if_rum.c revision 185950
1/*-
2 * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
3 * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
4 * Copyright (c) 2007-2008 Hans Petter Selasky <hselasky@freebsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19/*
20 * NOTE: all function names beginning like "rum_cfg_" can only
21 * be called from within the config thread function !
22 */
23
24#include <sys/cdefs.h>
25__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_rum2.c 185950 2008-12-11 23:17:48Z thompsa $");
26
27/*-
28 * Ralink Technology RT2501USB/RT2601USB chipset driver
29 * http://www.ralinktech.com.tw/
30 */
31
32#include <dev/usb2/include/usb2_devid.h>
33#include <dev/usb2/include/usb2_standard.h>
34#include <dev/usb2/include/usb2_mfunc.h>
35#include <dev/usb2/include/usb2_error.h>
36
37#define	usb2_config_td_cc rum_config_copy
38#define	usb2_config_td_softc rum_softc
39
40#define	USB_DEBUG_VAR rum_debug
41
42#include <dev/usb2/core/usb2_core.h>
43#include <dev/usb2/core/usb2_lookup.h>
44#include <dev/usb2/core/usb2_process.h>
45#include <dev/usb2/core/usb2_config_td.h>
46#include <dev/usb2/core/usb2_debug.h>
47#include <dev/usb2/core/usb2_request.h>
48#include <dev/usb2/core/usb2_busdma.h>
49#include <dev/usb2/core/usb2_util.h>
50
51#include <dev/usb2/wlan/usb2_wlan.h>
52#include <dev/usb2/wlan/if_rum2_reg.h>
53#include <dev/usb2/wlan/if_rum2_var.h>
54#include <dev/usb2/wlan/if_rum2_fw.h>
55
56#if USB_DEBUG
57static int rum_debug = 0;
58
59SYSCTL_NODE(_hw_usb2, OID_AUTO, rum, CTLFLAG_RW, 0, "USB rum");
60SYSCTL_INT(_hw_usb2_rum, OID_AUTO, debug, CTLFLAG_RW, &rum_debug, 0,
61    "Debug level");
62#endif
63
64/* prototypes */
65
66static device_probe_t rum_probe;
67static device_attach_t rum_attach;
68static device_detach_t rum_detach;
69
70static usb2_callback_t rum_bulk_read_callback;
71static usb2_callback_t rum_bulk_read_clear_stall_callback;
72static usb2_callback_t rum_bulk_write_callback;
73static usb2_callback_t rum_bulk_write_clear_stall_callback;
74
75static usb2_config_td_command_t rum_cfg_first_time_setup;
76static usb2_config_td_command_t rum_config_copy;
77static usb2_config_td_command_t rum_cfg_scan_start;
78static usb2_config_td_command_t rum_cfg_scan_end;
79static usb2_config_td_command_t rum_cfg_select_band;
80static usb2_config_td_command_t rum_cfg_set_chan;
81static usb2_config_td_command_t rum_cfg_enable_tsf_sync;
82static usb2_config_td_command_t rum_cfg_enable_mrr;
83static usb2_config_td_command_t rum_cfg_update_slot;
84static usb2_config_td_command_t rum_cfg_select_antenna;
85static usb2_config_td_command_t rum_cfg_set_txpreamble;
86static usb2_config_td_command_t rum_cfg_update_promisc;
87static usb2_config_td_command_t rum_cfg_pre_init;
88static usb2_config_td_command_t rum_cfg_init;
89static usb2_config_td_command_t rum_cfg_pre_stop;
90static usb2_config_td_command_t rum_cfg_stop;
91static usb2_config_td_command_t rum_cfg_amrr_timeout;
92static usb2_config_td_command_t rum_cfg_prepare_beacon;
93static usb2_config_td_command_t rum_cfg_newstate;
94
95static const char *rum_get_rf(uint32_t);
96static int	rum_ioctl_cb(struct ifnet *, u_long, caddr_t);
97static void	rum_std_command(struct ieee80211com *, usb2_config_td_command_t *);
98static void	rum_scan_start_cb(struct ieee80211com *);
99static void	rum_scan_end_cb(struct ieee80211com *);
100static void	rum_set_channel_cb(struct ieee80211com *);
101static uint16_t	rum_cfg_eeprom_read_2(struct rum_softc *, uint16_t);
102static uint32_t	rum_cfg_bbp_disbusy(struct rum_softc *);
103static uint32_t	rum_cfg_read(struct rum_softc *, uint16_t);
104static uint8_t	rum_cfg_bbp_init(struct rum_softc *);
105static uint8_t	rum_cfg_bbp_read(struct rum_softc *, uint8_t);
106static void	rum_cfg_amrr_start(struct rum_softc *);
107static void	rum_cfg_bbp_write(struct rum_softc *, uint8_t, uint8_t);
108static void	rum_cfg_do_request(struct rum_softc *,
109		    struct usb2_device_request *, void *);
110static void	rum_cfg_eeprom_read(struct rum_softc *, uint16_t, void *,
111		    uint16_t);
112static void	rum_cfg_load_microcode(struct rum_softc *, const uint8_t *,
113		    uint16_t);
114static void	rum_cfg_read_eeprom(struct rum_softc *);
115static void	rum_cfg_read_multi(struct rum_softc *, uint16_t, void *,
116		    uint16_t);
117static void	rum_cfg_rf_write(struct rum_softc *, uint8_t, uint32_t);
118static void	rum_cfg_set_bssid(struct rum_softc *, uint8_t *);
119static void	rum_cfg_set_macaddr(struct rum_softc *, uint8_t *);
120static void	rum_cfg_write(struct rum_softc *, uint16_t, uint32_t);
121static void	rum_cfg_write_multi(struct rum_softc *, uint16_t, void *,
122		    uint16_t);
123static void	rum_end_of_commands(struct rum_softc *);
124static void	rum_init_cb(void *);
125static void	rum_start_cb(struct ifnet *);
126static void	rum_watchdog(void *);
127static uint8_t	rum_get_rssi(struct rum_softc *, uint8_t);
128static struct ieee80211vap *rum_vap_create(struct ieee80211com *,
129		    const char[], int, int, int, const uint8_t[],
130		    const uint8_t[]);
131static void	rum_vap_delete(struct ieee80211vap *);
132static struct ieee80211_node *rum_node_alloc(struct ieee80211vap *,
133		    const uint8_t[]);
134static void	rum_newassoc(struct ieee80211_node *, int);
135static void	rum_cfg_disable_tsf_sync(struct rum_softc *);
136static void	rum_cfg_set_run(struct rum_softc *, struct rum_config_copy *);
137static void	rum_fill_write_queue(struct rum_softc *);
138static void	rum_tx_clean_queue(struct rum_softc *);
139static void	rum_tx_freem(struct mbuf *);
140static void	rum_tx_mgt(struct rum_softc *, struct mbuf *,
141		    struct ieee80211_node *);
142static struct ieee80211vap *rum_get_vap(struct rum_softc *);
143static void	rum_tx_data(struct rum_softc *, struct mbuf *,
144		    struct ieee80211_node *);
145static void	rum_tx_prot(struct rum_softc *, const struct mbuf *,
146		    struct ieee80211_node *, uint8_t, uint16_t);
147static void	rum_tx_raw(struct rum_softc *, struct mbuf *,
148		    struct ieee80211_node *,
149		    const struct ieee80211_bpf_params *);
150static int	rum_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
151		    const struct ieee80211_bpf_params *);
152static void	rum_setup_desc_and_tx(struct rum_softc *, struct mbuf *,
153		    uint32_t, uint16_t, uint16_t);
154static int	rum_newstate_cb(struct ieee80211vap *,
155		    enum ieee80211_state nstate, int arg);
156static void	rum_update_mcast_cb(struct ifnet *);
157static void	rum_update_promisc_cb(struct ifnet *);
158
159/* various supported device vendors/products */
160static const struct usb2_device_id rum_devs[] = {
161	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_HWU54DM, 0)},
162	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_RT2573_2, 0)},
163	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_RT2573_3, 0)},
164	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_RT2573_4, 0)},
165	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_WUG2700, 0)},
166	{USB_VPI(USB_VENDOR_AMIT, USB_PRODUCT_AMIT_CGWLUSB2GO, 0)},
167	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_RT2573_1, 0)},
168	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_RT2573_2, 0)},
169	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050A, 0)},
170	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D9050V3, 0)},
171	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GC, 0)},
172	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GR, 0)},
173	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU2, 0)},
174	{USB_VPI(USB_VENDOR_COREGA, USB_PRODUCT_COREGA_CGWLUSB2GL, 0)},
175	{USB_VPI(USB_VENDOR_COREGA, USB_PRODUCT_COREGA_CGWLUSB2GPX, 0)},
176	{USB_VPI(USB_VENDOR_DICKSMITH, USB_PRODUCT_DICKSMITH_CWD854F, 0)},
177	{USB_VPI(USB_VENDOR_DICKSMITH, USB_PRODUCT_DICKSMITH_RT2573, 0)},
178	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_DWLG122C1, 0)},
179	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_WUA1340, 0)},
180	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_DWA111, 0)},
181	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_DWA110, 0)},
182	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWB01GS, 0)},
183	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWI05GS, 0)},
184	{USB_VPI(USB_VENDOR_GIGASET, USB_PRODUCT_GIGASET_RT2573, 0)},
185	{USB_VPI(USB_VENDOR_GOODWAY, USB_PRODUCT_GOODWAY_RT2573, 0)},
186	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254LB, 0)},
187	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP, 0)},
188	{USB_VPI(USB_VENDOR_HUAWEI3COM, USB_PRODUCT_HUAWEI3COM_WUB320G, 0)},
189	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_G54HP, 0)},
190	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_SG54HP, 0)},
191	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_1, 0)},
192	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_2, 0)},
193	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_3, 0)},
194	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_4, 0)},
195	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_RT2573, 0)},
196	{USB_VPI(USB_VENDOR_PLANEX2, USB_PRODUCT_PLANEX2_GWUS54HP, 0)},
197	{USB_VPI(USB_VENDOR_PLANEX2, USB_PRODUCT_PLANEX2_GWUS54MINI2, 0)},
198	{USB_VPI(USB_VENDOR_PLANEX2, USB_PRODUCT_PLANEX2_GWUSMM, 0)},
199	{USB_VPI(USB_VENDOR_QCOM, USB_PRODUCT_QCOM_RT2573, 0)},
200	{USB_VPI(USB_VENDOR_QCOM, USB_PRODUCT_QCOM_RT2573_2, 0)},
201	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2573, 0)},
202	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2573_2, 0)},
203	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2671, 0)},
204	{USB_VPI(USB_VENDOR_SITECOMEU, USB_PRODUCT_SITECOMEU_WL113R2, 0)},
205	{USB_VPI(USB_VENDOR_SITECOMEU, USB_PRODUCT_SITECOMEU_WL172, 0)},
206	{USB_VPI(USB_VENDOR_SPARKLAN, USB_PRODUCT_SPARKLAN_RT2573, 0)},
207	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2573, 0)},
208};
209
210struct rum_def_mac {
211	uint32_t reg;
212	uint32_t val;
213};
214
215static const struct rum_def_mac rum_def_mac[] = {
216	{RT2573_TXRX_CSR0, 0x025fb032},
217	{RT2573_TXRX_CSR1, 0x9eaa9eaf},
218	{RT2573_TXRX_CSR2, 0x8a8b8c8d},
219	{RT2573_TXRX_CSR3, 0x00858687},
220	{RT2573_TXRX_CSR7, 0x2e31353b},
221	{RT2573_TXRX_CSR8, 0x2a2a2a2c},
222	{RT2573_TXRX_CSR15, 0x0000000f},
223	{RT2573_MAC_CSR6, 0x00000fff},
224	{RT2573_MAC_CSR8, 0x016c030a},
225	{RT2573_MAC_CSR10, 0x00000718},
226	{RT2573_MAC_CSR12, 0x00000004},
227	{RT2573_MAC_CSR13, 0x00007f00},
228	{RT2573_SEC_CSR0, 0x00000000},
229	{RT2573_SEC_CSR1, 0x00000000},
230	{RT2573_SEC_CSR5, 0x00000000},
231	{RT2573_PHY_CSR1, 0x000023b0},
232	{RT2573_PHY_CSR5, 0x00040a06},
233	{RT2573_PHY_CSR6, 0x00080606},
234	{RT2573_PHY_CSR7, 0x00000408},
235	{RT2573_AIFSN_CSR, 0x00002273},
236	{RT2573_CWMIN_CSR, 0x00002344},
237	{RT2573_CWMAX_CSR, 0x000034aa}
238};
239
240struct rum_def_bbp {
241	uint8_t	reg;
242	uint8_t	val;
243};
244
245static const struct rum_def_bbp rum_def_bbp[] = {
246	{3, 0x80},
247	{15, 0x30},
248	{17, 0x20},
249	{21, 0xc8},
250	{22, 0x38},
251	{23, 0x06},
252	{24, 0xfe},
253	{25, 0x0a},
254	{26, 0x0d},
255	{32, 0x0b},
256	{34, 0x12},
257	{37, 0x07},
258	{39, 0xf8},
259	{41, 0x60},
260	{53, 0x10},
261	{54, 0x18},
262	{60, 0x10},
263	{61, 0x04},
264	{62, 0x04},
265	{75, 0xfe},
266	{86, 0xfe},
267	{88, 0xfe},
268	{90, 0x0f},
269	{99, 0x00},
270	{102, 0x16},
271	{107, 0x04}
