/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright 2019 Joyent, Inc.
 */

/*
 * Copyright (c) 2006 Sam Leffler, Errno Consulting
 * Copyright (c) 2008-2009 Weongyo Jeong <weongyo@freebsd.org>
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer,
 *    without modification.
 * 2. Redistributions in binary form must reproduce at minimum a disclaimer
 *    similar to the "NO WARRANTY" disclaimer below ("Disclaimer") and any
 *    redistribution must be conditioned upon including a substantially
 *    similar Disclaimer requirement for further binary redistribution.
 *
 * NO WARRANTY
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF NONINFRINGEMENT, MERCHANTIBILITY
 * AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL
 * THE COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR SPECIAL, EXEMPLARY,
 * OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER
 * IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGES.
 */

/*
 * This driver is distantly derived from a driver of the same name
 * by Damien Bergamini.  The original copyright is included below:
 *
 * Copyright (c) 2006
 *      Damien Bergamini <damien.bergamini@free.fr>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */


#include <sys/types.h>
#include <sys/cmn_err.h>
#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/modctl.h>
#include <sys/devops.h>
#include <sys/byteorder.h>
#include <sys/mac_provider.h>
#include <sys/mac_wifi.h>
#include <sys/net80211.h>

#define USBDRV_MAJOR_VER        2
#define USBDRV_MINOR_VER        0
#include <sys/usb/usba.h>
#include <sys/usb/usba/usba_types.h>

#include "uath_reg.h"
#include "uath_var.h"

static void *uath_soft_state_p = NULL;

/*
 * Bit flags in the ral_dbg_flags
 */
#define UATH_DBG_MSG            0x000001
#define UATH_DBG_ERR            0x000002
#define UATH_DBG_USB            0x000004
#define UATH_DBG_TX             0x000008
#define UATH_DBG_RX             0x000010
#define UATH_DBG_FW             0x000020
#define UATH_DBG_TX_CMD         0x000040
#define UATH_DBG_RX_CMD         0x000080
#define UATH_DBG_ALL            0x000fff

uint32_t uath_dbg_flags = 0;

#ifdef DEBUG
#define UATH_DEBUG \
        uath_debug
#else
#define UATH_DEBUG(...) (void)(0)
#endif

/*
 * Various supported device vendors/products.
 * UB51: AR5005UG 802.11b/g, UB52: AR5005UX 802.11b/g
 */
#define UATH_FLAG_PRE_FIRMWARE  (1 << 0)
#define UATH_FLAG_ABG           (1 << 1)
#define UATH_FLAG_ERR           (1 << 2)
#define UATH_DEV(v, p, f)                                               \
        { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p }, (f) },             \
        { { USB_VENDOR_##v, USB_PRODUCT_##v##_##p##_NF },               \
            (f) | UATH_FLAG_PRE_FIRMWARE }
#define UATH_DEV_UG(v, p)       UATH_DEV(v, p, 0)
#define UATH_DEV_UX(v, p)       UATH_DEV(v, p, UATH_FLAG_ABG)

struct uath_devno {
        uint16_t vendor_id;
        uint16_t product_id;
};

static const struct uath_type {
        struct uath_devno       dev;
        uint8_t                 flags;
} uath_devs[] = {
        UATH_DEV_UG(ACCTON,             SMCWUSBTG2),
        UATH_DEV_UG(ATHEROS,            AR5523),
        UATH_DEV_UG(ATHEROS2,           AR5523_1),
        UATH_DEV_UG(ATHEROS2,           AR5523_2),
        UATH_DEV_UX(ATHEROS2,           AR5523_3),
        UATH_DEV_UG(CONCEPTRONIC,       AR5523_1),
        UATH_DEV_UX(CONCEPTRONIC,       AR5523_2),
        UATH_DEV_UX(DLINK,              DWLAG122),
        UATH_DEV_UX(DLINK,              DWLAG132),
        UATH_DEV_UG(DLINK,              DWLG132),
        UATH_DEV_UG(GIGASET,            AR5523),
        UATH_DEV_UG(GIGASET,            SMCWUSBTG),
        UATH_DEV_UG(GLOBALSUN,          AR5523_1),
        UATH_DEV_UX(GLOBALSUN,          AR5523_2),
        UATH_DEV_UG(IODATA,             USBWNG54US),
        UATH_DEV_UG(MELCO,              WLIU2KAMG54),
        UATH_DEV_UX(NETGEAR,            WG111U),
        UATH_DEV_UG(NETGEAR3,           WG111T),
        UATH_DEV_UG(NETGEAR3,           WPN111),
        UATH_DEV_UG(PHILIPS,            SNU6500),
        UATH_DEV_UX(UMEDIA,             AR5523_2),
        UATH_DEV_UG(UMEDIA,             TEW444UBEU),
        UATH_DEV_UG(WISTRONNEWEB,       AR5523_1),
        UATH_DEV_UX(WISTRONNEWEB,       AR5523_2),
        UATH_DEV_UG(ZCOM,               AR5523)
};

static char uath_fwmod[] = "uathfw";
static char uath_binmod[] = "uathbin";

/*
 * Supported rates for 802.11b/g modes (in 500Kbps unit).
 */
static const struct ieee80211_rateset uath_rateset_11b =
        { 4, { 2, 4, 11, 22 } };

static const struct ieee80211_rateset uath_rateset_11g =
        { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };

/*
 * device operations
 */
static int uath_attach(dev_info_t *, ddi_attach_cmd_t);
static int uath_detach(dev_info_t *, ddi_detach_cmd_t);

/*
 * Module Loading Data & Entry Points
 */
DDI_DEFINE_STREAM_OPS(uath_dev_ops, nulldev, nulldev, uath_attach,
    uath_detach, nodev, NULL, D_MP, NULL, ddi_quiesce_not_needed);

static struct modldrv uath_modldrv = {
        &mod_driverops,         /* Type of module.  This one is a driver */
        "Atheros AR5523 USB Driver v1.1",       /* short description */
        &uath_dev_ops           /* driver specific ops */
};

static struct modlinkage modlinkage = {
        MODREV_1,
        (void *)&uath_modldrv,
        NULL
};

static int      uath_m_stat(void *,  uint_t, uint64_t *);
static int      uath_m_start(void *);
static void     uath_m_stop(void *);
static int      uath_m_promisc(void *, boolean_t);
static int      uath_m_multicst(void *, boolean_t, const uint8_t *);
static int      uath_m_unicst(void *, const uint8_t *);
static mblk_t   *uath_m_tx(void *, mblk_t *);
static void     uath_m_ioctl(void *, queue_t *, mblk_t *);
static int      uath_m_setprop(void *, const char *, mac_prop_id_t,
                    uint_t, const void *);
static int      uath_m_getprop(void *, const char *, mac_prop_id_t,
                    uint_t, void *);
static void     uath_m_propinfo(void *, const char *, mac_prop_id_t,
                    mac_prop_info_handle_t);

static mac_callbacks_t uath_m_callbacks = {
        MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
        uath_m_stat,
        uath_m_start,
        uath_m_stop,
        uath_m_promisc,
        uath_m_multicst,
        uath_m_unicst,
        uath_m_tx,
        NULL,
        uath_m_ioctl,
        NULL,
        NULL,
        NULL,
        uath_m_setprop,
        uath_m_getprop,
        uath_m_propinfo
};

static usb_alt_if_data_t *
                uath_lookup_alt_if(usb_client_dev_data_t *,
                    uint_t, uint_t, uint_t);
static usb_ep_data_t *
                uath_lookup_ep_data(dev_info_t *,
                    usb_client_dev_data_t *, uint_t, uint_t, uint8_t, uint8_t);
static const char *
                uath_codename(int code);

static uint_t   uath_lookup(uint16_t, uint16_t);
static void     uath_list_all_eps(usb_alt_if_data_t *);
static int      uath_open_pipes(struct uath_softc *);
static void     uath_close_pipes(struct uath_softc *);
static int      uath_fw_send(struct uath_softc *,
                    usb_pipe_handle_t, const void *, size_t);
static int      uath_fw_ack(struct uath_softc *, int);
static int      uath_loadsym(ddi_modhandle_t, char *, char **, size_t *);
static int      uath_loadfirmware(struct uath_softc *);
static int      uath_alloc_cmd_list(struct uath_softc *,
                    struct uath_cmd *, int, int);
static int      uath_init_cmd_list(struct uath_softc *);
static void     uath_free_cmd_list(struct uath_cmd *, int);
static int      uath_host_available(struct uath_softc *);
static void     uath_get_capability(struct uath_softc *, uint32_t, uint32_t *);
static int      uath_get_devcap(struct uath_softc *);
static int      uath_get_devstatus(struct uath_softc *,
                    uint8_t [IEEE80211_ADDR_LEN]);
static int      uath_get_status(struct uath_softc *, uint32_t, void *, int);

static void     uath_cmd_lock_init(struct uath_cmd_lock *);
static void     uath_cmd_lock_destroy(struct uath_cmd_lock *);
static int      uath_cmd_lock_wait(struct uath_cmd_lock *, clock_t);
static void     uath_cmd_lock_signal(struct uath_cmd_lock *);

static int      uath_cmd_read(struct uath_softc *, uint32_t, const void *,
                    int, void *, int, int);
static int      uath_cmd_write(struct uath_softc *, uint32_t, const void *,
                    int, int);
static int      uath_cmdsend(struct uath_softc *, uint32_t,
                    const void *, int, void *, int, int);
static int      uath_rx_cmd_xfer(struct uath_softc *);
static int      uath_tx_cmd_xfer(struct uath_softc *,
                    usb_pipe_handle_t, const void *, uint_t);
static void     uath_cmd_txeof(usb_pipe_handle_t, struct usb_bulk_req *);
static void     uath_cmd_rxeof(usb_pipe_handle_t, usb_bulk_req_t *);
static void     uath_cmdeof(struct uath_softc *, struct uath_cmd *);

static void     uath_init_data_queue(struct uath_softc *);
static int      uath_rx_data_xfer(struct uath_softc *sc);
static int      uath_tx_data_xfer(struct uath_softc *, mblk_t *);
static void     uath_data_txeof(usb_pipe_handle_t, usb_bulk_req_t *);
static void     uath_data_rxeof(usb_pipe_handle_t, usb_bulk_req_t *);

static int      uath_create_connection(struct uath_softc *, uint32_t);
static int      uath_set_rates(struct uath_softc *,
                    const struct ieee80211_rateset *);
static int      uath_write_associd(struct uath_softc *);
static int      uath_set_ledsteady(struct uath_softc *, int, int);
static int      uath_set_ledblink(struct uath_softc *, int, int, int, int);
static void     uath_update_rxstat(struct uath_softc *, uint32_t);
static int      uath_send(ieee80211com_t *, mblk_t *, uint8_t);
static int      uath_reconnect(dev_info_t *);
static int      uath_disconnect(dev_info_t *);
static int      uath_newstate(struct ieee80211com *, enum ieee80211_state, int);

static int      uath_dataflush(struct uath_softc *);
static int      uath_cmdflush(struct uath_softc *);
static int      uath_flush(struct uath_softc *);
static int      uath_set_ledstate(struct uath_softc *, int);
static int      uath_set_chan(struct uath_softc *, struct ieee80211_channel *);
static int      uath_reset_tx_queues(struct uath_softc *);
static int      uath_wme_init(struct uath_softc *);
static int      uath_config_multi(struct uath_softc *,
                    uint32_t, const void *, int);
static void     uath_config(struct uath_softc *, uint32_t, uint32_t);
static int      uath_switch_channel(struct uath_softc *,
                    struct ieee80211_channel *);
static int      uath_set_rxfilter(struct uath_softc *, uint32_t, uint32_t);
static int      uath_init_locked(void *);
static void     uath_stop_locked(void *);
static int      uath_init(struct uath_softc *);
static void     uath_stop(struct uath_softc *);
static void     uath_resume(struct uath_softc *);

static void
uath_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
{
        va_list args;

        if (dbg_flags & uath_dbg_flags) {
                va_start(args, fmt);
                vcmn_err(CE_CONT, fmt, args);
                va_end(args);
        }
}

static uint_t
uath_lookup(uint16_t vendor_id, uint16_t product_id)
{
        int i, size;

        size = sizeof (uath_devs) / sizeof (struct uath_type);

        for (i = 0; i < size; i++) {
                if ((vendor_id == uath_devs[i].dev.vendor_id) &&
                    (product_id == uath_devs[i].dev.product_id))
                        return (uath_devs[i].flags);
        }
        return (UATH_FLAG_ERR);
}

/*
 * Return a specific alt_if from the device descriptor tree.
 */
static usb_alt_if_data_t *
uath_lookup_alt_if(usb_client_dev_data_t *dev_data, uint_t config,
    uint_t interface, uint_t alt)
{
        usb_cfg_data_t *cfg_data;
        usb_if_data_t *if_data;
        usb_alt_if_data_t *if_alt_data;

        /*
         * Assume everything is in the tree for now,
         * (USB_PARSE_LVL_ALL)
         * so we can directly index the array.
         */

        /* Descend to configuration, configs are 1-based */
        if (config < 1 || config > dev_data->dev_n_cfg)
                return (NULL);
        cfg_data = &dev_data->dev_cfg[config - 1];

        /* Descend to interface */
        if (interface > cfg_data->cfg_n_if - 1)
                return (NULL);
        if_data = &cfg_data->cfg_if[interface];

