if_ural.c revision 186454
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 186454 2008-12-23 19:59:21Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 *
22 */
23
24/*
25 *
26 * NOTE: all function names beginning like "ural_cfg_" can only
27 * be called from within the config thread function !
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 186454 2008-12-23 19:59:21Z thompsa $");
32
33/*-
34 * Ralink Technology RT2500USB chipset driver
35 * http://www.ralinktech.com/
36 */
37
38#include <dev/usb2/include/usb2_devid.h>
39#include <dev/usb2/include/usb2_standard.h>
40#include <dev/usb2/include/usb2_mfunc.h>
41#include <dev/usb2/include/usb2_error.h>
42
43#define	usb2_config_td_cc ural_config_copy
44#define	usb2_config_td_softc ural_softc
45
46#define	USB_DEBUG_VAR ural_debug
47
48#include <dev/usb2/core/usb2_core.h>
49#include <dev/usb2/core/usb2_lookup.h>
50#include <dev/usb2/core/usb2_process.h>
51#include <dev/usb2/core/usb2_config_td.h>
52#include <dev/usb2/core/usb2_debug.h>
53#include <dev/usb2/core/usb2_request.h>
54#include <dev/usb2/core/usb2_busdma.h>
55#include <dev/usb2/core/usb2_util.h>
56
57#include <dev/usb2/wlan/usb2_wlan.h>
58#include <dev/usb2/wlan/if_ural2_reg.h>
59#include <dev/usb2/wlan/if_ural2_var.h>
60
61#if USB_DEBUG
62static int ural_debug = 0;
63
64SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
65SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
66    "Debug level");
67#endif
68
69#define	URAL_RSSI(rssi)	\
70  ((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ? \
71   ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
72
73/* prototypes */
74
75static device_probe_t ural_probe;
76static device_attach_t ural_attach;
77static device_detach_t ural_detach;
78
79static usb2_callback_t ural_bulk_read_callback;
80static usb2_callback_t ural_bulk_read_clear_stall_callback;
81static usb2_callback_t ural_bulk_write_callback;
82static usb2_callback_t ural_bulk_write_clear_stall_callback;
83
84static usb2_config_td_command_t ural_cfg_first_time_setup;
85static usb2_config_td_command_t ural_config_copy;
86static usb2_config_td_command_t ural_cfg_scan_start;
87static usb2_config_td_command_t ural_cfg_scan_end;
88static usb2_config_td_command_t ural_cfg_set_chan;
89static usb2_config_td_command_t ural_cfg_enable_tsf_sync;
90static usb2_config_td_command_t ural_cfg_update_slot;
91static usb2_config_td_command_t ural_cfg_set_txpreamble;
92static usb2_config_td_command_t ural_cfg_update_promisc;
93static usb2_config_td_command_t ural_cfg_pre_init;
94static usb2_config_td_command_t ural_cfg_init;
95static usb2_config_td_command_t ural_cfg_pre_stop;
96static usb2_config_td_command_t ural_cfg_stop;
97static usb2_config_td_command_t ural_cfg_amrr_timeout;
98static usb2_config_td_command_t ural_cfg_newstate;
99
100static void	ural_cfg_do_request(struct ural_softc *,
101		    struct usb2_device_request *, void *);
102static void	ural_cfg_set_testmode(struct ural_softc *);
103static void	ural_cfg_eeprom_read(struct ural_softc *, uint16_t, void *,
104		    uint16_t);
105static uint16_t	ural_cfg_read(struct ural_softc *, uint16_t);
106static void	ural_cfg_read_multi(struct ural_softc *, uint16_t, void *,
107		    uint16_t);
108static void	ural_cfg_write(struct ural_softc *, uint16_t, uint16_t);
109static void	ural_cfg_write_multi(struct ural_softc *, uint16_t, void *,
110		    uint16_t);
111static void	ural_cfg_bbp_write(struct ural_softc *, uint8_t, uint8_t);
112static uint8_t	ural_cfg_bbp_read(struct ural_softc *, uint8_t);
113static void	ural_cfg_rf_write(struct ural_softc *, uint8_t, uint32_t);
114static void	ural_end_of_commands(struct ural_softc *);
115static const char *ural_get_rf(int rev);
116static void	ural_watchdog(void *);
117static void	ural_init_cb(void *);
118static int	ural_ioctl_cb(struct ifnet *, u_long cmd, caddr_t data);
119static void	ural_start_cb(struct ifnet *);
120static int	ural_newstate_cb(struct ieee80211vap *,
121		    enum ieee80211_state, int);
122static void	ural_std_command(struct ieee80211com *,
123		    usb2_config_td_command_t *);
124static void	ural_scan_start_cb(struct ieee80211com *);
125static void	ural_scan_end_cb(struct ieee80211com *);
126static void	ural_set_channel_cb(struct ieee80211com *);
127static void	ural_cfg_disable_rf_tune(struct ural_softc *);
128static void	ural_cfg_set_bssid(struct ural_softc *, uint8_t *);
129static void	ural_cfg_set_macaddr(struct ural_softc *, uint8_t *);
130static void	ural_cfg_set_txantenna(struct ural_softc *, uint8_t);
131static void	ural_cfg_set_rxantenna(struct ural_softc *, uint8_t);
132static void	ural_cfg_read_eeprom(struct ural_softc *);
133static uint8_t	ural_cfg_bbp_init(struct ural_softc *);
134static void	ural_cfg_amrr_start(struct ural_softc *);
135static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
136		    const char name[IFNAMSIZ], int unit, int opmode, int flags,
137		    const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t
138		    mac[IEEE80211_ADDR_LEN]);
139static void	ural_vap_delete(struct ieee80211vap *);
140static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
141		    const uint8_t mac[IEEE80211_ADDR_LEN]);
142static void	ural_newassoc(struct ieee80211_node *, int);
143static void	ural_cfg_disable_tsf_sync(struct ural_softc *);
144static void	ural_cfg_set_run(struct ural_softc *,
145		    struct usb2_config_td_cc *);
146static void	ural_fill_write_queue(struct ural_softc *);
147static void	ural_tx_clean_queue(struct ural_softc *);
148static void	ural_tx_freem(struct mbuf *);
149static void	ural_tx_mgt(struct ural_softc *, struct mbuf *,
150		    struct ieee80211_node *);
151static struct ieee80211vap *ural_get_vap(struct ural_softc *);
152static void	ural_tx_bcn(struct ural_softc *);
153static void	ural_tx_data(struct ural_softc *, struct mbuf *,
154		    struct ieee80211_node *);
155static void	ural_tx_prot(struct ural_softc *, const struct mbuf *,
156		    struct ieee80211_node *, uint8_t, uint16_t);
157static void	ural_tx_raw(struct ural_softc *, struct mbuf *,
158		    struct ieee80211_node *,
159		    const struct ieee80211_bpf_params *);
160static int	ural_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
161		    const struct ieee80211_bpf_params *);
162static void	ural_setup_desc_and_tx(struct ural_softc *, struct mbuf *,
163		    uint32_t, uint16_t);
164static void	ural_update_mcast_cb(struct ifnet *);
165static void	ural_update_promisc_cb(struct ifnet *);
166
167/* various supported device vendors/products */
168static const struct usb2_device_id ural_devs[] = {
169	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G, 0)},
170	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570, 0)},
171	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050, 0)},
172	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051, 0)},
173	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS, 0)},
174	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G, 0)},
175	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP, 0)},
176	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU, 0)},
177	{USB_VPI(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122, 0)},
178	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G, 0)},
179	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG, 0)},
180	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254, 0)},
181	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54, 0)},
182	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI, 0)},
183	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB, 0)},
184	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI, 0)},
185	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570, 0)},
186	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2, 0)},
187	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3, 0)},
188	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902, 0)},
189	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570, 0)},
190	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2, 0)},
191	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3, 0)},
192	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2573, 0)},
193	{USB_VPI(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G, 0)},
194	{USB_VPI(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG, 0)},
195	{USB_VPI(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R, 0)},
196	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570, 0)},
197	{USB_VPI(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570, 0)},
198	{USB_VPI(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570, 0)},
199};
200
201/*
202 * Default values for MAC registers; values taken from
203 * the reference driver:
204 */
205struct ural_def_mac {
206	uint16_t reg;
207	uint16_t val;
208};
209
210static const struct ural_def_mac ural_def_mac[] = {
211	{RAL_TXRX_CSR5, 0x8c8d},
212	{RAL_TXRX_CSR6, 0x8b8a},
213	{RAL_TXRX_CSR7, 0x8687},
214	{RAL_TXRX_CSR8, 0x0085},
215	{RAL_MAC_CSR13, 0x1111},
216	{RAL_MAC_CSR14, 0x1e11},
217	{RAL_TXRX_CSR21, 0xe78f},
218	{RAL_MAC_CSR9, 0xff1d},
219	{RAL_MAC_CSR11, 0x0002},
220	{RAL_MAC_CSR22, 0x0053},
221	{RAL_MAC_CSR15, 0x0000},
222	{RAL_MAC_CSR8, RAL_FRAME_SIZE},
223	{RAL_TXRX_CSR19, 0x0000},
224	{RAL_TXRX_CSR18, 0x005a},
225	{RAL_PHY_CSR2, 0x0000},
226	{RAL_TXRX_CSR0, 0x1ec0},
227	{RAL_PHY_CSR4, 0x000f}
228};
229
230/*
231 * Default values for BBP registers; values taken from the reference driver.
232 */
233struct ural_def_bbp {
234	uint8_t	reg;
235	uint8_t	val;
236};
237
238static const struct ural_def_bbp ural_def_bbp[] = {
239	{3, 0x02},
240	{4, 0x19},
241	{14, 0x1c},
242	{15, 0x30},
243	{16, 0xac},
244	{17, 0x48},
245	{18, 0x18},
246	{19, 0xff},
247	{20, 0x1e},
248	{21, 0x08},
249	{22, 0x08},
250	{23, 0x08},
251	{24, 0x80},
252	{25, 0x50},
253	{26, 0x08},
254	{27, 0x23},
255	{30, 0x10},
256	{31, 0x2b},
257	{32, 0xb9},
258	{34, 0x12},
259	{35, 0x50},
260	{39, 0xc4},
261	{40, 0x02},
262	{41, 0x60},
263	{53, 0x10},
264	{54, 0x18},
265	{56, 0x08},
266	{57, 0x10},
267	{58, 0x08},
268	{61, 0x60},
269	{62, 0x10},
270	{75, 0xff}
271};
272
273/*
274 * Default values for RF register R2 indexed by channel numbers.
