if_ural.c revision 188417
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 188417 2009-02-09 22:12:47Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23#include <sys/cdefs.h>
24__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 188417 2009-02-09 22:12:47Z thompsa $");
25
26/*-
27 * Ralink Technology RT2500USB chipset driver
28 * http://www.ralinktech.com/
29 */
30
31#include <dev/usb2/include/usb2_devid.h>
32#include <dev/usb2/include/usb2_standard.h>
33#include <dev/usb2/include/usb2_mfunc.h>
34#include <dev/usb2/include/usb2_error.h>
35
36#define	USB_DEBUG_VAR ural_debug
37
38#include <dev/usb2/core/usb2_core.h>
39#include <dev/usb2/core/usb2_lookup.h>
40#include <dev/usb2/core/usb2_process.h>
41#include <dev/usb2/core/usb2_debug.h>
42#include <dev/usb2/core/usb2_request.h>
43#include <dev/usb2/core/usb2_busdma.h>
44#include <dev/usb2/core/usb2_util.h>
45
46#include <dev/usb2/wlan/usb2_wlan.h>
47#include <dev/usb2/wlan/if_uralreg.h>
48#include <dev/usb2/wlan/if_uralvar.h>
49
50#if USB_DEBUG
51static int ural_debug = 0;
52
53SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
54SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
55    "Debug level");
56#endif
57
58#define	ural_do_request(sc,req,data) \
59    usb2_do_request_proc((sc)->sc_udev, &(sc)->sc_tq, req, data, 0, NULL, 5000)
60
61#define URAL_RSSI(rssi)					\
62	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
63	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
64
65/* various supported device vendors/products */
66static const struct usb2_device_id ural_devs[] = {
67	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G) },
68	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570) },
69	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050) },
70	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051) },
71	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS) },
72	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G) },
73	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP) },
74	{ USB_VP(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU) },
75	{ USB_VP(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122) },
76	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G) },
77	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG) },
78	{ USB_VP(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254) },
79	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54) },
80	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI) },
81	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB) },
82	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI) },
83	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570) },
84	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2) },
85	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3) },
86	{ USB_VP(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902) },
87	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570) },
88	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2) },
89	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3) },
90	{ USB_VP(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G) },
91	{ USB_VP(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG) },
92	{ USB_VP(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R) },
93	{ USB_VP(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570) },
94	{ USB_VP(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570) },
95	{ USB_VP(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570) },
96};
97
98static usb2_callback_t ural_bulk_read_callback;
99static usb2_callback_t ural_bulk_write_callback;
100
101static usb2_proc_callback_t ural_attach_post;
102static usb2_proc_callback_t ural_task;
103static usb2_proc_callback_t ural_scantask;
104static usb2_proc_callback_t ural_promisctask;
105static usb2_proc_callback_t ural_amrr_task;
106static usb2_proc_callback_t ural_init_task;
107static usb2_proc_callback_t ural_stop_task;
108
109static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
110			    const char name[IFNAMSIZ], int unit, int opmode,
111			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
112			    const uint8_t mac[IEEE80211_ADDR_LEN]);
113static void		ural_vap_delete(struct ieee80211vap *);
114static void		ural_tx_free(struct ural_tx_data *, int);
115static void		ural_setup_tx_list(struct ural_softc *);
116static void		ural_unsetup_tx_list(struct ural_softc *);
117static int		ural_newstate(struct ieee80211vap *,
118			    enum ieee80211_state, int);
119static void		ural_setup_tx_desc(struct ural_softc *,
120			    struct ural_tx_desc *, uint32_t, int, int);
121static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
122			    struct ieee80211_node *);
123static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
124			    struct ieee80211_node *);
125static int		ural_tx_data(struct ural_softc *, struct mbuf *,
126			    struct ieee80211_node *);
127static void		ural_start(struct ifnet *);
128static int		ural_ioctl(struct ifnet *, u_long, caddr_t);
129static void		ural_set_testmode(struct ural_softc *);
130static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
131			    int);
132static uint16_t		ural_read(struct ural_softc *, uint16_t);
133static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
134			    int);
135static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
136static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
137			    int) __unused;
138static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
139static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
140static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
141static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
142			    const uint8_t mac[IEEE80211_ADDR_LEN]);
143static void		ural_newassoc(struct ieee80211_node *, int);
144static void		ural_scan_start(struct ieee80211com *);
145static void		ural_scan_end(struct ieee80211com *);
146static void		ural_set_channel(struct ieee80211com *);
147static void		ural_set_chan(struct ural_softc *,
148			    struct ieee80211_channel *);
149static void		ural_disable_rf_tune(struct ural_softc *);
150static void		ural_enable_tsf_sync(struct ural_softc *);
151static void		ural_update_slot(struct ifnet *);
152static void		ural_set_txpreamble(struct ural_softc *);
153static void		ural_set_basicrates(struct ural_softc *,
154			    const struct ieee80211_channel *);
155static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
156static void		ural_set_macaddr(struct ural_softc *, uint8_t *);
157static const char	*ural_get_rf(int);
158static void		ural_read_eeprom(struct ural_softc *);
159static int		ural_bbp_init(struct ural_softc *);
160static void		ural_set_txantenna(struct ural_softc *, int);
161static void		ural_set_rxantenna(struct ural_softc *, int);
162static void		ural_init(void *);
163static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
164			    const struct ieee80211_bpf_params *);
165static void		ural_amrr_start(struct ural_softc *,
166			    struct ieee80211_node *);
167static void		ural_amrr_timeout(void *);
168static void		ural_queue_command(struct ural_softc *,
169			    usb2_proc_callback_t *, struct usb2_proc_msg *,
170			    struct usb2_proc_msg *);
171
172/*
173 * Default values for MAC registers; values taken from the reference driver.
174 */
175static const struct {
176	uint16_t	reg;
177	uint16_t	val;
178} ural_def_mac[] = {
179	{ RAL_TXRX_CSR5,  0x8c8d },
180	{ RAL_TXRX_CSR6,  0x8b8a },
181	{ RAL_TXRX_CSR7,  0x8687 },
182	{ RAL_TXRX_CSR8,  0x0085 },
183	{ RAL_MAC_CSR13,  0x1111 },
184	{ RAL_MAC_CSR14,  0x1e11 },
185	{ RAL_TXRX_CSR21, 0xe78f },
186	{ RAL_MAC_CSR9,   0xff1d },
187	{ RAL_MAC_CSR11,  0x0002 },
188	{ RAL_MAC_CSR22,  0x0053 },
189	{ RAL_MAC_CSR15,  0x0000 },
190	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
191	{ RAL_TXRX_CSR19, 0x0000 },
192	{ RAL_TXRX_CSR18, 0x005a },
193	{ RAL_PHY_CSR2,   0x0000 },
194	{ RAL_TXRX_CSR0,  0x1ec0 },
195	{ RAL_PHY_CSR4,   0x000f }
196};
197
198/*
199 * Default values for BBP registers; values taken from the reference driver.
200 */
201static const struct {
202	uint8_t	reg;
203	uint8_t	val;
204} ural_def_bbp[] = {
205	{  3, 0x02 },
206	{  4, 0x19 },
207	{ 14, 0x1c },
208	{ 15, 0x30 },
209	{ 16, 0xac },
210	{ 17, 0x48 },
211	{ 18, 0x18 },
212	{ 19, 0xff },
213	{ 20, 0x1e },
214	{ 21, 0x08 },
215	{ 22, 0x08 },
216	{ 23, 0x08 },
217	{ 24, 0x80 },
218	{ 25, 0x50 },
219	{ 26, 0x08 },
220	{ 27, 0x23 },
221	{ 30, 0x10 },
222	{ 31, 0x2b },
223	{ 32, 0xb9 },
224	{ 34, 0x12 },
225	{ 35, 0x50 },
226	{ 39, 0xc4 },
227	{ 40, 0x02 },
228	{ 41, 0x60 },
229	{ 53, 0x10 },
230	{ 54, 0x18 },
231	{ 56, 0x08 },
232	{ 57, 0x10 },
233	{ 58, 0x08 },
234	{ 61, 0x60 },
235	{ 62, 0x10 },
236	{ 75, 0xff }
237};
238
239/*
240 * Default values for RF register R2 indexed by channel numbers.
241 */
242static const uint32_t ural_rf2522_r2[] = {
243	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
244	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
245};
246
247static const uint32_t ural_rf2523_r2[] = {
248	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
249	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
250};
251
252static const uint32_t ural_rf2524_r2[] = {
253	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
254	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
255};
256
257static const uint32_t ural_rf2525_r2[] = {
258	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
259	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
260};
261
262static const uint32_t ural_rf2525_hi_r2[] = {
263	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
264	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
265};
266
267static const uint32_t ural_rf2525e_r2[] = {
268	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
269	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
270};
271
272static const uint32_t ural_rf2526_hi_r2[] = {
273	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
274	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
275};
276
277static const uint32_t ural_rf2526_r2[] = {
278	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
279	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
280};
281
282/*
283 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
284 * values taken from the reference driver.
