if_rum.c revision 189123
1/*	$FreeBSD: head/sys/dev/usb/wlan/if_rum.c 189123 2009-02-27 21:14:29Z thompsa $	*/
2
3/*-
4 * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
5 * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
6 * Copyright (c) 2007-2008 Hans Petter Selasky <hselasky@FreeBSD.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21#include <sys/cdefs.h>
22__FBSDID("$FreeBSD: head/sys/dev/usb/wlan/if_rum.c 189123 2009-02-27 21:14:29Z thompsa $");
23
24/*-
25 * Ralink Technology RT2501USB/RT2601USB chipset driver
26 * http://www.ralinktech.com.tw/
27 */
28
29#include "usbdevs.h"
30#include <dev/usb/usb.h>
31#include <dev/usb/usb_mfunc.h>
32#include <dev/usb/usb_error.h>
33
34#define	USB_DEBUG_VAR rum_debug
35
36#include <dev/usb/usb_core.h>
37#include <dev/usb/usb_lookup.h>
38#include <dev/usb/usb_process.h>
39#include <dev/usb/usb_debug.h>
40#include <dev/usb/usb_request.h>
41#include <dev/usb/usb_busdma.h>
42#include <dev/usb/usb_util.h>
43
44#include <dev/usb/wlan/usb_wlan.h>
45#include <dev/usb/wlan/if_rumreg.h>
46#include <dev/usb/wlan/if_rumvar.h>
47#include <dev/usb/wlan/if_rumfw.h>
48
49#if USB_DEBUG
50static int rum_debug = 0;
51
52SYSCTL_NODE(_hw_usb2, OID_AUTO, rum, CTLFLAG_RW, 0, "USB rum");
53SYSCTL_INT(_hw_usb2_rum, OID_AUTO, debug, CTLFLAG_RW, &rum_debug, 0,
54    "Debug level");
55#endif
56
57static const struct usb2_device_id rum_devs[] = {
58    { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_HWU54DM) },
59    { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_2) },
60    { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_3) },
61    { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_4) },
62    { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_WUG2700) },
63    { USB_VP(USB_VENDOR_AMIT,		USB_PRODUCT_AMIT_CGWLUSB2GO) },
64    { USB_VP(USB_VENDOR_ASUS,		USB_PRODUCT_ASUS_RT2573_1) },
65    { USB_VP(USB_VENDOR_ASUS,		USB_PRODUCT_ASUS_RT2573_2) },
66    { USB_VP(USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D7050A) },
67    { USB_VP(USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D9050V3) },
68    { USB_VP(USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GC) },
69    { USB_VP(USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GR) },
70    { USB_VP(USB_VENDOR_CONCEPTRONIC2,	USB_PRODUCT_CONCEPTRONIC2_C54RU2) },
71    { USB_VP(USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GL) },
72    { USB_VP(USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GPX) },
73    { USB_VP(USB_VENDOR_DICKSMITH,	USB_PRODUCT_DICKSMITH_CWD854F) },
74    { USB_VP(USB_VENDOR_DICKSMITH,	USB_PRODUCT_DICKSMITH_RT2573) },
75    { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWLG122C1) },
76    { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_WUA1340) },
77    { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA111) },
78    { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA110) },
79    { USB_VP(USB_VENDOR_GIGABYTE,	USB_PRODUCT_GIGABYTE_GNWB01GS) },
80    { USB_VP(USB_VENDOR_GIGABYTE,	USB_PRODUCT_GIGABYTE_GNWI05GS) },
81    { USB_VP(USB_VENDOR_GIGASET,	USB_PRODUCT_GIGASET_RT2573) },
82    { USB_VP(USB_VENDOR_GOODWAY,	USB_PRODUCT_GOODWAY_RT2573) },
83    { USB_VP(USB_VENDOR_GUILLEMOT,	USB_PRODUCT_GUILLEMOT_HWGUSB254LB) },
84    { USB_VP(USB_VENDOR_GUILLEMOT,	USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP) },
85    { USB_VP(USB_VENDOR_HUAWEI3COM,	USB_PRODUCT_HUAWEI3COM_WUB320G) },
86    { USB_VP(USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_G54HP) },
87    { USB_VP(USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_SG54HP) },
88    { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_1) },
89    { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_2) },
90    { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_3) },
91    { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_4) },
92    { USB_VP(USB_VENDOR_NOVATECH,	USB_PRODUCT_NOVATECH_RT2573) },
93    { USB_VP(USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GWUS54HP) },
94    { USB_VP(USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GWUS54MINI2) },
95    { USB_VP(USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GWUSMM) },
96    { USB_VP(USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573) },
97    { USB_VP(USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573_2) },
98    { USB_VP(USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573) },
99    { USB_VP(USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573_2) },
100    { USB_VP(USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2671) },
101    { USB_VP(USB_VENDOR_SITECOMEU,	USB_PRODUCT_SITECOMEU_WL113R2) },
102    { USB_VP(USB_VENDOR_SITECOMEU,	USB_PRODUCT_SITECOMEU_WL172) },
103    { USB_VP(USB_VENDOR_SPARKLAN,	USB_PRODUCT_SPARKLAN_RT2573) },
104    { USB_VP(USB_VENDOR_SURECOM,	USB_PRODUCT_SURECOM_RT2573) },
105};
106
107MODULE_DEPEND(rum, wlan, 1, 1, 1);
108MODULE_DEPEND(rum, wlan_amrr, 1, 1, 1);
109MODULE_DEPEND(rum, usb, 1, 1, 1);
110
111static device_probe_t rum_match;
112static device_attach_t rum_attach;
113static device_detach_t rum_detach;
114
115static usb2_callback_t rum_bulk_read_callback;
116static usb2_callback_t rum_bulk_write_callback;
117
118static usb2_proc_callback_t rum_command_wrapper;
119static usb2_proc_callback_t rum_attach_post;
120static usb2_proc_callback_t rum_task;
121static usb2_proc_callback_t rum_scantask;
122static usb2_proc_callback_t rum_promisctask;
123static usb2_proc_callback_t rum_amrr_task;
124static usb2_proc_callback_t rum_init_task;
125static usb2_proc_callback_t rum_stop_task;
126static usb2_proc_callback_t rum_flush_task;
127
128static usb2_error_t	rum_do_request(struct rum_softc *sc,
129			    struct usb2_device_request *req, void *data);
130static struct ieee80211vap *rum_vap_create(struct ieee80211com *,
131			    const char name[IFNAMSIZ], int unit, int opmode,
132			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
133			    const uint8_t mac[IEEE80211_ADDR_LEN]);
134static void		rum_vap_delete(struct ieee80211vap *);
135static void		rum_tx_free(struct rum_tx_data *, int);
136static void		rum_setup_tx_list(struct rum_softc *);
137static void		rum_unsetup_tx_list(struct rum_softc *);
138static int		rum_newstate(struct ieee80211vap *,
139			    enum ieee80211_state, int);
140static void		rum_setup_tx_desc(struct rum_softc *,
141			    struct rum_tx_desc *, uint32_t, uint16_t, int,
142			    int);
143static int		rum_tx_mgt(struct rum_softc *, struct mbuf *,
144			    struct ieee80211_node *);
145static int		rum_tx_raw(struct rum_softc *, struct mbuf *,
146			    struct ieee80211_node *,
147			    const struct ieee80211_bpf_params *);
148static int		rum_tx_data(struct rum_softc *, struct mbuf *,
149			    struct ieee80211_node *);
150static void		rum_start(struct ifnet *);
151static int		rum_ioctl(struct ifnet *, u_long, caddr_t);
152static void		rum_eeprom_read(struct rum_softc *, uint16_t, void *,
153			    int);
154static uint32_t		rum_read(struct rum_softc *, uint16_t);
155static void		rum_read_multi(struct rum_softc *, uint16_t, void *,
156			    int);
157static usb2_error_t	rum_write(struct rum_softc *, uint16_t, uint32_t);
158static usb2_error_t	rum_write_multi(struct rum_softc *, uint16_t, void *,
159			    size_t);
160static void		rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
161static uint8_t		rum_bbp_read(struct rum_softc *, uint8_t);
162static void		rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
163static void		rum_select_antenna(struct rum_softc *);
164static void		rum_enable_mrr(struct rum_softc *);
165static void		rum_set_txpreamble(struct rum_softc *);
166static void		rum_set_basicrates(struct rum_softc *);
167static void		rum_select_band(struct rum_softc *,
168			    struct ieee80211_channel *);
169static void		rum_set_chan(struct rum_softc *,
170			    struct ieee80211_channel *);
171static void		rum_enable_tsf_sync(struct rum_softc *);
172static void		rum_update_slot(struct ifnet *);
173static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
174static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
175static void		rum_update_mcast(struct ifnet *);
176static void		rum_update_promisc(struct ifnet *);
177static const char	*rum_get_rf(int);
178static void		rum_read_eeprom(struct rum_softc *);
179static int		rum_bbp_init(struct rum_softc *);
180static void		rum_init(void *);
181static void		rum_load_microcode(struct rum_softc *, const uint8_t *,
182			    size_t);
183static int		rum_prepare_beacon(struct rum_softc *,
184			    struct ieee80211vap *);
185static int		rum_raw_xmit(struct ieee80211_node *, struct mbuf *,
186			    const struct ieee80211_bpf_params *);
187static struct ieee80211_node *rum_node_alloc(struct ieee80211vap *,
188			    const uint8_t mac[IEEE80211_ADDR_LEN]);
189static void		rum_newassoc(struct ieee80211_node *, int);
190static void		rum_scan_start(struct ieee80211com *);
191static void		rum_scan_end(struct ieee80211com *);
192static void		rum_set_channel(struct ieee80211com *);
193static int		rum_get_rssi(struct rum_softc *, uint8_t);
194static void		rum_amrr_start(struct rum_softc *,
195			    struct ieee80211_node *);
196static void		rum_amrr_timeout(void *);
197static int		rum_pause(struct rum_softc *, int);
198static void		rum_queue_command(struct rum_softc *,
199			    usb2_proc_callback_t *, struct usb2_proc_msg *,
200			    struct usb2_proc_msg *);
201
202static const struct {
203	uint32_t	reg;