        /* Descend to alt */
        if (alt > if_data->if_n_alt - 1)
                return (NULL);
        if_alt_data = &if_data->if_alt[alt];

        return (if_alt_data);
}

/*
 * Print all endpoints of an alt_if.
 */
static void
uath_list_all_eps(usb_alt_if_data_t *ifalt)
{
        usb_ep_data_t *ep_data;
        usb_ep_descr_t *ep_descr;
        int i;

        for (i = 0; i < ifalt->altif_n_ep; i++) {
                ep_data = &ifalt->altif_ep[i];
                ep_descr = &ep_data->ep_descr;
                UATH_DEBUG(UATH_DBG_USB,
                    "uath: uath_list_all_endpoint: "
                    "ep addresa[%x] is %x",
                    i, ep_descr->bEndpointAddress);
        }
}

static usb_ep_data_t *
uath_lookup_ep_data(dev_info_t *dip,
    usb_client_dev_data_t *dev_datap,
    uint_t interface,
    uint_t alternate,
    uint8_t address,
    uint8_t type)
{
        usb_alt_if_data_t *altif_data;
        int i;

        if ((dip == NULL) || (dev_datap == NULL))
                return (NULL);

        altif_data = &dev_datap->dev_curr_cfg->
            cfg_if[interface].if_alt[alternate];

        for (i = 0; i < altif_data->altif_n_ep; i++) {
                usb_ep_descr_t *ept = &altif_data->altif_ep[i].ep_descr;
                uint8_t ept_type = ept->bmAttributes & USB_EP_ATTR_MASK;
                uint8_t ept_address = ept->bEndpointAddress;

                if (ept->bLength == 0)
                        continue;
                if ((ept_type == type) &&
                    ((type == USB_EP_ATTR_CONTROL) || (address == ept_address)))
                        return (&altif_data->altif_ep[i]);
        }
        return (NULL);
}

/*
 * Open communication pipes.
 * The following pipes are used by the AR5523:
 * ep0: 0x81 IN  Rx cmd
 * ep1: 0x01 OUT Tx cmd
 * ep2: 0x82 IN  Rx data
 * ep3: 0x02 OUT Tx data
 */
static int
uath_open_pipes(struct uath_softc *sc)
{
        usb_ep_data_t *ep_node;
        usb_ep_descr_t *ep_descr;
        usb_pipe_policy_t policy;
        int err;

#ifdef DEBUG
        usb_alt_if_data_t *altif_data;

        altif_data = uath_lookup_alt_if(sc->sc_udev, UATH_CONFIG_NO,
            UATH_IFACE_INDEX, UATH_ALT_IF_INDEX);
        if (altif_data == NULL) {
                UATH_DEBUG(UATH_DBG_ERR, "alt_if not found");
                return (USB_FAILURE);
        }

        uath_list_all_eps(altif_data);
#endif

        /*
         * XXX pipes numbers are hardcoded because we don't have any way
         * to distinguish the data pipes from the firmware command pipes
         * (both are bulk pipes) using the endpoints descriptors.
         */
        ep_node = uath_lookup_ep_data(sc->sc_dev, sc->sc_udev,
            0, 0, 0x81, USB_EP_ATTR_BULK);
        ep_descr = &ep_node->ep_descr;
        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_open_pipes(): "
            "find pipe %x\n", ep_descr->bEndpointAddress);

        bzero(&policy, sizeof (usb_pipe_policy_t));
        policy.pp_max_async_reqs = UATH_CMD_LIST_COUNT;

        err = usb_pipe_open(sc->sc_dev, &ep_node->ep_descr,
            &policy, USB_FLAGS_SLEEP, &sc->rx_cmd_pipe);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
                    "failed to open rx data pipe, err = %x\n",
                    err);
                goto fail;
        }


        ep_node = uath_lookup_ep_data(sc->sc_dev, sc->sc_udev,
            0, 0, 0x01, USB_EP_ATTR_BULK);
        ep_descr = &ep_node->ep_descr;
        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
            "find pipe %x\n",
            ep_descr->bEndpointAddress);

        bzero(&policy, sizeof (usb_pipe_policy_t));
        policy.pp_max_async_reqs = UATH_CMD_LIST_COUNT;

        err = usb_pipe_open(sc->sc_dev, &ep_node->ep_descr,
            &policy, USB_FLAGS_SLEEP, &sc->tx_cmd_pipe);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
                    "failed to open tx command pipe, err = %x\n",
                    err);
                goto fail;
        }

        ep_node = uath_lookup_ep_data(sc->sc_dev, sc->sc_udev,
            0, 0, 0x82, USB_EP_ATTR_BULK);
        ep_descr = &ep_node->ep_descr;
        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
            "find pipe %x\n",
            ep_descr->bEndpointAddress);

        bzero(&policy, sizeof (usb_pipe_policy_t));
        policy.pp_max_async_reqs = UATH_RX_DATA_LIST_COUNT;

        err = usb_pipe_open(sc->sc_dev, &ep_node->ep_descr,
            &policy, USB_FLAGS_SLEEP, &sc->rx_data_pipe);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
                    "failed to open tx pipe, err = %x\n",
                    err);
                goto fail;
        }

        ep_node = uath_lookup_ep_data(sc->sc_dev, sc->sc_udev,
            0, 0, 0x02, USB_EP_ATTR_BULK);
        ep_descr = &ep_node->ep_descr;
        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
            "find pipe %x\n",
            ep_descr->bEndpointAddress);

        bzero(&policy, sizeof (usb_pipe_policy_t));
        policy.pp_max_async_reqs = UATH_TX_DATA_LIST_COUNT;

        err = usb_pipe_open(sc->sc_dev, &ep_node->ep_descr,
            &policy, USB_FLAGS_SLEEP, &sc->tx_data_pipe);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_open_pipes(): "
                    "failed to open rx command pipe, err = %x\n",
                    err);
                goto fail;
        }

        return (UATH_SUCCESS);
fail:
        uath_close_pipes(sc);
        return (err);
}

static void
uath_close_pipes(struct uath_softc *sc)
{
        usb_flags_t flags = USB_FLAGS_SLEEP;

        if (sc->rx_cmd_pipe != NULL) {
                usb_pipe_reset(sc->sc_dev, sc->rx_cmd_pipe, flags, NULL, 0);
                usb_pipe_close(sc->sc_dev, sc->rx_cmd_pipe, flags, NULL, 0);
                sc->rx_cmd_pipe = NULL;
        }

        if (sc->tx_cmd_pipe != NULL) {
                usb_pipe_reset(sc->sc_dev, sc->tx_cmd_pipe, flags, NULL, 0);
                usb_pipe_close(sc->sc_dev, sc->tx_cmd_pipe, flags, NULL, 0);
                sc->tx_cmd_pipe = NULL;
        }

        if (sc->rx_data_pipe != NULL) {
                usb_pipe_reset(sc->sc_dev, sc->rx_data_pipe, flags, NULL, 0);
                usb_pipe_close(sc->sc_dev, sc->rx_data_pipe, flags, NULL, 0);
                sc->rx_data_pipe = NULL;
        }

        if (sc->tx_data_pipe != NULL) {
                usb_pipe_reset(sc->sc_dev, sc->tx_data_pipe, flags, NULL, 0);
                usb_pipe_close(sc->sc_dev, sc->tx_data_pipe, flags, NULL, 0);
                sc->tx_data_pipe = NULL;
        }

}

static const char *
uath_codename(int code)
{
#define N(a)    (sizeof (a)/sizeof (a[0]))
        static const char *names[] = {
            "0x00",
            "HOST_AVAILABLE",
            "BIND",
            "TARGET_RESET",
            "TARGET_GET_CAPABILITY",
            "TARGET_SET_CONFIG",
            "TARGET_GET_STATUS",
            "TARGET_GET_STATS",
            "TARGET_START",
            "TARGET_STOP",
            "TARGET_ENABLE",
            "TARGET_DISABLE",
            "CREATE_CONNECTION",
            "UPDATE_CONNECT_ATTR",
            "DELETE_CONNECT",
            "SEND",
            "FLUSH",
            "STATS_UPDATE",
            "BMISS",
            "DEVICE_AVAIL",
            "SEND_COMPLETE",
            "DATA_AVAIL",
            "SET_PWR_MODE",
            "BMISS_ACK",
            "SET_LED_STEADY",
            "SET_LED_BLINK",
            "SETUP_BEACON_DESC",
            "BEACON_INIT",
            "RESET_KEY_CACHE",
            "RESET_KEY_CACHE_ENTRY",
            "SET_KEY_CACHE_ENTRY",
            "SET_DECOMP_MASK",
            "SET_REGULATORY_DOMAIN",
            "SET_LED_STATE",
            "WRITE_ASSOCID",
            "SET_STA_BEACON_TIMERS",
            "GET_TSF",
            "RESET_TSF",
            "SET_ADHOC_MODE",
            "SET_BASIC_RATE",
            "MIB_CONTROL",
            "GET_CHANNEL_DATA",
            "GET_CUR_RSSI",
            "SET_ANTENNA_SWITCH",
            "0x2c", "0x2d", "0x2e",
            "USE_SHORT_SLOT_TIME",
            "SET_POWER_MODE",
            "SETUP_PSPOLL_DESC",
            "SET_RX_MULTICAST_FILTER",
            "RX_FILTER",
            "PER_CALIBRATION",
            "RESET",
            "DISABLE",
            "PHY_DISABLE",
            "SET_TX_POWER_LIMIT",
            "SET_TX_QUEUE_PARAMS",
            "SETUP_TX_QUEUE",
            "RELEASE_TX_QUEUE",
        };
        static char buf[8];

        if (code < N(names))
                return (names[code]);
        if (code == WDCMSG_SET_DEFAULT_KEY)
                return ("SET_DEFAULT_KEY");

        (void) snprintf(buf, sizeof (buf), "0x%02x", code);
        return (buf);
#undef N
}

static int
uath_fw_send(struct uath_softc *sc, usb_pipe_handle_t pipe,
    const void *data, size_t len)
{
        usb_bulk_req_t *send_req;
        mblk_t *mblk;
        int res;

        send_req = usb_alloc_bulk_req(sc->sc_dev, len, USB_FLAGS_SLEEP);

        send_req->bulk_len = (int)len;
        send_req->bulk_attributes = USB_ATTRS_AUTOCLEARING;
        send_req->bulk_timeout = UATH_CMD_TIMEOUT;

        mblk = send_req->bulk_data;
        bcopy(data, mblk->b_wptr, len);
        mblk->b_wptr += len;

        res = usb_pipe_bulk_xfer(pipe, send_req, USB_FLAGS_SLEEP);
        if (res != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_FW, "uath: uath_fw_send(): "
                    "Error %x writing data to bulk/out pipe", res);
                return (UATH_FAILURE);
        }

        usb_free_bulk_req(send_req);
        return (UATH_SUCCESS);
}

static int
uath_fw_ack(struct uath_softc *sc, int len)
{
        struct uath_fwblock *rxblock;
        usb_bulk_req_t *req;
        mblk_t *mp;
        int err;

        req = usb_alloc_bulk_req(sc->sc_dev, len, USB_FLAGS_SLEEP);
        if (req == NULL) {
                UATH_DEBUG(UATH_DBG_FW,
                    "uath: uath_fw_ack(): "
                    "uath_rx_transfer(): failed to allocate req");
                return (UATH_FAILURE);
        }

        req->bulk_len                   = len;
        req->bulk_client_private        = (usb_opaque_t)sc;
        req->bulk_timeout               = 0;
        req->bulk_attributes            = USB_ATTRS_SHORT_XFER_OK
            | USB_ATTRS_AUTOCLEARING;

        err = usb_pipe_bulk_xfer(sc->rx_cmd_pipe, req, USB_FLAGS_SLEEP);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_FW, "uath: uath_fw_ack(): "
                    "failed to do rx xfer, %d", err);
                usb_free_bulk_req(req);
                return (UATH_FAILURE);
        }

        mp = req->bulk_data;
        req->bulk_data = NULL;

        rxblock = (struct uath_fwblock *)mp->b_rptr;
        UATH_DEBUG(UATH_DBG_FW, "uath: uath_fw_ack() "
            "rxblock flags=0x%x total=%d\n",
            BE_32(rxblock->flags), BE_32(rxblock->rxtotal));

        freemsg(mp);
        usb_free_bulk_req(req);

        return (UATH_SUCCESS);
}

/*
 * find uath firmware module's "_start" "_end" symbols
 * and get its size.
 */
static int
uath_loadsym(ddi_modhandle_t modp, char *sym, char **start, size_t *len)
{
        char start_sym[64];
        char end_sym[64];
        char *p, *end;
        int rv;
        size_t n;

        (void) snprintf(start_sym, sizeof (start_sym), "%s_start", sym);
        (void) snprintf(end_sym, sizeof (end_sym), "%s_end", sym);

        p = (char *)ddi_modsym(modp, start_sym, &rv);
        if (p == NULL || rv != 0) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_loadsym(): "
                    "mod %s: symbol %s not found\n", uath_fwmod, start_sym);
                return (UATH_FAILURE);
        }

        end = (char *)ddi_modsym(modp, end_sym, &rv);
        if (end == NULL || rv != 0) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_loadsym(): "
                    "mod %s: symbol %s not found\n", uath_fwmod, end_sym);
                return (UATH_FAILURE);
        }

        n = _PTRDIFF(end, p);
        *start = p;
        *len = n;

        return (UATH_SUCCESS);
}

/*
 * Load the MIPS R4000 microcode into the device.  Once the image is loaded,
 * the device will detach itself from the bus and reattach later with a new
 * product Id (a la ezusb).  XXX this could also be implemented in userland
 * through /dev/ugen.
 */
static int
uath_loadfirmware(struct uath_softc *sc)
{
        struct uath_fwblock txblock;
        ddi_modhandle_t modp;
        char *fw_index, *fw_image = NULL;
        size_t fw_size, len;
        int err = DDI_SUCCESS, rv = 0;

        modp = ddi_modopen(uath_fwmod, KRTLD_MODE_FIRST, &rv);
        if (modp == NULL) {
                cmn_err(CE_WARN, "uath: uath_loadfirmware(): "
                    "module %s not found\n", uath_fwmod);
                goto label;
        }

        err = uath_loadsym(modp, uath_binmod, &fw_index, &fw_size);
        if (err != UATH_SUCCESS) {
                cmn_err(CE_WARN, "uath: uath_loadfirmware(): "
                    "could not get firmware\n");
                goto label;
        }

        fw_image = (char *)kmem_alloc(fw_size, KM_SLEEP);
        if (fw_image == NULL) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_loadfirmware(): "
                    "failed to alloc firmware memory\n");
                err = UATH_FAILURE;
                goto label;
        }

