xref: /openbsd-src/sys/dev/usb/if_urtw.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /*	$OpenBSD: if_urtw.c,v 1.7 2009/03/10 09:48:46 kevlo Exp $	*/
2 /*-
3  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include "bpfilter.h"
19 
20 #include <sys/param.h>
21 #include <sys/sockio.h>
22 #include <sys/proc.h>
23 #include <sys/mbuf.h>
24 #include <sys/kernel.h>
25 #include <sys/socket.h>
26 #include <sys/systm.h>
27 #include <sys/malloc.h>
28 #include <sys/timeout.h>
29 #include <sys/conf.h>
30 #include <sys/device.h>
31 
32 #include <machine/bus.h>
33 #include <machine/endian.h>
34 #if NBPFILTER > 0
35 #include <net/bpf.h>
36 #endif
37 #include <net/if.h>
38 #include <net/if_arp.h>
39 #include <net/if_dl.h>
40 #include <net/if_media.h>
41 #include <net/if_types.h>
42 
43 #include <netinet/in.h>
44 #include <netinet/in_systm.h>
45 #include <netinet/in_var.h>
46 #include <netinet/if_ether.h>
47 #include <netinet/ip.h>
48 
49 #include <net80211/ieee80211_var.h>
50 #include <net80211/ieee80211_radiotap.h>
51 
52 #include <dev/usb/usb.h>
53 #include <dev/usb/usbdi.h>
54 #include <dev/usb/usbdi_util.h>
55 #include <dev/usb/usbdevs.h>
56 
57 #include <dev/usb/if_urtwreg.h>
58 
59 #ifdef USB_DEBUG
60 #define	URTW_DEBUG
61 #endif
62 
63 #ifdef URTW_DEBUG
64 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
65 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
66 int urtw_debug = 0;
67 #else
68 #define	DPRINTF(x)
69 #define	DPRINTFN(n, x)
70 #endif
71 
72 /* recognized device vendors/products */
73 static const struct usb_devno urtw_devs[] = {
74 #define	URTW_DEV(v,p) { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }
75 	URTW_DEV(DICKSMITH, RTL8187),
76 	URTW_DEV(LOGITEC, RTL8187),
77 	URTW_DEV(REALTEK, RTL8187),
78 	URTW_DEV(SPHAIRON, RTL8187),
79 	URTW_DEV(SURECOM, EP9001G2A),
80 	URTW_DEV(NETGEAR, WG111V2)
81 #undef URTW_DEV
82 };
83 
84 #define urtw_read8_m(sc, val, data)	do {			\
85 	error = urtw_read8_c(sc, val, data);			\
86 	if (error != 0)						\
87 		goto fail;					\
88 } while (0)
89 #define urtw_write8_m(sc, val, data)	do {			\
90 	error = urtw_write8_c(sc, val, data);			\
91 	if (error != 0)						\
92 		goto fail;					\
93 } while (0)
94 #define urtw_read16_m(sc, val, data)	do {			\
95 	error = urtw_read16_c(sc, val, data);			\
96 	if (error != 0)						\
97 		goto fail;					\
98 } while (0)
99 #define urtw_write16_m(sc, val, data)	do {			\
100 	error = urtw_write16_c(sc, val, data);			\
101 	if (error != 0)						\
102 		goto fail;					\
103 } while (0)
104 #define urtw_read32_m(sc, val, data)	do {			\
105 	error = urtw_read32_c(sc, val, data);			\
106 	if (error != 0)						\
107 		goto fail;					\
108 } while (0)
109 #define urtw_write32_m(sc, val, data)	do {			\
110 	error = urtw_write32_c(sc, val, data);			\
111 	if (error != 0)						\
112 		goto fail;					\
113 } while (0)
114 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
115 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
116 	if (error != 0)						\
117 		goto fail;					\
118 } while (0)
119 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
120 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
121 	if (error != 0)						\
122 		goto fail;					\
123 } while (0)
124 #define urtw_8225_write(sc, val, data)	do {			\
125 	error = urtw_8225_write_c(sc, val, data);		\
126 	if (error != 0)						\
127 		goto fail;					\
128 } while (0)
129 
130 struct urtw_pair {
131 	uint32_t	reg;
132 	uint32_t	val;
133 };
134 
135 static uint8_t urtw_8225_agc[] = {
136 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
137 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
138 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
139 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
140 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
141 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
142 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
143 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
144 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
145 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
146 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
147 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
148 };
149 
150 static uint32_t urtw_8225_channel[] = {
151 	0x0000,		/* dummy channel 0  */
152 	0x085c,		/* 1  */
153 	0x08dc,		/* 2  */
154 	0x095c,		/* 3  */
155 	0x09dc,		/* 4  */
156 	0x0a5c,		/* 5  */
157 	0x0adc,		/* 6  */
158 	0x0b5c,		/* 7  */
159 	0x0bdc,		/* 8  */
160 	0x0c5c,		/* 9  */
161 	0x0cdc,		/* 10  */
162 	0x0d5c,		/* 11  */
163 	0x0ddc,		/* 12  */
164 	0x0e5c,		/* 13  */
165 	0x0f72,		/* 14  */
166 };
167 
168 static uint8_t urtw_8225_gain[] = {
169 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm  */
170 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm  */
171 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm  */
172 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm  */
173 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm  */
174 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm  */
175 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm  */
176 };
177 
178 static struct urtw_pair urtw_8225_rf_part1[] = {
179 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
180 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
181 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
182 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 },
183 };
184 
185 static struct urtw_pair urtw_8225_rf_part2[] = {
186 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
187 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
188 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
189 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
190 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
191 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
192 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
193 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
194 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
195 	{ 0x27, 0x88 }
196 };
197 
198 static struct urtw_pair urtw_8225_rf_part3[] = {
199 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
200 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
201 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
202 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
203 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
204 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
205 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
206 };
207 
208 static uint16_t urtw_8225_rxgain[] = {
209 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
210 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
211 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
212 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
213 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
214 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
215 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
216 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
217 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
218 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
219 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
220 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
221 };
222 
223 static uint8_t urtw_8225_threshold[] = {
224 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd,
225 };
226 
227 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
228 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
229 };
230 
231 static uint8_t urtw_8225_txpwr_cck[] = {
232 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
233 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
234 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
235 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
236 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
237 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
238 };
239 
240 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
241 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
242 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
243 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
244 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
245 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
246 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
247 };
248 
249 static uint8_t urtw_8225_txpwr_ofdm[]={
250 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
251 };
252 
253 static uint8_t urtw_8225v2_gain_bg[]={
254 	0x23, 0x15, 0xa5,		/* -82-1dbm  */
255         0x23, 0x15, 0xb5,		/* -82-2dbm  */
256         0x23, 0x15, 0xc5,		/* -82-3dbm  */
257         0x33, 0x15, 0xc5,		/* -78dbm  */
258         0x43, 0x15, 0xc5,		/* -74dbm  */
259         0x53, 0x15, 0xc5,		/* -70dbm  */
260         0x63, 0x15, 0xc5,		/* -66dbm  */
261 };
262 
263 static struct urtw_pair urtw_8225v2_rf_part1[] = {
264 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
265 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
266 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
267 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
268 };
269 
270 static struct urtw_pair urtw_8225v2_rf_part2[] = {
271 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
272 	{ 0x04, 0x00 },	{ 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
273 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
274 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
275 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
276 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
277 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
278 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
279 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
280 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
281 };
282 
283 static struct urtw_pair urtw_8225v2_rf_part3[] = {
284 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
285 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
286 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
287 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
288 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
289 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
290 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
291 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
292 };
293 
294 static uint16_t urtw_8225v2_rxgain[] = {
295         0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0008, 0x0009,
296 	0x000a,	0x000b, 0x0102, 0x0103, 0x0104, 0x0105, 0x0140, 0x0141,
297         0x0142,	0x0143, 0x0144, 0x0145, 0x0180, 0x0181, 0x0182, 0x0183,
298 	0x0184,	0x0185, 0x0188, 0x0189, 0x018a, 0x018b, 0x0243, 0x0244,
299 	0x0245,	0x0280, 0x0281, 0x0282, 0x0283, 0x0284, 0x0285, 0x0288,
300         0x0289, 0x028a, 0x028b, 0x028c, 0x0342, 0x0343, 0x0344, 0x0345,
301 	0x0380, 0x0381, 0x0382, 0x0383, 0x0384, 0x0385, 0x0388, 0x0389,
302 	0x038a, 0x038b, 0x038c, 0x038d, 0x0390, 0x0391, 0x0392, 0x0393,
303 	0x0394, 0x0395, 0x0398, 0x0399, 0x039a, 0x039b, 0x039c, 0x039d,
304 	0x03a0, 0x03a1, 0x03a2, 0x03a3, 0x03a4, 0x03a5, 0x03a8, 0x03a9,
305 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
306 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
307 };
308 
309 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
310 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
311 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
312 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
313 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
314 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
315 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
316 };
317 
318 static uint8_t urtw_8225v2_txpwr_cck[] = {
319 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04
320 };
321 
322 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
323 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00
324 };
325 
326 static struct urtw_pair urtw_ratetable[] = {
327 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
328 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
329 	{ 96, 10 }, { 108, 11 }
330 };
331 
332 int		urtw_init(struct ifnet *);
333 void		urtw_stop(struct ifnet *, int);
334 int		urtw_ioctl(struct ifnet *, u_long, caddr_t);
335 void		urtw_start(struct ifnet *);
336 int		urtw_alloc_data_list(struct urtw_softc *, struct urtw_data [],
337 		    int, int, int);
338 int		urtw_alloc_rx_data_list(struct urtw_softc *);
339 void		urtw_free_rx_data_list(struct urtw_softc *);
340 int		urtw_alloc_tx_data_list(struct urtw_softc *);
341 void		urtw_free_tx_data_list(struct urtw_softc *);
342 void		urtw_free_data_list(struct urtw_softc *,
343 		    usbd_pipe_handle, usbd_pipe_handle,
344 		    struct urtw_data data[], int);
345 void		urtw_rxeof(usbd_xfer_handle, usbd_private_handle,
346 		    usbd_status);
347 int		urtw_tx_start(struct urtw_softc *,
348 		    struct ieee80211_node *, struct mbuf *, int);
349 void		urtw_txeof_low(usbd_xfer_handle, usbd_private_handle,
350 		    usbd_status);
351 void		urtw_txeof_normal(usbd_xfer_handle, usbd_private_handle,
352 		    usbd_status);
353 void		urtw_next_scan(void *);
354 void		urtw_task(void *);
355 void		urtw_ledusbtask(void *);
356 void		urtw_ledtask(void *);
357 int		urtw_media_change(struct ifnet *);
358 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
359 void		urtw_watchdog(struct ifnet *);
360 void		urtw_set_multi(struct urtw_softc *);
361 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
362 int		urtw_isbmode(uint16_t);
363 uint16_t	urtw_rate2rtl(int rate);
364 uint16_t	urtw_rtl2rate(int);
365 usbd_status	urtw_set_rate(struct urtw_softc *);
366 usbd_status	urtw_update_msr(struct urtw_softc *);
367 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *);
368 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *);
369 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *);
370 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t);
371 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t);
372 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t);
373 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
374 usbd_status	urtw_eprom_ck(struct urtw_softc *);
375 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
376 		    int);
377 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
378 		    uint32_t *);
379 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
380 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
381 usbd_status	urtw_get_macaddr(struct urtw_softc *);
382 usbd_status	urtw_get_txpwr(struct urtw_softc *);
383 usbd_status	urtw_get_rfchip(struct urtw_softc *);
384 usbd_status	urtw_led_init(struct urtw_softc *);
385 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
386 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
387 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
388 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
389 		    uint32_t);
390 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
391 		    uint32_t);
392 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
393 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
394 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
395 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
396 		    uint16_t *);
397 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
398 usbd_status	urtw_8225_rf_init(struct urtw_softc *);
399 usbd_status	urtw_8225_rf_set_chan(struct urtw_softc *, int);
400 usbd_status	urtw_8225_rf_set_sens(struct urtw_softc *, int);
401 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
402 usbd_status	urtw_8225v2_rf_init(struct urtw_softc *);
403 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_softc *, int);
404 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
405 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
406 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
407 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
408 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
409 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
410 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
411 usbd_status	urtw_open_pipes(struct urtw_softc *);
412 usbd_status	urtw_close_pipes(struct urtw_softc *);
413 usbd_status	urtw_intr_enable(struct urtw_softc *);
414 usbd_status	urtw_intr_disable(struct urtw_softc *);
415 usbd_status	urtw_reset(struct urtw_softc *);
416 usbd_status	urtw_led_on(struct urtw_softc *, int);
417 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
418 usbd_status	urtw_led_blink(struct urtw_softc *);
419 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
420 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
421 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
422 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
423 usbd_status	urtw_rx_setconf(struct urtw_softc *);
424 usbd_status	urtw_rx_enable(struct urtw_softc *);
425 usbd_status	urtw_tx_enable(struct urtw_softc *sc);
426 
427 int urtw_match(struct device *, void *, void *);
428 void urtw_attach(struct device *, struct device *, void *);
429 int urtw_detach(struct device *, int);
430 int urtw_activate(struct device *, enum devact);
431 
432 struct cfdriver urtw_cd = {
433 	NULL, "urtw", DV_IFNET
434 };
435 
436 const struct cfattach urtw_ca = {
437 	sizeof(struct urtw_softc),
438 	urtw_match,
439 	urtw_attach,
440 	urtw_detach,
441 	urtw_activate,
442 };
443 
444 int
445 urtw_match(struct device *parent, void *match, void *aux)
446 {
447 	struct usb_attach_arg *uaa = aux;
448 
449 	if (uaa->iface != NULL)
450 		return UMATCH_NONE;
451 
452 	return (usb_lookup(urtw_devs, uaa->vendor, uaa->product) != NULL) ?
