sys/bus/u4b/wlan/if_urtw.c

   1 /*-
   2  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <sys/cdefs.h>
  18 __FBSDID("$FreeBSD$");
  19 #include <sys/param.h>
  20 #include <sys/sockio.h>
  21 #include <sys/sysctl.h>
  22 #include <sys/lock.h>
  23 #include <sys/mutex.h>
  24 #include <sys/mbuf.h>
  25 #include <sys/kernel.h>
  26 #include <sys/socket.h>
  27 #include <sys/systm.h>
  28 #include <sys/malloc.h>
  29 #include <sys/module.h>
  30 #include <sys/bus.h>
  31 #include <sys/endian.h>
  32 #include <sys/kdb.h>
  33
  34 #include <machine/bus.h>
  35 #include <machine/resource.h>
  36 #include <sys/rman.h>
  37
  38 #include <net/if.h>
  39 #include <net/if_arp.h>
  40 #include <net/ethernet.h>
  41 #include <net/if_dl.h>
  42 #include <net/if_media.h>
  43 #include <net/if_types.h>
  44
  45 #ifdef INET
  46 #include <netinet/in.h>
  47 #include <netinet/in_systm.h>
  48 #include <netinet/in_var.h>
  49 #include <netinet/if_ether.h>
  50 #include <netinet/ip.h>
  51 #endif
  52
  53 #include <net80211/ieee80211_var.h>
  54 #include <net80211/ieee80211_regdomain.h>
  55 #include <net80211/ieee80211_radiotap.h>
  56
  57 #include <dev/usb/usb.h>
  58 #include <dev/usb/usbdi.h>
  59 #include "usbdevs.h"
  60
  61 #include <dev/usb/wlan/if_urtwreg.h>
  62 #include <dev/usb/wlan/if_urtwvar.h>
  63
  64 static SYSCTL_NODE(_hw_usb, OID_AUTO, urtw, CTLFLAG_RW, 0, "USB Realtek 8187L");
  65 #ifdef URTW_DEBUG
  66 int urtw_debug = 0;
  67 SYSCTL_INT(_hw_usb_urtw, OID_AUTO, debug, CTLFLAG_RW, &urtw_debug, 0,
  68     "control debugging printfs");
  69 TUNABLE_INT("hw.usb.urtw.debug", &urtw_debug);
  70 enum {
  71         URTW_DEBUG_XMIT         = 0x00000001,   /* basic xmit operation */
  72         URTW_DEBUG_RECV         = 0x00000002,   /* basic recv operation */
  73         URTW_DEBUG_RESET        = 0x00000004,   /* reset processing */
  74         URTW_DEBUG_TX_PROC      = 0x00000008,   /* tx ISR proc */
  75         URTW_DEBUG_RX_PROC      = 0x00000010,   /* rx ISR proc */
  76         URTW_DEBUG_STATE        = 0x00000020,   /* 802.11 state transitions */
  77         URTW_DEBUG_STAT         = 0x00000040,   /* statistic */
  78         URTW_DEBUG_INIT         = 0x00000080,   /* initialization of dev */
  79         URTW_DEBUG_TXSTATUS     = 0x00000100,   /* tx status */
  80         URTW_DEBUG_ANY          = 0xffffffff
  81 };
  82 #define DPRINTF(sc, m, fmt, ...) do {                           \
  83         if (sc->sc_debug & (m))                                 \
  84                 printf(fmt, __VA_ARGS__);                       \
  85 } while (0)
  86 #else
  87 #define DPRINTF(sc, m, fmt, ...) do {                           \
  88         (void) sc;                                              \
  89 } while (0)
  90 #endif
  91 static int urtw_preamble_mode = URTW_PREAMBLE_MODE_LONG;
  92 SYSCTL_INT(_hw_usb_urtw, OID_AUTO, preamble_mode, CTLFLAG_RW,
  93     &urtw_preamble_mode, 0, "set the preable mode (long or short)");
  94 TUNABLE_INT("hw.usb.urtw.preamble_mode", &urtw_preamble_mode);
  95
  96 /* recognized device vendors/products */
  97 #define urtw_lookup(v, p)                                               \
  98         ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
  99 #define URTW_DEV_B(v,p)                                                 \
 100         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTW_REV_RTL8187B) }
 101 #define URTW_DEV_L(v,p)                                                 \
 102         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTW_REV_RTL8187L) }
 103 #define URTW_REV_RTL8187B       0
 104 #define URTW_REV_RTL8187L       1
 105 static const STRUCT_USB_HOST_ID urtw_devs[] = {
 106         URTW_DEV_B(NETGEAR, WG111V3),
 107         URTW_DEV_B(REALTEK, RTL8187B_0),
 108         URTW_DEV_B(REALTEK, RTL8187B_1),
 109         URTW_DEV_B(REALTEK, RTL8187B_2),
 110         URTW_DEV_B(SITECOMEU, WL168V4),
 111         URTW_DEV_L(ASUS, P5B_WIFI),
 112         URTW_DEV_L(BELKIN, F5D7050E),
 113         URTW_DEV_L(LINKSYS4, WUSB54GCV2),
 114         URTW_DEV_L(NETGEAR, WG111V2),
 115         URTW_DEV_L(REALTEK, RTL8187),
 116         URTW_DEV_L(SITECOMEU, WL168V1),
 117         URTW_DEV_L(SURECOM, EP9001G2A),
 118         { USB_VPI(USB_VENDOR_OVISLINK, 0x8187, URTW_REV_RTL8187L) },
 119         { USB_VPI(USB_VENDOR_DICKSMITH, 0x9401, URTW_REV_RTL8187L) },
 120         { USB_VPI(USB_VENDOR_HP, 0xca02, URTW_REV_RTL8187L) },
 121         { USB_VPI(USB_VENDOR_LOGITEC, 0x010c, URTW_REV_RTL8187L) },
 122         { USB_VPI(USB_VENDOR_NETGEAR, 0x6100, URTW_REV_RTL8187L) },
 123         { USB_VPI(USB_VENDOR_SPHAIRON, 0x0150, URTW_REV_RTL8187L) },
 124         { USB_VPI(USB_VENDOR_QCOM, 0x6232, URTW_REV_RTL8187L) },
 125 #undef URTW_DEV_L
 126 #undef URTW_DEV_B
 127 };
 128
 129 #define urtw_read8_m(sc, val, data)     do {                    \
 130         error = urtw_read8_c(sc, val, data);                    \
 131         if (error != 0)                                         \
 132                 goto fail;                                      \
 133 } while (0)
 134 #define urtw_write8_m(sc, val, data)    do {                    \
 135         error = urtw_write8_c(sc, val, data);                   \
 136         if (error != 0)                                         \
 137                 goto fail;                                      \
 138 } while (0)
 139 #define urtw_read16_m(sc, val, data)    do {                    \
 140         error = urtw_read16_c(sc, val, data);                   \
 141         if (error != 0)                                         \
 142                 goto fail;                                      \
 143 } while (0)
 144 #define urtw_write16_m(sc, val, data)   do {                    \
 145         error = urtw_write16_c(sc, val, data);                  \
 146         if (error != 0)                                         \
 147                 goto fail;                                      \
 148 } while (0)
 149 #define urtw_read32_m(sc, val, data)    do {                    \
 150         error = urtw_read32_c(sc, val, data);                   \
 151         if (error != 0)                                         \
 152                 goto fail;                                      \
 153 } while (0)
 154 #define urtw_write32_m(sc, val, data)   do {                    \
 155         error = urtw_write32_c(sc, val, data);                  \
 156         if (error != 0)                                         \
 157                 goto fail;                                      \
 158 } while (0)
 159 #define urtw_8187_write_phy_ofdm(sc, val, data) do {            \
 160         error = urtw_8187_write_phy_ofdm_c(sc, val, data);      \
 161         if (error != 0)                                         \
 162                 goto fail;                                      \
 163 } while (0)
 164 #define urtw_8187_write_phy_cck(sc, val, data)  do {            \
 165         error = urtw_8187_write_phy_cck_c(sc, val, data);       \
 166         if (error != 0)                                         \
 167                 goto fail;                                      \
 168 } while (0)
 169 #define urtw_8225_write(sc, val, data)  do {                    \
 170         error = urtw_8225_write_c(sc, val, data);               \
 171         if (error != 0)                                         \
 172                 goto fail;                                      \
 173 } while (0)
 174
 175 struct urtw_pair {
 176         uint32_t        reg;
 177         uint32_t        val;
 178 };
 179
 180 static uint8_t urtw_8225_agc[] = {
 181         0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
 182         0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
 183         0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
 184         0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
 185         0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
 186         0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
 187         0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
 188         0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
 189         0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
 190         0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
 191         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
 192         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
 193 };
 194
 195 static uint8_t urtw_8225z2_agc[] = {
 196         0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57, 0x55, 0x53, 0x51,
 197         0x4f, 0x4d, 0x4b, 0x49, 0x47, 0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b,
 198         0x39, 0x37, 0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27, 0x25,
 199         0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17, 0x15, 0x13, 0x11, 0x0f,
 200         0x0d, 0x0b, 0x09, 0x07, 0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01,
 201         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x19, 0x19,
 202         0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x20, 0x21, 0x22, 0x23,
 203         0x24, 0x25, 0x26, 0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
 204         0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d, 0x2d, 0x2d, 0x2d,
 205         0x2e, 0x2e, 0x2e, 0x2e, 0x2f, 0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31,
 206         0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
 207         0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
 208 };
 209
 210 static uint32_t urtw_8225_channel[] = {
 211         0x0000,         /* dummy channel 0  */
 212         0x085c,         /* 1  */
 213         0x08dc,         /* 2  */
 214         0x095c,         /* 3  */
 215         0x09dc,         /* 4  */
 216         0x0a5c,         /* 5  */
 217         0x0adc,         /* 6  */
 218         0x0b5c,         /* 7  */
 219         0x0bdc,         /* 8  */
 220         0x0c5c,         /* 9  */
 221         0x0cdc,         /* 10  */
 222         0x0d5c,         /* 11  */
 223         0x0ddc,         /* 12  */
 224         0x0e5c,         /* 13  */
 225         0x0f72,         /* 14  */
 226 };
 227
 228 static uint8_t urtw_8225_gain[] = {
 229         0x23, 0x88, 0x7c, 0xa5,         /* -82dbm  */
 230         0x23, 0x88, 0x7c, 0xb5,         /* -82dbm  */
 231         0x23, 0x88, 0x7c, 0xc5,         /* -82dbm  */
 232         0x33, 0x80, 0x79, 0xc5,         /* -78dbm  */
 233         0x43, 0x78, 0x76, 0xc5,         /* -74dbm  */
 234         0x53, 0x60, 0x73, 0xc5,         /* -70dbm  */
 235         0x63, 0x58, 0x70, 0xc5,         /* -66dbm  */
 236 };
 237
 238 static struct urtw_pair urtw_8225_rf_part1[] = {
 239         { 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 240         { 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
 241         { 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
 242         { 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 },
 243 };
 244
 245 static struct urtw_pair urtw_8225_rf_part2[] = {
 246         { 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
 247         { 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
 248         { 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
 249         { 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
 250         { 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
 251         { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
 252         { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
 253         { 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
 254         { 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
 255         { 0x27, 0x88 }
 256 };
 257
 258 static struct urtw_pair urtw_8225_rf_part3[] = {
 259         { 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
 260         { 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
 261         { 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
 262         { 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
 263         { 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
 264         { 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
 265         { 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
 266 };
 267
 268 static uint16_t urtw_8225_rxgain[] = {
 269         0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
 270         0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
 271         0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
 272         0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
 273         0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
 274         0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
 275         0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
 276         0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
 277         0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
 278         0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
 279         0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
 280         0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
 281 };
 282
 283 static uint8_t urtw_8225_threshold[] = {
 284         0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd,
 285 };
 286
 287 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
 288         0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
 289 };
 290
 291 static uint8_t urtw_8225_txpwr_cck[] = {
 292         0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
 293         0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
 294         0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
 295         0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
 296         0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
 297         0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
 298 };
 299
 300 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
 301         0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
 302         0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
 303         0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
 304         0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
 305         0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
 306         0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
 307 };
 308
 309 static uint8_t urtw_8225_txpwr_ofdm[]={
 310         0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
 311 };
 312
 313 static uint8_t urtw_8225v2_gain_bg[]={
 314         0x23, 0x15, 0xa5,               /* -82-1dbm  */
 315         0x23, 0x15, 0xb5,               /* -82-2dbm  */
 316         0x23, 0x15, 0xc5,               /* -82-3dbm  */
 317         0x33, 0x15, 0xc5,               /* -78dbm  */
 318         0x43, 0x15, 0xc5,               /* -74dbm  */
 319         0x53, 0x15, 0xc5,               /* -70dbm  */
 320         0x63, 0x15, 0xc5,               /* -66dbm  */
 321 };
 322
 323 static struct urtw_pair urtw_8225v2_rf_part1[] = {
 324         { 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 325         { 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
 326         { 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
 327         { 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
 328 };
 329
 330 static struct urtw_pair urtw_8225v2b_rf_part0[] = {
 331         { 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 332         { 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
 333         { 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
 334         { 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
 335 };
 336
 337 static struct urtw_pair urtw_8225v2b_rf_part1[] = {
 338         {0x0f0, 0x32}, {0x0f1, 0x32}, {0x0f2, 0x00},
 339         {0x0f3, 0x00}, {0x0f4, 0x32}, {0x0f5, 0x43},
 340         {0x0f6, 0x00}, {0x0f7, 0x00}, {0x0f8, 0x46},
 341         {0x0f9, 0xa4}, {0x0fa, 0x00}, {0x0fb, 0x00},
 342         {0x0fc, 0x96}, {0x0fd, 0xa4}, {0x0fe, 0x00},
 343         {0x0ff, 0x00}, {0x158, 0x4b}, {0x159, 0x00},
 344         {0x15a, 0x4b}, {0x15b, 0x00}, {0x160, 0x4b},
 345         {0x161, 0x09}, {0x162, 0x4b}, {0x163, 0x09},
 346         {0x1ce, 0x0f}, {0x1cf, 0x00}, {0x1e0, 0xff},
 347         {0x1e1, 0x0f}, {0x1e2, 0x00}, {0x1f0, 0x4e},
 348         {0x1f1, 0x01}, {0x1f2, 0x02}, {0x1f3, 0x03},
 349         {0x1f4, 0x04}, {0x1f5, 0x05}, {0x1f6, 0x06},
 350         {0x1f7, 0x07}, {0x1f8, 0x08}, {0x24e, 0x00},
 351         {0x20c, 0x04}, {0x221, 0x61}, {0x222, 0x68},
 352         {0x223, 0x6f}, {0x224, 0x76}, {0x225, 0x7d},
 353         {0x226, 0x84}, {0x227, 0x8d}, {0x24d, 0x08},
 354         {0x250, 0x05}, {0x251, 0xf5}, {0x252, 0x04},
 355         {0x253, 0xa0}, {0x254, 0x1f}, {0x255, 0x23},
 356         {0x256, 0x45}, {0x257, 0x67}, {0x258, 0x08},
 357         {0x259, 0x08}, {0x25a, 0x08}, {0x25b, 0x08},
 358         {0x260, 0x08}, {0x261, 0x08}, {0x262, 0x08},
 359         {0x263, 0x08}, {0x264, 0xcf}, {0x272, 0x56},
 360         {0x273, 0x9a}, {0x034, 0xf0}, {0x035, 0x0f},
 361         {0x05b, 0x40}, {0x084, 0x88}, {0x085, 0x24},
 362         {0x088, 0x54}, {0x08b, 0xb8}, {0x08c, 0x07},
 363         {0x08d, 0x00}, {0x094, 0x1b}, {0x095, 0x12},
 364         {0x096, 0x00}, {0x097, 0x06}, {0x09d, 0x1a},
 365         {0x09f, 0x10}, {0x0b4, 0x22}, {0x0be, 0x80},
 366         {0x0db, 0x00}, {0x0ee, 0x00}, {0x091, 0x03},
 367         {0x24c, 0x00}, {0x39f, 0x00}, {0x08c, 0x01},
 368         {0x08d, 0x10}, {0x08e, 0x08}, {0x08f, 0x00}
 369 };
 370
 371 static struct urtw_pair urtw_8225v2_rf_part2[] = {
 372         { 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
 373         { 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
 374         { 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
 375         { 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
 376         { 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
 377         { 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
 378         { 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
 379         { 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
 380         { 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
 381         { 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
 382 };
 383
 384 static struct urtw_pair urtw_8225v2b_rf_part2[] = {
 385         { 0x00, 0x10 }, { 0x01, 0x0d }, { 0x02, 0x01 }, { 0x03, 0x00 },
 386         { 0x04, 0x14 }, { 0x05, 0xfb }, { 0x06, 0xfb }, { 0x07, 0x60 },
 387         { 0x08, 0x00 }, { 0x09, 0x60 }, { 0x0a, 0x00 }, { 0x0b, 0x00 },
 388         { 0x0c, 0x00 }, { 0x0d, 0x5c }, { 0x0e, 0x00 }, { 0x0f, 0x00 },
 389         { 0x10, 0x40 }, { 0x11, 0x00 }, { 0x12, 0x40 }, { 0x13, 0x00 },
 390         { 0x14, 0x00 }, { 0x15, 0x00 }, { 0x16, 0xa8 }, { 0x17, 0x26 },
 391         { 0x18, 0x32 }, { 0x19, 0x33 }, { 0x1a, 0x07 }, { 0x1b, 0xa5 },
 392         { 0x1c, 0x6f }, { 0x1d, 0x55 }, { 0x1e, 0xc8 }, { 0x1f, 0xb3 },
 393         { 0x20, 0x0a }, { 0x21, 0xe1 }, { 0x22, 0x2C }, { 0x23, 0x8a },
 394         { 0x24, 0x86 }, { 0x25, 0x83 }, { 0x26, 0x34 }, { 0x27, 0x0f },
 395         { 0x28, 0x4f }, { 0x29, 0x24 }, { 0x2a, 0x6f }, { 0x2b, 0xc2 },
 396         { 0x2c, 0x6b }, { 0x2d, 0x40 }, { 0x2e, 0x80 }, { 0x2f, 0x00 },
 397         { 0x30, 0xc0 }, { 0x31, 0xc1 }, { 0x32, 0x58 }, { 0x33, 0xf1 },
 398         { 0x34, 0x00 }, { 0x35, 0xe4 }, { 0x36, 0x90 }, { 0x37, 0x3e },
 399         { 0x38, 0x6d }, { 0x39, 0x3c }, { 0x3a, 0xfb }, { 0x3b, 0x07 }
 400 };
 401
 402 static struct urtw_pair urtw_8225v2_rf_part3[] = {
 403         { 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
 404         { 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
 405         { 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
 406         { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
 407         { 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
 408         { 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
 409         { 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
 410         { 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
 411 };
 412
 413 static uint16_t urtw_8225v2_rxgain[] = {
 414         0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0008, 0x0009,
 415         0x000a, 0x000b, 0x0102, 0x0103, 0x0104, 0x0105, 0x0140, 0x0141,
 416         0x0142, 0x0143, 0x0144, 0x0145, 0x0180, 0x0181, 0x0182, 0x0183,
 417         0x0184, 0x0185, 0x0188, 0x0189, 0x018a, 0x018b, 0x0243, 0x0244,
 418         0x0245, 0x0280, 0x0281, 0x0282, 0x0283, 0x0284, 0x0285, 0x0288,
 419         0x0289, 0x028a, 0x028b, 0x028c, 0x0342, 0x0343, 0x0344, 0x0345,
 420         0x0380, 0x0381, 0x0382, 0x0383, 0x0384, 0x0385, 0x0388, 0x0389,
 421         0x038a, 0x038b, 0x038c, 0x038d, 0x0390, 0x0391, 0x0392, 0x0393,
 422         0x0394, 0x0395, 0x0398, 0x0399, 0x039a, 0x039b, 0x039c, 0x039d,
 423         0x03a0, 0x03a1, 0x03a2, 0x03a3, 0x03a4, 0x03a5, 0x03a8, 0x03a9,
 424         0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
 425         0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
 426 };
 427
 428 static uint16_t urtw_8225v2b_rxgain[] = {
 429         0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
 430         0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
 431         0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
 432         0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
 433         0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
 434         0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
 435         0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
 436         0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
 437         0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
 438         0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
 439         0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
 440         0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
 441 };
 442
 443 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
 444         0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
 445         0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
 446         0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
 447         0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
 448         0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
 449         0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
 450 };
 451
 452 static uint8_t urtw_8225v2_txpwr_cck[] = {
 453         0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04
 454 };
 455
 456 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
 457         0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00
 458 };
 459
 460 static uint8_t urtw_8225v2b_txpwr_cck[] = {
 461         0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
 462         0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
