sys/bus/u4b/wlan/if_urtw.c

   1 /*-
   2  * Copyright (c) 2008 Weongyo Jeong <weongyo@FreeBSD.org>
   3  *
   4  * Permission to use, copy, modify, and distribute this software for any
   5  * purpose with or without fee is hereby granted, provided that the above
   6  * copyright notice and this permission notice appear in all copies.
   7  *
   8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  15  */
  16
  17 #include <sys/cdefs.h>
  18 __FBSDID("$FreeBSD$");
  19 #include <sys/param.h>
  20 #include <sys/sockio.h>
  21 #include <sys/sysctl.h>
  22 #include <sys/lock.h>
  23 #include <sys/mutex.h>
  24 #include <sys/mbuf.h>
  25 #include <sys/kernel.h>
  26 #include <sys/socket.h>
  27 #include <sys/systm.h>
  28 #include <sys/malloc.h>
  29 #include <sys/module.h>
  30 #include <sys/bus.h>
  31 #include <sys/endian.h>
  32 #include <sys/kdb.h>
  33
  34 #include <machine/bus.h>
  35 #include <machine/resource.h>
  36 #include <sys/rman.h>
  37
  38 #include <net/if.h>
  39 #include <net/if_arp.h>
  40 #include <net/ethernet.h>
  41 #include <net/if_dl.h>
  42 #include <net/if_media.h>
  43 #include <net/if_types.h>
  44
  45 #ifdef INET
  46 #include <netinet/in.h>
  47 #include <netinet/in_systm.h>
  48 #include <netinet/in_var.h>
  49 #include <netinet/if_ether.h>
  50 #include <netinet/ip.h>
  51 #endif
  52
  53 #include <net80211/ieee80211_var.h>
  54 #include <net80211/ieee80211_regdomain.h>
  55 #include <net80211/ieee80211_radiotap.h>
  56
  57 #include <dev/usb/usb.h>
  58 #include <dev/usb/usbdi.h>
  59 #include "usbdevs.h"
  60
  61 #include <dev/usb/wlan/if_urtwreg.h>
  62 #include <dev/usb/wlan/if_urtwvar.h>
  63
  64 static SYSCTL_NODE(_hw_usb, OID_AUTO, urtw, CTLFLAG_RW, 0, "USB Realtek 8187L");
  65 #ifdef URTW_DEBUG
  66 int urtw_debug = 0;
  67 SYSCTL_INT(_hw_usb_urtw, OID_AUTO, debug, CTLFLAG_RW, &urtw_debug, 0,
  68     "control debugging printfs");
  69 TUNABLE_INT("hw.usb.urtw.debug", &urtw_debug);
  70 enum {
  71         URTW_DEBUG_XMIT         = 0x00000001,   /* basic xmit operation */
  72         URTW_DEBUG_RECV         = 0x00000002,   /* basic recv operation */
  73         URTW_DEBUG_RESET        = 0x00000004,   /* reset processing */
  74         URTW_DEBUG_TX_PROC      = 0x00000008,   /* tx ISR proc */
  75         URTW_DEBUG_RX_PROC      = 0x00000010,   /* rx ISR proc */
  76         URTW_DEBUG_STATE        = 0x00000020,   /* 802.11 state transitions */
  77         URTW_DEBUG_STAT         = 0x00000040,   /* statistic */
  78         URTW_DEBUG_INIT         = 0x00000080,   /* initialization of dev */
  79         URTW_DEBUG_TXSTATUS     = 0x00000100,   /* tx status */
  80         URTW_DEBUG_ANY          = 0xffffffff
  81 };
  82 #define DPRINTF(sc, m, fmt, ...) do {                           \
  83         if (sc->sc_debug & (m))                                 \
  84                 printf(fmt, __VA_ARGS__);                       \
  85 } while (0)
  86 #else
  87 #define DPRINTF(sc, m, fmt, ...) do {                           \
  88         (void) sc;                                              \
  89 } while (0)
  90 #endif
  91 static int urtw_preamble_mode = URTW_PREAMBLE_MODE_LONG;
  92 SYSCTL_INT(_hw_usb_urtw, OID_AUTO, preamble_mode, CTLFLAG_RW,
  93     &urtw_preamble_mode, 0, "set the preable mode (long or short)");
  94 TUNABLE_INT("hw.usb.urtw.preamble_mode", &urtw_preamble_mode);
  95
  96 /* recognized device vendors/products */
  97 #define urtw_lookup(v, p)                                               \
  98         ((const struct urtw_type *)usb_lookup(urtw_devs, v, p))
  99 #define URTW_DEV_B(v,p)                                                 \
 100         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTW_REV_RTL8187B) }
 101 #define URTW_DEV_L(v,p)                                                 \
 102         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, URTW_REV_RTL8187L) }
 103 #define URTW_REV_RTL8187B       0
 104 #define URTW_REV_RTL8187L       1
 105 static const STRUCT_USB_HOST_ID urtw_devs[] = {
 106         URTW_DEV_B(NETGEAR, WG111V3),
 107         URTW_DEV_B(REALTEK, RTL8187B_0),
 108         URTW_DEV_B(REALTEK, RTL8187B_1),
 109         URTW_DEV_B(REALTEK, RTL8187B_2),
 110         URTW_DEV_B(SITECOMEU, WL168V4),
 111         URTW_DEV_L(ASUS, P5B_WIFI),
 112         URTW_DEV_L(BELKIN, F5D7050E),
 113         URTW_DEV_L(LINKSYS4, WUSB54GCV2),
 114         URTW_DEV_L(NETGEAR, WG111V2),
 115         URTW_DEV_L(REALTEK, RTL8187),
 116         URTW_DEV_L(SITECOMEU, WL168V1),
 117         URTW_DEV_L(SURECOM, EP9001G2A),
 118         { USB_VPI(USB_VENDOR_OVISLINK, 0x8187, URTW_REV_RTL8187L) },
 119         { USB_VPI(USB_VENDOR_DICKSMITH, 0x9401, URTW_REV_RTL8187L) },
 120         { USB_VPI(USB_VENDOR_HP, 0xca02, URTW_REV_RTL8187L) },
 121         { USB_VPI(USB_VENDOR_LOGITEC, 0x010c, URTW_REV_RTL8187L) },
 122         { USB_VPI(USB_VENDOR_NETGEAR, 0x6100, URTW_REV_RTL8187L) },
 123         { USB_VPI(USB_VENDOR_SPHAIRON, 0x0150, URTW_REV_RTL8187L) },
 124         { USB_VPI(USB_VENDOR_QCOM, 0x6232, URTW_REV_RTL8187L) },
 125 #undef URTW_DEV_L
 126 #undef URTW_DEV_B
 127 };
 128
 129 #define urtw_read8_m(sc, val, data)     do {                    \
 130         error = urtw_read8_c(sc, val, data);                    \
 131         if (error != 0)                                         \
 132                 goto fail;                                      \
 133 } while (0)
 134 #define urtw_write8_m(sc, val, data)    do {                    \
 135         error = urtw_write8_c(sc, val, data);                   \
 136         if (error != 0)                                         \
 137                 goto fail;                                      \
 138 } while (0)
 139 #define urtw_read16_m(sc, val, data)    do {                    \
 140         error = urtw_read16_c(sc, val, data);                   \
 141         if (error != 0)                                         \
 142                 goto fail;                                      \
 143 } while (0)
 144 #define urtw_write16_m(sc, val, data)   do {                    \
 145         error = urtw_write16_c(sc, val, data);                  \
 146         if (error != 0)                                         \
 147                 goto fail;                                      \
 148 } while (0)
 149 #define urtw_read32_m(sc, val, data)    do {                    \
 150         error = urtw_read32_c(sc, val, data);                   \
 151         if (error != 0)                                         \
 152                 goto fail;                                      \
 153 } while (0)
 154 #define urtw_write32_m(sc, val, data)   do {                    \
 155         error = urtw_write32_c(sc, val, data);                  \
 156         if (error != 0)                                         \
 157                 goto fail;                                      \
 158 } while (0)
 159 #define urtw_8187_write_phy_ofdm(sc, val, data) do {            \
 160         error = urtw_8187_write_phy_ofdm_c(sc, val, data);      \
 161         if (error != 0)                                         \
 162                 goto fail;                                      \
 163 } while (0)
 164 #define urtw_8187_write_phy_cck(sc, val, data)  do {            \
 165         error = urtw_8187_write_phy_cck_c(sc, val, data);       \
 166         if (error != 0)                                         \
 167                 goto fail;                                      \
 168 } while (0)
 169 #define urtw_8225_write(sc, val, data)  do {                    \
 170         error = urtw_8225_write_c(sc, val, data);               \
 171         if (error != 0)                                         \
 172                 goto fail;                                      \
 173 } while (0)
 174
 175 struct urtw_pair {
 176         uint32_t        reg;
 177         uint32_t        val;
 178 };
 179
 180 static uint8_t urtw_8225_agc[] = {
 181         0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9d, 0x9c, 0x9b,
 182         0x9a, 0x99, 0x98, 0x97, 0x96, 0x95, 0x94, 0x93, 0x92, 0x91, 0x90,
 183         0x8f, 0x8e, 0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86, 0x85,
 184         0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e, 0x3d, 0x3c, 0x3b, 0x3a,
 185         0x39, 0x38, 0x37, 0x36, 0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f,
 186         0x2e, 0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26, 0x25, 0x24,
 187         0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e, 0x1d, 0x1c, 0x1b, 0x1a, 0x19,
 188         0x18, 0x17, 0x16, 0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
 189         0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06, 0x05, 0x04, 0x03,
 190         0x02, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
 191         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
 192         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
 193 };
 194
 195 static uint8_t urtw_8225z2_agc[] = {
 196         0x5e, 0x5e, 0x5e, 0x5e, 0x5d, 0x5b, 0x59, 0x57, 0x55, 0x53, 0x51,
 197         0x4f, 0x4d, 0x4b, 0x49, 0x47, 0x45, 0x43, 0x41, 0x3f, 0x3d, 0x3b,
 198         0x39, 0x37, 0x35, 0x33, 0x31, 0x2f, 0x2d, 0x2b, 0x29, 0x27, 0x25,
 199         0x23, 0x21, 0x1f, 0x1d, 0x1b, 0x19, 0x17, 0x15, 0x13, 0x11, 0x0f,
 200         0x0d, 0x0b, 0x09, 0x07, 0x05, 0x03, 0x01, 0x01, 0x01, 0x01, 0x01,
 201         0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x19, 0x19,
 202         0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x19, 0x20, 0x21, 0x22, 0x23,
 203         0x24, 0x25, 0x26, 0x26, 0x27, 0x27, 0x28, 0x28, 0x29, 0x2a, 0x2a,
 204         0x2a, 0x2b, 0x2b, 0x2b, 0x2c, 0x2c, 0x2c, 0x2d, 0x2d, 0x2d, 0x2d,
 205         0x2e, 0x2e, 0x2e, 0x2e, 0x2f, 0x2f, 0x2f, 0x30, 0x30, 0x31, 0x31,
 206         0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31,
 207         0x31, 0x31, 0x31, 0x31, 0x31, 0x31, 0x31
 208 };
 209
 210 static uint32_t urtw_8225_channel[] = {
 211         0x0000,         /* dummy channel 0  */
 212         0x085c,         /* 1  */
 213         0x08dc,         /* 2  */
 214         0x095c,         /* 3  */
 215         0x09dc,         /* 4  */
 216         0x0a5c,         /* 5  */
 217         0x0adc,         /* 6  */
 218         0x0b5c,         /* 7  */
 219         0x0bdc,         /* 8  */
 220         0x0c5c,         /* 9  */
 221         0x0cdc,         /* 10  */
 222         0x0d5c,         /* 11  */
 223         0x0ddc,         /* 12  */
 224         0x0e5c,         /* 13  */
 225         0x0f72,         /* 14  */
 226 };
 227
 228 static uint8_t urtw_8225_gain[] = {
 229         0x23, 0x88, 0x7c, 0xa5,         /* -82dbm  */
 230         0x23, 0x88, 0x7c, 0xb5,         /* -82dbm  */
 231         0x23, 0x88, 0x7c, 0xc5,         /* -82dbm  */
 232         0x33, 0x80, 0x79, 0xc5,         /* -78dbm  */
 233         0x43, 0x78, 0x76, 0xc5,         /* -74dbm  */
 234         0x53, 0x60, 0x73, 0xc5,         /* -70dbm  */
 235         0x63, 0x58, 0x70, 0xc5,         /* -66dbm  */
 236 };
 237
 238 static struct urtw_pair urtw_8225_rf_part1[] = {
 239         { 0x00, 0x0067 }, { 0x01, 0x0fe0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 240         { 0x04, 0x0486 }, { 0x05, 0x0bc0 }, { 0x06, 0x0ae6 }, { 0x07, 0x082a },
 241         { 0x08, 0x001f }, { 0x09, 0x0334 }, { 0x0a, 0x0fd4 }, { 0x0b, 0x0391 },
 242         { 0x0c, 0x0050 }, { 0x0d, 0x06db }, { 0x0e, 0x0029 }, { 0x0f, 0x0914 },
 243 };
 244
 245 static struct urtw_pair urtw_8225_rf_part2[] = {
 246         { 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
 247         { 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
 248         { 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x09 }, { 0x0b, 0x80 },
 249         { 0x0c, 0x01 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 }, { 0x10, 0x84 },
 250         { 0x11, 0x06 }, { 0x12, 0x20 }, { 0x13, 0x20 }, { 0x14, 0x00 },
 251         { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 }, { 0x18, 0xef },
 252         { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x76 }, { 0x1c, 0x04 },
 253         { 0x1e, 0x95 }, { 0x1f, 0x75 }, { 0x20, 0x1f }, { 0x21, 0x27 },
 254         { 0x22, 0x16 }, { 0x24, 0x46 }, { 0x25, 0x20 }, { 0x26, 0x90 },
 255         { 0x27, 0x88 }
 256 };
 257
 258 static struct urtw_pair urtw_8225_rf_part3[] = {
 259         { 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
 260         { 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x10, 0x9b },
 261         { 0x11, 0x88 }, { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 },
 262         { 0x1a, 0xa0 }, { 0x1b, 0x08 }, { 0x40, 0x86 }, { 0x41, 0x8d },
 263         { 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x1f }, { 0x45, 0x1e },
 264         { 0x46, 0x1a }, { 0x47, 0x15 }, { 0x48, 0x10 }, { 0x49, 0x0a },
 265         { 0x4a, 0x05 }, { 0x4b, 0x02 }, { 0x4c, 0x05 }
 266 };
 267
 268 static uint16_t urtw_8225_rxgain[] = {
 269         0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
 270         0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
 271         0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
 272         0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
 273         0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
 274         0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
 275         0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
 276         0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
 277         0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
 278         0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
 279         0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
 280         0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
 281 };
 282
 283 static uint8_t urtw_8225_threshold[] = {
 284         0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd,
 285 };
 286
 287 static uint8_t urtw_8225_tx_gain_cck_ofdm[] = {
 288         0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
 289 };
 290
 291 static uint8_t urtw_8225_txpwr_cck[] = {
 292         0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
 293         0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
 294         0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
 295         0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
 296         0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
 297         0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
 298 };
 299
 300 static uint8_t urtw_8225_txpwr_cck_ch14[] = {
 301         0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
 302         0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
 303         0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
 304         0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
 305         0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
 306         0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
 307 };
 308
 309 static uint8_t urtw_8225_txpwr_ofdm[]={
 310         0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
 311 };
 312
 313 static uint8_t urtw_8225v2_gain_bg[]={
 314         0x23, 0x15, 0xa5,               /* -82-1dbm  */
 315         0x23, 0x15, 0xb5,               /* -82-2dbm  */
 316         0x23, 0x15, 0xc5,               /* -82-3dbm  */
 317         0x33, 0x15, 0xc5,               /* -78dbm  */
 318         0x43, 0x15, 0xc5,               /* -74dbm  */
 319         0x53, 0x15, 0xc5,               /* -70dbm  */
 320         0x63, 0x15, 0xc5,               /* -66dbm  */
 321 };
 322
 323 static struct urtw_pair urtw_8225v2_rf_part1[] = {
 324         { 0x00, 0x02bf }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 325         { 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
 326         { 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
 327         { 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
 328 };
 329
 330 static struct urtw_pair urtw_8225v2b_rf_part0[] = {
 331         { 0x00, 0x00b7 }, { 0x01, 0x0ee0 }, { 0x02, 0x044d }, { 0x03, 0x0441 },
 332         { 0x04, 0x08c3 }, { 0x05, 0x0c72 }, { 0x06, 0x00e6 }, { 0x07, 0x082a },
 333         { 0x08, 0x003f }, { 0x09, 0x0335 }, { 0x0a, 0x09d4 }, { 0x0b, 0x07bb },
 334         { 0x0c, 0x0850 }, { 0x0d, 0x0cdf }, { 0x0e, 0x002b }, { 0x0f, 0x0114 }
 335 };
 336
 337 static struct urtw_pair urtw_8225v2b_rf_part1[] = {
 338         {0x0f0, 0x32}, {0x0f1, 0x32}, {0x0f2, 0x00},
 339         {0x0f3, 0x00}, {0x0f4, 0x32}, {0x0f5, 0x43},
 340         {0x0f6, 0x00}, {0x0f7, 0x00}, {0x0f8, 0x46},
 341         {0x0f9, 0xa4}, {0x0fa, 0x00}, {0x0fb, 0x00},
 342         {0x0fc, 0x96}, {0x0fd, 0xa4}, {0x0fe, 0x00},
 343         {0x0ff, 0x00}, {0x158, 0x4b}, {0x159, 0x00},
 344         {0x15a, 0x4b}, {0x15b, 0x00}, {0x160, 0x4b},
 345         {0x161, 0x09}, {0x162, 0x4b}, {0x163, 0x09},
 346         {0x1ce, 0x0f}, {0x1cf, 0x00}, {0x1e0, 0xff},
 347         {0x1e1, 0x0f}, {0x1e2, 0x00}, {0x1f0, 0x4e},
 348         {0x1f1, 0x01}, {0x1f2, 0x02}, {0x1f3, 0x03},
 349         {0x1f4, 0x04}, {0x1f5, 0x05}, {0x1f6, 0x06},
 350         {0x1f7, 0x07}, {0x1f8, 0x08}, {0x24e, 0x00},
 351         {0x20c, 0x04}, {0x221, 0x61}, {0x222, 0x68},
 352         {0x223, 0x6f}, {0x224, 0x76}, {0x225, 0x7d},
 353         {0x226, 0x84}, {0x227, 0x8d}, {0x24d, 0x08},
 354         {0x250, 0x05}, {0x251, 0xf5}, {0x252, 0x04},
 355         {0x253, 0xa0}, {0x254, 0x1f}, {0x255, 0x23},
 356         {0x256, 0x45}, {0x257, 0x67}, {0x258, 0x08},
 357         {0x259, 0x08}, {0x25a, 0x08}, {0x25b, 0x08},
 358         {0x260, 0x08}, {0x261, 0x08}, {0x262, 0x08},
 359         {0x263, 0x08}, {0x264, 0xcf}, {0x272, 0x56},
 360         {0x273, 0x9a}, {0x034, 0xf0}, {0x035, 0x0f},
 361         {0x05b, 0x40}, {0x084, 0x88}, {0x085, 0x24},
 362         {0x088, 0x54}, {0x08b, 0xb8}, {0x08c, 0x07},
 363         {0x08d, 0x00}, {0x094, 0x1b}, {0x095, 0x12},
 364         {0x096, 0x00}, {0x097, 0x06}, {0x09d, 0x1a},
 365         {0x09f, 0x10}, {0x0b4, 0x22}, {0x0be, 0x80},
 366         {0x0db, 0x00}, {0x0ee, 0x00}, {0x091, 0x03},
 367         {0x24c, 0x00}, {0x39f, 0x00}, {0x08c, 0x01},
 368         {0x08d, 0x10}, {0x08e, 0x08}, {0x08f, 0x00}
 369 };
 370
 371 static struct urtw_pair urtw_8225v2_rf_part2[] = {
 372         { 0x00, 0x01 }, { 0x01, 0x02 }, { 0x02, 0x42 }, { 0x03, 0x00 },
 373         { 0x04, 0x00 }, { 0x05, 0x00 }, { 0x06, 0x40 }, { 0x07, 0x00 },
 374         { 0x08, 0x40 }, { 0x09, 0xfe }, { 0x0a, 0x08 }, { 0x0b, 0x80 },
 375         { 0x0c, 0x01 }, { 0x0d, 0x43 }, { 0x0e, 0xd3 }, { 0x0f, 0x38 },
 376         { 0x10, 0x84 }, { 0x11, 0x07 }, { 0x12, 0x20 }, { 0x13, 0x20 },
 377         { 0x14, 0x00 }, { 0x15, 0x40 }, { 0x16, 0x00 }, { 0x17, 0x40 },
 378         { 0x18, 0xef }, { 0x19, 0x19 }, { 0x1a, 0x20 }, { 0x1b, 0x15 },
 379         { 0x1c, 0x04 }, { 0x1d, 0xc5 }, { 0x1e, 0x95 }, { 0x1f, 0x75 },
 380         { 0x20, 0x1f }, { 0x21, 0x17 }, { 0x22, 0x16 }, { 0x23, 0x80 },
 381         { 0x24, 0x46 }, { 0x25, 0x00 }, { 0x26, 0x90 }, { 0x27, 0x88 }
 382 };
 383
 384 static struct urtw_pair urtw_8225v2b_rf_part2[] = {
 385         { 0x00, 0x10 }, { 0x01, 0x0d }, { 0x02, 0x01 }, { 0x03, 0x00 },
 386         { 0x04, 0x14 }, { 0x05, 0xfb }, { 0x06, 0xfb }, { 0x07, 0x60 },
 387         { 0x08, 0x00 }, { 0x09, 0x60 }, { 0x0a, 0x00 }, { 0x0b, 0x00 },
 388         { 0x0c, 0x00 }, { 0x0d, 0x5c }, { 0x0e, 0x00 }, { 0x0f, 0x00 },
 389         { 0x10, 0x40 }, { 0x11, 0x00 }, { 0x12, 0x40 }, { 0x13, 0x00 },
 390         { 0x14, 0x00 }, { 0x15, 0x00 }, { 0x16, 0xa8 }, { 0x17, 0x26 },
 391         { 0x18, 0x32 }, { 0x19, 0x33 }, { 0x1a, 0x07 }, { 0x1b, 0xa5 },
 392         { 0x1c, 0x6f }, { 0x1d, 0x55 }, { 0x1e, 0xc8 }, { 0x1f, 0xb3 },
 393         { 0x20, 0x0a }, { 0x21, 0xe1 }, { 0x22, 0x2C }, { 0x23, 0x8a },
 394         { 0x24, 0x86 }, { 0x25, 0x83 }, { 0x26, 0x34 }, { 0x27, 0x0f },
 395         { 0x28, 0x4f }, { 0x29, 0x24 }, { 0x2a, 0x6f }, { 0x2b, 0xc2 },
 396         { 0x2c, 0x6b }, { 0x2d, 0x40 }, { 0x2e, 0x80 }, { 0x2f, 0x00 },
 397         { 0x30, 0xc0 }, { 0x31, 0xc1 }, { 0x32, 0x58 }, { 0x33, 0xf1 },
 398         { 0x34, 0x00 }, { 0x35, 0xe4 }, { 0x36, 0x90 }, { 0x37, 0x3e },
 399         { 0x38, 0x6d }, { 0x39, 0x3c }, { 0x3a, 0xfb }, { 0x3b, 0x07 }
 400 };
 401
 402 static struct urtw_pair urtw_8225v2_rf_part3[] = {
 403         { 0x00, 0x98 }, { 0x03, 0x20 }, { 0x04, 0x7e }, { 0x05, 0x12 },
 404         { 0x06, 0xfc }, { 0x07, 0x78 }, { 0x08, 0x2e }, { 0x09, 0x11 },
 405         { 0x0a, 0x17 }, { 0x0b, 0x11 }, { 0x10, 0x9b }, { 0x11, 0x88 },
 406         { 0x12, 0x47 }, { 0x13, 0xd0 }, { 0x19, 0x00 }, { 0x1a, 0xa0 },
 407         { 0x1b, 0x08 }, { 0x1d, 0x00 }, { 0x40, 0x86 }, { 0x41, 0x9d },
 408         { 0x42, 0x15 }, { 0x43, 0x18 }, { 0x44, 0x36 }, { 0x45, 0x35 },
 409         { 0x46, 0x2e }, { 0x47, 0x25 }, { 0x48, 0x1c }, { 0x49, 0x12 },
 410         { 0x4a, 0x09 }, { 0x4b, 0x04 }, { 0x4c, 0x05 }
 411 };
 412
 413 static uint16_t urtw_8225v2_rxgain[] = {
 414         0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0008, 0x0009,
 415         0x000a, 0x000b, 0x0102, 0x0103, 0x0104, 0x0105, 0x0140, 0x0141,
 416         0x0142, 0x0143, 0x0144, 0x0145, 0x0180, 0x0181, 0x0182, 0x0183,
 417         0x0184, 0x0185, 0x0188, 0x0189, 0x018a, 0x018b, 0x0243, 0x0244,
 418         0x0245, 0x0280, 0x0281, 0x0282, 0x0283, 0x0284, 0x0285, 0x0288,
 419         0x0289, 0x028a, 0x028b, 0x028c, 0x0342, 0x0343, 0x0344, 0x0345,
 420         0x0380, 0x0381, 0x0382, 0x0383, 0x0384, 0x0385, 0x0388, 0x0389,
 421         0x038a, 0x038b, 0x038c, 0x038d, 0x0390, 0x0391, 0x0392, 0x0393,
 422         0x0394, 0x0395, 0x0398, 0x0399, 0x039a, 0x039b, 0x039c, 0x039d,
 423         0x03a0, 0x03a1, 0x03a2, 0x03a3, 0x03a4, 0x03a5, 0x03a8, 0x03a9,
 424         0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
 425         0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
 426 };
 427
 428 static uint16_t urtw_8225v2b_rxgain[] = {
 429         0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
 430         0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
 431         0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
 432         0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
 433         0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
 434         0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
 435         0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
 436         0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
 437         0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
 438         0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
 439         0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
 440         0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
 441 };
 442
 443 static uint8_t urtw_8225v2_tx_gain_cck_ofdm[] = {
 444         0x00, 0x01, 0x02, 0x03, 0x04, 0x05,
 445         0x06, 0x07, 0x08, 0x09, 0x0a, 0x0b,
