK_MASK;
2208 		data |= URTW_TX_LOOPBACK_NONE;
2209 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2210 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2211 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2212 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2213 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2214 		data &= ~URTW_TX_SWPLCPLEN;
2215 		data |= URTW_TX_NOICV;
2216 		urtw_write32_m(sc, URTW_TX_CONF, data);
2217 	} else {
2218 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2219 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2220 		    URTW_TX_LONGRETRY;
2221 		urtw_write32_m(sc, URTW_TX_CONF, data);
2222 	}
2223 
2224 	urtw_read8_m(sc, URTW_CMD, &data8);
2225 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2226 fail:
2227 	return (error);
2228 }
2229 
2230 int
2231 urtw_init(struct ifnet *ifp)
2232 {
2233 	struct urtw_softc *sc = ifp->if_softc;
2234 	struct urtw_rf *rf = &sc->sc_rf;
2235 	struct ieee80211com *ic = &sc->sc_ic;
2236 	usbd_status error;
2237 	int ret;
2238 
2239 	urtw_stop(ifp, 0);
2240 
2241 	error = urtw_reset(sc);
2242 	if (error)
2243 		goto fail;
2244 
2245 	urtw_write8_m(sc, 0x85, 0);
2246 	urtw_write8_m(sc, URTW_GPIO, 0);
2247 
2248 	/* for led */
2249 	urtw_write8_m(sc, 0x85, 4);
2250 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2251 	if (error != 0)
2252 		goto fail;
2253 
2254 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2255 	if (error)
2256 		goto fail;
2257 
2258 	/* applying MAC address again. */
2259 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2260 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2261 	if (error)
2262 		goto fail;
2263 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2264 	if (error)
2265 		goto fail;
2266 
2267 	error = urtw_update_msr(sc);
2268 	if (error)
2269 		goto fail;
2270 
2271 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2272 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2273 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2274 	error = urtw_set_rate(sc);
2275 	if (error != 0)
2276 		goto fail;
2277 
2278 	error = rf->init(rf);
2279 	if (error != 0)
2280 		goto fail;
2281 	if (rf->set_sens != NULL)
2282 		rf->set_sens(rf);
2283 
2284 	urtw_write16_m(sc, 0x5e, 1);
2285 	urtw_write16_m(sc, 0xfe, 0x10);
2286 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2287 	urtw_write8_m(sc, 0xff, 0x60);
2288 	urtw_write16_m(sc, 0x5e, 0);
2289 	urtw_write8_m(sc, 0x85, 4);
2290 
2291 	error = urtw_intr_enable(sc);
2292 	if (error != 0)
2293 		goto fail;
2294 
2295 	/* reset softc variables */
2296 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
2297 	sc->sc_txtimer = 0;
2298 
2299 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2300 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2301 		if (error != 0) {
2302 			printf("%s: could not set configuration no\n",
2303 			    sc->sc_dev.dv_xname);
2304 			goto fail;
2305 		}
2306 		/* get the first interface handle */
2307 		error = usbd_device2interface_handle(sc->sc_udev,
2308 		    URTW_IFACE_INDEX, &sc->sc_iface);
2309 		if (error != 0) {
2310 			printf("%s: could not get interface handle\n",
2311 			    sc->sc_dev.dv_xname);
2312 			goto fail;
2313 		}
2314 		error = urtw_open_pipes(sc);
2315 		if (error != 0)
2316 			goto fail;
2317 		ret = urtw_alloc_rx_data_list(sc);
2318 		if (error != 0)
2319 			goto fail;
2320 		ret = urtw_alloc_tx_data_list(sc);
2321 		if (error != 0)
2322 			goto fail;
2323 		sc->sc_flags |= URTW_INIT_ONCE;
2324 	}
2325 
2326 	error = urtw_rx_enable(sc);
2327 	if (error != 0)
2328 		goto fail;
2329 	error = urtw_tx_enable(sc);
2330 	if (error != 0)
2331 		goto fail;
2332 
2333 	ifp->if_flags &= ~IFF_OACTIVE;
2334 	ifp->if_flags |= IFF_RUNNING;
2335 
2336 	ifp->if_timer = 1;
2337 
2338 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2339 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2340 	else
2341 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2342 
2343 	return (0);
2344 fail:
2345 	return (error);
2346 }
2347 
2348 void
2349 urtw_set_multi(struct urtw_softc *sc)
2350 {
2351 	struct arpcom *ac = &sc->sc_ic.ic_ac;
2352 	struct ifnet *ifp = &ac->ac_if;
2353 
2354 	/*
2355 	 * XXX don't know how to set a device.  Lack of docs.  Just try to set
2356 	 * IFF_ALLMULTI flag here.
2357 	 */
2358 	ifp->if_flags |= IFF_ALLMULTI;
2359 }
2360 
2361 int
2362 urtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2363 {
2364 	struct urtw_softc *sc = ifp->if_softc;
2365 	struct ieee80211com *ic = &sc->sc_ic;
2366 	struct ifaddr *ifa;
2367 	struct ifreq *ifr;
2368 	int s, error = 0;
2369 
2370 	if (usbd_is_dying(sc->sc_udev))
2371 		return (ENXIO);
2372 
2373 	usbd_ref_incr(sc->sc_udev);
2374 
2375 	s = splnet();
2376 
2377 	switch (cmd) {
2378 	case SIOCSIFADDR:
2379 		ifa = (struct ifaddr *)data;
2380 		ifp->if_flags |= IFF_UP;
2381 #ifdef INET
2382 		if (ifa->ifa_addr->sa_family == AF_INET)
2383 			arp_ifinit(&ic->ic_ac, ifa);
2384 #endif
2385 		/* FALLTHROUGH */
2386 	case SIOCSIFFLAGS:
2387 		if (ifp->if_flags & IFF_UP) {
2388 			/*
2389 			 * If only the PROMISC or ALLMULTI flag changes, then
2390 			 * don't do a full re-init of the chip, just update
2391 			 * the Rx filter.
2392 			 */
2393 			if ((ifp->if_flags & IFF_RUNNING) &&
2394 			    ((ifp->if_flags ^ sc->sc_if_flags) &
2395 			    (IFF_ALLMULTI | IFF_PROMISC)) != 0) {
2396 				urtw_set_multi(sc);
2397 			} else {
2398 				if (!(ifp->if_flags & IFF_RUNNING))
2399 					sc->sc_init(ifp);
2400 			}
2401 		} else {
2402 			if (ifp->if_flags & IFF_RUNNING)
2403 				urtw_stop(ifp, 1);
2404 		}
2405 		sc->sc_if_flags = ifp->if_flags;
2406 		break;
2407 
2408 	case SIOCADDMULTI:
2409 	case SIOCDELMULTI:
2410 		ifr = (struct ifreq *)data;
2411 		error = (cmd == SIOCADDMULTI) ?
