if_ural.c revision 201028
1/*	$FreeBSD: head/sys/dev/usb/wlan/if_ural.c 201028 2009-12-26 19:03:28Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@FreeBSD.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23#include <sys/cdefs.h>
24__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_ural.c 201028 2009-12-26 19:03:28Z thompsa $");
25
26/*-
27 * Ralink Technology RT2500USB chipset driver
28 * http://www.ralinktech.com/
29 */
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/lock.h>
35#include <sys/mutex.h>
36#include <sys/mbuf.h>
37#include <sys/kernel.h>
38#include <sys/socket.h>
39#include <sys/systm.h>
40#include <sys/malloc.h>
41#include <sys/module.h>
42#include <sys/bus.h>
43#include <sys/endian.h>
44#include <sys/kdb.h>
45
46#include <machine/bus.h>
47#include <machine/resource.h>
48#include <sys/rman.h>
49
50#include <net/bpf.h>
51#include <net/if.h>
52#include <net/if_arp.h>
53#include <net/ethernet.h>
54#include <net/if_dl.h>
55#include <net/if_media.h>
56#include <net/if_types.h>
57
58#ifdef INET
59#include <netinet/in.h>
60#include <netinet/in_systm.h>
61#include <netinet/in_var.h>
62#include <netinet/if_ether.h>
63#include <netinet/ip.h>
64#endif
65
66#include <net80211/ieee80211_var.h>
67#include <net80211/ieee80211_regdomain.h>
68#include <net80211/ieee80211_radiotap.h>
69#include <net80211/ieee80211_amrr.h>
70
71#include <dev/usb/usb.h>
72#include <dev/usb/usbdi.h>
73#include "usbdevs.h"
74
75#define	USB_DEBUG_VAR ural_debug
76#include <dev/usb/usb_debug.h>
77
78#include <dev/usb/wlan/if_uralreg.h>
79#include <dev/usb/wlan/if_uralvar.h>
80
81#if USB_DEBUG
82static int ural_debug = 0;
83
84SYSCTL_NODE(_hw_usb, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
85SYSCTL_INT(_hw_usb_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
86    "Debug level");
87#endif
88
89#define URAL_RSSI(rssi)					\
90	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
91	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
92
93/* various supported device vendors/products */
94static const struct usb_device_id ural_devs[] = {
95#define	URAL_DEV(v,p)  { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
96	URAL_DEV(ASUS, WL167G),
97	URAL_DEV(ASUS, RT2570),
98	URAL_DEV(BELKIN, F5D7050),
99	URAL_DEV(BELKIN, F5D7051),
100	URAL_DEV(CISCOLINKSYS, HU200TS),
101	URAL_DEV(CISCOLINKSYS, WUSB54G),
102	URAL_DEV(CISCOLINKSYS, WUSB54GP),
103	URAL_DEV(CONCEPTRONIC2, C54RU),
104	URAL_DEV(DLINK, DWLG122),
105	URAL_DEV(GIGABYTE, GN54G),
106	URAL_DEV(GIGABYTE, GNWBKG),
107	URAL_DEV(GUILLEMOT, HWGUSB254),
108	URAL_DEV(MELCO, KG54),
109	URAL_DEV(MELCO, KG54AI),
110	URAL_DEV(MELCO, KG54YB),
111	URAL_DEV(MELCO, NINWIFI),
112	URAL_DEV(MSI, RT2570),
113	URAL_DEV(MSI, RT2570_2),
114	URAL_DEV(MSI, RT2570_3),
115	URAL_DEV(NOVATECH, NV902),
116	URAL_DEV(RALINK, RT2570),
117	URAL_DEV(RALINK, RT2570_2),
118	URAL_DEV(RALINK, RT2570_3),
119	URAL_DEV(SIEMENS2, WL54G),
120	URAL_DEV(SMC, 2862WG),
121	URAL_DEV(SPHAIRON, UB801R),
122	URAL_DEV(SURECOM, RT2570),
123	URAL_DEV(VTECH, RT2570),
124	URAL_DEV(ZINWELL, RT2570),
125#undef URAL_DEV
126};
127
128static usb_callback_t ural_bulk_read_callback;
129static usb_callback_t ural_bulk_write_callback;
130
131static usb_error_t	ural_do_request(struct ural_softc *sc,
132			    struct usb_device_request *req, void *data);
133static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
134			    const char name[IFNAMSIZ], int unit, int opmode,
135			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
136			    const uint8_t mac[IEEE80211_ADDR_LEN]);
137static void		ural_vap_delete(struct ieee80211vap *);
138static void		ural_tx_free(struct ural_tx_data *, int);
139static void		ural_setup_tx_list(struct ural_softc *);
140static void		ural_unsetup_tx_list(struct ural_softc *);
141static int		ural_newstate(struct ieee80211vap *,
142			    enum ieee80211_state, int);
143static void		ural_setup_tx_desc(struct ural_softc *,
144			    struct ural_tx_desc *, uint32_t, int, int);
145static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
146			    struct ieee80211_node *);
147static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
148			    struct ieee80211_node *);
149static int		ural_tx_data(struct ural_softc *, struct mbuf *,
150			    struct ieee80211_node *);
151static void		ural_start(struct ifnet *);
152static int		ural_ioctl(struct ifnet *, u_long, caddr_t);
153static void		ural_set_testmode(struct ural_softc *);
154static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
155			    int);
156static uint16_t		ural_read(struct ural_softc *, uint16_t);
157static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
158			    int);
159static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
160static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
161			    int) __unused;
162static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
163static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
164static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
165static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
166			    const uint8_t mac[IEEE80211_ADDR_LEN]);
167static void		ural_newassoc(struct ieee80211_node *, int);
168static void		ural_scan_start(struct ieee80211com *);
169static void		ural_scan_end(struct ieee80211com *);
170static void		ural_set_channel(struct ieee80211com *);
171static void		ural_set_chan(struct ural_softc *,
172			    struct ieee80211_channel *);
173static void		ural_disable_rf_tune(struct ural_softc *);
174static void		ural_enable_tsf_sync(struct ural_softc *);
175static void 		ural_enable_tsf(struct ural_softc *);
176static void		ural_update_slot(struct ifnet *);
177static void		ural_set_txpreamble(struct ural_softc *);
178static void		ural_set_basicrates(struct ural_softc *,
179			    const struct ieee80211_channel *);
180static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
181static void		ural_set_macaddr(struct ural_softc *, uint8_t *);
182static void		ural_update_promisc(struct ifnet *);
183static void		ural_setpromisc(struct ural_softc *);
184static const char	*ural_get_rf(int);
185static void		ural_read_eeprom(struct ural_softc *);
186static int		ural_bbp_init(struct ural_softc *);
187static void		ural_set_txantenna(struct ural_softc *, int);
188static void		ural_set_rxantenna(struct ural_softc *, int);
189static void		ural_init_locked(struct ural_softc *);
190static void		ural_init(void *);
191static void		ural_stop(struct ural_softc *);
192static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
193			    const struct ieee80211_bpf_params *);
194static void		ural_amrr_start(struct ural_softc *,
195			    struct ieee80211_node *);
196static void		ural_amrr_timeout(void *);
197static void		ural_amrr_task(void *, int);
198static int		ural_pause(struct ural_softc *sc, int timeout);
199
200/*
201 * Default values for MAC registers; values taken from the reference driver.
202 */
203static const struct {
204	uint16_t	reg;
205	uint16_t	val;
206} ural_def_mac[] = {
207	{ RAL_TXRX_CSR5,  0x8c8d },
208	{ RAL_TXRX_CSR6,  0x8b8a },
209	{ RAL_TXRX_CSR7,  0x8687 },
210	{ RAL_TXRX_CSR8,  0x0085 },
211	{ RAL_MAC_CSR13,  0x1111 },
212	{ RAL_MAC_CSR14,  0x1e11 },
213	{ RAL_TXRX_CSR21, 0xe78f },
214	{ RAL_MAC_CSR9,   0xff1d },
215	{ RAL_MAC_CSR11,  0x0002 },
216	{ RAL_MAC_CSR22,  0x0053 },
217	{ RAL_MAC_CSR15,  0x0000 },
218	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
219	{ RAL_TXRX_CSR19, 0x0000 },
220	{ RAL_TXRX_CSR18, 0x005a },
221	{ RAL_PHY_CSR2,   0x0000 },
222	{ RAL_TXRX_CSR0,  0x1ec0 },
223	{ RAL_PHY_CSR4,   0x000f }
224};
225
226/*
227 * Default values for BBP registers; values taken from the reference driver.
