if_ural.c revision 187970
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 187970 2009-02-01 00:51:25Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 *
22 */
23
24/*
25 *
26 * NOTE: all function names beginning like "ural_cfg_" can only
27 * be called from within the config thread function !
28 */
29
30#include <sys/cdefs.h>
31__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 187970 2009-02-01 00:51:25Z thompsa $");
32
33/*-
34 * Ralink Technology RT2500USB chipset driver
35 * http://www.ralinktech.com/
36 */
37
38#include <dev/usb2/include/usb2_devid.h>
39#include <dev/usb2/include/usb2_standard.h>
40#include <dev/usb2/include/usb2_mfunc.h>
41#include <dev/usb2/include/usb2_error.h>
42
43#define	usb2_config_td_cc ural_config_copy
44#define	usb2_config_td_softc ural_softc
45
46#define	USB_DEBUG_VAR ural_debug
47
48#include <dev/usb2/core/usb2_core.h>
49#include <dev/usb2/core/usb2_lookup.h>
50#include <dev/usb2/core/usb2_process.h>
51#include <dev/usb2/core/usb2_config_td.h>
52#include <dev/usb2/core/usb2_debug.h>
53#include <dev/usb2/core/usb2_request.h>
54#include <dev/usb2/core/usb2_busdma.h>
55#include <dev/usb2/core/usb2_util.h>
56
57#include <dev/usb2/wlan/usb2_wlan.h>
58#include <dev/usb2/wlan/if_uralreg.h>
59#include <dev/usb2/wlan/if_uralvar.h>
60
61#if USB_DEBUG
62static int ural_debug = 0;
63
64SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
65SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
66    "Debug level");
67#endif
68
69#define	URAL_RSSI(rssi)	\
70  ((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ? \
71   ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
72
73/* prototypes */
74
75static device_probe_t ural_probe;
76static device_attach_t ural_attach;
77static device_detach_t ural_detach;
78
79static usb2_callback_t ural_bulk_read_callback;
80static usb2_callback_t ural_bulk_read_clear_stall_callback;
81static usb2_callback_t ural_bulk_write_callback;
82static usb2_callback_t ural_bulk_write_clear_stall_callback;
83
84static usb2_config_td_command_t ural_cfg_first_time_setup;
85static usb2_config_td_command_t ural_config_copy;
86static usb2_config_td_command_t ural_cfg_scan_start;
87static usb2_config_td_command_t ural_cfg_scan_end;
88static usb2_config_td_command_t ural_cfg_set_chan;
89static usb2_config_td_command_t ural_cfg_enable_tsf_sync;
90static usb2_config_td_command_t ural_cfg_update_slot;
91static usb2_config_td_command_t ural_cfg_set_txpreamble;
92static usb2_config_td_command_t ural_cfg_update_promisc;
93static usb2_config_td_command_t ural_cfg_pre_init;
94static usb2_config_td_command_t ural_cfg_init;
95static usb2_config_td_command_t ural_cfg_pre_stop;
96static usb2_config_td_command_t ural_cfg_stop;
97static usb2_config_td_command_t ural_cfg_amrr_timeout;
98static usb2_config_td_command_t ural_cfg_newstate;
99
100static void	ural_cfg_do_request(struct ural_softc *,
101		    struct usb2_device_request *, void *);
102static void	ural_cfg_set_testmode(struct ural_softc *);
103static void	ural_cfg_eeprom_read(struct ural_softc *, uint16_t, void *,
104		    uint16_t);
105static uint16_t	ural_cfg_read(struct ural_softc *, uint16_t);
106static void	ural_cfg_read_multi(struct ural_softc *, uint16_t, void *,
107		    uint16_t);
108static void	ural_cfg_write(struct ural_softc *, uint16_t, uint16_t);
109static void	ural_cfg_write_multi(struct ural_softc *, uint16_t, void *,
110		    uint16_t);
111static void	ural_cfg_bbp_write(struct ural_softc *, uint8_t, uint8_t);
112static uint8_t	ural_cfg_bbp_read(struct ural_softc *, uint8_t);
113static void	ural_cfg_rf_write(struct ural_softc *, uint8_t, uint32_t);
114static void	ural_end_of_commands(struct ural_softc *);
115static const char *ural_get_rf(int rev);
116static void	ural_watchdog(void *);
117static void	ural_init_cb(void *);
118static int	ural_ioctl_cb(struct ifnet *, u_long cmd, caddr_t data);
119static void	ural_start_cb(struct ifnet *);
120static int	ural_newstate_cb(struct ieee80211vap *,
121		    enum ieee80211_state, int);
122static void	ural_std_command(struct ieee80211com *,
123		    usb2_config_td_command_t *);
124static void	ural_scan_start_cb(struct ieee80211com *);
125static void	ural_scan_end_cb(struct ieee80211com *);
126static void	ural_set_channel_cb(struct ieee80211com *);
127static void	ural_cfg_disable_rf_tune(struct ural_softc *);
128static void	ural_cfg_set_bssid(struct ural_softc *, uint8_t *);
129static void	ural_cfg_set_macaddr(struct ural_softc *, uint8_t *);
130static void	ural_cfg_set_txantenna(struct ural_softc *, uint8_t);
131static void	ural_cfg_set_rxantenna(struct ural_softc *, uint8_t);
132static void	ural_cfg_read_eeprom(struct ural_softc *);
133static uint8_t	ural_cfg_bbp_init(struct ural_softc *);
134static void	ural_cfg_amrr_start(struct ural_softc *);
135static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
136		    const char name[IFNAMSIZ], int unit, int opmode, int flags,
137		    const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t
138		    mac[IEEE80211_ADDR_LEN]);
139static void	ural_vap_delete(struct ieee80211vap *);
140static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
141		    const uint8_t mac[IEEE80211_ADDR_LEN]);
142static void	ural_newassoc(struct ieee80211_node *, int);
143static void	ural_cfg_disable_tsf_sync(struct ural_softc *);
144static void	ural_cfg_set_run(struct ural_softc *,
145		    struct usb2_config_td_cc *);
146static void	ural_fill_write_queue(struct ural_softc *);
147static void	ural_tx_clean_queue(struct ural_softc *);
148static void	ural_tx_freem(struct mbuf *);
149static void	ural_tx_mgt(struct ural_softc *, struct mbuf *,
150		    struct ieee80211_node *);
151static struct ieee80211vap *ural_get_vap(struct ural_softc *);
152static void	ural_tx_bcn(struct ural_softc *);
153static void	ural_tx_data(struct ural_softc *, struct mbuf *,
154		    struct ieee80211_node *);
155static void	ural_tx_prot(struct ural_softc *, const struct mbuf *,
156		    struct ieee80211_node *, uint8_t, uint16_t);
157static void	ural_tx_raw(struct ural_softc *, struct mbuf *,
158		    struct ieee80211_node *,
159		    const struct ieee80211_bpf_params *);
160static int	ural_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
161		    const struct ieee80211_bpf_params *);
162static void	ural_setup_desc_and_tx(struct ural_softc *, struct mbuf *,
163		    uint32_t, uint16_t);
164static void	ural_update_mcast_cb(struct ifnet *);
165static void	ural_update_promisc_cb(struct ifnet *);
166
167/* various supported device vendors/products */
168static const struct usb2_device_id ural_devs[] = {
169	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G, 0)},
170	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570, 0)},
171	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050, 0)},
172	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051, 0)},
173	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS, 0)},
174	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G, 0)},
175	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP, 0)},
176	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU, 0)},
177	{USB_VPI(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122, 0)},
178	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G, 0)},
179	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG, 0)},
180	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254, 0)},
181	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54, 0)},
182	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI, 0)},
183	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB, 0)},
184	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI, 0)},
185	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570, 0)},
186	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2, 0)},
187	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3, 0)},
188	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902, 0)},
189	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570, 0)},
190	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2, 0)},
191	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3, 0)},
192	{USB_VPI(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G, 0)},
193	{USB_VPI(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG, 0)},
194	{USB_VPI(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R, 0)},
195	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570, 0)},
196	{USB_VPI(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570, 0)},
197	{USB_VPI(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570, 0)},
198};
199
200/*
201 * Default values for MAC registers; values taken from
202 * the reference driver:
203 */
204struct ural_def_mac {
205	uint16_t reg;
206	uint16_t val;
207};
208
209static const struct ural_def_mac ural_def_mac[] = {
210	{RAL_TXRX_CSR5, 0x8c8d},
211	{RAL_TXRX_CSR6, 0x8b8a},
212	{RAL_TXRX_CSR7, 0x8687},
213	{RAL_TXRX_CSR8, 0x0085},
214	{RAL_MAC_CSR13, 0x1111},
215	{RAL_MAC_CSR14, 0x1e11},
216	{RAL_TXRX_CSR21, 0xe78f},
217	{RAL_MAC_CSR9, 0xff1d},
218	{RAL_MAC_CSR11, 0x0002},
219	{RAL_MAC_CSR22, 0x0053},
220	{RAL_MAC_CSR15, 0x0000},
221	{RAL_MAC_CSR8, RAL_FRAME_SIZE},
222	{RAL_TXRX_CSR19, 0x0000},
223	{RAL_TXRX_CSR18, 0x005a},
224	{RAL_PHY_CSR2, 0x0000},
225	{RAL_TXRX_CSR0, 0x1ec0},
226	{RAL_PHY_CSR4, 0x000f}
227};
228
229/*
230 * Default values for BBP registers; values taken from the reference driver.
231 */
232struct ural_def_bbp {
233	uint8_t	reg;
234	uint8_t	val;
235};
236
237static const struct ural_def_bbp ural_def_bbp[] = {
238	{3, 0x02},
239	{4, 0x19},
240	{14, 0x1c},
241	{15, 0x30},
242	{16, 0xac},
243	{17, 0x48},
244	{18, 0x18},
245	{19, 0xff},
246	{20, 0x1e},
247	{21, 0x08},
248	{22, 0x08},
249	{23, 0x08},
250	{24, 0x80},
251	{25, 0x50},
252	{26, 0x08},
253	{27, 0x23},
254	{30, 0x10},
255	{31, 0x2b},
256	{32, 0xb9},
257	{34, 0x12},
258	{35, 0x50},
259	{39, 0xc4},
260	{40, 0x02},
261	{41, 0x60},
262	{53, 0x10},
263	{54, 0x18},
264	{56, 0x08},
265	{57, 0x10},
266	{58, 0x08},
267	{61, 0x60},
268	{62, 0x10},
269	{75, 0xff}
270};
271
272/*
273 * Default values for RF register R2 indexed by channel numbers.
274 */
275static const uint32_t ural_rf2522_r2[] = {
276	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
277	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
278};
279
280static const uint32_t ural_rf2523_r2[] = {
281	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
282	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
283};
284
285static const uint32_t ural_rf2524_r2[] = {
286	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
287	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
288};
289
290static const uint32_t ural_rf2525_r2[] = {
291	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
292	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
293};
294
295static const uint32_t ural_rf2525_hi_r2[] = {
296	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
297	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
298};
299
300static const uint32_t ural_rf2525e_r2[] = {
301	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
302	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
303};
304
305static const uint32_t ural_rf2526_hi_r2[] = {
306	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
307	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
308};
309
310static const uint32_t ural_rf2526_r2[] = {
311	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
312	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
313};
314
315/*
316 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
317 * values taken from the reference driver.