285 */
286static const struct {
287	uint8_t		chan;
288	uint32_t	r1;
289	uint32_t	r2;
290	uint32_t	r4;
291} ural_rf5222[] = {
292	{   1, 0x08808, 0x0044d, 0x00282 },
293	{   2, 0x08808, 0x0044e, 0x00282 },
294	{   3, 0x08808, 0x0044f, 0x00282 },
295	{   4, 0x08808, 0x00460, 0x00282 },
296	{   5, 0x08808, 0x00461, 0x00282 },
297	{   6, 0x08808, 0x00462, 0x00282 },
298	{   7, 0x08808, 0x00463, 0x00282 },
299	{   8, 0x08808, 0x00464, 0x00282 },
300	{   9, 0x08808, 0x00465, 0x00282 },
301	{  10, 0x08808, 0x00466, 0x00282 },
302	{  11, 0x08808, 0x00467, 0x00282 },
303	{  12, 0x08808, 0x00468, 0x00282 },
304	{  13, 0x08808, 0x00469, 0x00282 },
305	{  14, 0x08808, 0x0046b, 0x00286 },
306
307	{  36, 0x08804, 0x06225, 0x00287 },
308	{  40, 0x08804, 0x06226, 0x00287 },
309	{  44, 0x08804, 0x06227, 0x00287 },
310	{  48, 0x08804, 0x06228, 0x00287 },
311	{  52, 0x08804, 0x06229, 0x00287 },
312	{  56, 0x08804, 0x0622a, 0x00287 },
313	{  60, 0x08804, 0x0622b, 0x00287 },
314	{  64, 0x08804, 0x0622c, 0x00287 },
315
316	{ 100, 0x08804, 0x02200, 0x00283 },
317	{ 104, 0x08804, 0x02201, 0x00283 },
318	{ 108, 0x08804, 0x02202, 0x00283 },
319	{ 112, 0x08804, 0x02203, 0x00283 },
320	{ 116, 0x08804, 0x02204, 0x00283 },
321	{ 120, 0x08804, 0x02205, 0x00283 },
322	{ 124, 0x08804, 0x02206, 0x00283 },
323	{ 128, 0x08804, 0x02207, 0x00283 },
324	{ 132, 0x08804, 0x02208, 0x00283 },
325	{ 136, 0x08804, 0x02209, 0x00283 },
326	{ 140, 0x08804, 0x0220a, 0x00283 },
327
328	{ 149, 0x08808, 0x02429, 0x00281 },
329	{ 153, 0x08808, 0x0242b, 0x00281 },
330	{ 157, 0x08808, 0x0242d, 0x00281 },
331	{ 161, 0x08808, 0x0242f, 0x00281 }
332};
333
334static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
335	[URAL_BULK_WR] = {
336		.type = UE_BULK,
337		.endpoint = UE_ADDR_ANY,
338		.direction = UE_DIR_OUT,
339		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
340		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
341		.mh.callback = ural_bulk_write_callback,
342		.mh.timeout = 5000,	/* ms */
343	},
344	[URAL_BULK_RD] = {
345		.type = UE_BULK,
346		.endpoint = UE_ADDR_ANY,
347		.direction = UE_DIR_IN,
348		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
349		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
350		.mh.callback = ural_bulk_read_callback,
351	},
352};
353
354static device_probe_t ural_match;
355static device_attach_t ural_attach;
356static device_detach_t ural_detach;
357
358static device_method_t ural_methods[] = {
359	/* Device interface */
360	DEVMETHOD(device_probe,		ural_match),
361	DEVMETHOD(device_attach,	ural_attach),
362	DEVMETHOD(device_detach,	ural_detach),
363
364	{ 0, 0 }
365};
366
367static driver_t ural_driver = {
368	.name = "ural",
369	.methods = ural_methods,
370	.size = sizeof(struct ural_softc),
371};
372
373static devclass_t ural_devclass;
374
375DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
376MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
377MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
378MODULE_DEPEND(ural, wlan, 1, 1, 1);
379MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
380
381static int
382ural_match(device_t self)
383{
384	struct usb2_attach_arg *uaa = device_get_ivars(self);
385
386	if (uaa->usb2_mode != USB_MODE_HOST)
387		return (ENXIO);
388	if (uaa->info.bConfigIndex != 0)
389		return (ENXIO);
390	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
391		return (ENXIO);
392
393	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
394}
395
396static int
397ural_attach(device_t self)
398{
399	struct usb2_attach_arg *uaa = device_get_ivars(self);
400	struct ural_softc *sc = device_get_softc(self);
401	int error;
402	uint8_t iface_index;
403
404	device_set_usb2_desc(self);
405	sc->sc_udev = uaa->device;
406	sc->sc_dev = self;
407
408	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
409	    MTX_NETWORK_LOCK, MTX_DEF);
410
411	iface_index = RAL_IFACE_INDEX;
412	error = usb2_transfer_setup(uaa->device,
413	    &iface_index, sc->sc_xfer, ural_config,
414	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
415	if (error) {
416		device_printf(self, "could not allocate USB transfers, "
417		    "err=%s\n", usb2_errstr(error));
418		goto detach;
419	}
420	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
421	    device_get_nameunit(self), USB_PRI_MED);
422	if (error) {
423		device_printf(self, "could not setup config thread!\n");
424		goto detach;
425	}
426
427	/* fork rest of the attach code */
428	RAL_LOCK(sc);
429	ural_queue_command(sc, ural_attach_post,
430	    &sc->sc_synctask[0].hdr,
431	    &sc->sc_synctask[1].hdr);
432	RAL_UNLOCK(sc);
433	return (0);
434
435detach:
436	ural_detach(self);
437	return (ENXIO);			/* failure */
438}
439
440static void
441ural_attach_post(struct usb2_proc_msg *pm)
442{
443	struct ural_task *task = (struct ural_task *)pm;
444	struct ural_softc *sc = task->sc;
445	struct ifnet *ifp;
446	struct ieee80211com *ic;
447	uint8_t bands;
448
449	/* retrieve RT2570 rev. no */
450	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
451
452	/* retrieve MAC address and various other things from EEPROM */
453	ural_read_eeprom(sc);
454	RAL_UNLOCK(sc);
455
456	device_printf(sc->sc_dev, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
457	    sc->asic_rev, ural_get_rf(sc->rf_rev));
458
459	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
460	if (ifp == NULL) {
461		device_printf(sc->sc_dev, "can not if_alloc()\n");
462		RAL_LOCK(sc);
463		return;
464	}
465	ic = ifp->if_l2com;
466
467	ifp->if_softc = sc;
468	if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
469	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
470	ifp->if_init = ural_init;
471	ifp->if_ioctl = ural_ioctl;
472	ifp->if_start = ural_start;
473	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
474	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
475	IFQ_SET_READY(&ifp->if_snd);
476
477	ic->ic_ifp = ifp;
478	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
479	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_bssid);
480
481	/* set device capabilities */
482	ic->ic_caps =
483	      IEEE80211_C_STA		/* station mode supported */
484	    | IEEE80211_C_IBSS		/* IBSS mode supported */
485	    | IEEE80211_C_MONITOR	/* monitor mode supported */
486	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
487	    | IEEE80211_C_TXPMGT	/* tx power management */
488	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
489	    | IEEE80211_C_SHSLOT	/* short slot time supported */
490	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
491	    | IEEE80211_C_WPA		/* 802.11i */
492	    ;
493
494	bands = 0;
495	setbit(&bands, IEEE80211_MODE_11B);
496	setbit(&bands, IEEE80211_MODE_11G);
497	if (sc->rf_rev == RAL_RF_5222)
498		setbit(&bands, IEEE80211_MODE_11A);
499	ieee80211_init_channels(ic, NULL, &bands);
500
501	ieee80211_ifattach(ic);
502	ic->ic_newassoc = ural_newassoc;
503	ic->ic_raw_xmit = ural_raw_xmit;
504	ic->ic_node_alloc = ural_node_alloc;
505	ic->ic_scan_start = ural_scan_start;
506	ic->ic_scan_end = ural_scan_end;
507	ic->ic_set_channel = ural_set_channel;
508
509	ic->ic_vap_create = ural_vap_create;
510	ic->ic_vap_delete = ural_vap_delete;
511
512	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
513
514	bpfattach(ifp, DLT_IEEE802_11_RADIO,
515	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
516
517	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
518	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
519	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
520
521	sc->sc_txtap_len = sizeof sc->sc_txtap;
522	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
523	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
524
525	if (bootverbose)
526		ieee80211_announce(ic);
527
528	RAL_LOCK(sc);
529}
530
531static int
532ural_detach(device_t self)
533{
534	struct ural_softc *sc = device_get_softc(self);
535	struct ifnet *ifp = sc->sc_ifp;
536	struct ieee80211com *ic = ifp->if_l2com;
537
538	/* wait for any post attach or other command to complete */
539	usb2_proc_drain(&sc->sc_tq);
540
541	/* stop all USB transfers */
542	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
543	usb2_proc_free(&sc->sc_tq);
544
545	/* free TX list, if any */
546	RAL_LOCK(sc);
547	ural_unsetup_tx_list(sc);
548	RAL_UNLOCK(sc);
549
550	if (ifp) {
551		bpfdetach(ifp);
552		ieee80211_ifdetach(ic);
553		if_free(ifp);
554	}
555
556	mtx_destroy(&sc->sc_mtx);
557
558	return (0);
559}
560
561static struct ieee80211vap *
562ural_vap_create(struct ieee80211com *ic,
563	const char name[IFNAMSIZ], int unit, int opmode, int flags,
564	const uint8_t bssid[IEEE80211_ADDR_LEN],
565	const uint8_t mac[IEEE80211_ADDR_LEN])
566{
567	struct ural_softc *sc = ic->ic_ifp->if_softc;