 463         0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
 464         0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
 465 };
 466
 467 static uint8_t urtw_8225v2b_txpwr_cck_ch14[] = {
 468         0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
 469         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
 470         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
 471         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
 472 };
 473
 474 static struct urtw_pair urtw_ratetable[] = {
 475         {  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
 476         { 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
 477         { 96, 10 }, { 108, 11 }
 478 };
 479
 480 static const uint8_t urtw_8187b_reg_table[][3] = {
 481         { 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
 482         { 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
 483         { 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
 484         { 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
 485         { 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
 486         { 0xff, 0x00, 0 }, { 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 },
 487         { 0x5a, 0x4b, 1 }, { 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 },
 488         { 0x61, 0x09, 1 }, { 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 },
 489         { 0xce, 0x0f, 1 }, { 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 },
 490         { 0xe1, 0x0f, 1 }, { 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 },
 491         { 0xf1, 0x01, 1 }, { 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 },
 492         { 0xf4, 0x04, 1 }, { 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 },
 493         { 0xf7, 0x07, 1 }, { 0xf8, 0x08, 1 }, { 0x4e, 0x00, 2 },
 494         { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 }, { 0x22, 0x68, 2 },
 495         { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 }, { 0x25, 0x7d, 2 },
 496         { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 }, { 0x4d, 0x08, 2 },
 497         { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 }, { 0x52, 0x04, 2 },
 498         { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 }, { 0x55, 0x23, 2 },
 499         { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 }, { 0x58, 0x08, 2 },
 500         { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 }, { 0x5b, 0x08, 2 },
 501         { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 }, { 0x62, 0x08, 2 },
 502         { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 }, { 0x72, 0x56, 2 },
 503         { 0x73, 0x9a, 2 }, { 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 },
 504         { 0x5b, 0x40, 0 }, { 0x84, 0x88, 0 }, { 0x85, 0x24, 0 },
 505         { 0x88, 0x54, 0 }, { 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 },
 506         { 0x8d, 0x00, 0 }, { 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 },
 507         { 0x96, 0x00, 0 }, { 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 },
 508         { 0x9f, 0x10, 0 }, { 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 },
 509         { 0xdb, 0x00, 0 }, { 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
 510         { 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
 511         { 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
 512 };
 513
 514 static usb_callback_t urtw_bulk_rx_callback;
 515 static usb_callback_t urtw_bulk_tx_callback;
 516 static usb_callback_t urtw_bulk_tx_status_callback;
 517
 518 static const struct usb_config urtw_8187b_usbconfig[URTW_8187B_N_XFERS] = {
 519         [URTW_8187B_BULK_RX] = {
 520                 .type = UE_BULK,
 521                 .endpoint = 0x83,
 522                 .direction = UE_DIR_IN,
 523                 .bufsize = MCLBYTES,
 524                 .flags = {
 525                         .ext_buffer = 1,
 526                         .pipe_bof = 1,
 527                         .short_xfer_ok = 1
 528                 },
 529                 .callback = urtw_bulk_rx_callback
 530         },
 531         [URTW_8187B_BULK_TX_STATUS] = {
 532                 .type = UE_BULK,
 533                 .endpoint = 0x89,
 534                 .direction = UE_DIR_IN,
 535                 .bufsize = MCLBYTES,
 536                 .flags = {
 537                         .ext_buffer = 1,
 538                         .pipe_bof = 1,
 539                         .short_xfer_ok = 1
 540                 },
 541                 .callback = urtw_bulk_tx_status_callback
 542         },
 543         [URTW_8187B_BULK_TX_BE] = {
 544                 .type = UE_BULK,
 545                 .endpoint = URTW_8187B_TXPIPE_BE,
 546                 .direction = UE_DIR_OUT,
 547                 .bufsize = URTW_TX_MAXSIZE,
 548                 .flags = {
 549                         .ext_buffer = 1,
 550                         .force_short_xfer = 1,
 551                         .pipe_bof = 1,
 552                 },
 553                 .callback = urtw_bulk_tx_callback,
 554                 .timeout = URTW_DATA_TIMEOUT
 555         },
 556         [URTW_8187B_BULK_TX_BK] = {
 557                 .type = UE_BULK,
 558                 .endpoint = URTW_8187B_TXPIPE_BK,
 559                 .direction = UE_DIR_OUT,
 560                 .bufsize = URTW_TX_MAXSIZE,
 561                 .flags = {
 562                         .ext_buffer = 1,
 563                         .force_short_xfer = 1,
 564                         .pipe_bof = 1,
 565                 },
 566                 .callback = urtw_bulk_tx_callback,
 567                 .timeout = URTW_DATA_TIMEOUT
 568         },
 569         [URTW_8187B_BULK_TX_VI] = {
 570                 .type = UE_BULK,
 571                 .endpoint = URTW_8187B_TXPIPE_VI,
 572                 .direction = UE_DIR_OUT,
 573                 .bufsize = URTW_TX_MAXSIZE,
 574                 .flags = {
 575                         .ext_buffer = 1,
 576                         .force_short_xfer = 1,
 577                         .pipe_bof = 1,
 578                 },
 579                 .callback = urtw_bulk_tx_callback,
 580                 .timeout = URTW_DATA_TIMEOUT
 581         },
 582         [URTW_8187B_BULK_TX_VO] = {
 583                 .type = UE_BULK,
 584                 .endpoint = URTW_8187B_TXPIPE_VO,
 585                 .direction = UE_DIR_OUT,
 586                 .bufsize = URTW_TX_MAXSIZE,
 587                 .flags = {
 588                         .ext_buffer = 1,
 589                         .force_short_xfer = 1,
 590                         .pipe_bof = 1,
 591                 },
 592                 .callback = urtw_bulk_tx_callback,
 593                 .timeout = URTW_DATA_TIMEOUT
 594         },
 595         [URTW_8187B_BULK_TX_EP12] = {
 596                 .type = UE_BULK,
 597                 .endpoint = 0xc,
 598                 .direction = UE_DIR_OUT,
 599                 .bufsize = URTW_TX_MAXSIZE,
 600                 .flags = {
 601                         .ext_buffer = 1,
 602                         .force_short_xfer = 1,
 603                         .pipe_bof = 1,
 604                 },
 605                 .callback = urtw_bulk_tx_callback,
 606                 .timeout = URTW_DATA_TIMEOUT
 607         }
 608 };
 609
 610 static const struct usb_config urtw_8187l_usbconfig[URTW_8187L_N_XFERS] = {
 611         [URTW_8187L_BULK_RX] = {
 612                 .type = UE_BULK,
 613                 .endpoint = 0x81,
 614                 .direction = UE_DIR_IN,
 615                 .bufsize = MCLBYTES,
 616                 .flags = {
 617                         .ext_buffer = 1,
 618                         .pipe_bof = 1,
 619                         .short_xfer_ok = 1
 620                 },
 621                 .callback = urtw_bulk_rx_callback
 622         },
 623         [URTW_8187L_BULK_TX_LOW] = {
 624                 .type = UE_BULK,
 625                 .endpoint = 0x2,
 626                 .direction = UE_DIR_OUT,
 627                 .bufsize = URTW_TX_MAXSIZE,
 628                 .flags = {
 629                         .ext_buffer = 1,
 630                         .force_short_xfer = 1,
 631                         .pipe_bof = 1,
 632                 },
 633                 .callback = urtw_bulk_tx_callback,
 634                 .timeout = URTW_DATA_TIMEOUT
 635         },
 636         [URTW_8187L_BULK_TX_NORMAL] = {
 637                 .type = UE_BULK,
 638                 .endpoint = 0x3,
 639                 .direction = UE_DIR_OUT,
 640                 .bufsize = URTW_TX_MAXSIZE,
 641                 .flags = {
 642                         .ext_buffer = 1,
 643                         .force_short_xfer = 1,
 644                         .pipe_bof = 1,
 645                 },
 646                 .callback = urtw_bulk_tx_callback,
 647                 .timeout = URTW_DATA_TIMEOUT
 648         },
 649 };
 650
 651 static struct ieee80211vap *urtw_vap_create(struct ieee80211com *,
 652                             const char [IFNAMSIZ], int, enum ieee80211_opmode,
 653                             int, const uint8_t [IEEE80211_ADDR_LEN],
 654                             const uint8_t [IEEE80211_ADDR_LEN]);
 655 static void             urtw_vap_delete(struct ieee80211vap *);
 656 static void             urtw_init(void *);
 657 static void             urtw_stop(struct ifnet *, int);
 658 static void             urtw_stop_locked(struct ifnet *, int);
 659 static int              urtw_ioctl(struct ifnet *, u_long, caddr_t);
 660 static void             urtw_start(struct ifnet *);
 661 static int              urtw_alloc_rx_data_list(struct urtw_softc *);
 662 static int              urtw_alloc_tx_data_list(struct urtw_softc *);
 663 static int              urtw_raw_xmit(struct ieee80211_node *, struct mbuf *,
 664                             const struct ieee80211_bpf_params *);
 665 static void             urtw_scan_start(struct ieee80211com *);
 666 static void             urtw_scan_end(struct ieee80211com *);
 667 static void             urtw_set_channel(struct ieee80211com *);
 668 static void             urtw_update_mcast(struct ieee80211com *);
 669 static int              urtw_tx_start(struct urtw_softc *,
 670                             struct ieee80211_node *, struct mbuf *,
 671                             struct urtw_data *, int);
 672 static int              urtw_newstate(struct ieee80211vap *,
 673                             enum ieee80211_state, int);
 674 static void             urtw_led_ch(void *);
 675 static void             urtw_ledtask(void *, int);
 676 static void             urtw_watchdog(void *);
 677 static void             urtw_set_multi(void *);
 678 static int              urtw_isbmode(uint16_t);
 679 static uint16_t         urtw_rate2rtl(int);
 680 static uint16_t         urtw_rtl2rate(int);
 681 static usb_error_t      urtw_set_rate(struct urtw_softc *);
 682 static usb_error_t      urtw_update_msr(struct urtw_softc *);
 683 static usb_error_t      urtw_read8_c(struct urtw_softc *, int, uint8_t *);
 684 static usb_error_t      urtw_read16_c(struct urtw_softc *, int, uint16_t *);
 685 static usb_error_t      urtw_read32_c(struct urtw_softc *, int, uint32_t *);
 686 static usb_error_t      urtw_write8_c(struct urtw_softc *, int, uint8_t);
 687 static usb_error_t      urtw_write16_c(struct urtw_softc *, int, uint16_t);
 688 static usb_error_t      urtw_write32_c(struct urtw_softc *, int, uint32_t);
 689 static usb_error_t      urtw_eprom_cs(struct urtw_softc *, int);
 690 static usb_error_t      urtw_eprom_ck(struct urtw_softc *);
 691 static usb_error_t      urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
 692                             int);
 693 static usb_error_t      urtw_eprom_read32(struct urtw_softc *, uint32_t,
 694                             uint32_t *);
 695 static usb_error_t      urtw_eprom_readbit(struct urtw_softc *, int16_t *);
 696 static usb_error_t      urtw_eprom_writebit(struct urtw_softc *, int16_t);
 697 static usb_error_t      urtw_get_macaddr(struct urtw_softc *);
 698 static usb_error_t      urtw_get_txpwr(struct urtw_softc *);
 699 static usb_error_t      urtw_get_rfchip(struct urtw_softc *);
 700 static usb_error_t      urtw_led_init(struct urtw_softc *);
 701 static usb_error_t      urtw_8185_rf_pins_enable(struct urtw_softc *);
 702 static usb_error_t      urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
 703 static usb_error_t      urtw_8187_write_phy(struct urtw_softc *, uint8_t,
 704                             uint32_t);
 705 static usb_error_t      urtw_8187_write_phy_ofdm_c(struct urtw_softc *,
 706                             uint8_t, uint32_t);
 707 static usb_error_t      urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
 708                             uint32_t);
 709 static usb_error_t      urtw_8225_setgain(struct urtw_softc *, int16_t);
 710 static usb_error_t      urtw_8225_usb_init(struct urtw_softc *);
 711 static usb_error_t      urtw_8225_write_c(struct urtw_softc *, uint8_t,
 712                             uint16_t);
 713 static usb_error_t      urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
 714                             uint16_t *);
 715 static usb_error_t      urtw_8225_read(struct urtw_softc *, uint8_t,
 716                             uint32_t *);
 717 static usb_error_t      urtw_8225_rf_init(struct urtw_softc *);
 718 static usb_error_t      urtw_8225_rf_set_chan(struct urtw_softc *, int);
 719 static usb_error_t      urtw_8225_rf_set_sens(struct urtw_softc *, int);
 720 static usb_error_t      urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
 721 static usb_error_t      urtw_8225_rf_stop(struct urtw_softc *);
 722 static usb_error_t      urtw_8225v2_rf_init(struct urtw_softc *);
 723 static usb_error_t      urtw_8225v2_rf_set_chan(struct urtw_softc *, int);
 724 static usb_error_t      urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
 725 static usb_error_t      urtw_8225v2_setgain(struct urtw_softc *, int16_t);
 726 static usb_error_t      urtw_8225_isv2(struct urtw_softc *, int *);
 727 static usb_error_t      urtw_8225v2b_rf_init(struct urtw_softc *);
 728 static usb_error_t      urtw_8225v2b_rf_set_chan(struct urtw_softc *, int);
 729 static usb_error_t      urtw_read8e(struct urtw_softc *, int, uint8_t *);
 730 static usb_error_t      urtw_write8e(struct urtw_softc *, int, uint8_t);
 731 static usb_error_t      urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
 732 static usb_error_t      urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
 733 static usb_error_t      urtw_intr_enable(struct urtw_softc *);
 734 static usb_error_t      urtw_intr_disable(struct urtw_softc *);
 735 static usb_error_t      urtw_reset(struct urtw_softc *);
 736 static usb_error_t      urtw_led_on(struct urtw_softc *, int);
 737 static usb_error_t      urtw_led_ctl(struct urtw_softc *, int);
 738 static usb_error_t      urtw_led_blink(struct urtw_softc *);
 739 static usb_error_t      urtw_led_mode0(struct urtw_softc *, int);
 740 static usb_error_t      urtw_led_mode1(struct urtw_softc *, int);
 741 static usb_error_t      urtw_led_mode2(struct urtw_softc *, int);
 742 static usb_error_t      urtw_led_mode3(struct urtw_softc *, int);
 743 static usb_error_t      urtw_rx_setconf(struct urtw_softc *);
 744 static usb_error_t      urtw_rx_enable(struct urtw_softc *);
 745 static usb_error_t      urtw_tx_enable(struct urtw_softc *sc);
 746 static void             urtw_free_tx_data_list(struct urtw_softc *);
 747 static void             urtw_free_rx_data_list(struct urtw_softc *);
 748 static void             urtw_free_data_list(struct urtw_softc *,
 749                             struct urtw_data data[], int, int);
 750 static usb_error_t      urtw_adapter_start(struct urtw_softc *);
 751 static usb_error_t      urtw_adapter_start_b(struct urtw_softc *);
 752 static usb_error_t      urtw_set_mode(struct urtw_softc *, uint32_t);
 753 static usb_error_t      urtw_8187b_cmd_reset(struct urtw_softc *);
 754 static usb_error_t      urtw_do_request(struct urtw_softc *,
 755                             struct usb_device_request *, void *);
 756 static usb_error_t      urtw_8225v2b_set_txpwrlvl(struct urtw_softc *, int);
 757 static usb_error_t      urtw_led_off(struct urtw_softc *, int);
 758 static void             urtw_abort_xfers(struct urtw_softc *);
 759 static struct urtw_data *
 760                         urtw_getbuf(struct urtw_softc *sc);
 761 static int              urtw_compute_txtime(uint16_t, uint16_t, uint8_t,
 762                             uint8_t);
 763 static void             urtw_updateslot(struct ieee80211com *);
 764 static void             urtw_updateslottask(void *, int);
 765 static void             urtw_sysctl_node(struct urtw_softc *);
 766
 767 static int
 768 urtw_match(device_t dev)
 769 {
 770         struct usb_attach_arg *uaa = device_get_ivars(dev);
 771
 772         if (uaa->usb_mode != USB_MODE_HOST)
 773                 return (ENXIO);
 774         if (uaa->info.bConfigIndex != URTW_CONFIG_INDEX)
 775                 return (ENXIO);
 776         if (uaa->info.bIfaceIndex != URTW_IFACE_INDEX)
 777                 return (ENXIO);
 778
 779         return (usbd_lookup_id_by_uaa(urtw_devs, sizeof(urtw_devs), uaa));
 780 }
 781
 782 static int
 783 urtw_attach(device_t dev)
 784 {
 785         const struct usb_config *setup_start;
 786         int ret = ENXIO;
 787         struct urtw_softc *sc = device_get_softc(dev);
 788         struct usb_attach_arg *uaa = device_get_ivars(dev);
 789         struct ieee80211com *ic;
 790         struct ifnet *ifp;
 791         uint8_t bands, iface_index = URTW_IFACE_INDEX;          /* XXX */
 792         uint16_t n_setup;
 793         uint32_t data;
 794         usb_error_t error;
 795
 796         device_set_usb_desc(dev);
 797
 798         sc->sc_dev = dev;
 799         sc->sc_udev = uaa->device;
 800         if (USB_GET_DRIVER_INFO(uaa) == URTW_REV_RTL8187B)
 801                 sc->sc_flags |= URTW_RTL8187B;
 802 #ifdef URTW_DEBUG
 803         sc->sc_debug = urtw_debug;
 804 #endif
 805
 806         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev), MTX_NETWORK_LOCK,
 807             MTX_DEF);
 808         usb_callout_init_mtx(&sc->sc_led_ch, &sc->sc_mtx, 0);
 809         TASK_INIT(&sc->sc_led_task, 0, urtw_ledtask, sc);
 810         TASK_INIT(&sc->sc_updateslot_task, 0, urtw_updateslottask, sc);
 811         callout_init(&sc->sc_watchdog_ch, 0);
 812
 813         if (sc->sc_flags & URTW_RTL8187B) {
 814                 setup_start = urtw_8187b_usbconfig;
 815                 n_setup = URTW_8187B_N_XFERS;
 816         } else {
 817                 setup_start = urtw_8187l_usbconfig;
 818                 n_setup = URTW_8187L_N_XFERS;
 819         }
 820
 821         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
 822             setup_start, n_setup, sc, &sc->sc_mtx);
 823         if (error) {
 824                 device_printf(dev, "could not allocate USB transfers, "
 825                     "err=%s\n", usbd_errstr(error));
 826                 ret = ENXIO;
 827                 goto fail0;
 828         }
 829
 830         URTW_LOCK(sc);
 831
 832         urtw_read32_m(sc, URTW_RX, &data);
 833         sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
 834             URTW_EEPROM_93C46;
 835
 836         error = urtw_get_rfchip(sc);
 837         if (error != 0)
 838                 goto fail;
 839         error = urtw_get_macaddr(sc);
 840         if (error != 0)
 841                 goto fail;
 842         error = urtw_get_txpwr(sc);
 843         if (error != 0)
 844                 goto fail;
 845         error = urtw_led_init(sc);
 846         if (error != 0)
 847                 goto fail;
 848
 849         URTW_UNLOCK(sc);
 850
 851         sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
 852         sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
 853         sc->sc_currate = 3;
 854         sc->sc_preamble_mode = urtw_preamble_mode;
 855
 856         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 857         if (ifp == NULL) {
 858                 device_printf(sc->sc_dev, "can not allocate ifnet\n");
 859                 ret = ENOMEM;
 860                 goto fail1;
 861         }
 862
 863         ifp->if_softc = sc;
 864         if_initname(ifp, "urtw", device_get_unit(sc->sc_dev));
 865         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 866         ifp->if_init = urtw_init;
 867         ifp->if_ioctl = urtw_ioctl;
 868         ifp->if_start = urtw_start;
 869         /* XXX URTW_TX_DATA_LIST_COUNT */
 870         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 871         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 872         IFQ_SET_READY(&ifp->if_snd);
 873
 874         ic = ifp->if_l2com;
 875         ic->ic_ifp = ifp;
 876         ic->ic_softc = sc;
 877         ic->ic_name = device_get_nameunit(dev);
 878         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 879         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 880
 881         /* set device capabilities */
 882         ic->ic_caps =
 883             IEEE80211_C_STA |           /* station mode */
 884             IEEE80211_C_MONITOR |       /* monitor mode supported */
 885             IEEE80211_C_TXPMGT |        /* tx power management */
 886             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 887             IEEE80211_C_SHSLOT |        /* short slot time supported */
 888             IEEE80211_C_BGSCAN |        /* capable of bg scanning */
 889             IEEE80211_C_WPA;            /* 802.11i */
 890
 891         bands = 0;
 892         setbit(&bands, IEEE80211_MODE_11B);
 893         setbit(&bands, IEEE80211_MODE_11G);
 894         ieee80211_init_channels(ic, NULL, &bands);
 895
 896         ieee80211_ifattach(ic, sc->sc_bssid);
 897         ic->ic_raw_xmit = urtw_raw_xmit;
 898         ic->ic_scan_start = urtw_scan_start;
 899         ic->ic_scan_end = urtw_scan_end;
 900         ic->ic_set_channel = urtw_set_channel;
 901         ic->ic_updateslot = urtw_updateslot;
 902         ic->ic_vap_create = urtw_vap_create;
 903         ic->ic_vap_delete = urtw_vap_delete;
 904         ic->ic_update_mcast = urtw_update_mcast;
 905
 906         ieee80211_radiotap_attach(ic,
 907             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 908             URTW_TX_RADIOTAP_PRESENT,
 909             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 910             URTW_RX_RADIOTAP_PRESENT);
 911
 912         urtw_sysctl_node(sc);
 913
 914         if (bootverbose)
 915                 ieee80211_announce(ic);
 916         return (0);
 917
 918 fail:   URTW_UNLOCK(sc);
 919 fail1:  usbd_transfer_unsetup(sc->sc_xfer, (sc->sc_flags & URTW_RTL8187B) ?
