ath5k: explicitly check skb->len
[safe/jmp/linux-2.6] / drivers / net / wireless / rtl8187_dev.c
index bf9f0cc..060a265 100644 (file)
 
 MODULE_AUTHOR("Michael Wu <flamingice@sourmilk.net>");
 MODULE_AUTHOR("Andrea Merello <andreamrl@tiscali.it>");
-MODULE_DESCRIPTION("RTL8187 USB wireless driver");
+MODULE_DESCRIPTION("RTL8187/RTL8187B USB wireless driver");
 MODULE_LICENSE("GPL");
 
 static struct usb_device_id rtl8187_table[] __devinitdata = {
+       /* Asus */
+       {USB_DEVICE(0x0b05, 0x171d), .driver_info = DEVICE_RTL8187},
        /* Realtek */
-       {USB_DEVICE(0x0bda, 0x8187)},
+       {USB_DEVICE(0x0bda, 0x8187), .driver_info = DEVICE_RTL8187},
+       {USB_DEVICE(0x0bda, 0x8189), .driver_info = DEVICE_RTL8187B},
+       {USB_DEVICE(0x0bda, 0x8197), .driver_info = DEVICE_RTL8187B},
        /* Netgear */
-       {USB_DEVICE(0x0846, 0x6100)},
-       {USB_DEVICE(0x0846, 0x6a00)},
+       {USB_DEVICE(0x0846, 0x6100), .driver_info = DEVICE_RTL8187},
+       {USB_DEVICE(0x0846, 0x6a00), .driver_info = DEVICE_RTL8187},
+       {USB_DEVICE(0x0846, 0x4260), .driver_info = DEVICE_RTL8187B},
+       /* HP */
+       {USB_DEVICE(0x03f0, 0xca02), .driver_info = DEVICE_RTL8187},
+       /* Sitecom */
+       {USB_DEVICE(0x0df6, 0x000d), .driver_info = DEVICE_RTL8187},
        {}
 };
 
 MODULE_DEVICE_TABLE(usb, rtl8187_table);
 
+static const struct ieee80211_rate rtl818x_rates[] = {
+       { .bitrate = 10, .hw_value = 0, },
+       { .bitrate = 20, .hw_value = 1, },
+       { .bitrate = 55, .hw_value = 2, },
+       { .bitrate = 110, .hw_value = 3, },
+       { .bitrate = 60, .hw_value = 4, },
+       { .bitrate = 90, .hw_value = 5, },
+       { .bitrate = 120, .hw_value = 6, },
+       { .bitrate = 180, .hw_value = 7, },
+       { .bitrate = 240, .hw_value = 8, },
+       { .bitrate = 360, .hw_value = 9, },
+       { .bitrate = 480, .hw_value = 10, },
+       { .bitrate = 540, .hw_value = 11, },
+};
+
+static const struct ieee80211_channel rtl818x_channels[] = {
+       { .center_freq = 2412 },
+       { .center_freq = 2417 },
+       { .center_freq = 2422 },
+       { .center_freq = 2427 },
+       { .center_freq = 2432 },
+       { .center_freq = 2437 },
+       { .center_freq = 2442 },
+       { .center_freq = 2447 },
+       { .center_freq = 2452 },
+       { .center_freq = 2457 },
+       { .center_freq = 2462 },
+       { .center_freq = 2467 },
+       { .center_freq = 2472 },
+       { .center_freq = 2484 },
+};
+
+static void rtl8187_iowrite_async_cb(struct urb *urb)
+{
+       kfree(urb->context);
+       usb_free_urb(urb);
+}
+
+static void rtl8187_iowrite_async(struct rtl8187_priv *priv, __le16 addr,
+                                 void *data, u16 len)
+{
+       struct usb_ctrlrequest *dr;
+       struct urb *urb;
+       struct rtl8187_async_write_data {
+               u8 data[4];
+               struct usb_ctrlrequest dr;
+       } *buf;
+       int rc;
+
+       buf = kmalloc(sizeof(*buf), GFP_ATOMIC);
+       if (!buf)
+               return;
+
+       urb = usb_alloc_urb(0, GFP_ATOMIC);
+       if (!urb) {
+               kfree(buf);
+               return;
+       }
+
+       dr = &buf->dr;
+
+       dr->bRequestType = RTL8187_REQT_WRITE;
+       dr->bRequest = RTL8187_REQ_SET_REG;
+       dr->wValue = addr;
+       dr->wIndex = 0;
+       dr->wLength = cpu_to_le16(len);
+
+       memcpy(buf, data, len);
+
+       usb_fill_control_urb(urb, priv->udev, usb_sndctrlpipe(priv->udev, 0),
+                            (unsigned char *)dr, buf, len,
+                            rtl8187_iowrite_async_cb, buf);
+       rc = usb_submit_urb(urb, GFP_ATOMIC);
+       if (rc < 0) {
+               kfree(buf);
+               usb_free_urb(urb);
+       }
+}
+
+static inline void rtl818x_iowrite32_async(struct rtl8187_priv *priv,
+                                          __le32 *addr, u32 val)
+{
+       __le32 buf = cpu_to_le32(val);
+
+       rtl8187_iowrite_async(priv, cpu_to_le16((unsigned long)addr),
+                             &buf, sizeof(buf));
+}
+
 void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
 {
        struct rtl8187_priv *priv = dev->priv;
@@ -58,27 +155,30 @@ void rtl8187_write_phy(struct ieee80211_hw *dev, u8 addr, u32 data)
 
 static void rtl8187_tx_cb(struct urb *urb)
 {
-       struct ieee80211_tx_status status = { {0} };
        struct sk_buff *skb = (struct sk_buff *)urb->context;
-       struct rtl8187_tx_info *info = (struct rtl8187_tx_info *)skb->cb;
-
-       usb_free_urb(info->urb);
-       if (info->control)
-               memcpy(&status.control, info->control, sizeof(status.control));
-       kfree(info->control);
-       skb_pull(skb, sizeof(struct rtl8187_tx_hdr));
-       status.flags |= IEEE80211_TX_STATUS_ACK;
-       ieee80211_tx_status_irqsafe(info->dev, skb, &status);
+       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+       struct ieee80211_hw *hw = info->driver_data[0];
+       struct rtl8187_priv *priv = hw->priv;
+
+       usb_free_urb(info->driver_data[1]);
+       skb_pull(skb, priv->is_rtl8187b ? sizeof(struct rtl8187b_tx_hdr) :
+                                         sizeof(struct rtl8187_tx_hdr));
+       memset(&info->status, 0, sizeof(info->status));
+       info->flags |= IEEE80211_TX_STAT_ACK;
+       ieee80211_tx_status_irqsafe(hw, skb);
 }
 
