if_ural.c revision 185948
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 185948 2008-12-11 23:13:02Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 *
22 */
23
24/*
25 *
26 * NOTE: all function names beginning like "ural_cfg_" can only
27 * be called from within the config thread function !
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 185948 2008-12-11 23:13:02Z thompsa $");
32
33/*-
34 * Ralink Technology RT2500USB chipset driver
35 * http://www.ralinktech.com/
36 */
37
38#include <dev/usb2/include/usb2_devid.h>
39#include <dev/usb2/include/usb2_standard.h>
40#include <dev/usb2/include/usb2_mfunc.h>
41#include <dev/usb2/include/usb2_error.h>
42
43#define	usb2_config_td_cc ural_config_copy
44#define	usb2_config_td_softc ural_softc
45
46#define	USB_DEBUG_VAR ural_debug
47
48#include <dev/usb2/core/usb2_core.h>
49#include <dev/usb2/core/usb2_lookup.h>
50#include <dev/usb2/core/usb2_process.h>
51#include <dev/usb2/core/usb2_config_td.h>
52#include <dev/usb2/core/usb2_debug.h>
53#include <dev/usb2/core/usb2_request.h>
54#include <dev/usb2/core/usb2_busdma.h>
55#include <dev/usb2/core/usb2_util.h>
56
57#include <dev/usb2/wlan/usb2_wlan.h>
58#include <dev/usb2/wlan/if_ural2_reg.h>
59#include <dev/usb2/wlan/if_ural2_var.h>
60
61#if USB_DEBUG
62static int ural_debug = 0;
63
64SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
65SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
66    "Debug level");
67#endif
68
69#define	URAL_RSSI(rssi)	\
70  ((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ? \
71   ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
72
73/* prototypes */
74
75static device_probe_t ural_probe;
76static device_attach_t ural_attach;
77static device_detach_t ural_detach;
78
79static usb2_callback_t ural_bulk_read_callback;
80static usb2_callback_t ural_bulk_read_clear_stall_callback;
81static usb2_callback_t ural_bulk_write_callback;
82static usb2_callback_t ural_bulk_write_clear_stall_callback;
83
84static usb2_config_td_command_t ural_cfg_first_time_setup;
85static usb2_config_td_command_t ural_config_copy;
86static usb2_config_td_command_t ural_cfg_scan_start;
87static usb2_config_td_command_t ural_cfg_scan_end;
88static usb2_config_td_command_t ural_cfg_set_chan;
89static usb2_config_td_command_t ural_cfg_enable_tsf_sync;
90static usb2_config_td_command_t ural_cfg_update_slot;
91static usb2_config_td_command_t ural_cfg_set_txpreamble;
92static usb2_config_td_command_t ural_cfg_update_promisc;
93static usb2_config_td_command_t ural_cfg_pre_init;
94static usb2_config_td_command_t ural_cfg_init;
95static usb2_config_td_command_t ural_cfg_pre_stop;
96static usb2_config_td_command_t ural_cfg_stop;
97static usb2_config_td_command_t ural_cfg_amrr_timeout;
98static usb2_config_td_command_t ural_cfg_newstate;
99
100static void	ural_cfg_do_request(struct ural_softc *,
101		    struct usb2_device_request *, void *);
102static void	ural_cfg_set_testmode(struct ural_softc *);
103static void	ural_cfg_eeprom_read(struct ural_softc *, uint16_t, void *,
104		    uint16_t);
105static uint16_t	ural_cfg_read(struct ural_softc *, uint16_t);
106static void	ural_cfg_read_multi(struct ural_softc *, uint16_t, void *,
107		    uint16_t);
108static void	ural_cfg_write(struct ural_softc *, uint16_t, uint16_t);
109static void	ural_cfg_write_multi(struct ural_softc *, uint16_t, void *,
110		    uint16_t);
111static void	ural_cfg_bbp_write(struct ural_softc *, uint8_t, uint8_t);
112static uint8_t	ural_cfg_bbp_read(struct ural_softc *, uint8_t);
113static void	ural_cfg_rf_write(struct ural_softc *, uint8_t, uint32_t);
114static void	ural_end_of_commands(struct ural_softc *);
115static const char *ural_get_rf(int rev);
116static void	ural_watchdog(void *);
117static void	ural_init_cb(void *);
118static int	ural_ioctl_cb(struct ifnet *, u_long cmd, caddr_t data);
119static void	ural_start_cb(struct ifnet *);
120static int	ural_newstate_cb(struct ieee80211vap *,
121		    enum ieee80211_state, int);
122static void	ural_std_command(struct ieee80211com *,
123		    usb2_config_td_command_t *);
124static void	ural_scan_start_cb(struct ieee80211com *);
125static void	ural_scan_end_cb(struct ieee80211com *);
126static void	ural_set_channel_cb(struct ieee80211com *);
127static void	ural_cfg_disable_rf_tune(struct ural_softc *);
128static void	ural_cfg_set_bssid(struct ural_softc *, uint8_t *);
129static void	ural_cfg_set_macaddr(struct ural_softc *, uint8_t *);
130static void	ural_cfg_set_txantenna(struct ural_softc *, uint8_t);
131static void	ural_cfg_set_rxantenna(struct ural_softc *, uint8_t);
132static void	ural_cfg_read_eeprom(struct ural_softc *);
133static uint8_t	ural_cfg_bbp_init(struct ural_softc *);
134static void	ural_cfg_amrr_start(struct ural_softc *);
135static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
136		    const char name[IFNAMSIZ], int unit, int opmode, int flags,
137		    const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t
138		    mac[IEEE80211_ADDR_LEN]);
139static void	ural_vap_delete(struct ieee80211vap *);
140static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
141		    const uint8_t mac[IEEE80211_ADDR_LEN]);
142static void	ural_newassoc(struct ieee80211_node *, int);
143static void	ural_cfg_disable_tsf_sync(struct ural_softc *);
144static void	ural_cfg_set_run(struct ural_softc *,
145		    struct usb2_config_td_cc *);
146static void	ural_fill_write_queue(struct ural_softc *);
147static void	ural_tx_clean_queue(struct ural_softc *);
148static void	ural_tx_freem(struct mbuf *);
149static void	ural_tx_mgt(struct ural_softc *, struct mbuf *,
150		    struct ieee80211_node *);
151static struct ieee80211vap *ural_get_vap(struct ural_softc *);
152static void	ural_tx_bcn(struct ural_softc *);
153static void	ural_tx_data(struct ural_softc *, struct mbuf *,
154		    struct ieee80211_node *);
155static void	ural_tx_prot(struct ural_softc *, const struct mbuf *,
156		    struct ieee80211_node *, uint8_t, uint16_t);
157static void	ural_tx_raw(struct ural_softc *, struct mbuf *,
158		    struct ieee80211_node *,
159		    const struct ieee80211_bpf_params *);
160static int	ural_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
161		    const struct ieee80211_bpf_params *);
162static void	ural_setup_desc_and_tx(struct ural_softc *, struct mbuf *,
163		    uint32_t, uint16_t);
164static void	ural_update_mcast_cb(struct ifnet *);
165static void	ural_update_promisc_cb(struct ifnet *);
166
167/* various supported device vendors/products */
168static const struct usb2_device_id ural_devs[] = {
169	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G, 0)},
170	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570, 0)},
171	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050, 0)},
172	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051, 0)},
173	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS, 0)},
174	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G, 0)},
175	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP, 0)},
176	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU, 0)},
177	{USB_VPI(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122, 0)},
178	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G, 0)},
179	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG, 0)},
180	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254, 0)},
181	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54, 0)},
182	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI, 0)},
183	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB, 0)},
184	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI, 0)},
185	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570, 0)},
186	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2, 0)},
187	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3, 0)},
188	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902, 0)},
189	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570, 0)},
190	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2, 0)},
191	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3, 0)},
192	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2573, 0)},
193	{USB_VPI(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G, 0)},
194	{USB_VPI(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG, 0)},
195	{USB_VPI(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R, 0)},
196	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570, 0)},
197	{USB_VPI(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570, 0)},
198	{USB_VPI(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570, 0)},
199};
200
201/*
202 * Default values for MAC registers; values taken from
203 * the reference driver:
204 */
205struct ural_def_mac {
206	uint16_t reg;
207	uint16_t val;
208};
209
210static const struct ural_def_mac ural_def_mac[] = {
211	{RAL_TXRX_CSR5, 0x8c8d},
212	{RAL_TXRX_CSR6, 0x8b8a},
213	{RAL_TXRX_CSR7, 0x8687},
214	{RAL_TXRX_CSR8, 0x0085},
215	{RAL_MAC_CSR13, 0x1111},
216	{RAL_MAC_CSR14, 0x1e11},
217	{RAL_TXRX_CSR21, 0xe78f},
218	{RAL_MAC_CSR9, 0xff1d},
219	{RAL_MAC_CSR11, 0x0002},
220	{RAL_MAC_CSR22, 0x0053},
221	{RAL_MAC_CSR15, 0x0000},
222	{RAL_MAC_CSR8, RAL_FRAME_SIZE},
223	{RAL_TXRX_CSR19, 0x0000},
224	{RAL_TXRX_CSR18, 0x005a},
225	{RAL_PHY_CSR2, 0x0000},
226	{RAL_TXRX_CSR0, 0x1ec0},
227	{RAL_PHY_CSR4, 0x000f}
228};
229
230/*
231 * Default values for BBP registers; values taken from the reference driver.
232 */
233struct ural_def_bbp {
234	uint8_t	reg;
235	uint8_t	val;
236};
237
238static const struct ural_def_bbp ural_def_bbp[] = {
239	{3, 0x02},
240	{4, 0x19},
241	{14, 0x1c},
242	{15, 0x30},
243	{16, 0xac},
244	{17, 0x48},
245	{18, 0x18},
246	{19, 0xff},
247	{20, 0x1e},
248	{21, 0x08},
249	{22, 0x08},
250	{23, 0x08},
251	{24, 0x80},
252	{25, 0x50},
253	{26, 0x08},
254	{27, 0x23},
255	{30, 0x10},
256	{31, 0x2b},
257	{32, 0xb9},
258	{34, 0x12},
259	{35, 0x50},
260	{39, 0xc4},
261	{40, 0x02},
262	{41, 0x60},
263	{53, 0x10},
264	{54, 0x18},
265	{56, 0x08},
266	{57, 0x10},
267	{58, 0x08},
268	{61, 0x60},
269	{62, 0x10},
270	{75, 0xff}
271};
272
273/*
274 * Default values for RF register R2 indexed by channel numbers.
275 */
276static const uint32_t ural_rf2522_r2[] = {
277	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
278	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
279};
280
281static const uint32_t ural_rf2523_r2[] = {
282	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
283	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
284};
285
286static const uint32_t ural_rf2524_r2[] = {
287	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
288	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
289};
290
291static const uint32_t ural_rf2525_r2[] = {
292	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
293	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
294};
295
296static const uint32_t ural_rf2525_hi_r2[] = {
297	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
298	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
299};
300
301static const uint32_t ural_rf2525e_r2[] = {
302	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
303	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
304};
305
306static const uint32_t ural_rf2526_hi_r2[] = {
307	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
308	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
309};
310
311static const uint32_t ural_rf2526_r2[] = {
312	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
313	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
314};
315
316/*
317 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
318 * values taken from the reference driver.