2412 		    ether_addmulti(ifr, &ic->ic_ac) :
2413 		    ether_delmulti(ifr, &ic->ic_ac);
2414 		if (error == ENETRESET) {
2415 			if (ifp->if_flags & IFF_RUNNING)
2416 				urtw_set_multi(sc);
2417 			error = 0;
2418 		}
2419 		break;
2420 
2421 	case SIOCS80211CHANNEL:
2422 		/*
2423 		 * This allows for fast channel switching in monitor mode
2424 		 * (used by kismet). In IBSS mode, we must explicitly reset
2425 		 * the interface to generate a new beacon frame.
2426 		 */
2427 		error = ieee80211_ioctl(ifp, cmd, data);
2428 		if (error == ENETRESET &&
2429 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2430 			urtw_set_chan(sc, ic->ic_ibss_chan);
2431 			error = 0;
2432 		}
2433 		break;
2434 
2435 	default:
2436 		error = ieee80211_ioctl(ifp, cmd, data);
2437 	}
2438 
2439 	if (error == ENETRESET) {
2440 		if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
2441 		    (IFF_RUNNING | IFF_UP))
2442 			sc->sc_init(ifp);
2443 		error = 0;
2444 	}
2445 
2446 	splx(s);
2447 
2448 	usbd_ref_decr(sc->sc_udev);
2449 
2450 	return (error);
2451 }
2452 
2453 void
2454 urtw_start(struct ifnet *ifp)
2455 {
2456 	struct urtw_softc *sc = ifp->if_softc;
2457 	struct ieee80211com *ic = &sc->sc_ic;
2458 	struct ieee80211_node *ni;
2459 	struct mbuf *m0;
2460 
2461 	/*
2462 	 * net80211 may still try to send management frames even if the
2463 	 * IFF_RUNNING flag is not set...
2464 	 */
2465 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2466 		return;
2467 
2468 	for (;;) {
2469 		IF_POLL(&ic->ic_mgtq, m0);
2470 		if (m0 != NULL) {
2471 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2472 			    sc->sc_tx_normal_queued >=
2473 			    URTW_TX_DATA_LIST_COUNT) {
2474 				ifp->if_flags |= IFF_OACTIVE;
2475 				break;
2476 			}
2477 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2478 			ni = m0->m_pkthdr.ph_cookie;
2479 #if NBPFILTER > 0
2480 			if (ic->ic_rawbpf != NULL)
2481 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2482 #endif
2483 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2484 			    != 0)
2485 				break;
2486 		} else {
2487 			if (ic->ic_state != IEEE80211_S_RUN)
2488 				break;
2489 			IFQ_POLL(&ifp->if_snd, m0);
2490 			if (m0 == NULL)
2491 				break;
2492 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2493 			    sc->sc_tx_normal_queued >=
2494 			    URTW_TX_DATA_LIST_COUNT) {
2495 				ifp->if_flags |= IFF_OACTIVE;
2496 				break;
2497 			}
2498 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2499 #if NBPFILTER > 0
2500 			if (ifp->if_bpf != NULL)
2501 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2502 #endif
2503 			m0 = ieee80211_encap(ifp, m0, &ni);
2504 			if (m0 == NULL)
2505 				continue;
2506 #if NBPFILTER > 0
2507 			if (ic->ic_rawbpf != NULL)
2508 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2509 #endif
2510 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2511 			    != 0) {
2512 				if (ni != NULL)
2513 					ieee80211_release_node(ic, ni);
2514 				ifp->if_oerrors++;
2515 				break;
2516 			}
2517 		}
2518 		sc->sc_txtimer = 5;
2519 	}
2520 }
2521 
2522 void
2523 urtw_watchdog(struct ifnet *ifp)
2524 {
2525 	struct urtw_softc *sc = ifp->if_softc;
2526 
2527 	ifp->if_timer = 0;
2528 
2529 	if (sc->sc_txtimer > 0) {
2530 		if (--sc->sc_txtimer == 0) {
2531 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2532 			ifp->if_oerrors++;
2533 			return;
2534 		}
2535 		ifp->if_timer = 1;
2536 	}
2537 
2538 	ieee80211_watchdog(ifp);
2539 }
2540 
2541 void
2542 urtw_txeof_low(struct usbd_xfer *xfer, void *priv,
2543     usbd_status status)
2544 {
2545 	struct urtw_tx_data *data = priv;
2546 	struct urtw_softc *sc = data->sc;
2547 	struct ieee80211com *ic = &sc->sc_ic;
2548 	struct ifnet *ifp = &ic->ic_if;
2549 	int s;
2550 
2551 	if (status != USBD_NORMAL_COMPLETION) {
2552 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2553 			return;
2554 
2555 		printf("%s: could not transmit buffer: %s\n",
2556 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2557 
2558 		if (status == USBD_STALLED)
2559 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2560 
2561 		ifp->if_oerrors++;
2562 		return;
2563 	}
2564 
2565 	s = splnet();
2566 
2567 	ieee80211_release_node(ic, data->ni);
2568 	data->ni = NULL;
2569 
2570 	sc->sc_txtimer = 0;
2571 	ifp->if_opackets++;
2572 
2573 	sc->sc_tx_low_queued--;
2574 	ifp->if_flags &= ~IFF_OACTIVE;
2575 	urtw_start(ifp);
2576 
2577 	splx(s);
2578 }
2579 
2580 void
2581 urtw_txeof_normal(struct usbd_xfer *xfer, void *priv,
2582     usbd_status status)
2583 {
2584 	struct urtw_tx_data *data = priv;
2585 	struct urtw_softc *sc = data->sc;
2586 	struct ieee80211com *ic = &sc->sc_ic;
2587 	struct ifnet *ifp = &ic->ic_if;
2588 	int s;
2589 
2590 	if (status != USBD_NORMAL_COMPLETION) {
2591 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2592 			return;
2593 
2594 		printf("%s: could not transmit buffer: %s\n",
2595 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2596 
2597 		if (status == USBD_STALLED)
2598 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2599 
2600 		ifp->if_oerrors++;
2601 		return;
2602 	}
2603 
2604 	s = splnet();
2605 
2606 	ieee80211_release_node(ic, data->ni);
2607 	data->ni = NULL;
2608 
2609 	sc->sc_txtimer = 0;
2610 	ifp->if_opackets++;
2611 
2612 	sc->sc_tx_normal_queued--;
2613 	ifp->if_flags &= ~IFF_OACTIVE;
2614 	urtw_start(ifp);
2615 
2616 	splx(s);
2617 }
2618 
2619 int
2620 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2621     int prior)
2622 {
2623 	struct ieee80211com *ic = &sc->sc_ic;
2624 	struct urtw_tx_data *data;
2625 	struct ieee80211_frame *wh;
2626 	struct ieee80211_key *k;
2627 	usbd_status error;
2628 	int xferlen;
2629 
2630 	wh = mtod(m0, struct ieee80211_frame *);
2631 
2632 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2633 		k = ieee80211_get_txkey(ic, wh, ni);
2634 
2635 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2636 			return (ENOBUFS);
2637 
2638 		/* packet header may have moved, reset our local pointer */
2639 		wh = mtod(m0, struct ieee80211_frame *);
2640 	}
2641 
2642 #if NBPFILTER > 0
2643 	if (sc->sc_drvbpf != NULL) {
2644 		struct mbuf mb;
2645 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2646 
2647 		tap->wt_flags = 0;
2648 		tap->wt_rate = 0;
2649 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2650 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2651 
2652 		mb.m_data = (caddr_t)tap;
2653 		mb.m_len = sc->sc_txtap_len;
2654 		mb.m_next = m0;
2655 		mb.m_nextpkt = NULL;
2656 		mb.m_type = 0;
2657 		mb.m_flags = 0;
2658 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
2659 	}
2660 #endif
2661 
2662 	if (sc->sc_hwrev & URTW_HWREV_8187)
2663 		xferlen = m0->m_pkthdr.len + 4 * 3;
2664 	else
2665 		xferlen = m0->m_pkthdr.len + 4 * 8;
2666 
2667 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2668 		xferlen += 1;
2669 
2670 	data = &sc->sc_tx_data[sc->sc_txidx];
2671 	sc->sc_txidx = (sc->sc_txidx + 1) % URTW_TX_DATA_LIST_COUNT;
2672 
2673 	bzero(data->buf, URTW_TX_MAXSIZE);
2674 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2675 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2676 	data->buf[1] |= (1 << 7);
2677 
2678 	/* XXX sc_preamble_mode is always 2. */
2679 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2680 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2681 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2682 		data->buf[2] |= 1;
2683 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2684 	    prior == URTW_PRIORITY_LOW)
2685 		panic("TODO tx.");
2686 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2687 		data->buf[2] |= (1 << 1);
2688 	/* RTS rate - 10 means we use a basic rate. */
2689 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2690 	/*
2691 	 * XXX currently TX rate control depends on the rate value of
2692 	 * RX descriptor because I don't know how to we can control TX rate
2693 	 * in more smart way.  Please fix me you find a thing.
