if_rum.c revision 1.24
1/*	$OpenBSD: if_rum.c,v 1.40 2006/09/18 16:20:20 damien Exp $	*/
2/*	$NetBSD: if_rum.c,v 1.24 2008/11/07 00:20:12 dyoung Exp $	*/
3
4/*-
5 * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
6 * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
7 *
8 * Permission to use, copy, modify, and distribute this software for any
9 * purpose with or without fee is hereby granted, provided that the above
10 * copyright notice and this permission notice appear in all copies.
11 *
12 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 */
20
21/*-
22 * Ralink Technology RT2501USB/RT2601USB chipset driver
23 * http://www.ralinktech.com.tw/
24 */
25
26#include <sys/cdefs.h>
27__KERNEL_RCSID(0, "$NetBSD: if_rum.c,v 1.24 2008/11/07 00:20:12 dyoung Exp $");
28
29#include "bpfilter.h"
30
31#include <sys/param.h>
32#include <sys/sockio.h>
33#include <sys/sysctl.h>
34#include <sys/mbuf.h>
35#include <sys/kernel.h>
36#include <sys/socket.h>
37#include <sys/systm.h>
38#include <sys/malloc.h>
39#include <sys/conf.h>
40#include <sys/device.h>
41
42#include <sys/bus.h>
43#include <machine/endian.h>
44#include <sys/intr.h>
45
46#if NBPFILTER > 0
47#include <net/bpf.h>
48#endif
49#include <net/if.h>
50#include <net/if_arp.h>
51#include <net/if_dl.h>
52#include <net/if_ether.h>
53#include <net/if_media.h>
54#include <net/if_types.h>
55
56#include <netinet/in.h>
57#include <netinet/in_systm.h>
58#include <netinet/in_var.h>
59#include <netinet/ip.h>
60
61#include <net80211/ieee80211_netbsd.h>
62#include <net80211/ieee80211_var.h>
63#include <net80211/ieee80211_amrr.h>
64#include <net80211/ieee80211_radiotap.h>
65
66#include <dev/firmload.h>
67
68#include <dev/usb/usb.h>
69#include <dev/usb/usbdi.h>
70#include <dev/usb/usbdi_util.h>
71#include <dev/usb/usbdevs.h>
72
73#include <dev/usb/if_rumreg.h>
74#include <dev/usb/if_rumvar.h>
75
76#ifdef USB_DEBUG
77#define RUM_DEBUG
78#endif
79
80#ifdef RUM_DEBUG
81#define DPRINTF(x)	do { if (rum_debug) logprintf x; } while (0)
82#define DPRINTFN(n, x)	do { if (rum_debug >= (n)) logprintf x; } while (0)
83int rum_debug = 1;
84#else
85#define DPRINTF(x)
86#define DPRINTFN(n, x)
87#endif
88
89/* various supported device vendors/products */
90static const struct usb_devno rum_devs[] = {
91	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_HWU54DM },
92	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_2 },
93	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_3 },
94	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_4 },
95	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_WUG2700 },
96	{ USB_VENDOR_AMIT,		USB_PRODUCT_AMIT_CGWLUSB2GO },
97	{ USB_VENDOR_ASUSTEK,		USB_PRODUCT_ASUSTEK_WL167G_2 },
98	{ USB_VENDOR_ASUSTEK,		USB_PRODUCT_ASUSTEK_WL167G_3 },
99	{ USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D7050A },
100	{ USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D9050V3 },
101	{ USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GC },
102	{ USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GR },
103	{ USB_VENDOR_CONCEPTRONIC,	USB_PRODUCT_CONCEPTRONIC_C54RU2 },
104	{ USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GL },
105	{ USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GPX },
106	{ USB_VENDOR_DICKSMITH,		USB_PRODUCT_DICKSMITH_CWD854F },
107	{ USB_VENDOR_DICKSMITH,		USB_PRODUCT_DICKSMITH_RT2573 },
108	{ USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWLG122C1 },
109	{ USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_WUA1340 },
110	{ USB_VENDOR_GIGABYTE,		USB_PRODUCT_GIGABYTE_GNWB01GS },
111	{ USB_VENDOR_GIGABYTE,		USB_PRODUCT_GIGABYTE_GNWI05GS },
112	{ USB_VENDOR_GIGASET,		USB_PRODUCT_GIGASET_RT2573 },
113	{ USB_VENDOR_GOODWAY,		USB_PRODUCT_GOODWAY_RT2573 },
114	{ USB_VENDOR_GUILLEMOT,		USB_PRODUCT_GUILLEMOT_HWGUSB254LB },
115	{ USB_VENDOR_GUILLEMOT,		USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP },
116	{ USB_VENDOR_HUAWEI3COM,	USB_PRODUCT_HUAWEI3COM_RT2573 },
117	{ USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_G54HP },
118	{ USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_SG54HP },
119	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573 },
120	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_2 },
121	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_3 },
122	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_4 },
123	{ USB_VENDOR_NOVATECH,		USB_PRODUCT_NOVATECH_RT2573 },
124	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUS54HP },
125	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUS54MINI2 },
126	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUSMM },
127	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573 },
128	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573_2 },
129	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573_3 },
130	{ USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573 },
131	{ USB_VENDOR_RALINK_2,          USB_PRODUCT_RALINK_2_RT2573 },
132	{ USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2671 },
133	{ USB_VENDOR_SITECOMEU,		USB_PRODUCT_SITECOMEU_WL113R2 },
134	{ USB_VENDOR_SITECOMEU,		USB_PRODUCT_SITECOMEU_WL172 },
135	{ USB_VENDOR_SURECOM,		USB_PRODUCT_SURECOM_RT2573 }
136};
137
138Static int		rum_attachhook(void *);
139Static int		rum_alloc_tx_list(struct rum_softc *);
140Static void		rum_free_tx_list(struct rum_softc *);
141Static int		rum_alloc_rx_list(struct rum_softc *);
142Static void		rum_free_rx_list(struct rum_softc *);
143Static int		rum_media_change(struct ifnet *);
144Static void		rum_next_scan(void *);
145Static void		rum_task(void *);
146Static int		rum_newstate(struct ieee80211com *,
147			    enum ieee80211_state, int);
148Static void		rum_txeof(usbd_xfer_handle, usbd_private_handle,
149			    usbd_status);
150Static void		rum_rxeof(usbd_xfer_handle, usbd_private_handle,
151			    usbd_status);
152#if NBPFILTER > 0
153Static uint8_t		rum_rxrate(const struct rum_rx_desc *);
154#endif
155Static int		rum_ack_rate(struct ieee80211com *, int);
156Static uint16_t		rum_txtime(int, int, uint32_t);
157Static uint8_t		rum_plcp_signal(int);
158Static void		rum_setup_tx_desc(struct rum_softc *,
159			    struct rum_tx_desc *, uint32_t, uint16_t, int,
160			    int);
161Static int		rum_tx_mgt(struct rum_softc *, struct mbuf *,
162			    struct ieee80211_node *);
163Static int		rum_tx_data(struct rum_softc *, struct mbuf *,
164			    struct ieee80211_node *);
165Static void		rum_start(struct ifnet *);
166Static void		rum_watchdog(struct ifnet *);
167Static int		rum_ioctl(struct ifnet *, u_long, void *);
168Static void		rum_eeprom_read(struct rum_softc *, uint16_t, void *,
169			    int);
170Static uint32_t		rum_read(struct rum_softc *, uint16_t);
171Static void		rum_read_multi(struct rum_softc *, uint16_t, void *,
172			    int);
173Static void		rum_write(struct rum_softc *, uint16_t, uint32_t);
174Static void		rum_write_multi(struct rum_softc *, uint16_t, void *,
175			    size_t);
176Static void		rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
177Static uint8_t		rum_bbp_read(struct rum_softc *, uint8_t);
178Static void		rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
179Static void		rum_select_antenna(struct rum_softc *);
180Static void		rum_enable_mrr(struct rum_softc *);
181Static void		rum_set_txpreamble(struct rum_softc *);
182Static void		rum_set_basicrates(struct rum_softc *);
183Static void		rum_select_band(struct rum_softc *,
184			    struct ieee80211_channel *);
185Static void		rum_set_chan(struct rum_softc *,
186			    struct ieee80211_channel *);
187Static void		rum_enable_tsf_sync(struct rum_softc *);
188Static void		rum_update_slot(struct rum_softc *);
189Static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
190Static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
191Static void		rum_update_promisc(struct rum_softc *);
192Static const char	*rum_get_rf(int);
193Static void		rum_read_eeprom(struct rum_softc *);
194Static int		rum_bbp_init(struct rum_softc *);
195Static int		rum_init(struct ifnet *);
196Static void		rum_stop(struct ifnet *, int);
197Static int		rum_load_microcode(struct rum_softc *, const u_char *,
198			    size_t);
199Static int		rum_prepare_beacon(struct rum_softc *);
200Static void		rum_newassoc(struct ieee80211_node *, int);
201Static void		rum_amrr_start(struct rum_softc *,
202			    struct ieee80211_node *);
203Static void		rum_amrr_timeout(void *);
204Static void		rum_amrr_update(usbd_xfer_handle, usbd_private_handle,
205			    usbd_status status);
206
207/*
208 * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
209 */
210static const struct ieee80211_rateset rum_rateset_11a =
211	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
212
213static const struct ieee80211_rateset rum_rateset_11b =
214	{ 4, { 2, 4, 11, 22 } };
215
216static const struct ieee80211_rateset rum_rateset_11g =
217	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
218
219static const struct {
220	uint32_t	reg;
221	uint32_t	val;
222} rum_def_mac[] = {
223	RT2573_DEF_MAC
224};
225
226static const struct {
227	uint8_t	reg;
228	uint8_t	val;
229} rum_def_bbp[] = {
230	RT2573_DEF_BBP
231};
232
233static const struct rfprog {
234	uint8_t		chan;
235	uint32_t	r1, r2, r3, r4;
236}  rum_rf5226[] = {
237	RT2573_RF5226
238}, rum_rf5225[] = {
239	RT2573_RF5225
240};
241
242USB_DECLARE_DRIVER(rum);
243
244USB_MATCH(rum)
245{
246	USB_MATCH_START(rum, uaa);
247
248	return (usb_lookup(rum_devs, uaa->vendor, uaa->product) != NULL) ?