568	struct ural_vap *uvp;
569	struct ieee80211vap *vap;
570
571	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
572		return NULL;
573	uvp = (struct ural_vap *) malloc(sizeof(struct ural_vap),
574	    M_80211_VAP, M_NOWAIT | M_ZERO);
575	if (uvp == NULL)
576		return NULL;
577	vap = &uvp->vap;
578	/* enable s/w bmiss handling for sta mode */
579	ieee80211_vap_setup(ic, vap, name, unit, opmode,
580	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
581
582	/* override state transition machine */
583	uvp->newstate = vap->iv_newstate;
584	vap->iv_newstate = ural_newstate;
585
586	uvp->sc = sc;
587	usb2_callout_init_mtx(&uvp->amrr_ch, &sc->sc_mtx, 0);
588	ieee80211_amrr_init(&uvp->amrr, vap,
589	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
590	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
591	    1000 /* 1 sec */);
592
593	/* complete setup */
594	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
595	ic->ic_opmode = opmode;
596	return vap;
597}
598
599static void
600ural_vap_delete(struct ieee80211vap *vap)
601{
602	struct ural_vap *uvp = URAL_VAP(vap);
603
604	usb2_callout_drain(&uvp->amrr_ch);
605	ieee80211_amrr_cleanup(&uvp->amrr);
606	ieee80211_vap_detach(vap);
607	free(uvp, M_80211_VAP);
608}
609
610static void
611ural_tx_free(struct ural_tx_data *data, int txerr)
612{
613	struct ural_softc *sc = data->sc;
614
615	if (data->m != NULL) {
616		if (data->m->m_flags & M_TXCB)
617			ieee80211_process_callback(data->ni, data->m,
618			    txerr ? ETIMEDOUT : 0);
619		m_freem(data->m);
620		data->m = NULL;
621
622		ieee80211_free_node(data->ni);
623		data->ni = NULL;
624	}
625	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
626	sc->tx_nfree++;
627}
628
629static void
630ural_setup_tx_list(struct ural_softc *sc)
631{
632	struct ural_tx_data *data;
633	int i;
634
635	sc->tx_nfree = 0;
636	STAILQ_INIT(&sc->tx_q);
637	STAILQ_INIT(&sc->tx_free);
638
639	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
640		data = &sc->tx_data[i];
641
642		data->sc = sc;
643		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
644		sc->tx_nfree++;
645	}
646}
647
648static void
649ural_unsetup_tx_list(struct ural_softc *sc)
650{
651	struct ural_tx_data *data;
652	int i;
653
654	/* make sure any subsequent use of the queues will fail */
655	sc->tx_nfree = 0;
656	STAILQ_INIT(&sc->tx_q);
657	STAILQ_INIT(&sc->tx_free);
658
659	/* free up all node references and mbufs */
660	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
661		data = &sc->tx_data[i];
662
663		if (data->m != NULL) {
664			m_freem(data->m);
665			data->m = NULL;
666		}
667		if (data->ni != NULL) {
668			ieee80211_free_node(data->ni);
669			data->ni = NULL;
670		}
671	}
672}
673
674static void
675ural_task(struct usb2_proc_msg *pm)
676{
677	struct ural_task *task = (struct ural_task *)pm;
678	struct ural_softc *sc = task->sc;
679	struct ifnet *ifp = sc->sc_ifp;
680	struct ieee80211com *ic = ifp->if_l2com;
681	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
682	struct ural_vap *uvp = URAL_VAP(vap);
683	const struct ieee80211_txparam *tp;
684	enum ieee80211_state ostate;
685	struct ieee80211_node *ni;
686	struct mbuf *m;
687
688	ostate = vap->iv_state;
689
690	switch (sc->sc_state) {
691	case IEEE80211_S_INIT:
692		if (ostate == IEEE80211_S_RUN) {
693			/* abort TSF synchronization */
694			ural_write(sc, RAL_TXRX_CSR19, 0);
695
696			/* force tx led to stop blinking */
697			ural_write(sc, RAL_MAC_CSR20, 0);
698		}
699		break;
700
701	case IEEE80211_S_RUN:
702		ni = vap->iv_bss;
703
704		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
705			ural_update_slot(ic->ic_ifp);
706			ural_set_txpreamble(sc);
707			ural_set_basicrates(sc, ic->ic_bsschan);
708			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
709			ural_set_bssid(sc, sc->sc_bssid);
710		}
711
712		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
713		    vap->iv_opmode == IEEE80211_M_IBSS) {
714			m = ieee80211_beacon_alloc(ni, &uvp->bo);
715			if (m == NULL) {
716				device_printf(sc->sc_dev,
717				    "could not allocate beacon\n");
718				return;
719			}
720
721			if (ural_tx_bcn(sc, m, ni) != 0) {
722				device_printf(sc->sc_dev,
723				    "could not send beacon\n");
724				return;
725			}
726		}
727
728		/* make tx led blink on tx (controlled by ASIC) */
729		ural_write(sc, RAL_MAC_CSR20, 1);
730
731		if (vap->iv_opmode != IEEE80211_M_MONITOR)
732			ural_enable_tsf_sync(sc);
733
734		/* enable automatic rate adaptation */
735		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
736		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
737			ural_amrr_start(sc, ni);
738
739		break;
740
741	default:
742		break;
743	}
744
745	RAL_UNLOCK(sc);
746	IEEE80211_LOCK(ic);
747	uvp->newstate(vap, sc->sc_state, sc->sc_arg);
748	if (vap->iv_newstate_cb != NULL)
749		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
750	IEEE80211_UNLOCK(ic);
751	RAL_LOCK(sc);
752}
753
754static void
755ural_scantask(struct usb2_proc_msg *pm)
756{
757	struct ural_task *task = (struct ural_task *)pm;
758	struct ural_softc *sc = task->sc;
759	struct ifnet *ifp = sc->sc_ifp;
760	struct ieee80211com *ic = ifp->if_l2com;
761
762	RAL_LOCK_ASSERT(sc, MA_OWNED);
763
764	switch (sc->sc_scan_action) {
765	case URAL_SCAN_START:
766		/* abort TSF synchronization */
767		DPRINTF("starting scan\n");
768		ural_write(sc, RAL_TXRX_CSR19, 0);
769		ural_set_bssid(sc, ifp->if_broadcastaddr);
770		break;
771
772	case URAL_SET_CHANNEL:
773		ural_set_chan(sc, ic->ic_curchan);
774		break;
775
776	default: /* URAL_SCAN_END */
777		DPRINTF("stopping scan\n");
778		ural_enable_tsf_sync(sc);
779		ural_set_bssid(sc, sc->sc_bssid);
780		break;
781	}
782}
783
784static int
785ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
786{
787	struct ural_vap *uvp = URAL_VAP(vap);
788	struct ieee80211com *ic = vap->iv_ic;
789	struct ural_softc *sc = ic->ic_ifp->if_softc;
790
791	DPRINTF("%s -> %s\n",
792		ieee80211_state_name[vap->iv_state],
793		ieee80211_state_name[nstate]);
794
795	RAL_LOCK(sc);
796	usb2_callout_stop(&uvp->amrr_ch);
797
798	/* do it in a process context */
799	sc->sc_state = nstate;
800	sc->sc_arg = arg;
801	RAL_UNLOCK(sc);
802
803	if (nstate == IEEE80211_S_INIT) {
804		uvp->newstate(vap, nstate, arg);
805		return 0;
806	} else {
807		RAL_LOCK(sc);
808		ural_queue_command(sc, ural_task, &sc->sc_task[0].hdr,
809		    &sc->sc_task[1].hdr);
810		RAL_UNLOCK(sc);
811		return EINPROGRESS;
812	}
813}
814
815
816static void
817ural_bulk_write_callback(struct usb2_xfer *xfer)
818{
819	struct ural_softc *sc = xfer->priv_sc;
820	struct ifnet *ifp = sc->sc_ifp;
821	struct ieee80211com *ic = ifp->if_l2com;
822	struct ieee80211_channel *c = ic->ic_curchan;
823	struct ural_tx_data *data;
824	struct mbuf *m;
825	unsigned int len;
826
827	switch (USB_GET_STATE(xfer)) {
828	case USB_ST_TRANSFERRED:
829		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
830
831		/* free resources */
832		data = xfer->priv_fifo;
833		ural_tx_free(data, 0);
834		xfer->priv_fifo = NULL;
835
836		ifp->if_opackets++;
837		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
838
839		/* FALLTHROUGH */
840	case USB_ST_SETUP:
841tr_setup:
842		data = STAILQ_FIRST(&sc->tx_q);
843		if (data) {
844			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
845			m = data->m;
846
847			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
848				DPRINTFN(0, "data overflow, %u bytes\n",
849				    m->m_pkthdr.len);
850				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
851			}
852			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
853			    RAL_TX_DESC_SIZE);
854			usb2_m_copy_in(xfer->frbuffers, RAL_TX_DESC_SIZE, m, 0,
855			    m->m_pkthdr.len);
856
857			if (bpf_peers_present(ifp->if_bpf)) {
858				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
859
860				tap->wt_flags = 0;
861				tap->wt_rate = data->rate;
862				tap->wt_chan_freq = htole16(c->ic_freq);
863				tap->wt_chan_flags = htole16(c->ic_flags);
864				tap->wt_antenna = sc->tx_ant;
865
866				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
867			}
868
869			/* xfer length needs to be a multiple of two! */
870			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
871			if ((len % 64) == 0)
872				len += 2;
873
874			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
875			    m->m_pkthdr.len, len);
876
877			xfer->frlengths[0] = len;
878			xfer->priv_fifo = data;
879
880			usb2_start_hardware(xfer);
881		}
882		break;
883
884	default:			/* Error */
885		DPRINTFN(11, "transfer error, %s\n",
886		    usb2_errstr(xfer->error));
887
888		ifp->if_oerrors++;
889		data = xfer->priv_fifo;
890		if (data != NULL) {
891			ural_tx_free(data, xfer->error);
