if_ural.c revision 187378
191094Sdes/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 187378 2009-01-18 05:35:58Z thompsa $	*/
2115619Sdes
3228690Sdes/*-
491094Sdes * Copyright (c) 2005, 2006
591094Sdes *	Damien Bergamini <damien.bergamini@free.fr>
691094Sdes *
799158Sdes * Copyright (c) 2006, 2008
899158Sdes *	Hans Petter Selasky <hselasky@freebsd.org>
999158Sdes *
1091094Sdes * Permission to use, copy, modify, and distribute this software for any
1191094Sdes * purpose with or without fee is hereby granted, provided that the above
1291094Sdes * copyright notice and this permission notice appear in all copies.
1391094Sdes *
1491094Sdes * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
1591094Sdes * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
1691094Sdes * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
1791094Sdes * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
1891094Sdes * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
1991094Sdes * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
2091094Sdes * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
2191094Sdes *
2291094Sdes */
2391094Sdes
2491094Sdes/*
2591094Sdes *
2691094Sdes * NOTE: all function names beginning like "ural_cfg_" can only
2791094Sdes * be called from within the config thread function !
2891094Sdes */
2991094Sdes
3091094Sdes#include <sys/cdefs.h>
3191094Sdes__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 187378 2009-01-18 05:35:58Z thompsa $");
3291094Sdes
3391094Sdes/*-
3491094Sdes * Ralink Technology RT2500USB chipset driver
35255376Sdes * http://www.ralinktech.com/
3691094Sdes */
3791094Sdes
38228690Sdes#include <dev/usb2/include/usb2_devid.h>
39228690Sdes#include <dev/usb2/include/usb2_standard.h>
40228690Sdes#include <dev/usb2/include/usb2_mfunc.h>
41228690Sdes#include <dev/usb2/include/usb2_error.h>
4291094Sdes
4391094Sdes#define	usb2_config_td_cc ural_config_copy
4491100Sdes#define	usb2_config_td_softc ural_softc
4591100Sdes
4691100Sdes#define	USB_DEBUG_VAR ural_debug
4791100Sdes
4891100Sdes#include <dev/usb2/core/usb2_core.h>
4991100Sdes#include <dev/usb2/core/usb2_lookup.h>
5091100Sdes#include <dev/usb2/core/usb2_process.h>
5191094Sdes#include <dev/usb2/core/usb2_config_td.h>
5291094Sdes#include <dev/usb2/core/usb2_debug.h>
5391094Sdes#include <dev/usb2/core/usb2_request.h>
5491094Sdes#include <dev/usb2/core/usb2_busdma.h>
5591094Sdes#include <dev/usb2/core/usb2_util.h>
5691094Sdes
5791094Sdes#include <dev/usb2/wlan/usb2_wlan.h>
5891094Sdes#include <dev/usb2/wlan/if_uralreg.h>
5991094Sdes#include <dev/usb2/wlan/if_uralvar.h>
6091094Sdes
61107937Sdes#if USB_DEBUG
62107937Sdesstatic int ural_debug = 0;
6391094Sdes
6491100SdesSYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
6591100SdesSYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
6691100Sdes    "Debug level");
6791100Sdes#endif
68
69#define	URAL_RSSI(rssi)	\
70  ((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ? \
71   ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
72
73/* prototypes */
74
75static device_probe_t ural_probe;
76static device_attach_t ural_attach;
77static device_detach_t ural_detach;
78
79static usb2_callback_t ural_bulk_read_callback;
80static usb2_callback_t ural_bulk_read_clear_stall_callback;
81static usb2_callback_t ural_bulk_write_callback;
82static usb2_callback_t ural_bulk_write_clear_stall_callback;
83
84static usb2_config_td_command_t ural_cfg_first_time_setup;
85static usb2_config_td_command_t ural_config_copy;
86static usb2_config_td_command_t ural_cfg_scan_start;
87static usb2_config_td_command_t ural_cfg_scan_end;
88static usb2_config_td_command_t ural_cfg_set_chan;
89static usb2_config_td_command_t ural_cfg_enable_tsf_sync;
90static usb2_config_td_command_t ural_cfg_update_slot;
91static usb2_config_td_command_t ural_cfg_set_txpreamble;
92static usb2_config_td_command_t ural_cfg_update_promisc;
93static usb2_config_td_command_t ural_cfg_pre_init;
94static usb2_config_td_command_t ural_cfg_init;
95static usb2_config_td_command_t ural_cfg_pre_stop;
96static usb2_config_td_command_t ural_cfg_stop;
97static usb2_config_td_command_t ural_cfg_amrr_timeout;
98static usb2_config_td_command_t ural_cfg_newstate;
99
100static void	ural_cfg_do_request(struct ural_softc *,
101		    struct usb2_device_request *, void *);
102static void	ural_cfg_set_testmode(struct ural_softc *);
103static void	ural_cfg_eeprom_read(struct ural_softc *, uint16_t, void *,
104		    uint16_t);
105static uint16_t	ural_cfg_read(struct ural_softc *, uint16_t);
106static void	ural_cfg_read_multi(struct ural_softc *, uint16_t, void *,
107		    uint16_t);
108static void	ural_cfg_write(struct ural_softc *, uint16_t, uint16_t);
109static void	ural_cfg_write_multi(struct ural_softc *, uint16_t, void *,
110		    uint16_t);
111static void	ural_cfg_bbp_write(struct ural_softc *, uint8_t, uint8_t);
112static uint8_t	ural_cfg_bbp_read(struct ural_softc *, uint8_t);
113static void	ural_cfg_rf_write(struct ural_softc *, uint8_t, uint32_t);
114static void	ural_end_of_commands(struct ural_softc *);
115static const char *ural_get_rf(int rev);
116static void	ural_watchdog(void *);
117static void	ural_init_cb(void *);
118static int	ural_ioctl_cb(struct ifnet *, u_long cmd, caddr_t data);
119static void	ural_start_cb(struct ifnet *);
120static int	ural_newstate_cb(struct ieee80211vap *,
121		    enum ieee80211_state, int);
122static void	ural_std_command(struct ieee80211com *,
123		    usb2_config_td_command_t *);
124static void	ural_scan_start_cb(struct ieee80211com *);
125static void	ural_scan_end_cb(struct ieee80211com *);
126static void	ural_set_channel_cb(struct ieee80211com *);
127static void	ural_cfg_disable_rf_tune(struct ural_softc *);
128static void	ural_cfg_set_bssid(struct ural_softc *, uint8_t *);
129static void	ural_cfg_set_macaddr(struct ural_softc *, uint8_t *);
130static void	ural_cfg_set_txantenna(struct ural_softc *, uint8_t);
131static void	ural_cfg_set_rxantenna(struct ural_softc *, uint8_t);
132static void	ural_cfg_read_eeprom(struct ural_softc *);
133static uint8_t	ural_cfg_bbp_init(struct ural_softc *);
134static void	ural_cfg_amrr_start(struct ural_softc *);
135static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
136		    const char name[IFNAMSIZ], int unit, int opmode, int flags,
137		    const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t
138		    mac[IEEE80211_ADDR_LEN]);
139static void	ural_vap_delete(struct ieee80211vap *);
140static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
141		    const uint8_t mac[IEEE80211_ADDR_LEN]);
142static void	ural_newassoc(struct ieee80211_node *, int);
143static void	ural_cfg_disable_tsf_sync(struct ural_softc *);
144static void	ural_cfg_set_run(struct ural_softc *,
145		    struct usb2_config_td_cc *);
146static void	ural_fill_write_queue(struct ural_softc *);
147static void	ural_tx_clean_queue(struct ural_softc *);
148static void	ural_tx_freem(struct mbuf *);
149static void	ural_tx_mgt(struct ural_softc *, struct mbuf *,
150		    struct ieee80211_node *);
151static struct ieee80211vap *ural_get_vap(struct ural_softc *);
152static void	ural_tx_bcn(struct ural_softc *);
153static void	ural_tx_data(struct ural_softc *, struct mbuf *,
154		    struct ieee80211_node *);
155static void	ural_tx_prot(struct ural_softc *, const struct mbuf *,
156		    struct ieee80211_node *, uint8_t, uint16_t);
157static void	ural_tx_raw(struct ural_softc *, struct mbuf *,
158		    struct ieee80211_node *,
159		    const struct ieee80211_bpf_params *);
160static int	ural_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
161		    const struct ieee80211_bpf_params *);
162static void	ural_setup_desc_and_tx(struct ural_softc *, struct mbuf *,
163		    uint32_t, uint16_t);
164static void	ural_update_mcast_cb(struct ifnet *);
165static void	ural_update_promisc_cb(struct ifnet *);
166
167/* various supported device vendors/products */
168static const struct usb2_device_id ural_devs[] = {
169	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G, 0)},
170	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570, 0)},
171	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050, 0)},
172	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051, 0)},
173	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS, 0)},
174	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G, 0)},
175	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP, 0)},
176	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU, 0)},
177	{USB_VPI(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122, 0)},
178	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G, 0)},
179	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG, 0)},
180	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254, 0)},
181	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54, 0)},
182	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI, 0)},
183	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB, 0)},
184	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI, 0)},
185	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570, 0)},
186	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2, 0)},
187	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3, 0)},
188	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902, 0)},
189	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570, 0)},
190	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2, 0)},
191	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3, 0)},
192	{USB_VPI(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G, 0)},
193	{USB_VPI(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG, 0)},
194	{USB_VPI(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R, 0)},
195	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570, 0)},
196	{USB_VPI(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570, 0)},
197	{USB_VPI(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570, 0)},
198};
199
200/*
201 * Default values for MAC registers; values taken from
202 * the reference driver:
203 */
204struct ural_def_mac {
205	uint16_t reg;
206	uint16_t val;
207};
208
209static const struct ural_def_mac ural_def_mac[] = {
210	{RAL_TXRX_CSR5, 0x8c8d},
211	{RAL_TXRX_CSR6, 0x8b8a},
212	{RAL_TXRX_CSR7, 0x8687},
213	{RAL_TXRX_CSR8, 0x0085},
214	{RAL_MAC_CSR13, 0x1111},
215	{RAL_MAC_CSR14, 0x1e11},
216	{RAL_TXRX_CSR21, 0xe78f},
217	{RAL_MAC_CSR9, 0xff1d},
218	{RAL_MAC_CSR11, 0x0002},
219	{RAL_MAC_CSR22, 0x0053},
220	{RAL_MAC_CSR15, 0x0000},
221	{RAL_MAC_CSR8, RAL_FRAME_SIZE},
222	{RAL_TXRX_CSR19, 0x0000},
223	{RAL_TXRX_CSR18, 0x005a},
224	{RAL_PHY_CSR2, 0x0000},
225	{RAL_TXRX_CSR0, 0x1ec0},
226	{RAL_PHY_CSR4, 0x000f}
227};
228
229/*
230 * Default values for BBP registers; values taken from the reference driver.
