if_ural.c revision 188418
1/*	$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 188418 2009-02-09 22:14:38Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@freebsd.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23#include <sys/cdefs.h>
24__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_ural2.c 188418 2009-02-09 22:14:38Z thompsa $");
25
26/*-
27 * Ralink Technology RT2500USB chipset driver
28 * http://www.ralinktech.com/
29 */
30
31#include <dev/usb2/include/usb2_devid.h>
32#include <dev/usb2/include/usb2_standard.h>
33#include <dev/usb2/include/usb2_mfunc.h>
34#include <dev/usb2/include/usb2_error.h>
35
36#define	USB_DEBUG_VAR ural_debug
37
38#include <dev/usb2/core/usb2_core.h>
39#include <dev/usb2/core/usb2_lookup.h>
40#include <dev/usb2/core/usb2_process.h>
41#include <dev/usb2/core/usb2_debug.h>
42#include <dev/usb2/core/usb2_request.h>
43#include <dev/usb2/core/usb2_busdma.h>
44#include <dev/usb2/core/usb2_util.h>
45
46#include <dev/usb2/wlan/usb2_wlan.h>
47#include <dev/usb2/wlan/if_uralreg.h>
48#include <dev/usb2/wlan/if_uralvar.h>
49
50#if USB_DEBUG
51static int ural_debug = 0;
52
53SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
54SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
55    "Debug level");
56#endif
57
58#define URAL_RSSI(rssi)					\
59	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
60	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
61
62/* various supported device vendors/products */
63static const struct usb2_device_id ural_devs[] = {
64	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G) },
65	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570) },
66	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050) },
67	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051) },
68	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS) },
69	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G) },
70	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP) },
71	{ USB_VP(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU) },
72	{ USB_VP(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122) },
73	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G) },
74	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG) },
75	{ USB_VP(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254) },
76	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54) },
77	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI) },
78	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB) },
79	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI) },
80	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570) },
81	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2) },
82	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3) },
83	{ USB_VP(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902) },
84	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570) },
85	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2) },
86	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3) },
87	{ USB_VP(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G) },
88	{ USB_VP(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG) },
89	{ USB_VP(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R) },
90	{ USB_VP(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570) },
91	{ USB_VP(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570) },
92	{ USB_VP(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570) },
93};
94
95static usb2_callback_t ural_bulk_read_callback;
96static usb2_callback_t ural_bulk_write_callback;
97
98static usb2_proc_callback_t ural_task;
99static usb2_proc_callback_t ural_scantask;
100static usb2_proc_callback_t ural_promisctask;
101static usb2_proc_callback_t ural_amrr_task;
102
103static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
104			    const char name[IFNAMSIZ], int unit, int opmode,
105			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
106			    const uint8_t mac[IEEE80211_ADDR_LEN]);
107static void		ural_vap_delete(struct ieee80211vap *);
108static void		ural_tx_free(struct ural_tx_data *, int);
109static int		ural_alloc_tx_list(struct ural_softc *);
110static void		ural_free_tx_list(struct ural_softc *);
111static int		ural_newstate(struct ieee80211vap *,
112			    enum ieee80211_state, int);
113static void		ural_setup_tx_desc(struct ural_softc *,
114			    struct ural_tx_desc *, uint32_t, int, int);
115static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
116			    struct ieee80211_node *);
117static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
118			    struct ieee80211_node *);
119static int		ural_tx_data(struct ural_softc *, struct mbuf *,
120			    struct ieee80211_node *);
121static void		ural_start(struct ifnet *);
122static int		ural_ioctl(struct ifnet *, u_long, caddr_t);
123static void		ural_set_testmode(struct ural_softc *);
124static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
125			    int);
126static uint16_t		ural_read(struct ural_softc *, uint16_t);
127static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
128			    int);
129static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
130static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
131			    int) __unused;
132static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
133static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
134static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
135static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
136			    const uint8_t mac[IEEE80211_ADDR_LEN]);
137static void		ural_newassoc(struct ieee80211_node *, int);
138static void		ural_scan_start(struct ieee80211com *);
139static void		ural_scan_end(struct ieee80211com *);
140static void		ural_set_channel(struct ieee80211com *);
141static void		ural_set_chan(struct ural_softc *,
142			    struct ieee80211_channel *);
143static void		ural_disable_rf_tune(struct ural_softc *);
144static void		ural_enable_tsf_sync(struct ural_softc *);
145static void		ural_update_slot(struct ifnet *);
146static void		ural_set_txpreamble(struct ural_softc *);
147static void		ural_set_basicrates(struct ural_softc *,
148			    const struct ieee80211_channel *);
149static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
150static void		ural_set_macaddr(struct ural_softc *, uint8_t *);
151static const char	*ural_get_rf(int);
152static void		ural_read_eeprom(struct ural_softc *);
153static int		ural_bbp_init(struct ural_softc *);
154static void		ural_set_txantenna(struct ural_softc *, int);
155static void		ural_set_rxantenna(struct ural_softc *, int);
156static void		ural_init_locked(struct ural_softc *);
157static void		ural_init(void *);
158static void		ural_stop(void *);
159static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
160			    const struct ieee80211_bpf_params *);
161static void		ural_amrr_start(struct ural_softc *,
162			    struct ieee80211_node *);
163static void		ural_amrr_timeout(void *);
164static void		ural_queue_command(struct ural_softc *,
165			    usb2_proc_callback_t *, struct usb2_proc_msg *,
166			    struct usb2_proc_msg *);
167
168/*
169 * Default values for MAC registers; values taken from the reference driver.
170 */
171static const struct {
172	uint16_t	reg;
173	uint16_t	val;
174} ural_def_mac[] = {
175	{ RAL_TXRX_CSR5,  0x8c8d },
176	{ RAL_TXRX_CSR6,  0x8b8a },
177	{ RAL_TXRX_CSR7,  0x8687 },
178	{ RAL_TXRX_CSR8,  0x0085 },
179	{ RAL_MAC_CSR13,  0x1111 },
180	{ RAL_MAC_CSR14,  0x1e11 },
181	{ RAL_TXRX_CSR21, 0xe78f },
182	{ RAL_MAC_CSR9,   0xff1d },
183	{ RAL_MAC_CSR11,  0x0002 },
184	{ RAL_MAC_CSR22,  0x0053 },
185	{ RAL_MAC_CSR15,  0x0000 },
186	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
187	{ RAL_TXRX_CSR19, 0x0000 },
188	{ RAL_TXRX_CSR18, 0x005a },
189	{ RAL_PHY_CSR2,   0x0000 },
190	{ RAL_TXRX_CSR0,  0x1ec0 },
191	{ RAL_PHY_CSR4,   0x000f }
192};
193
194/*
195 * Default values for BBP registers; values taken from the reference driver.
196 */
197static const struct {
198	uint8_t	reg;
199	uint8_t	val;
200} ural_def_bbp[] = {
201	{  3, 0x02 },
202	{  4, 0x19 },
203	{ 14, 0x1c },
204	{ 15, 0x30 },
205	{ 16, 0xac },
206	{ 17, 0x48 },
207	{ 18, 0x18 },
208	{ 19, 0xff },
209	{ 20, 0x1e },
210	{ 21, 0x08 },
211	{ 22, 0x08 },
212	{ 23, 0x08 },
213	{ 24, 0x80 },
214	{ 25, 0x50 },
215	{ 26, 0x08 },
216	{ 27, 0x23 },
217	{ 30, 0x10 },
218	{ 31, 0x2b },
219	{ 32, 0xb9 },
220	{ 34, 0x12 },
221	{ 35, 0x50 },
222	{ 39, 0xc4 },
223	{ 40, 0x02 },
224	{ 41, 0x60 },
225	{ 53, 0x10 },
226	{ 54, 0x18 },
227	{ 56, 0x08 },
228	{ 57, 0x10 },
229	{ 58, 0x08 },
230	{ 61, 0x60 },
231	{ 62, 0x10 },
232	{ 75, 0xff }
233};
234
235/*
236 * Default values for RF register R2 indexed by channel numbers.
237 */
238static const uint32_t ural_rf2522_r2[] = {
239	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
240	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
241};
242
243static const uint32_t ural_rf2523_r2[] = {
244	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
245	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
246};
247
248static const uint32_t ural_rf2524_r2[] = {
249	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
250	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
251};
252
253static const uint32_t ural_rf2525_r2[] = {
254	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
255	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
256};
257
258static const uint32_t ural_rf2525_hi_r2[] = {
259	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
260	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
261};
262
263static const uint32_t ural_rf2525e_r2[] = {
264	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
265	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
266};
267
268static const uint32_t ural_rf2526_hi_r2[] = {
269	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
270	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
271};
272
273static const uint32_t ural_rf2526_r2[] = {
274	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
275	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
276};
277
278/*
279 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
280 * values taken from the reference driver.