275 */
276static const uint32_t ural_rf2522_r2[] = {
277	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
278	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
279};
280
281static const uint32_t ural_rf2523_r2[] = {
282	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
283	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
284};
285
286static const uint32_t ural_rf2524_r2[] = {
287	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
288	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
289};
290
291static const uint32_t ural_rf2525_r2[] = {
292	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
293	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
294};
295
296static const uint32_t ural_rf2525_hi_r2[] = {
297	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
298	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
299};
300
301static const uint32_t ural_rf2525e_r2[] = {
302	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
303	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
304};
305
306static const uint32_t ural_rf2526_hi_r2[] = {
307	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
308	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
309};
310
311static const uint32_t ural_rf2526_r2[] = {
312	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
313	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
314};
315
316/*
317 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
318 * values taken from the reference driver.
319 */
320struct ural_rf5222 {
321	uint8_t	chan;
322	uint32_t r1;
323	uint32_t r2;
324	uint32_t r4;
325};
326
327static const struct ural_rf5222 ural_rf5222[] = {
328	{1, 0x08808, 0x0044d, 0x00282},
329	{2, 0x08808, 0x0044e, 0x00282},
330	{3, 0x08808, 0x0044f, 0x00282},
331	{4, 0x08808, 0x00460, 0x00282},
332	{5, 0x08808, 0x00461, 0x00282},
333	{6, 0x08808, 0x00462, 0x00282},
334	{7, 0x08808, 0x00463, 0x00282},
335	{8, 0x08808, 0x00464, 0x00282},
336	{9, 0x08808, 0x00465, 0x00282},
337	{10, 0x08808, 0x00466, 0x00282},
338	{11, 0x08808, 0x00467, 0x00282},
339	{12, 0x08808, 0x00468, 0x00282},
340	{13, 0x08808, 0x00469, 0x00282},
341	{14, 0x08808, 0x0046b, 0x00286},
342
343	{36, 0x08804, 0x06225, 0x00287},
344	{40, 0x08804, 0x06226, 0x00287},
345	{44, 0x08804, 0x06227, 0x00287},
346	{48, 0x08804, 0x06228, 0x00287},
347	{52, 0x08804, 0x06229, 0x00287},
348	{56, 0x08804, 0x0622a, 0x00287},
349	{60, 0x08804, 0x0622b, 0x00287},
350	{64, 0x08804, 0x0622c, 0x00287},
351
352	{100, 0x08804, 0x02200, 0x00283},
353	{104, 0x08804, 0x02201, 0x00283},
354	{108, 0x08804, 0x02202, 0x00283},
355	{112, 0x08804, 0x02203, 0x00283},
356	{116, 0x08804, 0x02204, 0x00283},
357	{120, 0x08804, 0x02205, 0x00283},
358	{124, 0x08804, 0x02206, 0x00283},
359	{128, 0x08804, 0x02207, 0x00283},
360	{132, 0x08804, 0x02208, 0x00283},
361	{136, 0x08804, 0x02209, 0x00283},
362	{140, 0x08804, 0x0220a, 0x00283},
363
364	{149, 0x08808, 0x02429, 0x00281},
365	{153, 0x08808, 0x0242b, 0x00281},
366	{157, 0x08808, 0x0242d, 0x00281},
367	{161, 0x08808, 0x0242f, 0x00281}
368};
369
370static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
371	[0] = {
372		.type = UE_BULK,
373		.endpoint = UE_ADDR_ANY,
374		.direction = UE_DIR_OUT,
375		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
376		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
377		.mh.callback = &ural_bulk_write_callback,
378		.mh.timeout = 5000,	/* ms */
379	},
380
381	[1] = {
382		.type = UE_BULK,
383		.endpoint = UE_ADDR_ANY,
384		.direction = UE_DIR_IN,
385		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
386		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
387		.mh.callback = &ural_bulk_read_callback,
388	},
389
390	[2] = {
391		.type = UE_CONTROL,
392		.endpoint = 0x00,	/* Control pipe */
393		.direction = UE_DIR_ANY,
394		.mh.bufsize = sizeof(struct usb2_device_request),
395		.mh.callback = &ural_bulk_write_clear_stall_callback,
396		.mh.timeout = 1000,	/* 1 second */
397		.mh.interval = 50,	/* 50ms */
398	},
399
400	[3] = {
401		.type = UE_CONTROL,
402		.endpoint = 0x00,	/* Control pipe */
403		.direction = UE_DIR_ANY,
404		.mh.bufsize = sizeof(struct usb2_device_request),
405		.mh.callback = &ural_bulk_read_clear_stall_callback,
406		.mh.timeout = 1000,	/* 1 second */
407		.mh.interval = 50,	/* 50ms */
408	},
409};
410
411static devclass_t ural_devclass;
412
413static device_method_t ural_methods[] = {
414	DEVMETHOD(device_probe, ural_probe),
415	DEVMETHOD(device_attach, ural_attach),
416	DEVMETHOD(device_detach, ural_detach),
417	{0, 0}
418};
419
420static driver_t ural_driver = {
421	.name = "ural",
422	.methods = ural_methods,
423	.size = sizeof(struct ural_softc),
424};
425
426DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
427MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
428MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
429MODULE_DEPEND(ural, wlan, 1, 1, 1);
430MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
431
432static int
433ural_probe(device_t dev)
434{
435	struct usb2_attach_arg *uaa = device_get_ivars(dev);
436
437	if (uaa->usb2_mode != USB_MODE_HOST) {
438		return (ENXIO);
439	}
440	if (uaa->info.bConfigIndex != 0) {
441		return (ENXIO);
442	}
443	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX) {
444		return (ENXIO);
445	}
446	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
447}
448
449static int
450ural_attach(device_t dev)
451{
452	struct usb2_attach_arg *uaa = device_get_ivars(dev);
453	struct ural_softc *sc = device_get_softc(dev);
454	int error;
455	uint8_t iface_index;
456
457	if (sc == NULL) {
458		return (ENOMEM);
459	}
460	device_set_usb2_desc(dev);
461
462	mtx_init(&sc->sc_mtx, "ural lock", MTX_NETWORK_LOCK,
463	    MTX_DEF | MTX_RECURSE);
464
465	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
466	    device_get_nameunit(dev));
467
468	sc->sc_udev = uaa->device;
469	sc->sc_unit = device_get_unit(dev);
470
471	usb2_callout_init_mtx(&sc->sc_watchdog, &sc->sc_mtx, 0);
472
473	iface_index = RAL_IFACE_INDEX;
474	error = usb2_transfer_setup(uaa->device,
475	    &iface_index, sc->sc_xfer, ural_config,
476	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
477
478	if (error) {
479		device_printf(dev, "could not allocate USB transfers, "
480		    "err=%s\n", usb2_errstr(error));
481		goto detach;
482	}
483	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
484	    &ural_end_of_commands,
485	    sizeof(struct usb2_config_td_cc), 24);
486	if (error) {
487		device_printf(dev, "could not setup config "
488		    "thread!\n");
489		goto detach;
490	}
491	mtx_lock(&sc->sc_mtx);
492
493	/* start setup */
494
495	usb2_config_td_queue_command
496	    (&sc->sc_config_td, NULL, &ural_cfg_first_time_setup, 0, 0);
497
498	ural_watchdog(sc);
499	mtx_unlock(&sc->sc_mtx);
500	return (0);			/* success */
501
502detach:
503	ural_detach(dev);
504	return (ENXIO);			/* failure */
505}
506
507static int
508ural_detach(device_t dev)
509{
510	struct ural_softc *sc = device_get_softc(dev);
511	struct ieee80211com *ic;
512	struct ifnet *ifp;
513
514	usb2_config_td_drain(&sc->sc_config_td);
515
516	mtx_lock(&sc->sc_mtx);
517
518	usb2_callout_stop(&sc->sc_watchdog);
519
520	ural_cfg_pre_stop(sc, NULL, 0);
521
522	ifp = sc->sc_ifp;
523	ic = ifp->if_l2com;
524
525	mtx_unlock(&sc->sc_mtx);
526
527	/* stop all USB transfers first */
528	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
529
530	/* get rid of any late children */
531	bus_generic_detach(dev);
532
533	if (ifp) {
534		bpfdetach(ifp);
535		ieee80211_ifdetach(ic);
536		if_free(ifp);
537	}
538	usb2_config_td_unsetup(&sc->sc_config_td);
539
540	usb2_callout_drain(&sc->sc_watchdog);
541
542	mtx_destroy(&sc->sc_mtx);
543
544	return (0);
545}
546
547/*========================================================================*
548 * REGISTER READ / WRITE WRAPPER ROUTINES
549 *========================================================================*/
550
551static void
552ural_cfg_do_request(struct ural_softc *sc, struct usb2_device_request *req,
553    void *data)
554{
555	uint16_t length;
556	usb2_error_t err;
557
558repeat:
559
560	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
561		goto error;
562	}
563	err = usb2_do_request_flags
564	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
565
566	if (err) {
567
568		DPRINTF("device request failed, err=%s "
569		    "(ignored)\n", usb2_errstr(err));
570
571		/* wait a little before next try */
572		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
573			goto error;
574		}
575		/* try until we are detached */
576		goto repeat;
577
578error:
579		/* the device has been detached */
580		length = UGETW(req->wLength);
581
582		if ((req->bmRequestType & UT_READ) && length) {
583			bzero(data, length);
584		}
585	}
586}
587
588static void
589ural_cfg_set_testmode(struct ural_softc *sc)
590{
591	struct usb2_device_request req;
592
593	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
594	req.bRequest = RAL_VENDOR_REQUEST;
595	USETW(req.wValue, 4);
596	USETW(req.wIndex, 1);
597	USETW(req.wLength, 0);
598
599	ural_cfg_do_request(sc, &req, NULL);
600}
601
602static void
603ural_cfg_eeprom_read(struct ural_softc *sc, uint16_t addr,
604    void *buf, uint16_t len)
605{
606	struct usb2_device_request req;
607
608	req.bmRequestType = UT_READ_VENDOR_DEVICE;
609	req.bRequest = RAL_READ_EEPROM;
610	USETW(req.wValue, 0);
611	USETW(req.wIndex, addr);
612	USETW(req.wLength, len);
613
614	ural_cfg_do_request(sc, &req, buf);
615}
616
617static uint16_t
618ural_cfg_read(struct ural_softc *sc, uint16_t reg)
619{
620	struct usb2_device_request req;
621	uint16_t val;
622
623	req.bmRequestType = UT_READ_VENDOR_DEVICE;
624	req.bRequest = RAL_READ_MAC;
625	USETW(req.wValue, 0);
626	USETW(req.wIndex, reg);
627	USETW(req.wLength, sizeof(val));
628
629	ural_cfg_do_request(sc, &req, &val);
630
631	return (le16toh(val));
632}
633
634static void
635ural_cfg_read_multi(struct ural_softc *sc, uint16_t reg,
636    void *buf, uint16_t len)
637{
638	struct usb2_device_request req;
639
640	req.bmRequestType = UT_READ_VENDOR_DEVICE;
641	req.bRequest = RAL_READ_MULTI_MAC;
642	USETW(req.wValue, 0);
643	USETW(req.wIndex, reg);
644	USETW(req.wLength, len);
645
646	ural_cfg_do_request(sc, &req, buf);
647}
648
649static void
650ural_cfg_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
651{
652	struct usb2_device_request req;
653
654	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
655	req.bRequest = RAL_WRITE_MAC;
656	USETW(req.wValue, val);
657	USETW(req.wIndex, reg);
658	USETW(req.wLength, 0);
659
660	ural_cfg_do_request(sc, &req, NULL);
661}
662
663static void
664ural_cfg_write_multi(struct ural_softc *sc, uint16_t reg,
665    void *buf, uint16_t len)
666{
667	struct usb2_device_request req;
668
669	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