231 */
232struct ural_def_bbp {
233	uint8_t	reg;
234	uint8_t	val;
235};
236
237static const struct ural_def_bbp ural_def_bbp[] = {
238	{3, 0x02},
239	{4, 0x19},
240	{14, 0x1c},
241	{15, 0x30},
242	{16, 0xac},
243	{17, 0x48},
244	{18, 0x18},
245	{19, 0xff},
246	{20, 0x1e},
247	{21, 0x08},
248	{22, 0x08},
249	{23, 0x08},
250	{24, 0x80},
251	{25, 0x50},
252	{26, 0x08},
253	{27, 0x23},
254	{30, 0x10},
255	{31, 0x2b},
256	{32, 0xb9},
257	{34, 0x12},
258	{35, 0x50},
259	{39, 0xc4},
260	{40, 0x02},
261	{41, 0x60},
262	{53, 0x10},
263	{54, 0x18},
264	{56, 0x08},
265	{57, 0x10},
266	{58, 0x08},
267	{61, 0x60},
268	{62, 0x10},
269	{75, 0xff}
270};
271
272/*
273 * Default values for RF register R2 indexed by channel numbers.
274 */
275static const uint32_t ural_rf2522_r2[] = {
276	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
277	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
278};
279
280static const uint32_t ural_rf2523_r2[] = {
281	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
282	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
283};
284
285static const uint32_t ural_rf2524_r2[] = {
286	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
287	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
288};
289
290static const uint32_t ural_rf2525_r2[] = {
291	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
292	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
293};
294
295static const uint32_t ural_rf2525_hi_r2[] = {
296	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
297	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
298};
299
300static const uint32_t ural_rf2525e_r2[] = {
301	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
302	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
303};
304
305static const uint32_t ural_rf2526_hi_r2[] = {
306	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
307	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
308};
309
310static const uint32_t ural_rf2526_r2[] = {
311	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
312	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
313};
314
315/*
316 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
317 * values taken from the reference driver.
318 */
319struct ural_rf5222 {
320	uint8_t	chan;
321	uint32_t r1;
322	uint32_t r2;
323	uint32_t r4;
324};
325
326static const struct ural_rf5222 ural_rf5222[] = {
327	{1, 0x08808, 0x0044d, 0x00282},
328	{2, 0x08808, 0x0044e, 0x00282},
329	{3, 0x08808, 0x0044f, 0x00282},
330	{4, 0x08808, 0x00460, 0x00282},
331	{5, 0x08808, 0x00461, 0x00282},
332	{6, 0x08808, 0x00462, 0x00282},
333	{7, 0x08808, 0x00463, 0x00282},
334	{8, 0x08808, 0x00464, 0x00282},
335	{9, 0x08808, 0x00465, 0x00282},
336	{10, 0x08808, 0x00466, 0x00282},
337	{11, 0x08808, 0x00467, 0x00282},
338	{12, 0x08808, 0x00468, 0x00282},
339	{13, 0x08808, 0x00469, 0x00282},
340	{14, 0x08808, 0x0046b, 0x00286},
341
342	{36, 0x08804, 0x06225, 0x00287},
343	{40, 0x08804, 0x06226, 0x00287},
344	{44, 0x08804, 0x06227, 0x00287},
345	{48, 0x08804, 0x06228, 0x00287},
346	{52, 0x08804, 0x06229, 0x00287},
347	{56, 0x08804, 0x0622a, 0x00287},
348	{60, 0x08804, 0x0622b, 0x00287},
349	{64, 0x08804, 0x0622c, 0x00287},
350
351	{100, 0x08804, 0x02200, 0x00283},
352	{104, 0x08804, 0x02201, 0x00283},
353	{108, 0x08804, 0x02202, 0x00283},
354	{112, 0x08804, 0x02203, 0x00283},
355	{116, 0x08804, 0x02204, 0x00283},
356	{120, 0x08804, 0x02205, 0x00283},
357	{124, 0x08804, 0x02206, 0x00283},
358	{128, 0x08804, 0x02207, 0x00283},
359	{132, 0x08804, 0x02208, 0x00283},
360	{136, 0x08804, 0x02209, 0x00283},
361	{140, 0x08804, 0x0220a, 0x00283},
362
363	{149, 0x08808, 0x02429, 0x00281},
364	{153, 0x08808, 0x0242b, 0x00281},
365	{157, 0x08808, 0x0242d, 0x00281},
366	{161, 0x08808, 0x0242f, 0x00281}
367};
368
369static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
370	[URAL_BULK_DT_WR] = {
371		.type = UE_BULK,
372		.endpoint = UE_ADDR_ANY,
373		.direction = UE_DIR_OUT,
374		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
375		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
376		.mh.callback = &ural_bulk_write_callback,
377		.mh.timeout = 5000,	/* ms */
378	},
379
380	[URAL_BULK_DT_RD] = {
381		.type = UE_BULK,
382		.endpoint = UE_ADDR_ANY,
383		.direction = UE_DIR_IN,
384		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
385		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
386		.mh.callback = &ural_bulk_read_callback,
387	},
388
389	[URAL_BULK_CS_WR] = {
390		.type = UE_CONTROL,
391		.endpoint = 0x00,	/* Control pipe */
392		.direction = UE_DIR_ANY,
393		.mh.bufsize = sizeof(struct usb2_device_request),
394		.mh.callback = &ural_bulk_write_clear_stall_callback,
395		.mh.timeout = 1000,	/* 1 second */
396		.mh.interval = 50,	/* 50ms */
397	},
398
399	[URAL_BULK_CS_RD] = {
400		.type = UE_CONTROL,
401		.endpoint = 0x00,	/* Control pipe */
402		.direction = UE_DIR_ANY,
403		.mh.bufsize = sizeof(struct usb2_device_request),
404		.mh.callback = &ural_bulk_read_clear_stall_callback,
405		.mh.timeout = 1000,	/* 1 second */
406		.mh.interval = 50,	/* 50ms */
407	},
408};
409
410static devclass_t ural_devclass;
411
412static device_method_t ural_methods[] = {
413	DEVMETHOD(device_probe, ural_probe),
414	DEVMETHOD(device_attach, ural_attach),
415	DEVMETHOD(device_detach, ural_detach),
416	{0, 0}
417};
418
419static driver_t ural_driver = {
420	.name = "ural",
421	.methods = ural_methods,
422	.size = sizeof(struct ural_softc),
423};
424
425DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
426MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
427MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
428MODULE_DEPEND(ural, wlan, 1, 1, 1);
429MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
430
431static int
432ural_probe(device_t dev)
433{
434	struct usb2_attach_arg *uaa = device_get_ivars(dev);
435
436	if (uaa->usb2_mode != USB_MODE_HOST) {
437		return (ENXIO);
438	}
439	if (uaa->info.bConfigIndex != 0) {
440		return (ENXIO);
441	}
442	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX) {
443		return (ENXIO);
444	}
445	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
446}
447
448static int
449ural_attach(device_t dev)
450{
451	struct usb2_attach_arg *uaa = device_get_ivars(dev);
452	struct ural_softc *sc = device_get_softc(dev);
453	int error;
454	uint8_t iface_index;
455
456	if (sc == NULL) {
457		return (ENOMEM);
458	}
459	device_set_usb2_desc(dev);
460
461	mtx_init(&sc->sc_mtx, "ural lock", MTX_NETWORK_LOCK,
462	    MTX_DEF | MTX_RECURSE);
463
464	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
465	    device_get_nameunit(dev));
466
467	sc->sc_udev = uaa->device;
468	sc->sc_unit = device_get_unit(dev);
469
470	usb2_callout_init_mtx(&sc->sc_watchdog, &sc->sc_mtx, 0);
471
472	iface_index = RAL_IFACE_INDEX;
473	error = usb2_transfer_setup(uaa->device,
474	    &iface_index, sc->sc_xfer, ural_config,
475	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
476
477	if (error) {
478		device_printf(dev, "could not allocate USB transfers, "
479		    "err=%s\n", usb2_errstr(error));
480		goto detach;
481	}
482	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
483	    &ural_end_of_commands,
484	    sizeof(struct usb2_config_td_cc), 24);
485	if (error) {
486		device_printf(dev, "could not setup config "
487		    "thread!\n");
488		goto detach;
489	}
490	mtx_lock(&sc->sc_mtx);
491
492	/* start setup */
493
494	usb2_config_td_queue_command
495	    (&sc->sc_config_td, NULL, &ural_cfg_first_time_setup, 0, 0);
496
497	ural_watchdog(sc);
498	mtx_unlock(&sc->sc_mtx);
499	return (0);			/* success */
500
501detach:
502	ural_detach(dev);
503	return (ENXIO);			/* failure */
504}
505
506static int
507ural_detach(device_t dev)
508{
509	struct ural_softc *sc = device_get_softc(dev);
510	struct ieee80211com *ic;
511	struct ifnet *ifp;
512
513	usb2_config_td_drain(&sc->sc_config_td);
514
515	mtx_lock(&sc->sc_mtx);
516
517	usb2_callout_stop(&sc->sc_watchdog);
518
519	ural_cfg_pre_stop(sc, NULL, 0);
520
521	ifp = sc->sc_ifp;
522	ic = ifp->if_l2com;
523
524	mtx_unlock(&sc->sc_mtx);
525
526	/* stop all USB transfers first */
527	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
528
529	/* get rid of any late children */
530	bus_generic_detach(dev);
531
532	if (ifp) {
533		bpfdetach(ifp);
534		ieee80211_ifdetach(ic);
535		if_free(ifp);
536	}
537	usb2_config_td_unsetup(&sc->sc_config_td);
538
539	usb2_callout_drain(&sc->sc_watchdog);
540
541	mtx_destroy(&sc->sc_mtx);
542
543	return (0);
544}
545
546/*========================================================================*
547 * REGISTER READ / WRITE WRAPPER ROUTINES
548 *========================================================================*/
549
550static void
551ural_cfg_do_request(struct ural_softc *sc, struct usb2_device_request *req,
552    void *data)
553{
554	uint16_t length;
555	usb2_error_t err;
556
557repeat:
558
559	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
560		goto error;
561	}
562	err = usb2_do_request_flags
563	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
564
565	if (err) {
566
567		DPRINTF("device request failed, err=%s "
568		    "(ignored)\n", usb2_errstr(err));
569
570		/* wait a little before next try */
571		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
572			goto error;
573		}
574		/* try until we are detached */
575		goto repeat;
576
577error:
578		/* the device has been detached */
579		length = UGETW(req->wLength);
580
581		if ((req->bmRequestType & UT_READ) && length) {
582			bzero(data, length);
583		}
584	}
585}
586
587static void
588ural_cfg_set_testmode(struct ural_softc *sc)
589{
590	struct usb2_device_request req;
591
592	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
593	req.bRequest = RAL_VENDOR_REQUEST;
594	USETW(req.wValue, 4);
595	USETW(req.wIndex, 1);
596	USETW(req.wLength, 0);
597
