if_zyd.c revision 283540
1/*	$OpenBSD: if_zyd.c,v 1.52 2007/02/11 00:08:04 jsg Exp $	*/
2/*	$NetBSD: if_zyd.c,v 1.7 2007/06/21 04:04:29 kiyohara Exp $	*/
3/*	$FreeBSD: head/sys/dev/usb/wlan/if_zyd.c 283540 2015-05-25 19:53:29Z glebius $	*/
4
5/*-
6 * Copyright (c) 2006 by Damien Bergamini <damien.bergamini@free.fr>
7 * Copyright (c) 2006 by Florian Stoehr <ich@florian-stoehr.de>
8 *
9 * Permission to use, copy, modify, and distribute this software for any
10 * purpose with or without fee is hereby granted, provided that the above
11 * copyright notice and this permission notice appear in all copies.
12 *
13 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
14 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
15 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
16 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
17 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 */
21
22#include <sys/cdefs.h>
23__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_zyd.c 283540 2015-05-25 19:53:29Z glebius $");
24
25/*
26 * ZyDAS ZD1211/ZD1211B USB WLAN driver.
27 */
28
29#include <sys/param.h>
30#include <sys/sockio.h>
31#include <sys/sysctl.h>
32#include <sys/lock.h>
33#include <sys/mutex.h>
34#include <sys/condvar.h>
35#include <sys/mbuf.h>
36#include <sys/kernel.h>
37#include <sys/socket.h>
38#include <sys/systm.h>
39#include <sys/malloc.h>
40#include <sys/module.h>
41#include <sys/bus.h>
42#include <sys/endian.h>
43#include <sys/kdb.h>
44
45#include <machine/bus.h>
46#include <machine/resource.h>
47#include <sys/rman.h>
48
49#include <net/bpf.h>
50#include <net/if.h>
51#include <net/if_var.h>
52#include <net/if_arp.h>
53#include <net/ethernet.h>
54#include <net/if_dl.h>
55#include <net/if_media.h>
56#include <net/if_types.h>
57
58#ifdef INET
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_var.h>
62#include <netinet/if_ether.h>
63#include <netinet/ip.h>
64#endif
65
66#include <net80211/ieee80211_var.h>
67#include <net80211/ieee80211_regdomain.h>
68#include <net80211/ieee80211_radiotap.h>
69#include <net80211/ieee80211_ratectl.h>
70
71#include <dev/usb/usb.h>
72#include <dev/usb/usbdi.h>
73#include <dev/usb/usbdi_util.h>
74#include "usbdevs.h"
75
76#include <dev/usb/wlan/if_zydreg.h>
77#include <dev/usb/wlan/if_zydfw.h>
78
79#ifdef USB_DEBUG
80static int zyd_debug = 0;
81
82static SYSCTL_NODE(_hw_usb, OID_AUTO, zyd, CTLFLAG_RW, 0, "USB zyd");
83SYSCTL_INT(_hw_usb_zyd, OID_AUTO, debug, CTLFLAG_RWTUN, &zyd_debug, 0,
84    "zyd debug level");
85
86enum {
87	ZYD_DEBUG_XMIT		= 0x00000001,	/* basic xmit operation */
88	ZYD_DEBUG_RECV		= 0x00000002,	/* basic recv operation */
89	ZYD_DEBUG_RESET		= 0x00000004,	/* reset processing */
90	ZYD_DEBUG_INIT		= 0x00000008,	/* device init */
91	ZYD_DEBUG_TX_PROC	= 0x00000010,	/* tx ISR proc */
92	ZYD_DEBUG_RX_PROC	= 0x00000020,	/* rx ISR proc */
93	ZYD_DEBUG_STATE		= 0x00000040,	/* 802.11 state transitions */
94	ZYD_DEBUG_STAT		= 0x00000080,	/* statistic */
95	ZYD_DEBUG_FW		= 0x00000100,	/* firmware */
96	ZYD_DEBUG_CMD		= 0x00000200,	/* fw commands */
97	ZYD_DEBUG_ANY		= 0xffffffff
98};
99#define	DPRINTF(sc, m, fmt, ...) do {				\
100	if (zyd_debug & (m))					\
101		printf("%s: " fmt, __func__, ## __VA_ARGS__);	\
102} while (0)
103#else
104#define	DPRINTF(sc, m, fmt, ...) do {				\
105	(void) sc;						\
106} while (0)
107#endif
108
109#define	zyd_do_request(sc,req,data) \
110    usbd_do_request_flags((sc)->sc_udev, &(sc)->sc_mtx, req, data, 0, NULL, 5000)
111
112static device_probe_t zyd_match;
113static device_attach_t zyd_attach;
114static device_detach_t zyd_detach;
115
116static usb_callback_t zyd_intr_read_callback;
117static usb_callback_t zyd_intr_write_callback;
118static usb_callback_t zyd_bulk_read_callback;
119static usb_callback_t zyd_bulk_write_callback;
120
121static struct ieee80211vap *zyd_vap_create(struct ieee80211com *,
122		    const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
123		    const uint8_t [IEEE80211_ADDR_LEN],
124		    const uint8_t [IEEE80211_ADDR_LEN]);
125static void	zyd_vap_delete(struct ieee80211vap *);
126static void	zyd_tx_free(struct zyd_tx_data *, int);
127static void	zyd_setup_tx_list(struct zyd_softc *);
128static void	zyd_unsetup_tx_list(struct zyd_softc *);
129static int	zyd_newstate(struct ieee80211vap *, enum ieee80211_state, int);
130static int	zyd_cmd(struct zyd_softc *, uint16_t, const void *, int,
131		    void *, int, int);
132static int	zyd_read16(struct zyd_softc *, uint16_t, uint16_t *);
133static int	zyd_read32(struct zyd_softc *, uint16_t, uint32_t *);
134static int	zyd_write16(struct zyd_softc *, uint16_t, uint16_t);
135static int	zyd_write32(struct zyd_softc *, uint16_t, uint32_t);
136static int	zyd_rfwrite(struct zyd_softc *, uint32_t);
137static int	zyd_lock_phy(struct zyd_softc *);
138static int	zyd_unlock_phy(struct zyd_softc *);
139static int	zyd_rf_attach(struct zyd_softc *, uint8_t);
140static const char *zyd_rf_name(uint8_t);
141static int	zyd_hw_init(struct zyd_softc *);
142static int	zyd_read_pod(struct zyd_softc *);
143static int	zyd_read_eeprom(struct zyd_softc *);
144static int	zyd_get_macaddr(struct zyd_softc *);
145static int	zyd_set_macaddr(struct zyd_softc *, const uint8_t *);
146static int	zyd_set_bssid(struct zyd_softc *, const uint8_t *);
147static int	zyd_switch_radio(struct zyd_softc *, int);
148static int	zyd_set_led(struct zyd_softc *, int, int);
149static void	zyd_set_multi(struct zyd_softc *);
150static void	zyd_update_mcast(struct ieee80211com *);
151static int	zyd_set_rxfilter(struct zyd_softc *);
152static void	zyd_set_chan(struct zyd_softc *, struct ieee80211_channel *);
153static int	zyd_set_beacon_interval(struct zyd_softc *, int);
154static void	zyd_rx_data(struct usb_xfer *, int, uint16_t);
155static int	zyd_tx_start(struct zyd_softc *, struct mbuf *,
156		    struct ieee80211_node *);
157static void	zyd_start(struct ifnet *);
158static int	zyd_raw_xmit(struct ieee80211_node *, struct mbuf *,
159		    const struct ieee80211_bpf_params *);
160static int	zyd_ioctl(struct ifnet *, u_long, caddr_t);
161static void	zyd_init_locked(struct zyd_softc *);
162static void	zyd_init(void *);
163static void	zyd_stop(struct zyd_softc *);
164static int	zyd_loadfirmware(struct zyd_softc *);
165static void	zyd_scan_start(struct ieee80211com *);
166static void	zyd_scan_end(struct ieee80211com *);
167static void	zyd_set_channel(struct ieee80211com *);
168static int	zyd_rfmd_init(struct zyd_rf *);
169static int	zyd_rfmd_switch_radio(struct zyd_rf *, int);
170static int	zyd_rfmd_set_channel(struct zyd_rf *, uint8_t);
171static int	zyd_al2230_init(struct zyd_rf *);
172static int	zyd_al2230_switch_radio(struct zyd_rf *, int);
173static int	zyd_al2230_set_channel(struct zyd_rf *, uint8_t);
174static int	zyd_al2230_set_channel_b(struct zyd_rf *, uint8_t);
175static int	zyd_al2230_init_b(struct zyd_rf *);
176static int	zyd_al7230B_init(struct zyd_rf *);
177static int	zyd_al7230B_switch_radio(struct zyd_rf *, int);
178static int	zyd_al7230B_set_channel(struct zyd_rf *, uint8_t);
179static int	zyd_al2210_init(struct zyd_rf *);
180static int	zyd_al2210_switch_radio(struct zyd_rf *, int);
181static int	zyd_al2210_set_channel(struct zyd_rf *, uint8_t);
182static int	zyd_gct_init(struct zyd_rf *);
183static int	zyd_gct_switch_radio(struct zyd_rf *, int);
184static int	zyd_gct_set_channel(struct zyd_rf *, uint8_t);
185static int	zyd_gct_mode(struct zyd_rf *);
186static int	zyd_gct_set_channel_synth(struct zyd_rf *, int, int);
187static int	zyd_gct_write(struct zyd_rf *, uint16_t);
188static int	zyd_gct_txgain(struct zyd_rf *, uint8_t);
189static int	zyd_maxim2_init(struct zyd_rf *);
190static int	zyd_maxim2_switch_radio(struct zyd_rf *, int);
191static int	zyd_maxim2_set_channel(struct zyd_rf *, uint8_t);
192
193static const struct zyd_phy_pair zyd_def_phy[] = ZYD_DEF_PHY;
194static const struct zyd_phy_pair zyd_def_phyB[] = ZYD_DEF_PHYB;
195
196/* various supported device vendors/products */
197#define ZYD_ZD1211	0
198#define ZYD_ZD1211B	1
199
200#define	ZYD_ZD1211_DEV(v,p)	\
201	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, ZYD_ZD1211) }
202#define	ZYD_ZD1211B_DEV(v,p)	\
203	{ USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, ZYD_ZD1211B) }
204static const STRUCT_USB_HOST_ID zyd_devs[] = {
205	/* ZYD_ZD1211 */
206	ZYD_ZD1211_DEV(3COM2, 3CRUSB10075),
207	ZYD_ZD1211_DEV(ABOCOM, WL54),
208	ZYD_ZD1211_DEV(ASUS, WL159G),
209	ZYD_ZD1211_DEV(CYBERTAN, TG54USB),
210	ZYD_ZD1211_DEV(DRAYTEK, VIGOR550),
211	ZYD_ZD1211_DEV(PLANEX2, GWUS54GD),
212	ZYD_ZD1211_DEV(PLANEX2, GWUS54GZL),
213	ZYD_ZD1211_DEV(PLANEX3, GWUS54GZ),
214	ZYD_ZD1211_DEV(PLANEX3, GWUS54MINI),
215	ZYD_ZD1211_DEV(SAGEM, XG760A),
216	ZYD_ZD1211_DEV(SENAO, NUB8301),
217	ZYD_ZD1211_DEV(SITECOMEU, WL113),
218	ZYD_ZD1211_DEV(SWEEX, ZD1211),
219	ZYD_ZD1211_DEV(TEKRAM, QUICKWLAN),
220	ZYD_ZD1211_DEV(TEKRAM, ZD1211_1),
221	ZYD_ZD1211_DEV(TEKRAM, ZD1211_2),
222	ZYD_ZD1211_DEV(TWINMOS, G240),
223	ZYD_ZD1211_DEV(UMEDIA, ALL0298V2),
224	ZYD_ZD1211_DEV(UMEDIA, TEW429UB_A),
225	ZYD_ZD1211_DEV(UMEDIA, TEW429UB),
226	ZYD_ZD1211_DEV(WISTRONNEWEB, UR055G),
227	ZYD_ZD1211_DEV(ZCOM, ZD1211),
228	ZYD_ZD1211_DEV(ZYDAS, ZD1211),
229	ZYD_ZD1211_DEV(ZYXEL, AG225H),
230	ZYD_ZD1211_DEV(ZYXEL, ZYAIRG220),
231	ZYD_ZD1211_DEV(ZYXEL, G200V2),
232	/* ZYD_ZD1211B */
233	ZYD_ZD1211B_DEV(ACCTON, SMCWUSBG_NF),
234	ZYD_ZD1211B_DEV(ACCTON, SMCWUSBG),
235	ZYD_ZD1211B_DEV(ACCTON, ZD1211B),
236	ZYD_ZD1211B_DEV(ASUS, A9T_WIFI),
237	ZYD_ZD1211B_DEV(BELKIN, F5D7050_V4000),
238	ZYD_ZD1211B_DEV(BELKIN, ZD1211B),
239	ZYD_ZD1211B_DEV(CISCOLINKSYS, WUSBF54G),
240	ZYD_ZD1211B_DEV(FIBERLINE, WL430U),
241	ZYD_ZD1211B_DEV(MELCO, KG54L),
242	ZYD_ZD1211B_DEV(PHILIPS, SNU5600),
243	ZYD_ZD1211B_DEV(PLANEX2, GW_US54GXS),
244	ZYD_ZD1211B_DEV(SAGEM, XG76NA),
245	ZYD_ZD1211B_DEV(SITECOMEU, ZD1211B),
246	ZYD_ZD1211B_DEV(UMEDIA, TEW429UBC1),
247	ZYD_ZD1211B_DEV(USR, USR5423),
248	ZYD_ZD1211B_DEV(VTECH, ZD1211B),
249	ZYD_ZD1211B_DEV(ZCOM, ZD1211B),
250	ZYD_ZD1211B_DEV(ZYDAS, ZD1211B),
251	ZYD_ZD1211B_DEV(ZYXEL, M202),
252	ZYD_ZD1211B_DEV(ZYXEL, G202),
253	ZYD_ZD1211B_DEV(ZYXEL, G220V2)
254};
255
256static const struct usb_config zyd_config[ZYD_N_TRANSFER] = {
257	[ZYD_BULK_WR] = {
258		.type = UE_BULK,
259		.endpoint = UE_ADDR_ANY,
260		.direction = UE_DIR_OUT,
261		.bufsize = ZYD_MAX_TXBUFSZ,
262		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
263		.callback = zyd_bulk_write_callback,
264		.ep_index = 0,
265		.timeout = 10000,	/* 10 seconds */
266	},
267	[ZYD_BULK_RD] = {
268		.type = UE_BULK,
269		.endpoint = UE_ADDR_ANY,
270		.direction = UE_DIR_IN,
271		.bufsize = ZYX_MAX_RXBUFSZ,
272		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
273		.callback = zyd_bulk_read_callback,
274		.ep_index = 0,
275	},
276	[ZYD_INTR_WR] = {
277		.type = UE_BULK_INTR,
278		.endpoint = UE_ADDR_ANY,