204	uint32_t	val;
205} rum_def_mac[] = {
206	{ RT2573_TXRX_CSR0,  0x025fb032 },
207	{ RT2573_TXRX_CSR1,  0x9eaa9eaf },
208	{ RT2573_TXRX_CSR2,  0x8a8b8c8d },
209	{ RT2573_TXRX_CSR3,  0x00858687 },
210	{ RT2573_TXRX_CSR7,  0x2e31353b },
211	{ RT2573_TXRX_CSR8,  0x2a2a2a2c },
212	{ RT2573_TXRX_CSR15, 0x0000000f },
213	{ RT2573_MAC_CSR6,   0x00000fff },
214	{ RT2573_MAC_CSR8,   0x016c030a },
215	{ RT2573_MAC_CSR10,  0x00000718 },
216	{ RT2573_MAC_CSR12,  0x00000004 },
217	{ RT2573_MAC_CSR13,  0x00007f00 },
218	{ RT2573_SEC_CSR0,   0x00000000 },
219	{ RT2573_SEC_CSR1,   0x00000000 },
220	{ RT2573_SEC_CSR5,   0x00000000 },
221	{ RT2573_PHY_CSR1,   0x000023b0 },
222	{ RT2573_PHY_CSR5,   0x00040a06 },
223	{ RT2573_PHY_CSR6,   0x00080606 },
224	{ RT2573_PHY_CSR7,   0x00000408 },
225	{ RT2573_AIFSN_CSR,  0x00002273 },
226	{ RT2573_CWMIN_CSR,  0x00002344 },
227	{ RT2573_CWMAX_CSR,  0x000034aa }
228};
229
230static const struct {
231	uint8_t	reg;
232	uint8_t	val;
233} rum_def_bbp[] = {
234	{   3, 0x80 },
235	{  15, 0x30 },
236	{  17, 0x20 },
237	{  21, 0xc8 },
238	{  22, 0x38 },
239	{  23, 0x06 },
240	{  24, 0xfe },
241	{  25, 0x0a },
242	{  26, 0x0d },
243	{  32, 0x0b },
244	{  34, 0x12 },
245	{  37, 0x07 },
246	{  39, 0xf8 },
247	{  41, 0x60 },
248	{  53, 0x10 },
249	{  54, 0x18 },
250	{  60, 0x10 },
251	{  61, 0x04 },
252	{  62, 0x04 },
253	{  75, 0xfe },
254	{  86, 0xfe },
255	{  88, 0xfe },
256	{  90, 0x0f },
257	{  99, 0x00 },
258	{ 102, 0x16 },
259	{ 107, 0x04 }
260};
261
262static const struct rfprog {
263	uint8_t		chan;
264	uint32_t	r1, r2, r3, r4;
265}  rum_rf5226[] = {
266	{   1, 0x00b03, 0x001e1, 0x1a014, 0x30282 },
267	{   2, 0x00b03, 0x001e1, 0x1a014, 0x30287 },
268	{   3, 0x00b03, 0x001e2, 0x1a014, 0x30282 },
269	{   4, 0x00b03, 0x001e2, 0x1a014, 0x30287 },
270	{   5, 0x00b03, 0x001e3, 0x1a014, 0x30282 },
271	{   6, 0x00b03, 0x001e3, 0x1a014, 0x30287 },
272	{   7, 0x00b03, 0x001e4, 0x1a014, 0x30282 },
273	{   8, 0x00b03, 0x001e4, 0x1a014, 0x30287 },
274	{   9, 0x00b03, 0x001e5, 0x1a014, 0x30282 },
275	{  10, 0x00b03, 0x001e5, 0x1a014, 0x30287 },
276	{  11, 0x00b03, 0x001e6, 0x1a014, 0x30282 },
277	{  12, 0x00b03, 0x001e6, 0x1a014, 0x30287 },
278	{  13, 0x00b03, 0x001e7, 0x1a014, 0x30282 },
279	{  14, 0x00b03, 0x001e8, 0x1a014, 0x30284 },
280
281	{  34, 0x00b03, 0x20266, 0x36014, 0x30282 },
282	{  38, 0x00b03, 0x20267, 0x36014, 0x30284 },
283	{  42, 0x00b03, 0x20268, 0x36014, 0x30286 },
284	{  46, 0x00b03, 0x20269, 0x36014, 0x30288 },
285
286	{  36, 0x00b03, 0x00266, 0x26014, 0x30288 },
287	{  40, 0x00b03, 0x00268, 0x26014, 0x30280 },
288	{  44, 0x00b03, 0x00269, 0x26014, 0x30282 },
289	{  48, 0x00b03, 0x0026a, 0x26014, 0x30284 },
290	{  52, 0x00b03, 0x0026b, 0x26014, 0x30286 },
291	{  56, 0x00b03, 0x0026c, 0x26014, 0x30288 },
292	{  60, 0x00b03, 0x0026e, 0x26014, 0x30280 },
293	{  64, 0x00b03, 0x0026f, 0x26014, 0x30282 },
294
295	{ 100, 0x00b03, 0x0028a, 0x2e014, 0x30280 },
296	{ 104, 0x00b03, 0x0028b, 0x2e014, 0x30282 },
297	{ 108, 0x00b03, 0x0028c, 0x2e014, 0x30284 },
298	{ 112, 0x00b03, 0x0028d, 0x2e014, 0x30286 },
299	{ 116, 0x00b03, 0x0028e, 0x2e014, 0x30288 },
300	{ 120, 0x00b03, 0x002a0, 0x2e014, 0x30280 },
301	{ 124, 0x00b03, 0x002a1, 0x2e014, 0x30282 },
302	{ 128, 0x00b03, 0x002a2, 0x2e014, 0x30284 },
303	{ 132, 0x00b03, 0x002a3, 0x2e014, 0x30286 },
304	{ 136, 0x00b03, 0x002a4, 0x2e014, 0x30288 },
305	{ 140, 0x00b03, 0x002a6, 0x2e014, 0x30280 },
306
307	{ 149, 0x00b03, 0x002a8, 0x2e014, 0x30287 },
308	{ 153, 0x00b03, 0x002a9, 0x2e014, 0x30289 },
309	{ 157, 0x00b03, 0x002ab, 0x2e014, 0x30281 },
310	{ 161, 0x00b03, 0x002ac, 0x2e014, 0x30283 },
311	{ 165, 0x00b03, 0x002ad, 0x2e014, 0x30285 }
312}, rum_rf5225[] = {
313	{   1, 0x00b33, 0x011e1, 0x1a014, 0x30282 },
314	{   2, 0x00b33, 0x011e1, 0x1a014, 0x30287 },
315	{   3, 0x00b33, 0x011e2, 0x1a014, 0x30282 },
316	{   4, 0x00b33, 0x011e2, 0x1a014, 0x30287 },
317	{   5, 0x00b33, 0x011e3, 0x1a014, 0x30282 },
318	{   6, 0x00b33, 0x011e3, 0x1a014, 0x30287 },
319	{   7, 0x00b33, 0x011e4, 0x1a014, 0x30282 },
320	{   8, 0x00b33, 0x011e4, 0x1a014, 0x30287 },
321	{   9, 0x00b33, 0x011e5, 0x1a014, 0x30282 },
322	{  10, 0x00b33, 0x011e5, 0x1a014, 0x30287 },
323	{  11, 0x00b33, 0x011e6, 0x1a014, 0x30282 },
324	{  12, 0x00b33, 0x011e6, 0x1a014, 0x30287 },
325	{  13, 0x00b33, 0x011e7, 0x1a014, 0x30282 },
326	{  14, 0x00b33, 0x011e8, 0x1a014, 0x30284 },
327
328	{  34, 0x00b33, 0x01266, 0x26014, 0x30282 },
329	{  38, 0x00b33, 0x01267, 0x26014, 0x30284 },
330	{  42, 0x00b33, 0x01268, 0x26014, 0x30286 },
331	{  46, 0x00b33, 0x01269, 0x26014, 0x30288 },
332
333	{  36, 0x00b33, 0x01266, 0x26014, 0x30288 },
334	{  40, 0x00b33, 0x01268, 0x26014, 0x30280 },
335	{  44, 0x00b33, 0x01269, 0x26014, 0x30282 },
336	{  48, 0x00b33, 0x0126a, 0x26014, 0x30284 },
337	{  52, 0x00b33, 0x0126b, 0x26014, 0x30286 },
338	{  56, 0x00b33, 0x0126c, 0x26014, 0x30288 },
339	{  60, 0x00b33, 0x0126e, 0x26014, 0x30280 },
340	{  64, 0x00b33, 0x0126f, 0x26014, 0x30282 },
341
342	{ 100, 0x00b33, 0x0128a, 0x2e014, 0x30280 },
343	{ 104, 0x00b33, 0x0128b, 0x2e014, 0x30282 },
344	{ 108, 0x00b33, 0x0128c, 0x2e014, 0x30284 },
345	{ 112, 0x00b33, 0x0128d, 0x2e014, 0x30286 },
346	{ 116, 0x00b33, 0x0128e, 0x2e014, 0x30288 },
347	{ 120, 0x00b33, 0x012a0, 0x2e014, 0x30280 },
348	{ 124, 0x00b33, 0x012a1, 0x2e014, 0x30282 },
349	{ 128, 0x00b33, 0x012a2, 0x2e014, 0x30284 },
350	{ 132, 0x00b33, 0x012a3, 0x2e014, 0x30286 },
351	{ 136, 0x00b33, 0x012a4, 0x2e014, 0x30288 },
352	{ 140, 0x00b33, 0x012a6, 0x2e014, 0x30280 },
353
354	{ 149, 0x00b33, 0x012a8, 0x2e014, 0x30287 },
355	{ 153, 0x00b33, 0x012a9, 0x2e014, 0x30289 },
356	{ 157, 0x00b33, 0x012ab, 0x2e014, 0x30281 },
357	{ 161, 0x00b33, 0x012ac, 0x2e014, 0x30283 },
358	{ 165, 0x00b33, 0x012ad, 0x2e014, 0x30285 }
359};
360
361static const struct usb2_config rum_config[RUM_N_TRANSFER] = {
362	[RUM_BULK_WR] = {
363		.type = UE_BULK,
364		.endpoint = UE_ADDR_ANY,
365		.direction = UE_DIR_OUT,
366		.mh.bufsize = (MCLBYTES + RT2573_TX_DESC_SIZE + 8),
367		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
368		.mh.callback = rum_bulk_write_callback,
369		.mh.timeout = 5000,	/* ms */
370	},
371	[RUM_BULK_RD] = {
372		.type = UE_BULK,
373		.endpoint = UE_ADDR_ANY,
374		.direction = UE_DIR_IN,
375		.mh.bufsize = (MCLBYTES + RT2573_RX_DESC_SIZE),
376		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
377		.mh.callback = rum_bulk_read_callback,
378	},
379};
380
381static int
382rum_match(device_t self)
383{
384	struct usb2_attach_arg *uaa = device_get_ivars(self);
385
386	if (uaa->usb2_mode != USB_MODE_HOST)
387		return (ENXIO);
388	if (uaa->info.bConfigIndex != 0)
389		return (ENXIO);
390	if (uaa->info.bIfaceIndex != RT2573_IFACE_INDEX)
391		return (ENXIO);
392
393	return (usb2_lookup_id_by_uaa(rum_devs, sizeof(rum_devs), uaa));
394}
395
396static int
397rum_attach(device_t self)
398{
399	struct usb2_attach_arg *uaa = device_get_ivars(self);
400	struct rum_softc *sc = device_get_softc(self);
401	uint8_t iface_index;
402	int error;
403
404	device_set_usb2_desc(self);
405	sc->sc_udev = uaa->device;
406	sc->sc_dev = self;
407
408	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
409	    MTX_NETWORK_LOCK, MTX_DEF);
410
411	cv_init(&sc->sc_cmd_cv, "wtxdone");
412
413	iface_index = RT2573_IFACE_INDEX;
414	error = usb2_transfer_setup(uaa->device, &iface_index,
415	    sc->sc_xfer, rum_config, RUM_N_TRANSFER, sc, &sc->sc_mtx);
416	if (error) {
417		device_printf(self, "could not allocate USB transfers, "
418		    "err=%s\n", usb2_errstr(error));
419		goto detach;
420	}
421	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
422	    device_get_nameunit(self), USB_PRI_MED);
423	if (error) {
424		device_printf(self, "could not setup config thread!\n");
425		goto detach;
426	}
427
428	/* fork rest of the attach code */
429	RUM_LOCK(sc);
430	rum_queue_command(sc, rum_attach_post,
431	    &sc->sc_synctask[0].hdr,
432	    &sc->sc_synctask[1].hdr);
433	RUM_UNLOCK(sc);
434	return (0);
435
436detach:
437	rum_detach(self);
438	return (ENXIO);			/* failure */
439}
440
441static void
442rum_attach_post(struct usb2_proc_msg *pm)
443{
444	struct rum_task *task = (struct rum_task *)pm;
445	struct rum_softc *sc = task->sc;
446	struct ifnet *ifp;
447	struct ieee80211com *ic;
448	unsigned int ntries;
449	uint32_t tmp;
450	uint8_t bands;
451
452	/* retrieve RT2573 rev. no */
453	for (ntries = 0; ntries < 100; ntries++) {
454		if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
455			break;
456		if (rum_pause(sc, hz / 100))
457			break;
458	}
459	if (ntries == 100) {
460		device_printf(sc->sc_dev, "timeout waiting for chip to settle\n");
461		return;
462	}
463
464	/* retrieve MAC address and various other things from EEPROM */
465	rum_read_eeprom(sc);
466
467	device_printf(sc->sc_dev, "MAC/BBP RT2573 (rev 0x%05x), RF %s\n",
468	    tmp, rum_get_rf(sc->rf_rev));
469
470	rum_load_microcode(sc, rt2573_ucode, sizeof(rt2573_ucode));
471
472	/* XXX Async attach race */
473	if (usb2_proc_is_gone(&sc->sc_tq))
474		return;
475
476	RUM_UNLOCK(sc);
477
478	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
479	if (ifp == NULL) {
480		device_printf(sc->sc_dev, "can not if_alloc()\n");
481		RUM_LOCK(sc);
482		return;
483	}
484	ic = ifp->if_l2com;
485
486	ifp->if_softc = sc;
487	if_initname(ifp, "rum", device_get_unit(sc->sc_dev));
488	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
489	ifp->if_init = rum_init;
490	ifp->if_ioctl = rum_ioctl;
