[rtl818x] Add driver for Realtek 8180/8185 wireless cards

10 files changed, 2607 insertions, 0 deletions

diff --git a/src/Makefile b/src/Makefile
index 55d99ccf..b246faae 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -61,6 +61,7 @@ SRCDIRS		+= drivers/bus
 SRCDIRS		+= drivers/net
 SRCDIRS		+= drivers/net/e1000
 SRCDIRS		+= drivers/net/phantom
+SRCDIRS		+= drivers/net/rtl818x
 SRCDIRS		+= drivers/block
 SRCDIRS		+= drivers/nvs
 SRCDIRS		+= drivers/bitbash
diff --git a/src/drivers/net/rtl818x/rtl8180.c b/src/drivers/net/rtl818x/rtl8180.c
new file mode 100644
index 00000000..472ea207
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl8180.c
@@ -0,0 +1,17 @@
+/* Realtek 8180 card: rtl818x driver + rtl8180 RF modules */
+
+FILE_LICENCE(GPL2_OR_LATER);
+
+#include <gpxe/pci.h>
+
+REQUIRE_OBJECT(rtl818x);
+REQUIRE_OBJECT(rtl8180_grf5101);
+REQUIRE_OBJECT(rtl8180_max2820);
+REQUIRE_OBJECT(rtl8180_sa2400);
+
+static struct pci_device_id rtl8180_nics[] __unused = {
+	PCI_ROM(0x10ec, 0x8180, "rtl8180", "Realtek 8180", 0),
+	PCI_ROM(0x1799, 0x6001, "f5d6001", "Belkin F5D6001", 0),
+	PCI_ROM(0x1799, 0x6020, "f5d6020", "Belkin F5D6020", 0),
+	PCI_ROM(0x1186, 0x3300, "dwl510",  "D-Link DWL-510", 0),
+};
diff --git a/src/drivers/net/rtl818x/rtl8180_grf5101.c b/src/drivers/net/rtl818x/rtl8180_grf5101.c
new file mode 100644
index 00000000..036a4f8a
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl8180_grf5101.c
@@ -0,0 +1,186 @@
+/*
+ * Radio tuning for GCT GRF5101 on RTL8180
+ *
+ * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Modified slightly for gPXE, June 2009 by Joshua Oreman.
+ *
+ * Code from the BSD driver and the rtl8181 project have been
+ * very useful to understand certain things
+ *
+ * I want to thanks the Authors of such projects and the Ndiswrapper
+ * project Authors.
+ *
+ * A special Big Thanks also is for all people who donated me cards,
+ * making possible the creation of the original rtl8180 driver
+ * from which this code is derived!
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <unistd.h>
+#include <gpxe/pci.h>
+#include <gpxe/net80211.h>
+
+#include "rtl818x.h"
+
+FILE_LICENCE(GPL2_ONLY);
+
+#define GRF5101_ANTENNA 0xA3
+
+static const int grf5101_encode[] = {
+	0x0, 0x8, 0x4, 0xC,
+	0x2, 0xA, 0x6, 0xE,
+	0x1, 0x9, 0x5, 0xD,
+	0x3, 0xB, 0x7, 0xF
+};
+
+static void write_grf5101(struct net80211_device *dev, u8 addr, u32 data)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u32 phy_config;
+
+	phy_config =  grf5101_encode[(data >> 8) & 0xF];
+	phy_config |= grf5101_encode[(data >> 4) & 0xF] << 4;
+	phy_config |= grf5101_encode[data & 0xF] << 8;
+	phy_config |= grf5101_encode[(addr >> 1) & 0xF] << 12;
+	phy_config |= (addr & 1) << 16;
+	phy_config |= grf5101_encode[(data & 0xf000) >> 12] << 24;
+
+	/* MAC will bang bits to the chip */
+	phy_config |= 0x90000000;
+
+	/* This was originally a 32-bit write to a typecast
+	   RFPinsOutput, but gcc complained about aliasing rules. -JBO */
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, phy_config & 0xffff);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, phy_config >> 16);
+
+	mdelay(3);
+}
+
+static void grf5101_write_phy_antenna(struct net80211_device *dev, short chan)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 ant = GRF5101_ANTENNA;
+
+	if (priv->rfparam & RF_PARAM_ANTBDEFAULT)
+		ant |= BB_ANTENNA_B;
+
+	if (chan == 14)
+		ant |= BB_ANTATTEN_CHAN14;
+
+	rtl818x_write_phy(dev, 0x10, ant);
+}
+
+static void grf5101_rf_set_channel(struct net80211_device *dev,
+				   struct net80211_channel *channelp)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int channel = channelp->channel_nr;
+	u32 txpw = priv->txpower[channel - 1] & 0xFF;
+	u32 chan = channel - 1;
+
+	/* set TX power */
+	write_grf5101(dev, 0x15, 0x0);
+	write_grf5101(dev, 0x06, txpw);
+	write_grf5101(dev, 0x15, 0x10);
+	write_grf5101(dev, 0x15, 0x0);
+
+	/* set frequency */
+	write_grf5101(dev, 0x07, 0x0);
+	write_grf5101(dev, 0x0B, chan);
+	write_grf5101(dev, 0x07, 0x1000);
+
+	grf5101_write_phy_antenna(dev, channel);
+}
+
+static void grf5101_rf_stop(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u32 anaparam;
+
+	anaparam = priv->anaparam;
+	anaparam &= 0x000fffff;
+	anaparam |= 0x3f900000;
+	rtl818x_set_anaparam(priv, anaparam);
+
+	write_grf5101(dev, 0x07, 0x0);
+	write_grf5101(dev, 0x1f, 0x45);
+	write_grf5101(dev, 0x1f, 0x5);
+	write_grf5101(dev, 0x00, 0x8e4);
+}
+
+static void grf5101_rf_init(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+
+	rtl818x_set_anaparam(priv, priv->anaparam);
+
+	write_grf5101(dev, 0x1f, 0x0);
+	write_grf5101(dev, 0x1f, 0x0);
+	write_grf5101(dev, 0x1f, 0x40);
+	write_grf5101(dev, 0x1f, 0x60);
+	write_grf5101(dev, 0x1f, 0x61);
+	write_grf5101(dev, 0x1f, 0x61);
+	write_grf5101(dev, 0x00, 0xae4);
+	write_grf5101(dev, 0x1f, 0x1);
+	write_grf5101(dev, 0x1f, 0x41);
+	write_grf5101(dev, 0x1f, 0x61);
+
+	write_grf5101(dev, 0x01, 0x1a23);
+	write_grf5101(dev, 0x02, 0x4971);
+	write_grf5101(dev, 0x03, 0x41de);
+	write_grf5101(dev, 0x04, 0x2d80);
+	write_grf5101(dev, 0x05, 0x68ff);	/* 0x61ff original value */
+	write_grf5101(dev, 0x06, 0x0);
+	write_grf5101(dev, 0x07, 0x0);
+	write_grf5101(dev, 0x08, 0x7533);
+	write_grf5101(dev, 0x09, 0xc401);
+	write_grf5101(dev, 0x0a, 0x0);
+	write_grf5101(dev, 0x0c, 0x1c7);
+	write_grf5101(dev, 0x0d, 0x29d3);
+	write_grf5101(dev, 0x0e, 0x2e8);
+	write_grf5101(dev, 0x10, 0x192);
+	write_grf5101(dev, 0x11, 0x248);
+	write_grf5101(dev, 0x12, 0x0);
+	write_grf5101(dev, 0x13, 0x20c4);
+	write_grf5101(dev, 0x14, 0xf4fc);
+	write_grf5101(dev, 0x15, 0x0);
+	write_grf5101(dev, 0x16, 0x1500);
+
+	write_grf5101(dev, 0x07, 0x1000);
+
+	/* baseband configuration */
+	rtl818x_write_phy(dev, 0, 0xa8);
+	rtl818x_write_phy(dev, 3, 0x0);
+	rtl818x_write_phy(dev, 4, 0xc0);
+	rtl818x_write_phy(dev, 5, 0x90);
+	rtl818x_write_phy(dev, 6, 0x1e);
+	rtl818x_write_phy(dev, 7, 0x64);
+
+	grf5101_write_phy_antenna(dev, 1);
+
+	rtl818x_write_phy(dev, 0x11, 0x88);
+
+	if (rtl818x_ioread8(priv, &priv->map->CONFIG2) &
+	    RTL818X_CONFIG2_ANTENNA_DIV)
+		rtl818x_write_phy(dev, 0x12, 0xc0); /* enable ant diversity */
+	else
+		rtl818x_write_phy(dev, 0x12, 0x40); /* disable ant diversity */
+
+	rtl818x_write_phy(dev, 0x13, 0x90 | priv->csthreshold);
+
+	rtl818x_write_phy(dev, 0x19, 0x0);
+	rtl818x_write_phy(dev, 0x1a, 0xa0);
+	rtl818x_write_phy(dev, 0x1b, 0x44);
+}
+
+struct rtl818x_rf_ops grf5101_rf_ops __rtl818x_rf_driver = {
+	.name		= "GCT GRF5101",
+	.id             = 5,
+	.init		= grf5101_rf_init,
+	.stop		= grf5101_rf_stop,
+	.set_chan	= grf5101_rf_set_channel
+};
diff --git a/src/drivers/net/rtl818x/rtl8180_max2820.c b/src/drivers/net/rtl818x/rtl8180_max2820.c
new file mode 100644
index 00000000..7c9495f9
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl8180_max2820.c
@@ -0,0 +1,158 @@
+/*
+ * Radio tuning for Maxim max2820 on RTL8180
+ *
+ * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Modified slightly for gPXE, June 2009 by Joshua Oreman.
+ *
+ * Code from the BSD driver and the rtl8181 project have been
+ * very useful to understand certain things
+ *
+ * I want to thanks the Authors of such projects and the Ndiswrapper
+ * project Authors.
+ *
+ * A special Big Thanks also is for all people who donated me cards,
+ * making possible the creation of the original rtl8180 driver
+ * from which this code is derived!
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <unistd.h>
+#include <gpxe/pci.h>
+#include <gpxe/net80211.h>
+
+#include "rtl818x.h"
+
+FILE_LICENCE(GPL2_ONLY);
+
+#define MAXIM_ANTENNA 0xb3
+
+static const u32 max2820_chan[] = {
+	12, /* CH 1 */
+	17,
+	22,
+	27,
+	32,
+	37,
+	42,
+	47,
+	52,
+	57,
+	62,
+	67,
+	72,
+	84, /* CH 14 */
+};
+
+static void write_max2820(struct net80211_device *dev, u8 addr, u32 data)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u32 phy_config;
+
+	phy_config = 0x90 + (data & 0xf);
+	phy_config <<= 16;
+	phy_config += addr;
+	phy_config <<= 8;
+	phy_config += (data >> 4) & 0xff;
+
+	/* This was originally a 32-bit write to a typecast
+	   RFPinsOutput, but gcc complained about aliasing rules. -JBO */
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, phy_config & 0xffff);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, phy_config >> 16);
+
+	mdelay(1);
+}
+
+static void max2820_write_phy_antenna(struct net80211_device *dev, short chan)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 ant;
+
+	ant = MAXIM_ANTENNA;
+	if (priv->rfparam & RF_PARAM_ANTBDEFAULT)
+		ant |= BB_ANTENNA_B;
+	if (chan == 14)
+		ant |= BB_ANTATTEN_CHAN14;
+
+	rtl818x_write_phy(dev, 0x10, ant);
+}
+
+static void max2820_rf_set_channel(struct net80211_device *dev,
+				   struct net80211_channel *channelp)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int channel = channelp->channel_nr;
+	unsigned int chan_idx = channel - 1;
+	u32 txpw = priv->txpower[chan_idx] & 0xFF;
+	u32 chan = max2820_chan[chan_idx];
+
+	/* While philips SA2400 drive the PA bias from
+	 * sa2400, for MAXIM we do this directly from BB */
+	rtl818x_write_phy(dev, 3, txpw);
+
+	max2820_write_phy_antenna(dev, channel);
+	write_max2820(dev, 3, chan);
+}
+
+static void max2820_rf_stop(struct net80211_device *dev)
+{
+	rtl818x_write_phy(dev, 3, 0x8);
+	write_max2820(dev, 1, 0);
+}
+
+
+static void max2820_rf_init(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+
+	/* MAXIM from netbsd driver */
+	write_max2820(dev, 0, 0x007); /* test mode as indicated in datasheet */
+	write_max2820(dev, 1, 0x01e); /* enable register */
+	write_max2820(dev, 2, 0x001); /* synt register */
+
+	max2820_rf_set_channel(dev, NULL);
+
+	write_max2820(dev, 4, 0x313); /* rx register */
+
+	/* PA is driven directly by the BB, we keep the MAXIM bias
+	 * at the highest value in case that setting it to lower
+	 * values may introduce some further attenuation somewhere..
