if_rum.c revision 1.20
1/*	$OpenBSD: if_rum.c,v 1.40 2006/09/18 16:20:20 damien Exp $	*/
2/*	$NetBSD: if_rum.c,v 1.20 2008/04/05 16:35:35 cegger Exp $	*/
3
4/*-
5 * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
6 * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21/*-
22 * Ralink Technology RT2501USB/RT2601USB chipset driver
23 * http://www.ralinktech.com.tw/
24 */
25
26#include <sys/cdefs.h>
27__KERNEL_RCSID(0, "$NetBSD: if_rum.c,v 1.20 2008/04/05 16:35:35 cegger Exp $");
28
29#include "bpfilter.h"
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/mbuf.h>
35#include <sys/kernel.h>
36#include <sys/socket.h>
37#include <sys/systm.h>
38#include <sys/malloc.h>
39#include <sys/conf.h>
40#include <sys/device.h>
41
42#include <sys/bus.h>
43#include <machine/endian.h>
44#include <sys/intr.h>
45
46#if NBPFILTER > 0
47#include <net/bpf.h>
48#endif
49#include <net/if.h>
50#include <net/if_arp.h>
51#include <net/if_dl.h>
52#include <net/if_ether.h>
53#include <net/if_media.h>
54#include <net/if_types.h>
55
56#include <netinet/in.h>
57#include <netinet/in_systm.h>
58#include <netinet/in_var.h>
59#include <netinet/ip.h>
60
61#include <net80211/ieee80211_netbsd.h>
62#include <net80211/ieee80211_var.h>
63#include <net80211/ieee80211_amrr.h>
64#include <net80211/ieee80211_radiotap.h>
65
66#include <dev/firmload.h>
67
68#include <dev/usb/usb.h>
69#include <dev/usb/usbdi.h>
70#include <dev/usb/usbdi_util.h>
71#include <dev/usb/usbdevs.h>
72
73#include <dev/usb/if_rumreg.h>
74#include <dev/usb/if_rumvar.h>
75
76#ifdef USB_DEBUG
77#define RUM_DEBUG
78#endif
79
80#ifdef RUM_DEBUG
81#define DPRINTF(x)	do { if (rum_debug) logprintf x; } while (0)
82#define DPRINTFN(n, x)	do { if (rum_debug >= (n)) logprintf x; } while (0)
83int rum_debug = 1;
84#else
85#define DPRINTF(x)
86#define DPRINTFN(n, x)
87#endif
88
89/* various supported device vendors/products */
90static const struct usb_devno rum_devs[] = {
91	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_HWU54DM },
92	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_2 },
93	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_3 },
94	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_4 },
95	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_WUG2700 },
96	{ USB_VENDOR_AMIT,		USB_PRODUCT_AMIT_CGWLUSB2GO },
97	{ USB_VENDOR_ASUSTEK,		USB_PRODUCT_ASUSTEK_WL167G_2 },
98	{ USB_VENDOR_ASUSTEK,		USB_PRODUCT_ASUSTEK_WL167G_3 },
99	{ USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D7050A },
100	{ USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D9050V3 },
101	{ USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GC },
102	{ USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GR },
103	{ USB_VENDOR_CONCEPTRONIC,	USB_PRODUCT_CONCEPTRONIC_C54RU2 },
104	{ USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GL },
105	{ USB_VENDOR_DICKSMITH,		USB_PRODUCT_DICKSMITH_CWD854F },
106	{ USB_VENDOR_DICKSMITH,		USB_PRODUCT_DICKSMITH_RT2573 },
107	{ USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWLG122C1 },
108	{ USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_WUA1340 },
109	{ USB_VENDOR_GIGABYTE,		USB_PRODUCT_GIGABYTE_GNWB01GS },
110	{ USB_VENDOR_GIGABYTE,		USB_PRODUCT_GIGABYTE_GNWI05GS },
111	{ USB_VENDOR_GIGASET,		USB_PRODUCT_GIGASET_RT2573 },
112	{ USB_VENDOR_GOODWAY,		USB_PRODUCT_GOODWAY_RT2573 },
113	{ USB_VENDOR_GUILLEMOT,		USB_PRODUCT_GUILLEMOT_HWGUSB254LB },
114	{ USB_VENDOR_GUILLEMOT,		USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP },
115	{ USB_VENDOR_HUAWEI3COM,	USB_PRODUCT_HUAWEI3COM_RT2573 },
116	{ USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_G54HP },
117	{ USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_SG54HP },
118	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573 },
119	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_2 },
120	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_3 },
121	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_4 },
122	{ USB_VENDOR_NOVATECH,		USB_PRODUCT_NOVATECH_RT2573 },
123	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUS54HP },
124	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUS54MINI2 },
125	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUSMM },
126	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573 },
127	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573_2 },
128	{ USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573 },
129	{ USB_VENDOR_RALINK_2,          USB_PRODUCT_RALINK_2_RT2573 },
130	{ USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2671 },
131	{ USB_VENDOR_SITECOMEU,		USB_PRODUCT_SITECOMEU_WL113R2 },
132	{ USB_VENDOR_SITECOMEU,		USB_PRODUCT_SITECOMEU_WL172 },
133	{ USB_VENDOR_SURECOM,		USB_PRODUCT_SURECOM_RT2573 }
134};
135
136Static int		rum_attachhook(void *);
137Static int		rum_alloc_tx_list(struct rum_softc *);
138Static void		rum_free_tx_list(struct rum_softc *);
139Static int		rum_alloc_rx_list(struct rum_softc *);
140Static void		rum_free_rx_list(struct rum_softc *);
141Static int		rum_media_change(struct ifnet *);
142Static void		rum_next_scan(void *);
143Static void		rum_task(void *);
144Static int		rum_newstate(struct ieee80211com *,
145			    enum ieee80211_state, int);
146Static void		rum_txeof(usbd_xfer_handle, usbd_private_handle,
147			    usbd_status);
148Static void		rum_rxeof(usbd_xfer_handle, usbd_private_handle,
149			    usbd_status);
150#if NBPFILTER > 0
151Static uint8_t		rum_rxrate(const struct rum_rx_desc *);
152#endif
153Static int		rum_ack_rate(struct ieee80211com *, int);
154Static uint16_t		rum_txtime(int, int, uint32_t);
155Static uint8_t		rum_plcp_signal(int);
156Static void		rum_setup_tx_desc(struct rum_softc *,
157			    struct rum_tx_desc *, uint32_t, uint16_t, int,
158			    int);
159Static int		rum_tx_mgt(struct rum_softc *, struct mbuf *,
160			    struct ieee80211_node *);
161Static int		rum_tx_data(struct rum_softc *, struct mbuf *,
162			    struct ieee80211_node *);
163Static void		rum_start(struct ifnet *);
164Static void		rum_watchdog(struct ifnet *);
165Static int		rum_ioctl(struct ifnet *, u_long, void *);
166Static void		rum_eeprom_read(struct rum_softc *, uint16_t, void *,
167			    int);
168Static uint32_t		rum_read(struct rum_softc *, uint16_t);
169Static void		rum_read_multi(struct rum_softc *, uint16_t, void *,
170			    int);
171Static void		rum_write(struct rum_softc *, uint16_t, uint32_t);
172Static void		rum_write_multi(struct rum_softc *, uint16_t, void *,
173			    size_t);
174Static void		rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
175Static uint8_t		rum_bbp_read(struct rum_softc *, uint8_t);
176Static void		rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
177Static void		rum_select_antenna(struct rum_softc *);
178Static void		rum_enable_mrr(struct rum_softc *);
179Static void		rum_set_txpreamble(struct rum_softc *);
180Static void		rum_set_basicrates(struct rum_softc *);
181Static void		rum_select_band(struct rum_softc *,
182			    struct ieee80211_channel *);
183Static void		rum_set_chan(struct rum_softc *,
184			    struct ieee80211_channel *);
185Static void		rum_enable_tsf_sync(struct rum_softc *);
186Static void		rum_update_slot(struct rum_softc *);
187Static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
188Static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
189Static void		rum_update_promisc(struct rum_softc *);
190Static const char	*rum_get_rf(int);
191Static void		rum_read_eeprom(struct rum_softc *);
192Static int		rum_bbp_init(struct rum_softc *);
193Static int		rum_init(struct ifnet *);
194Static void		rum_stop(struct ifnet *, int);
195Static int		rum_load_microcode(struct rum_softc *, const u_char *,
196			    size_t);
197Static int		rum_prepare_beacon(struct rum_softc *);
198Static void		rum_newassoc(struct ieee80211_node *, int);
199Static void		rum_amrr_start(struct rum_softc *,
200			    struct ieee80211_node *);
201Static void		rum_amrr_timeout(void *);
202Static void		rum_amrr_update(usbd_xfer_handle, usbd_private_handle,
203			    usbd_status status);
204
205/*
206 * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
207 */
208static const struct ieee80211_rateset rum_rateset_11a =
209	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
210
211static const struct ieee80211_rateset rum_rateset_11b =
212	{ 4, { 2, 4, 11, 22 } };
213
214static const struct ieee80211_rateset rum_rateset_11g =
215	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
216
217static const struct {
218	uint32_t	reg;
219	uint32_t	val;
220} rum_def_mac[] = {
221	RT2573_DEF_MAC
222};
223
224static const struct {
225	uint8_t	reg;
226	uint8_t	val;
227} rum_def_bbp[] = {
228	RT2573_DEF_BBP
229};
230
231static const struct rfprog {
232	uint8_t		chan;
233	uint32_t	r1, r2, r3, r4;
234}  rum_rf5226[] = {
235	RT2573_RF5226
236}, rum_rf5225[] = {
237	RT2573_RF5225
238};
239
240USB_DECLARE_DRIVER(rum);
241
242USB_MATCH(rum)
243{
244	USB_MATCH_START(rum, uaa);
245
246	return (usb_lookup(rum_devs, uaa->vendor, uaa->product) != NULL) ?