279		.direction = UE_DIR_OUT,
280		.bufsize = sizeof(struct zyd_cmd),
281		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
282		.callback = zyd_intr_write_callback,
283		.timeout = 1000,	/* 1 second */
284		.ep_index = 1,
285	},
286	[ZYD_INTR_RD] = {
287		.type = UE_INTERRUPT,
288		.endpoint = UE_ADDR_ANY,
289		.direction = UE_DIR_IN,
290		.bufsize = sizeof(struct zyd_cmd),
291		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
292		.callback = zyd_intr_read_callback,
293	},
294};
295#define zyd_read16_m(sc, val, data)	do {				\
296	error = zyd_read16(sc, val, data);				\
297	if (error != 0)							\
298		goto fail;						\
299} while (0)
300#define zyd_write16_m(sc, val, data)	do {				\
301	error = zyd_write16(sc, val, data);				\
302	if (error != 0)							\
303		goto fail;						\
304} while (0)
305#define zyd_read32_m(sc, val, data)	do {				\
306	error = zyd_read32(sc, val, data);				\
307	if (error != 0)							\
308		goto fail;						\
309} while (0)
310#define zyd_write32_m(sc, val, data)	do {				\
311	error = zyd_write32(sc, val, data);				\
312	if (error != 0)							\
313		goto fail;						\
314} while (0)
315
316static int
317zyd_match(device_t dev)
318{
319	struct usb_attach_arg *uaa = device_get_ivars(dev);
320
321	if (uaa->usb_mode != USB_MODE_HOST)
322		return (ENXIO);
323	if (uaa->info.bConfigIndex != ZYD_CONFIG_INDEX)
324		return (ENXIO);
325	if (uaa->info.bIfaceIndex != ZYD_IFACE_INDEX)
326		return (ENXIO);
327
328	return (usbd_lookup_id_by_uaa(zyd_devs, sizeof(zyd_devs), uaa));
329}
330
331static int
332zyd_attach(device_t dev)
333{
334	struct usb_attach_arg *uaa = device_get_ivars(dev);
335	struct zyd_softc *sc = device_get_softc(dev);
336	struct ifnet *ifp;
337	struct ieee80211com *ic;
338	uint8_t iface_index, bands;
339	int error;
340
341	if (uaa->info.bcdDevice < 0x4330) {
342		device_printf(dev, "device version mismatch: 0x%X "
343		    "(only >= 43.30 supported)\n",
344		    uaa->info.bcdDevice);
345		return (EINVAL);
346	}
347
348	device_set_usb_desc(dev);
349	sc->sc_dev = dev;
350	sc->sc_udev = uaa->device;
351	sc->sc_macrev = USB_GET_DRIVER_INFO(uaa);
352
353	mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
354	    MTX_NETWORK_LOCK, MTX_DEF);
355	STAILQ_INIT(&sc->sc_rqh);
356
357	iface_index = ZYD_IFACE_INDEX;
358	error = usbd_transfer_setup(uaa->device,
359	    &iface_index, sc->sc_xfer, zyd_config,
360	    ZYD_N_TRANSFER, sc, &sc->sc_mtx);
361	if (error) {
362		device_printf(dev, "could not allocate USB transfers, "
363		    "err=%s\n", usbd_errstr(error));
364		goto detach;
365	}
366
367	ZYD_LOCK(sc);
368	if ((error = zyd_get_macaddr(sc)) != 0) {
369		device_printf(sc->sc_dev, "could not read EEPROM\n");
370		ZYD_UNLOCK(sc);
371		goto detach;
372	}
373	ZYD_UNLOCK(sc);
374
375	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
376	if (ifp == NULL) {
377		device_printf(sc->sc_dev, "can not if_alloc()\n");
378		goto detach;
379	}
380	ifp->if_softc = sc;
381	if_initname(ifp, "zyd", device_get_unit(sc->sc_dev));
382	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
383	ifp->if_init = zyd_init;
384	ifp->if_ioctl = zyd_ioctl;
385	ifp->if_start = zyd_start;
386	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
387	IFQ_SET_READY(&ifp->if_snd);
388
389	ic = ifp->if_l2com;
390	ic->ic_ifp = ifp;
391	ic->ic_softc = sc;
392	ic->ic_name = device_get_nameunit(dev);
393	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
394	ic->ic_opmode = IEEE80211_M_STA;
395
396	/* set device capabilities */
397	ic->ic_caps =
398		  IEEE80211_C_STA		/* station mode */
399		| IEEE80211_C_MONITOR		/* monitor mode */
400		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
401	        | IEEE80211_C_SHSLOT		/* short slot time supported */
402		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
403	        | IEEE80211_C_WPA		/* 802.11i */
404		;
405
406	bands = 0;
407	setbit(&bands, IEEE80211_MODE_11B);
408	setbit(&bands, IEEE80211_MODE_11G);
409	ieee80211_init_channels(ic, NULL, &bands);
410
411	ieee80211_ifattach(ic, sc->sc_bssid);
412	ic->ic_raw_xmit = zyd_raw_xmit;
413	ic->ic_scan_start = zyd_scan_start;
414	ic->ic_scan_end = zyd_scan_end;
415	ic->ic_set_channel = zyd_set_channel;
416
417	ic->ic_vap_create = zyd_vap_create;
418	ic->ic_vap_delete = zyd_vap_delete;
419	ic->ic_update_mcast = zyd_update_mcast;
420	ic->ic_update_promisc = zyd_update_mcast;
421
422	ieee80211_radiotap_attach(ic,
423	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
424		ZYD_TX_RADIOTAP_PRESENT,
425	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
426		ZYD_RX_RADIOTAP_PRESENT);
427
428	if (bootverbose)
429		ieee80211_announce(ic);
430
431	return (0);
432
433detach:
434	zyd_detach(dev);
435	return (ENXIO);			/* failure */
436}
437
438static int
439zyd_detach(device_t dev)
440{
441	struct zyd_softc *sc = device_get_softc(dev);
442	struct ifnet *ifp = sc->sc_ifp;
443	struct ieee80211com *ic;
444	unsigned int x;
445
446	/*
447	 * Prevent further allocations from RX/TX data
448	 * lists and ioctls:
449	 */
450	ZYD_LOCK(sc);
451	sc->sc_flags |= ZYD_FLAG_DETACHED;
452	STAILQ_INIT(&sc->tx_q);
453	STAILQ_INIT(&sc->tx_free);
454	ZYD_UNLOCK(sc);
455
456	/* drain USB transfers */
457	for (x = 0; x != ZYD_N_TRANSFER; x++)
458		usbd_transfer_drain(sc->sc_xfer[x]);
459
460	/* free TX list, if any */
461	ZYD_LOCK(sc);
462	zyd_unsetup_tx_list(sc);
463	ZYD_UNLOCK(sc);
464
465	/* free USB transfers and some data buffers */
466	usbd_transfer_unsetup(sc->sc_xfer, ZYD_N_TRANSFER);
467
468	if (ifp) {
469		ic = ifp->if_l2com;
470		ieee80211_ifdetach(ic);
471		if_free(ifp);
472	}
473	mtx_destroy(&sc->sc_mtx);
474
475	return (0);
476}
477
478static struct ieee80211vap *
479zyd_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
480    enum ieee80211_opmode opmode, int flags,
481    const uint8_t bssid[IEEE80211_ADDR_LEN],
482    const uint8_t mac[IEEE80211_ADDR_LEN])
483{
484	struct zyd_vap *zvp;
485	struct ieee80211vap *vap;
486
487	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
488		return (NULL);
489	zvp = (struct zyd_vap *) malloc(sizeof(struct zyd_vap),
490	    M_80211_VAP, M_NOWAIT | M_ZERO);
491	if (zvp == NULL)
492		return (NULL);
493	vap = &zvp->vap;
494
495	/* enable s/w bmiss handling for sta mode */
496	if (ieee80211_vap_setup(ic, vap, name, unit, opmode,
497	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac) != 0) {
498		/* out of memory */
499		free(zvp, M_80211_VAP);
500		return (NULL);
501	}
502
503	/* override state transition machine */
504	zvp->newstate = vap->iv_newstate;
505	vap->iv_newstate = zyd_newstate;
506
507	ieee80211_ratectl_init(vap);
508	ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
509
510	/* complete setup */
511	ieee80211_vap_attach(vap, ieee80211_media_change,
512	    ieee80211_media_status);
513	ic->ic_opmode = opmode;
514	return (vap);
515}
516
517static void
518zyd_vap_delete(struct ieee80211vap *vap)
519{
520	struct zyd_vap *zvp = ZYD_VAP(vap);
521
522	ieee80211_ratectl_deinit(vap);
523	ieee80211_vap_detach(vap);
524	free(zvp, M_80211_VAP);
525}
526
527static void
528zyd_tx_free(struct zyd_tx_data *data, int txerr)
529{
530	struct zyd_softc *sc = data->sc;
531
532	if (data->m != NULL) {
533		if (data->m->m_flags & M_TXCB)
534			ieee80211_process_callback(data->ni, data->m,
535			    txerr ? ETIMEDOUT : 0);
536		m_freem(data->m);
537		data->m = NULL;
538
539		ieee80211_free_node(data->ni);
540		data->ni = NULL;
541	}
542	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
543	sc->tx_nfree++;
544}
545
546static void
547zyd_setup_tx_list(struct zyd_softc *sc)
548{
549	struct zyd_tx_data *data;
550	int i;
551
552	sc->tx_nfree = 0;
553	STAILQ_INIT(&sc->tx_q);
554	STAILQ_INIT(&sc->tx_free);
555
556	for (i = 0; i < ZYD_TX_LIST_CNT; i++) {
557		data = &sc->tx_data[i];
558
559		data->sc = sc;
560		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
561		sc->tx_nfree++;
562	}
563}
564
565static void
566zyd_unsetup_tx_list(struct zyd_softc *sc)
567{
568	struct zyd_tx_data *data;
569	int i;
570
571	/* make sure any subsequent use of the queues will fail */
572	sc->tx_nfree = 0;
573	STAILQ_INIT(&sc->tx_q);
574	STAILQ_INIT(&sc->tx_free);
575
576	/* free up all node references and mbufs */
577	for (i = 0; i < ZYD_TX_LIST_CNT; i++) {
578		data = &sc->tx_data[i];
579
580		if (data->m != NULL) {
581			m_freem(data->m);
582			data->m = NULL;
583		}
584		if (data->ni != NULL) {
585			ieee80211_free_node(data->ni);
586			data->ni = NULL;
587		}
588	}
589}
590
591static int
592zyd_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
593{
594	struct zyd_vap *zvp = ZYD_VAP(vap);
595	struct ieee80211com *ic = vap->iv_ic;
596	struct zyd_softc *sc = ic->ic_ifp->if_softc;
597	int error;
598
599	DPRINTF(sc, ZYD_DEBUG_STATE, "%s: %s -> %s\n", __func__,
600	    ieee80211_state_name[vap->iv_state],
601	    ieee80211_state_name[nstate]);
602
603	IEEE80211_UNLOCK(ic);
604	ZYD_LOCK(sc);
605	switch (nstate) {
606	case IEEE80211_S_AUTH:
607		zyd_set_chan(sc, ic->ic_curchan);
608		break;
609	case IEEE80211_S_RUN:
610		if (vap->iv_opmode == IEEE80211_M_MONITOR)
611			break;
612
613		/* turn link LED on */
614		error = zyd_set_led(sc, ZYD_LED1, 1);
615		if (error != 0)
616			break;
617
618		/* make data LED blink upon Tx */
619		zyd_write32_m(sc, sc->sc_fwbase + ZYD_FW_LINK_STATUS, 1);
620
621		IEEE80211_ADDR_COPY(sc->sc_bssid, vap->iv_bss->ni_bssid);
622		zyd_set_bssid(sc, sc->sc_bssid);
623		break;
624	default:
625		break;
626	}
627fail:
628	ZYD_UNLOCK(sc);
629	IEEE80211_LOCK(ic);
630	return (zvp->newstate(vap, nstate, arg));
631}
632
633/*
634 * Callback handler for interrupt transfer
635 */
636static void
637zyd_intr_read_callback(struct usb_xfer *xfer, usb_error_t error)
638{
639	struct zyd_softc *sc = usbd_xfer_softc(xfer);
640	struct ifnet *ifp = sc->sc_ifp;
641	struct ieee80211com *ic = ifp->if_l2com;
642	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
643	struct ieee80211_node *ni;
644	struct zyd_cmd *cmd = &sc->sc_ibuf;
645	struct usb_page_cache *pc;
646	int datalen;
647	int actlen;
648
649	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
650
651	switch (USB_GET_STATE(xfer)) {
652	case USB_ST_TRANSFERRED:
653		pc = usbd_xfer_get_frame(xfer, 0);
654		usbd_copy_out(pc, 0, cmd, sizeof(*cmd));
655
656		switch (le16toh(cmd->code)) {
657		case ZYD_NOTIF_RETRYSTATUS:
658		{
659			struct zyd_notif_retry *retry =
660			    (struct zyd_notif_retry *)cmd->data;
661
662			DPRINTF(sc, ZYD_DEBUG_TX_PROC,
663			    "retry intr: rate=0x%x addr=%s count=%d (0x%x)\n",
664			    le16toh(retry->rate), ether_sprintf(retry->macaddr),
665			    le16toh(retry->count)&0xff, le16toh(retry->count));
666
667			/*
668			 * Find the node to which the packet was sent and
669			 * update its retry statistics.  In BSS mode, this node
670			 * is the AP we're associated to so no lookup is
671			 * actually needed.