249	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
250}
251
252Static int
253rum_attachhook(void *xsc)
254{
255	struct rum_softc *sc = xsc;
256	firmware_handle_t fwh;
257	const char *name = "rum-rt2573";
258	u_char *ucode;
259	size_t size;
260	int error;
261
262	if ((error = firmware_open("rum", name, &fwh)) != 0) {
263		printf("%s: failed loadfirmware of file %s (error %d)\n",
264		    USBDEVNAME(sc->sc_dev), name, error);
265		return error;
266	}
267	size = firmware_get_size(fwh);
268	ucode = firmware_malloc(size);
269	if (ucode == NULL) {
270		printf("%s: failed to allocate firmware memory\n",
271		    USBDEVNAME(sc->sc_dev));
272		firmware_close(fwh);
273		return ENOMEM;;
274	}
275	error = firmware_read(fwh, 0, ucode, size);
276	firmware_close(fwh);
277	if (error != 0) {
278		printf("%s: failed to read firmware (error %d)\n",
279		    USBDEVNAME(sc->sc_dev), error);
280		firmware_free(ucode, 0);
281		return error;
282	}
283
284	if (rum_load_microcode(sc, ucode, size) != 0) {
285		printf("%s: could not load 8051 microcode\n",
286		    USBDEVNAME(sc->sc_dev));
287		firmware_free(ucode, 0);
288		return ENXIO;
289	}
290
291	firmware_free(ucode, 0);
292	sc->sc_flags |= RT2573_FWLOADED;
293
294	return 0;
295}
296
297USB_ATTACH(rum)
298{
299	USB_ATTACH_START(rum, sc, uaa);
300	struct ieee80211com *ic = &sc->sc_ic;
301	struct ifnet *ifp = &sc->sc_if;
302	usb_interface_descriptor_t *id;
303	usb_endpoint_descriptor_t *ed;
304	usbd_status error;
305	char *devinfop;
306	int i, ntries;
307	uint32_t tmp;
308
309	sc->sc_dev = self;
310	sc->sc_udev = uaa->device;
311	sc->sc_flags = 0;
312
313	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
314	USB_ATTACH_SETUP;
315	aprint_normal_dev(self, "%s\n", devinfop);
316	usbd_devinfo_free(devinfop);
317
318	if (usbd_set_config_no(sc->sc_udev, RT2573_CONFIG_NO, 0) != 0) {
319		aprint_error_dev(self, "could not set configuration no\n");
320		USB_ATTACH_ERROR_RETURN;
321	}
322
323	/* get the first interface handle */
324	error = usbd_device2interface_handle(sc->sc_udev, RT2573_IFACE_INDEX,
325	    &sc->sc_iface);
326	if (error != 0) {
327		aprint_error_dev(self, "could not get interface handle\n");
328		USB_ATTACH_ERROR_RETURN;
329	}
330
331	/*
332	 * Find endpoints.
333	 */
334	id = usbd_get_interface_descriptor(sc->sc_iface);
335
336	sc->sc_rx_no = sc->sc_tx_no = -1;
337	for (i = 0; i < id->bNumEndpoints; i++) {
338		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
339		if (ed == NULL) {
340			aprint_error_dev(self,
341			    "no endpoint descriptor for iface %d\n", i);
342			USB_ATTACH_ERROR_RETURN;
343		}
344
345		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
346		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
347			sc->sc_rx_no = ed->bEndpointAddress;
348		else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
349		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
350			sc->sc_tx_no = ed->bEndpointAddress;
351	}
352	if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
353		aprint_error_dev(self, "missing endpoint\n");
354		USB_ATTACH_ERROR_RETURN;
355	}
356
357	usb_init_task(&sc->sc_task, rum_task, sc);
358	usb_callout_init(sc->sc_scan_ch);
359
360	sc->amrr.amrr_min_success_threshold =  1;
361	sc->amrr.amrr_max_success_threshold = 10;
362	usb_callout_init(sc->sc_amrr_ch);
363
364	/* retrieve RT2573 rev. no */
365	for (ntries = 0; ntries < 1000; ntries++) {
366		if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
367			break;
368		DELAY(1000);
369	}
370	if (ntries == 1000) {
371		aprint_error_dev(self, "timeout waiting for chip to settle\n");
372		USB_ATTACH_ERROR_RETURN;
373	}
374
375	/* retrieve MAC address and various other things from EEPROM */
376	rum_read_eeprom(sc);
377
378	aprint_normal_dev(self,
379	    "MAC/BBP RT%04x (rev 0x%05x), RF %s, address %s\n",
380	    sc->macbbp_rev, tmp,
381	    rum_get_rf(sc->rf_rev), ether_sprintf(ic->ic_myaddr));
382
383	ic->ic_ifp = ifp;
384	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
385	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
386	ic->ic_state = IEEE80211_S_INIT;
387
388	/* set device capabilities */
389	ic->ic_caps =
390	    IEEE80211_C_IBSS |		/* IBSS mode supported */
391	    IEEE80211_C_MONITOR |	/* monitor mode supported */
392	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
393	    IEEE80211_C_TXPMGT |	/* tx power management */
394	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
395	    IEEE80211_C_SHSLOT |	/* short slot time supported */
396	    IEEE80211_C_WPA;		/* 802.11i */
397
398	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
399		/* set supported .11a rates */
400		ic->ic_sup_rates[IEEE80211_MODE_11A] = rum_rateset_11a;
401
402		/* set supported .11a channels */
403		for (i = 34; i <= 46; i += 4) {
404			ic->ic_channels[i].ic_freq =
405			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
406			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
407		}
408		for (i = 36; i <= 64; i += 4) {
409			ic->ic_channels[i].ic_freq =
410			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
411			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
412		}
413		for (i = 100; i <= 140; i += 4) {
414			ic->ic_channels[i].ic_freq =
415			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
416			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
417		}
418		for (i = 149; i <= 165; i += 4) {
419			ic->ic_channels[i].ic_freq =
420			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
421			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
422		}
423	}
424
425	/* set supported .11b and .11g rates */
426	ic->ic_sup_rates[IEEE80211_MODE_11B] = rum_rateset_11b;
427	ic->ic_sup_rates[IEEE80211_MODE_11G] = rum_rateset_11g;
428
429	/* set supported .11b and .11g channels (1 through 14) */
430	for (i = 1; i <= 14; i++) {
431		ic->ic_channels[i].ic_freq =
432		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
433		ic->ic_channels[i].ic_flags =
434		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
435		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
436	}
437
438	ifp->if_softc = sc;
439	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
440	ifp->if_init = rum_init;
441	ifp->if_ioctl = rum_ioctl;
442	ifp->if_start = rum_start;
443	ifp->if_watchdog = rum_watchdog;
444	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
445	IFQ_SET_READY(&ifp->if_snd);
446	memcpy(ifp->if_xname, USBDEVNAME(sc->sc_dev), IFNAMSIZ);
447
448	if_attach(ifp);
449	ieee80211_ifattach(ic);
450	ic->ic_newassoc = rum_newassoc;
451
452	/* override state transition machine */
453	sc->sc_newstate = ic->ic_newstate;
454	ic->ic_newstate = rum_newstate;
455	ieee80211_media_init(ic, rum_media_change, ieee80211_media_status);
456
457#if NBPFILTER > 0
458	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
459	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN, &sc->sc_drvbpf);
460
461	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
462	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
463	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
464
465	sc->sc_txtap_len = sizeof sc->sc_txtapu;
466	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
467	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
468#endif
469
470	ieee80211_announce(ic);
471
472	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
473	    USBDEV(sc->sc_dev));
474
475	USB_ATTACH_SUCCESS_RETURN;
476}
477
478USB_DETACH(rum)
479{
480	USB_DETACH_START(rum, sc);
481	struct ieee80211com *ic = &sc->sc_ic;
482	struct ifnet *ifp = &sc->sc_if;
483	int s;
484
485	if (!ifp->if_softc)
486		return 0;
487
488	s = splusb();
489
490	rum_stop(ifp, 1);
491	usb_rem_task(sc->sc_udev, &sc->sc_task);
492	usb_uncallout(sc->sc_scan_ch, rum_next_scan, sc);
493	usb_uncallout(sc->sc_amrr_ch, rum_amrr_timeout, sc);
494
495	if (sc->amrr_xfer != NULL) {
496		usbd_free_xfer(sc->amrr_xfer);
497		sc->amrr_xfer = NULL;
498	}
499
500	if (sc->sc_rx_pipeh != NULL) {
501		usbd_abort_pipe(sc->sc_rx_pipeh);
502		usbd_close_pipe(sc->sc_rx_pipeh);
503	}
504
505	if (sc->sc_tx_pipeh != NULL) {
506		usbd_abort_pipe(sc->sc_tx_pipeh);
507		usbd_close_pipe(sc->sc_tx_pipeh);