453 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
454 }
455 
456 void
457 urtw_attach(struct device *parent, struct device *self, void *aux)
458 {
459 	struct urtw_softc *sc = (struct urtw_softc *)self;
460 	struct usb_attach_arg *uaa = aux;
461 	struct ieee80211com *ic = &sc->sc_ic;
462 	struct ifnet *ifp = &ic->ic_if;
463 	usbd_status error;
464 	uint32_t data;
465 	int i;
466 
467 	sc->sc_udev = uaa->device;
468 
469 	urtw_read32_m(sc, URTW_RX, &data);
470 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
471 	    URTW_EEPROM_93C46;
472 
473 	error = urtw_get_rfchip(sc);
474 	if (error != 0)
475 		goto fail;
476 	error = urtw_get_macaddr(sc);
477 	if (error != 0)
478 		goto fail;
479 	error = urtw_get_txpwr(sc);
480 	if (error != 0)
481 		goto fail;
482 	error = urtw_led_init(sc);		/* XXX incompleted  */
483 	if (error != 0)
484 		goto fail;
485 
486 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
487 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
488 	sc->sc_currate = 3;
489 	/* XXX for what?  */
490 	sc->sc_preamble_mode = 2;
491 
492 	usb_init_task(&sc->sc_task, urtw_task, sc);
493 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc);
494 	timeout_set(&sc->scan_to, urtw_next_scan, sc);
495 	timeout_set(&sc->sc_led_ch, urtw_ledtask, sc);
496 
497 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
498 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
499 	ic->ic_state = IEEE80211_S_INIT;
500 
501 	/* set device capabilities */
502 	ic->ic_caps =
503 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
504 	    IEEE80211_C_TXPMGT |	/* tx power management */
505 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
506 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
507 	    IEEE80211_C_WEP |		/* s/w WEP */
508 	    IEEE80211_C_RSN;		/* WPA/RSN */
509 
510 	/* set supported .11b and .11g rates */
511 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
512 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
513 
514 	/* set supported .11b and .11g channels (1 through 14) */
515 	for (i = 1; i <= 14; i++) {
516 		ic->ic_channels[i].ic_freq =
517 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
518 		ic->ic_channels[i].ic_flags =
519 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
520 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
521 	}
522 
523 	ifp->if_softc = sc;
524 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
525 	ifp->if_init = urtw_init;
526 	ifp->if_ioctl = urtw_ioctl;
527 	ifp->if_start = urtw_start;
528 	ifp->if_watchdog = urtw_watchdog;
529 	IFQ_SET_READY(&ifp->if_snd);
530 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
531 
532 	if_attach(ifp);
533 	ieee80211_ifattach(ifp);
534 
535 	/* override state transition machine */
536 	sc->sc_newstate = ic->ic_newstate;
537 	ic->ic_newstate = urtw_newstate;
538 	ieee80211_media_init(ifp, urtw_media_change, ieee80211_media_status);
539 
540 #if NBPFILTER > 0
541 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
542 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
543 
544 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
545 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
546 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
547 
548 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
549 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
550 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
551 #endif
552 
553 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
554 	    &sc->sc_dev);
555 
556 	printf("%s: address %s\n",
557 	    sc->sc_dev.dv_xname, ether_sprintf(ic->ic_myaddr));
558 
559 	return;
560 fail:
561 	printf("%s: %s failed!\n", sc->sc_dev.dv_xname, __func__);
562 }
563 
564 int
565 urtw_detach(struct device *self, int flags)
566 {
567 	struct urtw_softc *sc = (struct urtw_softc *)self;
568 	struct ifnet *ifp = &sc->sc_ic.ic_if;
569 	int s;
570 
571 	s = splusb();
572 
573 	ieee80211_ifdetach(ifp);	/* free all nodes */
574 	if_detach(ifp);
575 
576 	usb_rem_task(sc->sc_udev, &sc->sc_task);
577 	usb_rem_task(sc->sc_udev, &sc->sc_ledtask);
578 	timeout_del(&sc->scan_to);
579 	timeout_del(&sc->sc_led_ch);
580 
581 	/* abort and free xfers */
582 	urtw_free_tx_data_list(sc);
583 	urtw_free_rx_data_list(sc);
584 	urtw_close_pipes(sc);
585 
586 	splx(s);
587 
588 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
589 	    &sc->sc_dev);
590 
591 	return (0);
592 }
593 
594 int
595 urtw_activate(struct device *self, enum devact act)
596 {
597 	switch (act) {
598 	case DVACT_ACTIVATE:
599 		return (EOPNOTSUPP);
600 	case (DVACT_DEACTIVATE):
601 		break;
602 	}
603 
604 	return (0);
605 }
606 
607 usbd_status
608 urtw_close_pipes(struct urtw_softc *sc)
609 {
610 	usbd_status error = 0;
611 
612 	if (sc->sc_rxpipe != NULL) {
613 		error = usbd_close_pipe(sc->sc_rxpipe);
614 		if (error != 0)
615 			goto fail;
616 		sc->sc_rxpipe = NULL;
617 	}
618 	if (sc->sc_txpipe_low != NULL) {
619 		error = usbd_close_pipe(sc->sc_txpipe_low);
620 		if (error != 0)
621 			goto fail;
622 		sc->sc_txpipe_low = NULL;
623 	}
624 	if (sc->sc_txpipe_normal != NULL) {
625 		error = usbd_close_pipe(sc->sc_txpipe_normal);
626 		if (error != 0)
627 			goto fail;
628 		sc->sc_txpipe_normal = NULL;
629 	}
630 fail:
631 	return (error);
632 }
633 
634 usbd_status
635 urtw_open_pipes(struct urtw_softc *sc)
636 {
637 	usbd_status error;
638 
639 	/*
640 	 * NB: there is no way to distinguish each pipes so we need to hardcode
641 	 * pipe numbers
642 	 */
643 
644 	/* tx pipe - low priority packets  */
645 	error = usbd_open_pipe(sc->sc_iface, 0x2, USBD_EXCLUSIVE_USE,
646 	    &sc->sc_txpipe_low);
647 	if (error != 0) {
648 		printf("%s: could not open Tx low pipe: %s\n",
649 		    sc->sc_dev.dv_xname, usbd_errstr(error));
650 		goto fail;
651 	}
652 	/* tx pipe - normal priority packets  */
653 	error = usbd_open_pipe(sc->sc_iface, 0x3, USBD_EXCLUSIVE_USE,
654 	    &sc->sc_txpipe_normal);
655 	if (error != 0) {
656 		printf("%s: could not open Tx normal pipe: %s\n",
657 		    sc->sc_dev.dv_xname, usbd_errstr(error));
658 		goto fail;
659 	}
660 	/* rx pipe  */
661 	error = usbd_open_pipe(sc->sc_iface, 0x81, USBD_EXCLUSIVE_USE,
662 	    &sc->sc_rxpipe);
663 	if (error != 0) {
664 		printf("%s: could not open Rx pipe: %s\n",
665 		    sc->sc_dev.dv_xname, usbd_errstr(error));
666 		goto fail;
667 	}
668 
669 	return (0);
670 fail:
671 	(void)urtw_close_pipes(sc);
672 	return (error);
673 }
674 
675 int
676 urtw_alloc_data_list(struct urtw_softc *sc, struct urtw_data data[],
677 	int ndata, int maxsz, int fillmbuf)
678 {
679 	int i, error;
680 
681 	for (i = 0; i < ndata; i++) {
682 		struct urtw_data *dp = &data[i];
683 
684 		dp->sc = sc;
685 		dp->xfer = usbd_alloc_xfer(sc->sc_udev);
686 		if (dp->xfer == NULL) {
687 			printf("%s: could not allocate xfer\n",
688 			    sc->sc_dev.dv_xname);
689 			error = ENOMEM;
690 			goto fail;
691 		}
692 		if (fillmbuf) {
693 			MGETHDR(dp->m, M_DONTWAIT, MT_DATA);
694 			if (dp->m == NULL) {
695 				printf("%s: could not allocate rx mbuf\n",
696 				    sc->sc_dev.dv_xname);
697 				error = ENOMEM;
698 				goto fail;
699 			}
700 			MCLGET(dp->m, M_DONTWAIT);
701 			if (!(dp->m->m_flags & M_EXT)) {
702 				printf("%s: could not allocate rx mbuf cluster"
703 				    "\n", sc->sc_dev.dv_xname);
704 				error = ENOMEM;
705 				goto fail;
706 			}
707 			dp->buf = mtod(dp->m, uint8_t *);
708 		} else {
709 			dp->m = NULL;
710 			dp->buf = usbd_alloc_buffer(dp->xfer, maxsz);
711 			if (dp->buf == NULL) {
712 				printf("%s: could not allocate buffer\n",
713 				    sc->sc_dev.dv_xname);
714 				error = ENOMEM;
715 				goto fail;
716 			}
717 			if (((unsigned long)dp->buf) % 4)
718 				printf("%s: warn: unaligned buffer %p\n",
719 				    sc->sc_dev.dv_xname, dp->buf);
720 		}
721 		dp->ni = NULL;
722 	}
723 
724 	return (0);
725 
726 fail:	urtw_free_data_list(sc, NULL, NULL, data, ndata);
727 	return (error);
728 }
729 
730 void
731 urtw_free_data_list(struct urtw_softc *sc, usbd_pipe_handle pipe1,
732     usbd_pipe_handle pipe2, struct urtw_data data[], int ndata)
733 {
734 	struct ieee80211com *ic = &sc->sc_ic;
735 	int i;
736 
737 	/* make sure no transfers are pending */
738 	if (pipe1 != NULL)
739 		usbd_abort_pipe(pipe1);
740 	if (pipe2 != NULL)
741 		usbd_abort_pipe(pipe2);
742 
743 	for (i = 0; i < ndata; i++) {
744 		struct urtw_data *dp = &data[i];
745 
746 		if (dp->xfer != NULL) {
747 			usbd_free_xfer(dp->xfer);
748 			dp->xfer = NULL;
749 		}
750 		if (dp->m != NULL) {
751 			m_freem(dp->m);
752 			dp->m = NULL;
753 		}
754 		if (dp->ni != NULL) {
755 			ieee80211_release_node(ic, dp->ni);
756 			dp->ni = NULL;
757 		}
758 	}
759 }
760 
761 int
762 urtw_alloc_rx_data_list(struct urtw_softc *sc)
763 {
764 
765 	return urtw_alloc_data_list(sc,
766 	    sc->sc_rxdata, URTW_RX_DATA_LIST_COUNT, MCLBYTES, 1 /* mbufs */);
767 }
768 
769 void
770 urtw_free_rx_data_list(struct urtw_softc *sc)
771 {
772 
773 	urtw_free_data_list(sc, sc->sc_rxpipe, NULL, sc->sc_rxdata,
774 	    URTW_RX_DATA_LIST_COUNT);
775 }
776 
777 int
778 urtw_alloc_tx_data_list(struct urtw_softc *sc)
779 {
780 
781 	return urtw_alloc_data_list(sc,
782 	    sc->sc_txdata, URTW_TX_DATA_LIST_COUNT, URTW_TX_MAXSIZE,
783 	    0 /* no mbufs */);
784 }
785 
786 void
787 urtw_free_tx_data_list(struct urtw_softc *sc)
788 {
789 
790 	urtw_free_data_list(sc, sc->sc_txpipe_low, sc->sc_txpipe_normal,
791 	    sc->sc_txdata, URTW_TX_DATA_LIST_COUNT);
792 }
793 
794 int
795 urtw_media_change(struct ifnet *ifp)
796 {
797 	int error;
798 
799 	error = ieee80211_media_change(ifp);
800 	if (error != ENETRESET)
801 		return (error);
802 
803 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
804 		urtw_init(ifp);
805 
806 	return (0);
807 }
808 
809 int
810 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
811 {
812 	struct urtw_softc *sc = ic->ic_if.if_softc;
813 
814 	usb_rem_task(sc->sc_udev, &sc->sc_task);
815 	timeout_del(&sc->scan_to);
816 
817 	/* do it in a process context */
818 	sc->sc_state = nstate;
819 	sc->sc_arg = arg;
820 	usb_add_task(sc->sc_udev, &sc->sc_task);
821 
822 	return (0);
823 }
824 
825 usbd_status
826 urtw_led_init(struct urtw_softc *sc)
827 {
828 	uint32_t rev;
829 	usbd_status error;
830 
831 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
832 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
833 	if (error != 0)
834 		goto fail;
835 
836 	switch (rev & URTW_EPROM_CID_MASK) {
837 	case URTW_EPROM_CID_ALPHA0:
838 		sc->sc_strategy = URTW_SW_LED_MODE1;
839 		break;
840 	case URTW_EPROM_CID_SERCOMM_PS:
841 		sc->sc_strategy = URTW_SW_LED_MODE3;
842 		break;
843 	case URTW_EPROM_CID_HW_LED:
844 		sc->sc_strategy = URTW_HW_LED;
845 		break;
846 	case URTW_EPROM_CID_RSVD0:
847 	case URTW_EPROM_CID_RSVD1:
848 	default:
849 		sc->sc_strategy = URTW_SW_LED_MODE0;
850 		break;
851 	}
852 
853 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
854 
855 fail:
856 	return (error);
857 }
858 
859 /* XXX why we should allocalte memory buffer instead of using memory stack?  */
860 usbd_status
861 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
862     uint16_t *data)
863 {
864 	uint8_t *buf;
865 	uint16_t data16;
866 	usb_device_request_t *req;
867 	usbd_status error = 0;
868 
869 	data16 = *data;
870 	req = (usb_device_request_t *)malloc(sizeof(usb_device_request_t),
871 	    M_DEVBUF, M_NOWAIT | M_ZERO);
872 	if (req == NULL) {
873 		printf("%s: could not allocate a memory\n",
874 		    sc->sc_dev.dv_xname);
875 		goto fail0;
876 	}
877 	buf = (uint8_t *)malloc(2, M_DEVBUF, M_NOWAIT | M_ZERO);
878 	if (req == NULL) {