491	ifp->if_start = rum_start;
492	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
493	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
494	IFQ_SET_READY(&ifp->if_snd);
495
496	ic->ic_ifp = ifp;
497	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
498	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_bssid);
499
500	/* set device capabilities */
501	ic->ic_caps =
502	      IEEE80211_C_STA		/* station mode supported */
503	    | IEEE80211_C_IBSS		/* IBSS mode supported */
504	    | IEEE80211_C_MONITOR	/* monitor mode supported */
505	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
506	    | IEEE80211_C_TXPMGT	/* tx power management */
507	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
508	    | IEEE80211_C_SHSLOT	/* short slot time supported */
509	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
510	    | IEEE80211_C_WPA		/* 802.11i */
511	    ;
512
513	bands = 0;
514	setbit(&bands, IEEE80211_MODE_11B);
515	setbit(&bands, IEEE80211_MODE_11G);
516	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226)
517		setbit(&bands, IEEE80211_MODE_11A);
518	ieee80211_init_channels(ic, NULL, &bands);
519
520	ieee80211_ifattach(ic);
521	ic->ic_update_mcast = rum_update_mcast;
522	ic->ic_update_promisc = rum_update_promisc;
523	ic->ic_newassoc = rum_newassoc;
524	ic->ic_raw_xmit = rum_raw_xmit;
525	ic->ic_node_alloc = rum_node_alloc;
526	ic->ic_scan_start = rum_scan_start;
527	ic->ic_scan_end = rum_scan_end;
528	ic->ic_set_channel = rum_set_channel;
529
530	ic->ic_vap_create = rum_vap_create;
531	ic->ic_vap_delete = rum_vap_delete;
532
533	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
534
535	bpfattach(ifp, DLT_IEEE802_11_RADIO,
536	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
537
538	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
539	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
540	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
541
542	sc->sc_txtap_len = sizeof sc->sc_txtap;
543	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
544	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
545
546	if (bootverbose)
547		ieee80211_announce(ic);
548
549	RUM_LOCK(sc);
550}
551
552static int
553rum_detach(device_t self)
554{
555	struct rum_softc *sc = device_get_softc(self);
556	struct ifnet *ifp = sc->sc_ifp;
557	struct ieee80211com *ic;
558
559	/* wait for any post attach or other command to complete */
560	usb2_proc_drain(&sc->sc_tq);
561
562	/* stop all USB transfers */
563	usb2_transfer_unsetup(sc->sc_xfer, RUM_N_TRANSFER);
564	usb2_proc_free(&sc->sc_tq);
565
566	/* free TX list, if any */
567	RUM_LOCK(sc);
568	rum_unsetup_tx_list(sc);
569	RUM_UNLOCK(sc);
570
571	if (ifp) {
572		ic = ifp->if_l2com;
573		bpfdetach(ifp);
574		ieee80211_ifdetach(ic);
575		if_free(ifp);
576	}
577	cv_destroy(&sc->sc_cmd_cv);
578	mtx_destroy(&sc->sc_mtx);
579
580	return (0);
581}
582
583static usb2_error_t
584rum_do_request(struct rum_softc *sc,
585    struct usb2_device_request *req, void *data)
586{
587	usb2_error_t err;
588	int ntries = 10;
589
590	while (ntries--) {
591		err = usb2_do_request_proc(sc->sc_udev, &sc->sc_tq,
592		    req, data, 0, NULL, 250 /* ms */);
593		if (err == 0)
594			break;
595
596		DPRINTFN(1, "Control request failed, %s (retrying)\n",
597		    usb2_errstr(err));
598		if (rum_pause(sc, hz / 100))
599			break;
600	}
601	return (err);
602}
603
604static struct ieee80211vap *
605rum_vap_create(struct ieee80211com *ic,
606	const char name[IFNAMSIZ], int unit, int opmode, int flags,
607	const uint8_t bssid[IEEE80211_ADDR_LEN],
608	const uint8_t mac[IEEE80211_ADDR_LEN])
609{
610	struct rum_softc *sc = ic->ic_ifp->if_softc;
611	struct rum_vap *rvp;
612	struct ieee80211vap *vap;
613
614	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
615		return NULL;
616	rvp = (struct rum_vap *) malloc(sizeof(struct rum_vap),
617	    M_80211_VAP, M_NOWAIT | M_ZERO);
618	if (rvp == NULL)
619		return NULL;
620	vap = &rvp->vap;
621	/* enable s/w bmiss handling for sta mode */
622	ieee80211_vap_setup(ic, vap, name, unit, opmode,
623	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
624
625	/* override state transition machine */
626	rvp->newstate = vap->iv_newstate;
627	vap->iv_newstate = rum_newstate;
628
629	rvp->sc = sc;
630	usb2_callout_init_mtx(&rvp->amrr_ch, &sc->sc_mtx, 0);
631	ieee80211_amrr_init(&rvp->amrr, vap,
632	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
633	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
634	    1000 /* 1 sec */);
635
636	/* complete setup */
637	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
638	ic->ic_opmode = opmode;
639	return vap;
640}
641
642static void
643rum_flush_task(struct usb2_proc_msg *pm)
644{
645	/* Nothing to do */
646}
647
648static void
649rum_vap_delete(struct ieee80211vap *vap)
650{
651	struct rum_vap *rvp = RUM_VAP(vap);
652	struct rum_softc *sc = rvp->sc;
653
654	RUM_LOCK(sc);
655	/* wait for any pending tasks to complete */
656	rum_queue_command(sc, rum_flush_task,
657	    &sc->sc_synctask[0].hdr,
658	    &sc->sc_synctask[1].hdr);
659	RUM_UNLOCK(sc);
660
661	usb2_callout_drain(&rvp->amrr_ch);
662	ieee80211_amrr_cleanup(&rvp->amrr);
663	ieee80211_vap_detach(vap);
664	free(rvp, M_80211_VAP);
665}
666
667static void
668rum_tx_free(struct rum_tx_data *data, int txerr)
669{
670	struct rum_softc *sc = data->sc;
671
672	if (data->m != NULL) {
673		if (data->m->m_flags & M_TXCB)
674			ieee80211_process_callback(data->ni, data->m,
675			    txerr ? ETIMEDOUT : 0);
676		m_freem(data->m);
677		data->m = NULL;
678
679		ieee80211_free_node(data->ni);
680		data->ni = NULL;
681	}
682	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
683	sc->tx_nfree++;
684}
685
686static void
687rum_setup_tx_list(struct rum_softc *sc)
688{
689	struct rum_tx_data *data;
690	int i;
691
692	sc->tx_nfree = 0;
693	STAILQ_INIT(&sc->tx_q);
694	STAILQ_INIT(&sc->tx_free);
695
696	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
697		data = &sc->tx_data[i];
698
699		data->sc = sc;
700		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
701		sc->tx_nfree++;
702	}
703}
704
705static void
706rum_unsetup_tx_list(struct rum_softc *sc)
707{
708	struct rum_tx_data *data;
709	int i;
710
711	/* make sure any subsequent use of the queues will fail */
712	sc->tx_nfree = 0;
713	STAILQ_INIT(&sc->tx_q);
714	STAILQ_INIT(&sc->tx_free);
715
716	/* free up all node references and mbufs */
717	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
718		data = &sc->tx_data[i];
719
720		if (data->m != NULL) {
721			m_freem(data->m);
722			data->m = NULL;
723		}
724		if (data->ni != NULL) {
725			ieee80211_free_node(data->ni);
726			data->ni = NULL;
727		}
728	}
729}
730
731static void
732rum_task(struct usb2_proc_msg *pm)
733{
734	struct rum_task *task = (struct rum_task *)pm;
735	struct rum_softc *sc = task->sc;
736	struct ifnet *ifp = sc->sc_ifp;
737	struct ieee80211com *ic = ifp->if_l2com;
738	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
739	struct rum_vap *rvp = RUM_VAP(vap);
740	const struct ieee80211_txparam *tp;
741	enum ieee80211_state ostate;
742	struct ieee80211_node *ni;
743	uint32_t tmp;
744
745	ostate = vap->iv_state;
746
747	switch (sc->sc_state) {
748	case IEEE80211_S_INIT:
749		if (ostate == IEEE80211_S_RUN) {
750			/* abort TSF synchronization */
751			tmp = rum_read(sc, RT2573_TXRX_CSR9);
752			rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
753		}
754		break;
755
756	case IEEE80211_S_RUN:
757		ni = vap->iv_bss;
758
759		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
760			rum_update_slot(ic->ic_ifp);
761			rum_enable_mrr(sc);
762			rum_set_txpreamble(sc);
763			rum_set_basicrates(sc);
764			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
765			rum_set_bssid(sc, sc->sc_bssid);
766		}
767
768		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
769		    vap->iv_opmode == IEEE80211_M_IBSS)
770			rum_prepare_beacon(sc, vap);
771
772		if (vap->iv_opmode != IEEE80211_M_MONITOR)
773			rum_enable_tsf_sync(sc);
774
775		/* enable automatic rate adaptation */
776		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
777		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
778			rum_amrr_start(sc, ni);
779		break;
780	default:
781		break;
782	}
783
784	RUM_UNLOCK(sc);
785	IEEE80211_LOCK(ic);
786	rvp->newstate(vap, sc->sc_state, sc->sc_arg);
787	if (vap->iv_newstate_cb != NULL)
788		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
789	IEEE80211_UNLOCK(ic);
790	RUM_LOCK(sc);
791}
792
793static int
794rum_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
795{
796	struct rum_vap *rvp = RUM_VAP(vap);
797	struct ieee80211com *ic = vap->iv_ic;
798	struct rum_softc *sc = ic->ic_ifp->if_softc;
799
800	DPRINTF("%s -> %s\n",
801		ieee80211_state_name[vap->iv_state],
802		ieee80211_state_name[nstate]);
803
804	RUM_LOCK(sc);
805	usb2_callout_stop(&rvp->amrr_ch);
806
807	/* do it in a process context */
808	sc->sc_state = nstate;
809	sc->sc_arg = arg;
810	RUM_UNLOCK(sc);
811
812	if (nstate == IEEE80211_S_INIT) {
813		rvp->newstate(vap, nstate, arg);
814		return 0;
815	} else {
816		RUM_LOCK(sc);
817		rum_queue_command(sc, rum_task, &sc->sc_task[0].hdr,
818		    &sc->sc_task[1].hdr);
819		RUM_UNLOCK(sc);
820		return EINPROGRESS;
821	}
822}
823
824static void
825rum_bulk_write_callback(struct usb2_xfer *xfer)
826{
827	struct rum_softc *sc = xfer->priv_sc;
828	struct ifnet *ifp = sc->sc_ifp;
829	struct ieee80211com *ic = ifp->if_l2com;
830	struct ieee80211_channel *c = ic->ic_curchan;
