if_ural.c revision 187192
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 187192 2009-01-13 21:18:14Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 *
22 */
23
24/*
25 *
26 * NOTE: all function names beginning like "ural_cfg_" can only
27 * be called from within the config thread function !
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 187192 2009-01-13 21:18:14Z thompsa $");
32
33/*-
34 * Ralink Technology RT2500USB chipset driver
35 * http://www.ralinktech.com/
36 */
37
38#include <dev/usb2/include/usb2_devid.h>
39#include <dev/usb2/include/usb2_standard.h>
40#include <dev/usb2/include/usb2_mfunc.h>
41#include <dev/usb2/include/usb2_error.h>
42
43#define	usb2_config_td_cc ural_config_copy
44#define	usb2_config_td_softc ural_softc
45
46#define	USB_DEBUG_VAR ural_debug
47
48#include <dev/usb2/core/usb2_core.h>
49#include <dev/usb2/core/usb2_lookup.h>
50#include <dev/usb2/core/usb2_process.h>
51#include <dev/usb2/core/usb2_config_td.h>
52#include <dev/usb2/core/usb2_debug.h>
53#include <dev/usb2/core/usb2_request.h>
54#include <dev/usb2/core/usb2_busdma.h>
55#include <dev/usb2/core/usb2_util.h>
56
57#include <dev/usb2/wlan/usb2_wlan.h>
58#include <dev/usb2/wlan/if_uralreg.h>
59#include <dev/usb2/wlan/if_uralvar.h>
60
61#if USB_DEBUG
62static int ural_debug = 0;
63
64SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
65SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
66    "Debug level");
67#endif
68
69#define	URAL_RSSI(rssi)	\
70  ((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ? \
71   ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
72
73/* prototypes */
74
75static device_probe_t ural_probe;
76static device_attach_t ural_attach;
77static device_detach_t ural_detach;
78
79static usb2_callback_t ural_bulk_read_callback;
80static usb2_callback_t ural_bulk_read_clear_stall_callback;
81static usb2_callback_t ural_bulk_write_callback;
82static usb2_callback_t ural_bulk_write_clear_stall_callback;
83
84static usb2_config_td_command_t ural_cfg_first_time_setup;
85static usb2_config_td_command_t ural_config_copy;
86static usb2_config_td_command_t ural_cfg_scan_start;
87static usb2_config_td_command_t ural_cfg_scan_end;
88static usb2_config_td_command_t ural_cfg_set_chan;
89static usb2_config_td_command_t ural_cfg_enable_tsf_sync;
90static usb2_config_td_command_t ural_cfg_update_slot;
91static usb2_config_td_command_t ural_cfg_set_txpreamble;
92static usb2_config_td_command_t ural_cfg_update_promisc;
93static usb2_config_td_command_t ural_cfg_pre_init;
94static usb2_config_td_command_t ural_cfg_init;
95static usb2_config_td_command_t ural_cfg_pre_stop;
96static usb2_config_td_command_t ural_cfg_stop;
97static usb2_config_td_command_t ural_cfg_amrr_timeout;
98static usb2_config_td_command_t ural_cfg_newstate;
99
100static void	ural_cfg_do_request(struct ural_softc *,
101		    struct usb2_device_request *, void *);
102static void	ural_cfg_set_testmode(struct ural_softc *);
103static void	ural_cfg_eeprom_read(struct ural_softc *, uint16_t, void *,
104		    uint16_t);
105static uint16_t	ural_cfg_read(struct ural_softc *, uint16_t);
106static void	ural_cfg_read_multi(struct ural_softc *, uint16_t, void *,
107		    uint16_t);
108static void	ural_cfg_write(struct ural_softc *, uint16_t, uint16_t);
109static void	ural_cfg_write_multi(struct ural_softc *, uint16_t, void *,
110		    uint16_t);
111static void	ural_cfg_bbp_write(struct ural_softc *, uint8_t, uint8_t);
112static uint8_t	ural_cfg_bbp_read(struct ural_softc *, uint8_t);
113static void	ural_cfg_rf_write(struct ural_softc *, uint8_t, uint32_t);
114static void	ural_end_of_commands(struct ural_softc *);
115static const char *ural_get_rf(int rev);
116static void	ural_watchdog(void *);
117static void	ural_init_cb(void *);
118static int	ural_ioctl_cb(struct ifnet *, u_long cmd, caddr_t data);
119static void	ural_start_cb(struct ifnet *);
120static int	ural_newstate_cb(struct ieee80211vap *,
121		    enum ieee80211_state, int);
122static void	ural_std_command(struct ieee80211com *,
123		    usb2_config_td_command_t *);
124static void	ural_scan_start_cb(struct ieee80211com *);
125static void	ural_scan_end_cb(struct ieee80211com *);
126static void	ural_set_channel_cb(struct ieee80211com *);
127static void	ural_cfg_disable_rf_tune(struct ural_softc *);
128static void	ural_cfg_set_bssid(struct ural_softc *, uint8_t *);
129static void	ural_cfg_set_macaddr(struct ural_softc *, uint8_t *);
130static void	ural_cfg_set_txantenna(struct ural_softc *, uint8_t);
131static void	ural_cfg_set_rxantenna(struct ural_softc *, uint8_t);
132static void	ural_cfg_read_eeprom(struct ural_softc *);
133static uint8_t	ural_cfg_bbp_init(struct ural_softc *);
134static void	ural_cfg_amrr_start(struct ural_softc *);
135static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
136		    const char name[IFNAMSIZ], int unit, int opmode, int flags,
137		    const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t
138		    mac[IEEE80211_ADDR_LEN]);
139static void	ural_vap_delete(struct ieee80211vap *);
140static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
141		    const uint8_t mac[IEEE80211_ADDR_LEN]);
142static void	ural_newassoc(struct ieee80211_node *, int);
143static void	ural_cfg_disable_tsf_sync(struct ural_softc *);
144static void	ural_cfg_set_run(struct ural_softc *,
145		    struct usb2_config_td_cc *);
146static void	ural_fill_write_queue(struct ural_softc *);
147static void	ural_tx_clean_queue(struct ural_softc *);
148static void	ural_tx_freem(struct mbuf *);
149static void	ural_tx_mgt(struct ural_softc *, struct mbuf *,
150		    struct ieee80211_node *);
151static struct ieee80211vap *ural_get_vap(struct ural_softc *);
152static void	ural_tx_bcn(struct ural_softc *);
153static void	ural_tx_data(struct ural_softc *, struct mbuf *,
154		    struct ieee80211_node *);
155static void	ural_tx_prot(struct ural_softc *, const struct mbuf *,
156		    struct ieee80211_node *, uint8_t, uint16_t);
157static void	ural_tx_raw(struct ural_softc *, struct mbuf *,
158		    struct ieee80211_node *,
159		    const struct ieee80211_bpf_params *);
160static int	ural_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
161		    const struct ieee80211_bpf_params *);
162static void	ural_setup_desc_and_tx(struct ural_softc *, struct mbuf *,
163		    uint32_t, uint16_t);
164static void	ural_update_mcast_cb(struct ifnet *);
165static void	ural_update_promisc_cb(struct ifnet *);
166
167/* various supported device vendors/products */
168static const struct usb2_device_id ural_devs[] = {
169	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G, 0)},
170	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570, 0)},
171	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050, 0)},
172	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051, 0)},
173	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS, 0)},
174	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G, 0)},
175	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP, 0)},
176	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU, 0)},
177	{USB_VPI(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122, 0)},
178	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G, 0)},
179	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG, 0)},
180	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254, 0)},
181	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54, 0)},
182	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI, 0)},
183	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB, 0)},
184	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI, 0)},
185	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570, 0)},
186	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2, 0)},
187	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3, 0)},
188	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902, 0)},
189	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570, 0)},
190	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2, 0)},
191	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3, 0)},
192	{USB_VPI(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G, 0)},
193	{USB_VPI(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG, 0)},
194	{USB_VPI(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R, 0)},
195	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570, 0)},
196	{USB_VPI(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570, 0)},
197	{USB_VPI(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570, 0)},
198};
199
200/*
201 * Default values for MAC registers; values taken from
202 * the reference driver:
203 */
204struct ural_def_mac {
205	uint16_t reg;
206	uint16_t val;
207};
208
209static const struct ural_def_mac ural_def_mac[] = {
210	{RAL_TXRX_CSR5, 0x8c8d},
211	{RAL_TXRX_CSR6, 0x8b8a},
212	{RAL_TXRX_CSR7, 0x8687},
213	{RAL_TXRX_CSR8, 0x0085},
214	{RAL_MAC_CSR13, 0x1111},
215	{RAL_MAC_CSR14, 0x1e11},
216	{RAL_TXRX_CSR21, 0xe78f},
217	{RAL_MAC_CSR9, 0xff1d},
218	{RAL_MAC_CSR11, 0x0002},
219	{RAL_MAC_CSR22, 0x0053},
220	{RAL_MAC_CSR15, 0x0000},
221	{RAL_MAC_CSR8, RAL_FRAME_SIZE},
222	{RAL_TXRX_CSR19, 0x0000},
223	{RAL_TXRX_CSR18, 0x005a},
224	{RAL_PHY_CSR2, 0x0000},
225	{RAL_TXRX_CSR0, 0x1ec0},
226	{RAL_PHY_CSR4, 0x000f}
227};
228
229/*
230 * Default values for BBP registers; values taken from the reference driver.
231 */
232struct ural_def_bbp {
233	uint8_t	reg;
234	uint8_t	val;
235};
236
237static const struct ural_def_bbp ural_def_bbp[] = {
238	{3, 0x02},
239	{4, 0x19},
240	{14, 0x1c},
241	{15, 0x30},
242	{16, 0xac},
243	{17, 0x48},
244	{18, 0x18},
245	{19, 0xff},
246	{20, 0x1e},
247	{21, 0x08},
248	{22, 0x08},
249	{23, 0x08},
250	{24, 0x80},
251	{25, 0x50},
252	{26, 0x08},
253	{27, 0x23},
254	{30, 0x10},
255	{31, 0x2b},
256	{32, 0xb9},
257	{34, 0x12},
258	{35, 0x50},
259	{39, 0xc4},
260	{40, 0x02},
261	{41, 0x60},
262	{53, 0x10},
263	{54, 0x18},
264	{56, 0x08},
265	{57, 0x10},
266	{58, 0x08},
267	{61, 0x60},
268	{62, 0x10},
269	{75, 0xff}
270};
271
272/*
273 * Default values for RF register R2 indexed by channel numbers.
274 */
275static const uint32_t ural_rf2522_r2[] = {
276	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
277	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
278};
279
280static const uint32_t ural_rf2523_r2[] = {
281	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
282	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
283};
284
285static const uint32_t ural_rf2524_r2[] = {
286	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
287	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
288};
289
290static const uint32_t ural_rf2525_r2[] = {
291	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
292	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
293};
294
295static const uint32_t ural_rf2525_hi_r2[] = {
296	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
297	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
298};
299
300static const uint32_t ural_rf2525e_r2[] = {
301	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
302	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
303};
304
305static const uint32_t ural_rf2526_hi_r2[] = {
306	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
307	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
308};
309
310static const uint32_t ural_rf2526_r2[] = {
311	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
312	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
313};
314
315/*
316 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
317 * values taken from the reference driver.
