if_ural.c revision 188619
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 188619 2009-02-14 22:29:54Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23#include <sys/cdefs.h>
24__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 188619 2009-02-14 22:29:54Z thompsa $");
25
26/*-
27 * Ralink Technology RT2500USB chipset driver
28 * http://www.ralinktech.com/
29 */
30
31#include <dev/usb2/include/usb2_devid.h>
32#include <dev/usb2/include/usb2_standard.h>
33#include <dev/usb2/include/usb2_mfunc.h>
34#include <dev/usb2/include/usb2_error.h>
35
36#define	USB_DEBUG_VAR ural_debug
37
38#include <dev/usb2/core/usb2_core.h>
39#include <dev/usb2/core/usb2_lookup.h>
40#include <dev/usb2/core/usb2_process.h>
41#include <dev/usb2/core/usb2_debug.h>
42#include <dev/usb2/core/usb2_request.h>
43#include <dev/usb2/core/usb2_busdma.h>
44#include <dev/usb2/core/usb2_util.h>
45
46#include <dev/usb2/wlan/usb2_wlan.h>
47#include <dev/usb2/wlan/if_uralreg.h>
48#include <dev/usb2/wlan/if_uralvar.h>
49
50#if USB_DEBUG
51static int ural_debug = 0;
52
53SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
54SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
55    "Debug level");
56#endif
57
58#define	ural_do_request(sc,req,data) \
59    usb2_do_request_proc((sc)->sc_udev, &(sc)->sc_tq, req, data, 0, NULL, 5000)
60
61#define URAL_RSSI(rssi)					\
62	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
63	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
64
65/* various supported device vendors/products */
66static const struct usb2_device_id ural_devs[] = {
67	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G) },
68	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570) },
69	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050) },
70	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051) },
71	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS) },
72	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G) },
73	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP) },
74	{ USB_VP(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU) },
75	{ USB_VP(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122) },
76	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G) },
77	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG) },
78	{ USB_VP(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254) },
79	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54) },
80	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI) },
81	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB) },
82	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI) },
83	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570) },
84	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2) },
85	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3) },
86	{ USB_VP(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902) },
87	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570) },
88	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2) },
89	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3) },
90	{ USB_VP(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G) },
91	{ USB_VP(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG) },
92	{ USB_VP(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R) },
93	{ USB_VP(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570) },
94	{ USB_VP(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570) },
95	{ USB_VP(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570) },
96};
97
98static usb2_callback_t ural_bulk_read_callback;
99static usb2_callback_t ural_bulk_write_callback;
100
101static usb2_proc_callback_t ural_attach_post;
102static usb2_proc_callback_t ural_task;
103static usb2_proc_callback_t ural_scantask;
104static usb2_proc_callback_t ural_promisctask;
105static usb2_proc_callback_t ural_amrr_task;
106static usb2_proc_callback_t ural_init_task;
107static usb2_proc_callback_t ural_stop_task;
108
109static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
110			    const char name[IFNAMSIZ], int unit, int opmode,
111			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
112			    const uint8_t mac[IEEE80211_ADDR_LEN]);
113static void		ural_vap_delete(struct ieee80211vap *);
114static void		ural_tx_free(struct ural_tx_data *, int);
115static void		ural_setup_tx_list(struct ural_softc *);
116static void		ural_unsetup_tx_list(struct ural_softc *);
117static int		ural_newstate(struct ieee80211vap *,
118			    enum ieee80211_state, int);
119static void		ural_setup_tx_desc(struct ural_softc *,
120			    struct ural_tx_desc *, uint32_t, int, int);
121static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
122			    struct ieee80211_node *);
123static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
124			    struct ieee80211_node *);
125static int		ural_tx_data(struct ural_softc *, struct mbuf *,
126			    struct ieee80211_node *);
127static void		ural_start(struct ifnet *);
128static int		ural_ioctl(struct ifnet *, u_long, caddr_t);
129static void		ural_set_testmode(struct ural_softc *);
130static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
131			    int);
132static uint16_t		ural_read(struct ural_softc *, uint16_t);
133static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
134			    int);
135static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
136static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
137			    int) __unused;
138static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
139static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
140static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
141static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
142			    const uint8_t mac[IEEE80211_ADDR_LEN]);
143static void		ural_newassoc(struct ieee80211_node *, int);
144static void		ural_scan_start(struct ieee80211com *);
145static void		ural_scan_end(struct ieee80211com *);
146static void		ural_set_channel(struct ieee80211com *);
147static void		ural_set_chan(struct ural_softc *,
148			    struct ieee80211_channel *);
149static void		ural_disable_rf_tune(struct ural_softc *);
150static void		ural_enable_tsf_sync(struct ural_softc *);
151static void		ural_update_slot(struct ifnet *);
152static void		ural_set_txpreamble(struct ural_softc *);
153static void		ural_set_basicrates(struct ural_softc *,
154			    const struct ieee80211_channel *);
155static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
156static void		ural_set_macaddr(struct ural_softc *, uint8_t *);
157static const char	*ural_get_rf(int);
158static void		ural_read_eeprom(struct ural_softc *);
159static int		ural_bbp_init(struct ural_softc *);
160static void		ural_set_txantenna(struct ural_softc *, int);
161static void		ural_set_rxantenna(struct ural_softc *, int);
162static void		ural_init(void *);
163static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
164			    const struct ieee80211_bpf_params *);
165static void		ural_amrr_start(struct ural_softc *,
166			    struct ieee80211_node *);
167static void		ural_amrr_timeout(void *);
168static int		ural_pause(struct ural_softc *sc, int timeout);
169static void		ural_queue_command(struct ural_softc *,
170			    usb2_proc_callback_t *, struct usb2_proc_msg *,
171			    struct usb2_proc_msg *);
172
173/*
174 * Default values for MAC registers; values taken from the reference driver.
175 */
176static const struct {
177	uint16_t	reg;
178	uint16_t	val;
179} ural_def_mac[] = {
180	{ RAL_TXRX_CSR5,  0x8c8d },
181	{ RAL_TXRX_CSR6,  0x8b8a },
182	{ RAL_TXRX_CSR7,  0x8687 },
183	{ RAL_TXRX_CSR8,  0x0085 },
184	{ RAL_MAC_CSR13,  0x1111 },
185	{ RAL_MAC_CSR14,  0x1e11 },
186	{ RAL_TXRX_CSR21, 0xe78f },
187	{ RAL_MAC_CSR9,   0xff1d },
188	{ RAL_MAC_CSR11,  0x0002 },
189	{ RAL_MAC_CSR22,  0x0053 },
190	{ RAL_MAC_CSR15,  0x0000 },
191	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
192	{ RAL_TXRX_CSR19, 0x0000 },
193	{ RAL_TXRX_CSR18, 0x005a },
194	{ RAL_PHY_CSR2,   0x0000 },
195	{ RAL_TXRX_CSR0,  0x1ec0 },
196	{ RAL_PHY_CSR4,   0x000f }
197};
198
199/*
200 * Default values for BBP registers; values taken from the reference driver.
201 */
202static const struct {
203	uint8_t	reg;
204	uint8_t	val;
205} ural_def_bbp[] = {
206	{  3, 0x02 },
207	{  4, 0x19 },
208	{ 14, 0x1c },
209	{ 15, 0x30 },
210	{ 16, 0xac },
211	{ 17, 0x48 },
212	{ 18, 0x18 },
213	{ 19, 0xff },
214	{ 20, 0x1e },
215	{ 21, 0x08 },
216	{ 22, 0x08 },
217	{ 23, 0x08 },
218	{ 24, 0x80 },
219	{ 25, 0x50 },
220	{ 26, 0x08 },
221	{ 27, 0x23 },
222	{ 30, 0x10 },
223	{ 31, 0x2b },
224	{ 32, 0xb9 },
225	{ 34, 0x12 },
226	{ 35, 0x50 },
227	{ 39, 0xc4 },
228	{ 40, 0x02 },
229	{ 41, 0x60 },
230	{ 53, 0x10 },
231	{ 54, 0x18 },
232	{ 56, 0x08 },
233	{ 57, 0x10 },
234	{ 58, 0x08 },
235	{ 61, 0x60 },
236	{ 62, 0x10 },
237	{ 75, 0xff }
238};
239
240/*
241 * Default values for RF register R2 indexed by channel numbers.
242 */
243static const uint32_t ural_rf2522_r2[] = {
244	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
245	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
246};
247
248static const uint32_t ural_rf2523_r2[] = {
249	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
250	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
251};
252
253static const uint32_t ural_rf2524_r2[] = {
254	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
255	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
256};
257
258static const uint32_t ural_rf2525_r2[] = {
259	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
260	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
261};
262
263static const uint32_t ural_rf2525_hi_r2[] = {
264	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
265	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
266};
267
268static const uint32_t ural_rf2525e_r2[] = {
269	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
270	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
271};
272
273static const uint32_t ural_rf2526_hi_r2[] = {
274	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
275	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
276};
277
278static const uint32_t ural_rf2526_r2[] = {
279	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
280	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
281};
282
283/*
284 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
285 * values taken from the reference driver.