598	ural_cfg_do_request(sc, &req, NULL);
599}
600
601static void
602ural_cfg_eeprom_read(struct ural_softc *sc, uint16_t addr,
603    void *buf, uint16_t len)
604{
605	struct usb2_device_request req;
606
607	req.bmRequestType = UT_READ_VENDOR_DEVICE;
608	req.bRequest = RAL_READ_EEPROM;
609	USETW(req.wValue, 0);
610	USETW(req.wIndex, addr);
611	USETW(req.wLength, len);
612
613	ural_cfg_do_request(sc, &req, buf);
614}
615
616static uint16_t
617ural_cfg_read(struct ural_softc *sc, uint16_t reg)
618{
619	struct usb2_device_request req;
620	uint16_t val;
621
622	req.bmRequestType = UT_READ_VENDOR_DEVICE;
623	req.bRequest = RAL_READ_MAC;
624	USETW(req.wValue, 0);
625	USETW(req.wIndex, reg);
626	USETW(req.wLength, sizeof(val));
627
628	ural_cfg_do_request(sc, &req, &val);
629
630	return (le16toh(val));
631}
632
633static void
634ural_cfg_read_multi(struct ural_softc *sc, uint16_t reg,
635    void *buf, uint16_t len)
636{
637	struct usb2_device_request req;
638
639	req.bmRequestType = UT_READ_VENDOR_DEVICE;
640	req.bRequest = RAL_READ_MULTI_MAC;
641	USETW(req.wValue, 0);
642	USETW(req.wIndex, reg);
643	USETW(req.wLength, len);
644
645	ural_cfg_do_request(sc, &req, buf);
646}
647
648static void
649ural_cfg_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
650{
651	struct usb2_device_request req;
652
653	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
654	req.bRequest = RAL_WRITE_MAC;
655	USETW(req.wValue, val);
656	USETW(req.wIndex, reg);
657	USETW(req.wLength, 0);
658
659	ural_cfg_do_request(sc, &req, NULL);
660}
661
662static void
663ural_cfg_write_multi(struct ural_softc *sc, uint16_t reg,
664    void *buf, uint16_t len)
665{
666	struct usb2_device_request req;
667
668	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
669	req.bRequest = RAL_WRITE_MULTI_MAC;
670	USETW(req.wValue, 0);
671	USETW(req.wIndex, reg);
672	USETW(req.wLength, len);
673
674	ural_cfg_do_request(sc, &req, buf);
675}
676
677static uint8_t
678ural_cfg_bbp_disbusy(struct ural_softc *sc)
679{
680	uint16_t tmp;
681	uint8_t to;
682
683	for (to = 0;; to++) {
684		if (to < 100) {
685			tmp = ural_cfg_read(sc, RAL_PHY_CSR8);
686			tmp &= RAL_BBP_BUSY;
687
688			if (tmp == 0) {
689				return (0);
690			}
691			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
692				break;
693			}
694		} else {
695			break;
696		}
697	}
698	DPRINTF("could not disbusy BBP\n");
699	return (1);			/* failure */
700}
701
702static void
703ural_cfg_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
704{
705	uint16_t tmp;
706
707	if (ural_cfg_bbp_disbusy(sc)) {
708		return;
709	}
710	tmp = (reg << 8) | val;
711	ural_cfg_write(sc, RAL_PHY_CSR7, tmp);
712}
713
714static uint8_t
715ural_cfg_bbp_read(struct ural_softc *sc, uint8_t reg)
716{
717	uint16_t val;
718
719	if (ural_cfg_bbp_disbusy(sc)) {
720		return (0);
721	}
722	val = RAL_BBP_WRITE | (reg << 8);
723	ural_cfg_write(sc, RAL_PHY_CSR7, val);
724
725	if (ural_cfg_bbp_disbusy(sc)) {
726		return (0);
727	}
728	return (ural_cfg_read(sc, RAL_PHY_CSR7) & 0xff);
729}
730
731static void
732ural_cfg_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
733{
734	uint32_t tmp;
735	uint8_t to;
736
737	reg &= 3;
738
739	/* remember last written value */
740	sc->sc_rf_regs[reg] = val;
741
742	for (to = 0;; to++) {
743		if (to < 100) {
744			tmp = ural_cfg_read(sc, RAL_PHY_CSR10);
745
746			if (!(tmp & RAL_RF_LOBUSY)) {
747				break;
748			}
749			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
750				return;
751			}
752		} else {
753			DPRINTF("could not write to RF\n");
754			return;
755		}
756	}
757
758	tmp = RAL_RF_BUSY | RAL_RF_20BIT | ((val & 0xfffff) << 2) | reg;
759	ural_cfg_write(sc, RAL_PHY_CSR9, tmp & 0xffff);
760	ural_cfg_write(sc, RAL_PHY_CSR10, tmp >> 16);
761
762	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
763}
764
765static void
766ural_cfg_first_time_setup(struct ural_softc *sc,
767    struct usb2_config_td_cc *cc, uint16_t refcount)
768{
769	struct ieee80211com *ic;
770	struct ifnet *ifp;
771	uint8_t bands;
772
773	/* setup RX tap header */
774	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
775	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
776	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
777
778	/* setup TX tap header */
779	sc->sc_txtap_len = sizeof(sc->sc_txtap);
780	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
781	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
782
783	/* retrieve RT2570 rev. no */
784	sc->sc_asic_rev = ural_cfg_read(sc, RAL_MAC_CSR0);
785
786	/* retrieve MAC address and various other things from EEPROM */
787	ural_cfg_read_eeprom(sc);
788
789	printf("%s: MAC/BBP RT2570 (rev 0x%02x), RF %s (0x%02x)\n",
790	    sc->sc_name, sc->sc_asic_rev, ural_get_rf(sc->sc_rf_rev),
791	    sc->sc_rf_rev);
792
793	mtx_unlock(&sc->sc_mtx);
794
795	ifp = if_alloc(IFT_IEEE80211);
796
797	mtx_lock(&sc->sc_mtx);
798
799	if (ifp == NULL) {
800		DPRINTFN(0, "could not if_alloc()!\n");
801		goto done;
802	}
803	sc->sc_ifp = ifp;
804	ic = ifp->if_l2com;
805
806	ifp->if_softc = sc;
807	if_initname(ifp, "ural", sc->sc_unit);
808	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
809	ifp->if_init = &ural_init_cb;
810	ifp->if_ioctl = &ural_ioctl_cb;
811	ifp->if_start = &ural_start_cb;
812	ifp->if_watchdog = NULL;
813	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
814	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
815	IFQ_SET_READY(&ifp->if_snd);
816
817	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
818
819	ic->ic_ifp = ifp;
820	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
821	ic->ic_opmode = IEEE80211_M_STA;
822
823	/* set device capabilities */
824	ic->ic_caps =
825	    IEEE80211_C_STA		/* station mode supported */
826	    | IEEE80211_C_IBSS		/* IBSS mode supported */
827	    | IEEE80211_C_MONITOR	/* monitor mode supported */
828	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
829	    | IEEE80211_C_TXPMGT	/* tx power management */
830	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
831	    | IEEE80211_C_SHSLOT	/* short slot time supported */
832	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
833	    | IEEE80211_C_WPA		/* 802.11i */
834	    ;
835
836	bands = 0;
837	setbit(&bands, IEEE80211_MODE_11B);
838	setbit(&bands, IEEE80211_MODE_11G);
839
840	if (sc->sc_rf_rev == RAL_RF_5222) {
841		setbit(&bands, IEEE80211_MODE_11A);
842	}
843	ieee80211_init_channels(ic, NULL, &bands);
844
845	mtx_unlock(&sc->sc_mtx);
846
847	ieee80211_ifattach(ic);
848
849	mtx_lock(&sc->sc_mtx);
850
851	ic->ic_newassoc = &ural_newassoc;
852	ic->ic_raw_xmit = &ural_raw_xmit_cb;
853	ic->ic_node_alloc = &ural_node_alloc;
854	ic->ic_update_mcast = &ural_update_mcast_cb;
855	ic->ic_update_promisc = &ural_update_promisc_cb;
856	ic->ic_scan_start = &ural_scan_start_cb;
857	ic->ic_scan_end = &ural_scan_end_cb;
858	ic->ic_set_channel = &ural_set_channel_cb;
859	ic->ic_vap_create = &ural_vap_create;
860	ic->ic_vap_delete = &ural_vap_delete;
861
862	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
863
864	mtx_unlock(&sc->sc_mtx);
865
866	bpfattach(ifp, DLT_IEEE802_11_RADIO,
867	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
868
869	if (bootverbose) {
870		ieee80211_announce(ic);
871	}
872	mtx_lock(&sc->sc_mtx);
873done:
874	return;
875}
876
877static void
878ural_end_of_commands(struct ural_softc *sc)
879{
880	sc->sc_flags &= ~URAL_FLAG_WAIT_COMMAND;
881
882	/* start write transfer, if not started */
883	usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
884}
885
886static void
887ural_config_copy_chan(struct ural_config_copy_chan *cc,
888    struct ieee80211com *ic, struct ieee80211_channel *c)
889{
890	if (!c)
891		return;
892	cc->chan_to_ieee =
893	    ieee80211_chan2ieee(ic, c);
894	if (c != IEEE80211_CHAN_ANYC) {
895		cc->chan_to_mode =
896		    ieee80211_chan2mode(c);
897		if (IEEE80211_IS_CHAN_B(c))
898			cc->chan_is_b = 1;
899		if (IEEE80211_IS_CHAN_A(c))
900			cc->chan_is_a = 1;
901		if (IEEE80211_IS_CHAN_2GHZ(c))
902			cc->chan_is_2ghz = 1;
903		if (IEEE80211_IS_CHAN_5GHZ(c))
904			cc->chan_is_5ghz = 1;
905		if (IEEE80211_IS_CHAN_ANYG(c))
906			cc->chan_is_g = 1;
907	}
908}
909
910static void
911ural_config_copy(struct ural_softc *sc,
912    struct usb2_config_td_cc *cc, uint16_t refcount)
913{
914	struct ifnet *ifp;
915	struct ieee80211com *ic;
916	struct ieee80211_node *ni;
917	struct ieee80211vap *vap;
918	const struct ieee80211_txparam *tp;
919
920	bzero(cc, sizeof(*cc));
921
922	ifp = sc->sc_ifp;
923	if (ifp) {
924		cc->if_flags = ifp->if_flags;
925		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
926		    sizeof(cc->if_broadcastaddr));
927
928		ic = ifp->if_l2com;
929		if (ic) {
930			ural_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
931			ural_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
932			vap = TAILQ_FIRST(&ic->ic_vaps);
933			if (vap) {
934				ni = vap->iv_bss;
935				if (ni) {
936					cc->iv_bss.ni_intval = ni->ni_intval;
937					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
938					    sizeof(cc->iv_bss.ni_bssid));
939				}
940				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
941				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
942					cc->iv_bss.fixed_rate_none = 1;
943				}
944			}
945			cc->ic_opmode = ic->ic_opmode;
946			cc->ic_flags = ic->ic_flags;
947			cc->ic_txpowlimit = ic->ic_txpowlimit;
948			cc->ic_curmode = ic->ic_curmode;
949
950			bcopy(ic->ic_myaddr, cc->ic_myaddr,
951			    sizeof(cc->ic_myaddr));
952		}
953	}
954	sc->sc_flags |= URAL_FLAG_WAIT_COMMAND;
955}
956
957static const char *
958ural_get_rf(int rev)
959{
960	;				/* style fix */
961
962	switch (rev) {
963	case RAL_RF_2522:
964		return "RT2522";
965	case RAL_RF_2523:
966		return "RT2523";
967	case RAL_RF_2524:
968		return "RT2524";
969	case RAL_RF_2525:
970		return "RT2525";
971	case RAL_RF_2525E:
972		return "RT2525e";
