/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

/*
 * Copyright (c) 2003, 2004
 *      Daan Vreeken <Danovitsch@Vitsch.net>.  All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in the
 *    documentation and/or other materials provided with the distribution.
 * 3. All advertising materials mentioning features or use of this software
 *    must display the following acknowledgement:
 *      This product includes software developed by Daan Vreeken.
 * 4. Neither the name of the author nor the names of any co-contributors
 *    may be used to endorse or promote products derived from this software
 *    without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY Daan Vreeken AND CONTRIBUTORS ``AS IS'' AND
 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
 * ARE DISCLAIMED.  IN NO EVENT SHALL Daan Vreeken OR THE VOICES IN HIS HEAD
 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
 * THE POSSIBILITY OF SUCH DAMAGE.
 */

/*
 * Atmel AT76c503 / AT76c503a / AT76c505 / AT76c505a  USB WLAN driver
 *
 * Originally written by Daan Vreeken <Danovitsch @ Vitsch . net>
 *  http://vitsch.net/bsd/atuwi
 *
 * Contributed to by :
 *  Chris Whitehouse, Alistair Phillips, Peter Pilka, Martijn van Buul,
 *  Suihong Liang, Arjan van Leeuwen, Stuart Walsh
 *
 * Ported to OpenBSD by Theo de Raadt and David Gwynne.
 */

#include <sys/strsubr.h>
#include <sys/strsun.h>
#include <sys/mac_provider.h>
#include <sys/mac_wifi.h>
#include <sys/net80211.h>
#define USBDRV_MAJOR_VER        2
#define USBDRV_MINOR_VER        0
#include <sys/usb/usba.h>
#include <sys/usb/usba/usba_types.h>

#include "fw/atmel_rfmd.hex"
#include "fw/atmel_rfmd2958.hex"
#include "fw/atmel_rfmd2958-smc.hex"
#include "fw/atmel_intersil.hex"
#include "fw/atmel_at76c505_rfmd.hex"
#include "fw/atmel_at76c503_rfmd_acc.hex"
#include "fw/atmel_at76c503_i3863.hex"
#include "atu.h"

static void *atu_soft_state_p;
static mac_callbacks_t  atu_m_callbacks;
static const struct ieee80211_rateset atu_rateset = {4, {2, 4, 11, 22}};

static int
atu_usb_request(struct atu_softc *sc, uint8_t type,
    uint8_t request, uint16_t value, uint16_t index, uint16_t length,
    uint8_t *data)
{
        usb_ctrl_setup_t        req;
        usb_cb_flags_t          cf;
        usb_cr_t                cr;
        mblk_t                  *mp = NULL;
        int                     uret = USB_SUCCESS;

        bzero(&req, sizeof (req));
        req.bmRequestType = type;
        req.bRequest = request;
        req.wValue = value;
        req.wIndex = index;
        req.wLength = length;
        req.attrs = USB_ATTRS_NONE;

        if (type & USB_DEV_REQ_DEV_TO_HOST) {
                req.attrs = USB_ATTRS_AUTOCLEARING;
                uret = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph,
                    &req, &mp, &cr, &cf, 0);
                if (mp == NULL)
                        return (EIO);

                if (uret == USB_SUCCESS)
                        bcopy(mp->b_rptr, data, length);
        } else {
                if ((mp = allocb(length, BPRI_HI)) == NULL)
                        return (ENOMEM);

                bcopy(data, mp->b_wptr, length);
                mp->b_wptr += length;
                uret = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph,
                    &req, &mp, &cr, &cf, 0);
        }

        if (mp)
                freemsg(mp);

        return (uret == USB_SUCCESS ? 0 : EIO);
}

static int
atu_get_mib(struct atu_softc *sc, uint8_t type, uint8_t size,
    uint8_t index, uint8_t *buf)
{
        return atu_usb_request(sc, ATU_VENDOR_IF_IN, 0x033,
            type << 8, index, size, buf);
}

static int
atu_get_cmd_status(struct atu_softc *sc, uint8_t cmd, uint8_t *status)
{
        /*
         * all other drivers (including Windoze) request 40 bytes of status
         * and get a short-xfer of just 6 bytes. we can save 34 bytes of
         * buffer if we just request those 6 bytes in the first place :)
         */
        return atu_usb_request(sc, ATU_VENDOR_IF_IN, 0x22, cmd,
            0x0000, 6, status);
}

static uint8_t
atu_get_dfu_state(struct atu_softc *sc)
{
        uint8_t state;

        if (atu_usb_request(sc, DFU_GETSTATE, 0, 0, 1, &state))
                return (DFUState_DFUError);
        return (state);
}

static int
atu_get_opmode(struct atu_softc *sc, uint8_t *mode)
{
        return atu_usb_request(sc, ATU_VENDOR_IF_IN, 0x33, 0x0001,
            0x0000, 1, mode);
}

static int
atu_get_config(struct atu_softc *sc)
{
        struct ieee80211com     *ic = &sc->sc_ic;
        struct atu_rfmd_conf    rfmd_conf;
        struct atu_intersil_conf intersil_conf;
        int                     err;

        switch (sc->sc_radio) {
        case RadioRFMD:
        case RadioRFMD2958:
        case RadioRFMD2958_SMC:
        case AT76C503_RFMD_ACC:
        case AT76C505_RFMD:
                err = atu_usb_request(sc, ATU_VENDOR_IF_IN, 0x33, 0x0a02,
                    0x0000, sizeof (rfmd_conf), (uint8_t *)&rfmd_conf);
                if (err) {
                        cmn_err(CE_WARN, "%s: get RFMD config failed\n",
                            sc->sc_name);
                        return (err);
                }
                bcopy(rfmd_conf.MACAddr, ic->ic_macaddr, IEEE80211_ADDR_LEN);
                break;

        case RadioIntersil:
        case AT76C503_i3863:
                err = atu_usb_request(sc, ATU_VENDOR_IF_IN, 0x33, 0x0902,
                    0x0000, sizeof (intersil_conf), (uint8_t *)&intersil_conf);
                if (err) {
                        cmn_err(CE_WARN, "%s: get Intersil config failed\n",
                            sc->sc_name);
                        return (err);
                }
                bcopy(intersil_conf.MACAddr, ic->ic_macaddr,
                    IEEE80211_ADDR_LEN);
                break;
        }

        return (0);
}

static int
atu_wait_completion(struct atu_softc *sc, uint8_t cmd, uint8_t *status)
{
        uint8_t statusreq[6];
        int     idle_count = 0, err;

