xref: /titanic_50/usr/src/uts/common/io/ural/ural.c (revision cb511613a15cb3949eadffd67b37d3c665b4ef22)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2500USB chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/conf.h>
31 #include <sys/cmn_err.h>
32 #include <sys/stat.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <sys/ethernet.h>
37 #include <inet/common.h>
38 #include <inet/nd.h>
39 #include <inet/mi.h>
40 #include <sys/note.h>
41 #include <sys/stream.h>
42 #include <sys/strsun.h>
43 #include <sys/modctl.h>
44 #include <sys/devops.h>
45 #include <sys/dlpi.h>
46 #include <sys/mac_provider.h>
47 #include <sys/mac_wifi.h>
48 #include <sys/net80211.h>
49 #include <sys/net80211_proto.h>
50 #include <sys/varargs.h>
51 #include <sys/policy.h>
52 #include <sys/pci.h>
53 #include <sys/crypto/common.h>
54 #include <sys/crypto/api.h>
55 #include <inet/wifi_ioctl.h>
56 
57 #define	USBDRV_MAJOR_VER	2
58 #define	USBDRV_MINOR_VER	0
59 #include <sys/usb/usba.h>
60 
61 #include "ural_reg.h"
62 #include "ural_var.h"
63 
64 static void *ural_soft_state_p = NULL;
65 
66 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
67 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
68 
69 /* quickly determine if a given rate is CCK or OFDM */
70 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
71 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
72 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
73 #define	RAL_SIFS		10	/* us */
74 #define	RAL_RXTX_TURNAROUND	5	/* us */
75 
76 #define	URAL_N(a)		(sizeof (a) / sizeof ((a)[0]))
77 
78 /*
79  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
80  */
81 static const struct ieee80211_rateset ural_rateset_11a =
82 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
83 
84 static const struct ieee80211_rateset ural_rateset_11b =
85 	{ 4, { 2, 4, 11, 22 } };
86 
87 static const struct ieee80211_rateset ural_rateset_11g =
88 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
89 
90 /*
91  * Default values for MAC registers; values taken from the reference driver.
92  */
93 static const struct {
94 	uint16_t	reg;
95 	uint16_t	val;
96 } ural_def_mac[] = {
97 	{ RAL_TXRX_CSR5,  0x8c8d },
98 	{ RAL_TXRX_CSR6,  0x8b8a },
99 	{ RAL_TXRX_CSR7,  0x8687 },
100 	{ RAL_TXRX_CSR8,  0x0085 },
101 	{ RAL_MAC_CSR13,  0x1111 },
102 	{ RAL_MAC_CSR14,  0x1e11 },
103 	{ RAL_TXRX_CSR21, 0xe78f },
104 	{ RAL_MAC_CSR9,   0xff1d },
105 	{ RAL_MAC_CSR11,  0x0002 },
106 	{ RAL_MAC_CSR22,  0x0053 },
107 	{ RAL_MAC_CSR15,  0x0000 },
108 	{ RAL_MAC_CSR8,   0x0780 },
109 	{ RAL_TXRX_CSR19, 0x0000 },
110 	{ RAL_TXRX_CSR18, 0x005a },
111 	{ RAL_PHY_CSR2,   0x0000 },
112 	{ RAL_TXRX_CSR0,  0x1ec0 },
113 	{ RAL_PHY_CSR4,   0x000f }
114 };
115 
116 /*
117  * Default values for BBP registers; values taken from the reference driver.
118  */
119 static const struct {
120 	uint8_t	reg;
121 	uint8_t	val;
122 } ural_def_bbp[] = {
123 	{  3, 0x02 },
124 	{  4, 0x19 },
125 	{ 14, 0x1c },
126 	{ 15, 0x30 },
127 	{ 16, 0xac },
128 	{ 17, 0x48 },
129 	{ 18, 0x18 },
130 	{ 19, 0xff },
131 	{ 20, 0x1e },
132 	{ 21, 0x08 },
133 	{ 22, 0x08 },
134 	{ 23, 0x08 },
135 	{ 24, 0x80 },
136 	{ 25, 0x50 },
137 	{ 26, 0x08 },
138 	{ 27, 0x23 },
139 	{ 30, 0x10 },
140 	{ 31, 0x2b },
141 	{ 32, 0xb9 },
142 	{ 34, 0x12 },
143 	{ 35, 0x50 },
144 	{ 39, 0xc4 },
145 	{ 40, 0x02 },
146 	{ 41, 0x60 },
147 	{ 53, 0x10 },
148 	{ 54, 0x18 },
149 	{ 56, 0x08 },
150 	{ 57, 0x10 },
151 	{ 58, 0x08 },
152 	{ 61, 0x60 },
153 	{ 62, 0x10 },
154 	{ 75, 0xff }
155 };
156 
157 /*
158  * Default values for RF register R2 indexed by channel numbers.
159  */
160 static const uint32_t ural_rf2522_r2[] = {
161 	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
162 	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
163 };
164 
165 static const uint32_t ural_rf2523_r2[] = {
166 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
167 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
168 };
169 
170 static const uint32_t ural_rf2524_r2[] = {
171 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
172 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
173 };
174 
175 static const uint32_t ural_rf2525_r2[] = {
176 	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
177 	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
178 };
179 
180 static const uint32_t ural_rf2525_hi_r2[] = {
181 	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
182 	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
183 };
184 
185 static const uint32_t ural_rf2525e_r2[] = {
186 	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
187 	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
188 };
189 
190 static const uint32_t ural_rf2526_hi_r2[] = {
191 	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
192 	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
193 };
194 
195 static const uint32_t ural_rf2526_r2[] = {
196 	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
197 	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
198 };
199 
200 /*
201  * For dual-band RF, RF registers R1 and R4 also depend on channel number;
202  * values taken from the reference driver.
203  */
204 static const struct {
205 	uint8_t		chan;
206 	uint32_t	r1;
207 	uint32_t	r2;
208 	uint32_t	r4;
209 } ural_rf5222[] = {
210 	{   1, 0x08808, 0x0044d, 0x00282 },
211 	{   2, 0x08808, 0x0044e, 0x00282 },
212 	{   3, 0x08808, 0x0044f, 0x00282 },
213 	{   4, 0x08808, 0x00460, 0x00282 },
214 	{   5, 0x08808, 0x00461, 0x00282 },
215 	{   6, 0x08808, 0x00462, 0x00282 },
216 	{   7, 0x08808, 0x00463, 0x00282 },
217 	{   8, 0x08808, 0x00464, 0x00282 },
218 	{   9, 0x08808, 0x00465, 0x00282 },
219 	{  10, 0x08808, 0x00466, 0x00282 },
220 	{  11, 0x08808, 0x00467, 0x00282 },
221 	{  12, 0x08808, 0x00468, 0x00282 },
222 	{  13, 0x08808, 0x00469, 0x00282 },
223 	{  14, 0x08808, 0x0046b, 0x00286 },
224 
225 	{  36, 0x08804, 0x06225, 0x00287 },
226 	{  40, 0x08804, 0x06226, 0x00287 },
227 	{  44, 0x08804, 0x06227, 0x00287 },
228 	{  48, 0x08804, 0x06228, 0x00287 },
229 	{  52, 0x08804, 0x06229, 0x00287 },
230 	{  56, 0x08804, 0x0622a, 0x00287 },
231 	{  60, 0x08804, 0x0622b, 0x00287 },
232 	{  64, 0x08804, 0x0622c, 0x00287 },
233 
234 	{ 100, 0x08804, 0x02200, 0x00283 },
235 	{ 104, 0x08804, 0x02201, 0x00283 },
236 	{ 108, 0x08804, 0x02202, 0x00283 },
237 	{ 112, 0x08804, 0x02203, 0x00283 },
238 	{ 116, 0x08804, 0x02204, 0x00283 },
239 	{ 120, 0x08804, 0x02205, 0x00283 },
240 	{ 124, 0x08804, 0x02206, 0x00283 },
241 	{ 128, 0x08804, 0x02207, 0x00283 },
242 	{ 132, 0x08804, 0x02208, 0x00283 },
243 	{ 136, 0x08804, 0x02209, 0x00283 },
244 	{ 140, 0x08804, 0x0220a, 0x00283 },
245 
246 	{ 149, 0x08808, 0x02429, 0x00281 },
247 	{ 153, 0x08808, 0x0242b, 0x00281 },
248 	{ 157, 0x08808, 0x0242d, 0x00281 },
249 	{ 161, 0x08808, 0x0242f, 0x00281 }
250 };
251 
252 /*
253  * device operations
254  */
255 static int ural_attach(dev_info_t *, ddi_attach_cmd_t);
256 static int ural_detach(dev_info_t *, ddi_detach_cmd_t);
257 
258 /*
259  * Module Loading Data & Entry Points
260  */
261 DDI_DEFINE_STREAM_OPS(ural_dev_ops, nulldev, nulldev, ural_attach,
262     ural_detach, nodev, NULL, D_MP, NULL, ddi_quiesce_not_needed);
263 
264 static struct modldrv ural_modldrv = {
265 	&mod_driverops,		/* Type of module.  This one is a driver */
266 	"ural driver v1.3",	/* short description */
267 	&ural_dev_ops		/* driver specific ops */
268 };
269 
270 static struct modlinkage modlinkage = {
271 	MODREV_1,
272 	(void *)&ural_modldrv,
273 	NULL
274 };
275 
276 static int	ural_m_stat(void *,  uint_t, uint64_t *);
277 static int	ural_m_start(void *);
278 static void	ural_m_stop(void *);
279 static int	ural_m_promisc(void *, boolean_t);
280 static int	ural_m_multicst(void *, boolean_t, const uint8_t *);
281 static int	ural_m_unicst(void *, const uint8_t *);
282 static mblk_t	*ural_m_tx(void *, mblk_t *);