892			xfer->priv_fifo = NULL;
893		}
894
895		if (xfer->error == USB_ERR_STALLED) {
896			/* try to clear stall first */
897			xfer->flags.stall_pipe = 1;
898			goto tr_setup;
899		}
900		if (xfer->error == USB_ERR_TIMEOUT)
901			device_printf(sc->sc_dev, "device timeout\n");
902		break;
903	}
904}
905
906static void
907ural_bulk_read_callback(struct usb2_xfer *xfer)
908{
909	struct ural_softc *sc = xfer->priv_sc;
910	struct ifnet *ifp = sc->sc_ifp;
911	struct ieee80211com *ic = ifp->if_l2com;
912	struct ieee80211_node *ni;
913	struct mbuf *m = NULL;
914	uint32_t flags;
915	uint8_t rssi = 0;
916	unsigned int len;
917
918	switch (USB_GET_STATE(xfer)) {
919	case USB_ST_TRANSFERRED:
920
921		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
922
923		len = xfer->actlen;
924		if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
925			DPRINTF("%s: xfer too short %d\n",
926			    device_get_nameunit(sc->sc_dev), len);
927			ifp->if_ierrors++;
928			goto tr_setup;
929		}
930
931		len -= RAL_RX_DESC_SIZE;
932		/* rx descriptor is located at the end */
933		usb2_copy_out(xfer->frbuffers, len, &sc->sc_rx_desc,
934		    RAL_RX_DESC_SIZE);
935
936		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
937		flags = le32toh(sc->sc_rx_desc.flags);
938		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
939			/*
940		         * This should not happen since we did not
941		         * request to receive those frames when we
942		         * filled RAL_TXRX_CSR2:
943		         */
944			DPRINTFN(5, "PHY or CRC error\n");
945			ifp->if_ierrors++;
946			goto tr_setup;
947		}
948
949		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
950		if (m == NULL) {
951			DPRINTF("could not allocate mbuf\n");
952			ifp->if_ierrors++;
953			goto tr_setup;
954		}
955		usb2_copy_out(xfer->frbuffers, 0, mtod(m, uint8_t *), len);
956
957		/* finalize mbuf */
958		m->m_pkthdr.rcvif = ifp;
959		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
960
961		if (bpf_peers_present(ifp->if_bpf)) {
962			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
963
964			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
965			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
966			    (flags & RAL_RX_OFDM) ?
967			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
968			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
969			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
970			tap->wr_antenna = sc->rx_ant;
971			tap->wr_antsignal = rssi;
972
973			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
974		}
975		/* Strip trailing 802.11 MAC FCS. */
976		m_adj(m, -IEEE80211_CRC_LEN);
977
978		/* FALLTHROUGH */
979	case USB_ST_SETUP:
980tr_setup:
981		xfer->frlengths[0] = xfer->max_data_length;
982		usb2_start_hardware(xfer);
983
984		/*
985		 * At the end of a USB callback it is always safe to unlock
986		 * the private mutex of a device! That is why we do the
987		 * "ieee80211_input" here, and not some lines up!
988		 */
989		if (m) {
990			RAL_UNLOCK(sc);
991			ni = ieee80211_find_rxnode(ic,
992			    mtod(m, struct ieee80211_frame_min *));
993			if (ni != NULL) {
994				(void) ieee80211_input(ni, m, rssi,
995				    RAL_NOISE_FLOOR, 0);
996				ieee80211_free_node(ni);
997			} else
998				(void) ieee80211_input_all(ic, m, rssi,
999				    RAL_NOISE_FLOOR, 0);
1000			RAL_LOCK(sc);
1001		}
1002		return;
1003
1004	default:			/* Error */
1005		if (xfer->error != USB_ERR_CANCELLED) {
1006			/* try to clear stall first */
1007			xfer->flags.stall_pipe = 1;
1008			goto tr_setup;
1009		}
1010		return;
1011	}
1012}
1013
1014static uint8_t
1015ural_plcp_signal(int rate)
1016{
1017	switch (rate) {
1018	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1019	case 12:	return 0xb;
1020	case 18:	return 0xf;
1021	case 24:	return 0xa;
1022	case 36:	return 0xe;
1023	case 48:	return 0x9;
1024	case 72:	return 0xd;
1025	case 96:	return 0x8;
1026	case 108:	return 0xc;
1027
1028	/* CCK rates (NB: not IEEE std, device-specific) */
1029	case 2:		return 0x0;
1030	case 4:		return 0x1;
1031	case 11:	return 0x2;
1032	case 22:	return 0x3;
1033	}
1034	return 0xff;		/* XXX unsupported/unknown rate */
1035}
1036
1037static void
1038ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
1039    uint32_t flags, int len, int rate)
1040{
1041	struct ifnet *ifp = sc->sc_ifp;
1042	struct ieee80211com *ic = ifp->if_l2com;
1043	uint16_t plcp_length;
1044	int remainder;
1045
1046	desc->flags = htole32(flags);
1047	desc->flags |= htole32(RAL_TX_NEWSEQ);
1048	desc->flags |= htole32(len << 16);
1049
1050	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
1051	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
1052
1053	/* setup PLCP fields */
1054	desc->plcp_signal  = ural_plcp_signal(rate);
1055	desc->plcp_service = 4;
1056
1057	len += IEEE80211_CRC_LEN;
1058	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1059		desc->flags |= htole32(RAL_TX_OFDM);
1060
1061		plcp_length = len & 0xfff;
1062		desc->plcp_length_hi = plcp_length >> 6;
1063		desc->plcp_length_lo = plcp_length & 0x3f;
1064	} else {
1065		plcp_length = (16 * len + rate - 1) / rate;
1066		if (rate == 22) {
1067			remainder = (16 * len) % 22;
1068			if (remainder != 0 && remainder < 7)
1069				desc->plcp_service |= RAL_PLCP_LENGEXT;
1070		}
1071		desc->plcp_length_hi = plcp_length >> 8;
1072		desc->plcp_length_lo = plcp_length & 0xff;
1073
1074		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1075			desc->plcp_signal |= 0x08;
1076	}
1077
1078	desc->iv = 0;
1079	desc->eiv = 0;
1080}
1081
1082#define RAL_TX_TIMEOUT	5000
1083
1084static int
1085ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1086{
1087	struct ieee80211vap *vap = ni->ni_vap;
1088	struct ieee80211com *ic = ni->ni_ic;
1089	struct ifnet *ifp = sc->sc_ifp;
1090	const struct ieee80211_txparam *tp;
1091	struct ural_tx_data *data;
1092
1093	if (sc->tx_nfree == 0) {
1094		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1095		m_freem(m0);
1096		ieee80211_free_node(ni);
1097		return EIO;
1098	}
1099	data = STAILQ_FIRST(&sc->tx_free);
1100	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1101	sc->tx_nfree--;
1102	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1103
1104	data->m = m0;
1105	data->ni = ni;
1106	data->rate = tp->mgmtrate;
1107
1108	ural_setup_tx_desc(sc, &data->desc,
1109	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1110	    tp->mgmtrate);
1111
1112	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1113	    m0->m_pkthdr.len, tp->mgmtrate);
1114
1115	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1116	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1117
1118	return (0);
1119}
1120
1121static int
1122ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1123{
1124	struct ieee80211vap *vap = ni->ni_vap;
1125	struct ieee80211com *ic = ni->ni_ic;
1126	const struct ieee80211_txparam *tp;
1127	struct ural_tx_data *data;
1128	struct ieee80211_frame *wh;
1129	struct ieee80211_key *k;
1130	uint32_t flags;
1131	uint16_t dur;
1132
1133	RAL_LOCK_ASSERT(sc, MA_OWNED);
1134
1135	data = STAILQ_FIRST(&sc->tx_free);
1136	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1137	sc->tx_nfree--;
1138
1139	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1140
1141	wh = mtod(m0, struct ieee80211_frame *);
1142	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1143		k = ieee80211_crypto_encap(ni, m0);
1144		if (k == NULL) {
1145			m_freem(m0);
1146			return ENOBUFS;
1147		}
1148		wh = mtod(m0, struct ieee80211_frame *);
1149	}
1150
1151	data->m = m0;
1152	data->ni = ni;
1153	data->rate = tp->mgmtrate;
1154
1155	flags = 0;
1156	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1157		flags |= RAL_TX_ACK;
1158
1159		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
1160		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1161		*(uint16_t *)wh->i_dur = htole16(dur);
1162
1163		/* tell hardware to add timestamp for probe responses */
1164		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1165		    IEEE80211_FC0_TYPE_MGT &&
1166		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1167		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1168			flags |= RAL_TX_TIMESTAMP;
1169	}
1170
1171	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1172
1173	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1174	    m0->m_pkthdr.len, tp->mgmtrate);
1175
1176	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1177	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1178
1179	return 0;
1180}
1181
1182static int
1183ural_sendprot(struct ural_softc *sc,
1184    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1185{
1186	struct ieee80211com *ic = ni->ni_ic;
1187	const struct ieee80211_frame *wh;