2694 	 */
2695 	data->buf[3] = sc->sc_currate;
2696 	if (prior == URTW_PRIORITY_NORMAL) {
2697 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2698 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2699 		else if (ic->ic_fixed_rate != -1)
2700 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2701 	}
2702 
2703 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2704 		data->buf[8] = 3;		/* CW minimum */
2705 		data->buf[8] |= (7 << 4);	/* CW maximum */
2706 		data->buf[9] |= 11;		/* retry limitation */
2707 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2708 	} else {
2709 		data->buf[21] |= 11;		/* retry limitation */
2710 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2711 	}
2712 
2713 	data->ni = ni;
2714 
2715 	/* mbuf is no longer needed. */
2716 	m_freem(m0);
2717 
2718 	usbd_setup_xfer(data->xfer,
2719 	    (prior == URTW_PRIORITY_LOW) ? sc->sc_txpipe_low :
2720 	    sc->sc_txpipe_normal, data, data->buf, xferlen,
2721 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, URTW_DATA_TIMEOUT,
2722 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2723 	error = usbd_transfer(data->xfer);
2724 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2725 		printf("%s: could not send frame: %s\n",
2726 		    sc->sc_dev.dv_xname, usbd_errstr(error));
2727 		return (EIO);
2728 	}
2729 
2730 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2731 	if (error != 0)
2732 		printf("%s: could not control LED (%d)\n",
2733 		    sc->sc_dev.dv_xname, error);
2734 
2735 	if (prior == URTW_PRIORITY_LOW)
2736 		sc->sc_tx_low_queued++;
2737 	else
2738 		sc->sc_tx_normal_queued++;
2739 
2740 	return (0);
2741 }
2742 
2743 usbd_status
2744 urtw_8225_usb_init(struct urtw_softc *sc)
2745 {
2746 	uint8_t data;
2747 	usbd_status error;
2748 
2749 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2750 	urtw_write8_m(sc, URTW_GPIO, 0);
2751 	error = urtw_read8e(sc, 0x53, &data);
2752 	if (error)
2753 		goto fail;
2754 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2755 	if (error)
2756 		goto fail;
2757 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2758 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2759 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2760 
2761 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2762 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2763 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2764 
2765 	usbd_delay_ms(sc->sc_udev, 500);
2766 fail:
2767 	return (error);
2768 }
2769 
2770 usbd_status
2771 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2772 {
2773 	usbd_status error = 0;
2774 
2775 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2776 fail:
2777 	return (error);
2778 }
2779 
2780 usbd_status
2781 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2782 {
2783 	uint32_t phyw;
2784 	usbd_status error;
2785 
2786 	phyw = ((data << 8) | (addr | 0x80));
2787 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2788 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2789 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2790 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2791 	/*
2792 	 * Delay removed from 8185 to 8187.
2793 	 * usbd_delay_ms(sc->sc_udev, 1);
2794 	 */
2795 fail:
2796 	return (error);
2797 }
2798 
2799 usbd_status
2800 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2801 {
2802 	data = data & 0xff;
2803 	return (urtw_8187_write_phy(sc, addr, data));
2804 }
2805 
2806 usbd_status
2807 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2808 {
2809 	data = data & 0xff;
2810 	return (urtw_8187_write_phy(sc, addr, data | 0x10000));
2811 }
2812 
2813 usbd_status
2814 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2815 {
2816 	usbd_status error;
2817 
2818 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2819 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2820 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2821 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2822 fail:
2823 	return (error);
2824 }
2825 
2826 usbd_status
2827 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2828 {
2829 	int i, idx, set;
2830 	uint8_t *cck_pwltable;
2831 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2832 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2833 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2834 	usbd_status error;
2835 
2836 	cck_pwrlvl_max = 11;
2837 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2838 	ofdm_pwrlvl_min = 10;
2839 
2840 	/* CCK power setting */
2841 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2842 	idx = cck_pwrlvl % 6;
2843 	set = cck_pwrlvl / 6;
2844 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2845 	    urtw_8225_txpwr_cck;
2846 
2847 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2848 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2849 	for (i = 0; i < 8; i++) {
2850 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2851 		    cck_pwltable[idx * 8 + i]);
2852 	}
2853 	usbd_delay_ms(sc->sc_udev, 1);
2854 
2855 	/* OFDM power setting */
2856 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2857 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2858 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2859 
2860 	idx = ofdm_pwrlvl % 6;
2861 	set = ofdm_pwrlvl / 6;
2862 
2863 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2864 	if (error)
2865 		goto fail;
2866 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2867 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2868 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2869 
2870 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2871 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2872 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2873 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2874 	usbd_delay_ms(sc->sc_udev, 1);
2875 fail:
2876 	return (error);
2877 }
2878 
2879 usbd_status
2880 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2881 {
2882 	usbd_status error;
2883 
2884 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2885 	usbd_delay_ms(sc->sc_udev, 1);
2886 fail:
2887 	return (error);
2888 }
2889 
2890 usbd_status
2891 urtw_8225_rf_init(struct urtw_rf *rf)
2892 {
2893 	struct urtw_softc *sc = rf->rf_sc;
2894 	int i;
2895 	uint16_t data;
2896 	usbd_status error;
2897 
2898 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2899 	if (error)
2900 		goto fail;
2901 
2902 	error = urtw_8225_usb_init(sc);
2903 	if (error)
2904 		goto fail;
2905 
2906 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2907 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2908 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2909 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2910 
2911 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2912 	if (error)
2913 		goto fail;
2914 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2915 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2916 	if (error)
2917 		goto fail;
2918 
2919 	error = urtw_8185_rf_pins_enable(sc);
2920 	if (error)
2921 		goto fail;
2922 
2923 	usbd_delay_ms(sc->sc_udev, 500);
2924 
2925 	for (i = 0; i < nitems(urtw_8225_rf_part1); i++) {