+	 */
+	write_max2820(dev, 5, 0x00f);
+
+	/* baseband configuration */
+	rtl818x_write_phy(dev, 0, 0x88); /* sys1       */
+	rtl818x_write_phy(dev, 3, 0x08); /* txagc      */
+	rtl818x_write_phy(dev, 4, 0xf8); /* lnadet     */
+	rtl818x_write_phy(dev, 5, 0x90); /* ifagcinit  */
+	rtl818x_write_phy(dev, 6, 0x1a); /* ifagclimit */
+	rtl818x_write_phy(dev, 7, 0x64); /* ifagcdet   */
+
+	max2820_write_phy_antenna(dev, 1);
+
+	rtl818x_write_phy(dev, 0x11, 0x88); /* trl */
+
+	if (rtl818x_ioread8(priv, &priv->map->CONFIG2) &
+	    RTL818X_CONFIG2_ANTENNA_DIV)
+		rtl818x_write_phy(dev, 0x12, 0xc7);
+	else
+		rtl818x_write_phy(dev, 0x12, 0x47);
+
+	rtl818x_write_phy(dev, 0x13, 0x9b);
+
+	rtl818x_write_phy(dev, 0x19, 0x0);  /* CHESTLIM */
+	rtl818x_write_phy(dev, 0x1a, 0x9f); /* CHSQLIM  */
+
+	max2820_rf_set_channel(dev, NULL);
+}
+
+struct rtl818x_rf_ops max2820_rf_ops __rtl818x_rf_driver = {
+	.name		= "Maxim max2820",
+	.id		= 4,
+	.init		= max2820_rf_init,
+	.stop		= max2820_rf_stop,
+	.set_chan	= max2820_rf_set_channel
+};
diff --git a/src/drivers/net/rtl818x/rtl8180_sa2400.c b/src/drivers/net/rtl818x/rtl8180_sa2400.c
new file mode 100644
index 00000000..bcfd397a
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl8180_sa2400.c
@@ -0,0 +1,217 @@
+/*
+ * Radio tuning for Philips SA2400 on RTL8180
+ *
+ * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Modified slightly for gPXE, June 2009 by Joshua Oreman.
+ *
+ * Code from the BSD driver and the rtl8181 project have been
+ * very useful to understand certain things
+ *
+ * I want to thanks the Authors of such projects and the Ndiswrapper
+ * project Authors.
+ *
+ * A special Big Thanks also is for all people who donated me cards,
+ * making possible the creation of the original rtl8180 driver
+ * from which this code is derived!
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <unistd.h>
+#include <gpxe/pci.h>
+#include <gpxe/net80211.h>
+
+#include "rtl818x.h"
+
+FILE_LICENCE(GPL2_ONLY);
+
+#define SA2400_ANTENNA 0x91
+#define SA2400_DIG_ANAPARAM_PWR1_ON 0x8
+#define SA2400_ANA_ANAPARAM_PWR1_ON 0x28
+#define SA2400_ANAPARAM_PWR0_ON 0x3
+
+/* RX sensitivity in dbm */
+#define SA2400_MAX_SENS 85
+
+#define SA2400_REG4_FIRDAC_SHIFT 7
+
+static const u32 sa2400_chan[] = {
+	0x00096c, /* ch1 */
+	0x080970,
+	0x100974,
+	0x180978,
+	0x000980,
+	0x080984,
+	0x100988,
+	0x18098c,
+	0x000994,
+	0x080998,
+	0x10099c,
+	0x1809a0,
+	0x0009a8,
+	0x0009b4, /* ch 14 */
+};
+
+static void write_sa2400(struct net80211_device *dev, u8 addr, u32 data)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u32 phy_config;
+
+	/* MAC will bang bits to the sa2400. sw 3-wire is NOT used */
+	phy_config = 0xb0000000;
+
+	phy_config |= ((u32)(addr & 0xf)) << 24;
+	phy_config |= data & 0xffffff;
+
+	/* This was originally a 32-bit write to a typecast
+	   RFPinsOutput, but gcc complained about aliasing rules. -JBO */
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, phy_config & 0xffff);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, phy_config >> 16);
+
+	mdelay(3);
+}
+
+static void sa2400_write_phy_antenna(struct net80211_device *dev, short chan)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 ant = SA2400_ANTENNA;
+
+	if (priv->rfparam & RF_PARAM_ANTBDEFAULT)
+		ant |= BB_ANTENNA_B;
+
+	if (chan == 14)
+		ant |= BB_ANTATTEN_CHAN14;
+
+	rtl818x_write_phy(dev, 0x10, ant);
+
+}
+
+static void sa2400_rf_set_channel(struct net80211_device *dev,
+				  struct net80211_channel *channelp)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int channel = channelp->channel_nr;
+	u32 txpw = priv->txpower[channel - 1] & 0xFF;
+	u32 chan = sa2400_chan[channel - 1];
+
+	write_sa2400(dev, 7, txpw);
+
+	sa2400_write_phy_antenna(dev, channel);
+
+	write_sa2400(dev, 0, chan);
+	write_sa2400(dev, 1, 0xbb50);
+	write_sa2400(dev, 2, 0x80);
+	write_sa2400(dev, 3, 0);
+}
+
+static void sa2400_rf_stop(struct net80211_device *dev)
+{
+	write_sa2400(dev, 4, 0);
+}
+
+static void sa2400_rf_init(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u32 anaparam, txconf;
+	u8 firdac;
+	int analogphy = priv->rfparam & RF_PARAM_ANALOGPHY;
+
+	anaparam = priv->anaparam;
+	anaparam &= ~(1 << ANAPARAM_TXDACOFF_SHIFT);
+	anaparam &= ~ANAPARAM_PWR1_MASK;
+	anaparam &= ~ANAPARAM_PWR0_MASK;
+
+	if (analogphy) {
+		anaparam |= SA2400_ANA_ANAPARAM_PWR1_ON << ANAPARAM_PWR1_SHIFT;
+		firdac = 0;
+	} else {
+		anaparam |= (SA2400_DIG_ANAPARAM_PWR1_ON << ANAPARAM_PWR1_SHIFT);
+		anaparam |= (SA2400_ANAPARAM_PWR0_ON << ANAPARAM_PWR0_SHIFT);
+		firdac = 1 << SA2400_REG4_FIRDAC_SHIFT;
+	}
+
+	rtl818x_set_anaparam(priv, anaparam);
+
+	write_sa2400(dev, 0, sa2400_chan[0]);
+	write_sa2400(dev, 1, 0xbb50);
+	write_sa2400(dev, 2, 0x80);
+	write_sa2400(dev, 3, 0);
+	write_sa2400(dev, 4, 0x19340 | firdac);
+	write_sa2400(dev, 5, 0x1dfb | (SA2400_MAX_SENS - 54) << 15);
+	write_sa2400(dev, 4, 0x19348 | firdac); /* calibrate VCO */
+
+	if (!analogphy)
+		write_sa2400(dev, 4, 0x1938c); /*???*/
+
+	write_sa2400(dev, 4, 0x19340 | firdac);
+
+	write_sa2400(dev, 0, sa2400_chan[0]);
+	write_sa2400(dev, 1, 0xbb50);
+	write_sa2400(dev, 2, 0x80);
+	write_sa2400(dev, 3, 0);
+	write_sa2400(dev, 4, 0x19344 | firdac); /* calibrate filter */
+
+	/* new from rtl8180 embedded driver (rtl8181 project) */
+	write_sa2400(dev, 6, 0x13ff | (1 << 23)); /* MANRX */
+	write_sa2400(dev, 8, 0); /* VCO */
+
+	if (analogphy) {
+		rtl818x_set_anaparam(priv, anaparam |
+				     (1 << ANAPARAM_TXDACOFF_SHIFT));
+
+		txconf = rtl818x_ioread32(priv, &priv->map->TX_CONF);
+		rtl818x_iowrite32(priv, &priv->map->TX_CONF,
+			txconf | RTL818X_TX_CONF_LOOPBACK_CONT);
+
+		write_sa2400(dev, 4, 0x19341); /* calibrates DC */
+
+		/* a 5us delay is required here,
+		 * we rely on the 3ms delay introduced in write_sa2400 */
+
+		write_sa2400(dev, 4, 0x19345);
+
+		/* a 20us delay is required here,
+		 * we rely on the 3ms delay introduced in write_sa2400 */
+
+		rtl818x_iowrite32(priv, &priv->map->TX_CONF, txconf);
+
+		rtl818x_set_anaparam(priv, anaparam);
+	}
+	/* end new code */
+
+	write_sa2400(dev, 4, 0x19341 | firdac); /* RTX MODE */
+
+	/* baseband configuration */
+	rtl818x_write_phy(dev, 0, 0x98);
+	rtl818x_write_phy(dev, 3, 0x38);
+	rtl818x_write_phy(dev, 4, 0xe0);
+	rtl818x_write_phy(dev, 5, 0x90);
+	rtl818x_write_phy(dev, 6, 0x1a);
+	rtl818x_write_phy(dev, 7, 0x64);
+
+	sa2400_write_phy_antenna(dev, 1);
+
+	rtl818x_write_phy(dev, 0x11, 0x80);
+
+	if (rtl818x_ioread8(priv, &priv->map->CONFIG2) &
+	    RTL818X_CONFIG2_ANTENNA_DIV)
+		rtl818x_write_phy(dev, 0x12, 0xc7); /* enable ant diversity */
+	else
+		rtl818x_write_phy(dev, 0x12, 0x47); /* disable ant diversity */
+
+	rtl818x_write_phy(dev, 0x13, 0x90 | priv->csthreshold);
+
+	rtl818x_write_phy(dev, 0x19, 0x0);
+	rtl818x_write_phy(dev, 0x1a, 0xa0);
+}
+
+struct rtl818x_rf_ops sa2400_rf_ops __rtl818x_rf_driver = {
+	.name		= "Philips SA2400",
+	.id		= 3,
+	.init		= sa2400_rf_init,
+	.stop		= sa2400_rf_stop,
+	.set_chan	= sa2400_rf_set_channel
+};
diff --git a/src/drivers/net/rtl818x/rtl8185.c b/src/drivers/net/rtl818x/rtl8185.c
new file mode 100644
index 00000000..bfa5ab5c
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl8185.c
@@ -0,0 +1,14 @@
+/* Realtek 8185 card: rtl818x driver + rtl8185_rtl8225 RF module */
+
+FILE_LICENCE(GPL2_OR_LATER);
+
+#include <gpxe/pci.h>
+
+REQUIRE_OBJECT(rtl818x);
+REQUIRE_OBJECT(rtl8185_rtl8225);
+
+static struct pci_device_id rtl8185_nics[] __unused = {
+	PCI_ROM(0x10ec, 0x8185, "rtl8185", "Realtek 8185", 0),
+	PCI_ROM(0x1799, 0x700f, "f5d7000", "Belkin F5D7000", 0),
+	PCI_ROM(0x1799, 0x701f, "f5d7010", "Belkin F5D7010", 0),
+};
diff --git a/src/drivers/net/rtl818x/rtl8185_rtl8225.c b/src/drivers/net/rtl818x/rtl8185_rtl8225.c
new file mode 100644
index 00000000..b3fc186c
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl8185_rtl8225.c
@@ -0,0 +1,804 @@
+/*
+ * Radio tuning for RTL8225 on RTL8185
+ *
+ * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Modified slightly for gPXE, June 2009 by Joshua Oreman
+ *
+ * Based on the r8180 driver, which is:
+ * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ *
+ * Thanks to Realtek for their support!