508	}
509
510#if NBPFILTER > 0
511	bpfdetach(ifp);
512#endif
513	ieee80211_ifdetach(ic);	/* free all nodes */
514	if_detach(ifp);
515
516	splx(s);
517
518	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
519	    USBDEV(sc->sc_dev));
520
521	return 0;
522}
523
524Static int
525rum_alloc_tx_list(struct rum_softc *sc)
526{
527	struct rum_tx_data *data;
528	int i, error;
529
530	sc->tx_queued = 0;
531
532	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
533		data = &sc->tx_data[i];
534
535		data->sc = sc;
536
537		data->xfer = usbd_alloc_xfer(sc->sc_udev);
538		if (data->xfer == NULL) {
539			printf("%s: could not allocate tx xfer\n",
540			    USBDEVNAME(sc->sc_dev));
541			error = ENOMEM;
542			goto fail;
543		}
544
545		data->buf = usbd_alloc_buffer(data->xfer,
546		    RT2573_TX_DESC_SIZE + MCLBYTES);
547		if (data->buf == NULL) {
548			printf("%s: could not allocate tx buffer\n",
549			    USBDEVNAME(sc->sc_dev));
550			error = ENOMEM;
551			goto fail;
552		}
553
554		/* clean Tx descriptor */
555		bzero(data->buf, RT2573_TX_DESC_SIZE);
556	}
557
558	return 0;
559
560fail:	rum_free_tx_list(sc);
561	return error;
562}
563
564Static void
565rum_free_tx_list(struct rum_softc *sc)
566{
567	struct rum_tx_data *data;
568	int i;
569
570	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
571		data = &sc->tx_data[i];
572
573		if (data->xfer != NULL) {
574			usbd_free_xfer(data->xfer);
575			data->xfer = NULL;
576		}
577
578		if (data->ni != NULL) {
579			ieee80211_free_node(data->ni);
580			data->ni = NULL;
581		}
582	}
583}
584
585Static int
586rum_alloc_rx_list(struct rum_softc *sc)
587{
588	struct rum_rx_data *data;
589	int i, error;
590
591	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
592		data = &sc->rx_data[i];
593
594		data->sc = sc;
595
596		data->xfer = usbd_alloc_xfer(sc->sc_udev);
597		if (data->xfer == NULL) {
598			printf("%s: could not allocate rx xfer\n",
599			    USBDEVNAME(sc->sc_dev));
600			error = ENOMEM;
601			goto fail;
602		}
603
604		if (usbd_alloc_buffer(data->xfer, MCLBYTES) == NULL) {
605			printf("%s: could not allocate rx buffer\n",
606			    USBDEVNAME(sc->sc_dev));
607			error = ENOMEM;
608			goto fail;
609		}
610
611		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
612		if (data->m == NULL) {
613			printf("%s: could not allocate rx mbuf\n",
614			    USBDEVNAME(sc->sc_dev));
615			error = ENOMEM;
616			goto fail;
617		}
618
619		MCLGET(data->m, M_DONTWAIT);
620		if (!(data->m->m_flags & M_EXT)) {
621			printf("%s: could not allocate rx mbuf cluster\n",
622			    USBDEVNAME(sc->sc_dev));
623			error = ENOMEM;
624			goto fail;
625		}
626
627		data->buf = mtod(data->m, uint8_t *);
628	}
629
630	return 0;
631
632fail:	rum_free_tx_list(sc);
633	return error;
634}
635
636Static void
637rum_free_rx_list(struct rum_softc *sc)
638{
639	struct rum_rx_data *data;
640	int i;
641
642	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
643		data = &sc->rx_data[i];
644
645		if (data->xfer != NULL) {
646			usbd_free_xfer(data->xfer);
647			data->xfer = NULL;
648		}
649
650		if (data->m != NULL) {
651			m_freem(data->m);
652			data->m = NULL;
653		}
654	}
655}
656
657Static int
658rum_media_change(struct ifnet *ifp)
659{
660	int error;
661
662	error = ieee80211_media_change(ifp);
663	if (error != ENETRESET)
664		return error;
665
666	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
667		rum_init(ifp);
668
669	return 0;
670}
671
672/*
673 * This function is called periodically (every 200ms) during scanning to
674 * switch from one channel to another.
675 */
676Static void
677rum_next_scan(void *arg)
678{
679	struct rum_softc *sc = arg;
680	struct ieee80211com *ic = &sc->sc_ic;
681
682	if (ic->ic_state == IEEE80211_S_SCAN)
683		ieee80211_next_scan(ic);
684}
685
686Static void
687rum_task(void *arg)
688{
689	struct rum_softc *sc = arg;
690	struct ieee80211com *ic = &sc->sc_ic;
691	enum ieee80211_state ostate;
692	struct ieee80211_node *ni;
693	uint32_t tmp;
694
695	ostate = ic->ic_state;
696
697	switch (sc->sc_state) {
698	case IEEE80211_S_INIT:
699		if (ostate == IEEE80211_S_RUN) {
700			/* abort TSF synchronization */
701			tmp = rum_read(sc, RT2573_TXRX_CSR9);
702			rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
703		}
704		break;
705
706	case IEEE80211_S_SCAN:
707		rum_set_chan(sc, ic->ic_curchan);
708		usb_callout(sc->sc_scan_ch, hz / 5, rum_next_scan, sc);
709		break;
710
711	case IEEE80211_S_AUTH:
712		rum_set_chan(sc, ic->ic_curchan);
713		break;
714
715	case IEEE80211_S_ASSOC:
716		rum_set_chan(sc, ic->ic_curchan);
717		break;
718
719	case IEEE80211_S_RUN:
720		rum_set_chan(sc, ic->ic_curchan);
721
722		ni = ic->ic_bss;
723
724		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
725			rum_update_slot(sc);
726			rum_enable_mrr(sc);
727			rum_set_txpreamble(sc);
728			rum_set_basicrates(sc);
729			rum_set_bssid(sc, ni->ni_bssid);
730		}
731
732		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
733		    ic->ic_opmode == IEEE80211_M_IBSS)
734			rum_prepare_beacon(sc);
735
736		if (ic->ic_opmode != IEEE80211_M_MONITOR)
737			rum_enable_tsf_sync(sc);
738
739		if (ic->ic_opmode == IEEE80211_M_STA) {
740			/* fake a join to init the tx rate */
741			rum_newassoc(ic->ic_bss, 1);
742
743			/* enable automatic rate adaptation in STA mode */
744			if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
745				rum_amrr_start(sc, ni);
746		}
747
748		break;
749	}
750
751	sc->sc_newstate(ic, sc->sc_state, -1);
752}
753
754Static int
755rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
756{
757	struct rum_softc *sc = ic->ic_ifp->if_softc;
758
759	usb_rem_task(sc->sc_udev, &sc->sc_task);
760	usb_uncallout(sc->sc_scan_ch, rum_next_scan, sc);
761	usb_uncallout(sc->sc_amrr_ch, rum_amrr_timeout, sc);
762
763	/* do it in a process context */
764	sc->sc_state = nstate;
765	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
766
767	return 0;
768}
769
770/* quickly determine if a given rate is CCK or OFDM */
771#define RUM_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
772
773#define RUM_ACK_SIZE	14	/* 10 + 4(FCS) */
774#define RUM_CTS_SIZE	14	/* 10 + 4(FCS) */
775
776Static void
777rum_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
778{
779	struct rum_tx_data *data = priv;
780	struct rum_softc *sc = data->sc;
781	struct ifnet *ifp = &sc->sc_if;
782	int s;
783
784	if (status != USBD_NORMAL_COMPLETION) {
785		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
786			return;
787
788		printf("%s: could not transmit buffer: %s\n",
789		    USBDEVNAME(sc->sc_dev), usbd_errstr(status));
790
791		if (status == USBD_STALLED)
792			usbd_clear_endpoint_stall_async(sc->sc_tx_pipeh);
793
794		ifp->if_oerrors++;
795		return;
796	}
797
798	s = splnet();
799
800	ieee80211_free_node(data->ni);
801	data->ni = NULL;
802
803	sc->tx_queued--;
804	ifp->if_opackets++;
805
806	DPRINTFN(10, ("tx done\n"));
807
808	sc->sc_tx_timer = 0;
809	ifp->if_flags &= ~IFF_OACTIVE;
810	rum_start(ifp);
811
812	splx(s);
813}
814
815Static void
816rum_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
817{
818	struct rum_rx_data *data = priv;
819	struct rum_softc *sc = data->sc;
820	struct ieee80211com *ic = &sc->sc_ic;
821	struct ifnet *ifp = &sc->sc_if;
822	struct rum_rx_desc *desc;
823	struct ieee80211_frame *wh;
824	struct ieee80211_node *ni;
825	struct mbuf *mnew, *m;
826	int s, len;
827
828	if (status != USBD_NORMAL_COMPLETION) {
829		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
830			return;
831
832		if (status == USBD_STALLED)
833			usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
834		goto skip;
835	}
836
837	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
838
839	if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
840		DPRINTF(("%s: xfer too short %d\n", USBDEVNAME(sc->sc_dev),
841		    len));
842		ifp->if_ierrors++;
843		goto skip;
844	}
845
846	desc = (struct rum_rx_desc *)data->buf;
847
848	if (le32toh(desc->flags) & RT2573_RX_CRC_ERROR) {
849		/*
850		 * This should not happen since we did not request to receive
851		 * those frames when we filled RT2573_TXRX_CSR0.