247	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
248}
249
250Static int
251rum_attachhook(void *xsc)
252{
253	struct rum_softc *sc = xsc;
254	firmware_handle_t fwh;
255	const char *name = "rum-rt2573";
256	u_char *ucode;
257	size_t size;
258	int error;
259
260	if ((error = firmware_open("rum", name, &fwh)) != 0) {
261		printf("%s: failed loadfirmware of file %s (error %d)\n",
262		    USBDEVNAME(sc->sc_dev), name, error);
263		return error;
264	}
265	size = firmware_get_size(fwh);
266	ucode = firmware_malloc(size);
267	if (ucode == NULL) {
268		printf("%s: failed to allocate firmware memory\n",
269		    USBDEVNAME(sc->sc_dev));
270		firmware_close(fwh);
271		return ENOMEM;;
272	}
273	error = firmware_read(fwh, 0, ucode, size);
274	firmware_close(fwh);
275	if (error != 0) {
276		printf("%s: failed to read firmware (error %d)\n",
277		    USBDEVNAME(sc->sc_dev), error);
278		firmware_free(ucode, 0);
279		return error;
280	}
281
282	if (rum_load_microcode(sc, ucode, size) != 0) {
283		printf("%s: could not load 8051 microcode\n",
284		    USBDEVNAME(sc->sc_dev));
285		firmware_free(ucode, 0);
286		return ENXIO;
287	}
288
289	firmware_free(ucode, 0);
290	sc->sc_flags |= RT2573_FWLOADED;
291
292	return 0;
293}
294
295USB_ATTACH(rum)
296{
297	USB_ATTACH_START(rum, sc, uaa);
298	struct ieee80211com *ic = &sc->sc_ic;
299	struct ifnet *ifp = &sc->sc_if;
300	usb_interface_descriptor_t *id;
301	usb_endpoint_descriptor_t *ed;
302	usbd_status error;
303	char *devinfop;
304	int i, ntries;
305	uint32_t tmp;
306
307	sc->sc_udev = uaa->device;
308	sc->sc_flags = 0;
309
310	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
311	USB_ATTACH_SETUP;
312	printf("%s: %s\n", USBDEVNAME(sc->sc_dev), devinfop);
313	usbd_devinfo_free(devinfop);
314
315	if (usbd_set_config_no(sc->sc_udev, RT2573_CONFIG_NO, 0) != 0) {
316		printf("%s: could not set configuration no\n",
317		    USBDEVNAME(sc->sc_dev));
318		USB_ATTACH_ERROR_RETURN;
319	}
320
321	/* get the first interface handle */
322	error = usbd_device2interface_handle(sc->sc_udev, RT2573_IFACE_INDEX,
323	    &sc->sc_iface);
324	if (error != 0) {
325		printf("%s: could not get interface handle\n",
326		    USBDEVNAME(sc->sc_dev));
327		USB_ATTACH_ERROR_RETURN;
328	}
329
330	/*
331	 * Find endpoints.
332	 */
333	id = usbd_get_interface_descriptor(sc->sc_iface);
334
335	sc->sc_rx_no = sc->sc_tx_no = -1;
336	for (i = 0; i < id->bNumEndpoints; i++) {
337		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
338		if (ed == NULL) {
339			printf("%s: no endpoint descriptor for iface %d\n",
340			    USBDEVNAME(sc->sc_dev), i);
341			USB_ATTACH_ERROR_RETURN;
342		}
343
344		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
345		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
346			sc->sc_rx_no = ed->bEndpointAddress;
347		else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
348		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
349			sc->sc_tx_no = ed->bEndpointAddress;
350	}
351	if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
352		printf("%s: missing endpoint\n", USBDEVNAME(sc->sc_dev));
353		USB_ATTACH_ERROR_RETURN;
354	}
355
356	usb_init_task(&sc->sc_task, rum_task, sc);
357	usb_callout_init(sc->sc_scan_ch);
358
359	sc->amrr.amrr_min_success_threshold =  1;
360	sc->amrr.amrr_max_success_threshold = 10;
361	usb_callout_init(sc->sc_amrr_ch);
362
363	/* retrieve RT2573 rev. no */
364	for (ntries = 0; ntries < 1000; ntries++) {
365		if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
366			break;
367		DELAY(1000);
368	}
369	if (ntries == 1000) {
370		printf("%s: timeout waiting for chip to settle\n",
371		    USBDEVNAME(sc->sc_dev));
372		USB_ATTACH_ERROR_RETURN;
373	}
374
375	/* retrieve MAC address and various other things from EEPROM */
376	rum_read_eeprom(sc);
377
378	printf("%s: MAC/BBP RT%04x (rev 0x%05x), RF %s, address %s\n",
379	    USBDEVNAME(sc->sc_dev), sc->macbbp_rev, tmp,
380	    rum_get_rf(sc->rf_rev), ether_sprintf(ic->ic_myaddr));
381
382	ic->ic_ifp = ifp;
383	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
384	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
385	ic->ic_state = IEEE80211_S_INIT;
386
387	/* set device capabilities */
388	ic->ic_caps =
389	    IEEE80211_C_IBSS |		/* IBSS mode supported */
390	    IEEE80211_C_MONITOR |	/* monitor mode supported */
391	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
392	    IEEE80211_C_TXPMGT |	/* tx power management */
393	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
394	    IEEE80211_C_SHSLOT |	/* short slot time supported */
395	    IEEE80211_C_WPA;		/* 802.11i */
396
397	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
398		/* set supported .11a rates */
399		ic->ic_sup_rates[IEEE80211_MODE_11A] = rum_rateset_11a;
400
401		/* set supported .11a channels */
402		for (i = 34; i <= 46; i += 4) {
403			ic->ic_channels[i].ic_freq =
404			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
405			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
406		}
407		for (i = 36; i <= 64; i += 4) {
408			ic->ic_channels[i].ic_freq =
409			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
410			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
411		}
412		for (i = 100; i <= 140; i += 4) {
413			ic->ic_channels[i].ic_freq =
414			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
415			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
416		}
417		for (i = 149; i <= 165; i += 4) {
418			ic->ic_channels[i].ic_freq =
419			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
420			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
421		}
422	}
423
424	/* set supported .11b and .11g rates */
425	ic->ic_sup_rates[IEEE80211_MODE_11B] = rum_rateset_11b;
426	ic->ic_sup_rates[IEEE80211_MODE_11G] = rum_rateset_11g;
427
428	/* set supported .11b and .11g channels (1 through 14) */
429	for (i = 1; i <= 14; i++) {
430		ic->ic_channels[i].ic_freq =
431		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
432		ic->ic_channels[i].ic_flags =
433		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
434		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
435	}
436
437	ifp->if_softc = sc;
438	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
439	ifp->if_init = rum_init;
440	ifp->if_ioctl = rum_ioctl;
441	ifp->if_start = rum_start;
442	ifp->if_watchdog = rum_watchdog;
443	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
444	IFQ_SET_READY(&ifp->if_snd);
445	memcpy(ifp->if_xname, USBDEVNAME(sc->sc_dev), IFNAMSIZ);
446
447	if_attach(ifp);
448	ieee80211_ifattach(ic);
449	ic->ic_newassoc = rum_newassoc;
450
451	/* override state transition machine */
452	sc->sc_newstate = ic->ic_newstate;
453	ic->ic_newstate = rum_newstate;
454	ieee80211_media_init(ic, rum_media_change, ieee80211_media_status);
455
456#if NBPFILTER > 0
457	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
458	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN, &sc->sc_drvbpf);
459
460	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
461	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
462	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
463
464	sc->sc_txtap_len = sizeof sc->sc_txtapu;
465	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
466	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
467#endif
468
469	ieee80211_announce(ic);
470
471	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
472	    USBDEV(sc->sc_dev));
473
474	USB_ATTACH_SUCCESS_RETURN;
475}
476
477USB_DETACH(rum)
478{
479	USB_DETACH_START(rum, sc);
480	struct ieee80211com *ic = &sc->sc_ic;
481	struct ifnet *ifp = &sc->sc_if;
482	int s;
483
484	if (!ifp->if_softc)
485		return 0;
486
487	s = splusb();
488
489	rum_stop(ifp, 1);
490	usb_rem_task(sc->sc_udev, &sc->sc_task);
491	usb_uncallout(sc->sc_scan_ch, rum_next_scan, sc);
492	usb_uncallout(sc->sc_amrr_ch, rum_amrr_timeout, sc);
493
494	if (sc->amrr_xfer != NULL) {
495		usbd_free_xfer(sc->amrr_xfer);
496		sc->amrr_xfer = NULL;
497	}
498
499	if (sc->sc_rx_pipeh != NULL) {
500		usbd_abort_pipe(sc->sc_rx_pipeh);
501		usbd_close_pipe(sc->sc_rx_pipeh);
502	}
503
504	if (sc->sc_tx_pipeh != NULL) {
505		usbd_abort_pipe(sc->sc_tx_pipeh);