2926 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2927 		    urtw_8225_rf_part1[i].val);
2928 	}
2929 	usbd_delay_ms(sc->sc_udev, 50);
2930 	urtw_8225_write(sc, 0x2, 0xc4d);
2931 	usbd_delay_ms(sc->sc_udev, 200);
2932 	urtw_8225_write(sc, 0x2, 0x44d);
2933 	usbd_delay_ms(sc->sc_udev, 200);
2934 	urtw_8225_write(sc, 0x0, 0x127);
2935 
2936 	for (i = 0; i < nitems(urtw_8225_rxgain); i++) {
2937 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2938 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2939 	}
2940 
2941 	urtw_8225_write(sc, 0x0, 0x27);
2942 	urtw_8225_write(sc, 0x0, 0x22f);
2943 
2944 	for (i = 0; i < nitems(urtw_8225_agc); i++) {
2945 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2946 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2947 	}
2948 
2949 	for (i = 0; i < nitems(urtw_8225_rf_part2); i++) {
2950 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2951 		    urtw_8225_rf_part2[i].val);
2952 		usbd_delay_ms(sc->sc_udev, 1);
2953 	}
2954 
2955 	error = urtw_8225_setgain(sc, 4);
2956 	if (error)
2957 		goto fail;
2958 
2959 	for (i = 0; i < nitems(urtw_8225_rf_part3); i++) {
2960 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2961 		    urtw_8225_rf_part3[i].val);
2962 		usbd_delay_ms(sc->sc_udev, 1);
2963 	}
2964 
2965 	urtw_write8_m(sc, 0x5b, 0x0d);
2966 
2967 	error = urtw_8225_set_txpwrlvl(sc, 1);
2968 	if (error)
2969 		goto fail;
2970 
2971 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2972 	usbd_delay_ms(sc->sc_udev, 1);
2973 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2974 	usbd_delay_ms(sc->sc_udev, 1);
2975 
2976 	/* TX ant A, 0x0 for B */
2977 	error = urtw_8185_tx_antenna(sc, 0x3);
2978 	if (error)
2979 		goto fail;
2980 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2981 
2982 	error = urtw_8225_rf_set_chan(rf, 1);
2983 fail:
2984 	return (error);
2985 }
2986 
2987 usbd_status
2988 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
2989 {
2990 	struct urtw_softc *sc = rf->rf_sc;
2991 	struct ieee80211com *ic = &sc->sc_ic;
2992 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2993 	usbd_status error;
2994 
2995 	error = urtw_8225_set_txpwrlvl(sc, chan);
2996 	if (error)
2997 		goto fail;
2998 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2999 	usbd_delay_ms(sc->sc_udev, 10);
3000 
3001 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3002 
3003 	if (sc->sc_state == IEEE80211_S_ASSOC &&
3004 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3005 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3006 	else
3007 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3008 
3009 	if (IEEE80211_IS_CHAN_G(c)) {
3010 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3011 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3012 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3013 	} else {
3014 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3015 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3016 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3017 	}
3018 
3019 fail:
3020 	return (error);
3021 }
3022 
3023 usbd_status
3024 urtw_8225_rf_set_sens(struct urtw_rf *rf)
3025 {
3026 	struct urtw_softc *sc = rf->rf_sc;
3027 	usbd_status error;
3028 
3029 	if (rf->sens > 6)
3030 		return (-1);
3031 
3032 	if (rf->sens > 4)
3033 		urtw_8225_write(sc, 0x0c, 0x850);
3034 	else
3035 		urtw_8225_write(sc, 0x0c, 0x50);
3036 
3037 	rf->sens = 6 - rf->sens;
3038 	error = urtw_8225_setgain(sc, rf->sens);
3039 	if (error)
3040 		goto fail;
3041 
3042 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3043 
3044 fail:
3045 	return (error);
3046 }
3047 
3048 void
3049 urtw_stop(struct ifnet *ifp, int disable)
3050 {
3051 	struct urtw_softc *sc = ifp->if_softc;
3052 	struct ieee80211com *ic = &sc->sc_ic;
3053 	uint8_t data;
3054 	usbd_status error;
3055 
3056 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3057 
3058 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3059 
3060 	timeout_del(&sc->scan_to);
3061 	timeout_del(&sc->sc_led_ch);
3062 
3063 	urtw_intr_disable(sc);
3064 	urtw_read8_m(sc, URTW_CMD, &data);
3065 	data &= ~URTW_CMD_TX_ENABLE;
3066 	data &= ~URTW_CMD_RX_ENABLE;
3067 	urtw_write8_m(sc, URTW_CMD, data);
3068 
3069 	if (sc->sc_rxpipe != NULL)
3070 		usbd_abort_pipe(sc->sc_rxpipe);
3071 	if (sc->sc_txpipe_low != NULL)
3072 		usbd_abort_pipe(sc->sc_txpipe_low);
3073 	if (sc->sc_txpipe_normal != NULL)
3074 		usbd_abort_pipe(sc->sc_txpipe_normal);
3075 
3076 fail:
3077 	return;
3078 }
3079 
3080 int
3081 urtw_isbmode(uint16_t rate)
3082 {
3083 	rate = urtw_rtl2rate(rate);
3084 
3085 	return (((rate <= 22 && rate != 12 && rate != 18) ||
3086 	    rate == 44) ? (1) : (0));
3087 }
3088 
3089 void
3090 urtw_rxeof(struct usbd_xfer *xfer, void *priv, usbd_status status)
3091 {
3092 	struct urtw_rx_data *data = priv;
3093 	struct urtw_softc *sc = data->sc;
3094 	struct ieee80211com *ic = &sc->sc_ic;
3095 	struct ifnet *ifp = &ic->ic_if;
3096 	struct ieee80211_frame *wh;
3097 	struct ieee80211_node *ni;
3098 	struct ieee80211_rxinfo rxi;
3099 	struct mbuf *m, *mnew;
3100 	uint8_t *desc, quality, rate;
3101 	int actlen, flen, len, nf, rssi, s;
3102 
3103 	if (status != USBD_NORMAL_COMPLETION) {
3104 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3105 			return;
3106 
3107 		if (status == USBD_STALLED)
3108 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3109 		ifp->if_ierrors++;
3110 		goto skip;
3111 	}
3112 
3113 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3114 	if (actlen < URTW_MIN_RXBUFSZ) {
3115 		ifp->if_ierrors++;
3116 		goto skip;
3117 	}
3118 
3119 	if (sc->sc_hwrev & URTW_HWREV_8187)
3120 		/* 4 dword and 4 byte CRC */
3121 		len = actlen - (4 * 4);
3122 	else
3123 		/* 5 dword and 4 byte CRC */
3124 		len = actlen - (4 * 5);
3125 
3126 	desc = data->buf + len;
3127 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3128 	if (flen > actlen) {
3129 		ifp->if_ierrors++;
3130 		goto skip;
3131 	}
3132 
3133 	rate = (desc[2] & 0xf0) >> 4;
3134 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3135 		quality = desc[4] & 0xff;
3136 		rssi = (desc[6] & 0xfe) >> 1;
3137 
3138 		/* XXX correct? */
3139 		if (!urtw_isbmode(rate)) {
3140 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3141 			rssi = ((90 - rssi) * 100) / 65;
3142 		} else {
3143 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3144 			rssi = ((95 - rssi) * 100) / 65;
3145 		}
3146 	} else {
3147 		quality = desc[12];
3148 		rssi = 14 - desc[14] / 2;
3149 	}
3150 
3151 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3152 	if (mnew == NULL) {
3153 		printf("%s: could not allocate rx mbuf\n",
3154 		    sc->sc_dev.dv_xname);
3155 		ifp->if_ierrors++;
3156 		goto skip;
3157 	}
3158 	MCLGET(mnew, M_DONTWAIT);
3159 	if (!(mnew->m_flags & M_EXT)) {
3160 		printf("%s: could not allocate rx mbuf cluster\n",
3161 		    sc->sc_dev.dv_xname);
3162 		m_freem(mnew);
3163 		ifp->if_ierrors++;
3164 		goto skip;
3165 	}
3166 
3167 	m = data->m;
3168 	data->m = mnew;
3169 	data->buf = mtod(mnew, uint8_t *);
3170 
3171 	/* finalize mbuf */
3172 	m->m_pkthdr.rcvif = ifp;