-static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
-                     struct ieee80211_tx_control *control)
+static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb)
 {
        struct rtl8187_priv *priv = dev->priv;
-       struct rtl8187_tx_hdr *hdr;
-       struct rtl8187_tx_info *info;
+       struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
+       struct ieee80211_hdr *ieee80211hdr = (struct ieee80211_hdr *)skb->data;
+       unsigned int ep;
+       void *buf;
        struct urb *urb;
-       u32 tmp;
+       __le16 rts_dur = 0;
+       u32 flags;
+       int rc;
 
        urb = usb_alloc_urb(0, GFP_ATOMIC);
        if (!urb) {
@@ -86,32 +186,82 @@ static int rtl8187_tx(struct ieee80211_hw *dev, struct sk_buff *skb,
                return 0;
        }
 
-       hdr = (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
-       tmp = skb->len - sizeof(*hdr);
-       tmp |= RTL8187_TX_FLAG_NO_ENCRYPT;
-       tmp |= control->rts_cts_rate << 19;
-       tmp |= control->tx_rate << 24;
-       if (ieee80211_get_morefrag((struct ieee80211_hdr *)skb))
-               tmp |= RTL8187_TX_FLAG_MORE_FRAG;
-       if (control->flags & IEEE80211_TXCTL_USE_RTS_CTS) {
-               tmp |= RTL8187_TX_FLAG_RTS;
-               hdr->rts_duration =
-                       ieee80211_rts_duration(dev, priv->if_id, skb->len, control);
+       flags = skb->len;
+       flags |= RTL818X_TX_DESC_FLAG_NO_ENC;
+
+       flags |= ieee80211_get_tx_rate(dev, info)->hw_value << 24;
+       if (ieee80211_has_morefrags(((struct ieee80211_hdr *)skb->data)->frame_control))
+               flags |= RTL818X_TX_DESC_FLAG_MOREFRAG;
+       if (info->flags & IEEE80211_TX_CTL_USE_RTS_CTS) {
+               flags |= RTL818X_TX_DESC_FLAG_RTS;
+               flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+               rts_dur = ieee80211_rts_duration(dev, priv->vif,
+                                                skb->len, info);
+       } else if (info->flags & IEEE80211_TX_CTL_USE_CTS_PROTECT) {
+               flags |= RTL818X_TX_DESC_FLAG_CTS;
+               flags |= ieee80211_get_rts_cts_rate(dev, info)->hw_value << 19;
+       }
+
+       if (!priv->is_rtl8187b) {
+               struct rtl8187_tx_hdr *hdr =
+                       (struct rtl8187_tx_hdr *)skb_push(skb, sizeof(*hdr));
+               hdr->flags = cpu_to_le32(flags);
+               hdr->len = 0;
+               hdr->rts_duration = rts_dur;
+               hdr->retry = cpu_to_le32(info->control.retry_limit << 8);
+               buf = hdr;
+
+               ep = 2;
+       } else {
+               /* fc needs to be calculated before skb_push() */
+               unsigned int epmap[4] = { 6, 7, 5, 4 };
+               struct ieee80211_hdr *tx_hdr =
+                       (struct ieee80211_hdr *)(skb->data);
+               u16 fc = le16_to_cpu(tx_hdr->frame_control);
+
+               struct rtl8187b_tx_hdr *hdr =
+                       (struct rtl8187b_tx_hdr *)skb_push(skb, sizeof(*hdr));
+               struct ieee80211_rate *txrate =
+                       ieee80211_get_tx_rate(dev, info);
+               memset(hdr, 0, sizeof(*hdr));
+               hdr->flags = cpu_to_le32(flags);
+               hdr->rts_duration = rts_dur;
+               hdr->retry = cpu_to_le32(info->control.retry_limit << 8);
+               hdr->tx_duration =
+                       ieee80211_generic_frame_duration(dev, priv->vif,
+                                                        skb->len, txrate);
+               buf = hdr;
+
+               if ((fc & IEEE80211_FCTL_FTYPE) == IEEE80211_FTYPE_MGMT)
+                       ep = 12;
+               else
+                       ep = epmap[skb_get_queue_mapping(skb)];
+       }
+
+       /* FIXME: The sequence that follows is needed for this driver to
+        * work with mac80211 since "mac80211: fix TX sequence numbers".
+        * As with the temporary code in rt2x00, changes will be needed
+        * to get proper sequence numbers on beacons. In addition, this
+        * patch places the sequence number in the hardware state, which
+        * limits us to a single virtual state.
+        */
+       if (info->flags & IEEE80211_TX_CTL_ASSIGN_SEQ) {
+               if (info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)
+                       priv->seqno += 0x10;
+               ieee80211hdr->seq_ctrl &= cpu_to_le16(IEEE80211_SCTL_FRAG);
+               ieee80211hdr->seq_ctrl |= cpu_to_le16(priv->seqno);
+       }
+
+       info->driver_data[0] = dev;
+       info->driver_data[1] = urb;
+
+       usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, ep),
+                         buf, skb->len, rtl8187_tx_cb, skb);
+       rc = usb_submit_urb(urb, GFP_ATOMIC);
+       if (rc < 0) {
+               usb_free_urb(urb);
+               kfree_skb(skb);
        }
-       if (control->flags & IEEE80211_TXCTL_USE_CTS_PROTECT)
-               tmp |= RTL8187_TX_FLAG_CTS;
-       hdr->flags = cpu_to_le32(tmp);
-       hdr->len = 0;
-       tmp = control->retry_limit << 8;
-       hdr->retry = cpu_to_le32(tmp);
-
-       info = (struct rtl8187_tx_info *)skb->cb;
-       info->control = kmemdup(control, sizeof(*control), GFP_ATOMIC);
-       info->urb = urb;
-       info->dev = dev;
-       usb_fill_bulk_urb(urb, priv->udev, usb_sndbulkpipe(priv->udev, 2),
-                         hdr, skb->len, rtl8187_tx_cb, skb);
-       usb_submit_urb(urb, GFP_ATOMIC);
 
        return 0;
 }
@@ -122,9 +272,10 @@ static void rtl8187_rx_cb(struct urb *urb)
        struct rtl8187_rx_info *info = (struct rtl8187_rx_info *)skb->cb;
        struct ieee80211_hw *dev = info->dev;
        struct rtl8187_priv *priv = dev->priv;
-       struct rtl8187_rx_hdr *hdr;
        struct ieee80211_rx_status rx_status = { 0 };
        int rate, signal;
+       u32 flags;
+       u32 quality;
 
        spin_lock(&priv->rx_queue.lock);
        if (skb->next)
@@ -142,33 +293,69 @@ static void rtl8187_rx_cb(struct urb *urb)
        }
 