506		usbd_close_pipe(sc->sc_tx_pipeh);
507	}
508
509#if NBPFILTER > 0
510	bpfdetach(ifp);
511#endif
512	ieee80211_ifdetach(ic);	/* free all nodes */
513	if_detach(ifp);
514
515	splx(s);
516
517	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
518	    USBDEV(sc->sc_dev));
519
520	return 0;
521}
522
523Static int
524rum_alloc_tx_list(struct rum_softc *sc)
525{
526	struct rum_tx_data *data;
527	int i, error;
528
529	sc->tx_queued = 0;
530
531	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
532		data = &sc->tx_data[i];
533
534		data->sc = sc;
535
536		data->xfer = usbd_alloc_xfer(sc->sc_udev);
537		if (data->xfer == NULL) {
538			printf("%s: could not allocate tx xfer\n",
539			    USBDEVNAME(sc->sc_dev));
540			error = ENOMEM;
541			goto fail;
542		}
543
544		data->buf = usbd_alloc_buffer(data->xfer,
545		    RT2573_TX_DESC_SIZE + MCLBYTES);
546		if (data->buf == NULL) {
547			printf("%s: could not allocate tx buffer\n",
548			    USBDEVNAME(sc->sc_dev));
549			error = ENOMEM;
550			goto fail;
551		}
552
553		/* clean Tx descriptor */
554		bzero(data->buf, RT2573_TX_DESC_SIZE);
555	}
556
557	return 0;
558
559fail:	rum_free_tx_list(sc);
560	return error;
561}
562
563Static void
564rum_free_tx_list(struct rum_softc *sc)
565{
566	struct rum_tx_data *data;
567	int i;
568
569	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
570		data = &sc->tx_data[i];
571
572		if (data->xfer != NULL) {
573			usbd_free_xfer(data->xfer);
574			data->xfer = NULL;
575		}
576
577		if (data->ni != NULL) {
578			ieee80211_free_node(data->ni);
579			data->ni = NULL;
580		}
581	}
582}
583
584Static int
585rum_alloc_rx_list(struct rum_softc *sc)
586{
587	struct rum_rx_data *data;
588	int i, error;
589
590	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
591		data = &sc->rx_data[i];
592
593		data->sc = sc;
594
595		data->xfer = usbd_alloc_xfer(sc->sc_udev);
596		if (data->xfer == NULL) {
597			printf("%s: could not allocate rx xfer\n",
598			    USBDEVNAME(sc->sc_dev));
599			error = ENOMEM;
600			goto fail;
601		}
602
603		if (usbd_alloc_buffer(data->xfer, MCLBYTES) == NULL) {
604			printf("%s: could not allocate rx buffer\n",
605			    USBDEVNAME(sc->sc_dev));
606			error = ENOMEM;
607			goto fail;
608		}
609
610		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
611		if (data->m == NULL) {
612			printf("%s: could not allocate rx mbuf\n",
613			    USBDEVNAME(sc->sc_dev));
614			error = ENOMEM;
615			goto fail;
616		}
617
618		MCLGET(data->m, M_DONTWAIT);
619		if (!(data->m->m_flags & M_EXT)) {
620			printf("%s: could not allocate rx mbuf cluster\n",
621			    USBDEVNAME(sc->sc_dev));
622			error = ENOMEM;
623			goto fail;
624		}
625
626		data->buf = mtod(data->m, uint8_t *);
627	}
628
629	return 0;
630
631fail:	rum_free_tx_list(sc);
632	return error;
633}
634
635Static void
636rum_free_rx_list(struct rum_softc *sc)
637{
638	struct rum_rx_data *data;
639	int i;
640
641	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
642		data = &sc->rx_data[i];
643
644		if (data->xfer != NULL) {
645			usbd_free_xfer(data->xfer);
646			data->xfer = NULL;
647		}
648
649		if (data->m != NULL) {
650			m_freem(data->m);
651			data->m = NULL;
652		}
653	}
654}
655
656Static int
657rum_media_change(struct ifnet *ifp)
658{
659	int error;
660
661	error = ieee80211_media_change(ifp);
662	if (error != ENETRESET)
663		return error;
664
665	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
666		rum_init(ifp);
667
668	return 0;
669}
670
671/*
672 * This function is called periodically (every 200ms) during scanning to
673 * switch from one channel to another.
674 */
675Static void
676rum_next_scan(void *arg)
677{
678	struct rum_softc *sc = arg;
679	struct ieee80211com *ic = &sc->sc_ic;
680
681	if (ic->ic_state == IEEE80211_S_SCAN)
682		ieee80211_next_scan(ic);
683}
684
685Static void
686rum_task(void *arg)
687{
688	struct rum_softc *sc = arg;
689	struct ieee80211com *ic = &sc->sc_ic;
690	enum ieee80211_state ostate;
691	struct ieee80211_node *ni;
692	uint32_t tmp;
693
694	ostate = ic->ic_state;
695
696	switch (sc->sc_state) {
697	case IEEE80211_S_INIT:
698		if (ostate == IEEE80211_S_RUN) {
699			/* abort TSF synchronization */
700			tmp = rum_read(sc, RT2573_TXRX_CSR9);
701			rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
702		}
703		break;
704
705	case IEEE80211_S_SCAN:
706		rum_set_chan(sc, ic->ic_curchan);
707		usb_callout(sc->sc_scan_ch, hz / 5, rum_next_scan, sc);
708		break;
709
710	case IEEE80211_S_AUTH:
711		rum_set_chan(sc, ic->ic_curchan);
712		break;
713
714	case IEEE80211_S_ASSOC:
715		rum_set_chan(sc, ic->ic_curchan);
716		break;
717
718	case IEEE80211_S_RUN:
719		rum_set_chan(sc, ic->ic_curchan);
720
721		ni = ic->ic_bss;
722
723		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
724			rum_update_slot(sc);
725			rum_enable_mrr(sc);
726			rum_set_txpreamble(sc);
727			rum_set_basicrates(sc);
728			rum_set_bssid(sc, ni->ni_bssid);
729		}
730
731		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
732		    ic->ic_opmode == IEEE80211_M_IBSS)
733			rum_prepare_beacon(sc);
734
735		if (ic->ic_opmode != IEEE80211_M_MONITOR)
736			rum_enable_tsf_sync(sc);
737
738		if (ic->ic_opmode == IEEE80211_M_STA) {
739			/* fake a join to init the tx rate */
740			rum_newassoc(ic->ic_bss, 1);
741
742			/* enable automatic rate adaptation in STA mode */
743			if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
744				rum_amrr_start(sc, ni);
745		}
746
747		break;
748	}
749
750	sc->sc_newstate(ic, sc->sc_state, -1);
751}
752
753Static int
754rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
755{
756	struct rum_softc *sc = ic->ic_ifp->if_softc;
757
758	usb_rem_task(sc->sc_udev, &sc->sc_task);
759	usb_uncallout(sc->sc_scan_ch, rum_next_scan, sc);
760	usb_uncallout(sc->sc_amrr_ch, rum_amrr_timeout, sc);
761
762	/* do it in a process context */
763	sc->sc_state = nstate;
764	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
765
766	return 0;
767}
768
769/* quickly determine if a given rate is CCK or OFDM */
770#define RUM_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
771
772#define RUM_ACK_SIZE	14	/* 10 + 4(FCS) */
773#define RUM_CTS_SIZE	14	/* 10 + 4(FCS) */
774
775Static void
776rum_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
777{
778	struct rum_tx_data *data = priv;
779	struct rum_softc *sc = data->sc;
780	struct ifnet *ifp = &sc->sc_if;
781	int s;
782
783	if (status != USBD_NORMAL_COMPLETION) {
784		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
785			return;
786
787		printf("%s: could not transmit buffer: %s\n",
788		    USBDEVNAME(sc->sc_dev), usbd_errstr(status));
789
790		if (status == USBD_STALLED)
791			usbd_clear_endpoint_stall_async(sc->sc_tx_pipeh);
792
793		ifp->if_oerrors++;
794		return;
795	}
796
797	s = splnet();
798
799	ieee80211_free_node(data->ni);
800	data->ni = NULL;
801
802	sc->tx_queued--;
803	ifp->if_opackets++;
804
805	DPRINTFN(10, ("tx done\n"));
806
807	sc->sc_tx_timer = 0;
808	ifp->if_flags &= ~IFF_OACTIVE;
809	rum_start(ifp);
810
811	splx(s);
812}
813
814Static void
815rum_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
816{
817	struct rum_rx_data *data = priv;
818	struct rum_softc *sc = data->sc;
819	struct ieee80211com *ic = &sc->sc_ic;
820	struct ifnet *ifp = &sc->sc_if;
821	struct rum_rx_desc *desc;
822	struct ieee80211_frame *wh;
823	struct ieee80211_node *ni;
824	struct mbuf *mnew, *m;
825	int s, len;
826
827	if (status != USBD_NORMAL_COMPLETION) {
828		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
829			return;
830
831		if (status == USBD_STALLED)
832			usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
833		goto skip;
834	}
835
836	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
837
838	if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
839		DPRINTF(("%s: xfer too short %d\n", USBDEVNAME(sc->sc_dev),
840		    len));
841		ifp->if_ierrors++;
842		goto skip;
843	}
844
845	desc = (struct rum_rx_desc *)data->buf;
846
847	if (le32toh(desc->flags) & RT2573_RX_CRC_ERROR) {
848		/*
849		 * This should not happen since we did not request to receive
850		 * those frames when we filled RT2573_TXRX_CSR0.