3173 	m->m_pkthdr.len = m->m_len = flen - 4;
3174 
3175 	s = splnet();
3176 
3177 #if NBPFILTER > 0
3178 	if (sc->sc_drvbpf != NULL) {
3179 		struct mbuf mb;
3180 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3181 
3182 		/* XXX Are variables correct? */
3183 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3184 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3185 		tap->wr_dbm_antsignal = (int8_t)rssi;
3186 
3187 		mb.m_data = (caddr_t)tap;
3188 		mb.m_len = sc->sc_rxtap_len;
3189 		mb.m_next = m;
3190 		mb.m_nextpkt = NULL;
3191 		mb.m_type = 0;
3192 		mb.m_flags = 0;
3193 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
3194 	}
3195 #endif
3196 	wh = mtod(m, struct ieee80211_frame *);
3197 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3198 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3199 	ni = ieee80211_find_rxnode(ic, wh);
3200 
3201 	/* XXX correct? */
3202 	if (!urtw_isbmode(rate)) {
3203 		if (quality > 127)
3204 			quality = 0;
3205 		else if (quality < 27)
3206 			quality = 100;
3207 		else
3208 			quality = 127 - quality;
3209 	} else
3210 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3211 
3212 	nf = quality;
3213 
3214 	/* send the frame to the 802.11 layer */
3215 	rxi.rxi_flags = 0;
3216 	rxi.rxi_rssi = rssi;
3217 	rxi.rxi_tstamp = 0;
3218 	ieee80211_input(ifp, m, ni, &rxi);
3219 
3220 	/* node is no longer needed */
3221 	ieee80211_release_node(ic, ni);
3222 
3223 	splx(s);
3224 
3225 skip:	/* setup a new transfer */
3226 	usbd_setup_xfer(xfer, sc->sc_rxpipe, data, data->buf, MCLBYTES,
3227 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3228 	(void)usbd_transfer(xfer);
3229 }
3230 
3231 usbd_status
3232 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3233 {
3234 	uint8_t *gainp;
3235 	usbd_status error;
3236 
3237 	/* XXX for A? */
3238 	gainp = urtw_8225v2_gain_bg;
3239 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3240 	usbd_delay_ms(sc->sc_udev, 1);
3241 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3242 	usbd_delay_ms(sc->sc_udev, 1);
3243 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3244 	usbd_delay_ms(sc->sc_udev, 1);
3245 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3246 	usbd_delay_ms(sc->sc_udev, 1);
3247 fail:
3248 	return (error);
3249 }
3250 
3251 usbd_status
3252 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3253 {
3254 	int i;
3255 	uint8_t *cck_pwrtable;
3256 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3257 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3258 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3259 	usbd_status error;
3260 
3261 	/* CCK power setting */
3262 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3263 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3264 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3265 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3266 	    urtw_8225v2_txpwr_cck;
3267 
3268 	for (i = 0; i < 8; i++) {
3269 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3270 	}
3271 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3272 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3273 	usbd_delay_ms(sc->sc_udev, 1);
3274 
3275 	/* OFDM power setting */
3276 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3277 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3278 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3279 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3280 
3281 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3282 	if (error)
3283 		goto fail;
3284 
3285 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3286 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3287 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3288 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3289 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3290 
3291 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3292 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3293 	usbd_delay_ms(sc->sc_udev, 1);
3294 fail:
3295 	return (error);
3296 }
3297 
3298 usbd_status
3299 urtw_8225v2_rf_init(struct urtw_rf *rf)
3300 {
3301 	struct urtw_softc *sc = rf->rf_sc;
3302 	int i;
3303 	uint16_t data;
3304 	uint32_t data32;
3305 	usbd_status error;
3306 
3307 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3308 	if (error)
3309 		goto fail;
3310 
3311 	error = urtw_8225_usb_init(sc);
3312 	if (error)
3313 		goto fail;
3314 
3315 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3316 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3317 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3318 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3319 
3320 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3321 	if (error)
3322 		goto fail;
3323 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3324 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3325 	if (error)
3326 		goto fail;
3327 
3328 	error = urtw_8185_rf_pins_enable(sc);
3329 	if (error)
3330 		goto fail;
3331 
3332 	usbd_delay_ms(sc->sc_udev, 1000);
3333 
3334 	for (i = 0; i < nitems(urtw_8225v2_rf_part1); i++) {
3335 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3336 		    urtw_8225v2_rf_part1[i].val);
3337 		usbd_delay_ms(sc->sc_udev, 1);
3338 	}
3339 	usbd_delay_ms(sc->sc_udev, 50);
3340 
3341 	urtw_8225_write(sc, 0x0, 0x1b7);
3342 
3343 	for (i = 0; i < nitems(urtw_8225v2_rxgain); i++) {
3344 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3345 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3346 	}
3347 
3348 	urtw_8225_write(sc, 0x3, 0x2);
3349 	urtw_8225_write(sc, 0x5, 0x4);
3350 	urtw_8225_write(sc, 0x0, 0xb7);
3351 	urtw_8225_write(sc, 0x2, 0xc4d);
3352 	usbd_delay_ms(sc->sc_udev, 100);
3353 	urtw_8225_write(sc, 0x2, 0x44d);
3354 	usbd_delay_ms(sc->sc_udev, 100);
3355 
3356 	error = urtw_8225_read(sc, 0x6, &data32);
3357 	if (error != 0)
3358 		goto fail;
3359 	if (data32 != 0xe6)
3360 		printf("%s: expect 0xe6!! (0x%x)\n", sc->sc_dev.dv_xname,
3361 		    data32);
3362 	if (!(data32 & 0x80)) {
3363 		urtw_8225_write(sc, 0x02, 0x0c4d);
3364 		usbd_delay_ms(sc->sc_udev, 200);
3365 		urtw_8225_write(sc, 0x02, 0x044d);
3366 		usbd_delay_ms(sc->sc_udev, 100);
3367 		error = urtw_8225_read(sc, 0x6, &data32);
3368 		if (error != 0)
3369 			goto fail;
3370 		if (!(data32 & 0x80))
3371 			printf("%s: RF calibration failed\n",
3372 			    sc->sc_dev.dv_xname);
3373 	}
3374 	usbd_delay_ms(sc->sc_udev, 100);
3375 
3376 	urtw_8225_write(sc, 0x0, 0x2bf);
3377 	for (i = 0; i < nitems(urtw_8225_agc); i++) {
3378 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3379 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3380 	}
3381 
3382 	for (i = 0; i < nitems(urtw_8225v2_rf_part2); i++) {
3383 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3384 		    urtw_8225v2_rf_part2[i].val);
3385 	}
3386 
3387 	error = urtw_8225v2_setgain(sc, 4);
3388 	if (error)
3389 		goto fail;
3390 
3391 	for (i = 0; i < nitems(urtw_8225v2_rf_part3); i++) {
3392 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3393 		    urtw_8225v2_rf_part3[i].val);
3394 	}
3395 
3396 	urtw_write8_m(sc, 0x5b, 0x0d);
3397 