879 		printf("%s: could not allocate a memory\n",
880 		    sc->sc_dev.dv_xname);
881 		goto fail1;
882 	}
883 
884 	req->bmRequestType = UT_WRITE_VENDOR_DEVICE;
885 	req->bRequest = URTW_8187_SETREGS_REQ;
886 	USETW(req->wValue, addr);
887 	USETW(req->wIndex, index);
888 	USETW(req->wLength, sizeof(uint16_t));
889 	buf[0] = (data16 & 0x00ff);
890 	buf[1] = (data16 & 0xff00) >> 8;
891 
892 	error = usbd_do_request(sc->sc_udev, req, buf);
893 
894 	free(buf, M_DEVBUF);
895 fail1:	free(req, M_DEVBUF);
896 fail0:	return (error);
897 }
898 
899 usbd_status
900 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
901 {
902 	int i;
903 	int16_t bit;
904 	uint8_t rlen = 12, wlen = 6;
905 	uint16_t o1, o2, o3, tmp;
906 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
907 	uint32_t mask = 0x80000000, value = 0;
908 	usbd_status error;
909 
910 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
911 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
912 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
913 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
914 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
915 	o1 &= ~0xf;
916 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
917 	DELAY(5);
918 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
919 	DELAY(5);
920 
921 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
922 		bit = ((d2w & mask) != 0) ? 1 : 0;
923 
924 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
925 		DELAY(2);
926 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
927 		    URTW_BB_HOST_BANG_CLK);
928 		DELAY(2);
929 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
930 		    URTW_BB_HOST_BANG_CLK);
931 		DELAY(2);
932 		mask = mask >> 1;
933 		if (i == 2)
934 			break;
935 		bit = ((d2w & mask) != 0) ? 1 : 0;
936 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
937 		    URTW_BB_HOST_BANG_CLK);
938 		DELAY(2);
939 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
940 		    URTW_BB_HOST_BANG_CLK);
941 		DELAY(2);
942 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
943 		DELAY(1);
944 	}
945 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
946 	    URTW_BB_HOST_BANG_CLK);
947 	DELAY(2);
948 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
949 	DELAY(2);
950 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
951 	DELAY(2);
952 
953 	mask = 0x800;
954 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
955 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
956 		    o1 | URTW_BB_HOST_BANG_RW);
957 		DELAY(2);
958 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
959 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
960 		DELAY(2);
961 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
962 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
963 		DELAY(2);
964 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
965 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
966 		DELAY(2);
967 
968 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
969 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
970 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
971 		    o1 | URTW_BB_HOST_BANG_RW);
972 		DELAY(2);
973 	}
974 
975 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
976 	    URTW_BB_HOST_BANG_RW);
977 	DELAY(2);
978 
979 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
980 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
981 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
982 
983 	if (data != NULL)
984 		*data = value;
985 fail:
986 	return (error);
987 }
988 
989 usbd_status
990 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
991 {
992 	uint16_t d80, d82, d84;
993 	usbd_status error;
994 
995 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
996 	d80 &= 0xfff3;
997 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
998 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
999 	d84 &= 0xfff0;
1000 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1001 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1002 	DELAY(10);
1003 
1004 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1005 	DELAY(2);
1006 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1007 	DELAY(10);
1008 
1009 	error = urtw_8225_write_s16(sc, addr, 0x8225, &data);
1010 	if (error != 0)
1011 		goto fail;
1012 
1013 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1014 	DELAY(10);
1015 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1016 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1017 	usbd_delay_ms(sc->sc_udev, 2);
1018 fail:
1019 	return (error);
1020 }
1021 
1022 usbd_status
1023 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1024 {
1025 	uint32_t data;
1026 	usbd_status error;
1027 
1028 	*ret = 1;
1029 
1030 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1031 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1032 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1033 	usbd_delay_ms(sc->sc_udev, 500);
1034 
1035 	urtw_8225_write(sc, 0x0, 0x1b7);
1036 
1037 	error = urtw_8225_read(sc, 0x8, &data);
1038 	if (error != 0)
1039 		goto fail;
1040 	if (data != 0x588)
1041 		*ret = 0;
1042 	else {
1043 		error = urtw_8225_read(sc, 0x9, &data);
1044 		if (error != 0)
1045 			goto fail;
1046 		if (data != 0x700)
1047 			*ret = 0;
1048 	}
1049 
1050 	urtw_8225_write(sc, 0x0, 0xb7);
1051 fail:
1052 	return (error);
1053 }
1054 
1055 usbd_status
1056 urtw_get_rfchip(struct urtw_softc *sc)
1057 {
1058 	int ret;
1059 	uint32_t data;
1060 	usbd_status error;
1061 
1062 	error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1063 	if (error != 0)
1064 		goto fail;
1065 	switch (data & 0xff) {
1066 	case URTW_EPROM_RFCHIPID_RTL8225U:
1067 		error = urtw_8225_isv2(sc, &ret);
1068 		if (error != 0)
1069 			goto fail;
1070 		if (ret == 0) {
1071 			sc->sc_rf_init = urtw_8225_rf_init;
1072 			sc->sc_rf_set_sens = urtw_8225_rf_set_sens;
1073 			sc->sc_rf_set_chan = urtw_8225_rf_set_chan;
1074 		} else {
1075 			sc->sc_rf_init = urtw_8225v2_rf_init;
1076 			sc->sc_rf_set_chan = urtw_8225v2_rf_set_chan;
1077 		}
1078 		sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
1079 		sc->sc_sens = URTW_8225_RF_DEF_SENS;
1080 		break;
1081 	default:
1082 		panic("unsupported RF chip %d\n", data & 0xff);
1083 		/* never reach  */
1084 	}
1085 
1086 fail:
1087 	return (error);
1088 }
1089 
1090 usbd_status
1091 urtw_get_txpwr(struct urtw_softc *sc)
1092 {
1093 	int i, j;
1094 	uint32_t data;
1095 	usbd_status error;
1096 
1097 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1098 	if (error != 0)
1099 		goto fail;
1100 	sc->sc_txpwr_cck_base = data & 0xf;
1101 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1102 
1103 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1104 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1105 		if (error != 0)
1106 			goto fail;
1107 		sc->sc_txpwr_cck[i] = data & 0xf;
1108 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1109 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1110 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1111 	}
1112 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1113 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1114 		if (error != 0)
1115 			goto fail;
1116 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1117 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1118 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1119 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1120 	}
1121 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1122 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j, &data);
1123 		if (error != 0)
1124 			goto fail;
1125 		sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1126 		sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1127 		sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1128 		sc->sc_txpwr_ofdm[i + 6 + 4 + 1] = (data & 0xf000) >> 12;
1129 	}
1130 fail:
1131 	return (error);
1132 }
1133 
1134 usbd_status
1135 urtw_get_macaddr(struct urtw_softc *sc)
1136 {
1137 	struct ieee80211com *ic = &sc->sc_ic;
1138 	usbd_status error;
1139 	uint32_t data;
1140 
1141 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1142 	if (error != 0)
1143 		goto fail;
1144 	ic->ic_myaddr[0] = data & 0xff;
1145 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1146 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1147 	if (error != 0)
1148 		goto fail;
1149 	ic->ic_myaddr[2] = data & 0xff;
1150 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1151 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1152 	if (error != 0)
1153 		goto fail;
1154 	ic->ic_myaddr[4] = data & 0xff;
1155 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1156 fail:
1157 	return (error);
1158 }
1159 
1160 usbd_status
1161 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1162 {
1163 #define URTW_READCMD_LEN		3
1164 	int addrlen, i;
1165 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1166 	usbd_status error;
1167 
1168 	/* NB: make sure the buffer is initialized  */
1169 	*data = 0;
1170 
1171 	/* enable EPROM programming */
1172 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1173 	DELAY(URTW_EPROM_DELAY);
1174 
1175 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1176 	if (error != 0)
1177 		goto fail;
1178 	error = urtw_eprom_ck(sc);
1179 	if (error != 0)
1180 		goto fail;
1181 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1182 	if (error != 0)
1183 		goto fail;
1184 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1185 		addrlen = 8;
1186 		addrstr[0] = addr & (1 << 7);
1187 		addrstr[1] = addr & (1 << 6);
1188 		addrstr[2] = addr & (1 << 5);
1189 		addrstr[3] = addr & (1 << 4);
1190 		addrstr[4] = addr & (1 << 3);
1191 		addrstr[5] = addr & (1 << 2);
1192 		addrstr[6] = addr & (1 << 1);
1193 		addrstr[7] = addr & (1 << 0);
1194 	} else {
1195 		addrlen=6;
1196 		addrstr[0] = addr & (1 << 5);
1197 		addrstr[1] = addr & (1 << 4);
1198 		addrstr[2] = addr & (1 << 3);
1199 		addrstr[3] = addr & (1 << 2);
1200 		addrstr[4] = addr & (1 << 1);
1201 		addrstr[5] = addr & (1 << 0);
1202 	}
1203 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1204 	if (error != 0)
1205 		goto fail;
1206 
1207 	error = urtw_eprom_writebit(sc, 0);
1208 	if (error != 0)
1209 		goto fail;
1210 
1211 	for (i = 0; i < 16; i++) {
1212 		error = urtw_eprom_ck(sc);
1213 		if (error != 0)
1214 			goto fail;
1215 		error = urtw_eprom_readbit(sc, &data16);
1216 		if (error != 0)
1217 			goto fail;
1218 
1219 		(*data) |= (data16 << (15 - i));
1220 	}
1221 
1222 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1223 	if (error != 0)
1224 		goto fail;
1225 	error = urtw_eprom_ck(sc);
1226 	if (error != 0)
1227 		goto fail;
1228 
1229 	/* now disable EPROM programming */
1230 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1231 fail:
1232 	return (error);
1233 #undef URTW_READCMD_LEN
1234 }
1235 
1236 usbd_status
1237 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1238 {
1239 	uint8_t data8;
1240 	usbd_status error;
1241 
1242 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1243 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1244 	DELAY(URTW_EPROM_DELAY);
1245 
1246 fail:
1247 	return (error);
1248 }
1249 
1250 usbd_status
1251 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1252 {
1253 	int i = 0;
1254 	usbd_status error = 0;
1255 
1256 	for (i = 0; i < buflen; i++) {
1257 		error = urtw_eprom_writebit(sc, buf[i]);
1258 		if (error != 0)
1259 			goto fail;
1260 		error = urtw_eprom_ck(sc);
1261 		if (error != 0)
1262 			goto fail;
1263 	}
1264 fail:
1265 	return (error);
1266 }
1267 
1268 usbd_status