851		 */
852		DPRINTFN(5, ("CRC error\n"));
853		ifp->if_ierrors++;
854		goto skip;
855	}
856
857	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
858	if (mnew == NULL) {
859		printf("%s: could not allocate rx mbuf\n",
860		    USBDEVNAME(sc->sc_dev));
861		ifp->if_ierrors++;
862		goto skip;
863	}
864
865	MCLGET(mnew, M_DONTWAIT);
866	if (!(mnew->m_flags & M_EXT)) {
867		printf("%s: could not allocate rx mbuf cluster\n",
868		    USBDEVNAME(sc->sc_dev));
869		m_freem(mnew);
870		ifp->if_ierrors++;
871		goto skip;
872	}
873
874	m = data->m;
875	data->m = mnew;
876	data->buf = mtod(data->m, uint8_t *);
877
878	/* finalize mbuf */
879	m->m_pkthdr.rcvif = ifp;
880	m->m_data = (void *)(desc + 1);
881	m->m_pkthdr.len = m->m_len = (le32toh(desc->flags) >> 16) & 0xfff;
882
883	s = splnet();
884
885#if NBPFILTER > 0
886	if (sc->sc_drvbpf != NULL) {
887		struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
888
889		tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
890		tap->wr_rate = rum_rxrate(desc);
891		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
892		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
893		tap->wr_antenna = sc->rx_ant;
894		tap->wr_antsignal = desc->rssi;
895
896		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
897	}
898#endif
899
900	wh = mtod(m, struct ieee80211_frame *);
901	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
902
903	/* send the frame to the 802.11 layer */
904	ieee80211_input(ic, m, ni, desc->rssi, 0);
905
906	/* node is no longer needed */
907	ieee80211_free_node(ni);
908
909	splx(s);
910
911	DPRINTFN(15, ("rx done\n"));
912
913skip:	/* setup a new transfer */
914	usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data, data->buf, MCLBYTES,
915	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
916	usbd_transfer(xfer);
917}
918
919/*
920 * This function is only used by the Rx radiotap code. It returns the rate at
921 * which a given frame was received.
922 */
923#if NBPFILTER > 0
924Static uint8_t
925rum_rxrate(const struct rum_rx_desc *desc)
926{
927	if (le32toh(desc->flags) & RT2573_RX_OFDM) {
928		/* reverse function of rum_plcp_signal */
929		switch (desc->rate) {
930		case 0xb:	return 12;
931		case 0xf:	return 18;
932		case 0xa:	return 24;
933		case 0xe:	return 36;
934		case 0x9:	return 48;
935		case 0xd:	return 72;
936		case 0x8:	return 96;
937		case 0xc:	return 108;
938		}
939	} else {
940		if (desc->rate == 10)
941			return 2;
942		if (desc->rate == 20)
943			return 4;
944		if (desc->rate == 55)
945			return 11;
946		if (desc->rate == 110)
947			return 22;
948	}
949	return 2;	/* should not get there */
950}
951#endif
952
953/*
954 * Return the expected ack rate for a frame transmitted at rate `rate'.
955 * XXX: this should depend on the destination node basic rate set.
956 */
957Static int
958rum_ack_rate(struct ieee80211com *ic, int rate)
959{
960	switch (rate) {
961	/* CCK rates */
962	case 2:
963		return 2;
964	case 4:
965	case 11:
966	case 22:
967		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
968
969	/* OFDM rates */
970	case 12:
971	case 18:
972		return 12;
973	case 24:
974	case 36:
975		return 24;
976	case 48:
977	case 72:
978	case 96:
979	case 108:
980		return 48;
981	}
982
983	/* default to 1Mbps */
984	return 2;
985}
986
987/*
988 * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
989 * The function automatically determines the operating mode depending on the
990 * given rate. `flags' indicates whether short preamble is in use or not.
991 */
992Static uint16_t
993rum_txtime(int len, int rate, uint32_t flags)
994{
995	uint16_t txtime;
996
997	if (RUM_RATE_IS_OFDM(rate)) {
998		/* IEEE Std 802.11a-1999, pp. 37 */
999		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1000		txtime = 16 + 4 + 4 * txtime + 6;
1001	} else {
1002		/* IEEE Std 802.11b-1999, pp. 28 */
1003		txtime = (16 * len + rate - 1) / rate;
1004		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1005			txtime +=  72 + 24;
1006		else
1007			txtime += 144 + 48;
1008	}
1009	return txtime;
1010}
1011
1012Static uint8_t
1013rum_plcp_signal(int rate)
1014{
1015	switch (rate) {
1016	/* CCK rates (returned values are device-dependent) */
1017	case 2:		return 0x0;
1018	case 4:		return 0x1;
1019	case 11:	return 0x2;
1020	case 22:	return 0x3;
1021
1022	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1023	case 12:	return 0xb;
1024	case 18:	return 0xf;
1025	case 24:	return 0xa;
1026	case 36:	return 0xe;
1027	case 48:	return 0x9;
1028	case 72:	return 0xd;
1029	case 96:	return 0x8;
1030	case 108:	return 0xc;
1031
1032	/* unsupported rates (should not get there) */
1033	default:	return 0xff;
1034	}
1035}
1036
1037Static void
1038rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1039    uint32_t flags, uint16_t xflags, int len, int rate)
1040{
1041	struct ieee80211com *ic = &sc->sc_ic;
1042	uint16_t plcp_length;
1043	int remainder;
1044
1045	desc->flags = htole32(flags);
1046	desc->flags |= htole32(RT2573_TX_VALID);
1047	desc->flags |= htole32(len << 16);
1048
1049	desc->xflags = htole16(xflags);
1050
1051	desc->wme = htole16(
1052	    RT2573_QID(0) |
1053	    RT2573_AIFSN(2) |
1054	    RT2573_LOGCWMIN(4) |
1055	    RT2573_LOGCWMAX(10));
1056
1057	/* setup PLCP fields */
1058	desc->plcp_signal  = rum_plcp_signal(rate);
1059	desc->plcp_service = 4;
1060
1061	len += IEEE80211_CRC_LEN;
1062	if (RUM_RATE_IS_OFDM(rate)) {
1063		desc->flags |= htole32(RT2573_TX_OFDM);
1064
1065		plcp_length = len & 0xfff;
1066		desc->plcp_length_hi = plcp_length >> 6;
1067		desc->plcp_length_lo = plcp_length & 0x3f;
1068	} else {
1069		plcp_length = (16 * len + rate - 1) / rate;
1070		if (rate == 22) {
1071			remainder = (16 * len) % 22;
1072			if (remainder != 0 && remainder < 7)
1073				desc->plcp_service |= RT2573_PLCP_LENGEXT;
1074		}
1075		desc->plcp_length_hi = plcp_length >> 8;
1076		desc->plcp_length_lo = plcp_length & 0xff;
1077
1078		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1079			desc->plcp_signal |= 0x08;
1080	}
1081}
1082
1083#define RUM_TX_TIMEOUT	5000
1084
1085Static int
1086rum_tx_mgt(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1087{
1088	struct ieee80211com *ic = &sc->sc_ic;
1089	struct rum_tx_desc *desc;
1090	struct rum_tx_data *data;
1091	struct ieee80211_frame *wh;
1092	struct ieee80211_key *k;
1093	uint32_t flags = 0;
1094	uint16_t dur;
1095	usbd_status error;
1096	int xferlen, rate;
1097
1098	data = &sc->tx_data[0];
1099	desc = (struct rum_tx_desc *)data->buf;
1100
1101	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1102
1103	data->m = m0;
1104	data->ni = ni;
1105
1106	wh = mtod(m0, struct ieee80211_frame *);
1107
1108	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1109		k = ieee80211_crypto_encap(ic, ni, m0);
1110		if (k == NULL) {
1111			m_freem(m0);
1112			return ENOBUFS;
1113		}
1114	}
1115
1116	wh = mtod(m0, struct ieee80211_frame *);
1117
1118	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1119		flags |= RT2573_TX_NEED_ACK;
1120
1121		dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1122		    ic->ic_flags) + sc->sifs;
1123		*(uint16_t *)wh->i_dur = htole16(dur);
1124
1125		/* tell hardware to set timestamp in probe responses */
1126		if ((wh->i_fc[0] &
1127		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1128		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1129			flags |= RT2573_TX_TIMESTAMP;
1130	}
1131
1132#if NBPFILTER > 0
1133	if (sc->sc_drvbpf != NULL) {
1134		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1135
1136		tap->wt_flags = 0;
1137		tap->wt_rate = rate;
1138		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1139		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1140		tap->wt_antenna = sc->tx_ant;
1141
1142		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1143	}
1144#endif
1145
1146	m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1147	rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1148
1149	/* align end on a 4-bytes boundary */
1150	xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1151
1152	/*
1153	 * No space left in the last URB to store the extra 4 bytes, force
1154	 * sending of another URB.