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#include <unistd.h>
+#include <gpxe/pci.h>
+#include <gpxe/net80211.h>
+
+#include "rtl818x.h"
+
+FILE_LICENCE(GPL2_ONLY);
+
+#define RTL8225_ANAPARAM_ON	0xa0000b59
+#define RTL8225_ANAPARAM2_ON	0x860dec11
+#define RTL8225_ANAPARAM_OFF	0xa00beb59
+#define RTL8225_ANAPARAM2_OFF	0x840dec11
+
+#define min(a,b) (((a)<(b))?(a):(b))
+#define ARRAY_SIZE(a) (int)(sizeof(a)/sizeof((a)[0]))
+
+static inline void rtl8225_write_phy_ofdm(struct net80211_device *dev,
+					  u8 addr, u8 data)
+{
+	rtl818x_write_phy(dev, addr, data);
+}
+
+static inline void rtl8225_write_phy_cck(struct net80211_device *dev,
+					 u8 addr, u8 data)
+{
+	rtl818x_write_phy(dev, addr, data | 0x10000);
+}
+
+static void rtl8225_write(struct net80211_device *dev, u8 addr, u16 data)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u16 reg80, reg84, reg82;
+	u32 bangdata;
+	int i;
+
+	bangdata = (data << 4) | (addr & 0xf);
+
+	reg80 = rtl818x_ioread16(priv, &priv->map->RFPinsOutput) & 0xfff3;
+	reg82 = rtl818x_ioread16(priv, &priv->map->RFPinsEnable);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, reg82 | 0x7);
+
+	reg84 = rtl818x_ioread16(priv, &priv->map->RFPinsSelect);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, reg84 | 0x7 | 0x400);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(10);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(2);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(10);
+
+	for (i = 15; i >= 0; i--) {
+		u16 reg = reg80 | !!(bangdata & (1 << i));
+
+		if (i & 1)
+			rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg);
+
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg | (1 << 1));
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg | (1 << 1));
+
+		if (!(i & 1))
+			rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg);
+	}
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(10);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, reg84 | 0x400);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+}
+
+static u16 rtl8225_read(struct net80211_device *dev, u8 addr)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u16 reg80, reg82, reg84, out;
+	int i;
+
+	reg80 = rtl818x_ioread16(priv, &priv->map->RFPinsOutput);
+	reg82 = rtl818x_ioread16(priv, &priv->map->RFPinsEnable);
+	reg84 = rtl818x_ioread16(priv, &priv->map->RFPinsSelect) | 0x400;
+
+	reg80 &= ~0xF;
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, reg82 | 0x000F);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, reg84 | 0x000F);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80 | (1 << 2));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(4);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg80);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(5);
+
+	for (i = 4; i >= 0; i--) {
+		u16 reg = reg80 | ((addr >> i) & 1);
+
+		if (!(i & 1)) {
+			rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg);
+			rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+			udelay(1);
+		}
+
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg | (1 << 1));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(2);
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg | (1 << 1));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(2);
+
+		if (i & 1) {
+			rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, reg);
+			rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+			udelay(1);
+		}
+	}
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x000E);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0x040E);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+			  reg80 | (1 << 3) | (1 << 1));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(2);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+			  reg80 | (1 << 3));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(2);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+			  reg80 | (1 << 3));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(2);
+
+	out = 0;
+	for (i = 11; i >= 0; i--) {
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg80 | (1 << 3));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(1);
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg80 | (1 << 3) | (1 << 1));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(2);
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg80 | (1 << 3) | (1 << 1));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(2);
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg80 | (1 << 3) | (1 << 1));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(2);
+
+		if (rtl818x_ioread16(priv, &priv->map->RFPinsInput) & (1 << 1))
+			out |= 1 << i;
+
+		rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+				  reg80 | (1 << 3));
+		rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+		udelay(2);
+	}
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput,
+			  reg80 | (1 << 3) | (1 << 2));
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(2);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, reg82);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, reg84);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, 0x03A0);
+
+	return out;
+}
+
+static const u16 rtl8225bcd_rxgain[] = {
+	0x0400, 0x0401, 0x0402, 0x0403, 0x0404, 0x0405, 0x0408, 0x0409,
+	0x040a, 0x040b, 0x0502, 0x0503, 0x0504, 0x0505, 0x0540, 0x0541,
+	0x0542, 0x0543, 0x0544, 0x0545, 0x0580, 0x0581, 0x0582, 0x0583,
+	0x0584, 0x0585, 0x0588, 0x0589, 0x058a, 0x058b, 0x0643, 0x0644,
+	0x0645, 0x0680, 0x0681, 0x0682, 0x0683, 0x0684, 0x0685, 0x0688,
+	0x0689, 0x068a, 0x068b, 0x068c, 0x0742, 0x0743, 0x0744, 0x0745,
+	0x0780, 0x0781, 0x0782, 0x0783, 0x0784, 0x0785, 0x0788, 0x0789,
+	0x078a, 0x078b, 0x078c, 0x078d, 0x0790, 0x0791, 0x0792, 0x0793,
+	0x0794, 0x0795, 0x0798, 0x0799, 0x079a, 0x079b, 0x079c, 0x079d,
+	0x07a0, 0x07a1, 0x07a2, 0x07a3, 0x07a4, 0x07a5, 0x07a8, 0x07a9,
+	0x07aa, 0x07ab, 0x07ac, 0x07ad, 0x07b0, 0x07b1, 0x07b2, 0x07b3,
+	0x07b4, 0x07b5, 0x07b8, 0x07b9, 0x07ba, 0x07bb, 0x07bb
+};
+
+static const u8 rtl8225_agc[] = {
+	0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e, 0x9e,
+	0x9d, 0x9c, 0x9b, 0x9a, 0x99, 0x98, 0x97, 0x96,
+	0x95, 0x94, 0x93, 0x92, 0x91, 0x90, 0x8f, 0x8e,
+	0x8d, 0x8c, 0x8b, 0x8a, 0x89, 0x88, 0x87, 0x86,
+	0x85, 0x84, 0x83, 0x82, 0x81, 0x80, 0x3f, 0x3e,
+	0x3d, 0x3c, 0x3b, 0x3a, 0x39, 0x38, 0x37, 0x36,
+	0x35, 0x34, 0x33, 0x32, 0x31, 0x30, 0x2f, 0x2e,
+	0x2d, 0x2c, 0x2b, 0x2a, 0x29, 0x28, 0x27, 0x26,
+	0x25, 0x24, 0x23, 0x22, 0x21, 0x20, 0x1f, 0x1e,
+	0x1d, 0x1c, 0x1b, 0x1a, 0x19, 0x18, 0x17, 0x16,
+	0x15, 0x14, 0x13, 0x12, 0x11, 0x10, 0x0f, 0x0e,
+	0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08, 0x07, 0x06,
+	0x05, 0x04, 0x03, 0x02, 0x01, 0x01, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01,
+	0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01, 0x01
+};
+
+static const u8 rtl8225_gain[] = {
+	0x23, 0x88, 0x7c, 0xa5, /* -82dbm */
+	0x23, 0x88, 0x7c, 0xb5, /* -82dbm */
+	0x23, 0x88, 0x7c, 0xc5, /* -82dbm */
+	0x33, 0x80, 0x79, 0xc5, /* -78dbm */
+	0x43, 0x78, 0x76, 0xc5, /* -74dbm */
+	0x53, 0x60, 0x73, 0xc5, /* -70dbm */
+	0x63, 0x58, 0x70, 0xc5, /* -66dbm */
+};
+
+static const u8 rtl8225_threshold[] = {
+	0x8d, 0x8d, 0x8d, 0x8d, 0x9d, 0xad, 0xbd
+};
+
+static const u8 rtl8225_tx_gain_cck_ofdm[] = {
+	0x02, 0x06, 0x0e, 0x1e, 0x3e, 0x7e
+};
+
+static const u8 rtl8225_tx_power_cck[] = {
+	0x18, 0x17, 0x15, 0x11, 0x0c, 0x08, 0x04, 0x02,
+	0x1b, 0x1a, 0x17, 0x13, 0x0e, 0x09, 0x04, 0x02,
+	0x1f, 0x1e, 0x1a, 0x15, 0x10, 0x0a, 0x05, 0x02,
+	0x22, 0x21, 0x1d, 0x18, 0x11, 0x0b, 0x06, 0x02,
+	0x26, 0x25, 0x21, 0x1b, 0x14, 0x0d, 0x06, 0x03,
+	0x2b, 0x2a, 0x25, 0x1e, 0x16, 0x0e, 0x07, 0x03
+};
+
+static const u8 rtl8225_tx_power_cck_ch14[] = {
+	0x18, 0x17, 0x15, 0x0c, 0x00, 0x00, 0x00, 0x00,
+	0x1b, 0x1a, 0x17, 0x0e, 0x00, 0x00, 0x00, 0x00,
+	0x1f, 0x1e, 0x1a, 0x0f, 0x00, 0x00, 0x00, 0x00,
+	0x22, 0x21, 0x1d, 0x11, 0x00, 0x00, 0x00, 0x00,
+	0x26, 0x25, 0x21, 0x13, 0x00, 0x00, 0x00, 0x00,
+	0x2b, 0x2a, 0x25, 0x15, 0x00, 0x00, 0x00, 0x00
+};
+
+static const u8 rtl8225_tx_power_ofdm[] = {
+	0x80, 0x90, 0xa2, 0xb5, 0xcb, 0xe4
+};
+
+static const u32 rtl8225_chan[] = {
+	0x085c, 0x08dc, 0x095c, 0x09dc, 0x0a5c, 0x0adc, 0x0b5c,
+	0x0bdc, 0x0c5c, 0x0cdc, 0x0d5c, 0x0ddc, 0x0e5c, 0x0f72
+};
+
+static void rtl8225_rf_set_tx_power(struct net80211_device *dev, int channel)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 cck_power, ofdm_power;
+	const u8 *tmp;
+	u32 reg;
+	int i;
+
+	cck_power = priv->txpower[channel - 1] & 0xFF;
+	ofdm_power = priv->txpower[channel - 1] >> 8;
+
+	cck_power = min(cck_power, (u8)35);
+	ofdm_power = min(ofdm_power, (u8)35);
+
+	rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
+			 rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
+
+	if (channel == 14)
+		tmp = &rtl8225_tx_power_cck_ch14[(cck_power % 6) * 8];
+	else
+		tmp = &rtl8225_tx_power_cck[(cck_power % 6) * 8];
+
+	for (i = 0; i < 8; i++)
+		rtl8225_write_phy_cck(dev, 0x44 + i, *tmp++);
+
+	mdelay(1); /* FIXME: optional? */
+
+	/* anaparam2 on */
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
+	rtl818x_iowrite32(priv, &priv->map->ANAPARAM2, RTL8225_ANAPARAM2_ON);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+
+	rtl818x_iowrite8(priv, &priv->map->TX_GAIN_OFDM,
+			 rtl8225_tx_gain_cck_ofdm[ofdm_power/6] >> 1);
+
+	tmp = &rtl8225_tx_power_ofdm[ofdm_power % 6];
+
+	rtl8225_write_phy_ofdm(dev, 5, *tmp);
+	rtl8225_write_phy_ofdm(dev, 7, *tmp);
+
+	mdelay(1);
+}
+
+static void rtl8225_rf_init(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i;
+
+	rtl818x_set_anaparam(priv, RTL8225_ANAPARAM_ON);
+
+	/* host_pci_init */
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, 0x0480);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0x0488);
+	rtl818x_iowrite8(priv, &priv->map->GP_ENABLE, 0);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	mdelay(200);	/* FIXME: ehh?? */
+	rtl818x_iowrite8(priv, &priv->map->GP_ENABLE, 0xFF & ~(1 << 6));
+
+	rtl818x_iowrite32(priv, &priv->map->RF_TIMING, 0x000a8008);
+
+	/* TODO: check if we need really to change BRSR to do RF config */
+	rtl818x_ioread16(priv, &priv->map->BRSR);
+	rtl818x_iowrite16(priv, &priv->map->BRSR, 0xFFFF);
+	rtl818x_iowrite32(priv, &priv->map->RF_PARA, 0x00100044);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3, 0x44);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+
+	rtl8225_write(dev, 0x0, 0x067);
+	rtl8225_write(dev, 0x1, 0xFE0);
+	rtl8225_write(dev, 0x2, 0x44D);
+	rtl8225_write(dev, 0x3, 0x441);
+	rtl8225_write(dev, 0x4, 0x8BE);
+	rtl8225_write(dev, 0x5, 0xBF0);		/* TODO: minipci */
+	rtl8225_write(dev, 0x6, 0xAE6);
+	rtl8225_write(dev, 0x7, rtl8225_chan[0]);
+	rtl8225_write(dev, 0x8, 0x01F);
+	rtl8225_write(dev, 0x9, 0x334);
+	rtl8225_write(dev, 0xA, 0xFD4);
+	rtl8225_write(dev, 0xB, 0x391);
+	rtl8225_write(dev, 0xC, 0x050);
+	rtl8225_write(dev, 0xD, 0x6DB);
+	rtl8225_write(dev, 0xE, 0x029);
+	rtl8225_write(dev, 0xF, 0x914); mdelay(1);
+
+	rtl8225_write(dev, 0x2, 0xC4D); mdelay(100);
+
+	rtl8225_write(dev, 0x0, 0x127);
+
+	for (i = 0; i < ARRAY_SIZE(rtl8225bcd_rxgain); i++) {
+		rtl8225_write(dev, 0x1, i + 1);
+		rtl8225_write(dev, 0x2, rtl8225bcd_rxgain[i]);
+	}
+
+	rtl8225_write(dev, 0x0, 0x027);
+	rtl8225_write(dev, 0x0, 0x22F);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+
+	for (i = 0; i < ARRAY_SIZE(rtl8225_agc); i++) {
+		rtl8225_write_phy_ofdm(dev, 0xB, rtl8225_agc[i]);
+		mdelay(1);
+		rtl8225_write_phy_ofdm(dev, 0xA, 0x80 + i);
+		mdelay(1);
+	}
+
+	mdelay(1);
+
+	rtl8225_write_phy_ofdm(dev, 0x00, 0x01); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x01, 0x02); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x02, 0x62); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x03, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x04, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x05, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x06, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x07, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x08, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x09, 0xfe); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0a, 0x09); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0b, 0x80); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0c, 0x01); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0e, 0xd3); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0f, 0x38); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x10, 0x84); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x11, 0x03); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x12, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x13, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x14, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x15, 0x40); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x16, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x17, 0x40); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x18, 0xef); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x19, 0x19); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1a, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1b, 0x76); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1c, 0x04); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1e, 0x95); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1f, 0x75); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x20, 0x1f); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x21, 0x27); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x22, 0x16); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x24, 0x46); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x25, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x27, 0x88); mdelay(1);
+
+	rtl8225_write_phy_cck(dev, 0x00, 0x98); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x03, 0x20); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x04, 0x7e); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x05, 0x12); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x06, 0xfc); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x07, 0x78); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x08, 0x2e); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x10, 0x93); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x11, 0x88); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x12, 0x47); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x13, 0xd0);