319 */
320struct ural_rf5222 {
321	uint8_t	chan;
322	uint32_t r1;
323	uint32_t r2;
324	uint32_t r4;
325};
326
327static const struct ural_rf5222 ural_rf5222[] = {
328	{1, 0x08808, 0x0044d, 0x00282},
329	{2, 0x08808, 0x0044e, 0x00282},
330	{3, 0x08808, 0x0044f, 0x00282},
331	{4, 0x08808, 0x00460, 0x00282},
332	{5, 0x08808, 0x00461, 0x00282},
333	{6, 0x08808, 0x00462, 0x00282},
334	{7, 0x08808, 0x00463, 0x00282},
335	{8, 0x08808, 0x00464, 0x00282},
336	{9, 0x08808, 0x00465, 0x00282},
337	{10, 0x08808, 0x00466, 0x00282},
338	{11, 0x08808, 0x00467, 0x00282},
339	{12, 0x08808, 0x00468, 0x00282},
340	{13, 0x08808, 0x00469, 0x00282},
341	{14, 0x08808, 0x0046b, 0x00286},
342
343	{36, 0x08804, 0x06225, 0x00287},
344	{40, 0x08804, 0x06226, 0x00287},
345	{44, 0x08804, 0x06227, 0x00287},
346	{48, 0x08804, 0x06228, 0x00287},
347	{52, 0x08804, 0x06229, 0x00287},
348	{56, 0x08804, 0x0622a, 0x00287},
349	{60, 0x08804, 0x0622b, 0x00287},
350	{64, 0x08804, 0x0622c, 0x00287},
351
352	{100, 0x08804, 0x02200, 0x00283},
353	{104, 0x08804, 0x02201, 0x00283},
354	{108, 0x08804, 0x02202, 0x00283},
355	{112, 0x08804, 0x02203, 0x00283},
356	{116, 0x08804, 0x02204, 0x00283},
357	{120, 0x08804, 0x02205, 0x00283},
358	{124, 0x08804, 0x02206, 0x00283},
359	{128, 0x08804, 0x02207, 0x00283},
360	{132, 0x08804, 0x02208, 0x00283},
361	{136, 0x08804, 0x02209, 0x00283},
362	{140, 0x08804, 0x0220a, 0x00283},
363
364	{149, 0x08808, 0x02429, 0x00281},
365	{153, 0x08808, 0x0242b, 0x00281},
366	{157, 0x08808, 0x0242d, 0x00281},
367	{161, 0x08808, 0x0242f, 0x00281}
368};
369
370static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
371	[0] = {
372		.type = UE_BULK,
373		.endpoint = UE_ADDR_ANY,
374		.direction = UE_DIR_OUT,
375		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
376		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
377		.mh.callback = &ural_bulk_write_callback,
378		.mh.timeout = 5000,	/* ms */
379	},
380
381	[1] = {
382		.type = UE_BULK,
383		.endpoint = UE_ADDR_ANY,
384		.direction = UE_DIR_IN,
385		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
386		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
387		.mh.callback = &ural_bulk_read_callback,
388	},
389
390	[2] = {
391		.type = UE_CONTROL,
392		.endpoint = 0x00,	/* Control pipe */
393		.direction = UE_DIR_ANY,
394		.mh.bufsize = sizeof(struct usb2_device_request),
395		.mh.callback = &ural_bulk_write_clear_stall_callback,
396		.mh.timeout = 1000,	/* 1 second */
397		.mh.interval = 50,	/* 50ms */
398	},
399
400	[3] = {
401		.type = UE_CONTROL,
402		.endpoint = 0x00,	/* Control pipe */
403		.direction = UE_DIR_ANY,
404		.mh.bufsize = sizeof(struct usb2_device_request),
405		.mh.callback = &ural_bulk_read_clear_stall_callback,
406		.mh.timeout = 1000,	/* 1 second */
407		.mh.interval = 50,	/* 50ms */
408	},
409};
410
411static devclass_t ural_devclass;
412
413static device_method_t ural_methods[] = {
414	DEVMETHOD(device_probe, ural_probe),
415	DEVMETHOD(device_attach, ural_attach),
416	DEVMETHOD(device_detach, ural_detach),
417	{0, 0}
418};
419
420static driver_t ural_driver = {
421	.name = "ural",
422	.methods = ural_methods,
423	.size = sizeof(struct ural_softc),
424};
425
426DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
427MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
428MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
429MODULE_DEPEND(ural, wlan, 1, 1, 1);
430MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
431
432static int
433ural_probe(device_t dev)
434{
435	struct usb2_attach_arg *uaa = device_get_ivars(dev);
436
437	if (uaa->usb2_mode != USB_MODE_HOST) {
438		return (ENXIO);
439	}
440	if (uaa->info.bConfigIndex != 0) {
441		return (ENXIO);
442	}
443	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX) {
444		return (ENXIO);
445	}
446	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
447}
448
449static int
450ural_attach(device_t dev)
451{
452	struct usb2_attach_arg *uaa = device_get_ivars(dev);
453	struct ural_softc *sc = device_get_softc(dev);
454	int error;
455	uint8_t iface_index;
456
457	if (sc == NULL) {
458		return (ENOMEM);
459	}
460	device_set_usb2_desc(dev);
461
462	mtx_init(&sc->sc_mtx, "ural lock", MTX_NETWORK_LOCK,
463	    MTX_DEF | MTX_RECURSE);
464
465	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
466	    device_get_nameunit(dev));
467
468	sc->sc_udev = uaa->device;
469	sc->sc_unit = device_get_unit(dev);
470
471	usb2_callout_init_mtx(&sc->sc_watchdog,
472	    &sc->sc_mtx, CALLOUT_RETURNUNLOCKED);
473
474	iface_index = RAL_IFACE_INDEX;
475	error = usb2_transfer_setup(uaa->device,
476	    &iface_index, sc->sc_xfer, ural_config,
477	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
478
479	if (error) {
480		device_printf(dev, "could not allocate USB transfers, "
481		    "err=%s\n", usb2_errstr(error));
482		goto detach;
483	}
484	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
485	    &ural_end_of_commands,
486	    sizeof(struct usb2_config_td_cc), 24);
487	if (error) {
488		device_printf(dev, "could not setup config "
489		    "thread!\n");
490		goto detach;
491	}
492	mtx_lock(&sc->sc_mtx);
493
494	/* start setup */
495
496	usb2_config_td_queue_command
497	    (&sc->sc_config_td, NULL, &ural_cfg_first_time_setup, 0, 0);
498
499	/* start watchdog (will exit mutex) */
500
501	ural_watchdog(sc);
502
503	return (0);			/* success */
504
505detach:
506	ural_detach(dev);
507	return (ENXIO);			/* failure */
508}
509
510static int
511ural_detach(device_t dev)
512{
513	struct ural_softc *sc = device_get_softc(dev);
514	struct ieee80211com *ic;
515	struct ifnet *ifp;
516
517	usb2_config_td_drain(&sc->sc_config_td);
518
519	mtx_lock(&sc->sc_mtx);
520
521	usb2_callout_stop(&sc->sc_watchdog);
522
523	ural_cfg_pre_stop(sc, NULL, 0);
524
525	ifp = sc->sc_ifp;
526	ic = ifp->if_l2com;
527
528	mtx_unlock(&sc->sc_mtx);
529
530	/* stop all USB transfers first */
531	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
532
533	/* get rid of any late children */
534	bus_generic_detach(dev);
535
536	if (ifp) {
537		bpfdetach(ifp);
538		ieee80211_ifdetach(ic);
539		if_free(ifp);
540	}
541	usb2_config_td_unsetup(&sc->sc_config_td);
542
543	usb2_callout_drain(&sc->sc_watchdog);
544
545	mtx_destroy(&sc->sc_mtx);
546
547	return (0);
548}
549
550/*========================================================================*
551 * REGISTER READ / WRITE WRAPPER ROUTINES
552 *========================================================================*/
553
554static void
555ural_cfg_do_request(struct ural_softc *sc, struct usb2_device_request *req,
556    void *data)
557{
558	uint16_t length;
559	usb2_error_t err;
560
561repeat:
562
563	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
564		goto error;
565	}
566	err = usb2_do_request_flags
567	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
568
569	if (err) {
570
571		DPRINTF("device request failed, err=%s "
572		    "(ignored)\n", usb2_errstr(err));
573
574		/* wait a little before next try */
575		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
576			goto error;
577		}
578		/* try until we are detached */
579		goto repeat;
580
581error:
582		/* the device has been detached */
583		length = UGETW(req->wLength);
584
585		if ((req->bmRequestType & UT_READ) && length) {
586			bzero(data, length);
587		}
588	}
589	return;
590}
591
592static void
593ural_cfg_set_testmode(struct ural_softc *sc)
594{
595	struct usb2_device_request req;
596
597	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
598	req.bRequest = RAL_VENDOR_REQUEST;
599	USETW(req.wValue, 4);
600	USETW(req.wIndex, 1);
601	USETW(req.wLength, 0);
602
603	ural_cfg_do_request(sc, &req, NULL);
604	return;
605}
606
607static void
608ural_cfg_eeprom_read(struct ural_softc *sc, uint16_t addr,
609    void *buf, uint16_t len)
610{
611	struct usb2_device_request req;
612
613	req.bmRequestType = UT_READ_VENDOR_DEVICE;
614	req.bRequest = RAL_READ_EEPROM;
615	USETW(req.wValue, 0);
616	USETW(req.wIndex, addr);
617	USETW(req.wLength, len);
618
619	ural_cfg_do_request(sc, &req, buf);
620	return;
621}
622
623static uint16_t
624ural_cfg_read(struct ural_softc *sc, uint16_t reg)
625{
626	struct usb2_device_request req;
627	uint16_t val;
628
629	req.bmRequestType = UT_READ_VENDOR_DEVICE;
630	req.bRequest = RAL_READ_MAC;
631	USETW(req.wValue, 0);
632	USETW(req.wIndex, reg);
633	USETW(req.wLength, sizeof(val));
634
635	ural_cfg_do_request(sc, &req, &val);
636
637	return (le16toh(val));
638}
639
640static void
641ural_cfg_read_multi(struct ural_softc *sc, uint16_t reg,
642    void *buf, uint16_t len)
643{
644	struct usb2_device_request req;
645
646	req.bmRequestType = UT_READ_VENDOR_DEVICE;
647	req.bRequest = RAL_READ_MULTI_MAC;
648	USETW(req.wValue, 0);
649	USETW(req.wIndex, reg);
650	USETW(req.wLength, len);
651
652	ural_cfg_do_request(sc, &req, buf);
653	return;
654}
655
656static void
657ural_cfg_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
658{
659	struct usb2_device_request req;
660
661	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
662	req.bRequest = RAL_WRITE_MAC;
663	USETW(req.wValue, val);
664	USETW(req.wIndex, reg);
665	USETW(req.wLength, 0);
666
667	ural_cfg_do_request(sc, &req, NULL);
668	return;
669}
670
671static void
672ural_cfg_write_multi(struct ural_softc *sc, uint16_t reg,
673    void *buf, uint16_t len)
674{
675	struct usb2_device_request req;
676
677	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
678	req.bRequest = RAL_WRITE_MULTI_MAC;
679	USETW(req.wValue, 0);
680	USETW(req.wIndex, reg);
681	USETW(req.wLength, len);
682
683	ural_cfg_do_request(sc, &req, buf);
684	return;
685}
686
687static uint8_t
688ural_cfg_bbp_disbusy(struct ural_softc *sc)
689{
690	uint16_t tmp;
691	uint8_t to;
692
693	for (to = 0;; to++) {
694		if (to < 100) {
695			tmp = ural_cfg_read(sc, RAL_PHY_CSR8);
696			tmp &= RAL_BBP_BUSY;
697
698			if (tmp == 0) {
699				return (0);
700			}
701			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
702				break;
703			}
704		} else {
705			break;
706		}
707	}
708	DPRINTF("could not disbusy BBP\n");
709	return (1);			/* failure */
710}
711
712static void
713ural_cfg_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