973	case RAL_RF_2526:
974		return "RT2526";
975	case RAL_RF_5222:
976		return "RT5222";
977	default:
978		return "unknown";
979	}
980}
981
982/*------------------------------------------------------------------------*
983 * ural_bulk_read_callback - data read "thread"
984 *------------------------------------------------------------------------*/
985static void
986ural_bulk_read_callback(struct usb2_xfer *xfer)
987{
988	struct ural_softc *sc = xfer->priv_sc;
989	struct ifnet *ifp = sc->sc_ifp;
990	struct ieee80211com *ic = ifp->if_l2com;
991	struct ieee80211_node *ni;
992	struct mbuf *m = NULL;
993	uint32_t flags;
994	uint32_t max_len;
995	uint32_t real_len;
996	uint8_t rssi = 0;
997
998	switch (USB_GET_STATE(xfer)) {
999	case USB_ST_TRANSFERRED:
1000
1001		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
1002
1003		if (xfer->actlen < RAL_RX_DESC_SIZE) {
1004			DPRINTF("too short transfer, "
1005			    "%d bytes\n", xfer->actlen);
1006			ifp->if_ierrors++;
1007			goto tr_setup;
1008		}
1009		max_len = (xfer->actlen - RAL_RX_DESC_SIZE);
1010
1011		usb2_copy_out(xfer->frbuffers, max_len,
1012		    &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
1013
1014		flags = le32toh(sc->sc_rx_desc.flags);
1015
1016		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
1017			/*
1018		         * This should not happen since we did not
1019		         * request to receive those frames when we
1020		         * filled RAL_TXRX_CSR2:
1021		         */
1022			DPRINTFN(6, "PHY or CRC error\n");
1023			ifp->if_ierrors++;
1024			goto tr_setup;
1025		}
1026		if (max_len > MCLBYTES) {
1027			max_len = MCLBYTES;
1028		}
1029		real_len = (flags >> 16) & 0xfff;
1030
1031		if (real_len > max_len) {
1032			DPRINTF("invalid length in RX "
1033			    "descriptor, %u bytes, received %u bytes\n",
1034			    real_len, max_len);
1035			ifp->if_ierrors++;
1036			goto tr_setup;
1037		}
1038		/* ieee80211_input() will check if the mbuf is too short */
1039
1040		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1041
1042		if (m == NULL) {
1043			DPRINTF("could not allocate mbuf\n");
1044			ifp->if_ierrors++;
1045			goto tr_setup;
1046		}
1047		usb2_copy_out(xfer->frbuffers, 0, m->m_data, max_len);
1048
1049		/* finalize mbuf */
1050		m->m_pkthdr.rcvif = ifp;
1051		m->m_pkthdr.len = m->m_len = real_len;
1052
1053		DPRINTF("real length=%d bytes\n", real_len);
1054
1055		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
1056
1057		if (bpf_peers_present(ifp->if_bpf)) {
1058			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
1059
1060			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1061			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1062			    (sc->sc_rx_desc.flags & htole32(RAL_RX_OFDM)) ?
1063			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1064
1065			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1066			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1067			tap->wr_antenna = sc->sc_rx_ant;
1068			tap->wr_antsignal = rssi;
1069
1070			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1071		}
1072		/* Strip trailing 802.11 MAC FCS. */
1073		m_adj(m, -IEEE80211_CRC_LEN);
1074
1075	case USB_ST_SETUP:
1076tr_setup:
1077
1078		if (sc->sc_flags & URAL_FLAG_READ_STALL) {
1079			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_RD]);
1080		} else {
1081			xfer->frlengths[0] = xfer->max_data_length;
1082			usb2_start_hardware(xfer);
1083		}
1084
1085		/*
1086		 * At the end of a USB callback it is always safe to unlock
1087		 * the private mutex of a device! That is why we do the
1088		 * "ieee80211_input" here, and not some lines up!
1089		 */
1090		if (m) {
1091			mtx_unlock(&sc->sc_mtx);
1092
1093			ni = ieee80211_find_rxnode(ic, (void *)(m->m_data));
1094
1095			if (ni) {
1096				/* send the frame to the 802.11 layer */
1097				if (ieee80211_input(ni, m, rssi, RAL_NOISE_FLOOR, 0)) {
1098					/* ignore */
1099				}
1100				/* node is no longer needed */
1101				ieee80211_free_node(ni);
1102			} else {
1103				/* broadcast */
1104				if (ieee80211_input_all(ic, m, rssi, RAL_NOISE_FLOOR, 0)) {
1105					/* ignore */
1106				}
1107			}
1108
1109			mtx_lock(&sc->sc_mtx);
1110		}
1111		return;
1112
1113	default:			/* Error */
1114		if (xfer->error != USB_ERR_CANCELLED) {
1115			/* try to clear stall first */
1116			sc->sc_flags |= URAL_FLAG_READ_STALL;
1117			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_RD]);
1118		}
1119		return;
1120
1121	}
1122}
1123
1124static void
1125ural_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1126{
1127	struct ural_softc *sc = xfer->priv_sc;
1128	struct usb2_xfer *xfer_other = sc->sc_xfer[URAL_BULK_DT_RD];
1129
1130	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1131		DPRINTF("stall cleared\n");
1132		sc->sc_flags &= ~URAL_FLAG_READ_STALL;
1133		usb2_transfer_start(xfer_other);
1134	}
1135}
1136
1137static uint8_t
1138ural_plcp_signal(uint16_t rate)
1139{
1140	;				/* indent fix */
1141	switch (rate) {
1142		/* CCK rates (NB: not IEEE std, device-specific) */
1143	case 2:
1144		return (0x0);
1145	case 4:
1146		return (0x1);
1147	case 11:
1148		return (0x2);
1149	case 22:
1150		return (0x3);
1151
1152		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1153	case 12:
1154		return (0xb);
1155	case 18:
1156		return (0xf);
1157	case 24:
1158		return (0xa);
1159	case 36:
1160		return (0xe);
1161	case 48:
1162		return (0x9);
1163	case 72:
1164		return (0xd);
1165	case 96:
1166		return (0x8);
1167	case 108:
1168		return (0xc);
1169
1170		/* XXX unsupported/unknown rate */
1171	default:
1172		return (0xff);
1173	}
1174}
1175
1176/*
1177 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1178 * should be freed, when "ural_setup_desc_and_tx" is called.
1179 */
1180static void
1181ural_setup_desc_and_tx(struct ural_softc *sc, struct mbuf *m,
1182    uint32_t flags, uint16_t rate)
1183{
1184	struct ifnet *ifp = sc->sc_ifp;
1185	struct ieee80211com *ic = ifp->if_l2com;
1186	struct mbuf *mm;
1187	enum ieee80211_phytype phytype;
1188	uint16_t plcp_length;
1189	uint16_t len;
1190	uint8_t remainder;
1191
1192	DPRINTF("in\n");
1193
1194	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1195		/* free packet */
1196		ural_tx_freem(m);
1197		ifp->if_oerrors++;
1198		return;
1199	}
1200	if (!((sc->sc_flags & URAL_FLAG_LL_READY) &&
1201	    (sc->sc_flags & URAL_FLAG_HL_READY))) {
1202		/* free packet */
1203		ural_tx_freem(m);
1204		ifp->if_oerrors++;
1205		return;
1206	}
1207	if (rate < 2) {
1208		DPRINTF("rate < 2!\n");
1209
1210		/* avoid division by zero */
1211		rate = 2;
1212	}
1213	ic->ic_lastdata = ticks;
1214
1215	if (bpf_peers_present(ifp->if_bpf)) {
1216		struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
1217
1218		tap->wt_flags = 0;
1219		tap->wt_rate = rate;
1220		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1221		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1222		tap->wt_antenna = sc->sc_tx_ant;
1223
1224		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1225	}
1226	len = m->m_pkthdr.len;
1227
1228	sc->sc_tx_desc.flags = htole32(flags);
1229	sc->sc_tx_desc.flags |= htole32(RAL_TX_NEWSEQ);
1230	sc->sc_tx_desc.flags |= htole32(len << 16);
1231
1232	sc->sc_tx_desc.wme = htole16(RAL_AIFSN(2) |
1233	    RAL_LOGCWMIN(3) |
1234	    RAL_LOGCWMAX(5) |
1235	    RAL_IVOFFSET(sizeof(struct ieee80211_frame)));
1236
1237	/* setup PLCP fields */
1238	sc->sc_tx_desc.plcp_signal = ural_plcp_signal(rate);
1239	sc->sc_tx_desc.plcp_service = 4;
1240
1241	len += IEEE80211_CRC_LEN;
1242
1243	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1244
1245	if (phytype == IEEE80211_T_OFDM) {
1246		sc->sc_tx_desc.flags |= htole32(RAL_TX_OFDM);
1247
1248		plcp_length = len & 0xfff;
1249		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1250		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1251
1252	} else {
1253		plcp_length = ((16 * len) + rate - 1) / rate;
1254		if (rate == 22) {
1255			remainder = (16 * len) % 22;
1256			if ((remainder != 0) && (remainder < 7)) {
1257				sc->sc_tx_desc.plcp_service |=
1258				    RAL_PLCP_LENGEXT;
1259			}
1260		}
1261		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1262		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1263
1264		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1265			sc->sc_tx_desc.plcp_signal |= 0x08;
1266		}
1267	}
1268
1269	sc->sc_tx_desc.iv = 0;
1270	sc->sc_tx_desc.eiv = 0;
1271
1272	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1273		DPRINTF("No room for header structure!\n");
1274		ural_tx_freem(m);
1275		return;
1276	}
1277	mm = m_gethdr(M_NOWAIT, MT_DATA);
1278	if (mm == NULL) {
1279		DPRINTF("Could not allocate header mbuf!\n");
1280		ural_tx_freem(m);
1281		return;
1282	}
1283	DPRINTF(" %zu %u (out)\n", sizeof(sc->sc_tx_desc), m->m_pkthdr.len);
1284
1285	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1286	mm->m_len = sizeof(sc->sc_tx_desc);
1287
1288	mm->m_next = m;
1289	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1290	mm->m_pkthdr.rcvif = NULL;
1291
1292	/* start write transfer, if not started */
1293	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1294
1295	usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
1296}
1297
1298static void
1299ural_bulk_write_callback(struct usb2_xfer *xfer)
1300{
1301	struct ural_softc *sc = xfer->priv_sc;
1302	struct ifnet *ifp = sc->sc_ifp;
1303	struct mbuf *m;
1304	uint16_t temp_len;
1305	uint8_t align;
1306
1307	switch (USB_GET_STATE(xfer)) {
1308	case USB_ST_TRANSFERRED:
1309		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
1310
1311		ifp->if_opackets++;
1312
1313	case USB_ST_SETUP:
1314		if (sc->sc_flags & URAL_FLAG_WRITE_STALL) {
1315			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_WR]);
1316			break;
1317		}
1318		if (sc->sc_flags & URAL_FLAG_WAIT_COMMAND) {
1319			/*
1320			 * don't send anything while a command is pending !