+	rtl8225_write_phy_cck(dev, 0x19, 0x00);
+	rtl8225_write_phy_cck(dev, 0x1a, 0xa0);
+	rtl8225_write_phy_cck(dev, 0x1b, 0x08);
+	rtl8225_write_phy_cck(dev, 0x40, 0x86);
+	rtl8225_write_phy_cck(dev, 0x41, 0x8d); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x42, 0x15); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x43, 0x18); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x44, 0x1f); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x45, 0x1e); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x46, 0x1a); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x47, 0x15); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x48, 0x10); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x49, 0x0a); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x4a, 0x05); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x4b, 0x02); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x4c, 0x05); mdelay(1);
+
+	rtl818x_iowrite8(priv, &priv->map->TESTR, 0x0D); mdelay(1);
+
+	rtl8225_rf_set_tx_power(dev, 1);
+
+	/* RX antenna default to A */
+	rtl8225_write_phy_cck(dev, 0x10, 0x9b); mdelay(1);	/* B: 0xDB */
+	rtl8225_write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);	/* B: 0x10 */
+
+	rtl818x_iowrite8(priv, &priv->map->TX_ANTENNA, 0x03);	/* B: 0x00 */
+	mdelay(1);
+	rtl818x_iowrite32(priv, (u32 *)((u8 *)priv->map + 0x94), 0x15c00002);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+
+	rtl8225_write(dev, 0x0c, 0x50);
+	/* set OFDM initial gain */
+	rtl8225_write_phy_ofdm(dev, 0x0d, rtl8225_gain[4 * 4]);
+	rtl8225_write_phy_ofdm(dev, 0x23, rtl8225_gain[4 * 4 + 1]);
+	rtl8225_write_phy_ofdm(dev, 0x1b, rtl8225_gain[4 * 4 + 2]);
+	rtl8225_write_phy_ofdm(dev, 0x1d, rtl8225_gain[4 * 4 + 3]);
+	/* set CCK threshold */
+	rtl8225_write_phy_cck(dev, 0x41, rtl8225_threshold[0]);
+}
+
+static const u8 rtl8225z2_tx_power_cck_ch14[] = {
+	0x36, 0x35, 0x2e, 0x1b, 0x00, 0x00, 0x00, 0x00
+};
+
+static const u8 rtl8225z2_tx_power_cck_B[] = {
+	0x30, 0x2f, 0x29, 0x21, 0x19, 0x10, 0x08, 0x04
+};
+
+static const u8 rtl8225z2_tx_power_cck_A[] = {
+	0x33, 0x32, 0x2b, 0x23, 0x1a, 0x11, 0x08, 0x04
+};
+
+static const u8 rtl8225z2_tx_power_cck[] = {
+	0x36, 0x35, 0x2e, 0x25, 0x1c, 0x12, 0x09, 0x04
+};
+
+static void rtl8225z2_rf_set_tx_power(struct net80211_device *dev, int channel)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 cck_power, ofdm_power;
+	const u8 *tmp;
+	int i;
+
+	cck_power = priv->txpower[channel - 1] & 0xFF;
+	ofdm_power = priv->txpower[channel - 1] >> 8;
+
+	if (channel == 14)
+		tmp = rtl8225z2_tx_power_cck_ch14;
+	else if (cck_power == 12)
+		tmp = rtl8225z2_tx_power_cck_B;
+	else if (cck_power == 13)
+		tmp = rtl8225z2_tx_power_cck_A;
+	else
+		tmp = rtl8225z2_tx_power_cck;
+
+	for (i = 0; i < 8; i++)
+		rtl8225_write_phy_cck(dev, 0x44 + i, *tmp++);
+
+	cck_power = min(cck_power, (u8)35);
+	if (cck_power == 13 || cck_power == 14)
+		cck_power = 12;
+	if (cck_power >= 15)
+		cck_power -= 2;
+
+	rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK, cck_power);
+	rtl818x_ioread8(priv, &priv->map->TX_GAIN_CCK);
+	mdelay(1);
+
+	ofdm_power = min(ofdm_power, (u8)35);
+	rtl818x_iowrite8(priv, &priv->map->TX_GAIN_OFDM, ofdm_power);
+
+	rtl8225_write_phy_ofdm(dev, 2, 0x62);
+	rtl8225_write_phy_ofdm(dev, 5, 0x00);
+	rtl8225_write_phy_ofdm(dev, 6, 0x40);
+	rtl8225_write_phy_ofdm(dev, 7, 0x00);
+	rtl8225_write_phy_ofdm(dev, 8, 0x40);
+
+	mdelay(1);
+}
+
+static const u16 rtl8225z2_rxgain[] = {
+	0x0000, 0x0001, 0x0002, 0x0003, 0x0004, 0x0005, 0x0008, 0x0009,
+	0x000a, 0x000b, 0x0102, 0x0103, 0x0104, 0x0105, 0x0140, 0x0141,
+	0x0142, 0x0143, 0x0144, 0x0145, 0x0180, 0x0181, 0x0182, 0x0183,
+	0x0184, 0x0185, 0x0188, 0x0189, 0x018a, 0x018b, 0x0243, 0x0244,
+	0x0245, 0x0280, 0x0281, 0x0282, 0x0283, 0x0284, 0x0285, 0x0288,
+	0x0289, 0x028a, 0x028b, 0x028c, 0x0342, 0x0343, 0x0344, 0x0345,
+	0x0380, 0x0381, 0x0382, 0x0383, 0x0384, 0x0385, 0x0388, 0x0389,
+	0x038a, 0x038b, 0x038c, 0x038d, 0x0390, 0x0391, 0x0392, 0x0393,
+	0x0394, 0x0395, 0x0398, 0x0399, 0x039a, 0x039b, 0x039c, 0x039d,
+	0x03a0, 0x03a1, 0x03a2, 0x03a3, 0x03a4, 0x03a5, 0x03a8, 0x03a9,
+	0x03aa, 0x03ab, 0x03ac, 0x03ad, 0x03b0, 0x03b1, 0x03b2, 0x03b3,
+	0x03b4, 0x03b5, 0x03b8, 0x03b9, 0x03ba, 0x03bb, 0x03bb
+};
+
+static void rtl8225z2_rf_init(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i;
+
+	rtl818x_set_anaparam(priv, RTL8225_ANAPARAM_ON);
+
+	/* host_pci_init */
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, 0x0480);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0x0488);
+	rtl818x_iowrite8(priv, &priv->map->GP_ENABLE, 0);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	mdelay(200);	/* FIXME: ehh?? */
+	rtl818x_iowrite8(priv, &priv->map->GP_ENABLE, 0xFF & ~(1 << 6));
+
+	rtl818x_iowrite32(priv, &priv->map->RF_TIMING, 0x00088008);
+
+	/* TODO: check if we need really to change BRSR to do RF config */
+	rtl818x_ioread16(priv, &priv->map->BRSR);
+	rtl818x_iowrite16(priv, &priv->map->BRSR, 0xFFFF);
+	rtl818x_iowrite32(priv, &priv->map->RF_PARA, 0x00100044);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3, 0x44);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+
+	rtl8225_write(dev, 0x0, 0x0B7); mdelay(1);
+	rtl8225_write(dev, 0x1, 0xEE0); mdelay(1);
+	rtl8225_write(dev, 0x2, 0x44D); mdelay(1);
+	rtl8225_write(dev, 0x3, 0x441); mdelay(1);
+	rtl8225_write(dev, 0x4, 0x8C3); mdelay(1);
+	rtl8225_write(dev, 0x5, 0xC72); mdelay(1);
+	rtl8225_write(dev, 0x6, 0x0E6); mdelay(1);
+	rtl8225_write(dev, 0x7, 0x82A); mdelay(1);
+	rtl8225_write(dev, 0x8, 0x03F); mdelay(1);
+	rtl8225_write(dev, 0x9, 0x335); mdelay(1);
+	rtl8225_write(dev, 0xa, 0x9D4); mdelay(1);
+	rtl8225_write(dev, 0xb, 0x7BB); mdelay(1);
+	rtl8225_write(dev, 0xc, 0x850); mdelay(1);
+	rtl8225_write(dev, 0xd, 0xCDF); mdelay(1);
+	rtl8225_write(dev, 0xe, 0x02B); mdelay(1);
+	rtl8225_write(dev, 0xf, 0x114); mdelay(100);
+
+	if (!(rtl8225_read(dev, 6) & (1 << 7))) {
+		rtl8225_write(dev, 0x02, 0x0C4D);
+		mdelay(200);
+		rtl8225_write(dev, 0x02, 0x044D);
+		mdelay(100);
+		/* TODO: readd calibration failure message when the calibration
+		   check works */
+	}
+
+	rtl8225_write(dev, 0x0, 0x1B7);
+	rtl8225_write(dev, 0x3, 0x002);
+	rtl8225_write(dev, 0x5, 0x004);
+
+	for (i = 0; i < ARRAY_SIZE(rtl8225z2_rxgain); i++) {
+		rtl8225_write(dev, 0x1, i + 1);
+		rtl8225_write(dev, 0x2, rtl8225z2_rxgain[i]);
+	}
+
+	rtl8225_write(dev, 0x0, 0x0B7); mdelay(100);
+	rtl8225_write(dev, 0x2, 0xC4D);
+
+	mdelay(200);
+	rtl8225_write(dev, 0x2, 0x44D);
+	mdelay(100);
+
+	rtl8225_write(dev, 0x00, 0x2BF);
+	rtl8225_write(dev, 0xFF, 0xFFFF);
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+
+	for (i = 0; i < ARRAY_SIZE(rtl8225_agc); i++) {
+		rtl8225_write_phy_ofdm(dev, 0xB, rtl8225_agc[i]);
+		mdelay(1);
+		rtl8225_write_phy_ofdm(dev, 0xA, 0x80 + i);
+		mdelay(1);
+	}
+
+	mdelay(1);
+
+	rtl8225_write_phy_ofdm(dev, 0x00, 0x01); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x01, 0x02); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x02, 0x62); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x03, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x04, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x05, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x06, 0x40); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x07, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x08, 0x40); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x09, 0xfe); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0a, 0x09); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x18, 0xef); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0b, 0x80); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0c, 0x01); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0d, 0x43);
+	rtl8225_write_phy_ofdm(dev, 0x0e, 0xd3); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x0f, 0x38); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x10, 0x84); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x11, 0x06); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x12, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x13, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x14, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x15, 0x40); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x16, 0x00); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x17, 0x40); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x18, 0xef); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x19, 0x19); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1a, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1b, 0x11); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1c, 0x04); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1d, 0xc5); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1e, 0xb3); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x1f, 0x75); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x20, 0x1f); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x21, 0x27); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x22, 0x16); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x23, 0x80); mdelay(1); /* FIXME: not needed? */
+	rtl8225_write_phy_ofdm(dev, 0x24, 0x46); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x25, 0x20); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);
+	rtl8225_write_phy_ofdm(dev, 0x27, 0x88); mdelay(1);
+
+	rtl8225_write_phy_cck(dev, 0x00, 0x98); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x03, 0x20); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x04, 0x7e); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x05, 0x12); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x06, 0xfc); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x07, 0x78); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x08, 0x2e); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x10, 0x93); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x11, 0x88); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x12, 0x47); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x13, 0xd0);
+	rtl8225_write_phy_cck(dev, 0x19, 0x00);
+	rtl8225_write_phy_cck(dev, 0x1a, 0xa0);
+	rtl8225_write_phy_cck(dev, 0x1b, 0x08);
+	rtl8225_write_phy_cck(dev, 0x40, 0x86);
+	rtl8225_write_phy_cck(dev, 0x41, 0x8a); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x42, 0x15); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x43, 0x18); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x44, 0x36); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x45, 0x35); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x46, 0x2e); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x47, 0x25); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x48, 0x1c); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x49, 0x12); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x4a, 0x09); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x4b, 0x04); mdelay(1);
+	rtl8225_write_phy_cck(dev, 0x4c, 0x05); mdelay(1);
+
+	rtl818x_iowrite8(priv, (u8 *)priv->map + 0x5B, 0x0D); mdelay(1);
+
+	rtl8225z2_rf_set_tx_power(dev, 1);
+
+	/* RX antenna default to A */
+	rtl8225_write_phy_cck(dev, 0x10, 0x9b); mdelay(1);	/* B: 0xDB */
+	rtl8225_write_phy_ofdm(dev, 0x26, 0x90); mdelay(1);	/* B: 0x10 */
+
+	rtl818x_iowrite8(priv, &priv->map->TX_ANTENNA, 0x03);	/* B: 0x00 */
+	mdelay(1);
+	rtl818x_iowrite32(priv, (u32 *)((u8 *)priv->map + 0x94), 0x15c00002);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+}
+
+static void rtl8225x_rf_init(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u16 reg8, reg9;
+
+	rtl818x_iowrite16(priv, &priv->map->RFPinsOutput, 0x0480);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsSelect, 0x0488);
+	rtl818x_iowrite16(priv, &priv->map->RFPinsEnable, 0x1FFF);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	mdelay(100);
+
+	rtl8225_write(dev, 0, 0x1B7);
+
+	reg8 = rtl8225_read(dev, 8);
+	reg9 = rtl8225_read(dev, 9);
+
+	rtl8225_write(dev, 0, 0x0B7);
+
+	if (reg8 != 0x588 || reg9 != 0x700) {
+		priv->rf_flag = 0;
+		rtl8225_rf_init(dev);
+	} else {
+		priv->rf_flag = 1;
+		rtl8225z2_rf_init(dev);
+	}
+}
+
+static void rtl8225_rf_stop(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 reg;
+
+	rtl8225_write(dev, 0x4, 0x1f); mdelay(1);
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
+	rtl818x_iowrite32(priv, &priv->map->ANAPARAM2, RTL8225_ANAPARAM2_OFF);
+	rtl818x_iowrite32(priv, &priv->map->ANAPARAM, RTL8225_ANAPARAM_OFF);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+}
+
+static void rtl8225_rf_set_channel(struct net80211_device *dev,
+				   struct net80211_channel *channelp)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int chan = channelp->channel_nr;
+
+	if (priv->rf_flag)
+		rtl8225z2_rf_set_tx_power(dev, chan);
+	else
+		rtl8225_rf_set_tx_power(dev, chan);
+
+	rtl8225_write(dev, 0x7, rtl8225_chan[chan - 1]);
+	mdelay(10);
+}
+
+static void rtl8225_rf_conf_erp(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+
+	if (dev->phy_flags & NET80211_PHY_USE_SHORT_SLOT) {
+		rtl818x_iowrite8(priv, &priv->map->SLOT, 0x9);
+		rtl818x_iowrite8(priv, &priv->map->SIFS, 0x22);
+		rtl818x_iowrite8(priv, &priv->map->DIFS, 0x14);
+		rtl818x_iowrite8(priv, &priv->map->EIFS, 81);
+		rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0x73);
+	} else {
+		rtl818x_iowrite8(priv, &priv->map->SLOT, 0x14);
+		rtl818x_iowrite8(priv, &priv->map->SIFS, 0x44);
+		rtl818x_iowrite8(priv, &priv->map->DIFS, 0x24);
+		rtl818x_iowrite8(priv, &priv->map->EIFS, 81);
+		rtl818x_iowrite8(priv, &priv->map->CW_VAL, 0xa5);
+	}
+}
+
+struct rtl818x_rf_ops rtl8225_ops __rtl818x_rf_driver = {
+	.name		= "rtl8225",
+	.id		= 9,
+	.init		= rtl8225x_rf_init,
+	.stop		= rtl8225_rf_stop,
+	.set_chan	= rtl8225_rf_set_channel,
+	.conf_erp	= rtl8225_rf_conf_erp,
+};
diff --git a/src/drivers/net/rtl818x/rtl818x.c b/src/drivers/net/rtl818x/rtl818x.c
new file mode 100644
index 00000000..8ffe1135
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl818x.c
@@ -0,0 +1,850 @@
+
+/*
+ * Linux device driver for RTL8180 / RTL8185
+ *
+ * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Modified for gPXE, June 2009, by Joshua Oreman <oremanj@rwcr.net>
+ *
+ * Based on the r8180 driver, which is:
+ * Copyright 2004-2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ *
+ * Thanks to Realtek for their support!