670	req.bRequest = RAL_WRITE_MULTI_MAC;
671	USETW(req.wValue, 0);
672	USETW(req.wIndex, reg);
673	USETW(req.wLength, len);
674
675	ural_cfg_do_request(sc, &req, buf);
676}
677
678static uint8_t
679ural_cfg_bbp_disbusy(struct ural_softc *sc)
680{
681	uint16_t tmp;
682	uint8_t to;
683
684	for (to = 0;; to++) {
685		if (to < 100) {
686			tmp = ural_cfg_read(sc, RAL_PHY_CSR8);
687			tmp &= RAL_BBP_BUSY;
688
689			if (tmp == 0) {
690				return (0);
691			}
692			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
693				break;
694			}
695		} else {
696			break;
697		}
698	}
699	DPRINTF("could not disbusy BBP\n");
700	return (1);			/* failure */
701}
702
703static void
704ural_cfg_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
705{
706	uint16_t tmp;
707
708	if (ural_cfg_bbp_disbusy(sc)) {
709		return;
710	}
711	tmp = (reg << 8) | val;
712	ural_cfg_write(sc, RAL_PHY_CSR7, tmp);
713}
714
715static uint8_t
716ural_cfg_bbp_read(struct ural_softc *sc, uint8_t reg)
717{
718	uint16_t val;
719
720	if (ural_cfg_bbp_disbusy(sc)) {
721		return (0);
722	}
723	val = RAL_BBP_WRITE | (reg << 8);
724	ural_cfg_write(sc, RAL_PHY_CSR7, val);
725
726	if (ural_cfg_bbp_disbusy(sc)) {
727		return (0);
728	}
729	return (ural_cfg_read(sc, RAL_PHY_CSR7) & 0xff);
730}
731
732static void
733ural_cfg_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
734{
735	uint32_t tmp;
736	uint8_t to;
737
738	reg &= 3;
739
740	/* remember last written value */
741	sc->sc_rf_regs[reg] = val;
742
743	for (to = 0;; to++) {
744		if (to < 100) {
745			tmp = ural_cfg_read(sc, RAL_PHY_CSR10);
746
747			if (!(tmp & RAL_RF_LOBUSY)) {
748				break;
749			}
750			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
751				return;
752			}
753		} else {
754			DPRINTF("could not write to RF\n");
755			return;
756		}
757	}
758
759	tmp = RAL_RF_BUSY | RAL_RF_20BIT | ((val & 0xfffff) << 2) | reg;
760	ural_cfg_write(sc, RAL_PHY_CSR9, tmp & 0xffff);
761	ural_cfg_write(sc, RAL_PHY_CSR10, tmp >> 16);
762
763	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
764}
765
766static void
767ural_cfg_first_time_setup(struct ural_softc *sc,
768    struct usb2_config_td_cc *cc, uint16_t refcount)
769{
770	struct ieee80211com *ic;
771	struct ifnet *ifp;
772	uint8_t bands;
773
774	/* setup RX tap header */
775	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
776	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
777	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
778
779	/* setup TX tap header */
780	sc->sc_txtap_len = sizeof(sc->sc_txtap);
781	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
782	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
783
784	/* retrieve RT2570 rev. no */
785	sc->sc_asic_rev = ural_cfg_read(sc, RAL_MAC_CSR0);
786
787	/* retrieve MAC address and various other things from EEPROM */
788	ural_cfg_read_eeprom(sc);
789
790	printf("%s: MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
791	    sc->sc_name, sc->sc_asic_rev, ural_get_rf(sc->sc_rf_rev));
792
793	mtx_unlock(&sc->sc_mtx);
794
795	ifp = if_alloc(IFT_IEEE80211);
796
797	mtx_lock(&sc->sc_mtx);
798
799	if (ifp == NULL) {
800		DPRINTFN(0, "could not if_alloc()!\n");
801		goto done;
802	}
803	sc->sc_evilhack = ifp;
804	sc->sc_ifp = ifp;
805	ic = ifp->if_l2com;
806
807	ifp->if_softc = sc;
808	if_initname(ifp, "ural", sc->sc_unit);
809	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
810	ifp->if_init = &ural_init_cb;
811	ifp->if_ioctl = &ural_ioctl_cb;
812	ifp->if_start = &ural_start_cb;
813	ifp->if_watchdog = NULL;
814	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
815	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
816	IFQ_SET_READY(&ifp->if_snd);
817
818	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
819
820	ic->ic_ifp = ifp;
821	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
822	ic->ic_opmode = IEEE80211_M_STA;
823
824	/* set device capabilities */
825	ic->ic_caps =
826	    IEEE80211_C_STA		/* station mode supported */
827	    | IEEE80211_C_IBSS		/* IBSS mode supported */
828	    | IEEE80211_C_MONITOR	/* monitor mode supported */
829	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
830	    | IEEE80211_C_TXPMGT	/* tx power management */
831	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
832	    | IEEE80211_C_SHSLOT	/* short slot time supported */
833	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
834	    | IEEE80211_C_WPA		/* 802.11i */
835	    ;
836
837	bands = 0;
838	setbit(&bands, IEEE80211_MODE_11B);
839	setbit(&bands, IEEE80211_MODE_11G);
840
841	if (sc->sc_rf_rev == RAL_RF_5222) {
842		setbit(&bands, IEEE80211_MODE_11A);
843	}
844	ieee80211_init_channels(ic, NULL, &bands);
845
846	mtx_unlock(&sc->sc_mtx);
847
848	ieee80211_ifattach(ic);
849
850	mtx_lock(&sc->sc_mtx);
851
852	ic->ic_newassoc = &ural_newassoc;
853	ic->ic_raw_xmit = &ural_raw_xmit_cb;
854	ic->ic_node_alloc = &ural_node_alloc;
855	ic->ic_update_mcast = &ural_update_mcast_cb;
856	ic->ic_update_promisc = &ural_update_promisc_cb;
857	ic->ic_scan_start = &ural_scan_start_cb;
858	ic->ic_scan_end = &ural_scan_end_cb;
859	ic->ic_set_channel = &ural_set_channel_cb;
860	ic->ic_vap_create = &ural_vap_create;
861	ic->ic_vap_delete = &ural_vap_delete;
862
863	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
864
865	mtx_unlock(&sc->sc_mtx);
866
867	bpfattach(ifp, DLT_IEEE802_11_RADIO,
868	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
869
870	if (bootverbose) {
871		ieee80211_announce(ic);
872	}
873	mtx_lock(&sc->sc_mtx);
874done:
875	return;
876}
877
878static void
879ural_end_of_commands(struct ural_softc *sc)
880{
881	sc->sc_flags &= ~URAL_FLAG_WAIT_COMMAND;
882
883	/* start write transfer, if not started */
884	usb2_transfer_start(sc->sc_xfer[0]);
885}
886
887static void
888ural_config_copy_chan(struct ural_config_copy_chan *cc,
889    struct ieee80211com *ic, struct ieee80211_channel *c)
890{
891	if (!c)
892		return;
893	cc->chan_to_ieee =
894	    ieee80211_chan2ieee(ic, c);
895	if (c != IEEE80211_CHAN_ANYC) {
896		cc->chan_to_mode =
897		    ieee80211_chan2mode(c);
898		if (IEEE80211_IS_CHAN_B(c))
899			cc->chan_is_b = 1;
900		if (IEEE80211_IS_CHAN_A(c))
901			cc->chan_is_a = 1;
902		if (IEEE80211_IS_CHAN_2GHZ(c))
903			cc->chan_is_2ghz = 1;
904		if (IEEE80211_IS_CHAN_5GHZ(c))
905			cc->chan_is_5ghz = 1;
906		if (IEEE80211_IS_CHAN_ANYG(c))
907			cc->chan_is_g = 1;
908	}
909}
910
911static void
912ural_config_copy(struct ural_softc *sc,
913    struct usb2_config_td_cc *cc, uint16_t refcount)
914{
915	struct ifnet *ifp;
916	struct ieee80211com *ic;
917	struct ieee80211_node *ni;
918	struct ieee80211vap *vap;
919	const struct ieee80211_txparam *tp;
920
921	bzero(cc, sizeof(*cc));
922
923	ifp = sc->sc_ifp;
924	if (ifp) {
925		cc->if_flags = ifp->if_flags;
926		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
927		    sizeof(cc->if_broadcastaddr));
928
929		ic = ifp->if_l2com;
930		if (ic) {
931			ural_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
932			ural_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
933			vap = TAILQ_FIRST(&ic->ic_vaps);
934			if (vap) {
935				ni = vap->iv_bss;
936				if (ni) {
937					cc->iv_bss.ni_intval = ni->ni_intval;
938					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
939					    sizeof(cc->iv_bss.ni_bssid));
940				}
941				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
942				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
943					cc->iv_bss.fixed_rate_none = 1;
944				}
945			}
946			cc->ic_opmode = ic->ic_opmode;
947			cc->ic_flags = ic->ic_flags;
948			cc->ic_txpowlimit = ic->ic_txpowlimit;
949			cc->ic_curmode = ic->ic_curmode;
950
951			bcopy(ic->ic_myaddr, cc->ic_myaddr,
952			    sizeof(cc->ic_myaddr));
953		}
954	}
955	sc->sc_flags |= URAL_FLAG_WAIT_COMMAND;
956}
957
958static const char *
959ural_get_rf(int rev)
960{
961	switch (rev) {
962		case RAL_RF_2522:return "RT2522";
963	case RAL_RF_2523:
964		return "RT2523";
965	case RAL_RF_2524:
966		return "RT2524";
967	case RAL_RF_2525:
968		return "RT2525";
969	case RAL_RF_2525E:
970		return "RT2525e";
971	case RAL_RF_2526:
972		return "RT2526";
973	case RAL_RF_5222:
974		return "RT5222";
975	default:
976		return "unknown";
977	}
978}
979
980/*------------------------------------------------------------------------*
981 * ural_bulk_read_callback - data read "thread"
982 *------------------------------------------------------------------------*/
983static void
984ural_bulk_read_callback(struct usb2_xfer *xfer)
985{
986	struct ural_softc *sc = xfer->priv_sc;
987	struct ifnet *ifp = sc->sc_ifp;
988	struct ieee80211com *ic = ifp->if_l2com;
989	struct ieee80211_node *ni;
990	struct mbuf *m = NULL;
991	uint32_t flags;
992	uint32_t max_len;
993	uint32_t real_len;
994	uint8_t rssi = 0;
995
996	switch (USB_GET_STATE(xfer)) {
997	case USB_ST_TRANSFERRED:
998
999		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
1000
1001		if (xfer->actlen < RAL_RX_DESC_SIZE) {
1002			DPRINTF("too short transfer, "
1003			    "%d bytes\n", xfer->actlen);
1004			ifp->if_ierrors++;
1005			goto tr_setup;
1006		}
1007		max_len = (xfer->actlen - RAL_RX_DESC_SIZE);
1008
1009		usb2_copy_out(xfer->frbuffers, max_len,
1010		    &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
1011
1012		flags = le32toh(sc->sc_rx_desc.flags);
1013
1014		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
1015			/*
1016		         * This should not happen since we did not
1017		         * request to receive those frames when we
1018		         * filled RAL_TXRX_CSR2:
1019		         */
1020			DPRINTFN(6, "PHY or CRC error\n");
1021			ifp->if_ierrors++;
1022			goto tr_setup;
1023		}
1024		if (max_len > MCLBYTES) {
1025			max_len = MCLBYTES;
1026		}
1027		real_len = (flags >> 16) & 0xfff;
1028
1029		if (real_len > max_len) {
1030			DPRINTF("invalid length in RX "
1031			    "descriptor, %u bytes, received %u bytes\n",
1032			    real_len, max_len);
1033			ifp->if_ierrors++;
1034			goto tr_setup;
1035		}
1036		/* ieee80211_input() will check if the mbuf is too short */
1037
1038		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1039
1040		if (m == NULL) {
1041			DPRINTF("could not allocate mbuf\n");
1042			ifp->if_ierrors++;
1043			goto tr_setup;
1044		}
1045		usb2_copy_out(xfer->frbuffers, 0, m->m_data, max_len);
1046
1047		/* finalize mbuf */
1048		m->m_pkthdr.rcvif = ifp;
1049		m->m_pkthdr.len = m->m_len = real_len;
1050
1051		DPRINTF("real length=%d bytes\n", real_len);
1052
1053		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
1054
1055		if (bpf_peers_present(ifp->if_bpf)) {
1056			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
1057
1058			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1059			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1060			    (sc->sc_rx_desc.flags & htole32(RAL_RX_OFDM)) ?
