xref: /freebsd/sys/dev/usb/wlan/if_zyd.c (revision 4c8ffb2300fc8c507996d39d44dc1b0da2784099)
1 /*	$OpenBSD: if_zyd.c,v 1.52 2007/02/11 00:08:04 jsg Exp $	*/
2 /*	$NetBSD: if_zyd.c,v 1.7 2007/06/21 04:04:29 kiyohara Exp $	*/
3 /*	$FreeBSD$	*/
4 
5 /*-
6  * Copyright (c) 2006 by Damien Bergamini <damien.bergamini@free.fr>
7  * Copyright (c) 2006 by Florian Stoehr <ich@florian-stoehr.de>
8  *
9  * Permission to use, copy, modify, and distribute this software for any
10  * purpose with or without fee is hereby granted, provided that the above
11  * copyright notice and this permission notice appear in all copies.
12  *
13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20  */
21 
22 #include <sys/cdefs.h>
23 __FBSDID("$FreeBSD$");
24 
25 /*
26  * ZyDAS ZD1211/ZD1211B USB WLAN driver.
27  */
28 
29 #include <sys/param.h>
30 #include <sys/sockio.h>
31 #include <sys/sysctl.h>
32 #include <sys/lock.h>
33 #include <sys/mutex.h>
34 #include <sys/condvar.h>
35 #include <sys/mbuf.h>
36 #include <sys/kernel.h>
37 #include <sys/socket.h>
38 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/module.h>
41 #include <sys/bus.h>
42 #include <sys/endian.h>
43 #include <sys/kdb.h>
44 
45 #include <machine/bus.h>
46 #include <machine/resource.h>
47 #include <sys/rman.h>
48 
49 #include <net/bpf.h>
50 #include <net/if.h>
51 #include <net/if_arp.h>
52 #include <net/ethernet.h>
53 #include <net/if_dl.h>
54 #include <net/if_media.h>
55 #include <net/if_types.h>
56 
57 #ifdef INET
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/in_var.h>
61 #include <netinet/if_ether.h>
62 #include <netinet/ip.h>
63 #endif
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_regdomain.h>
67 #include <net80211/ieee80211_radiotap.h>
68 #include <net80211/ieee80211_ratectl.h>
69 
70 #include <dev/usb/usb.h>
71 #include <dev/usb/usbdi.h>
72 #include <dev/usb/usbdi_util.h>
73 #include "usbdevs.h"
74 
75 #include <dev/usb/wlan/if_zydreg.h>
76 #include <dev/usb/wlan/if_zydfw.h>
77 
78 #ifdef USB_DEBUG
79 static int zyd_debug = 0;
80 
81 SYSCTL_NODE(_hw_usb, OID_AUTO, zyd, CTLFLAG_RW, 0, "USB zyd");
82 SYSCTL_INT(_hw_usb_zyd, OID_AUTO, debug, CTLFLAG_RW, &zyd_debug, 0,
83     "zyd debug level");
84 
85 enum {
86 	ZYD_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
87 	ZYD_DEBUG_RECV		= 0x00000002,	/* basic recv operation */
88 	ZYD_DEBUG_RESET		= 0x00000004,	/* reset processing */
89 	ZYD_DEBUG_INIT		= 0x00000008,	/* device init */
90 	ZYD_DEBUG_TX_PROC	= 0x00000010,	/* tx ISR proc */
91 	ZYD_DEBUG_RX_PROC	= 0x00000020,	/* rx ISR proc */
92 	ZYD_DEBUG_STATE		= 0x00000040,	/* 802.11 state transitions */
93 	ZYD_DEBUG_STAT		= 0x00000080,	/* statistic */
94 	ZYD_DEBUG_FW		= 0x00000100,	/* firmware */
95 	ZYD_DEBUG_CMD		= 0x00000200,	/* fw commands */
96 	ZYD_DEBUG_ANY		= 0xffffffff
97 };
98 #define	DPRINTF(sc, m, fmt, ...) do {				\
99 	if (zyd_debug & (m))					\
100 		printf("%s: " fmt, __func__, ## __VA_ARGS__);	\
101 } while (0)
102 #else
103 #define	DPRINTF(sc, m, fmt, ...) do {				\
104 	(void) sc;						\
105 } while (0)
106 #endif
107 
108 #define	zyd_do_request(sc,req,data) \
109     usbd_do_request_flags((sc)->sc_udev, &(sc)->sc_mtx, req, data, 0, NULL, 5000)
110 
111 static device_probe_t zyd_match;
112 static device_attach_t zyd_attach;
113 static device_detach_t zyd_detach;
114 
115 static usb_callback_t zyd_intr_read_callback;
116 static usb_callback_t zyd_intr_write_callback;
117 static usb_callback_t zyd_bulk_read_callback;
118 static usb_callback_t zyd_bulk_write_callback;
119 
120 static struct ieee80211vap *zyd_vap_create(struct ieee80211com *,
121 		    const char name[IFNAMSIZ], int unit, int opmode,
122 		    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
123 		    const uint8_t mac[IEEE80211_ADDR_LEN]);
124 static void	zyd_vap_delete(struct ieee80211vap *);
125 static void	zyd_tx_free(struct zyd_tx_data *, int);
126 static void	zyd_setup_tx_list(struct zyd_softc *);
127 static void	zyd_unsetup_tx_list(struct zyd_softc *);
128 static int	zyd_newstate(struct ieee80211vap *, enum ieee80211_state, int);
129 static int	zyd_cmd(struct zyd_softc *, uint16_t, const void *, int,
130 		    void *, int, int);
131 static int	zyd_read16(struct zyd_softc *, uint16_t, uint16_t *);
132 static int	zyd_read32(struct zyd_softc *, uint16_t, uint32_t *);
133 static int	zyd_write16(struct zyd_softc *, uint16_t, uint16_t);
134 static int	zyd_write32(struct zyd_softc *, uint16_t, uint32_t);
135 static int	zyd_rfwrite(struct zyd_softc *, uint32_t);
136 static int	zyd_lock_phy(struct zyd_softc *);
137 static int	zyd_unlock_phy(struct zyd_softc *);
138 static int	zyd_rf_attach(struct zyd_softc *, uint8_t);
139 static const char *zyd_rf_name(uint8_t);
140 static int	zyd_hw_init(struct zyd_softc *);
141 static int	zyd_read_pod(struct zyd_softc *);
142 static int	zyd_read_eeprom(struct zyd_softc *);
143 static int	zyd_get_macaddr(struct zyd_softc *);
144 static int	zyd_set_macaddr(struct zyd_softc *, const uint8_t *);
145 static int	zyd_set_bssid(struct zyd_softc *, const uint8_t *);
146 static int	zyd_switch_radio(struct zyd_softc *, int);
147 static int	zyd_set_led(struct zyd_softc *, int, int);
148 static void	zyd_set_multi(struct zyd_softc *);
149 static void	zyd_update_mcast(struct ifnet *);
150 static int	zyd_set_rxfilter(struct zyd_softc *);
151 static void	zyd_set_chan(struct zyd_softc *, struct ieee80211_channel *);
152 static int	zyd_set_beacon_interval(struct zyd_softc *, int);
153 static void	zyd_rx_data(struct usb_xfer *, int, uint16_t);
154 static int	zyd_tx_start(struct zyd_softc *, struct mbuf *,
155 		    struct ieee80211_node *);
156 static void	zyd_start(struct ifnet *);
157 static int	zyd_raw_xmit(struct ieee80211_node *, struct mbuf *,
158 		    const struct ieee80211_bpf_params *);
159 static int	zyd_ioctl(struct ifnet *, u_long, caddr_t);
160 static void	zyd_init_locked(struct zyd_softc *);
161 static void	zyd_init(void *);
162 static void	zyd_stop(struct zyd_softc *);
163 static int	zyd_loadfirmware(struct zyd_softc *);
164 static void	zyd_scan_start(struct ieee80211com *);
165 static void	zyd_scan_end(struct ieee80211com *);
166 static void	zyd_set_channel(struct ieee80211com *);
167 static int	zyd_rfmd_init(struct zyd_rf *);
168 static int	zyd_rfmd_switch_radio(struct zyd_rf *, int);
169 static int	zyd_rfmd_set_channel(struct zyd_rf *, uint8_t);
170 static int	zyd_al2230_init(struct zyd_rf *);
171 static int	zyd_al2230_switch_radio(struct zyd_rf *, int);
172 static int	zyd_al2230_set_channel(struct zyd_rf *, uint8_t);
173 static int	zyd_al2230_set_channel_b(struct zyd_rf *, uint8_t);
174 static int	zyd_al2230_init_b(struct zyd_rf *);
175 static int	zyd_al7230B_init(struct zyd_rf *);
176 static int	zyd_al7230B_switch_radio(struct zyd_rf *, int);
177 static int	zyd_al7230B_set_channel(struct zyd_rf *, uint8_t);
178 static int	zyd_al2210_init(struct zyd_rf *);
179 static int	zyd_al2210_switch_radio(struct zyd_rf *, int);
180 static int	zyd_al2210_set_channel(struct zyd_rf *, uint8_t);
181 static int	zyd_gct_init(struct zyd_rf *);
182 static int	zyd_gct_switch_radio(struct zyd_rf *, int);
183 static int	zyd_gct_set_channel(struct zyd_rf *, uint8_t);
184 static int	zyd_gct_mode(struct zyd_rf *);
185 static int	zyd_gct_set_channel_synth(struct zyd_rf *, int, int);
186 static int	zyd_gct_write(struct zyd_rf *, uint16_t);
187 static int	zyd_gct_txgain(struct zyd_rf *, uint8_t);
188 static int	zyd_maxim2_init(struct zyd_rf *);
189 static int	zyd_maxim2_switch_radio(struct zyd_rf *, int);
190 static int	zyd_maxim2_set_channel(struct zyd_rf *, uint8_t);
191 
192 static const struct zyd_phy_pair zyd_def_phy[] = ZYD_DEF_PHY;
193 static const struct zyd_phy_pair zyd_def_phyB[] = ZYD_DEF_PHYB;
194 
195 /* various supported device vendors/products */
196 #define ZYD_ZD1211	0
197 #define ZYD_ZD1211B	1
198 
199 #define	ZYD_ZD1211_DEV(v,p)	\
200 	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, ZYD_ZD1211) }
201 #define	ZYD_ZD1211B_DEV(v,p)	\
202 	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, ZYD_ZD1211B) }
203 static const STRUCT_USB_HOST_ID zyd_devs[] = {
204 	/* ZYD_ZD1211 */
205 	ZYD_ZD1211_DEV(3COM2, 3CRUSB10075),
206 	ZYD_ZD1211_DEV(ABOCOM, WL54),
207 	ZYD_ZD1211_DEV(ASUS, WL159G),
208 	ZYD_ZD1211_DEV(CYBERTAN, TG54USB),
209 	ZYD_ZD1211_DEV(DRAYTEK, VIGOR550),
210 	ZYD_ZD1211_DEV(PLANEX2, GWUS54GD),
211 	ZYD_ZD1211_DEV(PLANEX2, GWUS54GZL),
212 	ZYD_ZD1211_DEV(PLANEX3, GWUS54GZ),
213 	ZYD_ZD1211_DEV(PLANEX3, GWUS54MINI),
214 	ZYD_ZD1211_DEV(SAGEM, XG760A),
215 	ZYD_ZD1211_DEV(SENAO, NUB8301),
216 	ZYD_ZD1211_DEV(SITECOMEU, WL113),
217 	ZYD_ZD1211_DEV(SWEEX, ZD1211),
218 	ZYD_ZD1211_DEV(TEKRAM, QUICKWLAN),
219 	ZYD_ZD1211_DEV(TEKRAM, ZD1211_1),
220 	ZYD_ZD1211_DEV(TEKRAM, ZD1211_2),
221 	ZYD_ZD1211_DEV(TWINMOS, G240),
222 	ZYD_ZD1211_DEV(UMEDIA, ALL0298V2),
223 	ZYD_ZD1211_DEV(UMEDIA, TEW429UB_A),
224 	ZYD_ZD1211_DEV(UMEDIA, TEW429UB),
225 	ZYD_ZD1211_DEV(WISTRONNEWEB, UR055G),
226 	ZYD_ZD1211_DEV(ZCOM, ZD1211),
227 	ZYD_ZD1211_DEV(ZYDAS, ZD1211),
228 	ZYD_ZD1211_DEV(ZYXEL, AG225H),
229 	ZYD_ZD1211_DEV(ZYXEL, ZYAIRG220),
230 	ZYD_ZD1211_DEV(ZYXEL, G200V2),
231 	/* ZYD_ZD1211B */
232 	ZYD_ZD1211B_DEV(ACCTON, SMCWUSBG),
233 	ZYD_ZD1211B_DEV(ACCTON, ZD1211B),
234 	ZYD_ZD1211B_DEV(ASUS, A9T_WIFI),
235 	ZYD_ZD1211B_DEV(BELKIN, F5D7050_V4000),
236 	ZYD_ZD1211B_DEV(BELKIN, ZD1211B),
237 	ZYD_ZD1211B_DEV(CISCOLINKSYS, WUSBF54G),
238 	ZYD_ZD1211B_DEV(FIBERLINE, WL430U),
239 	ZYD_ZD1211B_DEV(MELCO, KG54L),
240 	ZYD_ZD1211B_DEV(PHILIPS, SNU5600),
241 	ZYD_ZD1211B_DEV(PLANEX2, GW_US54GXS),
242 	ZYD_ZD1211B_DEV(SAGEM, XG76NA),
243 	ZYD_ZD1211B_DEV(SITECOMEU, ZD1211B),
244 	ZYD_ZD1211B_DEV(UMEDIA, TEW429UBC1),
245 	ZYD_ZD1211B_DEV(USR, USR5423),
246 	ZYD_ZD1211B_DEV(VTECH, ZD1211B),
247 	ZYD_ZD1211B_DEV(ZCOM, ZD1211B),
248 	ZYD_ZD1211B_DEV(ZYDAS, ZD1211B),
249 	ZYD_ZD1211B_DEV(ZYXEL, M202),
250 	ZYD_ZD1211B_DEV(ZYXEL, G202),
251 	ZYD_ZD1211B_DEV(ZYXEL, G220V2)
252 };
253 
254 static const struct usb_config zyd_config[ZYD_N_TRANSFER] = {
255 	[ZYD_BULK_WR] = {
256 		.type = UE_BULK,
257 		.endpoint = UE_ADDR_ANY,
258 		.direction = UE_DIR_OUT,
259 		.bufsize = ZYD_MAX_TXBUFSZ,
260 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
261 		.callback = zyd_bulk_write_callback,
262 		.ep_index = 0,
263 		.timeout = 10000,	/* 10 seconds */
264 	},
265 	[ZYD_BULK_RD] = {
266 		.type = UE_BULK,
267 		.endpoint = UE_ADDR_ANY,
268 		.direction = UE_DIR_IN,
269 		.bufsize = ZYX_MAX_RXBUFSZ,
270 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
271 		.callback = zyd_bulk_read_callback,
272 		.ep_index = 0,
273 	},
274 	[ZYD_INTR_WR] = {