        skb_put(skb, urb->actual_length);
-       hdr = (struct rtl8187_rx_hdr *)(skb_tail_pointer(skb) - sizeof(*hdr));
-       skb_trim(skb, le16_to_cpu(hdr->len) & 0x0FFF);
-
-       signal = hdr->agc >> 1;
-       rate = (le16_to_cpu(hdr->rate) >> 4) & 0xF;
-       if (rate > 3) { /* OFDM rate */
-               if (signal > 90)
-                       signal = 90;
-               else if (signal < 25)
-                       signal = 25;
-               signal = 90 - signal;
-       } else {        /* CCK rate */
-               if (signal > 95)
-                       signal = 95;
-               else if (signal < 30)
-                       signal = 30;
-               signal = 95 - signal;
+       if (!priv->is_rtl8187b) {
+               struct rtl8187_rx_hdr *hdr =
+                       (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
+               flags = le32_to_cpu(hdr->flags);
+               signal = hdr->signal & 0x7f;
+               rx_status.antenna = (hdr->signal >> 7) & 1;
+               rx_status.noise = hdr->noise;
+               rx_status.mactime = le64_to_cpu(hdr->mac_time);
+               priv->quality = signal;
+               rx_status.qual = priv->quality;
+               priv->noise = hdr->noise;
+               rate = (flags >> 20) & 0xF;
+               if (rate > 3) { /* OFDM rate */
+                       if (signal > 90)
+                               signal = 90;
+                       else if (signal < 25)
+                               signal = 25;
+                       signal = 90 - signal;
+               } else {        /* CCK rate */
+                       if (signal > 95)
+                               signal = 95;
+                       else if (signal < 30)
+                               signal = 30;
+                       signal = 95 - signal;
+               }
+               rx_status.signal = signal;
+               priv->signal = signal;
+       } else {
+               struct rtl8187b_rx_hdr *hdr =
+                       (typeof(hdr))(skb_tail_pointer(skb) - sizeof(*hdr));
+               /* The Realtek datasheet for the RTL8187B shows that the RX
+                * header contains the following quantities: signal quality,
+                * RSSI, AGC, the received power in dB, and the measured SNR.
+                * In testing, none of these quantities show qualitative
+                * agreement with AP signal strength, except for the AGC,
+                * which is inversely proportional to the strength of the
+                * signal. In the following, the quality and signal strength
+                * are derived from the AGC. The arbitrary scaling constants
+                * are chosen to make the results close to the values obtained
+                * for a BCM4312 using b43 as the driver. The noise is ignored
+                * for now.
+                */
+               flags = le32_to_cpu(hdr->flags);
+               quality = 170 - hdr->agc;
+               if (quality > 100)
+                       quality = 100;
+               signal = 14 - hdr->agc / 2;
+               rx_status.qual = quality;
+               priv->quality = quality;
+               rx_status.signal = signal;
+               priv->signal = signal;
+               rx_status.antenna = (hdr->rssi >> 7) & 1;
+               rx_status.mactime = le64_to_cpu(hdr->mac_time);
+               rate = (flags >> 20) & 0xF;
        }
 
-       rx_status.antenna = (hdr->signal >> 7) & 1;
-       rx_status.signal = 64 - min(hdr->noise, (u8)64);
-       rx_status.ssi = signal;
-       rx_status.rate = rate;
-       rx_status.freq = dev->conf.freq;
-       rx_status.channel = dev->conf.channel;
-       rx_status.phymode = dev->conf.phymode;
-       rx_status.mactime = le64_to_cpu(hdr->mac_time);
+       skb_trim(skb, flags & 0x0FFF);
+       rx_status.rate_idx = rate;
+       rx_status.freq = dev->conf.channel->center_freq;
+       rx_status.band = dev->conf.channel->band;
+       rx_status.flag |= RX_FLAG_TSFT;
+       if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR)
+               rx_status.flag |= RX_FLAG_FAILED_FCS_CRC;
        ieee80211_rx_irqsafe(dev, skb, &rx_status);
 
        skb = dev_alloc_skb(RTL8187_MAX_RX);
@@ -205,7 +392,8 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
                        break;
                }
                usb_fill_bulk_urb(entry, priv->udev,
-                                 usb_rcvbulkpipe(priv->udev, 1),
+                                 usb_rcvbulkpipe(priv->udev,
+                                 priv->is_rtl8187b ? 3 : 1),
                                  skb_tail_pointer(skb),
                                  RTL8187_MAX_RX, rtl8187_rx_cb, skb);
                info = (struct rtl8187_rx_info *)skb->cb;
@@ -218,29 +406,12 @@ static int rtl8187_init_urbs(struct ieee80211_hw *dev)
        return 0;
 }
 
-static int rtl8187_init_hw(struct ieee80211_hw *dev)
+static int rtl8187_cmd_reset(struct ieee80211_hw *dev)
 {
        struct rtl8187_priv *priv = dev->priv;
        u8 reg;
        int i;
 
-       /* reset */
-       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
-       reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
-       rtl818x_iowrite32(priv, &priv->map->ANAPARAM, RTL8225_ANAPARAM_ON);
-       rtl818x_iowrite32(priv, &priv->map->ANAPARAM2, RTL8225_ANAPARAM2_ON);
-       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
-       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
-
-       rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
-
-       msleep(200);
-       rtl818x_iowrite8(priv, (u8 *)0xFE18, 0x10);
-       rtl818x_iowrite8(priv, (u8 *)0xFE18, 0x11);
-       rtl818x_iowrite8(priv, (u8 *)0xFE18, 0x00);
-       msleep(200);
-
        reg = rtl818x_ioread8(priv, &priv->map->CMD);
        reg &= (1 << 1);
        reg |= RTL818X_CMD_RESET;
@@ -276,12 +447,52 @@ static int rtl8187_init_hw(struct ieee80211_hw *dev)
                return -ETIMEDOUT;
        }
 
+       return 0;
+}
+
+static int rtl8187_init_hw(struct ieee80211_hw *dev)
+{
+       struct rtl8187_priv *priv = dev->priv;
+       u8 reg;
+       int res;
+
+       /* reset */
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_CONFIG);
+       reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg |
+                        RTL818X_CONFIG3_ANAPARAM_WRITE);
+       rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
+                         RTL8187_RTL8225_ANAPARAM_ON);
+       rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
+                         RTL8187_RTL8225_ANAPARAM2_ON);
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg &
+                        ~RTL818X_CONFIG3_ANAPARAM_WRITE);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_NORMAL);
+
+       rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
+
+       msleep(200);
+       rtl818x_iowrite8(priv, (u8 *)0xFE18, 0x10);
+       rtl818x_iowrite8(priv, (u8 *)0xFE18, 0x11);
+       rtl818x_iowrite8(priv, (u8 *)0xFE18, 0x00);
+       msleep(200);
+
+       res = rtl8187_cmd_reset(dev);
+       if (res)
+               return res;
+
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
        reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
-       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
-       rtl818x_iowrite32(priv, &priv->map->ANAPARAM, RTL8225_ANAPARAM_ON);
-       rtl818x_iowrite32(priv, &priv->map->ANAPARAM2, RTL8225_ANAPARAM2_ON);
-       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3,
+                       reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
+       rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
+                         RTL8187_RTL8225_ANAPARAM_ON);
+       rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
+                         RTL8187_RTL8225_ANAPARAM2_ON);
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3,
+                       reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 
        /* setup card */
@@ -293,8 +504,6 @@ static int rtl8187_init_hw(struct ieee80211_hw *dev)
        rtl818x_iowrite8(priv, &priv->map->GP_ENABLE, 0);
 