1061			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1062
1063			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1064			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1065			tap->wr_antenna = sc->sc_rx_ant;
1066			tap->wr_antsignal = rssi;
1067
1068			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1069		}
1070		/* Strip trailing 802.11 MAC FCS. */
1071		m_adj(m, -IEEE80211_CRC_LEN);
1072
1073	case USB_ST_SETUP:
1074tr_setup:
1075
1076		if (sc->sc_flags & URAL_FLAG_READ_STALL) {
1077			usb2_transfer_start(sc->sc_xfer[3]);
1078		} else {
1079			xfer->frlengths[0] = xfer->max_data_length;
1080			usb2_start_hardware(xfer);
1081		}
1082
1083		/*
1084		 * At the end of a USB callback it is always safe to unlock
1085		 * the private mutex of a device! That is why we do the
1086		 * "ieee80211_input" here, and not some lines up!
1087		 */
1088		if (m) {
1089			mtx_unlock(&sc->sc_mtx);
1090
1091			ni = ieee80211_find_rxnode(ic, (void *)(m->m_data));
1092
1093			if (ni) {
1094				/* send the frame to the 802.11 layer */
1095				if (ieee80211_input(ni, m, rssi, RAL_NOISE_FLOOR, 0)) {
1096					/* ignore */
1097				}
1098				/* node is no longer needed */
1099				ieee80211_free_node(ni);
1100			} else {
1101				/* broadcast */
1102				if (ieee80211_input_all(ic, m, rssi, RAL_NOISE_FLOOR, 0)) {
1103					/* ignore */
1104				}
1105			}
1106
1107			mtx_lock(&sc->sc_mtx);
1108		}
1109		return;
1110
1111	default:			/* Error */
1112		if (xfer->error != USB_ERR_CANCELLED) {
1113			/* try to clear stall first */
1114			sc->sc_flags |= URAL_FLAG_READ_STALL;
1115			usb2_transfer_start(sc->sc_xfer[3]);
1116		}
1117		return;
1118
1119	}
1120}
1121
1122static void
1123ural_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1124{
1125	struct ural_softc *sc = xfer->priv_sc;
1126	struct usb2_xfer *xfer_other = sc->sc_xfer[1];
1127
1128	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1129		DPRINTF("stall cleared\n");
1130		sc->sc_flags &= ~URAL_FLAG_READ_STALL;
1131		usb2_transfer_start(xfer_other);
1132	}
1133}
1134
1135static uint8_t
1136ural_plcp_signal(uint16_t rate)
1137{
1138	;				/* indent fix */
1139	switch (rate) {
1140		/* CCK rates (NB: not IEEE std, device-specific) */
1141	case 2:
1142		return (0x0);
1143	case 4:
1144		return (0x1);
1145	case 11:
1146		return (0x2);
1147	case 22:
1148		return (0x3);
1149
1150		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1151	case 12:
1152		return (0xb);
1153	case 18:
1154		return (0xf);
1155	case 24:
1156		return (0xa);
1157	case 36:
1158		return (0xe);
1159	case 48:
1160		return (0x9);
1161	case 72:
1162		return (0xd);
1163	case 96:
1164		return (0x8);
1165	case 108:
1166		return (0xc);
1167
1168		/* XXX unsupported/unknown rate */
1169	default:
1170		return (0xff);
1171	}
1172}
1173
1174/*
1175 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1176 * should be freed, when "ural_setup_desc_and_tx" is called.
1177 */
1178static void
1179ural_setup_desc_and_tx(struct ural_softc *sc, struct mbuf *m,
1180    uint32_t flags, uint16_t rate)
1181{
1182	struct ifnet *ifp = sc->sc_ifp;
1183	struct ieee80211com *ic = ifp->if_l2com;
1184	struct mbuf *mm;
1185	enum ieee80211_phytype phytype;
1186	uint16_t plcp_length;
1187	uint16_t len;
1188	uint8_t remainder;
1189
1190	DPRINTF("in\n");
1191
1192	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1193		/* free packet */
1194		ural_tx_freem(m);
1195		ifp->if_oerrors++;
1196		return;
1197	}
1198	if (!((sc->sc_flags & URAL_FLAG_LL_READY) &&
1199	    (sc->sc_flags & URAL_FLAG_HL_READY))) {
1200		/* free packet */
1201		ural_tx_freem(m);
1202		ifp->if_oerrors++;
1203		return;
1204	}
1205	if (rate < 2) {
1206		DPRINTF("rate < 2!\n");
1207
1208		/* avoid division by zero */
1209		rate = 2;
1210	}
1211	ic->ic_lastdata = ticks;
1212
1213	if (bpf_peers_present(ifp->if_bpf)) {
1214		struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
1215
1216		tap->wt_flags = 0;
1217		tap->wt_rate = rate;
1218		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1219		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1220		tap->wt_antenna = sc->sc_tx_ant;
1221
1222		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1223	}
1224	len = m->m_pkthdr.len;
1225
1226	sc->sc_tx_desc.flags = htole32(flags);
1227	sc->sc_tx_desc.flags |= htole32(RAL_TX_NEWSEQ);
1228	sc->sc_tx_desc.flags |= htole32(len << 16);
1229
1230	sc->sc_tx_desc.wme = htole16(RAL_AIFSN(2) |
1231	    RAL_LOGCWMIN(3) |
1232	    RAL_LOGCWMAX(5) |
1233	    RAL_IVOFFSET(sizeof(struct ieee80211_frame)));
1234
1235	/* setup PLCP fields */
1236	sc->sc_tx_desc.plcp_signal = ural_plcp_signal(rate);
1237	sc->sc_tx_desc.plcp_service = 4;
1238
1239	len += IEEE80211_CRC_LEN;
1240
1241	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1242
1243	if (phytype == IEEE80211_T_OFDM) {
1244		sc->sc_tx_desc.flags |= htole32(RAL_TX_OFDM);
1245
1246		plcp_length = len & 0xfff;
1247		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1248		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1249
1250	} else {
1251		plcp_length = ((16 * len) + rate - 1) / rate;
1252		if (rate == 22) {
1253			remainder = (16 * len) % 22;
1254			if ((remainder != 0) && (remainder < 7)) {
1255				sc->sc_tx_desc.plcp_service |=
1256				    RAL_PLCP_LENGEXT;
1257			}
1258		}
1259		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1260		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1261
1262		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1263			sc->sc_tx_desc.plcp_signal |= 0x08;
1264		}
1265	}
1266
1267	sc->sc_tx_desc.iv = 0;
1268	sc->sc_tx_desc.eiv = 0;
1269
1270	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1271		DPRINTF("No room for header structure!\n");
1272		ural_tx_freem(m);
1273		return;
1274	}
1275	mm = m_gethdr(M_NOWAIT, MT_DATA);
1276	if (mm == NULL) {
1277		DPRINTF("Could not allocate header mbuf!\n");
1278		ural_tx_freem(m);
1279		return;
1280	}
1281	DPRINTF(" %zu %u (out)\n", sizeof(sc->sc_tx_desc), m->m_pkthdr.len);
1282
1283	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1284	mm->m_len = sizeof(sc->sc_tx_desc);
1285
1286	mm->m_next = m;
1287	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1288	mm->m_pkthdr.rcvif = NULL;
1289
1290	/* start write transfer, if not started */
1291	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1292
1293	usb2_transfer_start(sc->sc_xfer[0]);
1294}
1295
1296static void
1297ural_bulk_write_callback(struct usb2_xfer *xfer)
1298{
1299	struct ural_softc *sc = xfer->priv_sc;
1300	struct ifnet *ifp = sc->sc_ifp;
1301	struct mbuf *m;
1302	uint16_t temp_len;
1303	uint8_t align;
1304
1305	switch (USB_GET_STATE(xfer)) {
1306	case USB_ST_TRANSFERRED:
1307		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
1308
1309		ifp->if_opackets++;
1310
1311	case USB_ST_SETUP:
1312		if (sc->sc_flags & URAL_FLAG_WRITE_STALL) {
1313			usb2_transfer_start(sc->sc_xfer[2]);
1314			break;
1315		}
1316		if (sc->sc_flags & URAL_FLAG_WAIT_COMMAND) {
1317			/*
1318			 * don't send anything while a command is pending !
