xref: /titanic_51/usr/src/uts/common/io/ural/ural.c (revision 4df55fde49134f9735f84011f23a767c75e393c7)
1 /*
2  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005, 2006
8  *	Damien Bergamini <damien.bergamini@free.fr>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2500USB chipset driver
25  * http://www.ralinktech.com/
26  */
27 #include <sys/types.h>
28 #include <sys/cmn_err.h>
29 #include <sys/strsubr.h>
30 #include <sys/modctl.h>
31 #include <sys/devops.h>
32 #include <sys/mac_provider.h>
33 #include <sys/mac_wifi.h>
34 #include <sys/net80211.h>
35 
36 #define	USBDRV_MAJOR_VER	2
37 #define	USBDRV_MINOR_VER	0
38 #include <sys/usb/usba.h>
39 #include <sys/usb/usba/usba_types.h>
40 
41 #include "ural_reg.h"
42 #include "ural_var.h"
43 
44 static void *ural_soft_state_p = NULL;
45 
46 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
47 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
48 
49 /* quickly determine if a given rate is CCK or OFDM */
50 #define	RAL_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
51 #define	RAL_ACK_SIZE		14	/* 10 + 4(FCS) */
52 #define	RAL_CTS_SIZE		14	/* 10 + 4(FCS) */
53 #define	RAL_SIFS		10	/* us */
54 #define	RAL_RXTX_TURNAROUND	5	/* us */
55 
56 #define	URAL_N(a)		(sizeof (a) / sizeof ((a)[0]))
57 
58 /*
59  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
60  */
61 static const struct ieee80211_rateset ural_rateset_11a =
62 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
63 
64 static const struct ieee80211_rateset ural_rateset_11b =
65 	{ 4, { 2, 4, 11, 22 } };
66 
67 static const struct ieee80211_rateset ural_rateset_11g =
68 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
69 
70 /*
71  * Default values for MAC registers; values taken from the reference driver.
72  */
73 static const struct {
74 	uint16_t	reg;
75 	uint16_t	val;
76 } ural_def_mac[] = {
77 	{ RAL_TXRX_CSR5,  0x8c8d },
78 	{ RAL_TXRX_CSR6,  0x8b8a },
79 	{ RAL_TXRX_CSR7,  0x8687 },
80 	{ RAL_TXRX_CSR8,  0x0085 },
81 	{ RAL_MAC_CSR13,  0x1111 },
82 	{ RAL_MAC_CSR14,  0x1e11 },
83 	{ RAL_TXRX_CSR21, 0xe78f },
84 	{ RAL_MAC_CSR9,   0xff1d },
85 	{ RAL_MAC_CSR11,  0x0002 },
86 	{ RAL_MAC_CSR22,  0x0053 },
87 	{ RAL_MAC_CSR15,  0x0000 },
88 	{ RAL_MAC_CSR8,   0x0780 },
89 	{ RAL_TXRX_CSR19, 0x0000 },
90 	{ RAL_TXRX_CSR18, 0x005a },
91 	{ RAL_PHY_CSR2,   0x0000 },
92 	{ RAL_TXRX_CSR0,  0x1ec0 },
93 	{ RAL_PHY_CSR4,   0x000f }
94 };
95 
96 /*
97  * Default values for BBP registers; values taken from the reference driver.
98  */
99 static const struct {
100 	uint8_t	reg;
101 	uint8_t	val;
102 } ural_def_bbp[] = {
103 	{  3, 0x02 },
104 	{  4, 0x19 },
105 	{ 14, 0x1c },
106 	{ 15, 0x30 },
107 	{ 16, 0xac },
108 	{ 17, 0x48 },
109 	{ 18, 0x18 },
110 	{ 19, 0xff },
111 	{ 20, 0x1e },
112 	{ 21, 0x08 },
113 	{ 22, 0x08 },
114 	{ 23, 0x08 },
115 	{ 24, 0x80 },
116 	{ 25, 0x50 },
117 	{ 26, 0x08 },
118 	{ 27, 0x23 },
119 	{ 30, 0x10 },
120 	{ 31, 0x2b },
121 	{ 32, 0xb9 },
122 	{ 34, 0x12 },
123 	{ 35, 0x50 },
124 	{ 39, 0xc4 },
125 	{ 40, 0x02 },
126 	{ 41, 0x60 },
127 	{ 53, 0x10 },
128 	{ 54, 0x18 },
129 	{ 56, 0x08 },
130 	{ 57, 0x10 },
131 	{ 58, 0x08 },
132 	{ 61, 0x60 },
133 	{ 62, 0x10 },
134 	{ 75, 0xff }
135 };
136 
137 /*
138  * Default values for RF register R2 indexed by channel numbers.
139  */
140 static const uint32_t ural_rf2522_r2[] = {
141 	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
142 	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
143 };
144 
145 static const uint32_t ural_rf2523_r2[] = {
146 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
147 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
148 };
149 
150 static const uint32_t ural_rf2524_r2[] = {
151 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
152 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
153 };
154 
155 static const uint32_t ural_rf2525_r2[] = {
156 	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
157 	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
158 };
159 
160 static const uint32_t ural_rf2525_hi_r2[] = {
161 	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
162 	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
163 };
164 
165 static const uint32_t ural_rf2525e_r2[] = {
166 	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
167 	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
168 };
169 
170 static const uint32_t ural_rf2526_hi_r2[] = {
171 	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
172 	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
173 };
174 
175 static const uint32_t ural_rf2526_r2[] = {
176 	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
177 	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
178 };
179 
180 /*
181  * For dual-band RF, RF registers R1 and R4 also depend on channel number;
182  * values taken from the reference driver.
183  */
184 static const struct {
185 	uint8_t		chan;
186 	uint32_t	r1;
187 	uint32_t	r2;
188 	uint32_t	r4;
189 } ural_rf5222[] = {
190 	{   1, 0x08808, 0x0044d, 0x00282 },
191 	{   2, 0x08808, 0x0044e, 0x00282 },
192 	{   3, 0x08808, 0x0044f, 0x00282 },
193 	{   4, 0x08808, 0x00460, 0x00282 },
194 	{   5, 0x08808, 0x00461, 0x00282 },
195 	{   6, 0x08808, 0x00462, 0x00282 },
196 	{   7, 0x08808, 0x00463, 0x00282 },
197 	{   8, 0x08808, 0x00464, 0x00282 },
198 	{   9, 0x08808, 0x00465, 0x00282 },
199 	{  10, 0x08808, 0x00466, 0x00282 },
200 	{  11, 0x08808, 0x00467, 0x00282 },
201 	{  12, 0x08808, 0x00468, 0x00282 },
202 	{  13, 0x08808, 0x00469, 0x00282 },
203 	{  14, 0x08808, 0x0046b, 0x00286 },
204 
205 	{  36, 0x08804, 0x06225, 0x00287 },
206 	{  40, 0x08804, 0x06226, 0x00287 },
207 	{  44, 0x08804, 0x06227, 0x00287 },
208 	{  48, 0x08804, 0x06228, 0x00287 },
209 	{  52, 0x08804, 0x06229, 0x00287 },
210 	{  56, 0x08804, 0x0622a, 0x00287 },
211 	{  60, 0x08804, 0x0622b, 0x00287 },
212 	{  64, 0x08804, 0x0622c, 0x00287 },
213 
214 	{ 100, 0x08804, 0x02200, 0x00283 },
215 	{ 104, 0x08804, 0x02201, 0x00283 },
216 	{ 108, 0x08804, 0x02202, 0x00283 },
217 	{ 112, 0x08804, 0x02203, 0x00283 },
218 	{ 116, 0x08804, 0x02204, 0x00283 },
219 	{ 120, 0x08804, 0x02205, 0x00283 },
220 	{ 124, 0x08804, 0x02206, 0x00283 },
221 	{ 128, 0x08804, 0x02207, 0x00283 },
222 	{ 132, 0x08804, 0x02208, 0x00283 },
223 	{ 136, 0x08804, 0x02209, 0x00283 },
224 	{ 140, 0x08804, 0x0220a, 0x00283 },
225 
226 	{ 149, 0x08808, 0x02429, 0x00281 },
227 	{ 153, 0x08808, 0x0242b, 0x00281 },
228 	{ 157, 0x08808, 0x0242d, 0x00281 },
229 	{ 161, 0x08808, 0x0242f, 0x00281 }
230 };
231 
232 /*
233  * device operations
234  */
235 static int ural_attach(dev_info_t *, ddi_attach_cmd_t);
236 static int ural_detach(dev_info_t *, ddi_detach_cmd_t);
237 
238 /*
239  * Module Loading Data & Entry Points
240  */
241 DDI_DEFINE_STREAM_OPS(ural_dev_ops, nulldev, nulldev, ural_attach,
242     ural_detach, nodev, NULL, D_MP, NULL, ddi_quiesce_not_needed);
243 
244 static struct modldrv ural_modldrv = {
245 	&mod_driverops,		/* Type of module.  This one is a driver */
246 	"ural driver v1.4",	/* short description */
247 	&ural_dev_ops		/* driver specific ops */
248 };
249 
250 static struct modlinkage modlinkage = {
251 	MODREV_1,
252 	(void *)&ural_modldrv,
253 	NULL
254 };
255 
256 static int	ural_m_stat(void *,  uint_t, uint64_t *);
257 static int	ural_m_start(void *);
258 static void	ural_m_stop(void *);
259 static int	ural_m_promisc(void *, boolean_t);
260 static int	ural_m_multicst(void *, boolean_t, const uint8_t *);
261 static int	ural_m_unicst(void *, const uint8_t *);
262 static mblk_t	*ural_m_tx(void *, mblk_t *);
263 static void	ural_m_ioctl(void *, queue_t *, mblk_t *);
264 static int	ural_m_setprop(void *, const char *, mac_prop_id_t,