1155	 */
1156	if ((xferlen % 64) == 0)
1157		xferlen += 4;
1158
1159	DPRINTFN(10, ("sending msg frame len=%zu rate=%u xfer len=%u\n",
1160	    (size_t)m0->m_pkthdr.len + RT2573_TX_DESC_SIZE,
1161	    rate, xferlen));
1162
1163	usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1164	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1165
1166	error = usbd_transfer(data->xfer);
1167	if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1168		m_freem(m0);
1169		return error;
1170	}
1171
1172	sc->tx_queued++;
1173
1174	return 0;
1175}
1176
1177Static int
1178rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1179{
1180	struct ieee80211com *ic = &sc->sc_ic;
1181	struct rum_tx_desc *desc;
1182	struct rum_tx_data *data;
1183	struct ieee80211_frame *wh;
1184	struct ieee80211_key *k;
1185	uint32_t flags = 0;
1186	uint16_t dur;
1187	usbd_status error;
1188	int xferlen, rate;
1189
1190	wh = mtod(m0, struct ieee80211_frame *);
1191
1192	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
1193		rate = ic->ic_bss->ni_rates.rs_rates[ic->ic_fixed_rate];
1194	else
1195		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1196	if (rate == 0)
1197		rate = 2;	/* XXX should not happen */
1198	rate &= IEEE80211_RATE_VAL;
1199
1200	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1201		k = ieee80211_crypto_encap(ic, ni, m0);
1202		if (k == NULL) {
1203			m_freem(m0);
1204			return ENOBUFS;
1205		}
1206
1207		/* packet header may have moved, reset our local pointer */
1208		wh = mtod(m0, struct ieee80211_frame *);
1209	}
1210
1211	data = &sc->tx_data[0];
1212	desc = (struct rum_tx_desc *)data->buf;
1213
1214	data->ni = ni;
1215
1216	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1217		flags |= RT2573_TX_NEED_ACK;
1218
1219		dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1220		    ic->ic_flags) + sc->sifs;
1221		*(uint16_t *)wh->i_dur = htole16(dur);
1222	}
1223
1224#if NBPFILTER > 0
1225	if (sc->sc_drvbpf != NULL) {
1226		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1227
1228		tap->wt_flags = 0;
1229		tap->wt_rate = rate;
1230		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1231		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1232		tap->wt_antenna = sc->tx_ant;
1233
1234		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1235	}
1236#endif
1237
1238	m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1239	rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1240
1241	/* align end on a 4-bytes boundary */
1242	xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1243
1244	/*
1245	 * No space left in the last URB to store the extra 4 bytes, force
1246	 * sending of another URB.
1247	 */
1248	if ((xferlen % 64) == 0)
1249		xferlen += 4;
1250
1251	DPRINTFN(10, ("sending data frame len=%zu rate=%u xfer len=%u\n",
1252	    (size_t)m0->m_pkthdr.len + RT2573_TX_DESC_SIZE,
1253	    rate, xferlen));
1254
1255	/* mbuf is no longer needed */
1256	m_freem(m0);
1257
1258	usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1259	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1260
1261	error = usbd_transfer(data->xfer);
1262	if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS)
1263		return error;
1264
1265	sc->tx_queued++;
1266
1267	return 0;
1268}
1269
1270Static void
1271rum_start(struct ifnet *ifp)
1272{
1273	struct rum_softc *sc = ifp->if_softc;
1274	struct ieee80211com *ic = &sc->sc_ic;
1275	struct ether_header *eh;
1276	struct ieee80211_node *ni;
1277	struct mbuf *m0;
1278
1279	for (;;) {
1280		IF_POLL(&ic->ic_mgtq, m0);
1281		if (m0 != NULL) {
1282			if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1283				ifp->if_flags |= IFF_OACTIVE;
1284				break;
1285			}
1286			IF_DEQUEUE(&ic->ic_mgtq, m0);
1287
1288			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1289			m0->m_pkthdr.rcvif = NULL;
1290#if NBPFILTER > 0
1291			if (ic->ic_rawbpf != NULL)
1292				bpf_mtap(ic->ic_rawbpf, m0);
1293#endif
1294			if (rum_tx_mgt(sc, m0, ni) != 0)
1295				break;
1296
1297		} else {
1298			if (ic->ic_state != IEEE80211_S_RUN)
1299				break;
1300			IFQ_POLL(&ifp->if_snd, m0);
1301			if (m0 == NULL)
1302				break;
1303			if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1304				ifp->if_flags |= IFF_OACTIVE;
1305				break;
1306			}
1307			IFQ_DEQUEUE(&ifp->if_snd, m0);
1308			if (m0->m_len < sizeof(struct ether_header) &&
1309			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
1310				continue;
1311
1312			eh = mtod(m0, struct ether_header *);
1313			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1314			if (ni == NULL) {
1315				m_freem(m0);
1316				continue;
1317			}
1318#if NBPFILTER > 0
1319			if (ifp->if_bpf != NULL)
1320				bpf_mtap(ifp->if_bpf, m0);
1321#endif
1322			m0 = ieee80211_encap(ic, m0, ni);
1323			if (m0 == NULL) {
1324				ieee80211_free_node(ni);
1325				continue;
1326			}
1327#if NBPFILTER > 0
1328			if (ic->ic_rawbpf != NULL)
1329				bpf_mtap(ic->ic_rawbpf, m0);
1330#endif
1331			if (rum_tx_data(sc, m0, ni) != 0) {
1332				ieee80211_free_node(ni);
1333				ifp->if_oerrors++;
1334				break;
1335			}
1336		}
1337
1338		sc->sc_tx_timer = 5;
1339		ifp->if_timer = 1;
1340	}
1341}
1342
1343Static void
1344rum_watchdog(struct ifnet *ifp)
1345{
1346	struct rum_softc *sc = ifp->if_softc;
1347	struct ieee80211com *ic = &sc->sc_ic;
1348
1349	ifp->if_timer = 0;
1350
1351	if (sc->sc_tx_timer > 0) {
1352		if (--sc->sc_tx_timer == 0) {
1353			printf("%s: device timeout\n", USBDEVNAME(sc->sc_dev));
1354			/*rum_init(ifp); XXX needs a process context! */
1355			ifp->if_oerrors++;
1356			return;
1357		}
1358		ifp->if_timer = 1;
1359	}
1360
1361	ieee80211_watchdog(ic);
1362}
1363
1364Static int
1365rum_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1366{
1367	struct rum_softc *sc = ifp->if_softc;
1368	struct ieee80211com *ic = &sc->sc_ic;
1369	int s, error = 0;
1370
1371	s = splnet();
1372
1373	switch (cmd) {
1374	case SIOCSIFFLAGS:
1375		if (ifp->if_flags & IFF_UP) {
1376			if (ifp->if_flags & IFF_RUNNING)
1377				rum_update_promisc(sc);
1378			else
1379				rum_init(ifp);
1380		} else {
1381			if (ifp->if_flags & IFF_RUNNING)
1382				rum_stop(ifp, 1);
1383		}
1384		break;
1385
1386	default:
1387		error = ieee80211_ioctl(ic, cmd, data);
1388	}
1389
1390	if (error == ENETRESET) {
1391		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1392		    (IFF_UP | IFF_RUNNING))
1393			rum_init(ifp);
1394		error = 0;
1395	}
1396
1397	splx(s);
1398
1399	return error;
1400}
1401
1402Static void
1403rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1404{
1405	usb_device_request_t req;
1406	usbd_status error;
1407
1408	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1409	req.bRequest = RT2573_READ_EEPROM;
1410	USETW(req.wValue, 0);
1411	USETW(req.wIndex, addr);
1412	USETW(req.wLength, len);
1413
1414	error = usbd_do_request(sc->sc_udev, &req, buf);
1415	if (error != 0) {
1416		printf("%s: could not read EEPROM: %s\n",
1417		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1418	}
1419}
1420
1421Static uint32_t
1422rum_read(struct rum_softc *sc, uint16_t reg)
1423{
1424	uint32_t val;
1425
1426	rum_read_multi(sc, reg, &val, sizeof val);
1427
1428	return le32toh(val);
1429}
1430
1431Static void
1432rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1433{
1434	usb_device_request_t req;
1435	usbd_status error;
1436
1437	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1438	req.bRequest = RT2573_READ_MULTI_MAC;
1439	USETW(req.wValue, 0);
1440	USETW(req.wIndex, reg);
1441	USETW(req.wLength, len);
1442
1443	error = usbd_do_request(sc->sc_udev, &req, buf);
