if_ural.c revision 190749
1/*	$FreeBSD: head/sys/dev/usb/wlan/if_ural.c 190749 2009-04-05 21:24:15Z piso $	*/
2
3/*-
4 * Copyright (c) 2005, 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Copyright (c) 2006, 2008
8 *	Hans Petter Selasky <hselasky@FreeBSD.org>
9 *
10 * Permission to use, copy, modify, and distribute this software for any
11 * purpose with or without fee is hereby granted, provided that the above
12 * copyright notice and this permission notice appear in all copies.
13 *
14 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 */
22
23#include <sys/cdefs.h>
24__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_ural.c 190749 2009-04-05 21:24:15Z piso $");
25
26/*-
27 * Ralink Technology RT2500USB chipset driver
28 * http://www.ralinktech.com/
29 */
30
31#include "usbdevs.h"
32#include <dev/usb/usb.h>
33#include <dev/usb/usb_mfunc.h>
34#include <dev/usb/usb_error.h>
35
36#define	USB_DEBUG_VAR ural_debug
37
38#include <dev/usb/usb_core.h>
39#include <dev/usb/usb_lookup.h>
40#include <dev/usb/usb_process.h>
41#include <dev/usb/usb_debug.h>
42#include <dev/usb/usb_request.h>
43#include <dev/usb/usb_busdma.h>
44#include <dev/usb/usb_util.h>
45
46#include <dev/usb/wlan/usb_wlan.h>
47#include <dev/usb/wlan/if_uralreg.h>
48#include <dev/usb/wlan/if_uralvar.h>
49
50#if USB_DEBUG
51static int ural_debug = 0;
52
53SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
54SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
55    "Debug level");
56#endif
57
58#define URAL_RSSI(rssi)					\
59	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
60	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
61
62/* various supported device vendors/products */
63static const struct usb2_device_id ural_devs[] = {
64	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G) },
65	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570) },
66	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050) },
67	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051) },
68	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS) },
69	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G) },
70	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP) },
71	{ USB_VP(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU) },
72	{ USB_VP(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122) },
73	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G) },
74	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG) },
75	{ USB_VP(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254) },
76	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54) },
77	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI) },
78	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB) },
79	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI) },
80	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570) },
81	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2) },
82	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3) },
83	{ USB_VP(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902) },
84	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570) },
85	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2) },
86	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3) },
87	{ USB_VP(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G) },
88	{ USB_VP(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG) },
89	{ USB_VP(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R) },
90	{ USB_VP(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570) },
91	{ USB_VP(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570) },
92	{ USB_VP(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570) },
93};
94
95static usb2_callback_t ural_bulk_read_callback;
96static usb2_callback_t ural_bulk_write_callback;
97
98static usb2_proc_callback_t ural_command_wrapper;
99static usb2_proc_callback_t ural_attach_post;
100static usb2_proc_callback_t ural_task;
101static usb2_proc_callback_t ural_scantask;
102static usb2_proc_callback_t ural_promisctask;
103static usb2_proc_callback_t ural_amrr_task;
104static usb2_proc_callback_t ural_init_task;
105static usb2_proc_callback_t ural_stop_task;
106static usb2_proc_callback_t ural_flush_task;
107
108static usb2_error_t	ural_do_request(struct ural_softc *sc,
109			    struct usb2_device_request *req, void *data);
110static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
111			    const char name[IFNAMSIZ], int unit, int opmode,
112			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
113			    const uint8_t mac[IEEE80211_ADDR_LEN]);
114static void		ural_vap_delete(struct ieee80211vap *);
115static void		ural_tx_free(struct ural_tx_data *, int);
116static void		ural_setup_tx_list(struct ural_softc *);
117static void		ural_unsetup_tx_list(struct ural_softc *);
118static int		ural_newstate(struct ieee80211vap *,
119			    enum ieee80211_state, int);
120static void		ural_setup_tx_desc(struct ural_softc *,
121			    struct ural_tx_desc *, uint32_t, int, int);
122static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
123			    struct ieee80211_node *);
124static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
125			    struct ieee80211_node *);
126static int		ural_tx_data(struct ural_softc *, struct mbuf *,
127			    struct ieee80211_node *);
128static void		ural_start(struct ifnet *);
129static int		ural_ioctl(struct ifnet *, u_long, caddr_t);
130static void		ural_set_testmode(struct ural_softc *);
131static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
132			    int);
133static uint16_t		ural_read(struct ural_softc *, uint16_t);
134static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
135			    int);
136static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
137static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
138			    int) __unused;
139static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
140static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
141static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
142static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
143			    const uint8_t mac[IEEE80211_ADDR_LEN]);
144static void		ural_newassoc(struct ieee80211_node *, int);
145static void		ural_scan_start(struct ieee80211com *);
146static void		ural_scan_end(struct ieee80211com *);
147static void		ural_set_channel(struct ieee80211com *);
148static void		ural_set_chan(struct ural_softc *,
149			    struct ieee80211_channel *);
150static void		ural_disable_rf_tune(struct ural_softc *);
151static void		ural_enable_tsf_sync(struct ural_softc *);
152static void		ural_update_slot(struct ifnet *);
153static void		ural_set_txpreamble(struct ural_softc *);
154static void		ural_set_basicrates(struct ural_softc *,
155			    const struct ieee80211_channel *);
156static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
157static void		ural_set_macaddr(struct ural_softc *, uint8_t *);
158static void		ural_update_promisc(struct ifnet *);
159static const char	*ural_get_rf(int);
160static void		ural_read_eeprom(struct ural_softc *);
161static int		ural_bbp_init(struct ural_softc *);
162static void		ural_set_txantenna(struct ural_softc *, int);
163static void		ural_set_rxantenna(struct ural_softc *, int);
164static void		ural_init(void *);
165static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
166			    const struct ieee80211_bpf_params *);
167static void		ural_amrr_start(struct ural_softc *,
168			    struct ieee80211_node *);
169static void		ural_amrr_timeout(void *);
170static int		ural_pause(struct ural_softc *sc, int timeout);
171static void		ural_queue_command(struct ural_softc *,
172			    usb2_proc_callback_t *, struct usb2_proc_msg *,
173			    struct usb2_proc_msg *);
174
175/*
176 * Default values for MAC registers; values taken from the reference driver.
177 */
178static const struct {
179	uint16_t	reg;
180	uint16_t	val;
181} ural_def_mac[] = {
182	{ RAL_TXRX_CSR5,  0x8c8d },
183	{ RAL_TXRX_CSR6,  0x8b8a },
184	{ RAL_TXRX_CSR7,  0x8687 },
185	{ RAL_TXRX_CSR8,  0x0085 },
186	{ RAL_MAC_CSR13,  0x1111 },
187	{ RAL_MAC_CSR14,  0x1e11 },
188	{ RAL_TXRX_CSR21, 0xe78f },
189	{ RAL_MAC_CSR9,   0xff1d },
190	{ RAL_MAC_CSR11,  0x0002 },
191	{ RAL_MAC_CSR22,  0x0053 },
192	{ RAL_MAC_CSR15,  0x0000 },
193	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
194	{ RAL_TXRX_CSR19, 0x0000 },
195	{ RAL_TXRX_CSR18, 0x005a },
196	{ RAL_PHY_CSR2,   0x0000 },
197	{ RAL_TXRX_CSR0,  0x1ec0 },
198	{ RAL_PHY_CSR4,   0x000f }
199};
200
201/*
202 * Default values for BBP registers; values taken from the reference driver.
203 */
204static const struct {
205	uint8_t	reg;
206	uint8_t	val;
207} ural_def_bbp[] = {
208	{  3, 0x02 },
209	{  4, 0x19 },
210	{ 14, 0x1c },
211	{ 15, 0x30 },
212	{ 16, 0xac },
213	{ 17, 0x48 },
214	{ 18, 0x18 },
215	{ 19, 0xff },
216	{ 20, 0x1e },
217	{ 21, 0x08 },
218	{ 22, 0x08 },
219	{ 23, 0x08 },
220	{ 24, 0x80 },
221	{ 25, 0x50 },
222	{ 26, 0x08 },
223	{ 27, 0x23 },
224	{ 30, 0x10 },
225	{ 31, 0x2b },
226	{ 32, 0xb9 },
227	{ 34, 0x12 },
228	{ 35, 0x50 },
229	{ 39, 0xc4 },
230	{ 40, 0x02 },
231	{ 41, 0x60 },
232	{ 53, 0x10 },
233	{ 54, 0x18 },
234	{ 56, 0x08 },
235	{ 57, 0x10 },
236	{ 58, 0x08 },
237	{ 61, 0x60 },
238	{ 62, 0x10 },
239	{ 75, 0xff }
240};
241
242/*
243 * Default values for RF register R2 indexed by channel numbers.
244 */
245static const uint32_t ural_rf2522_r2[] = {
246	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
247	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
248};
249
250static const uint32_t ural_rf2523_r2[] = {
251	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
252	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
253};
254
255static const uint32_t ural_rf2524_r2[] = {
256	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
257	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
258};
259
260static const uint32_t ural_rf2525_r2[] = {
261	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
262	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
263};
264
265static const uint32_t ural_rf2525_hi_r2[] = {
266	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
267	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
268};
269
270static const uint32_t ural_rf2525e_r2[] = {
271	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
272	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
273};
274
275static const uint32_t ural_rf2526_hi_r2[] = {
276	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
277	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
278};
279
280static const uint32_t ural_rf2526_r2[] = {
281	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
282	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
283};
284
285/*
286 * For dual-band RF, RF registers R1 and R4 also depend on channel number;
287 * values taken from the reference driver.