275 		.type = UE_BULK_INTR,
276 		.endpoint = UE_ADDR_ANY,
277 		.direction = UE_DIR_OUT,
278 		.bufsize = sizeof(struct zyd_cmd),
279 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
280 		.callback = zyd_intr_write_callback,
281 		.timeout = 1000,	/* 1 second */
282 		.ep_index = 1,
283 	},
284 	[ZYD_INTR_RD] = {
285 		.type = UE_INTERRUPT,
286 		.endpoint = UE_ADDR_ANY,
287 		.direction = UE_DIR_IN,
288 		.bufsize = sizeof(struct zyd_cmd),
289 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
290 		.callback = zyd_intr_read_callback,
291 	},
292 };
293 #define zyd_read16_m(sc, val, data)	do {				\
294 	error = zyd_read16(sc, val, data);				\
295 	if (error != 0)							\
296 		goto fail;						\
297 } while (0)
298 #define zyd_write16_m(sc, val, data)	do {				\
299 	error = zyd_write16(sc, val, data);				\
300 	if (error != 0)							\
301 		goto fail;						\
302 } while (0)
303 #define zyd_read32_m(sc, val, data)	do {				\
304 	error = zyd_read32(sc, val, data);				\
305 	if (error != 0)							\
306 		goto fail;						\
307 } while (0)
308 #define zyd_write32_m(sc, val, data)	do {				\
309 	error = zyd_write32(sc, val, data);				\
310 	if (error != 0)							\
311 		goto fail;						\
312 } while (0)
313 
314 static int
315 zyd_match(device_t dev)
316 {
317 	struct usb_attach_arg *uaa = device_get_ivars(dev);
318 
319 	if (uaa->usb_mode != USB_MODE_HOST)
320 		return (ENXIO);
321 	if (uaa->info.bConfigIndex != ZYD_CONFIG_INDEX)
322 		return (ENXIO);
323 	if (uaa->info.bIfaceIndex != ZYD_IFACE_INDEX)
324 		return (ENXIO);
325 
326 	return (usbd_lookup_id_by_uaa(zyd_devs, sizeof(zyd_devs), uaa));
327 }
328 
329 static int
330 zyd_attach(device_t dev)
331 {
332 	struct usb_attach_arg *uaa = device_get_ivars(dev);
333 	struct zyd_softc *sc = device_get_softc(dev);
334 	struct ifnet *ifp;
335 	struct ieee80211com *ic;
336 	uint8_t iface_index, bands;
337 	int error;
338 
339 	if (uaa->info.bcdDevice < 0x4330) {
340 		device_printf(dev, "device version mismatch: 0x%X "
341 		    "(only >= 43.30 supported)\n",
342 		    uaa->info.bcdDevice);
343 		return (EINVAL);
344 	}
345 
346 	device_set_usb_desc(dev);
347 	sc->sc_dev = dev;
348 	sc->sc_udev = uaa->device;
349 	sc->sc_macrev = USB_GET_DRIVER_INFO(uaa);
350 
351 	mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
352 	    MTX_NETWORK_LOCK, MTX_DEF);
353 	STAILQ_INIT(&sc->sc_rqh);
354 
355 	iface_index = ZYD_IFACE_INDEX;
356 	error = usbd_transfer_setup(uaa->device,
357 	    &iface_index, sc->sc_xfer, zyd_config,
358 	    ZYD_N_TRANSFER, sc, &sc->sc_mtx);
359 	if (error) {
360 		device_printf(dev, "could not allocate USB transfers, "
361 		    "err=%s\n", usbd_errstr(error));
362 		goto detach;
363 	}
364 
365 	ZYD_LOCK(sc);
366 	if ((error = zyd_get_macaddr(sc)) != 0) {
367 		device_printf(sc->sc_dev, "could not read EEPROM\n");
368 		ZYD_UNLOCK(sc);
369 		goto detach;
370 	}
371 	ZYD_UNLOCK(sc);
372 
373 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
374 	if (ifp == NULL) {
375 		device_printf(sc->sc_dev, "can not if_alloc()\n");
376 		goto detach;
377 	}
378 	ifp->if_softc = sc;
379 	if_initname(ifp, "zyd", device_get_unit(sc->sc_dev));
380 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
381 	ifp->if_init = zyd_init;
382 	ifp->if_ioctl = zyd_ioctl;
383 	ifp->if_start = zyd_start;
384 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
385 	IFQ_SET_READY(&ifp->if_snd);
386 
387 	ic = ifp->if_l2com;
388 	ic->ic_ifp = ifp;
389 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
390 	ic->ic_opmode = IEEE80211_M_STA;
391 
392 	/* set device capabilities */
393 	ic->ic_caps =
394 		  IEEE80211_C_STA		/* station mode */
395 		| IEEE80211_C_MONITOR		/* monitor mode */
396 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
397 	        | IEEE80211_C_SHSLOT		/* short slot time supported */
398 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
399 	        | IEEE80211_C_WPA		/* 802.11i */
400 		;
401 
402 	bands = 0;
403 	setbit(&bands, IEEE80211_MODE_11B);
404 	setbit(&bands, IEEE80211_MODE_11G);
405 	ieee80211_init_channels(ic, NULL, &bands);
406 
407 	ieee80211_ifattach(ic, sc->sc_bssid);
408 	ic->ic_raw_xmit = zyd_raw_xmit;
409 	ic->ic_scan_start = zyd_scan_start;
410 	ic->ic_scan_end = zyd_scan_end;
411 	ic->ic_set_channel = zyd_set_channel;
412 
413 	ic->ic_vap_create = zyd_vap_create;
414 	ic->ic_vap_delete = zyd_vap_delete;
415 	ic->ic_update_mcast = zyd_update_mcast;
416 	ic->ic_update_promisc = zyd_update_mcast;
417 
418 	ieee80211_radiotap_attach(ic,
419 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
420 		ZYD_TX_RADIOTAP_PRESENT,
421 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
422 		ZYD_RX_RADIOTAP_PRESENT);
423 
424 	if (bootverbose)
425 		ieee80211_announce(ic);
426 
427 	return (0);
428 
429 detach:
430 	zyd_detach(dev);
431 	return (ENXIO);			/* failure */
432 }
433 
434 static int
435 zyd_detach(device_t dev)
436 {
437 	struct zyd_softc *sc = device_get_softc(dev);
438 	struct ifnet *ifp = sc->sc_ifp;
439 	struct ieee80211com *ic;
440 
441 	/* stop all USB transfers */
442 	usbd_transfer_unsetup(sc->sc_xfer, ZYD_N_TRANSFER);
443 
444 	/* free TX list, if any */
445 	zyd_unsetup_tx_list(sc);
446 
447 	if (ifp) {
448 		ic = ifp->if_l2com;
449 		ieee80211_ifdetach(ic);
450 		if_free(ifp);
451 	}
452 	mtx_destroy(&sc->sc_mtx);
453 
454 	return (0);
455 }
456 
457 static struct ieee80211vap *
458 zyd_vap_create(struct ieee80211com *ic,
459 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
460 	const uint8_t bssid[IEEE80211_ADDR_LEN],
461 	const uint8_t mac[IEEE80211_ADDR_LEN])
462 {
463 	struct zyd_vap *zvp;
464 	struct ieee80211vap *vap;
465 
466 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
467 		return (NULL);
468 	zvp = (struct zyd_vap *) malloc(sizeof(struct zyd_vap),
469 	    M_80211_VAP, M_NOWAIT | M_ZERO);
470 	if (zvp == NULL)
471 		return (NULL);
472 	vap = &zvp->vap;
473 	/* enable s/w bmiss handling for sta mode */
474 	ieee80211_vap_setup(ic, vap, name, unit, opmode,
475 	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
476 
477 	/* override state transition machine */
478 	zvp->newstate = vap->iv_newstate;
479 	vap->iv_newstate = zyd_newstate;
480 
481 	ieee80211_ratectl_init(vap);
482 	ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
483 
484 	/* complete setup */
485 	ieee80211_vap_attach(vap, ieee80211_media_change,
486 	    ieee80211_media_status);
487 	ic->ic_opmode = opmode;
488 	return (vap);
489 }
490 
491 static void
492 zyd_vap_delete(struct ieee80211vap *vap)
493 {
494 	struct zyd_vap *zvp = ZYD_VAP(vap);
495 
496 	ieee80211_ratectl_deinit(vap);
497 	ieee80211_vap_detach(vap);
498 	free(zvp, M_80211_VAP);
499 }
500 
501 static void
502 zyd_tx_free(struct zyd_tx_data *data, int txerr)
503 {
504 	struct zyd_softc *sc = data->sc;
505 
506 	if (data->m != NULL) {
507 		if (data->m->m_flags & M_TXCB)
508 			ieee80211_process_callback(data->ni, data->m,
509 			    txerr ? ETIMEDOUT : 0);
510 		m_freem(data->m);
511 		data->m = NULL;
512 
513 		ieee80211_free_node(data->ni);
514 		data->ni = NULL;
515 	}
516 	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
517 	sc->tx_nfree++;
518 }
519 
520 static void
521 zyd_setup_tx_list(struct zyd_softc *sc)
522 {
523 	struct zyd_tx_data *data;
524 	int i;
525 
526 	sc->tx_nfree = 0;
527 	STAILQ_INIT(&sc->tx_q);
528 	STAILQ_INIT(&sc->tx_free);
529 
530 	for (i = 0; i < ZYD_TX_LIST_CNT; i++) {
531 		data = &sc->tx_data[i];
532 
533 		data->sc = sc;
534 		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
535 		sc->tx_nfree++;
536 	}
537 }
538 
539 static void
540 zyd_unsetup_tx_list(struct zyd_softc *sc)
541 {
542 	struct zyd_tx_data *data;
543 	int i;
544 
545 	/* make sure any subsequent use of the queues will fail */
546 	sc->tx_nfree = 0;
547 	STAILQ_INIT(&sc->tx_q);
548 	STAILQ_INIT(&sc->tx_free);
549 
550 	/* free up all node references and mbufs */
551 	for (i = 0; i < ZYD_TX_LIST_CNT; i++) {
552 		data = &sc->tx_data[i];
553 
554 		if (data->m != NULL) {
555 			m_freem(data->m);
556 			data->m = NULL;
557 		}
558 		if (data->ni != NULL) {
559 			ieee80211_free_node(data->ni);
560 			data->ni = NULL;
561 		}
562 	}
563 }
564 
565 static int
566 zyd_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
567 {
568 	struct zyd_vap *zvp = ZYD_VAP(vap);
569 	struct ieee80211com *ic = vap->iv_ic;
570 	struct zyd_softc *sc = ic->ic_ifp->if_softc;
571 	int error;
572 
573 	DPRINTF(sc, ZYD_DEBUG_STATE, "%s: %s -> %s\n", __func__,
574 	    ieee80211_state_name[vap->iv_state],
575 	    ieee80211_state_name[nstate]);
576 
577 	IEEE80211_UNLOCK(ic);
578 	ZYD_LOCK(sc);
579 	switch (nstate) {
580 	case IEEE80211_S_AUTH:
581 		zyd_set_chan(sc, ic->ic_curchan);
582 		break;
583 	case IEEE80211_S_RUN:
584 		if (vap->iv_opmode == IEEE80211_M_MONITOR)
585 			break;
586 
587 		/* turn link LED on */
588 		error = zyd_set_led(sc, ZYD_LED1, 1);
589 		if (error != 0)
590 			break;
591 
592 		/* make data LED blink upon Tx */
593 		zyd_write32_m(sc, sc->sc_fwbase + ZYD_FW_LINK_STATUS, 1);
594 
595 		IEEE80211_ADDR_COPY(sc->sc_bssid, vap->iv_bss->ni_bssid);
596 		zyd_set_bssid(sc, sc->sc_bssid);
597 		break;
598 	default:
599 		break;
600 	}
601 fail:
602 	ZYD_UNLOCK(sc);
603 	IEEE80211_LOCK(ic);
604 	return (zvp->newstate(vap, nstate, arg));
605 }
606 
607 /*
608  * Callback handler for interrupt transfer
609  */
610 static void
611 zyd_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
612 {
613 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
614 	struct ifnet *ifp = sc->sc_ifp;
615 	struct ieee80211com *ic = ifp->if_l2com;
616 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
617 	struct ieee80211_node *ni;
618 	struct zyd_cmd *cmd = &sc->sc_ibuf;
619 	struct usb_page_cache *pc;
620 	int datalen;
621 	int actlen;
622 
623 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
624 
625 	switch (USB_GET_STATE(xfer)) {
626 	case USB_ST_TRANSFERRED:
627 		pc = usbd_xfer_get_frame(xfer, 0);
628 		usbd_copy_out(pc, 0, cmd, sizeof(*cmd));
629 
630 		switch (le16toh(cmd->code)) {
631 		case ZYD_NOTIF_RETRYSTATUS:
632 		{
633 			struct zyd_notif_retry *retry =
634 			    (struct zyd_notif_retry *)cmd->data;
635 
636 			DPRINTF(sc, ZYD_DEBUG_TX_PROC,
637 			    "retry intr: rate=0x%x addr=%s count=%d (0x%x)\n",
638 			    le16toh(retry->rate), ether_sprintf(retry->macaddr),
639 			    le16toh(retry->count)&0xff, le16toh(retry->count));
640 
641 			/*
642 			 * Find the node to which the packet was sent and
643 			 * update its retry statistics.  In BSS mode, this node
644 			 * is the AP we're associated to so no lookup is
645 			 * actually needed.
