sys/dev/usb/wlan/if_urtw.c

   1 /*-
   2  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <sys/cdefs.h>
  18 __FBSDID("$FreeBSD$");
  19
  20 #include "opt_wlan.h"
  21
  22 #include <sys/param.h>
  23 #include <sys/sockio.h>
  24 #include <sys/sysctl.h>
  25 #include <sys/lock.h>
  26 #include <sys/mutex.h>
  27 #include <sys/mbuf.h>
  28 #include <sys/kernel.h>
  29 #include <sys/socket.h>
  30 #include <sys/systm.h>
  31 #include <sys/malloc.h>
  32 #include <sys/module.h>
  33 #include <sys/bus.h>
  34 #include <sys/endian.h>
  35 #include <sys/kdb.h>
  36
  37 #include <net/if.h>
  38 #include <net/if_var.h>
  39 #include <net/if_arp.h>
  40 #include <net/ethernet.h>
  41 #include <net/if_dl.h>
  42 #include <net/if_media.h>
  43 #include <net/if_types.h>
  44
  45 #ifdef INET
  46 #include <netinet/in.h>
  47 #include <netinet/in_systm.h>
  48 #include <netinet/in_var.h>
  49 #include <netinet/if_ether.h>
  50 #include <netinet/ip.h>
  51 #endif
  52
  53 #include <net80211/ieee80211_var.h>
  54 #include <net80211/ieee80211_regdomain.h>
  55 #include <net80211/ieee80211_radiotap.h>
  56
  57 #include <dev/usb/usb.h>
  58 #include <dev/usb/usbdi.h>
  59 #include "usbdevs.h"
  60
  61 #include <dev/usb/wlan/if_urtwreg.h>
  62 #include <dev/usb/wlan/if_urtwvar.h>
  63
  64 /* copy some rate indices from if_rtwn_ridx.h */
  65 #define URTW_RIDX_CCK5          2
  66 #define URTW_RIDX_CCK11         3
  67 #define URTW_RIDX_OFDM6         4
  68 #define URTW_RIDX_OFDM24        8
  69
  70 static SYSCTL_NODE(_hw_usb, OID_AUTO, urtw, CTLFLAG_RW, 0, "USB Realtek 8187L");
  71 #ifdef URTW_DEBUG
  72 int urtw_debug = 0;
  73 SYSCTL_INT(_hw_usb_urtw, OID_AUTO, debug, CTLFLAG_RWTUN, &urtw_debug, 0,
  74     "control debugging printfs");
  75 enum {
  76         URTW_DEBUG_XMIT         = 0x00000001,   /* basic xmit operation */
  77         URTW_DEBUG_RECV         = 0x00000002,   /* basic recv operation */
  78         URTW_DEBUG_RESET        = 0x00000004,   /* reset processing */
  79         URTW_DEBUG_TX_PROC      = 0x00000008,   /* tx ISR proc */
  80         URTW_DEBUG_RX_PROC      = 0x00000010,   /* rx ISR proc */
  81         URTW_DEBUG_STATE        = 0x00000020,   /* 802.11 state transitions */
  82         URTW_DEBUG_STAT         = 0x00000040,   /* statistic */
  83         URTW_DEBUG_INIT         = 0x00000080,   /* initialization of dev */
  84         URTW_DEBUG_TXSTATUS     = 0x00000100,   /* tx status */
  85         URTW_DEBUG_ANY          = 0xffffffff
  86 };
  87 #define DPRINTF(sc, m, fmt, ...) do {                           \
  88         if (sc->sc_debug & (m))                                 \
  89                 printf(fmt, __VA_ARGS__);                       \
  90 } while (0)
  91 #else
  92 #define DPRINTF(sc, m, fmt, ...) do {                           \
  93         (void) sc;                                              \
  94 } while (0)
  95 #endif
  96 static int urtw_preamble_mode = URTW_PREAMBLE_MODE_LONG;
  97 SYSCTL_INT(_hw_usb_urtw, OID_AUTO, preamble_mode, CTLFLAG_RWTUN,
  98     &urtw_preamble_mode, 0, "set the preable mode (long or short)");
  99
 100 /* recognized device vendors/products */
 101 #define urtw_lookup(v, p)                                               \
 102         ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
 103 #define URTW_DEV_B(v,p)                                                 \
 104         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTW_REV_RTL8187B) }
 105 #define URTW_DEV_L(v,p)                                                 \
 106         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTW_REV_RTL8187L) }
 107 #define URTW_REV_RTL8187B       0
 108 #define URTW_REV_RTL8187L       1
 109 static const STRUCT_USB_HOST_ID urtw_devs[] = {
 110         URTW_DEV_B(NETGEAR, WG111V3),
 111         URTW_DEV_B(REALTEK, RTL8187B_0),
 112         URTW_DEV_B(REALTEK, RTL8187B_1),
 113         URTW_DEV_B(REALTEK, RTL8187B_2),
 114         URTW_DEV_B(SITECOMEU, WL168V4),
 115         URTW_DEV_L(ASUS, P5B_WIFI),
 116         URTW_DEV_L(BELKIN, F5D7050E),
 117         URTW_DEV_L(LINKSYS4, WUSB54GCV2),
 118         URTW_DEV_L(NETGEAR, WG111V2),
 119         URTW_DEV_L(REALTEK, RTL8187),
 120         URTW_DEV_L(SITECOMEU, WL168V1),
 121         URTW_DEV_L(SURECOM, EP9001G2A),
 122         { USB_VPI(USB_VENDOR_OVISLINK, 0x8187, URTW_REV_RTL8187L) },
 123         { USB_VPI(USB_VENDOR_DICKSMITH, 0x9401, URTW_REV_RTL8187L) },
 124         { USB_VPI(USB_VENDOR_HP, 0xca02, URTW_REV_RTL8187L) },
 125         { USB_VPI(USB_VENDOR_LOGITEC, 0x010c, URTW_REV_RTL8187L) },
 126         { USB_VPI(USB_VENDOR_NETGEAR, 0x6100, URTW_REV_RTL8187L) },
 127         { USB_VPI(USB_VENDOR_SPHAIRON, 0x0150, URTW_REV_RTL8187L) },
 128         { USB_VPI(USB_VENDOR_QCOM, 0x6232, URTW_REV_RTL8187L) },
 129 #undef URTW_DEV_L
 130 #undef URTW_DEV_B
 131 };
 132
 133 #define urtw_read8_m(sc, val, data)     do {                    \
 134         error = urtw_read8_c(sc, val, data);                    \
 135         if (error != 0)                                         \
 136                 goto fail;                                      \
 137 } while (0)
 138 #define urtw_write8_m(sc, val, data)    do {                    \
 139         error = urtw_write8_c(sc, val, data);                   \
 140         if (error != 0)                                         \
 141                 goto fail;                                      \
 142 } while (0)
 143 #define urtw_read16_m(sc, val, data)    do {                    \
 144         error = urtw_read16_c(sc, val, data);                   \
 145         if (error != 0)                                         \
 146                 goto fail;                                      \
 147 } while (0)
 148 #define urtw_write16_m(sc, val, data)   do {                    \
 149         error = urtw_write16_c(sc, val, data);                  \
 150         if (error != 0)                                         \
 151                 goto fail;                                      \
 152 } while (0)
 153 #define urtw_read32_m(sc, val, data)    do {                    \
 154         error = urtw_read32_c(sc, val, data);                   \
 155         if (error != 0)                                         \
 156                 goto fail;                                      \
 157 } while (0)
 158 #define urtw_write32_m(sc, val, data)   do {                    \
 159         error = urtw_write32_c(sc, val, data);                  \
 160         if (error != 0)                                         \
 161                 goto fail;                                      \
 162 } while (0)
 163 #define urtw_8187_write_phy_ofdm(sc, val, data) do {            \
 164         error = urtw_8187_write_phy_ofdm_c(sc, val, data);      \
 165         if (error != 0)                                         \
 166                 goto fail;                                      \
 167 } while (0)
 168 #define urtw_8187_write_phy_cck(sc, val, data)  do {            \
 169         error = urtw_8187_write_phy_cck_c(sc, val, data);       \
 170         if (error != 0)                                         \
 171                 goto fail;                                      \
 172 } while (0)
 173 #define urtw_8225_write(sc, val, data)  do {                    \
 174         error = urtw_8225_write_c(sc, val, data);               \
 175         if (error != 0)                                         \
 176                 goto fail;                                      \
 177 } while (0)
 178
 179 struct urtw_pair {
 180         uint32_t        reg;
 181         uint32_t        val;
 182 };
 183
 184 static uint8_t urtw_8225_agc[] = {
 185         0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
 186         0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
 187         0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
 188         0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
 189         0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
 190         0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
 191         0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
 192         0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
 193         0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
 194         0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
 195         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
 196         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
 197 };
 198
 199 static uint8_t urtw_8225z2_agc[] = {
 200         0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57, 0x55, 0x53, 0x51,
 201         0x4f, 0x4d, 0x4b, 0x49, 0x47, 0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b,
 202         0x39, 0x37, 0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27, 0x25,
 203         0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17, 0x15, 0x13, 0x11, 0x0f,
 204         0x0d, 0x0b, 0x09, 0x07, 0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01,
 205         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x19, 0x19,
 206         0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x20, 0x21, 0x22, 0x23,
 207         0x24, 0x25, 0x26, 0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
 208         0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d, 0x2d, 0x2d, 0x2d,
 209         0x2e, 0x2e, 0x2e, 0x2e, 0x2f, 0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31,
 210         0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
 211         0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
 212 };
 213
 214 static uint32_t urtw_8225_channel[] = {
 215         0x0000,         /* dummy channel 0  */
 216         0x085c,         /* 1  */
 217         0x08dc,         /* 2  */
 218         0x095c,         /* 3  */
 219         0x09dc,         /* 4  */
 220         0x0a5c,         /* 5  */
 221         0x0adc,         /* 6  */
 222         0x0b5c,         /* 7  */
 223         0x0bdc,         /* 8  */
 224         0x0c5c,         /* 9  */
 225         0x0cdc,         /* 10  */
 226         0x0d5c,         /* 11  */
 227         0x0ddc,         /* 12  */
 228         0x0e5c,         /* 13  */
 229         0x0f72,         /* 14  */
 230 };
 231
 232 static uint8_t urtw_8225_gain[] = {
 233         0x23, 0x88, 0x7c, 0xa5,         /* -82dbm  */
 234         0x23, 0x88, 0x7c, 0xb5,         /* -82dbm  */
 235         0x23, 0x88, 0x7c, 0xc5,         /* -82dbm  */
 236         0x33, 0x80, 0x79, 0xc5,         /* -78dbm  */
 237         0x43, 0x78, 0x76, 0xc5,         /* -74dbm  */
 238         0x53, 0x60, 0x73, 0xc5,         /* -70dbm  */
 239         0x63, 0x58, 0x70, 0xc5,         /* -66dbm  */
 240 };
 241
 242 static struct urtw_pair urtw_8225_rf_part1[] = {
 243         { 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 244         { 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
 245         { 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
 246         { 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 },
 247 };
 248
 249 static struct urtw_pair urtw_8225_rf_part2[] = {
 250         { 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
 251         { 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
 252         { 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
 253         { 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
 254         { 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
 255         { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
 256         { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
 257         { 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
 258         { 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
 259         { 0x27, 0x88 }
 260 };
 261
 262 static struct urtw_pair urtw_8225_rf_part3[] = {
 263         { 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
 264         { 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
 265         { 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
 266         { 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
 267         { 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
 268         { 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
 269         { 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
 270 };
 271
 272 static uint16_t urtw_8225_rxgain[] = {
 273         0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
 274         0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
 275         0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
 276         0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
 277         0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
 278         0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
 279         0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
 280         0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
 281         0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
 282         0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
 283         0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
 284         0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
 285 };
 286
 287 static uint8_t urtw_8225_threshold[] = {
 288         0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd,
 289 };
 290
 291 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
 292         0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
 293 };
 294
 295 static uint8_t urtw_8225_txpwr_cck[] = {
 296         0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
 297         0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
 298         0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
 299         0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
 300         0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
 301         0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
 302 };
 303
 304 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
 305         0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
 306         0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
 307         0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
 308         0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
 309         0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
 310         0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
 311 };
 312
 313 static uint8_t urtw_8225_txpwr_ofdm[]={
 314         0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
 315 };
 316
 317 static uint8_t urtw_8225v2_gain_bg[]={
 318         0x23, 0x15, 0xa5,               /* -82-1dbm  */
 319         0x23, 0x15, 0xb5,               /* -82-2dbm  */
 320         0x23, 0x15, 0xc5,               /* -82-3dbm  */
 321         0x33, 0x15, 0xc5,               /* -78dbm  */
 322         0x43, 0x15, 0xc5,               /* -74dbm  */
 323         0x53, 0x15, 0xc5,               /* -70dbm  */
 324         0x63, 0x15, 0xc5,               /* -66dbm  */
 325 };
 326
 327 static struct urtw_pair urtw_8225v2_rf_part1[] = {
 328         { 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 329         { 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
 330         { 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
 331         { 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
 332 };
 333
 334 static struct urtw_pair urtw_8225v2b_rf_part0[] = {
 335         { 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 336         { 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
 337         { 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
 338         { 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
 339 };
 340
 341 static struct urtw_pair urtw_8225v2b_rf_part1[] = {
 342         {0x0f0, 0x32}, {0x0f1, 0x32}, {0x0f2, 0x00},
 343         {0x0f3, 0x00}, {0x0f4, 0x32}, {0x0f5, 0x43},
 344         {0x0f6, 0x00}, {0x0f7, 0x00}, {0x0f8, 0x46},
 345         {0x0f9, 0xa4}, {0x0fa, 0x00}, {0x0fb, 0x00},
 346         {0x0fc, 0x96}, {0x0fd, 0xa4}, {0x0fe, 0x00},
 347         {0x0ff, 0x00}, {0x158, 0x4b}, {0x159, 0x00},
 348         {0x15a, 0x4b}, {0x15b, 0x00}, {0x160, 0x4b},
 349         {0x161, 0x09}, {0x162, 0x4b}, {0x163, 0x09},
 350         {0x1ce, 0x0f}, {0x1cf, 0x00}, {0x1e0, 0xff},
 351         {0x1e1, 0x0f}, {0x1e2, 0x00}, {0x1f0, 0x4e},
 352         {0x1f1, 0x01}, {0x1f2, 0x02}, {0x1f3, 0x03},
 353         {0x1f4, 0x04}, {0x1f5, 0x05}, {0x1f6, 0x06},
 354         {0x1f7, 0x07}, {0x1f8, 0x08}, {0x24e, 0x00},
 355         {0x20c, 0x04}, {0x221, 0x61}, {0x222, 0x68},
 356         {0x223, 0x6f}, {0x224, 0x76}, {0x225, 0x7d},
 357         {0x226, 0x84}, {0x227, 0x8d}, {0x24d, 0x08},
 358         {0x250, 0x05}, {0x251, 0xf5}, {0x252, 0x04},
 359         {0x253, 0xa0}, {0x254, 0x1f}, {0x255, 0x23},
 360         {0x256, 0x45}, {0x257, 0x67}, {0x258, 0x08},
 361         {0x259, 0x08}, {0x25a, 0x08}, {0x25b, 0x08},
 362         {0x260, 0x08}, {0x261, 0x08}, {0x262, 0x08},
 363         {0x263, 0x08}, {0x264, 0xcf}, {0x272, 0x56},
 364         {0x273, 0x9a}, {0x034, 0xf0}, {0x035, 0x0f},
 365         {0x05b, 0x40}, {0x084, 0x88}, {0x085, 0x24},
 366         {0x088, 0x54}, {0x08b, 0xb8}, {0x08c, 0x07},
 367         {0x08d, 0x00}, {0x094, 0x1b}, {0x095, 0x12},
 368         {0x096, 0x00}, {0x097, 0x06}, {0x09d, 0x1a},
 369         {0x09f, 0x10}, {0x0b4, 0x22}, {0x0be, 0x80},
 370         {0x0db, 0x00}, {0x0ee, 0x00}, {0x091, 0x03},
 371         {0x24c, 0x00}, {0x39f, 0x00}, {0x08c, 0x01},
 372         {0x08d, 0x10}, {0x08e, 0x08}, {0x08f, 0x00}
 373 };
 374
 375 static struct urtw_pair urtw_8225v2_rf_part2[] = {
 376         { 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
 377         { 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
 378         { 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
 379         { 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
 380         { 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
 381         { 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
 382         { 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
 383         { 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
 384         { 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
 385         { 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
 386 };
 387
 388 static struct urtw_pair urtw_8225v2b_rf_part2[] = {
 389         { 0x00, 0x10 }, { 0x01, 0x0d }, { 0x02, 0x01 }, { 0x03, 0x00 },
 390         { 0x04, 0x14 }, { 0x05, 0xfb }, { 0x06, 0xfb }, { 0x07, 0x60 },
 391         { 0x08, 0x00 }, { 0x09, 0x60 }, { 0x0a, 0x00 }, { 0x0b, 0x00 },
 392         { 0x0c, 0x00 }, { 0x0d, 0x5c }, { 0x0e, 0x00 }, { 0x0f, 0x00 },
 393         { 0x10, 0x40 }, { 0x11, 0x00 }, { 0x12, 0x40 }, { 0x13, 0x00 },
 394         { 0x14, 0x00 }, { 0x15, 0x00 }, { 0x16, 0xa8 }, { 0x17, 0x26 },
 395         { 0x18, 0x32 }, { 0x19, 0x33 }, { 0x1a, 0x07 }, { 0x1b, 0xa5 },
 396         { 0x1c, 0x6f }, { 0x1d, 0x55 }, { 0x1e, 0xc8 }, { 0x1f, 0xb3 },
 397         { 0x20, 0x0a }, { 0x21, 0xe1 }, { 0x22, 0x2C }, { 0x23, 0x8a },
 398         { 0x24, 0x86 }, { 0x25, 0x83 }, { 0x26, 0x34 }, { 0x27, 0x0f },
 399         { 0x28, 0x4f }, { 0x29, 0x24 }, { 0x2a, 0x6f }, { 0x2b, 0xc2 },
 400         { 0x2c, 0x6b }, { 0x2d, 0x40 }, { 0x2e, 0x80 }, { 0x2f, 0x00 },
 401         { 0x30, 0xc0 }, { 0x31, 0xc1 }, { 0x32, 0x58 }, { 0x33, 0xf1 },
 402         { 0x34, 0x00 }, { 0x35, 0xe4 }, { 0x36, 0x90 }, { 0x37, 0x3e },
 403         { 0x38, 0x6d }, { 0x39, 0x3c }, { 0x3a, 0xfb }, { 0x3b, 0x07 }
 404 };
 405
 406 static struct urtw_pair urtw_8225v2_rf_part3[] = {
 407         { 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
 408         { 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
 409         { 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
 410         { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
 411         { 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
 412         { 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
 413         { 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
 414         { 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
 415 };
 416
 417 static uint16_t urtw_8225v2_rxgain[] = {
 418         0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0008, 0x0009,
 419         0x000a, 0x000b, 0x0102, 0x0103, 0x0104, 0x0105, 0x0140, 0x0141,
 420         0x0142, 0x0143, 0x0144, 0x0145, 0x0180, 0x0181, 0x0182, 0x0183,
 421         0x0184, 0x0185, 0x0188, 0x0189, 0x018a, 0x018b, 0x0243, 0x0244,
 422         0x0245, 0x0280, 0x0281, 0x0282, 0x0283, 0x0284, 0x0285, 0x0288,
 423         0x0289, 0x028a, 0x028b, 0x028c, 0x0342, 0x0343, 0x0344, 0x0345,
 424         0x0380, 0x0381, 0x0382, 0x0383, 0x0384, 0x0385, 0x0388, 0x0389,
 425         0x038a, 0x038b, 0x038c, 0x038d, 0x0390, 0x0391, 0x0392, 0x0393,
 426         0x0394, 0x0395, 0x0398, 0x0399, 0x039a, 0x039b, 0x039c, 0x039d,
 427         0x03a0, 0x03a1, 0x03a2, 0x03a3, 0x03a4, 0x03a5, 0x03a8, 0x03a9,
 428         0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
 429         0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
 430 };
 431
 432 static uint16_t urtw_8225v2b_rxgain[] = {
 433         0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
 434         0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
 435         0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
 436         0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
 437         0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
 438         0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
 439         0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
 440         0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
 441         0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
 442         0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
 443         0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
 444         0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
 445 };
 446
 447 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
 448         0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
 449         0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
 450         0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
 451         0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
 452         0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
 453         0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
 454 };
 455
 456 static uint8_t urtw_8225v2_txpwr_cck[] = {
 457         0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04
 458 };
 459
 460 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
 461         0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00
 462 };
 463
 464 static uint8_t urtw_8225v2b_txpwr_cck[] = {