288 */
289static const struct {
290	uint8_t		chan;
291	uint32_t	r1;
292	uint32_t	r2;
293	uint32_t	r4;
294} ural_rf5222[] = {
295	{   1, 0x08808, 0x0044d, 0x00282 },
296	{   2, 0x08808, 0x0044e, 0x00282 },
297	{   3, 0x08808, 0x0044f, 0x00282 },
298	{   4, 0x08808, 0x00460, 0x00282 },
299	{   5, 0x08808, 0x00461, 0x00282 },
300	{   6, 0x08808, 0x00462, 0x00282 },
301	{   7, 0x08808, 0x00463, 0x00282 },
302	{   8, 0x08808, 0x00464, 0x00282 },
303	{   9, 0x08808, 0x00465, 0x00282 },
304	{  10, 0x08808, 0x00466, 0x00282 },
305	{  11, 0x08808, 0x00467, 0x00282 },
306	{  12, 0x08808, 0x00468, 0x00282 },
307	{  13, 0x08808, 0x00469, 0x00282 },
308	{  14, 0x08808, 0x0046b, 0x00286 },
309
310	{  36, 0x08804, 0x06225, 0x00287 },
311	{  40, 0x08804, 0x06226, 0x00287 },
312	{  44, 0x08804, 0x06227, 0x00287 },
313	{  48, 0x08804, 0x06228, 0x00287 },
314	{  52, 0x08804, 0x06229, 0x00287 },
315	{  56, 0x08804, 0x0622a, 0x00287 },
316	{  60, 0x08804, 0x0622b, 0x00287 },
317	{  64, 0x08804, 0x0622c, 0x00287 },
318
319	{ 100, 0x08804, 0x02200, 0x00283 },
320	{ 104, 0x08804, 0x02201, 0x00283 },
321	{ 108, 0x08804, 0x02202, 0x00283 },
322	{ 112, 0x08804, 0x02203, 0x00283 },
323	{ 116, 0x08804, 0x02204, 0x00283 },
324	{ 120, 0x08804, 0x02205, 0x00283 },
325	{ 124, 0x08804, 0x02206, 0x00283 },
326	{ 128, 0x08804, 0x02207, 0x00283 },
327	{ 132, 0x08804, 0x02208, 0x00283 },
328	{ 136, 0x08804, 0x02209, 0x00283 },
329	{ 140, 0x08804, 0x0220a, 0x00283 },
330
331	{ 149, 0x08808, 0x02429, 0x00281 },
332	{ 153, 0x08808, 0x0242b, 0x00281 },
333	{ 157, 0x08808, 0x0242d, 0x00281 },
334	{ 161, 0x08808, 0x0242f, 0x00281 }
335};
336
337static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
338	[URAL_BULK_WR] = {
339		.type = UE_BULK,
340		.endpoint = UE_ADDR_ANY,
341		.direction = UE_DIR_OUT,
342		.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
343		.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
344		.callback = ural_bulk_write_callback,
345		.timeout = 5000,	/* ms */
346	},
347	[URAL_BULK_RD] = {
348		.type = UE_BULK,
349		.endpoint = UE_ADDR_ANY,
350		.direction = UE_DIR_IN,
351		.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
352		.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
353		.callback = ural_bulk_read_callback,
354	},
355};
356
357static device_probe_t ural_match;
358static device_attach_t ural_attach;
359static device_detach_t ural_detach;
360
361static device_method_t ural_methods[] = {
362	/* Device interface */
363	DEVMETHOD(device_probe,		ural_match),
364	DEVMETHOD(device_attach,	ural_attach),
365	DEVMETHOD(device_detach,	ural_detach),
366
367	{ 0, 0 }
368};
369
370static driver_t ural_driver = {
371	.name = "ural",
372	.methods = ural_methods,
373	.size = sizeof(struct ural_softc),
374};
375
376static devclass_t ural_devclass;
377
378DRIVER_MODULE(ural, uhub, ural_driver, ural_devclass, NULL, 0);
379MODULE_DEPEND(ural, usb, 1, 1, 1);
380MODULE_DEPEND(ural, wlan, 1, 1, 1);
381MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
382
383static int
384ural_match(device_t self)
385{
386	struct usb2_attach_arg *uaa = device_get_ivars(self);
387
388	if (uaa->usb2_mode != USB_MODE_HOST)
389		return (ENXIO);
390	if (uaa->info.bConfigIndex != 0)
391		return (ENXIO);
392	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
393		return (ENXIO);
394
395	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
396}
397
398static int
399ural_attach(device_t self)
400{
401	struct usb2_attach_arg *uaa = device_get_ivars(self);
402	struct ural_softc *sc = device_get_softc(self);
403	int error;
404	uint8_t iface_index;
405
406	device_set_usb2_desc(self);
407	sc->sc_udev = uaa->device;
408	sc->sc_dev = self;
409
410	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
411	    MTX_NETWORK_LOCK, MTX_DEF);
412
413	cv_init(&sc->sc_cmd_cv, "wtxdone");
414
415	iface_index = RAL_IFACE_INDEX;
416	error = usb2_transfer_setup(uaa->device,
417	    &iface_index, sc->sc_xfer, ural_config,
418	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
419	if (error) {
420		device_printf(self, "could not allocate USB transfers, "
421		    "err=%s\n", usb2_errstr(error));
422		goto detach;
423	}
424	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
425	    device_get_nameunit(self), USB_PRI_MED);
426	if (error) {
427		device_printf(self, "could not setup config thread!\n");
428		goto detach;
429	}
430
431	/* fork rest of the attach code */
432	RAL_LOCK(sc);
433	ural_queue_command(sc, ural_attach_post,
434	    &sc->sc_synctask[0].hdr,
435	    &sc->sc_synctask[1].hdr);
436	RAL_UNLOCK(sc);
437	return (0);
438
439detach:
440	ural_detach(self);
441	return (ENXIO);			/* failure */
442}
443
444static void
445ural_attach_post(struct usb2_proc_msg *pm)
446{
447	struct ural_task *task = (struct ural_task *)pm;
448	struct ural_softc *sc = task->sc;
449	struct ifnet *ifp;
450	struct ieee80211com *ic;
451	uint8_t bands;
452
453	/* retrieve RT2570 rev. no */
454	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
455
456	/* retrieve MAC address and various other things from EEPROM */
457	ural_read_eeprom(sc);
458
459	/* XXX Async attach race */
460	if (usb2_proc_is_gone(&sc->sc_tq))
461		return;
462
463	RAL_UNLOCK(sc);
464
465	device_printf(sc->sc_dev, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
466	    sc->asic_rev, ural_get_rf(sc->rf_rev));
467
468	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
469	if (ifp == NULL) {
470		device_printf(sc->sc_dev, "can not if_alloc()\n");
471		RAL_LOCK(sc);
472		return;
473	}
474	ic = ifp->if_l2com;
475
476	ifp->if_softc = sc;
477	if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
478	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
479	ifp->if_init = ural_init;
480	ifp->if_ioctl = ural_ioctl;
481	ifp->if_start = ural_start;
482	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
483	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
484	IFQ_SET_READY(&ifp->if_snd);
485
486	ic->ic_ifp = ifp;
487	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
488
489	/* set device capabilities */
490	ic->ic_caps =
491	      IEEE80211_C_STA		/* station mode supported */
492	    | IEEE80211_C_IBSS		/* IBSS mode supported */
493	    | IEEE80211_C_MONITOR	/* monitor mode supported */
494	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
495	    | IEEE80211_C_TXPMGT	/* tx power management */
496	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
497	    | IEEE80211_C_SHSLOT	/* short slot time supported */
498	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
499	    | IEEE80211_C_WPA		/* 802.11i */
500	    ;
501
502	bands = 0;
503	setbit(&bands, IEEE80211_MODE_11B);
504	setbit(&bands, IEEE80211_MODE_11G);
505	if (sc->rf_rev == RAL_RF_5222)
506		setbit(&bands, IEEE80211_MODE_11A);
507	ieee80211_init_channels(ic, NULL, &bands);
508
509	ieee80211_ifattach(ic, sc->sc_bssid);
510	ic->ic_update_promisc = ural_update_promisc;
511	ic->ic_newassoc = ural_newassoc;
512	ic->ic_raw_xmit = ural_raw_xmit;
513	ic->ic_node_alloc = ural_node_alloc;
514	ic->ic_scan_start = ural_scan_start;
515	ic->ic_scan_end = ural_scan_end;
516	ic->ic_set_channel = ural_set_channel;
517
518	ic->ic_vap_create = ural_vap_create;
519	ic->ic_vap_delete = ural_vap_delete;
520
521	bpfattach(ifp, DLT_IEEE802_11_RADIO,
522	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
523
524	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
525	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
526	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
527
528	sc->sc_txtap_len = sizeof sc->sc_txtap;
529	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
530	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
531
532	if (bootverbose)
533		ieee80211_announce(ic);
534
535	RAL_LOCK(sc);
536}
537
538static int
539ural_detach(device_t self)
540{
541	struct ural_softc *sc = device_get_softc(self);
542	struct ifnet *ifp = sc->sc_ifp;
543	struct ieee80211com *ic;
544
545	/* wait for any post attach or other command to complete */
546	usb2_proc_drain(&sc->sc_tq);
547
548	/* stop all USB transfers */
549	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
550	usb2_proc_free(&sc->sc_tq);
551
552	/* free TX list, if any */
553	RAL_LOCK(sc);
554	ural_unsetup_tx_list(sc);
555	RAL_UNLOCK(sc);
556
557	if (ifp) {
558		ic = ifp->if_l2com;
559		bpfdetach(ifp);
560		ieee80211_ifdetach(ic);
561		if_free(ifp);
562	}
563	cv_destroy(&sc->sc_cmd_cv);
564	mtx_destroy(&sc->sc_mtx);
565
566	return (0);
567}
568
569static usb2_error_t
570ural_do_request(struct ural_softc *sc,
571    struct usb2_device_request *req, void *data)
572{
573	usb2_error_t err;
574	int ntries = 10;
575
576	while (ntries--) {
577		err = usb2_do_request_proc(sc->sc_udev, &sc->sc_tq,
578		    req, data, 0, NULL, 250 /* ms */);
579		if (err == 0)
580			break;
581
582		DPRINTFN(1, "Control request failed, %s (retrying)\n",
583		    usb2_errstr(err));
584		if (ural_pause(sc, hz / 100))
585			break;
586	}
587	return (err);
588}