318 */
319struct ural_rf5222 {
320	uint8_t	chan;
321	uint32_t r1;
322	uint32_t r2;
323	uint32_t r4;
324};
325
326static const struct ural_rf5222 ural_rf5222[] = {
327	{1, 0x08808, 0x0044d, 0x00282},
328	{2, 0x08808, 0x0044e, 0x00282},
329	{3, 0x08808, 0x0044f, 0x00282},
330	{4, 0x08808, 0x00460, 0x00282},
331	{5, 0x08808, 0x00461, 0x00282},
332	{6, 0x08808, 0x00462, 0x00282},
333	{7, 0x08808, 0x00463, 0x00282},
334	{8, 0x08808, 0x00464, 0x00282},
335	{9, 0x08808, 0x00465, 0x00282},
336	{10, 0x08808, 0x00466, 0x00282},
337	{11, 0x08808, 0x00467, 0x00282},
338	{12, 0x08808, 0x00468, 0x00282},
339	{13, 0x08808, 0x00469, 0x00282},
340	{14, 0x08808, 0x0046b, 0x00286},
341
342	{36, 0x08804, 0x06225, 0x00287},
343	{40, 0x08804, 0x06226, 0x00287},
344	{44, 0x08804, 0x06227, 0x00287},
345	{48, 0x08804, 0x06228, 0x00287},
346	{52, 0x08804, 0x06229, 0x00287},
347	{56, 0x08804, 0x0622a, 0x00287},
348	{60, 0x08804, 0x0622b, 0x00287},
349	{64, 0x08804, 0x0622c, 0x00287},
350
351	{100, 0x08804, 0x02200, 0x00283},
352	{104, 0x08804, 0x02201, 0x00283},
353	{108, 0x08804, 0x02202, 0x00283},
354	{112, 0x08804, 0x02203, 0x00283},
355	{116, 0x08804, 0x02204, 0x00283},
356	{120, 0x08804, 0x02205, 0x00283},
357	{124, 0x08804, 0x02206, 0x00283},
358	{128, 0x08804, 0x02207, 0x00283},
359	{132, 0x08804, 0x02208, 0x00283},
360	{136, 0x08804, 0x02209, 0x00283},
361	{140, 0x08804, 0x0220a, 0x00283},
362
363	{149, 0x08808, 0x02429, 0x00281},
364	{153, 0x08808, 0x0242b, 0x00281},
365	{157, 0x08808, 0x0242d, 0x00281},
366	{161, 0x08808, 0x0242f, 0x00281}
367};
368
369static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
370	[URAL_BULK_DT_WR] = {
371		.type = UE_BULK,
372		.endpoint = UE_ADDR_ANY,
373		.direction = UE_DIR_OUT,
374		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
375		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
376		.mh.callback = &ural_bulk_write_callback,
377		.mh.timeout = 5000,	/* ms */
378	},
379
380	[URAL_BULK_DT_RD] = {
381		.type = UE_BULK,
382		.endpoint = UE_ADDR_ANY,
383		.direction = UE_DIR_IN,
384		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
385		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
386		.mh.callback = &ural_bulk_read_callback,
387	},
388
389	[URAL_BULK_CS_WR] = {
390		.type = UE_CONTROL,
391		.endpoint = 0x00,	/* Control pipe */
392		.direction = UE_DIR_ANY,
393		.mh.bufsize = sizeof(struct usb2_device_request),
394		.mh.callback = &ural_bulk_write_clear_stall_callback,
395		.mh.timeout = 1000,	/* 1 second */
396		.mh.interval = 50,	/* 50ms */
397	},
398
399	[URAL_BULK_CS_RD] = {
400		.type = UE_CONTROL,
401		.endpoint = 0x00,	/* Control pipe */
402		.direction = UE_DIR_ANY,
403		.mh.bufsize = sizeof(struct usb2_device_request),
404		.mh.callback = &ural_bulk_read_clear_stall_callback,
405		.mh.timeout = 1000,	/* 1 second */
406		.mh.interval = 50,	/* 50ms */
407	},
408};
409
410static devclass_t ural_devclass;
411
412static device_method_t ural_methods[] = {
413	DEVMETHOD(device_probe, ural_probe),
414	DEVMETHOD(device_attach, ural_attach),
415	DEVMETHOD(device_detach, ural_detach),
416	{0, 0}
417};
418
419static driver_t ural_driver = {
420	.name = "ural",
421	.methods = ural_methods,
422	.size = sizeof(struct ural_softc),
423};
424
425DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
426MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
427MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
428MODULE_DEPEND(ural, wlan, 1, 1, 1);
429MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
430
431static int
432ural_probe(device_t dev)
433{
434	struct usb2_attach_arg *uaa = device_get_ivars(dev);
435
436	if (uaa->usb2_mode != USB_MODE_HOST) {
437		return (ENXIO);
438	}
439	if (uaa->info.bConfigIndex != 0) {
440		return (ENXIO);
441	}
442	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX) {
443		return (ENXIO);
444	}
445	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
446}
447
448static int
449ural_attach(device_t dev)
450{
451	struct usb2_attach_arg *uaa = device_get_ivars(dev);
452	struct ural_softc *sc = device_get_softc(dev);
453	int error;
454	uint8_t iface_index;
455
456	device_set_usb2_desc(dev);
457
458	mtx_init(&sc->sc_mtx, "ural lock", MTX_NETWORK_LOCK,
459	    MTX_DEF | MTX_RECURSE);
460
461	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
462	    device_get_nameunit(dev));
463
464	sc->sc_udev = uaa->device;
465	sc->sc_unit = device_get_unit(dev);
466
467	usb2_callout_init_mtx(&sc->sc_watchdog, &sc->sc_mtx, 0);
468
469	iface_index = RAL_IFACE_INDEX;
470	error = usb2_transfer_setup(uaa->device,
471	    &iface_index, sc->sc_xfer, ural_config,
472	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
473
474	if (error) {
475		device_printf(dev, "could not allocate USB transfers, "
476		    "err=%s\n", usb2_errstr(error));
477		goto detach;
478	}
479	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
480	    &ural_end_of_commands,
481	    sizeof(struct usb2_config_td_cc), 24);
482	if (error) {
483		device_printf(dev, "could not setup config "
484		    "thread!\n");
485		goto detach;
486	}
487	mtx_lock(&sc->sc_mtx);
488
489	/* start setup */
490
491	usb2_config_td_queue_command
492	    (&sc->sc_config_td, NULL, &ural_cfg_first_time_setup, 0, 0);
493
494	ural_watchdog(sc);
495	mtx_unlock(&sc->sc_mtx);
496	return (0);			/* success */
497
498detach:
499	ural_detach(dev);
500	return (ENXIO);			/* failure */
501}
502
503static int
504ural_detach(device_t dev)
505{
506	struct ural_softc *sc = device_get_softc(dev);
507	struct ieee80211com *ic;
508	struct ifnet *ifp;
509
510	usb2_config_td_drain(&sc->sc_config_td);
511
512	mtx_lock(&sc->sc_mtx);
513
514	usb2_callout_stop(&sc->sc_watchdog);
515
516	ural_cfg_pre_stop(sc, NULL, 0);
517
518	ifp = sc->sc_ifp;
519	ic = ifp->if_l2com;
520
521	mtx_unlock(&sc->sc_mtx);
522
523	/* stop all USB transfers first */
524	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
525
526	/* get rid of any late children */
527	bus_generic_detach(dev);
528
529	if (ifp) {
530		bpfdetach(ifp);
531		ieee80211_ifdetach(ic);
532		if_free(ifp);
533	}
534	usb2_config_td_unsetup(&sc->sc_config_td);
535
536	usb2_callout_drain(&sc->sc_watchdog);
537
538	mtx_destroy(&sc->sc_mtx);
539
540	return (0);
541}
542
543/*========================================================================*
544 * REGISTER READ / WRITE WRAPPER ROUTINES
545 *========================================================================*/
546
547static void
548ural_cfg_do_request(struct ural_softc *sc, struct usb2_device_request *req,
549    void *data)
550{
551	uint16_t length;
552	usb2_error_t err;
553
554repeat:
555
556	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
557		goto error;
558	}
559	err = usb2_do_request_flags
560	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
561
562	if (err) {
563
564		DPRINTF("device request failed, err=%s "
565		    "(ignored)\n", usb2_errstr(err));
566
567		/* wait a little before next try */
568		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
569			goto error;
570		}
571		/* try until we are detached */
572		goto repeat;
573
574error:
575		/* the device has been detached */
576		length = UGETW(req->wLength);
577
578		if ((req->bmRequestType & UT_READ) && length) {
579			bzero(data, length);
580		}
581	}
582}
583
584static void
585ural_cfg_set_testmode(struct ural_softc *sc)
586{
587	struct usb2_device_request req;
588
589	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
590	req.bRequest = RAL_VENDOR_REQUEST;
591	USETW(req.wValue, 4);
592	USETW(req.wIndex, 1);
593	USETW(req.wLength, 0);
594
595	ural_cfg_do_request(sc, &req, NULL);
596}
597
598static void
599ural_cfg_eeprom_read(struct ural_softc *sc, uint16_t addr,
600    void *buf, uint16_t len)
601{
602	struct usb2_device_request req;
603
604	req.bmRequestType = UT_READ_VENDOR_DEVICE;
605	req.bRequest = RAL_READ_EEPROM;
606	USETW(req.wValue, 0);
607	USETW(req.wIndex, addr);
608	USETW(req.wLength, len);
609
610	ural_cfg_do_request(sc, &req, buf);
611}
612
613static uint16_t
614ural_cfg_read(struct ural_softc *sc, uint16_t reg)
615{
616	struct usb2_device_request req;
617	uint16_t val;
618
619	req.bmRequestType = UT_READ_VENDOR_DEVICE;
620	req.bRequest = RAL_READ_MAC;
621	USETW(req.wValue, 0);
622	USETW(req.wIndex, reg);
623	USETW(req.wLength, sizeof(val));
624
625	ural_cfg_do_request(sc, &req, &val);
626
627	return (le16toh(val));
628}
629
630static void
631ural_cfg_read_multi(struct ural_softc *sc, uint16_t reg,
632    void *buf, uint16_t len)
633{
634	struct usb2_device_request req;
635
636	req.bmRequestType = UT_READ_VENDOR_DEVICE;
637	req.bRequest = RAL_READ_MULTI_MAC;
638	USETW(req.wValue, 0);
639	USETW(req.wIndex, reg);
640	USETW(req.wLength, len);
641
642	ural_cfg_do_request(sc, &req, buf);
643}
644
645static void
646ural_cfg_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
647{
648	struct usb2_device_request req;
649
650	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
651	req.bRequest = RAL_WRITE_MAC;
652	USETW(req.wValue, val);
653	USETW(req.wIndex, reg);
654	USETW(req.wLength, 0);
655
656	ural_cfg_do_request(sc, &req, NULL);
657}
658
659static void
660ural_cfg_write_multi(struct ural_softc *sc, uint16_t reg,
661    void *buf, uint16_t len)
662{
663	struct usb2_device_request req;
664
665	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
666	req.bRequest = RAL_WRITE_MULTI_MAC;
667	USETW(req.wValue, 0);
668	USETW(req.wIndex, reg);
669	USETW(req.wLength, len);
670
671	ural_cfg_do_request(sc, &req, buf);
672}
673
674static uint8_t
675ural_cfg_bbp_disbusy(struct ural_softc *sc)
676{
677	uint16_t tmp;
678	uint8_t to;
679
680	for (to = 0;; to++) {
681		if (to < 100) {
682			tmp = ural_cfg_read(sc, RAL_PHY_CSR8);
683			tmp &= RAL_BBP_BUSY;
684
685			if (tmp == 0) {
686				return (0);
687			}
688			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
689				break;
690			}
691		} else {
692			break;
693		}
694	}
695	DPRINTF("could not disbusy BBP\n");
696	return (1);			/* failure */
697}
698
699static void
700ural_cfg_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
701{
