Home | History | Annotate | Download | only in ural
      1 /*
      2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
      3  * Use is subject to license terms.
      4  */
      5 
      6 /*
      7  * Copyright (c) 2005, 2006
      8  *	Damien Bergamini <damien.bergamini (at) free.fr>
      9  *
     10  * Permission to use, copy, modify, and distribute this software for any
     11  * purpose with or without fee is hereby granted, provided that the above
     12  * copyright notice and this permission notice appear in all copies.
     13  *
     14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     21  */
     22 
     23 /*
     24  * Ralink Technology RT2500USB chipset driver
     25  * http://www.ralinktech.com/
     26  */
     27 #include <sys/types.h>
     28 #include <sys/cmn_err.h>
     29 #include <sys/strsubr.h>
     30 #include <sys/modctl.h>
     31 #include <sys/devops.h>
     32 #include <sys/mac_provider.h>
     33 #include <sys/mac_wifi.h>
     34 #include <sys/net80211.h>
     35 
     36 #define	USBDRV_MAJOR_VER	2
     37 #define	USBDRV_MINOR_VER	0
     38 #include <sys/usb/usba.h>
     39 #include <sys/usb/usba/usba_types.h>
     40 
     41 #include "ural_reg.h"
     42 #include "ural_var.h"
     43 
     44 static void *ural_soft_state_p = NULL;
     45 
     46 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
     47 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
     48 
     49 /* quickly determine if a given rate is CCK or OFDM */
     50 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
     51 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
     52 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
     53 #define	RAL_SIFS		10	/* us */
     54 #define	RAL_RXTX_TURNAROUND	5	/* us */
     55 
     56 #define	URAL_N(a)		(sizeof (a) / sizeof ((a)[0]))
     57 
     58 /*
     59  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
     60  */
     61 static const struct ieee80211_rateset ural_rateset_11a =
     62 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
     63 
     64 static const struct ieee80211_rateset ural_rateset_11b =
     65 	{ 4, { 2, 4, 11, 22 } };
     66 
     67 static const struct ieee80211_rateset ural_rateset_11g =
     68 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
     69 
     70 /*
     71  * Default values for MAC registers; values taken from the reference driver.
     72  */
     73 static const struct {
     74 	uint16_t	reg;
     75 	uint16_t	val;
     76 } ural_def_mac[] = {
     77 	{ RAL_TXRX_CSR5,  0x8c8d },
     78 	{ RAL_TXRX_CSR6,  0x8b8a },
     79 	{ RAL_TXRX_CSR7,  0x8687 },
     80 	{ RAL_TXRX_CSR8,  0x0085 },
     81 	{ RAL_MAC_CSR13,  0x1111 },
     82 	{ RAL_MAC_CSR14,  0x1e11 },
     83 	{ RAL_TXRX_CSR21, 0xe78f },
     84 	{ RAL_MAC_CSR9,   0xff1d },
     85 	{ RAL_MAC_CSR11,  0x0002 },
     86 	{ RAL_MAC_CSR22,  0x0053 },
     87 	{ RAL_MAC_CSR15,  0x0000 },
     88 	{ RAL_MAC_CSR8,   0x0780 },
     89 	{ RAL_TXRX_CSR19, 0x0000 },
     90 	{ RAL_TXRX_CSR18, 0x005a },
     91 	{ RAL_PHY_CSR2,   0x0000 },
     92 	{ RAL_TXRX_CSR0,  0x1ec0 },
     93 	{ RAL_PHY_CSR4,   0x000f }
     94 };
     95 
     96 /*
     97  * Default values for BBP registers; values taken from the reference driver.
     98  */
     99 static const struct {
    100 	uint8_t	reg;
    101 	uint8_t	val;
    102 } ural_def_bbp[] = {
    103 	{  3, 0x02 },
    104 	{  4, 0x19 },
    105 	{ 14, 0x1c },
    106 	{ 15, 0x30 },
    107 	{ 16, 0xac },
    108 	{ 17, 0x48 },
    109 	{ 18, 0x18 },
    110 	{ 19, 0xff },
    111 	{ 20, 0x1e },
    112 	{ 21, 0x08 },
    113 	{ 22, 0x08 },
    114 	{ 23, 0x08 },
    115 	{ 24, 0x80 },
    116 	{ 25, 0x50 },
    117 	{ 26, 0x08 },
    118 	{ 27, 0x23 },
    119 	{ 30, 0x10 },
    120 	{ 31, 0x2b },
    121 	{ 32, 0xb9 },
    122 	{ 34, 0x12 },
    123 	{ 35, 0x50 },
    124 	{ 39, 0xc4 },
    125 	{ 40, 0x02 },
    126 	{ 41, 0x60 },
    127 	{ 53, 0x10 },
    128 	{ 54, 0x18 },
    129 	{ 56, 0x08 },
    130 	{ 57, 0x10 },
    131 	{ 58, 0x08 },
    132 	{ 61, 0x60 },
    133 	{ 62, 0x10 },
    134 	{ 75, 0xff }
    135 };
    136 
    137 /*
    138  * Default values for RF register R2 indexed by channel numbers.
    139  */
    140 static const uint32_t ural_rf2522_r2[] = {
    141 	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
    142 	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
    143 };
    144 
    145 static const uint32_t ural_rf2523_r2[] = {
    146 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
    147 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
    148 };
    149 
    150 static const uint32_t ural_rf2524_r2[] = {
    151 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
    152 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
    153 };
    154 
    155 static const uint32_t ural_rf2525_r2[] = {
    156 	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
    157 	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
    158 };
    159 
    160 static const uint32_t ural_rf2525_hi_r2[] = {
    161 	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
    162 	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
    163 };
    164 
    165 static const uint32_t ural_rf2525e_r2[] = {
    166 	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
    167 	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
    168 };
    169 
    170 static const uint32_t ural_rf2526_hi_r2[] = {
    171 	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
    172 	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
    173 };
    174 
    175 static const uint32_t ural_rf2526_r2[] = {
    176 	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
    177 	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
    178 };
    179 
    180 /*
    181  * For dual-band RF, RF registers R1 and R4 also depend on channel number;
    182  * values taken from the reference driver.
    183  */
    184 static const struct {
    185 	uint8_t		chan;
    186 	uint32_t	r1;
    187 	uint32_t	r2;
    188 	uint32_t	r4;
    189 } ural_rf5222[] = {
    190 	{   1, 0x08808, 0x0044d, 0x00282 },
    191 	{   2, 0x08808, 0x0044e, 0x00282 },
    192 	{   3, 0x08808, 0x0044f, 0x00282 },
    193 	{   4, 0x08808, 0x00460, 0x00282 },
    194 	{   5, 0x08808, 0x00461, 0x00282 },
    195 	{   6, 0x08808, 0x00462, 0x00282 },
    196 	{   7, 0x08808, 0x00463, 0x00282 },
    197 	{   8, 0x08808, 0x00464, 0x00282 },
    198 	{   9, 0x08808, 0x00465, 0x00282 },
    199 	{  10, 0x08808, 0x00466, 0x00282 },
    200 	{  11, 0x08808, 0x00467, 0x00282 },
    201 	{  12, 0x08808, 0x00468, 0x00282 },
    202 	{  13, 0x08808, 0x00469, 0x00282 },
    203 	{  14, 0x08808, 0x0046b, 0x00286 },
    204 
    205 	{  36, 0x08804, 0x06225, 0x00287 },
    206 	{  40, 0x08804, 0x06226, 0x00287 },
    207 	{  44, 0x08804, 0x06227, 0x00287 },
    208 	{  48, 0x08804, 0x06228, 0x00287 },
    209 	{  52, 0x08804, 0x06229, 0x00287 },
    210 	{  56, 0x08804, 0x0622a, 0x00287 },
    211 	{  60, 0x08804, 0x0622b, 0x00287 },
    212 	{  64, 0x08804, 0x0622c, 0x00287 },
    213 
    214 	{ 100, 0x08804, 0x02200, 0x00283 },
    215 	{ 104, 0x08804, 0x02201, 0x00283 },
    216 	{ 108, 0x08804, 0x02202, 0x00283 },
    217 	{ 112, 0x08804, 0x02203, 0x00283 },
    218 	{ 116, 0x08804, 0x02204, 0x00283 },
    219 	{ 120, 0x08804, 0x02205, 0x00283 },
    220 	{ 124, 0x08804, 0x02206, 0x00283 },
    221 	{ 128, 0x08804, 0x02207, 0x00283 },
    222 	{ 132, 0x08804, 0x02208, 0x00283 },
    223 	{ 136, 0x08804, 0x02209, 0x00283 },
    224 	{ 140, 0x08804, 0x0220a, 0x00283 },
    225 
    226 	{ 149, 0x08808, 0x02429, 0x00281 },
    227 	{ 153, 0x08808, 0x0242b, 0x00281 },
    228 	{ 157, 0x08808, 0x0242d, 0x00281 },
    229 	{ 161, 0x08808, 0x0242f, 0x00281 }
    230 };
    231 
    232 /*
    233  * device operations
    234  */
    235 static int ural_attach(dev_info_t *, ddi_attach_cmd_t);
    236 static int ural_detach(dev_info_t *, ddi_detach_cmd_t);
    237 
    238 /*
    239  * Module Loading Data & Entry Points
    240  */
    241 DDI_DEFINE_STREAM_OPS(ural_dev_ops, nulldev, nulldev, ural_attach,
    242     ural_detach, nodev, NULL, D_MP, NULL, ddi_quiesce_not_needed);
    243 
    244 static struct modldrv ural_modldrv = {
    245 	&mod_driverops,		/* Type of module.  This one is a driver */
    246 	"ural driver v1.4",	/* short description */
    247 	&ural_dev_ops		/* driver specific ops */
    248 };
    249 
    250 static struct modlinkage modlinkage = {
    251 	MODREV_1,
    252 	(void *)&ural_modldrv,
    253 	NULL
    254 };
    255 
    256 static int	ural_m_stat(void *,  uint_t, uint64_t *);
    257 static int	ural_m_start(void *);
    258 static void	ural_m_stop(void *);
    259 static int	ural_m_promisc(void *, boolean_t);
    260 static int	ural_m_multicst(void *, boolean_t, const uint8_t *);
    261 static int	ural_m_unicst(void *, const uint8_t *);
    262 static mblk_t	*ural_m_tx(void *, mblk_t *);