1321			 */
1322			break;
1323		}
1324		ural_fill_write_queue(sc);
1325
1326		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1327
1328		if (m) {
1329
1330			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
1331				DPRINTFN(0, "data overflow, %u bytes\n",
1332				    m->m_pkthdr.len);
1333				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
1334			}
1335			usb2_m_copy_in(xfer->frbuffers, 0,
1336			    m, 0, m->m_pkthdr.len);
1337
1338			/* compute transfer length */
1339			temp_len = m->m_pkthdr.len;
1340
1341			/* make transfer length 16-bit aligned */
1342			align = (temp_len & 1);
1343
1344			/* check if we need to add two extra bytes */
1345			if (((temp_len + align) % 64) == 0) {
1346				align += 2;
1347			}
1348			/* check if we need to align length */
1349			if (align != 0) {
1350				/* zero the extra bytes */
1351				usb2_bzero(xfer->frbuffers, temp_len, align);
1352				temp_len += align;
1353			}
1354			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
1355			    m->m_pkthdr.len, temp_len);
1356
1357			xfer->frlengths[0] = temp_len;
1358
1359			usb2_start_hardware(xfer);
1360
1361			/* free mbuf and node */
1362			ural_tx_freem(m);
1363		}
1364		break;
1365
1366	default:			/* Error */
1367		DPRINTFN(11, "transfer error, %s\n",
1368		    usb2_errstr(xfer->error));
1369
1370		if (xfer->error != USB_ERR_CANCELLED) {
1371			/* try to clear stall first */
1372			sc->sc_flags |= URAL_FLAG_WRITE_STALL;
1373			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_WR]);
1374		}
1375		ifp->if_oerrors++;
1376		break;
1377	}
1378}
1379
1380static void
1381ural_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1382{
1383	struct ural_softc *sc = xfer->priv_sc;
1384	struct usb2_xfer *xfer_other = sc->sc_xfer[URAL_BULK_DT_WR];
1385
1386	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1387		DPRINTF("stall cleared\n");
1388		sc->sc_flags &= ~URAL_FLAG_WRITE_STALL;
1389		usb2_transfer_start(xfer_other);
1390	}
1391}
1392
1393static void
1394ural_watchdog(void *arg)
1395{
1396	struct ural_softc *sc = arg;
1397
1398	mtx_assert(&sc->sc_mtx, MA_OWNED);
1399
1400	if (sc->sc_amrr_timer) {
1401		usb2_config_td_queue_command
1402		    (&sc->sc_config_td, NULL,
1403		    &ural_cfg_amrr_timeout, 0, 0);
1404	}
1405	usb2_callout_reset(&sc->sc_watchdog,
1406	    hz, &ural_watchdog, sc);
1407}
1408
1409/*========================================================================*
1410 * IF-net callbacks
1411 *========================================================================*/
1412
1413static void
1414ural_init_cb(void *arg)
1415{
1416	struct ural_softc *sc = arg;
1417
1418	mtx_lock(&sc->sc_mtx);
1419	usb2_config_td_queue_command
1420	    (&sc->sc_config_td, &ural_cfg_pre_init,
1421	    &ural_cfg_init, 0, 0);
1422	mtx_unlock(&sc->sc_mtx);
1423}
1424
1425static int
1426ural_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1427{
1428	struct ural_softc *sc = ifp->if_softc;
1429	struct ieee80211com *ic = ifp->if_l2com;
1430	int error;
1431
1432	switch (cmd) {
1433	case SIOCSIFFLAGS:
1434		mtx_lock(&sc->sc_mtx);
1435		if (ifp->if_flags & IFF_UP) {
1436			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1437				usb2_config_td_queue_command
1438				    (&sc->sc_config_td, &ural_cfg_pre_init,
1439				    &ural_cfg_init, 0, 0);
1440			}
1441		} else {
1442			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1443				usb2_config_td_queue_command
1444				    (&sc->sc_config_td, &ural_cfg_pre_stop,
1445				    &ural_cfg_stop, 0, 0);
1446			}
1447		}
1448		mtx_unlock(&sc->sc_mtx);
1449		error = 0;
1450		break;
1451
1452	case SIOCGIFMEDIA:
1453	case SIOCSIFMEDIA:
1454		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1455		break;
1456
1457	default:
1458		error = ether_ioctl(ifp, cmd, data);
1459	}
1460	return (error);
1461}
1462
1463static void
1464ural_start_cb(struct ifnet *ifp)
1465{
1466	struct ural_softc *sc = ifp->if_softc;
1467
1468	mtx_lock(&sc->sc_mtx);
1469	/* start write transfer, if not started */
1470	usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
1471	mtx_unlock(&sc->sc_mtx);
1472}
1473
1474static void
1475ural_cfg_newstate(struct ural_softc *sc,
1476    struct usb2_config_td_cc *cc, uint16_t refcount)
1477{
1478	struct ifnet *ifp = sc->sc_ifp;
1479	struct ieee80211com *ic = ifp->if_l2com;
1480	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1481	struct ural_vap *uvp = URAL_VAP(vap);
1482	enum ieee80211_state ostate;
1483	enum ieee80211_state nstate;
1484	int arg;
1485
1486	ostate = vap->iv_state;
1487	nstate = sc->sc_ns_state;
1488	arg = sc->sc_ns_arg;
1489
1490	if (ostate == IEEE80211_S_INIT) {
1491		/* We are leaving INIT. TSF sync should be off. */
1492		ural_cfg_disable_tsf_sync(sc);
1493	}
1494	switch (nstate) {
1495	case IEEE80211_S_INIT:
1496		break;
1497
1498	case IEEE80211_S_RUN:
1499		ural_cfg_set_run(sc, cc);
1500		break;
1501
1502	default:
1503		break;
1504	}
1505
1506	mtx_unlock(&sc->sc_mtx);
1507	IEEE80211_LOCK(ic);
1508	uvp->newstate(vap, nstate, arg);
1509	if (vap->iv_newstate_cb != NULL)
1510		vap->iv_newstate_cb(vap, nstate, arg);
1511	IEEE80211_UNLOCK(ic);
1512	mtx_lock(&sc->sc_mtx);
1513}
1514
1515static int
1516ural_newstate_cb(struct ieee80211vap *vap,
1517    enum ieee80211_state nstate, int arg)
1518{
1519	struct ural_vap *uvp = URAL_VAP(vap);
1520	struct ieee80211com *ic = vap->iv_ic;
1521	struct ural_softc *sc = ic->ic_ifp->if_softc;
1522
1523	DPRINTF("setting new state: %d\n", nstate);
1524
1525	/* Special case - cannot defer this call and cannot block ! */
1526	if (nstate == IEEE80211_S_INIT) {
1527		/* stop timers */
1528		mtx_lock(&sc->sc_mtx);
1529		sc->sc_amrr_timer = 0;
1530		mtx_unlock(&sc->sc_mtx);
1531		return (uvp->newstate(vap, nstate, arg));
1532	}
1533	mtx_lock(&sc->sc_mtx);
1534	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1535		mtx_unlock(&sc->sc_mtx);
1536		return (0);		/* nothing to do */
1537	}
1538	/* store next state */
1539	sc->sc_ns_state = nstate;
1540	sc->sc_ns_arg = arg;
1541
1542	/* stop timers */
1543	sc->sc_amrr_timer = 0;
1544
1545	/*
1546	 * USB configuration can only be done from the USB configuration
1547	 * thread:
1548	 */
1549	usb2_config_td_queue_command
1550	    (&sc->sc_config_td, &ural_config_copy,
1551	    &ural_cfg_newstate, 0, 0);
1552
1553	mtx_unlock(&sc->sc_mtx);
1554
1555	return (EINPROGRESS);
1556}
1557
1558static void
1559ural_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1560{
1561	struct ural_softc *sc = ic->ic_ifp->if_softc;
1562
1563	mtx_lock(&sc->sc_mtx);
1564
1565	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1566
1567	usb2_config_td_queue_command
1568	    (&sc->sc_config_td, &ural_config_copy, func, 0, 0);
1569
1570	mtx_unlock(&sc->sc_mtx);
1571}
1572
1573static void
1574ural_scan_start_cb(struct ieee80211com *ic)
1575{
1576	ural_std_command(ic, &ural_cfg_scan_start);
1577}
1578
1579static void
1580ural_scan_end_cb(struct ieee80211com *ic)
1581{
1582	ural_std_command(ic, &ural_cfg_scan_end);
1583}
1584
1585static void
1586ural_set_channel_cb(struct ieee80211com *ic)
1587{
1588	ural_std_command(ic, &ural_cfg_set_chan);
1589}
1590
1591/*========================================================================*
1592 * configure sub-routines, ural_cfg_xxx
1593 *========================================================================*/
1594
1595static void
1596ural_cfg_scan_start(struct ural_softc *sc,
1597    struct usb2_config_td_cc *cc, uint16_t refcount)
1598{
1599	/* abort TSF synchronization */
1600	ural_cfg_disable_tsf_sync(sc);
1601	ural_cfg_set_bssid(sc, cc->if_broadcastaddr);
1602}
1603
1604static void
1605ural_cfg_scan_end(struct ural_softc *sc,
1606    struct usb2_config_td_cc *cc, uint16_t refcount)
1607{
1608	/* enable TSF synchronization */
1609	ural_cfg_enable_tsf_sync(sc, cc, 0);
1610	ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1611}
1612
1613static void
1614ural_cfg_set_chan(struct ural_softc *sc,
1615    struct usb2_config_td_cc *cc, uint16_t refcount)
1616{
1617	enum {
1618		N_RF5222 = (sizeof(ural_rf5222) / sizeof(ural_rf5222[0])),
1619	};
1620	uint32_t i;
1621	uint32_t chan;
1622	uint8_t power;
1623	uint8_t tmp;
1624
1625	chan = cc->ic_curchan.chan_to_ieee;
1626
1627	if ((chan == 0) ||
1628	    (chan == IEEE80211_CHAN_ANY)) {
1629		/* nothing to do */
1630		return;
1631	}
1632	if (cc->ic_curchan.chan_is_2ghz)
1633		power = min(sc->sc_txpow[chan - 1], 31);
1634	else
1635		power = 31;
1636
1637	/* adjust txpower using ifconfig settings */
1638	power -= (100 - cc->ic_txpowlimit) / 8;
1639
1640	DPRINTFN(3, "setting channel to %u, "
1641	    "tx-power to %u\n", chan, power);
1642
1643	switch (sc->sc_rf_rev) {
1644	case RAL_RF_2522:
1645		ural_cfg_rf_write(sc, RAL_RF1, 0x00814);
1646		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1647		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1648		break;
1649
1650	case RAL_RF_2523:
1651		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1652		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1653		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x38044);