702	uint16_t tmp;
703
704	if (ural_cfg_bbp_disbusy(sc)) {
705		return;
706	}
707	tmp = (reg << 8) | val;
708	ural_cfg_write(sc, RAL_PHY_CSR7, tmp);
709}
710
711static uint8_t
712ural_cfg_bbp_read(struct ural_softc *sc, uint8_t reg)
713{
714	uint16_t val;
715
716	if (ural_cfg_bbp_disbusy(sc)) {
717		return (0);
718	}
719	val = RAL_BBP_WRITE | (reg << 8);
720	ural_cfg_write(sc, RAL_PHY_CSR7, val);
721
722	if (ural_cfg_bbp_disbusy(sc)) {
723		return (0);
724	}
725	return (ural_cfg_read(sc, RAL_PHY_CSR7) & 0xff);
726}
727
728static void
729ural_cfg_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
730{
731	uint32_t tmp;
732	uint8_t to;
733
734	reg &= 3;
735
736	/* remember last written value */
737	sc->sc_rf_regs[reg] = val;
738
739	for (to = 0;; to++) {
740		if (to < 100) {
741			tmp = ural_cfg_read(sc, RAL_PHY_CSR10);
742
743			if (!(tmp & RAL_RF_LOBUSY)) {
744				break;
745			}
746			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
747				return;
748			}
749		} else {
750			DPRINTF("could not write to RF\n");
751			return;
752		}
753	}
754
755	tmp = RAL_RF_BUSY | RAL_RF_20BIT | ((val & 0xfffff) << 2) | reg;
756	ural_cfg_write(sc, RAL_PHY_CSR9, tmp & 0xffff);
757	ural_cfg_write(sc, RAL_PHY_CSR10, tmp >> 16);
758
759	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
760}
761
762static void
763ural_cfg_first_time_setup(struct ural_softc *sc,
764    struct usb2_config_td_cc *cc, uint16_t refcount)
765{
766	struct ieee80211com *ic;
767	struct ifnet *ifp;
768	uint8_t bands;
769
770	/* setup RX tap header */
771	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
772	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
773	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
774
775	/* setup TX tap header */
776	sc->sc_txtap_len = sizeof(sc->sc_txtap);
777	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
778	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
779
780	/* retrieve RT2570 rev. no */
781	sc->sc_asic_rev = ural_cfg_read(sc, RAL_MAC_CSR0);
782
783	/* retrieve MAC address and various other things from EEPROM */
784	ural_cfg_read_eeprom(sc);
785
786	printf("%s: MAC/BBP RT2570 (rev 0x%02x), RF %s (0x%02x)\n",
787	    sc->sc_name, sc->sc_asic_rev, ural_get_rf(sc->sc_rf_rev),
788	    sc->sc_rf_rev);
789
790	mtx_unlock(&sc->sc_mtx);
791
792	ifp = if_alloc(IFT_IEEE80211);
793
794	mtx_lock(&sc->sc_mtx);
795
796	if (ifp == NULL) {
797		DPRINTFN(0, "could not if_alloc()!\n");
798		goto done;
799	}
800	sc->sc_ifp = ifp;
801	ic = ifp->if_l2com;
802
803	ifp->if_softc = sc;
804	if_initname(ifp, "ural", sc->sc_unit);
805	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
806	ifp->if_init = &ural_init_cb;
807	ifp->if_ioctl = &ural_ioctl_cb;
808	ifp->if_start = &ural_start_cb;
809	ifp->if_watchdog = NULL;
810	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
811	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
812	IFQ_SET_READY(&ifp->if_snd);
813
814	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
815
816	ic->ic_ifp = ifp;
817	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
818	ic->ic_opmode = IEEE80211_M_STA;
819
820	/* set device capabilities */
821	ic->ic_caps =
822	    IEEE80211_C_STA		/* station mode supported */
823	    | IEEE80211_C_IBSS		/* IBSS mode supported */
824	    | IEEE80211_C_MONITOR	/* monitor mode supported */
825	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
826	    | IEEE80211_C_TXPMGT	/* tx power management */
827	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
828	    | IEEE80211_C_SHSLOT	/* short slot time supported */
829	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
830	    | IEEE80211_C_WPA		/* 802.11i */
831	    ;
832
833	bands = 0;
834	setbit(&bands, IEEE80211_MODE_11B);
835	setbit(&bands, IEEE80211_MODE_11G);
836
837	if (sc->sc_rf_rev == RAL_RF_5222) {
838		setbit(&bands, IEEE80211_MODE_11A);
839	}
840	ieee80211_init_channels(ic, NULL, &bands);
841
842	mtx_unlock(&sc->sc_mtx);
843
844	ieee80211_ifattach(ic);
845
846	mtx_lock(&sc->sc_mtx);
847
848	ic->ic_newassoc = &ural_newassoc;
849	ic->ic_raw_xmit = &ural_raw_xmit_cb;
850	ic->ic_node_alloc = &ural_node_alloc;
851	ic->ic_update_mcast = &ural_update_mcast_cb;
852	ic->ic_update_promisc = &ural_update_promisc_cb;
853	ic->ic_scan_start = &ural_scan_start_cb;
854	ic->ic_scan_end = &ural_scan_end_cb;
855	ic->ic_set_channel = &ural_set_channel_cb;
856	ic->ic_vap_create = &ural_vap_create;
857	ic->ic_vap_delete = &ural_vap_delete;
858
859	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
860
861	mtx_unlock(&sc->sc_mtx);
862
863	bpfattach(ifp, DLT_IEEE802_11_RADIO,
864	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
865
866	if (bootverbose) {
867		ieee80211_announce(ic);
868	}
869	mtx_lock(&sc->sc_mtx);
870done:
871	return;
872}
873
874static void
875ural_end_of_commands(struct ural_softc *sc)
876{
877	sc->sc_flags &= ~URAL_FLAG_WAIT_COMMAND;
878
879	/* start write transfer, if not started */
880	usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
881}
882
883static void
884ural_config_copy_chan(struct ural_config_copy_chan *cc,
885    struct ieee80211com *ic, struct ieee80211_channel *c)
886{
887	if (!c)
888		return;
889	cc->chan_to_ieee =
890	    ieee80211_chan2ieee(ic, c);
891	if (c != IEEE80211_CHAN_ANYC) {
892		cc->chan_to_mode =
893		    ieee80211_chan2mode(c);
894		if (IEEE80211_IS_CHAN_B(c))
895			cc->chan_is_b = 1;
896		if (IEEE80211_IS_CHAN_A(c))
897			cc->chan_is_a = 1;
898		if (IEEE80211_IS_CHAN_2GHZ(c))
899			cc->chan_is_2ghz = 1;
900		if (IEEE80211_IS_CHAN_5GHZ(c))
901			cc->chan_is_5ghz = 1;
902		if (IEEE80211_IS_CHAN_ANYG(c))
903			cc->chan_is_g = 1;
904	}
905}
906
907static void
908ural_config_copy(struct ural_softc *sc,
909    struct usb2_config_td_cc *cc, uint16_t refcount)
910{
911	struct ifnet *ifp;
912	struct ieee80211com *ic;
913	struct ieee80211_node *ni;
914	struct ieee80211vap *vap;
915	const struct ieee80211_txparam *tp;
916
917	bzero(cc, sizeof(*cc));
918
919	ifp = sc->sc_ifp;
920	if (ifp) {
921		cc->if_flags = ifp->if_flags;
922		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
923		    sizeof(cc->if_broadcastaddr));
924
925		ic = ifp->if_l2com;
926		if (ic) {
927			ural_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
928			ural_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
929			vap = TAILQ_FIRST(&ic->ic_vaps);
930			if (vap) {
931				ni = vap->iv_bss;
932				if (ni) {
933					cc->iv_bss.ni_intval = ni->ni_intval;
934					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
935					    sizeof(cc->iv_bss.ni_bssid));
936				}
937				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
938				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
939					cc->iv_bss.fixed_rate_none = 1;
940				}
941			}
942			cc->ic_opmode = ic->ic_opmode;
943			cc->ic_flags = ic->ic_flags;
944			cc->ic_txpowlimit = ic->ic_txpowlimit;
945			cc->ic_curmode = ic->ic_curmode;
946
947			bcopy(ic->ic_myaddr, cc->ic_myaddr,
948			    sizeof(cc->ic_myaddr));
949		}
950	}
951	sc->sc_flags |= URAL_FLAG_WAIT_COMMAND;
952}
953
954static const char *
955ural_get_rf(int rev)
956{
957	;				/* style fix */
958
959	switch (rev) {
960	case RAL_RF_2522:
961		return "RT2522";
962	case RAL_RF_2523:
963		return "RT2523";
964	case RAL_RF_2524:
965		return "RT2524";
966	case RAL_RF_2525:
967		return "RT2525";
968	case RAL_RF_2525E:
969		return "RT2525e";
970	case RAL_RF_2526:
971		return "RT2526";
972	case RAL_RF_5222:
973		return "RT5222";
974	default:
975		return "unknown";
976	}
977}
978
979/*------------------------------------------------------------------------*
980 * ural_bulk_read_callback - data read "thread"
981 *------------------------------------------------------------------------*/
982static void
983ural_bulk_read_callback(struct usb2_xfer *xfer)
984{
985	struct ural_softc *sc = xfer->priv_sc;
986	struct ifnet *ifp = sc->sc_ifp;
987	struct ieee80211com *ic = ifp->if_l2com;
988	struct ieee80211_node *ni;
989	struct mbuf *m = NULL;
990	uint32_t flags;
991	uint32_t max_len;
992	uint32_t real_len;
993	uint8_t rssi = 0;
994
995	switch (USB_GET_STATE(xfer)) {
996	case USB_ST_TRANSFERRED:
997
998		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
999
1000		if (xfer->actlen < RAL_RX_DESC_SIZE) {
1001			DPRINTF("too short transfer, "
1002			    "%d bytes\n", xfer->actlen);
1003			ifp->if_ierrors++;
1004			goto tr_setup;
1005		}
1006		max_len = (xfer->actlen - RAL_RX_DESC_SIZE);
1007
1008		usb2_copy_out(xfer->frbuffers, max_len,
1009		    &sc->sc_rx_desc, RAL_RX_DESC_SIZE);
1010
1011		flags = le32toh(sc->sc_rx_desc.flags);
1012
1013		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
1014			/*
1015		         * This should not happen since we did not
1016		         * request to receive those frames when we
1017		         * filled RAL_TXRX_CSR2:
1018		         */
1019			DPRINTFN(6, "PHY or CRC error\n");
1020			ifp->if_ierrors++;
1021			goto tr_setup;
1022		}
1023		if (max_len > MCLBYTES) {
1024			max_len = MCLBYTES;
1025		}
1026		real_len = (flags >> 16) & 0xfff;
1027
1028		if (real_len > max_len) {
1029			DPRINTF("invalid length in RX "
1030			    "descriptor, %u bytes, received %u bytes\n",
1031			    real_len, max_len);
1032			ifp->if_ierrors++;
1033			goto tr_setup;
1034		}
1035		/* ieee80211_input() will check if the mbuf is too short */
1036
1037		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1038
1039		if (m == NULL) {
1040			DPRINTF("could not allocate mbuf\n");
1041			ifp->if_ierrors++;
1042			goto tr_setup;
1043		}
1044		usb2_copy_out(xfer->frbuffers, 0, m->m_data, max_len);
1045
1046		/* finalize mbuf */
1047		m->m_pkthdr.rcvif = ifp;
1048		m->m_pkthdr.len = m->m_len = real_len;
1049
1050		DPRINTF("real length=%d bytes\n", real_len);
1051
1052		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
1053
1054		if (bpf_peers_present(ifp->if_bpf)) {
1055			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
1056
1057			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1058			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1059			    (sc->sc_rx_desc.flags & htole32(RAL_RX_OFDM)) ?