672			 */
673			ni = ieee80211_find_txnode(vap, retry->macaddr);
674			if (ni != NULL) {
675				int retrycnt =
676				    (int)(le16toh(retry->count) & 0xff);
677
678				ieee80211_ratectl_tx_complete(vap, ni,
679				    IEEE80211_RATECTL_TX_FAILURE,
680				    &retrycnt, NULL);
681				ieee80211_free_node(ni);
682			}
683			if (le16toh(retry->count) & 0x100)
684				if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);	/* too many retries */
685			break;
686		}
687		case ZYD_NOTIF_IORD:
688		{
689			struct zyd_rq *rqp;
690
691			if (le16toh(*(uint16_t *)cmd->data) == ZYD_CR_INTERRUPT)
692				break;	/* HMAC interrupt */
693
694			datalen = actlen - sizeof(cmd->code);
695			datalen -= 2;	/* XXX: padding? */
696
697			STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
698				int i;
699				int count;
700
701				if (rqp->olen != datalen)
702					continue;
703				count = rqp->olen / sizeof(struct zyd_pair);
704				for (i = 0; i < count; i++) {
705					if (*(((const uint16_t *)rqp->idata) + i) !=
706					    (((struct zyd_pair *)cmd->data) + i)->reg)
707						break;
708				}
709				if (i != count)
710					continue;
711				/* copy answer into caller-supplied buffer */
712				memcpy(rqp->odata, cmd->data, rqp->olen);
713				DPRINTF(sc, ZYD_DEBUG_CMD,
714				    "command %p complete, data = %*D \n",
715				    rqp, rqp->olen, (char *)rqp->odata, ":");
716				wakeup(rqp);	/* wakeup caller */
717				break;
718			}
719			if (rqp == NULL) {
720				device_printf(sc->sc_dev,
721				    "unexpected IORD notification %*D\n",
722				    datalen, cmd->data, ":");
723			}
724			break;
725		}
726		default:
727			device_printf(sc->sc_dev, "unknown notification %x\n",
728			    le16toh(cmd->code));
729		}
730
731		/* FALLTHROUGH */
732	case USB_ST_SETUP:
733tr_setup:
734		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
735		usbd_transfer_submit(xfer);
736		break;
737
738	default:			/* Error */
739		DPRINTF(sc, ZYD_DEBUG_CMD, "error = %s\n",
740		    usbd_errstr(error));
741
742		if (error != USB_ERR_CANCELLED) {
743			/* try to clear stall first */
744			usbd_xfer_set_stall(xfer);
745			goto tr_setup;
746		}
747		break;
748	}
749}
750
751static void
752zyd_intr_write_callback(struct usb_xfer *xfer, usb_error_t error)
753{
754	struct zyd_softc *sc = usbd_xfer_softc(xfer);
755	struct zyd_rq *rqp, *cmd;
756	struct usb_page_cache *pc;
757
758	switch (USB_GET_STATE(xfer)) {
759	case USB_ST_TRANSFERRED:
760		cmd = usbd_xfer_get_priv(xfer);
761		DPRINTF(sc, ZYD_DEBUG_CMD, "command %p transferred\n", cmd);
762		STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
763			/* Ensure the cached rq pointer is still valid */
764			if (rqp == cmd &&
765			    (rqp->flags & ZYD_CMD_FLAG_READ) == 0)
766				wakeup(rqp);	/* wakeup caller */
767		}
768
769		/* FALLTHROUGH */
770	case USB_ST_SETUP:
771tr_setup:
772		STAILQ_FOREACH(rqp, &sc->sc_rqh, rq) {
773			if (rqp->flags & ZYD_CMD_FLAG_SENT)
774				continue;
775
776			pc = usbd_xfer_get_frame(xfer, 0);
777			usbd_copy_in(pc, 0, rqp->cmd, rqp->ilen);
778
779			usbd_xfer_set_frame_len(xfer, 0, rqp->ilen);
780			usbd_xfer_set_priv(xfer, rqp);
781			rqp->flags |= ZYD_CMD_FLAG_SENT;
782			usbd_transfer_submit(xfer);
783			break;
784		}
785		break;
786
787	default:			/* Error */
788		DPRINTF(sc, ZYD_DEBUG_ANY, "error = %s\n",
789		    usbd_errstr(error));
790
791		if (error != USB_ERR_CANCELLED) {
792			/* try to clear stall first */
793			usbd_xfer_set_stall(xfer);
794			goto tr_setup;
795		}
796		break;
797	}
798}
799
800static int
801zyd_cmd(struct zyd_softc *sc, uint16_t code, const void *idata, int ilen,
802    void *odata, int olen, int flags)
803{
804	struct zyd_cmd cmd;
805	struct zyd_rq rq;
806	int error;
807
808	if (ilen > (int)sizeof(cmd.data))
809		return (EINVAL);
810
811	cmd.code = htole16(code);
812	memcpy(cmd.data, idata, ilen);
813	DPRINTF(sc, ZYD_DEBUG_CMD, "sending cmd %p = %*D\n",
814	    &rq, ilen, idata, ":");
815
816	rq.cmd = &cmd;
817	rq.idata = idata;
818	rq.odata = odata;
819	rq.ilen = sizeof(uint16_t) + ilen;
820	rq.olen = olen;
821	rq.flags = flags;
822	STAILQ_INSERT_TAIL(&sc->sc_rqh, &rq, rq);
823	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_RD]);
824	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_WR]);
825
826	/* wait at most one second for command reply */
827	error = mtx_sleep(&rq, &sc->sc_mtx, 0 , "zydcmd", hz);
828	if (error)
829		device_printf(sc->sc_dev, "command timeout\n");
830	STAILQ_REMOVE(&sc->sc_rqh, &rq, zyd_rq, rq);
831	DPRINTF(sc, ZYD_DEBUG_CMD, "finsihed cmd %p, error = %d \n",
832	    &rq, error);
833
834	return (error);
835}
836
837static int
838zyd_read16(struct zyd_softc *sc, uint16_t reg, uint16_t *val)
839{
840	struct zyd_pair tmp;
841	int error;
842
843	reg = htole16(reg);
844	error = zyd_cmd(sc, ZYD_CMD_IORD, &reg, sizeof(reg), &tmp, sizeof(tmp),
845	    ZYD_CMD_FLAG_READ);
846	if (error == 0)
847		*val = le16toh(tmp.val);
848	return (error);
849}
850
851static int
852zyd_read32(struct zyd_softc *sc, uint16_t reg, uint32_t *val)
853{
854	struct zyd_pair tmp[2];
855	uint16_t regs[2];
856	int error;
857
858	regs[0] = htole16(ZYD_REG32_HI(reg));
859	regs[1] = htole16(ZYD_REG32_LO(reg));
860	error = zyd_cmd(sc, ZYD_CMD_IORD, regs, sizeof(regs), tmp, sizeof(tmp),
861	    ZYD_CMD_FLAG_READ);
862	if (error == 0)
863		*val = le16toh(tmp[0].val) << 16 | le16toh(tmp[1].val);
864	return (error);
865}
866
867static int
868zyd_write16(struct zyd_softc *sc, uint16_t reg, uint16_t val)
869{
870	struct zyd_pair pair;
871
872	pair.reg = htole16(reg);
873	pair.val = htole16(val);
874
875	return zyd_cmd(sc, ZYD_CMD_IOWR, &pair, sizeof(pair), NULL, 0, 0);
876}
877
878static int
879zyd_write32(struct zyd_softc *sc, uint16_t reg, uint32_t val)
880{
881	struct zyd_pair pair[2];
882
883	pair[0].reg = htole16(ZYD_REG32_HI(reg));
884	pair[0].val = htole16(val >> 16);
885	pair[1].reg = htole16(ZYD_REG32_LO(reg));
886	pair[1].val = htole16(val & 0xffff);
887
888	return zyd_cmd(sc, ZYD_CMD_IOWR, pair, sizeof(pair), NULL, 0, 0);
889}
890
891static int
892zyd_rfwrite(struct zyd_softc *sc, uint32_t val)
893{
894	struct zyd_rf *rf = &sc->sc_rf;
895	struct zyd_rfwrite_cmd req;
896	uint16_t cr203;
897	int error, i;
898
899	zyd_read16_m(sc, ZYD_CR203, &cr203);
900	cr203 &= ~(ZYD_RF_IF_LE | ZYD_RF_CLK | ZYD_RF_DATA);
901
902	req.code  = htole16(2);
903	req.width = htole16(rf->width);
904	for (i = 0; i < rf->width; i++) {
905		req.bit[i] = htole16(cr203);
906		if (val & (1 << (rf->width - 1 - i)))
907			req.bit[i] |= htole16(ZYD_RF_DATA);
908	}
909	error = zyd_cmd(sc, ZYD_CMD_RFCFG, &req, 4 + 2 * rf->width, NULL, 0, 0);
910fail:
911	return (error);
912}
913
914static int
915zyd_rfwrite_cr(struct zyd_softc *sc, uint32_t val)
916{
917	int error;
918
919	zyd_write16_m(sc, ZYD_CR244, (val >> 16) & 0xff);
920	zyd_write16_m(sc, ZYD_CR243, (val >>  8) & 0xff);
921	zyd_write16_m(sc, ZYD_CR242, (val >>  0) & 0xff);
922fail:
923	return (error);
924}
925
926static int
927zyd_lock_phy(struct zyd_softc *sc)
928{
929	int error;
930	uint32_t tmp;
931
932	zyd_read32_m(sc, ZYD_MAC_MISC, &tmp);
933	tmp &= ~ZYD_UNLOCK_PHY_REGS;
934	zyd_write32_m(sc, ZYD_MAC_MISC, tmp);
935fail:
936	return (error);
937}
938
939static int
940zyd_unlock_phy(struct zyd_softc *sc)
941{
942	int error;
943	uint32_t tmp;
944
945	zyd_read32_m(sc, ZYD_MAC_MISC, &tmp);
946	tmp |= ZYD_UNLOCK_PHY_REGS;
947	zyd_write32_m(sc, ZYD_MAC_MISC, tmp);
948fail:
949	return (error);
950}
951
952/*
953 * RFMD RF methods.
954 */
955static int
956zyd_rfmd_init(struct zyd_rf *rf)
957{
958#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
959	struct zyd_softc *sc = rf->rf_sc;
960	static const struct zyd_phy_pair phyini[] = ZYD_RFMD_PHY;
961	static const uint32_t rfini[] = ZYD_RFMD_RF;
962	int i, error;
963
964	/* init RF-dependent PHY registers */
965	for (i = 0; i < N(phyini); i++) {
966		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
967	}
968
969	/* init RFMD radio */
970	for (i = 0; i < N(rfini); i++) {
971		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
972			return (error);
973	}
974fail:
975	return (error);
976#undef N
977}
978
979static int
980zyd_rfmd_switch_radio(struct zyd_rf *rf, int on)
981{
982	int error;
983	struct zyd_softc *sc = rf->rf_sc;
984
985	zyd_write16_m(sc, ZYD_CR10, on ? 0x89 : 0x15);
986	zyd_write16_m(sc, ZYD_CR11, on ? 0x00 : 0x81);
987fail:
988	return (error);
989}
990
991static int
992zyd_rfmd_set_channel(struct zyd_rf *rf, uint8_t chan)
993{
994	int error;
995	struct zyd_softc *sc = rf->rf_sc;
996	static const struct {
997		uint32_t	r1, r2;
998	} rfprog[] = ZYD_RFMD_CHANTABLE;
999
1000	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1001	if (error != 0)
1002		goto fail;
1003	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1004	if (error != 0)
1005		goto fail;
1006
1007fail:
1008	return (error);
1009}
1010
1011/*
1012 * AL2230 RF methods.