286 */
287static const struct {
288	uint8_t		chan;
289	uint32_t	r1;
290	uint32_t	r2;
291	uint32_t	r4;
292} ural_rf5222[] = {
293	{   1, 0x08808, 0x0044d, 0x00282 },
294	{   2, 0x08808, 0x0044e, 0x00282 },
295	{   3, 0x08808, 0x0044f, 0x00282 },
296	{   4, 0x08808, 0x00460, 0x00282 },
297	{   5, 0x08808, 0x00461, 0x00282 },
298	{   6, 0x08808, 0x00462, 0x00282 },
299	{   7, 0x08808, 0x00463, 0x00282 },
300	{   8, 0x08808, 0x00464, 0x00282 },
301	{   9, 0x08808, 0x00465, 0x00282 },
302	{  10, 0x08808, 0x00466, 0x00282 },
303	{  11, 0x08808, 0x00467, 0x00282 },
304	{  12, 0x08808, 0x00468, 0x00282 },
305	{  13, 0x08808, 0x00469, 0x00282 },
306	{  14, 0x08808, 0x0046b, 0x00286 },
307
308	{  36, 0x08804, 0x06225, 0x00287 },
309	{  40, 0x08804, 0x06226, 0x00287 },
310	{  44, 0x08804, 0x06227, 0x00287 },
311	{  48, 0x08804, 0x06228, 0x00287 },
312	{  52, 0x08804, 0x06229, 0x00287 },
313	{  56, 0x08804, 0x0622a, 0x00287 },
314	{  60, 0x08804, 0x0622b, 0x00287 },
315	{  64, 0x08804, 0x0622c, 0x00287 },
316
317	{ 100, 0x08804, 0x02200, 0x00283 },
318	{ 104, 0x08804, 0x02201, 0x00283 },
319	{ 108, 0x08804, 0x02202, 0x00283 },
320	{ 112, 0x08804, 0x02203, 0x00283 },
321	{ 116, 0x08804, 0x02204, 0x00283 },
322	{ 120, 0x08804, 0x02205, 0x00283 },
323	{ 124, 0x08804, 0x02206, 0x00283 },
324	{ 128, 0x08804, 0x02207, 0x00283 },
325	{ 132, 0x08804, 0x02208, 0x00283 },
326	{ 136, 0x08804, 0x02209, 0x00283 },
327	{ 140, 0x08804, 0x0220a, 0x00283 },
328
329	{ 149, 0x08808, 0x02429, 0x00281 },
330	{ 153, 0x08808, 0x0242b, 0x00281 },
331	{ 157, 0x08808, 0x0242d, 0x00281 },
332	{ 161, 0x08808, 0x0242f, 0x00281 }
333};
334
335static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
336	[URAL_BULK_WR] = {
337		.type = UE_BULK,
338		.endpoint = UE_ADDR_ANY,
339		.direction = UE_DIR_OUT,
340		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
341		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
342		.mh.callback = ural_bulk_write_callback,
343		.mh.timeout = 5000,	/* ms */
344	},
345	[URAL_BULK_RD] = {
346		.type = UE_BULK,
347		.endpoint = UE_ADDR_ANY,
348		.direction = UE_DIR_IN,
349		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
350		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
351		.mh.callback = ural_bulk_read_callback,
352	},
353};
354
355static device_probe_t ural_match;
356static device_attach_t ural_attach;
357static device_detach_t ural_detach;
358
359static device_method_t ural_methods[] = {
360	/* Device interface */
361	DEVMETHOD(device_probe,		ural_match),
362	DEVMETHOD(device_attach,	ural_attach),
363	DEVMETHOD(device_detach,	ural_detach),
364
365	{ 0, 0 }
366};
367
368static driver_t ural_driver = {
369	.name = "ural",
370	.methods = ural_methods,
371	.size = sizeof(struct ural_softc),
372};
373
374static devclass_t ural_devclass;
375
376DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
377MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
378MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
379MODULE_DEPEND(ural, wlan, 1, 1, 1);
380MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
381
382static int
383ural_match(device_t self)
384{
385	struct usb2_attach_arg *uaa = device_get_ivars(self);
386
387	if (uaa->usb2_mode != USB_MODE_HOST)
388		return (ENXIO);
389	if (uaa->info.bConfigIndex != 0)
390		return (ENXIO);
391	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
392		return (ENXIO);
393
394	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
395}
396
397static int
398ural_attach(device_t self)
399{
400	struct usb2_attach_arg *uaa = device_get_ivars(self);
401	struct ural_softc *sc = device_get_softc(self);
402	int error;
403	uint8_t iface_index;
404
405	device_set_usb2_desc(self);
406	sc->sc_udev = uaa->device;
407	sc->sc_dev = self;
408
409	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
410	    MTX_NETWORK_LOCK, MTX_DEF);
411
412	iface_index = RAL_IFACE_INDEX;
413	error = usb2_transfer_setup(uaa->device,
414	    &iface_index, sc->sc_xfer, ural_config,
415	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
416	if (error) {
417		device_printf(self, "could not allocate USB transfers, "
418		    "err=%s\n", usb2_errstr(error));
419		goto detach;
420	}
421	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
422	    device_get_nameunit(self), USB_PRI_MED);
423	if (error) {
424		device_printf(self, "could not setup config thread!\n");
425		goto detach;
426	}
427
428	/* fork rest of the attach code */
429	RAL_LOCK(sc);
430	ural_queue_command(sc, ural_attach_post,
431	    &sc->sc_synctask[0].hdr,
432	    &sc->sc_synctask[1].hdr);
433	RAL_UNLOCK(sc);
434	return (0);
435
436detach:
437	ural_detach(self);
438	return (ENXIO);			/* failure */
439}
440
441static void
442ural_attach_post(struct usb2_proc_msg *pm)
443{
444	struct ural_task *task = (struct ural_task *)pm;
445	struct ural_softc *sc = task->sc;
446	struct ifnet *ifp;
447	struct ieee80211com *ic;
448	uint8_t bands;
449
450	/* retrieve RT2570 rev. no */
451	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
452
453	/* retrieve MAC address and various other things from EEPROM */
454	ural_read_eeprom(sc);
455	RAL_UNLOCK(sc);
456
457	device_printf(sc->sc_dev, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
458	    sc->asic_rev, ural_get_rf(sc->rf_rev));
459
460	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
461	if (ifp == NULL) {
462		device_printf(sc->sc_dev, "can not if_alloc()\n");
463		RAL_LOCK(sc);
464		return;
465	}
466	ic = ifp->if_l2com;
467
468	ifp->if_softc = sc;
469	if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
470	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
471	ifp->if_init = ural_init;
472	ifp->if_ioctl = ural_ioctl;
473	ifp->if_start = ural_start;
474	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
475	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
476	IFQ_SET_READY(&ifp->if_snd);
477
478	ic->ic_ifp = ifp;
479	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
480	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_bssid);
481
482	/* set device capabilities */
483	ic->ic_caps =
484	      IEEE80211_C_STA		/* station mode supported */
485	    | IEEE80211_C_IBSS		/* IBSS mode supported */
486	    | IEEE80211_C_MONITOR	/* monitor mode supported */
487	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
488	    | IEEE80211_C_TXPMGT	/* tx power management */
489	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
490	    | IEEE80211_C_SHSLOT	/* short slot time supported */
491	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
492	    | IEEE80211_C_WPA		/* 802.11i */
493	    ;
494
495	bands = 0;
496	setbit(&bands, IEEE80211_MODE_11B);
497	setbit(&bands, IEEE80211_MODE_11G);
498	if (sc->rf_rev == RAL_RF_5222)
499		setbit(&bands, IEEE80211_MODE_11A);
500	ieee80211_init_channels(ic, NULL, &bands);
501
502	ieee80211_ifattach(ic);
503	ic->ic_newassoc = ural_newassoc;
504	ic->ic_raw_xmit = ural_raw_xmit;
505	ic->ic_node_alloc = ural_node_alloc;
506	ic->ic_scan_start = ural_scan_start;
507	ic->ic_scan_end = ural_scan_end;
508	ic->ic_set_channel = ural_set_channel;
509
510	ic->ic_vap_create = ural_vap_create;
511	ic->ic_vap_delete = ural_vap_delete;
512
513	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
514
515	bpfattach(ifp, DLT_IEEE802_11_RADIO,
516	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
517
518	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
519	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
520	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
521
522	sc->sc_txtap_len = sizeof sc->sc_txtap;
523	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
524	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
525
526	if (bootverbose)
527		ieee80211_announce(ic);
528
529	RAL_LOCK(sc);
530}
531
532static int
533ural_detach(device_t self)
534{
535	struct ural_softc *sc = device_get_softc(self);
536	struct ifnet *ifp = sc->sc_ifp;
537	struct ieee80211com *ic;
538
539	/* wait for any post attach or other command to complete */
540	usb2_proc_drain(&sc->sc_tq);
541
542	/* stop all USB transfers */
543	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
544	usb2_proc_free(&sc->sc_tq);
545
546	/* free TX list, if any */
547	RAL_LOCK(sc);
548	ural_unsetup_tx_list(sc);
549	RAL_UNLOCK(sc);
550
551	if (ifp) {
552		ic = ifp->if_l2com;
553		bpfdetach(ifp);
554		ieee80211_ifdetach(ic);
555		if_free(ifp);
556	}
557
558	mtx_destroy(&sc->sc_mtx);
559
560	return (0);
561}
562
563static struct ieee80211vap *
564ural_vap_create(struct ieee80211com *ic,
565	const char name[IFNAMSIZ], int unit, int opmode, int flags,
566	const uint8_t bssid[IEEE80211_ADDR_LEN],
567	const uint8_t mac[IEEE80211_ADDR_LEN])
568{
569	struct ural_softc *sc = ic->ic_ifp->if_softc;