852		 */
853		DPRINTFN(5, ("CRC error\n"));
854		ifp->if_ierrors++;
855		goto skip;
856	}
857
858	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
859	if (mnew == NULL) {
860		printf("%s: could not allocate rx mbuf\n",
861		    USBDEVNAME(sc->sc_dev));
862		ifp->if_ierrors++;
863		goto skip;
864	}
865
866	MCLGET(mnew, M_DONTWAIT);
867	if (!(mnew->m_flags & M_EXT)) {
868		printf("%s: could not allocate rx mbuf cluster\n",
869		    USBDEVNAME(sc->sc_dev));
870		m_freem(mnew);
871		ifp->if_ierrors++;
872		goto skip;
873	}
874
875	m = data->m;
876	data->m = mnew;
877	data->buf = mtod(data->m, uint8_t *);
878
879	/* finalize mbuf */
880	m->m_pkthdr.rcvif = ifp;
881	m->m_data = (void *)(desc + 1);
882	m->m_pkthdr.len = m->m_len = (le32toh(desc->flags) >> 16) & 0xfff;
883
884	s = splnet();
885
886#if NBPFILTER > 0
887	if (sc->sc_drvbpf != NULL) {
888		struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
889
890		tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
891		tap->wr_rate = rum_rxrate(desc);
892		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
893		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
894		tap->wr_antenna = sc->rx_ant;
895		tap->wr_antsignal = desc->rssi;
896
897		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
898	}
899#endif
900
901	wh = mtod(m, struct ieee80211_frame *);
902	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
903
904	/* send the frame to the 802.11 layer */
905	ieee80211_input(ic, m, ni, desc->rssi, 0);
906
907	/* node is no longer needed */
908	ieee80211_free_node(ni);
909
910	splx(s);
911
912	DPRINTFN(15, ("rx done\n"));
913
914skip:	/* setup a new transfer */
915	usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data, data->buf, MCLBYTES,
916	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
917	usbd_transfer(xfer);
918}
919
920/*
921 * This function is only used by the Rx radiotap code. It returns the rate at
922 * which a given frame was received.
923 */
924#if NBPFILTER > 0
925Static uint8_t
926rum_rxrate(const struct rum_rx_desc *desc)
927{
928	if (le32toh(desc->flags) & RT2573_RX_OFDM) {
929		/* reverse function of rum_plcp_signal */
930		switch (desc->rate) {
931		case 0xb:	return 12;
932		case 0xf:	return 18;
933		case 0xa:	return 24;
934		case 0xe:	return 36;
935		case 0x9:	return 48;
936		case 0xd:	return 72;
937		case 0x8:	return 96;
938		case 0xc:	return 108;
939		}
940	} else {
941		if (desc->rate == 10)
942			return 2;
943		if (desc->rate == 20)
944			return 4;
945		if (desc->rate == 55)
946			return 11;
947		if (desc->rate == 110)
948			return 22;
949	}
950	return 2;	/* should not get there */
951}
952#endif
953
954/*
955 * Return the expected ack rate for a frame transmitted at rate `rate'.
956 * XXX: this should depend on the destination node basic rate set.
957 */
958Static int
959rum_ack_rate(struct ieee80211com *ic, int rate)
960{
961	switch (rate) {
962	/* CCK rates */
963	case 2:
964		return 2;
965	case 4:
966	case 11:
967	case 22:
968		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
969
970	/* OFDM rates */
971	case 12:
972	case 18:
973		return 12;
974	case 24:
975	case 36:
976		return 24;
977	case 48:
978	case 72:
979	case 96:
980	case 108:
981		return 48;
982	}
983
984	/* default to 1Mbps */
985	return 2;
986}
987
988/*
989 * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
990 * The function automatically determines the operating mode depending on the
991 * given rate. `flags' indicates whether short preamble is in use or not.
992 */
993Static uint16_t
994rum_txtime(int len, int rate, uint32_t flags)
995{
996	uint16_t txtime;
997
998	if (RUM_RATE_IS_OFDM(rate)) {
999		/* IEEE Std 802.11a-1999, pp. 37 */
1000		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1001		txtime = 16 + 4 + 4 * txtime + 6;
1002	} else {
1003		/* IEEE Std 802.11b-1999, pp. 28 */
1004		txtime = (16 * len + rate - 1) / rate;
1005		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1006			txtime +=  72 + 24;
1007		else
1008			txtime += 144 + 48;
1009	}
1010	return txtime;
1011}
1012
1013Static uint8_t
1014rum_plcp_signal(int rate)
1015{
1016	switch (rate) {
1017	/* CCK rates (returned values are device-dependent) */
1018	case 2:		return 0x0;
1019	case 4:		return 0x1;
1020	case 11:	return 0x2;
1021	case 22:	return 0x3;
1022
1023	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1024	case 12:	return 0xb;
1025	case 18:	return 0xf;
1026	case 24:	return 0xa;
1027	case 36:	return 0xe;
1028	case 48:	return 0x9;
1029	case 72:	return 0xd;
1030	case 96:	return 0x8;
1031	case 108:	return 0xc;
1032
1033	/* unsupported rates (should not get there) */
1034	default:	return 0xff;
1035	}
1036}
1037
1038Static void
1039rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1040    uint32_t flags, uint16_t xflags, int len, int rate)
1041{
1042	struct ieee80211com *ic = &sc->sc_ic;
1043	uint16_t plcp_length;
1044	int remainder;
1045
1046	desc->flags = htole32(flags);
1047	desc->flags |= htole32(RT2573_TX_VALID);
1048	desc->flags |= htole32(len << 16);
1049
1050	desc->xflags = htole16(xflags);
1051
1052	desc->wme = htole16(
1053	    RT2573_QID(0) |
1054	    RT2573_AIFSN(2) |
1055	    RT2573_LOGCWMIN(4) |
1056	    RT2573_LOGCWMAX(10));
1057
1058	/* setup PLCP fields */
1059	desc->plcp_signal  = rum_plcp_signal(rate);
1060	desc->plcp_service = 4;
1061
1062	len += IEEE80211_CRC_LEN;
1063	if (RUM_RATE_IS_OFDM(rate)) {
1064		desc->flags |= htole32(RT2573_TX_OFDM);
1065
1066		plcp_length = len & 0xfff;
1067		desc->plcp_length_hi = plcp_length >> 6;
1068		desc->plcp_length_lo = plcp_length & 0x3f;
1069	} else {
1070		plcp_length = (16 * len + rate - 1) / rate;
1071		if (rate == 22) {
1072			remainder = (16 * len) % 22;
1073			if (remainder != 0 && remainder < 7)
1074				desc->plcp_service |= RT2573_PLCP_LENGEXT;
1075		}
1076		desc->plcp_length_hi = plcp_length >> 8;
1077		desc->plcp_length_lo = plcp_length & 0xff;
1078
1079		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1080			desc->plcp_signal |= 0x08;
1081	}
1082}
1083
1084#define RUM_TX_TIMEOUT	5000
1085
1086Static int
1087rum_tx_mgt(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1088{
1089	struct ieee80211com *ic = &sc->sc_ic;
1090	struct rum_tx_desc *desc;
1091	struct rum_tx_data *data;
1092	struct ieee80211_frame *wh;
1093	struct ieee80211_key *k;
1094	uint32_t flags = 0;
1095	uint16_t dur;
1096	usbd_status error;
1097	int xferlen, rate;
1098
1099	data = &sc->tx_data[0];
1100	desc = (struct rum_tx_desc *)data->buf;
1101
1102	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1103
1104	data->m = m0;
1105	data->ni = ni;
1106
1107	wh = mtod(m0, struct ieee80211_frame *);
1108
1109	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1110		k = ieee80211_crypto_encap(ic, ni, m0);
1111		if (k == NULL) {
1112			m_freem(m0);
1113			return ENOBUFS;
1114		}
1115	}
1116
1117	wh = mtod(m0, struct ieee80211_frame *);
1118
1119	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1120		flags |= RT2573_TX_NEED_ACK;
1121
1122		dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1123		    ic->ic_flags) + sc->sifs;
1124		*(uint16_t *)wh->i_dur = htole16(dur);
1125
1126		/* tell hardware to set timestamp in probe responses */
1127		if ((wh->i_fc[0] &
1128		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1129		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1130			flags |= RT2573_TX_TIMESTAMP;
1131	}
1132
1133#if NBPFILTER > 0
1134	if (sc->sc_drvbpf != NULL) {
1135		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1136
1137		tap->wt_flags = 0;
1138		tap->wt_rate = rate;
1139		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1140		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1141		tap->wt_antenna = sc->tx_ant;
1142
1143		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1144	}
1145#endif
1146
1147	m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1148	rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1149
1150	/* align end on a 4-bytes boundary */
1151	xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1152
1153	/*
1154	 * No space left in the last URB to store the extra 4 bytes, force
1155	 * sending of another URB.