283 static void	ural_m_ioctl(void *, queue_t *, mblk_t *);
284 static int	ural_m_setprop(void *, const char *, mac_prop_id_t,
285     uint_t, const void *);
286 static int	ural_m_getprop(void *, const char *, mac_prop_id_t,
287     uint_t, uint_t, void *, uint_t *);
288 
289 static mac_callbacks_t ural_m_callbacks = {
290 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
291 	ural_m_stat,
292 	ural_m_start,
293 	ural_m_stop,
294 	ural_m_promisc,
295 	ural_m_multicst,
296 	ural_m_unicst,
297 	ural_m_tx,
298 	ural_m_ioctl,
299 	NULL,		/* mc_getcapab */
300 	NULL,
301 	NULL,
302 	ural_m_setprop,
303 	ural_m_getprop
304 };
305 
306 extern const char *usb_str_cr(int);
307 static void ural_amrr_start(struct ural_softc *, struct ieee80211_node *);
308 static int  ural_tx_trigger(struct ural_softc *, mblk_t *);
309 static int  ural_rx_trigger(struct ural_softc *);
310 
311 uint32_t ural_dbg_flags = 0;
312 
313 #ifdef DEBUG
314 void
315 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
316 {
317 	va_list args;
318 
319 	if (dbg_flags & ural_dbg_flags) {
320 		va_start(args, fmt);
321 		vcmn_err(CE_CONT, fmt, args);
322 		va_end(args);
323 	}
324 }
325 #endif
326 
327 static uint16_t
328 ural_read(struct ural_softc *sc, uint16_t reg)
329 {
330 	usb_ctrl_setup_t req;
331 	usb_cr_t cr;
332 	usb_cb_flags_t cf;
333 	mblk_t *mp;
334 	int err;
335 	uint16_t val;
336 
337 	bzero(&req, sizeof (req));
338 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
339 	req.bRequest = RAL_READ_MAC;
340 	req.wValue = 0;
341 	req.wIndex = reg;
342 	req.wLength = sizeof (uint16_t);
343 
344 	mp = NULL;
345 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
346 	    &cr, &cf, 0);
347 
348 	if (err != USB_SUCCESS) {
349 		RAL_DEBUG(RAL_DBG_ERR,
350 		    "ural_read(): could not read MAC register:"
351 		    " cr:%s(%d), cf:(%x)\n",
352 		    usb_str_cr(cr), cr, cf);
353 		return (0);
354 	}
355 
356 	bcopy(mp->b_rptr, &val, sizeof (uint16_t));
357 
358 	if (mp)
359 		freemsg(mp);
360 
361 	return (LE_16(val));
362 }
363 
364 static void
365 ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
366 {
367 	usb_ctrl_setup_t req;
368 	usb_cr_t cr;
369 	usb_cb_flags_t cf;
370 	mblk_t *mp;
371 	int err;
372 
373 	bzero(&req, sizeof (req));
374 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
375 	req.bRequest = RAL_READ_MULTI_MAC;
376 	req.wValue = 0;
377 	req.wIndex = reg;
378 	req.wLength = (uint16_t)len;
379 	req.attrs = USB_ATTRS_AUTOCLEARING;
380 
381 	mp = NULL;
382 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
383 	    &cr, &cf, 0);
384 
385 	if (err != USB_SUCCESS) {
386 		RAL_DEBUG(RAL_DBG_ERR,
387 		    "ural_read_multi(): could not read MAC register:"
388 		    "cr:%s(%d), cf:(%x)\n",
389 		    usb_str_cr(cr), cr, cf);
390 		return;
391 	}
392 
393 	bcopy(mp->b_rptr, buf, len);
394 
395 	if (mp)
396 		freemsg(mp);
397 }
398 
399 static void
400 ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
401 {
402 	usb_ctrl_setup_t req;
403 	usb_cr_t cr;
404 	usb_cb_flags_t cf;
405 	int err;
406 
407 	bzero(&req, sizeof (req));
408 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
409 	req.bRequest = RAL_WRITE_MAC;
410 	req.wValue = val;
411 	req.wIndex = reg;
412 	req.wLength = 0;
413 	req.attrs = USB_ATTRS_NONE;
414 
415 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
416 	    &cr, &cf, 0);
417 
418 	if (err != USB_SUCCESS) {
419 		RAL_DEBUG(RAL_DBG_ERR,
420 		    "ural_write(): could not write MAC register:"
421 		    "cr:%s(%d), cf:(%x)\n",
422 		    usb_str_cr(cr), cr, cf);
423 	}
424 }
425 
426 /* ARGSUSED */
427 static void
428 ural_txeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
429 {
430 	struct ural_softc *sc = (struct ural_softc *)req->bulk_client_private;
431 	struct ieee80211com *ic = &sc->sc_ic;
432 
433 	RAL_DEBUG(RAL_DBG_TX,
434 	    "ural_txeof(): cr:%s(%d), flags:0x%x, tx_queued:%d",
435 	    usb_str_cr(req->bulk_completion_reason),
436 	    req->bulk_completion_reason,
437 	    req->bulk_cb_flags,
438 	    sc->tx_queued);
439 
440 	if (req->bulk_completion_reason != USB_CR_OK)
441 		sc->sc_tx_err++;
442 
443 	mutex_enter(&sc->tx_lock);
444 
445 	sc->tx_queued--;
446 	sc->sc_tx_timer = 0;
447 
448 	if (sc->sc_need_sched) {
449 		sc->sc_need_sched = 0;
450 		mac_tx_update(ic->ic_mach);
451 	}
452 
453 	mutex_exit(&sc->tx_lock);
454 	usb_free_bulk_req(req);
455 }
456 
457 /* ARGSUSED */
458 static void
459 ural_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
460 {
461 	struct ural_softc *sc = (struct ural_softc *)req->bulk_client_private;
462 	struct ieee80211com *ic = &sc->sc_ic;
463 
464 	struct ural_rx_desc *desc;
465 	struct ieee80211_frame *wh;
466 	struct ieee80211_node *ni;
467 
468 	mblk_t *m, *mp;
469 	int len, pktlen;
470 	char *rxbuf;
471 
472 	mp = req->bulk_data;
473 	req->bulk_data = NULL;
474 
475 	RAL_DEBUG(RAL_DBG_RX,
476 	    "ural_rxeof(): cr:%s(%d), flags:0x%x, rx_queued:%d",
477 	    usb_str_cr(req->bulk_completion_reason),
478 	    req->bulk_completion_reason,
479 	    req->bulk_cb_flags,
480 	    sc->rx_queued);
481 
482 	if (req->bulk_completion_reason != USB_CR_OK) {
483 		sc->sc_rx_err++;
484 		goto fail;
485 	}
486 
487 	len = (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
488 	rxbuf = (char *)mp->b_rptr;
489 
490 	if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
491 		RAL_DEBUG(RAL_DBG_ERR,
492 		    "ural_rxeof(): xfer too short %d\n", len);
493 		sc->sc_rx_err++;
494 		goto fail;
495 	}
496 
497 	/* rx descriptor is located at the end */
498 	desc = (struct ural_rx_desc *)(rxbuf + len - RAL_RX_DESC_SIZE);
499 
500 	if ((LE_32(desc->flags) & RAL_RX_PHY_ERROR) ||
501 	    (LE_32(desc->flags) & RAL_RX_CRC_ERROR)) {
502 		/*
503 		 * This should not happen since we did not request to receive
504 		 * those frames when we filled RAL_TXRX_CSR2.
505 		 */
506 		RAL_DEBUG(RAL_DBG_ERR, "PHY or CRC error\n");
507 		sc->sc_rx_err++;
508 		goto fail;
509 	}
510 
511 	pktlen = (LE_32(desc->flags) >> 16) & 0xfff;
512 
513 	if (pktlen > (len - RAL_RX_DESC_SIZE)) {
514 		RAL_DEBUG(RAL_DBG_ERR,
515 		    "ural_rxeof(): pktlen mismatch <%d, %d>.\n", pktlen, len);
516 		goto fail;
517 	}
518 
519 	/* Strip trailing 802.11 MAC FCS. */
520 	pktlen -= IEEE80211_CRC_LEN;
521 
522 	if ((m = allocb(pktlen, BPRI_MED)) == NULL) {
523 		RAL_DEBUG(RAL_DBG_ERR,
524 		    "ural_rxeof(): allocate mblk failed.\n");
525 		sc->sc_rx_nobuf++;
526 		goto fail;
527 	}
528 
529 	bcopy(rxbuf, m->b_rptr, pktlen);
530 	m->b_wptr += pktlen;
531 
532 	wh = (struct ieee80211_frame *)m->b_rptr;
533 	ni = ieee80211_find_rxnode(ic, wh);
534 
535 	/* send the frame to the 802.11 layer */
536 	(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
537 
538 	/* node is no longer needed */
539 	ieee80211_free_node(ni);
540 fail:
541 	mutex_enter(&sc->rx_lock);
542 	sc->rx_queued--;
543 	mutex_exit(&sc->rx_lock);
544 
545 	freemsg(mp);
546 	usb_free_bulk_req(req);
547 
548 	if (RAL_IS_RUNNING(sc))
549 		(void) ural_rx_trigger(sc);
550 }
551 
552 /*
553  * Return the expected ack rate for a frame transmitted at rate `rate'.
554  * this should depend on the destination node basic rate set.
555  */
556 static int
557 ural_ack_rate(struct ieee80211com *ic, int rate)
558 {
559 	switch (rate) {
560 	/* CCK rates */
561 	case 2:
562 		return (2);
563 	case 4:
564 	case 11:
565 	case 22:
566 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
567 
568 	/* OFDM rates */
569 	case 12:
570 	case 18:
571 		return (12);
572 	case 24:
573 	case 36:
574 		return (24);
575 	case 48:
576 	case 72:
577 	case 96:
578 	case 108:
579 		return (48);
580 	}
581 
582 	/* default to 1Mbps */
583 	return (2);
584 }
585 
586 /*
587  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
588  * The function automatically determines the operating mode depending on the
589  * given rate. `flags' indicates whether short preamble is in use or not.