714{
715	uint16_t tmp;
716
717	if (ural_cfg_bbp_disbusy(sc)) {
718		return;
719	}
720	tmp = (reg << 8) | val;
721	ural_cfg_write(sc, RAL_PHY_CSR7, tmp);
722	return;
723}
724
725static uint8_t
726ural_cfg_bbp_read(struct ural_softc *sc, uint8_t reg)
727{
728	uint16_t val;
729
730	if (ural_cfg_bbp_disbusy(sc)) {
731		return (0);
732	}
733	val = RAL_BBP_WRITE | (reg << 8);
734	ural_cfg_write(sc, RAL_PHY_CSR7, val);
735
736	if (ural_cfg_bbp_disbusy(sc)) {
737		return (0);
738	}
739	return (ural_cfg_read(sc, RAL_PHY_CSR7) & 0xff);
740}
741
742static void
743ural_cfg_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
744{
745	uint32_t tmp;
746	uint8_t to;
747
748	reg &= 3;
749
750	/* remember last written value */
751	sc->sc_rf_regs[reg] = val;
752
753	for (to = 0;; to++) {
754		if (to < 100) {
755			tmp = ural_cfg_read(sc, RAL_PHY_CSR10);
756
757			if (!(tmp & RAL_RF_LOBUSY)) {
758				break;
759			}
760			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
761				return;
762			}
763		} else {
764			DPRINTF("could not write to RF\n");
765			return;
766		}
767	}
768
769	tmp = RAL_RF_BUSY | RAL_RF_20BIT | ((val & 0xfffff) << 2) | reg;
770	ural_cfg_write(sc, RAL_PHY_CSR9, tmp & 0xffff);
771	ural_cfg_write(sc, RAL_PHY_CSR10, tmp >> 16);
772
773	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
774	return;
775}
776
777static void
778ural_cfg_first_time_setup(struct ural_softc *sc,
779    struct usb2_config_td_cc *cc, uint16_t refcount)
780{
781	struct ieee80211com *ic;
782	struct ifnet *ifp;
783	uint8_t bands;
784
785	/* setup RX tap header */
786	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
787	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
788	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
789
790	/* setup TX tap header */
791	sc->sc_txtap_len = sizeof(sc->sc_txtap);
792	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
793	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
794
795	/* retrieve RT2570 rev. no */
796	sc->sc_asic_rev = ural_cfg_read(sc, RAL_MAC_CSR0);
797
798	/* retrieve MAC address and various other things from EEPROM */
799	ural_cfg_read_eeprom(sc);
800
801	printf("%s: MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
802	    sc->sc_name, sc->sc_asic_rev, ural_get_rf(sc->sc_rf_rev));
803
804	mtx_unlock(&sc->sc_mtx);
805
806	ifp = if_alloc(IFT_IEEE80211);
807
808	mtx_lock(&sc->sc_mtx);
809
810	if (ifp == NULL) {
811		DPRINTFN(0, "could not if_alloc()!\n");
812		goto done;
813	}
814	sc->sc_evilhack = ifp;
815	sc->sc_ifp = ifp;
816	ic = ifp->if_l2com;
817
818	ifp->if_softc = sc;
819	if_initname(ifp, "ural", sc->sc_unit);
820	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
821	ifp->if_init = &ural_init_cb;
822	ifp->if_ioctl = &ural_ioctl_cb;
823	ifp->if_start = &ural_start_cb;
824	ifp->if_watchdog = NULL;
825	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
826	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
827	IFQ_SET_READY(&ifp->if_snd);
828
829	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
830
831	ic->ic_ifp = ifp;
832	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
833	ic->ic_opmode = IEEE80211_M_STA;
834
835	/* set device capabilities */
836	ic->ic_caps =
837	    IEEE80211_C_STA		/* station mode supported */
838	    | IEEE80211_C_IBSS		/* IBSS mode supported */
839	    | IEEE80211_C_MONITOR	/* monitor mode supported */
840	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
841	    | IEEE80211_C_TXPMGT	/* tx power management */
842	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
843	    | IEEE80211_C_SHSLOT	/* short slot time supported */
844	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
845	    | IEEE80211_C_WPA		/* 802.11i */
846	    ;
847
848	bands = 0;
849	setbit(&bands, IEEE80211_MODE_11B);
850	setbit(&bands, IEEE80211_MODE_11G);
851
852	if (sc->sc_rf_rev == RAL_RF_5222) {
853		setbit(&bands, IEEE80211_MODE_11A);
854	}
855	ieee80211_init_channels(ic, NULL, &bands);
856
857	mtx_unlock(&sc->sc_mtx);
858
859	ieee80211_ifattach(ic);
860
861	mtx_lock(&sc->sc_mtx);
862
863	ic->ic_newassoc = &ural_newassoc;
864	ic->ic_raw_xmit = &ural_raw_xmit_cb;
865	ic->ic_node_alloc = &ural_node_alloc;
866	ic->ic_update_mcast = &ural_update_mcast_cb;
867	ic->ic_update_promisc = &ural_update_promisc_cb;
868	ic->ic_scan_start = &ural_scan_start_cb;
869	ic->ic_scan_end = &ural_scan_end_cb;
870	ic->ic_set_channel = &ural_set_channel_cb;
871	ic->ic_vap_create = &ural_vap_create;
872	ic->ic_vap_delete = &ural_vap_delete;
873
874	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
875
876	mtx_unlock(&sc->sc_mtx);
877
878	bpfattach(ifp, DLT_IEEE802_11_RADIO,
879	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
880
881	if (bootverbose) {
882		ieee80211_announce(ic);
883	}
884	mtx_lock(&sc->sc_mtx);
885done:
886	return;
887}
888
889static void
890ural_end_of_commands(struct ural_softc *sc)
891{
892	sc->sc_flags &= ~URAL_FLAG_WAIT_COMMAND;
893
894	/* start write transfer, if not started */
895	usb2_transfer_start(sc->sc_xfer[0]);
896	return;
897}
898
899static void
900ural_config_copy_chan(struct ural_config_copy_chan *cc,
901    struct ieee80211com *ic, struct ieee80211_channel *c)
902{
903	if (!c)
904		return;
905	cc->chan_to_ieee =
906	    ieee80211_chan2ieee(ic, c);
907	if (c != IEEE80211_CHAN_ANYC) {
908		cc->chan_to_mode =
909		    ieee80211_chan2mode(c);
910		if (IEEE80211_IS_CHAN_B(c))
911			cc->chan_is_b = 1;
912		if (IEEE80211_IS_CHAN_A(c))
913			cc->chan_is_a = 1;
914		if (IEEE80211_IS_CHAN_2GHZ(c))
915			cc->chan_is_2ghz = 1;
916		if (IEEE80211_IS_CHAN_5GHZ(c))
917			cc->chan_is_5ghz = 1;
918		if (IEEE80211_IS_CHAN_ANYG(c))
919			cc->chan_is_g = 1;
920	}
921	return;
922}
923
924static void
925ural_config_copy(struct ural_softc *sc,
926    struct usb2_config_td_cc *cc, uint16_t refcount)
927{
928	struct ifnet *ifp;
929	struct ieee80211com *ic;
930	struct ieee80211_node *ni;
931	struct ieee80211vap *vap;
932	const struct ieee80211_txparam *tp;
933
934	bzero(cc, sizeof(*cc));
935
936	ifp = sc->sc_ifp;
937	if (ifp) {
938		cc->if_flags = ifp->if_flags;
939		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
940		    sizeof(cc->if_broadcastaddr));
941
942		ic = ifp->if_l2com;
943		if (ic) {
944			ural_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
945			ural_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
946			vap = TAILQ_FIRST(&ic->ic_vaps);
947			if (vap) {
948				ni = vap->iv_bss;
949				if (ni) {
950					cc->iv_bss.ni_intval = ni->ni_intval;
951					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
952					    sizeof(cc->iv_bss.ni_bssid));
953				}
954				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
955				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
956					cc->iv_bss.fixed_rate_none = 1;
957				}
958			}
959			cc->ic_opmode = ic->ic_opmode;
960			cc->ic_flags = ic->ic_flags;
961			cc->ic_txpowlimit = ic->ic_txpowlimit;
962			cc->ic_curmode = ic->ic_curmode;
963
964			bcopy(ic->ic_myaddr, cc->ic_myaddr,
965			    sizeof(cc->ic_myaddr));
966		}
967	}
968	sc->sc_flags |= URAL_FLAG_WAIT_COMMAND;
969	return;
970}
971
972static const char *
973ural_get_rf(int rev)
974{
975	switch (rev) {
976		case RAL_RF_2522:return "RT2522";
977	case RAL_RF_2523:
978		return "RT2523";
979	case RAL_RF_2524:
980		return "RT2524";
981	case RAL_RF_2525:
982		return "RT2525";
983	case RAL_RF_2525E:
984		return "RT2525e";
985	case RAL_RF_2526:
986		return "RT2526";
987	case RAL_RF_5222:
988		return "RT5222";
989	default:
990		return "unknown";
991	}
992}
993
994/*------------------------------------------------------------------------*
995 * ural_bulk_read_callback - data read "thread"
996 *------------------------------------------------------------------------*/
997static void
998ural_bulk_read_callback(struct usb2_xfer *xfer)
999{
1000	struct ural_softc *sc = xfer->priv_sc;
1001	struct ifnet *ifp = sc->sc_ifp;
1002	struct ieee80211com *ic = ifp->if_l2com;
1003	struct ieee80211_node *ni;
1004	struct mbuf *m = NULL;
1005	uint32_t flags;
1006	uint32_t max_len;
1007	uint32_t real_len;
1008	uint8_t rssi = 0;
1009
1010	switch (USB_GET_STATE(xfer)) {
1011	case USB_ST_TRANSFERRED:
1012
1013		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
1014
1015		if (xfer->actlen < RAL_RX_DESC_SIZE) {
1016			DPRINTF("too short transfer, "
1017			    "%d bytes\n", xfer->actlen);
1018			ifp->if_ierrors++;
1019			goto tr_setup;
1020		}
1021		max_len = (xfer->actlen - RAL_RX_DESC_SIZE);
1022
1023		usb2_copy_out(xfer->frbuffers, max_len,
1024		    &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
1025
1026		flags = le32toh(sc->sc_rx_desc.flags);
1027
1028		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
1029			/*
1030		         * This should not happen since we did not
1031		         * request to receive those frames when we
1032		         * filled RAL_TXRX_CSR2:
1033		         */
1034			DPRINTFN(6, "PHY or CRC error\n");
1035			ifp->if_ierrors++;
1036			goto tr_setup;
1037		}
1038		if (max_len > MCLBYTES) {
1039			max_len = MCLBYTES;
1040		}
1041		real_len = (flags >> 16) & 0xfff;
1042
1043		if (real_len > max_len) {
1044			DPRINTF("invalid length in RX "
1045			    "descriptor, %u bytes, received %u bytes\n",
1046			    real_len, max_len);
1047			ifp->if_ierrors++;
1048			goto tr_setup;
1049		}
1050		/* ieee80211_input() will check if the mbuf is too short */
1051
1052		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1053
1054		if (m == NULL) {
1055			DPRINTF("could not allocate mbuf\n");
1056			ifp->if_ierrors++;
1057			goto tr_setup;
1058		}
1059		usb2_copy_out(xfer->frbuffers, 0, m->m_data, max_len);
1060
1061		/* finalize mbuf */
1062		m->m_pkthdr.rcvif = ifp;
1063		m->m_pkthdr.len = m->m_len = real_len;
1064
1065		DPRINTF("real length=%d bytes\n", real_len);
1066
1067		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
1068
1069		if (bpf_peers_present(ifp->if_bpf)) {
1070			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
1071
1072			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1073			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1074			    (sc->sc_rx_desc.flags & htole32(RAL_RX_OFDM)) ?