589
590static struct ieee80211vap *
591ural_vap_create(struct ieee80211com *ic,
592	const char name[IFNAMSIZ], int unit, int opmode, int flags,
593	const uint8_t bssid[IEEE80211_ADDR_LEN],
594	const uint8_t mac[IEEE80211_ADDR_LEN])
595{
596	struct ural_softc *sc = ic->ic_ifp->if_softc;
597	struct ural_vap *uvp;
598	struct ieee80211vap *vap;
599
600	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
601		return NULL;
602	uvp = (struct ural_vap *) malloc(sizeof(struct ural_vap),
603	    M_80211_VAP, M_NOWAIT | M_ZERO);
604	if (uvp == NULL)
605		return NULL;
606	vap = &uvp->vap;
607	/* enable s/w bmiss handling for sta mode */
608	ieee80211_vap_setup(ic, vap, name, unit, opmode,
609	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
610
611	/* override state transition machine */
612	uvp->newstate = vap->iv_newstate;
613	vap->iv_newstate = ural_newstate;
614
615	uvp->sc = sc;
616	usb2_callout_init_mtx(&uvp->amrr_ch, &sc->sc_mtx, 0);
617	ieee80211_amrr_init(&uvp->amrr, vap,
618	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
619	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
620	    1000 /* 1 sec */);
621
622	/* complete setup */
623	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
624	ic->ic_opmode = opmode;
625	return vap;
626}
627
628static void
629ural_flush_task(struct usb2_proc_msg *pm)
630{
631	/* nothing to do */
632}
633
634static void
635ural_vap_delete(struct ieee80211vap *vap)
636{
637	struct ural_vap *uvp = URAL_VAP(vap);
638	struct ural_softc *sc = uvp->sc;
639
640	RAL_LOCK(sc);
641	/* wait for any pending tasks to complete */
642	ural_queue_command(sc, ural_flush_task,
643	    &sc->sc_synctask[0].hdr,
644	    &sc->sc_synctask[1].hdr);
645	RAL_UNLOCK(sc);
646
647	usb2_callout_drain(&uvp->amrr_ch);
648	ieee80211_amrr_cleanup(&uvp->amrr);
649	ieee80211_vap_detach(vap);
650	free(uvp, M_80211_VAP);
651}
652
653static void
654ural_tx_free(struct ural_tx_data *data, int txerr)
655{
656	struct ural_softc *sc = data->sc;
657
658	if (data->m != NULL) {
659		if (data->m->m_flags & M_TXCB)
660			ieee80211_process_callback(data->ni, data->m,
661			    txerr ? ETIMEDOUT : 0);
662		m_freem(data->m);
663		data->m = NULL;
664
665		ieee80211_free_node(data->ni);
666		data->ni = NULL;
667	}
668	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
669	sc->tx_nfree++;
670}
671
672static void
673ural_setup_tx_list(struct ural_softc *sc)
674{
675	struct ural_tx_data *data;
676	int i;
677
678	sc->tx_nfree = 0;
679	STAILQ_INIT(&sc->tx_q);
680	STAILQ_INIT(&sc->tx_free);
681
682	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
683		data = &sc->tx_data[i];
684
685		data->sc = sc;
686		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
687		sc->tx_nfree++;
688	}
689}
690
691static void
692ural_unsetup_tx_list(struct ural_softc *sc)
693{
694	struct ural_tx_data *data;
695	int i;
696
697	/* make sure any subsequent use of the queues will fail */
698	sc->tx_nfree = 0;
699	STAILQ_INIT(&sc->tx_q);
700	STAILQ_INIT(&sc->tx_free);
701
702	/* free up all node references and mbufs */
703	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
704		data = &sc->tx_data[i];
705
706		if (data->m != NULL) {
707			m_freem(data->m);
708			data->m = NULL;
709		}
710		if (data->ni != NULL) {
711			ieee80211_free_node(data->ni);
712			data->ni = NULL;
713		}
714	}
715}
716
717static void
718ural_task(struct usb2_proc_msg *pm)
719{
720	struct ural_task *task = (struct ural_task *)pm;
721	struct ural_softc *sc = task->sc;
722	struct ifnet *ifp = sc->sc_ifp;
723	struct ieee80211com *ic = ifp->if_l2com;
724	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
725	struct ural_vap *uvp = URAL_VAP(vap);
726	const struct ieee80211_txparam *tp;
727	enum ieee80211_state ostate;
728	struct ieee80211_node *ni;
729	struct mbuf *m;
730
731	ostate = vap->iv_state;
732
733	switch (sc->sc_state) {
734	case IEEE80211_S_INIT:
735		if (ostate == IEEE80211_S_RUN) {
736			/* abort TSF synchronization */
737			ural_write(sc, RAL_TXRX_CSR19, 0);
738
739			/* force tx led to stop blinking */
740			ural_write(sc, RAL_MAC_CSR20, 0);
741		}
742		break;
743
744	case IEEE80211_S_RUN:
745		ni = vap->iv_bss;
746
747		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
748			ural_update_slot(ic->ic_ifp);
749			ural_set_txpreamble(sc);
750			ural_set_basicrates(sc, ic->ic_bsschan);
751			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
752			ural_set_bssid(sc, sc->sc_bssid);
753		}
754
755		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
756		    vap->iv_opmode == IEEE80211_M_IBSS) {
757			m = ieee80211_beacon_alloc(ni, &uvp->bo);
758			if (m == NULL) {
759				device_printf(sc->sc_dev,
760				    "could not allocate beacon\n");
761				return;
762			}
763
764			if (ural_tx_bcn(sc, m, ni) != 0) {
765				device_printf(sc->sc_dev,
766				    "could not send beacon\n");
767				return;
768			}
769		}
770
771		/* make tx led blink on tx (controlled by ASIC) */
772		ural_write(sc, RAL_MAC_CSR20, 1);
773
774		if (vap->iv_opmode != IEEE80211_M_MONITOR)
775			ural_enable_tsf_sync(sc);
776
777		/* enable automatic rate adaptation */
778		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
779		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
780			ural_amrr_start(sc, ni);
781
782		break;
783
784	default:
785		break;
786	}
787
788	RAL_UNLOCK(sc);
789	IEEE80211_LOCK(ic);
790	uvp->newstate(vap, sc->sc_state, sc->sc_arg);
791	if (vap->iv_newstate_cb != NULL)
792		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
793	IEEE80211_UNLOCK(ic);
794	RAL_LOCK(sc);
795}
796
797static void
798ural_scantask(struct usb2_proc_msg *pm)
799{
800	struct ural_task *task = (struct ural_task *)pm;
801	struct ural_softc *sc = task->sc;
802	struct ifnet *ifp = sc->sc_ifp;
803	struct ieee80211com *ic = ifp->if_l2com;
804
805	RAL_LOCK_ASSERT(sc, MA_OWNED);
806
807	switch (sc->sc_scan_action) {
808	case URAL_SCAN_START:
809		/* abort TSF synchronization */
810		DPRINTF("starting scan\n");
811		ural_write(sc, RAL_TXRX_CSR19, 0);
812		ural_set_bssid(sc, ifp->if_broadcastaddr);
813		break;
814
815	case URAL_SET_CHANNEL:
816		ural_set_chan(sc, ic->ic_curchan);
817		break;
818
819	default: /* URAL_SCAN_END */
820		DPRINTF("stopping scan\n");
821		ural_enable_tsf_sync(sc);
822		ural_set_bssid(sc, sc->sc_bssid);
823		break;
824	}
825}
826
827static int
828ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
829{
830	struct ural_vap *uvp = URAL_VAP(vap);
831	struct ieee80211com *ic = vap->iv_ic;
832	struct ural_softc *sc = ic->ic_ifp->if_softc;
833
834	DPRINTF("%s -> %s\n",
835		ieee80211_state_name[vap->iv_state],
836		ieee80211_state_name[nstate]);
837
838	RAL_LOCK(sc);
839	usb2_callout_stop(&uvp->amrr_ch);
840
841	/* do it in a process context */
842	sc->sc_state = nstate;
843	sc->sc_arg = arg;
844	RAL_UNLOCK(sc);
845
846	if (nstate == IEEE80211_S_INIT) {
847		uvp->newstate(vap, nstate, arg);
848		return 0;
849	} else {
850		RAL_LOCK(sc);
851		ural_queue_command(sc, ural_task, &sc->sc_task[0].hdr,
852		    &sc->sc_task[1].hdr);
853		RAL_UNLOCK(sc);
854		return EINPROGRESS;
855	}
856}
857
858
859static void
860ural_bulk_write_callback(struct usb2_xfer *xfer)
861{
862	struct ural_softc *sc = xfer->priv_sc;
863	struct ifnet *ifp = sc->sc_ifp;
864	struct ieee80211com *ic = ifp->if_l2com;
865	struct ieee80211_channel *c = ic->ic_curchan;
866	struct ural_tx_data *data;
867	struct mbuf *m;
868	unsigned int len;
869
870	/* wakeup waiting command, if any */
871	if (sc->sc_last_task != NULL)
872		cv_signal(&sc->sc_cmd_cv);
873
874	switch (USB_GET_STATE(xfer)) {
875	case USB_ST_TRANSFERRED:
876		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
877
878		/* free resources */
879		data = xfer->priv_fifo;
880		ural_tx_free(data, 0);
881		xfer->priv_fifo = NULL;
882
883		ifp->if_opackets++;
884		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
885
886		/* FALLTHROUGH */
887	case USB_ST_SETUP:
888tr_setup:
889		/* wait for command to complete, if any */
890		if (sc->sc_last_task != NULL)
891			break;
892
893		data = STAILQ_FIRST(&sc->tx_q);
894		if (data) {
895			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
896			m = data->m;
897
898			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
899				DPRINTFN(0, "data overflow, %u bytes\n",
900				    m->m_pkthdr.len);
901				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
902			}
903			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
904			    RAL_TX_DESC_SIZE);
905			usb2_m_copy_in(xfer->frbuffers, RAL_TX_DESC_SIZE, m, 0,
906			    m->m_pkthdr.len);
907
908			if (bpf_peers_present(ifp->if_bpf)) {
909				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
910
911				tap->wt_flags = 0;
912				tap->wt_rate = data->rate;
913				tap->wt_chan_freq = htole16(c->ic_freq);
914				tap->wt_chan_flags = htole16(c->ic_flags);
915				tap->wt_antenna = sc->tx_ant;
916
917				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
918			}
919
920			/* xfer length needs to be a multiple of two! */