590  */
591 static uint16_t
592 ural_txtime(int len, int rate, uint32_t flags)
593 {
594 	uint16_t txtime;
595 
596 	if (RAL_RATE_IS_OFDM(rate)) {
597 		/* IEEE Std 802.11a-1999, pp. 37 */
598 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
599 		txtime = 16 + 4 + 4 * txtime + 6;
600 	} else {
601 		/* IEEE Std 802.11b-1999, pp. 28 */
602 		txtime = (16 * len + rate - 1) / rate;
603 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
604 			txtime +=  72 + 24;
605 		else
606 			txtime += 144 + 48;
607 	}
608 	return (txtime);
609 }
610 
611 static uint8_t
612 ural_plcp_signal(int rate)
613 {
614 	switch (rate) {
615 	/* CCK rates (returned values are device-dependent) */
616 	case 2:		return (0x0);
617 	case 4:		return (0x1);
618 	case 11:	return (0x2);
619 	case 22:	return (0x3);
620 
621 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
622 	case 12:	return (0xb);
623 	case 18:	return (0xf);
624 	case 24:	return (0xa);
625 	case 36:	return (0xe);
626 	case 48:	return (0x9);
627 	case 72:	return (0xd);
628 	case 96:	return (0x8);
629 	case 108:	return (0xc);
630 
631 	/* unsupported rates (should not get there) */
632 	default:	return (0xff);
633 	}
634 }
635 
636 static void
637 ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
638     uint32_t flags, int len, int rate)
639 {
640 	struct ieee80211com *ic = &sc->sc_ic;
641 	uint16_t plcp_length;
642 	int remainder;
643 
644 	desc->flags = LE_32(flags);
645 	desc->flags |= LE_32(RAL_TX_NEWSEQ);
646 	desc->flags |= LE_32(len << 16);
647 
648 	desc->wme = LE_16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
649 	desc->wme |= LE_16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
650 
651 	/* setup PLCP fields */
652 	desc->plcp_signal  = ural_plcp_signal(rate);
653 	desc->plcp_service = 4;
654 
655 	len += IEEE80211_CRC_LEN;
656 	if (RAL_RATE_IS_OFDM(rate)) {
657 		desc->flags |= LE_32(RAL_TX_OFDM);
658 
659 		plcp_length = len & 0xfff;
660 		desc->plcp_length_hi = plcp_length >> 6;
661 		desc->plcp_length_lo = plcp_length & 0x3f;
662 	} else {
663 		plcp_length = (16 * len + rate - 1) / rate;
664 		if (rate == 22) {
665 			remainder = (16 * len) % 22;
666 			if (remainder != 0 && remainder < 7)
667 				desc->plcp_service |= RAL_PLCP_LENGEXT;
668 		}
669 		desc->plcp_length_hi = plcp_length >> 8;
670 		desc->plcp_length_lo = plcp_length & 0xff;
671 
672 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
673 			desc->plcp_signal |= 0x08;
674 	}
675 
676 	desc->iv = 0;
677 	desc->eiv = 0;
678 }
679 
680 #define	RAL_TX_TIMEOUT		5
681 
682 static int
683 ural_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
684 {
685 	struct ural_softc *sc = (struct ural_softc *)ic;
686 	struct ural_tx_desc *desc;
687 
688 	struct ieee80211_frame *wh;
689 	struct ieee80211_key *k;
690 
691 	uint16_t dur;
692 	uint32_t flags = 0;
693 	int rate, err = DDI_SUCCESS;
694 
695 	struct ieee80211_node *ni = NULL;
696 	mblk_t *m, *m0;
697 	int off, mblen, pktlen, xferlen;
698 
699 	mutex_enter(&sc->tx_lock);
700 
701 	if (sc->tx_queued > RAL_TX_LIST_COUNT) {
702 		RAL_DEBUG(RAL_DBG_TX, "ural_send(): "
703 		    "no TX buffer available!\n");
704 		if ((type & IEEE80211_FC0_TYPE_MASK) ==
705 		    IEEE80211_FC0_TYPE_DATA) {
706 			sc->sc_need_sched = 1;
707 		}
708 		sc->sc_tx_nobuf++;
709 		err = ENOMEM;
710 		goto fail;
711 	}
712 
713 	m = allocb(RAL_TXBUF_SIZE + RAL_TX_DESC_SIZE, BPRI_MED);
714 	if (m == NULL) {
715 		RAL_DEBUG(RAL_DBG_ERR, "ural_send(): can't alloc mblk.\n");
716 		err = DDI_FAILURE;
717 		goto fail;
718 	}
719 
720 	m->b_rptr += RAL_TX_DESC_SIZE;	/* skip TX descriptor */
721 	m->b_wptr += RAL_TX_DESC_SIZE;
722 
723 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
724 		mblen = (uintptr_t)m0->b_wptr - (uintptr_t)m0->b_rptr;
725 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
726 		off += mblen;
727 	}
728 	m->b_wptr += off;
729 
730 	wh = (struct ieee80211_frame *)m->b_rptr;
731 
732 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
733 	if (ni == NULL) {
734 		err = DDI_FAILURE;
735 		sc->sc_tx_err++;
736 		freemsg(m);
737 		goto fail;
738 	}
739 
740 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
741 	    IEEE80211_FC0_TYPE_DATA) {
742 		(void) ieee80211_encap(ic, m, ni);
743 	}
744 
745 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
746 		k = ieee80211_crypto_encap(ic, m);
747 		if (k == NULL) {
748 			sc->sc_tx_err++;
749 			freemsg(m);
750 			err = DDI_FAILURE;
751 			goto fail;
752 		}
753 		/* packet header may have moved, reset our local pointer */
754 		wh = (struct ieee80211_frame *)m->b_rptr;
755 	}
756 
757 	m->b_rptr -= RAL_TX_DESC_SIZE;	/* restore */
758 	desc = (struct ural_tx_desc *)m->b_rptr;
759 
760 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
761 	    IEEE80211_FC0_TYPE_DATA) {	/* DATA */
762 		if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
763 			rate = ic->ic_bss->in_rates.ir_rates[ic->ic_fixed_rate];
764 		else
765 			rate = ni->in_rates.ir_rates[ni->in_txrate];
766 
767 		rate &= IEEE80211_RATE_VAL;
768 		if (rate <= 0) {
769 			rate = 2;	/* basic rate */
770 		}
771 
772 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
773 			flags |= RAL_TX_ACK;
774 			flags |= RAL_TX_RETRY(7);
775 
776 			dur = ural_txtime(RAL_ACK_SIZE, ural_ack_rate(ic, rate),
777 			    ic->ic_flags) + RAL_SIFS;
778 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
779 		}
780 	} else {	/* MGMT */
781 		rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
782 
783 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
784 			flags |= RAL_TX_ACK;
785 
786 			dur = ural_txtime(RAL_ACK_SIZE, rate, ic->ic_flags)
787 			    + RAL_SIFS;
788 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
789 
790 			/* tell hardware to add timestamp for probe responses */
791 			if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
792 			    IEEE80211_FC0_TYPE_MGT &&
793 			    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
794 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
795 				flags |= RAL_TX_TIMESTAMP;
796 		}
797 	}
798 
799 	pktlen = (uintptr_t)m->b_wptr - (uintptr_t)m->b_rptr - RAL_TX_DESC_SIZE;
800 	ural_setup_tx_desc(sc, desc, flags, pktlen, rate);
801 
802 	/* align end on a 2-bytes boundary */
803 	xferlen = (RAL_TX_DESC_SIZE + pktlen + 1) & ~1;
804 
805 	/*
806 	 * No space left in the last URB to store the extra 2 bytes, force
807 	 * sending of another URB.
808 	 */
809 	if ((xferlen % 64) == 0)
810 		xferlen += 2;
811 
812 	m->b_wptr = m->b_rptr + xferlen;
813 
814 	RAL_DEBUG(RAL_DBG_TX, "sending data frame len=%u rate=%u xfer len=%u\n",
815 	    pktlen, rate, xferlen);
816 
817 	(void) ural_tx_trigger(sc, m);
818 
819 	ic->ic_stats.is_tx_frags++;
820 	ic->ic_stats.is_tx_bytes += pktlen;
821 
822 fail:
823 	if (ni != NULL)
824 		ieee80211_free_node(ni);
825 
826 	if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
827 	    err == 0) {
828 		freemsg(mp);
829 	}
830 
831 	mutex_exit(&sc->tx_lock);
832 
833 	return (err);
834 }
835 
836 static mblk_t *
837 ural_m_tx(void *arg, mblk_t *mp)
838 {
839 	struct ural_softc *sc = (struct ural_softc *)arg;
840 	struct ieee80211com *ic = &sc->sc_ic;
841 	mblk_t *next;
842 
843 	/*
844 	 * No data frames go out unless we're associated; this
845 	 * should not happen as the 802.11 layer does not enable
846 	 * the xmit queue until we enter the RUN state.
847 	 */
848 	if (ic->ic_state != IEEE80211_S_RUN) {
849 		RAL_DEBUG(RAL_DBG_ERR, "ural_m_tx(): "
850 		    "discard, state %u\n", ic->ic_state);
851 		freemsgchain(mp);
852 		return (NULL);
853 	}
854 
855 	while (mp != NULL) {
856 		next = mp->b_next;
857 		mp->b_next = NULL;
858 		if (ural_send(ic, mp, IEEE80211_FC0_TYPE_DATA) != DDI_SUCCESS) {
859 			mp->b_next = next;
860 			freemsgchain(mp);
861 			return (NULL);
862 		}
863 		mp = next;
864 	}
865 	return (mp);
866 }
867 
868 static void
869 ural_set_testmode(struct ural_softc *sc)
870 {
871 	usb_ctrl_setup_t req;
872 	usb_cr_t cr;
873 	usb_cb_flags_t cf;
874 	int err;
875 
876 	bzero(&req, sizeof (req));
877 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
878 	req.bRequest = RAL_VENDOR_REQUEST;
879 	req.wValue = 4;
880 	req.wIndex = 1;
881 	req.wLength = 0;
882 	req.attrs = USB_ATTRS_NONE;
883 
884 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
885 	    &cr, &cf, 0);
886 
887 	if (err != USB_SUCCESS) {
888 		RAL_DEBUG(RAL_DBG_USB,
889 		    "ural_set_testmode(): could not set test mode:"
890 		    "cr:%s(%d), cf:%(x)\n",
891 		    usb_str_cr(cr), cr, cf);
892 	}
893 }
894 
895 static void
896 ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
897 {
898 	usb_ctrl_setup_t req;
899 	usb_cr_t cr;
900 	usb_cb_flags_t cf;
901 	mblk_t *mp;
902 	int err;
903 
904 	bzero(&req, sizeof (req));
905 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
906 	req.bRequest = RAL_READ_EEPROM;
907 	req.wValue = 0;
908 	req.wIndex = addr;
909 	req.wLength = (uint16_t)len;
910 
911 	mp = NULL;
912 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
913 	    &cr, &cf, 0);
914 
915 	if (err != USB_SUCCESS) {
916 		RAL_DEBUG(RAL_DBG_USB,
917 		    "ural_eeprom_read(): could not read EEPROM:"
918 		    "cr:%s(%d), cf:(%x)\n",
919 		    usb_str_cr(cr), cr, cf);
920 		return;
921 	}
922 
923 	bcopy(mp->b_rptr, buf, len);
924 
925 	if (mp)
926 		freemsg(mp);
927 }
928 
929 static void
930 ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
931 {
932 	uint16_t tmp;
933 	int ntries;
934 
935 	for (ntries = 0; ntries < 5; ntries++) {
936 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
937 			break;
938 	}
939 	if (ntries == 5) {
940 		RAL_DEBUG(RAL_DBG_ERR,
941 		    "ural_bbp_write(): could not write to BBP\n");
942 		return;
943 	}
944 
945 	tmp = reg << 8 | val;
946 	ural_write(sc, RAL_PHY_CSR7, tmp);
947 }
948 
949 static uint8_t
950 ural_bbp_read(struct ural_softc *sc, uint8_t reg)
951 {
952 	uint16_t val;
953 	int ntries;
954 
955 	val = RAL_BBP_WRITE | reg << 8;
956 	ural_write(sc, RAL_PHY_CSR7, val);
957 
958 	for (ntries = 0; ntries < 5; ntries++) {
959 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
960 			break;
961 	}
962 	if (ntries == 5) {
963 		RAL_DEBUG(RAL_DBG_ERR, "ural_bbp_read(): could not read BBP\n");
964 		return (0);
965 	}
966 
967 	return (ural_read(sc, RAL_PHY_CSR7) & 0xff);
968 }
969 
970 static void
971 ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
972 {
973 	uint32_t tmp;
974 	int ntries;
975 
976 	for (ntries = 0; ntries < 5; ntries++) {
977 		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
978 			break;
979 	}
980 	if (ntries == 5) {
981 		RAL_DEBUG(RAL_DBG_ERR,
982 		    "ural_rf_write(): could not write to RF\n");
983 		return;
984 	}
985 
986 	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xffff) << 2 | (reg & 0x3);
987 	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
988 	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
989 
990 	/* remember last written value in sc */
991 	sc->rf_regs[reg] = val;
992 
993 	RAL_DEBUG(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
994 }
995 
996 /*
997  * Disable RF auto-tuning.