        while ((err = atu_get_cmd_status(sc, cmd, statusreq)) == 0) {

                if ((statusreq[5] != STATUS_IN_PROGRESS) &&
                    (statusreq[5] != STATUS_IDLE)) {
                        if (status != NULL)
                                *status = statusreq[5];
                        return (0);
                } else if (idle_count++ > 60) {
                        cmn_err(CE_WARN, "%s: command (0x%02x) timeout\n",
                            sc->sc_name, cmd);
                        return (ETIME);
                }

                drv_usecwait(10 * 1000);
        }

        return (err);
}

static int
atu_send_command(struct atu_softc *sc, uint8_t *command, int size)
{
        return atu_usb_request(sc, ATU_VENDOR_DEV_OUT, 0x0e, 0x0000,
            0x0000, size, command);
}

static int
atu_send_mib(struct atu_softc *sc, uint8_t type, uint8_t size,
    uint8_t index, void *data)
{
        struct atu_cmd_set_mib  request;
        int err;

        bzero(&request, sizeof (request));
        request.AtCmd = CMD_SET_MIB;
        request.AtSize = size + 4;
        request.MIBType = type;
        request.MIBSize = size;
        request.MIBIndex = index;
        request.MIBReserved = 0;

        /*
         * For 1 and 2 byte requests we assume a direct value,
         * everything bigger than 2 bytes we assume a pointer to the data
         */
        switch (size) {
        case 0:
                break;
        case 1:
                request.data[0] = (long)data & 0x000000ff;
                break;
        case 2:
                request.data[0] = (long)data & 0x000000ff;
                request.data[1] = (long)data >> 8;
                break;
        default:
                bcopy(data, request.data, size);
                break;
        }

        err = atu_usb_request(sc, ATU_VENDOR_DEV_OUT, 0x0e, 0x0000,
            0x0000, size+8, (uint8_t *)&request);
        if (err)
                return (err);

        return (atu_wait_completion(sc, CMD_SET_MIB, NULL));
}

static int
atu_switch_radio(struct atu_softc *sc, boolean_t on)
{
        struct atu_cmd  radio;
        boolean_t       ostate;
        int             err;

        /* Intersil doesn't seem to support radio switch */
        if (sc->sc_radio == RadioIntersil)
                return (0);

        ostate = ATU_RADIO_ON(sc) ? B_TRUE : B_FALSE;
        if (on != ostate) {
                bzero(&radio, sizeof (radio));
                radio.Cmd = on ? CMD_RADIO_ON : CMD_RADIO_OFF;

                err = atu_send_command(sc, (uint8_t *)&radio,
                    sizeof (radio));
                if (err)
                        return (err);

                err = atu_wait_completion(sc, radio.Cmd, NULL);
                if (err)
                        return (err);

                if (on)
                        sc->sc_flags |= ATU_FLAG_RADIO_ON;
                else
                        sc->sc_flags &= ~ATU_FLAG_RADIO_ON;
        }

        return (0);
}

static int
atu_config(struct atu_softc *sc)
{
        struct ieee80211com             *ic = &sc->sc_ic;
        struct ieee80211_key            *k;
        struct atu_cmd_card_config      cmd;
        uint8_t                         rates[4] = {0x82, 0x84, 0x8B, 0x96};
        int                             err, i;

        err = atu_send_mib(sc, MIB_MAC_ADDR_STA, ic->ic_macaddr);
        if (err) {
                cmn_err(CE_WARN, "%s: setting MAC address failed\n",
                    sc->sc_name);
                return (err);
        }

        bzero(&cmd, sizeof (cmd));
        cmd.Cmd = CMD_STARTUP;
        cmd.Reserved = 0;
        cmd.Size = sizeof (cmd) - 4;
        cmd.Channel = ATU_DEF_CHAN;
        cmd.ShortRetryLimit = 7;
        cmd.RTS_Threshold = 2347;
        cmd.FragThreshold = 2346;
        cmd.PromiscuousMode = 1;
        cmd.AutoRateFallback = 1;
        bcopy(rates, cmd.BasicRateSet, 4);

        if (ic->ic_flags & IEEE80211_F_PRIVACY) {
                k = ic->ic_nw_keys + ic->ic_def_txkey;
                switch (k->wk_keylen) {
                case 5:
                        cmd.EncryptionType = ATU_ENC_WEP40;
                        break;
                case 13:
                        cmd.EncryptionType = ATU_ENC_WEP104;
                        break;
                default:
                        cmn_err(CE_WARN, "%s: key invalid (%d bytes)\n",
                            sc->sc_name, k->wk_keylen);
                        goto nowep;
                }
                cmd.PrivacyInvoked = 1;
                cmd.ExcludeUnencrypted = 1;
                cmd.WEP_DefaultKeyID = ic->ic_def_txkey;
                for (i = 0; i < IEEE80211_WEP_NKID; i++) {
                        k = ic->ic_nw_keys + i;
                        if (k->wk_keylen == 0)
                                continue;
                        bcopy(k->wk_key, cmd.WEP_DefaultKey + i, k->wk_keylen);
                }
        } else {
nowep:
                cmd.EncryptionType = ATU_ENC_NONE;
        }

        bcopy(ic->ic_des_essid, cmd.SSID, ic->ic_des_esslen);
        cmd.SSID_Len = ic->ic_des_esslen;
        cmd.BeaconPeriod = 100;

        err = atu_send_command(sc, (uint8_t *)&cmd, sizeof (cmd));
        if (err)
                return (err);
        err = atu_wait_completion(sc, CMD_STARTUP, NULL);
        if (err)
                return (err);

        err = atu_switch_radio(sc, B_TRUE);
        if (err)
                return (err);

        err = atu_send_mib(sc, MIB_MAC_MGMT_POWER_MODE,
            (void *)ATU_POWER_ACTIVE);
        if (err)
                return (err);

        return (0);
}

static int
atu_start_scan(struct atu_softc *sc)
{
        struct ieee80211com     *ic = &sc->sc_ic;
        struct atu_cmd_do_scan  scan;
        int                     err;

        if (!ATU_RUNNING(sc))
                return (EIO);

        bzero(&scan, sizeof (scan));
        scan.Cmd = CMD_START_SCAN;
        scan.Reserved = 0;
        scan.Size = sizeof (scan) - 4;
        (void) memset(scan.BSSID, 0xff, sizeof (scan.BSSID));
        bcopy(ic->ic_des_essid, scan.SSID, ic->ic_des_esslen);
        scan.SSID_Len = ic->ic_des_esslen;
        scan.ScanType = ATU_SCAN_ACTIVE;
        scan.Channel = ieee80211_chan2ieee(ic, ic->ic_curchan);
        scan.ProbeDelay = 0;
        scan.MinChannelTime = 20;
        scan.MaxChannelTime = 40;
        scan.InternationalScan = 0;