318 */
319struct ural_rf5222 {
320	uint8_t	chan;
321	uint32_t r1;
322	uint32_t r2;
323	uint32_t r4;
324};
325
326static const struct ural_rf5222 ural_rf5222[] = {
327	{1, 0x08808, 0x0044d, 0x00282},
328	{2, 0x08808, 0x0044e, 0x00282},
329	{3, 0x08808, 0x0044f, 0x00282},
330	{4, 0x08808, 0x00460, 0x00282},
331	{5, 0x08808, 0x00461, 0x00282},
332	{6, 0x08808, 0x00462, 0x00282},
333	{7, 0x08808, 0x00463, 0x00282},
334	{8, 0x08808, 0x00464, 0x00282},
335	{9, 0x08808, 0x00465, 0x00282},
336	{10, 0x08808, 0x00466, 0x00282},
337	{11, 0x08808, 0x00467, 0x00282},
338	{12, 0x08808, 0x00468, 0x00282},
339	{13, 0x08808, 0x00469, 0x00282},
340	{14, 0x08808, 0x0046b, 0x00286},
341
342	{36, 0x08804, 0x06225, 0x00287},
343	{40, 0x08804, 0x06226, 0x00287},
344	{44, 0x08804, 0x06227, 0x00287},
345	{48, 0x08804, 0x06228, 0x00287},
346	{52, 0x08804, 0x06229, 0x00287},
347	{56, 0x08804, 0x0622a, 0x00287},
348	{60, 0x08804, 0x0622b, 0x00287},
349	{64, 0x08804, 0x0622c, 0x00287},
350
351	{100, 0x08804, 0x02200, 0x00283},
352	{104, 0x08804, 0x02201, 0x00283},
353	{108, 0x08804, 0x02202, 0x00283},
354	{112, 0x08804, 0x02203, 0x00283},
355	{116, 0x08804, 0x02204, 0x00283},
356	{120, 0x08804, 0x02205, 0x00283},
357	{124, 0x08804, 0x02206, 0x00283},
358	{128, 0x08804, 0x02207, 0x00283},
359	{132, 0x08804, 0x02208, 0x00283},
360	{136, 0x08804, 0x02209, 0x00283},
361	{140, 0x08804, 0x0220a, 0x00283},
362
363	{149, 0x08808, 0x02429, 0x00281},
364	{153, 0x08808, 0x0242b, 0x00281},
365	{157, 0x08808, 0x0242d, 0x00281},
366	{161, 0x08808, 0x0242f, 0x00281}
367};
368
369static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
370	[0] = {
371		.type = UE_BULK,
372		.endpoint = UE_ADDR_ANY,
373		.direction = UE_DIR_OUT,
374		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
375		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
376		.mh.callback = &ural_bulk_write_callback,
377		.mh.timeout = 5000,	/* ms */
378	},
379
380	[1] = {
381		.type = UE_BULK,
382		.endpoint = UE_ADDR_ANY,
383		.direction = UE_DIR_IN,
384		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
385		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
386		.mh.callback = &ural_bulk_read_callback,
387	},
388
389	[2] = {
390		.type = UE_CONTROL,
391		.endpoint = 0x00,	/* Control pipe */
392		.direction = UE_DIR_ANY,
393		.mh.bufsize = sizeof(struct usb2_device_request),
394		.mh.callback = &ural_bulk_write_clear_stall_callback,
395		.mh.timeout = 1000,	/* 1 second */
396		.mh.interval = 50,	/* 50ms */
397	},
398
399	[3] = {
400		.type = UE_CONTROL,
401		.endpoint = 0x00,	/* Control pipe */
402		.direction = UE_DIR_ANY,
403		.mh.bufsize = sizeof(struct usb2_device_request),
404		.mh.callback = &ural_bulk_read_clear_stall_callback,
405		.mh.timeout = 1000,	/* 1 second */
406		.mh.interval = 50,	/* 50ms */
407	},
408};
409
410static devclass_t ural_devclass;
411
412static device_method_t ural_methods[] = {
413	DEVMETHOD(device_probe, ural_probe),
414	DEVMETHOD(device_attach, ural_attach),
415	DEVMETHOD(device_detach, ural_detach),
416	{0, 0}
417};
418
419static driver_t ural_driver = {
420	.name = "ural",
421	.methods = ural_methods,
422	.size = sizeof(struct ural_softc),
423};
424
425DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
426MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
427MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
428MODULE_DEPEND(ural, wlan, 1, 1, 1);
429MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
430
431static int
432ural_probe(device_t dev)
433{
434	struct usb2_attach_arg *uaa = device_get_ivars(dev);
435
436	if (uaa->usb2_mode != USB_MODE_HOST) {
437		return (ENXIO);
438	}
439	if (uaa->info.bConfigIndex != 0) {
440		return (ENXIO);
441	}
442	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX) {
443		return (ENXIO);
444	}
445	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
446}
447
448static int
449ural_attach(device_t dev)
450{
451	struct usb2_attach_arg *uaa = device_get_ivars(dev);
452	struct ural_softc *sc = device_get_softc(dev);
453	int error;
454	uint8_t iface_index;
455
456	if (sc == NULL) {
457		return (ENOMEM);
458	}
459	device_set_usb2_desc(dev);
460
461	mtx_init(&sc->sc_mtx, "ural lock", MTX_NETWORK_LOCK,
462	    MTX_DEF | MTX_RECURSE);
463
464	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
465	    device_get_nameunit(dev));
466
467	sc->sc_udev = uaa->device;
468	sc->sc_unit = device_get_unit(dev);
469
470	usb2_callout_init_mtx(&sc->sc_watchdog, &sc->sc_mtx, 0);
471
472	iface_index = RAL_IFACE_INDEX;
473	error = usb2_transfer_setup(uaa->device,
474	    &iface_index, sc->sc_xfer, ural_config,
475	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
476
477	if (error) {
478		device_printf(dev, "could not allocate USB transfers, "
479		    "err=%s\n", usb2_errstr(error));
480		goto detach;
481	}
482	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
483	    &ural_end_of_commands,
484	    sizeof(struct usb2_config_td_cc), 24);
485	if (error) {
486		device_printf(dev, "could not setup config "
487		    "thread!\n");
488		goto detach;
489	}
490	mtx_lock(&sc->sc_mtx);
491
492	/* start setup */
493
494	usb2_config_td_queue_command
495	    (&sc->sc_config_td, NULL, &ural_cfg_first_time_setup, 0, 0);
496
497	ural_watchdog(sc);
498	mtx_unlock(&sc->sc_mtx);
499	return (0);			/* success */
500
501detach:
502	ural_detach(dev);
503	return (ENXIO);			/* failure */
504}
505
506static int
507ural_detach(device_t dev)
508{
509	struct ural_softc *sc = device_get_softc(dev);
510	struct ieee80211com *ic;
511	struct ifnet *ifp;
512
513	usb2_config_td_drain(&sc->sc_config_td);
514
515	mtx_lock(&sc->sc_mtx);
516
517	usb2_callout_stop(&sc->sc_watchdog);
518
519	ural_cfg_pre_stop(sc, NULL, 0);
520
521	ifp = sc->sc_ifp;
522	ic = ifp->if_l2com;
523
524	mtx_unlock(&sc->sc_mtx);
525
526	/* stop all USB transfers first */
527	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
528
529	/* get rid of any late children */
530	bus_generic_detach(dev);
531
532	if (ifp) {
533		bpfdetach(ifp);
534		ieee80211_ifdetach(ic);
535		if_free(ifp);
536	}
537	usb2_config_td_unsetup(&sc->sc_config_td);
538
539	usb2_callout_drain(&sc->sc_watchdog);
540
541	mtx_destroy(&sc->sc_mtx);
542
543	return (0);
544}
545
546/*========================================================================*
547 * REGISTER READ / WRITE WRAPPER ROUTINES
548 *========================================================================*/
549
550static void
551ural_cfg_do_request(struct ural_softc *sc, struct usb2_device_request *req,
552    void *data)
553{
554	uint16_t length;
555	usb2_error_t err;
556
557repeat:
558
559	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
560		goto error;
561	}
562	err = usb2_do_request_flags
563	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
564
565	if (err) {
566
567		DPRINTF("device request failed, err=%s "
568		    "(ignored)\n", usb2_errstr(err));
569
570		/* wait a little before next try */
571		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
572			goto error;
573		}
574		/* try until we are detached */
575		goto repeat;
576
577error:
578		/* the device has been detached */
579		length = UGETW(req->wLength);
580
581		if ((req->bmRequestType & UT_READ) && length) {
582			bzero(data, length);
583		}
584	}
585}
586
587static void
588ural_cfg_set_testmode(struct ural_softc *sc)
589{
590	struct usb2_device_request req;
591
592	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
593	req.bRequest = RAL_VENDOR_REQUEST;
594	USETW(req.wValue, 4);
595	USETW(req.wIndex, 1);
596	USETW(req.wLength, 0);
597
598	ural_cfg_do_request(sc, &req, NULL);
599}
600
601static void
602ural_cfg_eeprom_read(struct ural_softc *sc, uint16_t addr,
603    void *buf, uint16_t len)
604{
605	struct usb2_device_request req;
606
607	req.bmRequestType = UT_READ_VENDOR_DEVICE;
608	req.bRequest = RAL_READ_EEPROM;
609	USETW(req.wValue, 0);
610	USETW(req.wIndex, addr);
611	USETW(req.wLength, len);
612
613	ural_cfg_do_request(sc, &req, buf);
614}
615
616static uint16_t
617ural_cfg_read(struct ural_softc *sc, uint16_t reg)
618{
619	struct usb2_device_request req;
620	uint16_t val;
621
622	req.bmRequestType = UT_READ_VENDOR_DEVICE;
623	req.bRequest = RAL_READ_MAC;
624	USETW(req.wValue, 0);
625	USETW(req.wIndex, reg);
626	USETW(req.wLength, sizeof(val));
627
628	ural_cfg_do_request(sc, &req, &val);
629
630	return (le16toh(val));
631}
632
633static void
634ural_cfg_read_multi(struct ural_softc *sc, uint16_t reg,
635    void *buf, uint16_t len)
636{
637	struct usb2_device_request req;
638
639	req.bmRequestType = UT_READ_VENDOR_DEVICE;
640	req.bRequest = RAL_READ_MULTI_MAC;
641	USETW(req.wValue, 0);
642	USETW(req.wIndex, reg);
643	USETW(req.wLength, len);
644
645	ural_cfg_do_request(sc, &req, buf);
646}
647
648static void
649ural_cfg_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
650{
651	struct usb2_device_request req;
652
653	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
654	req.bRequest = RAL_WRITE_MAC;
655	USETW(req.wValue, val);
656	USETW(req.wIndex, reg);
657	USETW(req.wLength, 0);
658
659	ural_cfg_do_request(sc, &req, NULL);
660}
661
662static void
663ural_cfg_write_multi(struct ural_softc *sc, uint16_t reg,
664    void *buf, uint16_t len)
665{
666	struct usb2_device_request req;
667
668	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
669	req.bRequest = RAL_WRITE_MULTI_MAC;
670	USETW(req.wValue, 0);
671	USETW(req.wIndex, reg);
672	USETW(req.wLength, len);
673
674	ural_cfg_do_request(sc, &req, buf);
675}
676
677static uint8_t
678ural_cfg_bbp_disbusy(struct ural_softc *sc)
679{
680	uint16_t tmp;
681	uint8_t to;
682
683	for (to = 0;; to++) {
684		if (to < 100) {
685			tmp = ural_cfg_read(sc, RAL_PHY_CSR8);
686			tmp &= RAL_BBP_BUSY;
687
688			if (tmp == 0) {
689				return (0);
690			}
691			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
692				break;
693			}
694		} else {
695			break;
696		}
697	}
698	DPRINTF("could not disbusy BBP\n");
699	return (1);			/* failure */
700}
701
702static void
703ural_cfg_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
704{
705	uint16_t tmp;