1013 */
1014static int
1015zyd_al2230_init(struct zyd_rf *rf)
1016{
1017#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1018	struct zyd_softc *sc = rf->rf_sc;
1019	static const struct zyd_phy_pair phyini[] = ZYD_AL2230_PHY;
1020	static const struct zyd_phy_pair phy2230s[] = ZYD_AL2230S_PHY_INIT;
1021	static const struct zyd_phy_pair phypll[] = {
1022		{ ZYD_CR251, 0x2f }, { ZYD_CR251, 0x3f },
1023		{ ZYD_CR138, 0x28 }, { ZYD_CR203, 0x06 }
1024	};
1025	static const uint32_t rfini1[] = ZYD_AL2230_RF_PART1;
1026	static const uint32_t rfini2[] = ZYD_AL2230_RF_PART2;
1027	static const uint32_t rfini3[] = ZYD_AL2230_RF_PART3;
1028	int i, error;
1029
1030	/* init RF-dependent PHY registers */
1031	for (i = 0; i < N(phyini); i++)
1032		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1033
1034	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0) {
1035		for (i = 0; i < N(phy2230s); i++)
1036			zyd_write16_m(sc, phy2230s[i].reg, phy2230s[i].val);
1037	}
1038
1039	/* init AL2230 radio */
1040	for (i = 0; i < N(rfini1); i++) {
1041		error = zyd_rfwrite(sc, rfini1[i]);
1042		if (error != 0)
1043			goto fail;
1044	}
1045
1046	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0)
1047		error = zyd_rfwrite(sc, 0x000824);
1048	else
1049		error = zyd_rfwrite(sc, 0x0005a4);
1050	if (error != 0)
1051		goto fail;
1052
1053	for (i = 0; i < N(rfini2); i++) {
1054		error = zyd_rfwrite(sc, rfini2[i]);
1055		if (error != 0)
1056			goto fail;
1057	}
1058
1059	for (i = 0; i < N(phypll); i++)
1060		zyd_write16_m(sc, phypll[i].reg, phypll[i].val);
1061
1062	for (i = 0; i < N(rfini3); i++) {
1063		error = zyd_rfwrite(sc, rfini3[i]);
1064		if (error != 0)
1065			goto fail;
1066	}
1067fail:
1068	return (error);
1069#undef N
1070}
1071
1072static int
1073zyd_al2230_fini(struct zyd_rf *rf)
1074{
1075#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1076	int error, i;
1077	struct zyd_softc *sc = rf->rf_sc;
1078	static const struct zyd_phy_pair phy[] = ZYD_AL2230_PHY_FINI_PART1;
1079
1080	for (i = 0; i < N(phy); i++)
1081		zyd_write16_m(sc, phy[i].reg, phy[i].val);
1082
1083	if (sc->sc_newphy != 0)
1084		zyd_write16_m(sc, ZYD_CR9, 0xe1);
1085
1086	zyd_write16_m(sc, ZYD_CR203, 0x6);
1087fail:
1088	return (error);
1089#undef N
1090}
1091
1092static int
1093zyd_al2230_init_b(struct zyd_rf *rf)
1094{
1095#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1096	struct zyd_softc *sc = rf->rf_sc;
1097	static const struct zyd_phy_pair phy1[] = ZYD_AL2230_PHY_PART1;
1098	static const struct zyd_phy_pair phy2[] = ZYD_AL2230_PHY_PART2;
1099	static const struct zyd_phy_pair phy3[] = ZYD_AL2230_PHY_PART3;
1100	static const struct zyd_phy_pair phy2230s[] = ZYD_AL2230S_PHY_INIT;
1101	static const struct zyd_phy_pair phyini[] = ZYD_AL2230_PHY_B;
1102	static const uint32_t rfini_part1[] = ZYD_AL2230_RF_B_PART1;
1103	static const uint32_t rfini_part2[] = ZYD_AL2230_RF_B_PART2;
1104	static const uint32_t rfini_part3[] = ZYD_AL2230_RF_B_PART3;
1105	static const uint32_t zyd_al2230_chtable[][3] = ZYD_AL2230_CHANTABLE;
1106	int i, error;
1107
1108	for (i = 0; i < N(phy1); i++)
1109		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1110
1111	/* init RF-dependent PHY registers */
1112	for (i = 0; i < N(phyini); i++)
1113		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1114
1115	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0) {
1116		for (i = 0; i < N(phy2230s); i++)
1117			zyd_write16_m(sc, phy2230s[i].reg, phy2230s[i].val);
1118	}
1119
1120	for (i = 0; i < 3; i++) {
1121		error = zyd_rfwrite_cr(sc, zyd_al2230_chtable[0][i]);
1122		if (error != 0)
1123			return (error);
1124	}
1125
1126	for (i = 0; i < N(rfini_part1); i++) {
1127		error = zyd_rfwrite_cr(sc, rfini_part1[i]);
1128		if (error != 0)
1129			return (error);
1130	}
1131
1132	if (sc->sc_rfrev == ZYD_RF_AL2230S || sc->sc_al2230s != 0)
1133		error = zyd_rfwrite(sc, 0x241000);
1134	else
1135		error = zyd_rfwrite(sc, 0x25a000);
1136	if (error != 0)
1137		goto fail;
1138
1139	for (i = 0; i < N(rfini_part2); i++) {
1140		error = zyd_rfwrite_cr(sc, rfini_part2[i]);
1141		if (error != 0)
1142			return (error);
1143	}
1144
1145	for (i = 0; i < N(phy2); i++)
1146		zyd_write16_m(sc, phy2[i].reg, phy2[i].val);
1147
1148	for (i = 0; i < N(rfini_part3); i++) {
1149		error = zyd_rfwrite_cr(sc, rfini_part3[i]);
1150		if (error != 0)
1151			return (error);
1152	}
1153
1154	for (i = 0; i < N(phy3); i++)
1155		zyd_write16_m(sc, phy3[i].reg, phy3[i].val);
1156
1157	error = zyd_al2230_fini(rf);
1158fail:
1159	return (error);
1160#undef N
1161}
1162
1163static int
1164zyd_al2230_switch_radio(struct zyd_rf *rf, int on)
1165{
1166	struct zyd_softc *sc = rf->rf_sc;
1167	int error, on251 = (sc->sc_macrev == ZYD_ZD1211) ? 0x3f : 0x7f;
1168
1169	zyd_write16_m(sc, ZYD_CR11,  on ? 0x00 : 0x04);
1170	zyd_write16_m(sc, ZYD_CR251, on ? on251 : 0x2f);
1171fail:
1172	return (error);
1173}
1174
1175static int
1176zyd_al2230_set_channel(struct zyd_rf *rf, uint8_t chan)
1177{
1178#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1179	int error, i;
1180	struct zyd_softc *sc = rf->rf_sc;
1181	static const struct zyd_phy_pair phy1[] = {
1182		{ ZYD_CR138, 0x28 }, { ZYD_CR203, 0x06 },
1183	};
1184	static const struct {
1185		uint32_t	r1, r2, r3;
1186	} rfprog[] = ZYD_AL2230_CHANTABLE;
1187
1188	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1189	if (error != 0)
1190		goto fail;
1191	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1192	if (error != 0)
1193		goto fail;
1194	error = zyd_rfwrite(sc, rfprog[chan - 1].r3);
1195	if (error != 0)
1196		goto fail;
1197
1198	for (i = 0; i < N(phy1); i++)
1199		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1200fail:
1201	return (error);
1202#undef N
1203}
1204
1205static int
1206zyd_al2230_set_channel_b(struct zyd_rf *rf, uint8_t chan)
1207{
1208#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1209	int error, i;
1210	struct zyd_softc *sc = rf->rf_sc;
1211	static const struct zyd_phy_pair phy1[] = ZYD_AL2230_PHY_PART1;
1212	static const struct {
1213		uint32_t	r1, r2, r3;
1214	} rfprog[] = ZYD_AL2230_CHANTABLE_B;
1215
1216	for (i = 0; i < N(phy1); i++)
1217		zyd_write16_m(sc, phy1[i].reg, phy1[i].val);
1218
1219	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r1);
1220	if (error != 0)
1221		goto fail;
1222	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r2);
1223	if (error != 0)
1224		goto fail;
1225	error = zyd_rfwrite_cr(sc, rfprog[chan - 1].r3);
1226	if (error != 0)
1227		goto fail;
1228	error = zyd_al2230_fini(rf);
1229fail:
1230	return (error);
1231#undef N
1232}
1233
1234#define	ZYD_AL2230_PHY_BANDEDGE6					\
1235{									\
1236	{ ZYD_CR128, 0x14 }, { ZYD_CR129, 0x12 }, { ZYD_CR130, 0x10 },	\
1237	{ ZYD_CR47,  0x1e }						\
1238}
1239
1240static int
1241zyd_al2230_bandedge6(struct zyd_rf *rf, struct ieee80211_channel *c)
1242{
1243#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1244	int error = 0, i;
1245	struct zyd_softc *sc = rf->rf_sc;
1246	struct ifnet *ifp = sc->sc_ifp;
1247	struct ieee80211com *ic = ifp->if_l2com;
1248	struct zyd_phy_pair r[] = ZYD_AL2230_PHY_BANDEDGE6;
1249	int chan = ieee80211_chan2ieee(ic, c);
1250
1251	if (chan == 1 || chan == 11)
1252		r[0].val = 0x12;
1253
1254	for (i = 0; i < N(r); i++)
1255		zyd_write16_m(sc, r[i].reg, r[i].val);
1256fail:
1257	return (error);
1258#undef N
1259}
1260
1261/*
1262 * AL7230B RF methods.
1263 */
1264static int
1265zyd_al7230B_init(struct zyd_rf *rf)
1266{
1267#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1268	struct zyd_softc *sc = rf->rf_sc;
1269	static const struct zyd_phy_pair phyini_1[] = ZYD_AL7230B_PHY_1;
1270	static const struct zyd_phy_pair phyini_2[] = ZYD_AL7230B_PHY_2;
1271	static const struct zyd_phy_pair phyini_3[] = ZYD_AL7230B_PHY_3;
1272	static const uint32_t rfini_1[] = ZYD_AL7230B_RF_1;
1273	static const uint32_t rfini_2[] = ZYD_AL7230B_RF_2;
1274	int i, error;
1275
1276	/* for AL7230B, PHY and RF need to be initialized in "phases" */
1277
1278	/* init RF-dependent PHY registers, part one */
1279	for (i = 0; i < N(phyini_1); i++)
1280		zyd_write16_m(sc, phyini_1[i].reg, phyini_1[i].val);
1281
1282	/* init AL7230B radio, part one */
1283	for (i = 0; i < N(rfini_1); i++) {
1284		if ((error = zyd_rfwrite(sc, rfini_1[i])) != 0)
1285			return (error);
1286	}
1287	/* init RF-dependent PHY registers, part two */
1288	for (i = 0; i < N(phyini_2); i++)
1289		zyd_write16_m(sc, phyini_2[i].reg, phyini_2[i].val);
1290
1291	/* init AL7230B radio, part two */
1292	for (i = 0; i < N(rfini_2); i++) {
1293		if ((error = zyd_rfwrite(sc, rfini_2[i])) != 0)
1294			return (error);
1295	}
1296	/* init RF-dependent PHY registers, part three */
1297	for (i = 0; i < N(phyini_3); i++)
1298		zyd_write16_m(sc, phyini_3[i].reg, phyini_3[i].val);
1299fail:
1300	return (error);
1301#undef N
1302}
1303
1304static int
1305zyd_al7230B_switch_radio(struct zyd_rf *rf, int on)
1306{
1307	int error;
1308	struct zyd_softc *sc = rf->rf_sc;
1309
1310	zyd_write16_m(sc, ZYD_CR11,  on ? 0x00 : 0x04);
1311	zyd_write16_m(sc, ZYD_CR251, on ? 0x3f : 0x2f);
1312fail:
1313	return (error);
1314}
1315
1316static int
1317zyd_al7230B_set_channel(struct zyd_rf *rf, uint8_t chan)
1318{
1319#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1320	struct zyd_softc *sc = rf->rf_sc;
1321	static const struct {
1322		uint32_t	r1, r2;
1323	} rfprog[] = ZYD_AL7230B_CHANTABLE;
1324	static const uint32_t rfsc[] = ZYD_AL7230B_RF_SETCHANNEL;
1325	int i, error;
1326
1327	zyd_write16_m(sc, ZYD_CR240, 0x57);
1328	zyd_write16_m(sc, ZYD_CR251, 0x2f);
1329
1330	for (i = 0; i < N(rfsc); i++) {
1331		if ((error = zyd_rfwrite(sc, rfsc[i])) != 0)
1332			return (error);
1333	}
1334
1335	zyd_write16_m(sc, ZYD_CR128, 0x14);
1336	zyd_write16_m(sc, ZYD_CR129, 0x12);
1337	zyd_write16_m(sc, ZYD_CR130, 0x10);
1338	zyd_write16_m(sc, ZYD_CR38,  0x38);
1339	zyd_write16_m(sc, ZYD_CR136, 0xdf);
1340
1341	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1342	if (error != 0)
1343		goto fail;
1344	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1345	if (error != 0)
1346		goto fail;
1347	error = zyd_rfwrite(sc, 0x3c9000);
1348	if (error != 0)
1349		goto fail;
1350
1351	zyd_write16_m(sc, ZYD_CR251, 0x3f);
1352	zyd_write16_m(sc, ZYD_CR203, 0x06);
1353	zyd_write16_m(sc, ZYD_CR240, 0x08);
1354fail:
1355	return (error);
1356#undef N
1357}
1358
1359/*
1360 * AL2210 RF methods.
1361 */
1362static int
1363zyd_al2210_init(struct zyd_rf *rf)
1364{
1365#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1366	struct zyd_softc *sc = rf->rf_sc;
1367	static const struct zyd_phy_pair phyini[] = ZYD_AL2210_PHY;
1368	static const uint32_t rfini[] = ZYD_AL2210_RF;
1369	uint32_t tmp;
1370	int i, error;
1371
1372	zyd_write32_m(sc, ZYD_CR18, 2);
1373
1374	/* init RF-dependent PHY registers */
1375	for (i = 0; i < N(phyini); i++)
1376		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1377
1378	/* init AL2210 radio */
1379	for (i = 0; i < N(rfini); i++) {
1380		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1381			return (error);
1382	}
1383	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1384	zyd_read32_m(sc, ZYD_CR_RADIO_PD, &tmp);
1385	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp & ~1);
1386	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp | 1);
1387	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x05);
1388	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x00);
1389	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1390	zyd_write32_m(sc, ZYD_CR18, 3);
1391fail:
1392	return (error);
1393#undef N
1394}
1395
1396static int
1397zyd_al2210_switch_radio(struct zyd_rf *rf, int on)
1398{
1399	/* vendor driver does nothing for this RF chip */
1400
1401	return (0);
1402}
1403
1404static int
1405zyd_al2210_set_channel(struct zyd_rf *rf, uint8_t chan)
1406{
1407	int error;
1408	struct zyd_softc *sc = rf->rf_sc;
1409	static const uint32_t rfprog[] = ZYD_AL2210_CHANTABLE;
1410	uint32_t tmp;
1411
1412	zyd_write32_m(sc, ZYD_CR18, 2);
1413	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1414	zyd_read32_m(sc, ZYD_CR_RADIO_PD, &tmp);
1415	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp & ~1);
1416	zyd_write32_m(sc, ZYD_CR_RADIO_PD, tmp | 1);
1417	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x05);
1418	zyd_write32_m(sc, ZYD_CR_RFCFG, 0x00);
1419	zyd_write16_m(sc, ZYD_CR47, 0x1e);
1420
1421	/* actually set the channel */
1422	error = zyd_rfwrite(sc, rfprog[chan - 1]);
1423	if (error != 0)
1424		goto fail;
1425
1426	zyd_write32_m(sc, ZYD_CR18, 3);
1427fail:
1428	return (error);
1429}
1430
1431/*
1432 * GCT RF methods.