265     uint_t, const void *);
266 static int	ural_m_getprop(void *, const char *, mac_prop_id_t,
267     uint_t, uint_t, void *, uint_t *);
268 
269 static mac_callbacks_t ural_m_callbacks = {
270 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
271 	ural_m_stat,
272 	ural_m_start,
273 	ural_m_stop,
274 	ural_m_promisc,
275 	ural_m_multicst,
276 	ural_m_unicst,
277 	ural_m_tx,
278 	ural_m_ioctl,
279 	NULL,		/* mc_getcapab */
280 	NULL,
281 	NULL,
282 	ural_m_setprop,
283 	ural_m_getprop
284 };
285 
286 static void ural_amrr_start(struct ural_softc *, struct ieee80211_node *);
287 static int  ural_tx_trigger(struct ural_softc *, mblk_t *);
288 static int  ural_rx_trigger(struct ural_softc *);
289 
290 uint32_t ural_dbg_flags = 0;
291 
292 void
293 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
294 {
295 	va_list args;
296 
297 	if (dbg_flags & ural_dbg_flags) {
298 		va_start(args, fmt);
299 		vcmn_err(CE_CONT, fmt, args);
300 		va_end(args);
301 	}
302 }
303 
304 static uint16_t
305 ural_read(struct ural_softc *sc, uint16_t reg)
306 {
307 	usb_ctrl_setup_t req;
308 	usb_cr_t cr;
309 	usb_cb_flags_t cf;
310 	mblk_t *mp;
311 	int err;
312 	uint16_t val;
313 
314 	bzero(&req, sizeof (req));
315 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
316 	req.bRequest = RAL_READ_MAC;
317 	req.wValue = 0;
318 	req.wIndex = reg;
319 	req.wLength = sizeof (uint16_t);
320 
321 	mp = NULL;
322 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
323 	    &cr, &cf, 0);
324 
325 	if (err != USB_SUCCESS) {
326 		ral_debug(RAL_DBG_ERR,
327 		    "ural_read(): could not read MAC register:"
328 		    " cr:%s(%d), cf:(%x)\n",
329 		    usb_str_cr(cr), cr, cf);
330 		return (0);
331 	}
332 
333 	bcopy(mp->b_rptr, &val, sizeof (uint16_t));
334 
335 	if (mp)
336 		freemsg(mp);
337 
338 	return (LE_16(val));
339 }
340 
341 static void
342 ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
343 {
344 	usb_ctrl_setup_t req;
345 	usb_cr_t cr;
346 	usb_cb_flags_t cf;
347 	mblk_t *mp;
348 	int err;
349 
350 	bzero(&req, sizeof (req));
351 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
352 	req.bRequest = RAL_READ_MULTI_MAC;
353 	req.wValue = 0;
354 	req.wIndex = reg;
355 	req.wLength = (uint16_t)len;
356 	req.attrs = USB_ATTRS_AUTOCLEARING;
357 
358 	mp = NULL;
359 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
360 	    &cr, &cf, 0);
361 
362 	if (err != USB_SUCCESS) {
363 		ral_debug(RAL_DBG_ERR,
364 		    "ural_read_multi(): could not read MAC register:"
365 		    "cr:%s(%d), cf:(%x)\n",
366 		    usb_str_cr(cr), cr, cf);
367 		return;
368 	}
369 
370 	bcopy(mp->b_rptr, buf, len);
371 
372 	if (mp)
373 		freemsg(mp);
374 }
375 
376 static void
377 ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
378 {
379 	usb_ctrl_setup_t req;
380 	usb_cr_t cr;
381 	usb_cb_flags_t cf;
382 	int err;
383 
384 	bzero(&req, sizeof (req));
385 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
386 	req.bRequest = RAL_WRITE_MAC;
387 	req.wValue = val;
388 	req.wIndex = reg;
389 	req.wLength = 0;
390 	req.attrs = USB_ATTRS_NONE;
391 
392 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
393 	    &cr, &cf, 0);
394 
395 	if (err != USB_SUCCESS) {
396 		ral_debug(RAL_DBG_ERR,
397 		    "ural_write(): could not write MAC register:"
398 		    "cr:%s(%d), cf:(%x)\n",
399 		    usb_str_cr(cr), cr, cf);
400 	}
401 }
402 
403 /* ARGSUSED */
404 static void
405 ural_txeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
406 {
407 	struct ural_softc *sc = (struct ural_softc *)req->bulk_client_private;
408 	struct ieee80211com *ic = &sc->sc_ic;
409 
410 	ral_debug(RAL_DBG_TX,
411 	    "ural_txeof(): cr:%s(%d), flags:0x%x, tx_queued:%d",
412 	    usb_str_cr(req->bulk_completion_reason),
413 	    req->bulk_completion_reason,
414 	    req->bulk_cb_flags,
415 	    sc->tx_queued);
416 
417 	if (req->bulk_completion_reason != USB_CR_OK)
418 		sc->sc_tx_err++;
419 
420 	mutex_enter(&sc->tx_lock);
421 
422 	sc->tx_queued--;
423 	sc->sc_tx_timer = 0;
424 
425 	if (sc->sc_need_sched) {
426 		sc->sc_need_sched = 0;
427 		mac_tx_update(ic->ic_mach);
428 	}
429 
430 	mutex_exit(&sc->tx_lock);
431 	usb_free_bulk_req(req);
432 }
433 
434 /* ARGSUSED */
435 static void
436 ural_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
437 {
438 	struct ural_softc *sc = (struct ural_softc *)req->bulk_client_private;
439 	struct ieee80211com *ic = &sc->sc_ic;
440 
441 	struct ural_rx_desc *desc;
442 	struct ieee80211_frame *wh;
443 	struct ieee80211_node *ni;
444 
445 	mblk_t *m, *mp;
446 	int len, pktlen;
447 	char *rxbuf;
448 
449 	mp = req->bulk_data;
450 	req->bulk_data = NULL;
451 
452 	ral_debug(RAL_DBG_RX,
453 	    "ural_rxeof(): cr:%s(%d), flags:0x%x, rx_queued:%d",
454 	    usb_str_cr(req->bulk_completion_reason),
455 	    req->bulk_completion_reason,
456 	    req->bulk_cb_flags,
457 	    sc->rx_queued);
458 
459 	if (req->bulk_completion_reason != USB_CR_OK) {
460 		sc->sc_rx_err++;
461 		goto fail;
462 	}
463 
464 	len = (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
465 	rxbuf = (char *)mp->b_rptr;
466 
467 	if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
468 		ral_debug(RAL_DBG_ERR,
469 		    "ural_rxeof(): xfer too short %d\n", len);
470 		sc->sc_rx_err++;
471 		goto fail;
472 	}
473 
474 	/* rx descriptor is located at the end */
475 	desc = (struct ural_rx_desc *)(rxbuf + len - RAL_RX_DESC_SIZE);
476 
477 	if ((LE_32(desc->flags) & RAL_RX_PHY_ERROR) ||
478 	    (LE_32(desc->flags) & RAL_RX_CRC_ERROR)) {
479 		/*
480 		 * This should not happen since we did not request to receive
481 		 * those frames when we filled RAL_TXRX_CSR2.
482 		 */
483 		ral_debug(RAL_DBG_ERR, "PHY or CRC error\n");
484 		sc->sc_rx_err++;
485 		goto fail;
486 	}
487 
488 	pktlen = (LE_32(desc->flags) >> 16) & 0xfff;
489 
490 	if (pktlen > (len - RAL_RX_DESC_SIZE)) {
491 		ral_debug(RAL_DBG_ERR,
492 		    "ural_rxeof(): pktlen mismatch <%d, %d>.\n", pktlen, len);
493 		goto fail;
494 	}
495 
496 	/* Strip trailing 802.11 MAC FCS. */
497 	pktlen -= IEEE80211_CRC_LEN;
498 
499 	if ((m = allocb(pktlen, BPRI_MED)) == NULL) {
500 		ral_debug(RAL_DBG_ERR,
501 		    "ural_rxeof(): allocate mblk failed.\n");
502 		sc->sc_rx_nobuf++;
503 		goto fail;
504 	}
505 
506 	bcopy(rxbuf, m->b_rptr, pktlen);
507 	m->b_wptr += pktlen;
508 
509 	wh = (struct ieee80211_frame *)m->b_rptr;
510 	ni = ieee80211_find_rxnode(ic, wh);
511 
512 	/* send the frame to the 802.11 layer */
513 	(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
514 
515 	/* node is no longer needed */
516 	ieee80211_free_node(ni);
517 fail:
518 	mutex_enter(&sc->rx_lock);
519 	sc->rx_queued--;
520 	mutex_exit(&sc->rx_lock);
521 
522 	freemsg(mp);
523 	usb_free_bulk_req(req);
524 
525 	if (RAL_IS_RUNNING(sc))
526 		(void) ural_rx_trigger(sc);
527 }
528 
529 /*
530  * Return the expected ack rate for a frame transmitted at rate `rate'.
531  * this should depend on the destination node basic rate set.
532  */
533 static int
534 ural_ack_rate(struct ieee80211com *ic, int rate)
535 {
536 	switch (rate) {
537 	/* CCK rates */
538 	case 2:
539 		return (2);
540 	case 4:
541 	case 11:
542 	case 22:
543 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
544 
545 	/* OFDM rates */
546 	case 12:
547 	case 18:
548 		return (12);
549 	case 24:
550 	case 36:
551 		return (24);
552 	case 48:
553 	case 72:
554 	case 96:
555 	case 108:
556 		return (48);
557 	}
558 
559 	/* default to 1Mbps */
560 	return (2);
561 }
562 
563 /*
564  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
565  * The function automatically determines the operating mode depending on the
566  * given rate. `flags' indicates whether short preamble is in use or not.