228 */
229static const struct {
230	uint8_t	reg;
231	uint8_t	val;
232} ural_def_bbp[] = {
233	{  3, 0x02 },
234	{  4, 0x19 },
235	{ 14, 0x1c },
236	{ 15, 0x30 },
237	{ 16, 0xac },
238	{ 17, 0x48 },
239	{ 18, 0x18 },
240	{ 19, 0xff },
241	{ 20, 0x1e },
242	{ 21, 0x08 },
243	{ 22, 0x08 },
244	{ 23, 0x08 },
245	{ 24, 0x80 },
246	{ 25, 0x50 },
247	{ 26, 0x08 },
248	{ 27, 0x23 },
249	{ 30, 0x10 },
250	{ 31, 0x2b },
251	{ 32, 0xb9 },
252	{ 34, 0x12 },
253	{ 35, 0x50 },
254	{ 39, 0xc4 },
255	{ 40, 0x02 },
256	{ 41, 0x60 },
257	{ 53, 0x10 },
258	{ 54, 0x18 },
259	{ 56, 0x08 },
260	{ 57, 0x10 },
261	{ 58, 0x08 },
262	{ 61, 0x60 },
263	{ 62, 0x10 },
264	{ 75, 0xff }
265};
266
267/*
268 * Default values for RF register R2 indexed by channel numbers.
269 */
270static const uint32_t ural_rf2522_r2[] = {
271	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
272	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
273};
274
275static const uint32_t ural_rf2523_r2[] = {
276	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
277	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
278};
279
280static const uint32_t ural_rf2524_r2[] = {
281	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
282	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
283};
284
285static const uint32_t ural_rf2525_r2[] = {
286	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
287	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
288};
289
290static const uint32_t ural_rf2525_hi_r2[] = {
291	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
292	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
293};
294
295static const uint32_t ural_rf2525e_r2[] = {
296	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
297	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
298};
299
300static const uint32_t ural_rf2526_hi_r2[] = {
301	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
302	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
303};
304
305static const uint32_t ural_rf2526_r2[] = {
306	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
307	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
308};
309
310/*
311 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
312 * values taken from the reference driver.
313 */
314static const struct {
315	uint8_t		chan;
316	uint32_t	r1;
317	uint32_t	r2;
318	uint32_t	r4;
319} ural_rf5222[] = {
320	{   1, 0x08808, 0x0044d, 0x00282 },
321	{   2, 0x08808, 0x0044e, 0x00282 },
322	{   3, 0x08808, 0x0044f, 0x00282 },
323	{   4, 0x08808, 0x00460, 0x00282 },
324	{   5, 0x08808, 0x00461, 0x00282 },
325	{   6, 0x08808, 0x00462, 0x00282 },
326	{   7, 0x08808, 0x00463, 0x00282 },
327	{   8, 0x08808, 0x00464, 0x00282 },
328	{   9, 0x08808, 0x00465, 0x00282 },
329	{  10, 0x08808, 0x00466, 0x00282 },
330	{  11, 0x08808, 0x00467, 0x00282 },
331	{  12, 0x08808, 0x00468, 0x00282 },
332	{  13, 0x08808, 0x00469, 0x00282 },
333	{  14, 0x08808, 0x0046b, 0x00286 },
334
335	{  36, 0x08804, 0x06225, 0x00287 },
336	{  40, 0x08804, 0x06226, 0x00287 },
337	{  44, 0x08804, 0x06227, 0x00287 },
338	{  48, 0x08804, 0x06228, 0x00287 },
339	{  52, 0x08804, 0x06229, 0x00287 },
340	{  56, 0x08804, 0x0622a, 0x00287 },
341	{  60, 0x08804, 0x0622b, 0x00287 },
342	{  64, 0x08804, 0x0622c, 0x00287 },
343
344	{ 100, 0x08804, 0x02200, 0x00283 },
345	{ 104, 0x08804, 0x02201, 0x00283 },
346	{ 108, 0x08804, 0x02202, 0x00283 },
347	{ 112, 0x08804, 0x02203, 0x00283 },
348	{ 116, 0x08804, 0x02204, 0x00283 },
349	{ 120, 0x08804, 0x02205, 0x00283 },
350	{ 124, 0x08804, 0x02206, 0x00283 },
351	{ 128, 0x08804, 0x02207, 0x00283 },
352	{ 132, 0x08804, 0x02208, 0x00283 },
353	{ 136, 0x08804, 0x02209, 0x00283 },
354	{ 140, 0x08804, 0x0220a, 0x00283 },
355
356	{ 149, 0x08808, 0x02429, 0x00281 },
357	{ 153, 0x08808, 0x0242b, 0x00281 },
358	{ 157, 0x08808, 0x0242d, 0x00281 },
359	{ 161, 0x08808, 0x0242f, 0x00281 }
360};
361
362static const struct usb_config ural_config[URAL_N_TRANSFER] = {
363	[URAL_BULK_WR] = {
364		.type = UE_BULK,
365		.endpoint = UE_ADDR_ANY,
366		.direction = UE_DIR_OUT,
367		.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
368		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
369		.callback = ural_bulk_write_callback,
370		.timeout = 5000,	/* ms */
371	},
372	[URAL_BULK_RD] = {
373		.type = UE_BULK,
374		.endpoint = UE_ADDR_ANY,
375		.direction = UE_DIR_IN,
376		.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
377		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
378		.callback = ural_bulk_read_callback,
379	},
380};
381
382static device_probe_t ural_match;
383static device_attach_t ural_attach;
384static device_detach_t ural_detach;
385
386static device_method_t ural_methods[] = {
387	/* Device interface */
388	DEVMETHOD(device_probe,		ural_match),
389	DEVMETHOD(device_attach,	ural_attach),
390	DEVMETHOD(device_detach,	ural_detach),
391
392	{ 0, 0 }
393};
394
395static driver_t ural_driver = {
396	.name = "ural",
397	.methods = ural_methods,
398	.size = sizeof(struct ural_softc),
399};
400
401static devclass_t ural_devclass;
402
403DRIVER_MODULE(ural, uhub, ural_driver, ural_devclass, NULL, 0);
404MODULE_DEPEND(ural, usb, 1, 1, 1);
405MODULE_DEPEND(ural, wlan, 1, 1, 1);
406MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
407
408static int
409ural_match(device_t self)
410{
411	struct usb_attach_arg *uaa = device_get_ivars(self);
412
413	if (uaa->usb_mode != USB_MODE_HOST)
414		return (ENXIO);
415	if (uaa->info.bConfigIndex != 0)
416		return (ENXIO);
417	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
418		return (ENXIO);
419
420	return (usbd_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
421}
422
423static int
424ural_attach(device_t self)
425{
426	struct usb_attach_arg *uaa = device_get_ivars(self);
427	struct ural_softc *sc = device_get_softc(self);
428	struct ifnet *ifp;
429	struct ieee80211com *ic;
430	uint8_t iface_index, bands;
431	int error;
432
433	device_set_usb_desc(self);
434	sc->sc_udev = uaa->device;
435	sc->sc_dev = self;
436
437	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
438	    MTX_NETWORK_LOCK, MTX_DEF);
439
440	iface_index = RAL_IFACE_INDEX;
441	error = usbd_transfer_setup(uaa->device,
442	    &iface_index, sc->sc_xfer, ural_config,
443	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
444	if (error) {
445		device_printf(self, "could not allocate USB transfers, "
446		    "err=%s\n", usbd_errstr(error));
447		goto detach;
448	}
449
450	RAL_LOCK(sc);
451	/* retrieve RT2570 rev. no */
452	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
453
454	/* retrieve MAC address and various other things from EEPROM */
455	ural_read_eeprom(sc);
456	RAL_UNLOCK(sc);
457
458	device_printf(self, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
459	    sc->asic_rev, ural_get_rf(sc->rf_rev));
460
461	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
462	if (ifp == NULL) {
463		device_printf(sc->sc_dev, "can not if_alloc()\n");
464		goto detach;
465	}
466	ic = ifp->if_l2com;
467
468	ifp->if_softc = sc;
469	if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
470	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
471	ifp->if_init = ural_init;
472	ifp->if_ioctl = ural_ioctl;
473	ifp->if_start = ural_start;
474	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
475	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
476	IFQ_SET_READY(&ifp->if_snd);
477
478	ic->ic_ifp = ifp;
479	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
480
481	/* set device capabilities */
482	ic->ic_caps =
483	      IEEE80211_C_STA		/* station mode supported */
484	    | IEEE80211_C_IBSS		/* IBSS mode supported */
485	    | IEEE80211_C_MONITOR	/* monitor mode supported */
486	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
487	    | IEEE80211_C_TXPMGT	/* tx power management */
488	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
489	    | IEEE80211_C_SHSLOT	/* short slot time supported */
490	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
491	    | IEEE80211_C_WPA		/* 802.11i */
492	    ;
493
494	bands = 0;
495	setbit(&bands, IEEE80211_MODE_11B);
496	setbit(&bands, IEEE80211_MODE_11G);
497	if (sc->rf_rev == RAL_RF_5222)
498		setbit(&bands, IEEE80211_MODE_11A);
499	ieee80211_init_channels(ic, NULL, &bands);
500
501	ieee80211_ifattach(ic, sc->sc_bssid);
502	ic->ic_update_promisc = ural_update_promisc;
503	ic->ic_newassoc = ural_newassoc;
504	ic->ic_raw_xmit = ural_raw_xmit;
505	ic->ic_node_alloc = ural_node_alloc;
506	ic->ic_scan_start = ural_scan_start;
507	ic->ic_scan_end = ural_scan_end;
508	ic->ic_set_channel = ural_set_channel;
509
510	ic->ic_vap_create = ural_vap_create;
511	ic->ic_vap_delete = ural_vap_delete;
512