1060			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1061
1062			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1063			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1064			tap->wr_antenna = sc->sc_rx_ant;
1065			tap->wr_antsignal = rssi;
1066
1067			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1068		}
1069		/* Strip trailing 802.11 MAC FCS. */
1070		m_adj(m, -IEEE80211_CRC_LEN);
1071
1072	case USB_ST_SETUP:
1073tr_setup:
1074
1075		if (sc->sc_flags & URAL_FLAG_READ_STALL) {
1076			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_RD]);
1077		} else {
1078			xfer->frlengths[0] = xfer->max_data_length;
1079			usb2_start_hardware(xfer);
1080		}
1081
1082		/*
1083		 * At the end of a USB callback it is always safe to unlock
1084		 * the private mutex of a device! That is why we do the
1085		 * "ieee80211_input" here, and not some lines up!
1086		 */
1087		if (m) {
1088			mtx_unlock(&sc->sc_mtx);
1089
1090			ni = ieee80211_find_rxnode(ic, (void *)(m->m_data));
1091
1092			if (ni) {
1093				/* send the frame to the 802.11 layer */
1094				if (ieee80211_input(ni, m, rssi, RAL_NOISE_FLOOR, 0)) {
1095					/* ignore */
1096				}
1097				/* node is no longer needed */
1098				ieee80211_free_node(ni);
1099			} else {
1100				/* broadcast */
1101				if (ieee80211_input_all(ic, m, rssi, RAL_NOISE_FLOOR, 0)) {
1102					/* ignore */
1103				}
1104			}
1105
1106			mtx_lock(&sc->sc_mtx);
1107		}
1108		return;
1109
1110	default:			/* Error */
1111		if (xfer->error != USB_ERR_CANCELLED) {
1112			/* try to clear stall first */
1113			sc->sc_flags |= URAL_FLAG_READ_STALL;
1114			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_RD]);
1115		}
1116		return;
1117
1118	}
1119}
1120
1121static void
1122ural_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1123{
1124	struct ural_softc *sc = xfer->priv_sc;
1125	struct usb2_xfer *xfer_other = sc->sc_xfer[URAL_BULK_DT_RD];
1126
1127	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1128		DPRINTF("stall cleared\n");
1129		sc->sc_flags &= ~URAL_FLAG_READ_STALL;
1130		usb2_transfer_start(xfer_other);
1131	}
1132}
1133
1134static uint8_t
1135ural_plcp_signal(uint16_t rate)
1136{
1137	;				/* indent fix */
1138	switch (rate) {
1139		/* CCK rates (NB: not IEEE std, device-specific) */
1140	case 2:
1141		return (0x0);
1142	case 4:
1143		return (0x1);
1144	case 11:
1145		return (0x2);
1146	case 22:
1147		return (0x3);
1148
1149		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1150	case 12:
1151		return (0xb);
1152	case 18:
1153		return (0xf);
1154	case 24:
1155		return (0xa);
1156	case 36:
1157		return (0xe);
1158	case 48:
1159		return (0x9);
1160	case 72:
1161		return (0xd);
1162	case 96:
1163		return (0x8);
1164	case 108:
1165		return (0xc);
1166
1167		/* XXX unsupported/unknown rate */
1168	default:
1169		return (0xff);
1170	}
1171}
1172
1173/*
1174 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1175 * should be freed, when "ural_setup_desc_and_tx" is called.
1176 */
1177static void
1178ural_setup_desc_and_tx(struct ural_softc *sc, struct mbuf *m,
1179    uint32_t flags, uint16_t rate)
1180{
1181	struct ifnet *ifp = sc->sc_ifp;
1182	struct ieee80211com *ic = ifp->if_l2com;
1183	struct mbuf *mm;
1184	enum ieee80211_phytype phytype;
1185	uint16_t plcp_length;
1186	uint16_t len;
1187	uint8_t remainder;
1188
1189	DPRINTF("in\n");
1190
1191	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1192		/* free packet */
1193		ural_tx_freem(m);
1194		ifp->if_oerrors++;
1195		return;
1196	}
1197	if (!((sc->sc_flags & URAL_FLAG_LL_READY) &&
1198	    (sc->sc_flags & URAL_FLAG_HL_READY))) {
1199		/* free packet */
1200		ural_tx_freem(m);
1201		ifp->if_oerrors++;
1202		return;
1203	}
1204	if (rate < 2) {
1205		DPRINTF("rate < 2!\n");
1206
1207		/* avoid division by zero */
1208		rate = 2;
1209	}
1210	ic->ic_lastdata = ticks;
1211
1212	if (bpf_peers_present(ifp->if_bpf)) {
1213		struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
1214
1215		tap->wt_flags = 0;
1216		tap->wt_rate = rate;
1217		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1218		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1219		tap->wt_antenna = sc->sc_tx_ant;
1220
1221		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1222	}
1223	len = m->m_pkthdr.len;
1224
1225	sc->sc_tx_desc.flags = htole32(flags);
1226	sc->sc_tx_desc.flags |= htole32(RAL_TX_NEWSEQ);
1227	sc->sc_tx_desc.flags |= htole32(len << 16);
1228
1229	sc->sc_tx_desc.wme = htole16(RAL_AIFSN(2) |
1230	    RAL_LOGCWMIN(3) |
1231	    RAL_LOGCWMAX(5) |
1232	    RAL_IVOFFSET(sizeof(struct ieee80211_frame)));
1233
1234	/* setup PLCP fields */
1235	sc->sc_tx_desc.plcp_signal = ural_plcp_signal(rate);
1236	sc->sc_tx_desc.plcp_service = 4;
1237
1238	len += IEEE80211_CRC_LEN;
1239
1240	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1241
1242	if (phytype == IEEE80211_T_OFDM) {
1243		sc->sc_tx_desc.flags |= htole32(RAL_TX_OFDM);
1244
1245		plcp_length = len & 0xfff;
1246		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1247		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1248
1249	} else {
1250		plcp_length = ((16 * len) + rate - 1) / rate;
1251		if (rate == 22) {
1252			remainder = (16 * len) % 22;
1253			if ((remainder != 0) && (remainder < 7)) {
1254				sc->sc_tx_desc.plcp_service |=
1255				    RAL_PLCP_LENGEXT;
1256			}
1257		}
1258		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1259		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1260
1261		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1262			sc->sc_tx_desc.plcp_signal |= 0x08;
1263		}
1264	}
1265
1266	sc->sc_tx_desc.iv = 0;
1267	sc->sc_tx_desc.eiv = 0;
1268
1269	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1270		DPRINTF("No room for header structure!\n");
1271		ural_tx_freem(m);
1272		return;
1273	}
1274	mm = m_gethdr(M_NOWAIT, MT_DATA);
1275	if (mm == NULL) {
1276		DPRINTF("Could not allocate header mbuf!\n");
1277		ural_tx_freem(m);
1278		return;
1279	}
1280	DPRINTF(" %zu %u (out)\n", sizeof(sc->sc_tx_desc), m->m_pkthdr.len);
1281
1282	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1283	mm->m_len = sizeof(sc->sc_tx_desc);
1284
1285	mm->m_next = m;
1286	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1287	mm->m_pkthdr.rcvif = NULL;
1288
1289	/* start write transfer, if not started */
1290	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1291
1292	usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
1293}
1294
1295static void
1296ural_bulk_write_callback(struct usb2_xfer *xfer)
1297{
1298	struct ural_softc *sc = xfer->priv_sc;
1299	struct ifnet *ifp = sc->sc_ifp;
1300	struct mbuf *m;
1301	uint16_t temp_len;
1302	uint8_t align;
1303
1304	switch (USB_GET_STATE(xfer)) {
1305	case USB_ST_TRANSFERRED:
1306		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
1307
1308		ifp->if_opackets++;
1309
1310	case USB_ST_SETUP:
1311		if (sc->sc_flags & URAL_FLAG_WRITE_STALL) {
1312			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_WR]);
1313			break;
1314		}
1315		if (sc->sc_flags & URAL_FLAG_WAIT_COMMAND) {
1316			/*
1317			 * don't send anything while a command is pending !