567  */
568 static uint16_t
569 ural_txtime(int len, int rate, uint32_t flags)
570 {
571 	uint16_t txtime;
572 
573 	if (RAL_RATE_IS_OFDM(rate)) {
574 		/* IEEE Std 802.11a-1999, pp. 37 */
575 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
576 		txtime = 16 + 4 + 4 * txtime + 6;
577 	} else {
578 		/* IEEE Std 802.11b-1999, pp. 28 */
579 		txtime = (16 * len + rate - 1) / rate;
580 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
581 			txtime +=  72 + 24;
582 		else
583 			txtime += 144 + 48;
584 	}
585 	return (txtime);
586 }
587 
588 static uint8_t
589 ural_plcp_signal(int rate)
590 {
591 	switch (rate) {
592 	/* CCK rates (returned values are device-dependent) */
593 	case 2:		return (0x0);
594 	case 4:		return (0x1);
595 	case 11:	return (0x2);
596 	case 22:	return (0x3);
597 
598 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
599 	case 12:	return (0xb);
600 	case 18:	return (0xf);
601 	case 24:	return (0xa);
602 	case 36:	return (0xe);
603 	case 48:	return (0x9);
604 	case 72:	return (0xd);
605 	case 96:	return (0x8);
606 	case 108:	return (0xc);
607 
608 	/* unsupported rates (should not get there) */
609 	default:	return (0xff);
610 	}
611 }
612 
613 static void
614 ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
615     uint32_t flags, int len, int rate)
616 {
617 	struct ieee80211com *ic = &sc->sc_ic;
618 	uint16_t plcp_length;
619 	int remainder;
620 
621 	desc->flags = LE_32(flags);
622 	desc->flags |= LE_32(RAL_TX_NEWSEQ);
623 	desc->flags |= LE_32(len << 16);
624 
625 	desc->wme = LE_16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
626 	desc->wme |= LE_16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
627 
628 	/* setup PLCP fields */
629 	desc->plcp_signal  = ural_plcp_signal(rate);
630 	desc->plcp_service = 4;
631 
632 	len += IEEE80211_CRC_LEN;
633 	if (RAL_RATE_IS_OFDM(rate)) {
634 		desc->flags |= LE_32(RAL_TX_OFDM);
635 
636 		plcp_length = len & 0xfff;
637 		desc->plcp_length_hi = plcp_length >> 6;
638 		desc->plcp_length_lo = plcp_length & 0x3f;
639 	} else {
640 		plcp_length = (16 * len + rate - 1) / rate;
641 		if (rate == 22) {
642 			remainder = (16 * len) % 22;
643 			if (remainder != 0 && remainder < 7)
644 				desc->plcp_service |= RAL_PLCP_LENGEXT;
645 		}
646 		desc->plcp_length_hi = plcp_length >> 8;
647 		desc->plcp_length_lo = plcp_length & 0xff;
648 
649 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
650 			desc->plcp_signal |= 0x08;
651 	}
652 
653 	desc->iv = 0;
654 	desc->eiv = 0;
655 }
656 
657 #define	RAL_TX_TIMEOUT		5
658 
659 static int
660 ural_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
661 {
662 	struct ural_softc *sc = (struct ural_softc *)ic;
663 	struct ural_tx_desc *desc;
664 
665 	struct ieee80211_frame *wh;
666 	struct ieee80211_key *k;
667 
668 	uint16_t dur;
669 	uint32_t flags = 0;
670 	int rate, err = DDI_SUCCESS;
671 
672 	struct ieee80211_node *ni = NULL;
673 	mblk_t *m, *m0;
674 	int off, mblen, pktlen, xferlen;
675 
676 	/* discard packets while suspending or not inited */
677 	if (!RAL_IS_RUNNING(sc)) {
678 		freemsg(mp);
679 		return (ENXIO);
680 	}
681 
682 	mutex_enter(&sc->tx_lock);
683 
684 	if (sc->tx_queued > RAL_TX_LIST_COUNT) {
685 		ral_debug(RAL_DBG_TX, "ural_send(): "
686 		    "no TX buffer available!\n");
687 		if ((type & IEEE80211_FC0_TYPE_MASK) ==
688 		    IEEE80211_FC0_TYPE_DATA) {
689 			sc->sc_need_sched = 1;
690 		}
691 		sc->sc_tx_nobuf++;
692 		err = ENOMEM;
693 		goto fail;
694 	}
695 
696 	m = allocb(RAL_TXBUF_SIZE + RAL_TX_DESC_SIZE, BPRI_MED);
697 	if (m == NULL) {
698 		ral_debug(RAL_DBG_ERR, "ural_send(): can't alloc mblk.\n");
699 		err = DDI_FAILURE;
700 		goto fail;
701 	}
702 
703 	m->b_rptr += RAL_TX_DESC_SIZE;	/* skip TX descriptor */
704 	m->b_wptr += RAL_TX_DESC_SIZE;
705 
706 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
707 		mblen = (uintptr_t)m0->b_wptr - (uintptr_t)m0->b_rptr;
708 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
709 		off += mblen;
710 	}
711 	m->b_wptr += off;
712 
713 	wh = (struct ieee80211_frame *)m->b_rptr;
714 
715 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
716 	if (ni == NULL) {
717 		err = DDI_FAILURE;
718 		sc->sc_tx_err++;
719 		freemsg(m);
720 		goto fail;
721 	}
722 
723 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
724 	    IEEE80211_FC0_TYPE_DATA) {
725 		(void) ieee80211_encap(ic, m, ni);
726 	}
727 
728 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
729 		k = ieee80211_crypto_encap(ic, m);
730 		if (k == NULL) {
731 			sc->sc_tx_err++;
732 			freemsg(m);
733 			err = DDI_FAILURE;
734 			goto fail;
735 		}
736 		/* packet header may have moved, reset our local pointer */
737 		wh = (struct ieee80211_frame *)m->b_rptr;
738 	}
739 
740 	m->b_rptr -= RAL_TX_DESC_SIZE;	/* restore */
741 	desc = (struct ural_tx_desc *)m->b_rptr;
742 
743 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
744 	    IEEE80211_FC0_TYPE_DATA) {	/* DATA */
745 		if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
746 			rate = ic->ic_bss->in_rates.ir_rates[ic->ic_fixed_rate];
747 		else
748 			rate = ni->in_rates.ir_rates[ni->in_txrate];
749 
750 		rate &= IEEE80211_RATE_VAL;
751 		if (rate <= 0) {
752 			rate = 2;	/* basic rate */
753 		}
754 
755 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
756 			flags |= RAL_TX_ACK;
757 			flags |= RAL_TX_RETRY(7);
758 
759 			dur = ural_txtime(RAL_ACK_SIZE, ural_ack_rate(ic, rate),
760 			    ic->ic_flags) + RAL_SIFS;
761 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
762 		}
763 	} else {	/* MGMT */
764 		rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
765 
766 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
767 			flags |= RAL_TX_ACK;
768 
769 			dur = ural_txtime(RAL_ACK_SIZE, rate, ic->ic_flags)
770 			    + RAL_SIFS;
771 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
772 
773 			/* tell hardware to add timestamp for probe responses */
774 			if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
775 			    IEEE80211_FC0_TYPE_MGT &&
776 			    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
777 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
778 				flags |= RAL_TX_TIMESTAMP;
779 		}
780 	}
781 
782 	pktlen = (uintptr_t)m->b_wptr - (uintptr_t)m->b_rptr - RAL_TX_DESC_SIZE;
783 	ural_setup_tx_desc(sc, desc, flags, pktlen, rate);
784 
785 	/* align end on a 2-bytes boundary */
786 	xferlen = (RAL_TX_DESC_SIZE + pktlen + 1) & ~1;
787 
788 	/*
789 	 * No space left in the last URB to store the extra 2 bytes, force
790 	 * sending of another URB.
791 	 */
792 	if ((xferlen % 64) == 0)
793 		xferlen += 2;
794 
795 	m->b_wptr = m->b_rptr + xferlen;
796 
797 	ral_debug(RAL_DBG_TX, "sending data frame len=%u rate=%u xfer len=%u\n",
798 	    pktlen, rate, xferlen);
799 
800 	(void) ural_tx_trigger(sc, m);
801 
802 	ic->ic_stats.is_tx_frags++;
803 	ic->ic_stats.is_tx_bytes += pktlen;
804 
805 fail:
806 	if (ni != NULL)
807 		ieee80211_free_node(ni);
808 
809 	if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
810 	    err == 0) {
811 		freemsg(mp);
812 	}
813 
814 	mutex_exit(&sc->tx_lock);
815 
816 	return (err);
817 }
818 
819 static mblk_t *
820 ural_m_tx(void *arg, mblk_t *mp)
821 {
822 	struct ural_softc *sc = (struct ural_softc *)arg;
823 	struct ieee80211com *ic = &sc->sc_ic;
824 	mblk_t *next;
825 
826 	/*
827 	 * No data frames go out unless we're associated; this
828 	 * should not happen as the 802.11 layer does not enable
829 	 * the xmit queue until we enter the RUN state.
830 	 */
831 	if (ic->ic_state != IEEE80211_S_RUN) {
832 		ral_debug(RAL_DBG_ERR, "ural_m_tx(): "
833 		    "discard, state %u\n", ic->ic_state);
834 		freemsgchain(mp);
835 		return (NULL);
836 	}
837 
838 	while (mp != NULL) {
839 		next = mp->b_next;
840 		mp->b_next = NULL;
841 		if (ural_send(ic, mp, IEEE80211_FC0_TYPE_DATA) != DDI_SUCCESS) {
842 			mp->b_next = next;
843 			freemsgchain(mp);
844 			return (NULL);
845 		}
846 		mp = next;
847 	}
848 	return (mp);
849 }
850 
851 static void
852 ural_set_testmode(struct ural_softc *sc)
853 {
854 	usb_ctrl_setup_t req;
855 	usb_cr_t cr;
856 	usb_cb_flags_t cf;
857 	int err;
858 
859 	bzero(&req, sizeof (req));
860 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
861 	req.bRequest = RAL_VENDOR_REQUEST;
862 	req.wValue = 4;
863 	req.wIndex = 1;
864 	req.wLength = 0;
865 	req.attrs = USB_ATTRS_NONE;
866 
867 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
868 	    &cr, &cf, 0);
869 
870 	if (err != USB_SUCCESS) {
871 		ral_debug(RAL_DBG_USB,
872 		    "ural_set_testmode(): could not set test mode:"
873 		    "cr:%s(%d), cf:%(x)\n",
874 		    usb_str_cr(cr), cr, cf);
875 	}
876 }
877 
878 static void
879 ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
880 {
881 	usb_ctrl_setup_t req;
882 	usb_cr_t cr;
883 	usb_cb_flags_t cf;
884 	mblk_t *mp;
885 	int err;
886 
887 	bzero(&req, sizeof (req));
888 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
889 	req.bRequest = RAL_READ_EEPROM;
890 	req.wValue = 0;
891 	req.wIndex = addr;
892 	req.wLength = (uint16_t)len;
893 
894 	mp = NULL;
895 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
896 	    &cr, &cf, 0);
897 
898 	if (err != USB_SUCCESS) {
899 		ral_debug(RAL_DBG_USB,
900 		    "ural_eeprom_read(): could not read EEPROM:"
901 		    "cr:%s(%d), cf:(%x)\n",
902 		    usb_str_cr(cr), cr, cf);
903 		return;
904 	}
905 
906 	bcopy(mp->b_rptr, buf, len);
907 
908 	if (mp)
909 		freemsg(mp);
910 }
911 
912 static void
913 ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
914 {
915 	uint16_t tmp;
916 	int ntries;
917 
918 	for (ntries = 0; ntries < 5; ntries++) {
919 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
920 			break;
921 	}
922 	if (ntries == 5) {
923 		ral_debug(RAL_DBG_ERR,
924 		    "ural_bbp_write(): could not write to BBP\n");
925 		return;
926 	}
927 
928 	tmp = reg << 8 | val;
929 	ural_write(sc, RAL_PHY_CSR7, tmp);
930 }
931 
932 static uint8_t
933 ural_bbp_read(struct ural_softc *sc, uint8_t reg)
934 {
935 	uint16_t val;
936 	int ntries;
937 
938 	val = RAL_BBP_WRITE | reg << 8;
939 	ural_write(sc, RAL_PHY_CSR7, val);
940 
941 	for (ntries = 0; ntries < 5; ntries++) {
942 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
943 			break;
944 	}
945 	if (ntries == 5) {
946 		ral_debug(RAL_DBG_ERR, "ural_bbp_read(): could not read BBP\n");
947 		return (0);
948 	}
949 
950 	return (ural_read(sc, RAL_PHY_CSR7) & 0xff);
951 }
952 
953 static void
954 ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
955 {
956 	uint32_t tmp;
957 	int ntries;
958 
959 	for (ntries = 0; ntries < 5; ntries++) {
960 		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
961 			break;
962 	}
963 	if (ntries == 5) {
964 		ral_debug(RAL_DBG_ERR,
965 		    "ural_rf_write(): could not write to RF\n");
966 		return;
967 	}
968 
969 	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xffff) << 2 | (reg & 0x3);
970 	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
971 	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
972 
973 	/* remember last written value in sc */
974 	sc->rf_regs[reg] = val;
975 
976 	ral_debug(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
977 }
978 
979 /*
980  * Disable RF auto-tuning.