513	ieee80211_radiotap_attach(ic,
514	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
515		RAL_TX_RADIOTAP_PRESENT,
516	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
517		RAL_RX_RADIOTAP_PRESENT);
518
519	if (bootverbose)
520		ieee80211_announce(ic);
521
522	return (0);
523
524detach:
525	ural_detach(self);
526	return (ENXIO);			/* failure */
527}
528
529static int
530ural_detach(device_t self)
531{
532	struct ural_softc *sc = device_get_softc(self);
533	struct ifnet *ifp = sc->sc_ifp;
534	struct ieee80211com *ic;
535
536	/* stop all USB transfers */
537	usbd_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
538
539	/* free TX list, if any */
540	RAL_LOCK(sc);
541	ural_unsetup_tx_list(sc);
542	RAL_UNLOCK(sc);
543
544	if (ifp) {
545		ic = ifp->if_l2com;
546		ieee80211_ifdetach(ic);
547		if_free(ifp);
548	}
549	mtx_destroy(&sc->sc_mtx);
550
551	return (0);
552}
553
554static usb_error_t
555ural_do_request(struct ural_softc *sc,
556    struct usb_device_request *req, void *data)
557{
558	usb_error_t err;
559	int ntries = 10;
560
561	while (ntries--) {
562		err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
563		    req, data, 0, NULL, 250 /* ms */);
564		if (err == 0)
565			break;
566
567		DPRINTFN(1, "Control request failed, %s (retrying)\n",
568		    usbd_errstr(err));
569		if (ural_pause(sc, hz / 100))
570			break;
571	}
572	return (err);
573}
574
575static struct ieee80211vap *
576ural_vap_create(struct ieee80211com *ic,
577	const char name[IFNAMSIZ], int unit, int opmode, int flags,
578	const uint8_t bssid[IEEE80211_ADDR_LEN],
579	const uint8_t mac[IEEE80211_ADDR_LEN])
580{
581	struct ural_softc *sc = ic->ic_ifp->if_softc;
582	struct ural_vap *uvp;
583	struct ieee80211vap *vap;
584
585	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
586		return NULL;
587	uvp = (struct ural_vap *) malloc(sizeof(struct ural_vap),
588	    M_80211_VAP, M_NOWAIT | M_ZERO);
589	if (uvp == NULL)
590		return NULL;
591	vap = &uvp->vap;
592	/* enable s/w bmiss handling for sta mode */
593	ieee80211_vap_setup(ic, vap, name, unit, opmode,
594	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
595
596	/* override state transition machine */
597	uvp->newstate = vap->iv_newstate;
598	vap->iv_newstate = ural_newstate;
599
600	usb_callout_init_mtx(&uvp->amrr_ch, &sc->sc_mtx, 0);
601	TASK_INIT(&uvp->amrr_task, 0, ural_amrr_task, uvp);
602	ieee80211_amrr_init(&uvp->amrr, vap,
603	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
604	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
605	    1000 /* 1 sec */);
606
607	/* complete setup */
608	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
609	ic->ic_opmode = opmode;
610	return vap;
611}
612
613static void
614ural_vap_delete(struct ieee80211vap *vap)
615{
616	struct ural_vap *uvp = URAL_VAP(vap);
617	struct ieee80211com *ic = vap->iv_ic;
618
619	usb_callout_drain(&uvp->amrr_ch);
620	ieee80211_draintask(ic, &uvp->amrr_task);
621	ieee80211_amrr_cleanup(&uvp->amrr);
622	ieee80211_vap_detach(vap);
623	free(uvp, M_80211_VAP);
624}
625
626static void
627ural_tx_free(struct ural_tx_data *data, int txerr)
628{
629	struct ural_softc *sc = data->sc;
630
631	if (data->m != NULL) {
632		if (data->m->m_flags & M_TXCB)
633			ieee80211_process_callback(data->ni, data->m,
634			    txerr ? ETIMEDOUT : 0);
635		m_freem(data->m);
636		data->m = NULL;
637
638		ieee80211_free_node(data->ni);
639		data->ni = NULL;
640	}
641	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
642	sc->tx_nfree++;
643}
644
645static void
646ural_setup_tx_list(struct ural_softc *sc)
647{
648	struct ural_tx_data *data;
649	int i;
650
651	sc->tx_nfree = 0;
652	STAILQ_INIT(&sc->tx_q);
653	STAILQ_INIT(&sc->tx_free);
654
655	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
656		data = &sc->tx_data[i];
657
658		data->sc = sc;
659		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
660		sc->tx_nfree++;
661	}
662}
663
664static void
665ural_unsetup_tx_list(struct ural_softc *sc)
666{
667	struct ural_tx_data *data;
668	int i;
669
670	/* make sure any subsequent use of the queues will fail */
671	sc->tx_nfree = 0;
672	STAILQ_INIT(&sc->tx_q);
673	STAILQ_INIT(&sc->tx_free);
674
675	/* free up all node references and mbufs */
676	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
677		data = &sc->tx_data[i];
678
679		if (data->m != NULL) {
680			m_freem(data->m);
681			data->m = NULL;
682		}
683		if (data->ni != NULL) {
684			ieee80211_free_node(data->ni);
685			data->ni = NULL;
686		}
687	}
688}
689
690static int
691ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
692{
693	struct ural_vap *uvp = URAL_VAP(vap);
694	struct ieee80211com *ic = vap->iv_ic;
695	struct ural_softc *sc = ic->ic_ifp->if_softc;
696	const struct ieee80211_txparam *tp;
697	struct ieee80211_node *ni;
698	struct mbuf *m;
699
700	DPRINTF("%s -> %s\n",
701		ieee80211_state_name[vap->iv_state],
702		ieee80211_state_name[nstate]);
703
704	IEEE80211_UNLOCK(ic);
705	RAL_LOCK(sc);
706	usb_callout_stop(&uvp->amrr_ch);
707
708	switch (nstate) {
709	case IEEE80211_S_INIT:
710		if (vap->iv_state == IEEE80211_S_RUN) {
711			/* abort TSF synchronization */
712			ural_write(sc, RAL_TXRX_CSR19, 0);
713
714			/* force tx led to stop blinking */
715			ural_write(sc, RAL_MAC_CSR20, 0);
716		}
717		break;
718
719	case IEEE80211_S_RUN:
720		ni = vap->iv_bss;
721
722		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
723			ural_update_slot(ic->ic_ifp);
724			ural_set_txpreamble(sc);
725			ural_set_basicrates(sc, ic->ic_bsschan);
726			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
727			ural_set_bssid(sc, sc->sc_bssid);
728		}
729
730		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
731		    vap->iv_opmode == IEEE80211_M_IBSS) {
732			m = ieee80211_beacon_alloc(ni, &uvp->bo);
733			if (m == NULL) {
734				device_printf(sc->sc_dev,
735				    "could not allocate beacon\n");
736				RAL_UNLOCK(sc);
737				IEEE80211_LOCK(ic);
738				return (-1);
739			}
740			ieee80211_ref_node(ni);
741			if (ural_tx_bcn(sc, m, ni) != 0) {
742				device_printf(sc->sc_dev,
743				    "could not send beacon\n");
744				RAL_UNLOCK(sc);
745				IEEE80211_LOCK(ic);
746				return (-1);
747			}
748		}
749
750		/* make tx led blink on tx (controlled by ASIC) */
751		ural_write(sc, RAL_MAC_CSR20, 1);
752
753		if (vap->iv_opmode != IEEE80211_M_MONITOR)
754			ural_enable_tsf_sync(sc);
755		else
756			ural_enable_tsf(sc);
757
758		/* enable automatic rate adaptation */
759		/* XXX should use ic_bsschan but not valid until after newstate call below */
760		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
761		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
762			ural_amrr_start(sc, ni);
763
764		break;
765
766	default:
767		break;
768	}
769	RAL_UNLOCK(sc);
770	IEEE80211_LOCK(ic);
771	return (uvp->newstate(vap, nstate, arg));
772}
773
774
775static void
776ural_bulk_write_callback(struct usb_xfer *xfer, usb_error_t error)
777{
778	struct ural_softc *sc = usbd_xfer_softc(xfer);
779	struct ifnet *ifp = sc->sc_ifp;
780	struct ieee80211vap *vap;
781	struct ural_tx_data *data;
782	struct mbuf *m;
783	struct usb_page_cache *pc;
784	int len;
785
786	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
787
788	switch (USB_GET_STATE(xfer)) {
789	case USB_ST_TRANSFERRED:
790		DPRINTFN(11, "transfer complete, %d bytes\n", len);
791
792		/* free resources */
793		data = usbd_xfer_get_priv(xfer);
794		ural_tx_free(data, 0);
795		usbd_xfer_set_priv(xfer, NULL);
796
797		ifp->if_opackets++;
798		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
799
800		/* FALLTHROUGH */
801	case USB_ST_SETUP:
802tr_setup:
803		data = STAILQ_FIRST(&sc->tx_q);
804		if (data) {
805			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
806			m = data->m;
807
808			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
809				DPRINTFN(0, "data overflow, %u bytes\n",
810				    m->m_pkthdr.len);
811				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
812			}
813			pc = usbd_xfer_get_frame(xfer, 0);
814			usbd_copy_in(pc, 0, &data->desc, RAL_TX_DESC_SIZE);
815			usbd_m_copy_in(pc, RAL_TX_DESC_SIZE, m, 0,
816			    m->m_pkthdr.len);
817
818			vap = data->ni->ni_vap;
819			if (ieee80211_radiotap_active_vap(vap)) {
820				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
821
822				tap->wt_flags = 0;
823				tap->wt_rate = data->rate;
824				tap->wt_antenna = sc->tx_ant;
825
826				ieee80211_radiotap_tx(vap, m);
827			}
828
829			/* xfer length needs to be a multiple of two! */
830			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
831			if ((len % 64) == 0)
832				len += 2;
833
834			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
835			    m->m_pkthdr.len, len);