281 */
282static const struct {
283	uint8_t		chan;
284	uint32_t	r1;
285	uint32_t	r2;
286	uint32_t	r4;
287} ural_rf5222[] = {
288	{   1, 0x08808, 0x0044d, 0x00282 },
289	{   2, 0x08808, 0x0044e, 0x00282 },
290	{   3, 0x08808, 0x0044f, 0x00282 },
291	{   4, 0x08808, 0x00460, 0x00282 },
292	{   5, 0x08808, 0x00461, 0x00282 },
293	{   6, 0x08808, 0x00462, 0x00282 },
294	{   7, 0x08808, 0x00463, 0x00282 },
295	{   8, 0x08808, 0x00464, 0x00282 },
296	{   9, 0x08808, 0x00465, 0x00282 },
297	{  10, 0x08808, 0x00466, 0x00282 },
298	{  11, 0x08808, 0x00467, 0x00282 },
299	{  12, 0x08808, 0x00468, 0x00282 },
300	{  13, 0x08808, 0x00469, 0x00282 },
301	{  14, 0x08808, 0x0046b, 0x00286 },
302
303	{  36, 0x08804, 0x06225, 0x00287 },
304	{  40, 0x08804, 0x06226, 0x00287 },
305	{  44, 0x08804, 0x06227, 0x00287 },
306	{  48, 0x08804, 0x06228, 0x00287 },
307	{  52, 0x08804, 0x06229, 0x00287 },
308	{  56, 0x08804, 0x0622a, 0x00287 },
309	{  60, 0x08804, 0x0622b, 0x00287 },
310	{  64, 0x08804, 0x0622c, 0x00287 },
311
312	{ 100, 0x08804, 0x02200, 0x00283 },
313	{ 104, 0x08804, 0x02201, 0x00283 },
314	{ 108, 0x08804, 0x02202, 0x00283 },
315	{ 112, 0x08804, 0x02203, 0x00283 },
316	{ 116, 0x08804, 0x02204, 0x00283 },
317	{ 120, 0x08804, 0x02205, 0x00283 },
318	{ 124, 0x08804, 0x02206, 0x00283 },
319	{ 128, 0x08804, 0x02207, 0x00283 },
320	{ 132, 0x08804, 0x02208, 0x00283 },
321	{ 136, 0x08804, 0x02209, 0x00283 },
322	{ 140, 0x08804, 0x0220a, 0x00283 },
323
324	{ 149, 0x08808, 0x02429, 0x00281 },
325	{ 153, 0x08808, 0x0242b, 0x00281 },
326	{ 157, 0x08808, 0x0242d, 0x00281 },
327	{ 161, 0x08808, 0x0242f, 0x00281 }
328};
329
330static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
331	[URAL_BULK_WR] = {
332		.type = UE_BULK,
333		.endpoint = UE_ADDR_ANY,
334		.direction = UE_DIR_OUT,
335		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
336		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
337		.mh.callback = ural_bulk_write_callback,
338		.mh.timeout = 5000,	/* ms */
339	},
340	[URAL_BULK_RD] = {
341		.type = UE_BULK,
342		.endpoint = UE_ADDR_ANY,
343		.direction = UE_DIR_IN,
344		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
345		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
346		.mh.callback = ural_bulk_read_callback,
347	},
348};
349
350static device_probe_t ural_match;
351static device_attach_t ural_attach;
352static device_detach_t ural_detach;
353
354static device_method_t ural_methods[] = {
355	/* Device interface */
356	DEVMETHOD(device_probe,		ural_match),
357	DEVMETHOD(device_attach,	ural_attach),
358	DEVMETHOD(device_detach,	ural_detach),
359
360	{ 0, 0 }
361};
362
363static driver_t ural_driver = {
364	.name = "ural",
365	.methods = ural_methods,
366	.size = sizeof(struct ural_softc),
367};
368
369static devclass_t ural_devclass;
370
371DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
372MODULE_DEPEND(ural, usb2_wlan, 1, 1, 1);
373MODULE_DEPEND(ural, usb2_core, 1, 1, 1);
374MODULE_DEPEND(ural, wlan, 1, 1, 1);
375MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
376
377static int
378ural_match(device_t self)
379{
380	struct usb2_attach_arg *uaa = device_get_ivars(self);
381
382	if (uaa->usb2_mode != USB_MODE_HOST)
383		return (ENXIO);
384	if (uaa->info.bConfigIndex != 0)
385		return (ENXIO);
386	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
387		return (ENXIO);
388
389	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
390}
391
392static int
393ural_attach(device_t self)
394{
395	struct usb2_attach_arg *uaa = device_get_ivars(self);
396	struct ural_softc *sc = device_get_softc(self);
397	struct ifnet *ifp;
398	struct ieee80211com *ic;
399	int error;
400	uint8_t bands, iface_index;
401
402	device_set_usb2_desc(self);
403	sc->sc_udev = uaa->device;
404	sc->sc_dev = self;
405
406	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
407	    MTX_NETWORK_LOCK, MTX_DEF);
408
409	iface_index = RAL_IFACE_INDEX;
410	error = usb2_transfer_setup(uaa->device,
411	    &iface_index, sc->sc_xfer, ural_config,
412	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
413	if (error) {
414		device_printf(self, "could not allocate USB transfers, "
415		    "err=%s\n", usb2_errstr(error));
416		goto detach;
417	}
418	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
419	    device_get_nameunit(self), USB_PRI_MED);
420	if (error) {
421		device_printf(self, "could not setup config thread!\n");
422		goto detach;
423	}
424
425	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
426	if (ifp == NULL) {
427		device_printf(sc->sc_dev, "can not if_alloc()\n");
428		goto detach;
429	}
430	ic = ifp->if_l2com;
431
432	RAL_LOCK(sc);
433	/* retrieve RT2570 rev. no */
434	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
435
436	/* retrieve MAC address and various other things from EEPROM */
437	ural_read_eeprom(sc);
438	RAL_UNLOCK(sc);
439
440	device_printf(sc->sc_dev, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
441	    sc->asic_rev, ural_get_rf(sc->rf_rev));
442
443	ifp->if_softc = sc;
444	if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
445	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
446	ifp->if_init = ural_init;
447	ifp->if_ioctl = ural_ioctl;
448	ifp->if_start = ural_start;
449	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
450	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
451	IFQ_SET_READY(&ifp->if_snd);
452
453	ic->ic_ifp = ifp;
454	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
455
456	/* set device capabilities */
457	ic->ic_caps =
458	      IEEE80211_C_STA		/* station mode supported */
459	    | IEEE80211_C_IBSS		/* IBSS mode supported */
460	    | IEEE80211_C_MONITOR	/* monitor mode supported */
461	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
462	    | IEEE80211_C_TXPMGT	/* tx power management */
463	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
464	    | IEEE80211_C_SHSLOT	/* short slot time supported */
465	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
466	    | IEEE80211_C_WPA		/* 802.11i */
467	    ;
468
469	bands = 0;
470	setbit(&bands, IEEE80211_MODE_11B);
471	setbit(&bands, IEEE80211_MODE_11G);
472	if (sc->rf_rev == RAL_RF_5222)
473		setbit(&bands, IEEE80211_MODE_11A);
474	ieee80211_init_channels(ic, NULL, &bands);
475
476	ieee80211_ifattach(ic);
477	ic->ic_newassoc = ural_newassoc;
478	ic->ic_raw_xmit = ural_raw_xmit;
479	ic->ic_node_alloc = ural_node_alloc;
480	ic->ic_scan_start = ural_scan_start;
481	ic->ic_scan_end = ural_scan_end;
482	ic->ic_set_channel = ural_set_channel;
483
484	ic->ic_vap_create = ural_vap_create;
485	ic->ic_vap_delete = ural_vap_delete;
486
487	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
488
489	bpfattach(ifp, DLT_IEEE802_11_RADIO,
490	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
491
492	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
493	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
494	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
495
496	sc->sc_txtap_len = sizeof sc->sc_txtap;
497	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
498	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
499
500	if (bootverbose)
501		ieee80211_announce(ic);
502
503	return (0);			/* success */
504
505detach:
506	ural_detach(self);
507	return (ENXIO);			/* failure */
508}
509
510static int
511ural_detach(device_t self)
512{
513	struct ural_softc *sc = device_get_softc(self);
514	struct ifnet *ifp = sc->sc_ifp;
515	struct ieee80211com *ic = ifp->if_l2com;
516
517	RAL_LOCK(sc);
518	sc->sc_flags |= URAL_FLAG_DETACH;
519	ural_stop(sc);
520	RAL_UNLOCK(sc);
521
522	/* stop all USB transfers first */
523	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
524	usb2_proc_free(&sc->sc_tq);
525
526	if (ifp) {
527		bpfdetach(ifp);
528		ieee80211_ifdetach(ic);
529		if_free(ifp);
530	}
531	mtx_destroy(&sc->sc_mtx);
532
533	return (0);