 446         0x0c, 0x0d, 0x0e, 0x0f, 0x10, 0x11,
 447         0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
 448         0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d,
 449         0x1e, 0x1f, 0x20, 0x21, 0x22, 0x23,
 450 };
 451
 452 static uint8_t urtw_8225v2_txpwr_cck[] = {
 453         0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04
 454 };
 455
 456 static uint8_t urtw_8225v2_txpwr_cck_ch14[] = {
 457         0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00
 458 };
 459
 460 static uint8_t urtw_8225v2b_txpwr_cck[] = {
 461         0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04,
 462         0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x03,
 463         0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03,
 464         0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03
 465 };
 466
 467 static uint8_t urtw_8225v2b_txpwr_cck_ch14[] = {
 468         0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00,
 469         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
 470         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00,
 471         0x30, 0x2f, 0x29, 0x15, 0x00, 0x00, 0x00, 0x00
 472 };
 473
 474 static struct urtw_pair urtw_ratetable[] = {
 475         {  2,  0 }, {   4,  1 }, { 11, 2 }, { 12, 4 }, { 18, 5 },
 476         { 22,  3 }, {  24,  6 }, { 36, 7 }, { 48, 8 }, { 72, 9 },
 477         { 96, 10 }, { 108, 11 }
 478 };
 479
 480 static const uint8_t urtw_8187b_reg_table[][3] = {
 481         { 0xf0, 0x32, 0 }, { 0xf1, 0x32, 0 }, { 0xf2, 0x00, 0 },
 482         { 0xf3, 0x00, 0 }, { 0xf4, 0x32, 0 }, { 0xf5, 0x43, 0 },
 483         { 0xf6, 0x00, 0 }, { 0xf7, 0x00, 0 }, { 0xf8, 0x46, 0 },
 484         { 0xf9, 0xa4, 0 }, { 0xfa, 0x00, 0 }, { 0xfb, 0x00, 0 },
 485         { 0xfc, 0x96, 0 }, { 0xfd, 0xa4, 0 }, { 0xfe, 0x00, 0 },
 486         { 0xff, 0x00, 0 }, { 0x58, 0x4b, 1 }, { 0x59, 0x00, 1 },
 487         { 0x5a, 0x4b, 1 }, { 0x5b, 0x00, 1 }, { 0x60, 0x4b, 1 },
 488         { 0x61, 0x09, 1 }, { 0x62, 0x4b, 1 }, { 0x63, 0x09, 1 },
 489         { 0xce, 0x0f, 1 }, { 0xcf, 0x00, 1 }, { 0xe0, 0xff, 1 },
 490         { 0xe1, 0x0f, 1 }, { 0xe2, 0x00, 1 }, { 0xf0, 0x4e, 1 },
 491         { 0xf1, 0x01, 1 }, { 0xf2, 0x02, 1 }, { 0xf3, 0x03, 1 },
 492         { 0xf4, 0x04, 1 }, { 0xf5, 0x05, 1 }, { 0xf6, 0x06, 1 },
 493         { 0xf7, 0x07, 1 }, { 0xf8, 0x08, 1 }, { 0x4e, 0x00, 2 },
 494         { 0x0c, 0x04, 2 }, { 0x21, 0x61, 2 }, { 0x22, 0x68, 2 },
 495         { 0x23, 0x6f, 2 }, { 0x24, 0x76, 2 }, { 0x25, 0x7d, 2 },
 496         { 0x26, 0x84, 2 }, { 0x27, 0x8d, 2 }, { 0x4d, 0x08, 2 },
 497         { 0x50, 0x05, 2 }, { 0x51, 0xf5, 2 }, { 0x52, 0x04, 2 },
 498         { 0x53, 0xa0, 2 }, { 0x54, 0x1f, 2 }, { 0x55, 0x23, 2 },
 499         { 0x56, 0x45, 2 }, { 0x57, 0x67, 2 }, { 0x58, 0x08, 2 },
 500         { 0x59, 0x08, 2 }, { 0x5a, 0x08, 2 }, { 0x5b, 0x08, 2 },
 501         { 0x60, 0x08, 2 }, { 0x61, 0x08, 2 }, { 0x62, 0x08, 2 },
 502         { 0x63, 0x08, 2 }, { 0x64, 0xcf, 2 }, { 0x72, 0x56, 2 },
 503         { 0x73, 0x9a, 2 }, { 0x34, 0xf0, 0 }, { 0x35, 0x0f, 0 },
 504         { 0x5b, 0x40, 0 }, { 0x84, 0x88, 0 }, { 0x85, 0x24, 0 },
 505         { 0x88, 0x54, 0 }, { 0x8b, 0xb8, 0 }, { 0x8c, 0x07, 0 },
 506         { 0x8d, 0x00, 0 }, { 0x94, 0x1b, 0 }, { 0x95, 0x12, 0 },
 507         { 0x96, 0x00, 0 }, { 0x97, 0x06, 0 }, { 0x9d, 0x1a, 0 },
 508         { 0x9f, 0x10, 0 }, { 0xb4, 0x22, 0 }, { 0xbe, 0x80, 0 },
 509         { 0xdb, 0x00, 0 }, { 0xee, 0x00, 0 }, { 0x91, 0x03, 0 },
 510         { 0x4c, 0x00, 2 }, { 0x9f, 0x00, 3 }, { 0x8c, 0x01, 0 },
 511         { 0x8d, 0x10, 0 }, { 0x8e, 0x08, 0 }, { 0x8f, 0x00, 0 }
 512 };
 513
 514 static usb_callback_t urtw_bulk_rx_callback;
 515 static usb_callback_t urtw_bulk_tx_callback;
 516 static usb_callback_t urtw_bulk_tx_status_callback;
 517
 518 static const struct usb_config urtw_8187b_usbconfig[URTW_8187B_N_XFERS] = {
 519         [URTW_8187B_BULK_RX] = {
 520                 .type = UE_BULK,
 521                 .endpoint = 0x83,
 522                 .direction = UE_DIR_IN,
 523                 .bufsize = MCLBYTES,
 524                 .flags = {
 525                         .ext_buffer = 1,
 526                         .pipe_bof = 1,
 527                         .short_xfer_ok = 1
 528                 },
 529                 .callback = urtw_bulk_rx_callback
 530         },
 531         [URTW_8187B_BULK_TX_STATUS] = {
 532                 .type = UE_BULK,
 533                 .endpoint = 0x89,
 534                 .direction = UE_DIR_IN,
 535                 .bufsize = MCLBYTES,
 536                 .flags = {
 537                         .ext_buffer = 1,
 538                         .pipe_bof = 1,
 539                         .short_xfer_ok = 1
 540                 },
 541                 .callback = urtw_bulk_tx_status_callback
 542         },
 543         [URTW_8187B_BULK_TX_BE] = {
 544                 .type = UE_BULK,
 545                 .endpoint = URTW_8187B_TXPIPE_BE,
 546                 .direction = UE_DIR_OUT,
 547                 .bufsize = URTW_TX_MAXSIZE,
 548                 .flags = {
 549                         .ext_buffer = 1,
 550                         .force_short_xfer = 1,
 551                         .pipe_bof = 1,
 552                 },
 553                 .callback = urtw_bulk_tx_callback,
 554                 .timeout = URTW_DATA_TIMEOUT
 555         },
 556         [URTW_8187B_BULK_TX_BK] = {
 557                 .type = UE_BULK,
 558                 .endpoint = URTW_8187B_TXPIPE_BK,
 559                 .direction = UE_DIR_OUT,
 560                 .bufsize = URTW_TX_MAXSIZE,
 561                 .flags = {
 562                         .ext_buffer = 1,
 563                         .force_short_xfer = 1,
 564                         .pipe_bof = 1,
 565                 },
 566                 .callback = urtw_bulk_tx_callback,
 567                 .timeout = URTW_DATA_TIMEOUT
 568         },
 569         [URTW_8187B_BULK_TX_VI] = {
 570                 .type = UE_BULK,
 571                 .endpoint = URTW_8187B_TXPIPE_VI,
 572                 .direction = UE_DIR_OUT,
 573                 .bufsize = URTW_TX_MAXSIZE,
 574                 .flags = {
 575                         .ext_buffer = 1,
 576                         .force_short_xfer = 1,
 577                         .pipe_bof = 1,
 578                 },
 579                 .callback = urtw_bulk_tx_callback,
 580                 .timeout = URTW_DATA_TIMEOUT
 581         },
 582         [URTW_8187B_BULK_TX_VO] = {
 583                 .type = UE_BULK,
 584                 .endpoint = URTW_8187B_TXPIPE_VO,
 585                 .direction = UE_DIR_OUT,
 586                 .bufsize = URTW_TX_MAXSIZE,
 587                 .flags = {
 588                         .ext_buffer = 1,
 589                         .force_short_xfer = 1,
 590                         .pipe_bof = 1,
 591                 },
 592                 .callback = urtw_bulk_tx_callback,
 593                 .timeout = URTW_DATA_TIMEOUT
 594         },
 595         [URTW_8187B_BULK_TX_EP12] = {
 596                 .type = UE_BULK,
 597                 .endpoint = 0xc,
 598                 .direction = UE_DIR_OUT,
 599                 .bufsize = URTW_TX_MAXSIZE,
 600                 .flags = {
 601                         .ext_buffer = 1,
 602                         .force_short_xfer = 1,
 603                         .pipe_bof = 1,
 604                 },
 605                 .callback = urtw_bulk_tx_callback,
 606                 .timeout = URTW_DATA_TIMEOUT
 607         }
 608 };
 609
 610 static const struct usb_config urtw_8187l_usbconfig[URTW_8187L_N_XFERS] = {
 611         [URTW_8187L_BULK_RX] = {
 612                 .type = UE_BULK,
 613                 .endpoint = 0x81,
 614                 .direction = UE_DIR_IN,
 615                 .bufsize = MCLBYTES,
 616                 .flags = {
 617                         .ext_buffer = 1,
 618                         .pipe_bof = 1,
 619                         .short_xfer_ok = 1
 620                 },
 621                 .callback = urtw_bulk_rx_callback
 622         },
 623         [URTW_8187L_BULK_TX_LOW] = {
 624                 .type = UE_BULK,
 625                 .endpoint = 0x2,
 626                 .direction = UE_DIR_OUT,
 627                 .bufsize = URTW_TX_MAXSIZE,
 628                 .flags = {
 629                         .ext_buffer = 1,
 630                         .force_short_xfer = 1,
 631                         .pipe_bof = 1,
 632                 },
 633                 .callback = urtw_bulk_tx_callback,
 634                 .timeout = URTW_DATA_TIMEOUT
 635         },
 636         [URTW_8187L_BULK_TX_NORMAL] = {
 637                 .type = UE_BULK,
 638                 .endpoint = 0x3,
 639                 .direction = UE_DIR_OUT,
 640                 .bufsize = URTW_TX_MAXSIZE,
 641                 .flags = {
 642                         .ext_buffer = 1,
 643                         .force_short_xfer = 1,
 644                         .pipe_bof = 1,
 645                 },
 646                 .callback = urtw_bulk_tx_callback,
 647                 .timeout = URTW_DATA_TIMEOUT
 648         },
 649 };
 650
 651 static struct ieee80211vap *urtw_vap_create(struct ieee80211com *,
 652                             const char [IFNAMSIZ], int, enum ieee80211_opmode,
 653                             int, const uint8_t [IEEE80211_ADDR_LEN],
 654                             const uint8_t [IEEE80211_ADDR_LEN]);
 655 static void             urtw_vap_delete(struct ieee80211vap *);
 656 static void             urtw_init(void *);
 657 static void             urtw_stop(struct ifnet *, int);
 658 static void             urtw_stop_locked(struct ifnet *, int);
 659 static int              urtw_ioctl(struct ifnet *, u_long, caddr_t);
 660 static void             urtw_start(struct ifnet *);
 661 static int              urtw_alloc_rx_data_list(struct urtw_softc *);
 662 static int              urtw_alloc_tx_data_list(struct urtw_softc *);
 663 static int              urtw_raw_xmit(struct ieee80211_node *, struct mbuf *,
 664                             const struct ieee80211_bpf_params *);
 665 static void             urtw_scan_start(struct ieee80211com *);
 666 static void             urtw_scan_end(struct ieee80211com *);
 667 static void             urtw_set_channel(struct ieee80211com *);
 668 static void             urtw_update_mcast(struct ifnet *);
 669 static int              urtw_tx_start(struct urtw_softc *,
 670                             struct ieee80211_node *, struct mbuf *,
 671                             struct urtw_data *, int);
 672 static int              urtw_newstate(struct ieee80211vap *,
 673                             enum ieee80211_state, int);
 674 static void             urtw_led_ch(void *);
 675 static void             urtw_ledtask(void *, int);
 676 static void             urtw_watchdog(void *);
 677 static void             urtw_set_multi(void *);
 678 static int              urtw_isbmode(uint16_t);
 679 static uint16_t         urtw_rate2rtl(int);
 680 static uint16_t         urtw_rtl2rate(int);
 681 static usb_error_t      urtw_set_rate(struct urtw_softc *);
 682 static usb_error_t      urtw_update_msr(struct urtw_softc *);
 683 static usb_error_t      urtw_read8_c(struct urtw_softc *, int, uint8_t *);
 684 static usb_error_t      urtw_read16_c(struct urtw_softc *, int, uint16_t *);
 685 static usb_error_t      urtw_read32_c(struct urtw_softc *, int, uint32_t *);
 686 static usb_error_t      urtw_write8_c(struct urtw_softc *, int, uint8_t);
 687 static usb_error_t      urtw_write16_c(struct urtw_softc *, int, uint16_t);
 688 static usb_error_t      urtw_write32_c(struct urtw_softc *, int, uint32_t);
 689 static usb_error_t      urtw_eprom_cs(struct urtw_softc *, int);
 690 static usb_error_t      urtw_eprom_ck(struct urtw_softc *);
 691 static usb_error_t      urtw_eprom_sendbits(struct urtw_softc *, int16_t *,
 692                             int);
 693 static usb_error_t      urtw_eprom_read32(struct urtw_softc *, uint32_t,
 694                             uint32_t *);
 695 static usb_error_t      urtw_eprom_readbit(struct urtw_softc *, int16_t *);
 696 static usb_error_t      urtw_eprom_writebit(struct urtw_softc *, int16_t);
 697 static usb_error_t      urtw_get_macaddr(struct urtw_softc *);
 698 static usb_error_t      urtw_get_txpwr(struct urtw_softc *);
 699 static usb_error_t      urtw_get_rfchip(struct urtw_softc *);
 700 static usb_error_t      urtw_led_init(struct urtw_softc *);
 701 static usb_error_t      urtw_8185_rf_pins_enable(struct urtw_softc *);
 702 static usb_error_t      urtw_8185_tx_antenna(struct urtw_softc *, uint8_t);
 703 static usb_error_t      urtw_8187_write_phy(struct urtw_softc *, uint8_t,
 704                             uint32_t);
 705 static usb_error_t      urtw_8187_write_phy_ofdm_c(struct urtw_softc *,
 706                             uint8_t, uint32_t);
 707 static usb_error_t      urtw_8187_write_phy_cck_c(struct urtw_softc *, uint8_t,
 708                             uint32_t);
 709 static usb_error_t      urtw_8225_setgain(struct urtw_softc *, int16_t);
 710 static usb_error_t      urtw_8225_usb_init(struct urtw_softc *);
 711 static usb_error_t      urtw_8225_write_c(struct urtw_softc *, uint8_t,
 712                             uint16_t);
 713 static usb_error_t      urtw_8225_write_s16(struct urtw_softc *, uint8_t, int,
 714                             uint16_t *);
 715 static usb_error_t      urtw_8225_read(struct urtw_softc *, uint8_t,
 716                             uint32_t *);
 717 static usb_error_t      urtw_8225_rf_init(struct urtw_softc *);
 718 static usb_error_t      urtw_8225_rf_set_chan(struct urtw_softc *, int);
 719 static usb_error_t      urtw_8225_rf_set_sens(struct urtw_softc *, int);
 720 static usb_error_t      urtw_8225_set_txpwrlvl(struct urtw_softc *, int);
 721 static usb_error_t      urtw_8225_rf_stop(struct urtw_softc *);
 722 static usb_error_t      urtw_8225v2_rf_init(struct urtw_softc *);
 723 static usb_error_t      urtw_8225v2_rf_set_chan(struct urtw_softc *, int);
 724 static usb_error_t      urtw_8225v2_set_txpwrlvl(struct urtw_softc *, int);
 725 static usb_error_t      urtw_8225v2_setgain(struct urtw_softc *, int16_t);
 726 static usb_error_t      urtw_8225_isv2(struct urtw_softc *, int *);
 727 static usb_error_t      urtw_8225v2b_rf_init(struct urtw_softc *);
 728 static usb_error_t      urtw_8225v2b_rf_set_chan(struct urtw_softc *, int);
 729 static usb_error_t      urtw_read8e(struct urtw_softc *, int, uint8_t *);
 730 static usb_error_t      urtw_write8e(struct urtw_softc *, int, uint8_t);
 731 static usb_error_t      urtw_8180_set_anaparam(struct urtw_softc *, uint32_t);
 732 static usb_error_t      urtw_8185_set_anaparam2(struct urtw_softc *, uint32_t);
 733 static usb_error_t      urtw_intr_enable(struct urtw_softc *);
 734 static usb_error_t      urtw_intr_disable(struct urtw_softc *);
 735 static usb_error_t      urtw_reset(struct urtw_softc *);
 736 static usb_error_t      urtw_led_on(struct urtw_softc *, int);
 737 static usb_error_t      urtw_led_ctl(struct urtw_softc *, int);
 738 static usb_error_t      urtw_led_blink(struct urtw_softc *);
 739 static usb_error_t      urtw_led_mode0(struct urtw_softc *, int);
 740 static usb_error_t      urtw_led_mode1(struct urtw_softc *, int);
 741 static usb_error_t      urtw_led_mode2(struct urtw_softc *, int);
 742 static usb_error_t      urtw_led_mode3(struct urtw_softc *, int);
 743 static usb_error_t      urtw_rx_setconf(struct urtw_softc *);
 744 static usb_error_t      urtw_rx_enable(struct urtw_softc *);
 745 static usb_error_t      urtw_tx_enable(struct urtw_softc *sc);
 746 static void             urtw_free_tx_data_list(struct urtw_softc *);
 747 static void             urtw_free_rx_data_list(struct urtw_softc *);
 748 static void             urtw_free_data_list(struct urtw_softc *,
 749                             struct urtw_data data[], int, int);
 750 static usb_error_t      urtw_adapter_start(struct urtw_softc *);
 751 static usb_error_t      urtw_adapter_start_b(struct urtw_softc *);
 752 static usb_error_t      urtw_set_mode(struct urtw_softc *, uint32_t);
 753 static usb_error_t      urtw_8187b_cmd_reset(struct urtw_softc *);
 754 static usb_error_t      urtw_do_request(struct urtw_softc *,
 755                             struct usb_device_request *, void *);
 756 static usb_error_t      urtw_8225v2b_set_txpwrlvl(struct urtw_softc *, int);
 757 static usb_error_t      urtw_led_off(struct urtw_softc *, int);
 758 static void             urtw_abort_xfers(struct urtw_softc *);
 759 static struct urtw_data *
 760                         urtw_getbuf(struct urtw_softc *sc);
 761 static int              urtw_compute_txtime(uint16_t, uint16_t, uint8_t,
 762                             uint8_t);
 763 static void             urtw_updateslot(struct ifnet *);
 764 static void             urtw_updateslottask(void *, int);
 765 static void             urtw_sysctl_node(struct urtw_softc *);
 766
 767 static int
 768 urtw_match(device_t dev)
 769 {
 770         struct usb_attach_arg *uaa = device_get_ivars(dev);
 771
 772         if (uaa->usb_mode != USB_MODE_HOST)
 773                 return (ENXIO);
 774         if (uaa->info.bConfigIndex != URTW_CONFIG_INDEX)
 775                 return (ENXIO);
 776         if (uaa->info.bIfaceIndex != URTW_IFACE_INDEX)
 777                 return (ENXIO);
 778
 779         return (usbd_lookup_id_by_uaa(urtw_devs, sizeof(urtw_devs), uaa));
 780 }
 781
 782 static int
 783 urtw_attach(device_t dev)
 784 {
 785         const struct usb_config *setup_start;
 786         int ret = ENXIO;
 787         struct urtw_softc *sc = device_get_softc(dev);
 788         struct usb_attach_arg *uaa = device_get_ivars(dev);
 789         struct ieee80211com *ic;
 790         struct ifnet *ifp;
 791         uint8_t bands, iface_index = URTW_IFACE_INDEX;          /* XXX */
 792         uint16_t n_setup;
 793         uint32_t data;
 794         usb_error_t error;
 795
 796         device_set_usb_desc(dev);
 797
 798         sc->sc_dev = dev;
 799         sc->sc_udev = uaa->device;
 800         if (USB_GET_DRIVER_INFO(uaa) == URTW_REV_RTL8187B)
 801                 sc->sc_flags |= URTW_RTL8187B;
 802 #ifdef URTW_DEBUG
 803         sc->sc_debug = urtw_debug;
 804 #endif
 805
 806         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev), MTX_NETWORK_LOCK,
 807             MTX_DEF);
 808         usb_callout_init_mtx(&sc->sc_led_ch, &sc->sc_mtx, 0);
 809         TASK_INIT(&sc->sc_led_task, 0, urtw_ledtask, sc);
 810         TASK_INIT(&sc->sc_updateslot_task, 0, urtw_updateslottask, sc);
 811         callout_init(&sc->sc_watchdog_ch, 0);
 812
 813         if (sc->sc_flags & URTW_RTL8187B) {
 814                 setup_start = urtw_8187b_usbconfig;
 815                 n_setup = URTW_8187B_N_XFERS;
 816         } else {
 817                 setup_start = urtw_8187l_usbconfig;
 818                 n_setup = URTW_8187L_N_XFERS;
 819         }
 820
 821         error = usbd_transfer_setup(uaa->device, &iface_index, sc->sc_xfer,
 822             setup_start, n_setup, sc, &sc->sc_mtx);
 823         if (error) {
 824                 device_printf(dev, "could not allocate USB transfers, "
 825                     "err=%s\n", usbd_errstr(error));
 826                 ret = ENXIO;
 827                 goto fail0;
 828         }
 829
 830         URTW_LOCK(sc);
 831
 832         urtw_read32_m(sc, URTW_RX, &data);
 833         sc->sc_epromtype = (data & URTW_RX_9356SEL) ? URTW_EEPROM_93C56 :
 834             URTW_EEPROM_93C46;
 835
 836         error = urtw_get_rfchip(sc);
 837         if (error != 0)
 838                 goto fail;
 839         error = urtw_get_macaddr(sc);
 840         if (error != 0)
 841                 goto fail;
 842         error = urtw_get_txpwr(sc);
 843         if (error != 0)
 844                 goto fail;
 845         error = urtw_led_init(sc);
 846         if (error != 0)
 847                 goto fail;
 848
 849         URTW_UNLOCK(sc);
 850
 851         sc->sc_rts_retry = URTW_DEFAULT_RTS_RETRY;
 852         sc->sc_tx_retry = URTW_DEFAULT_TX_RETRY;
 853         sc->sc_currate = 3;
 854         sc->sc_preamble_mode = urtw_preamble_mode;
 855
 856         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 857         if (ifp == NULL) {
 858                 device_printf(sc->sc_dev, "can not allocate ifnet\n");
 859                 ret = ENOMEM;
 860                 goto fail1;
 861         }
 862
 863         ifp->if_softc = sc;
 864         if_initname(ifp, "urtw", device_get_unit(sc->sc_dev));
 865         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 866         ifp->if_init = urtw_init;
 867         ifp->if_ioctl = urtw_ioctl;
 868         ifp->if_start = urtw_start;
 869         /* XXX URTW_TX_DATA_LIST_COUNT */
 870         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 871         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 872         IFQ_SET_READY(&ifp->if_snd);
 873
 874         ic = ifp->if_l2com;
 875         ic->ic_ifp = ifp;
 876         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 877         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 878
 879         /* set device capabilities */
 880         ic->ic_caps =
 881             IEEE80211_C_STA |           /* station mode */
 882             IEEE80211_C_MONITOR |       /* monitor mode supported */
 883             IEEE80211_C_TXPMGT |        /* tx power management */
 884             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 885             IEEE80211_C_SHSLOT |        /* short slot time supported */
 886             IEEE80211_C_BGSCAN |        /* capable of bg scanning */
 887             IEEE80211_C_WPA;            /* 802.11i */
 888
 889         bands = 0;
 890         setbit(&bands, IEEE80211_MODE_11B);
 891         setbit(&bands, IEEE80211_MODE_11G);
 892         ieee80211_init_channels(ic, NULL, &bands);
 893
 894         ieee80211_ifattach(ic, sc->sc_bssid);
 895         ic->ic_raw_xmit = urtw_raw_xmit;
 896         ic->ic_scan_start = urtw_scan_start;
 897         ic->ic_scan_end = urtw_scan_end;
 898         ic->ic_set_channel = urtw_set_channel;
 899         ic->ic_updateslot = urtw_updateslot;
 900         ic->ic_vap_create = urtw_vap_create;
 901         ic->ic_vap_delete = urtw_vap_delete;
 902         ic->ic_update_mcast = urtw_update_mcast;
 903
 904         ieee80211_radiotap_attach(ic,
 905             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 906             URTW_TX_RADIOTAP_PRESENT,
 907             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 908             URTW_RX_RADIOTAP_PRESENT);
 909
 910         urtw_sysctl_node(sc);
 911
 912         if (bootverbose)
 913                 ieee80211_announce(ic);
 914         return (0);
 915
 916 fail:   URTW_UNLOCK(sc);
 917 fail1:  usbd_transfer_unsetup(sc->sc_xfer, (sc->sc_flags & URTW_RTL8187B) ?