570	struct ural_vap *uvp;
571	struct ieee80211vap *vap;
572
573	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
574		return NULL;
575	uvp = (struct ural_vap *) malloc(sizeof(struct ural_vap),
576	    M_80211_VAP, M_NOWAIT | M_ZERO);
577	if (uvp == NULL)
578		return NULL;
579	vap = &uvp->vap;
580	/* enable s/w bmiss handling for sta mode */
581	ieee80211_vap_setup(ic, vap, name, unit, opmode,
582	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
583
584	/* override state transition machine */
585	uvp->newstate = vap->iv_newstate;
586	vap->iv_newstate = ural_newstate;
587
588	uvp->sc = sc;
589	usb2_callout_init_mtx(&uvp->amrr_ch, &sc->sc_mtx, 0);
590	ieee80211_amrr_init(&uvp->amrr, vap,
591	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
592	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
593	    1000 /* 1 sec */);
594
595	/* complete setup */
596	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
597	ic->ic_opmode = opmode;
598	return vap;
599}
600
601static void
602ural_vap_delete(struct ieee80211vap *vap)
603{
604	struct ural_vap *uvp = URAL_VAP(vap);
605
606	usb2_callout_drain(&uvp->amrr_ch);
607	ieee80211_amrr_cleanup(&uvp->amrr);
608	ieee80211_vap_detach(vap);
609	free(uvp, M_80211_VAP);
610}
611
612static void
613ural_tx_free(struct ural_tx_data *data, int txerr)
614{
615	struct ural_softc *sc = data->sc;
616
617	if (data->m != NULL) {
618		if (data->m->m_flags & M_TXCB)
619			ieee80211_process_callback(data->ni, data->m,
620			    txerr ? ETIMEDOUT : 0);
621		m_freem(data->m);
622		data->m = NULL;
623
624		ieee80211_free_node(data->ni);
625		data->ni = NULL;
626	}
627	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
628	sc->tx_nfree++;
629}
630
631static void
632ural_setup_tx_list(struct ural_softc *sc)
633{
634	struct ural_tx_data *data;
635	int i;
636
637	sc->tx_nfree = 0;
638	STAILQ_INIT(&sc->tx_q);
639	STAILQ_INIT(&sc->tx_free);
640
641	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
642		data = &sc->tx_data[i];
643
644		data->sc = sc;
645		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
646		sc->tx_nfree++;
647	}
648}
649
650static void
651ural_unsetup_tx_list(struct ural_softc *sc)
652{
653	struct ural_tx_data *data;
654	int i;
655
656	/* make sure any subsequent use of the queues will fail */
657	sc->tx_nfree = 0;
658	STAILQ_INIT(&sc->tx_q);
659	STAILQ_INIT(&sc->tx_free);
660
661	/* free up all node references and mbufs */
662	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
663		data = &sc->tx_data[i];
664
665		if (data->m != NULL) {
666			m_freem(data->m);
667			data->m = NULL;
668		}
669		if (data->ni != NULL) {
670			ieee80211_free_node(data->ni);
671			data->ni = NULL;
672		}
673	}
674}
675
676static void
677ural_task(struct usb2_proc_msg *pm)
678{
679	struct ural_task *task = (struct ural_task *)pm;
680	struct ural_softc *sc = task->sc;
681	struct ifnet *ifp = sc->sc_ifp;
682	struct ieee80211com *ic = ifp->if_l2com;
683	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
684	struct ural_vap *uvp = URAL_VAP(vap);
685	const struct ieee80211_txparam *tp;
686	enum ieee80211_state ostate;
687	struct ieee80211_node *ni;
688	struct mbuf *m;
689
690	ostate = vap->iv_state;
691
692	switch (sc->sc_state) {
693	case IEEE80211_S_INIT:
694		if (ostate == IEEE80211_S_RUN) {
695			/* abort TSF synchronization */
696			ural_write(sc, RAL_TXRX_CSR19, 0);
697
698			/* force tx led to stop blinking */
699			ural_write(sc, RAL_MAC_CSR20, 0);
700		}
701		break;
702
703	case IEEE80211_S_RUN:
704		ni = vap->iv_bss;
705
706		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
707			ural_update_slot(ic->ic_ifp);
708			ural_set_txpreamble(sc);
709			ural_set_basicrates(sc, ic->ic_bsschan);
710			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
711			ural_set_bssid(sc, sc->sc_bssid);
712		}
713
714		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
715		    vap->iv_opmode == IEEE80211_M_IBSS) {
716			m = ieee80211_beacon_alloc(ni, &uvp->bo);
717			if (m == NULL) {
718				device_printf(sc->sc_dev,
719				    "could not allocate beacon\n");
720				return;
721			}
722
723			if (ural_tx_bcn(sc, m, ni) != 0) {
724				device_printf(sc->sc_dev,
725				    "could not send beacon\n");
726				return;
727			}
728		}
729
730		/* make tx led blink on tx (controlled by ASIC) */
731		ural_write(sc, RAL_MAC_CSR20, 1);
732
733		if (vap->iv_opmode != IEEE80211_M_MONITOR)
734			ural_enable_tsf_sync(sc);
735
736		/* enable automatic rate adaptation */
737		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
738		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
739			ural_amrr_start(sc, ni);
740
741		break;
742
743	default:
744		break;
745	}
746
747	RAL_UNLOCK(sc);
748	IEEE80211_LOCK(ic);
749	uvp->newstate(vap, sc->sc_state, sc->sc_arg);
750	if (vap->iv_newstate_cb != NULL)
751		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
752	IEEE80211_UNLOCK(ic);
753	RAL_LOCK(sc);
754}
755
756static void
757ural_scantask(struct usb2_proc_msg *pm)
758{
759	struct ural_task *task = (struct ural_task *)pm;
760	struct ural_softc *sc = task->sc;
761	struct ifnet *ifp = sc->sc_ifp;
762	struct ieee80211com *ic = ifp->if_l2com;
763
764	RAL_LOCK_ASSERT(sc, MA_OWNED);
765
766	switch (sc->sc_scan_action) {
767	case URAL_SCAN_START:
768		/* abort TSF synchronization */
769		DPRINTF("starting scan\n");
770		ural_write(sc, RAL_TXRX_CSR19, 0);
771		ural_set_bssid(sc, ifp->if_broadcastaddr);
772		break;
773
774	case URAL_SET_CHANNEL:
775		ural_set_chan(sc, ic->ic_curchan);
776		break;
777
778	default: /* URAL_SCAN_END */
779		DPRINTF("stopping scan\n");
780		ural_enable_tsf_sync(sc);
781		ural_set_bssid(sc, sc->sc_bssid);
782		break;
783	}
784}
785
786static int
787ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
788{
789	struct ural_vap *uvp = URAL_VAP(vap);
790	struct ieee80211com *ic = vap->iv_ic;
791	struct ural_softc *sc = ic->ic_ifp->if_softc;
792
793	DPRINTF("%s -> %s\n",
794		ieee80211_state_name[vap->iv_state],
795		ieee80211_state_name[nstate]);
796
797	RAL_LOCK(sc);
798	usb2_callout_stop(&uvp->amrr_ch);
799
800	/* do it in a process context */
801	sc->sc_state = nstate;
802	sc->sc_arg = arg;
803	RAL_UNLOCK(sc);
804
805	if (nstate == IEEE80211_S_INIT) {
806		uvp->newstate(vap, nstate, arg);
807		return 0;
808	} else {
809		RAL_LOCK(sc);
810		ural_queue_command(sc, ural_task, &sc->sc_task[0].hdr,
811		    &sc->sc_task[1].hdr);
812		RAL_UNLOCK(sc);
813		return EINPROGRESS;
814	}
815}
816
817
818static void
819ural_bulk_write_callback(struct usb2_xfer *xfer)
820{
821	struct ural_softc *sc = xfer->priv_sc;
822	struct ifnet *ifp = sc->sc_ifp;
823	struct ieee80211com *ic = ifp->if_l2com;
824	struct ieee80211_channel *c = ic->ic_curchan;
825	struct ural_tx_data *data;
826	struct mbuf *m;
827	unsigned int len;
828
829	switch (USB_GET_STATE(xfer)) {
830	case USB_ST_TRANSFERRED:
831		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
832
833		/* free resources */
834		data = xfer->priv_fifo;
835		ural_tx_free(data, 0);
836		xfer->priv_fifo = NULL;
837
838		ifp->if_opackets++;
839		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
840
841		/* FALLTHROUGH */
842	case USB_ST_SETUP:
843tr_setup:
844		data = STAILQ_FIRST(&sc->tx_q);
845		if (data) {
846			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
847			m = data->m;
848
849			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
850				DPRINTFN(0, "data overflow, %u bytes\n",
851				    m->m_pkthdr.len);
852				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
853			}
854			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
855			    RAL_TX_DESC_SIZE);
856			usb2_m_copy_in(xfer->frbuffers, RAL_TX_DESC_SIZE, m, 0,
857			    m->m_pkthdr.len);
858
859			if (bpf_peers_present(ifp->if_bpf)) {
860				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
861
862				tap->wt_flags = 0;
863				tap->wt_rate = data->rate;
864				tap->wt_chan_freq = htole16(c->ic_freq);
865				tap->wt_chan_flags = htole16(c->ic_flags);
866				tap->wt_antenna = sc->tx_ant;
867
868				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
869			}
870
871			/* xfer length needs to be a multiple of two! */
872			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
873			if ((len % 64) == 0)
874				len += 2;
875
876			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
877			    m->m_pkthdr.len, len);
878
879			xfer->frlengths[0] = len;
880			xfer->priv_fifo = data;
881
882			usb2_start_hardware(xfer);
883		}
884		break;
885
886	default:			/* Error */
887		DPRINTFN(11, "transfer error, %s\n",
888		    usb2_errstr(xfer->error));
889
890		ifp->if_oerrors++;
891		data = xfer->priv_fifo;
892		if (data != NULL) {
893			ural_tx_free(data, xfer->error);
894			xfer->priv_fifo = NULL;
895		}
896