 465         0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
 466         0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
 467         0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
 468         0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
 469 };
 470
 471 static uint8_t urtw_8225v2b_txpwr_cck_ch14[] = {
 472         0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
 473         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
 474         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
 475         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
 476 };
 477
 478 static struct urtw_pair urtw_ratetable[] = {
 479         {  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
 480         { 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
 481         { 96, 10 }, { 108, 11 }
 482 };
 483
 484 #if 0
 485 static const uint8_t urtw_8187b_reg_table[][3] = {
 486         { 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
 487         { 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
 488         { 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
 489         { 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
 490         { 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
 491         { 0xff, 0x00, 0 }, { 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 },
 492         { 0x5a, 0x4b, 1 }, { 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 },
 493         { 0x61, 0x09, 1 }, { 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 },
 494         { 0xce, 0x0f, 1 }, { 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 },
 495         { 0xe1, 0x0f, 1 }, { 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 },
 496         { 0xf1, 0x01, 1 }, { 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 },
 497         { 0xf4, 0x04, 1 }, { 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 },
 498         { 0xf7, 0x07, 1 }, { 0xf8, 0x08, 1 }, { 0x4e, 0x00, 2 },
 499         { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 }, { 0x22, 0x68, 2 },
 500         { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 }, { 0x25, 0x7d, 2 },
 501         { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 }, { 0x4d, 0x08, 2 },
 502         { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 }, { 0x52, 0x04, 2 },
 503         { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 }, { 0x55, 0x23, 2 },
 504         { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 }, { 0x58, 0x08, 2 },
 505         { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 }, { 0x5b, 0x08, 2 },
 506         { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 }, { 0x62, 0x08, 2 },
 507         { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 }, { 0x72, 0x56, 2 },
 508         { 0x73, 0x9a, 2 }, { 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 },
 509         { 0x5b, 0x40, 0 }, { 0x84, 0x88, 0 }, { 0x85, 0x24, 0 },
 510         { 0x88, 0x54, 0 }, { 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 },
 511         { 0x8d, 0x00, 0 }, { 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 },
 512         { 0x96, 0x00, 0 }, { 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 },
 513         { 0x9f, 0x10, 0 }, { 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 },
 514         { 0xdb, 0x00, 0 }, { 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
 515         { 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
 516         { 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
 517 };
 518 #endif
 519
 520 static usb_callback_t urtw_bulk_rx_callback;
 521 static usb_callback_t urtw_bulk_tx_callback;
 522 static usb_callback_t urtw_bulk_tx_status_callback;
 523
 524 static const struct usb_config urtw_8187b_usbconfig[URTW_8187B_N_XFERS] = {
 525         [URTW_8187B_BULK_RX] = {
 526                 .type = UE_BULK,
 527                 .endpoint = 0x83,
 528                 .direction = UE_DIR_IN,
 529                 .bufsize = MCLBYTES,
 530                 .flags = {
 531                         .ext_buffer = 1,
 532                         .pipe_bof = 1,
 533                         .short_xfer_ok = 1
 534                 },
 535                 .callback = urtw_bulk_rx_callback
 536         },
 537         [URTW_8187B_BULK_TX_STATUS] = {
 538                 .type = UE_BULK,
 539                 .endpoint = 0x89,
 540                 .direction = UE_DIR_IN,
 541                 .bufsize = sizeof(uint64_t),
 542                 .flags = {
 543                         .pipe_bof = 1,
 544                         .short_xfer_ok = 1
 545                 },
 546                 .callback = urtw_bulk_tx_status_callback
 547         },
 548         [URTW_8187B_BULK_TX_BE] = {
 549                 .type = UE_BULK,
 550                 .endpoint = URTW_8187B_TXPIPE_BE,
 551                 .direction = UE_DIR_OUT,
 552                 .bufsize = URTW_TX_MAXSIZE * URTW_TX_DATA_LIST_COUNT,
 553                 .flags = {
 554                         .force_short_xfer = 1,
 555                         .pipe_bof = 1,
 556                 },
 557                 .callback = urtw_bulk_tx_callback,
 558                 .timeout = URTW_DATA_TIMEOUT
 559         },
 560         [URTW_8187B_BULK_TX_BK] = {
 561                 .type = UE_BULK,
 562                 .endpoint = URTW_8187B_TXPIPE_BK,
 563                 .direction = UE_DIR_OUT,
 564                 .bufsize = URTW_TX_MAXSIZE,
 565                 .flags = {
 566                         .ext_buffer = 1,
 567                         .force_short_xfer = 1,
 568                         .pipe_bof = 1,
 569                 },
 570                 .callback = urtw_bulk_tx_callback,
 571                 .timeout = URTW_DATA_TIMEOUT
 572         },
 573         [URTW_8187B_BULK_TX_VI] = {
 574                 .type = UE_BULK,
 575                 .endpoint = URTW_8187B_TXPIPE_VI,
 576                 .direction = UE_DIR_OUT,
 577                 .bufsize = URTW_TX_MAXSIZE,
 578                 .flags = {
 579                         .ext_buffer = 1,
 580                         .force_short_xfer = 1,
 581                         .pipe_bof = 1,
 582                 },
 583                 .callback = urtw_bulk_tx_callback,
 584                 .timeout = URTW_DATA_TIMEOUT
 585         },
 586         [URTW_8187B_BULK_TX_VO] = {
 587                 .type = UE_BULK,
 588                 .endpoint = URTW_8187B_TXPIPE_VO,
 589                 .direction = UE_DIR_OUT,
 590                 .bufsize = URTW_TX_MAXSIZE,
 591                 .flags = {
 592                         .ext_buffer = 1,
 593                         .force_short_xfer = 1,
 594                         .pipe_bof = 1,
 595                 },
 596                 .callback = urtw_bulk_tx_callback,
 597                 .timeout = URTW_DATA_TIMEOUT
 598         },
 599         [URTW_8187B_BULK_TX_EP12] = {
 600                 .type = UE_BULK,
 601                 .endpoint = 0xc,
 602                 .direction = UE_DIR_OUT,
 603                 .bufsize = URTW_TX_MAXSIZE,
 604                 .flags = {
 605                         .ext_buffer = 1,
 606                         .force_short_xfer = 1,
 607                         .pipe_bof = 1,
 608                 },
 609                 .callback = urtw_bulk_tx_callback,
 610                 .timeout = URTW_DATA_TIMEOUT
 611         }
 612 };
 613
 614 static const struct usb_config urtw_8187l_usbconfig[URTW_8187L_N_XFERS] = {
 615         [URTW_8187L_BULK_RX] = {
 616                 .type = UE_BULK,
 617                 .endpoint = 0x81,
 618                 .direction = UE_DIR_IN,
 619                 .bufsize = MCLBYTES,
 620                 .flags = {
 621                         .ext_buffer = 1,
 622                         .pipe_bof = 1,
 623                         .short_xfer_ok = 1
 624                 },
 625                 .callback = urtw_bulk_rx_callback
 626         },
 627         [URTW_8187L_BULK_TX_LOW] = {
 628                 .type = UE_BULK,
 629                 .endpoint = 0x2,
 630                 .direction = UE_DIR_OUT,
 631                 .bufsize = URTW_TX_MAXSIZE * URTW_TX_DATA_LIST_COUNT,
 632                 .flags = {
 633                         .force_short_xfer = 1,
 634                         .pipe_bof = 1,
 635                 },
 636                 .callback = urtw_bulk_tx_callback,
 637                 .timeout = URTW_DATA_TIMEOUT
 638         },
 639         [URTW_8187L_BULK_TX_NORMAL] = {
 640                 .type = UE_BULK,
 641                 .endpoint = 0x3,
 642                 .direction = UE_DIR_OUT,
 643                 .bufsize = URTW_TX_MAXSIZE,
 644                 .flags = {
 645                         .ext_buffer = 1,
 646                         .force_short_xfer = 1,
 647                         .pipe_bof = 1,
 648                 },
 649                 .callback = urtw_bulk_tx_callback,
 650                 .timeout = URTW_DATA_TIMEOUT
 651         },
 652 };
 653
 654 static struct ieee80211vap *urtw_vap_create(struct ieee80211com *,
 655                             const char [IFNAMSIZ], int, enum ieee80211_opmode,
 656                             int, const uint8_t [IEEE80211_ADDR_LEN],
 657                             const uint8_t [IEEE80211_ADDR_LEN]);
 658 static void             urtw_vap_delete(struct ieee80211vap *);
 659 static void             urtw_init(struct urtw_softc *);
 660 static void             urtw_stop(struct urtw_softc *);
 661 static void             urtw_parent(struct ieee80211com *);
 662 static int              urtw_transmit(struct ieee80211com *, struct mbuf *);
 663 static void             urtw_start(struct urtw_softc *);
 664 static int              urtw_alloc_rx_data_list(struct urtw_softc *);
 665 static int              urtw_alloc_tx_data_list(struct urtw_softc *);
 666 static int              urtw_raw_xmit(struct ieee80211_node *, struct mbuf *,
 667                             const struct ieee80211_bpf_params *);
 668 static void             urtw_scan_start(struct ieee80211com *);
 669 static void             urtw_scan_end(struct ieee80211com *);
 670 static void             urtw_getradiocaps(struct ieee80211com *, int, int *,
 671                            struct ieee80211_channel[]);
 672 static void             urtw_set_channel(struct ieee80211com *);
 673 static void             urtw_update_mcast(struct ieee80211com *);
 674 static int              urtw_tx_start(struct urtw_softc *,
 675                             struct ieee80211_node *, struct mbuf *,
 676                             struct urtw_data *, int);
 677 static int              urtw_newstate(struct ieee80211vap *,
 678                             enum ieee80211_state, int);
 679 static void             urtw_led_ch(void *);
 680 static void             urtw_ledtask(void *, int);
 681 static void             urtw_watchdog(void *);
 682 static void             urtw_set_multi(void *);
 683 static int              urtw_isbmode(uint16_t);
 684 static uint16_t         urtw_rtl2rate(uint32_t);
 685 static usb_error_t      urtw_set_rate(struct urtw_softc *);
 686 static usb_error_t      urtw_update_msr(struct urtw_softc *);
 687 static usb_error_t      urtw_read8_c(struct urtw_softc *, int, uint8_t *);
 688 static usb_error_t      urtw_read16_c(struct urtw_softc *, int, uint16_t *);
 689 static usb_error_t      urtw_read32_c(struct urtw_softc *, int, uint32_t *);
 690 static usb_error_t      urtw_write8_c(struct urtw_softc *, int, uint8_t);
 691 static usb_error_t      urtw_write16_c(struct urtw_softc *, int, uint16_t);
 692 static usb_error_t      urtw_write32_c(struct urtw_softc *, int, uint32_t);
 693 static usb_error_t      urtw_eprom_cs(struct urtw_softc *, int);
 694 static usb_error_t      urtw_eprom_ck(struct urtw_softc *);
 695 static usb_error_t      urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
 696                             int);
 697 static usb_error_t      urtw_eprom_read32(struct urtw_softc *, uint32_t,
 698                             uint32_t *);
 699 static usb_error_t      urtw_eprom_readbit(struct urtw_softc *, int16_t *);
 700 static usb_error_t      urtw_eprom_writebit(struct urtw_softc *, int16_t);
 701 static usb_error_t      urtw_get_macaddr(struct urtw_softc *);
 702 static usb_error_t      urtw_get_txpwr(struct urtw_softc *);
 703 static usb_error_t      urtw_get_rfchip(struct urtw_softc *);
 704 static usb_error_t      urtw_led_init(struct urtw_softc *);
 705 static usb_error_t      urtw_8185_rf_pins_enable(struct urtw_softc *);
 706 static usb_error_t      urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
 707 static usb_error_t      urtw_8187_write_phy(struct urtw_softc *, uint8_t,
 708                             uint32_t);
 709 static usb_error_t      urtw_8187_write_phy_ofdm_c(struct urtw_softc *,
 710                             uint8_t, uint32_t);
 711 static usb_error_t      urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
 712                             uint32_t);
 713 static usb_error_t      urtw_8225_setgain(struct urtw_softc *, int16_t);
 714 static usb_error_t      urtw_8225_usb_init(struct urtw_softc *);
 715 static usb_error_t      urtw_8225_write_c(struct urtw_softc *, uint8_t,
 716                             uint16_t);
 717 static usb_error_t      urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
 718                             uint16_t *);
 719 static usb_error_t      urtw_8225_read(struct urtw_softc *, uint8_t,
 720                             uint32_t *);
 721 static usb_error_t      urtw_8225_rf_init(struct urtw_softc *);
 722 static usb_error_t      urtw_8225_rf_set_chan(struct urtw_softc *, int);
 723 static usb_error_t      urtw_8225_rf_set_sens(struct urtw_softc *, int);
 724 static usb_error_t      urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
 725 static usb_error_t      urtw_8225_rf_stop(struct urtw_softc *);
 726 static usb_error_t      urtw_8225v2_rf_init(struct urtw_softc *);
 727 static usb_error_t      urtw_8225v2_rf_set_chan(struct urtw_softc *, int);
 728 static usb_error_t      urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
 729 static usb_error_t      urtw_8225v2_setgain(struct urtw_softc *, int16_t);
 730 static usb_error_t      urtw_8225_isv2(struct urtw_softc *, int *);
 731 static usb_error_t      urtw_8225v2b_rf_init(struct urtw_softc *);
 732 static usb_error_t      urtw_8225v2b_rf_set_chan(struct urtw_softc *, int);
 733 static usb_error_t      urtw_read8e(struct urtw_softc *, int, uint8_t *);
 734 static usb_error_t      urtw_write8e(struct urtw_softc *, int, uint8_t);
 735 static usb_error_t      urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
 736 static usb_error_t      urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
 737 static usb_error_t      urtw_intr_enable(struct urtw_softc *);
 738 static usb_error_t      urtw_intr_disable(struct urtw_softc *);
 739 static usb_error_t      urtw_reset(struct urtw_softc *);
 740 static usb_error_t      urtw_led_on(struct urtw_softc *, int);
 741 static usb_error_t      urtw_led_ctl(struct urtw_softc *, int);
 742 static usb_error_t      urtw_led_blink(struct urtw_softc *);
 743 static usb_error_t      urtw_led_mode0(struct urtw_softc *, int);
 744 static usb_error_t      urtw_led_mode1(struct urtw_softc *, int);
 745 static usb_error_t      urtw_led_mode2(struct urtw_softc *, int);
 746 static usb_error_t      urtw_led_mode3(struct urtw_softc *, int);
 747 static usb_error_t      urtw_rx_setconf(struct urtw_softc *);
 748 static usb_error_t      urtw_rx_enable(struct urtw_softc *);
 749 static usb_error_t      urtw_tx_enable(struct urtw_softc *sc);
 750 static void             urtw_free_tx_data_list(struct urtw_softc *);
 751 static void             urtw_free_rx_data_list(struct urtw_softc *);
 752 static void             urtw_free_data_list(struct urtw_softc *,
 753                             struct urtw_data data[], int, int);
 754 static usb_error_t      urtw_adapter_start(struct urtw_softc *);
 755 static usb_error_t      urtw_adapter_start_b(struct urtw_softc *);
 756 static usb_error_t      urtw_set_mode(struct urtw_softc *, uint32_t);
 757 static usb_error_t      urtw_8187b_cmd_reset(struct urtw_softc *);
 758 static usb_error_t      urtw_do_request(struct urtw_softc *,
 759                             struct usb_device_request *, void *);
 760 static usb_error_t      urtw_8225v2b_set_txpwrlvl(struct urtw_softc *, int);
 761 static usb_error_t      urtw_led_off(struct urtw_softc *, int);
 762 static void             urtw_abort_xfers(struct urtw_softc *);
 763 static struct urtw_data *
 764                         urtw_getbuf(struct urtw_softc *sc);
 765 static int              urtw_compute_txtime(uint16_t, uint16_t, uint8_t,
 766                             uint8_t);
 767 static void             urtw_updateslot(struct ieee80211com *);
 768 static void             urtw_updateslottask(void *, int);
 769 static void             urtw_sysctl_node(struct urtw_softc *);
 770
 771 static int
 772 urtw_match(device_t dev)
 773 {
 774         struct usb_attach_arg *uaa = device_get_ivars(dev);
 775
 776         if (uaa->usb_mode != USB_MODE_HOST)
 777                 return (ENXIO);
 778         if (uaa->info.bConfigIndex != URTW_CONFIG_INDEX)
 779                 return (ENXIO);
 780         if (uaa->info.bIfaceIndex != URTW_IFACE_INDEX)
 781                 return (ENXIO);
 782
 783         return (usbd_lookup_id_by_uaa(urtw_devs, sizeof(urtw_devs), uaa));
 784 }
 785
 786 static int
 787 urtw_attach(device_t dev)
 788 {
 789         const struct usb_config *setup_start;
 790         int ret = ENXIO;
 791         struct urtw_softc *sc = device_get_softc(dev);
 792         struct usb_attach_arg *uaa = device_get_ivars(dev);
 793         struct ieee80211com *ic = &sc->sc_ic;
 794         uint8_t iface_index = URTW_IFACE_INDEX;         /* XXX */
 795         uint16_t n_setup;
 796         uint32_t data;
 797         usb_error_t error;
 798
 799         device_set_usb_desc(dev);
 800
 801         sc->sc_dev = dev;
 802         sc->sc_udev = uaa->device;
 803         if (USB_GET_DRIVER_INFO(uaa) == URTW_REV_RTL8187B)
 804                 sc->sc_flags |= URTW_RTL8187B;
 805 #ifdef URTW_DEBUG
 806         sc->sc_debug = urtw_debug;
 807 #endif
 808
 809         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev), MTX_NETWORK_LOCK,
 810             MTX_DEF);
 811         usb_callout_init_mtx(&sc->sc_led_ch, &sc->sc_mtx, 0);
 812         TASK_INIT(&sc->sc_led_task, 0, urtw_ledtask, sc);
 813         TASK_INIT(&sc->sc_updateslot_task, 0, urtw_updateslottask, sc);
 814         callout_init(&sc->sc_watchdog_ch, 0);
 815         mbufq_init(&sc->sc_snd, ifqmaxlen);
 816
 817         if (sc->sc_flags & URTW_RTL8187B) {
 818                 setup_start = urtw_8187b_usbconfig;
 819                 n_setup = URTW_8187B_N_XFERS;
 820         } else {
 821                 setup_start = urtw_8187l_usbconfig;
 822                 n_setup = URTW_8187L_N_XFERS;
 823         }
 824
 825         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
 826             setup_start, n_setup, sc, &sc->sc_mtx);
 827         if (error) {
 828                 device_printf(dev, "could not allocate USB transfers, "
 829                     "err=%s\n", usbd_errstr(error));
 830                 ret = ENXIO;
 831                 goto fail0;
 832         }
 833
 834         if (sc->sc_flags & URTW_RTL8187B) {
 835                 sc->sc_tx_dma_buf =
 836                     usbd_xfer_get_frame_buffer(sc->sc_xfer[
 837                     URTW_8187B_BULK_TX_BE], 0);
 838         } else {
 839                 sc->sc_tx_dma_buf =
 840                     usbd_xfer_get_frame_buffer(sc->sc_xfer[
 841                     URTW_8187L_BULK_TX_LOW], 0);
 842         }
 843
 844         URTW_LOCK(sc);
 845
 846         urtw_read32_m(sc, URTW_RX, &data);
 847         sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
 848             URTW_EEPROM_93C46;
 849
 850         error = urtw_get_rfchip(sc);
 851         if (error != 0)
 852                 goto fail;
 853         error = urtw_get_macaddr(sc);
 854         if (error != 0)
 855                 goto fail;
 856         error = urtw_get_txpwr(sc);
 857         if (error != 0)
 858                 goto fail;
 859         error = urtw_led_init(sc);
 860         if (error != 0)
 861                 goto fail;
 862
 863         URTW_UNLOCK(sc);
 864
 865         sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
 866         sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
 867         sc->sc_currate = URTW_RIDX_CCK11;
 868         sc->sc_preamble_mode = urtw_preamble_mode;
 869
 870         ic->ic_softc = sc;
 871         ic->ic_name = device_get_nameunit(dev);
 872         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 873         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 874
 875         /* set device capabilities */
 876         ic->ic_caps =
 877             IEEE80211_C_STA |           /* station mode */
 878             IEEE80211_C_MONITOR |       /* monitor mode supported */
 879             IEEE80211_C_TXPMGT |        /* tx power management */
 880             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 881             IEEE80211_C_SHSLOT |        /* short slot time supported */
 882             IEEE80211_C_BGSCAN |        /* capable of bg scanning */
 883             IEEE80211_C_WPA;            /* 802.11i */
 884
 885         /* XXX TODO: setup regdomain if URTW_EPROM_CHANPLAN_BY_HW bit is set.*/
 886
 887         urtw_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
 888             ic->ic_channels);
 889
 890         ieee80211_ifattach(ic);
 891         ic->ic_raw_xmit = urtw_raw_xmit;
 892         ic->ic_scan_start = urtw_scan_start;
 893         ic->ic_scan_end = urtw_scan_end;
 894         ic->ic_getradiocaps = urtw_getradiocaps;
 895         ic->ic_set_channel = urtw_set_channel;
 896         ic->ic_updateslot = urtw_updateslot;
 897         ic->ic_vap_create = urtw_vap_create;
 898         ic->ic_vap_delete = urtw_vap_delete;
 899         ic->ic_update_mcast = urtw_update_mcast;
 900         ic->ic_parent = urtw_parent;
 901         ic->ic_transmit = urtw_transmit;
 902
 903         ieee80211_radiotap_attach(ic,
 904             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 905             URTW_TX_RADIOTAP_PRESENT,
 906             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 907             URTW_RX_RADIOTAP_PRESENT);
 908
 909         urtw_sysctl_node(sc);
 910
 911         if (bootverbose)
 912                 ieee80211_announce(ic);
 913         return (0);
 914
 915 fail:
 916         URTW_UNLOCK(sc);
 917         usbd_transfer_unsetup(sc->sc_xfer, (sc->sc_flags & URTW_RTL8187B) ?