1318			 */
1319			break;
1320		}
1321		ural_fill_write_queue(sc);
1322
1323		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1324
1325		if (m) {
1326
1327			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
1328				DPRINTFN(0, "data overflow, %u bytes\n",
1329				    m->m_pkthdr.len);
1330				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
1331			}
1332			usb2_m_copy_in(xfer->frbuffers, 0,
1333			    m, 0, m->m_pkthdr.len);
1334
1335			/* compute transfer length */
1336			temp_len = m->m_pkthdr.len;
1337
1338			/* make transfer length 16-bit aligned */
1339			align = (temp_len & 1);
1340
1341			/* check if we need to add two extra bytes */
1342			if (((temp_len + align) % 64) == 0) {
1343				align += 2;
1344			}
1345			/* check if we need to align length */
1346			if (align != 0) {
1347				/* zero the extra bytes */
1348				usb2_bzero(xfer->frbuffers, temp_len, align);
1349				temp_len += align;
1350			}
1351			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
1352			    m->m_pkthdr.len, temp_len);
1353
1354			xfer->frlengths[0] = temp_len;
1355
1356			usb2_start_hardware(xfer);
1357
1358			/* free mbuf and node */
1359			ural_tx_freem(m);
1360		}
1361		break;
1362
1363	default:			/* Error */
1364		DPRINTFN(11, "transfer error, %s\n",
1365		    usb2_errstr(xfer->error));
1366
1367		if (xfer->error != USB_ERR_CANCELLED) {
1368			/* try to clear stall first */
1369			sc->sc_flags |= URAL_FLAG_WRITE_STALL;
1370			usb2_transfer_start(sc->sc_xfer[URAL_BULK_CS_WR]);
1371		}
1372		ifp->if_oerrors++;
1373		break;
1374	}
1375}
1376
1377static void
1378ural_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1379{
1380	struct ural_softc *sc = xfer->priv_sc;
1381	struct usb2_xfer *xfer_other = sc->sc_xfer[URAL_BULK_DT_WR];
1382
1383	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1384		DPRINTF("stall cleared\n");
1385		sc->sc_flags &= ~URAL_FLAG_WRITE_STALL;
1386		usb2_transfer_start(xfer_other);
1387	}
1388}
1389
1390static void
1391ural_watchdog(void *arg)
1392{
1393	struct ural_softc *sc = arg;
1394
1395	mtx_assert(&sc->sc_mtx, MA_OWNED);
1396
1397	if (sc->sc_amrr_timer) {
1398		usb2_config_td_queue_command
1399		    (&sc->sc_config_td, NULL,
1400		    &ural_cfg_amrr_timeout, 0, 0);
1401	}
1402	usb2_callout_reset(&sc->sc_watchdog,
1403	    hz, &ural_watchdog, sc);
1404}
1405
1406/*========================================================================*
1407 * IF-net callbacks
1408 *========================================================================*/
1409
1410static void
1411ural_init_cb(void *arg)
1412{
1413	struct ural_softc *sc = arg;
1414
1415	mtx_lock(&sc->sc_mtx);
1416	usb2_config_td_queue_command
1417	    (&sc->sc_config_td, &ural_cfg_pre_init,
1418	    &ural_cfg_init, 0, 0);
1419	mtx_unlock(&sc->sc_mtx);
1420}
1421
1422static int
1423ural_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1424{
1425	struct ural_softc *sc = ifp->if_softc;
1426	struct ieee80211com *ic = ifp->if_l2com;
1427	int error;
1428
1429	switch (cmd) {
1430	case SIOCSIFFLAGS:
1431		mtx_lock(&sc->sc_mtx);
1432		if (ifp->if_flags & IFF_UP) {
1433			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1434				usb2_config_td_queue_command
1435				    (&sc->sc_config_td, &ural_cfg_pre_init,
1436				    &ural_cfg_init, 0, 0);
1437			}
1438		} else {
1439			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1440				usb2_config_td_queue_command
1441				    (&sc->sc_config_td, &ural_cfg_pre_stop,
1442				    &ural_cfg_stop, 0, 0);
1443			}
1444		}
1445		mtx_unlock(&sc->sc_mtx);
1446		error = 0;
1447		break;
1448
1449	case SIOCGIFMEDIA:
1450	case SIOCSIFMEDIA:
1451		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1452		break;
1453
1454	default:
1455		error = ether_ioctl(ifp, cmd, data);
1456	}
1457	return (error);
1458}
1459
1460static void
1461ural_start_cb(struct ifnet *ifp)
1462{
1463	struct ural_softc *sc = ifp->if_softc;
1464
1465	mtx_lock(&sc->sc_mtx);
1466	/* start write transfer, if not started */
1467	usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
1468	mtx_unlock(&sc->sc_mtx);
1469}
1470
1471static void
1472ural_cfg_newstate(struct ural_softc *sc,
1473    struct usb2_config_td_cc *cc, uint16_t refcount)
1474{
1475	struct ifnet *ifp = sc->sc_ifp;
1476	struct ieee80211com *ic = ifp->if_l2com;
1477	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1478	struct ural_vap *uvp = URAL_VAP(vap);
1479	enum ieee80211_state ostate;
1480	enum ieee80211_state nstate;
1481	int arg;
1482
1483	ostate = vap->iv_state;
1484	nstate = sc->sc_ns_state;
1485	arg = sc->sc_ns_arg;
1486
1487	if (ostate == IEEE80211_S_INIT) {
1488		/* We are leaving INIT. TSF sync should be off. */
1489		ural_cfg_disable_tsf_sync(sc);
1490	}
1491	switch (nstate) {
1492	case IEEE80211_S_INIT:
1493		break;
1494
1495	case IEEE80211_S_RUN:
1496		ural_cfg_set_run(sc, cc);
1497		break;
1498
1499	default:
1500		break;
1501	}
1502
1503	mtx_unlock(&sc->sc_mtx);
1504	IEEE80211_LOCK(ic);
1505	uvp->newstate(vap, nstate, arg);
1506	if (vap->iv_newstate_cb != NULL)
1507		vap->iv_newstate_cb(vap, nstate, arg);
1508	IEEE80211_UNLOCK(ic);
1509	mtx_lock(&sc->sc_mtx);
1510}
1511
1512static int
1513ural_newstate_cb(struct ieee80211vap *vap,
1514    enum ieee80211_state nstate, int arg)
1515{
1516	struct ural_vap *uvp = URAL_VAP(vap);
1517	struct ieee80211com *ic = vap->iv_ic;
1518	struct ural_softc *sc = ic->ic_ifp->if_softc;
1519
1520	DPRINTF("setting new state: %d\n", nstate);
1521
1522	/* Special case - cannot defer this call and cannot block ! */
1523	if (nstate == IEEE80211_S_INIT) {
1524		/* stop timers */
1525		mtx_lock(&sc->sc_mtx);
1526		sc->sc_amrr_timer = 0;
1527		mtx_unlock(&sc->sc_mtx);
1528		return (uvp->newstate(vap, nstate, arg));
1529	}
1530	mtx_lock(&sc->sc_mtx);
1531	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1532		mtx_unlock(&sc->sc_mtx);
1533		return (0);		/* nothing to do */
1534	}
1535	/* store next state */
1536	sc->sc_ns_state = nstate;
1537	sc->sc_ns_arg = arg;
1538
1539	/* stop timers */
1540	sc->sc_amrr_timer = 0;
1541
1542	/*
1543	 * USB configuration can only be done from the USB configuration
1544	 * thread:
1545	 */
1546	usb2_config_td_queue_command
1547	    (&sc->sc_config_td, &ural_config_copy,
1548	    &ural_cfg_newstate, 0, 0);
1549
1550	mtx_unlock(&sc->sc_mtx);
1551
1552	return (EINPROGRESS);
1553}
1554
1555static void
1556ural_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1557{
1558	struct ural_softc *sc = ic->ic_ifp->if_softc;
1559
1560	mtx_lock(&sc->sc_mtx);
1561
1562	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1563
1564	usb2_config_td_queue_command
1565	    (&sc->sc_config_td, &ural_config_copy, func, 0, 0);
1566
1567	mtx_unlock(&sc->sc_mtx);
1568}
1569
1570static void
1571ural_scan_start_cb(struct ieee80211com *ic)
1572{
1573	ural_std_command(ic, &ural_cfg_scan_start);
1574}
1575
1576static void
1577ural_scan_end_cb(struct ieee80211com *ic)
1578{
1579	ural_std_command(ic, &ural_cfg_scan_end);
1580}
1581
1582static void
1583ural_set_channel_cb(struct ieee80211com *ic)
1584{
1585	ural_std_command(ic, &ural_cfg_set_chan);
1586}
1587
1588/*========================================================================*
1589 * configure sub-routines, ural_cfg_xxx
1590 *========================================================================*/
1591
1592static void
1593ural_cfg_scan_start(struct ural_softc *sc,
1594    struct usb2_config_td_cc *cc, uint16_t refcount)
1595{
1596	/* abort TSF synchronization */
1597	ural_cfg_disable_tsf_sync(sc);
1598	ural_cfg_set_bssid(sc, cc->if_broadcastaddr);
1599}
1600
1601static void
1602ural_cfg_scan_end(struct ural_softc *sc,
1603    struct usb2_config_td_cc *cc, uint16_t refcount)
1604{
1605	/* enable TSF synchronization */
1606	ural_cfg_enable_tsf_sync(sc, cc, 0);
1607	ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1608}
1609
1610static void
1611ural_cfg_set_chan(struct ural_softc *sc,
1612    struct usb2_config_td_cc *cc, uint16_t refcount)
1613{
1614	enum {
1615		N_RF5222 = (sizeof(ural_rf5222) / sizeof(ural_rf5222[0])),
1616	};
1617	uint32_t i;
1618	uint32_t chan;
1619	uint8_t power;
1620	uint8_t tmp;
1621
1622	chan = cc->ic_curchan.chan_to_ieee;
1623
1624	if ((chan == 0) ||
1625	    (chan == IEEE80211_CHAN_ANY)) {
1626		/* nothing to do */
1627		return;
1628	}
1629	if (cc->ic_curchan.chan_is_2ghz)
1630		power = min(sc->sc_txpow[chan - 1], 31);
1631	else
1632		power = 31;
1633
1634	/* adjust txpower using ifconfig settings */
1635	power -= (100 - cc->ic_txpowlimit) / 8;
1636
1637	DPRINTFN(3, "setting channel to %u, "
1638	    "tx-power to %u\n", chan, power);
1639
1640	switch (sc->sc_rf_rev) {
1641	case RAL_RF_2522:
1642		ural_cfg_rf_write(sc, RAL_RF1, 0x00814);
1643		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1644		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1645		break;
1646
1647	case RAL_RF_2523:
1648		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1649		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1650		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x38044);