897		if (xfer->error == USB_ERR_STALLED) {
898			/* try to clear stall first */
899			xfer->flags.stall_pipe = 1;
900			goto tr_setup;
901		}
902		if (xfer->error == USB_ERR_TIMEOUT)
903			device_printf(sc->sc_dev, "device timeout\n");
904		break;
905	}
906}
907
908static void
909ural_bulk_read_callback(struct usb2_xfer *xfer)
910{
911	struct ural_softc *sc = xfer->priv_sc;
912	struct ifnet *ifp = sc->sc_ifp;
913	struct ieee80211com *ic = ifp->if_l2com;
914	struct ieee80211_node *ni;
915	struct mbuf *m = NULL;
916	uint32_t flags;
917	uint8_t rssi = 0;
918	unsigned int len;
919
920	switch (USB_GET_STATE(xfer)) {
921	case USB_ST_TRANSFERRED:
922
923		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
924
925		len = xfer->actlen;
926		if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
927			DPRINTF("%s: xfer too short %d\n",
928			    device_get_nameunit(sc->sc_dev), len);
929			ifp->if_ierrors++;
930			goto tr_setup;
931		}
932
933		len -= RAL_RX_DESC_SIZE;
934		/* rx descriptor is located at the end */
935		usb2_copy_out(xfer->frbuffers, len, &sc->sc_rx_desc,
936		    RAL_RX_DESC_SIZE);
937
938		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
939		flags = le32toh(sc->sc_rx_desc.flags);
940		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
941			/*
942		         * This should not happen since we did not
943		         * request to receive those frames when we
944		         * filled RAL_TXRX_CSR2:
945		         */
946			DPRINTFN(5, "PHY or CRC error\n");
947			ifp->if_ierrors++;
948			goto tr_setup;
949		}
950
951		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
952		if (m == NULL) {
953			DPRINTF("could not allocate mbuf\n");
954			ifp->if_ierrors++;
955			goto tr_setup;
956		}
957		usb2_copy_out(xfer->frbuffers, 0, mtod(m, uint8_t *), len);
958
959		/* finalize mbuf */
960		m->m_pkthdr.rcvif = ifp;
961		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
962
963		if (bpf_peers_present(ifp->if_bpf)) {
964			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
965
966			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
967			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
968			    (flags & RAL_RX_OFDM) ?
969			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
970			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
971			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
972			tap->wr_antenna = sc->rx_ant;
973			tap->wr_antsignal = rssi;
974
975			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
976		}
977		/* Strip trailing 802.11 MAC FCS. */
978		m_adj(m, -IEEE80211_CRC_LEN);
979
980		/* FALLTHROUGH */
981	case USB_ST_SETUP:
982tr_setup:
983		xfer->frlengths[0] = xfer->max_data_length;
984		usb2_start_hardware(xfer);
985
986		/*
987		 * At the end of a USB callback it is always safe to unlock
988		 * the private mutex of a device! That is why we do the
989		 * "ieee80211_input" here, and not some lines up!
990		 */
991		if (m) {
992			RAL_UNLOCK(sc);
993			ni = ieee80211_find_rxnode(ic,
994			    mtod(m, struct ieee80211_frame_min *));
995			if (ni != NULL) {
996				(void) ieee80211_input(ni, m, rssi,
997				    RAL_NOISE_FLOOR, 0);
998				ieee80211_free_node(ni);
999			} else
1000				(void) ieee80211_input_all(ic, m, rssi,
1001				    RAL_NOISE_FLOOR, 0);
1002			RAL_LOCK(sc);
1003		}
1004		return;
1005
1006	default:			/* Error */
1007		if (xfer->error != USB_ERR_CANCELLED) {
1008			/* try to clear stall first */
1009			xfer->flags.stall_pipe = 1;
1010			goto tr_setup;
1011		}
1012		return;
1013	}
1014}
1015
1016static uint8_t
1017ural_plcp_signal(int rate)
1018{
1019	switch (rate) {
1020	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1021	case 12:	return 0xb;
1022	case 18:	return 0xf;
1023	case 24:	return 0xa;
1024	case 36:	return 0xe;
1025	case 48:	return 0x9;
1026	case 72:	return 0xd;
1027	case 96:	return 0x8;
1028	case 108:	return 0xc;
1029
1030	/* CCK rates (NB: not IEEE std, device-specific) */
1031	case 2:		return 0x0;
1032	case 4:		return 0x1;
1033	case 11:	return 0x2;
1034	case 22:	return 0x3;
1035	}
1036	return 0xff;		/* XXX unsupported/unknown rate */
1037}
1038
1039static void
1040ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
1041    uint32_t flags, int len, int rate)
1042{
1043	struct ifnet *ifp = sc->sc_ifp;
1044	struct ieee80211com *ic = ifp->if_l2com;
1045	uint16_t plcp_length;
1046	int remainder;
1047
1048	desc->flags = htole32(flags);
1049	desc->flags |= htole32(RAL_TX_NEWSEQ);
1050	desc->flags |= htole32(len << 16);
1051
1052	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
1053	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
1054
1055	/* setup PLCP fields */
1056	desc->plcp_signal  = ural_plcp_signal(rate);
1057	desc->plcp_service = 4;
1058
1059	len += IEEE80211_CRC_LEN;
1060	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1061		desc->flags |= htole32(RAL_TX_OFDM);
1062
1063		plcp_length = len & 0xfff;
1064		desc->plcp_length_hi = plcp_length >> 6;
1065		desc->plcp_length_lo = plcp_length & 0x3f;
1066	} else {
1067		plcp_length = (16 * len + rate - 1) / rate;
1068		if (rate == 22) {
1069			remainder = (16 * len) % 22;
1070			if (remainder != 0 && remainder < 7)
1071				desc->plcp_service |= RAL_PLCP_LENGEXT;
1072		}
1073		desc->plcp_length_hi = plcp_length >> 8;
1074		desc->plcp_length_lo = plcp_length & 0xff;
1075
1076		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1077			desc->plcp_signal |= 0x08;
1078	}
1079
1080	desc->iv = 0;
1081	desc->eiv = 0;
1082}
1083
1084#define RAL_TX_TIMEOUT	5000
1085
1086static int
1087ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1088{
1089	struct ieee80211vap *vap = ni->ni_vap;
1090	struct ieee80211com *ic = ni->ni_ic;
1091	struct ifnet *ifp = sc->sc_ifp;
1092	const struct ieee80211_txparam *tp;
1093	struct ural_tx_data *data;
1094
1095	if (sc->tx_nfree == 0) {
1096		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1097		m_freem(m0);
1098		ieee80211_free_node(ni);
1099		return EIO;
1100	}
1101	data = STAILQ_FIRST(&sc->tx_free);
1102	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1103	sc->tx_nfree--;
1104	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1105
1106	data->m = m0;
1107	data->ni = ni;
1108	data->rate = tp->mgmtrate;
1109
1110	ural_setup_tx_desc(sc, &data->desc,
1111	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1112	    tp->mgmtrate);
1113
1114	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1115	    m0->m_pkthdr.len, tp->mgmtrate);
1116
1117	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1118	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1119
1120	return (0);
1121}
1122
1123static int
1124ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1125{
1126	struct ieee80211vap *vap = ni->ni_vap;
1127	struct ieee80211com *ic = ni->ni_ic;
1128	const struct ieee80211_txparam *tp;
1129	struct ural_tx_data *data;
1130	struct ieee80211_frame *wh;
1131	struct ieee80211_key *k;
1132	uint32_t flags;
1133	uint16_t dur;
1134
1135	RAL_LOCK_ASSERT(sc, MA_OWNED);
1136
1137	data = STAILQ_FIRST(&sc->tx_free);
1138	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1139	sc->tx_nfree--;
1140
1141	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1142
1143	wh = mtod(m0, struct ieee80211_frame *);
1144	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1145		k = ieee80211_crypto_encap(ni, m0);
1146		if (k == NULL) {
1147			m_freem(m0);
1148			return ENOBUFS;
1149		}
1150		wh = mtod(m0, struct ieee80211_frame *);
1151	}
1152
1153	data->m = m0;
1154	data->ni = ni;
1155	data->rate = tp->mgmtrate;
1156
1157	flags = 0;
1158	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1159		flags |= RAL_TX_ACK;
1160
1161		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
1162		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1163		*(uint16_t *)wh->i_dur = htole16(dur);
1164
1165		/* tell hardware to add timestamp for probe responses */
1166		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1167		    IEEE80211_FC0_TYPE_MGT &&
1168		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1169		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1170			flags |= RAL_TX_TIMESTAMP;
1171	}
1172
1173	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1174
1175	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1176	    m0->m_pkthdr.len, tp->mgmtrate);
1177
1178	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1179	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1180
1181	return 0;
1182}
1183
1184static int
1185ural_sendprot(struct ural_softc *sc,
1186    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1187{
1188	struct ieee80211com *ic = ni->ni_ic;
1189	const struct ieee80211_frame *wh;
1190	struct ural_tx_data *data;
1191	struct mbuf *mprot;
