xref: /freebsd/sys/dev/usb/wlan/if_ural.c (revision b3aaa0cc21c63d388230c7ef2a80abd631ff20d5)
1 /*	$FreeBSD$	*/
2 
3 /*-
4  * Copyright (c) 2005, 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Copyright (c) 2006, 2008
8  *	Hans Petter Selasky <hselasky@FreeBSD.org>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 #include <sys/cdefs.h>
24 __FBSDID("$FreeBSD$");
25 
26 /*-
27  * Ralink Technology RT2500USB chipset driver
28  * http://www.ralinktech.com/
29  */
30 
31 #include "usbdevs.h"
32 #include <dev/usb/usb.h>
33 #include <dev/usb/usb_mfunc.h>
34 #include <dev/usb/usb_error.h>
35 
36 #define	USB_DEBUG_VAR ural_debug
37 
38 #include <dev/usb/usb_core.h>
39 #include <dev/usb/usb_lookup.h>
40 #include <dev/usb/usb_process.h>
41 #include <dev/usb/usb_debug.h>
42 #include <dev/usb/usb_request.h>
43 #include <dev/usb/usb_busdma.h>
44 #include <dev/usb/usb_util.h>
45 
46 #include <dev/usb/wlan/usb_wlan.h>
47 #include <dev/usb/wlan/if_uralreg.h>
48 #include <dev/usb/wlan/if_uralvar.h>
49 
50 #if USB_DEBUG
51 static int ural_debug = 0;
52 
53 SYSCTL_NODE(_hw_usb2, OID_AUTO, ural, CTLFLAG_RW, 0, "USB ural");
54 SYSCTL_INT(_hw_usb2_ural, OID_AUTO, debug, CTLFLAG_RW, &ural_debug, 0,
55     "Debug level");
56 #endif
57 
58 #define	ural_do_request(sc,req,data) \
59     usb2_do_request_proc((sc)->sc_udev, &(sc)->sc_tq, req, data, 0, NULL, 5000)
60 
61 #define URAL_RSSI(rssi)					\
62 	((rssi) > (RAL_NOISE_FLOOR + RAL_RSSI_CORR) ?	\
63 	 ((rssi) - (RAL_NOISE_FLOOR + RAL_RSSI_CORR)) : 0)
64 
65 /* various supported device vendors/products */
66 static const struct usb2_device_id ural_devs[] = {
67 	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_WL167G) },
68 	{ USB_VP(USB_VENDOR_ASUS, USB_PRODUCT_RALINK_RT2570) },
69 	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050) },
70 	{ USB_VP(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7051) },
71 	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_HU200TS) },
72 	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54G) },
73 	{ USB_VP(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GP) },
74 	{ USB_VP(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU) },
75 	{ USB_VP(USB_VENDOR_DLINK, USB_PRODUCT_DLINK_DWLG122) },
76 	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GN54G) },
77 	{ USB_VP(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWBKG) },
78 	{ USB_VP(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254) },
79 	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54) },
80 	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54AI) },
81 	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_KG54YB) },
82 	{ USB_VP(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_NINWIFI) },
83 	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570) },
84 	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_2) },
85 	{ USB_VP(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2570_3) },
86 	{ USB_VP(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_NV902) },
87 	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570) },
88 	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_2) },
89 	{ USB_VP(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2570_3) },
90 	{ USB_VP(USB_VENDOR_SIEMENS2, USB_PRODUCT_SIEMENS2_WL54G) },
91 	{ USB_VP(USB_VENDOR_SMC, USB_PRODUCT_SMC_2862WG) },
92 	{ USB_VP(USB_VENDOR_SPHAIRON, USB_PRODUCT_SPHAIRON_UB801R) },
93 	{ USB_VP(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2570) },
94 	{ USB_VP(USB_VENDOR_VTECH, USB_PRODUCT_VTECH_RT2570) },
95 	{ USB_VP(USB_VENDOR_ZINWELL, USB_PRODUCT_ZINWELL_RT2570) },
96 };
97 
98 static usb2_callback_t ural_bulk_read_callback;
99 static usb2_callback_t ural_bulk_write_callback;
100 
101 static usb2_proc_callback_t ural_attach_post;
102 static usb2_proc_callback_t ural_task;
103 static usb2_proc_callback_t ural_scantask;
104 static usb2_proc_callback_t ural_promisctask;
105 static usb2_proc_callback_t ural_amrr_task;
106 static usb2_proc_callback_t ural_init_task;
107 static usb2_proc_callback_t ural_stop_task;
108 
109 static struct ieee80211vap *ural_vap_create(struct ieee80211com *,
110 			    const char name[IFNAMSIZ], int unit, int opmode,
111 			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
112 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
113 static void		ural_vap_delete(struct ieee80211vap *);
114 static void		ural_tx_free(struct ural_tx_data *, int);
115 static void		ural_setup_tx_list(struct ural_softc *);
116 static void		ural_unsetup_tx_list(struct ural_softc *);
117 static int		ural_newstate(struct ieee80211vap *,
118 			    enum ieee80211_state, int);
119 static void		ural_setup_tx_desc(struct ural_softc *,
120 			    struct ural_tx_desc *, uint32_t, int, int);
121 static int		ural_tx_bcn(struct ural_softc *, struct mbuf *,
122 			    struct ieee80211_node *);
123 static int		ural_tx_mgt(struct ural_softc *, struct mbuf *,
124 			    struct ieee80211_node *);
125 static int		ural_tx_data(struct ural_softc *, struct mbuf *,
126 			    struct ieee80211_node *);
127 static void		ural_start(struct ifnet *);
128 static int		ural_ioctl(struct ifnet *, u_long, caddr_t);
129 static void		ural_set_testmode(struct ural_softc *);
130 static void		ural_eeprom_read(struct ural_softc *, uint16_t, void *,
131 			    int);
132 static uint16_t		ural_read(struct ural_softc *, uint16_t);
133 static void		ural_read_multi(struct ural_softc *, uint16_t, void *,
134 			    int);
135 static void		ural_write(struct ural_softc *, uint16_t, uint16_t);
136 static void		ural_write_multi(struct ural_softc *, uint16_t, void *,
137 			    int) __unused;
138 static void		ural_bbp_write(struct ural_softc *, uint8_t, uint8_t);
139 static uint8_t		ural_bbp_read(struct ural_softc *, uint8_t);
140 static void		ural_rf_write(struct ural_softc *, uint8_t, uint32_t);
141 static struct ieee80211_node *ural_node_alloc(struct ieee80211vap *,
142 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
143 static void		ural_newassoc(struct ieee80211_node *, int);
144 static void		ural_scan_start(struct ieee80211com *);
145 static void		ural_scan_end(struct ieee80211com *);
146 static void		ural_set_channel(struct ieee80211com *);
147 static void		ural_set_chan(struct ural_softc *,
148 			    struct ieee80211_channel *);
149 static void		ural_disable_rf_tune(struct ural_softc *);
150 static void		ural_enable_tsf_sync(struct ural_softc *);
151 static void		ural_update_slot(struct ifnet *);
152 static void		ural_set_txpreamble(struct ural_softc *);
153 static void		ural_set_basicrates(struct ural_softc *,
154 			    const struct ieee80211_channel *);
155 static void		ural_set_bssid(struct ural_softc *, const uint8_t *);
156 static void		ural_set_macaddr(struct ural_softc *, uint8_t *);
157 static const char	*ural_get_rf(int);
158 static void		ural_read_eeprom(struct ural_softc *);
159 static int		ural_bbp_init(struct ural_softc *);
160 static void		ural_set_txantenna(struct ural_softc *, int);
161 static void		ural_set_rxantenna(struct ural_softc *, int);
162 static void		ural_init(void *);
163 static int		ural_raw_xmit(struct ieee80211_node *, struct mbuf *,
164 			    const struct ieee80211_bpf_params *);
165 static void		ural_amrr_start(struct ural_softc *,
166 			    struct ieee80211_node *);
167 static void		ural_amrr_timeout(void *);
168 static int		ural_pause(struct ural_softc *sc, int timeout);
169 static void		ural_queue_command(struct ural_softc *,
170 			    usb2_proc_callback_t *, struct usb2_proc_msg *,
171 			    struct usb2_proc_msg *);
172 
173 /*
174  * Default values for MAC registers; values taken from the reference driver.
175  */
176 static const struct {
177 	uint16_t	reg;
178 	uint16_t	val;
179 } ural_def_mac[] = {
180 	{ RAL_TXRX_CSR5,  0x8c8d },
181 	{ RAL_TXRX_CSR6,  0x8b8a },
182 	{ RAL_TXRX_CSR7,  0x8687 },
183 	{ RAL_TXRX_CSR8,  0x0085 },
184 	{ RAL_MAC_CSR13,  0x1111 },
185 	{ RAL_MAC_CSR14,  0x1e11 },
186 	{ RAL_TXRX_CSR21, 0xe78f },
187 	{ RAL_MAC_CSR9,   0xff1d },
188 	{ RAL_MAC_CSR11,  0x0002 },
189 	{ RAL_MAC_CSR22,  0x0053 },
190 	{ RAL_MAC_CSR15,  0x0000 },
191 	{ RAL_MAC_CSR8,   RAL_FRAME_SIZE },
192 	{ RAL_TXRX_CSR19, 0x0000 },
193 	{ RAL_TXRX_CSR18, 0x005a },
194 	{ RAL_PHY_CSR2,   0x0000 },
195 	{ RAL_TXRX_CSR0,  0x1ec0 },
196 	{ RAL_PHY_CSR4,   0x000f }
197 };
198 
199 /*
200  * Default values for BBP registers; values taken from the reference driver.
201  */
202 static const struct {
203 	uint8_t	reg;
204 	uint8_t	val;
205 } ural_def_bbp[] = {
206 	{  3, 0x02 },
207 	{  4, 0x19 },
208 	{ 14, 0x1c },
209 	{ 15, 0x30 },
210 	{ 16, 0xac },
211 	{ 17, 0x48 },
212 	{ 18, 0x18 },
213 	{ 19, 0xff },
214 	{ 20, 0x1e },
215 	{ 21, 0x08 },
216 	{ 22, 0x08 },
217 	{ 23, 0x08 },
218 	{ 24, 0x80 },
219 	{ 25, 0x50 },
220 	{ 26, 0x08 },
221 	{ 27, 0x23 },
222 	{ 30, 0x10 },
223 	{ 31, 0x2b },
224 	{ 32, 0xb9 },
225 	{ 34, 0x12 },
226 	{ 35, 0x50 },
227 	{ 39, 0xc4 },
228 	{ 40, 0x02 },
229 	{ 41, 0x60 },
230 	{ 53, 0x10 },
231 	{ 54, 0x18 },
232 	{ 56, 0x08 },
233 	{ 57, 0x10 },
234 	{ 58, 0x08 },
235 	{ 61, 0x60 },
236 	{ 62, 0x10 },
237 	{ 75, 0xff }
238 };
239 
240 /*
241  * Default values for RF register R2 indexed by channel numbers.