 920             URTW_8187B_N_XFERS : URTW_8187L_N_XFERS);
 921 fail0:
 922         return (ret);
 923 }
 924
 925 static int
 926 urtw_detach(device_t dev)
 927 {
 928         struct urtw_softc *sc = device_get_softc(dev);
 929         struct ifnet *ifp = sc->sc_ifp;
 930         struct ieee80211com *ic = ifp->if_l2com;
 931
 932         if (!device_is_attached(dev))
 933                 return (0);
 934
 935         urtw_stop(ifp, 1);
 936         ieee80211_draintask(ic, &sc->sc_updateslot_task);
 937         ieee80211_draintask(ic, &sc->sc_led_task);
 938
 939         usb_callout_drain(&sc->sc_led_ch);
 940         callout_drain(&sc->sc_watchdog_ch);
 941
 942         usbd_transfer_unsetup(sc->sc_xfer, (sc->sc_flags & URTW_RTL8187B) ?
 943             URTW_8187B_N_XFERS : URTW_8187L_N_XFERS);
 944         ieee80211_ifdetach(ic);
 945
 946         urtw_free_tx_data_list(sc);
 947         urtw_free_rx_data_list(sc);
 948
 949         if_free(ifp);
 950         mtx_destroy(&sc->sc_mtx);
 951
 952         return (0);
 953 }
 954
 955 static void
 956 urtw_free_tx_data_list(struct urtw_softc *sc)
 957 {
 958         urtw_free_data_list(sc, sc->sc_tx, URTW_TX_DATA_LIST_COUNT, 0);
 959 }
 960
 961 static void
 962 urtw_free_rx_data_list(struct urtw_softc *sc)
 963 {
 964         urtw_free_data_list(sc, sc->sc_rx, URTW_RX_DATA_LIST_COUNT, 1);
 965 }
 966
 967 static void
 968 urtw_free_data_list(struct urtw_softc *sc, struct urtw_data data[], int ndata,
 969     int fillmbuf)
 970 {
 971         int i;
 972
 973         for (i = 0; i < ndata; i++) {
 974                 struct urtw_data *dp = &data[i];
 975
 976                 if (fillmbuf == 1) {
 977                         if (dp->m != NULL) {
 978                                 m_freem(dp->m);
 979                                 dp->m = NULL;
 980                                 dp->buf = NULL;
 981                         }
 982                 } else {
 983                         if (dp->buf != NULL) {
 984                                 free(dp->buf, M_USBDEV);
 985                                 dp->buf = NULL;
 986                         }
 987                 }
 988                 if (dp->ni != NULL) {
 989                         ieee80211_free_node(dp->ni);
 990                         dp->ni = NULL;
 991                 }
 992         }
 993 }
 994
 995 static struct ieee80211vap *
 996 urtw_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 997     enum ieee80211_opmode opmode, int flags,
 998     const uint8_t bssid[IEEE80211_ADDR_LEN],
 999     const uint8_t mac[IEEE80211_ADDR_LEN])
1000 {
1001         struct urtw_vap *uvp;
1002         struct ieee80211vap *vap;
1003
1004         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
1005                 return (NULL);
1006         uvp = (struct urtw_vap *) malloc(sizeof(struct urtw_vap),
1007             M_80211_VAP, M_WAITOK | M_ZERO);
1008         if (uvp == NULL)
1009                 return (NULL);
1010         vap = &uvp->vap;
1011         /* enable s/w bmiss handling for sta mode */
1012         ieee80211_vap_setup(ic, vap, name, unit, opmode,
1013             flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
1014
1015         /* override state transition machine */
1016         uvp->newstate = vap->iv_newstate;
1017         vap->iv_newstate = urtw_newstate;
1018
1019         /* complete setup */
1020         ieee80211_vap_attach(vap, ieee80211_media_change,
1021             ieee80211_media_status);
1022         ic->ic_opmode = opmode;
1023         return (vap);
1024 }
1025
1026 static void
1027 urtw_vap_delete(struct ieee80211vap *vap)
1028 {
1029         struct urtw_vap *uvp = URTW_VAP(vap);
1030
1031         ieee80211_vap_detach(vap);
1032         free(uvp, M_80211_VAP);
1033 }
1034
1035 static void
1036 urtw_init_locked(void *arg)
1037 {
1038         int ret;
1039         struct urtw_softc *sc = arg;
1040         struct ifnet *ifp = sc->sc_ifp;
1041         usb_error_t error;
1042
1043         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1044                 urtw_stop_locked(ifp, 0);
1045
1046         error = (sc->sc_flags & URTW_RTL8187B) ? urtw_adapter_start_b(sc) :
1047             urtw_adapter_start(sc);
1048         if (error != 0)
1049                 goto fail;
1050
1051         /* reset softc variables  */
1052         sc->sc_txtimer = 0;
1053
1054         if (!(sc->sc_flags & URTW_INIT_ONCE)) {
1055                 ret = urtw_alloc_rx_data_list(sc);
1056                 if (ret != 0)
1057                         goto fail;
1058                 ret = urtw_alloc_tx_data_list(sc);
1059                 if (ret != 0)
1060                         goto fail;
1061                 sc->sc_flags |= URTW_INIT_ONCE;
1062         }
1063
1064         error = urtw_rx_enable(sc);
1065         if (error != 0)
1066                 goto fail;
1067         error = urtw_tx_enable(sc);
1068         if (error != 0)
1069                 goto fail;
1070
1071         if (sc->sc_flags & URTW_RTL8187B)
1072                 usbd_transfer_start(sc->sc_xfer[URTW_8187B_BULK_TX_STATUS]);
1073
1074         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1075         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1076
1077         callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1078 fail:
1079         return;
1080 }
1081
1082 static void
1083 urtw_init(void *arg)
1084 {
1085         struct urtw_softc *sc = arg;
1086
1087         URTW_LOCK(sc);
1088         urtw_init_locked(arg);
1089         URTW_UNLOCK(sc);
1090 }
1091
1092 static usb_error_t
1093 urtw_adapter_start_b(struct urtw_softc *sc)
1094 {
1095         uint8_t data8;
1096         usb_error_t error;
1097
1098         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1099         if (error)
1100                 goto fail;
1101
1102         urtw_read8_m(sc, URTW_CONFIG3, &data8);
1103         urtw_write8_m(sc, URTW_CONFIG3,
1104             data8 | URTW_CONFIG3_ANAPARAM_WRITE | URTW_CONFIG3_GNT_SELECT);
1105         urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
1106         urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
1107         urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
1108
1109         urtw_write8_m(sc, 0x61, 0x10);
1110         urtw_read8_m(sc, 0x62, &data8);
1111         urtw_write8_m(sc, 0x62, data8 & ~(1 << 5));
1112         urtw_write8_m(sc, 0x62, data8 | (1 << 5));
1113
1114         urtw_read8_m(sc, URTW_CONFIG3, &data8);
1115         data8 &= ~URTW_CONFIG3_ANAPARAM_WRITE;
1116         urtw_write8_m(sc, URTW_CONFIG3, data8);
1117
1118         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1119         if (error)
1120                 goto fail;
1121
1122         error = urtw_8187b_cmd_reset(sc);
1123         if (error)
1124                 goto fail;
1125
1126         error = sc->sc_rf_init(sc);
1127         if (error != 0)
1128                 goto fail;
1129         urtw_write8_m(sc, URTW_CMD, URTW_CMD_RX_ENABLE | URTW_CMD_TX_ENABLE);
1130
1131         /* fix RTL8187B RX stall */
1132         error = urtw_intr_enable(sc);
1133         if (error)
1134                 goto fail;
1135
1136         error = urtw_write8e(sc, 0x41, 0xf4);
1137         if (error)
1138                 goto fail;
1139         error = urtw_write8e(sc, 0x40, 0x00);
1140         if (error)
1141                 goto fail;
1142         error = urtw_write8e(sc, 0x42, 0x00);
1143         if (error)
1144                 goto fail;
1145         error = urtw_write8e(sc, 0x42, 0x01);
1146         if (error)
1147                 goto fail;
1148         error = urtw_write8e(sc, 0x40, 0x0f);
1149         if (error)
1150                 goto fail;
1151         error = urtw_write8e(sc, 0x42, 0x00);
1152         if (error)
1153                 goto fail;
1154         error = urtw_write8e(sc, 0x42, 0x01);
1155         if (error)
1156                 goto fail;
1157
1158         urtw_read8_m(sc, 0xdb, &data8);
1159         urtw_write8_m(sc, 0xdb, data8 | (1 << 2));
1160         urtw_write16_m(sc, 0x372, 0x59fa);
1161         urtw_write16_m(sc, 0x374, 0x59d2);
1162         urtw_write16_m(sc, 0x376, 0x59d2);
1163         urtw_write16_m(sc, 0x378, 0x19fa);
1164         urtw_write16_m(sc, 0x37a, 0x19fa);
1165         urtw_write16_m(sc, 0x37c, 0x00d0);
1166         urtw_write8_m(sc, 0x61, 0);
1167
1168         urtw_write8_m(sc, 0x180, 0x0f);
1169         urtw_write8_m(sc, 0x183, 0x03);
1170         urtw_write8_m(sc, 0xda, 0x10);
1171         urtw_write8_m(sc, 0x24d, 0x08);
1172         urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
1173
1174         urtw_write16_m(sc, 0x1ec, 0x800);       /* RX MAX SIZE */
1175 fail:
1176         return (error);
1177 }
1178
1179 static usb_error_t
1180 urtw_adapter_start(struct urtw_softc *sc)
1181 {
1182         usb_error_t error;
1183
1184         error = urtw_reset(sc);
1185         if (error)
1186                 goto fail;
1187
1188         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 0);
1189         urtw_write8_m(sc, URTW_GPIO, 0);
1190
1191         /* for led  */
1192         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 4);
1193         error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
1194         if (error != 0)
1195                 goto fail;
1196
1197         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1198         if (error)
1199                 goto fail;
1200         /* applying MAC address again.  */
1201         urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)sc->sc_bssid)[0]);
1202         urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)sc->sc_bssid)[1] & 0xffff);
1203         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1204         if (error)
1205                 goto fail;
1206
1207         error = urtw_update_msr(sc);
1208         if (error)
1209                 goto fail;
1210
1211         urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
1212         urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
1213         urtw_write8_m(sc, URTW_RATE_FALLBACK, URTW_RATE_FALLBACK_ENABLE | 0x1);
1214         error = urtw_set_rate(sc);
1215         if (error != 0)
1216                 goto fail;
1217
1218         error = sc->sc_rf_init(sc);
1219         if (error != 0)
1220                 goto fail;
1221         if (sc->sc_rf_set_sens != NULL)
1222                 sc->sc_rf_set_sens(sc, sc->sc_sens);
1223
1224         /* XXX correct? to call write16  */
1225         urtw_write16_m(sc, URTW_PSR, 1);
1226         urtw_write16_m(sc, URTW_ADDR_MAGIC2, 0x10);
1227         urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
1228         urtw_write8_m(sc, URTW_ADDR_MAGIC3, 0x60);
1229         /* XXX correct? to call write16  */
1230         urtw_write16_m(sc, URTW_PSR, 0);
1231         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 4);
1232
1233         error = urtw_intr_enable(sc);
1234         if (error != 0)
1235                 goto fail;
1236
1237 fail:
1238         return (error);
1239 }
1240
1241 static usb_error_t
1242 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1243 {
1244         uint8_t data;
1245         usb_error_t error;
1246
1247         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1248         data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1249         data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1250         urtw_write8_m(sc, URTW_EPROM_CMD, data);
1251 fail:
1252         return (error);
1253 }
1254
1255 static usb_error_t
1256 urtw_8187b_cmd_reset(struct urtw_softc *sc)
1257 {
1258         int i;
1259         uint8_t data8;
1260         usb_error_t error;
1261
1262         /* XXX the code can be duplicate with urtw_reset().  */
1263         urtw_read8_m(sc, URTW_CMD, &data8);
1264         data8 = (data8 & 0x2) | URTW_CMD_RST;
1265         urtw_write8_m(sc, URTW_CMD, data8);
1266
1267         for (i = 0; i < 20; i++) {
1268                 usb_pause_mtx(&sc->sc_mtx, 2);
1269                 urtw_read8_m(sc, URTW_CMD, &data8);
1270                 if (!(data8 & URTW_CMD_RST))
1271                         break;
1272         }
1273         if (i >= 20) {
1274                 device_printf(sc->sc_dev, "reset timeout\n");
1275                 goto fail;
1276         }
1277 fail:
1278         return (error);
1279 }
1280
1281 static usb_error_t
1282 urtw_do_request(struct urtw_softc *sc,
1283     struct usb_device_request *req, void *data)
1284 {
1285         usb_error_t err;
1286         int ntries = 10;
1287
1288         URTW_ASSERT_LOCKED(sc);
1289
1290         while (ntries--) {
1291                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
1292                     req, data, 0, NULL, 250 /* ms */);
1293                 if (err == 0)
1294                         break;
1295
1296                 DPRINTF(sc, URTW_DEBUG_INIT,
1297                     "Control request failed, %s (retrying)\n",
1298                     usbd_errstr(err));
1299                 usb_pause_mtx(&sc->sc_mtx, hz / 100);
1300         }
1301         return (err);
1302 }
1303
1304 static void
1305 urtw_stop_locked(struct ifnet *ifp, int disable)
1306 {
1307         struct urtw_softc *sc = ifp->if_softc;
1308         uint8_t data8;
1309         usb_error_t error;
1310
1311         (void)disable;
1312         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1313
1314         error = urtw_intr_disable(sc);
1315         if (error)
1316                 goto fail;
1317         urtw_read8_m(sc, URTW_CMD, &data8);
1318         data8 &= ~(URTW_CMD_RX_ENABLE | URTW_CMD_TX_ENABLE);
1319         urtw_write8_m(sc, URTW_CMD, data8);
1320
1321         error = sc->sc_rf_stop(sc);
1322         if (error != 0)
1323                 goto fail;
1324
1325         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1326         if (error)
1327                 goto fail;
1328         urtw_read8_m(sc, URTW_CONFIG4, &data8);
1329         urtw_write8_m(sc, URTW_CONFIG4, data8 | URTW_CONFIG4_VCOOFF);
1330         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1331         if (error)
1332                 goto fail;
1333 fail:
1334         if (error)
1335                 device_printf(sc->sc_dev, "failed to stop (%s)\n",
1336                     usbd_errstr(error));
1337
1338         usb_callout_stop(&sc->sc_led_ch);
1339         callout_stop(&sc->sc_watchdog_ch);
1340
1341         urtw_abort_xfers(sc);
1342 }
1343
1344 static void
1345 urtw_stop(struct ifnet *ifp, int disable)
1346 {
1347         struct urtw_softc *sc = ifp->if_softc;
1348
1349         URTW_LOCK(sc);
1350         urtw_stop_locked(ifp, disable);
1351         URTW_UNLOCK(sc);
1352 }
1353
1354 static void
1355 urtw_abort_xfers(struct urtw_softc *sc)
1356 {
1357         int i, max;
1358
1359         URTW_ASSERT_LOCKED(sc);
1360
1361         max = (sc->sc_flags & URTW_RTL8187B) ? URTW_8187B_N_XFERS :
1362             URTW_8187L_N_XFERS;
1363
1364         /* abort any pending transfers */
1365         for (i = 0; i < max; i++)
1366                 usbd_transfer_stop(sc->sc_xfer[i]);
1367 }
1368
1369 static int
1370 urtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1371 {
1372         struct urtw_softc *sc = ifp->if_softc;
1373         struct ieee80211com *ic = ifp->if_l2com;
1374         struct ifreq *ifr = (struct ifreq *) data;
1375         int error = 0, startall = 0;
1376
1377         switch (cmd) {
1378         case SIOCSIFFLAGS:
1379                 if (ifp->if_flags & IFF_UP) {
1380                         if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1381                                 if ((ifp->if_flags ^ sc->sc_if_flags) &
1382                                     (IFF_ALLMULTI | IFF_PROMISC))
1383                                         urtw_set_multi(sc);
1384                         } else {
1385                                 urtw_init(ifp->if_softc);
1386                                 startall = 1;
1387                         }
1388                 } else {
1389                         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1390                                 urtw_stop(ifp, 1);
1391                 }
1392                 sc->sc_if_flags = ifp->if_flags;
1393                 if (startall)
1394                         ieee80211_start_all(ic);
1395                 break;
1396         case SIOCGIFMEDIA:
1397                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1398                 break;
1399         case SIOCGIFADDR:
1400                 error = ether_ioctl(ifp, cmd, data);
1401                 break;
1402         default:
1403                 error = EINVAL;
1404                 break;
1405         }
1406
1407         return (error);
1408 }
1409
1410 static void
1411 urtw_start(struct ifnet *ifp)
1412 {
1413         struct urtw_data *bf;
1414         struct urtw_softc *sc = ifp->if_softc;
1415         struct ieee80211_node *ni;
1416         struct mbuf *m;
1417
1418         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1419                 return;
1420
1421         URTW_LOCK(sc);
1422         for (;;) {
1423                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1424                 if (m == NULL)
1425                         break;
1426                 bf = urtw_getbuf(sc);
1427                 if (bf == NULL) {
1428                         IFQ_DRV_PREPEND(&ifp->if_snd, m);
1429                         break;
1430                 }
1431
1432                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1433                 m->m_pkthdr.rcvif = NULL;
1434
1435                 if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_NORMAL) != 0) {
1436                         ifp->if_oerrors++;
1437                         STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1438                         ieee80211_free_node(ni);
1439                         break;
1440                 }
1441
1442                 sc->sc_txtimer = 5;
1443                 callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1444         }
1445         URTW_UNLOCK(sc);
1446 }
1447
1448 static int
1449 urtw_alloc_data_list(struct urtw_softc *sc, struct urtw_data data[],
1450         int ndata, int maxsz, int fillmbuf)
1451 {
1452         int i, error;
1453
1454         for (i = 0; i < ndata; i++) {
1455                 struct urtw_data *dp = &data[i];
1456
1457                 dp->sc = sc;
1458                 if (fillmbuf) {
1459                         dp->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1460                         if (dp->m == NULL) {
1461                                 device_printf(sc->sc_dev,
1462                                     "could not allocate rx mbuf\n");
1463                                 error = ENOMEM;
1464                                 goto fail;
1465                         }
1466                         dp->buf = mtod(dp->m, uint8_t *);
1467                 } else {
1468                         dp->m = NULL;
1469                         dp->buf = malloc(maxsz, M_USBDEV, M_WAITOK);
1470                         if (dp->buf == NULL) {
1471                                 device_printf(sc->sc_dev,
1472                                     "could not allocate buffer\n");
1473                                 error = ENOMEM;
1474                                 goto fail;
1475                         }
1476                         if (((unsigned long)dp->buf) % 4)
1477                                 device_printf(sc->sc_dev,
1478                                     "warn: unaligned buffer %p\n", dp->buf);
1479                 }
1480                 dp->ni = NULL;
1481         }
1482
1483         return 0;
1484
1485 fail:   urtw_free_data_list(sc, data, ndata, fillmbuf);
1486         return error;
1487 }
1488
1489 static int
1490 urtw_alloc_rx_data_list(struct urtw_softc *sc)
1491 {
1492         int error, i;
1493
1494         error = urtw_alloc_data_list(sc,
1495             sc->sc_rx, URTW_RX_DATA_LIST_COUNT, MCLBYTES, 1 /* mbufs */);
1496         if (error != 0)
1497                 return (error);
1498
1499         STAILQ_INIT(&sc->sc_rx_active);
1500         STAILQ_INIT(&sc->sc_rx_inactive);
1501
1502         for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++)
1503                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1504
1505         return (0);
1506 }
1507
1508 static int
1509 urtw_alloc_tx_data_list(struct urtw_softc *sc)
1510 {
1511         int error, i;
1512
1513         error = urtw_alloc_data_list(sc,
1514             sc->sc_tx, URTW_TX_DATA_LIST_COUNT, URTW_TX_MAXSIZE,
1515             0 /* no mbufs */);
1516         if (error != 0)
1517                 return (error);
1518
1519         STAILQ_INIT(&sc->sc_tx_active);
1520         STAILQ_INIT(&sc->sc_tx_inactive);
1521         STAILQ_INIT(&sc->sc_tx_pending);
1522
1523         for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++)
1524                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i],
1525                     next);
1526
1527         return (0);
1528 }
1529
1530 static int
1531 urtw_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1532     const struct ieee80211_bpf_params *params)
1533 {
1534         struct ieee80211com *ic = ni->ni_ic;
1535         struct ifnet *ifp = ic->ic_ifp;
1536         struct urtw_data *bf;
1537         struct urtw_softc *sc = ifp->if_softc;
1538
1539         /* prevent management frames from being sent if we're not ready */
1540         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1541                 m_freem(m);
1542                 ieee80211_free_node(ni);
1543                 return ENETDOWN;
1544         }
1545         URTW_LOCK(sc);
1546         bf = urtw_getbuf(sc);
1547         if (bf == NULL) {
1548                 ieee80211_free_node(ni);
1549                 m_freem(m);
1550                 URTW_UNLOCK(sc);
1551                 return (ENOBUFS);               /* XXX */
1552         }
1553
1554         ifp->if_opackets++;
1555         if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_LOW) != 0) {
1556                 ieee80211_free_node(ni);
1557                 ifp->if_oerrors++;
1558                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1559                 URTW_UNLOCK(sc);
1560                 return (EIO);
1561         }
1562         URTW_UNLOCK(sc);
1563
1564         sc->sc_txtimer = 5;
1565         return (0);
1566 }
1567
1568 static void
1569 urtw_scan_start(struct ieee80211com *ic)
1570 {
1571
1572         /* XXX do nothing?  */
1573 }
1574
1575 static void
1576 urtw_scan_end(struct ieee80211com *ic)
1577 {
1578
1579         /* XXX do nothing?  */
1580 }
1581
1582 static void
1583 urtw_set_channel(struct ieee80211com *ic)
1584 {
1585         struct urtw_softc *sc  = ic->ic_ifp->if_softc;
1586         struct ifnet *ifp = sc->sc_ifp;
1587         uint32_t data, orig;
1588         usb_error_t error;
1589
1590         /*
1591          * if the user set a channel explicitly using ifconfig(8) this function
1592          * can be called earlier than we're expected that in some cases the
1593          * initialization would be failed if setting a channel is called before
1594          * the init have done.