3398 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3399 	if (error)
3400 		goto fail;
3401 
3402 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3403 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3404 
3405 	/* TX ant A, 0x0 for B */
3406 	error = urtw_8185_tx_antenna(sc, 0x3);
3407 	if (error)
3408 		goto fail;
3409 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3410 
3411 	error = urtw_8225_rf_set_chan(rf, 1);
3412 fail:
3413 	return (error);
3414 }
3415 
3416 usbd_status
3417 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3418 {
3419 	struct urtw_softc *sc = rf->rf_sc;
3420 	struct ieee80211com *ic = &sc->sc_ic;
3421 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3422 	usbd_status error;
3423 
3424 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3425 	if (error)
3426 		goto fail;
3427 
3428 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3429 	usbd_delay_ms(sc->sc_udev, 10);
3430 
3431 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3432 
3433 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3434 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3435 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3436 	else
3437 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3438 
3439 	if (IEEE80211_IS_CHAN_G(c)) {
3440 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3441 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3442 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3443 	} else {
3444 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3445 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3446 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3447 	}
3448 
3449 fail:
3450 	return (error);
3451 }
3452 
3453 void
3454 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3455 {
3456 	struct urtw_rf *rf = &sc->sc_rf;
3457 	struct ieee80211com *ic = &sc->sc_ic;
3458 	usbd_status error = 0;
3459 	uint32_t data;
3460 	u_int chan;
3461 
3462 	chan = ieee80211_chan2ieee(ic, c);
3463 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3464 		return;
3465 	/*
3466 	 * During changing the channel we need to temporary disable
3467 	 * TX.
3468 	 */
3469 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3470 	data &= ~URTW_TX_LOOPBACK_MASK;
3471 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3472 	error = rf->set_chan(rf, chan);
3473 	if (error != 0) {
3474 		printf("%s could not change the channel\n",
3475 		    sc->sc_dev.dv_xname);
3476 		return;
3477 	}
3478 	usbd_delay_ms(sc->sc_udev, 10);
3479 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3480 
3481 fail:	return;
3482 
3483 }
3484 
3485 void
3486 urtw_next_scan(void *arg)
3487 {
3488 	struct urtw_softc *sc = arg;
3489 	struct ieee80211com *ic = &sc->sc_ic;
3490 	struct ifnet *ifp = &ic->ic_if;
3491 
3492 	if (usbd_is_dying(sc->sc_udev))
3493 		return;
3494 
3495 	usbd_ref_incr(sc->sc_udev);
3496 
3497 	if (ic->ic_state == IEEE80211_S_SCAN)
3498 		ieee80211_next_scan(ifp);
3499 
3500 	usbd_ref_decr(sc->sc_udev);
3501 }
3502 
3503 void
3504 urtw_task(void *arg)
3505 {
3506 	struct urtw_softc *sc = arg;
3507 	struct ieee80211com *ic = &sc->sc_ic;
3508 	struct ieee80211_node *ni;
3509 	enum ieee80211_state ostate;
3510 	usbd_status error = 0;
3511 
3512 	if (usbd_is_dying(sc->sc_udev))
3513 		return;
3514 
3515 	ostate = ic->ic_state;
3516 
3517 	switch (sc->sc_state) {
3518 	case IEEE80211_S_INIT:
3519 		if (ostate == IEEE80211_S_RUN) {
3520 			/* turn link LED off */
3521 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3522 		}
3523 		break;
3524 
3525 	case IEEE80211_S_SCAN:
3526 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3527 		if (!usbd_is_dying(sc->sc_udev))
3528 			timeout_add_msec(&sc->scan_to, 200);
3529 		break;
3530 
3531 	case IEEE80211_S_AUTH:
3532 	case IEEE80211_S_ASSOC:
3533 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3534 		break;
3535 
3536 	case IEEE80211_S_RUN:
3537 		ni = ic->ic_bss;
3538 
3539 		/* setting bssid. */
3540 		error = urtw_set_bssid(sc, ni->ni_bssid);
3541 		if (error != 0)
3542 			goto fail;
3543 		urtw_update_msr(sc);
3544 		/* XXX maybe the below would be incorrect. */
3545 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3546 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3547 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3548 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3549 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3550 		if (error != 0)
3551 			printf("%s: could not control LED (%d)\n",
3552 			    sc->sc_dev.dv_xname, error);
3553 		break;
3554 	}
3555 
3556 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3557 
3558 fail:
3559 	if (error != 0)
3560 		DPRINTF(("%s: error duing processing RUN state.",
3561 		    sc->sc_dev.dv_xname));
3562 }
3563 
3564 usbd_status
3565 urtw_8187b_update_wmm(struct urtw_softc *sc)
3566 {
3567 	struct ieee80211com *ic = &sc->sc_ic;
3568 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3569 	uint32_t data;
3570 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3571 	usbd_status error;
3572 
3573 	sifs = 0xa;
3574 	if (IEEE80211_IS_CHAN_G(c))
3575 		slot = 0x9;
3576 	else
3577 		slot = 0x14;
3578 
3579 	aifs = (2 * slot) + sifs;
3580 	ecwmin = 3;
3581 	ecwmax = 7;
3582 
3583 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3584 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3585 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3586 
3587 	urtw_write32_m(sc, URTW_AC_VO, data);
3588 	urtw_write32_m(sc, URTW_AC_VI, data);
3589 	urtw_write32_m(sc, URTW_AC_BE, data);
3590 	urtw_write32_m(sc, URTW_AC_BK, data);
3591 
3592 fail:
3593 	return (error);
3594 }
3595 
3596 usbd_status
3597 urtw_8187b_reset(struct urtw_softc *sc)
3598 {
3599 	uint8_t data;
3600 	usbd_status error;
3601 
3602 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3603 	if (error)
3604 		goto fail;
3605 
3606 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3607 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3608 		URTW_CONFIG3_GNT_SELECT);
3609 
3610 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3611 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3612 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3613 
3614 	urtw_write8_m(sc, 0x61, 0x10);
3615 	urtw_read8_m(sc, 0x62, &data);
3616 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3617 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3618 
3619 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3620 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3621 
3622 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3623 	if (error)
3624 		goto fail;
3625 
3626 	urtw_read8_m(sc, URTW_CMD, &data);
3627 	data = (data & 2) | URTW_CMD_RST;
3628 	urtw_write8_m(sc, URTW_CMD, data);
3629 	usbd_delay_ms(sc->sc_udev, 100);
3630 
3631 	urtw_read8_m(sc, URTW_CMD, &data);
3632 	if (data & URTW_CMD_RST) {
3633 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
3634 		goto fail;
3635 	}
3636 
3637 fail:
3638 	return (error);
3639 }
3640 
3641 int
3642 urtw_8187b_init(struct ifnet *ifp)
3643 {
3644 	struct urtw_softc *sc = ifp->if_softc;
3645 	struct urtw_rf *rf = &sc->sc_rf;
3646 	struct ieee80211com *ic = &sc->sc_ic;