1319			 */
1320			break;
1321		}
1322		ural_fill_write_queue(sc);
1323
1324		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1325
1326		if (m) {
1327
1328			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
1329				DPRINTFN(0, "data overflow, %u bytes\n",
1330				    m->m_pkthdr.len);
1331				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
1332			}
1333			usb2_m_copy_in(xfer->frbuffers, 0,
1334			    m, 0, m->m_pkthdr.len);
1335
1336			/* compute transfer length */
1337			temp_len = m->m_pkthdr.len;
1338
1339			/* make transfer length 16-bit aligned */
1340			align = (temp_len & 1);
1341
1342			/* check if we need to add two extra bytes */
1343			if (((temp_len + align) % 64) == 0) {
1344				align += 2;
1345			}
1346			/* check if we need to align length */
1347			if (align != 0) {
1348				/* zero the extra bytes */
1349				usb2_bzero(xfer->frbuffers, temp_len, align);
1350				temp_len += align;
1351			}
1352			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
1353			    m->m_pkthdr.len, temp_len);
1354
1355			xfer->frlengths[0] = temp_len;
1356
1357			usb2_start_hardware(xfer);
1358
1359			/* free mbuf and node */
1360			ural_tx_freem(m);
1361		}
1362		break;
1363
1364	default:			/* Error */
1365		DPRINTFN(11, "transfer error, %s\n",
1366		    usb2_errstr(xfer->error));
1367
1368		if (xfer->error != USB_ERR_CANCELLED) {
1369			/* try to clear stall first */
1370			sc->sc_flags |= URAL_FLAG_WRITE_STALL;
1371			usb2_transfer_start(sc->sc_xfer[2]);
1372		}
1373		ifp->if_oerrors++;
1374		break;
1375	}
1376}
1377
1378static void
1379ural_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1380{
1381	struct ural_softc *sc = xfer->priv_sc;
1382	struct usb2_xfer *xfer_other = sc->sc_xfer[0];
1383
1384	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1385		DPRINTF("stall cleared\n");
1386		sc->sc_flags &= ~URAL_FLAG_WRITE_STALL;
1387		usb2_transfer_start(xfer_other);
1388	}
1389}
1390
1391static void
1392ural_watchdog(void *arg)
1393{
1394	struct ural_softc *sc = arg;
1395
1396	mtx_assert(&sc->sc_mtx, MA_OWNED);
1397
1398	if (sc->sc_amrr_timer) {
1399		usb2_config_td_queue_command
1400		    (&sc->sc_config_td, NULL,
1401		    &ural_cfg_amrr_timeout, 0, 0);
1402	}
1403	usb2_callout_reset(&sc->sc_watchdog,
1404	    hz, &ural_watchdog, sc);
1405}
1406
1407/*========================================================================*
1408 * IF-net callbacks
1409 *========================================================================*/
1410
1411static void
1412ural_init_cb(void *arg)
1413{
1414	struct ural_softc *sc = arg;
1415
1416	mtx_lock(&sc->sc_mtx);
1417	usb2_config_td_queue_command
1418	    (&sc->sc_config_td, &ural_cfg_pre_init,
1419	    &ural_cfg_init, 0, 0);
1420	mtx_unlock(&sc->sc_mtx);
1421}
1422
1423static int
1424ural_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1425{
1426	struct ural_softc *sc = ifp->if_softc;
1427	struct ieee80211com *ic = ifp->if_l2com;
1428	int error;
1429
1430	switch (cmd) {
1431	case SIOCSIFFLAGS:
1432		mtx_lock(&sc->sc_mtx);
1433		if (ifp->if_flags & IFF_UP) {
1434			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1435				usb2_config_td_queue_command
1436				    (&sc->sc_config_td, &ural_cfg_pre_init,
1437				    &ural_cfg_init, 0, 0);
1438			}
1439		} else {
1440			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1441				usb2_config_td_queue_command
1442				    (&sc->sc_config_td, &ural_cfg_pre_stop,
1443				    &ural_cfg_stop, 0, 0);
1444			}
1445		}
1446		mtx_unlock(&sc->sc_mtx);
1447		error = 0;
1448		break;
1449
1450	case SIOCGIFMEDIA:
1451	case SIOCSIFMEDIA:
1452		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1453		break;
1454
1455	default:
1456		error = ether_ioctl(ifp, cmd, data);
1457	}
1458	return (error);
1459}
1460
1461static void
1462ural_start_cb(struct ifnet *ifp)
1463{
1464	struct ural_softc *sc = ifp->if_softc;
1465
1466	mtx_lock(&sc->sc_mtx);
1467	/* start write transfer, if not started */
1468	usb2_transfer_start(sc->sc_xfer[0]);
1469	mtx_unlock(&sc->sc_mtx);
1470}
1471
1472static void
1473ural_cfg_newstate(struct ural_softc *sc,
1474    struct usb2_config_td_cc *cc, uint16_t refcount)
1475{
1476	struct ifnet *ifp = sc->sc_ifp;
1477	struct ieee80211com *ic = ifp->if_l2com;
1478	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1479	struct ural_vap *uvp = URAL_VAP(vap);
1480	enum ieee80211_state ostate;
1481	enum ieee80211_state nstate;
1482	int arg;
1483
1484	ostate = vap->iv_state;
1485	nstate = sc->sc_ns_state;
1486	arg = sc->sc_ns_arg;
1487
1488	if (ostate == IEEE80211_S_INIT) {
1489		/* We are leaving INIT. TSF sync should be off. */
1490		ural_cfg_disable_tsf_sync(sc);
1491	}
1492	switch (nstate) {
1493	case IEEE80211_S_INIT:
1494		break;
1495
1496	case IEEE80211_S_RUN:
1497		ural_cfg_set_run(sc, cc);
1498		break;
1499
1500	default:
1501		break;
1502	}
1503
1504	mtx_unlock(&sc->sc_mtx);
1505	IEEE80211_LOCK(ic);
1506	uvp->newstate(vap, nstate, arg);
1507	if (vap->iv_newstate_cb != NULL)
1508		vap->iv_newstate_cb(vap, nstate, arg);
1509	IEEE80211_UNLOCK(ic);
1510	mtx_lock(&sc->sc_mtx);
1511}
1512
1513static int
1514ural_newstate_cb(struct ieee80211vap *vap,
1515    enum ieee80211_state nstate, int arg)
1516{
1517	struct ural_vap *uvp = URAL_VAP(vap);
1518	struct ieee80211com *ic = vap->iv_ic;
1519	struct ural_softc *sc = ic->ic_ifp->if_softc;
1520
1521	DPRINTF("setting new state: %d\n", nstate);
1522
1523	/* Special case - cannot defer this call and cannot block ! */
1524	if (nstate == IEEE80211_S_INIT) {
1525		/* stop timers */
1526		mtx_lock(&sc->sc_mtx);
1527		sc->sc_amrr_timer = 0;
1528		mtx_unlock(&sc->sc_mtx);
1529		return (uvp->newstate(vap, nstate, arg));
1530	}
1531	mtx_lock(&sc->sc_mtx);
1532	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1533		mtx_unlock(&sc->sc_mtx);
1534		return (0);		/* nothing to do */
1535	}
1536	/* store next state */
1537	sc->sc_ns_state = nstate;
1538	sc->sc_ns_arg = arg;
1539
1540	/* stop timers */
1541	sc->sc_amrr_timer = 0;
1542
1543	/*
1544	 * USB configuration can only be done from the USB configuration
1545	 * thread:
1546	 */
1547	usb2_config_td_queue_command
1548	    (&sc->sc_config_td, &ural_config_copy,
1549	    &ural_cfg_newstate, 0, 0);
1550
1551	mtx_unlock(&sc->sc_mtx);
1552
1553	return (EINPROGRESS);
1554}
1555
1556static void
1557ural_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1558{
1559	struct ural_softc *sc = ic->ic_ifp->if_softc;
1560
1561	mtx_lock(&sc->sc_mtx);
1562
1563	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1564
1565	usb2_config_td_queue_command
1566	    (&sc->sc_config_td, &ural_config_copy, func, 0, 0);
1567
1568	mtx_unlock(&sc->sc_mtx);
1569}
1570
1571static void
1572ural_scan_start_cb(struct ieee80211com *ic)
1573{
1574	ural_std_command(ic, &ural_cfg_scan_start);
1575}
1576
1577static void
1578ural_scan_end_cb(struct ieee80211com *ic)
1579{
1580	ural_std_command(ic, &ural_cfg_scan_end);
1581}
1582
1583static void
1584ural_set_channel_cb(struct ieee80211com *ic)
1585{
1586	ural_std_command(ic, &ural_cfg_set_chan);
1587}
1588
1589/*========================================================================*
1590 * configure sub-routines, ural_cfg_xxx
1591 *========================================================================*/
1592
1593static void
1594ural_cfg_scan_start(struct ural_softc *sc,
1595    struct usb2_config_td_cc *cc, uint16_t refcount)
1596{
1597	/* abort TSF synchronization */
1598	ural_cfg_disable_tsf_sync(sc);
1599	ural_cfg_set_bssid(sc, cc->if_broadcastaddr);
1600}
1601
1602static void
1603ural_cfg_scan_end(struct ural_softc *sc,
1604    struct usb2_config_td_cc *cc, uint16_t refcount)
1605{
1606	/* enable TSF synchronization */
1607	ural_cfg_enable_tsf_sync(sc, cc, 0);
1608	ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1609}
1610
1611static void
1612ural_cfg_set_chan(struct ural_softc *sc,
1613    struct usb2_config_td_cc *cc, uint16_t refcount)
1614{
1615	enum {
1616		N_RF5222 = (sizeof(ural_rf5222) / sizeof(ural_rf5222[0])),
1617	};
1618	uint32_t i;
1619	uint32_t chan;
1620	uint8_t power;
1621	uint8_t tmp;
1622
1623	chan = cc->ic_curchan.chan_to_ieee;
1624
1625	if ((chan == 0) ||
1626	    (chan == IEEE80211_CHAN_ANY)) {
1627		/* nothing to do */
1628		return;
1629	}
1630	if (cc->ic_curchan.chan_is_2ghz)
1631		power = min(sc->sc_txpow[chan - 1], 31);
1632	else
1633		power = 31;
1634
1635	/* adjust txpower using ifconfig settings */
1636	power -= (100 - cc->ic_txpowlimit) / 8;
1637
1638	DPRINTFN(3, "setting channel to %u, "
1639	    "tx-power to %u\n", chan, power);
1640
1641	switch (sc->sc_rf_rev) {
1642	case RAL_RF_2522:
1643		ural_cfg_rf_write(sc, RAL_RF1, 0x00814);
1644		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1645		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1646		break;
1647
1648	case RAL_RF_2523:
1649		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1650		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1651		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x38044);