 918             URTW_8187B_N_XFERS : URTW_8187L_N_XFERS);
 919 fail0:
 920         return (ret);
 921 }
 922
 923 static int
 924 urtw_detach(device_t dev)
 925 {
 926         struct urtw_softc *sc = device_get_softc(dev);
 927         struct ifnet *ifp = sc->sc_ifp;
 928         struct ieee80211com *ic = ifp->if_l2com;
 929
 930         if (!device_is_attached(dev))
 931                 return (0);
 932
 933         urtw_stop(ifp, 1);
 934         ieee80211_draintask(ic, &sc->sc_updateslot_task);
 935         ieee80211_draintask(ic, &sc->sc_led_task);
 936
 937         usb_callout_drain(&sc->sc_led_ch);
 938         callout_drain(&sc->sc_watchdog_ch);
 939
 940         usbd_transfer_unsetup(sc->sc_xfer, (sc->sc_flags & URTW_RTL8187B) ?
 941             URTW_8187B_N_XFERS : URTW_8187L_N_XFERS);
 942         ieee80211_ifdetach(ic);
 943
 944         urtw_free_tx_data_list(sc);
 945         urtw_free_rx_data_list(sc);
 946
 947         if_free(ifp);
 948         mtx_destroy(&sc->sc_mtx);
 949
 950         return (0);
 951 }
 952
 953 static void
 954 urtw_free_tx_data_list(struct urtw_softc *sc)
 955 {
 956
 957         urtw_free_data_list(sc, sc->sc_tx, URTW_TX_DATA_LIST_COUNT, 0);
 958 }
 959
 960 static void
 961 urtw_free_rx_data_list(struct urtw_softc *sc)
 962 {
 963
 964         urtw_free_data_list(sc, sc->sc_rx, URTW_RX_DATA_LIST_COUNT, 1);
 965 }
 966
 967 static void
 968 urtw_free_data_list(struct urtw_softc *sc, struct urtw_data data[], int ndata,
 969     int fillmbuf)
 970 {
 971         int i;
 972
 973         for (i = 0; i < ndata; i++) {
 974                 struct urtw_data *dp = &data[i];
 975
 976                 if (fillmbuf == 1) {
 977                         if (dp->m != NULL) {
 978                                 m_freem(dp->m);
 979                                 dp->m = NULL;
 980                                 dp->buf = NULL;
 981                         }
 982                 } else {
 983                         if (dp->buf != NULL) {
 984                                 free(dp->buf, M_USBDEV);
 985                                 dp->buf = NULL;
 986                         }
 987                 }
 988                 if (dp->ni != NULL) {
 989                         ieee80211_free_node(dp->ni);
 990                         dp->ni = NULL;
 991                 }
 992         }
 993 }
 994
 995 static struct ieee80211vap *
 996 urtw_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 997     enum ieee80211_opmode opmode, int flags,
 998     const uint8_t bssid[IEEE80211_ADDR_LEN],
 999     const uint8_t mac[IEEE80211_ADDR_LEN])
1000 {
1001         struct urtw_vap *uvp;
1002         struct ieee80211vap *vap;
1003
1004         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
1005                 return (NULL);
1006         uvp = (struct urtw_vap *) malloc(sizeof(struct urtw_vap),
1007             M_80211_VAP, M_WAITOK | M_ZERO);
1008         if (uvp == NULL)
1009                 return (NULL);
1010         vap = &uvp->vap;
1011         /* enable s/w bmiss handling for sta mode */
1012         ieee80211_vap_setup(ic, vap, name, unit, opmode,
1013             flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
1014
1015         /* override state transition machine */
1016         uvp->newstate = vap->iv_newstate;
1017         vap->iv_newstate = urtw_newstate;
1018
1019         /* complete setup */
1020         ieee80211_vap_attach(vap, ieee80211_media_change,
1021             ieee80211_media_status);
1022         ic->ic_opmode = opmode;
1023         return (vap);
1024 }
1025
1026 static void
1027 urtw_vap_delete(struct ieee80211vap *vap)
1028 {
1029         struct urtw_vap *uvp = URTW_VAP(vap);
1030
1031         ieee80211_vap_detach(vap);
1032         free(uvp, M_80211_VAP);
1033 }
1034
1035 static void
1036 urtw_init_locked(void *arg)
1037 {
1038         int ret;
1039         struct urtw_softc *sc = arg;
1040         struct ifnet *ifp = sc->sc_ifp;
1041         usb_error_t error;
1042
1043         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1044                 urtw_stop_locked(ifp, 0);
1045
1046         error = (sc->sc_flags & URTW_RTL8187B) ? urtw_adapter_start_b(sc) :
1047             urtw_adapter_start(sc);
1048         if (error != 0)
1049                 goto fail;
1050
1051         /* reset softc variables  */
1052         sc->sc_txtimer = 0;
1053
1054         if (!(sc->sc_flags & URTW_INIT_ONCE)) {
1055                 ret = urtw_alloc_rx_data_list(sc);
1056                 if (ret != 0)
1057                         goto fail;
1058                 ret = urtw_alloc_tx_data_list(sc);
1059                 if (ret != 0)
1060                         goto fail;
1061                 sc->sc_flags |= URTW_INIT_ONCE;
1062         }
1063
1064         error = urtw_rx_enable(sc);
1065         if (error != 0)
1066                 goto fail;
1067         error = urtw_tx_enable(sc);
1068         if (error != 0)
1069                 goto fail;
1070
1071         if (sc->sc_flags & URTW_RTL8187B)
1072                 usbd_transfer_start(sc->sc_xfer[URTW_8187B_BULK_TX_STATUS]);
1073
1074         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1075         ifp->if_drv_flags |= IFF_DRV_RUNNING;
1076
1077         callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1078 fail:
1079         return;
1080 }
1081
1082 static void
1083 urtw_init(void *arg)
1084 {
1085         struct urtw_softc *sc = arg;
1086
1087         URTW_LOCK(sc);
1088         urtw_init_locked(arg);
1089         URTW_UNLOCK(sc);
1090 }
1091
1092 static usb_error_t
1093 urtw_adapter_start_b(struct urtw_softc *sc)
1094 {
1095 #define N(a)    (sizeof(a) / sizeof((a)[0]))
1096         uint8_t data8;
1097         usb_error_t error;
1098
1099         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1100         if (error)
1101                 goto fail;
1102
1103         urtw_read8_m(sc, URTW_CONFIG3, &data8);
1104         urtw_write8_m(sc, URTW_CONFIG3,
1105             data8 | URTW_CONFIG3_ANAPARAM_WRITE | URTW_CONFIG3_GNT_SELECT);
1106         urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8187B_8225_ANAPARAM2_ON);
1107         urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_ON);
1108         urtw_write8_m(sc, URTW_ANAPARAM3, URTW_8187B_8225_ANAPARAM3_ON);
1109
1110         urtw_write8_m(sc, 0x61, 0x10);
1111         urtw_read8_m(sc, 0x62, &data8);
1112         urtw_write8_m(sc, 0x62, data8 & ~(1 << 5));
1113         urtw_write8_m(sc, 0x62, data8 | (1 << 5));
1114
1115         urtw_read8_m(sc, URTW_CONFIG3, &data8);
1116         data8 &= ~URTW_CONFIG3_ANAPARAM_WRITE;
1117         urtw_write8_m(sc, URTW_CONFIG3, data8);
1118
1119         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1120         if (error)
1121                 goto fail;
1122
1123         error = urtw_8187b_cmd_reset(sc);
1124         if (error)
1125                 goto fail;
1126
1127         error = sc->sc_rf_init(sc);
1128         if (error != 0)
1129                 goto fail;
1130         urtw_write8_m(sc, URTW_CMD, URTW_CMD_RX_ENABLE | URTW_CMD_TX_ENABLE);
1131
1132         /* fix RTL8187B RX stall */
1133         error = urtw_intr_enable(sc);
1134         if (error)
1135                 goto fail;
1136
1137         error = urtw_write8e(sc, 0x41, 0xf4);
1138         if (error)
1139                 goto fail;
1140         error = urtw_write8e(sc, 0x40, 0x00);
1141         if (error)
1142                 goto fail;
1143         error = urtw_write8e(sc, 0x42, 0x00);
1144         if (error)
1145                 goto fail;
1146         error = urtw_write8e(sc, 0x42, 0x01);
1147         if (error)
1148                 goto fail;
1149         error = urtw_write8e(sc, 0x40, 0x0f);
1150         if (error)
1151                 goto fail;
1152         error = urtw_write8e(sc, 0x42, 0x00);
1153         if (error)
1154                 goto fail;
1155         error = urtw_write8e(sc, 0x42, 0x01);
1156         if (error)
1157                 goto fail;
1158
1159         urtw_read8_m(sc, 0xdb, &data8);
1160         urtw_write8_m(sc, 0xdb, data8 | (1 << 2));
1161         urtw_write16_m(sc, 0x372, 0x59fa);
1162         urtw_write16_m(sc, 0x374, 0x59d2);
1163         urtw_write16_m(sc, 0x376, 0x59d2);
1164         urtw_write16_m(sc, 0x378, 0x19fa);
1165         urtw_write16_m(sc, 0x37a, 0x19fa);
1166         urtw_write16_m(sc, 0x37c, 0x00d0);
1167         urtw_write8_m(sc, 0x61, 0);
1168
1169         urtw_write8_m(sc, 0x180, 0x0f);
1170         urtw_write8_m(sc, 0x183, 0x03);
1171         urtw_write8_m(sc, 0xda, 0x10);
1172         urtw_write8_m(sc, 0x24d, 0x08);
1173         urtw_write32_m(sc, URTW_HSSI_PARA, 0x0600321b);
1174
1175         urtw_write16_m(sc, 0x1ec, 0x800);       /* RX MAX SIZE */
1176 fail:
1177         return (error);
1178 #undef N
1179 }
1180
1181 static usb_error_t
1182 urtw_adapter_start(struct urtw_softc *sc)
1183 {
1184         usb_error_t error;
1185
1186         error = urtw_reset(sc);
1187         if (error)
1188                 goto fail;
1189
1190         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 0);
1191         urtw_write8_m(sc, URTW_GPIO, 0);
1192
1193         /* for led  */
1194         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 4);
1195         error = urtw_led_ctl(sc, URTW_LED_CTL_POWER_ON);
1196         if (error != 0)
1197                 goto fail;
1198
1199         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1200         if (error)
1201                 goto fail;
1202         /* applying MAC address again.  */
1203         urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)sc->sc_bssid)[0]);
1204         urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)sc->sc_bssid)[1] & 0xffff);
1205         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1206         if (error)
1207                 goto fail;
1208
1209         error = urtw_update_msr(sc);
1210         if (error)
1211                 goto fail;
1212
1213         urtw_write32_m(sc, URTW_INT_TIMEOUT, 0);
1214         urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
1215         urtw_write8_m(sc, URTW_RATE_FALLBACK, URTW_RATE_FALLBACK_ENABLE | 0x1);
1216         error = urtw_set_rate(sc);
1217         if (error != 0)
1218                 goto fail;
1219
1220         error = sc->sc_rf_init(sc);
1221         if (error != 0)
1222                 goto fail;
1223         if (sc->sc_rf_set_sens != NULL)
1224                 sc->sc_rf_set_sens(sc, sc->sc_sens);
1225
1226         /* XXX correct? to call write16  */
1227         urtw_write16_m(sc, URTW_PSR, 1);
1228         urtw_write16_m(sc, URTW_ADDR_MAGIC2, 0x10);
1229         urtw_write8_m(sc, URTW_TALLY_SEL, 0x80);
1230         urtw_write8_m(sc, URTW_ADDR_MAGIC3, 0x60);
1231         /* XXX correct? to call write16  */
1232         urtw_write16_m(sc, URTW_PSR, 0);
1233         urtw_write8_m(sc, URTW_ADDR_MAGIC1, 4);
1234
1235         error = urtw_intr_enable(sc);
1236         if (error != 0)
1237                 goto fail;
1238
1239 fail:
1240         return (error);
1241 }
1242
1243 static usb_error_t
1244 urtw_set_mode(struct urtw_softc *sc, uint32_t mode)
1245 {
1246         uint8_t data;
1247         usb_error_t error;
1248
1249         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
1250         data = (data & ~URTW_EPROM_CMD_MASK) | (mode << URTW_EPROM_CMD_SHIFT);
1251         data = data & ~(URTW_EPROM_CS | URTW_EPROM_CK);
1252         urtw_write8_m(sc, URTW_EPROM_CMD, data);
1253 fail:
1254         return (error);
1255 }
1256
1257 static usb_error_t
1258 urtw_8187b_cmd_reset(struct urtw_softc *sc)
1259 {
1260         int i;
1261         uint8_t data8;
1262         usb_error_t error;
1263
1264         /* XXX the code can be duplicate with urtw_reset().  */
1265         urtw_read8_m(sc, URTW_CMD, &data8);
1266         data8 = (data8 & 0x2) | URTW_CMD_RST;
1267         urtw_write8_m(sc, URTW_CMD, data8);
1268
1269         for (i = 0; i < 20; i++) {
1270                 usb_pause_mtx(&sc->sc_mtx, 2);
1271                 urtw_read8_m(sc, URTW_CMD, &data8);
1272                 if (!(data8 & URTW_CMD_RST))
1273                         break;
1274         }
1275         if (i >= 20) {
1276                 device_printf(sc->sc_dev, "reset timeout\n");
1277                 goto fail;
1278         }
1279 fail:
1280         return (error);
1281 }
1282
1283 static usb_error_t
1284 urtw_do_request(struct urtw_softc *sc,
1285     struct usb_device_request *req, void *data)
1286 {
1287         usb_error_t err;
1288         int ntries = 10;
1289
1290         URTW_ASSERT_LOCKED(sc);
1291
1292         while (ntries--) {
1293                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
1294                     req, data, 0, NULL, 250 /* ms */);
1295                 if (err == 0)
1296                         break;
1297
1298                 DPRINTF(sc, URTW_DEBUG_INIT,
1299                     "Control request failed, %s (retrying)\n",
1300                     usbd_errstr(err));
1301                 usb_pause_mtx(&sc->sc_mtx, hz / 100);
1302         }
1303         return (err);
1304 }
1305
1306 static void
1307 urtw_stop_locked(struct ifnet *ifp, int disable)
1308 {
1309         struct urtw_softc *sc = ifp->if_softc;
1310         uint8_t data8;
1311         usb_error_t error;
1312
1313         (void)disable;
1314         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
1315
1316         error = urtw_intr_disable(sc);
1317         if (error)
1318                 goto fail;
1319         urtw_read8_m(sc, URTW_CMD, &data8);
1320         data8 &= ~(URTW_CMD_RX_ENABLE | URTW_CMD_TX_ENABLE);
1321         urtw_write8_m(sc, URTW_CMD, data8);
1322
1323         error = sc->sc_rf_stop(sc);
1324         if (error != 0)
1325                 goto fail;
1326
1327         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
1328         if (error)
1329                 goto fail;
1330         urtw_read8_m(sc, URTW_CONFIG4, &data8);
1331         urtw_write8_m(sc, URTW_CONFIG4, data8 | URTW_CONFIG4_VCOOFF);
1332         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
1333         if (error)
1334                 goto fail;
1335 fail:
1336         if (error)
1337                 device_printf(sc->sc_dev, "failed to stop (%s)\n",
1338                     usbd_errstr(error));
1339
1340         usb_callout_stop(&sc->sc_led_ch);
1341         callout_stop(&sc->sc_watchdog_ch);
1342
1343         urtw_abort_xfers(sc);
1344 }
1345
1346 static void
1347 urtw_stop(struct ifnet *ifp, int disable)
1348 {
1349         struct urtw_softc *sc = ifp->if_softc;
1350
1351         URTW_LOCK(sc);
1352         urtw_stop_locked(ifp, disable);
1353         URTW_UNLOCK(sc);
1354 }
1355
1356 static void
1357 urtw_abort_xfers(struct urtw_softc *sc)
1358 {
1359         int i, max;
1360
1361         URTW_ASSERT_LOCKED(sc);
1362
1363         max = (sc->sc_flags & URTW_RTL8187B) ? URTW_8187B_N_XFERS :
1364             URTW_8187L_N_XFERS;
1365
1366         /* abort any pending transfers */
1367         for (i = 0; i < max; i++)
1368                 usbd_transfer_stop(sc->sc_xfer[i]);
1369 }
1370
1371 static int
1372 urtw_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1373 {
1374         struct urtw_softc *sc = ifp->if_softc;
1375         struct ieee80211com *ic = ifp->if_l2com;
1376         struct ifreq *ifr = (struct ifreq *) data;
1377         int error = 0, startall = 0;
1378
1379         switch (cmd) {
1380         case SIOCSIFFLAGS:
1381                 if (ifp->if_flags & IFF_UP) {
1382                         if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1383                                 if ((ifp->if_flags ^ sc->sc_if_flags) &
1384                                     (IFF_ALLMULTI | IFF_PROMISC))
1385                                         urtw_set_multi(sc);
1386                         } else {
1387                                 urtw_init(ifp->if_softc);
1388                                 startall = 1;
1389                         }
1390                 } else {
1391                         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1392                                 urtw_stop(ifp, 1);
1393                 }
1394                 sc->sc_if_flags = ifp->if_flags;
1395                 if (startall)
1396                         ieee80211_start_all(ic);
1397                 break;
1398         case SIOCGIFMEDIA:
1399                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1400                 break;
1401         case SIOCGIFADDR:
1402                 error = ether_ioctl(ifp, cmd, data);
1403                 break;
1404         default:
1405                 error = EINVAL;
1406                 break;
1407         }
1408
1409         return (error);
1410 }
1411
1412 static void
1413 urtw_start(struct ifnet *ifp)
1414 {
1415         struct urtw_data *bf;
1416         struct urtw_softc *sc = ifp->if_softc;
1417         struct ieee80211_node *ni;
1418         struct mbuf *m;
1419
1420         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1421                 return;
1422
1423         URTW_LOCK(sc);
1424         for (;;) {
1425                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1426                 if (m == NULL)
1427                         break;
1428                 bf = urtw_getbuf(sc);
1429                 if (bf == NULL) {
1430                         IFQ_DRV_PREPEND(&ifp->if_snd, m);
1431                         break;
1432                 }
1433
1434                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1435                 m->m_pkthdr.rcvif = NULL;
1436
1437                 if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_NORMAL) != 0) {
1438                         ifp->if_oerrors++;
1439                         STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1440                         ieee80211_free_node(ni);
1441                         break;
1442                 }
1443
1444                 sc->sc_txtimer = 5;
1445                 callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1446         }
1447         URTW_UNLOCK(sc);
1448 }
1449
1450 static int
1451 urtw_alloc_data_list(struct urtw_softc *sc, struct urtw_data data[],
1452         int ndata, int maxsz, int fillmbuf)
1453 {
1454         int i, error;
1455
1456         for (i = 0; i < ndata; i++) {
1457                 struct urtw_data *dp = &data[i];
1458
1459                 dp->sc = sc;
1460                 if (fillmbuf) {
1461                         dp->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1462                         if (dp->m == NULL) {
1463                                 device_printf(sc->sc_dev,
1464                                     "could not allocate rx mbuf\n");
1465                                 error = ENOMEM;
1466                                 goto fail;
1467                         }
1468                         dp->buf = mtod(dp->m, uint8_t *);
1469                 } else {
1470                         dp->m = NULL;
1471                         dp->buf = malloc(maxsz, M_USBDEV, M_WAITOK);
1472                         if (dp->buf == NULL) {
1473                                 device_printf(sc->sc_dev,
1474                                     "could not allocate buffer\n");
1475                                 error = ENOMEM;
1476                                 goto fail;
1477                         }
1478                         if (((unsigned long)dp->buf) % 4)
1479                                 device_printf(sc->sc_dev,
1480                                     "warn: unaligned buffer %p\n", dp->buf);
1481                 }
1482                 dp->ni = NULL;
1483         }
1484
1485         return 0;
1486
1487 fail:   urtw_free_data_list(sc, data, ndata, fillmbuf);
1488         return error;
1489 }
1490
1491 static int
1492 urtw_alloc_rx_data_list(struct urtw_softc *sc)
1493 {
1494         int error, i;
1495
1496         error = urtw_alloc_data_list(sc,
1497             sc->sc_rx, URTW_RX_DATA_LIST_COUNT, MCLBYTES, 1 /* mbufs */);
1498         if (error != 0)
1499                 return (error);
1500
1501         STAILQ_INIT(&sc->sc_rx_active);
1502         STAILQ_INIT(&sc->sc_rx_inactive);
1503
1504         for (i = 0; i < URTW_RX_DATA_LIST_COUNT; i++)
1505                 STAILQ_INSERT_HEAD(&sc->sc_rx_inactive, &sc->sc_rx[i], next);
1506
1507         return (0);
1508 }
1509
1510 static int
1511 urtw_alloc_tx_data_list(struct urtw_softc *sc)
1512 {
1513         int error, i;
1514
1515         error = urtw_alloc_data_list(sc,
1516             sc->sc_tx, URTW_TX_DATA_LIST_COUNT, URTW_TX_MAXSIZE,
1517             0 /* no mbufs */);
1518         if (error != 0)
1519                 return (error);
1520
1521         STAILQ_INIT(&sc->sc_tx_active);
1522         STAILQ_INIT(&sc->sc_tx_inactive);
1523         STAILQ_INIT(&sc->sc_tx_pending);
1524
1525         for (i = 0; i < URTW_TX_DATA_LIST_COUNT; i++)
1526                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, &sc->sc_tx[i],
1527                     next);
1528
1529         return (0);
1530 }
1531
1532 static int
1533 urtw_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1534     const struct ieee80211_bpf_params *params)
1535 {
1536         struct ieee80211com *ic = ni->ni_ic;
1537         struct ifnet *ifp = ic->ic_ifp;
1538         struct urtw_data *bf;
1539         struct urtw_softc *sc = ifp->if_softc;
1540
1541         /* prevent management frames from being sent if we're not ready */
1542         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1543                 m_freem(m);
1544                 ieee80211_free_node(ni);
1545                 return ENETDOWN;
1546         }
1547         URTW_LOCK(sc);
1548         bf = urtw_getbuf(sc);
1549         if (bf == NULL) {
1550                 ieee80211_free_node(ni);
1551                 m_freem(m);
1552                 URTW_UNLOCK(sc);
1553                 return (ENOBUFS);               /* XXX */
1554         }
1555
1556         ifp->if_opackets++;
1557         if (urtw_tx_start(sc, ni, m, bf, URTW_PRIORITY_LOW) != 0) {
1558                 ieee80211_free_node(ni);
1559                 ifp->if_oerrors++;
1560                 STAILQ_INSERT_HEAD(&sc->sc_tx_inactive, bf, next);
1561                 URTW_UNLOCK(sc);
1562                 return (EIO);
1563         }
1564         URTW_UNLOCK(sc);
1565
1566         sc->sc_txtimer = 5;
1567         return (0);
1568 }
1569
1570 static void
1571 urtw_scan_start(struct ieee80211com *ic)
1572 {
1573
1574         /* XXX do nothing?  */
1575 }
1576
1577 static void
1578 urtw_scan_end(struct ieee80211com *ic)
1579 {
1580
1581         /* XXX do nothing?  */
1582 }
1583
1584 static void
1585 urtw_set_channel(struct ieee80211com *ic)
1586 {
1587         struct urtw_softc *sc  = ic->ic_ifp->if_softc;
1588         struct ifnet *ifp = sc->sc_ifp;
1589         uint32_t data, orig;
1590         usb_error_t error;
1591
1592         /*
1593          * if the user set a channel explicitly using ifconfig(8) this function
1594          * can be called earlier than we're expected that in some cases the
1595          * initialization would be failed if setting a channel is called before
1596          * the init have done.