831	struct rum_tx_data *data;
832	struct mbuf *m;
833	unsigned int len;
834
835	/* wakeup waiting command, if any */
836	if (sc->sc_last_task != NULL)
837		cv_signal(&sc->sc_cmd_cv);
838
839	switch (USB_GET_STATE(xfer)) {
840	case USB_ST_TRANSFERRED:
841		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
842
843		/* free resources */
844		data = xfer->priv_fifo;
845		rum_tx_free(data, 0);
846		xfer->priv_fifo = NULL;
847
848		ifp->if_opackets++;
849		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
850
851		/* FALLTHROUGH */
852	case USB_ST_SETUP:
853tr_setup:
854		/* wait for command to complete, if any */
855		if (sc->sc_last_task != NULL)
856			break;
857
858		data = STAILQ_FIRST(&sc->tx_q);
859		if (data) {
860			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
861			m = data->m;
862
863			if (m->m_pkthdr.len > (MCLBYTES + RT2573_TX_DESC_SIZE)) {
864				DPRINTFN(0, "data overflow, %u bytes\n",
865				    m->m_pkthdr.len);
866				m->m_pkthdr.len = (MCLBYTES + RT2573_TX_DESC_SIZE);
867			}
868			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
869			    RT2573_TX_DESC_SIZE);
870			usb2_m_copy_in(xfer->frbuffers, RT2573_TX_DESC_SIZE, m,
871			    0, m->m_pkthdr.len);
872
873			if (bpf_peers_present(ifp->if_bpf)) {
874				struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
875
876				tap->wt_flags = 0;
877				tap->wt_rate = data->rate;
878				tap->wt_chan_freq = htole16(c->ic_freq);
879				tap->wt_chan_flags = htole16(c->ic_flags);
880				tap->wt_antenna = sc->tx_ant;
881
882				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
883			}
884
885			/* align end on a 4-bytes boundary */
886			len = (RT2573_TX_DESC_SIZE + m->m_pkthdr.len + 3) & ~3;
887			if ((len % 64) == 0)
888				len += 4;
889
890			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
891			    m->m_pkthdr.len, len);
892
893			xfer->frlengths[0] = len;
894			xfer->priv_fifo = data;
895
896			usb2_start_hardware(xfer);
897		}
898		break;
899
900	default:			/* Error */
901		DPRINTFN(11, "transfer error, %s\n",
902		    usb2_errstr(xfer->error));
903
904		ifp->if_oerrors++;
905		data = xfer->priv_fifo;
906		if (data != NULL) {
907			rum_tx_free(data, xfer->error);
908			xfer->priv_fifo = NULL;
909		}
910
911		if (xfer->error == USB_ERR_STALLED) {
912			/* try to clear stall first */
913			xfer->flags.stall_pipe = 1;
914			goto tr_setup;
915		}
916		if (xfer->error == USB_ERR_TIMEOUT)
917			device_printf(sc->sc_dev, "device timeout\n");
918		break;
919	}
920}
921
922static void
923rum_bulk_read_callback(struct usb2_xfer *xfer)
924{
925	struct rum_softc *sc = xfer->priv_sc;
926	struct ifnet *ifp = sc->sc_ifp;
927	struct ieee80211com *ic = ifp->if_l2com;
928	struct ieee80211_node *ni;
929	struct mbuf *m = NULL;
930	uint32_t flags;
931	uint8_t rssi = 0;
932	unsigned int len;
933
934	switch (USB_GET_STATE(xfer)) {
935	case USB_ST_TRANSFERRED:
936
937		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
938
939		len = xfer->actlen;
940		if (len < RT2573_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
941			DPRINTF("%s: xfer too short %d\n",
942			    device_get_nameunit(sc->sc_dev), len);
943			ifp->if_ierrors++;
944			goto tr_setup;
945		}
946
947		len -= RT2573_RX_DESC_SIZE;
948		usb2_copy_out(xfer->frbuffers, 0, &sc->sc_rx_desc,
949		    RT2573_RX_DESC_SIZE);
950
951		rssi = rum_get_rssi(sc, sc->sc_rx_desc.rssi);
952		flags = le32toh(sc->sc_rx_desc.flags);
953		if (flags & RT2573_RX_CRC_ERROR) {
954			/*
955		         * This should not happen since we did not
956		         * request to receive those frames when we
957		         * filled RUM_TXRX_CSR2:
958		         */
959			DPRINTFN(5, "PHY or CRC error\n");
960			ifp->if_ierrors++;
961			goto tr_setup;
962		}
963
964		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
965		if (m == NULL) {
966			DPRINTF("could not allocate mbuf\n");
967			ifp->if_ierrors++;
968			goto tr_setup;
969		}
970		usb2_copy_out(xfer->frbuffers, RT2573_RX_DESC_SIZE,
971		    mtod(m, uint8_t *), len);
972
973		/* finalize mbuf */
974		m->m_pkthdr.rcvif = ifp;
975		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
976
977		if (bpf_peers_present(ifp->if_bpf)) {
978			struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
979
980			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
981			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
982			    (flags & RT2573_RX_OFDM) ?
983			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
984			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
985			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
986			tap->wr_antenna = sc->rx_ant;
987			tap->wr_antsignal = rssi;
988
989			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
990		}
991		/* FALLTHROUGH */
992	case USB_ST_SETUP:
993tr_setup:
994		xfer->frlengths[0] = xfer->max_data_length;
995		usb2_start_hardware(xfer);
996
997		/*
998		 * At the end of a USB callback it is always safe to unlock
999		 * the private mutex of a device! That is why we do the
1000		 * "ieee80211_input" here, and not some lines up!
1001		 */
1002		if (m) {
1003			RUM_UNLOCK(sc);
1004			ni = ieee80211_find_rxnode(ic,
1005			    mtod(m, struct ieee80211_frame_min *));
1006			if (ni != NULL) {
1007				(void) ieee80211_input(ni, m, rssi,
1008				    RT2573_NOISE_FLOOR, 0);
1009				ieee80211_free_node(ni);
1010			} else
1011				(void) ieee80211_input_all(ic, m, rssi,
1012				    RT2573_NOISE_FLOOR, 0);
1013			RUM_LOCK(sc);
1014		}
1015		return;
1016
1017	default:			/* Error */
1018		if (xfer->error != USB_ERR_CANCELLED) {
1019			/* try to clear stall first */
1020			xfer->flags.stall_pipe = 1;
1021			goto tr_setup;
1022		}
1023		return;
1024	}
1025}
1026
1027static uint8_t
1028rum_plcp_signal(int rate)
1029{
1030	switch (rate) {
1031	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1032	case 12:	return 0xb;
1033	case 18:	return 0xf;
1034	case 24:	return 0xa;
1035	case 36:	return 0xe;
1036	case 48:	return 0x9;
1037	case 72:	return 0xd;
1038	case 96:	return 0x8;
1039	case 108:	return 0xc;
1040
1041	/* CCK rates (NB: not IEEE std, device-specific) */
1042	case 2:		return 0x0;
1043	case 4:		return 0x1;
1044	case 11:	return 0x2;
1045	case 22:	return 0x3;
1046	}
1047	return 0xff;		/* XXX unsupported/unknown rate */
1048}
1049
1050static void
1051rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1052    uint32_t flags, uint16_t xflags, int len, int rate)
1053{
1054	struct ifnet *ifp = sc->sc_ifp;
1055	struct ieee80211com *ic = ifp->if_l2com;
1056	uint16_t plcp_length;
1057	int remainder;
1058
1059	desc->flags = htole32(flags);
1060	desc->flags |= htole32(RT2573_TX_VALID);
1061	desc->flags |= htole32(len << 16);
1062
1063	desc->xflags = htole16(xflags);
1064
1065	desc->wme = htole16(RT2573_QID(0) | RT2573_AIFSN(2) |
1066	    RT2573_LOGCWMIN(4) | RT2573_LOGCWMAX(10));
1067
1068	/* setup PLCP fields */
1069	desc->plcp_signal  = rum_plcp_signal(rate);
1070	desc->plcp_service = 4;
1071
1072	len += IEEE80211_CRC_LEN;
1073	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1074		desc->flags |= htole32(RT2573_TX_OFDM);
1075
1076		plcp_length = len & 0xfff;
1077		desc->plcp_length_hi = plcp_length >> 6;
1078		desc->plcp_length_lo = plcp_length & 0x3f;
1079	} else {
1080		plcp_length = (16 * len + rate - 1) / rate;
1081		if (rate == 22) {
1082			remainder = (16 * len) % 22;
1083			if (remainder != 0 && remainder < 7)
1084				desc->plcp_service |= RT2573_PLCP_LENGEXT;
1085		}
1086		desc->plcp_length_hi = plcp_length >> 8;
1087		desc->plcp_length_lo = plcp_length & 0xff;
1088
1089		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1090			desc->plcp_signal |= 0x08;
1091	}
1092}
1093
1094static int
1095rum_sendprot(struct rum_softc *sc,
1096    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1097{
1098	struct ieee80211com *ic = ni->ni_ic;
1099	const struct ieee80211_frame *wh;
1100	struct rum_tx_data *data;
1101	struct mbuf *mprot;
1102	int protrate, ackrate, pktlen, flags, isshort;
1103	uint16_t dur;
1104
1105	RUM_LOCK_ASSERT(sc, MA_OWNED);
1106	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1107	    ("protection %d", prot));
1108
1109	wh = mtod(m, const struct ieee80211_frame *);
1110	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1111
1112	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1113	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1114
1115	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1116	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1117	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1118	flags = RT2573_TX_MORE_FRAG;
1119	if (prot == IEEE80211_PROT_RTSCTS) {
1120		/* NB: CTS is the same size as an ACK */
1121		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1122		flags |= RT2573_TX_NEED_ACK;
1123		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1124	} else {
1125		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1126	}
1127	if (mprot == NULL) {
1128		/* XXX stat + msg */
1129		return (ENOBUFS);
1130	}
1131	data = STAILQ_FIRST(&sc->tx_free);
1132	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1133	sc->tx_nfree--;
1134
1135	data->m = mprot;
1136	data->ni = ieee80211_ref_node(ni);
1137	data->rate = protrate;
1138	rum_setup_tx_desc(sc, &data->desc, flags, 0, mprot->m_pkthdr.len, protrate);
1139
1140	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1141	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1142
1143	return 0;
1144}
1145
1146static int