836
837			usbd_xfer_set_frame_len(xfer, 0, len);
838			usbd_xfer_set_priv(xfer, data);
839
840			usbd_transfer_submit(xfer);
841		}
842		RAL_UNLOCK(sc);
843		ural_start(ifp);
844		RAL_LOCK(sc);
845		break;
846
847	default:			/* Error */
848		DPRINTFN(11, "transfer error, %s\n",
849		    usbd_errstr(error));
850
851		ifp->if_oerrors++;
852		data = usbd_xfer_get_priv(xfer);
853		if (data != NULL) {
854			ural_tx_free(data, error);
855			usbd_xfer_set_priv(xfer, NULL);
856		}
857
858		if (error == USB_ERR_STALLED) {
859			/* try to clear stall first */
860			usbd_xfer_set_stall(xfer);
861			goto tr_setup;
862		}
863		if (error == USB_ERR_TIMEOUT)
864			device_printf(sc->sc_dev, "device timeout\n");
865		break;
866	}
867}
868
869static void
870ural_bulk_read_callback(struct usb_xfer *xfer, usb_error_t error)
871{
872	struct ural_softc *sc = usbd_xfer_softc(xfer);
873	struct ifnet *ifp = sc->sc_ifp;
874	struct ieee80211com *ic = ifp->if_l2com;
875	struct ieee80211_node *ni;
876	struct mbuf *m = NULL;
877	struct usb_page_cache *pc;
878	uint32_t flags;
879	int8_t rssi = 0, nf = 0;
880	int len;
881
882	usbd_xfer_status(xfer, &len, NULL, NULL, NULL);
883
884	switch (USB_GET_STATE(xfer)) {
885	case USB_ST_TRANSFERRED:
886
887		DPRINTFN(15, "rx done, actlen=%d\n", len);
888
889		if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
890			DPRINTF("%s: xfer too short %d\n",
891			    device_get_nameunit(sc->sc_dev), len);
892			ifp->if_ierrors++;
893			goto tr_setup;
894		}
895
896		len -= RAL_RX_DESC_SIZE;
897		/* rx descriptor is located at the end */
898		pc = usbd_xfer_get_frame(xfer, 0);
899		usbd_copy_out(pc, len, &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
900
901		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
902		nf = RAL_NOISE_FLOOR;
903		flags = le32toh(sc->sc_rx_desc.flags);
904		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
905			/*
906		         * This should not happen since we did not
907		         * request to receive those frames when we
908		         * filled RAL_TXRX_CSR2:
909		         */
910			DPRINTFN(5, "PHY or CRC error\n");
911			ifp->if_ierrors++;
912			goto tr_setup;
913		}
914
915		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
916		if (m == NULL) {
917			DPRINTF("could not allocate mbuf\n");
918			ifp->if_ierrors++;
919			goto tr_setup;
920		}
921		usbd_copy_out(pc, 0, mtod(m, uint8_t *), len);
922
923		/* finalize mbuf */
924		m->m_pkthdr.rcvif = ifp;
925		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
926
927		if (ieee80211_radiotap_active(ic)) {
928			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
929
930			/* XXX set once */
931			tap->wr_flags = 0;
932			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
933			    (flags & RAL_RX_OFDM) ?
934			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
935			tap->wr_antenna = sc->rx_ant;
936			tap->wr_antsignal = nf + rssi;
937			tap->wr_antnoise = nf;
938		}
939		/* Strip trailing 802.11 MAC FCS. */
940		m_adj(m, -IEEE80211_CRC_LEN);
941
942		/* FALLTHROUGH */
943	case USB_ST_SETUP:
944tr_setup:
945		usbd_xfer_set_frame_len(xfer, 0, usbd_xfer_max_len(xfer));
946		usbd_transfer_submit(xfer);
947
948		/*
949		 * At the end of a USB callback it is always safe to unlock
950		 * the private mutex of a device! That is why we do the
951		 * "ieee80211_input" here, and not some lines up!
952		 */
953		RAL_UNLOCK(sc);
954		if (m) {
955			ni = ieee80211_find_rxnode(ic,
956			    mtod(m, struct ieee80211_frame_min *));
957			if (ni != NULL) {
958				(void) ieee80211_input(ni, m, rssi, nf);
959				ieee80211_free_node(ni);
960			} else
961				(void) ieee80211_input_all(ic, m, rssi, nf);
962		}
963		if ((ifp->if_drv_flags & IFF_DRV_OACTIVE) == 0 &&
964		    !IFQ_IS_EMPTY(&ifp->if_snd))
965			ural_start(ifp);
966		RAL_LOCK(sc);
967		return;
968
969	default:			/* Error */
970		if (error != USB_ERR_CANCELLED) {
971			/* try to clear stall first */
972			usbd_xfer_set_stall(xfer);
973			goto tr_setup;
974		}
975		return;
976	}
977}
978
979static uint8_t
980ural_plcp_signal(int rate)
981{
982	switch (rate) {
983	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
984	case 12:	return 0xb;
985	case 18:	return 0xf;
986	case 24:	return 0xa;
987	case 36:	return 0xe;
988	case 48:	return 0x9;
989	case 72:	return 0xd;
990	case 96:	return 0x8;
991	case 108:	return 0xc;
992
993	/* CCK rates (NB: not IEEE std, device-specific) */
994	case 2:		return 0x0;
995	case 4:		return 0x1;
996	case 11:	return 0x2;
997	case 22:	return 0x3;
998	}
999	return 0xff;		/* XXX unsupported/unknown rate */
1000}
1001
1002static void
1003ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
1004    uint32_t flags, int len, int rate)
1005{
1006	struct ifnet *ifp = sc->sc_ifp;
1007	struct ieee80211com *ic = ifp->if_l2com;
1008	uint16_t plcp_length;
1009	int remainder;
1010
1011	desc->flags = htole32(flags);
1012	desc->flags |= htole32(RAL_TX_NEWSEQ);
1013	desc->flags |= htole32(len << 16);
1014
1015	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
1016	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
1017
1018	/* setup PLCP fields */
1019	desc->plcp_signal  = ural_plcp_signal(rate);
1020	desc->plcp_service = 4;
1021
1022	len += IEEE80211_CRC_LEN;
1023	if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM) {
1024		desc->flags |= htole32(RAL_TX_OFDM);
1025
1026		plcp_length = len & 0xfff;
1027		desc->plcp_length_hi = plcp_length >> 6;
1028		desc->plcp_length_lo = plcp_length & 0x3f;
1029	} else {
1030		plcp_length = (16 * len + rate - 1) / rate;
1031		if (rate == 22) {
1032			remainder = (16 * len) % 22;
1033			if (remainder != 0 && remainder < 7)
1034				desc->plcp_service |= RAL_PLCP_LENGEXT;
1035		}
1036		desc->plcp_length_hi = plcp_length >> 8;
1037		desc->plcp_length_lo = plcp_length & 0xff;
1038
1039		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1040			desc->plcp_signal |= 0x08;
1041	}
1042
1043	desc->iv = 0;
1044	desc->eiv = 0;
1045}
1046
1047#define RAL_TX_TIMEOUT	5000
1048
1049static int
1050ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1051{
1052	struct ieee80211vap *vap = ni->ni_vap;
1053	struct ieee80211com *ic = ni->ni_ic;
1054	struct ifnet *ifp = sc->sc_ifp;
1055	const struct ieee80211_txparam *tp;
1056	struct ural_tx_data *data;
1057
1058	if (sc->tx_nfree == 0) {
1059		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1060		m_freem(m0);
1061		ieee80211_free_node(ni);
1062		return EIO;
1063	}
1064	data = STAILQ_FIRST(&sc->tx_free);
1065	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1066	sc->tx_nfree--;
1067	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1068
1069	data->m = m0;
1070	data->ni = ni;
1071	data->rate = tp->mgmtrate;
1072
1073	ural_setup_tx_desc(sc, &data->desc,
1074	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1075	    tp->mgmtrate);
1076
1077	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1078	    m0->m_pkthdr.len, tp->mgmtrate);
1079
1080	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1081	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1082
1083	return (0);
1084}
1085
1086static int
1087ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1088{
1089	struct ieee80211vap *vap = ni->ni_vap;
1090	struct ieee80211com *ic = ni->ni_ic;
1091	const struct ieee80211_txparam *tp;
1092	struct ural_tx_data *data;
1093	struct ieee80211_frame *wh;
1094	struct ieee80211_key *k;
1095	uint32_t flags;
1096	uint16_t dur;
1097
1098	RAL_LOCK_ASSERT(sc, MA_OWNED);
1099
1100	data = STAILQ_FIRST(&sc->tx_free);
1101	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1102	sc->tx_nfree--;
1103
1104	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1105
1106	wh = mtod(m0, struct ieee80211_frame *);
1107	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1108		k = ieee80211_crypto_encap(ni, m0);
1109		if (k == NULL) {
1110			m_freem(m0);
1111			return ENOBUFS;
1112		}
1113		wh = mtod(m0, struct ieee80211_frame *);
1114	}
1115
1116	data->m = m0;
1117	data->ni = ni;
1118	data->rate = tp->mgmtrate;
1119
1120	flags = 0;
1121	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1122		flags |= RAL_TX_ACK;
1123
1124		dur = ieee80211_ack_duration(ic->ic_rt, tp->mgmtrate,
1125		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1126		*(uint16_t *)wh->i_dur = htole16(dur);
1127
1128		/* tell hardware to add timestamp for probe responses */
1129		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1130		    IEEE80211_FC0_TYPE_MGT &&
1131		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1132		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1133			flags |= RAL_TX_TIMESTAMP;
1134	}
1135
1136	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1137