1075			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1076
1077			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1078			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1079			tap->wr_antenna = sc->sc_rx_ant;
1080			tap->wr_antsignal = rssi;
1081
1082			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1083		}
1084		/* Strip trailing 802.11 MAC FCS. */
1085		m_adj(m, -IEEE80211_CRC_LEN);
1086
1087	case USB_ST_SETUP:
1088tr_setup:
1089
1090		if (sc->sc_flags & URAL_FLAG_READ_STALL) {
1091			usb2_transfer_start(sc->sc_xfer[3]);
1092		} else {
1093			xfer->frlengths[0] = xfer->max_data_length;
1094			usb2_start_hardware(xfer);
1095		}
1096
1097		/*
1098		 * At the end of a USB callback it is always safe to unlock
1099		 * the private mutex of a device! That is why we do the
1100		 * "ieee80211_input" here, and not some lines up!
1101		 */
1102		if (m) {
1103			mtx_unlock(&sc->sc_mtx);
1104
1105			ni = ieee80211_find_rxnode(ic, (void *)(m->m_data));
1106
1107			if (ni) {
1108				/* send the frame to the 802.11 layer */
1109				if (ieee80211_input(ni, m, rssi, RAL_NOISE_FLOOR, 0)) {
1110					/* ignore */
1111				}
1112				/* node is no longer needed */
1113				ieee80211_free_node(ni);
1114			} else {
1115				/* broadcast */
1116				if (ieee80211_input_all(ic, m, rssi, RAL_NOISE_FLOOR, 0)) {
1117					/* ignore */
1118				}
1119			}
1120
1121			mtx_lock(&sc->sc_mtx);
1122		}
1123		return;
1124
1125	default:			/* Error */
1126		if (xfer->error != USB_ERR_CANCELLED) {
1127			/* try to clear stall first */
1128			sc->sc_flags |= URAL_FLAG_READ_STALL;
1129			usb2_transfer_start(sc->sc_xfer[3]);
1130		}
1131		return;
1132
1133	}
1134}
1135
1136static void
1137ural_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1138{
1139	struct ural_softc *sc = xfer->priv_sc;
1140	struct usb2_xfer *xfer_other = sc->sc_xfer[1];
1141
1142	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1143		DPRINTF("stall cleared\n");
1144		sc->sc_flags &= ~URAL_FLAG_READ_STALL;
1145		usb2_transfer_start(xfer_other);
1146	}
1147	return;
1148}
1149
1150static uint8_t
1151ural_plcp_signal(uint16_t rate)
1152{
1153	;				/* indent fix */
1154	switch (rate) {
1155		/* CCK rates (NB: not IEEE std, device-specific) */
1156	case 2:
1157		return (0x0);
1158	case 4:
1159		return (0x1);
1160	case 11:
1161		return (0x2);
1162	case 22:
1163		return (0x3);
1164
1165		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1166	case 12:
1167		return (0xb);
1168	case 18:
1169		return (0xf);
1170	case 24:
1171		return (0xa);
1172	case 36:
1173		return (0xe);
1174	case 48:
1175		return (0x9);
1176	case 72:
1177		return (0xd);
1178	case 96:
1179		return (0x8);
1180	case 108:
1181		return (0xc);
1182
1183		/* XXX unsupported/unknown rate */
1184	default:
1185		return (0xff);
1186	}
1187}
1188
1189/*
1190 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1191 * should be freed, when "ural_setup_desc_and_tx" is called.
1192 */
1193static void
1194ural_setup_desc_and_tx(struct ural_softc *sc, struct mbuf *m,
1195    uint32_t flags, uint16_t rate)
1196{
1197	struct ifnet *ifp = sc->sc_ifp;
1198	struct ieee80211com *ic = ifp->if_l2com;
1199	struct mbuf *mm;
1200	enum ieee80211_phytype phytype;
1201	uint16_t plcp_length;
1202	uint16_t len;
1203	uint8_t remainder;
1204
1205	DPRINTF("in\n");
1206
1207	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1208		/* free packet */
1209		ural_tx_freem(m);
1210		ifp->if_oerrors++;
1211		return;
1212	}
1213	if (!((sc->sc_flags & URAL_FLAG_LL_READY) &&
1214	    (sc->sc_flags & URAL_FLAG_HL_READY))) {
1215		/* free packet */
1216		ural_tx_freem(m);
1217		ifp->if_oerrors++;
1218		return;
1219	}
1220	if (rate < 2) {
1221		DPRINTF("rate < 2!\n");
1222
1223		/* avoid division by zero */
1224		rate = 2;
1225	}
1226	ic->ic_lastdata = ticks;
1227
1228	if (bpf_peers_present(ifp->if_bpf)) {
1229		struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
1230
1231		tap->wt_flags = 0;
1232		tap->wt_rate = rate;
1233		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1234		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1235		tap->wt_antenna = sc->sc_tx_ant;
1236
1237		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1238	}
1239	len = m->m_pkthdr.len;
1240
1241	sc->sc_tx_desc.flags = htole32(flags);
1242	sc->sc_tx_desc.flags |= htole32(RAL_TX_NEWSEQ);
1243	sc->sc_tx_desc.flags |= htole32(len << 16);
1244
1245	sc->sc_tx_desc.wme = htole16(RAL_AIFSN(2) |
1246	    RAL_LOGCWMIN(3) |
1247	    RAL_LOGCWMAX(5) |
1248	    RAL_IVOFFSET(sizeof(struct ieee80211_frame)));
1249
1250	/* setup PLCP fields */
1251	sc->sc_tx_desc.plcp_signal = ural_plcp_signal(rate);
1252	sc->sc_tx_desc.plcp_service = 4;
1253
1254	len += IEEE80211_CRC_LEN;
1255
1256	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1257
1258	if (phytype == IEEE80211_T_OFDM) {
1259		sc->sc_tx_desc.flags |= htole32(RAL_TX_OFDM);
1260
1261		plcp_length = len & 0xfff;
1262		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1263		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1264
1265	} else {
1266		plcp_length = ((16 * len) + rate - 1) / rate;
1267		if (rate == 22) {
1268			remainder = (16 * len) % 22;
1269			if ((remainder != 0) && (remainder < 7)) {
1270				sc->sc_tx_desc.plcp_service |=
1271				    RAL_PLCP_LENGEXT;
1272			}
1273		}
1274		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1275		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1276
1277		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1278			sc->sc_tx_desc.plcp_signal |= 0x08;
1279		}
1280	}
1281
1282	sc->sc_tx_desc.iv = 0;
1283	sc->sc_tx_desc.eiv = 0;
1284
1285	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1286		DPRINTF("No room for header structure!\n");
1287		ural_tx_freem(m);
1288		return;
1289	}
1290	mm = m_gethdr(M_NOWAIT, MT_DATA);
1291	if (mm == NULL) {
1292		DPRINTF("Could not allocate header mbuf!\n");
1293		ural_tx_freem(m);
1294		return;
1295	}
1296	DPRINTF(" %zu %u (out)\n", sizeof(sc->sc_tx_desc), m->m_pkthdr.len);
1297
1298	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1299	mm->m_len = sizeof(sc->sc_tx_desc);
1300
1301	mm->m_next = m;
1302	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1303	mm->m_pkthdr.rcvif = NULL;
1304
1305	/* start write transfer, if not started */
1306	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1307
1308	usb2_transfer_start(sc->sc_xfer[0]);
1309	return;
1310}
1311
1312static void
1313ural_bulk_write_callback(struct usb2_xfer *xfer)
1314{
1315	struct ural_softc *sc = xfer->priv_sc;
1316	struct ifnet *ifp = sc->sc_ifp;
1317	struct mbuf *m;
1318	uint16_t temp_len;
1319	uint8_t align;
1320
1321	switch (USB_GET_STATE(xfer)) {
1322	case USB_ST_TRANSFERRED:
1323		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
1324
1325		ifp->if_opackets++;
1326
1327	case USB_ST_SETUP:
1328		if (sc->sc_flags & URAL_FLAG_WRITE_STALL) {
1329			usb2_transfer_start(sc->sc_xfer[2]);
1330			break;
1331		}
1332		if (sc->sc_flags & URAL_FLAG_WAIT_COMMAND) {
1333			/*
1334			 * don't send anything while a command is pending !