272};
273
274struct rfprog {
275	uint8_t	chan;
276	uint32_t r1, r2, r3, r4;
277};
278
279static const struct rfprog rum_rf5226[] = {
280	{1, 0x00b03, 0x001e1, 0x1a014, 0x30282},
281	{2, 0x00b03, 0x001e1, 0x1a014, 0x30287},
282	{3, 0x00b03, 0x001e2, 0x1a014, 0x30282},
283	{4, 0x00b03, 0x001e2, 0x1a014, 0x30287},
284	{5, 0x00b03, 0x001e3, 0x1a014, 0x30282},
285	{6, 0x00b03, 0x001e3, 0x1a014, 0x30287},
286	{7, 0x00b03, 0x001e4, 0x1a014, 0x30282},
287	{8, 0x00b03, 0x001e4, 0x1a014, 0x30287},
288	{9, 0x00b03, 0x001e5, 0x1a014, 0x30282},
289	{10, 0x00b03, 0x001e5, 0x1a014, 0x30287},
290	{11, 0x00b03, 0x001e6, 0x1a014, 0x30282},
291	{12, 0x00b03, 0x001e6, 0x1a014, 0x30287},
292	{13, 0x00b03, 0x001e7, 0x1a014, 0x30282},
293	{14, 0x00b03, 0x001e8, 0x1a014, 0x30284},
294
295	{34, 0x00b03, 0x20266, 0x36014, 0x30282},
296	{38, 0x00b03, 0x20267, 0x36014, 0x30284},
297	{42, 0x00b03, 0x20268, 0x36014, 0x30286},
298	{46, 0x00b03, 0x20269, 0x36014, 0x30288},
299
300	{36, 0x00b03, 0x00266, 0x26014, 0x30288},
301	{40, 0x00b03, 0x00268, 0x26014, 0x30280},
302	{44, 0x00b03, 0x00269, 0x26014, 0x30282},
303	{48, 0x00b03, 0x0026a, 0x26014, 0x30284},
304	{52, 0x00b03, 0x0026b, 0x26014, 0x30286},
305	{56, 0x00b03, 0x0026c, 0x26014, 0x30288},
306	{60, 0x00b03, 0x0026e, 0x26014, 0x30280},
307	{64, 0x00b03, 0x0026f, 0x26014, 0x30282},
308
309	{100, 0x00b03, 0x0028a, 0x2e014, 0x30280},
310	{104, 0x00b03, 0x0028b, 0x2e014, 0x30282},
311	{108, 0x00b03, 0x0028c, 0x2e014, 0x30284},
312	{112, 0x00b03, 0x0028d, 0x2e014, 0x30286},
313	{116, 0x00b03, 0x0028e, 0x2e014, 0x30288},
314	{120, 0x00b03, 0x002a0, 0x2e014, 0x30280},
315	{124, 0x00b03, 0x002a1, 0x2e014, 0x30282},
316	{128, 0x00b03, 0x002a2, 0x2e014, 0x30284},
317	{132, 0x00b03, 0x002a3, 0x2e014, 0x30286},
318	{136, 0x00b03, 0x002a4, 0x2e014, 0x30288},
319	{140, 0x00b03, 0x002a6, 0x2e014, 0x30280},
320
321	{149, 0x00b03, 0x002a8, 0x2e014, 0x30287},
322	{153, 0x00b03, 0x002a9, 0x2e014, 0x30289},
323	{157, 0x00b03, 0x002ab, 0x2e014, 0x30281},
324	{161, 0x00b03, 0x002ac, 0x2e014, 0x30283},
325	{165, 0x00b03, 0x002ad, 0x2e014, 0x30285}
326};
327
328static const struct rfprog rum_rf5225[] = {
329	{1, 0x00b33, 0x011e1, 0x1a014, 0x30282},
330	{2, 0x00b33, 0x011e1, 0x1a014, 0x30287},
331	{3, 0x00b33, 0x011e2, 0x1a014, 0x30282},
332	{4, 0x00b33, 0x011e2, 0x1a014, 0x30287},
333	{5, 0x00b33, 0x011e3, 0x1a014, 0x30282},
334	{6, 0x00b33, 0x011e3, 0x1a014, 0x30287},
335	{7, 0x00b33, 0x011e4, 0x1a014, 0x30282},
336	{8, 0x00b33, 0x011e4, 0x1a014, 0x30287},
337	{9, 0x00b33, 0x011e5, 0x1a014, 0x30282},
338	{10, 0x00b33, 0x011e5, 0x1a014, 0x30287},
339	{11, 0x00b33, 0x011e6, 0x1a014, 0x30282},
340	{12, 0x00b33, 0x011e6, 0x1a014, 0x30287},
341	{13, 0x00b33, 0x011e7, 0x1a014, 0x30282},
342	{14, 0x00b33, 0x011e8, 0x1a014, 0x30284},
343
344	{34, 0x00b33, 0x01266, 0x26014, 0x30282},
345	{38, 0x00b33, 0x01267, 0x26014, 0x30284},
346	{42, 0x00b33, 0x01268, 0x26014, 0x30286},
347	{46, 0x00b33, 0x01269, 0x26014, 0x30288},
348
349	{36, 0x00b33, 0x01266, 0x26014, 0x30288},
350	{40, 0x00b33, 0x01268, 0x26014, 0x30280},
351	{44, 0x00b33, 0x01269, 0x26014, 0x30282},
352	{48, 0x00b33, 0x0126a, 0x26014, 0x30284},
353	{52, 0x00b33, 0x0126b, 0x26014, 0x30286},
354	{56, 0x00b33, 0x0126c, 0x26014, 0x30288},
355	{60, 0x00b33, 0x0126e, 0x26014, 0x30280},
356	{64, 0x00b33, 0x0126f, 0x26014, 0x30282},
357
358	{100, 0x00b33, 0x0128a, 0x2e014, 0x30280},
359	{104, 0x00b33, 0x0128b, 0x2e014, 0x30282},
360	{108, 0x00b33, 0x0128c, 0x2e014, 0x30284},
361	{112, 0x00b33, 0x0128d, 0x2e014, 0x30286},
362	{116, 0x00b33, 0x0128e, 0x2e014, 0x30288},
363	{120, 0x00b33, 0x012a0, 0x2e014, 0x30280},
364	{124, 0x00b33, 0x012a1, 0x2e014, 0x30282},
365	{128, 0x00b33, 0x012a2, 0x2e014, 0x30284},
366	{132, 0x00b33, 0x012a3, 0x2e014, 0x30286},
367	{136, 0x00b33, 0x012a4, 0x2e014, 0x30288},
368	{140, 0x00b33, 0x012a6, 0x2e014, 0x30280},
369
370	{149, 0x00b33, 0x012a8, 0x2e014, 0x30287},
371	{153, 0x00b33, 0x012a9, 0x2e014, 0x30289},
372	{157, 0x00b33, 0x012ab, 0x2e014, 0x30281},
373	{161, 0x00b33, 0x012ac, 0x2e014, 0x30283},
374	{165, 0x00b33, 0x012ad, 0x2e014, 0x30285}
375};
376
377static const struct usb2_config rum_config[RUM_N_TRANSFER] = {
378	[0] = {
379		.type = UE_BULK,
380		.endpoint = UE_ADDR_ANY,
381		.direction = UE_DIR_OUT,
382		.mh.bufsize = (MCLBYTES + RT2573_TX_DESC_SIZE + 8),
383		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
384		.mh.callback = &rum_bulk_write_callback,
385		.mh.timeout = 5000,	/* ms */
386	},
387
388	[1] = {
389		.type = UE_BULK,
390		.endpoint = UE_ADDR_ANY,
391		.direction = UE_DIR_IN,
392		.mh.bufsize = (MCLBYTES + RT2573_RX_DESC_SIZE),
393		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
394		.mh.callback = &rum_bulk_read_callback,
395	},
396
397	[2] = {
398		.type = UE_CONTROL,
399		.endpoint = 0x00,	/* Control pipe */
400		.direction = UE_DIR_ANY,
401		.mh.bufsize = sizeof(struct usb2_device_request),
402		.mh.callback = &rum_bulk_write_clear_stall_callback,
403		.mh.timeout = 1000,	/* 1 second */
404		.mh.interval = 50,	/* 50ms */
405	},
406
407	[3] = {
408		.type = UE_CONTROL,
409		.endpoint = 0x00,	/* Control pipe */
410		.direction = UE_DIR_ANY,
411		.mh.bufsize = sizeof(struct usb2_device_request),
412		.mh.callback = &rum_bulk_read_clear_stall_callback,
413		.mh.timeout = 1000,	/* 1 second */
414		.mh.interval = 50,	/* 50ms */
415	},
416};
417
418static devclass_t rum_devclass;
419
420static device_method_t rum_methods[] = {
421	DEVMETHOD(device_probe, rum_probe),
422	DEVMETHOD(device_attach, rum_attach),
423	DEVMETHOD(device_detach, rum_detach),
424	{0, 0}
425};
426
427static driver_t rum_driver = {
428	.name = "rum",
429	.methods = rum_methods,
430	.size = sizeof(struct rum_softc),
431};
432
433DRIVER_MODULE(rum, ushub, rum_driver, rum_devclass, NULL, 0);
434MODULE_DEPEND(rum, usb2_wlan, 1, 1, 1);
435MODULE_DEPEND(rum, usb2_core, 1, 1, 1);
436MODULE_DEPEND(rum, wlan, 1, 1, 1);
437MODULE_DEPEND(rum, wlan_amrr, 1, 1, 1);
438
439static int
440rum_probe(device_t dev)
441{
442	struct usb2_attach_arg *uaa = device_get_ivars(dev);
443
444	if (uaa->usb2_mode != USB_MODE_HOST) {
445		return (ENXIO);
446	}
447	if (uaa->info.bConfigIndex != 0) {
448		return (ENXIO);
449	}
450	if (uaa->info.bIfaceIndex != RT2573_IFACE_INDEX) {
451		return (ENXIO);
452	}
453	return (usb2_lookup_id_by_uaa(rum_devs, sizeof(rum_devs), uaa));
454}
455
456static int
457rum_attach(device_t dev)
458{
459	struct usb2_attach_arg *uaa = device_get_ivars(dev);
460	struct rum_softc *sc = device_get_softc(dev);
461	int error;
462	uint8_t iface_index;
463
464	if (sc == NULL) {
465		return (ENOMEM);
466	}
467	device_set_usb2_desc(dev);
468
469	mtx_init(&sc->sc_mtx, "rum lock", MTX_NETWORK_LOCK,
470	    MTX_DEF | MTX_RECURSE);
471
472	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
473	    device_get_nameunit(dev));
474
475	sc->sc_udev = uaa->device;
476	sc->sc_unit = device_get_unit(dev);
477
478	usb2_callout_init_mtx(&sc->sc_watchdog,
479	    &sc->sc_mtx, CALLOUT_RETURNUNLOCKED);
480
481	iface_index = RT2573_IFACE_INDEX;
482	error = usb2_transfer_setup(uaa->device, &iface_index,
483	    sc->sc_xfer, rum_config, RUM_N_TRANSFER, sc, &sc->sc_mtx);
484	if (error) {
485		device_printf(dev, "could not allocate USB transfers, "
486		    "err=%s\n", usb2_errstr(error));
487		goto detach;
488	}
489	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
490	    &rum_end_of_commands,
491	    sizeof(struct usb2_config_td_cc), 24);
492	if (error) {
493		device_printf(dev, "could not setup config "
494		    "thread!\n");
495		goto detach;
496	}
497	mtx_lock(&sc->sc_mtx);
498
499	/* start setup */
500
501	usb2_config_td_queue_command
502	    (&sc->sc_config_td, NULL, &rum_cfg_first_time_setup, 0, 0);
503
504	/* start watchdog (will exit mutex) */
505
506	rum_watchdog(sc);
507
508	return (0);			/* success */
509
510detach:
511	rum_detach(dev);
512	return (ENXIO);			/* failure */
513}
514
515static int
516rum_detach(device_t dev)
517{
518	struct rum_softc *sc = device_get_softc(dev);
519	struct ieee80211com *ic;
520	struct ifnet *ifp;
521
522	usb2_config_td_drain(&sc->sc_config_td);
523
524	mtx_lock(&sc->sc_mtx);
525
526	usb2_callout_stop(&sc->sc_watchdog);
527
528	rum_cfg_pre_stop(sc, NULL, 0);
529
530	ifp = sc->sc_ifp;
531	ic = ifp->if_l2com;
532
533	mtx_unlock(&sc->sc_mtx);
534
535	/* stop all USB transfers first */
536	usb2_transfer_unsetup(sc->sc_xfer, RUM_N_TRANSFER);
537
538	/* get rid of any late children */
539	bus_generic_detach(dev);
540
541	if (ifp) {
542		bpfdetach(ifp);
543		ieee80211_ifdetach(ic);
544		if_free(ifp);
545	}
546	usb2_config_td_unsetup(&sc->sc_config_td);
547
548	usb2_callout_drain(&sc->sc_watchdog);
549
550	mtx_destroy(&sc->sc_mtx);
551
552	return (0);
553}
554
555static void
556rum_cfg_do_request(struct rum_softc *sc, struct usb2_device_request *req,
557    void *data)
558{
559	uint16_t length;
560	usb2_error_t err;
561
562repeat:
563
564	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
565		goto error;
566	}
567	err = usb2_do_request_flags
568	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
569
570	if (err) {
571
572		DPRINTF("device request failed, err=%s "
573		    "(ignored)\n", usb2_errstr(err));
574
575		/* wait a little before next try */
576		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
577			goto error;
578		}
579		/* try until we are detached */
580		goto repeat;
581
582error:
583		/* the device has been detached */
584		length = UGETW(req->wLength);
585
586		if ((req->bmRequestType & UT_READ) && length) {
587			bzero(data, length);
588		}
589	}
590}
591
592static void
593rum_cfg_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, uint16_t len)
594{
595	struct usb2_device_request req;
596
597	req.bmRequestType = UT_READ_VENDOR_DEVICE;
598	req.bRequest = RT2573_READ_EEPROM;
599	USETW(req.wValue, 0);
600	USETW(req.wIndex, addr);
601	USETW(req.wLength, len);
602
603	rum_cfg_do_request(sc, &req, buf);
604}
605
606static uint16_t
607rum_cfg_eeprom_read_2(struct rum_softc *sc, uint16_t addr)
608{
609	uint16_t tmp;
610
611	rum_cfg_eeprom_read(sc, addr, &tmp, sizeof(tmp));
612	return (le16toh(tmp));
613}
614
615static uint32_t
616rum_cfg_read(struct rum_softc *sc, uint16_t reg)
617{
618	uint32_t val;
619
620	rum_cfg_read_multi(sc, reg, &val, sizeof(val));
621	return (le32toh(val));
622}
623
624static void
625rum_cfg_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, uint16_t len)
626{
627	struct usb2_device_request req;
628
629	req.bmRequestType = UT_READ_VENDOR_DEVICE;
630	req.bRequest = RT2573_READ_MULTI_MAC;
631	USETW(req.wValue, 0);
632	USETW(req.wIndex, reg);
633	USETW(req.wLength, len);
634
635	rum_cfg_do_request(sc, &req, buf);
636}
637
638static void
639rum_cfg_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
640{
641	uint32_t tmp = htole32(val);
642
643	rum_cfg_write_multi(sc, reg, &tmp, sizeof(tmp));
644}
645
646static void
647rum_cfg_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, uint16_t len)
648{
649	struct usb2_device_request req;
650
651	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
652	req.bRequest = RT2573_WRITE_MULTI_MAC;
653	USETW(req.wValue, 0);
654	USETW(req.wIndex, reg);
655	USETW(req.wLength, len);
656
657	rum_cfg_do_request(sc, &req, buf);
658}
659
660static uint32_t
661rum_cfg_bbp_disbusy(struct rum_softc *sc)
662{
663	uint32_t tmp;