534}
535
536static struct ieee80211vap *
537ural_vap_create(struct ieee80211com *ic,
538	const char name[IFNAMSIZ], int unit, int opmode, int flags,
539	const uint8_t bssid[IEEE80211_ADDR_LEN],
540	const uint8_t mac[IEEE80211_ADDR_LEN])
541{
542	struct ural_softc *sc = ic->ic_ifp->if_softc;
543	struct ural_vap *uvp;
544	struct ieee80211vap *vap;
545
546	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
547		return NULL;
548	uvp = (struct ural_vap *) malloc(sizeof(struct ural_vap),
549	    M_80211_VAP, M_NOWAIT | M_ZERO);
550	if (uvp == NULL)
551		return NULL;
552	vap = &uvp->vap;
553	/* enable s/w bmiss handling for sta mode */
554	ieee80211_vap_setup(ic, vap, name, unit, opmode,
555	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
556
557	/* override state transition machine */
558	uvp->newstate = vap->iv_newstate;
559	vap->iv_newstate = ural_newstate;
560
561	uvp->sc = sc;
562	usb2_callout_init_mtx(&uvp->amrr_ch, &sc->sc_mtx, 0);
563	ieee80211_amrr_init(&uvp->amrr, vap,
564	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
565	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
566	    1000 /* 1 sec */);
567
568	/* complete setup */
569	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
570	ic->ic_opmode = opmode;
571	return vap;
572}
573
574static void
575ural_vap_delete(struct ieee80211vap *vap)
576{
577	struct ural_vap *uvp = URAL_VAP(vap);
578	struct ural_softc *sc = uvp->sc;
579
580	RAL_LOCK(sc);
581	usb2_callout_stop(&uvp->amrr_ch);
582	RAL_UNLOCK(sc);
583	ieee80211_amrr_cleanup(&uvp->amrr);
584	ieee80211_vap_detach(vap);
585	free(uvp, M_80211_VAP);
586}
587
588static void
589ural_tx_free(struct ural_tx_data *data, int txerr)
590{
591	struct ural_softc *sc = data->sc;
592
593	if (data->m != NULL) {
594		if (data->m->m_flags & M_TXCB)
595			ieee80211_process_callback(data->ni, data->m,
596			    txerr ? ETIMEDOUT : 0);
597		m_freem(data->m);
598		data->m = NULL;
599
600		ieee80211_free_node(data->ni);
601		data->ni = NULL;
602	}
603	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
604	sc->tx_nfree++;
605}
606
607static int
608ural_alloc_tx_list(struct ural_softc *sc)
609{
610	struct ural_tx_data *data;
611	int i;
612
613	sc->tx_data = malloc(sizeof(struct ural_tx_data) * RAL_TX_LIST_COUNT,
614	    M_USB, M_NOWAIT|M_ZERO);
615	if (sc->tx_data == NULL)
616		return (ENOMEM);
617
618	sc->tx_nfree = 0;
619	STAILQ_INIT(&sc->tx_q);
620	STAILQ_INIT(&sc->tx_free);
621
622	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
623		data = &sc->tx_data[i];
624
625		data->sc = sc;
626		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
627		sc->tx_nfree++;
628	}
629	return 0;
630}
631
632static void
633ural_free_tx_list(struct ural_softc *sc)
634{
635	struct ural_tx_data *data;
636	int i;
637
638	if (sc->tx_data == NULL)
639		return;
640
641	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
642		data = &sc->tx_data[i];
643
644		if (data->m != NULL) {
645			m_freem(data->m);
646			data->m = NULL;
647		}
648		if (data->ni != NULL) {
649			ieee80211_free_node(data->ni);
650			data->ni = NULL;
651		}
652	}
653	free(sc->tx_data, M_USB);
654	sc->tx_data = NULL;
655}
656
657static void
658ural_task(struct usb2_proc_msg *pm)
659{
660	struct ural_task *task = (struct ural_task *)pm;
661	struct ural_softc *sc = task->sc;
662	struct ifnet *ifp = sc->sc_ifp;
663	struct ieee80211com *ic = ifp->if_l2com;
664	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
665	struct ural_vap *uvp = URAL_VAP(vap);
666	const struct ieee80211_txparam *tp;
667	enum ieee80211_state ostate;
668	struct ieee80211_node *ni;
669	struct mbuf *m;
670
671	if (sc->sc_flags & URAL_FLAG_DETACH)
672		return;
673
674	ostate = vap->iv_state;
675
676	switch (sc->sc_state) {
677	case IEEE80211_S_INIT:
678		if (ostate == IEEE80211_S_RUN) {
679			/* abort TSF synchronization */
680			ural_write(sc, RAL_TXRX_CSR19, 0);
681
682			/* force tx led to stop blinking */
683			ural_write(sc, RAL_MAC_CSR20, 0);
684		}
685		break;
686
687	case IEEE80211_S_RUN:
688		ni = vap->iv_bss;
689
690		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
691			ural_update_slot(ic->ic_ifp);
692			ural_set_txpreamble(sc);
693			ural_set_basicrates(sc, ic->ic_bsschan);
694			ural_set_bssid(sc, ni->ni_bssid);
695		}
696
697		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
698		    vap->iv_opmode == IEEE80211_M_IBSS) {
699			m = ieee80211_beacon_alloc(ni, &uvp->bo);
700			if (m == NULL) {
701				device_printf(sc->sc_dev,
702				    "could not allocate beacon\n");
703				return;
704			}
705
706			if (ural_tx_bcn(sc, m, ni) != 0) {
707				device_printf(sc->sc_dev,
708				    "could not send beacon\n");
709				return;
710			}
711		}
712
713		/* make tx led blink on tx (controlled by ASIC) */
714		ural_write(sc, RAL_MAC_CSR20, 1);
715
716		if (vap->iv_opmode != IEEE80211_M_MONITOR)
717			ural_enable_tsf_sync(sc);
718
719		/* enable automatic rate adaptation */
720		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
721		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
722			ural_amrr_start(sc, ni);
723
724		break;
725
726	default:
727		break;
728	}
729
730	RAL_UNLOCK(sc);
731	IEEE80211_LOCK(ic);
732	uvp->newstate(vap, sc->sc_state, sc->sc_arg);
733	if (vap->iv_newstate_cb != NULL)
734		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
735	IEEE80211_UNLOCK(ic);
736	RAL_LOCK(sc);
737}
738
739static void
740ural_scantask(struct usb2_proc_msg *pm)
741{
742	struct ural_task *task = (struct ural_task *)pm;
743	struct ural_softc *sc = task->sc;
744	struct ifnet *ifp = sc->sc_ifp;
745	struct ieee80211com *ic = ifp->if_l2com;
746	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
747
748	RAL_LOCK_ASSERT(sc, MA_OWNED);
749
750	if (sc->sc_flags & URAL_FLAG_DETACH)
751		return;
752
753	if (sc->sc_scan_action == URAL_SCAN_START) {
754		/* abort TSF synchronization */
755		DPRINTF("starting scan\n");
756		ural_write(sc, RAL_TXRX_CSR19, 0);
757		ural_set_bssid(sc, ifp->if_broadcastaddr);
758	} else if (sc->sc_scan_action == URAL_SET_CHANNEL) {
759		ural_set_chan(sc, ic->ic_curchan);
760	} else {
761		DPRINTF("stopping scan\n");
762		ural_enable_tsf_sync(sc);
763		/* XXX keep local copy */
764		ural_set_bssid(sc, vap->iv_bss->ni_bssid);
765	}
766}
767
768static int
769ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
770{
771	struct ural_vap *uvp = URAL_VAP(vap);
772	struct ieee80211com *ic = vap->iv_ic;
773	struct ural_softc *sc = ic->ic_ifp->if_softc;
774
775	DPRINTF("%s -> %s\n",
776		ieee80211_state_name[vap->iv_state],
777		ieee80211_state_name[nstate]);
778
779	RAL_LOCK(sc);
780	usb2_callout_stop(&uvp->amrr_ch);
781
782	/* do it in a process context */
783	sc->sc_state = nstate;
784	sc->sc_arg = arg;
785	RAL_UNLOCK(sc);
786
787	if (nstate == IEEE80211_S_INIT) {
788		uvp->newstate(vap, nstate, arg);
789		return 0;
790	} else {
791		RAL_LOCK(sc);
792		ural_queue_command(sc, ural_task, &sc->sc_task[0].hdr,
793		    &sc->sc_task[1].hdr);
794		RAL_UNLOCK(sc);
795		return EINPROGRESS;
796	}
797}
798
799
800static void
801ural_bulk_write_callback(struct usb2_xfer *xfer)
802{
803	struct ural_softc *sc = xfer->priv_sc;
804	struct ifnet *ifp = sc->sc_ifp;
805	struct ieee80211com *ic = ifp->if_l2com;
806	struct ieee80211_channel *c = ic->ic_curchan;
807	struct ural_tx_data *data;
808	struct mbuf *m;
809	int len;
810
811	switch (USB_GET_STATE(xfer)) {
812	case USB_ST_TRANSFERRED:
813		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
814
815		/* free resources */
816		data = xfer->priv_fifo;
817		ural_tx_free(data, 0);
818		xfer->priv_fifo = NULL;
819
820		ifp->if_opackets++;
821		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
822
823		/* FALLTHROUGH */
824	case USB_ST_SETUP:
825tr_setup:
826#if 0
827		if (sc->sc_flags & URAL_FLAG_WAIT_COMMAND) {
828			/*
829			 * don't send anything while a command is pending !
