xref: /openbsd/sys/dev/usb/if_urtw.c (revision 898184e3)
1 /*	$OpenBSD: if_urtw.c,v 1.39 2011/07/03 15:47:17 matthew Exp $	*/
2 
3 /*-
4  * Copyright (c) 2009 Martynas Venckus <martynas@openbsd.org>
5  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 #include "bpfilter.h"
21 
22 #include <sys/param.h>
23 #include <sys/sockio.h>
24 #include <sys/proc.h>
25 #include <sys/mbuf.h>
26 #include <sys/kernel.h>
27 #include <sys/socket.h>
28 #include <sys/systm.h>
29 #include <sys/malloc.h>
30 #include <sys/timeout.h>
31 #include <sys/conf.h>
32 #include <sys/device.h>
33 
34 #include <machine/bus.h>
35 #include <machine/endian.h>
36 #if NBPFILTER > 0
37 #include <net/bpf.h>
38 #endif
39 #include <net/if.h>
40 #include <net/if_arp.h>
41 #include <net/if_dl.h>
42 #include <net/if_media.h>
43 #include <net/if_types.h>
44 
45 #include <netinet/in.h>
46 #include <netinet/in_systm.h>
47 #include <netinet/in_var.h>
48 #include <netinet/if_ether.h>
49 #include <netinet/ip.h>
50 
51 #include <net80211/ieee80211_var.h>
52 #include <net80211/ieee80211_radiotap.h>
53 
54 #include <dev/usb/usb.h>
55 #include <dev/usb/usbdi.h>
56 #include <dev/usb/usbdi_util.h>
57 #include <dev/usb/usbdevs.h>
58 
59 #include <dev/usb/if_urtwreg.h>
60 
61 #ifdef USB_DEBUG
62 #define	URTW_DEBUG
63 #endif
64 
65 #ifdef URTW_DEBUG
66 #define	DPRINTF(x)	do { if (urtw_debug) printf x; } while (0)
67 #define	DPRINTFN(n, x)	do { if (urtw_debug >= (n)) printf x; } while (0)
68 int urtw_debug = 0;
69 #else
70 #define	DPRINTF(x)
71 #define	DPRINTFN(n, x)
72 #endif
73 
74 /*
75  * Recognized device vendors/products.
76  */
77 static const struct urtw_type {
78 	struct usb_devno	dev;
79 	uint8_t			rev;
80 } urtw_devs[] = {
81 #define	URTW_DEV_RTL8187(v, p)	\
82 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187 }
83 #define	URTW_DEV_RTL8187B(v, p)	\
84 	    { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, URTW_HWREV_8187B }
85 	/* Realtek RTL8187 devices. */
86 	URTW_DEV_RTL8187(ASUS,		P5B_WIFI),
87 	URTW_DEV_RTL8187(DICKSMITH,	RTL8187),
88 	URTW_DEV_RTL8187(LINKSYS4,	WUSB54GCV2),
89 	URTW_DEV_RTL8187(LOGITEC,	RTL8187),
90 	URTW_DEV_RTL8187(NETGEAR,	WG111V2),
91 	URTW_DEV_RTL8187(REALTEK,	RTL8187),
92 	URTW_DEV_RTL8187(SITECOMEU,	WL168V1),
93 	URTW_DEV_RTL8187(SPHAIRON,	RTL8187),
94 	URTW_DEV_RTL8187(SURECOM,	EP9001G2A),
95 	/* Realtek RTL8187B devices. */
96 	URTW_DEV_RTL8187B(BELKIN,	F5D7050E),
97 	URTW_DEV_RTL8187B(NETGEAR,	WG111V3),
98 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_0),
99 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_1),
100 	URTW_DEV_RTL8187B(REALTEK,	RTL8187B_2),
101 	URTW_DEV_RTL8187B(SITECOMEU,	WL168V4)
102 #undef	URTW_DEV_RTL8187
103 #undef	URTW_DEV_RTL8187B
104 };
105 #define	urtw_lookup(v, p)	\
106 	    ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
107 
108 /*
109  * Helper read/write macros.
110  */
111 #define urtw_read8_m(sc, val, data)	do {			\
112 	error = urtw_read8_c(sc, val, data, 0);			\
113 	if (error != 0)						\
114 		goto fail;					\
115 } while (0)
116 #define urtw_read8_idx_m(sc, val, data, idx)	do {		\
117 	error = urtw_read8_c(sc, val, data, idx);		\
118 	if (error != 0)						\
119 		goto fail;					\
120 } while (0)
121 #define urtw_write8_m(sc, val, data)	do {			\
122 	error = urtw_write8_c(sc, val, data, 0);		\
123 	if (error != 0)						\
124 		goto fail;					\
125 } while (0)
126 #define urtw_write8_idx_m(sc, val, data, idx)	do {		\
127 	error = urtw_write8_c(sc, val, data, idx);		\
128 	if (error != 0)						\
129 		goto fail;					\
130 } while (0)
131 #define urtw_read16_m(sc, val, data)	do {			\
132 	error = urtw_read16_c(sc, val, data, 0);		\
133 	if (error != 0)						\
134 		goto fail;					\
135 } while (0)
136 #define urtw_read16_idx_m(sc, val, data, idx)	do {		\
137 	error = urtw_read16_c(sc, val, data, idx);		\
138 	if (error != 0)						\
139 		goto fail;					\
140 } while (0)
141 #define urtw_write16_m(sc, val, data)	do {			\
142 	error = urtw_write16_c(sc, val, data, 0);		\
143 	if (error != 0)						\
144 		goto fail;					\
145 } while (0)
146 #define urtw_write16_idx_m(sc, val, data, idx)	do {		\
147 	error = urtw_write16_c(sc, val, data, idx);		\
148 	if (error != 0)						\
149 		goto fail;					\
150 } while (0)
151 #define urtw_read32_m(sc, val, data)	do {			\
152 	error = urtw_read32_c(sc, val, data, 0);		\
153 	if (error != 0)						\
154 		goto fail;					\
155 } while (0)
156 #define urtw_read32_idx_m(sc, val, data, idx)	do {		\
157 	error = urtw_read32_c(sc, val, data, idx);		\
158 	if (error != 0)						\
159 		goto fail;					\
160 } while (0)
161 #define urtw_write32_m(sc, val, data)	do {			\
162 	error = urtw_write32_c(sc, val, data, 0);		\
163 	if (error != 0)						\
164 		goto fail;					\
165 } while (0)
166 #define urtw_write32_idx_m(sc, val, data, idx)	do {		\
167 	error = urtw_write32_c(sc, val, data, idx);		\
168 	if (error != 0)						\
169 		goto fail;					\
170 } while (0)
171 #define urtw_8187_write_phy_ofdm(sc, val, data)	do {		\
172 	error = urtw_8187_write_phy_ofdm_c(sc, val, data);	\
173 	if (error != 0)						\
174 		goto fail;					\
175 } while (0)
176 #define urtw_8187_write_phy_cck(sc, val, data)	do {		\
177 	error = urtw_8187_write_phy_cck_c(sc, val, data);	\
178 	if (error != 0)						\
179 		goto fail;					\
180 } while (0)
181 #define urtw_8225_write(sc, val, data)	do {			\
182 	error = urtw_8225_write_c(sc, val, data);		\
183 	if (error != 0)						\
184 		goto fail;					\
185 } while (0)
186 
187 struct urtw_pair {
188 	uint32_t	reg;
189 	uint32_t	val;
190 };
191 
192 struct urtw_pair_idx {
193 	uint8_t		reg;
194 	uint8_t		val;
195 	uint8_t		idx;
196 };
197 
198 static struct urtw_pair_idx urtw_8187b_regtbl[] = {
199 	{ 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
200 	{ 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
201 	{ 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
202 	{ 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
203 	{ 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
204 	{ 0xff, 0x00, 0 },
205 
206 	{ 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 }, { 0x5a, 0x4b, 1 },
207 	{ 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 }, { 0x61, 0x09, 1 },
208 	{ 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 }, { 0xce, 0x0f, 1 },
209 	{ 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 }, { 0xe1, 0x0f, 1 },
210 	{ 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 }, { 0xf1, 0x01, 1 },
211 	{ 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 }, { 0xf4, 0x04, 1 },
212 	{ 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 }, { 0xf7, 0x07, 1 },
213 	{ 0xf8, 0x08, 1 },
214 
215 	{ 0x4e, 0x00, 2 }, { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 },
216 	{ 0x22, 0x68, 2 }, { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 },
217 	{ 0x25, 0x7d, 2 }, { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 },
218 	{ 0x4d, 0x08, 2 }, { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 },
219 	{ 0x52, 0x04, 2 }, { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 },
220 	{ 0x55, 0x23, 2 }, { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 },
221 	{ 0x58, 0x08, 2 }, { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 },
222 	{ 0x5b, 0x08, 2 }, { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 },
223 	{ 0x62, 0x08, 2 }, { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 },
224 	{ 0x72, 0x56, 2 }, { 0x73, 0x9a, 2 },
225 
226 	{ 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 }, { 0x5b, 0x40, 0 },
227 	{ 0x84, 0x88, 0 }, { 0x85, 0x24, 0 }, { 0x88, 0x54, 0 },
228 	{ 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 }, { 0x8d, 0x00, 0 },
229 	{ 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 }, { 0x96, 0x00, 0 },
230 	{ 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 }, { 0x9f, 0x10, 0 },
231 	{ 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 }, { 0xdb, 0x00, 0 },
232 	{ 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
233 
234 	{ 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
235 	{ 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
236 };
237 
238 static uint8_t urtw_8225_agc[] = {
239 	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
240 	0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
241 	0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
242 	0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
243 	0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
244 	0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
245 	0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
246 	0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
247 	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
248 	0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
249 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
250 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
251 };
252 
253 static uint32_t urtw_8225_channel[] = {
254 	0x0000,		/* dummy channel 0 */
255 	0x085c,		/* 1 */
256 	0x08dc,		/* 2 */
257 	0x095c,		/* 3 */
258 	0x09dc,		/* 4 */
259 	0x0a5c,		/* 5 */
260 	0x0adc,		/* 6 */
261 	0x0b5c,		/* 7 */
262 	0x0bdc,		/* 8 */
263 	0x0c5c,		/* 9 */
264 	0x0cdc,		/* 10 */
265 	0x0d5c,		/* 11 */
266 	0x0ddc,		/* 12 */
267 	0x0e5c,		/* 13 */
268 	0x0f72,		/* 14 */
269 };
270 
271 static uint8_t urtw_8225_gain[] = {
272 	0x23, 0x88, 0x7c, 0xa5,		/* -82dbm */
273 	0x23, 0x88, 0x7c, 0xb5,		/* -82dbm */
274 	0x23, 0x88, 0x7c, 0xc5,		/* -82dbm */
275 	0x33, 0x80, 0x79, 0xc5,		/* -78dbm */
276 	0x43, 0x78, 0x76, 0xc5,		/* -74dbm */
277 	0x53, 0x60, 0x73, 0xc5,		/* -70dbm */
278 	0x63, 0x58, 0x70, 0xc5,		/* -66dbm */
279 };
280 
281 static struct urtw_pair urtw_8225_rf_part1[] = {
282 	{ 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
283 	{ 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
284 	{ 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
285 	{ 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 }
286 };
287 
288 static struct urtw_pair urtw_8225_rf_part2[] = {
289 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
290 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
291 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
292 	{ 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
293 	{ 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
294 	{ 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
295 	{ 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
296 	{ 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
297 	{ 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
298 	{ 0x27, 0x88 }
299 };
300 
301 static struct urtw_pair urtw_8225_rf_part3[] = {
302 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
303 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
304 	{ 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
305 	{ 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
306 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
307 	{ 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
308 	{ 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
309 };
310 
311 static uint16_t urtw_8225_rxgain[] = {
312 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
313 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
314 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
315 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
316 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
317 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
318 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
319 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
320 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
321 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
322 	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
323 	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
324 };
325 
326 static uint8_t urtw_8225_threshold[] = {
327 	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
328 };
329 
330 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
331 	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
332 };
333 
334 static uint8_t urtw_8225_txpwr_cck[] = {
335 	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
336 	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
337 	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
338 	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
339 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
340 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
341 };
342 
343 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
344 	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
345 	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
346 	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
347 	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
348 	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
349 	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
350 };
351 
352 static uint8_t urtw_8225_txpwr_ofdm[] = {
353 	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
354 };
355 
356 static uint8_t urtw_8225v2_agc[] = {
357 	0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57,
358 	0x55, 0x53, 0x51, 0x4f, 0x4d, 0x4b, 0x49, 0x47,
359 	0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b, 0x39, 0x37,
360 	0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27,
361 	0x25, 0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17,
362 	0x15, 0x13, 0x11, 0x0f, 0x0d, 0x0b, 0x09, 0x07,
363 	0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
364 	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
365 	0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19,
366 	0x19, 0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26,
367 	0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
368 	0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d,
369 	0x2d, 0x2d, 0x2d, 0x2e, 0x2e, 0x2e, 0x2e, 0x2f,
370 	0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31, 0x31, 0x31,
371 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
372 	0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
373 };
374 
375 static uint8_t urtw_8225v2_ofdm[] = {
376 	0x10, 0x0d, 0x01, 0x00, 0x14, 0xfb, 0xfb, 0x60,
377 	0x00, 0x60, 0x00, 0x00, 0x00, 0x5c, 0x00, 0x00,
378 	0x40, 0x00, 0x40, 0x00, 0x00, 0x00, 0xa8, 0x26,
379 	0x32, 0x33, 0x07, 0xa5, 0x6f, 0x55, 0xc8, 0xb3,
380 	0x0a, 0xe1, 0x2c, 0x8a, 0x86, 0x83, 0x34, 0x0f,
381 	0x4f, 0x24, 0x6f, 0xc2, 0x6b, 0x40, 0x80, 0x00,
382 	0xc0, 0xc1, 0x58, 0xf1, 0x00, 0xe4, 0x90, 0x3e,
383 	0x6d, 0x3c, 0xfb, 0x07
384 };
385 
386 static uint8_t urtw_8225v2_gain_bg[] = {
387 	0x23, 0x15, 0xa5,		/* -82-1dbm */
388 	0x23, 0x15, 0xb5,		/* -82-2dbm */
389 	0x23, 0x15, 0xc5,		/* -82-3dbm */
390 	0x33, 0x15, 0xc5,		/* -78dbm */
391 	0x43, 0x15, 0xc5,		/* -74dbm */
392 	0x53, 0x15, 0xc5,		/* -70dbm */
393 	0x63, 0x15, 0xc5,		/* -66dbm */
394 };
395 
396 static struct urtw_pair urtw_8225v2_rf_part1[] = {
397 	{ 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
398 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
399 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
400 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
401 };
402 
403 static struct urtw_pair urtw_8225v2_rf_part2[] = {
404 	{ 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
405 	{ 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
406 	{ 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
407 	{ 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
408 	{ 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
409 	{ 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
410 	{ 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
411 	{ 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
412 	{ 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
413 	{ 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
414 };
415 
416 static struct urtw_pair urtw_8225v2_rf_part3[] = {
417 	{ 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
418 	{ 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
419 	{ 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
420 	{ 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
421 	{ 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
422 	{ 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
423 	{ 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
424 	{ 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
425 };
426 
427 static uint16_t urtw_8225v2_rxgain[] = {
428 	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
429 	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
430 	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
431 	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
432 	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
433 	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
434 	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
435 	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
436 	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
437 	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
438 	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
439 	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
440 };
441 
442 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
443 	0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
444 	0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
445 	0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