1595          */
1596         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1597                 return;
1598
1599         if (sc->sc_curchan != NULL && sc->sc_curchan == ic->ic_curchan)
1600                 return;
1601
1602         URTW_LOCK(sc);
1603
1604         /*
1605          * during changing th channel we need to temporarily be disable
1606          * TX.
1607          */
1608         urtw_read32_m(sc, URTW_TX_CONF, &orig);
1609         data = orig & ~URTW_TX_LOOPBACK_MASK;
1610         urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
1611
1612         error = sc->sc_rf_set_chan(sc, ieee80211_chan2ieee(ic, ic->ic_curchan));
1613         if (error != 0)
1614                 goto fail;
1615         usb_pause_mtx(&sc->sc_mtx, 10);
1616         urtw_write32_m(sc, URTW_TX_CONF, orig);
1617
1618         urtw_write16_m(sc, URTW_ATIM_WND, 2);
1619         urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
1620         urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
1621         urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
1622
1623 fail:
1624         URTW_UNLOCK(sc);
1625
1626         sc->sc_curchan = ic->ic_curchan;
1627
1628         if (error != 0)
1629                 device_printf(sc->sc_dev, "could not change the channel\n");
1630 }
1631
1632 static void
1633 urtw_update_mcast(struct ieee80211com *ic)
1634 {
1635
1636         /* XXX do nothing?  */
1637 }
1638
1639 static int
1640 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
1641     struct urtw_data *data, int prior)
1642 {
1643         struct ifnet *ifp = sc->sc_ifp;
1644         struct ieee80211_frame *wh = mtod(m0, struct ieee80211_frame *);
1645         struct ieee80211_key *k;
1646         const struct ieee80211_txparam *tp;
1647         struct ieee80211com *ic = ifp->if_l2com;
1648         struct ieee80211vap *vap = ni->ni_vap;
1649         struct usb_xfer *rtl8187b_pipes[URTW_8187B_TXPIPE_MAX] = {
1650                 sc->sc_xfer[URTW_8187B_BULK_TX_BE],
1651                 sc->sc_xfer[URTW_8187B_BULK_TX_BK],
1652                 sc->sc_xfer[URTW_8187B_BULK_TX_VI],
1653                 sc->sc_xfer[URTW_8187B_BULK_TX_VO]
1654         };
1655         struct usb_xfer *xfer;
1656         int dur = 0, rtsdur = 0, rtsenable = 0, ctsenable = 0, rate,
1657             pkttime = 0, txdur = 0, isshort = 0, xferlen;
1658         uint16_t acktime, rtstime, ctstime;
1659         uint32_t flags;
1660         usb_error_t error;
1661
1662         URTW_ASSERT_LOCKED(sc);
1663
1664         /*
1665          * Software crypto.
1666          */
1667         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1668                 k = ieee80211_crypto_encap(ni, m0);
1669                 if (k == NULL) {
1670                         device_printf(sc->sc_dev,
1671                             "ieee80211_crypto_encap returns NULL.\n");
1672                         /* XXX we don't expect the fragmented frames  */
1673                         m_freem(m0);
1674                         return (ENOBUFS);
1675                 }
1676
1677                 /* in case packet header moved, reset pointer */
1678                 wh = mtod(m0, struct ieee80211_frame *);
1679         }
1680
1681         if (ieee80211_radiotap_active_vap(vap)) {
1682                 struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
1683
1684                 /* XXX Are variables correct?  */
1685                 tap->wt_flags = 0;
1686                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1687                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1688
1689                 ieee80211_radiotap_tx(vap, m0);
1690         }
1691
1692         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT ||
1693             (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) {
1694                 tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1695                 rate = tp->mgmtrate;
1696         } else {
1697                 tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1698                 /* for data frames */
1699                 if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1700                         rate = tp->mcastrate;
1701                 else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1702                         rate = tp->ucastrate;
1703                 else
1704                         rate = urtw_rtl2rate(sc->sc_currate);
1705         }
1706
1707         sc->sc_stats.txrates[sc->sc_currate]++;
1708
1709         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1710                 txdur = pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1711                     IEEE80211_CRC_LEN, rate, 0, 0);
1712         else {
1713                 acktime = urtw_compute_txtime(14, 2,0, 0);
1714                 if ((m0->m_pkthdr.len + 4) > vap->iv_rtsthreshold) {
1715                         rtsenable = 1;
1716                         ctsenable = 0;
1717                         rtstime = urtw_compute_txtime(URTW_ACKCTS_LEN, 2, 0, 0);
1718                         ctstime = urtw_compute_txtime(14, 2, 0, 0);
1719                         pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1720                             IEEE80211_CRC_LEN, rate, 0, isshort);
1721                         rtsdur = ctstime + pkttime + acktime +
1722                             3 * URTW_ASIFS_TIME;
1723                         txdur = rtstime + rtsdur;
1724                 } else {
1725                         rtsenable = ctsenable = rtsdur = 0;
1726                         pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1727                             IEEE80211_CRC_LEN, rate, 0, isshort);
1728                         txdur = pkttime + URTW_ASIFS_TIME + acktime;
1729                 }
1730
1731                 if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
1732                         dur = urtw_compute_txtime(m0->m_pkthdr.len +
1733                             IEEE80211_CRC_LEN, rate, 0, isshort) +
1734                             3 * URTW_ASIFS_TIME +
1735                             2 * acktime;
1736                 else
1737                         dur = URTW_ASIFS_TIME + acktime;
1738         }
1739         *(uint16_t *)wh->i_dur = htole16(dur);
1740
1741         xferlen = m0->m_pkthdr.len;
1742         xferlen += (sc->sc_flags & URTW_RTL8187B) ? (4 * 8) : (4 * 3);
1743         if ((0 == xferlen % 64) || (0 == xferlen % 512))
1744                 xferlen += 1;
1745
1746         memset(data->buf, 0, URTW_TX_MAXSIZE);
1747         flags = m0->m_pkthdr.len & 0xfff;
1748         flags |= URTW_TX_FLAG_NO_ENC;
1749         if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1750             (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
1751             (sc->sc_preamble_mode == URTW_PREAMBLE_MODE_SHORT) &&
1752             (sc->sc_currate != 0))
1753                 flags |= URTW_TX_FLAG_SPLCP;
1754         if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
1755                 flags |= URTW_TX_FLAG_MOREFRAG;
1756
1757         flags |= (sc->sc_currate & 0xf) << URTW_TX_FLAG_TXRATE_SHIFT;
1758
1759         if (sc->sc_flags & URTW_RTL8187B) {
1760                 struct urtw_8187b_txhdr *tx;
1761
1762                 tx = (struct urtw_8187b_txhdr *)data->buf;
1763                 if (ctsenable)
1764                         flags |= URTW_TX_FLAG_CTS;
1765                 if (rtsenable) {
1766                         flags |= URTW_TX_FLAG_RTS;
1767                         flags |= (urtw_rate2rtl(11) & 0xf) <<
1768                             URTW_TX_FLAG_RTSRATE_SHIFT;
1769                         tx->rtsdur = rtsdur;
1770                 }
1771                 tx->flag = htole32(flags);
1772                 tx->txdur = txdur;
1773                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1774                     IEEE80211_FC0_TYPE_MGT &&
1775                     (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1776                     IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1777                         tx->retry = 1;
1778                 else
1779                         tx->retry = URTW_TX_MAXRETRY;
1780                 m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(tx + 1));
1781         } else {
1782                 struct urtw_8187l_txhdr *tx;
1783
1784                 tx = (struct urtw_8187l_txhdr *)data->buf;
1785                 if (rtsenable) {
1786                         flags |= URTW_TX_FLAG_RTS;
1787                         tx->rtsdur = rtsdur;
1788                 }
1789                 flags |= (urtw_rate2rtl(11) & 0xf) << URTW_TX_FLAG_RTSRATE_SHIFT;
1790                 tx->flag = htole32(flags);
1791                 tx->retry = 3;          /* CW minimum  */
1792                 tx->retry |= 7 << 4;    /* CW maximum  */
1793                 tx->retry |= URTW_TX_MAXRETRY << 8;     /* retry limitation  */
1794                 m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(tx + 1));
1795         }
1796
1797         data->buflen = xferlen;
1798         data->ni = ni;
1799         data->m = m0;
1800
1801         if (sc->sc_flags & URTW_RTL8187B) {
1802                 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1803                 case IEEE80211_FC0_TYPE_CTL:
1804                 case IEEE80211_FC0_TYPE_MGT:
1805                         xfer = sc->sc_xfer[URTW_8187B_BULK_TX_EP12];
1806                         break;
1807                 default:
1808                         KASSERT(M_WME_GETAC(m0) < URTW_8187B_TXPIPE_MAX,
1809                             ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1810                         xfer = rtl8187b_pipes[M_WME_GETAC(m0)];
1811                         break;
1812                 }
1813         } else
1814                 xfer = (prior == URTW_PRIORITY_LOW) ?
1815                     sc->sc_xfer[URTW_8187L_BULK_TX_LOW] :
1816                     sc->sc_xfer[URTW_8187L_BULK_TX_NORMAL];
1817
1818         STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1819         usbd_transfer_start(xfer);
1820
1821         error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
1822         if (error != 0)
1823                 device_printf(sc->sc_dev, "could not control LED (%d)\n",
1824                     error);
1825         return (0);
1826 }
1827
1828 static int
1829 urtw_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1830 {
1831         struct ieee80211com *ic = vap->iv_ic;
1832         struct urtw_softc *sc = ic->ic_ifp->if_softc;
1833         struct urtw_vap *uvp = URTW_VAP(vap);
1834         struct ieee80211_node *ni;
1835         usb_error_t error = 0;
1836
1837         DPRINTF(sc, URTW_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1838             ieee80211_state_name[vap->iv_state],
1839             ieee80211_state_name[nstate]);
1840
1841         sc->sc_state = nstate;
1842
1843         IEEE80211_UNLOCK(ic);
1844         URTW_LOCK(sc);
1845         usb_callout_stop(&sc->sc_led_ch);
1846         callout_stop(&sc->sc_watchdog_ch);
1847
1848         switch (nstate) {
1849         case IEEE80211_S_INIT:
1850         case IEEE80211_S_SCAN:
1851         case IEEE80211_S_AUTH:
1852         case IEEE80211_S_ASSOC:
1853                 break;
1854         case IEEE80211_S_RUN:
1855                 ni = ieee80211_ref_node(vap->iv_bss);
1856                 /* setting bssid.  */
1857                 urtw_write32_m(sc, URTW_BSSID, ((uint32_t *)ni->ni_bssid)[0]);
1858                 urtw_write16_m(sc, URTW_BSSID + 4,
1859                     ((uint16_t *)ni->ni_bssid)[2]);
1860                 urtw_update_msr(sc);
1861                 /* XXX maybe the below would be incorrect.  */
1862                 urtw_write16_m(sc, URTW_ATIM_WND, 2);
1863                 urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
1864                 urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
1865                 urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
1866                 error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
1867                 if (error != 0)
1868                         device_printf(sc->sc_dev,
1869                             "could not control LED (%d)\n", error);
1870                 ieee80211_free_node(ni);
1871                 break;
1872         default:
1873                 break;
1874         }
1875 fail:
1876         URTW_UNLOCK(sc);
1877         IEEE80211_LOCK(ic);
1878         return (uvp->newstate(vap, nstate, arg));
1879 }
1880
1881 static void
1882 urtw_watchdog(void *arg)
1883 {
1884         struct urtw_softc *sc = arg;
1885         struct ifnet *ifp = sc->sc_ifp;
1886
1887         if (sc->sc_txtimer > 0) {
1888                 if (--sc->sc_txtimer == 0) {
1889                         device_printf(sc->sc_dev, "device timeout\n");
1890                         ifp->if_oerrors++;
1891                         return;
1892                 }
1893                 callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1894         }
1895 }
1896
1897 static void
1898 urtw_set_multi(void *arg)
1899 {
1900         struct urtw_softc *sc = arg;
1901         struct ifnet *ifp = sc->sc_ifp;
1902
1903         if (!(ifp->if_flags & IFF_UP))
1904                 return;
1905
1906         /*
1907          * XXX don't know how to set a device.  Lack of docs.  Just try to set
1908          * IFF_ALLMULTI flag here.