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
-       for (i = 0; i < ETH_ALEN; i++)
-               rtl818x_iowrite8(priv, &priv->map->MAC[i], priv->hwaddr[i]);
 
        rtl818x_iowrite16(priv, (__le16 *)0xFFF4, 0xFFFF);
        reg = rtl818x_ioread8(priv, &priv->map->CONFIG1);
@@ -328,71 +537,242 @@ static int rtl8187_init_hw(struct ieee80211_hw *dev)
        rtl818x_iowrite32(priv, &priv->map->RF_TIMING, 0x000a8008);
        rtl818x_iowrite16(priv, &priv->map->BRSR, 0xFFFF);
        rtl818x_iowrite32(priv, &priv->map->RF_PARA, 0x00100044);
-       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_CONFIG);
        rtl818x_iowrite8(priv, &priv->map->CONFIG3, 0x44);
-       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_NORMAL);
        rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FF7);
        msleep(100);
 
-       priv->rf_init(dev);
+       priv->rf->init(dev);
 
        rtl818x_iowrite16(priv, &priv->map->BRSR, 0x01F3);
-       reg = rtl818x_ioread16(priv, &priv->map->PGSELECT) & 0xfffe;
-       rtl818x_iowrite16(priv, &priv->map->PGSELECT, reg | 0x1);
+       reg = rtl818x_ioread8(priv, &priv->map->PGSELECT) & ~1;
+       rtl818x_iowrite8(priv, &priv->map->PGSELECT, reg | 1);
        rtl818x_iowrite16(priv, (__le16 *)0xFFFE, 0x10);
        rtl818x_iowrite8(priv, &priv->map->TALLY_SEL, 0x80);
        rtl818x_iowrite8(priv, (u8 *)0xFFFF, 0x60);
-       rtl818x_iowrite16(priv, &priv->map->PGSELECT, reg);
+       rtl818x_iowrite8(priv, &priv->map->PGSELECT, reg);
 
        return 0;
 }
 
-static void rtl8187_set_channel(struct ieee80211_hw *dev, int channel)
+static const u8 rtl8187b_reg_table[][3] = {
+       {0xF0, 0x32, 0}, {0xF1, 0x32, 0}, {0xF2, 0x00, 0}, {0xF3, 0x00, 0},
+       {0xF4, 0x32, 0}, {0xF5, 0x43, 0}, {0xF6, 0x00, 0}, {0xF7, 0x00, 0},
+       {0xF8, 0x46, 0}, {0xF9, 0xA4, 0}, {0xFA, 0x00, 0}, {0xFB, 0x00, 0},
+       {0xFC, 0x96, 0}, {0xFD, 0xA4, 0}, {0xFE, 0x00, 0}, {0xFF, 0x00, 0},
+
+       {0x58, 0x4B, 1}, {0x59, 0x00, 1}, {0x5A, 0x4B, 1}, {0x5B, 0x00, 1},
+       {0x60, 0x4B, 1}, {0x61, 0x09, 1}, {0x62, 0x4B, 1}, {0x63, 0x09, 1},
+       {0xCE, 0x0F, 1}, {0xCF, 0x00, 1}, {0xE0, 0xFF, 1}, {0xE1, 0x0F, 1},
+       {0xE2, 0x00, 1}, {0xF0, 0x4E, 1}, {0xF1, 0x01, 1}, {0xF2, 0x02, 1},
+       {0xF3, 0x03, 1}, {0xF4, 0x04, 1}, {0xF5, 0x05, 1}, {0xF6, 0x06, 1},
+       {0xF7, 0x07, 1}, {0xF8, 0x08, 1},
+
+       {0x4E, 0x00, 2}, {0x0C, 0x04, 2}, {0x21, 0x61, 2}, {0x22, 0x68, 2},
+       {0x23, 0x6F, 2}, {0x24, 0x76, 2}, {0x25, 0x7D, 2}, {0x26, 0x84, 2},
+       {0x27, 0x8D, 2}, {0x4D, 0x08, 2}, {0x50, 0x05, 2}, {0x51, 0xF5, 2},
+       {0x52, 0x04, 2}, {0x53, 0xA0, 2}, {0x54, 0x1F, 2}, {0x55, 0x23, 2},
+       {0x56, 0x45, 2}, {0x57, 0x67, 2}, {0x58, 0x08, 2}, {0x59, 0x08, 2},
+       {0x5A, 0x08, 2}, {0x5B, 0x08, 2}, {0x60, 0x08, 2}, {0x61, 0x08, 2},
+       {0x62, 0x08, 2}, {0x63, 0x08, 2}, {0x64, 0xCF, 2}, {0x72, 0x56, 2},
+       {0x73, 0x9A, 2},
+
+       {0x34, 0xF0, 0}, {0x35, 0x0F, 0}, {0x5B, 0x40, 0}, {0x84, 0x88, 0},
+       {0x85, 0x24, 0}, {0x88, 0x54, 0}, {0x8B, 0xB8, 0}, {0x8C, 0x07, 0},
+       {0x8D, 0x00, 0}, {0x94, 0x1B, 0}, {0x95, 0x12, 0}, {0x96, 0x00, 0},
+       {0x97, 0x06, 0}, {0x9D, 0x1A, 0}, {0x9F, 0x10, 0}, {0xB4, 0x22, 0},
+       {0xBE, 0x80, 0}, {0xDB, 0x00, 0}, {0xEE, 0x00, 0}, {0x91, 0x03, 0},
+
+       {0x4C, 0x00, 2}, {0x9F, 0x00, 3}, {0x8C, 0x01, 0}, {0x8D, 0x10, 0},
+       {0x8E, 0x08, 0}, {0x8F, 0x00, 0}
+};
+
+static int rtl8187b_init_hw(struct ieee80211_hw *dev)
 {
-       u32 reg;
        struct rtl8187_priv *priv = dev->priv;
+       int res, i;
+       u8 reg;
 