1335			 */
1336			break;
1337		}
1338		ural_fill_write_queue(sc);
1339
1340		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1341
1342		if (m) {
1343
1344			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
1345				DPRINTFN(0, "data overflow, %u bytes\n",
1346				    m->m_pkthdr.len);
1347				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
1348			}
1349			usb2_m_copy_in(xfer->frbuffers, 0,
1350			    m, 0, m->m_pkthdr.len);
1351
1352			/* compute transfer length */
1353			temp_len = m->m_pkthdr.len;
1354
1355			/* make transfer length 16-bit aligned */
1356			align = (temp_len & 1);
1357
1358			/* check if we need to add two extra bytes */
1359			if (((temp_len + align) % 64) == 0) {
1360				align += 2;
1361			}
1362			/* check if we need to align length */
1363			if (align != 0) {
1364				/* zero the extra bytes */
1365				usb2_bzero(xfer->frbuffers, temp_len, align);
1366				temp_len += align;
1367			}
1368			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
1369			    m->m_pkthdr.len, temp_len);
1370
1371			xfer->frlengths[0] = temp_len;
1372
1373			usb2_start_hardware(xfer);
1374
1375			/* free mbuf and node */
1376			ural_tx_freem(m);
1377		}
1378		break;
1379
1380	default:			/* Error */
1381		DPRINTFN(11, "transfer error, %s\n",
1382		    usb2_errstr(xfer->error));
1383
1384		if (xfer->error != USB_ERR_CANCELLED) {
1385			/* try to clear stall first */
1386			sc->sc_flags |= URAL_FLAG_WRITE_STALL;
1387			usb2_transfer_start(sc->sc_xfer[2]);
1388		}
1389		ifp->if_oerrors++;
1390		break;
1391	}
1392	return;
1393}
1394
1395static void
1396ural_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1397{
1398	struct ural_softc *sc = xfer->priv_sc;
1399	struct usb2_xfer *xfer_other = sc->sc_xfer[0];
1400
1401	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1402		DPRINTF("stall cleared\n");
1403		sc->sc_flags &= ~URAL_FLAG_WRITE_STALL;
1404		usb2_transfer_start(xfer_other);
1405	}
1406	return;
1407}
1408
1409static void
1410ural_watchdog(void *arg)
1411{
1412	struct ural_softc *sc = arg;
1413
1414	mtx_assert(&sc->sc_mtx, MA_OWNED);
1415
1416	if (sc->sc_amrr_timer) {
1417		usb2_config_td_queue_command
1418		    (&sc->sc_config_td, NULL,
1419		    &ural_cfg_amrr_timeout, 0, 0);
1420	}
1421	usb2_callout_reset(&sc->sc_watchdog,
1422	    hz, &ural_watchdog, sc);
1423
1424	mtx_unlock(&sc->sc_mtx);
1425
1426	return;
1427}
1428
1429/*========================================================================*
1430 * IF-net callbacks
1431 *========================================================================*/
1432
1433static void
1434ural_init_cb(void *arg)
1435{
1436	struct ural_softc *sc = arg;
1437
1438	mtx_lock(&sc->sc_mtx);
1439	usb2_config_td_queue_command
1440	    (&sc->sc_config_td, &ural_cfg_pre_init,
1441	    &ural_cfg_init, 0, 0);
1442	mtx_unlock(&sc->sc_mtx);
1443
1444	return;
1445}
1446
1447static int
1448ural_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1449{
1450	struct ural_softc *sc = ifp->if_softc;
1451	struct ieee80211com *ic = ifp->if_l2com;
1452	int error;
1453
1454	switch (cmd) {
1455	case SIOCSIFFLAGS:
1456		mtx_lock(&sc->sc_mtx);
1457		if (ifp->if_flags & IFF_UP) {
1458			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1459				usb2_config_td_queue_command
1460				    (&sc->sc_config_td, &ural_cfg_pre_init,
1461				    &ural_cfg_init, 0, 0);
1462			}
1463		} else {
1464			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1465				usb2_config_td_queue_command
1466				    (&sc->sc_config_td, &ural_cfg_pre_stop,
1467				    &ural_cfg_stop, 0, 0);
1468			}
1469		}
1470		mtx_unlock(&sc->sc_mtx);
1471		error = 0;
1472		break;
1473
1474	case SIOCGIFMEDIA:
1475	case SIOCSIFMEDIA:
1476		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1477		break;
1478
1479	default:
1480		error = ether_ioctl(ifp, cmd, data);
1481	}
1482	return (error);
1483}
1484
1485static void
1486ural_start_cb(struct ifnet *ifp)
1487{
1488	struct ural_softc *sc = ifp->if_softc;
1489
1490	mtx_lock(&sc->sc_mtx);
1491	/* start write transfer, if not started */
1492	usb2_transfer_start(sc->sc_xfer[0]);
1493	mtx_unlock(&sc->sc_mtx);
1494
1495	return;
1496}
1497
1498static void
1499ural_cfg_newstate(struct ural_softc *sc,
1500    struct usb2_config_td_cc *cc, uint16_t refcount)
1501{
1502	struct ifnet *ifp = sc->sc_ifp;
1503	struct ieee80211com *ic = ifp->if_l2com;
1504	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1505	struct ural_vap *uvp = URAL_VAP(vap);
1506	enum ieee80211_state ostate;
1507	enum ieee80211_state nstate;
1508	int arg;
1509
1510	ostate = vap->iv_state;
1511	nstate = sc->sc_ns_state;
1512	arg = sc->sc_ns_arg;
1513
1514	if (ostate == IEEE80211_S_INIT) {
1515		/* We are leaving INIT. TSF sync should be off. */
1516		ural_cfg_disable_tsf_sync(sc);
1517	}
1518	switch (nstate) {
1519	case IEEE80211_S_INIT:
1520		break;
1521
1522	case IEEE80211_S_RUN:
1523		ural_cfg_set_run(sc, cc);
1524		break;
1525
1526	default:
1527		break;
1528	}
1529
1530	mtx_unlock(&sc->sc_mtx);
1531	IEEE80211_LOCK(ic);
1532	uvp->newstate(vap, nstate, arg);
1533	if (vap->iv_newstate_cb != NULL)
1534		vap->iv_newstate_cb(vap, nstate, arg);
1535	IEEE80211_UNLOCK(ic);
1536	mtx_lock(&sc->sc_mtx);
1537	return;
1538}
1539
1540static int
1541ural_newstate_cb(struct ieee80211vap *vap,
1542    enum ieee80211_state nstate, int arg)
1543{
1544	struct ural_vap *uvp = URAL_VAP(vap);
1545	struct ieee80211com *ic = vap->iv_ic;
1546	struct ural_softc *sc = ic->ic_ifp->if_softc;
1547
1548	DPRINTF("setting new state: %d\n", nstate);
1549
1550	/* Special case - cannot defer this call and cannot block ! */
1551	if (nstate == IEEE80211_S_INIT) {
1552		/* stop timers */
1553		mtx_lock(&sc->sc_mtx);
1554		sc->sc_amrr_timer = 0;
1555		mtx_unlock(&sc->sc_mtx);
1556		return (uvp->newstate(vap, nstate, arg));
1557	}
1558	mtx_lock(&sc->sc_mtx);
1559	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1560		mtx_unlock(&sc->sc_mtx);
1561		return (0);		/* nothing to do */
1562	}
1563	/* store next state */
1564	sc->sc_ns_state = nstate;
1565	sc->sc_ns_arg = arg;
1566
1567	/* stop timers */
1568	sc->sc_amrr_timer = 0;
1569
1570	/*
1571	 * USB configuration can only be done from the USB configuration
1572	 * thread:
1573	 */
1574	usb2_config_td_queue_command
1575	    (&sc->sc_config_td, &ural_config_copy,
1576	    &ural_cfg_newstate, 0, 0);
1577
1578	mtx_unlock(&sc->sc_mtx);
1579
1580	return (EINPROGRESS);
1581}
1582
1583static void
1584ural_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1585{
1586	struct ural_softc *sc = ic->ic_ifp->if_softc;
1587
1588	mtx_lock(&sc->sc_mtx);
1589
1590	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1591
1592	usb2_config_td_queue_command
1593	    (&sc->sc_config_td, &ural_config_copy, func, 0, 0);
1594
1595	mtx_unlock(&sc->sc_mtx);
1596
1597	return;
1598}
1599
1600static void
1601ural_scan_start_cb(struct ieee80211com *ic)
1602{
1603	ural_std_command(ic, &ural_cfg_scan_start);
1604	return;
1605}
1606
1607static void
1608ural_scan_end_cb(struct ieee80211com *ic)
1609{
1610	ural_std_command(ic, &ural_cfg_scan_end);
1611	return;
1612}
1613
1614static void
1615ural_set_channel_cb(struct ieee80211com *ic)
1616{
1617	ural_std_command(ic, &ural_cfg_set_chan);
1618	return;
1619}
1620
1621/*========================================================================*
1622 * configure sub-routines, ural_cfg_xxx
1623 *========================================================================*/
1624
1625static void
1626ural_cfg_scan_start(struct ural_softc *sc,
1627    struct usb2_config_td_cc *cc, uint16_t refcount)
1628{
1629	/* abort TSF synchronization */
1630	ural_cfg_disable_tsf_sync(sc);
1631	ural_cfg_set_bssid(sc, cc->if_broadcastaddr);
1632	return;
1633}
1634
1635static void
1636ural_cfg_scan_end(struct ural_softc *sc,
1637    struct usb2_config_td_cc *cc, uint16_t refcount)
1638{
1639	/* enable TSF synchronization */
1640	ural_cfg_enable_tsf_sync(sc, cc, 0);
1641	ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1642	return;
1643}
1644
1645static void
1646ural_cfg_set_chan(struct ural_softc *sc,
1647    struct usb2_config_td_cc *cc, uint16_t refcount)
1648{
1649	enum {
1650		N_RF5222 = (sizeof(ural_rf5222) / sizeof(ural_rf5222[0])),
1651	};
1652	uint32_t i;
1653	uint32_t chan;
1654	uint8_t power;
1655	uint8_t tmp;
1656
1657	chan = cc->ic_curchan.chan_to_ieee;
1658
1659	if ((chan == 0) ||
1660	    (chan == IEEE80211_CHAN_ANY)) {
1661		/* nothing to do */
1662		return;
1663	}
1664	if (cc->ic_curchan.chan_is_2ghz)
1665		power = min(sc->sc_txpow[chan - 1], 31);
1666	else
1667		power = 31;
1668
1669	/* adjust txpower using ifconfig settings */
1670	power -= (100 - cc->ic_txpowlimit) / 8;
1671
1672	DPRINTFN(3, "setting channel to %u, "
1673	    "tx-power to %u\n", chan, power);
1674
1675	switch (sc->sc_rf_rev) {
1676	case RAL_RF_2522:
1677		ural_cfg_rf_write(sc, RAL_RF1, 0x00814);
1678		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1679		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1680		break;
1681
1682	case RAL_RF_2523:
1683		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1684		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1685		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x38044);