981  */
982 static void
983 ural_disable_rf_tune(struct ural_softc *sc)
984 {
985 	uint32_t tmp;
986 
987 	if (sc->rf_rev != RAL_RF_2523) {
988 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
989 		ural_rf_write(sc, RAL_RF1, tmp);
990 	}
991 
992 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
993 	ural_rf_write(sc, RAL_RF3, tmp);
994 
995 	ral_debug(RAL_DBG_HW, "disabling RF autotune\n");
996 }
997 
998 
999 static void
1000 ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1001 {
1002 	struct ieee80211com *ic = &sc->sc_ic;
1003 	uint8_t power, tmp;
1004 	uint_t i, chan;
1005 
1006 	chan = ieee80211_chan2ieee(ic, c);
1007 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1008 		return;
1009 
1010 	if (IEEE80211_IS_CHAN_2GHZ(c))
1011 		power = min(sc->txpow[chan - 1], 31);
1012 	else
1013 		power = 31;
1014 
1015 	/* adjust txpower using ifconfig settings */
1016 	power -= (100 - ic->ic_txpowlimit) / 8;
1017 
1018 	ral_debug(RAL_DBG_HW, "setting channel to %u, txpower to %u\n",
1019 	    chan, power);
1020 
1021 	switch (sc->rf_rev) {
1022 	case RAL_RF_2522:
1023 		ural_rf_write(sc, RAL_RF1, 0x00814);
1024 		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1025 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1026 		break;
1027 
1028 	case RAL_RF_2523:
1029 		ural_rf_write(sc, RAL_RF1, 0x08804);
1030 		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1031 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1032 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1033 		break;
1034 
1035 	case RAL_RF_2524:
1036 		ural_rf_write(sc, RAL_RF1, 0x0c808);
1037 		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1038 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1039 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1040 		break;
1041 
1042 	case RAL_RF_2525:
1043 		ural_rf_write(sc, RAL_RF1, 0x08808);
1044 		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1045 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1046 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1047 
1048 		ural_rf_write(sc, RAL_RF1, 0x08808);
1049 		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1050 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1051 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1052 		break;
1053 
1054 	case RAL_RF_2525E:
1055 		ural_rf_write(sc, RAL_RF1, 0x08808);
1056 		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1057 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1058 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1059 		break;
1060 
1061 	case RAL_RF_2526:
1062 		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1063 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1064 		ural_rf_write(sc, RAL_RF1, 0x08804);
1065 
1066 		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1067 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1068 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1069 		break;
1070 
1071 	/* dual-band RF */
1072 	case RAL_RF_5222:
1073 		for (i = 0; ural_rf5222[i].chan != chan; i++) {
1074 			if (i > URAL_N(ural_rf5222)) break;
1075 		}
1076 
1077 		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1078 		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1079 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1080 		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1081 		break;
1082 	}
1083 
1084 	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1085 	    ic->ic_state != IEEE80211_S_SCAN) {
1086 		/* set Japan filter bit for channel 14 */
1087 		tmp = ural_bbp_read(sc, 70);
1088 
1089 		tmp &= ~RAL_JAPAN_FILTER;
1090 		if (chan == 14)
1091 			tmp |= RAL_JAPAN_FILTER;
1092 
1093 		ural_bbp_write(sc, 70, tmp);
1094 
1095 		/* clear CRC errs */
1096 		(void) ural_read(sc, RAL_STA_CSR0);
1097 
1098 		drv_usecwait(10000);
1099 		ural_disable_rf_tune(sc);
1100 	}
1101 }
1102 
1103 /*
1104  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1105  * synchronization.
1106  */
1107 static void
1108 ural_enable_tsf_sync(struct ural_softc *sc)
1109 {
1110 	struct ieee80211com *ic = &sc->sc_ic;
1111 	uint16_t logcwmin, preload, tmp;
1112 
1113 	/* first, disable TSF synchronization */
1114 	ural_write(sc, RAL_TXRX_CSR19, 0);
1115 
1116 	tmp = (16 * ic->ic_bss->in_intval) << 4;
1117 	ural_write(sc, RAL_TXRX_CSR18, tmp);
1118 
1119 	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1120 	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1121 	tmp = logcwmin << 12 | preload;
1122 	ural_write(sc, RAL_TXRX_CSR20, tmp);
1123 
1124 	/* finally, enable TSF synchronization */
1125 	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1126 	if (ic->ic_opmode == IEEE80211_M_STA)
1127 		tmp |= RAL_ENABLE_TSF_SYNC(1);
1128 	else
1129 		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1130 	ural_write(sc, RAL_TXRX_CSR19, tmp);
1131 
1132 	ral_debug(RAL_DBG_HW, "enabling TSF synchronization\n");
1133 }
1134 
1135 /*
1136  * This function can be called by ieee80211_set_shortslottime(). Refer to
1137  * IEEE Std 802.11-1999 pp. 85 to know how these values are computed.
1138  */
1139 /* ARGSUSED */
1140 static void
1141 ural_update_slot(struct ieee80211com *ic, int onoff)
1142 {
1143 	struct ural_softc *sc = (struct ural_softc *)ic;
1144 	uint16_t slottime, sifs, eifs;
1145 
1146 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1147 	/* slottime = (onoff ? 9 : 20); */
1148 
1149 	/*
1150 	 * These settings may sound a bit inconsistent but this is what the
1151 	 * reference driver does.
1152 	 */
1153 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1154 		sifs = 16 - RAL_RXTX_TURNAROUND;
1155 		eifs = 364;
1156 	} else {
1157 		sifs = 10 - RAL_RXTX_TURNAROUND;
1158 		eifs = 64;
1159 	}
1160 
1161 	ural_write(sc, RAL_MAC_CSR10, slottime);
1162 	ural_write(sc, RAL_MAC_CSR11, sifs);
1163 	ural_write(sc, RAL_MAC_CSR12, eifs);
1164 }
1165 
1166 static void
1167 ural_set_txpreamble(struct ural_softc *sc)
1168 {
1169 	uint16_t tmp;
1170 
1171 	tmp = ural_read(sc, RAL_TXRX_CSR10);
1172 
1173 	tmp &= ~RAL_SHORT_PREAMBLE;
1174 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1175 		tmp |= RAL_SHORT_PREAMBLE;
1176 
1177 	ural_write(sc, RAL_TXRX_CSR10, tmp);
1178 }
1179 
1180 static void
1181 ural_set_basicrates(struct ural_softc *sc)
1182 {
1183 	struct ieee80211com *ic = &sc->sc_ic;
1184 
1185 	/* update basic rate set */
1186 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1187 		/* 11b basic rates: 1, 2Mbps */
1188 		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1189 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->in_chan)) {
1190 		/* 11a basic rates: 6, 12, 24Mbps */
1191 		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1192 	} else {
1193 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1194 		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1195 	}
1196 }
1197 
1198 static void
1199 ural_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1200 {
1201 	uint16_t tmp;
1202 
1203 	tmp = bssid[0] | bssid[1] << 8;
1204 	ural_write(sc, RAL_MAC_CSR5, tmp);
1205 
1206 	tmp = bssid[2] | bssid[3] << 8;
1207 	ural_write(sc, RAL_MAC_CSR6, tmp);
1208 
1209 	tmp = bssid[4] | bssid[5] << 8;
1210 	ural_write(sc, RAL_MAC_CSR7, tmp);
1211 
1212 	ral_debug(RAL_DBG_HW, "setting BSSID to " MACSTR "\n", MAC2STR(bssid));
1213 }
1214 
1215 static void
1216 ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1217 {
1218 	uint16_t tmp;
1219 
1220 	tmp = addr[0] | addr[1] << 8;
1221 	ural_write(sc, RAL_MAC_CSR2, tmp);
1222 
1223 	tmp = addr[2] | addr[3] << 8;
1224 	ural_write(sc, RAL_MAC_CSR3, tmp);
1225 
1226 	tmp = addr[4] | addr[5] << 8;
1227 	ural_write(sc, RAL_MAC_CSR4, tmp);
1228 
1229 	ral_debug(RAL_DBG_HW,
1230 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1231 }
1232 
1233 static void
1234 ural_update_promisc(struct ural_softc *sc)
1235 {
1236 	uint32_t tmp;
1237 
1238 	tmp = ural_read(sc, RAL_TXRX_CSR2);
1239 
1240 	tmp &= ~RAL_DROP_NOT_TO_ME;
1241 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1242 		tmp |= RAL_DROP_NOT_TO_ME;
1243 
1244 	ural_write(sc, RAL_TXRX_CSR2, tmp);
1245 
1246 	ral_debug(RAL_DBG_HW, "%s promiscuous mode\n",