1192	int protrate, ackrate, pktlen, flags, isshort;
1193	uint16_t dur;
1194
1195	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1196	    ("protection %d", prot));
1197
1198	wh = mtod(m, const struct ieee80211_frame *);
1199	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1200
1201	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1202	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1203
1204	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1205	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1206	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1207	flags = RAL_TX_RETRY(7);
1208	if (prot == IEEE80211_PROT_RTSCTS) {
1209		/* NB: CTS is the same size as an ACK */
1210		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1211		flags |= RAL_TX_ACK;
1212		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1213	} else {
1214		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1215	}
1216	if (mprot == NULL) {
1217		/* XXX stat + msg */
1218		return ENOBUFS;
1219	}
1220	data = STAILQ_FIRST(&sc->tx_free);
1221	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1222	sc->tx_nfree--;
1223
1224	data->m = mprot;
1225	data->ni = ieee80211_ref_node(ni);
1226	data->rate = protrate;
1227	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1228
1229	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1230	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1231
1232	return 0;
1233}
1234
1235static int
1236ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1237    const struct ieee80211_bpf_params *params)
1238{
1239	struct ural_tx_data *data;
1240	uint32_t flags;
1241	int error;
1242	int rate;
1243
1244	RAL_LOCK_ASSERT(sc, MA_OWNED);
1245	KASSERT(params != NULL, ("no raw xmit params"));
1246
1247	data = STAILQ_FIRST(&sc->tx_free);
1248	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1249	sc->tx_nfree--;
1250
1251	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1252	/* XXX validate */
1253	if (rate == 0) {
1254		m_freem(m0);
1255		return EINVAL;
1256	}
1257	flags = 0;
1258	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1259		flags |= RAL_TX_ACK;
1260	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1261		error = ural_sendprot(sc, m0, ni,
1262		    params->ibp_flags & IEEE80211_BPF_RTS ?
1263			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1264		    rate);
1265		if (error) {
1266			m_freem(m0);
1267			return error;
1268		}
1269		flags |= RAL_TX_IFS_SIFS;
1270	}
1271
1272	data->m = m0;
1273	data->ni = ni;
1274	data->rate = rate;
1275
1276	/* XXX need to setup descriptor ourself */
1277	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1278
1279	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1280	    m0->m_pkthdr.len, rate);
1281
1282	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1283	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1284
1285	return 0;
1286}
1287
1288static int
1289ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1290{
1291	struct ieee80211vap *vap = ni->ni_vap;
1292	struct ieee80211com *ic = ni->ni_ic;
1293	struct ural_tx_data *data;
1294	struct ieee80211_frame *wh;
1295	const struct ieee80211_txparam *tp;
1296	struct ieee80211_key *k;
1297	uint32_t flags = 0;
1298	uint16_t dur;
1299	int error, rate;
1300
1301	RAL_LOCK_ASSERT(sc, MA_OWNED);
1302
1303	wh = mtod(m0, struct ieee80211_frame *);
1304
1305	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1306	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1307		rate = tp->mcastrate;
1308	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1309		rate = tp->ucastrate;
1310	else
1311		rate = ni->ni_txrate;
1312
1313	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1314		k = ieee80211_crypto_encap(ni, m0);
1315		if (k == NULL) {
1316			m_freem(m0);
1317			return ENOBUFS;
1318		}
1319		/* packet header may have moved, reset our local pointer */
1320		wh = mtod(m0, struct ieee80211_frame *);
1321	}
1322
1323	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1324		int prot = IEEE80211_PROT_NONE;
1325		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1326			prot = IEEE80211_PROT_RTSCTS;
1327		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1328		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1329			prot = ic->ic_protmode;
1330		if (prot != IEEE80211_PROT_NONE) {
1331			error = ural_sendprot(sc, m0, ni, prot, rate);
1332			if (error) {
1333				m_freem(m0);
1334				return error;
1335			}
1336			flags |= RAL_TX_IFS_SIFS;
1337		}
1338	}
1339
1340	data = STAILQ_FIRST(&sc->tx_free);
1341	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1342	sc->tx_nfree--;
1343
1344	data->m = m0;
1345	data->ni = ni;
1346	data->rate = rate;
1347
1348	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1349		flags |= RAL_TX_ACK;
1350		flags |= RAL_TX_RETRY(7);
1351
1352		dur = ieee80211_ack_duration(sc->sc_rates, rate,
1353		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1354		*(uint16_t *)wh->i_dur = htole16(dur);
1355	}
1356
1357	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1358
1359	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1360	    m0->m_pkthdr.len, rate);
1361
1362	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1363	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1364
1365	return 0;
1366}
1367
1368static void
1369ural_start(struct ifnet *ifp)
1370{
1371	struct ural_softc *sc = ifp->if_softc;
1372	struct ieee80211_node *ni;
1373	struct mbuf *m;
1374
1375	RAL_LOCK(sc);
1376	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1377		RAL_UNLOCK(sc);
1378		return;
1379	}
1380	for (;;) {
1381		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1382		if (m == NULL)
1383			break;
1384		if (sc->tx_nfree == 0) {
1385			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1386			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1387			break;
1388		}
1389		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1390		m = ieee80211_encap(ni, m);
1391		if (m == NULL) {
1392			ieee80211_free_node(ni);
1393			continue;
1394		}
1395		if (ural_tx_data(sc, m, ni) != 0) {
1396			ieee80211_free_node(ni);
1397			ifp->if_oerrors++;
1398			break;
1399		}
1400	}
1401	RAL_UNLOCK(sc);
1402}
1403
1404static int
1405ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1406{
1407	struct ural_softc *sc = ifp->if_softc;
1408	struct ieee80211com *ic = ifp->if_l2com;
1409	struct ifreq *ifr = (struct ifreq *) data;
1410	int error = 0, startall = 0;
1411
1412	switch (cmd) {
1413	case SIOCSIFFLAGS:
1414		RAL_LOCK(sc);
1415		if (ifp->if_flags & IFF_UP) {
1416			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1417				ural_queue_command(sc, ural_init_task,
1418				    &sc->sc_synctask[0].hdr,
1419				    &sc->sc_synctask[1].hdr);
1420				startall = 1;
1421			} else
1422				ural_queue_command(sc, ural_promisctask,
1423				    &sc->sc_promisctask[0].hdr,
1424				    &sc->sc_promisctask[1].hdr);
1425		} else {
1426			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1427				ural_queue_command(sc, ural_stop_task,
1428				    &sc->sc_synctask[0].hdr,
1429				    &sc->sc_synctask[1].hdr);
1430			}
1431		}
1432		RAL_UNLOCK(sc);
1433		if (startall)
1434			ieee80211_start_all(ic);
1435		break;
1436	case SIOCGIFMEDIA:
1437	case SIOCSIFMEDIA:
1438		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1439		break;
1440	default:
1441		error = ether_ioctl(ifp, cmd, data);
1442		break;
1443	}
1444	return error;
1445}
1446
1447static void
1448ural_set_testmode(struct ural_softc *sc)
1449{
1450	struct usb2_device_request req;
1451	usb2_error_t error;
1452
1453	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1454	req.bRequest = RAL_VENDOR_REQUEST;
1455	USETW(req.wValue, 4);
1456	USETW(req.wIndex, 1);
1457	USETW(req.wLength, 0);
1458
1459	error = ural_do_request(sc, &req, NULL);
1460	if (error != 0) {
1461		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1462		    usb2_errstr(error));
1463	}
1464}
1465
1466static void
1467ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1468{
1469	struct usb2_device_request req;
1470	usb2_error_t error;
1471
1472	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1473	req.bRequest = RAL_READ_EEPROM;
1474	USETW(req.wValue, 0);
1475	USETW(req.wIndex, addr);
1476	USETW(req.wLength, len);
1477
1478	error = ural_do_request(sc, &req, buf);
1479	if (error != 0) {
1480		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1481		    usb2_errstr(error));
1482	}
1483}
1484
1485static uint16_t
1486ural_read(struct ural_softc *sc, uint16_t reg)
1487{
1488	struct usb2_device_request req;
1489	usb2_error_t error;
1490	uint16_t val;
1491
1492	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1493	req.bRequest = RAL_READ_MAC;
1494	USETW(req.wValue, 0);
1495	USETW(req.wIndex, reg);