        err = atu_send_command(sc, (uint8_t *)&scan, sizeof (scan));
        if (err) {
                cmn_err(CE_WARN, "%s: SCAN command failed\n",
                    sc->sc_name);
                return (err);
        }

        err = atu_wait_completion(sc, CMD_START_SCAN, NULL);
        if (err) {
                cmn_err(CE_WARN, "%s: SCAN completion failed\n",
                    sc->sc_name);
                return (err);
        }

        return (0);
}

static int
atu_join(struct atu_softc *sc, struct ieee80211_node *node)
{
        struct atu_cmd_join     join;
        uint8_t                 status;
        int                     err;

        bzero(&join, sizeof (join));
        join.Cmd = CMD_JOIN;
        join.Reserved = 0x00;
        join.Size = sizeof (join) - 4;
        bcopy(node->in_bssid, join.bssid, IEEE80211_ADDR_LEN);
        bcopy(node->in_essid, join.essid, node->in_esslen);
        join.essid_size = node->in_esslen;

        if (node->in_capinfo & IEEE80211_CAPINFO_IBSS)
                join.bss_type = ATU_MODE_IBSS;
        else
                join.bss_type = ATU_MODE_STA;

        join.channel = ieee80211_chan2ieee(&sc->sc_ic, node->in_chan);
        join.timeout = ATU_JOIN_TIMEOUT;
        join.reserved = 0x00;

        err = atu_send_command(sc, (uint8_t *)&join, sizeof (join));
        if (err) {
                cmn_err(CE_WARN, "%s: JOIN command failed\n",
                    sc->sc_name);
                return (err);
        }
        err = atu_wait_completion(sc, CMD_JOIN, &status);
        if (err)
                return (err);

        if (status != STATUS_COMPLETE) {
                cmn_err(CE_WARN, "%s: incorrect JOIN state (0x%02x)\n",
                    sc->sc_name, status);
                return (EIO);
        }

        return (0);
}

static int
atu_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
{
        struct atu_softc        *sc = (struct atu_softc *)ic;
        enum ieee80211_state    ostate = ic->ic_state;
        int                     err = 0;

        ATU_LOCK(sc);

        if (sc->sc_scan_timer != 0) {
                ATU_UNLOCK(sc);
                (void) untimeout(sc->sc_scan_timer);
                ATU_LOCK(sc);
                sc->sc_scan_timer = 0;
        }
        ostate = ic->ic_state;

        switch (nstate) {
        case IEEE80211_S_SCAN:
                switch (ostate) {
                        case IEEE80211_S_SCAN:
                        case IEEE80211_S_AUTH:
                        case IEEE80211_S_ASSOC:
                        case IEEE80211_S_RUN:
                                ATU_UNLOCK(sc);
                                sc->sc_newstate(ic, nstate, arg);
                                ATU_LOCK(sc);
                                if ((err = atu_start_scan(sc)) != 0) {
                                        ATU_UNLOCK(sc);
                                        ieee80211_cancel_scan(ic);
                                        return (err);
                                }
                                sc->sc_scan_timer = timeout(
                                    (void (*) (void*))ieee80211_next_scan,
                                    (void *)&sc->sc_ic, 0);

                                ATU_UNLOCK(sc);
                                return (err);
                        default:
                                break;
                }
                break;

        case IEEE80211_S_AUTH:
                switch (ostate) {
                case IEEE80211_S_INIT:
                case IEEE80211_S_SCAN:
                        err = atu_join(sc, ic->ic_bss);
                        if (err) {
                                ATU_UNLOCK(sc);
                                return (err);
                        }
                        break;
                default:
                        break;
                }
        default:
                break;
        }

        ATU_UNLOCK(sc);
        err = sc->sc_newstate(ic, nstate, arg);

        return (err);
}

static int
atu_open_pipes(struct atu_softc *sc)
{
        usb_ep_data_t           *ep;
        usb_pipe_policy_t       policy = {0};
        int                     uret;

        ep = usb_lookup_ep_data(sc->sc_dip, sc->sc_udev, 0, 0, 0,
            USB_EP_ATTR_BULK, USB_EP_DIR_OUT);
        policy.pp_max_async_reqs = ATU_TX_LIST_CNT;

        uret = usb_pipe_open(sc->sc_dip, &ep->ep_descr, &policy,
            USB_FLAGS_SLEEP, &sc->sc_tx_pipe);
        if (uret != USB_SUCCESS)
                goto fail;

        ep = usb_lookup_ep_data(sc->sc_dip, sc->sc_udev, 0, 0, 0,
            USB_EP_ATTR_BULK, USB_EP_DIR_IN);
        policy.pp_max_async_reqs = ATU_RX_LIST_CNT + 32;

        uret = usb_pipe_open(sc->sc_dip, &ep->ep_descr, &policy,
            USB_FLAGS_SLEEP, &sc->sc_rx_pipe);
        if (uret != USB_SUCCESS)
                goto fail;

        return (0);
fail:
        if (sc->sc_rx_pipe != NULL) {
                usb_pipe_close(sc->sc_dip, sc->sc_rx_pipe,
                    USB_FLAGS_SLEEP, NULL, 0);
                sc->sc_rx_pipe = NULL;
        }

        if (sc->sc_tx_pipe != NULL) {
                usb_pipe_close(sc->sc_dip, sc->sc_tx_pipe,
                    USB_FLAGS_SLEEP, NULL, 0);
                sc->sc_tx_pipe = NULL;
        }

        return (EIO);
}

static void
atu_close_pipes(struct atu_softc *sc)
{
        usb_flags_t flags = USB_FLAGS_SLEEP;

        if (sc->sc_rx_pipe != NULL) {
                usb_pipe_reset(sc->sc_dip, sc->sc_rx_pipe, flags, NULL, 0);
                usb_pipe_close(sc->sc_dip, sc->sc_rx_pipe, flags, NULL, 0);
                sc->sc_rx_pipe = NULL;
        }

        if (sc->sc_tx_pipe != NULL) {
                usb_pipe_reset(sc->sc_dip, sc->sc_tx_pipe, flags, NULL, 0);
                usb_pipe_close(sc->sc_dip, sc->sc_tx_pipe, flags, NULL, 0);
                sc->sc_tx_pipe = NULL;
        }
}

static int atu_rx_trigger(struct atu_softc *sc);