446 	0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
447 	0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
448 	0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23
449 };
450 
451 static uint8_t urtw_8225v2_txpwr_cck[] = {
452 	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
453 	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
454 	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
455 	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
456 };
457 
458 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
459 	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
460 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
461 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
462 	0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
463 };
464 
465 static struct urtw_pair urtw_8225v2_b_rf[] = {
466 	{ 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
467 	{ 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
468 	{ 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
469 	{ 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 },
470 	{ 0x00, 0x01b7 }
471 };
472 
473 static struct urtw_pair urtw_ratetable[] = {
474 	{  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
475 	{ 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
476 	{ 96, 10 }, { 108, 11 }
477 };
478 
479 int		urtw_init(struct ifnet *);
480 void		urtw_stop(struct ifnet *, int);
481 int		urtw_ioctl(struct ifnet *, u_long, caddr_t);
482 void		urtw_start(struct ifnet *);
483 int		urtw_alloc_rx_data_list(struct urtw_softc *);
484 void		urtw_free_rx_data_list(struct urtw_softc *);
485 int		urtw_alloc_tx_data_list(struct urtw_softc *);
486 void		urtw_free_tx_data_list(struct urtw_softc *);
487 void		urtw_rxeof(usbd_xfer_handle, usbd_private_handle,
488 		    usbd_status);
489 int		urtw_tx_start(struct urtw_softc *,
490 		    struct ieee80211_node *, struct mbuf *, int);
491 void		urtw_txeof_low(usbd_xfer_handle, usbd_private_handle,
492 		    usbd_status);
493 void		urtw_txeof_normal(usbd_xfer_handle, usbd_private_handle,
494 		    usbd_status);
495 void		urtw_next_scan(void *);
496 void		urtw_task(void *);
497 void		urtw_ledusbtask(void *);
498 void		urtw_ledtask(void *);
499 int		urtw_media_change(struct ifnet *);
500 int		urtw_newstate(struct ieee80211com *, enum ieee80211_state, int);
501 void		urtw_watchdog(struct ifnet *);
502 void		urtw_set_multi(struct urtw_softc *);
503 void		urtw_set_chan(struct urtw_softc *, struct ieee80211_channel *);
504 int		urtw_isbmode(uint16_t);
505 uint16_t	urtw_rate2rtl(int rate);
506 uint16_t	urtw_rtl2rate(int);
507 usbd_status	urtw_set_rate(struct urtw_softc *);
508 usbd_status	urtw_update_msr(struct urtw_softc *);
509 usbd_status	urtw_read8_c(struct urtw_softc *, int, uint8_t *, uint8_t);
510 usbd_status	urtw_read16_c(struct urtw_softc *, int, uint16_t *, uint8_t);
511 usbd_status	urtw_read32_c(struct urtw_softc *, int, uint32_t *, uint8_t);
512 usbd_status	urtw_write8_c(struct urtw_softc *, int, uint8_t, uint8_t);
513 usbd_status	urtw_write16_c(struct urtw_softc *, int, uint16_t, uint8_t);
514 usbd_status	urtw_write32_c(struct urtw_softc *, int, uint32_t, uint8_t);
515 usbd_status	urtw_eprom_cs(struct urtw_softc *, int);
516 usbd_status	urtw_eprom_ck(struct urtw_softc *);
517 usbd_status	urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
518 		    int);
519 usbd_status	urtw_eprom_read32(struct urtw_softc *, uint32_t,
520 		    uint32_t *);
521 usbd_status	urtw_eprom_readbit(struct urtw_softc *, int16_t *);
522 usbd_status	urtw_eprom_writebit(struct urtw_softc *, int16_t);
523 usbd_status	urtw_get_macaddr(struct urtw_softc *);
524 usbd_status	urtw_get_txpwr(struct urtw_softc *);
525 usbd_status	urtw_get_rfchip(struct urtw_softc *);
526 usbd_status	urtw_led_init(struct urtw_softc *);
527 usbd_status	urtw_8185_rf_pins_enable(struct urtw_softc *);
528 usbd_status	urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
529 usbd_status	urtw_8187_write_phy(struct urtw_softc *, uint8_t, uint32_t);
530 usbd_status	urtw_8187_write_phy_ofdm_c(struct urtw_softc *, uint8_t,
531 		    uint32_t);
532 usbd_status	urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
533 		    uint32_t);
534 usbd_status	urtw_8225_setgain(struct urtw_softc *, int16_t);
535 usbd_status	urtw_8225_usb_init(struct urtw_softc *);
536 usbd_status	urtw_8225_write_c(struct urtw_softc *, uint8_t, uint16_t);
537 usbd_status	urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
538 		    uint16_t);
539 usbd_status	urtw_8225_read(struct urtw_softc *, uint8_t, uint32_t *);
540 usbd_status	urtw_8225_rf_init(struct urtw_rf *);
541 usbd_status	urtw_8225_rf_set_chan(struct urtw_rf *, int);
542 usbd_status	urtw_8225_rf_set_sens(struct urtw_rf *);
543 usbd_status	urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
544 usbd_status	urtw_8225v2_rf_init(struct urtw_rf *);
545 usbd_status	urtw_8225v2_rf_set_chan(struct urtw_rf *, int);
546 usbd_status	urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
547 usbd_status	urtw_8225v2_setgain(struct urtw_softc *, int16_t);
548 usbd_status	urtw_8225_isv2(struct urtw_softc *, int *);
549 usbd_status	urtw_read8e(struct urtw_softc *, int, uint8_t *);
550 usbd_status	urtw_write8e(struct urtw_softc *, int, uint8_t);
551 usbd_status	urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
552 usbd_status	urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
553 usbd_status	urtw_open_pipes(struct urtw_softc *);
554 usbd_status	urtw_close_pipes(struct urtw_softc *);
555 usbd_status	urtw_intr_enable(struct urtw_softc *);
556 usbd_status	urtw_intr_disable(struct urtw_softc *);
557 usbd_status	urtw_reset(struct urtw_softc *);
558 usbd_status	urtw_led_on(struct urtw_softc *, int);
559 usbd_status	urtw_led_ctl(struct urtw_softc *, int);
560 usbd_status	urtw_led_blink(struct urtw_softc *);
561 usbd_status	urtw_led_mode0(struct urtw_softc *, int);
562 usbd_status	urtw_led_mode1(struct urtw_softc *, int);
563 usbd_status	urtw_led_mode2(struct urtw_softc *, int);
564 usbd_status	urtw_led_mode3(struct urtw_softc *, int);
565 usbd_status	urtw_rx_setconf(struct urtw_softc *);
566 usbd_status	urtw_rx_enable(struct urtw_softc *);
567 usbd_status	urtw_tx_enable(struct urtw_softc *);
568 usbd_status	urtw_8187b_update_wmm(struct urtw_softc *);
569 usbd_status	urtw_8187b_reset(struct urtw_softc *);
570 int		urtw_8187b_init(struct ifnet *);
571 usbd_status	urtw_8225v2_b_config_mac(struct urtw_softc *);
572 usbd_status	urtw_8225v2_b_init_rfe(struct urtw_softc *);
573 usbd_status	urtw_8225v2_b_update_chan(struct urtw_softc *);
574 usbd_status	urtw_8225v2_b_rf_init(struct urtw_rf *);
575 usbd_status	urtw_8225v2_b_rf_set_chan(struct urtw_rf *, int);
576 usbd_status	urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *, int);
577 int		urtw_set_bssid(struct urtw_softc *, const uint8_t *);
578 int		urtw_set_macaddr(struct urtw_softc *, const uint8_t *);
579 
580 int urtw_match(struct device *, void *, void *);
581 void urtw_attach(struct device *, struct device *, void *);
582 int urtw_detach(struct device *, int);
583 int urtw_activate(struct device *, int);
584 
585 struct cfdriver urtw_cd = {
586 	NULL, "urtw", DV_IFNET
587 };
588 
589 const struct cfattach urtw_ca = {
590 	sizeof(struct urtw_softc),
591 	urtw_match,
592 	urtw_attach,
593 	urtw_detach,
594 	urtw_activate,
595 };
596 
597 int
598 urtw_match(struct device *parent, void *match, void *aux)
599 {
600 	struct usb_attach_arg *uaa = aux;
601 
602 	if (uaa->iface != NULL)
603 		return (UMATCH_NONE);
604 
605 	return ((urtw_lookup(uaa->vendor, uaa->product) != NULL) ?
606 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE);
607 }
608 
609 void
610 urtw_attach(struct device *parent, struct device *self, void *aux)
611 {
612 	struct urtw_softc *sc = (struct urtw_softc *)self;
613 	struct usb_attach_arg *uaa = aux;
614 	struct ieee80211com *ic = &sc->sc_ic;
615 	struct ifnet *ifp = &ic->ic_if;
616 	usbd_status error;
617 	uint8_t data8;
618 	uint32_t data;
619 	int i;
620 
621 	sc->sc_udev = uaa->device;
622 	sc->sc_hwrev = urtw_lookup(uaa->vendor, uaa->product)->rev;
623 
624 	printf("%s: ", sc->sc_dev.dv_xname);
625 
626 	if (sc->sc_hwrev & URTW_HWREV_8187) {
627 		urtw_read32_m(sc, URTW_TX_CONF, &data);
628 		data &= URTW_TX_HWREV_MASK;
629 		switch (data) {
630 		case URTW_TX_HWREV_8187_D:
631 			sc->sc_hwrev |= URTW_HWREV_8187_D;
632 			printf("RTL8187 rev D");
633 			break;
634 		case URTW_TX_HWREV_8187B_D:
635 			/*
636 			 * Detect Realtek RTL8187B devices that use
637 			 * USB IDs of RTL8187.
638 			 */
639 			sc->sc_hwrev = URTW_HWREV_8187B | URTW_HWREV_8187B_B;
640 			printf("RTL8187B rev B (early)");
641 			break;
642 		default:
643 			sc->sc_hwrev |= URTW_HWREV_8187_B;
644 			printf("RTL8187 rev 0x%02x", data >> 25);
645 			break;
646 		}
647 	} else {
648 		/* RTL8187B hwrev register. */
649 		urtw_read8_m(sc, URTW_8187B_HWREV, &data8);
650 		switch (data8) {
651 		case URTW_8187B_HWREV_8187B_B:
652 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
653 			printf("RTL8187B rev B");
654 			break;
655 		case URTW_8187B_HWREV_8187B_D:
656 			sc->sc_hwrev |= URTW_HWREV_8187B_D;
657 			printf("RTL8187B rev D");
658 			break;
659 		case URTW_8187B_HWREV_8187B_E:
660 			sc->sc_hwrev |= URTW_HWREV_8187B_E;
661 			printf("RTL8187B rev E");
662 			break;
663 		default:
664 			sc->sc_hwrev |= URTW_HWREV_8187B_B;
665 			printf("RTL8187B rev 0x%02x", data8);
666 			break;
667 		}
668 	}
669 
670 	urtw_read32_m(sc, URTW_RX, &data);
671 	sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
672 	    URTW_EEPROM_93C46;
673 
674 	error = urtw_get_rfchip(sc);
675 	if (error != 0)
676 		goto fail;
677 	error = urtw_get_macaddr(sc);
678 	if (error != 0)
679 		goto fail;
680 	error = urtw_get_txpwr(sc);
681 	if (error != 0)
682 		goto fail;
683 	error = urtw_led_init(sc);		/* XXX incompleted */
684 	if (error != 0)
685 		goto fail;
686 
687 	sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
688 	sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
689 	sc->sc_currate = 3;
690 	/* XXX for what? */
691 	sc->sc_preamble_mode = 2;
692 
693 	usb_init_task(&sc->sc_task, urtw_task, sc, USB_TASK_TYPE_GENERIC);
694 	usb_init_task(&sc->sc_ledtask, urtw_ledusbtask, sc,
695 	    USB_TASK_TYPE_GENERIC);
696 	timeout_set(&sc->scan_to, urtw_next_scan, sc);
697 	timeout_set(&sc->sc_led_ch, urtw_ledtask, sc);
698 
699 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
700 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
701 	ic->ic_state = IEEE80211_S_INIT;
702 
703 	/* set device capabilities */
704 	ic->ic_caps =
705 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
706 	    IEEE80211_C_TXPMGT |	/* tx power management */
707 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
708 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
709 	    IEEE80211_C_WEP |		/* s/w WEP */
710 	    IEEE80211_C_RSN;		/* WPA/RSN */
711 
712 	/* set supported .11b and .11g rates */
713 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
714 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
715 
716 	/* set supported .11b and .11g channels (1 through 14) */
717 	for (i = 1; i <= 14; i++) {
718 		ic->ic_channels[i].ic_freq =
719 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
720 		ic->ic_channels[i].ic_flags =
721 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
722 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
723 	}
724 
725 	ifp->if_softc = sc;
726 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
727 	if (sc->sc_hwrev & URTW_HWREV_8187) {
728 		sc->sc_init = urtw_init;
729 	} else {
730 		sc->sc_init = urtw_8187b_init;
731 	}
732 	ifp->if_ioctl = urtw_ioctl;
733 	ifp->if_start = urtw_start;
734 	ifp->if_watchdog = urtw_watchdog;
735 	IFQ_SET_READY(&ifp->if_snd);
736 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
737 
738 	if_attach(ifp);
739 	ieee80211_ifattach(ifp);
740 
741 	/* override state transition machine */
742 	sc->sc_newstate = ic->ic_newstate;
743 	ic->ic_newstate = urtw_newstate;
744 	ieee80211_media_init(ifp, urtw_media_change, ieee80211_media_status);
745 
746 #if NBPFILTER > 0
747 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
748 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN);
749 
750 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
751 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
752 	sc->sc_rxtap.wr_ihdr.it_present = htole32(URTW_RX_RADIOTAP_PRESENT);
753 
754 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
755 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
756 	sc->sc_txtap.wt_ihdr.it_present = htole32(URTW_TX_RADIOTAP_PRESENT);
757 #endif
758 
759 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
760 
761 	return;
762 fail:
763 	printf(": %s failed!\n", __func__);
764 }
765 
766 int
767 urtw_detach(struct device *self, int flags)
768 {
769 	struct urtw_softc *sc = (struct urtw_softc *)self;
770 	struct ifnet *ifp = &sc->sc_ic.ic_if;
771 	int s;
772 
773 	s = splusb();
774 
775 	if (timeout_initialized(&sc->scan_to))
776 		timeout_del(&sc->scan_to);
777 	if (timeout_initialized(&sc->sc_led_ch))
778 		timeout_del(&sc->sc_led_ch);
779 
780 	usb_rem_wait_task(sc->sc_udev, &sc->sc_task);
781 	usb_rem_wait_task(sc->sc_udev, &sc->sc_ledtask);
782 
783 	usbd_ref_wait(sc->sc_udev);
784 
785 	if (ifp->if_softc != NULL) {
786 		ieee80211_ifdetach(ifp);	/* free all nodes */
787 		if_detach(ifp);
788 	}
789 
790 	/* abort and free xfers */
791 	urtw_free_tx_data_list(sc);
792 	urtw_free_rx_data_list(sc);
793 	urtw_close_pipes(sc);
794 
795 	splx(s);
796 
797 	return (0);
798 }
799 
800 int
801 urtw_activate(struct device *self, int act)
802 {
803 	struct urtw_softc *sc = (struct urtw_softc *)self;
804 
805 	switch (act) {
806 	case DVACT_DEACTIVATE:
807 		usbd_deactivate(sc->sc_udev);
808 		break;
809 	}
810 
811 	return (0);
812 }
813 
814 usbd_status
815 urtw_close_pipes(struct urtw_softc *sc)
816 {
817 	usbd_status error = 0;
818 
819 	if (sc->sc_rxpipe != NULL) {
820 		error = usbd_close_pipe(sc->sc_rxpipe);
821 		if (error != 0)
822 			goto fail;
823 		sc->sc_rxpipe = NULL;
824 	}
825 	if (sc->sc_txpipe_low != NULL) {
826 		error = usbd_close_pipe(sc->sc_txpipe_low);
827 		if (error != 0)
828 			goto fail;
829 		sc->sc_txpipe_low = NULL;
830 	}
831 	if (sc->sc_txpipe_normal != NULL) {
832 		error = usbd_close_pipe(sc->sc_txpipe_normal);
833 		if (error != 0)
834 			goto fail;
835 		sc->sc_txpipe_normal = NULL;
836 	}
837 fail:
838 	return (error);
839 }
840 
841 usbd_status
842 urtw_open_pipes(struct urtw_softc *sc)
843 {
844 	usbd_status error;
845 
846 	/*
847 	 * NB: there is no way to distinguish each pipes so we need to hardcode
848 	 * pipe numbers
849 	 */
850 
851 	/* tx pipe - low priority packets */
852 	if (sc->sc_hwrev & URTW_HWREV_8187)
853 		error = usbd_open_pipe(sc->sc_iface, 0x2,
854 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
855 	else
856 		error = usbd_open_pipe(sc->sc_iface, 0x6,
857 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_low);
858 	if (error != 0) {
859 		printf("%s: could not open Tx low pipe: %s\n",
860 		    sc->sc_dev.dv_xname, usbd_errstr(error));
861 		goto fail;
862 	}
863 	/* tx pipe - normal priority packets */
864 	if (sc->sc_hwrev & URTW_HWREV_8187)
865 		error = usbd_open_pipe(sc->sc_iface, 0x3,
866 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
867 	else
868 		error = usbd_open_pipe(sc->sc_iface, 0x7,
869 		    USBD_EXCLUSIVE_USE, &sc->sc_txpipe_normal);
870 	if (error != 0) {
871 		printf("%s: could not open Tx normal pipe: %s\n",
872 		    sc->sc_dev.dv_xname, usbd_errstr(error));
873 		goto fail;
874 	}
875 	/* rx pipe */
876 	if (sc->sc_hwrev & URTW_HWREV_8187)
877 		error = usbd_open_pipe(sc->sc_iface, 0x81,
878 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
879 	else
880 		error = usbd_open_pipe(sc->sc_iface, 0x83,
881 		    USBD_EXCLUSIVE_USE, &sc->sc_rxpipe);
882 	if (error != 0) {
883 		printf("%s: could not open Rx pipe: %s\n",
884 		    sc->sc_dev.dv_xname, usbd_errstr(error));
885 		goto fail;
886 	}
887 
888 	return (0);
889 fail:
890 	(void)urtw_close_pipes(sc);
891 	return (error);
892 }
893 
894 int
895 urtw_alloc_rx_data_list(struct urtw_softc *sc)
896 {
897 	int i, error;
898 
899 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
900 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
901 
902 		data->sc = sc;
903 
904 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
905 		if (data->xfer == NULL) {
906 			printf("%s: could not allocate rx xfer\n",
907 			    sc->sc_dev.dv_xname);
908 			error = ENOMEM;
909 			goto fail;
910 		}
911 
912 		if (usbd_alloc_buffer(data->xfer, URTW_RX_MAXSIZE) == NULL) {
913 			printf("%s: could not allocate rx buffer\n",
914 			    sc->sc_dev.dv_xname);
915 			error = ENOMEM;
916 			goto fail;
917 		}
918 
919 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
920 		if (data->m == NULL) {
921 			printf("%s: could not allocate rx mbuf\n",
922 			    sc->sc_dev.dv_xname);
923 			error = ENOMEM;
924 			goto fail;
925 		}
926 		MCLGET(data->m, M_DONTWAIT);
927 		if (!(data->m->m_flags & M_EXT)) {
928 			printf("%s: could not allocate rx mbuf cluster\n",
929 			    sc->sc_dev.dv_xname);
930 			error = ENOMEM;
931 			goto fail;
932 		}
933 		data->buf = mtod(data->m, uint8_t *);
934 	}
935 
936 	return (0);
937 
938 fail:
939 	urtw_free_rx_data_list(sc);
940 	return (error);