1269 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1270 {
1271 	uint8_t data;
1272 	usbd_status error;
1273 
1274 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1275 	if (bit != 0)
1276 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1277 	else
1278 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1279 	DELAY(URTW_EPROM_DELAY);
1280 fail:
1281 	return (error);
1282 }
1283 
1284 usbd_status
1285 urtw_eprom_ck(struct urtw_softc *sc)
1286 {
1287 	uint8_t data;
1288 	usbd_status error;
1289 
1290 	/* masking  */
1291 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1292 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1293 	DELAY(URTW_EPROM_DELAY);
1294 	/* unmasking  */
1295 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1296 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1297 	DELAY(URTW_EPROM_DELAY);
1298 fail:
1299 	return (error);
1300 }
1301 
1302 usbd_status
1303 urtw_eprom_cs(struct urtw_softc *sc, int able)
1304 {
1305 	uint8_t data;
1306 	usbd_status error;
1307 
1308 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1309 	if (able == URTW_EPROM_ENABLE)
1310 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1311 	else
1312 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1313 	DELAY(URTW_EPROM_DELAY);
1314 fail:
1315 	return (error);
1316 }
1317 
1318 usbd_status
1319 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data)
1320 {
1321 	usb_device_request_t req;
1322 	usbd_status error;
1323 
1324 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1325 	req.bRequest = URTW_8187_GETREGS_REQ;
1326 	USETW(req.wValue, val | 0xff00);
1327 	USETW(req.wIndex, 0);
1328 	USETW(req.wLength, sizeof(uint8_t));
1329 
1330 	error = usbd_do_request(sc->sc_udev, &req, data);
1331 	return (error);
1332 }
1333 
1334 usbd_status
1335 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1336 {
1337 	usb_device_request_t req;
1338 	usbd_status error;
1339 
1340 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1341 	req.bRequest = URTW_8187_GETREGS_REQ;
1342 	USETW(req.wValue, val | 0xfe00);
1343 	USETW(req.wIndex, 0);
1344 	USETW(req.wLength, sizeof(uint8_t));
1345 
1346 	error = usbd_do_request(sc->sc_udev, &req, data);
1347 	return (error);
1348 }
1349 
1350 usbd_status
1351 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data)
1352 {
1353 	usb_device_request_t req;
1354 	usbd_status error;
1355 
1356 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1357 	req.bRequest = URTW_8187_GETREGS_REQ;
1358 	USETW(req.wValue, val | 0xff00);
1359 	USETW(req.wIndex, 0);
1360 	USETW(req.wLength, sizeof(uint16_t));
1361 
1362 	error = usbd_do_request(sc->sc_udev, &req, data);
1363 	return (error);
1364 }
1365 
1366 usbd_status
1367 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data)
1368 {
1369 	usb_device_request_t req;
1370 	usbd_status error;
1371 
1372 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1373 	req.bRequest = URTW_8187_GETREGS_REQ;
1374 	USETW(req.wValue, val | 0xff00);
1375 	USETW(req.wIndex, 0);
1376 	USETW(req.wLength, sizeof(uint32_t));
1377 
1378 	error = usbd_do_request(sc->sc_udev, &req, data);
1379 	return (error);
1380 }
1381 
1382 usbd_status
1383 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data)
1384 {
1385 	usb_device_request_t req;
1386 
1387 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1388 	req.bRequest = URTW_8187_SETREGS_REQ;
1389 	USETW(req.wValue, val | 0xff00);
1390 	USETW(req.wIndex, 0);
1391 	USETW(req.wLength, sizeof(uint8_t));
1392 
1393 	return (usbd_do_request(sc->sc_udev, &req, &data));
1394 }
1395 
1396 usbd_status
1397 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1398 {
1399 	usb_device_request_t req;
1400 
1401 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1402 	req.bRequest = URTW_8187_SETREGS_REQ;
1403 	USETW(req.wValue, val | 0xfe00);
1404 	USETW(req.wIndex, 0);
1405 	USETW(req.wLength, sizeof(uint8_t));
1406 
1407 	return (usbd_do_request(sc->sc_udev, &req, &data));
1408 }
1409 
1410 usbd_status
1411 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data)
1412 {
1413 	usb_device_request_t req;
1414 
1415 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1416 	req.bRequest = URTW_8187_SETREGS_REQ;
1417 	USETW(req.wValue, val | 0xff00);
1418 	USETW(req.wIndex, 0);
1419 	USETW(req.wLength, sizeof(uint16_t));
1420 
1421 	return (usbd_do_request(sc->sc_udev, &req, &data));
1422 }
1423 
1424 usbd_status
1425 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data)
1426 {
1427 	usb_device_request_t req;
1428 
1429 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1430 	req.bRequest = URTW_8187_SETREGS_REQ;
1431 	USETW(req.wValue, val | 0xff00);
1432 	USETW(req.wIndex, 0);
1433 	USETW(req.wLength, sizeof(uint32_t));
1434 
1435 	return (usbd_do_request(sc->sc_udev, &req, &data));
1436 }
1437 
1438 static usbd_status
1439 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1440 {
1441 	uint8_t data;
1442 	usbd_status error;
1443 
1444 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1445 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1446 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1447 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1448 fail:
1449 	return (error);
1450 }
1451 
1452 usbd_status
1453 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1454 {
1455 	uint8_t data;
1456 	usbd_status error;
1457 
1458 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1459 	if (error)
1460 		goto fail;
1461 
1462 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1463 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1464 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1465 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1466 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1467 
1468 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1469 	if (error)
1470 		goto fail;
1471 fail:
1472 	return (error);
1473 }
1474 
1475 usbd_status
1476 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1477 {
1478 	uint8_t data;
1479 	usbd_status error;
1480 
1481 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1482 	if (error)
1483 		goto fail;
1484 
1485 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1486 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1487 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1488 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1489 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1490 
1491 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1492 	if (error)
1493 		goto fail;
1494 fail:
1495 	return (error);
1496 }
1497 
1498 usbd_status
1499 urtw_intr_disable(struct urtw_softc *sc)
1500 {
1501 	usbd_status error;
1502 
1503 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1504 fail:
1505 	return (error);
1506 }
1507 
1508 usbd_status
1509 urtw_reset(struct urtw_softc *sc)
1510 {
1511 	uint8_t data;
1512 	usbd_status error;
1513 
1514 	error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
1515 	if (error)
1516 		goto fail;
1517 	error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
1518 	if (error)
1519 		goto fail;
1520 
1521 	error = urtw_intr_disable(sc);
1522 	if (error)
1523 		goto fail;
1524 	usbd_delay_ms(sc->sc_udev, 100);
1525 
1526 	error = urtw_write8e(sc, 0x18, 0x10);
1527 	if (error != 0)
1528 		goto fail;
1529 	error = urtw_write8e(sc, 0x18, 0x11);
1530 	if (error != 0)
1531 		goto fail;
1532 	error = urtw_write8e(sc, 0x18, 0x00);
1533 	if (error != 0)
1534 		goto fail;
1535 	usbd_delay_ms(sc->sc_udev, 100);
1536 
1537 	urtw_read8_m(sc, URTW_CMD, &data);
1538 	data = (data & 2) | URTW_CMD_RST;
1539 	urtw_write8_m(sc, URTW_CMD, data);
1540 	usbd_delay_ms(sc->sc_udev, 100);
1541 
1542 	urtw_read8_m(sc, URTW_CMD, &data);
1543 	if (data & URTW_CMD_RST) {
1544 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
1545 		goto fail;
1546 	}
1547 
1548 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1549 	if (error)
1550 		goto fail;
1551 	usbd_delay_ms(sc->sc_udev, 100);
1552 
1553 	error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
1554 	if (error)
1555 		goto fail;
1556 	error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
1557 	if (error)
1558 		goto fail;
1559 fail:
1560 	return (error);
1561 }
1562 
1563 usbd_status
1564 urtw_led_on(struct urtw_softc *sc, int type)
1565 {
1566 	usbd_status error;
1567 
1568 	if (type == URTW_LED_GPIO) {
1569 		switch (sc->sc_gpio_ledpin) {
1570 		case URTW_LED_PIN_GPIO0:
1571 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1572 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1573 			break;
1574 		default:
1575 			panic("unsupported LED PIN type 0x%x",
1576 			    sc->sc_gpio_ledpin);
1577 			/* never reach  */
1578 		}
1579 	} else {
1580 		panic("unsupported LED type 0x%x", type);
1581 		/* never reach  */
1582 	}
1583 
1584 	sc->sc_gpio_ledon = 1;
1585 fail:
1586 	return (error);
1587 }
1588 
1589 static usbd_status
1590 urtw_led_off(struct urtw_softc *sc, int type)
1591 {
1592 	usbd_status error;
1593 
1594 	if (type == URTW_LED_GPIO) {
1595 		switch (sc->sc_gpio_ledpin) {
1596 		case URTW_LED_PIN_GPIO0:
1597 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1598 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1599 			break;
1600 		default:
1601 			panic("unsupported LED PIN type 0x%x",
1602 			    sc->sc_gpio_ledpin);
1603 			/* never reach  */
1604 		}
1605 	} else {
1606 		panic("unsupported LED type 0x%x", type);
1607 		/* never reach  */
1608 	}
1609 
1610 	sc->sc_gpio_ledon = 0;
1611 
1612 fail:
1613 	return (error);
1614 }
1615 
1616 usbd_status
1617 urtw_led_mode0(struct urtw_softc *sc, int mode)
1618 {
1619 	struct timeval t;
1620 
1621 	switch (mode) {
1622 	case URTW_LED_CTL_POWER_ON:
1623 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1624 		break;
1625 	case URTW_LED_CTL_TX:
1626 		if (sc->sc_gpio_ledinprogress == 1)
1627 			return (0);
1628 
1629 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1630 		sc->sc_gpio_blinktime = 2;
1631 		break;
1632 	case URTW_LED_CTL_LINK:
1633 		sc->sc_gpio_ledstate = URTW_LED_ON;
1634 		break;
1635 	default:
1636 		panic("unsupported LED mode 0x%x", mode);
1637 		/* never reach  */
1638 	}
1639 
1640 	switch (sc->sc_gpio_ledstate) {
1641 	case URTW_LED_ON:
1642 		if (sc->sc_gpio_ledinprogress != 0)
1643 			break;
1644 		urtw_led_on(sc, URTW_LED_GPIO);
1645 		break;
1646 	case URTW_LED_BLINK_NORMAL:
1647 		if (sc->sc_gpio_ledinprogress != 0)
1648 			break;
1649 		sc->sc_gpio_ledinprogress = 1;
1650 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1651 			URTW_LED_OFF : URTW_LED_ON;
1652 		t.tv_sec = 0;
1653 		t.tv_usec = 100 * 1000L;
1654 		timeout_add(&sc->sc_led_ch, tvtohz(&t));
1655 		break;
1656 	case URTW_LED_POWER_ON_BLINK:
1657 		urtw_led_on(sc, URTW_LED_GPIO);
1658 		usbd_delay_ms(sc->sc_udev, 100);
1659 		urtw_led_off(sc, URTW_LED_GPIO);
1660 		break;
1661 	default:
1662 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1663 		/* never reach  */
1664 	}
1665 	return (0);
1666 }
1667 
1668 usbd_status
1669 urtw_led_mode1(struct urtw_softc *sc, int mode)
1670 {
1671 
1672 	return (USBD_INVAL);
1673 }
1674 
1675 usbd_status
1676 urtw_led_mode2(struct urtw_softc *sc, int mode)
1677 {
1678 
1679 	return (USBD_INVAL);
1680 }
1681 
1682 usbd_status
1683 urtw_led_mode3(struct urtw_softc *sc, int mode)
1684 {
1685 
1686 	return (USBD_INVAL);
1687 }
1688 
1689 void
1690 urtw_ledusbtask(void *arg)
1691 {
1692 	struct urtw_softc *sc = arg;
1693 
1694 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1695 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1696 
1697 	urtw_led_blink(sc);
1698 }
1699 
1700 void
1701 urtw_ledtask(void *arg)