646 			 */
647 			ni = ieee80211_find_txnode(vap, retry->macaddr);
648 			if (ni != NULL) {
649 				int retrycnt =
650 				    (int)(le16toh(retry->count) & 0xff);
651 
652 				ieee80211_ratectl_tx_complete(vap, ni,
653 				    IEEE80211_RATECTL_TX_FAILURE,
654 				    &retrycnt, NULL);
655 				ieee80211_free_node(ni);
656 			}
657 			if (le16toh(retry->count) & 0x100)
658 				ifp->if_oerrors++;	/* too many retries */
659 			break;
660 		}
661 		case ZYD_NOTIF_IORD:
662 		{
663 			struct zyd_rq *rqp;
664 
665 			if (le16toh(*(uint16_t *)cmd->data) == ZYD_CR_INTERRUPT)
666 				break;	/* HMAC interrupt */
667 
668 			datalen = actlen - sizeof(cmd->code);
669 			datalen -= 2;	/* XXX: padding? */
670 
671 			STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
672 				int i, cnt;
673 
674 				if (rqp->olen != datalen)
675 					continue;
676 				cnt = rqp->olen / sizeof(struct zyd_pair);
677 				for (i = 0; i < cnt; i++) {
678 					if (*(((const uint16_t *)rqp->idata) + i) !=
679 					    (((struct zyd_pair *)cmd->data) + i)->reg)
680 						break;
681 				}
682 				if (i != cnt)
683 					continue;
684 				/* copy answer into caller-supplied buffer */
685 				bcopy(cmd->data, rqp->odata, rqp->olen);
686 				DPRINTF(sc, ZYD_DEBUG_CMD,
687 				    "command %p complete, data = %*D \n",
688 				    rqp, rqp->olen, rqp->odata, ":");
689 				wakeup(rqp);	/* wakeup caller */
690 				break;
691 			}
692 			if (rqp == NULL) {
693 				device_printf(sc->sc_dev,
694 				    "unexpected IORD notification %*D\n",
695 				    datalen, cmd->data, ":");
696 			}
697 			break;
698 		}
699 		default:
700 			device_printf(sc->sc_dev, "unknown notification %x\n",
701 			    le16toh(cmd->code));
702 		}
703 
704 		/* FALLTHROUGH */
705 	case USB_ST_SETUP:
706 tr_setup:
707 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
708 		usbd_transfer_submit(xfer);
709 		break;
710 
711 	default:			/* Error */
712 		DPRINTF(sc, ZYD_DEBUG_CMD, "error = %s\n",
713 		    usbd_errstr(error));
714 
715 		if (error != USB_ERR_CANCELLED) {
716 			/* try to clear stall first */
717 			usbd_xfer_set_stall(xfer);
718 			goto tr_setup;
719 		}
720 		break;
721 	}
722 }
723 
724 static void
725 zyd_intr_write_callback(struct usb_xfer *xfer, usb_error_t error)
726 {
727 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
728 	struct zyd_rq *rqp, *cmd;
729 	struct usb_page_cache *pc;
730 
731 	switch (USB_GET_STATE(xfer)) {
732 	case USB_ST_TRANSFERRED:
733 		cmd = usbd_xfer_get_priv(xfer);
734 		DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n", cmd);
735 		STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
736 			/* Ensure the cached rq pointer is still valid */
737 			if (rqp == cmd &&
738 			    (rqp->flags & ZYD_CMD_FLAG_READ) == 0)
739 				wakeup(rqp);	/* wakeup caller */
740 		}
741 
742 		/* FALLTHROUGH */
743 	case USB_ST_SETUP:
744 tr_setup:
745 		STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
746 			if (rqp->flags & ZYD_CMD_FLAG_SENT)
747 				continue;
748 
749 			pc = usbd_xfer_get_frame(xfer, 0);
750 			usbd_copy_in(pc, 0, rqp->cmd, rqp->ilen);
751 
752 			usbd_xfer_set_frame_len(xfer, 0, rqp->ilen);
753 			usbd_xfer_set_priv(xfer, rqp);
754 			rqp->flags |= ZYD_CMD_FLAG_SENT;
755 			usbd_transfer_submit(xfer);
756 			break;
757 		}
758 		break;
759 
760 	default:			/* Error */
761 		DPRINTF(sc, ZYD_DEBUG_ANY, "error = %s\n",
762 		    usbd_errstr(error));
763 
764 		if (error != USB_ERR_CANCELLED) {
765 			/* try to clear stall first */
766 			usbd_xfer_set_stall(xfer);
767 			goto tr_setup;
768 		}
769 		break;
770 	}
771 }
772 
773 static int
774 zyd_cmd(struct zyd_softc *sc, uint16_t code, const void *idata, int ilen,
775     void *odata, int olen, int flags)
776 {
777 	struct zyd_cmd cmd;
778 	struct zyd_rq rq;
779 	int error;
780 
781 	if (ilen > sizeof(cmd.data))
782 		return (EINVAL);
783 
784 	cmd.code = htole16(code);
785 	bcopy(idata, cmd.data, ilen);
786 	DPRINTF(sc, ZYD_DEBUG_CMD, "sending cmd %p = %*D\n",
787 	    &rq, ilen, idata, ":");
788 
789 	rq.cmd = &cmd;
790 	rq.idata = idata;
791 	rq.odata = odata;
792 	rq.ilen = sizeof(uint16_t) + ilen;
793 	rq.olen = olen;
794 	rq.flags = flags;
795 	STAILQ_INSERT_TAIL(&sc->sc_rqh, &rq, rq);
796 	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_RD]);
797 	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_WR]);
798 
799 	/* wait at most one second for command reply */
800 	error = mtx_sleep(&rq, &sc->sc_mtx, 0 , "zydcmd", hz);
801 	if (error)
802 		device_printf(sc->sc_dev, "command timeout\n");
803 	STAILQ_REMOVE(&sc->sc_rqh, &rq, zyd_rq, rq);
804 	DPRINTF(sc, ZYD_DEBUG_CMD, "finsihed cmd %p, error = %d \n",
805 	    &rq, error);
806 
807 	return (error);
808 }
809 
810 static int
811 zyd_read16(struct zyd_softc *sc, uint16_t reg, uint16_t *val)
812 {
813 	struct zyd_pair tmp;
814 	int error;
815 
816 	reg = htole16(reg);
817 	error = zyd_cmd(sc, ZYD_CMD_IORD, &reg, sizeof(reg), &tmp, sizeof(tmp),
818 	    ZYD_CMD_FLAG_READ);
819 	if (error == 0)
820 		*val = le16toh(tmp.val);
821 	return (error);
822 }
823 
824 static int
825 zyd_read32(struct zyd_softc *sc, uint16_t reg, uint32_t *val)
826 {
827 	struct zyd_pair tmp[2];
828 	uint16_t regs[2];
829 	int error;
830 
831 	regs[0] = htole16(ZYD_REG32_HI(reg));
832 	regs[1] = htole16(ZYD_REG32_LO(reg));
833 	error = zyd_cmd(sc, ZYD_CMD_IORD, regs, sizeof(regs), tmp, sizeof(tmp),
834 	    ZYD_CMD_FLAG_READ);
835 	if (error == 0)
836 		*val = le16toh(tmp[0].val) << 16 | le16toh(tmp[1].val);
837 	return (error);
838 }
839 
840 static int
841 zyd_write16(struct zyd_softc *sc, uint16_t reg, uint16_t val)
842 {
843 	struct zyd_pair pair;
844 
845 	pair.reg = htole16(reg);
846 	pair.val = htole16(val);
847 
848 	return zyd_cmd(sc, ZYD_CMD_IOWR, &pair, sizeof(pair), NULL, 0, 0);
849 }
850 
851 static int
852 zyd_write32(struct zyd_softc *sc, uint16_t reg, uint32_t val)
853 {
854 	struct zyd_pair pair[2];
855 
856 	pair[0].reg = htole16(ZYD_REG32_HI(reg));
857 	pair[0].val = htole16(val >> 16);
858 	pair[1].reg = htole16(ZYD_REG32_LO(reg));
859 	pair[1].val = htole16(val & 0xffff);
860 
861 	return zyd_cmd(sc, ZYD_CMD_IOWR, pair, sizeof(pair), NULL, 0, 0);
862 }
863 
864 static int
865 zyd_rfwrite(struct zyd_softc *sc, uint32_t val)
866 {
867 	struct zyd_rf *rf = &sc->sc_rf;
868 	struct zyd_rfwrite_cmd req;
869 	uint16_t cr203;
870 	int error, i;
871 
872 	zyd_read16_m(sc, ZYD_CR203, &cr203);
873 	cr203 &= ~(ZYD_RF_IF_LE | ZYD_RF_CLK | ZYD_RF_DATA);
874 
875 	req.code  = htole16(2);
876 	req.width = htole16(rf->width);
877 	for (i = 0; i < rf->width; i++) {
878 		req.bit[i] = htole16(cr203);
879 		if (val & (1 << (rf->width - 1 - i)))
880 			req.bit[i] |= htole16(ZYD_RF_DATA);
881 	}
882 	error = zyd_cmd(sc, ZYD_CMD_RFCFG, &req, 4 + 2 * rf->width, NULL, 0, 0);
883 fail:
884 	return (error);
885 }
886 
887 static int
888 zyd_rfwrite_cr(struct zyd_softc *sc, uint32_t val)
889 {
890 	int error;
891 
892 	zyd_write16_m(sc, ZYD_CR244, (val >> 16) & 0xff);
893 	zyd_write16_m(sc, ZYD_CR243, (val >>  8) & 0xff);
894 	zyd_write16_m(sc, ZYD_CR242, (val >>  0) & 0xff);
895 fail:
896 	return (error);
897 }
898 
899 static int
900 zyd_lock_phy(struct zyd_softc *sc)
901 {
902 	int error;
903 	uint32_t tmp;
904 
905 	zyd_read32_m(sc, ZYD_MAC_MISC, &tmp);
906 	tmp &= ~ZYD_UNLOCK_PHY_REGS;
907 	zyd_write32_m(sc, ZYD_MAC_MISC, tmp);
908 fail:
909 	return (error);
910 }
911 
912 static int
913 zyd_unlock_phy(struct zyd_softc *sc)
914 {
915 	int error;
916 	uint32_t tmp;
917 
918 	zyd_read32_m(sc, ZYD_MAC_MISC, &tmp);
919 	tmp |= ZYD_UNLOCK_PHY_REGS;
920 	zyd_write32_m(sc, ZYD_MAC_MISC, tmp);
921 fail:
922 	return (error);
923 }
924 
925 /*
926  * RFMD RF methods.
927  */
928 static int
929 zyd_rfmd_init(struct zyd_rf *rf)
930 {
931 #define N(a)	(sizeof(a) / sizeof((a)[0]))
932 	struct zyd_softc *sc = rf->rf_sc;
933 	static const struct zyd_phy_pair phyini[] = ZYD_RFMD_PHY;
934 	static const uint32_t rfini[] = ZYD_RFMD_RF;
935 	int i, error;
936 
937 	/* init RF-dependent PHY registers */
938 	for (i = 0; i < N(phyini); i++) {
939 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
940 	}
941 
942 	/* init RFMD radio */
943 	for (i = 0; i < N(rfini); i++) {
944 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
945 			return (error);
946 	}
947 fail:
948 	return (error);
949 #undef N
950 }
951 
952 static int
953 zyd_rfmd_switch_radio(struct zyd_rf *rf, int on)
954 {
955 	int error;
956 	struct zyd_softc *sc = rf->rf_sc;
957 
958 	zyd_write16_m(sc, ZYD_CR10, on ? 0x89 : 0x15);
959 	zyd_write16_m(sc, ZYD_CR11, on ? 0x00 : 0x81);
960 fail:
961 	return (error);
962 }
963 
964 static int
965 zyd_rfmd_set_channel(struct zyd_rf *rf, uint8_t chan)
966 {
967 	int error;
968 	struct zyd_softc *sc = rf->rf_sc;
969 	static const struct {
970 		uint32_t	r1, r2;
971 	} rfprog[] = ZYD_RFMD_CHANTABLE;
972 
973 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
974 	if (error != 0)
975 		goto fail;
976 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
977 	if (error != 0)
978 		goto fail;
979 
980 fail:
981 	return (error);
982 }
983 
984 /*
985  * AL2230 RF methods.