664	uint8_t to;
665
666	for (to = 0;; to++) {
667		if (to < 100) {
668			tmp = rum_cfg_read(sc, RT2573_PHY_CSR3);
669
670			if ((tmp & RT2573_BBP_BUSY) == 0) {
671				return (tmp);
672			}
673			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
674				break;
675			}
676		} else {
677			break;
678		}
679	}
680	DPRINTF("could not disbusy BBP\n");
681	return (RT2573_BBP_BUSY);	/* failure */
682}
683
684static void
685rum_cfg_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
686{
687	uint32_t tmp;
688
689	if (rum_cfg_bbp_disbusy(sc) & RT2573_BBP_BUSY) {
690		return;
691	}
692	tmp = RT2573_BBP_BUSY | ((reg & 0x7f) << 8) | val;
693	rum_cfg_write(sc, RT2573_PHY_CSR3, tmp);
694}
695
696static uint8_t
697rum_cfg_bbp_read(struct rum_softc *sc, uint8_t reg)
698{
699	uint32_t val;
700
701	if (rum_cfg_bbp_disbusy(sc) & RT2573_BBP_BUSY) {
702		return (0);
703	}
704	val = RT2573_BBP_BUSY | RT2573_BBP_READ | (reg << 8);
705	rum_cfg_write(sc, RT2573_PHY_CSR3, val);
706
707	val = rum_cfg_bbp_disbusy(sc);
708	return (val & 0xff);
709}
710
711static void
712rum_cfg_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
713{
714	uint32_t tmp;
715	uint8_t to;
716
717	reg &= 3;
718
719	for (to = 0;; to++) {
720		if (to < 100) {
721			tmp = rum_cfg_read(sc, RT2573_PHY_CSR4);
722			if (!(tmp & RT2573_RF_BUSY)) {
723				break;
724			}
725			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
726				return;
727			}
728		} else {
729			DPRINTF("could not write to RF\n");
730			return;
731		}
732	}
733
734	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | ((val & 0xfffff) << 2) | reg;
735	rum_cfg_write(sc, RT2573_PHY_CSR4, tmp);
736
737	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
738}
739
740static void
741rum_cfg_first_time_setup(struct rum_softc *sc,
742    struct usb2_config_td_cc *cc, uint16_t refcount)
743{
744	struct ieee80211com *ic;
745	struct ifnet *ifp;
746	uint32_t tmp;
747	uint16_t i;
748	uint8_t bands;
749
750	/* setup RX tap header */
751	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
752	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
753	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
754
755	/* setup TX tap header */
756	sc->sc_txtap_len = sizeof(sc->sc_txtap);
757	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
758	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
759
760	/* retrieve RT2573 rev. no */
761	for (i = 0; i < 100; i++) {
762
763		tmp = rum_cfg_read(sc, RT2573_MAC_CSR0);
764		if (tmp != 0) {
765			break;
766		}
767		/* wait a little */
768		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
769			/* device detached */
770			goto done;
771		}
772	}
773
774	if (tmp == 0) {
775		DPRINTF("chip is maybe not ready\n");
776	}
777	/* retrieve MAC address and various other things from EEPROM */
778	rum_cfg_read_eeprom(sc);
779
780	printf("%s: MAC/BBP RT2573 (rev 0x%05x), RF %s\n",
781	    sc->sc_name, tmp, rum_get_rf(sc->sc_rf_rev));
782
783	rum_cfg_load_microcode(sc, rt2573_ucode, sizeof(rt2573_ucode));
784
785	mtx_unlock(&sc->sc_mtx);
786
787	ifp = if_alloc(IFT_IEEE80211);
788
789	mtx_lock(&sc->sc_mtx);
790
791	if (ifp == NULL) {
792		DPRINTFN(0, "could not if_alloc()!\n");
793		goto done;
794	}
795	sc->sc_evilhack = ifp;
796	sc->sc_ifp = ifp;
797	ic = ifp->if_l2com;
798
799	ifp->if_softc = sc;
800	if_initname(ifp, "rum", sc->sc_unit);
801	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
802	ifp->if_init = &rum_init_cb;
803	ifp->if_ioctl = &rum_ioctl_cb;
804	ifp->if_start = &rum_start_cb;
805	ifp->if_watchdog = NULL;
806	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
807	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
808	IFQ_SET_READY(&ifp->if_snd);
809
810	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
811
812	ic->ic_ifp = ifp;
813	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
814	ic->ic_opmode = IEEE80211_M_STA;
815
816	/* set device capabilities */
817	ic->ic_caps =
818	    IEEE80211_C_STA		/* station mode supported */
819	    | IEEE80211_C_IBSS		/* IBSS mode supported */
820	    | IEEE80211_C_MONITOR	/* monitor mode supported */
821	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
822	    | IEEE80211_C_TXPMGT	/* tx power management */
823	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
824	    | IEEE80211_C_SHSLOT	/* short slot time supported */
825	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
826	    | IEEE80211_C_WPA		/* 802.11i */
827	    ;
828
829	bands = 0;
830	setbit(&bands, IEEE80211_MODE_11B);
831	setbit(&bands, IEEE80211_MODE_11G);
832	ieee80211_init_channels(ic, NULL, &bands);
833
834	if ((sc->sc_rf_rev == RT2573_RF_5225) ||
835	    (sc->sc_rf_rev == RT2573_RF_5226)) {
836
837		struct ieee80211_channel *c;
838
839		/* set supported .11a channels */
840		for (i = 34; i <= 46; i += 4) {
841			c = ic->ic_channels + (ic->ic_nchans++);
842			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
843			c->ic_flags = IEEE80211_CHAN_A;
844			c->ic_ieee = i;
845		}
846		for (i = 36; i <= 64; i += 4) {
847			c = ic->ic_channels + (ic->ic_nchans++);
848			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
849			c->ic_flags = IEEE80211_CHAN_A;
850			c->ic_ieee = i;
851		}
852		for (i = 100; i <= 140; i += 4) {
853			c = ic->ic_channels + (ic->ic_nchans++);
854			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
855			c->ic_flags = IEEE80211_CHAN_A;
856			c->ic_ieee = i;
857		}
858		for (i = 149; i <= 165; i += 4) {
859			c = ic->ic_channels + (ic->ic_nchans++);
860			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
861			c->ic_flags = IEEE80211_CHAN_A;
862			c->ic_ieee = i;
863		}
864	}
865	mtx_unlock(&sc->sc_mtx);
866
867	ieee80211_ifattach(ic);
868
869	mtx_lock(&sc->sc_mtx);
870
871	ic->ic_newassoc = &rum_newassoc;
872	ic->ic_raw_xmit = &rum_raw_xmit_cb;
873	ic->ic_node_alloc = &rum_node_alloc;
874	ic->ic_update_mcast = &rum_update_mcast_cb;
875	ic->ic_update_promisc = &rum_update_promisc_cb;
876	ic->ic_scan_start = &rum_scan_start_cb;
877	ic->ic_scan_end = &rum_scan_end_cb;
878	ic->ic_set_channel = &rum_set_channel_cb;
879	ic->ic_vap_create = &rum_vap_create;
880	ic->ic_vap_delete = &rum_vap_delete;
881
882	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
883
884	mtx_unlock(&sc->sc_mtx);
885
886	bpfattach(ifp, DLT_IEEE802_11_RADIO,
887	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
888
889	if (bootverbose) {
890		ieee80211_announce(ic);
891	}
892	mtx_lock(&sc->sc_mtx);
893done:
894	return;
895}
896
897static void
898rum_end_of_commands(struct rum_softc *sc)
899{
900	sc->sc_flags &= ~RUM_FLAG_WAIT_COMMAND;
901
902	/* start write transfer, if not started */
903	usb2_transfer_start(sc->sc_xfer[0]);
904}
905
906static void
907rum_config_copy_chan(struct rum_config_copy_chan *cc,
908    struct ieee80211com *ic, struct ieee80211_channel *c)
909{
910	if (!c)
911		return;
912	cc->chan_to_ieee =
913	    ieee80211_chan2ieee(ic, c);
914	if (c != IEEE80211_CHAN_ANYC) {
915		cc->chan_to_mode =
916		    ieee80211_chan2mode(c);
917		if (IEEE80211_IS_CHAN_B(c))
918			cc->chan_is_b = 1;
919		if (IEEE80211_IS_CHAN_A(c))
920			cc->chan_is_a = 1;
921		if (IEEE80211_IS_CHAN_2GHZ(c))
922			cc->chan_is_2ghz = 1;
923		if (IEEE80211_IS_CHAN_5GHZ(c))
924			cc->chan_is_5ghz = 1;
925		if (IEEE80211_IS_CHAN_ANYG(c))
926			cc->chan_is_g = 1;
927	}
928}
929
930static void
931rum_config_copy(struct rum_softc *sc,
932    struct usb2_config_td_cc *cc, uint16_t refcount)
933{
934	struct ifnet *ifp;
935	struct ieee80211com *ic;
936	struct ieee80211_node *ni;
937	struct ieee80211vap *vap;
938	const struct ieee80211_txparam *tp;
939
940	bzero(cc, sizeof(*cc));
941
942	ifp = sc->sc_ifp;
943	if (ifp) {
944		cc->if_flags = ifp->if_flags;
945		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
946		    sizeof(cc->if_broadcastaddr));
947
948		ic = ifp->if_l2com;
949		if (ic) {
950			rum_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
951			rum_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
952			vap = TAILQ_FIRST(&ic->ic_vaps);
953			if (vap) {
954				ni = vap->iv_bss;
955				if (ni) {
956					cc->iv_bss.ni_intval = ni->ni_intval;
957					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
958					    sizeof(cc->iv_bss.ni_bssid));
959				}
960				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
961				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
962					cc->iv_bss.fixed_rate_none = 1;
963				}
964			}
965			cc->ic_opmode = ic->ic_opmode;
966			cc->ic_flags = ic->ic_flags;
967			cc->ic_txpowlimit = ic->ic_txpowlimit;
968			cc->ic_curmode = ic->ic_curmode;
969
970			bcopy(ic->ic_myaddr, cc->ic_myaddr,
971			    sizeof(cc->ic_myaddr));
972		}
973	}
974	sc->sc_flags |= RUM_FLAG_WAIT_COMMAND;
975}
976
977static const char *
978rum_get_rf(uint32_t rev)
979{
980	;				/* indent fix */
981	switch (rev) {
982	case RT2573_RF_2527:
983		return "RT2527 (MIMO XR)";
984	case RT2573_RF_2528:
985		return "RT2528";
986	case RT2573_RF_5225:
987		return "RT5225 (MIMO XR)";
988	case RT2573_RF_5226:
989		return "RT5226";
990	default:
991		return "unknown";
992	}
993}
994
995static void
996rum_bulk_read_callback(struct usb2_xfer *xfer)
997{
998	struct rum_softc *sc = xfer->priv_sc;
999	struct ifnet *ifp = sc->sc_ifp;
1000	struct ieee80211com *ic = ifp->if_l2com;
1001	struct ieee80211_node *ni;
1002
1003	struct mbuf *m = NULL;
1004	uint32_t flags;
1005	uint32_t max_len;
1006	uint8_t rssi = 0;
1007
1008	switch (USB_GET_STATE(xfer)) {
1009	case USB_ST_TRANSFERRED:
1010
1011		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
1012
1013		if (xfer->actlen < (RT2573_RX_DESC_SIZE + IEEE80211_MIN_LEN)) {
1014			DPRINTF("too short transfer, "
1015			    "%d bytes\n", xfer->actlen);
1016			ifp->if_ierrors++;
1017			goto tr_setup;
1018		}
1019		usb2_copy_out(xfer->frbuffers, 0,
1020		    &sc->sc_rx_desc, RT2573_RX_DESC_SIZE);
1021
1022		flags = le32toh(sc->sc_rx_desc.flags);
1023
1024		if (flags & RT2573_RX_CRC_ERROR) {
1025			/*
1026		         * This should not happen since we did not
1027		         * request to receive those frames when we
1028		         * filled RAL_TXRX_CSR2:
1029		         */
1030			DPRINTFN(6, "PHY or CRC error\n");
1031			ifp->if_ierrors++;
1032			goto tr_setup;
1033		}
1034		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1035
1036		if (m == NULL) {
1037			DPRINTF("could not allocate mbuf\n");
1038			ifp->if_ierrors++;
1039			goto tr_setup;
1040		}
1041		max_len = (xfer->actlen - RT2573_RX_DESC_SIZE);
1042
1043		usb2_copy_out(xfer->frbuffers, RT2573_RX_DESC_SIZE,
1044		    m->m_data, max_len);
1045
1046		/* finalize mbuf */
1047		m->m_pkthdr.rcvif = ifp;
1048		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
1049
1050		if (m->m_len > max_len) {
1051			DPRINTF("invalid length in RX "
1052			    "descriptor, %u bytes, received %u bytes\n",
1053			    m->m_len, max_len);
1054			ifp->if_ierrors++;
1055			m_freem(m);
1056			m = NULL;
1057			goto tr_setup;
1058		}
1059		rssi = rum_get_rssi(sc, sc->sc_rx_desc.rssi);
1060
1061		DPRINTF("real length=%d bytes, rssi=%d\n", m->m_len, rssi);
1062
1063		if (bpf_peers_present(ifp->if_bpf)) {
1064			struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
1065
1066			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1067			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1068			    (sc->sc_rx_desc.flags & htole32(RT2573_RX_OFDM)) ?