706
707	if (ural_cfg_bbp_disbusy(sc)) {
708		return;
709	}
710	tmp = (reg << 8) | val;
711	ural_cfg_write(sc, RAL_PHY_CSR7, tmp);
712}
713
714static uint8_t
715ural_cfg_bbp_read(struct ural_softc *sc, uint8_t reg)
716{
717	uint16_t val;
718
719	if (ural_cfg_bbp_disbusy(sc)) {
720		return (0);
721	}
722	val = RAL_BBP_WRITE | (reg << 8);
723	ural_cfg_write(sc, RAL_PHY_CSR7, val);
724
725	if (ural_cfg_bbp_disbusy(sc)) {
726		return (0);
727	}
728	return (ural_cfg_read(sc, RAL_PHY_CSR7) & 0xff);
729}
730
731static void
732ural_cfg_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
733{
734	uint32_t tmp;
735	uint8_t to;
736
737	reg &= 3;
738
739	/* remember last written value */
740	sc->sc_rf_regs[reg] = val;
741
742	for (to = 0;; to++) {
743		if (to < 100) {
744			tmp = ural_cfg_read(sc, RAL_PHY_CSR10);
745
746			if (!(tmp & RAL_RF_LOBUSY)) {
747				break;
748			}
749			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
750				return;
751			}
752		} else {
753			DPRINTF("could not write to RF\n");
754			return;
755		}
756	}
757
758	tmp = RAL_RF_BUSY | RAL_RF_20BIT | ((val & 0xfffff) << 2) | reg;
759	ural_cfg_write(sc, RAL_PHY_CSR9, tmp & 0xffff);
760	ural_cfg_write(sc, RAL_PHY_CSR10, tmp >> 16);
761
762	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
763}
764
765static void
766ural_cfg_first_time_setup(struct ural_softc *sc,
767    struct usb2_config_td_cc *cc, uint16_t refcount)
768{
769	struct ieee80211com *ic;
770	struct ifnet *ifp;
771	uint8_t bands;
772
773	/* setup RX tap header */
774	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
775	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
776	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
777
778	/* setup TX tap header */
779	sc->sc_txtap_len = sizeof(sc->sc_txtap);
780	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
781	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
782
783	/* retrieve RT2570 rev. no */
784	sc->sc_asic_rev = ural_cfg_read(sc, RAL_MAC_CSR0);
785
786	/* retrieve MAC address and various other things from EEPROM */
787	ural_cfg_read_eeprom(sc);
788
789	printf("%s: MAC/BBP RT2570 (rev 0x%02x), RF %s (0x%02x)\n",
790	    sc->sc_name, sc->sc_asic_rev, ural_get_rf(sc->sc_rf_rev),
791	    sc->sc_rf_rev);
792
793	mtx_unlock(&sc->sc_mtx);
794
795	ifp = if_alloc(IFT_IEEE80211);
796
797	mtx_lock(&sc->sc_mtx);
798
799	if (ifp == NULL) {
800		DPRINTFN(0, "could not if_alloc()!\n");
801		goto done;
802	}
803	sc->sc_evilhack = ifp;
804	sc->sc_ifp = ifp;
805	ic = ifp->if_l2com;
806
807	ifp->if_softc = sc;
808	if_initname(ifp, "ural", sc->sc_unit);
809	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
810	ifp->if_init = &ural_init_cb;
811	ifp->if_ioctl = &ural_ioctl_cb;
812	ifp->if_start = &ural_start_cb;
813	ifp->if_watchdog = NULL;
814	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
815	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
816	IFQ_SET_READY(&ifp->if_snd);
817
818	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
819
820	ic->ic_ifp = ifp;
821	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
822	ic->ic_opmode = IEEE80211_M_STA;
823
824	/* set device capabilities */
825	ic->ic_caps =
826	    IEEE80211_C_STA		/* station mode supported */
827	    | IEEE80211_C_IBSS		/* IBSS mode supported */
828	    | IEEE80211_C_MONITOR	/* monitor mode supported */
829	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
830	    | IEEE80211_C_TXPMGT	/* tx power management */
831	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
832	    | IEEE80211_C_SHSLOT	/* short slot time supported */
833	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
834	    | IEEE80211_C_WPA		/* 802.11i */
835	    ;
836
837	bands = 0;
838	setbit(&bands, IEEE80211_MODE_11B);
839	setbit(&bands, IEEE80211_MODE_11G);
840
841	if (sc->sc_rf_rev == RAL_RF_5222) {
842		setbit(&bands, IEEE80211_MODE_11A);
843	}
844	ieee80211_init_channels(ic, NULL, &bands);
845
846	mtx_unlock(&sc->sc_mtx);
847
848	ieee80211_ifattach(ic);
849
850	mtx_lock(&sc->sc_mtx);
851
852	ic->ic_newassoc = &ural_newassoc;
853	ic->ic_raw_xmit = &ural_raw_xmit_cb;
854	ic->ic_node_alloc = &ural_node_alloc;
855	ic->ic_update_mcast = &ural_update_mcast_cb;
856	ic->ic_update_promisc = &ural_update_promisc_cb;
857	ic->ic_scan_start = &ural_scan_start_cb;
858	ic->ic_scan_end = &ural_scan_end_cb;
859	ic->ic_set_channel = &ural_set_channel_cb;
860	ic->ic_vap_create = &ural_vap_create;
861	ic->ic_vap_delete = &ural_vap_delete;
862
863	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
864
865	mtx_unlock(&sc->sc_mtx);
866
867	bpfattach(ifp, DLT_IEEE802_11_RADIO,
868	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
869
870	if (bootverbose) {
871		ieee80211_announce(ic);
872	}
873	mtx_lock(&sc->sc_mtx);
874done:
875	return;
876}
877
878static void
879ural_end_of_commands(struct ural_softc *sc)
880{
881	sc->sc_flags &= ~URAL_FLAG_WAIT_COMMAND;
882
883	/* start write transfer, if not started */
884	usb2_transfer_start(sc->sc_xfer[0]);
885}
886
887static void
888ural_config_copy_chan(struct ural_config_copy_chan *cc,
889    struct ieee80211com *ic, struct ieee80211_channel *c)
890{
891	if (!c)
892		return;
893	cc->chan_to_ieee =
894	    ieee80211_chan2ieee(ic, c);
895	if (c != IEEE80211_CHAN_ANYC) {
896		cc->chan_to_mode =
897		    ieee80211_chan2mode(c);
898		if (IEEE80211_IS_CHAN_B(c))
899			cc->chan_is_b = 1;
900		if (IEEE80211_IS_CHAN_A(c))
901			cc->chan_is_a = 1;
902		if (IEEE80211_IS_CHAN_2GHZ(c))
903			cc->chan_is_2ghz = 1;
904		if (IEEE80211_IS_CHAN_5GHZ(c))
905			cc->chan_is_5ghz = 1;
906		if (IEEE80211_IS_CHAN_ANYG(c))
907			cc->chan_is_g = 1;
908	}
909}
910
911static void
912ural_config_copy(struct ural_softc *sc,
913    struct usb2_config_td_cc *cc, uint16_t refcount)
914{
915	struct ifnet *ifp;
916	struct ieee80211com *ic;
917	struct ieee80211_node *ni;
918	struct ieee80211vap *vap;
919	const struct ieee80211_txparam *tp;
920
921	bzero(cc, sizeof(*cc));
922
923	ifp = sc->sc_ifp;
924	if (ifp) {
925		cc->if_flags = ifp->if_flags;
926		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
927		    sizeof(cc->if_broadcastaddr));
928
929		ic = ifp->if_l2com;
930		if (ic) {
931			ural_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
932			ural_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
933			vap = TAILQ_FIRST(&ic->ic_vaps);
934			if (vap) {
935				ni = vap->iv_bss;
936				if (ni) {
937					cc->iv_bss.ni_intval = ni->ni_intval;
938					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
939					    sizeof(cc->iv_bss.ni_bssid));
940				}
941				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
942				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
943					cc->iv_bss.fixed_rate_none = 1;
944				}
945			}
946			cc->ic_opmode = ic->ic_opmode;
947			cc->ic_flags = ic->ic_flags;
948			cc->ic_txpowlimit = ic->ic_txpowlimit;
949			cc->ic_curmode = ic->ic_curmode;
950
951			bcopy(ic->ic_myaddr, cc->ic_myaddr,
952			    sizeof(cc->ic_myaddr));
953		}
954	}
955	sc->sc_flags |= URAL_FLAG_WAIT_COMMAND;
956}
957
958static const char *
959ural_get_rf(int rev)
960{
961	;				/* style fix */
962
963	switch (rev) {
964	case RAL_RF_2522:
965		return "RT2522";
966	case RAL_RF_2523:
967		return "RT2523";
968	case RAL_RF_2524:
969		return "RT2524";
970	case RAL_RF_2525:
971		return "RT2525";
972	case RAL_RF_2525E:
973		return "RT2525e";
974	case RAL_RF_2526:
975		return "RT2526";
976	case RAL_RF_5222:
977		return "RT5222";
978	default:
979		return "unknown";
980	}
981}
982
983/*------------------------------------------------------------------------*
984 * ural_bulk_read_callback - data read "thread"
985 *------------------------------------------------------------------------*/
986static void
987ural_bulk_read_callback(struct usb2_xfer *xfer)
988{
989	struct ural_softc *sc = xfer->priv_sc;
990	struct ifnet *ifp = sc->sc_ifp;
991	struct ieee80211com *ic = ifp->if_l2com;
992	struct ieee80211_node *ni;
993	struct mbuf *m = NULL;
994	uint32_t flags;
995	uint32_t max_len;
996	uint32_t real_len;
997	uint8_t rssi = 0;
998
999	switch (USB_GET_STATE(xfer)) {
1000	case USB_ST_TRANSFERRED:
1001
1002		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
1003
1004		if (xfer->actlen < RAL_RX_DESC_SIZE) {
1005			DPRINTF("too short transfer, "
1006			    "%d bytes\n", xfer->actlen);
1007			ifp->if_ierrors++;
1008			goto tr_setup;
1009		}
1010		max_len = (xfer->actlen - RAL_RX_DESC_SIZE);
1011
1012		usb2_copy_out(xfer->frbuffers, max_len,
1013		    &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
1014
1015		flags = le32toh(sc->sc_rx_desc.flags);
1016
1017		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
1018			/*
1019		         * This should not happen since we did not
1020		         * request to receive those frames when we
1021		         * filled RAL_TXRX_CSR2:
1022		         */
1023			DPRINTFN(6, "PHY or CRC error\n");
1024			ifp->if_ierrors++;
1025			goto tr_setup;
1026		}
1027		if (max_len > MCLBYTES) {
1028			max_len = MCLBYTES;
1029		}
1030		real_len = (flags >> 16) & 0xfff;
1031
1032		if (real_len > max_len) {
1033			DPRINTF("invalid length in RX "
1034			    "descriptor, %u bytes, received %u bytes\n",
1035			    real_len, max_len);
1036			ifp->if_ierrors++;
1037			goto tr_setup;
1038		}
1039		/* ieee80211_input() will check if the mbuf is too short */
1040
1041		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1042
1043		if (m == NULL) {
1044			DPRINTF("could not allocate mbuf\n");
1045			ifp->if_ierrors++;
1046			goto tr_setup;
1047		}
1048		usb2_copy_out(xfer->frbuffers, 0, m->m_data, max_len);
1049
1050		/* finalize mbuf */
1051		m->m_pkthdr.rcvif = ifp;
1052		m->m_pkthdr.len = m->m_len = real_len;
1053
1054		DPRINTF("real length=%d bytes\n", real_len);
1055
1056		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
1057
1058		if (bpf_peers_present(ifp->if_bpf)) {
1059			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
1060
1061			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1062			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1063			    (sc->sc_rx_desc.flags & htole32(RAL_RX_OFDM)) ?