 918             URTW_8187B_N_XFERS : URTW_8187L_N_XFERS);
 919 fail0:
 920         return (ret);
 921 }
 922
 923 static int
 924 urtw_detach(device_t dev)
 925 {
 926         struct urtw_softc *sc = device_get_softc(dev);
 927         struct ieee80211com *ic = &sc->sc_ic;
 928         unsigned int x;
 929         unsigned int n_xfers;
 930
 931         /* Prevent further ioctls */
 932         URTW_LOCK(sc);
 933         sc->sc_flags |= URTW_DETACHED;
 934         urtw_stop(sc);
 935         URTW_UNLOCK(sc);
 936
 937         ieee80211_draintask(ic, &sc->sc_updateslot_task);
 938         ieee80211_draintask(ic, &sc->sc_led_task);
 939
 940         usb_callout_drain(&sc->sc_led_ch);
 941         callout_drain(&sc->sc_watchdog_ch);
 942
 943         n_xfers = (sc->sc_flags & URTW_RTL8187B) ?
 944             URTW_8187B_N_XFERS : URTW_8187L_N_XFERS;
 945
 946         /* prevent further allocations from RX/TX data lists */
 947         URTW_LOCK(sc);
 948         STAILQ_INIT(&sc->sc_tx_active);
 949         STAILQ_INIT(&sc->sc_tx_inactive);
 950         STAILQ_INIT(&sc->sc_tx_pending);
 951
 952         STAILQ_INIT(&sc->sc_rx_active);
 953         STAILQ_INIT(&sc->sc_rx_inactive);
 954         URTW_UNLOCK(sc);
 955
 956         /* drain USB transfers */
 957         for (x = 0; x != n_xfers; x++)
 958                 usbd_transfer_drain(sc->sc_xfer[x]);
 959
 960         /* free data buffers */
 961         URTW_LOCK(sc);
 962         urtw_free_tx_data_list(sc);
 963         urtw_free_rx_data_list(sc);
 964         URTW_UNLOCK(sc);
 965
 966         /* free USB transfers and some data buffers */
 967         usbd_transfer_unsetup(sc->sc_xfer, n_xfers);
 968
 969         ieee80211_ifdetach(ic);
 970         mbufq_drain(&sc->sc_snd);
 971         mtx_destroy(&sc->sc_mtx);
 972         return (0);
 973 }
 974
 975 static void
 976 urtw_free_tx_data_list(struct urtw_softc *sc)
 977 {
 978         urtw_free_data_list(sc, sc->sc_tx, URTW_TX_DATA_LIST_COUNT, 0);
 979 }
 980
 981 static void
 982 urtw_free_rx_data_list(struct urtw_softc *sc)
 983 {
 984         urtw_free_data_list(sc, sc->sc_rx, URTW_RX_DATA_LIST_COUNT, 1);
 985 }
 986
 987 static void
 988 urtw_free_data_list(struct urtw_softc *sc, struct urtw_data data[], int ndata,
 989     int fillmbuf)
 990 {
 991         int i;
 992
 993         for (i = 0; i < ndata; i++) {
 994                 struct urtw_data *dp = &data[i];
 995
 996                 if (fillmbuf == 1) {
 997                         if (dp->m != NULL) {
 998                                 m_freem(dp->m);
 999                                 dp->m = NULL;
1000                                 dp->buf = NULL;
1001                         }
1002                 } else {
1003                         dp->buf = NULL;
1004                 }
1005                 if (dp->ni != NULL) {
1006                         ieee80211_free_node(dp->ni);
1007                         dp->ni = NULL;
1008                 }
1009         }
1010 }
1011
1012 static struct ieee80211vap *
1013 urtw_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
1014     enum ieee80211_opmode opmode, int flags,
1015     const uint8_t bssid[IEEE80211_ADDR_LEN],
1016     const uint8_t mac[IEEE80211_ADDR_LEN])
1017 {
1018         struct urtw_vap *uvp;
1019         struct ieee80211vap *vap;
1020
1021         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
1022                 return (NULL);
1023         uvp = malloc(sizeof(struct urtw_vap), M_80211_VAP, M_WAITOK | M_ZERO);
1024         vap = &uvp->vap;
1025         /* enable s/w bmiss handling for sta mode */
1026
1027         if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
1028             flags | IEEE80211_CLONE_NOBEACONS, bssid) != 0) {
1029                 /* out of memory */
1030                 free(uvp, M_80211_VAP);
1031                 return (NULL);
1032         }
1033
1034         /* override state transition machine */
1035         uvp->newstate = vap->iv_newstate;
1036         vap->iv_newstate = urtw_newstate;
1037
1038         /* complete setup */
1039         ieee80211_vap_attach(vap, ieee80211_media_change,
1040             ieee80211_media_status, mac);
1041         ic->ic_opmode = opmode;
1042         return (vap);
1043 }
1044
1045 static void
1046 urtw_vap_delete(struct ieee80211vap *vap)
1047 {
1048         struct urtw_vap *uvp = URTW_VAP(vap);
1049
1050         ieee80211_vap_detach(vap);
1051         free(uvp, M_80211_VAP);
1052 }
1053
1054 static void
1055 urtw_init(struct urtw_softc *sc)
1056 {
1057         usb_error_t error;
1058         int ret;
1059
1060         URTW_ASSERT_LOCKED(sc);
1061
1062         if (sc->sc_flags & URTW_RUNNING)
1063                 urtw_stop(sc);
1064
1065         error = (sc->sc_flags & URTW_RTL8187B) ? urtw_adapter_start_b(sc) :
1066             urtw_adapter_start(sc);
1067         if (error != 0)
1068                 goto fail;
1069
1070         /* reset softc variables  */
1071         sc->sc_txtimer = 0;
1072
1073         if (!(sc->sc_flags & URTW_INIT_ONCE)) {
1074                 ret = urtw_alloc_rx_data_list(sc);
1075                 if (ret != 0)
1076                         goto fail;
1077                 ret = urtw_alloc_tx_data_list(sc);
1078                 if (ret != 0)
1079                         goto fail;
1080                 sc->sc_flags |= URTW_INIT_ONCE;
1081         }
1082
1083         error = urtw_rx_enable(sc);
1084         if (error != 0)
1085                 goto fail;
1086         error = urtw_tx_enable(sc);
1087         if (error != 0)
1088                 goto fail;
1089
1090         if (sc->sc_flags & URTW_RTL8187B)
1091                 usbd_transfer_start(sc->sc_xfer[URTW_8187B_BULK_TX_STATUS]);
1092
1093         sc->sc_flags |= URTW_RUNNING;
1094
1095         callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1096 fail:
1097         return;
1098 }
1099
1100 static usb_error_t
1101 urtw_adapter_start_b(struct urtw_softc *sc)
1102 {
1103         uint8_t data8;
1104         usb_error_t error;
1105
1106         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1107         if (error)
1108                 goto fail;
1109
1110         urtw_read8_m(sc, URTW_CONFIG3, &data8);
1111         urtw_write8_m(sc, URTW_CONFIG3,
1112             data8 | URTW_CONFIG3_ANAPARAM_WRITE | URTW_CONFIG3_GNT_SELECT);
1113         urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
1114         urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
1115         urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
1116
1117         urtw_write8_m(sc, 0x61, 0x10);
1118         urtw_read8_m(sc, 0x62, &data8);
1119         urtw_write8_m(sc, 0x62, data8 & ~(1 << 5));
1120         urtw_write8_m(sc, 0x62, data8 | (1 << 5));
1121
1122         urtw_read8_m(sc, URTW_CONFIG3, &data8);
1123         data8 &= ~URTW_CONFIG3_ANAPARAM_WRITE;
1124         urtw_write8_m(sc, URTW_CONFIG3, data8);
1125
1126         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1127         if (error)
1128                 goto fail;
1129
1130         error = urtw_8187b_cmd_reset(sc);
1131         if (error)
1132                 goto fail;
1133
1134         error = sc->sc_rf_init(sc);
1135         if (error != 0)
1136                 goto fail;
1137         urtw_write8_m(sc, URTW_CMD, URTW_CMD_RX_ENABLE | URTW_CMD_TX_ENABLE);
1138
1139         /* fix RTL8187B RX stall */
1140         error = urtw_intr_enable(sc);
1141         if (error)
1142                 goto fail;
1143
1144         error = urtw_write8e(sc, 0x41, 0xf4);
1145         if (error)
1146                 goto fail;
1147         error = urtw_write8e(sc, 0x40, 0x00);
1148         if (error)
1149                 goto fail;
1150         error = urtw_write8e(sc, 0x42, 0x00);
1151         if (error)
1152                 goto fail;
1153         error = urtw_write8e(sc, 0x42, 0x01);
1154         if (error)
1155                 goto fail;
1156         error = urtw_write8e(sc, 0x40, 0x0f);
1157         if (error)
1158                 goto fail;
1159         error = urtw_write8e(sc, 0x42, 0x00);
1160         if (error)
1161                 goto fail;
1162         error = urtw_write8e(sc, 0x42, 0x01);
1163         if (error)
1164                 goto fail;
1165
1166         urtw_read8_m(sc, 0xdb, &data8);
1167         urtw_write8_m(sc, 0xdb, data8 | (1 << 2));
1168         urtw_write16_m(sc, 0x372, 0x59fa);
1169         urtw_write16_m(sc, 0x374, 0x59d2);
1170         urtw_write16_m(sc, 0x376, 0x59d2);
1171         urtw_write16_m(sc, 0x378, 0x19fa);
1172         urtw_write16_m(sc, 0x37a, 0x19fa);
1173         urtw_write16_m(sc, 0x37c, 0x00d0);
1174         urtw_write8_m(sc, 0x61, 0);
1175
1176         urtw_write8_m(sc, 0x180, 0x0f);
1177         urtw_write8_m(sc, 0x183, 0x03);
1178         urtw_write8_m(sc, 0xda, 0x10);
1179         urtw_write8_m(sc, 0x24d, 0x08);
1180         urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
1181
1182         urtw_write16_m(sc, 0x1ec, 0x800);       /* RX MAX SIZE */
1183 fail:
1184         return (error);
1185 }
1186
1187 static usb_error_t
1188 urtw_adapter_start(struct urtw_softc *sc)
1189 {
1190         struct ieee80211com *ic = &sc->sc_ic;
1191         usb_error_t error;
1192
1193         error = urtw_reset(sc);
1194         if (error)
1195                 goto fail;
1196
1197         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 0);
1198         urtw_write8_m(sc, URTW_GPIO, 0);
1199
1200         /* for led  */
1201         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 4);
1202         error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
1203         if (error != 0)
1204                 goto fail;
1205
1206         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1207         if (error)
1208                 goto fail;
1209         /* applying MAC address again.  */
1210         urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)ic->ic_macaddr)[0]);
1211         urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)ic->ic_macaddr)[1] & 0xffff);
1212         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1213         if (error)
1214                 goto fail;
1215
1216         error = urtw_update_msr(sc);
1217         if (error)
1218                 goto fail;
1219
1220         urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
1221         urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
1222         urtw_write8_m(sc, URTW_RATE_FALLBACK, URTW_RATE_FALLBACK_ENABLE | 0x1);
1223         error = urtw_set_rate(sc);
1224         if (error != 0)
1225                 goto fail;
1226
1227         error = sc->sc_rf_init(sc);
1228         if (error != 0)
1229                 goto fail;
1230         if (sc->sc_rf_set_sens != NULL)
1231                 sc->sc_rf_set_sens(sc, sc->sc_sens);
1232
1233         /* XXX correct? to call write16  */
1234         urtw_write16_m(sc, URTW_PSR, 1);
1235         urtw_write16_m(sc, URTW_ADDR_MAGIC2, 0x10);
1236         urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
1237         urtw_write8_m(sc, URTW_ADDR_MAGIC3, 0x60);
1238         /* XXX correct? to call write16  */
1239         urtw_write16_m(sc, URTW_PSR, 0);
1240         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 4);
1241
1242         error = urtw_intr_enable(sc);
1243         if (error != 0)
1244                 goto fail;
1245
1246 fail:
1247         return (error);
1248 }
1249
1250 static usb_error_t
1251 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1252 {
1253         uint8_t data;
1254         usb_error_t error;
1255
1256         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1257         data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1258         data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1259         urtw_write8_m(sc, URTW_EPROM_CMD, data);
1260 fail:
1261         return (error);
1262 }
1263
1264 static usb_error_t
1265 urtw_8187b_cmd_reset(struct urtw_softc *sc)
1266 {
1267         int i;
1268         uint8_t data8;
1269         usb_error_t error;
1270
1271         /* XXX the code can be duplicate with urtw_reset().  */
1272         urtw_read8_m(sc, URTW_CMD, &data8);
1273         data8 = (data8 & 0x2) | URTW_CMD_RST;
1274         urtw_write8_m(sc, URTW_CMD, data8);
1275
1276         for (i = 0; i < 20; i++) {
1277                 usb_pause_mtx(&sc->sc_mtx, 2);
1278                 urtw_read8_m(sc, URTW_CMD, &data8);
1279                 if (!(data8 & URTW_CMD_RST))
1280                         break;
1281         }
1282         if (i >= 20) {
1283                 device_printf(sc->sc_dev, "reset timeout\n");
1284                 goto fail;
1285         }
1286 fail:
1287         return (error);
1288 }
1289
1290 static usb_error_t
1291 urtw_do_request(struct urtw_softc *sc,
1292     struct usb_device_request *req, void *data)
1293 {
1294         usb_error_t err;
1295         int ntries = 10;
1296
1297         URTW_ASSERT_LOCKED(sc);
1298
1299         while (ntries--) {
1300                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
1301                     req, data, 0, NULL, 250 /* ms */);
1302                 if (err == 0)
1303                         break;
1304
1305                 DPRINTF(sc, URTW_DEBUG_INIT,
1306                     "Control request failed, %s (retrying)\n",
1307                     usbd_errstr(err));
1308                 usb_pause_mtx(&sc->sc_mtx, hz / 100);
1309         }
1310         return (err);
1311 }
1312
1313 static void
1314 urtw_stop(struct urtw_softc *sc)
1315 {
1316         uint8_t data8;
1317         usb_error_t error;
1318
1319         URTW_ASSERT_LOCKED(sc);
1320
1321         sc->sc_flags &= ~URTW_RUNNING;
1322
1323         error = urtw_intr_disable(sc);
1324         if (error)
1325                 goto fail;
1326         urtw_read8_m(sc, URTW_CMD, &data8);
1327         data8 &= ~(URTW_CMD_RX_ENABLE | URTW_CMD_TX_ENABLE);
1328         urtw_write8_m(sc, URTW_CMD, data8);
1329
1330         error = sc->sc_rf_stop(sc);
1331         if (error != 0)
1332                 goto fail;
1333
1334         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1335         if (error)
1336                 goto fail;
1337         urtw_read8_m(sc, URTW_CONFIG4, &data8);
1338         urtw_write8_m(sc, URTW_CONFIG4, data8 | URTW_CONFIG4_VCOOFF);
1339         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1340         if (error)
1341                 goto fail;
1342 fail:
1343         if (error)
1344                 device_printf(sc->sc_dev, "failed to stop (%s)\n",
1345                     usbd_errstr(error));
1346
1347         usb_callout_stop(&sc->sc_led_ch);
1348         callout_stop(&sc->sc_watchdog_ch);
1349
1350         urtw_abort_xfers(sc);
1351 }
1352
1353 static void
1354 urtw_abort_xfers(struct urtw_softc *sc)
1355 {
1356         int i, max;
1357
1358         URTW_ASSERT_LOCKED(sc);
1359
1360         max = (sc->sc_flags & URTW_RTL8187B) ? URTW_8187B_N_XFERS :
1361             URTW_8187L_N_XFERS;
1362
1363         /* abort any pending transfers */
1364         for (i = 0; i < max; i++)
1365                 usbd_transfer_stop(sc->sc_xfer[i]);
1366 }
1367
1368 static void
1369 urtw_parent(struct ieee80211com *ic)
1370 {
1371         struct urtw_softc *sc = ic->ic_softc;
1372         int startall = 0;
1373
1374         URTW_LOCK(sc);
1375         if (sc->sc_flags & URTW_DETACHED) {
1376                 URTW_UNLOCK(sc);
1377                 return;
1378         }
1379
1380         if (ic->ic_nrunning > 0) {
1381                 if (sc->sc_flags & URTW_RUNNING) {
1382                         if (ic->ic_promisc > 0 || ic->ic_allmulti > 0)
1383                                 urtw_set_multi(sc);
1384                 } else {
1385                         urtw_init(sc);
1386                         startall = 1;
1387                 }
1388         } else if (sc->sc_flags & URTW_RUNNING)
1389                 urtw_stop(sc);
1390         URTW_UNLOCK(sc);
1391         if (startall)
1392                 ieee80211_start_all(ic);
1393 }
1394
1395 static int
1396 urtw_transmit(struct ieee80211com *ic, struct mbuf *m)
1397 {
1398         struct urtw_softc *sc = ic->ic_softc;
1399         int error;
1400
1401         URTW_LOCK(sc);
1402         if ((sc->sc_flags & URTW_RUNNING) == 0) {
1403                 URTW_UNLOCK(sc);
1404                 return (ENXIO);
1405         }
1406         error = mbufq_enqueue(&sc->sc_snd, m);
1407         if (error) {
1408                 URTW_UNLOCK(sc);
1409                 return (error);
1410         }
1411         urtw_start(sc);
1412         URTW_UNLOCK(sc);
1413
1414         return (0);
1415 }
1416
1417 static void
1418 urtw_start(struct urtw_softc *sc)
1419 {
1420         struct urtw_data *bf;
1421         struct ieee80211_node *ni;
1422         struct mbuf *m;
1423
1424         URTW_ASSERT_LOCKED(sc);
1425
1426         if ((sc->sc_flags & URTW_RUNNING) == 0)
1427                 return;
1428
1429         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
1430                 bf = urtw_getbuf(sc);
1431                 if (bf == NULL) {
1432                         mbufq_prepend(&sc->sc_snd, m);
1433                         break;
1434                 }
1435
1436                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1437                 m->m_pkthdr.rcvif = NULL;
1438
1439                 if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_NORMAL) != 0) {
1440                         if_inc_counter(ni->ni_vap->iv_ifp,
1441                             IFCOUNTER_OERRORS, 1);
1442                         STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1443                         ieee80211_free_node(ni);
1444                         break;
1445                 }
1446
1447                 sc->sc_txtimer = 5;
1448                 callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1449         }
1450 }
1451
1452 static int
1453 urtw_alloc_data_list(struct urtw_softc *sc, struct urtw_data data[],
1454     int ndata, int maxsz, void *dma_buf)
1455 {
1456         int i, error;
1457
1458         for (i = 0; i < ndata; i++) {
1459                 struct urtw_data *dp = &data[i];
1460
1461                 dp->sc = sc;
1462                 if (dma_buf == NULL) {
1463                         dp->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1464                         if (dp->m == NULL) {
1465                                 device_printf(sc->sc_dev,
1466                                     "could not allocate rx mbuf\n");
1467                                 error = ENOMEM;
1468                                 goto fail;
1469                         }
1470                         dp->buf = mtod(dp->m, uint8_t *);
1471                 } else {
1472                         dp->m = NULL;
1473                         dp->buf = ((uint8_t *)dma_buf) +
1474                             (i * maxsz);
1475                 }
1476                 dp->ni = NULL;
1477         }
1478         return (0);
1479
1480 fail:   urtw_free_data_list(sc, data, ndata, 1);
1481         return (error);
1482 }
1483
1484 static int
1485 urtw_alloc_rx_data_list(struct urtw_softc *sc)
1486 {
1487         int error, i;
1488
1489         error = urtw_alloc_data_list(sc,
1490             sc->sc_rx, URTW_RX_DATA_LIST_COUNT,
1491             MCLBYTES, NULL /* mbufs */);
1492         if (error != 0)
1493                 return (error);
1494
1495         STAILQ_INIT(&sc->sc_rx_active);
1496         STAILQ_INIT(&sc->sc_rx_inactive);
1497
1498         for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++)
1499                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1500
1501         return (0);
1502 }
1503
1504 static int
1505 urtw_alloc_tx_data_list(struct urtw_softc *sc)
1506 {
1507         int error, i;
1508
1509         error = urtw_alloc_data_list(sc,
1510             sc->sc_tx, URTW_TX_DATA_LIST_COUNT, URTW_TX_MAXSIZE,
1511             sc->sc_tx_dma_buf /* no mbufs */);
1512         if (error != 0)
1513                 return (error);
1514
1515         STAILQ_INIT(&sc->sc_tx_active);
1516         STAILQ_INIT(&sc->sc_tx_inactive);
1517         STAILQ_INIT(&sc->sc_tx_pending);
1518
1519         for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++)
1520                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i],
1521                     next);
1522
1523         return (0);
1524 }
1525
1526 static int
1527 urtw_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1528     const struct ieee80211_bpf_params *params)
1529 {
1530         struct ieee80211com *ic = ni->ni_ic;
1531         struct urtw_softc *sc = ic->ic_softc;
1532         struct urtw_data *bf;
1533
1534         /* prevent management frames from being sent if we're not ready */
1535         if (!(sc->sc_flags & URTW_RUNNING)) {
1536                 m_freem(m);
1537                 return ENETDOWN;
1538         }
1539         URTW_LOCK(sc);
1540         bf = urtw_getbuf(sc);
1541         if (bf == NULL) {
1542                 m_freem(m);
1543                 URTW_UNLOCK(sc);
1544                 return (ENOBUFS);               /* XXX */
1545         }
1546
1547         if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_LOW) != 0) {
1548                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1549                 URTW_UNLOCK(sc);
1550                 return (EIO);
1551         }
1552         URTW_UNLOCK(sc);
1553
1554         sc->sc_txtimer = 5;
1555         return (0);
1556 }
1557
1558 static void
1559 urtw_scan_start(struct ieee80211com *ic)
1560 {
1561
1562         /* XXX do nothing?  */
1563 }
1564
1565 static void
1566 urtw_scan_end(struct ieee80211com *ic)
1567 {
1568
1569         /* XXX do nothing?  */
1570 }
1571
1572 static void
1573 urtw_getradiocaps(struct ieee80211com *ic,
1574     int maxchans, int *nchans, struct ieee80211_channel chans[])
1575 {
1576         uint8_t bands[IEEE80211_MODE_BYTES];
1577
1578         memset(bands, 0, sizeof(bands));
1579         setbit(bands, IEEE80211_MODE_11B);
1580         setbit(bands, IEEE80211_MODE_11G);
1581         ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
1582 }
1583
1584 static void
1585 urtw_set_channel(struct ieee80211com *ic)
1586 {
1587         struct urtw_softc *sc = ic->ic_softc;
1588         uint32_t data, orig;
1589         usb_error_t error;
1590
1591         /*
1592          * if the user set a channel explicitly using ifconfig(8) this function
1593          * can be called earlier than we're expected that in some cases the
1594          * initialization would be failed if setting a channel is called before
1595          * the init have done.