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+FILE_LICENCE(GPL2_ONLY);
+
+#include <stdint.h>
+#include <errno.h>
+#include <stdio.h>
+#include <unistd.h>
+#include <byteswap.h>
+#include <gpxe/iobuf.h>
+#include <gpxe/malloc.h>
+#include <gpxe/pci.h>
+#include <gpxe/net80211.h>
+#include <gpxe/netdevice.h>
+#include <gpxe/threewire.h>
+
+#include "rtl818x.h"
+
+/* rtl818x_rates[hw rate number] = rate in 100kbps units */
+static const u16 rtl818x_rates[] = {
+	10, 20, 55, 110, /* 802.11b */
+	60, 90, 120, 180, 240, 360, 480, 540, /* 802.11g */
+	0, 0, 0, 0,		/* index safely using a value masked with 0xF */
+};
+#define RTL818X_NR_B_RATES  4
+#define RTL818X_NR_RATES    12
+
+/* used by RF drivers */
+void rtl818x_write_phy(struct net80211_device *dev, u8 addr, u32 data)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i = 10;
+	u32 buf;
+
+	buf = (data << 8) | addr;
+
+	rtl818x_iowrite32(priv, (u32 *)&priv->map->PHY[0], buf | 0x80);
+	while (i--) {
+		rtl818x_iowrite32(priv, (u32 *)&priv->map->PHY[0], buf);
+		if (rtl818x_ioread8(priv, &priv->map->PHY[2]) == (data & 0xFF))
+			return;
+	}
+}
+
+static void rtl818x_handle_rx(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	unsigned int count = RTL818X_RX_RING_SIZE;
+
+	while (count--) {
+		struct rtl818x_rx_desc *entry = &priv->rx_ring[priv->rx_idx];
+		struct io_buffer *iob = priv->rx_buf[priv->rx_idx];
+		u32 flags = le32_to_cpu(entry->flags);
+
+		if (flags & RTL818X_RX_DESC_FLAG_OWN)
+			return;
+
+		if (flags & (RTL818X_RX_DESC_FLAG_DMA_FAIL |
+			     RTL818X_RX_DESC_FLAG_FOF |
+			     RTL818X_RX_DESC_FLAG_RX_ERR)) {
+			/* This is crappy hardware. The Linux driver
+			   doesn't even log these. */
+			goto done;
+		} else if (flags & RTL818X_RX_DESC_FLAG_CRC32_ERR) {
+			/* This is actually a corrupt packet. */
+			DBG2("rtl818x RX:%d CRC fail: flags %08x\n",
+			     priv->rx_idx, flags);
+			net80211_rx_err(dev, NULL, EIO);
+		} else {
+			u32 flags2 = le32_to_cpu(entry->flags2);
+			struct io_buffer *new_iob = alloc_iob(MAX_RX_SIZE);
+			if (!new_iob) {
+				net80211_rx_err(dev, NULL, ENOMEM);
+				goto done;
+			}
+
+			DBGP("rtl818x RX:%d success: flags %08x %08x\n",
+			     priv->rx_idx, flags, flags2);
+
+			iob_put(iob, flags & 0xFFF);
+
+			net80211_rx(dev, iob, (flags2 >> 8) & 0x7f,
+				    rtl818x_rates[(flags >> 20) & 0xf]);
+
+			iob = new_iob;
+			priv->rx_buf[priv->rx_idx] = iob;
+		}
+
+	done:
+		entry->rx_buf = cpu_to_le32(virt_to_bus(iob->data));
+		entry->flags = cpu_to_le32(RTL818X_RX_DESC_FLAG_OWN | MAX_RX_SIZE);
+
+		if (priv->rx_idx == RTL818X_RX_RING_SIZE - 1)
+			entry->flags |= cpu_to_le32(RTL818X_RX_DESC_FLAG_EOR);
+
+		priv->rx_idx = (priv->rx_idx + 1) % RTL818X_RX_RING_SIZE;
+	}
+}
+
+static void rtl818x_handle_tx(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	unsigned int count = RTL818X_TX_RING_SIZE;
+
+	while (count--) {
+		struct rtl818x_tx_desc *entry = &priv->tx_ring[priv->tx_cons];
+		struct io_buffer *iob = priv->tx_buf[priv->tx_cons];
+		u32 flags = le32_to_cpu(entry->flags);
+		int rc;
+
+		if ((flags & RTL818X_TX_DESC_FLAG_OWN) || !iob)
+			return;
+
+		rc = 0;
+		if (!(flags & RTL818X_TX_DESC_FLAG_TX_OK)) {
+			/* our packet was not ACKed properly */
+			rc = EIO;
+		}
+
+		net80211_tx_complete(dev, iob, flags & 0xFF, rc);
+
+		priv->tx_buf[priv->tx_cons] = NULL;
+		priv->tx_cons = (priv->tx_cons + 1) % RTL818X_TX_RING_SIZE;
+	}
+}
+
+static void rtl818x_poll(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u16 reg = rtl818x_ioread16(priv, &priv->map->INT_STATUS);
+
+	if (reg == 0xFFFF)
+		return;
+
+	rtl818x_iowrite16(priv, &priv->map->INT_STATUS, reg);
+
+	if (reg & (RTL818X_INT_TXN_OK | RTL818X_INT_TXN_ERR))
+		rtl818x_handle_tx(dev);
+
+	if (reg & (RTL818X_INT_RX_OK | RTL818X_INT_RX_ERR))
+		rtl818x_handle_rx(dev);
+}
+
+#define DIV_ROUND_UP(n,d) (((n)+(d)-1)/(d))
+
+static int rtl818x_tx(struct net80211_device *dev, struct io_buffer *iob)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	struct rtl818x_tx_desc *entry;
+	u32 tx_flags;
+	u16 plcp_len = 0;
+	int len = iob_len(iob);
+
+	tx_flags = RTL818X_TX_DESC_FLAG_OWN | RTL818X_TX_DESC_FLAG_FS |
+		RTL818X_TX_DESC_FLAG_LS | (priv->hw_rate << 24) | len;
+
+	if (priv->r8185) {
+		tx_flags |= RTL818X_TX_DESC_FLAG_DMA |
+			    RTL818X_TX_DESC_FLAG_NO_ENC;
+	} else {
+		unsigned int remainder;
+
+		plcp_len = DIV_ROUND_UP(16 * (len + 4),
+					(dev->rates[dev->rate] * 2) / 10);
+		remainder = (16 * (len + 4)) %
+			    ((dev->rates[dev->rate] * 2) / 10);
+
+		if (remainder > 0 && remainder <= 6)
+			plcp_len |= 1 << 15;
+	}
+
+	if (dev->phy_flags & NET80211_PHY_USE_PROTECTION) {
+		tx_flags |= RTL818X_TX_DESC_FLAG_CTS;
+		tx_flags |= priv->hw_rtscts_rate << 19;
+	}
+
+	entry = &priv->tx_ring[priv->tx_prod];
+
+	if (entry->flags & RTL818X_TX_DESC_FLAG_OWN) {
+		/* card hasn't processed the old packet yet! */
+		return -EBUSY;
+	}
+
+	priv->tx_buf[priv->tx_prod] = iob;
+	priv->tx_prod = (priv->tx_prod + 1) % RTL818X_TX_RING_SIZE;
+
+	entry->rts_duration = 0;
+	entry->plcp_len = cpu_to_le16(plcp_len);
+	entry->tx_buf = cpu_to_le32(virt_to_bus(iob->data));
+	entry->frame_len = cpu_to_le32(len);
+	entry->flags2 = /* alternate retry rate in 100kbps << 4 */ 0;
+	entry->retry_limit = RTL818X_MAX_RETRIES;
+	entry->flags = cpu_to_le32(tx_flags);
+
+	rtl818x_iowrite8(priv, &priv->map->TX_DMA_POLLING, (1 << 5));
+
+	return 0;
+}
+
+void rtl818x_set_anaparam(struct rtl818x_priv *priv, u32 anaparam)
+{
+	u8 reg;
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3,
+		 reg | RTL818X_CONFIG3_ANAPARAM_WRITE);
+	rtl818x_iowrite32(priv, &priv->map->ANAPARAM, anaparam);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG3,
+		 reg & ~RTL818X_CONFIG3_ANAPARAM_WRITE);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+}
+
+static int rtl818x_init_hw(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u16 reg;
+
+	rtl818x_iowrite8(priv, &priv->map->CMD, 0);
+	rtl818x_ioread8(priv, &priv->map->CMD);
+	mdelay(10);
+
+	/* reset */
+	rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
+	rtl818x_ioread8(priv, &priv->map->CMD);
+
+	reg = rtl818x_ioread8(priv, &priv->map->CMD);
+	reg &= (1 << 1);
+	reg |= RTL818X_CMD_RESET;
+	rtl818x_iowrite8(priv, &priv->map->CMD, RTL818X_CMD_RESET);
+	rtl818x_ioread8(priv, &priv->map->CMD);
+	mdelay(200);
+
+	/* check success of reset */
+	if (rtl818x_ioread8(priv, &priv->map->CMD) & RTL818X_CMD_RESET) {
+		DBG("rtl818x %s: reset timeout!\n", dev->netdev->name);
+		return -ETIMEDOUT;
+	}
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_LOAD);
+	rtl818x_ioread8(priv, &priv->map->CMD);
+	mdelay(200);
+
+	if (rtl818x_ioread8(priv, &priv->map->CONFIG3) & (1 << 3)) {
+		/* For cardbus */
+		reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+		reg |= 1 << 1;
+		rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg);
+		reg = rtl818x_ioread16(priv, &priv->map->FEMR);
+		reg |= (1 << 15) | (1 << 14) | (1 << 4);
+		rtl818x_iowrite16(priv, &priv->map->FEMR, reg);
+	}
+
+	rtl818x_iowrite8(priv, &priv->map->MSR, 0);
+
+	if (!priv->r8185)
+		rtl818x_set_anaparam(priv, priv->anaparam);
+
+	rtl818x_iowrite32(priv, &priv->map->RDSAR, priv->rx_ring_dma);
+	rtl818x_iowrite32(priv, &priv->map->TNPDA, priv->tx_ring_dma);
+
+	/* TODO: necessary? specs indicate not */
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	reg = rtl818x_ioread8(priv, &priv->map->CONFIG2);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG2, reg & ~(1 << 3));
+	if (priv->r8185) {
+		reg = rtl818x_ioread8(priv, &priv->map->CONFIG2);
+		rtl818x_iowrite8(priv, &priv->map->CONFIG2, reg | (1 << 4));
+	}
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+