986  */
987 static int
988 zyd_al2230_init(struct zyd_rf *rf)
989 {
990 #define N(a)	(sizeof(a) / sizeof((a)[0]))
991 	struct zyd_softc *sc = rf->rf_sc;
992 	static const struct zyd_phy_pair phyini[] = ZYD_AL2230_PHY;
993 	static const struct zyd_phy_pair phy2230s[] = ZYD_AL2230S_PHY_INIT;
994 	static const struct zyd_phy_pair phypll[] = {
995 		{ ZYD_CR251, 0x2f }, { ZYD_CR251, 0x3f },
996 		{ ZYD_CR138, 0x28 }, { ZYD_CR203, 0x06 }
997 	};
998 	static const uint32_t rfini1[] = ZYD_AL2230_RF_PART1;
999 	static const uint32_t rfini2[] = ZYD_AL2230_RF_PART2;
1000 	static const uint32_t rfini3[] = ZYD_AL2230_RF_PART3;
1001 	int i, error;
1002 
1003 	/* init RF-dependent PHY registers */
1004 	for (i = 0; i < N(phyini); i++)
1005 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1006 
1007 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0) {
1008 		for (i = 0; i < N(phy2230s); i++)
1009 			zyd_write16_m(sc, phy2230s[i].reg, phy2230s[i].val);
1010 	}
1011 
1012 	/* init AL2230 radio */
1013 	for (i = 0; i < N(rfini1); i++) {
1014 		error = zyd_rfwrite(sc, rfini1[i]);
1015 		if (error != 0)
1016 			goto fail;
1017 	}
1018 
1019 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0)
1020 		error = zyd_rfwrite(sc, 0x000824);
1021 	else
1022 		error = zyd_rfwrite(sc, 0x0005a4);
1023 	if (error != 0)
1024 		goto fail;
1025 
1026 	for (i = 0; i < N(rfini2); i++) {
1027 		error = zyd_rfwrite(sc, rfini2[i]);
1028 		if (error != 0)
1029 			goto fail;
1030 	}
1031 
1032 	for (i = 0; i < N(phypll); i++)
1033 		zyd_write16_m(sc, phypll[i].reg, phypll[i].val);
1034 
1035 	for (i = 0; i < N(rfini3); i++) {
1036 		error = zyd_rfwrite(sc, rfini3[i]);
1037 		if (error != 0)
1038 			goto fail;
1039 	}
1040 fail:
1041 	return (error);
1042 #undef N
1043 }
1044 
1045 static int
1046 zyd_al2230_fini(struct zyd_rf *rf)
1047 {
1048 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1049 	int error, i;
1050 	struct zyd_softc *sc = rf->rf_sc;
1051 	static const struct zyd_phy_pair phy[] = ZYD_AL2230_PHY_FINI_PART1;
1052 
1053 	for (i = 0; i < N(phy); i++)
1054 		zyd_write16_m(sc, phy[i].reg, phy[i].val);
1055 
1056 	if (sc->sc_newphy != 0)
1057 		zyd_write16_m(sc, ZYD_CR9, 0xe1);
1058 
1059 	zyd_write16_m(sc, ZYD_CR203, 0x6);
1060 fail:
1061 	return (error);
1062 #undef N
1063 }
1064 
1065 static int
1066 zyd_al2230_init_b(struct zyd_rf *rf)
1067 {
1068 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1069 	struct zyd_softc *sc = rf->rf_sc;
1070 	static const struct zyd_phy_pair phy1[] = ZYD_AL2230_PHY_PART1;
1071 	static const struct zyd_phy_pair phy2[] = ZYD_AL2230_PHY_PART2;
1072 	static const struct zyd_phy_pair phy3[] = ZYD_AL2230_PHY_PART3;
1073 	static const struct zyd_phy_pair phy2230s[] = ZYD_AL2230S_PHY_INIT;
1074 	static const struct zyd_phy_pair phyini[] = ZYD_AL2230_PHY_B;
1075 	static const uint32_t rfini_part1[] = ZYD_AL2230_RF_B_PART1;
1076 	static const uint32_t rfini_part2[] = ZYD_AL2230_RF_B_PART2;
1077 	static const uint32_t rfini_part3[] = ZYD_AL2230_RF_B_PART3;
1078 	static const uint32_t zyd_al2230_chtable[][3] = ZYD_AL2230_CHANTABLE;
1079 	int i, error;
1080 
1081 	for (i = 0; i < N(phy1); i++)
1082 		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1083 
1084 	/* init RF-dependent PHY registers */
1085 	for (i = 0; i < N(phyini); i++)
1086 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1087 
1088 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0) {
1089 		for (i = 0; i < N(phy2230s); i++)
1090 			zyd_write16_m(sc, phy2230s[i].reg, phy2230s[i].val);
1091 	}
1092 
1093 	for (i = 0; i < 3; i++) {
1094 		error = zyd_rfwrite_cr(sc, zyd_al2230_chtable[0][i]);
1095 		if (error != 0)
1096 			return (error);
1097 	}
1098 
1099 	for (i = 0; i < N(rfini_part1); i++) {
1100 		error = zyd_rfwrite_cr(sc, rfini_part1[i]);
1101 		if (error != 0)
1102 			return (error);
1103 	}
1104 
1105 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0)
1106 		error = zyd_rfwrite(sc, 0x241000);
1107 	else
1108 		error = zyd_rfwrite(sc, 0x25a000);
1109 	if (error != 0)
1110 		goto fail;
1111 
1112 	for (i = 0; i < N(rfini_part2); i++) {
1113 		error = zyd_rfwrite_cr(sc, rfini_part2[i]);
1114 		if (error != 0)
1115 			return (error);
1116 	}
1117 
1118 	for (i = 0; i < N(phy2); i++)
1119 		zyd_write16_m(sc, phy2[i].reg, phy2[i].val);
1120 
1121 	for (i = 0; i < N(rfini_part3); i++) {
1122 		error = zyd_rfwrite_cr(sc, rfini_part3[i]);
1123 		if (error != 0)
1124 			return (error);
1125 	}
1126 
1127 	for (i = 0; i < N(phy3); i++)
1128 		zyd_write16_m(sc, phy3[i].reg, phy3[i].val);
1129 
1130 	error = zyd_al2230_fini(rf);
1131 fail:
1132 	return (error);
1133 #undef N
1134 }
1135 
1136 static int
1137 zyd_al2230_switch_radio(struct zyd_rf *rf, int on)
1138 {
1139 	struct zyd_softc *sc = rf->rf_sc;
1140 	int error, on251 = (sc->sc_macrev == ZYD_ZD1211) ? 0x3f : 0x7f;
1141 
1142 	zyd_write16_m(sc, ZYD_CR11,  on ? 0x00 : 0x04);
1143 	zyd_write16_m(sc, ZYD_CR251, on ? on251 : 0x2f);
1144 fail:
1145 	return (error);
1146 }
1147 
1148 static int
1149 zyd_al2230_set_channel(struct zyd_rf *rf, uint8_t chan)
1150 {
1151 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1152 	int error, i;
1153 	struct zyd_softc *sc = rf->rf_sc;
1154 	static const struct zyd_phy_pair phy1[] = {
1155 		{ ZYD_CR138, 0x28 }, { ZYD_CR203, 0x06 },
1156 	};
1157 	static const struct {
1158 		uint32_t	r1, r2, r3;
1159 	} rfprog[] = ZYD_AL2230_CHANTABLE;
1160 
1161 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1162 	if (error != 0)
1163 		goto fail;
1164 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1165 	if (error != 0)
1166 		goto fail;
1167 	error = zyd_rfwrite(sc, rfprog[chan - 1].r3);
1168 	if (error != 0)
1169 		goto fail;
1170 
1171 	for (i = 0; i < N(phy1); i++)
1172 		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1173 fail:
1174 	return (error);
1175 #undef N
1176 }
1177 
1178 static int
1179 zyd_al2230_set_channel_b(struct zyd_rf *rf, uint8_t chan)
1180 {
1181 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1182 	int error, i;
1183 	struct zyd_softc *sc = rf->rf_sc;
1184 	static const struct zyd_phy_pair phy1[] = ZYD_AL2230_PHY_PART1;
1185 	static const struct {
1186 		uint32_t	r1, r2, r3;
1187 	} rfprog[] = ZYD_AL2230_CHANTABLE_B;
1188 
1189 	for (i = 0; i < N(phy1); i++)
1190 		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1191 
1192 	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r1);
1193 	if (error != 0)
1194 		goto fail;
1195 	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r2);
1196 	if (error != 0)
1197 		goto fail;
1198 	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r3);
1199 	if (error != 0)
1200 		goto fail;
1201 	error = zyd_al2230_fini(rf);
1202 fail:
1203 	return (error);
1204 #undef N
1205 }
1206 
1207 #define	ZYD_AL2230_PHY_BANDEDGE6					\
1208 {									\
1209 	{ ZYD_CR128, 0x14 }, { ZYD_CR129, 0x12 }, { ZYD_CR130, 0x10 },	\
1210 	{ ZYD_CR47,  0x1e }						\
1211 }
1212 
1213 static int
1214 zyd_al2230_bandedge6(struct zyd_rf *rf, struct ieee80211_channel *c)
1215 {
1216 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1217 	int error = 0, i;
1218 	struct zyd_softc *sc = rf->rf_sc;
1219 	struct ifnet *ifp = sc->sc_ifp;
1220 	struct ieee80211com *ic = ifp->if_l2com;
1221 	struct zyd_phy_pair r[] = ZYD_AL2230_PHY_BANDEDGE6;
1222 	int chan = ieee80211_chan2ieee(ic, c);
1223 
1224 	if (chan == 1 || chan == 11)
1225 		r[0].val = 0x12;
1226 
1227 	for (i = 0; i < N(r); i++)
1228 		zyd_write16_m(sc, r[i].reg, r[i].val);
1229 fail:
1230 	return (error);
1231 #undef N
1232 }
1233 
1234 /*
1235  * AL7230B RF methods.
1236  */
1237 static int
1238 zyd_al7230B_init(struct zyd_rf *rf)
1239 {
1240 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1241 	struct zyd_softc *sc = rf->rf_sc;
1242 	static const struct zyd_phy_pair phyini_1[] = ZYD_AL7230B_PHY_1;
1243 	static const struct zyd_phy_pair phyini_2[] = ZYD_AL7230B_PHY_2;
1244 	static const struct zyd_phy_pair phyini_3[] = ZYD_AL7230B_PHY_3;
1245 	static const uint32_t rfini_1[] = ZYD_AL7230B_RF_1;
1246 	static const uint32_t rfini_2[] = ZYD_AL7230B_RF_2;
1247 	int i, error;
1248 
1249 	/* for AL7230B, PHY and RF need to be initialized in "phases" */
1250 
1251 	/* init RF-dependent PHY registers, part one */
1252 	for (i = 0; i < N(phyini_1); i++)
1253 		zyd_write16_m(sc, phyini_1[i].reg, phyini_1[i].val);
1254 
1255 	/* init AL7230B radio, part one */
1256 	for (i = 0; i < N(rfini_1); i++) {
1257 		if ((error = zyd_rfwrite(sc, rfini_1[i])) != 0)
1258 			return (error);
1259 	}
1260 	/* init RF-dependent PHY registers, part two */
1261 	for (i = 0; i < N(phyini_2); i++)
1262 		zyd_write16_m(sc, phyini_2[i].reg, phyini_2[i].val);
1263 
1264 	/* init AL7230B radio, part two */
1265 	for (i = 0; i < N(rfini_2); i++) {
1266 		if ((error = zyd_rfwrite(sc, rfini_2[i])) != 0)
1267 			return (error);
1268 	}
1269 	/* init RF-dependent PHY registers, part three */
1270 	for (i = 0; i < N(phyini_3); i++)
1271 		zyd_write16_m(sc, phyini_3[i].reg, phyini_3[i].val);
1272 fail:
1273 	return (error);
1274 #undef N
1275 }
1276 
1277 static int
1278 zyd_al7230B_switch_radio(struct zyd_rf *rf, int on)
1279 {
1280 	int error;
1281 	struct zyd_softc *sc = rf->rf_sc;
1282 
1283 	zyd_write16_m(sc, ZYD_CR11,  on ? 0x00 : 0x04);
1284 	zyd_write16_m(sc, ZYD_CR251, on ? 0x3f : 0x2f);
1285 fail:
1286 	return (error);
1287 }
1288 
1289 static int
1290 zyd_al7230B_set_channel(struct zyd_rf *rf, uint8_t chan)
1291 {
1292 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1293 	struct zyd_softc *sc = rf->rf_sc;
1294 	static const struct {
1295 		uint32_t	r1, r2;
1296 	} rfprog[] = ZYD_AL7230B_CHANTABLE;
1297 	static const uint32_t rfsc[] = ZYD_AL7230B_RF_SETCHANNEL;
1298 	int i, error;
1299 
1300 	zyd_write16_m(sc, ZYD_CR240, 0x57);
1301 	zyd_write16_m(sc, ZYD_CR251, 0x2f);
1302 
1303 	for (i = 0; i < N(rfsc); i++) {
1304 		if ((error = zyd_rfwrite(sc, rfsc[i])) != 0)
1305 			return (error);
1306 	}
1307 
1308 	zyd_write16_m(sc, ZYD_CR128, 0x14);
1309 	zyd_write16_m(sc, ZYD_CR129, 0x12);
1310 	zyd_write16_m(sc, ZYD_CR130, 0x10);
1311 	zyd_write16_m(sc, ZYD_CR38,  0x38);
1312 	zyd_write16_m(sc, ZYD_CR136, 0xdf);
1313 
1314 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1315 	if (error != 0)
1316 		goto fail;
1317 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1318 	if (error != 0)
1319 		goto fail;
1320 	error = zyd_rfwrite(sc, 0x3c9000);
1321 	if (error != 0)
1322 		goto fail;
1323 
1324 	zyd_write16_m(sc, ZYD_CR251, 0x3f);
1325 	zyd_write16_m(sc, ZYD_CR203, 0x06);
1326 	zyd_write16_m(sc, ZYD_CR240, 0x08);
1327 fail:
1328 	return (error);
1329 #undef N
1330 }
1331 
1332 /*
1333  * AL2210 RF methods.
1334  */
1335 static int
1336 zyd_al2210_init(struct zyd_rf *rf)
1337 {
1338 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1339 	struct zyd_softc *sc = rf->rf_sc;
1340 	static const struct zyd_phy_pair phyini[] = ZYD_AL2210_PHY;
1341 	static const uint32_t rfini[] = ZYD_AL2210_RF;
1342 	uint32_t tmp;
1343 	int i, error;
1344 
1345 	zyd_write32_m(sc, ZYD_CR18, 2);
1346 
1347 	/* init RF-dependent PHY registers */
1348 	for (i = 0; i < N(phyini); i++)
1349 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1350 
1351 	/* init AL2210 radio */
1352 	for (i = 0; i < N(rfini); i++) {
1353 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1354 			return (error);
1355 	}
1356 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1357 	zyd_read32_m(sc, ZYD_CR_RADIO_PD, &tmp);
1358 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp & ~1);
1359 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp | 1);
1360 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x05);
1361 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x00);
1362 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1363 	zyd_write32_m(sc, ZYD_CR18, 3);
1364 fail:
1365 	return (error);
1366 #undef N
1367 }
1368 
1369 static int
1370 zyd_al2210_switch_radio(struct zyd_rf *rf, int on)
1371 {
1372 	/* vendor driver does nothing for this RF chip */
1373 
1374 	return (0);
1375 }
1376 
1377 static int
1378 zyd_al2210_set_channel(struct zyd_rf *rf, uint8_t chan)
1379 {
1380 	int error;
1381 	struct zyd_softc *sc = rf->rf_sc;
1382 	static const uint32_t rfprog[] = ZYD_AL2210_CHANTABLE;
1383 	uint32_t tmp;
1384 
1385 	zyd_write32_m(sc, ZYD_CR18, 2);
1386 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1387 	zyd_read32_m(sc, ZYD_CR_RADIO_PD, &tmp);
1388 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp & ~1);
1389 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp | 1);
1390 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x05);
1391 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x00);
1392 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1393 
1394 	/* actually set the channel */
1395 	error = zyd_rfwrite(sc, rfprog[chan - 1]);
1396 	if (error != 0)
1397 		goto fail;
1398 
1399 	zyd_write32_m(sc, ZYD_CR18, 3);
1400 fail:
1401 	return (error);
1402 }
1403 
1404 /*
1405  * GCT RF methods.