1147rum_tx_mgt(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1148{
1149	struct ieee80211vap *vap = ni->ni_vap;
1150	struct ifnet *ifp = sc->sc_ifp;
1151	struct ieee80211com *ic = ifp->if_l2com;
1152	struct rum_tx_data *data;
1153	struct ieee80211_frame *wh;
1154	const struct ieee80211_txparam *tp;
1155	struct ieee80211_key *k;
1156	uint32_t flags = 0;
1157	uint16_t dur;
1158
1159	RUM_LOCK_ASSERT(sc, MA_OWNED);
1160
1161	data = STAILQ_FIRST(&sc->tx_free);
1162	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1163	sc->tx_nfree--;
1164
1165	wh = mtod(m0, struct ieee80211_frame *);
1166	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1167		k = ieee80211_crypto_encap(ni, m0);
1168		if (k == NULL) {
1169			m_freem(m0);
1170			return ENOBUFS;
1171		}
1172		wh = mtod(m0, struct ieee80211_frame *);
1173	}
1174
1175	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1176
1177	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1178		flags |= RT2573_TX_NEED_ACK;
1179
1180		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
1181		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1182		*(uint16_t *)wh->i_dur = htole16(dur);
1183
1184		/* tell hardware to add timestamp for probe responses */
1185		if ((wh->i_fc[0] &
1186		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1187		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1188			flags |= RT2573_TX_TIMESTAMP;
1189	}
1190
1191	data->m = m0;
1192	data->ni = ni;
1193	data->rate = tp->mgmtrate;
1194
1195	rum_setup_tx_desc(sc, &data->desc, flags, 0, m0->m_pkthdr.len, tp->mgmtrate);
1196
1197	DPRINTFN(10, "sending mgt frame len=%d rate=%d\n",
1198	    m0->m_pkthdr.len + (int)RT2573_TX_DESC_SIZE, tp->mgmtrate);
1199
1200	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1201	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1202
1203	return (0);
1204}
1205
1206static int
1207rum_tx_raw(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1208    const struct ieee80211_bpf_params *params)
1209{
1210	struct rum_tx_data *data;
1211	uint32_t flags;
1212	int rate, error;
1213
1214	RUM_LOCK_ASSERT(sc, MA_OWNED);
1215	KASSERT(params != NULL, ("no raw xmit params"));
1216
1217	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1218	/* XXX validate */
1219	if (rate == 0) {
1220		m_freem(m0);
1221		return EINVAL;
1222	}
1223	flags = 0;
1224	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1225		flags |= RT2573_TX_NEED_ACK;
1226	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1227		error = rum_sendprot(sc, m0, ni,
1228		    params->ibp_flags & IEEE80211_BPF_RTS ?
1229			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1230		    rate);
1231		if (error || sc->tx_nfree == 0) {
1232			m_freem(m0);
1233			return ENOBUFS;
1234		}
1235		flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
1236	}
1237
1238	data = STAILQ_FIRST(&sc->tx_free);
1239	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1240	sc->tx_nfree--;
1241
1242	data->m = m0;
1243	data->ni = ni;
1244	data->rate = rate;
1245
1246	/* XXX need to setup descriptor ourself */
1247	rum_setup_tx_desc(sc, &data->desc, flags, 0, m0->m_pkthdr.len, rate);
1248
1249	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1250	    m0->m_pkthdr.len, rate);
1251
1252	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1253	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1254
1255	return 0;
1256}
1257
1258static int
1259rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1260{
1261	struct ieee80211vap *vap = ni->ni_vap;
1262	struct ifnet *ifp = sc->sc_ifp;
1263	struct ieee80211com *ic = ifp->if_l2com;
1264	struct rum_tx_data *data;
1265	struct ieee80211_frame *wh;
1266	const struct ieee80211_txparam *tp;
1267	struct ieee80211_key *k;
1268	uint32_t flags = 0;
1269	uint16_t dur;
1270	int error, rate;
1271
1272	RUM_LOCK_ASSERT(sc, MA_OWNED);
1273
1274	wh = mtod(m0, struct ieee80211_frame *);
1275
1276	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1277	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1278		rate = tp->mcastrate;
1279	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1280		rate = tp->ucastrate;
1281	else
1282		rate = ni->ni_txrate;
1283
1284	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1285		k = ieee80211_crypto_encap(ni, m0);
1286		if (k == NULL) {
1287			m_freem(m0);
1288			return ENOBUFS;
1289		}
1290
1291		/* packet header may have moved, reset our local pointer */
1292		wh = mtod(m0, struct ieee80211_frame *);
1293	}
1294
1295	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1296		int prot = IEEE80211_PROT_NONE;
1297		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1298			prot = IEEE80211_PROT_RTSCTS;
1299		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1300		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1301			prot = ic->ic_protmode;
1302		if (prot != IEEE80211_PROT_NONE) {
1303			error = rum_sendprot(sc, m0, ni, prot, rate);
1304			if (error || sc->tx_nfree == 0) {
1305				m_freem(m0);
1306				return ENOBUFS;
1307			}
1308			flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
1309		}
1310	}
1311
1312	data = STAILQ_FIRST(&sc->tx_free);
1313	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1314	sc->tx_nfree--;
1315
1316	data->m = m0;
1317	data->ni = ni;
1318	data->rate = rate;
1319
1320	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1321		flags |= RT2573_TX_NEED_ACK;
1322		flags |= RT2573_TX_MORE_FRAG;
1323
1324		dur = ieee80211_ack_duration(sc->sc_rates, rate,
1325		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1326		*(uint16_t *)wh->i_dur = htole16(dur);
1327	}
1328
1329	rum_setup_tx_desc(sc, &data->desc, flags, 0, m0->m_pkthdr.len, rate);
1330
1331	DPRINTFN(10, "sending frame len=%d rate=%d\n",
1332	    m0->m_pkthdr.len + (int)RT2573_TX_DESC_SIZE, rate);
1333
1334	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1335	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1336
1337	return 0;
1338}
1339
1340static void
1341rum_start(struct ifnet *ifp)
1342{
1343	struct rum_softc *sc = ifp->if_softc;
1344	struct ieee80211_node *ni;
1345	struct mbuf *m;
1346
1347	RUM_LOCK(sc);
1348	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1349		RUM_UNLOCK(sc);
1350		return;
1351	}
1352	for (;;) {
1353		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1354		if (m == NULL)
1355			break;
1356		if (sc->tx_nfree < RUM_TX_MINFREE) {
1357			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1358			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1359			break;
1360		}
1361		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1362		m = ieee80211_encap(ni, m);
1363		if (m == NULL) {
1364			ieee80211_free_node(ni);
1365			ifp->if_oerrors++;
1366			continue;
1367		}
1368		if (rum_tx_data(sc, m, ni) != 0) {
1369			ieee80211_free_node(ni);
1370			ifp->if_oerrors++;
1371			break;
1372		}
1373	}
1374	RUM_UNLOCK(sc);
1375}
1376
1377static int
1378rum_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1379{
1380	struct rum_softc *sc = ifp->if_softc;
1381	struct ieee80211com *ic = ifp->if_l2com;
1382	struct ifreq *ifr = (struct ifreq *) data;
1383	int error = 0, startall = 0;
1384
1385	switch (cmd) {
1386	case SIOCSIFFLAGS:
1387		RUM_LOCK(sc);
1388		if (ifp->if_flags & IFF_UP) {
1389			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1390				rum_queue_command(sc, rum_init_task,
1391				    &sc->sc_synctask[0].hdr,
1392				    &sc->sc_synctask[1].hdr);
1393				startall = 1;
1394			} else
1395				rum_queue_command(sc, rum_promisctask,
1396				    &sc->sc_promisctask[0].hdr,
1397				    &sc->sc_promisctask[1].hdr);
1398		} else {
1399			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1400				rum_queue_command(sc, rum_stop_task,
1401				    &sc->sc_synctask[0].hdr,
1402				    &sc->sc_synctask[1].hdr);
1403			}
1404		}
1405		RUM_UNLOCK(sc);
1406		if (startall)
1407			ieee80211_start_all(ic);
1408		break;
1409	case SIOCGIFMEDIA:
1410		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1411		break;
1412	case SIOCGIFADDR:
1413		error = ether_ioctl(ifp, cmd, data);
1414		break;
1415	default:
1416		error = EINVAL;
1417		break;
1418	}
1419	return error;
1420}
1421
1422static void
1423rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1424{
1425	struct usb2_device_request req;
1426	usb2_error_t error;
1427
1428	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1429	req.bRequest = RT2573_READ_EEPROM;
1430	USETW(req.wValue, 0);
1431	USETW(req.wIndex, addr);
1432	USETW(req.wLength, len);
1433
1434	error = rum_do_request(sc, &req, buf);
1435	if (error != 0) {
1436		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1437		    usb2_errstr(error));
1438	}
1439}
1440
1441static uint32_t
1442rum_read(struct rum_softc *sc, uint16_t reg)
1443{
1444	uint32_t val;
1445
1446	rum_read_multi(sc, reg, &val, sizeof val);
1447
1448	return le32toh(val);
1449}
1450
1451static void
1452rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1453{
1454	struct usb2_device_request req;
1455	usb2_error_t error;
1456
1457	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1458	req.bRequest = RT2573_READ_MULTI_MAC;
1459	USETW(req.wValue, 0);
1460	USETW(req.wIndex, reg);
1461	USETW(req.wLength, len);
1462
1463	error = rum_do_request(sc, &req, buf);
1464	if (error != 0) {
1465		device_printf(sc->sc_dev,
1466		    "could not multi read MAC register: %s\n",
1467		    usb2_errstr(error));
1468	}
1469}
1470
1471static usb2_error_t
1472rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1473{
1474	uint32_t tmp = htole32(val);