1596          */
1597         if (!(sc->sc_flags & URTW_RUNNING))
1598                 return;
1599
1600         if (sc->sc_curchan != NULL && sc->sc_curchan == ic->ic_curchan)
1601                 return;
1602
1603         URTW_LOCK(sc);
1604
1605         /*
1606          * during changing th channel we need to temporarily be disable
1607          * TX.
1608          */
1609         urtw_read32_m(sc, URTW_TX_CONF, &orig);
1610         data = orig & ~URTW_TX_LOOPBACK_MASK;
1611         urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
1612
1613         error = sc->sc_rf_set_chan(sc, ieee80211_chan2ieee(ic, ic->ic_curchan));
1614         if (error != 0)
1615                 goto fail;
1616         usb_pause_mtx(&sc->sc_mtx, 10);
1617         urtw_write32_m(sc, URTW_TX_CONF, orig);
1618
1619         urtw_write16_m(sc, URTW_ATIM_WND, 2);
1620         urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
1621         urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
1622         urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
1623
1624 fail:
1625         URTW_UNLOCK(sc);
1626
1627         sc->sc_curchan = ic->ic_curchan;
1628
1629         if (error != 0)
1630                 device_printf(sc->sc_dev, "could not change the channel\n");
1631 }
1632
1633 static void
1634 urtw_update_mcast(struct ieee80211com *ic)
1635 {
1636
1637         /* XXX do nothing?  */
1638 }
1639
1640 static int
1641 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
1642     struct urtw_data *data, int prior)
1643 {
1644         struct ieee80211_frame *wh = mtod(m0, struct ieee80211_frame *);
1645         struct ieee80211_key *k;
1646         const struct ieee80211_txparam *tp = ni->ni_txparms;
1647         struct ieee80211com *ic = &sc->sc_ic;
1648         struct ieee80211vap *vap = ni->ni_vap;
1649         struct usb_xfer *rtl8187b_pipes[URTW_8187B_TXPIPE_MAX] = {
1650                 sc->sc_xfer[URTW_8187B_BULK_TX_BE],
1651                 sc->sc_xfer[URTW_8187B_BULK_TX_BK],
1652                 sc->sc_xfer[URTW_8187B_BULK_TX_VI],
1653                 sc->sc_xfer[URTW_8187B_BULK_TX_VO]
1654         };
1655         struct usb_xfer *xfer;
1656         int dur = 0, rtsdur = 0, rtsenable = 0, ctsenable = 0, rate, type,
1657             pkttime = 0, txdur = 0, isshort = 0, xferlen, ismcast;
1658         uint16_t acktime, rtstime, ctstime;
1659         uint32_t flags;
1660         usb_error_t error;
1661
1662         URTW_ASSERT_LOCKED(sc);
1663
1664         ismcast = IEEE80211_IS_MULTICAST(wh->i_addr1);
1665         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1666
1667         /*
1668          * Software crypto.
1669          */
1670         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1671                 k = ieee80211_crypto_encap(ni, m0);
1672                 if (k == NULL) {
1673                         device_printf(sc->sc_dev,
1674                             "ieee80211_crypto_encap returns NULL.\n");
1675                         /* XXX we don't expect the fragmented frames  */
1676                         m_freem(m0);
1677                         return (ENOBUFS);
1678                 }
1679
1680                 /* in case packet header moved, reset pointer */
1681                 wh = mtod(m0, struct ieee80211_frame *);
1682         }
1683
1684         if (ieee80211_radiotap_active_vap(vap)) {
1685                 struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
1686
1687                 /* XXX Are variables correct?  */
1688                 tap->wt_flags = 0;
1689                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1690                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1691
1692                 ieee80211_radiotap_tx(vap, m0);
1693         }
1694
1695         if (type == IEEE80211_FC0_TYPE_MGT ||
1696             type == IEEE80211_FC0_TYPE_CTL ||
1697             (m0->m_flags & M_EAPOL) != 0) {
1698                 rate = tp->mgmtrate;
1699         } else {
1700                 /* for data frames */
1701                 if (ismcast)
1702                         rate = tp->mcastrate;
1703                 else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1704                         rate = tp->ucastrate;
1705                 else
1706                         rate = urtw_rtl2rate(sc->sc_currate);
1707         }
1708
1709         sc->sc_stats.txrates[sc->sc_currate]++;
1710
1711         if (ismcast)
1712                 txdur = pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1713                     IEEE80211_CRC_LEN, rate, 0, 0);
1714         else {
1715                 acktime = urtw_compute_txtime(14, 2,0, 0);
1716                 if ((m0->m_pkthdr.len + 4) > vap->iv_rtsthreshold) {
1717                         rtsenable = 1;
1718                         ctsenable = 0;
1719                         rtstime = urtw_compute_txtime(URTW_ACKCTS_LEN, 2, 0, 0);
1720                         ctstime = urtw_compute_txtime(14, 2, 0, 0);
1721                         pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1722                             IEEE80211_CRC_LEN, rate, 0, isshort);
1723                         rtsdur = ctstime + pkttime + acktime +
1724                             3 * URTW_ASIFS_TIME;
1725                         txdur = rtstime + rtsdur;
1726                 } else {
1727                         rtsenable = ctsenable = rtsdur = 0;
1728                         pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1729                             IEEE80211_CRC_LEN, rate, 0, isshort);
1730                         txdur = pkttime + URTW_ASIFS_TIME + acktime;
1731                 }
1732
1733                 if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
1734                         dur = urtw_compute_txtime(m0->m_pkthdr.len +
1735                             IEEE80211_CRC_LEN, rate, 0, isshort) +
1736                             3 * URTW_ASIFS_TIME +
1737                             2 * acktime;
1738                 else
1739                         dur = URTW_ASIFS_TIME + acktime;
1740         }
1741         USETW(wh->i_dur, dur);
1742
1743         xferlen = m0->m_pkthdr.len;
1744         xferlen += (sc->sc_flags & URTW_RTL8187B) ? (4 * 8) : (4 * 3);
1745         if ((0 == xferlen % 64) || (0 == xferlen % 512))
1746                 xferlen += 1;
1747
1748         memset(data->buf, 0, URTW_TX_MAXSIZE);
1749         flags = m0->m_pkthdr.len & 0xfff;
1750         flags |= URTW_TX_FLAG_NO_ENC;
1751         if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1752             (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
1753             (sc->sc_preamble_mode == URTW_PREAMBLE_MODE_SHORT) &&
1754             (sc->sc_currate != 0))
1755                 flags |= URTW_TX_FLAG_SPLCP;
1756         if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
1757                 flags |= URTW_TX_FLAG_MOREFRAG;
1758
1759         flags |= (sc->sc_currate & 0xf) << URTW_TX_FLAG_TXRATE_SHIFT;
1760
1761         if (sc->sc_flags & URTW_RTL8187B) {
1762                 struct urtw_8187b_txhdr *tx;
1763
1764                 tx = (struct urtw_8187b_txhdr *)data->buf;
1765                 if (ctsenable)
1766                         flags |= URTW_TX_FLAG_CTS;
1767                 if (rtsenable) {
1768                         flags |= URTW_TX_FLAG_RTS;
1769                         flags |= URTW_RIDX_CCK5 << URTW_TX_FLAG_RTSRATE_SHIFT;
1770                         tx->rtsdur = rtsdur;
1771                 }
1772                 tx->flag = htole32(flags);
1773                 tx->txdur = txdur;
1774                 if (type == IEEE80211_FC0_TYPE_MGT &&
1775                     (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1776                     IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1777                         tx->retry = 1;
1778                 else
1779                         tx->retry = URTW_TX_MAXRETRY;
1780                 m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(tx + 1));
1781         } else {
1782                 struct urtw_8187l_txhdr *tx;
1783
1784                 tx = (struct urtw_8187l_txhdr *)data->buf;
1785                 if (rtsenable) {
1786                         flags |= URTW_TX_FLAG_RTS;
1787                         tx->rtsdur = rtsdur;
1788                 }
1789                 flags |= URTW_RIDX_CCK5 << URTW_TX_FLAG_RTSRATE_SHIFT;
1790                 tx->flag = htole32(flags);
1791                 tx->retry = 3;          /* CW minimum  */
1792                 tx->retry |= 7 << 4;    /* CW maximum  */
1793                 tx->retry |= URTW_TX_MAXRETRY << 8;     /* retry limitation  */
1794                 m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(tx + 1));
1795         }
1796
1797         data->buflen = xferlen;
1798         data->ni = ni;
1799         data->m = m0;
1800
1801         if (sc->sc_flags & URTW_RTL8187B) {
1802                 switch (type) {
1803                 case IEEE80211_FC0_TYPE_CTL:
1804                 case IEEE80211_FC0_TYPE_MGT:
1805                         xfer = sc->sc_xfer[URTW_8187B_BULK_TX_EP12];
1806                         break;
1807                 default:
1808                         KASSERT(M_WME_GETAC(m0) < URTW_8187B_TXPIPE_MAX,
1809                             ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1810                         xfer = rtl8187b_pipes[M_WME_GETAC(m0)];
1811                         break;
1812                 }
1813         } else
1814                 xfer = (prior == URTW_PRIORITY_LOW) ?
1815                     sc->sc_xfer[URTW_8187L_BULK_TX_LOW] :
1816                     sc->sc_xfer[URTW_8187L_BULK_TX_NORMAL];
1817
1818         STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1819         usbd_transfer_start(xfer);
1820
1821         error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
1822         if (error != 0)
1823                 device_printf(sc->sc_dev, "could not control LED (%d)\n",
1824                     error);
1825         return (0);
1826 }
1827
1828 static int
1829 urtw_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1830 {
1831         struct ieee80211com *ic = vap->iv_ic;
1832         struct urtw_softc *sc = ic->ic_softc;
1833         struct urtw_vap *uvp = URTW_VAP(vap);
1834         struct ieee80211_node *ni;
1835         usb_error_t error = 0;
1836
1837         DPRINTF(sc, URTW_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1838             ieee80211_state_name[vap->iv_state],
1839             ieee80211_state_name[nstate]);
1840
1841         sc->sc_state = nstate;
1842
1843         IEEE80211_UNLOCK(ic);
1844         URTW_LOCK(sc);
1845         usb_callout_stop(&sc->sc_led_ch);
1846         callout_stop(&sc->sc_watchdog_ch);
1847
1848         switch (nstate) {
1849         case IEEE80211_S_INIT:
1850         case IEEE80211_S_SCAN:
1851         case IEEE80211_S_AUTH:
1852         case IEEE80211_S_ASSOC:
1853                 break;
1854         case IEEE80211_S_RUN:
1855                 ni = ieee80211_ref_node(vap->iv_bss);
1856                 /* setting bssid.  */
1857                 urtw_write32_m(sc, URTW_BSSID, ((uint32_t *)ni->ni_bssid)[0]);
1858                 urtw_write16_m(sc, URTW_BSSID + 4,
1859                     ((uint16_t *)ni->ni_bssid)[2]);
1860                 urtw_update_msr(sc);
1861                 /* XXX maybe the below would be incorrect.  */
1862                 urtw_write16_m(sc, URTW_ATIM_WND, 2);
1863                 urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
1864                 urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
1865                 urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
1866                 error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
1867                 if (error != 0)
1868                         device_printf(sc->sc_dev,
1869                             "could not control LED (%d)\n", error);
1870                 ieee80211_free_node(ni);
1871                 break;
1872         default:
1873                 break;
1874         }
1875 fail:
1876         URTW_UNLOCK(sc);
1877         IEEE80211_LOCK(ic);
1878         return (uvp->newstate(vap, nstate, arg));
1879 }
1880
1881 static void
1882 urtw_watchdog(void *arg)
1883 {
1884         struct urtw_softc *sc = arg;
1885
1886         if (sc->sc_txtimer > 0) {
1887                 if (--sc->sc_txtimer == 0) {
1888                         device_printf(sc->sc_dev, "device timeout\n");
1889                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
1890                         return;
1891                 }
1892                 callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1893         }
1894 }
1895
1896 static void
1897 urtw_set_multi(void *arg)
1898 {
1899         /* XXX don't know how to set a device.  Lack of docs. */
1900 }
1901
1902 static usb_error_t
1903 urtw_set_rate(struct urtw_softc *sc)
1904 {
1905         int i, basic_rate, min_rr_rate, max_rr_rate;
1906         uint16_t data;
1907         usb_error_t error;
1908
1909         basic_rate = URTW_RIDX_OFDM24;
1910         min_rr_rate = URTW_RIDX_OFDM6;
1911         max_rr_rate = URTW_RIDX_OFDM24;
1912
1913         urtw_write8_m(sc, URTW_RESP_RATE,
1914             max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
1915             min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
1916
1917         urtw_read16_m(sc, URTW_BRSR, &data);
1918         data &= ~URTW_BRSR_MBR_8185;
1919
1920         for (i = 0; i <= basic_rate; i++)
1921                 data |= (1 << i);
1922
1923         urtw_write16_m(sc, URTW_BRSR, data);
1924 fail:
1925         return (error);
1926 }
1927
1928 static uint16_t
1929 urtw_rtl2rate(uint32_t rate)
1930 {
1931         unsigned int i;
1932
1933         for (i = 0; i < nitems(urtw_ratetable); i++) {
1934                 if (rate == urtw_ratetable[i].val)
1935                         return urtw_ratetable[i].reg;
1936         }
1937
1938         return (0);
1939 }
1940
1941 static usb_error_t
1942 urtw_update_msr(struct urtw_softc *sc)
1943 {
1944         struct ieee80211com *ic = &sc->sc_ic;
1945         uint8_t data;
1946         usb_error_t error;
1947
1948         urtw_read8_m(sc, URTW_MSR, &data);
1949         data &= ~URTW_MSR_LINK_MASK;
1950
1951         if (sc->sc_state == IEEE80211_S_RUN) {
1952                 switch (ic->ic_opmode) {
1953                 case IEEE80211_M_STA:
1954                 case IEEE80211_M_MONITOR:
1955                         data |= URTW_MSR_LINK_STA;
1956                         if (sc->sc_flags & URTW_RTL8187B)
1957                                 data |= URTW_MSR_LINK_ENEDCA;
1958                         break;
1959                 case IEEE80211_M_IBSS:
1960                         data |= URTW_MSR_LINK_ADHOC;
1961                         break;
1962                 case IEEE80211_M_HOSTAP:
1963                         data |= URTW_MSR_LINK_HOSTAP;
1964                         break;
1965                 default:
1966                         DPRINTF(sc, URTW_DEBUG_STATE,
1967                             "unsupported operation mode 0x%x\n",
1968                             ic->ic_opmode);
1969                         error = USB_ERR_INVAL;
1970                         goto fail;
1971                 }
1972         } else
1973                 data |= URTW_MSR_LINK_NONE;
1974
1975         urtw_write8_m(sc, URTW_MSR, data);
1976 fail:
1977         return (error);
1978 }
1979
1980 static usb_error_t
1981 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data)
1982 {
1983         struct usb_device_request req;
1984         usb_error_t error;
1985
1986         URTW_ASSERT_LOCKED(sc);
1987
1988         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1989         req.bRequest = URTW_8187_GETREGS_REQ;
1990         USETW(req.wValue, (val & 0xff) | 0xff00);
1991         USETW(req.wIndex, (val >> 8) & 0x3);
1992         USETW(req.wLength, sizeof(uint8_t));
1993
1994         error = urtw_do_request(sc, &req, data);
1995         return (error);
1996 }
1997
1998 static usb_error_t
1999 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data)
2000 {
2001         struct usb_device_request req;
2002         usb_error_t error;
2003
2004         URTW_ASSERT_LOCKED(sc);
2005
2006         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2007         req.bRequest = URTW_8187_GETREGS_REQ;
2008         USETW(req.wValue, (val & 0xff) | 0xff00);
2009         USETW(req.wIndex, (val >> 8) & 0x3);
2010         USETW(req.wLength, sizeof(uint16_t));
2011
2012         error = urtw_do_request(sc, &req, data);
2013         return (error);
2014 }
2015
2016 static usb_error_t
2017 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data)
2018 {
2019         struct usb_device_request req;
2020         usb_error_t error;
2021
2022         URTW_ASSERT_LOCKED(sc);
2023
2024         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2025         req.bRequest = URTW_8187_GETREGS_REQ;
2026         USETW(req.wValue, (val & 0xff) | 0xff00);
2027         USETW(req.wIndex, (val >> 8) & 0x3);
2028         USETW(req.wLength, sizeof(uint32_t));
2029
2030         error = urtw_do_request(sc, &req, data);
2031         return (error);
2032 }
2033
2034 static usb_error_t
2035 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data)
2036 {
2037         struct usb_device_request req;
2038
2039         URTW_ASSERT_LOCKED(sc);
2040
2041         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2042         req.bRequest = URTW_8187_SETREGS_REQ;
2043         USETW(req.wValue, (val & 0xff) | 0xff00);
2044         USETW(req.wIndex, (val >> 8) & 0x3);
2045         USETW(req.wLength, sizeof(uint8_t));
2046
2047         return (urtw_do_request(sc, &req, &data));
2048 }
2049
2050 static usb_error_t
2051 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data)
2052 {
2053         struct usb_device_request req;
2054
2055         URTW_ASSERT_LOCKED(sc);
2056
2057         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2058         req.bRequest = URTW_8187_SETREGS_REQ;
2059         USETW(req.wValue, (val & 0xff) | 0xff00);
2060         USETW(req.wIndex, (val >> 8) & 0x3);
2061         USETW(req.wLength, sizeof(uint16_t));
2062
2063         return (urtw_do_request(sc, &req, &data));
2064 }
2065
2066 static usb_error_t
2067 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data)
2068 {
2069         struct usb_device_request req;
2070
2071         URTW_ASSERT_LOCKED(sc);
2072
2073         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2074         req.bRequest = URTW_8187_SETREGS_REQ;
2075         USETW(req.wValue, (val & 0xff) | 0xff00);
2076         USETW(req.wIndex, (val >> 8) & 0x3);
2077         USETW(req.wLength, sizeof(uint32_t));
2078
2079         return (urtw_do_request(sc, &req, &data));
2080 }
2081
2082 static usb_error_t
2083 urtw_get_macaddr(struct urtw_softc *sc)
2084 {
2085         struct ieee80211com *ic = &sc->sc_ic;
2086         uint32_t data;
2087         usb_error_t error;
2088
2089         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
2090         if (error != 0)
2091                 goto fail;
2092         ic->ic_macaddr[0] = data & 0xff;
2093         ic->ic_macaddr[1] = (data & 0xff00) >> 8;
2094         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
2095         if (error != 0)
2096                 goto fail;
2097         ic->ic_macaddr[2] = data & 0xff;
2098         ic->ic_macaddr[3] = (data & 0xff00) >> 8;
2099         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
2100         if (error != 0)
2101                 goto fail;
2102         ic->ic_macaddr[4] = data & 0xff;
2103         ic->ic_macaddr[5] = (data & 0xff00) >> 8;
2104 fail:
2105         return (error);
2106 }
2107
2108 static usb_error_t
2109 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
2110 {
2111 #define URTW_READCMD_LEN                3
2112         int addrlen, i;
2113         int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
2114         usb_error_t error;
2115
2116         /* NB: make sure the buffer is initialized  */
2117         *data = 0;
2118
2119         /* enable EPROM programming */
2120         urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
2121         DELAY(URTW_EPROM_DELAY);
2122
2123         error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
2124         if (error != 0)
2125                 goto fail;
2126         error = urtw_eprom_ck(sc);
2127         if (error != 0)
2128                 goto fail;
2129         error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
2130         if (error != 0)
2131                 goto fail;
2132         if (sc->sc_epromtype == URTW_EEPROM_93C56) {
2133                 addrlen = 8;
2134                 addrstr[0] = addr & (1 << 7);
2135                 addrstr[1] = addr & (1 << 6);
2136                 addrstr[2] = addr & (1 << 5);
2137                 addrstr[3] = addr & (1 << 4);
2138                 addrstr[4] = addr & (1 << 3);
2139                 addrstr[5] = addr & (1 << 2);
2140                 addrstr[6] = addr & (1 << 1);
2141                 addrstr[7] = addr & (1 << 0);
2142         } else {
2143                 addrlen=6;
2144                 addrstr[0] = addr & (1 << 5);
2145                 addrstr[1] = addr & (1 << 4);
2146                 addrstr[2] = addr & (1 << 3);
2147                 addrstr[3] = addr & (1 << 2);
2148                 addrstr[4] = addr & (1 << 1);
2149                 addrstr[5] = addr & (1 << 0);
2150         }
2151         error = urtw_eprom_sendbits(sc, addrstr, addrlen);
2152         if (error != 0)
2153                 goto fail;
2154
2155         error = urtw_eprom_writebit(sc, 0);
2156         if (error != 0)
2157                 goto fail;
2158
2159         for (i = 0; i < 16; i++) {
2160                 error = urtw_eprom_ck(sc);
2161                 if (error != 0)
2162                         goto fail;
2163                 error = urtw_eprom_readbit(sc, &data16);
2164                 if (error != 0)
2165                         goto fail;
2166
2167                 (*data) |= (data16 << (15 - i));
2168         }
2169
2170         error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
2171         if (error != 0)
2172                 goto fail;
2173         error = urtw_eprom_ck(sc);
2174         if (error != 0)
2175                 goto fail;
2176
2177         /* now disable EPROM programming */
2178         urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
2179 fail:
2180         return (error);
2181 #undef URTW_READCMD_LEN
2182 }
2183
2184 static usb_error_t
2185 urtw_eprom_cs(struct urtw_softc *sc, int able)