1069			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1070			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1071			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1072			tap->wr_antenna = sc->sc_rx_ant;
1073			tap->wr_antsignal = rssi;
1074
1075			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1076		}
1077	case USB_ST_SETUP:
1078tr_setup:
1079
1080		if (sc->sc_flags & RUM_FLAG_READ_STALL) {
1081			usb2_transfer_start(sc->sc_xfer[3]);
1082		} else {
1083			xfer->frlengths[0] = xfer->max_data_length;
1084			usb2_start_hardware(xfer);
1085		}
1086
1087		/*
1088		 * At the end of a USB callback it is always safe to unlock
1089		 * the private mutex of a device! That is why we do the
1090		 * "ieee80211_input" here, and not some lines up!
1091		 */
1092		if (m) {
1093			mtx_unlock(&sc->sc_mtx);
1094
1095			ni = ieee80211_find_rxnode(ic, mtod(m, struct ieee80211_frame_min *));
1096			if (ni != NULL) {
1097				if (ieee80211_input(ni, m, rssi, RT2573_NOISE_FLOOR, 0)) {
1098					/* ignore */
1099				}
1100				/* node is no longer needed */
1101				ieee80211_free_node(ni);
1102			} else {
1103				if (ieee80211_input_all(ic, m, rssi, RT2573_NOISE_FLOOR, 0)) {
1104					/* ignore */
1105				}
1106			}
1107
1108			mtx_lock(&sc->sc_mtx);
1109		}
1110		return;
1111
1112	default:			/* Error */
1113		if (xfer->error != USB_ERR_CANCELLED) {
1114			/* try to clear stall first */
1115			sc->sc_flags |= RUM_FLAG_READ_STALL;
1116			usb2_transfer_start(sc->sc_xfer[3]);
1117		}
1118		return;
1119
1120	}
1121}
1122
1123static void
1124rum_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1125{
1126	struct rum_softc *sc = xfer->priv_sc;
1127	struct usb2_xfer *xfer_other = sc->sc_xfer[1];
1128
1129	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1130		DPRINTF("stall cleared\n");
1131		sc->sc_flags &= ~RUM_FLAG_READ_STALL;
1132		usb2_transfer_start(xfer_other);
1133	}
1134}
1135
1136static uint8_t
1137rum_plcp_signal(uint16_t rate)
1138{
1139	;				/* indent fix */
1140	switch (rate) {
1141		/* CCK rates (NB: not IEEE std, device-specific) */
1142	case 2:
1143		return (0x0);
1144	case 4:
1145		return (0x1);
1146	case 11:
1147		return (0x2);
1148	case 22:
1149		return (0x3);
1150
1151		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1152	case 12:
1153		return (0xb);
1154	case 18:
1155		return (0xf);
1156	case 24:
1157		return (0xa);
1158	case 36:
1159		return (0xe);
1160	case 48:
1161		return (0x9);
1162	case 72:
1163		return (0xd);
1164	case 96:
1165		return (0x8);
1166	case 108:
1167		return (0xc);
1168
1169		/* XXX unsupported/unknown rate */
1170	default:
1171		return (0xff);
1172	}
1173}
1174
1175/*
1176 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1177 * should be freed, when "rum_setup_desc_and_tx" is called.
1178 */
1179
1180static void
1181rum_setup_desc_and_tx(struct rum_softc *sc, struct mbuf *m, uint32_t flags,
1182    uint16_t xflags, uint16_t rate)
1183{
1184	struct ifnet *ifp = sc->sc_ifp;
1185	struct ieee80211com *ic = ifp->if_l2com;
1186	struct mbuf *mm;
1187	enum ieee80211_phytype phytype;
1188	uint16_t plcp_length;
1189	uint16_t len;
1190	uint8_t remainder;
1191	uint8_t is_beacon;
1192
1193	if (xflags & RT2573_TX_BEACON) {
1194		xflags &= ~RT2573_TX_BEACON;
1195		is_beacon = 1;
1196	} else {
1197		is_beacon = 0;
1198	}
1199
1200	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1201		/* free packet */
1202		rum_tx_freem(m);
1203		ifp->if_oerrors++;
1204		return;
1205	}
1206	if (!((sc->sc_flags & RUM_FLAG_LL_READY) &&
1207	    (sc->sc_flags & RUM_FLAG_HL_READY))) {
1208		/* free packet */
1209		rum_tx_freem(m);
1210		ifp->if_oerrors++;
1211		return;
1212	}
1213	if (rate < 2) {
1214		DPRINTF("rate < 2!\n");
1215
1216		/* avoid division by zero */
1217		rate = 2;
1218	}
1219	ic->ic_lastdata = ticks;
1220	if (bpf_peers_present(ifp->if_bpf)) {
1221		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1222
1223		tap->wt_flags = 0;
1224		tap->wt_rate = rate;
1225		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1226		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1227		tap->wt_antenna = sc->sc_tx_ant;
1228
1229		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1230	}
1231	len = m->m_pkthdr.len;
1232
1233	flags |= RT2573_TX_VALID;
1234	flags |= (len << 16);
1235
1236	sc->sc_tx_desc.flags = htole32(flags);
1237	sc->sc_tx_desc.xflags = htole16(xflags);
1238
1239	sc->sc_tx_desc.wme = htole16(RT2573_QID(0) | RT2573_AIFSN(2) |
1240	    RT2573_LOGCWMIN(4) | RT2573_LOGCWMAX(10));
1241
1242	/* setup PLCP fields */
1243	sc->sc_tx_desc.plcp_signal = rum_plcp_signal(rate);
1244	sc->sc_tx_desc.plcp_service = 4;
1245
1246	len += IEEE80211_CRC_LEN;
1247
1248	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1249
1250	if (phytype == IEEE80211_T_OFDM) {
1251		sc->sc_tx_desc.flags |= htole32(RT2573_TX_OFDM);
1252
1253		plcp_length = (len & 0xfff);
1254		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1255		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1256	} else {
1257		plcp_length = ((16 * len) + rate - 1) / rate;
1258		if (rate == 22) {
1259			remainder = (16 * len) % 22;
1260			if ((remainder != 0) && (remainder < 7)) {
1261				sc->sc_tx_desc.plcp_service |=
1262				    RT2573_PLCP_LENGEXT;
1263			}
1264		}
1265		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1266		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1267
1268		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1269			sc->sc_tx_desc.plcp_signal |= 0x08;
1270		}
1271	}
1272
1273	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1274		DPRINTF("No room for header structure!\n");
1275		rum_tx_freem(m);
1276		return;
1277	}
1278	mm = m_gethdr(M_NOWAIT, MT_DATA);
1279	if (mm == NULL) {
1280		DPRINTF("Could not allocate header mbuf!\n");
1281		rum_tx_freem(m);
1282		return;
1283	}
1284	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1285	mm->m_len = sizeof(sc->sc_tx_desc);
1286	mm->m_next = m;
1287	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1288	mm->m_pkthdr.rcvif = NULL;
1289
1290	if (is_beacon) {
1291
1292		if (mm->m_pkthdr.len > sizeof(sc->sc_beacon_buf)) {
1293			DPRINTFN(0, "Truncating beacon"
1294			    ", %u bytes!\n", mm->m_pkthdr.len);
1295			mm->m_pkthdr.len = sizeof(sc->sc_beacon_buf);
1296		}
1297		m_copydata(mm, 0, mm->m_pkthdr.len, sc->sc_beacon_buf);
1298
1299		/* copy the first 24 bytes of Tx descriptor into NIC memory */
1300		rum_cfg_write_multi(sc, RT2573_HW_BEACON_BASE0,
1301		    sc->sc_beacon_buf, mm->m_pkthdr.len);
1302		rum_tx_freem(mm);
1303		return;
1304	}
1305	/* start write transfer, if not started */
1306	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1307
1308	usb2_transfer_start(sc->sc_xfer[0]);
1309}
1310
1311static void
1312rum_bulk_write_callback(struct usb2_xfer *xfer)
1313{
1314	struct rum_softc *sc = xfer->priv_sc;
1315	struct ifnet *ifp = sc->sc_ifp;
1316	struct mbuf *m;
1317	uint16_t temp_len;
1318	uint8_t align;
1319
1320	switch (USB_GET_STATE(xfer)) {
1321	case USB_ST_TRANSFERRED:
1322		DPRINTFN(11, "transfer complete\n");
1323
1324		ifp->if_opackets++;
1325
1326	case USB_ST_SETUP:
1327		if (sc->sc_flags & RUM_FLAG_WRITE_STALL) {
1328			usb2_transfer_start(sc->sc_xfer[2]);
1329			break;
1330		}
1331		if (sc->sc_flags & RUM_FLAG_WAIT_COMMAND) {
1332			/*
1333			 * don't send anything while a command is pending !