941 }
942 
943 void
944 urtw_free_rx_data_list(struct urtw_softc *sc)
945 {
946 	int i;
947 
948 	/* Make sure no transfers are pending. */
949 	if (sc->sc_rxpipe != NULL)
950 		usbd_abort_pipe(sc->sc_rxpipe);
951 
952 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
953 		struct urtw_rx_data *data = &sc->sc_rx_data[i];
954 
955 		if (data->xfer != NULL) {
956 			usbd_free_xfer(data->xfer);
957 			data->xfer = NULL;
958 		}
959 		if (data->m != NULL) {
960 			m_freem(data->m);
961 			data->m = NULL;
962 		}
963 	}
964 }
965 
966 int
967 urtw_alloc_tx_data_list(struct urtw_softc *sc)
968 {
969 	int i, error;
970 
971 	for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
972 		struct urtw_tx_data *data = &sc->sc_tx_data[i];
973 
974 		data->sc = sc;
975 		data->ni = NULL;
976 
977 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
978 		if (data->xfer == NULL) {
979 			printf("%s: could not allocate tx xfer\n",
980 			    sc->sc_dev.dv_xname);
981 			error = ENOMEM;
982 			goto fail;
983 		}
984 
985 		data->buf = usbd_alloc_buffer(data->xfer, URTW_TX_MAXSIZE);
986 		if (data->buf == NULL) {
987 			printf("%s: could not allocate tx buffer\n",
988 			    sc->sc_dev.dv_xname);
989 			error = ENOMEM;
990 			goto fail;
991 		}
992 
993 		if (((unsigned long)data->buf) % 4)
994 			printf("%s: warn: unaligned buffer %p\n",
995 			    sc->sc_dev.dv_xname, data->buf);
996 	}
997 
998 	return (0);
999 
1000 fail:
1001 	urtw_free_tx_data_list(sc);
1002 	return (error);
1003 }
1004 
1005 void
1006 urtw_free_tx_data_list(struct urtw_softc *sc)
1007 {
1008 	struct ieee80211com *ic = &sc->sc_ic;
1009 	int i;
1010 
1011 	/* Make sure no transfers are pending. */
1012 	if (sc->sc_txpipe_low != NULL)
1013 		usbd_abort_pipe(sc->sc_txpipe_low);
1014 	if (sc->sc_txpipe_normal != NULL)
1015 		usbd_abort_pipe(sc->sc_txpipe_normal);
1016 
1017 	for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++) {
1018 		struct urtw_tx_data *data = &sc->sc_tx_data[i];
1019 
1020 		if (data->xfer != NULL) {
1021 			usbd_free_xfer(data->xfer);
1022 			data->xfer = NULL;
1023 		}
1024 		if (data->ni != NULL) {
1025 			ieee80211_release_node(ic, data->ni);
1026 			data->ni = NULL;
1027 		}
1028 	}
1029 }
1030 
1031 int
1032 urtw_media_change(struct ifnet *ifp)
1033 {
1034 	struct urtw_softc *sc = ifp->if_softc;
1035 	int error;
1036 
1037 	error = ieee80211_media_change(ifp);
1038 	if (error != ENETRESET)
1039 		return (error);
1040 
1041 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1042 	    (IFF_UP | IFF_RUNNING))
1043 		sc->sc_init(ifp);
1044 
1045 	return (0);
1046 }
1047 
1048 int
1049 urtw_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1050 {
1051 	struct urtw_softc *sc = ic->ic_if.if_softc;
1052 
1053 	usb_rem_task(sc->sc_udev, &sc->sc_task);
1054 	timeout_del(&sc->scan_to);
1055 
1056 	/* do it in a process context */
1057 	sc->sc_state = nstate;
1058 	sc->sc_arg = arg;
1059 	usb_add_task(sc->sc_udev, &sc->sc_task);
1060 
1061 	return (0);
1062 }
1063 
1064 usbd_status
1065 urtw_led_init(struct urtw_softc *sc)
1066 {
1067 	uint32_t rev;
1068 	usbd_status error;
1069 
1070 	urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
1071 	error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
1072 	if (error != 0)
1073 		goto fail;
1074 
1075 	switch (rev & URTW_EPROM_CID_MASK) {
1076 	case URTW_EPROM_CID_ALPHA0:
1077 		sc->sc_strategy = URTW_SW_LED_MODE1;
1078 		break;
1079 	case URTW_EPROM_CID_SERCOMM_PS:
1080 		sc->sc_strategy = URTW_SW_LED_MODE3;
1081 		break;
1082 	case URTW_EPROM_CID_HW_LED:
1083 		sc->sc_strategy = URTW_HW_LED;
1084 		break;
1085 	case URTW_EPROM_CID_RSVD0:
1086 	case URTW_EPROM_CID_RSVD1:
1087 	default:
1088 		sc->sc_strategy = URTW_SW_LED_MODE0;
1089 		break;
1090 	}
1091 
1092 	sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
1093 
1094 fail:
1095 	return (error);
1096 }
1097 
1098 usbd_status
1099 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
1100     uint16_t data)
1101 {
1102 	usb_device_request_t req;
1103 
1104 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1105 	req.bRequest = URTW_8187_SETREGS_REQ;
1106 	USETW(req.wValue, addr);
1107 	USETW(req.wIndex, index);
1108 	USETW(req.wLength, sizeof(uint16_t));
1109 
1110 	return (usbd_do_request(sc->sc_udev, &req, &data));
1111 }
1112 
1113 usbd_status
1114 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
1115 {
1116 	int i;
1117 	int16_t bit;
1118 	uint8_t rlen = 12, wlen = 6;
1119 	uint16_t o1, o2, o3, tmp;
1120 	uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
1121 	uint32_t mask = 0x80000000, value = 0;
1122 	usbd_status error;
1123 
1124 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
1125 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
1126 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
1127 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | 0xf);
1128 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | 0xf);
1129 	o1 &= ~0xf;
1130 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
1131 	DELAY(5);
1132 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
1133 	DELAY(5);
1134 
1135 	for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
1136 		bit = ((d2w & mask) != 0) ? 1 : 0;
1137 
1138 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1139 		DELAY(2);
1140 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1141 		    URTW_BB_HOST_BANG_CLK);
1142 		DELAY(2);
1143 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1144 		    URTW_BB_HOST_BANG_CLK);
1145 		DELAY(2);
1146 		mask = mask >> 1;
1147 		if (i == 2)
1148 			break;
1149 		bit = ((d2w & mask) != 0) ? 1 : 0;
1150 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1151 		    URTW_BB_HOST_BANG_CLK);
1152 		DELAY(2);
1153 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
1154 		    URTW_BB_HOST_BANG_CLK);
1155 		DELAY(2);
1156 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
1157 		DELAY(1);
1158 	}
1159 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
1160 	    URTW_BB_HOST_BANG_CLK);
1161 	DELAY(2);
1162 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
1163 	DELAY(2);
1164 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
1165 	DELAY(2);
1166 
1167 	mask = 0x800;
1168 	for (i = 0; i < rlen; i++, mask = mask >> 1) {
1169 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1170 		    o1 | URTW_BB_HOST_BANG_RW);
1171 		DELAY(2);
1172 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1173 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1174 		DELAY(2);
1175 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1176 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1177 		DELAY(2);
1178 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1179 		    o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
1180 		DELAY(2);
1181 
1182 		urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
1183 		value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
1184 		urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
1185 		    o1 | URTW_BB_HOST_BANG_RW);
1186 		DELAY(2);
1187 	}
1188 
1189 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
1190 	    URTW_BB_HOST_BANG_RW);
1191 	DELAY(2);
1192 
1193 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
1194 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
1195 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x3a0);
1196 
1197 	if (data != NULL)
1198 		*data = value;
1199 fail:
1200 	return (error);
1201 }
1202 
1203 usbd_status
1204 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
1205 {
1206 	uint16_t d80, d82, d84;
1207 	usbd_status error;
1208 
1209 	urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
1210 	d80 &= 0xfff3;
1211 	urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
1212 	urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
1213 	d84 &= 0xfff0;
1214 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | 0x0007);
1215 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | 0x0007);
1216 	DELAY(10);
1217 
1218 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1219 	DELAY(2);
1220 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
1221 	DELAY(10);
1222 
1223 	error = urtw_8225_write_s16(sc, addr, 0x8225, data);
1224 	if (error != 0)
1225 		goto fail;
1226 
1227 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1228 	DELAY(10);
1229 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
1230 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
1231 	usbd_delay_ms(sc->sc_udev, 2);
1232 fail:
1233 	return (error);
1234 }
1235 
1236 usbd_status
1237 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
1238 {
1239 	uint32_t data;
1240 	usbd_status error;
1241 
1242 	*ret = 1;
1243 
1244 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0080);
1245 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x0080);
1246 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x0080);
1247 	usbd_delay_ms(sc->sc_udev, 500);
1248 
1249 	urtw_8225_write(sc, 0x0, 0x1b7);
1250 
1251 	error = urtw_8225_read(sc, 0x8, &data);
1252 	if (error != 0)
1253 		goto fail;
1254 	if (data != 0x588)
1255 		*ret = 0;
1256 	else {
1257 		error = urtw_8225_read(sc, 0x9, &data);
1258 		if (error != 0)
1259 			goto fail;
1260 		if (data != 0x700)
1261 			*ret = 0;
1262 	}
1263 
1264 	urtw_8225_write(sc, 0x0, 0xb7);
1265 fail:
1266 	return (error);
1267 }
1268 
1269 usbd_status
1270 urtw_get_rfchip(struct urtw_softc *sc)
1271 {
1272 	struct urtw_rf *rf = &sc->sc_rf;
1273 	int ret;
1274 	uint32_t data;
1275 	usbd_status error;
1276 
1277 	rf->rf_sc = sc;
1278 
1279 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1280 		error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
1281 		if (error != 0)
1282 			panic("unsupported RF chip");
1283 			/* NOTREACHED */
1284 		switch (data & 0xff) {
1285 		case URTW_EPROM_RFCHIPID_RTL8225U:
1286 			error = urtw_8225_isv2(sc, &ret);
1287 			if (error != 0)
1288 				goto fail;
1289 			if (ret == 0) {
1290 				rf->init = urtw_8225_rf_init;
1291 				rf->set_chan = urtw_8225_rf_set_chan;
1292 				rf->set_sens = urtw_8225_rf_set_sens;
1293 				printf(", RFv1");
1294 			} else {
1295 				rf->init = urtw_8225v2_rf_init;
1296 				rf->set_chan = urtw_8225v2_rf_set_chan;
1297 				rf->set_sens = NULL;
1298 				printf(", RFv2");
1299 			}
1300 			break;
1301 		default:
1302 			goto fail;
1303 		}
1304 	} else {
1305 		rf->init = urtw_8225v2_b_rf_init;
1306 		rf->set_chan = urtw_8225v2_b_rf_set_chan;
1307 		rf->set_sens = NULL;
1308 	}
1309 
1310 	rf->max_sens = URTW_8225_RF_MAX_SENS;
1311 	rf->sens = URTW_8225_RF_DEF_SENS;
1312 
1313 	return (0);
1314 
1315 fail:
1316 	panic("unsupported RF chip %d", data & 0xff);
1317 	/* NOTREACHED */
1318 }
1319 
1320 usbd_status
1321 urtw_get_txpwr(struct urtw_softc *sc)
1322 {
1323 	int i, j;
1324 	uint32_t data;
1325 	usbd_status error;
1326 
1327 	error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
1328 	if (error != 0)
1329 		goto fail;
1330 	sc->sc_txpwr_cck_base = data & 0xf;
1331 	sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
1332 
1333 	for (i = 1, j = 0; i < 6; i += 2, j++) {
1334 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
1335 		if (error != 0)
1336 			goto fail;
1337 		sc->sc_txpwr_cck[i] = data & 0xf;
1338 		sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
1339 		sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
1340 		sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
1341 	}
1342 	for (i = 1, j = 0; i < 4; i += 2, j++) {
1343 		error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
1344 		if (error != 0)
1345 			goto fail;
1346 		sc->sc_txpwr_cck[i + 6] = data & 0xf;
1347 		sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
1348 		sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
1349 		sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
1350 	}
1351 	if (sc->sc_hwrev & URTW_HWREV_8187) {
1352 		for (i = 1, j = 0; i < 4; i += 2, j++) {
1353 			error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
1354 			    &data);
1355 			if (error != 0)
1356 				goto fail;
1357 			sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
1358 			sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
1359 			sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
1360 			sc->sc_txpwr_ofdm[i + 6 + 4 + 1] =
1361 			    (data & 0xf000) >> 12;
1362 		}
1363 	} else {
1364 		/* Channel 11. */
1365 		error = urtw_eprom_read32(sc, 0x1b, &data);
1366 		if (error != 0)
1367 			goto fail;
1368 		sc->sc_txpwr_cck[11] = data & 0xf;
1369 		sc->sc_txpwr_ofdm[11] = (data & 0xf0) >> 4;
1370 
1371 		/* Channel 12. */
1372 		error = urtw_eprom_read32(sc, 0xa, &data);
1373 		if (error != 0)
1374 			goto fail;
1375 		sc->sc_txpwr_cck[12] = data & 0xf;
1376 		sc->sc_txpwr_ofdm[12] = (data & 0xf0) >> 4;
1377 
1378 		/* Channel 13, 14. */
1379 		error = urtw_eprom_read32(sc, 0x1c, &data);
1380 		if (error != 0)
1381 			goto fail;
1382 		sc->sc_txpwr_cck[13] = data & 0xf;
1383 		sc->sc_txpwr_ofdm[13] = (data & 0xf0) >> 4;
1384 		sc->sc_txpwr_cck[14] = (data & 0xf00) >> 8;
1385 		sc->sc_txpwr_ofdm[14] = (data & 0xf000) >> 12;
1386 	}
1387 fail:
1388 	return (error);
1389 }
1390 
1391 usbd_status
1392 urtw_get_macaddr(struct urtw_softc *sc)
1393 {
1394 	struct ieee80211com *ic = &sc->sc_ic;
1395 	usbd_status error;
1396 	uint32_t data;
1397 
1398 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
1399 	if (error != 0)
1400 		goto fail;
1401 	ic->ic_myaddr[0] = data & 0xff;
1402 	ic->ic_myaddr[1] = (data & 0xff00) >> 8;
1403 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
1404 	if (error != 0)
1405 		goto fail;
1406 	ic->ic_myaddr[2] = data & 0xff;
1407 	ic->ic_myaddr[3] = (data & 0xff00) >> 8;
1408 	error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
1409 	if (error != 0)
1410 		goto fail;
1411 	ic->ic_myaddr[4] = data & 0xff;
1412 	ic->ic_myaddr[5] = (data & 0xff00) >> 8;
1413 fail:
1414 	return (error);
1415 }
1416 
1417 usbd_status
1418 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
1419 {
1420 #define URTW_READCMD_LEN		3
1421 	int addrlen, i;
1422 	int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
1423 	usbd_status error;
1424 
1425 	/* NB: make sure the buffer is initialized */
1426 	*data = 0;
1427 
1428 	/* enable EPROM programming */
1429 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
1430 	DELAY(URTW_EPROM_DELAY);
1431 
1432 	error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
1433 	if (error != 0)
1434 		goto fail;
1435 	error = urtw_eprom_ck(sc);
1436 	if (error != 0)
1437 		goto fail;
1438 	error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
1439 	if (error != 0)
1440 		goto fail;
1441 	if (sc->sc_epromtype == URTW_EEPROM_93C56) {
1442 		addrlen = 8;
1443 		addrstr[0] = addr & (1 << 7);
1444 		addrstr[1] = addr & (1 << 6);
1445 		addrstr[2] = addr & (1 << 5);
1446 		addrstr[3] = addr & (1 << 4);
1447 		addrstr[4] = addr & (1 << 3);
1448 		addrstr[5] = addr & (1 << 2);
1449 		addrstr[6] = addr & (1 << 1);
1450 		addrstr[7] = addr & (1 << 0);
1451 	} else {
1452 		addrlen=6;
1453 		addrstr[0] = addr & (1 << 5);
1454 		addrstr[1] = addr & (1 << 4);
1455 		addrstr[2] = addr & (1 << 3);
1456 		addrstr[3] = addr & (1 << 2);
1457 		addrstr[4] = addr & (1 << 1);
1458 		addrstr[5] = addr & (1 << 0);
1459 	}
1460 	error = urtw_eprom_sendbits(sc, addrstr, addrlen);
1461 	if (error != 0)
1462 		goto fail;
1463 
1464 	error = urtw_eprom_writebit(sc, 0);
1465 	if (error != 0)
1466 		goto fail;
1467 
1468 	for (i = 0; i < 16; i++) {
1469 		error = urtw_eprom_ck(sc);
1470 		if (error != 0)
1471 			goto fail;
1472 		error = urtw_eprom_readbit(sc, &data16);
1473 		if (error != 0)
1474 			goto fail;
1475 
1476 		(*data) |= (data16 << (15 - i));
1477 	}
1478 
1479 	error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
1480 	if (error != 0)
1481 		goto fail;
1482 	error = urtw_eprom_ck(sc);
1483 	if (error != 0)
1484 		goto fail;
1485 
1486 	/* now disable EPROM programming */
1487 	urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
1488 fail:
1489 	return (error);
1490 #undef URTW_READCMD_LEN
1491 }
1492 
1493 usbd_status
1494 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
1495 {
1496 	uint8_t data8;
1497 	usbd_status error;
1498 
1499 	urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
1500 	*data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
1501 	DELAY(URTW_EPROM_DELAY);
1502 
1503 fail:
1504 	return (error);
1505 }
1506 
1507 usbd_status
1508 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
1509 {
1510 	int i = 0;
1511 	usbd_status error = 0;
1512 
1513 	for (i = 0; i < buflen; i++) {
1514 		error = urtw_eprom_writebit(sc, buf[i]);
1515 		if (error != 0)
1516 			goto fail;
1517 		error = urtw_eprom_ck(sc);
1518 		if (error != 0)
1519 			goto fail;
1520 	}
1521 fail:
1522 	return (error);
1523 }
1524 
1525 usbd_status
1526 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
1527 {
1528 	uint8_t data;
1529 	usbd_status error;
1530 
1531 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1532 	if (bit != 0)
1533 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
1534 	else
1535 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
1536 	DELAY(URTW_EPROM_DELAY);
1537 fail:
1538 	return (error);
1539 }
1540 
1541 usbd_status
1542 urtw_eprom_ck(struct urtw_softc *sc)
1543 {
1544 	uint8_t data;
1545 	usbd_status error;
1546 
1547 	/* masking */