1138	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1139	    m0->m_pkthdr.len, tp->mgmtrate);
1140
1141	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1142	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1143
1144	return 0;
1145}
1146
1147static int
1148ural_sendprot(struct ural_softc *sc,
1149    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1150{
1151	struct ieee80211com *ic = ni->ni_ic;
1152	const struct ieee80211_frame *wh;
1153	struct ural_tx_data *data;
1154	struct mbuf *mprot;
1155	int protrate, ackrate, pktlen, flags, isshort;
1156	uint16_t dur;
1157
1158	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1159	    ("protection %d", prot));
1160
1161	wh = mtod(m, const struct ieee80211_frame *);
1162	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1163
1164	protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
1165	ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
1166
1167	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1168	dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort);
1169	    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1170	flags = RAL_TX_RETRY(7);
1171	if (prot == IEEE80211_PROT_RTSCTS) {
1172		/* NB: CTS is the same size as an ACK */
1173		dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1174		flags |= RAL_TX_ACK;
1175		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1176	} else {
1177		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1178	}
1179	if (mprot == NULL) {
1180		/* XXX stat + msg */
1181		return ENOBUFS;
1182	}
1183	data = STAILQ_FIRST(&sc->tx_free);
1184	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1185	sc->tx_nfree--;
1186
1187	data->m = mprot;
1188	data->ni = ieee80211_ref_node(ni);
1189	data->rate = protrate;
1190	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1191
1192	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1193	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1194
1195	return 0;
1196}
1197
1198static int
1199ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1200    const struct ieee80211_bpf_params *params)
1201{
1202	struct ieee80211com *ic = ni->ni_ic;
1203	struct ural_tx_data *data;
1204	uint32_t flags;
1205	int error;
1206	int rate;
1207
1208	RAL_LOCK_ASSERT(sc, MA_OWNED);
1209	KASSERT(params != NULL, ("no raw xmit params"));
1210
1211	rate = params->ibp_rate0;
1212	if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
1213		m_freem(m0);
1214		return EINVAL;
1215	}
1216	flags = 0;
1217	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1218		flags |= RAL_TX_ACK;
1219	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1220		error = ural_sendprot(sc, m0, ni,
1221		    params->ibp_flags & IEEE80211_BPF_RTS ?
1222			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1223		    rate);
1224		if (error || sc->tx_nfree == 0) {
1225			m_freem(m0);
1226			return ENOBUFS;
1227		}
1228		flags |= RAL_TX_IFS_SIFS;
1229	}
1230
1231	data = STAILQ_FIRST(&sc->tx_free);
1232	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1233	sc->tx_nfree--;
1234
1235	data->m = m0;
1236	data->ni = ni;
1237	data->rate = rate;
1238
1239	/* XXX need to setup descriptor ourself */
1240	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1241
1242	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1243	    m0->m_pkthdr.len, rate);
1244
1245	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1246	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1247
1248	return 0;
1249}
1250
1251static int
1252ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1253{
1254	struct ieee80211vap *vap = ni->ni_vap;
1255	struct ieee80211com *ic = ni->ni_ic;
1256	struct ural_tx_data *data;
1257	struct ieee80211_frame *wh;
1258	const struct ieee80211_txparam *tp;
1259	struct ieee80211_key *k;
1260	uint32_t flags = 0;
1261	uint16_t dur;
1262	int error, rate;
1263
1264	RAL_LOCK_ASSERT(sc, MA_OWNED);
1265
1266	wh = mtod(m0, struct ieee80211_frame *);
1267
1268	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1269	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1270		rate = tp->mcastrate;
1271	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1272		rate = tp->ucastrate;
1273	else
1274		rate = ni->ni_txrate;
1275
1276	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1277		k = ieee80211_crypto_encap(ni, m0);
1278		if (k == NULL) {
1279			m_freem(m0);
1280			return ENOBUFS;
1281		}
1282		/* packet header may have moved, reset our local pointer */
1283		wh = mtod(m0, struct ieee80211_frame *);
1284	}
1285
1286	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1287		int prot = IEEE80211_PROT_NONE;
1288		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1289			prot = IEEE80211_PROT_RTSCTS;
1290		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1291		    ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM)
1292			prot = ic->ic_protmode;
1293		if (prot != IEEE80211_PROT_NONE) {
1294			error = ural_sendprot(sc, m0, ni, prot, rate);
1295			if (error || sc->tx_nfree == 0) {
1296				m_freem(m0);
1297				return ENOBUFS;
1298			}
1299			flags |= RAL_TX_IFS_SIFS;
1300		}
1301	}
1302
1303	data = STAILQ_FIRST(&sc->tx_free);
1304	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1305	sc->tx_nfree--;
1306
1307	data->m = m0;
1308	data->ni = ni;
1309	data->rate = rate;
1310
1311	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1312		flags |= RAL_TX_ACK;
1313		flags |= RAL_TX_RETRY(7);
1314
1315		dur = ieee80211_ack_duration(ic->ic_rt, rate,
1316		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1317		*(uint16_t *)wh->i_dur = htole16(dur);
1318	}
1319
1320	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1321
1322	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1323	    m0->m_pkthdr.len, rate);
1324
1325	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1326	usbd_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1327
1328	return 0;
1329}
1330
1331static void
1332ural_start(struct ifnet *ifp)
1333{
1334	struct ural_softc *sc = ifp->if_softc;
1335	struct ieee80211_node *ni;
1336	struct mbuf *m;
1337
1338	RAL_LOCK(sc);
1339	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1340		RAL_UNLOCK(sc);
1341		return;
1342	}
1343	for (;;) {
1344		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1345		if (m == NULL)
1346			break;
1347		if (sc->tx_nfree < RAL_TX_MINFREE) {
1348			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1349			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1350			break;
1351		}
1352		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1353		if (ural_tx_data(sc, m, ni) != 0) {
1354			ieee80211_free_node(ni);
1355			ifp->if_oerrors++;
1356			break;
1357		}
1358	}
1359	RAL_UNLOCK(sc);
1360}
1361
1362static int
1363ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1364{
1365	struct ural_softc *sc = ifp->if_softc;
1366	struct ieee80211com *ic = ifp->if_l2com;
1367	struct ifreq *ifr = (struct ifreq *) data;
1368	int error = 0, startall = 0;
1369
1370	switch (cmd) {
1371	case SIOCSIFFLAGS:
1372		RAL_LOCK(sc);
1373		if (ifp->if_flags & IFF_UP) {
1374			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1375				ural_init_locked(sc);
1376				startall = 1;
1377			} else
1378				ural_setpromisc(sc);
1379		} else {
1380			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1381				ural_stop(sc);
1382		}
1383		RAL_UNLOCK(sc);
1384		if (startall)
1385			ieee80211_start_all(ic);
1386		break;
1387	case SIOCGIFMEDIA:
1388	case SIOCSIFMEDIA:
1389		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1390		break;
1391	default:
1392		error = ether_ioctl(ifp, cmd, data);
1393		break;
1394	}
1395	return error;
1396}
1397
1398static void
1399ural_set_testmode(struct ural_softc *sc)
1400{
1401	struct usb_device_request req;
1402	usb_error_t error;
1403
1404	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1405	req.bRequest = RAL_VENDOR_REQUEST;
1406	USETW(req.wValue, 4);
1407	USETW(req.wIndex, 1);
1408	USETW(req.wLength, 0);
1409
1410	error = ural_do_request(sc, &req, NULL);
1411	if (error != 0) {
1412		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1413		    usbd_errstr(error));
1414	}
1415}
1416
1417static void
1418ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1419{
1420	struct usb_device_request req;
1421	usb_error_t error;
1422
1423	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1424	req.bRequest = RAL_READ_EEPROM;
1425	USETW(req.wValue, 0);
1426	USETW(req.wIndex, addr);
1427	USETW(req.wLength, len);
1428
1429	error = ural_do_request(sc, &req, buf);
1430	if (error != 0) {
1431		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1432		    usbd_errstr(error));
1433	}
1434}
1435
1436static uint16_t
1437ural_read(struct ural_softc *sc, uint16_t reg)