1064			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1065
1066			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1067			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1068			tap->wr_antenna = sc->sc_rx_ant;
1069			tap->wr_antsignal = rssi;
1070
1071			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1072		}
1073		/* Strip trailing 802.11 MAC FCS. */
1074		m_adj(m, -IEEE80211_CRC_LEN);
1075
1076	case USB_ST_SETUP:
1077tr_setup:
1078
1079		if (sc->sc_flags & URAL_FLAG_READ_STALL) {
1080			usb2_transfer_start(sc->sc_xfer[3]);
1081		} else {
1082			xfer->frlengths[0] = xfer->max_data_length;
1083			usb2_start_hardware(xfer);
1084		}
1085
1086		/*
1087		 * At the end of a USB callback it is always safe to unlock
1088		 * the private mutex of a device! That is why we do the
1089		 * "ieee80211_input" here, and not some lines up!
1090		 */
1091		if (m) {
1092			mtx_unlock(&sc->sc_mtx);
1093
1094			ni = ieee80211_find_rxnode(ic, (void *)(m->m_data));
1095
1096			if (ni) {
1097				/* send the frame to the 802.11 layer */
1098				if (ieee80211_input(ni, m, rssi, RAL_NOISE_FLOOR, 0)) {
1099					/* ignore */
1100				}
1101				/* node is no longer needed */
1102				ieee80211_free_node(ni);
1103			} else {
1104				/* broadcast */
1105				if (ieee80211_input_all(ic, m, rssi, RAL_NOISE_FLOOR, 0)) {
1106					/* ignore */
1107				}
1108			}
1109
1110			mtx_lock(&sc->sc_mtx);
1111		}
1112		return;
1113
1114	default:			/* Error */
1115		if (xfer->error != USB_ERR_CANCELLED) {
1116			/* try to clear stall first */
1117			sc->sc_flags |= URAL_FLAG_READ_STALL;
1118			usb2_transfer_start(sc->sc_xfer[3]);
1119		}
1120		return;
1121
1122	}
1123}
1124
1125static void
1126ural_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1127{
1128	struct ural_softc *sc = xfer->priv_sc;
1129	struct usb2_xfer *xfer_other = sc->sc_xfer[1];
1130
1131	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1132		DPRINTF("stall cleared\n");
1133		sc->sc_flags &= ~URAL_FLAG_READ_STALL;
1134		usb2_transfer_start(xfer_other);
1135	}
1136}
1137
1138static uint8_t
1139ural_plcp_signal(uint16_t rate)
1140{
1141	;				/* indent fix */
1142	switch (rate) {
1143		/* CCK rates (NB: not IEEE std, device-specific) */
1144	case 2:
1145		return (0x0);
1146	case 4:
1147		return (0x1);
1148	case 11:
1149		return (0x2);
1150	case 22:
1151		return (0x3);
1152
1153		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1154	case 12:
1155		return (0xb);
1156	case 18:
1157		return (0xf);
1158	case 24:
1159		return (0xa);
1160	case 36:
1161		return (0xe);
1162	case 48:
1163		return (0x9);
1164	case 72:
1165		return (0xd);
1166	case 96:
1167		return (0x8);
1168	case 108:
1169		return (0xc);
1170
1171		/* XXX unsupported/unknown rate */
1172	default:
1173		return (0xff);
1174	}
1175}
1176
1177/*
1178 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1179 * should be freed, when "ural_setup_desc_and_tx" is called.
1180 */
1181static void
1182ural_setup_desc_and_tx(struct ural_softc *sc, struct mbuf *m,
1183    uint32_t flags, uint16_t rate)
1184{
1185	struct ifnet *ifp = sc->sc_ifp;
1186	struct ieee80211com *ic = ifp->if_l2com;
1187	struct mbuf *mm;
1188	enum ieee80211_phytype phytype;
1189	uint16_t plcp_length;
1190	uint16_t len;
1191	uint8_t remainder;
1192
1193	DPRINTF("in\n");
1194
1195	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1196		/* free packet */
1197		ural_tx_freem(m);
1198		ifp->if_oerrors++;
1199		return;
1200	}
1201	if (!((sc->sc_flags & URAL_FLAG_LL_READY) &&
1202	    (sc->sc_flags & URAL_FLAG_HL_READY))) {
1203		/* free packet */
1204		ural_tx_freem(m);
1205		ifp->if_oerrors++;
1206		return;
1207	}
1208	if (rate < 2) {
1209		DPRINTF("rate < 2!\n");
1210
1211		/* avoid division by zero */
1212		rate = 2;
1213	}
1214	ic->ic_lastdata = ticks;
1215
1216	if (bpf_peers_present(ifp->if_bpf)) {
1217		struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
1218
1219		tap->wt_flags = 0;
1220		tap->wt_rate = rate;
1221		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1222		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1223		tap->wt_antenna = sc->sc_tx_ant;
1224
1225		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1226	}
1227	len = m->m_pkthdr.len;
1228
1229	sc->sc_tx_desc.flags = htole32(flags);
1230	sc->sc_tx_desc.flags |= htole32(RAL_TX_NEWSEQ);
1231	sc->sc_tx_desc.flags |= htole32(len << 16);
1232
1233	sc->sc_tx_desc.wme = htole16(RAL_AIFSN(2) |
1234	    RAL_LOGCWMIN(3) |
1235	    RAL_LOGCWMAX(5) |
1236	    RAL_IVOFFSET(sizeof(struct ieee80211_frame)));
1237
1238	/* setup PLCP fields */
1239	sc->sc_tx_desc.plcp_signal = ural_plcp_signal(rate);
1240	sc->sc_tx_desc.plcp_service = 4;
1241
1242	len += IEEE80211_CRC_LEN;
1243
1244	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1245
1246	if (phytype == IEEE80211_T_OFDM) {
1247		sc->sc_tx_desc.flags |= htole32(RAL_TX_OFDM);
1248
1249		plcp_length = len & 0xfff;
1250		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1251		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1252
1253	} else {
1254		plcp_length = ((16 * len) + rate - 1) / rate;
1255		if (rate == 22) {
1256			remainder = (16 * len) % 22;
1257			if ((remainder != 0) && (remainder < 7)) {
1258				sc->sc_tx_desc.plcp_service |=
1259				    RAL_PLCP_LENGEXT;
1260			}
1261		}
1262		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1263		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1264
1265		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1266			sc->sc_tx_desc.plcp_signal |= 0x08;
1267		}
1268	}
1269
1270	sc->sc_tx_desc.iv = 0;
1271	sc->sc_tx_desc.eiv = 0;
1272
1273	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1274		DPRINTF("No room for header structure!\n");
1275		ural_tx_freem(m);
1276		return;
1277	}
1278	mm = m_gethdr(M_NOWAIT, MT_DATA);
1279	if (mm == NULL) {
1280		DPRINTF("Could not allocate header mbuf!\n");
1281		ural_tx_freem(m);
1282		return;
1283	}
1284	DPRINTF(" %zu %u (out)\n", sizeof(sc->sc_tx_desc), m->m_pkthdr.len);
1285
1286	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1287	mm->m_len = sizeof(sc->sc_tx_desc);
1288
1289	mm->m_next = m;
1290	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1291	mm->m_pkthdr.rcvif = NULL;
1292
1293	/* start write transfer, if not started */
1294	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1295
1296	usb2_transfer_start(sc->sc_xfer[0]);
1297}
1298
1299static void
1300ural_bulk_write_callback(struct usb2_xfer *xfer)
1301{
1302	struct ural_softc *sc = xfer->priv_sc;
1303	struct ifnet *ifp = sc->sc_ifp;
1304	struct mbuf *m;
1305	uint16_t temp_len;
1306	uint8_t align;
1307
1308	switch (USB_GET_STATE(xfer)) {
1309	case USB_ST_TRANSFERRED:
1310		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
1311
1312		ifp->if_opackets++;
1313
1314	case USB_ST_SETUP:
1315		if (sc->sc_flags & URAL_FLAG_WRITE_STALL) {
1316			usb2_transfer_start(sc->sc_xfer[2]);
1317			break;
1318		}
1319		if (sc->sc_flags & URAL_FLAG_WAIT_COMMAND) {
1320			/*
1321			 * don't send anything while a command is pending !