-       reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
-       /* Enable TX loopback on MAC level to avoid TX during channel
-        * changes, as this has be seen to causes problems and the
-        * card will stop work until next reset
-        */
-       rtl818x_iowrite32(priv, &priv->map->TX_CONF,
-                         reg | RTL818X_TX_CONF_LOOPBACK_MAC);
-       msleep(10);
-       rtl8225_rf_set_channel(dev, channel);
-       msleep(10);
-       rtl818x_iowrite32(priv, &priv->map->TX_CONF, reg);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_CONFIG);
+
+       reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+       reg |= RTL818X_CONFIG3_ANAPARAM_WRITE | RTL818X_CONFIG3_GNT_SELECT;
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
+       rtl818x_iowrite32(priv, &priv->map->ANAPARAM2,
+                         RTL8187B_RTL8225_ANAPARAM2_ON);
+       rtl818x_iowrite32(priv, &priv->map->ANAPARAM,
+                         RTL8187B_RTL8225_ANAPARAM_ON);
+       rtl818x_iowrite8(priv, &priv->map->ANAPARAM3,
+                        RTL8187B_RTL8225_ANAPARAM3_ON);
+
+       rtl818x_iowrite8(priv, (u8 *)0xFF61, 0x10);
+       reg = rtl818x_ioread8(priv, (u8 *)0xFF62);
+       rtl818x_iowrite8(priv, (u8 *)0xFF62, reg & ~(1 << 5));
+       rtl818x_iowrite8(priv, (u8 *)0xFF62, reg | (1 << 5));
+
+       reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+       reg &= ~RTL818X_CONFIG3_ANAPARAM_WRITE;
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
+
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_NORMAL);
+
+       res = rtl8187_cmd_reset(dev);
+       if (res)
+               return res;
+
+       rtl818x_iowrite16(priv, (__le16 *)0xFF2D, 0x0FFF);
+       reg = rtl818x_ioread8(priv, &priv->map->CW_CONF);
+       reg |= RTL818X_CW_CONF_PERPACKET_RETRY_SHIFT;
+       rtl818x_iowrite8(priv, &priv->map->CW_CONF, reg);
+       reg = rtl818x_ioread8(priv, &priv->map->TX_AGC_CTL);
+       reg |= RTL818X_TX_AGC_CTL_PERPACKET_GAIN_SHIFT |
+              RTL818X_TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT;
+       rtl818x_iowrite8(priv, &priv->map->TX_AGC_CTL, reg);
+
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFFE0, 0x0FFF, 1);
+       reg = rtl818x_ioread8(priv, &priv->map->RATE_FALLBACK);
+       reg |= RTL818X_RATE_FALLBACK_ENABLE;
+       rtl818x_iowrite8(priv, &priv->map->RATE_FALLBACK, reg);
+
+       rtl818x_iowrite16(priv, &priv->map->BEACON_INTERVAL, 100);
+       rtl818x_iowrite16(priv, &priv->map->ATIM_WND, 2);
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFFD4, 0xFFFF, 1);
+
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_CONFIG);
+       reg = rtl818x_ioread8(priv, &priv->map->CONFIG1);
+       rtl818x_iowrite8(priv, &priv->map->CONFIG1, (reg & 0x3F) | 0x80);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_NORMAL);
+
+       rtl818x_iowrite8(priv, &priv->map->WPA_CONF, 0);
+       for (i = 0; i < ARRAY_SIZE(rtl8187b_reg_table); i++) {
+               rtl818x_iowrite8_idx(priv,
+                                    (u8 *)(uintptr_t)
+                                    (rtl8187b_reg_table[i][0] | 0xFF00),
+                                    rtl8187b_reg_table[i][1],
+                                    rtl8187b_reg_table[i][2]);
+       }
+
+       rtl818x_iowrite16(priv, &priv->map->TID_AC_MAP, 0xFA50);
+       rtl818x_iowrite16(priv, &priv->map->INT_MIG, 0);
+
+       rtl818x_iowrite32_idx(priv, (__le32 *)0xFFF0, 0, 1);
+       rtl818x_iowrite32_idx(priv, (__le32 *)0xFFF4, 0, 1);
+       rtl818x_iowrite8_idx(priv, (u8 *)0xFFF8, 0, 1);
+
+       rtl818x_iowrite32(priv, &priv->map->RF_TIMING, 0x00004001);
+
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF72, 0x569A, 2);
+
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_CONFIG);
+       reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+       reg |= RTL818X_CONFIG3_ANAPARAM_WRITE;
+       rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD,
+                        RTL818X_EEPROM_CMD_NORMAL);
+
+       rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, 0x0480);
+       rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0x2488);
+       rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+       msleep(1100);
+
+       priv->rf->init(dev);
+
+       reg = RTL818X_CMD_TX_ENABLE | RTL818X_CMD_RX_ENABLE;
+       rtl818x_iowrite8(priv, &priv->map->CMD, reg);
+       rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0xFFFF);
+
+       rtl818x_iowrite8(priv, (u8 *)0xFE41, 0xF4);
+       rtl818x_iowrite8(priv, (u8 *)0xFE40, 0x00);
+       rtl818x_iowrite8(priv, (u8 *)0xFE42, 0x00);
+       rtl818x_iowrite8(priv, (u8 *)0xFE42, 0x01);
+       rtl818x_iowrite8(priv, (u8 *)0xFE40, 0x0F);
+       rtl818x_iowrite8(priv, (u8 *)0xFE42, 0x00);
+       rtl818x_iowrite8(priv, (u8 *)0xFE42, 0x01);
+
+       reg = rtl818x_ioread8(priv, (u8 *)0xFFDB);
+       rtl818x_iowrite8(priv, (u8 *)0xFFDB, reg | (1 << 2));
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF72, 0x59FA, 3);
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF74, 0x59D2, 3);
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF76, 0x59D2, 3);
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF78, 0x19FA, 3);
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF7A, 0x19FA, 3);
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFF7C, 0x00D0, 3);
+       rtl818x_iowrite8(priv, (u8 *)0xFF61, 0);
+       rtl818x_iowrite8_idx(priv, (u8 *)0xFF80, 0x0F, 1);
+       rtl818x_iowrite8_idx(priv, (u8 *)0xFF83, 0x03, 1);
+       rtl818x_iowrite8(priv, (u8 *)0xFFDA, 0x10);
+       rtl818x_iowrite8_idx(priv, (u8 *)0xFF4D, 0x08, 2);
+
+       rtl818x_iowrite32(priv, &priv->map->HSSI_PARA, 0x0600321B);
+
+       rtl818x_iowrite16_idx(priv, (__le16 *)0xFFEC, 0x0800, 1);
+
+       return 0;
 }
 
-static int rtl8187_open(struct ieee80211_hw *dev)
+static int rtl8187_start(struct ieee80211_hw *dev)
 {
        struct rtl8187_priv *priv = dev->priv;
        u32 reg;
        int ret;
 
-       ret = rtl8187_init_hw(dev);
+       ret = (!priv->is_rtl8187b) ? rtl8187_init_hw(dev) :
+                                    rtl8187b_init_hw(dev);
        if (ret)
                return ret;
 
+       mutex_lock(&priv->conf_mutex);
+       if (priv->is_rtl8187b) {
+               reg = RTL818X_RX_CONF_MGMT |
+                     RTL818X_RX_CONF_DATA |
+                     RTL818X_RX_CONF_BROADCAST |
+                     RTL818X_RX_CONF_NICMAC |
+                     RTL818X_RX_CONF_BSSID |
+                     (7 << 13 /* RX FIFO threshold NONE */) |
+                     (7 << 10 /* MAX RX DMA */) |
+                     RTL818X_RX_CONF_RX_AUTORESETPHY |
+                     RTL818X_RX_CONF_ONLYERLPKT |
+                     RTL818X_RX_CONF_MULTICAST;
+               priv->rx_conf = reg;
+               rtl818x_iowrite32(priv, &priv->map->RX_CONF, reg);
+
+               rtl818x_iowrite32(priv, &priv->map->TX_CONF,
+                                 RTL818X_TX_CONF_HW_SEQNUM |
+                                 RTL818X_TX_CONF_DISREQQSIZE |
+                                 (7 << 8  /* short retry limit */) |
+                                 (7 << 0  /* long retry limit */) |
+                                 (7 << 21 /* MAX TX DMA */));
+               rtl8187_init_urbs(dev);
+               mutex_unlock(&priv->conf_mutex);
+               return 0;
+       }
+
        rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0xFFFF);
 