242  */
243 static const uint32_t ural_rf2522_r2[] = {
244 	0x307f6, 0x307fb, 0x30800, 0x30805, 0x3080a, 0x3080f, 0x30814,
245 	0x30819, 0x3081e, 0x30823, 0x30828, 0x3082d, 0x30832, 0x3083e
246 };
247 
248 static const uint32_t ural_rf2523_r2[] = {
249 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
250 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
251 };
252 
253 static const uint32_t ural_rf2524_r2[] = {
254 	0x00327, 0x00328, 0x00329, 0x0032a, 0x0032b, 0x0032c, 0x0032d,
255 	0x0032e, 0x0032f, 0x00340, 0x00341, 0x00342, 0x00343, 0x00346
256 };
257 
258 static const uint32_t ural_rf2525_r2[] = {
259 	0x20327, 0x20328, 0x20329, 0x2032a, 0x2032b, 0x2032c, 0x2032d,
260 	0x2032e, 0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20346
261 };
262 
263 static const uint32_t ural_rf2525_hi_r2[] = {
264 	0x2032f, 0x20340, 0x20341, 0x20342, 0x20343, 0x20344, 0x20345,
265 	0x20346, 0x20347, 0x20348, 0x20349, 0x2034a, 0x2034b, 0x2034e
266 };
267 
268 static const uint32_t ural_rf2525e_r2[] = {
269 	0x2044d, 0x2044e, 0x2044f, 0x20460, 0x20461, 0x20462, 0x20463,
270 	0x20464, 0x20465, 0x20466, 0x20467, 0x20468, 0x20469, 0x2046b
271 };
272 
273 static const uint32_t ural_rf2526_hi_r2[] = {
274 	0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d, 0x0022d,
275 	0x0022e, 0x0022e, 0x0022f, 0x0022d, 0x00240, 0x00240, 0x00241
276 };
277 
278 static const uint32_t ural_rf2526_r2[] = {
279 	0x00226, 0x00227, 0x00227, 0x00228, 0x00228, 0x00229, 0x00229,
280 	0x0022a, 0x0022a, 0x0022b, 0x0022b, 0x0022c, 0x0022c, 0x0022d
281 };
282 
283 /*
284  * For dual-band RF, RF registers R1 and R4 also depend on channel number;
285  * values taken from the reference driver.
286  */
287 static const struct {
288 	uint8_t		chan;
289 	uint32_t	r1;
290 	uint32_t	r2;
291 	uint32_t	r4;
292 } ural_rf5222[] = {
293 	{   1, 0x08808, 0x0044d, 0x00282 },
294 	{   2, 0x08808, 0x0044e, 0x00282 },
295 	{   3, 0x08808, 0x0044f, 0x00282 },
296 	{   4, 0x08808, 0x00460, 0x00282 },
297 	{   5, 0x08808, 0x00461, 0x00282 },
298 	{   6, 0x08808, 0x00462, 0x00282 },
299 	{   7, 0x08808, 0x00463, 0x00282 },
300 	{   8, 0x08808, 0x00464, 0x00282 },
301 	{   9, 0x08808, 0x00465, 0x00282 },
302 	{  10, 0x08808, 0x00466, 0x00282 },
303 	{  11, 0x08808, 0x00467, 0x00282 },
304 	{  12, 0x08808, 0x00468, 0x00282 },
305 	{  13, 0x08808, 0x00469, 0x00282 },
306 	{  14, 0x08808, 0x0046b, 0x00286 },
307 
308 	{  36, 0x08804, 0x06225, 0x00287 },
309 	{  40, 0x08804, 0x06226, 0x00287 },
310 	{  44, 0x08804, 0x06227, 0x00287 },
311 	{  48, 0x08804, 0x06228, 0x00287 },
312 	{  52, 0x08804, 0x06229, 0x00287 },
313 	{  56, 0x08804, 0x0622a, 0x00287 },
314 	{  60, 0x08804, 0x0622b, 0x00287 },
315 	{  64, 0x08804, 0x0622c, 0x00287 },
316 
317 	{ 100, 0x08804, 0x02200, 0x00283 },
318 	{ 104, 0x08804, 0x02201, 0x00283 },
319 	{ 108, 0x08804, 0x02202, 0x00283 },
320 	{ 112, 0x08804, 0x02203, 0x00283 },
321 	{ 116, 0x08804, 0x02204, 0x00283 },
322 	{ 120, 0x08804, 0x02205, 0x00283 },
323 	{ 124, 0x08804, 0x02206, 0x00283 },
324 	{ 128, 0x08804, 0x02207, 0x00283 },
325 	{ 132, 0x08804, 0x02208, 0x00283 },
326 	{ 136, 0x08804, 0x02209, 0x00283 },
327 	{ 140, 0x08804, 0x0220a, 0x00283 },
328 
329 	{ 149, 0x08808, 0x02429, 0x00281 },
330 	{ 153, 0x08808, 0x0242b, 0x00281 },
331 	{ 157, 0x08808, 0x0242d, 0x00281 },
332 	{ 161, 0x08808, 0x0242f, 0x00281 }
333 };
334 
335 static const struct usb2_config ural_config[URAL_N_TRANSFER] = {
336 	[URAL_BULK_WR] = {
337 		.type = UE_BULK,
338 		.endpoint = UE_ADDR_ANY,
339 		.direction = UE_DIR_OUT,
340 		.mh.bufsize = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE + 4),
341 		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
342 		.mh.callback = ural_bulk_write_callback,
343 		.mh.timeout = 5000,	/* ms */
344 	},
345 	[URAL_BULK_RD] = {
346 		.type = UE_BULK,
347 		.endpoint = UE_ADDR_ANY,
348 		.direction = UE_DIR_IN,
349 		.mh.bufsize = (RAL_FRAME_SIZE + RAL_RX_DESC_SIZE),
350 		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
351 		.mh.callback = ural_bulk_read_callback,
352 	},
353 };
354 
355 static device_probe_t ural_match;
356 static device_attach_t ural_attach;
357 static device_detach_t ural_detach;
358 
359 static device_method_t ural_methods[] = {
360 	/* Device interface */
361 	DEVMETHOD(device_probe,		ural_match),
362 	DEVMETHOD(device_attach,	ural_attach),
363 	DEVMETHOD(device_detach,	ural_detach),
364 
365 	{ 0, 0 }
366 };
367 
368 static driver_t ural_driver = {
369 	.name = "ural",
370 	.methods = ural_methods,
371 	.size = sizeof(struct ural_softc),
372 };
373 
374 static devclass_t ural_devclass;
375 
376 DRIVER_MODULE(ural, ushub, ural_driver, ural_devclass, NULL, 0);
377 MODULE_DEPEND(ural, usb, 1, 1, 1);
378 MODULE_DEPEND(ural, wlan, 1, 1, 1);
379 MODULE_DEPEND(ural, wlan_amrr, 1, 1, 1);
380 
381 static int
382 ural_match(device_t self)
383 {
384 	struct usb2_attach_arg *uaa = device_get_ivars(self);
385 
386 	if (uaa->usb2_mode != USB_MODE_HOST)
387 		return (ENXIO);
388 	if (uaa->info.bConfigIndex != 0)
389 		return (ENXIO);
390 	if (uaa->info.bIfaceIndex != RAL_IFACE_INDEX)
391 		return (ENXIO);
392 
393 	return (usb2_lookup_id_by_uaa(ural_devs, sizeof(ural_devs), uaa));
394 }
395 
396 static int
397 ural_attach(device_t self)
398 {
399 	struct usb2_attach_arg *uaa = device_get_ivars(self);
400 	struct ural_softc *sc = device_get_softc(self);
401 	int error;
402 	uint8_t iface_index;
403 
404 	device_set_usb2_desc(self);
405 	sc->sc_udev = uaa->device;
406 	sc->sc_dev = self;
407 
408 	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
409 	    MTX_NETWORK_LOCK, MTX_DEF);
410 
411 	iface_index = RAL_IFACE_INDEX;
412 	error = usb2_transfer_setup(uaa->device,
413 	    &iface_index, sc->sc_xfer, ural_config,
414 	    URAL_N_TRANSFER, sc, &sc->sc_mtx);
415 	if (error) {
416 		device_printf(self, "could not allocate USB transfers, "
417 		    "err=%s\n", usb2_errstr(error));
418 		goto detach;
419 	}
420 	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
421 	    device_get_nameunit(self), USB_PRI_MED);
422 	if (error) {
423 		device_printf(self, "could not setup config thread!\n");
424 		goto detach;
425 	}
426 
427 	/* fork rest of the attach code */
428 	RAL_LOCK(sc);
429 	ural_queue_command(sc, ural_attach_post,
430 	    &sc->sc_synctask[0].hdr,
431 	    &sc->sc_synctask[1].hdr);
432 	RAL_UNLOCK(sc);
433 	return (0);
434 
435 detach:
436 	ural_detach(self);
437 	return (ENXIO);			/* failure */
438 }
439 
440 static void
441 ural_attach_post(struct usb2_proc_msg *pm)
442 {
443 	struct ural_task *task = (struct ural_task *)pm;
444 	struct ural_softc *sc = task->sc;
445 	struct ifnet *ifp;
446 	struct ieee80211com *ic;
447 	uint8_t bands;
448 
449 	/* retrieve RT2570 rev. no */
450 	sc->asic_rev = ural_read(sc, RAL_MAC_CSR0);
451 
452 	/* retrieve MAC address and various other things from EEPROM */
453 	ural_read_eeprom(sc);
454 	RAL_UNLOCK(sc);
455 
456 	device_printf(sc->sc_dev, "MAC/BBP RT2570 (rev 0x%02x), RF %s\n",
457 	    sc->asic_rev, ural_get_rf(sc->rf_rev));
458 
459 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
460 	if (ifp == NULL) {
461 		device_printf(sc->sc_dev, "can not if_alloc()\n");
462 		RAL_LOCK(sc);
463 		return;
464 	}
465 	ic = ifp->if_l2com;
466 
467 	ifp->if_softc = sc;
468 	if_initname(ifp, "ural", device_get_unit(sc->sc_dev));
469 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
470 	ifp->if_init = ural_init;
471 	ifp->if_ioctl = ural_ioctl;
472 	ifp->if_start = ural_start;
473 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
474 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
475 	IFQ_SET_READY(&ifp->if_snd);
476 
477 	ic->ic_ifp = ifp;
478 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
479 	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_bssid);
480 
481 	/* set device capabilities */
482 	ic->ic_caps =
483 	      IEEE80211_C_STA		/* station mode supported */
484 	    | IEEE80211_C_IBSS		/* IBSS mode supported */
485 	    | IEEE80211_C_MONITOR	/* monitor mode supported */
486 	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
487 	    | IEEE80211_C_TXPMGT	/* tx power management */
488 	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
489 	    | IEEE80211_C_SHSLOT	/* short slot time supported */
490 	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
491 	    | IEEE80211_C_WPA		/* 802.11i */
492 	    ;
493 
494 	bands = 0;
495 	setbit(&bands, IEEE80211_MODE_11B);
496 	setbit(&bands, IEEE80211_MODE_11G);
497 	if (sc->rf_rev == RAL_RF_5222)
498 		setbit(&bands, IEEE80211_MODE_11A);
499 	ieee80211_init_channels(ic, NULL, &bands);
500 
501 	ieee80211_ifattach(ic);
502 	ic->ic_newassoc = ural_newassoc;
503 	ic->ic_raw_xmit = ural_raw_xmit;
504 	ic->ic_node_alloc = ural_node_alloc;
505 	ic->ic_scan_start = ural_scan_start;
506 	ic->ic_scan_end = ural_scan_end;
507 	ic->ic_set_channel = ural_set_channel;
508 
509 	ic->ic_vap_create = ural_vap_create;
510 	ic->ic_vap_delete = ural_vap_delete;
511 
512 	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
513 
514 	bpfattach(ifp, DLT_IEEE802_11_RADIO,
515 	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
516 
517 	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
518 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
519 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RAL_RX_RADIOTAP_PRESENT);
520 
521 	sc->sc_txtap_len = sizeof sc->sc_txtap;
522 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