1651		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1652		break;
1653
1654	case RAL_RF_2524:
1655		ural_cfg_rf_write(sc, RAL_RF1, 0x0c808);
1656		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1657		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1658		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1659		break;
1660
1661	case RAL_RF_2525:
1662		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1663		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1664		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1665		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1666
1667		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1668		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1669		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1670		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1671		break;
1672
1673	case RAL_RF_2525E:
1674		ural_cfg_rf_write(sc, RAL_RF1, 0x08808);
1675		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1676		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1677		ural_cfg_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1678		break;
1679
1680	case RAL_RF_2526:
1681		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1682		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1683		ural_cfg_rf_write(sc, RAL_RF1, 0x08804);
1684
1685		ural_cfg_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1686		ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x18044);
1687		ural_cfg_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1688		break;
1689
1690		/* dual-band RF */
1691	case RAL_RF_5222:
1692		for (i = 0; i < N_RF5222; i++) {
1693			if (ural_rf5222[i].chan == chan) {
1694				ural_cfg_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1695				ural_cfg_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1696				ural_cfg_rf_write(sc, RAL_RF3, (power << 7) | 0x00040);
1697				ural_cfg_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1698				break;
1699			}
1700		}
1701		break;
1702	}
1703
1704	if ((cc->ic_opmode != IEEE80211_M_MONITOR) &&
1705	    (!(cc->ic_flags & IEEE80211_F_SCAN))) {
1706
1707		/* set Japan filter bit for channel 14 */
1708		tmp = ural_cfg_bbp_read(sc, 70);
1709
1710		if (chan == 14) {
1711			tmp |= RAL_JAPAN_FILTER;
1712		} else {
1713			tmp &= ~RAL_JAPAN_FILTER;
1714		}
1715
1716		ural_cfg_bbp_write(sc, 70, tmp);
1717
1718		/* clear CRC errors */
1719		ural_cfg_read(sc, RAL_STA_CSR0);
1720
1721		ural_cfg_disable_rf_tune(sc);
1722	}
1723	/* update basic rate set */
1724	if (cc->ic_curchan.chan_is_b) {
1725		/* 11b basic rates: 1, 2Mbps */
1726		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1727	} else if (cc->ic_curchan.chan_is_a) {
1728		/* 11a basic rates: 6, 12, 24Mbps */
1729		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1730	} else {
1731		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1732		ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1733	}
1734
1735	/* wait a little */
1736	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1737		return;
1738	}
1739}
1740
1741static void
1742ural_cfg_set_run(struct ural_softc *sc,
1743    struct usb2_config_td_cc *cc)
1744{
1745	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1746		ural_cfg_update_slot(sc, cc, 0);
1747		ural_cfg_set_txpreamble(sc, cc, 0);
1748
1749		/* update basic rate set */
1750
1751		if (cc->ic_bsschan.chan_is_5ghz) {
1752			/* 11a basic rates: 6, 12, 24Mbps */
1753			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x150);
1754		} else if (cc->ic_bsschan.chan_is_g) {
1755			/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1756			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
1757		} else {
1758			/* 11b basic rates: 1, 2Mbps */
1759			ural_cfg_write(sc, RAL_TXRX_CSR11, 0x3);
1760		}
1761		ural_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1762	}
1763	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1764	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1765		ural_tx_bcn(sc);
1766	}
1767	/* make tx led blink on tx (controlled by ASIC) */
1768	ural_cfg_write(sc, RAL_MAC_CSR20, 1);
1769
1770	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1771		ural_cfg_enable_tsf_sync(sc, cc, 0);
1772	}
1773	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
1774	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
1775
1776	if (cc->iv_bss.fixed_rate_none) {
1777		/* enable automatic rate adaptation */
1778		ural_cfg_amrr_start(sc);
1779	}
1780}
1781
1782/*------------------------------------------------------------------------*
1783 * ural_cfg_disable_rf_tune - disable RF auto-tuning
1784 *------------------------------------------------------------------------*/
1785static void
1786ural_cfg_disable_rf_tune(struct ural_softc *sc)
1787{
1788	uint32_t tmp;
1789
1790	if (sc->sc_rf_rev != RAL_RF_2523) {
1791		tmp = sc->sc_rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1792		ural_cfg_rf_write(sc, RAL_RF1, tmp);
1793	}
1794	tmp = sc->sc_rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1795	ural_cfg_rf_write(sc, RAL_RF3, tmp);
1796
1797	DPRINTFN(3, "disabling RF autotune\n");
1798}
1799
1800/*------------------------------------------------------------------------*
1801 * ural_cfg_enable_tsf_sync - refer to IEEE Std 802.11-1999 pp. 123
1802 * for more information on TSF synchronization
1803 *------------------------------------------------------------------------*/
1804static void
1805ural_cfg_enable_tsf_sync(struct ural_softc *sc,
1806    struct usb2_config_td_cc *cc, uint16_t refcount)
1807{
1808	uint16_t logcwmin;
1809	uint16_t preload;
1810	uint16_t tmp;
1811
1812	/* first, disable TSF synchronization */
1813	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1814
1815	tmp = (16 * cc->iv_bss.ni_intval) << 4;
1816	ural_cfg_write(sc, RAL_TXRX_CSR18, tmp);
1817
1818	logcwmin = (cc->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1819	preload = (cc->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1820	tmp = (logcwmin << 12) | preload;
1821	ural_cfg_write(sc, RAL_TXRX_CSR20, tmp);
1822
1823	/* finally, enable TSF synchronization */
1824	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1825	if (cc->ic_opmode == IEEE80211_M_STA)
1826		tmp |= RAL_ENABLE_TSF_SYNC(1);
1827	else
1828		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1829
1830	ural_cfg_write(sc, RAL_TXRX_CSR19, tmp);
1831
1832	DPRINTF("enabling TSF synchronization\n");
1833}
1834
1835static void
1836ural_cfg_disable_tsf_sync(struct ural_softc *sc)
1837{
1838	/* abort TSF synchronization */
1839	ural_cfg_write(sc, RAL_TXRX_CSR19, 0);
1840
1841	/* force tx led to stop blinking */
1842	ural_cfg_write(sc, RAL_MAC_CSR20, 0);
1843}
1844
1845#define	RAL_RXTX_TURNAROUND    5	/* us */
1846
1847static void
1848ural_cfg_update_slot(struct ural_softc *sc,
1849    struct usb2_config_td_cc *cc, uint16_t refcount)
1850{
1851	uint16_t slottime;
1852	uint16_t sifs;
1853	uint16_t eifs;
1854
1855	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1856
1857	/*
1858	 * These settings may sound a bit inconsistent but this is what the
1859	 * reference driver does.
1860	 */
1861	if (cc->ic_curmode == IEEE80211_MODE_11B) {
1862		sifs = 16 - RAL_RXTX_TURNAROUND;
1863		eifs = 364;
1864	} else {
1865		sifs = 10 - RAL_RXTX_TURNAROUND;
1866		eifs = 64;
1867	}
1868
1869	ural_cfg_write(sc, RAL_MAC_CSR10, slottime);
1870	ural_cfg_write(sc, RAL_MAC_CSR11, sifs);
1871	ural_cfg_write(sc, RAL_MAC_CSR12, eifs);
1872}
1873
1874static void
1875ural_cfg_set_txpreamble(struct ural_softc *sc,
1876    struct usb2_config_td_cc *cc, uint16_t refcount)
1877{
1878	uint16_t tmp;
1879
1880	tmp = ural_cfg_read(sc, RAL_TXRX_CSR10);
1881
1882	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE) {
1883		tmp |= RAL_SHORT_PREAMBLE;
1884	} else {
1885		tmp &= ~RAL_SHORT_PREAMBLE;
1886	}
1887
1888	ural_cfg_write(sc, RAL_TXRX_CSR10, tmp);
1889}
1890
1891static void
1892ural_cfg_set_bssid(struct ural_softc *sc, uint8_t *bssid)
1893{
1894	ural_cfg_write_multi(sc, RAL_MAC_CSR5, bssid, IEEE80211_ADDR_LEN);
1895
1896	DPRINTF("setting BSSID to 0x%02x%02x%02x%02x%02x%02x\n",
1897	    bssid[5], bssid[4], bssid[3],
1898	    bssid[2], bssid[1], bssid[0]);
1899}
1900
1901static void
1902ural_cfg_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1903{
1904	ural_cfg_write_multi(sc, RAL_MAC_CSR2, addr, IEEE80211_ADDR_LEN);
1905
1906	DPRINTF("setting MAC to 0x%02x%02x%02x%02x%02x%02x\n",
1907	    addr[5], addr[4], addr[3],
1908	    addr[2], addr[1], addr[0]);
1909}
1910
1911static void
1912ural_cfg_update_promisc(struct ural_softc *sc,
1913    struct usb2_config_td_cc *cc, uint16_t refcount)
1914{
1915	uint16_t tmp;
1916
1917	tmp = ural_cfg_read(sc, RAL_TXRX_CSR2);
1918
1919	if (cc->if_flags & IFF_PROMISC) {
1920		tmp &= ~RAL_DROP_NOT_TO_ME;
1921	} else {
1922		tmp |= RAL_DROP_NOT_TO_ME;
1923	}
1924
1925	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
1926
1927	DPRINTF("%s promiscuous mode\n",
1928	    (cc->if_flags & IFF_PROMISC) ?