1438{
1439	struct usb_device_request req;
1440	usb_error_t error;
1441	uint16_t val;
1442
1443	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1444	req.bRequest = RAL_READ_MAC;
1445	USETW(req.wValue, 0);
1446	USETW(req.wIndex, reg);
1447	USETW(req.wLength, sizeof (uint16_t));
1448
1449	error = ural_do_request(sc, &req, &val);
1450	if (error != 0) {
1451		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1452		    usbd_errstr(error));
1453		return 0;
1454	}
1455
1456	return le16toh(val);
1457}
1458
1459static void
1460ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1461{
1462	struct usb_device_request req;
1463	usb_error_t error;
1464
1465	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1466	req.bRequest = RAL_READ_MULTI_MAC;
1467	USETW(req.wValue, 0);
1468	USETW(req.wIndex, reg);
1469	USETW(req.wLength, len);
1470
1471	error = ural_do_request(sc, &req, buf);
1472	if (error != 0) {
1473		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1474		    usbd_errstr(error));
1475	}
1476}
1477
1478static void
1479ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1480{
1481	struct usb_device_request req;
1482	usb_error_t error;
1483
1484	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1485	req.bRequest = RAL_WRITE_MAC;
1486	USETW(req.wValue, val);
1487	USETW(req.wIndex, reg);
1488	USETW(req.wLength, 0);
1489
1490	error = ural_do_request(sc, &req, NULL);
1491	if (error != 0) {
1492		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1493		    usbd_errstr(error));
1494	}
1495}
1496
1497static void
1498ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1499{
1500	struct usb_device_request req;
1501	usb_error_t error;
1502
1503	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1504	req.bRequest = RAL_WRITE_MULTI_MAC;
1505	USETW(req.wValue, 0);
1506	USETW(req.wIndex, reg);
1507	USETW(req.wLength, len);
1508
1509	error = ural_do_request(sc, &req, buf);
1510	if (error != 0) {
1511		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1512		    usbd_errstr(error));
1513	}
1514}
1515
1516static void
1517ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1518{
1519	uint16_t tmp;
1520	int ntries;
1521
1522	for (ntries = 0; ntries < 100; ntries++) {
1523		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1524			break;
1525		if (ural_pause(sc, hz / 100))
1526			break;
1527	}
1528	if (ntries == 100) {
1529		device_printf(sc->sc_dev, "could not write to BBP\n");
1530		return;
1531	}
1532
1533	tmp = reg << 8 | val;
1534	ural_write(sc, RAL_PHY_CSR7, tmp);
1535}
1536
1537static uint8_t
1538ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1539{
1540	uint16_t val;
1541	int ntries;
1542
1543	val = RAL_BBP_WRITE | reg << 8;
1544	ural_write(sc, RAL_PHY_CSR7, val);
1545
1546	for (ntries = 0; ntries < 100; ntries++) {
1547		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1548			break;
1549		if (ural_pause(sc, hz / 100))
1550			break;
1551	}
1552	if (ntries == 100) {
1553		device_printf(sc->sc_dev, "could not read BBP\n");
1554		return 0;
1555	}
1556
1557	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1558}
1559
1560static void
1561ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1562{
1563	uint32_t tmp;
1564	int ntries;
1565
1566	for (ntries = 0; ntries < 100; ntries++) {
1567		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1568			break;
1569		if (ural_pause(sc, hz / 100))
1570			break;
1571	}
1572	if (ntries == 100) {
1573		device_printf(sc->sc_dev, "could not write to RF\n");
1574		return;
1575	}
1576
1577	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1578	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1579	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1580
1581	/* remember last written value in sc */
1582	sc->rf_regs[reg] = val;
1583
1584	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1585}
1586
1587/* ARGUSED */
1588static struct ieee80211_node *
1589ural_node_alloc(struct ieee80211vap *vap __unused,
1590	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
1591{
1592	struct ural_node *un;
1593
1594	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1595	return un != NULL ? &un->ni : NULL;
1596}
1597
1598static void
1599ural_newassoc(struct ieee80211_node *ni, int isnew)
1600{
1601	struct ieee80211vap *vap = ni->ni_vap;
1602
1603	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
1604}
1605
1606static void
1607ural_scan_start(struct ieee80211com *ic)
1608{
1609	struct ifnet *ifp = ic->ic_ifp;
1610	struct ural_softc *sc = ifp->if_softc;
1611
1612	RAL_LOCK(sc);
1613	ural_write(sc, RAL_TXRX_CSR19, 0);
1614	ural_set_bssid(sc, ifp->if_broadcastaddr);
1615	RAL_UNLOCK(sc);
1616}
1617
1618static void
1619ural_scan_end(struct ieee80211com *ic)
1620{
1621	struct ural_softc *sc = ic->ic_ifp->if_softc;
1622
1623	RAL_LOCK(sc);
1624	ural_enable_tsf_sync(sc);
1625	ural_set_bssid(sc, sc->sc_bssid);
1626	RAL_UNLOCK(sc);
1627
1628}
1629
1630static void
1631ural_set_channel(struct ieee80211com *ic)
1632{
1633	struct ural_softc *sc = ic->ic_ifp->if_softc;
1634
1635	RAL_LOCK(sc);
1636	ural_set_chan(sc, ic->ic_curchan);
1637	RAL_UNLOCK(sc);
1638}
1639
1640static void
1641ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1642{
1643	struct ifnet *ifp = sc->sc_ifp;
1644	struct ieee80211com *ic = ifp->if_l2com;
1645	uint8_t power, tmp;
1646	int i, chan;
1647
1648	chan = ieee80211_chan2ieee(ic, c);
1649	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1650		return;
1651
1652	if (IEEE80211_IS_CHAN_2GHZ(c))
1653		power = min(sc->txpow[chan - 1], 31);
1654	else
1655		power = 31;
1656
1657	/* adjust txpower using ifconfig settings */
1658	power -= (100 - ic->ic_txpowlimit) / 8;
1659
1660	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1661
1662	switch (sc->rf_rev) {
1663	case RAL_RF_2522:
1664		ural_rf_write(sc, RAL_RF1, 0x00814);
1665		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1666		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1667		break;
1668
1669	case RAL_RF_2523:
1670		ural_rf_write(sc, RAL_RF1, 0x08804);
1671		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1672		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1673		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1674		break;
1675
1676	case RAL_RF_2524:
1677		ural_rf_write(sc, RAL_RF1, 0x0c808);
1678		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1679		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1680		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1681		break;
1682
1683	case RAL_RF_2525:
1684		ural_rf_write(sc, RAL_RF1, 0x08808);
1685		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1686		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1687		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1688
1689		ural_rf_write(sc, RAL_RF1, 0x08808);
1690		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1691		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1692		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1693		break;
1694
1695	case RAL_RF_2525E:
1696		ural_rf_write(sc, RAL_RF1, 0x08808);
1697		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1698		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1699		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1700		break;
1701
1702	case RAL_RF_2526:
1703		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1704		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1705		ural_rf_write(sc, RAL_RF1, 0x08804);
1706
1707		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1708		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1709		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1710		break;
1711
1712	/* dual-band RF */
1713	case RAL_RF_5222:
1714		for (i = 0; ural_rf5222[i].chan != chan; i++);
1715
1716		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1717		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1718		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1719		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1720		break;
1721	}
1722
1723	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1724	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1725		/* set Japan filter bit for channel 14 */
1726		tmp = ural_bbp_read(sc, 70);
1727
1728		tmp &= ~RAL_JAPAN_FILTER;
1729		if (chan == 14)
1730			tmp |= RAL_JAPAN_FILTER;
1731
1732		ural_bbp_write(sc, 70, tmp);
1733
1734		/* clear CRC errors */
1735		ural_read(sc, RAL_STA_CSR0);
1736
1737		ural_pause(sc, hz / 100);
1738		ural_disable_rf_tune(sc);
1739	}
1740
1741	/* XXX doesn't belong here */
1742	/* update basic rate set */
1743	ural_set_basicrates(sc, c);
1744
1745	/* give the hardware some time to do the switchover */
1746	ural_pause(sc, hz / 100);
1747}
1748
1749/*
1750 * Disable RF auto-tuning.