1597          */
1598         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING))
1599                 return;
1600
1601         if (sc->sc_curchan != NULL && sc->sc_curchan == ic->ic_curchan)
1602                 return;
1603
1604         URTW_LOCK(sc);
1605
1606         /*
1607          * during changing th channel we need to temporarily be disable
1608          * TX.
1609          */
1610         urtw_read32_m(sc, URTW_TX_CONF, &orig);
1611         data = orig & ~URTW_TX_LOOPBACK_MASK;
1612         urtw_write32_m(sc, URTW_TX_CONF, data | URTW_TX_LOOPBACK_MAC);
1613
1614         error = sc->sc_rf_set_chan(sc, ieee80211_chan2ieee(ic, ic->ic_curchan));
1615         if (error != 0)
1616                 goto fail;
1617         usb_pause_mtx(&sc->sc_mtx, 10);
1618         urtw_write32_m(sc, URTW_TX_CONF, orig);
1619
1620         urtw_write16_m(sc, URTW_ATIM_WND, 2);
1621         urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
1622         urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
1623         urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
1624
1625 fail:
1626         URTW_UNLOCK(sc);
1627
1628         sc->sc_curchan = ic->ic_curchan;
1629
1630         if (error != 0)
1631                 device_printf(sc->sc_dev, "could not change the channel\n");
1632 }
1633
1634 static void
1635 urtw_update_mcast(struct ifnet *ifp)
1636 {
1637
1638         /* XXX do nothing?  */
1639 }
1640
1641 static int
1642 urtw_tx_start(struct urtw_softc *sc, struct ieee80211_node *ni, struct mbuf *m0,
1643     struct urtw_data *data, int prior)
1644 {
1645         struct ifnet *ifp = sc->sc_ifp;
1646         struct ieee80211_frame *wh = mtod(m0, struct ieee80211_frame *);
1647         struct ieee80211_key *k;
1648         const struct ieee80211_txparam *tp;
1649         struct ieee80211com *ic = ifp->if_l2com;
1650         struct ieee80211vap *vap = ni->ni_vap;
1651         struct usb_xfer *rtl8187b_pipes[URTW_8187B_TXPIPE_MAX] = {
1652                 sc->sc_xfer[URTW_8187B_BULK_TX_BE],
1653                 sc->sc_xfer[URTW_8187B_BULK_TX_BK],
1654                 sc->sc_xfer[URTW_8187B_BULK_TX_VI],
1655                 sc->sc_xfer[URTW_8187B_BULK_TX_VO]
1656         };
1657         struct usb_xfer *xfer;
1658         int dur = 0, rtsdur = 0, rtsenable = 0, ctsenable = 0, rate,
1659             pkttime = 0, txdur = 0, isshort = 0, xferlen;
1660         uint16_t acktime, rtstime, ctstime;
1661         uint32_t flags;
1662         usb_error_t error;
1663
1664         URTW_ASSERT_LOCKED(sc);
1665
1666         /*
1667          * Software crypto.
1668          */
1669         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1670                 k = ieee80211_crypto_encap(ni, m0);
1671                 if (k == NULL) {
1672                         device_printf(sc->sc_dev,
1673                             "ieee80211_crypto_encap returns NULL.\n");
1674                         /* XXX we don't expect the fragmented frames  */
1675                         m_freem(m0);
1676                         return (ENOBUFS);
1677                 }
1678
1679                 /* in case packet header moved, reset pointer */
1680                 wh = mtod(m0, struct ieee80211_frame *);
1681         }
1682
1683         if (ieee80211_radiotap_active_vap(vap)) {
1684                 struct urtw_tx_radiotap_header *tap = &sc->sc_txtap;
1685
1686                 /* XXX Are variables correct?  */
1687                 tap->wt_flags = 0;
1688                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1689                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1690
1691                 ieee80211_radiotap_tx(vap, m0);
1692         }
1693
1694         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT ||
1695             (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) {
1696                 tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1697                 rate = tp->mgmtrate;
1698         } else {
1699                 tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1700                 /* for data frames */
1701                 if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1702                         rate = tp->mcastrate;
1703                 else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1704                         rate = tp->ucastrate;
1705                 else
1706                         rate = urtw_rtl2rate(sc->sc_currate);
1707         }
1708
1709         sc->sc_stats.txrates[sc->sc_currate]++;
1710
1711         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1712                 txdur = pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1713                     IEEE80211_CRC_LEN, rate, 0, 0);
1714         else {
1715                 acktime = urtw_compute_txtime(14, 2,0, 0);
1716                 if ((m0->m_pkthdr.len + 4) > vap->iv_rtsthreshold) {
1717                         rtsenable = 1;
1718                         ctsenable = 0;
1719                         rtstime = urtw_compute_txtime(URTW_ACKCTS_LEN, 2, 0, 0);
1720                         ctstime = urtw_compute_txtime(14, 2, 0, 0);
1721                         pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1722                             IEEE80211_CRC_LEN, rate, 0, isshort);
1723                         rtsdur = ctstime + pkttime + acktime +
1724                             3 * URTW_ASIFS_TIME;
1725                         txdur = rtstime + rtsdur;
1726                 } else {
1727                         rtsenable = ctsenable = rtsdur = 0;
1728                         pkttime = urtw_compute_txtime(m0->m_pkthdr.len +
1729                             IEEE80211_CRC_LEN, rate, 0, isshort);
1730                         txdur = pkttime + URTW_ASIFS_TIME + acktime;
1731                 }
1732
1733                 if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
1734                         dur = urtw_compute_txtime(m0->m_pkthdr.len +
1735                             IEEE80211_CRC_LEN, rate, 0, isshort) +
1736                             3 * URTW_ASIFS_TIME +
1737                             2 * acktime;
1738                 else
1739                         dur = URTW_ASIFS_TIME + acktime;
1740         }
1741         *(uint16_t *)wh->i_dur = htole16(dur);
1742
1743         xferlen = m0->m_pkthdr.len;
1744         xferlen += (sc->sc_flags & URTW_RTL8187B) ? (4 * 8) : (4 * 3);
1745         if ((0 == xferlen % 64) || (0 == xferlen % 512))
1746                 xferlen += 1;
1747
1748         memset(data->buf, 0, URTW_TX_MAXSIZE);
1749         flags = m0->m_pkthdr.len & 0xfff;
1750         flags |= URTW_TX_FLAG_NO_ENC;
1751         if ((ic->ic_flags & IEEE80211_F_SHPREAMBLE) &&
1752             (ni->ni_capinfo & IEEE80211_CAPINFO_SHORT_PREAMBLE) &&
1753             (sc->sc_preamble_mode == URTW_PREAMBLE_MODE_SHORT) &&
1754             (sc->sc_currate != 0))
1755                 flags |= URTW_TX_FLAG_SPLCP;
1756         if (wh->i_fc[1] & IEEE80211_FC1_MORE_FRAG)
1757                 flags |= URTW_TX_FLAG_MOREFRAG;
1758
1759         flags |= (sc->sc_currate & 0xf) << URTW_TX_FLAG_TXRATE_SHIFT;
1760
1761         if (sc->sc_flags & URTW_RTL8187B) {
1762                 struct urtw_8187b_txhdr *tx;
1763
1764                 tx = (struct urtw_8187b_txhdr *)data->buf;
1765                 if (ctsenable)
1766                         flags |= URTW_TX_FLAG_CTS;
1767                 if (rtsenable) {
1768                         flags |= URTW_TX_FLAG_RTS;
1769                         flags |= (urtw_rate2rtl(11) & 0xf) <<
1770                             URTW_TX_FLAG_RTSRATE_SHIFT;
1771                         tx->rtsdur = rtsdur;
1772                 }
1773                 tx->flag = htole32(flags);
1774                 tx->txdur = txdur;
1775                 if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1776                     IEEE80211_FC0_TYPE_MGT &&
1777                     (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1778                     IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1779                         tx->retry = 1;
1780                 else
1781                         tx->retry = URTW_TX_MAXRETRY;
1782                 m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(tx + 1));
1783         } else {
1784                 struct urtw_8187l_txhdr *tx;
1785
1786                 tx = (struct urtw_8187l_txhdr *)data->buf;
1787                 if (rtsenable) {
1788                         flags |= URTW_TX_FLAG_RTS;
1789                         tx->rtsdur = rtsdur;
1790                 }
1791                 flags |= (urtw_rate2rtl(11) & 0xf) << URTW_TX_FLAG_RTSRATE_SHIFT;
1792                 tx->flag = htole32(flags);
1793                 tx->retry = 3;          /* CW minimum  */
1794                 tx->retry = 7 << 4;     /* CW maximum  */
1795                 tx->retry = URTW_TX_MAXRETRY << 8;      /* retry limitation  */
1796                 m_copydata(m0, 0, m0->m_pkthdr.len, (uint8_t *)(tx + 1));
1797         }
1798
1799         data->buflen = xferlen;
1800         data->ni = ni;
1801         data->m = m0;
1802
1803         if (sc->sc_flags & URTW_RTL8187B) {
1804                 switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
1805                 case IEEE80211_FC0_TYPE_CTL:
1806                 case IEEE80211_FC0_TYPE_MGT:
1807                         xfer = sc->sc_xfer[URTW_8187B_BULK_TX_EP12];
1808                         break;
1809                 default:
1810                         KASSERT(M_WME_GETAC(m0) < URTW_8187B_TXPIPE_MAX,
1811                             ("unsupported WME pipe %d", M_WME_GETAC(m0)));
1812                         xfer = rtl8187b_pipes[M_WME_GETAC(m0)];
1813                         break;
1814                 }
1815         } else
1816                 xfer = (prior == URTW_PRIORITY_LOW) ?
1817                     sc->sc_xfer[URTW_8187L_BULK_TX_LOW] :
1818                     sc->sc_xfer[URTW_8187L_BULK_TX_NORMAL];
1819
1820         STAILQ_INSERT_TAIL(&sc->sc_tx_pending, data, next);
1821         usbd_transfer_start(xfer);
1822
1823         error = urtw_led_ctl(sc, URTW_LED_CTL_TX);
1824         if (error != 0)
1825                 device_printf(sc->sc_dev, "could not control LED (%d)\n",
1826                     error);
1827         return (0);
1828 }
1829
1830 static int
1831 urtw_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1832 {
1833         struct ieee80211com *ic = vap->iv_ic;
1834         struct urtw_softc *sc = ic->ic_ifp->if_softc;
1835         struct urtw_vap *uvp = URTW_VAP(vap);
1836         struct ieee80211_node *ni;
1837         usb_error_t error = 0;
1838
1839         DPRINTF(sc, URTW_DEBUG_STATE, "%s: %s -> %s\n", __func__,
1840             ieee80211_state_name[vap->iv_state],
1841             ieee80211_state_name[nstate]);
1842
1843         sc->sc_state = nstate;
1844
1845         IEEE80211_UNLOCK(ic);
1846         URTW_LOCK(sc);
1847         usb_callout_stop(&sc->sc_led_ch);
1848         callout_stop(&sc->sc_watchdog_ch);
1849
1850         switch (nstate) {
1851         case IEEE80211_S_INIT:
1852         case IEEE80211_S_SCAN:
1853         case IEEE80211_S_AUTH:
1854         case IEEE80211_S_ASSOC:
1855                 break;
1856         case IEEE80211_S_RUN:
1857                 ni = ieee80211_ref_node(vap->iv_bss);
1858                 /* setting bssid.  */
1859                 urtw_write32_m(sc, URTW_BSSID, ((uint32_t *)ni->ni_bssid)[0]);
1860                 urtw_write16_m(sc, URTW_BSSID + 4,
1861                     ((uint16_t *)ni->ni_bssid)[2]);
1862                 urtw_update_msr(sc);
1863                 /* XXX maybe the below would be incorrect.  */
1864                 urtw_write16_m(sc, URTW_ATIM_WND, 2);
1865                 urtw_write16_m(sc, URTW_ATIM_TR_ITV, 100);
1866                 urtw_write16_m(sc, URTW_BEACON_INTERVAL, 0x64);
1867                 urtw_write16_m(sc, URTW_BEACON_INTERVAL_TIME, 100);
1868                 error = urtw_led_ctl(sc, URTW_LED_CTL_LINK);
1869                 if (error != 0)
1870                         device_printf(sc->sc_dev,
1871                             "could not control LED (%d)\n", error);
1872                 ieee80211_free_node(ni);
1873                 break;
1874         default:
1875                 break;
1876         }
1877 fail:
1878         URTW_UNLOCK(sc);
1879         IEEE80211_LOCK(ic);
1880         return (uvp->newstate(vap, nstate, arg));
1881 }
1882
1883 static void
1884 urtw_watchdog(void *arg)
1885 {
1886         struct urtw_softc *sc = arg;
1887         struct ifnet *ifp = sc->sc_ifp;
1888
1889         if (sc->sc_txtimer > 0) {
1890                 if (--sc->sc_txtimer == 0) {
1891                         device_printf(sc->sc_dev, "device timeout\n");
1892                         ifp->if_oerrors++;
1893                         return;
1894                 }
1895                 callout_reset(&sc->sc_watchdog_ch, hz, urtw_watchdog, sc);
1896         }
1897 }
1898
1899 static void
1900 urtw_set_multi(void *arg)
1901 {
1902         struct urtw_softc *sc = arg;
1903         struct ifnet *ifp = sc->sc_ifp;
1904
1905         if (!(ifp->if_flags & IFF_UP))
1906                 return;
1907
1908         /*
1909          * XXX don't know how to set a device.  Lack of docs.  Just try to set
1910          * IFF_ALLMULTI flag here.
