xref: /freebsd/sys/dev/usb/wlan/if_zyd.c (revision 830940567b49bb0c08dfaed40418999e76616909)
1 /*	$OpenBSD: if_zyd.c,v 1.52 2007/02/11 00:08:04 jsg Exp $	*/
2 /*	$NetBSD: if_zyd.c,v 1.7 2007/06/21 04:04:29 kiyohara Exp $	*/
3 /*	$FreeBSD$	*/
4 
5 /*-
6  * Copyright (c) 2006 by Damien Bergamini <damien.bergamini@free.fr>
7  * Copyright (c) 2006 by Florian Stoehr <ich@florian-stoehr.de>
8  *
9  * Permission to use, copy, modify, and distribute this software for any
10  * purpose with or without fee is hereby granted, provided that the above
11  * copyright notice and this permission notice appear in all copies.
12  *
13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20  */
21 
22 #include <sys/cdefs.h>
23 __FBSDID("$FreeBSD$");
24 
25 /*
26  * ZyDAS ZD1211/ZD1211B USB WLAN driver.
27  */
28 
29 #include <sys/param.h>
30 #include <sys/sockio.h>
31 #include <sys/sysctl.h>
32 #include <sys/lock.h>
33 #include <sys/mutex.h>
34 #include <sys/condvar.h>
35 #include <sys/mbuf.h>
36 #include <sys/kernel.h>
37 #include <sys/socket.h>
38 #include <sys/systm.h>
39 #include <sys/malloc.h>
40 #include <sys/module.h>
41 #include <sys/bus.h>
42 #include <sys/endian.h>
43 #include <sys/kdb.h>
44 
45 #include <machine/bus.h>
46 #include <machine/resource.h>
47 #include <sys/rman.h>
48 
49 #include <net/bpf.h>
50 #include <net/if.h>
51 #include <net/if_arp.h>
52 #include <net/ethernet.h>
53 #include <net/if_dl.h>
54 #include <net/if_media.h>
55 #include <net/if_types.h>
56 
57 #ifdef INET
58 #include <netinet/in.h>
59 #include <netinet/in_systm.h>
60 #include <netinet/in_var.h>
61 #include <netinet/if_ether.h>
62 #include <netinet/ip.h>
63 #endif
64 
65 #include <net80211/ieee80211_var.h>
66 #include <net80211/ieee80211_regdomain.h>
67 #include <net80211/ieee80211_radiotap.h>
68 #include <net80211/ieee80211_amrr.h>
69 
70 #include <dev/usb/usb.h>
71 #include <dev/usb/usbdi.h>
72 #include <dev/usb/usbdi_util.h>
73 #include "usbdevs.h"
74 
75 #include <dev/usb/wlan/if_zydreg.h>
76 #include <dev/usb/wlan/if_zydfw.h>
77 
78 #if USB_DEBUG
79 static int zyd_debug = 0;
80 
81 SYSCTL_NODE(_hw_usb, OID_AUTO, zyd, CTLFLAG_RW, 0, "USB zyd");
82 SYSCTL_INT(_hw_usb_zyd, OID_AUTO, debug, CTLFLAG_RW, &zyd_debug, 0,
83     "zyd debug level");
84 
85 enum {
86 	ZYD_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
87 	ZYD_DEBUG_RECV		= 0x00000002,	/* basic recv operation */
88 	ZYD_DEBUG_RESET		= 0x00000004,	/* reset processing */
89 	ZYD_DEBUG_INIT		= 0x00000008,	/* device init */
90 	ZYD_DEBUG_TX_PROC	= 0x00000010,	/* tx ISR proc */
91 	ZYD_DEBUG_RX_PROC	= 0x00000020,	/* rx ISR proc */
92 	ZYD_DEBUG_STATE		= 0x00000040,	/* 802.11 state transitions */
93 	ZYD_DEBUG_STAT		= 0x00000080,	/* statistic */
94 	ZYD_DEBUG_FW		= 0x00000100,	/* firmware */
95 	ZYD_DEBUG_CMD		= 0x00000200,	/* fw commands */
96 	ZYD_DEBUG_ANY		= 0xffffffff
97 };
98 #define	DPRINTF(sc, m, fmt, ...) do {				\
99 	if (zyd_debug & (m))					\
100 		printf("%s: " fmt, __func__, ## __VA_ARGS__);	\
101 } while (0)
102 #else
103 #define	DPRINTF(sc, m, fmt, ...) do {				\
104 	(void) sc;						\
105 } while (0)
106 #endif
107 
108 #define	zyd_do_request(sc,req,data) \
109     usbd_do_request_flags((sc)->sc_udev, &(sc)->sc_mtx, req, data, 0, NULL, 5000)
110 
111 static device_probe_t zyd_match;
112 static device_attach_t zyd_attach;
113 static device_detach_t zyd_detach;
114 
115 static usb_callback_t zyd_intr_read_callback;
116 static usb_callback_t zyd_intr_write_callback;
117 static usb_callback_t zyd_bulk_read_callback;
118 static usb_callback_t zyd_bulk_write_callback;
119 
120 static struct ieee80211vap *zyd_vap_create(struct ieee80211com *,
121 		    const char name[IFNAMSIZ], int unit, int opmode,
122 		    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
123 		    const uint8_t mac[IEEE80211_ADDR_LEN]);
124 static void	zyd_vap_delete(struct ieee80211vap *);
125 static void	zyd_tx_free(struct zyd_tx_data *, int);
126 static void	zyd_setup_tx_list(struct zyd_softc *);
127 static void	zyd_unsetup_tx_list(struct zyd_softc *);
128 static struct ieee80211_node *zyd_node_alloc(struct ieee80211vap *,
129 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
130 static int	zyd_newstate(struct ieee80211vap *, enum ieee80211_state, int);
131 static int	zyd_cmd(struct zyd_softc *, uint16_t, const void *, int,
132 		    void *, int, int);
133 static int	zyd_read16(struct zyd_softc *, uint16_t, uint16_t *);
134 static int	zyd_read32(struct zyd_softc *, uint16_t, uint32_t *);
135 static int	zyd_write16(struct zyd_softc *, uint16_t, uint16_t);
136 static int	zyd_write32(struct zyd_softc *, uint16_t, uint32_t);
137 static int	zyd_rfwrite(struct zyd_softc *, uint32_t);
138 static int	zyd_lock_phy(struct zyd_softc *);
139 static int	zyd_unlock_phy(struct zyd_softc *);
140 static int	zyd_rf_attach(struct zyd_softc *, uint8_t);
141 static const char *zyd_rf_name(uint8_t);
142 static int	zyd_hw_init(struct zyd_softc *);
143 static int	zyd_read_pod(struct zyd_softc *);
144 static int	zyd_read_eeprom(struct zyd_softc *);
145 static int	zyd_get_macaddr(struct zyd_softc *);
146 static int	zyd_set_macaddr(struct zyd_softc *, const uint8_t *);
147 static int	zyd_set_bssid(struct zyd_softc *, const uint8_t *);
148 static int	zyd_switch_radio(struct zyd_softc *, int);
149 static int	zyd_set_led(struct zyd_softc *, int, int);
150 static void	zyd_set_multi(struct zyd_softc *);
151 static void	zyd_update_mcast(struct ifnet *);
152 static int	zyd_set_rxfilter(struct zyd_softc *);
153 static void	zyd_set_chan(struct zyd_softc *, struct ieee80211_channel *);
154 static int	zyd_set_beacon_interval(struct zyd_softc *, int);
155 static void	zyd_rx_data(struct usb_xfer *, int, uint16_t);
156 static int	zyd_tx_start(struct zyd_softc *, struct mbuf *,
157 		    struct ieee80211_node *);
158 static void	zyd_start(struct ifnet *);
159 static int	zyd_raw_xmit(struct ieee80211_node *, struct mbuf *,
160 		    const struct ieee80211_bpf_params *);
161 static int	zyd_ioctl(struct ifnet *, u_long, caddr_t);
162 static void	zyd_init_locked(struct zyd_softc *);
163 static void	zyd_init(void *);
164 static void	zyd_stop(struct zyd_softc *);
165 static int	zyd_loadfirmware(struct zyd_softc *);
166 static void	zyd_newassoc(struct ieee80211_node *, int);
167 static void	zyd_scan_start(struct ieee80211com *);
168 static void	zyd_scan_end(struct ieee80211com *);
169 static void	zyd_set_channel(struct ieee80211com *);
170 static int	zyd_rfmd_init(struct zyd_rf *);
171 static int	zyd_rfmd_switch_radio(struct zyd_rf *, int);
172 static int	zyd_rfmd_set_channel(struct zyd_rf *, uint8_t);
173 static int	zyd_al2230_init(struct zyd_rf *);
174 static int	zyd_al2230_switch_radio(struct zyd_rf *, int);
175 static int	zyd_al2230_set_channel(struct zyd_rf *, uint8_t);
176 static int	zyd_al2230_set_channel_b(struct zyd_rf *, uint8_t);
177 static int	zyd_al2230_init_b(struct zyd_rf *);
178 static int	zyd_al7230B_init(struct zyd_rf *);
179 static int	zyd_al7230B_switch_radio(struct zyd_rf *, int);
180 static int	zyd_al7230B_set_channel(struct zyd_rf *, uint8_t);
181 static int	zyd_al2210_init(struct zyd_rf *);
182 static int	zyd_al2210_switch_radio(struct zyd_rf *, int);
183 static int	zyd_al2210_set_channel(struct zyd_rf *, uint8_t);
184 static int	zyd_gct_init(struct zyd_rf *);
185 static int	zyd_gct_switch_radio(struct zyd_rf *, int);
186 static int	zyd_gct_set_channel(struct zyd_rf *, uint8_t);
187 static int	zyd_gct_mode(struct zyd_rf *);
188 static int	zyd_gct_set_channel_synth(struct zyd_rf *, int, int);
189 static int	zyd_gct_write(struct zyd_rf *, uint16_t);
190 static int	zyd_gct_txgain(struct zyd_rf *, uint8_t);
191 static int	zyd_maxim2_init(struct zyd_rf *);
192 static int	zyd_maxim2_switch_radio(struct zyd_rf *, int);
193 static int	zyd_maxim2_set_channel(struct zyd_rf *, uint8_t);
194 
195 static const struct zyd_phy_pair zyd_def_phy[] = ZYD_DEF_PHY;
196 static const struct zyd_phy_pair zyd_def_phyB[] = ZYD_DEF_PHYB;
197 
198 /* various supported device vendors/products */
199 #define ZYD_ZD1211	0
200 #define ZYD_ZD1211B	1
201 
202 #define	ZYD_ZD1211_DEV(v,p)	\
203 	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, ZYD_ZD1211) }
204 #define	ZYD_ZD1211B_DEV(v,p)	\
205 	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, ZYD_ZD1211B) }
206 static const struct usb_device_id zyd_devs[] = {
207 	/* ZYD_ZD1211 */
208 	ZYD_ZD1211_DEV(3COM2, 3CRUSB10075),
209 	ZYD_ZD1211_DEV(ABOCOM, WL54),
210 	ZYD_ZD1211_DEV(ASUS, WL159G),
211 	ZYD_ZD1211_DEV(CYBERTAN, TG54USB),
212 	ZYD_ZD1211_DEV(DRAYTEK, VIGOR550),
213 	ZYD_ZD1211_DEV(PLANEX2, GWUS54GD),
214 	ZYD_ZD1211_DEV(PLANEX2, GWUS54GZL),
215 	ZYD_ZD1211_DEV(PLANEX3, GWUS54GZ),
216 	ZYD_ZD1211_DEV(PLANEX3, GWUS54MINI),
217 	ZYD_ZD1211_DEV(SAGEM, XG760A),
218 	ZYD_ZD1211_DEV(SENAO, NUB8301),
219 	ZYD_ZD1211_DEV(SITECOMEU, WL113),
220 	ZYD_ZD1211_DEV(SWEEX, ZD1211),
221 	ZYD_ZD1211_DEV(TEKRAM, QUICKWLAN),
222 	ZYD_ZD1211_DEV(TEKRAM, ZD1211_1),
223 	ZYD_ZD1211_DEV(TEKRAM, ZD1211_2),
224 	ZYD_ZD1211_DEV(TWINMOS, G240),
225 	ZYD_ZD1211_DEV(UMEDIA, ALL0298V2),
226 	ZYD_ZD1211_DEV(UMEDIA, TEW429UB_A),
227 	ZYD_ZD1211_DEV(UMEDIA, TEW429UB),
228 	ZYD_ZD1211_DEV(WISTRONNEWEB, UR055G),
229 	ZYD_ZD1211_DEV(ZCOM, ZD1211),
230 	ZYD_ZD1211_DEV(ZYDAS, ZD1211),
231 	ZYD_ZD1211_DEV(ZYXEL, AG225H),
232 	ZYD_ZD1211_DEV(ZYXEL, ZYAIRG220),
233 	ZYD_ZD1211_DEV(ZYXEL, G200V2),
234 	/* ZYD_ZD1211B */
235 	ZYD_ZD1211B_DEV(ACCTON, SMCWUSBG),
236 	ZYD_ZD1211B_DEV(ACCTON, ZD1211B),
237 	ZYD_ZD1211B_DEV(ASUS, A9T_WIFI),
238 	ZYD_ZD1211B_DEV(BELKIN, F5D7050_V4000),
239 	ZYD_ZD1211B_DEV(BELKIN, ZD1211B),
240 	ZYD_ZD1211B_DEV(CISCOLINKSYS, WUSBF54G),
241 	ZYD_ZD1211B_DEV(FIBERLINE, WL430U),
242 	ZYD_ZD1211B_DEV(MELCO, KG54L),
243 	ZYD_ZD1211B_DEV(PHILIPS, SNU5600),
244 	ZYD_ZD1211B_DEV(PLANEX2, GW_US54GXS),
245 	ZYD_ZD1211B_DEV(SAGEM, XG76NA),
246 	ZYD_ZD1211B_DEV(SITECOMEU, ZD1211B),
247 	ZYD_ZD1211B_DEV(UMEDIA, TEW429UBC1),
248 	ZYD_ZD1211B_DEV(USR, USR5423),
249 	ZYD_ZD1211B_DEV(VTECH, ZD1211B),
250 	ZYD_ZD1211B_DEV(ZCOM, ZD1211B),
251 	ZYD_ZD1211B_DEV(ZYDAS, ZD1211B),
252 	ZYD_ZD1211B_DEV(ZYXEL, M202),
253 	ZYD_ZD1211B_DEV(ZYXEL, G202),
254 	ZYD_ZD1211B_DEV(ZYXEL, G220V2)
255 };
256 
257 static const struct usb_config zyd_config[ZYD_N_TRANSFER] = {
258 	[ZYD_BULK_WR] = {
259 		.type = UE_BULK,
260 		.endpoint = UE_ADDR_ANY,
261 		.direction = UE_DIR_OUT,
262 		.bufsize = ZYD_MAX_TXBUFSZ,
263 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
264 		.callback = zyd_bulk_write_callback,
265 		.ep_index = 0,
266 		.timeout = 10000,	/* 10 seconds */
267 	},
268 	[ZYD_BULK_RD] = {
269 		.type = UE_BULK,
270 		.endpoint = UE_ADDR_ANY,
271 		.direction = UE_DIR_IN,
272 		.bufsize = ZYX_MAX_RXBUFSZ,
273 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
274 		.callback = zyd_bulk_read_callback,
275 		.ep_index = 0,
276 	},
277 	[ZYD_INTR_WR] = {
278 		.type = UE_BULK_INTR,
279 		.endpoint = UE_ADDR_ANY,
280 		.direction = UE_DIR_OUT,
281 		.bufsize = sizeof(struct zyd_cmd),
282 		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
283 		.callback = zyd_intr_write_callback,