2186 {
2187         uint8_t data;
2188         usb_error_t error;
2189
2190         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2191         if (able == URTW_EPROM_ENABLE)
2192                 urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
2193         else
2194                 urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
2195         DELAY(URTW_EPROM_DELAY);
2196 fail:
2197         return (error);
2198 }
2199
2200 static usb_error_t
2201 urtw_eprom_ck(struct urtw_softc *sc)
2202 {
2203         uint8_t data;
2204         usb_error_t error;
2205
2206         /* masking  */
2207         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2208         urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
2209         DELAY(URTW_EPROM_DELAY);
2210         /* unmasking  */
2211         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2212         urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
2213         DELAY(URTW_EPROM_DELAY);
2214 fail:
2215         return (error);
2216 }
2217
2218 static usb_error_t
2219 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
2220 {
2221         uint8_t data8;
2222         usb_error_t error;
2223
2224         urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
2225         *data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
2226         DELAY(URTW_EPROM_DELAY);
2227
2228 fail:
2229         return (error);
2230 }
2231
2232 static usb_error_t
2233 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
2234 {
2235         uint8_t data;
2236         usb_error_t error;
2237
2238         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2239         if (bit != 0)
2240                 urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
2241         else
2242                 urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
2243         DELAY(URTW_EPROM_DELAY);
2244 fail:
2245         return (error);
2246 }
2247
2248 static usb_error_t
2249 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
2250 {
2251         int i = 0;
2252         usb_error_t error = 0;
2253
2254         for (i = 0; i < buflen; i++) {
2255                 error = urtw_eprom_writebit(sc, buf[i]);
2256                 if (error != 0)
2257                         goto fail;
2258                 error = urtw_eprom_ck(sc);
2259                 if (error != 0)
2260                         goto fail;
2261         }
2262 fail:
2263         return (error);
2264 }
2265
2266
2267 static usb_error_t
2268 urtw_get_txpwr(struct urtw_softc *sc)
2269 {
2270         int i, j;
2271         uint32_t data;
2272         usb_error_t error;
2273
2274         error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
2275         if (error != 0)
2276                 goto fail;
2277         sc->sc_txpwr_cck_base = data & 0xf;
2278         sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
2279
2280         for (i = 1, j = 0; i < 6; i += 2, j++) {
2281                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
2282                 if (error != 0)
2283                         goto fail;
2284                 sc->sc_txpwr_cck[i] = data & 0xf;
2285                 sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
2286                 sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
2287                 sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
2288         }
2289         for (i = 1, j = 0; i < 4; i += 2, j++) {
2290                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
2291                 if (error != 0)
2292                         goto fail;
2293                 sc->sc_txpwr_cck[i + 6] = data & 0xf;
2294                 sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
2295                 sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
2296                 sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
2297         }
2298         if (sc->sc_flags & URTW_RTL8187B) {
2299                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2, &data);
2300                 if (error != 0)
2301                         goto fail;
2302                 sc->sc_txpwr_cck[1 + 6 + 4] = data & 0xf;
2303                 sc->sc_txpwr_ofdm[1 + 6 + 4] = (data & 0xf0) >> 4;
2304                 error = urtw_eprom_read32(sc, 0x0a, &data);
2305                 if (error != 0)
2306                         goto fail;
2307                 sc->sc_txpwr_cck[2 + 6 + 4] = data & 0xf;
2308                 sc->sc_txpwr_ofdm[2 + 6 + 4] = (data & 0xf0) >> 4;
2309                 error = urtw_eprom_read32(sc, 0x1c, &data);
2310                 if (error != 0)
2311                         goto fail;
2312                 sc->sc_txpwr_cck[3 + 6 + 4] = data & 0xf;
2313                 sc->sc_txpwr_cck[3 + 6 + 4 + 1] = (data & 0xf00) >> 8;
2314                 sc->sc_txpwr_ofdm[3 + 6 + 4] = (data & 0xf0) >> 4;
2315                 sc->sc_txpwr_ofdm[3 + 6 + 4 + 1] = (data & 0xf000) >> 12;
2316         } else {
2317                 for (i = 1, j = 0; i < 4; i += 2, j++) {
2318                         error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
2319                             &data);
2320                         if (error != 0)
2321                                 goto fail;
2322                         sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
2323                         sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
2324                         sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
2325                         sc->sc_txpwr_ofdm[i + 6 + 4 + 1] = (data & 0xf000) >> 12;
2326                 }
2327         }
2328 fail:
2329         return (error);
2330 }
2331
2332
2333 static usb_error_t
2334 urtw_get_rfchip(struct urtw_softc *sc)
2335 {
2336         int ret;
2337         uint8_t data8;
2338         uint32_t data;
2339         usb_error_t error;
2340
2341         if (sc->sc_flags & URTW_RTL8187B) {
2342                 urtw_read8_m(sc, 0xe1, &data8);
2343                 switch (data8) {
2344                 case 0:
2345                         sc->sc_flags |= URTW_RTL8187B_REV_B;
2346                         break;
2347                 case 1:
2348                         sc->sc_flags |= URTW_RTL8187B_REV_D;
2349                         break;
2350                 case 2:
2351                         sc->sc_flags |= URTW_RTL8187B_REV_E;
2352                         break;
2353                 default:
2354                         device_printf(sc->sc_dev, "unknown type: %#x\n", data8);
2355                         sc->sc_flags |= URTW_RTL8187B_REV_B;
2356                         break;
2357                 }
2358         } else {
2359                 urtw_read32_m(sc, URTW_TX_CONF, &data);
2360                 switch (data & URTW_TX_HWMASK) {
2361                 case URTW_TX_R8187vD_B:
2362                         sc->sc_flags |= URTW_RTL8187B;
2363                         break;
2364                 case URTW_TX_R8187vD:
2365                         break;
2366                 default:
2367                         device_printf(sc->sc_dev, "unknown RTL8187L type: %#x\n",
2368                             data & URTW_TX_HWMASK);
2369                         break;
2370                 }
2371         }
2372
2373         error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
2374         if (error != 0)
2375                 goto fail;
2376         switch (data & 0xff) {
2377         case URTW_EPROM_RFCHIPID_RTL8225U:
2378                 error = urtw_8225_isv2(sc, &ret);
2379                 if (error != 0)
2380                         goto fail;
2381                 if (ret == 0) {
2382                         sc->sc_rf_init = urtw_8225_rf_init;
2383                         sc->sc_rf_set_sens = urtw_8225_rf_set_sens;
2384                         sc->sc_rf_set_chan = urtw_8225_rf_set_chan;
2385                         sc->sc_rf_stop = urtw_8225_rf_stop;
2386                 } else {
2387                         sc->sc_rf_init = urtw_8225v2_rf_init;
2388                         sc->sc_rf_set_chan = urtw_8225v2_rf_set_chan;
2389                         sc->sc_rf_stop = urtw_8225_rf_stop;
2390                 }
2391                 sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
2392                 sc->sc_sens = URTW_8225_RF_DEF_SENS;
2393                 break;
2394         case URTW_EPROM_RFCHIPID_RTL8225Z2:
2395                 sc->sc_rf_init = urtw_8225v2b_rf_init;
2396                 sc->sc_rf_set_chan = urtw_8225v2b_rf_set_chan;
2397                 sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
2398                 sc->sc_sens = URTW_8225_RF_DEF_SENS;
2399                 sc->sc_rf_stop = urtw_8225_rf_stop;
2400                 break;
2401         default:
2402                 DPRINTF(sc, URTW_DEBUG_STATE,
2403                     "unsupported RF chip %d\n", data & 0xff);
2404                 error = USB_ERR_INVAL;
2405                 goto fail;
2406         }
2407
2408         device_printf(sc->sc_dev, "%s rf %s hwrev %s\n",
2409             (sc->sc_flags & URTW_RTL8187B) ? "rtl8187b" : "rtl8187l",
2410             ((data & 0xff) == URTW_EPROM_RFCHIPID_RTL8225U) ? "rtl8225u" :
2411             "rtl8225z2",
2412             (sc->sc_flags & URTW_RTL8187B) ? ((data8 == 0) ? "b" :
2413                 (data8 == 1) ? "d" : "e") : "none");
2414
2415 fail:
2416         return (error);
2417 }
2418
2419
2420 static usb_error_t
2421 urtw_led_init(struct urtw_softc *sc)
2422 {
2423         uint32_t rev;
2424         usb_error_t error;
2425
2426         urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
2427         error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
2428         if (error != 0)
2429                 goto fail;
2430
2431         switch (rev & URTW_EPROM_CID_MASK) {
2432         case URTW_EPROM_CID_ALPHA0:
2433                 sc->sc_strategy = URTW_SW_LED_MODE1;
2434                 break;
2435         case URTW_EPROM_CID_SERCOMM_PS:
2436                 sc->sc_strategy = URTW_SW_LED_MODE3;
2437                 break;
2438         case URTW_EPROM_CID_HW_LED:
2439                 sc->sc_strategy = URTW_HW_LED;
2440                 break;
2441         case URTW_EPROM_CID_RSVD0:
2442         case URTW_EPROM_CID_RSVD1:
2443         default:
2444                 sc->sc_strategy = URTW_SW_LED_MODE0;
2445                 break;
2446         }
2447
2448         sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
2449
2450 fail:
2451         return (error);
2452 }
2453
2454
2455 static usb_error_t
2456 urtw_8225_rf_init(struct urtw_softc *sc)
2457 {
2458         unsigned int i;
2459         uint16_t data;
2460         usb_error_t error;
2461
2462         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2463         if (error)
2464                 goto fail;
2465
2466         error = urtw_8225_usb_init(sc);
2467         if (error)
2468                 goto fail;
2469
2470         urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2471         urtw_read16_m(sc, URTW_BRSR, &data);            /* XXX ??? */
2472         urtw_write16_m(sc, URTW_BRSR, 0xffff);
2473         urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2474
2475         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2476         if (error)
2477                 goto fail;
2478         urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2479         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2480         if (error)
2481                 goto fail;
2482
2483         error = urtw_8185_rf_pins_enable(sc);
2484         if (error)
2485                 goto fail;
2486         usb_pause_mtx(&sc->sc_mtx, 1000);
2487
2488         for (i = 0; i < nitems(urtw_8225_rf_part1); i++) {
2489                 urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2490                     urtw_8225_rf_part1[i].val);
2491                 usb_pause_mtx(&sc->sc_mtx, 1);
2492         }
2493         usb_pause_mtx(&sc->sc_mtx, 100);
2494         urtw_8225_write(sc,
2495             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2496         usb_pause_mtx(&sc->sc_mtx, 200);
2497         urtw_8225_write(sc,
2498             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2499         usb_pause_mtx(&sc->sc_mtx, 200);
2500         urtw_8225_write(sc,
2501             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC3);
2502
2503         for (i = 0; i < 95; i++) {
2504                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
2505                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, urtw_8225_rxgain[i]);
2506         }
2507
2508         urtw_8225_write(sc,
2509             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC4);
2510         urtw_8225_write(sc,
2511             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC5);
2512
2513         for (i = 0; i < 128; i++) {
2514                 urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2515                 usb_pause_mtx(&sc->sc_mtx, 1);
2516                 urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2517                 usb_pause_mtx(&sc->sc_mtx, 1);
2518         }
2519
2520         for (i = 0; i < nitems(urtw_8225_rf_part2); i++) {
2521                 urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2522                     urtw_8225_rf_part2[i].val);
2523                 usb_pause_mtx(&sc->sc_mtx, 1);
2524         }
2525
2526         error = urtw_8225_setgain(sc, 4);
2527         if (error)
2528                 goto fail;
2529
2530         for (i = 0; i < nitems(urtw_8225_rf_part3); i++) {
2531                 urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2532                     urtw_8225_rf_part3[i].val);
2533                 usb_pause_mtx(&sc->sc_mtx, 1);
2534         }
2535
2536         urtw_write8_m(sc, URTW_TESTR, 0x0d);
2537
2538         error = urtw_8225_set_txpwrlvl(sc, 1);
2539         if (error)
2540                 goto fail;
2541
2542         urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2543         usb_pause_mtx(&sc->sc_mtx, 1);
2544         urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2545         usb_pause_mtx(&sc->sc_mtx, 1);
2546
2547         /* TX ant A, 0x0 for B */
2548         error = urtw_8185_tx_antenna(sc, 0x3);
2549         if (error)
2550                 goto fail;
2551         urtw_write32_m(sc, URTW_HSSI_PARA, 0x3dc00002);
2552
2553         error = urtw_8225_rf_set_chan(sc, 1);
2554 fail:
2555         return (error);
2556 }
2557
2558 static usb_error_t
2559 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2560 {
2561         usb_error_t error = 0;
2562
2563         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2564 fail:
2565         return (error);
2566 }
2567
2568 static usb_error_t
2569 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2570 {
2571         usb_error_t error;
2572
2573         urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2574         usb_pause_mtx(&sc->sc_mtx, 1);
2575 fail:
2576         return (error);
2577 }
2578
2579 static usb_error_t
2580 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2581 {
2582
2583         data = data & 0xff;
2584         return urtw_8187_write_phy(sc, addr, data);
2585 }
2586
2587 static usb_error_t
2588 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2589 {
2590
2591         data = data & 0xff;
2592         return urtw_8187_write_phy(sc, addr, data | 0x10000);
2593 }
2594
2595 static usb_error_t
2596 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2597 {
2598         uint32_t phyw;
2599         usb_error_t error;
2600
2601         phyw = ((data << 8) | (addr | 0x80));
2602         urtw_write8_m(sc, URTW_PHY_MAGIC4, ((phyw & 0xff000000) >> 24));
2603         urtw_write8_m(sc, URTW_PHY_MAGIC3, ((phyw & 0x00ff0000) >> 16));
2604         urtw_write8_m(sc, URTW_PHY_MAGIC2, ((phyw & 0x0000ff00) >> 8));
2605         urtw_write8_m(sc, URTW_PHY_MAGIC1, ((phyw & 0x000000ff)));
2606         usb_pause_mtx(&sc->sc_mtx, 1);
2607 fail:
2608         return (error);
2609 }
2610
2611 static usb_error_t
2612 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2613 {
2614         usb_error_t error;
2615
2616         urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2617         urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2618         urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2619         urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2620 fail:
2621         return (error);
2622 }
2623
2624 static usb_error_t
2625 urtw_8225_usb_init(struct urtw_softc *sc)
2626 {
2627         uint8_t data;
2628         usb_error_t error;
2629
2630         urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2631         urtw_write8_m(sc, URTW_GPIO, 0);
2632         error = urtw_read8e(sc, 0x53, &data);
2633         if (error)
2634                 goto fail;
2635         error = urtw_write8e(sc, 0x53, data | (1 << 7));
2636         if (error)
2637                 goto fail;
2638         urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2639         urtw_write8_m(sc, URTW_GPIO, 0x20);
2640         urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2641
2642         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2643         urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2644         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2645
2646         usb_pause_mtx(&sc->sc_mtx, 500);
2647 fail:
2648         return (error);
2649 }
2650
2651 static usb_error_t
2652 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
2653 {
2654         uint16_t d80, d82, d84;
2655         usb_error_t error;
2656
2657         urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
2658         d80 &= URTW_RF_PINS_MAGIC1;
2659         urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
2660         urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
2661         d84 &= URTW_RF_PINS_MAGIC2;
2662         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | URTW_RF_PINS_MAGIC3);
2663         urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | URTW_RF_PINS_MAGIC3);
2664         DELAY(10);
2665
2666         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2667         DELAY(2);
2668         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
2669         DELAY(10);
2670
2671         error = urtw_8225_write_s16(sc, addr, 0x8225, &data);
2672         if (error != 0)
2673                 goto fail;
2674
2675         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2676         DELAY(10);
2677         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2678         urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
2679         usb_pause_mtx(&sc->sc_mtx, 2);
2680 fail:
2681         return (error);
2682 }
2683
2684 static usb_error_t
2685 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
2686     uint16_t *data)
2687 {
2688         uint8_t buf[2];
2689         uint16_t data16;
2690         struct usb_device_request req;
2691         usb_error_t error = 0;
2692
2693         data16 = *data;
2694
2695         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2696         req.bRequest = URTW_8187_SETREGS_REQ;
2697         USETW(req.wValue, addr);
2698         USETW(req.wIndex, index);
2699         USETW(req.wLength, sizeof(uint16_t));
2700         buf[0] = (data16 & 0x00ff);
2701         buf[1] = (data16 & 0xff00) >> 8;
2702
2703         error = urtw_do_request(sc, &req, buf);
2704
2705         return (error);
2706 }
2707
2708 static usb_error_t
2709 urtw_8225_rf_set_chan(struct urtw_softc *sc, int chan)
2710 {
2711         usb_error_t error;
2712
2713         error = urtw_8225_set_txpwrlvl(sc, chan);
2714         if (error)
2715                 goto fail;
2716         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
2717         usb_pause_mtx(&sc->sc_mtx, 10);
2718 fail:
2719         return (error);
2720 }
2721
2722 static usb_error_t
2723 urtw_8225_rf_set_sens(struct urtw_softc *sc, int sens)
2724 {
2725         usb_error_t error;
2726
2727         if (sens < 0 || sens > 6)
2728                 return -1;
2729
2730         if (sens > 4)
2731                 urtw_8225_write(sc,
2732                     URTW_8225_ADDR_C_MAGIC, URTW_8225_ADDR_C_DATA_MAGIC1);
2733         else
2734                 urtw_8225_write(sc,
2735                     URTW_8225_ADDR_C_MAGIC, URTW_8225_ADDR_C_DATA_MAGIC2);
2736
2737         sens = 6 - sens;
2738         error = urtw_8225_setgain(sc, sens);
2739         if (error)
2740                 goto fail;
2741
2742         urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[sens]);
2743
2744 fail:
2745         return (error);
2746 }
2747
2748 static usb_error_t
2749 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2750 {
2751         int i, idx, set;
2752         uint8_t *cck_pwltable;
2753         uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2754         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2755         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2756         usb_error_t error;
2757
2758         cck_pwrlvl_max = 11;
2759         ofdm_pwrlvl_max = 25;   /* 12 -> 25  */
2760         ofdm_pwrlvl_min = 10;
2761
2762         /* CCK power setting */
2763         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2764         idx = cck_pwrlvl % 6;
2765         set = cck_pwrlvl / 6;
2766         cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2767             urtw_8225_txpwr_cck;
2768
2769         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2770             urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2771         for (i = 0; i < 8; i++) {
2772                 urtw_8187_write_phy_cck(sc, 0x44 + i,
2773                     cck_pwltable[idx * 8 + i]);
2774         }
2775         usb_pause_mtx(&sc->sc_mtx, 1);
2776
2777         /* OFDM power setting */
2778         ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2779             ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2780         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2781
2782         idx = ofdm_pwrlvl % 6;
2783         set = ofdm_pwrlvl / 6;
2784
2785         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
2786         if (error)
2787                 goto fail;
2788         urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2789         urtw_8187_write_phy_ofdm(sc, 6, 0);
2790         urtw_8187_write_phy_ofdm(sc, 8, 0);
2791
2792         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2793             urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2794         urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2795         urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2796         usb_pause_mtx(&sc->sc_mtx, 1);