1702 {
1703 	struct urtw_softc *sc = arg;
1704 
1705 	/*
1706 	 * NB: to change a status of the led we need at least a sleep so we
1707 	 * can't do it here
1708 	 */
1709 	usb_add_task(sc->sc_udev, &sc->sc_ledtask);
1710 }
1711 
1712 usbd_status
1713 urtw_led_ctl(struct urtw_softc *sc, int mode)
1714 {
1715 	usbd_status error = 0;
1716 
1717 	switch (sc->sc_strategy) {
1718 	case URTW_SW_LED_MODE0:
1719 		error = urtw_led_mode0(sc, mode);
1720 		break;
1721 	case URTW_SW_LED_MODE1:
1722 		error = urtw_led_mode1(sc, mode);
1723 		break;
1724 	case URTW_SW_LED_MODE2:
1725 		error = urtw_led_mode2(sc, mode);
1726 		break;
1727 	case URTW_SW_LED_MODE3:
1728 		error = urtw_led_mode3(sc, mode);
1729 		break;
1730 	default:
1731 		panic("unsupported LED mode %d\n", sc->sc_strategy);
1732 		/* never reach  */
1733 	}
1734 
1735 	return (error);
1736 }
1737 
1738 usbd_status
1739 urtw_led_blink(struct urtw_softc *sc)
1740 {
1741 	struct timeval t;
1742 	uint8_t ing = 0;
1743 	usbd_status error;
1744 
1745 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
1746 		error = urtw_led_on(sc, URTW_LED_GPIO);
1747 	else
1748 		error = urtw_led_off(sc, URTW_LED_GPIO);
1749 	sc->sc_gpio_blinktime--;
1750 	if (sc->sc_gpio_blinktime == 0)
1751 		ing = 1;
1752 	else {
1753 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
1754 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
1755 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
1756 			ing = 1;
1757 	}
1758 	if (ing == 1) {
1759 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
1760 		    sc->sc_gpio_ledon == 0)
1761 			error = urtw_led_on(sc, URTW_LED_GPIO);
1762 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
1763 		    sc->sc_gpio_ledon == 1)
1764 			error = urtw_led_off(sc, URTW_LED_GPIO);
1765 
1766 		sc->sc_gpio_blinktime = 0;
1767 		sc->sc_gpio_ledinprogress = 0;
1768 		return (0);
1769 	}
1770 
1771 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
1772 	    URTW_LED_ON : URTW_LED_OFF;
1773 
1774 	switch (sc->sc_gpio_ledstate) {
1775 	case URTW_LED_BLINK_NORMAL:
1776 		t.tv_sec = 0;
1777 		t.tv_usec = 100 * 1000L;
1778 		timeout_add(&sc->sc_led_ch, tvtohz(&t));
1779 		break;
1780 	default:
1781 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1782 		/* never reach  */
1783 	}
1784 	return (0);
1785 }
1786 
1787 usbd_status
1788 urtw_update_msr(struct urtw_softc *sc)
1789 {
1790 	struct ieee80211com *ic = &sc->sc_ic;
1791 	uint8_t data;
1792 	usbd_status error;
1793 
1794 	urtw_read8_m(sc, URTW_MSR, &data);
1795 	data &= ~URTW_MSR_LINK_MASK;
1796 
1797 	if (sc->sc_state == IEEE80211_S_RUN) {
1798 		switch (ic->ic_opmode) {
1799 		case IEEE80211_M_STA:
1800 		case IEEE80211_M_MONITOR:
1801 			data |= URTW_MSR_LINK_STA;
1802 			break;
1803 		default:
1804 			panic("unsupported operation mode 0x%x\n",
1805 			    ic->ic_opmode);
1806 			/* never reach  */
1807 		}
1808 	} else
1809 		data |= URTW_MSR_LINK_NONE;
1810 
1811 	urtw_write8_m(sc, URTW_MSR, data);
1812 fail:
1813 	return (error);
1814 }
1815 
1816 uint16_t
1817 urtw_rate2rtl(int rate)
1818 {
1819 	int i;
1820 
1821 	for (i = 0; i < nitems(urtw_ratetable); i++) {
1822 		if (rate == urtw_ratetable[i].reg)
1823 			return urtw_ratetable[i].val;
1824 	}
1825 
1826 	return (3);
1827 }
1828 
1829 uint16_t
1830 urtw_rtl2rate(int rate)
1831 {
1832 	int i;
1833 
1834 	for (i = 0; i < nitems(urtw_ratetable); i++) {
1835 		if (rate == urtw_ratetable[i].val)
1836 			return urtw_ratetable[i].reg;
1837 	}
1838 
1839 	return (0);
1840 }
1841 
1842 usbd_status
1843 urtw_set_rate(struct urtw_softc *sc)
1844 {
1845 	int i, basic_rate, min_rr_rate, max_rr_rate;
1846 	uint16_t data;
1847 	usbd_status error;
1848 
1849 	basic_rate = urtw_rate2rtl(48);
1850 	min_rr_rate = urtw_rate2rtl(12);
1851 	max_rr_rate = urtw_rate2rtl(48);
1852 
1853 	urtw_write8_m(sc, URTW_RESP_RATE,
1854 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
1855 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
1856 
1857 	urtw_read16_m(sc, URTW_BRSR, &data);
1858 	data &= ~URTW_BRSR_MBR_8185;
1859 
1860 	for (i = 0; i <= basic_rate; i++)
1861 		data |= (1 << i);
1862 
1863 	urtw_write16_m(sc, URTW_BRSR, data);
1864 fail:
1865 	return (error);
1866 }
1867 
1868 usbd_status
1869 urtw_intr_enable(struct urtw_softc *sc)
1870 {
1871 	usbd_status error;
1872 
1873 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
1874 fail:
1875 	return (error);
1876 }
1877 
1878 usbd_status
1879 urtw_rx_setconf(struct urtw_softc *sc)
1880 {
1881 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1882 	struct ieee80211com *ic = &sc->sc_ic;
1883 	uint32_t data;
1884 	usbd_status error;
1885 
1886 	urtw_read32_m(sc, URTW_RX, &data);
1887 	data = data &~ URTW_RX_FILTER_MASK;
1888 #if 0
1889 	data = data | URTW_RX_FILTER_CTL;
1890 #endif
1891 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
1892 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
1893 
1894 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
1895 		data = data | URTW_RX_FILTER_ICVERR;
1896 		data = data | URTW_RX_FILTER_PWR;
1897 	}
1898 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
1899 		data = data | URTW_RX_FILTER_CRCERR;
1900 
1901 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
1902 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
1903 		data = data | URTW_RX_FILTER_ALLMAC;
1904 	} else {
1905 		data = data | URTW_RX_FILTER_NICMAC;
1906 		data = data | URTW_RX_CHECK_BSSID;
1907 	}
1908 
1909 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
1910 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
1911 	data = data &~ URTW_MAX_RX_DMA_MASK;
1912 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
1913 
1914 	urtw_write32_m(sc, URTW_RX, data);
1915 fail:
1916 	return (error);
1917 }
1918 
1919 usbd_status
1920 urtw_rx_enable(struct urtw_softc *sc)
1921 {
1922 	int i;
1923 	struct urtw_data *rxdata;
1924 	uint8_t data;
1925 	usbd_status error;
1926 
1927 	/*
1928 	 * Start up the receive pipe.
1929 	 */
1930 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
1931 		rxdata = &sc->sc_rxdata[i];
1932 
1933 		usbd_setup_xfer(rxdata->xfer, sc->sc_rxpipe, rxdata,
1934 		    rxdata->buf, MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT,
1935 		    urtw_rxeof);
1936 		error = usbd_transfer(rxdata->xfer);
1937 		if (error != USBD_IN_PROGRESS && error != 0) {
1938 			printf("%s: could not queue Rx transfer\n",
1939 			    sc->sc_dev.dv_xname);
1940 			goto fail;
1941 		}
1942 	}
1943 
1944 	error = urtw_rx_setconf(sc);
1945 	if (error != 0)
1946 		goto fail;
1947 
1948 	urtw_read8_m(sc, URTW_CMD, &data);
1949 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
1950 fail:
1951 	return (error);
1952 }
1953 
1954 usbd_status
1955 urtw_tx_enable(struct urtw_softc *sc)
1956 {
1957 	uint8_t data8;
1958 	uint32_t data;
1959 	usbd_status error;
1960 
1961 	urtw_read8_m(sc, URTW_CW_CONF, &data8);
1962 	data8 &= ~(URTW_CW_CONF_PERPACKET_CW | URTW_CW_CONF_PERPACKET_RETRY);
1963 	urtw_write8_m(sc, URTW_CW_CONF, data8);
1964 
1965 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
1966 	data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
1967 	data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
1968 	data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
1969 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
1970 
1971 	urtw_read32_m(sc, URTW_TX_CONF, &data);
1972 	data &= ~URTW_TX_LOOPBACK_MASK;
1973 	data |= URTW_TX_LOOPBACK_NONE;
1974 	data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
1975 	data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
1976 	data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
1977 	data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
1978 	data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
1979 	data &= ~URTW_TX_SWPLCPLEN;
1980 	data |= URTW_TX_NOICV;
1981 	urtw_write32_m(sc, URTW_TX_CONF, data);
1982 
1983 	urtw_read8_m(sc, URTW_CMD, &data8);
1984 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
1985 fail:
1986 	return (error);
1987 }
1988 
1989 int
1990 urtw_init(struct ifnet *ifp)
1991 {
1992 	struct urtw_softc *sc = ifp->if_softc;
1993 	struct ieee80211com *ic = &sc->sc_ic;
1994 	usbd_status error;
1995 	int ret;
1996 
1997 	urtw_stop(ifp, 0);
1998 
1999 	error = urtw_reset(sc);
2000 	if (error)
2001 		goto fail;
2002 
2003 	urtw_write8_m(sc, 0x85, 0);
2004 	urtw_write8_m(sc, URTW_GPIO, 0);
2005 
2006 	/* for led  */
2007 	urtw_write8_m(sc, 0x85, 4);
2008 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2009 	if (error != 0)
2010 		goto fail;
2011 
2012 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2013 	if (error)
2014 		goto fail;
2015 
2016 	/* applying MAC address again.  */
2017 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2018 	urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)ic->ic_myaddr)[0]);
2019 	urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)ic->ic_myaddr)[1] & 0xffff);
2020 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2021 	if (error)
2022 		goto fail;
2023 
2024 	error = urtw_update_msr(sc);
2025 	if (error)
2026 		goto fail;
2027 
2028 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2029 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2030 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2031 	error = urtw_set_rate(sc);
2032 	if (error != 0)
2033 		goto fail;
2034 
2035 	error = sc->sc_rf_init(sc);
2036 	if (error != 0)
2037 		goto fail;
2038 	if (sc->sc_rf_set_sens != NULL)
2039 		sc->sc_rf_set_sens(sc, sc->sc_sens);
2040 
2041 	urtw_write16_m(sc, 0x5e, 1);
2042 	urtw_write16_m(sc, 0xfe, 0x10);
2043 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2044 	urtw_write8_m(sc, 0xff, 0x60);
2045 	urtw_write16_m(sc, 0x5e, 0);
2046 	urtw_write8_m(sc, 0x85, 4);
2047 
2048 	error = urtw_intr_enable(sc);
2049 	if (error != 0)
2050 		goto fail;
2051 
2052 	/* reset softc variables  */
2053 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
2054 	sc->sc_txtimer = 0;
2055 
2056 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2057 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2058 		if (error != 0) {
2059 			printf("%s: could not set configuration no\n",
2060 			     sc->sc_dev.dv_xname);
2061 			goto fail;
2062 		}
2063 		/* get the first interface handle */
2064 		error = usbd_device2interface_handle(sc->sc_udev,
2065 		    URTW_IFACE_INDEX, &sc->sc_iface);
2066 		if (error != 0) {
2067 			printf("%s: could not get interface handle\n",
2068 			    sc->sc_dev.dv_xname);
2069 			goto fail;
2070 		}
2071 		error = urtw_open_pipes(sc);
2072 		if (error != 0)
2073 			goto fail;
2074 		ret = urtw_alloc_rx_data_list(sc);
2075 		if (error != 0)
2076 			goto fail;
2077 		ret = urtw_alloc_tx_data_list(sc);
2078 		if (error != 0)
2079 			goto fail;
2080 		sc->sc_flags |= URTW_INIT_ONCE;
2081 	}
2082 
2083 	error = urtw_rx_enable(sc);
2084 	if (error != 0)
2085 		goto fail;
2086 	error = urtw_tx_enable(sc);
2087 	if (error != 0)
2088 		goto fail;
2089 
2090 	ifp->if_flags &= ~IFF_OACTIVE;
2091 	ifp->if_flags |= IFF_RUNNING;
2092 
2093 	ifp->if_timer = 1;
2094 
2095 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2096 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2097 	else
2098 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2099 
2100 	return (0);
2101 fail:
2102 	return (error);
2103 }
2104 
2105 void
2106 urtw_set_multi(struct urtw_softc *sc)
2107 {
2108 	struct arpcom *ac = &sc->sc_ic.ic_ac;
2109 	struct ifnet *ifp = &ac->ac_if;
2110 
2111 	/*
2112 	 * XXX don't know how to set a device.  Lack of docs.  Just try to set
2113 	 * IFF_ALLMULTI flag here.