998  */
999 static void
1000 ural_disable_rf_tune(struct ural_softc *sc)
1001 {
1002 	uint32_t tmp;
1003 
1004 	if (sc->rf_rev != RAL_RF_2523) {
1005 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1006 		ural_rf_write(sc, RAL_RF1, tmp);
1007 	}
1008 
1009 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1010 	ural_rf_write(sc, RAL_RF3, tmp);
1011 
1012 	RAL_DEBUG(RAL_DBG_HW, "disabling RF autotune\n");
1013 }
1014 
1015 
1016 static void
1017 ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1018 {
1019 	struct ieee80211com *ic = &sc->sc_ic;
1020 	uint8_t power, tmp;
1021 	uint_t i, chan;
1022 
1023 	chan = ieee80211_chan2ieee(ic, c);
1024 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1025 		return;
1026 
1027 	if (IEEE80211_IS_CHAN_2GHZ(c))
1028 		power = min(sc->txpow[chan - 1], 31);
1029 	else
1030 		power = 31;
1031 
1032 	/* adjust txpower using ifconfig settings */
1033 	power -= (100 - ic->ic_txpowlimit) / 8;
1034 
1035 	RAL_DEBUG(RAL_DBG_HW, "setting channel to %u, txpower to %u\n",
1036 	    chan, power);
1037 
1038 	switch (sc->rf_rev) {
1039 	case RAL_RF_2522:
1040 		ural_rf_write(sc, RAL_RF1, 0x00814);
1041 		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1042 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1043 		break;
1044 
1045 	case RAL_RF_2523:
1046 		ural_rf_write(sc, RAL_RF1, 0x08804);
1047 		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1048 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1049 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1050 		break;
1051 
1052 	case RAL_RF_2524:
1053 		ural_rf_write(sc, RAL_RF1, 0x0c808);
1054 		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1055 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1056 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1057 		break;
1058 
1059 	case RAL_RF_2525:
1060 		ural_rf_write(sc, RAL_RF1, 0x08808);
1061 		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1062 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1063 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1064 
1065 		ural_rf_write(sc, RAL_RF1, 0x08808);
1066 		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1067 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1068 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1069 		break;
1070 
1071 	case RAL_RF_2525E:
1072 		ural_rf_write(sc, RAL_RF1, 0x08808);
1073 		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1074 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1075 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1076 		break;
1077 
1078 	case RAL_RF_2526:
1079 		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1080 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1081 		ural_rf_write(sc, RAL_RF1, 0x08804);
1082 
1083 		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1084 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1085 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1086 		break;
1087 
1088 	/* dual-band RF */
1089 	case RAL_RF_5222:
1090 		for (i = 0; ural_rf5222[i].chan != chan; i++) {
1091 			if (i > URAL_N(ural_rf5222)) break;
1092 		}
1093 
1094 		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1095 		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1096 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1097 		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1098 		break;
1099 	}
1100 
1101 	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1102 	    ic->ic_state != IEEE80211_S_SCAN) {
1103 		/* set Japan filter bit for channel 14 */
1104 		tmp = ural_bbp_read(sc, 70);
1105 
1106 		tmp &= ~RAL_JAPAN_FILTER;
1107 		if (chan == 14)
1108 			tmp |= RAL_JAPAN_FILTER;
1109 
1110 		ural_bbp_write(sc, 70, tmp);
1111 
1112 		/* clear CRC errs */
1113 		(void) ural_read(sc, RAL_STA_CSR0);
1114 
1115 		drv_usecwait(10000);
1116 		ural_disable_rf_tune(sc);
1117 	}
1118 }
1119 
1120 /*
1121  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1122  * synchronization.
1123  */
1124 static void
1125 ural_enable_tsf_sync(struct ural_softc *sc)
1126 {
1127 	struct ieee80211com *ic = &sc->sc_ic;
1128 	uint16_t logcwmin, preload, tmp;
1129 
1130 	/* first, disable TSF synchronization */
1131 	ural_write(sc, RAL_TXRX_CSR19, 0);
1132 
1133 	tmp = (16 * ic->ic_bss->in_intval) << 4;
1134 	ural_write(sc, RAL_TXRX_CSR18, tmp);
1135 
1136 	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1137 	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1138 	tmp = logcwmin << 12 | preload;
1139 	ural_write(sc, RAL_TXRX_CSR20, tmp);
1140 
1141 	/* finally, enable TSF synchronization */
1142 	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1143 	if (ic->ic_opmode == IEEE80211_M_STA)
1144 		tmp |= RAL_ENABLE_TSF_SYNC(1);
1145 	else
1146 		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1147 	ural_write(sc, RAL_TXRX_CSR19, tmp);
1148 
1149 	RAL_DEBUG(RAL_DBG_HW, "enabling TSF synchronization\n");
1150 }
1151 
1152 /*
1153  * This function can be called by ieee80211_set_shortslottime(). Refer to
1154  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
1155  */
1156 /* ARGSUSED */
1157 static void
1158 ural_update_slot(struct ieee80211com *ic, int onoff)
1159 {
1160 	struct ural_softc *sc = (struct ural_softc *)ic;
1161 	uint16_t slottime, sifs, eifs;
1162 
1163 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1164 	/* slottime = (onoff ? 9 : 20); */
1165 
1166 	/*
1167 	 * These settings may sound a bit inconsistent but this is what the
1168 	 * reference driver does.
1169 	 */
1170 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1171 		sifs = 16 - RAL_RXTX_TURNAROUND;
1172 		eifs = 364;
1173 	} else {
1174 		sifs = 10 - RAL_RXTX_TURNAROUND;
1175 		eifs = 64;
1176 	}
1177 
1178 	ural_write(sc, RAL_MAC_CSR10, slottime);
1179 	ural_write(sc, RAL_MAC_CSR11, sifs);
1180 	ural_write(sc, RAL_MAC_CSR12, eifs);
1181 }
1182 
1183 static void
1184 ural_set_txpreamble(struct ural_softc *sc)
1185 {
1186 	uint16_t tmp;
1187 
1188 	tmp = ural_read(sc, RAL_TXRX_CSR10);
1189 
1190 	tmp &= ~RAL_SHORT_PREAMBLE;
1191 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1192 		tmp |= RAL_SHORT_PREAMBLE;
1193 
1194 	ural_write(sc, RAL_TXRX_CSR10, tmp);
1195 }
1196 
1197 static void
1198 ural_set_basicrates(struct ural_softc *sc)
1199 {
1200 	struct ieee80211com *ic = &sc->sc_ic;
1201 
1202 	/* update basic rate set */
1203 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1204 		/* 11b basic rates: 1, 2Mbps */
1205 		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1206 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->in_chan)) {
1207 		/* 11a basic rates: 6, 12, 24Mbps */
1208 		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1209 	} else {
1210 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1211 		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1212 	}
1213 }
1214 
1215 static void
1216 ural_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1217 {
1218 	uint16_t tmp;
1219 
1220 	tmp = bssid[0] | bssid[1] << 8;
1221 	ural_write(sc, RAL_MAC_CSR5, tmp);
1222 
1223 	tmp = bssid[2] | bssid[3] << 8;
1224 	ural_write(sc, RAL_MAC_CSR6, tmp);
1225 
1226 	tmp = bssid[4] | bssid[5] << 8;
1227 	ural_write(sc, RAL_MAC_CSR7, tmp);
1228 
1229 	RAL_DEBUG(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
1230 }
1231 
1232 static void
1233 ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1234 {
1235 	uint16_t tmp;
1236 
1237 	tmp = addr[0] | addr[1] << 8;
1238 	ural_write(sc, RAL_MAC_CSR2, tmp);
1239 
1240 	tmp = addr[2] | addr[3] << 8;
1241 	ural_write(sc, RAL_MAC_CSR3, tmp);
1242 
1243 	tmp = addr[4] | addr[5] << 8;
1244 	ural_write(sc, RAL_MAC_CSR4, tmp);
1245 
1246 	RAL_DEBUG(RAL_DBG_HW,
1247 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1248 }
1249 
1250 static void
1251 ural_update_promisc(struct ural_softc *sc)
1252 {
1253 	uint32_t tmp;
1254 
1255 	tmp = ural_read(sc, RAL_TXRX_CSR2);
1256 
1257 	tmp &= ~RAL_DROP_NOT_TO_ME;
1258 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1259 		tmp |= RAL_DROP_NOT_TO_ME;