1188	struct ural_tx_data *data;
1189	struct mbuf *mprot;
1190	int protrate, ackrate, pktlen, flags, isshort;
1191	uint16_t dur;
1192
1193	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1194	    ("protection %d", prot));
1195
1196	wh = mtod(m, const struct ieee80211_frame *);
1197	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1198
1199	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1200	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1201
1202	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1203	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1204	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1205	flags = RAL_TX_RETRY(7);
1206	if (prot == IEEE80211_PROT_RTSCTS) {
1207		/* NB: CTS is the same size as an ACK */
1208		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1209		flags |= RAL_TX_ACK;
1210		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1211	} else {
1212		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1213	}
1214	if (mprot == NULL) {
1215		/* XXX stat + msg */
1216		return ENOBUFS;
1217	}
1218	data = STAILQ_FIRST(&sc->tx_free);
1219	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1220	sc->tx_nfree--;
1221
1222	data->m = mprot;
1223	data->ni = ieee80211_ref_node(ni);
1224	data->rate = protrate;
1225	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1226
1227	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1228	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1229
1230	return 0;
1231}
1232
1233static int
1234ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1235    const struct ieee80211_bpf_params *params)
1236{
1237	struct ural_tx_data *data;
1238	uint32_t flags;
1239	int error;
1240	int rate;
1241
1242	RAL_LOCK_ASSERT(sc, MA_OWNED);
1243	KASSERT(params != NULL, ("no raw xmit params"));
1244
1245	data = STAILQ_FIRST(&sc->tx_free);
1246	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1247	sc->tx_nfree--;
1248
1249	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1250	/* XXX validate */
1251	if (rate == 0) {
1252		m_freem(m0);
1253		return EINVAL;
1254	}
1255	flags = 0;
1256	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1257		flags |= RAL_TX_ACK;
1258	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1259		error = ural_sendprot(sc, m0, ni,
1260		    params->ibp_flags & IEEE80211_BPF_RTS ?
1261			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1262		    rate);
1263		if (error) {
1264			m_freem(m0);
1265			return error;
1266		}
1267		flags |= RAL_TX_IFS_SIFS;
1268	}
1269
1270	data->m = m0;
1271	data->ni = ni;
1272	data->rate = rate;
1273
1274	/* XXX need to setup descriptor ourself */
1275	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1276
1277	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1278	    m0->m_pkthdr.len, rate);
1279
1280	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1281	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1282
1283	return 0;
1284}
1285
1286static int
1287ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1288{
1289	struct ieee80211vap *vap = ni->ni_vap;
1290	struct ieee80211com *ic = ni->ni_ic;
1291	struct ural_tx_data *data;
1292	struct ieee80211_frame *wh;
1293	const struct ieee80211_txparam *tp;
1294	struct ieee80211_key *k;
1295	uint32_t flags = 0;
1296	uint16_t dur;
1297	int error, rate;
1298
1299	RAL_LOCK_ASSERT(sc, MA_OWNED);
1300
1301	wh = mtod(m0, struct ieee80211_frame *);
1302
1303	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1304	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1305		rate = tp->mcastrate;
1306	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1307		rate = tp->ucastrate;
1308	else
1309		rate = ni->ni_txrate;
1310
1311	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1312		k = ieee80211_crypto_encap(ni, m0);
1313		if (k == NULL) {
1314			m_freem(m0);
1315			return ENOBUFS;
1316		}
1317		/* packet header may have moved, reset our local pointer */
1318		wh = mtod(m0, struct ieee80211_frame *);
1319	}
1320
1321	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1322		int prot = IEEE80211_PROT_NONE;
1323		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1324			prot = IEEE80211_PROT_RTSCTS;
1325		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1326		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1327			prot = ic->ic_protmode;
1328		if (prot != IEEE80211_PROT_NONE) {
1329			error = ural_sendprot(sc, m0, ni, prot, rate);
1330			if (error) {
1331				m_freem(m0);
1332				return error;
1333			}
1334			flags |= RAL_TX_IFS_SIFS;
1335		}
1336	}
1337
1338	data = STAILQ_FIRST(&sc->tx_free);
1339	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1340	sc->tx_nfree--;
1341
1342	data->m = m0;
1343	data->ni = ni;
1344	data->rate = rate;
1345
1346	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1347		flags |= RAL_TX_ACK;
1348		flags |= RAL_TX_RETRY(7);
1349
1350		dur = ieee80211_ack_duration(sc->sc_rates, rate,
1351		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1352		*(uint16_t *)wh->i_dur = htole16(dur);
1353	}
1354
1355	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1356
1357	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1358	    m0->m_pkthdr.len, rate);
1359
1360	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1361	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1362
1363	return 0;
1364}
1365
1366static void
1367ural_start(struct ifnet *ifp)
1368{
1369	struct ural_softc *sc = ifp->if_softc;
1370	struct ieee80211_node *ni;
1371	struct mbuf *m;
1372
1373	RAL_LOCK(sc);
1374	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1375		RAL_UNLOCK(sc);
1376		return;
1377	}
1378	for (;;) {
1379		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1380		if (m == NULL)
1381			break;
1382		if (sc->tx_nfree == 0) {
1383			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1384			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1385			break;
1386		}
1387		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1388		m = ieee80211_encap(ni, m);
1389		if (m == NULL) {
1390			ieee80211_free_node(ni);
1391			continue;
1392		}
1393		if (ural_tx_data(sc, m, ni) != 0) {
1394			ieee80211_free_node(ni);
1395			ifp->if_oerrors++;
1396			break;
1397		}
1398	}
1399	RAL_UNLOCK(sc);
1400}
1401
1402static int
1403ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1404{
1405	struct ural_softc *sc = ifp->if_softc;
1406	struct ieee80211com *ic = ifp->if_l2com;
1407	struct ifreq *ifr = (struct ifreq *) data;
1408	int error = 0, startall = 0;
1409
1410	switch (cmd) {
1411	case SIOCSIFFLAGS:
1412		RAL_LOCK(sc);
1413		if (ifp->if_flags & IFF_UP) {
1414			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1415				ural_queue_command(sc, ural_init_task,
1416				    &sc->sc_synctask[0].hdr,
1417				    &sc->sc_synctask[1].hdr);
1418				startall = 1;
1419			} else
1420				ural_queue_command(sc, ural_promisctask,
1421				    &sc->sc_promisctask[0].hdr,
1422				    &sc->sc_promisctask[1].hdr);
1423		} else {
1424			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1425				ural_queue_command(sc, ural_stop_task,
1426				    &sc->sc_synctask[0].hdr,
1427				    &sc->sc_synctask[1].hdr);
1428			}
1429		}
1430		RAL_UNLOCK(sc);
1431		if (startall)
1432			ieee80211_start_all(ic);
1433		break;
1434	case SIOCGIFMEDIA:
1435	case SIOCSIFMEDIA:
1436		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1437		break;
1438	default:
1439		error = ether_ioctl(ifp, cmd, data);
1440		break;
1441	}
1442	return error;
1443}
1444
1445static void
1446ural_set_testmode(struct ural_softc *sc)
1447{
1448	struct usb2_device_request req;
1449	usb2_error_t error;
1450
1451	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1452	req.bRequest = RAL_VENDOR_REQUEST;
1453	USETW(req.wValue, 4);
1454	USETW(req.wIndex, 1);
1455	USETW(req.wLength, 0);
1456
1457	error = ural_do_request(sc, &req, NULL);
1458	if (error != 0) {
1459		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1460		    usb2_errstr(error));
1461	}
1462}
1463
1464static void
1465ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1466{
1467	struct usb2_device_request req;
1468	usb2_error_t error;
1469
1470	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1471	req.bRequest = RAL_READ_EEPROM;
1472	USETW(req.wValue, 0);
1473	USETW(req.wIndex, addr);
1474	USETW(req.wLength, len);
1475
1476	error = ural_do_request(sc, &req, buf);
1477	if (error != 0) {
1478		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1479		    usb2_errstr(error));
1480	}
1481}
1482
1483static uint16_t
1484ural_read(struct ural_softc *sc, uint16_t reg)
1485{
1486	struct usb2_device_request req;
1487	usb2_error_t error;
1488	uint16_t val;
1489