921			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
922			if ((len % 64) == 0)
923				len += 2;
924
925			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
926			    m->m_pkthdr.len, len);
927
928			xfer->frlengths[0] = len;
929			xfer->priv_fifo = data;
930
931			usb2_start_hardware(xfer);
932		}
933		break;
934
935	default:			/* Error */
936		DPRINTFN(11, "transfer error, %s\n",
937		    usb2_errstr(xfer->error));
938
939		ifp->if_oerrors++;
940		data = xfer->priv_fifo;
941		if (data != NULL) {
942			ural_tx_free(data, xfer->error);
943			xfer->priv_fifo = NULL;
944		}
945
946		if (xfer->error == USB_ERR_STALLED) {
947			/* try to clear stall first */
948			xfer->flags.stall_pipe = 1;
949			goto tr_setup;
950		}
951		if (xfer->error == USB_ERR_TIMEOUT)
952			device_printf(sc->sc_dev, "device timeout\n");
953		break;
954	}
955}
956
957static void
958ural_bulk_read_callback(struct usb2_xfer *xfer)
959{
960	struct ural_softc *sc = xfer->priv_sc;
961	struct ifnet *ifp = sc->sc_ifp;
962	struct ieee80211com *ic = ifp->if_l2com;
963	struct ieee80211_node *ni;
964	struct mbuf *m = NULL;
965	uint32_t flags;
966	uint8_t rssi = 0;
967	unsigned int len;
968
969	switch (USB_GET_STATE(xfer)) {
970	case USB_ST_TRANSFERRED:
971
972		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
973
974		len = xfer->actlen;
975		if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
976			DPRINTF("%s: xfer too short %d\n",
977			    device_get_nameunit(sc->sc_dev), len);
978			ifp->if_ierrors++;
979			goto tr_setup;
980		}
981
982		len -= RAL_RX_DESC_SIZE;
983		/* rx descriptor is located at the end */
984		usb2_copy_out(xfer->frbuffers, len, &sc->sc_rx_desc,
985		    RAL_RX_DESC_SIZE);
986
987		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
988		flags = le32toh(sc->sc_rx_desc.flags);
989		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
990			/*
991		         * This should not happen since we did not
992		         * request to receive those frames when we
993		         * filled RAL_TXRX_CSR2:
994		         */
995			DPRINTFN(5, "PHY or CRC error\n");
996			ifp->if_ierrors++;
997			goto tr_setup;
998		}
999
1000		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1001		if (m == NULL) {
1002			DPRINTF("could not allocate mbuf\n");
1003			ifp->if_ierrors++;
1004			goto tr_setup;
1005		}
1006		usb2_copy_out(xfer->frbuffers, 0, mtod(m, uint8_t *), len);
1007
1008		/* finalize mbuf */
1009		m->m_pkthdr.rcvif = ifp;
1010		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
1011
1012		if (bpf_peers_present(ifp->if_bpf)) {
1013			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
1014
1015			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1016			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1017			    (flags & RAL_RX_OFDM) ?
1018			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1019			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1020			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1021			tap->wr_antenna = sc->rx_ant;
1022			tap->wr_antsignal = rssi;
1023
1024			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1025		}
1026		/* Strip trailing 802.11 MAC FCS. */
1027		m_adj(m, -IEEE80211_CRC_LEN);
1028
1029		/* FALLTHROUGH */
1030	case USB_ST_SETUP:
1031tr_setup:
1032		xfer->frlengths[0] = xfer->max_data_length;
1033		usb2_start_hardware(xfer);
1034
1035		/*
1036		 * At the end of a USB callback it is always safe to unlock
1037		 * the private mutex of a device! That is why we do the
1038		 * "ieee80211_input" here, and not some lines up!
1039		 */
1040		if (m) {
1041			RAL_UNLOCK(sc);
1042			ni = ieee80211_find_rxnode(ic,
1043			    mtod(m, struct ieee80211_frame_min *));
1044			if (ni != NULL) {
1045				(void) ieee80211_input(ni, m, rssi,
1046				    RAL_NOISE_FLOOR, 0);
1047				ieee80211_free_node(ni);
1048			} else
1049				(void) ieee80211_input_all(ic, m, rssi,
1050				    RAL_NOISE_FLOOR, 0);
1051			RAL_LOCK(sc);
1052		}
1053		return;
1054
1055	default:			/* Error */
1056		if (xfer->error != USB_ERR_CANCELLED) {
1057			/* try to clear stall first */
1058			xfer->flags.stall_pipe = 1;
1059			goto tr_setup;
1060		}
1061		return;
1062	}
1063}
1064
1065static uint8_t
1066ural_plcp_signal(int rate)
1067{
1068	switch (rate) {
1069	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1070	case 12:	return 0xb;
1071	case 18:	return 0xf;
1072	case 24:	return 0xa;
1073	case 36:	return 0xe;
1074	case 48:	return 0x9;
1075	case 72:	return 0xd;
1076	case 96:	return 0x8;
1077	case 108:	return 0xc;
1078
1079	/* CCK rates (NB: not IEEE std, device-specific) */
1080	case 2:		return 0x0;
1081	case 4:		return 0x1;
1082	case 11:	return 0x2;
1083	case 22:	return 0x3;
1084	}
1085	return 0xff;		/* XXX unsupported/unknown rate */
1086}
1087
1088static void
1089ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
1090    uint32_t flags, int len, int rate)
1091{
1092	struct ifnet *ifp = sc->sc_ifp;
1093	struct ieee80211com *ic = ifp->if_l2com;
1094	uint16_t plcp_length;
1095	int remainder;
1096
1097	desc->flags = htole32(flags);
1098	desc->flags |= htole32(RAL_TX_NEWSEQ);
1099	desc->flags |= htole32(len << 16);
1100
1101	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
1102	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
1103
1104	/* setup PLCP fields */
1105	desc->plcp_signal  = ural_plcp_signal(rate);
1106	desc->plcp_service = 4;
1107
1108	len += IEEE80211_CRC_LEN;
1109	if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM) {
1110		desc->flags |= htole32(RAL_TX_OFDM);
1111
1112		plcp_length = len & 0xfff;
1113		desc->plcp_length_hi = plcp_length >> 6;
1114		desc->plcp_length_lo = plcp_length & 0x3f;
1115	} else {
1116		plcp_length = (16 * len + rate - 1) / rate;
1117		if (rate == 22) {
1118			remainder = (16 * len) % 22;
1119			if (remainder != 0 && remainder < 7)
1120				desc->plcp_service |= RAL_PLCP_LENGEXT;
1121		}
1122		desc->plcp_length_hi = plcp_length >> 8;
1123		desc->plcp_length_lo = plcp_length & 0xff;
1124
1125		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1126			desc->plcp_signal |= 0x08;
1127	}
1128
1129	desc->iv = 0;
1130	desc->eiv = 0;
1131}
1132
1133#define RAL_TX_TIMEOUT	5000
1134
1135static int
1136ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1137{
1138	struct ieee80211vap *vap = ni->ni_vap;
1139	struct ieee80211com *ic = ni->ni_ic;
1140	struct ifnet *ifp = sc->sc_ifp;
1141	const struct ieee80211_txparam *tp;
1142	struct ural_tx_data *data;
1143
1144	if (sc->tx_nfree == 0) {
1145		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1146		m_freem(m0);
1147		ieee80211_free_node(ni);
1148		return EIO;
1149	}
1150	data = STAILQ_FIRST(&sc->tx_free);
1151	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1152	sc->tx_nfree--;
1153	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1154
1155	data->m = m0;
1156	data->ni = ni;
1157	data->rate = tp->mgmtrate;
1158
1159	ural_setup_tx_desc(sc, &data->desc,
1160	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1161	    tp->mgmtrate);
1162
1163	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1164	    m0->m_pkthdr.len, tp->mgmtrate);
1165
1166	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1167	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1168
1169	return (0);
1170}
1171
1172static int
1173ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1174{
1175	struct ieee80211vap *vap = ni->ni_vap;
1176	struct ieee80211com *ic = ni->ni_ic;
1177	const struct ieee80211_txparam *tp;
1178	struct ural_tx_data *data;
1179	struct ieee80211_frame *wh;
1180	struct ieee80211_key *k;
1181	uint32_t flags;
1182	uint16_t dur;
1183
1184	RAL_LOCK_ASSERT(sc, MA_OWNED);
1185
1186	data = STAILQ_FIRST(&sc->tx_free);
1187	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1188	sc->tx_nfree--;
1189
1190	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1191
1192	wh = mtod(m0, struct ieee80211_frame *);
1193	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1194		k = ieee80211_crypto_encap(ni, m0);
1195		if (k == NULL) {
1196			m_freem(m0);
1197			return ENOBUFS;
1198		}
1199		wh = mtod(m0, struct ieee80211_frame *);
1200	}
1201
1202	data->m = m0;
1203	data->ni = ni;
1204	data->rate = tp->mgmtrate;
1205
1206	flags = 0;
1207	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1208		flags |= RAL_TX_ACK;
1209
1210		dur = ieee80211_ack_duration(ic->ic_rt, tp->mgmtrate,
1211		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1212		*(uint16_t *)wh->i_dur = htole16(dur);
1213
1214		/* tell hardware to add timestamp for probe responses */
1215		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1216		    IEEE80211_FC0_TYPE_MGT &&
1217		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1218		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1219			flags |= RAL_TX_TIMESTAMP;
1220	}
1221
1222	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1223
1224	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1225	    m0->m_pkthdr.len, tp->mgmtrate);