284 		.timeout = 1000,	/* 1 second */
285 		.ep_index = 1,
286 	},
287 	[ZYD_INTR_RD] = {
288 		.type = UE_INTERRUPT,
289 		.endpoint = UE_ADDR_ANY,
290 		.direction = UE_DIR_IN,
291 		.bufsize = sizeof(struct zyd_cmd),
292 		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
293 		.callback = zyd_intr_read_callback,
294 	},
295 };
296 #define zyd_read16_m(sc, val, data)	do {				\
297 	error = zyd_read16(sc, val, data);				\
298 	if (error != 0)							\
299 		goto fail;						\
300 } while (0)
301 #define zyd_write16_m(sc, val, data)	do {				\
302 	error = zyd_write16(sc, val, data);				\
303 	if (error != 0)							\
304 		goto fail;						\
305 } while (0)
306 #define zyd_read32_m(sc, val, data)	do {				\
307 	error = zyd_read32(sc, val, data);				\
308 	if (error != 0)							\
309 		goto fail;						\
310 } while (0)
311 #define zyd_write32_m(sc, val, data)	do {				\
312 	error = zyd_write32(sc, val, data);				\
313 	if (error != 0)							\
314 		goto fail;						\
315 } while (0)
316 
317 static int
318 zyd_match(device_t dev)
319 {
320 	struct usb_attach_arg *uaa = device_get_ivars(dev);
321 
322 	if (uaa->usb_mode != USB_MODE_HOST)
323 		return (ENXIO);
324 	if (uaa->info.bConfigIndex != ZYD_CONFIG_INDEX)
325 		return (ENXIO);
326 	if (uaa->info.bIfaceIndex != ZYD_IFACE_INDEX)
327 		return (ENXIO);
328 
329 	return (usbd_lookup_id_by_uaa(zyd_devs, sizeof(zyd_devs), uaa));
330 }
331 
332 static int
333 zyd_attach(device_t dev)
334 {
335 	struct usb_attach_arg *uaa = device_get_ivars(dev);
336 	struct zyd_softc *sc = device_get_softc(dev);
337 	struct ifnet *ifp;
338 	struct ieee80211com *ic;
339 	uint8_t iface_index, bands;
340 	int error;
341 
342 	if (uaa->info.bcdDevice < 0x4330) {
343 		device_printf(dev, "device version mismatch: 0x%X "
344 		    "(only >= 43.30 supported)\n",
345 		    uaa->info.bcdDevice);
346 		return (EINVAL);
347 	}
348 
349 	device_set_usb_desc(dev);
350 	sc->sc_dev = dev;
351 	sc->sc_udev = uaa->device;
352 	sc->sc_macrev = USB_GET_DRIVER_INFO(uaa);
353 
354 	mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
355 	    MTX_NETWORK_LOCK, MTX_DEF);
356 	STAILQ_INIT(&sc->sc_rqh);
357 
358 	iface_index = ZYD_IFACE_INDEX;
359 	error = usbd_transfer_setup(uaa->device,
360 	    &iface_index, sc->sc_xfer, zyd_config,
361 	    ZYD_N_TRANSFER, sc, &sc->sc_mtx);
362 	if (error) {
363 		device_printf(dev, "could not allocate USB transfers, "
364 		    "err=%s\n", usbd_errstr(error));
365 		goto detach;
366 	}
367 
368 	ZYD_LOCK(sc);
369 	if ((error = zyd_get_macaddr(sc)) != 0) {
370 		device_printf(sc->sc_dev, "could not read EEPROM\n");
371 		ZYD_UNLOCK(sc);
372 		goto detach;
373 	}
374 	ZYD_UNLOCK(sc);
375 
376 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
377 	if (ifp == NULL) {
378 		device_printf(sc->sc_dev, "can not if_alloc()\n");
379 		goto detach;
380 	}
381 	ifp->if_softc = sc;
382 	if_initname(ifp, "zyd", device_get_unit(sc->sc_dev));
383 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
384 	ifp->if_init = zyd_init;
385 	ifp->if_ioctl = zyd_ioctl;
386 	ifp->if_start = zyd_start;
387 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
388 	IFQ_SET_READY(&ifp->if_snd);
389 
390 	ic = ifp->if_l2com;
391 	ic->ic_ifp = ifp;
392 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
393 	ic->ic_opmode = IEEE80211_M_STA;
394 
395 	/* set device capabilities */
396 	ic->ic_caps =
397 		  IEEE80211_C_STA		/* station mode */
398 		| IEEE80211_C_MONITOR		/* monitor mode */
399 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
400 	        | IEEE80211_C_SHSLOT		/* short slot time supported */
401 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
402 	        | IEEE80211_C_WPA		/* 802.11i */
403 		;
404 
405 	bands = 0;
406 	setbit(&bands, IEEE80211_MODE_11B);
407 	setbit(&bands, IEEE80211_MODE_11G);
408 	ieee80211_init_channels(ic, NULL, &bands);
409 
410 	ieee80211_ifattach(ic, sc->sc_bssid);
411 	ic->ic_newassoc = zyd_newassoc;
412 	ic->ic_raw_xmit = zyd_raw_xmit;
413 	ic->ic_node_alloc = zyd_node_alloc;
414 	ic->ic_scan_start = zyd_scan_start;
415 	ic->ic_scan_end = zyd_scan_end;
416 	ic->ic_set_channel = zyd_set_channel;
417 
418 	ic->ic_vap_create = zyd_vap_create;
419 	ic->ic_vap_delete = zyd_vap_delete;
420 	ic->ic_update_mcast = zyd_update_mcast;
421 	ic->ic_update_promisc = zyd_update_mcast;
422 
423 	ieee80211_radiotap_attach(ic,
424 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
425 		ZYD_TX_RADIOTAP_PRESENT,
426 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
427 		ZYD_RX_RADIOTAP_PRESENT);
428 
429 	if (bootverbose)
430 		ieee80211_announce(ic);
431 
432 	return (0);
433 
434 detach:
435 	zyd_detach(dev);
436 	return (ENXIO);			/* failure */
437 }
438 
439 static int
440 zyd_detach(device_t dev)
441 {
442 	struct zyd_softc *sc = device_get_softc(dev);
443 	struct ifnet *ifp = sc->sc_ifp;
444 	struct ieee80211com *ic;
445 
446 	/* stop all USB transfers */
447 	usbd_transfer_unsetup(sc->sc_xfer, ZYD_N_TRANSFER);
448 
449 	/* free TX list, if any */
450 	zyd_unsetup_tx_list(sc);
451 
452 	if (ifp) {
453 		ic = ifp->if_l2com;
454 		ieee80211_ifdetach(ic);
455 		if_free(ifp);
456 	}
457 	mtx_destroy(&sc->sc_mtx);
458 
459 	return (0);
460 }
461 
462 static struct ieee80211vap *
463 zyd_vap_create(struct ieee80211com *ic,
464 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
465 	const uint8_t bssid[IEEE80211_ADDR_LEN],
466 	const uint8_t mac[IEEE80211_ADDR_LEN])
467 {
468 	struct zyd_vap *zvp;
469 	struct ieee80211vap *vap;
470 
471 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
472 		return (NULL);
473 	zvp = (struct zyd_vap *) malloc(sizeof(struct zyd_vap),
474 	    M_80211_VAP, M_NOWAIT | M_ZERO);
475 	if (zvp == NULL)
476 		return (NULL);
477 	vap = &zvp->vap;
478 	/* enable s/w bmiss handling for sta mode */
479 	ieee80211_vap_setup(ic, vap, name, unit, opmode,
480 	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
481 
482 	/* override state transition machine */
483 	zvp->newstate = vap->iv_newstate;
484 	vap->iv_newstate = zyd_newstate;
485 
486 	ieee80211_amrr_init(&zvp->amrr, vap,
487 	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
488 	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
489 	    1000 /* 1 sec */);
490 
491 	/* complete setup */
492 	ieee80211_vap_attach(vap, ieee80211_media_change,
493 	    ieee80211_media_status);
494 	ic->ic_opmode = opmode;
495 	return (vap);
496 }
497 
498 static void
499 zyd_vap_delete(struct ieee80211vap *vap)
500 {
501 	struct zyd_vap *zvp = ZYD_VAP(vap);
502 
503 	ieee80211_amrr_cleanup(&zvp->amrr);
504 	ieee80211_vap_detach(vap);
505 	free(zvp, M_80211_VAP);
506 }
507 
508 static void
509 zyd_tx_free(struct zyd_tx_data *data, int txerr)
510 {
511 	struct zyd_softc *sc = data->sc;
512 
513 	if (data->m != NULL) {
514 		if (data->m->m_flags & M_TXCB)
515 			ieee80211_process_callback(data->ni, data->m,
516 			    txerr ? ETIMEDOUT : 0);
517 		m_freem(data->m);
518 		data->m = NULL;
519 
520 		if (txerr == 0)
521 			ieee80211_amrr_tx_complete(&ZYD_NODE(data->ni)->amn,
522 			    IEEE80211_AMRR_SUCCESS, 0);
523 		ieee80211_free_node(data->ni);
524 		data->ni = NULL;
525 	}
526 	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
527 	sc->tx_nfree++;
528 }
529 
530 static void
531 zyd_setup_tx_list(struct zyd_softc *sc)
532 {
533 	struct zyd_tx_data *data;
534 	int i;
535 
536 	sc->tx_nfree = 0;
537 	STAILQ_INIT(&sc->tx_q);
538 	STAILQ_INIT(&sc->tx_free);
539 
540 	for (i = 0; i < ZYD_TX_LIST_CNT; i++) {
541 		data = &sc->tx_data[i];
542 
543 		data->sc = sc;
544 		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
545 		sc->tx_nfree++;
546 	}
547 }
548 
549 static void
550 zyd_unsetup_tx_list(struct zyd_softc *sc)
551 {
552 	struct zyd_tx_data *data;
553 	int i;
554 
555 	/* make sure any subsequent use of the queues will fail */
556 	sc->tx_nfree = 0;
557 	STAILQ_INIT(&sc->tx_q);
558 	STAILQ_INIT(&sc->tx_free);
559 
560 	/* free up all node references and mbufs */
561 	for (i = 0; i < ZYD_TX_LIST_CNT; i++) {
562 		data = &sc->tx_data[i];
563 
564 		if (data->m != NULL) {
565 			m_freem(data->m);
566 			data->m = NULL;
567 		}
568 		if (data->ni != NULL) {
569 			ieee80211_free_node(data->ni);
570 			data->ni = NULL;
571 		}
572 	}
573 }
574 
575 /* ARGUSED */
576 static struct ieee80211_node *
577 zyd_node_alloc(struct ieee80211vap *vap __unused,
578 	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
579 {
580 	struct zyd_node *zn;
581 
582 	zn = malloc(sizeof(struct zyd_node), M_80211_NODE, M_NOWAIT | M_ZERO);
583 	return (zn != NULL) ? (&zn->ni) : (NULL);
584 }
585 
586 static int
587 zyd_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
588 {
589 	struct zyd_vap *zvp = ZYD_VAP(vap);
590 	struct ieee80211com *ic = vap->iv_ic;
591 	struct zyd_softc *sc = ic->ic_ifp->if_softc;
592 	struct ieee80211_node *ni;
593 	int error;
594 
595 	DPRINTF(sc, ZYD_DEBUG_STATE, "%s: %s -> %s\n", __func__,
596 	    ieee80211_state_name[vap->iv_state],
597 	    ieee80211_state_name[nstate]);
598 
599 	IEEE80211_UNLOCK(ic);
600 	ZYD_LOCK(sc);
601 	switch (nstate) {
602 	case IEEE80211_S_AUTH:
603 		zyd_set_chan(sc, ic->ic_curchan);
604 		break;
605 	case IEEE80211_S_RUN:
606 		ni = vap->iv_bss;
607 		if (vap->iv_opmode == IEEE80211_M_MONITOR)
608 			break;
609 
610 		/* turn link LED on */
611 		error = zyd_set_led(sc, ZYD_LED1, 1);
612 		if (error != 0)
613 			break;
614 
615 		/* make data LED blink upon Tx */
616 		zyd_write32_m(sc, sc->sc_fwbase + ZYD_FW_LINK_STATUS, 1);
617 
618 		IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
619 		zyd_set_bssid(sc, sc->sc_bssid);
620 		break;
621 	default:
622 		break;
623 	}
624 fail:
625 	ZYD_UNLOCK(sc);
626 	IEEE80211_LOCK(ic);
627 	return (zvp->newstate(vap, nstate, arg));
628 }
629 
630 /*
631  * Callback handler for interrupt transfer
632  */
633 static void
634 zyd_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
635 {
636 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
637 	struct ifnet *ifp = sc->sc_ifp;
638 	struct ieee80211com *ic = ifp->if_l2com;
639 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
640 	struct ieee80211_node *ni;
641 	struct zyd_cmd *cmd = &sc->sc_ibuf;
642 	struct usb_page_cache *pc;
643 	int datalen;
644 	int actlen;
645 
646 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
647 
648 	switch (USB_GET_STATE(xfer)) {
649 	case USB_ST_TRANSFERRED:
650 		pc = usbd_xfer_get_frame(xfer, 0);
651 		usbd_copy_out(pc, 0, cmd, sizeof(*cmd));
652 
653 		switch (le16toh(cmd->code)) {
654 		case ZYD_NOTIF_RETRYSTATUS:
655 		{
656 			struct zyd_notif_retry *retry =
657 			    (struct zyd_notif_retry *)cmd->data;
658 
659 			DPRINTF(sc, ZYD_DEBUG_TX_PROC,
660 			    "retry intr: rate=0x%x addr=%s count=%d (0x%x)\n",
661 			    le16toh(retry->rate), ether_sprintf(retry->macaddr),
662 			    le16toh(retry->count)&0xff, le16toh(retry->count));
663 
664 			/*
665 			 * Find the node to which the packet was sent and
666 			 * update its retry statistics.  In BSS mode, this node
667 			 * is the AP we're associated to so no lookup is
668 			 * actually needed.