1490	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1491	req.bRequest = RAL_READ_MAC;
1492	USETW(req.wValue, 0);
1493	USETW(req.wIndex, reg);
1494	USETW(req.wLength, sizeof (uint16_t));
1495
1496	error = ural_do_request(sc, &req, &val);
1497	if (error != 0) {
1498		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1499		    usb2_errstr(error));
1500		return 0;
1501	}
1502
1503	return le16toh(val);
1504}
1505
1506static void
1507ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1508{
1509	struct usb2_device_request req;
1510	usb2_error_t error;
1511
1512	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1513	req.bRequest = RAL_READ_MULTI_MAC;
1514	USETW(req.wValue, 0);
1515	USETW(req.wIndex, reg);
1516	USETW(req.wLength, len);
1517
1518	error = ural_do_request(sc, &req, buf);
1519	if (error != 0) {
1520		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1521		    usb2_errstr(error));
1522	}
1523}
1524
1525static void
1526ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1527{
1528	struct usb2_device_request req;
1529	usb2_error_t error;
1530
1531	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1532	req.bRequest = RAL_WRITE_MAC;
1533	USETW(req.wValue, val);
1534	USETW(req.wIndex, reg);
1535	USETW(req.wLength, 0);
1536
1537	error = ural_do_request(sc, &req, NULL);
1538	if (error != 0) {
1539		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1540		    usb2_errstr(error));
1541	}
1542}
1543
1544static void
1545ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1546{
1547	struct usb2_device_request req;
1548	usb2_error_t error;
1549
1550	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1551	req.bRequest = RAL_WRITE_MULTI_MAC;
1552	USETW(req.wValue, 0);
1553	USETW(req.wIndex, reg);
1554	USETW(req.wLength, len);
1555
1556	error = ural_do_request(sc, &req, buf);
1557	if (error != 0) {
1558		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1559		    usb2_errstr(error));
1560	}
1561}
1562
1563static void
1564ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1565{
1566	uint16_t tmp;
1567	int ntries;
1568
1569	for (ntries = 0; ntries < 5; ntries++) {
1570		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1571			break;
1572	}
1573	if (ntries == 5) {
1574		device_printf(sc->sc_dev, "could not write to BBP\n");
1575		return;
1576	}
1577
1578	tmp = reg << 8 | val;
1579	ural_write(sc, RAL_PHY_CSR7, tmp);
1580}
1581
1582static uint8_t
1583ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1584{
1585	uint16_t val;
1586	int ntries;
1587
1588	val = RAL_BBP_WRITE | reg << 8;
1589	ural_write(sc, RAL_PHY_CSR7, val);
1590
1591	for (ntries = 0; ntries < 5; ntries++) {
1592		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1593			break;
1594	}
1595	if (ntries == 5) {
1596		device_printf(sc->sc_dev, "could not read BBP\n");
1597		return 0;
1598	}
1599
1600	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1601}
1602
1603static void
1604ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1605{
1606	uint32_t tmp;
1607	int ntries;
1608
1609	for (ntries = 0; ntries < 5; ntries++) {
1610		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1611			break;
1612	}
1613	if (ntries == 5) {
1614		device_printf(sc->sc_dev, "could not write to RF\n");
1615		return;
1616	}
1617
1618	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1619	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1620	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1621
1622	/* remember last written value in sc */
1623	sc->rf_regs[reg] = val;
1624
1625	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1626}
1627
1628/* ARGUSED */
1629static struct ieee80211_node *
1630ural_node_alloc(struct ieee80211vap *vap __unused,
1631	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
1632{
1633	struct ural_node *un;
1634
1635	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1636	return un != NULL ? &un->ni : NULL;
1637}
1638
1639static void
1640ural_newassoc(struct ieee80211_node *ni, int isnew)
1641{
1642	struct ieee80211vap *vap = ni->ni_vap;
1643
1644	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
1645}
1646
1647static void
1648ural_scan_start(struct ieee80211com *ic)
1649{
1650	struct ural_softc *sc = ic->ic_ifp->if_softc;
1651
1652	RAL_LOCK(sc);
1653	/* do it in a process context */
1654	sc->sc_scan_action = URAL_SCAN_START;
1655	ural_queue_command(sc, ural_scantask,
1656	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1657	RAL_UNLOCK(sc);
1658
1659}
1660
1661static void
1662ural_scan_end(struct ieee80211com *ic)
1663{
1664	struct ural_softc *sc = ic->ic_ifp->if_softc;
1665
1666	RAL_LOCK(sc);
1667	/* do it in a process context */
1668	sc->sc_scan_action = URAL_SCAN_END;
1669	ural_queue_command(sc, ural_scantask,
1670	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1671	RAL_UNLOCK(sc);
1672
1673}
1674
1675static void
1676ural_set_channel(struct ieee80211com *ic)
1677{
1678	struct ural_softc *sc = ic->ic_ifp->if_softc;
1679
1680	RAL_LOCK(sc);
1681	/* do it in a process context */
1682	sc->sc_scan_action = URAL_SET_CHANNEL;
1683	ural_queue_command(sc, ural_scantask,
1684	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1685
1686	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1687	RAL_UNLOCK(sc);
1688}
1689
1690static void
1691ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1692{
1693	struct ifnet *ifp = sc->sc_ifp;
1694	struct ieee80211com *ic = ifp->if_l2com;
1695	uint8_t power, tmp;
1696	u_int i, chan;
1697
1698	chan = ieee80211_chan2ieee(ic, c);
1699	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1700		return;
1701
1702	if (IEEE80211_IS_CHAN_2GHZ(c))
1703		power = min(sc->txpow[chan - 1], 31);
1704	else
1705		power = 31;
1706
1707	/* adjust txpower using ifconfig settings */
1708	power -= (100 - ic->ic_txpowlimit) / 8;
1709
1710	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1711
1712	switch (sc->rf_rev) {
1713	case RAL_RF_2522:
1714		ural_rf_write(sc, RAL_RF1, 0x00814);
1715		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1716		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1717		break;
1718
1719	case RAL_RF_2523:
1720		ural_rf_write(sc, RAL_RF1, 0x08804);
1721		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1722		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1723		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1724		break;
1725
1726	case RAL_RF_2524:
1727		ural_rf_write(sc, RAL_RF1, 0x0c808);
1728		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1729		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1730		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1731		break;
1732
1733	case RAL_RF_2525:
1734		ural_rf_write(sc, RAL_RF1, 0x08808);
1735		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1736		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1737		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1738
1739		ural_rf_write(sc, RAL_RF1, 0x08808);
1740		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1741		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1742		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1743		break;
1744
1745	case RAL_RF_2525E:
1746		ural_rf_write(sc, RAL_RF1, 0x08808);
1747		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1748		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1749		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1750		break;
1751
1752	case RAL_RF_2526:
1753		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1754		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1755		ural_rf_write(sc, RAL_RF1, 0x08804);
1756
1757		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1758		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1759		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1760		break;
1761
1762	/* dual-band RF */
1763	case RAL_RF_5222:
1764		for (i = 0; ural_rf5222[i].chan != chan; i++);
1765
1766		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1767		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1768		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1769		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1770		break;
1771	}
1772
1773	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1774	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1775		/* set Japan filter bit for channel 14 */
1776		tmp = ural_bbp_read(sc, 70);
1777
1778		tmp &= ~RAL_JAPAN_FILTER;
1779		if (chan == 14)
1780			tmp |= RAL_JAPAN_FILTER;
1781
1782		ural_bbp_write(sc, 70, tmp);
1783
1784		/* clear CRC errors */
1785		ural_read(sc, RAL_STA_CSR0);
1786
1787		DELAY(10000);
1788		ural_disable_rf_tune(sc);
1789	}
1790
1791	/* XXX doesn't belong here */
1792	/* update basic rate set */
1793	ural_set_basicrates(sc, c);
1794}
1795
1796/*
1797 * Disable RF auto-tuning.