1548 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1549 	urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
1550 	DELAY(URTW_EPROM_DELAY);
1551 	/* unmasking */
1552 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1553 	urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
1554 	DELAY(URTW_EPROM_DELAY);
1555 fail:
1556 	return (error);
1557 }
1558 
1559 usbd_status
1560 urtw_eprom_cs(struct urtw_softc *sc, int able)
1561 {
1562 	uint8_t data;
1563 	usbd_status error;
1564 
1565 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1566 	if (able == URTW_EPROM_ENABLE)
1567 		urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
1568 	else
1569 		urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
1570 	DELAY(URTW_EPROM_DELAY);
1571 fail:
1572 	return (error);
1573 }
1574 
1575 usbd_status
1576 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data, uint8_t idx)
1577 {
1578 	usb_device_request_t req;
1579 	usbd_status error;
1580 
1581 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1582 	req.bRequest = URTW_8187_GETREGS_REQ;
1583 	USETW(req.wValue, val | 0xff00);
1584 	USETW(req.wIndex, idx & 0x03);
1585 	USETW(req.wLength, sizeof(uint8_t));
1586 
1587 	error = usbd_do_request(sc->sc_udev, &req, data);
1588 	return (error);
1589 }
1590 
1591 usbd_status
1592 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
1593 {
1594 	usb_device_request_t req;
1595 	usbd_status error;
1596 
1597 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1598 	req.bRequest = URTW_8187_GETREGS_REQ;
1599 	USETW(req.wValue, val | 0xfe00);
1600 	USETW(req.wIndex, 0);
1601 	USETW(req.wLength, sizeof(uint8_t));
1602 
1603 	error = usbd_do_request(sc->sc_udev, &req, data);
1604 	return (error);
1605 }
1606 
1607 usbd_status
1608 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data, uint8_t idx)
1609 {
1610 	usb_device_request_t req;
1611 	usbd_status error;
1612 
1613 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1614 	req.bRequest = URTW_8187_GETREGS_REQ;
1615 	USETW(req.wValue, val | 0xff00);
1616 	USETW(req.wIndex, idx & 0x03);
1617 	USETW(req.wLength, sizeof(uint16_t));
1618 
1619 	error = usbd_do_request(sc->sc_udev, &req, data);
1620 	return (error);
1621 }
1622 
1623 usbd_status
1624 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data, uint8_t idx)
1625 {
1626 	usb_device_request_t req;
1627 	usbd_status error;
1628 
1629 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1630 	req.bRequest = URTW_8187_GETREGS_REQ;
1631 	USETW(req.wValue, val | 0xff00);
1632 	USETW(req.wIndex, idx & 0x03);
1633 	USETW(req.wLength, sizeof(uint32_t));
1634 
1635 	error = usbd_do_request(sc->sc_udev, &req, data);
1636 	return (error);
1637 }
1638 
1639 usbd_status
1640 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data, uint8_t idx)
1641 {
1642 	usb_device_request_t req;
1643 
1644 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1645 	req.bRequest = URTW_8187_SETREGS_REQ;
1646 	USETW(req.wValue, val | 0xff00);
1647 	USETW(req.wIndex, idx & 0x03);
1648 	USETW(req.wLength, sizeof(uint8_t));
1649 
1650 	return (usbd_do_request(sc->sc_udev, &req, &data));
1651 }
1652 
1653 usbd_status
1654 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
1655 {
1656 	usb_device_request_t req;
1657 
1658 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1659 	req.bRequest = URTW_8187_SETREGS_REQ;
1660 	USETW(req.wValue, val | 0xfe00);
1661 	USETW(req.wIndex, 0);
1662 	USETW(req.wLength, sizeof(uint8_t));
1663 
1664 	return (usbd_do_request(sc->sc_udev, &req, &data));
1665 }
1666 
1667 usbd_status
1668 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data, uint8_t idx)
1669 {
1670 	usb_device_request_t req;
1671 
1672 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1673 	req.bRequest = URTW_8187_SETREGS_REQ;
1674 	USETW(req.wValue, val | 0xff00);
1675 	USETW(req.wIndex, idx & 0x03);
1676 	USETW(req.wLength, sizeof(uint16_t));
1677 
1678 	return (usbd_do_request(sc->sc_udev, &req, &data));
1679 }
1680 
1681 usbd_status
1682 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data, uint8_t idx)
1683 {
1684 	usb_device_request_t req;
1685 
1686 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1687 	req.bRequest = URTW_8187_SETREGS_REQ;
1688 	USETW(req.wValue, val | 0xff00);
1689 	USETW(req.wIndex, idx & 0x03);
1690 	USETW(req.wLength, sizeof(uint32_t));
1691 
1692 	return (usbd_do_request(sc->sc_udev, &req, &data));
1693 }
1694 
1695 static usbd_status
1696 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1697 {
1698 	uint8_t data;
1699 	usbd_status error;
1700 
1701 	urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1702 	data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1703 	data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1704 	urtw_write8_m(sc, URTW_EPROM_CMD, data);
1705 fail:
1706 	return (error);
1707 }
1708 
1709 usbd_status
1710 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
1711 {
1712 	uint8_t data;
1713 	usbd_status error;
1714 
1715 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1716 	if (error)
1717 		goto fail;
1718 
1719 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1720 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1721 	urtw_write32_m(sc, URTW_ANAPARAM, val);
1722 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1723 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1724 
1725 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1726 	if (error)
1727 		goto fail;
1728 fail:
1729 	return (error);
1730 }
1731 
1732 usbd_status
1733 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
1734 {
1735 	uint8_t data;
1736 	usbd_status error;
1737 
1738 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1739 	if (error)
1740 		goto fail;
1741 
1742 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1743 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
1744 	urtw_write32_m(sc, URTW_ANAPARAM2, val);
1745 	urtw_read8_m(sc, URTW_CONFIG3, &data);
1746 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
1747 
1748 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1749 	if (error)
1750 		goto fail;
1751 fail:
1752 	return (error);
1753 }
1754 
1755 usbd_status
1756 urtw_intr_disable(struct urtw_softc *sc)
1757 {
1758 	usbd_status error;
1759 
1760 	urtw_write16_m(sc, URTW_INTR_MASK, 0);
1761 fail:
1762 	return (error);
1763 }
1764 
1765 usbd_status
1766 urtw_reset(struct urtw_softc *sc)
1767 {
1768 	uint8_t data;
1769 	usbd_status error;
1770 
1771 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1772 	if (error)
1773 		goto fail;
1774 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1775 	if (error)
1776 		goto fail;
1777 
1778 	error = urtw_intr_disable(sc);
1779 	if (error)
1780 		goto fail;
1781 	usbd_delay_ms(sc->sc_udev, 100);
1782 
1783 	error = urtw_write8e(sc, 0x18, 0x10);
1784 	if (error != 0)
1785 		goto fail;
1786 	error = urtw_write8e(sc, 0x18, 0x11);
1787 	if (error != 0)
1788 		goto fail;
1789 	error = urtw_write8e(sc, 0x18, 0x00);
1790 	if (error != 0)
1791 		goto fail;
1792 	usbd_delay_ms(sc->sc_udev, 100);
1793 
1794 	urtw_read8_m(sc, URTW_CMD, &data);
1795 	data = (data & 2) | URTW_CMD_RST;
1796 	urtw_write8_m(sc, URTW_CMD, data);
1797 	usbd_delay_ms(sc->sc_udev, 100);
1798 
1799 	urtw_read8_m(sc, URTW_CMD, &data);
1800 	if (data & URTW_CMD_RST) {
1801 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
1802 		goto fail;
1803 	}
1804 
1805 	error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
1806 	if (error)
1807 		goto fail;
1808 	usbd_delay_ms(sc->sc_udev, 100);
1809 
1810 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
1811 	if (error)
1812 		goto fail;
1813 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
1814 	if (error)
1815 		goto fail;
1816 fail:
1817 	return (error);
1818 }
1819 
1820 usbd_status
1821 urtw_led_on(struct urtw_softc *sc, int type)
1822 {
1823 	usbd_status error;
1824 
1825 	if (type == URTW_LED_GPIO) {
1826 		switch (sc->sc_gpio_ledpin) {
1827 		case URTW_LED_PIN_GPIO0:
1828 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1829 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
1830 			break;
1831 		default:
1832 			panic("unsupported LED PIN type 0x%x",
1833 			    sc->sc_gpio_ledpin);
1834 			/* NOTREACHED */
1835 		}
1836 	} else {
1837 		panic("unsupported LED type 0x%x", type);
1838 		/* NOTREACHED */
1839 	}
1840 
1841 	sc->sc_gpio_ledon = 1;
1842 fail:
1843 	return (error);
1844 }
1845 
1846 static usbd_status
1847 urtw_led_off(struct urtw_softc *sc, int type)
1848 {
1849 	usbd_status error;
1850 
1851 	if (type == URTW_LED_GPIO) {
1852 		switch (sc->sc_gpio_ledpin) {
1853 		case URTW_LED_PIN_GPIO0:
1854 			urtw_write8_m(sc, URTW_GPIO, 0x01);
1855 			urtw_write8_m(sc, URTW_GP_ENABLE, 0x01);
1856 			break;
1857 		default:
1858 			panic("unsupported LED PIN type 0x%x",
1859 			    sc->sc_gpio_ledpin);
1860 			/* NOTREACHED */
1861 		}
1862 	} else {
1863 		panic("unsupported LED type 0x%x", type);
1864 		/* NOTREACHED */
1865 	}
1866 
1867 	sc->sc_gpio_ledon = 0;
1868 
1869 fail:
1870 	return (error);
1871 }
1872 
1873 usbd_status
1874 urtw_led_mode0(struct urtw_softc *sc, int mode)
1875 {
1876 	struct timeval t;
1877 
1878 	switch (mode) {
1879 	case URTW_LED_CTL_POWER_ON:
1880 		sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
1881 		break;
1882 	case URTW_LED_CTL_TX:
1883 		if (sc->sc_gpio_ledinprogress == 1)
1884 			return (0);
1885 
1886 		sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
1887 		sc->sc_gpio_blinktime = 2;
1888 		break;
1889 	case URTW_LED_CTL_LINK:
1890 		sc->sc_gpio_ledstate = URTW_LED_ON;
1891 		break;
1892 	default:
1893 		panic("unsupported LED mode 0x%x", mode);
1894 		/* NOTREACHED */
1895 	}
1896 
1897 	switch (sc->sc_gpio_ledstate) {
1898 	case URTW_LED_ON:
1899 		if (sc->sc_gpio_ledinprogress != 0)
1900 			break;
1901 		urtw_led_on(sc, URTW_LED_GPIO);
1902 		break;
1903 	case URTW_LED_BLINK_NORMAL:
1904 		if (sc->sc_gpio_ledinprogress != 0)
1905 			break;
1906 		sc->sc_gpio_ledinprogress = 1;
1907 		sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
1908 			URTW_LED_OFF : URTW_LED_ON;
1909 		t.tv_sec = 0;
1910 		t.tv_usec = 100 * 1000L;
1911 		if (!usbd_is_dying(sc->sc_udev))
1912 			timeout_add(&sc->sc_led_ch, tvtohz(&t));
1913 		break;
1914 	case URTW_LED_POWER_ON_BLINK:
1915 		urtw_led_on(sc, URTW_LED_GPIO);
1916 		usbd_delay_ms(sc->sc_udev, 100);
1917 		urtw_led_off(sc, URTW_LED_GPIO);
1918 		break;
1919 	default:
1920 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
1921 		/* NOTREACHED */
1922 	}
1923 	return (0);
1924 }
1925 
1926 usbd_status
1927 urtw_led_mode1(struct urtw_softc *sc, int mode)
1928 {
1929 	return (USBD_INVAL);
1930 }
1931 
1932 usbd_status
1933 urtw_led_mode2(struct urtw_softc *sc, int mode)
1934 {
1935 	return (USBD_INVAL);
1936 }
1937 
1938 usbd_status
1939 urtw_led_mode3(struct urtw_softc *sc, int mode)
1940 {
1941 	return (USBD_INVAL);
1942 }
1943 
1944 void
1945 urtw_ledusbtask(void *arg)
1946 {
1947 	struct urtw_softc *sc = arg;
1948 
1949 	if (sc->sc_strategy != URTW_SW_LED_MODE0)
1950 		panic("could not process a LED strategy 0x%x", sc->sc_strategy);
1951 
1952 	urtw_led_blink(sc);
1953 }
1954 
1955 void
1956 urtw_ledtask(void *arg)
1957 {
1958 	struct urtw_softc *sc = arg;
1959 
1960 	/*
1961 	 * NB: to change a status of the led we need at least a sleep so we
1962 	 * can't do it here
1963 	 */
1964 	usb_add_task(sc->sc_udev, &sc->sc_ledtask);
1965 }
1966 
1967 usbd_status
1968 urtw_led_ctl(struct urtw_softc *sc, int mode)
1969 {
1970 	usbd_status error = 0;
1971 
1972 	switch (sc->sc_strategy) {
1973 	case URTW_SW_LED_MODE0:
1974 		error = urtw_led_mode0(sc, mode);
1975 		break;
1976 	case URTW_SW_LED_MODE1:
1977 		error = urtw_led_mode1(sc, mode);
1978 		break;
1979 	case URTW_SW_LED_MODE2:
1980 		error = urtw_led_mode2(sc, mode);
1981 		break;
1982 	case URTW_SW_LED_MODE3:
1983 		error = urtw_led_mode3(sc, mode);
1984 		break;
1985 	default:
1986 		panic("unsupported LED mode %d", sc->sc_strategy);
1987 		/* NOTREACHED */
1988 	}
1989 
1990 	return (error);
1991 }
1992 
1993 usbd_status
1994 urtw_led_blink(struct urtw_softc *sc)
1995 {
1996 	struct timeval t;
1997 	uint8_t ing = 0;
1998 	usbd_status error;
1999 
2000 	if (sc->sc_gpio_blinkstate == URTW_LED_ON)
2001 		error = urtw_led_on(sc, URTW_LED_GPIO);
2002 	else
2003 		error = urtw_led_off(sc, URTW_LED_GPIO);
2004 	sc->sc_gpio_blinktime--;
2005 	if (sc->sc_gpio_blinktime == 0)
2006 		ing = 1;
2007 	else {
2008 		if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
2009 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
2010 		    sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
2011 			ing = 1;
2012 	}
2013 	if (ing == 1) {
2014 		if (sc->sc_gpio_ledstate == URTW_LED_ON &&
2015 		    sc->sc_gpio_ledon == 0)
2016 			error = urtw_led_on(sc, URTW_LED_GPIO);
2017 		else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
2018 		    sc->sc_gpio_ledon == 1)
2019 			error = urtw_led_off(sc, URTW_LED_GPIO);
2020 
2021 		sc->sc_gpio_blinktime = 0;
2022 		sc->sc_gpio_ledinprogress = 0;
2023 		return (0);
2024 	}
2025 
2026 	sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
2027 	    URTW_LED_ON : URTW_LED_OFF;
2028 
2029 	switch (sc->sc_gpio_ledstate) {
2030 	case URTW_LED_BLINK_NORMAL:
2031 		t.tv_sec = 0;
2032 		t.tv_usec = 100 * 1000L;
2033 		if (!usbd_is_dying(sc->sc_udev))
2034 			timeout_add(&sc->sc_led_ch, tvtohz(&t));
2035 		break;
2036 	default:
2037 		panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
2038 		/* NOTREACHED */
2039 	}
2040 	return (0);
2041 }
2042 
2043 usbd_status
2044 urtw_update_msr(struct urtw_softc *sc)
2045 {
2046 	struct ieee80211com *ic = &sc->sc_ic;
2047 	uint8_t data;
2048 	usbd_status error;
2049 
2050 	urtw_read8_m(sc, URTW_MSR, &data);
2051 	data &= ~URTW_MSR_LINK_MASK;
2052 
2053 	/* Should always be set. */
2054 	if (sc->sc_hwrev & URTW_HWREV_8187B)
2055 		data |= URTW_MSR_LINK_ENEDCA;
2056 
2057 	if (sc->sc_state == IEEE80211_S_RUN) {
2058 		switch (ic->ic_opmode) {
2059 		case IEEE80211_M_STA:
2060 		case IEEE80211_M_MONITOR:
2061 			data |= URTW_MSR_LINK_STA;
2062 			break;
2063 		default:
2064 			panic("unsupported operation mode 0x%x",
2065 			    ic->ic_opmode);
2066 			/* NOTREACHED */
2067 		}
2068 	} else
2069 		data |= URTW_MSR_LINK_NONE;
2070 
2071 	urtw_write8_m(sc, URTW_MSR, data);
2072 fail:
2073 	return (error);
2074 }
2075 
2076 uint16_t
2077 urtw_rate2rtl(int rate)
2078 {
2079 	int i;
2080 
2081 	for (i = 0; i < nitems(urtw_ratetable); i++) {
2082 		if (rate == urtw_ratetable[i].reg)
2083 			return (urtw_ratetable[i].val);
2084 	}
2085 
2086 	return (3);
2087 }
2088 
2089 uint16_t
2090 urtw_rtl2rate(int rate)
2091 {
2092 	int i;
2093 
2094 	for (i = 0; i < nitems(urtw_ratetable); i++) {
2095 		if (rate == urtw_ratetable[i].val)
2096 			return (urtw_ratetable[i].reg);
2097 	}
2098 
2099 	return (0);
2100 }
2101 
2102 usbd_status
2103 urtw_set_rate(struct urtw_softc *sc)
2104 {
2105 	int i, basic_rate, min_rr_rate, max_rr_rate;
2106 	uint16_t data;
2107 	usbd_status error;
2108 
2109 	basic_rate = urtw_rate2rtl(48);
2110 	min_rr_rate = urtw_rate2rtl(12);
2111 	max_rr_rate = urtw_rate2rtl(48);
2112 
2113 	urtw_write8_m(sc, URTW_RESP_RATE,
2114 	    max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
2115 	    min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
2116 
2117 	urtw_read16_m(sc, URTW_8187_BRSR, &data);
2118 	data &= ~URTW_BRSR_MBR_8185;
2119 
2120 	for (i = 0; i <= basic_rate; i++)
2121 		data |= (1 << i);
2122 
2123 	urtw_write16_m(sc, URTW_8187_BRSR, data);
2124 fail:
2125 	return (error);
2126 }
2127 
2128 usbd_status
2129 urtw_intr_enable(struct urtw_softc *sc)
2130 {
2131 	usbd_status error;
2132 
2133 	urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
2134 fail:
2135 	return (error);
2136 }
2137 
2138 usbd_status
2139 urtw_rx_setconf(struct urtw_softc *sc)
2140 {
2141 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2142 	struct ieee80211com *ic = &sc->sc_ic;
2143 	uint32_t data;
2144 	usbd_status error;
2145 
2146 	urtw_read32_m(sc, URTW_RX, &data);
2147 	data = data &~ URTW_RX_FILTER_MASK;
2148 #if 0
2149 	data = data | URTW_RX_FILTER_CTL;
2150 #endif
2151 	data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
2152 	data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
2153 
2154 	if (ic->ic_opmode == IEEE80211_M_MONITOR) {
2155 		data = data | URTW_RX_FILTER_ICVERR;
2156 		data = data | URTW_RX_FILTER_PWR;
2157 	}
2158 	if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
2159 		data = data | URTW_RX_FILTER_CRCERR;
2160 
2161 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2162 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2163 		data = data | URTW_RX_FILTER_ALLMAC;
2164 	} else {
2165 		data = data | URTW_RX_FILTER_NICMAC;
2166 		data = data | URTW_RX_CHECK_BSSID;
2167 	}
2168 
2169 	data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
2170 	data = data | URTW_RX_FIFO_THRESHOLD_NONE | URTW_RX_AUTORESETPHY;
2171 	data = data &~ URTW_MAX_RX_DMA_MASK;
2172 	data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
2173 
2174 	urtw_write32_m(sc, URTW_RX, data);
2175 fail:
2176 	return (error);
2177 }
2178 
2179 usbd_status
2180 urtw_rx_enable(struct urtw_softc *sc)
2181 {
2182 	int i;
2183 	struct urtw_rx_data *rx_data;
2184 	uint8_t data;
2185 	usbd_status error;
2186 
2187 	/*
2188 	 * Start up the receive pipe.