1156	 */
1157	if ((xferlen % 64) == 0)
1158		xferlen += 4;
1159
1160	DPRINTFN(10, ("sending msg frame len=%zu rate=%u xfer len=%u\n",
1161	    (size_t)m0->m_pkthdr.len + RT2573_TX_DESC_SIZE,
1162	    rate, xferlen));
1163
1164	usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1165	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1166
1167	error = usbd_transfer(data->xfer);
1168	if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1169		m_freem(m0);
1170		return error;
1171	}
1172
1173	sc->tx_queued++;
1174
1175	return 0;
1176}
1177
1178Static int
1179rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1180{
1181	struct ieee80211com *ic = &sc->sc_ic;
1182	struct rum_tx_desc *desc;
1183	struct rum_tx_data *data;
1184	struct ieee80211_frame *wh;
1185	struct ieee80211_key *k;
1186	uint32_t flags = 0;
1187	uint16_t dur;
1188	usbd_status error;
1189	int xferlen, rate;
1190
1191	wh = mtod(m0, struct ieee80211_frame *);
1192
1193	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
1194		rate = ic->ic_bss->ni_rates.rs_rates[ic->ic_fixed_rate];
1195	else
1196		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1197	if (rate == 0)
1198		rate = 2;	/* XXX should not happen */
1199	rate &= IEEE80211_RATE_VAL;
1200
1201	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1202		k = ieee80211_crypto_encap(ic, ni, m0);
1203		if (k == NULL) {
1204			m_freem(m0);
1205			return ENOBUFS;
1206		}
1207
1208		/* packet header may have moved, reset our local pointer */
1209		wh = mtod(m0, struct ieee80211_frame *);
1210	}
1211
1212	data = &sc->tx_data[0];
1213	desc = (struct rum_tx_desc *)data->buf;
1214
1215	data->ni = ni;
1216
1217	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1218		flags |= RT2573_TX_NEED_ACK;
1219
1220		dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1221		    ic->ic_flags) + sc->sifs;
1222		*(uint16_t *)wh->i_dur = htole16(dur);
1223	}
1224
1225#if NBPFILTER > 0
1226	if (sc->sc_drvbpf != NULL) {
1227		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1228
1229		tap->wt_flags = 0;
1230		tap->wt_rate = rate;
1231		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1232		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1233		tap->wt_antenna = sc->tx_ant;
1234
1235		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1236	}
1237#endif
1238
1239	m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1240	rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1241
1242	/* align end on a 4-bytes boundary */
1243	xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1244
1245	/*
1246	 * No space left in the last URB to store the extra 4 bytes, force
1247	 * sending of another URB.
1248	 */
1249	if ((xferlen % 64) == 0)
1250		xferlen += 4;
1251
1252	DPRINTFN(10, ("sending data frame len=%zu rate=%u xfer len=%u\n",
1253	    (size_t)m0->m_pkthdr.len + RT2573_TX_DESC_SIZE,
1254	    rate, xferlen));
1255
1256	/* mbuf is no longer needed */
1257	m_freem(m0);
1258
1259	usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1260	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1261
1262	error = usbd_transfer(data->xfer);
1263	if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS)
1264		return error;
1265
1266	sc->tx_queued++;
1267
1268	return 0;
1269}
1270
1271Static void
1272rum_start(struct ifnet *ifp)
1273{
1274	struct rum_softc *sc = ifp->if_softc;
1275	struct ieee80211com *ic = &sc->sc_ic;
1276	struct ether_header *eh;
1277	struct ieee80211_node *ni;
1278	struct mbuf *m0;
1279
1280	for (;;) {
1281		IF_POLL(&ic->ic_mgtq, m0);
1282		if (m0 != NULL) {
1283			if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1284				ifp->if_flags |= IFF_OACTIVE;
1285				break;
1286			}
1287			IF_DEQUEUE(&ic->ic_mgtq, m0);
1288
1289			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1290			m0->m_pkthdr.rcvif = NULL;
1291#if NBPFILTER > 0
1292			if (ic->ic_rawbpf != NULL)
1293				bpf_mtap(ic->ic_rawbpf, m0);
1294#endif
1295			if (rum_tx_mgt(sc, m0, ni) != 0)
1296				break;
1297
1298		} else {
1299			if (ic->ic_state != IEEE80211_S_RUN)
1300				break;
1301			IFQ_POLL(&ifp->if_snd, m0);
1302			if (m0 == NULL)
1303				break;
1304			if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1305				ifp->if_flags |= IFF_OACTIVE;
1306				break;
1307			}
1308			IFQ_DEQUEUE(&ifp->if_snd, m0);
1309			if (m0->m_len < sizeof(struct ether_header) &&
1310			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
1311				continue;
1312
1313			eh = mtod(m0, struct ether_header *);
1314			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1315			if (ni == NULL) {
1316				m_freem(m0);
1317				continue;
1318			}
1319#if NBPFILTER > 0
1320			if (ifp->if_bpf != NULL)
1321				bpf_mtap(ifp->if_bpf, m0);
1322#endif
1323			m0 = ieee80211_encap(ic, m0, ni);
1324			if (m0 == NULL) {
1325				ieee80211_free_node(ni);
1326				continue;
1327			}
1328#if NBPFILTER > 0
1329			if (ic->ic_rawbpf != NULL)
1330				bpf_mtap(ic->ic_rawbpf, m0);
1331#endif
1332			if (rum_tx_data(sc, m0, ni) != 0) {
1333				ieee80211_free_node(ni);
1334				ifp->if_oerrors++;
1335				break;
1336			}
1337		}
1338
1339		sc->sc_tx_timer = 5;
1340		ifp->if_timer = 1;
1341	}
1342}
1343
1344Static void
1345rum_watchdog(struct ifnet *ifp)
1346{
1347	struct rum_softc *sc = ifp->if_softc;
1348	struct ieee80211com *ic = &sc->sc_ic;
1349
1350	ifp->if_timer = 0;
1351
1352	if (sc->sc_tx_timer > 0) {
1353		if (--sc->sc_tx_timer == 0) {
1354			printf("%s: device timeout\n", USBDEVNAME(sc->sc_dev));
1355			/*rum_init(ifp); XXX needs a process context! */
1356			ifp->if_oerrors++;
1357			return;
1358		}
1359		ifp->if_timer = 1;
1360	}
1361
1362	ieee80211_watchdog(ic);
1363}
1364
1365Static int
1366rum_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1367{
1368	struct rum_softc *sc = ifp->if_softc;
1369	struct ieee80211com *ic = &sc->sc_ic;
1370	int s, error = 0;
1371
1372	s = splnet();
1373
1374	switch (cmd) {
1375	case SIOCSIFFLAGS:
1376		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1377			break;
1378		/* XXX re-use ether_ioctl() */
1379		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1380		case IFF_UP|IFF_RUNNING:
1381			rum_update_promisc(sc);
1382			break;
1383		case IFF_UP:
1384			rum_init(ifp);
1385			break;
1386		case IFF_RUNNING:
1387			rum_stop(ifp, 1);
1388			break;
1389		case 0:
1390			break;
1391		}
1392		break;
1393
1394	default:
1395		error = ieee80211_ioctl(ic, cmd, data);
1396	}
1397
1398	if (error == ENETRESET) {
1399		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1400		    (IFF_UP | IFF_RUNNING))
1401			rum_init(ifp);
1402		error = 0;
1403	}
1404
1405	splx(s);
1406
1407	return error;
1408}
1409
1410Static void
1411rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1412{
1413	usb_device_request_t req;
1414	usbd_status error;
1415
1416	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1417	req.bRequest = RT2573_READ_EEPROM;
1418	USETW(req.wValue, 0);
1419	USETW(req.wIndex, addr);
1420	USETW(req.wLength, len);
1421
1422	error = usbd_do_request(sc->sc_udev, &req, buf);
1423	if (error != 0) {
1424		printf("%s: could not read EEPROM: %s\n",
1425		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1426	}
1427}
1428
1429Static uint32_t
1430rum_read(struct rum_softc *sc, uint16_t reg)
1431{
1432	uint32_t val;
1433
1434	rum_read_multi(sc, reg, &val, sizeof val);
1435
1436	return le32toh(val);
1437}
1438
1439Static void
1440rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1441{
1442	usb_device_request_t req;
1443	usbd_status error;
1444
1445	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1446	req.bRequest = RT2573_READ_MULTI_MAC;
1447	USETW(req.wValue, 0);
1448	USETW(req.wIndex, reg);