1798 */
1799static void
1800ural_disable_rf_tune(struct ural_softc *sc)
1801{
1802	uint32_t tmp;
1803
1804	if (sc->rf_rev != RAL_RF_2523) {
1805		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1806		ural_rf_write(sc, RAL_RF1, tmp);
1807	}
1808
1809	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1810	ural_rf_write(sc, RAL_RF3, tmp);
1811
1812	DPRINTFN(2, "disabling RF autotune\n");
1813}
1814
1815/*
1816 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1817 * synchronization.
1818 */
1819static void
1820ural_enable_tsf_sync(struct ural_softc *sc)
1821{
1822	struct ifnet *ifp = sc->sc_ifp;
1823	struct ieee80211com *ic = ifp->if_l2com;
1824	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1825	uint16_t logcwmin, preload, tmp;
1826
1827	/* first, disable TSF synchronization */
1828	ural_write(sc, RAL_TXRX_CSR19, 0);
1829
1830	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1831	ural_write(sc, RAL_TXRX_CSR18, tmp);
1832
1833	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1834	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1835	tmp = logcwmin << 12 | preload;
1836	ural_write(sc, RAL_TXRX_CSR20, tmp);
1837
1838	/* finally, enable TSF synchronization */
1839	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1840	if (ic->ic_opmode == IEEE80211_M_STA)
1841		tmp |= RAL_ENABLE_TSF_SYNC(1);
1842	else
1843		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1844	ural_write(sc, RAL_TXRX_CSR19, tmp);
1845
1846	DPRINTF("enabling TSF synchronization\n");
1847}
1848
1849#define RAL_RXTX_TURNAROUND	5	/* us */
1850static void
1851ural_update_slot(struct ifnet *ifp)
1852{
1853	struct ural_softc *sc = ifp->if_softc;
1854	struct ieee80211com *ic = ifp->if_l2com;
1855	uint16_t slottime, sifs, eifs;
1856
1857	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1858
1859	/*
1860	 * These settings may sound a bit inconsistent but this is what the
1861	 * reference driver does.
1862	 */
1863	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1864		sifs = 16 - RAL_RXTX_TURNAROUND;
1865		eifs = 364;
1866	} else {
1867		sifs = 10 - RAL_RXTX_TURNAROUND;
1868		eifs = 64;
1869	}
1870
1871	ural_write(sc, RAL_MAC_CSR10, slottime);
1872	ural_write(sc, RAL_MAC_CSR11, sifs);
1873	ural_write(sc, RAL_MAC_CSR12, eifs);
1874}
1875
1876static void
1877ural_set_txpreamble(struct ural_softc *sc)
1878{
1879	struct ifnet *ifp = sc->sc_ifp;
1880	struct ieee80211com *ic = ifp->if_l2com;
1881	uint16_t tmp;
1882
1883	tmp = ural_read(sc, RAL_TXRX_CSR10);
1884
1885	tmp &= ~RAL_SHORT_PREAMBLE;
1886	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1887		tmp |= RAL_SHORT_PREAMBLE;
1888
1889	ural_write(sc, RAL_TXRX_CSR10, tmp);
1890}
1891
1892static void
1893ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1894{
1895	/* XXX wrong, take from rate set */
1896	/* update basic rate set */
1897	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1898		/* 11a basic rates: 6, 12, 24Mbps */
1899		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1900	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1901		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1902		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1903	} else {
1904		/* 11b basic rates: 1, 2Mbps */
1905		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1906	}
1907}
1908
1909static void
1910ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1911{
1912	uint16_t tmp;
1913
1914	tmp = bssid[0] | bssid[1] << 8;
1915	ural_write(sc, RAL_MAC_CSR5, tmp);
1916
1917	tmp = bssid[2] | bssid[3] << 8;
1918	ural_write(sc, RAL_MAC_CSR6, tmp);
1919
1920	tmp = bssid[4] | bssid[5] << 8;
1921	ural_write(sc, RAL_MAC_CSR7, tmp);
1922
1923	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1924}
1925
1926static void
1927ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1928{
1929	uint16_t tmp;
1930
1931	tmp = addr[0] | addr[1] << 8;
1932	ural_write(sc, RAL_MAC_CSR2, tmp);
1933
1934	tmp = addr[2] | addr[3] << 8;
1935	ural_write(sc, RAL_MAC_CSR3, tmp);
1936
1937	tmp = addr[4] | addr[5] << 8;
1938	ural_write(sc, RAL_MAC_CSR4, tmp);
1939
1940	DPRINTF("setting MAC address to %6D\n", addr, ":");
1941}
1942
1943static void
1944ural_promisctask(struct usb2_proc_msg *pm)
1945{
1946	struct ural_task *task = (struct ural_task *)pm;
1947	struct ural_softc *sc = task->sc;
1948	struct ifnet *ifp = sc->sc_ifp;
1949	uint32_t tmp;
1950
1951	tmp = ural_read(sc, RAL_TXRX_CSR2);
1952
1953	tmp &= ~RAL_DROP_NOT_TO_ME;
1954	if (!(ifp->if_flags & IFF_PROMISC))
1955		tmp |= RAL_DROP_NOT_TO_ME;
1956
1957	ural_write(sc, RAL_TXRX_CSR2, tmp);
1958
1959	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1960	    "entering" : "leaving");
1961}
1962
1963static const char *
1964ural_get_rf(int rev)
1965{
1966	switch (rev) {
1967	case RAL_RF_2522:	return "RT2522";
1968	case RAL_RF_2523:	return "RT2523";
1969	case RAL_RF_2524:	return "RT2524";
1970	case RAL_RF_2525:	return "RT2525";
1971	case RAL_RF_2525E:	return "RT2525e";
1972	case RAL_RF_2526:	return "RT2526";
1973	case RAL_RF_5222:	return "RT5222";
1974	default:		return "unknown";
1975	}
1976}
1977
1978static void
1979ural_read_eeprom(struct ural_softc *sc)
1980{
1981	uint16_t val;
1982
1983	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1984	val = le16toh(val);
1985	sc->rf_rev =   (val >> 11) & 0x7;
1986	sc->hw_radio = (val >> 10) & 0x1;
1987	sc->led_mode = (val >> 6)  & 0x7;
1988	sc->rx_ant =   (val >> 4)  & 0x3;
1989	sc->tx_ant =   (val >> 2)  & 0x3;
1990	sc->nb_ant =   val & 0x3;
1991
1992	/* read MAC address */
1993	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_bssid, 6);
1994
1995	/* read default values for BBP registers */
1996	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1997
1998	/* read Tx power for all b/g channels */
1999	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
2000}
2001
2002static int
2003ural_bbp_init(struct ural_softc *sc)
2004{
2005#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2006	int i, ntries;
2007
2008	/* wait for BBP to be ready */
2009	for (ntries = 0; ntries < 100; ntries++) {
2010		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
2011			break;
2012		DELAY(1000);
2013	}
2014	if (ntries == 100) {
2015		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2016		return EIO;
2017	}
2018
2019	/* initialize BBP registers to default values */
2020	for (i = 0; i < N(ural_def_bbp); i++)
2021		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
2022
2023#if 0
2024	/* initialize BBP registers to values stored in EEPROM */
2025	for (i = 0; i < 16; i++) {
2026		if (sc->bbp_prom[i].reg == 0xff)
2027			continue;
2028		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2029	}
2030#endif
2031
2032	return 0;
2033#undef N
2034}
2035
2036static void
2037ural_set_txantenna(struct ural_softc *sc, int antenna)
2038{
2039	uint16_t tmp;
2040	uint8_t tx;
2041
2042	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
2043	if (antenna == 1)
2044		tx |= RAL_BBP_ANTA;
2045	else if (antenna == 2)
2046		tx |= RAL_BBP_ANTB;
2047	else
2048		tx |= RAL_BBP_DIVERSITY;
2049
2050	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2051	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
2052	    sc->rf_rev == RAL_RF_5222)
2053		tx |= RAL_BBP_FLIPIQ;
2054
2055	ural_bbp_write(sc, RAL_BBP_TX, tx);
2056
2057	/* update values in PHY_CSR5 and PHY_CSR6 */
2058	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
2059	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2060
2061	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
2062	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2063}
2064
2065static void
2066ural_set_rxantenna(struct ural_softc *sc, int antenna)
2067{
2068	uint8_t rx;
2069
2070	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2071	if (antenna == 1)
2072		rx |= RAL_BBP_ANTA;
2073	else if (antenna == 2)
2074		rx |= RAL_BBP_ANTB;
2075	else
2076		rx |= RAL_BBP_DIVERSITY;
2077