2189 	 */
2190 	for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++) {
2191 		rx_data = &sc->sc_rx_data[i];
2192 
2193 		usbd_setup_xfer(rx_data->xfer, sc->sc_rxpipe, rx_data,
2194 		    rx_data->buf, MCLBYTES, USBD_SHORT_XFER_OK,
2195 		    USBD_NO_TIMEOUT, urtw_rxeof);
2196 		error = usbd_transfer(rx_data->xfer);
2197 		if (error != USBD_IN_PROGRESS && error != 0) {
2198 			printf("%s: could not queue Rx transfer\n",
2199 			    sc->sc_dev.dv_xname);
2200 			goto fail;
2201 		}
2202 	}
2203 
2204 	error = urtw_rx_setconf(sc);
2205 	if (error != 0)
2206 		goto fail;
2207 
2208 	urtw_read8_m(sc, URTW_CMD, &data);
2209 	urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
2210 fail:
2211 	return (error);
2212 }
2213 
2214 usbd_status
2215 urtw_tx_enable(struct urtw_softc *sc)
2216 {
2217 	uint8_t data8;
2218 	uint32_t data;
2219 	usbd_status error;
2220 
2221 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2222 		urtw_read8_m(sc, URTW_CW_CONF, &data8);
2223 		data8 &= ~(URTW_CW_CONF_PERPACKET_CW |
2224 		    URTW_CW_CONF_PERPACKET_RETRY);
2225 		urtw_write8_m(sc, URTW_CW_CONF, data8);
2226 
2227  		urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
2228 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
2229 		data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
2230 		data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
2231 		urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
2232 
2233 		urtw_read32_m(sc, URTW_TX_CONF, &data);
2234 		data &= ~URTW_TX_LOOPBACK_MASK;
2235 		data |= URTW_TX_LOOPBACK_NONE;
2236 		data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
2237 		data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
2238 		data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
2239 		data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
2240 		data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
2241 		data &= ~URTW_TX_SWPLCPLEN;
2242 		data |= URTW_TX_NOICV;
2243 		urtw_write32_m(sc, URTW_TX_CONF, data);
2244 	} else {
2245 		data = URTW_TX_DURPROCMODE | URTW_TX_DISREQQSIZE |
2246 		    URTW_TX_MXDMA_2048 | URTW_TX_SHORTRETRY |
2247 		    URTW_TX_LONGRETRY;
2248 		urtw_write32_m(sc, URTW_TX_CONF, data);
2249 	}
2250 
2251 	urtw_read8_m(sc, URTW_CMD, &data8);
2252 	urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
2253 fail:
2254 	return (error);
2255 }
2256 
2257 int
2258 urtw_init(struct ifnet *ifp)
2259 {
2260 	struct urtw_softc *sc = ifp->if_softc;
2261 	struct urtw_rf *rf = &sc->sc_rf;
2262 	struct ieee80211com *ic = &sc->sc_ic;
2263 	usbd_status error;
2264 	int ret;
2265 
2266 	urtw_stop(ifp, 0);
2267 
2268 	error = urtw_reset(sc);
2269 	if (error)
2270 		goto fail;
2271 
2272 	urtw_write8_m(sc, 0x85, 0);
2273 	urtw_write8_m(sc, URTW_GPIO, 0);
2274 
2275 	/* for led */
2276 	urtw_write8_m(sc, 0x85, 4);
2277 	error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
2278 	if (error != 0)
2279 		goto fail;
2280 
2281 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2282 	if (error)
2283 		goto fail;
2284 
2285 	/* applying MAC address again. */
2286 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2287 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
2288 	if (error)
2289 		goto fail;
2290 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2291 	if (error)
2292 		goto fail;
2293 
2294 	error = urtw_update_msr(sc);
2295 	if (error)
2296 		goto fail;
2297 
2298 	urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
2299 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
2300 	urtw_write8_m(sc, URTW_RATE_FALLBACK, 0x81);
2301 	error = urtw_set_rate(sc);
2302 	if (error != 0)
2303 		goto fail;
2304 
2305 	error = rf->init(rf);
2306 	if (error != 0)
2307 		goto fail;
2308 	if (rf->set_sens != NULL)
2309 		rf->set_sens(rf);
2310 
2311 	urtw_write16_m(sc, 0x5e, 1);
2312 	urtw_write16_m(sc, 0xfe, 0x10);
2313 	urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
2314 	urtw_write8_m(sc, 0xff, 0x60);
2315 	urtw_write16_m(sc, 0x5e, 0);
2316 	urtw_write8_m(sc, 0x85, 4);
2317 
2318 	error = urtw_intr_enable(sc);
2319 	if (error != 0)
2320 		goto fail;
2321 
2322 	/* reset softc variables */
2323 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
2324 	sc->sc_txtimer = 0;
2325 
2326 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
2327 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
2328 		if (error != 0) {
2329 			printf("%s: could not set configuration no\n",
2330 			    sc->sc_dev.dv_xname);
2331 			goto fail;
2332 		}
2333 		/* get the first interface handle */
2334 		error = usbd_device2interface_handle(sc->sc_udev,
2335 		    URTW_IFACE_INDEX, &sc->sc_iface);
2336 		if (error != 0) {
2337 			printf("%s: could not get interface handle\n",
2338 			    sc->sc_dev.dv_xname);
2339 			goto fail;
2340 		}
2341 		error = urtw_open_pipes(sc);
2342 		if (error != 0)
2343 			goto fail;
2344 		ret = urtw_alloc_rx_data_list(sc);
2345 		if (error != 0)
2346 			goto fail;
2347 		ret = urtw_alloc_tx_data_list(sc);
2348 		if (error != 0)
2349 			goto fail;
2350 		sc->sc_flags |= URTW_INIT_ONCE;
2351 	}
2352 
2353 	error = urtw_rx_enable(sc);
2354 	if (error != 0)
2355 		goto fail;
2356 	error = urtw_tx_enable(sc);
2357 	if (error != 0)
2358 		goto fail;
2359 
2360 	ifp->if_flags &= ~IFF_OACTIVE;
2361 	ifp->if_flags |= IFF_RUNNING;
2362 
2363 	ifp->if_timer = 1;
2364 
2365 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2366 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2367 	else
2368 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2369 
2370 	return (0);
2371 fail:
2372 	return (error);
2373 }
2374 
2375 void
2376 urtw_set_multi(struct urtw_softc *sc)
2377 {
2378 	struct arpcom *ac = &sc->sc_ic.ic_ac;
2379 	struct ifnet *ifp = &ac->ac_if;
2380 
2381 	/*
2382 	 * XXX don't know how to set a device.  Lack of docs.  Just try to set
2383 	 * IFF_ALLMULTI flag here.
2384 	 */
2385 	ifp->if_flags |= IFF_ALLMULTI;
2386 }
2387 
2388 int
2389 urtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2390 {
2391 	struct urtw_softc *sc = ifp->if_softc;
2392 	struct ieee80211com *ic = &sc->sc_ic;
2393 	struct ifaddr *ifa;
2394 	struct ifreq *ifr;
2395 	int s, error = 0;
2396 
2397 	if (usbd_is_dying(sc->sc_udev))
2398 		return (ENXIO);
2399 
2400 	usbd_ref_incr(sc->sc_udev);
2401 
2402 	s = splnet();
2403 
2404 	switch (cmd) {
2405 	case SIOCSIFADDR:
2406 		ifa = (struct ifaddr *)data;
2407 		ifp->if_flags |= IFF_UP;
2408 #ifdef INET
2409 		if (ifa->ifa_addr->sa_family == AF_INET)
2410 			arp_ifinit(&ic->ic_ac, ifa);
2411 #endif
2412 		/* FALLTHROUGH */
2413 	case SIOCSIFFLAGS:
2414 		if (ifp->if_flags & IFF_UP) {
2415 			/*
2416 			 * If only the PROMISC or ALLMULTI flag changes, then
2417 			 * don't do a full re-init of the chip, just update
2418 			 * the Rx filter.
2419 			 */
2420 			if ((ifp->if_flags & IFF_RUNNING) &&
2421 			    ((ifp->if_flags ^ sc->sc_if_flags) &
2422 			    (IFF_ALLMULTI | IFF_PROMISC)) != 0) {
2423 				urtw_set_multi(sc);
2424 			} else {
2425 				if (!(ifp->if_flags & IFF_RUNNING))
2426 					sc->sc_init(ifp);
2427 			}
2428 		} else {
2429 			if (ifp->if_flags & IFF_RUNNING)
2430 				urtw_stop(ifp, 1);
2431 		}
2432 		sc->sc_if_flags = ifp->if_flags;
2433 		break;
2434 
2435 	case SIOCADDMULTI:
2436 	case SIOCDELMULTI:
2437 		ifr = (struct ifreq *)data;
2438 		error = (cmd == SIOCADDMULTI) ?
2439 		    ether_addmulti(ifr, &ic->ic_ac) :
2440 		    ether_delmulti(ifr, &ic->ic_ac);
2441 		if (error == ENETRESET) {
2442 			if (ifp->if_flags & IFF_RUNNING)
2443 				urtw_set_multi(sc);
2444 			error = 0;
2445 		}
2446 		break;
2447 
2448 	case SIOCS80211CHANNEL:
2449 		/*
2450 		 * This allows for fast channel switching in monitor mode
2451 		 * (used by kismet). In IBSS mode, we must explicitly reset
2452 		 * the interface to generate a new beacon frame.
2453 		 */
2454 		error = ieee80211_ioctl(ifp, cmd, data);
2455 		if (error == ENETRESET &&
2456 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
2457 			urtw_set_chan(sc, ic->ic_ibss_chan);
2458 			error = 0;
2459 		}
2460 		break;
2461 
2462 	default:
2463 		error = ieee80211_ioctl(ifp, cmd, data);
2464 	}
2465 
2466 	if (error == ENETRESET) {
2467 		if ((ifp->if_flags & (IFF_RUNNING | IFF_UP)) ==
2468 		    (IFF_RUNNING | IFF_UP))
2469 			sc->sc_init(ifp);
2470 		error = 0;
2471 	}
2472 
2473 	splx(s);
2474 
2475 	usbd_ref_decr(sc->sc_udev);
2476 
2477 	return (error);
2478 }
2479 
2480 void
2481 urtw_start(struct ifnet *ifp)
2482 {
2483 	struct urtw_softc *sc = ifp->if_softc;
2484 	struct ieee80211com *ic = &sc->sc_ic;
2485 	struct ieee80211_node *ni;
2486 	struct mbuf *m0;
2487 
2488 	/*
2489 	 * net80211 may still try to send management frames even if the
2490 	 * IFF_RUNNING flag is not set...
2491 	 */
2492 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
2493 		return;
2494 
2495 	for (;;) {
2496 		IF_POLL(&ic->ic_mgtq, m0);
2497 		if (m0 != NULL) {
2498 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2499 			    sc->sc_tx_normal_queued >=
2500 			    URTW_TX_DATA_LIST_COUNT) {
2501 				ifp->if_flags |= IFF_OACTIVE;
2502 				break;
2503 			}
2504 			IF_DEQUEUE(&ic->ic_mgtq, m0);
2505 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
2506 			m0->m_pkthdr.rcvif = NULL;
2507 #if NBPFILTER > 0
2508 			if (ic->ic_rawbpf != NULL)
2509 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2510 #endif
2511 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2512 			    != 0)
2513 				break;
2514 		} else {
2515 			if (ic->ic_state != IEEE80211_S_RUN)
2516 				break;
2517 			IFQ_POLL(&ifp->if_snd, m0);
2518 			if (m0 == NULL)
2519 				break;
2520 			if (sc->sc_tx_low_queued >= URTW_TX_DATA_LIST_COUNT ||
2521 			    sc->sc_tx_normal_queued >=
2522 			    URTW_TX_DATA_LIST_COUNT) {
2523 				ifp->if_flags |= IFF_OACTIVE;
2524 				break;
2525 			}
2526 			IFQ_DEQUEUE(&ifp->if_snd, m0);
2527 #if NBPFILTER > 0
2528 			if (ifp->if_bpf != NULL)
2529 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
2530 #endif
2531 			m0 = ieee80211_encap(ifp, m0, &ni);
2532 			if (m0 == NULL)
2533 				continue;
2534 #if NBPFILTER > 0
2535 			if (ic->ic_rawbpf != NULL)
2536 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
2537 #endif
2538 			if (urtw_tx_start(sc, ni, m0, URTW_PRIORITY_NORMAL)
2539 			    != 0) {
2540 				if (ni != NULL)
2541 					ieee80211_release_node(ic, ni);
2542 				ifp->if_oerrors++;
2543 				break;
2544 			}
2545 		}
2546 		sc->sc_txtimer = 5;
2547 	}
2548 }
2549 
2550 void
2551 urtw_watchdog(struct ifnet *ifp)
2552 {
2553 	struct urtw_softc *sc = ifp->if_softc;
2554 
2555 	ifp->if_timer = 0;
2556 
2557 	if (sc->sc_txtimer > 0) {
2558 		if (--sc->sc_txtimer == 0) {
2559 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
2560 			ifp->if_oerrors++;
2561 			return;
2562 		}
2563 		ifp->if_timer = 1;
2564 	}
2565 
2566 	ieee80211_watchdog(ifp);
2567 }
2568 
2569 void
2570 urtw_txeof_low(usbd_xfer_handle xfer, usbd_private_handle priv,
2571     usbd_status status)
2572 {
2573 	struct urtw_tx_data *data = priv;
2574 	struct urtw_softc *sc = data->sc;
2575 	struct ieee80211com *ic = &sc->sc_ic;
2576 	struct ifnet *ifp = &ic->ic_if;
2577 	int s;
2578 
2579 	if (status != USBD_NORMAL_COMPLETION) {
2580 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2581 			return;
2582 
2583 		printf("%s: could not transmit buffer: %s\n",
2584 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2585 
2586 		if (status == USBD_STALLED)
2587 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_low);
2588 
2589 		ifp->if_oerrors++;
2590 		return;
2591 	}
2592 
2593 	s = splnet();
2594 
2595 	ieee80211_release_node(ic, data->ni);
2596 	data->ni = NULL;
2597 
2598 	sc->sc_txtimer = 0;
2599 	ifp->if_opackets++;
2600 
2601 	sc->sc_tx_low_queued--;
2602 	ifp->if_flags &= ~IFF_OACTIVE;
2603 	urtw_start(ifp);
2604 
2605 	splx(s);
2606 }
2607 
2608 void
2609 urtw_txeof_normal(usbd_xfer_handle xfer, usbd_private_handle priv,
2610     usbd_status status)
2611 {
2612 	struct urtw_tx_data *data = priv;
2613 	struct urtw_softc *sc = data->sc;
2614 	struct ieee80211com *ic = &sc->sc_ic;
2615 	struct ifnet *ifp = &ic->ic_if;
2616 	int s;
2617 
2618 	if (status != USBD_NORMAL_COMPLETION) {
2619 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
2620 			return;
2621 
2622 		printf("%s: could not transmit buffer: %s\n",
2623 		    sc->sc_dev.dv_xname, usbd_errstr(status));
2624 
2625 		if (status == USBD_STALLED)
2626 			usbd_clear_endpoint_stall_async(sc->sc_txpipe_normal);
2627 
2628 		ifp->if_oerrors++;
2629 		return;
2630 	}
2631 
2632 	s = splnet();
2633 
2634 	ieee80211_release_node(ic, data->ni);
2635 	data->ni = NULL;
2636 
2637 	sc->sc_txtimer = 0;
2638 	ifp->if_opackets++;
2639 
2640 	sc->sc_tx_normal_queued--;
2641 	ifp->if_flags &= ~IFF_OACTIVE;
2642 	urtw_start(ifp);
2643 
2644 	splx(s);
2645 }
2646 
2647 int
2648 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
2649     int prior)
2650 {
2651 	struct ieee80211com *ic = &sc->sc_ic;
2652 	struct urtw_tx_data *data;
2653 	struct ieee80211_frame *wh;
2654 	struct ieee80211_key *k;
2655 	usbd_status error;
2656 	int xferlen;
2657 
2658 	wh = mtod(m0, struct ieee80211_frame *);
2659 
2660 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2661 		k = ieee80211_get_txkey(ic, wh, ni);
2662 
2663 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
2664 			return (ENOBUFS);
2665 
2666 		/* packet header may have moved, reset our local pointer */
2667 		wh = mtod(m0, struct ieee80211_frame *);
2668 	}
2669 
2670 #if NBPFILTER > 0
2671 	if (sc->sc_drvbpf != NULL) {
2672 		struct mbuf mb;
2673 		struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
2674 
2675 		tap->wt_flags = 0;
2676 		tap->wt_rate = 0;
2677 		tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
2678 		tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
2679 
2680 		mb.m_data = (caddr_t)tap;
2681 		mb.m_len = sc->sc_txtap_len;
2682 		mb.m_next = m0;
2683 		mb.m_nextpkt = NULL;
2684 		mb.m_type = 0;
2685 		mb.m_flags = 0;
2686 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
2687 	}
2688 #endif
2689 
2690 	if (sc->sc_hwrev & URTW_HWREV_8187)
2691 		xferlen = m0->m_pkthdr.len + 4 * 3;
2692 	else
2693 		xferlen = m0->m_pkthdr.len + 4 * 8;
2694 
2695 	if ((0 == xferlen % 64) || (0 == xferlen % 512))
2696 		xferlen += 1;
2697 
2698 	data = &sc->sc_tx_data[sc->sc_txidx];
2699 	sc->sc_txidx = (sc->sc_txidx + 1) % URTW_TX_DATA_LIST_COUNT;
2700 
2701 	bzero(data->buf, URTW_TX_MAXSIZE);
2702 	data->buf[0] = m0->m_pkthdr.len & 0xff;
2703 	data->buf[1] = (m0->m_pkthdr.len & 0x0f00) >> 8;
2704 	data->buf[1] |= (1 << 7);
2705 
2706 	/* XXX sc_preamble_mode is always 2. */
2707 	if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
2708 	    (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
2709 	    (sc->sc_preamble_mode == 1) && (sc->sc_currate != 0))
2710 		data->buf[2] |= 1;
2711 	if ((m0->m_pkthdr.len > ic->ic_rtsthreshold) &&
2712 	    prior == URTW_PRIORITY_LOW)
2713 		panic("TODO tx.");
2714 	if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
2715 		data->buf[2] |= (1 << 1);
2716 	/* RTS rate - 10 means we use a basic rate. */
2717 	data->buf[2] |= (urtw_rate2rtl(2) << 3);
2718 	/*
2719 	 * XXX currently TX rate control depends on the rate value of
2720 	 * RX descriptor because I don't know how to we can control TX rate
2721 	 * in more smart way.  Please fix me you find a thing.