523 	sc->sc_txtap.wt_ihdr.it_present = htole32(RAL_TX_RADIOTAP_PRESENT);
524 
525 	if (bootverbose)
526 		ieee80211_announce(ic);
527 
528 	RAL_LOCK(sc);
529 }
530 
531 static int
532 ural_detach(device_t self)
533 {
534 	struct ural_softc *sc = device_get_softc(self);
535 	struct ifnet *ifp = sc->sc_ifp;
536 	struct ieee80211com *ic;
537 
538 	/* wait for any post attach or other command to complete */
539 	usb2_proc_drain(&sc->sc_tq);
540 
541 	/* stop all USB transfers */
542 	usb2_transfer_unsetup(sc->sc_xfer, URAL_N_TRANSFER);
543 	usb2_proc_free(&sc->sc_tq);
544 
545 	/* free TX list, if any */
546 	RAL_LOCK(sc);
547 	ural_unsetup_tx_list(sc);
548 	RAL_UNLOCK(sc);
549 
550 	if (ifp) {
551 		ic = ifp->if_l2com;
552 		bpfdetach(ifp);
553 		ieee80211_ifdetach(ic);
554 		if_free(ifp);
555 	}
556 
557 	mtx_destroy(&sc->sc_mtx);
558 
559 	return (0);
560 }
561 
562 static struct ieee80211vap *
563 ural_vap_create(struct ieee80211com *ic,
564 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
565 	const uint8_t bssid[IEEE80211_ADDR_LEN],
566 	const uint8_t mac[IEEE80211_ADDR_LEN])
567 {
568 	struct ural_softc *sc = ic->ic_ifp->if_softc;
569 	struct ural_vap *uvp;
570 	struct ieee80211vap *vap;
571 
572 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
573 		return NULL;
574 	uvp = (struct ural_vap *) malloc(sizeof(struct ural_vap),
575 	    M_80211_VAP, M_NOWAIT | M_ZERO);
576 	if (uvp == NULL)
577 		return NULL;
578 	vap = &uvp->vap;
579 	/* enable s/w bmiss handling for sta mode */
580 	ieee80211_vap_setup(ic, vap, name, unit, opmode,
581 	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
582 
583 	/* override state transition machine */
584 	uvp->newstate = vap->iv_newstate;
585 	vap->iv_newstate = ural_newstate;
586 
587 	uvp->sc = sc;
588 	usb2_callout_init_mtx(&uvp->amrr_ch, &sc->sc_mtx, 0);
589 	ieee80211_amrr_init(&uvp->amrr, vap,
590 	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
591 	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
592 	    1000 /* 1 sec */);
593 
594 	/* complete setup */
595 	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
596 	ic->ic_opmode = opmode;
597 	return vap;
598 }
599 
600 static void
601 ural_vap_delete(struct ieee80211vap *vap)
602 {
603 	struct ural_vap *uvp = URAL_VAP(vap);
604 
605 	usb2_callout_drain(&uvp->amrr_ch);
606 	ieee80211_amrr_cleanup(&uvp->amrr);
607 	ieee80211_vap_detach(vap);
608 	free(uvp, M_80211_VAP);
609 }
610 
611 static void
612 ural_tx_free(struct ural_tx_data *data, int txerr)
613 {
614 	struct ural_softc *sc = data->sc;
615 
616 	if (data->m != NULL) {
617 		if (data->m->m_flags & M_TXCB)
618 			ieee80211_process_callback(data->ni, data->m,
619 			    txerr ? ETIMEDOUT : 0);
620 		m_freem(data->m);
621 		data->m = NULL;
622 
623 		ieee80211_free_node(data->ni);
624 		data->ni = NULL;
625 	}
626 	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
627 	sc->tx_nfree++;
628 }
629 
630 static void
631 ural_setup_tx_list(struct ural_softc *sc)
632 {
633 	struct ural_tx_data *data;
634 	int i;
635 
636 	sc->tx_nfree = 0;
637 	STAILQ_INIT(&sc->tx_q);
638 	STAILQ_INIT(&sc->tx_free);
639 
640 	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
641 		data = &sc->tx_data[i];
642 
643 		data->sc = sc;
644 		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
645 		sc->tx_nfree++;
646 	}
647 }
648 
649 static void
650 ural_unsetup_tx_list(struct ural_softc *sc)
651 {
652 	struct ural_tx_data *data;
653 	int i;
654 
655 	/* make sure any subsequent use of the queues will fail */
656 	sc->tx_nfree = 0;
657 	STAILQ_INIT(&sc->tx_q);
658 	STAILQ_INIT(&sc->tx_free);
659 
660 	/* free up all node references and mbufs */
661 	for (i = 0; i < RAL_TX_LIST_COUNT; i++) {
662 		data = &sc->tx_data[i];
663 
664 		if (data->m != NULL) {
665 			m_freem(data->m);
666 			data->m = NULL;
667 		}
668 		if (data->ni != NULL) {
669 			ieee80211_free_node(data->ni);
670 			data->ni = NULL;
671 		}
672 	}
673 }
674 
675 static void
676 ural_task(struct usb2_proc_msg *pm)
677 {
678 	struct ural_task *task = (struct ural_task *)pm;
679 	struct ural_softc *sc = task->sc;
680 	struct ifnet *ifp = sc->sc_ifp;
681 	struct ieee80211com *ic = ifp->if_l2com;
682 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
683 	struct ural_vap *uvp = URAL_VAP(vap);
684 	const struct ieee80211_txparam *tp;
685 	enum ieee80211_state ostate;
686 	struct ieee80211_node *ni;
687 	struct mbuf *m;
688 
689 	ostate = vap->iv_state;
690 
691 	switch (sc->sc_state) {
692 	case IEEE80211_S_INIT:
693 		if (ostate == IEEE80211_S_RUN) {
694 			/* abort TSF synchronization */
695 			ural_write(sc, RAL_TXRX_CSR19, 0);
696 
697 			/* force tx led to stop blinking */
698 			ural_write(sc, RAL_MAC_CSR20, 0);
699 		}
700 		break;
701 
702 	case IEEE80211_S_RUN:
703 		ni = vap->iv_bss;
704 
705 		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
706 			ural_update_slot(ic->ic_ifp);
707 			ural_set_txpreamble(sc);
708 			ural_set_basicrates(sc, ic->ic_bsschan);
709 			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
710 			ural_set_bssid(sc, sc->sc_bssid);
711 		}
712 
713 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
714 		    vap->iv_opmode == IEEE80211_M_IBSS) {
715 			m = ieee80211_beacon_alloc(ni, &uvp->bo);
716 			if (m == NULL) {
717 				device_printf(sc->sc_dev,
718 				    "could not allocate beacon\n");
719 				return;
720 			}
721 
722 			if (ural_tx_bcn(sc, m, ni) != 0) {
723 				device_printf(sc->sc_dev,
724 				    "could not send beacon\n");
725 				return;
726 			}
727 		}
728 
729 		/* make tx led blink on tx (controlled by ASIC) */
730 		ural_write(sc, RAL_MAC_CSR20, 1);
731 
732 		if (vap->iv_opmode != IEEE80211_M_MONITOR)
733 			ural_enable_tsf_sync(sc);
734 
735 		/* enable automatic rate adaptation */
736 		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
737 		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
738 			ural_amrr_start(sc, ni);
739 
740 		break;
741 
742 	default:
743 		break;
744 	}
745 
746 	RAL_UNLOCK(sc);
747 	IEEE80211_LOCK(ic);
748 	uvp->newstate(vap, sc->sc_state, sc->sc_arg);
749 	if (vap->iv_newstate_cb != NULL)
750 		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
751 	IEEE80211_UNLOCK(ic);
752 	RAL_LOCK(sc);
753 }
754 
755 static void
756 ural_scantask(struct usb2_proc_msg *pm)
757 {
758 	struct ural_task *task = (struct ural_task *)pm;
759 	struct ural_softc *sc = task->sc;
760 	struct ifnet *ifp = sc->sc_ifp;
761 	struct ieee80211com *ic = ifp->if_l2com;
762 
763 	RAL_LOCK_ASSERT(sc, MA_OWNED);
764 
765 	switch (sc->sc_scan_action) {
766 	case URAL_SCAN_START:
767 		/* abort TSF synchronization */
768 		DPRINTF("starting scan\n");
769 		ural_write(sc, RAL_TXRX_CSR19, 0);
770 		ural_set_bssid(sc, ifp->if_broadcastaddr);
771 		break;
772 
773 	case URAL_SET_CHANNEL:
774 		ural_set_chan(sc, ic->ic_curchan);
775 		break;
776 
777 	default: /* URAL_SCAN_END */
778 		DPRINTF("stopping scan\n");
779 		ural_enable_tsf_sync(sc);
780 		ural_set_bssid(sc, sc->sc_bssid);
781 		break;
782 	}
783 }
784 
785 static int
786 ural_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
787 {
788 	struct ural_vap *uvp = URAL_VAP(vap);
789 	struct ieee80211com *ic = vap->iv_ic;
790 	struct ural_softc *sc = ic->ic_ifp->if_softc;
791 
792 	DPRINTF("%s -> %s\n",
793 		ieee80211_state_name[vap->iv_state],
794 		ieee80211_state_name[nstate]);
795 
796 	RAL_LOCK(sc);
797 	usb2_callout_stop(&uvp->amrr_ch);
798 
799 	/* do it in a process context */
800 	sc->sc_state = nstate;
801 	sc->sc_arg = arg;
802 	RAL_UNLOCK(sc);
803 
804 	if (nstate == IEEE80211_S_INIT) {
805 		uvp->newstate(vap, nstate, arg);
806 		return 0;
807 	} else {
808 		RAL_LOCK(sc);
809 		ural_queue_command(sc, ural_task, &sc->sc_task[0].hdr,
810 		    &sc->sc_task[1].hdr);
811 		RAL_UNLOCK(sc);
812 		return EINPROGRESS;
813 	}
814 }
815 
816 
817 static void
818 ural_bulk_write_callback(struct usb2_xfer *xfer)
819 {
820 	struct ural_softc *sc = xfer->priv_sc;
821 	struct ifnet *ifp = sc->sc_ifp;
822 	struct ieee80211com *ic = ifp->if_l2com;
823 	struct ieee80211_channel *c = ic->ic_curchan;
824 	struct ural_tx_data *data;
825 	struct mbuf *m;
826 	unsigned int len;
827 
828 	switch (USB_GET_STATE(xfer)) {
829 	case USB_ST_TRANSFERRED:
830 		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
831 
832 		/* free resources */
833 		data = xfer->priv_fifo;
834 		ural_tx_free(data, 0);
835 		xfer->priv_fifo = NULL;
836 
837 		ifp->if_opackets++;
838 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
839 
840 		/* FALLTHROUGH */
841 	case USB_ST_SETUP:
842 tr_setup:
843 		data = STAILQ_FIRST(&sc->tx_q);
844 		if (data) {
845 			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
846 			m = data->m;
847 
848 			if (m->m_pkthdr.len > (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE)) {
849 				DPRINTFN(0, "data overflow, %u bytes\n",
850 				    m->m_pkthdr.len);
851 				m->m_pkthdr.len = (RAL_FRAME_SIZE + RAL_TX_DESC_SIZE);
852 			}
853 			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
854 			    RAL_TX_DESC_SIZE);
855 			usb2_m_copy_in(xfer->frbuffers, RAL_TX_DESC_SIZE, m, 0,
856 			    m->m_pkthdr.len);
857 
858 			if (bpf_peers_present(ifp->if_bpf)) {
859 				struct ural_tx_radiotap_header *tap = &sc->sc_txtap;
860 
861 				tap->wt_flags = 0;
862 				tap->wt_rate = data->rate;
863 				tap->wt_chan_freq = htole16(c->ic_freq);