1322			 */
1323			break;
1324		}
1325		ural_fill_write_queue(sc);
1326
1327		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1328
1329		if (m) {
1330
1331			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
1332				DPRINTFN(0, "data overflow, %u bytes\n",
1333				    m->m_pkthdr.len);
1334				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
1335			}
1336			usb2_m_copy_in(xfer->frbuffers, 0,
1337			    m, 0, m->m_pkthdr.len);
1338
1339			/* compute transfer length */
1340			temp_len = m->m_pkthdr.len;
1341
1342			/* make transfer length 16-bit aligned */
1343			align = (temp_len & 1);
1344
1345			/* check if we need to add two extra bytes */
1346			if (((temp_len + align) % 64) == 0) {
1347				align += 2;
1348			}
1349			/* check if we need to align length */
1350			if (align != 0) {
1351				/* zero the extra bytes */
1352				usb2_bzero(xfer->frbuffers, temp_len, align);
1353				temp_len += align;
1354			}
1355			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
1356			    m->m_pkthdr.len, temp_len);
1357
1358			xfer->frlengths[0] = temp_len;
1359
1360			usb2_start_hardware(xfer);
1361
1362			/* free mbuf and node */
1363			ural_tx_freem(m);
1364		}
1365		break;
1366
1367	default:			/* Error */
1368		DPRINTFN(11, "transfer error, %s\n",
1369		    usb2_errstr(xfer->error));
1370
1371		if (xfer->error != USB_ERR_CANCELLED) {
1372			/* try to clear stall first */
1373			sc->sc_flags |= URAL_FLAG_WRITE_STALL;
1374			usb2_transfer_start(sc->sc_xfer[2]);
1375		}
1376		ifp->if_oerrors++;
1377		break;
1378	}
1379}
1380
1381static void
1382ural_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1383{
1384	struct ural_softc *sc = xfer->priv_sc;
1385	struct usb2_xfer *xfer_other = sc->sc_xfer[0];
1386
1387	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1388		DPRINTF("stall cleared\n");
1389		sc->sc_flags &= ~URAL_FLAG_WRITE_STALL;
1390		usb2_transfer_start(xfer_other);
1391	}
1392}
1393
1394static void
1395ural_watchdog(void *arg)
1396{
1397	struct ural_softc *sc = arg;
1398
1399	mtx_assert(&sc->sc_mtx, MA_OWNED);
1400
1401	if (sc->sc_amrr_timer) {
1402		usb2_config_td_queue_command
1403		    (&sc->sc_config_td, NULL,
1404		    &ural_cfg_amrr_timeout, 0, 0);
1405	}
1406	usb2_callout_reset(&sc->sc_watchdog,
1407	    hz, &ural_watchdog, sc);
1408}
1409
1410/*========================================================================*
1411 * IF-net callbacks
1412 *========================================================================*/
1413
1414static void
1415ural_init_cb(void *arg)
1416{
1417	struct ural_softc *sc = arg;
1418
1419	mtx_lock(&sc->sc_mtx);
1420	usb2_config_td_queue_command
1421	    (&sc->sc_config_td, &ural_cfg_pre_init,
1422	    &ural_cfg_init, 0, 0);
1423	mtx_unlock(&sc->sc_mtx);
1424}
1425
1426static int
1427ural_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1428{
1429	struct ural_softc *sc = ifp->if_softc;
1430	struct ieee80211com *ic = ifp->if_l2com;
1431	int error;
1432
1433	switch (cmd) {
1434	case SIOCSIFFLAGS:
1435		mtx_lock(&sc->sc_mtx);
1436		if (ifp->if_flags & IFF_UP) {
1437			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1438				usb2_config_td_queue_command
1439				    (&sc->sc_config_td, &ural_cfg_pre_init,
1440				    &ural_cfg_init, 0, 0);
1441			}
1442		} else {
1443			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1444				usb2_config_td_queue_command
1445				    (&sc->sc_config_td, &ural_cfg_pre_stop,
1446				    &ural_cfg_stop, 0, 0);
1447			}
1448		}
1449		mtx_unlock(&sc->sc_mtx);
1450		error = 0;
1451		break;
1452
1453	case SIOCGIFMEDIA:
1454	case SIOCSIFMEDIA:
1455		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1456		break;
1457
1458	default:
1459		error = ether_ioctl(ifp, cmd, data);
1460	}
1461	return (error);
1462}
1463
1464static void
1465ural_start_cb(struct ifnet *ifp)
1466{
1467	struct ural_softc *sc = ifp->if_softc;
1468
1469	mtx_lock(&sc->sc_mtx);
1470	/* start write transfer, if not started */
1471	usb2_transfer_start(sc->sc_xfer[0]);
1472	mtx_unlock(&sc->sc_mtx);
1473}
1474
1475static void
1476ural_cfg_newstate(struct ural_softc *sc,
1477    struct usb2_config_td_cc *cc, uint16_t refcount)
1478{
1479	struct ifnet *ifp = sc->sc_ifp;
1480	struct ieee80211com *ic = ifp->if_l2com;
1481	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1482	struct ural_vap *uvp = URAL_VAP(vap);
1483	enum ieee80211_state ostate;
1484	enum ieee80211_state nstate;
1485	int arg;
1486
1487	ostate = vap->iv_state;
1488	nstate = sc->sc_ns_state;
1489	arg = sc->sc_ns_arg;
1490
1491	if (ostate == IEEE80211_S_INIT) {
1492		/* We are leaving INIT. TSF sync should be off. */
1493		ural_cfg_disable_tsf_sync(sc);
1494	}
1495	switch (nstate) {
1496	case IEEE80211_S_INIT:
1497		break;
1498
1499	case IEEE80211_S_RUN:
1500		ural_cfg_set_run(sc, cc);
1501		break;
1502
1503	default:
1504		break;
1505	}
1506
1507	mtx_unlock(&sc->sc_mtx);
1508	IEEE80211_LOCK(ic);
1509	uvp->newstate(vap, nstate, arg);
1510	if (vap->iv_newstate_cb != NULL)
1511		vap->iv_newstate_cb(vap, nstate, arg);
1512	IEEE80211_UNLOCK(ic);
1513	mtx_lock(&sc->sc_mtx);
1514}
1515
1516static int
1517ural_newstate_cb(struct ieee80211vap *vap,
1518    enum ieee80211_state nstate, int arg)
1519{
1520	struct ural_vap *uvp = URAL_VAP(vap);
1521	struct ieee80211com *ic = vap->iv_ic;
1522	struct ural_softc *sc = ic->ic_ifp->if_softc;
1523
1524	DPRINTF("setting new state: %d\n", nstate);
1525
1526	/* Special case - cannot defer this call and cannot block ! */
1527	if (nstate == IEEE80211_S_INIT) {
1528		/* stop timers */
1529		mtx_lock(&sc->sc_mtx);
1530		sc->sc_amrr_timer = 0;
1531		mtx_unlock(&sc->sc_mtx);
1532		return (uvp->newstate(vap, nstate, arg));
1533	}
1534	mtx_lock(&sc->sc_mtx);
1535	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1536		mtx_unlock(&sc->sc_mtx);
1537		return (0);		/* nothing to do */
1538	}
1539	/* store next state */
1540	sc->sc_ns_state = nstate;
1541	sc->sc_ns_arg = arg;
1542
1543	/* stop timers */
1544	sc->sc_amrr_timer = 0;
1545
1546	/*
1547	 * USB configuration can only be done from the USB configuration
1548	 * thread:
1549	 */
1550	usb2_config_td_queue_command
1551	    (&sc->sc_config_td, &ural_config_copy,
1552	    &ural_cfg_newstate, 0, 0);
1553
1554	mtx_unlock(&sc->sc_mtx);
1555
1556	return (EINPROGRESS);
1557}
1558
1559static void
1560ural_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1561{
1562	struct ural_softc *sc = ic->ic_ifp->if_softc;
1563
1564	mtx_lock(&sc->sc_mtx);
1565
1566	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1567
1568	usb2_config_td_queue_command
1569	    (&sc->sc_config_td, &ural_config_copy, func, 0, 0);
1570
1571	mtx_unlock(&sc->sc_mtx);
1572}
1573
1574static void
1575ural_scan_start_cb(struct ieee80211com *ic)
1576{
1577	ural_std_command(ic, &ural_cfg_scan_start);
1578}
1579
1580static void
1581ural_scan_end_cb(struct ieee80211com *ic)
1582{
1583	ural_std_command(ic, &ural_cfg_scan_end);
1584}
1585
1586static void
1587ural_set_channel_cb(struct ieee80211com *ic)
1588{
1589	ural_std_command(ic, &ural_cfg_set_chan);
1590}
1591
1592/*========================================================================*
1593 * configure sub-routines, ural_cfg_xxx
1594 *========================================================================*/
1595
1596static void
1597ural_cfg_scan_start(struct ural_softc *sc,
1598    struct usb2_config_td_cc *cc, uint16_t refcount)
1599{
1600	/* abort TSF synchronization */
1601	ural_cfg_disable_tsf_sync(sc);
1602	ural_cfg_set_bssid(sc, cc->if_broadcastaddr);
1603}
1604
1605static void
1606ural_cfg_scan_end(struct ural_softc *sc,
1607    struct usb2_config_td_cc *cc, uint16_t refcount)
1608{
1609	/* enable TSF synchronization */
1610	ural_cfg_enable_tsf_sync(sc, cc, 0);
1611	ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1612}
1613
1614static void
1615ural_cfg_set_chan(struct ural_softc *sc,
1616    struct usb2_config_td_cc *cc, uint16_t refcount)
1617{
1618	enum {
1619		N_RF5222 = (sizeof(ural_rf5222) / sizeof(ural_rf5222[0])),
1620	};
1621	uint32_t i;
1622	uint32_t chan;
1623	uint8_t power;
1624	uint8_t tmp;
1625
1626	chan = cc->ic_curchan.chan_to_ieee;
1627
1628	if ((chan == 0) ||
1629	    (chan == IEEE80211_CHAN_ANY)) {
1630		/* nothing to do */
1631		return;
1632	}
1633	if (cc->ic_curchan.chan_is_2ghz)
1634		power = min(sc->sc_txpow[chan - 1], 31);
1635	else
1636		power = 31;
1637
1638	/* adjust txpower using ifconfig settings */
1639	power -= (100 - cc->ic_txpowlimit) / 8;
1640
1641	DPRINTFN(3, "setting channel to %u, "
1642	    "tx-power to %u\n", chan, power);
1643
1644	switch (sc->sc_rf_rev) {
1645	case RAL_RF_2522:
1646		ural_cfg_rf_write(sc, RAL_RF1, 0x00814);
1647		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1648		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1649		break;
1650
1651	case RAL_RF_2523:
1652		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1653		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1654		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x38044);