1496	USETW(req.wLength, sizeof (uint16_t));
1497
1498	error = ural_do_request(sc, &req, &val);
1499	if (error != 0) {
1500		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1501		    usb2_errstr(error));
1502		return 0;
1503	}
1504
1505	return le16toh(val);
1506}
1507
1508static void
1509ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1510{
1511	struct usb2_device_request req;
1512	usb2_error_t error;
1513
1514	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1515	req.bRequest = RAL_READ_MULTI_MAC;
1516	USETW(req.wValue, 0);
1517	USETW(req.wIndex, reg);
1518	USETW(req.wLength, len);
1519
1520	error = ural_do_request(sc, &req, buf);
1521	if (error != 0) {
1522		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1523		    usb2_errstr(error));
1524	}
1525}
1526
1527static void
1528ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1529{
1530	struct usb2_device_request req;
1531	usb2_error_t error;
1532
1533	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1534	req.bRequest = RAL_WRITE_MAC;
1535	USETW(req.wValue, val);
1536	USETW(req.wIndex, reg);
1537	USETW(req.wLength, 0);
1538
1539	error = ural_do_request(sc, &req, NULL);
1540	if (error != 0) {
1541		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1542		    usb2_errstr(error));
1543	}
1544}
1545
1546static void
1547ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1548{
1549	struct usb2_device_request req;
1550	usb2_error_t error;
1551
1552	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1553	req.bRequest = RAL_WRITE_MULTI_MAC;
1554	USETW(req.wValue, 0);
1555	USETW(req.wIndex, reg);
1556	USETW(req.wLength, len);
1557
1558	error = ural_do_request(sc, &req, buf);
1559	if (error != 0) {
1560		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1561		    usb2_errstr(error));
1562	}
1563}
1564
1565static void
1566ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1567{
1568	uint16_t tmp;
1569	int ntries;
1570
1571	for (ntries = 0; ntries < 100; ntries++) {
1572		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1573			break;
1574		if (ural_pause(sc, hz / 100))
1575			break;
1576	}
1577	if (ntries == 100) {
1578		device_printf(sc->sc_dev, "could not write to BBP\n");
1579		return;
1580	}
1581
1582	tmp = reg << 8 | val;
1583	ural_write(sc, RAL_PHY_CSR7, tmp);
1584}
1585
1586static uint8_t
1587ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1588{
1589	uint16_t val;
1590	int ntries;
1591
1592	val = RAL_BBP_WRITE | reg << 8;
1593	ural_write(sc, RAL_PHY_CSR7, val);
1594
1595	for (ntries = 0; ntries < 100; ntries++) {
1596		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1597			break;
1598		if (ural_pause(sc, hz / 100))
1599			break;
1600	}
1601	if (ntries == 100) {
1602		device_printf(sc->sc_dev, "could not read BBP\n");
1603		return 0;
1604	}
1605
1606	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1607}
1608
1609static void
1610ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1611{
1612	uint32_t tmp;
1613	int ntries;
1614
1615	for (ntries = 0; ntries < 100; ntries++) {
1616		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1617			break;
1618		if (ural_pause(sc, hz / 100))
1619			break;
1620	}
1621	if (ntries == 100) {
1622		device_printf(sc->sc_dev, "could not write to RF\n");
1623		return;
1624	}
1625
1626	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1627	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1628	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1629
1630	/* remember last written value in sc */
1631	sc->rf_regs[reg] = val;
1632
1633	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1634}
1635
1636/* ARGUSED */
1637static struct ieee80211_node *
1638ural_node_alloc(struct ieee80211vap *vap __unused,
1639	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
1640{
1641	struct ural_node *un;
1642
1643	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1644	return un != NULL ? &un->ni : NULL;
1645}
1646
1647static void
1648ural_newassoc(struct ieee80211_node *ni, int isnew)
1649{
1650	struct ieee80211vap *vap = ni->ni_vap;
1651
1652	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
1653}
1654
1655static void
1656ural_scan_start(struct ieee80211com *ic)
1657{
1658	struct ural_softc *sc = ic->ic_ifp->if_softc;
1659
1660	RAL_LOCK(sc);
1661	/* do it in a process context */
1662	sc->sc_scan_action = URAL_SCAN_START;
1663	ural_queue_command(sc, ural_scantask,
1664	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1665	RAL_UNLOCK(sc);
1666
1667}
1668
1669static void
1670ural_scan_end(struct ieee80211com *ic)
1671{
1672	struct ural_softc *sc = ic->ic_ifp->if_softc;
1673
1674	RAL_LOCK(sc);
1675	/* do it in a process context */
1676	sc->sc_scan_action = URAL_SCAN_END;
1677	ural_queue_command(sc, ural_scantask,
1678	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1679	RAL_UNLOCK(sc);
1680
1681}
1682
1683static void
1684ural_set_channel(struct ieee80211com *ic)
1685{
1686	struct ural_softc *sc = ic->ic_ifp->if_softc;
1687
1688	RAL_LOCK(sc);
1689	/* do it in a process context */
1690	sc->sc_scan_action = URAL_SET_CHANNEL;
1691	ural_queue_command(sc, ural_scantask,
1692	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1693
1694	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1695	RAL_UNLOCK(sc);
1696}
1697
1698static void
1699ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1700{
1701	struct ifnet *ifp = sc->sc_ifp;
1702	struct ieee80211com *ic = ifp->if_l2com;
1703	uint8_t power, tmp;
1704	int i, chan;
1705
1706	chan = ieee80211_chan2ieee(ic, c);
1707	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1708		return;
1709
1710	if (IEEE80211_IS_CHAN_2GHZ(c))
1711		power = min(sc->txpow[chan - 1], 31);
1712	else
1713		power = 31;
1714
1715	/* adjust txpower using ifconfig settings */
1716	power -= (100 - ic->ic_txpowlimit) / 8;
1717
1718	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1719
1720	switch (sc->rf_rev) {
1721	case RAL_RF_2522:
1722		ural_rf_write(sc, RAL_RF1, 0x00814);
1723		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1724		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1725		break;
1726
1727	case RAL_RF_2523:
1728		ural_rf_write(sc, RAL_RF1, 0x08804);
1729		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1730		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1731		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1732		break;
1733
1734	case RAL_RF_2524:
1735		ural_rf_write(sc, RAL_RF1, 0x0c808);
1736		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1737		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1738		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1739		break;
1740
1741	case RAL_RF_2525:
1742		ural_rf_write(sc, RAL_RF1, 0x08808);
1743		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1744		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1745		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1746
1747		ural_rf_write(sc, RAL_RF1, 0x08808);
1748		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1749		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1750		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1751		break;
1752
1753	case RAL_RF_2525E:
1754		ural_rf_write(sc, RAL_RF1, 0x08808);
1755		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1756		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1757		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1758		break;
1759
1760	case RAL_RF_2526:
1761		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1762		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1763		ural_rf_write(sc, RAL_RF1, 0x08804);
1764
1765		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1766		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1767		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1768		break;
1769
1770	/* dual-band RF */
1771	case RAL_RF_5222:
1772		for (i = 0; ural_rf5222[i].chan != chan; i++);
1773
1774		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1775		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1776		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1777		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1778		break;
1779	}
1780
1781	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1782	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1783		/* set Japan filter bit for channel 14 */
1784		tmp = ural_bbp_read(sc, 70);
1785
1786		tmp &= ~RAL_JAPAN_FILTER;
1787		if (chan == 14)
1788			tmp |= RAL_JAPAN_FILTER;
1789
1790		ural_bbp_write(sc, 70, tmp);
1791
1792		/* clear CRC errors */
1793		ural_read(sc, RAL_STA_CSR0);
1794
1795		ural_pause(sc, hz / 100);
1796		ural_disable_rf_tune(sc);
1797	}
1798
1799	/* XXX doesn't belong here */
1800	/* update basic rate set */
1801	ural_set_basicrates(sc, c);
1802}
1803
1804/*
1805 * Disable RF auto-tuning.