1449	USETW(req.wLength, len);
1450
1451	error = usbd_do_request(sc->sc_udev, &req, buf);
1452	if (error != 0) {
1453		printf("%s: could not multi read MAC register: %s\n",
1454		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1455	}
1456}
1457
1458Static void
1459rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1460{
1461	uint32_t tmp = htole32(val);
1462
1463	rum_write_multi(sc, reg, &tmp, sizeof tmp);
1464}
1465
1466Static void
1467rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1468{
1469	usb_device_request_t req;
1470	usbd_status error;
1471
1472	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1473	req.bRequest = RT2573_WRITE_MULTI_MAC;
1474	USETW(req.wValue, 0);
1475	USETW(req.wIndex, reg);
1476	USETW(req.wLength, len);
1477
1478	error = usbd_do_request(sc->sc_udev, &req, buf);
1479	if (error != 0) {
1480		printf("%s: could not multi write MAC register: %s\n",
1481		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1482	}
1483}
1484
1485Static void
1486rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1487{
1488	uint32_t tmp;
1489	int ntries;
1490
1491	for (ntries = 0; ntries < 5; ntries++) {
1492		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1493			break;
1494	}
1495	if (ntries == 5) {
1496		printf("%s: could not write to BBP\n", USBDEVNAME(sc->sc_dev));
1497		return;
1498	}
1499
1500	tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1501	rum_write(sc, RT2573_PHY_CSR3, tmp);
1502}
1503
1504Static uint8_t
1505rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1506{
1507	uint32_t val;
1508	int ntries;
1509
1510	for (ntries = 0; ntries < 5; ntries++) {
1511		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1512			break;
1513	}
1514	if (ntries == 5) {
1515		printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1516		return 0;
1517	}
1518
1519	val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1520	rum_write(sc, RT2573_PHY_CSR3, val);
1521
1522	for (ntries = 0; ntries < 100; ntries++) {
1523		val = rum_read(sc, RT2573_PHY_CSR3);
1524		if (!(val & RT2573_BBP_BUSY))
1525			return val & 0xff;
1526		DELAY(1);
1527	}
1528
1529	printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1530	return 0;
1531}
1532
1533Static void
1534rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1535{
1536	uint32_t tmp;
1537	int ntries;
1538
1539	for (ntries = 0; ntries < 5; ntries++) {
1540		if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1541			break;
1542	}
1543	if (ntries == 5) {
1544		printf("%s: could not write to RF\n", USBDEVNAME(sc->sc_dev));
1545		return;
1546	}
1547
1548	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1549	    (reg & 3);
1550	rum_write(sc, RT2573_PHY_CSR4, tmp);
1551
1552	/* remember last written value in sc */
1553	sc->rf_regs[reg] = val;
1554
1555	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff));
1556}
1557
1558Static void
1559rum_select_antenna(struct rum_softc *sc)
1560{
1561	uint8_t bbp4, bbp77;
1562	uint32_t tmp;
1563
1564	bbp4  = rum_bbp_read(sc, 4);
1565	bbp77 = rum_bbp_read(sc, 77);
1566
1567	/* TBD */
1568
1569	/* make sure Rx is disabled before switching antenna */
1570	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1571	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1572
1573	rum_bbp_write(sc,  4, bbp4);
1574	rum_bbp_write(sc, 77, bbp77);
1575
1576	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1577}
1578
1579/*
1580 * Enable multi-rate retries for frames sent at OFDM rates.
1581 * In 802.11b/g mode, allow fallback to CCK rates.
1582 */
1583Static void
1584rum_enable_mrr(struct rum_softc *sc)
1585{
1586	struct ieee80211com *ic = &sc->sc_ic;
1587	uint32_t tmp;
1588
1589	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1590
1591	tmp &= ~RT2573_MRR_CCK_FALLBACK;
1592	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1593		tmp |= RT2573_MRR_CCK_FALLBACK;
1594	tmp |= RT2573_MRR_ENABLED;
1595
1596	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1597}
1598
1599Static void
1600rum_set_txpreamble(struct rum_softc *sc)
1601{
1602	uint32_t tmp;
1603
1604	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1605
1606	tmp &= ~RT2573_SHORT_PREAMBLE;
1607	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1608		tmp |= RT2573_SHORT_PREAMBLE;
1609
1610	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1611}
1612
1613Static void
1614rum_set_basicrates(struct rum_softc *sc)
1615{
1616	struct ieee80211com *ic = &sc->sc_ic;
1617
1618	/* update basic rate set */
1619	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1620		/* 11b basic rates: 1, 2Mbps */
1621		rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1622	} else if (ic->ic_curmode == IEEE80211_MODE_11A) {
1623		/* 11a basic rates: 6, 12, 24Mbps */
1624		rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1625	} else {
1626		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1627		rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1628	}
1629}
1630
1631/*
1632 * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1633 * driver.
1634 */
1635Static void
1636rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1637{
1638	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1639	uint32_t tmp;
1640
1641	/* update all BBP registers that depend on the band */
1642	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1643	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1644	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1645		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1646		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1647	}
1648	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1649	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1650		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1651	}
1652
1653	sc->bbp17 = bbp17;
1654	rum_bbp_write(sc,  17, bbp17);
1655	rum_bbp_write(sc,  96, bbp96);
1656	rum_bbp_write(sc, 104, bbp104);
1657
1658	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1659	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1660		rum_bbp_write(sc, 75, 0x80);
1661		rum_bbp_write(sc, 86, 0x80);
1662		rum_bbp_write(sc, 88, 0x80);
1663	}
1664
1665	rum_bbp_write(sc, 35, bbp35);
1666	rum_bbp_write(sc, 97, bbp97);
1667	rum_bbp_write(sc, 98, bbp98);
1668
1669	tmp = rum_read(sc, RT2573_PHY_CSR0);
1670	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1671	if (IEEE80211_IS_CHAN_2GHZ(c))
1672		tmp |= RT2573_PA_PE_2GHZ;
1673	else
1674		tmp |= RT2573_PA_PE_5GHZ;
1675	rum_write(sc, RT2573_PHY_CSR0, tmp);
1676
1677	/* 802.11a uses a 16 microseconds short interframe space */
1678	sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1679}
1680
1681Static void
1682rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1683{
1684	struct ieee80211com *ic = &sc->sc_ic;
1685	const struct rfprog *rfprog;
1686	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1687	int8_t power;
1688	u_int i, chan;
1689
1690	chan = ieee80211_chan2ieee(ic, c);
1691	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1692		return;
1693
1694	/* select the appropriate RF settings based on what EEPROM says */
1695	rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1696		  sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1697
1698	/* find the settings for this channel (we know it exists) */
1699	for (i = 0; rfprog[i].chan != chan; i++);
1700
1701	power = sc->txpow[i];
1702	if (power < 0) {
1703		bbp94 += power;
1704		power = 0;
1705	} else if (power > 31) {
1706		bbp94 += power - 31;
1707		power = 31;
1708	}
1709
1710	/*
1711	 * If we are switching from the 2GHz band to the 5GHz band or
1712	 * vice-versa, BBP registers need to be reprogrammed.