    263 static void	ural_m_ioctl(void *, queue_t *, mblk_t *);
    264 static int	ural_m_setprop(void *, const char *, mac_prop_id_t,
    265     uint_t, const void *);
    266 static int	ural_m_getprop(void *, const char *, mac_prop_id_t,
    267     uint_t, uint_t, void *, uint_t *);
    268 
    269 static mac_callbacks_t ural_m_callbacks = {
    270 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
    271 	ural_m_stat,
    272 	ural_m_start,
    273 	ural_m_stop,
    274 	ural_m_promisc,
    275 	ural_m_multicst,
    276 	ural_m_unicst,
    277 	ural_m_tx,
    278 	ural_m_ioctl,
    279 	NULL,		/* mc_getcapab */
    280 	NULL,
    281 	NULL,
    282 	ural_m_setprop,
    283 	ural_m_getprop
    284 };
    285 
    286 static void ural_amrr_start(struct ural_softc *, struct ieee80211_node *);
    287 static int  ural_tx_trigger(struct ural_softc *, mblk_t *);
    288 static int  ural_rx_trigger(struct ural_softc *);
    289 
    290 uint32_t ural_dbg_flags = 0;
    291 
    292 void
    293 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
    294 {
    295 	va_list args;
    296 
    297 	if (dbg_flags & ural_dbg_flags) {
    298 		va_start(args, fmt);
    299 		vcmn_err(CE_CONT, fmt, args);
    300 		va_end(args);
    301 	}
    302 }
    303 
    304 static uint16_t
    305 ural_read(struct ural_softc *sc, uint16_t reg)
    306 {
    307 	usb_ctrl_setup_t req;
    308 	usb_cr_t cr;
    309 	usb_cb_flags_t cf;
    310 	mblk_t *mp;
    311 	int err;
    312 	uint16_t val;
    313 
    314 	bzero(&req, sizeof (req));
    315 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
    316 	req.bRequest = RAL_READ_MAC;
    317 	req.wValue = 0;
    318 	req.wIndex = reg;
    319 	req.wLength = sizeof (uint16_t);
    320 
    321 	mp = NULL;
    322 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
    323 	    &cr, &cf, 0);
    324 
    325 	if (err != USB_SUCCESS) {
    326 		ral_debug(RAL_DBG_ERR,
    327 		    "ural_read(): could not read MAC register:"
    328 		    " cr:%s(%d), cf:(%x)\n",
    329 		    usb_str_cr(cr), cr, cf);
    330 		return (0);
    331 	}
    332 
    333 	bcopy(mp->b_rptr, &val, sizeof (uint16_t));
    334 
    335 	if (mp)
    336 		freemsg(mp);
    337 
    338 	return (LE_16(val));
    339 }
    340 
    341 static void
    342 ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
    343 {
    344 	usb_ctrl_setup_t req;
    345 	usb_cr_t cr;
    346 	usb_cb_flags_t cf;
    347 	mblk_t *mp;
    348 	int err;
    349 
    350 	bzero(&req, sizeof (req));
    351 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
    352 	req.bRequest = RAL_READ_MULTI_MAC;
    353 	req.wValue = 0;
    354 	req.wIndex = reg;
    355 	req.wLength = (uint16_t)len;
    356 	req.attrs = USB_ATTRS_AUTOCLEARING;
    357 
    358 	mp = NULL;
    359 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
    360 	    &cr, &cf, 0);
    361 
    362 	if (err != USB_SUCCESS) {
    363 		ral_debug(RAL_DBG_ERR,
    364 		    "ural_read_multi(): could not read MAC register:"
    365 		    "cr:%s(%d), cf:(%x)\n",
    366 		    usb_str_cr(cr), cr, cf);
    367 		return;
    368 	}
    369 
    370 	bcopy(mp->b_rptr, buf, len);
    371 
    372 	if (mp)
    373 		freemsg(mp);
    374 }
    375 
    376 static void
    377 ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
    378 {
    379 	usb_ctrl_setup_t req;
    380 	usb_cr_t cr;
    381 	usb_cb_flags_t cf;
    382 	int err;
    383 
    384 	bzero(&req, sizeof (req));
    385 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
    386 	req.bRequest = RAL_WRITE_MAC;
    387 	req.wValue = val;
    388 	req.wIndex = reg;
    389 	req.wLength = 0;
    390 	req.attrs = USB_ATTRS_NONE;
    391 
    392 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
    393 	    &cr, &cf, 0);
    394 
    395 	if (err != USB_SUCCESS) {
    396 		ral_debug(RAL_DBG_ERR,
    397 		    "ural_write(): could not write MAC register:"
    398 		    "cr:%s(%d), cf:(%x)\n",
    399 		    usb_str_cr(cr), cr, cf);
    400 	}
    401 }
    402 
    403 /* ARGSUSED */
    404 static void
    405 ural_txeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
    406 {
    407 	struct ural_softc *sc = (struct ural_softc *)req->bulk_client_private;
    408 	struct ieee80211com *ic = &sc->sc_ic;
    409 
    410 	ral_debug(RAL_DBG_TX,
    411 	    "ural_txeof(): cr:%s(%d), flags:0x%x, tx_queued:%d",
    412 	    usb_str_cr(req->bulk_completion_reason),
    413 	    req->bulk_completion_reason,
    414 	    req->bulk_cb_flags,
    415 	    sc->tx_queued);
    416 
    417 	if (req->bulk_completion_reason != USB_CR_OK)
    418 		sc->sc_tx_err++;
    419 
    420 	mutex_enter(&sc->tx_lock);
    421 
    422 	sc->tx_queued--;
    423 	sc->sc_tx_timer = 0;
    424 
    425 	if (sc->sc_need_sched) {
    426 		sc->sc_need_sched = 0;
    427 		mac_tx_update(ic->ic_mach);
    428 	}
    429 
    430 	mutex_exit(&sc->tx_lock);
    431 	usb_free_bulk_req(req);
    432 }
    433 
    434 /* ARGSUSED */
    435 static void
    436 ural_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
    437 {
    438 	struct ural_softc *sc = (struct ural_softc *)req->bulk_client_private;
    439 	struct ieee80211com *ic = &sc->sc_ic;
    440 
    441 	struct ural_rx_desc *desc;
    442 	struct ieee80211_frame *wh;
    443 	struct ieee80211_node *ni;
    444 
    445 	mblk_t *m, *mp;
    446 	int len, pktlen;
    447 	char *rxbuf;
    448 
    449 	mp = req->bulk_data;
    450 	req->bulk_data = NULL;
    451 
    452 	ral_debug(RAL_DBG_RX,
    453 	    "ural_rxeof(): cr:%s(%d), flags:0x%x, rx_queued:%d",
    454 	    usb_str_cr(req->bulk_completion_reason),
    455 	    req->bulk_completion_reason,
    456 	    req->bulk_cb_flags,
    457 	    sc->rx_queued);
    458 
    459 	if (req->bulk_completion_reason != USB_CR_OK) {
    460 		sc->sc_rx_err++;
    461 		goto fail;
    462 	}
    463 
    464 	len = (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
    465 	rxbuf = (char *)mp->b_rptr;
    466 
    467 	if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
    468 		ral_debug(RAL_DBG_ERR,
    469 		    "ural_rxeof(): xfer too short %d\n", len);
    470 		sc->sc_rx_err++;
    471 		goto fail;
    472 	}
    473 
    474 	/* rx descriptor is located at the end */
    475 	desc = (struct ural_rx_desc *)(rxbuf + len - RAL_RX_DESC_SIZE);
    476 
    477 	if ((LE_32(desc->flags) & RAL_RX_PHY_ERROR) ||
    478 	    (LE_32(desc->flags) & RAL_RX_CRC_ERROR)) {
    479 		/*
    480 		 * This should not happen since we did not request to receive
    481 		 * those frames when we filled RAL_TXRX_CSR2.
    482 		 */
    483 		ral_debug(RAL_DBG_ERR, "PHY or CRC error\n");
    484 		sc->sc_rx_err++;
    485 		goto fail;
    486 	}
    487 
    488 	pktlen = (LE_32(desc->flags) >> 16) & 0xfff;
    489 
    490 	if (pktlen > (len - RAL_RX_DESC_SIZE)) {
    491 		ral_debug(RAL_DBG_ERR,
    492 		    "ural_rxeof(): pktlen mismatch <%d, %d>.\n", pktlen, len);
    493 		goto fail;
    494 	}
    495 
    496 	/* Strip trailing 802.11 MAC FCS. */
    497 	pktlen -= IEEE80211_CRC_LEN;
    498 
    499 	if ((m = allocb(pktlen, BPRI_MED)) == NULL) {
    500 		ral_debug(RAL_DBG_ERR,
    501 		    "ural_rxeof(): allocate mblk failed.\n");
    502 		sc->sc_rx_nobuf++;
    503 		goto fail;
    504 	}
    505 
    506 	bcopy(rxbuf, m->b_rptr, pktlen);
    507 	m->b_wptr += pktlen;
    508 
    509 	wh = (struct ieee80211_frame *)m->b_rptr;
    510 	ni = ieee80211_find_rxnode(ic, wh);
    511 
    512 	/* send the frame to the 802.11 layer */
    513 	(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
    514 
    515 	/* node is no longer needed */
    516 	ieee80211_free_node(ni);
    517 fail:
    518 	mutex_enter(&sc->rx_lock);
    519 	sc->rx_queued--;
    520 	mutex_exit(&sc->rx_lock);
    521 
    522 	freemsg(mp);
    523 	usb_free_bulk_req(req);
    524 
    525 	if (RAL_IS_RUNNING(sc))
    526 		(void) ural_rx_trigger(sc);
    527 }
    528 
    529 /*
    530  * Return the expected ack rate for a frame transmitted at rate `rate'.
    531  * this should depend on the destination node basic rate set.
    532  */
    533 static int
    534 ural_ack_rate(struct ieee80211com *ic, int rate)
    535 {
    536 	switch (rate) {
    537 	/* CCK rates */
    538 	case 2:
    539 		return (2);
    540 	case 4:
    541 	case 11:
    542 	case 22:
    543 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
    544 
    545 	/* OFDM rates */
    546 	case 12:
    547 	case 18:
    548 		return (12);
    549 	case 24:
    550 	case 36:
    551 		return (24);
    552 	case 48:
    553 	case 72:
    554 	case 96:
    555 	case 108:
    556 		return (48);
    557 	}
    558 
    559 	/* default to 1Mbps */
    560 	return (2);
    561 }
    562 
    563 /*
    564  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
    565  * The function automatically determines the operating mode depending on the
    566  * given rate. `flags' indicates whether short preamble is in use or not.