+       rtl818x_iowrite32(priv, &priv->map->MAR[0], ~0);
+       rtl818x_iowrite32(priv, &priv->map->MAR[1], ~0);
+
        rtl8187_init_urbs(dev);
 
        reg = RTL818X_RX_CONF_ONLYERLPKT |
              RTL818X_RX_CONF_RX_AUTORESETPHY |
              RTL818X_RX_CONF_BSSID |
              RTL818X_RX_CONF_MGMT |
-             RTL818X_RX_CONF_CTRL |
              RTL818X_RX_CONF_DATA |
              (7 << 13 /* RX FIFO threshold NONE */) |
              (7 << 10 /* MAX RX DMA */) |
              RTL818X_RX_CONF_BROADCAST |
-             RTL818X_RX_CONF_MULTICAST |
              RTL818X_RX_CONF_NICMAC;
-       if (priv->mode == IEEE80211_IF_TYPE_MNTR)
-               reg |= RTL818X_RX_CONF_MONITOR;
 
+       priv->rx_conf = reg;
        rtl818x_iowrite32(priv, &priv->map->RX_CONF, reg);
 
        reg = rtl818x_ioread8(priv, &priv->map->CW_CONF);
@@ -415,17 +795,19 @@ static int rtl8187_open(struct ieee80211_hw *dev)
        reg |= RTL818X_CMD_TX_ENABLE;
        reg |= RTL818X_CMD_RX_ENABLE;
        rtl818x_iowrite8(priv, &priv->map->CMD, reg);
+       mutex_unlock(&priv->conf_mutex);
 
        return 0;
 }
 
-static int rtl8187_stop(struct ieee80211_hw *dev)
+static void rtl8187_stop(struct ieee80211_hw *dev)
 {
        struct rtl8187_priv *priv = dev->priv;
        struct rtl8187_rx_info *info;
        struct sk_buff *skb;
        u32 reg;
 
+       mutex_lock(&priv->conf_mutex);
        rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
 
        reg = rtl818x_ioread8(priv, &priv->map->CMD);
@@ -433,7 +815,7 @@ static int rtl8187_stop(struct ieee80211_hw *dev)
        reg &= ~RTL818X_CMD_RX_ENABLE;
        rtl818x_iowrite8(priv, &priv->map->CMD, reg);
 
-       rtl8225_rf_stop(dev);
+       priv->rf->stop(dev);
 
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
        reg = rtl818x_ioread8(priv, &priv->map->CONFIG4);
@@ -445,29 +827,36 @@ static int rtl8187_stop(struct ieee80211_hw *dev)
                usb_kill_urb(info->urb);
                kfree_skb(skb);
        }
-       return 0;
+       mutex_unlock(&priv->conf_mutex);
 }
 
 static int rtl8187_add_interface(struct ieee80211_hw *dev,
                                 struct ieee80211_if_init_conf *conf)
 {
        struct rtl8187_priv *priv = dev->priv;
+       int i;
 
-       /* NOTE: using IEEE80211_IF_TYPE_MGMT to indicate no mode selected */
-       if (priv->mode != IEEE80211_IF_TYPE_MGMT)
-               return -1;
+       if (priv->mode != IEEE80211_IF_TYPE_MNTR)
+               return -EOPNOTSUPP;
 
        switch (conf->type) {
        case IEEE80211_IF_TYPE_STA:
-       case IEEE80211_IF_TYPE_MNTR:
                priv->mode = conf->type;
                break;
        default:
                return -EOPNOTSUPP;
        }
 
-       priv->hwaddr = conf->mac_addr ? conf->mac_addr : dev->wiphy->perm_addr;
+       mutex_lock(&priv->conf_mutex);
+       priv->vif = conf->vif;
+
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+       for (i = 0; i < ETH_ALEN; i++)
+               rtl818x_iowrite8(priv, &priv->map->MAC[i],
+                                ((u8 *)conf->mac_addr)[i]);
+       rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 
+       mutex_unlock(&priv->conf_mutex);
        return 0;
 }
 
@@ -475,62 +864,121 @@ static void rtl8187_remove_interface(struct ieee80211_hw *dev,
                                     struct ieee80211_if_init_conf *conf)
 {
        struct rtl8187_priv *priv = dev->priv;
-       priv->mode = IEEE80211_IF_TYPE_MGMT;
+       mutex_lock(&priv->conf_mutex);
+       priv->mode = IEEE80211_IF_TYPE_MNTR;
+       priv->vif = NULL;
+       mutex_unlock(&priv->conf_mutex);
 }
 
 static int rtl8187_config(struct ieee80211_hw *dev, struct ieee80211_conf *conf)
 {
        struct rtl8187_priv *priv = dev->priv;
-       rtl8187_set_channel(dev, conf->channel);
+       u32 reg;
 
-       rtl818x_iowrite8(priv, &priv->map->SIFS, 0x22);
+       mutex_lock(&priv->conf_mutex);
+       reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
+       /* Enable TX loopback on MAC level to avoid TX during channel
+        * changes, as this has be seen to causes problems and the
+        * card will stop work until next reset
+        */
+       rtl818x_iowrite32(priv, &priv->map->TX_CONF,
+                         reg | RTL818X_TX_CONF_LOOPBACK_MAC);
+       msleep(10);
+       priv->rf->set_chan(dev, conf);
+       msleep(10);
+       rtl818x_iowrite32(priv, &priv->map->TX_CONF, reg);
 
-       if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME) {
-               rtl818x_iowrite8(priv, &priv->map->SLOT, 0x9);
-               rtl818x_iowrite8(priv, &priv->map->DIFS, 0x14);
-               rtl818x_iowrite8(priv, &priv->map->EIFS, 91 - 0x14);
-               rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0x73);
-       } else {
-               rtl818x_iowrite8(priv, &priv->map->SLOT, 0x14);
-               rtl818x_iowrite8(priv, &priv->map->DIFS, 0x24);
-               rtl818x_iowrite8(priv, &priv->map->EIFS, 91 - 0x24);
-               rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0xa5);
+       if (!priv->is_rtl8187b) {
+               rtl818x_iowrite8(priv, &priv->map->SIFS, 0x22);
+
+               if (conf->flags & IEEE80211_CONF_SHORT_SLOT_TIME) {
+                       rtl818x_iowrite8(priv, &priv->map->SLOT, 0x9);
+                       rtl818x_iowrite8(priv, &priv->map->DIFS, 0x14);
+                       rtl818x_iowrite8(priv, &priv->map->EIFS, 91 - 0x14);
+                       rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0x73);
+               } else {
+                       rtl818x_iowrite8(priv, &priv->map->SLOT, 0x14);
+                       rtl818x_iowrite8(priv, &priv->map->DIFS, 0x24);
+                       rtl818x_iowrite8(priv, &priv->map->EIFS, 91 - 0x24);
+                       rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0xa5);
+               }
        }
 
        rtl818x_iowrite16(priv, &priv->map->ATIM_WND, 2);
        rtl818x_iowrite16(priv, &priv->map->ATIMTR_INTERVAL, 100);
        rtl818x_iowrite16(priv, &priv->map->BEACON_INTERVAL, 100);
        rtl818x_iowrite16(priv, &priv->map->BEACON_INTERVAL_TIME, 100);
+       mutex_unlock(&priv->conf_mutex);
        return 0;
 }
 