        (void) memcpy(fw_image, fw_index, fw_size);
        fw_index = fw_image;
        len = fw_size;
        UATH_DEBUG(UATH_DBG_MSG, "loading firmware size = %lu\n", fw_size);

        /* bzero(txblock, sizeof (struct uath_fwblock)); */
        txblock.flags = BE_32(UATH_WRITE_BLOCK);
        txblock.total = BE_32(fw_size);

        while (len > 0) {
                size_t mlen = min(len, UATH_MAX_FWBLOCK_SIZE);

                txblock.remain = BE_32(len - mlen);
                txblock.len = BE_32(mlen);

                UATH_DEBUG(UATH_DBG_FW, "uath: uath_loadfirmware(): "
                    "sending firmware block: %d bytes sending\n", mlen);
                UATH_DEBUG(UATH_DBG_FW, "uath: uath_loadfirmware(): "
                    "sending firmware block: %d bytes remaining\n",
                    len - mlen);

                /* send firmware block meta-data */
                err = uath_fw_send(sc, sc->tx_cmd_pipe, &txblock,
                    sizeof (struct uath_fwblock));
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_FW, "uath: uath_loadfirmware(): "
                            "send block meta-data error");
                        goto label;
                }

                /* send firmware block data */
                err = uath_fw_send(sc, sc->tx_data_pipe, fw_index, mlen);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_FW, "uath: uath_loadfirmware() "
                            "send block data err");
                        goto label;
                }

                /* wait for ack from firmware */
                err = uath_fw_ack(sc, sizeof (struct uath_fwblock));
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_FW, "uath: uath_loadfirmware() "
                            "rx block ack err");
                        goto label;
                }

                fw_index += mlen;
                len -= mlen;
        }

label:
        if (fw_image != NULL)
                kmem_free(fw_image, fw_size);
        fw_image = fw_index = NULL;
        if (modp != NULL)
                (void) ddi_modclose(modp);
        return (err);
}

static int
uath_alloc_cmd_list(struct uath_softc *sc, struct uath_cmd cmds[],
    int ncmd, int maxsz)
{
        int i, err;

        for (i = 0; i < ncmd; i++) {
                struct uath_cmd *cmd = &cmds[i];

                cmd->sc = sc;   /* backpointer for callbacks */
                cmd->msgid = i;
                cmd->buf = kmem_zalloc(maxsz, KM_NOSLEEP);
                if (cmd->buf == NULL) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_alloc_cmd_list(): "
                            "could not allocate xfer buffer\n");
                        err = DDI_ENOMEM;
                        goto fail;
                }
        }
        return (UATH_SUCCESS);

fail:
        uath_free_cmd_list(cmds, ncmd);
        return (err);
}

static int
uath_init_cmd_list(struct uath_softc *sc)
{
        int i;

        sc->sc_cmdid = sc->rx_cmd_queued = sc->tx_cmd_queued = 0;
        for (i = 0; i < UATH_CMD_LIST_COUNT; i++) {
                if (uath_rx_cmd_xfer(sc) != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_init_cmd_list(): "
                            "failed to init cmd list %x\n", i);
                        return (UATH_FAILURE);
                }
        }
        return (UATH_SUCCESS);
}

static void
uath_free_cmd_list(struct uath_cmd cmds[], int ncmd)
{
        int i;

        for (i = 0; i < ncmd; i++)
                if (cmds[i].buf != NULL) {
                        kmem_free(cmds[i].buf, UATH_MAX_CMDSZ);
                        cmds[i].buf = NULL;
                }
}

static int
uath_host_available(struct uath_softc *sc)
{
        struct uath_cmd_host_available setup;

        /* inform target the host is available */
        setup.sw_ver_major = BE_32(ATH_SW_VER_MAJOR);
        setup.sw_ver_minor = BE_32(ATH_SW_VER_MINOR);
        setup.sw_ver_patch = BE_32(ATH_SW_VER_PATCH);
        setup.sw_ver_build = BE_32(ATH_SW_VER_BUILD);
        return (uath_cmd_read(sc, WDCMSG_HOST_AVAILABLE,
            &setup, sizeof (setup), NULL, 0, 0));
}

static void
uath_get_capability(struct uath_softc *sc, uint32_t cap, uint32_t *val)
{
        int err;

        cap = BE_32(cap);
        err = uath_cmd_read(sc, WDCMSG_TARGET_GET_CAPABILITY, &cap,
            sizeof (cap), val, sizeof (uint32_t), UATH_CMD_FLAG_MAGIC);
        if (err == UATH_SUCCESS)
                *val = BE_32(*val);
        else
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_get_capability(): "
                    "could not read capability %u\n", BE_32(cap));
}

static int
uath_get_devcap(struct uath_softc *sc)
{
        struct uath_devcap *cap = &sc->sc_devcap;

        /* collect device capabilities */
        uath_get_capability(sc, CAP_TARGET_VERSION,
            &cap->targetVersion);
        uath_get_capability(sc, CAP_TARGET_REVISION,
            &cap->targetRevision);
        uath_get_capability(sc, CAP_MAC_VERSION,
            &cap->macVersion);
        uath_get_capability(sc, CAP_MAC_REVISION,
            &cap->macRevision);
        uath_get_capability(sc, CAP_PHY_REVISION,
            &cap->phyRevision);
        uath_get_capability(sc, CAP_ANALOG_5GHz_REVISION,
            &cap->analog5GhzRevision);
        uath_get_capability(sc, CAP_ANALOG_2GHz_REVISION,
            &cap->analog2GhzRevision);
        uath_get_capability(sc, CAP_REG_DOMAIN,
            &cap->regDomain);
        uath_get_capability(sc, CAP_REG_CAP_BITS,
            &cap->regCapBits);

        /* NB: not supported in rev 1.5 */
        /* uath_get_capability(sc, CAP_COUNTRY_CODE, cap->countryCode); */

        uath_get_capability(sc, CAP_WIRELESS_MODES,
            &cap->wirelessModes);
        uath_get_capability(sc, CAP_CHAN_SPREAD_SUPPORT,
            &cap->chanSpreadSupport);
        uath_get_capability(sc, CAP_COMPRESS_SUPPORT,
            &cap->compressSupport);
        uath_get_capability(sc, CAP_BURST_SUPPORT,
            &cap->burstSupport);
        uath_get_capability(sc, CAP_FAST_FRAMES_SUPPORT,
            &cap->fastFramesSupport);
        uath_get_capability(sc, CAP_CHAP_TUNING_SUPPORT,
            &cap->chapTuningSupport);
        uath_get_capability(sc, CAP_TURBOG_SUPPORT,
            &cap->turboGSupport);
        uath_get_capability(sc, CAP_TURBO_PRIME_SUPPORT,
            &cap->turboPrimeSupport);
        uath_get_capability(sc, CAP_DEVICE_TYPE,
            &cap->deviceType);
        uath_get_capability(sc, CAP_WME_SUPPORT,
            &cap->wmeSupport);
        uath_get_capability(sc, CAP_TOTAL_QUEUES,
            &cap->numTxQueues);
        uath_get_capability(sc, CAP_CONNECTION_ID_MAX,
            &cap->connectionIdMax);

        uath_get_capability(sc, CAP_LOW_5GHZ_CHAN,
            &cap->low5GhzChan);
        uath_get_capability(sc, CAP_HIGH_5GHZ_CHAN,
            &cap->high5GhzChan);
        uath_get_capability(sc, CAP_LOW_2GHZ_CHAN,
            &cap->low2GhzChan);
        uath_get_capability(sc, CAP_HIGH_2GHZ_CHAN,
            &cap->high2GhzChan);
        uath_get_capability(sc, CAP_TWICE_ANTENNAGAIN_5G,
            &cap->twiceAntennaGain5G);
        uath_get_capability(sc, CAP_TWICE_ANTENNAGAIN_2G,
            &cap->twiceAntennaGain2G);

        uath_get_capability(sc, CAP_CIPHER_AES_CCM,
            &cap->supportCipherAES_CCM);
        uath_get_capability(sc, CAP_CIPHER_TKIP,
            &cap->supportCipherTKIP);
        uath_get_capability(sc, CAP_MIC_TKIP,
            &cap->supportMicTKIP);

        cap->supportCipherWEP = 1;      /* NB: always available */
        return (UATH_SUCCESS);
}

static int
uath_get_status(struct uath_softc *sc, uint32_t which, void *odata, int olen)
{
        int err;

        which = BE_32(which);
        err = uath_cmd_read(sc, WDCMSG_TARGET_GET_STATUS,
            &which, sizeof (which), odata, olen, UATH_CMD_FLAG_MAGIC);
        if (err != UATH_SUCCESS)
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_get_status(): "
                    "could not read EEPROM offset 0x%02x\n", BE_32(which));
        return (err);
}

static int
uath_get_devstatus(struct uath_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
{
        int err;

        /* retrieve MAC address */
        err = uath_get_status(sc, ST_MAC_ADDR, macaddr, IEEE80211_ADDR_LEN);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_get_devstatus(): "
                    "could not read MAC address\n");
                return (err);
        }

        err = uath_get_status(sc, ST_SERIAL_NUMBER,
            &sc->sc_serial[0], sizeof (sc->sc_serial));
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_get_devstatus(): "
                    "could not read device serial number\n");
                return (err);
        }

        return (UATH_SUCCESS);
}

/*
 * uath_cmd_lock: a special signal structure that is used for notification
 * that a callback function has been called.
 */

/* Initializes the uath_cmd_lock structure. */
static void
uath_cmd_lock_init(struct uath_cmd_lock *lock)
{
        ASSERT(lock != NULL);
        mutex_init(&lock->mutex, NULL, MUTEX_DRIVER, NULL);
        cv_init(&lock->cv, NULL, CV_DRIVER, NULL);
        lock->done = B_FALSE;
}

/* Deinitalizes the uath_cb_lock structure. */
void
uath_cmd_lock_destroy(struct uath_cmd_lock *lock)
{
        ASSERT(lock != NULL);
        mutex_destroy(&lock->mutex);
        cv_destroy(&lock->cv);
}

/*
 * Wait on lock until someone calls the "signal" function or the timeout
 * expires. Note: timeout is in microseconds.
 */
static int
uath_cmd_lock_wait(struct uath_cmd_lock *lock, clock_t timeout)
{
        int res, cv_res;
        clock_t etime;

        ASSERT(lock != NULL);
        mutex_enter(&lock->mutex);

        if (timeout < 0) {
                /* no timeout - wait as long as needed */
                while (lock->done == B_FALSE)
                        cv_wait(&lock->cv, &lock->mutex);
        } else {
                /* wait with timeout (given in usec) */
                etime = ddi_get_lbolt() + drv_usectohz(timeout);
                while (lock->done == B_FALSE) {
                        cv_res = cv_timedwait_sig(&lock->cv,
                            &lock->mutex, etime);
                        if (cv_res <= 0) break;
                }
        }

        res = (lock->done == B_TRUE) ? UATH_SUCCESS : UATH_FAILURE;
        mutex_exit(&lock->mutex);

        return (res);
}

/* Signal that the job (eg. callback) is done and unblock anyone who waits. */
static void
uath_cmd_lock_signal(struct uath_cmd_lock *lock)
{
        ASSERT(lock != NULL);

        mutex_enter(&lock->mutex);
        lock->done = B_TRUE;
        cv_broadcast(&lock->cv);
        mutex_exit(&lock->mutex);
}

static int
uath_cmd_read(struct uath_softc *sc, uint32_t code, const void *idata,
    int ilen, void *odata, int olen, int flags)
{
        flags |= UATH_CMD_FLAG_READ;
        return (uath_cmdsend(sc, code, idata, ilen, odata, olen, flags));
}

static int
uath_cmd_write(struct uath_softc *sc, uint32_t code, const void *data,
    int len, int flags)
{
        flags &= ~UATH_CMD_FLAG_READ;
        return (uath_cmdsend(sc, code, data, len, NULL, 0, flags));
}

/*
 * Low-level function to send read or write commands to the firmware.
 */
static int
uath_cmdsend(struct uath_softc *sc, uint32_t code, const void *idata, int ilen,
    void *odata, int olen, int flags)
{
        struct uath_cmd_hdr *hdr;
        struct uath_cmd *cmd;
        int err;

        /* grab a xfer */
        cmd = &sc->sc_cmd[sc->sc_cmdid];

        cmd->flags = flags;
        /* always bulk-out a multiple of 4 bytes */
        cmd->buflen = (sizeof (struct uath_cmd_hdr) + ilen + 3) & ~3;

        hdr = (struct uath_cmd_hdr *)cmd->buf;
        bzero(hdr, sizeof (struct uath_cmd_hdr));
        hdr->len   = BE_32(cmd->buflen);
        hdr->code  = BE_32(code);
        hdr->msgid = cmd->msgid;        /* don't care about endianness */
        hdr->magic = BE_32((cmd->flags & UATH_CMD_FLAG_MAGIC) ? 1 << 24 : 0);
        bcopy(idata, (uint8_t *)(hdr + 1), ilen);