1929	    "entering" : "leaving");
1930}
1931
1932static void
1933ural_cfg_set_txantenna(struct ural_softc *sc, uint8_t antenna)
1934{
1935	uint16_t tmp;
1936	uint8_t tx;
1937
1938	tx = ural_cfg_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
1939	if (antenna == 1)
1940		tx |= RAL_BBP_ANTA;
1941	else if (antenna == 2)
1942		tx |= RAL_BBP_ANTB;
1943	else
1944		tx |= RAL_BBP_DIVERSITY;
1945
1946	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
1947	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1948	    (sc->sc_rf_rev == RAL_RF_2526) ||
1949	    (sc->sc_rf_rev == RAL_RF_5222)) {
1950		tx |= RAL_BBP_FLIPIQ;
1951	}
1952	ural_cfg_bbp_write(sc, RAL_BBP_TX, tx);
1953
1954	/* update values in PHY_CSR5 and PHY_CSR6 */
1955	tmp = ural_cfg_read(sc, RAL_PHY_CSR5) & ~0x7;
1956	ural_cfg_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
1957
1958	tmp = ural_cfg_read(sc, RAL_PHY_CSR6) & ~0x7;
1959	ural_cfg_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
1960}
1961
1962static void
1963ural_cfg_set_rxantenna(struct ural_softc *sc, uint8_t antenna)
1964{
1965	uint8_t rx;
1966
1967	rx = ural_cfg_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
1968	if (antenna == 1)
1969		rx |= RAL_BBP_ANTA;
1970	else if (antenna == 2)
1971		rx |= RAL_BBP_ANTB;
1972	else
1973		rx |= RAL_BBP_DIVERSITY;
1974
1975	/* need to force no I/Q flip for RF 2525e and 2526 */
1976
1977	if ((sc->sc_rf_rev == RAL_RF_2525E) ||
1978	    (sc->sc_rf_rev == RAL_RF_2526)) {
1979		rx &= ~RAL_BBP_FLIPIQ;
1980	}
1981	ural_cfg_bbp_write(sc, RAL_BBP_RX, rx);
1982}
1983
1984static void
1985ural_cfg_read_eeprom(struct ural_softc *sc)
1986{
1987	uint16_t val;
1988
1989	ural_cfg_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1990
1991	val = le16toh(val);
1992
1993	sc->sc_rf_rev = (val >> 11) & 0x7;
1994	sc->sc_hw_radio = (val >> 10) & 0x1;
1995	sc->sc_led_mode = (val >> 6) & 0x7;
1996	sc->sc_rx_ant = (val >> 4) & 0x3;
1997	sc->sc_tx_ant = (val >> 2) & 0x3;
1998	sc->sc_nb_ant = (val & 0x3);
1999
2000	DPRINTF("val = 0x%04x\n", val);
2001
2002	/* read MAC address */
2003	ural_cfg_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_myaddr,
2004	    sizeof(sc->sc_myaddr));
2005
2006	/* read default values for BBP registers */
2007	ural_cfg_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->sc_bbp_prom,
2008	    sizeof(sc->sc_bbp_prom));
2009
2010	/* read Tx power for all b/g channels */
2011	ural_cfg_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->sc_txpow,
2012	    sizeof(sc->sc_txpow));
2013}
2014
2015static uint8_t
2016ural_cfg_bbp_init(struct ural_softc *sc)
2017{
2018	enum {
2019		N_DEF_BBP = (sizeof(ural_def_bbp) / sizeof(ural_def_bbp[0])),
2020	};
2021	uint16_t i;
2022	uint8_t to;
2023
2024	/* wait for BBP to become ready */
2025	for (to = 0;; to++) {
2026		if (to < 100) {
2027			if (ural_cfg_bbp_read(sc, RAL_BBP_VERSION) != 0) {
2028				break;
2029			}
2030			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2031				return (1);	/* failure */
2032			}
2033		} else {
2034			DPRINTF("timeout waiting for BBP\n");
2035			return (1);	/* failure */
2036		}
2037	}
2038
2039	/* initialize BBP registers to default values */
2040	for (i = 0; i < N_DEF_BBP; i++) {
2041		ural_cfg_bbp_write(sc, ural_def_bbp[i].reg,
2042		    ural_def_bbp[i].val);
2043	}
2044
2045#if 0
2046	/* initialize BBP registers to values stored in EEPROM */
2047	for (i = 0; i < 16; i++) {
2048		if (sc->sc_bbp_prom[i].reg == 0xff) {
2049			continue;
2050		}
2051		ural_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg,
2052		    sc->sc_bbp_prom[i].val);
2053	}
2054#endif
2055	return (0);			/* success */
2056}
2057
2058static void
2059ural_cfg_pre_init(struct ural_softc *sc,
2060    struct usb2_config_td_cc *cc, uint16_t refcount)
2061{
2062	struct ifnet *ifp = sc->sc_ifp;
2063	struct ieee80211com *ic = ifp->if_l2com;
2064
2065	/* immediate configuration */
2066
2067	ural_cfg_pre_stop(sc, cc, 0);
2068
2069	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2070
2071	sc->sc_flags |= URAL_FLAG_HL_READY;
2072
2073	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2074}
2075
2076static void
2077ural_cfg_init(struct ural_softc *sc,
2078    struct usb2_config_td_cc *cc, uint16_t refcount)
2079{
2080	enum {
2081		N_DEF_MAC = (sizeof(ural_def_mac) / sizeof(ural_def_mac[0])),
2082	};
2083	uint16_t tmp;
2084	uint16_t i;
2085	uint8_t to;
2086
2087	/* delayed configuration */
2088
2089	ural_cfg_set_testmode(sc);
2090
2091	ural_cfg_write(sc, 0x308, 0x00f0);	/* XXX magic */
2092
2093	ural_cfg_stop(sc, cc, 0);
2094
2095	/* initialize MAC registers to default values */
2096	for (i = 0; i < N_DEF_MAC; i++) {
2097		ural_cfg_write(sc, ural_def_mac[i].reg,
2098		    ural_def_mac[i].val);
2099	}
2100
2101	/* wait for BBP and RF to wake up (this can take a long time!) */
2102	for (to = 0;; to++) {
2103		if (to < 100) {
2104			tmp = ural_cfg_read(sc, RAL_MAC_CSR17);
2105			if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2106			    (RAL_BBP_AWAKE | RAL_RF_AWAKE)) {
2107				break;
2108			}
2109			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2110				goto fail;
2111			}
2112		} else {
2113			DPRINTF("timeout waiting for "
2114			    "BBP/RF to wakeup\n");
2115			goto fail;
2116		}
2117	}
2118
2119	/* we're ready! */
2120	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2121
2122	/* set basic rate set (will be updated later) */
2123	ural_cfg_write(sc, RAL_TXRX_CSR11, 0x15f);
2124
2125	if (ural_cfg_bbp_init(sc)) {
2126		goto fail;
2127	}
2128	/* set default BSS channel */
2129	ural_cfg_set_chan(sc, cc, 0);
2130
2131	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2132	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta,
2133	    sizeof(sc->sc_sta));
2134
2135	DPRINTF("rx_ant=%d, tx_ant=%d\n",
2136	    sc->sc_rx_ant, sc->sc_tx_ant);
2137
2138	ural_cfg_set_txantenna(sc, sc->sc_tx_ant);
2139	ural_cfg_set_rxantenna(sc, sc->sc_rx_ant);
2140
2141	ural_cfg_set_macaddr(sc, cc->ic_myaddr);
2142
2143	/*
2144	 * make sure that the first transaction
2145	 * clears the stall:
2146	 */
2147	sc->sc_flags |= (URAL_FLAG_READ_STALL |
2148	    URAL_FLAG_WRITE_STALL |
2149	    URAL_FLAG_LL_READY);
2150
2151	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2152	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2153		struct ifnet *ifp = sc->sc_ifp;
2154		struct ieee80211com *ic = ifp->if_l2com;
2155
2156		/*
2157		 * start the USB transfers, if not already started:
2158		 */
2159		usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_RD]);
2160		usb2_transfer_start(sc->sc_xfer[URAL_BULK_DT_WR]);
2161
2162		/*
2163		 * start IEEE802.11 layer
2164		 */
2165		mtx_unlock(&sc->sc_mtx);
2166		ieee80211_start_all(ic);
2167		mtx_lock(&sc->sc_mtx);
2168	}
2169	/*
2170	 * start Rx
2171	 */
2172	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2173	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2174
2175		tmp |= (RAL_DROP_CTL | RAL_DROP_BAD_VERSION);
2176
2177		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2178			tmp |= RAL_DROP_TODS;
2179		}
2180		if (!(cc->if_flags & IFF_PROMISC)) {
2181			tmp |= RAL_DROP_NOT_TO_ME;
2182		}
2183	}
2184	ural_cfg_write(sc, RAL_TXRX_CSR2, tmp);
2185
2186	return;
2187
2188fail:
2189	ural_cfg_pre_stop(sc, NULL, 0);
2190
2191	if (cc) {
2192		ural_cfg_stop(sc, cc, 0);
2193	}
2194}
2195
2196static void
2197ural_cfg_pre_stop(struct ural_softc *sc,
2198    struct usb2_config_td_cc *cc, uint16_t refcount)
2199{
2200	struct ifnet *ifp = sc->sc_ifp;
2201
2202	if (cc) {
2203		/* copy the needed configuration */
2204		ural_config_copy(sc, cc, refcount);
2205	}
2206	/* immediate configuration */
2207
2208	if (ifp) {
2209		/* clear flags */
2210		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2211	}
2212	sc->sc_flags &= ~(URAL_FLAG_HL_READY |
2213	    URAL_FLAG_LL_READY);
2214
2215	/*
2216	 * stop all the transfers, if not already stopped:
2217	 */
2218	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_DT_WR]);
2219	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_DT_RD]);
2220	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_CS_WR]);
2221	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_CS_RD]);
2222
2223	/* clean up transmission */
2224	ural_tx_clean_queue(sc);
2225}
2226
2227static void
2228ural_cfg_stop(struct ural_softc *sc,
2229    struct usb2_config_td_cc *cc, uint16_t refcount)
2230{
2231	/* disable Rx */
2232	ural_cfg_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2233
2234	/* reset ASIC and BBP (but won't reset MAC registers!) */
2235	ural_cfg_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2236
2237	/* wait a little */
2238	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2239
2240	/* clear reset */
2241	ural_cfg_write(sc, RAL_MAC_CSR1, 0);
2242
2243	/* wait a little */
2244	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2245}
2246
2247static void
2248ural_cfg_amrr_start(struct ural_softc *sc)
2249{
2250	struct ieee80211vap *vap;
2251	struct ieee80211_node *ni;
2252
2253	vap = ural_get_vap(sc);
2254
2255	if (vap == NULL) {
2256		return;
2257	}
2258	ni = vap->iv_bss;
2259	if (ni == NULL) {
2260		return;
2261	}
2262	/* init AMRR */
2263
2264	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2265	/* enable AMRR timer */
2266
2267	sc->sc_amrr_timer = 1;
2268}
2269
2270static void
2271ural_cfg_amrr_timeout(struct ural_softc *sc,
2272    struct usb2_config_td_cc *cc, uint16_t refcount)
2273{
2274	struct ifnet *ifp = sc->sc_ifp;
2275	struct ieee80211vap *vap;
2276	struct ieee80211_node *ni;
2277	uint32_t ok;
2278	uint32_t fail;
2279
2280	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2281	ural_cfg_read_multi(sc, RAL_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2282
2283	vap = ural_get_vap(sc);
2284	if (vap == NULL) {
2285		return;
2286	}
2287	ni = vap->iv_bss;
2288	if (ni == NULL) {
2289		return;
2290	}
2291	if ((sc->sc_flags & URAL_FLAG_LL_READY) &&
2292	    (sc->sc_flags & URAL_FLAG_HL_READY)) {
2293
2294		ok = sc->sc_sta[7] +	/* TX ok w/o retry */
2295		    sc->sc_sta[8];	/* TX ok w/ retry */
2296		fail = sc->sc_sta[9];	/* TX retry-fail count */
2297
2298		if (sc->sc_amrr_timer) {
2299
2300			ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2301			    ok + fail, ok, sc->sc_sta[8] + fail);
2302
2303			if (ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn)) {
2304				/* ignore */
2305			}
2306		}
2307		ifp->if_oerrors += fail;
2308	}
2309}
2310
2311static struct ieee80211vap *
2312ural_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
2313    int opmode, int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
2314    const uint8_t mac[IEEE80211_ADDR_LEN])
2315{
2316	struct ural_vap *uvp;
2317	struct ieee80211vap *vap;
2318	struct ural_softc *sc = ic->ic_ifp->if_softc;
2319
2320	/* Need to sync with config thread: */
2321	mtx_lock(&sc->sc_mtx);
2322	if (usb2_config_td_sync(&sc->sc_config_td)) {
2323		mtx_unlock(&sc->sc_mtx);
2324		/* config thread is gone */
2325		return (NULL);
2326	}
2327	mtx_unlock(&sc->sc_mtx);
2328
2329	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2330		return NULL;
2331	uvp = (struct ural_vap *)malloc(sizeof(struct ural_vap),
2332	    M_80211_VAP, M_NOWAIT | M_ZERO);
2333	if (uvp == NULL)
2334		return NULL;
2335
2336	vap = &uvp->vap;
2337	/* enable s/w bmiss handling for sta mode */
2338	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2339	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2340
2341	/* override state transition machine */
2342	uvp->newstate = vap->iv_newstate;
2343	vap->iv_newstate = &ural_newstate_cb;
2344
2345	ieee80211_amrr_init(&uvp->amrr, vap,
2346	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2347	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2348	    1000 /* 1 sec */ );
2349
2350	/* complete setup */
2351	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2352
2353	/* store current operation mode */
2354	ic->ic_opmode = opmode;
2355
2356	return (vap);
2357}
2358
2359static void
2360ural_vap_delete(struct ieee80211vap *vap)
2361{
2362	struct ural_vap *uvp = URAL_VAP(vap);
2363	struct ural_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2364
2365	/* Need to sync with config thread: */
2366	mtx_lock(&sc->sc_mtx);
2367	if (usb2_config_td_sync(&sc->sc_config_td)) {
2368		/* ignore */
2369	}
2370	mtx_unlock(&sc->sc_mtx);
2371
2372	ieee80211_amrr_cleanup(&uvp->amrr);
2373	ieee80211_vap_detach(vap);
2374	free(uvp, M_80211_VAP);
2375}
2376
2377/* ARGUSED */
2378static struct ieee80211_node *
2379ural_node_alloc(struct ieee80211vap *vap __unused,
2380    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2381{
2382	struct ural_node *un;
2383
2384	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2385	return ((un != NULL) ? &un->ni : NULL);
2386}
2387
2388static void
2389ural_newassoc(struct ieee80211_node *ni, int isnew)
2390{
2391	struct ieee80211vap *vap = ni->ni_vap;
2392
2393	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
2394}
2395
2396static void
2397ural_fill_write_queue(struct ural_softc *sc)
2398{
2399	struct ifnet *ifp = sc->sc_ifp;
2400	struct ieee80211_node *ni;
2401	struct mbuf *m;
2402
2403	/*
2404	 * We only fill up half of the queue with data frames. The rest is
2405	 * reserved for other kinds of frames.