1751 */
1752static void
1753ural_disable_rf_tune(struct ural_softc *sc)
1754{
1755	uint32_t tmp;
1756
1757	if (sc->rf_rev != RAL_RF_2523) {
1758		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1759		ural_rf_write(sc, RAL_RF1, tmp);
1760	}
1761
1762	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1763	ural_rf_write(sc, RAL_RF3, tmp);
1764
1765	DPRINTFN(2, "disabling RF autotune\n");
1766}
1767
1768/*
1769 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1770 * synchronization.
1771 */
1772static void
1773ural_enable_tsf_sync(struct ural_softc *sc)
1774{
1775	struct ifnet *ifp = sc->sc_ifp;
1776	struct ieee80211com *ic = ifp->if_l2com;
1777	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1778	uint16_t logcwmin, preload, tmp;
1779
1780	/* first, disable TSF synchronization */
1781	ural_write(sc, RAL_TXRX_CSR19, 0);
1782
1783	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1784	ural_write(sc, RAL_TXRX_CSR18, tmp);
1785
1786	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1787	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1788	tmp = logcwmin << 12 | preload;
1789	ural_write(sc, RAL_TXRX_CSR20, tmp);
1790
1791	/* finally, enable TSF synchronization */
1792	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1793	if (ic->ic_opmode == IEEE80211_M_STA)
1794		tmp |= RAL_ENABLE_TSF_SYNC(1);
1795	else
1796		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1797	ural_write(sc, RAL_TXRX_CSR19, tmp);
1798
1799	DPRINTF("enabling TSF synchronization\n");
1800}
1801
1802static void
1803ural_enable_tsf(struct ural_softc *sc)
1804{
1805	/* first, disable TSF synchronization */
1806	ural_write(sc, RAL_TXRX_CSR19, 0);
1807	ural_write(sc, RAL_TXRX_CSR19, RAL_ENABLE_TSF | RAL_ENABLE_TSF_SYNC(2));
1808}
1809
1810#define RAL_RXTX_TURNAROUND	5	/* us */
1811static void
1812ural_update_slot(struct ifnet *ifp)
1813{
1814	struct ural_softc *sc = ifp->if_softc;
1815	struct ieee80211com *ic = ifp->if_l2com;
1816	uint16_t slottime, sifs, eifs;
1817
1818	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1819
1820	/*
1821	 * These settings may sound a bit inconsistent but this is what the
1822	 * reference driver does.
1823	 */
1824	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1825		sifs = 16 - RAL_RXTX_TURNAROUND;
1826		eifs = 364;
1827	} else {
1828		sifs = 10 - RAL_RXTX_TURNAROUND;
1829		eifs = 64;
1830	}
1831
1832	ural_write(sc, RAL_MAC_CSR10, slottime);
1833	ural_write(sc, RAL_MAC_CSR11, sifs);
1834	ural_write(sc, RAL_MAC_CSR12, eifs);
1835}
1836
1837static void
1838ural_set_txpreamble(struct ural_softc *sc)
1839{
1840	struct ifnet *ifp = sc->sc_ifp;
1841	struct ieee80211com *ic = ifp->if_l2com;
1842	uint16_t tmp;
1843
1844	tmp = ural_read(sc, RAL_TXRX_CSR10);
1845
1846	tmp &= ~RAL_SHORT_PREAMBLE;
1847	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1848		tmp |= RAL_SHORT_PREAMBLE;
1849
1850	ural_write(sc, RAL_TXRX_CSR10, tmp);
1851}
1852
1853static void
1854ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1855{
1856	/* XXX wrong, take from rate set */
1857	/* update basic rate set */
1858	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1859		/* 11a basic rates: 6, 12, 24Mbps */
1860		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1861	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1862		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1863		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1864	} else {
1865		/* 11b basic rates: 1, 2Mbps */
1866		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1867	}
1868}
1869
1870static void
1871ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1872{
1873	uint16_t tmp;
1874
1875	tmp = bssid[0] | bssid[1] << 8;
1876	ural_write(sc, RAL_MAC_CSR5, tmp);
1877
1878	tmp = bssid[2] | bssid[3] << 8;
1879	ural_write(sc, RAL_MAC_CSR6, tmp);
1880
1881	tmp = bssid[4] | bssid[5] << 8;
1882	ural_write(sc, RAL_MAC_CSR7, tmp);
1883
1884	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1885}
1886
1887static void
1888ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1889{
1890	uint16_t tmp;
1891
1892	tmp = addr[0] | addr[1] << 8;
1893	ural_write(sc, RAL_MAC_CSR2, tmp);
1894
1895	tmp = addr[2] | addr[3] << 8;
1896	ural_write(sc, RAL_MAC_CSR3, tmp);
1897
1898	tmp = addr[4] | addr[5] << 8;
1899	ural_write(sc, RAL_MAC_CSR4, tmp);
1900
1901	DPRINTF("setting MAC address to %6D\n", addr, ":");
1902}
1903
1904static void
1905ural_setpromisc(struct ural_softc *sc)
1906{
1907	struct ifnet *ifp = sc->sc_ifp;
1908	uint32_t tmp;
1909
1910	tmp = ural_read(sc, RAL_TXRX_CSR2);
1911
1912	tmp &= ~RAL_DROP_NOT_TO_ME;
1913	if (!(ifp->if_flags & IFF_PROMISC))
1914		tmp |= RAL_DROP_NOT_TO_ME;
1915
1916	ural_write(sc, RAL_TXRX_CSR2, tmp);
1917
1918	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1919	    "entering" : "leaving");
1920}
1921
1922static void
1923ural_update_promisc(struct ifnet *ifp)
1924{
1925	struct ural_softc *sc = ifp->if_softc;
1926
1927	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1928		return;
1929
1930	RAL_LOCK(sc);
1931	ural_setpromisc(sc);
1932	RAL_UNLOCK(sc);
1933}
1934
1935static const char *
1936ural_get_rf(int rev)
1937{
1938	switch (rev) {
1939	case RAL_RF_2522:	return "RT2522";
1940	case RAL_RF_2523:	return "RT2523";
1941	case RAL_RF_2524:	return "RT2524";
1942	case RAL_RF_2525:	return "RT2525";
1943	case RAL_RF_2525E:	return "RT2525e";
1944	case RAL_RF_2526:	return "RT2526";
1945	case RAL_RF_5222:	return "RT5222";
1946	default:		return "unknown";
1947	}
1948}
1949
1950static void
1951ural_read_eeprom(struct ural_softc *sc)
1952{
1953	uint16_t val;
1954
1955	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1956	val = le16toh(val);
1957	sc->rf_rev =   (val >> 11) & 0x7;
1958	sc->hw_radio = (val >> 10) & 0x1;
1959	sc->led_mode = (val >> 6)  & 0x7;
1960	sc->rx_ant =   (val >> 4)  & 0x3;
1961	sc->tx_ant =   (val >> 2)  & 0x3;
1962	sc->nb_ant =   val & 0x3;
1963
1964	/* read MAC address */
1965	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_bssid, 6);
1966
1967	/* read default values for BBP registers */
1968	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1969
1970	/* read Tx power for all b/g channels */
1971	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
1972}
1973
1974static int
1975ural_bbp_init(struct ural_softc *sc)
1976{
1977#define N(a)	(sizeof (a) / sizeof ((a)[0]))
1978	int i, ntries;
1979
1980	/* wait for BBP to be ready */
1981	for (ntries = 0; ntries < 100; ntries++) {
1982		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
1983			break;
1984		if (ural_pause(sc, hz / 100))
1985			break;
1986	}
1987	if (ntries == 100) {
1988		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
1989		return EIO;
1990	}
1991
1992	/* initialize BBP registers to default values */
1993	for (i = 0; i < N(ural_def_bbp); i++)
1994		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
1995
1996#if 0
1997	/* initialize BBP registers to values stored in EEPROM */
1998	for (i = 0; i < 16; i++) {
1999		if (sc->bbp_prom[i].reg == 0xff)
2000			continue;
2001		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2002	}
2003#endif
2004
2005	return 0;
2006#undef N
2007}
2008
2009static void
2010ural_set_txantenna(struct ural_softc *sc, int antenna)
2011{
2012	uint16_t tmp;
2013	uint8_t tx;
2014
2015	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
2016	if (antenna == 1)
2017		tx |= RAL_BBP_ANTA;
2018	else if (antenna == 2)
2019		tx |= RAL_BBP_ANTB;
2020	else
2021		tx |= RAL_BBP_DIVERSITY;
2022
2023	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2024	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