1406  */
1407 static int
1408 zyd_gct_init(struct zyd_rf *rf)
1409 {
1410 #define	ZYD_GCT_INTR_REG	0x85c1
1411 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1412 	struct zyd_softc *sc = rf->rf_sc;
1413 	static const struct zyd_phy_pair phyini[] = ZYD_GCT_PHY;
1414 	static const uint32_t rfini[] = ZYD_GCT_RF;
1415 	static const uint16_t vco[11][7] = ZYD_GCT_VCO;
1416 	int i, idx = -1, error;
1417 	uint16_t data;
1418 
1419 	/* init RF-dependent PHY registers */
1420 	for (i = 0; i < N(phyini); i++)
1421 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1422 
1423 	/* init cgt radio */
1424 	for (i = 0; i < N(rfini); i++) {
1425 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1426 			return (error);
1427 	}
1428 
1429 	error = zyd_gct_mode(rf);
1430 	if (error != 0)
1431 		return (error);
1432 
1433 	for (i = 0; i < N(vco) - 1; i++) {
1434 		error = zyd_gct_set_channel_synth(rf, 1, 0);
1435 		if (error != 0)
1436 			goto fail;
1437 		error = zyd_gct_write(rf, vco[i][0]);
1438 		if (error != 0)
1439 			goto fail;
1440 		zyd_write16_m(sc, ZYD_GCT_INTR_REG, 0xf);
1441 		zyd_read16_m(sc, ZYD_GCT_INTR_REG, &data);
1442 		if ((data & 0xf) == 0) {
1443 			idx = i;
1444 			break;
1445 		}
1446 	}
1447 	if (idx == -1) {
1448 		error = zyd_gct_set_channel_synth(rf, 1, 1);
1449 		if (error != 0)
1450 			goto fail;
1451 		error = zyd_gct_write(rf, 0x6662);
1452 		if (error != 0)
1453 			goto fail;
1454 	}
1455 
1456 	rf->idx = idx;
1457 	zyd_write16_m(sc, ZYD_CR203, 0x6);
1458 fail:
1459 	return (error);
1460 #undef N
1461 #undef ZYD_GCT_INTR_REG
1462 }
1463 
1464 static int
1465 zyd_gct_mode(struct zyd_rf *rf)
1466 {
1467 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1468 	struct zyd_softc *sc = rf->rf_sc;
1469 	static const uint32_t mode[] = {
1470 		0x25f98, 0x25f9a, 0x25f94, 0x27fd4
1471 	};
1472 	int i, error;
1473 
1474 	for (i = 0; i < N(mode); i++) {
1475 		if ((error = zyd_rfwrite(sc, mode[i])) != 0)
1476 			break;
1477 	}
1478 	return (error);
1479 #undef N
1480 }
1481 
1482 static int
1483 zyd_gct_set_channel_synth(struct zyd_rf *rf, int chan, int acal)
1484 {
1485 	int error, idx = chan - 1;
1486 	struct zyd_softc *sc = rf->rf_sc;
1487 	static uint32_t acal_synth[] = ZYD_GCT_CHANNEL_ACAL;
1488 	static uint32_t std_synth[] = ZYD_GCT_CHANNEL_STD;
1489 	static uint32_t div_synth[] = ZYD_GCT_CHANNEL_DIV;
1490 
1491 	error = zyd_rfwrite(sc,
1492 	    (acal == 1) ? acal_synth[idx] : std_synth[idx]);
1493 	if (error != 0)
1494 		return (error);
1495 	return zyd_rfwrite(sc, div_synth[idx]);
1496 }
1497 
1498 static int
1499 zyd_gct_write(struct zyd_rf *rf, uint16_t value)
1500 {
1501 	struct zyd_softc *sc = rf->rf_sc;
1502 
1503 	return zyd_rfwrite(sc, 0x300000 | 0x40000 | value);
1504 }
1505 
1506 static int
1507 zyd_gct_switch_radio(struct zyd_rf *rf, int on)
1508 {
1509 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1510 	int error;
1511 	struct zyd_softc *sc = rf->rf_sc;
1512 
1513 	error = zyd_rfwrite(sc, on ? 0x25f94 : 0x25f90);
1514 	if (error != 0)
1515 		return (error);
1516 
1517 	zyd_write16_m(sc, ZYD_CR11, on ? 0x00 : 0x04);
1518 	zyd_write16_m(sc, ZYD_CR251,
1519 	    on ? ((sc->sc_macrev == ZYD_ZD1211B) ? 0x7f : 0x3f) : 0x2f);
1520 fail:
1521 	return (error);
1522 }
1523 
1524 static int
1525 zyd_gct_set_channel(struct zyd_rf *rf, uint8_t chan)
1526 {
1527 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1528 	int error, i;
1529 	struct zyd_softc *sc = rf->rf_sc;
1530 	static const struct zyd_phy_pair cmd[] = {
1531 		{ ZYD_CR80, 0x30 }, { ZYD_CR81, 0x30 }, { ZYD_CR79, 0x58 },
1532 		{ ZYD_CR12, 0xf0 }, { ZYD_CR77, 0x1b }, { ZYD_CR78, 0x58 },
1533 	};
1534 	static const uint16_t vco[11][7] = ZYD_GCT_VCO;
1535 
1536 	error = zyd_gct_set_channel_synth(rf, chan, 0);
1537 	if (error != 0)
1538 		goto fail;
1539 	error = zyd_gct_write(rf, (rf->idx == -1) ? 0x6662 :
1540 	    vco[rf->idx][((chan - 1) / 2)]);
1541 	if (error != 0)
1542 		goto fail;
1543 	error = zyd_gct_mode(rf);
1544 	if (error != 0)
1545 		return (error);
1546 	for (i = 0; i < N(cmd); i++)
1547 		zyd_write16_m(sc, cmd[i].reg, cmd[i].val);
1548 	error = zyd_gct_txgain(rf, chan);
1549 	if (error != 0)
1550 		return (error);
1551 	zyd_write16_m(sc, ZYD_CR203, 0x6);
1552 fail:
1553 	return (error);
1554 #undef N
1555 }
1556 
1557 static int
1558 zyd_gct_txgain(struct zyd_rf *rf, uint8_t chan)
1559 {
1560 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1561 	struct zyd_softc *sc = rf->rf_sc;
1562 	static uint32_t txgain[] = ZYD_GCT_TXGAIN;
1563 	uint8_t idx = sc->sc_pwrint[chan - 1];
1564 
1565 	if (idx >= N(txgain)) {
1566 		device_printf(sc->sc_dev, "could not set TX gain (%d %#x)\n",
1567 		    chan, idx);
1568 		return 0;
1569 	}
1570 
1571 	return zyd_rfwrite(sc, 0x700000 | txgain[idx]);
1572 #undef N
1573 }
1574 
1575 /*
1576  * Maxim2 RF methods.
1577  */
1578 static int
1579 zyd_maxim2_init(struct zyd_rf *rf)
1580 {
1581 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1582 	struct zyd_softc *sc = rf->rf_sc;
1583 	static const struct zyd_phy_pair phyini[] = ZYD_MAXIM2_PHY;
1584 	static const uint32_t rfini[] = ZYD_MAXIM2_RF;
1585 	uint16_t tmp;
1586 	int i, error;
1587 
1588 	/* init RF-dependent PHY registers */
1589 	for (i = 0; i < N(phyini); i++)
1590 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1591 
1592 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1593 	zyd_write16_m(sc, ZYD_CR203, tmp & ~(1 << 4));
1594 
1595 	/* init maxim2 radio */
1596 	for (i = 0; i < N(rfini); i++) {
1597 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1598 			return (error);
1599 	}
1600 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1601 	zyd_write16_m(sc, ZYD_CR203, tmp | (1 << 4));
1602 fail:
1603 	return (error);
1604 #undef N
1605 }
1606 
1607 static int
1608 zyd_maxim2_switch_radio(struct zyd_rf *rf, int on)
1609 {
1610 
1611 	/* vendor driver does nothing for this RF chip */
1612 	return (0);
1613 }
1614 
1615 static int
1616 zyd_maxim2_set_channel(struct zyd_rf *rf, uint8_t chan)
1617 {
1618 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1619 	struct zyd_softc *sc = rf->rf_sc;
1620 	static const struct zyd_phy_pair phyini[] = ZYD_MAXIM2_PHY;
1621 	static const uint32_t rfini[] = ZYD_MAXIM2_RF;
1622 	static const struct {
1623 		uint32_t	r1, r2;
1624 	} rfprog[] = ZYD_MAXIM2_CHANTABLE;
1625 	uint16_t tmp;
1626 	int i, error;
1627 
1628 	/*
1629 	 * Do the same as we do when initializing it, except for the channel
1630 	 * values coming from the two channel tables.
1631 	 */
1632 
1633 	/* init RF-dependent PHY registers */
1634 	for (i = 0; i < N(phyini); i++)
1635 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1636 
1637 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1638 	zyd_write16_m(sc, ZYD_CR203, tmp & ~(1 << 4));
1639 
1640 	/* first two values taken from the chantables */
1641 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1642 	if (error != 0)
1643 		goto fail;
1644 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1645 	if (error != 0)
1646 		goto fail;
1647 
1648 	/* init maxim2 radio - skipping the two first values */
1649 	for (i = 2; i < N(rfini); i++) {
1650 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1651 			return (error);
1652 	}
1653 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1654 	zyd_write16_m(sc, ZYD_CR203, tmp | (1 << 4));
1655 fail:
1656 	return (error);
1657 #undef N
1658 }
1659 
1660 static int
1661 zyd_rf_attach(struct zyd_softc *sc, uint8_t type)
1662 {
1663 	struct zyd_rf *rf = &sc->sc_rf;
1664 
1665 	rf->rf_sc = sc;
1666 	rf->update_pwr = 1;
1667 
1668 	switch (type) {
1669 	case ZYD_RF_RFMD:
1670 		rf->init         = zyd_rfmd_init;
1671 		rf->switch_radio = zyd_rfmd_switch_radio;
1672 		rf->set_channel  = zyd_rfmd_set_channel;
1673 		rf->width        = 24;	/* 24-bit RF values */
1674 		break;
1675 	case ZYD_RF_AL2230:
1676 	case ZYD_RF_AL2230S:
1677 		if (sc->sc_macrev == ZYD_ZD1211B) {
1678 			rf->init = zyd_al2230_init_b;
1679 			rf->set_channel = zyd_al2230_set_channel_b;
1680 		} else {
1681 			rf->init = zyd_al2230_init;
1682 			rf->set_channel = zyd_al2230_set_channel;
1683 		}
1684 		rf->switch_radio = zyd_al2230_switch_radio;
1685 		rf->bandedge6	 = zyd_al2230_bandedge6;
1686 		rf->width        = 24;	/* 24-bit RF values */
1687 		break;
1688 	case ZYD_RF_AL7230B:
1689 		rf->init         = zyd_al7230B_init;
1690 		rf->switch_radio = zyd_al7230B_switch_radio;
1691 		rf->set_channel  = zyd_al7230B_set_channel;
1692 		rf->width        = 24;	/* 24-bit RF values */
1693 		break;
1694 	case ZYD_RF_AL2210:
1695 		rf->init         = zyd_al2210_init;
1696 		rf->switch_radio = zyd_al2210_switch_radio;
1697 		rf->set_channel  = zyd_al2210_set_channel;
1698 		rf->width        = 24;	/* 24-bit RF values */
1699 		break;
1700 	case ZYD_RF_MAXIM_NEW:
1701 	case ZYD_RF_GCT:
1702 		rf->init         = zyd_gct_init;
1703 		rf->switch_radio = zyd_gct_switch_radio;
1704 		rf->set_channel  = zyd_gct_set_channel;
1705 		rf->width        = 24;	/* 24-bit RF values */
1706 		rf->update_pwr   = 0;
1707 		break;
1708 	case ZYD_RF_MAXIM_NEW2:
1709 		rf->init         = zyd_maxim2_init;
1710 		rf->switch_radio = zyd_maxim2_switch_radio;
1711 		rf->set_channel  = zyd_maxim2_set_channel;
1712 		rf->width        = 18;	/* 18-bit RF values */
1713 		break;
1714 	default:
1715 		device_printf(sc->sc_dev,
1716 		    "sorry, radio \"%s\" is not supported yet\n",
1717 		    zyd_rf_name(type));
1718 		return (EINVAL);
1719 	}
1720 	return (0);
1721 }
1722 
1723 static const char *
1724 zyd_rf_name(uint8_t type)
1725 {
1726 	static const char * const zyd_rfs[] = {
1727 		"unknown", "unknown", "UW2451",   "UCHIP",     "AL2230",
1728 		"AL7230B", "THETA",   "AL2210",   "MAXIM_NEW", "GCT",
1729 		"AL2230S",  "RALINK",  "INTERSIL", "RFMD",      "MAXIM_NEW2",
1730 		"PHILIPS"
1731 	};
1732 
1733 	return zyd_rfs[(type > 15) ? 0 : type];
1734 }
1735 
1736 static int
1737 zyd_hw_init(struct zyd_softc *sc)
1738 {
1739 	int error;
1740 	const struct zyd_phy_pair *phyp;
1741 	struct zyd_rf *rf = &sc->sc_rf;
1742 	uint16_t val;
1743 
1744 	/* specify that the plug and play is finished */
1745 	zyd_write32_m(sc, ZYD_MAC_AFTER_PNP, 1);
1746 	zyd_read16_m(sc, ZYD_FIRMWARE_BASE_ADDR, &sc->sc_fwbase);
1747 	DPRINTF(sc, ZYD_DEBUG_FW, "firmware base address=0x%04x\n",
1748 	    sc->sc_fwbase);
1749 
1750 	/* retrieve firmware revision number */
1751 	zyd_read16_m(sc, sc->sc_fwbase + ZYD_FW_FIRMWARE_REV, &sc->sc_fwrev);
1752 	zyd_write32_m(sc, ZYD_CR_GPI_EN, 0);
1753 	zyd_write32_m(sc, ZYD_MAC_CONT_WIN_LIMIT, 0x7f043f);
1754 	/* set mandatory rates - XXX assumes 802.11b/g */
1755 	zyd_write32_m(sc, ZYD_MAC_MAN_RATE, 0x150f);
1756 
1757 	/* disable interrupts */
1758 	zyd_write32_m(sc, ZYD_CR_INTERRUPT, 0);
1759 
1760 	if ((error = zyd_read_pod(sc)) != 0) {
1761 		device_printf(sc->sc_dev, "could not read EEPROM\n");
1762 		goto fail;
1763 	}
1764 
1765 	/* PHY init (resetting) */
1766 	error = zyd_lock_phy(sc);
1767 	if (error != 0)
1768 		goto fail;
1769 	phyp = (sc->sc_macrev == ZYD_ZD1211B) ? zyd_def_phyB : zyd_def_phy;
1770 	for (; phyp->reg != 0; phyp++)
1771 		zyd_write16_m(sc, phyp->reg, phyp->val);
1772 	if (sc->sc_macrev == ZYD_ZD1211 && sc->sc_fix_cr157 != 0) {
1773 		zyd_read16_m(sc, ZYD_EEPROM_PHY_REG, &val);
1774 		zyd_write32_m(sc, ZYD_CR157, val >> 8);
1775 	}
1776 	error = zyd_unlock_phy(sc);
1777 	if (error != 0)
1778 		goto fail;
1779 
1780 	/* HMAC init */
1781 	zyd_write32_m(sc, ZYD_MAC_ACK_EXT, 0x00000020);
1782 	zyd_write32_m(sc, ZYD_CR_ADDA_MBIAS_WT, 0x30000808);
1783 	zyd_write32_m(sc, ZYD_MAC_SNIFFER, 0x00000000);
1784 	zyd_write32_m(sc, ZYD_MAC_RXFILTER, 0x00000000);
1785 	zyd_write32_m(sc, ZYD_MAC_GHTBL, 0x00000000);
1786 	zyd_write32_m(sc, ZYD_MAC_GHTBH, 0x80000000);
1787 	zyd_write32_m(sc, ZYD_MAC_MISC, 0x000000a4);
1788 	zyd_write32_m(sc, ZYD_CR_ADDA_PWR_DWN, 0x0000007f);
1789 	zyd_write32_m(sc, ZYD_MAC_BCNCFG, 0x00f00401);
1790 	zyd_write32_m(sc, ZYD_MAC_PHY_DELAY2, 0x00000000);
1791 	zyd_write32_m(sc, ZYD_MAC_ACK_EXT, 0x00000080);
1792 	zyd_write32_m(sc, ZYD_CR_ADDA_PWR_DWN, 0x00000000);
1793 	zyd_write32_m(sc, ZYD_MAC_SIFS_ACK_TIME, 0x00000100);
1794 	zyd_write32_m(sc, ZYD_CR_RX_PE_DELAY, 0x00000070);
1795 	zyd_write32_m(sc, ZYD_CR_PS_CTRL, 0x10000000);
1796 	zyd_write32_m(sc, ZYD_MAC_RTSCTSRATE, 0x02030203);
1797 	zyd_write32_m(sc, ZYD_MAC_AFTER_PNP, 1);
1798 	zyd_write32_m(sc, ZYD_MAC_BACKOFF_PROTECT, 0x00000114);
1799 	zyd_write32_m(sc, ZYD_MAC_DIFS_EIFS_SIFS, 0x0a47c032);
1800 	zyd_write32_m(sc, ZYD_MAC_CAM_MODE, 0x3);
1801 
1802 	if (sc->sc_macrev == ZYD_ZD1211) {