1655		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1656		break;
1657
1658	case RAL_RF_2524:
1659		ural_cfg_rf_write(sc, RAL_RF1, 0x0c808);
1660		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1661		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1662		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1663		break;
1664
1665	case RAL_RF_2525:
1666		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1667		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1668		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1669		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1670
1671		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1672		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1673		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1674		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1675		break;
1676
1677	case RAL_RF_2525E:
1678		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1679		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1680		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1681		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1682		break;
1683
1684	case RAL_RF_2526:
1685		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1686		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1687		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1688
1689		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1690		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1691		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1692		break;
1693
1694		/* dual-band RF */
1695	case RAL_RF_5222:
1696		for (i = 0; i < N_RF5222; i++) {
1697			if (ural_rf5222[i].chan == chan) {
1698				ural_cfg_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1699				ural_cfg_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1700				ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1701				ural_cfg_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1702				break;
1703			}
1704		}
1705		break;
1706	}
1707
1708	if ((cc->ic_opmode != IEEE80211_M_MONITOR) &&
1709	    (!(cc->ic_flags & IEEE80211_F_SCAN))) {
1710
1711		/* set Japan filter bit for channel 14 */
1712		tmp = ural_cfg_bbp_read(sc, 70);
1713
1714		if (chan == 14) {
1715			tmp |= RAL_JAPAN_FILTER;
1716		} else {
1717			tmp &= ~RAL_JAPAN_FILTER;
1718		}
1719
1720		ural_cfg_bbp_write(sc, 70, tmp);
1721
1722		/* clear CRC errors */
1723		ural_cfg_read(sc, RAL_STA_CSR0);
1724
1725		ural_cfg_disable_rf_tune(sc);
1726	}
1727	/* update basic rate set */
1728	if (cc->ic_curchan.chan_is_b) {
1729		/* 11b basic rates: 1, 2Mbps */
1730		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1731	} else if (cc->ic_curchan.chan_is_a) {
1732		/* 11a basic rates: 6, 12, 24Mbps */
1733		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1734	} else {
1735		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1736		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1737	}
1738
1739	/* wait a little */
1740	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1741		return;
1742	}
1743}
1744
1745static void
1746ural_cfg_set_run(struct ural_softc *sc,
1747    struct usb2_config_td_cc *cc)
1748{
1749	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1750		ural_cfg_update_slot(sc, cc, 0);
1751		ural_cfg_set_txpreamble(sc, cc, 0);
1752
1753		/* update basic rate set */
1754
1755		if (cc->ic_bsschan.chan_is_5ghz) {
1756			/* 11a basic rates: 6, 12, 24Mbps */
1757			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1758		} else if (cc->ic_bsschan.chan_is_g) {
1759			/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1760			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1761		} else {
1762			/* 11b basic rates: 1, 2Mbps */
1763			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1764		}
1765		ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1766	}
1767	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1768	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1769		ural_tx_bcn(sc);
1770	}
1771	/* make tx led blink on tx (controlled by ASIC) */
1772	ural_cfg_write(sc, RAL_MAC_CSR20, 1);
1773
1774	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1775		ural_cfg_enable_tsf_sync(sc, cc, 0);
1776	}
1777	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1778	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
1779
1780	if (cc->iv_bss.fixed_rate_none) {
1781		/* enable automatic rate adaptation */
1782		ural_cfg_amrr_start(sc);
1783	}
1784}
1785
1786/*------------------------------------------------------------------------*
1787 * ural_cfg_disable_rf_tune - disable RF auto-tuning
1788 *------------------------------------------------------------------------*/
1789static void
1790ural_cfg_disable_rf_tune(struct ural_softc *sc)
1791{
1792	uint32_t tmp;
1793
1794	if (sc->sc_rf_rev != RAL_RF_2523) {
1795		tmp = sc->sc_rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1796		ural_cfg_rf_write(sc, RAL_RF1, tmp);
1797	}
1798	tmp = sc->sc_rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1799	ural_cfg_rf_write(sc, RAL_RF3, tmp);
1800
1801	DPRINTFN(3, "disabling RF autotune\n");
1802}
1803
1804/*------------------------------------------------------------------------*
1805 * ural_cfg_enable_tsf_sync - refer to IEEE Std 802.11-1999 pp. 123
1806 * for more information on TSF synchronization
1807 *------------------------------------------------------------------------*/
1808static void
1809ural_cfg_enable_tsf_sync(struct ural_softc *sc,
1810    struct usb2_config_td_cc *cc, uint16_t refcount)
1811{
1812	uint16_t logcwmin;
1813	uint16_t preload;
1814	uint16_t tmp;
1815
1816	/* first, disable TSF synchronization */
1817	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1818
1819	tmp = (16 * cc->iv_bss.ni_intval) << 4;
1820	ural_cfg_write(sc, RAL_TXRX_CSR18, tmp);
1821
1822	logcwmin = (cc->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1823	preload = (cc->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1824	tmp = (logcwmin << 12) | preload;
1825	ural_cfg_write(sc, RAL_TXRX_CSR20, tmp);
1826
1827	/* finally, enable TSF synchronization */
1828	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1829	if (cc->ic_opmode == IEEE80211_M_STA)
1830		tmp |= RAL_ENABLE_TSF_SYNC(1);
1831	else
1832		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1833
1834	ural_cfg_write(sc, RAL_TXRX_CSR19, tmp);
1835
1836	DPRINTF("enabling TSF synchronization\n");
1837}
1838
1839static void
1840ural_cfg_disable_tsf_sync(struct ural_softc *sc)
1841{
1842	/* abort TSF synchronization */
1843	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1844
1845	/* force tx led to stop blinking */
1846	ural_cfg_write(sc, RAL_MAC_CSR20, 0);
1847}
1848
1849#define	RAL_RXTX_TURNAROUND    5	/* us */
1850
1851static void
1852ural_cfg_update_slot(struct ural_softc *sc,
1853    struct usb2_config_td_cc *cc, uint16_t refcount)
1854{
1855	uint16_t slottime;
1856	uint16_t sifs;
1857	uint16_t eifs;
1858
1859	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1860
1861	/*
1862	 * These settings may sound a bit inconsistent but this is what the
1863	 * reference driver does.
1864	 */
1865	if (cc->ic_curmode == IEEE80211_MODE_11B) {
1866		sifs = 16 - RAL_RXTX_TURNAROUND;
1867		eifs = 364;
1868	} else {
1869		sifs = 10 - RAL_RXTX_TURNAROUND;
1870		eifs = 64;
1871	}
1872
1873	ural_cfg_write(sc, RAL_MAC_CSR10, slottime);
1874	ural_cfg_write(sc, RAL_MAC_CSR11, sifs);
1875	ural_cfg_write(sc, RAL_MAC_CSR12, eifs);
1876}
1877
1878static void
1879ural_cfg_set_txpreamble(struct ural_softc *sc,
1880    struct usb2_config_td_cc *cc, uint16_t refcount)
1881{
1882	uint16_t tmp;
1883
1884	tmp = ural_cfg_read(sc, RAL_TXRX_CSR10);
1885
1886	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE) {
1887		tmp |= RAL_SHORT_PREAMBLE;
1888	} else {
1889		tmp &= ~RAL_SHORT_PREAMBLE;
1890	}
1891
1892	ural_cfg_write(sc, RAL_TXRX_CSR10, tmp);
1893}
1894
1895static void
1896ural_cfg_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1897{
1898	ural_cfg_write_multi(sc, RAL_MAC_CSR5, bssid, IEEE80211_ADDR_LEN);
1899
1900	DPRINTF("setting BSSID to 0x%02x%02x%02x%02x%02x%02x\n",
1901	    bssid[5], bssid[4], bssid[3],
1902	    bssid[2], bssid[1], bssid[0]);
1903}
1904
1905static void
1906ural_cfg_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1907{
1908	ural_cfg_write_multi(sc, RAL_MAC_CSR2, addr, IEEE80211_ADDR_LEN);
1909
1910	DPRINTF("setting MAC to 0x%02x%02x%02x%02x%02x%02x\n",
1911	    addr[5], addr[4], addr[3],
1912	    addr[2], addr[1], addr[0]);
1913}
1914
1915static void
1916ural_cfg_update_promisc(struct ural_softc *sc,
1917    struct usb2_config_td_cc *cc, uint16_t refcount)
1918{
1919	uint16_t tmp;
1920
1921	tmp = ural_cfg_read(sc, RAL_TXRX_CSR2);
1922
1923	if (cc->if_flags & IFF_PROMISC) {
1924		tmp &= ~RAL_DROP_NOT_TO_ME;
1925	} else {
1926		tmp |= RAL_DROP_NOT_TO_ME;
1927	}
1928
1929	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
1930
1931	DPRINTF("%s promiscuous mode\n",
1932	    (cc->if_flags & IFF_PROMISC) ?