/*ARGSUSED*/
static void
atu_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
{
        struct atu_softc *sc = (struct atu_softc *)req->bulk_client_private;
        struct ieee80211com     *ic = &sc->sc_ic;
        struct ieee80211_node   *ni;
        struct atu_rx_hdr       *h;
        struct ieee80211_frame  *wh;
        mblk_t                  *mp = req->bulk_data;
        int                     len, pktlen;

        req->bulk_data = NULL;
        if (req->bulk_completion_reason != USB_CR_OK) {
                sc->sc_rx_err++;
                goto fail;
        }

        len = msgdsize(mp);
        if (len < ATU_RX_HDRLEN + ATU_MIN_FRAMELEN) {
                cmn_err(CE_CONT, "%s: fragment (%d bytes)\n",
                    sc->sc_name, len);
                sc->sc_rx_err++;
                goto fail;
        }

        h = (struct atu_rx_hdr *)mp->b_rptr;
        pktlen = h->length - 4;
        if (pktlen + ATU_RX_HDRLEN + 4 != len) {
                cmn_err(CE_CONT, "%s: jumbo (%d bytes -> %d bytes)\n",
                    sc->sc_name, len, pktlen);
                sc->sc_rx_err++;
                goto fail;
        }

        mp->b_rptr += ATU_RX_HDRLEN;
        mp->b_wptr = mp->b_rptr + pktlen;
        wh = (struct ieee80211_frame *)mp->b_rptr;

        if (wh->i_fc[1] & IEEE80211_FC1_WEP)
                wh->i_fc[1] &= ~IEEE80211_FC1_WEP;

        ni = ieee80211_find_rxnode(ic, wh);
        (void) ieee80211_input(ic, mp, ni, h->rssi, h->rx_time);
        ieee80211_free_node(ni);
done:
        usb_free_bulk_req(req);

        mutex_enter(&sc->sc_rxlock);
        sc->rx_queued--;
        mutex_exit(&sc->sc_rxlock);

        if (ATU_RUNNING(sc))
                (void) atu_rx_trigger(sc);
        return;
fail:
        freemsg(mp);
        goto done;
}

/*ARGSUSED*/
static void
atu_txeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
{
        struct atu_softc *sc = (struct atu_softc *)req->bulk_client_private;
        struct ieee80211com     *ic = &sc->sc_ic;

        if (req->bulk_completion_reason != USB_CR_OK)
                ic->ic_stats.is_tx_failed++;
        usb_free_bulk_req(req);

        mutex_enter(&sc->sc_txlock);
        sc->tx_queued--;

        if (sc->sc_need_sched) {
                sc->sc_need_sched = 0;
                mac_tx_update(ic->ic_mach);
        }

        mutex_exit(&sc->sc_txlock);
}

static int
atu_rx_trigger(struct atu_softc *sc)
{
        usb_bulk_req_t *req;
        int uret;

        req = usb_alloc_bulk_req(sc->sc_dip, ATU_RX_BUFSZ, USB_FLAGS_SLEEP);
        if (req == NULL)
                return (ENOMEM);

        req->bulk_len           = ATU_RX_BUFSZ;
        req->bulk_client_private = (usb_opaque_t)sc;
        req->bulk_timeout       = 0;
        req->bulk_attributes = USB_ATTRS_SHORT_XFER_OK | USB_ATTRS_AUTOCLEARING;
        req->bulk_cb            = atu_rxeof;
        req->bulk_exc_cb        = atu_rxeof;
        req->bulk_completion_reason = 0;
        req->bulk_cb_flags      = 0;

        uret = usb_pipe_bulk_xfer(sc->sc_rx_pipe, req, 0);
        if (uret != USB_SUCCESS) {
                usb_free_bulk_req(req);
                return (EIO);
        }

        mutex_enter(&sc->sc_rxlock);
        sc->rx_queued++;
        mutex_exit(&sc->sc_rxlock);

        return (0);
}

static int
atu_tx_trigger(struct atu_softc *sc, mblk_t *mp)
{
        usb_bulk_req_t *req;
        int uret;

        req = usb_alloc_bulk_req(sc->sc_dip, 0, USB_FLAGS_SLEEP);
        if (req == NULL)
                return (EIO);

        req->bulk_len           = msgdsize(mp);
        req->bulk_data          = mp;
        req->bulk_client_private = (usb_opaque_t)sc;
        req->bulk_timeout       = 10;
        req->bulk_attributes    = USB_ATTRS_AUTOCLEARING;
        req->bulk_cb            = atu_txeof;
        req->bulk_exc_cb        = atu_txeof;
        req->bulk_completion_reason = 0;
        req->bulk_cb_flags      = 0;

        uret = usb_pipe_bulk_xfer(sc->sc_tx_pipe, req, 0);
        if (uret != USB_SUCCESS) {
                req->bulk_data = NULL;
                usb_free_bulk_req(req);
                return (EIO);
        }

        mutex_enter(&sc->sc_txlock);
        sc->tx_queued++;
        mutex_exit(&sc->sc_txlock);

        return (0);
}

static int
atu_init_rx_queue(struct atu_softc *sc)
{
        int err, i;

        mutex_enter(&sc->sc_rxlock);
        sc->rx_queued = 0;
        mutex_exit(&sc->sc_rxlock);

        for (i = 0; i < ATU_RX_LIST_CNT; i++) {
                err = atu_rx_trigger(sc);
                if (err)
                        return (err);
        }

        return (0);
}

static void
atu_init_tx_queue(struct atu_softc *sc)
{
        mutex_enter(&sc->sc_txlock);
        sc->tx_queued = 0;
        mutex_exit(&sc->sc_txlock);
}

static int
atu_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
{
        struct atu_softc        *sc = (struct atu_softc *)ic;
        struct ieee80211_node   *ni = NULL;
        struct atu_tx_hdr       *desc;
        struct ieee80211_frame  *wh;
        mblk_t                  *m;
        int pktlen = msgdsize(mp), err = 0;

        mutex_enter(&sc->sc_txlock);
        if (sc->tx_queued > ATU_TX_LIST_CNT) {
                sc->sc_tx_nobuf++;
                mutex_exit(&sc->sc_txlock);
                err = ENOMEM;
                goto fail;
        }
        mutex_exit(&sc->sc_txlock);

        m = allocb(ATU_TX_BUFSZ, BPRI_MED);
        if (m == NULL) {
                sc->sc_tx_nobuf++;
                err = ENOMEM;
                goto fail;
        }
        /* reserve tx header space */
        m->b_rptr += ATU_TX_HDRLEN;
        m->b_wptr += ATU_TX_HDRLEN;