    567  */
    568 static uint16_t
    569 ural_txtime(int len, int rate, uint32_t flags)
    570 {
    571 	uint16_t txtime;
    572 
    573 	if (RAL_RATE_IS_OFDM(rate)) {
    574 		/* IEEE Std 802.11a-1999, pp. 37 */
    575 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
    576 		txtime = 16 + 4 + 4 * txtime + 6;
    577 	} else {
    578 		/* IEEE Std 802.11b-1999, pp. 28 */
    579 		txtime = (16 * len + rate - 1) / rate;
    580 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
    581 			txtime +=  72 + 24;
    582 		else
    583 			txtime += 144 + 48;
    584 	}
    585 	return (txtime);
    586 }
    587 
    588 static uint8_t
    589 ural_plcp_signal(int rate)
    590 {
    591 	switch (rate) {
    592 	/* CCK rates (returned values are device-dependent) */
    593 	case 2:		return (0x0);
    594 	case 4:		return (0x1);
    595 	case 11:	return (0x2);
    596 	case 22:	return (0x3);
    597 
    598 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
    599 	case 12:	return (0xb);
    600 	case 18:	return (0xf);
    601 	case 24:	return (0xa);
    602 	case 36:	return (0xe);
    603 	case 48:	return (0x9);
    604 	case 72:	return (0xd);
    605 	case 96:	return (0x8);
    606 	case 108:	return (0xc);
    607 
    608 	/* unsupported rates (should not get there) */
    609 	default:	return (0xff);
    610 	}
    611 }
    612 
    613 static void
    614 ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
    615     uint32_t flags, int len, int rate)
    616 {
    617 	struct ieee80211com *ic = &sc->sc_ic;
    618 	uint16_t plcp_length;
    619 	int remainder;
    620 
    621 	desc->flags = LE_32(flags);
    622 	desc->flags |= LE_32(RAL_TX_NEWSEQ);
    623 	desc->flags |= LE_32(len << 16);
    624 
    625 	desc->wme = LE_16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
    626 	desc->wme |= LE_16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
    627 
    628 	/* setup PLCP fields */
    629 	desc->plcp_signal  = ural_plcp_signal(rate);
    630 	desc->plcp_service = 4;
    631 
    632 	len += IEEE80211_CRC_LEN;
    633 	if (RAL_RATE_IS_OFDM(rate)) {
    634 		desc->flags |= LE_32(RAL_TX_OFDM);
    635 
    636 		plcp_length = len & 0xfff;
    637 		desc->plcp_length_hi = plcp_length >> 6;
    638 		desc->plcp_length_lo = plcp_length & 0x3f;
    639 	} else {
    640 		plcp_length = (16 * len + rate - 1) / rate;
    641 		if (rate == 22) {
    642 			remainder = (16 * len) % 22;
    643 			if (remainder != 0 && remainder < 7)
    644 				desc->plcp_service |= RAL_PLCP_LENGEXT;
    645 		}
    646 		desc->plcp_length_hi = plcp_length >> 8;
    647 		desc->plcp_length_lo = plcp_length & 0xff;
    648 
    649 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
    650 			desc->plcp_signal |= 0x08;
    651 	}
    652 
    653 	desc->iv = 0;
    654 	desc->eiv = 0;
    655 }
    656 
    657 #define	RAL_TX_TIMEOUT		5
    658 
    659 static int
    660 ural_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
    661 {
    662 	struct ural_softc *sc = (struct ural_softc *)ic;
    663 	struct ural_tx_desc *desc;
    664 
    665 	struct ieee80211_frame *wh;
    666 	struct ieee80211_key *k;
    667 
    668 	uint16_t dur;
    669 	uint32_t flags = 0;
    670 	int rate, err = DDI_SUCCESS;
    671 
    672 	struct ieee80211_node *ni = NULL;
    673 	mblk_t *m, *m0;
    674 	int off, mblen, pktlen, xferlen;
    675 
    676 	/* discard packets while suspending or not inited */
    677 	if (!RAL_IS_RUNNING(sc)) {
    678 		freemsg(mp);
    679 		return (ENXIO);
    680 	}
    681 
    682 	mutex_enter(&sc->tx_lock);
    683 
    684 	if (sc->tx_queued > RAL_TX_LIST_COUNT) {
    685 		ral_debug(RAL_DBG_TX, "ural_send(): "
    686 		    "no TX buffer available!\n");
    687 		if ((type & IEEE80211_FC0_TYPE_MASK) ==
    688 		    IEEE80211_FC0_TYPE_DATA) {
    689 			sc->sc_need_sched = 1;
    690 		}
    691 		sc->sc_tx_nobuf++;
    692 		err = ENOMEM;
    693 		goto fail;
    694 	}
    695 
    696 	m = allocb(RAL_TXBUF_SIZE + RAL_TX_DESC_SIZE, BPRI_MED);
    697 	if (m == NULL) {
    698 		ral_debug(RAL_DBG_ERR, "ural_send(): can't alloc mblk.\n");
    699 		err = DDI_FAILURE;
    700 		goto fail;
    701 	}
    702 
    703 	m->b_rptr += RAL_TX_DESC_SIZE;	/* skip TX descriptor */
    704 	m->b_wptr += RAL_TX_DESC_SIZE;
    705 
    706 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
    707 		mblen = (uintptr_t)m0->b_wptr - (uintptr_t)m0->b_rptr;
    708 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
    709 		off += mblen;
    710 	}
    711 	m->b_wptr += off;
    712 
    713 	wh = (struct ieee80211_frame *)m->b_rptr;
    714 
    715 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
    716 	if (ni == NULL) {
    717 		err = DDI_FAILURE;
    718 		sc->sc_tx_err++;
    719 		freemsg(m);
    720 		goto fail;
    721 	}
    722 
    723 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
    724 	    IEEE80211_FC0_TYPE_DATA) {
    725 		(void) ieee80211_encap(ic, m, ni);
    726 	}
    727 
    728 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
    729 		k = ieee80211_crypto_encap(ic, m);
    730 		if (k == NULL) {
    731 			sc->sc_tx_err++;
    732 			freemsg(m);
    733 			err = DDI_FAILURE;
    734 			goto fail;
    735 		}
    736 		/* packet header may have moved, reset our local pointer */
    737 		wh = (struct ieee80211_frame *)m->b_rptr;
    738 	}
    739 
    740 	m->b_rptr -= RAL_TX_DESC_SIZE;	/* restore */
    741 	desc = (struct ural_tx_desc *)m->b_rptr;
    742 
    743 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
    744 	    IEEE80211_FC0_TYPE_DATA) {	/* DATA */
    745 		if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
    746 			rate = ic->ic_bss->in_rates.ir_rates[ic->ic_fixed_rate];
    747 		else
    748 			rate = ni->in_rates.ir_rates[ni->in_txrate];
    749 
    750 		rate &= IEEE80211_RATE_VAL;
    751 		if (rate <= 0) {
    752 			rate = 2;	/* basic rate */
    753 		}
    754 
    755 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
    756 			flags |= RAL_TX_ACK;
    757 			flags |= RAL_TX_RETRY(7);
    758 
    759 			dur = ural_txtime(RAL_ACK_SIZE, ural_ack_rate(ic, rate),
    760 			    ic->ic_flags) + RAL_SIFS;
    761 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
    762 		}
    763 	} else {	/* MGMT */
    764 		rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
    765 
    766 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
    767 			flags |= RAL_TX_ACK;
    768 
    769 			dur = ural_txtime(RAL_ACK_SIZE, rate, ic->ic_flags)
    770 			    + RAL_SIFS;
    771 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
    772 
    773 			/* tell hardware to add timestamp for probe responses */
    774 			if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
    775 			    IEEE80211_FC0_TYPE_MGT &&
    776 			    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
    777 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
    778 				flags |= RAL_TX_TIMESTAMP;
    779 		}
    780 	}
    781 
    782 	pktlen = (uintptr_t)m->b_wptr - (uintptr_t)m->b_rptr - RAL_TX_DESC_SIZE;
    783 	ural_setup_tx_desc(sc, desc, flags, pktlen, rate);
    784 
    785 	/* align end on a 2-bytes boundary */
    786 	xferlen = (RAL_TX_DESC_SIZE + pktlen + 1) & ~1;
    787 
    788 	/*
    789 	 * No space left in the last URB to store the extra 2 bytes, force
    790 	 * sending of another URB.
    791 	 */
    792 	if ((xferlen % 64) == 0)
    793 		xferlen += 2;
    794 
    795 	m->b_wptr = m->b_rptr + xferlen;
    796 
    797 	ral_debug(RAL_DBG_TX, "sending data frame len=%u rate=%u xfer len=%u\n",
    798 	    pktlen, rate, xferlen);
    799 
    800 	(void) ural_tx_trigger(sc, m);
    801 
    802 	ic->ic_stats.is_tx_frags++;
    803 	ic->ic_stats.is_tx_bytes += pktlen;
    804 
    805 fail:
    806 	if (ni != NULL)
    807 		ieee80211_free_node(ni);
    808 
    809 	if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
    810 	    err == 0) {
    811 		freemsg(mp);
    812 	}
    813 
    814 	mutex_exit(&sc->tx_lock);
    815 
    816 	return (err);
    817 }
    818 
    819 static mblk_t *
    820 ural_m_tx(void *arg, mblk_t *mp)
    821 {
    822 	struct ural_softc *sc = (struct ural_softc *)arg;
    823 	struct ieee80211com *ic = &sc->sc_ic;
    824 	mblk_t *next;
    825 
    826 	/*
    827 	 * No data frames go out unless we're associated; this
    828 	 * should not happen as the 802.11 layer does not enable
    829 	 * the xmit queue until we enter the RUN state.
    830 	 */
    831 	if (ic->ic_state != IEEE80211_S_RUN) {
    832 		ral_debug(RAL_DBG_ERR, "ural_m_tx(): "
    833 		    "discard, state %u\n", ic->ic_state);
    834 		freemsgchain(mp);
    835 		return (NULL);
    836 	}
    837 
    838 	while (mp != NULL) {
    839 		next = mp->b_next;
    840 		mp->b_next = NULL;
    841 		if (ural_send(ic, mp, IEEE80211_FC0_TYPE_DATA) != DDI_SUCCESS) {
    842 			mp->b_next = next;
    843 			freemsgchain(mp);
    844 			return (NULL);
    845 		}
    846 		mp = next;
    847 	}
    848 	return (mp);
    849 }
    850 
    851 static void
    852 ural_set_testmode(struct ural_softc *sc)
    853 {
    854 	usb_ctrl_setup_t req;
    855 	usb_cr_t cr;
    856 	usb_cb_flags_t cf;
    857 	int err;
    858 
    859 	bzero(&req, sizeof (req));
    860 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
    861 	req.bRequest = RAL_VENDOR_REQUEST;
    862 	req.wValue = 4;
    863 	req.wIndex = 1;
    864 	req.wLength = 0;
    865 	req.attrs = USB_ATTRS_NONE;
    866 
    867 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
    868 	    &cr, &cf, 0);
    869 
    870 	if (err != USB_SUCCESS) {
    871 		ral_debug(RAL_DBG_USB,
    872 		    "ural_set_testmode(): could not set test mode:"
    873 		    "cr:%s(%d), cf:%(x)\n",
    874 		    usb_str_cr(cr), cr, cf);
    875 	}
    876 }
    877 
    878 static void
    879 ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
    880 {
    881 	usb_ctrl_setup_t req;
    882 	usb_cr_t cr;
    883 	usb_cb_flags_t cf;
    884 	mblk_t *mp;
    885 	int err;
    886 
    887 	bzero(&req, sizeof (req));
    888 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
    889 	req.bRequest = RAL_READ_EEPROM;
    890 	req.wValue = 0;
    891 	req.wIndex = addr;
    892 	req.wLength = (uint16_t)len;
    893 
    894 	mp = NULL;
    895 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
    896 	    &cr, &cf, 0);
    897 
    898 	if (err != USB_SUCCESS) {
    899 		ral_debug(RAL_DBG_USB,
    900 		    "ural_eeprom_read(): could not read EEPROM:"
    901 		    "cr:%s(%d), cf:(%x)\n",
    902 		    usb_str_cr(cr), cr, cf);
    903 		return;
    904 	}
    905 
    906 	bcopy(mp->b_rptr, buf, len);
    907 
    908 	if (mp)
    909 		freemsg(mp);
    910 }
    911 
    912 static void
    913 ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
    914 {
    915 	uint16_t tmp;
    916 	int ntries;
    917 
    918 	for (ntries = 0; ntries < 5; ntries++) {
    919 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
    920 			break;
    921 	}
    922 	if (ntries == 5) {
    923 		ral_debug(RAL_DBG_ERR,
    924 		    "ural_bbp_write(): could not write to BBP\n");
    925 		return;
    926 	}
    927 
    928 	tmp = reg << 8 | val;
    929 	ural_write(sc, RAL_PHY_CSR7, tmp);
    930 }
    931 
    932 static uint8_t
    933 ural_bbp_read(struct ural_softc *sc, uint8_t reg)
    934 {
    935 	uint16_t val;
    936 	int ntries;
    937 
    938 	val = RAL_BBP_WRITE | reg << 8;
    939 	ural_write(sc, RAL_PHY_CSR7, val);
    940 
    941 	for (ntries = 0; ntries < 5; ntries++) {
    942 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
    943 			break;
    944 	}
    945 	if (ntries == 5) {
    946 		ral_debug(RAL_DBG_ERR, "ural_bbp_read(): could not read BBP\n");
    947 		return (0);
    948 	}
    949 
    950 	return (ural_read(sc, RAL_PHY_CSR7) & 0xff);
    951 }
    952 
    953 static void
    954 ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
    955 {
    956 	uint32_t tmp;
    957 	int ntries;
    958 
    959 	for (ntries = 0; ntries < 5; ntries++) {
    960 		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
    961 			break;
    962 	}
    963 	if (ntries == 5) {
    964 		ral_debug(RAL_DBG_ERR,
    965 		    "ural_rf_write(): could not write to RF\n");
    966 		return;
    967 	}
    968 
    969 	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xffff) << 2 | (reg & 0x3);
    970 	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
    971 	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
    972 
    973 	/* remember last written value in sc */
    974 	sc->rf_regs[reg] = val;
    975 
    976 	ral_debug(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
    977 }
    978 
    979 /*
    980  * Disable RF auto-tuning.