1226
1227	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1228	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1229
1230	return 0;
1231}
1232
1233static int
1234ural_sendprot(struct ural_softc *sc,
1235    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1236{
1237	struct ieee80211com *ic = ni->ni_ic;
1238	const struct ieee80211_frame *wh;
1239	struct ural_tx_data *data;
1240	struct mbuf *mprot;
1241	int protrate, ackrate, pktlen, flags, isshort;
1242	uint16_t dur;
1243
1244	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1245	    ("protection %d", prot));
1246
1247	wh = mtod(m, const struct ieee80211_frame *);
1248	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1249
1250	protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
1251	ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
1252
1253	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1254	dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort);
1255	    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1256	flags = RAL_TX_RETRY(7);
1257	if (prot == IEEE80211_PROT_RTSCTS) {
1258		/* NB: CTS is the same size as an ACK */
1259		dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1260		flags |= RAL_TX_ACK;
1261		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1262	} else {
1263		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1264	}
1265	if (mprot == NULL) {
1266		/* XXX stat + msg */
1267		return ENOBUFS;
1268	}
1269	data = STAILQ_FIRST(&sc->tx_free);
1270	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1271	sc->tx_nfree--;
1272
1273	data->m = mprot;
1274	data->ni = ieee80211_ref_node(ni);
1275	data->rate = protrate;
1276	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1277
1278	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1279	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1280
1281	return 0;
1282}
1283
1284static int
1285ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1286    const struct ieee80211_bpf_params *params)
1287{
1288	struct ural_tx_data *data;
1289	uint32_t flags;
1290	int error;
1291	int rate;
1292
1293	RAL_LOCK_ASSERT(sc, MA_OWNED);
1294	KASSERT(params != NULL, ("no raw xmit params"));
1295
1296	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1297	/* XXX validate */
1298	if (rate == 0) {
1299		m_freem(m0);
1300		return EINVAL;
1301	}
1302	flags = 0;
1303	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1304		flags |= RAL_TX_ACK;
1305	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1306		error = ural_sendprot(sc, m0, ni,
1307		    params->ibp_flags & IEEE80211_BPF_RTS ?
1308			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1309		    rate);
1310		if (error || sc->tx_nfree == 0) {
1311			m_freem(m0);
1312			return ENOBUFS;
1313		}
1314		flags |= RAL_TX_IFS_SIFS;
1315	}
1316
1317	data = STAILQ_FIRST(&sc->tx_free);
1318	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1319	sc->tx_nfree--;
1320
1321	data->m = m0;
1322	data->ni = ni;
1323	data->rate = rate;
1324
1325	/* XXX need to setup descriptor ourself */
1326	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1327
1328	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1329	    m0->m_pkthdr.len, rate);
1330
1331	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1332	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1333
1334	return 0;
1335}
1336
1337static int
1338ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1339{
1340	struct ieee80211vap *vap = ni->ni_vap;
1341	struct ieee80211com *ic = ni->ni_ic;
1342	struct ural_tx_data *data;
1343	struct ieee80211_frame *wh;
1344	const struct ieee80211_txparam *tp;
1345	struct ieee80211_key *k;
1346	uint32_t flags = 0;
1347	uint16_t dur;
1348	int error, rate;
1349
1350	RAL_LOCK_ASSERT(sc, MA_OWNED);
1351
1352	wh = mtod(m0, struct ieee80211_frame *);
1353
1354	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1355	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1356		rate = tp->mcastrate;
1357	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1358		rate = tp->ucastrate;
1359	else
1360		rate = ni->ni_txrate;
1361
1362	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1363		k = ieee80211_crypto_encap(ni, m0);
1364		if (k == NULL) {
1365			m_freem(m0);
1366			return ENOBUFS;
1367		}
1368		/* packet header may have moved, reset our local pointer */
1369		wh = mtod(m0, struct ieee80211_frame *);
1370	}
1371
1372	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1373		int prot = IEEE80211_PROT_NONE;
1374		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1375			prot = IEEE80211_PROT_RTSCTS;
1376		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1377		    ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM)
1378			prot = ic->ic_protmode;
1379		if (prot != IEEE80211_PROT_NONE) {
1380			error = ural_sendprot(sc, m0, ni, prot, rate);
1381			if (error || sc->tx_nfree == 0) {
1382				m_freem(m0);
1383				return ENOBUFS;
1384			}
1385			flags |= RAL_TX_IFS_SIFS;
1386		}
1387	}
1388
1389	data = STAILQ_FIRST(&sc->tx_free);
1390	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1391	sc->tx_nfree--;
1392
1393	data->m = m0;
1394	data->ni = ni;
1395	data->rate = rate;
1396
1397	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1398		flags |= RAL_TX_ACK;
1399		flags |= RAL_TX_RETRY(7);
1400
1401		dur = ieee80211_ack_duration(ic->ic_rt, rate,
1402		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1403		*(uint16_t *)wh->i_dur = htole16(dur);
1404	}
1405
1406	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1407
1408	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1409	    m0->m_pkthdr.len, rate);
1410
1411	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1412	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1413
1414	return 0;
1415}
1416
1417static void
1418ural_start(struct ifnet *ifp)
1419{
1420	struct ural_softc *sc = ifp->if_softc;
1421	struct ieee80211_node *ni;
1422	struct mbuf *m;
1423
1424	RAL_LOCK(sc);
1425	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1426		RAL_UNLOCK(sc);
1427		return;
1428	}
1429	for (;;) {
1430		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1431		if (m == NULL)
1432			break;
1433		if (sc->tx_nfree < RAL_TX_MINFREE) {
1434			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1435			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1436			break;
1437		}
1438		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1439		if (ural_tx_data(sc, m, ni) != 0) {
1440			ieee80211_free_node(ni);
1441			ifp->if_oerrors++;
1442			break;
1443		}
1444	}
1445	RAL_UNLOCK(sc);
1446}
1447
1448static int
1449ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1450{
1451	struct ural_softc *sc = ifp->if_softc;
1452	struct ieee80211com *ic = ifp->if_l2com;
1453	struct ifreq *ifr = (struct ifreq *) data;
1454	int error = 0, startall = 0;
1455
1456	switch (cmd) {
1457	case SIOCSIFFLAGS:
1458		RAL_LOCK(sc);
1459		if (ifp->if_flags & IFF_UP) {
1460			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1461				ural_queue_command(sc, ural_init_task,
1462				    &sc->sc_synctask[0].hdr,
1463				    &sc->sc_synctask[1].hdr);
1464				startall = 1;
1465			} else
1466				ural_queue_command(sc, ural_promisctask,
1467				    &sc->sc_promisctask[0].hdr,
1468				    &sc->sc_promisctask[1].hdr);
1469		} else {
1470			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1471				ural_queue_command(sc, ural_stop_task,
1472				    &sc->sc_synctask[0].hdr,
1473				    &sc->sc_synctask[1].hdr);
1474			}
1475		}
1476		RAL_UNLOCK(sc);
1477		if (startall)
1478			ieee80211_start_all(ic);
1479		break;
1480	case SIOCGIFMEDIA:
1481	case SIOCSIFMEDIA:
1482		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1483		break;
1484	default:
1485		error = ether_ioctl(ifp, cmd, data);
1486		break;
1487	}
1488	return error;
1489}
1490
1491static void
1492ural_set_testmode(struct ural_softc *sc)
1493{
1494	struct usb2_device_request req;
1495	usb2_error_t error;
1496
1497	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1498	req.bRequest = RAL_VENDOR_REQUEST;
1499	USETW(req.wValue, 4);
1500	USETW(req.wIndex, 1);
1501	USETW(req.wLength, 0);
1502
1503	error = ural_do_request(sc, &req, NULL);
1504	if (error != 0) {
1505		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1506		    usb2_errstr(error));
1507	}
1508}
1509
1510static void
1511ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1512{
1513	struct usb2_device_request req;
1514	usb2_error_t error;
1515
1516	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1517	req.bRequest = RAL_READ_EEPROM;
1518	USETW(req.wValue, 0);
1519	USETW(req.wIndex, addr);
1520	USETW(req.wLength, len);
1521
1522	error = ural_do_request(sc, &req, buf);
1523	if (error != 0) {
1524		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1525		    usb2_errstr(error));
1526	}
1527}
1528
1529static uint16_t
1530ural_read(struct ural_softc *sc, uint16_t reg)
1531{
1532	struct usb2_device_request req;
1533	usb2_error_t error;