        /* copy and (implicitly) free old data */
        mcopymsg(mp, m->b_wptr);
        m->b_wptr += pktlen;
        wh = (struct ieee80211_frame *)m->b_rptr;

        ni = ieee80211_find_txnode(ic, wh->i_addr1);
        if (ni == NULL) {
                ic->ic_stats.is_tx_failed++;
                freemsg(m);
                err = ENXIO;
                goto fail;
        }

        if (type == IEEE80211_FC0_TYPE_DATA)
                (void) ieee80211_encap(ic, m, ni);

        /* full WEP in device, prune WEP fields (IV, KID) */
        if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
                (void) memmove(m->b_rptr + IEEE80211_WEP_IVLEN
                    + IEEE80211_WEP_KIDLEN, m->b_rptr,
                    sizeof (struct ieee80211_frame));
                m->b_rptr += IEEE80211_WEP_IVLEN + IEEE80211_WEP_KIDLEN;
        }
        pktlen = msgdsize(m);
        m->b_rptr -= ATU_TX_HDRLEN;

        /* setup tx header */
        desc = (struct atu_tx_hdr *)m->b_rptr;
        bzero(desc, ATU_TX_HDRLEN);
        desc->length = (uint16_t)pktlen;
        desc->tx_rate = ATU_DEF_TX_RATE;

        err = atu_tx_trigger(sc, m);
        if (!err) {
                ic->ic_stats.is_tx_frags++;
                ic->ic_stats.is_tx_bytes += pktlen;
        } else {
                ic->ic_stats.is_tx_failed++;
                freemsg(m);
        }
fail:
        if (ni != NULL)
                ieee80211_free_node(ni);

        return (err);
}

static int
atu_stop(struct atu_softc *sc)
{
        sc->sc_flags &= ~ATU_FLAG_RUNNING;
        atu_close_pipes(sc);

        return (atu_switch_radio(sc, B_FALSE));
}

static int
atu_init(struct atu_softc *sc)
{
        int err;

        err = atu_stop(sc);
        if (err)
                return (err);

        err = atu_open_pipes(sc);
        if (err)
                goto fail;

        err = atu_config(sc);
        if (err) {
                cmn_err(CE_WARN, "%s: startup config failed\n",
                    sc->sc_name);
                goto fail;
        }

        atu_init_tx_queue(sc);

        err = atu_init_rx_queue(sc);
        if (err) {
                cmn_err(CE_WARN, "%s: rx queue init failed\n", sc->sc_name);
                goto fail;
        }

        sc->sc_flags |= ATU_FLAG_RUNNING;

        return (0);
fail:
        (void) atu_stop(sc);
        return (err);
}

static void
atu_watchdog(void *arg)
{
        struct atu_softc *sc = arg;
        struct ieee80211com *ic = &sc->sc_ic;

        ieee80211_stop_watchdog(ic);

        ATU_LOCK(sc);
        if (!ATU_RUNNING(sc)) {
                ATU_UNLOCK(sc);
                return;
        }

        ATU_UNLOCK(sc);
        switch (ic->ic_state) {
                case IEEE80211_S_AUTH:
                case IEEE80211_S_ASSOC:
                        if (ic->ic_bss->in_fails > 0)
                                ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
                        else
                                ieee80211_watchdog(ic);
                        break;
        }
}

static int
atu_dfu_stage1(void *arg)
{
        struct atu_softc *sc = arg;
        uint8_t state, *ptr = NULL, status[6];
        int block_size, bytes_left = 0, block = 0, err, i, count = 0;

        /*
         * Uploading firmware is done with the DFU (Device Firmware Upgrade)
         * interface. See "Universal Serial Bus - Device Class Specification
         * for Device Firmware Upgrade" pdf for details of the protocol.
         * Maybe this could be moved to a separate 'firmware driver' once more
         * device drivers need it... For now we'll just do it here.
         *
         * Just for your information, the Atmel's DFU descriptor looks like
         * this:
         *
         * 07           size
         * 21           type
         * 01           capabilities : only firmware download, *need* reset
         *                after download
         * 13 05        detach timeout : max 1299ms between DFU_DETACH and
         *                reset
         * 00 04        max bytes of firmware per transaction : 1024
         */
        for (i = 0; i < sizeof (atu_fw_table) / sizeof (atu_fw_table[0]); i++)
                if (sc->sc_radio == atu_fw_table[i].atur_type) {
                        ptr = atu_fw_table[i].atur_int;
                        bytes_left = atu_fw_table[i].atur_int_size;
                }

        state = atu_get_dfu_state(sc);
        while (block >= 0 && state > 0) {
                switch (state) {
                case DFUState_DnLoadSync:
                        /* get DFU status */
                        err = atu_usb_request(sc, DFU_GETSTATUS, 0, 0, 6,
                            status);
                        if (err) {
                                cmn_err(CE_WARN, "%s: DFU get status failed\n",
                                    sc->sc_name);
                                return (err);
                        }
                        /* success means state => DnLoadIdle */
                        state = DFUState_DnLoadIdle;
                        continue;

                case DFUState_DFUIdle:
                case DFUState_DnLoadIdle:
                        if (bytes_left >= DFU_MaxBlockSize)
                                block_size = DFU_MaxBlockSize;
                        else
                                block_size = bytes_left;

                        err = atu_usb_request(sc, DFU_DNLOAD, block++, 0,
                            block_size, ptr);
                        if (err) {
                                cmn_err(CE_WARN, "%s: DFU download failed\n",
                                    sc->sc_name);
                                return (err);
                        }

                        ptr += block_size;
                        bytes_left -= block_size;
                        if (block_size == 0)
                                block = -1;
                        break;

                case DFUState_DFUError:
                        cmn_err(CE_WARN, "%s: DFU state error\n", sc->sc_name);
                        return (EIO);

                default:
                        drv_usecwait(10*1000);
                        if (++count > 100) {
                                cmn_err(CE_WARN, "%s: DFU timeout\n",
                                    sc->sc_name);
                                return (ETIME);
                        }
                        break;
                }

                state = atu_get_dfu_state(sc);
        }
        if (state != DFUState_ManifestSync)
                cmn_err(CE_WARN, "%s: DFU state (%d) != ManifestSync\n",
                    sc->sc_name, state);

        err = atu_usb_request(sc, DFU_GETSTATUS, 0, 0, 6, status);
        if (err) {
                cmn_err(CE_WARN, "%s: DFU get status failed\n",
                    sc->sc_name);
                return (err);
        }

        err = atu_usb_request(sc, DFU_REMAP, 0, 0, 0, NULL);
        if (err && !(sc->sc_quirk & ATU_QUIRK_NO_REMAP)) {
                cmn_err(CE_WARN, "%s: DFU remap failed\n", sc->sc_name);
                return (err);
        }