        UATH_DEBUG(UATH_DBG_TX_CMD, "uath: uath_cmdsend(): "
            "queue %x send %s [flags 0x%x] olen %d\n",
            cmd->msgid, uath_codename(code), cmd->flags, olen);

        cmd->odata = odata;
        if (odata == NULL)
                UATH_DEBUG(UATH_DBG_TX_CMD, "uath: uath_cmdsend(): "
                    "warning - odata is NULL\n");
        else if (olen < UATH_MAX_CMDSZ - sizeof (*hdr) + sizeof (uint32_t))
                UATH_DEBUG(UATH_DBG_TX_CMD, "uath: uath_cmdsend(): "
                    "warning - olen %x is short\n, olen");
        cmd->olen = olen;

        err = uath_tx_cmd_xfer(sc, sc->tx_cmd_pipe, cmd->buf, cmd->buflen);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_cmdsend(): "
                    "Error writing command\n");
                return (UATH_FAILURE);
        }

        sc->sc_cmdid = (sc->sc_cmdid + 1) % UATH_CMD_LIST_COUNT;

        if (cmd->flags & UATH_CMD_FLAG_READ) {
                /* wait at most two seconds for command reply */
                uath_cmd_lock_init(&sc->rlock);
                err = uath_cmd_lock_wait(&sc->rlock, 2000000);
                cmd->odata = NULL;      /* in case reply comes too late */
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_cmdsend(): "
                            "timeout waiting for reply, "
                            "to cmd 0x%x (%u), queue %x\n",
                            code, code, cmd->msgid);
                        err = UATH_FAILURE;
                } else if (cmd->olen != olen) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_cmdsend(): "
                            "unexpected reply data count "
                            "to cmd 0x%x (%x), got %u, expected %u\n",
                            code, cmd->msgid, cmd->olen, olen);
                        err = UATH_FAILURE;
                }
                uath_cmd_lock_destroy(&sc->rlock);
                return (err);
        }

        return (UATH_SUCCESS);
}

/* ARGSUSED */
static void
uath_cmd_txeof(usb_pipe_handle_t pipe, struct usb_bulk_req *req)
{
        struct uath_softc *sc = (struct uath_softc *)req->bulk_client_private;

        UATH_DEBUG(UATH_DBG_TX_CMD, "uath: uath_cmd_txeof(): "
            "cr:%s(%d), flags:0x%x, tx queued %d\n",
            usb_str_cr(req->bulk_completion_reason),
            req->bulk_completion_reason,
            req->bulk_cb_flags,
            sc->tx_cmd_queued);

        if (req->bulk_completion_reason != USB_CR_OK)
                sc->sc_tx_err++;

        mutex_enter(&sc->sc_txlock_cmd);
        sc->tx_cmd_queued--;
        mutex_exit(&sc->sc_txlock_cmd);
        usb_free_bulk_req(req);
}

static int
uath_tx_cmd_xfer(struct uath_softc *sc,
    usb_pipe_handle_t pipe, const void *data, uint_t len)
{
        usb_bulk_req_t *send_req;
        mblk_t *mblk;
        int res;

        send_req = usb_alloc_bulk_req(sc->sc_dev, len, USB_FLAGS_SLEEP);

        send_req->bulk_client_private           = (usb_opaque_t)sc;
        send_req->bulk_len                      = (int)len;
        send_req->bulk_attributes               = USB_ATTRS_AUTOCLEARING;
        send_req->bulk_timeout                  = UATH_CMD_TIMEOUT;
        send_req->bulk_cb                       = uath_cmd_txeof;
        send_req->bulk_exc_cb                   = uath_cmd_txeof;
        send_req->bulk_completion_reason        = 0;
        send_req->bulk_cb_flags                 = 0;

        mblk = send_req->bulk_data;
        bcopy(data, mblk->b_rptr, len);
        mblk->b_wptr += len;

        res = usb_pipe_bulk_xfer(pipe, send_req, USB_FLAGS_NOSLEEP);
        if (res != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_tx_cmd_xfer(): "
                    "Error %x writing cmd to bulk/out pipe", res);
                return (UATH_FAILURE);
        }

        mutex_enter(&sc->sc_txlock_cmd);
        sc->tx_cmd_queued++;
        mutex_exit(&sc->sc_txlock_cmd);
        return (UATH_SUCCESS);
}

static void
uath_cmdeof(struct uath_softc *sc, struct uath_cmd *cmd)
{
        struct uath_cmd_hdr *hdr;
        int dlen;

        hdr = (struct uath_cmd_hdr *)cmd->buf;

        hdr->code = BE_32(hdr->code);
        hdr->len = BE_32(hdr->len);
        hdr->magic = BE_32(hdr->magic); /* target status on return */

        /* NB: msgid is passed thru w/o byte swapping */
        UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmdeof(): "
            "%s: [ix %x] len=%x status %x\n",
            uath_codename(hdr->code),
            hdr->msgid,
            hdr->len,
            hdr->magic);

        switch (hdr->code & 0xff) {
        /* reply to a read command */
        default:
                dlen = hdr->len - sizeof (*hdr);
                UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmdeof(): "
                    "code %x data len %u\n",
                    hdr->code & 0xff, dlen);

                /*
                 * The first response from the target after the
                 * HOST_AVAILABLE has an invalid msgid so we must
                 * treat it specially.
                 */
                if ((hdr->msgid < UATH_CMD_LIST_COUNT) && (hdr->code != 0x13)) {
                        uint32_t *rp = (uint32_t *)(hdr + 1);
                        uint_t olen;

                        if (!(sizeof (*hdr) <= hdr->len &&
                            hdr->len < UATH_MAX_CMDSZ)) {
                                UATH_DEBUG(UATH_DBG_RX_CMD,
                                    "uath: uath_cmdeof(): "
                                    "invalid WDC msg length %u; "
                                    "msg ignored\n",
                                    hdr->len);
                                return;
                        }

                        /*
                         * Calculate return/receive payload size; the
                         * first word, if present, always gives the
                         * number of bytes--unless it's 0 in which
                         * case a single 32-bit word should be present.
                         */
                        if (dlen >= sizeof (uint32_t)) {
                                olen = BE_32(rp[0]);
                                dlen -= sizeof (uint32_t);
                                if (olen == 0) {
                                        /* convention is 0 =>'s one word */
                                        olen = sizeof (uint32_t);
                                        /* XXX KASSERT(olen == dlen ) */
                                }
                        } else
                                olen = 0;

                        if (cmd->odata != NULL) {
                                /* NB: cmd->olen validated in uath_cmd */
                                if (olen > cmd->olen) {
                                        /* XXX complain? */
                                        UATH_DEBUG(UATH_DBG_RX_CMD,
                                            "uath: uath_cmdeof(): "
                                            "cmd 0x%x olen %u cmd olen %u\n",
                                            hdr->code, olen, cmd->olen);
                                        olen = cmd->olen;
                                }
                                if (olen > dlen) {
                                        /* XXX complain, shouldn't happen */
                                        UATH_DEBUG(UATH_DBG_RX_CMD,
                                            "uath: uath_cmdeof(): "
                                            "cmd 0x%x olen %u dlen %u\n",
                                            hdr->code, olen, dlen);
                                        olen = dlen;
                                }
                                /* XXX have submitter do this */
                                /* copy answer into caller's supplied buffer */
                                bcopy(&rp[1], cmd->odata, olen);
                                cmd->olen = olen;
                        }
                }

                /* Just signal that something happened */
                uath_cmd_lock_signal(&sc->rlock);
                break;

        case WDCMSG_TARGET_START:
                UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmdeof(): "
                    "receive TARGET STAERT\n");

                if (hdr->msgid >= UATH_CMD_LIST_COUNT) {
                        /* XXX */
                        return;
                }
                dlen = hdr->len - sizeof (*hdr);
                if (dlen != sizeof (uint32_t)) {
                        /* XXX something wrong */
                        return;
                }
                /* XXX have submitter do this */
                /* copy answer into caller's supplied buffer */
                bcopy(hdr + 1, cmd->odata, sizeof (uint32_t));
                cmd->olen = sizeof (uint32_t);

                /* wake up caller */
                uath_cmd_lock_signal(&sc->rlock);
                break;

        case WDCMSG_SEND_COMPLETE:
                /* this notification is sent when UATH_TX_NOTIFY is set */
                UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmdeof(): "
                    "receive Tx notification\n");
                break;

        case WDCMSG_TARGET_GET_STATS:
                UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmdeof(): "
                    "received device statistics\n");
                break;
        }
}

/* ARGSUSED */
static void
uath_cmd_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
{
        struct uath_softc *sc = (struct uath_softc *)req->bulk_client_private;
        struct uath_cmd_hdr *hdr;
        struct uath_cmd *cmd;
        mblk_t *m, *mp;
        int len;

        UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmd_rxeof(): "
            "cr:%s(%d), flags:0x%x, rx queued %d\n",
            usb_str_cr(req->bulk_completion_reason),
            req->bulk_completion_reason,
            req->bulk_cb_flags,
            sc->rx_cmd_queued);

        m = req->bulk_data;
        req->bulk_data = NULL;

        if (req->bulk_completion_reason != USB_CR_OK) {
                UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_cmd_rxeof(): "
                    "USB CR is not OK\n");
                goto fail;
        }

        if (m->b_cont != NULL) {
                /* Fragmented message, concatenate */
                mp = msgpullup(m, -1);
                freemsg(m);
                m = mp;
                mp = NULL;
        }

        len = msgdsize(m);
        if (len < sizeof (struct uath_cmd_hdr)) {
                UATH_DEBUG(UATH_DBG_RX_CMD, "uath: uath_rx_cmdeof(): "
                    "short xfer error\n");
                goto fail;
        }

        hdr = (struct uath_cmd_hdr *)m->b_rptr;
        if (BE_32(hdr->code) == 0x13)
                cmd = &sc->sc_cmd[0];
        else
                cmd = &sc->sc_cmd[hdr->msgid];

        bcopy(m->b_rptr, cmd->buf, len);
        uath_cmdeof(sc, cmd);
        (void) uath_rx_cmd_xfer(sc);
fail:
        mutex_enter(&sc->sc_rxlock_cmd);
        sc->rx_cmd_queued--;
        mutex_exit(&sc->sc_rxlock_cmd);
        if (m) freemsg(m);
        usb_free_bulk_req(req);
}

static int
uath_rx_cmd_xfer(struct uath_softc *sc)
{
        usb_bulk_req_t *req;
        int err;

        req = usb_alloc_bulk_req(sc->sc_dev, UATH_MAX_CMDSZ, USB_FLAGS_SLEEP);
        if (req == NULL) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_rx_cmd_xfer(): "
                    "failed to allocate req");
                return (UATH_FAILURE);
        }

        req->bulk_len                   = UATH_MAX_CMDSZ;
        req->bulk_client_private        = (usb_opaque_t)sc;
        req->bulk_cb                    = uath_cmd_rxeof;
        req->bulk_exc_cb                = uath_cmd_rxeof;
        req->bulk_timeout               = 0;
        req->bulk_completion_reason     = 0;
        req->bulk_cb_flags              = 0;
        req->bulk_attributes            = USB_ATTRS_SHORT_XFER_OK
            | USB_ATTRS_AUTOCLEARING;

        err = usb_pipe_bulk_xfer(sc->rx_cmd_pipe, req, USB_FLAGS_NOSLEEP);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_rx_cmd_xfer(): "
                    "failed to do rx xfer, %d", err);
                usb_free_bulk_req(req);
                return (UATH_FAILURE);
        }

        mutex_enter(&sc->sc_rxlock_cmd);
        sc->rx_cmd_queued++;
        mutex_exit(&sc->sc_rxlock_cmd);
        return (UATH_SUCCESS);
}

static void
uath_init_data_queue(struct uath_softc *sc)
{
        sc->tx_data_queued = sc->rx_data_queued = 0;
}

/* ARGSUSED */
static void
uath_data_txeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
{
        struct uath_softc *sc = (struct uath_softc *)req->bulk_client_private;
        struct ieee80211com *ic = &sc->sc_ic;

        UATH_DEBUG(UATH_DBG_TX, "uath: uath_data_txeof(): "
            "uath_txeof(): cr:%s(%d), flags:0x%x, tx_data_queued %d\n",
            usb_str_cr(req->bulk_completion_reason),
            req->bulk_completion_reason,
            req->bulk_cb_flags,
            sc->tx_data_queued);

        if (req->bulk_completion_reason != USB_CR_OK)
                sc->sc_tx_err++;

        mutex_enter(&sc->sc_txlock_data);
        sc->tx_data_queued--;

        if (sc->sc_need_sched) {
                sc->sc_need_sched = 0;
                mac_tx_update(ic->ic_mach);
        }

        mutex_exit(&sc->sc_txlock_data);
        usb_free_bulk_req(req);
}

static int
uath_tx_data_xfer(struct uath_softc *sc, mblk_t *mp)
{
        usb_bulk_req_t *req;
        int err;

        req = usb_alloc_bulk_req(sc->sc_dev, 0, USB_FLAGS_SLEEP);
        if (req == NULL) {
                UATH_DEBUG(UATH_DBG_TX, "uath: uath_tx_data_xfer(): "
                    "uath_tx_data_xfer(): failed to allocate req");
                freemsg(mp);
                return (UATH_FAILURE);
        }

        req->bulk_len                   = msgdsize(mp);
        req->bulk_data                  = mp;
        req->bulk_client_private        = (usb_opaque_t)sc;
        req->bulk_timeout               = UATH_DATA_TIMEOUT;
        req->bulk_attributes            = USB_ATTRS_AUTOCLEARING;
        req->bulk_cb                    = uath_data_txeof;
        req->bulk_exc_cb                = uath_data_txeof;
        req->bulk_completion_reason     = 0;
        req->bulk_cb_flags              = 0;

        if ((err = usb_pipe_bulk_xfer(sc->tx_data_pipe, req, 0)) !=
            USB_SUCCESS) {

                UATH_DEBUG(UATH_DBG_TX, "uath: uath_tx_data_xfer(): "
                    "failed to do tx xfer, %d", err);
                usb_free_bulk_req(req);
                return (UATH_FAILURE);
        }

        sc->tx_data_queued++;
        return (UATH_SUCCESS);
}

/* ARGSUSED */
static void
uath_data_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
{
        struct uath_softc *sc = (struct uath_softc *)req->bulk_client_private;
        struct ieee80211com *ic = &sc->sc_ic;
        struct uath_chunk *chunk;
        struct uath_rx_desc *desc;
        struct ieee80211_frame *wh;
        struct ieee80211_node *ni;

        mblk_t *m, *mp;
        uint8_t *rxbuf;
        int actlen, pktlen;

        mutex_enter(&sc->sc_rxlock_data);

        UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
            "cr:%s(%d), flags:0x%x, rx_data_queued %d\n",
            usb_str_cr(req->bulk_completion_reason),
            req->bulk_completion_reason,
            req->bulk_cb_flags,
            sc->rx_data_queued);

        mp = req->bulk_data;
        req->bulk_data = NULL;

        if (req->bulk_completion_reason != USB_CR_OK) {
                UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
                    "USB CR is not OK\n");
                sc->sc_rx_err++;
                goto fail;
        }

        rxbuf = (uint8_t *)mp->b_rptr;
        actlen = (uintptr_t)mp->b_wptr - (uintptr_t)mp->b_rptr;
        if (actlen < UATH_MIN_RXBUFSZ) {
                UATH_DEBUG(UATH_DBG_RX, "uath_data_rxeof(): "
                    "wrong recv size %d\n", actlen);
                sc->sc_rx_err++;
                goto fail;
        }

        chunk = (struct uath_chunk *)rxbuf;
        if (chunk->seqnum == 0 && chunk->flags == 0 && chunk->length == 0) {
                UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
                    "strange response\n");
                UATH_RESET_INTRX(sc);
                sc->sc_rx_err++;
                goto fail;
        }

        if (chunk->seqnum != sc->sc_intrx_nextnum) {
                UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
                    "invalid seqnum %d, expected %d\n",
                    chunk->seqnum, sc->sc_intrx_nextnum);
                UATH_STAT_INC(sc, st_badchunkseqnum);
                UATH_RESET_INTRX(sc);
                sc->sc_rx_err++;
                goto fail;
        }

        /* check multi-chunk frames  */
        if ((chunk->seqnum == 0 && !(chunk->flags & UATH_CFLAGS_FINAL)) ||
            (chunk->seqnum != 0 && (chunk->flags & UATH_CFLAGS_FINAL)) ||
            chunk->flags & UATH_CFLAGS_RXMSG) {
                UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
                    "receive multi-chunk frames "
                    "chunk seqnum %x, flags %x, length %u\n",
                    chunk->seqnum, chunk->flags, BE_16(chunk->length));
                UATH_STAT_INC(sc, st_multichunk);
        }


        /* if the frame is not final continue the transfer  */
        if (!(chunk->flags & UATH_CFLAGS_FINAL))
                sc->sc_intrx_nextnum++;

        /*
         * if the frame is not set UATH_CFLAGS_RXMSG, then rx descriptor is
         * located at the end, 32-bit aligned
         */
        desc = (chunk->flags & UATH_CFLAGS_RXMSG) ?
            (struct uath_rx_desc *)(chunk + 1) :
            (struct uath_rx_desc *)(((uint8_t *)chunk) +
            sizeof (struct uath_chunk) + BE_16(chunk->length) -
            sizeof (struct uath_rx_desc));

        UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
            "frame len %u code %u status %u rate %u antenna %u "
            "rssi %d channel %u phyerror %u connix %u "
            "decrypterror %u keycachemiss %u\n",
            BE_32(desc->framelen), BE_32(desc->code), BE_32(desc->status),
            BE_32(desc->rate), BE_32(desc->antenna), BE_32(desc->rssi),
            BE_32(desc->channel), BE_32(desc->phyerror), BE_32(desc->connix),
            BE_32(desc->decrypterror), BE_32(desc->keycachemiss));

        if (BE_32(desc->len) > IEEE80211_MAX_LEN) {
                UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
                    "bad descriptor (len=%d)\n", BE_32(desc->len));
                UATH_STAT_INC(sc, st_toobigrxpkt);
                goto fail;
        }

        uath_update_rxstat(sc, BE_32(desc->status));

        pktlen = BE_32(desc->framelen) - UATH_RX_DUMMYSIZE;

        if ((m = allocb(pktlen, BPRI_MED)) == NULL) {
                UATH_DEBUG(UATH_DBG_RX, "uath: uath_data_rxeof(): "
                    "allocate mblk failed.\n");
                sc->sc_rx_nobuf++;
                goto fail;
        }
        bcopy((rxbuf + sizeof (struct uath_chunk)), m->b_rptr, pktlen);

        m->b_wptr = m->b_rptr + pktlen;
        wh = (struct ieee80211_frame *)m->b_rptr;
        ni = ieee80211_find_rxnode(ic, wh);

        /* send the frame to the 802.11 layer */
        (void) ieee80211_input(ic, m, ni, (int)BE_32(desc->rssi), 0);

        /* node is no longer needed */
        ieee80211_free_node(ni);
fail:
        sc->rx_data_queued--;
        if (mp) freemsg(mp);
        usb_free_bulk_req(req);
        mutex_exit(&sc->sc_rxlock_data);
        if (UATH_IS_RUNNING(sc) && !UATH_IS_SUSPEND(sc)) {
                (void) uath_rx_data_xfer(sc);
        }
}

static int
uath_rx_data_xfer(struct uath_softc *sc)
{
        usb_bulk_req_t *req;
        int err;

        req = usb_alloc_bulk_req(sc->sc_dev,
            IEEE80211_MAX_LEN, USB_FLAGS_SLEEP);
        if (req == NULL) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_rx_data_xfer(): "
                    "failed to allocate req");
                return (UATH_SUCCESS);
        }

        req->bulk_len                   = IEEE80211_MAX_LEN;
        req->bulk_cb                    = uath_data_rxeof;
        req->bulk_exc_cb                = uath_data_rxeof;
        req->bulk_client_private        = (usb_opaque_t)sc;
        req->bulk_timeout               = 0;
        req->bulk_completion_reason     = 0;
        req->bulk_cb_flags              = 0;
        req->bulk_attributes            = USB_ATTRS_SHORT_XFER_OK
            | USB_ATTRS_AUTOCLEARING;

        err = usb_pipe_bulk_xfer(sc->rx_data_pipe, req, 0);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_rx_data_xfer(): "
                    "failed to do rx xfer, %d", err);
                usb_free_bulk_req(req);
                return (UATH_FAILURE);
        }

        mutex_enter(&sc->sc_rxlock_data);
        sc->rx_data_queued++;
        mutex_exit(&sc->sc_rxlock_data);
        return (UATH_SUCCESS);
}

static void
uath_update_rxstat(struct uath_softc *sc, uint32_t status)
{

        switch (status) {
        case UATH_STATUS_STOP_IN_PROGRESS:
                UATH_STAT_INC(sc, st_stopinprogress);
                break;
        case UATH_STATUS_CRC_ERR:
                UATH_STAT_INC(sc, st_crcerr);
                break;
        case UATH_STATUS_PHY_ERR:
                UATH_STAT_INC(sc, st_phyerr);
                break;
        case UATH_STATUS_DECRYPT_CRC_ERR:
                UATH_STAT_INC(sc, st_decrypt_crcerr);
                break;
        case UATH_STATUS_DECRYPT_MIC_ERR:
                UATH_STAT_INC(sc, st_decrypt_micerr);
                break;
        case UATH_STATUS_DECOMP_ERR:
                UATH_STAT_INC(sc, st_decomperr);
                break;
        case UATH_STATUS_KEY_ERR:
                UATH_STAT_INC(sc, st_keyerr);
                break;
        case UATH_STATUS_ERR:
                UATH_STAT_INC(sc, st_err);
                break;
        default:
                break;
        }
}

static void
uath_next_scan(void *arg)
{
        struct uath_softc       *sc = arg;
        struct ieee80211com     *ic = &sc->sc_ic;

        if (ic->ic_state == IEEE80211_S_SCAN)
                ieee80211_next_scan(ic);

        sc->sc_scan_id = 0;
}

static int
uath_create_connection(struct uath_softc *sc, uint32_t connid)
{
        const struct ieee80211_rateset *rs;
        struct ieee80211com *ic = &sc->sc_ic;
        struct ieee80211_node *ni = ic->ic_bss;
        struct uath_cmd_create_connection create;
        int err;

        bzero(&create, sizeof (create));
        create.connid = BE_32(connid);
        create.bssid = BE_32(0);
        /* XXX packed or not?  */
        create.size = BE_32(sizeof (struct uath_cmd_rateset));

        rs = &ni->in_rates;
        create.connattr.rateset.length = rs->ir_nrates;
        bcopy(rs->ir_rates, &create.connattr.rateset.set[0],
            rs->ir_nrates);

        /* XXX turbo */
        if (UATH_IS_CHAN_A(ni->in_chan))
                create.connattr.wlanmode = BE_32(WLAN_MODE_11a);
        else if (UATH_IS_CHAN_ANYG(ni->in_chan))
                create.connattr.wlanmode = BE_32(WLAN_MODE_11g);
        else
                create.connattr.wlanmode = BE_32(WLAN_MODE_11b);

        err = uath_cmd_write(sc, WDCMSG_CREATE_CONNECTION, &create,
            sizeof (create), 0);
        return (err);
}

static int
uath_set_rates(struct uath_softc *sc, const struct ieee80211_rateset *rs)
{
        struct uath_cmd_rates rates;
        int err;

        bzero(&rates, sizeof (rates));
        rates.connid = BE_32(UATH_ID_BSS);              /* XXX */
        rates.size   = BE_32(sizeof (struct uath_cmd_rateset));
        /* XXX bounds check rs->rs_nrates */
        rates.rateset.length = rs->ir_nrates;
        bcopy(rs->ir_rates, &rates.rateset.set[0], rs->ir_nrates);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_set_rates(): "
            "setting supported rates nrates=%d\n", rs->ir_nrates);
        err = uath_cmd_write(sc, WDCMSG_SET_BASIC_RATE,
            &rates, sizeof (rates), 0);
        return (err);
}

static int
uath_write_associd(struct uath_softc *sc)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct ieee80211_node *ni = ic->ic_bss;
        struct uath_cmd_set_associd associd;
        int err;

        bzero(&associd, sizeof (associd));
        associd.defaultrateix = BE_32(1);       /* XXX */
        associd.associd = BE_32(ni->in_associd);
        associd.timoffset = BE_32(0x3b);        /* XXX */
        IEEE80211_ADDR_COPY(associd.bssid, ni->in_bssid);
        err = uath_cmd_write(sc, WDCMSG_WRITE_ASSOCID, &associd,
            sizeof (associd), 0);
        return (err);
}

static int
uath_set_ledsteady(struct uath_softc *sc, int lednum, int ledmode)
{
        struct uath_cmd_ledsteady led;
        int err;

        led.lednum = BE_32(lednum);
        led.ledmode = BE_32(ledmode);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_set_ledsteady(): "
            "set %s led %s (steady)\n",
            (lednum == UATH_LED_LINK) ? "link" : "activity",
            ledmode ? "on" : "off");
        err = uath_cmd_write(sc, WDCMSG_SET_LED_STEADY, &led, sizeof (led), 0);
        return (err);
}

static int
uath_set_ledblink(struct uath_softc *sc, int lednum, int ledmode,
    int blinkrate, int slowmode)
{
        struct uath_cmd_ledblink led;
        int err;

        led.lednum = BE_32(lednum);
        led.ledmode = BE_32(ledmode);
        led.blinkrate = BE_32(blinkrate);
        led.slowmode = BE_32(slowmode);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_set_ledblink(): "
            "set %s led %s (blink)\n",
            (lednum == UATH_LED_LINK) ? "link" : "activity",
            ledmode ? "on" : "off");

        err = uath_cmd_write(sc, WDCMSG_SET_LED_BLINK,
            &led, sizeof (led), 0);
        return (err);
}


static int
uath_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
{
        struct uath_softc *sc = (struct uath_softc *)ic;
        struct ieee80211_node *ni = ic->ic_bss;
        enum ieee80211_state ostate;
        int err;

        ostate = ic->ic_state;
        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_newstate(): "
            "%d -> %d\n", ostate, nstate);

        if (sc->sc_scan_id != 0) {
                (void) untimeout(sc->sc_scan_id);
                sc->sc_scan_id = 0;
        }

        UATH_LOCK(sc);

        if (UATH_IS_DISCONNECT(sc) && (nstate != IEEE80211_S_INIT)) {
                UATH_UNLOCK(sc);
                return (DDI_SUCCESS);
        }

        if (UATH_IS_SUSPEND(sc) && (nstate != IEEE80211_S_INIT)) {
                UATH_UNLOCK(sc);
                return (DDI_SUCCESS);
        }

        switch (nstate) {
        case IEEE80211_S_INIT:
                if (ostate == IEEE80211_S_RUN) {
                        /* turn link and activity LEDs off */
                        (void) uath_set_ledstate(sc, 0);
                }
                break;
        case IEEE80211_S_SCAN:
                if (uath_switch_channel(sc, ic->ic_curchan) != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_newstate(): "
                            "could not switch channel\n");
                        break;
                }
                sc->sc_scan_id = timeout(uath_next_scan, (void *)sc,
                    drv_usectohz(250000));
                break;
        case IEEE80211_S_AUTH:
                /* XXX good place?  set RTS threshold  */
                uath_config(sc, CFG_USER_RTS_THRESHOLD, ic->ic_rtsthreshold);

                if (uath_switch_channel(sc, ni->in_chan) != 0) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_newstate(): "
                            "could not switch channel\n");
                        break;
                }
                if (uath_create_connection(sc, UATH_ID_BSS) != 0) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_newstate(): "
                            "could not create connection\n");
                        break;
                }
                break;
        case IEEE80211_S_ASSOC:
                if (uath_set_rates(sc, &ni->in_rates) != 0) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_newstate(): "
                            "could not set negotiated rate set\n");
                        break;
                }
                break;
        case IEEE80211_S_RUN:
                /* XXX monitor mode doesn't be supported  */
                if (ic->ic_opmode == IEEE80211_M_MONITOR) {
                        (void) uath_set_ledstate(sc, 1);
                        break;
                }

                /*
                 * Tx rate is controlled by firmware, report the maximum
                 * negotiated rate in ifconfig output.
                 */
                ni->in_txrate = ni->in_rates.ir_nrates - 1;

                if (uath_write_associd(sc) != 0) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_newstate(): "
                            "could not write association id\n");
                        break;
                }
                /* turn link LED on */
                (void) uath_set_ledsteady(sc, UATH_LED_LINK, UATH_LED_ON);
                /* make activity LED blink */
                (void) uath_set_ledblink(sc, UATH_LED_ACTIVITY,
                    UATH_LED_ON, 1, 2);
                /* set state to associated */
                (void) uath_set_ledstate(sc, 1);
                break;
        }