1806 */
1807static void
1808ural_disable_rf_tune(struct ural_softc *sc)
1809{
1810	uint32_t tmp;
1811
1812	if (sc->rf_rev != RAL_RF_2523) {
1813		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1814		ural_rf_write(sc, RAL_RF1, tmp);
1815	}
1816
1817	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1818	ural_rf_write(sc, RAL_RF3, tmp);
1819
1820	DPRINTFN(2, "disabling RF autotune\n");
1821}
1822
1823/*
1824 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1825 * synchronization.
1826 */
1827static void
1828ural_enable_tsf_sync(struct ural_softc *sc)
1829{
1830	struct ifnet *ifp = sc->sc_ifp;
1831	struct ieee80211com *ic = ifp->if_l2com;
1832	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1833	uint16_t logcwmin, preload, tmp;
1834
1835	/* first, disable TSF synchronization */
1836	ural_write(sc, RAL_TXRX_CSR19, 0);
1837
1838	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1839	ural_write(sc, RAL_TXRX_CSR18, tmp);
1840
1841	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1842	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1843	tmp = logcwmin << 12 | preload;
1844	ural_write(sc, RAL_TXRX_CSR20, tmp);
1845
1846	/* finally, enable TSF synchronization */
1847	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1848	if (ic->ic_opmode == IEEE80211_M_STA)
1849		tmp |= RAL_ENABLE_TSF_SYNC(1);
1850	else
1851		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1852	ural_write(sc, RAL_TXRX_CSR19, tmp);
1853
1854	DPRINTF("enabling TSF synchronization\n");
1855}
1856
1857#define RAL_RXTX_TURNAROUND	5	/* us */
1858static void
1859ural_update_slot(struct ifnet *ifp)
1860{
1861	struct ural_softc *sc = ifp->if_softc;
1862	struct ieee80211com *ic = ifp->if_l2com;
1863	uint16_t slottime, sifs, eifs;
1864
1865	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1866
1867	/*
1868	 * These settings may sound a bit inconsistent but this is what the
1869	 * reference driver does.
1870	 */
1871	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1872		sifs = 16 - RAL_RXTX_TURNAROUND;
1873		eifs = 364;
1874	} else {
1875		sifs = 10 - RAL_RXTX_TURNAROUND;
1876		eifs = 64;
1877	}
1878
1879	ural_write(sc, RAL_MAC_CSR10, slottime);
1880	ural_write(sc, RAL_MAC_CSR11, sifs);
1881	ural_write(sc, RAL_MAC_CSR12, eifs);
1882}
1883
1884static void
1885ural_set_txpreamble(struct ural_softc *sc)
1886{
1887	struct ifnet *ifp = sc->sc_ifp;
1888	struct ieee80211com *ic = ifp->if_l2com;
1889	uint16_t tmp;
1890
1891	tmp = ural_read(sc, RAL_TXRX_CSR10);
1892
1893	tmp &= ~RAL_SHORT_PREAMBLE;
1894	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1895		tmp |= RAL_SHORT_PREAMBLE;
1896
1897	ural_write(sc, RAL_TXRX_CSR10, tmp);
1898}
1899
1900static void
1901ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1902{
1903	/* XXX wrong, take from rate set */
1904	/* update basic rate set */
1905	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1906		/* 11a basic rates: 6, 12, 24Mbps */
1907		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1908	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1909		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1910		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1911	} else {
1912		/* 11b basic rates: 1, 2Mbps */
1913		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1914	}
1915}
1916
1917static void
1918ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1919{
1920	uint16_t tmp;
1921
1922	tmp = bssid[0] | bssid[1] << 8;
1923	ural_write(sc, RAL_MAC_CSR5, tmp);
1924
1925	tmp = bssid[2] | bssid[3] << 8;
1926	ural_write(sc, RAL_MAC_CSR6, tmp);
1927
1928	tmp = bssid[4] | bssid[5] << 8;
1929	ural_write(sc, RAL_MAC_CSR7, tmp);
1930
1931	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1932}
1933
1934static void
1935ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1936{
1937	uint16_t tmp;
1938
1939	tmp = addr[0] | addr[1] << 8;
1940	ural_write(sc, RAL_MAC_CSR2, tmp);
1941
1942	tmp = addr[2] | addr[3] << 8;
1943	ural_write(sc, RAL_MAC_CSR3, tmp);
1944
1945	tmp = addr[4] | addr[5] << 8;
1946	ural_write(sc, RAL_MAC_CSR4, tmp);
1947
1948	DPRINTF("setting MAC address to %6D\n", addr, ":");
1949}
1950
1951static void
1952ural_promisctask(struct usb2_proc_msg *pm)
1953{
1954	struct ural_task *task = (struct ural_task *)pm;
1955	struct ural_softc *sc = task->sc;
1956	struct ifnet *ifp = sc->sc_ifp;
1957	uint32_t tmp;
1958
1959	tmp = ural_read(sc, RAL_TXRX_CSR2);
1960
1961	tmp &= ~RAL_DROP_NOT_TO_ME;
1962	if (!(ifp->if_flags & IFF_PROMISC))
1963		tmp |= RAL_DROP_NOT_TO_ME;
1964
1965	ural_write(sc, RAL_TXRX_CSR2, tmp);
1966
1967	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1968	    "entering" : "leaving");
1969}
1970
1971static const char *
1972ural_get_rf(int rev)
1973{
1974	switch (rev) {
1975	case RAL_RF_2522:	return "RT2522";
1976	case RAL_RF_2523:	return "RT2523";
1977	case RAL_RF_2524:	return "RT2524";
1978	case RAL_RF_2525:	return "RT2525";
1979	case RAL_RF_2525E:	return "RT2525e";
1980	case RAL_RF_2526:	return "RT2526";
1981	case RAL_RF_5222:	return "RT5222";
1982	default:		return "unknown";
1983	}
1984}
1985
1986static void
1987ural_read_eeprom(struct ural_softc *sc)
1988{
1989	uint16_t val;
1990
1991	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1992	val = le16toh(val);
1993	sc->rf_rev =   (val >> 11) & 0x7;
1994	sc->hw_radio = (val >> 10) & 0x1;
1995	sc->led_mode = (val >> 6)  & 0x7;
1996	sc->rx_ant =   (val >> 4)  & 0x3;
1997	sc->tx_ant =   (val >> 2)  & 0x3;
1998	sc->nb_ant =   val & 0x3;
1999
2000	/* read MAC address */
2001	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_bssid, 6);
2002
2003	/* read default values for BBP registers */
2004	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
2005
2006	/* read Tx power for all b/g channels */
2007	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
2008}
2009
2010static int
2011ural_bbp_init(struct ural_softc *sc)
2012{
2013#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2014	int i, ntries;
2015
2016	/* wait for BBP to be ready */
2017	for (ntries = 0; ntries < 100; ntries++) {
2018		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
2019			break;
2020		if (ural_pause(sc, hz / 100))
2021			break;
2022	}
2023	if (ntries == 100) {
2024		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2025		return EIO;
2026	}
2027
2028	/* initialize BBP registers to default values */
2029	for (i = 0; i < N(ural_def_bbp); i++)
2030		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
2031
2032#if 0
2033	/* initialize BBP registers to values stored in EEPROM */
2034	for (i = 0; i < 16; i++) {
2035		if (sc->bbp_prom[i].reg == 0xff)
2036			continue;
2037		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2038	}
2039#endif
2040
2041	return 0;
2042#undef N
2043}
2044
2045static void
2046ural_set_txantenna(struct ural_softc *sc, int antenna)
2047{
2048	uint16_t tmp;
2049	uint8_t tx;
2050
2051	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
2052	if (antenna == 1)
2053		tx |= RAL_BBP_ANTA;
2054	else if (antenna == 2)
2055		tx |= RAL_BBP_ANTB;
2056	else
2057		tx |= RAL_BBP_DIVERSITY;
2058
2059	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2060	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
2061	    sc->rf_rev == RAL_RF_5222)
2062		tx |= RAL_BBP_FLIPIQ;
2063
2064	ural_bbp_write(sc, RAL_BBP_TX, tx);
2065
2066	/* update values in PHY_CSR5 and PHY_CSR6 */
2067	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
2068	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2069
2070	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
2071	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2072}
2073
2074static void
2075ural_set_rxantenna(struct ural_softc *sc, int antenna)
2076{
2077	uint8_t rx;
2078
2079	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2080	if (antenna == 1)
2081		rx |= RAL_BBP_ANTA;
2082	else if (antenna == 2)
2083		rx |= RAL_BBP_ANTB;
2084	else
2085		rx |= RAL_BBP_DIVERSITY;
2086
2087	/* need to force no I/Q flip for RF 2525e and 2526 */
2088	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2089		rx &= ~RAL_BBP_FLIPIQ;
2090
2091	ural_bbp_write(sc, RAL_BBP_RX, rx);
2092}
2093
2094static void
2095ural_init_task(struct usb2_proc_msg *pm)
2096{
2097#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2098	struct ural_task *task = (struct ural_task *)pm;
2099	struct ural_softc *sc = task->sc;
2100	struct ifnet *ifp = sc->sc_ifp;
2101	struct ieee80211com *ic = ifp->if_l2com;
2102	uint16_t tmp;
2103	int i, ntries;
2104
2105	RAL_LOCK_ASSERT(sc, MA_OWNED);
2106
2107	ural_set_testmode(sc);
2108	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2109
2110	ural_stop_task(pm);
2111
2112	/* initialize MAC registers to default values */
2113	for (i = 0; i < N(ural_def_mac); i++)
2114		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2115
2116	/* wait for BBP and RF to wake up (this can take a long time!) */
2117	for (ntries = 0; ntries < 100; ntries++) {
2118		tmp = ural_read(sc, RAL_MAC_CSR17);
2119		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2120		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2121			break;
2122		if (ural_pause(sc, hz / 100))
2123			break;
2124	}
2125	if (ntries == 100) {
2126		device_printf(sc->sc_dev,
2127		    "timeout waiting for BBP/RF to wakeup\n");
2128		goto fail;
2129	}
2130
2131	/* we're ready! */
2132	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2133
2134	/* set basic rate set (will be updated later) */
2135	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2136
2137	if (ural_bbp_init(sc) != 0)
2138		goto fail;
2139
2140	ural_set_chan(sc, ic->ic_curchan);
2141
2142	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2143	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2144
2145	ural_set_txantenna(sc, sc->tx_ant);
2146	ural_set_rxantenna(sc, sc->rx_ant);
2147
2148	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2149	ural_set_macaddr(sc, ic->ic_myaddr);
2150
2151	/*
2152	 * Allocate Tx and Rx xfer queues.