1534	uint16_t val;
1535
1536	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1537	req.bRequest = RAL_READ_MAC;
1538	USETW(req.wValue, 0);
1539	USETW(req.wIndex, reg);
1540	USETW(req.wLength, sizeof (uint16_t));
1541
1542	error = ural_do_request(sc, &req, &val);
1543	if (error != 0) {
1544		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1545		    usb2_errstr(error));
1546		return 0;
1547	}
1548
1549	return le16toh(val);
1550}
1551
1552static void
1553ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1554{
1555	struct usb2_device_request req;
1556	usb2_error_t error;
1557
1558	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1559	req.bRequest = RAL_READ_MULTI_MAC;
1560	USETW(req.wValue, 0);
1561	USETW(req.wIndex, reg);
1562	USETW(req.wLength, len);
1563
1564	error = ural_do_request(sc, &req, buf);
1565	if (error != 0) {
1566		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1567		    usb2_errstr(error));
1568	}
1569}
1570
1571static void
1572ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1573{
1574	struct usb2_device_request req;
1575	usb2_error_t error;
1576
1577	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1578	req.bRequest = RAL_WRITE_MAC;
1579	USETW(req.wValue, val);
1580	USETW(req.wIndex, reg);
1581	USETW(req.wLength, 0);
1582
1583	error = ural_do_request(sc, &req, NULL);
1584	if (error != 0) {
1585		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1586		    usb2_errstr(error));
1587	}
1588}
1589
1590static void
1591ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1592{
1593	struct usb2_device_request req;
1594	usb2_error_t error;
1595
1596	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1597	req.bRequest = RAL_WRITE_MULTI_MAC;
1598	USETW(req.wValue, 0);
1599	USETW(req.wIndex, reg);
1600	USETW(req.wLength, len);
1601
1602	error = ural_do_request(sc, &req, buf);
1603	if (error != 0) {
1604		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1605		    usb2_errstr(error));
1606	}
1607}
1608
1609static void
1610ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1611{
1612	uint16_t tmp;
1613	int ntries;
1614
1615	for (ntries = 0; ntries < 100; ntries++) {
1616		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1617			break;
1618		if (ural_pause(sc, hz / 100))
1619			break;
1620	}
1621	if (ntries == 100) {
1622		device_printf(sc->sc_dev, "could not write to BBP\n");
1623		return;
1624	}
1625
1626	tmp = reg << 8 | val;
1627	ural_write(sc, RAL_PHY_CSR7, tmp);
1628}
1629
1630static uint8_t
1631ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1632{
1633	uint16_t val;
1634	int ntries;
1635
1636	val = RAL_BBP_WRITE | reg << 8;
1637	ural_write(sc, RAL_PHY_CSR7, val);
1638
1639	for (ntries = 0; ntries < 100; ntries++) {
1640		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1641			break;
1642		if (ural_pause(sc, hz / 100))
1643			break;
1644	}
1645	if (ntries == 100) {
1646		device_printf(sc->sc_dev, "could not read BBP\n");
1647		return 0;
1648	}
1649
1650	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1651}
1652
1653static void
1654ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1655{
1656	uint32_t tmp;
1657	int ntries;
1658
1659	for (ntries = 0; ntries < 100; ntries++) {
1660		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1661			break;
1662		if (ural_pause(sc, hz / 100))
1663			break;
1664	}
1665	if (ntries == 100) {
1666		device_printf(sc->sc_dev, "could not write to RF\n");
1667		return;
1668	}
1669
1670	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1671	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1672	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1673
1674	/* remember last written value in sc */
1675	sc->rf_regs[reg] = val;
1676
1677	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1678}
1679
1680/* ARGUSED */
1681static struct ieee80211_node *
1682ural_node_alloc(struct ieee80211vap *vap __unused,
1683	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
1684{
1685	struct ural_node *un;
1686
1687	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1688	return un != NULL ? &un->ni : NULL;
1689}
1690
1691static void
1692ural_newassoc(struct ieee80211_node *ni, int isnew)
1693{
1694	struct ieee80211vap *vap = ni->ni_vap;
1695
1696	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
1697}
1698
1699static void
1700ural_scan_start(struct ieee80211com *ic)
1701{
1702	struct ural_softc *sc = ic->ic_ifp->if_softc;
1703
1704	RAL_LOCK(sc);
1705	/* do it in a process context */
1706	sc->sc_scan_action = URAL_SCAN_START;
1707	ural_queue_command(sc, ural_scantask,
1708	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1709	RAL_UNLOCK(sc);
1710
1711}
1712
1713static void
1714ural_scan_end(struct ieee80211com *ic)
1715{
1716	struct ural_softc *sc = ic->ic_ifp->if_softc;
1717
1718	RAL_LOCK(sc);
1719	/* do it in a process context */
1720	sc->sc_scan_action = URAL_SCAN_END;
1721	ural_queue_command(sc, ural_scantask,
1722	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1723	RAL_UNLOCK(sc);
1724
1725}
1726
1727static void
1728ural_set_channel(struct ieee80211com *ic)
1729{
1730	struct ural_softc *sc = ic->ic_ifp->if_softc;
1731
1732	RAL_LOCK(sc);
1733	/* do it in a process context */
1734	sc->sc_scan_action = URAL_SET_CHANNEL;
1735	ural_queue_command(sc, ural_scantask,
1736	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1737	RAL_UNLOCK(sc);
1738}
1739
1740static void
1741ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1742{
1743	struct ifnet *ifp = sc->sc_ifp;
1744	struct ieee80211com *ic = ifp->if_l2com;
1745	uint8_t power, tmp;
1746	int i, chan;
1747
1748	chan = ieee80211_chan2ieee(ic, c);
1749	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1750		return;
1751
1752	if (IEEE80211_IS_CHAN_2GHZ(c))
1753		power = min(sc->txpow[chan - 1], 31);
1754	else
1755		power = 31;
1756
1757	/* adjust txpower using ifconfig settings */
1758	power -= (100 - ic->ic_txpowlimit) / 8;
1759
1760	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1761
1762	switch (sc->rf_rev) {
1763	case RAL_RF_2522:
1764		ural_rf_write(sc, RAL_RF1, 0x00814);
1765		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1766		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1767		break;
1768
1769	case RAL_RF_2523:
1770		ural_rf_write(sc, RAL_RF1, 0x08804);
1771		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1772		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1773		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1774		break;
1775
1776	case RAL_RF_2524:
1777		ural_rf_write(sc, RAL_RF1, 0x0c808);
1778		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1779		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1780		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1781		break;
1782
1783	case RAL_RF_2525:
1784		ural_rf_write(sc, RAL_RF1, 0x08808);
1785		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1786		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1787		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1788
1789		ural_rf_write(sc, RAL_RF1, 0x08808);
1790		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1791		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1792		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1793		break;
1794
1795	case RAL_RF_2525E:
1796		ural_rf_write(sc, RAL_RF1, 0x08808);
1797		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1798		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1799		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1800		break;
1801
1802	case RAL_RF_2526:
1803		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1804		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1805		ural_rf_write(sc, RAL_RF1, 0x08804);
1806
1807		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1808		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1809		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1810		break;
1811
1812	/* dual-band RF */
1813	case RAL_RF_5222:
1814		for (i = 0; ural_rf5222[i].chan != chan; i++);
1815
1816		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1817		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1818		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1819		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1820		break;
1821	}
1822
1823	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1824	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1825		/* set Japan filter bit for channel 14 */
1826		tmp = ural_bbp_read(sc, 70);
1827
1828		tmp &= ~RAL_JAPAN_FILTER;
1829		if (chan == 14)
1830			tmp |= RAL_JAPAN_FILTER;
1831
1832		ural_bbp_write(sc, 70, tmp);
1833
1834		/* clear CRC errors */
1835		ural_read(sc, RAL_STA_CSR0);
1836
1837		ural_pause(sc, hz / 100);
1838		ural_disable_rf_tune(sc);
1839	}
1840
1841	/* XXX doesn't belong here */
1842	/* update basic rate set */
1843	ural_set_basicrates(sc, c);
1844
1845	/* give the hardware some time to do the switchover */
1846	ural_pause(sc, hz / 100);
1847}
1848
1849/*
1850 * Disable RF auto-tuning.