1933	    "entering" : "leaving");
1934}
1935
1936static void
1937ural_cfg_set_txantenna(struct ural_softc *sc, uint8_t antenna)
1938{
1939	uint16_t tmp;
1940	uint8_t tx;
1941
1942	tx = ural_cfg_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1943	if (antenna == 1)
1944		tx |= RAL_BBP_ANTA;
1945	else if (antenna == 2)
1946		tx |= RAL_BBP_ANTB;
1947	else
1948		tx |= RAL_BBP_DIVERSITY;
1949
1950	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1951	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1952	    (sc->sc_rf_rev == RAL_RF_2526) ||
1953	    (sc->sc_rf_rev == RAL_RF_5222)) {
1954		tx |= RAL_BBP_FLIPIQ;
1955	}
1956	ural_cfg_bbp_write(sc, RAL_BBP_TX, tx);
1957
1958	/* update values in PHY_CSR5 and PHY_CSR6 */
1959	tmp = ural_cfg_read(sc, RAL_PHY_CSR5) & ~0x7;
1960	ural_cfg_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1961
1962	tmp = ural_cfg_read(sc, RAL_PHY_CSR6) & ~0x7;
1963	ural_cfg_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1964}
1965
1966static void
1967ural_cfg_set_rxantenna(struct ural_softc *sc, uint8_t antenna)
1968{
1969	uint8_t rx;
1970
1971	rx = ural_cfg_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1972	if (antenna == 1)
1973		rx |= RAL_BBP_ANTA;
1974	else if (antenna == 2)
1975		rx |= RAL_BBP_ANTB;
1976	else
1977		rx |= RAL_BBP_DIVERSITY;
1978
1979	/* need to force no I/Q flip for RF 2525e and 2526 */
1980
1981	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1982	    (sc->sc_rf_rev == RAL_RF_2526)) {
1983		rx &= ~RAL_BBP_FLIPIQ;
1984	}
1985	ural_cfg_bbp_write(sc, RAL_BBP_RX, rx);
1986}
1987
1988static void
1989ural_cfg_read_eeprom(struct ural_softc *sc)
1990{
1991	uint16_t val;
1992
1993	ural_cfg_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1994
1995	val = le16toh(val);
1996
1997	sc->sc_rf_rev = (val >> 11) & 0x7;
1998	sc->sc_hw_radio = (val >> 10) & 0x1;
1999	sc->sc_led_mode = (val >> 6) & 0x7;
2000	sc->sc_rx_ant = (val >> 4) & 0x3;
2001	sc->sc_tx_ant = (val >> 2) & 0x3;
2002	sc->sc_nb_ant = (val & 0x3);
2003
2004	DPRINTF("val = 0x%04x\n", val);
2005
2006	/* read MAC address */
2007	ural_cfg_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_myaddr,
2008	    sizeof(sc->sc_myaddr));
2009
2010	/* read default values for BBP registers */
2011	ural_cfg_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->sc_bbp_prom,
2012	    sizeof(sc->sc_bbp_prom));
2013
2014	/* read Tx power for all b/g channels */
2015	ural_cfg_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->sc_txpow,
2016	    sizeof(sc->sc_txpow));
2017}
2018
2019static uint8_t
2020ural_cfg_bbp_init(struct ural_softc *sc)
2021{
2022	enum {
2023		N_DEF_BBP = (sizeof(ural_def_bbp) / sizeof(ural_def_bbp[0])),
2024	};
2025	uint16_t i;
2026	uint8_t to;
2027
2028	/* wait for BBP to become ready */
2029	for (to = 0;; to++) {
2030		if (to < 100) {
2031			if (ural_cfg_bbp_read(sc, RAL_BBP_VERSION) != 0) {
2032				break;
2033			}
2034			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2035				return (1);	/* failure */
2036			}
2037		} else {
2038			DPRINTF("timeout waiting for BBP\n");
2039			return (1);	/* failure */
2040		}
2041	}
2042
2043	/* initialize BBP registers to default values */
2044	for (i = 0; i < N_DEF_BBP; i++) {
2045		ural_cfg_bbp_write(sc, ural_def_bbp[i].reg,
2046		    ural_def_bbp[i].val);
2047	}
2048
2049#if 0
2050	/* initialize BBP registers to values stored in EEPROM */
2051	for (i = 0; i < 16; i++) {
2052		if (sc->sc_bbp_prom[i].reg == 0xff) {
2053			continue;
2054		}
2055		ural_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg,
2056		    sc->sc_bbp_prom[i].val);
2057	}
2058#endif
2059	return (0);			/* success */
2060}
2061
2062static void
2063ural_cfg_pre_init(struct ural_softc *sc,
2064    struct usb2_config_td_cc *cc, uint16_t refcount)
2065{
2066	struct ifnet *ifp = sc->sc_ifp;
2067	struct ieee80211com *ic = ifp->if_l2com;
2068
2069	/* immediate configuration */
2070
2071	ural_cfg_pre_stop(sc, cc, 0);
2072
2073	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2074
2075	sc->sc_flags |= URAL_FLAG_HL_READY;
2076
2077	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2078}
2079
2080static void
2081ural_cfg_init(struct ural_softc *sc,
2082    struct usb2_config_td_cc *cc, uint16_t refcount)
2083{
2084	enum {
2085		N_DEF_MAC = (sizeof(ural_def_mac) / sizeof(ural_def_mac[0])),
2086	};
2087	uint16_t tmp;
2088	uint16_t i;
2089	uint8_t to;
2090
2091	/* delayed configuration */
2092
2093	ural_cfg_set_testmode(sc);
2094
2095	ural_cfg_write(sc, 0x308, 0x00f0);	/* XXX magic */
2096
2097	ural_cfg_stop(sc, cc, 0);
2098
2099	/* initialize MAC registers to default values */
2100	for (i = 0; i < N_DEF_MAC; i++) {
2101		ural_cfg_write(sc, ural_def_mac[i].reg,
2102		    ural_def_mac[i].val);
2103	}
2104
2105	/* wait for BBP and RF to wake up (this can take a long time!) */
2106	for (to = 0;; to++) {
2107		if (to < 100) {
2108			tmp = ural_cfg_read(sc, RAL_MAC_CSR17);
2109			if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2110			    (RAL_BBP_AWAKE | RAL_RF_AWAKE)) {
2111				break;
2112			}
2113			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2114				goto fail;
2115			}
2116		} else {
2117			DPRINTF("timeout waiting for "
2118			    "BBP/RF to wakeup\n");
2119			goto fail;
2120		}
2121	}
2122
2123	/* we're ready! */
2124	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2125
2126	/* set basic rate set (will be updated later) */
2127	ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
2128
2129	if (ural_cfg_bbp_init(sc)) {
2130		goto fail;
2131	}
2132	/* set default BSS channel */
2133	ural_cfg_set_chan(sc, cc, 0);
2134
2135	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2136	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta,
2137	    sizeof(sc->sc_sta));
2138
2139	DPRINTF("rx_ant=%d, tx_ant=%d\n",
2140	    sc->sc_rx_ant, sc->sc_tx_ant);
2141
2142	ural_cfg_set_txantenna(sc, sc->sc_tx_ant);
2143	ural_cfg_set_rxantenna(sc, sc->sc_rx_ant);
2144
2145	ural_cfg_set_macaddr(sc, cc->ic_myaddr);
2146
2147	/*
2148	 * make sure that the first transaction
2149	 * clears the stall:
2150	 */
2151	sc->sc_flags |= (URAL_FLAG_READ_STALL |
2152	    URAL_FLAG_WRITE_STALL |
2153	    URAL_FLAG_LL_READY);
2154
2155	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2156	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2157		struct ifnet *ifp = sc->sc_ifp;
2158		struct ieee80211com *ic = ifp->if_l2com;
2159
2160		/*
2161		 * start the USB transfers, if not already started:
2162		 */
2163		usb2_transfer_start(sc->sc_xfer[1]);
2164		usb2_transfer_start(sc->sc_xfer[0]);
2165
2166		/*
2167		 * start IEEE802.11 layer
2168		 */
2169		mtx_unlock(&sc->sc_mtx);
2170		ieee80211_start_all(ic);
2171		mtx_lock(&sc->sc_mtx);
2172	}
2173	/*
2174	 * start Rx
2175	 */
2176	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2177	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2178
2179		tmp |= (RAL_DROP_CTL | RAL_DROP_BAD_VERSION);
2180
2181		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2182			tmp |= RAL_DROP_TODS;
2183		}
2184		if (!(cc->if_flags & IFF_PROMISC)) {
2185			tmp |= RAL_DROP_NOT_TO_ME;
2186		}
2187	}
2188	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
2189
2190	return;
2191
2192fail:
2193	ural_cfg_pre_stop(sc, NULL, 0);
2194
2195	if (cc) {
2196		ural_cfg_stop(sc, cc, 0);
2197	}
2198}
2199
2200static void
2201ural_cfg_pre_stop(struct ural_softc *sc,
2202    struct usb2_config_td_cc *cc, uint16_t refcount)
2203{
2204	struct ifnet *ifp = sc->sc_ifp;
2205
2206	if (cc) {
2207		/* copy the needed configuration */
2208		ural_config_copy(sc, cc, refcount);
2209	}
2210	/* immediate configuration */
2211
2212	if (ifp) {
2213		/* clear flags */
2214		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2215	}
2216	sc->sc_flags &= ~(URAL_FLAG_HL_READY |
2217	    URAL_FLAG_LL_READY);
2218
2219	/*
2220	 * stop all the transfers, if not already stopped:
2221	 */
2222	usb2_transfer_stop(sc->sc_xfer[0]);
2223	usb2_transfer_stop(sc->sc_xfer[1]);
2224	usb2_transfer_stop(sc->sc_xfer[2]);
2225	usb2_transfer_stop(sc->sc_xfer[3]);
2226
2227	/* clean up transmission */
2228	ural_tx_clean_queue(sc);
2229}
2230
2231static void
2232ural_cfg_stop(struct ural_softc *sc,
2233    struct usb2_config_td_cc *cc, uint16_t refcount)
2234{
2235	/* disable Rx */
2236	ural_cfg_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2237
2238	/* reset ASIC and BBP (but won't reset MAC registers!) */
2239	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2240
2241	/* wait a little */
2242	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2243
2244	/* clear reset */
2245	ural_cfg_write(sc, RAL_MAC_CSR1, 0);
2246
2247	/* wait a little */
2248	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2249}
2250
2251static void
2252ural_cfg_amrr_start(struct ural_softc *sc)
2253{
2254	struct ieee80211vap *vap;
2255	struct ieee80211_node *ni;
2256
2257	vap = ural_get_vap(sc);
2258
2259	if (vap == NULL) {
2260		return;
2261	}
2262	ni = vap->iv_bss;
2263	if (ni == NULL) {
2264		return;
2265	}
2266	/* init AMRR */
2267
2268	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2269	/* enable AMRR timer */
2270
2271	sc->sc_amrr_timer = 1;
2272}
2273
2274static void
2275ural_cfg_amrr_timeout(struct ural_softc *sc,
2276    struct usb2_config_td_cc *cc, uint16_t refcount)
2277{
2278	struct ifnet *ifp = sc->sc_ifp;
2279	struct ieee80211vap *vap;
2280	struct ieee80211_node *ni;
2281	uint32_t ok;
2282	uint32_t fail;
2283
2284	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2285	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2286
2287	vap = ural_get_vap(sc);
2288	if (vap == NULL) {
2289		return;
2290	}
2291	ni = vap->iv_bss;
2292	if (ni == NULL) {
2293		return;
2294	}
2295	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2296	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2297
2298		ok = sc->sc_sta[7] +	/* TX ok w/o retry */
2299		    sc->sc_sta[8];	/* TX ok w/ retry */
2300		fail = sc->sc_sta[9];	/* TX retry-fail count */
2301
2302		if (sc->sc_amrr_timer) {
2303
2304			ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2305			    ok + fail, ok, sc->sc_sta[8] + fail);
2306
2307			if (ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn)) {
2308				/* ignore */
2309			}
2310		}
2311		ifp->if_oerrors += fail;
2312	}
2313}
2314
2315static struct ieee80211vap *
2316ural_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2317    int opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
2318    const uint8_t mac[IEEE80211_ADDR_LEN])
2319{
2320	struct ural_vap *uvp;
2321	struct ieee80211vap *vap;
2322	struct ural_softc *sc = ic->ic_ifp->if_softc;
2323
2324	/* Need to sync with config thread: */
2325	mtx_lock(&sc->sc_mtx);
2326	if (usb2_config_td_sync(&sc->sc_config_td)) {
2327		mtx_unlock(&sc->sc_mtx);
2328		/* config thread is gone */
2329		return (NULL);
2330	}
2331	mtx_unlock(&sc->sc_mtx);
2332
2333	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2334		return NULL;
2335	uvp = (struct ural_vap *)malloc(sizeof(struct ural_vap),
2336	    M_80211_VAP, M_NOWAIT | M_ZERO);
2337	if (uvp == NULL)
2338		return NULL;
2339
2340	vap = &uvp->vap;
2341	/* enable s/w bmiss handling for sta mode */
2342	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2343	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2344
2345	/* override state transition machine */
2346	uvp->newstate = vap->iv_newstate;
2347	vap->iv_newstate = &ural_newstate_cb;
2348
2349	ieee80211_amrr_init(&uvp->amrr, vap,
2350	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2351	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2352	    1000 /* 1 sec */ );
2353
2354	/* complete setup */
2355	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2356
2357	/* store current operation mode */
2358	ic->ic_opmode = opmode;
2359
2360	return (vap);
2361}
2362
2363static void
2364ural_vap_delete(struct ieee80211vap *vap)
2365{
2366	struct ural_vap *uvp = URAL_VAP(vap);
2367	struct ural_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2368
2369	/* Need to sync with config thread: */
2370	mtx_lock(&sc->sc_mtx);
2371	if (usb2_config_td_sync(&sc->sc_config_td)) {
2372		/* ignore */
2373	}
2374	mtx_unlock(&sc->sc_mtx);
2375
2376	ieee80211_amrr_cleanup(&uvp->amrr);
2377	ieee80211_vap_detach(vap);
2378	free(uvp, M_80211_VAP);
2379}
2380
2381/* ARGUSED */
2382static struct ieee80211_node *
2383ural_node_alloc(struct ieee80211vap *vap __unused,
2384    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2385{
2386	struct ural_node *un;
2387
2388	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2389	return ((un != NULL) ? &un->ni : NULL);
2390}
2391
2392static void
2393ural_newassoc(struct ieee80211_node *ni, int isnew)
2394{
2395	struct ieee80211vap *vap = ni->ni_vap;
2396
2397	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2398}
2399
2400static void
2401ural_fill_write_queue(struct ural_softc *sc)
2402{
2403	struct ifnet *ifp = sc->sc_ifp;
2404	struct ieee80211_node *ni;
2405	struct mbuf *m;
2406
2407	/*
2408	 * We only fill up half of the queue with data frames. The rest is
2409	 * reserved for other kinds of frames.