669 			 */
670 			ni = ieee80211_find_txnode(vap, retry->macaddr);
671 			if (ni != NULL) {
672 				ieee80211_amrr_tx_complete(&ZYD_NODE(ni)->amn,
673 				    IEEE80211_AMRR_FAILURE,
674 				    (int)(le16toh(retry->count) & 0xff));
675 				ieee80211_free_node(ni);
676 			}
677 			if (le16toh(retry->count) & 0x100)
678 				ifp->if_oerrors++;	/* too many retries */
679 			break;
680 		}
681 		case ZYD_NOTIF_IORD:
682 		{
683 			struct zyd_rq *rqp;
684 
685 			if (le16toh(*(uint16_t *)cmd->data) == ZYD_CR_INTERRUPT)
686 				break;	/* HMAC interrupt */
687 
688 			datalen = actlen - sizeof(cmd->code);
689 			datalen -= 2;	/* XXX: padding? */
690 
691 			STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
692 				int i, cnt;
693 
694 				if (rqp->olen != datalen)
695 					continue;
696 				cnt = rqp->olen / sizeof(struct zyd_pair);
697 				for (i = 0; i < cnt; i++) {
698 					if (*(((const uint16_t *)rqp->idata) + i) !=
699 					    (((struct zyd_pair *)cmd->data) + i)->reg)
700 						break;
701 				}
702 				if (i != cnt)
703 					continue;
704 				/* copy answer into caller-supplied buffer */
705 				bcopy(cmd->data, rqp->odata, rqp->olen);
706 				DPRINTF(sc, ZYD_DEBUG_CMD,
707 				    "command %p complete, data = %*D \n",
708 				    rqp, rqp->olen, rqp->odata, ":");
709 				wakeup(rqp);	/* wakeup caller */
710 				break;
711 			}
712 			if (rqp == NULL) {
713 				device_printf(sc->sc_dev,
714 				    "unexpected IORD notification %*D\n",
715 				    datalen, cmd->data, ":");
716 			}
717 			break;
718 		}
719 		default:
720 			device_printf(sc->sc_dev, "unknown notification %x\n",
721 			    le16toh(cmd->code));
722 		}
723 
724 		/* FALLTHROUGH */
725 	case USB_ST_SETUP:
726 tr_setup:
727 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
728 		usbd_transfer_submit(xfer);
729 		break;
730 
731 	default:			/* Error */
732 		DPRINTF(sc, ZYD_DEBUG_CMD, "error = %s\n",
733 		    usbd_errstr(error));
734 
735 		if (error != USB_ERR_CANCELLED) {
736 			/* try to clear stall first */
737 			usbd_xfer_set_stall(xfer);
738 			goto tr_setup;
739 		}
740 		break;
741 	}
742 }
743 
744 static void
745 zyd_intr_write_callback(struct usb_xfer *xfer, usb_error_t error)
746 {
747 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
748 	struct zyd_rq *rqp, *cmd;
749 	struct usb_page_cache *pc;
750 
751 	switch (USB_GET_STATE(xfer)) {
752 	case USB_ST_TRANSFERRED:
753 		cmd = usbd_xfer_get_priv(xfer);
754 		DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n", cmd);
755 		STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
756 			/* Ensure the cached rq pointer is still valid */
757 			if (rqp == cmd &&
758 			    (rqp->flags & ZYD_CMD_FLAG_READ) == 0)
759 				wakeup(rqp);	/* wakeup caller */
760 		}
761 
762 		/* FALLTHROUGH */
763 	case USB_ST_SETUP:
764 tr_setup:
765 		STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
766 			if (rqp->flags & ZYD_CMD_FLAG_SENT)
767 				continue;
768 
769 			pc = usbd_xfer_get_frame(xfer, 0);
770 			usbd_copy_in(pc, 0, rqp->cmd, rqp->ilen);
771 
772 			usbd_xfer_set_frame_len(xfer, 0, rqp->ilen);
773 			usbd_xfer_set_priv(xfer, rqp);
774 			rqp->flags |= ZYD_CMD_FLAG_SENT;
775 			usbd_transfer_submit(xfer);
776 			break;
777 		}
778 		break;
779 
780 	default:			/* Error */
781 		DPRINTF(sc, ZYD_DEBUG_ANY, "error = %s\n",
782 		    usbd_errstr(error));
783 
784 		if (error != USB_ERR_CANCELLED) {
785 			/* try to clear stall first */
786 			usbd_xfer_set_stall(xfer);
787 			goto tr_setup;
788 		}
789 		break;
790 	}
791 }
792 
793 static int
794 zyd_cmd(struct zyd_softc *sc, uint16_t code, const void *idata, int ilen,
795     void *odata, int olen, int flags)
796 {
797 	struct zyd_cmd cmd;
798 	struct zyd_rq rq;
799 	int error;
800 
801 	if (ilen > sizeof(cmd.data))
802 		return (EINVAL);
803 
804 	cmd.code = htole16(code);
805 	bcopy(idata, cmd.data, ilen);
806 	DPRINTF(sc, ZYD_DEBUG_CMD, "sending cmd %p = %*D\n",
807 	    &rq, ilen, idata, ":");
808 
809 	rq.cmd = &cmd;
810 	rq.idata = idata;
811 	rq.odata = odata;
812 	rq.ilen = sizeof(uint16_t) + ilen;
813 	rq.olen = olen;
814 	rq.flags = flags;
815 	STAILQ_INSERT_TAIL(&sc->sc_rqh, &rq, rq);
816 	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_RD]);
817 	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_WR]);
818 
819 	/* wait at most one second for command reply */
820 	error = mtx_sleep(&rq, &sc->sc_mtx, 0 , "zydcmd", hz);
821 	if (error)
822 		device_printf(sc->sc_dev, "command timeout\n");
823 	STAILQ_REMOVE(&sc->sc_rqh, &rq, zyd_rq, rq);
824 	DPRINTF(sc, ZYD_DEBUG_CMD, "finsihed cmd %p, error = %d \n",
825 	    &rq, error);
826 
827 	return (error);
828 }
829 
830 static int
831 zyd_read16(struct zyd_softc *sc, uint16_t reg, uint16_t *val)
832 {
833 	struct zyd_pair tmp;
834 	int error;
835 
836 	reg = htole16(reg);
837 	error = zyd_cmd(sc, ZYD_CMD_IORD, &reg, sizeof(reg), &tmp, sizeof(tmp),
838 	    ZYD_CMD_FLAG_READ);
839 	if (error == 0)
840 		*val = le16toh(tmp.val);
841 	return (error);
842 }
843 
844 static int
845 zyd_read32(struct zyd_softc *sc, uint16_t reg, uint32_t *val)
846 {
847 	struct zyd_pair tmp[2];
848 	uint16_t regs[2];
849 	int error;
850 
851 	regs[0] = htole16(ZYD_REG32_HI(reg));
852 	regs[1] = htole16(ZYD_REG32_LO(reg));
853 	error = zyd_cmd(sc, ZYD_CMD_IORD, regs, sizeof(regs), tmp, sizeof(tmp),
854 	    ZYD_CMD_FLAG_READ);
855 	if (error == 0)
856 		*val = le16toh(tmp[0].val) << 16 | le16toh(tmp[1].val);
857 	return (error);
858 }
859 
860 static int
861 zyd_write16(struct zyd_softc *sc, uint16_t reg, uint16_t val)
862 {
863 	struct zyd_pair pair;
864 
865 	pair.reg = htole16(reg);
866 	pair.val = htole16(val);
867 
868 	return zyd_cmd(sc, ZYD_CMD_IOWR, &pair, sizeof(pair), NULL, 0, 0);
869 }
870 
871 static int
872 zyd_write32(struct zyd_softc *sc, uint16_t reg, uint32_t val)
873 {
874 	struct zyd_pair pair[2];
875 
876 	pair[0].reg = htole16(ZYD_REG32_HI(reg));
877 	pair[0].val = htole16(val >> 16);
878 	pair[1].reg = htole16(ZYD_REG32_LO(reg));
879 	pair[1].val = htole16(val & 0xffff);
880 
881 	return zyd_cmd(sc, ZYD_CMD_IOWR, pair, sizeof(pair), NULL, 0, 0);
882 }
883 
884 static int
885 zyd_rfwrite(struct zyd_softc *sc, uint32_t val)
886 {
887 	struct zyd_rf *rf = &sc->sc_rf;
888 	struct zyd_rfwrite_cmd req;
889 	uint16_t cr203;
890 	int error, i;
891 
892 	zyd_read16_m(sc, ZYD_CR203, &cr203);
893 	cr203 &= ~(ZYD_RF_IF_LE | ZYD_RF_CLK | ZYD_RF_DATA);
894 
895 	req.code  = htole16(2);
896 	req.width = htole16(rf->width);
897 	for (i = 0; i < rf->width; i++) {
898 		req.bit[i] = htole16(cr203);
899 		if (val & (1 << (rf->width - 1 - i)))
900 			req.bit[i] |= htole16(ZYD_RF_DATA);
901 	}
902 	error = zyd_cmd(sc, ZYD_CMD_RFCFG, &req, 4 + 2 * rf->width, NULL, 0, 0);
903 fail:
904 	return (error);
905 }
906 
907 static int
908 zyd_rfwrite_cr(struct zyd_softc *sc, uint32_t val)
909 {
910 	int error;
911 
912 	zyd_write16_m(sc, ZYD_CR244, (val >> 16) & 0xff);
913 	zyd_write16_m(sc, ZYD_CR243, (val >>  8) & 0xff);
914 	zyd_write16_m(sc, ZYD_CR242, (val >>  0) & 0xff);
915 fail:
916 	return (error);
917 }
918 
919 static int
920 zyd_lock_phy(struct zyd_softc *sc)
921 {
922 	int error;
923 	uint32_t tmp;
924 
925 	zyd_read32_m(sc, ZYD_MAC_MISC, &tmp);
926 	tmp &= ~ZYD_UNLOCK_PHY_REGS;
927 	zyd_write32_m(sc, ZYD_MAC_MISC, tmp);
928 fail:
929 	return (error);
930 }
931 
932 static int
933 zyd_unlock_phy(struct zyd_softc *sc)
934 {
935 	int error;
936 	uint32_t tmp;
937 
938 	zyd_read32_m(sc, ZYD_MAC_MISC, &tmp);
939 	tmp |= ZYD_UNLOCK_PHY_REGS;
940 	zyd_write32_m(sc, ZYD_MAC_MISC, tmp);
941 fail:
942 	return (error);
943 }
944 
945 /*
946  * RFMD RF methods.
947  */
948 static int
949 zyd_rfmd_init(struct zyd_rf *rf)
950 {
951 #define N(a)	(sizeof(a) / sizeof((a)[0]))
952 	struct zyd_softc *sc = rf->rf_sc;
953 	static const struct zyd_phy_pair phyini[] = ZYD_RFMD_PHY;
954 	static const uint32_t rfini[] = ZYD_RFMD_RF;
955 	int i, error;
956 
957 	/* init RF-dependent PHY registers */
958 	for (i = 0; i < N(phyini); i++) {
959 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
960 	}
961 
962 	/* init RFMD radio */
963 	for (i = 0; i < N(rfini); i++) {
964 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
965 			return (error);
966 	}
967 fail:
968 	return (error);
969 #undef N
970 }
971 
972 static int
973 zyd_rfmd_switch_radio(struct zyd_rf *rf, int on)
974 {
975 	int error;
976 	struct zyd_softc *sc = rf->rf_sc;
977 
978 	zyd_write16_m(sc, ZYD_CR10, on ? 0x89 : 0x15);
979 	zyd_write16_m(sc, ZYD_CR11, on ? 0x00 : 0x81);
980 fail:
981 	return (error);
982 }
983 
984 static int
985 zyd_rfmd_set_channel(struct zyd_rf *rf, uint8_t chan)
986 {
987 	int error;
988 	struct zyd_softc *sc = rf->rf_sc;
989 	static const struct {
990 		uint32_t	r1, r2;
991 	} rfprog[] = ZYD_RFMD_CHANTABLE;
992 
993 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
994 	if (error != 0)
995 		goto fail;
996 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
997 	if (error != 0)
998 		goto fail;
999 
1000 fail:
1001 	return (error);
1002 }
1003 
1004 /*
1005  * AL2230 RF methods.