1475
1476	return (rum_write_multi(sc, reg, &tmp, sizeof tmp));
1477}
1478
1479static usb2_error_t
1480rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1481{
1482	struct usb2_device_request req;
1483	usb2_error_t error;
1484
1485	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1486	req.bRequest = RT2573_WRITE_MULTI_MAC;
1487	USETW(req.wValue, 0);
1488	USETW(req.wIndex, reg);
1489	USETW(req.wLength, len);
1490
1491	error = rum_do_request(sc, &req, buf);
1492	if (error != 0) {
1493		device_printf(sc->sc_dev,
1494		    "could not multi write MAC register: %s\n",
1495		    usb2_errstr(error));
1496	}
1497	return (error);
1498}
1499
1500static void
1501rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1502{
1503	uint32_t tmp;
1504	int ntries;
1505
1506	DPRINTFN(2, "reg=0x%08x\n", reg);
1507
1508	for (ntries = 0; ntries < 100; ntries++) {
1509		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1510			break;
1511		if (rum_pause(sc, hz / 100))
1512			break;
1513	}
1514	if (ntries == 100) {
1515		device_printf(sc->sc_dev, "could not write to BBP\n");
1516		return;
1517	}
1518
1519	tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1520	rum_write(sc, RT2573_PHY_CSR3, tmp);
1521}
1522
1523static uint8_t
1524rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1525{
1526	uint32_t val;
1527	int ntries;
1528
1529	DPRINTFN(2, "reg=0x%08x\n", reg);
1530
1531	for (ntries = 0; ntries < 100; ntries++) {
1532		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1533			break;
1534		if (rum_pause(sc, hz / 100))
1535			break;
1536	}
1537	if (ntries == 100) {
1538		device_printf(sc->sc_dev, "could not read BBP\n");
1539		return 0;
1540	}
1541
1542	val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1543	rum_write(sc, RT2573_PHY_CSR3, val);
1544
1545	for (ntries = 0; ntries < 100; ntries++) {
1546		val = rum_read(sc, RT2573_PHY_CSR3);
1547		if (!(val & RT2573_BBP_BUSY))
1548			return val & 0xff;
1549		if (rum_pause(sc, hz / 100))
1550			break;
1551	}
1552
1553	device_printf(sc->sc_dev, "could not read BBP\n");
1554	return 0;
1555}
1556
1557static void
1558rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1559{
1560	uint32_t tmp;
1561	int ntries;
1562
1563	for (ntries = 0; ntries < 100; ntries++) {
1564		if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1565			break;
1566		if (rum_pause(sc, hz / 100))
1567			break;
1568	}
1569	if (ntries == 100) {
1570		device_printf(sc->sc_dev, "could not write to RF\n");
1571		return;
1572	}
1573
1574	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1575	    (reg & 3);
1576	rum_write(sc, RT2573_PHY_CSR4, tmp);
1577
1578	/* remember last written value in sc */
1579	sc->rf_regs[reg] = val;
1580
1581	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff);
1582}
1583
1584static void
1585rum_select_antenna(struct rum_softc *sc)
1586{
1587	uint8_t bbp4, bbp77;
1588	uint32_t tmp;
1589
1590	bbp4  = rum_bbp_read(sc, 4);
1591	bbp77 = rum_bbp_read(sc, 77);
1592
1593	/* TBD */
1594
1595	/* make sure Rx is disabled before switching antenna */
1596	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1597	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1598
1599	rum_bbp_write(sc,  4, bbp4);
1600	rum_bbp_write(sc, 77, bbp77);
1601
1602	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1603}
1604
1605/*
1606 * Enable multi-rate retries for frames sent at OFDM rates.
1607 * In 802.11b/g mode, allow fallback to CCK rates.
1608 */
1609static void
1610rum_enable_mrr(struct rum_softc *sc)
1611{
1612	struct ifnet *ifp = sc->sc_ifp;
1613	struct ieee80211com *ic = ifp->if_l2com;
1614	uint32_t tmp;
1615
1616	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1617
1618	tmp &= ~RT2573_MRR_CCK_FALLBACK;
1619	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan))
1620		tmp |= RT2573_MRR_CCK_FALLBACK;
1621	tmp |= RT2573_MRR_ENABLED;
1622
1623	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1624}
1625
1626static void
1627rum_set_txpreamble(struct rum_softc *sc)
1628{
1629	struct ifnet *ifp = sc->sc_ifp;
1630	struct ieee80211com *ic = ifp->if_l2com;
1631	uint32_t tmp;
1632
1633	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1634
1635	tmp &= ~RT2573_SHORT_PREAMBLE;
1636	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1637		tmp |= RT2573_SHORT_PREAMBLE;
1638
1639	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1640}
1641
1642static void
1643rum_set_basicrates(struct rum_softc *sc)
1644{
1645	struct ifnet *ifp = sc->sc_ifp;
1646	struct ieee80211com *ic = ifp->if_l2com;
1647
1648	/* update basic rate set */
1649	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1650		/* 11b basic rates: 1, 2Mbps */
1651		rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1652	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan)) {
1653		/* 11a basic rates: 6, 12, 24Mbps */
1654		rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1655	} else {
1656		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1657		rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1658	}
1659}
1660
1661/*
1662 * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1663 * driver.
1664 */
1665static void
1666rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1667{
1668	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1669	uint32_t tmp;
1670
1671	/* update all BBP registers that depend on the band */
1672	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1673	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1674	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1675		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1676		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1677	}
1678	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1679	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1680		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1681	}
1682
1683	sc->bbp17 = bbp17;
1684	rum_bbp_write(sc,  17, bbp17);
1685	rum_bbp_write(sc,  96, bbp96);
1686	rum_bbp_write(sc, 104, bbp104);
1687
1688	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1689	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1690		rum_bbp_write(sc, 75, 0x80);
1691		rum_bbp_write(sc, 86, 0x80);
1692		rum_bbp_write(sc, 88, 0x80);
1693	}
1694
1695	rum_bbp_write(sc, 35, bbp35);
1696	rum_bbp_write(sc, 97, bbp97);
1697	rum_bbp_write(sc, 98, bbp98);
1698
1699	tmp = rum_read(sc, RT2573_PHY_CSR0);
1700	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1701	if (IEEE80211_IS_CHAN_2GHZ(c))
1702		tmp |= RT2573_PA_PE_2GHZ;
1703	else
1704		tmp |= RT2573_PA_PE_5GHZ;
1705	rum_write(sc, RT2573_PHY_CSR0, tmp);
1706}
1707
1708static void
1709rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1710{
1711	struct ifnet *ifp = sc->sc_ifp;
1712	struct ieee80211com *ic = ifp->if_l2com;
1713	const struct rfprog *rfprog;
1714	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1715	int8_t power;
1716	int i, chan;
1717
1718	chan = ieee80211_chan2ieee(ic, c);
1719	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1720		return;
1721
1722	/* select the appropriate RF settings based on what EEPROM says */
1723	rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1724		  sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1725
1726	/* find the settings for this channel (we know it exists) */
1727	for (i = 0; rfprog[i].chan != chan; i++);
1728
1729	power = sc->txpow[i];
1730	if (power < 0) {
1731		bbp94 += power;
1732		power = 0;
1733	} else if (power > 31) {
1734		bbp94 += power - 31;
1735		power = 31;
1736	}
1737
1738	/*
1739	 * If we are switching from the 2GHz band to the 5GHz band or
1740	 * vice-versa, BBP registers need to be reprogrammed.
1741	 */
1742	if (c->ic_flags != ic->ic_curchan->ic_flags) {
1743		rum_select_band(sc, c);
1744		rum_select_antenna(sc);
1745	}
1746	ic->ic_curchan = c;
1747
1748	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1749	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1750	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1751	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1752
1753	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1754	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1755	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1756	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1757
1758	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1759	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1760	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1761	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1762
1763	rum_pause(sc, hz / 100);
1764
1765	/* enable smart mode for MIMO-capable RFs */
1766	bbp3 = rum_bbp_read(sc, 3);
1767
1768	bbp3 &= ~RT2573_SMART_MODE;
1769	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1770		bbp3 |= RT2573_SMART_MODE;
1771
1772	rum_bbp_write(sc, 3, bbp3);
1773
1774	if (bbp94 != RT2573_BBPR94_DEFAULT)
1775		rum_bbp_write(sc, 94, bbp94);
1776
1777	/* give the chip some extra time to do the switchover */
1778	rum_pause(sc, hz / 100);
1779}
1780
1781/*
1782 * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1783 * and HostAP operating modes.
1784 */
1785static void
1786rum_enable_tsf_sync(struct rum_softc *sc)
1787{
1788	struct ifnet *ifp = sc->sc_ifp;
1789	struct ieee80211com *ic = ifp->if_l2com;
1790	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1791	uint32_t tmp;
1792
1793	if (vap->iv_opmode != IEEE80211_M_STA) {
1794		/*
1795		 * Change default 16ms TBTT adjustment to 8ms.
1796		 * Must be done before enabling beacon generation.