2410	 */
2411
2412	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2413
2414		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2415		if (m == NULL)
2416			break;
2417
2418		ni = (void *)(m->m_pkthdr.rcvif);
2419		m = ieee80211_encap(ni, m);
2420		if (m == NULL) {
2421			ieee80211_free_node(ni);
2422			continue;
2423		}
2424		ural_tx_data(sc, m, ni);
2425	}
2426}
2427
2428static void
2429ural_tx_clean_queue(struct ural_softc *sc)
2430{
2431	struct mbuf *m;
2432
2433	for (;;) {
2434		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2435
2436		if (!m) {
2437			break;
2438		}
2439		ural_tx_freem(m);
2440	}
2441}
2442
2443static void
2444ural_tx_freem(struct mbuf *m)
2445{
2446	struct ieee80211_node *ni;
2447
2448	while (m) {
2449		ni = (void *)(m->m_pkthdr.rcvif);
2450		if (!ni) {
2451			m = m_free(m);
2452			continue;
2453		}
2454		if (m->m_flags & M_TXCB) {
2455			ieee80211_process_callback(ni, m, 0);
2456		}
2457		m_freem(m);
2458		ieee80211_free_node(ni);
2459
2460		break;
2461	}
2462}
2463
2464static void
2465ural_tx_mgt(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2466{
2467	struct ieee80211vap *vap = ni->ni_vap;
2468	struct ieee80211com *ic = ni->ni_ic;
2469	const struct ieee80211_txparam *tp;
2470	struct ieee80211_frame *wh;
2471	struct ieee80211_key *k;
2472	uint32_t flags;
2473	uint16_t dur;
2474
2475	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2476
2477	wh = mtod(m, struct ieee80211_frame *);
2478	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2479		k = ieee80211_crypto_encap(ni, m);
2480		if (k == NULL) {
2481			m_freem(m);
2482			ieee80211_free_node(ni);
2483			return;
2484		}
2485		wh = mtod(m, struct ieee80211_frame *);
2486	}
2487	flags = 0;
2488	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2489		flags |= RAL_TX_ACK;
2490
2491		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2492		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2493		USETW(wh->i_dur, dur);
2494
2495		/* tell hardware to add timestamp for probe responses */
2496		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2497		    IEEE80211_FC0_TYPE_MGT &&
2498		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
2499		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2500			flags |= RAL_TX_TIMESTAMP;
2501	}
2502	m->m_pkthdr.rcvif = (void *)ni;
2503	ural_setup_desc_and_tx(sc, m, flags, tp->mgmtrate);
2504}
2505
2506static struct ieee80211vap *
2507ural_get_vap(struct ural_softc *sc)
2508{
2509	struct ifnet *ifp;
2510	struct ieee80211com *ic;
2511
2512	if (sc == NULL) {
2513		return NULL;
2514	}
2515	ifp = sc->sc_ifp;
2516	if (ifp == NULL) {
2517		return NULL;
2518	}
2519	ic = ifp->if_l2com;
2520	if (ic == NULL) {
2521		return NULL;
2522	}
2523	return TAILQ_FIRST(&ic->ic_vaps);
2524}
2525
2526static void
2527ural_tx_bcn(struct ural_softc *sc)
2528{
2529	struct ieee80211_node *ni;
2530	struct ieee80211vap *vap;
2531	struct ieee80211com *ic;
2532	const struct ieee80211_txparam *tp;
2533	struct mbuf *m;
2534
2535	vap = ural_get_vap(sc);
2536	if (vap == NULL) {
2537		return;
2538	}
2539	ni = vap->iv_bss;
2540	if (ni == NULL) {
2541		return;
2542	}
2543	ic = vap->iv_ic;
2544	if (ic == NULL) {
2545		return;
2546	}
2547	DPRINTFN(11, "Sending beacon frame.\n");
2548
2549	m = ieee80211_beacon_alloc(ni, &URAL_VAP(vap)->bo);
2550	if (m == NULL) {
2551		DPRINTFN(0, "could not allocate beacon\n");
2552		return;
2553	}
2554	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2555
2556	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2557	ural_setup_desc_and_tx(sc, m, RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP,
2558	    tp->mgmtrate);
2559}
2560
2561static void
2562ural_tx_data(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2563{
2564	struct ieee80211vap *vap = ni->ni_vap;
2565	struct ieee80211com *ic = ni->ni_ic;
2566	const struct ieee80211_txparam *tp;
2567	struct ieee80211_frame *wh;
2568	struct ieee80211_key *k;
2569	uint32_t flags = 0;
2570	uint16_t dur;
2571	uint16_t rate;
2572
2573	DPRINTFN(11, "Sending data.\n");
2574
2575	wh = mtod(m, struct ieee80211_frame *);
2576
2577	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2578	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2579		rate = tp->mcastrate;
2580	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2581		rate = tp->ucastrate;
2582	else
2583		rate = ni->ni_txrate;
2584
2585	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2586		k = ieee80211_crypto_encap(ni, m);
2587		if (k == NULL) {
2588			m_freem(m);
2589			ieee80211_free_node(ni);
2590			return;
2591		}
2592		/* packet header may have moved, reset our local pointer */
2593		wh = mtod(m, struct ieee80211_frame *);
2594	}
2595	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2596		uint8_t prot = IEEE80211_PROT_NONE;
2597
2598		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2599			prot = IEEE80211_PROT_RTSCTS;
2600		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2601		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2602			prot = ic->ic_protmode;
2603		if (prot != IEEE80211_PROT_NONE) {
2604			ural_tx_prot(sc, m, ni, prot, rate);
2605			flags |= RAL_TX_IFS_SIFS;
2606		}
2607		flags |= RAL_TX_ACK;
2608		flags |= RAL_TX_RETRY(7);
2609
2610		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2611		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2612		USETW(wh->i_dur, dur);
2613	}
2614	m->m_pkthdr.rcvif = (void *)ni;
2615	ural_setup_desc_and_tx(sc, m, flags, rate);
2616}
2617
2618static void
2619ural_tx_prot(struct ural_softc *sc,
2620    const struct mbuf *m, struct ieee80211_node *ni,
2621    uint8_t prot, uint16_t rate)
2622{
2623	struct ieee80211com *ic = ni->ni_ic;
2624	const struct ieee80211_frame *wh;
2625	struct mbuf *mprot;
2626	uint32_t flags;
2627	uint16_t protrate;
2628	uint16_t ackrate;
2629	uint16_t pktlen;
2630	uint16_t dur;
2631	uint8_t isshort;
2632
2633	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2634	    (prot == IEEE80211_PROT_CTSONLY),
2635	    ("protection %u", prot));
2636
2637	DPRINTFN(16, "Sending protection frame.\n");
2638
2639	wh = mtod(m, const struct ieee80211_frame *);
2640	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2641
2642	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2643	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2644
2645	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2646	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2647	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2648	flags = RAL_TX_RETRY(7);
2649	if (prot == IEEE80211_PROT_RTSCTS) {
2650		/* NB: CTS is the same size as an ACK */
2651		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2652		flags |= RAL_TX_ACK;
2653		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2654	} else {
2655		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2656	}
2657	if (mprot == NULL) {
2658		return;
2659	}
2660	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2661	ural_setup_desc_and_tx(sc, mprot, flags, protrate);
2662}
2663
2664static void
2665ural_tx_raw(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2666    const struct ieee80211_bpf_params *params)
2667{
2668	uint32_t flags;
2669	uint16_t rate;
2670
2671	DPRINTFN(11, "Sending raw frame.\n");
2672
2673	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2674
2675	/* XXX validate */
2676	if (rate == 0) {
2677		m_freem(m);
2678		ieee80211_free_node(ni);
2679		return;
2680	}
2681	flags = 0;
2682	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2683		flags |= RAL_TX_ACK;
2684	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2685		ural_tx_prot(sc, m, ni,
2686		    (params->ibp_flags & IEEE80211_BPF_RTS) ?
2687		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2688		    rate);
2689		flags |= RAL_TX_IFS_SIFS;
2690	}
2691	m->m_pkthdr.rcvif = (void *)ni;
2692	ural_setup_desc_and_tx(sc, m, flags, rate);
2693}
2694
2695static int
2696ural_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2697    const struct ieee80211_bpf_params *params)
2698{
2699	struct ieee80211com *ic = ni->ni_ic;
2700	struct ifnet *ifp = ic->ic_ifp;
2701	struct ural_softc *sc = ifp->if_softc;
2702
2703	mtx_lock(&sc->sc_mtx);
2704	if (params == NULL) {
2705		/*
2706		 * Legacy path; interpret frame contents to decide
2707		 * precisely how to send the frame.
2708		 */
2709		ural_tx_mgt(sc, m, ni);
2710	} else {
2711		/*
2712		 * Caller supplied explicit parameters to use in
2713		 * sending the frame.
2714		 */
2715		ural_tx_raw(sc, m, ni, params);
2716	}
2717	mtx_unlock(&sc->sc_mtx);
2718	return (0);
2719}
2720
2721static void
2722ural_update_mcast_cb(struct ifnet *ifp)
2723{
2724	/* not supported */
2725}
2726
2727static void
2728ural_update_promisc_cb(struct ifnet *ifp)
2729{
2730	struct ural_softc *sc = ifp->if_softc;
2731
2732	mtx_lock(&sc->sc_mtx);
2733	usb2_config_td_queue_command
2734	    (&sc->sc_config_td, &ural_config_copy,
2735	    &ural_cfg_update_promisc, 0, 0);
2736	mtx_unlock(&sc->sc_mtx);
2737}
2738