    981  */
    982 static void
    983 ural_disable_rf_tune(struct ural_softc *sc)
    984 {
    985 	uint32_t tmp;
    986 
    987 	if (sc->rf_rev != RAL_RF_2523) {
    988 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
    989 		ural_rf_write(sc, RAL_RF1, tmp);
    990 	}
    991 
    992 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
    993 	ural_rf_write(sc, RAL_RF3, tmp);
    994 
    995 	ral_debug(RAL_DBG_HW, "disabling RF autotune\n");
    996 }
    997 
    998 
    999 static void
   1000 ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
   1001 {
   1002 	struct ieee80211com *ic = &sc->sc_ic;
   1003 	uint8_t power, tmp;
   1004 	uint_t i, chan;
   1005 
   1006 	chan = ieee80211_chan2ieee(ic, c);
   1007 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
   1008 		return;
   1009 
   1010 	if (IEEE80211_IS_CHAN_2GHZ(c))
   1011 		power = min(sc->txpow[chan - 1], 31);
   1012 	else
   1013 		power = 31;
   1014 
   1015 	/* adjust txpower using ifconfig settings */
   1016 	power -= (100 - ic->ic_txpowlimit) / 8;
   1017 
   1018 	ral_debug(RAL_DBG_HW, "setting channel to %u, txpower to %u\n",
   1019 	    chan, power);
   1020 
   1021 	switch (sc->rf_rev) {
   1022 	case RAL_RF_2522:
   1023 		ural_rf_write(sc, RAL_RF1, 0x00814);
   1024 		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
   1025 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
   1026 		break;
   1027 
   1028 	case RAL_RF_2523:
   1029 		ural_rf_write(sc, RAL_RF1, 0x08804);
   1030 		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
   1031 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
   1032 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
   1033 		break;
   1034 
   1035 	case RAL_RF_2524:
   1036 		ural_rf_write(sc, RAL_RF1, 0x0c808);
   1037 		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
   1038 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
   1039 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
   1040 		break;
   1041 
   1042 	case RAL_RF_2525:
   1043 		ural_rf_write(sc, RAL_RF1, 0x08808);
   1044 		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
   1045 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
   1046 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
   1047 
   1048 		ural_rf_write(sc, RAL_RF1, 0x08808);
   1049 		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
   1050 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
   1051 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
   1052 		break;
   1053 
   1054 	case RAL_RF_2525E:
   1055 		ural_rf_write(sc, RAL_RF1, 0x08808);
   1056 		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
   1057 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
   1058 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
   1059 		break;
   1060 
   1061 	case RAL_RF_2526:
   1062 		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
   1063 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
   1064 		ural_rf_write(sc, RAL_RF1, 0x08804);
   1065 
   1066 		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
   1067 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
   1068 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
   1069 		break;
   1070 
   1071 	/* dual-band RF */
   1072 	case RAL_RF_5222:
   1073 		for (i = 0; ural_rf5222[i].chan != chan; i++) {
   1074 			if (i > URAL_N(ural_rf5222)) break;
   1075 		}
   1076 
   1077 		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
   1078 		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
   1079 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
   1080 		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
   1081 		break;
   1082 	}
   1083 
   1084 	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
   1085 	    ic->ic_state != IEEE80211_S_SCAN) {
   1086 		/* set Japan filter bit for channel 14 */
   1087 		tmp = ural_bbp_read(sc, 70);
   1088 
   1089 		tmp &= ~RAL_JAPAN_FILTER;
   1090 		if (chan == 14)
   1091 			tmp |= RAL_JAPAN_FILTER;
   1092 
   1093 		ural_bbp_write(sc, 70, tmp);
   1094 
   1095 		/* clear CRC errs */
   1096 		(void) ural_read(sc, RAL_STA_CSR0);
   1097 
   1098 		drv_usecwait(10000);
   1099 		ural_disable_rf_tune(sc);
   1100 	}
   1101 }
   1102 
   1103 /*
   1104  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
   1105  * synchronization.
   1106  */
   1107 static void
   1108 ural_enable_tsf_sync(struct ural_softc *sc)
   1109 {
   1110 	struct ieee80211com *ic = &sc->sc_ic;
   1111 	uint16_t logcwmin, preload, tmp;
   1112 
   1113 	/* first, disable TSF synchronization */
   1114 	ural_write(sc, RAL_TXRX_CSR19, 0);
   1115 
   1116 	tmp = (16 * ic->ic_bss->in_intval) << 4;
   1117 	ural_write(sc, RAL_TXRX_CSR18, tmp);
   1118 
   1119 	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
   1120 	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
   1121 	tmp = logcwmin << 12 | preload;
   1122 	ural_write(sc, RAL_TXRX_CSR20, tmp);
   1123 
   1124 	/* finally, enable TSF synchronization */
   1125 	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
   1126 	if (ic->ic_opmode == IEEE80211_M_STA)
   1127 		tmp |= RAL_ENABLE_TSF_SYNC(1);
   1128 	else
   1129 		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
   1130 	ural_write(sc, RAL_TXRX_CSR19, tmp);
   1131 
   1132 	ral_debug(RAL_DBG_HW, "enabling TSF synchronization\n");
   1133 }
   1134 
   1135 /*
   1136  * This function can be called by ieee80211_set_shortslottime(). Refer to
   1137  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
   1138  */
   1139 /* ARGSUSED */
   1140 static void
   1141 ural_update_slot(struct ieee80211com *ic, int onoff)
   1142 {
   1143 	struct ural_softc *sc = (struct ural_softc *)ic;
   1144 	uint16_t slottime, sifs, eifs;
   1145 
   1146 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
   1147 	/* slottime = (onoff ? 9 : 20); */
   1148 
   1149 	/*
   1150 	 * These settings may sound a bit inconsistent but this is what the
   1151 	 * reference driver does.
   1152 	 */
   1153 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
   1154 		sifs = 16 - RAL_RXTX_TURNAROUND;
   1155 		eifs = 364;
   1156 	} else {
   1157 		sifs = 10 - RAL_RXTX_TURNAROUND;
   1158 		eifs = 64;
   1159 	}
   1160 
   1161 	ural_write(sc, RAL_MAC_CSR10, slottime);
   1162 	ural_write(sc, RAL_MAC_CSR11, sifs);
   1163 	ural_write(sc, RAL_MAC_CSR12, eifs);
   1164 }
   1165 
   1166 static void
   1167 ural_set_txpreamble(struct ural_softc *sc)
   1168 {
   1169 	uint16_t tmp;
   1170 
   1171 	tmp = ural_read(sc, RAL_TXRX_CSR10);
   1172 
   1173 	tmp &= ~RAL_SHORT_PREAMBLE;
   1174 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
   1175 		tmp |= RAL_SHORT_PREAMBLE;
   1176 
   1177 	ural_write(sc, RAL_TXRX_CSR10, tmp);
   1178 }
   1179 
   1180 static void
   1181 ural_set_basicrates(struct ural_softc *sc)
   1182 {
   1183 	struct ieee80211com *ic = &sc->sc_ic;
   1184 
   1185 	/* update basic rate set */
   1186 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
   1187 		/* 11b basic rates: 1, 2Mbps */
   1188 		ural_write(sc, RAL_TXRX_CSR11, 0x3);
   1189 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->in_chan)) {
   1190 		/* 11a basic rates: 6, 12, 24Mbps */
   1191 		ural_write(sc, RAL_TXRX_CSR11, 0x150);
   1192 	} else {
   1193 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
   1194 		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
   1195 	}
   1196 }
   1197 
   1198 static void
   1199 ural_set_bssid(struct ural_softc *sc, uint8_t *bssid)
   1200 {
   1201 	uint16_t tmp;
   1202 
   1203 	tmp = bssid[0] | bssid[1] << 8;
   1204 	ural_write(sc, RAL_MAC_CSR5, tmp);
   1205 
   1206 	tmp = bssid[2] | bssid[3] << 8;
   1207 	ural_write(sc, RAL_MAC_CSR6, tmp);
   1208 
   1209 	tmp = bssid[4] | bssid[5] << 8;
   1210 	ural_write(sc, RAL_MAC_CSR7, tmp);
   1211 
   1212 	ral_debug(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
   1213 }
   1214 
   1215 static void
   1216 ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
   1217 {
   1218 	uint16_t tmp;
   1219 
   1220 	tmp = addr[0] | addr[1] << 8;
   1221 	ural_write(sc, RAL_MAC_CSR2, tmp);
   1222 
   1223 	tmp = addr[2] | addr[3] << 8;
   1224 	ural_write(sc, RAL_MAC_CSR3, tmp);
   1225 
   1226 	tmp = addr[4] | addr[5] << 8;
   1227 	ural_write(sc, RAL_MAC_CSR4, tmp);
   1228 
   1229 	ral_debug(RAL_DBG_HW,
   1230 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
   1231 }
   1232 
   1233 static void
   1234 ural_update_promisc(struct ural_softc *sc)
   1235 {
   1236 	uint32_t tmp;
   1237 
   1238 	tmp = ural_read(sc, RAL_TXRX_CSR2);
   1239 
   1240 	tmp &= ~RAL_DROP_NOT_TO_ME;
   1241 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
   1242 		tmp |= RAL_DROP_NOT_TO_ME;
   1243 
   1244 	ural_write(sc, RAL_TXRX_CSR2, tmp);
   1245 
   1246 	ral_debug(RAL_DBG_HW, "%s promiscuous mode\n",
   1247 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