1260 
1261 	ural_write(sc, RAL_TXRX_CSR2, tmp);
1262 
1263 	RAL_DEBUG(RAL_DBG_HW, "%s promiscuous mode\n",
1264 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1265 }
1266 
1267 static const char *
1268 ural_get_rf(int rev)
1269 {
1270 	switch (rev) {
1271 	case RAL_RF_2522:	return ("RT2522");
1272 	case RAL_RF_2523:	return ("RT2523");
1273 	case RAL_RF_2524:	return ("RT2524");
1274 	case RAL_RF_2525:	return ("RT2525");
1275 	case RAL_RF_2525E:	return ("RT2525e");
1276 	case RAL_RF_2526:	return ("RT2526");
1277 	case RAL_RF_5222:	return ("RT5222");
1278 	default:		return ("unknown");
1279 	}
1280 }
1281 
1282 static void
1283 ural_read_eeprom(struct ural_softc *sc)
1284 {
1285 	struct ieee80211com *ic = &sc->sc_ic;
1286 	uint16_t val;
1287 
1288 	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1289 	val = LE_16(val);
1290 	sc->rf_rev =   (val >> 11) & 0x7;
1291 	sc->hw_radio = (val >> 10) & 0x1;
1292 	sc->led_mode = (val >> 6)  & 0x7;
1293 	sc->rx_ant =   (val >> 4)  & 0x3;
1294 	sc->tx_ant =   (val >> 2)  & 0x3;
1295 	sc->nb_ant =   val & 0x3;
1296 
1297 	/* read MAC address */
1298 	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, ic->ic_macaddr, 6);
1299 
1300 	/* read default values for BBP registers */
1301 	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1302 
1303 	/* read Tx power for all b/g channels */
1304 	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
1305 }
1306 
1307 static int
1308 ural_bbp_init(struct ural_softc *sc)
1309 {
1310 	int i, ntries;
1311 
1312 	/* wait for BBP to be ready */
1313 	for (ntries = 0; ntries < 100; ntries++) {
1314 		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
1315 			break;
1316 		drv_usecwait(1000);
1317 	}
1318 	if (ntries == 100) {
1319 		RAL_DEBUG(RAL_DBG_ERR, "timeout waiting for BBP\n");
1320 		return (EIO);
1321 	}
1322 
1323 	/* initialize BBP registers to default values */
1324 	for (i = 0; i < URAL_N(ural_def_bbp); i++)
1325 		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
1326 
1327 	return (0);
1328 }
1329 
1330 static void
1331 ural_set_txantenna(struct ural_softc *sc, int antenna)
1332 {
1333 	uint16_t tmp;
1334 	uint8_t tx;
1335 
1336 	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1337 	if (antenna == 1)
1338 		tx |= RAL_BBP_ANTA;
1339 	else if (antenna == 2)
1340 		tx |= RAL_BBP_ANTB;
1341 	else
1342 		tx |= RAL_BBP_DIVERSITY;
1343 
1344 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1345 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
1346 	    sc->rf_rev == RAL_RF_5222)
1347 		tx |= RAL_BBP_FLIPIQ;
1348 
1349 	ural_bbp_write(sc, RAL_BBP_TX, tx);
1350 
1351 	/* update values in PHY_CSR5 and PHY_CSR6 */
1352 	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
1353 	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1354 
1355 	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
1356 	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1357 }
1358 
1359 static void
1360 ural_set_rxantenna(struct ural_softc *sc, int antenna)
1361 {
1362 	uint8_t rx;
1363 
1364 	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1365 	if (antenna == 1)
1366 		rx |= RAL_BBP_ANTA;
1367 	else if (antenna == 2)
1368 		rx |= RAL_BBP_ANTB;
1369 	else
1370 		rx |= RAL_BBP_DIVERSITY;
1371 
1372 	/* need to force no I/Q flip for RF 2525e and 2526 */
1373 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
1374 		rx &= ~RAL_BBP_FLIPIQ;
1375 
1376 	ural_bbp_write(sc, RAL_BBP_RX, rx);
1377 }
1378 
1379 /*
1380  * This function is called periodically (every 200ms) during scanning to
1381  * switch from one channel to another.
1382  */
1383 static void
1384 ural_next_scan(void *arg)
1385 {
1386 	struct ural_softc *sc = arg;
1387 	struct ieee80211com *ic = &sc->sc_ic;
1388 
1389 	if (ic->ic_state == IEEE80211_S_SCAN)
1390 		ieee80211_next_scan(ic);
1391 }
1392 
1393 static int
1394 ural_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1395 {
1396 	struct ural_softc *sc = (struct ural_softc *)ic;
1397 	enum ieee80211_state ostate;
1398 	struct ieee80211_node *ni;
1399 	int err;
1400 
1401 	RAL_LOCK(sc);
1402 
1403 	ostate = ic->ic_state;
1404 
1405 	if (sc->sc_scan_id != 0) {
1406 		(void) untimeout(sc->sc_scan_id);
1407 		sc->sc_scan_id = 0;
1408 	}
1409 
1410 	if (sc->sc_amrr_id != 0) {
1411 		(void) untimeout(sc->sc_amrr_id);
1412 		sc->sc_amrr_id = 0;
1413 	}
1414 
1415 	switch (nstate) {
1416 	case IEEE80211_S_INIT:
1417 		if (ostate == IEEE80211_S_RUN) {
1418 			/* abort TSF synchronization */
1419 			ural_write(sc, RAL_TXRX_CSR19, 0);
1420 			/* force tx led to stop blinking */
1421 			ural_write(sc, RAL_MAC_CSR20, 0);
1422 		}
1423 		break;
1424 
1425 	case IEEE80211_S_SCAN:
1426 		ural_set_chan(sc, ic->ic_curchan);
1427 		sc->sc_scan_id = timeout(ural_next_scan, (void *)sc,
1428 		    drv_usectohz(sc->dwelltime * 1000));
1429 		break;
1430 
1431 	case IEEE80211_S_AUTH:
1432 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_AUTH ...\n");
1433 		ural_set_chan(sc, ic->ic_curchan);
1434 		break;
1435 
1436 	case IEEE80211_S_ASSOC:
1437 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_ASSOC ...\n");
1438 		ural_set_chan(sc, ic->ic_curchan);
1439 		break;
1440 
1441 	case IEEE80211_S_RUN:
1442 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_RUN ...\n");
1443 		ural_set_chan(sc, ic->ic_curchan);
1444 
1445 		ni = ic->ic_bss;
1446 
1447 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1448 			ural_update_slot(ic, 1);
1449 			ural_set_txpreamble(sc);
1450 			ural_set_basicrates(sc);
1451 			ural_set_bssid(sc, ni->in_bssid);
1452 		}
1453 
1454 
1455 		/* make tx led blink on tx (controlled by ASIC) */
1456 		ural_write(sc, RAL_MAC_CSR20, 1);
1457 
1458 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1459 			ural_enable_tsf_sync(sc);
1460 
1461 		/* enable automatic rate adaptation in STA mode */
1462 		if (ic->ic_opmode == IEEE80211_M_STA &&
1463 		    ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
1464 			ural_amrr_start(sc, ni);
1465 
1466 		break;
1467 	}
1468 
1469 	RAL_UNLOCK(sc);
1470 
1471 	err = sc->sc_newstate(ic, nstate, arg);
1472 	/*
1473 	 * Finally, start any timers.
1474 	 */
1475 	if (nstate == IEEE80211_S_RUN)
1476 		ieee80211_start_watchdog(ic, 1);
1477 
1478 	return (err);
1479 }
1480 
1481 
1482 
1483 static void
1484 ural_close_pipes(struct ural_softc *sc)
1485 {
1486 	usb_flags_t flags = USB_FLAGS_SLEEP;
1487 
1488 	if (sc->sc_rx_pipeh != NULL) {
1489 		usb_pipe_reset(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
1490 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
1491 		sc->sc_rx_pipeh = NULL;
1492 	}
1493 
1494 	if (sc->sc_tx_pipeh != NULL) {
1495 		usb_pipe_reset(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
1496 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
1497 		sc->sc_tx_pipeh = NULL;
1498 	}
1499 }
1500 
1501 static int
1502 ural_open_pipes(struct ural_softc *sc)
1503 {
1504 	usb_ep_data_t *ep_node;
1505 	usb_pipe_policy_t policy;
1506 	int err;
1507 
1508 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
1509 	    USB_EP_ATTR_BULK, USB_EP_DIR_OUT);
1510 
1511 	bzero(&policy, sizeof (usb_pipe_policy_t));
1512 	policy.pp_max_async_reqs = RAL_TX_LIST_COUNT;
1513 
1514 	if ((err = usb_pipe_open(sc->sc_dev,
1515 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
1516 	    &sc->sc_tx_pipeh)) != USB_SUCCESS) {
1517 		RAL_DEBUG(RAL_DBG_ERR,
1518 		    "ural_open_pipes(): %x failed to open tx pipe\n", err);
1519 		goto fail;
1520 	}
1521 
1522 	RAL_DEBUG(RAL_DBG_MSG, "tx pipe opened\n");
1523 
1524 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
1525 	    USB_EP_ATTR_BULK, USB_EP_DIR_IN);
1526 
1527 	bzero(&policy, sizeof (usb_pipe_policy_t));
1528 	policy.pp_max_async_reqs = RAL_RX_LIST_COUNT + 32;
1529 
1530 	if ((err = usb_pipe_open(sc->sc_dev,
1531 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
1532 	    &sc->sc_rx_pipeh)) != USB_SUCCESS) {
1533 		RAL_DEBUG(RAL_DBG_ERR,
1534 		    "ural_open_pipes(): %x failed to open rx pipe\n", err);