1909          */
1910         ifp->if_flags |= IFF_ALLMULTI;
1911 }
1912
1913 static usb_error_t
1914 urtw_set_rate(struct urtw_softc *sc)
1915 {
1916         int i, basic_rate, min_rr_rate, max_rr_rate;
1917         uint16_t data;
1918         usb_error_t error;
1919
1920         basic_rate = urtw_rate2rtl(48);
1921         min_rr_rate = urtw_rate2rtl(12);
1922         max_rr_rate = urtw_rate2rtl(48);
1923
1924         urtw_write8_m(sc, URTW_RESP_RATE,
1925             max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
1926             min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
1927
1928         urtw_read16_m(sc, URTW_BRSR, &data);
1929         data &= ~URTW_BRSR_MBR_8185;
1930
1931         for (i = 0; i <= basic_rate; i++)
1932                 data |= (1 << i);
1933
1934         urtw_write16_m(sc, URTW_BRSR, data);
1935 fail:
1936         return (error);
1937 }
1938
1939 static uint16_t
1940 urtw_rate2rtl(int rate)
1941 {
1942         int i;
1943
1944         for (i = 0; i < nitems(urtw_ratetable); i++) {
1945                 if (rate == urtw_ratetable[i].reg)
1946                         return urtw_ratetable[i].val;
1947         }
1948
1949         return (3);
1950 }
1951
1952 static uint16_t
1953 urtw_rtl2rate(int rate)
1954 {
1955         int i;
1956
1957         for (i = 0; i < nitems(urtw_ratetable); i++) {
1958                 if (rate == urtw_ratetable[i].val)
1959                         return urtw_ratetable[i].reg;
1960         }
1961
1962         return (0);
1963 }
1964
1965 static usb_error_t
1966 urtw_update_msr(struct urtw_softc *sc)
1967 {
1968         struct ifnet *ifp = sc->sc_ifp;
1969         struct ieee80211com *ic = ifp->if_l2com;
1970         uint8_t data;
1971         usb_error_t error;
1972
1973         urtw_read8_m(sc, URTW_MSR, &data);
1974         data &= ~URTW_MSR_LINK_MASK;
1975
1976         if (sc->sc_state == IEEE80211_S_RUN) {
1977                 switch (ic->ic_opmode) {
1978                 case IEEE80211_M_STA:
1979                 case IEEE80211_M_MONITOR:
1980                         data |= URTW_MSR_LINK_STA;
1981                         if (sc->sc_flags & URTW_RTL8187B)
1982                                 data |= URTW_MSR_LINK_ENEDCA;
1983                         break;
1984                 case IEEE80211_M_IBSS:
1985                         data |= URTW_MSR_LINK_ADHOC;
1986                         break;
1987                 case IEEE80211_M_HOSTAP:
1988                         data |= URTW_MSR_LINK_HOSTAP;
1989                         break;
1990                 default:
1991                         panic("unsupported operation mode 0x%x\n",
1992                             ic->ic_opmode);
1993                         /* never reach  */
1994                 }
1995         } else
1996                 data |= URTW_MSR_LINK_NONE;
1997
1998         urtw_write8_m(sc, URTW_MSR, data);
1999 fail:
2000         return (error);
2001 }
2002
2003 static usb_error_t
2004 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data)
2005 {
2006         struct usb_device_request req;
2007         usb_error_t error;
2008
2009         URTW_ASSERT_LOCKED(sc);
2010
2011         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2012         req.bRequest = URTW_8187_GETREGS_REQ;
2013         USETW(req.wValue, (val & 0xff) | 0xff00);
2014         USETW(req.wIndex, (val >> 8) & 0x3);
2015         USETW(req.wLength, sizeof(uint8_t));
2016
2017         error = urtw_do_request(sc, &req, data);
2018         return (error);
2019 }
2020
2021 static usb_error_t
2022 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data)
2023 {
2024         struct usb_device_request req;
2025         usb_error_t error;
2026
2027         URTW_ASSERT_LOCKED(sc);
2028
2029         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2030         req.bRequest = URTW_8187_GETREGS_REQ;
2031         USETW(req.wValue, (val & 0xff) | 0xff00);
2032         USETW(req.wIndex, (val >> 8) & 0x3);
2033         USETW(req.wLength, sizeof(uint16_t));
2034
2035         error = urtw_do_request(sc, &req, data);
2036         return (error);
2037 }
2038
2039 static usb_error_t
2040 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data)
2041 {
2042         struct usb_device_request req;
2043         usb_error_t error;
2044
2045         URTW_ASSERT_LOCKED(sc);
2046
2047         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2048         req.bRequest = URTW_8187_GETREGS_REQ;
2049         USETW(req.wValue, (val & 0xff) | 0xff00);
2050         USETW(req.wIndex, (val >> 8) & 0x3);
2051         USETW(req.wLength, sizeof(uint32_t));
2052
2053         error = urtw_do_request(sc, &req, data);
2054         return (error);
2055 }
2056
2057 static usb_error_t
2058 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data)
2059 {
2060         struct usb_device_request req;
2061
2062         URTW_ASSERT_LOCKED(sc);
2063
2064         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2065         req.bRequest = URTW_8187_SETREGS_REQ;
2066         USETW(req.wValue, (val & 0xff) | 0xff00);
2067         USETW(req.wIndex, (val >> 8) & 0x3);
2068         USETW(req.wLength, sizeof(uint8_t));
2069
2070         return (urtw_do_request(sc, &req, &data));
2071 }
2072
2073 static usb_error_t
2074 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data)
2075 {
2076         struct usb_device_request req;
2077
2078         URTW_ASSERT_LOCKED(sc);
2079
2080         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2081         req.bRequest = URTW_8187_SETREGS_REQ;
2082         USETW(req.wValue, (val & 0xff) | 0xff00);
2083         USETW(req.wIndex, (val >> 8) & 0x3);
2084         USETW(req.wLength, sizeof(uint16_t));
2085
2086         return (urtw_do_request(sc, &req, &data));
2087 }
2088
2089 static usb_error_t
2090 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data)
2091 {
2092         struct usb_device_request req;
2093
2094         URTW_ASSERT_LOCKED(sc);
2095
2096         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2097         req.bRequest = URTW_8187_SETREGS_REQ;
2098         USETW(req.wValue, (val & 0xff) | 0xff00);
2099         USETW(req.wIndex, (val >> 8) & 0x3);
2100         USETW(req.wLength, sizeof(uint32_t));
2101
2102         return (urtw_do_request(sc, &req, &data));
2103 }
2104
2105 static usb_error_t
2106 urtw_get_macaddr(struct urtw_softc *sc)
2107 {
2108         uint32_t data;
2109         usb_error_t error;
2110
2111         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
2112         if (error != 0)
2113                 goto fail;
2114         sc->sc_bssid[0] = data & 0xff;
2115         sc->sc_bssid[1] = (data & 0xff00) >> 8;
2116         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
2117         if (error != 0)
2118                 goto fail;
2119         sc->sc_bssid[2] = data & 0xff;
2120         sc->sc_bssid[3] = (data & 0xff00) >> 8;
2121         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
2122         if (error != 0)
2123                 goto fail;
2124         sc->sc_bssid[4] = data & 0xff;
2125         sc->sc_bssid[5] = (data & 0xff00) >> 8;
2126 fail:
2127         return (error);
2128 }
2129
2130 static usb_error_t
2131 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
2132 {
2133 #define URTW_READCMD_LEN                3
2134         int addrlen, i;
2135         int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
2136         usb_error_t error;
2137
2138         /* NB: make sure the buffer is initialized  */
2139         *data = 0;
2140
2141         /* enable EPROM programming */
2142         urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
2143         DELAY(URTW_EPROM_DELAY);
2144
2145         error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
2146         if (error != 0)
2147                 goto fail;
2148         error = urtw_eprom_ck(sc);
2149         if (error != 0)
2150                 goto fail;
2151         error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
2152         if (error != 0)
2153                 goto fail;
2154         if (sc->sc_epromtype == URTW_EEPROM_93C56) {
2155                 addrlen = 8;
2156                 addrstr[0] = addr & (1 << 7);
2157                 addrstr[1] = addr & (1 << 6);
2158                 addrstr[2] = addr & (1 << 5);
2159                 addrstr[3] = addr & (1 << 4);
2160                 addrstr[4] = addr & (1 << 3);
2161                 addrstr[5] = addr & (1 << 2);
2162                 addrstr[6] = addr & (1 << 1);
2163                 addrstr[7] = addr & (1 << 0);
2164         } else {
2165                 addrlen=6;
2166                 addrstr[0] = addr & (1 << 5);
2167                 addrstr[1] = addr & (1 << 4);
2168                 addrstr[2] = addr & (1 << 3);
2169                 addrstr[3] = addr & (1 << 2);
2170                 addrstr[4] = addr & (1 << 1);
2171                 addrstr[5] = addr & (1 << 0);
2172         }
2173         error = urtw_eprom_sendbits(sc, addrstr, addrlen);
2174         if (error != 0)
2175                 goto fail;
2176
2177         error = urtw_eprom_writebit(sc, 0);
2178         if (error != 0)
2179                 goto fail;
2180
2181         for (i = 0; i < 16; i++) {
2182                 error = urtw_eprom_ck(sc);
2183                 if (error != 0)
2184                         goto fail;
2185                 error = urtw_eprom_readbit(sc, &data16);
2186                 if (error != 0)
2187                         goto fail;
2188
2189                 (*data) |= (data16 << (15 - i));
2190         }
2191
2192         error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
2193         if (error != 0)
2194                 goto fail;
2195         error = urtw_eprom_ck(sc);
2196         if (error != 0)
2197                 goto fail;
2198
2199         /* now disable EPROM programming */
2200         urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
2201 fail:
2202         return (error);
2203 #undef URTW_READCMD_LEN
2204 }
2205
2206 static usb_error_t
2207 urtw_eprom_cs(struct urtw_softc *sc, int able)
2208 {
2209         uint8_t data;
2210         usb_error_t error;
2211
2212         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2213         if (able == URTW_EPROM_ENABLE)
2214                 urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
2215         else
2216                 urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
2217         DELAY(URTW_EPROM_DELAY);
2218 fail:
2219         return (error);
2220 }
2221
2222 static usb_error_t
2223 urtw_eprom_ck(struct urtw_softc *sc)
2224 {
2225         uint8_t data;
2226         usb_error_t error;
2227
2228         /* masking  */
2229         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2230         urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
2231         DELAY(URTW_EPROM_DELAY);
2232         /* unmasking  */
2233         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2234         urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
2235         DELAY(URTW_EPROM_DELAY);
2236 fail:
2237         return (error);
2238 }
2239
2240 static usb_error_t
2241 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
2242 {
2243         uint8_t data8;
2244         usb_error_t error;
2245
2246         urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
2247         *data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
2248         DELAY(URTW_EPROM_DELAY);
2249
2250 fail:
2251         return (error);
2252 }
2253
2254 static usb_error_t
2255 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
2256 {
2257         uint8_t data;
2258         usb_error_t error;
2259
2260         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2261         if (bit != 0)
2262                 urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
2263         else
2264                 urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
2265         DELAY(URTW_EPROM_DELAY);
2266 fail:
2267         return (error);
2268 }
2269
2270 static usb_error_t
2271 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
2272 {
2273         int i = 0;
2274         usb_error_t error = 0;
2275
2276         for (i = 0; i < buflen; i++) {
2277                 error = urtw_eprom_writebit(sc, buf[i]);
2278                 if (error != 0)
2279                         goto fail;
2280                 error = urtw_eprom_ck(sc);
2281                 if (error != 0)
2282                         goto fail;
2283         }
2284 fail:
2285         return (error);
2286 }
2287
2288
2289 static usb_error_t
2290 urtw_get_txpwr(struct urtw_softc *sc)
2291 {
2292         int i, j;
2293         uint32_t data;
2294         usb_error_t error;
2295
2296         error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
2297         if (error != 0)
2298                 goto fail;
2299         sc->sc_txpwr_cck_base = data & 0xf;
2300         sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
2301
2302         for (i = 1, j = 0; i < 6; i += 2, j++) {
2303                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
2304                 if (error != 0)
2305                         goto fail;
2306                 sc->sc_txpwr_cck[i] = data & 0xf;
2307                 sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
2308                 sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
2309                 sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
2310         }
2311         for (i = 1, j = 0; i < 4; i += 2, j++) {
2312                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
2313                 if (error != 0)
2314                         goto fail;
2315                 sc->sc_txpwr_cck[i + 6] = data & 0xf;
2316                 sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
2317                 sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
2318                 sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
2319         }
2320         if (sc->sc_flags & URTW_RTL8187B) {
2321                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2, &data);
2322                 if (error != 0)
2323                         goto fail;
2324                 sc->sc_txpwr_cck[1 + 6 + 4] = data & 0xf;
2325                 sc->sc_txpwr_ofdm[1 + 6 + 4] = (data & 0xf0) >> 4;
2326                 error = urtw_eprom_read32(sc, 0x0a, &data);
2327                 if (error != 0)
2328                         goto fail;
2329                 sc->sc_txpwr_cck[2 + 6 + 4] = data & 0xf;
2330                 sc->sc_txpwr_ofdm[2 + 6 + 4] = (data & 0xf0) >> 4;
2331                 error = urtw_eprom_read32(sc, 0x1c, &data);
2332                 if (error != 0)
2333                         goto fail;
2334                 sc->sc_txpwr_cck[3 + 6 + 4] = data & 0xf;
2335                 sc->sc_txpwr_cck[3 + 6 + 4 + 1] = (data & 0xf00) >> 8;
2336                 sc->sc_txpwr_ofdm[3 + 6 + 4] = (data & 0xf0) >> 4;
2337                 sc->sc_txpwr_ofdm[3 + 6 + 4 + 1] = (data & 0xf000) >> 12;
2338         } else {
2339                 for (i = 1, j = 0; i < 4; i += 2, j++) {
2340                         error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
2341                             &data);
2342                         if (error != 0)
2343                                 goto fail;
2344                         sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
2345                         sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
2346                         sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
2347                         sc->sc_txpwr_ofdm[i + 6 + 4 + 1] = (data & 0xf000) >> 12;
2348                 }
2349         }
2350 fail:
2351         return (error);
2352 }
2353
2354
2355 static usb_error_t
2356 urtw_get_rfchip(struct urtw_softc *sc)
2357 {
2358         int ret;
2359         uint8_t data8;
2360         uint32_t data;
2361         usb_error_t error;
2362
2363         if (sc->sc_flags & URTW_RTL8187B) {
2364                 urtw_read8_m(sc, 0xe1, &data8);
2365                 switch (data8) {
2366                 case 0:
2367                         sc->sc_flags |= URTW_RTL8187B_REV_B;
2368                         break;
2369                 case 1:
2370                         sc->sc_flags |= URTW_RTL8187B_REV_D;
2371                         break;
2372                 case 2:
2373                         sc->sc_flags |= URTW_RTL8187B_REV_E;
2374                         break;
2375                 default:
2376                         device_printf(sc->sc_dev, "unknown type: %#x\n", data8);
2377                         sc->sc_flags |= URTW_RTL8187B_REV_B;
2378                         break;
2379                 }
2380         } else {
2381                 urtw_read32_m(sc, URTW_TX_CONF, &data);
2382                 switch (data & URTW_TX_HWMASK) {
2383                 case URTW_TX_R8187vD_B:
2384                         sc->sc_flags |= URTW_RTL8187B;
2385                         break;
2386                 case URTW_TX_R8187vD:
2387                         break;
2388                 default:
2389                         device_printf(sc->sc_dev, "unknown RTL8187L type: %#x\n",
2390                             data & URTW_TX_HWMASK);
2391                         break;
2392                 }
2393         }
2394
2395         error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
2396         if (error != 0)
2397                 goto fail;
2398         switch (data & 0xff) {
2399         case URTW_EPROM_RFCHIPID_RTL8225U:
2400                 error = urtw_8225_isv2(sc, &ret);
2401                 if (error != 0)
2402                         goto fail;
2403                 if (ret == 0) {
2404                         sc->sc_rf_init = urtw_8225_rf_init;
2405                         sc->sc_rf_set_sens = urtw_8225_rf_set_sens;
2406                         sc->sc_rf_set_chan = urtw_8225_rf_set_chan;
2407                         sc->sc_rf_stop = urtw_8225_rf_stop;
2408                 } else {
2409                         sc->sc_rf_init = urtw_8225v2_rf_init;
2410                         sc->sc_rf_set_chan = urtw_8225v2_rf_set_chan;
2411                         sc->sc_rf_stop = urtw_8225_rf_stop;
2412                 }
2413                 sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
2414                 sc->sc_sens = URTW_8225_RF_DEF_SENS;
2415                 break;
2416         case URTW_EPROM_RFCHIPID_RTL8225Z2:
2417                 sc->sc_rf_init = urtw_8225v2b_rf_init;
2418                 sc->sc_rf_set_chan = urtw_8225v2b_rf_set_chan;
2419                 sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
2420                 sc->sc_sens = URTW_8225_RF_DEF_SENS;
2421                 sc->sc_rf_stop = urtw_8225_rf_stop;
2422                 break;
2423         default:
2424                 panic("unsupported RF chip %d\n", data & 0xff);
2425                 /* never reach  */
2426         }
2427
2428         device_printf(sc->sc_dev, "%s rf %s hwrev %s\n",
2429             (sc->sc_flags & URTW_RTL8187B) ? "rtl8187b" : "rtl8187l",
2430             ((data & 0xff) == URTW_EPROM_RFCHIPID_RTL8225U) ? "rtl8225u" :
2431             "rtl8225z2",
2432             (sc->sc_flags & URTW_RTL8187B) ? ((data8 == 0) ? "b" :
2433                 (data8 == 1) ? "d" : "e") : "none");
2434
2435 fail:
2436         return (error);
2437 }
2438
2439
2440 static usb_error_t
2441 urtw_led_init(struct urtw_softc *sc)
2442 {
2443         uint32_t rev;
2444         usb_error_t error;
2445
2446         urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
2447         error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
2448         if (error != 0)
2449                 goto fail;
2450
2451         switch (rev & URTW_EPROM_CID_MASK) {
2452         case URTW_EPROM_CID_ALPHA0:
2453                 sc->sc_strategy = URTW_SW_LED_MODE1;
2454                 break;
2455         case URTW_EPROM_CID_SERCOMM_PS:
2456                 sc->sc_strategy = URTW_SW_LED_MODE3;
2457                 break;
2458         case URTW_EPROM_CID_HW_LED:
2459                 sc->sc_strategy = URTW_HW_LED;
2460                 break;
2461         case URTW_EPROM_CID_RSVD0:
2462         case URTW_EPROM_CID_RSVD1:
2463         default:
2464                 sc->sc_strategy = URTW_SW_LED_MODE0;
2465                 break;
2466         }
2467
2468         sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
2469
2470 fail:
2471         return (error);
2472 }
2473
2474
2475 static usb_error_t
2476 urtw_8225_rf_init(struct urtw_softc *sc)
2477 {
2478         int i;
2479         uint16_t data;
2480         usb_error_t error;
2481
2482         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2483         if (error)
2484                 goto fail;
2485
2486         error = urtw_8225_usb_init(sc);
2487         if (error)
2488                 goto fail;
2489
2490         urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2491         urtw_read16_m(sc, URTW_BRSR, &data);            /* XXX ??? */
2492         urtw_write16_m(sc, URTW_BRSR, 0xffff);
2493         urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2494
2495         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2496         if (error)
2497                 goto fail;
2498         urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2499         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2500         if (error)
2501                 goto fail;
2502
2503         error = urtw_8185_rf_pins_enable(sc);
2504         if (error)
2505                 goto fail;
2506         usb_pause_mtx(&sc->sc_mtx, 1000);
2507
2508         for (i = 0; i < nitems(urtw_8225_rf_part1); i++) {
2509                 urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2510                     urtw_8225_rf_part1[i].val);
2511                 usb_pause_mtx(&sc->sc_mtx, 1);
2512         }
2513         usb_pause_mtx(&sc->sc_mtx, 100);
2514         urtw_8225_write(sc,
2515             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2516         usb_pause_mtx(&sc->sc_mtx, 200);
2517         urtw_8225_write(sc,
2518             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2519         usb_pause_mtx(&sc->sc_mtx, 200);
2520         urtw_8225_write(sc,
2521             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC3);
2522
2523         for (i = 0; i < 95; i++) {
2524                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
2525                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, urtw_8225_rxgain[i]);
2526         }
2527
2528         urtw_8225_write(sc,
2529             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC4);
2530         urtw_8225_write(sc,
2531             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC5);
2532
2533         for (i = 0; i < 128; i++) {
2534                 urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2535                 usb_pause_mtx(&sc->sc_mtx, 1);
2536                 urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2537                 usb_pause_mtx(&sc->sc_mtx, 1);
2538         }
2539
2540         for (i = 0; i < nitems(urtw_8225_rf_part2); i++) {
2541                 urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2542                     urtw_8225_rf_part2[i].val);
2543                 usb_pause_mtx(&sc->sc_mtx, 1);
2544         }
2545
2546         error = urtw_8225_setgain(sc, 4);
2547         if (error)
2548                 goto fail;
2549
2550         for (i = 0; i < nitems(urtw_8225_rf_part3); i++) {
2551                 urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2552                     urtw_8225_rf_part3[i].val);
2553                 usb_pause_mtx(&sc->sc_mtx, 1);
2554         }
2555
2556         urtw_write8_m(sc, URTW_TESTR, 0x0d);
2557
2558         error = urtw_8225_set_txpwrlvl(sc, 1);
2559         if (error)
2560                 goto fail;
2561
2562         urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2563         usb_pause_mtx(&sc->sc_mtx, 1);
2564         urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2565         usb_pause_mtx(&sc->sc_mtx, 1);
2566
2567         /* TX ant A, 0x0 for B */
2568         error = urtw_8185_tx_antenna(sc, 0x3);
2569         if (error)
2570                 goto fail;
2571         urtw_write32_m(sc, URTW_HSSI_PARA, 0x3dc00002);
2572
2573         error = urtw_8225_rf_set_chan(sc, 1);
2574 fail:
2575         return (error);
2576 }
2577
2578 static usb_error_t
2579 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2580 {
2581         usb_error_t error = 0;
2582
2583         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2584 fail:
2585         return (error);
2586 }
2587
2588 static usb_error_t
2589 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2590 {
2591         usb_error_t error;
2592
2593         urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2594         usb_pause_mtx(&sc->sc_mtx, 1);
2595 fail:
2596         return (error);
2597 }
2598
2599 static usb_error_t
2600 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2601 {
2602
2603         data = data & 0xff;
2604         return urtw_8187_write_phy(sc, addr, data);
2605 }
2606
2607 static usb_error_t
2608 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2609 {
2610
2611         data = data & 0xff;
2612         return urtw_8187_write_phy(sc, addr, data | 0x10000);
2613 }
2614
2615 static usb_error_t
2616 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2617 {
2618         uint32_t phyw;
2619         usb_error_t error;
2620
2621         phyw = ((data << 8) | (addr | 0x80));
2622         urtw_write8_m(sc, URTW_PHY_MAGIC4, ((phyw & 0xff000000) >> 24));
2623         urtw_write8_m(sc, URTW_PHY_MAGIC3, ((phyw & 0x00ff0000) >> 16));
2624         urtw_write8_m(sc, URTW_PHY_MAGIC2, ((phyw & 0x0000ff00) >> 8));
2625         urtw_write8_m(sc, URTW_PHY_MAGIC1, ((phyw & 0x000000ff)));
2626         usb_pause_mtx(&sc->sc_mtx, 1);
2627 fail:
2628         return (error);
2629 }
2630
2631 static usb_error_t
2632 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2633 {
2634         usb_error_t error;
2635
2636         urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2637         urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2638         urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2639         urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2640 fail:
2641         return (error);
2642 }
2643
2644 static usb_error_t
2645 urtw_8225_usb_init(struct urtw_softc *sc)
2646 {
2647         uint8_t data;
2648         usb_error_t error;
2649
2650         urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2651         urtw_write8_m(sc, URTW_GPIO, 0);
2652         error = urtw_read8e(sc, 0x53, &data);
2653         if (error)
2654                 goto fail;
2655         error = urtw_write8e(sc, 0x53, data | (1 << 7));
2656         if (error)
2657                 goto fail;
2658         urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2659         urtw_write8_m(sc, URTW_GPIO, 0x20);
2660         urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2661
2662         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2663         urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2664         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2665
2666         usb_pause_mtx(&sc->sc_mtx, 500);
2667 fail:
2668         return (error);
2669 }
2670
2671 static usb_error_t
2672 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
2673 {
2674         uint16_t d80, d82, d84;
2675         usb_error_t error;
2676
2677         urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
2678         d80 &= URTW_RF_PINS_MAGIC1;
2679         urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
2680         urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
2681         d84 &= URTW_RF_PINS_MAGIC2;
2682         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | URTW_RF_PINS_MAGIC3);