1713	 */
1714	if (c->ic_flags != ic->ic_curchan->ic_flags) {
1715		rum_select_band(sc, c);
1716		rum_select_antenna(sc);
1717	}
1718	ic->ic_curchan = c;
1719
1720	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1721	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1722	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1723	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1724
1725	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1726	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1727	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1728	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1729
1730	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1731	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1732	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1733	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1734
1735	DELAY(10);
1736
1737	/* enable smart mode for MIMO-capable RFs */
1738	bbp3 = rum_bbp_read(sc, 3);
1739
1740	bbp3 &= ~RT2573_SMART_MODE;
1741	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1742		bbp3 |= RT2573_SMART_MODE;
1743
1744	rum_bbp_write(sc, 3, bbp3);
1745
1746	if (bbp94 != RT2573_BBPR94_DEFAULT)
1747		rum_bbp_write(sc, 94, bbp94);
1748}
1749
1750/*
1751 * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1752 * and HostAP operating modes.
1753 */
1754Static void
1755rum_enable_tsf_sync(struct rum_softc *sc)
1756{
1757	struct ieee80211com *ic = &sc->sc_ic;
1758	uint32_t tmp;
1759
1760	if (ic->ic_opmode != IEEE80211_M_STA) {
1761		/*
1762		 * Change default 16ms TBTT adjustment to 8ms.
1763		 * Must be done before enabling beacon generation.
1764		 */
1765		rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1766	}
1767
1768	tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1769
1770	/* set beacon interval (in 1/16ms unit) */
1771	tmp |= ic->ic_bss->ni_intval * 16;
1772
1773	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1774	if (ic->ic_opmode == IEEE80211_M_STA)
1775		tmp |= RT2573_TSF_MODE(1);
1776	else
1777		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1778
1779	rum_write(sc, RT2573_TXRX_CSR9, tmp);
1780}
1781
1782Static void
1783rum_update_slot(struct rum_softc *sc)
1784{
1785	struct ieee80211com *ic = &sc->sc_ic;
1786	uint8_t slottime;
1787	uint32_t tmp;
1788
1789	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1790
1791	tmp = rum_read(sc, RT2573_MAC_CSR9);
1792	tmp = (tmp & ~0xff) | slottime;
1793	rum_write(sc, RT2573_MAC_CSR9, tmp);
1794
1795	DPRINTF(("setting slot time to %uus\n", slottime));
1796}
1797
1798Static void
1799rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1800{
1801	uint32_t tmp;
1802
1803	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1804	rum_write(sc, RT2573_MAC_CSR4, tmp);
1805
1806	tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1807	rum_write(sc, RT2573_MAC_CSR5, tmp);
1808}
1809
1810Static void
1811rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1812{
1813	uint32_t tmp;
1814
1815	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1816	rum_write(sc, RT2573_MAC_CSR2, tmp);
1817
1818	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1819	rum_write(sc, RT2573_MAC_CSR3, tmp);
1820}
1821
1822Static void
1823rum_update_promisc(struct rum_softc *sc)
1824{
1825	struct ifnet *ifp = sc->sc_ic.ic_ifp;
1826	uint32_t tmp;
1827
1828	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1829
1830	tmp &= ~RT2573_DROP_NOT_TO_ME;
1831	if (!(ifp->if_flags & IFF_PROMISC))
1832		tmp |= RT2573_DROP_NOT_TO_ME;
1833
1834	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1835
1836	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1837	    "entering" : "leaving"));
1838}
1839
1840Static const char *
1841rum_get_rf(int rev)
1842{
1843	switch (rev) {
1844	case RT2573_RF_2527:	return "RT2527 (MIMO XR)";
1845	case RT2573_RF_2528:	return "RT2528";
1846	case RT2573_RF_5225:	return "RT5225 (MIMO XR)";
1847	case RT2573_RF_5226:	return "RT5226";
1848	default:		return "unknown";
1849	}
1850}
1851
1852Static void
1853rum_read_eeprom(struct rum_softc *sc)
1854{
1855	struct ieee80211com *ic = &sc->sc_ic;
1856	uint16_t val;
1857#ifdef RUM_DEBUG
1858	int i;
1859#endif
1860
1861	/* read MAC/BBP type */
1862	rum_eeprom_read(sc, RT2573_EEPROM_MACBBP, &val, 2);
1863	sc->macbbp_rev = le16toh(val);
1864
1865	/* read MAC address */
1866	rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1867
1868	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1869	val = le16toh(val);
1870	sc->rf_rev =   (val >> 11) & 0x1f;
1871	sc->hw_radio = (val >> 10) & 0x1;
1872	sc->rx_ant =   (val >> 4)  & 0x3;
1873	sc->tx_ant =   (val >> 2)  & 0x3;
1874	sc->nb_ant =   val & 0x3;
1875
1876	DPRINTF(("RF revision=%d\n", sc->rf_rev));
1877
1878	rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1879	val = le16toh(val);
1880	sc->ext_5ghz_lna = (val >> 6) & 0x1;
1881	sc->ext_2ghz_lna = (val >> 4) & 0x1;
1882
1883	DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1884	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
1885
1886	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1887	val = le16toh(val);
1888	if ((val & 0xff) != 0xff)
1889		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
1890
1891	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1892	val = le16toh(val);
1893	if ((val & 0xff) != 0xff)
1894		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
1895
1896	DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1897	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
1898
1899	rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1900	val = le16toh(val);
1901	if ((val & 0xff) != 0xff)
1902		sc->rffreq = val & 0xff;
1903
1904	DPRINTF(("RF freq=%d\n", sc->rffreq));
1905
1906	/* read Tx power for all a/b/g channels */
1907	rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1908	/* XXX default Tx power for 802.11a channels */
1909	memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1910#ifdef RUM_DEBUG
1911	for (i = 0; i < 14; i++)
1912		DPRINTF(("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]));
1913#endif
1914
1915	/* read default values for BBP registers */
1916	rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1917#ifdef RUM_DEBUG
1918	for (i = 0; i < 14; i++) {
1919		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1920			continue;
1921		DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1922		    sc->bbp_prom[i].val));
1923	}
1924#endif
1925}
1926
1927Static int
1928rum_bbp_init(struct rum_softc *sc)
1929{
1930#define N(a)	(sizeof (a) / sizeof ((a)[0]))
1931	int i, ntries;
1932	uint8_t val;
1933
1934	/* wait for BBP to be ready */
1935	for (ntries = 0; ntries < 100; ntries++) {
1936		val = rum_bbp_read(sc, 0);
1937		if (val != 0 && val != 0xff)
1938			break;
1939		DELAY(1000);
1940	}
1941	if (ntries == 100) {
1942		printf("%s: timeout waiting for BBP\n",
1943		    USBDEVNAME(sc->sc_dev));
1944		return EIO;
1945	}
1946
1947	/* initialize BBP registers to default values */
1948	for (i = 0; i < N(rum_def_bbp); i++)
1949		rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1950
1951	/* write vendor-specific BBP values (from EEPROM) */
1952	for (i = 0; i < 16; i++) {
1953		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1954			continue;
1955		rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1956	}
1957
1958	return 0;
1959#undef N
1960}
1961
1962Static int
1963rum_init(struct ifnet *ifp)
1964{
1965#define N(a)	(sizeof (a) / sizeof ((a)[0]))
1966	struct rum_softc *sc = ifp->if_softc;
1967	struct ieee80211com *ic = &sc->sc_ic;
1968	struct rum_rx_data *data;
1969	uint32_t tmp;
1970	usbd_status error = 0;
1971	int i, ntries;
1972
1973	if ((sc->sc_flags & RT2573_FWLOADED) == 0) {
1974		if (rum_attachhook(sc))
1975			goto fail;
1976	}
1977
1978	rum_stop(ifp, 0);
1979
1980	/* initialize MAC registers to default values */
1981	for (i = 0; i < N(rum_def_mac); i++)
1982		rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1983
1984	/* set host ready */
1985	rum_write(sc, RT2573_MAC_CSR1, 3);
1986	rum_write(sc, RT2573_MAC_CSR1, 0);
1987
1988	/* wait for BBP/RF to wakeup */
1989	for (ntries = 0; ntries < 1000; ntries++) {
1990		if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1991			break;
1992		rum_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
1993		DELAY(1000);
1994	}
1995	if (ntries == 1000) {
1996		printf("%s: timeout waiting for BBP/RF to wakeup\n",
1997		    USBDEVNAME(sc->sc_dev));
1998		goto fail;
1999	}
2000
2001	if ((error = rum_bbp_init(sc)) != 0)
2002		goto fail;
2003
2004	/* select default channel */
2005	rum_select_band(sc, ic->ic_curchan);
2006	rum_select_antenna(sc);
2007	rum_set_chan(sc, ic->ic_curchan);
2008
2009	/* clear STA registers */
2010	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2011
2012	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2013	rum_set_macaddr(sc, ic->ic_myaddr);
2014
2015	/* initialize ASIC */
2016	rum_write(sc, RT2573_MAC_CSR1, 4);
2017
2018	/*
2019	 * Allocate xfer for AMRR statistics requests.