1334			 */
1335			break;
1336		}
1337		rum_fill_write_queue(sc);
1338
1339		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1340
1341		if (m) {
1342
1343			if (m->m_pkthdr.len > (MCLBYTES + RT2573_TX_DESC_SIZE)) {
1344				DPRINTFN(0, "data overflow, %u bytes\n",
1345				    m->m_pkthdr.len);
1346				m->m_pkthdr.len = (MCLBYTES + RT2573_TX_DESC_SIZE);
1347			}
1348			usb2_m_copy_in(xfer->frbuffers, 0,
1349			    m, 0, m->m_pkthdr.len);
1350
1351			/* compute transfer length */
1352			temp_len = m->m_pkthdr.len;
1353
1354			/* make transfer length 32-bit aligned */
1355			align = (-(temp_len)) & 3;
1356
1357			/* check if we need to add four extra bytes */
1358			if (((temp_len + align) % 64) == 0) {
1359				align += 4;
1360			}
1361			/* check if we need to align length */
1362			if (align != 0) {
1363				/* zero the extra bytes */
1364				usb2_bzero(xfer->frbuffers, temp_len, align);
1365				temp_len += align;
1366			}
1367			DPRINTFN(11, "sending frame len=%u ferlen=%u\n",
1368			    m->m_pkthdr.len, temp_len);
1369
1370			xfer->frlengths[0] = temp_len;
1371			usb2_start_hardware(xfer);
1372
1373			/* free mbuf and node */
1374			rum_tx_freem(m);
1375
1376		}
1377		break;
1378
1379	default:			/* Error */
1380		DPRINTFN(11, "transfer error, %s\n",
1381		    usb2_errstr(xfer->error));
1382
1383		if (xfer->error != USB_ERR_CANCELLED) {
1384			/* try to clear stall first */
1385			sc->sc_flags |= RUM_FLAG_WRITE_STALL;
1386			usb2_transfer_start(sc->sc_xfer[2]);
1387		}
1388		ifp->if_oerrors++;
1389		break;
1390	}
1391}
1392
1393static void
1394rum_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1395{
1396	struct rum_softc *sc = xfer->priv_sc;
1397	struct usb2_xfer *xfer_other = sc->sc_xfer[0];
1398
1399	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1400		DPRINTF("stall cleared\n");
1401		sc->sc_flags &= ~RUM_FLAG_WRITE_STALL;
1402		usb2_transfer_start(xfer_other);
1403	}
1404}
1405
1406static void
1407rum_watchdog(void *arg)
1408{
1409	struct rum_softc *sc = arg;
1410
1411	mtx_assert(&sc->sc_mtx, MA_OWNED);
1412
1413	if (sc->sc_amrr_timer) {
1414		usb2_config_td_queue_command
1415		    (&sc->sc_config_td, NULL,
1416		    &rum_cfg_amrr_timeout, 0, 0);
1417	}
1418	usb2_callout_reset(&sc->sc_watchdog,
1419	    hz, &rum_watchdog, sc);
1420
1421	mtx_unlock(&sc->sc_mtx);
1422}
1423
1424static void
1425rum_init_cb(void *arg)
1426{
1427	struct rum_softc *sc = arg;
1428
1429	mtx_lock(&sc->sc_mtx);
1430	usb2_config_td_queue_command
1431	    (&sc->sc_config_td, &rum_cfg_pre_init,
1432	    &rum_cfg_init, 0, 0);
1433	mtx_unlock(&sc->sc_mtx);
1434}
1435
1436static int
1437rum_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1438{
1439	struct rum_softc *sc = ifp->if_softc;
1440	struct ieee80211com *ic = ifp->if_l2com;
1441	int error;
1442
1443	switch (cmd) {
1444	case SIOCSIFFLAGS:
1445		mtx_lock(&sc->sc_mtx);
1446		if (ifp->if_flags & IFF_UP) {
1447			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1448				usb2_config_td_queue_command
1449				    (&sc->sc_config_td, &rum_cfg_pre_init,
1450				    &rum_cfg_init, 0, 0);
1451			}
1452		} else {
1453			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1454				usb2_config_td_queue_command
1455				    (&sc->sc_config_td, &rum_cfg_pre_stop,
1456				    &rum_cfg_stop, 0, 0);
1457			}
1458		}
1459		mtx_unlock(&sc->sc_mtx);
1460		error = 0;
1461		break;
1462
1463	case SIOCGIFMEDIA:
1464	case SIOCSIFMEDIA:
1465		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1466		break;
1467
1468	default:
1469		error = ether_ioctl(ifp, cmd, data);
1470	}
1471	return (error);
1472}
1473
1474static void
1475rum_start_cb(struct ifnet *ifp)
1476{
1477	struct rum_softc *sc = ifp->if_softc;
1478
1479	mtx_lock(&sc->sc_mtx);
1480	/* start write transfer, if not started */
1481	usb2_transfer_start(sc->sc_xfer[0]);
1482	mtx_unlock(&sc->sc_mtx);
1483}
1484
1485static void
1486rum_cfg_newstate(struct rum_softc *sc,
1487    struct usb2_config_td_cc *cc, uint16_t refcount)
1488{
1489	struct ifnet *ifp = sc->sc_ifp;
1490	struct ieee80211com *ic = ifp->if_l2com;
1491	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1492	struct rum_vap *uvp = RUM_VAP(vap);
1493	enum ieee80211_state ostate;
1494	enum ieee80211_state nstate;
1495	int arg;
1496
1497	ostate = vap->iv_state;
1498	nstate = sc->sc_ns_state;
1499	arg = sc->sc_ns_arg;
1500
1501	if (ostate == IEEE80211_S_INIT) {
1502		/* We are leaving INIT. TSF sync should be off. */
1503		rum_cfg_disable_tsf_sync(sc);
1504	}
1505	switch (nstate) {
1506	case IEEE80211_S_INIT:
1507		break;
1508
1509	case IEEE80211_S_RUN:
1510		rum_cfg_set_run(sc, cc);
1511		break;
1512
1513	default:
1514		break;
1515	}
1516
1517	mtx_unlock(&sc->sc_mtx);
1518	IEEE80211_LOCK(ic);
1519	uvp->newstate(vap, nstate, arg);
1520	if (vap->iv_newstate_cb != NULL)
1521		vap->iv_newstate_cb(vap, nstate, arg);
1522	IEEE80211_UNLOCK(ic);
1523	mtx_lock(&sc->sc_mtx);
1524}
1525
1526static int
1527rum_newstate_cb(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1528{
1529	struct rum_vap *uvp = RUM_VAP(vap);
1530	struct ieee80211com *ic = vap->iv_ic;
1531	struct rum_softc *sc = ic->ic_ifp->if_softc;
1532
1533	DPRINTF("setting new state: %d\n", nstate);
1534
1535	/* Special case - cannot defer this call and cannot block ! */
1536	if (nstate == IEEE80211_S_INIT) {
1537		/* stop timers */
1538		mtx_lock(&sc->sc_mtx);
1539		sc->sc_amrr_timer = 0;
1540		mtx_unlock(&sc->sc_mtx);
1541		return (uvp->newstate(vap, nstate, arg));
1542	}
1543	mtx_lock(&sc->sc_mtx);
1544	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1545		mtx_unlock(&sc->sc_mtx);
1546		return (0);		/* nothing to do */
1547	}
1548	/* store next state */
1549	sc->sc_ns_state = nstate;
1550	sc->sc_ns_arg = arg;
1551
1552	/* stop timers */
1553	sc->sc_amrr_timer = 0;
1554
1555	/*
1556	 * USB configuration can only be done from the USB configuration
1557	 * thread:
1558	 */
1559	usb2_config_td_queue_command
1560	    (&sc->sc_config_td, &rum_config_copy,
1561	    &rum_cfg_newstate, 0, 0);
1562
1563	mtx_unlock(&sc->sc_mtx);
1564
1565	return (EINPROGRESS);
1566}
1567
1568static void
1569rum_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1570{
1571	struct rum_softc *sc = ic->ic_ifp->if_softc;
1572
1573	mtx_lock(&sc->sc_mtx);
1574
1575	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1576
1577	usb2_config_td_queue_command
1578	    (&sc->sc_config_td, &rum_config_copy, func, 0, 0);
1579
1580	mtx_unlock(&sc->sc_mtx);
1581}
1582
1583static void
1584rum_scan_start_cb(struct ieee80211com *ic)
1585{
1586	rum_std_command(ic, &rum_cfg_scan_start);
1587}
1588
1589static void
1590rum_scan_end_cb(struct ieee80211com *ic)
1591{
1592	rum_std_command(ic, &rum_cfg_scan_end);
1593}
1594
1595static void
1596rum_set_channel_cb(struct ieee80211com *ic)
1597{
1598	rum_std_command(ic, &rum_cfg_set_chan);
1599}
1600
1601static void
1602rum_cfg_scan_start(struct rum_softc *sc,
1603    struct usb2_config_td_cc *cc, uint16_t refcount)
1604{
1605	/* abort TSF synchronization */
1606	rum_cfg_disable_tsf_sync(sc);
1607	rum_cfg_set_bssid(sc, cc->if_broadcastaddr);
1608}
1609
1610static void
1611rum_cfg_scan_end(struct rum_softc *sc,
1612    struct usb2_config_td_cc *cc, uint16_t refcount)
1613{
1614	/* enable TSF synchronization */
1615	rum_cfg_enable_tsf_sync(sc, cc, 0);
1616	rum_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1617}
1618
1619/*
1620 * Reprogram MAC/BBP to switch to a new band. Values taken from the reference
1621 * driver.
1622 */
1623static void
1624rum_cfg_select_band(struct rum_softc *sc,
1625    struct usb2_config_td_cc *cc, uint16_t refcount)
1626{
1627	uint32_t tmp;
1628	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1629
1630	/* update all BBP registers that depend on the band */
1631	bbp17 = 0x20;
1632	bbp96 = 0x48;
1633	bbp104 = 0x2c;
1634	bbp35 = 0x50;
1635	bbp97 = 0x48;
1636	bbp98 = 0x48;
1637
1638	if (cc->ic_curchan.chan_is_5ghz) {
1639		bbp17 += 0x08;
1640		bbp96 += 0x10;
1641		bbp104 += 0x0c;
1642		bbp35 += 0x10;
1643		bbp97 += 0x10;
1644		bbp98 += 0x10;
1645	}
1646	if ((cc->ic_curchan.chan_is_2ghz && sc->sc_ext_2ghz_lna) ||
1647	    (cc->ic_curchan.chan_is_5ghz && sc->sc_ext_5ghz_lna)) {
1648		bbp17 += 0x10;
1649		bbp96 += 0x10;
1650		bbp104 += 0x10;
1651	}
1652	sc->sc_bbp17 = bbp17;
1653	rum_cfg_bbp_write(sc, 17, bbp17);
1654	rum_cfg_bbp_write(sc, 96, bbp96);
1655	rum_cfg_bbp_write(sc, 104, bbp104);
1656
1657	if ((cc->ic_curchan.chan_is_2ghz && sc->sc_ext_2ghz_lna) ||
1658	    (cc->ic_curchan.chan_is_5ghz && sc->sc_ext_5ghz_lna)) {
1659		rum_cfg_bbp_write(sc, 75, 0x80);
1660		rum_cfg_bbp_write(sc, 86, 0x80);
1661		rum_cfg_bbp_write(sc, 88, 0x80);
1662	}
1663	rum_cfg_bbp_write(sc, 35, bbp35);
1664	rum_cfg_bbp_write(sc, 97, bbp97);
1665	rum_cfg_bbp_write(sc, 98, bbp98);
1666
1667	tmp = rum_cfg_read(sc, RT2573_PHY_CSR0);
1668	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1669	if (cc->ic_curchan.chan_is_2ghz)
1670		tmp |= RT2573_PA_PE_2GHZ;
1671	else
1672		tmp |= RT2573_PA_PE_5GHZ;
1673	rum_cfg_write(sc, RT2573_PHY_CSR0, tmp);
1674
1675	/* 802.11a uses a 16 microseconds short interframe space */
1676	sc->sc_sifs = cc->ic_curchan.chan_is_5ghz ? 16 : 10;
1677}
1678
1679static void
1680rum_cfg_set_chan(struct rum_softc *sc,
1681    struct usb2_config_td_cc *cc, uint16_t refcount)
1682{
1683	enum {
1684	N_RF5225 = (sizeof(rum_rf5225) / sizeof(rum_rf5225[0]))};
1685	const struct rfprog *rfprog;
1686	uint32_t chan;
1687	uint16_t i;
1688	uint8_t bbp3;
1689	uint8_t bbp94 = RT2573_BBPR94_DEFAULT;
1690	int8_t power;
1691
1692	chan = cc->ic_curchan.chan_to_ieee;
1693
1694	if ((chan == 0) ||
1695	    (chan == IEEE80211_CHAN_ANY)) {
1696		/* nothing to do */
1697		return;
1698	}
1699	if (chan == sc->sc_last_chan) {
1700		return;
1701	}
1702	sc->sc_last_chan = chan;
1703
1704	/* select the appropriate RF settings based on what EEPROM says */
1705	rfprog = ((sc->sc_rf_rev == RT2573_RF_5225) ||
1706	    (sc->sc_rf_rev == RT2573_RF_2527)) ? rum_rf5225 : rum_rf5226;
1707
1708	/* find the settings for this channel */
1709	for (i = 0;; i++) {
1710		if (i == (N_RF5225 - 1))
1711			break;
1712		if (rfprog[i].chan == chan)
1713			break;
1714	}
1715
1716	DPRINTF("chan=%d, i=%d\n", chan, i);
1717
1718	power = sc->sc_txpow[i];
1719	if (power < 0) {
1720		bbp94 += power;
1721		power = 0;
1722	} else if (power > 31) {
1723		bbp94 += power - 31;
1724		power = 31;
1725	}
1726	/*
1727	 * If we are switching from the 2GHz band to the 5GHz band or
1728	 * vice-versa, BBP registers need to be reprogrammed.