2797 fail:
2798         return (error);
2799 }
2800
2801
2802 static usb_error_t
2803 urtw_8225_rf_stop(struct urtw_softc *sc)
2804 {
2805         uint8_t data;
2806         usb_error_t error;
2807
2808         urtw_8225_write(sc, 0x4, 0x1f);
2809
2810         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2811         if (error)
2812                 goto fail;
2813
2814         urtw_read8_m(sc, URTW_CONFIG3, &data);
2815         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
2816         if (sc->sc_flags & URTW_RTL8187B) {
2817                 urtw_write32_m(sc, URTW_ANAPARAM2,
2818                     URTW_8187B_8225_ANAPARAM2_OFF);
2819                 urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_OFF);
2820                 urtw_write32_m(sc, URTW_ANAPARAM3,
2821                     URTW_8187B_8225_ANAPARAM3_OFF);
2822         } else {
2823                 urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8225_ANAPARAM2_OFF);
2824                 urtw_write32_m(sc, URTW_ANAPARAM, URTW_8225_ANAPARAM_OFF);
2825         }
2826
2827         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
2828         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2829         if (error)
2830                 goto fail;
2831
2832 fail:
2833         return (error);
2834 }
2835
2836 static usb_error_t
2837 urtw_8225v2_rf_init(struct urtw_softc *sc)
2838 {
2839         unsigned int i;
2840         uint16_t data;
2841         uint32_t data32;
2842         usb_error_t error;
2843
2844         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2845         if (error)
2846                 goto fail;
2847
2848         error = urtw_8225_usb_init(sc);
2849         if (error)
2850                 goto fail;
2851
2852         urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2853         urtw_read16_m(sc, URTW_BRSR, &data);            /* XXX ??? */
2854         urtw_write16_m(sc, URTW_BRSR, 0xffff);
2855         urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2856
2857         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2858         if (error)
2859                 goto fail;
2860         urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2861         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2862         if (error)
2863                 goto fail;
2864
2865         error = urtw_8185_rf_pins_enable(sc);
2866         if (error)
2867                 goto fail;
2868
2869         usb_pause_mtx(&sc->sc_mtx, 500);
2870
2871         for (i = 0; i < nitems(urtw_8225v2_rf_part1); i++) {
2872                 urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
2873                     urtw_8225v2_rf_part1[i].val);
2874         }
2875         usb_pause_mtx(&sc->sc_mtx, 50);
2876
2877         urtw_8225_write(sc,
2878             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC1);
2879
2880         for (i = 0; i < 95; i++) {
2881                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
2882                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC,
2883                     urtw_8225v2_rxgain[i]);
2884         }
2885
2886         urtw_8225_write(sc,
2887             URTW_8225_ADDR_3_MAGIC, URTW_8225_ADDR_3_DATA_MAGIC1);
2888         urtw_8225_write(sc,
2889             URTW_8225_ADDR_5_MAGIC, URTW_8225_ADDR_5_DATA_MAGIC1);
2890         urtw_8225_write(sc,
2891             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC2);
2892         urtw_8225_write(sc,
2893             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2894         usb_pause_mtx(&sc->sc_mtx, 100);
2895         urtw_8225_write(sc,
2896             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2897         usb_pause_mtx(&sc->sc_mtx, 100);
2898
2899         error = urtw_8225_read(sc, URTW_8225_ADDR_6_MAGIC, &data32);
2900         if (error != 0)
2901                 goto fail;
2902         if (data32 != URTW_8225_ADDR_6_DATA_MAGIC1)
2903                 device_printf(sc->sc_dev, "expect 0xe6!! (0x%x)\n", data32);
2904         if (!(data32 & URTW_8225_ADDR_6_DATA_MAGIC2)) {
2905                 urtw_8225_write(sc,
2906                     URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2907                 usb_pause_mtx(&sc->sc_mtx, 100);
2908                 urtw_8225_write(sc,
2909                     URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2910                 usb_pause_mtx(&sc->sc_mtx, 50);
2911                 error = urtw_8225_read(sc, URTW_8225_ADDR_6_MAGIC, &data32);
2912                 if (error != 0)
2913                         goto fail;
2914                 if (!(data32 & URTW_8225_ADDR_6_DATA_MAGIC2))
2915                         device_printf(sc->sc_dev, "RF calibration failed\n");
2916         }
2917         usb_pause_mtx(&sc->sc_mtx, 100);
2918
2919         urtw_8225_write(sc,
2920             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC6);
2921         for (i = 0; i < 128; i++) {
2922                 urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2923                 urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2924         }
2925
2926         for (i = 0; i < nitems(urtw_8225v2_rf_part2); i++) {
2927                 urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
2928                     urtw_8225v2_rf_part2[i].val);
2929         }
2930
2931         error = urtw_8225v2_setgain(sc, 4);
2932         if (error)
2933                 goto fail;
2934
2935         for (i = 0; i < nitems(urtw_8225v2_rf_part3); i++) {
2936                 urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
2937                     urtw_8225v2_rf_part3[i].val);
2938         }
2939
2940         urtw_write8_m(sc, URTW_TESTR, 0x0d);
2941
2942         error = urtw_8225v2_set_txpwrlvl(sc, 1);
2943         if (error)
2944                 goto fail;
2945
2946         urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2947         urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2948
2949         /* TX ant A, 0x0 for B */
2950         error = urtw_8185_tx_antenna(sc, 0x3);
2951         if (error)
2952                 goto fail;
2953         urtw_write32_m(sc, URTW_HSSI_PARA, 0x3dc00002);
2954
2955         error = urtw_8225_rf_set_chan(sc, 1);
2956 fail:
2957         return (error);
2958 }
2959
2960 static usb_error_t
2961 urtw_8225v2_rf_set_chan(struct urtw_softc *sc, int chan)
2962 {
2963         usb_error_t error;
2964
2965         error = urtw_8225v2_set_txpwrlvl(sc, chan);
2966         if (error)
2967                 goto fail;
2968
2969         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
2970         usb_pause_mtx(&sc->sc_mtx, 10);
2971 fail:
2972         return (error);
2973 }
2974
2975 static usb_error_t
2976 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
2977 {
2978         int i;
2979         int16_t bit;
2980         uint8_t rlen = 12, wlen = 6;
2981         uint16_t o1, o2, o3, tmp;
2982         uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
2983         uint32_t mask = 0x80000000, value = 0;
2984         usb_error_t error;
2985
2986         urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
2987         urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
2988         urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
2989         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | URTW_RF_PINS_MAGIC4);
2990         urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | URTW_RF_PINS_MAGIC4);
2991         o1 &= ~URTW_RF_PINS_MAGIC4;
2992         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
2993         DELAY(5);
2994         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
2995         DELAY(5);
2996
2997         for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
2998                 bit = ((d2w & mask) != 0) ? 1 : 0;
2999
3000                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
3001                 DELAY(2);
3002                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3003                     URTW_BB_HOST_BANG_CLK);
3004                 DELAY(2);
3005                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3006                     URTW_BB_HOST_BANG_CLK);
3007                 DELAY(2);
3008                 mask = mask >> 1;
3009                 if (i == 2)
3010                         break;
3011                 bit = ((d2w & mask) != 0) ? 1 : 0;
3012                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3013                     URTW_BB_HOST_BANG_CLK);
3014                 DELAY(2);
3015                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3016                     URTW_BB_HOST_BANG_CLK);
3017                 DELAY(2);
3018                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
3019                 DELAY(1);
3020         }
3021         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
3022             URTW_BB_HOST_BANG_CLK);
3023         DELAY(2);
3024         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
3025         DELAY(2);
3026         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
3027         DELAY(2);
3028
3029         mask = 0x800;
3030         for (i = 0; i < rlen; i++, mask = mask >> 1) {
3031                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3032                     o1 | URTW_BB_HOST_BANG_RW);
3033                 DELAY(2);
3034                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3035                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3036                 DELAY(2);
3037                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3038                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3039                 DELAY(2);
3040                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3041                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3042                 DELAY(2);
3043
3044                 urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
3045                 value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
3046                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3047                     o1 | URTW_BB_HOST_BANG_RW);
3048                 DELAY(2);
3049         }
3050
3051         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
3052             URTW_BB_HOST_BANG_RW);
3053         DELAY(2);
3054
3055         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
3056         urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
3057         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, URTW_RF_PINS_OUTPUT_MAGIC1);
3058
3059         if (data != NULL)
3060                 *data = value;
3061 fail:
3062         return (error);
3063 }
3064
3065
3066 static usb_error_t
3067 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3068 {
3069         int i;
3070         uint8_t *cck_pwrtable;
3071         uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3072         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3073         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3074         usb_error_t error;
3075
3076         /* CCK power setting */
3077         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3078         cck_pwrlvl += sc->sc_txpwr_cck_base;
3079         cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3080         cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3081             urtw_8225v2_txpwr_cck;
3082
3083         for (i = 0; i < 8; i++)
3084                 urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3085
3086         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3087             urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3088         usb_pause_mtx(&sc->sc_mtx, 1);
3089
3090         /* OFDM power setting */
3091         ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3092                 ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3093         ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3094         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3095
3096         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3097         if (error)
3098                 goto fail;
3099
3100         urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3101         urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3102         urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3103         urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3104         urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3105
3106         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3107             urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3108         usb_pause_mtx(&sc->sc_mtx, 1);
3109 fail:
3110         return (error);
3111 }
3112
3113 static usb_error_t
3114 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3115 {
3116         uint8_t *gainp;
3117         usb_error_t error;
3118
3119         /* XXX for A?  */
3120         gainp = urtw_8225v2_gain_bg;
3121         urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3122         usb_pause_mtx(&sc->sc_mtx, 1);
3123         urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3124         usb_pause_mtx(&sc->sc_mtx, 1);
3125         urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3126         usb_pause_mtx(&sc->sc_mtx, 1);
3127         urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3128         usb_pause_mtx(&sc->sc_mtx, 1);
3129 fail:
3130         return (error);
3131 }
3132
3133 static usb_error_t
3134 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
3135 {
3136         uint32_t data;
3137         usb_error_t error;
3138
3139         *ret = 1;
3140
3141         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, URTW_RF_PINS_MAGIC5);
3142         urtw_write16_m(sc, URTW_RF_PINS_SELECT, URTW_RF_PINS_MAGIC5);
3143         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, URTW_RF_PINS_MAGIC5);
3144         usb_pause_mtx(&sc->sc_mtx, 500);
3145
3146         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC,
3147             URTW_8225_ADDR_0_DATA_MAGIC1);
3148
3149         error = urtw_8225_read(sc, URTW_8225_ADDR_8_MAGIC, &data);
3150         if (error != 0)
3151                 goto fail;
3152         if (data != URTW_8225_ADDR_8_DATA_MAGIC1)
3153                 *ret = 0;
3154         else {
3155                 error = urtw_8225_read(sc, URTW_8225_ADDR_9_MAGIC, &data);
3156                 if (error != 0)
3157                         goto fail;
3158                 if (data != URTW_8225_ADDR_9_DATA_MAGIC1)
3159                         *ret = 0;
3160         }
3161
3162         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC,
3163             URTW_8225_ADDR_0_DATA_MAGIC2);
3164 fail:
3165         return (error);
3166 }
3167
3168 static usb_error_t
3169 urtw_8225v2b_rf_init(struct urtw_softc *sc)
3170 {
3171         struct ieee80211com *ic = &sc->sc_ic;
3172         unsigned int i;
3173         uint8_t data8;
3174         usb_error_t error;
3175
3176         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3177         if (error)
3178                 goto fail;
3179
3180         /*
3181          * initialize extra registers on 8187
3182          */
3183         urtw_write16_m(sc, URTW_BRSR_8187B, 0xfff);
3184
3185         /* retry limit */
3186         urtw_read8_m(sc, URTW_CW_CONF, &data8);
3187         data8 |= URTW_CW_CONF_PERPACKET_RETRY;
3188         urtw_write8_m(sc, URTW_CW_CONF, data8);
3189
3190         /* TX AGC */
3191         urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
3192         data8 |= URTW_TX_AGC_CTL_PERPACKET_GAIN;
3193         urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
3194
3195         /* Auto Rate Fallback Control */
3196 #define URTW_ARFR       0x1e0
3197         urtw_write16_m(sc, URTW_ARFR, 0xfff);
3198         urtw_read8_m(sc, URTW_RATE_FALLBACK, &data8);
3199         urtw_write8_m(sc, URTW_RATE_FALLBACK,
3200             data8 | URTW_RATE_FALLBACK_ENABLE);
3201
3202         urtw_read8_m(sc, URTW_MSR, &data8);
3203         urtw_write8_m(sc, URTW_MSR, data8 & 0xf3);
3204         urtw_read8_m(sc, URTW_MSR, &data8);
3205         urtw_write8_m(sc, URTW_MSR, data8 | URTW_MSR_LINK_ENEDCA);
3206         urtw_write8_m(sc, URTW_ACM_CONTROL, sc->sc_acmctl);
3207
3208         urtw_write16_m(sc, URTW_ATIM_WND, 2);
3209         urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3210 #define URTW_FEMR_FOR_8187B     0x1d4
3211         urtw_write16_m(sc, URTW_FEMR_FOR_8187B, 0xffff);
3212
3213         /* led type */
3214         urtw_read8_m(sc, URTW_CONFIG1, &data8);
3215         data8 = (data8 & 0x3f) | 0x80;
3216         urtw_write8_m(sc, URTW_CONFIG1, data8);
3217
3218         /* applying MAC address again.  */
3219         urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)ic->ic_macaddr)[0]);
3220         urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)ic->ic_macaddr)[1] & 0xffff);
3221
3222         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3223         if (error)
3224                 goto fail;
3225
3226         urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3227
3228         /*
3229          * MAC configuration
3230          */
3231         for (i = 0; i < nitems(urtw_8225v2b_rf_part1); i++)
3232                 urtw_write8_m(sc, urtw_8225v2b_rf_part1[i].reg,
3233                     urtw_8225v2b_rf_part1[i].val);
3234         urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3235         urtw_write16_m(sc, URTW_INT_MIG, 0x0000);
3236         urtw_write32_m(sc, 0x1f0, 0);
3237         urtw_write32_m(sc, 0x1f4, 0);
3238         urtw_write8_m(sc, 0x1f8, 0);
3239         urtw_write32_m(sc, URTW_RF_TIMING, 0x4001);
3240
3241 #define URTW_RFSW_CTRL  0x272
3242         urtw_write16_m(sc, URTW_RFSW_CTRL, 0x569a);
3243
3244         /*
3245          * initialize PHY
3246          */
3247         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3248         if (error)
3249                 goto fail;
3250         urtw_read8_m(sc, URTW_CONFIG3, &data8);
3251         urtw_write8_m(sc, URTW_CONFIG3,
3252             data8 | URTW_CONFIG3_ANAPARAM_WRITE);
3253
3254         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3255         if (error)
3256                 goto fail;
3257
3258         /* setup RFE initial timing */
3259         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3260         urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3261         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3262         usb_pause_mtx(&sc->sc_mtx, 1100);
3263
3264         for (i = 0; i < nitems(urtw_8225v2b_rf_part0); i++) {
3265                 urtw_8225_write(sc, urtw_8225v2b_rf_part0[i].reg,
3266                     urtw_8225v2b_rf_part0[i].val);
3267                 usb_pause_mtx(&sc->sc_mtx, 1);
3268         }
3269         urtw_8225_write(sc, 0x00, 0x01b7);
3270
3271         for (i = 0; i < 95; i++) {
3272                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
3273                 usb_pause_mtx(&sc->sc_mtx, 1);
3274                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC,
3275                     urtw_8225v2b_rxgain[i]);
3276                 usb_pause_mtx(&sc->sc_mtx, 1);
3277         }
3278
3279         urtw_8225_write(sc, URTW_8225_ADDR_3_MAGIC, 0x080);
3280         usb_pause_mtx(&sc->sc_mtx, 1);
3281         urtw_8225_write(sc, URTW_8225_ADDR_5_MAGIC, 0x004);
3282         usb_pause_mtx(&sc->sc_mtx, 1);
3283         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC, 0x0b7);
3284         usb_pause_mtx(&sc->sc_mtx, 1);
3285         usb_pause_mtx(&sc->sc_mtx, 3000);
3286         urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, 0xc4d);
3287         usb_pause_mtx(&sc->sc_mtx, 2000);
3288         urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, 0x44d);
3289         usb_pause_mtx(&sc->sc_mtx, 1);
3290         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC, 0x2bf);
3291         usb_pause_mtx(&sc->sc_mtx, 1);
3292
3293         urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3294         urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3295         urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3296
3297         urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3298         for (i = 0; i < 128; i++) {
3299                 uint32_t addr, data;
3300
3301                 data = (urtw_8225z2_agc[i] << 8) | 0x0000008f;
3302                 addr = ((i + 0x80) << 8) | 0x0000008e;
3303
3304                 urtw_8187_write_phy_ofdm(sc, data & 0x7f, (data >> 8) & 0xff);
3305                 urtw_8187_write_phy_ofdm(sc, addr & 0x7f, (addr >> 8) & 0xff);
3306                 urtw_8187_write_phy_ofdm(sc, 0x0e, 0x00);
3307         }
3308         urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3309
3310         for (i = 0; i < nitems(urtw_8225v2b_rf_part2); i++)
3311                 urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2b_rf_part2[i].val);
3312
3313         urtw_write32_m(sc, URTW_8187B_AC_VO, (7 << 12) | (3 << 8) | 0x1c);
3314         urtw_write32_m(sc, URTW_8187B_AC_VI, (7 << 12) | (3 << 8) | 0x1c);
3315         urtw_write32_m(sc, URTW_8187B_AC_BE, (7 << 12) | (3 << 8) | 0x1c);
3316         urtw_write32_m(sc, URTW_8187B_AC_BK, (7 << 12) | (3 << 8) | 0x1c);
3317
3318         urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3319         urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3320         urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3321         urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3322
3323 fail:
3324         return (error);
3325 }
3326
3327 static usb_error_t
3328 urtw_8225v2b_rf_set_chan(struct urtw_softc *sc, int chan)
3329 {
3330         usb_error_t error;
3331
3332         error = urtw_8225v2b_set_txpwrlvl(sc, chan);
3333         if (error)
3334                 goto fail;
3335
3336         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
3337         usb_pause_mtx(&sc->sc_mtx, 10);
3338 fail:
3339         return (error);
3340 }
3341
3342 static usb_error_t
3343 urtw_8225v2b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3344 {
3345         int i;
3346         uint8_t *cck_pwrtable;
3347         uint8_t cck_pwrlvl_max = 15;
3348         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3349         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3350         usb_error_t error;
3351
3352         /* CCK power setting */
3353         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ?