1911          */
1912         ifp->if_flags |= IFF_ALLMULTI;
1913 }
1914
1915 static usb_error_t
1916 urtw_set_rate(struct urtw_softc *sc)
1917 {
1918         int i, basic_rate, min_rr_rate, max_rr_rate;
1919         uint16_t data;
1920         usb_error_t error;
1921
1922         basic_rate = urtw_rate2rtl(48);
1923         min_rr_rate = urtw_rate2rtl(12);
1924         max_rr_rate = urtw_rate2rtl(48);
1925
1926         urtw_write8_m(sc, URTW_RESP_RATE,
1927             max_rr_rate << URTW_RESP_MAX_RATE_SHIFT |
1928             min_rr_rate << URTW_RESP_MIN_RATE_SHIFT);
1929
1930         urtw_read16_m(sc, URTW_BRSR, &data);
1931         data &= ~URTW_BRSR_MBR_8185;
1932
1933         for (i = 0; i <= basic_rate; i++)
1934                 data |= (1 << i);
1935
1936         urtw_write16_m(sc, URTW_BRSR, data);
1937 fail:
1938         return (error);
1939 }
1940
1941 static uint16_t
1942 urtw_rate2rtl(int rate)
1943 {
1944 #define N(a)    (sizeof(a) / sizeof((a)[0]))
1945         int i;
1946
1947         for (i = 0; i < N(urtw_ratetable); i++) {
1948                 if (rate == urtw_ratetable[i].reg)
1949                         return urtw_ratetable[i].val;
1950         }
1951
1952         return (3);
1953 #undef N
1954 }
1955
1956 static uint16_t
1957 urtw_rtl2rate(int rate)
1958 {
1959 #define N(a)    (sizeof(a) / sizeof((a)[0]))
1960         int i;
1961
1962         for (i = 0; i < N(urtw_ratetable); i++) {
1963                 if (rate == urtw_ratetable[i].val)
1964                         return urtw_ratetable[i].reg;
1965         }
1966
1967         return (0);
1968 #undef N
1969 }
1970
1971 static usb_error_t
1972 urtw_update_msr(struct urtw_softc *sc)
1973 {
1974         struct ifnet *ifp = sc->sc_ifp;
1975         struct ieee80211com *ic = ifp->if_l2com;
1976         uint8_t data;
1977         usb_error_t error;
1978
1979         urtw_read8_m(sc, URTW_MSR, &data);
1980         data &= ~URTW_MSR_LINK_MASK;
1981
1982         if (sc->sc_state == IEEE80211_S_RUN) {
1983                 switch (ic->ic_opmode) {
1984                 case IEEE80211_M_STA:
1985                 case IEEE80211_M_MONITOR:
1986                         data |= URTW_MSR_LINK_STA;
1987                         if (sc->sc_flags & URTW_RTL8187B)
1988                                 data |= URTW_MSR_LINK_ENEDCA;
1989                         break;
1990                 case IEEE80211_M_IBSS:
1991                         data |= URTW_MSR_LINK_ADHOC;
1992                         break;
1993                 case IEEE80211_M_HOSTAP:
1994                         data |= URTW_MSR_LINK_HOSTAP;
1995                         break;
1996                 default:
1997                         panic("unsupported operation mode 0x%x\n",
1998                             ic->ic_opmode);
1999                         /* never reach  */
2000                 }
2001         } else
2002                 data |= URTW_MSR_LINK_NONE;
2003
2004         urtw_write8_m(sc, URTW_MSR, data);
2005 fail:
2006         return (error);
2007 }
2008
2009 static usb_error_t
2010 urtw_read8_c(struct urtw_softc *sc, int val, uint8_t *data)
2011 {
2012         struct usb_device_request req;
2013         usb_error_t error;
2014
2015         URTW_ASSERT_LOCKED(sc);
2016
2017         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2018         req.bRequest = URTW_8187_GETREGS_REQ;
2019         USETW(req.wValue, (val & 0xff) | 0xff00);
2020         USETW(req.wIndex, (val >> 8) & 0x3);
2021         USETW(req.wLength, sizeof(uint8_t));
2022
2023         error = urtw_do_request(sc, &req, data);
2024         return (error);
2025 }
2026
2027 static usb_error_t
2028 urtw_read16_c(struct urtw_softc *sc, int val, uint16_t *data)
2029 {
2030         struct usb_device_request req;
2031         usb_error_t error;
2032
2033         URTW_ASSERT_LOCKED(sc);
2034
2035         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2036         req.bRequest = URTW_8187_GETREGS_REQ;
2037         USETW(req.wValue, (val & 0xff) | 0xff00);
2038         USETW(req.wIndex, (val >> 8) & 0x3);
2039         USETW(req.wLength, sizeof(uint16_t));
2040
2041         error = urtw_do_request(sc, &req, data);
2042         return (error);
2043 }
2044
2045 static usb_error_t
2046 urtw_read32_c(struct urtw_softc *sc, int val, uint32_t *data)
2047 {
2048         struct usb_device_request req;
2049         usb_error_t error;
2050
2051         URTW_ASSERT_LOCKED(sc);
2052
2053         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2054         req.bRequest = URTW_8187_GETREGS_REQ;
2055         USETW(req.wValue, (val & 0xff) | 0xff00);
2056         USETW(req.wIndex, (val >> 8) & 0x3);
2057         USETW(req.wLength, sizeof(uint32_t));
2058
2059         error = urtw_do_request(sc, &req, data);
2060         return (error);
2061 }
2062
2063 static usb_error_t
2064 urtw_write8_c(struct urtw_softc *sc, int val, uint8_t data)
2065 {
2066         struct usb_device_request req;
2067
2068         URTW_ASSERT_LOCKED(sc);
2069
2070         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2071         req.bRequest = URTW_8187_SETREGS_REQ;
2072         USETW(req.wValue, (val & 0xff) | 0xff00);
2073         USETW(req.wIndex, (val >> 8) & 0x3);
2074         USETW(req.wLength, sizeof(uint8_t));
2075
2076         return (urtw_do_request(sc, &req, &data));
2077 }
2078
2079 static usb_error_t
2080 urtw_write16_c(struct urtw_softc *sc, int val, uint16_t data)
2081 {
2082         struct usb_device_request req;
2083
2084         URTW_ASSERT_LOCKED(sc);
2085
2086         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2087         req.bRequest = URTW_8187_SETREGS_REQ;
2088         USETW(req.wValue, (val & 0xff) | 0xff00);
2089         USETW(req.wIndex, (val >> 8) & 0x3);
2090         USETW(req.wLength, sizeof(uint16_t));
2091
2092         return (urtw_do_request(sc, &req, &data));
2093 }
2094
2095 static usb_error_t
2096 urtw_write32_c(struct urtw_softc *sc, int val, uint32_t data)
2097 {
2098         struct usb_device_request req;
2099
2100         URTW_ASSERT_LOCKED(sc);
2101
2102         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2103         req.bRequest = URTW_8187_SETREGS_REQ;
2104         USETW(req.wValue, (val & 0xff) | 0xff00);
2105         USETW(req.wIndex, (val >> 8) & 0x3);
2106         USETW(req.wLength, sizeof(uint32_t));
2107
2108         return (urtw_do_request(sc, &req, &data));
2109 }
2110
2111 static usb_error_t
2112 urtw_get_macaddr(struct urtw_softc *sc)
2113 {
2114         uint32_t data;
2115         usb_error_t error;
2116
2117         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR, &data);
2118         if (error != 0)
2119                 goto fail;
2120         sc->sc_bssid[0] = data & 0xff;
2121         sc->sc_bssid[1] = (data & 0xff00) >> 8;
2122         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 1, &data);
2123         if (error != 0)
2124                 goto fail;
2125         sc->sc_bssid[2] = data & 0xff;
2126         sc->sc_bssid[3] = (data & 0xff00) >> 8;
2127         error = urtw_eprom_read32(sc, URTW_EPROM_MACADDR + 2, &data);
2128         if (error != 0)
2129                 goto fail;
2130         sc->sc_bssid[4] = data & 0xff;
2131         sc->sc_bssid[5] = (data & 0xff00) >> 8;
2132 fail:
2133         return (error);
2134 }
2135
2136 static usb_error_t
2137 urtw_eprom_read32(struct urtw_softc *sc, uint32_t addr, uint32_t *data)
2138 {
2139 #define URTW_READCMD_LEN                3
2140         int addrlen, i;
2141         int16_t addrstr[8], data16, readcmd[] = { 1, 1, 0 };
2142         usb_error_t error;
2143
2144         /* NB: make sure the buffer is initialized  */
2145         *data = 0;
2146
2147         /* enable EPROM programming */
2148         urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_PROGRAM_MODE);
2149         DELAY(URTW_EPROM_DELAY);
2150
2151         error = urtw_eprom_cs(sc, URTW_EPROM_ENABLE);
2152         if (error != 0)
2153                 goto fail;
2154         error = urtw_eprom_ck(sc);
2155         if (error != 0)
2156                 goto fail;
2157         error = urtw_eprom_sendbits(sc, readcmd, URTW_READCMD_LEN);
2158         if (error != 0)
2159                 goto fail;
2160         if (sc->sc_epromtype == URTW_EEPROM_93C56) {
2161                 addrlen = 8;
2162                 addrstr[0] = addr & (1 << 7);
2163                 addrstr[1] = addr & (1 << 6);
2164                 addrstr[2] = addr & (1 << 5);
2165                 addrstr[3] = addr & (1 << 4);
2166                 addrstr[4] = addr & (1 << 3);
2167                 addrstr[5] = addr & (1 << 2);
2168                 addrstr[6] = addr & (1 << 1);
2169                 addrstr[7] = addr & (1 << 0);
2170         } else {
2171                 addrlen=6;
2172                 addrstr[0] = addr & (1 << 5);
2173                 addrstr[1] = addr & (1 << 4);
2174                 addrstr[2] = addr & (1 << 3);
2175                 addrstr[3] = addr & (1 << 2);
2176                 addrstr[4] = addr & (1 << 1);
2177                 addrstr[5] = addr & (1 << 0);
2178         }
2179         error = urtw_eprom_sendbits(sc, addrstr, addrlen);
2180         if (error != 0)
2181                 goto fail;
2182
2183         error = urtw_eprom_writebit(sc, 0);
2184         if (error != 0)
2185                 goto fail;
2186
2187         for (i = 0; i < 16; i++) {
2188                 error = urtw_eprom_ck(sc);
2189                 if (error != 0)
2190                         goto fail;
2191                 error = urtw_eprom_readbit(sc, &data16);
2192                 if (error != 0)
2193                         goto fail;
2194
2195                 (*data) |= (data16 << (15 - i));
2196         }
2197
2198         error = urtw_eprom_cs(sc, URTW_EPROM_DISABLE);
2199         if (error != 0)
2200                 goto fail;
2201         error = urtw_eprom_ck(sc);
2202         if (error != 0)
2203                 goto fail;
2204
2205         /* now disable EPROM programming */
2206         urtw_write8_m(sc, URTW_EPROM_CMD, URTW_EPROM_CMD_NORMAL_MODE);
2207 fail:
2208         return (error);
2209 #undef URTW_READCMD_LEN
2210 }
2211
2212 static usb_error_t
2213 urtw_eprom_cs(struct urtw_softc *sc, int able)
2214 {
2215         uint8_t data;
2216         usb_error_t error;
2217
2218         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2219         if (able == URTW_EPROM_ENABLE)
2220                 urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CS);
2221         else
2222                 urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CS);
2223         DELAY(URTW_EPROM_DELAY);
2224 fail:
2225         return (error);
2226 }
2227
2228 static usb_error_t
2229 urtw_eprom_ck(struct urtw_softc *sc)
2230 {
2231         uint8_t data;
2232         usb_error_t error;
2233
2234         /* masking  */
2235         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2236         urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_CK);
2237         DELAY(URTW_EPROM_DELAY);
2238         /* unmasking  */
2239         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2240         urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_CK);
2241         DELAY(URTW_EPROM_DELAY);
2242 fail:
2243         return (error);
2244 }
2245
2246 static usb_error_t
2247 urtw_eprom_readbit(struct urtw_softc *sc, int16_t *data)
2248 {
2249         uint8_t data8;
2250         usb_error_t error;
2251
2252         urtw_read8_m(sc, URTW_EPROM_CMD, &data8);
2253         *data = (data8 & URTW_EPROM_READBIT) ? 1 : 0;
2254         DELAY(URTW_EPROM_DELAY);
2255
2256 fail:
2257         return (error);
2258 }
2259
2260 static usb_error_t
2261 urtw_eprom_writebit(struct urtw_softc *sc, int16_t bit)
2262 {
2263         uint8_t data;
2264         usb_error_t error;
2265
2266         urtw_read8_m(sc, URTW_EPROM_CMD, &data);
2267         if (bit != 0)
2268                 urtw_write8_m(sc, URTW_EPROM_CMD, data | URTW_EPROM_WRITEBIT);
2269         else
2270                 urtw_write8_m(sc, URTW_EPROM_CMD, data & ~URTW_EPROM_WRITEBIT);
2271         DELAY(URTW_EPROM_DELAY);
2272 fail:
2273         return (error);
2274 }
2275
2276 static usb_error_t
2277 urtw_eprom_sendbits(struct urtw_softc *sc, int16_t *buf, int buflen)
2278 {
2279         int i = 0;
2280         usb_error_t error = 0;
2281
2282         for (i = 0; i < buflen; i++) {
2283                 error = urtw_eprom_writebit(sc, buf[i]);
2284                 if (error != 0)
2285                         goto fail;
2286                 error = urtw_eprom_ck(sc);
2287                 if (error != 0)
2288                         goto fail;
2289         }
2290 fail:
2291         return (error);
2292 }
2293
2294
2295 static usb_error_t
2296 urtw_get_txpwr(struct urtw_softc *sc)
2297 {
2298         int i, j;
2299         uint32_t data;
2300         usb_error_t error;
2301
2302         error = urtw_eprom_read32(sc, URTW_EPROM_TXPW_BASE, &data);
2303         if (error != 0)
2304                 goto fail;
2305         sc->sc_txpwr_cck_base = data & 0xf;
2306         sc->sc_txpwr_ofdm_base = (data >> 4) & 0xf;
2307
2308         for (i = 1, j = 0; i < 6; i += 2, j++) {
2309                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW0 + j, &data);
2310                 if (error != 0)
2311                         goto fail;
2312                 sc->sc_txpwr_cck[i] = data & 0xf;
2313                 sc->sc_txpwr_cck[i + 1] = (data & 0xf00) >> 8;
2314                 sc->sc_txpwr_ofdm[i] = (data & 0xf0) >> 4;
2315                 sc->sc_txpwr_ofdm[i + 1] = (data & 0xf000) >> 12;
2316         }
2317         for (i = 1, j = 0; i < 4; i += 2, j++) {
2318                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW1 + j, &data);
2319                 if (error != 0)
2320                         goto fail;
2321                 sc->sc_txpwr_cck[i + 6] = data & 0xf;
2322                 sc->sc_txpwr_cck[i + 6 + 1] = (data & 0xf00) >> 8;
2323                 sc->sc_txpwr_ofdm[i + 6] = (data & 0xf0) >> 4;
2324                 sc->sc_txpwr_ofdm[i + 6 + 1] = (data & 0xf000) >> 12;
2325         }
2326         if (sc->sc_flags & URTW_RTL8187B) {
2327                 error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2, &data);
2328                 if (error != 0)
2329                         goto fail;
2330                 sc->sc_txpwr_cck[1 + 6 + 4] = data & 0xf;
2331                 sc->sc_txpwr_ofdm[1 + 6 + 4] = (data & 0xf0) >> 4;
2332                 error = urtw_eprom_read32(sc, 0x0a, &data);
2333                 if (error != 0)
2334                         goto fail;
2335                 sc->sc_txpwr_cck[2 + 6 + 4] = data & 0xf;
2336                 sc->sc_txpwr_ofdm[2 + 6 + 4] = (data & 0xf0) >> 4;
2337                 error = urtw_eprom_read32(sc, 0x1c, &data);
2338                 if (error != 0)
2339                         goto fail;
2340                 sc->sc_txpwr_cck[3 + 6 + 4] = data & 0xf;
2341                 sc->sc_txpwr_cck[3 + 6 + 4 + 1] = (data & 0xf00) >> 8;
2342                 sc->sc_txpwr_ofdm[3 + 6 + 4] = (data & 0xf0) >> 4;
2343                 sc->sc_txpwr_ofdm[3 + 6 + 4 + 1] = (data & 0xf000) >> 12;
2344         } else {
2345                 for (i = 1, j = 0; i < 4; i += 2, j++) {
2346                         error = urtw_eprom_read32(sc, URTW_EPROM_TXPW2 + j,
2347                             &data);
2348                         if (error != 0)
2349                                 goto fail;
2350                         sc->sc_txpwr_cck[i + 6 + 4] = data & 0xf;
2351                         sc->sc_txpwr_cck[i + 6 + 4 + 1] = (data & 0xf00) >> 8;
2352                         sc->sc_txpwr_ofdm[i + 6 + 4] = (data & 0xf0) >> 4;
2353                         sc->sc_txpwr_ofdm[i + 6 + 4 + 1] = (data & 0xf000) >> 12;
2354                 }
2355         }
2356 fail:
2357         return (error);
2358 }
2359
2360
2361 static usb_error_t
2362 urtw_get_rfchip(struct urtw_softc *sc)
2363 {
2364         int ret;
2365         uint8_t data8;
2366         uint32_t data;
2367         usb_error_t error;
2368
2369         if (sc->sc_flags & URTW_RTL8187B) {
2370                 urtw_read8_m(sc, 0xe1, &data8);
2371                 switch (data8) {
2372                 case 0:
2373                         sc->sc_flags |= URTW_RTL8187B_REV_B;
2374                         break;
2375                 case 1:
2376                         sc->sc_flags |= URTW_RTL8187B_REV_D;
2377                         break;
2378                 case 2:
2379                         sc->sc_flags |= URTW_RTL8187B_REV_E;
2380                         break;
2381                 default:
2382                         device_printf(sc->sc_dev, "unknown type: %#x\n", data8);
2383                         sc->sc_flags |= URTW_RTL8187B_REV_B;
2384                         break;
2385                 }
2386         } else {
2387                 urtw_read32_m(sc, URTW_TX_CONF, &data);
2388                 switch (data & URTW_TX_HWMASK) {
2389                 case URTW_TX_R8187vD_B:
2390                         sc->sc_flags |= URTW_RTL8187B;
2391                         break;
2392                 case URTW_TX_R8187vD:
2393                         break;
2394                 default:
2395                         device_printf(sc->sc_dev, "unknown RTL8187L type: %#x\n",
2396                             data & URTW_TX_HWMASK);
2397                         break;
2398                 }
2399         }
2400
2401         error = urtw_eprom_read32(sc, URTW_EPROM_RFCHIPID, &data);
2402         if (error != 0)
2403                 goto fail;
2404         switch (data & 0xff) {
2405         case URTW_EPROM_RFCHIPID_RTL8225U:
2406                 error = urtw_8225_isv2(sc, &ret);
2407                 if (error != 0)
2408                         goto fail;
2409                 if (ret == 0) {
2410                         sc->sc_rf_init = urtw_8225_rf_init;
2411                         sc->sc_rf_set_sens = urtw_8225_rf_set_sens;
2412                         sc->sc_rf_set_chan = urtw_8225_rf_set_chan;
2413                         sc->sc_rf_stop = urtw_8225_rf_stop;
2414                 } else {
2415                         sc->sc_rf_init = urtw_8225v2_rf_init;
2416                         sc->sc_rf_set_chan = urtw_8225v2_rf_set_chan;
2417                         sc->sc_rf_stop = urtw_8225_rf_stop;
2418                 }
2419                 sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
2420                 sc->sc_sens = URTW_8225_RF_DEF_SENS;
2421                 break;
2422         case URTW_EPROM_RFCHIPID_RTL8225Z2:
2423                 sc->sc_rf_init = urtw_8225v2b_rf_init;
2424                 sc->sc_rf_set_chan = urtw_8225v2b_rf_set_chan;
2425                 sc->sc_max_sens = URTW_8225_RF_MAX_SENS;
2426                 sc->sc_sens = URTW_8225_RF_DEF_SENS;
2427                 sc->sc_rf_stop = urtw_8225_rf_stop;
2428                 break;
2429         default:
2430                 panic("unsupported RF chip %d\n", data & 0xff);
2431                 /* never reach  */
2432         }
2433
2434         device_printf(sc->sc_dev, "%s rf %s hwrev %s\n",
2435             (sc->sc_flags & URTW_RTL8187B) ? "rtl8187b" : "rtl8187l",
2436             ((data & 0xff) == URTW_EPROM_RFCHIPID_RTL8225U) ? "rtl8225u" :
2437             "rtl8225z2",
2438             (sc->sc_flags & URTW_RTL8187B) ? ((data8 == 0) ? "b" :
2439                 (data8 == 1) ? "d" : "e") : "none");
2440
2441 fail:
2442         return (error);
2443 }
2444
2445
2446 static usb_error_t
2447 urtw_led_init(struct urtw_softc *sc)
2448 {
2449         uint32_t rev;
2450         usb_error_t error;
2451
2452         urtw_read8_m(sc, URTW_PSR, &sc->sc_psr);
2453         error = urtw_eprom_read32(sc, URTW_EPROM_SWREV, &rev);
2454         if (error != 0)
2455                 goto fail;
2456
2457         switch (rev & URTW_EPROM_CID_MASK) {
2458         case URTW_EPROM_CID_ALPHA0:
2459                 sc->sc_strategy = URTW_SW_LED_MODE1;
2460                 break;
2461         case URTW_EPROM_CID_SERCOMM_PS:
2462                 sc->sc_strategy = URTW_SW_LED_MODE3;
2463                 break;
2464         case URTW_EPROM_CID_HW_LED:
2465                 sc->sc_strategy = URTW_HW_LED;
2466                 break;
2467         case URTW_EPROM_CID_RSVD0:
2468         case URTW_EPROM_CID_RSVD1:
2469         default:
2470                 sc->sc_strategy = URTW_SW_LED_MODE0;
2471                 break;
2472         }
2473
2474         sc->sc_gpio_ledpin = URTW_LED_PIN_GPIO0;
2475
2476 fail:
2477         return (error);
2478 }
2479
2480
2481 static usb_error_t
2482 urtw_8225_rf_init(struct urtw_softc *sc)
2483 {
2484 #define N(a)    (sizeof(a) / sizeof((a)[0]))
2485         int i;
2486         uint16_t data;
2487         usb_error_t error;
2488
2489         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2490         if (error)
2491                 goto fail;
2492
2493         error = urtw_8225_usb_init(sc);
2494         if (error)
2495                 goto fail;
2496
2497         urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2498         urtw_read16_m(sc, URTW_BRSR, &data);            /* XXX ??? */
2499         urtw_write16_m(sc, URTW_BRSR, 0xffff);
2500         urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2501
2502         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2503         if (error)
2504                 goto fail;
2505         urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2506         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2507         if (error)
2508                 goto fail;
2509
2510         error = urtw_8185_rf_pins_enable(sc);
2511         if (error)
2512                 goto fail;
2513         usb_pause_mtx(&sc->sc_mtx, 1000);
2514
2515         for (i = 0; i < N(urtw_8225_rf_part1); i++) {
2516                 urtw_8225_write(sc, urtw_8225_rf_part1[i].reg,
2517                     urtw_8225_rf_part1[i].val);
2518                 usb_pause_mtx(&sc->sc_mtx, 1);
2519         }
2520         usb_pause_mtx(&sc->sc_mtx, 100);
2521         urtw_8225_write(sc,
2522             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2523         usb_pause_mtx(&sc->sc_mtx, 200);
2524         urtw_8225_write(sc,
2525             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2526         usb_pause_mtx(&sc->sc_mtx, 200);
2527         urtw_8225_write(sc,
2528             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC3);
2529
2530         for (i = 0; i < 95; i++) {
2531                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
2532                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, urtw_8225_rxgain[i]);
2533         }
2534
2535         urtw_8225_write(sc,
2536             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC4);
2537         urtw_8225_write(sc,
2538             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC5);
2539
2540         for (i = 0; i < 128; i++) {
2541                 urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2542                 usb_pause_mtx(&sc->sc_mtx, 1);
2543                 urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2544                 usb_pause_mtx(&sc->sc_mtx, 1);
2545         }
2546
2547         for (i = 0; i < N(urtw_8225_rf_part2); i++) {
2548                 urtw_8187_write_phy_ofdm(sc, urtw_8225_rf_part2[i].reg,
2549                     urtw_8225_rf_part2[i].val);
2550                 usb_pause_mtx(&sc->sc_mtx, 1);
2551         }
2552
2553         error = urtw_8225_setgain(sc, 4);
2554         if (error)
2555                 goto fail;
2556
2557         for (i = 0; i < N(urtw_8225_rf_part3); i++) {
2558                 urtw_8187_write_phy_cck(sc, urtw_8225_rf_part3[i].reg,
2559                     urtw_8225_rf_part3[i].val);
2560                 usb_pause_mtx(&sc->sc_mtx, 1);
2561         }
2562
2563         urtw_write8_m(sc, URTW_TESTR, 0x0d);
2564
2565         error = urtw_8225_set_txpwrlvl(sc, 1);
2566         if (error)
2567                 goto fail;
2568
2569         urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2570         usb_pause_mtx(&sc->sc_mtx, 1);
2571         urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2572         usb_pause_mtx(&sc->sc_mtx, 1);
2573
2574         /* TX ant A, 0x0 for B */
2575         error = urtw_8185_tx_antenna(sc, 0x3);
2576         if (error)
2577                 goto fail;
2578         urtw_write32_m(sc, URTW_HSSI_PARA, 0x3dc00002);
2579
2580         error = urtw_8225_rf_set_chan(sc, 1);
2581 fail:
2582         return (error);
2583 #undef N
2584 }
2585
2586 static usb_error_t
2587 urtw_8185_rf_pins_enable(struct urtw_softc *sc)
2588 {
2589         usb_error_t error = 0;
2590
2591         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1ff7);
2592 fail:
2593         return (error);
2594 }
2595
2596 static usb_error_t
2597 urtw_8185_tx_antenna(struct urtw_softc *sc, uint8_t ant)
2598 {
2599         usb_error_t error;
2600
2601         urtw_write8_m(sc, URTW_TX_ANTENNA, ant);
2602         usb_pause_mtx(&sc->sc_mtx, 1);
2603 fail:
2604         return (error);
2605 }
2606
2607 static usb_error_t
2608 urtw_8187_write_phy_ofdm_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2609 {
2610
2611         data = data & 0xff;
2612         return urtw_8187_write_phy(sc, addr, data);
2613 }
2614
2615 static usb_error_t
2616 urtw_8187_write_phy_cck_c(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2617 {
2618
2619         data = data & 0xff;
2620         return urtw_8187_write_phy(sc, addr, data | 0x10000);
2621 }
2622
2623 static usb_error_t
2624 urtw_8187_write_phy(struct urtw_softc *sc, uint8_t addr, uint32_t data)
2625 {
2626         uint32_t phyw;
2627         usb_error_t error;
2628
2629         phyw = ((data << 8) | (addr | 0x80));
2630         urtw_write8_m(sc, URTW_PHY_MAGIC4, ((phyw & 0xff000000) >> 24));
2631         urtw_write8_m(sc, URTW_PHY_MAGIC3, ((phyw & 0x00ff0000) >> 16));
2632         urtw_write8_m(sc, URTW_PHY_MAGIC2, ((phyw & 0x0000ff00) >> 8));
2633         urtw_write8_m(sc, URTW_PHY_MAGIC1, ((phyw & 0x000000ff)));
2634         usb_pause_mtx(&sc->sc_mtx, 1);
2635 fail:
2636         return (error);
2637 }
2638
2639 static usb_error_t
2640 urtw_8225_setgain(struct urtw_softc *sc, int16_t gain)
2641 {
2642         usb_error_t error;
2643
2644         urtw_8187_write_phy_ofdm(sc, 0x0d, urtw_8225_gain[gain * 4]);
2645         urtw_8187_write_phy_ofdm(sc, 0x1b, urtw_8225_gain[gain * 4 + 2]);
2646         urtw_8187_write_phy_ofdm(sc, 0x1d, urtw_8225_gain[gain * 4 + 3]);
2647         urtw_8187_write_phy_ofdm(sc, 0x23, urtw_8225_gain[gain * 4 + 1]);
2648 fail:
2649         return (error);
2650 }
2651
2652 static usb_error_t
2653 urtw_8225_usb_init(struct urtw_softc *sc)
2654 {
2655         uint8_t data;
2656         usb_error_t error;
2657
2658         urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 0);
2659         urtw_write8_m(sc, URTW_GPIO, 0);
2660         error = urtw_read8e(sc, 0x53, &data);
2661         if (error)
2662                 goto fail;
2663         error = urtw_write8e(sc, 0x53, data | (1 << 7));
2664         if (error)
2665                 goto fail;
2666         urtw_write8_m(sc, URTW_RF_PINS_SELECT + 1, 4);
2667         urtw_write8_m(sc, URTW_GPIO, 0x20);
2668         urtw_write8_m(sc, URTW_GP_ENABLE, 0);
2669
2670         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x80);
2671         urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x80);
2672         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x80);
2673
2674         usb_pause_mtx(&sc->sc_mtx, 500);
2675 fail:
2676         return (error);
2677 }
2678
2679 static usb_error_t
2680 urtw_8225_write_c(struct urtw_softc *sc, uint8_t addr, uint16_t data)
2681 {
2682         uint16_t d80, d82, d84;
2683         usb_error_t error;
2684
2685         urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &d80);
2686         d80 &= URTW_RF_PINS_MAGIC1;
2687         urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &d82);