1729	 */
1730	rum_cfg_select_band(sc, cc, 0);
1731	rum_cfg_select_antenna(sc, cc, 0);
1732
1733	rum_cfg_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1734	rum_cfg_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1735	rum_cfg_rf_write(sc, RT2573_RF3, rfprog[i].r3 | (power << 7));
1736	rum_cfg_rf_write(sc, RT2573_RF4, rfprog[i].r4 | (sc->sc_rffreq << 10));
1737
1738	rum_cfg_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1739	rum_cfg_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1740	rum_cfg_rf_write(sc, RT2573_RF3, rfprog[i].r3 | (power << 7) | 1);
1741	rum_cfg_rf_write(sc, RT2573_RF4, rfprog[i].r4 | (sc->sc_rffreq << 10));
1742
1743	rum_cfg_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1744	rum_cfg_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1745	rum_cfg_rf_write(sc, RT2573_RF3, rfprog[i].r3 | (power << 7));
1746	rum_cfg_rf_write(sc, RT2573_RF4, rfprog[i].r4 | (sc->sc_rffreq << 10));
1747
1748	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1749		return;
1750	}
1751	/* enable smart mode for MIMO-capable RFs */
1752	bbp3 = rum_cfg_bbp_read(sc, 3);
1753
1754	if ((sc->sc_rf_rev == RT2573_RF_5225) ||
1755	    (sc->sc_rf_rev == RT2573_RF_2527))
1756		bbp3 &= ~RT2573_SMART_MODE;
1757	else
1758		bbp3 |= RT2573_SMART_MODE;
1759
1760	rum_cfg_bbp_write(sc, 3, bbp3);
1761
1762	rum_cfg_bbp_write(sc, 94, bbp94);
1763
1764	/* update basic rate set */
1765
1766	if (cc->ic_curchan.chan_is_b) {
1767		/* 11b basic rates: 1, 2Mbps */
1768		rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x3);
1769	} else if (cc->ic_curchan.chan_is_a) {
1770		/* 11a basic rates: 6, 12, 24Mbps */
1771		rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x150);
1772	} else {
1773		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1774		rum_cfg_write(sc, RT2573_TXRX_CSR5, 0xf);
1775	}
1776
1777	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1778		return;
1779	}
1780}
1781
1782static void
1783rum_cfg_set_run(struct rum_softc *sc,
1784    struct usb2_config_td_cc *cc)
1785{
1786
1787	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1788		rum_cfg_update_slot(sc, cc, 0);
1789		rum_cfg_enable_mrr(sc, cc, 0);
1790		rum_cfg_set_txpreamble(sc, cc, 0);
1791
1792		/* update basic rate set */
1793
1794		if (cc->ic_bsschan.chan_is_5ghz) {
1795			/* 11a basic rates: 6, 12, 24Mbps */
1796			rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x150);
1797		} else if (cc->ic_bsschan.chan_is_g) {
1798			/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1799			rum_cfg_write(sc, RT2573_TXRX_CSR5, 0xf);
1800		} else {
1801			/* 11b basic rates: 1, 2Mbps */
1802			rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x3);
1803		}
1804		rum_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1805	}
1806	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1807	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1808		rum_cfg_prepare_beacon(sc, cc, 0);
1809	}
1810	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1811		rum_cfg_enable_tsf_sync(sc, cc, 0);
1812	}
1813	if (cc->iv_bss.fixed_rate_none) {
1814		/* enable automatic rate adaptation */
1815		rum_cfg_amrr_start(sc);
1816	}
1817}
1818
1819static void
1820rum_cfg_enable_tsf_sync(struct rum_softc *sc,
1821    struct usb2_config_td_cc *cc, uint16_t refcount)
1822{
1823	uint32_t tmp;
1824
1825	if (cc->ic_opmode != IEEE80211_M_STA) {
1826		/*
1827		 * Change default 16ms TBTT adjustment to 8ms.
1828		 * Must be done before enabling beacon generation.
1829		 */
1830		rum_cfg_write(sc, RT2573_TXRX_CSR10, (1 << 12) | 8);
1831	}
1832	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1833
1834	/* set beacon interval (in 1/16ms unit) */
1835	tmp |= cc->iv_bss.ni_intval * 16;
1836
1837	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1838	if (cc->ic_opmode == IEEE80211_M_STA)
1839		tmp |= RT2573_TSF_MODE(1);
1840	else
1841		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1842
1843	rum_cfg_write(sc, RT2573_TXRX_CSR9, tmp);
1844}
1845
1846static void
1847rum_cfg_disable_tsf_sync(struct rum_softc *sc)
1848{
1849	uint32_t tmp;
1850
1851	/* abort TSF synchronization */
1852	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR9);
1853	rum_cfg_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
1854}
1855
1856/*
1857 * Enable multi-rate retries for frames sent at OFDM rates.
1858 * In 802.11b/g mode, allow fallback to CCK rates.
1859 */
1860static void
1861rum_cfg_enable_mrr(struct rum_softc *sc,
1862    struct usb2_config_td_cc *cc, uint16_t refcount)
1863{
1864	uint32_t tmp;
1865
1866	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR4);
1867
1868	if (cc->ic_curchan.chan_is_5ghz)
1869		tmp &= ~RT2573_MRR_CCK_FALLBACK;
1870	else
1871		tmp |= RT2573_MRR_CCK_FALLBACK;
1872
1873	tmp |= RT2573_MRR_ENABLED;
1874
1875	rum_cfg_write(sc, RT2573_TXRX_CSR4, tmp);
1876}
1877
1878static void
1879rum_cfg_update_slot(struct rum_softc *sc,
1880    struct usb2_config_td_cc *cc, uint16_t refcount)
1881{
1882	uint32_t tmp;
1883	uint8_t slottime;
1884
1885	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1886
1887	tmp = rum_cfg_read(sc, RT2573_MAC_CSR9);
1888	tmp = (tmp & ~0xff) | slottime;
1889	rum_cfg_write(sc, RT2573_MAC_CSR9, tmp);
1890
1891	DPRINTF("setting slot time to %u us\n", slottime);
1892}
1893
1894static void
1895rum_cfg_set_txpreamble(struct rum_softc *sc,
1896    struct usb2_config_td_cc *cc, uint16_t refcount)
1897{
1898	uint32_t tmp;
1899
1900	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR4);
1901
1902	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE)
1903		tmp |= RT2573_SHORT_PREAMBLE;
1904	else
1905		tmp &= ~RT2573_SHORT_PREAMBLE;
1906
1907	rum_cfg_write(sc, RT2573_TXRX_CSR4, tmp);
1908}
1909
1910static void
1911rum_cfg_set_bssid(struct rum_softc *sc, uint8_t *bssid)
1912{
1913	uint32_t tmp;
1914
1915	tmp = bssid[0] | (bssid[1] << 8) | (bssid[2] << 16) | (bssid[3] << 24);
1916	rum_cfg_write(sc, RT2573_MAC_CSR4, tmp);
1917
1918	tmp = (bssid[4]) | (bssid[5] << 8) | (RT2573_ONE_BSSID << 16);
1919	rum_cfg_write(sc, RT2573_MAC_CSR5, tmp);
1920}
1921
1922static void
1923rum_cfg_set_macaddr(struct rum_softc *sc, uint8_t *addr)
1924{
1925	uint32_t tmp;
1926
1927	tmp = addr[0] | (addr[1] << 8) | (addr[2] << 16) | (addr[3] << 24);
1928	rum_cfg_write(sc, RT2573_MAC_CSR2, tmp);
1929
1930	tmp = addr[4] | (addr[5] << 8) | (0xff << 16);
1931	rum_cfg_write(sc, RT2573_MAC_CSR3, tmp);
1932}
1933
1934static void
1935rum_cfg_update_promisc(struct rum_softc *sc,
1936    struct usb2_config_td_cc *cc, uint16_t refcount)
1937{
1938	uint32_t tmp;
1939
1940	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0);
1941
1942	if (cc->if_flags & IFF_PROMISC)
1943		tmp &= ~RT2573_DROP_NOT_TO_ME;
1944	else
1945		tmp |= RT2573_DROP_NOT_TO_ME;
1946
1947	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp);
1948
1949	DPRINTF("%s promiscuous mode\n",
1950	    (cc->if_flags & IFF_PROMISC) ?
1951	    "entering" : "leaving");
1952}
1953
1954static void
1955rum_cfg_select_antenna(struct rum_softc *sc,
1956    struct usb2_config_td_cc *cc, uint16_t refcount)
1957{
1958	uint32_t tmp;
1959	uint8_t bbp3;
1960	uint8_t bbp4;
1961	uint8_t bbp77;
1962	uint8_t rx_ant;
1963	uint8_t is_5ghz;
1964
1965	bbp3 = rum_cfg_bbp_read(sc, 3);
1966	bbp4 = rum_cfg_bbp_read(sc, 4);
1967	bbp77 = rum_cfg_bbp_read(sc, 77);
1968
1969	bbp3 &= ~0x01;
1970	bbp4 &= ~0x23;
1971
1972	rx_ant = sc->sc_rx_ant;
1973	is_5ghz = cc->ic_curchan.chan_is_5ghz;
1974
1975	switch (sc->sc_rf_rev) {
1976	case RT2573_RF_5226:
1977	case RT2573_RF_5225:
1978		if (rx_ant == 0) {
1979			/* Diversity */
1980			bbp4 |= 0x02;
1981			if (is_5ghz == 0)
1982				bbp4 |= 0x20;
1983		} else if (rx_ant == 1) {
1984			/* RX: Antenna A */
1985			bbp4 |= 0x01;
1986			if (is_5ghz)
1987				bbp77 &= ~0x03;
1988			else
1989				bbp77 |= 0x03;
1990		} else if (rx_ant == 2) {
1991			/* RX: Antenna B */
1992			bbp4 |= 0x01;
1993			if (is_5ghz)
1994				bbp77 |= 0x03;
1995			else
1996				bbp77 &= ~0x03;
1997		}
1998		break;
1999
2000	case RT2573_RF_2528:
2001	case RT2573_RF_2527:
2002		if (rx_ant == 0) {
2003			/* Diversity */
2004			bbp4 |= 0x22;
2005		} else if (rx_ant == 1) {
2006			/* RX: Antenna A */
2007			bbp4 |= 0x21;
2008			bbp77 |= 0x03;
2009		} else if (rx_ant == 2) {
2010			/* RX: Antenna B */
2011			bbp4 |= 0x21;
2012			bbp77 &= ~0x03;
2013		}
2014		break;
2015	default:
2016		break;
2017	}
2018	bbp4 &= ~(sc->sc_ftype << 5);
2019
2020	/* make sure Rx is disabled before switching antenna */
2021	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0);
2022	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2023
2024	rum_cfg_bbp_write(sc, 3, bbp3);
2025	rum_cfg_bbp_write(sc, 4, bbp4);
2026	rum_cfg_bbp_write(sc, 77, bbp77);
2027
2028	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp);
2029}
2030
2031static void
2032rum_cfg_read_eeprom(struct rum_softc *sc)
2033{
2034	uint16_t val;
2035
2036	/* read MAC address */
2037	rum_cfg_eeprom_read(sc, RT2573_EEPROM_ADDRESS, sc->sc_myaddr, 6);
2038
2039	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_ANTENNA);
2040	sc->sc_rf_rev = (val >> 11) & 0x1f;
2041	sc->sc_hw_radio = (val >> 10) & 0x1;
2042	sc->sc_ftype = (val >> 6) & 0x1;
2043	sc->sc_rx_ant = (val >> 4) & 0x3;
2044	sc->sc_tx_ant = (val >> 2) & 0x3;
2045	sc->sc_nb_ant = (val & 0x3);
2046
2047	DPRINTF("RF revision=%d\n", sc->sc_rf_rev);
2048
2049	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_CONFIG2);
2050	sc->sc_ext_5ghz_lna = (val >> 6) & 0x1;
2051	sc->sc_ext_2ghz_lna = (val >> 4) & 0x1;
2052
2053	DPRINTF("External 2GHz LNA=%d, External 5GHz LNA=%d\n",
2054	    sc->sc_ext_2ghz_lna, sc->sc_ext_5ghz_lna);
2055
2056	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET);
2057	if ((val & 0xff) != 0xff)
2058		sc->sc_rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
2059	else
2060		sc->sc_rssi_2ghz_corr = 0;
2061
2062	/* range check */
2063	if ((sc->sc_rssi_2ghz_corr < -10) ||
2064	    (sc->sc_rssi_2ghz_corr > 10)) {
2065		sc->sc_rssi_2ghz_corr = 0;
2066	}
2067	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET);
2068	if ((val & 0xff) != 0xff)
2069		sc->sc_rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2070	else
2071		sc->sc_rssi_5ghz_corr = 0;
2072
2073	/* range check */
2074	if ((sc->sc_rssi_5ghz_corr < -10) ||
2075	    (sc->sc_rssi_5ghz_corr > 10)) {
2076		sc->sc_rssi_5ghz_corr = 0;
2077	}
2078	if (sc->sc_ext_2ghz_lna) {
2079		sc->sc_rssi_2ghz_corr -= 14;
2080	}
2081	if (sc->sc_ext_5ghz_lna) {
2082		sc->sc_rssi_5ghz_corr -= 14;
2083	}