2114 	 */
2115 	ifp->if_flags |= IFF_ALLMULTI;
2116 }
2117 
2118 int
2119 urtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2120 {
2121 	struct urtw_softc *sc = ifp->if_softc;
2122 	struct ieee80211com *ic = &sc->sc_ic;
2123 	struct ifaddr *ifa;
2124 	struct ifreq *ifr;
2125 	int s, error = 0;
2126 
2127 	s = splnet();
2128 
2129 	switch (cmd) {
2130 	case SIOCSIFADDR:
2131 		ifa = (struct ifaddr *)data;
2132 		ifp->if_flags |= IFF_UP;
2133 #ifdef INET
2134 		if (ifa->ifa_addr->sa_family == AF_INET)
2135 			arp_ifinit(&ic->ic_ac, ifa);
2136 #endif
2137 		/* FALLTHROUGH */
2138 	case SIOCSIFFLAGS:
2139 		if (ifp->if_flags & IFF_UP) {
2140 			/*
2141 			 * If only the PROMISC or ALLMULTI flag changes, then
2142 			 * don't do a full re-init of the chip, just update
2143 			 * the Rx filter.
2144 			 */
2145 			if ((ifp->if_flags & IFF_RUNNING) &&
2146 			    ((ifp->if_flags ^ sc->sc_if_flags) &
2147 			    (IFF_ALLMULTI | IFF_PROMISC)) != 0) {
2148 			    	urtw_set_multi(sc);
2149 			} else {
2150 				if (!(ifp->if_flags & IFF_RUNNING))
2151 					urtw_init(ifp);
2152 			}
2153 		} else {
2154 			if (ifp->if_flags & IFF_RUNNING)
2155 				urtw_stop(ifp, 1);
2156 		}
2157 		sc->sc_if_flags = ifp->if_flags;
2158 		break;
2159 
2160 	case SIOCADDMULTI:
2161 	case SIOCDELMULTI:
2162 		ifr = (struct ifreq *)data;
2163 		error = (cmd == SIOCADDMULTI) ?
2164 		    ether_addmulti(ifr, &ic->ic_ac) :
2165 		    ether_delmulti(ifr, &ic->ic_ac);
2166 		if (error == ENETRESET) {
2167 			if (ifp->if_flags & IFF_RUNNING)
2168 				urtw_set_multi(sc);
2169 			error = 0;
2170 		}
2171 		break;
2172 
2173 	case SIOCS80211CHANNEL:
2174 		/*
2175 		 * This allows for fast channel switching in monitor mode
2176 		 * (used by kismet). In IBSS mode, we must explicitly reset
2177 		 * the interface to generate a new beacon frame.
2178 		 */
2179 		error = ieee80211_ioctl(ifp, cmd, data);
2180 		if (error == ENETRESET &&
2181 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2182 		    	urtw_set_chan(sc, ic->ic_ibss_chan);
2183 			error = 0;
2184 		}
2185 		break;
2186 
2187 	default:
2188 		error = ieee80211_ioctl(ifp, cmd, data);
2189 	}
2190 
2191 	if (error == ENETRESET) {
2192 		if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
2193 		    (IFF_RUNNING | IFF_UP))
2194 			urtw_init(ifp);
2195 		error = 0;
2196 	}
2197 
2198 	splx(s);
2199 
2200 	return (error);
2201 }
2202 
2203 void
2204 urtw_start(struct ifnet *ifp)
2205 {
2206 	struct urtw_softc *sc = ifp->if_softc;
2207 	struct ieee80211com *ic = &sc->sc_ic;
2208 	struct ieee80211_node *ni;
2209 	struct mbuf *m0;
2210 
2211 	/*
2212 	 * net80211 may still try to send management frames even if the
2213 	 * IFF_RUNNING flag is not set...
2214 	 */
2215 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2216 		return;
2217 
2218 	for (;;) {
2219 		IF_POLL(&ic->ic_mgtq, m0);
2220 		if (m0 != NULL) {
2221 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2222 			    sc->sc_tx_normal_queued >=
2223 			    URTW_TX_DATA_LIST_COUNT) {
2224 			    	ifp->if_flags |= IFF_OACTIVE;
2225 				break;
2226 			}
2227 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2228 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
2229 			m0->m_pkthdr.rcvif = NULL;
2230 #if NBPFILTER > 0
2231 			if (ic->ic_rawbpf != NULL)
2232 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2233 #endif
2234 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2235 			    != 0)
2236 				break;
2237 		} else {
2238 			if (ic->ic_state != IEEE80211_S_RUN)
2239 				break;
2240 			IFQ_POLL(&ifp->if_snd, m0);
2241 			if (m0 == NULL)
2242 				break;
2243 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2244 			    sc->sc_tx_normal_queued >=
2245 			    URTW_TX_DATA_LIST_COUNT) {
2246 			    	ifp->if_flags |= IFF_OACTIVE;
2247 				break;
2248 			}
2249 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2250 #if NBPFILTER > 0
2251 			if (ifp->if_bpf != NULL)
2252 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2253 #endif
2254 			m0 = ieee80211_encap(ifp, m0, &ni);
2255 			if (m0 == NULL)
2256 				continue;
2257 #if NBPFILTER > 0
2258 			if (ic->ic_rawbpf != NULL)
2259 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2260 #endif
2261 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2262 			    != 0) {
2263 				if (ni != NULL)
2264 					ieee80211_release_node(ic, ni);
2265 				ifp->if_oerrors++;
2266 				break;
2267 			}
2268 		}
2269 		sc->sc_txtimer = 5;
2270 	}
2271 }
2272 
2273 void
2274 urtw_watchdog(struct ifnet *ifp)
2275 {
2276 	struct urtw_softc *sc = ifp->if_softc;
2277 
2278 	ifp->if_timer = 0;
2279 
2280 	if (sc->sc_txtimer > 0) {
2281 		if (--sc->sc_txtimer == 0) {
2282 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2283 			ifp->if_oerrors++;
2284 			return;
2285 		}
2286 		ifp->if_timer = 1;
2287 	}
2288 
2289 	ieee80211_watchdog(ifp);
2290 }
2291 
2292 void
2293 urtw_txeof_low(usbd_xfer_handle xfer, usbd_private_handle priv,
2294     usbd_status status)
2295 {
2296 	struct urtw_data *data = priv;
2297 	struct urtw_softc *sc = data->sc;
2298 	struct ieee80211com *ic = &sc->sc_ic;
2299 	struct ifnet *ifp = &ic->ic_if;
2300 	int s;
2301 
2302 	if (status != USBD_NORMAL_COMPLETION) {
2303 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2304 			return;
2305 
2306 		printf("%s: could not transmit buffer: %s\n",
2307 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2308 
2309 		if (status == USBD_STALLED)
2310 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2311 
2312 		ifp->if_oerrors++;
2313 		return;
2314 	}
2315 
2316 	s = splnet();
2317 
2318 	ieee80211_release_node(ic, data->ni);
2319 	data->ni = NULL;
2320 
2321 	sc->sc_txtimer = 0;
2322 	ifp->if_opackets++;
2323 
2324 	sc->sc_tx_low_queued--;
2325 	ifp->if_flags &= ~IFF_OACTIVE;
2326 	urtw_start(ifp);
2327 
2328 	splx(s);
2329 }
2330 
2331 void
2332 urtw_txeof_normal(usbd_xfer_handle xfer, usbd_private_handle priv,
2333     usbd_status status)
2334 {
2335 	struct urtw_data *data = priv;
2336 	struct urtw_softc *sc = data->sc;
2337 	struct ieee80211com *ic = &sc->sc_ic;
2338 	struct ifnet *ifp = &ic->ic_if;
2339 	int s;
2340 
2341 	if (status != USBD_NORMAL_COMPLETION) {
2342 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2343 			return;
2344 
2345 		printf("%s: could not transmit buffer: %s\n",
2346 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2347 
2348 		if (status == USBD_STALLED)
2349 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2350 
2351 		ifp->if_oerrors++;
2352 		return;
2353 	}
2354 
2355 	s = splnet();
2356 
2357 	ieee80211_release_node(ic, data->ni);
2358 	data->ni = NULL;
2359 
2360 	sc->sc_txtimer = 0;
2361 	ifp->if_opackets++;
2362 
2363 	sc->sc_tx_normal_queued--;
2364 	ifp->if_flags &= ~IFF_OACTIVE;
2365 	urtw_start(ifp);
2366 
2367 	splx(s);
2368 }
2369 
2370 int
2371 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2372     int prior)
2373 {
2374 	struct ieee80211com *ic = &sc->sc_ic;
2375 	struct urtw_data *data;
2376 	struct ieee80211_frame *wh;
2377 	struct ieee80211_key *k;
2378 	usbd_status error;
2379 	int xferlen;
2380 
2381 	wh = mtod(m0, struct ieee80211_frame *);
2382 
2383 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2384 		k = ieee80211_get_txkey(ic, wh, ni);
2385 
2386 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2387 			return (ENOBUFS);
2388 
2389 		/* packet header may have moved, reset our local pointer */
2390 		wh = mtod(m0, struct ieee80211_frame *);
2391 	}
2392 
2393 #if NBPFILTER > 0
2394 	if (sc->sc_drvbpf != NULL) {
2395 		struct mbuf mb;
2396 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2397 
2398 		tap->wt_flags = 0;
2399 		tap->wt_rate = 0;
2400 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2401 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2402 
2403 		mb.m_data = (caddr_t)tap;
2404 		mb.m_len = sc->sc_txtap_len;
2405 		mb.m_next = m0;
2406 		mb.m_nextpkt = NULL;
2407 		mb.m_type = 0;
2408 		mb.m_flags = 0;
2409 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
2410 	}
2411 #endif
2412 
2413 	xferlen = m0->m_pkthdr.len + 4 * 3;
2414 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2415 		xferlen += 1;
2416 
2417 	data = &sc->sc_txdata[sc->sc_txidx];
2418 	sc->sc_txidx = (sc->sc_txidx + 1) % URTW_TX_DATA_LIST_COUNT;
2419 
2420 	bzero(data->buf, URTW_TX_MAXSIZE);
2421 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2422 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2423 	data->buf[1] |= (1 << 7);
2424 
2425 	/* XXX sc_preamble_mode is always 2.  */
2426 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2427 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2428 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2429 		data->buf[2] |= 1;
2430 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2431 	    prior == URTW_PRIORITY_LOW)
2432 		panic("TODO tx.");
2433 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2434 		data->buf[2] |= (1 << 1);
2435 	/* RTS rate - 10 means we use a basic rate.  */
2436 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2437 	/*
2438 	 * XXX currently TX rate control depends on the rate value of
2439 	 * RX descriptor because I don't know how to we can control TX rate
2440 	 * in more smart way.  Please fix me you find a thing.