2683         urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | URTW_RF_PINS_MAGIC3);
2684         DELAY(10);
2685
2686         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2687         DELAY(2);
2688         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
2689         DELAY(10);
2690
2691         error = urtw_8225_write_s16(sc, addr, 0x8225, &data);
2692         if (error != 0)
2693                 goto fail;
2694
2695         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2696         DELAY(10);
2697         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2698         urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
2699         usb_pause_mtx(&sc->sc_mtx, 2);
2700 fail:
2701         return (error);
2702 }
2703
2704 /* XXX why we should allocalte memory buffer instead of using memory stack?  */
2705 static usb_error_t
2706 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
2707     uint16_t *data)
2708 {
2709         uint8_t *buf;
2710         uint16_t data16;
2711         struct usb_device_request *req;
2712         usb_error_t error = 0;
2713
2714         data16 = *data;
2715         req = (usb_device_request_t *)malloc(sizeof(usb_device_request_t),
2716             M_80211_VAP, M_WAITOK | M_ZERO);
2717         if (req == NULL) {
2718                 device_printf(sc->sc_dev, "could not allocate a memory\n");
2719                 goto fail0;
2720         }
2721         buf = (uint8_t *)malloc(2, M_80211_VAP, M_WAITOK | M_ZERO);
2722         if (req == NULL) {
2723                 device_printf(sc->sc_dev, "could not allocate a memory\n");
2724                 goto fail1;
2725         }
2726
2727         req->bmRequestType = UT_WRITE_VENDOR_DEVICE;
2728         req->bRequest = URTW_8187_SETREGS_REQ;
2729         USETW(req->wValue, addr);
2730         USETW(req->wIndex, index);
2731         USETW(req->wLength, sizeof(uint16_t));
2732         buf[0] = (data16 & 0x00ff);
2733         buf[1] = (data16 & 0xff00) >> 8;
2734
2735         error = urtw_do_request(sc, req, buf);
2736
2737         free(buf, M_80211_VAP);
2738 fail1:  free(req, M_80211_VAP);
2739 fail0:  return (error);
2740 }
2741
2742 static usb_error_t
2743 urtw_8225_rf_set_chan(struct urtw_softc *sc, int chan)
2744 {
2745         usb_error_t error;
2746
2747         error = urtw_8225_set_txpwrlvl(sc, chan);
2748         if (error)
2749                 goto fail;
2750         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
2751         usb_pause_mtx(&sc->sc_mtx, 10);
2752 fail:
2753         return (error);
2754 }
2755
2756 static usb_error_t
2757 urtw_8225_rf_set_sens(struct urtw_softc *sc, int sens)
2758 {
2759         usb_error_t error;
2760
2761         if (sens < 0 || sens > 6)
2762                 return -1;
2763
2764         if (sens > 4)
2765                 urtw_8225_write(sc,
2766                     URTW_8225_ADDR_C_MAGIC, URTW_8225_ADDR_C_DATA_MAGIC1);
2767         else
2768                 urtw_8225_write(sc,
2769                     URTW_8225_ADDR_C_MAGIC, URTW_8225_ADDR_C_DATA_MAGIC2);
2770
2771         sens = 6 - sens;
2772         error = urtw_8225_setgain(sc, sens);
2773         if (error)
2774                 goto fail;
2775
2776         urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[sens]);
2777
2778 fail:
2779         return (error);
2780 }
2781
2782 static usb_error_t
2783 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2784 {
2785         int i, idx, set;
2786         uint8_t *cck_pwltable;
2787         uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2788         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2789         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2790         usb_error_t error;
2791
2792         cck_pwrlvl_max = 11;
2793         ofdm_pwrlvl_max = 25;   /* 12 -> 25  */
2794         ofdm_pwrlvl_min = 10;
2795
2796         /* CCK power setting */
2797         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2798         idx = cck_pwrlvl % 6;
2799         set = cck_pwrlvl / 6;
2800         cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2801             urtw_8225_txpwr_cck;
2802
2803         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2804             urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2805         for (i = 0; i < 8; i++) {
2806                 urtw_8187_write_phy_cck(sc, 0x44 + i,
2807                     cck_pwltable[idx * 8 + i]);
2808         }
2809         usb_pause_mtx(&sc->sc_mtx, 1);
2810
2811         /* OFDM power setting */
2812         ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2813             ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2814         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2815
2816         idx = ofdm_pwrlvl % 6;
2817         set = ofdm_pwrlvl / 6;
2818
2819         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
2820         if (error)
2821                 goto fail;
2822         urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2823         urtw_8187_write_phy_ofdm(sc, 6, 0);
2824         urtw_8187_write_phy_ofdm(sc, 8, 0);
2825
2826         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2827             urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2828         urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2829         urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2830         usb_pause_mtx(&sc->sc_mtx, 1);
2831 fail:
2832         return (error);
2833 }
2834
2835
2836 static usb_error_t
2837 urtw_8225_rf_stop(struct urtw_softc *sc)
2838 {
2839         uint8_t data;
2840         usb_error_t error;
2841
2842         urtw_8225_write(sc, 0x4, 0x1f);
2843
2844         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2845         if (error)
2846                 goto fail;
2847
2848         urtw_read8_m(sc, URTW_CONFIG3, &data);
2849         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
2850         if (sc->sc_flags & URTW_RTL8187B) {
2851                 urtw_write32_m(sc, URTW_ANAPARAM2,
2852                     URTW_8187B_8225_ANAPARAM2_OFF);
2853                 urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_OFF);
2854                 urtw_write32_m(sc, URTW_ANAPARAM3,
2855                     URTW_8187B_8225_ANAPARAM3_OFF);
2856         } else {
2857                 urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8225_ANAPARAM2_OFF);
2858                 urtw_write32_m(sc, URTW_ANAPARAM, URTW_8225_ANAPARAM_OFF);
2859         }
2860
2861         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
2862         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2863         if (error)
2864                 goto fail;
2865
2866 fail:
2867         return (error);
2868 }
2869
2870 static usb_error_t
2871 urtw_8225v2_rf_init(struct urtw_softc *sc)
2872 {
2873         int i;
2874         uint16_t data;
2875         uint32_t data32;
2876         usb_error_t error;
2877
2878         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2879         if (error)
2880                 goto fail;
2881
2882         error = urtw_8225_usb_init(sc);
2883         if (error)
2884                 goto fail;
2885
2886         urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2887         urtw_read16_m(sc, URTW_BRSR, &data);            /* XXX ??? */
2888         urtw_write16_m(sc, URTW_BRSR, 0xffff);
2889         urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2890
2891         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2892         if (error)
2893                 goto fail;
2894         urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2895         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2896         if (error)
2897                 goto fail;
2898
2899         error = urtw_8185_rf_pins_enable(sc);
2900         if (error)
2901                 goto fail;
2902
2903         usb_pause_mtx(&sc->sc_mtx, 500);
2904
2905         for (i = 0; i < nitems(urtw_8225v2_rf_part1); i++) {
2906                 urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
2907                     urtw_8225v2_rf_part1[i].val);
2908         }
2909         usb_pause_mtx(&sc->sc_mtx, 50);
2910
2911         urtw_8225_write(sc,
2912             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC1);
2913
2914         for (i = 0; i < 95; i++) {
2915                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
2916                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC,
2917                     urtw_8225v2_rxgain[i]);
2918         }
2919
2920         urtw_8225_write(sc,
2921             URTW_8225_ADDR_3_MAGIC, URTW_8225_ADDR_3_DATA_MAGIC1);
2922         urtw_8225_write(sc,
2923             URTW_8225_ADDR_5_MAGIC, URTW_8225_ADDR_5_DATA_MAGIC1);
2924         urtw_8225_write(sc,
2925             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC2);
2926         urtw_8225_write(sc,
2927             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2928         usb_pause_mtx(&sc->sc_mtx, 100);
2929         urtw_8225_write(sc,
2930             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2931         usb_pause_mtx(&sc->sc_mtx, 100);
2932
2933         error = urtw_8225_read(sc, URTW_8225_ADDR_6_MAGIC, &data32);
2934         if (error != 0)
2935                 goto fail;
2936         if (data32 != URTW_8225_ADDR_6_DATA_MAGIC1)
2937                 device_printf(sc->sc_dev, "expect 0xe6!! (0x%x)\n", data32);
2938         if (!(data32 & URTW_8225_ADDR_6_DATA_MAGIC2)) {
2939                 urtw_8225_write(sc,
2940                     URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2941                 usb_pause_mtx(&sc->sc_mtx, 100);
2942                 urtw_8225_write(sc,
2943                     URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2944                 usb_pause_mtx(&sc->sc_mtx, 50);
2945                 error = urtw_8225_read(sc, URTW_8225_ADDR_6_MAGIC, &data32);
2946                 if (error != 0)
2947                         goto fail;
2948                 if (!(data32 & URTW_8225_ADDR_6_DATA_MAGIC2))
2949                         device_printf(sc->sc_dev, "RF calibration failed\n");
2950         }
2951         usb_pause_mtx(&sc->sc_mtx, 100);
2952
2953         urtw_8225_write(sc,
2954             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC6);
2955         for (i = 0; i < 128; i++) {
2956                 urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2957                 urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2958         }
2959
2960         for (i = 0; i < nitems(urtw_8225v2_rf_part2); i++) {
2961                 urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
2962                     urtw_8225v2_rf_part2[i].val);
2963         }
2964
2965         error = urtw_8225v2_setgain(sc, 4);
2966         if (error)
2967                 goto fail;
2968
2969         for (i = 0; i < nitems(urtw_8225v2_rf_part3); i++) {
2970                 urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
2971                     urtw_8225v2_rf_part3[i].val);
2972         }
2973
2974         urtw_write8_m(sc, URTW_TESTR, 0x0d);
2975
2976         error = urtw_8225v2_set_txpwrlvl(sc, 1);
2977         if (error)
2978                 goto fail;
2979
2980         urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2981         urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2982
2983         /* TX ant A, 0x0 for B */
2984         error = urtw_8185_tx_antenna(sc, 0x3);
2985         if (error)
2986                 goto fail;
2987         urtw_write32_m(sc, URTW_HSSI_PARA, 0x3dc00002);
2988
2989         error = urtw_8225_rf_set_chan(sc, 1);
2990 fail:
2991         return (error);
2992 }
2993
2994 static usb_error_t
2995 urtw_8225v2_rf_set_chan(struct urtw_softc *sc, int chan)
2996 {
2997         usb_error_t error;
2998
2999         error = urtw_8225v2_set_txpwrlvl(sc, chan);
3000         if (error)
3001                 goto fail;
3002
3003         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
3004         usb_pause_mtx(&sc->sc_mtx, 10);
3005 fail:
3006         return (error);
3007 }
3008
3009 static usb_error_t
3010 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
3011 {
3012         int i;
3013         int16_t bit;
3014         uint8_t rlen = 12, wlen = 6;
3015         uint16_t o1, o2, o3, tmp;
3016         uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
3017         uint32_t mask = 0x80000000, value = 0;
3018         usb_error_t error;
3019
3020         urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
3021         urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
3022         urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
3023         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | URTW_RF_PINS_MAGIC4);
3024         urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | URTW_RF_PINS_MAGIC4);
3025         o1 &= ~URTW_RF_PINS_MAGIC4;
3026         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
3027         DELAY(5);
3028         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
3029         DELAY(5);
3030
3031         for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
3032                 bit = ((d2w & mask) != 0) ? 1 : 0;
3033
3034                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
3035                 DELAY(2);
3036                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3037                     URTW_BB_HOST_BANG_CLK);
3038                 DELAY(2);
3039                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3040                     URTW_BB_HOST_BANG_CLK);
3041                 DELAY(2);
3042                 mask = mask >> 1;
3043                 if (i == 2)
3044                         break;
3045                 bit = ((d2w & mask) != 0) ? 1 : 0;
3046                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3047                     URTW_BB_HOST_BANG_CLK);
3048                 DELAY(2);
3049                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3050                     URTW_BB_HOST_BANG_CLK);
3051                 DELAY(2);
3052                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
3053                 DELAY(1);
3054         }
3055         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
3056             URTW_BB_HOST_BANG_CLK);
3057         DELAY(2);
3058         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
3059         DELAY(2);
3060         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
3061         DELAY(2);
3062
3063         mask = 0x800;
3064         for (i = 0; i < rlen; i++, mask = mask >> 1) {
3065                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3066                     o1 | URTW_BB_HOST_BANG_RW);
3067                 DELAY(2);
3068                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3069                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3070                 DELAY(2);
3071                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3072                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3073                 DELAY(2);
3074                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3075                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3076                 DELAY(2);
3077
3078                 urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
3079                 value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
3080                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3081                     o1 | URTW_BB_HOST_BANG_RW);
3082                 DELAY(2);
3083         }
3084
3085         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
3086             URTW_BB_HOST_BANG_RW);
3087         DELAY(2);
3088
3089         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
3090         urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
3091         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, URTW_RF_PINS_OUTPUT_MAGIC1);
3092
3093         if (data != NULL)
3094                 *data = value;
3095 fail:
3096         return (error);
3097 }
3098
3099
3100 static usb_error_t
3101 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3102 {
3103         int i;
3104         uint8_t *cck_pwrtable;
3105         uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3106         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3107         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3108         usb_error_t error;
3109
3110         /* CCK power setting */
3111         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3112         cck_pwrlvl += sc->sc_txpwr_cck_base;
3113         cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3114         cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3115             urtw_8225v2_txpwr_cck;
3116
3117         for (i = 0; i < 8; i++)
3118                 urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3119
3120         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3121             urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3122         usb_pause_mtx(&sc->sc_mtx, 1);
3123
3124         /* OFDM power setting */
3125         ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3126                 ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3127         ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3128         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3129
3130         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3131         if (error)
3132                 goto fail;
3133
3134         urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3135         urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3136         urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3137         urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3138         urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3139
3140         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3141             urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3142         usb_pause_mtx(&sc->sc_mtx, 1);
3143 fail:
3144         return (error);
3145 }
3146
3147 static usb_error_t
3148 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3149 {
3150         uint8_t *gainp;
3151         usb_error_t error;
3152
3153         /* XXX for A?  */
3154         gainp = urtw_8225v2_gain_bg;
3155         urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3156         usb_pause_mtx(&sc->sc_mtx, 1);
3157         urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3158         usb_pause_mtx(&sc->sc_mtx, 1);
3159         urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3160         usb_pause_mtx(&sc->sc_mtx, 1);
3161         urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3162         usb_pause_mtx(&sc->sc_mtx, 1);
3163 fail:
3164         return (error);
3165 }
3166
3167 static usb_error_t
3168 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
3169 {
3170         uint32_t data;
3171         usb_error_t error;
3172
3173         *ret = 1;
3174
3175         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, URTW_RF_PINS_MAGIC5);
3176         urtw_write16_m(sc, URTW_RF_PINS_SELECT, URTW_RF_PINS_MAGIC5);
3177         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, URTW_RF_PINS_MAGIC5);
3178         usb_pause_mtx(&sc->sc_mtx, 500);
3179
3180         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC,
3181             URTW_8225_ADDR_0_DATA_MAGIC1);
3182
3183         error = urtw_8225_read(sc, URTW_8225_ADDR_8_MAGIC, &data);
3184         if (error != 0)
3185                 goto fail;
3186         if (data != URTW_8225_ADDR_8_DATA_MAGIC1)
3187                 *ret = 0;
3188         else {
3189                 error = urtw_8225_read(sc, URTW_8225_ADDR_9_MAGIC, &data);
3190                 if (error != 0)
3191                         goto fail;
3192                 if (data != URTW_8225_ADDR_9_DATA_MAGIC1)
3193                         *ret = 0;
3194         }
3195
3196         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC,
3197             URTW_8225_ADDR_0_DATA_MAGIC2);
3198 fail:
3199         return (error);
3200 }
3201
3202 static usb_error_t
3203 urtw_8225v2b_rf_init(struct urtw_softc *sc)
3204 {
3205         int i;
3206         uint8_t data8;
3207         usb_error_t error;
3208
3209         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3210         if (error)
3211                 goto fail;
3212
3213         /*
3214          * initialize extra registers on 8187
3215          */
3216         urtw_write16_m(sc, URTW_BRSR_8187B, 0xfff);
3217
3218         /* retry limit */
3219         urtw_read8_m(sc, URTW_CW_CONF, &data8);
3220         data8 |= URTW_CW_CONF_PERPACKET_RETRY;
3221         urtw_write8_m(sc, URTW_CW_CONF, data8);
3222
3223         /* TX AGC */
3224         urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
3225         data8 |= URTW_TX_AGC_CTL_PERPACKET_GAIN;
3226         urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
3227
3228         /* Auto Rate Fallback Control */
3229 #define URTW_ARFR       0x1e0
3230         urtw_write16_m(sc, URTW_ARFR, 0xfff);
3231         urtw_read8_m(sc, URTW_RATE_FALLBACK, &data8);
3232         urtw_write8_m(sc, URTW_RATE_FALLBACK,
3233             data8 | URTW_RATE_FALLBACK_ENABLE);
3234
3235         urtw_read8_m(sc, URTW_MSR, &data8);
3236         urtw_write8_m(sc, URTW_MSR, data8 & 0xf3);
3237         urtw_read8_m(sc, URTW_MSR, &data8);
3238         urtw_write8_m(sc, URTW_MSR, data8 | URTW_MSR_LINK_ENEDCA);
3239         urtw_write8_m(sc, URTW_ACM_CONTROL, sc->sc_acmctl);
3240
3241         urtw_write16_m(sc, URTW_ATIM_WND, 2);
3242         urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3243 #define URTW_FEMR_FOR_8187B     0x1d4
3244         urtw_write16_m(sc, URTW_FEMR_FOR_8187B, 0xffff);
3245
3246         /* led type */
3247         urtw_read8_m(sc, URTW_CONFIG1, &data8);
3248         data8 = (data8 & 0x3f) | 0x80;
3249         urtw_write8_m(sc, URTW_CONFIG1, data8);
3250
3251         /* applying MAC address again.  */
3252         urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)sc->sc_bssid)[0]);
3253         urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)sc->sc_bssid)[1] & 0xffff);
3254
3255         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3256         if (error)
3257                 goto fail;
3258
3259         urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3260
3261         /*
3262          * MAC configuration
3263          */
3264         for (i = 0; i < nitems(urtw_8225v2b_rf_part1); i++)
3265                 urtw_write8_m(sc, urtw_8225v2b_rf_part1[i].reg,
3266                     urtw_8225v2b_rf_part1[i].val);
3267         urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3268         urtw_write16_m(sc, URTW_INT_MIG, 0x0000);
3269         urtw_write32_m(sc, 0x1f0, 0);
3270         urtw_write32_m(sc, 0x1f4, 0);
3271         urtw_write8_m(sc, 0x1f8, 0);
3272         urtw_write32_m(sc, URTW_RF_TIMING, 0x4001);
3273
3274 #define URTW_RFSW_CTRL  0x272
3275         urtw_write16_m(sc, URTW_RFSW_CTRL, 0x569a);
3276
3277         /*
3278          * initialize PHY
3279          */
3280         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3281         if (error)
3282                 goto fail;
3283         urtw_read8_m(sc, URTW_CONFIG3, &data8);
3284         urtw_write8_m(sc, URTW_CONFIG3,
3285             data8 | URTW_CONFIG3_ANAPARAM_WRITE);
3286
3287         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3288         if (error)
3289                 goto fail;
3290
3291         /* setup RFE initial timing */
3292         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3293         urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3294         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3295         usb_pause_mtx(&sc->sc_mtx, 1100);
3296
3297         for (i = 0; i < nitems(urtw_8225v2b_rf_part0); i++) {
3298                 urtw_8225_write(sc, urtw_8225v2b_rf_part0[i].reg,
3299                     urtw_8225v2b_rf_part0[i].val);
3300                 usb_pause_mtx(&sc->sc_mtx, 1);
3301         }
3302         urtw_8225_write(sc, 0x00, 0x01b7);
3303
3304         for (i = 0; i < 95; i++) {
3305                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
3306                 usb_pause_mtx(&sc->sc_mtx, 1);
3307                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC,
3308                     urtw_8225v2b_rxgain[i]);
3309                 usb_pause_mtx(&sc->sc_mtx, 1);
3310         }
3311
3312         urtw_8225_write(sc, URTW_8225_ADDR_3_MAGIC, 0x080);
3313         usb_pause_mtx(&sc->sc_mtx, 1);
3314         urtw_8225_write(sc, URTW_8225_ADDR_5_MAGIC, 0x004);
3315         usb_pause_mtx(&sc->sc_mtx, 1);
3316         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC, 0x0b7);
3317         usb_pause_mtx(&sc->sc_mtx, 1);
3318         usb_pause_mtx(&sc->sc_mtx, 3000);
3319         urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, 0xc4d);
3320         usb_pause_mtx(&sc->sc_mtx, 2000);
3321         urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, 0x44d);
3322         usb_pause_mtx(&sc->sc_mtx, 1);
3323         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC, 0x2bf);
3324         usb_pause_mtx(&sc->sc_mtx, 1);
3325
3326         urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3327         urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3328         urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3329
3330         urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3331         for (i = 0; i < 128; i++) {
3332                 uint32_t addr, data;
3333
3334                 data = (urtw_8225z2_agc[i] << 8) | 0x0000008f;
3335                 addr = ((i + 0x80) << 8) | 0x0000008e;
3336
3337                 urtw_8187_write_phy_ofdm(sc, data & 0x7f, (data >> 8) & 0xff);
3338                 urtw_8187_write_phy_ofdm(sc, addr & 0x7f, (addr >> 8) & 0xff);
3339                 urtw_8187_write_phy_ofdm(sc, 0x0e, 0x00);
3340         }
3341         urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3342
3343         for (i = 0; i < nitems(urtw_8225v2b_rf_part2); i++)
3344                 urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2b_rf_part2[i].val);
3345
3346         urtw_write32_m(sc, URTW_8187B_AC_VO, (7 << 12) | (3 << 8) | 0x1c);
3347         urtw_write32_m(sc, URTW_8187B_AC_VI, (7 << 12) | (3 << 8) | 0x1c);
3348         urtw_write32_m(sc, URTW_8187B_AC_BE, (7 << 12) | (3 << 8) | 0x1c);
3349         urtw_write32_m(sc, URTW_8187B_AC_BK, (7 << 12) | (3 << 8) | 0x1c);
3350
3351         urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3352         urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3353         urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3354         urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3355
3356 fail:
3357         return (error);
3358 }
3359
3360 static usb_error_t
3361 urtw_8225v2b_rf_set_chan(struct urtw_softc *sc, int chan)
3362 {
3363         usb_error_t error;
3364
3365         error = urtw_8225v2b_set_txpwrlvl(sc, chan);
3366         if (error)
3367                 goto fail;
3368
3369         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
3370         usb_pause_mtx(&sc->sc_mtx, 10);
3371 fail:
3372         return (error);
3373 }
3374
3375 static usb_error_t
3376 urtw_8225v2b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3377 {
3378         int i;
3379         uint8_t *cck_pwrtable;
3380         uint8_t cck_pwrlvl_max = 15;
3381         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3382         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3383         usb_error_t error;
3384
3385         /* CCK power setting */
3386         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ?