864 				tap->wt_chan_flags = htole16(c->ic_flags);
865 				tap->wt_antenna = sc->tx_ant;
866 
867 				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
868 			}
869 
870 			/* xfer length needs to be a multiple of two! */
871 			len = (RAL_TX_DESC_SIZE + m->m_pkthdr.len + 1) & ~1;
872 			if ((len % 64) == 0)
873 				len += 2;
874 
875 			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
876 			    m->m_pkthdr.len, len);
877 
878 			xfer->frlengths[0] = len;
879 			xfer->priv_fifo = data;
880 
881 			usb2_start_hardware(xfer);
882 		}
883 		break;
884 
885 	default:			/* Error */
886 		DPRINTFN(11, "transfer error, %s\n",
887 		    usb2_errstr(xfer->error));
888 
889 		ifp->if_oerrors++;
890 		data = xfer->priv_fifo;
891 		if (data != NULL) {
892 			ural_tx_free(data, xfer->error);
893 			xfer->priv_fifo = NULL;
894 		}
895 
896 		if (xfer->error == USB_ERR_STALLED) {
897 			/* try to clear stall first */
898 			xfer->flags.stall_pipe = 1;
899 			goto tr_setup;
900 		}
901 		if (xfer->error == USB_ERR_TIMEOUT)
902 			device_printf(sc->sc_dev, "device timeout\n");
903 		break;
904 	}
905 }
906 
907 static void
908 ural_bulk_read_callback(struct usb2_xfer *xfer)
909 {
910 	struct ural_softc *sc = xfer->priv_sc;
911 	struct ifnet *ifp = sc->sc_ifp;
912 	struct ieee80211com *ic = ifp->if_l2com;
913 	struct ieee80211_node *ni;
914 	struct mbuf *m = NULL;
915 	uint32_t flags;
916 	uint8_t rssi = 0;
917 	unsigned int len;
918 
919 	switch (USB_GET_STATE(xfer)) {
920 	case USB_ST_TRANSFERRED:
921 
922 		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
923 
924 		len = xfer->actlen;
925 		if (len < RAL_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
926 			DPRINTF("%s: xfer too short %d\n",
927 			    device_get_nameunit(sc->sc_dev), len);
928 			ifp->if_ierrors++;
929 			goto tr_setup;
930 		}
931 
932 		len -= RAL_RX_DESC_SIZE;
933 		/* rx descriptor is located at the end */
934 		usb2_copy_out(xfer->frbuffers, len, &sc->sc_rx_desc,
935 		    RAL_RX_DESC_SIZE);
936 
937 		rssi = URAL_RSSI(sc->sc_rx_desc.rssi);
938 		flags = le32toh(sc->sc_rx_desc.flags);
939 		if (flags & (RAL_RX_PHY_ERROR | RAL_RX_CRC_ERROR)) {
940 			/*
941 		         * This should not happen since we did not
942 		         * request to receive those frames when we
943 		         * filled RAL_TXRX_CSR2:
944 		         */
945 			DPRINTFN(5, "PHY or CRC error\n");
946 			ifp->if_ierrors++;
947 			goto tr_setup;
948 		}
949 
950 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
951 		if (m == NULL) {
952 			DPRINTF("could not allocate mbuf\n");
953 			ifp->if_ierrors++;
954 			goto tr_setup;
955 		}
956 		usb2_copy_out(xfer->frbuffers, 0, mtod(m, uint8_t *), len);
957 
958 		/* finalize mbuf */
959 		m->m_pkthdr.rcvif = ifp;
960 		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
961 
962 		if (bpf_peers_present(ifp->if_bpf)) {
963 			struct ural_rx_radiotap_header *tap = &sc->sc_rxtap;
964 
965 			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
966 			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
967 			    (flags & RAL_RX_OFDM) ?
968 			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
969 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
970 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
971 			tap->wr_antenna = sc->rx_ant;
972 			tap->wr_antsignal = rssi;
973 
974 			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
975 		}
976 		/* Strip trailing 802.11 MAC FCS. */
977 		m_adj(m, -IEEE80211_CRC_LEN);
978 
979 		/* FALLTHROUGH */
980 	case USB_ST_SETUP:
981 tr_setup:
982 		xfer->frlengths[0] = xfer->max_data_length;
983 		usb2_start_hardware(xfer);
984 
985 		/*
986 		 * At the end of a USB callback it is always safe to unlock
987 		 * the private mutex of a device! That is why we do the
988 		 * "ieee80211_input" here, and not some lines up!
989 		 */
990 		if (m) {
991 			RAL_UNLOCK(sc);
992 			ni = ieee80211_find_rxnode(ic,
993 			    mtod(m, struct ieee80211_frame_min *));
994 			if (ni != NULL) {
995 				(void) ieee80211_input(ni, m, rssi,
996 				    RAL_NOISE_FLOOR, 0);
997 				ieee80211_free_node(ni);
998 			} else
999 				(void) ieee80211_input_all(ic, m, rssi,
1000 				    RAL_NOISE_FLOOR, 0);
1001 			RAL_LOCK(sc);
1002 		}
1003 		return;
1004 
1005 	default:			/* Error */
1006 		if (xfer->error != USB_ERR_CANCELLED) {
1007 			/* try to clear stall first */
1008 			xfer->flags.stall_pipe = 1;
1009 			goto tr_setup;
1010 		}
1011 		return;
1012 	}
1013 }
1014 
1015 static uint8_t
1016 ural_plcp_signal(int rate)
1017 {
1018 	switch (rate) {
1019 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1020 	case 12:	return 0xb;
1021 	case 18:	return 0xf;
1022 	case 24:	return 0xa;
1023 	case 36:	return 0xe;
1024 	case 48:	return 0x9;
1025 	case 72:	return 0xd;
1026 	case 96:	return 0x8;
1027 	case 108:	return 0xc;
1028 
1029 	/* CCK rates (NB: not IEEE std, device-specific) */
1030 	case 2:		return 0x0;
1031 	case 4:		return 0x1;
1032 	case 11:	return 0x2;
1033 	case 22:	return 0x3;
1034 	}
1035 	return 0xff;		/* XXX unsupported/unknown rate */
1036 }
1037 
1038 static void
1039 ural_setup_tx_desc(struct ural_softc *sc, struct ural_tx_desc *desc,
1040     uint32_t flags, int len, int rate)
1041 {
1042 	struct ifnet *ifp = sc->sc_ifp;
1043 	struct ieee80211com *ic = ifp->if_l2com;
1044 	uint16_t plcp_length;
1045 	int remainder;
1046 
1047 	desc->flags = htole32(flags);
1048 	desc->flags |= htole32(RAL_TX_NEWSEQ);
1049 	desc->flags |= htole32(len << 16);
1050 
1051 	desc->wme = htole16(RAL_AIFSN(2) | RAL_LOGCWMIN(3) | RAL_LOGCWMAX(5));
1052 	desc->wme |= htole16(RAL_IVOFFSET(sizeof (struct ieee80211_frame)));
1053 
1054 	/* setup PLCP fields */
1055 	desc->plcp_signal  = ural_plcp_signal(rate);
1056 	desc->plcp_service = 4;
1057 
1058 	len += IEEE80211_CRC_LEN;
1059 	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1060 		desc->flags |= htole32(RAL_TX_OFDM);
1061 
1062 		plcp_length = len & 0xfff;
1063 		desc->plcp_length_hi = plcp_length >> 6;
1064 		desc->plcp_length_lo = plcp_length & 0x3f;
1065 	} else {
1066 		plcp_length = (16 * len + rate - 1) / rate;
1067 		if (rate == 22) {
1068 			remainder = (16 * len) % 22;
1069 			if (remainder != 0 && remainder < 7)
1070 				desc->plcp_service |= RAL_PLCP_LENGEXT;
1071 		}
1072 		desc->plcp_length_hi = plcp_length >> 8;
1073 		desc->plcp_length_lo = plcp_length & 0xff;
1074 
1075 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1076 			desc->plcp_signal |= 0x08;
1077 	}
1078 
1079 	desc->iv = 0;
1080 	desc->eiv = 0;
1081 }
1082 
1083 #define RAL_TX_TIMEOUT	5000
1084 
1085 static int
1086 ural_tx_bcn(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1087 {
1088 	struct ieee80211vap *vap = ni->ni_vap;
1089 	struct ieee80211com *ic = ni->ni_ic;
1090 	struct ifnet *ifp = sc->sc_ifp;
1091 	const struct ieee80211_txparam *tp;
1092 	struct ural_tx_data *data;
1093 
1094 	if (sc->tx_nfree == 0) {
1095 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1096 		m_freem(m0);
1097 		ieee80211_free_node(ni);
1098 		return EIO;
1099 	}
1100 	data = STAILQ_FIRST(&sc->tx_free);
1101 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1102 	sc->tx_nfree--;
1103 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
1104 
1105 	data->m = m0;
1106 	data->ni = ni;
1107 	data->rate = tp->mgmtrate;
1108 
1109 	ural_setup_tx_desc(sc, &data->desc,
1110 	    RAL_TX_IFS_NEWBACKOFF | RAL_TX_TIMESTAMP, m0->m_pkthdr.len,
1111 	    tp->mgmtrate);
1112 
1113 	DPRINTFN(10, "sending beacon frame len=%u rate=%u\n",
1114 	    m0->m_pkthdr.len, tp->mgmtrate);
1115 
1116 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1117 	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1118 
1119 	return (0);
1120 }
1121 
1122 static int
1123 ural_tx_mgt(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1124 {
1125 	struct ieee80211vap *vap = ni->ni_vap;
1126 	struct ieee80211com *ic = ni->ni_ic;
1127 	const struct ieee80211_txparam *tp;
1128 	struct ural_tx_data *data;
1129 	struct ieee80211_frame *wh;
1130 	struct ieee80211_key *k;
1131 	uint32_t flags;
1132 	uint16_t dur;
1133 
1134 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1135 
1136 	data = STAILQ_FIRST(&sc->tx_free);
1137 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1138 	sc->tx_nfree--;
1139 
1140 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1141 
1142 	wh = mtod(m0, struct ieee80211_frame *);
1143 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1144 		k = ieee80211_crypto_encap(ni, m0);
1145 		if (k == NULL) {
1146 			m_freem(m0);
1147 			return ENOBUFS;
1148 		}
1149 		wh = mtod(m0, struct ieee80211_frame *);
1150 	}
1151 
1152 	data->m = m0;
1153 	data->ni = ni;
1154 	data->rate = tp->mgmtrate;
1155 
1156 	flags = 0;
1157 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1158 		flags |= RAL_TX_ACK;
1159 
1160 		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
1161 		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1162 		*(uint16_t *)wh->i_dur = htole16(dur);
1163 
1164 		/* tell hardware to add timestamp for probe responses */
1165 		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1166 		    IEEE80211_FC0_TYPE_MGT &&
1167 		    (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
1168 		    IEEE80211_FC0_SUBTYPE_PROBE_RESP)
1169 			flags |= RAL_TX_TIMESTAMP;
1170 	}
1171 
1172 	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, tp->mgmtrate);
1173 
1174 	DPRINTFN(10, "sending mgt frame len=%u rate=%u\n",