2722 	 */
2723 	data->buf[3] = sc->sc_currate;
2724 	if (prior == URTW_PRIORITY_NORMAL) {
2725 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2726 			data->buf[3] = urtw_rate2rtl(ni->ni_rates.rs_rates[0]);
2727 		else if (ic->ic_fixed_rate != -1)
2728 			data->buf[3] = urtw_rate2rtl(ic->ic_fixed_rate);
2729 	}
2730 
2731 	if (sc->sc_hwrev & URTW_HWREV_8187) {
2732 		data->buf[8] = 3;		/* CW minimum */
2733 		data->buf[8] |= (7 << 4);	/* CW maximum */
2734 		data->buf[9] |= 11;		/* retry limitation */
2735 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[12]);
2736 	} else {
2737 		data->buf[21] |= 11;		/* retry limitation */
2738 		m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)&data->buf[32]);
2739 	}
2740 
2741 	data->ni = ni;
2742 
2743 	/* mbuf is no longer needed. */
2744 	m_freem(m0);
2745 
2746 	usbd_setup_xfer(data->xfer,
2747 	    (prior == URTW_PRIORITY_LOW) ? sc->sc_txpipe_low :
2748 	    sc->sc_txpipe_normal, data, data->buf, xferlen,
2749 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, URTW_DATA_TIMEOUT,
2750 	    (prior == URTW_PRIORITY_LOW) ? urtw_txeof_low : urtw_txeof_normal);
2751 	error = usbd_transfer(data->xfer);
2752 	if (error != USBD_IN_PROGRESS && error != USBD_NORMAL_COMPLETION) {
2753 		printf("%s: could not send frame: %s\n",
2754 		    sc->sc_dev.dv_xname, usbd_errstr(error));
2755 		return (EIO);
2756 	}
2757 
2758 	error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
2759 	if (error != 0)
2760 		printf("%s: could not control LED (%d)\n",
2761 		    sc->sc_dev.dv_xname, error);
2762 
2763 	if (prior == URTW_PRIORITY_LOW)
2764 		sc->sc_tx_low_queued++;
2765 	else
2766 		sc->sc_tx_normal_queued++;
2767 
2768 	return (0);
2769 }
2770 
2771 usbd_status
2772 urtw_8225_usb_init(struct urtw_softc *sc)
2773 {
2774 	uint8_t data;
2775 	usbd_status error;
2776 
2777 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2778 	urtw_write8_m(sc, URTW_GPIO, 0);
2779 	error = urtw_read8e(sc, 0x53, &data);
2780 	if (error)
2781 		goto fail;
2782 	error = urtw_write8e(sc, 0x53, data | (1 << 7));
2783 	if (error)
2784 		goto fail;
2785 	urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2786 	urtw_write8_m(sc, URTW_GPIO, 0x20);
2787 	urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2788 
2789 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2790 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2791 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2792 
2793 	usbd_delay_ms(sc->sc_udev, 500);
2794 fail:
2795 	return (error);
2796 }
2797 
2798 usbd_status
2799 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2800 {
2801 	usbd_status error = 0;
2802 
2803 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2804 fail:
2805 	return (error);
2806 }
2807 
2808 usbd_status
2809 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2810 {
2811 	uint32_t phyw;
2812 	usbd_status error;
2813 
2814 	phyw = ((data << 8) | (addr | 0x80));
2815 	urtw_write8_m(sc, 0x7f, ((phyw & 0xff000000) >> 24));
2816 	urtw_write8_m(sc, 0x7e, ((phyw & 0x00ff0000) >> 16));
2817 	urtw_write8_m(sc, 0x7d, ((phyw & 0x0000ff00) >> 8));
2818 	urtw_write8_m(sc, 0x7c, ((phyw & 0x000000ff)));
2819 	/*
2820 	 * Delay removed from 8185 to 8187.
2821 	 * usbd_delay_ms(sc->sc_udev, 1);
2822 	 */
2823 fail:
2824 	return (error);
2825 }
2826 
2827 usbd_status
2828 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2829 {
2830 	data = data & 0xff;
2831 	return (urtw_8187_write_phy(sc, addr, data));
2832 }
2833 
2834 usbd_status
2835 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2836 {
2837 	data = data & 0xff;
2838 	return (urtw_8187_write_phy(sc, addr, data | 0x10000));
2839 }
2840 
2841 usbd_status
2842 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2843 {
2844 	usbd_status error;
2845 
2846 	urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2847 	urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2848 	urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2849 	urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2850 fail:
2851 	return (error);
2852 }
2853 
2854 usbd_status
2855 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2856 {
2857 	int i, idx, set;
2858 	uint8_t *cck_pwltable;
2859 	uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2860 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2861 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2862 	usbd_status error;
2863 
2864 	cck_pwrlvl_max = 11;
2865 	ofdm_pwrlvl_max = 25;	/* 12 -> 25 */
2866 	ofdm_pwrlvl_min = 10;
2867 
2868 	/* CCK power setting */
2869 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2870 	idx = cck_pwrlvl % 6;
2871 	set = cck_pwrlvl / 6;
2872 	cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2873 	    urtw_8225_txpwr_cck;
2874 
2875 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2876 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2877 	for (i = 0; i < 8; i++) {
2878 		urtw_8187_write_phy_cck(sc, 0x44 + i,
2879 		    cck_pwltable[idx * 8 + i]);
2880 	}
2881 	usbd_delay_ms(sc->sc_udev, 1);
2882 
2883 	/* OFDM power setting */
2884 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2885 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2886 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2887 
2888 	idx = ofdm_pwrlvl % 6;
2889 	set = ofdm_pwrlvl / 6;
2890 
2891 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
2892 	if (error)
2893 		goto fail;
2894 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2895 	urtw_8187_write_phy_ofdm(sc, 6, 0);
2896 	urtw_8187_write_phy_ofdm(sc, 8, 0);
2897 
2898 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2899 	    urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2900 	urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2901 	urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2902 	usbd_delay_ms(sc->sc_udev, 1);
2903 fail:
2904 	return (error);
2905 }
2906 
2907 usbd_status
2908 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2909 {
2910 	usbd_status error;
2911 
2912 	urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2913 	usbd_delay_ms(sc->sc_udev, 1);
2914 fail:
2915 	return (error);
2916 }
2917 
2918 usbd_status
2919 urtw_8225_rf_init(struct urtw_rf *rf)
2920 {
2921 	struct urtw_softc *sc = rf->rf_sc;
2922 	int i;
2923 	uint16_t data;
2924 	usbd_status error;
2925 
2926 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
2927 	if (error)
2928 		goto fail;
2929 
2930 	error = urtw_8225_usb_init(sc);
2931 	if (error)
2932 		goto fail;
2933 
2934 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2935 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
2936 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
2937 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2938 
2939 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2940 	if (error)
2941 		goto fail;
2942 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2943 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2944 	if (error)
2945 		goto fail;
2946 
2947 	error = urtw_8185_rf_pins_enable(sc);
2948 	if (error)
2949 		goto fail;
2950 
2951 	usbd_delay_ms(sc->sc_udev, 500);
2952 
2953 	for (i = 0; i < nitems(urtw_8225_rf_part1); i++) {
2954 		urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2955 		    urtw_8225_rf_part1[i].val);
2956 	}
2957 	usbd_delay_ms(sc->sc_udev, 50);
2958 	urtw_8225_write(sc, 0x2, 0xc4d);
2959 	usbd_delay_ms(sc->sc_udev, 200);
2960 	urtw_8225_write(sc, 0x2, 0x44d);
2961 	usbd_delay_ms(sc->sc_udev, 200);
2962 	urtw_8225_write(sc, 0x0, 0x127);
2963 
2964 	for (i = 0; i < nitems(urtw_8225_rxgain); i++) {
2965 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
2966 		urtw_8225_write(sc, 0x2, urtw_8225_rxgain[i]);
2967 	}
2968 
2969 	urtw_8225_write(sc, 0x0, 0x27);
2970 	urtw_8225_write(sc, 0x0, 0x22f);
2971 
2972 	for (i = 0; i < nitems(urtw_8225_agc); i++) {
2973 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2974 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2975 	}
2976 
2977 	for (i = 0; i < nitems(urtw_8225_rf_part2); i++) {
2978 		urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2979 		    urtw_8225_rf_part2[i].val);
2980 		usbd_delay_ms(sc->sc_udev, 1);
2981 	}
2982 
2983 	error = urtw_8225_setgain(sc, 4);
2984 	if (error)
2985 		goto fail;
2986 
2987 	for (i = 0; i < nitems(urtw_8225_rf_part3); i++) {
2988 		urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2989 		    urtw_8225_rf_part3[i].val);
2990 		usbd_delay_ms(sc->sc_udev, 1);
2991 	}
2992 
2993 	urtw_write8_m(sc, 0x5b, 0x0d);
2994 
2995 	error = urtw_8225_set_txpwrlvl(sc, 1);
2996 	if (error)
2997 		goto fail;
2998 
2999 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3000 	usbd_delay_ms(sc->sc_udev, 1);
3001 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3002 	usbd_delay_ms(sc->sc_udev, 1);
3003 
3004 	/* TX ant A, 0x0 for B */
3005 	error = urtw_8185_tx_antenna(sc, 0x3);
3006 	if (error)
3007 		goto fail;
3008 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3009 
3010 	error = urtw_8225_rf_set_chan(rf, 1);
3011 fail:
3012 	return (error);
3013 }
3014 
3015 usbd_status
3016 urtw_8225_rf_set_chan(struct urtw_rf *rf, int chan)
3017 {
3018 	struct urtw_softc *sc = rf->rf_sc;
3019 	struct ieee80211com *ic = &sc->sc_ic;
3020 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3021 	usbd_status error;
3022 
3023 	error = urtw_8225_set_txpwrlvl(sc, chan);
3024 	if (error)
3025 		goto fail;
3026 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3027 	usbd_delay_ms(sc->sc_udev, 10);
3028 
3029 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3030 
3031 	if (sc->sc_state == IEEE80211_S_ASSOC &&
3032 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3033 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3034 	else
3035 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3036 
3037 	if (IEEE80211_IS_CHAN_G(c)) {
3038 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3039 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3040 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3041 	} else {
3042 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3043 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3044 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3045 	}
3046 
3047 fail:
3048 	return (error);
3049 }
3050 
3051 usbd_status
3052 urtw_8225_rf_set_sens(struct urtw_rf *rf)
3053 {
3054 	struct urtw_softc *sc = rf->rf_sc;
3055 	usbd_status error;
3056 
3057 	if (rf->sens < 0 || rf->sens > 6)
3058 		return (-1);
3059 
3060 	if (rf->sens > 4)
3061 		urtw_8225_write(sc, 0x0c, 0x850);
3062 	else
3063 		urtw_8225_write(sc, 0x0c, 0x50);
3064 
3065 	rf->sens = 6 - rf->sens;
3066 	error = urtw_8225_setgain(sc, rf->sens);
3067 	if (error)
3068 		goto fail;
3069 
3070 	urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[rf->sens]);
3071 
3072 fail:
3073 	return (error);
3074 }
3075 
3076 void
3077 urtw_stop(struct ifnet *ifp, int disable)
3078 {
3079 	struct urtw_softc *sc = ifp->if_softc;
3080 	struct ieee80211com *ic = &sc->sc_ic;
3081 	uint8_t data;
3082 	usbd_status error;
3083 
3084 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
3085 
3086 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
3087 
3088 	timeout_del(&sc->scan_to);
3089 	timeout_del(&sc->sc_led_ch);
3090 
3091 	urtw_intr_disable(sc);
3092 	urtw_read8_m(sc, URTW_CMD, &data);
3093 	data &= ~URTW_CMD_TX_ENABLE;
3094 	data &= ~URTW_CMD_RX_ENABLE;
3095 	urtw_write8_m(sc, URTW_CMD, data);
3096 
3097 	if (sc->sc_rxpipe != NULL)
3098 		usbd_abort_pipe(sc->sc_rxpipe);
3099 	if (sc->sc_txpipe_low != NULL)
3100 		usbd_abort_pipe(sc->sc_txpipe_low);
3101 	if (sc->sc_txpipe_normal != NULL)
3102 		usbd_abort_pipe(sc->sc_txpipe_normal);
3103 
3104 fail:
3105 	return;
3106 }
3107 
3108 int
3109 urtw_isbmode(uint16_t rate)
3110 {
3111 	rate = urtw_rtl2rate(rate);
3112 
3113 	return (((rate <= 22 && rate != 12 && rate != 18) ||
3114 	    rate == 44) ? (1) : (0));
3115 }
3116 
3117 void
3118 urtw_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
3119 {
3120 	struct urtw_rx_data *data = priv;
3121 	struct urtw_softc *sc = data->sc;
3122 	struct ieee80211com *ic = &sc->sc_ic;
3123 	struct ifnet *ifp = &ic->ic_if;
3124 	struct ieee80211_frame *wh;
3125 	struct ieee80211_node *ni;
3126 	struct ieee80211_rxinfo rxi;
3127 	struct mbuf *m, *mnew;
3128 	uint8_t *desc, quality, rate;
3129 	int actlen, flen, len, nf, rssi, s;
3130 
3131 	if (status != USBD_NORMAL_COMPLETION) {
3132 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
3133 			return;
3134 
3135 		if (status == USBD_STALLED)
3136 			usbd_clear_endpoint_stall_async(sc->sc_rxpipe);
3137 		ifp->if_ierrors++;
3138 		goto skip;
3139 	}
3140 
3141 	usbd_get_xfer_status(xfer, NULL, NULL, &actlen, NULL);
3142 	if (actlen < URTW_MIN_RXBUFSZ) {
3143 		ifp->if_ierrors++;
3144 		goto skip;
3145 	}
3146 
3147 	if (sc->sc_hwrev & URTW_HWREV_8187)
3148 		/* 4 dword and 4 byte CRC */
3149 		len = actlen - (4 * 4);
3150 	else
3151 		/* 5 dword and 4 byte CRC */
3152 		len = actlen - (4 * 5);
3153 
3154 	desc = data->buf + len;
3155 	flen = ((desc[1] & 0x0f) << 8) + (desc[0] & 0xff);
3156 	if (flen > actlen) {
3157 		ifp->if_ierrors++;
3158 		goto skip;
3159 	}
3160 
3161 	rate = (desc[2] & 0xf0) >> 4;
3162 	if (sc->sc_hwrev & URTW_HWREV_8187) {
3163 		quality = desc[4] & 0xff;
3164 		rssi = (desc[6] & 0xfe) >> 1;
3165 
3166 		/* XXX correct? */
3167 		if (!urtw_isbmode(rate)) {
3168 			rssi = (rssi > 90) ? 90 : ((rssi < 25) ? 25 : rssi);
3169 			rssi = ((90 - rssi) * 100) / 65;
3170 		} else {
3171 			rssi = (rssi > 90) ? 95 : ((rssi < 30) ? 30 : rssi);
3172 			rssi = ((95 - rssi) * 100) / 65;
3173 		}
3174 	} else {
3175 		quality = desc[12];
3176 		rssi = 14 - desc[14] / 2;
3177 	}
3178 
3179 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
3180 	if (mnew == NULL) {
3181 		printf("%s: could not allocate rx mbuf\n",
3182 		    sc->sc_dev.dv_xname);
3183 		ifp->if_ierrors++;
3184 		goto skip;
3185 	}
3186 	MCLGET(mnew, M_DONTWAIT);
3187 	if (!(mnew->m_flags & M_EXT)) {
3188 		printf("%s: could not allocate rx mbuf cluster\n",
3189 		    sc->sc_dev.dv_xname);
3190 		m_freem(mnew);
3191 		ifp->if_ierrors++;
3192 		goto skip;
3193 	}
3194 