1006  */
1007 static int
1008 zyd_al2230_init(struct zyd_rf *rf)
1009 {
1010 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1011 	struct zyd_softc *sc = rf->rf_sc;
1012 	static const struct zyd_phy_pair phyini[] = ZYD_AL2230_PHY;
1013 	static const struct zyd_phy_pair phy2230s[] = ZYD_AL2230S_PHY_INIT;
1014 	static const struct zyd_phy_pair phypll[] = {
1015 		{ ZYD_CR251, 0x2f }, { ZYD_CR251, 0x3f },
1016 		{ ZYD_CR138, 0x28 }, { ZYD_CR203, 0x06 }
1017 	};
1018 	static const uint32_t rfini1[] = ZYD_AL2230_RF_PART1;
1019 	static const uint32_t rfini2[] = ZYD_AL2230_RF_PART2;
1020 	static const uint32_t rfini3[] = ZYD_AL2230_RF_PART3;
1021 	int i, error;
1022 
1023 	/* init RF-dependent PHY registers */
1024 	for (i = 0; i < N(phyini); i++)
1025 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1026 
1027 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0) {
1028 		for (i = 0; i < N(phy2230s); i++)
1029 			zyd_write16_m(sc, phy2230s[i].reg, phy2230s[i].val);
1030 	}
1031 
1032 	/* init AL2230 radio */
1033 	for (i = 0; i < N(rfini1); i++) {
1034 		error = zyd_rfwrite(sc, rfini1[i]);
1035 		if (error != 0)
1036 			goto fail;
1037 	}
1038 
1039 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0)
1040 		error = zyd_rfwrite(sc, 0x000824);
1041 	else
1042 		error = zyd_rfwrite(sc, 0x0005a4);
1043 	if (error != 0)
1044 		goto fail;
1045 
1046 	for (i = 0; i < N(rfini2); i++) {
1047 		error = zyd_rfwrite(sc, rfini2[i]);
1048 		if (error != 0)
1049 			goto fail;
1050 	}
1051 
1052 	for (i = 0; i < N(phypll); i++)
1053 		zyd_write16_m(sc, phypll[i].reg, phypll[i].val);
1054 
1055 	for (i = 0; i < N(rfini3); i++) {
1056 		error = zyd_rfwrite(sc, rfini3[i]);
1057 		if (error != 0)
1058 			goto fail;
1059 	}
1060 fail:
1061 	return (error);
1062 #undef N
1063 }
1064 
1065 static int
1066 zyd_al2230_fini(struct zyd_rf *rf)
1067 {
1068 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1069 	int error, i;
1070 	struct zyd_softc *sc = rf->rf_sc;
1071 	static const struct zyd_phy_pair phy[] = ZYD_AL2230_PHY_FINI_PART1;
1072 
1073 	for (i = 0; i < N(phy); i++)
1074 		zyd_write16_m(sc, phy[i].reg, phy[i].val);
1075 
1076 	if (sc->sc_newphy != 0)
1077 		zyd_write16_m(sc, ZYD_CR9, 0xe1);
1078 
1079 	zyd_write16_m(sc, ZYD_CR203, 0x6);
1080 fail:
1081 	return (error);
1082 #undef N
1083 }
1084 
1085 static int
1086 zyd_al2230_init_b(struct zyd_rf *rf)
1087 {
1088 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1089 	struct zyd_softc *sc = rf->rf_sc;
1090 	static const struct zyd_phy_pair phy1[] = ZYD_AL2230_PHY_PART1;
1091 	static const struct zyd_phy_pair phy2[] = ZYD_AL2230_PHY_PART2;
1092 	static const struct zyd_phy_pair phy3[] = ZYD_AL2230_PHY_PART3;
1093 	static const struct zyd_phy_pair phy2230s[] = ZYD_AL2230S_PHY_INIT;
1094 	static const struct zyd_phy_pair phyini[] = ZYD_AL2230_PHY_B;
1095 	static const uint32_t rfini_part1[] = ZYD_AL2230_RF_B_PART1;
1096 	static const uint32_t rfini_part2[] = ZYD_AL2230_RF_B_PART2;
1097 	static const uint32_t rfini_part3[] = ZYD_AL2230_RF_B_PART3;
1098 	static const uint32_t zyd_al2230_chtable[][3] = ZYD_AL2230_CHANTABLE;
1099 	int i, error;
1100 
1101 	for (i = 0; i < N(phy1); i++)
1102 		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1103 
1104 	/* init RF-dependent PHY registers */
1105 	for (i = 0; i < N(phyini); i++)
1106 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1107 
1108 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0) {
1109 		for (i = 0; i < N(phy2230s); i++)
1110 			zyd_write16_m(sc, phy2230s[i].reg, phy2230s[i].val);
1111 	}
1112 
1113 	for (i = 0; i < 3; i++) {
1114 		error = zyd_rfwrite_cr(sc, zyd_al2230_chtable[0][i]);
1115 		if (error != 0)
1116 			return (error);
1117 	}
1118 
1119 	for (i = 0; i < N(rfini_part1); i++) {
1120 		error = zyd_rfwrite_cr(sc, rfini_part1[i]);
1121 		if (error != 0)
1122 			return (error);
1123 	}
1124 
1125 	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0)
1126 		error = zyd_rfwrite(sc, 0x241000);
1127 	else
1128 		error = zyd_rfwrite(sc, 0x25a000);
1129 	if (error != 0)
1130 		goto fail;
1131 
1132 	for (i = 0; i < N(rfini_part2); i++) {
1133 		error = zyd_rfwrite_cr(sc, rfini_part2[i]);
1134 		if (error != 0)
1135 			return (error);
1136 	}
1137 
1138 	for (i = 0; i < N(phy2); i++)
1139 		zyd_write16_m(sc, phy2[i].reg, phy2[i].val);
1140 
1141 	for (i = 0; i < N(rfini_part3); i++) {
1142 		error = zyd_rfwrite_cr(sc, rfini_part3[i]);
1143 		if (error != 0)
1144 			return (error);
1145 	}
1146 
1147 	for (i = 0; i < N(phy3); i++)
1148 		zyd_write16_m(sc, phy3[i].reg, phy3[i].val);
1149 
1150 	error = zyd_al2230_fini(rf);
1151 fail:
1152 	return (error);
1153 #undef N
1154 }
1155 
1156 static int
1157 zyd_al2230_switch_radio(struct zyd_rf *rf, int on)
1158 {
1159 	struct zyd_softc *sc = rf->rf_sc;
1160 	int error, on251 = (sc->sc_macrev == ZYD_ZD1211) ? 0x3f : 0x7f;
1161 
1162 	zyd_write16_m(sc, ZYD_CR11,  on ? 0x00 : 0x04);
1163 	zyd_write16_m(sc, ZYD_CR251, on ? on251 : 0x2f);
1164 fail:
1165 	return (error);
1166 }
1167 
1168 static int
1169 zyd_al2230_set_channel(struct zyd_rf *rf, uint8_t chan)
1170 {
1171 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1172 	int error, i;
1173 	struct zyd_softc *sc = rf->rf_sc;
1174 	static const struct zyd_phy_pair phy1[] = {
1175 		{ ZYD_CR138, 0x28 }, { ZYD_CR203, 0x06 },
1176 	};
1177 	static const struct {
1178 		uint32_t	r1, r2, r3;
1179 	} rfprog[] = ZYD_AL2230_CHANTABLE;
1180 
1181 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1182 	if (error != 0)
1183 		goto fail;
1184 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1185 	if (error != 0)
1186 		goto fail;
1187 	error = zyd_rfwrite(sc, rfprog[chan - 1].r3);
1188 	if (error != 0)
1189 		goto fail;
1190 
1191 	for (i = 0; i < N(phy1); i++)
1192 		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1193 fail:
1194 	return (error);
1195 #undef N
1196 }
1197 
1198 static int
1199 zyd_al2230_set_channel_b(struct zyd_rf *rf, uint8_t chan)
1200 {
1201 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1202 	int error, i;
1203 	struct zyd_softc *sc = rf->rf_sc;
1204 	static const struct zyd_phy_pair phy1[] = ZYD_AL2230_PHY_PART1;
1205 	static const struct {
1206 		uint32_t	r1, r2, r3;
1207 	} rfprog[] = ZYD_AL2230_CHANTABLE_B;
1208 
1209 	for (i = 0; i < N(phy1); i++)
1210 		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1211 
1212 	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r1);
1213 	if (error != 0)
1214 		goto fail;
1215 	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r2);
1216 	if (error != 0)
1217 		goto fail;
1218 	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r3);
1219 	if (error != 0)
1220 		goto fail;
1221 	error = zyd_al2230_fini(rf);
1222 fail:
1223 	return (error);
1224 #undef N
1225 }
1226 
1227 #define	ZYD_AL2230_PHY_BANDEDGE6					\
1228 {									\
1229 	{ ZYD_CR128, 0x14 }, { ZYD_CR129, 0x12 }, { ZYD_CR130, 0x10 },	\
1230 	{ ZYD_CR47,  0x1e }						\
1231 }
1232 
1233 static int
1234 zyd_al2230_bandedge6(struct zyd_rf *rf, struct ieee80211_channel *c)
1235 {
1236 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1237 	int error = 0, i;
1238 	struct zyd_softc *sc = rf->rf_sc;
1239 	struct ifnet *ifp = sc->sc_ifp;
1240 	struct ieee80211com *ic = ifp->if_l2com;
1241 	struct zyd_phy_pair r[] = ZYD_AL2230_PHY_BANDEDGE6;
1242 	int chan = ieee80211_chan2ieee(ic, c);
1243 
1244 	if (chan == 1 || chan == 11)
1245 		r[0].val = 0x12;
1246 
1247 	for (i = 0; i < N(r); i++)
1248 		zyd_write16_m(sc, r[i].reg, r[i].val);
1249 fail:
1250 	return (error);
1251 #undef N
1252 }
1253 
1254 /*
1255  * AL7230B RF methods.
1256  */
1257 static int
1258 zyd_al7230B_init(struct zyd_rf *rf)
1259 {
1260 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1261 	struct zyd_softc *sc = rf->rf_sc;
1262 	static const struct zyd_phy_pair phyini_1[] = ZYD_AL7230B_PHY_1;
1263 	static const struct zyd_phy_pair phyini_2[] = ZYD_AL7230B_PHY_2;
1264 	static const struct zyd_phy_pair phyini_3[] = ZYD_AL7230B_PHY_3;
1265 	static const uint32_t rfini_1[] = ZYD_AL7230B_RF_1;
1266 	static const uint32_t rfini_2[] = ZYD_AL7230B_RF_2;
1267 	int i, error;
1268 
1269 	/* for AL7230B, PHY and RF need to be initialized in "phases" */
1270 
1271 	/* init RF-dependent PHY registers, part one */
1272 	for (i = 0; i < N(phyini_1); i++)
1273 		zyd_write16_m(sc, phyini_1[i].reg, phyini_1[i].val);
1274 
1275 	/* init AL7230B radio, part one */
1276 	for (i = 0; i < N(rfini_1); i++) {
1277 		if ((error = zyd_rfwrite(sc, rfini_1[i])) != 0)
1278 			return (error);
1279 	}
1280 	/* init RF-dependent PHY registers, part two */
1281 	for (i = 0; i < N(phyini_2); i++)
1282 		zyd_write16_m(sc, phyini_2[i].reg, phyini_2[i].val);
1283 
1284 	/* init AL7230B radio, part two */
1285 	for (i = 0; i < N(rfini_2); i++) {
1286 		if ((error = zyd_rfwrite(sc, rfini_2[i])) != 0)
1287 			return (error);
1288 	}
1289 	/* init RF-dependent PHY registers, part three */
1290 	for (i = 0; i < N(phyini_3); i++)
1291 		zyd_write16_m(sc, phyini_3[i].reg, phyini_3[i].val);
1292 fail:
1293 	return (error);
1294 #undef N
1295 }
1296 
1297 static int
1298 zyd_al7230B_switch_radio(struct zyd_rf *rf, int on)
1299 {
1300 	int error;
1301 	struct zyd_softc *sc = rf->rf_sc;
1302 
1303 	zyd_write16_m(sc, ZYD_CR11,  on ? 0x00 : 0x04);
1304 	zyd_write16_m(sc, ZYD_CR251, on ? 0x3f : 0x2f);
1305 fail:
1306 	return (error);
1307 }
1308 
1309 static int
1310 zyd_al7230B_set_channel(struct zyd_rf *rf, uint8_t chan)
1311 {
1312 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1313 	struct zyd_softc *sc = rf->rf_sc;
1314 	static const struct {
1315 		uint32_t	r1, r2;
1316 	} rfprog[] = ZYD_AL7230B_CHANTABLE;
1317 	static const uint32_t rfsc[] = ZYD_AL7230B_RF_SETCHANNEL;
1318 	int i, error;
1319 
1320 	zyd_write16_m(sc, ZYD_CR240, 0x57);
1321 	zyd_write16_m(sc, ZYD_CR251, 0x2f);
1322 
1323 	for (i = 0; i < N(rfsc); i++) {
1324 		if ((error = zyd_rfwrite(sc, rfsc[i])) != 0)
1325 			return (error);
1326 	}
1327 
1328 	zyd_write16_m(sc, ZYD_CR128, 0x14);
1329 	zyd_write16_m(sc, ZYD_CR129, 0x12);
1330 	zyd_write16_m(sc, ZYD_CR130, 0x10);
1331 	zyd_write16_m(sc, ZYD_CR38,  0x38);
1332 	zyd_write16_m(sc, ZYD_CR136, 0xdf);
1333 
1334 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1335 	if (error != 0)
1336 		goto fail;
1337 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1338 	if (error != 0)
1339 		goto fail;
1340 	error = zyd_rfwrite(sc, 0x3c9000);
1341 	if (error != 0)
1342 		goto fail;
1343 
1344 	zyd_write16_m(sc, ZYD_CR251, 0x3f);
1345 	zyd_write16_m(sc, ZYD_CR203, 0x06);
1346 	zyd_write16_m(sc, ZYD_CR240, 0x08);
1347 fail:
1348 	return (error);
1349 #undef N
1350 }
1351 
1352 /*
1353  * AL2210 RF methods.
1354  */
1355 static int
1356 zyd_al2210_init(struct zyd_rf *rf)
1357 {
1358 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1359 	struct zyd_softc *sc = rf->rf_sc;
1360 	static const struct zyd_phy_pair phyini[] = ZYD_AL2210_PHY;
1361 	static const uint32_t rfini[] = ZYD_AL2210_RF;
1362 	uint32_t tmp;
1363 	int i, error;
1364 
1365 	zyd_write32_m(sc, ZYD_CR18, 2);
1366 
1367 	/* init RF-dependent PHY registers */
1368 	for (i = 0; i < N(phyini); i++)
1369 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1370 
1371 	/* init AL2210 radio */
1372 	for (i = 0; i < N(rfini); i++) {
1373 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1374 			return (error);
1375 	}
1376 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1377 	zyd_read32_m(sc, ZYD_CR_RADIO_PD, &tmp);
1378 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp & ~1);
1379 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp | 1);
1380 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x05);
1381 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x00);
1382 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1383 	zyd_write32_m(sc, ZYD_CR18, 3);
1384 fail:
1385 	return (error);
1386 #undef N
1387 }
1388 
1389 static int
1390 zyd_al2210_switch_radio(struct zyd_rf *rf, int on)
1391 {
1392 	/* vendor driver does nothing for this RF chip */
1393 
1394 	return (0);
1395 }
1396 
1397 static int
1398 zyd_al2210_set_channel(struct zyd_rf *rf, uint8_t chan)
1399 {
1400 	int error;
1401 	struct zyd_softc *sc = rf->rf_sc;
1402 	static const uint32_t rfprog[] = ZYD_AL2210_CHANTABLE;
1403 	uint32_t tmp;
1404 
1405 	zyd_write32_m(sc, ZYD_CR18, 2);
1406 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1407 	zyd_read32_m(sc, ZYD_CR_RADIO_PD, &tmp);
1408 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp & ~1);
1409 	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp | 1);
1410 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x05);
1411 	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x00);
1412 	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1413 
1414 	/* actually set the channel */
1415 	error = zyd_rfwrite(sc, rfprog[chan - 1]);
1416 	if (error != 0)
1417 		goto fail;
1418 
1419 	zyd_write32_m(sc, ZYD_CR18, 3);
1420 fail:
1421 	return (error);
1422 }
1423 
1424 /*
1425  * GCT RF methods.