1175 	    m0->m_pkthdr.len, tp->mgmtrate);
1176 
1177 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1178 	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1179 
1180 	return 0;
1181 }
1182 
1183 static int
1184 ural_sendprot(struct ural_softc *sc,
1185     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1186 {
1187 	struct ieee80211com *ic = ni->ni_ic;
1188 	const struct ieee80211_frame *wh;
1189 	struct ural_tx_data *data;
1190 	struct mbuf *mprot;
1191 	int protrate, ackrate, pktlen, flags, isshort;
1192 	uint16_t dur;
1193 
1194 	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1195 	    ("protection %d", prot));
1196 
1197 	wh = mtod(m, const struct ieee80211_frame *);
1198 	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1199 
1200 	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1201 	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1202 
1203 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1204 	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1205 	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1206 	flags = RAL_TX_RETRY(7);
1207 	if (prot == IEEE80211_PROT_RTSCTS) {
1208 		/* NB: CTS is the same size as an ACK */
1209 		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1210 		flags |= RAL_TX_ACK;
1211 		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1212 	} else {
1213 		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1214 	}
1215 	if (mprot == NULL) {
1216 		/* XXX stat + msg */
1217 		return ENOBUFS;
1218 	}
1219 	data = STAILQ_FIRST(&sc->tx_free);
1220 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1221 	sc->tx_nfree--;
1222 
1223 	data->m = mprot;
1224 	data->ni = ieee80211_ref_node(ni);
1225 	data->rate = protrate;
1226 	ural_setup_tx_desc(sc, &data->desc, flags, mprot->m_pkthdr.len, protrate);
1227 
1228 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1229 	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1230 
1231 	return 0;
1232 }
1233 
1234 static int
1235 ural_tx_raw(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1236     const struct ieee80211_bpf_params *params)
1237 {
1238 	struct ural_tx_data *data;
1239 	uint32_t flags;
1240 	int error;
1241 	int rate;
1242 
1243 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1244 	KASSERT(params != NULL, ("no raw xmit params"));
1245 
1246 	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1247 	/* XXX validate */
1248 	if (rate == 0) {
1249 		m_freem(m0);
1250 		return EINVAL;
1251 	}
1252 	flags = 0;
1253 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1254 		flags |= RAL_TX_ACK;
1255 	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1256 		error = ural_sendprot(sc, m0, ni,
1257 		    params->ibp_flags & IEEE80211_BPF_RTS ?
1258 			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1259 		    rate);
1260 		if (error || sc->tx_nfree == 0) {
1261 			m_freem(m0);
1262 			return ENOBUFS;
1263 		}
1264 		flags |= RAL_TX_IFS_SIFS;
1265 	}
1266 
1267 	data = STAILQ_FIRST(&sc->tx_free);
1268 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1269 	sc->tx_nfree--;
1270 
1271 	data->m = m0;
1272 	data->ni = ni;
1273 	data->rate = rate;
1274 
1275 	/* XXX need to setup descriptor ourself */
1276 	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1277 
1278 	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1279 	    m0->m_pkthdr.len, rate);
1280 
1281 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1282 	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1283 
1284 	return 0;
1285 }
1286 
1287 static int
1288 ural_tx_data(struct ural_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1289 {
1290 	struct ieee80211vap *vap = ni->ni_vap;
1291 	struct ieee80211com *ic = ni->ni_ic;
1292 	struct ural_tx_data *data;
1293 	struct ieee80211_frame *wh;
1294 	const struct ieee80211_txparam *tp;
1295 	struct ieee80211_key *k;
1296 	uint32_t flags = 0;
1297 	uint16_t dur;
1298 	int error, rate;
1299 
1300 	RAL_LOCK_ASSERT(sc, MA_OWNED);
1301 
1302 	wh = mtod(m0, struct ieee80211_frame *);
1303 
1304 	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1305 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1306 		rate = tp->mcastrate;
1307 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1308 		rate = tp->ucastrate;
1309 	else
1310 		rate = ni->ni_txrate;
1311 
1312 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1313 		k = ieee80211_crypto_encap(ni, m0);
1314 		if (k == NULL) {
1315 			m_freem(m0);
1316 			return ENOBUFS;
1317 		}
1318 		/* packet header may have moved, reset our local pointer */
1319 		wh = mtod(m0, struct ieee80211_frame *);
1320 	}
1321 
1322 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1323 		int prot = IEEE80211_PROT_NONE;
1324 		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1325 			prot = IEEE80211_PROT_RTSCTS;
1326 		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1327 		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1328 			prot = ic->ic_protmode;
1329 		if (prot != IEEE80211_PROT_NONE) {
1330 			error = ural_sendprot(sc, m0, ni, prot, rate);
1331 			if (error || sc->tx_nfree == 0) {
1332 				m_freem(m0);
1333 				return ENOBUFS;
1334 			}
1335 			flags |= RAL_TX_IFS_SIFS;
1336 		}
1337 	}
1338 
1339 	data = STAILQ_FIRST(&sc->tx_free);
1340 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1341 	sc->tx_nfree--;
1342 
1343 	data->m = m0;
1344 	data->ni = ni;
1345 	data->rate = rate;
1346 
1347 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1348 		flags |= RAL_TX_ACK;
1349 		flags |= RAL_TX_RETRY(7);
1350 
1351 		dur = ieee80211_ack_duration(sc->sc_rates, rate,
1352 		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1353 		*(uint16_t *)wh->i_dur = htole16(dur);
1354 	}
1355 
1356 	ural_setup_tx_desc(sc, &data->desc, flags, m0->m_pkthdr.len, rate);
1357 
1358 	DPRINTFN(10, "sending data frame len=%u rate=%u\n",
1359 	    m0->m_pkthdr.len, rate);
1360 
1361 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1362 	usb2_transfer_start(sc->sc_xfer[URAL_BULK_WR]);
1363 
1364 	return 0;
1365 }
1366 
1367 static void
1368 ural_start(struct ifnet *ifp)
1369 {
1370 	struct ural_softc *sc = ifp->if_softc;
1371 	struct ieee80211_node *ni;
1372 	struct mbuf *m;
1373 
1374 	RAL_LOCK(sc);
1375 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1376 		RAL_UNLOCK(sc);
1377 		return;
1378 	}
1379 	for (;;) {
1380 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1381 		if (m == NULL)
1382 			break;
1383 		if (sc->tx_nfree < RAL_TX_MINFREE) {
1384 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1385 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1386 			break;
1387 		}
1388 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1389 		m = ieee80211_encap(ni, m);
1390 		if (m == NULL) {
1391 			ieee80211_free_node(ni);
1392 			continue;
1393 		}
1394 		if (ural_tx_data(sc, m, ni) != 0) {
1395 			ieee80211_free_node(ni);
1396 			ifp->if_oerrors++;
1397 			break;
1398 		}
1399 	}
1400 	RAL_UNLOCK(sc);
1401 }
1402 
1403 static int
1404 ural_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1405 {
1406 	struct ural_softc *sc = ifp->if_softc;
1407 	struct ieee80211com *ic = ifp->if_l2com;
1408 	struct ifreq *ifr = (struct ifreq *) data;
1409 	int error = 0, startall = 0;
1410 
1411 	switch (cmd) {
1412 	case SIOCSIFFLAGS:
1413 		RAL_LOCK(sc);
1414 		if (ifp->if_flags & IFF_UP) {
1415 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1416 				ural_queue_command(sc, ural_init_task,
1417 				    &sc->sc_synctask[0].hdr,
1418 				    &sc->sc_synctask[1].hdr);
1419 				startall = 1;
1420 			} else
1421 				ural_queue_command(sc, ural_promisctask,
1422 				    &sc->sc_promisctask[0].hdr,
1423 				    &sc->sc_promisctask[1].hdr);
1424 		} else {
1425 			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1426 				ural_queue_command(sc, ural_stop_task,
1427 				    &sc->sc_synctask[0].hdr,
1428 				    &sc->sc_synctask[1].hdr);
1429 			}
1430 		}
1431 		RAL_UNLOCK(sc);
1432 		if (startall)
1433 			ieee80211_start_all(ic);
1434 		break;
1435 	case SIOCGIFMEDIA:
1436 	case SIOCSIFMEDIA:
1437 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1438 		break;
1439 	default:
1440 		error = ether_ioctl(ifp, cmd, data);
1441 		break;
1442 	}
1443 	return error;
1444 }
1445 
1446 static void
1447 ural_set_testmode(struct ural_softc *sc)
1448 {
1449 	struct usb2_device_request req;
1450 	usb2_error_t error;
1451 
1452 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1453 	req.bRequest = RAL_VENDOR_REQUEST;
1454 	USETW(req.wValue, 4);
1455 	USETW(req.wIndex, 1);
1456 	USETW(req.wLength, 0);
1457 
1458 	error = ural_do_request(sc, &req, NULL);
1459 	if (error != 0) {
1460 		device_printf(sc->sc_dev, "could not set test mode: %s\n",
1461 		    usb2_errstr(error));
1462 	}
1463 }
1464 
1465 static void
1466 ural_eeprom_read(struct ural_softc *sc, uint16_t addr, void *buf, int len)
1467 {
1468 	struct usb2_device_request req;
1469 	usb2_error_t error;
1470 
1471 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1472 	req.bRequest = RAL_READ_EEPROM;
1473 	USETW(req.wValue, 0);
1474 	USETW(req.wIndex, addr);
1475 	USETW(req.wLength, len);
1476 
1477 	error = ural_do_request(sc, &req, buf);
1478 	if (error != 0) {
1479 		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1480 		    usb2_errstr(error));
1481 	}
1482 }
1483 
1484 static uint16_t
1485 ural_read(struct ural_softc *sc, uint16_t reg)
1486 {