2025	    sc->rf_rev == RAL_RF_5222)
2026		tx |= RAL_BBP_FLIPIQ;
2027
2028	ural_bbp_write(sc, RAL_BBP_TX, tx);
2029
2030	/* update values in PHY_CSR5 and PHY_CSR6 */
2031	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
2032	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2033
2034	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
2035	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2036}
2037
2038static void
2039ural_set_rxantenna(struct ural_softc *sc, int antenna)
2040{
2041	uint8_t rx;
2042
2043	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2044	if (antenna == 1)
2045		rx |= RAL_BBP_ANTA;
2046	else if (antenna == 2)
2047		rx |= RAL_BBP_ANTB;
2048	else
2049		rx |= RAL_BBP_DIVERSITY;
2050
2051	/* need to force no I/Q flip for RF 2525e and 2526 */
2052	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2053		rx &= ~RAL_BBP_FLIPIQ;
2054
2055	ural_bbp_write(sc, RAL_BBP_RX, rx);
2056}
2057
2058static void
2059ural_init_locked(struct ural_softc *sc)
2060{
2061#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2062	struct ifnet *ifp = sc->sc_ifp;
2063	struct ieee80211com *ic = ifp->if_l2com;
2064	uint16_t tmp;
2065	int i, ntries;
2066
2067	RAL_LOCK_ASSERT(sc, MA_OWNED);
2068
2069	ural_set_testmode(sc);
2070	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2071
2072	ural_stop(sc);
2073
2074	/* initialize MAC registers to default values */
2075	for (i = 0; i < N(ural_def_mac); i++)
2076		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2077
2078	/* wait for BBP and RF to wake up (this can take a long time!) */
2079	for (ntries = 0; ntries < 100; ntries++) {
2080		tmp = ural_read(sc, RAL_MAC_CSR17);
2081		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2082		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2083			break;
2084		if (ural_pause(sc, hz / 100))
2085			break;
2086	}
2087	if (ntries == 100) {
2088		device_printf(sc->sc_dev,
2089		    "timeout waiting for BBP/RF to wakeup\n");
2090		goto fail;
2091	}
2092
2093	/* we're ready! */
2094	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2095
2096	/* set basic rate set (will be updated later) */
2097	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2098
2099	if (ural_bbp_init(sc) != 0)
2100		goto fail;
2101
2102	ural_set_chan(sc, ic->ic_curchan);
2103
2104	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2105	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2106
2107	ural_set_txantenna(sc, sc->tx_ant);
2108	ural_set_rxantenna(sc, sc->rx_ant);
2109
2110	ural_set_macaddr(sc, IF_LLADDR(ifp));
2111
2112	/*
2113	 * Allocate Tx and Rx xfer queues.
2114	 */
2115	ural_setup_tx_list(sc);
2116
2117	/* kick Rx */
2118	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2119	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2120		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2121		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2122			tmp |= RAL_DROP_TODS;
2123		if (!(ifp->if_flags & IFF_PROMISC))
2124			tmp |= RAL_DROP_NOT_TO_ME;
2125	}
2126	ural_write(sc, RAL_TXRX_CSR2, tmp);
2127
2128	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2129	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2130	usbd_xfer_set_stall(sc->sc_xfer[URAL_BULK_WR]);
2131	usbd_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2132	return;
2133
2134fail:	ural_stop(sc);
2135#undef N
2136}
2137
2138static void
2139ural_init(void *priv)
2140{
2141	struct ural_softc *sc = priv;
2142	struct ifnet *ifp = sc->sc_ifp;
2143	struct ieee80211com *ic = ifp->if_l2com;
2144
2145	RAL_LOCK(sc);
2146	ural_init_locked(sc);
2147	RAL_UNLOCK(sc);
2148
2149	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2150		ieee80211_start_all(ic);		/* start all vap's */
2151}
2152
2153static void
2154ural_stop(struct ural_softc *sc)
2155{
2156	struct ifnet *ifp = sc->sc_ifp;
2157
2158	RAL_LOCK_ASSERT(sc, MA_OWNED);
2159
2160	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2161
2162	/*
2163	 * Drain all the transfers, if not already drained:
2164	 */
2165	RAL_UNLOCK(sc);
2166	usbd_transfer_drain(sc->sc_xfer[URAL_BULK_WR]);
2167	usbd_transfer_drain(sc->sc_xfer[URAL_BULK_RD]);
2168	RAL_LOCK(sc);
2169
2170	ural_unsetup_tx_list(sc);
2171
2172	/* disable Rx */
2173	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2174	/* reset ASIC and BBP (but won't reset MAC registers!) */
2175	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2176	/* wait a little */
2177	ural_pause(sc, hz / 10);
2178	ural_write(sc, RAL_MAC_CSR1, 0);
2179	/* wait a little */
2180	ural_pause(sc, hz / 10);
2181}
2182
2183static int
2184ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2185	const struct ieee80211_bpf_params *params)
2186{
2187	struct ieee80211com *ic = ni->ni_ic;
2188	struct ifnet *ifp = ic->ic_ifp;
2189	struct ural_softc *sc = ifp->if_softc;
2190
2191	RAL_LOCK(sc);
2192	/* prevent management frames from being sent if we're not ready */
2193	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2194		RAL_UNLOCK(sc);
2195		m_freem(m);
2196		ieee80211_free_node(ni);
2197		return ENETDOWN;
2198	}
2199	if (sc->tx_nfree < RAL_TX_MINFREE) {
2200		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2201		RAL_UNLOCK(sc);
2202		m_freem(m);
2203		ieee80211_free_node(ni);
2204		return EIO;
2205	}
2206
2207	ifp->if_opackets++;
2208
2209	if (params == NULL) {
2210		/*
2211		 * Legacy path; interpret frame contents to decide
2212		 * precisely how to send the frame.
2213		 */
2214		if (ural_tx_mgt(sc, m, ni) != 0)
2215			goto bad;
2216	} else {
2217		/*
2218		 * Caller supplied explicit parameters to use in
2219		 * sending the frame.
2220		 */
2221		if (ural_tx_raw(sc, m, ni, params) != 0)
2222			goto bad;
2223	}
2224	RAL_UNLOCK(sc);
2225	return 0;
2226bad:
2227	ifp->if_oerrors++;
2228	RAL_UNLOCK(sc);
2229	ieee80211_free_node(ni);
2230	return EIO;		/* XXX */
2231}
2232
2233static void
2234ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
2235{
2236	struct ieee80211vap *vap = ni->ni_vap;
2237	struct ural_vap *uvp = URAL_VAP(vap);
2238
2239	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2240	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2241
2242	ieee80211_amrr_node_init(&uvp->amrr, &URAL_NODE(ni)->amn, ni);
2243
2244	usb_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2245}
2246
2247static void
2248ural_amrr_timeout(void *arg)
2249{
2250	struct ural_vap *uvp = arg;
2251	struct ieee80211vap *vap = &uvp->vap;
2252	struct ieee80211com *ic = vap->iv_ic;
2253
2254	ieee80211_runtask(ic, &uvp->amrr_task);
2255}
2256
2257static void
2258ural_amrr_task(void *arg, int pending)
2259{
2260	struct ural_vap *uvp = arg;
2261	struct ieee80211vap *vap = &uvp->vap;
2262	struct ieee80211com *ic = vap->iv_ic;
2263	struct ifnet *ifp = ic->ic_ifp;
2264	struct ural_softc *sc = ifp->if_softc;
2265	struct ieee80211_node *ni = vap->iv_bss;
2266	int ok, fail;
2267
2268	RAL_LOCK(sc);
2269	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2270	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2271
2272	ok = sc->sta[7] +		/* TX ok w/o retry */
2273	     sc->sta[8];		/* TX ok w/ retry */
2274	fail = sc->sta[9];		/* TX retry-fail count */
2275
2276	ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2277	    ok+fail, ok, sc->sta[8] + fail);
2278	(void) ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn);
2279
2280	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2281
2282	usb_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2283	RAL_UNLOCK(sc);
2284}
2285
2286static int
2287ural_pause(struct ural_softc *sc, int timeout)
2288{
2289
2290	usb_pause_mtx(&sc->sc_mtx, timeout);
2291	return (0);
2292}
2293