1433 */
1434static int
1435zyd_gct_init(struct zyd_rf *rf)
1436{
1437#define	ZYD_GCT_INTR_REG	0x85c1
1438#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1439	struct zyd_softc *sc = rf->rf_sc;
1440	static const struct zyd_phy_pair phyini[] = ZYD_GCT_PHY;
1441	static const uint32_t rfini[] = ZYD_GCT_RF;
1442	static const uint16_t vco[11][7] = ZYD_GCT_VCO;
1443	int i, idx = -1, error;
1444	uint16_t data;
1445
1446	/* init RF-dependent PHY registers */
1447	for (i = 0; i < N(phyini); i++)
1448		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1449
1450	/* init cgt radio */
1451	for (i = 0; i < N(rfini); i++) {
1452		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1453			return (error);
1454	}
1455
1456	error = zyd_gct_mode(rf);
1457	if (error != 0)
1458		return (error);
1459
1460	for (i = 0; i < (int)(N(vco) - 1); i++) {
1461		error = zyd_gct_set_channel_synth(rf, 1, 0);
1462		if (error != 0)
1463			goto fail;
1464		error = zyd_gct_write(rf, vco[i][0]);
1465		if (error != 0)
1466			goto fail;
1467		zyd_write16_m(sc, ZYD_GCT_INTR_REG, 0xf);
1468		zyd_read16_m(sc, ZYD_GCT_INTR_REG, &data);
1469		if ((data & 0xf) == 0) {
1470			idx = i;
1471			break;
1472		}
1473	}
1474	if (idx == -1) {
1475		error = zyd_gct_set_channel_synth(rf, 1, 1);
1476		if (error != 0)
1477			goto fail;
1478		error = zyd_gct_write(rf, 0x6662);
1479		if (error != 0)
1480			goto fail;
1481	}
1482
1483	rf->idx = idx;
1484	zyd_write16_m(sc, ZYD_CR203, 0x6);
1485fail:
1486	return (error);
1487#undef N
1488#undef ZYD_GCT_INTR_REG
1489}
1490
1491static int
1492zyd_gct_mode(struct zyd_rf *rf)
1493{
1494#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1495	struct zyd_softc *sc = rf->rf_sc;
1496	static const uint32_t mode[] = {
1497		0x25f98, 0x25f9a, 0x25f94, 0x27fd4
1498	};
1499	int i, error;
1500
1501	for (i = 0; i < N(mode); i++) {
1502		if ((error = zyd_rfwrite(sc, mode[i])) != 0)
1503			break;
1504	}
1505	return (error);
1506#undef N
1507}
1508
1509static int
1510zyd_gct_set_channel_synth(struct zyd_rf *rf, int chan, int acal)
1511{
1512	int error, idx = chan - 1;
1513	struct zyd_softc *sc = rf->rf_sc;
1514	static uint32_t acal_synth[] = ZYD_GCT_CHANNEL_ACAL;
1515	static uint32_t std_synth[] = ZYD_GCT_CHANNEL_STD;
1516	static uint32_t div_synth[] = ZYD_GCT_CHANNEL_DIV;
1517
1518	error = zyd_rfwrite(sc,
1519	    (acal == 1) ? acal_synth[idx] : std_synth[idx]);
1520	if (error != 0)
1521		return (error);
1522	return zyd_rfwrite(sc, div_synth[idx]);
1523}
1524
1525static int
1526zyd_gct_write(struct zyd_rf *rf, uint16_t value)
1527{
1528	struct zyd_softc *sc = rf->rf_sc;
1529
1530	return zyd_rfwrite(sc, 0x300000 | 0x40000 | value);
1531}
1532
1533static int
1534zyd_gct_switch_radio(struct zyd_rf *rf, int on)
1535{
1536	int error;
1537	struct zyd_softc *sc = rf->rf_sc;
1538
1539	error = zyd_rfwrite(sc, on ? 0x25f94 : 0x25f90);
1540	if (error != 0)
1541		return (error);
1542
1543	zyd_write16_m(sc, ZYD_CR11, on ? 0x00 : 0x04);
1544	zyd_write16_m(sc, ZYD_CR251,
1545	    on ? ((sc->sc_macrev == ZYD_ZD1211B) ? 0x7f : 0x3f) : 0x2f);
1546fail:
1547	return (error);
1548}
1549
1550static int
1551zyd_gct_set_channel(struct zyd_rf *rf, uint8_t chan)
1552{
1553#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1554	int error, i;
1555	struct zyd_softc *sc = rf->rf_sc;
1556	static const struct zyd_phy_pair cmd[] = {
1557		{ ZYD_CR80, 0x30 }, { ZYD_CR81, 0x30 }, { ZYD_CR79, 0x58 },
1558		{ ZYD_CR12, 0xf0 }, { ZYD_CR77, 0x1b }, { ZYD_CR78, 0x58 },
1559	};
1560	static const uint16_t vco[11][7] = ZYD_GCT_VCO;
1561
1562	error = zyd_gct_set_channel_synth(rf, chan, 0);
1563	if (error != 0)
1564		goto fail;
1565	error = zyd_gct_write(rf, (rf->idx == -1) ? 0x6662 :
1566	    vco[rf->idx][((chan - 1) / 2)]);
1567	if (error != 0)
1568		goto fail;
1569	error = zyd_gct_mode(rf);
1570	if (error != 0)
1571		return (error);
1572	for (i = 0; i < N(cmd); i++)
1573		zyd_write16_m(sc, cmd[i].reg, cmd[i].val);
1574	error = zyd_gct_txgain(rf, chan);
1575	if (error != 0)
1576		return (error);
1577	zyd_write16_m(sc, ZYD_CR203, 0x6);
1578fail:
1579	return (error);
1580#undef N
1581}
1582
1583static int
1584zyd_gct_txgain(struct zyd_rf *rf, uint8_t chan)
1585{
1586#define N(a)	(sizeof(a) / sizeof((a)[0]))
1587	struct zyd_softc *sc = rf->rf_sc;
1588	static uint32_t txgain[] = ZYD_GCT_TXGAIN;
1589	uint8_t idx = sc->sc_pwrint[chan - 1];
1590
1591	if (idx >= N(txgain)) {
1592		device_printf(sc->sc_dev, "could not set TX gain (%d %#x)\n",
1593		    chan, idx);
1594		return 0;
1595	}
1596
1597	return zyd_rfwrite(sc, 0x700000 | txgain[idx]);
1598#undef N
1599}
1600
1601/*
1602 * Maxim2 RF methods.
1603 */
1604static int
1605zyd_maxim2_init(struct zyd_rf *rf)
1606{
1607#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1608	struct zyd_softc *sc = rf->rf_sc;
1609	static const struct zyd_phy_pair phyini[] = ZYD_MAXIM2_PHY;
1610	static const uint32_t rfini[] = ZYD_MAXIM2_RF;
1611	uint16_t tmp;
1612	int i, error;
1613
1614	/* init RF-dependent PHY registers */
1615	for (i = 0; i < N(phyini); i++)
1616		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1617
1618	zyd_read16_m(sc, ZYD_CR203, &tmp);
1619	zyd_write16_m(sc, ZYD_CR203, tmp & ~(1 << 4));
1620
1621	/* init maxim2 radio */
1622	for (i = 0; i < N(rfini); i++) {
1623		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1624			return (error);
1625	}
1626	zyd_read16_m(sc, ZYD_CR203, &tmp);
1627	zyd_write16_m(sc, ZYD_CR203, tmp | (1 << 4));
1628fail:
1629	return (error);
1630#undef N
1631}
1632
1633static int
1634zyd_maxim2_switch_radio(struct zyd_rf *rf, int on)
1635{
1636
1637	/* vendor driver does nothing for this RF chip */
1638	return (0);
1639}
1640
1641static int
1642zyd_maxim2_set_channel(struct zyd_rf *rf, uint8_t chan)
1643{
1644#define N(a)	((int)(sizeof(a) / sizeof((a)[0])))
1645	struct zyd_softc *sc = rf->rf_sc;
1646	static const struct zyd_phy_pair phyini[] = ZYD_MAXIM2_PHY;
1647	static const uint32_t rfini[] = ZYD_MAXIM2_RF;
1648	static const struct {
1649		uint32_t	r1, r2;
1650	} rfprog[] = ZYD_MAXIM2_CHANTABLE;
1651	uint16_t tmp;
1652	int i, error;
1653
1654	/*
1655	 * Do the same as we do when initializing it, except for the channel
1656	 * values coming from the two channel tables.
1657	 */
1658
1659	/* init RF-dependent PHY registers */
1660	for (i = 0; i < N(phyini); i++)
1661		zyd_write16_m(sc, phyini[i].reg, phyini[i].val);
1662
1663	zyd_read16_m(sc, ZYD_CR203, &tmp);
1664	zyd_write16_m(sc, ZYD_CR203, tmp & ~(1 << 4));
1665
1666	/* first two values taken from the chantables */
1667	error = zyd_rfwrite(sc, rfprog[chan - 1].r1);
1668	if (error != 0)
1669		goto fail;
1670	error = zyd_rfwrite(sc, rfprog[chan - 1].r2);
1671	if (error != 0)
1672		goto fail;
1673
1674	/* init maxim2 radio - skipping the two first values */
1675	for (i = 2; i < N(rfini); i++) {
1676		if ((error = zyd_rfwrite(sc, rfini[i])) != 0)
1677			return (error);
1678	}
1679	zyd_read16_m(sc, ZYD_CR203, &tmp);
1680	zyd_write16_m(sc, ZYD_CR203, tmp | (1 << 4));
1681fail:
1682	return (error);
1683#undef N
1684}
1685
1686static int
1687zyd_rf_attach(struct zyd_softc *sc, uint8_t type)
1688{
1689	struct zyd_rf *rf = &sc->sc_rf;
1690
1691	rf->rf_sc = sc;
1692	rf->update_pwr = 1;
1693
1694	switch (type) {
1695	case ZYD_RF_RFMD:
1696		rf->init         = zyd_rfmd_init;
1697		rf->switch_radio = zyd_rfmd_switch_radio;
1698		rf->set_channel  = zyd_rfmd_set_channel;
1699		rf->width        = 24;	/* 24-bit RF values */
1700		break;
1701	case ZYD_RF_AL2230:
1702	case ZYD_RF_AL2230S:
1703		if (sc->sc_macrev == ZYD_ZD1211B) {
1704			rf->init = zyd_al2230_init_b;
1705			rf->set_channel = zyd_al2230_set_channel_b;
1706		} else {
1707			rf->init = zyd_al2230_init;
1708			rf->set_channel = zyd_al2230_set_channel;
1709		}
1710		rf->switch_radio = zyd_al2230_switch_radio;
1711		rf->bandedge6	 = zyd_al2230_bandedge6;
1712		rf->width        = 24;	/* 24-bit RF values */
1713		break;
1714	case ZYD_RF_AL7230B:
1715		rf->init         = zyd_al7230B_init;
1716		rf->switch_radio = zyd_al7230B_switch_radio;
1717		rf->set_channel  = zyd_al7230B_set_channel;
1718		rf->width        = 24;	/* 24-bit RF values */
1719		break;
1720	case ZYD_RF_AL2210:
1721		rf->init         = zyd_al2210_init;
1722		rf->switch_radio = zyd_al2210_switch_radio;
1723		rf->set_channel  = zyd_al2210_set_channel;
1724		rf->width        = 24;	/* 24-bit RF values */
1725		break;
1726	case ZYD_RF_MAXIM_NEW:
1727	case ZYD_RF_GCT:
1728		rf->init         = zyd_gct_init;
1729		rf->switch_radio = zyd_gct_switch_radio;
1730		rf->set_channel  = zyd_gct_set_channel;
1731		rf->width        = 24;	/* 24-bit RF values */
1732		rf->update_pwr   = 0;
1733		break;
1734	case ZYD_RF_MAXIM_NEW2:
1735		rf->init         = zyd_maxim2_init;
1736		rf->switch_radio = zyd_maxim2_switch_radio;
1737		rf->set_channel  = zyd_maxim2_set_channel;
1738		rf->width        = 18;	/* 18-bit RF values */
1739		break;
1740	default:
1741		device_printf(sc->sc_dev,
1742		    "sorry, radio \"%s\" is not supported yet\n",
1743		    zyd_rf_name(type));
1744		return (EINVAL);
1745	}
1746	return (0);
1747}
1748
1749static const char *
1750zyd_rf_name(uint8_t type)
1751{
1752	static const char * const zyd_rfs[] = {
1753		"unknown", "unknown", "UW2451",   "UCHIP",     "AL2230",
1754		"AL7230B", "THETA",   "AL2210",   "MAXIM_NEW", "GCT",
1755		"AL2230S",  "RALINK",  "INTERSIL", "RFMD",      "MAXIM_NEW2",
1756		"PHILIPS"
1757	};
1758
1759	return zyd_rfs[(type > 15) ? 0 : type];
1760}
1761
1762static int
1763zyd_hw_init(struct zyd_softc *sc)
1764{
1765	int error;
1766	const struct zyd_phy_pair *phyp;
1767	struct zyd_rf *rf = &sc->sc_rf;
1768	uint16_t val;
1769
1770	/* specify that the plug and play is finished */
1771	zyd_write32_m(sc, ZYD_MAC_AFTER_PNP, 1);
1772	zyd_read16_m(sc, ZYD_FIRMWARE_BASE_ADDR, &sc->sc_fwbase);
1773	DPRINTF(sc, ZYD_DEBUG_FW, "firmware base address=0x%04x\n",
1774	    sc->sc_fwbase);
1775
1776	/* retrieve firmware revision number */
1777	zyd_read16_m(sc, sc->sc_fwbase + ZYD_FW_FIRMWARE_REV, &sc->sc_fwrev);
1778	zyd_write32_m(sc, ZYD_CR_GPI_EN, 0);
1779	zyd_write32_m(sc, ZYD_MAC_CONT_WIN_LIMIT, 0x7f043f);
1780	/* set mandatory rates - XXX assumes 802.11b/g */
1781	zyd_write32_m(sc, ZYD_MAC_MAN_RATE, 0x150f);
1782
1783	/* disable interrupts */
1784	zyd_write32_m(sc, ZYD_CR_INTERRUPT, 0);
1785
1786	if ((error = zyd_read_pod(sc)) != 0) {
1787		device_printf(sc->sc_dev, "could not read EEPROM\n");
1788		goto fail;
1789	}
1790
1791	/* PHY init (resetting) */
1792	error = zyd_lock_phy(sc);
1793	if (error != 0)
1794		goto fail;
1795	phyp = (sc->sc_macrev == ZYD_ZD1211B) ? zyd_def_phyB : zyd_def_phy;
1796	for (; phyp->reg != 0; phyp++)
1797		zyd_write16_m(sc, phyp->reg, phyp->val);
1798	if (sc->sc_macrev == ZYD_ZD1211 && sc->sc_fix_cr157 != 0) {
1799		zyd_read16_m(sc, ZYD_EEPROM_PHY_REG, &val);
1800		zyd_write32_m(sc, ZYD_CR157, val >> 8);
1801	}
1802	error = zyd_unlock_phy(sc);
1803	if (error != 0)
1804		goto fail;
1805
1806	/* HMAC init */
1807	zyd_write32_m(sc, ZYD_MAC_ACK_EXT, 0x00000020);
1808	zyd_write32_m(sc, ZYD_CR_ADDA_MBIAS_WT, 0x30000808);
1809	zyd_write32_m(sc, ZYD_MAC_SNIFFER, 0x00000000);
1810	zyd_write32_m(sc, ZYD_MAC_RXFILTER, 0x00000000);
1811	zyd_write32_m(sc, ZYD_MAC_GHTBL, 0x00000000);
1812	zyd_write32_m(sc, ZYD_MAC_GHTBH, 0x80000000);
1813	zyd_write32_m(sc, ZYD_MAC_MISC, 0x000000a4);
1814	zyd_write32_m(sc, ZYD_CR_ADDA_PWR_DWN, 0x0000007f);
1815	zyd_write32_m(sc, ZYD_MAC_BCNCFG, 0x00f00401);
1816	zyd_write32_m(sc, ZYD_MAC_PHY_DELAY2, 0x00000000);
1817	zyd_write32_m(sc, ZYD_MAC_ACK_EXT, 0x00000080);
1818	zyd_write32_m(sc, ZYD_CR_ADDA_PWR_DWN, 0x00000000);
1819	zyd_write32_m(sc, ZYD_MAC_SIFS_ACK_TIME, 0x00000100);
1820	zyd_write32_m(sc, ZYD_CR_RX_PE_DELAY, 0x00000070);
1821	zyd_write32_m(sc, ZYD_CR_PS_CTRL, 0x10000000);
1822	zyd_write32_m(sc, ZYD_MAC_RTSCTSRATE, 0x02030203);
1823	zyd_write32_m(sc, ZYD_MAC_AFTER_PNP, 1);
1824	zyd_write32_m(sc, ZYD_MAC_BACKOFF_PROTECT, 0x00000114);
1825	zyd_write32_m(sc, ZYD_MAC_DIFS_EIFS_SIFS, 0x0a47c032);
1826	zyd_write32_m(sc, ZYD_MAC_CAM_MODE, 0x3);
1827
1828	if (sc->sc_macrev == ZYD_ZD1211) {
1829		zyd_write32_m(sc, ZYD_MAC_RETRY, 0x00000002);
1830		zyd_write32_m(sc, ZYD_MAC_RX_THRESHOLD, 0x000c0640);