1851 */
1852static void
1853ural_disable_rf_tune(struct ural_softc *sc)
1854{
1855	uint32_t tmp;
1856
1857	if (sc->rf_rev != RAL_RF_2523) {
1858		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1859		ural_rf_write(sc, RAL_RF1, tmp);
1860	}
1861
1862	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1863	ural_rf_write(sc, RAL_RF3, tmp);
1864
1865	DPRINTFN(2, "disabling RF autotune\n");
1866}
1867
1868/*
1869 * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1870 * synchronization.
1871 */
1872static void
1873ural_enable_tsf_sync(struct ural_softc *sc)
1874{
1875	struct ifnet *ifp = sc->sc_ifp;
1876	struct ieee80211com *ic = ifp->if_l2com;
1877	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1878	uint16_t logcwmin, preload, tmp;
1879
1880	/* first, disable TSF synchronization */
1881	ural_write(sc, RAL_TXRX_CSR19, 0);
1882
1883	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1884	ural_write(sc, RAL_TXRX_CSR18, tmp);
1885
1886	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1887	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1888	tmp = logcwmin << 12 | preload;
1889	ural_write(sc, RAL_TXRX_CSR20, tmp);
1890
1891	/* finally, enable TSF synchronization */
1892	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1893	if (ic->ic_opmode == IEEE80211_M_STA)
1894		tmp |= RAL_ENABLE_TSF_SYNC(1);
1895	else
1896		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1897	ural_write(sc, RAL_TXRX_CSR19, tmp);
1898
1899	DPRINTF("enabling TSF synchronization\n");
1900}
1901
1902#define RAL_RXTX_TURNAROUND	5	/* us */
1903static void
1904ural_update_slot(struct ifnet *ifp)
1905{
1906	struct ural_softc *sc = ifp->if_softc;
1907	struct ieee80211com *ic = ifp->if_l2com;
1908	uint16_t slottime, sifs, eifs;
1909
1910	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1911
1912	/*
1913	 * These settings may sound a bit inconsistent but this is what the
1914	 * reference driver does.
1915	 */
1916	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1917		sifs = 16 - RAL_RXTX_TURNAROUND;
1918		eifs = 364;
1919	} else {
1920		sifs = 10 - RAL_RXTX_TURNAROUND;
1921		eifs = 64;
1922	}
1923
1924	ural_write(sc, RAL_MAC_CSR10, slottime);
1925	ural_write(sc, RAL_MAC_CSR11, sifs);
1926	ural_write(sc, RAL_MAC_CSR12, eifs);
1927}
1928
1929static void
1930ural_set_txpreamble(struct ural_softc *sc)
1931{
1932	struct ifnet *ifp = sc->sc_ifp;
1933	struct ieee80211com *ic = ifp->if_l2com;
1934	uint16_t tmp;
1935
1936	tmp = ural_read(sc, RAL_TXRX_CSR10);
1937
1938	tmp &= ~RAL_SHORT_PREAMBLE;
1939	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1940		tmp |= RAL_SHORT_PREAMBLE;
1941
1942	ural_write(sc, RAL_TXRX_CSR10, tmp);
1943}
1944
1945static void
1946ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1947{
1948	/* XXX wrong, take from rate set */
1949	/* update basic rate set */
1950	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1951		/* 11a basic rates: 6, 12, 24Mbps */
1952		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1953	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1954		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1955		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1956	} else {
1957		/* 11b basic rates: 1, 2Mbps */
1958		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1959	}
1960}
1961
1962static void
1963ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1964{
1965	uint16_t tmp;
1966
1967	tmp = bssid[0] | bssid[1] << 8;
1968	ural_write(sc, RAL_MAC_CSR5, tmp);
1969
1970	tmp = bssid[2] | bssid[3] << 8;
1971	ural_write(sc, RAL_MAC_CSR6, tmp);
1972
1973	tmp = bssid[4] | bssid[5] << 8;
1974	ural_write(sc, RAL_MAC_CSR7, tmp);
1975
1976	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1977}
1978
1979static void
1980ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1981{
1982	uint16_t tmp;
1983
1984	tmp = addr[0] | addr[1] << 8;
1985	ural_write(sc, RAL_MAC_CSR2, tmp);
1986
1987	tmp = addr[2] | addr[3] << 8;
1988	ural_write(sc, RAL_MAC_CSR3, tmp);
1989
1990	tmp = addr[4] | addr[5] << 8;
1991	ural_write(sc, RAL_MAC_CSR4, tmp);
1992
1993	DPRINTF("setting MAC address to %6D\n", addr, ":");
1994}
1995
1996static void
1997ural_promisctask(struct usb2_proc_msg *pm)
1998{
1999	struct ural_task *task = (struct ural_task *)pm;
2000	struct ural_softc *sc = task->sc;
2001	struct ifnet *ifp = sc->sc_ifp;
2002	uint32_t tmp;
2003
2004	tmp = ural_read(sc, RAL_TXRX_CSR2);
2005
2006	tmp &= ~RAL_DROP_NOT_TO_ME;
2007	if (!(ifp->if_flags & IFF_PROMISC))
2008		tmp |= RAL_DROP_NOT_TO_ME;
2009
2010	ural_write(sc, RAL_TXRX_CSR2, tmp);
2011
2012	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2013	    "entering" : "leaving");
2014}
2015
2016static void
2017ural_update_promisc(struct ifnet *ifp)
2018{
2019	struct ural_softc *sc = ifp->if_softc;
2020
2021	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
2022		return;
2023
2024	RAL_LOCK(sc);
2025	ural_queue_command(sc, ural_promisctask,
2026	    &sc->sc_promisctask[0].hdr,
2027	    &sc->sc_promisctask[1].hdr);
2028	RAL_UNLOCK(sc);
2029}
2030
2031static const char *
2032ural_get_rf(int rev)
2033{
2034	switch (rev) {
2035	case RAL_RF_2522:	return "RT2522";
2036	case RAL_RF_2523:	return "RT2523";
2037	case RAL_RF_2524:	return "RT2524";
2038	case RAL_RF_2525:	return "RT2525";
2039	case RAL_RF_2525E:	return "RT2525e";
2040	case RAL_RF_2526:	return "RT2526";
2041	case RAL_RF_5222:	return "RT5222";
2042	default:		return "unknown";
2043	}
2044}
2045
2046static void
2047ural_read_eeprom(struct ural_softc *sc)
2048{
2049	uint16_t val;
2050
2051	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
2052	val = le16toh(val);
2053	sc->rf_rev =   (val >> 11) & 0x7;
2054	sc->hw_radio = (val >> 10) & 0x1;
2055	sc->led_mode = (val >> 6)  & 0x7;
2056	sc->rx_ant =   (val >> 4)  & 0x3;
2057	sc->tx_ant =   (val >> 2)  & 0x3;
2058	sc->nb_ant =   val & 0x3;
2059
2060	/* read MAC address */
2061	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_bssid, 6);
2062
2063	/* read default values for BBP registers */
2064	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
2065
2066	/* read Tx power for all b/g channels */
2067	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
2068}
2069
2070static int
2071ural_bbp_init(struct ural_softc *sc)
2072{
2073#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2074	int i, ntries;
2075
2076	/* wait for BBP to be ready */
2077	for (ntries = 0; ntries < 100; ntries++) {
2078		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
2079			break;
2080		if (ural_pause(sc, hz / 100))
2081			break;
2082	}
2083	if (ntries == 100) {
2084		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2085		return EIO;
2086	}
2087
2088	/* initialize BBP registers to default values */
2089	for (i = 0; i < N(ural_def_bbp); i++)
2090		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
2091
2092#if 0
2093	/* initialize BBP registers to values stored in EEPROM */
2094	for (i = 0; i < 16; i++) {
2095		if (sc->bbp_prom[i].reg == 0xff)
2096			continue;
2097		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2098	}
2099#endif
2100
2101	return 0;
2102#undef N
2103}
2104
2105static void
2106ural_set_txantenna(struct ural_softc *sc, int antenna)
2107{
2108	uint16_t tmp;
2109	uint8_t tx;
2110
2111	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
2112	if (antenna == 1)
2113		tx |= RAL_BBP_ANTA;
2114	else if (antenna == 2)
2115		tx |= RAL_BBP_ANTB;
2116	else
2117		tx |= RAL_BBP_DIVERSITY;
2118
2119	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2120	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
2121	    sc->rf_rev == RAL_RF_5222)
2122		tx |= RAL_BBP_FLIPIQ;
2123
2124	ural_bbp_write(sc, RAL_BBP_TX, tx);
2125
2126	/* update values in PHY_CSR5 and PHY_CSR6 */
2127	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
2128	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2129
2130	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
2131	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2132}
2133
2134static void
2135ural_set_rxantenna(struct ural_softc *sc, int antenna)
2136{
2137	uint8_t rx;
2138
2139	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2140	if (antenna == 1)
2141		rx |= RAL_BBP_ANTA;
2142	else if (antenna == 2)
2143		rx |= RAL_BBP_ANTB;
2144	else
2145		rx |= RAL_BBP_DIVERSITY;
2146
2147	/* need to force no I/Q flip for RF 2525e and 2526 */
2148	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2149		rx &= ~RAL_BBP_FLIPIQ;
2150
2151	ural_bbp_write(sc, RAL_BBP_RX, rx);
2152}
2153
2154static void
2155ural_init_task(struct usb2_proc_msg *pm)
2156{
2157#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2158	struct ural_task *task = (struct ural_task *)pm;
2159	struct ural_softc *sc = task->sc;
2160	struct ifnet *ifp = sc->sc_ifp;
2161	struct ieee80211com *ic = ifp->if_l2com;
2162	uint16_t tmp;
2163	int i, ntries;
2164
2165	RAL_LOCK_ASSERT(sc, MA_OWNED);
2166
2167	ural_set_testmode(sc);
2168	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2169
2170	ural_stop_task(pm);
2171
2172	/* initialize MAC registers to default values */
2173	for (i = 0; i < N(ural_def_mac); i++)
2174		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2175
2176	/* wait for BBP and RF to wake up (this can take a long time!) */
2177	for (ntries = 0; ntries < 100; ntries++) {
2178		tmp = ural_read(sc, RAL_MAC_CSR17);
2179		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2180		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2181			break;
2182		if (ural_pause(sc, hz / 100))
2183			break;
2184	}
2185	if (ntries == 100) {
2186		device_printf(sc->sc_dev,
2187		    "timeout waiting for BBP/RF to wakeup\n");
2188		goto fail;
2189	}
2190
2191	/* we're ready! */
2192	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2193
2194	/* set basic rate set (will be updated later) */
2195	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2196
2197	if (ural_bbp_init(sc) != 0)
2198		goto fail;
2199
2200	ural_set_chan(sc, ic->ic_curchan);
2201
2202	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2203	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2204
2205	ural_set_txantenna(sc, sc->tx_ant);
2206	ural_set_rxantenna(sc, sc->rx_ant);
2207
2208	ural_set_macaddr(sc, IF_LLADDR(ifp));
2209
2210	/*
2211	 * Allocate Tx and Rx xfer queues.