3647 	int ret;
3648 	uint8_t data;
3649 	usbd_status error;
3650 
3651 	urtw_stop(ifp, 0);
3652 
3653 	error = urtw_8187b_update_wmm(sc);
3654 	if (error != 0)
3655 		goto fail;
3656 	error = urtw_8187b_reset(sc);
3657 	if (error)
3658 		goto fail;
3659 
3660 	/* Applying MAC address again. */
3661 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3662 	if (error)
3663 		goto fail;
3664 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
3665 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3666 	if (error)
3667 		goto fail;
3668 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3669 	if (error)
3670 		goto fail;
3671 
3672 	error = urtw_update_msr(sc);
3673 	if (error)
3674 		goto fail;
3675 
3676 	error = rf->init(rf);
3677 	if (error != 0)
3678 		goto fail;
3679 
3680 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3681 		URTW_CMD_RX_ENABLE);
3682 	error = urtw_intr_enable(sc);
3683 	if (error != 0)
3684 		goto fail;
3685 
3686 	error = urtw_write8e(sc, 0x41, 0xf4);
3687 	if (error != 0)
3688 		goto fail;
3689 	error = urtw_write8e(sc, 0x40, 0x00);
3690 	if (error != 0)
3691 		goto fail;
3692 	error = urtw_write8e(sc, 0x42, 0x00);
3693 	if (error != 0)
3694 		goto fail;
3695 	error = urtw_write8e(sc, 0x42, 0x01);
3696 	if (error != 0)
3697 		goto fail;
3698 	error = urtw_write8e(sc, 0x40, 0x0f);
3699 	if (error != 0)
3700 		goto fail;
3701 	error = urtw_write8e(sc, 0x42, 0x00);
3702 	if (error != 0)
3703 		goto fail;
3704 	error = urtw_write8e(sc, 0x42, 0x01);
3705 	if (error != 0)
3706 		goto fail;
3707 
3708 	urtw_read8_m(sc, 0xdb, &data);
3709 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3710 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3711 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3712 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3713 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3714 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3715 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3716 	urtw_write8_m(sc, 0x61, 0);
3717 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3718 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3719 	urtw_write8_m(sc, 0xda, 0x10);
3720 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3721 
3722 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3723 
3724 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3725 
3726 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3727 
3728 	/* Reset softc variables. */
3729 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
3730 	sc->sc_txtimer = 0;
3731 
3732 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3733 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3734 		if (error != 0) {
3735 			printf("%s: could not set configuration no\n",
3736 			    sc->sc_dev.dv_xname);
3737 			goto fail;
3738 		}
3739 		/* Get the first interface handle. */
3740 		error = usbd_device2interface_handle(sc->sc_udev,
3741 		    URTW_IFACE_INDEX, &sc->sc_iface);
3742 		if (error != 0) {
3743 			printf("%s: could not get interface handle\n",
3744 			    sc->sc_dev.dv_xname);
3745 			goto fail;
3746 		}
3747 		error = urtw_open_pipes(sc);
3748 		if (error != 0)
3749 			goto fail;
3750 		ret = urtw_alloc_rx_data_list(sc);
3751 		if (error != 0)
3752 			goto fail;
3753 		ret = urtw_alloc_tx_data_list(sc);
3754 		if (error != 0)
3755 			goto fail;
3756 		sc->sc_flags |= URTW_INIT_ONCE;
3757 	}
3758 
3759 	error = urtw_rx_enable(sc);
3760 	if (error != 0)
3761 		goto fail;
3762 	error = urtw_tx_enable(sc);
3763 	if (error != 0)
3764 		goto fail;
3765 
3766 	ifp->if_flags &= ~IFF_OACTIVE;
3767 	ifp->if_flags |= IFF_RUNNING;
3768 
3769 	ifp->if_timer = 1;
3770 
3771 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3772 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3773 	else
3774 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3775 
3776 fail:
3777 	return (error);
3778 }
3779 
3780 usbd_status
3781 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3782 {
3783 	int i;
3784 	usbd_status error;
3785 
3786 	for (i = 0; i < nitems(urtw_8187b_regtbl); i++) {
3787 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3788 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3789 	}
3790 
3791 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3792 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3793 
3794 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3795 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3796 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3797 
3798 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3799 
3800 fail:
3801 	return (error);
3802 }
3803 
3804 usbd_status
3805 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3806 {
3807 	usbd_status error;
3808 
3809 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3810 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3811 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3812 	usbd_delay_ms(sc->sc_udev, 100);
3813 
3814 fail:
3815 	return (error);
3816 }
3817 
3818 usbd_status
3819 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3820 {
3821 	struct ieee80211com *ic = &sc->sc_ic;
3822 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3823 	uint8_t aifs, difs, eifs, sifs, slot;
3824 	usbd_status error;
3825 
3826 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3827 
3828 	sifs = 0xa;
3829 	if (IEEE80211_IS_CHAN_G(c)) {
3830 		slot = 0x9;
3831 		difs = 0x1c;
3832 		eifs = 0x5b;
3833 	} else {
3834 		slot = 0x14;
3835 		difs = 0x32;
3836 		eifs = 0x5b;
3837 	}
3838 	aifs = (2 * slot) + sifs;
3839 
3840 	urtw_write8_m(sc, URTW_SLOT, slot);
3841 
3842 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3843 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3844 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3845 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3846 
3847 	urtw_write8_m(sc, URTW_DIFS, difs);
3848 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3849 
3850 fail:
3851 	return (error);
3852 }
3853 
3854 usbd_status
3855 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3856 {
3857 	struct urtw_softc *sc = rf->rf_sc;
3858 	int i;
3859 	uint8_t data;
3860 	usbd_status error;
3861 
3862 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3863 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3864 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3865 	urtw_write8_m(sc, URTW_CW_CONF, data |
3866 		URTW_CW_CONF_PERPACKET_RETRY);
3867 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3868 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3869 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3870 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3871 
3872 	/* Auto rate fallback control. */
3873 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3874 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3875 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3876 		URTW_RATE_FALLBACK_ENABLE);
3877 
3878 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3879 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3880 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3881 