1426  */
1427 static int
1428 zyd_gct_init(struct zyd_rf *rf)
1429 {
1430 #define	ZYD_GCT_INTR_REG	0x85c1
1431 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1432 	struct zyd_softc *sc = rf->rf_sc;
1433 	static const struct zyd_phy_pair phyini[] = ZYD_GCT_PHY;
1434 	static const uint32_t rfini[] = ZYD_GCT_RF;
1435 	static const uint16_t vco[11][7] = ZYD_GCT_VCO;
1436 	int i, idx = -1, error;
1437 	uint16_t data;
1438 
1439 	/* init RF-dependent PHY registers */
1440 	for (i = 0; i < N(phyini); i++)
1441 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1442 
1443 	/* init cgt radio */
1444 	for (i = 0; i < N(rfini); i++) {
1445 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1446 			return (error);
1447 	}
1448 
1449 	error = zyd_gct_mode(rf);
1450 	if (error != 0)
1451 		return (error);
1452 
1453 	for (i = 0; i < N(vco) - 1; i++) {
1454 		error = zyd_gct_set_channel_synth(rf, 1, 0);
1455 		if (error != 0)
1456 			goto fail;
1457 		error = zyd_gct_write(rf, vco[i][0]);
1458 		if (error != 0)
1459 			goto fail;
1460 		zyd_write16_m(sc, ZYD_GCT_INTR_REG, 0xf);
1461 		zyd_read16_m(sc, ZYD_GCT_INTR_REG, &data);
1462 		if ((data & 0xf) == 0) {
1463 			idx = i;
1464 			break;
1465 		}
1466 	}
1467 	if (idx == -1) {
1468 		error = zyd_gct_set_channel_synth(rf, 1, 1);
1469 		if (error != 0)
1470 			goto fail;
1471 		error = zyd_gct_write(rf, 0x6662);
1472 		if (error != 0)
1473 			goto fail;
1474 	}
1475 
1476 	rf->idx = idx;
1477 	zyd_write16_m(sc, ZYD_CR203, 0x6);
1478 fail:
1479 	return (error);
1480 #undef N
1481 #undef ZYD_GCT_INTR_REG
1482 }
1483 
1484 static int
1485 zyd_gct_mode(struct zyd_rf *rf)
1486 {
1487 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1488 	struct zyd_softc *sc = rf->rf_sc;
1489 	static const uint32_t mode[] = {
1490 		0x25f98, 0x25f9a, 0x25f94, 0x27fd4
1491 	};
1492 	int i, error;
1493 
1494 	for (i = 0; i < N(mode); i++) {
1495 		if ((error = zyd_rfwrite(sc, mode[i])) != 0)
1496 			break;
1497 	}
1498 	return (error);
1499 #undef N
1500 }
1501 
1502 static int
1503 zyd_gct_set_channel_synth(struct zyd_rf *rf, int chan, int acal)
1504 {
1505 	int error, idx = chan - 1;
1506 	struct zyd_softc *sc = rf->rf_sc;
1507 	static uint32_t acal_synth[] = ZYD_GCT_CHANNEL_ACAL;
1508 	static uint32_t std_synth[] = ZYD_GCT_CHANNEL_STD;
1509 	static uint32_t div_synth[] = ZYD_GCT_CHANNEL_DIV;
1510 
1511 	error = zyd_rfwrite(sc,
1512 	    (acal == 1) ? acal_synth[idx] : std_synth[idx]);
1513 	if (error != 0)
1514 		return (error);
1515 	return zyd_rfwrite(sc, div_synth[idx]);
1516 }
1517 
1518 static int
1519 zyd_gct_write(struct zyd_rf *rf, uint16_t value)
1520 {
1521 	struct zyd_softc *sc = rf->rf_sc;
1522 
1523 	return zyd_rfwrite(sc, 0x300000 | 0x40000 | value);
1524 }
1525 
1526 static int
1527 zyd_gct_switch_radio(struct zyd_rf *rf, int on)
1528 {
1529 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1530 	int error;
1531 	struct zyd_softc *sc = rf->rf_sc;
1532 
1533 	error = zyd_rfwrite(sc, on ? 0x25f94 : 0x25f90);
1534 	if (error != 0)
1535 		return (error);
1536 
1537 	zyd_write16_m(sc, ZYD_CR11, on ? 0x00 : 0x04);
1538 	zyd_write16_m(sc, ZYD_CR251,
1539 	    on ? ((sc->sc_macrev == ZYD_ZD1211B) ? 0x7f : 0x3f) : 0x2f);
1540 fail:
1541 	return (error);
1542 }
1543 
1544 static int
1545 zyd_gct_set_channel(struct zyd_rf *rf, uint8_t chan)
1546 {
1547 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1548 	int error, i;
1549 	struct zyd_softc *sc = rf->rf_sc;
1550 	static const struct zyd_phy_pair cmd[] = {
1551 		{ ZYD_CR80, 0x30 }, { ZYD_CR81, 0x30 }, { ZYD_CR79, 0x58 },
1552 		{ ZYD_CR12, 0xf0 }, { ZYD_CR77, 0x1b }, { ZYD_CR78, 0x58 },
1553 	};
1554 	static const uint16_t vco[11][7] = ZYD_GCT_VCO;
1555 
1556 	error = zyd_gct_set_channel_synth(rf, chan, 0);
1557 	if (error != 0)
1558 		goto fail;
1559 	error = zyd_gct_write(rf, (rf->idx == -1) ? 0x6662 :
1560 	    vco[rf->idx][((chan - 1) / 2)]);
1561 	if (error != 0)
1562 		goto fail;
1563 	error = zyd_gct_mode(rf);
1564 	if (error != 0)
1565 		return (error);
1566 	for (i = 0; i < N(cmd); i++)
1567 		zyd_write16_m(sc, cmd[i].reg, cmd[i].val);
1568 	error = zyd_gct_txgain(rf, chan);
1569 	if (error != 0)
1570 		return (error);
1571 	zyd_write16_m(sc, ZYD_CR203, 0x6);
1572 fail:
1573 	return (error);
1574 #undef N
1575 }
1576 
1577 static int
1578 zyd_gct_txgain(struct zyd_rf *rf, uint8_t chan)
1579 {
1580 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1581 	struct zyd_softc *sc = rf->rf_sc;
1582 	static uint32_t txgain[] = ZYD_GCT_TXGAIN;
1583 	uint8_t idx = sc->sc_pwrint[chan - 1];
1584 
1585 	if (idx >= N(txgain)) {
1586 		device_printf(sc->sc_dev, "could not set TX gain (%d %#x)\n",
1587 		    chan, idx);
1588 		return 0;
1589 	}
1590 
1591 	return zyd_rfwrite(sc, 0x700000 | txgain[idx]);
1592 #undef N
1593 }
1594 
1595 /*
1596  * Maxim2 RF methods.
1597  */
1598 static int
1599 zyd_maxim2_init(struct zyd_rf *rf)
1600 {
1601 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1602 	struct zyd_softc *sc = rf->rf_sc;
1603 	static const struct zyd_phy_pair phyini[] = ZYD_MAXIM2_PHY;
1604 	static const uint32_t rfini[] = ZYD_MAXIM2_RF;
1605 	uint16_t tmp;
1606 	int i, error;
1607 
1608 	/* init RF-dependent PHY registers */
1609 	for (i = 0; i < N(phyini); i++)
1610 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1611 
1612 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1613 	zyd_write16_m(sc, ZYD_CR203, tmp & ~(1 << 4));
1614 
1615 	/* init maxim2 radio */
1616 	for (i = 0; i < N(rfini); i++) {
1617 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1618 			return (error);
1619 	}
1620 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1621 	zyd_write16_m(sc, ZYD_CR203, tmp | (1 << 4));
1622 fail:
1623 	return (error);
1624 #undef N
1625 }
1626 
1627 static int
1628 zyd_maxim2_switch_radio(struct zyd_rf *rf, int on)
1629 {
1630 
1631 	/* vendor driver does nothing for this RF chip */
1632 	return (0);
1633 }
1634 
1635 static int
1636 zyd_maxim2_set_channel(struct zyd_rf *rf, uint8_t chan)
1637 {
1638 #define N(a)	(sizeof(a) / sizeof((a)[0]))
1639 	struct zyd_softc *sc = rf->rf_sc;
1640 	static const struct zyd_phy_pair phyini[] = ZYD_MAXIM2_PHY;
1641 	static const uint32_t rfini[] = ZYD_MAXIM2_RF;
1642 	static const struct {
1643 		uint32_t	r1, r2;
1644 	} rfprog[] = ZYD_MAXIM2_CHANTABLE;
1645 	uint16_t tmp;
1646 	int i, error;
1647 
1648 	/*
1649 	 * Do the same as we do when initializing it, except for the channel
1650 	 * values coming from the two channel tables.
1651 	 */
1652 
1653 	/* init RF-dependent PHY registers */
1654 	for (i = 0; i < N(phyini); i++)
1655 		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1656 
1657 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1658 	zyd_write16_m(sc, ZYD_CR203, tmp & ~(1 << 4));
1659 
1660 	/* first two values taken from the chantables */
1661 	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1662 	if (error != 0)
1663 		goto fail;
1664 	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1665 	if (error != 0)
1666 		goto fail;
1667 
1668 	/* init maxim2 radio - skipping the two first values */
1669 	for (i = 2; i < N(rfini); i++) {
1670 		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1671 			return (error);
1672 	}
1673 	zyd_read16_m(sc, ZYD_CR203, &tmp);
1674 	zyd_write16_m(sc, ZYD_CR203, tmp | (1 << 4));
1675 fail:
1676 	return (error);
1677 #undef N
1678 }
1679 
1680 static int
1681 zyd_rf_attach(struct zyd_softc *sc, uint8_t type)
1682 {
1683 	struct zyd_rf *rf = &sc->sc_rf;
1684 
1685 	rf->rf_sc = sc;
1686 	rf->update_pwr = 1;
1687 
1688 	switch (type) {
1689 	case ZYD_RF_RFMD:
1690 		rf->init         = zyd_rfmd_init;
1691 		rf->switch_radio = zyd_rfmd_switch_radio;
1692 		rf->set_channel  = zyd_rfmd_set_channel;
1693 		rf->width        = 24;	/* 24-bit RF values */
1694 		break;
1695 	case ZYD_RF_AL2230:
1696 	case ZYD_RF_AL2230S:
1697 		if (sc->sc_macrev == ZYD_ZD1211B) {
1698 			rf->init = zyd_al2230_init_b;
1699 			rf->set_channel = zyd_al2230_set_channel_b;
1700 		} else {
1701 			rf->init = zyd_al2230_init;
1702 			rf->set_channel = zyd_al2230_set_channel;
1703 		}
1704 		rf->switch_radio = zyd_al2230_switch_radio;
1705 		rf->bandedge6	 = zyd_al2230_bandedge6;
1706 		rf->width        = 24;	/* 24-bit RF values */
1707 		break;
1708 	case ZYD_RF_AL7230B:
1709 		rf->init         = zyd_al7230B_init;
1710 		rf->switch_radio = zyd_al7230B_switch_radio;
1711 		rf->set_channel  = zyd_al7230B_set_channel;
1712 		rf->width        = 24;	/* 24-bit RF values */
1713 		break;
1714 	case ZYD_RF_AL2210:
1715 		rf->init         = zyd_al2210_init;
1716 		rf->switch_radio = zyd_al2210_switch_radio;
1717 		rf->set_channel  = zyd_al2210_set_channel;
1718 		rf->width        = 24;	/* 24-bit RF values */
1719 		break;
1720 	case ZYD_RF_MAXIM_NEW:
1721 	case ZYD_RF_GCT:
1722 		rf->init         = zyd_gct_init;
1723 		rf->switch_radio = zyd_gct_switch_radio;
1724 		rf->set_channel  = zyd_gct_set_channel;
1725 		rf->width        = 24;	/* 24-bit RF values */
1726 		rf->update_pwr   = 0;
1727 		break;
1728 	case ZYD_RF_MAXIM_NEW2:
1729 		rf->init         = zyd_maxim2_init;
1730 		rf->switch_radio = zyd_maxim2_switch_radio;
1731 		rf->set_channel  = zyd_maxim2_set_channel;
1732 		rf->width        = 18;	/* 18-bit RF values */
1733 		break;
1734 	default:
1735 		device_printf(sc->sc_dev,
1736 		    "sorry, radio \"%s\" is not supported yet\n",
1737 		    zyd_rf_name(type));
1738 		return (EINVAL);
1739 	}
1740 	return (0);
1741 }
1742 
1743 static const char *
1744 zyd_rf_name(uint8_t type)
1745 {
1746 	static const char * const zyd_rfs[] = {
1747 		"unknown", "unknown", "UW2451",   "UCHIP",     "AL2230",
1748 		"AL7230B", "THETA",   "AL2210",   "MAXIM_NEW", "GCT",
1749 		"AL2230S",  "RALINK",  "INTERSIL", "RFMD",      "MAXIM_NEW2",
1750 		"PHILIPS"
1751 	};
1752 
1753 	return zyd_rfs[(type > 15) ? 0 : type];
1754 }
1755 
1756 static int
1757 zyd_hw_init(struct zyd_softc *sc)
1758 {
1759 	int error;
1760 	const struct zyd_phy_pair *phyp;
1761 	struct zyd_rf *rf = &sc->sc_rf;
1762 	uint16_t val;
1763 
1764 	/* specify that the plug and play is finished */
1765 	zyd_write32_m(sc, ZYD_MAC_AFTER_PNP, 1);
1766 	zyd_read16_m(sc, ZYD_FIRMWARE_BASE_ADDR, &sc->sc_fwbase);
1767 	DPRINTF(sc, ZYD_DEBUG_FW, "firmware base address=0x%04x\n",
1768 	    sc->sc_fwbase);
1769 
1770 	/* retrieve firmware revision number */
1771 	zyd_read16_m(sc, sc->sc_fwbase + ZYD_FW_FIRMWARE_REV, &sc->sc_fwrev);
1772 	zyd_write32_m(sc, ZYD_CR_GPI_EN, 0);
1773 	zyd_write32_m(sc, ZYD_MAC_CONT_WIN_LIMIT, 0x7f043f);
1774 	/* set mandatory rates - XXX assumes 802.11b/g */
1775 	zyd_write32_m(sc, ZYD_MAC_MAN_RATE, 0x150f);
1776 
1777 	/* disable interrupts */
1778 	zyd_write32_m(sc, ZYD_CR_INTERRUPT, 0);
1779 
1780 	if ((error = zyd_read_pod(sc)) != 0) {
1781 		device_printf(sc->sc_dev, "could not read EEPROM\n");
1782 		goto fail;
1783 	}
1784 
1785 	/* PHY init (resetting) */
1786 	error = zyd_lock_phy(sc);
1787 	if (error != 0)
1788 		goto fail;
1789 	phyp = (sc->sc_macrev == ZYD_ZD1211B) ? zyd_def_phyB : zyd_def_phy;
1790 	for (; phyp->reg != 0; phyp++)
1791 		zyd_write16_m(sc, phyp->reg, phyp->val);
1792 	if (sc->sc_macrev == ZYD_ZD1211 && sc->sc_fix_cr157 != 0) {
1793 		zyd_read16_m(sc, ZYD_EEPROM_PHY_REG, &val);
1794 		zyd_write32_m(sc, ZYD_CR157, val >> 8);
1795 	}
1796 	error = zyd_unlock_phy(sc);
1797 	if (error != 0)
1798 		goto fail;
1799 
1800 	/* HMAC init */
1801 	zyd_write32_m(sc, ZYD_MAC_ACK_EXT, 0x00000020);
1802 	zyd_write32_m(sc, ZYD_CR_ADDA_MBIAS_WT, 0x30000808);
1803 	zyd_write32_m(sc, ZYD_MAC_SNIFFER, 0x00000000);
1804 	zyd_write32_m(sc, ZYD_MAC_RXFILTER, 0x00000000);
1805 	zyd_write32_m(sc, ZYD_MAC_GHTBL, 0x00000000);
1806 	zyd_write32_m(sc, ZYD_MAC_GHTBH, 0x80000000);
1807 	zyd_write32_m(sc, ZYD_MAC_MISC, 0x000000a4);
1808 	zyd_write32_m(sc, ZYD_CR_ADDA_PWR_DWN, 0x0000007f);
1809 	zyd_write32_m(sc, ZYD_MAC_BCNCFG, 0x00f00401);
1810 	zyd_write32_m(sc, ZYD_MAC_PHY_DELAY2, 0x00000000);
1811 	zyd_write32_m(sc, ZYD_MAC_ACK_EXT, 0x00000080);
1812 	zyd_write32_m(sc, ZYD_CR_ADDA_PWR_DWN, 0x00000000);
1813 	zyd_write32_m(sc, ZYD_MAC_SIFS_ACK_TIME, 0x00000100);
1814 	zyd_write32_m(sc, ZYD_CR_RX_PE_DELAY, 0x00000070);
1815 	zyd_write32_m(sc, ZYD_CR_PS_CTRL, 0x10000000);
1816 	zyd_write32_m(sc, ZYD_MAC_RTSCTSRATE, 0x02030203);
1817 	zyd_write32_m(sc, ZYD_MAC_AFTER_PNP, 1);
1818 	zyd_write32_m(sc, ZYD_MAC_BACKOFF_PROTECT, 0x00000114);
1819 	zyd_write32_m(sc, ZYD_MAC_DIFS_EIFS_SIFS, 0x0a47c032);
1820 	zyd_write32_m(sc, ZYD_MAC_CAM_MODE, 0x3);
1821 
1822 	if (sc->sc_macrev == ZYD_ZD1211) {