1831	} else {
1832		zyd_write32_m(sc, ZYD_MACB_MAX_RETRY, 0x02020202);
1833		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL4, 0x007f003f);
1834		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL3, 0x007f003f);
1835		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL2, 0x003f001f);
1836		zyd_write32_m(sc, ZYD_MACB_TXPWR_CTL1, 0x001f000f);
1837		zyd_write32_m(sc, ZYD_MACB_AIFS_CTL1, 0x00280028);
1838		zyd_write32_m(sc, ZYD_MACB_AIFS_CTL2, 0x008C003C);
1839		zyd_write32_m(sc, ZYD_MACB_TXOP, 0x01800824);
1840		zyd_write32_m(sc, ZYD_MAC_RX_THRESHOLD, 0x000c0eff);
1841	}
1842
1843	/* init beacon interval to 100ms */
1844	if ((error = zyd_set_beacon_interval(sc, 100)) != 0)
1845		goto fail;
1846
1847	if ((error = zyd_rf_attach(sc, sc->sc_rfrev)) != 0) {
1848		device_printf(sc->sc_dev, "could not attach RF, rev 0x%x\n",
1849		    sc->sc_rfrev);
1850		goto fail;
1851	}
1852
1853	/* RF chip init */
1854	error = zyd_lock_phy(sc);
1855	if (error != 0)
1856		goto fail;
1857	error = (*rf->init)(rf);
1858	if (error != 0) {
1859		device_printf(sc->sc_dev,
1860		    "radio initialization failed, error %d\n", error);
1861		goto fail;
1862	}
1863	error = zyd_unlock_phy(sc);
1864	if (error != 0)
1865		goto fail;
1866
1867	if ((error = zyd_read_eeprom(sc)) != 0) {
1868		device_printf(sc->sc_dev, "could not read EEPROM\n");
1869		goto fail;
1870	}
1871
1872fail:	return (error);
1873}
1874
1875static int
1876zyd_read_pod(struct zyd_softc *sc)
1877{
1878	int error;
1879	uint32_t tmp;
1880
1881	zyd_read32_m(sc, ZYD_EEPROM_POD, &tmp);
1882	sc->sc_rfrev     = tmp & 0x0f;
1883	sc->sc_ledtype   = (tmp >>  4) & 0x01;
1884	sc->sc_al2230s   = (tmp >>  7) & 0x01;
1885	sc->sc_cckgain   = (tmp >>  8) & 0x01;
1886	sc->sc_fix_cr157 = (tmp >> 13) & 0x01;
1887	sc->sc_parev     = (tmp >> 16) & 0x0f;
1888	sc->sc_bandedge6 = (tmp >> 21) & 0x01;
1889	sc->sc_newphy    = (tmp >> 31) & 0x01;
1890	sc->sc_txled     = ((tmp & (1 << 24)) && (tmp & (1 << 29))) ? 0 : 1;
1891fail:
1892	return (error);
1893}
1894
1895static int
1896zyd_read_eeprom(struct zyd_softc *sc)
1897{
1898	uint16_t val;
1899	int error, i;
1900
1901	/* read Tx power calibration tables */
1902	for (i = 0; i < 7; i++) {
1903		zyd_read16_m(sc, ZYD_EEPROM_PWR_CAL + i, &val);
1904		sc->sc_pwrcal[i * 2] = val >> 8;
1905		sc->sc_pwrcal[i * 2 + 1] = val & 0xff;
1906		zyd_read16_m(sc, ZYD_EEPROM_PWR_INT + i, &val);
1907		sc->sc_pwrint[i * 2] = val >> 8;
1908		sc->sc_pwrint[i * 2 + 1] = val & 0xff;
1909		zyd_read16_m(sc, ZYD_EEPROM_36M_CAL + i, &val);
1910		sc->sc_ofdm36_cal[i * 2] = val >> 8;
1911		sc->sc_ofdm36_cal[i * 2 + 1] = val & 0xff;
1912		zyd_read16_m(sc, ZYD_EEPROM_48M_CAL + i, &val);
1913		sc->sc_ofdm48_cal[i * 2] = val >> 8;
1914		sc->sc_ofdm48_cal[i * 2 + 1] = val & 0xff;
1915		zyd_read16_m(sc, ZYD_EEPROM_54M_CAL + i, &val);
1916		sc->sc_ofdm54_cal[i * 2] = val >> 8;
1917		sc->sc_ofdm54_cal[i * 2 + 1] = val & 0xff;
1918	}
1919fail:
1920	return (error);
1921}
1922
1923static int
1924zyd_get_macaddr(struct zyd_softc *sc)
1925{
1926	struct usb_device_request req;
1927	usb_error_t error;
1928
1929	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1930	req.bRequest = ZYD_READFWDATAREQ;
1931	USETW(req.wValue, ZYD_EEPROM_MAC_ADDR_P1);
1932	USETW(req.wIndex, 0);
1933	USETW(req.wLength, IEEE80211_ADDR_LEN);
1934
1935	error = zyd_do_request(sc, &req, sc->sc_bssid);
1936	if (error != 0) {
1937		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1938		    usbd_errstr(error));
1939	}
1940
1941	return (error);
1942}
1943
1944static int
1945zyd_set_macaddr(struct zyd_softc *sc, const uint8_t *addr)
1946{
1947	int error;
1948	uint32_t tmp;
1949
1950	tmp = addr[3] << 24 | addr[2] << 16 | addr[1] << 8 | addr[0];
1951	zyd_write32_m(sc, ZYD_MAC_MACADRL, tmp);
1952	tmp = addr[5] << 8 | addr[4];
1953	zyd_write32_m(sc, ZYD_MAC_MACADRH, tmp);
1954fail:
1955	return (error);
1956}
1957
1958static int
1959zyd_set_bssid(struct zyd_softc *sc, const uint8_t *addr)
1960{
1961	int error;
1962	uint32_t tmp;
1963
1964	tmp = addr[3] << 24 | addr[2] << 16 | addr[1] << 8 | addr[0];
1965	zyd_write32_m(sc, ZYD_MAC_BSSADRL, tmp);
1966	tmp = addr[5] << 8 | addr[4];
1967	zyd_write32_m(sc, ZYD_MAC_BSSADRH, tmp);
1968fail:
1969	return (error);
1970}
1971
1972static int
1973zyd_switch_radio(struct zyd_softc *sc, int on)
1974{
1975	struct zyd_rf *rf = &sc->sc_rf;
1976	int error;
1977
1978	error = zyd_lock_phy(sc);
1979	if (error != 0)
1980		goto fail;
1981	error = (*rf->switch_radio)(rf, on);
1982	if (error != 0)
1983		goto fail;
1984	error = zyd_unlock_phy(sc);
1985fail:
1986	return (error);
1987}
1988
1989static int
1990zyd_set_led(struct zyd_softc *sc, int which, int on)
1991{
1992	int error;
1993	uint32_t tmp;
1994
1995	zyd_read32_m(sc, ZYD_MAC_TX_PE_CONTROL, &tmp);
1996	tmp &= ~which;
1997	if (on)
1998		tmp |= which;
1999	zyd_write32_m(sc, ZYD_MAC_TX_PE_CONTROL, tmp);
2000fail:
2001	return (error);
2002}
2003
2004static void
2005zyd_set_multi(struct zyd_softc *sc)
2006{
2007	int error;
2008	struct ifnet *ifp = sc->sc_ifp;
2009	struct ieee80211com *ic = ifp->if_l2com;
2010	struct ifmultiaddr *ifma;
2011	uint32_t low, high;
2012	uint8_t v;
2013
2014	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2015		return;
2016
2017	low = 0x00000000;
2018	high = 0x80000000;
2019
2020	if (ic->ic_opmode == IEEE80211_M_MONITOR ||
2021	    (ifp->if_flags & (IFF_ALLMULTI | IFF_PROMISC))) {
2022		low = 0xffffffff;
2023		high = 0xffffffff;
2024	} else {
2025		if_maddr_rlock(ifp);
2026		TAILQ_FOREACH(ifma, &ifp->if_multiaddrs, ifma_link) {
2027			if (ifma->ifma_addr->sa_family != AF_LINK)
2028				continue;
2029			v = ((uint8_t *)LLADDR((struct sockaddr_dl *)
2030			    ifma->ifma_addr))[5] >> 2;
2031			if (v < 32)
2032				low |= 1 << v;
2033			else
2034				high |= 1 << (v - 32);
2035		}
2036		if_maddr_runlock(ifp);
2037	}
2038
2039	/* reprogram multicast global hash table */
2040	zyd_write32_m(sc, ZYD_MAC_GHTBL, low);
2041	zyd_write32_m(sc, ZYD_MAC_GHTBH, high);
2042fail:
2043	if (error != 0)
2044		device_printf(sc->sc_dev,
2045		    "could not set multicast hash table\n");
2046}
2047
2048static void
2049zyd_update_mcast(struct ieee80211com *ic)
2050{
2051	struct zyd_softc *sc = ic->ic_softc;
2052
2053	if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2054		return;
2055
2056	ZYD_LOCK(sc);
2057	zyd_set_multi(sc);
2058	ZYD_UNLOCK(sc);
2059}
2060
2061static int
2062zyd_set_rxfilter(struct zyd_softc *sc)
2063{
2064	struct ifnet *ifp = sc->sc_ifp;
2065	struct ieee80211com *ic = ifp->if_l2com;
2066	uint32_t rxfilter;
2067
2068	switch (ic->ic_opmode) {
2069	case IEEE80211_M_STA:
2070		rxfilter = ZYD_FILTER_BSS;
2071		break;
2072	case IEEE80211_M_IBSS:
2073	case IEEE80211_M_HOSTAP:
2074		rxfilter = ZYD_FILTER_HOSTAP;
2075		break;
2076	case IEEE80211_M_MONITOR:
2077		rxfilter = ZYD_FILTER_MONITOR;
2078		break;
2079	default:
2080		/* should not get there */
2081		return (EINVAL);
2082	}
2083	return zyd_write32(sc, ZYD_MAC_RXFILTER, rxfilter);
2084}
2085
2086static void
2087zyd_set_chan(struct zyd_softc *sc, struct ieee80211_channel *c)
2088{
2089	int error;
2090	struct ifnet *ifp = sc->sc_ifp;
2091	struct ieee80211com *ic = ifp->if_l2com;
2092	struct zyd_rf *rf = &sc->sc_rf;
2093	uint32_t tmp;
2094	int chan;
2095
2096	chan = ieee80211_chan2ieee(ic, c);
2097	if (chan == 0 || chan == IEEE80211_CHAN_ANY) {
2098		/* XXX should NEVER happen */
2099		device_printf(sc->sc_dev,
2100		    "%s: invalid channel %x\n", __func__, chan);
2101		return;
2102	}
2103
2104	error = zyd_lock_phy(sc);
2105	if (error != 0)
2106		goto fail;
2107
2108	error = (*rf->set_channel)(rf, chan);
2109	if (error != 0)
2110		goto fail;
2111
2112	if (rf->update_pwr) {
2113		/* update Tx power */
2114		zyd_write16_m(sc, ZYD_CR31, sc->sc_pwrint[chan - 1]);
2115
2116		if (sc->sc_macrev == ZYD_ZD1211B) {
2117			zyd_write16_m(sc, ZYD_CR67,
2118			    sc->sc_ofdm36_cal[chan - 1]);
2119			zyd_write16_m(sc, ZYD_CR66,
2120			    sc->sc_ofdm48_cal[chan - 1]);
2121			zyd_write16_m(sc, ZYD_CR65,
2122			    sc->sc_ofdm54_cal[chan - 1]);
2123			zyd_write16_m(sc, ZYD_CR68, sc->sc_pwrcal[chan - 1]);
2124			zyd_write16_m(sc, ZYD_CR69, 0x28);
2125			zyd_write16_m(sc, ZYD_CR69, 0x2a);
2126		}
2127	}
2128	if (sc->sc_cckgain) {
2129		/* set CCK baseband gain from EEPROM */
2130		if (zyd_read32(sc, ZYD_EEPROM_PHY_REG, &tmp) == 0)
2131			zyd_write16_m(sc, ZYD_CR47, tmp & 0xff);
2132	}
2133	if (sc->sc_bandedge6 && rf->bandedge6 != NULL) {
2134		error = (*rf->bandedge6)(rf, c);
2135		if (error != 0)
2136			goto fail;
2137	}
2138	zyd_write32_m(sc, ZYD_CR_CONFIG_PHILIPS, 0);
2139
2140	error = zyd_unlock_phy(sc);
2141	if (error != 0)
2142		goto fail;
2143
2144	sc->sc_rxtap.wr_chan_freq = sc->sc_txtap.wt_chan_freq =
2145	    htole16(c->ic_freq);
2146	sc->sc_rxtap.wr_chan_flags = sc->sc_txtap.wt_chan_flags =
2147	    htole16(c->ic_flags);
2148fail:
2149	return;
2150}
2151
2152static int
2153zyd_set_beacon_interval(struct zyd_softc *sc, int bintval)
2154{
2155	int error;
2156	uint32_t val;
2157
2158	zyd_read32_m(sc, ZYD_CR_ATIM_WND_PERIOD, &val);
2159	sc->sc_atim_wnd = val;
2160	zyd_read32_m(sc, ZYD_CR_PRE_TBTT, &val);
2161	sc->sc_pre_tbtt = val;
2162	sc->sc_bcn_int = bintval;
2163
2164	if (sc->sc_bcn_int <= 5)
2165		sc->sc_bcn_int = 5;
2166	if (sc->sc_pre_tbtt < 4 || sc->sc_pre_tbtt >= sc->sc_bcn_int)
2167		sc->sc_pre_tbtt = sc->sc_bcn_int - 1;
2168	if (sc->sc_atim_wnd >= sc->sc_pre_tbtt)
2169		sc->sc_atim_wnd = sc->sc_pre_tbtt - 1;
2170
2171	zyd_write32_m(sc, ZYD_CR_ATIM_WND_PERIOD, sc->sc_atim_wnd);
2172	zyd_write32_m(sc, ZYD_CR_PRE_TBTT, sc->sc_pre_tbtt);
2173	zyd_write32_m(sc, ZYD_CR_BCN_INTERVAL, sc->sc_bcn_int);
2174fail:
2175	return (error);
2176}
2177
2178static void
2179zyd_rx_data(struct usb_xfer *xfer, int offset, uint16_t len)
2180{
2181	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2182	struct ifnet *ifp = sc->sc_ifp;
2183	struct ieee80211com *ic = ifp->if_l2com;
2184	struct zyd_plcphdr plcp;
2185	struct zyd_rx_stat stat;
2186	struct usb_page_cache *pc;
2187	struct mbuf *m;
2188	int rlen, rssi;
2189
2190	if (len < ZYD_MIN_FRAGSZ) {
2191		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: frame too short (length=%d)\n",
2192		    device_get_nameunit(sc->sc_dev), len);
2193		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
2194		return;
2195	}
2196	pc = usbd_xfer_get_frame(xfer, 0);
2197	usbd_copy_out(pc, offset, &plcp, sizeof(plcp));
2198	usbd_copy_out(pc, offset + len - sizeof(stat), &stat, sizeof(stat));
2199
2200	if (stat.flags & ZYD_RX_ERROR) {
2201		DPRINTF(sc, ZYD_DEBUG_RECV,
2202		    "%s: RX status indicated error (%x)\n",
2203		    device_get_nameunit(sc->sc_dev), stat.flags);
2204		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
2205		return;
2206	}
2207
2208	/* compute actual frame length */
2209	rlen = len - sizeof(struct zyd_plcphdr) -
2210	    sizeof(struct zyd_rx_stat) - IEEE80211_CRC_LEN;
2211
2212	/* allocate a mbuf to store the frame */
2213	if (rlen > (int)MCLBYTES) {
2214		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: frame too long (length=%d)\n",
2215		    device_get_nameunit(sc->sc_dev), rlen);
2216		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
2217		return;
2218	} else if (rlen > (int)MHLEN)
2219		m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
2220	else
2221		m = m_gethdr(M_NOWAIT, MT_DATA);
2222	if (m == NULL) {
2223		DPRINTF(sc, ZYD_DEBUG_RECV, "%s: could not allocate rx mbuf\n",
2224		    device_get_nameunit(sc->sc_dev));
2225		if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
2226		return;
2227	}
2228	m->m_pkthdr.rcvif = ifp;
2229	m->m_pkthdr.len = m->m_len = rlen;
2230	usbd_copy_out(pc, offset + sizeof(plcp), mtod(m, uint8_t *), rlen);
2231
2232	if (ieee80211_radiotap_active(ic)) {
2233		struct zyd_rx_radiotap_header *tap = &sc->sc_rxtap;
2234
2235		tap->wr_flags = 0;
2236		if (stat.flags & (ZYD_RX_BADCRC16 | ZYD_RX_BADCRC32))
2237			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2238		/* XXX toss, no way to express errors */
2239		if (stat.flags & ZYD_RX_DECRYPTERR)
2240			tap->wr_flags |= IEEE80211_RADIOTAP_F_BADFCS;
2241		tap->wr_rate = ieee80211_plcp2rate(plcp.signal,
2242		    (stat.flags & ZYD_RX_OFDM) ?