1686		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1687		break;
1688
1689	case RAL_RF_2524:
1690		ural_cfg_rf_write(sc, RAL_RF1, 0x0c808);
1691		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1692		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1693		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1694		break;
1695
1696	case RAL_RF_2525:
1697		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1698		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1699		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1700		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1701
1702		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1703		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1704		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1705		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1706		break;
1707
1708	case RAL_RF_2525E:
1709		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1710		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1711		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1712		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1713		break;
1714
1715	case RAL_RF_2526:
1716		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1717		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1718		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1719
1720		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1721		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1722		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1723		break;
1724
1725		/* dual-band RF */
1726	case RAL_RF_5222:
1727		for (i = 0; i < N_RF5222; i++) {
1728			if (ural_rf5222[i].chan == chan) {
1729				ural_cfg_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1730				ural_cfg_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1731				ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1732				ural_cfg_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1733				break;
1734			}
1735		}
1736		break;
1737	}
1738
1739	if ((cc->ic_opmode != IEEE80211_M_MONITOR) &&
1740	    (!(cc->ic_flags & IEEE80211_F_SCAN))) {
1741
1742		/* set Japan filter bit for channel 14 */
1743		tmp = ural_cfg_bbp_read(sc, 70);
1744
1745		if (chan == 14) {
1746			tmp |= RAL_JAPAN_FILTER;
1747		} else {
1748			tmp &= ~RAL_JAPAN_FILTER;
1749		}
1750
1751		ural_cfg_bbp_write(sc, 70, tmp);
1752
1753		/* clear CRC errors */
1754		ural_cfg_read(sc, RAL_STA_CSR0);
1755
1756		ural_cfg_disable_rf_tune(sc);
1757	}
1758	/* update basic rate set */
1759	if (cc->ic_curchan.chan_is_b) {
1760		/* 11b basic rates: 1, 2Mbps */
1761		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1762	} else if (cc->ic_curchan.chan_is_a) {
1763		/* 11a basic rates: 6, 12, 24Mbps */
1764		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1765	} else {
1766		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1767		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1768	}
1769
1770	/* wait a little */
1771	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1772		return;
1773	}
1774	return;
1775}
1776
1777static void
1778ural_cfg_set_run(struct ural_softc *sc,
1779    struct usb2_config_td_cc *cc)
1780{
1781	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1782		ural_cfg_update_slot(sc, cc, 0);
1783		ural_cfg_set_txpreamble(sc, cc, 0);
1784
1785		/* update basic rate set */
1786
1787		if (cc->ic_bsschan.chan_is_5ghz) {
1788			/* 11a basic rates: 6, 12, 24Mbps */
1789			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1790		} else if (cc->ic_bsschan.chan_is_g) {
1791			/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1792			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1793		} else {
1794			/* 11b basic rates: 1, 2Mbps */
1795			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1796		}
1797		ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1798	}
1799	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1800	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1801		ural_tx_bcn(sc);
1802	}
1803	/* make tx led blink on tx (controlled by ASIC) */
1804	ural_cfg_write(sc, RAL_MAC_CSR20, 1);
1805
1806	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1807		ural_cfg_enable_tsf_sync(sc, cc, 0);
1808	}
1809	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1810	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
1811
1812	if (cc->iv_bss.fixed_rate_none) {
1813		/* enable automatic rate adaptation */
1814		ural_cfg_amrr_start(sc);
1815	}
1816	return;
1817}
1818
1819/*------------------------------------------------------------------------*
1820 * ural_cfg_disable_rf_tune - disable RF auto-tuning
1821 *------------------------------------------------------------------------*/
1822static void
1823ural_cfg_disable_rf_tune(struct ural_softc *sc)
1824{
1825	uint32_t tmp;
1826
1827	if (sc->sc_rf_rev != RAL_RF_2523) {
1828		tmp = sc->sc_rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1829		ural_cfg_rf_write(sc, RAL_RF1, tmp);
1830	}
1831	tmp = sc->sc_rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1832	ural_cfg_rf_write(sc, RAL_RF3, tmp);
1833
1834	DPRINTFN(3, "disabling RF autotune\n");
1835
1836	return;
1837}
1838
1839/*------------------------------------------------------------------------*
1840 * ural_cfg_enable_tsf_sync - refer to IEEE Std 802.11-1999 pp. 123
1841 * for more information on TSF synchronization
1842 *------------------------------------------------------------------------*/
1843static void
1844ural_cfg_enable_tsf_sync(struct ural_softc *sc,
1845    struct usb2_config_td_cc *cc, uint16_t refcount)
1846{
1847	uint16_t logcwmin;
1848	uint16_t preload;
1849	uint16_t tmp;
1850
1851	/* first, disable TSF synchronization */
1852	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1853
1854	tmp = (16 * cc->iv_bss.ni_intval) << 4;
1855	ural_cfg_write(sc, RAL_TXRX_CSR18, tmp);
1856
1857	logcwmin = (cc->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1858	preload = (cc->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1859	tmp = (logcwmin << 12) | preload;
1860	ural_cfg_write(sc, RAL_TXRX_CSR20, tmp);
1861
1862	/* finally, enable TSF synchronization */
1863	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1864	if (cc->ic_opmode == IEEE80211_M_STA)
1865		tmp |= RAL_ENABLE_TSF_SYNC(1);
1866	else
1867		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1868
1869	ural_cfg_write(sc, RAL_TXRX_CSR19, tmp);
1870
1871	DPRINTF("enabling TSF synchronization\n");
1872
1873	return;
1874}
1875
1876static void
1877ural_cfg_disable_tsf_sync(struct ural_softc *sc)
1878{
1879	/* abort TSF synchronization */
1880	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1881
1882	/* force tx led to stop blinking */
1883	ural_cfg_write(sc, RAL_MAC_CSR20, 0);
1884
1885	return;
1886}
1887
1888#define	RAL_RXTX_TURNAROUND    5	/* us */
1889
1890static void
1891ural_cfg_update_slot(struct ural_softc *sc,
1892    struct usb2_config_td_cc *cc, uint16_t refcount)
1893{
1894	uint16_t slottime;
1895	uint16_t sifs;
1896	uint16_t eifs;
1897
1898	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1899
1900	/*
1901	 * These settings may sound a bit inconsistent but this is what the
1902	 * reference driver does.
1903	 */
1904	if (cc->ic_curmode == IEEE80211_MODE_11B) {
1905		sifs = 16 - RAL_RXTX_TURNAROUND;
1906		eifs = 364;
1907	} else {
1908		sifs = 10 - RAL_RXTX_TURNAROUND;
1909		eifs = 64;
1910	}
1911
1912	ural_cfg_write(sc, RAL_MAC_CSR10, slottime);
1913	ural_cfg_write(sc, RAL_MAC_CSR11, sifs);
1914	ural_cfg_write(sc, RAL_MAC_CSR12, eifs);
1915	return;
1916}
1917
1918static void
1919ural_cfg_set_txpreamble(struct ural_softc *sc,
1920    struct usb2_config_td_cc *cc, uint16_t refcount)
1921{
1922	uint16_t tmp;
1923
1924	tmp = ural_cfg_read(sc, RAL_TXRX_CSR10);
1925
1926	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE) {
1927		tmp |= RAL_SHORT_PREAMBLE;
1928	} else {
1929		tmp &= ~RAL_SHORT_PREAMBLE;
1930	}
1931
1932	ural_cfg_write(sc, RAL_TXRX_CSR10, tmp);
1933	return;
1934}
1935
1936static void
1937ural_cfg_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1938{
1939	ural_cfg_write_multi(sc, RAL_MAC_CSR5, bssid, IEEE80211_ADDR_LEN);
1940
1941	DPRINTF("setting BSSID to 0x%02x%02x%02x%02x%02x%02x\n",
1942	    bssid[5], bssid[4], bssid[3],
1943	    bssid[2], bssid[1], bssid[0]);
1944	return;
1945}
1946
1947static void
1948ural_cfg_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1949{
1950	ural_cfg_write_multi(sc, RAL_MAC_CSR2, addr, IEEE80211_ADDR_LEN);
1951
1952	DPRINTF("setting MAC to 0x%02x%02x%02x%02x%02x%02x\n",
1953	    addr[5], addr[4], addr[3],
1954	    addr[2], addr[1], addr[0]);
1955	return;
1956}
1957
1958static void
1959ural_cfg_update_promisc(struct ural_softc *sc,
1960    struct usb2_config_td_cc *cc, uint16_t refcount)
1961{
1962	uint16_t tmp;
1963
1964	tmp = ural_cfg_read(sc, RAL_TXRX_CSR2);
1965
1966	if (cc->if_flags & IFF_PROMISC) {
1967		tmp &= ~RAL_DROP_NOT_TO_ME;
1968	} else {
1969		tmp |= RAL_DROP_NOT_TO_ME;
1970	}
1971
1972	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
1973
1974	DPRINTF("%s promiscuous mode\n",
1975	    (cc->if_flags & IFF_PROMISC) ?