        UATH_UNLOCK(sc);

        err = sc->sc_newstate(ic, nstate, arg);
        return (err);
}

static int
uath_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
{
        struct uath_softc *sc = (struct uath_softc *)ic;
        struct uath_chunk *chunk;
        struct uath_tx_desc *desc;
        struct ieee80211_frame *wh;
        struct ieee80211_node *ni = NULL;
        struct ieee80211_key *k;

        mblk_t *m, *m0;
        int err, off, mblen;
        int pktlen, framelen, msglen;

        err = UATH_SUCCESS;

        mutex_enter(&sc->sc_txlock_data);

        if (UATH_IS_SUSPEND(sc)) {
                err = 0;
                goto fail;
        }

        if (sc->tx_data_queued > UATH_TX_DATA_LIST_COUNT) {
                UATH_DEBUG(UATH_DBG_TX, "uath: uath_send(): "
                    "no TX buffer available!\n");
                if ((type & IEEE80211_FC0_TYPE_MASK) ==
                    IEEE80211_FC0_TYPE_DATA) {
                        sc->sc_need_sched = 1;
                }
                sc->sc_tx_nobuf++;
                err = ENOMEM;
                goto fail;
        }

        m = allocb(UATH_MAX_TXBUFSZ, BPRI_MED);
        if (m == NULL) {
                UATH_DEBUG(UATH_DBG_TX, "uath: uath_send(): "
                    "can't alloc mblk.\n");
                err = DDI_FAILURE;
                goto fail;
        }

        /* skip TX descriptor */
        m->b_rptr += sizeof (struct uath_chunk) + sizeof (struct uath_tx_desc);
        m->b_wptr += sizeof (struct uath_chunk) + sizeof (struct uath_tx_desc);

        for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
                mblen = (uintptr_t)m0->b_wptr - (uintptr_t)m0->b_rptr;
                (void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
                off += mblen;
        }
        m->b_wptr += off;

        wh = (struct ieee80211_frame *)m->b_rptr;

        ni = ieee80211_find_txnode(ic, wh->i_addr1);
        if (ni == NULL) {
                err = DDI_FAILURE;
                freemsg(m);
                goto fail;
        }

        if ((type & IEEE80211_FC0_TYPE_MASK) ==
            IEEE80211_FC0_TYPE_DATA) {
                (void) ieee80211_encap(ic, m, ni);
        }

        if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
                k = ieee80211_crypto_encap(ic, m);
                if (k == NULL) {
                        freemsg(m);
                        err = DDI_FAILURE;
                        goto fail;
                }
                /* packet header may have moved, reset our local pointer */
                wh = (struct ieee80211_frame *)m->b_rptr;
        }

        pktlen = (uintptr_t)m->b_wptr - (uintptr_t)m->b_rptr;
        framelen = pktlen + IEEE80211_CRC_LEN;
        msglen = framelen + sizeof (struct uath_tx_desc);

        m->b_rptr -= sizeof (struct uath_chunk) + sizeof (struct uath_tx_desc);

        chunk = (struct uath_chunk *)m->b_rptr;
        desc = (struct uath_tx_desc *)(chunk + 1);

        /* one chunk only for now */
        chunk->seqnum = 0;
        chunk->flags = UATH_CFLAGS_FINAL;
        chunk->length = BE_16(msglen);

        /* fill Tx descriptor */
        desc->msglen = BE_32(msglen);
        /* NB: to get UATH_TX_NOTIFY reply, `msgid' must be larger than 0  */
        desc->msgid  = sc->sc_msgid; /* don't care about endianness */
        desc->type   = BE_32(WDCMSG_SEND);
        switch (wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) {
        case IEEE80211_FC0_TYPE_CTL:
        case IEEE80211_FC0_TYPE_MGT:
                /* NB: force all management frames to highest queue */
                if (ni->in_flags & UATH_NODE_QOS) {
                        /* NB: force all management frames to highest queue */
                        desc->txqid = BE_32(WME_AC_VO | UATH_TXQID_MINRATE);
                } else
                        desc->txqid = BE_32(WME_AC_BE | UATH_TXQID_MINRATE);
                break;
        case IEEE80211_FC0_TYPE_DATA:
                /* XXX multicast frames should honor mcastrate */
                desc->txqid = BE_32(WME_AC_BE);
                break;
        default:
                UATH_DEBUG(UATH_DBG_TX, "uath: uath_send(): "
                    "bogus frame type 0x%x (%s)\n",
                    wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK);
                err = EIO;
                goto fail;
        }

        if (ic->ic_state == IEEE80211_S_AUTH ||
            ic->ic_state == IEEE80211_S_ASSOC ||
            ic->ic_state == IEEE80211_S_RUN)
                desc->connid = BE_32(UATH_ID_BSS);
        else
                desc->connid = BE_32(UATH_ID_INVALID);
        desc->flags  = BE_32(0 /* no UATH_TX_NOTIFY */);
        desc->buflen = BE_32(pktlen);

        (void) uath_tx_data_xfer(sc, m);

        sc->sc_msgid = (sc->sc_msgid + 1) % UATH_TX_DATA_LIST_COUNT;

        ic->ic_stats.is_tx_frags++;
        ic->ic_stats.is_tx_bytes += pktlen;

fail:
        if (ni != NULL)
                ieee80211_free_node(ni);
        if ((mp) &&
            ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
            err == 0)) {
                freemsg(mp);
        }
        mutex_exit(&sc->sc_txlock_data);
        return (err);
}

static int
uath_reconnect(dev_info_t *devinfo)
{
        struct uath_softc *sc;
        struct ieee80211com *ic;
        int err;
        uint16_t vendor_id, product_id;

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_reconnect(): "
            "uath online\n");

        sc = ddi_get_soft_state(uath_soft_state_p, ddi_get_instance(devinfo));
        ASSERT(sc != NULL);
        ic = (struct ieee80211com *)&sc->sc_ic;

        if (!UATH_IS_RECONNECT(sc)) {
                err = uath_open_pipes(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not open pipes\n");
                        return (DDI_FAILURE);
                }

                err = uath_loadfirmware(sc);
                if (err != DDI_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not download firmware\n");
                        return (DDI_FAILURE);
                }

                uath_close_pipes(sc);
                usb_client_detach(sc->sc_dev, sc->sc_udev);

                /* reset device */
                err = usb_reset_device(sc->sc_dev, USB_RESET_LVL_DEFAULT);
                if (err != USB_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not reset device %x\n", err);
                }

                err = usb_client_attach(devinfo, USBDRV_VERSION, 0);
                if (err != USB_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "usb_client_attach failed\n");
                }

                err = usb_get_dev_data(devinfo, &sc->sc_udev,
                    USB_PARSE_LVL_ALL, 0);
                if (err != USB_SUCCESS) {
                        sc->sc_udev = NULL;
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "usb_get_dev_data failed\n");
                }

                vendor_id = sc->sc_udev->dev_descr->idVendor;
                product_id = sc->sc_udev->dev_descr->idProduct;
                sc->dev_flags = uath_lookup(vendor_id, product_id);
                if (sc->dev_flags == UATH_FLAG_ERR) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "HW does not match\n");
                }

                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_reconnect(): "
                    "vendorId = %x,deviceID = %x, flags = %x\n",
                    vendor_id, product_id, sc->dev_flags);

                UATH_LOCK(sc);
                sc->sc_flags |= UATH_FLAG_RECONNECT;
                UATH_UNLOCK(sc);

        } else {
                err = uath_open_pipes(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not open pipes\n");
                        return (DDI_FAILURE);
                }

                /*
                 * Allocate xfers for firmware commands.
                 */
                err = uath_alloc_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT,
                    UATH_MAX_CMDSZ);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not allocate Tx command list\n");
                        return (DDI_FAILURE);
                }

                err = uath_init_cmd_list(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not init RX command list\n");
                        return (DDI_FAILURE);
                }

                /*
                 * We're now ready to send+receive firmware commands.
                 */
                err = uath_host_available(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not initialize adapter\n");
                        return (DDI_FAILURE);
                }

                err = uath_get_devcap(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not get device capabilities\n");
                        return (DDI_FAILURE);
                }

                err = uath_get_devstatus(sc, ic->ic_macaddr);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "could not get dev status\n");
                        return (DDI_FAILURE);
                }

                err = usb_check_same_device(sc->sc_dev, NULL, USB_LOG_L2, -1,
                    USB_CHK_BASIC, NULL);
                if (err != USB_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "different device connected %x\n", err);
                        return (DDI_FAILURE);
                }

                err = uath_init(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_reconnect(): "
                            "device re-connect failed\n");
                        return (DDI_FAILURE);
                }

                UATH_LOCK(sc);
                sc->sc_flags &= ~UATH_FLAG_RECONNECT;
                sc->sc_flags &= ~UATH_FLAG_DISCONNECT;
                sc->sc_flags |= UATH_FLAG_RUNNING;
                UATH_UNLOCK(sc);
        }

        return (DDI_SUCCESS);
}

static int
uath_disconnect(dev_info_t *devinfo)
{
        struct uath_softc *sc;
        struct ieee80211com *ic;

        /*
         * We can't call uath_stop() here, since the hardware is removed,
         * we can't access the register anymore.
         */
        sc = ddi_get_soft_state(uath_soft_state_p, ddi_get_instance(devinfo));
        ASSERT(sc != NULL);

        if (sc->sc_flags & UATH_FLAG_RECONNECT) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_disconnect(): "
                    "stage 0 in re-connect\n");
                uath_close_pipes(sc);
                return (DDI_SUCCESS);
        }

        UATH_LOCK(sc);
        sc->sc_flags |= UATH_FLAG_DISCONNECT;
        UATH_UNLOCK(sc);

        ic = (struct ieee80211com *)&sc->sc_ic;
        ieee80211_new_state(ic, IEEE80211_S_INIT, -1);

        UATH_LOCK(sc);
        sc->sc_flags &= ~UATH_FLAG_RUNNING;     /* STOP */
        UATH_UNLOCK(sc);

        /* abort and free xfers */
        uath_free_cmd_list(sc->sc_cmd, UATH_CMD_LIST_COUNT);

        /* close Tx/Rx pipes */
        uath_close_pipes(sc);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_disconnect(): "
            "offline success\n");

        return (DDI_SUCCESS);
}

static int
uath_dataflush(struct uath_softc *sc)
{
        struct uath_chunk *chunk;
        struct uath_tx_desc *desc;
        uint8_t *buf;
        int err;

        buf = kmem_alloc(UATH_MAX_TXBUFSZ, KM_NOSLEEP);
        if (buf == NULL) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_dataflush(): "
                    "no bufs\n");
                return (ENOBUFS);
        }

        chunk = (struct uath_chunk *)buf;
        desc = (struct uath_tx_desc *)(chunk + 1);

        /* one chunk only */
        chunk->seqnum = 0;
        chunk->flags = UATH_CFLAGS_FINAL;
        chunk->length = BE_16(sizeof (struct uath_tx_desc));

        bzero(desc, sizeof (struct uath_tx_desc));
        desc->msglen = BE_32(sizeof (struct uath_tx_desc));
        desc->msgid  = sc->sc_msgid; /* don't care about endianness */
        desc->type   = BE_32(WDCMSG_FLUSH);
        desc->txqid  = BE_32(0);
        desc->connid = BE_32(0);
        desc->flags  = BE_32(0);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_dataflush(): "
            "send flush ix %d\n", desc->msgid);

        err = uath_fw_send(sc, sc->tx_data_pipe, buf,
            sizeof (struct uath_chunk) + sizeof (struct uath_tx_desc));
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_dataflush(): "
                    "data flush error");
                return (UATH_FAILURE);
        }

        kmem_free(buf, UATH_MAX_TXBUFSZ);
        sc->sc_msgid = (sc->sc_msgid + 1) % UATH_TX_DATA_LIST_COUNT;

        return (UATH_SUCCESS);
}

static int
uath_cmdflush(struct uath_softc *sc)
{
        return (uath_cmd_write(sc, WDCMSG_FLUSH, NULL, 0, 0));
}

static int
uath_flush(struct uath_softc *sc)
{
        int err;

        err = uath_dataflush(sc);
        if (err != UATH_SUCCESS)
                goto failed;

        err = uath_cmdflush(sc);
        if (err != UATH_SUCCESS)
                goto failed;

        return (UATH_SUCCESS);
failed:
        return (err);
}

static int
uath_set_ledstate(struct uath_softc *sc, int connected)
{
        int err;

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_set_ledstate(): "
            "set led state %sconnected\n", connected ? "" : "!");

        connected = BE_32(connected);
        err = uath_cmd_write(sc, WDCMSG_SET_LED_STATE,
            &connected, sizeof (connected), 0);
        return (err);
}

static int
uath_config_multi(struct uath_softc *sc, uint32_t reg, const void *data,
    int len)
{
        struct uath_write_mac write;
        int err;

        write.reg = BE_32(reg);
        write.len = BE_32(len);
        bcopy(data, write.data, len);

        /* properly handle the case where len is zero (reset) */
        err = uath_cmd_write(sc, WDCMSG_TARGET_SET_CONFIG, &write,
            (len == 0) ? sizeof (uint32_t) : 2 * sizeof (uint32_t) + len, 0);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_config_multi(): "
                    "could not write %d bytes to register 0x%02x\n", len, reg);
        }
        return (err);
}

static void
uath_config(struct uath_softc *sc, uint32_t reg, uint32_t val)
{
        struct uath_write_mac write;
        int err;

        write.reg = BE_32(reg);
        write.len = BE_32(0);   /* 0 = single write */
        *(uint32_t *)write.data = BE_32(val);

        err = uath_cmd_write(sc, WDCMSG_TARGET_SET_CONFIG, &write,
            3 * sizeof (uint32_t), 0);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_config(): "
                    "could not write register 0x%02x\n",
                    reg);
        }
}

static int
uath_switch_channel(struct uath_softc *sc, struct ieee80211_channel *c)
{
        int err;