2243			IEEE80211_T_OFDM : IEEE80211_T_CCK);
2244		tap->wr_antsignal = stat.rssi + -95;
2245		tap->wr_antnoise = -95;	/* XXX */
2246	}
2247	rssi = (stat.rssi > 63) ? 127 : 2 * stat.rssi;
2248
2249	sc->sc_rx_data[sc->sc_rx_count].rssi = rssi;
2250	sc->sc_rx_data[sc->sc_rx_count].m = m;
2251	sc->sc_rx_count++;
2252}
2253
2254static void
2255zyd_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
2256{
2257	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2258	struct ifnet *ifp = sc->sc_ifp;
2259	struct ieee80211com *ic = ifp->if_l2com;
2260	struct ieee80211_node *ni;
2261	struct zyd_rx_desc desc;
2262	struct mbuf *m;
2263	struct usb_page_cache *pc;
2264	uint32_t offset;
2265	uint8_t rssi;
2266	int8_t nf;
2267	int i;
2268	int actlen;
2269
2270	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2271
2272	sc->sc_rx_count = 0;
2273	switch (USB_GET_STATE(xfer)) {
2274	case USB_ST_TRANSFERRED:
2275		pc = usbd_xfer_get_frame(xfer, 0);
2276		usbd_copy_out(pc, actlen - sizeof(desc), &desc, sizeof(desc));
2277
2278		offset = 0;
2279		if (UGETW(desc.tag) == ZYD_TAG_MULTIFRAME) {
2280			DPRINTF(sc, ZYD_DEBUG_RECV,
2281			    "%s: received multi-frame transfer\n", __func__);
2282
2283			for (i = 0; i < ZYD_MAX_RXFRAMECNT; i++) {
2284				uint16_t len16 = UGETW(desc.len[i]);
2285
2286				if (len16 == 0 || len16 > actlen)
2287					break;
2288
2289				zyd_rx_data(xfer, offset, len16);
2290
2291				/* next frame is aligned on a 32-bit boundary */
2292				len16 = (len16 + 3) & ~3;
2293				offset += len16;
2294				if (len16 > actlen)
2295					break;
2296				actlen -= len16;
2297			}
2298		} else {
2299			DPRINTF(sc, ZYD_DEBUG_RECV,
2300			    "%s: received single-frame transfer\n", __func__);
2301
2302			zyd_rx_data(xfer, 0, actlen);
2303		}
2304		/* FALLTHROUGH */
2305	case USB_ST_SETUP:
2306tr_setup:
2307		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
2308		usbd_transfer_submit(xfer);
2309
2310		/*
2311		 * At the end of a USB callback it is always safe to unlock
2312		 * the private mutex of a device! That is why we do the
2313		 * "ieee80211_input" here, and not some lines up!
2314		 */
2315		ZYD_UNLOCK(sc);
2316		for (i = 0; i < sc->sc_rx_count; i++) {
2317			rssi = sc->sc_rx_data[i].rssi;
2318			m = sc->sc_rx_data[i].m;
2319			sc->sc_rx_data[i].m = NULL;
2320
2321			nf = -95;	/* XXX */
2322
2323			ni = ieee80211_find_rxnode(ic,
2324			    mtod(m, struct ieee80211_frame_min *));
2325			if (ni != NULL) {
2326				(void)ieee80211_input(ni, m, rssi, nf);
2327				ieee80211_free_node(ni);
2328			} else
2329				(void)ieee80211_input_all(ic, m, rssi, nf);
2330		}
2331		if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
2332		    !IFQ_IS_EMPTY(&ifp->if_snd))
2333			zyd_start(ifp);
2334		ZYD_LOCK(sc);
2335		break;
2336
2337	default:			/* Error */
2338		DPRINTF(sc, ZYD_DEBUG_ANY, "frame error: %s\n", usbd_errstr(error));
2339
2340		if (error != USB_ERR_CANCELLED) {
2341			/* try to clear stall first */
2342			usbd_xfer_set_stall(xfer);
2343			goto tr_setup;
2344		}
2345		break;
2346	}
2347}
2348
2349static uint8_t
2350zyd_plcp_signal(struct zyd_softc *sc, int rate)
2351{
2352	switch (rate) {
2353	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
2354	case 12:
2355		return (0xb);
2356	case 18:
2357		return (0xf);
2358	case 24:
2359		return (0xa);
2360	case 36:
2361		return (0xe);
2362	case 48:
2363		return (0x9);
2364	case 72:
2365		return (0xd);
2366	case 96:
2367		return (0x8);
2368	case 108:
2369		return (0xc);
2370	/* CCK rates (NB: not IEEE std, device-specific) */
2371	case 2:
2372		return (0x0);
2373	case 4:
2374		return (0x1);
2375	case 11:
2376		return (0x2);
2377	case 22:
2378		return (0x3);
2379	}
2380
2381	device_printf(sc->sc_dev, "unsupported rate %d\n", rate);
2382	return (0x0);
2383}
2384
2385static void
2386zyd_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
2387{
2388	struct zyd_softc *sc = usbd_xfer_softc(xfer);
2389	struct ifnet *ifp = sc->sc_ifp;
2390	struct ieee80211vap *vap;
2391	struct zyd_tx_data *data;
2392	struct mbuf *m;
2393	struct usb_page_cache *pc;
2394	int actlen;
2395
2396	usbd_xfer_status(xfer, &actlen, NULL, NULL, NULL);
2397
2398	switch (USB_GET_STATE(xfer)) {
2399	case USB_ST_TRANSFERRED:
2400		DPRINTF(sc, ZYD_DEBUG_ANY, "transfer complete, %u bytes\n",
2401		    actlen);
2402
2403		/* free resources */
2404		data = usbd_xfer_get_priv(xfer);
2405		zyd_tx_free(data, 0);
2406		usbd_xfer_set_priv(xfer, NULL);
2407
2408		if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
2409		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2410
2411		/* FALLTHROUGH */
2412	case USB_ST_SETUP:
2413tr_setup:
2414		data = STAILQ_FIRST(&sc->tx_q);
2415		if (data) {
2416			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
2417			m = data->m;
2418
2419			if (m->m_pkthdr.len > (int)ZYD_MAX_TXBUFSZ) {
2420				DPRINTF(sc, ZYD_DEBUG_ANY, "data overflow, %u bytes\n",
2421				    m->m_pkthdr.len);
2422				m->m_pkthdr.len = ZYD_MAX_TXBUFSZ;
2423			}
2424			pc = usbd_xfer_get_frame(xfer, 0);
2425			usbd_copy_in(pc, 0, &data->desc, ZYD_TX_DESC_SIZE);
2426			usbd_m_copy_in(pc, ZYD_TX_DESC_SIZE, m, 0,
2427			    m->m_pkthdr.len);
2428
2429			vap = data->ni->ni_vap;
2430			if (ieee80211_radiotap_active_vap(vap)) {
2431				struct zyd_tx_radiotap_header *tap = &sc->sc_txtap;
2432
2433				tap->wt_flags = 0;
2434				tap->wt_rate = data->rate;
2435
2436				ieee80211_radiotap_tx(vap, m);
2437			}
2438
2439			usbd_xfer_set_frame_len(xfer, 0, ZYD_TX_DESC_SIZE + m->m_pkthdr.len);
2440			usbd_xfer_set_priv(xfer, data);
2441			usbd_transfer_submit(xfer);
2442		}
2443		ZYD_UNLOCK(sc);
2444		zyd_start(ifp);
2445		ZYD_LOCK(sc);
2446		break;
2447
2448	default:			/* Error */
2449		DPRINTF(sc, ZYD_DEBUG_ANY, "transfer error, %s\n",
2450		    usbd_errstr(error));
2451
2452		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
2453		data = usbd_xfer_get_priv(xfer);
2454		usbd_xfer_set_priv(xfer, NULL);
2455		if (data != NULL)
2456			zyd_tx_free(data, error);
2457
2458		if (error != USB_ERR_CANCELLED) {
2459			if (error == USB_ERR_TIMEOUT)
2460				device_printf(sc->sc_dev, "device timeout\n");
2461
2462			/*
2463			 * Try to clear stall first, also if other
2464			 * errors occur, hence clearing stall
2465			 * introduces a 50 ms delay:
2466			 */
2467			usbd_xfer_set_stall(xfer);
2468			goto tr_setup;
2469		}
2470		break;
2471	}
2472}
2473
2474static int
2475zyd_tx_start(struct zyd_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
2476{
2477	struct ieee80211vap *vap = ni->ni_vap;
2478	struct ieee80211com *ic = ni->ni_ic;
2479	struct zyd_tx_desc *desc;
2480	struct zyd_tx_data *data;
2481	struct ieee80211_frame *wh;
2482	const struct ieee80211_txparam *tp;
2483	struct ieee80211_key *k;
2484	int rate, totlen;
2485	static const uint8_t ratediv[] = ZYD_TX_RATEDIV;
2486	uint8_t phy;
2487	uint16_t pktlen;
2488	uint32_t bits;
2489
2490	wh = mtod(m0, struct ieee80211_frame *);
2491	data = STAILQ_FIRST(&sc->tx_free);
2492	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
2493	sc->tx_nfree--;
2494
2495	if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_MGT ||
2496	    (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) == IEEE80211_FC0_TYPE_CTL) {
2497		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2498		rate = tp->mgmtrate;
2499	} else {
2500		tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2501		/* for data frames */
2502		if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2503			rate = tp->mcastrate;
2504		else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2505			rate = tp->ucastrate;
2506		else {
2507			(void) ieee80211_ratectl_rate(ni, NULL, 0);
2508			rate = ni->ni_txrate;
2509		}
2510	}
2511
2512	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2513		k = ieee80211_crypto_encap(ni, m0);
2514		if (k == NULL) {
2515			m_freem(m0);
2516			return (ENOBUFS);
2517		}
2518		/* packet header may have moved, reset our local pointer */
2519		wh = mtod(m0, struct ieee80211_frame *);
2520	}
2521
2522	data->ni = ni;
2523	data->m = m0;
2524	data->rate = rate;
2525
2526	/* fill Tx descriptor */
2527	desc = &data->desc;
2528	phy = zyd_plcp_signal(sc, rate);
2529	desc->phy = phy;
2530	if (ZYD_RATE_IS_OFDM(rate)) {
2531		desc->phy |= ZYD_TX_PHY_OFDM;
2532		if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
2533			desc->phy |= ZYD_TX_PHY_5GHZ;
2534	} else if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
2535		desc->phy |= ZYD_TX_PHY_SHPREAMBLE;
2536
2537	totlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
2538	desc->len = htole16(totlen);
2539
2540	desc->flags = ZYD_TX_FLAG_BACKOFF;
2541	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2542		/* multicast frames are not sent at OFDM rates in 802.11b/g */
2543		if (totlen > vap->iv_rtsthreshold) {
2544			desc->flags |= ZYD_TX_FLAG_RTS;
2545		} else if (ZYD_RATE_IS_OFDM(rate) &&
2546		    (ic->ic_flags & IEEE80211_F_USEPROT)) {
2547			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2548				desc->flags |= ZYD_TX_FLAG_CTS_TO_SELF;
2549			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2550				desc->flags |= ZYD_TX_FLAG_RTS;
2551		}
2552	} else
2553		desc->flags |= ZYD_TX_FLAG_MULTICAST;
2554	if ((wh->i_fc[0] &
2555	    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
2556	    (IEEE80211_FC0_TYPE_CTL | IEEE80211_FC0_SUBTYPE_PS_POLL))
2557		desc->flags |= ZYD_TX_FLAG_TYPE(ZYD_TX_TYPE_PS_POLL);
2558
2559	/* actual transmit length (XXX why +10?) */
2560	pktlen = ZYD_TX_DESC_SIZE + 10;
2561	if (sc->sc_macrev == ZYD_ZD1211)
2562		pktlen += totlen;
2563	desc->pktlen = htole16(pktlen);
2564
2565	bits = (rate == 11) ? (totlen * 16) + 10 :
2566	    ((rate == 22) ? (totlen * 8) + 10 : (totlen * 8));
2567	desc->plcp_length = htole16(bits / ratediv[phy]);
2568	desc->plcp_service = 0;
2569	if (rate == 22 && (bits % 11) > 0 && (bits % 11) <= 3)
2570		desc->plcp_service |= ZYD_PLCP_LENGEXT;
2571	desc->nextlen = 0;
2572
2573	if (ieee80211_radiotap_active_vap(vap)) {
2574		struct zyd_tx_radiotap_header *tap = &sc->sc_txtap;
2575
2576		tap->wt_flags = 0;
2577		tap->wt_rate = rate;
2578
2579		ieee80211_radiotap_tx(vap, m0);
2580	}
2581
2582	DPRINTF(sc, ZYD_DEBUG_XMIT,
2583	    "%s: sending data frame len=%zu rate=%u\n",
2584	    device_get_nameunit(sc->sc_dev), (size_t)m0->m_pkthdr.len,
2585		rate);
2586
2587	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
2588	usbd_transfer_start(sc->sc_xfer[ZYD_BULK_WR]);
2589
2590	return (0);
2591}
2592
2593static void
2594zyd_start(struct ifnet *ifp)
2595{
2596	struct zyd_softc *sc = ifp->if_softc;
2597	struct ieee80211_node *ni;
2598	struct mbuf *m;
2599
2600	ZYD_LOCK(sc);
2601	for (;;) {
2602		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2603		if (m == NULL)
2604			break;
2605		if (sc->tx_nfree == 0) {
2606			IFQ_DRV_PREPEND(&ifp->if_snd, m);
2607			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2608			break;
2609		}
2610		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2611		if (zyd_tx_start(sc, m, ni) != 0) {
2612			ieee80211_free_node(ni);
2613			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
2614			break;
2615		}
2616	}
2617	ZYD_UNLOCK(sc);
2618}
2619
2620static int
2621zyd_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2622	const struct ieee80211_bpf_params *params)
2623{
2624	struct ieee80211com *ic = ni->ni_ic;
2625	struct ifnet *ifp = ic->ic_ifp;
2626	struct zyd_softc *sc = ifp->if_softc;
2627
2628	ZYD_LOCK(sc);
2629	/* prevent management frames from being sent if we're not ready */
2630	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2631		ZYD_UNLOCK(sc);
2632		m_freem(m);
2633		ieee80211_free_node(ni);
2634		return (ENETDOWN);
2635	}
2636	if (sc->tx_nfree == 0) {
2637		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2638		ZYD_UNLOCK(sc);
2639		m_freem(m);
2640		ieee80211_free_node(ni);
2641		return (ENOBUFS);		/* XXX */
2642	}
2643
2644	/*
2645	 * Legacy path; interpret frame contents to decide
2646	 * precisely how to send the frame.