        /*
         * after a lot of trying and measuring I found out the device needs
         * about 56 miliseconds after sending the remap command before
         * it's ready to communicate again. So we'll wait just a little bit
         * longer than that to be sure...
         */
        drv_usecwait((56+100)*1000);

        return (0);
}

static int
atu_dfu_stage2(void *arg)
{
        struct atu_softc *sc = arg;
        uint8_t *ptr = NULL;
        int block_size, bytes_left = 0, block = 0, err, i;

        for (i = 0; i < sizeof (atu_fw_table) / sizeof (atu_fw_table[0]); i++)
                if (sc->sc_radio == atu_fw_table[i].atur_type) {
                        ptr = atu_fw_table[i].atur_ext;
                        bytes_left = atu_fw_table[i].atur_ext_size;
                }

        while (bytes_left) {
                if (bytes_left > 1024)
                        block_size = 1024;
                else
                        block_size = bytes_left;

                err = atu_usb_request(sc, ATU_VENDOR_DEV_OUT, 0x0e,
                    0x0802, block, block_size, ptr);
                if (err) {
                        cmn_err(CE_WARN, "%s: stage2 firmware load failed\n",
                            sc->sc_name);
                        return (err);
                }

                ptr += block_size;
                block++;
                bytes_left -= block_size;
        }

        err = atu_usb_request(sc, ATU_VENDOR_DEV_OUT, 0x0e, 0x0802,
            block, 0, NULL);
        if (err) {
                cmn_err(CE_WARN, "%s: zero-length block load failed\n",
                    sc->sc_name);
                return (err);
        }

        /*
         * The SMC2662w V.4 seems to require some time to do its thing with
         * the stage2 firmware... 20 ms isn't enough, but 21 ms works 100
         * times out of 100 tries. We'll wait a bit longer just to be sure
         */
        if (sc->sc_quirk & ATU_QUIRK_FW_DELAY)
                drv_usecwait((21 + 100) * 1000);

        return (0);
}

static int
atu_load_microcode(struct atu_softc *sc, boolean_t attach)
{
        usb_dev_reset_lvl_t     reset;
        uint8_t                 mode, chan;
        int                     err;

        reset = attach ? USB_RESET_LVL_REATTACH : USB_RESET_LVL_DEFAULT;

        err = atu_get_opmode(sc, &mode);
        if (!err) {
                if (mode == ATU_DEV_READY)
                        return (0);
                /*
                 * Opmode of SMC2662 V.4 does not change after stage2
                 * firmware download. If succeeded reading the channel
                 * number, stage2 firmware is already running.
                 */
                if (sc->sc_radio != RadioIntersil &&
                    atu_get_mib(sc, MIB_PHY_CHANNEL, &chan) == 0)
                        return (0);

                if (mode == ATU_DEV_STAGE2)
stage2:
                        return (atu_dfu_stage2(sc));
        }

        err = atu_dfu_stage1(sc);
        if (err)
                return (err);

        if (usb_reset_device(sc->sc_dip, reset) != USB_SUCCESS)
                return (EIO);

        if (attach)
                return (EAGAIN);
        else
                goto stage2;
}

static int
atu_disconnect(dev_info_t *dip)
{
        struct atu_softc *sc;
        struct ieee80211com *ic;

        sc = ddi_get_soft_state(atu_soft_state_p, ddi_get_instance(dip));
        ic = &sc->sc_ic;

        ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
        ieee80211_stop_watchdog(ic);

        ATU_LOCK(sc);
        if (sc->sc_scan_timer != 0) {
                ATU_UNLOCK(sc);
                (void) untimeout(sc->sc_scan_timer);
                ATU_LOCK(sc);
                sc->sc_scan_timer = 0;
        }

        sc->sc_flags &= ~(ATU_FLAG_RUNNING | ATU_FLAG_RADIO_ON);
        atu_close_pipes(sc);

        ATU_UNLOCK(sc);
        return (0);
}

static int
atu_reconnect(dev_info_t *dip)
{
        struct atu_softc *sc;
        int err;

        sc = ddi_get_soft_state(atu_soft_state_p, ddi_get_instance(dip));
        if (usb_check_same_device(sc->sc_dip, NULL, USB_LOG_L2, -1,
            USB_CHK_BASIC, NULL) != USB_SUCCESS)
                return (DDI_FAILURE);

        ATU_LOCK(sc);
        err = atu_load_microcode(sc, B_FALSE);
        if (!err)
                err = atu_init(sc);

        ATU_UNLOCK(sc);
        return (err ? DDI_FAILURE : DDI_SUCCESS);
}

static int
atu_attach(dev_info_t *dip, ddi_attach_cmd_t cmd)
{
        struct atu_softc        *sc;
        struct ieee80211com     *ic;
        mac_register_t          *macp;
        wifi_data_t             wd = {0};
        int                     instance, i, err;

        switch (cmd) {
        case DDI_ATTACH:
                break;
        case DDI_RESUME:
                sc = ddi_get_soft_state(atu_soft_state_p,
                    ddi_get_instance(dip));
                if (usb_check_same_device(sc->sc_dip, NULL, USB_LOG_L2, -1,
                    USB_CHK_BASIC, NULL) != USB_SUCCESS)
                        return (DDI_SUCCESS);

                if (atu_load_microcode(sc, B_FALSE) == 0)
                        (void) atu_init(sc);

                return (DDI_SUCCESS);
        default:
                return (DDI_FAILURE);
        }

        instance = ddi_get_instance(dip);
        if (ddi_soft_state_zalloc(atu_soft_state_p, instance) != DDI_SUCCESS)
                return (DDI_FAILURE);

        sc = ddi_get_soft_state(atu_soft_state_p, instance);
        ic = &sc->sc_ic;
        sc->sc_dip = dip;

        (void) snprintf(sc->sc_name, sizeof (sc->sc_name), "%s%d",
            "atu", instance);

        err = usb_client_attach(dip, USBDRV_VERSION, 0);
        if (err != USB_SUCCESS)
                goto fail1;

        err = usb_get_dev_data(dip, &sc->sc_udev, USB_PARSE_LVL_ALL, 0);
        if (err != USB_SUCCESS) {
                sc->sc_udev = NULL;
                goto fail2;
        }

        for (i = 0; i < sizeof (atu_dev_table)/sizeof (atu_dev_table[0]); i++) {
                struct atu_dev_type *t = &atu_dev_table[i];
                if (sc->sc_udev->dev_descr->idVendor == t->atu_vid &&
                    sc->sc_udev->dev_descr->idProduct == t->atu_pid) {
                        sc->sc_radio = t->atu_radio;
                        sc->sc_quirk = t->atu_quirk;
                }
        }

        err = atu_load_microcode(sc, B_TRUE);
        if (err == EAGAIN) {
                sc->sc_flags |= ATU_FLAG_REATTACH;      /* reattaching */
                return (DDI_SUCCESS);
        } else if (err) {
                goto fail2;
        }
        sc->sc_flags &= ~ATU_FLAG_REATTACH;