3354             ((sc->sc_flags & URTW_RTL8187B_REV_B) ? cck_pwrlvl_max : 22) :
3355             (cck_pwrlvl + ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 0 : 7));
3356         cck_pwrlvl += sc->sc_txpwr_cck_base;
3357         cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3358         cck_pwrtable = (chan == 14) ? urtw_8225v2b_txpwr_cck_ch14 :
3359             urtw_8225v2b_txpwr_cck;
3360
3361         if (sc->sc_flags & URTW_RTL8187B_REV_B)
3362                 cck_pwrtable += (cck_pwrlvl <= 6) ? 0 :
3363                     ((cck_pwrlvl <= 11) ? 8 : 16);
3364         else
3365                 cck_pwrtable += (cck_pwrlvl <= 5) ? 0 :
3366                     ((cck_pwrlvl <= 11) ? 8 : ((cck_pwrlvl <= 17) ? 16 : 24));
3367
3368         for (i = 0; i < 8; i++)
3369                 urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3370
3371         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3372             urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3373         usb_pause_mtx(&sc->sc_mtx, 1);
3374
3375         /* OFDM power setting */
3376         ofdm_pwrlvl = (ofdm_pwrlvl > 15) ?
3377             ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 17 : 25) :
3378             (ofdm_pwrlvl + ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 2 : 10));
3379         ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3380         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3381
3382         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3383             urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3384
3385         if (sc->sc_flags & URTW_RTL8187B_REV_B) {
3386                 if (ofdm_pwrlvl <= 11) {
3387                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
3388                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
3389                 } else {
3390                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3391                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3392                 }
3393         } else {
3394                 if (ofdm_pwrlvl <= 11) {
3395                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3396                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3397                 } else if (ofdm_pwrlvl <= 17) {
3398                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
3399                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
3400                 } else {
3401                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
3402                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
3403                 }
3404         }
3405         usb_pause_mtx(&sc->sc_mtx, 1);
3406 fail:
3407         return (error);
3408 }
3409
3410 static usb_error_t
3411 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
3412 {
3413         struct usb_device_request req;
3414         usb_error_t error;
3415
3416         req.bmRequestType = UT_READ_VENDOR_DEVICE;
3417         req.bRequest = URTW_8187_GETREGS_REQ;
3418         USETW(req.wValue, val | 0xfe00);
3419         USETW(req.wIndex, 0);
3420         USETW(req.wLength, sizeof(uint8_t));
3421
3422         error = urtw_do_request(sc, &req, data);
3423         return (error);
3424 }
3425
3426 static usb_error_t
3427 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
3428 {
3429         struct usb_device_request req;
3430
3431         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
3432         req.bRequest = URTW_8187_SETREGS_REQ;
3433         USETW(req.wValue, val | 0xfe00);
3434         USETW(req.wIndex, 0);
3435         USETW(req.wLength, sizeof(uint8_t));
3436
3437         return (urtw_do_request(sc, &req, &data));
3438 }
3439
3440 static usb_error_t
3441 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
3442 {
3443         uint8_t data;
3444         usb_error_t error;
3445
3446         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3447         if (error)
3448                 goto fail;
3449
3450         urtw_read8_m(sc, URTW_CONFIG3, &data);
3451         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3452         urtw_write32_m(sc, URTW_ANAPARAM, val);
3453         urtw_read8_m(sc, URTW_CONFIG3, &data);
3454         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3455
3456         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3457         if (error)
3458                 goto fail;
3459 fail:
3460         return (error);
3461 }
3462
3463 static usb_error_t
3464 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
3465 {
3466         uint8_t data;
3467         usb_error_t error;
3468
3469         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3470         if (error)
3471                 goto fail;
3472
3473         urtw_read8_m(sc, URTW_CONFIG3, &data);
3474         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3475         urtw_write32_m(sc, URTW_ANAPARAM2, val);
3476         urtw_read8_m(sc, URTW_CONFIG3, &data);
3477         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3478
3479         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3480         if (error)
3481                 goto fail;
3482 fail:
3483         return (error);
3484 }
3485
3486 static usb_error_t
3487 urtw_intr_enable(struct urtw_softc *sc)
3488 {
3489         usb_error_t error;
3490
3491         urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
3492 fail:
3493         return (error);
3494 }
3495
3496 static usb_error_t
3497 urtw_intr_disable(struct urtw_softc *sc)
3498 {
3499         usb_error_t error;
3500
3501         urtw_write16_m(sc, URTW_INTR_MASK, 0);
3502 fail:
3503         return (error);
3504 }
3505
3506 static usb_error_t
3507 urtw_reset(struct urtw_softc *sc)
3508 {
3509         uint8_t data;
3510         usb_error_t error;
3511
3512         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3513         if (error)
3514                 goto fail;
3515         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3516         if (error)
3517                 goto fail;
3518
3519         error = urtw_intr_disable(sc);
3520         if (error)
3521                 goto fail;
3522         usb_pause_mtx(&sc->sc_mtx, 100);
3523
3524         error = urtw_write8e(sc, 0x18, 0x10);
3525         if (error != 0)
3526                 goto fail;
3527         error = urtw_write8e(sc, 0x18, 0x11);
3528         if (error != 0)
3529                 goto fail;
3530         error = urtw_write8e(sc, 0x18, 0x00);
3531         if (error != 0)
3532                 goto fail;
3533         usb_pause_mtx(&sc->sc_mtx, 100);
3534
3535         urtw_read8_m(sc, URTW_CMD, &data);
3536         data = (data & 0x2) | URTW_CMD_RST;
3537         urtw_write8_m(sc, URTW_CMD, data);
3538         usb_pause_mtx(&sc->sc_mtx, 100);
3539
3540         urtw_read8_m(sc, URTW_CMD, &data);
3541         if (data & URTW_CMD_RST) {
3542                 device_printf(sc->sc_dev, "reset timeout\n");
3543                 goto fail;
3544         }
3545
3546         error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
3547         if (error)
3548                 goto fail;
3549         usb_pause_mtx(&sc->sc_mtx, 100);
3550
3551         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3552         if (error)
3553                 goto fail;
3554         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3555         if (error)
3556                 goto fail;
3557 fail:
3558         return (error);
3559 }
3560
3561 static usb_error_t
3562 urtw_led_ctl(struct urtw_softc *sc, int mode)
3563 {
3564         usb_error_t error = 0;
3565
3566         switch (sc->sc_strategy) {
3567         case URTW_SW_LED_MODE0:
3568                 error = urtw_led_mode0(sc, mode);
3569                 break;
3570         case URTW_SW_LED_MODE1:
3571                 error = urtw_led_mode1(sc, mode);
3572                 break;
3573         case URTW_SW_LED_MODE2:
3574                 error = urtw_led_mode2(sc, mode);
3575                 break;
3576         case URTW_SW_LED_MODE3:
3577                 error = urtw_led_mode3(sc, mode);
3578                 break;
3579         default:
3580                 DPRINTF(sc, URTW_DEBUG_STATE,
3581                     "unsupported LED mode %d\n", sc->sc_strategy);
3582                 error = USB_ERR_INVAL;
3583                 break;
3584         }
3585
3586         return (error);
3587 }
3588
3589 static usb_error_t
3590 urtw_led_mode0(struct urtw_softc *sc, int mode)
3591 {
3592
3593         switch (mode) {
3594         case URTW_LED_CTL_POWER_ON:
3595                 sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
3596                 break;
3597         case URTW_LED_CTL_TX:
3598                 if (sc->sc_gpio_ledinprogress == 1)
3599                         return (0);
3600
3601                 sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
3602                 sc->sc_gpio_blinktime = 2;
3603                 break;
3604         case URTW_LED_CTL_LINK:
3605                 sc->sc_gpio_ledstate = URTW_LED_ON;
3606                 break;
3607         default:
3608                 DPRINTF(sc, URTW_DEBUG_STATE,
3609                     "unsupported LED mode 0x%x", mode);
3610                 return (USB_ERR_INVAL);
3611         }
3612
3613         switch (sc->sc_gpio_ledstate) {
3614         case URTW_LED_ON:
3615                 if (sc->sc_gpio_ledinprogress != 0)
3616                         break;
3617                 urtw_led_on(sc, URTW_LED_GPIO);
3618                 break;
3619         case URTW_LED_BLINK_NORMAL:
3620                 if (sc->sc_gpio_ledinprogress != 0)
3621                         break;
3622                 sc->sc_gpio_ledinprogress = 1;
3623                 sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
3624                         URTW_LED_OFF : URTW_LED_ON;
3625                 usb_callout_reset(&sc->sc_led_ch, hz, urtw_led_ch, sc);
3626                 break;
3627         case URTW_LED_POWER_ON_BLINK:
3628                 urtw_led_on(sc, URTW_LED_GPIO);
3629                 usb_pause_mtx(&sc->sc_mtx, 100);
3630                 urtw_led_off(sc, URTW_LED_GPIO);
3631                 break;
3632         default:
3633                 DPRINTF(sc, URTW_DEBUG_STATE,
3634                     "unknown LED status 0x%x", sc->sc_gpio_ledstate);
3635                 return (USB_ERR_INVAL);
3636         }
3637         return (0);
3638 }
3639
3640 static usb_error_t
3641 urtw_led_mode1(struct urtw_softc *sc, int mode)
3642 {
3643         return (USB_ERR_INVAL);
3644 }
3645
3646 static usb_error_t
3647 urtw_led_mode2(struct urtw_softc *sc, int mode)
3648 {
3649         return (USB_ERR_INVAL);
3650 }
3651
3652 static usb_error_t
3653 urtw_led_mode3(struct urtw_softc *sc, int mode)
3654 {
3655         return (USB_ERR_INVAL);
3656 }
3657
3658 static usb_error_t
3659 urtw_led_on(struct urtw_softc *sc, int type)
3660 {
3661         usb_error_t error;
3662
3663         if (type == URTW_LED_GPIO) {
3664                 switch (sc->sc_gpio_ledpin) {
3665                 case URTW_LED_PIN_GPIO0:
3666                         urtw_write8_m(sc, URTW_GPIO, 0x01);
3667                         urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
3668                         break;
3669                 default:
3670                         DPRINTF(sc, URTW_DEBUG_STATE,
3671                             "unsupported LED PIN type 0x%x",
3672                             sc->sc_gpio_ledpin);
3673                         error = USB_ERR_INVAL;
3674                         goto fail;
3675                 }
3676         } else {
3677                 DPRINTF(sc, URTW_DEBUG_STATE,
3678                     "unsupported LED type 0x%x", type);
3679                 error = USB_ERR_INVAL;
3680                 goto fail;
3681         }
3682
3683         sc->sc_gpio_ledon = 1;
3684 fail:
3685         return (error);
3686 }
3687
3688 static usb_error_t
3689 urtw_led_off(struct urtw_softc *sc, int type)
3690 {
3691         usb_error_t error;
3692
3693         if (type == URTW_LED_GPIO) {
3694                 switch (sc->sc_gpio_ledpin) {
3695                 case URTW_LED_PIN_GPIO0:
3696                         urtw_write8_m(sc, URTW_GPIO, URTW_GPIO_DATA_MAGIC1);
3697                         urtw_write8_m(sc,
3698                             URTW_GP_ENABLE, URTW_GP_ENABLE_DATA_MAGIC1);
3699                         break;
3700                 default:
3701                         DPRINTF(sc, URTW_DEBUG_STATE,
3702                             "unsupported LED PIN type 0x%x",
3703                             sc->sc_gpio_ledpin);
3704                         error = USB_ERR_INVAL;
3705                         goto fail;
3706                 }
3707         } else {
3708                 DPRINTF(sc, URTW_DEBUG_STATE,
3709                     "unsupported LED type 0x%x", type);
3710                 error = USB_ERR_INVAL;
3711                 goto fail;
3712         }
3713
3714         sc->sc_gpio_ledon = 0;
3715
3716 fail:
3717         return (error);
3718 }
3719
3720 static void
3721 urtw_led_ch(void *arg)
3722 {
3723         struct urtw_softc *sc = arg;
3724         struct ieee80211com *ic = &sc->sc_ic;
3725
3726         ieee80211_runtask(ic, &sc->sc_led_task);
3727 }
3728
3729 static void
3730 urtw_ledtask(void *arg, int pending)
3731 {
3732         struct urtw_softc *sc = arg;
3733
3734         if (sc->sc_strategy != URTW_SW_LED_MODE0) {
3735                 DPRINTF(sc, URTW_DEBUG_STATE,
3736                     "could not process a LED strategy 0x%x",
3737                     sc->sc_strategy);
3738                 return;
3739         }
3740
3741         URTW_LOCK(sc);
3742         urtw_led_blink(sc);
3743         URTW_UNLOCK(sc);
3744 }
3745
3746 static usb_error_t
3747 urtw_led_blink(struct urtw_softc *sc)
3748 {
3749         uint8_t ing = 0;
3750         usb_error_t error;
3751
3752         if (sc->sc_gpio_blinkstate == URTW_LED_ON)
3753                 error = urtw_led_on(sc, URTW_LED_GPIO);
3754         else
3755                 error = urtw_led_off(sc, URTW_LED_GPIO);
3756         sc->sc_gpio_blinktime--;
3757         if (sc->sc_gpio_blinktime == 0)
3758                 ing = 1;
3759         else {
3760                 if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
3761                     sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
3762                     sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
3763                         ing = 1;
3764         }
3765         if (ing == 1) {
3766                 if (sc->sc_gpio_ledstate == URTW_LED_ON &&
3767                     sc->sc_gpio_ledon == 0)
3768                         error = urtw_led_on(sc, URTW_LED_GPIO);
3769                 else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
3770                     sc->sc_gpio_ledon == 1)
3771                         error = urtw_led_off(sc, URTW_LED_GPIO);
3772
3773                 sc->sc_gpio_blinktime = 0;
3774                 sc->sc_gpio_ledinprogress = 0;
3775                 return (0);
3776         }
3777
3778         sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
3779             URTW_LED_ON : URTW_LED_OFF;
3780
3781         switch (sc->sc_gpio_ledstate) {
3782         case URTW_LED_BLINK_NORMAL:
3783                 usb_callout_reset(&sc->sc_led_ch, hz, urtw_led_ch, sc);
3784                 break;
3785         default:
3786                 DPRINTF(sc, URTW_DEBUG_STATE,
3787                     "unknown LED status 0x%x",
3788                     sc->sc_gpio_ledstate);
3789                 return (USB_ERR_INVAL);
3790         }
3791         return (0);
3792 }
3793
3794 static usb_error_t
3795 urtw_rx_enable(struct urtw_softc *sc)
3796 {
3797         uint8_t data;
3798         usb_error_t error;
3799
3800         usbd_transfer_start((sc->sc_flags & URTW_RTL8187B) ?