2647	 * XXX raw path
2648	 */
2649	if (zyd_tx_start(sc, m, ni) != 0) {
2650		ZYD_UNLOCK(sc);
2651		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
2652		ieee80211_free_node(ni);
2653		return (EIO);
2654	}
2655	ZYD_UNLOCK(sc);
2656	return (0);
2657}
2658
2659static int
2660zyd_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2661{
2662	struct zyd_softc *sc = ifp->if_softc;
2663	struct ieee80211com *ic = ifp->if_l2com;
2664	struct ifreq *ifr = (struct ifreq *) data;
2665	int error;
2666	int startall = 0;
2667
2668	ZYD_LOCK(sc);
2669	error = (sc->sc_flags & ZYD_FLAG_DETACHED) ? ENXIO : 0;
2670	ZYD_UNLOCK(sc);
2671	if (error)
2672		return (error);
2673
2674	switch (cmd) {
2675	case SIOCSIFFLAGS:
2676		ZYD_LOCK(sc);
2677		if (ifp->if_flags & IFF_UP) {
2678			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
2679				zyd_init_locked(sc);
2680				startall = 1;
2681			} else
2682				zyd_set_multi(sc);
2683		} else {
2684			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2685				zyd_stop(sc);
2686		}
2687		ZYD_UNLOCK(sc);
2688		if (startall)
2689			ieee80211_start_all(ic);
2690		break;
2691	case SIOCGIFMEDIA:
2692		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2693		break;
2694	case SIOCGIFADDR:
2695		error = ether_ioctl(ifp, cmd, data);
2696		break;
2697	default:
2698		error = EINVAL;
2699		break;
2700	}
2701	return (error);
2702}
2703
2704static void
2705zyd_init_locked(struct zyd_softc *sc)
2706{
2707	struct ifnet *ifp = sc->sc_ifp;
2708	struct ieee80211com *ic = ifp->if_l2com;
2709	struct usb_config_descriptor *cd;
2710	int error;
2711	uint32_t val;
2712
2713	ZYD_LOCK_ASSERT(sc, MA_OWNED);
2714
2715	if (!(sc->sc_flags & ZYD_FLAG_INITONCE)) {
2716		error = zyd_loadfirmware(sc);
2717		if (error != 0) {
2718			device_printf(sc->sc_dev,
2719			    "could not load firmware (error=%d)\n", error);
2720			goto fail;
2721		}
2722
2723		/* reset device */
2724		cd = usbd_get_config_descriptor(sc->sc_udev);
2725		error = usbd_req_set_config(sc->sc_udev, &sc->sc_mtx,
2726		    cd->bConfigurationValue);
2727		if (error)
2728			device_printf(sc->sc_dev, "reset failed, continuing\n");
2729
2730		error = zyd_hw_init(sc);
2731		if (error) {
2732			device_printf(sc->sc_dev,
2733			    "hardware initialization failed\n");
2734			goto fail;
2735		}
2736
2737		device_printf(sc->sc_dev,
2738		    "HMAC ZD1211%s, FW %02x.%02x, RF %s S%x, PA%x LED %x "
2739		    "BE%x NP%x Gain%x F%x\n",
2740		    (sc->sc_macrev == ZYD_ZD1211) ? "": "B",
2741		    sc->sc_fwrev >> 8, sc->sc_fwrev & 0xff,
2742		    zyd_rf_name(sc->sc_rfrev), sc->sc_al2230s, sc->sc_parev,
2743		    sc->sc_ledtype, sc->sc_bandedge6, sc->sc_newphy,
2744		    sc->sc_cckgain, sc->sc_fix_cr157);
2745
2746		/* read regulatory domain (currently unused) */
2747		zyd_read32_m(sc, ZYD_EEPROM_SUBID, &val);
2748		sc->sc_regdomain = val >> 16;
2749		DPRINTF(sc, ZYD_DEBUG_INIT, "regulatory domain %x\n",
2750		    sc->sc_regdomain);
2751
2752		/* we'll do software WEP decryption for now */
2753		DPRINTF(sc, ZYD_DEBUG_INIT, "%s: setting encryption type\n",
2754		    __func__);
2755		zyd_write32_m(sc, ZYD_MAC_ENCRYPTION_TYPE, ZYD_ENC_SNIFFER);
2756
2757		sc->sc_flags |= ZYD_FLAG_INITONCE;
2758	}
2759
2760	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2761		zyd_stop(sc);
2762
2763	DPRINTF(sc, ZYD_DEBUG_INIT, "setting MAC address to %6D\n",
2764	    IF_LLADDR(ifp), ":");
2765	error = zyd_set_macaddr(sc, IF_LLADDR(ifp));
2766	if (error != 0)
2767		return;
2768
2769	/* set basic rates */
2770	if (ic->ic_curmode == IEEE80211_MODE_11B)
2771		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0x0003);
2772	else if (ic->ic_curmode == IEEE80211_MODE_11A)
2773		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0x1500);
2774	else	/* assumes 802.11b/g */
2775		zyd_write32_m(sc, ZYD_MAC_BAS_RATE, 0xff0f);
2776
2777	/* promiscuous mode */
2778	zyd_write32_m(sc, ZYD_MAC_SNIFFER, 0);
2779	/* multicast setup */
2780	zyd_set_multi(sc);
2781	/* set RX filter  */
2782	error = zyd_set_rxfilter(sc);
2783	if (error != 0)
2784		goto fail;
2785
2786	/* switch radio transmitter ON */
2787	error = zyd_switch_radio(sc, 1);
2788	if (error != 0)
2789		goto fail;
2790	/* set default BSS channel */
2791	zyd_set_chan(sc, ic->ic_curchan);
2792
2793	/*
2794	 * Allocate Tx and Rx xfer queues.
2795	 */
2796	zyd_setup_tx_list(sc);
2797
2798	/* enable interrupts */
2799	zyd_write32_m(sc, ZYD_CR_INTERRUPT, ZYD_HWINT_MASK);
2800
2801	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2802	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2803	usbd_xfer_set_stall(sc->sc_xfer[ZYD_BULK_WR]);
2804	usbd_transfer_start(sc->sc_xfer[ZYD_BULK_RD]);
2805	usbd_transfer_start(sc->sc_xfer[ZYD_INTR_RD]);
2806
2807	return;
2808
2809fail:	zyd_stop(sc);
2810	return;
2811}
2812
2813static void
2814zyd_init(void *priv)
2815{
2816	struct zyd_softc *sc = priv;
2817	struct ifnet *ifp = sc->sc_ifp;
2818	struct ieee80211com *ic = ifp->if_l2com;
2819
2820	ZYD_LOCK(sc);
2821	zyd_init_locked(sc);
2822	ZYD_UNLOCK(sc);
2823
2824	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2825		ieee80211_start_all(ic);		/* start all vap's */
2826}
2827
2828static void
2829zyd_stop(struct zyd_softc *sc)
2830{
2831	struct ifnet *ifp = sc->sc_ifp;
2832	int error;
2833
2834	ZYD_LOCK_ASSERT(sc, MA_OWNED);
2835
2836	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2837
2838	/*
2839	 * Drain all the transfers, if not already drained:
2840	 */
2841	ZYD_UNLOCK(sc);
2842	usbd_transfer_drain(sc->sc_xfer[ZYD_BULK_WR]);
2843	usbd_transfer_drain(sc->sc_xfer[ZYD_BULK_RD]);
2844	ZYD_LOCK(sc);
2845
2846	zyd_unsetup_tx_list(sc);
2847
2848	/* Stop now if the device was never set up */
2849	if (!(sc->sc_flags & ZYD_FLAG_INITONCE))
2850		return;
2851
2852	/* switch radio transmitter OFF */
2853	error = zyd_switch_radio(sc, 0);
2854	if (error != 0)
2855		goto fail;
2856	/* disable Rx */
2857	zyd_write32_m(sc, ZYD_MAC_RXFILTER, 0);
2858	/* disable interrupts */
2859	zyd_write32_m(sc, ZYD_CR_INTERRUPT, 0);
2860
2861fail:
2862	return;
2863}
2864
2865static int
2866zyd_loadfirmware(struct zyd_softc *sc)
2867{
2868	struct usb_device_request req;
2869	size_t size;
2870	u_char *fw;
2871	uint8_t stat;
2872	uint16_t addr;
2873
2874	if (sc->sc_flags & ZYD_FLAG_FWLOADED)
2875		return (0);
2876
2877	if (sc->sc_macrev == ZYD_ZD1211) {
2878		fw = (u_char *)zd1211_firmware;
2879		size = sizeof(zd1211_firmware);
2880	} else {
2881		fw = (u_char *)zd1211b_firmware;
2882		size = sizeof(zd1211b_firmware);
2883	}
2884
2885	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2886	req.bRequest = ZYD_DOWNLOADREQ;
2887	USETW(req.wIndex, 0);
2888
2889	addr = ZYD_FIRMWARE_START_ADDR;
2890	while (size > 0) {
2891		/*
2892		 * When the transfer size is 4096 bytes, it is not
2893		 * likely to be able to transfer it.
2894		 * The cause is port or machine or chip?
2895		 */
2896		const int mlen = min(size, 64);
2897
2898		DPRINTF(sc, ZYD_DEBUG_FW,
2899		    "loading firmware block: len=%d, addr=0x%x\n", mlen, addr);
2900
2901		USETW(req.wValue, addr);
2902		USETW(req.wLength, mlen);
2903		if (zyd_do_request(sc, &req, fw) != 0)
2904			return (EIO);
2905
2906		addr += mlen / 2;
2907		fw   += mlen;
2908		size -= mlen;
2909	}
2910
2911	/* check whether the upload succeeded */
2912	req.bmRequestType = UT_READ_VENDOR_DEVICE;
2913	req.bRequest = ZYD_DOWNLOADSTS;
2914	USETW(req.wValue, 0);
2915	USETW(req.wIndex, 0);
2916	USETW(req.wLength, sizeof(stat));
2917	if (zyd_do_request(sc, &req, &stat) != 0)
2918		return (EIO);
2919
2920	sc->sc_flags |= ZYD_FLAG_FWLOADED;
2921
2922	return (stat & 0x80) ? (EIO) : (0);
2923}
2924
2925static void
2926zyd_scan_start(struct ieee80211com *ic)
2927{
2928	struct ifnet *ifp = ic->ic_ifp;
2929	struct zyd_softc *sc = ifp->if_softc;
2930
2931	ZYD_LOCK(sc);
2932	/* want broadcast address while scanning */
2933	zyd_set_bssid(sc, ifp->if_broadcastaddr);
2934	ZYD_UNLOCK(sc);
2935}
2936
2937static void
2938zyd_scan_end(struct ieee80211com *ic)
2939{
2940	struct zyd_softc *sc = ic->ic_ifp->if_softc;
2941
2942	ZYD_LOCK(sc);
2943	/* restore previous bssid */
2944	zyd_set_bssid(sc, sc->sc_bssid);
2945	ZYD_UNLOCK(sc);
2946}
2947
2948static void
2949zyd_set_channel(struct ieee80211com *ic)
2950{
2951	struct zyd_softc *sc = ic->ic_ifp->if_softc;
2952
2953	ZYD_LOCK(sc);
2954	zyd_set_chan(sc, ic->ic_curchan);
2955	ZYD_UNLOCK(sc);
2956}
2957
2958static device_method_t zyd_methods[] = {
2959        /* Device interface */
2960        DEVMETHOD(device_probe, zyd_match),
2961        DEVMETHOD(device_attach, zyd_attach),
2962        DEVMETHOD(device_detach, zyd_detach),
2963	DEVMETHOD_END
2964};
2965
2966static driver_t zyd_driver = {
2967	.name = "zyd",
2968	.methods = zyd_methods,
2969	.size = sizeof(struct zyd_softc)
2970};
2971
2972static devclass_t zyd_devclass;
2973
2974DRIVER_MODULE(zyd, uhub, zyd_driver, zyd_devclass, NULL, 0);
2975MODULE_DEPEND(zyd, usb, 1, 1, 1);
2976MODULE_DEPEND(zyd, wlan, 1, 1, 1);
2977MODULE_VERSION(zyd, 1);
2978