830			 */
831			break;
832		}
833#endif
834
835		data = STAILQ_FIRST(&sc->tx_q);
836		if (data) {
837			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
838			m = data->m;
839
840			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
841				DPRINTFN(0, "data overflow, %u bytes\n",
842				    m->m_pkthdr.len);
843				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
844			}
845			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
846			    RAL_TX_DESC_SIZE);
847			usb2_m_copy_in(xfer->frbuffers, RAL_TX_DESC_SIZE, m, 0,
848			    m->m_pkthdr.len);
849
850			if (bpf_peers_present(ifp->if_bpf)) {
851				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
852
853				tap->wt_flags = 0;
854				tap->wt_rate = data->rate;
855				tap->wt_chan_freq = htole16(c->ic_freq);
856				tap->wt_chan_flags = htole16(c->ic_flags);
857				tap->wt_antenna = sc->tx_ant;
858
859				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
860			}
861
862			/* xfer length needs to be a multiple of two! */
863			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
864			if ((len % 64) == 0)
865				len += 2;
866
867			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
868			    m->m_pkthdr.len, len);
869
870			xfer->frlengths[0] = len;
871			xfer->priv_fifo = data;
872
873			usb2_start_hardware(xfer);
874		}
875		break;
876
877	default:			/* Error */
878		DPRINTFN(11, "transfer error, %s\n",
879		    usb2_errstr(xfer->error));
880
881		if (xfer->error == USB_ERR_STALLED) {
882			/* try to clear stall first */
883			xfer->flags.stall_pipe = 1;
884			goto tr_setup;
885		}
886		if (xfer->error == USB_ERR_TIMEOUT)
887			device_printf(sc->sc_dev, "device timeout\n");
888
889		ifp->if_oerrors++;
890		data = xfer->priv_fifo;
891		if (data != NULL) {
892			ural_tx_free(data, xfer->error);
893			xfer->priv_fifo = NULL;
894		}
895		break;
896	}
897}
898
899static void
900ural_bulk_read_callback(struct usb2_xfer *xfer)
901{
902	struct ural_softc *sc = xfer->priv_sc;
903	struct ifnet *ifp = sc->sc_ifp;
904	struct ieee80211com *ic = ifp->if_l2com;
905	struct ieee80211_node *ni;
906	struct mbuf *m = NULL;
907	uint32_t flags;
908	uint8_t rssi = 0;
909	int len;
910
911	switch (USB_GET_STATE(xfer)) {
912	case USB_ST_TRANSFERRED:
913
914		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
915
916		len = xfer->actlen;
917		if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
918			DPRINTF("%s: xfer too short %d\n",
919			    device_get_nameunit(sc->sc_dev), len);
920			ifp->if_ierrors++;
921			goto tr_setup;
922		}
923
924		len -= RAL_RX_DESC_SIZE;
925		/* rx descriptor is located at the end */
926		usb2_copy_out(xfer->frbuffers, len, &sc->sc_rx_desc,
927		    RAL_RX_DESC_SIZE);
928
929		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
930		flags = le32toh(sc->sc_rx_desc.flags);
931		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
932			/*
933		         * This should not happen since we did not
934		         * request to receive those frames when we
935		         * filled RAL_TXRX_CSR2:
936		         */
937			DPRINTFN(5, "PHY or CRC error\n");
938			ifp->if_ierrors++;
939			goto tr_setup;
940		}
941
942		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
943		if (m == NULL) {
944			DPRINTF("could not allocate mbuf\n");
945			ifp->if_ierrors++;
946			goto tr_setup;
947		}
948		usb2_copy_out(xfer->frbuffers, 0, mtod(m, uint8_t *), len);
949
950		/* finalize mbuf */
951		m->m_pkthdr.rcvif = ifp;
952		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
953
954		if (bpf_peers_present(ifp->if_bpf)) {
955			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
956
957			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
958			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
959			    (flags & RAL_RX_OFDM) ?
960			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
961			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
962			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
963			tap->wr_antenna = sc->rx_ant;
964			tap->wr_antsignal = rssi;
965
966			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
967		}
968		/* Strip trailing 802.11 MAC FCS. */
969		m_adj(m, -IEEE80211_CRC_LEN);
970
971		/* FALLTHROUGH */
972	case USB_ST_SETUP:
973tr_setup:
974		xfer->frlengths[0] = xfer->max_data_length;
975		usb2_start_hardware(xfer);
976
977		/*
978		 * At the end of a USB callback it is always safe to unlock
979		 * the private mutex of a device! That is why we do the
980		 * "ieee80211_input" here, and not some lines up!
981		 */
982		if (m) {
983			RAL_UNLOCK(sc);
984			ni = ieee80211_find_rxnode(ic,
985			    mtod(m, struct ieee80211_frame_min *));
986			if (ni != NULL) {
987				(void) ieee80211_input(ni, m, rssi,
988				    RAL_NOISE_FLOOR, 0);
989				ieee80211_free_node(ni);
990			} else
991				(void) ieee80211_input_all(ic, m, rssi,
992				    RAL_NOISE_FLOOR, 0);
993			RAL_LOCK(sc);
994		}
995		return;
996
997	default:			/* Error */
998		if (xfer->error != USB_ERR_CANCELLED) {
999			/* try to clear stall first */
1000			xfer->flags.stall_pipe = 1;
1001			goto tr_setup;
1002		}
1003		return;
1004
1005	}
1006}
1007
1008static uint8_t
1009ural_plcp_signal(int rate)
1010{
1011	switch (rate) {
1012	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1013	case 12:	return 0xb;
1014	case 18:	return 0xf;
1015	case 24:	return 0xa;
1016	case 36:	return 0xe;
1017	case 48:	return 0x9;
1018	case 72:	return 0xd;
1019	case 96:	return 0x8;
1020	case 108:	return 0xc;
1021
1022	/* CCK rates (NB: not IEEE std, device-specific) */
1023	case 2:		return 0x0;
1024	case 4:		return 0x1;
1025	case 11:	return 0x2;
1026	case 22:	return 0x3;
1027	}
1028	return 0xff;		/* XXX unsupported/unknown rate */
1029}
1030
1031static void
1032ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
1033    uint32_t flags, int len, int rate)
1034{
1035	struct ifnet *ifp = sc->sc_ifp;
1036	struct ieee80211com *ic = ifp->if_l2com;
1037	uint16_t plcp_length;
1038	int remainder;
1039
1040	desc->flags = htole32(flags);
1041	desc->flags |= htole32(RAL_TX_NEWSEQ);
1042	desc->flags |= htole32(len << 16);
1043
1044	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
1045	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
1046
1047	/* setup PLCP fields */
1048	desc->plcp_signal  = ural_plcp_signal(rate);
1049	desc->plcp_service = 4;
1050
1051	len += IEEE80211_CRC_LEN;
1052	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1053		desc->flags |= htole32(RAL_TX_OFDM);
1054
1055		plcp_length = len & 0xfff;
1056		desc->plcp_length_hi = plcp_length >> 6;
1057		desc->plcp_length_lo = plcp_length & 0x3f;
1058	} else {
1059		plcp_length = (16 * len + rate - 1) / rate;
1060		if (rate == 22) {
1061			remainder = (16 * len) % 22;
1062			if (remainder != 0 && remainder < 7)
1063				desc->plcp_service |= RAL_PLCP_LENGEXT;
1064		}
1065		desc->plcp_length_hi = plcp_length >> 8;
1066		desc->plcp_length_lo = plcp_length & 0xff;
1067
1068		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1069			desc->plcp_signal |= 0x08;
1070	}
1071
1072	desc->iv = 0;
1073	desc->eiv = 0;
1074}
1075
1076#define RAL_TX_TIMEOUT	5000
1077
1078static int
1079ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1080{
1081	struct ieee80211vap *vap = ni->ni_vap;
1082	struct ieee80211com *ic = ni->ni_ic;
1083	struct ifnet *ifp = sc->sc_ifp;
1084	const struct ieee80211_txparam *tp;
1085	struct ural_tx_data *data;
1086
1087	if (sc->tx_nfree == 0) {
1088		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1089		m_freem(m0);
1090		ieee80211_free_node(ni);
1091		return EIO;
1092	}
1093	data = STAILQ_FIRST(&sc->tx_free);
1094	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1095	sc->tx_nfree--;
1096	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1097
1098	data->m = m0;
1099	data->ni = ni;
1100	data->rate = tp->mgmtrate;
1101
1102	ural_setup_tx_desc(sc, &data->desc,
1103	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1104	    tp->mgmtrate);
1105
1106	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1107	    m0->m_pkthdr.len, tp->mgmtrate);
1108
1109	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1110	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1111
1112	return (0);
1113}
1114
1115static int
1116ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1117{
1118	struct ieee80211vap *vap = ni->ni_vap;
1119	struct ieee80211com *ic = ni->ni_ic;
1120	const struct ieee80211_txparam *tp;
1121	struct ural_tx_data *data;
1122	struct ieee80211_frame *wh;
1123	struct ieee80211_key *k;
1124	uint32_t flags;
1125	uint16_t dur;
1126
1127	RAL_LOCK_ASSERT(sc, MA_OWNED);
1128
1129	data = STAILQ_FIRST(&sc->tx_free);
1130	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1131	sc->tx_nfree--;
1132
1133	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1134
1135	wh = mtod(m0, struct ieee80211_frame *);
1136	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1137		k = ieee80211_crypto_encap(ni, m0);
1138		if (k == NULL) {
1139			m_freem(m0);
1140			return ENOBUFS;
1141		}
1142		wh = mtod(m0, struct ieee80211_frame *);
1143	}
1144
1145	data->m = m0;
1146	data->ni = ni;
1147	data->rate = tp->mgmtrate;
1148
1149	flags = 0;