1487 	struct usb2_device_request req;
1488 	usb2_error_t error;
1489 	uint16_t val;
1490 
1491 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1492 	req.bRequest = RAL_READ_MAC;
1493 	USETW(req.wValue, 0);
1494 	USETW(req.wIndex, reg);
1495 	USETW(req.wLength, sizeof (uint16_t));
1496 
1497 	error = ural_do_request(sc, &req, &val);
1498 	if (error != 0) {
1499 		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1500 		    usb2_errstr(error));
1501 		return 0;
1502 	}
1503 
1504 	return le16toh(val);
1505 }
1506 
1507 static void
1508 ural_read_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1509 {
1510 	struct usb2_device_request req;
1511 	usb2_error_t error;
1512 
1513 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1514 	req.bRequest = RAL_READ_MULTI_MAC;
1515 	USETW(req.wValue, 0);
1516 	USETW(req.wIndex, reg);
1517 	USETW(req.wLength, len);
1518 
1519 	error = ural_do_request(sc, &req, buf);
1520 	if (error != 0) {
1521 		device_printf(sc->sc_dev, "could not read MAC register: %s\n",
1522 		    usb2_errstr(error));
1523 	}
1524 }
1525 
1526 static void
1527 ural_write(struct ural_softc *sc, uint16_t reg, uint16_t val)
1528 {
1529 	struct usb2_device_request req;
1530 	usb2_error_t error;
1531 
1532 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1533 	req.bRequest = RAL_WRITE_MAC;
1534 	USETW(req.wValue, val);
1535 	USETW(req.wIndex, reg);
1536 	USETW(req.wLength, 0);
1537 
1538 	error = ural_do_request(sc, &req, NULL);
1539 	if (error != 0) {
1540 		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1541 		    usb2_errstr(error));
1542 	}
1543 }
1544 
1545 static void
1546 ural_write_multi(struct ural_softc *sc, uint16_t reg, void *buf, int len)
1547 {
1548 	struct usb2_device_request req;
1549 	usb2_error_t error;
1550 
1551 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1552 	req.bRequest = RAL_WRITE_MULTI_MAC;
1553 	USETW(req.wValue, 0);
1554 	USETW(req.wIndex, reg);
1555 	USETW(req.wLength, len);
1556 
1557 	error = ural_do_request(sc, &req, buf);
1558 	if (error != 0) {
1559 		device_printf(sc->sc_dev, "could not write MAC register: %s\n",
1560 		    usb2_errstr(error));
1561 	}
1562 }
1563 
1564 static void
1565 ural_bbp_write(struct ural_softc *sc, uint8_t reg, uint8_t val)
1566 {
1567 	uint16_t tmp;
1568 	int ntries;
1569 
1570 	for (ntries = 0; ntries < 100; ntries++) {
1571 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1572 			break;
1573 		if (ural_pause(sc, hz / 100))
1574 			break;
1575 	}
1576 	if (ntries == 100) {
1577 		device_printf(sc->sc_dev, "could not write to BBP\n");
1578 		return;
1579 	}
1580 
1581 	tmp = reg << 8 | val;
1582 	ural_write(sc, RAL_PHY_CSR7, tmp);
1583 }
1584 
1585 static uint8_t
1586 ural_bbp_read(struct ural_softc *sc, uint8_t reg)
1587 {
1588 	uint16_t val;
1589 	int ntries;
1590 
1591 	val = RAL_BBP_WRITE | reg << 8;
1592 	ural_write(sc, RAL_PHY_CSR7, val);
1593 
1594 	for (ntries = 0; ntries < 100; ntries++) {
1595 		if (!(ural_read(sc, RAL_PHY_CSR8) & RAL_BBP_BUSY))
1596 			break;
1597 		if (ural_pause(sc, hz / 100))
1598 			break;
1599 	}
1600 	if (ntries == 100) {
1601 		device_printf(sc->sc_dev, "could not read BBP\n");
1602 		return 0;
1603 	}
1604 
1605 	return ural_read(sc, RAL_PHY_CSR7) & 0xff;
1606 }
1607 
1608 static void
1609 ural_rf_write(struct ural_softc *sc, uint8_t reg, uint32_t val)
1610 {
1611 	uint32_t tmp;
1612 	int ntries;
1613 
1614 	for (ntries = 0; ntries < 100; ntries++) {
1615 		if (!(ural_read(sc, RAL_PHY_CSR10) & RAL_RF_LOBUSY))
1616 			break;
1617 		if (ural_pause(sc, hz / 100))
1618 			break;
1619 	}
1620 	if (ntries == 100) {
1621 		device_printf(sc->sc_dev, "could not write to RF\n");
1622 		return;
1623 	}
1624 
1625 	tmp = RAL_RF_BUSY | RAL_RF_20BIT | (val & 0xfffff) << 2 | (reg & 0x3);
1626 	ural_write(sc, RAL_PHY_CSR9,  tmp & 0xffff);
1627 	ural_write(sc, RAL_PHY_CSR10, tmp >> 16);
1628 
1629 	/* remember last written value in sc */
1630 	sc->rf_regs[reg] = val;
1631 
1632 	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 0x3, val & 0xfffff);
1633 }
1634 
1635 /* ARGUSED */
1636 static struct ieee80211_node *
1637 ural_node_alloc(struct ieee80211vap *vap __unused,
1638 	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
1639 {
1640 	struct ural_node *un;
1641 
1642 	un = malloc(sizeof(struct ural_node), M_80211_NODE, M_NOWAIT | M_ZERO);
1643 	return un != NULL ? &un->ni : NULL;
1644 }
1645 
1646 static void
1647 ural_newassoc(struct ieee80211_node *ni, int isnew)
1648 {
1649 	struct ieee80211vap *vap = ni->ni_vap;
1650 
1651 	ieee80211_amrr_node_init(&URAL_VAP(vap)->amrr, &URAL_NODE(ni)->amn, ni);
1652 }
1653 
1654 static void
1655 ural_scan_start(struct ieee80211com *ic)
1656 {
1657 	struct ural_softc *sc = ic->ic_ifp->if_softc;
1658 
1659 	RAL_LOCK(sc);
1660 	/* do it in a process context */
1661 	sc->sc_scan_action = URAL_SCAN_START;
1662 	ural_queue_command(sc, ural_scantask,
1663 	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1664 	RAL_UNLOCK(sc);
1665 
1666 }
1667 
1668 static void
1669 ural_scan_end(struct ieee80211com *ic)
1670 {
1671 	struct ural_softc *sc = ic->ic_ifp->if_softc;
1672 
1673 	RAL_LOCK(sc);
1674 	/* do it in a process context */
1675 	sc->sc_scan_action = URAL_SCAN_END;
1676 	ural_queue_command(sc, ural_scantask,
1677 	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1678 	RAL_UNLOCK(sc);
1679 
1680 }
1681 
1682 static void
1683 ural_set_channel(struct ieee80211com *ic)
1684 {
1685 	struct ural_softc *sc = ic->ic_ifp->if_softc;
1686 
1687 	RAL_LOCK(sc);
1688 	/* do it in a process context */
1689 	sc->sc_scan_action = URAL_SET_CHANNEL;
1690 	ural_queue_command(sc, ural_scantask,
1691 	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
1692 
1693 	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1694 	RAL_UNLOCK(sc);
1695 }
1696 
1697 static void
1698 ural_set_chan(struct ural_softc *sc, struct ieee80211_channel *c)
1699 {
1700 	struct ifnet *ifp = sc->sc_ifp;
1701 	struct ieee80211com *ic = ifp->if_l2com;
1702 	uint8_t power, tmp;
1703 	int i, chan;
1704 
1705 	chan = ieee80211_chan2ieee(ic, c);
1706 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1707 		return;
1708 
1709 	if (IEEE80211_IS_CHAN_2GHZ(c))
1710 		power = min(sc->txpow[chan - 1], 31);
1711 	else
1712 		power = 31;
1713 
1714 	/* adjust txpower using ifconfig settings */
1715 	power -= (100 - ic->ic_txpowlimit) / 8;
1716 
1717 	DPRINTFN(2, "setting channel to %u, txpower to %u\n", chan, power);
1718 
1719 	switch (sc->rf_rev) {
1720 	case RAL_RF_2522:
1721 		ural_rf_write(sc, RAL_RF1, 0x00814);
1722 		ural_rf_write(sc, RAL_RF2, ural_rf2522_r2[chan - 1]);
1723 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1724 		break;
1725 
1726 	case RAL_RF_2523:
1727 		ural_rf_write(sc, RAL_RF1, 0x08804);
1728 		ural_rf_write(sc, RAL_RF2, ural_rf2523_r2[chan - 1]);
1729 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x38044);
1730 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1731 		break;
1732 
1733 	case RAL_RF_2524:
1734 		ural_rf_write(sc, RAL_RF1, 0x0c808);
1735 		ural_rf_write(sc, RAL_RF2, ural_rf2524_r2[chan - 1]);
1736 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1737 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1738 		break;
1739 
1740 	case RAL_RF_2525:
1741 		ural_rf_write(sc, RAL_RF1, 0x08808);
1742 		ural_rf_write(sc, RAL_RF2, ural_rf2525_hi_r2[chan - 1]);
1743 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1744 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1745 
1746 		ural_rf_write(sc, RAL_RF1, 0x08808);
1747 		ural_rf_write(sc, RAL_RF2, ural_rf2525_r2[chan - 1]);
1748 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1749 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00280 : 0x00286);
1750 		break;
1751 
1752 	case RAL_RF_2525E:
1753 		ural_rf_write(sc, RAL_RF1, 0x08808);
1754 		ural_rf_write(sc, RAL_RF2, ural_rf2525e_r2[chan - 1]);
1755 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1756 		ural_rf_write(sc, RAL_RF4, (chan == 14) ? 0x00286 : 0x00282);
1757 		break;
1758 
1759 	case RAL_RF_2526:
1760 		ural_rf_write(sc, RAL_RF2, ural_rf2526_hi_r2[chan - 1]);
1761 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1762 		ural_rf_write(sc, RAL_RF1, 0x08804);
1763 
1764 		ural_rf_write(sc, RAL_RF2, ural_rf2526_r2[chan - 1]);
1765 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x18044);
1766 		ural_rf_write(sc, RAL_RF4, (chan & 1) ? 0x00386 : 0x00381);
1767 		break;
1768 
1769 	/* dual-band RF */
1770 	case RAL_RF_5222:
1771 		for (i = 0; ural_rf5222[i].chan != chan; i++);
1772 
1773 		ural_rf_write(sc, RAL_RF1, ural_rf5222[i].r1);
1774 		ural_rf_write(sc, RAL_RF2, ural_rf5222[i].r2);
1775 		ural_rf_write(sc, RAL_RF3, power << 7 | 0x00040);
1776 		ural_rf_write(sc, RAL_RF4, ural_rf5222[i].r4);
1777 		break;
1778 	}
1779 
1780 	if (ic->ic_opmode != IEEE80211_M_MONITOR &&
1781 	    (ic->ic_flags & IEEE80211_F_SCAN) == 0) {
1782 		/* set Japan filter bit for channel 14 */
1783 		tmp = ural_bbp_read(sc, 70);
1784 
1785 		tmp &= ~RAL_JAPAN_FILTER;
1786 		if (chan == 14)
1787 			tmp |= RAL_JAPAN_FILTER;
1788 
1789 		ural_bbp_write(sc, 70, tmp);
1790 
1791 		/* clear CRC errors */
1792 		ural_read(sc, RAL_STA_CSR0);
1793 
1794 		ural_pause(sc, hz / 100);
1795 		ural_disable_rf_tune(sc);
1796 	}
1797 
1798 	/* XXX doesn't belong here */
1799 	/* update basic rate set */
1800 	ural_set_basicrates(sc, c);
1801 }
1802 
1803 /*
1804  * Disable RF auto-tuning.