1652		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1653		break;
1654
1655	case RAL_RF_2524:
1656		ural_cfg_rf_write(sc, RAL_RF1, 0x0c808);
1657		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1658		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1659		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1660		break;
1661
1662	case RAL_RF_2525:
1663		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1664		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1665		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1666		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1667
1668		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1669		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1670		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1671		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1672		break;
1673
1674	case RAL_RF_2525E:
1675		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1676		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1677		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1678		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1679		break;
1680
1681	case RAL_RF_2526:
1682		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1683		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1684		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1685
1686		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1687		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1688		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1689		break;
1690
1691		/* dual-band RF */
1692	case RAL_RF_5222:
1693		for (i = 0; i < N_RF5222; i++) {
1694			if (ural_rf5222[i].chan == chan) {
1695				ural_cfg_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1696				ural_cfg_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1697				ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1698				ural_cfg_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1699				break;
1700			}
1701		}
1702		break;
1703	}
1704
1705	if ((cc->ic_opmode != IEEE80211_M_MONITOR) &&
1706	    (!(cc->ic_flags & IEEE80211_F_SCAN))) {
1707
1708		/* set Japan filter bit for channel 14 */
1709		tmp = ural_cfg_bbp_read(sc, 70);
1710
1711		if (chan == 14) {
1712			tmp |= RAL_JAPAN_FILTER;
1713		} else {
1714			tmp &= ~RAL_JAPAN_FILTER;
1715		}
1716
1717		ural_cfg_bbp_write(sc, 70, tmp);
1718
1719		/* clear CRC errors */
1720		ural_cfg_read(sc, RAL_STA_CSR0);
1721
1722		ural_cfg_disable_rf_tune(sc);
1723	}
1724	/* update basic rate set */
1725	if (cc->ic_curchan.chan_is_b) {
1726		/* 11b basic rates: 1, 2Mbps */
1727		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1728	} else if (cc->ic_curchan.chan_is_a) {
1729		/* 11a basic rates: 6, 12, 24Mbps */
1730		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1731	} else {
1732		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1733		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1734	}
1735
1736	/* wait a little */
1737	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1738		return;
1739	}
1740}
1741
1742static void
1743ural_cfg_set_run(struct ural_softc *sc,
1744    struct usb2_config_td_cc *cc)
1745{
1746	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1747		ural_cfg_update_slot(sc, cc, 0);
1748		ural_cfg_set_txpreamble(sc, cc, 0);
1749
1750		/* update basic rate set */
1751
1752		if (cc->ic_bsschan.chan_is_5ghz) {
1753			/* 11a basic rates: 6, 12, 24Mbps */
1754			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1755		} else if (cc->ic_bsschan.chan_is_g) {
1756			/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1757			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1758		} else {
1759			/* 11b basic rates: 1, 2Mbps */
1760			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1761		}
1762		ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1763	}
1764	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1765	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1766		ural_tx_bcn(sc);
1767	}
1768	/* make tx led blink on tx (controlled by ASIC) */
1769	ural_cfg_write(sc, RAL_MAC_CSR20, 1);
1770
1771	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1772		ural_cfg_enable_tsf_sync(sc, cc, 0);
1773	}
1774	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1775	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
1776
1777	if (cc->iv_bss.fixed_rate_none) {
1778		/* enable automatic rate adaptation */
1779		ural_cfg_amrr_start(sc);
1780	}
1781}
1782
1783/*------------------------------------------------------------------------*
1784 * ural_cfg_disable_rf_tune - disable RF auto-tuning
1785 *------------------------------------------------------------------------*/
1786static void
1787ural_cfg_disable_rf_tune(struct ural_softc *sc)
1788{
1789	uint32_t tmp;
1790
1791	if (sc->sc_rf_rev != RAL_RF_2523) {
1792		tmp = sc->sc_rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1793		ural_cfg_rf_write(sc, RAL_RF1, tmp);
1794	}
1795	tmp = sc->sc_rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1796	ural_cfg_rf_write(sc, RAL_RF3, tmp);
1797
1798	DPRINTFN(3, "disabling RF autotune\n");
1799}
1800
1801/*------------------------------------------------------------------------*
1802 * ural_cfg_enable_tsf_sync - refer to IEEE Std 802.11-1999 pp. 123
1803 * for more information on TSF synchronization
1804 *------------------------------------------------------------------------*/
1805static void
1806ural_cfg_enable_tsf_sync(struct ural_softc *sc,
1807    struct usb2_config_td_cc *cc, uint16_t refcount)
1808{
1809	uint16_t logcwmin;
1810	uint16_t preload;
1811	uint16_t tmp;
1812
1813	/* first, disable TSF synchronization */
1814	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1815
1816	tmp = (16 * cc->iv_bss.ni_intval) << 4;
1817	ural_cfg_write(sc, RAL_TXRX_CSR18, tmp);
1818
1819	logcwmin = (cc->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1820	preload = (cc->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1821	tmp = (logcwmin << 12) | preload;
1822	ural_cfg_write(sc, RAL_TXRX_CSR20, tmp);
1823
1824	/* finally, enable TSF synchronization */
1825	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1826	if (cc->ic_opmode == IEEE80211_M_STA)
1827		tmp |= RAL_ENABLE_TSF_SYNC(1);
1828	else
1829		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1830
1831	ural_cfg_write(sc, RAL_TXRX_CSR19, tmp);
1832
1833	DPRINTF("enabling TSF synchronization\n");
1834}
1835
1836static void
1837ural_cfg_disable_tsf_sync(struct ural_softc *sc)
1838{
1839	/* abort TSF synchronization */
1840	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1841
1842	/* force tx led to stop blinking */
1843	ural_cfg_write(sc, RAL_MAC_CSR20, 0);
1844}
1845
1846#define	RAL_RXTX_TURNAROUND    5	/* us */
1847
1848static void
1849ural_cfg_update_slot(struct ural_softc *sc,
1850    struct usb2_config_td_cc *cc, uint16_t refcount)
1851{
1852	uint16_t slottime;
1853	uint16_t sifs;
1854	uint16_t eifs;
1855
1856	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1857
1858	/*
1859	 * These settings may sound a bit inconsistent but this is what the
1860	 * reference driver does.
1861	 */
1862	if (cc->ic_curmode == IEEE80211_MODE_11B) {
1863		sifs = 16 - RAL_RXTX_TURNAROUND;
1864		eifs = 364;
1865	} else {
1866		sifs = 10 - RAL_RXTX_TURNAROUND;
1867		eifs = 64;
1868	}
1869
1870	ural_cfg_write(sc, RAL_MAC_CSR10, slottime);
1871	ural_cfg_write(sc, RAL_MAC_CSR11, sifs);
1872	ural_cfg_write(sc, RAL_MAC_CSR12, eifs);
1873}
1874
1875static void
1876ural_cfg_set_txpreamble(struct ural_softc *sc,
1877    struct usb2_config_td_cc *cc, uint16_t refcount)
1878{
1879	uint16_t tmp;
1880
1881	tmp = ural_cfg_read(sc, RAL_TXRX_CSR10);
1882
1883	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE) {
1884		tmp |= RAL_SHORT_PREAMBLE;
1885	} else {
1886		tmp &= ~RAL_SHORT_PREAMBLE;
1887	}
1888
1889	ural_cfg_write(sc, RAL_TXRX_CSR10, tmp);
1890}
1891
1892static void
1893ural_cfg_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1894{
1895	ural_cfg_write_multi(sc, RAL_MAC_CSR5, bssid, IEEE80211_ADDR_LEN);
1896
1897	DPRINTF("setting BSSID to 0x%02x%02x%02x%02x%02x%02x\n",
1898	    bssid[5], bssid[4], bssid[3],
1899	    bssid[2], bssid[1], bssid[0]);
1900}
1901
1902static void
1903ural_cfg_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1904{
1905	ural_cfg_write_multi(sc, RAL_MAC_CSR2, addr, IEEE80211_ADDR_LEN);
1906
1907	DPRINTF("setting MAC to 0x%02x%02x%02x%02x%02x%02x\n",
1908	    addr[5], addr[4], addr[3],
1909	    addr[2], addr[1], addr[0]);
1910}
1911
1912static void
1913ural_cfg_update_promisc(struct ural_softc *sc,
1914    struct usb2_config_td_cc *cc, uint16_t refcount)
1915{
1916	uint16_t tmp;
1917
1918	tmp = ural_cfg_read(sc, RAL_TXRX_CSR2);
1919
1920	if (cc->if_flags & IFF_PROMISC) {
1921		tmp &= ~RAL_DROP_NOT_TO_ME;
1922	} else {
1923		tmp |= RAL_DROP_NOT_TO_ME;
1924	}
1925
1926	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
1927
1928	DPRINTF("%s promiscuous mode\n",
1929	    (cc->if_flags & IFF_PROMISC) ?