   1248 }
   1249 
   1250 static const char *
   1251 ural_get_rf(int rev)
   1252 {
   1253 	switch (rev) {
   1254 	case RAL_RF_2522:	return ("RT2522");
   1255 	case RAL_RF_2523:	return ("RT2523");
   1256 	case RAL_RF_2524:	return ("RT2524");
   1257 	case RAL_RF_2525:	return ("RT2525");
   1258 	case RAL_RF_2525E:	return ("RT2525e");
   1259 	case RAL_RF_2526:	return ("RT2526");
   1260 	case RAL_RF_5222:	return ("RT5222");
   1261 	default:		return ("unknown");
   1262 	}
   1263 }
   1264 
   1265 static void
   1266 ural_read_eeprom(struct ural_softc *sc)
   1267 {
   1268 	struct ieee80211com *ic = &sc->sc_ic;
   1269 	uint16_t val;
   1270 
   1271 	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
   1272 	val = LE_16(val);
   1273 	sc->rf_rev =   (val >> 11) & 0x7;
   1274 	sc->hw_radio = (val >> 10) & 0x1;
   1275 	sc->led_mode = (val >> 6)  & 0x7;
   1276 	sc->rx_ant =   (val >> 4)  & 0x3;
   1277 	sc->tx_ant =   (val >> 2)  & 0x3;
   1278 	sc->nb_ant =   val & 0x3;
   1279 
   1280 	/* read MAC address */
   1281 	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, ic->ic_macaddr, 6);
   1282 
   1283 	/* read default values for BBP registers */
   1284 	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
   1285 
   1286 	/* read Tx power for all b/g channels */
   1287 	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
   1288 }
   1289 
   1290 static int
   1291 ural_bbp_init(struct ural_softc *sc)
   1292 {
   1293 	int i, ntries;
   1294 
   1295 	/* wait for BBP to be ready */
   1296 	for (ntries = 0; ntries < 100; ntries++) {
   1297 		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
   1298 			break;
   1299 		drv_usecwait(1000);
   1300 	}
   1301 	if (ntries == 100) {
   1302 		ral_debug(RAL_DBG_ERR, "timeout waiting for BBP\n");
   1303 		return (EIO);
   1304 	}
   1305 
   1306 	/* initialize BBP registers to default values */
   1307 	for (i = 0; i < URAL_N(ural_def_bbp); i++)
   1308 		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
   1309 
   1310 	return (0);
   1311 }
   1312 
   1313 static void
   1314 ural_set_txantenna(struct ural_softc *sc, int antenna)
   1315 {
   1316 	uint16_t tmp;
   1317 	uint8_t tx;
   1318 
   1319 	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
   1320 	if (antenna == 1)
   1321 		tx |= RAL_BBP_ANTA;
   1322 	else if (antenna == 2)
   1323 		tx |= RAL_BBP_ANTB;
   1324 	else
   1325 		tx |= RAL_BBP_DIVERSITY;
   1326 
   1327 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
   1328 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
   1329 	    sc->rf_rev == RAL_RF_5222)
   1330 		tx |= RAL_BBP_FLIPIQ;
   1331 
   1332 	ural_bbp_write(sc, RAL_BBP_TX, tx);
   1333 
   1334 	/* update values in PHY_CSR5 and PHY_CSR6 */
   1335 	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
   1336 	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
   1337 
   1338 	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
   1339 	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
   1340 }
   1341 
   1342 static void
   1343 ural_set_rxantenna(struct ural_softc *sc, int antenna)
   1344 {
   1345 	uint8_t rx;
   1346 
   1347 	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
   1348 	if (antenna == 1)
   1349 		rx |= RAL_BBP_ANTA;
   1350 	else if (antenna == 2)
   1351 		rx |= RAL_BBP_ANTB;
   1352 	else
   1353 		rx |= RAL_BBP_DIVERSITY;
   1354 
   1355 	/* need to force no I/Q flip for RF 2525e and 2526 */
   1356 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
   1357 		rx &= ~RAL_BBP_FLIPIQ;
   1358 
   1359 	ural_bbp_write(sc, RAL_BBP_RX, rx);
   1360 }
   1361 
   1362 /*
   1363  * This function is called periodically (every 200ms) during scanning to
   1364  * switch from one channel to another.
   1365  */
   1366 static void
   1367 ural_next_scan(void *arg)
   1368 {
   1369 	struct ural_softc *sc = arg;
   1370 	struct ieee80211com *ic = &sc->sc_ic;
   1371 
   1372 	if (ic->ic_state == IEEE80211_S_SCAN)
   1373 		ieee80211_next_scan(ic);
   1374 }
   1375 
   1376 static int
   1377 ural_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
   1378 {
   1379 	struct ural_softc *sc = (struct ural_softc *)ic;
   1380 	enum ieee80211_state ostate;
   1381 	struct ieee80211_node *ni;
   1382 	int err;
   1383 
   1384 	RAL_LOCK(sc);
   1385 
   1386 	ostate = ic->ic_state;
   1387 
   1388 	if (sc->sc_scan_id != 0) {
   1389 		(void) untimeout(sc->sc_scan_id);
   1390 		sc->sc_scan_id = 0;
   1391 	}
   1392 
   1393 	if (sc->sc_amrr_id != 0) {
   1394 		(void) untimeout(sc->sc_amrr_id);
   1395 		sc->sc_amrr_id = 0;
   1396 	}
   1397 
   1398 	switch (nstate) {
   1399 	case IEEE80211_S_INIT:
   1400 		if (ostate == IEEE80211_S_RUN) {
   1401 			/* abort TSF synchronization */
   1402 			ural_write(sc, RAL_TXRX_CSR19, 0);
   1403 			/* force tx led to stop blinking */
   1404 			ural_write(sc, RAL_MAC_CSR20, 0);
   1405 		}
   1406 		break;
   1407 
   1408 	case IEEE80211_S_SCAN:
   1409 		ural_set_chan(sc, ic->ic_curchan);
   1410 		sc->sc_scan_id = timeout(ural_next_scan, (void *)sc,
   1411 		    drv_usectohz(sc->dwelltime * 1000));
   1412 		break;
   1413 
   1414 	case IEEE80211_S_AUTH:
   1415 		ural_set_chan(sc, ic->ic_curchan);
   1416 		break;
   1417 
   1418 	case IEEE80211_S_ASSOC:
   1419 		ural_set_chan(sc, ic->ic_curchan);
   1420 		break;
   1421 
   1422 	case IEEE80211_S_RUN:
   1423 		ural_set_chan(sc, ic->ic_curchan);
   1424 
   1425 		ni = ic->ic_bss;
   1426 
   1427 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
   1428 			ural_update_slot(ic, 1);
   1429 			ural_set_txpreamble(sc);
   1430 			ural_set_basicrates(sc);
   1431 			ural_set_bssid(sc, ni->in_bssid);
   1432 		}
   1433 
   1434 
   1435 		/* make tx led blink on tx (controlled by ASIC) */
   1436 		ural_write(sc, RAL_MAC_CSR20, 1);
   1437 
   1438 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
   1439 			ural_enable_tsf_sync(sc);
   1440 
   1441 		/* enable automatic rate adaptation in STA mode */
   1442 		if (ic->ic_opmode == IEEE80211_M_STA &&
   1443 		    ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
   1444 			ural_amrr_start(sc, ni);
   1445 
   1446 		break;
   1447 	}
   1448 
   1449 	RAL_UNLOCK(sc);
   1450 
   1451 	err = sc->sc_newstate(ic, nstate, arg);
   1452 	/*
   1453 	 * Finally, start any timers.
   1454 	 */
   1455 	if (nstate == IEEE80211_S_RUN)
   1456 		ieee80211_start_watchdog(ic, 1);
   1457 
   1458 	return (err);
   1459 }
   1460 
   1461 
   1462 
   1463 static void
   1464 ural_close_pipes(struct ural_softc *sc)
   1465 {
   1466 	usb_flags_t flags = USB_FLAGS_SLEEP;
   1467 
   1468 	if (sc->sc_rx_pipeh != NULL) {
   1469 		usb_pipe_reset(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
   1470 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
   1471 		sc->sc_rx_pipeh = NULL;
   1472 	}
   1473 
   1474 	if (sc->sc_tx_pipeh != NULL) {
   1475 		usb_pipe_reset(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
   1476 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
   1477 		sc->sc_tx_pipeh = NULL;
   1478 	}
   1479 }
   1480 
   1481 static int
   1482 ural_open_pipes(struct ural_softc *sc)
   1483 {
   1484 	usb_ep_data_t *ep_node;
   1485 	usb_pipe_policy_t policy;
   1486 	int err;
   1487 
   1488 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
   1489 	    USB_EP_ATTR_BULK, USB_EP_DIR_OUT);
   1490 
   1491 	bzero(&policy, sizeof (usb_pipe_policy_t));
   1492 	policy.pp_max_async_reqs = RAL_TX_LIST_COUNT;
   1493 
   1494 	if ((err = usb_pipe_open(sc->sc_dev,
   1495 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
   1496 	    &sc->sc_tx_pipeh)) != USB_SUCCESS) {
   1497 		ral_debug(RAL_DBG_ERR,
   1498 		    "ural_open_pipes(): %x failed to open tx pipe\n", err);
   1499 		goto fail;
   1500 	}
   1501 
   1502 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
   1503 	    USB_EP_ATTR_BULK, USB_EP_DIR_IN);
   1504 
   1505 	bzero(&policy, sizeof (usb_pipe_policy_t));
   1506 	policy.pp_max_async_reqs = RAL_RX_LIST_COUNT + 32;
   1507 
   1508 	if ((err = usb_pipe_open(sc->sc_dev,
   1509 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
   1510 	    &sc->sc_rx_pipeh)) != USB_SUCCESS) {
   1511 		ral_debug(RAL_DBG_ERR,
   1512 		    "ural_open_pipes(): %x failed to open rx pipe\n", err);
   1513 		goto fail;
   1514 	}
   1515 
   1516 	return (USB_SUCCESS);
   1517 
   1518 fail:
   1519 	if (sc->sc_rx_pipeh != NULL) {
   1520 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh,
   1521 		    USB_FLAGS_SLEEP, NULL, 0);
   1522 		sc->sc_rx_pipeh = NULL;
   1523 	}
   1524 
   1525 	if (sc->sc_tx_pipeh != NULL) {
   1526 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh,
   1527 		    USB_FLAGS_SLEEP, NULL, 0);
   1528 		sc->sc_tx_pipeh = NULL;
   1529 	}
   1530 
   1531 	return (USB_FAILURE);
   1532 }
   1533 
   1534 static int
   1535 ural_tx_trigger(struct ural_softc *sc, mblk_t *mp)