1247 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1248 }
1249 
1250 static const char *
1251 ural_get_rf(int rev)
1252 {
1253 	switch (rev) {
1254 	case RAL_RF_2522:	return ("RT2522");
1255 	case RAL_RF_2523:	return ("RT2523");
1256 	case RAL_RF_2524:	return ("RT2524");
1257 	case RAL_RF_2525:	return ("RT2525");
1258 	case RAL_RF_2525E:	return ("RT2525e");
1259 	case RAL_RF_2526:	return ("RT2526");
1260 	case RAL_RF_5222:	return ("RT5222");
1261 	default:		return ("unknown");
1262 	}
1263 }
1264 
1265 static void
1266 ural_read_eeprom(struct ural_softc *sc)
1267 {
1268 	struct ieee80211com *ic = &sc->sc_ic;
1269 	uint16_t val;
1270 
1271 	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1272 	val = LE_16(val);
1273 	sc->rf_rev =   (val >> 11) & 0x7;
1274 	sc->hw_radio = (val >> 10) & 0x1;
1275 	sc->led_mode = (val >> 6)  & 0x7;
1276 	sc->rx_ant =   (val >> 4)  & 0x3;
1277 	sc->tx_ant =   (val >> 2)  & 0x3;
1278 	sc->nb_ant =   val & 0x3;
1279 
1280 	/* read MAC address */
1281 	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, ic->ic_macaddr, 6);
1282 
1283 	/* read default values for BBP registers */
1284 	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1285 
1286 	/* read Tx power for all b/g channels */
1287 	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
1288 }
1289 
1290 static int
1291 ural_bbp_init(struct ural_softc *sc)
1292 {
1293 	int i, ntries;
1294 
1295 	/* wait for BBP to be ready */
1296 	for (ntries = 0; ntries < 100; ntries++) {
1297 		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
1298 			break;
1299 		drv_usecwait(1000);
1300 	}
1301 	if (ntries == 100) {
1302 		ral_debug(RAL_DBG_ERR, "timeout waiting for BBP\n");
1303 		return (EIO);
1304 	}
1305 
1306 	/* initialize BBP registers to default values */
1307 	for (i = 0; i < URAL_N(ural_def_bbp); i++)
1308 		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
1309 
1310 	return (0);
1311 }
1312 
1313 static void
1314 ural_set_txantenna(struct ural_softc *sc, int antenna)
1315 {
1316 	uint16_t tmp;
1317 	uint8_t tx;
1318 
1319 	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1320 	if (antenna == 1)
1321 		tx |= RAL_BBP_ANTA;
1322 	else if (antenna == 2)
1323 		tx |= RAL_BBP_ANTB;
1324 	else
1325 		tx |= RAL_BBP_DIVERSITY;
1326 
1327 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1328 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
1329 	    sc->rf_rev == RAL_RF_5222)
1330 		tx |= RAL_BBP_FLIPIQ;
1331 
1332 	ural_bbp_write(sc, RAL_BBP_TX, tx);
1333 
1334 	/* update values in PHY_CSR5 and PHY_CSR6 */
1335 	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
1336 	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1337 
1338 	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
1339 	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1340 }
1341 
1342 static void
1343 ural_set_rxantenna(struct ural_softc *sc, int antenna)
1344 {
1345 	uint8_t rx;
1346 
1347 	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1348 	if (antenna == 1)
1349 		rx |= RAL_BBP_ANTA;
1350 	else if (antenna == 2)
1351 		rx |= RAL_BBP_ANTB;
1352 	else
1353 		rx |= RAL_BBP_DIVERSITY;
1354 
1355 	/* need to force no I/Q flip for RF 2525e and 2526 */
1356 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
1357 		rx &= ~RAL_BBP_FLIPIQ;
1358 
1359 	ural_bbp_write(sc, RAL_BBP_RX, rx);
1360 }
1361 
1362 /*
1363  * This function is called periodically (every 200ms) during scanning to
1364  * switch from one channel to another.
1365  */
1366 static void
1367 ural_next_scan(void *arg)
1368 {
1369 	struct ural_softc *sc = arg;
1370 	struct ieee80211com *ic = &sc->sc_ic;
1371 
1372 	if (ic->ic_state == IEEE80211_S_SCAN)
1373 		ieee80211_next_scan(ic);
1374 }
1375 
1376 static int
1377 ural_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1378 {
1379 	struct ural_softc *sc = (struct ural_softc *)ic;
1380 	enum ieee80211_state ostate;
1381 	struct ieee80211_node *ni;
1382 	int err;
1383 
1384 	RAL_LOCK(sc);
1385 
1386 	ostate = ic->ic_state;
1387 
1388 	if (sc->sc_scan_id != 0) {
1389 		(void) untimeout(sc->sc_scan_id);
1390 		sc->sc_scan_id = 0;
1391 	}
1392 
1393 	if (sc->sc_amrr_id != 0) {
1394 		(void) untimeout(sc->sc_amrr_id);
1395 		sc->sc_amrr_id = 0;
1396 	}
1397 
1398 	switch (nstate) {
1399 	case IEEE80211_S_INIT:
1400 		if (ostate == IEEE80211_S_RUN) {
1401 			/* abort TSF synchronization */
1402 			ural_write(sc, RAL_TXRX_CSR19, 0);
1403 			/* force tx led to stop blinking */
1404 			ural_write(sc, RAL_MAC_CSR20, 0);
1405 		}
1406 		break;
1407 
1408 	case IEEE80211_S_SCAN:
1409 		ural_set_chan(sc, ic->ic_curchan);
1410 		sc->sc_scan_id = timeout(ural_next_scan, (void *)sc,
1411 		    drv_usectohz(sc->dwelltime * 1000));
1412 		break;
1413 
1414 	case IEEE80211_S_AUTH:
1415 		ural_set_chan(sc, ic->ic_curchan);
1416 		break;
1417 
1418 	case IEEE80211_S_ASSOC:
1419 		ural_set_chan(sc, ic->ic_curchan);
1420 		break;
1421 
1422 	case IEEE80211_S_RUN:
1423 		ural_set_chan(sc, ic->ic_curchan);
1424 
1425 		ni = ic->ic_bss;
1426 
1427 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1428 			ural_update_slot(ic, 1);
1429 			ural_set_txpreamble(sc);
1430 			ural_set_basicrates(sc);
1431 			ural_set_bssid(sc, ni->in_bssid);
1432 		}
1433 
1434 
1435 		/* make tx led blink on tx (controlled by ASIC) */
1436 		ural_write(sc, RAL_MAC_CSR20, 1);
1437 
1438 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1439 			ural_enable_tsf_sync(sc);
1440 
1441 		/* enable automatic rate adaptation in STA mode */
1442 		if (ic->ic_opmode == IEEE80211_M_STA &&
1443 		    ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
1444 			ural_amrr_start(sc, ni);
1445 
1446 		break;
1447 	}
1448 
1449 	RAL_UNLOCK(sc);
1450 
1451 	err = sc->sc_newstate(ic, nstate, arg);
1452 	/*
1453 	 * Finally, start any timers.
1454 	 */
1455 	if (nstate == IEEE80211_S_RUN)
1456 		ieee80211_start_watchdog(ic, 1);
1457 
1458 	return (err);
1459 }
1460 
1461 
1462 
1463 static void
1464 ural_close_pipes(struct ural_softc *sc)
1465 {
1466 	usb_flags_t flags = USB_FLAGS_SLEEP;
1467 
1468 	if (sc->sc_rx_pipeh != NULL) {
1469 		usb_pipe_reset(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
1470 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
1471 		sc->sc_rx_pipeh = NULL;
1472 	}
1473 
1474 	if (sc->sc_tx_pipeh != NULL) {
1475 		usb_pipe_reset(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
1476 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
1477 		sc->sc_tx_pipeh = NULL;
1478 	}
1479 }
1480 
1481 static int
1482 ural_open_pipes(struct ural_softc *sc)
1483 {
1484 	usb_ep_data_t *ep_node;
1485 	usb_pipe_policy_t policy;
1486 	int err;
1487 
1488 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
1489 	    USB_EP_ATTR_BULK, USB_EP_DIR_OUT);
1490 
1491 	bzero(&policy, sizeof (usb_pipe_policy_t));
1492 	policy.pp_max_async_reqs = RAL_TX_LIST_COUNT;
1493 
1494 	if ((err = usb_pipe_open(sc->sc_dev,
1495 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
1496 	    &sc->sc_tx_pipeh)) != USB_SUCCESS) {
1497 		ral_debug(RAL_DBG_ERR,
1498 		    "ural_open_pipes(): %x failed to open tx pipe\n", err);
1499 		goto fail;
1500 	}
1501 
1502 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
1503 	    USB_EP_ATTR_BULK, USB_EP_DIR_IN);
1504 
1505 	bzero(&policy, sizeof (usb_pipe_policy_t));
1506 	policy.pp_max_async_reqs = RAL_RX_LIST_COUNT + 32;
1507 
1508 	if ((err = usb_pipe_open(sc->sc_dev,
1509 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
1510 	    &sc->sc_rx_pipeh)) != USB_SUCCESS) {
1511 		ral_debug(RAL_DBG_ERR,
1512 		    "ural_open_pipes(): %x failed to open rx pipe\n", err);
1513 		goto fail;
1514 	}
1515 
1516 	return (USB_SUCCESS);
1517 
1518 fail:
1519 	if (sc->sc_rx_pipeh != NULL) {
1520 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh,
1521 		    USB_FLAGS_SLEEP, NULL, 0);
1522 		sc->sc_rx_pipeh = NULL;
1523 	}
1524 
1525 	if (sc->sc_tx_pipeh != NULL) {
1526 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh,
1527 		    USB_FLAGS_SLEEP, NULL, 0);
1528 		sc->sc_tx_pipeh = NULL;
1529 	}
1530 
1531 	return (USB_FAILURE);
1532 }
1533 
1534 static int