1150	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1151		flags |= RAL_TX_ACK;
1152
1153		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
1154		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1155		*(uint16_t *)wh->i_dur = htole16(dur);
1156
1157		/* tell hardware to add timestamp for probe responses */
1158		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1159		    IEEE80211_FC0_TYPE_MGT &&
1160		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1161		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1162			flags |= RAL_TX_TIMESTAMP;
1163	}
1164
1165	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1166
1167	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1168	    m0->m_pkthdr.len, tp->mgmtrate);
1169
1170	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1171	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1172
1173	return 0;
1174}
1175
1176static int
1177ural_sendprot(struct ural_softc *sc,
1178    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1179{
1180	struct ieee80211com *ic = ni->ni_ic;
1181	const struct ieee80211_frame *wh;
1182	struct ural_tx_data *data;
1183	struct mbuf *mprot;
1184	int protrate, ackrate, pktlen, flags, isshort;
1185	uint16_t dur;
1186
1187	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1188	    ("protection %d", prot));
1189
1190	wh = mtod(m, const struct ieee80211_frame *);
1191	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1192
1193	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1194	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1195
1196	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1197	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1198	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1199	flags = RAL_TX_RETRY(7);
1200	if (prot == IEEE80211_PROT_RTSCTS) {
1201		/* NB: CTS is the same size as an ACK */
1202		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1203		flags |= RAL_TX_ACK;
1204		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1205	} else {
1206		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1207	}
1208	if (mprot == NULL) {
1209		/* XXX stat + msg */
1210		return ENOBUFS;
1211	}
1212	data = STAILQ_FIRST(&sc->tx_free);
1213	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1214	sc->tx_nfree--;
1215
1216	data->m = mprot;
1217	data->ni = ieee80211_ref_node(ni);
1218	data->rate = protrate;
1219	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1220
1221	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1222	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1223
1224	return 0;
1225}
1226
1227static int
1228ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1229    const struct ieee80211_bpf_params *params)
1230{
1231	struct ural_tx_data *data;
1232	uint32_t flags;
1233	int error;
1234	int rate;
1235
1236	RAL_LOCK_ASSERT(sc, MA_OWNED);
1237	KASSERT(params != NULL, ("no raw xmit params"));
1238
1239	data = STAILQ_FIRST(&sc->tx_free);
1240	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1241	sc->tx_nfree--;
1242
1243	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1244	/* XXX validate */
1245	if (rate == 0) {
1246		m_freem(m0);
1247		return EINVAL;
1248	}
1249	flags = 0;
1250	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1251		flags |= RAL_TX_ACK;
1252	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1253		error = ural_sendprot(sc, m0, ni,
1254		    params->ibp_flags & IEEE80211_BPF_RTS ?
1255			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1256		    rate);
1257		if (error) {
1258			m_freem(m0);
1259			return error;
1260		}
1261		flags |= RAL_TX_IFS_SIFS;
1262	}
1263
1264	data->m = m0;
1265	data->ni = ni;
1266	data->rate = rate;
1267
1268	/* XXX need to setup descriptor ourself */
1269	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1270
1271	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1272	    m0->m_pkthdr.len, rate);
1273
1274	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1275	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1276
1277	return 0;
1278}
1279
1280static int
1281ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1282{
1283	struct ieee80211vap *vap = ni->ni_vap;
1284	struct ieee80211com *ic = ni->ni_ic;
1285	struct ural_tx_data *data;
1286	struct ieee80211_frame *wh;
1287	const struct ieee80211_txparam *tp;
1288	struct ieee80211_key *k;
1289	uint32_t flags = 0;
1290	uint16_t dur;
1291	int error, rate;
1292
1293	RAL_LOCK_ASSERT(sc, MA_OWNED);
1294
1295	wh = mtod(m0, struct ieee80211_frame *);
1296
1297	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1298	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1299		rate = tp->mcastrate;
1300	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1301		rate = tp->ucastrate;
1302	else
1303		rate = ni->ni_txrate;
1304
1305	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1306		k = ieee80211_crypto_encap(ni, m0);
1307		if (k == NULL) {
1308			m_freem(m0);
1309			return ENOBUFS;
1310		}
1311		/* packet header may have moved, reset our local pointer */
1312		wh = mtod(m0, struct ieee80211_frame *);
1313	}
1314
1315	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1316		int prot = IEEE80211_PROT_NONE;
1317		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1318			prot = IEEE80211_PROT_RTSCTS;
1319		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1320		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1321			prot = ic->ic_protmode;
1322		if (prot != IEEE80211_PROT_NONE) {
1323			error = ural_sendprot(sc, m0, ni, prot, rate);
1324			if (error) {
1325				m_freem(m0);
1326				return error;
1327			}
1328			flags |= RAL_TX_IFS_SIFS;
1329		}
1330	}
1331
1332	data = STAILQ_FIRST(&sc->tx_free);
1333	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1334	sc->tx_nfree--;
1335
1336	data->m = m0;
1337	data->ni = ni;
1338	data->rate = rate;
1339
1340	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1341		flags |= RAL_TX_ACK;
1342		flags |= RAL_TX_RETRY(7);
1343
1344		dur = ieee80211_ack_duration(sc->sc_rates, rate,
1345		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1346		*(uint16_t *)wh->i_dur = htole16(dur);
1347	}
1348
1349	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1350
1351	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1352	    m0->m_pkthdr.len, rate);
1353
1354	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1355	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1356
1357	return 0;
1358}
1359
1360static void
1361ural_start(struct ifnet *ifp)
1362{
1363	struct ural_softc *sc = ifp->if_softc;
1364	struct ieee80211_node *ni;
1365	struct mbuf *m;
1366
1367	RAL_LOCK(sc);
1368	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1369		RAL_UNLOCK(sc);
1370		return;
1371	}
1372	for (;;) {
1373		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1374		if (m == NULL)
1375			break;
1376		if (sc->tx_nfree == 0) {
1377			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1378			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1379			break;
1380		}
1381		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1382		m = ieee80211_encap(ni, m);
1383		if (m == NULL) {
1384			ieee80211_free_node(ni);
1385			continue;
1386		}
1387		if (ural_tx_data(sc, m, ni) != 0) {
1388			ieee80211_free_node(ni);
1389			ifp->if_oerrors++;
1390			break;
1391		}
1392	}
1393	RAL_UNLOCK(sc);
1394}
1395
1396static int
1397ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1398{
1399	struct ural_softc *sc = ifp->if_softc;
1400	struct ieee80211com *ic = ifp->if_l2com;
1401	struct ifreq *ifr = (struct ifreq *) data;
1402	int error = 0, startall = 0;
1403
1404	switch (cmd) {
1405	case SIOCSIFFLAGS:
1406		RAL_LOCK(sc);
1407		if (ifp->if_flags & IFF_UP) {
1408			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1409				ural_init_locked(sc);
1410				startall = 1;
1411			} else
1412				ural_queue_command(sc, ural_promisctask,
1413				    &sc->sc_promisctask[0].hdr,
1414				    &sc->sc_promisctask[1].hdr);
1415		} else {
1416			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1417				ural_stop(sc);
1418		}
1419		RAL_UNLOCK(sc);
1420		if (startall)
1421			ieee80211_start_all(ic);
1422		break;
1423	case SIOCGIFMEDIA:
1424	case SIOCSIFMEDIA:
1425		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1426		break;
1427	default:
1428		error = ether_ioctl(ifp, cmd, data);
1429		break;
1430	}
1431	return error;
1432}
1433
1434static void
1435ural_set_testmode(struct ural_softc *sc)
1436{
1437	struct usb2_device_request req;
1438	usb2_error_t error;
1439
1440	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1441	req.bRequest = RAL_VENDOR_REQUEST;
1442	USETW(req.wValue, 4);
1443	USETW(req.wIndex, 1);
1444	USETW(req.wLength, 0);
1445
1446	error = usb2_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL);
1447	if (error != 0) {
1448		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1449		    usb2_errstr(error));
1450	}
1451}
1452
1453static void
1454ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1455{
1456	struct usb2_device_request req;
1457	usb2_error_t error;
1458
1459	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1460	req.bRequest = RAL_READ_EEPROM;
1461	USETW(req.wValue, 0);
1462	USETW(req.wIndex, addr);
1463	USETW(req.wLength, len);