   1536 {
   1537 	usb_bulk_req_t *req;
   1538 	int err;
   1539 
   1540 	sc->sc_tx_timer = RAL_TX_TIMEOUT;
   1541 
   1542 	req = usb_alloc_bulk_req(sc->sc_dev, 0, USB_FLAGS_SLEEP);
   1543 	if (req == NULL) {
   1544 		ral_debug(RAL_DBG_ERR,
   1545 		    "ural_tx_trigger(): failed to allocate req");
   1546 		freemsg(mp);
   1547 		return (-1);
   1548 	}
   1549 
   1550 	req->bulk_len		= (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
   1551 	req->bulk_data		= mp;
   1552 	req->bulk_client_private = (usb_opaque_t)sc;
   1553 	req->bulk_timeout	= RAL_TX_TIMEOUT;
   1554 	req->bulk_attributes	= USB_ATTRS_AUTOCLEARING;
   1555 	req->bulk_cb		= ural_txeof;
   1556 	req->bulk_exc_cb	= ural_txeof;
   1557 	req->bulk_completion_reason = 0;
   1558 	req->bulk_cb_flags	= 0;
   1559 
   1560 	if ((err = usb_pipe_bulk_xfer(sc->sc_tx_pipeh, req, 0))
   1561 	    != USB_SUCCESS) {
   1562 
   1563 		ral_debug(RAL_DBG_ERR, "ural_tx_trigger(): "
   1564 		    "failed to do tx xfer, %d", err);
   1565 		usb_free_bulk_req(req);
   1566 		return (-1);
   1567 	}
   1568 
   1569 	sc->tx_queued++;
   1570 
   1571 	return (0);
   1572 }
   1573 
   1574 static int
   1575 ural_rx_trigger(struct ural_softc *sc)
   1576 {
   1577 	usb_bulk_req_t *req;
   1578 	int err;
   1579 
   1580 	req = usb_alloc_bulk_req(sc->sc_dev, RAL_RXBUF_SIZE, USB_FLAGS_SLEEP);
   1581 	if (req == NULL) {
   1582 		ral_debug(RAL_DBG_ERR,
   1583 		    "ural_rx_trigger(): failed to allocate req");
   1584 		return (-1);
   1585 	}
   1586 
   1587 	req->bulk_len		= RAL_RXBUF_SIZE;
   1588 	req->bulk_client_private = (usb_opaque_t)sc;
   1589 	req->bulk_timeout	= 0;
   1590 	req->bulk_attributes	= USB_ATTRS_SHORT_XFER_OK
   1591 	    | USB_ATTRS_AUTOCLEARING;
   1592 	req->bulk_cb		= ural_rxeof;
   1593 	req->bulk_exc_cb	= ural_rxeof;
   1594 	req->bulk_completion_reason = 0;
   1595 	req->bulk_cb_flags	= 0;
   1596 
   1597 	err = usb_pipe_bulk_xfer(sc->sc_rx_pipeh, req, 0);
   1598 
   1599 	if (err != USB_SUCCESS) {
   1600 		ral_debug(RAL_DBG_ERR, "ural_rx_trigger(): "
   1601 		    "failed to do rx xfer, %d", err);
   1602 		usb_free_bulk_req(req);
   1603 
   1604 		return (-1);
   1605 	}
   1606 
   1607 	mutex_enter(&sc->rx_lock);
   1608 	sc->rx_queued++;
   1609 	mutex_exit(&sc->rx_lock);
   1610 
   1611 	return (0);
   1612 }
   1613 
   1614 static void
   1615 ural_init_tx_queue(struct ural_softc *sc)
   1616 {
   1617 	sc->tx_queued = 0;
   1618 }
   1619 
   1620 static int
   1621 ural_init_rx_queue(struct ural_softc *sc)
   1622 {
   1623 	int	i;
   1624 
   1625 	sc->rx_queued = 0;
   1626 
   1627 	for (i = 0; i < RAL_RX_LIST_COUNT; i++) {
   1628 		if (ural_rx_trigger(sc) != 0) {
   1629 			return (USB_FAILURE);
   1630 		}
   1631 	}
   1632 
   1633 	return (USB_SUCCESS);
   1634 }
   1635 
   1636 static void
   1637 ural_stop(struct ural_softc *sc)
   1638 {
   1639 	struct ieee80211com *ic = &sc->sc_ic;
   1640 
   1641 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   1642 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
   1643 
   1644 	RAL_LOCK(sc);
   1645 
   1646 	sc->sc_tx_timer = 0;
   1647 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
   1648 
   1649 	/* disable Rx */
   1650 	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
   1651 
   1652 	/* reset ASIC and BBP (but won't reset MAC registers!) */
   1653 	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
   1654 	ural_write(sc, RAL_MAC_CSR1, 0);
   1655 
   1656 	ural_close_pipes(sc);
   1657 
   1658 	RAL_UNLOCK(sc);
   1659 }
   1660 
   1661 static int
   1662 ural_init(struct ural_softc *sc)
   1663 {
   1664 	struct ieee80211com *ic = &sc->sc_ic;
   1665 	uint16_t tmp;
   1666 	int i, ntries;
   1667 
   1668 	ural_set_testmode(sc);
   1669 	ural_write(sc, 0x308, 0x00f0);	/* magic */
   1670 
   1671 	ural_stop(sc);
   1672 
   1673 	/* initialize MAC registers to default values */
   1674 	for (i = 0; i < URAL_N(ural_def_mac); i++)
   1675 		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
   1676 
   1677 	/* wait for BBP and RF to wake up (this can take a long time!) */
   1678 	for (ntries = 0; ntries < 100; ntries++) {
   1679 		tmp = ural_read(sc, RAL_MAC_CSR17);
   1680 		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
   1681 		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
   1682 			break;
   1683 		drv_usecwait(1000);
   1684 	}
   1685 	if (ntries == 100) {
   1686 		ral_debug(RAL_DBG_ERR,
   1687 		    "ural_init(): timeout waiting for BBP/RF to wakeup\n");
   1688 		goto fail;
   1689 	}
   1690 
   1691 	/* we're ready! */
   1692 	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
   1693 
   1694 	/* set basic rate set (will be updated later) */
   1695 	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
   1696 
   1697 	if (ural_bbp_init(sc) != 0)
   1698 		goto fail;
   1699 
   1700 	/* set default BSS channel */
   1701 	ural_set_chan(sc, ic->ic_curchan);
   1702 
   1703 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
   1704 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
   1705 
   1706 	ural_set_txantenna(sc, sc->tx_ant);
   1707 	ural_set_rxantenna(sc, sc->rx_ant);
   1708 
   1709 	ural_set_macaddr(sc, ic->ic_macaddr);
   1710 
   1711 	if (ural_open_pipes(sc) != USB_SUCCESS) {
   1712 		ral_debug(RAL_DBG_ERR, "ural_init(): "
   1713 		    "could not open pipes.\n");
   1714 		goto fail;
   1715 	}
   1716 
   1717 	ural_init_tx_queue(sc);
   1718 
   1719 	if (ural_init_rx_queue(sc) != USB_SUCCESS)
   1720 		goto fail;
   1721 
   1722 	/* kick Rx */
   1723 	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
   1724 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
   1725 		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
   1726 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
   1727 			tmp |= RAL_DROP_TODS;
   1728 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
   1729 			tmp |= RAL_DROP_NOT_TO_ME;
   1730 	}
   1731 	ural_write(sc, RAL_TXRX_CSR2, tmp);
   1732 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
   1733 
   1734 	return (DDI_SUCCESS);
   1735 fail:
   1736 	ural_stop(sc);
   1737 	return (EIO);
   1738 }
   1739 
   1740 static int
   1741 ural_disconnect(dev_info_t *devinfo)
   1742 {
   1743 	struct ural_softc *sc;
   1744 	struct ieee80211com *ic;
   1745 
   1746 	/*
   1747 	 * We can't call ural_stop() here, since the hardware is removed,
   1748 	 * we can't access the register anymore.
   1749 	 */
   1750 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
   1751 	ASSERT(sc != NULL);
   1752 
   1753 	if (!RAL_IS_RUNNING(sc))	/* different device or not inited */
   1754 		return (DDI_SUCCESS);
   1755 
   1756 	ic = &sc->sc_ic;
   1757 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
   1758 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
   1759 
   1760 	RAL_LOCK(sc);
   1761 
   1762 	sc->sc_tx_timer = 0;
   1763 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
   1764 
   1765 	ural_close_pipes(sc);
   1766 
   1767 	RAL_UNLOCK(sc);
   1768 
   1769 	return (DDI_SUCCESS);
   1770 }
   1771 
   1772 static int
   1773 ural_reconnect(dev_info_t *devinfo)
   1774 {
   1775 	struct ural_softc *sc;
   1776 	int err;
   1777 
   1778 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
   1779 	ASSERT(sc != NULL);
   1780 
   1781 	/* check device changes after disconnect */
   1782 	if (usb_check_same_device(sc->sc_dev, NULL, USB_LOG_L2, -1,
   1783 	    USB_CHK_BASIC | USB_CHK_CFG, NULL) != USB_SUCCESS) {
   1784 		ral_debug(RAL_DBG_ERR, "different device connected\n");
   1785 		return (DDI_FAILURE);
   1786 	}
   1787 
   1788 	err = ural_init(sc);
   1789 
   1790 	return (err);
   1791 }
   1792 
   1793 static void
   1794 ural_resume(struct ural_softc *sc)
   1795 {
   1796 	/* check device changes after suspend */
   1797 	if (usb_check_same_device(sc->sc_dev, NULL, USB_LOG_L2, -1,
   1798 	    USB_CHK_BASIC | USB_CHK_CFG, NULL) != USB_SUCCESS) {
   1799 		ral_debug(RAL_DBG_ERR, "no or different device connected\n");
   1800 		return;
   1801 	}
   1802 
   1803 	(void) ural_init(sc);
   1804 }
   1805 
   1806 #define	URAL_AMRR_MIN_SUCCESS_THRESHOLD	1
   1807 #define	URAL_AMRR_MAX_SUCCESS_THRESHOLD	10
   1808 
   1809 /*
   1810  * Naive implementation of the Adaptive Multi Rate Retry algorithm:
   1811  * "IEEE 802.11 Rate Adaptation: A Practical Approach"
   1812  * Mathieu Lacage, Hossein Manshaei, Thierry Turletti
   1813  * INRIA Sophia - Projet Planete
   1814  * http://www-sop.inria.fr/rapports/sophia/RR-5208.html
   1815  *
   1816  * This algorithm is particularly well suited for ural since it does not
   1817  * require per-frame retry statistics.  Note however that since h/w does
   1818  * not provide per-frame stats, we can't do per-node rate adaptation and
   1819  * thus automatic rate adaptation is only enabled in STA operating mode.