1535 		goto fail;
1536 	}
1537 
1538 	RAL_DEBUG(RAL_DBG_MSG, "rx pipe opened\n");
1539 
1540 	return (USB_SUCCESS);
1541 
1542 fail:
1543 	if (sc->sc_rx_pipeh != NULL) {
1544 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh,
1545 		    USB_FLAGS_SLEEP, NULL, 0);
1546 		sc->sc_rx_pipeh = NULL;
1547 	}
1548 
1549 	if (sc->sc_tx_pipeh != NULL) {
1550 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh,
1551 		    USB_FLAGS_SLEEP, NULL, 0);
1552 		sc->sc_tx_pipeh = NULL;
1553 	}
1554 
1555 	return (USB_FAILURE);
1556 }
1557 
1558 static int
1559 ural_tx_trigger(struct ural_softc *sc, mblk_t *mp)
1560 {
1561 	usb_bulk_req_t *req;
1562 	int err;
1563 
1564 	sc->sc_tx_timer = RAL_TX_TIMEOUT;
1565 
1566 	req = usb_alloc_bulk_req(sc->sc_dev, 0, USB_FLAGS_SLEEP);
1567 	if (req == NULL) {
1568 		RAL_DEBUG(RAL_DBG_ERR,
1569 		    "ural_tx_trigger(): failed to allocate req");
1570 		freemsg(mp);
1571 		return (-1);
1572 	}
1573 
1574 	req->bulk_len		= (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
1575 	req->bulk_data		= mp;
1576 	req->bulk_client_private = (usb_opaque_t)sc;
1577 	req->bulk_timeout	= RAL_TX_TIMEOUT;
1578 	req->bulk_attributes	= USB_ATTRS_AUTOCLEARING;
1579 	req->bulk_cb		= ural_txeof;
1580 	req->bulk_exc_cb	= ural_txeof;
1581 	req->bulk_completion_reason = 0;
1582 	req->bulk_cb_flags	= 0;
1583 
1584 	if ((err = usb_pipe_bulk_xfer(sc->sc_tx_pipeh, req, 0))
1585 	    != USB_SUCCESS) {
1586 
1587 		RAL_DEBUG(RAL_DBG_ERR, "ural_tx_trigger(): "
1588 		    "failed to do tx xfer, %d", err);
1589 		usb_free_bulk_req(req);
1590 		return (-1);
1591 	}
1592 
1593 	sc->tx_queued++;
1594 
1595 	return (0);
1596 }
1597 
1598 static int
1599 ural_rx_trigger(struct ural_softc *sc)
1600 {
1601 	usb_bulk_req_t *req;
1602 	int err;
1603 
1604 	req = usb_alloc_bulk_req(sc->sc_dev, RAL_RXBUF_SIZE, USB_FLAGS_SLEEP);
1605 	if (req == NULL) {
1606 		RAL_DEBUG(RAL_DBG_ERR,
1607 		    "ural_rx_trigger(): failed to allocate req");
1608 		return (-1);
1609 	}
1610 
1611 	req->bulk_len		= RAL_RXBUF_SIZE;
1612 	req->bulk_client_private = (usb_opaque_t)sc;
1613 	req->bulk_timeout	= 0;
1614 	req->bulk_attributes	= USB_ATTRS_SHORT_XFER_OK
1615 	    | USB_ATTRS_AUTOCLEARING;
1616 	req->bulk_cb		= ural_rxeof;
1617 	req->bulk_exc_cb	= ural_rxeof;
1618 	req->bulk_completion_reason = 0;
1619 	req->bulk_cb_flags	= 0;
1620 
1621 	err = usb_pipe_bulk_xfer(sc->sc_rx_pipeh, req, 0);
1622 
1623 	if (err != USB_SUCCESS) {
1624 		RAL_DEBUG(RAL_DBG_ERR, "ural_rx_trigger(): "
1625 		    "failed to do rx xfer, %d", err);
1626 		usb_free_bulk_req(req);
1627 
1628 		return (-1);
1629 	}
1630 
1631 	mutex_enter(&sc->rx_lock);
1632 	sc->rx_queued++;
1633 	mutex_exit(&sc->rx_lock);
1634 
1635 	return (0);
1636 }
1637 
1638 static void
1639 ural_init_tx_queue(struct ural_softc *sc)
1640 {
1641 	sc->tx_queued = 0;
1642 }
1643 
1644 static int
1645 ural_init_rx_queue(struct ural_softc *sc)
1646 {
1647 	int	i;
1648 
1649 	sc->rx_queued = 0;
1650 
1651 	for (i = 0; i < RAL_RX_LIST_COUNT; i++) {
1652 		if (ural_rx_trigger(sc) != 0) {
1653 			return (USB_FAILURE);
1654 		}
1655 	}
1656 
1657 	return (USB_SUCCESS);
1658 }
1659 
1660 static void
1661 ural_stop(struct ural_softc *sc)
1662 {
1663 	struct ieee80211com *ic = &sc->sc_ic;
1664 
1665 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1666 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1667 
1668 	RAL_LOCK(sc);
1669 
1670 	sc->sc_tx_timer = 0;
1671 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1672 
1673 	/* disable Rx */
1674 	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
1675 
1676 	/* reset ASIC and BBP (but won't reset MAC registers!) */
1677 	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
1678 	ural_write(sc, RAL_MAC_CSR1, 0);
1679 
1680 	ural_close_pipes(sc);
1681 
1682 	RAL_UNLOCK(sc);
1683 }
1684 
1685 static int
1686 ural_init(struct ural_softc *sc)
1687 {
1688 	struct ieee80211com *ic = &sc->sc_ic;
1689 	uint16_t tmp;
1690 	int i, ntries;
1691 
1692 	ural_set_testmode(sc);
1693 	ural_write(sc, 0x308, 0x00f0);	/* magic */
1694 
1695 	ural_stop(sc);
1696 
1697 	/* initialize MAC registers to default values */
1698 	for (i = 0; i < URAL_N(ural_def_mac); i++)
1699 		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
1700 
1701 	/* wait for BBP and RF to wake up (this can take a long time!) */
1702 	for (ntries = 0; ntries < 100; ntries++) {
1703 		tmp = ural_read(sc, RAL_MAC_CSR17);
1704 		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
1705 		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
1706 			break;
1707 		drv_usecwait(1000);
1708 	}
1709 	if (ntries == 100) {
1710 		RAL_DEBUG(RAL_DBG_ERR,
1711 		    "ural_init(): timeout waiting for BBP/RF to wakeup\n");
1712 		goto fail;
1713 	}
1714 
1715 	/* we're ready! */
1716 	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
1717 
1718 	/* set basic rate set (will be updated later) */
1719 	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1720 
1721 	if (ural_bbp_init(sc) != 0)
1722 		goto fail;
1723 
1724 	/* set default BSS channel */
1725 	ural_set_chan(sc, ic->ic_curchan);
1726 
1727 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1728 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
1729 
1730 	ural_set_txantenna(sc, sc->tx_ant);
1731 	ural_set_rxantenna(sc, sc->rx_ant);
1732 
1733 	ural_set_macaddr(sc, ic->ic_macaddr);
1734 
1735 	if (ural_open_pipes(sc) != USB_SUCCESS) {
1736 		RAL_DEBUG(RAL_DBG_ERR, "ural_init(): "
1737 		    "could not open pipes.\n");
1738 		goto fail;
1739 	}
1740 
1741 	ural_init_tx_queue(sc);
1742 
1743 	if (ural_init_rx_queue(sc) != USB_SUCCESS)
1744 		goto fail;
1745 
1746 	/* kick Rx */
1747 	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
1748 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1749 		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
1750 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1751 			tmp |= RAL_DROP_TODS;
1752 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1753 			tmp |= RAL_DROP_NOT_TO_ME;
1754 	}
1755 	ural_write(sc, RAL_TXRX_CSR2, tmp);
1756 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
1757 
1758 	return (DDI_SUCCESS);
1759 fail:
1760 	ural_stop(sc);
1761 	return (EIO);
1762 }
1763 
1764 static int
1765 ural_offline(dev_info_t *devinfo)
1766 {
1767 	struct ural_softc *sc;
1768 	struct ieee80211com *ic;
1769 
1770 	RAL_DEBUG(RAL_DBG_MSG, "ural_offline()\n");
1771 
1772 	/*
1773 	 * We can't call ural_stop() here, since the hardware is removed,
1774 	 * we can't access the register anymore.
1775 	 */
1776 
1777 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
1778 	ic = &sc->sc_ic;
1779 
1780 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1781 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1782 
1783 	RAL_LOCK(sc);
1784 
1785 	sc->sc_tx_timer = 0;
1786 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1787 
1788 	ural_close_pipes(sc);
1789 
1790 	RAL_UNLOCK(sc);
1791 
1792 	return (DDI_SUCCESS);
1793 }
1794 
1795 static int
1796 ural_online(dev_info_t *devinfo)
1797 {
1798 	struct ural_softc *sc;
1799 	int err;
1800 
1801 	RAL_DEBUG(RAL_DBG_MSG, "ural_online()\n");
1802 
1803 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
1804 	err = ural_init(sc);
1805 
1806 	return (err);
1807 }
1808 
1809 #define	URAL_AMRR_MIN_SUCCESS_THRESHOLD	1
1810 #define	URAL_AMRR_MAX_SUCCESS_THRESHOLD	10
1811 
1812 /*
1813  * Naive implementation of the Adaptive Multi Rate Retry algorithm:
1814  * "IEEE 802.11 Rate Adaptation: A Practical Approach"
1815  * Mathieu Lacage, Hossein Manshaei, Thierry Turletti
1816  * INRIA Sophia - Projet Planete
1817  * http://www-sop.inria.fr/rapports/sophia/RR-5208.html
1818  *
1819  * This algorithm is particularly well suited for ural since it does not
1820  * require per-frame retry statistics.  Note however that since h/w does
1821  * not provide per-frame stats, we can't do per-node rate adaptation and
1822  * thus automatic rate adaptation is only enabled in STA operating mode.