2078	/* need to force no I/Q flip for RF 2525e and 2526 */
2079	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2080		rx &= ~RAL_BBP_FLIPIQ;
2081
2082	ural_bbp_write(sc, RAL_BBP_RX, rx);
2083}
2084
2085static void
2086ural_init_task(struct usb2_proc_msg *pm)
2087{
2088#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2089	struct ural_task *task = (struct ural_task *)pm;
2090	struct ural_softc *sc = task->sc;
2091	struct ifnet *ifp = sc->sc_ifp;
2092	struct ieee80211com *ic = ifp->if_l2com;
2093	uint16_t tmp;
2094	int i, ntries;
2095
2096	RAL_LOCK_ASSERT(sc, MA_OWNED);
2097
2098	ural_set_testmode(sc);
2099	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2100
2101	ural_stop_task(pm);
2102
2103	/* initialize MAC registers to default values */
2104	for (i = 0; i < N(ural_def_mac); i++)
2105		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2106
2107	/* wait for BBP and RF to wake up (this can take a long time!) */
2108	for (ntries = 0; ntries < 100; ntries++) {
2109		tmp = ural_read(sc, RAL_MAC_CSR17);
2110		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2111		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2112			break;
2113		DELAY(1000);
2114	}
2115	if (ntries == 100) {
2116		device_printf(sc->sc_dev,
2117		    "timeout waiting for BBP/RF to wakeup\n");
2118		goto fail;
2119	}
2120
2121	/* we're ready! */
2122	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2123
2124	/* set basic rate set (will be updated later) */
2125	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2126
2127	if (ural_bbp_init(sc) != 0)
2128		goto fail;
2129
2130	ural_set_chan(sc, ic->ic_curchan);
2131
2132	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2133	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2134
2135	ural_set_txantenna(sc, sc->tx_ant);
2136	ural_set_rxantenna(sc, sc->rx_ant);
2137
2138	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2139	ural_set_macaddr(sc, ic->ic_myaddr);
2140
2141	/*
2142	 * Allocate Tx and Rx xfer queues.
2143	 */
2144	ural_setup_tx_list(sc);
2145
2146	/* kick Rx */
2147	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2148	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2149		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2150		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2151			tmp |= RAL_DROP_TODS;
2152		if (!(ifp->if_flags & IFF_PROMISC))
2153			tmp |= RAL_DROP_NOT_TO_ME;
2154	}
2155	ural_write(sc, RAL_TXRX_CSR2, tmp);
2156
2157	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2158	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2159	usb2_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2160	return;
2161
2162fail:	ural_stop_task(pm);
2163#undef N
2164}
2165
2166static void
2167ural_init(void *priv)
2168{
2169	struct ural_softc *sc = priv;
2170	struct ifnet *ifp = sc->sc_ifp;
2171	struct ieee80211com *ic = ifp->if_l2com;
2172
2173	RAL_LOCK(sc);
2174	ural_queue_command(sc, ural_init_task,
2175	    &sc->sc_synctask[0].hdr,
2176	    &sc->sc_synctask[1].hdr);
2177	RAL_UNLOCK(sc);
2178
2179	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2180		ieee80211_start_all(ic);		/* start all vap's */
2181}
2182
2183static void
2184ural_stop_task(struct usb2_proc_msg *pm)
2185{
2186	struct ural_task *task = (struct ural_task *)pm;
2187	struct ural_softc *sc = task->sc;
2188	struct ifnet *ifp = sc->sc_ifp;
2189
2190	RAL_LOCK_ASSERT(sc, MA_OWNED);
2191
2192	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2193
2194	/*
2195	 * Drain all the transfers, if not already drained:
2196	 */
2197	RAL_UNLOCK(sc);
2198	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_WR]);
2199	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_RD]);
2200	RAL_LOCK(sc);
2201
2202	ural_unsetup_tx_list(sc);
2203
2204	/* disable Rx */
2205	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2206	/* reset ASIC and BBP (but won't reset MAC registers!) */
2207	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2208	ural_write(sc, RAL_MAC_CSR1, 0);
2209}
2210
2211static int
2212ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2213	const struct ieee80211_bpf_params *params)
2214{
2215	struct ieee80211com *ic = ni->ni_ic;
2216	struct ifnet *ifp = ic->ic_ifp;
2217	struct ural_softc *sc = ifp->if_softc;
2218
2219	RAL_LOCK(sc);
2220	/* prevent management frames from being sent if we're not ready */
2221	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2222		RAL_UNLOCK(sc);
2223		m_freem(m);
2224		ieee80211_free_node(ni);
2225		return ENETDOWN;
2226	}
2227	if (sc->tx_nfree == 0) {
2228		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2229		RAL_UNLOCK(sc);
2230		m_freem(m);
2231		ieee80211_free_node(ni);
2232		return EIO;
2233	}
2234
2235	ifp->if_opackets++;
2236
2237	if (params == NULL) {
2238		/*
2239		 * Legacy path; interpret frame contents to decide
2240		 * precisely how to send the frame.
2241		 */
2242		if (ural_tx_mgt(sc, m, ni) != 0)
2243			goto bad;
2244	} else {
2245		/*
2246		 * Caller supplied explicit parameters to use in
2247		 * sending the frame.
2248		 */
2249		if (ural_tx_raw(sc, m, ni, params) != 0)
2250			goto bad;
2251	}
2252	RAL_UNLOCK(sc);
2253	return 0;
2254bad:
2255	ifp->if_oerrors++;
2256	RAL_UNLOCK(sc);
2257	ieee80211_free_node(ni);
2258	return EIO;		/* XXX */
2259}
2260
2261static void
2262ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
2263{
2264	struct ieee80211vap *vap = ni->ni_vap;
2265	struct ural_vap *uvp = URAL_VAP(vap);
2266
2267	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2268	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2269
2270	ieee80211_amrr_node_init(&uvp->amrr, &URAL_NODE(ni)->amn, ni);
2271
2272	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2273}
2274
2275static void
2276ural_amrr_timeout(void *arg)
2277{
2278	struct ural_vap *uvp = arg;
2279	struct ural_softc *sc = uvp->sc;
2280
2281	ural_queue_command(sc, ural_amrr_task,
2282	    &uvp->amrr_task[0].hdr, &uvp->amrr_task[1].hdr);
2283}
2284
2285static void
2286ural_amrr_task(struct usb2_proc_msg *pm)
2287{
2288	struct ural_task *task = (struct ural_task *)pm;
2289	struct ural_softc *sc = task->sc;
2290	struct ifnet *ifp = sc->sc_ifp;
2291	struct ieee80211com *ic = ifp->if_l2com;
2292	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2293	struct ural_vap *uvp = URAL_VAP(vap);
2294	struct ieee80211_node *ni = vap->iv_bss;
2295	int ok, fail;
2296
2297	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2298	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2299
2300	ok = sc->sta[7] +		/* TX ok w/o retry */
2301	     sc->sta[8];		/* TX ok w/ retry */
2302	fail = sc->sta[9];		/* TX retry-fail count */
2303
2304	ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2305	    ok+fail, ok, sc->sta[8] + fail);
2306	(void) ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn);
2307
2308	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2309
2310	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2311}
2312
2313static void
2314ural_queue_command(struct ural_softc *sc, usb2_proc_callback_t *fn,
2315    struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2316{
2317	struct ural_task *task;
2318
2319	RAL_LOCK_ASSERT(sc, MA_OWNED);
2320
2321	if (usb2_proc_is_gone(&sc->sc_tq)) {
2322		DPRINTF("proc is gone\n");
2323		return;         /* nothing to do */
2324	}
2325	/*
2326	 * NOTE: The task cannot get executed before we drop the
2327	 * "sc_mtx" mutex. It is safe to update fields in the message
2328	 * structure after that the message got queued.
2329	 */
2330	task = (struct ural_task *)
2331	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2332
2333	/* Setup callback and softc pointers */
2334	task->hdr.pm_callback = fn;
2335	task->sc = sc;
2336
2337	/*
2338	 * Init and stop must be synchronous!
2339	 */
2340	if ((fn == ural_init_task) || (fn == ural_stop_task))
2341		usb2_proc_mwait(&sc->sc_tq, t0, t1);
2342}
2343
2344