1654		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1655		break;
1656
1657	case RAL_RF_2524:
1658		ural_cfg_rf_write(sc, RAL_RF1, 0x0c808);
1659		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1660		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1661		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1662		break;
1663
1664	case RAL_RF_2525:
1665		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1666		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1667		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1668		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1669
1670		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1671		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1672		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1673		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1674		break;
1675
1676	case RAL_RF_2525E:
1677		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1678		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1679		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1680		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1681		break;
1682
1683	case RAL_RF_2526:
1684		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1685		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1686		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1687
1688		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1689		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1690		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1691		break;
1692
1693		/* dual-band RF */
1694	case RAL_RF_5222:
1695		for (i = 0; i < N_RF5222; i++) {
1696			if (ural_rf5222[i].chan == chan) {
1697				ural_cfg_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1698				ural_cfg_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1699				ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1700				ural_cfg_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1701				break;
1702			}
1703		}
1704		break;
1705	}
1706
1707	if ((cc->ic_opmode != IEEE80211_M_MONITOR) &&
1708	    (!(cc->ic_flags & IEEE80211_F_SCAN))) {
1709
1710		/* set Japan filter bit for channel 14 */
1711		tmp = ural_cfg_bbp_read(sc, 70);
1712
1713		if (chan == 14) {
1714			tmp |= RAL_JAPAN_FILTER;
1715		} else {
1716			tmp &= ~RAL_JAPAN_FILTER;
1717		}
1718
1719		ural_cfg_bbp_write(sc, 70, tmp);
1720
1721		/* clear CRC errors */
1722		ural_cfg_read(sc, RAL_STA_CSR0);
1723
1724		ural_cfg_disable_rf_tune(sc);
1725	}
1726	/* update basic rate set */
1727	if (cc->ic_curchan.chan_is_b) {
1728		/* 11b basic rates: 1, 2Mbps */
1729		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1730	} else if (cc->ic_curchan.chan_is_a) {
1731		/* 11a basic rates: 6, 12, 24Mbps */
1732		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1733	} else {
1734		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1735		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1736	}
1737
1738	/* wait a little */
1739	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1740		return;
1741	}
1742}
1743
1744static void
1745ural_cfg_set_run(struct ural_softc *sc,
1746    struct usb2_config_td_cc *cc)
1747{
1748	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1749		ural_cfg_update_slot(sc, cc, 0);
1750		ural_cfg_set_txpreamble(sc, cc, 0);
1751
1752		/* update basic rate set */
1753
1754		if (cc->ic_bsschan.chan_is_5ghz) {
1755			/* 11a basic rates: 6, 12, 24Mbps */
1756			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1757		} else if (cc->ic_bsschan.chan_is_g) {
1758			/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1759			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1760		} else {
1761			/* 11b basic rates: 1, 2Mbps */
1762			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1763		}
1764		ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1765	}
1766	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1767	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1768		ural_tx_bcn(sc);
1769	}
1770	/* make tx led blink on tx (controlled by ASIC) */
1771	ural_cfg_write(sc, RAL_MAC_CSR20, 1);
1772
1773	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1774		ural_cfg_enable_tsf_sync(sc, cc, 0);
1775	}
1776	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1777	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
1778
1779	if (cc->iv_bss.fixed_rate_none) {
1780		/* enable automatic rate adaptation */
1781		ural_cfg_amrr_start(sc);
1782	}
1783}
1784
1785/*------------------------------------------------------------------------*
1786 * ural_cfg_disable_rf_tune - disable RF auto-tuning
1787 *------------------------------------------------------------------------*/
1788static void
1789ural_cfg_disable_rf_tune(struct ural_softc *sc)
1790{
1791	uint32_t tmp;
1792
1793	if (sc->sc_rf_rev != RAL_RF_2523) {
1794		tmp = sc->sc_rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1795		ural_cfg_rf_write(sc, RAL_RF1, tmp);
1796	}
1797	tmp = sc->sc_rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1798	ural_cfg_rf_write(sc, RAL_RF3, tmp);
1799
1800	DPRINTFN(3, "disabling RF autotune\n");
1801}
1802
1803/*------------------------------------------------------------------------*
1804 * ural_cfg_enable_tsf_sync - refer to IEEE Std 802.11-1999 pp. 123
1805 * for more information on TSF synchronization
1806 *------------------------------------------------------------------------*/
1807static void
1808ural_cfg_enable_tsf_sync(struct ural_softc *sc,
1809    struct usb2_config_td_cc *cc, uint16_t refcount)
1810{
1811	uint16_t logcwmin;
1812	uint16_t preload;
1813	uint16_t tmp;
1814
1815	/* first, disable TSF synchronization */
1816	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1817
1818	tmp = (16 * cc->iv_bss.ni_intval) << 4;
1819	ural_cfg_write(sc, RAL_TXRX_CSR18, tmp);
1820
1821	logcwmin = (cc->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1822	preload = (cc->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1823	tmp = (logcwmin << 12) | preload;
1824	ural_cfg_write(sc, RAL_TXRX_CSR20, tmp);
1825
1826	/* finally, enable TSF synchronization */
1827	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1828	if (cc->ic_opmode == IEEE80211_M_STA)
1829		tmp |= RAL_ENABLE_TSF_SYNC(1);
1830	else
1831		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1832
1833	ural_cfg_write(sc, RAL_TXRX_CSR19, tmp);
1834
1835	DPRINTF("enabling TSF synchronization\n");
1836}
1837
1838static void
1839ural_cfg_disable_tsf_sync(struct ural_softc *sc)
1840{
1841	/* abort TSF synchronization */
1842	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1843
1844	/* force tx led to stop blinking */
1845	ural_cfg_write(sc, RAL_MAC_CSR20, 0);
1846}
1847
1848#define	RAL_RXTX_TURNAROUND    5	/* us */
1849
1850static void
1851ural_cfg_update_slot(struct ural_softc *sc,
1852    struct usb2_config_td_cc *cc, uint16_t refcount)
1853{
1854	uint16_t slottime;
1855	uint16_t sifs;
1856	uint16_t eifs;
1857
1858	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1859
1860	/*
1861	 * These settings may sound a bit inconsistent but this is what the
1862	 * reference driver does.
1863	 */
1864	if (cc->ic_curmode == IEEE80211_MODE_11B) {
1865		sifs = 16 - RAL_RXTX_TURNAROUND;
1866		eifs = 364;
1867	} else {
1868		sifs = 10 - RAL_RXTX_TURNAROUND;
1869		eifs = 64;
1870	}
1871
1872	ural_cfg_write(sc, RAL_MAC_CSR10, slottime);
1873	ural_cfg_write(sc, RAL_MAC_CSR11, sifs);
1874	ural_cfg_write(sc, RAL_MAC_CSR12, eifs);
1875}
1876
1877static void
1878ural_cfg_set_txpreamble(struct ural_softc *sc,
1879    struct usb2_config_td_cc *cc, uint16_t refcount)
1880{
1881	uint16_t tmp;
1882
1883	tmp = ural_cfg_read(sc, RAL_TXRX_CSR10);
1884
1885	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE) {
1886		tmp |= RAL_SHORT_PREAMBLE;
1887	} else {
1888		tmp &= ~RAL_SHORT_PREAMBLE;
1889	}
1890
1891	ural_cfg_write(sc, RAL_TXRX_CSR10, tmp);
1892}
1893
1894static void
1895ural_cfg_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1896{
1897	ural_cfg_write_multi(sc, RAL_MAC_CSR5, bssid, IEEE80211_ADDR_LEN);
1898
1899	DPRINTF("setting BSSID to 0x%02x%02x%02x%02x%02x%02x\n",
1900	    bssid[5], bssid[4], bssid[3],
1901	    bssid[2], bssid[1], bssid[0]);
1902}
1903
1904static void
1905ural_cfg_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1906{
1907	ural_cfg_write_multi(sc, RAL_MAC_CSR2, addr, IEEE80211_ADDR_LEN);
1908
1909	DPRINTF("setting MAC to 0x%02x%02x%02x%02x%02x%02x\n",
1910	    addr[5], addr[4], addr[3],
1911	    addr[2], addr[1], addr[0]);
1912}
1913
1914static void
1915ural_cfg_update_promisc(struct ural_softc *sc,
1916    struct usb2_config_td_cc *cc, uint16_t refcount)
1917{
1918	uint16_t tmp;
1919
1920	tmp = ural_cfg_read(sc, RAL_TXRX_CSR2);
1921
1922	if (cc->if_flags & IFF_PROMISC) {
1923		tmp &= ~RAL_DROP_NOT_TO_ME;
1924	} else {
1925		tmp |= RAL_DROP_NOT_TO_ME;
1926	}
1927
1928	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
1929
1930	DPRINTF("%s promiscuous mode\n",
1931	    (cc->if_flags & IFF_PROMISC) ?