        /* read device config & MAC address */
        err = atu_get_config(sc);
        if (err) {
                cmn_err(CE_WARN, "%s: read device config failed\n",
                    sc->sc_name);
                goto fail2;
        }

        mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&sc->sc_txlock, NULL, MUTEX_DRIVER, NULL);
        mutex_init(&sc->sc_rxlock, NULL, MUTEX_DRIVER, NULL);

        ic->ic_phytype = IEEE80211_T_DS;
        ic->ic_opmode = IEEE80211_M_STA;
        ic->ic_caps = IEEE80211_C_SHPREAMBLE | IEEE80211_C_WEP;
        ic->ic_sup_rates[IEEE80211_MODE_11B] = atu_rateset;
        ic->ic_maxrssi = atu_fw_table[sc->sc_radio].max_rssi;
        ic->ic_state = IEEE80211_S_INIT;
        for (i = 1; i <= 14; i++) {
                ic->ic_sup_channels[i].ich_freq =
                    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
                ic->ic_sup_channels[i].ich_flags =
                    IEEE80211_CHAN_CCK | IEEE80211_CHAN_2GHZ |
                    IEEE80211_CHAN_PASSIVE;
        }
        ic->ic_xmit = atu_send;
        ieee80211_attach(ic);

        sc->sc_newstate = ic->ic_newstate;
        ic->ic_newstate = atu_newstate;
        ic->ic_watchdog = atu_watchdog;
        ieee80211_media_init(ic);

        ic->ic_def_txkey = 0;
        wd.wd_opmode = ic->ic_opmode;
        wd.wd_secalloc = WIFI_SEC_NONE;
        IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);

        macp = mac_alloc(MAC_VERSION);
        if (macp == NULL)
                goto fail3;

        macp->m_type_ident      = MAC_PLUGIN_IDENT_WIFI;
        macp->m_driver          = sc;
        macp->m_dip             = dip;
        macp->m_src_addr        = ic->ic_macaddr;
        macp->m_callbacks       = &atu_m_callbacks;
        macp->m_min_sdu         = 0;
        macp->m_max_sdu         = IEEE80211_MTU;
        macp->m_pdata           = &wd;
        macp->m_pdata_size      = sizeof (wd);

        err = mac_register(macp, &ic->ic_mach);
        mac_free(macp);
        if (err)
                goto fail3;

        err = usb_register_hotplug_cbs(sc->sc_dip, atu_disconnect,
            atu_reconnect);
        if (err != USB_SUCCESS)
                goto fail4;

        err = ddi_create_minor_node(dip, sc->sc_name, S_IFCHR,
            instance + 1, DDI_NT_NET_WIFI, 0);
        if (err != DDI_SUCCESS)
                cmn_err(CE_WARN, "%s: minor node creation failed\n",
                    sc->sc_name);

        mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
        return (DDI_SUCCESS);

fail4:
        (void) mac_unregister(ic->ic_mach);
fail3:
        mutex_destroy(&sc->sc_genlock);
        mutex_destroy(&sc->sc_rxlock);
        mutex_destroy(&sc->sc_txlock);
fail2:
        usb_client_detach(sc->sc_dip, sc->sc_udev);
fail1:
        ddi_soft_state_free(atu_soft_state_p, instance);

        return (DDI_FAILURE);
}

static int
atu_detach(dev_info_t *dip, ddi_detach_cmd_t cmd)
{
        struct atu_softc *sc;
        int err;

        sc = ddi_get_soft_state(atu_soft_state_p, ddi_get_instance(dip));

        switch (cmd) {
        case DDI_DETACH:
                break;
        case DDI_SUSPEND:
                ieee80211_new_state(&sc->sc_ic, IEEE80211_S_INIT, -1);
                ieee80211_stop_watchdog(&sc->sc_ic);

                ATU_LOCK(sc);
                if (sc->sc_scan_timer != 0) {
                        ATU_UNLOCK(sc);
                        (void) untimeout(sc->sc_scan_timer);
                        ATU_LOCK(sc);
                        sc->sc_scan_timer = 0;
                }
                (void) atu_stop(sc);

                ATU_UNLOCK(sc);
                return (DDI_SUCCESS);
        default:
                return (DDI_FAILURE);
        }

        if (!ATU_REATTACH(sc)) {
                err = mac_disable(sc->sc_ic.ic_mach);
                if (err)
                        return (DDI_FAILURE);

                (void) atu_stop(sc);

                usb_unregister_hotplug_cbs(dip);
                (void) mac_unregister(sc->sc_ic.ic_mach);
                ieee80211_detach(&sc->sc_ic);

                mutex_destroy(&sc->sc_genlock);
                mutex_destroy(&sc->sc_txlock);
                mutex_destroy(&sc->sc_rxlock);

                ddi_remove_minor_node(dip, NULL);
        }

        usb_client_detach(dip, sc->sc_udev);
        ddi_soft_state_free(atu_soft_state_p, ddi_get_instance(dip));

        return (DDI_SUCCESS);
}

DDI_DEFINE_STREAM_OPS(atu_dev_ops, nulldev, nulldev, atu_attach,
    atu_detach, nodev, NULL, D_MP, NULL, ddi_quiesce_not_needed);

static struct modldrv atu_modldrv = {
        &mod_driverops,
        "atu driver v1.1",
        &atu_dev_ops
};

static struct modlinkage modlinkage = {
        MODREV_1,
        (void *)&atu_modldrv,
        NULL
};

int
_info(struct modinfo *modinfop)
{
        return (mod_info(&modlinkage, modinfop));
}

int
_init(void)
{
        int status;

        status = ddi_soft_state_init(&atu_soft_state_p,
            sizeof (struct atu_softc), 1);
        if (status != 0)
                return (status);

        mac_init_ops(&atu_dev_ops, "atu");
        status = mod_install(&modlinkage);
        if (status != 0) {
                mac_fini_ops(&atu_dev_ops);
                ddi_soft_state_fini(&atu_soft_state_p);
        }
        return (status);
}

int
_fini(void)
{
        int status;

        status = mod_remove(&modlinkage);
        if (status == 0) {
                mac_fini_ops(&atu_dev_ops);
                ddi_soft_state_fini(&atu_soft_state_p);
        }
        return (status);
}

static int
atu_m_start(void *arg)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        int err;