1805  */
1806 static void
1807 ural_disable_rf_tune(struct ural_softc *sc)
1808 {
1809 	uint32_t tmp;
1810 
1811 	if (sc->rf_rev != RAL_RF_2523) {
1812 		tmp = sc->rf_regs[RAL_RF1] & ~RAL_RF1_AUTOTUNE;
1813 		ural_rf_write(sc, RAL_RF1, tmp);
1814 	}
1815 
1816 	tmp = sc->rf_regs[RAL_RF3] & ~RAL_RF3_AUTOTUNE;
1817 	ural_rf_write(sc, RAL_RF3, tmp);
1818 
1819 	DPRINTFN(2, "disabling RF autotune\n");
1820 }
1821 
1822 /*
1823  * Refer to IEEE Std 802.11-1999 pp. 123 for more information on TSF
1824  * synchronization.
1825  */
1826 static void
1827 ural_enable_tsf_sync(struct ural_softc *sc)
1828 {
1829 	struct ifnet *ifp = sc->sc_ifp;
1830 	struct ieee80211com *ic = ifp->if_l2com;
1831 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1832 	uint16_t logcwmin, preload, tmp;
1833 
1834 	/* first, disable TSF synchronization */
1835 	ural_write(sc, RAL_TXRX_CSR19, 0);
1836 
1837 	tmp = (16 * vap->iv_bss->ni_intval) << 4;
1838 	ural_write(sc, RAL_TXRX_CSR18, tmp);
1839 
1840 	logcwmin = (ic->ic_opmode == IEEE80211_M_IBSS) ? 2 : 0;
1841 	preload = (ic->ic_opmode == IEEE80211_M_IBSS) ? 320 : 6;
1842 	tmp = logcwmin << 12 | preload;
1843 	ural_write(sc, RAL_TXRX_CSR20, tmp);
1844 
1845 	/* finally, enable TSF synchronization */
1846 	tmp = RAL_ENABLE_TSF | RAL_ENABLE_TBCN;
1847 	if (ic->ic_opmode == IEEE80211_M_STA)
1848 		tmp |= RAL_ENABLE_TSF_SYNC(1);
1849 	else
1850 		tmp |= RAL_ENABLE_TSF_SYNC(2) | RAL_ENABLE_BEACON_GENERATOR;
1851 	ural_write(sc, RAL_TXRX_CSR19, tmp);
1852 
1853 	DPRINTF("enabling TSF synchronization\n");
1854 }
1855 
1856 #define RAL_RXTX_TURNAROUND	5	/* us */
1857 static void
1858 ural_update_slot(struct ifnet *ifp)
1859 {
1860 	struct ural_softc *sc = ifp->if_softc;
1861 	struct ieee80211com *ic = ifp->if_l2com;
1862 	uint16_t slottime, sifs, eifs;
1863 
1864 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1865 
1866 	/*
1867 	 * These settings may sound a bit inconsistent but this is what the
1868 	 * reference driver does.
1869 	 */
1870 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1871 		sifs = 16 - RAL_RXTX_TURNAROUND;
1872 		eifs = 364;
1873 	} else {
1874 		sifs = 10 - RAL_RXTX_TURNAROUND;
1875 		eifs = 64;
1876 	}
1877 
1878 	ural_write(sc, RAL_MAC_CSR10, slottime);
1879 	ural_write(sc, RAL_MAC_CSR11, sifs);
1880 	ural_write(sc, RAL_MAC_CSR12, eifs);
1881 }
1882 
1883 static void
1884 ural_set_txpreamble(struct ural_softc *sc)
1885 {
1886 	struct ifnet *ifp = sc->sc_ifp;
1887 	struct ieee80211com *ic = ifp->if_l2com;
1888 	uint16_t tmp;
1889 
1890 	tmp = ural_read(sc, RAL_TXRX_CSR10);
1891 
1892 	tmp &= ~RAL_SHORT_PREAMBLE;
1893 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1894 		tmp |= RAL_SHORT_PREAMBLE;
1895 
1896 	ural_write(sc, RAL_TXRX_CSR10, tmp);
1897 }
1898 
1899 static void
1900 ural_set_basicrates(struct ural_softc *sc, const struct ieee80211_channel *c)
1901 {
1902 	/* XXX wrong, take from rate set */
1903 	/* update basic rate set */
1904 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1905 		/* 11a basic rates: 6, 12, 24Mbps */
1906 		ural_write(sc, RAL_TXRX_CSR11, 0x150);
1907 	} else if (IEEE80211_IS_CHAN_ANYG(c)) {
1908 		/* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1909 		ural_write(sc, RAL_TXRX_CSR11, 0x15f);
1910 	} else {
1911 		/* 11b basic rates: 1, 2Mbps */
1912 		ural_write(sc, RAL_TXRX_CSR11, 0x3);
1913 	}
1914 }
1915 
1916 static void
1917 ural_set_bssid(struct ural_softc *sc, const uint8_t *bssid)
1918 {
1919 	uint16_t tmp;
1920 
1921 	tmp = bssid[0] | bssid[1] << 8;
1922 	ural_write(sc, RAL_MAC_CSR5, tmp);
1923 
1924 	tmp = bssid[2] | bssid[3] << 8;
1925 	ural_write(sc, RAL_MAC_CSR6, tmp);
1926 
1927 	tmp = bssid[4] | bssid[5] << 8;
1928 	ural_write(sc, RAL_MAC_CSR7, tmp);
1929 
1930 	DPRINTF("setting BSSID to %6D\n", bssid, ":");
1931 }
1932 
1933 static void
1934 ural_set_macaddr(struct ural_softc *sc, uint8_t *addr)
1935 {
1936 	uint16_t tmp;
1937 
1938 	tmp = addr[0] | addr[1] << 8;
1939 	ural_write(sc, RAL_MAC_CSR2, tmp);
1940 
1941 	tmp = addr[2] | addr[3] << 8;
1942 	ural_write(sc, RAL_MAC_CSR3, tmp);
1943 
1944 	tmp = addr[4] | addr[5] << 8;
1945 	ural_write(sc, RAL_MAC_CSR4, tmp);
1946 
1947 	DPRINTF("setting MAC address to %6D\n", addr, ":");
1948 }
1949 
1950 static void
1951 ural_promisctask(struct usb2_proc_msg *pm)
1952 {
1953 	struct ural_task *task = (struct ural_task *)pm;
1954 	struct ural_softc *sc = task->sc;
1955 	struct ifnet *ifp = sc->sc_ifp;
1956 	uint32_t tmp;
1957 
1958 	tmp = ural_read(sc, RAL_TXRX_CSR2);
1959 
1960 	tmp &= ~RAL_DROP_NOT_TO_ME;
1961 	if (!(ifp->if_flags & IFF_PROMISC))
1962 		tmp |= RAL_DROP_NOT_TO_ME;
1963 
1964 	ural_write(sc, RAL_TXRX_CSR2, tmp);
1965 
1966 	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1967 	    "entering" : "leaving");
1968 }
1969 
1970 static const char *
1971 ural_get_rf(int rev)
1972 {
1973 	switch (rev) {
1974 	case RAL_RF_2522:	return "RT2522";
1975 	case RAL_RF_2523:	return "RT2523";
1976 	case RAL_RF_2524:	return "RT2524";
1977 	case RAL_RF_2525:	return "RT2525";
1978 	case RAL_RF_2525E:	return "RT2525e";
1979 	case RAL_RF_2526:	return "RT2526";
1980 	case RAL_RF_5222:	return "RT5222";
1981 	default:		return "unknown";
1982 	}
1983 }
1984 
1985 static void
1986 ural_read_eeprom(struct ural_softc *sc)
1987 {
1988 	uint16_t val;
1989 
1990 	ural_eeprom_read(sc, RAL_EEPROM_CONFIG0, &val, 2);
1991 	val = le16toh(val);
1992 	sc->rf_rev =   (val >> 11) & 0x7;
1993 	sc->hw_radio = (val >> 10) & 0x1;
1994 	sc->led_mode = (val >> 6)  & 0x7;
1995 	sc->rx_ant =   (val >> 4)  & 0x3;
1996 	sc->tx_ant =   (val >> 2)  & 0x3;
1997 	sc->nb_ant =   val & 0x3;
1998 
1999 	/* read MAC address */
2000 	ural_eeprom_read(sc, RAL_EEPROM_ADDRESS, sc->sc_bssid, 6);
2001 
2002 	/* read default values for BBP registers */
2003 	ural_eeprom_read(sc, RAL_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
2004 
2005 	/* read Tx power for all b/g channels */
2006 	ural_eeprom_read(sc, RAL_EEPROM_TXPOWER, sc->txpow, 14);
2007 }
2008 
2009 static int
2010 ural_bbp_init(struct ural_softc *sc)
2011 {
2012 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2013 	int i, ntries;
2014 
2015 	/* wait for BBP to be ready */
2016 	for (ntries = 0; ntries < 100; ntries++) {
2017 		if (ural_bbp_read(sc, RAL_BBP_VERSION) != 0)
2018 			break;
2019 		if (ural_pause(sc, hz / 100))
2020 			break;
2021 	}
2022 	if (ntries == 100) {
2023 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2024 		return EIO;
2025 	}
2026 
2027 	/* initialize BBP registers to default values */
2028 	for (i = 0; i < N(ural_def_bbp); i++)
2029 		ural_bbp_write(sc, ural_def_bbp[i].reg, ural_def_bbp[i].val);
2030 
2031 #if 0
2032 	/* initialize BBP registers to values stored in EEPROM */
2033 	for (i = 0; i < 16; i++) {
2034 		if (sc->bbp_prom[i].reg == 0xff)
2035 			continue;
2036 		ural_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2037 	}
2038 #endif
2039 
2040 	return 0;
2041 #undef N
2042 }
2043 
2044 static void
2045 ural_set_txantenna(struct ural_softc *sc, int antenna)
2046 {
2047 	uint16_t tmp;
2048 	uint8_t tx;
2049 
2050 	tx = ural_bbp_read(sc, RAL_BBP_TX) & ~RAL_BBP_ANTMASK;
2051 	if (antenna == 1)
2052 		tx |= RAL_BBP_ANTA;
2053 	else if (antenna == 2)
2054 		tx |= RAL_BBP_ANTB;
2055 	else
2056 		tx |= RAL_BBP_DIVERSITY;
2057 
2058 	/* need to force I/Q flip for RF 2525e, 2526 and 5222 */
2059 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526 ||
2060 	    sc->rf_rev == RAL_RF_5222)
2061 		tx |= RAL_BBP_FLIPIQ;
2062 
2063 	ural_bbp_write(sc, RAL_BBP_TX, tx);
2064 
2065 	/* update values in PHY_CSR5 and PHY_CSR6 */
2066 	tmp = ural_read(sc, RAL_PHY_CSR5) & ~0x7;
2067 	ural_write(sc, RAL_PHY_CSR5, tmp | (tx & 0x7));
2068 
2069 	tmp = ural_read(sc, RAL_PHY_CSR6) & ~0x7;
2070 	ural_write(sc, RAL_PHY_CSR6, tmp | (tx & 0x7));
2071 }
2072 
2073 static void
2074 ural_set_rxantenna(struct ural_softc *sc, int antenna)
2075 {
2076 	uint8_t rx;
2077 
2078 	rx = ural_bbp_read(sc, RAL_BBP_RX) & ~RAL_BBP_ANTMASK;
2079 	if (antenna == 1)
2080 		rx |= RAL_BBP_ANTA;
2081 	else if (antenna == 2)
2082 		rx |= RAL_BBP_ANTB;
2083 	else
2084 		rx |= RAL_BBP_DIVERSITY;
2085 
2086 	/* need to force no I/Q flip for RF 2525e and 2526 */
2087 	if (sc->rf_rev == RAL_RF_2525E || sc->rf_rev == RAL_RF_2526)
2088 		rx &= ~RAL_BBP_FLIPIQ;
2089 
2090 	ural_bbp_write(sc, RAL_BBP_RX, rx);
2091 }
2092 
2093 static void
2094 ural_init_task(struct usb2_proc_msg *pm)
2095 {
2096 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2097 	struct ural_task *task = (struct ural_task *)pm;
2098 	struct ural_softc *sc = task->sc;
2099 	struct ifnet *ifp = sc->sc_ifp;
2100 	struct ieee80211com *ic = ifp->if_l2com;
2101 	uint16_t tmp;
2102 	int i, ntries;
2103 
2104 	RAL_LOCK_ASSERT(sc, MA_OWNED);
2105 
2106 	ural_set_testmode(sc);
2107 	ural_write(sc, 0x308, 0x00f0);	/* XXX magic */
2108 
2109 	ural_stop_task(pm);
2110 
2111 	/* initialize MAC registers to default values */
2112 	for (i = 0; i < N(ural_def_mac); i++)
2113 		ural_write(sc, ural_def_mac[i].reg, ural_def_mac[i].val);
2114 
2115 	/* wait for BBP and RF to wake up (this can take a long time!) */
2116 	for (ntries = 0; ntries < 100; ntries++) {
2117 		tmp = ural_read(sc, RAL_MAC_CSR17);
2118 		if ((tmp & (RAL_BBP_AWAKE | RAL_RF_AWAKE)) ==
2119 		    (RAL_BBP_AWAKE | RAL_RF_AWAKE))
2120 			break;
2121 		if (ural_pause(sc, hz / 100))
2122 			break;
2123 	}
2124 	if (ntries == 100) {
2125 		device_printf(sc->sc_dev,
2126 		    "timeout waiting for BBP/RF to wakeup\n");
2127 		goto fail;
2128 	}
2129 
2130 	/* we're ready! */
2131 	ural_write(sc, RAL_MAC_CSR1, RAL_HOST_READY);
2132 
2133 	/* set basic rate set (will be updated later) */
2134 	ural_write(sc, RAL_TXRX_CSR11, 0x15f);
2135 
2136 	if (ural_bbp_init(sc) != 0)
2137 		goto fail;
2138 
2139 	ural_set_chan(sc, ic->ic_curchan);
2140 
2141 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2142 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2143 
2144 	ural_set_txantenna(sc, sc->tx_ant);
2145 	ural_set_rxantenna(sc, sc->rx_ant);
2146 
2147 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2148 	ural_set_macaddr(sc, ic->ic_myaddr);
2149 
2150 	/*
2151 	 * Allocate Tx and Rx xfer queues.