-static int rtl8187_config_interface(struct ieee80211_hw *dev, int if_id,
+static int rtl8187_config_interface(struct ieee80211_hw *dev,
+                                   struct ieee80211_vif *vif,
                                    struct ieee80211_if_conf *conf)
 {
        struct rtl8187_priv *priv = dev->priv;
        int i;
+       u8 reg;
 
-       priv->if_id = if_id;
-
+       mutex_lock(&priv->conf_mutex);
        for (i = 0; i < ETH_ALEN; i++)
                rtl818x_iowrite8(priv, &priv->map->BSSID[i], conf->bssid[i]);
 
-       if (is_valid_ether_addr(conf->bssid))
-               rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_INFRA);
-       else
-               rtl818x_iowrite8(priv, &priv->map->MSR, RTL818X_MSR_NO_LINK);
+       if (is_valid_ether_addr(conf->bssid)) {
+               reg = RTL818X_MSR_INFRA;
+               if (priv->is_rtl8187b)
+                       reg |= RTL818X_MSR_ENEDCA;
+               rtl818x_iowrite8(priv, &priv->map->MSR, reg);
+       } else {
+               reg = RTL818X_MSR_NO_LINK;
+               rtl818x_iowrite8(priv, &priv->map->MSR, reg);
+       }
 
+       mutex_unlock(&priv->conf_mutex);
        return 0;
 }
 
+static void rtl8187_configure_filter(struct ieee80211_hw *dev,
+                                    unsigned int changed_flags,
+                                    unsigned int *total_flags,
+                                    int mc_count, struct dev_addr_list *mclist)
+{
+       struct rtl8187_priv *priv = dev->priv;
+
+       if (changed_flags & FIF_FCSFAIL)
+               priv->rx_conf ^= RTL818X_RX_CONF_FCS;
+       if (changed_flags & FIF_CONTROL)
+               priv->rx_conf ^= RTL818X_RX_CONF_CTRL;
+       if (changed_flags & FIF_OTHER_BSS)
+               priv->rx_conf ^= RTL818X_RX_CONF_MONITOR;
+       if (*total_flags & FIF_ALLMULTI || mc_count > 0)
+               priv->rx_conf |= RTL818X_RX_CONF_MULTICAST;
+       else
+               priv->rx_conf &= ~RTL818X_RX_CONF_MULTICAST;
+
+       *total_flags = 0;
+
+       if (priv->rx_conf & RTL818X_RX_CONF_FCS)
+               *total_flags |= FIF_FCSFAIL;
+       if (priv->rx_conf & RTL818X_RX_CONF_CTRL)
+               *total_flags |= FIF_CONTROL;
+       if (priv->rx_conf & RTL818X_RX_CONF_MONITOR)
+               *total_flags |= FIF_OTHER_BSS;
+       if (priv->rx_conf & RTL818X_RX_CONF_MULTICAST)
+               *total_flags |= FIF_ALLMULTI;
+
+       rtl818x_iowrite32_async(priv, &priv->map->RX_CONF, priv->rx_conf);
+}
+
 static const struct ieee80211_ops rtl8187_ops = {
        .tx                     = rtl8187_tx,
-       .open                   = rtl8187_open,
+       .start                  = rtl8187_start,
        .stop                   = rtl8187_stop,
        .add_interface          = rtl8187_add_interface,
        .remove_interface       = rtl8187_remove_interface,
        .config                 = rtl8187_config,
        .config_interface       = rtl8187_config_interface,
+       .configure_filter       = rtl8187_configure_filter,
 };
 
 static void rtl8187_eeprom_register_read(struct eeprom_93cx6 *eeprom)
@@ -572,6 +1020,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        struct rtl8187_priv *priv;
        struct eeprom_93cx6 eeprom;
        struct ieee80211_channel *channel;
+       const char *chip_name;
        u16 txpwr, reg;
        int err, i;
        DECLARE_MAC_BUF(mac);
@@ -583,6 +1032,7 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        }
 
        priv = dev->priv;
+       priv->is_rtl8187b = (id->driver_info == DEVICE_RTL8187B);
 
        SET_IEEE80211_DEV(dev, &intf->dev);
        usb_set_intfdata(intf, dev);
@@ -591,30 +1041,25 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        usb_get_dev(udev);
 
        skb_queue_head_init(&priv->rx_queue);
+
+       BUILD_BUG_ON(sizeof(priv->channels) != sizeof(rtl818x_channels));
+       BUILD_BUG_ON(sizeof(priv->rates) != sizeof(rtl818x_rates));
+
        memcpy(priv->channels, rtl818x_channels, sizeof(rtl818x_channels));
        memcpy(priv->rates, rtl818x_rates, sizeof(rtl818x_rates));
        priv->map = (struct rtl818x_csr *)0xFF00;
-       priv->modes[0].mode = MODE_IEEE80211G;
-       priv->modes[0].num_rates = ARRAY_SIZE(rtl818x_rates);
-       priv->modes[0].rates = priv->rates;
-       priv->modes[0].num_channels = ARRAY_SIZE(rtl818x_channels);
-       priv->modes[0].channels = priv->channels;
-       priv->modes[1].mode = MODE_IEEE80211B;
-       priv->modes[1].num_rates = 4;
-       priv->modes[1].rates = priv->rates;
-       priv->modes[1].num_channels = ARRAY_SIZE(rtl818x_channels);
-       priv->modes[1].channels = priv->channels;
-       priv->mode = IEEE80211_IF_TYPE_MGMT;
+
+       priv->band.band = IEEE80211_BAND_2GHZ;
+       priv->band.channels = priv->channels;
+       priv->band.n_channels = ARRAY_SIZE(rtl818x_channels);
+       priv->band.bitrates = priv->rates;
+       priv->band.n_bitrates = ARRAY_SIZE(rtl818x_rates);
+       dev->wiphy->bands[IEEE80211_BAND_2GHZ] = &priv->band;
+
+
+       priv->mode = IEEE80211_IF_TYPE_MNTR;
        dev->flags = IEEE80211_HW_HOST_BROADCAST_PS_BUFFERING |
                     IEEE80211_HW_RX_INCLUDES_FCS;
-       dev->extra_tx_headroom = sizeof(struct rtl8187_tx_hdr);
-       dev->queues = 1;
-       dev->max_rssi = 65;
-       dev->max_signal = 64;
-
-       for (i = 0; i < 2; i++)
-               if ((err = ieee80211_register_hwmode(dev, &priv->modes[i])))
-                       goto err_free_dev;
 
        eeprom.data = dev;
        eeprom.register_read = rtl8187_eeprom_register_read;
@@ -639,53 +1084,129 @@ static int __devinit rtl8187_probe(struct usb_interface *intf,
        for (i = 0; i < 3; i++) {
                eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_1 + i,
                                  &txpwr);
-               (*channel++).val = txpwr & 0xFF;
-               (*channel++).val = txpwr >> 8;
+               (*channel++).hw_value = txpwr & 0xFF;
+               (*channel++).hw_value = txpwr >> 8;
        }
        for (i = 0; i < 2; i++) {
                eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_4 + i,
                                  &txpwr);
-               (*channel++).val = txpwr & 0xFF;
-               (*channel++).val = txpwr >> 8;
-       }
-       for (i = 0; i < 2; i++) {
-               eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_6 + i,
-                                 &txpwr);
-               (*channel++).val = txpwr & 0xFF;
-               (*channel++).val = txpwr >> 8;
+               (*channel++).hw_value = txpwr & 0xFF;
+               (*channel++).hw_value = txpwr >> 8;
        }
 
        eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_BASE,
                          &priv->txpwr_base);
 