   1820  */
   1821 #define	is_success(amrr)	\
   1822 	((amrr)->retrycnt < (amrr)->txcnt / 10)
   1823 #define	is_failure(amrr)	\
   1824 	((amrr)->retrycnt > (amrr)->txcnt / 3)
   1825 #define	is_enough(amrr)		\
   1826 	((amrr)->txcnt > 10)
   1827 #define	is_min_rate(ni)		\
   1828 	((ni)->in_txrate == 0)
   1829 #define	is_max_rate(ni)		\
   1830 	((ni)->in_txrate == (ni)->in_rates.ir_nrates - 1)
   1831 #define	increase_rate(ni)	\
   1832 	((ni)->in_txrate++)
   1833 #define	decrease_rate(ni)	\
   1834 	((ni)->in_txrate--)
   1835 #define	reset_cnt(amrr)	do {	\
   1836 	(amrr)->txcnt = (amrr)->retrycnt = 0;	\
   1837 	_NOTE(CONSTCOND)	\
   1838 } while (/* CONSTCOND */0)
   1839 
   1840 static void
   1841 ural_ratectl(struct ural_amrr *amrr, struct ieee80211_node *ni)
   1842 {
   1843 	int need_change = 0;
   1844 
   1845 	if (is_success(amrr) && is_enough(amrr)) {
   1846 		amrr->success++;
   1847 		if (amrr->success >= amrr->success_threshold &&
   1848 		    !is_max_rate(ni)) {
   1849 			amrr->recovery = 1;
   1850 			amrr->success = 0;
   1851 			increase_rate(ni);
   1852 			need_change = 1;
   1853 		} else {
   1854 			amrr->recovery = 0;
   1855 		}
   1856 	} else if (is_failure(amrr)) {
   1857 		amrr->success = 0;
   1858 		if (!is_min_rate(ni)) {
   1859 			if (amrr->recovery) {
   1860 				amrr->success_threshold *= 2;
   1861 				if (amrr->success_threshold >
   1862 				    URAL_AMRR_MAX_SUCCESS_THRESHOLD)
   1863 					amrr->success_threshold =
   1864 					    URAL_AMRR_MAX_SUCCESS_THRESHOLD;
   1865 			} else {
   1866 				amrr->success_threshold =
   1867 				    URAL_AMRR_MIN_SUCCESS_THRESHOLD;
   1868 			}
   1869 			decrease_rate(ni);
   1870 			need_change = 1;
   1871 		}
   1872 		amrr->recovery = 0;	/* original paper was incorrect */
   1873 	}
   1874 
   1875 	if (is_enough(amrr) || need_change)
   1876 		reset_cnt(amrr);
   1877 }
   1878 
   1879 static void
   1880 ural_amrr_timeout(void *arg)
   1881 {
   1882 	struct ural_softc *sc = (struct ural_softc *)arg;
   1883 	struct ural_amrr *amrr = &sc->amrr;
   1884 
   1885 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
   1886 
   1887 	/* count TX retry-fail as Tx errors */
   1888 	sc->sc_tx_err += sc->sta[9];
   1889 	sc->sc_tx_retries += (sc->sta[7] + sc->sta[8]);
   1890 
   1891 	amrr->retrycnt =
   1892 	    sc->sta[7] +	/* TX one-retry ok count */
   1893 	    sc->sta[8] +	/* TX more-retry ok count */
   1894 	    sc->sta[9];		/* TX retry-fail count */
   1895 
   1896 	amrr->txcnt =
   1897 	    amrr->retrycnt +
   1898 	    sc->sta[6];		/* TX no-retry ok count */
   1899 
   1900 	ural_ratectl(amrr, sc->sc_ic.ic_bss);
   1901 
   1902 	sc->sc_amrr_id = timeout(ural_amrr_timeout, (void *)sc,
   1903 	    drv_usectohz(1000 * 1000)); /* 1 second */
   1904 }
   1905 
   1906 
   1907 static void
   1908 ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
   1909 {
   1910 	struct ural_amrr *amrr = &sc->amrr;
   1911 	int i;
   1912 
   1913 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
   1914 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
   1915 
   1916 	amrr->success = 0;
   1917 	amrr->recovery = 0;
   1918 	amrr->txcnt = amrr->retrycnt = 0;
   1919 	amrr->success_threshold = URAL_AMRR_MIN_SUCCESS_THRESHOLD;
   1920 
   1921 	/* set rate to some reasonable initial value */
   1922 	for (i = ni->in_rates.ir_nrates - 1;
   1923 	    i > 0 && (ni->in_rates.ir_rates[i] & IEEE80211_RATE_VAL) > 72;
   1924 	    i--) {
   1925 	}
   1926 
   1927 	ni->in_txrate = i;
   1928 
   1929 	sc->sc_amrr_id = timeout(ural_amrr_timeout, (void *)sc,
   1930 	    drv_usectohz(1000 * 1000)); /* 1 second */
   1931 }
   1932 
   1933 void
   1934 ural_watchdog(void *arg)
   1935 {
   1936 	struct ural_softc *sc = arg;
   1937 	struct ieee80211com *ic = &sc->sc_ic;
   1938 	int ntimer = 0;
   1939 
   1940 	RAL_LOCK(sc);
   1941 	ic->ic_watchdog_timer = 0;
   1942 
   1943 	if (!RAL_IS_RUNNING(sc)) {
   1944 		RAL_UNLOCK(sc);
   1945 		return;
   1946 	}
   1947 
   1948 	if (sc->sc_tx_timer > 0) {
   1949 		if (--sc->sc_tx_timer == 0) {
   1950 			ral_debug(RAL_DBG_ERR, "tx timer timeout\n");
   1951 			RAL_UNLOCK(sc);
   1952 			(void) ural_init(sc);
   1953 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
   1954 			return;
   1955 		}
   1956 	}
   1957 
   1958 	if (ic->ic_state == IEEE80211_S_RUN)
   1959 		ntimer = 1;
   1960 
   1961 	RAL_UNLOCK(sc);
   1962 
   1963 	ieee80211_watchdog(ic);
   1964 
   1965 	if (ntimer)
   1966 		ieee80211_start_watchdog(ic, ntimer);
   1967 }
   1968 
   1969 static int
   1970 ural_m_start(void *arg)
   1971 {
   1972 	struct ural_softc *sc = (struct ural_softc *)arg;
   1973 	int err;
   1974 
   1975 	/*
   1976 	 * initialize RT2500USB hardware
   1977 	 */
   1978 	err = ural_init(sc);
   1979 	if (err != DDI_SUCCESS) {
   1980 		ral_debug(RAL_DBG_ERR, "device configuration failed\n");
   1981 		goto fail;
   1982 	}
   1983 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
   1984 	return (err);
   1985 
   1986 fail:
   1987 	ural_stop(sc);
   1988 	return (err);
   1989 }
   1990 
   1991 static void
   1992 ural_m_stop(void *arg)
   1993 {
   1994 	struct ural_softc *sc = (struct ural_softc *)arg;
   1995 
   1996 	(void) ural_stop(sc);
   1997 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
   1998 }
   1999 
   2000 static int
   2001 ural_m_unicst(void *arg, const uint8_t *macaddr)
   2002 {
   2003 	struct ural_softc *sc = (struct ural_softc *)arg;
   2004 	struct ieee80211com *ic = &sc->sc_ic;
   2005 
   2006 	ral_debug(RAL_DBG_MSG, "ural_m_unicst(): " MACSTR "\n",
   2007 	    MAC2STR(macaddr));
   2008 
   2009 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
   2010 	(void) ural_set_macaddr(sc, (uint8_t *)macaddr);
   2011 	(void) ural_init(sc);
   2012 
   2013 	return (0);
   2014 }
   2015 
   2016 /*ARGSUSED*/
   2017 static int
   2018 ural_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
   2019 {
   2020 	return (0);
   2021 }
   2022 
   2023 static int
   2024 ural_m_promisc(void *arg, boolean_t on)
   2025 {
   2026 	struct ural_softc *sc = (struct ural_softc *)arg;
   2027 
   2028 	if (on) {
   2029 		sc->sc_rcr |= RAL_RCR_PROMISC;
   2030 		sc->sc_rcr |= RAL_RCR_MULTI;
   2031 	} else {
   2032 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
   2033 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
   2034 	}
   2035 
   2036 	ural_update_promisc(sc);
   2037 	return (0);
   2038 }
   2039 
   2040 /*
   2041  * callback functions for /get/set properties
   2042  */
   2043 static int
   2044 ural_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
   2045     uint_t wldp_length, const void *wldp_buf)
   2046 {
   2047 	struct ural_softc *sc = (struct ural_softc *)arg;
   2048 	struct ieee80211com *ic = &sc->sc_ic;
   2049 	int err;
   2050 
   2051 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
   2052 	    wldp_length, wldp_buf);
   2053 	RAL_LOCK(sc);
   2054 	if (err == ENETRESET) {
   2055 		if (RAL_IS_RUNNING(sc)) {
   2056 			RAL_UNLOCK(sc);
   2057 			(void) ural_init(sc);
   2058 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
   2059 			RAL_LOCK(sc);
   2060 		}
   2061 		err = 0;
   2062 	}
   2063 	RAL_UNLOCK(sc);
   2064 
   2065 	return (err);
   2066 }
   2067 
   2068 static int
   2069 ural_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
   2070     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
   2071 {
   2072 	struct ural_softc *sc = (struct ural_softc *)arg;
   2073 	int err;
   2074 
   2075 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
   2076 	    pr_flags, wldp_length, wldp_buf, perm);
   2077 
   2078 	return (err);
   2079 }
   2080 
   2081 static void
   2082 ural_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
   2083 {
   2084 	struct ural_softc *sc = (struct ural_softc *)arg;
   2085 	struct ieee80211com *ic = &sc->sc_ic;
   2086 	int err;
   2087 
   2088 	err = ieee80211_ioctl(ic, wq, mp);
   2089 	RAL_LOCK(sc);
   2090 	if (err == ENETRESET) {
   2091 		if (RAL_IS_RUNNING(sc)) {
   2092 			RAL_UNLOCK(sc);
   2093 			(void) ural_init(sc);
   2094 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
   2095 			RAL_LOCK(sc);
   2096 		}
   2097 	}
   2098 	RAL_UNLOCK(sc);
   2099 }
   2100 
   2101 static int
   2102 ural_m_stat(void *arg, uint_t stat, uint64_t *val)
   2103 {
   2104 	struct ural_softc *sc  = (struct ural_softc *)arg;
   2105 	ieee80211com_t	*ic = &sc->sc_ic;
   2106 	ieee80211_node_t *ni = ic->ic_bss;
   2107 	struct ieee80211_rateset *rs = &ni->in_rates;
   2108 
   2109 	RAL_LOCK(sc);
   2110 	switch (stat) {
   2111 	case MAC_STAT_IFSPEED:
   2112 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
   2113 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
   2114 		    : ic->ic_fixed_rate) / 2 * 1000000;
   2115 		break;
   2116 	case MAC_STAT_NOXMTBUF:
   2117 		*val = sc->sc_tx_nobuf;
   2118 		break;
   2119 	case MAC_STAT_NORCVBUF:
   2120 		*val = sc->sc_rx_nobuf;
   2121 		break;
   2122 	case MAC_STAT_IERRORS:
   2123 		*val = sc->sc_rx_err;
   2124 		break;
   2125 	case MAC_STAT_RBYTES:
   2126 		*val = ic->ic_stats.is_rx_bytes;
   2127 		break;
   2128 	case MAC_STAT_IPACKETS:
   2129 		*val = ic->ic_stats.is_rx_frags;
   2130 		break;
   2131 	case MAC_STAT_OBYTES:
   2132 		*val = ic->ic_stats.is_tx_bytes;
   2133 		break;
   2134 	case MAC_STAT_OPACKETS:
   2135 		*val = ic->ic_stats.is_tx_frags;
   2136 		break;
   2137 	case MAC_STAT_OERRORS:
   2138 	case WIFI_STAT_TX_FAILED:
   2139 		*val = sc->sc_tx_err;
   2140 		break;
   2141 	case WIFI_STAT_TX_RETRANS:
   2142 		*val = sc->sc_tx_retries;
   2143 		break;
   2144 	case WIFI_STAT_FCS_ERRORS:
   2145 	case WIFI_STAT_WEP_ERRORS:
   2146 	case WIFI_STAT_TX_FRAGS:
   2147 	case WIFI_STAT_MCAST_TX:
   2148 	case WIFI_STAT_RTS_SUCCESS:
   2149 	case WIFI_STAT_RTS_FAILURE:
   2150 	case WIFI_STAT_ACK_FAILURE:
   2151 	case WIFI_STAT_RX_FRAGS:
   2152 	case WIFI_STAT_MCAST_RX:
   2153 	case WIFI_STAT_RX_DUPS:
   2154 		RAL_UNLOCK(sc);
   2155 		return (ieee80211_stat(ic, stat, val));
   2156 	default:
   2157 		RAL_UNLOCK(sc);
   2158 		return (ENOTSUP);
   2159 	}
   2160 	RAL_UNLOCK(sc);
   2161 
   2162 	return (0);
   2163 }
   2164 
   2165 
   2166 static int
   2167 ural_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
   2168 {
   2169 	struct ural_softc *sc;
   2170 	struct ieee80211com *ic;
   2171 	int err, i;
   2172 	int instance;
   2173 
   2174 	char strbuf[32];
   2175 
   2176 	wifi_data_t wd = { 0 };
   2177 	mac_register_t *macp;
   2178 
   2179 	switch (cmd) {
   2180 	case DDI_ATTACH:
   2181 		break;
   2182 	case DDI_RESUME:
   2183 		sc = ddi_get_soft_state(ural_soft_state_p,
   2184 		    ddi_get_instance(devinfo));
   2185 		ASSERT(sc != NULL);
   2186 		ural_resume(sc);
   2187 		return (DDI_SUCCESS);
   2188 	default:
   2189 		return (DDI_FAILURE);
   2190 	}
   2191 
   2192 	instance = ddi_get_instance(devinfo);
   2193 
   2194 	if (ddi_soft_state_zalloc(ural_soft_state_p, instance) != DDI_SUCCESS) {
   2195 		ral_debug(RAL_DBG_MSG, "ural_attach(): "
   2196 		    "unable to alloc soft_state_p\n");
   2197 		return (DDI_FAILURE);
   2198 	}
   2199 
   2200 	sc = ddi_get_soft_state(ural_soft_state_p, instance);
   2201 	ic = (ieee80211com_t *)&sc->sc_ic;
   2202 	sc->sc_dev = devinfo;
   2203 
   2204 	if (usb_client_attach(devinfo, USBDRV_VERSION, 0) != USB_SUCCESS) {
   2205 		ral_debug(RAL_DBG_ERR,
   2206 		    "ural_attach(): usb_client_attach failed\n");
   2207 		goto fail1;
   2208 	}
   2209 
   2210 	if (usb_get_dev_data(devinfo, &sc->sc_udev,
   2211 	    USB_PARSE_LVL_ALL, 0) != USB_SUCCESS) {
   2212 		sc->sc_udev = NULL;
   2213 		goto fail2;
   2214 	}
   2215 
   2216 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
   2217 	mutex_init(&sc->tx_lock, NULL, MUTEX_DRIVER, NULL);
   2218 	mutex_init(&sc->rx_lock, NULL, MUTEX_DRIVER, NULL);
   2219 
   2220 	/* retrieve RT2570 rev. no */
   2221 	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
   2222 
   2223 	/* retrieve MAC address and various other things from EEPROM */
   2224 	ural_read_eeprom(sc);
   2225 
   2226 	ral_debug(RAL_DBG_MSG, "ural: MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
   2227 	    sc->asic_rev, ural_get_rf(sc->rf_rev));
   2228 
   2229 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
   2230 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
   2231 	ic->ic_state = IEEE80211_S_INIT;
   2232 
   2233 	ic->ic_maxrssi = 63;
   2234 	ic->ic_set_shortslot = ural_update_slot;
   2235 	ic->ic_xmit = ural_send;
   2236 
   2237 	/* set device capabilities */
   2238 	ic->ic_caps =
   2239 	    IEEE80211_C_TXPMGT |	/* tx power management */
   2240 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
   2241 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
   2242 
   2243 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
   2244 
   2245 #define	IEEE80211_CHAN_A	\
   2246 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
   2247 
   2248 	if (sc->rf_rev == RAL_RF_5222) {
   2249 		/* set supported .11a rates */
   2250 		ic->ic_sup_rates[IEEE80211_MODE_11A] = ural_rateset_11a;
   2251 
   2252 		/* set supported .11a channels */
   2253 		for (i = 36; i <= 64; i += 4) {
   2254 			ic->ic_sup_channels[i].ich_freq =
   2255 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
   2256 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
   2257 		}
   2258 		for (i = 100; i <= 140; i += 4) {
   2259 			ic->ic_sup_channels[i].ich_freq =
   2260 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
   2261 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
   2262 		}
   2263 		for (i = 149; i <= 161; i += 4) {
   2264 			ic->ic_sup_channels[i].ich_freq =
   2265 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
   2266 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
   2267 		}
   2268 	}
   2269 
   2270 	/* set supported .11b and .11g rates */
   2271 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ural_rateset_11b;
   2272 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ural_rateset_11g;
   2273 
   2274 	/* set supported .11b and .11g channels (1 through 14) */
   2275 	for (i = 1; i <= 14; i++) {
   2276 		ic->ic_sup_channels[i].ich_freq =
   2277 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
   2278 		ic->ic_sup_channels[i].ich_flags =
   2279 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
   2280 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
   2281 	}
   2282 
   2283 	ieee80211_attach(ic);
   2284 
   2285 	/* register WPA door */
   2286 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
   2287 	    ddi_get_instance(devinfo));
   2288 
   2289 	/* override state transition machine */
   2290 	sc->sc_newstate = ic->ic_newstate;
   2291 	ic->ic_newstate = ural_newstate;
   2292 	ic->ic_watchdog = ural_watchdog;
   2293 	ieee80211_media_init(ic);
   2294 	ic->ic_def_txkey = 0;
   2295 
   2296 	sc->sc_rcr = 0;
   2297 	sc->dwelltime = 300;
   2298 	sc->sc_flags &= 0;
   2299 
   2300 	/*
   2301 	 * Provide initial settings for the WiFi plugin; whenever this
   2302 	 * information changes, we need to call mac_plugindata_update()
   2303 	 */
   2304 	wd.wd_opmode = ic->ic_opmode;
   2305 	wd.wd_secalloc = WIFI_SEC_NONE;
   2306 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
   2307 
   2308 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
   2309 		ral_debug(RAL_DBG_ERR, "ural_attach(): "
   2310 		    "MAC version mismatch\n");
   2311 		goto fail3;
   2312 	}
   2313 
   2314 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
   2315 	macp->m_driver		= sc;
   2316 	macp->m_dip		= devinfo;
   2317 	macp->m_src_addr	= ic->ic_macaddr;
   2318 	macp->m_callbacks	= &ural_m_callbacks;
   2319 	macp->m_min_sdu		= 0;
   2320 	macp->m_max_sdu		= IEEE80211_MTU;
   2321 	macp->m_pdata		= &wd;
   2322 	macp->m_pdata_size	= sizeof (wd);
   2323 
   2324 	err = mac_register(macp, &ic->ic_mach);
   2325 	mac_free(macp);
   2326 	if (err != 0) {
   2327 		ral_debug(RAL_DBG_ERR, "ural_attach(): "
   2328 		    "mac_register() err %x\n", err);
   2329 		goto fail3;
   2330 	}
   2331 
   2332 	if (usb_register_hotplug_cbs(devinfo, ural_disconnect,
   2333 	    ural_reconnect) != USB_SUCCESS) {
   2334 		ral_debug(RAL_DBG_ERR,
   2335 		    "ural: ural_attach() failed to register events");
   2336 		goto fail4;
   2337 	}
   2338 
   2339 	/*
   2340 	 * Create minor node of type DDI_NT_NET_WIFI
   2341 	 */
   2342 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
   2343 	    "ural", instance);
   2344 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
   2345 	    instance + 1, DDI_NT_NET_WIFI, 0);
   2346 
   2347 	if (err != DDI_SUCCESS)
   2348 		ral_debug(RAL_DBG_ERR, "ddi_create_minor_node() failed\n");
   2349 
   2350 	/*
   2351 	 * Notify link is down now
   2352 	 */
   2353 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
   2354 
   2355 	return (DDI_SUCCESS);
   2356 fail4:
   2357 	(void) mac_unregister(ic->ic_mach);
   2358 fail3:
   2359 	mutex_destroy(&sc->sc_genlock);
   2360 	mutex_destroy(&sc->tx_lock);
   2361 	mutex_destroy(&sc->rx_lock);
   2362 fail2:
   2363 	usb_client_detach(sc->sc_dev, sc->sc_udev);
   2364 fail1:
   2365 	ddi_soft_state_free(ural_soft_state_p, ddi_get_instance(devinfo));
   2366 
   2367 	return (DDI_FAILURE);
   2368 }
   2369 
   2370 static int
   2371 ural_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
   2372 {
   2373 	struct ural_softc *sc;
   2374 
   2375 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
   2376 	ASSERT(sc != NULL);
   2377 
   2378 	switch (cmd) {
   2379 	case DDI_DETACH:
   2380 		break;
   2381 	case DDI_SUSPEND:
   2382 		if (RAL_IS_RUNNING(sc))
   2383 			(void) ural_stop(sc);
   2384 		return (DDI_SUCCESS);
   2385 	default:
   2386 		return (DDI_FAILURE);
   2387 	}
   2388 
   2389 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
   2390 		return (DDI_FAILURE);
   2391 
   2392 	ural_stop(sc);
   2393 	usb_unregister_hotplug_cbs(devinfo);
   2394 
   2395 	/*
   2396 	 * Unregister from the MAC layer subsystem
   2397 	 */
   2398 	(void) mac_unregister(sc->sc_ic.ic_mach);
   2399 
   2400 	/*
   2401 	 * detach ieee80211 layer
   2402 	 */
   2403 	ieee80211_detach(&sc->sc_ic);
   2404 
   2405 	mutex_destroy(&sc->sc_genlock);
   2406 	mutex_destroy(&sc->tx_lock);
   2407 	mutex_destroy(&sc->rx_lock);
   2408 
   2409 	/* pipes will be close in ural_stop() */
   2410 	usb_client_detach(devinfo, sc->sc_udev);
   2411 	sc->sc_udev = NULL;
   2412 
   2413 	ddi_remove_minor_node(devinfo, NULL);
   2414 	ddi_soft_state_free(ural_soft_state_p, ddi_get_instance(devinfo));
   2415 
   2416 	return (DDI_SUCCESS);
   2417 }
   2418 
   2419 int
   2420 _info(struct modinfo *modinfop)
   2421 {
   2422 	return (mod_info(&modlinkage, modinfop));
   2423 }
   2424 
   2425 int
   2426 _init(void)
   2427 {
   2428 	int status;
   2429 
   2430 	status = ddi_soft_state_init(&ural_soft_state_p,
   2431 	    sizeof (struct ural_softc), 1);
   2432 	if (status != 0)
   2433 		return (status);
   2434 
   2435 	mac_init_ops(&ural_dev_ops, "ural");
   2436 	status = mod_install(&modlinkage);
   2437 	if (status != 0) {
   2438 		mac_fini_ops(&ural_dev_ops);
   2439 		ddi_soft_state_fini(&ural_soft_state_p);
   2440 	}
   2441 	return (status);
   2442 }
   2443 
   2444 int
   2445 _fini(void)
   2446 {
   2447 	int status;
   2448 
   2449 	status = mod_remove(&modlinkage);
   2450 	if (status == 0) {
   2451 		mac_fini_ops(&ural_dev_ops);
   2452 		ddi_soft_state_fini(&ural_soft_state_p);
   2453 	}
   2454 	return (status);
   2455 }
   2456