3801             sc->sc_xfer[URTW_8187B_BULK_RX] : sc->sc_xfer[URTW_8187L_BULK_RX]);
3802
3803         error = urtw_rx_setconf(sc);
3804         if (error != 0)
3805                 goto fail;
3806
3807         if ((sc->sc_flags & URTW_RTL8187B) == 0) {
3808                 urtw_read8_m(sc, URTW_CMD, &data);
3809                 urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
3810         }
3811 fail:
3812         return (error);
3813 }
3814
3815 static usb_error_t
3816 urtw_tx_enable(struct urtw_softc *sc)
3817 {
3818         uint8_t data8;
3819         uint32_t data;
3820         usb_error_t error;
3821
3822         if (sc->sc_flags & URTW_RTL8187B) {
3823                 urtw_read32_m(sc, URTW_TX_CONF, &data);
3824                 data &= ~URTW_TX_LOOPBACK_MASK;
3825                 data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
3826                 data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
3827                 data &= ~URTW_TX_SWPLCPLEN;
3828                 data |= URTW_TX_HW_SEQNUM | URTW_TX_DISREQQSIZE |
3829                     (7 << 8) |  /* short retry limit */
3830                     (7 << 0) |  /* long retry limit */
3831                     (7 << 21);  /* MAX TX DMA */
3832                 urtw_write32_m(sc, URTW_TX_CONF, data);
3833
3834                 urtw_read8_m(sc, URTW_MSR, &data8);
3835                 data8 |= URTW_MSR_LINK_ENEDCA;
3836                 urtw_write8_m(sc, URTW_MSR, data8);
3837                 return (error);
3838         }
3839
3840         urtw_read8_m(sc, URTW_CW_CONF, &data8);
3841         data8 &= ~(URTW_CW_CONF_PERPACKET_CW | URTW_CW_CONF_PERPACKET_RETRY);
3842         urtw_write8_m(sc, URTW_CW_CONF, data8);
3843
3844         urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
3845         data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
3846         data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
3847         data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
3848         urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
3849
3850         urtw_read32_m(sc, URTW_TX_CONF, &data);
3851         data &= ~URTW_TX_LOOPBACK_MASK;
3852         data |= URTW_TX_LOOPBACK_NONE;
3853         data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
3854         data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
3855         data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
3856         data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
3857         data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
3858         data &= ~URTW_TX_SWPLCPLEN;
3859         data |= URTW_TX_NOICV;
3860         urtw_write32_m(sc, URTW_TX_CONF, data);
3861
3862         urtw_read8_m(sc, URTW_CMD, &data8);
3863         urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
3864 fail:
3865         return (error);
3866 }
3867
3868 static usb_error_t
3869 urtw_rx_setconf(struct urtw_softc *sc)
3870 {
3871         struct ieee80211com *ic = &sc->sc_ic;
3872         uint32_t data;
3873         usb_error_t error;
3874
3875         urtw_read32_m(sc, URTW_RX, &data);
3876         data = data &~ URTW_RX_FILTER_MASK;
3877         if (sc->sc_flags & URTW_RTL8187B) {
3878                 data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA |
3879                     URTW_RX_FILTER_MCAST | URTW_RX_FILTER_BCAST |
3880                     URTW_RX_FILTER_NICMAC | URTW_RX_CHECK_BSSID |
3881                     URTW_RX_FIFO_THRESHOLD_NONE |
3882                     URTW_MAX_RX_DMA_2048 |
3883                     URTW_RX_AUTORESETPHY | URTW_RCR_ONLYERLPKT;
3884         } else {
3885                 data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
3886                 data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
3887
3888                 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
3889                         data = data | URTW_RX_FILTER_ICVERR;
3890                         data = data | URTW_RX_FILTER_PWR;
3891                 }
3892                 if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
3893                         data = data | URTW_RX_FILTER_CRCERR;
3894
3895                 if (ic->ic_opmode == IEEE80211_M_MONITOR ||
3896                     ic->ic_promisc > 0 || ic->ic_allmulti > 0) {
3897                         data = data | URTW_RX_FILTER_ALLMAC;
3898                 } else {
3899                         data = data | URTW_RX_FILTER_NICMAC;
3900                         data = data | URTW_RX_CHECK_BSSID;
3901                 }
3902
3903                 data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
3904                 data = data | URTW_RX_FIFO_THRESHOLD_NONE |
3905                     URTW_RX_AUTORESETPHY;
3906                 data = data &~ URTW_MAX_RX_DMA_MASK;
3907                 data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
3908         }
3909
3910         urtw_write32_m(sc, URTW_RX, data);
3911 fail:
3912         return (error);
3913 }
3914
3915 static struct mbuf *
3916 urtw_rxeof(struct usb_xfer *xfer, struct urtw_data *data, int *rssi_p,
3917     int8_t *nf_p)
3918 {
3919         int actlen, flen, rssi;
3920         struct ieee80211_frame *wh;
3921         struct mbuf *m, *mnew;
3922         struct urtw_softc *sc = data->sc;
3923         struct ieee80211com *ic = &sc->sc_ic;
3924         uint8_t noise = 0, rate;
3925
3926         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
3927
3928         if (sc->sc_flags & URTW_RTL8187B) {
3929                 struct urtw_8187b_rxhdr *rx;
3930
3931                 if (actlen < sizeof(*rx) + IEEE80211_ACK_LEN)
3932                         goto fail;
3933
3934                 rx = (struct urtw_8187b_rxhdr *)(data->buf +
3935                     (actlen - (sizeof(struct urtw_8187b_rxhdr))));
3936                 flen = le32toh(rx->flag) & 0xfff;
3937                 if (flen > actlen - sizeof(*rx))
3938                         goto fail;
3939
3940                 rate = (le32toh(rx->flag) >> URTW_RX_FLAG_RXRATE_SHIFT) & 0xf;
3941                 /* XXX correct? */
3942                 rssi = rx->rssi & URTW_RX_RSSI_MASK;
3943                 noise = rx->noise;
3944         } else {
3945                 struct urtw_8187l_rxhdr *rx;
3946
3947                 if (actlen < sizeof(*rx) + IEEE80211_ACK_LEN)
3948                         goto fail;
3949
3950                 rx = (struct urtw_8187l_rxhdr *)(data->buf +
3951                     (actlen - (sizeof(struct urtw_8187l_rxhdr))));
3952                 flen = le32toh(rx->flag) & 0xfff;
3953                 if (flen > actlen - sizeof(*rx))
3954                         goto fail;
3955
3956                 rate = (le32toh(rx->flag) >> URTW_RX_FLAG_RXRATE_SHIFT) & 0xf;
3957                 /* XXX correct? */
3958                 rssi = rx->rssi & URTW_RX_8187L_RSSI_MASK;
3959                 noise = rx->noise;
3960         }
3961
3962         if (flen < IEEE80211_ACK_LEN)
3963                 goto fail;
3964
3965         mnew = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
3966         if (mnew == NULL)
3967                 goto fail;
3968
3969         m = data->m;
3970         data->m = mnew;
3971         data->buf = mtod(mnew, uint8_t *);
3972
3973         /* finalize mbuf */
3974         m->m_pkthdr.len = m->m_len = flen - IEEE80211_CRC_LEN;
3975
3976         if (ieee80211_radiotap_active(ic)) {
3977                 struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3978
3979                 /* XXX Are variables correct?  */
3980                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
3981                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
3982                 tap->wr_dbm_antsignal = (int8_t)rssi;
3983         }
3984
3985         wh = mtod(m, struct ieee80211_frame *);
3986         if (IEEE80211_IS_DATA(wh))
3987                 sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
3988
3989         *rssi_p = rssi;
3990         *nf_p = noise;          /* XXX correct? */
3991
3992         return (m);
3993
3994 fail:
3995         counter_u64_add(ic->ic_ierrors, 1);
3996         return (NULL);
3997 }
3998
3999 static void
4000 urtw_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
4001 {
4002         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4003         struct ieee80211com *ic = &sc->sc_ic;
4004         struct ieee80211_node *ni;
4005         struct mbuf *m = NULL;
4006         struct urtw_data *data;
4007         int8_t nf = -95;
4008         int rssi = 1;
4009
4010         URTW_ASSERT_LOCKED(sc);
4011
4012         switch (USB_GET_STATE(xfer)) {
4013         case USB_ST_TRANSFERRED:
4014                 data = STAILQ_FIRST(&sc->sc_rx_active);
4015                 if (data == NULL)
4016                         goto setup;
4017                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
4018                 m = urtw_rxeof(xfer, data, &rssi, &nf);
4019                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
4020                 /* FALLTHROUGH */
4021         case USB_ST_SETUP:
4022 setup:
4023                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
4024                 if (data == NULL) {
4025                         KASSERT(m == NULL, ("mbuf isn't NULL"));
4026                         return;
4027                 }
4028                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
4029                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
4030                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
4031                     usbd_xfer_max_len(xfer));
4032                 usbd_transfer_submit(xfer);
4033
4034                 /*
4035                  * To avoid LOR we should unlock our private mutex here to call
4036                  * ieee80211_input() because here is at the end of a USB
4037                  * callback and safe to unlock.
4038                  */
4039                 URTW_UNLOCK(sc);
4040                 if (m != NULL) {
4041                         if (m->m_pkthdr.len >=
4042                             sizeof(struct ieee80211_frame_min)) {
4043                                 ni = ieee80211_find_rxnode(ic,
4044                                     mtod(m, struct ieee80211_frame_min *));
4045                         } else
4046                                 ni = NULL;
4047
4048                         if (ni != NULL) {
4049                                 (void) ieee80211_input(ni, m, rssi, nf);
4050                                 /* node is no longer needed */
4051                                 ieee80211_free_node(ni);
4052                         } else
4053                                 (void) ieee80211_input_all(ic, m, rssi, nf);
4054                         m = NULL;
4055                 }
4056                 URTW_LOCK(sc);
4057                 break;
4058         default:
4059                 /* needs it to the inactive queue due to a error.  */
4060                 data = STAILQ_FIRST(&sc->sc_rx_active);
4061                 if (data != NULL) {
4062                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
4063                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
4064                 }
4065                 if (error != USB_ERR_CANCELLED) {
4066                         usbd_xfer_set_stall(xfer);
4067                         counter_u64_add(ic->ic_ierrors, 1);
4068                         goto setup;
4069                 }
4070                 break;
4071         }
4072 }
4073
4074 #define URTW_STATUS_TYPE_TXCLOSE        1
4075 #define URTW_STATUS_TYPE_BEACON_INTR    0
4076
4077 static void
4078 urtw_txstatus_eof(struct usb_xfer *xfer)
4079 {
4080         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4081         struct ieee80211com *ic = &sc->sc_ic;
4082         int actlen, type, pktretry, seq;
4083         uint64_t val;
4084
4085         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
4086
4087         if (actlen != sizeof(uint64_t))
4088                 return;
4089
4090         val = le64toh(sc->sc_txstatus);
4091         type = (val >> 30) & 0x3;
4092         if (type == URTW_STATUS_TYPE_TXCLOSE) {
4093                 pktretry = val & 0xff;
4094                 seq = (val >> 16) & 0xff;
4095                 if (pktretry == URTW_TX_MAXRETRY)
4096                         counter_u64_add(ic->ic_oerrors, 1);
4097                 DPRINTF(sc, URTW_DEBUG_TXSTATUS, "pktretry %d seq %#x\n",
4098                     pktretry, seq);
4099         }
4100 }
4101
4102 static void
4103 urtw_bulk_tx_status_callback(struct usb_xfer *xfer, usb_error_t error)
4104 {
4105         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4106         struct ieee80211com *ic = &sc->sc_ic;
4107         void *dma_buf = usbd_xfer_get_frame_buffer(xfer, 0);
4108
4109         URTW_ASSERT_LOCKED(sc);
4110
4111         switch (USB_GET_STATE(xfer)) {
4112         case USB_ST_TRANSFERRED:
4113                 urtw_txstatus_eof(xfer);
4114                 /* FALLTHROUGH */
4115         case USB_ST_SETUP:
4116 setup:
4117                 memcpy(dma_buf, &sc->sc_txstatus, sizeof(uint64_t));
4118                 usbd_xfer_set_frame_len(xfer, 0, sizeof(uint64_t));
4119                 usbd_transfer_submit(xfer);
4120                 break;
4121         default:
4122                 if (error != USB_ERR_CANCELLED) {
4123                         usbd_xfer_set_stall(xfer);
4124                         counter_u64_add(ic->ic_ierrors, 1);
4125                         goto setup;
4126                 }
4127                 break;
4128         }
4129 }
4130
4131 static void
4132 urtw_txeof(struct usb_xfer *xfer, struct urtw_data *data)
4133 {
4134         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4135
4136         URTW_ASSERT_LOCKED(sc);
4137
4138         if (data->m) {
4139                 /* XXX status? */
4140                 ieee80211_tx_complete(data->ni, data->m, 0);
4141                 data->m = NULL;
4142                 data->ni = NULL;
4143         }
4144         sc->sc_txtimer = 0;
4145 }
4146
4147 static void
4148 urtw_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
4149 {
4150         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4151         struct urtw_data *data;
4152
4153         URTW_ASSERT_LOCKED(sc);
4154
4155         switch (USB_GET_STATE(xfer)) {
4156         case USB_ST_TRANSFERRED:
4157                 data = STAILQ_FIRST(&sc->sc_tx_active);
4158                 if (data == NULL)
4159                         goto setup;
4160                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
4161                 urtw_txeof(xfer, data);
4162                 STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
4163                 /* FALLTHROUGH */
4164         case USB_ST_SETUP:
4165 setup:
4166                 data = STAILQ_FIRST(&sc->sc_tx_pending);
4167                 if (data == NULL) {
4168                         DPRINTF(sc, URTW_DEBUG_XMIT,
4169                             "%s: empty pending queue\n", __func__);
4170                         return;
4171                 }
4172                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
4173                 STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
4174
4175                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
4176                 usbd_transfer_submit(xfer);
4177
4178                 urtw_start(sc);
4179                 break;
4180         default:
4181                 data = STAILQ_FIRST(&sc->sc_tx_active);
4182                 if (data == NULL)
4183                         goto setup;
4184                 if (data->ni != NULL) {
4185                         if_inc_counter(data->ni->ni_vap->iv_ifp,
4186                             IFCOUNTER_OERRORS, 1);
4187                         ieee80211_free_node(data->ni);
4188                         data->ni = NULL;
4189                 }
4190                 if (error != USB_ERR_CANCELLED) {
4191                         usbd_xfer_set_stall(xfer);
4192                         goto setup;
4193                 }
4194                 break;
4195         }
4196 }
4197
4198 static struct urtw_data *
4199 _urtw_getbuf(struct urtw_softc *sc)
4200 {
4201         struct urtw_data *bf;
4202
4203         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
4204         if (bf != NULL)
4205                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
4206         else
4207                 bf = NULL;
4208         if (bf == NULL)
4209                 DPRINTF(sc, URTW_DEBUG_XMIT, "%s: %s\n", __func__,
4210                     "out of xmit buffers");
4211         return (bf);
4212 }
4213
4214 static struct urtw_data *
4215 urtw_getbuf(struct urtw_softc *sc)
4216 {
4217         struct urtw_data *bf;
4218
4219         URTW_ASSERT_LOCKED(sc);
4220
4221         bf = _urtw_getbuf(sc);
4222         if (bf == NULL)
4223                 DPRINTF(sc, URTW_DEBUG_XMIT, "%s: stop queue\n", __func__);
4224         return (bf);
4225 }
4226
4227 static int
4228 urtw_isbmode(uint16_t rate)
4229 {
4230
4231         return ((rate <= 22 && rate != 12 && rate != 18) ||
4232             rate == 44) ? (1) : (0);
4233 }
4234
4235 static uint16_t
4236 urtw_rate2dbps(uint16_t rate)
4237 {
4238
4239         switch(rate) {
4240         case 12:
4241         case 18:
4242         case 24:
4243         case 36:
4244         case 48:
4245         case 72:
4246         case 96:
4247         case 108:
4248                 return (rate * 2);
4249         default:
4250                 break;
4251         }
4252         return (24);
4253 }
4254
4255 static int
4256 urtw_compute_txtime(uint16_t framelen, uint16_t rate,
4257     uint8_t ismgt, uint8_t isshort)
4258 {
4259         uint16_t     ceiling, frametime, n_dbps;
4260
4261         if (urtw_isbmode(rate)) {
4262                 if (ismgt || !isshort || rate == 2)
4263                         frametime = (uint16_t)(144 + 48 +
4264                             (framelen * 8 / (rate / 2)));
4265                 else
4266                         frametime = (uint16_t)(72 + 24 +
4267                             (framelen * 8 / (rate / 2)));
4268                 if ((framelen * 8 % (rate / 2)) != 0)
4269                         frametime++;
4270         } else {
4271                 n_dbps = urtw_rate2dbps(rate);
4272                 ceiling = (16 + 8 * framelen + 6) / n_dbps
4273                     + (((16 + 8 * framelen + 6) % n_dbps) ? 1 : 0);
4274                 frametime = (uint16_t)(16 + 4 + 4 * ceiling + 6);
4275         }
4276         return (frametime);
4277 }
4278
4279 /*
4280  * Callback from the 802.11 layer to update the
4281  * slot time based on the current setting.
4282  */
4283 static void
4284 urtw_updateslot(struct ieee80211com *ic)
4285 {
4286         struct urtw_softc *sc = ic->ic_softc;
4287
4288         ieee80211_runtask(ic, &sc->sc_updateslot_task);
4289 }
4290
4291 static void
4292 urtw_updateslottask(void *arg, int pending)
4293 {
4294         struct urtw_softc *sc = arg;
4295         struct ieee80211com *ic = &sc->sc_ic;
4296         int error;
4297
4298         URTW_LOCK(sc);
4299         if ((sc->sc_flags & URTW_RUNNING) == 0) {
4300                 URTW_UNLOCK(sc);
4301                 return;
4302         }
4303         if (sc->sc_flags & URTW_RTL8187B) {
4304                 urtw_write8_m(sc, URTW_SIFS, 0x22);
4305                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan))
4306                         urtw_write8_m(sc, URTW_SLOT, IEEE80211_DUR_SHSLOT);
4307                 else
4308                         urtw_write8_m(sc, URTW_SLOT, IEEE80211_DUR_SLOT);
4309                 urtw_write8_m(sc, URTW_8187B_EIFS, 0x5b);
4310                 urtw_write8_m(sc, URTW_CARRIER_SCOUNT, 0x5b);
4311         } else {
4312                 urtw_write8_m(sc, URTW_SIFS, 0x22);
4313                 if (sc->sc_state == IEEE80211_S_ASSOC &&
4314                     ic->ic_flags & IEEE80211_F_SHSLOT)
4315                         urtw_write8_m(sc, URTW_SLOT, IEEE80211_DUR_SHSLOT);
4316                 else
4317                         urtw_write8_m(sc, URTW_SLOT, IEEE80211_DUR_SLOT);
4318                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan)) {
4319                         urtw_write8_m(sc, URTW_DIFS, 0x14);
4320                         urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x14);
4321                         urtw_write8_m(sc, URTW_CW_VAL, 0x73);
4322                 } else {
4323                         urtw_write8_m(sc, URTW_DIFS, 0x24);
4324                         urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x24);
4325                         urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
4326                 }
4327         }
4328 fail:
4329         URTW_UNLOCK(sc);
4330 }
4331
4332 static void
4333 urtw_sysctl_node(struct urtw_softc *sc)
4334 {
4335 #define URTW_SYSCTL_STAT_ADD32(c, h, n, p, d)   \
4336         SYSCTL_ADD_UINT(c, h, OID_AUTO, n, CTLFLAG_RD, p, 0, d)
4337         struct sysctl_ctx_list *ctx;
4338         struct sysctl_oid_list *child, *parent;
4339         struct sysctl_oid *tree;
4340         struct urtw_stats *stats = &sc->sc_stats;
4341
4342         ctx = device_get_sysctl_ctx(sc->sc_dev);
4343         child = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
4344
4345         tree = SYSCTL_ADD_NODE(ctx, child, OID_AUTO, "stats", CTLFLAG_RD,
4346             NULL, "URTW statistics");
4347         parent = SYSCTL_CHILDREN(tree);
4348
4349         /* Tx statistics. */
4350         tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "tx", CTLFLAG_RD,
4351             NULL, "Tx MAC statistics");
4352         child = SYSCTL_CHILDREN(tree);
4353         URTW_SYSCTL_STAT_ADD32(ctx, child, "1m", &stats->txrates[0],
4354             "1 Mbit/s");
4355         URTW_SYSCTL_STAT_ADD32(ctx, child, "2m", &stats->txrates[1],
4356             "2 Mbit/s");
4357         URTW_SYSCTL_STAT_ADD32(ctx, child, "5.5m", &stats->txrates[2],
4358             "5.5 Mbit/s");
4359         URTW_SYSCTL_STAT_ADD32(ctx, child, "6m", &stats->txrates[4],
4360             "6 Mbit/s");
4361         URTW_SYSCTL_STAT_ADD32(ctx, child, "9m", &stats->txrates[5],
4362             "9 Mbit/s");
4363         URTW_SYSCTL_STAT_ADD32(ctx, child, "11m", &stats->txrates[3],
4364             "11 Mbit/s");
4365         URTW_SYSCTL_STAT_ADD32(ctx, child, "12m", &stats->txrates[6],
4366             "12 Mbit/s");
4367         URTW_SYSCTL_STAT_ADD32(ctx, child, "18m", &stats->txrates[7],
4368             "18 Mbit/s");
4369         URTW_SYSCTL_STAT_ADD32(ctx, child, "24m", &stats->txrates[8],
4370             "24 Mbit/s");
4371         URTW_SYSCTL_STAT_ADD32(ctx, child, "36m", &stats->txrates[9],
4372             "36 Mbit/s");
4373         URTW_SYSCTL_STAT_ADD32(ctx, child, "48m", &stats->txrates[10],
4374             "48 Mbit/s");
4375         URTW_SYSCTL_STAT_ADD32(ctx, child, "54m", &stats->txrates[11],
4376             "54 Mbit/s");
4377 #undef URTW_SYSCTL_STAT_ADD32
4378 }
4379
4380 static device_method_t urtw_methods[] = {
4381         DEVMETHOD(device_probe, urtw_match),
4382         DEVMETHOD(device_attach, urtw_attach),
4383         DEVMETHOD(device_detach, urtw_detach),
4384         DEVMETHOD_END
4385 };
4386 static driver_t urtw_driver = {
4387         .name = "urtw",
4388         .methods = urtw_methods,
4389         .size = sizeof(struct urtw_softc)
4390 };
4391 static devclass_t urtw_devclass;
4392
4393 DRIVER_MODULE(urtw, uhub, urtw_driver, urtw_devclass, NULL, 0);
4394 MODULE_DEPEND(urtw, wlan, 1, 1, 1);
4395 MODULE_DEPEND(urtw, usb, 1, 1, 1);
4396 MODULE_VERSION(urtw, 1);
4397 USB_PNP_HOST_INFO(urtw_devs);