        ATU_LOCK(sc);
        err = atu_init(sc);

        ATU_UNLOCK(sc);
        return (err);
}

static void
atu_m_stop(void *arg)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;

        ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
        ieee80211_stop_watchdog(ic);

        ATU_LOCK(sc);
        if (sc->sc_scan_timer != 0) {
                ATU_UNLOCK(sc);
                (void) untimeout(sc->sc_scan_timer);
                ATU_LOCK(sc);
                sc->sc_scan_timer = 0;
        }
        (void) atu_stop(sc);

        ATU_UNLOCK(sc);
}

/*ARGSUSED*/
static int
atu_m_unicst(void *arg, const uint8_t *macaddr)
{
        return (ENOTSUP);
}

/*ARGSUSED*/
static int
atu_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
{
        return (ENOTSUP);
}

/*ARGSUSED*/
static int
atu_m_promisc(void *arg, boolean_t on)
{
        return (0);
}

static int
atu_m_setprop(void *arg, const char *name, mac_prop_id_t id, uint_t len,
    const void *buf)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        int err;

        err = ieee80211_setprop(ic, name, id, len, buf);
        if (err != ENETRESET)
                return (err);
        if (ic->ic_des_esslen == 0)
                return (0);

        ATU_LOCK(sc);
        if (ATU_RUNNING(sc)) {
                if (sc->sc_scan_timer != 0) {
                        ATU_UNLOCK(sc);
                        (void) untimeout(sc->sc_scan_timer);
                        ATU_LOCK(sc);
                        sc->sc_scan_timer = 0;
                }
                err = atu_init(sc);

                ATU_UNLOCK(sc);
                if (err)
                        return (err);
                ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
                ATU_LOCK(sc);
        }

        ATU_UNLOCK(sc);
        return (0);
}

static int
atu_m_getprop(void *arg, const char *name, mac_prop_id_t id,
    uint_t length, void *buf)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;

        return (ieee80211_getprop(ic, name, id, length, buf));
}

static void
atu_m_propinfo(void *arg, const char *name, mac_prop_id_t id,
    mac_prop_info_handle_t mph)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;

        ieee80211_propinfo(ic, name, id, mph);
}

static void
atu_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        int err;

        err = ieee80211_ioctl(ic, wq, mp);
        if (err != ENETRESET || ic->ic_des_esslen == 0)
                return;

        ATU_LOCK(sc);
        if (ATU_RUNNING(sc)) {
                if (sc->sc_scan_timer != 0) {
                        ATU_UNLOCK(sc);
                        (void) untimeout(sc->sc_scan_timer);
                        ATU_LOCK(sc);
                        sc->sc_scan_timer = 0;
                }
                err = atu_init(sc);

                ATU_UNLOCK(sc);
                if (err)
                        return;
                ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
                ATU_LOCK(sc);
        }

        ATU_UNLOCK(sc);
}

static mblk_t *
atu_m_tx(void *arg, mblk_t *mp)
{
        struct atu_softc *sc = (struct atu_softc *)arg;
        struct ieee80211com *ic = &sc->sc_ic;
        mblk_t *next;

        if (ic->ic_state != IEEE80211_S_RUN) {
                freemsgchain(mp);
                return (NULL);
        }

        while (mp != NULL) {
                next = mp->b_next;
                mp->b_next = NULL;
                if (atu_send(ic, mp, IEEE80211_FC0_TYPE_DATA) == ENOMEM) {
                        mutex_enter(&sc->sc_txlock);
                        sc->sc_need_sched = 1;
                        mutex_exit(&sc->sc_txlock);

                        mp->b_next = next;
                        return (mp);
                }
                mp = next;
        }

        return (mp);
}

static int
atu_m_stat(void *arg, uint_t stat, uint64_t *val)
{
        struct atu_softc        *sc  = (struct atu_softc *)arg;
        ieee80211com_t          *ic = &sc->sc_ic;
        ieee80211_node_t        *in;

        ATU_LOCK(sc);
        switch (stat) {
        case MAC_STAT_IFSPEED:
                in = ic->ic_bss;
                *val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
                    IEEE80211_RATE(in->in_txrate) :
                    ic->ic_fixed_rate) / 2 * 1000000;
                break;
        case MAC_STAT_NOXMTBUF:
                *val = sc->sc_tx_nobuf;
                break;
        case MAC_STAT_NORCVBUF:
                *val = sc->sc_rx_nobuf;
                break;
        case MAC_STAT_IERRORS:
                *val = sc->sc_rx_err;
                break;
        case MAC_STAT_RBYTES:
                *val = ic->ic_stats.is_rx_bytes;
                break;
        case MAC_STAT_IPACKETS:
                *val = ic->ic_stats.is_rx_frags;
                break;
        case MAC_STAT_OBYTES:
                *val = ic->ic_stats.is_tx_bytes;
                break;
        case MAC_STAT_OPACKETS:
                *val = ic->ic_stats.is_tx_frags;
                break;
        case MAC_STAT_OERRORS:
                *val = ic->ic_stats.is_tx_failed;
                break;
        case WIFI_STAT_TX_FRAGS:
        case WIFI_STAT_MCAST_TX:
        case WIFI_STAT_TX_FAILED:
        case WIFI_STAT_TX_RETRANS:
        case WIFI_STAT_TX_RERETRANS:
        case WIFI_STAT_RTS_SUCCESS:
        case WIFI_STAT_RTS_FAILURE:
        case WIFI_STAT_ACK_FAILURE:
        case WIFI_STAT_RX_FRAGS:
        case WIFI_STAT_MCAST_RX:
        case WIFI_STAT_FCS_ERRORS:
        case WIFI_STAT_WEP_ERRORS:
        case WIFI_STAT_RX_DUPS:
                ATU_UNLOCK(sc);
                return (ieee80211_stat(ic, stat, val));
        default:
                ATU_UNLOCK(sc);
                return (ENOTSUP);
        }

        ATU_UNLOCK(sc);
        return (0);
}

static mac_callbacks_t atu_m_callbacks = {
        MC_IOCTL | MC_SETPROP | MC_GETPROP | MC_PROPINFO,
        atu_m_stat,
        atu_m_start,
        atu_m_stop,
        atu_m_promisc,
        atu_m_multicst,
        atu_m_unicst,
        atu_m_tx,
        NULL,
        atu_m_ioctl,
        NULL,
        NULL,
        NULL,
        atu_m_setprop,
        atu_m_getprop,
        atu_m_propinfo
};