+	/* TODO: set CONFIG5 for calibrating AGC on rtl8180 + philips radio? */
+
+	/* TODO: turn off hw wep on rtl8180 */
+
+	rtl818x_iowrite32(priv, &priv->map->INT_TIMEOUT, 0);
+
+	if (priv->r8185) {
+		rtl818x_iowrite8(priv, &priv->map->WPA_CONF, 0);
+		rtl818x_iowrite8(priv, &priv->map->RATE_FALLBACK, 0x81);
+		rtl818x_iowrite8(priv, &priv->map->RESP_RATE, (8 << 4) | 0);
+
+		rtl818x_iowrite16(priv, &priv->map->BRSR, 0x01F3);
+
+		/* TODO: set ClkRun enable? necessary? */
+		reg = rtl818x_ioread8(priv, &priv->map->GP_ENABLE);
+		rtl818x_iowrite8(priv, &priv->map->GP_ENABLE, reg & ~(1 << 6));
+		rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+		reg = rtl818x_ioread8(priv, &priv->map->CONFIG3);
+		rtl818x_iowrite8(priv, &priv->map->CONFIG3, reg | (1 << 2));
+		rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+	} else {
+		rtl818x_iowrite16(priv, &priv->map->BRSR, 0x1);
+		rtl818x_iowrite8(priv, &priv->map->SECURITY, 0);
+
+		rtl818x_iowrite8(priv, &priv->map->PHY_DELAY, 0x6);
+		rtl818x_iowrite8(priv, &priv->map->CARRIER_SENSE_COUNTER, 0x4C);
+	}
+
+	priv->rf->init(dev);
+	if (priv->r8185)
+		rtl818x_iowrite16(priv, &priv->map->BRSR, 0x01F3);
+	return 0;
+}
+
+static int rtl818x_init_rx_ring(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	struct rtl818x_rx_desc *entry;
+	int i;
+
+	priv->rx_ring = malloc_dma(sizeof(*priv->rx_ring) * RTL818X_RX_RING_SIZE,
+				   RTL818X_RING_ALIGN);
+	priv->rx_ring_dma = virt_to_bus(priv->rx_ring);
+	if (!priv->rx_ring) {
+		DBG("rtl818x %s: cannot allocate RX ring\n", dev->netdev->name);
+		return -ENOMEM;
+	}
+
+	memset(priv->rx_ring, 0, sizeof(*priv->rx_ring) * RTL818X_RX_RING_SIZE);
+	priv->rx_idx = 0;
+
+	for (i = 0; i < RTL818X_RX_RING_SIZE; i++) {
+		struct io_buffer *iob = alloc_iob(MAX_RX_SIZE);
+		entry = &priv->rx_ring[i];
+		if (!iob)
+			return -ENOMEM;
+
+		priv->rx_buf[i] = iob;
+		entry->rx_buf = cpu_to_le32(virt_to_bus(iob->data));
+		entry->flags = cpu_to_le32(RTL818X_RX_DESC_FLAG_OWN |
+					   MAX_RX_SIZE);
+	}
+	entry->flags |= cpu_to_le32(RTL818X_RX_DESC_FLAG_EOR);
+	return 0;
+}
+
+static void rtl818x_free_rx_ring(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i;
+
+	for (i = 0; i < RTL818X_RX_RING_SIZE; i++) {
+		free_iob(priv->rx_buf[i]);
+		priv->rx_buf[i] = NULL;
+	}
+
+	free_dma(priv->rx_ring, sizeof(*priv->rx_ring) * RTL818X_RX_RING_SIZE);
+	priv->rx_ring = NULL;
+}
+
+static int rtl818x_init_tx_ring(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i;
+
+	priv->tx_ring = malloc_dma(sizeof(*priv->tx_ring) * RTL818X_TX_RING_SIZE,
+				   RTL818X_RING_ALIGN);
+	priv->tx_ring_dma = virt_to_bus(priv->tx_ring);
+	if (!priv->tx_ring) {
+		DBG("rtl818x %s: cannot allocate TX ring\n", dev->netdev->name);
+		return -ENOMEM;
+	}
+
+	memset(priv->tx_ring, 0, sizeof(*priv->tx_ring) * RTL818X_TX_RING_SIZE);
+	priv->tx_prod = priv->tx_cons = 0;
+
+	for (i = 0; i < RTL818X_TX_RING_SIZE; i++)
+		priv->tx_ring[i].next_tx_desc = cpu_to_le32(priv->tx_ring_dma +
+				((i + 1) % RTL818X_TX_RING_SIZE) * sizeof(*priv->tx_ring));
+
+	return 0;
+}
+
+static void rtl818x_free_tx_ring(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i;
+
+	for (i = 0; i < RTL818X_TX_RING_SIZE; i++) {
+		if (priv->tx_buf[i])
+			net80211_tx_complete(dev, priv->tx_buf[i], 0, ECANCELED);
+		priv->tx_buf[i] = NULL;
+	}
+
+	free_dma(priv->tx_ring, sizeof(*priv->tx_ring) * RTL818X_TX_RING_SIZE);
+	priv->tx_ring = NULL;
+}
+
+static void rtl818x_irq(struct net80211_device *dev, int enable)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	rtl818x_iowrite16(priv, &priv->map->INT_MASK, enable? 0xFFFF : 0);
+}
+
+/* Sets the MAC address of the card. */
+static void rtl818x_set_hwaddr(struct net80211_device *dev, u8 *hwaddr)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	rtl818x_iowrite32(priv, (u32 *)&priv->map->MAC[0],
+			  le32_to_cpu(*(u32 *)hwaddr));
+	rtl818x_iowrite16(priv, (u16 *)&priv->map->MAC[4],
+			  le16_to_cpu(*(u16 *)(hwaddr + 4)));
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+}
+
+static int rtl818x_start(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int ret;
+	u32 reg;
+
+	ret = rtl818x_init_rx_ring(dev);
+	if (ret)
+		return ret;
+
+	ret = rtl818x_init_tx_ring(dev);
+	if (ret)
+		goto err_free_rings;
+
+	ret = rtl818x_init_hw(dev);
+	if (ret)
+		goto err_free_rings;
+
+	rtl818x_set_hwaddr(dev, dev->netdev->ll_addr);
+
+	rtl818x_iowrite32(priv, &priv->map->RDSAR, priv->rx_ring_dma);
+	rtl818x_iowrite32(priv, &priv->map->TNPDA, priv->tx_ring_dma);
+
+	rtl818x_iowrite16(priv, &priv->map->INT_MASK, 0);
+
+	rtl818x_iowrite32(priv, &priv->map->MAR[0], ~0);
+	rtl818x_iowrite32(priv, &priv->map->MAR[1], ~0);
+
+	reg = RTL818X_RX_CONF_ONLYERLPKT |
+	      RTL818X_RX_CONF_RX_AUTORESETPHY |
+	      RTL818X_RX_CONF_MGMT |
+	      RTL818X_RX_CONF_DATA |
+	      (7 << 8 /* MAX RX DMA */) |
+	      RTL818X_RX_CONF_BROADCAST |
+	      RTL818X_RX_CONF_NICMAC;
+
+	if (priv->r8185)
+		reg |= RTL818X_RX_CONF_CSDM1 | RTL818X_RX_CONF_CSDM2;
+	else {
+		reg |= (priv->rfparam & RF_PARAM_CARRIERSENSE1)
+			? RTL818X_RX_CONF_CSDM1 : 0;
+		reg |= (priv->rfparam & RF_PARAM_CARRIERSENSE2)
+			? RTL818X_RX_CONF_CSDM2 : 0;
+	}
+
+	priv->rx_conf = reg;
+	rtl818x_iowrite32(priv, &priv->map->RX_CONF, reg);
+
+	if (priv->r8185) {
+		reg = rtl818x_ioread8(priv, &priv->map->CW_CONF);
+		reg &= ~RTL818X_CW_CONF_PERPACKET_CW_SHIFT;
+		reg |= RTL818X_CW_CONF_PERPACKET_RETRY_SHIFT;
+		rtl818x_iowrite8(priv, &priv->map->CW_CONF, reg);
+
+		reg = rtl818x_ioread8(priv, &priv->map->TX_AGC_CTL);
+		reg &= ~RTL818X_TX_AGC_CTL_PERPACKET_GAIN_SHIFT;
+		reg &= ~RTL818X_TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT;
+		reg |=  RTL818X_TX_AGC_CTL_FEEDBACK_ANT;
+		rtl818x_iowrite8(priv, &priv->map->TX_AGC_CTL, reg);
+
+		/* disable early TX */
+		rtl818x_iowrite8(priv, (u8 *)priv->map + 0xec, 0x3f);
+	}
+
+	reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
+	reg |= (6 << 21 /* MAX TX DMA */) |
+	       RTL818X_TX_CONF_NO_ICV;
+
+	if (priv->r8185)
+		reg &= ~RTL818X_TX_CONF_PROBE_DTS;
+	else
+		reg &= ~RTL818X_TX_CONF_HW_SEQNUM;
+
+	/* different meaning, same value on both rtl8185 and rtl8180 */
+	reg &= ~RTL818X_TX_CONF_SAT_HWPLCP;
+
+	rtl818x_iowrite32(priv, &priv->map->TX_CONF, reg);
+
+	reg = rtl818x_ioread8(priv, &priv->map->CMD);
+	reg |= RTL818X_CMD_RX_ENABLE;
+	reg |= RTL818X_CMD_TX_ENABLE;
+	rtl818x_iowrite8(priv, &priv->map->CMD, reg);
+
+	DBG("%s rtl818x: started\n", dev->netdev->name);
+
+	return 0;
+
+ err_free_rings:
+	rtl818x_free_rx_ring(dev);
+	if (priv->tx_ring)
+		rtl818x_free_tx_ring(dev);
+
+	DBG("%s rtl818x: failed to start\n", dev->netdev->name);
+
+	return ret;
+}
+
+static void rtl818x_stop(struct net80211_device *dev)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	u8 reg;
+
+	rtl818x_irq(dev, 0);
+
+	reg = rtl818x_ioread8(priv, &priv->map->CMD);
+	reg &= ~RTL818X_CMD_TX_ENABLE;
+	reg &= ~RTL818X_CMD_RX_ENABLE;
+	rtl818x_iowrite8(priv, &priv->map->CMD, reg);
+
+	priv->rf->stop(dev);
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_CONFIG);
+	reg = rtl818x_ioread8(priv, &priv->map->CONFIG4);
+	rtl818x_iowrite8(priv, &priv->map->CONFIG4, reg | RTL818X_CONFIG4_VCOOFF);
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+
+	rtl818x_free_rx_ring(dev);
+	rtl818x_free_tx_ring(dev);
+}
+
+static int rtl818x_config(struct net80211_device *dev, int changed)
+{
+	struct rtl818x_priv *priv = dev->priv;
+	int i;
+
+	if (changed & NET80211_CFG_CHANNEL)
+		priv->rf->set_chan(dev, &dev->channels[dev->channel]);
+
+	if (changed & NET80211_CFG_ASSOC) {
+		for (i = 0; i < ETH_ALEN; i++)
+			rtl818x_iowrite8(priv, &priv->map->BSSID[i], dev->bssid[i]);
+		rtl818x_iowrite8(priv, &priv->map->MSR,
+				 dev->state & NET80211_ASSOCIATED?