1464
1465	error = usb2_do_request(sc->sc_udev, &sc->sc_mtx, &req, buf);
1466	if (error != 0) {
1467		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1468		    usb2_errstr(error));
1469	}
1470}
1471
1472static uint16_t
1473ural_read(struct ural_softc *sc, uint16_t reg)
1474{
1475	struct usb2_device_request req;
1476	usb2_error_t error;
1477	uint16_t val;
1478
1479	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1480	req.bRequest = RAL_READ_MAC;
1481	USETW(req.wValue, 0);
1482	USETW(req.wIndex, reg);
1483	USETW(req.wLength, sizeof (uint16_t));
1484
1485	error = usb2_do_request(sc->sc_udev, &sc->sc_mtx, &req, &val);
1486	if (error != 0) {
1487		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1488		    usb2_errstr(error));
1489		return 0;
1490	}
1491
1492	return le16toh(val);
1493}
1494
1495static void
1496ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1497{
1498	struct usb2_device_request req;
1499	usb2_error_t error;
1500
1501	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1502	req.bRequest = RAL_READ_MULTI_MAC;
1503	USETW(req.wValue, 0);
1504	USETW(req.wIndex, reg);
1505	USETW(req.wLength, len);
1506
1507	error = usb2_do_request(sc->sc_udev, &sc->sc_mtx, &req, buf);
1508	if (error != 0) {
1509		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1510		    usb2_errstr(error));
1511	}
1512}
1513
1514static void
1515ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1516{
1517	struct usb2_device_request req;
1518	usb2_error_t error;
1519
1520	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1521	req.bRequest = RAL_WRITE_MAC;
1522	USETW(req.wValue, val);
1523	USETW(req.wIndex, reg);
1524	USETW(req.wLength, 0);
1525
1526	error = usb2_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL);
1527	if (error != 0) {
1528		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1529		    usb2_errstr(error));
1530	}
1531}
1532
1533static void
1534ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1535{
1536	struct usb2_device_request req;
1537	usb2_error_t error;
1538
1539	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1540	req.bRequest = RAL_WRITE_MULTI_MAC;
1541	USETW(req.wValue, 0);
1542	USETW(req.wIndex, reg);
1543	USETW(req.wLength, len);
1544
1545	error = usb2_do_request(sc->sc_udev, &sc->sc_mtx, &req, buf);
1546	if (error != 0) {
1547		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1548		    usb2_errstr(error));
1549	}
1550}
1551
1552static void
1553ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1554{
1555	uint16_t tmp;
1556	int ntries;
1557
1558	for (ntries = 0; ntries < 5; ntries++) {
1559		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1560			break;
1561	}
1562	if (ntries == 5) {
1563		device_printf(sc->sc_dev, "could not write to BBP\n");
1564		return;
1565	}
1566
1567	tmp = reg << 8 | val;
1568	ural_write(sc, RAL_PHY_CSR7, tmp);
1569}
1570
1571static uint8_t
1572ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1573{
1574	uint16_t val;
1575	int ntries;
1576
1577	val = RAL_BBP_WRITE | reg << 8;
1578	ural_write(sc, RAL_PHY_CSR7, val);
1579
1580	for (ntries = 0; ntries < 5; ntries++) {
1581		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1582			break;
1583	}
1584	if (ntries == 5) {
1585		device_printf(sc->sc_dev, "could not read BBP\n");
1586		return 0;
1587	}
1588
1589	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1590}
1591
1592static void
1593ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1594{
1595	uint32_t tmp;
1596	int ntries;
1597
1598	for (ntries = 0; ntries < 5; ntries++) {
1599		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1600			break;
1601	}
1602	if (ntries == 5) {
1603		device_printf(sc->sc_dev, "could not write to RF\n");
1604		return;
1605	}
1606
1607	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1608	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1609	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1610
1611	/* remember last written value in sc */
1612	sc->rf_regs[reg] = val;
1613
1614	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1615}
1616
1617/* ARGUSED */
1618static struct ieee80211_node *
1619ural_node_alloc(struct ieee80211vap *vap __unused,
1620	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
1621{
1622	struct ural_node *un;
1623
1624	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1625	return un != NULL ? &un->ni : NULL;
1626}
1627
1628static void
1629ural_newassoc(struct ieee80211_node *ni, int isnew)
1630{
1631	struct ieee80211vap *vap = ni->ni_vap;
1632
1633	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
1634}
1635
1636static void
1637ural_scan_start(struct ieee80211com *ic)
1638{
1639	struct ural_softc *sc = ic->ic_ifp->if_softc;
1640
1641	RAL_LOCK(sc);
1642	/* do it in a process context */
1643	sc->sc_scan_action = URAL_SCAN_START;
1644	ural_queue_command(sc, ural_scantask,
1645	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1646	RAL_UNLOCK(sc);
1647
1648}
1649
1650static void
1651ural_scan_end(struct ieee80211com *ic)
1652{
1653	struct ural_softc *sc = ic->ic_ifp->if_softc;
1654
1655	RAL_LOCK(sc);
1656	/* do it in a process context */
1657	sc->sc_scan_action = URAL_SCAN_END;
1658	ural_queue_command(sc, ural_scantask,
1659	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1660	RAL_UNLOCK(sc);
1661
1662}
1663
1664static void
1665ural_set_channel(struct ieee80211com *ic)
1666{
1667	struct ural_softc *sc = ic->ic_ifp->if_softc;
1668
1669	RAL_LOCK(sc);
1670	/* do it in a process context */
1671	sc->sc_scan_action = URAL_SET_CHANNEL;
1672	ural_queue_command(sc, ural_scantask,
1673	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1674
1675	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1676	RAL_UNLOCK(sc);
1677}
1678
1679static void
1680ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1681{
1682	struct ifnet *ifp = sc->sc_ifp;
1683	struct ieee80211com *ic = ifp->if_l2com;
1684	uint8_t power, tmp;
1685	u_int i, chan;
1686
1687	chan = ieee80211_chan2ieee(ic, c);
1688	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1689		return;
1690
1691	if (IEEE80211_IS_CHAN_2GHZ(c))
1692		power = min(sc->txpow[chan - 1], 31);
1693	else
1694		power = 31;
1695
1696	/* adjust txpower using ifconfig settings */
1697	power -= (100 - ic->ic_txpowlimit) / 8;
1698
1699	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1700
1701	switch (sc->rf_rev) {
1702	case RAL_RF_2522:
1703		ural_rf_write(sc, RAL_RF1, 0x00814);
1704		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1705		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1706		break;
1707
1708	case RAL_RF_2523:
1709		ural_rf_write(sc, RAL_RF1, 0x08804);
1710		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1711		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1712		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1713		break;
1714
1715	case RAL_RF_2524:
1716		ural_rf_write(sc, RAL_RF1, 0x0c808);
1717		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1718		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1719		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1720		break;
1721
1722	case RAL_RF_2525:
1723		ural_rf_write(sc, RAL_RF1, 0x08808);
1724		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1725		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1726		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1727
1728		ural_rf_write(sc, RAL_RF1, 0x08808);
1729		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1730		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1731		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1732		break;
1733
1734	case RAL_RF_2525E:
1735		ural_rf_write(sc, RAL_RF1, 0x08808);
1736		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1737		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1738		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1739		break;
1740
1741	case RAL_RF_2526:
1742		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1743		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1744		ural_rf_write(sc, RAL_RF1, 0x08804);
1745
1746		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1747		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1748		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1749		break;
1750
1751	/* dual-band RF */
1752	case RAL_RF_5222:
1753		for (i = 0; ural_rf5222[i].chan != chan; i++);
1754
1755		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1756		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1757		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1758		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1759		break;
1760	}
1761
1762	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1763	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1764		/* set Japan filter bit for channel 14 */
1765		tmp = ural_bbp_read(sc, 70);
1766
1767		tmp &= ~RAL_JAPAN_FILTER;
1768		if (chan == 14)
1769			tmp |= RAL_JAPAN_FILTER;
1770
1771		ural_bbp_write(sc, 70, tmp);
1772
1773		/* clear CRC errors */
1774		ural_read(sc, RAL_STA_CSR0);
1775
1776		DELAY(10000);
1777		ural_disable_rf_tune(sc);
1778	}
1779
1780	/* XXX doesn't belong here */
1781	/* update basic rate set */
1782	ural_set_basicrates(sc, c);
1783}
1784
1785/*
1786 * Disable RF auto-tuning.