1444	if (error != 0) {
1445		printf("%s: could not multi read MAC register: %s\n",
1446		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1447	}
1448}
1449
1450Static void
1451rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1452{
1453	uint32_t tmp = htole32(val);
1454
1455	rum_write_multi(sc, reg, &tmp, sizeof tmp);
1456}
1457
1458Static void
1459rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1460{
1461	usb_device_request_t req;
1462	usbd_status error;
1463
1464	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1465	req.bRequest = RT2573_WRITE_MULTI_MAC;
1466	USETW(req.wValue, 0);
1467	USETW(req.wIndex, reg);
1468	USETW(req.wLength, len);
1469
1470	error = usbd_do_request(sc->sc_udev, &req, buf);
1471	if (error != 0) {
1472		printf("%s: could not multi write MAC register: %s\n",
1473		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1474	}
1475}
1476
1477Static void
1478rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1479{
1480	uint32_t tmp;
1481	int ntries;
1482
1483	for (ntries = 0; ntries < 5; ntries++) {
1484		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1485			break;
1486	}
1487	if (ntries == 5) {
1488		printf("%s: could not write to BBP\n", USBDEVNAME(sc->sc_dev));
1489		return;
1490	}
1491
1492	tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1493	rum_write(sc, RT2573_PHY_CSR3, tmp);
1494}
1495
1496Static uint8_t
1497rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1498{
1499	uint32_t val;
1500	int ntries;
1501
1502	for (ntries = 0; ntries < 5; ntries++) {
1503		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1504			break;
1505	}
1506	if (ntries == 5) {
1507		printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1508		return 0;
1509	}
1510
1511	val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1512	rum_write(sc, RT2573_PHY_CSR3, val);
1513
1514	for (ntries = 0; ntries < 100; ntries++) {
1515		val = rum_read(sc, RT2573_PHY_CSR3);
1516		if (!(val & RT2573_BBP_BUSY))
1517			return val & 0xff;
1518		DELAY(1);
1519	}
1520
1521	printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1522	return 0;
1523}
1524
1525Static void
1526rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1527{
1528	uint32_t tmp;
1529	int ntries;
1530
1531	for (ntries = 0; ntries < 5; ntries++) {
1532		if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1533			break;
1534	}
1535	if (ntries == 5) {
1536		printf("%s: could not write to RF\n", USBDEVNAME(sc->sc_dev));
1537		return;
1538	}
1539
1540	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1541	    (reg & 3);
1542	rum_write(sc, RT2573_PHY_CSR4, tmp);
1543
1544	/* remember last written value in sc */
1545	sc->rf_regs[reg] = val;
1546
1547	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff));
1548}
1549
1550Static void
1551rum_select_antenna(struct rum_softc *sc)
1552{
1553	uint8_t bbp4, bbp77;
1554	uint32_t tmp;
1555
1556	bbp4  = rum_bbp_read(sc, 4);
1557	bbp77 = rum_bbp_read(sc, 77);
1558
1559	/* TBD */
1560
1561	/* make sure Rx is disabled before switching antenna */
1562	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1563	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1564
1565	rum_bbp_write(sc,  4, bbp4);
1566	rum_bbp_write(sc, 77, bbp77);
1567
1568	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1569}
1570
1571/*
1572 * Enable multi-rate retries for frames sent at OFDM rates.
1573 * In 802.11b/g mode, allow fallback to CCK rates.
1574 */
1575Static void
1576rum_enable_mrr(struct rum_softc *sc)
1577{
1578	struct ieee80211com *ic = &sc->sc_ic;
1579	uint32_t tmp;
1580
1581	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1582
1583	tmp &= ~RT2573_MRR_CCK_FALLBACK;
1584	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1585		tmp |= RT2573_MRR_CCK_FALLBACK;
1586	tmp |= RT2573_MRR_ENABLED;
1587
1588	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1589}
1590
1591Static void
1592rum_set_txpreamble(struct rum_softc *sc)
1593{
1594	uint32_t tmp;
1595
1596	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1597
1598	tmp &= ~RT2573_SHORT_PREAMBLE;
1599	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1600		tmp |= RT2573_SHORT_PREAMBLE;
1601
1602	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1603}
1604
1605Static void
1606rum_set_basicrates(struct rum_softc *sc)
1607{
1608	struct ieee80211com *ic = &sc->sc_ic;
1609
1610	/* update basic rate set */
1611	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1612		/* 11b basic rates: 1, 2Mbps */
1613		rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1614	} else if (ic->ic_curmode == IEEE80211_MODE_11A) {
1615		/* 11a basic rates: 6, 12, 24Mbps */
1616		rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1617	} else {
1618		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1619		rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1620	}
1621}
1622
1623/*
1624 * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1625 * driver.
1626 */
1627Static void
1628rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1629{
1630	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1631	uint32_t tmp;
1632
1633	/* update all BBP registers that depend on the band */
1634	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1635	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1636	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1637		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1638		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1639	}
1640	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1641	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1642		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1643	}
1644
1645	sc->bbp17 = bbp17;
1646	rum_bbp_write(sc,  17, bbp17);
1647	rum_bbp_write(sc,  96, bbp96);
1648	rum_bbp_write(sc, 104, bbp104);
1649
1650	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1651	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1652		rum_bbp_write(sc, 75, 0x80);
1653		rum_bbp_write(sc, 86, 0x80);
1654		rum_bbp_write(sc, 88, 0x80);
1655	}
1656
1657	rum_bbp_write(sc, 35, bbp35);
1658	rum_bbp_write(sc, 97, bbp97);
1659	rum_bbp_write(sc, 98, bbp98);
1660
1661	tmp = rum_read(sc, RT2573_PHY_CSR0);
1662	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1663	if (IEEE80211_IS_CHAN_2GHZ(c))
1664		tmp |= RT2573_PA_PE_2GHZ;
1665	else
1666		tmp |= RT2573_PA_PE_5GHZ;
1667	rum_write(sc, RT2573_PHY_CSR0, tmp);
1668
1669	/* 802.11a uses a 16 microseconds short interframe space */
1670	sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1671}
1672
1673Static void
1674rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1675{
1676	struct ieee80211com *ic = &sc->sc_ic;
1677	const struct rfprog *rfprog;
1678	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1679	int8_t power;
1680	u_int i, chan;
1681
1682	chan = ieee80211_chan2ieee(ic, c);
1683	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1684		return;
1685
1686	/* select the appropriate RF settings based on what EEPROM says */
1687	rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1688		  sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1689
1690	/* find the settings for this channel (we know it exists) */
1691	for (i = 0; rfprog[i].chan != chan; i++);
1692
1693	power = sc->txpow[i];
1694	if (power < 0) {
1695		bbp94 += power;
1696		power = 0;
1697	} else if (power > 31) {
1698		bbp94 += power - 31;
1699		power = 31;
1700	}
1701
1702	/*
1703	 * If we are switching from the 2GHz band to the 5GHz band or
1704	 * vice-versa, BBP registers need to be reprogrammed.