1535 ural_tx_trigger(struct ural_softc *sc, mblk_t *mp)
1536 {
1537 	usb_bulk_req_t *req;
1538 	int err;
1539 
1540 	sc->sc_tx_timer = RAL_TX_TIMEOUT;
1541 
1542 	req = usb_alloc_bulk_req(sc->sc_dev, 0, USB_FLAGS_SLEEP);
1543 	if (req == NULL) {
1544 		ral_debug(RAL_DBG_ERR,
1545 		    "ural_tx_trigger(): failed to allocate req");
1546 		freemsg(mp);
1547 		return (-1);
1548 	}
1549 
1550 	req->bulk_len		= (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
1551 	req->bulk_data		= mp;
1552 	req->bulk_client_private = (usb_opaque_t)sc;
1553 	req->bulk_timeout	= RAL_TX_TIMEOUT;
1554 	req->bulk_attributes	= USB_ATTRS_AUTOCLEARING;
1555 	req->bulk_cb		= ural_txeof;
1556 	req->bulk_exc_cb	= ural_txeof;
1557 	req->bulk_completion_reason = 0;
1558 	req->bulk_cb_flags	= 0;
1559 
1560 	if ((err = usb_pipe_bulk_xfer(sc->sc_tx_pipeh, req, 0))
1561 	    != USB_SUCCESS) {
1562 
1563 		ral_debug(RAL_DBG_ERR, "ural_tx_trigger(): "
1564 		    "failed to do tx xfer, %d", err);
1565 		usb_free_bulk_req(req);
1566 		return (-1);
1567 	}
1568 
1569 	sc->tx_queued++;
1570 
1571 	return (0);
1572 }
1573 
1574 static int
1575 ural_rx_trigger(struct ural_softc *sc)
1576 {
1577 	usb_bulk_req_t *req;
1578 	int err;
1579 
1580 	req = usb_alloc_bulk_req(sc->sc_dev, RAL_RXBUF_SIZE, USB_FLAGS_SLEEP);
1581 	if (req == NULL) {
1582 		ral_debug(RAL_DBG_ERR,
1583 		    "ural_rx_trigger(): failed to allocate req");
1584 		return (-1);
1585 	}
1586 
1587 	req->bulk_len		= RAL_RXBUF_SIZE;
1588 	req->bulk_client_private = (usb_opaque_t)sc;
1589 	req->bulk_timeout	= 0;
1590 	req->bulk_attributes	= USB_ATTRS_SHORT_XFER_OK
1591 	    | USB_ATTRS_AUTOCLEARING;
1592 	req->bulk_cb		= ural_rxeof;
1593 	req->bulk_exc_cb	= ural_rxeof;
1594 	req->bulk_completion_reason = 0;
1595 	req->bulk_cb_flags	= 0;
1596 
1597 	err = usb_pipe_bulk_xfer(sc->sc_rx_pipeh, req, 0);
1598 
1599 	if (err != USB_SUCCESS) {
1600 		ral_debug(RAL_DBG_ERR, "ural_rx_trigger(): "
1601 		    "failed to do rx xfer, %d", err);
1602 		usb_free_bulk_req(req);
1603 
1604 		return (-1);
1605 	}
1606 
1607 	mutex_enter(&sc->rx_lock);
1608 	sc->rx_queued++;
1609 	mutex_exit(&sc->rx_lock);
1610 
1611 	return (0);
1612 }
1613 
1614 static void
1615 ural_init_tx_queue(struct ural_softc *sc)
1616 {
1617 	sc->tx_queued = 0;
1618 }
1619 
1620 static int
1621 ural_init_rx_queue(struct ural_softc *sc)
1622 {
1623 	int	i;
1624 
1625 	sc->rx_queued = 0;
1626 
1627 	for (i = 0; i < RAL_RX_LIST_COUNT; i++) {
1628 		if (ural_rx_trigger(sc) != 0) {
1629 			return (USB_FAILURE);
1630 		}
1631 	}
1632 
1633 	return (USB_SUCCESS);
1634 }
1635 
1636 static void
1637 ural_stop(struct ural_softc *sc)
1638 {
1639 	struct ieee80211com *ic = &sc->sc_ic;
1640 
1641 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1642 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1643 
1644 	RAL_LOCK(sc);
1645 
1646 	sc->sc_tx_timer = 0;
1647 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1648 
1649 	/* disable Rx */
1650 	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
1651 
1652 	/* reset ASIC and BBP (but won't reset MAC registers!) */
1653 	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
1654 	ural_write(sc, RAL_MAC_CSR1, 0);
1655 
1656 	ural_close_pipes(sc);
1657 
1658 	RAL_UNLOCK(sc);
1659 }
1660 
1661 static int
1662 ural_init(struct ural_softc *sc)
1663 {
1664 	struct ieee80211com *ic = &sc->sc_ic;
1665 	uint16_t tmp;
1666 	int i, ntries;
1667 
1668 	ural_set_testmode(sc);
1669 	ural_write(sc, 0x308, 0x00f0);	/* magic */
1670 
1671 	ural_stop(sc);
1672 
1673 	/* initialize MAC registers to default values */
1674 	for (i = 0; i < URAL_N(ural_def_mac); i++)
1675 		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
1676 
1677 	/* wait for BBP and RF to wake up (this can take a long time!) */
1678 	for (ntries = 0; ntries < 100; ntries++) {
1679 		tmp = ural_read(sc, RAL_MAC_CSR17);
1680 		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
1681 		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
1682 			break;
1683 		drv_usecwait(1000);
1684 	}
1685 	if (ntries == 100) {
1686 		ral_debug(RAL_DBG_ERR,
1687 		    "ural_init(): timeout waiting for BBP/RF to wakeup\n");
1688 		goto fail;
1689 	}
1690 
1691 	/* we're ready! */
1692 	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
1693 
1694 	/* set basic rate set (will be updated later) */
1695 	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1696 
1697 	if (ural_bbp_init(sc) != 0)
1698 		goto fail;
1699 
1700 	/* set default BSS channel */
1701 	ural_set_chan(sc, ic->ic_curchan);
1702 
1703 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1704 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
1705 
1706 	ural_set_txantenna(sc, sc->tx_ant);
1707 	ural_set_rxantenna(sc, sc->rx_ant);
1708 
1709 	ural_set_macaddr(sc, ic->ic_macaddr);
1710 
1711 	if (ural_open_pipes(sc) != USB_SUCCESS) {
1712 		ral_debug(RAL_DBG_ERR, "ural_init(): "
1713 		    "could not open pipes.\n");
1714 		goto fail;
1715 	}
1716 
1717 	ural_init_tx_queue(sc);
1718 
1719 	if (ural_init_rx_queue(sc) != USB_SUCCESS)
1720 		goto fail;
1721 
1722 	/* kick Rx */
1723 	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
1724 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1725 		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
1726 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1727 			tmp |= RAL_DROP_TODS;
1728 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1729 			tmp |= RAL_DROP_NOT_TO_ME;
1730 	}
1731 	ural_write(sc, RAL_TXRX_CSR2, tmp);
1732 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
1733 
1734 	return (DDI_SUCCESS);
1735 fail:
1736 	ural_stop(sc);
1737 	return (EIO);
1738 }
1739 
1740 static int
1741 ural_disconnect(dev_info_t *devinfo)
1742 {
1743 	struct ural_softc *sc;
1744 	struct ieee80211com *ic;
1745 
1746 	/*
1747 	 * We can't call ural_stop() here, since the hardware is removed,
1748 	 * we can't access the register anymore.
1749 	 */
1750 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
1751 	ASSERT(sc != NULL);
1752 
1753 	if (!RAL_IS_RUNNING(sc))	/* different device or not inited */
1754 		return (DDI_SUCCESS);
1755 
1756 	ic = &sc->sc_ic;
1757 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1758 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1759 
1760 	RAL_LOCK(sc);
1761 
1762 	sc->sc_tx_timer = 0;
1763 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1764 
1765 	ural_close_pipes(sc);
1766 
1767 	RAL_UNLOCK(sc);
1768 
1769 	return (DDI_SUCCESS);
1770 }
1771 
1772 static int
1773 ural_reconnect(dev_info_t *devinfo)
1774 {
1775 	struct ural_softc *sc;
1776 	int err;
1777 
1778 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
1779 	ASSERT(sc != NULL);
1780 
1781 	/* check device changes after disconnect */
1782 	if (usb_check_same_device(sc->sc_dev, NULL, USB_LOG_L2, -1,
1783 	    USB_CHK_BASIC | USB_CHK_CFG, NULL) != USB_SUCCESS) {
1784 		ral_debug(RAL_DBG_ERR, "different device connected\n");
1785 		return (DDI_FAILURE);
1786 	}
1787 
1788 	err = ural_init(sc);
1789 
1790 	return (err);
1791 }
1792 
1793 static void
1794 ural_resume(struct ural_softc *sc)
1795 {
1796 	/* check device changes after suspend */
1797 	if (usb_check_same_device(sc->sc_dev, NULL, USB_LOG_L2, -1,
1798 	    USB_CHK_BASIC | USB_CHK_CFG, NULL) != USB_SUCCESS) {
1799 		ral_debug(RAL_DBG_ERR, "no or different device connected\n");
1800 		return;
1801 	}
1802 
1803 	(void) ural_init(sc);
1804 }
1805 
1806 #define	URAL_AMRR_MIN_SUCCESS_THRESHOLD	1
1807 #define	URAL_AMRR_MAX_SUCCESS_THRESHOLD	10
1808 
1809 /*
1810  * Naive implementation of the Adaptive Multi Rate Retry algorithm:
1811  * "IEEE 802.11 Rate Adaptation: A Practical Approach"
1812  * Mathieu Lacage, Hossein Manshaei, Thierry Turletti
1813  * INRIA Sophia - Projet Planete
1814  * http://www-sop.inria.fr/rapports/sophia/RR-5208.html
1815  *
1816  * This algorithm is particularly well suited for ural since it does not
1817  * require per-frame retry statistics.  Note however that since h/w does
1818  * not provide per-frame stats, we can't do per-node rate adaptation and
1819  * thus automatic rate adaptation is only enabled in STA operating mode.