2020	 */
2021	sc->amrr_xfer = usbd_alloc_xfer(sc->sc_udev);
2022	if (sc->amrr_xfer == NULL) {
2023		printf("%s: could not allocate AMRR xfer\n",
2024		    USBDEVNAME(sc->sc_dev));
2025		goto fail;
2026	}
2027
2028	/*
2029	 * Open Tx and Rx USB bulk pipes.
2030	 */
2031	error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
2032	    &sc->sc_tx_pipeh);
2033	if (error != 0) {
2034		printf("%s: could not open Tx pipe: %s\n",
2035		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2036		goto fail;
2037	}
2038
2039	error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
2040	    &sc->sc_rx_pipeh);
2041	if (error != 0) {
2042		printf("%s: could not open Rx pipe: %s\n",
2043		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2044		goto fail;
2045	}
2046
2047	/*
2048	 * Allocate Tx and Rx xfer queues.
2049	 */
2050	error = rum_alloc_tx_list(sc);
2051	if (error != 0) {
2052		printf("%s: could not allocate Tx list\n",
2053		    USBDEVNAME(sc->sc_dev));
2054		goto fail;
2055	}
2056
2057	error = rum_alloc_rx_list(sc);
2058	if (error != 0) {
2059		printf("%s: could not allocate Rx list\n",
2060		    USBDEVNAME(sc->sc_dev));
2061		goto fail;
2062	}
2063
2064	/*
2065	 * Start up the receive pipe.
2066	 */
2067	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
2068		data = &sc->rx_data[i];
2069
2070		usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf,
2071		    MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
2072		error = usbd_transfer(data->xfer);
2073		if (error != USBD_NORMAL_COMPLETION &&
2074		    error != USBD_IN_PROGRESS) {
2075			printf("%s: could not queue Rx transfer\n",
2076			    USBDEVNAME(sc->sc_dev));
2077			goto fail;
2078		}
2079	}
2080
2081	/* update Rx filter */
2082	tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2083
2084	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2085	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2086		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2087		       RT2573_DROP_ACKCTS;
2088		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2089			tmp |= RT2573_DROP_TODS;
2090		if (!(ifp->if_flags & IFF_PROMISC))
2091			tmp |= RT2573_DROP_NOT_TO_ME;
2092	}
2093	rum_write(sc, RT2573_TXRX_CSR0, tmp);
2094
2095	ifp->if_flags &= ~IFF_OACTIVE;
2096	ifp->if_flags |= IFF_RUNNING;
2097
2098	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2099		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2100	else
2101		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2102
2103	return 0;
2104
2105fail:	rum_stop(ifp, 1);
2106	return error;
2107#undef N
2108}
2109
2110Static void
2111rum_stop(struct ifnet *ifp, int disable)
2112{
2113	struct rum_softc *sc = ifp->if_softc;
2114	struct ieee80211com *ic = &sc->sc_ic;
2115	uint32_t tmp;
2116
2117	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2118
2119	sc->sc_tx_timer = 0;
2120	ifp->if_timer = 0;
2121	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2122
2123	/* disable Rx */
2124	tmp = rum_read(sc, RT2573_TXRX_CSR0);
2125	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2126
2127	/* reset ASIC */
2128	rum_write(sc, RT2573_MAC_CSR1, 3);
2129	rum_write(sc, RT2573_MAC_CSR1, 0);
2130
2131	if (sc->sc_rx_pipeh != NULL) {
2132		usbd_abort_pipe(sc->sc_rx_pipeh);
2133		usbd_close_pipe(sc->sc_rx_pipeh);
2134		sc->sc_rx_pipeh = NULL;
2135	}
2136
2137	if (sc->sc_tx_pipeh != NULL) {
2138		usbd_abort_pipe(sc->sc_tx_pipeh);
2139		usbd_close_pipe(sc->sc_tx_pipeh);
2140		sc->sc_tx_pipeh = NULL;
2141	}
2142
2143	rum_free_rx_list(sc);
2144	rum_free_tx_list(sc);
2145}
2146
2147Static int
2148rum_load_microcode(struct rum_softc *sc, const u_char *ucode, size_t size)
2149{
2150	usb_device_request_t req;
2151	uint16_t reg = RT2573_MCU_CODE_BASE;
2152	usbd_status error;
2153
2154	/* copy firmware image into NIC */
2155	for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2156		rum_write(sc, reg, UGETDW(ucode));
2157
2158	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2159	req.bRequest = RT2573_MCU_CNTL;
2160	USETW(req.wValue, RT2573_MCU_RUN);
2161	USETW(req.wIndex, 0);
2162	USETW(req.wLength, 0);
2163
2164	error = usbd_do_request(sc->sc_udev, &req, NULL);
2165	if (error != 0) {
2166		printf("%s: could not run firmware: %s\n",
2167		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2168	}
2169	return error;
2170}
2171
2172Static int
2173rum_prepare_beacon(struct rum_softc *sc)
2174{
2175	struct ieee80211com *ic = &sc->sc_ic;
2176	struct rum_tx_desc desc;
2177	struct mbuf *m0;
2178	int rate;
2179
2180	m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo);
2181	if (m0 == NULL) {
2182		aprint_error_dev(sc->sc_dev,
2183		    "could not allocate beacon frame\n");
2184		return ENOBUFS;
2185	}
2186
2187	/* send beacons at the lowest available rate */
2188	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
2189
2190	rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2191	    m0->m_pkthdr.len, rate);
2192
2193	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2194	rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2195
2196	/* copy beacon header and payload into NIC memory */
2197	rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2198	    m0->m_pkthdr.len);
2199
2200	m_freem(m0);
2201
2202	return 0;
2203}
2204
2205Static void
2206rum_newassoc(struct ieee80211_node *ni, int isnew)
2207{
2208	/* start with lowest Tx rate */
2209	ni->ni_txrate = 0;
2210}
2211
2212Static void
2213rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
2214{
2215	int i;
2216
2217	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2218	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2219
2220	ieee80211_amrr_node_init(&sc->amrr, &sc->amn);
2221
2222	/* set rate to some reasonable initial value */
2223	for (i = ni->ni_rates.rs_nrates - 1;
2224	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
2225	     i--);
2226	ni->ni_txrate = i;
2227
2228	usb_callout(sc->sc_amrr_ch, hz, rum_amrr_timeout, sc);
2229}
2230
2231Static void
2232rum_amrr_timeout(void *arg)
2233{
2234	struct rum_softc *sc = arg;
2235	usb_device_request_t req;
2236
2237	/*
2238	 * Asynchronously read statistic registers (cleared by read).
2239	 */
2240	req.bmRequestType = UT_READ_VENDOR_DEVICE;
2241	req.bRequest = RT2573_READ_MULTI_MAC;
2242	USETW(req.wValue, 0);
2243	USETW(req.wIndex, RT2573_STA_CSR0);
2244	USETW(req.wLength, sizeof sc->sta);
2245
2246	usbd_setup_default_xfer(sc->amrr_xfer, sc->sc_udev, sc,
2247	    USBD_DEFAULT_TIMEOUT, &req, sc->sta, sizeof sc->sta, 0,
2248	    rum_amrr_update);
2249	(void)usbd_transfer(sc->amrr_xfer);
2250}
2251
2252Static void
2253rum_amrr_update(usbd_xfer_handle xfer, usbd_private_handle priv,
2254    usbd_status status)
2255{
2256	struct rum_softc *sc = (struct rum_softc *)priv;
2257	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2258
2259	if (status != USBD_NORMAL_COMPLETION) {
2260		printf("%s: could not retrieve Tx statistics - cancelling "
2261		    "automatic rate control\n", USBDEVNAME(sc->sc_dev));
2262		return;
2263	}
2264
2265	/* count TX retry-fail as Tx errors */
2266	ifp->if_oerrors += le32toh(sc->sta[5]) >> 16;
2267
2268	sc->amn.amn_retrycnt =
2269	    (le32toh(sc->sta[4]) >> 16) +	/* TX one-retry ok count */
2270	    (le32toh(sc->sta[5]) & 0xffff) +	/* TX more-retry ok count */
2271	    (le32toh(sc->sta[5]) >> 16);	/* TX retry-fail count */
2272
2273	sc->amn.amn_txcnt =
2274	    sc->amn.amn_retrycnt +
2275	    (le32toh(sc->sta[4]) & 0xffff);	/* TX no-retry ok count */
2276
2277	ieee80211_amrr_choose(&sc->amrr, sc->sc_ic.ic_bss, &sc->amn);
2278
2279	usb_callout(sc->sc_amrr_ch, hz, rum_amrr_timeout, sc);
2280}
2281
2282int
2283rum_activate(device_ptr_t self, enum devact act)
2284{
2285	switch (act) {
2286	case DVACT_ACTIVATE:
2287		return EOPNOTSUPP;
2288
2289	case DVACT_DEACTIVATE:
2290		/*if_deactivate(&sc->sc_ic.ic_if);*/
2291		break;
2292	}
2293
2294	return 0;
2295}
2296