+					RTL818X_MSR_INFRA : RTL818X_MSR_NO_LINK);
+	}
+
+	if (changed & NET80211_CFG_PHY_PARAMS)
+		priv->rf->conf_erp(dev);
+
+	if (changed & NET80211_CFG_RATE) {
+		/* figure out the hardware rate number for the new
+		   logical rate */
+		int hw_rate;
+		for (hw_rate = 0; hw_rate < RTL818X_NR_RATES &&
+			     rtl818x_rates[hw_rate] != dev->rates[dev->rate];
+		     hw_rate++)
+			;
+		if (hw_rate >= RTL818X_NR_RATES)
+			return -EINVAL;
+
+		priv->hw_rate = hw_rate;
+
+		/* and the RTS/CTS rate */
+		for (hw_rate = 0; hw_rate < RTL818X_NR_RATES &&
+			     rtl818x_rates[hw_rate] !=
+				dev->rates[dev->rtscts_rate];
+		     hw_rate++)
+			;
+		if (hw_rate >= RTL818X_NR_RATES)
+			hw_rate = priv->hw_rate;
+
+		priv->hw_rtscts_rate = hw_rate;
+	}
+
+	return 0;
+}
+
+static const u8 rtl818x_eeprom_bits[] = {
+	[SPI_BIT_SCLK] = RTL818X_EEPROM_CMD_CK,
+	[SPI_BIT_MISO] = RTL818X_EEPROM_CMD_READ,
+	[SPI_BIT_MOSI] = RTL818X_EEPROM_CMD_WRITE,
+	[SPI_BIT_SS(0)] = RTL818X_EEPROM_CMD_CS,
+};
+
+static int rtl818x_spi_read_bit(struct bit_basher *basher, unsigned int bit_id)
+{
+	struct rtl818x_priv *priv = container_of(basher, struct rtl818x_priv,
+						 spibit.basher);
+
+	u8 reg = rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	return reg & rtl818x_eeprom_bits[bit_id];
+}
+
+static void rtl818x_spi_write_bit(struct bit_basher *basher,
+				  unsigned int bit_id, unsigned long data)
+{
+	struct rtl818x_priv *priv = container_of(basher, struct rtl818x_priv,
+						 spibit.basher);
+
+	u8 reg = rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	u8 mask = rtl818x_eeprom_bits[bit_id];
+	reg = (reg & ~mask) | (data & mask);
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, reg);
+
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(10);
+}
+
+static struct bit_basher_operations rtl818x_basher_ops = {
+	.read = rtl818x_spi_read_bit,
+	.write = rtl818x_spi_write_bit,
+};
+
+/* The net80211 code makes a copy of this, so we're OK modifying the
+   static version as we initialize the card, as long as we don't
+   depend on possibly-modified values in case there are multiple cards. */
+static struct net80211_hw_info rtl818x_hwinfo = {
+	/* MAC address filled in at runtime */
+	/* modes filled in at runtime */
+	.bands = NET80211_BAND_2GHZ,
+	.flags = NET80211_HW_RX_HAS_FCS,
+	.signal_type = NET80211_SIGNAL_ARBITRARY,
+	/* supported rates filled in at runtime */
+	.signal_max = 65,
+	.channel_change_time = 1000, /* no idea what the actual value is */
+};
+
+static const char *rtl818x_rf_names[] = {
+	NULL,			/* no 0 */
+	"Intersil", "RFMD",	/* unsupported 1-2 */
+	"SA2400", "max2820", "GRF5101",	/* supported 3-5 */
+	NULL, NULL, NULL,	/* no 6-8 */
+	"RTL8225",		/* supported 9 */
+	"RTL8255",		/* unsupported 10 */
+};
+#define RTL818X_NR_RF_NAMES 11
+
+struct net80211_device_operations rtl818x_operations = {
+	.open = rtl818x_start,
+	.close = rtl818x_stop,
+	.transmit = rtl818x_tx,
+	.poll = rtl818x_poll,
+	.irq = rtl818x_irq,
+	.config = rtl818x_config,
+};
+
+static int rtl818x_probe(struct pci_device *pdev,
+			 const struct pci_device_id *id __unused)
+{
+	struct net80211_device *dev;
+	struct rtl818x_priv *priv;
+	struct rtl818x_rf_ops *rf;
+	int err, i;
+	const char *chip_name;
+	u32 reg;
+	u16 eeprom_val;
+
+	adjust_pci_device(pdev);
+
+	dev = net80211_alloc(sizeof(*priv));
+	if (!dev) {
+		DBG("rtl818x: net80211 alloc failed\n");
+		return -ENOMEM;
+	}
+
+	priv = dev->priv;
+	priv->pdev = pdev;
+	dev->netdev->dev = &pdev->dev;
+
+	priv->map = (struct rtl818x_csr *)pdev->ioaddr;
+	if (!priv->map)
+		priv->map = (struct rtl818x_csr *)pdev->membase;
+
+	if (!priv->map) {
+		DBG("rtl818x: cannot find device memory\n");
+		err = -ENXIO;
+		goto err_free_dev;
+	}
+
+	reg = rtl818x_ioread32(priv, &priv->map->TX_CONF);
+	reg &= RTL818X_TX_CONF_HWVER_MASK;
+	switch (reg) {
+	case RTL818X_TX_CONF_R8180_ABCD:
+		chip_name = "0";
+		break;
+	case RTL818X_TX_CONF_R8180_F:
+		chip_name = "0vF";
+		break;
+	case RTL818X_TX_CONF_R8185_ABC:
+		chip_name = "5";
+		break;
+	case RTL818X_TX_CONF_R8185_D:
+		chip_name = "5vD";
+		break;
+	default:
+		DBG("rtl818x: Unknown chip! (0x%x)\n", reg >> 25);
+		err = -ENOSYS;
+		goto err_free_dev;
+	}
+
+	priv->r8185 = reg & RTL818X_TX_CONF_R8185_ABC;
+
+	memcpy(rtl818x_hwinfo.supported_rates, rtl818x_rates,
+	       sizeof(*rtl818x_rates) * RTL818X_NR_RATES);
+
+	if (priv->r8185) {
+		rtl818x_hwinfo.modes = NET80211_MODE_B | NET80211_MODE_G;
+		rtl818x_hwinfo.nr_supported_rates = RTL818X_NR_RATES;
+	} else {
+		rtl818x_hwinfo.modes = NET80211_MODE_B;
+		rtl818x_hwinfo.nr_supported_rates = RTL818X_NR_B_RATES;
+	}
+
+	priv->spibit.basher.op = &rtl818x_basher_ops;
+	priv->spibit.bus.mode = SPI_MODE_THREEWIRE;
+	init_spi_bit_basher(&priv->spibit);
+
+	DBG2("rtl818x RX_CONF: %08x\n", rtl818x_ioread32(priv, &priv->map->RX_CONF));
+
+	if (rtl818x_ioread32(priv, &priv->map->RX_CONF) & (1 << 6))
+		init_at93c66(&priv->eeprom, 16);
+	else
+		init_at93c46(&priv->eeprom, 16);
+	priv->eeprom.bus = &priv->spibit.bus;
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_PROGRAM);
+	rtl818x_ioread8(priv, &priv->map->EEPROM_CMD);
+	udelay(10);
+
+	nvs_read(&priv->eeprom.nvs, 0x06, &eeprom_val, 2);
+	DBG2("rtl818x eeprom val = %04x\n", eeprom_val);
+	eeprom_val &= 0xFF;
+
+	priv->rf = NULL;
+	for_each_table_entry(rf, RTL818X_RF_DRIVERS) {
+		if (rf->id == eeprom_val) {
+			priv->rf = rf;
+			break;
+		}
+	}
+
+	if (!priv->rf) {
+		if (eeprom_val < RTL818X_NR_RF_NAMES &&
+		    rtl818x_rf_names[eeprom_val] != NULL)
+			DBG("rtl818x: %s RF frontend not supported!\n",
+			    rtl818x_rf_names[eeprom_val]);
+		else
+			DBG("rtl818x: RF frontend #%d not recognized!\n",
+			    eeprom_val);
+
+		err = -ENOSYS;
+		goto err_free_dev;
+	}
+
+	nvs_read(&priv->eeprom.nvs, 0x17, &eeprom_val, 2);
+	priv->csthreshold = eeprom_val >> 8;
+	if (!priv->r8185) {
+		nvs_read(&priv->eeprom.nvs, 0xD, &priv->anaparam, 4);
+		nvs_read(&priv->eeprom.nvs, 0x19, &priv->rfparam, 2);
+		priv->anaparam = le32_to_cpu(priv->anaparam);
+		priv->rfparam = le16_to_cpu(priv->rfparam);
+	}
+
+	/* read the MAC address */
+	nvs_read(&priv->eeprom.nvs, 0x7, rtl818x_hwinfo.hwaddr, 6);
+
+	/* CCK TX power */
+	for (i = 0; i < 14; i += 2) {
+		u16 txpwr;
+		nvs_read(&priv->eeprom.nvs, 0x10 + (i >> 1), &txpwr, 2);
+		priv->txpower[i] = txpwr & 0xFF;
+		priv->txpower[i + 1] = txpwr >> 8;
+	}
+
+	/* OFDM TX power */
+	if (priv->r8185) {
+		for (i = 0; i < 14; i += 2) {
+			u16 txpwr;
+			nvs_read(&priv->eeprom.nvs, 0x20 + (i >> 1), &txpwr, 2);
+			priv->txpower[i] |= (txpwr & 0xFF) << 8;
+			priv->txpower[i + 1] |= txpwr & 0xFF00;
+		}
+	}
+
+	rtl818x_iowrite8(priv, &priv->map->EEPROM_CMD, RTL818X_EEPROM_CMD_NORMAL);
+
+	err = net80211_register(dev, &rtl818x_operations, &rtl818x_hwinfo);
+	if (err) {
+		DBG("rtl818x: cannot register device\n");
+		goto err_free_dev;
+	}
+
+	DBG("rtl818x: Realtek RTL818%s (RF chip %s) with address %s\n",
+	    chip_name, priv->rf->name, netdev_hwaddr(dev->netdev));
+
+	return 0;
+
+ err_free_dev:
+	pci_set_drvdata(pdev, NULL);
+	net80211_free(dev);
+	return err;
+}
+
+static void rtl818x_remove(struct pci_device *pdev)
+{
+	struct net80211_device *dev = pci_get_drvdata(pdev);
+
+	if (!dev)
+		return;
+
+	net80211_unregister(dev);
+	net80211_free(dev);
+}
+
+/* Hide PCI_ROM definitions in here from parserom.pl; the definitions
+   that should be used are in rtl8180.c and rtl8185.c. */
+#define RTL_ROM PCI_ROM
+
+static struct pci_device_id rtl818x_nics[] = {
+	RTL_ROM(0x10ec, 0x8185, "rtl8185", "Realtek 8185", 0),
+	RTL_ROM(0x1799, 0x700f, "f5d7000", "Belkin F5D7000", 0),
+	RTL_ROM(0x1799, 0x701f, "f5d7010", "Belkin F5D7010", 0),
+
+	RTL_ROM(0x10ec, 0x8180, "rtl8180", "Realtek 8180", 0),
+	RTL_ROM(0x1799, 0x6001, "f5d6001", "Belkin F5D6001", 0),
+	RTL_ROM(0x1799, 0x6020, "f5d6020", "Belkin F5D6020", 0),
+	RTL_ROM(0x1186, 0x3300, "dwl510",  "D-Link DWL-510", 0),
+};
+
+struct pci_driver rtl818x_driver __pci_driver = {
+	.ids            = rtl818x_nics,
+	.id_count       = sizeof(rtl818x_nics) / sizeof(rtl818x_nics[0]),
+	.probe		= rtl818x_probe,
+	.remove		= rtl818x_remove,
+};
diff --git a/src/drivers/net/rtl818x/rtl818x.h b/src/drivers/net/rtl818x/rtl818x.h
new file mode 100644
index 00000000..15821fa9
--- /dev/null
+++ b/src/drivers/net/rtl818x/rtl818x.h
@@ -0,0 +1,359 @@
+/*
+ * Definitions for RTL818x hardware
+ *
+ * Copyright 2007 Michael Wu <flamingice@sourmilk.net>
+ * Copyright 2007 Andrea Merello <andreamrl@tiscali.it>
+ *
+ * Modified for gPXE, June 2009, by Joshua Oreman <oremanj@rwcr.net>
+ *
+ * Based on the r8187 driver, which is:
+ * Copyright 2005 Andrea Merello <andreamrl@tiscali.it>, et al.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+
+#ifndef RTL818X_H
+#define RTL818X_H
+
+#include <gpxe/spi_bit.h>
+#include <gpxe/tables.h>
+
+FILE_LICENCE(GPL2_ONLY);
+
+struct rtl818x_csr {
+	u8	MAC[6];
+	u8	reserved_0[2];
+	u32	MAR[2];
+	u8	RX_FIFO_COUNT;
+	u8	reserved_1;
+	u8	TX_FIFO_COUNT;
+	u8	BQREQ;
+	u8	reserved_2[4];
+	u32	TSFT[2];
+	u32	TLPDA;
+	u32	TNPDA;
+	u32	THPDA;
+	u16	BRSR;
+	u8	BSSID[6];
+	u8	RESP_RATE;
+	u8	EIFS;
+	u8	reserved_3[1];
+	u8	CMD;
+#define RTL818X_CMD_TX_ENABLE		(1 << 2)
+#define RTL818X_CMD_RX_ENABLE		(1 << 3)
+#define RTL818X_CMD_RESET		(1 << 4)
+	u8	reserved_4[4];
+	u16	INT_MASK;
+	u16	INT_STATUS;
+#define RTL818X_INT_RX_OK		(1 <<  0)
+#define RTL818X_INT_RX_ERR		(1 <<  1)
+#define RTL818X_INT_TXL_OK		(1 <<  2)
+#define RTL818X_INT_TXL_ERR		(1 <<  3)