1803 		zyd_write32_m(sc, ZYD_MAC_RETRY, 0x00000002);
1804 		zyd_write32_m(sc, ZYD_MAC_RX_THRESHOLD, 0x000c0640);
1805 	} else {
1806 		zyd_write32_m(sc, ZYD_MACB_MAX_RETRY, 0x02020202);
1807 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL4, 0x007f003f);
1808 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL3, 0x007f003f);
1809 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL2, 0x003f001f);
1810 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL1, 0x001f000f);
1811 		zyd_write32_m(sc, ZYD_MACB_AIFS_CTL1, 0x00280028);
1812 		zyd_write32_m(sc, ZYD_MACB_AIFS_CTL2, 0x008C003C);
1813 		zyd_write32_m(sc, ZYD_MACB_TXOP, 0x01800824);
1814 		zyd_write32_m(sc, ZYD_MAC_RX_THRESHOLD, 0x000c0eff);
1815 	}
1816 
1817 	/* init beacon interval to 100ms */
1818 	if ((error = zyd_set_beacon_interval(sc, 100)) != 0)
1819 		goto fail;
1820 
1821 	if ((error = zyd_rf_attach(sc, sc->sc_rfrev)) != 0) {
1822 		device_printf(sc->sc_dev, "could not attach RF, rev 0x%x\n",
1823 		    sc->sc_rfrev);
1824 		goto fail;
1825 	}
1826 
1827 	/* RF chip init */
1828 	error = zyd_lock_phy(sc);
1829 	if (error != 0)
1830 		goto fail;
1831 	error = (*rf->init)(rf);
1832 	if (error != 0) {
1833 		device_printf(sc->sc_dev,
1834 		    "radio initialization failed, error %d\n", error);
1835 		goto fail;
1836 	}
1837 	error = zyd_unlock_phy(sc);
1838 	if (error != 0)
1839 		goto fail;
1840 
1841 	if ((error = zyd_read_eeprom(sc)) != 0) {
1842 		device_printf(sc->sc_dev, "could not read EEPROM\n");
1843 		goto fail;
1844 	}
1845 
1846 fail:	return (error);
1847 }
1848 
1849 static int
1850 zyd_read_pod(struct zyd_softc *sc)
1851 {
1852 	int error;
1853 	uint32_t tmp;
1854 
1855 	zyd_read32_m(sc, ZYD_EEPROM_POD, &tmp);
1856 	sc->sc_rfrev     = tmp & 0x0f;
1857 	sc->sc_ledtype   = (tmp >>  4) & 0x01;
1858 	sc->sc_al2230s   = (tmp >>  7) & 0x01;
1859 	sc->sc_cckgain   = (tmp >>  8) & 0x01;
1860 	sc->sc_fix_cr157 = (tmp >> 13) & 0x01;
1861 	sc->sc_parev     = (tmp >> 16) & 0x0f;
1862 	sc->sc_bandedge6 = (tmp >> 21) & 0x01;
1863 	sc->sc_newphy    = (tmp >> 31) & 0x01;
1864 	sc->sc_txled     = ((tmp & (1 << 24)) && (tmp & (1 << 29))) ? 0 : 1;
1865 fail:
1866 	return (error);
1867 }
1868 
1869 static int
1870 zyd_read_eeprom(struct zyd_softc *sc)
1871 {
1872 	uint16_t val;
1873 	int error, i;
1874 
1875 	/* read Tx power calibration tables */
1876 	for (i = 0; i < 7; i++) {
1877 		zyd_read16_m(sc, ZYD_EEPROM_PWR_CAL + i, &val);
1878 		sc->sc_pwrcal[i * 2] = val >> 8;
1879 		sc->sc_pwrcal[i * 2 + 1] = val & 0xff;
1880 		zyd_read16_m(sc, ZYD_EEPROM_PWR_INT + i, &val);
1881 		sc->sc_pwrint[i * 2] = val >> 8;
1882 		sc->sc_pwrint[i * 2 + 1] = val & 0xff;
1883 		zyd_read16_m(sc, ZYD_EEPROM_36M_CAL + i, &val);
1884 		sc->sc_ofdm36_cal[i * 2] = val >> 8;
1885 		sc->sc_ofdm36_cal[i * 2 + 1] = val & 0xff;
1886 		zyd_read16_m(sc, ZYD_EEPROM_48M_CAL + i, &val);
1887 		sc->sc_ofdm48_cal[i * 2] = val >> 8;
1888 		sc->sc_ofdm48_cal[i * 2 + 1] = val & 0xff;
1889 		zyd_read16_m(sc, ZYD_EEPROM_54M_CAL + i, &val);
1890 		sc->sc_ofdm54_cal[i * 2] = val >> 8;
1891 		sc->sc_ofdm54_cal[i * 2 + 1] = val & 0xff;
1892 	}
1893 fail:
1894 	return (error);
1895 }
1896 
1897 static int
1898 zyd_get_macaddr(struct zyd_softc *sc)
1899 {
1900 	struct usb_device_request req;
1901 	usb_error_t error;
1902 
1903 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1904 	req.bRequest = ZYD_READFWDATAREQ;
1905 	USETW(req.wValue, ZYD_EEPROM_MAC_ADDR_P1);
1906 	USETW(req.wIndex, 0);
1907 	USETW(req.wLength, IEEE80211_ADDR_LEN);
1908 
1909 	error = zyd_do_request(sc, &req, sc->sc_bssid);
1910 	if (error != 0) {
1911 		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1912 		    usbd_errstr(error));
1913 	}
1914 
1915 	return (error);
1916 }
1917 
1918 static int
1919 zyd_set_macaddr(struct zyd_softc *sc, const uint8_t *addr)
1920 {
1921 	int error;
1922 	uint32_t tmp;
1923 
1924 	tmp = addr[3] << 24 | addr[2] << 16 | addr[1] << 8 | addr[0];
1925 	zyd_write32_m(sc, ZYD_MAC_MACADRL, tmp);
1926 	tmp = addr[5] << 8 | addr[4];
1927 	zyd_write32_m(sc, ZYD_MAC_MACADRH, tmp);
1928 fail:
1929 	return (error);
1930 }
1931 
1932 static int
1933 zyd_set_bssid(struct zyd_softc *sc, const uint8_t *addr)
1934 {
1935 	int error;
1936 	uint32_t tmp;
1937 
1938 	tmp = addr[3] << 24 | addr[2] << 16 | addr[1] << 8 | addr[0];
1939 	zyd_write32_m(sc, ZYD_MAC_BSSADRL, tmp);
1940 	tmp = addr[5] << 8 | addr[4];
1941 	zyd_write32_m(sc, ZYD_MAC_BSSADRH, tmp);
1942 fail:
1943 	return (error);
1944 }
1945 
1946 static int
1947 zyd_switch_radio(struct zyd_softc *sc, int on)
1948 {
1949 	struct zyd_rf *rf = &sc->sc_rf;
1950 	int error;
1951 
1952 	error = zyd_lock_phy(sc);
1953 	if (error != 0)
1954 		goto fail;
1955 	error = (*rf->switch_radio)(rf, on);
1956 	if (error != 0)
1957 		goto fail;
1958 	error = zyd_unlock_phy(sc);
1959 fail:
1960 	return (error);
1961 }
1962 
1963 static int
1964 zyd_set_led(struct zyd_softc *sc, int which, int on)
1965 {
1966 	int error;
1967 	uint32_t tmp;
1968 
1969 	zyd_read32_m(sc, ZYD_MAC_TX_PE_CONTROL, &tmp);
1970 	tmp &= ~which;
1971 	if (on)
1972 		tmp |= which;
1973 	zyd_write32_m(sc, ZYD_MAC_TX_PE_CONTROL, tmp);
1974 fail:
1975 	return (error);
1976 }
1977 
1978 static void
1979 zyd_set_multi(struct zyd_softc *sc)
1980 {
1981 	int error;
1982 	struct ifnet *ifp = sc->sc_ifp;
1983 	struct ieee80211com *ic = ifp->if_l2com;
1984 	struct ifmultiaddr *ifma;
1985 	uint32_t low, high;
1986 	uint8_t v;
1987 
1988 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1989 		return;
1990 
1991 	low = 0x00000000;
1992 	high = 0x80000000;
1993 
1994 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
1995 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
1996 		low = 0xffffffff;
1997 		high = 0xffffffff;
1998 	} else {
1999 		if_maddr_rlock(ifp);
2000 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2001 			if (ifma->ifma_addr->sa_family != AF_LINK)
2002 				continue;
2003 			v = ((uint8_t *)LLADDR((struct sockaddr_dl *)
2004 			    ifma->ifma_addr))[5] >> 2;
2005 			if (v < 32)
2006 				low |= 1 << v;
2007 			else
2008 				high |= 1 << (v - 32);
2009 		}
2010 		if_maddr_runlock(ifp);
2011 	}
2012 
2013 	/* reprogram multicast global hash table */
2014 	zyd_write32_m(sc, ZYD_MAC_GHTBL, low);
2015 	zyd_write32_m(sc, ZYD_MAC_GHTBH, high);
2016 fail:
2017 	if (error != 0)
2018 		device_printf(sc->sc_dev,
2019 		    "could not set multicast hash table\n");
2020 }
2021 
2022 static void
2023 zyd_update_mcast(struct ifnet *ifp)
2024 {
2025 	struct zyd_softc *sc = ifp->if_softc;
2026 
2027 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2028 		return;
2029 
2030 	ZYD_LOCK(sc);
2031 	zyd_set_multi(sc);
2032 	ZYD_UNLOCK(sc);
2033 }
2034 
2035 static int
2036 zyd_set_rxfilter(struct zyd_softc *sc)
2037 {
2038 	struct ifnet *ifp = sc->sc_ifp;
2039 	struct ieee80211com *ic = ifp->if_l2com;
2040 	uint32_t rxfilter;
2041 
2042 	switch (ic->ic_opmode) {
2043 	case IEEE80211_M_STA:
2044 		rxfilter = ZYD_FILTER_BSS;
2045 		break;
2046 	case IEEE80211_M_IBSS:
2047 	case IEEE80211_M_HOSTAP:
2048 		rxfilter = ZYD_FILTER_HOSTAP;
2049 		break;
2050 	case IEEE80211_M_MONITOR:
2051 		rxfilter = ZYD_FILTER_MONITOR;
2052 		break;
2053 	default:
2054 		/* should not get there */
2055 		return (EINVAL);
2056 	}
2057 	return zyd_write32(sc, ZYD_MAC_RXFILTER, rxfilter);
2058 }
2059 
2060 static void
2061 zyd_set_chan(struct zyd_softc *sc, struct ieee80211_channel *c)
2062 {
2063 	int error;
2064 	struct ifnet *ifp = sc->sc_ifp;
2065 	struct ieee80211com *ic = ifp->if_l2com;
2066 	struct zyd_rf *rf = &sc->sc_rf;
2067 	uint32_t tmp;
2068 	int chan;
2069 
2070 	chan = ieee80211_chan2ieee(ic, c);
2071 	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2072 		/* XXX should NEVER happen */
2073 		device_printf(sc->sc_dev,
2074 		    "%s: invalid channel %x\n", __func__, chan);
2075 		return;
2076 	}
2077 
2078 	error = zyd_lock_phy(sc);
2079 	if (error != 0)
2080 		goto fail;
2081 
2082 	error = (*rf->set_channel)(rf, chan);
2083 	if (error != 0)
2084 		goto fail;
2085 
2086 	if (rf->update_pwr) {
2087 		/* update Tx power */
2088 		zyd_write16_m(sc, ZYD_CR31, sc->sc_pwrint[chan - 1]);
2089 
2090 		if (sc->sc_macrev == ZYD_ZD1211B) {
2091 			zyd_write16_m(sc, ZYD_CR67,
2092 			    sc->sc_ofdm36_cal[chan - 1]);
2093 			zyd_write16_m(sc, ZYD_CR66,
2094 			    sc->sc_ofdm48_cal[chan - 1]);
2095 			zyd_write16_m(sc, ZYD_CR65,
2096 			    sc->sc_ofdm54_cal[chan - 1]);
2097 			zyd_write16_m(sc, ZYD_CR68, sc->sc_pwrcal[chan - 1]);
2098 			zyd_write16_m(sc, ZYD_CR69, 0x28);
2099 			zyd_write16_m(sc, ZYD_CR69, 0x2a);
2100 		}
2101 	}
2102 	if (sc->sc_cckgain) {
2103 		/* set CCK baseband gain from EEPROM */
2104 		if (zyd_read32(sc, ZYD_EEPROM_PHY_REG, &tmp) == 0)
2105 			zyd_write16_m(sc, ZYD_CR47, tmp & 0xff);
2106 	}
2107 	if (sc->sc_bandedge6 && rf->bandedge6 != NULL) {
2108 		error = (*rf->bandedge6)(rf, c);
2109 		if (error != 0)
2110 			goto fail;
2111 	}
2112 	zyd_write32_m(sc, ZYD_CR_CONFIG_PHILIPS, 0);
2113 
2114 	error = zyd_unlock_phy(sc);
2115 	if (error != 0)
2116 		goto fail;
2117 
2118 	sc->sc_rxtap.wr_chan_freq = sc->sc_txtap.wt_chan_freq =
2119 	    htole16(c->ic_freq);
2120 	sc->sc_rxtap.wr_chan_flags = sc->sc_txtap.wt_chan_flags =
2121 	    htole16(c->ic_flags);
2122 fail:
2123 	return;
2124 }
2125 
2126 static int
2127 zyd_set_beacon_interval(struct zyd_softc *sc, int bintval)
2128 {
2129 	int error;
2130 	uint32_t val;
2131 
2132 	zyd_read32_m(sc, ZYD_CR_ATIM_WND_PERIOD, &val);
2133 	sc->sc_atim_wnd = val;
2134 	zyd_read32_m(sc, ZYD_CR_PRE_TBTT, &val);
2135 	sc->sc_pre_tbtt = val;
2136 	sc->sc_bcn_int = bintval;
2137 
2138 	if (sc->sc_bcn_int <= 5)
2139 		sc->sc_bcn_int = 5;
2140 	if (sc->sc_pre_tbtt < 4 || sc->sc_pre_tbtt >= sc->sc_bcn_int)
2141 		sc->sc_pre_tbtt = sc->sc_bcn_int - 1;
2142 	if (sc->sc_atim_wnd >= sc->sc_pre_tbtt)
2143 		sc->sc_atim_wnd = sc->sc_pre_tbtt - 1;
2144 
2145 	zyd_write32_m(sc, ZYD_CR_ATIM_WND_PERIOD, sc->sc_atim_wnd);
2146 	zyd_write32_m(sc, ZYD_CR_PRE_TBTT, sc->sc_pre_tbtt);
2147 	zyd_write32_m(sc, ZYD_CR_BCN_INTERVAL, sc->sc_bcn_int);
2148 fail:
2149 	return (error);
2150 }
2151 
2152 static void
2153 zyd_rx_data(struct usb_xfer *xfer, int offset, uint16_t len)
2154 {
2155 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2156 	struct ifnet *ifp = sc->sc_ifp;
2157 	struct ieee80211com *ic = ifp->if_l2com;
2158 	struct zyd_plcphdr plcp;
2159 	struct zyd_rx_stat stat;
2160 	struct usb_page_cache *pc;
2161 	struct mbuf *m;
2162 	int rlen, rssi;
2163 
2164 	if (len < ZYD_MIN_FRAGSZ) {
2165 		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: frame too short (length=%d)\n",
2166 		    device_get_nameunit(sc->sc_dev), len);
2167 		ifp->if_ierrors++;
2168 		return;
2169 	}
2170 	pc = usbd_xfer_get_frame(xfer, 0);
2171 	usbd_copy_out(pc, offset, &plcp, sizeof(plcp));
2172 	usbd_copy_out(pc, offset + len - sizeof(stat), &stat, sizeof(stat));
2173 
2174 	if (stat.flags & ZYD_RX_ERROR) {
2175 		DPRINTF(sc, ZYD_DEBUG_RECV,
2176 		    "%s: RX status indicated error (%x)\n",
2177 		    device_get_nameunit(sc->sc_dev), stat.flags);
2178 		ifp->if_ierrors++;
2179 		return;
2180 	}
2181 
2182 	/* compute actual frame length */
2183 	rlen = len - sizeof(struct zyd_plcphdr) -
2184 	    sizeof(struct zyd_rx_stat) - IEEE80211_CRC_LEN;
2185 
2186 	/* allocate a mbuf to store the frame */
2187 	if (rlen > MCLBYTES) {
2188 		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: frame too long (length=%d)\n",
2189 		    device_get_nameunit(sc->sc_dev), rlen);
2190 		ifp->if_ierrors++;
2191 		return;
2192 	} else if (rlen > MHLEN)
2193 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
2194 	else
2195 		m = m_gethdr(M_DONTWAIT, MT_DATA);
2196 	if (m == NULL) {
2197 		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: could not allocate rx mbuf\n",
2198 		    device_get_nameunit(sc->sc_dev));
2199 		ifp->if_ierrors++;
2200 		return;
2201 	}
2202 	m->m_pkthdr.rcvif = ifp;
2203 	m->m_pkthdr.len = m->m_len = rlen;
2204 	usbd_copy_out(pc, offset + sizeof(plcp), mtod(m, uint8_t *), rlen);
2205 
2206 	if (ieee80211_radiotap_active(ic)) {
2207 		struct zyd_rx_radiotap_header *tap = &sc->sc_rxtap;
2208 
2209 		tap->wr_flags = 0;
2210 		if (stat.flags & (ZYD_RX_BADCRC16 | ZYD_RX_BADCRC32))
2211 			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2212 		/* XXX toss, no way to express errors */
2213 		if (stat.flags & ZYD_RX_DECRYPTERR)
2214 			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2215 		tap->wr_rate = ieee80211_plcp2rate(plcp.signal,
2216 		    (stat.flags & ZYD_RX_OFDM) ?