1930	    "entering" : "leaving");
1931}
1932
1933static void
1934ural_cfg_set_txantenna(struct ural_softc *sc, uint8_t antenna)
1935{
1936	uint16_t tmp;
1937	uint8_t tx;
1938
1939	tx = ural_cfg_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1940	if (antenna == 1)
1941		tx |= RAL_BBP_ANTA;
1942	else if (antenna == 2)
1943		tx |= RAL_BBP_ANTB;
1944	else
1945		tx |= RAL_BBP_DIVERSITY;
1946
1947	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1948	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1949	    (sc->sc_rf_rev == RAL_RF_2526) ||
1950	    (sc->sc_rf_rev == RAL_RF_5222)) {
1951		tx |= RAL_BBP_FLIPIQ;
1952	}
1953	ural_cfg_bbp_write(sc, RAL_BBP_TX, tx);
1954
1955	/* update values in PHY_CSR5 and PHY_CSR6 */
1956	tmp = ural_cfg_read(sc, RAL_PHY_CSR5) & ~0x7;
1957	ural_cfg_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1958
1959	tmp = ural_cfg_read(sc, RAL_PHY_CSR6) & ~0x7;
1960	ural_cfg_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1961}
1962
1963static void
1964ural_cfg_set_rxantenna(struct ural_softc *sc, uint8_t antenna)
1965{
1966	uint8_t rx;
1967
1968	rx = ural_cfg_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1969	if (antenna == 1)
1970		rx |= RAL_BBP_ANTA;
1971	else if (antenna == 2)
1972		rx |= RAL_BBP_ANTB;
1973	else
1974		rx |= RAL_BBP_DIVERSITY;
1975
1976	/* need to force no I/Q flip for RF 2525e and 2526 */
1977
1978	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1979	    (sc->sc_rf_rev == RAL_RF_2526)) {
1980		rx &= ~RAL_BBP_FLIPIQ;
1981	}
1982	ural_cfg_bbp_write(sc, RAL_BBP_RX, rx);
1983}
1984
1985static void
1986ural_cfg_read_eeprom(struct ural_softc *sc)
1987{
1988	uint16_t val;
1989
1990	ural_cfg_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1991
1992	val = le16toh(val);
1993
1994	sc->sc_rf_rev = (val >> 11) & 0x7;
1995	sc->sc_hw_radio = (val >> 10) & 0x1;
1996	sc->sc_led_mode = (val >> 6) & 0x7;
1997	sc->sc_rx_ant = (val >> 4) & 0x3;
1998	sc->sc_tx_ant = (val >> 2) & 0x3;
1999	sc->sc_nb_ant = (val & 0x3);
2000
2001	DPRINTF("val = 0x%04x\n", val);
2002
2003	/* read MAC address */
2004	ural_cfg_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_myaddr,
2005	    sizeof(sc->sc_myaddr));
2006
2007	/* read default values for BBP registers */
2008	ural_cfg_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->sc_bbp_prom,
2009	    sizeof(sc->sc_bbp_prom));
2010
2011	/* read Tx power for all b/g channels */
2012	ural_cfg_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->sc_txpow,
2013	    sizeof(sc->sc_txpow));
2014}
2015
2016static uint8_t
2017ural_cfg_bbp_init(struct ural_softc *sc)
2018{
2019	enum {
2020		N_DEF_BBP = (sizeof(ural_def_bbp) / sizeof(ural_def_bbp[0])),
2021	};
2022	uint16_t i;
2023	uint8_t to;
2024
2025	/* wait for BBP to become ready */
2026	for (to = 0;; to++) {
2027		if (to < 100) {
2028			if (ural_cfg_bbp_read(sc, RAL_BBP_VERSION) != 0) {
2029				break;
2030			}
2031			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2032				return (1);	/* failure */
2033			}
2034		} else {
2035			DPRINTF("timeout waiting for BBP\n");
2036			return (1);	/* failure */
2037		}
2038	}
2039
2040	/* initialize BBP registers to default values */
2041	for (i = 0; i < N_DEF_BBP; i++) {
2042		ural_cfg_bbp_write(sc, ural_def_bbp[i].reg,
2043		    ural_def_bbp[i].val);
2044	}
2045
2046#if 0
2047	/* initialize BBP registers to values stored in EEPROM */
2048	for (i = 0; i < 16; i++) {
2049		if (sc->sc_bbp_prom[i].reg == 0xff) {
2050			continue;
2051		}
2052		ural_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg,
2053		    sc->sc_bbp_prom[i].val);
2054	}
2055#endif
2056	return (0);			/* success */
2057}
2058
2059static void
2060ural_cfg_pre_init(struct ural_softc *sc,
2061    struct usb2_config_td_cc *cc, uint16_t refcount)
2062{
2063	struct ifnet *ifp = sc->sc_ifp;
2064	struct ieee80211com *ic = ifp->if_l2com;
2065
2066	/* immediate configuration */
2067
2068	ural_cfg_pre_stop(sc, cc, 0);
2069
2070	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2071
2072	sc->sc_flags |= URAL_FLAG_HL_READY;
2073
2074	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2075}
2076
2077static void
2078ural_cfg_init(struct ural_softc *sc,
2079    struct usb2_config_td_cc *cc, uint16_t refcount)
2080{
2081	enum {
2082		N_DEF_MAC = (sizeof(ural_def_mac) / sizeof(ural_def_mac[0])),
2083	};
2084	uint16_t tmp;
2085	uint16_t i;
2086	uint8_t to;
2087
2088	/* delayed configuration */
2089
2090	ural_cfg_set_testmode(sc);
2091
2092	ural_cfg_write(sc, 0x308, 0x00f0);	/* XXX magic */
2093
2094	ural_cfg_stop(sc, cc, 0);
2095
2096	/* initialize MAC registers to default values */
2097	for (i = 0; i < N_DEF_MAC; i++) {
2098		ural_cfg_write(sc, ural_def_mac[i].reg,
2099		    ural_def_mac[i].val);
2100	}
2101
2102	/* wait for BBP and RF to wake up (this can take a long time!) */
2103	for (to = 0;; to++) {
2104		if (to < 100) {
2105			tmp = ural_cfg_read(sc, RAL_MAC_CSR17);
2106			if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2107			    (RAL_BBP_AWAKE | RAL_RF_AWAKE)) {
2108				break;
2109			}
2110			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2111				goto fail;
2112			}
2113		} else {
2114			DPRINTF("timeout waiting for "
2115			    "BBP/RF to wakeup\n");
2116			goto fail;
2117		}
2118	}
2119
2120	/* we're ready! */
2121	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2122
2123	/* set basic rate set (will be updated later) */
2124	ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
2125
2126	if (ural_cfg_bbp_init(sc)) {
2127		goto fail;
2128	}
2129	/* set default BSS channel */
2130	ural_cfg_set_chan(sc, cc, 0);
2131
2132	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2133	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta,
2134	    sizeof(sc->sc_sta));
2135
2136	DPRINTF("rx_ant=%d, tx_ant=%d\n",
2137	    sc->sc_rx_ant, sc->sc_tx_ant);
2138
2139	ural_cfg_set_txantenna(sc, sc->sc_tx_ant);
2140	ural_cfg_set_rxantenna(sc, sc->sc_rx_ant);
2141
2142	ural_cfg_set_macaddr(sc, cc->ic_myaddr);
2143
2144	/*
2145	 * make sure that the first transaction
2146	 * clears the stall:
2147	 */
2148	sc->sc_flags |= (URAL_FLAG_READ_STALL |
2149	    URAL_FLAG_WRITE_STALL |
2150	    URAL_FLAG_LL_READY);
2151
2152	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2153	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2154		struct ifnet *ifp = sc->sc_ifp;
2155		struct ieee80211com *ic = ifp->if_l2com;
2156
2157		/*
2158		 * start the USB transfers, if not already started:
2159		 */
2160		usb2_transfer_start(sc->sc_xfer[1]);
2161		usb2_transfer_start(sc->sc_xfer[0]);
2162
2163		/*
2164		 * start IEEE802.11 layer
2165		 */
2166		mtx_unlock(&sc->sc_mtx);
2167		ieee80211_start_all(ic);
2168		mtx_lock(&sc->sc_mtx);
2169	}
2170	/*
2171	 * start Rx
2172	 */
2173	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2174	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2175
2176		tmp |= (RAL_DROP_CTL | RAL_DROP_BAD_VERSION);
2177
2178		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2179			tmp |= RAL_DROP_TODS;
2180		}
2181		if (!(cc->if_flags & IFF_PROMISC)) {
2182			tmp |= RAL_DROP_NOT_TO_ME;
2183		}
2184	}
2185	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
2186
2187	return;
2188
2189fail:
2190	ural_cfg_pre_stop(sc, NULL, 0);
2191
2192	if (cc) {
2193		ural_cfg_stop(sc, cc, 0);
2194	}
2195}
2196
2197static void
2198ural_cfg_pre_stop(struct ural_softc *sc,
2199    struct usb2_config_td_cc *cc, uint16_t refcount)
2200{
2201	struct ifnet *ifp = sc->sc_ifp;
2202
2203	if (cc) {
2204		/* copy the needed configuration */
2205		ural_config_copy(sc, cc, refcount);
2206	}
2207	/* immediate configuration */
2208
2209	if (ifp) {
2210		/* clear flags */
2211		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2212	}
2213	sc->sc_flags &= ~(URAL_FLAG_HL_READY |
2214	    URAL_FLAG_LL_READY);
2215
2216	/*
2217	 * stop all the transfers, if not already stopped:
2218	 */
2219	usb2_transfer_stop(sc->sc_xfer[0]);
2220	usb2_transfer_stop(sc->sc_xfer[1]);
2221	usb2_transfer_stop(sc->sc_xfer[2]);
2222	usb2_transfer_stop(sc->sc_xfer[3]);
2223
2224	/* clean up transmission */
2225	ural_tx_clean_queue(sc);
2226}
2227
2228static void
2229ural_cfg_stop(struct ural_softc *sc,
2230    struct usb2_config_td_cc *cc, uint16_t refcount)
2231{
2232	/* disable Rx */
2233	ural_cfg_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2234
2235	/* reset ASIC and BBP (but won't reset MAC registers!) */
2236	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2237
2238	/* wait a little */
2239	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2240
2241	/* clear reset */
2242	ural_cfg_write(sc, RAL_MAC_CSR1, 0);
2243
2244	/* wait a little */
2245	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2246}
2247
2248static void
2249ural_cfg_amrr_start(struct ural_softc *sc)
2250{
2251	struct ieee80211vap *vap;
2252	struct ieee80211_node *ni;
2253
2254	vap = ural_get_vap(sc);
2255
2256	if (vap == NULL) {
2257		return;
2258	}
2259	ni = vap->iv_bss;
2260	if (ni == NULL) {
2261		return;
2262	}
2263	/* init AMRR */
2264
2265	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2266	/* enable AMRR timer */
2267
2268	sc->sc_amrr_timer = 1;
2269}
2270
2271static void
2272ural_cfg_amrr_timeout(struct ural_softc *sc,
2273    struct usb2_config_td_cc *cc, uint16_t refcount)
2274{
2275	struct ifnet *ifp = sc->sc_ifp;
2276	struct ieee80211vap *vap;
2277	struct ieee80211_node *ni;
2278	uint32_t ok;
2279	uint32_t fail;
2280
2281	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2282	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2283
2284	vap = ural_get_vap(sc);
2285	if (vap == NULL) {
2286		return;
2287	}
2288	ni = vap->iv_bss;
2289	if (ni == NULL) {
2290		return;
2291	}
2292	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2293	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2294
2295		ok = sc->sc_sta[7] +	/* TX ok w/o retry */
2296		    sc->sc_sta[8];	/* TX ok w/ retry */
2297		fail = sc->sc_sta[9];	/* TX retry-fail count */
2298
2299		if (sc->sc_amrr_timer) {
2300
2301			ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2302			    ok + fail, ok, sc->sc_sta[8] + fail);
2303
2304			if (ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn)) {
2305				/* ignore */
2306			}
2307		}
2308		ifp->if_oerrors += fail;
2309	}
2310}
2311
2312static struct ieee80211vap *
2313ural_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2314    int opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
2315    const uint8_t mac[IEEE80211_ADDR_LEN])
2316{
2317	struct ural_vap *uvp;
2318	struct ieee80211vap *vap;
2319	struct ural_softc *sc = ic->ic_ifp->if_softc;
2320
2321	/* Need to sync with config thread: */
2322	mtx_lock(&sc->sc_mtx);
2323	if (usb2_config_td_sync(&sc->sc_config_td)) {
2324		mtx_unlock(&sc->sc_mtx);
2325		/* config thread is gone */
2326		return (NULL);
2327	}
2328	mtx_unlock(&sc->sc_mtx);
2329
2330	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2331		return NULL;
2332	uvp = (struct ural_vap *)malloc(sizeof(struct ural_vap),
2333	    M_80211_VAP, M_NOWAIT | M_ZERO);
2334	if (uvp == NULL)
2335		return NULL;
2336
2337	vap = &uvp->vap;
2338	/* enable s/w bmiss handling for sta mode */
2339	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2340	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2341
2342	/* override state transition machine */
2343	uvp->newstate = vap->iv_newstate;
2344	vap->iv_newstate = &ural_newstate_cb;
2345
2346	ieee80211_amrr_init(&uvp->amrr, vap,
2347	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2348	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2349	    1000 /* 1 sec */ );
2350
2351	/* complete setup */
2352	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2353
2354	/* store current operation mode */
2355	ic->ic_opmode = opmode;
2356
2357	return (vap);
2358}
2359
2360static void
2361ural_vap_delete(struct ieee80211vap *vap)
2362{
2363	struct ural_vap *uvp = URAL_VAP(vap);
2364	struct ural_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2365
2366	/* Need to sync with config thread: */
2367	mtx_lock(&sc->sc_mtx);
2368	if (usb2_config_td_sync(&sc->sc_config_td)) {
2369		/* ignore */
2370	}
2371	mtx_unlock(&sc->sc_mtx);
2372
2373	ieee80211_amrr_cleanup(&uvp->amrr);
2374	ieee80211_vap_detach(vap);
2375	free(uvp, M_80211_VAP);
2376}
2377
2378/* ARGUSED */
2379static struct ieee80211_node *
2380ural_node_alloc(struct ieee80211vap *vap __unused,
2381    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2382{
2383	struct ural_node *un;
2384
2385	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2386	return ((un != NULL) ? &un->ni : NULL);
2387}
2388
2389static void
2390ural_newassoc(struct ieee80211_node *ni, int isnew)
2391{
2392	struct ieee80211vap *vap = ni->ni_vap;
2393
2394	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2395}
2396
2397static void
2398ural_fill_write_queue(struct ural_softc *sc)
2399{
2400	struct ifnet *ifp = sc->sc_ifp;
2401	struct ieee80211_node *ni;
2402	struct mbuf *m;
2403
2404	/*
2405	 * We only fill up half of the queue with data frames. The rest is
2406	 * reserved for other kinds of frames.