1823 		zyd_write32_m(sc, ZYD_MAC_RETRY, 0x00000002);
1824 		zyd_write32_m(sc, ZYD_MAC_RX_THRESHOLD, 0x000c0640);
1825 	} else {
1826 		zyd_write32_m(sc, ZYD_MACB_MAX_RETRY, 0x02020202);
1827 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL4, 0x007f003f);
1828 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL3, 0x007f003f);
1829 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL2, 0x003f001f);
1830 		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL1, 0x001f000f);
1831 		zyd_write32_m(sc, ZYD_MACB_AIFS_CTL1, 0x00280028);
1832 		zyd_write32_m(sc, ZYD_MACB_AIFS_CTL2, 0x008C003C);
1833 		zyd_write32_m(sc, ZYD_MACB_TXOP, 0x01800824);
1834 		zyd_write32_m(sc, ZYD_MAC_RX_THRESHOLD, 0x000c0eff);
1835 	}
1836 
1837 	/* init beacon interval to 100ms */
1838 	if ((error = zyd_set_beacon_interval(sc, 100)) != 0)
1839 		goto fail;
1840 
1841 	if ((error = zyd_rf_attach(sc, sc->sc_rfrev)) != 0) {
1842 		device_printf(sc->sc_dev, "could not attach RF, rev 0x%x\n",
1843 		    sc->sc_rfrev);
1844 		goto fail;
1845 	}
1846 
1847 	/* RF chip init */
1848 	error = zyd_lock_phy(sc);
1849 	if (error != 0)
1850 		goto fail;
1851 	error = (*rf->init)(rf);
1852 	if (error != 0) {
1853 		device_printf(sc->sc_dev,
1854 		    "radio initialization failed, error %d\n", error);
1855 		goto fail;
1856 	}
1857 	error = zyd_unlock_phy(sc);
1858 	if (error != 0)
1859 		goto fail;
1860 
1861 	if ((error = zyd_read_eeprom(sc)) != 0) {
1862 		device_printf(sc->sc_dev, "could not read EEPROM\n");
1863 		goto fail;
1864 	}
1865 
1866 fail:	return (error);
1867 }
1868 
1869 static int
1870 zyd_read_pod(struct zyd_softc *sc)
1871 {
1872 	int error;
1873 	uint32_t tmp;
1874 
1875 	zyd_read32_m(sc, ZYD_EEPROM_POD, &tmp);
1876 	sc->sc_rfrev     = tmp & 0x0f;
1877 	sc->sc_ledtype   = (tmp >>  4) & 0x01;
1878 	sc->sc_al2230s   = (tmp >>  7) & 0x01;
1879 	sc->sc_cckgain   = (tmp >>  8) & 0x01;
1880 	sc->sc_fix_cr157 = (tmp >> 13) & 0x01;
1881 	sc->sc_parev     = (tmp >> 16) & 0x0f;
1882 	sc->sc_bandedge6 = (tmp >> 21) & 0x01;
1883 	sc->sc_newphy    = (tmp >> 31) & 0x01;
1884 	sc->sc_txled     = ((tmp & (1 << 24)) && (tmp & (1 << 29))) ? 0 : 1;
1885 fail:
1886 	return (error);
1887 }
1888 
1889 static int
1890 zyd_read_eeprom(struct zyd_softc *sc)
1891 {
1892 	uint16_t val;
1893 	int error, i;
1894 
1895 	/* read Tx power calibration tables */
1896 	for (i = 0; i < 7; i++) {
1897 		zyd_read16_m(sc, ZYD_EEPROM_PWR_CAL + i, &val);
1898 		sc->sc_pwrcal[i * 2] = val >> 8;
1899 		sc->sc_pwrcal[i * 2 + 1] = val & 0xff;
1900 		zyd_read16_m(sc, ZYD_EEPROM_PWR_INT + i, &val);
1901 		sc->sc_pwrint[i * 2] = val >> 8;
1902 		sc->sc_pwrint[i * 2 + 1] = val & 0xff;
1903 		zyd_read16_m(sc, ZYD_EEPROM_36M_CAL + i, &val);
1904 		sc->sc_ofdm36_cal[i * 2] = val >> 8;
1905 		sc->sc_ofdm36_cal[i * 2 + 1] = val & 0xff;
1906 		zyd_read16_m(sc, ZYD_EEPROM_48M_CAL + i, &val);
1907 		sc->sc_ofdm48_cal[i * 2] = val >> 8;
1908 		sc->sc_ofdm48_cal[i * 2 + 1] = val & 0xff;
1909 		zyd_read16_m(sc, ZYD_EEPROM_54M_CAL + i, &val);
1910 		sc->sc_ofdm54_cal[i * 2] = val >> 8;
1911 		sc->sc_ofdm54_cal[i * 2 + 1] = val & 0xff;
1912 	}
1913 fail:
1914 	return (error);
1915 }
1916 
1917 static int
1918 zyd_get_macaddr(struct zyd_softc *sc)
1919 {
1920 	struct usb_device_request req;
1921 	usb_error_t error;
1922 
1923 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1924 	req.bRequest = ZYD_READFWDATAREQ;
1925 	USETW(req.wValue, ZYD_EEPROM_MAC_ADDR_P1);
1926 	USETW(req.wIndex, 0);
1927 	USETW(req.wLength, IEEE80211_ADDR_LEN);
1928 
1929 	error = zyd_do_request(sc, &req, sc->sc_bssid);
1930 	if (error != 0) {
1931 		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1932 		    usbd_errstr(error));
1933 	}
1934 
1935 	return (error);
1936 }
1937 
1938 static int
1939 zyd_set_macaddr(struct zyd_softc *sc, const uint8_t *addr)
1940 {
1941 	int error;
1942 	uint32_t tmp;
1943 
1944 	tmp = addr[3] << 24 | addr[2] << 16 | addr[1] << 8 | addr[0];
1945 	zyd_write32_m(sc, ZYD_MAC_MACADRL, tmp);
1946 	tmp = addr[5] << 8 | addr[4];
1947 	zyd_write32_m(sc, ZYD_MAC_MACADRH, tmp);
1948 fail:
1949 	return (error);
1950 }
1951 
1952 static int
1953 zyd_set_bssid(struct zyd_softc *sc, const uint8_t *addr)
1954 {
1955 	int error;
1956 	uint32_t tmp;
1957 
1958 	tmp = addr[3] << 24 | addr[2] << 16 | addr[1] << 8 | addr[0];
1959 	zyd_write32_m(sc, ZYD_MAC_BSSADRL, tmp);
1960 	tmp = addr[5] << 8 | addr[4];
1961 	zyd_write32_m(sc, ZYD_MAC_BSSADRH, tmp);
1962 fail:
1963 	return (error);
1964 }
1965 
1966 static int
1967 zyd_switch_radio(struct zyd_softc *sc, int on)
1968 {
1969 	struct zyd_rf *rf = &sc->sc_rf;
1970 	int error;
1971 
1972 	error = zyd_lock_phy(sc);
1973 	if (error != 0)
1974 		goto fail;
1975 	error = (*rf->switch_radio)(rf, on);
1976 	if (error != 0)
1977 		goto fail;
1978 	error = zyd_unlock_phy(sc);
1979 fail:
1980 	return (error);
1981 }
1982 
1983 static int
1984 zyd_set_led(struct zyd_softc *sc, int which, int on)
1985 {
1986 	int error;
1987 	uint32_t tmp;
1988 
1989 	zyd_read32_m(sc, ZYD_MAC_TX_PE_CONTROL, &tmp);
1990 	tmp &= ~which;
1991 	if (on)
1992 		tmp |= which;
1993 	zyd_write32_m(sc, ZYD_MAC_TX_PE_CONTROL, tmp);
1994 fail:
1995 	return (error);
1996 }
1997 
1998 static void
1999 zyd_set_multi(struct zyd_softc *sc)
2000 {
2001 	int error;
2002 	struct ifnet *ifp = sc->sc_ifp;
2003 	struct ieee80211com *ic = ifp->if_l2com;
2004 	struct ifmultiaddr *ifma;
2005 	uint32_t low, high;
2006 	uint8_t v;
2007 
2008 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2009 		return;
2010 
2011 	low = 0x00000000;
2012 	high = 0x80000000;
2013 
2014 	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2015 	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2016 		low = 0xffffffff;
2017 		high = 0xffffffff;
2018 	} else {
2019 		if_maddr_rlock(ifp);
2020 		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2021 			if (ifma->ifma_addr->sa_family != AF_LINK)
2022 				continue;
2023 			v = ((uint8_t *)LLADDR((struct sockaddr_dl *)
2024 			    ifma->ifma_addr))[5] >> 2;
2025 			if (v < 32)
2026 				low |= 1 << v;
2027 			else
2028 				high |= 1 << (v - 32);
2029 		}
2030 		if_maddr_runlock(ifp);
2031 	}
2032 
2033 	/* reprogram multicast global hash table */
2034 	zyd_write32_m(sc, ZYD_MAC_GHTBL, low);
2035 	zyd_write32_m(sc, ZYD_MAC_GHTBH, high);
2036 fail:
2037 	if (error != 0)
2038 		device_printf(sc->sc_dev,
2039 		    "could not set multicast hash table\n");
2040 }
2041 
2042 static void
2043 zyd_update_mcast(struct ifnet *ifp)
2044 {
2045 	struct zyd_softc *sc = ifp->if_softc;
2046 
2047 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2048 		return;
2049 
2050 	ZYD_LOCK(sc);
2051 	zyd_set_multi(sc);
2052 	ZYD_UNLOCK(sc);
2053 }
2054 
2055 static int
2056 zyd_set_rxfilter(struct zyd_softc *sc)
2057 {
2058 	struct ifnet *ifp = sc->sc_ifp;
2059 	struct ieee80211com *ic = ifp->if_l2com;
2060 	uint32_t rxfilter;
2061 
2062 	switch (ic->ic_opmode) {
2063 	case IEEE80211_M_STA:
2064 		rxfilter = ZYD_FILTER_BSS;
2065 		break;
2066 	case IEEE80211_M_IBSS:
2067 	case IEEE80211_M_HOSTAP:
2068 		rxfilter = ZYD_FILTER_HOSTAP;
2069 		break;
2070 	case IEEE80211_M_MONITOR:
2071 		rxfilter = ZYD_FILTER_MONITOR;
2072 		break;
2073 	default:
2074 		/* should not get there */
2075 		return (EINVAL);
2076 	}
2077 	return zyd_write32(sc, ZYD_MAC_RXFILTER, rxfilter);
2078 }
2079 
2080 static void
2081 zyd_set_chan(struct zyd_softc *sc, struct ieee80211_channel *c)
2082 {
2083 	int error;
2084 	struct ifnet *ifp = sc->sc_ifp;
2085 	struct ieee80211com *ic = ifp->if_l2com;
2086 	struct zyd_rf *rf = &sc->sc_rf;
2087 	uint32_t tmp;
2088 	int chan;
2089 
2090 	chan = ieee80211_chan2ieee(ic, c);
2091 	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2092 		/* XXX should NEVER happen */
2093 		device_printf(sc->sc_dev,
2094 		    "%s: invalid channel %x\n", __func__, chan);
2095 		return;
2096 	}
2097 
2098 	error = zyd_lock_phy(sc);
2099 	if (error != 0)
2100 		goto fail;
2101 
2102 	error = (*rf->set_channel)(rf, chan);
2103 	if (error != 0)
2104 		goto fail;
2105 
2106 	if (rf->update_pwr) {
2107 		/* update Tx power */
2108 		zyd_write16_m(sc, ZYD_CR31, sc->sc_pwrint[chan - 1]);
2109 
2110 		if (sc->sc_macrev == ZYD_ZD1211B) {
2111 			zyd_write16_m(sc, ZYD_CR67,
2112 			    sc->sc_ofdm36_cal[chan - 1]);
2113 			zyd_write16_m(sc, ZYD_CR66,
2114 			    sc->sc_ofdm48_cal[chan - 1]);
2115 			zyd_write16_m(sc, ZYD_CR65,
2116 			    sc->sc_ofdm54_cal[chan - 1]);
2117 			zyd_write16_m(sc, ZYD_CR68, sc->sc_pwrcal[chan - 1]);
2118 			zyd_write16_m(sc, ZYD_CR69, 0x28);
2119 			zyd_write16_m(sc, ZYD_CR69, 0x2a);
2120 		}
2121 	}
2122 	if (sc->sc_cckgain) {
2123 		/* set CCK baseband gain from EEPROM */
2124 		if (zyd_read32(sc, ZYD_EEPROM_PHY_REG, &tmp) == 0)
2125 			zyd_write16_m(sc, ZYD_CR47, tmp & 0xff);
2126 	}
2127 	if (sc->sc_bandedge6 && rf->bandedge6 != NULL) {
2128 		error = (*rf->bandedge6)(rf, c);
2129 		if (error != 0)
2130 			goto fail;
2131 	}
2132 	zyd_write32_m(sc, ZYD_CR_CONFIG_PHILIPS, 0);
2133 
2134 	error = zyd_unlock_phy(sc);
2135 	if (error != 0)
2136 		goto fail;
2137 
2138 	sc->sc_rxtap.wr_chan_freq = sc->sc_txtap.wt_chan_freq =
2139 	    htole16(c->ic_freq);
2140 	sc->sc_rxtap.wr_chan_flags = sc->sc_txtap.wt_chan_flags =
2141 	    htole16(c->ic_flags);
2142 fail:
2143 	return;
2144 }
2145 
2146 static int
2147 zyd_set_beacon_interval(struct zyd_softc *sc, int bintval)
2148 {
2149 	int error;
2150 	uint32_t val;
2151 
2152 	zyd_read32_m(sc, ZYD_CR_ATIM_WND_PERIOD, &val);
2153 	sc->sc_atim_wnd = val;
2154 	zyd_read32_m(sc, ZYD_CR_PRE_TBTT, &val);
2155 	sc->sc_pre_tbtt = val;
2156 	sc->sc_bcn_int = bintval;
2157 
2158 	if (sc->sc_bcn_int <= 5)
2159 		sc->sc_bcn_int = 5;
2160 	if (sc->sc_pre_tbtt < 4 || sc->sc_pre_tbtt >= sc->sc_bcn_int)
2161 		sc->sc_pre_tbtt = sc->sc_bcn_int - 1;
2162 	if (sc->sc_atim_wnd >= sc->sc_pre_tbtt)
2163 		sc->sc_atim_wnd = sc->sc_pre_tbtt - 1;
2164 
2165 	zyd_write32_m(sc, ZYD_CR_ATIM_WND_PERIOD, sc->sc_atim_wnd);
2166 	zyd_write32_m(sc, ZYD_CR_PRE_TBTT, sc->sc_pre_tbtt);
2167 	zyd_write32_m(sc, ZYD_CR_BCN_INTERVAL, sc->sc_bcn_int);
2168 fail:
2169 	return (error);
2170 }
2171 
2172 static void
2173 zyd_rx_data(struct usb_xfer *xfer, int offset, uint16_t len)
2174 {
2175 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2176 	struct ifnet *ifp = sc->sc_ifp;
2177 	struct ieee80211com *ic = ifp->if_l2com;
2178 	struct zyd_plcphdr plcp;
2179 	struct zyd_rx_stat stat;
2180 	struct usb_page_cache *pc;
2181 	struct mbuf *m;
2182 	int rlen, rssi;
2183 
2184 	if (len < ZYD_MIN_FRAGSZ) {
2185 		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: frame too short (length=%d)\n",
2186 		    device_get_nameunit(sc->sc_dev), len);
2187 		ifp->if_ierrors++;
2188 		return;
2189 	}
2190 	pc = usbd_xfer_get_frame(xfer, 0);
2191 	usbd_copy_out(pc, offset, &plcp, sizeof(plcp));
2192 	usbd_copy_out(pc, offset + len - sizeof(stat), &stat, sizeof(stat));
2193 
2194 	if (stat.flags & ZYD_RX_ERROR) {
2195 		DPRINTF(sc, ZYD_DEBUG_RECV,
2196 		    "%s: RX status indicated error (%x)\n",
2197 		    device_get_nameunit(sc->sc_dev), stat.flags);
2198 		ifp->if_ierrors++;
2199 		return;
2200 	}
2201 
2202 	/* compute actual frame length */
2203 	rlen = len - sizeof(struct zyd_plcphdr) -
2204 	    sizeof(struct zyd_rx_stat) - IEEE80211_CRC_LEN;
2205 
2206 	/* allocate a mbuf to store the frame */
2207 	if (rlen > MCLBYTES) {
2208 		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: frame too long (length=%d)\n",
2209 		    device_get_nameunit(sc->sc_dev), rlen);
2210 		ifp->if_ierrors++;
2211 		return;
2212 	} else if (rlen > MHLEN)
2213 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
2214 	else
2215 		m = m_gethdr(M_DONTWAIT, MT_DATA);
2216 	if (m == NULL) {
2217 		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: could not allocate rx mbuf\n",
2218 		    device_get_nameunit(sc->sc_dev));
2219 		ifp->if_ierrors++;
2220 		return;
2221 	}
2222 	m->m_pkthdr.rcvif = ifp;
2223 	m->m_pkthdr.len = m->m_len = rlen;
2224 	usbd_copy_out(pc, offset + sizeof(plcp), mtod(m, uint8_t *), rlen);
2225 
2226 	if (ieee80211_radiotap_active(ic)) {
2227 		struct zyd_rx_radiotap_header *tap = &sc->sc_rxtap;
2228 
2229 		tap->wr_flags = 0;
2230 		if (stat.flags & (ZYD_RX_BADCRC16 | ZYD_RX_BADCRC32))
2231 			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2232 		/* XXX toss, no way to express errors */
2233 		if (stat.flags & ZYD_RX_DECRYPTERR)
2234 			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2235 		tap->wr_rate = ieee80211_plcp2rate(plcp.signal,
2236 		    (stat.flags & ZYD_RX_OFDM) ?