2688         urtw_read16_m(sc, URTW_RF_PINS_SELECT, &d84);
2689         d84 &= URTW_RF_PINS_MAGIC2;
2690         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, d82 | URTW_RF_PINS_MAGIC3);
2691         urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84 | URTW_RF_PINS_MAGIC3);
2692         DELAY(10);
2693
2694         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2695         DELAY(2);
2696         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80);
2697         DELAY(10);
2698
2699         error = urtw_8225_write_s16(sc, addr, 0x8225, &data);
2700         if (error != 0)
2701                 goto fail;
2702
2703         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2704         DELAY(10);
2705         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, d80 | URTW_BB_HOST_BANG_EN);
2706         urtw_write16_m(sc, URTW_RF_PINS_SELECT, d84);
2707         usb_pause_mtx(&sc->sc_mtx, 2);
2708 fail:
2709         return (error);
2710 }
2711
2712 /* XXX why we should allocalte memory buffer instead of using memory stack?  */
2713 static usb_error_t
2714 urtw_8225_write_s16(struct urtw_softc *sc, uint8_t addr, int index,
2715     uint16_t *data)
2716 {
2717         uint8_t *buf;
2718         uint16_t data16;
2719         struct usb_device_request *req;
2720         usb_error_t error = 0;
2721
2722         data16 = *data;
2723         req = (usb_device_request_t *)malloc(sizeof(usb_device_request_t),
2724             M_80211_VAP, M_WAITOK | M_ZERO);
2725         if (req == NULL) {
2726                 device_printf(sc->sc_dev, "could not allocate a memory\n");
2727                 goto fail0;
2728         }
2729         buf = (uint8_t *)malloc(2, M_80211_VAP, M_WAITOK | M_ZERO);
2730         if (req == NULL) {
2731                 device_printf(sc->sc_dev, "could not allocate a memory\n");
2732                 goto fail1;
2733         }
2734
2735         req->bmRequestType = UT_WRITE_VENDOR_DEVICE;
2736         req->bRequest = URTW_8187_SETREGS_REQ;
2737         USETW(req->wValue, addr);
2738         USETW(req->wIndex, index);
2739         USETW(req->wLength, sizeof(uint16_t));
2740         buf[0] = (data16 & 0x00ff);
2741         buf[1] = (data16 & 0xff00) >> 8;
2742
2743         error = urtw_do_request(sc, req, buf);
2744
2745         free(buf, M_80211_VAP);
2746 fail1:  free(req, M_80211_VAP);
2747 fail0:  return (error);
2748 }
2749
2750 static usb_error_t
2751 urtw_8225_rf_set_chan(struct urtw_softc *sc, int chan)
2752 {
2753         usb_error_t error;
2754
2755         error = urtw_8225_set_txpwrlvl(sc, chan);
2756         if (error)
2757                 goto fail;
2758         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
2759         usb_pause_mtx(&sc->sc_mtx, 10);
2760 fail:
2761         return (error);
2762 }
2763
2764 static usb_error_t
2765 urtw_8225_rf_set_sens(struct urtw_softc *sc, int sens)
2766 {
2767         usb_error_t error;
2768
2769         if (sens < 0 || sens > 6)
2770                 return -1;
2771
2772         if (sens > 4)
2773                 urtw_8225_write(sc,
2774                     URTW_8225_ADDR_C_MAGIC, URTW_8225_ADDR_C_DATA_MAGIC1);
2775         else
2776                 urtw_8225_write(sc,
2777                     URTW_8225_ADDR_C_MAGIC, URTW_8225_ADDR_C_DATA_MAGIC2);
2778
2779         sens = 6 - sens;
2780         error = urtw_8225_setgain(sc, sens);
2781         if (error)
2782                 goto fail;
2783
2784         urtw_8187_write_phy_cck(sc, 0x41, urtw_8225_threshold[sens]);
2785
2786 fail:
2787         return (error);
2788 }
2789
2790 static usb_error_t
2791 urtw_8225_set_txpwrlvl(struct urtw_softc *sc, int chan)
2792 {
2793         int i, idx, set;
2794         uint8_t *cck_pwltable;
2795         uint8_t cck_pwrlvl_max, ofdm_pwrlvl_min, ofdm_pwrlvl_max;
2796         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
2797         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
2798         usb_error_t error;
2799
2800         cck_pwrlvl_max = 11;
2801         ofdm_pwrlvl_max = 25;   /* 12 -> 25  */
2802         ofdm_pwrlvl_min = 10;
2803
2804         /* CCK power setting */
2805         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
2806         idx = cck_pwrlvl % 6;
2807         set = cck_pwrlvl / 6;
2808         cck_pwltable = (chan == 14) ? urtw_8225_txpwr_cck_ch14 :
2809             urtw_8225_txpwr_cck;
2810
2811         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
2812             urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2813         for (i = 0; i < 8; i++) {
2814                 urtw_8187_write_phy_cck(sc, 0x44 + i,
2815                     cck_pwltable[idx * 8 + i]);
2816         }
2817         usb_pause_mtx(&sc->sc_mtx, 1);
2818
2819         /* OFDM power setting */
2820         ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
2821             ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
2822         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
2823
2824         idx = ofdm_pwrlvl % 6;
2825         set = ofdm_pwrlvl / 6;
2826
2827         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
2828         if (error)
2829                 goto fail;
2830         urtw_8187_write_phy_ofdm(sc, 2, 0x42);
2831         urtw_8187_write_phy_ofdm(sc, 6, 0);
2832         urtw_8187_write_phy_ofdm(sc, 8, 0);
2833
2834         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
2835             urtw_8225_tx_gain_cck_ofdm[set] >> 1);
2836         urtw_8187_write_phy_ofdm(sc, 0x5, urtw_8225_txpwr_ofdm[idx]);
2837         urtw_8187_write_phy_ofdm(sc, 0x7, urtw_8225_txpwr_ofdm[idx]);
2838         usb_pause_mtx(&sc->sc_mtx, 1);
2839 fail:
2840         return (error);
2841 }
2842
2843
2844 static usb_error_t
2845 urtw_8225_rf_stop(struct urtw_softc *sc)
2846 {
2847         uint8_t data;
2848         usb_error_t error;
2849
2850         urtw_8225_write(sc, 0x4, 0x1f);
2851
2852         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2853         if (error)
2854                 goto fail;
2855
2856         urtw_read8_m(sc, URTW_CONFIG3, &data);
2857         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
2858         if (sc->sc_flags & URTW_RTL8187B) {
2859                 urtw_write32_m(sc, URTW_ANAPARAM2,
2860                     URTW_8187B_8225_ANAPARAM2_OFF);
2861                 urtw_write32_m(sc, URTW_ANAPARAM, URTW_8187B_8225_ANAPARAM_OFF);
2862                 urtw_write32_m(sc, URTW_ANAPARAM3,
2863                     URTW_8187B_8225_ANAPARAM3_OFF);
2864         } else {
2865                 urtw_write32_m(sc, URTW_ANAPARAM2, URTW_8225_ANAPARAM2_OFF);
2866                 urtw_write32_m(sc, URTW_ANAPARAM, URTW_8225_ANAPARAM_OFF);
2867         }
2868
2869         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
2870         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2871         if (error)
2872                 goto fail;
2873
2874 fail:
2875         return (error);
2876 }
2877
2878 static usb_error_t
2879 urtw_8225v2_rf_init(struct urtw_softc *sc)
2880 {
2881 #define N(a)    (sizeof(a) / sizeof((a)[0]))
2882         int i;
2883         uint16_t data;
2884         uint32_t data32;
2885         usb_error_t error;
2886
2887         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
2888         if (error)
2889                 goto fail;
2890
2891         error = urtw_8225_usb_init(sc);
2892         if (error)
2893                 goto fail;
2894
2895         urtw_write32_m(sc, URTW_RF_TIMING, 0x000a8008);
2896         urtw_read16_m(sc, URTW_BRSR, &data);            /* XXX ??? */
2897         urtw_write16_m(sc, URTW_BRSR, 0xffff);
2898         urtw_write32_m(sc, URTW_RF_PARA, 0x100044);
2899
2900         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
2901         if (error)
2902                 goto fail;
2903         urtw_write8_m(sc, URTW_CONFIG3, 0x44);
2904         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
2905         if (error)
2906                 goto fail;
2907
2908         error = urtw_8185_rf_pins_enable(sc);
2909         if (error)
2910                 goto fail;
2911
2912         usb_pause_mtx(&sc->sc_mtx, 500);
2913
2914         for (i = 0; i < N(urtw_8225v2_rf_part1); i++) {
2915                 urtw_8225_write(sc, urtw_8225v2_rf_part1[i].reg,
2916                     urtw_8225v2_rf_part1[i].val);
2917         }
2918         usb_pause_mtx(&sc->sc_mtx, 50);
2919
2920         urtw_8225_write(sc,
2921             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC1);
2922
2923         for (i = 0; i < 95; i++) {
2924                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
2925                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC,
2926                     urtw_8225v2_rxgain[i]);
2927         }
2928
2929         urtw_8225_write(sc,
2930             URTW_8225_ADDR_3_MAGIC, URTW_8225_ADDR_3_DATA_MAGIC1);
2931         urtw_8225_write(sc,
2932             URTW_8225_ADDR_5_MAGIC, URTW_8225_ADDR_5_DATA_MAGIC1);
2933         urtw_8225_write(sc,
2934             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC2);
2935         urtw_8225_write(sc,
2936             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2937         usb_pause_mtx(&sc->sc_mtx, 100);
2938         urtw_8225_write(sc,
2939             URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2940         usb_pause_mtx(&sc->sc_mtx, 100);
2941
2942         error = urtw_8225_read(sc, URTW_8225_ADDR_6_MAGIC, &data32);
2943         if (error != 0)
2944                 goto fail;
2945         if (data32 != URTW_8225_ADDR_6_DATA_MAGIC1)
2946                 device_printf(sc->sc_dev, "expect 0xe6!! (0x%x)\n", data32);
2947         if (!(data32 & URTW_8225_ADDR_6_DATA_MAGIC2)) {
2948                 urtw_8225_write(sc,
2949                     URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC1);
2950                 usb_pause_mtx(&sc->sc_mtx, 100);
2951                 urtw_8225_write(sc,
2952                     URTW_8225_ADDR_2_MAGIC, URTW_8225_ADDR_2_DATA_MAGIC2);
2953                 usb_pause_mtx(&sc->sc_mtx, 50);
2954                 error = urtw_8225_read(sc, URTW_8225_ADDR_6_MAGIC, &data32);
2955                 if (error != 0)
2956                         goto fail;
2957                 if (!(data32 & URTW_8225_ADDR_6_DATA_MAGIC2))
2958                         device_printf(sc->sc_dev, "RF calibration failed\n");
2959         }
2960         usb_pause_mtx(&sc->sc_mtx, 100);
2961
2962         urtw_8225_write(sc,
2963             URTW_8225_ADDR_0_MAGIC, URTW_8225_ADDR_0_DATA_MAGIC6);
2964         for (i = 0; i < 128; i++) {
2965                 urtw_8187_write_phy_ofdm(sc, 0xb, urtw_8225_agc[i]);
2966                 urtw_8187_write_phy_ofdm(sc, 0xa, (uint8_t)i + 0x80);
2967         }
2968
2969         for (i = 0; i < N(urtw_8225v2_rf_part2); i++) {
2970                 urtw_8187_write_phy_ofdm(sc, urtw_8225v2_rf_part2[i].reg,
2971                     urtw_8225v2_rf_part2[i].val);
2972         }
2973
2974         error = urtw_8225v2_setgain(sc, 4);
2975         if (error)
2976                 goto fail;
2977
2978         for (i = 0; i < N(urtw_8225v2_rf_part3); i++) {
2979                 urtw_8187_write_phy_cck(sc, urtw_8225v2_rf_part3[i].reg,
2980                     urtw_8225v2_rf_part3[i].val);
2981         }
2982
2983         urtw_write8_m(sc, URTW_TESTR, 0x0d);
2984
2985         error = urtw_8225v2_set_txpwrlvl(sc, 1);
2986         if (error)
2987                 goto fail;
2988
2989         urtw_8187_write_phy_cck(sc, 0x10, 0x9b);
2990         urtw_8187_write_phy_ofdm(sc, 0x26, 0x90);
2991
2992         /* TX ant A, 0x0 for B */
2993         error = urtw_8185_tx_antenna(sc, 0x3);
2994         if (error)
2995                 goto fail;
2996         urtw_write32_m(sc, URTW_HSSI_PARA, 0x3dc00002);
2997
2998         error = urtw_8225_rf_set_chan(sc, 1);
2999 fail:
3000         return (error);
3001 #undef N
3002 }
3003
3004 static usb_error_t
3005 urtw_8225v2_rf_set_chan(struct urtw_softc *sc, int chan)
3006 {
3007         usb_error_t error;
3008
3009         error = urtw_8225v2_set_txpwrlvl(sc, chan);
3010         if (error)
3011                 goto fail;
3012
3013         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
3014         usb_pause_mtx(&sc->sc_mtx, 10);
3015 fail:
3016         return (error);
3017 }
3018
3019 static usb_error_t
3020 urtw_8225_read(struct urtw_softc *sc, uint8_t addr, uint32_t *data)
3021 {
3022         int i;
3023         int16_t bit;
3024         uint8_t rlen = 12, wlen = 6;
3025         uint16_t o1, o2, o3, tmp;
3026         uint32_t d2w = ((uint32_t)(addr & 0x1f)) << 27;
3027         uint32_t mask = 0x80000000, value = 0;
3028         usb_error_t error;
3029
3030         urtw_read16_m(sc, URTW_RF_PINS_OUTPUT, &o1);
3031         urtw_read16_m(sc, URTW_RF_PINS_ENABLE, &o2);
3032         urtw_read16_m(sc, URTW_RF_PINS_SELECT, &o3);
3033         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2 | URTW_RF_PINS_MAGIC4);
3034         urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3 | URTW_RF_PINS_MAGIC4);
3035         o1 &= ~URTW_RF_PINS_MAGIC4;
3036         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN);
3037         DELAY(5);
3038         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1);
3039         DELAY(5);
3040
3041         for (i = 0; i < (wlen / 2); i++, mask = mask >> 1) {
3042                 bit = ((d2w & mask) != 0) ? 1 : 0;
3043
3044                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
3045                 DELAY(2);
3046                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3047                     URTW_BB_HOST_BANG_CLK);
3048                 DELAY(2);
3049                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3050                     URTW_BB_HOST_BANG_CLK);
3051                 DELAY(2);
3052                 mask = mask >> 1;
3053                 if (i == 2)
3054                         break;
3055                 bit = ((d2w & mask) != 0) ? 1 : 0;
3056                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3057                     URTW_BB_HOST_BANG_CLK);
3058                 DELAY(2);
3059                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 |
3060                     URTW_BB_HOST_BANG_CLK);
3061                 DELAY(2);
3062                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1);
3063                 DELAY(1);
3064         }
3065         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW |
3066             URTW_BB_HOST_BANG_CLK);
3067         DELAY(2);
3068         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, bit | o1 | URTW_BB_HOST_BANG_RW);
3069         DELAY(2);
3070         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_RW);
3071         DELAY(2);
3072
3073         mask = 0x800;
3074         for (i = 0; i < rlen; i++, mask = mask >> 1) {
3075                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3076                     o1 | URTW_BB_HOST_BANG_RW);
3077                 DELAY(2);
3078                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3079                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3080                 DELAY(2);
3081                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3082                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3083                 DELAY(2);
3084                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3085                     o1 | URTW_BB_HOST_BANG_RW | URTW_BB_HOST_BANG_CLK);
3086                 DELAY(2);
3087
3088                 urtw_read16_m(sc, URTW_RF_PINS_INPUT, &tmp);
3089                 value |= ((tmp & URTW_BB_HOST_BANG_CLK) ? mask : 0);
3090                 urtw_write16_m(sc, URTW_RF_PINS_OUTPUT,
3091                     o1 | URTW_BB_HOST_BANG_RW);
3092                 DELAY(2);
3093         }
3094
3095         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, o1 | URTW_BB_HOST_BANG_EN |
3096             URTW_BB_HOST_BANG_RW);
3097         DELAY(2);
3098
3099         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, o2);
3100         urtw_write16_m(sc, URTW_RF_PINS_SELECT, o3);
3101         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, URTW_RF_PINS_OUTPUT_MAGIC1);
3102
3103         if (data != NULL)
3104                 *data = value;
3105 fail:
3106         return (error);
3107 }
3108
3109
3110 static usb_error_t
3111 urtw_8225v2_set_txpwrlvl(struct urtw_softc *sc, int chan)
3112 {
3113         int i;
3114         uint8_t *cck_pwrtable;
3115         uint8_t cck_pwrlvl_max = 15, ofdm_pwrlvl_max = 25, ofdm_pwrlvl_min = 10;
3116         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3117         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3118         usb_error_t error;
3119
3120         /* CCK power setting */
3121         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ? cck_pwrlvl_max : cck_pwrlvl;
3122         cck_pwrlvl += sc->sc_txpwr_cck_base;
3123         cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3124         cck_pwrtable = (chan == 14) ? urtw_8225v2_txpwr_cck_ch14 :
3125             urtw_8225v2_txpwr_cck;
3126
3127         for (i = 0; i < 8; i++)
3128                 urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3129
3130         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3131             urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl]);
3132         usb_pause_mtx(&sc->sc_mtx, 1);
3133
3134         /* OFDM power setting */
3135         ofdm_pwrlvl = (ofdm_pwrlvl > (ofdm_pwrlvl_max - ofdm_pwrlvl_min)) ?
3136                 ofdm_pwrlvl_max : ofdm_pwrlvl + ofdm_pwrlvl_min;
3137         ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3138         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3139
3140         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3141         if (error)
3142                 goto fail;
3143
3144         urtw_8187_write_phy_ofdm(sc, 2, 0x42);
3145         urtw_8187_write_phy_ofdm(sc, 5, 0x0);
3146         urtw_8187_write_phy_ofdm(sc, 6, 0x40);
3147         urtw_8187_write_phy_ofdm(sc, 7, 0x0);
3148         urtw_8187_write_phy_ofdm(sc, 8, 0x40);
3149
3150         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3151             urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl]);
3152         usb_pause_mtx(&sc->sc_mtx, 1);
3153 fail:
3154         return (error);
3155 }
3156
3157 static usb_error_t
3158 urtw_8225v2_setgain(struct urtw_softc *sc, int16_t gain)
3159 {
3160         uint8_t *gainp;
3161         usb_error_t error;
3162
3163         /* XXX for A?  */
3164         gainp = urtw_8225v2_gain_bg;
3165         urtw_8187_write_phy_ofdm(sc, 0x0d, gainp[gain * 3]);
3166         usb_pause_mtx(&sc->sc_mtx, 1);
3167         urtw_8187_write_phy_ofdm(sc, 0x1b, gainp[gain * 3 + 1]);
3168         usb_pause_mtx(&sc->sc_mtx, 1);
3169         urtw_8187_write_phy_ofdm(sc, 0x1d, gainp[gain * 3 + 2]);
3170         usb_pause_mtx(&sc->sc_mtx, 1);
3171         urtw_8187_write_phy_ofdm(sc, 0x21, 0x17);
3172         usb_pause_mtx(&sc->sc_mtx, 1);
3173 fail:
3174         return (error);
3175 }
3176
3177 static usb_error_t
3178 urtw_8225_isv2(struct urtw_softc *sc, int *ret)
3179 {
3180         uint32_t data;
3181         usb_error_t error;
3182
3183         *ret = 1;
3184
3185         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, URTW_RF_PINS_MAGIC5);
3186         urtw_write16_m(sc, URTW_RF_PINS_SELECT, URTW_RF_PINS_MAGIC5);
3187         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, URTW_RF_PINS_MAGIC5);
3188         usb_pause_mtx(&sc->sc_mtx, 500);
3189
3190         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC,
3191             URTW_8225_ADDR_0_DATA_MAGIC1);
3192
3193         error = urtw_8225_read(sc, URTW_8225_ADDR_8_MAGIC, &data);
3194         if (error != 0)
3195                 goto fail;
3196         if (data != URTW_8225_ADDR_8_DATA_MAGIC1)
3197                 *ret = 0;
3198         else {
3199                 error = urtw_8225_read(sc, URTW_8225_ADDR_9_MAGIC, &data);
3200                 if (error != 0)
3201                         goto fail;
3202                 if (data != URTW_8225_ADDR_9_DATA_MAGIC1)
3203                         *ret = 0;
3204         }
3205
3206         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC,
3207             URTW_8225_ADDR_0_DATA_MAGIC2);
3208 fail:
3209         return (error);
3210 }
3211
3212 static usb_error_t
3213 urtw_8225v2b_rf_init(struct urtw_softc *sc)
3214 {
3215 #define N(a)    (sizeof(a) / sizeof((a)[0]))
3216         int i;
3217         uint8_t data8;
3218         usb_error_t error;
3219
3220         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3221         if (error)
3222                 goto fail;
3223
3224         /*
3225          * initialize extra registers on 8187
3226          */
3227         urtw_write16_m(sc, URTW_BRSR_8187B, 0xfff);
3228
3229         /* retry limit */
3230         urtw_read8_m(sc, URTW_CW_CONF, &data8);
3231         data8 |= URTW_CW_CONF_PERPACKET_RETRY;
3232         urtw_write8_m(sc, URTW_CW_CONF, data8);
3233
3234         /* TX AGC */
3235         urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
3236         data8 |= URTW_TX_AGC_CTL_PERPACKET_GAIN;
3237         urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
3238
3239         /* Auto Rate Fallback Control */
3240 #define URTW_ARFR       0x1e0
3241         urtw_write16_m(sc, URTW_ARFR, 0xfff);
3242         urtw_read8_m(sc, URTW_RATE_FALLBACK, &data8);
3243         urtw_write8_m(sc, URTW_RATE_FALLBACK,
3244             data8 | URTW_RATE_FALLBACK_ENABLE);
3245
3246         urtw_read8_m(sc, URTW_MSR, &data8);
3247         urtw_write8_m(sc, URTW_MSR, data8 & 0xf3);
3248         urtw_read8_m(sc, URTW_MSR, &data8);
3249         urtw_write8_m(sc, URTW_MSR, data8 | URTW_MSR_LINK_ENEDCA);
3250         urtw_write8_m(sc, URTW_ACM_CONTROL, sc->sc_acmctl);
3251
3252         urtw_write16_m(sc, URTW_ATIM_WND, 2);
3253         urtw_write16_m(sc, URTW_BEACON_INTERVAL, 100);
3254 #define URTW_FEMR_FOR_8187B     0x1d4
3255         urtw_write16_m(sc, URTW_FEMR_FOR_8187B, 0xffff);
3256
3257         /* led type */
3258         urtw_read8_m(sc, URTW_CONFIG1, &data8);
3259         data8 = (data8 & 0x3f) | 0x80;
3260         urtw_write8_m(sc, URTW_CONFIG1, data8);
3261
3262         /* applying MAC address again.  */
3263         urtw_write32_m(sc, URTW_MAC0, ((uint32_t *)sc->sc_bssid)[0]);
3264         urtw_write16_m(sc, URTW_MAC4, ((uint32_t *)sc->sc_bssid)[1] & 0xffff);
3265
3266         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3267         if (error)
3268                 goto fail;
3269
3270         urtw_write8_m(sc, URTW_WPA_CONFIG, 0);
3271
3272         /*
3273          * MAC configuration
3274          */
3275         for (i = 0; i < N(urtw_8225v2b_rf_part1); i++)
3276                 urtw_write8_m(sc, urtw_8225v2b_rf_part1[i].reg,
3277                     urtw_8225v2b_rf_part1[i].val);
3278         urtw_write16_m(sc, URTW_TID_AC_MAP, 0xfa50);
3279         urtw_write16_m(sc, URTW_INT_MIG, 0x0000);
3280         urtw_write32_m(sc, 0x1f0, 0);
3281         urtw_write32_m(sc, 0x1f4, 0);
3282         urtw_write8_m(sc, 0x1f8, 0);
3283         urtw_write32_m(sc, URTW_RF_TIMING, 0x4001);
3284
3285 #define URTW_RFSW_CTRL  0x272
3286         urtw_write16_m(sc, URTW_RFSW_CTRL, 0x569a);
3287
3288         /*
3289          * initialize PHY
3290          */
3291         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3292         if (error)
3293                 goto fail;
3294         urtw_read8_m(sc, URTW_CONFIG3, &data8);
3295         urtw_write8_m(sc, URTW_CONFIG3,
3296             data8 | URTW_CONFIG3_ANAPARAM_WRITE);
3297
3298         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3299         if (error)
3300                 goto fail;
3301
3302         /* setup RFE initial timing */
3303         urtw_write16_m(sc, URTW_RF_PINS_OUTPUT, 0x0480);
3304         urtw_write16_m(sc, URTW_RF_PINS_SELECT, 0x2488);
3305         urtw_write16_m(sc, URTW_RF_PINS_ENABLE, 0x1fff);
3306         usb_pause_mtx(&sc->sc_mtx, 1100);
3307
3308         for (i = 0; i < N(urtw_8225v2b_rf_part0); i++) {
3309                 urtw_8225_write(sc, urtw_8225v2b_rf_part0[i].reg,
3310                     urtw_8225v2b_rf_part0[i].val);
3311                 usb_pause_mtx(&sc->sc_mtx, 1);
3312         }
3313         urtw_8225_write(sc, 0x00, 0x01b7);
3314
3315         for (i = 0; i < 95; i++) {
3316                 urtw_8225_write(sc, URTW_8225_ADDR_1_MAGIC, (uint8_t)(i + 1));
3317                 usb_pause_mtx(&sc->sc_mtx, 1);
3318                 urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC,
3319                     urtw_8225v2b_rxgain[i]);
3320                 usb_pause_mtx(&sc->sc_mtx, 1);
3321         }
3322
3323         urtw_8225_write(sc, URTW_8225_ADDR_3_MAGIC, 0x080);
3324         usb_pause_mtx(&sc->sc_mtx, 1);
3325         urtw_8225_write(sc, URTW_8225_ADDR_5_MAGIC, 0x004);
3326         usb_pause_mtx(&sc->sc_mtx, 1);
3327         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC, 0x0b7);
3328         usb_pause_mtx(&sc->sc_mtx, 1);
3329         usb_pause_mtx(&sc->sc_mtx, 3000);
3330         urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, 0xc4d);
3331         usb_pause_mtx(&sc->sc_mtx, 2000);
3332         urtw_8225_write(sc, URTW_8225_ADDR_2_MAGIC, 0x44d);
3333         usb_pause_mtx(&sc->sc_mtx, 1);
3334         urtw_8225_write(sc, URTW_8225_ADDR_0_MAGIC, 0x2bf);
3335         usb_pause_mtx(&sc->sc_mtx, 1);
3336
3337         urtw_write8_m(sc, URTW_TX_GAIN_CCK, 0x03);
3338         urtw_write8_m(sc, URTW_TX_GAIN_OFDM, 0x07);
3339         urtw_write8_m(sc, URTW_TX_ANTENNA, 0x03);
3340
3341         urtw_8187_write_phy_ofdm(sc, 0x80, 0x12);
3342         for (i = 0; i < 128; i++) {
3343                 uint32_t addr, data;
3344
3345                 data = (urtw_8225z2_agc[i] << 8) | 0x0000008f;
3346                 addr = ((i + 0x80) << 8) | 0x0000008e;
3347
3348                 urtw_8187_write_phy_ofdm(sc, data & 0x7f, (data >> 8) & 0xff);
3349                 urtw_8187_write_phy_ofdm(sc, addr & 0x7f, (addr >> 8) & 0xff);
3350                 urtw_8187_write_phy_ofdm(sc, 0x0e, 0x00);
3351         }
3352         urtw_8187_write_phy_ofdm(sc, 0x80, 0x10);
3353
3354         for (i = 0; i < N(urtw_8225v2b_rf_part2); i++)
3355                 urtw_8187_write_phy_ofdm(sc, i, urtw_8225v2b_rf_part2[i].val);
3356
3357         urtw_write32_m(sc, URTW_8187B_AC_VO, (7 << 12) | (3 << 8) | 0x1c);
3358         urtw_write32_m(sc, URTW_8187B_AC_VI, (7 << 12) | (3 << 8) | 0x1c);
3359         urtw_write32_m(sc, URTW_8187B_AC_BE, (7 << 12) | (3 << 8) | 0x1c);
3360         urtw_write32_m(sc, URTW_8187B_AC_BK, (7 << 12) | (3 << 8) | 0x1c);
3361
3362         urtw_8187_write_phy_ofdm(sc, 0x97, 0x46);
3363         urtw_8187_write_phy_ofdm(sc, 0xa4, 0xb6);
3364         urtw_8187_write_phy_ofdm(sc, 0x85, 0xfc);
3365         urtw_8187_write_phy_cck(sc, 0xc1, 0x88);
3366
3367 fail:
3368         return (error);
3369 #undef N
3370 }
3371
3372 static usb_error_t
3373 urtw_8225v2b_rf_set_chan(struct urtw_softc *sc, int chan)
3374 {
3375         usb_error_t error;
3376
3377         error = urtw_8225v2b_set_txpwrlvl(sc, chan);
3378         if (error)
3379                 goto fail;
3380
3381         urtw_8225_write(sc, URTW_8225_ADDR_7_MAGIC, urtw_8225_channel[chan]);
3382         usb_pause_mtx(&sc->sc_mtx, 10);
3383 fail:
3384         return (error);
3385 }
3386
3387 static usb_error_t
3388 urtw_8225v2b_set_txpwrlvl(struct urtw_softc *sc, int chan)
3389 {
3390         int i;
3391         uint8_t *cck_pwrtable;
3392         uint8_t cck_pwrlvl_max = 15;
3393         uint8_t cck_pwrlvl = sc->sc_txpwr_cck[chan] & 0xff;
3394         uint8_t ofdm_pwrlvl = sc->sc_txpwr_ofdm[chan] & 0xff;
3395         usb_error_t error;
3396
3397         /* CCK power setting */
3398         cck_pwrlvl = (cck_pwrlvl > cck_pwrlvl_max) ?