2217 			IEEE80211_T_OFDM : IEEE80211_T_CCK);
2218 		tap->wr_antsignal = stat.rssi + -95;
2219 		tap->wr_antnoise = -95;	/* XXX */
2220 	}
2221 	rssi = (stat.rssi > 63) ? 127 : 2 * stat.rssi;
2222 
2223 	sc->sc_rx_data[sc->sc_rx_count].rssi = rssi;
2224 	sc->sc_rx_data[sc->sc_rx_count].m = m;
2225 	sc->sc_rx_count++;
2226 }
2227 
2228 static void
2229 zyd_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
2230 {
2231 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2232 	struct ifnet *ifp = sc->sc_ifp;
2233 	struct ieee80211com *ic = ifp->if_l2com;
2234 	struct ieee80211_node *ni;
2235 	struct zyd_rx_desc desc;
2236 	struct mbuf *m;
2237 	struct usb_page_cache *pc;
2238 	uint32_t offset;
2239 	uint8_t rssi;
2240 	int8_t nf;
2241 	int i;
2242 	int actlen;
2243 
2244 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2245 
2246 	sc->sc_rx_count = 0;
2247 	switch (USB_GET_STATE(xfer)) {
2248 	case USB_ST_TRANSFERRED:
2249 		pc = usbd_xfer_get_frame(xfer, 0);
2250 		usbd_copy_out(pc, actlen - sizeof(desc), &desc, sizeof(desc));
2251 
2252 		offset = 0;
2253 		if (UGETW(desc.tag) == ZYD_TAG_MULTIFRAME) {
2254 			DPRINTF(sc, ZYD_DEBUG_RECV,
2255 			    "%s: received multi-frame transfer\n", __func__);
2256 
2257 			for (i = 0; i < ZYD_MAX_RXFRAMECNT; i++) {
2258 				uint16_t len16 = UGETW(desc.len[i]);
2259 
2260 				if (len16 == 0 || len16 > actlen)
2261 					break;
2262 
2263 				zyd_rx_data(xfer, offset, len16);
2264 
2265 				/* next frame is aligned on a 32-bit boundary */
2266 				len16 = (len16 + 3) & ~3;
2267 				offset += len16;
2268 				if (len16 > actlen)
2269 					break;
2270 				actlen -= len16;
2271 			}
2272 		} else {
2273 			DPRINTF(sc, ZYD_DEBUG_RECV,
2274 			    "%s: received single-frame transfer\n", __func__);
2275 
2276 			zyd_rx_data(xfer, 0, actlen);
2277 		}
2278 		/* FALLTHROUGH */
2279 	case USB_ST_SETUP:
2280 tr_setup:
2281 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2282 		usbd_transfer_submit(xfer);
2283 
2284 		/*
2285 		 * At the end of a USB callback it is always safe to unlock
2286 		 * the private mutex of a device! That is why we do the
2287 		 * "ieee80211_input" here, and not some lines up!
2288 		 */
2289 		ZYD_UNLOCK(sc);
2290 		for (i = 0; i < sc->sc_rx_count; i++) {
2291 			rssi = sc->sc_rx_data[i].rssi;
2292 			m = sc->sc_rx_data[i].m;
2293 			sc->sc_rx_data[i].m = NULL;
2294 
2295 			nf = -95;	/* XXX */
2296 
2297 			ni = ieee80211_find_rxnode(ic,
2298 			    mtod(m, struct ieee80211_frame_min *));
2299 			if (ni != NULL) {
2300 				(void)ieee80211_input(ni, m, rssi, nf);
2301 				ieee80211_free_node(ni);
2302 			} else
2303 				(void)ieee80211_input_all(ic, m, rssi, nf);
2304 		}
2305 		if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
2306 		    !IFQ_IS_EMPTY(&ifp->if_snd))
2307 			zyd_start(ifp);
2308 		ZYD_LOCK(sc);
2309 		break;
2310 
2311 	default:			/* Error */
2312 		DPRINTF(sc, ZYD_DEBUG_ANY, "frame error: %s\n", usbd_errstr(error));
2313 
2314 		if (error != USB_ERR_CANCELLED) {
2315 			/* try to clear stall first */
2316 			usbd_xfer_set_stall(xfer);
2317 			goto tr_setup;
2318 		}
2319 		break;
2320 	}
2321 }
2322 
2323 static uint8_t
2324 zyd_plcp_signal(struct zyd_softc *sc, int rate)
2325 {
2326 	switch (rate) {
2327 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
2328 	case 12:
2329 		return (0xb);
2330 	case 18:
2331 		return (0xf);
2332 	case 24:
2333 		return (0xa);
2334 	case 36:
2335 		return (0xe);
2336 	case 48:
2337 		return (0x9);
2338 	case 72:
2339 		return (0xd);
2340 	case 96:
2341 		return (0x8);
2342 	case 108:
2343 		return (0xc);
2344 	/* CCK rates (NB: not IEEE std, device-specific) */
2345 	case 2:
2346 		return (0x0);
2347 	case 4:
2348 		return (0x1);
2349 	case 11:
2350 		return (0x2);
2351 	case 22:
2352 		return (0x3);
2353 	}
2354 
2355 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
2356 	return (0x0);
2357 }
2358 
2359 static void
2360 zyd_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
2361 {
2362 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2363 	struct ifnet *ifp = sc->sc_ifp;
2364 	struct ieee80211vap *vap;
2365 	struct zyd_tx_data *data;
2366 	struct mbuf *m;
2367 	struct usb_page_cache *pc;
2368 	int actlen;
2369 
2370 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2371 
2372 	switch (USB_GET_STATE(xfer)) {
2373 	case USB_ST_TRANSFERRED:
2374 		DPRINTF(sc, ZYD_DEBUG_ANY, "transfer complete, %u bytes\n",
2375 		    actlen);
2376 
2377 		/* free resources */
2378 		data = usbd_xfer_get_priv(xfer);
2379 		zyd_tx_free(data, 0);
2380 		usbd_xfer_set_priv(xfer, NULL);
2381 
2382 		ifp->if_opackets++;
2383 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2384 
2385 		/* FALLTHROUGH */
2386 	case USB_ST_SETUP:
2387 tr_setup:
2388 		data = STAILQ_FIRST(&sc->tx_q);
2389 		if (data) {
2390 			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
2391 			m = data->m;
2392 
2393 			if (m->m_pkthdr.len > ZYD_MAX_TXBUFSZ) {
2394 				DPRINTF(sc, ZYD_DEBUG_ANY, "data overflow, %u bytes\n",
2395 				    m->m_pkthdr.len);
2396 				m->m_pkthdr.len = ZYD_MAX_TXBUFSZ;
2397 			}
2398 			pc = usbd_xfer_get_frame(xfer, 0);
2399 			usbd_copy_in(pc, 0, &data->desc, ZYD_TX_DESC_SIZE);
2400 			usbd_m_copy_in(pc, ZYD_TX_DESC_SIZE, m, 0,
2401 			    m->m_pkthdr.len);
2402 
2403 			vap = data->ni->ni_vap;
2404 			if (ieee80211_radiotap_active_vap(vap)) {
2405 				struct zyd_tx_radiotap_header *tap = &sc->sc_txtap;
2406 
2407 				tap->wt_flags = 0;
2408 				tap->wt_rate = data->rate;
2409 
2410 				ieee80211_radiotap_tx(vap, m);
2411 			}
2412 
2413 			usbd_xfer_set_frame_len(xfer, 0, ZYD_TX_DESC_SIZE + m->m_pkthdr.len);
2414 			usbd_xfer_set_priv(xfer, data);
2415 			usbd_transfer_submit(xfer);
2416 		}
2417 		ZYD_UNLOCK(sc);
2418 		zyd_start(ifp);
2419 		ZYD_LOCK(sc);
2420 		break;
2421 
2422 	default:			/* Error */
2423 		DPRINTF(sc, ZYD_DEBUG_ANY, "transfer error, %s\n",
2424 		    usbd_errstr(error));
2425 
2426 		ifp->if_oerrors++;
2427 		data = usbd_xfer_get_priv(xfer);
2428 		usbd_xfer_set_priv(xfer, NULL);
2429 		if (data != NULL)
2430 			zyd_tx_free(data, error);
2431 
2432 		if (error != USB_ERR_CANCELLED) {
2433 			if (error == USB_ERR_TIMEOUT)
2434 				device_printf(sc->sc_dev, "device timeout\n");
2435 
2436 			/*
2437 			 * Try to clear stall first, also if other
2438 			 * errors occur, hence clearing stall
2439 			 * introduces a 50 ms delay:
2440 			 */
2441 			usbd_xfer_set_stall(xfer);
2442 			goto tr_setup;
2443 		}
2444 		break;
2445 	}
2446 }
2447 
2448 static int
2449 zyd_tx_start(struct zyd_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
2450 {
2451 	struct ieee80211vap *vap = ni->ni_vap;
2452 	struct ieee80211com *ic = ni->ni_ic;
2453 	struct zyd_tx_desc *desc;
2454 	struct zyd_tx_data *data;
2455 	struct ieee80211_frame *wh;
2456 	const struct ieee80211_txparam *tp;
2457 	struct ieee80211_key *k;
2458 	int rate, totlen;
2459 	static uint8_t ratediv[] = ZYD_TX_RATEDIV;
2460 	uint8_t phy;
2461 	uint16_t pktlen;
2462 	uint32_t bits;
2463 
2464 	wh = mtod(m0, struct ieee80211_frame *);
2465 	data = STAILQ_FIRST(&sc->tx_free);
2466 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
2467 	sc->tx_nfree--;
2468 
2469 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT ||
2470 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) {
2471 		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2472 		rate = tp->mgmtrate;
2473 	} else {
2474 		tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2475 		/* for data frames */
2476 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2477 			rate = tp->mcastrate;
2478 		else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2479 			rate = tp->ucastrate;
2480 		else {
2481 			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2482 			rate = ni->ni_txrate;
2483 		}
2484 	}
2485 
2486 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2487 		k = ieee80211_crypto_encap(ni, m0);
2488 		if (k == NULL) {
2489 			m_freem(m0);
2490 			return (ENOBUFS);
2491 		}
2492 		/* packet header may have moved, reset our local pointer */
2493 		wh = mtod(m0, struct ieee80211_frame *);
2494 	}
2495 
2496 	data->ni = ni;
2497 	data->m = m0;
2498 	data->rate = rate;
2499 
2500 	/* fill Tx descriptor */
2501 	desc = &data->desc;
2502 	phy = zyd_plcp_signal(sc, rate);
2503 	desc->phy = phy;
2504 	if (ZYD_RATE_IS_OFDM(rate)) {
2505 		desc->phy |= ZYD_TX_PHY_OFDM;
2506 		if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
2507 			desc->phy |= ZYD_TX_PHY_5GHZ;
2508 	} else if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
2509 		desc->phy |= ZYD_TX_PHY_SHPREAMBLE;
2510 
2511 	totlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
2512 	desc->len = htole16(totlen);
2513 
2514 	desc->flags = ZYD_TX_FLAG_BACKOFF;
2515 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2516 		/* multicast frames are not sent at OFDM rates in 802.11b/g */
2517 		if (totlen > vap->iv_rtsthreshold) {
2518 			desc->flags |= ZYD_TX_FLAG_RTS;
2519 		} else if (ZYD_RATE_IS_OFDM(rate) &&
2520 		    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2521 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2522 				desc->flags |= ZYD_TX_FLAG_CTS_TO_SELF;
2523 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2524 				desc->flags |= ZYD_TX_FLAG_RTS;
2525 		}
2526 	} else
2527 		desc->flags |= ZYD_TX_FLAG_MULTICAST;
2528 	if ((wh->i_fc[0] &
2529 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
2530 	    (IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_PS_POLL))
2531 		desc->flags |= ZYD_TX_FLAG_TYPE(ZYD_TX_TYPE_PS_POLL);
2532 
2533 	/* actual transmit length (XXX why +10?) */
2534 	pktlen = ZYD_TX_DESC_SIZE + 10;
2535 	if (sc->sc_macrev == ZYD_ZD1211)
2536 		pktlen += totlen;
2537 	desc->pktlen = htole16(pktlen);
2538 
2539 	bits = (rate == 11) ? (totlen * 16) + 10 :
2540 	    ((rate == 22) ? (totlen * 8) + 10 : (totlen * 8));
2541 	desc->plcp_length = htole16(bits / ratediv[phy]);
2542 	desc->plcp_service = 0;
2543 	if (rate == 22 && (bits % 11) > 0 && (bits % 11) <= 3)
2544 		desc->plcp_service |= ZYD_PLCP_LENGEXT;
2545 	desc->nextlen = 0;
2546 
2547 	if (ieee80211_radiotap_active_vap(vap)) {
2548 		struct zyd_tx_radiotap_header *tap = &sc->sc_txtap;
2549 
2550 		tap->wt_flags = 0;
2551 		tap->wt_rate = rate;
2552 
2553 		ieee80211_radiotap_tx(vap, m0);
2554 	}
2555 
2556 	DPRINTF(sc, ZYD_DEBUG_XMIT,
2557 	    "%s: sending data frame len=%zu rate=%u\n",
2558 	    device_get_nameunit(sc->sc_dev), (size_t)m0->m_pkthdr.len,
2559 		rate);
2560 
2561 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
2562 	usbd_transfer_start(sc->sc_xfer[ZYD_BULK_WR]);
2563 
2564 	return (0);
2565 }
2566 
2567 static void
2568 zyd_start(struct ifnet *ifp)
2569 {
2570 	struct zyd_softc *sc = ifp->if_softc;
2571 	struct ieee80211_node *ni;
2572 	struct mbuf *m;
2573 
2574 	ZYD_LOCK(sc);
2575 	for (;;) {
2576 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2577 		if (m == NULL)
2578 			break;
2579 		if (sc->tx_nfree == 0) {
2580 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
2581 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2582 			break;
2583 		}
2584 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2585 		if (zyd_tx_start(sc, m, ni) != 0) {
2586 			ieee80211_free_node(ni);
2587 			ifp->if_oerrors++;
2588 			break;
2589 		}
2590 	}
2591 	ZYD_UNLOCK(sc);
2592 }
2593 
2594 static int
2595 zyd_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2596 	const struct ieee80211_bpf_params *params)
2597 {
2598 	struct ieee80211com *ic = ni->ni_ic;
2599 	struct ifnet *ifp = ic->ic_ifp;
2600 	struct zyd_softc *sc = ifp->if_softc;
2601 
2602 	ZYD_LOCK(sc);
2603 	/* prevent management frames from being sent if we're not ready */
2604 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2605 		ZYD_UNLOCK(sc);
2606 		m_freem(m);
2607 		ieee80211_free_node(ni);
2608 		return (ENETDOWN);
2609 	}
2610 	if (sc->tx_nfree == 0) {
2611 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2612 		ZYD_UNLOCK(sc);
2613 		m_freem(m);
2614 		ieee80211_free_node(ni);
2615 		return (ENOBUFS);		/* XXX */
2616 	}
2617 
2618 	/*
2619 	 * Legacy path; interpret frame contents to decide
2620 	 * precisely how to send the frame.