        /* set radio frequency */
        err = uath_set_chan(sc, c);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_switch_channel(): "
                    "could not set channel\n");
                goto failed;
        }

        /* reset Tx rings */
        err = uath_reset_tx_queues(sc);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_switch_channel(): "
                    "could not reset Tx queues\n");
                goto failed;
        }

        /* set Tx rings WME properties */
        err = uath_wme_init(sc);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_switch_channel(): "
                    "could not init Tx queues\n");
                goto failed;
        }

        err = uath_set_ledstate(sc, 0);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_switch_channel(): "
                    "could not set led state\n");
                goto failed;
        }

        err = uath_flush(sc);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_switch_channel(): "
                    "could not flush pipes\n");
                goto failed;
        }

failed:
        return (err);
}

static int
uath_set_rxfilter(struct uath_softc *sc, uint32_t bits, uint32_t op)
{
        struct uath_cmd_rx_filter rxfilter;

        rxfilter.bits = BE_32(bits);
        rxfilter.op = BE_32(op);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_set_rxfilter(): "
            "setting Rx filter=0x%x flags=0x%x\n", bits, op);

        return ((uath_cmd_write(sc, WDCMSG_RX_FILTER, &rxfilter,
            sizeof (rxfilter), 0)));
}

static int
uath_set_chan(struct uath_softc *sc, struct ieee80211_channel *c)
{
        struct ieee80211com *ic = &sc->sc_ic;
        struct uath_cmd_reset reset;

        bzero(&reset, sizeof (reset));
        if (IEEE80211_IS_CHAN_2GHZ(c))
                reset.flags |= BE_32(UATH_CHAN_2GHZ);
        if (IEEE80211_IS_CHAN_5GHZ(c))
                reset.flags |= BE_32(UATH_CHAN_5GHZ);
        /* NB: 11g =>'s 11b so don't specify both OFDM and CCK */
        if (UATH_IS_CHAN_OFDM(c))
                reset.flags |= BE_32(UATH_CHAN_OFDM);
        else if (UATH_IS_CHAN_CCK(c))
                reset.flags |= BE_32(UATH_CHAN_CCK);
        /* turbo can be used in either 2GHz or 5GHz */
        if (c->ich_flags & IEEE80211_CHAN_TURBO)
                reset.flags |= BE_32(UATH_CHAN_TURBO);

        reset.freq = BE_32(c->ich_freq);
        reset.maxrdpower = BE_32(50);   /* XXX */
        reset.channelchange = BE_32(1);
        reset.keeprccontent = BE_32(0);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_set_chan(): "
            "set channel %d, flags 0x%x freq %u\n",
            ieee80211_chan2ieee(ic, c),
            BE_32(reset.flags), BE_32(reset.freq));

        return (uath_cmd_write(sc, WDCMSG_RESET, &reset, sizeof (reset), 0));
}

static int
uath_reset_tx_queues(struct uath_softc *sc)
{
        int ac, err;

        for (ac = 0; ac < 4; ac++) {
                const uint32_t qid = BE_32(ac);
                err = uath_cmd_write(sc, WDCMSG_RELEASE_TX_QUEUE, &qid,
                    sizeof (qid), 0);
                if (err != UATH_SUCCESS)
                        break;
        }
        return (err);
}

static int
uath_wme_init(struct uath_softc *sc)
{
        /* XXX get from net80211 */
        static const struct uath_wme_settings uath_wme_11g[4] = {
                { 7, 4, 10,  0, 0 },    /* Background */
                { 3, 4, 10,  0, 0 },    /* Best-Effort */
                { 3, 3,  4, 26, 0 },    /* Video */
                { 2, 2,  3, 47, 0 }     /* Voice */
        };

        struct uath_cmd_txq_setup qinfo;
        int ac, err;

        for (ac = 0; ac < 4; ac++) {
                qinfo.qid               = BE_32(ac);
                qinfo.len               = BE_32(sizeof (qinfo.attr));
                qinfo.attr.priority     = BE_32(ac);    /* XXX */
                qinfo.attr.aifs         = BE_32(uath_wme_11g[ac].aifsn);
                qinfo.attr.logcwmin     = BE_32(uath_wme_11g[ac].logcwmin);
                qinfo.attr.logcwmax     = BE_32(uath_wme_11g[ac].logcwmax);
                qinfo.attr.mode         = BE_32(uath_wme_11g[ac].acm);
                qinfo.attr.qflags       = BE_32(1);
                qinfo.attr.bursttime    =
                    BE_32(UATH_TXOP_TO_US(uath_wme_11g[ac].txop));

                err = uath_cmd_write(sc, WDCMSG_SETUP_TX_QUEUE, &qinfo,
                    sizeof (qinfo), 0);
                if (err != UATH_SUCCESS)
                        break;
        }
        return (err);
}

static void
uath_stop_locked(void *arg)
{
        struct uath_softc *sc = (struct uath_softc *)arg;

        /* flush data & control requests into the target  */
        (void) uath_flush(sc);

        /* set a LED status to the disconnected.  */
        (void) uath_set_ledstate(sc, 0);

        /* stop the target  */
        (void) uath_cmd_write(sc, WDCMSG_TARGET_STOP, NULL, 0, 0);

        /* abort any pending transfers */
        usb_pipe_reset(sc->sc_dev, sc->rx_data_pipe, USB_FLAGS_SLEEP, NULL, 0);
        usb_pipe_reset(sc->sc_dev, sc->tx_data_pipe, USB_FLAGS_SLEEP, NULL, 0);
        usb_pipe_reset(sc->sc_dev, sc->tx_cmd_pipe, USB_FLAGS_SLEEP, NULL, 0);
}

static int
uath_init_locked(void *arg)
{
        struct uath_softc *sc = arg;
        struct ieee80211com *ic = &sc->sc_ic;
        uint32_t val;
        int i, err;

        if (UATH_IS_RUNNING(sc))
                uath_stop_locked(sc);

        uath_init_data_queue(sc);

        /* reset variables */
        sc->sc_intrx_nextnum = sc->sc_msgid = 0;

        val = BE_32(0);
        (void) uath_cmd_write(sc, WDCMSG_BIND, &val, sizeof (val), 0);

        /* set MAC address */
        (void) uath_config_multi(sc, CFG_MAC_ADDR,
            ic->ic_macaddr, IEEE80211_ADDR_LEN);

        /* XXX honor net80211 state */
        uath_config(sc, CFG_RATE_CONTROL_ENABLE, 0x00000001);
        uath_config(sc, CFG_DIVERSITY_CTL, 0x00000001);
        uath_config(sc, CFG_ABOLT, 0x0000003f);
        uath_config(sc, CFG_WME_ENABLED, 0x00000001);

        uath_config(sc, CFG_SERVICE_TYPE, 1);
        uath_config(sc, CFG_TP_SCALE, 0x00000000);
        uath_config(sc, CFG_TPC_HALF_DBM5, 0x0000003c);
        uath_config(sc, CFG_TPC_HALF_DBM2, 0x0000003c);
        uath_config(sc, CFG_OVERRD_TX_POWER, 0x00000000);
        uath_config(sc, CFG_GMODE_PROTECTION, 0x00000000);
        uath_config(sc, CFG_GMODE_PROTECT_RATE_INDEX, 0x00000003);
        uath_config(sc, CFG_PROTECTION_TYPE, 0x00000000);
        uath_config(sc, CFG_MODE_CTS, 0x00000002);

        err = uath_cmd_read(sc, WDCMSG_TARGET_START, NULL, 0,
            &val, sizeof (val), UATH_CMD_FLAG_MAGIC);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_init_locked(): "
                    "could not start target\n");
                goto fail;
        }

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_init_locked(): "
            "%s returns handle: 0x%x\n",
            uath_codename(WDCMSG_TARGET_START), BE_32(val));

        /* set default channel */
        err = uath_switch_channel(sc, ic->ic_curchan);
        if (err) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_init_locked(): "
                    "could not switch channel, error %d\n", err);
                goto fail;
        }

        val = BE_32(TARGET_DEVICE_AWAKE);
        (void) uath_cmd_write(sc, WDCMSG_SET_PWR_MODE, &val, sizeof (val), 0);
        /* XXX? check */
        (void) uath_cmd_write(sc, WDCMSG_RESET_KEY_CACHE, NULL, 0, 0);

        for (i = 0; i < UATH_RX_DATA_LIST_COUNT; i++) {
                err = uath_rx_data_xfer(sc);
                if (err != UATH_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_init_locked(): "
                            "could not alloc rx xfer %x\n", i);
                        goto fail;
                }
        }

        /* enable Rx */
        (void) uath_set_rxfilter(sc, 0x0, UATH_FILTER_OP_INIT);
        (void) uath_set_rxfilter(sc,
            UATH_FILTER_RX_UCAST | UATH_FILTER_RX_MCAST |
            UATH_FILTER_RX_BCAST | UATH_FILTER_RX_BEACON,
            UATH_FILTER_OP_SET);

        return (UATH_SUCCESS);

fail:
        uath_stop_locked(sc);
        return (err);
}

static int
uath_init(struct uath_softc *sc)
{
        int err;

        UATH_LOCK(sc);
        err = uath_init_locked(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_init(): "
                    "failed to initialize uath hardware\n");
                UATH_UNLOCK(sc);
                return (DDI_FAILURE);
        }
        UATH_UNLOCK(sc);
        return (DDI_SUCCESS);
}

static void
uath_stop(struct uath_softc *sc)
{
        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_stop(): "
            "uath stop now\n");

        UATH_LOCK(sc);
        uath_stop_locked(sc);
        UATH_UNLOCK(sc);
}

static void
uath_resume(struct uath_softc *sc)
{
        int err;

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_resume(): "
            "uath resume now\n");

        /* check device changes after suspend */
        if (usb_check_same_device(sc->sc_dev, NULL, USB_LOG_L2, -1,
            USB_CHK_BASIC | USB_CHK_CFG, NULL) != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_resume: "
                    "no or different device connected\n");
                return;
        }

        /*
         * initialize hardware
         */
        err = uath_init_cmd_list(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_resume(): "
                    "could not init RX command list\n");
                return;
        }

        err = uath_init(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_resume(): "
                    "hardware init failed\n");
                uath_stop(sc);
                return;
        }

        ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
        UATH_LOCK(sc);
        sc->sc_flags &= ~UATH_FLAG_SUSPEND;
        sc->sc_flags |= UATH_FLAG_RUNNING;
        UATH_UNLOCK(sc);
}

static int
uath_m_start(void *arg)
{
        struct uath_softc *sc = (struct uath_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        int err;

        /*
         * initialize hardware
         */
        err = uath_init(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_m_start(): "
                    "device configuration failed\n");
                uath_stop(sc);
                return (err);
        }

        ieee80211_new_state(ic, IEEE80211_S_INIT, -1);

        UATH_LOCK(sc);
        sc->sc_flags |= UATH_FLAG_RUNNING;
        UATH_UNLOCK(sc);
        return (DDI_SUCCESS);
}

static void
uath_m_stop(void *arg)
{
        struct uath_softc *sc = (struct uath_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;

        ieee80211_new_state(ic, IEEE80211_S_INIT, -1);

        if (!UATH_IS_DISCONNECT(sc))
                uath_stop(sc);

        UATH_LOCK(sc);
        sc->sc_flags &= ~UATH_FLAG_RUNNING;
        UATH_UNLOCK(sc);
}

static void
uath_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
{
        struct uath_softc *sc = (struct uath_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        int err;

        err = ieee80211_ioctl(ic, wq, mp);
        UATH_LOCK(sc);
        if (err == ENETRESET) {
                if (ic->ic_des_esslen) {
                        if (UATH_IS_RUNNING(sc)) {
                                UATH_UNLOCK(sc);
                                (void) uath_init(sc);
                                (void) ieee80211_new_state(ic,
                                    IEEE80211_S_SCAN, -1);
                                UATH_LOCK(sc);
                        }
                }
        }
        UATH_UNLOCK(sc);
}

/*ARGSUSED*/
static int
uath_m_unicst(void *arg, const uint8_t *macaddr)
{
        return (0);
}

/*ARGSUSED*/
static int
uath_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
{
        return (0);
}

/*ARGSUSED*/
static int
uath_m_promisc(void *arg, boolean_t on)
{
        return (0);
}

/*
 * callback functions for /get/set properties
 */
static int
uath_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
    uint_t wldp_length, const void *wldp_buf)
{
        struct uath_softc *sc = (struct uath_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        int err;

        err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
            wldp_length, wldp_buf);
        UATH_LOCK(sc);
        if (err == ENETRESET) {
                if (ic->ic_des_esslen && UATH_IS_RUNNING(sc)) {
                        UATH_UNLOCK(sc);
                        (void) uath_init(sc);
                        (void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
                        UATH_LOCK(sc);
                }
                err = 0;
        }
        UATH_UNLOCK(sc);
        return (err);
}

static int
uath_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
    uint_t wldp_length, void *wldp_buf)
{
        struct uath_softc *sc = (struct uath_softc *)arg;
        int err;

        err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
            wldp_length, wldp_buf);
        return (err);
}

static void
uath_m_propinfo(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
    mac_prop_info_handle_t prh)
{
        struct uath_softc *sc = (struct uath_softc *)arg;

        ieee80211_propinfo(&sc->sc_ic, pr_name, wldp_pr_num, prh);
}

static int
uath_m_stat(void *arg, uint_t stat, uint64_t *val)
{
        struct uath_softc *sc  = (struct uath_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        struct ieee80211_node *ni = NULL;
        struct ieee80211_rateset *rs = NULL;