3387             ((sc->sc_flags & URTW_RTL8187B_REV_B) ? cck_pwrlvl_max : 22) :
3388             (cck_pwrlvl + ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 0 : 7));
3389         cck_pwrlvl += sc->sc_txpwr_cck_base;
3390         cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3391         cck_pwrtable = (chan == 14) ? urtw_8225v2b_txpwr_cck_ch14 :
3392             urtw_8225v2b_txpwr_cck;
3393
3394         if (sc->sc_flags & URTW_RTL8187B_REV_B)
3395                 cck_pwrtable += (cck_pwrlvl <= 6) ? 0 :
3396                     ((cck_pwrlvl <= 11) ? 8 : 16);
3397         else
3398                 cck_pwrtable += (cck_pwrlvl <= 5) ? 0 :
3399                     ((cck_pwrlvl <= 11) ? 8 : ((cck_pwrlvl <= 17) ? 16 : 24));
3400
3401         for (i = 0; i < 8; i++)
3402                 urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3403
3404         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3405             urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3406         usb_pause_mtx(&sc->sc_mtx, 1);
3407
3408         /* OFDM power setting */
3409         ofdm_pwrlvl = (ofdm_pwrlvl > 15) ?
3410             ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 17 : 25) :
3411             (ofdm_pwrlvl + ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 2 : 10));
3412         ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3413         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3414
3415         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3416             urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3417
3418         if (sc->sc_flags & URTW_RTL8187B_REV_B) {
3419                 if (ofdm_pwrlvl <= 11) {
3420                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
3421                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
3422                 } else {
3423                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3424                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3425                 }
3426         } else {
3427                 if (ofdm_pwrlvl <= 11) {
3428                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3429                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3430                 } else if (ofdm_pwrlvl <= 17) {
3431                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
3432                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
3433                 } else {
3434                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
3435                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
3436                 }
3437         }
3438         usb_pause_mtx(&sc->sc_mtx, 1);
3439 fail:
3440         return (error);
3441 }
3442
3443 static usb_error_t
3444 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
3445 {
3446         struct usb_device_request req;
3447         usb_error_t error;
3448
3449         req.bmRequestType = UT_READ_VENDOR_DEVICE;
3450         req.bRequest = URTW_8187_GETREGS_REQ;
3451         USETW(req.wValue, val | 0xfe00);
3452         USETW(req.wIndex, 0);
3453         USETW(req.wLength, sizeof(uint8_t));
3454
3455         error = urtw_do_request(sc, &req, data);
3456         return (error);
3457 }
3458
3459 static usb_error_t
3460 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
3461 {
3462         struct usb_device_request req;
3463
3464         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
3465         req.bRequest = URTW_8187_SETREGS_REQ;
3466         USETW(req.wValue, val | 0xfe00);
3467         USETW(req.wIndex, 0);
3468         USETW(req.wLength, sizeof(uint8_t));
3469
3470         return (urtw_do_request(sc, &req, &data));
3471 }
3472
3473 static usb_error_t
3474 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
3475 {
3476         uint8_t data;
3477         usb_error_t error;
3478
3479         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3480         if (error)
3481                 goto fail;
3482
3483         urtw_read8_m(sc, URTW_CONFIG3, &data);
3484         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3485         urtw_write32_m(sc, URTW_ANAPARAM, val);
3486         urtw_read8_m(sc, URTW_CONFIG3, &data);
3487         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3488
3489         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3490         if (error)
3491                 goto fail;
3492 fail:
3493         return (error);
3494 }
3495
3496 static usb_error_t
3497 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
3498 {
3499         uint8_t data;
3500         usb_error_t error;
3501
3502         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3503         if (error)
3504                 goto fail;
3505
3506         urtw_read8_m(sc, URTW_CONFIG3, &data);
3507         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3508         urtw_write32_m(sc, URTW_ANAPARAM2, val);
3509         urtw_read8_m(sc, URTW_CONFIG3, &data);
3510         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3511
3512         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3513         if (error)
3514                 goto fail;
3515 fail:
3516         return (error);
3517 }
3518
3519 static usb_error_t
3520 urtw_intr_enable(struct urtw_softc *sc)
3521 {
3522         usb_error_t error;
3523
3524         urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
3525 fail:
3526         return (error);
3527 }
3528
3529 static usb_error_t
3530 urtw_intr_disable(struct urtw_softc *sc)
3531 {
3532         usb_error_t error;
3533
3534         urtw_write16_m(sc, URTW_INTR_MASK, 0);
3535 fail:
3536         return (error);
3537 }
3538
3539 static usb_error_t
3540 urtw_reset(struct urtw_softc *sc)
3541 {
3542         uint8_t data;
3543         usb_error_t error;
3544
3545         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3546         if (error)
3547                 goto fail;
3548         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3549         if (error)
3550                 goto fail;
3551
3552         error = urtw_intr_disable(sc);
3553         if (error)
3554                 goto fail;
3555         usb_pause_mtx(&sc->sc_mtx, 100);
3556
3557         error = urtw_write8e(sc, 0x18, 0x10);
3558         if (error != 0)
3559                 goto fail;
3560         error = urtw_write8e(sc, 0x18, 0x11);
3561         if (error != 0)
3562                 goto fail;
3563         error = urtw_write8e(sc, 0x18, 0x00);
3564         if (error != 0)
3565                 goto fail;
3566         usb_pause_mtx(&sc->sc_mtx, 100);
3567
3568         urtw_read8_m(sc, URTW_CMD, &data);
3569         data = (data & 0x2) | URTW_CMD_RST;
3570         urtw_write8_m(sc, URTW_CMD, data);
3571         usb_pause_mtx(&sc->sc_mtx, 100);
3572
3573         urtw_read8_m(sc, URTW_CMD, &data);
3574         if (data & URTW_CMD_RST) {
3575                 device_printf(sc->sc_dev, "reset timeout\n");
3576                 goto fail;
3577         }
3578
3579         error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
3580         if (error)
3581                 goto fail;
3582         usb_pause_mtx(&sc->sc_mtx, 100);
3583
3584         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3585         if (error)
3586                 goto fail;
3587         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3588         if (error)
3589                 goto fail;
3590 fail:
3591         return (error);
3592 }
3593
3594 static usb_error_t
3595 urtw_led_ctl(struct urtw_softc *sc, int mode)
3596 {
3597         usb_error_t error = 0;
3598
3599         switch (sc->sc_strategy) {
3600         case URTW_SW_LED_MODE0:
3601                 error = urtw_led_mode0(sc, mode);
3602                 break;
3603         case URTW_SW_LED_MODE1:
3604                 error = urtw_led_mode1(sc, mode);
3605                 break;
3606         case URTW_SW_LED_MODE2:
3607                 error = urtw_led_mode2(sc, mode);
3608                 break;
3609         case URTW_SW_LED_MODE3:
3610                 error = urtw_led_mode3(sc, mode);
3611                 break;
3612         default:
3613                 panic("unsupported LED mode %d\n", sc->sc_strategy);
3614                 /* never reach  */
3615         }
3616
3617         return (error);
3618 }
3619
3620 static usb_error_t
3621 urtw_led_mode0(struct urtw_softc *sc, int mode)
3622 {
3623
3624         switch (mode) {
3625         case URTW_LED_CTL_POWER_ON:
3626                 sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
3627                 break;
3628         case URTW_LED_CTL_TX:
3629                 if (sc->sc_gpio_ledinprogress == 1)
3630                         return (0);
3631
3632                 sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
3633                 sc->sc_gpio_blinktime = 2;
3634                 break;
3635         case URTW_LED_CTL_LINK:
3636                 sc->sc_gpio_ledstate = URTW_LED_ON;
3637                 break;
3638         default:
3639                 panic("unsupported LED mode 0x%x", mode);
3640                 /* never reach  */
3641         }
3642
3643         switch (sc->sc_gpio_ledstate) {
3644         case URTW_LED_ON:
3645                 if (sc->sc_gpio_ledinprogress != 0)
3646                         break;
3647                 urtw_led_on(sc, URTW_LED_GPIO);
3648                 break;
3649         case URTW_LED_BLINK_NORMAL:
3650                 if (sc->sc_gpio_ledinprogress != 0)
3651                         break;
3652                 sc->sc_gpio_ledinprogress = 1;
3653                 sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
3654                         URTW_LED_OFF : URTW_LED_ON;
3655                 usb_callout_reset(&sc->sc_led_ch, hz, urtw_led_ch, sc);
3656                 break;
3657         case URTW_LED_POWER_ON_BLINK:
3658                 urtw_led_on(sc, URTW_LED_GPIO);
3659                 usb_pause_mtx(&sc->sc_mtx, 100);
3660                 urtw_led_off(sc, URTW_LED_GPIO);
3661                 break;
3662         default:
3663                 panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
3664                 /* never reach  */
3665         }
3666         return (0);
3667 }
3668
3669 static usb_error_t
3670 urtw_led_mode1(struct urtw_softc *sc, int mode)
3671 {
3672         return (USB_ERR_INVAL);
3673 }
3674
3675 static usb_error_t
3676 urtw_led_mode2(struct urtw_softc *sc, int mode)
3677 {
3678         return (USB_ERR_INVAL);
3679 }
3680
3681 static usb_error_t
3682 urtw_led_mode3(struct urtw_softc *sc, int mode)
3683 {
3684         return (USB_ERR_INVAL);
3685 }
3686
3687 static usb_error_t
3688 urtw_led_on(struct urtw_softc *sc, int type)
3689 {
3690         usb_error_t error;
3691
3692         if (type == URTW_LED_GPIO) {
3693                 switch (sc->sc_gpio_ledpin) {
3694                 case URTW_LED_PIN_GPIO0:
3695                         urtw_write8_m(sc, URTW_GPIO, 0x01);
3696                         urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
3697                         break;
3698                 default:
3699                         panic("unsupported LED PIN type 0x%x",
3700                             sc->sc_gpio_ledpin);
3701                         /* never reach  */
3702                 }
3703         } else {
3704                 panic("unsupported LED type 0x%x", type);
3705                 /* never reach  */
3706         }
3707
3708         sc->sc_gpio_ledon = 1;
3709 fail:
3710         return (error);
3711 }
3712
3713 static usb_error_t
3714 urtw_led_off(struct urtw_softc *sc, int type)
3715 {
3716         usb_error_t error;
3717
3718         if (type == URTW_LED_GPIO) {
3719                 switch (sc->sc_gpio_ledpin) {
3720                 case URTW_LED_PIN_GPIO0:
3721                         urtw_write8_m(sc, URTW_GPIO, URTW_GPIO_DATA_MAGIC1);
3722                         urtw_write8_m(sc,
3723                             URTW_GP_ENABLE, URTW_GP_ENABLE_DATA_MAGIC1);
3724                         break;
3725                 default:
3726                         panic("unsupported LED PIN type 0x%x",
3727                             sc->sc_gpio_ledpin);
3728                         /* never reach  */
3729                 }
3730         } else {
3731                 panic("unsupported LED type 0x%x", type);
3732                 /* never reach  */
3733         }
3734
3735         sc->sc_gpio_ledon = 0;
3736
3737 fail:
3738         return (error);
3739 }
3740
3741 static void
3742 urtw_led_ch(void *arg)
3743 {
3744         struct urtw_softc *sc = arg;
3745         struct ifnet *ifp = sc->sc_ifp;
3746         struct ieee80211com *ic = ifp->if_l2com;
3747
3748         ieee80211_runtask(ic, &sc->sc_led_task);
3749 }
3750
3751 static void
3752 urtw_ledtask(void *arg, int pending)
3753 {
3754         struct urtw_softc *sc = arg;
3755
3756         if (sc->sc_strategy != URTW_SW_LED_MODE0)
3757                 panic("could not process a LED strategy 0x%x", sc->sc_strategy);
3758
3759         URTW_LOCK(sc);
3760         urtw_led_blink(sc);
3761         URTW_UNLOCK(sc);
3762 }
3763
3764 static usb_error_t
3765 urtw_led_blink(struct urtw_softc *sc)
3766 {
3767         uint8_t ing = 0;
3768         usb_error_t error;
3769
3770         if (sc->sc_gpio_blinkstate == URTW_LED_ON)
3771                 error = urtw_led_on(sc, URTW_LED_GPIO);
3772         else
3773                 error = urtw_led_off(sc, URTW_LED_GPIO);
3774         sc->sc_gpio_blinktime--;
3775         if (sc->sc_gpio_blinktime == 0)
3776                 ing = 1;
3777         else {
3778                 if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
3779                     sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
3780                     sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
3781                         ing = 1;
3782         }
3783         if (ing == 1) {
3784                 if (sc->sc_gpio_ledstate == URTW_LED_ON &&
3785                     sc->sc_gpio_ledon == 0)
3786                         error = urtw_led_on(sc, URTW_LED_GPIO);
3787                 else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
3788                     sc->sc_gpio_ledon == 1)
3789                         error = urtw_led_off(sc, URTW_LED_GPIO);
3790
3791                 sc->sc_gpio_blinktime = 0;
3792                 sc->sc_gpio_ledinprogress = 0;
3793                 return (0);
3794         }
3795
3796         sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
3797             URTW_LED_ON : URTW_LED_OFF;
3798
3799         switch (sc->sc_gpio_ledstate) {
3800         case URTW_LED_BLINK_NORMAL:
3801                 usb_callout_reset(&sc->sc_led_ch, hz, urtw_led_ch, sc);
3802                 break;
3803         default:
3804                 panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
3805                 /* never reach  */
3806         }
3807         return (0);
3808 }
3809
3810 static usb_error_t
3811 urtw_rx_enable(struct urtw_softc *sc)
3812 {
3813         uint8_t data;
3814         usb_error_t error;
3815
3816         usbd_transfer_start((sc->sc_flags & URTW_RTL8187B) ?