1823  */
1824 #define	is_success(amrr)	\
1825 	((amrr)->retrycnt < (amrr)->txcnt / 10)
1826 #define	is_failure(amrr)	\
1827 	((amrr)->retrycnt > (amrr)->txcnt / 3)
1828 #define	is_enough(amrr)		\
1829 	((amrr)->txcnt > 10)
1830 #define	is_min_rate(ni)		\
1831 	((ni)->in_txrate == 0)
1832 #define	is_max_rate(ni)		\
1833 	((ni)->in_txrate == (ni)->in_rates.ir_nrates - 1)
1834 #define	increase_rate(ni)	\
1835 	((ni)->in_txrate++)
1836 #define	decrease_rate(ni)	\
1837 	((ni)->in_txrate--)
1838 #define	reset_cnt(amrr)	do {	\
1839 	(amrr)->txcnt = (amrr)->retrycnt = 0;	\
1840 	_NOTE(CONSTCOND)	\
1841 } while (/* CONSTCOND */0)
1842 
1843 static void
1844 ural_ratectl(struct ural_amrr *amrr, struct ieee80211_node *ni)
1845 {
1846 	int need_change = 0;
1847 
1848 	if (is_success(amrr) && is_enough(amrr)) {
1849 		amrr->success++;
1850 		if (amrr->success >= amrr->success_threshold &&
1851 		    !is_max_rate(ni)) {
1852 			amrr->recovery = 1;
1853 			amrr->success = 0;
1854 			increase_rate(ni);
1855 			need_change = 1;
1856 		} else {
1857 			amrr->recovery = 0;
1858 		}
1859 	} else if (is_failure(amrr)) {
1860 		amrr->success = 0;
1861 		if (!is_min_rate(ni)) {
1862 			if (amrr->recovery) {
1863 				amrr->success_threshold *= 2;
1864 				if (amrr->success_threshold >
1865 				    URAL_AMRR_MAX_SUCCESS_THRESHOLD)
1866 					amrr->success_threshold =
1867 					    URAL_AMRR_MAX_SUCCESS_THRESHOLD;
1868 			} else {
1869 				amrr->success_threshold =
1870 				    URAL_AMRR_MIN_SUCCESS_THRESHOLD;
1871 			}
1872 			decrease_rate(ni);
1873 			need_change = 1;
1874 		}
1875 		amrr->recovery = 0;	/* original paper was incorrect */
1876 	}
1877 
1878 	if (is_enough(amrr) || need_change)
1879 		reset_cnt(amrr);
1880 }
1881 
1882 static void
1883 ural_amrr_timeout(void *arg)
1884 {
1885 	struct ural_softc *sc = (struct ural_softc *)arg;
1886 	struct ural_amrr *amrr = &sc->amrr;
1887 
1888 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
1889 
1890 	/* count TX retry-fail as Tx errors */
1891 	sc->sc_tx_err += sc->sta[9];
1892 	sc->sc_tx_retries += (sc->sta[7] + sc->sta[8]);
1893 
1894 	amrr->retrycnt =
1895 	    sc->sta[7] +	/* TX one-retry ok count */
1896 	    sc->sta[8] +	/* TX more-retry ok count */
1897 	    sc->sta[9];		/* TX retry-fail count */
1898 
1899 	amrr->txcnt =
1900 	    amrr->retrycnt +
1901 	    sc->sta[6];		/* TX no-retry ok count */
1902 
1903 	ural_ratectl(amrr, sc->sc_ic.ic_bss);
1904 
1905 	sc->sc_amrr_id = timeout(ural_amrr_timeout, (void *)sc,
1906 	    drv_usectohz(1000 * 1000)); /* 1 second */
1907 }
1908 
1909 
1910 static void
1911 ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
1912 {
1913 	struct ural_amrr *amrr = &sc->amrr;
1914 	int i;
1915 
1916 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1917 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
1918 
1919 	amrr->success = 0;
1920 	amrr->recovery = 0;
1921 	amrr->txcnt = amrr->retrycnt = 0;
1922 	amrr->success_threshold = URAL_AMRR_MIN_SUCCESS_THRESHOLD;
1923 
1924 	/* set rate to some reasonable initial value */
1925 	for (i = ni->in_rates.ir_nrates - 1;
1926 	    i > 0 && (ni->in_rates.ir_rates[i] & IEEE80211_RATE_VAL) > 72;
1927 	    i--) {
1928 	}
1929 
1930 	ni->in_txrate = i;
1931 
1932 	sc->sc_amrr_id = timeout(ural_amrr_timeout, (void *)sc,
1933 	    drv_usectohz(1000 * 1000)); /* 1 second */
1934 }
1935 
1936 void
1937 ural_watchdog(void *arg)
1938 {
1939 	struct ural_softc *sc = arg;
1940 	struct ieee80211com *ic = &sc->sc_ic;
1941 	int ntimer = 0;
1942 
1943 	RAL_LOCK(sc);
1944 	ic->ic_watchdog_timer = 0;
1945 
1946 	if (!RAL_IS_RUNNING(sc)) {
1947 		RAL_UNLOCK(sc);
1948 		return;
1949 	}
1950 
1951 	if (sc->sc_tx_timer > 0) {
1952 		if (--sc->sc_tx_timer == 0) {
1953 			RAL_DEBUG(RAL_DBG_ERR, "tx timer timeout\n");
1954 			RAL_UNLOCK(sc);
1955 			(void) ural_init(sc);
1956 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1957 			return;
1958 		}
1959 	}
1960 
1961 	if (ic->ic_state == IEEE80211_S_RUN)
1962 		ntimer = 1;
1963 
1964 	RAL_UNLOCK(sc);
1965 
1966 	ieee80211_watchdog(ic);
1967 
1968 	if (ntimer)
1969 		ieee80211_start_watchdog(ic, ntimer);
1970 }
1971 
1972 static int
1973 ural_m_start(void *arg)
1974 {
1975 	struct ural_softc *sc = (struct ural_softc *)arg;
1976 	crypto_mech_type_t type;
1977 	int err;
1978 
1979 
1980 	type = crypto_mech2id(SUN_CKM_RC4); /* load rc4 module into kernel */
1981 	RAL_DEBUG(RAL_DBG_MSG, "ural_m_start(%d)\n", type);
1982 
1983 	/*
1984 	 * initialize RT2500USB hardware
1985 	 */
1986 	err = ural_init(sc);
1987 	if (err != DDI_SUCCESS) {
1988 		RAL_DEBUG(RAL_DBG_ERR, "device configuration failed\n");
1989 		goto fail;
1990 	}
1991 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
1992 	return (err);
1993 
1994 fail:
1995 	ural_stop(sc);
1996 	return (err);
1997 }
1998 
1999 static void
2000 ural_m_stop(void *arg)
2001 {
2002 	struct ural_softc *sc = (struct ural_softc *)arg;
2003 
2004 	RAL_DEBUG(RAL_DBG_MSG, "ural_m_stop()\n");
2005 
2006 	(void) ural_stop(sc);
2007 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2008 }
2009 
2010 static int
2011 ural_m_unicst(void *arg, const uint8_t *macaddr)
2012 {
2013 	struct ural_softc *sc = (struct ural_softc *)arg;
2014 	struct ieee80211com *ic = &sc->sc_ic;
2015 
2016 	RAL_DEBUG(RAL_DBG_MSG, "ural_m_unicst(): " MACSTR "\n",
2017 	    MAC2STR(macaddr));
2018 
2019 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2020 	(void) ural_set_macaddr(sc, (uint8_t *)macaddr);
2021 	(void) ural_init(sc);
2022 
2023 	return (0);
2024 }
2025 
2026 /*ARGSUSED*/
2027 static int
2028 ural_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2029 {
2030 	return (0);
2031 }
2032 
2033 static int
2034 ural_m_promisc(void *arg, boolean_t on)
2035 {
2036 	struct ural_softc *sc = (struct ural_softc *)arg;
2037 
2038 	RAL_DEBUG(RAL_DBG_MSG, "ural_m_promisc()\n");
2039 
2040 	if (on) {
2041 		sc->sc_rcr |= RAL_RCR_PROMISC;
2042 		sc->sc_rcr |= RAL_RCR_MULTI;
2043 	} else {
2044 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2045 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2046 	}
2047 
2048 	ural_update_promisc(sc);
2049 	return (0);
2050 }
2051 
2052 /*
2053  * callback functions for /get/set properties
2054  */
2055 static int
2056 ural_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2057     uint_t wldp_length, const void *wldp_buf)
2058 {
2059 	struct ural_softc *sc = (struct ural_softc *)arg;
2060 	struct ieee80211com *ic = &sc->sc_ic;
2061 	int err;
2062 
2063 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2064 	    wldp_length, wldp_buf);
2065 	RAL_LOCK(sc);
2066 	if (err == ENETRESET) {
2067 		if (RAL_IS_RUNNING(sc)) {
2068 			RAL_UNLOCK(sc);
2069 			(void) ural_init(sc);
2070 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2071 			RAL_LOCK(sc);
2072 		}
2073 		err = 0;
2074 	}
2075 	RAL_UNLOCK(sc);
2076 
2077 	return (err);
2078 }
2079 
2080 static int
2081 ural_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2082     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2083 {
2084 	struct ural_softc *sc = (struct ural_softc *)arg;
2085 	int err;
2086 
2087 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2088 	    pr_flags, wldp_length, wldp_buf, perm);
2089 
2090 	return (err);
2091 }
2092 
2093 static void
2094 ural_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2095 {
2096 	struct ural_softc *sc = (struct ural_softc *)arg;
2097 	struct ieee80211com *ic = &sc->sc_ic;
2098 	int err;
2099 
2100 	err = ieee80211_ioctl(ic, wq, mp);
2101 	RAL_LOCK(sc);
2102 	if (err == ENETRESET) {
2103 		if (RAL_IS_RUNNING(sc)) {
2104 			RAL_UNLOCK(sc);
2105 			(void) ural_init(sc);
2106 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2107 			RAL_LOCK(sc);
2108 		}
2109 	}
2110 	RAL_UNLOCK(sc);
2111 }
2112 
2113 static int
2114 ural_m_stat(void *arg, uint_t stat, uint64_t *val)
2115 {
2116 	struct ural_softc *sc  = (struct ural_softc *)arg;
2117 	ieee80211com_t	*ic = &sc->sc_ic;
2118 	ieee80211_node_t *ni = ic->ic_bss;
2119 	struct ieee80211_rateset *rs = &ni->in_rates;
2120 
2121 	RAL_LOCK(sc);
2122 	switch (stat) {
2123 	case MAC_STAT_IFSPEED:
2124 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2125 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2126 		    : ic->ic_fixed_rate) / 2 * 1000000;
2127 		break;
2128 	case MAC_STAT_NOXMTBUF:
2129 		*val = sc->sc_tx_nobuf;
2130 		break;
2131 	case MAC_STAT_NORCVBUF:
2132 		*val = sc->sc_rx_nobuf;
2133 		break;
2134 	case MAC_STAT_IERRORS:
2135 		*val = sc->sc_rx_err;
2136 		break;
2137 	case MAC_STAT_RBYTES:
2138 		*val = ic->ic_stats.is_rx_bytes;
2139 		break;
2140 	case MAC_STAT_IPACKETS:
2141 		*val = ic->ic_stats.is_rx_frags;
2142 		break;
2143 	case MAC_STAT_OBYTES:
2144 		*val = ic->ic_stats.is_tx_bytes;
2145 		break;
2146 	case MAC_STAT_OPACKETS:
2147 		*val = ic->ic_stats.is_tx_frags;
2148 		break;
2149 	case MAC_STAT_OERRORS:
2150 	case WIFI_STAT_TX_FAILED:
2151 		*val = sc->sc_tx_err;
2152 		break;