        UATH_LOCK(sc);
        switch (stat) {
        case MAC_STAT_IFSPEED:
                ni = ic->ic_bss;
                rs = &ni->in_rates;
                *val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
                    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
                    : ic->ic_fixed_rate) * 5000000ull;
                break;
        case MAC_STAT_NOXMTBUF:
                *val = sc->sc_tx_nobuf;
                break;
        case MAC_STAT_NORCVBUF:
                *val = sc->sc_rx_nobuf;
                break;
        case MAC_STAT_IERRORS:
                *val = sc->sc_rx_err;
                break;
        case MAC_STAT_RBYTES:
                *val = ic->ic_stats.is_rx_bytes;
                break;
        case MAC_STAT_IPACKETS:
                *val = ic->ic_stats.is_rx_frags;
                break;
        case MAC_STAT_OBYTES:
                *val = ic->ic_stats.is_tx_bytes;
                break;
        case MAC_STAT_OPACKETS:
                *val = ic->ic_stats.is_tx_frags;
                break;
        case MAC_STAT_OERRORS:
        case WIFI_STAT_TX_FAILED:
                *val = sc->sc_tx_err;
                break;
        case WIFI_STAT_TX_RETRANS:
                *val = sc->sc_tx_retries;
                break;
        case WIFI_STAT_FCS_ERRORS:
        case WIFI_STAT_WEP_ERRORS:
        case WIFI_STAT_TX_FRAGS:
        case WIFI_STAT_MCAST_TX:
        case WIFI_STAT_RTS_SUCCESS:
        case WIFI_STAT_RTS_FAILURE:
        case WIFI_STAT_ACK_FAILURE:
        case WIFI_STAT_RX_FRAGS:
        case WIFI_STAT_MCAST_RX:
        case WIFI_STAT_RX_DUPS:
                UATH_UNLOCK(sc);
                return (ieee80211_stat(ic, stat, val));
        default:
                UATH_UNLOCK(sc);
                return (ENOTSUP);
        }
        UATH_UNLOCK(sc);

        return (0);
}

static mblk_t *
uath_m_tx(void *arg, mblk_t *mp)
{
        struct uath_softc *sc = (struct uath_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        mblk_t *next;

        /*
         * No data frames go out unless we're associated; this
         * should not happen as the 802.11 layer does not enable
         * the xmit queue until we enter the RUN state.
         */
        if ((ic->ic_state != IEEE80211_S_RUN) ||
            UATH_IS_SUSPEND(sc)) {
                UATH_DEBUG(UATH_DBG_MSG, "uath: uath_m_tx(): "
                    "discard, state %u\n", ic->ic_state);
                freemsgchain(mp);
                return (NULL);
        }

        while (mp != NULL) {
                next = mp->b_next;
                mp->b_next = NULL;
                if (uath_send(ic, mp, IEEE80211_FC0_TYPE_DATA) != DDI_SUCCESS) {
                        mp->b_next = next;
                        break;
                }
                mp = next;
        }
        return (mp);
}

static int
uath_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
{
        struct uath_softc *sc;
        struct ieee80211com *ic;

        int i, err, instance;
        char strbuf[32];
        uint16_t vendor_id, product_id;

        wifi_data_t wd = { 0 };
        mac_register_t *macp;

        switch (cmd) {
        case DDI_ATTACH:
                break;
        case DDI_RESUME:
                sc = ddi_get_soft_state(uath_soft_state_p,
                    ddi_get_instance(devinfo));
                ASSERT(sc != NULL);
                uath_resume(sc);
                return (DDI_SUCCESS);
        default:
                return (DDI_FAILURE);
        }

        instance = ddi_get_instance(devinfo);
        err = ddi_soft_state_zalloc(uath_soft_state_p, instance);
        if (err != DDI_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "ddi_soft_state_zalloc failed\n");
                return (DDI_FAILURE);
        }

        sc = ddi_get_soft_state(uath_soft_state_p, instance);
        ic = (ieee80211com_t *)&sc->sc_ic;
        sc->sc_dev = devinfo;

        err = usb_client_attach(devinfo, USBDRV_VERSION, 0);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "usb_client_attach failed\n");
                goto fail1;
        }

        err = usb_get_dev_data(devinfo, &sc->sc_udev, USB_PARSE_LVL_ALL, 0);
        if (err != USB_SUCCESS) {
                sc->sc_udev = NULL;
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "usb_get_dev_data failed\n");
                goto fail2;
        }

        vendor_id = sc->sc_udev->dev_descr->idVendor;
        product_id = sc->sc_udev->dev_descr->idProduct;
        sc->dev_flags = uath_lookup(vendor_id, product_id);
        if (sc->dev_flags == UATH_FLAG_ERR) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "HW does not match\n");
                goto fail2;
        }

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_attach(): "
            "vendorId = %x,deviceID = %x, flags = %x\n",
            vendor_id, product_id, sc->dev_flags);

        /*
         * We must open the pipes early because they're used to upload the
         * firmware (pre-firmware devices) or to send firmware commands.
         */
        err = uath_open_pipes(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "could not open pipes\n");
                goto fail3;
        }

        if (sc->dev_flags & UATH_FLAG_PRE_FIRMWARE) {
                err = uath_loadfirmware(sc);
                if (err != DDI_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                            "could not read firmware %s, err %d\n",
                            "uath-ar5523", err);
                        goto fail3;
                }

                uath_close_pipes(sc);
                usb_client_detach(sc->sc_dev, sc->sc_udev);

                err = usb_reset_device(devinfo, USB_RESET_LVL_REATTACH);
                if (err != USB_SUCCESS) {
                        UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                            "could not re-attach, err %d\n", err);
                        goto fail1;
                }
                return (DDI_SUCCESS);
        }

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_attach(): "
            "firmware download and re-attach successfully\n");

        /*
         * Only post-firmware devices here.
         */
        mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&sc->sc_rxlock_cmd, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&sc->sc_txlock_cmd, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&sc->sc_rxlock_data, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&sc->sc_txlock_data, NULL, MUTEX_DRIVER, NULL);

        /*
         * Allocate xfers for firmware commands.
         */
        err = uath_alloc_cmd_list(sc, sc->sc_cmd, UATH_CMD_LIST_COUNT,
            UATH_MAX_CMDSZ);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "could not allocate Tx command list\n");
                goto fail4;
        }

        err = uath_init_cmd_list(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "could not init RX command list\n");
                goto fail5;
        }

        /*
         * We're now ready to send+receive firmware commands.
         */
        err = uath_host_available(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "could not initialize adapter\n");
                goto fail5;
        }

        err = uath_get_devcap(sc);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "could not get device capabilities\n");
                goto fail5;
        }

        err = uath_get_devstatus(sc, ic->ic_macaddr);
        if (err != UATH_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "could not get dev status\n");
                goto fail5;
        }

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_attach(): "
            "MAC address is: %x:%x:%x:%x:%x:%x\n",
            ic->ic_macaddr[0], ic->ic_macaddr[1], ic->ic_macaddr[2],
            ic->ic_macaddr[3], ic->ic_macaddr[4], ic->ic_macaddr[5]);

        ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
        ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
        ic->ic_state = IEEE80211_S_INIT;

        ic->ic_maxrssi = 40;

        ic->ic_xmit = uath_send;

        /* set device capabilities */
        ic->ic_caps =
            IEEE80211_C_TXPMGT |        /* tx power management */
            IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
            IEEE80211_C_SHSLOT;         /* short slot time supported */

        ic->ic_caps |= IEEE80211_C_WPA;  /* Support WPA/WPA2 */

        /* set supported .11b and .11g rates */
        ic->ic_sup_rates[IEEE80211_MODE_11B] = uath_rateset_11b;
        ic->ic_sup_rates[IEEE80211_MODE_11G] = uath_rateset_11g;

        /* set supported .11b and .11g channels (1 through 11) */
        for (i = 1; i <= 11; i++) {
                ic->ic_sup_channels[i].ich_freq =
                    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
                ic->ic_sup_channels[i].ich_flags =
                    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
                    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
        }

        ieee80211_attach(ic);

        /* register WPA door */
        ieee80211_register_door(ic, ddi_driver_name(devinfo),
            ddi_get_instance(devinfo));

        /* override state transition machine */
        sc->sc_newstate = ic->ic_newstate;
        ic->ic_newstate = uath_newstate;
        ieee80211_media_init(ic);
        ic->ic_def_txkey = 0;

        sc->sc_flags = 0;

        /*
         * Provide initial settings for the WiFi plugin; whenever this
         * information changes, we need to call mac_plugindata_update()
         */
        wd.wd_opmode = ic->ic_opmode;
        wd.wd_secalloc = WIFI_SEC_NONE;
        IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);

        if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
                UATH_DEBUG(UATH_DBG_ERR, "uath_attach(): "
                    "MAC version mismatch\n");
                goto fail5;
        }

        macp->m_type_ident      = MAC_PLUGIN_IDENT_WIFI;
        macp->m_driver          = sc;
        macp->m_dip             = devinfo;
        macp->m_src_addr        = ic->ic_macaddr;
        macp->m_callbacks       = &uath_m_callbacks;
        macp->m_min_sdu         = 0;
        macp->m_max_sdu         = IEEE80211_MTU;
        macp->m_pdata           = &wd;
        macp->m_pdata_size      = sizeof (wd);

        err = mac_register(macp, &ic->ic_mach);
        mac_free(macp);
        if (err != 0) {
                UATH_DEBUG(UATH_DBG_ERR, "uath_attach(): "
                    "mac_register() error %x\n", err);
                goto fail5;
        };

        err = usb_register_hotplug_cbs(devinfo,
            uath_disconnect, uath_reconnect);
        if (err != USB_SUCCESS) {
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "failed to register events\n");
                goto fail6;
        }

        /*
         * Create minor node of type DDI_NT_NET_WIFI
         */
        (void) snprintf(strbuf, sizeof (strbuf), "%s%d",
            "uath", instance);
        err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
            instance + 1, DDI_NT_NET_WIFI, 0);
        if (err != DDI_SUCCESS)
                UATH_DEBUG(UATH_DBG_ERR, "uath: uath_attach(): "
                    "ddi_create_minor_node() failed\n");

        /*
         * Notify link is down now
         */
        mac_link_update(ic->ic_mach, LINK_STATE_DOWN);

        UATH_DEBUG(UATH_DBG_MSG, "uath: uath_attach(): "
            "attach success\n");
        return (DDI_SUCCESS);

fail6:
        (void) mac_unregister(ic->ic_mach);
fail5:
        uath_free_cmd_list(sc->sc_cmd, UATH_CMD_LIST_COUNT);
fail4:
        mutex_destroy(&sc->sc_genlock);
        mutex_destroy(&sc->sc_rxlock_cmd);
        mutex_destroy(&sc->sc_rxlock_data);
        mutex_destroy(&sc->sc_txlock_cmd);
        mutex_destroy(&sc->sc_txlock_data);
fail3:
        uath_close_pipes(sc);
fail2:
        usb_client_detach(sc->sc_dev, sc->sc_udev);
fail1:
        ddi_soft_state_free(uath_soft_state_p, ddi_get_instance(devinfo));
        return (DDI_FAILURE);
}

static int
uath_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
{
        struct uath_softc *sc;

        sc = ddi_get_soft_state(uath_soft_state_p, ddi_get_instance(devinfo));
        ASSERT(sc != NULL);

        switch (cmd) {
        case DDI_DETACH:
                break;
        case DDI_SUSPEND:
                if (UATH_IS_RUNNING(sc)) {
                        ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
                        uath_stop(sc);
                }
                UATH_LOCK(sc);
                sc->sc_flags &= ~UATH_FLAG_RUNNING;
                sc->sc_flags |= UATH_FLAG_SUSPEND;
                UATH_UNLOCK(sc);
                return (DDI_SUCCESS);
        default:
                return (DDI_FAILURE);
        }

        if (sc->dev_flags & UATH_FLAG_PRE_FIRMWARE) {
                ddi_soft_state_free(uath_soft_state_p,
                    ddi_get_instance(devinfo));
                return (DDI_SUCCESS);
        }

        if (!UATH_IS_DISCONNECT(sc) && UATH_IS_RUNNING(sc))
                uath_stop(sc);

        uath_free_cmd_list(sc->sc_cmd, UATH_CMD_LIST_COUNT);

        if (mac_disable(sc->sc_ic.ic_mach) != 0)
                return (DDI_FAILURE);

        /*
         * Unregister from the MAC layer subsystem
         */
        if (mac_unregister(sc->sc_ic.ic_mach) != 0)
                return (DDI_FAILURE);

        /*
         * detach ieee80211 layer
         */
        ieee80211_detach(&sc->sc_ic);

        /* close Tx/Rx pipes */
        uath_close_pipes(sc);
        usb_unregister_hotplug_cbs(devinfo);

        mutex_destroy(&sc->sc_genlock);
        mutex_destroy(&sc->sc_rxlock_cmd);
        mutex_destroy(&sc->sc_rxlock_data);
        mutex_destroy(&sc->sc_txlock_cmd);
        mutex_destroy(&sc->sc_txlock_data);

        /* pipes will be close in uath_stop() */
        usb_client_detach(devinfo, sc->sc_udev);
        sc->sc_udev = NULL;

        ddi_remove_minor_node(devinfo, NULL);
        ddi_soft_state_free(uath_soft_state_p, ddi_get_instance(devinfo));

        return (DDI_SUCCESS);
}

int
_info(struct modinfo *modinfop)
{
        return (mod_info(&modlinkage, modinfop));
}

int
_init(void)
{
        int status;

        status = ddi_soft_state_init(&uath_soft_state_p,
            sizeof (struct uath_softc), 1);
        if (status != 0)
                return (status);

        mac_init_ops(&uath_dev_ops, "uath");
        status = mod_install(&modlinkage);
        if (status != 0) {
                mac_fini_ops(&uath_dev_ops);
                ddi_soft_state_fini(&uath_soft_state_p);
        }
        return (status);
}

int
_fini(void)
{
        int status;

        status = mod_remove(&modlinkage);
        if (status == 0) {
                mac_fini_ops(&uath_dev_ops);
                ddi_soft_state_fini(&uath_soft_state_p);
        }
        return (status);
}