2406	 */
2407
2408	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2409
2410		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2411		if (m == NULL)
2412			break;
2413
2414		ni = (void *)(m->m_pkthdr.rcvif);
2415		m = ieee80211_encap(ni, m);
2416		if (m == NULL) {
2417			ieee80211_free_node(ni);
2418			continue;
2419		}
2420		ural_tx_data(sc, m, ni);
2421	}
2422}
2423
2424static void
2425ural_tx_clean_queue(struct ural_softc *sc)
2426{
2427	struct mbuf *m;
2428
2429	for (;;) {
2430		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2431
2432		if (!m) {
2433			break;
2434		}
2435		ural_tx_freem(m);
2436	}
2437}
2438
2439static void
2440ural_tx_freem(struct mbuf *m)
2441{
2442	struct ieee80211_node *ni;
2443
2444	while (m) {
2445		ni = (void *)(m->m_pkthdr.rcvif);
2446		if (!ni) {
2447			m = m_free(m);
2448			continue;
2449		}
2450		if (m->m_flags & M_TXCB) {
2451			ieee80211_process_callback(ni, m, 0);
2452		}
2453		m_freem(m);
2454		ieee80211_free_node(ni);
2455
2456		break;
2457	}
2458}
2459
2460static void
2461ural_tx_mgt(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2462{
2463	struct ieee80211vap *vap = ni->ni_vap;
2464	struct ieee80211com *ic = ni->ni_ic;
2465	const struct ieee80211_txparam *tp;
2466	struct ieee80211_frame *wh;
2467	struct ieee80211_key *k;
2468	uint32_t flags;
2469	uint16_t dur;
2470
2471	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2472
2473	wh = mtod(m, struct ieee80211_frame *);
2474	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2475		k = ieee80211_crypto_encap(ni, m);
2476		if (k == NULL) {
2477			m_freem(m);
2478			ieee80211_free_node(ni);
2479			return;
2480		}
2481		wh = mtod(m, struct ieee80211_frame *);
2482	}
2483	flags = 0;
2484	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2485		flags |= RAL_TX_ACK;
2486
2487		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2488		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2489		USETW(wh->i_dur, dur);
2490
2491		/* tell hardware to add timestamp for probe responses */
2492		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
2493		    IEEE80211_FC0_TYPE_MGT &&
2494		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
2495		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
2496			flags |= RAL_TX_TIMESTAMP;
2497	}
2498	m->m_pkthdr.rcvif = (void *)ni;
2499	ural_setup_desc_and_tx(sc, m, flags, tp->mgmtrate);
2500}
2501
2502static struct ieee80211vap *
2503ural_get_vap(struct ural_softc *sc)
2504{
2505	struct ifnet *ifp;
2506	struct ieee80211com *ic;
2507
2508	if (sc == NULL) {
2509		return NULL;
2510	}
2511	ifp = sc->sc_ifp;
2512	if (ifp == NULL) {
2513		return NULL;
2514	}
2515	ic = ifp->if_l2com;
2516	if (ic == NULL) {
2517		return NULL;
2518	}
2519	return TAILQ_FIRST(&ic->ic_vaps);
2520}
2521
2522static void
2523ural_tx_bcn(struct ural_softc *sc)
2524{
2525	struct ieee80211_node *ni;
2526	struct ieee80211vap *vap;
2527	struct ieee80211com *ic;
2528	const struct ieee80211_txparam *tp;
2529	struct mbuf *m;
2530
2531	vap = ural_get_vap(sc);
2532	if (vap == NULL) {
2533		return;
2534	}
2535	ni = vap->iv_bss;
2536	if (ni == NULL) {
2537		return;
2538	}
2539	ic = vap->iv_ic;
2540	if (ic == NULL) {
2541		return;
2542	}
2543	DPRINTFN(11, "Sending beacon frame.\n");
2544
2545	m = ieee80211_beacon_alloc(ni, &URAL_VAP(vap)->bo);
2546	if (m == NULL) {
2547		DPRINTFN(0, "could not allocate beacon\n");
2548		return;
2549	}
2550	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2551
2552	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2553	ural_setup_desc_and_tx(sc, m, RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP,
2554	    tp->mgmtrate);
2555}
2556
2557static void
2558ural_tx_data(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2559{
2560	struct ieee80211vap *vap = ni->ni_vap;
2561	struct ieee80211com *ic = ni->ni_ic;
2562	const struct ieee80211_txparam *tp;
2563	struct ieee80211_frame *wh;
2564	struct ieee80211_key *k;
2565	uint32_t flags = 0;
2566	uint16_t dur;
2567	uint16_t rate;
2568
2569	DPRINTFN(11, "Sending data.\n");
2570
2571	wh = mtod(m, struct ieee80211_frame *);
2572
2573	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2574	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2575		rate = tp->mcastrate;
2576	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2577		rate = tp->ucastrate;
2578	else
2579		rate = ni->ni_txrate;
2580
2581	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2582		k = ieee80211_crypto_encap(ni, m);
2583		if (k == NULL) {
2584			m_freem(m);
2585			ieee80211_free_node(ni);
2586			return;
2587		}
2588		/* packet header may have moved, reset our local pointer */
2589		wh = mtod(m, struct ieee80211_frame *);
2590	}
2591	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2592		uint8_t prot = IEEE80211_PROT_NONE;
2593
2594		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2595			prot = IEEE80211_PROT_RTSCTS;
2596		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2597		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2598			prot = ic->ic_protmode;
2599		if (prot != IEEE80211_PROT_NONE) {
2600			ural_tx_prot(sc, m, ni, prot, rate);
2601			flags |= RAL_TX_IFS_SIFS;
2602		}
2603		flags |= RAL_TX_ACK;
2604		flags |= RAL_TX_RETRY(7);
2605
2606		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2607		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2608		USETW(wh->i_dur, dur);
2609	}
2610	m->m_pkthdr.rcvif = (void *)ni;
2611	ural_setup_desc_and_tx(sc, m, flags, rate);
2612}
2613
2614static void
2615ural_tx_prot(struct ural_softc *sc,
2616    const struct mbuf *m, struct ieee80211_node *ni,
2617    uint8_t prot, uint16_t rate)
2618{
2619	struct ieee80211com *ic = ni->ni_ic;
2620	const struct ieee80211_frame *wh;
2621	struct mbuf *mprot;
2622	uint32_t flags;
2623	uint16_t protrate;
2624	uint16_t ackrate;
2625	uint16_t pktlen;
2626	uint16_t dur;
2627	uint8_t isshort;
2628
2629	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2630	    (prot == IEEE80211_PROT_CTSONLY),
2631	    ("protection %u", prot));
2632
2633	DPRINTFN(16, "Sending protection frame.\n");
2634
2635	wh = mtod(m, const struct ieee80211_frame *);
2636	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2637
2638	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2639	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2640
2641	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2642	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2643	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2644	flags = RAL_TX_RETRY(7);
2645	if (prot == IEEE80211_PROT_RTSCTS) {
2646		/* NB: CTS is the same size as an ACK */
2647		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2648		flags |= RAL_TX_ACK;
2649		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2650	} else {
2651		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2652	}
2653	if (mprot == NULL) {
2654		return;
2655	}
2656	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2657	ural_setup_desc_and_tx(sc, mprot, flags, protrate);
2658}
2659
2660static void
2661ural_tx_raw(struct ural_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2662    const struct ieee80211_bpf_params *params)
2663{
2664	uint32_t flags;
2665	uint16_t rate;
2666
2667	DPRINTFN(11, "Sending raw frame.\n");
2668
2669	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2670
2671	/* XXX validate */
2672	if (rate == 0) {
2673		m_freem(m);
2674		ieee80211_free_node(ni);
2675		return;
2676	}
2677	flags = 0;
2678	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2679		flags |= RAL_TX_ACK;
2680	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2681		ural_tx_prot(sc, m, ni,
2682		    (params->ibp_flags & IEEE80211_BPF_RTS) ?
2683		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2684		    rate);
2685		flags |= RAL_TX_IFS_SIFS;
2686	}
2687	m->m_pkthdr.rcvif = (void *)ni;
2688	ural_setup_desc_and_tx(sc, m, flags, rate);
2689}
2690
2691static int
2692ural_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2693    const struct ieee80211_bpf_params *params)
2694{
2695	struct ieee80211com *ic = ni->ni_ic;
2696	struct ifnet *ifp = ic->ic_ifp;
2697	struct ural_softc *sc = ifp->if_softc;
2698
2699	mtx_lock(&sc->sc_mtx);
2700	if (params == NULL) {
2701		/*
2702		 * Legacy path; interpret frame contents to decide
2703		 * precisely how to send the frame.
2704		 */
2705		ural_tx_mgt(sc, m, ni);
2706	} else {
2707		/*
2708		 * Caller supplied explicit parameters to use in
2709		 * sending the frame.
2710		 */
2711		ural_tx_raw(sc, m, ni, params);
2712	}
2713	mtx_unlock(&sc->sc_mtx);
2714	return (0);
2715}
2716
2717static void
2718ural_update_mcast_cb(struct ifnet *ifp)
2719{
2720	/* not supported */
2721}
2722
2723static void
2724ural_update_promisc_cb(struct ifnet *ifp)
2725{
2726	struct ural_softc *sc = ifp->if_softc;
2727
2728	mtx_lock(&sc->sc_mtx);
2729	usb2_config_td_queue_command
2730	    (&sc->sc_config_td, &ural_config_copy,
2731	    &ural_cfg_update_promisc, 0, 0);
2732	mtx_unlock(&sc->sc_mtx);
2733}
2734