1787 */
1788static void
1789ural_disable_rf_tune(struct ural_softc *sc)
1790{
1791	uint32_t tmp;
1792
1793	if (sc->rf_rev != RAL_RF_2523) {
1794		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1795		ural_rf_write(sc, RAL_RF1, tmp);
1796	}
1797
1798	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1799	ural_rf_write(sc, RAL_RF3, tmp);
1800
1801	DPRINTFN(2, "disabling RF autotune\n");
1802}
1803
1804/*
1805 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1806 * synchronization.
1807 */
1808static void
1809ural_enable_tsf_sync(struct ural_softc *sc)
1810{
1811	struct ifnet *ifp = sc->sc_ifp;
1812	struct ieee80211com *ic = ifp->if_l2com;
1813	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1814	uint16_t logcwmin, preload, tmp;
1815
1816	/* first, disable TSF synchronization */
1817	ural_write(sc, RAL_TXRX_CSR19, 0);
1818
1819	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1820	ural_write(sc, RAL_TXRX_CSR18, tmp);
1821
1822	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1823	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1824	tmp = logcwmin << 12 | preload;
1825	ural_write(sc, RAL_TXRX_CSR20, tmp);
1826
1827	/* finally, enable TSF synchronization */
1828	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1829	if (ic->ic_opmode == IEEE80211_M_STA)
1830		tmp |= RAL_ENABLE_TSF_SYNC(1);
1831	else
1832		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1833	ural_write(sc, RAL_TXRX_CSR19, tmp);
1834
1835	DPRINTF("enabling TSF synchronization\n");
1836}
1837
1838#define RAL_RXTX_TURNAROUND	5	/* us */
1839static void
1840ural_update_slot(struct ifnet *ifp)
1841{
1842	struct ural_softc *sc = ifp->if_softc;
1843	struct ieee80211com *ic = ifp->if_l2com;
1844	uint16_t slottime, sifs, eifs;
1845
1846	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1847
1848	/*
1849	 * These settings may sound a bit inconsistent but this is what the
1850	 * reference driver does.
1851	 */
1852	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1853		sifs = 16 - RAL_RXTX_TURNAROUND;
1854		eifs = 364;
1855	} else {
1856		sifs = 10 - RAL_RXTX_TURNAROUND;
1857		eifs = 64;
1858	}
1859
1860	ural_write(sc, RAL_MAC_CSR10, slottime);
1861	ural_write(sc, RAL_MAC_CSR11, sifs);
1862	ural_write(sc, RAL_MAC_CSR12, eifs);
1863}
1864
1865static void
1866ural_set_txpreamble(struct ural_softc *sc)
1867{
1868	struct ifnet *ifp = sc->sc_ifp;
1869	struct ieee80211com *ic = ifp->if_l2com;
1870	uint16_t tmp;
1871
1872	tmp = ural_read(sc, RAL_TXRX_CSR10);
1873
1874	tmp &= ~RAL_SHORT_PREAMBLE;
1875	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1876		tmp |= RAL_SHORT_PREAMBLE;
1877
1878	ural_write(sc, RAL_TXRX_CSR10, tmp);
1879}
1880
1881static void
1882ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1883{
1884	/* XXX wrong, take from rate set */
1885	/* update basic rate set */
1886	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1887		/* 11a basic rates: 6, 12, 24Mbps */
1888		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1889	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1890		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1891		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1892	} else {
1893		/* 11b basic rates: 1, 2Mbps */
1894		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1895	}
1896}
1897
1898static void
1899ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1900{
1901	uint16_t tmp;
1902
1903	tmp = bssid[0] | bssid[1] << 8;
1904	ural_write(sc, RAL_MAC_CSR5, tmp);
1905
1906	tmp = bssid[2] | bssid[3] << 8;
1907	ural_write(sc, RAL_MAC_CSR6, tmp);
1908
1909	tmp = bssid[4] | bssid[5] << 8;
1910	ural_write(sc, RAL_MAC_CSR7, tmp);
1911
1912	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1913}
1914
1915static void
1916ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1917{
1918	uint16_t tmp;
1919
1920	tmp = addr[0] | addr[1] << 8;
1921	ural_write(sc, RAL_MAC_CSR2, tmp);
1922
1923	tmp = addr[2] | addr[3] << 8;
1924	ural_write(sc, RAL_MAC_CSR3, tmp);
1925
1926	tmp = addr[4] | addr[5] << 8;
1927	ural_write(sc, RAL_MAC_CSR4, tmp);
1928
1929	DPRINTF("setting MAC address to %6D\n", addr, ":");
1930}
1931
1932static void
1933ural_promisctask(struct usb2_proc_msg *pm)
1934{
1935	struct ural_task *task = (struct ural_task *)pm;
1936	struct ural_softc *sc = task->sc;
1937	struct ifnet *ifp = sc->sc_ifp;
1938	uint32_t tmp;
1939
1940	if (sc->sc_flags & URAL_FLAG_DETACH)
1941		return;
1942
1943	tmp = ural_read(sc, RAL_TXRX_CSR2);
1944
1945	tmp &= ~RAL_DROP_NOT_TO_ME;
1946	if (!(ifp->if_flags & IFF_PROMISC))
1947		tmp |= RAL_DROP_NOT_TO_ME;
1948
1949	ural_write(sc, RAL_TXRX_CSR2, tmp);
1950
1951	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1952	    "entering" : "leaving");
1953}
1954
1955static const char *
1956ural_get_rf(int rev)
1957{
1958	switch (rev) {
1959	case RAL_RF_2522:	return "RT2522";
1960	case RAL_RF_2523:	return "RT2523";
1961	case RAL_RF_2524:	return "RT2524";
1962	case RAL_RF_2525:	return "RT2525";
1963	case RAL_RF_2525E:	return "RT2525e";
1964	case RAL_RF_2526:	return "RT2526";
1965	case RAL_RF_5222:	return "RT5222";
1966	default:		return "unknown";
1967	}
1968}
1969
1970static void
1971ural_read_eeprom(struct ural_softc *sc)
1972{
1973	struct ifnet *ifp = sc->sc_ifp;
1974	struct ieee80211com *ic = ifp->if_l2com;
1975	uint16_t val;
1976
1977	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1978	val = le16toh(val);
1979	sc->rf_rev =   (val >> 11) & 0x7;
1980	sc->hw_radio = (val >> 10) & 0x1;
1981	sc->led_mode = (val >> 6)  & 0x7;
1982	sc->rx_ant =   (val >> 4)  & 0x3;
1983	sc->tx_ant =   (val >> 2)  & 0x3;
1984	sc->nb_ant =   val & 0x3;
1985
1986	/* read MAC address */
1987	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1988
1989	/* read default values for BBP registers */
1990	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1991
1992	/* read Tx power for all b/g channels */
1993	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
1994}
1995
1996static int
1997ural_bbp_init(struct ural_softc *sc)
1998{
1999#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2000	int i, ntries;
2001
2002	/* wait for BBP to be ready */
2003	for (ntries = 0; ntries < 100; ntries++) {
2004		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
2005			break;
2006		DELAY(1000);
2007	}
2008	if (ntries == 100) {
2009		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2010		return EIO;
2011	}
2012
2013	/* initialize BBP registers to default values */
2014	for (i = 0; i < N(ural_def_bbp); i++)
2015		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
2016
2017#if 0
2018	/* initialize BBP registers to values stored in EEPROM */
2019	for (i = 0; i < 16; i++) {
2020		if (sc->bbp_prom[i].reg == 0xff)
2021			continue;
2022		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2023	}
2024#endif
2025
2026	return 0;
2027#undef N
2028}
2029
2030static void
2031ural_set_txantenna(struct ural_softc *sc, int antenna)
2032{
2033	uint16_t tmp;
2034	uint8_t tx;
2035
2036	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
2037	if (antenna == 1)
2038		tx |= RAL_BBP_ANTA;
2039	else if (antenna == 2)
2040		tx |= RAL_BBP_ANTB;
2041	else
2042		tx |= RAL_BBP_DIVERSITY;
2043
2044	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2045	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
2046	    sc->rf_rev == RAL_RF_5222)
2047		tx |= RAL_BBP_FLIPIQ;
2048
2049	ural_bbp_write(sc, RAL_BBP_TX, tx);
2050
2051	/* update values in PHY_CSR5 and PHY_CSR6 */
2052	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
2053	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2054
2055	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
2056	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2057}
2058
2059static void
2060ural_set_rxantenna(struct ural_softc *sc, int antenna)
2061{
2062	uint8_t rx;
2063
2064	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2065	if (antenna == 1)