1976	    "entering" : "leaving");
1977	return;
1978}
1979
1980static void
1981ural_cfg_set_txantenna(struct ural_softc *sc, uint8_t antenna)
1982{
1983	uint16_t tmp;
1984	uint8_t tx;
1985
1986	tx = ural_cfg_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1987	if (antenna == 1)
1988		tx |= RAL_BBP_ANTA;
1989	else if (antenna == 2)
1990		tx |= RAL_BBP_ANTB;
1991	else
1992		tx |= RAL_BBP_DIVERSITY;
1993
1994	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1995	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1996	    (sc->sc_rf_rev == RAL_RF_2526) ||
1997	    (sc->sc_rf_rev == RAL_RF_5222)) {
1998		tx |= RAL_BBP_FLIPIQ;
1999	}
2000	ural_cfg_bbp_write(sc, RAL_BBP_TX, tx);
2001
2002	/* update values in PHY_CSR5 and PHY_CSR6 */
2003	tmp = ural_cfg_read(sc, RAL_PHY_CSR5) & ~0x7;
2004	ural_cfg_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2005
2006	tmp = ural_cfg_read(sc, RAL_PHY_CSR6) & ~0x7;
2007	ural_cfg_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2008
2009	return;
2010}
2011
2012static void
2013ural_cfg_set_rxantenna(struct ural_softc *sc, uint8_t antenna)
2014{
2015	uint8_t rx;
2016
2017	rx = ural_cfg_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2018	if (antenna == 1)
2019		rx |= RAL_BBP_ANTA;
2020	else if (antenna == 2)
2021		rx |= RAL_BBP_ANTB;
2022	else
2023		rx |= RAL_BBP_DIVERSITY;
2024
2025	/* need to force no I/Q flip for RF 2525e and 2526 */
2026
2027	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
2028	    (sc->sc_rf_rev == RAL_RF_2526)) {
2029		rx &= ~RAL_BBP_FLIPIQ;
2030	}
2031	ural_cfg_bbp_write(sc, RAL_BBP_RX, rx);
2032	return;
2033}
2034
2035static void
2036ural_cfg_read_eeprom(struct ural_softc *sc)
2037{
2038	uint16_t val;
2039
2040	ural_cfg_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
2041
2042	val = le16toh(val);
2043
2044	sc->sc_rf_rev = (val >> 11) & 0x7;
2045	sc->sc_hw_radio = (val >> 10) & 0x1;
2046	sc->sc_led_mode = (val >> 6) & 0x7;
2047	sc->sc_rx_ant = (val >> 4) & 0x3;
2048	sc->sc_tx_ant = (val >> 2) & 0x3;
2049	sc->sc_nb_ant = (val & 0x3);
2050
2051	DPRINTF("val = 0x%04x\n", val);
2052
2053	/* read MAC address */
2054	ural_cfg_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_myaddr,
2055	    sizeof(sc->sc_myaddr));
2056
2057	/* read default values for BBP registers */
2058	ural_cfg_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->sc_bbp_prom,
2059	    sizeof(sc->sc_bbp_prom));
2060
2061	/* read Tx power for all b/g channels */
2062	ural_cfg_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->sc_txpow,
2063	    sizeof(sc->sc_txpow));
2064	return;
2065}
2066
2067static uint8_t
2068ural_cfg_bbp_init(struct ural_softc *sc)
2069{
2070	enum {
2071		N_DEF_BBP = (sizeof(ural_def_bbp) / sizeof(ural_def_bbp[0])),
2072	};
2073	uint16_t i;
2074	uint8_t to;
2075
2076	/* wait for BBP to become ready */
2077	for (to = 0;; to++) {
2078		if (to < 100) {
2079			if (ural_cfg_bbp_read(sc, RAL_BBP_VERSION) != 0) {
2080				break;
2081			}
2082			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2083				return (1);	/* failure */
2084			}
2085		} else {
2086			DPRINTF("timeout waiting for BBP\n");
2087			return (1);	/* failure */
2088		}
2089	}
2090
2091	/* initialize BBP registers to default values */
2092	for (i = 0; i < N_DEF_BBP; i++) {
2093		ural_cfg_bbp_write(sc, ural_def_bbp[i].reg,
2094		    ural_def_bbp[i].val);
2095	}
2096
2097#if 0
2098	/* initialize BBP registers to values stored in EEPROM */
2099	for (i = 0; i < 16; i++) {
2100		if (sc->sc_bbp_prom[i].reg == 0xff) {
2101			continue;
2102		}
2103		ural_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg,
2104		    sc->sc_bbp_prom[i].val);
2105	}
2106#endif
2107	return (0);			/* success */
2108}
2109
2110static void
2111ural_cfg_pre_init(struct ural_softc *sc,
2112    struct usb2_config_td_cc *cc, uint16_t refcount)
2113{
2114	struct ifnet *ifp = sc->sc_ifp;
2115	struct ieee80211com *ic = ifp->if_l2com;
2116
2117	/* immediate configuration */
2118
2119	ural_cfg_pre_stop(sc, cc, 0);
2120
2121	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2122
2123	sc->sc_flags |= URAL_FLAG_HL_READY;
2124
2125	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2126
2127	return;
2128}
2129
2130static void
2131ural_cfg_init(struct ural_softc *sc,
2132    struct usb2_config_td_cc *cc, uint16_t refcount)
2133{
2134	enum {
2135		N_DEF_MAC = (sizeof(ural_def_mac) / sizeof(ural_def_mac[0])),
2136	};
2137	uint16_t tmp;
2138	uint16_t i;
2139	uint8_t to;
2140
2141	/* delayed configuration */
2142
2143	ural_cfg_set_testmode(sc);
2144
2145	ural_cfg_write(sc, 0x308, 0x00f0);	/* XXX magic */
2146
2147	ural_cfg_stop(sc, cc, 0);
2148
2149	/* initialize MAC registers to default values */
2150	for (i = 0; i < N_DEF_MAC; i++) {
2151		ural_cfg_write(sc, ural_def_mac[i].reg,
2152		    ural_def_mac[i].val);
2153	}
2154
2155	/* wait for BBP and RF to wake up (this can take a long time!) */
2156	for (to = 0;; to++) {
2157		if (to < 100) {
2158			tmp = ural_cfg_read(sc, RAL_MAC_CSR17);
2159			if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2160			    (RAL_BBP_AWAKE | RAL_RF_AWAKE)) {
2161				break;
2162			}
2163			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2164				goto fail;
2165			}
2166		} else {
2167			DPRINTF("timeout waiting for "
2168			    "BBP/RF to wakeup\n");
2169			goto fail;
2170		}
2171	}
2172
2173	/* we're ready! */
2174	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2175
2176	/* set basic rate set (will be updated later) */
2177	ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
2178
2179	if (ural_cfg_bbp_init(sc)) {
2180		goto fail;
2181	}
2182	/* set default BSS channel */
2183	ural_cfg_set_chan(sc, cc, 0);
2184
2185	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2186	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta,
2187	    sizeof(sc->sc_sta));
2188
2189	DPRINTF("rx_ant=%d, tx_ant=%d\n",
2190	    sc->sc_rx_ant, sc->sc_tx_ant);
2191
2192	ural_cfg_set_txantenna(sc, sc->sc_tx_ant);
2193	ural_cfg_set_rxantenna(sc, sc->sc_rx_ant);
2194
2195	ural_cfg_set_macaddr(sc, cc->ic_myaddr);
2196
2197	/*
2198	 * make sure that the first transaction
2199	 * clears the stall:
2200	 */
2201	sc->sc_flags |= (URAL_FLAG_READ_STALL |
2202	    URAL_FLAG_WRITE_STALL |
2203	    URAL_FLAG_LL_READY);
2204
2205	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2206	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2207		struct ifnet *ifp = sc->sc_ifp;
2208		struct ieee80211com *ic = ifp->if_l2com;
2209
2210		/*
2211		 * start the USB transfers, if not already started:
2212		 */
2213		usb2_transfer_start(sc->sc_xfer[1]);
2214		usb2_transfer_start(sc->sc_xfer[0]);
2215
2216		/*
2217		 * start IEEE802.11 layer
2218		 */
2219		mtx_unlock(&sc->sc_mtx);
2220		ieee80211_start_all(ic);
2221		mtx_lock(&sc->sc_mtx);
2222	}
2223	/*
2224	 * start Rx
2225	 */
2226	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2227	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2228
2229		tmp |= (RAL_DROP_CTL | RAL_DROP_BAD_VERSION);
2230
2231		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2232			tmp |= RAL_DROP_TODS;
2233		}
2234		if (!(cc->if_flags & IFF_PROMISC)) {
2235			tmp |= RAL_DROP_NOT_TO_ME;
2236		}
2237	}
2238	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
2239
2240	return;
2241
2242fail:
2243	ural_cfg_pre_stop(sc, NULL, 0);
2244
2245	if (cc) {
2246		ural_cfg_stop(sc, cc, 0);
2247	}
2248	return;
2249}
2250
2251static void
2252ural_cfg_pre_stop(struct ural_softc *sc,
2253    struct usb2_config_td_cc *cc, uint16_t refcount)
2254{
2255	struct ifnet *ifp = sc->sc_ifp;
2256
2257	if (cc) {
2258		/* copy the needed configuration */
2259		ural_config_copy(sc, cc, refcount);
2260	}
2261	/* immediate configuration */
2262
2263	if (ifp) {
2264		/* clear flags */
2265		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2266	}
2267	sc->sc_flags &= ~(URAL_FLAG_HL_READY |
2268	    URAL_FLAG_LL_READY);
2269
2270	/*
2271	 * stop all the transfers, if not already stopped:
2272	 */
2273	usb2_transfer_stop(sc->sc_xfer[0]);
2274	usb2_transfer_stop(sc->sc_xfer[1]);
2275	usb2_transfer_stop(sc->sc_xfer[2]);
2276	usb2_transfer_stop(sc->sc_xfer[3]);
2277
2278	/* clean up transmission */
2279	ural_tx_clean_queue(sc);
2280	return;
2281}
2282
2283static void
2284ural_cfg_stop(struct ural_softc *sc,
2285    struct usb2_config_td_cc *cc, uint16_t refcount)
2286{
2287	/* disable Rx */
2288	ural_cfg_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2289
2290	/* reset ASIC and BBP (but won't reset MAC registers!) */
2291	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2292
2293	/* wait a little */
2294	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2295
2296	/* clear reset */
2297	ural_cfg_write(sc, RAL_MAC_CSR1, 0);
2298
2299	/* wait a little */
2300	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2301
2302	return;
2303}
2304
2305static void
2306ural_cfg_amrr_start(struct ural_softc *sc)
2307{
2308	struct ieee80211vap *vap;
2309	struct ieee80211_node *ni;
2310
2311	vap = ural_get_vap(sc);
2312
2313	if (vap == NULL) {
2314		return;
2315	}
2316	ni = vap->iv_bss;
2317	if (ni == NULL) {
2318		return;
2319	}
2320	/* init AMRR */
2321
2322	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2323	/* enable AMRR timer */
2324
2325	sc->sc_amrr_timer = 1;
2326	return;
2327}
2328
2329static void
2330ural_cfg_amrr_timeout(struct ural_softc *sc,
2331    struct usb2_config_td_cc *cc, uint16_t refcount)
2332{
2333	struct ifnet *ifp = sc->sc_ifp;
2334	struct ieee80211vap *vap;
2335	struct ieee80211_node *ni;
2336	uint32_t ok;
2337	uint32_t fail;
2338
2339	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2340	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2341
2342	vap = ural_get_vap(sc);
2343	if (vap == NULL) {
2344		return;
2345	}
2346	ni = vap->iv_bss;
2347	if (ni == NULL) {
2348		return;
2349	}
2350	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2351	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2352
2353		ok = sc->sc_sta[7] +	/* TX ok w/o retry */
2354		    sc->sc_sta[8];	/* TX ok w/ retry */
2355		fail = sc->sc_sta[9];	/* TX retry-fail count */
2356
2357		if (sc->sc_amrr_timer) {
2358
2359			ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2360			    ok + fail, ok, sc->sc_sta[8] + fail);
2361
2362			if (ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn)) {
2363				/* ignore */
2364			}
2365		}
2366		ifp->if_oerrors += fail;
2367	}
2368	return;
2369}
2370
2371static struct ieee80211vap *
2372ural_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2373    int opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
2374    const uint8_t mac[IEEE80211_ADDR_LEN])
2375{
2376	struct ural_vap *uvp;
2377	struct ieee80211vap *vap;
2378	struct ural_softc *sc = ic->ic_ifp->if_softc;
2379
2380	/* Need to sync with config thread: */
2381	mtx_lock(&sc->sc_mtx);
2382	if (usb2_config_td_sync(&sc->sc_config_td)) {
2383		mtx_unlock(&sc->sc_mtx);
2384		/* config thread is gone */
2385		return (NULL);
2386	}
2387	mtx_unlock(&sc->sc_mtx);
2388
2389	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2390		return NULL;
2391	uvp = (struct ural_vap *)malloc(sizeof(struct ural_vap),
2392	    M_80211_VAP, M_NOWAIT | M_ZERO);
2393	if (uvp == NULL)
2394		return NULL;
2395
2396	vap = &uvp->vap;
2397	/* enable s/w bmiss handling for sta mode */
2398	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2399	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2400
2401	/* override state transition machine */
2402	uvp->newstate = vap->iv_newstate;
2403	vap->iv_newstate = &ural_newstate_cb;
2404
2405	ieee80211_amrr_init(&uvp->amrr, vap,
2406	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2407	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2408	    1000 /* 1 sec */ );
2409
2410	/* complete setup */
2411	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2412
2413	/* store current operation mode */
2414	ic->ic_opmode = opmode;
2415
2416	return (vap);
2417}
2418
2419static void
2420ural_vap_delete(struct ieee80211vap *vap)
2421{
2422	struct ural_vap *uvp = URAL_VAP(vap);
2423	struct ural_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2424
2425	/* Need to sync with config thread: */
2426	mtx_lock(&sc->sc_mtx);
2427	if (usb2_config_td_sync(&sc->sc_config_td)) {
2428		/* ignore */
2429	}
2430	mtx_unlock(&sc->sc_mtx);
2431
2432	ieee80211_amrr_cleanup(&uvp->amrr);
2433	ieee80211_vap_detach(vap);
2434	free(uvp, M_80211_VAP);
2435	return;
2436}
2437
2438/* ARGUSED */
2439static struct ieee80211_node *
2440ural_node_alloc(struct ieee80211vap *vap __unused,
2441    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2442{
2443	struct ural_node *un;
2444
2445	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2446	return ((un != NULL) ? &un->ni : NULL);
2447}
2448
2449static void
2450ural_newassoc(struct ieee80211_node *ni, int isnew)
2451{
2452	struct ieee80211vap *vap = ni->ni_vap;
2453
2454	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2455	return;
2456}
2457
2458static void
2459ural_fill_write_queue(struct ural_softc *sc)
2460{
2461	struct ifnet *ifp = sc->sc_ifp;
2462	struct ieee80211_node *ni;
2463	struct mbuf *m;
2464
2465	/*
2466	 * We only fill up half of the queue with data frames. The rest is
2467	 * reserved for other kinds of frames.