-       reg = rtl818x_ioread16(priv, &priv->map->PGSELECT) & ~1;
-       rtl818x_iowrite16(priv, &priv->map->PGSELECT, reg | 1);
+       reg = rtl818x_ioread8(priv, &priv->map->PGSELECT) & ~1;
+       rtl818x_iowrite8(priv, &priv->map->PGSELECT, reg | 1);
        /* 0 means asic B-cut, we should use SW 3 wire
         * bit-by-bit banging for radio. 1 means we can use
         * USB specific request to write radio registers */
        priv->asic_rev = rtl818x_ioread8(priv, (u8 *)0xFFFE) & 0x3;
-       rtl818x_iowrite16(priv, &priv->map->PGSELECT, reg);
+       rtl818x_iowrite8(priv, &priv->map->PGSELECT, reg);
        rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
 
-       rtl8225_write(dev, 0, 0x1B7);
+       if (!priv->is_rtl8187b) {
+               u32 reg32;
+               reg32 = rtl818x_ioread32(priv, &priv->map->TX_CONF);
+               reg32 &= RTL818X_TX_CONF_HWVER_MASK;
+               switch (reg32) {
+               case RTL818X_TX_CONF_R8187vD_B:
+                       /* Some RTL8187B devices have a USB ID of 0x8187
+                        * detect them here */
+                       chip_name = "RTL8187BvB(early)";
+                       priv->is_rtl8187b = 1;
+                       priv->hw_rev = RTL8187BvB;
+                       break;
+               case RTL818X_TX_CONF_R8187vD:
+                       chip_name = "RTL8187vD";
+                       break;
+               default:
+                       chip_name = "RTL8187vB (default)";
+               }
+       } else {
+               /*
+                * Force USB request to write radio registers for 8187B, Realtek
+                * only uses it in their sources
+                */
+               /*if (priv->asic_rev == 0) {
+                       printk(KERN_WARNING "rtl8187: Forcing use of USB "
+                              "requests to write to radio registers\n");
+                       priv->asic_rev = 1;
+               }*/
+               switch (rtl818x_ioread8(priv, (u8 *)0xFFE1)) {
+               case RTL818X_R8187B_B:
+                       chip_name = "RTL8187BvB";
+                       priv->hw_rev = RTL8187BvB;
+                       break;
+               case RTL818X_R8187B_D:
+                       chip_name = "RTL8187BvD";
+                       priv->hw_rev = RTL8187BvD;
+                       break;
+               case RTL818X_R8187B_E:
+                       chip_name = "RTL8187BvE";
+                       priv->hw_rev = RTL8187BvE;
+                       break;
+               default:
+                       chip_name = "RTL8187BvB (default)";
+                       priv->hw_rev = RTL8187BvB;
+               }
+       }
+
+       if (!priv->is_rtl8187b) {
+               for (i = 0; i < 2; i++) {
+                       eeprom_93cx6_read(&eeprom,
+                                         RTL8187_EEPROM_TXPWR_CHAN_6 + i,
+                                         &txpwr);
+                       (*channel++).hw_value = txpwr & 0xFF;
+                       (*channel++).hw_value = txpwr >> 8;
+               }
+       } else {
+               eeprom_93cx6_read(&eeprom, RTL8187_EEPROM_TXPWR_CHAN_6,
+                                 &txpwr);
+               (*channel++).hw_value = txpwr & 0xFF;
+
+               eeprom_93cx6_read(&eeprom, 0x0A, &txpwr);
+               (*channel++).hw_value = txpwr & 0xFF;
 
-       if (rtl8225_read(dev, 8) != 0x588 || rtl8225_read(dev, 9) != 0x700)
-               priv->rf_init = rtl8225_rf_init;
-       else
-               priv->rf_init = rtl8225z2_rf_init;
+               eeprom_93cx6_read(&eeprom, 0x1C, &txpwr);
+               (*channel++).hw_value = txpwr & 0xFF;
+               (*channel++).hw_value = txpwr >> 8;
+       }
+
+       if (priv->is_rtl8187b) {
+               printk(KERN_WARNING "rtl8187: 8187B chip detected. Support "
+                       "is EXPERIMENTAL, and could damage your\n"
+                       "         hardware, use at your own risk\n");
+               dev->flags |= IEEE80211_HW_SIGNAL_DBM;
+       } else {
+               dev->flags |= IEEE80211_HW_SIGNAL_UNSPEC;
+               dev->max_signal = 65;
+       }
+
+       if ((id->driver_info == DEVICE_RTL8187) && priv->is_rtl8187b)
+               printk(KERN_INFO "rtl8187: inconsistency between id with OEM"
+                      " info!\n");
 
-       rtl8225_write(dev, 0, 0x0B7);
+       priv->rf = rtl8187_detect_rf(dev);
+       dev->extra_tx_headroom = (!priv->is_rtl8187b) ?
+                                 sizeof(struct rtl8187_tx_hdr) :
+                                 sizeof(struct rtl8187b_tx_hdr);
+       if (!priv->is_rtl8187b)
+               dev->queues = 1;
+       else
+               dev->queues = 4;
 
        err = ieee80211_register_hw(dev);
        if (err) {
                printk(KERN_ERR "rtl8187: Cannot register device\n");
                goto err_free_dev;
        }
+       mutex_init(&priv->conf_mutex);
 
-       printk(KERN_INFO "%s: hwaddr %s, rtl8187 V%d + %s\n",
+       printk(KERN_INFO "%s: hwaddr %s, %s V%d + %s\n",
               wiphy_name(dev->wiphy), print_mac(mac, dev->wiphy->perm_addr),
-              priv->asic_rev, priv->rf_init == rtl8225_rf_init ?
-              "rtl8225" : "rtl8225z2");
+              chip_name, priv->asic_rev, priv->rf->name);
 
        return 0;
 
@@ -715,7 +1236,7 @@ static struct usb_driver rtl8187_driver = {
        .name           = KBUILD_MODNAME,
        .id_table       = rtl8187_table,
        .probe          = rtl8187_probe,
-       .disconnect     = rtl8187_disconnect,
+       .disconnect     = __devexit_p(rtl8187_disconnect),
 };
 
 static int __init rtl8187_init(void)