2407	 */
2408
2409	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2410
2411		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2412		if (m == NULL)
2413			break;
2414
2415		ni = (void *)(m->m_pkthdr.rcvif);
2416		m = ieee80211_encap(ni, m);
2417		if (m == NULL) {
2418			ieee80211_free_node(ni);
2419			continue;
2420		}
2421		ural_tx_data(sc, m, ni);
2422	}
2423}
2424
2425static void
2426ural_tx_clean_queue(struct ural_softc *sc)
2427{
2428	struct mbuf *m;
2429
2430	for (;;) {
2431		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2432
2433		if (!m) {
2434			break;
2435		}
2436		ural_tx_freem(m);
2437	}
2438}
2439
2440static void
2441ural_tx_freem(struct mbuf *m)
2442{
2443	struct ieee80211_node *ni;
2444
2445	while (m) {
2446		ni = (void *)(m->m_pkthdr.rcvif);
2447		if (!ni) {
2448			m = m_free(m);
2449			continue;
2450		}
2451		if (m->m_flags & M_TXCB) {
2452			ieee80211_process_callback(ni, m, 0);
2453		}
2454		m_freem(m);
2455		ieee80211_free_node(ni);
2456
2457		break;
2458	}
2459}
2460
2461static void
2462ural_tx_mgt(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2463{
2464	struct ieee80211vap *vap = ni->ni_vap;
2465	struct ieee80211com *ic = ni->ni_ic;
2466	const struct ieee80211_txparam *tp;
2467	struct ieee80211_frame *wh;
2468	struct ieee80211_key *k;
2469	uint32_t flags;
2470	uint16_t dur;
2471
2472	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2473
2474	wh = mtod(m, struct ieee80211_frame *);
2475	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2476		k = ieee80211_crypto_encap(ni, m);
2477		if (k == NULL) {
2478			m_freem(m);
2479			ieee80211_free_node(ni);
2480			return;
2481		}
2482		wh = mtod(m, struct ieee80211_frame *);
2483	}
2484	flags = 0;
2485	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2486		flags |= RAL_TX_ACK;
2487
2488		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2489		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2490		USETW(wh->i_dur, dur);
2491
2492		/* tell hardware to add timestamp for probe responses */
2493		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2494		    IEEE80211_FC0_TYPE_MGT &&
2495		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
2496		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2497			flags |= RAL_TX_TIMESTAMP;
2498	}
2499	m->m_pkthdr.rcvif = (void *)ni;
2500	ural_setup_desc_and_tx(sc, m, flags, tp->mgmtrate);
2501}
2502
2503static struct ieee80211vap *
2504ural_get_vap(struct ural_softc *sc)
2505{
2506	struct ifnet *ifp;
2507	struct ieee80211com *ic;
2508
2509	if (sc == NULL) {
2510		return NULL;
2511	}
2512	ifp = sc->sc_ifp;
2513	if (ifp == NULL) {
2514		return NULL;
2515	}
2516	ic = ifp->if_l2com;
2517	if (ic == NULL) {
2518		return NULL;
2519	}
2520	return TAILQ_FIRST(&ic->ic_vaps);
2521}
2522
2523static void
2524ural_tx_bcn(struct ural_softc *sc)
2525{
2526	struct ieee80211_node *ni;
2527	struct ieee80211vap *vap;
2528	struct ieee80211com *ic;
2529	const struct ieee80211_txparam *tp;
2530	struct mbuf *m;
2531
2532	vap = ural_get_vap(sc);
2533	if (vap == NULL) {
2534		return;
2535	}
2536	ni = vap->iv_bss;
2537	if (ni == NULL) {
2538		return;
2539	}
2540	ic = vap->iv_ic;
2541	if (ic == NULL) {
2542		return;
2543	}
2544	DPRINTFN(11, "Sending beacon frame.\n");
2545
2546	m = ieee80211_beacon_alloc(ni, &URAL_VAP(vap)->bo);
2547	if (m == NULL) {
2548		DPRINTFN(0, "could not allocate beacon\n");
2549		return;
2550	}
2551	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2552
2553	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2554	ural_setup_desc_and_tx(sc, m, RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP,
2555	    tp->mgmtrate);
2556}
2557
2558static void
2559ural_tx_data(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2560{
2561	struct ieee80211vap *vap = ni->ni_vap;
2562	struct ieee80211com *ic = ni->ni_ic;
2563	const struct ieee80211_txparam *tp;
2564	struct ieee80211_frame *wh;
2565	struct ieee80211_key *k;
2566	uint32_t flags = 0;
2567	uint16_t dur;
2568	uint16_t rate;
2569
2570	DPRINTFN(11, "Sending data.\n");
2571
2572	wh = mtod(m, struct ieee80211_frame *);
2573
2574	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2575	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2576		rate = tp->mcastrate;
2577	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2578		rate = tp->ucastrate;
2579	else
2580		rate = ni->ni_txrate;
2581
2582	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2583		k = ieee80211_crypto_encap(ni, m);
2584		if (k == NULL) {
2585			m_freem(m);
2586			ieee80211_free_node(ni);
2587			return;
2588		}
2589		/* packet header may have moved, reset our local pointer */
2590		wh = mtod(m, struct ieee80211_frame *);
2591	}
2592	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2593		uint8_t prot = IEEE80211_PROT_NONE;
2594
2595		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2596			prot = IEEE80211_PROT_RTSCTS;
2597		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2598		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2599			prot = ic->ic_protmode;
2600		if (prot != IEEE80211_PROT_NONE) {
2601			ural_tx_prot(sc, m, ni, prot, rate);
2602			flags |= RAL_TX_IFS_SIFS;
2603		}
2604		flags |= RAL_TX_ACK;
2605		flags |= RAL_TX_RETRY(7);
2606
2607		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2608		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2609		USETW(wh->i_dur, dur);
2610	}
2611	m->m_pkthdr.rcvif = (void *)ni;
2612	ural_setup_desc_and_tx(sc, m, flags, rate);
2613}
2614
2615static void
2616ural_tx_prot(struct ural_softc *sc,
2617    const struct mbuf *m, struct ieee80211_node *ni,
2618    uint8_t prot, uint16_t rate)
2619{
2620	struct ieee80211com *ic = ni->ni_ic;
2621	const struct ieee80211_frame *wh;
2622	struct mbuf *mprot;
2623	uint32_t flags;
2624	uint16_t protrate;
2625	uint16_t ackrate;
2626	uint16_t pktlen;
2627	uint16_t dur;
2628	uint8_t isshort;
2629
2630	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2631	    (prot == IEEE80211_PROT_CTSONLY),
2632	    ("protection %u", prot));
2633
2634	DPRINTFN(16, "Sending protection frame.\n");
2635
2636	wh = mtod(m, const struct ieee80211_frame *);
2637	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2638
2639	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2640	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2641
2642	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2643	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2644	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2645	flags = RAL_TX_RETRY(7);
2646	if (prot == IEEE80211_PROT_RTSCTS) {
2647		/* NB: CTS is the same size as an ACK */
2648		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2649		flags |= RAL_TX_ACK;
2650		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2651	} else {
2652		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2653	}
2654	if (mprot == NULL) {
2655		return;
2656	}
2657	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2658	ural_setup_desc_and_tx(sc, mprot, flags, protrate);
2659}
2660
2661static void
2662ural_tx_raw(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2663    const struct ieee80211_bpf_params *params)
2664{
2665	uint32_t flags;
2666	uint16_t rate;
2667
2668	DPRINTFN(11, "Sending raw frame.\n");
2669
2670	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2671
2672	/* XXX validate */
2673	if (rate == 0) {
2674		m_freem(m);
2675		ieee80211_free_node(ni);
2676		return;
2677	}
2678	flags = 0;
2679	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2680		flags |= RAL_TX_ACK;
2681	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2682		ural_tx_prot(sc, m, ni,
2683		    (params->ibp_flags & IEEE80211_BPF_RTS) ?
2684		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2685		    rate);
2686		flags |= RAL_TX_IFS_SIFS;
2687	}
2688	m->m_pkthdr.rcvif = (void *)ni;
2689	ural_setup_desc_and_tx(sc, m, flags, rate);
2690}
2691
2692static int
2693ural_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2694    const struct ieee80211_bpf_params *params)
2695{
2696	struct ieee80211com *ic = ni->ni_ic;
2697	struct ifnet *ifp = ic->ic_ifp;
2698	struct ural_softc *sc = ifp->if_softc;
2699
2700	mtx_lock(&sc->sc_mtx);
2701	if (params == NULL) {
2702		/*
2703		 * Legacy path; interpret frame contents to decide
2704		 * precisely how to send the frame.
2705		 */
2706		ural_tx_mgt(sc, m, ni);
2707	} else {
2708		/*
2709		 * Caller supplied explicit parameters to use in
2710		 * sending the frame.
2711		 */
2712		ural_tx_raw(sc, m, ni, params);
2713	}
2714	mtx_unlock(&sc->sc_mtx);
2715	return (0);
2716}
2717
2718static void
2719ural_update_mcast_cb(struct ifnet *ifp)
2720{
2721	/* not supported */
2722}
2723
2724static void
2725ural_update_promisc_cb(struct ifnet *ifp)
2726{
2727	struct ural_softc *sc = ifp->if_softc;
2728
2729	mtx_lock(&sc->sc_mtx);
2730	usb2_config_td_queue_command
2731	    (&sc->sc_config_td, &ural_config_copy,
2732	    &ural_cfg_update_promisc, 0, 0);
2733	mtx_unlock(&sc->sc_mtx);
2734}
2735