2153 	case WIFI_STAT_TX_RETRANS:
2154 		*val = sc->sc_tx_retries;
2155 		break;
2156 	case WIFI_STAT_FCS_ERRORS:
2157 	case WIFI_STAT_WEP_ERRORS:
2158 	case WIFI_STAT_TX_FRAGS:
2159 	case WIFI_STAT_MCAST_TX:
2160 	case WIFI_STAT_RTS_SUCCESS:
2161 	case WIFI_STAT_RTS_FAILURE:
2162 	case WIFI_STAT_ACK_FAILURE:
2163 	case WIFI_STAT_RX_FRAGS:
2164 	case WIFI_STAT_MCAST_RX:
2165 	case WIFI_STAT_RX_DUPS:
2166 		RAL_UNLOCK(sc);
2167 		return (ieee80211_stat(ic, stat, val));
2168 	default:
2169 		RAL_UNLOCK(sc);
2170 		return (ENOTSUP);
2171 	}
2172 	RAL_UNLOCK(sc);
2173 
2174 	return (0);
2175 }
2176 
2177 
2178 static int
2179 ural_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2180 {
2181 	struct ural_softc *sc;
2182 	struct ieee80211com *ic;
2183 	int err, i;
2184 	int instance;
2185 
2186 	char strbuf[32];
2187 
2188 	wifi_data_t wd = { 0 };
2189 	mac_register_t *macp;
2190 
2191 	RAL_DEBUG(RAL_DBG_MSG, "ural_attach()\n");
2192 
2193 	if (cmd != DDI_ATTACH)
2194 		return (DDI_FAILURE);
2195 
2196 	instance = ddi_get_instance(devinfo);
2197 
2198 	if (ddi_soft_state_zalloc(ural_soft_state_p, instance) != DDI_SUCCESS) {
2199 		RAL_DEBUG(RAL_DBG_MSG, "ural_attach(): "
2200 		    "unable to alloc soft_state_p\n");
2201 		return (DDI_FAILURE);
2202 	}
2203 
2204 	sc = ddi_get_soft_state(ural_soft_state_p, instance);
2205 	ic = (ieee80211com_t *)&sc->sc_ic;
2206 	sc->sc_dev = devinfo;
2207 
2208 	if (usb_client_attach(devinfo, USBDRV_VERSION, 0) != USB_SUCCESS) {
2209 		RAL_DEBUG(RAL_DBG_ERR,
2210 		    "ural_attach(): usb_client_attach failed\n");
2211 		goto fail1;
2212 	}
2213 
2214 	if (usb_get_dev_data(devinfo, &sc->sc_udev,
2215 	    USB_PARSE_LVL_ALL, 0) != USB_SUCCESS) {
2216 		sc->sc_udev = NULL;
2217 		goto fail2;
2218 	}
2219 
2220 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2221 	mutex_init(&sc->tx_lock, NULL, MUTEX_DRIVER, NULL);
2222 	mutex_init(&sc->rx_lock, NULL, MUTEX_DRIVER, NULL);
2223 
2224 	/* retrieve RT2570 rev. no */
2225 	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
2226 
2227 	/* retrieve MAC address and various other things from EEPROM */
2228 	ural_read_eeprom(sc);
2229 
2230 	RAL_DEBUG(RAL_DBG_MSG, "ural: MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
2231 	    sc->asic_rev, ural_get_rf(sc->rf_rev));
2232 
2233 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2234 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2235 	ic->ic_state = IEEE80211_S_INIT;
2236 
2237 	ic->ic_maxrssi = 63;
2238 	ic->ic_set_shortslot = ural_update_slot;
2239 	ic->ic_xmit = ural_send;
2240 
2241 	/* set device capabilities */
2242 	ic->ic_caps =
2243 	    IEEE80211_C_TXPMGT |	/* tx power management */
2244 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2245 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2246 
2247 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2248 
2249 #define	IEEE80211_CHAN_A	\
2250 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2251 
2252 	if (sc->rf_rev == RAL_RF_5222) {
2253 		/* set supported .11a rates */
2254 		ic->ic_sup_rates[IEEE80211_MODE_11A] = ural_rateset_11a;
2255 
2256 		/* set supported .11a channels */
2257 		for (i = 36; i <= 64; i += 4) {
2258 			ic->ic_sup_channels[i].ich_freq =
2259 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2260 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2261 		}
2262 		for (i = 100; i <= 140; i += 4) {
2263 			ic->ic_sup_channels[i].ich_freq =
2264 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2265 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2266 		}
2267 		for (i = 149; i <= 161; i += 4) {
2268 			ic->ic_sup_channels[i].ich_freq =
2269 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2270 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2271 		}
2272 	}
2273 
2274 	/* set supported .11b and .11g rates */
2275 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ural_rateset_11b;
2276 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ural_rateset_11g;
2277 
2278 	/* set supported .11b and .11g channels (1 through 14) */
2279 	for (i = 1; i <= 14; i++) {
2280 		ic->ic_sup_channels[i].ich_freq =
2281 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2282 		ic->ic_sup_channels[i].ich_flags =
2283 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2284 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2285 	}
2286 
2287 	ieee80211_attach(ic);
2288 
2289 	/* register WPA door */
2290 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2291 	    ddi_get_instance(devinfo));
2292 
2293 	/* override state transition machine */
2294 	sc->sc_newstate = ic->ic_newstate;
2295 	ic->ic_newstate = ural_newstate;
2296 	ic->ic_watchdog = ural_watchdog;
2297 	ieee80211_media_init(ic);
2298 	ic->ic_def_txkey = 0;
2299 
2300 	sc->sc_rcr = 0;
2301 	sc->dwelltime = 300;
2302 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2303 
2304 	/*
2305 	 * Provide initial settings for the WiFi plugin; whenever this
2306 	 * information changes, we need to call mac_plugindata_update()
2307 	 */
2308 	wd.wd_opmode = ic->ic_opmode;
2309 	wd.wd_secalloc = WIFI_SEC_NONE;
2310 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2311 
2312 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2313 		RAL_DEBUG(RAL_DBG_ERR, "ural_attach(): "
2314 		    "MAC version mismatch\n");
2315 		goto fail3;
2316 	}
2317 
2318 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2319 	macp->m_driver		= sc;
2320 	macp->m_dip		= devinfo;
2321 	macp->m_src_addr	= ic->ic_macaddr;
2322 	macp->m_callbacks	= &ural_m_callbacks;
2323 	macp->m_min_sdu		= 0;
2324 	macp->m_max_sdu		= IEEE80211_MTU;
2325 	macp->m_pdata		= &wd;
2326 	macp->m_pdata_size	= sizeof (wd);
2327 
2328 	err = mac_register(macp, &ic->ic_mach);
2329 	mac_free(macp);
2330 	if (err != 0) {
2331 		RAL_DEBUG(RAL_DBG_ERR, "ural_attach(): "
2332 		    "mac_register() err %x\n", err);
2333 		goto fail3;
2334 	}
2335 
2336 	if (usb_register_hotplug_cbs(devinfo, ural_offline,
2337 	    ural_online) != USB_SUCCESS) {
2338 		RAL_DEBUG(RAL_DBG_ERR,
2339 		    "ural: ural_attach() failed to register events");
2340 		goto fail4;
2341 	}
2342 
2343 	/*
2344 	 * Create minor node of type DDI_NT_NET_WIFI
2345 	 */
2346 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2347 	    "ural", instance);
2348 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2349 	    instance + 1, DDI_NT_NET_WIFI, 0);
2350 
2351 	if (err != DDI_SUCCESS)
2352 		RAL_DEBUG(RAL_DBG_ERR, "ddi_create_minor_node() failed\n");
2353 
2354 	/*
2355 	 * Notify link is down now
2356 	 */
2357 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2358 
2359 	RAL_DEBUG(RAL_DBG_MSG, "ural_attach() done successfully.\n");
2360 	return (DDI_SUCCESS);
2361 fail4:
2362 	(void) mac_unregister(ic->ic_mach);
2363 fail3:
2364 	mutex_destroy(&sc->sc_genlock);
2365 	mutex_destroy(&sc->tx_lock);
2366 	mutex_destroy(&sc->rx_lock);
2367 fail2:
2368 	usb_client_detach(sc->sc_dev, sc->sc_udev);
2369 fail1:
2370 	ddi_soft_state_free(ural_soft_state_p, ddi_get_instance(devinfo));
2371 
2372 	return (DDI_FAILURE);
2373 }
2374 
2375 static int
2376 ural_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2377 {
2378 	struct ural_softc *sc;
2379 
2380 	RAL_DEBUG(RAL_DBG_MSG, "ural_detach()\n");
2381 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
2382 
2383 	if (cmd != DDI_DETACH)
2384 		return (DDI_FAILURE);
2385 
2386 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2387 		return (DDI_FAILURE);
2388 
2389 	ural_stop(sc);
2390 	usb_unregister_hotplug_cbs(devinfo);
2391 
2392 	/*
2393 	 * Unregister from the MAC layer subsystem
2394 	 */
2395 	(void) mac_unregister(sc->sc_ic.ic_mach);
2396 
2397 	/*
2398 	 * detach ieee80211 layer
2399 	 */
2400 	ieee80211_detach(&sc->sc_ic);
2401 
2402 	mutex_destroy(&sc->sc_genlock);
2403 	mutex_destroy(&sc->tx_lock);
2404 	mutex_destroy(&sc->rx_lock);
2405 
2406 	/* pipes will be close in ural_stop() */
2407 	usb_client_detach(devinfo, sc->sc_udev);
2408 	sc->sc_udev = NULL;
2409 
2410 	ddi_remove_minor_node(devinfo, NULL);
2411 	ddi_soft_state_free(ural_soft_state_p, ddi_get_instance(devinfo));
2412 
2413 	return (DDI_SUCCESS);
2414 }
2415 
2416 int
2417 _info(struct modinfo *modinfop)
2418 {
2419 	return (mod_info(&modlinkage, modinfop));
2420 }
2421 
2422 int
2423 _init(void)
2424 {
2425 	int status;
2426 
2427 	status = ddi_soft_state_init(&ural_soft_state_p,
2428 	    sizeof (struct ural_softc), 1);
2429 	if (status != 0)
2430 		return (status);
2431 
2432 	mac_init_ops(&ural_dev_ops, "ural");
2433 	status = mod_install(&modlinkage);
2434 	if (status != 0) {
2435 		mac_fini_ops(&ural_dev_ops);
2436 		ddi_soft_state_fini(&ural_soft_state_p);
2437 	}
2438 	return (status);
2439 }
2440 
2441 int
2442 _fini(void)
2443 {
2444 	int status;
2445 
2446 	status = mod_remove(&modlinkage);
2447 	if (status == 0) {
2448 		mac_fini_ops(&ural_dev_ops);
2449 		ddi_soft_state_fini(&ural_soft_state_p);
2450 	}
2451 	return (status);
2452 }
2453