2153	 */
2154	ural_setup_tx_list(sc);
2155
2156	/* kick Rx */
2157	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2158	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2159		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2160		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2161			tmp |= RAL_DROP_TODS;
2162		if (!(ifp->if_flags & IFF_PROMISC))
2163			tmp |= RAL_DROP_NOT_TO_ME;
2164	}
2165	ural_write(sc, RAL_TXRX_CSR2, tmp);
2166
2167	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2168	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2169	usb2_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2170	return;
2171
2172fail:	ural_stop_task(pm);
2173#undef N
2174}
2175
2176static void
2177ural_init(void *priv)
2178{
2179	struct ural_softc *sc = priv;
2180	struct ifnet *ifp = sc->sc_ifp;
2181	struct ieee80211com *ic = ifp->if_l2com;
2182
2183	RAL_LOCK(sc);
2184	ural_queue_command(sc, ural_init_task,
2185	    &sc->sc_synctask[0].hdr,
2186	    &sc->sc_synctask[1].hdr);
2187	RAL_UNLOCK(sc);
2188
2189	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2190		ieee80211_start_all(ic);		/* start all vap's */
2191}
2192
2193static void
2194ural_stop_task(struct usb2_proc_msg *pm)
2195{
2196	struct ural_task *task = (struct ural_task *)pm;
2197	struct ural_softc *sc = task->sc;
2198	struct ifnet *ifp = sc->sc_ifp;
2199
2200	RAL_LOCK_ASSERT(sc, MA_OWNED);
2201
2202	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2203
2204	/*
2205	 * Drain all the transfers, if not already drained:
2206	 */
2207	RAL_UNLOCK(sc);
2208	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_WR]);
2209	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_RD]);
2210	RAL_LOCK(sc);
2211
2212	ural_unsetup_tx_list(sc);
2213
2214	/* disable Rx */
2215	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2216	/* reset ASIC and BBP (but won't reset MAC registers!) */
2217	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2218	/* wait a little */
2219	ural_pause(sc, hz / 10);
2220	ural_write(sc, RAL_MAC_CSR1, 0);
2221}
2222
2223static int
2224ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2225	const struct ieee80211_bpf_params *params)
2226{
2227	struct ieee80211com *ic = ni->ni_ic;
2228	struct ifnet *ifp = ic->ic_ifp;
2229	struct ural_softc *sc = ifp->if_softc;
2230
2231	RAL_LOCK(sc);
2232	/* prevent management frames from being sent if we're not ready */
2233	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2234		RAL_UNLOCK(sc);
2235		m_freem(m);
2236		ieee80211_free_node(ni);
2237		return ENETDOWN;
2238	}
2239	if (sc->tx_nfree == 0) {
2240		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2241		RAL_UNLOCK(sc);
2242		m_freem(m);
2243		ieee80211_free_node(ni);
2244		return EIO;
2245	}
2246
2247	ifp->if_opackets++;
2248
2249	if (params == NULL) {
2250		/*
2251		 * Legacy path; interpret frame contents to decide
2252		 * precisely how to send the frame.
2253		 */
2254		if (ural_tx_mgt(sc, m, ni) != 0)
2255			goto bad;
2256	} else {
2257		/*
2258		 * Caller supplied explicit parameters to use in
2259		 * sending the frame.
2260		 */
2261		if (ural_tx_raw(sc, m, ni, params) != 0)
2262			goto bad;
2263	}
2264	RAL_UNLOCK(sc);
2265	return 0;
2266bad:
2267	ifp->if_oerrors++;
2268	RAL_UNLOCK(sc);
2269	ieee80211_free_node(ni);
2270	return EIO;		/* XXX */
2271}
2272
2273static void
2274ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
2275{
2276	struct ieee80211vap *vap = ni->ni_vap;
2277	struct ural_vap *uvp = URAL_VAP(vap);
2278
2279	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2280	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2281
2282	ieee80211_amrr_node_init(&uvp->amrr, &URAL_NODE(ni)->amn, ni);
2283
2284	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2285}
2286
2287static void
2288ural_amrr_timeout(void *arg)
2289{
2290	struct ural_vap *uvp = arg;
2291	struct ural_softc *sc = uvp->sc;
2292
2293	ural_queue_command(sc, ural_amrr_task,
2294	    &uvp->amrr_task[0].hdr, &uvp->amrr_task[1].hdr);
2295}
2296
2297static void
2298ural_amrr_task(struct usb2_proc_msg *pm)
2299{
2300	struct ural_task *task = (struct ural_task *)pm;
2301	struct ural_softc *sc = task->sc;
2302	struct ifnet *ifp = sc->sc_ifp;
2303	struct ieee80211com *ic = ifp->if_l2com;
2304	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2305	struct ural_vap *uvp = URAL_VAP(vap);
2306	struct ieee80211_node *ni = vap->iv_bss;
2307	int ok, fail;
2308
2309	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2310	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2311
2312	ok = sc->sta[7] +		/* TX ok w/o retry */
2313	     sc->sta[8];		/* TX ok w/ retry */
2314	fail = sc->sta[9];		/* TX retry-fail count */
2315
2316	ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2317	    ok+fail, ok, sc->sta[8] + fail);
2318	(void) ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn);
2319
2320	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2321
2322	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2323}
2324
2325static int
2326ural_pause(struct ural_softc *sc, int timeout)
2327{
2328	if (usb2_proc_is_gone(&sc->sc_tq))
2329		return (1);
2330
2331	usb2_pause_mtx(&sc->sc_mtx, timeout);
2332	return (0);
2333}
2334
2335static void
2336ural_queue_command(struct ural_softc *sc, usb2_proc_callback_t *fn,
2337    struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2338{
2339	struct ural_task *task;
2340
2341	RAL_LOCK_ASSERT(sc, MA_OWNED);
2342
2343	if (usb2_proc_is_gone(&sc->sc_tq)) {
2344		DPRINTF("proc is gone\n");
2345		return;         /* nothing to do */
2346	}
2347	/*
2348	 * NOTE: The task cannot get executed before we drop the
2349	 * "sc_mtx" mutex. It is safe to update fields in the message
2350	 * structure after that the message got queued.
2351	 */
2352	task = (struct ural_task *)
2353	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2354
2355	/* Setup callback and softc pointers */
2356	task->hdr.pm_callback = fn;
2357	task->sc = sc;
2358
2359	/*
2360	 * Init and stop must be synchronous!
2361	 */
2362	if ((fn == ural_init_task) || (fn == ural_stop_task))
2363		usb2_proc_mwait(&sc->sc_tq, t0, t1);
2364}
2365
2366