2468	 */
2469
2470	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2471
2472		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2473		if (m == NULL)
2474			break;
2475
2476		ni = (void *)(m->m_pkthdr.rcvif);
2477		m = ieee80211_encap(ni, m);
2478		if (m == NULL) {
2479			ieee80211_free_node(ni);
2480			continue;
2481		}
2482		ural_tx_data(sc, m, ni);
2483	}
2484	return;
2485}
2486
2487static void
2488ural_tx_clean_queue(struct ural_softc *sc)
2489{
2490	struct mbuf *m;
2491
2492	for (;;) {
2493		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2494
2495		if (!m) {
2496			break;
2497		}
2498		ural_tx_freem(m);
2499	}
2500
2501	return;
2502}
2503
2504static void
2505ural_tx_freem(struct mbuf *m)
2506{
2507	struct ieee80211_node *ni;
2508
2509	while (m) {
2510		ni = (void *)(m->m_pkthdr.rcvif);
2511		if (!ni) {
2512			m = m_free(m);
2513			continue;
2514		}
2515		if (m->m_flags & M_TXCB) {
2516			ieee80211_process_callback(ni, m, 0);
2517		}
2518		m_freem(m);
2519		ieee80211_free_node(ni);
2520
2521		break;
2522	}
2523	return;
2524}
2525
2526static void
2527ural_tx_mgt(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2528{
2529	struct ieee80211vap *vap = ni->ni_vap;
2530	struct ieee80211com *ic = ni->ni_ic;
2531	const struct ieee80211_txparam *tp;
2532	struct ieee80211_frame *wh;
2533	struct ieee80211_key *k;
2534	uint32_t flags;
2535	uint16_t dur;
2536
2537	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2538
2539	wh = mtod(m, struct ieee80211_frame *);
2540	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2541		k = ieee80211_crypto_encap(ni, m);
2542		if (k == NULL) {
2543			m_freem(m);
2544			ieee80211_free_node(ni);
2545			return;
2546		}
2547		wh = mtod(m, struct ieee80211_frame *);
2548	}
2549	flags = 0;
2550	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2551		flags |= RAL_TX_ACK;
2552
2553		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2554		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2555		USETW(wh->i_dur, dur);
2556
2557		/* tell hardware to add timestamp for probe responses */
2558		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2559		    IEEE80211_FC0_TYPE_MGT &&
2560		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
2561		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2562			flags |= RAL_TX_TIMESTAMP;
2563	}
2564	m->m_pkthdr.rcvif = (void *)ni;
2565	ural_setup_desc_and_tx(sc, m, flags, tp->mgmtrate);
2566	return;
2567}
2568
2569static struct ieee80211vap *
2570ural_get_vap(struct ural_softc *sc)
2571{
2572	struct ifnet *ifp;
2573	struct ieee80211com *ic;
2574
2575	if (sc == NULL) {
2576		return NULL;
2577	}
2578	ifp = sc->sc_ifp;
2579	if (ifp == NULL) {
2580		return NULL;
2581	}
2582	ic = ifp->if_l2com;
2583	if (ic == NULL) {
2584		return NULL;
2585	}
2586	return TAILQ_FIRST(&ic->ic_vaps);
2587}
2588
2589static void
2590ural_tx_bcn(struct ural_softc *sc)
2591{
2592	struct ieee80211_node *ni;
2593	struct ieee80211vap *vap;
2594	struct ieee80211com *ic;
2595	const struct ieee80211_txparam *tp;
2596	struct mbuf *m;
2597
2598	vap = ural_get_vap(sc);
2599	if (vap == NULL) {
2600		return;
2601	}
2602	ni = vap->iv_bss;
2603	if (ni == NULL) {
2604		return;
2605	}
2606	ic = vap->iv_ic;
2607	if (ic == NULL) {
2608		return;
2609	}
2610	DPRINTFN(11, "Sending beacon frame.\n");
2611
2612	m = ieee80211_beacon_alloc(ni, &URAL_VAP(vap)->bo);
2613	if (m == NULL) {
2614		DPRINTFN(0, "could not allocate beacon\n");
2615		return;
2616	}
2617	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2618
2619	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2620	ural_setup_desc_and_tx(sc, m, RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP,
2621	    tp->mgmtrate);
2622	return;
2623}
2624
2625static void
2626ural_tx_data(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2627{
2628	struct ieee80211vap *vap = ni->ni_vap;
2629	struct ieee80211com *ic = ni->ni_ic;
2630	const struct ieee80211_txparam *tp;
2631	struct ieee80211_frame *wh;
2632	struct ieee80211_key *k;
2633	uint32_t flags = 0;
2634	uint16_t dur;
2635	uint16_t rate;
2636
2637	DPRINTFN(11, "Sending data.\n");
2638
2639	wh = mtod(m, struct ieee80211_frame *);
2640
2641	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2642	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2643		rate = tp->mcastrate;
2644	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2645		rate = tp->ucastrate;
2646	else
2647		rate = ni->ni_txrate;
2648
2649	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2650		k = ieee80211_crypto_encap(ni, m);
2651		if (k == NULL) {
2652			m_freem(m);
2653			ieee80211_free_node(ni);
2654			return;
2655		}
2656		/* packet header may have moved, reset our local pointer */
2657		wh = mtod(m, struct ieee80211_frame *);
2658	}
2659	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2660		uint8_t prot = IEEE80211_PROT_NONE;
2661
2662		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2663			prot = IEEE80211_PROT_RTSCTS;
2664		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2665		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2666			prot = ic->ic_protmode;
2667		if (prot != IEEE80211_PROT_NONE) {
2668			ural_tx_prot(sc, m, ni, prot, rate);
2669			flags |= RAL_TX_IFS_SIFS;
2670		}
2671		flags |= RAL_TX_ACK;
2672		flags |= RAL_TX_RETRY(7);
2673
2674		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2675		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2676		USETW(wh->i_dur, dur);
2677	}
2678	m->m_pkthdr.rcvif = (void *)ni;
2679	ural_setup_desc_and_tx(sc, m, flags, rate);
2680	return;
2681}
2682
2683static void
2684ural_tx_prot(struct ural_softc *sc,
2685    const struct mbuf *m, struct ieee80211_node *ni,
2686    uint8_t prot, uint16_t rate)
2687{
2688	struct ieee80211com *ic = ni->ni_ic;
2689	const struct ieee80211_frame *wh;
2690	struct mbuf *mprot;
2691	uint32_t flags;
2692	uint16_t protrate;
2693	uint16_t ackrate;
2694	uint16_t pktlen;
2695	uint16_t dur;
2696	uint8_t isshort;
2697
2698	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2699	    (prot == IEEE80211_PROT_CTSONLY),
2700	    ("protection %u", prot));
2701
2702	DPRINTFN(16, "Sending protection frame.\n");
2703
2704	wh = mtod(m, const struct ieee80211_frame *);
2705	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2706
2707	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2708	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2709
2710	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2711	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2712	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2713	flags = RAL_TX_RETRY(7);
2714	if (prot == IEEE80211_PROT_RTSCTS) {
2715		/* NB: CTS is the same size as an ACK */
2716		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2717		flags |= RAL_TX_ACK;
2718		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2719	} else {
2720		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2721	}
2722	if (mprot == NULL) {
2723		return;
2724	}
2725	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2726	ural_setup_desc_and_tx(sc, mprot, flags, protrate);
2727	return;
2728}
2729
2730static void
2731ural_tx_raw(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2732    const struct ieee80211_bpf_params *params)
2733{
2734	uint32_t flags;
2735	uint16_t rate;
2736
2737	DPRINTFN(11, "Sending raw frame.\n");
2738
2739	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2740
2741	/* XXX validate */
2742	if (rate == 0) {
2743		m_freem(m);
2744		ieee80211_free_node(ni);
2745		return;
2746	}
2747	flags = 0;
2748	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2749		flags |= RAL_TX_ACK;
2750	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2751		ural_tx_prot(sc, m, ni,
2752		    (params->ibp_flags & IEEE80211_BPF_RTS) ?
2753		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2754		    rate);
2755		flags |= RAL_TX_IFS_SIFS;
2756	}
2757	m->m_pkthdr.rcvif = (void *)ni;
2758	ural_setup_desc_and_tx(sc, m, flags, rate);
2759	return;
2760}
2761
2762static int
2763ural_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2764    const struct ieee80211_bpf_params *params)
2765{
2766	struct ieee80211com *ic = ni->ni_ic;
2767	struct ifnet *ifp = ic->ic_ifp;
2768	struct ural_softc *sc = ifp->if_softc;
2769
2770	mtx_lock(&sc->sc_mtx);
2771	if (params == NULL) {
2772		/*
2773		 * Legacy path; interpret frame contents to decide
2774		 * precisely how to send the frame.
2775		 */
2776		ural_tx_mgt(sc, m, ni);
2777	} else {
2778		/*
2779		 * Caller supplied explicit parameters to use in
2780		 * sending the frame.
2781		 */
2782		ural_tx_raw(sc, m, ni, params);
2783	}
2784	mtx_unlock(&sc->sc_mtx);
2785	return (0);
2786}
2787
2788static void
2789ural_update_mcast_cb(struct ifnet *ifp)
2790{
2791	/* not supported */
2792	return;
2793}
2794
2795static void
2796ural_update_promisc_cb(struct ifnet *ifp)
2797{
2798	struct ural_softc *sc = ifp->if_softc;
2799
2800	mtx_lock(&sc->sc_mtx);
2801	usb2_config_td_queue_command
2802	    (&sc->sc_config_td, &ural_config_copy,
2803	    &ural_cfg_update_promisc, 0, 0);
2804	mtx_unlock(&sc->sc_mtx);
2805	return;
2806}
2807