3195 	m = data->m;
3196 	data->m = mnew;
3197 	data->buf = mtod(mnew, uint8_t *);
3198 
3199 	/* finalize mbuf */
3200 	m->m_pkthdr.rcvif = ifp;
3201 	m->m_pkthdr.len = m->m_len = flen - 4;
3202 
3203 	s = splnet();
3204 
3205 #if NBPFILTER > 0
3206 	if (sc->sc_drvbpf != NULL) {
3207 		struct mbuf mb;
3208 		struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3209 
3210 		/* XXX Are variables correct? */
3211 		tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
3212 		tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
3213 		tap->wr_dbm_antsignal = (int8_t)rssi;
3214 
3215 		mb.m_data = (caddr_t)tap;
3216 		mb.m_len = sc->sc_rxtap_len;
3217 		mb.m_next = m;
3218 		mb.m_nextpkt = NULL;
3219 		mb.m_type = 0;
3220 		mb.m_flags = 0;
3221 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
3222 	}
3223 #endif
3224 	wh = mtod(m, struct ieee80211_frame *);
3225 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
3226 		sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3227 	ni = ieee80211_find_rxnode(ic, wh);
3228 
3229 	/* XXX correct? */
3230 	if (!urtw_isbmode(rate)) {
3231 		if (quality > 127)
3232 			quality = 0;
3233 		else if (quality < 27)
3234 			quality = 100;
3235 		else
3236 			quality = 127 - quality;
3237 	} else
3238 		quality = (quality > 64) ? 0 : ((64 - quality) * 100) / 64;
3239 
3240 	nf = quality;
3241 
3242 	/* send the frame to the 802.11 layer */
3243 	rxi.rxi_flags = 0;
3244 	rxi.rxi_rssi = rssi;
3245 	rxi.rxi_tstamp = 0;
3246 	ieee80211_input(ifp, m, ni, &rxi);
3247 
3248 	/* node is no longer needed */
3249 	ieee80211_release_node(ic, ni);
3250 
3251 	splx(s);
3252 
3253 skip:	/* setup a new transfer */
3254 	usbd_setup_xfer(xfer, sc->sc_rxpipe, data, data->buf, MCLBYTES,
3255 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, urtw_rxeof);
3256 	(void)usbd_transfer(xfer);
3257 }
3258 
3259 usbd_status
3260 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3261 {
3262 	uint8_t *gainp;
3263 	usbd_status error;
3264 
3265 	/* XXX for A? */
3266 	gainp = urtw_8225v2_gain_bg;
3267 	urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3268 	usbd_delay_ms(sc->sc_udev, 1);
3269 	urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3270 	usbd_delay_ms(sc->sc_udev, 1);
3271 	urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3272 	usbd_delay_ms(sc->sc_udev, 1);
3273 	urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3274 	usbd_delay_ms(sc->sc_udev, 1);
3275 fail:
3276 	return (error);
3277 }
3278 
3279 usbd_status
3280 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3281 {
3282 	int i;
3283 	uint8_t *cck_pwrtable;
3284 	uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3285 	uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3286 	uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3287 	usbd_status error;
3288 
3289 	/* CCK power setting */
3290 	cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3291 	cck_pwrlvl += sc->sc_txpwr_cck_base;
3292 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3293 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3294 	    urtw_8225v2_txpwr_cck;
3295 
3296 	for (i = 0; i < 8; i++) {
3297 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3298 	}
3299 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3300 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3301 	usbd_delay_ms(sc->sc_udev, 1);
3302 
3303 	/* OFDM power setting */
3304 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3305 		ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3306 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3307 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3308 
3309 	error = urtw_8185_set_anaparam2(sc, URTW_8187_8225_ANAPARAM2_ON);
3310 	if (error)
3311 		goto fail;
3312 
3313 	urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3314 	urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3315 	urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3316 	urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3317 	urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3318 
3319 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3320 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3321 	usbd_delay_ms(sc->sc_udev, 1);
3322 fail:
3323 	return (error);
3324 }
3325 
3326 usbd_status
3327 urtw_8225v2_rf_init(struct urtw_rf *rf)
3328 {
3329 	struct urtw_softc *sc = rf->rf_sc;
3330 	int i;
3331 	uint16_t data;
3332 	uint32_t data32;
3333 	usbd_status error;
3334 
3335 	error = urtw_8180_set_anaparam(sc, URTW_8187_8225_ANAPARAM_ON);
3336 	if (error)
3337 		goto fail;
3338 
3339 	error = urtw_8225_usb_init(sc);
3340 	if (error)
3341 		goto fail;
3342 
3343 	urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
3344 	urtw_read16_m(sc, URTW_8187_BRSR, &data);	/* XXX ??? */
3345 	urtw_write16_m(sc, URTW_8187_BRSR, 0xffff);
3346 	urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
3347 
3348 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3349 	if (error)
3350 		goto fail;
3351 	urtw_write8_m(sc, URTW_CONFIG3, 0x44);
3352 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3353 	if (error)
3354 		goto fail;
3355 
3356 	error = urtw_8185_rf_pins_enable(sc);
3357 	if (error)
3358 		goto fail;
3359 
3360 	usbd_delay_ms(sc->sc_udev, 1000);
3361 
3362 	for (i = 0; i < nitems(urtw_8225v2_rf_part1); i++) {
3363 		urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
3364 		    urtw_8225v2_rf_part1[i].val);
3365 		usbd_delay_ms(sc->sc_udev, 1);
3366 	}
3367 	usbd_delay_ms(sc->sc_udev, 50);
3368 
3369 	urtw_8225_write(sc, 0x0, 0x1b7);
3370 
3371 	for (i = 0; i < nitems(urtw_8225v2_rxgain); i++) {
3372 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3373 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3374 	}
3375 
3376 	urtw_8225_write(sc, 0x3, 0x2);
3377 	urtw_8225_write(sc, 0x5, 0x4);
3378 	urtw_8225_write(sc, 0x0, 0xb7);
3379 	urtw_8225_write(sc, 0x2, 0xc4d);
3380 	usbd_delay_ms(sc->sc_udev, 100);
3381 	urtw_8225_write(sc, 0x2, 0x44d);
3382 	usbd_delay_ms(sc->sc_udev, 100);
3383 
3384 	error = urtw_8225_read(sc, 0x6, &data32);
3385 	if (error != 0)
3386 		goto fail;
3387 	if (data32 != 0xe6)
3388 		printf("%s: expect 0xe6!! (0x%x)\n", sc->sc_dev.dv_xname,
3389 		    data32);
3390 	if (!(data32 & 0x80)) {
3391 		urtw_8225_write(sc, 0x02, 0x0c4d);
3392 		usbd_delay_ms(sc->sc_udev, 200);
3393 		urtw_8225_write(sc, 0x02, 0x044d);
3394 		usbd_delay_ms(sc->sc_udev, 100);
3395 		error = urtw_8225_read(sc, 0x6, &data32);
3396 		if (error != 0)
3397 			goto fail;
3398 		if (!(data32 & 0x80))
3399 			printf("%s: RF calibration failed\n",
3400 			    sc->sc_dev.dv_xname);
3401 	}
3402 	usbd_delay_ms(sc->sc_udev, 100);
3403 
3404 	urtw_8225_write(sc, 0x0, 0x2bf);
3405 	for (i = 0; i < nitems(urtw_8225_agc); i++) {
3406 		urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
3407 		urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
3408 	}
3409 
3410 	for (i = 0; i < nitems(urtw_8225v2_rf_part2); i++) {
3411 		urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
3412 		    urtw_8225v2_rf_part2[i].val);
3413 	}
3414 
3415 	error = urtw_8225v2_setgain(sc, 4);
3416 	if (error)
3417 		goto fail;
3418 
3419 	for (i = 0; i < nitems(urtw_8225v2_rf_part3); i++) {
3420 		urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
3421 		    urtw_8225v2_rf_part3[i].val);
3422 	}
3423 
3424 	urtw_write8_m(sc, 0x5b, 0x0d);
3425 
3426 	error = urtw_8225v2_set_txpwrlvl(sc, 1);
3427 	if (error)
3428 		goto fail;
3429 
3430 	urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
3431 	urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
3432 
3433 	/* TX ant A, 0x0 for B */
3434 	error = urtw_8185_tx_antenna(sc, 0x3);
3435 	if (error)
3436 		goto fail;
3437 	urtw_write32_m(sc, 0x94, 0x3dc00002);
3438 
3439 	error = urtw_8225_rf_set_chan(rf, 1);
3440 fail:
3441 	return (error);
3442 }
3443 
3444 usbd_status
3445 urtw_8225v2_rf_set_chan(struct urtw_rf *rf, int chan)
3446 {
3447 	struct urtw_softc *sc = rf->rf_sc;
3448 	struct ieee80211com *ic = &sc->sc_ic;
3449 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3450 	usbd_status error;
3451 
3452 	error = urtw_8225v2_set_txpwrlvl(sc, chan);
3453 	if (error)
3454 		goto fail;
3455 
3456 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3457 	usbd_delay_ms(sc->sc_udev, 10);
3458 
3459 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3460 
3461 	if(sc->sc_state == IEEE80211_S_ASSOC &&
3462 	    ic->ic_flags & IEEE80211_F_SHSLOT)
3463 		urtw_write8_m(sc, URTW_SLOT, 0x9);
3464 	else
3465 		urtw_write8_m(sc, URTW_SLOT, 0x14);
3466 
3467 	if (IEEE80211_IS_CHAN_G(c)) {
3468 		urtw_write8_m(sc, URTW_DIFS, 0x14);
3469 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x14);
3470 		urtw_write8_m(sc, URTW_CW_VAL, 0x73);
3471 	} else {
3472 		urtw_write8_m(sc, URTW_DIFS, 0x24);
3473 		urtw_write8_m(sc, URTW_8187_EIFS, 0x5b - 0x24);
3474 		urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
3475 	}
3476 
3477 fail:
3478 	return (error);
3479 }
3480 
3481 void
3482 urtw_set_chan(struct urtw_softc *sc, struct ieee80211_channel *c)
3483 {
3484 	struct urtw_rf *rf = &sc->sc_rf;
3485 	struct ieee80211com *ic = &sc->sc_ic;
3486 	usbd_status error = 0;
3487 	uint32_t data;
3488 	u_int chan;
3489 
3490 	chan = ieee80211_chan2ieee(ic, c);
3491 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3492 		return;
3493 	/*
3494 	 * During changing the channel we need to temporary disable
3495 	 * TX.
3496 	 */
3497 	urtw_read32_m(sc, URTW_TX_CONF, &data);
3498 	data &= ~URTW_TX_LOOPBACK_MASK;
3499 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
3500 	error = rf->set_chan(rf, chan);
3501 	if (error != 0) {
3502 		printf("%s could not change the channel\n",
3503 		    sc->sc_dev.dv_xname);
3504 		return;
3505 	}
3506 	usbd_delay_ms(sc->sc_udev, 10);
3507 	urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_NONE);
3508 
3509 fail:	return;
3510 
3511 }
3512 
3513 void
3514 urtw_next_scan(void *arg)
3515 {
3516 	struct urtw_softc *sc = arg;
3517 	struct ieee80211com *ic = &sc->sc_ic;
3518 	struct ifnet *ifp = &ic->ic_if;
3519 
3520 	if (usbd_is_dying(sc->sc_udev))
3521 		return;
3522 
3523 	usbd_ref_incr(sc->sc_udev);
3524 
3525 	if (ic->ic_state == IEEE80211_S_SCAN)
3526 		ieee80211_next_scan(ifp);
3527 
3528 	usbd_ref_decr(sc->sc_udev);
3529 }
3530 
3531 void
3532 urtw_task(void *arg)
3533 {
3534 	struct urtw_softc *sc = arg;
3535 	struct ieee80211com *ic = &sc->sc_ic;
3536 	struct ieee80211_node *ni;
3537 	enum ieee80211_state ostate;
3538 	usbd_status error = 0;
3539 
3540 	if (usbd_is_dying(sc->sc_udev))
3541 		return;
3542 
3543 	ostate = ic->ic_state;
3544 
3545 	switch (sc->sc_state) {
3546 	case IEEE80211_S_INIT:
3547 		if (ostate == IEEE80211_S_RUN) {
3548 			/* turn link LED off */
3549 			(void)urtw_led_off(sc, URTW_LED_GPIO);
3550 		}
3551 		break;
3552 
3553 	case IEEE80211_S_SCAN:
3554 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3555 		if (!usbd_is_dying(sc->sc_udev))
3556 			timeout_add_msec(&sc->scan_to, 200);
3557 		break;
3558 
3559 	case IEEE80211_S_AUTH:
3560 	case IEEE80211_S_ASSOC:
3561 		urtw_set_chan(sc, ic->ic_bss->ni_chan);
3562 		break;
3563 
3564 	case IEEE80211_S_RUN:
3565 		ni = ic->ic_bss;
3566 
3567 		/* setting bssid. */
3568 		error = urtw_set_bssid(sc, ni->ni_bssid);
3569 		if (error != 0)
3570 			goto fail;
3571 		urtw_update_msr(sc);
3572 		/* XXX maybe the below would be incorrect. */
3573 		urtw_write16_m(sc, URTW_ATIM_WND, 2);
3574 		urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
3575 		urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
3576 		urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 0x3ff);
3577 		error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
3578 		if (error != 0)
3579 			printf("%s: could not control LED (%d)\n",
3580 			    sc->sc_dev.dv_xname, error);
3581 		break;
3582 	}
3583 
3584 	sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
3585 
3586 fail:
3587 	if (error != 0)
3588 		DPRINTF(("%s: error duing processing RUN state.",
3589 		    sc->sc_dev.dv_xname));
3590 }
3591 
3592 usbd_status
3593 urtw_8187b_update_wmm(struct urtw_softc *sc)
3594 {
3595 	struct ieee80211com *ic = &sc->sc_ic;
3596 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3597 	uint32_t data;
3598 	uint8_t aifs, sifs, slot, ecwmin, ecwmax;
3599 	usbd_status error;
3600 
3601 	sifs = 0xa;
3602 	if (IEEE80211_IS_CHAN_G(c))
3603 		slot = 0x9;
3604 	else
3605 		slot = 0x14;
3606 
3607 	aifs = (2 * slot) + sifs;
3608 	ecwmin = 3;
3609 	ecwmax = 7;
3610 
3611 	data = ((uint32_t)aifs << 0) |		/* AIFS, offset 0 */
3612 	    ((uint32_t)ecwmin << 8) |		/* ECW minimum, offset 8 */
3613 	    ((uint32_t)ecwmax << 12);		/* ECW maximum, offset 16 */
3614 
3615 	urtw_write32_m(sc, URTW_AC_VO, data);
3616 	urtw_write32_m(sc, URTW_AC_VI, data);
3617 	urtw_write32_m(sc, URTW_AC_BE, data);
3618 	urtw_write32_m(sc, URTW_AC_BK, data);
3619 
3620 fail:
3621 	return (error);
3622 }
3623 
3624 usbd_status
3625 urtw_8187b_reset(struct urtw_softc *sc)
3626 {
3627 	uint8_t data;
3628 	usbd_status error;
3629 
3630 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3631 	if (error)
3632 		goto fail;
3633 
3634 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3635 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE |
3636 		URTW_CONFIG3_GNT_SELECT);
3637 
3638 	urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
3639 	urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
3640 	urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
3641 
3642 	urtw_write8_m(sc, 0x61, 0x10);
3643 	urtw_read8_m(sc, 0x62, &data);
3644 	urtw_write8_m(sc, 0x62, data & ~(1 << 5));
3645 	urtw_write8_m(sc, 0x62, data | (1 << 5));
3646 
3647 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3648 	urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3649 
3650 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3651 	if (error)
3652 		goto fail;
3653 
3654 	urtw_read8_m(sc, URTW_CMD, &data);
3655 	data = (data & 2) | URTW_CMD_RST;
3656 	urtw_write8_m(sc, URTW_CMD, data);
3657 	usbd_delay_ms(sc->sc_udev, 100);
3658 
3659 	urtw_read8_m(sc, URTW_CMD, &data);
3660 	if (data & URTW_CMD_RST) {