2237 			IEEE80211_T_OFDM : IEEE80211_T_CCK);
2238 		tap->wr_antsignal = stat.rssi + -95;
2239 		tap->wr_antnoise = -95;	/* XXX */
2240 	}
2241 	rssi = (stat.rssi > 63) ? 127 : 2 * stat.rssi;
2242 
2243 	sc->sc_rx_data[sc->sc_rx_count].rssi = rssi;
2244 	sc->sc_rx_data[sc->sc_rx_count].m = m;
2245 	sc->sc_rx_count++;
2246 }
2247 
2248 static void
2249 zyd_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
2250 {
2251 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2252 	struct ifnet *ifp = sc->sc_ifp;
2253 	struct ieee80211com *ic = ifp->if_l2com;
2254 	struct ieee80211_node *ni;
2255 	struct zyd_rx_desc desc;
2256 	struct mbuf *m;
2257 	struct usb_page_cache *pc;
2258 	uint32_t offset;
2259 	uint8_t rssi;
2260 	int8_t nf;
2261 	int i;
2262 	int actlen;
2263 
2264 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2265 
2266 	sc->sc_rx_count = 0;
2267 	switch (USB_GET_STATE(xfer)) {
2268 	case USB_ST_TRANSFERRED:
2269 		pc = usbd_xfer_get_frame(xfer, 0);
2270 		usbd_copy_out(pc, actlen - sizeof(desc), &desc, sizeof(desc));
2271 
2272 		offset = 0;
2273 		if (UGETW(desc.tag) == ZYD_TAG_MULTIFRAME) {
2274 			DPRINTF(sc, ZYD_DEBUG_RECV,
2275 			    "%s: received multi-frame transfer\n", __func__);
2276 
2277 			for (i = 0; i < ZYD_MAX_RXFRAMECNT; i++) {
2278 				uint16_t len16 = UGETW(desc.len[i]);
2279 
2280 				if (len16 == 0 || len16 > actlen)
2281 					break;
2282 
2283 				zyd_rx_data(xfer, offset, len16);
2284 
2285 				/* next frame is aligned on a 32-bit boundary */
2286 				len16 = (len16 + 3) & ~3;
2287 				offset += len16;
2288 				if (len16 > actlen)
2289 					break;
2290 				actlen -= len16;
2291 			}
2292 		} else {
2293 			DPRINTF(sc, ZYD_DEBUG_RECV,
2294 			    "%s: received single-frame transfer\n", __func__);
2295 
2296 			zyd_rx_data(xfer, 0, actlen);
2297 		}
2298 		/* FALLTHROUGH */
2299 	case USB_ST_SETUP:
2300 tr_setup:
2301 		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2302 		usbd_transfer_submit(xfer);
2303 
2304 		/*
2305 		 * At the end of a USB callback it is always safe to unlock
2306 		 * the private mutex of a device! That is why we do the
2307 		 * "ieee80211_input" here, and not some lines up!
2308 		 */
2309 		ZYD_UNLOCK(sc);
2310 		for (i = 0; i < sc->sc_rx_count; i++) {
2311 			rssi = sc->sc_rx_data[i].rssi;
2312 			m = sc->sc_rx_data[i].m;
2313 			sc->sc_rx_data[i].m = NULL;
2314 
2315 			nf = -95;	/* XXX */
2316 
2317 			ni = ieee80211_find_rxnode(ic,
2318 			    mtod(m, struct ieee80211_frame_min *));
2319 			if (ni != NULL) {
2320 				(void)ieee80211_input(ni, m, rssi, nf);
2321 				ieee80211_free_node(ni);
2322 			} else
2323 				(void)ieee80211_input_all(ic, m, rssi, nf);
2324 		}
2325 		ZYD_LOCK(sc);
2326 		break;
2327 
2328 	default:			/* Error */
2329 		DPRINTF(sc, ZYD_DEBUG_ANY, "frame error: %s\n", usbd_errstr(error));
2330 
2331 		if (error != USB_ERR_CANCELLED) {
2332 			/* try to clear stall first */
2333 			usbd_xfer_set_stall(xfer);
2334 			goto tr_setup;
2335 		}
2336 		break;
2337 	}
2338 }
2339 
2340 static uint8_t
2341 zyd_plcp_signal(struct zyd_softc *sc, int rate)
2342 {
2343 	switch (rate) {
2344 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
2345 	case 12:
2346 		return (0xb);
2347 	case 18:
2348 		return (0xf);
2349 	case 24:
2350 		return (0xa);
2351 	case 36:
2352 		return (0xe);
2353 	case 48:
2354 		return (0x9);
2355 	case 72:
2356 		return (0xd);
2357 	case 96:
2358 		return (0x8);
2359 	case 108:
2360 		return (0xc);
2361 	/* CCK rates (NB: not IEEE std, device-specific) */
2362 	case 2:
2363 		return (0x0);
2364 	case 4:
2365 		return (0x1);
2366 	case 11:
2367 		return (0x2);
2368 	case 22:
2369 		return (0x3);
2370 	}
2371 
2372 	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
2373 	return (0x0);
2374 }
2375 
2376 static void
2377 zyd_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
2378 {
2379 	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2380 	struct ifnet *ifp = sc->sc_ifp;
2381 	struct ieee80211vap *vap;
2382 	struct zyd_tx_data *data;
2383 	struct mbuf *m;
2384 	struct usb_page_cache *pc;
2385 	int actlen;
2386 
2387 	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2388 
2389 	switch (USB_GET_STATE(xfer)) {
2390 	case USB_ST_TRANSFERRED:
2391 		DPRINTF(sc, ZYD_DEBUG_ANY, "transfer complete, %u bytes\n",
2392 		    actlen);
2393 
2394 		/* free resources */
2395 		data = usbd_xfer_get_priv(xfer);
2396 		zyd_tx_free(data, 0);
2397 		usbd_xfer_set_priv(xfer, NULL);
2398 
2399 		ifp->if_opackets++;
2400 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2401 
2402 		/* FALLTHROUGH */
2403 	case USB_ST_SETUP:
2404 tr_setup:
2405 		data = STAILQ_FIRST(&sc->tx_q);
2406 		if (data) {
2407 			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
2408 			m = data->m;
2409 
2410 			if (m->m_pkthdr.len > ZYD_MAX_TXBUFSZ) {
2411 				DPRINTF(sc, ZYD_DEBUG_ANY, "data overflow, %u bytes\n",
2412 				    m->m_pkthdr.len);
2413 				m->m_pkthdr.len = ZYD_MAX_TXBUFSZ;
2414 			}
2415 			pc = usbd_xfer_get_frame(xfer, 0);
2416 			usbd_copy_in(pc, 0, &data->desc, ZYD_TX_DESC_SIZE);
2417 			usbd_m_copy_in(pc, ZYD_TX_DESC_SIZE, m, 0,
2418 			    m->m_pkthdr.len);
2419 
2420 			vap = data->ni->ni_vap;
2421 			if (ieee80211_radiotap_active_vap(vap)) {
2422 				struct zyd_tx_radiotap_header *tap = &sc->sc_txtap;
2423 
2424 				tap->wt_flags = 0;
2425 				tap->wt_rate = data->rate;
2426 
2427 				ieee80211_radiotap_tx(vap, m);
2428 			}
2429 
2430 			usbd_xfer_set_frame_len(xfer, 0, ZYD_TX_DESC_SIZE + m->m_pkthdr.len);
2431 			usbd_xfer_set_priv(xfer, data);
2432 			usbd_transfer_submit(xfer);
2433 		}
2434 		break;
2435 
2436 	default:			/* Error */
2437 		DPRINTF(sc, ZYD_DEBUG_ANY, "transfer error, %s\n",
2438 		    usbd_errstr(error));
2439 
2440 		ifp->if_oerrors++;
2441 		data = usbd_xfer_get_priv(xfer);
2442 		usbd_xfer_set_priv(xfer, NULL);
2443 		if (data != NULL)
2444 			zyd_tx_free(data, error);
2445 
2446 		if (error == USB_ERR_STALLED) {
2447 			/* try to clear stall first */
2448 			usbd_xfer_set_stall(xfer);
2449 			goto tr_setup;
2450 		}
2451 		if (error == USB_ERR_TIMEOUT)
2452 			device_printf(sc->sc_dev, "device timeout\n");
2453 		break;
2454 	}
2455 }
2456 
2457 static int
2458 zyd_tx_start(struct zyd_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
2459 {
2460 	struct ieee80211vap *vap = ni->ni_vap;
2461 	struct ieee80211com *ic = ni->ni_ic;
2462 	struct zyd_tx_desc *desc;
2463 	struct zyd_tx_data *data;
2464 	struct ieee80211_frame *wh;
2465 	const struct ieee80211_txparam *tp;
2466 	struct ieee80211_key *k;
2467 	int rate, totlen;
2468 	static uint8_t ratediv[] = ZYD_TX_RATEDIV;
2469 	uint8_t phy;
2470 	uint16_t pktlen;
2471 	uint32_t bits;
2472 
2473 	wh = mtod(m0, struct ieee80211_frame *);
2474 	data = STAILQ_FIRST(&sc->tx_free);
2475 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
2476 	sc->tx_nfree--;
2477 
2478 	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT ||
2479 	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) {
2480 		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2481 		rate = tp->mgmtrate;
2482 	} else {
2483 		tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2484 		/* for data frames */
2485 		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2486 			rate = tp->mcastrate;
2487 		else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2488 			rate = tp->ucastrate;
2489 		else {
2490 			(void) ieee80211_amrr_choose(ni, &ZYD_NODE(ni)->amn);
2491 			rate = ni->ni_txrate;
2492 		}
2493 	}
2494 
2495 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2496 		k = ieee80211_crypto_encap(ni, m0);
2497 		if (k == NULL) {
2498 			m_freem(m0);
2499 			return (ENOBUFS);
2500 		}
2501 		/* packet header may have moved, reset our local pointer */
2502 		wh = mtod(m0, struct ieee80211_frame *);
2503 	}
2504 
2505 	data->ni = ni;
2506 	data->m = m0;
2507 	data->rate = rate;
2508 
2509 	/* fill Tx descriptor */
2510 	desc = &data->desc;
2511 	phy = zyd_plcp_signal(sc, rate);
2512 	desc->phy = phy;
2513 	if (ZYD_RATE_IS_OFDM(rate)) {
2514 		desc->phy |= ZYD_TX_PHY_OFDM;
2515 		if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
2516 			desc->phy |= ZYD_TX_PHY_5GHZ;
2517 	} else if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
2518 		desc->phy |= ZYD_TX_PHY_SHPREAMBLE;
2519 
2520 	totlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
2521 	desc->len = htole16(totlen);
2522 
2523 	desc->flags = ZYD_TX_FLAG_BACKOFF;
2524 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2525 		/* multicast frames are not sent at OFDM rates in 802.11b/g */
2526 		if (totlen > vap->iv_rtsthreshold) {
2527 			desc->flags |= ZYD_TX_FLAG_RTS;
2528 		} else if (ZYD_RATE_IS_OFDM(rate) &&
2529 		    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2530 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2531 				desc->flags |= ZYD_TX_FLAG_CTS_TO_SELF;
2532 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2533 				desc->flags |= ZYD_TX_FLAG_RTS;
2534 		}
2535 	} else
2536 		desc->flags |= ZYD_TX_FLAG_MULTICAST;
2537 	if ((wh->i_fc[0] &
2538 	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
2539 	    (IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_PS_POLL))
2540 		desc->flags |= ZYD_TX_FLAG_TYPE(ZYD_TX_TYPE_PS_POLL);
2541 
2542 	/* actual transmit length (XXX why +10?) */
2543 	pktlen = ZYD_TX_DESC_SIZE + 10;
2544 	if (sc->sc_macrev == ZYD_ZD1211)
2545 		pktlen += totlen;
2546 	desc->pktlen = htole16(pktlen);
2547 
2548 	bits = (rate == 11) ? (totlen * 16) + 10 :
2549 	    ((rate == 22) ? (totlen * 8) + 10 : (totlen * 8));
2550 	desc->plcp_length = bits / ratediv[phy];
2551 	desc->plcp_service = 0;
2552 	if (rate == 22 && (bits % 11) > 0 && (bits % 11) <= 3)
2553 		desc->plcp_service |= ZYD_PLCP_LENGEXT;
2554 	desc->nextlen = 0;
2555 
2556 	if (ieee80211_radiotap_active_vap(vap)) {
2557 		struct zyd_tx_radiotap_header *tap = &sc->sc_txtap;
2558 
2559 		tap->wt_flags = 0;
2560 		tap->wt_rate = rate;
2561 
2562 		ieee80211_radiotap_tx(vap, m0);
2563 	}
2564 
2565 	DPRINTF(sc, ZYD_DEBUG_XMIT,
2566 	    "%s: sending data frame len=%zu rate=%u\n",
2567 	    device_get_nameunit(sc->sc_dev), (size_t)m0->m_pkthdr.len,
2568 		rate);
2569 
2570 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
2571 	usbd_transfer_start(sc->sc_xfer[ZYD_BULK_WR]);
2572 
2573 	return (0);
2574 }
2575 
2576 static void
2577 zyd_start(struct ifnet *ifp)
2578 {
2579 	struct zyd_softc *sc = ifp->if_softc;
2580 	struct ieee80211_node *ni;
2581 	struct mbuf *m;
2582 
2583 	ZYD_LOCK(sc);
2584 	for (;;) {
2585 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2586 		if (m == NULL)
2587 			break;
2588 		if (sc->tx_nfree == 0) {
2589 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
2590 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2591 			break;
2592 		}
2593 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2594 		if (zyd_tx_start(sc, m, ni) != 0) {
2595 			ieee80211_free_node(ni);
2596 			ifp->if_oerrors++;
2597 			break;
2598 		}
2599 	}
2600 	ZYD_UNLOCK(sc);
2601 }
2602 
2603 static int
2604 zyd_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2605 	const struct ieee80211_bpf_params *params)
2606 {
2607 	struct ieee80211com *ic = ni->ni_ic;
2608 	struct ifnet *ifp = ic->ic_ifp;
2609 	struct zyd_softc *sc = ifp->if_softc;
2610 
2611 	ZYD_LOCK(sc);
2612 	/* prevent management frames from being sent if we're not ready */
2613 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2614 		ZYD_UNLOCK(sc);
2615 		m_freem(m);
2616 		ieee80211_free_node(ni);
2617 		return (ENETDOWN);
2618 	}
2619 	if (sc->tx_nfree == 0) {
2620 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2621 		ZYD_UNLOCK(sc);
2622 		m_freem(m);
2623 		ieee80211_free_node(ni);
2624 		return (ENOBUFS);		/* XXX */
2625 	}
2626 
2627 	/*
2628 	 * Legacy path; interpret frame contents to decide
2629 	 * precisely how to send the frame.