1705	 */
1706	if (c->ic_flags != ic->ic_curchan->ic_flags) {
1707		rum_select_band(sc, c);
1708		rum_select_antenna(sc);
1709	}
1710	ic->ic_curchan = c;
1711
1712	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1713	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1714	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1715	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1716
1717	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1718	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1719	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1720	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1721
1722	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1723	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1724	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1725	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1726
1727	DELAY(10);
1728
1729	/* enable smart mode for MIMO-capable RFs */
1730	bbp3 = rum_bbp_read(sc, 3);
1731
1732	bbp3 &= ~RT2573_SMART_MODE;
1733	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1734		bbp3 |= RT2573_SMART_MODE;
1735
1736	rum_bbp_write(sc, 3, bbp3);
1737
1738	if (bbp94 != RT2573_BBPR94_DEFAULT)
1739		rum_bbp_write(sc, 94, bbp94);
1740}
1741
1742/*
1743 * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1744 * and HostAP operating modes.
1745 */
1746Static void
1747rum_enable_tsf_sync(struct rum_softc *sc)
1748{
1749	struct ieee80211com *ic = &sc->sc_ic;
1750	uint32_t tmp;
1751
1752	if (ic->ic_opmode != IEEE80211_M_STA) {
1753		/*
1754		 * Change default 16ms TBTT adjustment to 8ms.
1755		 * Must be done before enabling beacon generation.
1756		 */
1757		rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1758	}
1759
1760	tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1761
1762	/* set beacon interval (in 1/16ms unit) */
1763	tmp |= ic->ic_bss->ni_intval * 16;
1764
1765	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1766	if (ic->ic_opmode == IEEE80211_M_STA)
1767		tmp |= RT2573_TSF_MODE(1);
1768	else
1769		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1770
1771	rum_write(sc, RT2573_TXRX_CSR9, tmp);
1772}
1773
1774Static void
1775rum_update_slot(struct rum_softc *sc)
1776{
1777	struct ieee80211com *ic = &sc->sc_ic;
1778	uint8_t slottime;
1779	uint32_t tmp;
1780
1781	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1782
1783	tmp = rum_read(sc, RT2573_MAC_CSR9);
1784	tmp = (tmp & ~0xff) | slottime;
1785	rum_write(sc, RT2573_MAC_CSR9, tmp);
1786
1787	DPRINTF(("setting slot time to %uus\n", slottime));
1788}
1789
1790Static void
1791rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1792{
1793	uint32_t tmp;
1794
1795	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1796	rum_write(sc, RT2573_MAC_CSR4, tmp);
1797
1798	tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1799	rum_write(sc, RT2573_MAC_CSR5, tmp);
1800}
1801
1802Static void
1803rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1804{
1805	uint32_t tmp;
1806
1807	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1808	rum_write(sc, RT2573_MAC_CSR2, tmp);
1809
1810	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1811	rum_write(sc, RT2573_MAC_CSR3, tmp);
1812}
1813
1814Static void
1815rum_update_promisc(struct rum_softc *sc)
1816{
1817	struct ifnet *ifp = sc->sc_ic.ic_ifp;
1818	uint32_t tmp;
1819
1820	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1821
1822	tmp &= ~RT2573_DROP_NOT_TO_ME;
1823	if (!(ifp->if_flags & IFF_PROMISC))
1824		tmp |= RT2573_DROP_NOT_TO_ME;
1825
1826	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1827
1828	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1829	    "entering" : "leaving"));
1830}
1831
1832Static const char *
1833rum_get_rf(int rev)
1834{
1835	switch (rev) {
1836	case RT2573_RF_2527:	return "RT2527 (MIMO XR)";
1837	case RT2573_RF_2528:	return "RT2528";
1838	case RT2573_RF_5225:	return "RT5225 (MIMO XR)";
1839	case RT2573_RF_5226:	return "RT5226";
1840	default:		return "unknown";
1841	}
1842}
1843
1844Static void
1845rum_read_eeprom(struct rum_softc *sc)
1846{
1847	struct ieee80211com *ic = &sc->sc_ic;
1848	uint16_t val;
1849#ifdef RUM_DEBUG
1850	int i;
1851#endif
1852
1853	/* read MAC/BBP type */
1854	rum_eeprom_read(sc, RT2573_EEPROM_MACBBP, &val, 2);
1855	sc->macbbp_rev = le16toh(val);
1856
1857	/* read MAC address */
1858	rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1859
1860	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1861	val = le16toh(val);
1862	sc->rf_rev =   (val >> 11) & 0x1f;
1863	sc->hw_radio = (val >> 10) & 0x1;
1864	sc->rx_ant =   (val >> 4)  & 0x3;
1865	sc->tx_ant =   (val >> 2)  & 0x3;
1866	sc->nb_ant =   val & 0x3;
1867
1868	DPRINTF(("RF revision=%d\n", sc->rf_rev));
1869
1870	rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1871	val = le16toh(val);
1872	sc->ext_5ghz_lna = (val >> 6) & 0x1;
1873	sc->ext_2ghz_lna = (val >> 4) & 0x1;
1874
1875	DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1876	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
1877
1878	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1879	val = le16toh(val);
1880	if ((val & 0xff) != 0xff)
1881		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
1882
1883	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1884	val = le16toh(val);
1885	if ((val & 0xff) != 0xff)
1886		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
1887
1888	DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1889	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
1890
1891	rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1892	val = le16toh(val);
1893	if ((val & 0xff) != 0xff)
1894		sc->rffreq = val & 0xff;
1895
1896	DPRINTF(("RF freq=%d\n", sc->rffreq));
1897
1898	/* read Tx power for all a/b/g channels */
1899	rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1900	/* XXX default Tx power for 802.11a channels */
1901	memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1902#ifdef RUM_DEBUG
1903	for (i = 0; i < 14; i++)
1904		DPRINTF(("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]));
1905#endif
1906
1907	/* read default values for BBP registers */
1908	rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1909#ifdef RUM_DEBUG
1910	for (i = 0; i < 14; i++) {
1911		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1912			continue;
1913		DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1914		    sc->bbp_prom[i].val));
1915	}
1916#endif
1917}
1918
1919Static int
1920rum_bbp_init(struct rum_softc *sc)
1921{
1922#define N(a)	(sizeof (a) / sizeof ((a)[0]))
1923	int i, ntries;
1924	uint8_t val;
1925
1926	/* wait for BBP to be ready */
1927	for (ntries = 0; ntries < 100; ntries++) {
1928		val = rum_bbp_read(sc, 0);
1929		if (val != 0 && val != 0xff)
1930			break;
1931		DELAY(1000);
1932	}
1933	if (ntries == 100) {
1934		printf("%s: timeout waiting for BBP\n",
1935		    USBDEVNAME(sc->sc_dev));
1936		return EIO;
1937	}
1938
1939	/* initialize BBP registers to default values */
1940	for (i = 0; i < N(rum_def_bbp); i++)
1941		rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1942
1943	/* write vendor-specific BBP values (from EEPROM) */
1944	for (i = 0; i < 16; i++) {
1945		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1946			continue;
1947		rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1948	}
1949
1950	return 0;
1951#undef N
1952}
1953
1954Static int
1955rum_init(struct ifnet *ifp)
1956{
1957#define N(a)	(sizeof (a) / sizeof ((a)[0]))
1958	struct rum_softc *sc = ifp->if_softc;
1959	struct ieee80211com *ic = &sc->sc_ic;
1960	struct rum_rx_data *data;
1961	uint32_t tmp;
1962	usbd_status error = 0;
1963	int i, ntries;
1964
1965	if ((sc->sc_flags & RT2573_FWLOADED) == 0) {
1966		if (rum_attachhook(sc))
1967			goto fail;
1968	}
1969
1970	rum_stop(ifp, 0);
1971
1972	/* initialize MAC registers to default values */
1973	for (i = 0; i < N(rum_def_mac); i++)
1974		rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1975
1976	/* set host ready */
1977	rum_write(sc, RT2573_MAC_CSR1, 3);
1978	rum_write(sc, RT2573_MAC_CSR1, 0);
1979
1980	/* wait for BBP/RF to wakeup */
1981	for (ntries = 0; ntries < 1000; ntries++) {
1982		if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1983			break;
1984		rum_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
1985		DELAY(1000);
1986	}
1987	if (ntries == 1000) {
1988		printf("%s: timeout waiting for BBP/RF to wakeup\n",
1989		    USBDEVNAME(sc->sc_dev));
1990		goto fail;
1991	}
1992
1993	if ((error = rum_bbp_init(sc)) != 0)
1994		goto fail;
1995
1996	/* select default channel */
1997	rum_select_band(sc, ic->ic_curchan);
1998	rum_select_antenna(sc);
1999	rum_set_chan(sc, ic->ic_curchan);
2000
2001	/* clear STA registers */
2002	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2003
2004	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2005	rum_set_macaddr(sc, ic->ic_myaddr);
2006
2007	/* initialize ASIC */
2008	rum_write(sc, RT2573_MAC_CSR1, 4);
2009
2010	/*
2011	 * Allocate xfer for AMRR statistics requests.