2441 	 */
2442 	data->buf[3] = sc->sc_currate;
2443 	if (prior == URTW_PRIORITY_NORMAL) {
2444 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2445 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2446 		else if (ic->ic_fixed_rate != -1)
2447 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2448 	}
2449 	data->buf[8] = 3;		/* CW minimum  */
2450 	data->buf[8] |= (7 << 4);	/* CW maximum  */
2451 	data->buf[9] |= 11;		/* retry limitation  */
2452 
2453 	m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2454 	data->ni = ni;
2455 	data->m = m0;
2456 
2457 	usbd_setup_xfer(data->xfer,
2458 	    (prior == URTW_PRIORITY_LOW) ? sc->sc_txpipe_low :
2459 	    sc->sc_txpipe_normal, data, data->buf, xferlen,
2460 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, URTW_DATA_TIMEOUT,
2461 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2462 	error = usbd_transfer(data->xfer);
2463 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2464 		printf("%s: could not send frame: %s\n",
2465 		    sc->sc_dev.dv_xname, usbd_errstr(error));
2466 		return (EIO);
2467 	}
2468 
2469 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2470 	if (error != 0)
2471 		printf("%s: could not control LED (%d)\n",
2472 		    sc->sc_dev.dv_xname, error);
2473 
2474 	if (prior == URTW_PRIORITY_LOW)
2475 		sc->sc_tx_low_queued++;
2476 	else
2477 		sc->sc_tx_normal_queued++;
2478 
2479 	return (0);
2480 }
2481 
2482 usbd_status
2483 urtw_8225_usb_init(struct urtw_softc *sc)
2484 {
2485 	uint8_t data;
2486 	usbd_status error;
2487 
2488 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2489 	urtw_write8_m(sc, URTW_GPIO, 0);
2490 	error = urtw_read8e(sc, 0x53, &data);
2491 	if (error)
2492 		goto fail;
2493 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2494 	if (error)
2495 		goto fail;
2496 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2497 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2498 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2499 
2500 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2501 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2502 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2503 
2504 	usbd_delay_ms(sc->sc_udev, 500);
2505 fail:
2506 	return (error);
2507 }
2508 
2509 usbd_status
2510 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2511 {
2512 	usbd_status error = 0;
2513 
2514 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2515 fail:
2516 	return (error);
2517 }
2518 
2519 usbd_status
2520 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2521 {
2522 	uint32_t phyw;
2523 	usbd_status error;
2524 
2525 	phyw = ((data << 8) | (addr | 0x80));
2526 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2527 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2528 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2529 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2530 	usbd_delay_ms(sc->sc_udev, 1);
2531 fail:
2532 	return (error);
2533 }
2534 
2535 usbd_status
2536 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2537 {
2538 
2539 	data = data & 0xff;
2540 	return (urtw_8187_write_phy(sc, addr, data));
2541 }
2542 
2543 usbd_status
2544 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2545 {
2546 
2547 	data = data & 0xff;
2548 	return (urtw_8187_write_phy(sc, addr, data | 0x10000));
2549 }
2550 
2551 usbd_status
2552 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2553 {
2554 	usbd_status error;
2555 
2556 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2557 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2558 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2559 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2560 fail:
2561 	return (error);
2562 }
2563 
2564 usbd_status
2565 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2566 {
2567 	int i, idx, set;
2568 	uint8_t *cck_pwltable;
2569 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2570 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2571 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2572 	usbd_status error;
2573 
2574 	cck_pwrlvl_max = 11;
2575 	ofdm_pwrlvl_max = 25;	/* 12 -> 25  */
2576 	ofdm_pwrlvl_min = 10;
2577 
2578 	/* CCK power setting */
2579 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2580 	idx = cck_pwrlvl % 6;
2581 	set = cck_pwrlvl / 6;
2582 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2583 	    urtw_8225_txpwr_cck;
2584 
2585 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2586 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2587 	for (i = 0; i < 8; i++) {
2588 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2589 		    cck_pwltable[idx * 8 + i]);
2590 	}
2591 	usbd_delay_ms(sc->sc_udev, 1);
2592 
2593 	/* OFDM power setting */
2594 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2595 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2596 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2597 
2598 	idx = ofdm_pwrlvl % 6;
2599 	set = ofdm_pwrlvl / 6;
2600 
2601 	error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
2602 	if (error)
2603 		goto fail;
2604 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2605 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2606 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2607 
2608 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2609 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2610 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2611 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2612 	usbd_delay_ms(sc->sc_udev, 1);
2613 fail:
2614 	return (error);
2615 }
2616 
2617 usbd_status
2618 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2619 {
2620 	usbd_status error;
2621 
2622 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2623 	usbd_delay_ms(sc->sc_udev, 1);
2624 fail:
2625 	return (error);
2626 }
2627 
2628 usbd_status
2629 urtw_8225_rf_init(struct urtw_softc *sc)
2630 {
2631 	int i;
2632 	uint16_t data;
2633 	usbd_status error;
2634 
2635 	error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2636 	if (error)
2637 		goto fail;
2638 
2639 	error = urtw_8225_usb_init(sc);
2640 	if (error)
2641 		goto fail;
2642 
2643 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2644 	urtw_read16_m(sc, URTW_BRSR, &data);		/* XXX ??? */
2645 	urtw_write16_m(sc, URTW_BRSR, 0xffff);
2646 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2647 
2648 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2649 	if (error)
2650 		goto fail;
2651 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2652 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2653 	if (error)
2654 		goto fail;
2655 
2656 	error = urtw_8185_rf_pins_enable(sc);
2657 	if (error)
2658 		goto fail;
2659 	usbd_delay_ms(sc->sc_udev, 500);
2660 
2661 	for (i = 0; i < nitems(urtw_8225_rf_part1); i++) {
2662 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2663 		    urtw_8225_rf_part1[i].val);
2664 	}
2665 	usbd_delay_ms(sc->sc_udev, 50);
2666 	urtw_8225_write(sc, 0x2, 0xc4d);
2667 	usbd_delay_ms(sc->sc_udev, 200);
2668 	urtw_8225_write(sc, 0x2, 0x44d);
2669 	usbd_delay_ms(sc->sc_udev, 200);
2670 	urtw_8225_write(sc, 0x0, 0x127);
2671 
2672 	for (i = 0; i < 95; i++) {
2673 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2674 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2675 	}
2676 
2677 	urtw_8225_write(sc, 0x0, 0x27);
2678 	urtw_8225_write(sc, 0x0, 0x22f);
2679 
2680 	for (i = 0; i < 128; i++) {
2681 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2682 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2683 	}
2684 
2685 	for (i = 0; i < nitems(urtw_8225_rf_part2); i++) {
2686 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2687 		    urtw_8225_rf_part2[i].val);
2688 		usbd_delay_ms(sc->sc_udev, 1);
2689 	}
2690 
2691 	error = urtw_8225_setgain(sc, 4);
2692 	if (error)
2693 		goto fail;
2694 
2695 	for (i = 0; i < nitems(urtw_8225_rf_part3); i++) {
2696 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2697 		    urtw_8225_rf_part3[i].val);
2698 		usbd_delay_ms(sc->sc_udev, 1);
2699 	}
2700 
2701 	urtw_write8_m(sc, 0x5b, 0x0d);
2702 
2703 	error = urtw_8225_set_txpwrlvl(sc, 1);
2704 	if (error)
2705 		goto fail;
2706 
2707 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2708 	usbd_delay_ms(sc->sc_udev, 1);
2709 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2710 	usbd_delay_ms(sc->sc_udev, 1);
2711 
2712 	/* TX ant A, 0x0 for B */
2713 	error = urtw_8185_tx_antenna(sc, 0x3);
2714 	if (error)
2715 		goto fail;
2716 	urtw_write32_m(sc, 0x94, 0x3dc00002);
2717 
2718 	error = urtw_8225_rf_set_chan(sc, 1);
2719 fail:
2720 	return (error);
2721 }
2722 
2723 usbd_status
2724 urtw_8225_rf_set_chan(struct urtw_softc *sc, int chan)
2725 {
2726 	struct ieee80211com *ic = &sc->sc_ic;
2727 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2728 	usbd_status error;
2729 
2730 	error = urtw_8225_set_txpwrlvl(sc, chan);
2731 	if (error)
2732 		goto fail;
2733 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
2734 	usbd_delay_ms(sc->sc_udev, 10);
2735 
2736 	urtw_write8_m(sc, URTW_SIFS, 0x22);
2737 
2738 	if (sc->sc_state == IEEE80211_S_ASSOC &&
2739 	    ic->ic_flags & IEEE80211_F_SHSLOT)
2740 		urtw_write8_m(sc, URTW_SLOT, 0x9);
2741 	else
2742 		urtw_write8_m(sc, URTW_SLOT, 0x14);
2743 
2744 	if (IEEE80211_IS_CHAN_G(c)) {
2745 		urtw_write8_m(sc, URTW_DIFS, 0x14);
2746 		urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x14);
2747 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
2748 	} else {
2749 		urtw_write8_m(sc, URTW_DIFS, 0x24);
2750 		urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x24);
2751 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
2752 	}
2753 
2754 fail:
2755 	return (error);
2756 }
2757 
2758 usbd_status
2759 urtw_8225_rf_set_sens(struct urtw_softc *sc, int sens)
2760 {
2761 	usbd_status error;
2762 
2763 	if (sens < 0 || sens > 6)
2764 		return -1;
2765 
2766 	if (sens > 4)
2767 		urtw_8225_write(sc, 0x0c, 0x850);
2768 	else
2769 		urtw_8225_write(sc, 0x0c, 0x50);
2770 
2771 	sens = 6 - sens;
2772 	error = urtw_8225_setgain(sc, sens);
2773 	if (error)
2774 		goto fail;
2775 
2776 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[sens]);
2777 
2778 fail:
2779 	return (error);
2780 }
2781 
2782 void
2783 urtw_stop(struct ifnet *ifp, int disable)
2784 {
2785 	struct urtw_softc *sc = ifp->if_softc;
2786 
2787 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2788 
2789 	timeout_del(&sc->scan_to);
2790 	timeout_del(&sc->sc_led_ch);
2791 
2792 	if (sc->sc_rxpipe != NULL)
2793 		usbd_abort_pipe(sc->sc_rxpipe);
2794 	if (sc->sc_txpipe_low != NULL)
2795 		usbd_abort_pipe(sc->sc_txpipe_low);
2796 	if (sc->sc_txpipe_normal != NULL)
2797 		usbd_abort_pipe(sc->sc_txpipe_normal);
2798 }
2799 
2800 int
2801 urtw_isbmode(uint16_t rate)
2802 {
2803 
2804 	rate = urtw_rtl2rate(rate);
2805 
2806 	return ((rate <= 22 && rate != 12 && rate != 18) ||
2807 	    rate == 44) ? (1) : (0);
2808 }
2809 
2810 void
2811 urtw_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
2812 {
2813 	struct urtw_data *data = priv;
2814 	struct urtw_softc *sc = data->sc;
2815 	struct ieee80211com *ic = &sc->sc_ic;
2816 	struct ifnet *ifp = &ic->ic_if;
2817 	struct ieee80211_frame *wh;
2818 	struct ieee80211_node *ni;
2819 	struct ieee80211_rxinfo rxi;
2820 	struct mbuf *m, *mnew;
2821 	uint8_t *desc, quality, rate;
2822 	int actlen, flen, len, nf, rssi, s;
2823 
2824 	if (status != USBD_NORMAL_COMPLETION) {
2825 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2826 			return;
2827 
2828 		if (status == USBD_STALLED)
2829 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
2830 		ifp->if_ierrors++;
2831 		goto skip;
2832 	}
2833 
2834 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
2835 	if (actlen < URTW_MIN_RXBUFSZ) {
2836 		ifp->if_ierrors++;
2837 		goto skip;
2838 	}
2839 
2840 	/* 4 dword and 4 byte CRC  */
2841 	len = actlen - (4 * 4);
2842 	desc = data->buf + len;
2843 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
2844 	if (flen > actlen) {
2845 		ifp->if_ierrors++;
2846 		goto skip;
2847 	}
2848 
2849 	rate = (desc[2] & 0xf0) >> 4;
2850 	quality = desc[4] & 0xff;
2851 	/* XXX correct?  */
2852 	rssi = (desc[6] & 0xfe) >> 1;
2853 	if (!urtw_isbmode(rate)) {