1932	    "entering" : "leaving");
1933}
1934
1935static void
1936ural_cfg_set_txantenna(struct ural_softc *sc, uint8_t antenna)
1937{
1938	uint16_t tmp;
1939	uint8_t tx;
1940
1941	tx = ural_cfg_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1942	if (antenna == 1)
1943		tx |= RAL_BBP_ANTA;
1944	else if (antenna == 2)
1945		tx |= RAL_BBP_ANTB;
1946	else
1947		tx |= RAL_BBP_DIVERSITY;
1948
1949	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1950	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1951	    (sc->sc_rf_rev == RAL_RF_2526) ||
1952	    (sc->sc_rf_rev == RAL_RF_5222)) {
1953		tx |= RAL_BBP_FLIPIQ;
1954	}
1955	ural_cfg_bbp_write(sc, RAL_BBP_TX, tx);
1956
1957	/* update values in PHY_CSR5 and PHY_CSR6 */
1958	tmp = ural_cfg_read(sc, RAL_PHY_CSR5) & ~0x7;
1959	ural_cfg_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1960
1961	tmp = ural_cfg_read(sc, RAL_PHY_CSR6) & ~0x7;
1962	ural_cfg_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1963}
1964
1965static void
1966ural_cfg_set_rxantenna(struct ural_softc *sc, uint8_t antenna)
1967{
1968	uint8_t rx;
1969
1970	rx = ural_cfg_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1971	if (antenna == 1)
1972		rx |= RAL_BBP_ANTA;
1973	else if (antenna == 2)
1974		rx |= RAL_BBP_ANTB;
1975	else
1976		rx |= RAL_BBP_DIVERSITY;
1977
1978	/* need to force no I/Q flip for RF 2525e and 2526 */
1979
1980	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1981	    (sc->sc_rf_rev == RAL_RF_2526)) {
1982		rx &= ~RAL_BBP_FLIPIQ;
1983	}
1984	ural_cfg_bbp_write(sc, RAL_BBP_RX, rx);
1985}
1986
1987static void
1988ural_cfg_read_eeprom(struct ural_softc *sc)
1989{
1990	uint16_t val;
1991
1992	ural_cfg_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1993
1994	val = le16toh(val);
1995
1996	sc->sc_rf_rev = (val >> 11) & 0x7;
1997	sc->sc_hw_radio = (val >> 10) & 0x1;
1998	sc->sc_led_mode = (val >> 6) & 0x7;
1999	sc->sc_rx_ant = (val >> 4) & 0x3;
2000	sc->sc_tx_ant = (val >> 2) & 0x3;
2001	sc->sc_nb_ant = (val & 0x3);
2002
2003	DPRINTF("val = 0x%04x\n", val);
2004
2005	/* read MAC address */
2006	ural_cfg_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_myaddr,
2007	    sizeof(sc->sc_myaddr));
2008
2009	/* read default values for BBP registers */
2010	ural_cfg_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->sc_bbp_prom,
2011	    sizeof(sc->sc_bbp_prom));
2012
2013	/* read Tx power for all b/g channels */
2014	ural_cfg_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->sc_txpow,
2015	    sizeof(sc->sc_txpow));
2016}
2017
2018static uint8_t
2019ural_cfg_bbp_init(struct ural_softc *sc)
2020{
2021	enum {
2022		N_DEF_BBP = (sizeof(ural_def_bbp) / sizeof(ural_def_bbp[0])),
2023	};
2024	uint16_t i;
2025	uint8_t to;
2026
2027	/* wait for BBP to become ready */
2028	for (to = 0;; to++) {
2029		if (to < 100) {
2030			if (ural_cfg_bbp_read(sc, RAL_BBP_VERSION) != 0) {
2031				break;
2032			}
2033			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2034				return (1);	/* failure */
2035			}
2036		} else {
2037			DPRINTF("timeout waiting for BBP\n");
2038			return (1);	/* failure */
2039		}
2040	}
2041
2042	/* initialize BBP registers to default values */
2043	for (i = 0; i < N_DEF_BBP; i++) {
2044		ural_cfg_bbp_write(sc, ural_def_bbp[i].reg,
2045		    ural_def_bbp[i].val);
2046	}
2047
2048#if 0
2049	/* initialize BBP registers to values stored in EEPROM */
2050	for (i = 0; i < 16; i++) {
2051		if (sc->sc_bbp_prom[i].reg == 0xff) {
2052			continue;
2053		}
2054		ural_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg,
2055		    sc->sc_bbp_prom[i].val);
2056	}
2057#endif
2058	return (0);			/* success */
2059}
2060
2061static void
2062ural_cfg_pre_init(struct ural_softc *sc,
2063    struct usb2_config_td_cc *cc, uint16_t refcount)
2064{
2065	struct ifnet *ifp = sc->sc_ifp;
2066	struct ieee80211com *ic = ifp->if_l2com;
2067
2068	/* immediate configuration */
2069
2070	ural_cfg_pre_stop(sc, cc, 0);
2071
2072	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2073
2074	sc->sc_flags |= URAL_FLAG_HL_READY;
2075
2076	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2077}
2078
2079static void
2080ural_cfg_init(struct ural_softc *sc,
2081    struct usb2_config_td_cc *cc, uint16_t refcount)
2082{
2083	enum {
2084		N_DEF_MAC = (sizeof(ural_def_mac) / sizeof(ural_def_mac[0])),
2085	};
2086	uint16_t tmp;
2087	uint16_t i;
2088	uint8_t to;
2089
2090	/* delayed configuration */
2091
2092	ural_cfg_set_testmode(sc);
2093
2094	ural_cfg_write(sc, 0x308, 0x00f0);	/* XXX magic */
2095
2096	ural_cfg_stop(sc, cc, 0);
2097
2098	/* initialize MAC registers to default values */
2099	for (i = 0; i < N_DEF_MAC; i++) {
2100		ural_cfg_write(sc, ural_def_mac[i].reg,
2101		    ural_def_mac[i].val);
2102	}
2103
2104	/* wait for BBP and RF to wake up (this can take a long time!) */
2105	for (to = 0;; to++) {
2106		if (to < 100) {
2107			tmp = ural_cfg_read(sc, RAL_MAC_CSR17);
2108			if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2109			    (RAL_BBP_AWAKE | RAL_RF_AWAKE)) {
2110				break;
2111			}
2112			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2113				goto fail;
2114			}
2115		} else {
2116			DPRINTF("timeout waiting for "
2117			    "BBP/RF to wakeup\n");
2118			goto fail;
2119		}
2120	}
2121
2122	/* we're ready! */
2123	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2124
2125	/* set basic rate set (will be updated later) */
2126	ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
2127
2128	if (ural_cfg_bbp_init(sc)) {
2129		goto fail;
2130	}
2131	/* set default BSS channel */
2132	ural_cfg_set_chan(sc, cc, 0);
2133
2134	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2135	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta,
2136	    sizeof(sc->sc_sta));
2137
2138	DPRINTF("rx_ant=%d, tx_ant=%d\n",
2139	    sc->sc_rx_ant, sc->sc_tx_ant);
2140
2141	ural_cfg_set_txantenna(sc, sc->sc_tx_ant);
2142	ural_cfg_set_rxantenna(sc, sc->sc_rx_ant);
2143
2144	ural_cfg_set_macaddr(sc, cc->ic_myaddr);
2145
2146	/*
2147	 * make sure that the first transaction
2148	 * clears the stall:
2149	 */
2150	sc->sc_flags |= (URAL_FLAG_READ_STALL |
2151	    URAL_FLAG_WRITE_STALL |
2152	    URAL_FLAG_LL_READY);
2153
2154	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2155	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2156		struct ifnet *ifp = sc->sc_ifp;
2157		struct ieee80211com *ic = ifp->if_l2com;
2158
2159		/*
2160		 * start the USB transfers, if not already started:
2161		 */
2162		usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_RD]);
2163		usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
2164
2165		/*
2166		 * start IEEE802.11 layer
2167		 */
2168		mtx_unlock(&sc->sc_mtx);
2169		ieee80211_start_all(ic);
2170		mtx_lock(&sc->sc_mtx);
2171	}
2172	/*
2173	 * start Rx
2174	 */
2175	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2176	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2177
2178		tmp |= (RAL_DROP_CTL | RAL_DROP_BAD_VERSION);
2179
2180		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2181			tmp |= RAL_DROP_TODS;
2182		}
2183		if (!(cc->if_flags & IFF_PROMISC)) {
2184			tmp |= RAL_DROP_NOT_TO_ME;
2185		}
2186	}
2187	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
2188
2189	return;
2190
2191fail:
2192	ural_cfg_pre_stop(sc, NULL, 0);
2193
2194	if (cc) {
2195		ural_cfg_stop(sc, cc, 0);
2196	}
2197}
2198
2199static void
2200ural_cfg_pre_stop(struct ural_softc *sc,
2201    struct usb2_config_td_cc *cc, uint16_t refcount)
2202{
2203	struct ifnet *ifp = sc->sc_ifp;
2204
2205	if (cc) {
2206		/* copy the needed configuration */
2207		ural_config_copy(sc, cc, refcount);
2208	}
2209	/* immediate configuration */
2210
2211	if (ifp) {
2212		/* clear flags */
2213		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2214	}
2215	sc->sc_flags &= ~(URAL_FLAG_HL_READY |
2216	    URAL_FLAG_LL_READY);
2217
2218	/*
2219	 * stop all the transfers, if not already stopped:
2220	 */
2221	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_DT_WR]);
2222	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_DT_RD]);
2223	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_CS_WR]);
2224	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_CS_RD]);
2225
2226	/* clean up transmission */
2227	ural_tx_clean_queue(sc);
2228}
2229
2230static void
2231ural_cfg_stop(struct ural_softc *sc,
2232    struct usb2_config_td_cc *cc, uint16_t refcount)
2233{
2234	/* disable Rx */
2235	ural_cfg_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2236
2237	/* reset ASIC and BBP (but won't reset MAC registers!) */
2238	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2239
2240	/* wait a little */
2241	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2242
2243	/* clear reset */
2244	ural_cfg_write(sc, RAL_MAC_CSR1, 0);
2245
2246	/* wait a little */
2247	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2248}
2249
2250static void
2251ural_cfg_amrr_start(struct ural_softc *sc)
2252{
2253	struct ieee80211vap *vap;
2254	struct ieee80211_node *ni;
2255
2256	vap = ural_get_vap(sc);
2257
2258	if (vap == NULL) {
2259		return;
2260	}
2261	ni = vap->iv_bss;
2262	if (ni == NULL) {
2263		return;
2264	}
2265	/* init AMRR */
2266
2267	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2268	/* enable AMRR timer */
2269
2270	sc->sc_amrr_timer = 1;
2271}
2272
2273static void
2274ural_cfg_amrr_timeout(struct ural_softc *sc,
2275    struct usb2_config_td_cc *cc, uint16_t refcount)
2276{
2277	struct ifnet *ifp = sc->sc_ifp;
2278	struct ieee80211vap *vap;
2279	struct ieee80211_node *ni;
2280	uint32_t ok;
2281	uint32_t fail;
2282
2283	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2284	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2285
2286	vap = ural_get_vap(sc);
2287	if (vap == NULL) {
2288		return;
2289	}
2290	ni = vap->iv_bss;
2291	if (ni == NULL) {
2292		return;
2293	}
2294	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2295	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2296
2297		ok = sc->sc_sta[7] +	/* TX ok w/o retry */
2298		    sc->sc_sta[8];	/* TX ok w/ retry */
2299		fail = sc->sc_sta[9];	/* TX retry-fail count */
2300
2301		if (sc->sc_amrr_timer) {
2302
2303			ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2304			    ok + fail, ok, sc->sc_sta[8] + fail);
2305
2306			if (ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn)) {
2307				/* ignore */
2308			}
2309		}
2310		ifp->if_oerrors += fail;
2311	}
2312}
2313
2314static struct ieee80211vap *
2315ural_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2316    int opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
2317    const uint8_t mac[IEEE80211_ADDR_LEN])
2318{
2319	struct ural_vap *uvp;
2320	struct ieee80211vap *vap;
2321	struct ural_softc *sc = ic->ic_ifp->if_softc;
2322
2323	/* Need to sync with config thread: */
2324	mtx_lock(&sc->sc_mtx);
2325	if (usb2_config_td_sync(&sc->sc_config_td)) {
2326		mtx_unlock(&sc->sc_mtx);
2327		/* config thread is gone */
2328		return (NULL);
2329	}
2330	mtx_unlock(&sc->sc_mtx);
2331
2332	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2333		return NULL;
2334	uvp = (struct ural_vap *)malloc(sizeof(struct ural_vap),
2335	    M_80211_VAP, M_NOWAIT | M_ZERO);
2336	if (uvp == NULL)
2337		return NULL;
2338
2339	vap = &uvp->vap;
2340	/* enable s/w bmiss handling for sta mode */
2341	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2342	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2343
2344	/* override state transition machine */
2345	uvp->newstate = vap->iv_newstate;
2346	vap->iv_newstate = &ural_newstate_cb;
2347
2348	ieee80211_amrr_init(&uvp->amrr, vap,
2349	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2350	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2351	    1000 /* 1 sec */ );
2352
2353	/* complete setup */
2354	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2355
2356	/* store current operation mode */
2357	ic->ic_opmode = opmode;
2358
2359	return (vap);
2360}
2361
2362static void
2363ural_vap_delete(struct ieee80211vap *vap)
2364{
2365	struct ural_vap *uvp = URAL_VAP(vap);
2366	struct ural_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2367
2368	/* Need to sync with config thread: */
2369	mtx_lock(&sc->sc_mtx);
2370	if (usb2_config_td_sync(&sc->sc_config_td)) {
2371		/* ignore */
2372	}
2373	mtx_unlock(&sc->sc_mtx);
2374
2375	ieee80211_amrr_cleanup(&uvp->amrr);
2376	ieee80211_vap_detach(vap);
2377	free(uvp, M_80211_VAP);
2378}
2379
2380/* ARGUSED */
2381static struct ieee80211_node *
2382ural_node_alloc(struct ieee80211vap *vap __unused,
2383    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2384{
2385	struct ural_node *un;
2386
2387	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2388	return ((un != NULL) ? &un->ni : NULL);
2389}
2390
2391static void
2392ural_newassoc(struct ieee80211_node *ni, int isnew)
2393{
2394	struct ieee80211vap *vap = ni->ni_vap;
2395
2396	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2397}
2398
2399static void
2400ural_fill_write_queue(struct ural_softc *sc)
2401{
2402	struct ifnet *ifp = sc->sc_ifp;
2403	struct ieee80211_node *ni;
2404	struct mbuf *m;
2405
2406	/*
2407	 * We only fill up half of the queue with data frames. The rest is
2408	 * reserved for other kinds of frames.