1820  */
1821 #define	is_success(amrr)	\
1822 	((amrr)->retrycnt < (amrr)->txcnt / 10)
1823 #define	is_failure(amrr)	\
1824 	((amrr)->retrycnt > (amrr)->txcnt / 3)
1825 #define	is_enough(amrr)		\
1826 	((amrr)->txcnt > 10)
1827 #define	is_min_rate(ni)		\
1828 	((ni)->in_txrate == 0)
1829 #define	is_max_rate(ni)		\
1830 	((ni)->in_txrate == (ni)->in_rates.ir_nrates - 1)
1831 #define	increase_rate(ni)	\
1832 	((ni)->in_txrate++)
1833 #define	decrease_rate(ni)	\
1834 	((ni)->in_txrate--)
1835 #define	reset_cnt(amrr)	do {	\
1836 	(amrr)->txcnt = (amrr)->retrycnt = 0;	\
1837 	_NOTE(CONSTCOND)	\
1838 } while (/* CONSTCOND */0)
1839 
1840 static void
1841 ural_ratectl(struct ural_amrr *amrr, struct ieee80211_node *ni)
1842 {
1843 	int need_change = 0;
1844 
1845 	if (is_success(amrr) && is_enough(amrr)) {
1846 		amrr->success++;
1847 		if (amrr->success >= amrr->success_threshold &&
1848 		    !is_max_rate(ni)) {
1849 			amrr->recovery = 1;
1850 			amrr->success = 0;
1851 			increase_rate(ni);
1852 			need_change = 1;
1853 		} else {
1854 			amrr->recovery = 0;
1855 		}
1856 	} else if (is_failure(amrr)) {
1857 		amrr->success = 0;
1858 		if (!is_min_rate(ni)) {
1859 			if (amrr->recovery) {
1860 				amrr->success_threshold *= 2;
1861 				if (amrr->success_threshold >
1862 				    URAL_AMRR_MAX_SUCCESS_THRESHOLD)
1863 					amrr->success_threshold =
1864 					    URAL_AMRR_MAX_SUCCESS_THRESHOLD;
1865 			} else {
1866 				amrr->success_threshold =
1867 				    URAL_AMRR_MIN_SUCCESS_THRESHOLD;
1868 			}
1869 			decrease_rate(ni);
1870 			need_change = 1;
1871 		}
1872 		amrr->recovery = 0;	/* original paper was incorrect */
1873 	}
1874 
1875 	if (is_enough(amrr) || need_change)
1876 		reset_cnt(amrr);
1877 }
1878 
1879 static void
1880 ural_amrr_timeout(void *arg)
1881 {
1882 	struct ural_softc *sc = (struct ural_softc *)arg;
1883 	struct ural_amrr *amrr = &sc->amrr;
1884 
1885 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
1886 
1887 	/* count TX retry-fail as Tx errors */
1888 	sc->sc_tx_err += sc->sta[9];
1889 	sc->sc_tx_retries += (sc->sta[7] + sc->sta[8]);
1890 
1891 	amrr->retrycnt =
1892 	    sc->sta[7] +	/* TX one-retry ok count */
1893 	    sc->sta[8] +	/* TX more-retry ok count */
1894 	    sc->sta[9];		/* TX retry-fail count */
1895 
1896 	amrr->txcnt =
1897 	    amrr->retrycnt +
1898 	    sc->sta[6];		/* TX no-retry ok count */
1899 
1900 	ural_ratectl(amrr, sc->sc_ic.ic_bss);
1901 
1902 	sc->sc_amrr_id = timeout(ural_amrr_timeout, (void *)sc,
1903 	    drv_usectohz(1000 * 1000)); /* 1 second */
1904 }
1905 
1906 
1907 static void
1908 ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
1909 {
1910 	struct ural_amrr *amrr = &sc->amrr;
1911 	int i;
1912 
1913 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1914 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof (sc->sta));
1915 
1916 	amrr->success = 0;
1917 	amrr->recovery = 0;
1918 	amrr->txcnt = amrr->retrycnt = 0;
1919 	amrr->success_threshold = URAL_AMRR_MIN_SUCCESS_THRESHOLD;
1920 
1921 	/* set rate to some reasonable initial value */
1922 	for (i = ni->in_rates.ir_nrates - 1;
1923 	    i > 0 && (ni->in_rates.ir_rates[i] & IEEE80211_RATE_VAL) > 72;
1924 	    i--) {
1925 	}
1926 
1927 	ni->in_txrate = i;
1928 
1929 	sc->sc_amrr_id = timeout(ural_amrr_timeout, (void *)sc,
1930 	    drv_usectohz(1000 * 1000)); /* 1 second */
1931 }
1932 
1933 void
1934 ural_watchdog(void *arg)
1935 {
1936 	struct ural_softc *sc = arg;
1937 	struct ieee80211com *ic = &sc->sc_ic;
1938 	int ntimer = 0;
1939 
1940 	RAL_LOCK(sc);
1941 	ic->ic_watchdog_timer = 0;
1942 
1943 	if (!RAL_IS_RUNNING(sc)) {
1944 		RAL_UNLOCK(sc);
1945 		return;
1946 	}
1947 
1948 	if (sc->sc_tx_timer > 0) {
1949 		if (--sc->sc_tx_timer == 0) {
1950 			ral_debug(RAL_DBG_ERR, "tx timer timeout\n");
1951 			RAL_UNLOCK(sc);
1952 			(void) ural_init(sc);
1953 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1954 			return;
1955 		}
1956 	}
1957 
1958 	if (ic->ic_state == IEEE80211_S_RUN)
1959 		ntimer = 1;
1960 
1961 	RAL_UNLOCK(sc);
1962 
1963 	ieee80211_watchdog(ic);
1964 
1965 	if (ntimer)
1966 		ieee80211_start_watchdog(ic, ntimer);
1967 }
1968 
1969 static int
1970 ural_m_start(void *arg)
1971 {
1972 	struct ural_softc *sc = (struct ural_softc *)arg;
1973 	int err;
1974 
1975 	/*
1976 	 * initialize RT2500USB hardware
1977 	 */
1978 	err = ural_init(sc);
1979 	if (err != DDI_SUCCESS) {
1980 		ral_debug(RAL_DBG_ERR, "device configuration failed\n");
1981 		goto fail;
1982 	}
1983 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
1984 	return (err);
1985 
1986 fail:
1987 	ural_stop(sc);
1988 	return (err);
1989 }
1990 
1991 static void
1992 ural_m_stop(void *arg)
1993 {
1994 	struct ural_softc *sc = (struct ural_softc *)arg;
1995 
1996 	(void) ural_stop(sc);
1997 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1998 }
1999 
2000 static int
2001 ural_m_unicst(void *arg, const uint8_t *macaddr)
2002 {
2003 	struct ural_softc *sc = (struct ural_softc *)arg;
2004 	struct ieee80211com *ic = &sc->sc_ic;
2005 
2006 	ral_debug(RAL_DBG_MSG, "ural_m_unicst(): " MACSTR "\n",
2007 	    MAC2STR(macaddr));
2008 
2009 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2010 	(void) ural_set_macaddr(sc, (uint8_t *)macaddr);
2011 	(void) ural_init(sc);
2012 
2013 	return (0);
2014 }
2015 
2016 /*ARGSUSED*/
2017 static int
2018 ural_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2019 {
2020 	return (0);
2021 }
2022 
2023 static int
2024 ural_m_promisc(void *arg, boolean_t on)
2025 {
2026 	struct ural_softc *sc = (struct ural_softc *)arg;
2027 
2028 	if (on) {
2029 		sc->sc_rcr |= RAL_RCR_PROMISC;
2030 		sc->sc_rcr |= RAL_RCR_MULTI;
2031 	} else {
2032 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2033 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2034 	}
2035 
2036 	ural_update_promisc(sc);
2037 	return (0);
2038 }
2039 
2040 /*
2041  * callback functions for /get/set properties
2042  */
2043 static int
2044 ural_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2045     uint_t wldp_length, const void *wldp_buf)
2046 {
2047 	struct ural_softc *sc = (struct ural_softc *)arg;
2048 	struct ieee80211com *ic = &sc->sc_ic;
2049 	int err;
2050 
2051 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2052 	    wldp_length, wldp_buf);
2053 	RAL_LOCK(sc);
2054 	if (err == ENETRESET) {
2055 		if (RAL_IS_RUNNING(sc)) {
2056 			RAL_UNLOCK(sc);
2057 			(void) ural_init(sc);
2058 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2059 			RAL_LOCK(sc);
2060 		}
2061 		err = 0;
2062 	}
2063 	RAL_UNLOCK(sc);
2064 
2065 	return (err);
2066 }
2067 
2068 static int
2069 ural_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2070     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2071 {
2072 	struct ural_softc *sc = (struct ural_softc *)arg;
2073 	int err;
2074 
2075 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2076 	    pr_flags, wldp_length, wldp_buf, perm);
2077 
2078 	return (err);
2079 }
2080 
2081 static void
2082 ural_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2083 {
2084 	struct ural_softc *sc = (struct ural_softc *)arg;
2085 	struct ieee80211com *ic = &sc->sc_ic;
2086 	int err;
2087 
2088 	err = ieee80211_ioctl(ic, wq, mp);
2089 	RAL_LOCK(sc);
2090 	if (err == ENETRESET) {
2091 		if (RAL_IS_RUNNING(sc)) {
2092 			RAL_UNLOCK(sc);
2093 			(void) ural_init(sc);
2094 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2095 			RAL_LOCK(sc);
2096 		}
2097 	}
2098 	RAL_UNLOCK(sc);
2099 }
2100 
2101 static int
2102 ural_m_stat(void *arg, uint_t stat, uint64_t *val)
2103 {
2104 	struct ural_softc *sc  = (struct ural_softc *)arg;
2105 	ieee80211com_t	*ic = &sc->sc_ic;
2106 	ieee80211_node_t *ni = ic->ic_bss;
2107 	struct ieee80211_rateset *rs = &ni->in_rates;
2108 
2109 	RAL_LOCK(sc);
2110 	switch (stat) {
2111 	case MAC_STAT_IFSPEED:
2112 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2113 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2114 		    : ic->ic_fixed_rate) / 2 * 1000000;
2115 		break;
2116 	case MAC_STAT_NOXMTBUF:
2117 		*val = sc->sc_tx_nobuf;
2118 		break;
2119 	case MAC_STAT_NORCVBUF:
2120 		*val = sc->sc_rx_nobuf;
2121 		break;
2122 	case MAC_STAT_IERRORS:
2123 		*val = sc->sc_rx_err;
2124 		break;
2125 	case MAC_STAT_RBYTES:
2126 		*val = ic->ic_stats.is_rx_bytes;
2127 		break;
2128 	case MAC_STAT_IPACKETS:
2129 		*val = ic->ic_stats.is_rx_frags;
2130 		break;
2131 	case MAC_STAT_OBYTES:
2132 		*val = ic->ic_stats.is_tx_bytes;
2133 		break;
2134 	case MAC_STAT_OPACKETS:
2135 		*val = ic->ic_stats.is_tx_frags;
2136 		break;
2137 	case MAC_STAT_OERRORS:
2138 	case WIFI_STAT_TX_FAILED:
2139 		*val = sc->sc_tx_err;
2140 		break;
2141 	case WIFI_STAT_TX_RETRANS:
2142 		*val = sc->sc_tx_retries;
2143 		break;
2144 	case WIFI_STAT_FCS_ERRORS:
2145 	case WIFI_STAT_WEP_ERRORS:
2146 	case WIFI_STAT_TX_FRAGS:
2147 	case WIFI_STAT_MCAST_TX:
2148 	case WIFI_STAT_RTS_SUCCESS:
2149 	case WIFI_STAT_RTS_FAILURE:
2150 	case WIFI_STAT_ACK_FAILURE:
2151 	case WIFI_STAT_RX_FRAGS:
2152 	case WIFI_STAT_MCAST_RX:
2153 	case WIFI_STAT_RX_DUPS:
2154 		RAL_UNLOCK(sc);
2155 		return (ieee80211_stat(ic, stat, val));
2156 	default:
2157 		RAL_UNLOCK(sc);
2158 		return (ENOTSUP);
2159 	}
2160 	RAL_UNLOCK(sc);
2161 
2162 	return (0);
2163 }
2164 
2165 
2166 static int
2167 ural_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2168 {
2169 	struct ural_softc *sc;
2170 	struct ieee80211com *ic;
2171 	int err, i;
2172 	int instance;
2173 
2174 	char strbuf[32];
2175 
2176 	wifi_data_t wd = { 0 };
2177 	mac_register_t *macp;
2178 
2179 	switch (cmd) {
2180 	case DDI_ATTACH:
2181 		break;
2182 	case DDI_RESUME:
2183 		sc = ddi_get_soft_state(ural_soft_state_p,
2184 		    ddi_get_instance(devinfo));
2185 		ASSERT(sc != NULL);
2186 		ural_resume(sc);
2187 		return (DDI_SUCCESS);
2188 	default:
2189 		return (DDI_FAILURE);
2190 	}
2191 
2192 	instance = ddi_get_instance(devinfo);
2193 
2194 	if (ddi_soft_state_zalloc(ural_soft_state_p, instance) != DDI_SUCCESS) {
2195 		ral_debug(RAL_DBG_MSG, "ural_attach(): "
2196 		    "unable to alloc soft_state_p\n");
2197 		return (DDI_FAILURE);
2198 	}
2199 
2200 	sc = ddi_get_soft_state(ural_soft_state_p, instance);
2201 	ic = (ieee80211com_t *)&sc->sc_ic;
2202 	sc->sc_dev = devinfo;
2203 
2204 	if (usb_client_attach(devinfo, USBDRV_VERSION, 0) != USB_SUCCESS) {
2205 		ral_debug(RAL_DBG_ERR,
2206 		    "ural_attach(): usb_client_attach failed\n");
2207 		goto fail1;
2208 	}
2209 
2210 	if (usb_get_dev_data(devinfo, &sc->sc_udev,
2211 	    USB_PARSE_LVL_ALL, 0) != USB_SUCCESS) {
2212 		sc->sc_udev = NULL;
2213 		goto fail2;
2214 	}
2215 
2216 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2217 	mutex_init(&sc->tx_lock, NULL, MUTEX_DRIVER, NULL);
2218 	mutex_init(&sc->rx_lock, NULL, MUTEX_DRIVER, NULL);
2219 
2220 	/* retrieve RT2570 rev. no */
2221 	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
2222 
2223 	/* retrieve MAC address and various other things from EEPROM */
2224 	ural_read_eeprom(sc);
2225 
2226 	ral_debug(RAL_DBG_MSG, "ural: MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
2227 	    sc->asic_rev, ural_get_rf(sc->rf_rev));
2228 
2229 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2230 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2231 	ic->ic_state = IEEE80211_S_INIT;
2232 
2233 	ic->ic_maxrssi = 63;
2234 	ic->ic_set_shortslot = ural_update_slot;
2235 	ic->ic_xmit = ural_send;
2236 
2237 	/* set device capabilities */
2238 	ic->ic_caps =
2239 	    IEEE80211_C_TXPMGT |	/* tx power management */
2240 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2241 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2242 
2243 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2244 
2245 #define	IEEE80211_CHAN_A	\
2246 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2247 
2248 	if (sc->rf_rev == RAL_RF_5222) {
2249 		/* set supported .11a rates */
2250 		ic->ic_sup_rates[IEEE80211_MODE_11A] = ural_rateset_11a;
2251 
2252 		/* set supported .11a channels */
2253 		for (i = 36; i <= 64; i += 4) {
2254 			ic->ic_sup_channels[i].ich_freq =
2255 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2256 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2257 		}
2258 		for (i = 100; i <= 140; i += 4) {
2259 			ic->ic_sup_channels[i].ich_freq =
2260 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2261 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2262 		}
2263 		for (i = 149; i <= 161; i += 4) {
2264 			ic->ic_sup_channels[i].ich_freq =
2265 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2266 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2267 		}
2268 	}
2269 
2270 	/* set supported .11b and .11g rates */
2271 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ural_rateset_11b;
2272 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ural_rateset_11g;
2273 
2274 	/* set supported .11b and .11g channels (1 through 14) */
2275 	for (i = 1; i <= 14; i++) {
2276 		ic->ic_sup_channels[i].ich_freq =
2277 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2278 		ic->ic_sup_channels[i].ich_flags =
2279 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2280 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2281 	}
2282 
2283 	ieee80211_attach(ic);
2284 
2285 	/* register WPA door */
2286 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2287 	    ddi_get_instance(devinfo));
2288 
2289 	/* override state transition machine */
2290 	sc->sc_newstate = ic->ic_newstate;
2291 	ic->ic_newstate = ural_newstate;
2292 	ic->ic_watchdog = ural_watchdog;
2293 	ieee80211_media_init(ic);
2294 	ic->ic_def_txkey = 0;
2295 
2296 	sc->sc_rcr = 0;
2297 	sc->dwelltime = 300;
2298 	sc->sc_flags &= 0;
2299 
2300 	/*
2301 	 * Provide initial settings for the WiFi plugin; whenever this
2302 	 * information changes, we need to call mac_plugindata_update()
2303 	 */
2304 	wd.wd_opmode = ic->ic_opmode;
2305 	wd.wd_secalloc = WIFI_SEC_NONE;
2306 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2307 
2308 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2309 		ral_debug(RAL_DBG_ERR, "ural_attach(): "
2310 		    "MAC version mismatch\n");
2311 		goto fail3;
2312 	}
2313 
2314 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2315 	macp->m_driver		= sc;
2316 	macp->m_dip		= devinfo;
2317 	macp->m_src_addr	= ic->ic_macaddr;
2318 	macp->m_callbacks	= &ural_m_callbacks;
2319 	macp->m_min_sdu		= 0;
2320 	macp->m_max_sdu		= IEEE80211_MTU;
2321 	macp->m_pdata		= &wd;
2322 	macp->m_pdata_size	= sizeof (wd);
2323 
2324 	err = mac_register(macp, &ic->ic_mach);
2325 	mac_free(macp);
2326 	if (err != 0) {
2327 		ral_debug(RAL_DBG_ERR, "ural_attach(): "
2328 		    "mac_register() err %x\n", err);
2329 		goto fail3;
2330 	}
2331 
2332 	if (usb_register_hotplug_cbs(devinfo, ural_disconnect,
2333 	    ural_reconnect) != USB_SUCCESS) {
2334 		ral_debug(RAL_DBG_ERR,
2335 		    "ural: ural_attach() failed to register events");
2336 		goto fail4;
2337 	}
2338 
2339 	/*
2340 	 * Create minor node of type DDI_NT_NET_WIFI
2341 	 */
2342 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2343 	    "ural", instance);
2344 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2345 	    instance + 1, DDI_NT_NET_WIFI, 0);
2346 
2347 	if (err != DDI_SUCCESS)
2348 		ral_debug(RAL_DBG_ERR, "ddi_create_minor_node() failed\n");
2349 
2350 	/*
2351 	 * Notify link is down now
2352 	 */
2353 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2354 
2355 	return (DDI_SUCCESS);
2356 fail4:
2357 	(void) mac_unregister(ic->ic_mach);
2358 fail3:
2359 	mutex_destroy(&sc->sc_genlock);
2360 	mutex_destroy(&sc->tx_lock);
2361 	mutex_destroy(&sc->rx_lock);
2362 fail2:
2363 	usb_client_detach(sc->sc_dev, sc->sc_udev);
2364 fail1:
2365 	ddi_soft_state_free(ural_soft_state_p, ddi_get_instance(devinfo));
2366 
2367 	return (DDI_FAILURE);
2368 }
2369 
2370 static int
2371 ural_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2372 {
2373 	struct ural_softc *sc;
2374 
2375 	sc = ddi_get_soft_state(ural_soft_state_p, ddi_get_instance(devinfo));
2376 	ASSERT(sc != NULL);
2377 
2378 	switch (cmd) {
2379 	case DDI_DETACH:
2380 		break;
2381 	case DDI_SUSPEND:
2382 		if (RAL_IS_RUNNING(sc))
2383 			(void) ural_stop(sc);
2384 		return (DDI_SUCCESS);
2385 	default:
2386 		return (DDI_FAILURE);
2387 	}
2388 
2389 	if (mac_disable(sc->sc_ic.ic_mach) != 0)
2390 		return (DDI_FAILURE);
2391 
2392 	ural_stop(sc);
2393 	usb_unregister_hotplug_cbs(devinfo);
2394 
2395 	/*
2396 	 * Unregister from the MAC layer subsystem
2397 	 */
2398 	(void) mac_unregister(sc->sc_ic.ic_mach);
2399 
2400 	/*
2401 	 * detach ieee80211 layer
2402 	 */
2403 	ieee80211_detach(&sc->sc_ic);
2404 
2405 	mutex_destroy(&sc->sc_genlock);
2406 	mutex_destroy(&sc->tx_lock);
2407 	mutex_destroy(&sc->rx_lock);
2408 
2409 	/* pipes will be close in ural_stop() */
2410 	usb_client_detach(devinfo, sc->sc_udev);
2411 	sc->sc_udev = NULL;
2412 
2413 	ddi_remove_minor_node(devinfo, NULL);
2414 	ddi_soft_state_free(ural_soft_state_p, ddi_get_instance(devinfo));
2415 
2416 	return (DDI_SUCCESS);
2417 }
2418 
2419 int
2420 _info(struct modinfo *modinfop)
2421 {
2422 	return (mod_info(&modlinkage, modinfop));
2423 }
2424 
2425 int
2426 _init(void)
2427 {
2428 	int status;
2429 
2430 	status = ddi_soft_state_init(&ural_soft_state_p,
2431 	    sizeof (struct ural_softc), 1);
2432 	if (status != 0)
2433 		return (status);
2434 
2435 	mac_init_ops(&ural_dev_ops, "ural");
2436 	status = mod_install(&modlinkage);
2437 	if (status != 0) {
2438 		mac_fini_ops(&ural_dev_ops);
2439 		ddi_soft_state_fini(&ural_soft_state_p);
2440 	}
2441 	return (status);
2442 }
2443 
2444 int
2445 _fini(void)
2446 {
2447 	int status;
2448 
2449 	status = mod_remove(&modlinkage);
2450 	if (status == 0) {
2451 		mac_fini_ops(&ural_dev_ops);
2452 		ddi_soft_state_fini(&ural_soft_state_p);
2453 	}
2454 	return (status);
2455 }
2456