3661 		printf("%s: reset timeout\n", sc->sc_dev.dv_xname);
3662 		goto fail;
3663 	}
3664 
3665 fail:
3666 	return (error);
3667 }
3668 
3669 int
3670 urtw_8187b_init(struct ifnet *ifp)
3671 {
3672 	struct urtw_softc *sc = ifp->if_softc;
3673 	struct urtw_rf *rf = &sc->sc_rf;
3674 	struct ieee80211com *ic = &sc->sc_ic;
3675 	int ret;
3676 	uint8_t data;
3677 	usbd_status error;
3678 
3679 	urtw_stop(ifp, 0);
3680 
3681 	error = urtw_8187b_update_wmm(sc);
3682 	if (error != 0)
3683 		goto fail;
3684 	error = urtw_8187b_reset(sc);
3685 	if (error)
3686 		goto fail;
3687 
3688 	/* Applying MAC address again. */
3689 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3690 	if (error)
3691 		goto fail;
3692 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
3693 	error = urtw_set_macaddr(sc, ic->ic_myaddr);
3694 	if (error)
3695 		goto fail;
3696 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3697 	if (error)
3698 		goto fail;
3699 
3700 	error = urtw_update_msr(sc);
3701 	if (error)
3702 		goto fail;
3703 
3704 	error = rf->init(rf);
3705 	if (error != 0)
3706 		goto fail;
3707 
3708 	urtw_write8_m(sc, URTW_CMD, URTW_CMD_TX_ENABLE |
3709 		URTW_CMD_RX_ENABLE);
3710 	error = urtw_intr_enable(sc);
3711 	if (error != 0)
3712 		goto fail;
3713 
3714 	error = urtw_write8e(sc, 0x41, 0xf4);
3715 	if (error != 0)
3716 		goto fail;
3717 	error = urtw_write8e(sc, 0x40, 0x00);
3718 	if (error != 0)
3719 		goto fail;
3720 	error = urtw_write8e(sc, 0x42, 0x00);
3721 	if (error != 0)
3722 		goto fail;
3723 	error = urtw_write8e(sc, 0x42, 0x01);
3724 	if (error != 0)
3725 		goto fail;
3726 	error = urtw_write8e(sc, 0x40, 0x0f);
3727 	if (error != 0)
3728 		goto fail;
3729 	error = urtw_write8e(sc, 0x42, 0x00);
3730 	if (error != 0)
3731 		goto fail;
3732 	error = urtw_write8e(sc, 0x42, 0x01);
3733 	if (error != 0)
3734 		goto fail;
3735 
3736 	urtw_read8_m(sc, 0xdb, &data);
3737 	urtw_write8_m(sc, 0xdb, data | (1 << 2));
3738 	urtw_write16_idx_m(sc, 0x72, 0x59fa, 3);
3739 	urtw_write16_idx_m(sc, 0x74, 0x59d2, 3);
3740 	urtw_write16_idx_m(sc, 0x76, 0x59d2, 3);
3741 	urtw_write16_idx_m(sc, 0x78, 0x19fa, 3);
3742 	urtw_write16_idx_m(sc, 0x7a, 0x19fa, 3);
3743 	urtw_write16_idx_m(sc, 0x7c, 0x00d0, 3);
3744 	urtw_write8_m(sc, 0x61, 0);
3745 	urtw_write8_idx_m(sc, 0x80, 0x0f, 1);
3746 	urtw_write8_idx_m(sc, 0x83, 0x03, 1);
3747 	urtw_write8_m(sc, 0xda, 0x10);
3748 	urtw_write8_idx_m(sc, 0x4d, 0x08, 2);
3749 
3750 	urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
3751 
3752 	urtw_write16_idx_m(sc, 0xec, 0x0800, 1);
3753 
3754 	urtw_write8_m(sc, URTW_ACM_CONTROL, 0);
3755 
3756 	/* Reset softc variables. */
3757 	sc->sc_txidx = sc->sc_tx_low_queued = sc->sc_tx_normal_queued = 0;
3758 	sc->sc_txtimer = 0;
3759 
3760 	if (!(sc->sc_flags & URTW_INIT_ONCE)) {
3761 		error = usbd_set_config_no(sc->sc_udev, URTW_CONFIG_NO, 0);
3762 		if (error != 0) {
3763 			printf("%s: could not set configuration no\n",
3764 			    sc->sc_dev.dv_xname);
3765 			goto fail;
3766 		}
3767 		/* Get the first interface handle. */
3768 		error = usbd_device2interface_handle(sc->sc_udev,
3769 		    URTW_IFACE_INDEX, &sc->sc_iface);
3770 		if (error != 0) {
3771 			printf("%s: could not get interface handle\n",
3772 			    sc->sc_dev.dv_xname);
3773 			goto fail;
3774 		}
3775 		error = urtw_open_pipes(sc);
3776 		if (error != 0)
3777 			goto fail;
3778 		ret = urtw_alloc_rx_data_list(sc);
3779 		if (error != 0)
3780 			goto fail;
3781 		ret = urtw_alloc_tx_data_list(sc);
3782 		if (error != 0)
3783 			goto fail;
3784 		sc->sc_flags |= URTW_INIT_ONCE;
3785 	}
3786 
3787 	error = urtw_rx_enable(sc);
3788 	if (error != 0)
3789 		goto fail;
3790 	error = urtw_tx_enable(sc);
3791 	if (error != 0)
3792 		goto fail;
3793 
3794 	ifp->if_flags &= ~IFF_OACTIVE;
3795 	ifp->if_flags |= IFF_RUNNING;
3796 
3797 	ifp->if_timer = 1;
3798 
3799 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
3800 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3801 	else
3802 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3803 
3804 fail:
3805 	return (error);
3806 }
3807 
3808 usbd_status
3809 urtw_8225v2_b_config_mac(struct urtw_softc *sc)
3810 {
3811 	int i;
3812 	usbd_status error;
3813 
3814 	for (i = 0; i < nitems(urtw_8187b_regtbl); i++) {
3815 		urtw_write8_idx_m(sc, urtw_8187b_regtbl[i].reg,
3816 		    urtw_8187b_regtbl[i].val, urtw_8187b_regtbl[i].idx);
3817 	}
3818 
3819 	urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3820 	urtw_write16_m(sc, URTW_INT_MIG, 0);
3821 
3822 	urtw_write32_idx_m(sc, 0xf0, 0, 1);
3823 	urtw_write32_idx_m(sc, 0xf4, 0, 1);
3824 	urtw_write8_idx_m(sc, 0xf8, 0, 1);
3825 
3826 	urtw_write32_m(sc, URTW_RF_TIMING, 0x00004001);
3827 
3828 fail:
3829 	return (error);
3830 }
3831 
3832 usbd_status
3833 urtw_8225v2_b_init_rfe(struct urtw_softc *sc)
3834 {
3835 	usbd_status error;
3836 
3837 	urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3838 	urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3839 	urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3840 	usbd_delay_ms(sc->sc_udev, 100);
3841 
3842 fail:
3843 	return (error);
3844 }
3845 
3846 usbd_status
3847 urtw_8225v2_b_update_chan(struct urtw_softc *sc)
3848 {
3849 	struct ieee80211com *ic = &sc->sc_ic;
3850 	struct ieee80211_channel *c = ic->ic_ibss_chan;
3851 	uint8_t aifs, difs, eifs, sifs, slot;
3852 	usbd_status error;
3853 
3854 	urtw_write8_m(sc, URTW_SIFS, 0x22);
3855 
3856 	sifs = 0xa;
3857 	if (IEEE80211_IS_CHAN_G(c)) {
3858 		slot = 0x9;
3859 		difs = 0x1c;
3860 		eifs = 0x5b;
3861 	} else {
3862 		slot = 0x14;
3863 		difs = 0x32;
3864 		eifs = 0x5b;
3865 	}
3866 	aifs = (2 * slot) + sifs;
3867 
3868 	urtw_write8_m(sc, URTW_SLOT, slot);
3869 
3870 	urtw_write8_m(sc, URTW_AC_VO, aifs);
3871 	urtw_write8_m(sc, URTW_AC_VI, aifs);
3872 	urtw_write8_m(sc, URTW_AC_BE, aifs);
3873 	urtw_write8_m(sc, URTW_AC_BK, aifs);
3874 
3875 	urtw_write8_m(sc, URTW_DIFS, difs);
3876 	urtw_write8_m(sc, URTW_8187B_EIFS, eifs);
3877 
3878 fail:
3879 	return (error);
3880 }
3881 
3882 usbd_status
3883 urtw_8225v2_b_rf_init(struct urtw_rf *rf)
3884 {
3885 	struct urtw_softc *sc = rf->rf_sc;
3886 	int i;
3887 	uint8_t data;
3888 	usbd_status error;
3889 
3890 	/* Set up ACK rate, retry limit, TX AGC, TX antenna. */
3891 	urtw_write16_m(sc, URTW_8187B_BRSR, 0x0fff);
3892 	urtw_read8_m(sc, URTW_CW_CONF, &data);
3893 	urtw_write8_m(sc, URTW_CW_CONF, data |
3894 		URTW_CW_CONF_PERPACKET_RETRY);
3895 	urtw_read8_m(sc, URTW_TX_AGC_CTL, &data);
3896 	urtw_write8_m(sc, URTW_TX_AGC_CTL, data |
3897 		URTW_TX_AGC_CTL_PERPACKET_GAIN |
3898 		URTW_TX_AGC_CTL_PERPACKET_ANTSEL);
3899 
3900 	/* Auto rate fallback control. */
3901 	urtw_write16_idx_m(sc, URTW_ARFR, 0x0fff, 1);	/* 1M ~ 54M */
3902 	urtw_read8_m(sc, URTW_RATE_FALLBACK, &data);
3903 	urtw_write8_m(sc, URTW_RATE_FALLBACK, data |
3904 		URTW_RATE_FALLBACK_ENABLE);
3905 
3906 	urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3907 	urtw_write16_m(sc, URTW_ATIM_WND, 2);
3908 	urtw_write16_idx_m(sc, URTW_FEMR, 0xffff, 1);
3909 
3910 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3911 	if (error)
3912 		goto fail;
3913 	urtw_read8_m(sc, URTW_CONFIG1, &data);
3914 	urtw_write8_m(sc, URTW_CONFIG1, (data & 0x3f) | 0x80);
3915 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3916 	if (error)
3917 		goto fail;
3918 
3919 	urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3920 	urtw_8225v2_b_config_mac(sc);
3921 	urtw_write16_idx_m(sc, URTW_RFSW_CTRL, 0x569a, 2);
3922 
3923 	error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3924 	if (error)
3925 		goto fail;
3926 	urtw_read8_m(sc, URTW_CONFIG3, &data);
3927 	urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3928 	error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3929 	if (error)
3930 		goto fail;
3931 
3932 	urtw_8225v2_b_init_rfe(sc);
3933 
3934 	for (i = 0; i < nitems(urtw_8225v2_b_rf); i++) {
3935 		urtw_8225_write(sc, urtw_8225v2_b_rf[i].reg,
3936 		    urtw_8225v2_b_rf[i].val);
3937 	}
3938 
3939 	for (i = 0; i < nitems(urtw_8225v2_rxgain); i++) {
3940 		urtw_8225_write(sc, 0x1, (uint8_t)(i + 1));
3941 		urtw_8225_write(sc, 0x2, urtw_8225v2_rxgain[i]);
3942 	}
3943 
3944 	urtw_8225_write(sc, 0x03, 0x080);
3945 	urtw_8225_write(sc, 0x05, 0x004);
3946 	urtw_8225_write(sc, 0x00, 0x0b7);
3947 	urtw_8225_write(sc, 0x02, 0xc4d);
3948 	urtw_8225_write(sc, 0x02, 0x44d);
3949 	urtw_8225_write(sc, 0x00, 0x2bf);
3950 
3951 	urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3952 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3953 	urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3954 
3955 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3956 	for (i = 0; i < nitems(urtw_8225v2_agc); i++) {
3957 		urtw_8187_write_phy_ofdm(sc, 0x0f, urtw_8225v2_agc[i]);
3958 		urtw_8187_write_phy_ofdm(sc, 0x0e, (uint8_t)i + 0x80);
3959 		urtw_8187_write_phy_ofdm(sc, 0x0e, 0);
3960 	}
3961 	urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3962 
3963 	for (i = 0; i < nitems(urtw_8225v2_ofdm); i++)
3964 		urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2_ofdm[i]);
3965 
3966 	urtw_8225v2_b_update_chan(sc);
3967 
3968 	urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3969 	urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3970 	urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3971 	urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3972 
3973 	error = urtw_8225v2_b_rf_set_chan(rf, 1);
3974 fail:
3975 	return (error);
3976 }
3977 
3978 usbd_status
3979 urtw_8225v2_b_rf_set_chan(struct urtw_rf *rf, int chan)
3980 {
3981 	struct urtw_softc *sc = rf->rf_sc;
3982 	usbd_status error;
3983 
3984 	error = urtw_8225v2_b_set_txpwrlvl(sc, chan);
3985 	if (error)
3986 		goto fail;
3987 
3988 	urtw_8225_write(sc, 0x7, urtw_8225_channel[chan]);
3989 	/*
3990 	 * Delay removed from 8185 to 8187.
3991 	 * usbd_delay_ms(sc->sc_udev, 10);
3992 	 */
3993 
3994 	urtw_write16_m(sc, URTW_AC_VO, 0x5114);
3995 	urtw_write16_m(sc, URTW_AC_VI, 0x5114);
3996 	urtw_write16_m(sc, URTW_AC_BE, 0x5114);
3997 	urtw_write16_m(sc, URTW_AC_BK, 0x5114);
3998 
3999 fail:
4000 	return (error);
4001 }
4002 
4003 usbd_status
4004 urtw_8225v2_b_set_txpwrlvl(struct urtw_softc *sc, int chan)
4005 {
4006 	int i;
4007 	uint8_t *cck_pwrtable;
4008 	uint8_t cck_pwrlvl_min, cck_pwrlvl_max, ofdm_pwrlvl_min,
4009 	    ofdm_pwrlvl_max;
4010 	int8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
4011 	int8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
4012 	usbd_status error;
4013 
4014 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4015 		cck_pwrlvl_min = 0;
4016 		cck_pwrlvl_max = 15;
4017 		ofdm_pwrlvl_min = 2;
4018 		ofdm_pwrlvl_max = 17;
4019 	} else {
4020 		cck_pwrlvl_min = 7;
4021 		cck_pwrlvl_max = 22;
4022 		ofdm_pwrlvl_min = 10;
4023 		ofdm_pwrlvl_max = 25;
4024 	}
4025 
4026 	/* CCK power setting */
4027 	cck_pwrlvl = (cck_pwrlvl > (cck_pwrlvl_max - cck_pwrlvl_min)) ?
4028 	    cck_pwrlvl_max : (cck_pwrlvl + cck_pwrlvl_min);
4029 
4030 	cck_pwrlvl += sc->sc_txpwr_cck_base;
4031 	cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
4032 	cck_pwrlvl = (cck_pwrlvl < 0) ? 0 : cck_pwrlvl;
4033 
4034 	cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
4035 	    urtw_8225v2_txpwr_cck;
4036 
4037 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4038 		if (cck_pwrlvl <= 6)
4039 			; /* do nothing */
4040 		else if (cck_pwrlvl <= 11)
4041 			cck_pwrtable += 8;
4042 		else
4043 			cck_pwrtable += 16;
4044 	} else {
4045 		if (cck_pwrlvl <= 5)
4046 			; /* do nothing */
4047 		else if (cck_pwrlvl <= 11)
4048 			cck_pwrtable += 8;
4049 		else if (cck_pwrlvl <= 17)
4050 			cck_pwrtable += 16;
4051 		else
4052 			cck_pwrtable += 24;
4053 	}
4054 
4055 	for (i = 0; i < 8; i++) {
4056 		urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
4057 	}
4058 
4059 	urtw_write8_m(sc, URTW_TX_GAIN_CCK,
4060 	    urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
4061 	/*
4062 	 * Delay removed from 8185 to 8187.
4063 	 * usbd_delay_ms(sc->sc_udev, 1);
4064 	 */
4065 
4066 	/* OFDM power setting */
4067 	ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
4068 	    ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
4069 
4070 	ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
4071 	ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
4072 	ofdm_pwrlvl = (ofdm_pwrlvl < 0) ? 0 : ofdm_pwrlvl;
4073 
4074 	urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
4075 	    urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
4076 
4077 	if (sc->sc_hwrev & URTW_HWREV_8187B_B) {
4078 		if (ofdm_pwrlvl <= 11) {
4079 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
4080 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
4081 		} else {
4082 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4083 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4084 		}
4085 	} else {
4086 		if (ofdm_pwrlvl <= 11) {
4087 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
4088 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
4089 		} else if (ofdm_pwrlvl <= 17) {
4090 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
4091 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
4092 		} else {
4093 			urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
4094 			urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
4095 		}
4096 	}
4097 
4098 	/*
4099 	 * Delay removed from 8185 to 8187.
4100 	 * usbd_delay_ms(sc->sc_udev, 1);
4101 	 */
4102 fail:
4103 	return (error);
4104 }
4105 
4106 int
4107 urtw_set_bssid(struct urtw_softc *sc, const uint8_t *bssid)
4108 {
4109 	int error;
4110 
4111 	urtw_write32_m(sc, URTW_BSSID,
4112 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
4113 	urtw_write16_m(sc, URTW_BSSID + 4,
4114 	    bssid[4] | bssid[5] << 8);
4115 
4116 	return 0;
4117 
4118 fail:
4119 	return error;
4120 }
4121 
4122 int
4123 urtw_set_macaddr(struct urtw_softc *sc, const uint8_t *addr)
4124 {
4125 	int error;
4126 
4127 	urtw_write32_m(sc, URTW_MAC0,
4128 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
4129 	urtw_write16_m(sc, URTW_MAC4,
4130 	    addr[4] | addr[5] << 8);
4131 
4132 	return 0;
4133 
4134 fail:
4135 	return error;
4136 }
4137