2084	DPRINTF("RSSI 2GHz corr=%d, RSSI 5GHz corr=%d\n",
2085	    sc->sc_rssi_2ghz_corr, sc->sc_rssi_5ghz_corr);
2086
2087	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_FREQ_OFFSET);
2088	if ((val & 0xff) != 0xff)
2089		sc->sc_rffreq = (val & 0xff);
2090	else
2091		sc->sc_rffreq = 0;
2092
2093	DPRINTF("RF freq=%d\n", sc->sc_rffreq);
2094
2095	/* read Tx power for all a/b/g channels */
2096	rum_cfg_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->sc_txpow, 14);
2097
2098	/* XXX default Tx power for 802.11a channels */
2099	memset(sc->sc_txpow + 14, 24, sizeof(sc->sc_txpow) - 14);
2100
2101	/* read default values for BBP registers */
2102	rum_cfg_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->sc_bbp_prom, 2 * 16);
2103}
2104
2105static uint8_t
2106rum_cfg_bbp_init(struct rum_softc *sc)
2107{
2108	enum {
2109		N_DEF_BBP = (sizeof(rum_def_bbp) / sizeof(rum_def_bbp[0])),
2110	};
2111	uint16_t i;
2112	uint8_t to;
2113	uint8_t tmp;
2114
2115	/* wait for BBP to become ready */
2116	for (to = 0;; to++) {
2117		if (to < 100) {
2118			tmp = rum_cfg_bbp_read(sc, 0);
2119			if ((tmp != 0x00) &&
2120			    (tmp != 0xff)) {
2121				break;
2122			}
2123			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2124				return (1);	/* failure */
2125			}
2126		} else {
2127			DPRINTF("timeout waiting for BBP\n");
2128			return (1);	/* failure */
2129		}
2130	}
2131
2132	/* initialize BBP registers to default values */
2133	for (i = 0; i < N_DEF_BBP; i++) {
2134		rum_cfg_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
2135	}
2136
2137	/* write vendor-specific BBP values (from EEPROM) */
2138	for (i = 0; i < 16; i++) {
2139		if ((sc->sc_bbp_prom[i].reg == 0) ||
2140		    (sc->sc_bbp_prom[i].reg == 0xff)) {
2141			continue;
2142		}
2143		rum_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg, sc->sc_bbp_prom[i].val);
2144	}
2145	return (0);
2146}
2147
2148static void
2149rum_cfg_pre_init(struct rum_softc *sc,
2150    struct usb2_config_td_cc *cc, uint16_t refcount)
2151{
2152	struct ifnet *ifp = sc->sc_ifp;
2153	struct ieee80211com *ic = ifp->if_l2com;
2154
2155	/* immediate configuration */
2156
2157	rum_cfg_pre_stop(sc, cc, 0);
2158
2159	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2160
2161	sc->sc_flags |= RUM_FLAG_HL_READY;
2162
2163	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2164}
2165
2166static void
2167rum_cfg_init(struct rum_softc *sc,
2168    struct usb2_config_td_cc *cc, uint16_t refcount)
2169{
2170	enum {
2171		N_DEF_MAC = (sizeof(rum_def_mac) / sizeof(rum_def_mac[0])),
2172	};
2173
2174	uint32_t tmp;
2175	uint16_t i;
2176	uint8_t to;
2177
2178	/* delayed configuration */
2179
2180	rum_cfg_stop(sc, cc, 0);
2181
2182	/* initialize MAC registers to default values */
2183	for (i = 0; i < N_DEF_MAC; i++) {
2184		rum_cfg_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
2185	}
2186
2187	/* set host ready */
2188	rum_cfg_write(sc, RT2573_MAC_CSR1, 3);
2189	rum_cfg_write(sc, RT2573_MAC_CSR1, 0);
2190
2191	/* wait for BBP/RF to wakeup */
2192	for (to = 0;; to++) {
2193		if (to < 100) {
2194			if (rum_cfg_read(sc, RT2573_MAC_CSR12) & 8) {
2195				break;
2196			}
2197			rum_cfg_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
2198
2199			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2200				goto fail;
2201			}
2202		} else {
2203			DPRINTF("timeout waiting for "
2204			    "BBP/RF to wakeup\n");
2205			goto fail;
2206		}
2207	}
2208
2209	if (rum_cfg_bbp_init(sc)) {
2210		goto fail;
2211	}
2212	/* select default channel */
2213
2214	sc->sc_last_chan = 0;
2215
2216	rum_cfg_set_chan(sc, cc, 0);
2217
2218	/* clear STA registers */
2219	rum_cfg_read_multi(sc, RT2573_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2220	/* set MAC address */
2221	rum_cfg_set_macaddr(sc, cc->ic_myaddr);
2222
2223	/* initialize ASIC */
2224	rum_cfg_write(sc, RT2573_MAC_CSR1, 4);
2225
2226	/*
2227	 * make sure that the first transaction
2228	 * clears the stall:
2229	 */
2230	sc->sc_flags |= (RUM_FLAG_READ_STALL |
2231	    RUM_FLAG_WRITE_STALL |
2232	    RUM_FLAG_LL_READY);
2233
2234	if ((sc->sc_flags & RUM_FLAG_LL_READY) &&
2235	    (sc->sc_flags & RUM_FLAG_HL_READY)) {
2236		struct ifnet *ifp = sc->sc_ifp;
2237		struct ieee80211com *ic = ifp->if_l2com;
2238
2239		/*
2240		 * start the USB transfers, if not already started:
2241		 */
2242		usb2_transfer_start(sc->sc_xfer[1]);
2243		usb2_transfer_start(sc->sc_xfer[0]);
2244
2245		/*
2246		 * start IEEE802.11 layer
2247		 */
2248		mtx_unlock(&sc->sc_mtx);
2249		ieee80211_start_all(ic);
2250		mtx_lock(&sc->sc_mtx);
2251	}
2252	/* update Rx filter */
2253	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2254
2255	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2256
2257	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2258		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2259		    RT2573_DROP_ACKCTS;
2260		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2261			tmp |= RT2573_DROP_TODS;
2262		}
2263		if (!(cc->if_flags & IFF_PROMISC)) {
2264			tmp |= RT2573_DROP_NOT_TO_ME;
2265		}
2266	}
2267	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp);
2268
2269	return;
2270
2271fail:
2272	rum_cfg_pre_stop(sc, NULL, 0);
2273
2274	if (cc) {
2275		rum_cfg_stop(sc, cc, 0);
2276	}
2277}
2278
2279static void
2280rum_cfg_pre_stop(struct rum_softc *sc,
2281    struct usb2_config_td_cc *cc, uint16_t refcount)
2282{
2283	struct ifnet *ifp = sc->sc_ifp;
2284
2285	if (cc) {
2286		/* copy the needed configuration */
2287		rum_config_copy(sc, cc, refcount);
2288	}
2289	/* immediate configuration */
2290
2291	if (ifp) {
2292		/* clear flags */
2293		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2294	}
2295	sc->sc_flags &= ~(RUM_FLAG_HL_READY |
2296	    RUM_FLAG_LL_READY);
2297
2298	/*
2299	 * stop all the transfers, if not already stopped:
2300	 */
2301	usb2_transfer_stop(sc->sc_xfer[0]);
2302	usb2_transfer_stop(sc->sc_xfer[1]);
2303	usb2_transfer_stop(sc->sc_xfer[2]);
2304	usb2_transfer_stop(sc->sc_xfer[3]);
2305
2306	/* clean up transmission */
2307	rum_tx_clean_queue(sc);
2308}
2309
2310static void
2311rum_cfg_stop(struct rum_softc *sc,
2312    struct usb2_config_td_cc *cc, uint16_t refcount)
2313{
2314	uint32_t tmp;
2315
2316	/* disable Rx */
2317	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0);
2318	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2319
2320	/* reset ASIC */
2321	rum_cfg_write(sc, RT2573_MAC_CSR1, 3);
2322
2323	/* wait a little */
2324	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2325
2326	rum_cfg_write(sc, RT2573_MAC_CSR1, 0);
2327
2328	/* wait a little */
2329	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2330}
2331
2332static void
2333rum_cfg_amrr_start(struct rum_softc *sc)
2334{
2335	struct ieee80211vap *vap;
2336	struct ieee80211_node *ni;
2337
2338	vap = rum_get_vap(sc);
2339
2340	if (vap == NULL) {
2341		return;
2342	}
2343	ni = vap->iv_bss;
2344	if (ni == NULL) {
2345		return;
2346	}
2347	/* init AMRR */
2348
2349	ieee80211_amrr_node_init(&RUM_VAP(vap)->amrr, &RUM_NODE(ni)->amn, ni);
2350
2351	/* enable AMRR timer */
2352
2353	sc->sc_amrr_timer = 1;
2354}
2355
2356static void
2357rum_cfg_amrr_timeout(struct rum_softc *sc,
2358    struct usb2_config_td_cc *cc, uint16_t refcount)
2359{
2360	struct ifnet *ifp = sc->sc_ifp;
2361	struct ieee80211vap *vap;
2362	struct ieee80211_node *ni;
2363	uint32_t ok;
2364	uint32_t fail;
2365
2366	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2367	rum_cfg_read_multi(sc, RT2573_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2368
2369	vap = rum_get_vap(sc);
2370	if (vap == NULL) {
2371		return;
2372	}
2373	ni = vap->iv_bss;
2374	if (ni == NULL) {
2375		return;
2376	}
2377	if ((sc->sc_flags & RUM_FLAG_LL_READY) &&
2378	    (sc->sc_flags & RUM_FLAG_HL_READY)) {
2379
2380		ok = (le32toh(sc->sc_sta[4]) >> 16) +	/* TX ok w/o retry */
2381		    (le32toh(sc->sc_sta[5]) & 0xffff);	/* TX ok w/ retry */
2382		fail = (le32toh(sc->sc_sta[5]) >> 16);	/* TX retry-fail count */
2383
2384		if (sc->sc_amrr_timer) {
2385			ieee80211_amrr_tx_update(&RUM_NODE(vap->iv_bss)->amn,
2386			    ok + fail, ok, (le32toh(sc->sc_sta[5]) & 0xffff) + fail);
2387
2388			if (ieee80211_amrr_choose(ni, &RUM_NODE(ni)->amn)) {
2389				/* ignore */
2390			}
2391		}
2392		ifp->if_oerrors += fail;/* count TX retry-fail as Tx errors */
2393	}
2394}
2395
2396static void
2397rum_cfg_load_microcode(struct rum_softc *sc, const uint8_t *ucode, uint16_t size)
2398{
2399	struct usb2_device_request req;
2400	uint16_t reg = RT2573_MCU_CODE_BASE;
2401
2402	/* copy firmware image into NIC */
2403	while (size >= 4) {
2404		rum_cfg_write(sc, reg, UGETDW(ucode));
2405		reg += 4;
2406		ucode += 4;
2407		size -= 4;
2408	}
2409
2410	if (size != 0) {
2411		DPRINTF("possibly invalid firmware\n");
2412	}
2413	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2414	req.bRequest = RT2573_MCU_CNTL;
2415	USETW(req.wValue, RT2573_MCU_RUN);
2416	USETW(req.wIndex, 0);
2417	USETW(req.wLength, 0);
2418
2419	rum_cfg_do_request(sc, &req, NULL);
2420}
2421
2422static void
2423rum_cfg_prepare_beacon(struct rum_softc *sc,
2424    struct usb2_config_td_cc *cc, uint16_t refcount)
2425{
2426	struct ieee80211_node *ni;
2427	struct ieee80211vap *vap;
2428	struct ieee80211com *ic;
2429	const struct ieee80211_txparam *tp;
2430	struct mbuf *m;
2431
2432	vap = rum_get_vap(sc);
2433	if (vap == NULL) {
2434		return;
2435	}
2436	ni = vap->iv_bss;
2437	if (ni == NULL) {
2438		return;
2439	}
2440	ic = vap->iv_ic;
2441	if (ic == NULL) {
2442		return;
2443	}
2444	DPRINTFN(11, "Sending beacon frame.\n");
2445
2446	m = ieee80211_beacon_alloc(ni, &RUM_VAP(vap)->bo);
2447	if (m == NULL) {
2448		DPRINTFN(0, "could not allocate beacon\n");
2449		return;
2450	}
2451	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2452
2453	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2454	rum_setup_desc_and_tx(sc, m, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ | RT2573_TX_BEACON, tp->mgmtrate);
2455}
2456
2457static uint8_t
2458rum_get_rssi(struct rum_softc *sc, uint8_t raw)
2459{
2460	struct ifnet *ifp = sc->sc_ifp;
2461	struct ieee80211com *ic = ifp->if_l2com;
2462	int16_t rssi;
2463	uint8_t lna;
2464	uint8_t agc;
2465
2466	lna = (raw >> 5) & 0x3;
2467	agc = raw & 0x1f;
2468
2469	if (lna == 0) {
2470		/*
2471                 * No RSSI mapping
2472                 *
2473                 * NB: Since RSSI is relative to noise floor, -1 is
2474                 *     adequate for caller to know error happened.