1797		 */
1798		rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1799	}
1800
1801	tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1802
1803	/* set beacon interval (in 1/16ms unit) */
1804	tmp |= vap->iv_bss->ni_intval * 16;
1805
1806	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1807	if (vap->iv_opmode == IEEE80211_M_STA)
1808		tmp |= RT2573_TSF_MODE(1);
1809	else
1810		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1811
1812	rum_write(sc, RT2573_TXRX_CSR9, tmp);
1813}
1814
1815static void
1816rum_update_slot(struct ifnet *ifp)
1817{
1818	struct rum_softc *sc = ifp->if_softc;
1819	struct ieee80211com *ic = ifp->if_l2com;
1820	uint8_t slottime;
1821	uint32_t tmp;
1822
1823	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1824
1825	tmp = rum_read(sc, RT2573_MAC_CSR9);
1826	tmp = (tmp & ~0xff) | slottime;
1827	rum_write(sc, RT2573_MAC_CSR9, tmp);
1828
1829	DPRINTF("setting slot time to %uus\n", slottime);
1830}
1831
1832static void
1833rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1834{
1835	uint32_t tmp;
1836
1837	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1838	rum_write(sc, RT2573_MAC_CSR4, tmp);
1839
1840	tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1841	rum_write(sc, RT2573_MAC_CSR5, tmp);
1842}
1843
1844static void
1845rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1846{
1847	uint32_t tmp;
1848
1849	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1850	rum_write(sc, RT2573_MAC_CSR2, tmp);
1851
1852	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1853	rum_write(sc, RT2573_MAC_CSR3, tmp);
1854}
1855
1856static void
1857rum_promisctask(struct usb2_proc_msg *pm)
1858{
1859	struct rum_task *task = (struct rum_task *)pm;
1860	struct rum_softc *sc = task->sc;
1861	struct ifnet *ifp = sc->sc_ifp;
1862	uint32_t tmp;
1863
1864	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1865
1866	tmp &= ~RT2573_DROP_NOT_TO_ME;
1867	if (!(ifp->if_flags & IFF_PROMISC))
1868		tmp |= RT2573_DROP_NOT_TO_ME;
1869
1870	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1871
1872	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1873	    "entering" : "leaving");
1874}
1875
1876static void
1877rum_update_mcast(struct ifnet *ifp)
1878{
1879	/* not supported */
1880}
1881
1882static void
1883rum_update_promisc(struct ifnet *ifp)
1884{
1885	struct rum_softc *sc = ifp->if_softc;
1886
1887	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
1888		return;
1889
1890	RUM_LOCK(sc);
1891	rum_queue_command(sc, rum_promisctask,
1892	    &sc->sc_promisctask[0].hdr,
1893	    &sc->sc_promisctask[1].hdr);
1894	RUM_UNLOCK(sc);
1895}
1896
1897static const char *
1898rum_get_rf(int rev)
1899{
1900	switch (rev) {
1901	case RT2573_RF_2527:	return "RT2527 (MIMO XR)";
1902	case RT2573_RF_2528:	return "RT2528";
1903	case RT2573_RF_5225:	return "RT5225 (MIMO XR)";
1904	case RT2573_RF_5226:	return "RT5226";
1905	default:		return "unknown";
1906	}
1907}
1908
1909static void
1910rum_read_eeprom(struct rum_softc *sc)
1911{
1912	uint16_t val;
1913#ifdef RUM_DEBUG
1914	int i;
1915#endif
1916
1917	/* read MAC address */
1918	rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, sc->sc_bssid, 6);
1919
1920	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1921	val = le16toh(val);
1922	sc->rf_rev =   (val >> 11) & 0x1f;
1923	sc->hw_radio = (val >> 10) & 0x1;
1924	sc->rx_ant =   (val >> 4)  & 0x3;
1925	sc->tx_ant =   (val >> 2)  & 0x3;
1926	sc->nb_ant =   val & 0x3;
1927
1928	DPRINTF("RF revision=%d\n", sc->rf_rev);
1929
1930	rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1931	val = le16toh(val);
1932	sc->ext_5ghz_lna = (val >> 6) & 0x1;
1933	sc->ext_2ghz_lna = (val >> 4) & 0x1;
1934
1935	DPRINTF("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1936	    sc->ext_2ghz_lna, sc->ext_5ghz_lna);
1937
1938	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1939	val = le16toh(val);
1940	if ((val & 0xff) != 0xff)
1941		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
1942
1943	/* Only [-10, 10] is valid */
1944	if (sc->rssi_2ghz_corr < -10 || sc->rssi_2ghz_corr > 10)
1945		sc->rssi_2ghz_corr = 0;
1946
1947	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1948	val = le16toh(val);
1949	if ((val & 0xff) != 0xff)
1950		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
1951
1952	/* Only [-10, 10] is valid */
1953	if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
1954		sc->rssi_5ghz_corr = 0;
1955
1956	if (sc->ext_2ghz_lna)
1957		sc->rssi_2ghz_corr -= 14;
1958	if (sc->ext_5ghz_lna)
1959		sc->rssi_5ghz_corr -= 14;
1960
1961	DPRINTF("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1962	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr);
1963
1964	rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1965	val = le16toh(val);
1966	if ((val & 0xff) != 0xff)
1967		sc->rffreq = val & 0xff;
1968
1969	DPRINTF("RF freq=%d\n", sc->rffreq);
1970
1971	/* read Tx power for all a/b/g channels */
1972	rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1973	/* XXX default Tx power for 802.11a channels */
1974	memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1975#ifdef RUM_DEBUG
1976	for (i = 0; i < 14; i++)
1977		DPRINTF("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]);
1978#endif
1979
1980	/* read default values for BBP registers */
1981	rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1982#ifdef RUM_DEBUG
1983	for (i = 0; i < 14; i++) {
1984		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1985			continue;
1986		DPRINTF("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1987		    sc->bbp_prom[i].val);
1988	}
1989#endif
1990}
1991
1992static int
1993rum_bbp_init(struct rum_softc *sc)
1994{
1995#define N(a)	(sizeof (a) / sizeof ((a)[0]))
1996	int i, ntries;
1997
1998	/* wait for BBP to be ready */
1999	for (ntries = 0; ntries < 100; ntries++) {
2000		const uint8_t val = rum_bbp_read(sc, 0);
2001		if (val != 0 && val != 0xff)
2002			break;
2003		if (rum_pause(sc, hz / 100))
2004			break;
2005	}
2006	if (ntries == 100) {
2007		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2008		return EIO;
2009	}
2010
2011	/* initialize BBP registers to default values */
2012	for (i = 0; i < N(rum_def_bbp); i++)
2013		rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
2014
2015	/* write vendor-specific BBP values (from EEPROM) */
2016	for (i = 0; i < 16; i++) {
2017		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
2018			continue;
2019		rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2020	}
2021
2022	return 0;
2023#undef N
2024}
2025
2026static void
2027rum_init_task(struct usb2_proc_msg *pm)
2028{
2029#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2030	struct rum_task *task = (struct rum_task *)pm;
2031	struct rum_softc *sc = task->sc;
2032	struct ifnet *ifp = sc->sc_ifp;
2033	struct ieee80211com *ic = ifp->if_l2com;
2034	uint32_t tmp;
2035	usb2_error_t error;
2036	int i, ntries;
2037
2038	RUM_LOCK_ASSERT(sc, MA_OWNED);
2039
2040	rum_stop_task(pm);
2041
2042	/* initialize MAC registers to default values */
2043	for (i = 0; i < N(rum_def_mac); i++)
2044		rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
2045
2046	/* set host ready */
2047	rum_write(sc, RT2573_MAC_CSR1, 3);
2048	rum_write(sc, RT2573_MAC_CSR1, 0);
2049
2050	/* wait for BBP/RF to wakeup */
2051	for (ntries = 0; ntries < 100; ntries++) {
2052		if (rum_read(sc, RT2573_MAC_CSR12) & 8)
2053			break;
2054		rum_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
2055		if (rum_pause(sc, hz / 100))
2056			break;
2057	}
2058	if (ntries == 100) {
2059		device_printf(sc->sc_dev,
2060		    "timeout waiting for BBP/RF to wakeup\n");
2061		goto fail;
2062	}
2063
2064	if ((error = rum_bbp_init(sc)) != 0)
2065		goto fail;
2066
2067	/* select default channel */
2068	rum_select_band(sc, ic->ic_curchan);
2069	rum_select_antenna(sc);
2070	rum_set_chan(sc, ic->ic_curchan);
2071
2072	/* clear STA registers */
2073	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2074
2075	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2076	rum_set_macaddr(sc, ic->ic_myaddr);
2077
2078	/* initialize ASIC */
2079	rum_write(sc, RT2573_MAC_CSR1, 4);
2080
2081	/*
2082	 * Allocate Tx and Rx xfer queues.
2083	 */
2084	rum_setup_tx_list(sc);
2085
2086	/* update Rx filter */
2087	tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2088
2089	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2090	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2091		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2092		       RT2573_DROP_ACKCTS;
2093		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2094			tmp |= RT2573_DROP_TODS;
2095		if (!(ifp->if_flags & IFF_PROMISC))
2096			tmp |= RT2573_DROP_NOT_TO_ME;
2097	}
2098	rum_write(sc, RT2573_TXRX_CSR0, tmp);
2099
2100	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2101	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2102	usb2_transfer_set_stall(sc->sc_xfer[RUM_BULK_WR]);
2103	usb2_transfer_start(sc->sc_xfer[RUM_BULK_RD]);
2104	return;
2105
2106fail:	rum_stop_task(pm);
2107#undef N
2108}
2109
2110static void
2111rum_init(void *priv)
2112{
2113	struct rum_softc *sc = priv;
2114	struct ifnet *ifp = sc->sc_ifp;
2115	struct ieee80211com *ic = ifp->if_l2com;
2116
2117	RUM_LOCK(sc);
2118	rum_queue_command(sc, rum_init_task,
2119	    &sc->sc_synctask[0].hdr,
2120	    &sc->sc_synctask[1].hdr);
2121	RUM_UNLOCK(sc);
2122
2123	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2124		ieee80211_start_all(ic);		/* start all vap's */
2125}
2126
2127static void
2128rum_stop_task(struct usb2_proc_msg *pm)
2129{
2130	struct rum_task *task = (struct rum_task *)pm;
2131	struct rum_softc *sc = task->sc;
2132	struct ifnet *ifp = sc->sc_ifp;
2133	uint32_t tmp;
2134
2135	RUM_LOCK_ASSERT(sc, MA_OWNED);
2136
2137	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2138
2139	RUM_UNLOCK(sc);
2140
2141	/*
2142	 * Drain the USB transfers, if not already drained:
2143	 */
2144	usb2_transfer_drain(sc->sc_xfer[RUM_BULK_WR]);
2145	usb2_transfer_drain(sc->sc_xfer[RUM_BULK_RD]);
2146
2147	RUM_LOCK(sc);
2148
2149	rum_unsetup_tx_list(sc);
2150
2151	/* disable Rx */
2152	tmp = rum_read(sc, RT2573_TXRX_CSR0);
2153	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2154
2155	/* reset ASIC */
2156	rum_write(sc, RT2573_MAC_CSR1, 3);
2157	rum_write(sc, RT2573_MAC_CSR1, 0);
2158}
2159
2160static void
2161rum_load_microcode(struct rum_softc *sc, const uint8_t *ucode, size_t size)
2162{
2163	struct usb2_device_request req;
2164	uint16_t reg = RT2573_MCU_CODE_BASE;
2165	usb2_error_t err;
2166
2167	/* copy firmware image into NIC */
2168	for (; size >= 4; reg += 4, ucode += 4, size -= 4) {
2169		err = rum_write(sc, reg, UGETDW(ucode));
2170		if (err) {
2171			/* firmware already loaded ? */
2172			device_printf(sc->sc_dev, "Firmware load "
2173			    "failure! (ignored)\n");
2174			break;
2175		}
2176	}
2177
2178	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2179	req.bRequest = RT2573_MCU_CNTL;
2180	USETW(req.wValue, RT2573_MCU_RUN);
2181	USETW(req.wIndex, 0);
2182	USETW(req.wLength, 0);
2183
2184	err = rum_do_request(sc, &req, NULL);
2185	if (err != 0) {
2186		device_printf(sc->sc_dev, "could not run firmware: %s\n",
2187		    usb2_errstr(err));
2188	}
2189
2190	/* give the chip some time to boot */
2191	rum_pause(sc, hz / 8);
2192}
2193
2194static int
2195rum_prepare_beacon(struct rum_softc *sc, struct ieee80211vap *vap)
2196{
2197	struct ieee80211com *ic = vap->iv_ic;
2198	const struct ieee80211_txparam *tp;
2199	struct rum_tx_desc desc;
2200	struct mbuf *m0;
2201
2202	m0 = ieee80211_beacon_alloc(vap->iv_bss, &RUM_VAP(vap)->bo);
2203	if (m0 == NULL) {
2204		return ENOBUFS;
2205	}
2206
2207	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2208	rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2209	    m0->m_pkthdr.len, tp->mgmtrate);
2210
2211	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2212	rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2213
2214	/* copy beacon header and payload into NIC memory */
2215	rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2216	    m0->m_pkthdr.len);
2217
2218	m_freem(m0);
2219
2220	return 0;
2221}
2222
2223static int
2224rum_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2225    const struct ieee80211_bpf_params *params)
2226{
2227	struct ifnet *ifp = ni->ni_ic->ic_ifp;
2228	struct rum_softc *sc = ifp->if_softc;
2229
2230	RUM_LOCK(sc);
2231	/* prevent management frames from being sent if we're not ready */
2232	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2233		RUM_UNLOCK(sc);
2234		m_freem(m);
2235		ieee80211_free_node(ni);
2236		return ENETDOWN;
2237	}
2238	if (sc->tx_nfree < RUM_TX_MINFREE) {
2239		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2240		RUM_UNLOCK(sc);
2241		m_freem(m);
2242		ieee80211_free_node(ni);
2243		return EIO;
2244	}
2245
2246	ifp->if_opackets++;
2247
2248	if (params == NULL) {
2249		/*
2250		 * Legacy path; interpret frame contents to decide
2251		 * precisely how to send the frame.