2854 		rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
2855 		rssi = ((90 - rssi) * 100) / 65;
2856 	} else {
2857 		rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
2858 		rssi = ((95 - rssi) * 100) / 65;
2859 	}
2860 
2861 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
2862 	if (mnew == NULL) {
2863 		printf("%s: could not allocate rx mbuf\n",
2864 		    sc->sc_dev.dv_xname);
2865 		ifp->if_ierrors++;
2866 		goto skip;
2867 	}
2868 	MCLGET(mnew, M_DONTWAIT);
2869 	if (!(mnew->m_flags & M_EXT)) {
2870 		printf("%s: could not allocate rx mbuf cluster\n",
2871 		    sc->sc_dev.dv_xname);
2872 		m_freem(mnew);
2873 		ifp->if_ierrors++;
2874 		goto skip;
2875 	}
2876 
2877 	m = data->m;
2878 	data->m = mnew;
2879 	data->buf = mtod(mnew, uint8_t *);
2880 
2881 	/* finalize mbuf */
2882 	m->m_pkthdr.rcvif = ifp;
2883 	m->m_pkthdr.len = m->m_len = flen - 4;
2884 
2885 	s = splnet();
2886 
2887 #if NBPFILTER > 0
2888 	if (sc->sc_drvbpf != NULL) {
2889 		struct mbuf mb;
2890 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
2891 
2892 		/* XXX Are variables correct?  */
2893 		tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2894 		tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2895 		tap->wr_dbm_antsignal = (int8_t)rssi;
2896 
2897 		mb.m_data = (caddr_t)tap;
2898 		mb.m_len = sc->sc_rxtap_len;
2899 		mb.m_next = m;
2900 		mb.m_nextpkt = NULL;
2901 		mb.m_type = 0;
2902 		mb.m_flags = 0;
2903 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
2904 	}
2905 #endif
2906 	wh = mtod(m, struct ieee80211_frame *);
2907 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
2908 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
2909 	ni = ieee80211_find_rxnode(ic, wh);
2910 
2911 	/* XXX correct?  */
2912 	nf = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
2913 
2914 	/* send the frame to the 802.11 layer */
2915 	rxi.rxi_flags = 0;
2916 	rxi.rxi_rssi = rssi;
2917 	rxi.rxi_tstamp = 0;
2918 	ieee80211_input(ifp, m, ni, &rxi);
2919 
2920 	/* node is no longer needed */
2921 	ieee80211_release_node(ic, ni);
2922 
2923 	splx(s);
2924 
2925 skip:	/* setup a new transfer */
2926 	usbd_setup_xfer(xfer, sc->sc_rxpipe, data, data->buf, MCLBYTES,
2927 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
2928 	(void)usbd_transfer(xfer);
2929 }
2930 
2931 usbd_status
2932 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
2933 {
2934 	uint8_t *gainp;
2935 	usbd_status error;
2936 
2937 	/* XXX for A?  */
2938 	gainp = urtw_8225v2_gain_bg;
2939 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
2940 	usbd_delay_ms(sc->sc_udev, 1);
2941 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
2942 	usbd_delay_ms(sc->sc_udev, 1);
2943 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
2944 	usbd_delay_ms(sc->sc_udev, 1);
2945 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
2946 	usbd_delay_ms(sc->sc_udev, 1);
2947 fail:
2948 	return (error);
2949 }
2950 
2951 usbd_status
2952 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
2953 {
2954 	int i;
2955 	uint8_t *cck_pwrtable;
2956 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
2957 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2958 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2959 	usbd_status error;
2960 
2961 	/* CCK power setting */
2962 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2963 	cck_pwrlvl += sc->sc_txpwr_cck_base;
2964 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
2965 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
2966 	    urtw_8225v2_txpwr_cck;
2967 
2968 	for (i = 0; i < 8; i++) {
2969 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
2970 	}
2971 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2972 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
2973 	usbd_delay_ms(sc->sc_udev, 1);
2974 
2975 	/* OFDM power setting */
2976 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2977 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2978 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
2979 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2980 
2981 	error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
2982 	if (error)
2983 		goto fail;
2984 
2985 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2986 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
2987 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
2988 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
2989 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
2990 
2991 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2992 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
2993 	usbd_delay_ms(sc->sc_udev, 1);
2994 fail:
2995 	return (error);
2996 }
2997 
2998 usbd_status
2999 urtw_8225v2_rf_init(struct urtw_softc *sc)
3000 {
3001 	int i;
3002 	uint16_t data;
3003 	uint32_t data32;
3004 	usbd_status error;
3005 
3006 	error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3007 	if (error)
3008 		goto fail;
3009 
3010 	error = urtw_8225_usb_init(sc);
3011 	if (error)
3012 		goto fail;
3013 
3014 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3015 	urtw_read16_m(sc, URTW_BRSR, &data);		/* XXX ??? */
3016 	urtw_write16_m(sc, URTW_BRSR, 0xffff);
3017 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3018 
3019 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3020 	if (error)
3021 		goto fail;
3022 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3023 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3024 	if (error)
3025 		goto fail;
3026 
3027 	error = urtw_8185_rf_pins_enable(sc);
3028 	if (error)
3029 		goto fail;
3030 
3031 	usbd_delay_ms(sc->sc_udev, 1000);
3032 
3033 	for (i = 0; i < nitems(urtw_8225v2_rf_part1); i++) {
3034 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3035 		    urtw_8225v2_rf_part1[i].val);
3036 		usbd_delay_ms(sc->sc_udev, 1);
3037 	}
3038 	usbd_delay_ms(sc->sc_udev, 50);
3039 
3040 	urtw_8225_write(sc, 0x0, 0x1b7);
3041 
3042 	for (i = 0; i < 95; i++) {
3043 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3044 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3045 	}
3046 
3047 	urtw_8225_write(sc, 0x3, 0x2);
3048 	urtw_8225_write(sc, 0x5, 0x4);
3049 	urtw_8225_write(sc, 0x0, 0xb7);
3050 	urtw_8225_write(sc, 0x2, 0xc4d);
3051 	usbd_delay_ms(sc->sc_udev, 100);
3052 	urtw_8225_write(sc, 0x2, 0x44d);
3053 	usbd_delay_ms(sc->sc_udev, 100);
3054 
3055 	error = urtw_8225_read(sc, 0x6, &data32);
3056 	if (error != 0)
3057 		goto fail;
3058 	if (data32 != 0xe6)
3059 		printf("%s: expect 0xe6!! (0x%x)\n", sc->sc_dev.dv_xname,
3060 		    data32);
3061 	if (!(data32 & 0x80)) {
3062 		urtw_8225_write(sc, 0x02, 0x0c4d);
3063 		usbd_delay_ms(sc->sc_udev, 200);
3064 		urtw_8225_write(sc, 0x02, 0x044d);
3065 		usbd_delay_ms(sc->sc_udev, 100);
3066 		error = urtw_8225_read(sc, 0x6, &data32);
3067 		if (error != 0)
3068 			goto fail;
3069 		if (!(data32 & 0x80))
3070 			printf("%s: RF calibration failed\n",
3071 			    sc->sc_dev.dv_xname);
3072 	}
3073 	usbd_delay_ms(sc->sc_udev, 100);
3074 
3075 	urtw_8225_write(sc, 0x0, 0x2bf);
3076 	for (i = 0; i < 128; i++) {
3077 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3078 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3079 	}
3080 
3081 	for (i = 0; i < nitems(urtw_8225v2_rf_part2); i++) {
3082 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3083 		    urtw_8225v2_rf_part2[i].val);
3084 	}
3085 
3086 	error = urtw_8225v2_setgain(sc, 4);
3087 	if (error)
3088 		goto fail;
3089 
3090 	for (i = 0; i < nitems(urtw_8225v2_rf_part3); i++) {
3091 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3092 		    urtw_8225v2_rf_part3[i].val);
3093 	}
3094 
3095 	urtw_write8_m(sc, 0x5b, 0x0d);
3096 
3097 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3098 	if (error)
3099 		goto fail;
3100 
3101 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3102 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3103 
3104 	/* TX ant A, 0x0 for B */
3105 	error = urtw_8185_tx_antenna(sc, 0x3);
3106 	if (error)
3107 		goto fail;
3108 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3109 
3110 	error = urtw_8225_rf_set_chan(sc, 1);
3111 fail:
3112 	return (error);
3113 }
3114 
3115 usbd_status
3116 urtw_8225v2_rf_set_chan(struct urtw_softc *sc, int chan)
3117 {
3118 	struct ieee80211com *ic = &sc->sc_ic;
3119 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3120 	usbd_status error;
3121 
3122 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3123 	if (error)
3124 		goto fail;
3125 
3126 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3127 	usbd_delay_ms(sc->sc_udev, 10);
3128 
3129 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3130 
3131 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3132 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3133 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3134 	else
3135 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3136 
3137 	if (IEEE80211_IS_CHAN_G(c)) {
3138 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3139 		urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x14);
3140 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3141 	} else {
3142 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3143 		urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x24);
3144 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3145 	}
3146 
3147 fail:
3148 	return (error);
3149 }
3150 
3151 void
3152 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3153 {
3154 	struct ieee80211com *ic = &sc->sc_ic;
3155 	usbd_status error = 0;
3156 	uint32_t data;
3157 	u_int chan;
3158 
3159 	chan = ieee80211_chan2ieee(ic, c);
3160 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3161 		return;
3162 	/*
3163 	 * during changing th channel we need to temporarily be disable
3164 	 * TX.
3165 	 */
3166 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3167 	data &= ~URTW_TX_LOOPBACK_MASK;
3168 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3169 	error = sc->sc_rf_set_chan(sc, chan);
3170 	if (error != 0) {
3171 		printf("%s could not change the channel\n",
3172 		    sc->sc_dev.dv_xname);
3173 		return;
3174 	}
3175 	usbd_delay_ms(sc->sc_udev, 10);
3176 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3177 
3178 fail:	return;
3179 
3180 }
3181 
3182 void
3183 urtw_next_scan(void *arg)
3184 {
3185 	struct urtw_softc *sc = arg;
3186 	struct ieee80211com *ic = &sc->sc_ic;
3187 	struct ifnet *ifp = &ic->ic_if;
3188 
3189 	if (ic->ic_state == IEEE80211_S_SCAN)
3190 		ieee80211_next_scan(ifp);
3191 }
3192 
3193 void
3194 urtw_task(void *arg)
3195 {
3196 	struct urtw_softc *sc = arg;
3197 	struct ieee80211com *ic = &sc->sc_ic;
3198 	struct ieee80211_node *ni;
3199 	enum ieee80211_state ostate;
3200 	usbd_status error = 0;
3201 
3202 	ostate = ic->ic_state;
3203 
3204 	switch (sc->sc_state) {
3205 	case IEEE80211_S_INIT:
3206 		if (ostate == IEEE80211_S_RUN) {
3207 			/* turn link LED off */
3208 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3209 		}
3210 		break;
3211 
3212 	case IEEE80211_S_SCAN:
3213 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3214 		timeout_add(&sc->scan_to, hz / 5);
3215 		break;
3216 
3217 	case IEEE80211_S_AUTH:
3218 	case IEEE80211_S_ASSOC:
3219 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3220 		break;
3221 
3222 	case IEEE80211_S_RUN:
3223 		ni = ic->ic_bss;
3224 
3225 		/* setting bssid.  */
3226 		urtw_write32_m(sc, URTW_BSSID, ((uint32_t *)ni->ni_bssid)[0]);
3227 		urtw_write16_m(sc, URTW_BSSID + 4,
3228 		    ((uint16_t *)ni->ni_bssid)[2]);
3229 		urtw_update_msr(sc);
3230 		/* XXX maybe the below would be incorrect.  */
3231 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3232 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3233 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3234 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
3235 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3236 		if (error != 0)
3237 			printf("%s: could not control LED (%d)\n",
3238 			    sc->sc_dev.dv_xname, error);
3239 		break;
3240 	}
3241 
3242 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3243 
3244 fail:
3245 	if (error != 0)
3246 		DPRINTF(("%s: error duing processing RUN state.",
3247   		    sc->sc_dev.dv_xname));
3248 }
3249