2630 	 * XXX raw path
2631 	 */
2632 	if (zyd_tx_start(sc, m, ni) != 0) {
2633 		ZYD_UNLOCK(sc);
2634 		ifp->if_oerrors++;
2635 		ieee80211_free_node(ni);
2636 		return (EIO);
2637 	}
2638 	ZYD_UNLOCK(sc);
2639 	return (0);
2640 }
2641 
2642 static int
2643 zyd_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2644 {
2645 	struct zyd_softc *sc = ifp->if_softc;
2646 	struct ieee80211com *ic = ifp->if_l2com;
2647 	struct ifreq *ifr = (struct ifreq *) data;
2648 	int error = 0, startall = 0;
2649 
2650 	switch (cmd) {
2651 	case SIOCSIFFLAGS:
2652 		ZYD_LOCK(sc);
2653 		if (ifp->if_flags & IFF_UP) {
2654 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2655 				zyd_init_locked(sc);
2656 				startall = 1;
2657 			} else
2658 				zyd_set_multi(sc);
2659 		} else {
2660 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2661 				zyd_stop(sc);
2662 		}
2663 		ZYD_UNLOCK(sc);
2664 		if (startall)
2665 			ieee80211_start_all(ic);
2666 		break;
2667 	case SIOCGIFMEDIA:
2668 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2669 		break;
2670 	case SIOCGIFADDR:
2671 		error = ether_ioctl(ifp, cmd, data);
2672 		break;
2673 	default:
2674 		error = EINVAL;
2675 		break;
2676 	}
2677 	return (error);
2678 }
2679 
2680 static void
2681 zyd_init_locked(struct zyd_softc *sc)
2682 {
2683 	struct ifnet *ifp = sc->sc_ifp;
2684 	struct ieee80211com *ic = ifp->if_l2com;
2685 	struct usb_config_descriptor *cd;
2686 	int error;
2687 	uint32_t val;
2688 
2689 	ZYD_LOCK_ASSERT(sc, MA_OWNED);
2690 
2691 	if (!(sc->sc_flags & ZYD_FLAG_INITONCE)) {
2692 		error = zyd_loadfirmware(sc);
2693 		if (error != 0) {
2694 			device_printf(sc->sc_dev,
2695 			    "could not load firmware (error=%d)\n", error);
2696 			goto fail;
2697 		}
2698 
2699 		/* reset device */
2700 		cd = usbd_get_config_descriptor(sc->sc_udev);
2701 		error = usbd_req_set_config(sc->sc_udev, &sc->sc_mtx,
2702 		    cd->bConfigurationValue);
2703 		if (error)
2704 			device_printf(sc->sc_dev, "reset failed, continuing\n");
2705 
2706 		error = zyd_hw_init(sc);
2707 		if (error) {
2708 			device_printf(sc->sc_dev,
2709 			    "hardware initialization failed\n");
2710 			goto fail;
2711 		}
2712 
2713 		device_printf(sc->sc_dev,
2714 		    "HMAC ZD1211%s, FW %02x.%02x, RF %s S%x, PA%x LED %x "
2715 		    "BE%x NP%x Gain%x F%x\n",
2716 		    (sc->sc_macrev == ZYD_ZD1211) ? "": "B",
2717 		    sc->sc_fwrev >> 8, sc->sc_fwrev & 0xff,
2718 		    zyd_rf_name(sc->sc_rfrev), sc->sc_al2230s, sc->sc_parev,
2719 		    sc->sc_ledtype, sc->sc_bandedge6, sc->sc_newphy,
2720 		    sc->sc_cckgain, sc->sc_fix_cr157);
2721 
2722 		/* read regulatory domain (currently unused) */
2723 		zyd_read32_m(sc, ZYD_EEPROM_SUBID, &val);
2724 		sc->sc_regdomain = val >> 16;
2725 		DPRINTF(sc, ZYD_DEBUG_INIT, "regulatory domain %x\n",
2726 		    sc->sc_regdomain);
2727 
2728 		/* we'll do software WEP decryption for now */
2729 		DPRINTF(sc, ZYD_DEBUG_INIT, "%s: setting encryption type\n",
2730 		    __func__);
2731 		zyd_write32_m(sc, ZYD_MAC_ENCRYPTION_TYPE, ZYD_ENC_SNIFFER);
2732 
2733 		sc->sc_flags |= ZYD_FLAG_INITONCE;
2734 	}
2735 
2736 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2737 		zyd_stop(sc);
2738 
2739 	DPRINTF(sc, ZYD_DEBUG_INIT, "setting MAC address to %6D\n",
2740 	    IF_LLADDR(ifp), ":");
2741 	error = zyd_set_macaddr(sc, IF_LLADDR(ifp));
2742 	if (error != 0)
2743 		return;
2744 
2745 	/* set basic rates */
2746 	if (ic->ic_curmode == IEEE80211_MODE_11B)
2747 		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0x0003);
2748 	else if (ic->ic_curmode == IEEE80211_MODE_11A)
2749 		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0x1500);
2750 	else	/* assumes 802.11b/g */
2751 		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0xff0f);
2752 
2753 	/* promiscuous mode */
2754 	zyd_write32_m(sc, ZYD_MAC_SNIFFER, 0);
2755 	/* multicast setup */
2756 	zyd_set_multi(sc);
2757 	/* set RX filter  */
2758 	error = zyd_set_rxfilter(sc);
2759 	if (error != 0)
2760 		goto fail;
2761 
2762 	/* switch radio transmitter ON */
2763 	error = zyd_switch_radio(sc, 1);
2764 	if (error != 0)
2765 		goto fail;
2766 	/* set default BSS channel */
2767 	zyd_set_chan(sc, ic->ic_curchan);
2768 
2769 	/*
2770 	 * Allocate Tx and Rx xfer queues.
2771 	 */
2772 	zyd_setup_tx_list(sc);
2773 
2774 	/* enable interrupts */
2775 	zyd_write32_m(sc, ZYD_CR_INTERRUPT, ZYD_HWINT_MASK);
2776 
2777 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2778 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2779 	usbd_xfer_set_stall(sc->sc_xfer[ZYD_BULK_WR]);
2780 	usbd_transfer_start(sc->sc_xfer[ZYD_BULK_RD]);
2781 	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_RD]);
2782 
2783 	return;
2784 
2785 fail:	zyd_stop(sc);
2786 	return;
2787 }
2788 
2789 static void
2790 zyd_init(void *priv)
2791 {
2792 	struct zyd_softc *sc = priv;
2793 	struct ifnet *ifp = sc->sc_ifp;
2794 	struct ieee80211com *ic = ifp->if_l2com;
2795 
2796 	ZYD_LOCK(sc);
2797 	zyd_init_locked(sc);
2798 	ZYD_UNLOCK(sc);
2799 
2800 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2801 		ieee80211_start_all(ic);		/* start all vap's */
2802 }
2803 
2804 static void
2805 zyd_stop(struct zyd_softc *sc)
2806 {
2807 	struct ifnet *ifp = sc->sc_ifp;
2808 	int error;
2809 
2810 	ZYD_LOCK_ASSERT(sc, MA_OWNED);
2811 
2812 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2813 
2814 	/*
2815 	 * Drain all the transfers, if not already drained:
2816 	 */
2817 	ZYD_UNLOCK(sc);
2818 	usbd_transfer_drain(sc->sc_xfer[ZYD_BULK_WR]);
2819 	usbd_transfer_drain(sc->sc_xfer[ZYD_BULK_RD]);
2820 	ZYD_LOCK(sc);
2821 
2822 	zyd_unsetup_tx_list(sc);
2823 
2824 	/* Stop now if the device was never set up */
2825 	if (!(sc->sc_flags & ZYD_FLAG_INITONCE))
2826 		return;
2827 
2828 	/* switch radio transmitter OFF */
2829 	error = zyd_switch_radio(sc, 0);
2830 	if (error != 0)
2831 		goto fail;
2832 	/* disable Rx */
2833 	zyd_write32_m(sc, ZYD_MAC_RXFILTER, 0);
2834 	/* disable interrupts */
2835 	zyd_write32_m(sc, ZYD_CR_INTERRUPT, 0);
2836 
2837 fail:
2838 	return;
2839 }
2840 
2841 static int
2842 zyd_loadfirmware(struct zyd_softc *sc)
2843 {
2844 	struct usb_device_request req;
2845 	size_t size;
2846 	u_char *fw;
2847 	uint8_t stat;
2848 	uint16_t addr;
2849 
2850 	if (sc->sc_flags & ZYD_FLAG_FWLOADED)
2851 		return (0);
2852 
2853 	if (sc->sc_macrev == ZYD_ZD1211) {
2854 		fw = (u_char *)zd1211_firmware;
2855 		size = sizeof(zd1211_firmware);
2856 	} else {
2857 		fw = (u_char *)zd1211b_firmware;
2858 		size = sizeof(zd1211b_firmware);
2859 	}
2860 
2861 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2862 	req.bRequest = ZYD_DOWNLOADREQ;
2863 	USETW(req.wIndex, 0);
2864 
2865 	addr = ZYD_FIRMWARE_START_ADDR;
2866 	while (size > 0) {
2867 		/*
2868 		 * When the transfer size is 4096 bytes, it is not
2869 		 * likely to be able to transfer it.
2870 		 * The cause is port or machine or chip?
2871 		 */
2872 		const int mlen = min(size, 64);
2873 
2874 		DPRINTF(sc, ZYD_DEBUG_FW,
2875 		    "loading firmware block: len=%d, addr=0x%x\n", mlen, addr);
2876 
2877 		USETW(req.wValue, addr);
2878 		USETW(req.wLength, mlen);
2879 		if (zyd_do_request(sc, &req, fw) != 0)
2880 			return (EIO);
2881 
2882 		addr += mlen / 2;
2883 		fw   += mlen;
2884 		size -= mlen;
2885 	}
2886 
2887 	/* check whether the upload succeeded */
2888 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
2889 	req.bRequest = ZYD_DOWNLOADSTS;
2890 	USETW(req.wValue, 0);
2891 	USETW(req.wIndex, 0);
2892 	USETW(req.wLength, sizeof(stat));
2893 	if (zyd_do_request(sc, &req, &stat) != 0)
2894 		return (EIO);
2895 
2896 	sc->sc_flags |= ZYD_FLAG_FWLOADED;
2897 
2898 	return (stat & 0x80) ? (EIO) : (0);
2899 }
2900 
2901 static void
2902 zyd_newassoc(struct ieee80211_node *ni, int isnew)
2903 {
2904 	struct ieee80211vap *vap = ni->ni_vap;
2905 
2906 	ieee80211_amrr_node_init(&ZYD_VAP(vap)->amrr, &ZYD_NODE(ni)->amn, ni);
2907 }
2908 
2909 static void
2910 zyd_scan_start(struct ieee80211com *ic)
2911 {
2912 	struct ifnet *ifp = ic->ic_ifp;
2913 	struct zyd_softc *sc = ifp->if_softc;
2914 
2915 	ZYD_LOCK(sc);
2916 	/* want broadcast address while scanning */
2917 	zyd_set_bssid(sc, ifp->if_broadcastaddr);
2918 	ZYD_UNLOCK(sc);
2919 }
2920 
2921 static void
2922 zyd_scan_end(struct ieee80211com *ic)
2923 {
2924 	struct zyd_softc *sc = ic->ic_ifp->if_softc;
2925 
2926 	ZYD_LOCK(sc);
2927 	/* restore previous bssid */
2928 	zyd_set_bssid(sc, sc->sc_bssid);
2929 	ZYD_UNLOCK(sc);
2930 }
2931 
2932 static void
2933 zyd_set_channel(struct ieee80211com *ic)
2934 {
2935 	struct zyd_softc *sc = ic->ic_ifp->if_softc;
2936 
2937 	ZYD_LOCK(sc);
2938 	zyd_set_chan(sc, ic->ic_curchan);
2939 	ZYD_UNLOCK(sc);
2940 }
2941 
2942 static device_method_t zyd_methods[] = {
2943         /* Device interface */
2944         DEVMETHOD(device_probe, zyd_match),
2945         DEVMETHOD(device_attach, zyd_attach),
2946         DEVMETHOD(device_detach, zyd_detach),
2947 
2948 	{ 0, 0 }
2949 };
2950 
2951 static driver_t zyd_driver = {
2952         "zyd",
2953         zyd_methods,
2954         sizeof(struct zyd_softc)
2955 };
2956 
2957 static devclass_t zyd_devclass;
2958 
2959 DRIVER_MODULE(zyd, uhub, zyd_driver, zyd_devclass, NULL, 0);
2960 MODULE_DEPEND(zyd, usb, 1, 1, 1);
2961 MODULE_DEPEND(zyd, wlan, 1, 1, 1);
2962 MODULE_DEPEND(zyd, wlan_amrr, 1, 1, 1);
2963