2212	 */
2213	ural_setup_tx_list(sc);
2214
2215	/* kick Rx */
2216	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2217	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2218		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2219		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2220			tmp |= RAL_DROP_TODS;
2221		if (!(ifp->if_flags & IFF_PROMISC))
2222			tmp |= RAL_DROP_NOT_TO_ME;
2223	}
2224	ural_write(sc, RAL_TXRX_CSR2, tmp);
2225
2226	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2227	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2228	usb2_transfer_set_stall(sc->sc_xfer[URAL_BULK_WR]);
2229	usb2_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2230	return;
2231
2232fail:	ural_stop_task(pm);
2233#undef N
2234}
2235
2236static void
2237ural_init(void *priv)
2238{
2239	struct ural_softc *sc = priv;
2240	struct ifnet *ifp = sc->sc_ifp;
2241	struct ieee80211com *ic = ifp->if_l2com;
2242
2243	RAL_LOCK(sc);
2244	ural_queue_command(sc, ural_init_task,
2245	    &sc->sc_synctask[0].hdr,
2246	    &sc->sc_synctask[1].hdr);
2247	RAL_UNLOCK(sc);
2248
2249	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2250		ieee80211_start_all(ic);		/* start all vap's */
2251}
2252
2253static void
2254ural_stop_task(struct usb2_proc_msg *pm)
2255{
2256	struct ural_task *task = (struct ural_task *)pm;
2257	struct ural_softc *sc = task->sc;
2258	struct ifnet *ifp = sc->sc_ifp;
2259
2260	RAL_LOCK_ASSERT(sc, MA_OWNED);
2261
2262	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2263
2264	/*
2265	 * Drain all the transfers, if not already drained:
2266	 */
2267	RAL_UNLOCK(sc);
2268	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_WR]);
2269	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_RD]);
2270	RAL_LOCK(sc);
2271
2272	ural_unsetup_tx_list(sc);
2273
2274	/* disable Rx */
2275	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2276	/* reset ASIC and BBP (but won't reset MAC registers!) */
2277	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2278	/* wait a little */
2279	ural_pause(sc, hz / 10);
2280	ural_write(sc, RAL_MAC_CSR1, 0);
2281	/* wait a little */
2282	ural_pause(sc, hz / 10);
2283}
2284
2285static int
2286ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2287	const struct ieee80211_bpf_params *params)
2288{
2289	struct ieee80211com *ic = ni->ni_ic;
2290	struct ifnet *ifp = ic->ic_ifp;
2291	struct ural_softc *sc = ifp->if_softc;
2292
2293	RAL_LOCK(sc);
2294	/* prevent management frames from being sent if we're not ready */
2295	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2296		RAL_UNLOCK(sc);
2297		m_freem(m);
2298		ieee80211_free_node(ni);
2299		return ENETDOWN;
2300	}
2301	if (sc->tx_nfree < RAL_TX_MINFREE) {
2302		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2303		RAL_UNLOCK(sc);
2304		m_freem(m);
2305		ieee80211_free_node(ni);
2306		return EIO;
2307	}
2308
2309	ifp->if_opackets++;
2310
2311	if (params == NULL) {
2312		/*
2313		 * Legacy path; interpret frame contents to decide
2314		 * precisely how to send the frame.
2315		 */
2316		if (ural_tx_mgt(sc, m, ni) != 0)
2317			goto bad;
2318	} else {
2319		/*
2320		 * Caller supplied explicit parameters to use in
2321		 * sending the frame.
2322		 */
2323		if (ural_tx_raw(sc, m, ni, params) != 0)
2324			goto bad;
2325	}
2326	RAL_UNLOCK(sc);
2327	return 0;
2328bad:
2329	ifp->if_oerrors++;
2330	RAL_UNLOCK(sc);
2331	ieee80211_free_node(ni);
2332	return EIO;		/* XXX */
2333}
2334
2335static void
2336ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
2337{
2338	struct ieee80211vap *vap = ni->ni_vap;
2339	struct ural_vap *uvp = URAL_VAP(vap);
2340
2341	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2342	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2343
2344	ieee80211_amrr_node_init(&uvp->amrr, &URAL_NODE(ni)->amn, ni);
2345
2346	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2347}
2348
2349static void
2350ural_amrr_timeout(void *arg)
2351{
2352	struct ural_vap *uvp = arg;
2353	struct ural_softc *sc = uvp->sc;
2354
2355	ural_queue_command(sc, ural_amrr_task,
2356	    &uvp->amrr_task[0].hdr, &uvp->amrr_task[1].hdr);
2357}
2358
2359static void
2360ural_amrr_task(struct usb2_proc_msg *pm)
2361{
2362	struct ural_task *task = (struct ural_task *)pm;
2363	struct ural_softc *sc = task->sc;
2364	struct ifnet *ifp = sc->sc_ifp;
2365	struct ieee80211com *ic = ifp->if_l2com;
2366	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2367	struct ural_vap *uvp = URAL_VAP(vap);
2368	struct ieee80211_node *ni = vap->iv_bss;
2369	int ok, fail;
2370
2371	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2372	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2373
2374	ok = sc->sta[7] +		/* TX ok w/o retry */
2375	     sc->sta[8];		/* TX ok w/ retry */
2376	fail = sc->sta[9];		/* TX retry-fail count */
2377
2378	ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2379	    ok+fail, ok, sc->sta[8] + fail);
2380	(void) ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn);
2381
2382	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2383
2384	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2385}
2386
2387static int
2388ural_pause(struct ural_softc *sc, int timeout)
2389{
2390	if (usb2_proc_is_gone(&sc->sc_tq))
2391		return (1);
2392
2393	usb2_pause_mtx(&sc->sc_mtx, timeout);
2394	return (0);
2395}
2396
2397static void
2398ural_command_wrapper(struct usb2_proc_msg *pm)
2399{
2400	struct ural_task *task = (struct ural_task *)pm;
2401	struct ural_softc *sc = task->sc;
2402	struct ifnet *ifp;
2403
2404	/* wait for pending transfer, if any */
2405	while (usb2_transfer_pending(sc->sc_xfer[URAL_BULK_WR]))
2406		cv_wait(&sc->sc_cmd_cv, &sc->sc_mtx);
2407
2408	/* make sure any hardware FIFOs are emptied */
2409	ural_pause(sc, hz / 1000);
2410
2411	/* execute task */
2412	task->func(pm);
2413
2414	/* check if this is the last task executed */
2415	if (sc->sc_last_task == task) {
2416		sc->sc_last_task = NULL;
2417		ifp = sc->sc_ifp;
2418		/* re-start TX, if any */
2419		if ((ifp != NULL) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
2420			usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
2421	}
2422}
2423
2424static void
2425ural_queue_command(struct ural_softc *sc, usb2_proc_callback_t *fn,
2426    struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2427{
2428	struct ural_task *task;
2429
2430	RAL_LOCK_ASSERT(sc, MA_OWNED);
2431
2432	/*
2433	 * NOTE: The task cannot get executed before we drop the
2434	 * "sc_mtx" mutex. It is safe to update fields in the message
2435	 * structure after that the message got queued.
2436	 */
2437	task = (struct ural_task *)
2438	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2439
2440	/* Setup callback and softc pointers */
2441	task->hdr.pm_callback = ural_command_wrapper;
2442	task->func = fn;
2443	task->sc = sc;
2444
2445	/* Make sure that any TX operation will stop */
2446	sc->sc_last_task = task;
2447
2448	/*
2449	 * Init, stop and flush must be synchronous!
2450	 */
2451	if ((fn == ural_init_task) || (fn == ural_stop_task) ||
2452	    (fn == ural_stop_task))
2453		usb2_proc_mwait(&sc->sc_tq, t0, t1);
2454}
2455