2409	 */
2410
2411	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2412
2413		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2414		if (m == NULL)
2415			break;
2416
2417		ni = (void *)(m->m_pkthdr.rcvif);
2418		m = ieee80211_encap(ni, m);
2419		if (m == NULL) {
2420			ieee80211_free_node(ni);
2421			continue;
2422		}
2423		ural_tx_data(sc, m, ni);
2424	}
2425}
2426
2427static void
2428ural_tx_clean_queue(struct ural_softc *sc)
2429{
2430	struct mbuf *m;
2431
2432	for (;;) {
2433		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2434
2435		if (!m) {
2436			break;
2437		}
2438		ural_tx_freem(m);
2439	}
2440}
2441
2442static void
2443ural_tx_freem(struct mbuf *m)
2444{
2445	struct ieee80211_node *ni;
2446
2447	while (m) {
2448		ni = (void *)(m->m_pkthdr.rcvif);
2449		if (!ni) {
2450			m = m_free(m);
2451			continue;
2452		}
2453		if (m->m_flags & M_TXCB) {
2454			ieee80211_process_callback(ni, m, 0);
2455		}
2456		m_freem(m);
2457		ieee80211_free_node(ni);
2458
2459		break;
2460	}
2461}
2462
2463static void
2464ural_tx_mgt(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2465{
2466	struct ieee80211vap *vap = ni->ni_vap;
2467	struct ieee80211com *ic = ni->ni_ic;
2468	const struct ieee80211_txparam *tp;
2469	struct ieee80211_frame *wh;
2470	struct ieee80211_key *k;
2471	uint32_t flags;
2472	uint16_t dur;
2473
2474	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2475
2476	wh = mtod(m, struct ieee80211_frame *);
2477	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2478		k = ieee80211_crypto_encap(ni, m);
2479		if (k == NULL) {
2480			m_freem(m);
2481			ieee80211_free_node(ni);
2482			return;
2483		}
2484		wh = mtod(m, struct ieee80211_frame *);
2485	}
2486	flags = 0;
2487	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2488		flags |= RAL_TX_ACK;
2489
2490		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2491		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2492		USETW(wh->i_dur, dur);
2493
2494		/* tell hardware to add timestamp for probe responses */
2495		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2496		    IEEE80211_FC0_TYPE_MGT &&
2497		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
2498		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2499			flags |= RAL_TX_TIMESTAMP;
2500	}
2501	m->m_pkthdr.rcvif = (void *)ni;
2502	ural_setup_desc_and_tx(sc, m, flags, tp->mgmtrate);
2503}
2504
2505static struct ieee80211vap *
2506ural_get_vap(struct ural_softc *sc)
2507{
2508	struct ifnet *ifp;
2509	struct ieee80211com *ic;
2510
2511	if (sc == NULL) {
2512		return NULL;
2513	}
2514	ifp = sc->sc_ifp;
2515	if (ifp == NULL) {
2516		return NULL;
2517	}
2518	ic = ifp->if_l2com;
2519	if (ic == NULL) {
2520		return NULL;
2521	}
2522	return TAILQ_FIRST(&ic->ic_vaps);
2523}
2524
2525static void
2526ural_tx_bcn(struct ural_softc *sc)
2527{
2528	struct ieee80211_node *ni;
2529	struct ieee80211vap *vap;
2530	struct ieee80211com *ic;
2531	const struct ieee80211_txparam *tp;
2532	struct mbuf *m;
2533
2534	vap = ural_get_vap(sc);
2535	if (vap == NULL) {
2536		return;
2537	}
2538	ni = vap->iv_bss;
2539	if (ni == NULL) {
2540		return;
2541	}
2542	ic = vap->iv_ic;
2543	if (ic == NULL) {
2544		return;
2545	}
2546	DPRINTFN(11, "Sending beacon frame.\n");
2547
2548	m = ieee80211_beacon_alloc(ni, &URAL_VAP(vap)->bo);
2549	if (m == NULL) {
2550		DPRINTFN(0, "could not allocate beacon\n");
2551		return;
2552	}
2553	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2554
2555	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2556	ural_setup_desc_and_tx(sc, m, RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP,
2557	    tp->mgmtrate);
2558}
2559
2560static void
2561ural_tx_data(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2562{
2563	struct ieee80211vap *vap = ni->ni_vap;
2564	struct ieee80211com *ic = ni->ni_ic;
2565	const struct ieee80211_txparam *tp;
2566	struct ieee80211_frame *wh;
2567	struct ieee80211_key *k;
2568	uint32_t flags = 0;
2569	uint16_t dur;
2570	uint16_t rate;
2571
2572	DPRINTFN(11, "Sending data.\n");
2573
2574	wh = mtod(m, struct ieee80211_frame *);
2575
2576	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2577	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2578		rate = tp->mcastrate;
2579	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2580		rate = tp->ucastrate;
2581	else
2582		rate = ni->ni_txrate;
2583
2584	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2585		k = ieee80211_crypto_encap(ni, m);
2586		if (k == NULL) {
2587			m_freem(m);
2588			ieee80211_free_node(ni);
2589			return;
2590		}
2591		/* packet header may have moved, reset our local pointer */
2592		wh = mtod(m, struct ieee80211_frame *);
2593	}
2594	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2595		uint8_t prot = IEEE80211_PROT_NONE;
2596
2597		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2598			prot = IEEE80211_PROT_RTSCTS;
2599		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2600		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2601			prot = ic->ic_protmode;
2602		if (prot != IEEE80211_PROT_NONE) {
2603			ural_tx_prot(sc, m, ni, prot, rate);
2604			flags |= RAL_TX_IFS_SIFS;
2605		}
2606		flags |= RAL_TX_ACK;
2607		flags |= RAL_TX_RETRY(7);
2608
2609		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2610		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2611		USETW(wh->i_dur, dur);
2612	}
2613	m->m_pkthdr.rcvif = (void *)ni;
2614	ural_setup_desc_and_tx(sc, m, flags, rate);
2615}
2616
2617static void
2618ural_tx_prot(struct ural_softc *sc,
2619    const struct mbuf *m, struct ieee80211_node *ni,
2620    uint8_t prot, uint16_t rate)
2621{
2622	struct ieee80211com *ic = ni->ni_ic;
2623	const struct ieee80211_frame *wh;
2624	struct mbuf *mprot;
2625	uint32_t flags;
2626	uint16_t protrate;
2627	uint16_t ackrate;
2628	uint16_t pktlen;
2629	uint16_t dur;
2630	uint8_t isshort;
2631
2632	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2633	    (prot == IEEE80211_PROT_CTSONLY),
2634	    ("protection %u", prot));
2635
2636	DPRINTFN(16, "Sending protection frame.\n");
2637
2638	wh = mtod(m, const struct ieee80211_frame *);
2639	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2640
2641	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2642	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2643
2644	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2645	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2646	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2647	flags = RAL_TX_RETRY(7);
2648	if (prot == IEEE80211_PROT_RTSCTS) {
2649		/* NB: CTS is the same size as an ACK */
2650		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2651		flags |= RAL_TX_ACK;
2652		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2653	} else {
2654		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2655	}
2656	if (mprot == NULL) {
2657		return;
2658	}
2659	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2660	ural_setup_desc_and_tx(sc, mprot, flags, protrate);
2661}
2662
2663static void
2664ural_tx_raw(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2665    const struct ieee80211_bpf_params *params)
2666{
2667	uint32_t flags;
2668	uint16_t rate;
2669
2670	DPRINTFN(11, "Sending raw frame.\n");
2671
2672	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2673
2674	/* XXX validate */
2675	if (rate == 0) {
2676		m_freem(m);
2677		ieee80211_free_node(ni);
2678		return;
2679	}
2680	flags = 0;
2681	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2682		flags |= RAL_TX_ACK;
2683	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2684		ural_tx_prot(sc, m, ni,
2685		    (params->ibp_flags & IEEE80211_BPF_RTS) ?
2686		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2687		    rate);
2688		flags |= RAL_TX_IFS_SIFS;
2689	}
2690	m->m_pkthdr.rcvif = (void *)ni;
2691	ural_setup_desc_and_tx(sc, m, flags, rate);
2692}
2693
2694static int
2695ural_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2696    const struct ieee80211_bpf_params *params)
2697{
2698	struct ieee80211com *ic = ni->ni_ic;
2699	struct ifnet *ifp = ic->ic_ifp;
2700	struct ural_softc *sc = ifp->if_softc;
2701
2702	mtx_lock(&sc->sc_mtx);
2703	if (params == NULL) {
2704		/*
2705		 * Legacy path; interpret frame contents to decide
2706		 * precisely how to send the frame.
2707		 */
2708		ural_tx_mgt(sc, m, ni);
2709	} else {
2710		/*
2711		 * Caller supplied explicit parameters to use in
2712		 * sending the frame.
2713		 */
2714		ural_tx_raw(sc, m, ni, params);
2715	}
2716	mtx_unlock(&sc->sc_mtx);
2717	return (0);
2718}
2719
2720static void
2721ural_update_mcast_cb(struct ifnet *ifp)
2722{
2723	/* not supported */
2724}
2725
2726static void
2727ural_update_promisc_cb(struct ifnet *ifp)
2728{
2729	struct ural_softc *sc = ifp->if_softc;
2730
2731	mtx_lock(&sc->sc_mtx);
2732	usb2_config_td_queue_command
2733	    (&sc->sc_config_td, &ural_config_copy,
2734	    &ural_cfg_update_promisc, 0, 0);
2735	mtx_unlock(&sc->sc_mtx);
2736}
2737