2475                 */
2476		return (0);
2477	}
2478	rssi = (2 * agc) - RT2573_NOISE_FLOOR;
2479
2480	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
2481
2482		rssi += sc->sc_rssi_2ghz_corr;
2483
2484		if (lna == 1)
2485			rssi -= 64;
2486		else if (lna == 2)
2487			rssi -= 74;
2488		else if (lna == 3)
2489			rssi -= 90;
2490	} else {
2491
2492		rssi += sc->sc_rssi_5ghz_corr;
2493
2494		if ((!sc->sc_ext_5ghz_lna) && (lna != 1))
2495			rssi += 4;
2496
2497		if (lna == 1)
2498			rssi -= 64;
2499		else if (lna == 2)
2500			rssi -= 86;
2501		else if (lna == 3)
2502			rssi -= 100;
2503	}
2504
2505	/* range check */
2506
2507	if (rssi < 0)
2508		rssi = 0;
2509	else if (rssi > 255)
2510		rssi = 255;
2511
2512	return (rssi);
2513}
2514
2515static struct ieee80211vap *
2516rum_vap_create(struct ieee80211com *ic,
2517    const char name[IFNAMSIZ], int unit, int opmode, int flags,
2518    const uint8_t bssid[IEEE80211_ADDR_LEN],
2519    const uint8_t mac[IEEE80211_ADDR_LEN])
2520{
2521	struct rum_vap *rvp;
2522	struct ieee80211vap *vap;
2523	struct rum_softc *sc = ic->ic_ifp->if_softc;
2524
2525	DPRINTF("\n");
2526
2527	/* Need to sync with config thread: */
2528	mtx_lock(&sc->sc_mtx);
2529	if (usb2_config_td_sync(&sc->sc_config_td)) {
2530		mtx_unlock(&sc->sc_mtx);
2531		/* config thread is gone */
2532		return (NULL);
2533	}
2534	mtx_unlock(&sc->sc_mtx);
2535
2536	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2537		return NULL;
2538	rvp = (struct rum_vap *)malloc(sizeof(struct rum_vap),
2539	    M_80211_VAP, M_NOWAIT | M_ZERO);
2540	if (rvp == NULL)
2541		return NULL;
2542	vap = &rvp->vap;
2543	/* enable s/w bmiss handling for sta mode */
2544	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2545	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2546
2547	/* override state transition machine */
2548	rvp->newstate = vap->iv_newstate;
2549	vap->iv_newstate = &rum_newstate_cb;
2550
2551	ieee80211_amrr_init(&rvp->amrr, vap,
2552	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2553	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2554	    1000 /* 1 sec */ );
2555
2556	/* complete setup */
2557	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2558
2559	/* store current operation mode */
2560	ic->ic_opmode = opmode;
2561
2562	return (vap);
2563}
2564
2565static void
2566rum_vap_delete(struct ieee80211vap *vap)
2567{
2568	struct rum_vap *rvp = RUM_VAP(vap);
2569	struct rum_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2570
2571	DPRINTF("\n");
2572
2573	/* Need to sync with config thread: */
2574	mtx_lock(&sc->sc_mtx);
2575	if (usb2_config_td_sync(&sc->sc_config_td)) {
2576		/* ignore */
2577	}
2578	mtx_unlock(&sc->sc_mtx);
2579
2580	ieee80211_amrr_cleanup(&rvp->amrr);
2581	ieee80211_vap_detach(vap);
2582	free(rvp, M_80211_VAP);
2583}
2584
2585/* ARGUSED */
2586static struct ieee80211_node *
2587rum_node_alloc(struct ieee80211vap *vap __unused,
2588    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2589{
2590	struct rum_node *rn;
2591
2592	rn = malloc(sizeof(struct rum_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2593	return ((rn != NULL) ? &rn->ni : NULL);
2594}
2595
2596static void
2597rum_newassoc(struct ieee80211_node *ni, int isnew)
2598{
2599	struct ieee80211vap *vap = ni->ni_vap;
2600
2601	ieee80211_amrr_node_init(&RUM_VAP(vap)->amrr, &RUM_NODE(ni)->amn, ni);
2602}
2603
2604static void
2605rum_fill_write_queue(struct rum_softc *sc)
2606{
2607	struct ifnet *ifp = sc->sc_ifp;
2608	struct ieee80211_node *ni;
2609	struct mbuf *m;
2610
2611	/*
2612	 * We only fill up half of the queue with data frames. The rest is
2613	 * reserved for other kinds of frames.
2614	 */
2615
2616	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2617
2618		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2619		if (m == NULL)
2620			break;
2621
2622		ni = (void *)(m->m_pkthdr.rcvif);
2623		m = ieee80211_encap(ni, m);
2624		if (m == NULL) {
2625			ieee80211_free_node(ni);
2626			continue;
2627		}
2628		rum_tx_data(sc, m, ni);
2629	}
2630}
2631
2632static void
2633rum_tx_clean_queue(struct rum_softc *sc)
2634{
2635	struct mbuf *m;
2636
2637	for (;;) {
2638		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2639
2640		if (!m) {
2641			break;
2642		}
2643		rum_tx_freem(m);
2644	}
2645}
2646
2647static void
2648rum_tx_freem(struct mbuf *m)
2649{
2650	struct ieee80211_node *ni;
2651
2652	while (m) {
2653		ni = (void *)(m->m_pkthdr.rcvif);
2654		if (!ni) {
2655			m = m_free(m);
2656			continue;
2657		}
2658		if (m->m_flags & M_TXCB) {
2659			ieee80211_process_callback(ni, m, 0);
2660		}
2661		m_freem(m);
2662		ieee80211_free_node(ni);
2663
2664		break;
2665	}
2666}
2667
2668static void
2669rum_tx_mgt(struct rum_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2670{
2671	struct ieee80211vap *vap = ni->ni_vap;
2672	struct ieee80211com *ic = ni->ni_ic;
2673	const struct ieee80211_txparam *tp;
2674	struct ieee80211_frame *wh;
2675	struct ieee80211_key *k;
2676	uint32_t flags;
2677	uint16_t dur;
2678
2679	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2680
2681	wh = mtod(m, struct ieee80211_frame *);
2682	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2683		k = ieee80211_crypto_encap(ni, m);
2684		if (k == NULL) {
2685			m_freem(m);
2686			ieee80211_free_node(ni);
2687			return;
2688		}
2689		wh = mtod(m, struct ieee80211_frame *);
2690	}
2691	flags = 0;
2692	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2693		flags |= RT2573_TX_NEED_ACK;
2694
2695		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2696		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2697		USETW(wh->i_dur, dur);
2698
2699		/* tell hardware to add timestamp for probe responses */
2700		if ((wh->i_fc[0] &
2701		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
2702		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
2703			flags |= RT2573_TX_TIMESTAMP;
2704	}
2705	m->m_pkthdr.rcvif = (void *)ni;
2706	rum_setup_desc_and_tx(sc, m, flags, 0, tp->mgmtrate);
2707}
2708
2709static struct ieee80211vap *
2710rum_get_vap(struct rum_softc *sc)
2711{
2712	struct ifnet *ifp;
2713	struct ieee80211com *ic;
2714
2715	if (sc == NULL) {
2716		return NULL;
2717	}
2718	ifp = sc->sc_ifp;
2719	if (ifp == NULL) {
2720		return NULL;
2721	}
2722	ic = ifp->if_l2com;
2723	if (ic == NULL) {
2724		return NULL;
2725	}
2726	return TAILQ_FIRST(&ic->ic_vaps);
2727}
2728
2729static void
2730rum_tx_data(struct rum_softc *sc, struct mbuf *m,
2731    struct ieee80211_node *ni)
2732{
2733	struct ieee80211vap *vap = ni->ni_vap;
2734	struct ieee80211com *ic = ni->ni_ic;
2735	const struct ieee80211_txparam *tp;
2736	struct ieee80211_frame *wh;
2737	struct ieee80211_key *k;
2738	uint32_t flags = 0;
2739	uint16_t dur;
2740	uint16_t rate;
2741
2742	DPRINTFN(11, "Sending data.\n");
2743
2744	wh = mtod(m, struct ieee80211_frame *);
2745
2746	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2747	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2748		rate = tp->mcastrate;
2749	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2750		rate = tp->ucastrate;
2751	else
2752		rate = ni->ni_txrate;
2753
2754	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2755		k = ieee80211_crypto_encap(ni, m);
2756		if (k == NULL) {
2757			m_freem(m);
2758			ieee80211_free_node(ni);
2759			return;
2760		}
2761		/* packet header may have moved, reset our local pointer */
2762		wh = mtod(m, struct ieee80211_frame *);
2763	}
2764	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2765		uint8_t prot = IEEE80211_PROT_NONE;
2766
2767		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2768			prot = IEEE80211_PROT_RTSCTS;
2769		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2770		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2771			prot = ic->ic_protmode;
2772		if (prot != IEEE80211_PROT_NONE) {
2773			rum_tx_prot(sc, m, ni, prot, rate);
2774			flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
2775		}
2776		flags |= RT2573_TX_NEED_ACK;
2777		flags |= RT2573_TX_MORE_FRAG;
2778
2779		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2780		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2781		USETW(wh->i_dur, dur);
2782	}
2783	m->m_pkthdr.rcvif = (void *)ni;
2784	rum_setup_desc_and_tx(sc, m, flags, 0, rate);
2785}
2786
2787static void
2788rum_tx_prot(struct rum_softc *sc,
2789    const struct mbuf *m, struct ieee80211_node *ni,
2790    uint8_t prot, uint16_t rate)
2791{
2792	struct ieee80211com *ic = ni->ni_ic;
2793	const struct ieee80211_frame *wh;
2794	struct mbuf *mprot;
2795	uint32_t flags;
2796	uint16_t protrate;
2797	uint16_t ackrate;
2798	uint16_t pktlen;
2799	uint16_t dur;
2800	uint8_t isshort;
2801
2802	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2803	    (prot == IEEE80211_PROT_CTSONLY),
2804	    ("protection %u", prot));
2805
2806	DPRINTFN(11, "Sending protection frame.\n");
2807
2808	wh = mtod(m, const struct ieee80211_frame *);
2809	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2810
2811	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2812	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2813
2814	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2815	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2816	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2817	flags = RT2573_TX_MORE_FRAG;
2818	if (prot == IEEE80211_PROT_RTSCTS) {
2819		/* NB: CTS is the same size as an ACK */
2820		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2821		flags |= RT2573_TX_NEED_ACK;
2822		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2823	} else {
2824		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2825	}
2826	if (mprot == NULL) {
2827		return;
2828	}
2829	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2830	rum_setup_desc_and_tx(sc, mprot, flags, 0, protrate);
2831}
2832
2833static void
2834rum_tx_raw(struct rum_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2835    const struct ieee80211_bpf_params *params)
2836{
2837	uint32_t flags;
2838	uint16_t rate;
2839
2840	DPRINTFN(11, "Sending raw frame.\n");
2841
2842	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2843
2844	/* XXX validate */
2845	if (rate == 0) {
2846		m_freem(m);
2847		ieee80211_free_node(ni);
2848		return;
2849	}
2850	flags = 0;
2851	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2852		flags |= RT2573_TX_NEED_ACK;
2853	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2854		rum_tx_prot(sc, m, ni,
2855		    params->ibp_flags & IEEE80211_BPF_RTS ?
2856		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2857		    rate);
2858		flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
2859	}
2860	m->m_pkthdr.rcvif = (void *)ni;
2861	rum_setup_desc_and_tx(sc, m, flags, 0, rate);
2862}
2863
2864static int
2865rum_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2866    const struct ieee80211_bpf_params *params)
2867{
2868	struct ieee80211com *ic = ni->ni_ic;
2869	struct ifnet *ifp = ic->ic_ifp;
2870	struct rum_softc *sc = ifp->if_softc;
2871
2872	mtx_lock(&sc->sc_mtx);
2873	if (params == NULL) {
2874		/*
2875		 * Legacy path; interpret frame contents to decide
2876		 * precisely how to send the frame.
2877		 */
2878		rum_tx_mgt(sc, m, ni);
2879	} else {
2880		/*
2881		 * Caller supplied explicit parameters to use in
2882		 * sending the frame.
2883		 */
2884		rum_tx_raw(sc, m, ni, params);
2885	}
2886	mtx_unlock(&sc->sc_mtx);
2887	return (0);
2888}
2889
2890static void
2891rum_update_mcast_cb(struct ifnet *ifp)
2892{
2893	/* not supported */
2894}
2895
2896static void
2897rum_update_promisc_cb(struct ifnet *ifp)
2898{
2899	struct rum_softc *sc = ifp->if_softc;
2900
2901	mtx_lock(&sc->sc_mtx);
2902	usb2_config_td_queue_command
2903	    (&sc->sc_config_td, &rum_config_copy,
2904	    &rum_cfg_update_promisc, 0, 0);
2905	mtx_unlock(&sc->sc_mtx);
2906}
2907