3882 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3883 	if (error)
3884 		goto fail;
3885 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3886 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3887 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3888 	if (error)
3889 		goto fail;
3890 
3891 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3892 	urtw_8225v2_b_config_mac(sc);
3893 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3894 
3895 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3896 	if (error)
3897 		goto fail;
3898 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3899 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3900 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3901 	if (error)
3902 		goto fail;
3903 
3904 	urtw_8225v2_b_init_rfe(sc);
3905 
3906 	for (i = 0; i < nitems(urtw_8225v2_b_rf); i++) {
3907 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3908 		    urtw_8225v2_b_rf[i].val);
3909 	}
3910 
3911 	for (i = 0; i < nitems(urtw_8225v2_rxgain); i++) {
3912 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3913 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3914 	}
3915 
3916 	urtw_8225_write(sc, 0x03, 0x080);
3917 	urtw_8225_write(sc, 0x05, 0x004);
3918 	urtw_8225_write(sc, 0x00, 0x0b7);
3919 	urtw_8225_write(sc, 0x02, 0xc4d);
3920 	urtw_8225_write(sc, 0x02, 0x44d);
3921 	urtw_8225_write(sc, 0x00, 0x2bf);
3922 
3923 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3924 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3925 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3926 
3927 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3928 	for (i = 0; i < nitems(urtw_8225v2_agc); i++) {
3929 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3930 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3931 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3932 	}
3933 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3934 
3935 	for (i = 0; i < nitems(urtw_8225v2_ofdm); i++)
3936 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3937 
3938 	urtw_8225v2_b_update_chan(sc);
3939 
3940 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3941 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3942 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3943 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3944 
3945 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3946 fail:
3947 	return (error);
3948 }
3949 
3950 usbd_status
3951 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3952 {
3953 	struct urtw_softc *sc = rf->rf_sc;
3954 	usbd_status error;
3955 
3956 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3957 	if (error)
3958 		goto fail;
3959 
3960 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3961 	/*
3962 	 * Delay removed from 8185 to 8187.
3963 	 * usbd_delay_ms(sc->sc_udev, 10);
3964 	 */
3965 
3966 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3967 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3968 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3969 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3970 
3971 fail:
3972 	return (error);
3973 }
3974 
3975 usbd_status
3976 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3977 {
3978 	int i;
3979 	uint8_t *cck_pwrtable;
3980 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
3981 	    ofdm_pwrlvl_max;
3982 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3983 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3984 	usbd_status error;
3985 
3986 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
3987 		cck_pwrlvl_min = 0;
3988 		cck_pwrlvl_max = 15;
3989 		ofdm_pwrlvl_min = 2;
3990 		ofdm_pwrlvl_max = 17;
3991 	} else {
3992 		cck_pwrlvl_min = 7;
3993 		cck_pwrlvl_max = 22;
3994 		ofdm_pwrlvl_min = 10;
3995 		ofdm_pwrlvl_max = 25;
3996 	}
3997 
3998 	/* CCK power setting */
3999 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
4000 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
4001 
4002 	cck_pwrlvl += sc->sc_txpwr_cck_base;
4003 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
4004 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
4005 
4006 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
4007 	    urtw_8225v2_txpwr_cck;
4008 
4009 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4010 		if (cck_pwrlvl <= 6)
4011 			; /* do nothing */
4012 		else if (cck_pwrlvl <= 11)
4013 			cck_pwrtable += 8;
4014 		else
4015 			cck_pwrtable += 16;
4016 	} else {
4017 		if (cck_pwrlvl <= 5)
4018 			; /* do nothing */
4019 		else if (cck_pwrlvl <= 11)
4020 			cck_pwrtable += 8;
4021 		else if (cck_pwrlvl <= 17)
4022 			cck_pwrtable += 16;
4023 		else
4024 			cck_pwrtable += 24;
4025 	}
4026 
4027 	for (i = 0; i < 8; i++) {
4028 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
4029 	}
4030 
4031 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
4032 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
4033 	/*
4034 	 * Delay removed from 8185 to 8187.
4035 	 * usbd_delay_ms(sc->sc_udev, 1);
4036 	 */
4037 
4038 	/* OFDM power setting */
4039 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
4040 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
4041 
4042 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
4043 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
4044 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
4045 
4046 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
4047 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
4048 
4049 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4050 		if (ofdm_pwrlvl <= 11) {
4051 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4052 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4053 		} else {
4054 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4055 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4056 		}
4057 	} else {
4058 		if (ofdm_pwrlvl <= 11) {
4059 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4060 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4061 		} else if (ofdm_pwrlvl <= 17) {
4062 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4063 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4064 		} else {
4065 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4066 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4067 		}
4068 	}
4069 
4070 	/*
4071 	 * Delay removed from 8185 to 8187.
4072 	 * usbd_delay_ms(sc->sc_udev, 1);
4073 	 */
4074 fail:
4075 	return (error);
4076 }
4077 
4078 int
4079 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4080 {
4081 	int error;
4082 
4083 	urtw_write32_m(sc, URTW_BSSID,
4084 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4085 	urtw_write16_m(sc, URTW_BSSID + 4,
4086 	    bssid[4] | bssid[5] << 8);
4087 
4088 	return 0;
4089 
4090 fail:
4091 	return error;
4092 }
4093 
4094 int
4095 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4096 {
4097 	int error;
4098 
4099 	urtw_write32_m(sc, URTW_MAC0,
4100 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4101 	urtw_write16_m(sc, URTW_MAC4,
4102 	    addr[4] | addr[5] << 8);
4103 
4104 	return 0;
4105 
4106 fail:
4107 	return error;
4108 }
4109