2066		rx |= RAL_BBP_ANTA;
2067	else if (antenna == 2)
2068		rx |= RAL_BBP_ANTB;
2069	else
2070		rx |= RAL_BBP_DIVERSITY;
2071
2072	/* need to force no I/Q flip for RF 2525e and 2526 */
2073	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2074		rx &= ~RAL_BBP_FLIPIQ;
2075
2076	ural_bbp_write(sc, RAL_BBP_RX, rx);
2077}
2078
2079static void
2080ural_init_locked(struct ural_softc *sc)
2081{
2082#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2083	struct ifnet *ifp = sc->sc_ifp;
2084	struct ieee80211com *ic = ifp->if_l2com;
2085	uint16_t tmp;
2086	usb2_error_t error;
2087	int i, ntries;
2088
2089	RAL_LOCK_ASSERT(sc, MA_OWNED);
2090
2091	if (sc->sc_flags & URAL_FLAG_DETACH)
2092		return;
2093
2094	ural_set_testmode(sc);
2095	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2096
2097	ural_stop(sc);
2098
2099	/* initialize MAC registers to default values */
2100	for (i = 0; i < N(ural_def_mac); i++)
2101		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2102
2103	/* wait for BBP and RF to wake up (this can take a long time!) */
2104	for (ntries = 0; ntries < 100; ntries++) {
2105		tmp = ural_read(sc, RAL_MAC_CSR17);
2106		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2107		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2108			break;
2109		DELAY(1000);
2110	}
2111	if (ntries == 100) {
2112		device_printf(sc->sc_dev,
2113		    "timeout waiting for BBP/RF to wakeup\n");
2114		goto fail;
2115	}
2116
2117	/* we're ready! */
2118	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2119
2120	/* set basic rate set (will be updated later) */
2121	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2122
2123	if (ural_bbp_init(sc) != 0)
2124		goto fail;
2125
2126	ural_set_chan(sc, ic->ic_curchan);
2127
2128	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2129	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2130
2131	ural_set_txantenna(sc, sc->tx_ant);
2132	ural_set_rxantenna(sc, sc->rx_ant);
2133
2134	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2135	ural_set_macaddr(sc, ic->ic_myaddr);
2136
2137	/*
2138	 * Allocate Tx and Rx xfer queues.
2139	 */
2140	error = ural_alloc_tx_list(sc);
2141	if (error != 0) {
2142		device_printf(sc->sc_dev, "could not allocate Tx list\n");
2143		goto fail;
2144	}
2145
2146	/* kick Rx */
2147	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2148	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2149		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2150		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2151			tmp |= RAL_DROP_TODS;
2152		if (!(ifp->if_flags & IFF_PROMISC))
2153			tmp |= RAL_DROP_NOT_TO_ME;
2154	}
2155	ural_write(sc, RAL_TXRX_CSR2, tmp);
2156
2157	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2158	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2159	usb2_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2160	return;
2161
2162fail:	ural_stop(sc);
2163#undef N
2164}
2165
2166static void
2167ural_init(void *priv)
2168{
2169	struct ural_softc *sc = priv;
2170	struct ifnet *ifp = sc->sc_ifp;
2171	struct ieee80211com *ic = ifp->if_l2com;
2172
2173	RAL_LOCK(sc);
2174	ural_init_locked(sc);
2175	RAL_UNLOCK(sc);
2176
2177	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2178		ieee80211_start_all(ic);		/* start all vap's */
2179}
2180
2181static void
2182ural_stop(void *priv)
2183{
2184	struct ural_softc *sc = priv;
2185	struct ifnet *ifp = sc->sc_ifp;
2186
2187	RAL_LOCK_ASSERT(sc, MA_OWNED);
2188
2189	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2190
2191	/*
2192	 * stop all the transfers, if not already stopped:
2193	 */
2194	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_WR]);
2195	usb2_transfer_stop(sc->sc_xfer[URAL_BULK_RD]);
2196
2197	ural_free_tx_list(sc);
2198
2199	/* Stop now if the device has vanished */
2200	if (sc->sc_flags & URAL_FLAG_DETACH)
2201		return;
2202
2203	/* disable Rx */
2204	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2205	/* reset ASIC and BBP (but won't reset MAC registers!) */
2206	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2207	ural_write(sc, RAL_MAC_CSR1, 0);
2208}
2209
2210static int
2211ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2212	const struct ieee80211_bpf_params *params)
2213{
2214	struct ieee80211com *ic = ni->ni_ic;
2215	struct ifnet *ifp = ic->ic_ifp;
2216	struct ural_softc *sc = ifp->if_softc;
2217
2218	RAL_LOCK(sc);
2219	/* prevent management frames from being sent if we're not ready */
2220	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2221		RAL_UNLOCK(sc);
2222		m_freem(m);
2223		ieee80211_free_node(ni);
2224		return ENETDOWN;
2225	}
2226	if (sc->tx_nfree == 0) {
2227		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2228		RAL_UNLOCK(sc);
2229		m_freem(m);
2230		ieee80211_free_node(ni);
2231		return EIO;
2232	}
2233
2234	ifp->if_opackets++;
2235
2236	if (params == NULL) {
2237		/*
2238		 * Legacy path; interpret frame contents to decide
2239		 * precisely how to send the frame.
2240		 */
2241		if (ural_tx_mgt(sc, m, ni) != 0)
2242			goto bad;
2243	} else {
2244		/*
2245		 * Caller supplied explicit parameters to use in
2246		 * sending the frame.
2247		 */
2248		if (ural_tx_raw(sc, m, ni, params) != 0)
2249			goto bad;
2250	}
2251	RAL_UNLOCK(sc);
2252	return 0;
2253bad:
2254	ifp->if_oerrors++;
2255	RAL_UNLOCK(sc);
2256	ieee80211_free_node(ni);
2257	return EIO;		/* XXX */
2258}
2259
2260static void
2261ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
2262{
2263	struct ieee80211vap *vap = ni->ni_vap;
2264	struct ural_vap *uvp = URAL_VAP(vap);
2265
2266	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2267	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2268
2269	ieee80211_amrr_node_init(&uvp->amrr, &URAL_NODE(ni)->amn, ni);
2270
2271	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2272}
2273
2274static void
2275ural_amrr_timeout(void *arg)
2276{
2277	struct ural_vap *uvp = arg;
2278	struct ural_softc *sc = uvp->sc;
2279
2280	ural_queue_command(sc, ural_amrr_task,
2281	    &uvp->amrr_task[0].hdr, &uvp->amrr_task[1].hdr);
2282}
2283
2284static void
2285ural_amrr_task(struct usb2_proc_msg *pm)
2286{
2287	struct ural_task *task = (struct ural_task *)pm;
2288	struct ural_softc *sc = task->sc;
2289	struct ifnet *ifp = sc->sc_ifp;
2290	struct ieee80211com *ic = ifp->if_l2com;
2291	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2292	struct ural_vap *uvp = URAL_VAP(vap);
2293	struct ieee80211_node *ni = vap->iv_bss;
2294	int ok, fail;
2295
2296	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2297	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2298
2299	ok = sc->sta[7] +		/* TX ok w/o retry */
2300	     sc->sta[8];		/* TX ok w/ retry */
2301	fail = sc->sta[9];		/* TX retry-fail count */
2302
2303	ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2304	    ok+fail, ok, sc->sta[8] + fail);
2305	(void) ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn);
2306
2307	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2308
2309	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2310}
2311
2312static void
2313ural_queue_command(struct ural_softc *sc, usb2_proc_callback_t *fn,
2314    struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2315{
2316	struct ural_task *task;
2317
2318	RAL_LOCK_ASSERT(sc, MA_OWNED);
2319
2320	if (usb2_proc_is_gone(&sc->sc_tq)) {
2321		DPRINTF("proc is gone\n");
2322		return;         /* nothing to do */
2323	}
2324	/*
2325	 * NOTE: The task cannot get executed before we drop the
2326	 * "sc_mtx" mutex. It is safe to update fields in the message
2327	 * structure after that the message got queued.
2328	 */
2329	task = (struct ural_task *)
2330	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2331
2332	/* Setup callback and softc pointers */
2333	task->hdr.pm_callback = fn;
2334	task->sc = sc;
2335
2336}
2337
2338