3399             ((sc->sc_flags & URTW_RTL8187B_REV_B) ? cck_pwrlvl_max : 22) :
3400             (cck_pwrlvl + ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 0 : 7));
3401         cck_pwrlvl += sc->sc_txpwr_cck_base;
3402         cck_pwrlvl = (cck_pwrlvl > 35) ? 35 : cck_pwrlvl;
3403         cck_pwrtable = (chan == 14) ? urtw_8225v2b_txpwr_cck_ch14 :
3404             urtw_8225v2b_txpwr_cck;
3405
3406         if (sc->sc_flags & URTW_RTL8187B_REV_B)
3407                 cck_pwrtable += (cck_pwrlvl <= 6) ? 0 :
3408                     ((cck_pwrlvl <= 11) ? 8 : 16);
3409         else
3410                 cck_pwrtable += (cck_pwrlvl <= 5) ? 0 :
3411                     ((cck_pwrlvl <= 11) ? 8 : ((cck_pwrlvl <= 17) ? 16 : 24));
3412
3413         for (i = 0; i < 8; i++)
3414                 urtw_8187_write_phy_cck(sc, 0x44 + i, cck_pwrtable[i]);
3415
3416         urtw_write8_m(sc, URTW_TX_GAIN_CCK,
3417             urtw_8225v2_tx_gain_cck_ofdm[cck_pwrlvl] << 1);
3418         usb_pause_mtx(&sc->sc_mtx, 1);
3419
3420         /* OFDM power setting */
3421         ofdm_pwrlvl = (ofdm_pwrlvl > 15) ?
3422             ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 17 : 25) :
3423             (ofdm_pwrlvl + ((sc->sc_flags & URTW_RTL8187B_REV_B) ? 2 : 10));
3424         ofdm_pwrlvl += sc->sc_txpwr_ofdm_base;
3425         ofdm_pwrlvl = (ofdm_pwrlvl > 35) ? 35 : ofdm_pwrlvl;
3426
3427         urtw_write8_m(sc, URTW_TX_GAIN_OFDM,
3428             urtw_8225v2_tx_gain_cck_ofdm[ofdm_pwrlvl] << 1);
3429
3430         if (sc->sc_flags & URTW_RTL8187B_REV_B) {
3431                 if (ofdm_pwrlvl <= 11) {
3432                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x60);
3433                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x60);
3434                 } else {
3435                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3436                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3437                 }
3438         } else {
3439                 if (ofdm_pwrlvl <= 11) {
3440                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x5c);
3441                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x5c);
3442                 } else if (ofdm_pwrlvl <= 17) {
3443                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x54);
3444                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x54);
3445                 } else {
3446                         urtw_8187_write_phy_ofdm(sc, 0x87, 0x50);
3447                         urtw_8187_write_phy_ofdm(sc, 0x89, 0x50);
3448                 }
3449         }
3450         usb_pause_mtx(&sc->sc_mtx, 1);
3451 fail:
3452         return (error);
3453 }
3454
3455 static usb_error_t
3456 urtw_read8e(struct urtw_softc *sc, int val, uint8_t *data)
3457 {
3458         struct usb_device_request req;
3459         usb_error_t error;
3460
3461         req.bmRequestType = UT_READ_VENDOR_DEVICE;
3462         req.bRequest = URTW_8187_GETREGS_REQ;
3463         USETW(req.wValue, val | 0xfe00);
3464         USETW(req.wIndex, 0);
3465         USETW(req.wLength, sizeof(uint8_t));
3466
3467         error = urtw_do_request(sc, &req, data);
3468         return (error);
3469 }
3470
3471 static usb_error_t
3472 urtw_write8e(struct urtw_softc *sc, int val, uint8_t data)
3473 {
3474         struct usb_device_request req;
3475
3476         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
3477         req.bRequest = URTW_8187_SETREGS_REQ;
3478         USETW(req.wValue, val | 0xfe00);
3479         USETW(req.wIndex, 0);
3480         USETW(req.wLength, sizeof(uint8_t));
3481
3482         return (urtw_do_request(sc, &req, &data));
3483 }
3484
3485 static usb_error_t
3486 urtw_8180_set_anaparam(struct urtw_softc *sc, uint32_t val)
3487 {
3488         uint8_t data;
3489         usb_error_t error;
3490
3491         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3492         if (error)
3493                 goto fail;
3494
3495         urtw_read8_m(sc, URTW_CONFIG3, &data);
3496         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3497         urtw_write32_m(sc, URTW_ANAPARAM, val);
3498         urtw_read8_m(sc, URTW_CONFIG3, &data);
3499         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3500
3501         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3502         if (error)
3503                 goto fail;
3504 fail:
3505         return (error);
3506 }
3507
3508 static usb_error_t
3509 urtw_8185_set_anaparam2(struct urtw_softc *sc, uint32_t val)
3510 {
3511         uint8_t data;
3512         usb_error_t error;
3513
3514         error = urtw_set_mode(sc, URTW_EPROM_CMD_CONFIG);
3515         if (error)
3516                 goto fail;
3517
3518         urtw_read8_m(sc, URTW_CONFIG3, &data);
3519         urtw_write8_m(sc, URTW_CONFIG3, data | URTW_CONFIG3_ANAPARAM_WRITE);
3520         urtw_write32_m(sc, URTW_ANAPARAM2, val);
3521         urtw_read8_m(sc, URTW_CONFIG3, &data);
3522         urtw_write8_m(sc, URTW_CONFIG3, data & ~URTW_CONFIG3_ANAPARAM_WRITE);
3523
3524         error = urtw_set_mode(sc, URTW_EPROM_CMD_NORMAL);
3525         if (error)
3526                 goto fail;
3527 fail:
3528         return (error);
3529 }
3530
3531 static usb_error_t
3532 urtw_intr_enable(struct urtw_softc *sc)
3533 {
3534         usb_error_t error;
3535
3536         urtw_write16_m(sc, URTW_INTR_MASK, 0xffff);
3537 fail:
3538         return (error);
3539 }
3540
3541 static usb_error_t
3542 urtw_intr_disable(struct urtw_softc *sc)
3543 {
3544         usb_error_t error;
3545
3546         urtw_write16_m(sc, URTW_INTR_MASK, 0);
3547 fail:
3548         return (error);
3549 }
3550
3551 static usb_error_t
3552 urtw_reset(struct urtw_softc *sc)
3553 {
3554         uint8_t data;
3555         usb_error_t error;
3556
3557         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3558         if (error)
3559                 goto fail;
3560         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3561         if (error)
3562                 goto fail;
3563
3564         error = urtw_intr_disable(sc);
3565         if (error)
3566                 goto fail;
3567         usb_pause_mtx(&sc->sc_mtx, 100);
3568
3569         error = urtw_write8e(sc, 0x18, 0x10);
3570         if (error != 0)
3571                 goto fail;
3572         error = urtw_write8e(sc, 0x18, 0x11);
3573         if (error != 0)
3574                 goto fail;
3575         error = urtw_write8e(sc, 0x18, 0x00);
3576         if (error != 0)
3577                 goto fail;
3578         usb_pause_mtx(&sc->sc_mtx, 100);
3579
3580         urtw_read8_m(sc, URTW_CMD, &data);
3581         data = (data & 0x2) | URTW_CMD_RST;
3582         urtw_write8_m(sc, URTW_CMD, data);
3583         usb_pause_mtx(&sc->sc_mtx, 100);
3584
3585         urtw_read8_m(sc, URTW_CMD, &data);
3586         if (data & URTW_CMD_RST) {
3587                 device_printf(sc->sc_dev, "reset timeout\n");
3588                 goto fail;
3589         }
3590
3591         error = urtw_set_mode(sc, URTW_EPROM_CMD_LOAD);
3592         if (error)
3593                 goto fail;
3594         usb_pause_mtx(&sc->sc_mtx, 100);
3595
3596         error = urtw_8180_set_anaparam(sc, URTW_8225_ANAPARAM_ON);
3597         if (error)
3598                 goto fail;
3599         error = urtw_8185_set_anaparam2(sc, URTW_8225_ANAPARAM2_ON);
3600         if (error)
3601                 goto fail;
3602 fail:
3603         return (error);
3604 }
3605
3606 static usb_error_t
3607 urtw_led_ctl(struct urtw_softc *sc, int mode)
3608 {
3609         usb_error_t error = 0;
3610
3611         switch (sc->sc_strategy) {
3612         case URTW_SW_LED_MODE0:
3613                 error = urtw_led_mode0(sc, mode);
3614                 break;
3615         case URTW_SW_LED_MODE1:
3616                 error = urtw_led_mode1(sc, mode);
3617                 break;
3618         case URTW_SW_LED_MODE2:
3619                 error = urtw_led_mode2(sc, mode);
3620                 break;
3621         case URTW_SW_LED_MODE3:
3622                 error = urtw_led_mode3(sc, mode);
3623                 break;
3624         default:
3625                 panic("unsupported LED mode %d\n", sc->sc_strategy);
3626                 /* never reach  */
3627         }
3628
3629         return (error);
3630 }
3631
3632 static usb_error_t
3633 urtw_led_mode0(struct urtw_softc *sc, int mode)
3634 {
3635
3636         switch (mode) {
3637         case URTW_LED_CTL_POWER_ON:
3638                 sc->sc_gpio_ledstate = URTW_LED_POWER_ON_BLINK;
3639                 break;
3640         case URTW_LED_CTL_TX:
3641                 if (sc->sc_gpio_ledinprogress == 1)
3642                         return (0);
3643
3644                 sc->sc_gpio_ledstate = URTW_LED_BLINK_NORMAL;
3645                 sc->sc_gpio_blinktime = 2;
3646                 break;
3647         case URTW_LED_CTL_LINK:
3648                 sc->sc_gpio_ledstate = URTW_LED_ON;
3649                 break;
3650         default:
3651                 panic("unsupported LED mode 0x%x", mode);
3652                 /* never reach  */
3653         }
3654
3655         switch (sc->sc_gpio_ledstate) {
3656         case URTW_LED_ON:
3657                 if (sc->sc_gpio_ledinprogress != 0)
3658                         break;
3659                 urtw_led_on(sc, URTW_LED_GPIO);
3660                 break;
3661         case URTW_LED_BLINK_NORMAL:
3662                 if (sc->sc_gpio_ledinprogress != 0)
3663                         break;
3664                 sc->sc_gpio_ledinprogress = 1;
3665                 sc->sc_gpio_blinkstate = (sc->sc_gpio_ledon != 0) ?
3666                         URTW_LED_OFF : URTW_LED_ON;
3667                 usb_callout_reset(&sc->sc_led_ch, hz, urtw_led_ch, sc);
3668                 break;
3669         case URTW_LED_POWER_ON_BLINK:
3670                 urtw_led_on(sc, URTW_LED_GPIO);
3671                 usb_pause_mtx(&sc->sc_mtx, 100);
3672                 urtw_led_off(sc, URTW_LED_GPIO);
3673                 break;
3674         default:
3675                 panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
3676                 /* never reach  */
3677         }
3678         return (0);
3679 }
3680
3681 static usb_error_t
3682 urtw_led_mode1(struct urtw_softc *sc, int mode)
3683 {
3684
3685         return (USB_ERR_INVAL);
3686 }
3687
3688 static usb_error_t
3689 urtw_led_mode2(struct urtw_softc *sc, int mode)
3690 {
3691
3692         return (USB_ERR_INVAL);
3693 }
3694
3695 static usb_error_t
3696 urtw_led_mode3(struct urtw_softc *sc, int mode)
3697 {
3698
3699         return (USB_ERR_INVAL);
3700 }
3701
3702 static usb_error_t
3703 urtw_led_on(struct urtw_softc *sc, int type)
3704 {
3705         usb_error_t error;
3706
3707         if (type == URTW_LED_GPIO) {
3708                 switch (sc->sc_gpio_ledpin) {
3709                 case URTW_LED_PIN_GPIO0:
3710                         urtw_write8_m(sc, URTW_GPIO, 0x01);
3711                         urtw_write8_m(sc, URTW_GP_ENABLE, 0x00);
3712                         break;
3713                 default:
3714                         panic("unsupported LED PIN type 0x%x",
3715                             sc->sc_gpio_ledpin);
3716                         /* never reach  */
3717                 }
3718         } else {
3719                 panic("unsupported LED type 0x%x", type);
3720                 /* never reach  */
3721         }
3722
3723         sc->sc_gpio_ledon = 1;
3724 fail:
3725         return (error);
3726 }
3727
3728 static usb_error_t
3729 urtw_led_off(struct urtw_softc *sc, int type)
3730 {
3731         usb_error_t error;
3732
3733         if (type == URTW_LED_GPIO) {
3734                 switch (sc->sc_gpio_ledpin) {
3735                 case URTW_LED_PIN_GPIO0:
3736                         urtw_write8_m(sc, URTW_GPIO, URTW_GPIO_DATA_MAGIC1);
3737                         urtw_write8_m(sc,
3738                             URTW_GP_ENABLE, URTW_GP_ENABLE_DATA_MAGIC1);
3739                         break;
3740                 default:
3741                         panic("unsupported LED PIN type 0x%x",
3742                             sc->sc_gpio_ledpin);
3743                         /* never reach  */
3744                 }
3745         } else {
3746                 panic("unsupported LED type 0x%x", type);
3747                 /* never reach  */
3748         }
3749
3750         sc->sc_gpio_ledon = 0;
3751
3752 fail:
3753         return (error);
3754 }
3755
3756 static void
3757 urtw_led_ch(void *arg)
3758 {
3759         struct urtw_softc *sc = arg;
3760         struct ifnet *ifp = sc->sc_ifp;
3761         struct ieee80211com *ic = ifp->if_l2com;
3762
3763         ieee80211_runtask(ic, &sc->sc_led_task);
3764 }
3765
3766 static void
3767 urtw_ledtask(void *arg, int pending)
3768 {
3769         struct urtw_softc *sc = arg;
3770
3771         if (sc->sc_strategy != URTW_SW_LED_MODE0)
3772                 panic("could not process a LED strategy 0x%x", sc->sc_strategy);
3773
3774         URTW_LOCK(sc);
3775         urtw_led_blink(sc);
3776         URTW_UNLOCK(sc);
3777 }
3778
3779 static usb_error_t
3780 urtw_led_blink(struct urtw_softc *sc)
3781 {
3782         uint8_t ing = 0;
3783         usb_error_t error;
3784
3785         if (sc->sc_gpio_blinkstate == URTW_LED_ON)
3786                 error = urtw_led_on(sc, URTW_LED_GPIO);
3787         else
3788                 error = urtw_led_off(sc, URTW_LED_GPIO);
3789         sc->sc_gpio_blinktime--;
3790         if (sc->sc_gpio_blinktime == 0)
3791                 ing = 1;
3792         else {
3793                 if (sc->sc_gpio_ledstate != URTW_LED_BLINK_NORMAL &&
3794                     sc->sc_gpio_ledstate != URTW_LED_BLINK_SLOWLY &&
3795                     sc->sc_gpio_ledstate != URTW_LED_BLINK_CM3)
3796                         ing = 1;
3797         }
3798         if (ing == 1) {
3799                 if (sc->sc_gpio_ledstate == URTW_LED_ON &&
3800                     sc->sc_gpio_ledon == 0)
3801                         error = urtw_led_on(sc, URTW_LED_GPIO);
3802                 else if (sc->sc_gpio_ledstate == URTW_LED_OFF &&
3803                     sc->sc_gpio_ledon == 1)
3804                         error = urtw_led_off(sc, URTW_LED_GPIO);
3805
3806                 sc->sc_gpio_blinktime = 0;
3807                 sc->sc_gpio_ledinprogress = 0;
3808                 return (0);
3809         }
3810
3811         sc->sc_gpio_blinkstate = (sc->sc_gpio_blinkstate != URTW_LED_ON) ?
3812             URTW_LED_ON : URTW_LED_OFF;
3813
3814         switch (sc->sc_gpio_ledstate) {
3815         case URTW_LED_BLINK_NORMAL:
3816                 usb_callout_reset(&sc->sc_led_ch, hz, urtw_led_ch, sc);
3817                 break;
3818         default:
3819                 panic("unknown LED status 0x%x", sc->sc_gpio_ledstate);
3820                 /* never reach  */
3821         }
3822         return (0);
3823 }
3824
3825 static usb_error_t
3826 urtw_rx_enable(struct urtw_softc *sc)
3827 {
3828         uint8_t data;
3829         usb_error_t error;
3830
3831         usbd_transfer_start((sc->sc_flags & URTW_RTL8187B) ?