2012	 */
2013	sc->amrr_xfer = usbd_alloc_xfer(sc->sc_udev);
2014	if (sc->amrr_xfer == NULL) {
2015		printf("%s: could not allocate AMRR xfer\n",
2016		    USBDEVNAME(sc->sc_dev));
2017		goto fail;
2018	}
2019
2020	/*
2021	 * Open Tx and Rx USB bulk pipes.
2022	 */
2023	error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
2024	    &sc->sc_tx_pipeh);
2025	if (error != 0) {
2026		printf("%s: could not open Tx pipe: %s\n",
2027		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2028		goto fail;
2029	}
2030
2031	error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
2032	    &sc->sc_rx_pipeh);
2033	if (error != 0) {
2034		printf("%s: could not open Rx pipe: %s\n",
2035		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2036		goto fail;
2037	}
2038
2039	/*
2040	 * Allocate Tx and Rx xfer queues.
2041	 */
2042	error = rum_alloc_tx_list(sc);
2043	if (error != 0) {
2044		printf("%s: could not allocate Tx list\n",
2045		    USBDEVNAME(sc->sc_dev));
2046		goto fail;
2047	}
2048
2049	error = rum_alloc_rx_list(sc);
2050	if (error != 0) {
2051		printf("%s: could not allocate Rx list\n",
2052		    USBDEVNAME(sc->sc_dev));
2053		goto fail;
2054	}
2055
2056	/*
2057	 * Start up the receive pipe.
2058	 */
2059	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
2060		data = &sc->rx_data[i];
2061
2062		usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf,
2063		    MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
2064		error = usbd_transfer(data->xfer);
2065		if (error != USBD_NORMAL_COMPLETION &&
2066		    error != USBD_IN_PROGRESS) {
2067			printf("%s: could not queue Rx transfer\n",
2068			    USBDEVNAME(sc->sc_dev));
2069			goto fail;
2070		}
2071	}
2072
2073	/* update Rx filter */
2074	tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2075
2076	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2077	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2078		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2079		       RT2573_DROP_ACKCTS;
2080		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2081			tmp |= RT2573_DROP_TODS;
2082		if (!(ifp->if_flags & IFF_PROMISC))
2083			tmp |= RT2573_DROP_NOT_TO_ME;
2084	}
2085	rum_write(sc, RT2573_TXRX_CSR0, tmp);
2086
2087	ifp->if_flags &= ~IFF_OACTIVE;
2088	ifp->if_flags |= IFF_RUNNING;
2089
2090	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2091		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2092	else
2093		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2094
2095	return 0;
2096
2097fail:	rum_stop(ifp, 1);
2098	return error;
2099#undef N
2100}
2101
2102Static void
2103rum_stop(struct ifnet *ifp, int disable)
2104{
2105	struct rum_softc *sc = ifp->if_softc;
2106	struct ieee80211com *ic = &sc->sc_ic;
2107	uint32_t tmp;
2108
2109	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2110
2111	sc->sc_tx_timer = 0;
2112	ifp->if_timer = 0;
2113	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2114
2115	/* disable Rx */
2116	tmp = rum_read(sc, RT2573_TXRX_CSR0);
2117	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2118
2119	/* reset ASIC */
2120	rum_write(sc, RT2573_MAC_CSR1, 3);
2121	rum_write(sc, RT2573_MAC_CSR1, 0);
2122
2123	if (sc->sc_rx_pipeh != NULL) {
2124		usbd_abort_pipe(sc->sc_rx_pipeh);
2125		usbd_close_pipe(sc->sc_rx_pipeh);
2126		sc->sc_rx_pipeh = NULL;
2127	}
2128
2129	if (sc->sc_tx_pipeh != NULL) {
2130		usbd_abort_pipe(sc->sc_tx_pipeh);
2131		usbd_close_pipe(sc->sc_tx_pipeh);
2132		sc->sc_tx_pipeh = NULL;
2133	}
2134
2135	rum_free_rx_list(sc);
2136	rum_free_tx_list(sc);
2137}
2138
2139Static int
2140rum_load_microcode(struct rum_softc *sc, const u_char *ucode, size_t size)
2141{
2142	usb_device_request_t req;
2143	uint16_t reg = RT2573_MCU_CODE_BASE;
2144	usbd_status error;
2145
2146	/* copy firmware image into NIC */
2147	for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2148		rum_write(sc, reg, UGETDW(ucode));
2149
2150	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2151	req.bRequest = RT2573_MCU_CNTL;
2152	USETW(req.wValue, RT2573_MCU_RUN);
2153	USETW(req.wIndex, 0);
2154	USETW(req.wLength, 0);
2155
2156	error = usbd_do_request(sc->sc_udev, &req, NULL);
2157	if (error != 0) {
2158		printf("%s: could not run firmware: %s\n",
2159		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2160	}
2161	return error;
2162}
2163
2164Static int
2165rum_prepare_beacon(struct rum_softc *sc)
2166{
2167	struct ieee80211com *ic = &sc->sc_ic;
2168	struct rum_tx_desc desc;
2169	struct mbuf *m0;
2170	int rate;
2171
2172	m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo);
2173	if (m0 == NULL) {
2174		aprint_error_dev(&sc->sc_dev, "could not allocate beacon frame\n");
2175		return ENOBUFS;
2176	}
2177
2178	/* send beacons at the lowest available rate */
2179	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
2180
2181	rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2182	    m0->m_pkthdr.len, rate);
2183
2184	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2185	rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2186
2187	/* copy beacon header and payload into NIC memory */
2188	rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2189	    m0->m_pkthdr.len);
2190
2191	m_freem(m0);
2192
2193	return 0;
2194}
2195
2196Static void
2197rum_newassoc(struct ieee80211_node *ni, int isnew)
2198{
2199	/* start with lowest Tx rate */
2200	ni->ni_txrate = 0;
2201}
2202
2203Static void
2204rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
2205{
2206	int i;
2207
2208	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2209	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2210
2211	ieee80211_amrr_node_init(&sc->amrr, &sc->amn);
2212
2213	/* set rate to some reasonable initial value */
2214	for (i = ni->ni_rates.rs_nrates - 1;
2215	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
2216	     i--);
2217	ni->ni_txrate = i;
2218
2219	usb_callout(sc->sc_amrr_ch, hz, rum_amrr_timeout, sc);
2220}
2221
2222Static void
2223rum_amrr_timeout(void *arg)
2224{
2225	struct rum_softc *sc = arg;
2226	usb_device_request_t req;
2227
2228	/*
2229	 * Asynchronously read statistic registers (cleared by read).
2230	 */
2231	req.bmRequestType = UT_READ_VENDOR_DEVICE;
2232	req.bRequest = RT2573_READ_MULTI_MAC;
2233	USETW(req.wValue, 0);
2234	USETW(req.wIndex, RT2573_STA_CSR0);
2235	USETW(req.wLength, sizeof sc->sta);
2236
2237	usbd_setup_default_xfer(sc->amrr_xfer, sc->sc_udev, sc,
2238	    USBD_DEFAULT_TIMEOUT, &req, sc->sta, sizeof sc->sta, 0,
2239	    rum_amrr_update);
2240	(void)usbd_transfer(sc->amrr_xfer);
2241}
2242
2243Static void
2244rum_amrr_update(usbd_xfer_handle xfer, usbd_private_handle priv,
2245    usbd_status status)
2246{
2247	struct rum_softc *sc = (struct rum_softc *)priv;
2248	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2249
2250	if (status != USBD_NORMAL_COMPLETION) {
2251		printf("%s: could not retrieve Tx statistics - cancelling "
2252		    "automatic rate control\n", USBDEVNAME(sc->sc_dev));
2253		return;
2254	}
2255
2256	/* count TX retry-fail as Tx errors */
2257	ifp->if_oerrors += le32toh(sc->sta[5]) >> 16;
2258
2259	sc->amn.amn_retrycnt =
2260	    (le32toh(sc->sta[4]) >> 16) +	/* TX one-retry ok count */
2261	    (le32toh(sc->sta[5]) & 0xffff) +	/* TX more-retry ok count */
2262	    (le32toh(sc->sta[5]) >> 16);	/* TX retry-fail count */
2263
2264	sc->amn.amn_txcnt =
2265	    sc->amn.amn_retrycnt +
2266	    (le32toh(sc->sta[4]) & 0xffff);	/* TX no-retry ok count */
2267
2268	ieee80211_amrr_choose(&sc->amrr, sc->sc_ic.ic_bss, &sc->amn);
2269
2270	usb_callout(sc->sc_amrr_ch, hz, rum_amrr_timeout, sc);
2271}
2272
2273int
2274rum_activate(device_ptr_t self, enum devact act)
2275{
2276	switch (act) {
2277	case DVACT_ACTIVATE:
2278		return EOPNOTSUPP;
2279
2280	case DVACT_DEACTIVATE:
2281		/*if_deactivate(&sc->sc_ic.ic_if);*/
2282		break;
2283	}
2284
2285	return 0;
2286}
2287