2252		 */
2253		if (rum_tx_mgt(sc, m, ni) != 0)
2254			goto bad;
2255	} else {
2256		/*
2257		 * Caller supplied explicit parameters to use in
2258		 * sending the frame.
2259		 */
2260		if (rum_tx_raw(sc, m, ni, params) != 0)
2261			goto bad;
2262	}
2263	RUM_UNLOCK(sc);
2264
2265	return 0;
2266bad:
2267	ifp->if_oerrors++;
2268	RUM_UNLOCK(sc);
2269	ieee80211_free_node(ni);
2270	return EIO;
2271}
2272
2273static void
2274rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
2275{
2276	struct ieee80211vap *vap = ni->ni_vap;
2277	struct rum_vap *rvp = RUM_VAP(vap);
2278
2279	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2280	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2281
2282	ieee80211_amrr_node_init(&rvp->amrr, &RUM_NODE(ni)->amn, ni);
2283
2284	usb2_callout_reset(&rvp->amrr_ch, hz, rum_amrr_timeout, rvp);
2285}
2286
2287static void
2288rum_amrr_timeout(void *arg)
2289{
2290	struct rum_vap *rvp = arg;
2291	struct rum_softc *sc = rvp->sc;
2292
2293	rum_queue_command(sc, rum_amrr_task,
2294	    &rvp->amrr_task[0].hdr, &rvp->amrr_task[1].hdr);
2295}
2296
2297static void
2298rum_amrr_task(struct usb2_proc_msg *pm)
2299{
2300	struct rum_task *task = (struct rum_task *)pm;
2301	struct rum_softc *sc = task->sc;
2302	struct ifnet *ifp = sc->sc_ifp;
2303	struct ieee80211com *ic = ifp->if_l2com;
2304	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2305	struct rum_vap *rvp = RUM_VAP(vap);
2306	struct ieee80211_node *ni = vap->iv_bss;
2307	int ok, fail;
2308
2309	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2310	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof(sc->sta));
2311
2312	ok = (le32toh(sc->sta[4]) >> 16) +	/* TX ok w/o retry */
2313	    (le32toh(sc->sta[5]) & 0xffff);	/* TX ok w/ retry */
2314	fail = (le32toh(sc->sta[5]) >> 16);	/* TX retry-fail count */
2315
2316	ieee80211_amrr_tx_update(&RUM_NODE(ni)->amn,
2317	    ok+fail, ok, (le32toh(sc->sta[5]) & 0xffff) + fail);
2318	(void) ieee80211_amrr_choose(ni, &RUM_NODE(ni)->amn);
2319
2320	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2321
2322	usb2_callout_reset(&rvp->amrr_ch, hz, rum_amrr_timeout, rvp);
2323}
2324
2325/* ARGUSED */
2326static struct ieee80211_node *
2327rum_node_alloc(struct ieee80211vap *vap __unused,
2328	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2329{
2330	struct rum_node *rn;
2331
2332	rn = malloc(sizeof(struct rum_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2333	return rn != NULL ? &rn->ni : NULL;
2334}
2335
2336static void
2337rum_newassoc(struct ieee80211_node *ni, int isnew)
2338{
2339	struct ieee80211vap *vap = ni->ni_vap;
2340
2341	ieee80211_amrr_node_init(&RUM_VAP(vap)->amrr, &RUM_NODE(ni)->amn, ni);
2342}
2343
2344static void
2345rum_scan_start(struct ieee80211com *ic)
2346{
2347	struct rum_softc *sc = ic->ic_ifp->if_softc;
2348
2349	RUM_LOCK(sc);
2350	/* do it in a process context */
2351	sc->sc_scan_action = RUM_SCAN_START;
2352	rum_queue_command(sc, rum_scantask,
2353	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
2354	RUM_UNLOCK(sc);
2355
2356}
2357
2358static void
2359rum_scan_end(struct ieee80211com *ic)
2360{
2361	struct rum_softc *sc = ic->ic_ifp->if_softc;
2362
2363	RUM_LOCK(sc);
2364	/* do it in a process context */
2365	sc->sc_scan_action = RUM_SCAN_END;
2366	rum_queue_command(sc, rum_scantask,
2367	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
2368	RUM_UNLOCK(sc);
2369
2370}
2371
2372static void
2373rum_set_channel(struct ieee80211com *ic)
2374{
2375	struct rum_softc *sc = ic->ic_ifp->if_softc;
2376
2377	RUM_LOCK(sc);
2378	/* do it in a process context */
2379	sc->sc_scan_action = RUM_SET_CHANNEL;
2380	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
2381	rum_queue_command(sc, rum_scantask,
2382	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
2383	RUM_UNLOCK(sc);
2384}
2385
2386static void
2387rum_scantask(struct usb2_proc_msg *pm)
2388{
2389	struct rum_task *task = (struct rum_task *)pm;
2390	struct rum_softc *sc = task->sc;
2391	struct ifnet *ifp = sc->sc_ifp;
2392	struct ieee80211com *ic = ifp->if_l2com;
2393	uint32_t tmp;
2394
2395	RUM_LOCK_ASSERT(sc, MA_OWNED);
2396
2397	switch (sc->sc_scan_action) {
2398	case RUM_SCAN_START:
2399		/* abort TSF synchronization */
2400		tmp = rum_read(sc, RT2573_TXRX_CSR9);
2401		rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
2402		rum_set_bssid(sc, ifp->if_broadcastaddr);
2403		break;
2404
2405	case RUM_SET_CHANNEL:
2406		rum_set_chan(sc, ic->ic_curchan);
2407		break;
2408
2409	default: /* RUM_SCAN_END */
2410		rum_enable_tsf_sync(sc);
2411		rum_set_bssid(sc, sc->sc_bssid);
2412		break;
2413	}
2414}
2415
2416static int
2417rum_get_rssi(struct rum_softc *sc, uint8_t raw)
2418{
2419	struct ifnet *ifp = sc->sc_ifp;
2420	struct ieee80211com *ic = ifp->if_l2com;
2421	int lna, agc, rssi;
2422
2423	lna = (raw >> 5) & 0x3;
2424	agc = raw & 0x1f;
2425
2426	if (lna == 0) {
2427		/*
2428		 * No RSSI mapping
2429		 *
2430		 * NB: Since RSSI is relative to noise floor, -1 is
2431		 *     adequate for caller to know error happened.
2432		 */
2433		return -1;
2434	}
2435
2436	rssi = (2 * agc) - RT2573_NOISE_FLOOR;
2437
2438	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
2439		rssi += sc->rssi_2ghz_corr;
2440
2441		if (lna == 1)
2442			rssi -= 64;
2443		else if (lna == 2)
2444			rssi -= 74;
2445		else if (lna == 3)
2446			rssi -= 90;
2447	} else {
2448		rssi += sc->rssi_5ghz_corr;
2449
2450		if (!sc->ext_5ghz_lna && lna != 1)
2451			rssi += 4;
2452
2453		if (lna == 1)
2454			rssi -= 64;
2455		else if (lna == 2)
2456			rssi -= 86;
2457		else if (lna == 3)
2458			rssi -= 100;
2459	}
2460	return rssi;
2461}
2462
2463static int
2464rum_pause(struct rum_softc *sc, int timeout)
2465{
2466	if (usb2_proc_is_gone(&sc->sc_tq))
2467		return (1);
2468
2469	usb2_pause_mtx(&sc->sc_mtx, timeout);
2470	return (0);
2471}
2472
2473static void
2474rum_command_wrapper(struct usb2_proc_msg *pm)
2475{
2476	struct rum_task *task = (struct rum_task *)pm;
2477	struct rum_softc *sc = task->sc;
2478	struct ifnet *ifp;
2479
2480	/* wait for pending transfer, if any */
2481	while (usb2_transfer_pending(sc->sc_xfer[RUM_BULK_WR]))
2482		cv_wait(&sc->sc_cmd_cv, &sc->sc_mtx);
2483
2484	/* make sure any hardware buffers are emptied */
2485	rum_pause(sc, hz / 1000);
2486
2487	/* execute task */
2488	task->func(pm);
2489
2490	/* check if this is the last task executed */
2491	if (sc->sc_last_task == task) {
2492		sc->sc_last_task = NULL;
2493		ifp = sc->sc_ifp;
2494		/* re-start TX, if any */
2495		if ((ifp != NULL) && (ifp->if_drv_flags & IFF_DRV_RUNNING))
2496			usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
2497	}
2498}
2499
2500static void
2501rum_queue_command(struct rum_softc *sc, usb2_proc_callback_t *fn,
2502    struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2503{
2504	struct rum_task *task;
2505
2506	RUM_LOCK_ASSERT(sc, MA_OWNED);
2507
2508	/*
2509	 * NOTE: The task cannot get executed before we drop the
2510	 * "sc_mtx" mutex. It is safe to update fields in the message
2511	 * structure after that the message got queued.
2512	 */
2513	task = (struct rum_task *)
2514	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2515
2516	/* Setup callback and softc pointers */
2517	task->hdr.pm_callback = rum_command_wrapper;
2518	task->func = fn;
2519	task->sc = sc;
2520
2521	/* Make sure that any TX operation will stop */
2522	sc->sc_last_task = task;
2523
2524	/*
2525	 * Init, stop and flush must be synchronous!
2526	 */
2527	if ((fn == rum_init_task) || (fn == rum_stop_task) ||
2528	    (fn == rum_flush_task))
2529		usb2_proc_mwait(&sc->sc_tq, t0, t1);
2530}
2531
2532static device_method_t rum_methods[] = {
2533	/* Device interface */
2534	DEVMETHOD(device_probe,		rum_match),
2535	DEVMETHOD(device_attach,	rum_attach),
2536	DEVMETHOD(device_detach,	rum_detach),
2537
2538	{ 0, 0 }
2539};
2540
2541static driver_t rum_driver = {
2542	.name = "rum",
2543	.methods = rum_methods,
2544	.size = sizeof(struct rum_softc),
2545};
2546
2547static devclass_t rum_devclass;
2548
2549DRIVER_MODULE(rum, ushub, rum_driver, rum_devclass, NULL, 0);
2550