3832             sc->sc_xfer[URTW_8187B_BULK_RX] : sc->sc_xfer[URTW_8187L_BULK_RX]);
3833
3834         error = urtw_rx_setconf(sc);
3835         if (error != 0)
3836                 goto fail;
3837
3838         if ((sc->sc_flags & URTW_RTL8187B) == 0) {
3839                 urtw_read8_m(sc, URTW_CMD, &data);
3840                 urtw_write8_m(sc, URTW_CMD, data | URTW_CMD_RX_ENABLE);
3841         }
3842 fail:
3843         return (error);
3844 }
3845
3846 static usb_error_t
3847 urtw_tx_enable(struct urtw_softc *sc)
3848 {
3849         uint8_t data8;
3850         uint32_t data;
3851         usb_error_t error;
3852
3853         if (sc->sc_flags & URTW_RTL8187B) {
3854                 urtw_read32_m(sc, URTW_TX_CONF, &data);
3855                 data &= ~URTW_TX_LOOPBACK_MASK;
3856                 data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
3857                 data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
3858                 data &= ~URTW_TX_SWPLCPLEN;
3859                 data |= URTW_TX_HW_SEQNUM | URTW_TX_DISREQQSIZE |
3860                     (7 << 8) |  /* short retry limit */
3861                     (7 << 0) |  /* long retry limit */
3862                     (7 << 21);  /* MAX TX DMA */
3863                 urtw_write32_m(sc, URTW_TX_CONF, data);
3864
3865                 urtw_read8_m(sc, URTW_MSR, &data8);
3866                 data8 |= URTW_MSR_LINK_ENEDCA;
3867                 urtw_write8_m(sc, URTW_MSR, data8);
3868                 return (error);
3869         }
3870
3871         urtw_read8_m(sc, URTW_CW_CONF, &data8);
3872         data8 &= ~(URTW_CW_CONF_PERPACKET_CW | URTW_CW_CONF_PERPACKET_RETRY);
3873         urtw_write8_m(sc, URTW_CW_CONF, data8);
3874
3875         urtw_read8_m(sc, URTW_TX_AGC_CTL, &data8);
3876         data8 &= ~URTW_TX_AGC_CTL_PERPACKET_GAIN;
3877         data8 &= ~URTW_TX_AGC_CTL_PERPACKET_ANTSEL;
3878         data8 &= ~URTW_TX_AGC_CTL_FEEDBACK_ANT;
3879         urtw_write8_m(sc, URTW_TX_AGC_CTL, data8);
3880
3881         urtw_read32_m(sc, URTW_TX_CONF, &data);
3882         data &= ~URTW_TX_LOOPBACK_MASK;
3883         data |= URTW_TX_LOOPBACK_NONE;
3884         data &= ~(URTW_TX_DPRETRY_MASK | URTW_TX_RTSRETRY_MASK);
3885         data |= sc->sc_tx_retry << URTW_TX_DPRETRY_SHIFT;
3886         data |= sc->sc_rts_retry << URTW_TX_RTSRETRY_SHIFT;
3887         data &= ~(URTW_TX_NOCRC | URTW_TX_MXDMA_MASK);
3888         data |= URTW_TX_MXDMA_2048 | URTW_TX_CWMIN | URTW_TX_DISCW;
3889         data &= ~URTW_TX_SWPLCPLEN;
3890         data |= URTW_TX_NOICV;
3891         urtw_write32_m(sc, URTW_TX_CONF, data);
3892
3893         urtw_read8_m(sc, URTW_CMD, &data8);
3894         urtw_write8_m(sc, URTW_CMD, data8 | URTW_CMD_TX_ENABLE);
3895 fail:
3896         return (error);
3897 }
3898
3899 static usb_error_t
3900 urtw_rx_setconf(struct urtw_softc *sc)
3901 {
3902         struct ifnet *ifp = sc->sc_ifp;
3903         struct ieee80211com *ic = ifp->if_l2com;
3904         uint32_t data;
3905         usb_error_t error;
3906
3907         urtw_read32_m(sc, URTW_RX, &data);
3908         data = data &~ URTW_RX_FILTER_MASK;
3909         if (sc->sc_flags & URTW_RTL8187B) {
3910                 data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA |
3911                     URTW_RX_FILTER_MCAST | URTW_RX_FILTER_BCAST |
3912                     URTW_RX_FILTER_NICMAC | URTW_RX_CHECK_BSSID |
3913                     URTW_RX_FIFO_THRESHOLD_NONE |
3914                     URTW_MAX_RX_DMA_2048 |
3915                     URTW_RX_AUTORESETPHY | URTW_RCR_ONLYERLPKT;
3916         } else {
3917                 data = data | URTW_RX_FILTER_MNG | URTW_RX_FILTER_DATA;
3918                 data = data | URTW_RX_FILTER_BCAST | URTW_RX_FILTER_MCAST;
3919
3920                 if (ic->ic_opmode == IEEE80211_M_MONITOR) {
3921                         data = data | URTW_RX_FILTER_ICVERR;
3922                         data = data | URTW_RX_FILTER_PWR;
3923                 }
3924                 if (sc->sc_crcmon == 1 && ic->ic_opmode == IEEE80211_M_MONITOR)
3925                         data = data | URTW_RX_FILTER_CRCERR;
3926
3927                 if (ic->ic_opmode == IEEE80211_M_MONITOR ||
3928                     (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
3929                         data = data | URTW_RX_FILTER_ALLMAC;
3930                 } else {
3931                         data = data | URTW_RX_FILTER_NICMAC;
3932                         data = data | URTW_RX_CHECK_BSSID;
3933                 }
3934
3935                 data = data &~ URTW_RX_FIFO_THRESHOLD_MASK;
3936                 data = data | URTW_RX_FIFO_THRESHOLD_NONE |
3937                     URTW_RX_AUTORESETPHY;
3938                 data = data &~ URTW_MAX_RX_DMA_MASK;
3939                 data = data | URTW_MAX_RX_DMA_2048 | URTW_RCR_ONLYERLPKT;
3940         }
3941
3942         urtw_write32_m(sc, URTW_RX, data);
3943 fail:
3944         return (error);
3945 }
3946
3947 static struct mbuf *
3948 urtw_rxeof(struct usb_xfer *xfer, struct urtw_data *data, int *rssi_p,
3949     int8_t *nf_p)
3950 {
3951         int actlen, flen, rssi;
3952         struct ieee80211_frame *wh;
3953         struct mbuf *m, *mnew;
3954         struct urtw_softc *sc = data->sc;
3955         struct ifnet *ifp = sc->sc_ifp;
3956         struct ieee80211com *ic = ifp->if_l2com;
3957         uint8_t noise = 0, rate;
3958
3959         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
3960
3961         if (actlen < URTW_MIN_RXBUFSZ) {
3962                 ifp->if_ierrors++;
3963                 return (NULL);
3964         }
3965
3966         if (sc->sc_flags & URTW_RTL8187B) {
3967                 struct urtw_8187b_rxhdr *rx;
3968
3969                 rx = (struct urtw_8187b_rxhdr *)(data->buf +
3970                     (actlen - (sizeof(struct urtw_8187b_rxhdr))));
3971                 flen = le32toh(rx->flag) & 0xfff;
3972                 if (flen > actlen) {
3973                         ifp->if_ierrors++;
3974                         return (NULL);
3975                 }
3976                 rate = (le32toh(rx->flag) >> URTW_RX_FLAG_RXRATE_SHIFT) & 0xf;
3977                 /* XXX correct? */
3978                 rssi = rx->rssi & URTW_RX_RSSI_MASK;
3979                 noise = rx->noise;
3980         } else {
3981                 struct urtw_8187l_rxhdr *rx;
3982
3983                 rx = (struct urtw_8187l_rxhdr *)(data->buf +
3984                     (actlen - (sizeof(struct urtw_8187l_rxhdr))));
3985                 flen = le32toh(rx->flag) & 0xfff;
3986                 if (flen > actlen) {
3987                         ifp->if_ierrors++;
3988                         return (NULL);
3989                 }
3990
3991                 rate = (le32toh(rx->flag) >> URTW_RX_FLAG_RXRATE_SHIFT) & 0xf;
3992                 /* XXX correct? */
3993                 rssi = rx->rssi & URTW_RX_8187L_RSSI_MASK;
3994                 noise = rx->noise;
3995         }
3996
3997         mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
3998         if (mnew == NULL) {
3999                 ifp->if_ierrors++;
4000                 return (NULL);
4001         }
4002
4003         m = data->m;
4004         data->m = mnew;
4005         data->buf = mtod(mnew, uint8_t *);
4006
4007         /* finalize mbuf */
4008         m->m_pkthdr.rcvif = ifp;
4009         m->m_pkthdr.len = m->m_len = flen - IEEE80211_CRC_LEN;
4010
4011         if (ieee80211_radiotap_active(ic)) {
4012                 struct urtw_rx_radiotap_header *tap = &sc->sc_rxtap;
4013
4014                 /* XXX Are variables correct?  */
4015                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
4016                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
4017                 tap->wr_dbm_antsignal = (int8_t)rssi;
4018         }
4019
4020         wh = mtod(m, struct ieee80211_frame *);
4021         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_DATA)
4022                 sc->sc_currate = (rate > 0) ? rate : sc->sc_currate;
4023
4024         *rssi_p = rssi;
4025         *nf_p = noise;          /* XXX correct? */
4026
4027         return (m);
4028 }
4029
4030 static void
4031 urtw_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
4032 {
4033         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4034         struct ifnet *ifp = sc->sc_ifp;
4035         struct ieee80211com *ic = ifp->if_l2com;
4036         struct ieee80211_frame *wh;
4037         struct ieee80211_node *ni;
4038         struct mbuf *m = NULL;
4039         struct urtw_data *data;
4040         int8_t nf = -95;
4041         int rssi = 1;
4042
4043         URTW_ASSERT_LOCKED(sc);
4044
4045         switch (USB_GET_STATE(xfer)) {
4046         case USB_ST_TRANSFERRED:
4047                 data = STAILQ_FIRST(&sc->sc_rx_active);
4048                 if (data == NULL)
4049                         goto setup;
4050                 STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
4051                 m = urtw_rxeof(xfer, data, &rssi, &nf);
4052                 STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
4053                 /* FALLTHROUGH */
4054         case USB_ST_SETUP:
4055 setup:
4056                 data = STAILQ_FIRST(&sc->sc_rx_inactive);
4057                 if (data == NULL) {
4058                         KASSERT(m == NULL, ("mbuf isn't NULL"));
4059                         return;
4060                 }
4061                 STAILQ_REMOVE_HEAD(&sc->sc_rx_inactive, next);
4062                 STAILQ_INSERT_TAIL(&sc->sc_rx_active, data, next);
4063                 usbd_xfer_set_frame_data(xfer, 0, data->buf,
4064                     usbd_xfer_max_len(xfer));
4065                 usbd_transfer_submit(xfer);
4066
4067                 /*
4068                  * To avoid LOR we should unlock our private mutex here to call
4069                  * ieee80211_input() because here is at the end of a USB
4070                  * callback and safe to unlock.
4071                  */
4072                 URTW_UNLOCK(sc);
4073                 if (m != NULL) {
4074                         wh = mtod(m, struct ieee80211_frame *);
4075                         ni = ieee80211_find_rxnode(ic,
4076                             (struct ieee80211_frame_min *)wh);
4077                         if (ni != NULL) {
4078                                 (void) ieee80211_input(ni, m, rssi, nf);
4079                                 /* node is no longer needed */
4080                                 ieee80211_free_node(ni);
4081                         } else
4082                                 (void) ieee80211_input_all(ic, m, rssi, nf);
4083                         m = NULL;
4084                 }
4085                 URTW_LOCK(sc);
4086                 break;
4087         default:
4088                 /* needs it to the inactive queue due to a error.  */
4089                 data = STAILQ_FIRST(&sc->sc_rx_active);
4090                 if (data != NULL) {
4091                         STAILQ_REMOVE_HEAD(&sc->sc_rx_active, next);
4092                         STAILQ_INSERT_TAIL(&sc->sc_rx_inactive, data, next);
4093                 }
4094                 if (error != USB_ERR_CANCELLED) {
4095                         usbd_xfer_set_stall(xfer);
4096                         ifp->if_ierrors++;
4097                         goto setup;
4098                 }
4099                 break;
4100         }
4101 }
4102
4103 #define URTW_STATUS_TYPE_TXCLOSE        1
4104 #define URTW_STATUS_TYPE_BEACON_INTR    0
4105
4106 static void
4107 urtw_txstatus_eof(struct usb_xfer *xfer)
4108 {
4109         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4110         struct ifnet *ifp = sc->sc_ifp;
4111         int actlen, type, pktretry, seq;
4112         uint64_t val;
4113
4114         usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
4115
4116         if (actlen != sizeof(uint64_t))
4117                 return;
4118
4119         val = le64toh(sc->sc_txstatus);
4120         type = (val >> 30) & 0x3;
4121         if (type == URTW_STATUS_TYPE_TXCLOSE) {
4122                 pktretry = val & 0xff;
4123                 seq = (val >> 16) & 0xff;
4124                 if (pktretry == URTW_TX_MAXRETRY)
4125                         ifp->if_oerrors++;
4126                 DPRINTF(sc, URTW_DEBUG_TXSTATUS, "pktretry %d seq %#x\n",
4127                     pktretry, seq);
4128         }
4129 }
4130
4131 static void
4132 urtw_bulk_tx_status_callback(struct usb_xfer *xfer, usb_error_t error)
4133 {
4134         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4135         struct ifnet *ifp = sc->sc_ifp;
4136
4137         URTW_ASSERT_LOCKED(sc);
4138
4139         switch (USB_GET_STATE(xfer)) {
4140         case USB_ST_TRANSFERRED:
4141                 urtw_txstatus_eof(xfer);
4142                 /* FALLTHROUGH */
4143         case USB_ST_SETUP:
4144 setup:
4145                 usbd_xfer_set_frame_data(xfer, 0, &sc->sc_txstatus,
4146                     sizeof(int64_t));
4147                 usbd_transfer_submit(xfer);
4148                 break;
4149         default:
4150                 if (error != USB_ERR_CANCELLED) {
4151                         usbd_xfer_set_stall(xfer);
4152                         ifp->if_ierrors++;
4153                         goto setup;
4154                 }
4155                 break;
4156         }
4157 }
4158
4159 static void
4160 urtw_txeof(struct usb_xfer *xfer, struct urtw_data *data)
4161 {
4162         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4163         struct ifnet *ifp = sc->sc_ifp;
4164         struct mbuf *m;
4165
4166         URTW_ASSERT_LOCKED(sc);
4167
4168         /*
4169          * Do any tx complete callback.  Note this must be done before releasing
4170          * the node reference.
4171          */
4172         if (data->m) {
4173                 m = data->m;
4174                 if (m->m_flags & M_TXCB) {
4175                         /* XXX status? */
4176                         ieee80211_process_callback(data->ni, m, 0);
4177                 }
4178                 m_freem(m);
4179                 data->m = NULL;
4180         }
4181         if (data->ni) {
4182                 ieee80211_free_node(data->ni);
4183                 data->ni = NULL;
4184         }
4185         sc->sc_txtimer = 0;
4186         ifp->if_opackets++;
4187         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
4188 }
4189
4190 static void
4191 urtw_bulk_tx_callback(struct usb_xfer *xfer, usb_error_t error)
4192 {
4193         struct urtw_softc *sc = usbd_xfer_softc(xfer);
4194         struct ifnet *ifp = sc->sc_ifp;
4195         struct urtw_data *data;
4196
4197         URTW_ASSERT_LOCKED(sc);
4198
4199         switch (USB_GET_STATE(xfer)) {
4200         case USB_ST_TRANSFERRED:
4201                 data = STAILQ_FIRST(&sc->sc_tx_active);
4202                 if (data == NULL)
4203                         goto setup;
4204                 STAILQ_REMOVE_HEAD(&sc->sc_tx_active, next);
4205                 urtw_txeof(xfer, data);
4206                 STAILQ_INSERT_TAIL(&sc->sc_tx_inactive, data, next);
4207                 /* FALLTHROUGH */
4208         case USB_ST_SETUP:
4209 setup:
4210                 data = STAILQ_FIRST(&sc->sc_tx_pending);
4211                 if (data == NULL) {
4212                         DPRINTF(sc, URTW_DEBUG_XMIT,
4213                             "%s: empty pending queue\n", __func__);
4214                         return;
4215                 }
4216                 STAILQ_REMOVE_HEAD(&sc->sc_tx_pending, next);
4217                 STAILQ_INSERT_TAIL(&sc->sc_tx_active, data, next);
4218
4219                 usbd_xfer_set_frame_data(xfer, 0, data->buf, data->buflen);
4220                 usbd_transfer_submit(xfer);
4221
4222                 URTW_UNLOCK(sc);
4223                 urtw_start(ifp);
4224                 URTW_LOCK(sc);
4225                 break;
4226         default:
4227                 data = STAILQ_FIRST(&sc->sc_tx_active);
4228                 if (data == NULL)
4229                         goto setup;
4230                 if (data->ni != NULL) {
4231                         ieee80211_free_node(data->ni);
4232                         data->ni = NULL;
4233                         ifp->if_oerrors++;
4234                 }
4235                 if (error != USB_ERR_CANCELLED) {
4236                         usbd_xfer_set_stall(xfer);
4237                         goto setup;
4238                 }
4239                 break;
4240         }
4241 }
4242
4243 static struct urtw_data *
4244 _urtw_getbuf(struct urtw_softc *sc)
4245 {
4246         struct urtw_data *bf;
4247
4248         bf = STAILQ_FIRST(&sc->sc_tx_inactive);
4249         if (bf != NULL)
4250                 STAILQ_REMOVE_HEAD(&sc->sc_tx_inactive, next);
4251         else
4252                 bf = NULL;
4253         if (bf == NULL)
4254                 DPRINTF(sc, URTW_DEBUG_XMIT, "%s: %s\n", __func__,
4255                     "out of xmit buffers");
4256         return (bf);
4257 }
4258
4259 static struct urtw_data *
4260 urtw_getbuf(struct urtw_softc *sc)
4261 {
4262         struct urtw_data *bf;
4263
4264         URTW_ASSERT_LOCKED(sc);
4265
4266         bf = _urtw_getbuf(sc);
4267         if (bf == NULL) {
4268                 struct ifnet *ifp = sc->sc_ifp;
4269
4270                 DPRINTF(sc, URTW_DEBUG_XMIT, "%s: stop queue\n", __func__);
4271                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
4272         }
4273         return (bf);
4274 }
4275
4276 static int
4277 urtw_isbmode(uint16_t rate)
4278 {
4279
4280         return ((rate <= 22 && rate != 12 && rate != 18) ||
4281             rate == 44) ? (1) : (0);
4282 }
4283
4284 static uint16_t
4285 urtw_rate2dbps(uint16_t rate)
4286 {
4287
4288         switch(rate) {
4289         case 12:
4290         case 18:
4291         case 24:
4292         case 36:
4293         case 48:
4294         case 72:
4295         case 96:
4296         case 108:
4297                 return (rate * 2);
4298         default:
4299                 break;
4300         }
4301         return (24);
4302 }
4303
4304 static int
4305 urtw_compute_txtime(uint16_t framelen, uint16_t rate,
4306     uint8_t ismgt, uint8_t isshort)
4307 {
4308         uint16_t     ceiling, frametime, n_dbps;
4309
4310         if (urtw_isbmode(rate)) {
4311                 if (ismgt || !isshort || rate == 2)
4312                         frametime = (uint16_t)(144 + 48 +
4313                             (framelen * 8 / (rate / 2)));
4314                 else
4315                         frametime = (uint16_t)(72 + 24 +
4316                             (framelen * 8 / (rate / 2)));
4317                 if ((framelen * 8 % (rate / 2)) != 0)
4318                         frametime++;
4319         } else {
4320                 n_dbps = urtw_rate2dbps(rate);
4321                 ceiling = (16 + 8 * framelen + 6) / n_dbps
4322                     + (((16 + 8 * framelen + 6) % n_dbps) ? 1 : 0);
4323                 frametime = (uint16_t)(16 + 4 + 4 * ceiling + 6);
4324         }
4325         return (frametime);
4326 }
4327
4328 /*
4329  * Callback from the 802.11 layer to update the
4330  * slot time based on the current setting.
4331  */
4332 static void
4333 urtw_updateslot(struct ifnet *ifp)
4334 {
4335         struct urtw_softc *sc = ifp->if_softc;
4336         struct ieee80211com *ic = ifp->if_l2com;
4337
4338         ieee80211_runtask(ic, &sc->sc_updateslot_task);
4339 }
4340
4341 static void
4342 urtw_updateslottask(void *arg, int pending)
4343 {
4344         struct urtw_softc *sc = arg;
4345         struct ifnet *ifp = sc->sc_ifp;
4346         struct ieee80211com *ic = ifp->if_l2com;
4347         int error;
4348
4349         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
4350                 return;
4351
4352         URTW_LOCK(sc);
4353         if (sc->sc_flags & URTW_RTL8187B) {
4354                 urtw_write8_m(sc, URTW_SIFS, 0x22);
4355                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan))
4356                         urtw_write8_m(sc, URTW_SLOT, 0x9);
4357                 else
4358                         urtw_write8_m(sc, URTW_SLOT, 0x14);
4359                 urtw_write8_m(sc, URTW_8187B_EIFS, 0x5b);
4360                 urtw_write8_m(sc, URTW_CARRIER_SCOUNT, 0x5b);
4361         } else {
4362                 urtw_write8_m(sc, URTW_SIFS, 0x22);
4363                 if (sc->sc_state == IEEE80211_S_ASSOC &&
4364                     ic->ic_flags & IEEE80211_F_SHSLOT)
4365                         urtw_write8_m(sc, URTW_SLOT, 0x9);
4366                 else
4367                         urtw_write8_m(sc, URTW_SLOT, 0x14);
4368                 if (IEEE80211_IS_CHAN_ANYG(ic->ic_curchan)) {
4369                         urtw_write8_m(sc, URTW_DIFS, 0x14);
4370                         urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x14);
4371                         urtw_write8_m(sc, URTW_CW_VAL, 0x73);
4372                 } else {
4373                         urtw_write8_m(sc, URTW_DIFS, 0x24);
4374                         urtw_write8_m(sc, URTW_EIFS, 0x5b - 0x24);
4375                         urtw_write8_m(sc, URTW_CW_VAL, 0xa5);
4376                 }
4377         }
4378 fail:
4379         URTW_UNLOCK(sc);
4380 }
4381
4382 static void
4383 urtw_sysctl_node(struct urtw_softc *sc)
4384 {
4385 #define URTW_SYSCTL_STAT_ADD32(c, h, n, p, d)   \
4386         SYSCTL_ADD_UINT(c, h, OID_AUTO, n, CTLFLAG_RD, p, 0, d)
4387         struct sysctl_ctx_list *ctx;
4388         struct sysctl_oid_list *child, *parent;
4389         struct sysctl_oid *tree;
4390         struct urtw_stats *stats = &sc->sc_stats;
4391
4392         ctx = device_get_sysctl_ctx(sc->sc_dev);
4393         child = SYSCTL_CHILDREN(device_get_sysctl_tree(sc->sc_dev));
4394
4395         tree = SYSCTL_ADD_NODE(ctx, child, OID_AUTO, "stats", CTLFLAG_RD,
4396             NULL, "URTW statistics");
4397         parent = SYSCTL_CHILDREN(tree);
4398
4399         /* Tx statistics. */
4400         tree = SYSCTL_ADD_NODE(ctx, parent, OID_AUTO, "tx", CTLFLAG_RD,
4401             NULL, "Tx MAC statistics");
4402         child = SYSCTL_CHILDREN(tree);
4403         URTW_SYSCTL_STAT_ADD32(ctx, child, "1m", &stats->txrates[0],
4404             "1 Mbit/s");
4405         URTW_SYSCTL_STAT_ADD32(ctx, child, "2m", &stats->txrates[1],
4406             "2 Mbit/s");
4407         URTW_SYSCTL_STAT_ADD32(ctx, child, "5.5m", &stats->txrates[2],
4408             "5.5 Mbit/s");
4409         URTW_SYSCTL_STAT_ADD32(ctx, child, "6m", &stats->txrates[4],
4410             "6 Mbit/s");
4411         URTW_SYSCTL_STAT_ADD32(ctx, child, "9m", &stats->txrates[5],
4412             "9 Mbit/s");
4413         URTW_SYSCTL_STAT_ADD32(ctx, child, "11m", &stats->txrates[3],
4414             "11 Mbit/s");
4415         URTW_SYSCTL_STAT_ADD32(ctx, child, "12m", &stats->txrates[6],
4416             "12 Mbit/s");
4417         URTW_SYSCTL_STAT_ADD32(ctx, child, "18m", &stats->txrates[7],
4418             "18 Mbit/s");
4419         URTW_SYSCTL_STAT_ADD32(ctx, child, "24m", &stats->txrates[8],
4420             "24 Mbit/s");
4421         URTW_SYSCTL_STAT_ADD32(ctx, child, "36m", &stats->txrates[9],
4422             "36 Mbit/s");
4423         URTW_SYSCTL_STAT_ADD32(ctx, child, "48m", &stats->txrates[10],
4424             "48 Mbit/s");
4425         URTW_SYSCTL_STAT_ADD32(ctx, child, "54m", &stats->txrates[11],
4426             "54 Mbit/s");
4427 #undef URTW_SYSCTL_STAT_ADD32
4428 }
4429
4430 static device_method_t urtw_methods[] = {
4431         DEVMETHOD(device_probe, urtw_match),
4432         DEVMETHOD(device_attach, urtw_attach),
4433         DEVMETHOD(device_detach, urtw_detach),
4434         DEVMETHOD_END
4435 };
4436 static driver_t urtw_driver = {
4437         "urtw",
4438         urtw_methods,
4439         sizeof(struct urtw_softc)
4440 };
4441 static devclass_t urtw_devclass;
4442
4443 DRIVER_MODULE(urtw, uhub, urtw_driver, urtw_devclass, NULL, 0);
4444 MODULE_DEPEND(urtw, wlan, 1, 1, 1);
4445 MODULE_DEPEND(urtw, usb, 1, 1, 1);
4446 MODULE_VERSION(urtw, 1);