2152 	 */
2153 	ural_setup_tx_list(sc);
2154 
2155 	/* kick Rx */
2156 	tmp = RAL_DROP_PHY | RAL_DROP_CRC;
2157 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2158 		tmp |= RAL_DROP_CTL | RAL_DROP_BAD_VERSION;
2159 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2160 			tmp |= RAL_DROP_TODS;
2161 		if (!(ifp->if_flags & IFF_PROMISC))
2162 			tmp |= RAL_DROP_NOT_TO_ME;
2163 	}
2164 	ural_write(sc, RAL_TXRX_CSR2, tmp);
2165 
2166 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2167 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2168 	usb2_transfer_start(sc->sc_xfer[URAL_BULK_RD]);
2169 	return;
2170 
2171 fail:	ural_stop_task(pm);
2172 #undef N
2173 }
2174 
2175 static void
2176 ural_init(void *priv)
2177 {
2178 	struct ural_softc *sc = priv;
2179 	struct ifnet *ifp = sc->sc_ifp;
2180 	struct ieee80211com *ic = ifp->if_l2com;
2181 
2182 	RAL_LOCK(sc);
2183 	ural_queue_command(sc, ural_init_task,
2184 	    &sc->sc_synctask[0].hdr,
2185 	    &sc->sc_synctask[1].hdr);
2186 	RAL_UNLOCK(sc);
2187 
2188 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2189 		ieee80211_start_all(ic);		/* start all vap's */
2190 }
2191 
2192 static void
2193 ural_stop_task(struct usb2_proc_msg *pm)
2194 {
2195 	struct ural_task *task = (struct ural_task *)pm;
2196 	struct ural_softc *sc = task->sc;
2197 	struct ifnet *ifp = sc->sc_ifp;
2198 
2199 	RAL_LOCK_ASSERT(sc, MA_OWNED);
2200 
2201 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2202 
2203 	/*
2204 	 * Drain all the transfers, if not already drained:
2205 	 */
2206 	RAL_UNLOCK(sc);
2207 	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_WR]);
2208 	usb2_transfer_drain(sc->sc_xfer[URAL_BULK_RD]);
2209 	RAL_LOCK(sc);
2210 
2211 	ural_unsetup_tx_list(sc);
2212 
2213 	/* disable Rx */
2214 	ural_write(sc, RAL_TXRX_CSR2, RAL_DISABLE_RX);
2215 	/* reset ASIC and BBP (but won't reset MAC registers!) */
2216 	ural_write(sc, RAL_MAC_CSR1, RAL_RESET_ASIC | RAL_RESET_BBP);
2217 	/* wait a little */
2218 	ural_pause(sc, hz / 10);
2219 	ural_write(sc, RAL_MAC_CSR1, 0);
2220 }
2221 
2222 static int
2223 ural_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2224 	const struct ieee80211_bpf_params *params)
2225 {
2226 	struct ieee80211com *ic = ni->ni_ic;
2227 	struct ifnet *ifp = ic->ic_ifp;
2228 	struct ural_softc *sc = ifp->if_softc;
2229 
2230 	RAL_LOCK(sc);
2231 	/* prevent management frames from being sent if we're not ready */
2232 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2233 		RAL_UNLOCK(sc);
2234 		m_freem(m);
2235 		ieee80211_free_node(ni);
2236 		return ENETDOWN;
2237 	}
2238 	if (sc->tx_nfree < RAL_TX_MINFREE) {
2239 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2240 		RAL_UNLOCK(sc);
2241 		m_freem(m);
2242 		ieee80211_free_node(ni);
2243 		return EIO;
2244 	}
2245 
2246 	ifp->if_opackets++;
2247 
2248 	if (params == NULL) {
2249 		/*
2250 		 * Legacy path; interpret frame contents to decide
2251 		 * precisely how to send the frame.
2252 		 */
2253 		if (ural_tx_mgt(sc, m, ni) != 0)
2254 			goto bad;
2255 	} else {
2256 		/*
2257 		 * Caller supplied explicit parameters to use in
2258 		 * sending the frame.
2259 		 */
2260 		if (ural_tx_raw(sc, m, ni, params) != 0)
2261 			goto bad;
2262 	}
2263 	RAL_UNLOCK(sc);
2264 	return 0;
2265 bad:
2266 	ifp->if_oerrors++;
2267 	RAL_UNLOCK(sc);
2268 	ieee80211_free_node(ni);
2269 	return EIO;		/* XXX */
2270 }
2271 
2272 static void
2273 ural_amrr_start(struct ural_softc *sc, struct ieee80211_node *ni)
2274 {
2275 	struct ieee80211vap *vap = ni->ni_vap;
2276 	struct ural_vap *uvp = URAL_VAP(vap);
2277 
2278 	/* clear statistic registers (STA_CSR0 to STA_CSR10) */
2279 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof sc->sta);
2280 
2281 	ieee80211_amrr_node_init(&uvp->amrr, &URAL_NODE(ni)->amn, ni);
2282 
2283 	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2284 }
2285 
2286 static void
2287 ural_amrr_timeout(void *arg)
2288 {
2289 	struct ural_vap *uvp = arg;
2290 	struct ural_softc *sc = uvp->sc;
2291 
2292 	ural_queue_command(sc, ural_amrr_task,
2293 	    &uvp->amrr_task[0].hdr, &uvp->amrr_task[1].hdr);
2294 }
2295 
2296 static void
2297 ural_amrr_task(struct usb2_proc_msg *pm)
2298 {
2299 	struct ural_task *task = (struct ural_task *)pm;
2300 	struct ural_softc *sc = task->sc;
2301 	struct ifnet *ifp = sc->sc_ifp;
2302 	struct ieee80211com *ic = ifp->if_l2com;
2303 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2304 	struct ural_vap *uvp = URAL_VAP(vap);
2305 	struct ieee80211_node *ni = vap->iv_bss;
2306 	int ok, fail;
2307 
2308 	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2309 	ural_read_multi(sc, RAL_STA_CSR0, sc->sta, sizeof(sc->sta));
2310 
2311 	ok = sc->sta[7] +		/* TX ok w/o retry */
2312 	     sc->sta[8];		/* TX ok w/ retry */
2313 	fail = sc->sta[9];		/* TX retry-fail count */
2314 
2315 	ieee80211_amrr_tx_update(&URAL_NODE(ni)->amn,
2316 	    ok+fail, ok, sc->sta[8] + fail);
2317 	(void) ieee80211_amrr_choose(ni, &URAL_NODE(ni)->amn);
2318 
2319 	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2320 
2321 	usb2_callout_reset(&uvp->amrr_ch, hz, ural_amrr_timeout, uvp);
2322 }
2323 
2324 static int
2325 ural_pause(struct ural_softc *sc, int timeout)
2326 {
2327 	if (usb2_proc_is_gone(&sc->sc_tq))
2328 		return (1);
2329 
2330 	usb2_pause_mtx(&sc->sc_mtx, timeout);
2331 	return (0);
2332 }
2333 
2334 static void
2335 ural_queue_command(struct ural_softc *sc, usb2_proc_callback_t *fn,
2336     struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2337 {
2338 	struct ural_task *task;
2339 
2340 	RAL_LOCK_ASSERT(sc, MA_OWNED);
2341 
2342 	if (usb2_proc_is_gone(&sc->sc_tq)) {
2343 		DPRINTF("proc is gone\n");
2344 		return;         /* nothing to do */
2345 	}
2346 	/*
2347 	 * NOTE: The task cannot get executed before we drop the
2348 	 * "sc_mtx" mutex. It is safe to update fields in the message
2349 	 * structure after that the message got queued.
2350 	 */
2351 	task = (struct ural_task *)
2352 	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2353 
2354 	/* Setup callback and softc pointers */
2355 	task->hdr.pm_callback = fn;
2356 	task->sc = sc;
2357 
2358 	/*
2359 	 * Init and stop must be synchronous!
2360 	 */
2361 	if ((fn == ural_init_task) || (fn == ural_stop_task))
2362 		usb2_proc_mwait(&sc->sc_tq, t0, t1);
2363 }
2364 
2365