+#define RTL818X_INT_RX_DU		(1 <<  4)
+#define RTL818X_INT_RX_FO		(1 <<  5)
+#define RTL818X_INT_TXN_OK		(1 <<  6)
+#define RTL818X_INT_TXN_ERR		(1 <<  7)
+#define RTL818X_INT_TXH_OK		(1 <<  8)
+#define RTL818X_INT_TXH_ERR		(1 <<  9)
+#define RTL818X_INT_TXB_OK		(1 << 10)
+#define RTL818X_INT_TXB_ERR		(1 << 11)
+#define RTL818X_INT_ATIM		(1 << 12)
+#define RTL818X_INT_BEACON		(1 << 13)
+#define RTL818X_INT_TIME_OUT		(1 << 14)
+#define RTL818X_INT_TX_FO		(1 << 15)
+	u32	TX_CONF;
+#define RTL818X_TX_CONF_LOOPBACK_MAC	(1 << 17)
+#define RTL818X_TX_CONF_LOOPBACK_CONT	(3 << 17)
+#define RTL818X_TX_CONF_NO_ICV		(1 << 19)
+#define RTL818X_TX_CONF_DISCW		(1 << 20)
+#define RTL818X_TX_CONF_SAT_HWPLCP	(1 << 24)
+#define RTL818X_TX_CONF_R8180_ABCD	(2 << 25)
+#define RTL818X_TX_CONF_R8180_F		(3 << 25)
+#define RTL818X_TX_CONF_R8185_ABC	(4 << 25)
+#define RTL818X_TX_CONF_R8185_D		(5 << 25)
+#define RTL818X_TX_CONF_R8187vD		(5 << 25)
+#define RTL818X_TX_CONF_R8187vD_B	(6 << 25)
+#define RTL818X_TX_CONF_HWVER_MASK	(7 << 25)
+#define RTL818X_TX_CONF_DISREQQSIZE	(1 << 28)
+#define RTL818X_TX_CONF_PROBE_DTS	(1 << 29)
+#define RTL818X_TX_CONF_HW_SEQNUM	(1 << 30)
+#define RTL818X_TX_CONF_CW_MIN		(1 << 31)
+	u32	RX_CONF;
+#define RTL818X_RX_CONF_MONITOR		(1 <<  0)
+#define RTL818X_RX_CONF_NICMAC		(1 <<  1)
+#define RTL818X_RX_CONF_MULTICAST	(1 <<  2)
+#define RTL818X_RX_CONF_BROADCAST	(1 <<  3)
+#define RTL818X_RX_CONF_FCS		(1 <<  5)
+#define RTL818X_RX_CONF_DATA		(1 << 18)
+#define RTL818X_RX_CONF_CTRL		(1 << 19)
+#define RTL818X_RX_CONF_MGMT		(1 << 20)
+#define RTL818X_RX_CONF_ADDR3		(1 << 21)
+#define RTL818X_RX_CONF_PM		(1 << 22)
+#define RTL818X_RX_CONF_BSSID		(1 << 23)
+#define RTL818X_RX_CONF_RX_AUTORESETPHY	(1 << 28)
+#define RTL818X_RX_CONF_CSDM1		(1 << 29)
+#define RTL818X_RX_CONF_CSDM2		(1 << 30)
+#define RTL818X_RX_CONF_ONLYERLPKT	(1 << 31)
+	u32	INT_TIMEOUT;
+	u32	TBDA;
+	u8	EEPROM_CMD;
+#define RTL818X_EEPROM_CMD_READ		(1 << 0)
+#define RTL818X_EEPROM_CMD_WRITE	(1 << 1)
+#define RTL818X_EEPROM_CMD_CK		(1 << 2)
+#define RTL818X_EEPROM_CMD_CS		(1 << 3)
+#define RTL818X_EEPROM_CMD_NORMAL	(0 << 6)
+#define RTL818X_EEPROM_CMD_LOAD		(1 << 6)
+#define RTL818X_EEPROM_CMD_PROGRAM	(2 << 6)
+#define RTL818X_EEPROM_CMD_CONFIG	(3 << 6)
+	u8	CONFIG0;
+	u8	CONFIG1;
+	u8	CONFIG2;
+#define RTL818X_CONFIG2_ANTENNA_DIV	(1 << 6)
+	u32	ANAPARAM;
+	u8	MSR;
+#define RTL818X_MSR_NO_LINK		(0 << 2)
+#define RTL818X_MSR_ADHOC		(1 << 2)
+#define RTL818X_MSR_INFRA		(2 << 2)
+#define RTL818X_MSR_MASTER		(3 << 2)
+#define RTL818X_MSR_ENEDCA		(4 << 2)
+	u8	CONFIG3;
+#define RTL818X_CONFIG3_ANAPARAM_WRITE	(1 << 6)
+#define RTL818X_CONFIG3_GNT_SELECT	(1 << 7)
+	u8	CONFIG4;
+#define RTL818X_CONFIG4_POWEROFF	(1 << 6)
+#define RTL818X_CONFIG4_VCOOFF		(1 << 7)
+	u8	TESTR;
+	u8	reserved_9[2];
+	u8	PGSELECT;
+	u8	SECURITY;
+	u32	ANAPARAM2;
+	u8	reserved_10[12];
+	u16	BEACON_INTERVAL;
+	u16	ATIM_WND;
+	u16	BEACON_INTERVAL_TIME;
+	u16	ATIMTR_INTERVAL;
+	u8	PHY_DELAY;
+	u8	CARRIER_SENSE_COUNTER;
+	u8	reserved_11[2];
+	u8	PHY[4];
+	u16	RFPinsOutput;
+	u16	RFPinsEnable;
+	u16	RFPinsSelect;
+	u16	RFPinsInput;
+	u32	RF_PARA;
+	u32	RF_TIMING;
+	u8	GP_ENABLE;
+	u8	GPIO;
+	u8	reserved_12[2];
+	u32	HSSI_PARA;
+	u8	reserved_13[4];
+	u8	TX_AGC_CTL;
+#define RTL818X_TX_AGC_CTL_PERPACKET_GAIN_SHIFT		(1 << 0)
+#define RTL818X_TX_AGC_CTL_PERPACKET_ANTSEL_SHIFT	(1 << 1)
+#define RTL818X_TX_AGC_CTL_FEEDBACK_ANT			(1 << 2)
+	u8	TX_GAIN_CCK;
+	u8	TX_GAIN_OFDM;
+	u8	TX_ANTENNA;
+	u8	reserved_14[16];
+	u8	WPA_CONF;
+	u8	reserved_15[3];
+	u8	SIFS;
+	u8	DIFS;
+	u8	SLOT;
+	u8	reserved_16[5];
+	u8	CW_CONF;
+#define RTL818X_CW_CONF_PERPACKET_CW_SHIFT	(1 << 0)
+#define RTL818X_CW_CONF_PERPACKET_RETRY_SHIFT	(1 << 1)
+	u8	CW_VAL;
+	u8	RATE_FALLBACK;
+#define RTL818X_RATE_FALLBACK_ENABLE	(1 << 7)
+	u8	ACM_CONTROL;
+	u8	reserved_17[24];
+	u8	CONFIG5;
+	u8	TX_DMA_POLLING;
+	u8	reserved_18[2];
+	u16	CWR;
+	u8	RETRY_CTR;
+	u8	reserved_19[3];
+	u16	INT_MIG;
+/* RTL818X_R8187B_*: magic numbers from ioregisters */
+#define RTL818X_R8187B_B	0
+#define RTL818X_R8187B_D	1
+#define RTL818X_R8187B_E	2
+	u32	RDSAR;
+	u16	TID_AC_MAP;
+	u8	reserved_20[4];
+	u8	ANAPARAM3;
+	u8	reserved_21[5];
+	u16	FEMR;
+	u8	reserved_22[4];
+	u16	TALLY_CNT;
+	u8	TALLY_SEL;
+} __attribute__((packed));
+
+#define MAX_RX_SIZE IEEE80211_MAX_FRAME_LEN
+
+#define RF_PARAM_ANALOGPHY	(1 << 0)
+#define RF_PARAM_ANTBDEFAULT	(1 << 1)
+#define RF_PARAM_CARRIERSENSE1	(1 << 2)
+#define RF_PARAM_CARRIERSENSE2	(1 << 3)
+
+#define BB_ANTATTEN_CHAN14	0x0C
+#define BB_ANTENNA_B 		0x40
+
+#define BB_HOST_BANG 		(1 << 30)
+#define BB_HOST_BANG_EN 	(1 << 2)
+#define BB_HOST_BANG_CLK 	(1 << 1)
+#define BB_HOST_BANG_DATA	1
+
+#define ANAPARAM_TXDACOFF_SHIFT	27
+#define ANAPARAM_PWR0_SHIFT	28
+#define ANAPARAM_PWR0_MASK 	(0x07 << ANAPARAM_PWR0_SHIFT)
+#define ANAPARAM_PWR1_SHIFT	20
+#define ANAPARAM_PWR1_MASK	(0x7F << ANAPARAM_PWR1_SHIFT)
+
+#define RTL818X_RX_RING_SIZE	8 /* doesn't have to be a power of 2 */
+#define RTL818X_TX_RING_SIZE	8 /* nor this [but 2^n is very slightly faster] */
+#define RTL818X_RING_ALIGN	256
+
+#define RTL818X_MAX_RETRIES     4
+
+enum rtl818x_tx_desc_flags {
+	RTL818X_TX_DESC_FLAG_NO_ENC	= (1 << 15),
+	RTL818X_TX_DESC_FLAG_TX_OK	= (1 << 15),
+	RTL818X_TX_DESC_FLAG_SPLCP	= (1 << 16),
+	RTL818X_TX_DESC_FLAG_RX_UNDER	= (1 << 16),
+	RTL818X_TX_DESC_FLAG_MOREFRAG	= (1 << 17),
+	RTL818X_TX_DESC_FLAG_CTS	= (1 << 18),
+	RTL818X_TX_DESC_FLAG_RTS	= (1 << 23),
+	RTL818X_TX_DESC_FLAG_LS		= (1 << 28),
+	RTL818X_TX_DESC_FLAG_FS		= (1 << 29),
+	RTL818X_TX_DESC_FLAG_DMA	= (1 << 30),
+	RTL818X_TX_DESC_FLAG_OWN	= (1 << 31)
+};
+
+struct rtl818x_tx_desc {
+	u32 flags;
+	u16 rts_duration;
+	u16 plcp_len;
+	u32 tx_buf;
+	u32 frame_len;
+	u32 next_tx_desc;
+	u8 cw;
+	u8 retry_limit;
+	u8 agc;
+	u8 flags2;
+	u32 reserved[2];
+} __attribute__ ((packed));
+
+enum rtl818x_rx_desc_flags {
+	RTL818X_RX_DESC_FLAG_ICV_ERR	= (1 << 12),
+	RTL818X_RX_DESC_FLAG_CRC32_ERR	= (1 << 13),
+	RTL818X_RX_DESC_FLAG_PM		= (1 << 14),
+	RTL818X_RX_DESC_FLAG_RX_ERR	= (1 << 15),
+	RTL818X_RX_DESC_FLAG_BCAST	= (1 << 16),
+	RTL818X_RX_DESC_FLAG_PAM	= (1 << 17),
+	RTL818X_RX_DESC_FLAG_MCAST	= (1 << 18),
+	RTL818X_RX_DESC_FLAG_QOS	= (1 << 19), /* RTL8187(B) only */
+	RTL818X_RX_DESC_FLAG_TRSW	= (1 << 24), /* RTL8187(B) only */
+	RTL818X_RX_DESC_FLAG_SPLCP	= (1 << 25),
+	RTL818X_RX_DESC_FLAG_FOF	= (1 << 26),
+	RTL818X_RX_DESC_FLAG_DMA_FAIL	= (1 << 27),
+	RTL818X_RX_DESC_FLAG_LS		= (1 << 28),
+	RTL818X_RX_DESC_FLAG_FS		= (1 << 29),
+	RTL818X_RX_DESC_FLAG_EOR	= (1 << 30),
+	RTL818X_RX_DESC_FLAG_OWN	= (1 << 31)
+};
+
+struct rtl818x_rx_desc {
+	u32 flags;
+	u32 flags2;
+	union {
+		u32 rx_buf;
+		u64 tsft;
+	};
+} __attribute__ ((packed));
+
+struct rtl818x_priv {
+	struct rtl818x_csr *map;
+	const struct rtl818x_rf_ops *rf;
+	int rf_flag; /* whatever RF driver wishes to use it for */
+	int hw_rate;
+	int hw_rtscts_rate;
+
+	struct spi_bit_basher spibit;
+	struct spi_device eeprom;
+
+	struct rtl818x_rx_desc *rx_ring;
+	u32 rx_ring_dma;
+	unsigned int rx_idx;	/* next desc to be filled by card */
+	struct io_buffer *rx_buf[RTL818X_RX_RING_SIZE];
+
+	struct rtl818x_tx_desc *tx_ring;
+	u32 tx_ring_dma;
+	unsigned int tx_cons;	/* next desc to be filled by card */
+	unsigned int tx_prod;	/* next desc to be filled by driver */
+	struct io_buffer *tx_buf[RTL818X_TX_RING_SIZE];
+
+	struct pci_device *pdev;
+	u32 rx_conf;
+
+	u16 txpower[14];
+
+	int r8185;
+	u32 anaparam;
+	u16 rfparam;
+	u8 csthreshold;
+};
+
+void rtl818x_write_phy(struct net80211_device *dev, u8 addr, u32 data);
+void rtl818x_set_anaparam(struct rtl818x_priv *priv, u32 anaparam);
+
+static inline u8 rtl818x_ioread8(struct rtl818x_priv *priv __unused, u8 *addr)
+{
+	return inb(addr);
+}
+
+static inline u16 rtl818x_ioread16(struct rtl818x_priv *priv __unused, u16 *addr)
+{
+	return inw(addr);
+}
+
+static inline u32 rtl818x_ioread32(struct rtl818x_priv *priv __unused, u32 *addr)
+{
+	return inl(addr);
+}
+
+static inline void rtl818x_iowrite8(struct rtl818x_priv *priv __unused,
+				    u8 *addr, u8 val)
+{
+	outb(val, addr);
+}
+
+static inline void rtl818x_iowrite16(struct rtl818x_priv *priv __unused,
+				     u16 *addr, u16 val)
+{
+	outw(val, addr);
+}
+
+static inline void rtl818x_iowrite32(struct rtl818x_priv *priv __unused,
+				     u32 *addr, u32 val)
+{
+	outl(val, addr);
+}
+
+#define RTL818X_RF_DRIVERS __table(struct rtl818x_rf_ops, "rtl818x_rf_drivers")
+#define __rtl818x_rf_driver __table_entry(RTL818X_RF_DRIVERS, 01)
+
+struct rtl818x_rf_ops {
+	char *name;
+	u8 id;			/* as identified in EEPROM */
+	void (*init)(struct net80211_device *dev);
+	void (*stop)(struct net80211_device *dev);
+	void (*set_chan)(struct net80211_device *dev, struct net80211_channel *chan);
+	void (*conf_erp)(struct net80211_device *dev); /* set based on dev->erp_flags */
+};
+
+#endif /* RTL818X_H */
diff --git a/src/include/gpxe/errfile.h b/src/include/gpxe/errfile.h
index e777ecb1..8fb6a95f 100644
--- a/src/include/gpxe/errfile.h
+++ b/src/include/gpxe/errfile.h
@@ -110,6 +110,7 @@ FILE_LICENCE ( GPL2_OR_LATER );
 #define ERRFILE_phantom		     ( ERRFILE_DRIVER | 0x004b0000 )
 #define ERRFILE_ne2k_isa	     ( ERRFILE_DRIVER | 0x004c0000 )
 #define ERRFILE_b44		     ( ERRFILE_DRIVER | 0x004d0000 )
+#define ERRFILE_rtl818x		     ( ERRFILE_DRIVER | 0x004e0000 )
 
 #define ERRFILE_scsi		     ( ERRFILE_DRIVER | 0x00700000 )
 #define ERRFILE_arbel		     ( ERRFILE_DRIVER | 0x00710000 )