2621 	 * XXX raw path
2622 	 */
2623 	if (zyd_tx_start(sc, m, ni) != 0) {
2624 		ZYD_UNLOCK(sc);
2625 		ifp->if_oerrors++;
2626 		ieee80211_free_node(ni);
2627 		return (EIO);
2628 	}
2629 	ZYD_UNLOCK(sc);
2630 	return (0);
2631 }
2632 
2633 static int
2634 zyd_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2635 {
2636 	struct zyd_softc *sc = ifp->if_softc;
2637 	struct ieee80211com *ic = ifp->if_l2com;
2638 	struct ifreq *ifr = (struct ifreq *) data;
2639 	int error = 0, startall = 0;
2640 
2641 	switch (cmd) {
2642 	case SIOCSIFFLAGS:
2643 		ZYD_LOCK(sc);
2644 		if (ifp->if_flags & IFF_UP) {
2645 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2646 				zyd_init_locked(sc);
2647 				startall = 1;
2648 			} else
2649 				zyd_set_multi(sc);
2650 		} else {
2651 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2652 				zyd_stop(sc);
2653 		}
2654 		ZYD_UNLOCK(sc);
2655 		if (startall)
2656 			ieee80211_start_all(ic);
2657 		break;
2658 	case SIOCGIFMEDIA:
2659 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2660 		break;
2661 	case SIOCGIFADDR:
2662 		error = ether_ioctl(ifp, cmd, data);
2663 		break;
2664 	default:
2665 		error = EINVAL;
2666 		break;
2667 	}
2668 	return (error);
2669 }
2670 
2671 static void
2672 zyd_init_locked(struct zyd_softc *sc)
2673 {
2674 	struct ifnet *ifp = sc->sc_ifp;
2675 	struct ieee80211com *ic = ifp->if_l2com;
2676 	struct usb_config_descriptor *cd;
2677 	int error;
2678 	uint32_t val;
2679 
2680 	ZYD_LOCK_ASSERT(sc, MA_OWNED);
2681 
2682 	if (!(sc->sc_flags & ZYD_FLAG_INITONCE)) {
2683 		error = zyd_loadfirmware(sc);
2684 		if (error != 0) {
2685 			device_printf(sc->sc_dev,
2686 			    "could not load firmware (error=%d)\n", error);
2687 			goto fail;
2688 		}
2689 
2690 		/* reset device */
2691 		cd = usbd_get_config_descriptor(sc->sc_udev);
2692 		error = usbd_req_set_config(sc->sc_udev, &sc->sc_mtx,
2693 		    cd->bConfigurationValue);
2694 		if (error)
2695 			device_printf(sc->sc_dev, "reset failed, continuing\n");
2696 
2697 		error = zyd_hw_init(sc);
2698 		if (error) {
2699 			device_printf(sc->sc_dev,
2700 			    "hardware initialization failed\n");
2701 			goto fail;
2702 		}
2703 
2704 		device_printf(sc->sc_dev,
2705 		    "HMAC ZD1211%s, FW %02x.%02x, RF %s S%x, PA%x LED %x "
2706 		    "BE%x NP%x Gain%x F%x\n",
2707 		    (sc->sc_macrev == ZYD_ZD1211) ? "": "B",
2708 		    sc->sc_fwrev >> 8, sc->sc_fwrev & 0xff,
2709 		    zyd_rf_name(sc->sc_rfrev), sc->sc_al2230s, sc->sc_parev,
2710 		    sc->sc_ledtype, sc->sc_bandedge6, sc->sc_newphy,
2711 		    sc->sc_cckgain, sc->sc_fix_cr157);
2712 
2713 		/* read regulatory domain (currently unused) */
2714 		zyd_read32_m(sc, ZYD_EEPROM_SUBID, &val);
2715 		sc->sc_regdomain = val >> 16;
2716 		DPRINTF(sc, ZYD_DEBUG_INIT, "regulatory domain %x\n",
2717 		    sc->sc_regdomain);
2718 
2719 		/* we'll do software WEP decryption for now */
2720 		DPRINTF(sc, ZYD_DEBUG_INIT, "%s: setting encryption type\n",
2721 		    __func__);
2722 		zyd_write32_m(sc, ZYD_MAC_ENCRYPTION_TYPE, ZYD_ENC_SNIFFER);
2723 
2724 		sc->sc_flags |= ZYD_FLAG_INITONCE;
2725 	}
2726 
2727 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2728 		zyd_stop(sc);
2729 
2730 	DPRINTF(sc, ZYD_DEBUG_INIT, "setting MAC address to %6D\n",
2731 	    IF_LLADDR(ifp), ":");
2732 	error = zyd_set_macaddr(sc, IF_LLADDR(ifp));
2733 	if (error != 0)
2734 		return;
2735 
2736 	/* set basic rates */
2737 	if (ic->ic_curmode == IEEE80211_MODE_11B)
2738 		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0x0003);
2739 	else if (ic->ic_curmode == IEEE80211_MODE_11A)
2740 		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0x1500);
2741 	else	/* assumes 802.11b/g */
2742 		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0xff0f);
2743 
2744 	/* promiscuous mode */
2745 	zyd_write32_m(sc, ZYD_MAC_SNIFFER, 0);
2746 	/* multicast setup */
2747 	zyd_set_multi(sc);
2748 	/* set RX filter  */
2749 	error = zyd_set_rxfilter(sc);
2750 	if (error != 0)
2751 		goto fail;
2752 
2753 	/* switch radio transmitter ON */
2754 	error = zyd_switch_radio(sc, 1);
2755 	if (error != 0)
2756 		goto fail;
2757 	/* set default BSS channel */
2758 	zyd_set_chan(sc, ic->ic_curchan);
2759 
2760 	/*
2761 	 * Allocate Tx and Rx xfer queues.
2762 	 */
2763 	zyd_setup_tx_list(sc);
2764 
2765 	/* enable interrupts */
2766 	zyd_write32_m(sc, ZYD_CR_INTERRUPT, ZYD_HWINT_MASK);
2767 
2768 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2769 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2770 	usbd_xfer_set_stall(sc->sc_xfer[ZYD_BULK_WR]);
2771 	usbd_transfer_start(sc->sc_xfer[ZYD_BULK_RD]);
2772 	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_RD]);
2773 
2774 	return;
2775 
2776 fail:	zyd_stop(sc);
2777 	return;
2778 }
2779 
2780 static void
2781 zyd_init(void *priv)
2782 {
2783 	struct zyd_softc *sc = priv;
2784 	struct ifnet *ifp = sc->sc_ifp;
2785 	struct ieee80211com *ic = ifp->if_l2com;
2786 
2787 	ZYD_LOCK(sc);
2788 	zyd_init_locked(sc);
2789 	ZYD_UNLOCK(sc);
2790 
2791 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2792 		ieee80211_start_all(ic);		/* start all vap's */
2793 }
2794 
2795 static void
2796 zyd_stop(struct zyd_softc *sc)
2797 {
2798 	struct ifnet *ifp = sc->sc_ifp;
2799 	int error;
2800 
2801 	ZYD_LOCK_ASSERT(sc, MA_OWNED);
2802 
2803 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2804 
2805 	/*
2806 	 * Drain all the transfers, if not already drained:
2807 	 */
2808 	ZYD_UNLOCK(sc);
2809 	usbd_transfer_drain(sc->sc_xfer[ZYD_BULK_WR]);
2810 	usbd_transfer_drain(sc->sc_xfer[ZYD_BULK_RD]);
2811 	ZYD_LOCK(sc);
2812 
2813 	zyd_unsetup_tx_list(sc);
2814 
2815 	/* Stop now if the device was never set up */
2816 	if (!(sc->sc_flags & ZYD_FLAG_INITONCE))
2817 		return;
2818 
2819 	/* switch radio transmitter OFF */
2820 	error = zyd_switch_radio(sc, 0);
2821 	if (error != 0)
2822 		goto fail;
2823 	/* disable Rx */
2824 	zyd_write32_m(sc, ZYD_MAC_RXFILTER, 0);
2825 	/* disable interrupts */
2826 	zyd_write32_m(sc, ZYD_CR_INTERRUPT, 0);
2827 
2828 fail:
2829 	return;
2830 }
2831 
2832 static int
2833 zyd_loadfirmware(struct zyd_softc *sc)
2834 {
2835 	struct usb_device_request req;
2836 	size_t size;
2837 	u_char *fw;
2838 	uint8_t stat;
2839 	uint16_t addr;
2840 
2841 	if (sc->sc_flags & ZYD_FLAG_FWLOADED)
2842 		return (0);
2843 
2844 	if (sc->sc_macrev == ZYD_ZD1211) {
2845 		fw = (u_char *)zd1211_firmware;
2846 		size = sizeof(zd1211_firmware);
2847 	} else {
2848 		fw = (u_char *)zd1211b_firmware;
2849 		size = sizeof(zd1211b_firmware);
2850 	}
2851 
2852 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2853 	req.bRequest = ZYD_DOWNLOADREQ;
2854 	USETW(req.wIndex, 0);
2855 
2856 	addr = ZYD_FIRMWARE_START_ADDR;
2857 	while (size > 0) {
2858 		/*
2859 		 * When the transfer size is 4096 bytes, it is not
2860 		 * likely to be able to transfer it.
2861 		 * The cause is port or machine or chip?
2862 		 */
2863 		const int mlen = min(size, 64);
2864 
2865 		DPRINTF(sc, ZYD_DEBUG_FW,
2866 		    "loading firmware block: len=%d, addr=0x%x\n", mlen, addr);
2867 
2868 		USETW(req.wValue, addr);
2869 		USETW(req.wLength, mlen);
2870 		if (zyd_do_request(sc, &req, fw) != 0)
2871 			return (EIO);
2872 
2873 		addr += mlen / 2;
2874 		fw   += mlen;
2875 		size -= mlen;
2876 	}
2877 
2878 	/* check whether the upload succeeded */
2879 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
2880 	req.bRequest = ZYD_DOWNLOADSTS;
2881 	USETW(req.wValue, 0);
2882 	USETW(req.wIndex, 0);
2883 	USETW(req.wLength, sizeof(stat));
2884 	if (zyd_do_request(sc, &req, &stat) != 0)
2885 		return (EIO);
2886 
2887 	sc->sc_flags |= ZYD_FLAG_FWLOADED;
2888 
2889 	return (stat & 0x80) ? (EIO) : (0);
2890 }
2891 
2892 static void
2893 zyd_scan_start(struct ieee80211com *ic)
2894 {
2895 	struct ifnet *ifp = ic->ic_ifp;
2896 	struct zyd_softc *sc = ifp->if_softc;
2897 
2898 	ZYD_LOCK(sc);
2899 	/* want broadcast address while scanning */
2900 	zyd_set_bssid(sc, ifp->if_broadcastaddr);
2901 	ZYD_UNLOCK(sc);
2902 }
2903 
2904 static void
2905 zyd_scan_end(struct ieee80211com *ic)
2906 {
2907 	struct zyd_softc *sc = ic->ic_ifp->if_softc;
2908 
2909 	ZYD_LOCK(sc);
2910 	/* restore previous bssid */
2911 	zyd_set_bssid(sc, sc->sc_bssid);
2912 	ZYD_UNLOCK(sc);
2913 }
2914 
2915 static void
2916 zyd_set_channel(struct ieee80211com *ic)
2917 {
2918 	struct zyd_softc *sc = ic->ic_ifp->if_softc;
2919 
2920 	ZYD_LOCK(sc);
2921 	zyd_set_chan(sc, ic->ic_curchan);
2922 	ZYD_UNLOCK(sc);
2923 }
2924 
2925 static device_method_t zyd_methods[] = {
2926         /* Device interface */
2927         DEVMETHOD(device_probe, zyd_match),
2928         DEVMETHOD(device_attach, zyd_attach),
2929         DEVMETHOD(device_detach, zyd_detach),
2930 
2931 	{ 0, 0 }
2932 };
2933 
2934 static driver_t zyd_driver = {
2935         "zyd",
2936         zyd_methods,
2937         sizeof(struct zyd_softc)
2938 };
2939 
2940 static devclass_t zyd_devclass;
2941 
2942 DRIVER_MODULE(zyd, uhub, zyd_driver, zyd_devclass, NULL, 0);
2943 MODULE_DEPEND(zyd, usb, 1, 1, 1);
2944 MODULE_DEPEND(zyd, wlan, 1, 1, 1);
2945 MODULE_VERSION(zyd, 1);
2946