3817             sc->sc_xfer[URTW_8187B_BULK_RX] : sc->sc_xfer[URTW_8187L_BULK_RX]);
3818
3819         error = urtw_rx_setconf(sc);
3820         if (error != 0)
3821                 goto fail;
3822
3823         if ((sc->sc_flags & URTW_RTL8187B) == 0) {
3824                 urtw_read8_m(sc, URTW_CMD, &data);
3825                 urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
3826         }
3827 fail:
3828         return (error);
3829 }
3830
3831 static usb_error_t
3832 urtw_tx_enable(struct urtw_softc *sc)
3833 {
3834         uint8_t data8;
3835         uint32_t data;
3836         usb_error_t error;
3837
3838         if (sc->sc_flags & URTW_RTL8187B) {
3839                 urtw_read32_m(sc, URTW_TX_CONF, &data);
3840                 data &= ~URTW_TX_LOOPBACK_MASK;
3841                 data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
3842                 data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
3843                 data &= ~URTW_TX_SWPLCPLEN;
3844                 data |= URTW_TX_HW_SEQNUM | URTW_TX_DISREQQSIZE |
3845                     (7 << 8) |  /* short retry limit */
3846                     (7 << 0) |  /* long retry limit */
3847                     (7 << 21);  /* MAX TX DMA */
3848                 urtw_write32_m(sc, URTW_TX_CONF, data);
3849
3850                 urtw_read8_m(sc, URTW_MSR, &data8);
3851                 data8 |= URTW_MSR_LINK_ENEDCA;
3852                 urtw_write8_m(sc, URTW_MSR, data8);
3853                 return (error);
3854         }
3855
3856         urtw_read8_m(sc, URTW_CW_CONF, &data8);
3857         data8 &= ~(URTW_CW_CONF_PERPACKET_CW | URTW_CW_CONF_PERPACKET_RETRY);
3858         urtw_write8_m(sc, URTW_CW_CONF, data8);
3859
3860         urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
3861         data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
3862         data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
3863         data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
3864         urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
3865
3866         urtw_read32_m(sc, URTW_TX_CONF, &data);
3867         data &= ~URTW_TX_LOOPBACK_MASK;
3868         data |= URTW_TX_LOOPBACK_NONE;
3869         data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
3870         data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
3871         data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
3872         data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
3873         data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
3874         data &= ~URTW_TX_SWPLCPLEN;
3875         data |= URTW_TX_NOICV;
3876         urtw_write32_m(sc, URTW_TX_CONF, data);
3877
3878         urtw_read8_m(sc, URTW_CMD, &data8);
3879         urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
3880 fail:
3881         return (error);
3882 }
3883
3884 static usb_error_t
3885 urtw_rx_setconf(struct urtw_softc *sc)
3886 {
3887         struct ifnet *ifp = sc->sc_ifp;
3888         struct ieee80211com *ic = ifp->if_l2com;
3889         uint32_t data;
3890         usb_error_t error;
3891
3892         urtw_read32_m(sc, URTW_RX, &data);
3893         data = data &~ URTW_RX_FILTER_MASK;
3894         if (sc->sc_flags & URTW_RTL8187B) {
3895                 data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA |
3896                     URTW_RX_FILTER_MCAST | URTW_RX_FILTER_BCAST |
3897                     URTW_RX_FILTER_NICMAC | URTW_RX_CHECK_BSSID |
3898                     URTW_RX_FIFO_THRESHOLD_NONE |
3899                     URTW_MAX_RX_DMA_2048 |
3900                     URTW_RX_AUTORESETPHY | URTW_RCR_ONLYERLPKT;
3901         } else {
3902                 data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
3903                 data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
3904
3905                 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
3906                         data = data | URTW_RX_FILTER_ICVERR;
3907                         data = data | URTW_RX_FILTER_PWR;
3908                 }
3909                 if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
3910                         data = data | URTW_RX_FILTER_CRCERR;
3911
3912                 if (ic->ic_opmode == IEEE80211_M_MONITOR ||
3913                     (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
3914                         data = data | URTW_RX_FILTER_ALLMAC;
3915                 } else {
3916                         data = data | URTW_RX_FILTER_NICMAC;
3917                         data = data | URTW_RX_CHECK_BSSID;
3918                 }
3919
3920                 data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
3921                 data = data | URTW_RX_FIFO_THRESHOLD_NONE |
3922                     URTW_RX_AUTORESETPHY;
3923                 data = data &~ URTW_MAX_RX_DMA_MASK;
3924                 data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
3925         }
3926
3927         urtw_write32_m(sc, URTW_RX, data);
3928 fail:
3929         return (error);
3930 }
3931
3932 static struct mbuf *
3933 urtw_rxeof(struct usb_xfer *xfer, struct urtw_data *data, int *rssi_p,
3934     int8_t *nf_p)
3935 {
3936         int actlen, flen, rssi;
3937         struct ieee80211_frame *wh;
3938         struct mbuf *m, *mnew;
3939         struct urtw_softc *sc = data->sc;
3940         struct ifnet *ifp = sc->sc_ifp;
3941         struct ieee80211com *ic = ifp->if_l2com;
3942         uint8_t noise = 0, rate;
3943
3944         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
3945
3946         if (actlen < URTW_MIN_RXBUFSZ) {
3947                 ifp->if_ierrors++;
3948                 return (NULL);
3949         }
3950
3951         if (sc->sc_flags & URTW_RTL8187B) {
3952                 struct urtw_8187b_rxhdr *rx;
3953
3954                 rx = (struct urtw_8187b_rxhdr *)(data->buf +
3955                     (actlen - (sizeof(struct urtw_8187b_rxhdr))));
3956                 flen = le32toh(rx->flag) & 0xfff;
3957                 if (flen > actlen) {
3958                         ifp->if_ierrors++;
3959                         return (NULL);
3960                 }
3961                 rate = (le32toh(rx->flag) >> URTW_RX_FLAG_RXRATE_SHIFT) & 0xf;
3962                 /* XXX correct? */
3963                 rssi = rx->rssi & URTW_RX_RSSI_MASK;
3964                 noise = rx->noise;
3965         } else {
3966                 struct urtw_8187l_rxhdr *rx;
3967
3968                 rx = (struct urtw_8187l_rxhdr *)(data->buf +
3969                     (actlen - (sizeof(struct urtw_8187l_rxhdr))));
3970                 flen = le32toh(rx->flag) & 0xfff;
3971                 if (flen > actlen) {
3972                         ifp->if_ierrors++;
3973                         return (NULL);
3974                 }
3975
3976                 rate = (le32toh(rx->flag) >> URTW_RX_FLAG_RXRATE_SHIFT) & 0xf;
3977                 /* XXX correct? */
3978                 rssi = rx->rssi & URTW_RX_8187L_RSSI_MASK;
3979                 noise = rx->noise;
3980         }
3981
3982         mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
3983         if (mnew == NULL) {
3984                 ifp->if_ierrors++;
3985                 return (NULL);
3986         }
3987
3988         m = data->m;
3989         data->m = mnew;
3990         data->buf = mtod(mnew, uint8_t *);
3991
3992         /* finalize mbuf */
3993         m->m_pkthdr.rcvif = ifp;
3994         m->m_pkthdr.len = m->m_len = flen - IEEE80211_CRC_LEN;
3995
3996         if (ieee80211_radiotap_active(ic)) {
3997                 struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
3998
3999                 /* XXX Are variables correct?  */
4000                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
4001                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
4002                 tap->wr_dbm_antsignal = (int8_t)rssi;
4003         }
4004
4005         wh = mtod(m, struct ieee80211_frame *);
4006         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
4007                 sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
4008
4009         *rssi_p = rssi;
4010         *nf_p = noise;          /* XXX correct? */
4011
4012         return (m);
4013 }
4014
4015 static void
4016 urtw_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
4017 {
4018         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4019         struct ifnet *ifp = sc->sc_ifp;
4020         struct ieee80211com *ic = ifp->if_l2com;
4021         struct ieee80211_frame *wh;
4022         struct ieee80211_node *ni;
4023         struct mbuf *m = NULL;
4024         struct urtw_data *data;
4025         int8_t nf = -95;
4026         int rssi = 1;
4027
4028         URTW_ASSERT_LOCKED(sc);
4029
4030         switch (USB_GET_STATE(xfer)) {
4031         case USB_ST_TRANSFERRED:
4032                 data = STAILQ_FIRST(&sc->sc_rx_active);
4033                 if (data == NULL)
4034                         goto setup;
4035                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
4036                 m = urtw_rxeof(xfer, data, &rssi, &nf);
4037                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
4038                 /* FALLTHROUGH */
4039         case USB_ST_SETUP:
4040 setup:
4041                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
4042                 if (data == NULL) {
4043                         KASSERT(m == NULL, ("mbuf isn't NULL"));
4044                         return;
4045                 }
4046                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
4047                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
4048                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
4049                     usbd_xfer_max_len(xfer));
4050                 usbd_transfer_submit(xfer);
4051
4052                 /*
4053                  * To avoid LOR we should unlock our private mutex here to call
4054                  * ieee80211_input() because here is at the end of a USB
4055                  * callback and safe to unlock.
4056                  */
4057                 URTW_UNLOCK(sc);
4058                 if (m != NULL) {
4059                         wh = mtod(m, struct ieee80211_frame *);
4060                         ni = ieee80211_find_rxnode(ic,
4061                             (struct ieee80211_frame_min *)wh);
4062                         if (ni != NULL) {
4063                                 (void) ieee80211_input(ni, m, rssi, nf);
4064                                 /* node is no longer needed */
4065                                 ieee80211_free_node(ni);
4066                         } else
4067                                 (void) ieee80211_input_all(ic, m, rssi, nf);
4068                         m = NULL;
4069                 }
4070                 URTW_LOCK(sc);
4071                 break;
4072         default:
4073                 /* needs it to the inactive queue due to a error.  */
4074                 data = STAILQ_FIRST(&sc->sc_rx_active);
4075                 if (data != NULL) {
4076                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
4077                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
4078                 }
4079                 if (error != USB_ERR_CANCELLED) {
4080                         usbd_xfer_set_stall(xfer);
4081                         ifp->if_ierrors++;
4082                         goto setup;
4083                 }
4084                 break;
4085         }
4086 }
4087
4088 #define URTW_STATUS_TYPE_TXCLOSE        1
4089 #define URTW_STATUS_TYPE_BEACON_INTR    0
4090
4091 static void
4092 urtw_txstatus_eof(struct usb_xfer *xfer)
4093 {
4094         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4095         struct ifnet *ifp = sc->sc_ifp;
4096         int actlen, type, pktretry, seq;
4097         uint64_t val;
4098
4099         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
4100
4101         if (actlen != sizeof(uint64_t))
4102                 return;
4103
4104         val = le64toh(sc->sc_txstatus);
4105         type = (val >> 30) & 0x3;
4106         if (type == URTW_STATUS_TYPE_TXCLOSE) {
4107                 pktretry = val & 0xff;
4108                 seq = (val >> 16) & 0xff;
4109                 if (pktretry == URTW_TX_MAXRETRY)
4110                         ifp->if_oerrors++;
4111                 DPRINTF(sc, URTW_DEBUG_TXSTATUS, "pktretry %d seq %#x\n",
4112                     pktretry, seq);
4113         }
4114 }
4115
4116 static void
4117 urtw_bulk_tx_status_callback(struct usb_xfer *xfer, usb_error_t error)
4118 {
4119         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4120         struct ifnet *ifp = sc->sc_ifp;
4121
4122         URTW_ASSERT_LOCKED(sc);
4123
4124         switch (USB_GET_STATE(xfer)) {
4125         case USB_ST_TRANSFERRED:
4126                 urtw_txstatus_eof(xfer);
4127                 /* FALLTHROUGH */
4128         case USB_ST_SETUP:
4129 setup:
4130                 usbd_xfer_set_frame_data(xfer, 0, &sc->sc_txstatus,
4131                     sizeof(int64_t));
4132                 usbd_transfer_submit(xfer);
4133                 break;
4134         default:
4135                 if (error != USB_ERR_CANCELLED) {
4136                         usbd_xfer_set_stall(xfer);
4137                         ifp->if_ierrors++;
4138                         goto setup;
4139                 }
4140                 break;
4141         }
4142 }
4143
4144 static void
4145 urtw_txeof(struct usb_xfer *xfer, struct urtw_data *data)
4146 {
4147         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4148         struct ifnet *ifp = sc->sc_ifp;
4149         struct mbuf *m;
4150
4151         URTW_ASSERT_LOCKED(sc);
4152
4153         /*
4154          * Do any tx complete callback.  Note this must be done before releasing
4155          * the node reference.
4156          */
4157         if (data->m) {
4158                 m = data->m;
4159                 if (m->m_flags & M_TXCB) {
4160                         /* XXX status? */
4161                         ieee80211_process_callback(data->ni, m, 0);
4162                 }
4163                 m_freem(m);
4164                 data->m = NULL;
4165         }
4166         if (data->ni) {
4167                 ieee80211_free_node(data->ni);
4168                 data->ni = NULL;
4169         }
4170         sc->sc_txtimer = 0;
4171         ifp->if_opackets++;
4172         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
4173 }
4174
4175 static void
4176 urtw_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
4177 {
4178         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4179         struct ifnet *ifp = sc->sc_ifp;
4180         struct urtw_data *data;
4181
4182         URTW_ASSERT_LOCKED(sc);
4183
4184         switch (USB_GET_STATE(xfer)) {
4185         case USB_ST_TRANSFERRED:
4186                 data = STAILQ_FIRST(&sc->sc_tx_active);
4187                 if (data == NULL)
4188                         goto setup;
4189                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
4190                 urtw_txeof(xfer, data);
4191                 STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
4192                 /* FALLTHROUGH */
4193         case USB_ST_SETUP:
4194 setup:
4195                 data = STAILQ_FIRST(&sc->sc_tx_pending);
4196                 if (data == NULL) {
4197                         DPRINTF(sc, URTW_DEBUG_XMIT,
4198                             "%s: empty pending queue\n", __func__);
4199                         return;
4200                 }
4201                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
4202                 STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
4203
4204                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
4205                 usbd_transfer_submit(xfer);
4206
4207                 URTW_UNLOCK(sc);
4208                 urtw_start(ifp);
4209                 URTW_LOCK(sc);
4210                 break;
4211         default:
4212                 data = STAILQ_FIRST(&sc->sc_tx_active);
4213                 if (data == NULL)
4214                         goto setup;
4215                 if (data->ni != NULL) {
4216                         ieee80211_free_node(data->ni);
4217                         data->ni = NULL;
4218                         ifp->if_oerrors++;
4219                 }
4220                 if (error != USB_ERR_CANCELLED) {
4221                         usbd_xfer_set_stall(xfer);
4222                         goto setup;
4223                 }
4224                 break;
4225         }
4226 }
4227
4228 static struct urtw_data *
4229 _urtw_getbuf(struct urtw_softc *sc)
4230 {
4231         struct urtw_data *bf;
4232
4233         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
4234         if (bf != NULL)
4235                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
4236         else
4237                 bf = NULL;
4238         if (bf == NULL)
4239                 DPRINTF(sc, URTW_DEBUG_XMIT, "%s: %s\n", __func__,
4240                     "out of xmit buffers");
4241         return (bf);
4242 }
4243
4244 static struct urtw_data *
4245 urtw_getbuf(struct urtw_softc *sc)
4246 {
4247         struct urtw_data *bf;
4248
4249         URTW_ASSERT_LOCKED(sc);
4250
4251         bf = _urtw_getbuf(sc);
4252         if (bf == NULL) {
4253                 struct ifnet *ifp = sc->sc_ifp;
4254
4255                 DPRINTF(sc, URTW_DEBUG_XMIT, "%s: stop queue\n", __func__);
4256                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
4257         }
4258         return (bf);
4259 }
4260
4261 static int
4262 urtw_isbmode(uint16_t rate)
4263 {
4264
4265         return ((rate <= 22 && rate != 12 && rate != 18) ||
4266             rate == 44) ? (1) : (0);
4267 }
4268
4269 static uint16_t
4270 urtw_rate2dbps(uint16_t rate)
4271 {
4272
4273         switch(rate) {
4274         case 12:
4275         case 18:
4276         case 24:
4277         case 36:
4278         case 48:
4279         case 72:
4280         case 96:
4281         case 108:
4282                 return (rate * 2);
4283         default:
4284                 break;
4285         }
4286         return (24);
4287 }
4288
4289 static int
4290 urtw_compute_txtime(uint16_t framelen, uint16_t rate,
4291     uint8_t ismgt, uint8_t isshort)
4292 {
4293         uint16_t     ceiling, frametime, n_dbps;
4294
4295         if (urtw_isbmode(rate)) {
4296                 if (ismgt || !isshort || rate == 2)
4297                         frametime = (uint16_t)(144 + 48 +
4298                             (framelen * 8 / (rate / 2)));
4299                 else
4300                         frametime = (uint16_t)(72 + 24 +
4301                             (framelen * 8 / (rate / 2)));
4302                 if ((framelen * 8 % (rate / 2)) != 0)
4303                         frametime++;
4304         } else {
4305                 n_dbps = urtw_rate2dbps(rate);
4306                 ceiling = (16 + 8 * framelen + 6) / n_dbps
4307                     + (((16 + 8 * framelen + 6) % n_dbps) ? 1 : 0);
4308                 frametime = (uint16_t)(16 + 4 + 4 * ceiling + 6);
4309         }
4310         return (frametime);
4311 }
4312
4313 /*
4314  * Callback from the 802.11 layer to update the
4315  * slot time based on the current setting.
4316  */
4317 static void
4318 urtw_updateslot(struct ieee80211com *ic)
4319 {
4320         struct urtw_softc *sc = ic->ic_softc;
4321
4322         ieee80211_runtask(ic, &sc->sc_updateslot_task);
4323 }
4324
4325 static void
4326 urtw_updateslottask(void *arg, int pending)
4327 {
4328         struct urtw_softc *sc = arg;
4329         struct ifnet *ifp = sc->sc_ifp;
4330         struct ieee80211com *ic = ifp->if_l2com;
4331         int error;
4332
4333         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
4334                 return;
4335
4336         URTW_LOCK(sc);
4337         if (sc->sc_flags & URTW_RTL8187B) {
4338                 urtw_write8_m(sc, URTW_SIFS, 0x22);
4339                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan))
4340                         urtw_write8_m(sc, URTW_SLOT, 0x9);
4341                 else
4342                         urtw_write8_m(sc, URTW_SLOT, 0x14);
4343                 urtw_write8_m(sc, URTW_8187B_EIFS, 0x5b);
4344                 urtw_write8_m(sc, URTW_CARRIER_SCOUNT, 0x5b);
4345         } else {
4346                 urtw_write8_m(sc, URTW_SIFS, 0x22);
4347                 if (sc->sc_state == IEEE80211_S_ASSOC &&
4348                     ic->ic_flags & IEEE80211_F_SHSLOT)
4349                         urtw_write8_m(sc, URTW_SLOT, 0x9);
4350                 else
4351                         urtw_write8_m(sc, URTW_SLOT, 0x14);
4352                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan)) {
4353                         urtw_write8_m(sc, URTW_DIFS, 0x14);
4354                         urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x14);
4355                         urtw_write8_m(sc, URTW_CW_VAL, 0x73);
4356                 } else {
4357                         urtw_write8_m(sc, URTW_DIFS, 0x24);
4358                         urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x24);
4359                         urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
4360                 }
4361         }
4362 fail:
4363         URTW_UNLOCK(sc);
4364 }
4365
4366 static void
4367 urtw_sysctl_node(struct urtw_softc *sc)
4368 {
4369 #define URTW_SYSCTL_STAT_ADD32(c, h, n, p, d)   \
4370         SYSCTL_ADD_UINT(c, h, OID_AUTO, n, CTLFLAG_RD, p, 0, d)
4371         struct sysctl_ctx_list *ctx;
4372         struct sysctl_oid_list *child, *parent;
4373         struct sysctl_oid *tree;
4374         struct urtw_stats *stats = &sc->sc_stats;
4375
4376         ctx = device_get_sysctl_ctx(sc->sc_dev);
4377         child = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
4378
4379         tree = SYSCTL_ADD_NODE(ctx, child, OID_AUTO, "stats", CTLFLAG_RD,
4380             NULL, "URTW statistics");
4381         parent = SYSCTL_CHILDREN(tree);
4382
4383         /* Tx statistics. */
4384         tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "tx", CTLFLAG_RD,
4385             NULL, "Tx MAC statistics");
4386         child = SYSCTL_CHILDREN(tree);
4387         URTW_SYSCTL_STAT_ADD32(ctx, child, "1m", &stats->txrates[0],
4388             "1 Mbit/s");
4389         URTW_SYSCTL_STAT_ADD32(ctx, child, "2m", &stats->txrates[1],
4390             "2 Mbit/s");
4391         URTW_SYSCTL_STAT_ADD32(ctx, child, "5.5m", &stats->txrates[2],
4392             "5.5 Mbit/s");
4393         URTW_SYSCTL_STAT_ADD32(ctx, child, "6m", &stats->txrates[4],
4394             "6 Mbit/s");
4395         URTW_SYSCTL_STAT_ADD32(ctx, child, "9m", &stats->txrates[5],
4396             "9 Mbit/s");
4397         URTW_SYSCTL_STAT_ADD32(ctx, child, "11m", &stats->txrates[3],
4398             "11 Mbit/s");
4399         URTW_SYSCTL_STAT_ADD32(ctx, child, "12m", &stats->txrates[6],
4400             "12 Mbit/s");
4401         URTW_SYSCTL_STAT_ADD32(ctx, child, "18m", &stats->txrates[7],
4402             "18 Mbit/s");
4403         URTW_SYSCTL_STAT_ADD32(ctx, child, "24m", &stats->txrates[8],
4404             "24 Mbit/s");
4405         URTW_SYSCTL_STAT_ADD32(ctx, child, "36m", &stats->txrates[9],
4406             "36 Mbit/s");
4407         URTW_SYSCTL_STAT_ADD32(ctx, child, "48m", &stats->txrates[10],
4408             "48 Mbit/s");
4409         URTW_SYSCTL_STAT_ADD32(ctx, child, "54m", &stats->txrates[11],
4410             "54 Mbit/s");
4411 #undef URTW_SYSCTL_STAT_ADD32
4412 }
4413
4414 static device_method_t urtw_methods[] = {
4415         DEVMETHOD(device_probe, urtw_match),
4416         DEVMETHOD(device_attach, urtw_attach),
4417         DEVMETHOD(device_detach, urtw_detach),
4418         DEVMETHOD_END
4419 };
4420 static driver_t urtw_driver = {
4421         "urtw",
4422         urtw_methods,
4423         sizeof(struct urtw_softc)
4424 };
4425 static devclass_t urtw_devclass;
4426
4427 DRIVER_MODULE(urtw, uhub, urtw_driver, urtw_devclass, NULL, NULL);
4428 MODULE_DEPEND(urtw, wlan, 1, 1, 1);
4429 MODULE_DEPEND(urtw, usb, 1, 1, 1);
4430 MODULE_VERSION(urtw, 1);