sys/dev/netif/rum/if_rum.c

   1 /*      $OpenBSD: if_rum.c,v 1.40 2006/09/18 16:20:20 damien Exp $      */
   2 /*      $DragonFly: src/sys/dev/netif/rum/if_rum.c,v 1.1 2006/12/10 03:24:25 sephe Exp $        */
   3
   4 /*-
   5  * Copyright (c) 2005, 2006 Damien Bergamini <damien.bergamini@free.fr>
   6  * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
   7  *
   8  * Permission to use, copy, modify, and distribute this software for any
   9  * purpose with or without fee is hereby granted, provided that the above
  10  * copyright notice and this permission notice appear in all copies.
  11  *
  12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19  */
  20
  21 /*-
  22  * Ralink Technology RT2501USB/RT2601USB chipset driver
  23  * http://www.ralinktech.com/
  24  */
  25
  26 #include <sys/param.h>
  27 #include <sys/bus.h>
  28 #include <sys/endian.h>
  29 #include <sys/kernel.h>
  30 #include <sys/malloc.h>
  31 #include <sys/mbuf.h>
  32 #include <sys/rman.h>
  33 #include <sys/serialize.h>
  34 #include <sys/socket.h>
  35 #include <sys/sockio.h>
  36
  37 #include <net/bpf.h>
  38 #include <net/ethernet.h>
  39 #include <net/if.h>
  40 #include <net/if_arp.h>
  41 #include <net/if_dl.h>
  42 #include <net/if_media.h>
  43 #include <net/ifq_var.h>
  44
  45 #include <netproto/802_11/ieee80211_var.h>
  46 #include <netproto/802_11/ieee80211_radiotap.h>
  47 #include <netproto/802_11/wlan_ratectl/onoe/ieee80211_onoe_param.h>
  48
  49 #include <bus/usb/usb.h>
  50 #include <bus/usb/usbdi.h>
  51 #include <bus/usb/usbdi_util.h>
  52 #include <bus/usb/usbdevs.h>
  53
  54 #include "if_rumreg.h"
  55 #include "if_rumvar.h"
  56 #include "rum_ucode.h"
  57
  58 #ifdef USB_DEBUG
  59 #define RUM_DEBUG
  60 #endif
  61
  62 #ifdef RUM_DEBUG
  63 #define DPRINTF(x)      do { if (rum_debug) logprintf x; } while (0)
  64 #define DPRINTFN(n, x)  do { if (rum_debug >= (n)) logprintf x; } while (0)
  65 int rum_debug = 0;
  66 #else
  67 #define DPRINTF(x)
  68 #define DPRINTFN(n, x)
  69 #endif
  70
  71 /* various supported device vendors/products */
  72 static const struct usb_devno rum_devs[] = {
  73         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573 },
  74         { USB_VENDOR_ASUS,              USB_PRODUCT_ASUS_WL167G_2 },
  75         { USB_VENDOR_BELKIN,            USB_PRODUCT_BELKIN_F5D7050A },
  76         { USB_VENDOR_BELKIN,            USB_PRODUCT_BELKIN_F5D9050V3 },
  77         { USB_VENDOR_LINKSYS4,          USB_PRODUCT_LINKSYS4_WUSB54GC },
  78         { USB_VENDOR_CONCEPTRONIC,      USB_PRODUCT_CONCEPTRONIC_C54RU2 },
  79         { USB_VENDOR_DICKSMITH,         USB_PRODUCT_DICKSMITH_CWD854F },
  80         { USB_VENDOR_DICKSMITH,         USB_PRODUCT_DICKSMITH_RT2573 },
  81         { USB_VENDOR_DLINK2,            USB_PRODUCT_DLINK2_DWLG122C1 },
  82         { USB_VENDOR_DLINK2,            USB_PRODUCT_DLINK2_WUA1340 },
  83         { USB_VENDOR_GIGABYTE,          USB_PRODUCT_GIGABYTE_GNWB01GS },
  84         { USB_VENDOR_GIGASET,           USB_PRODUCT_GIGASET_RT2573 },
  85         { USB_VENDOR_GOODWAY,           USB_PRODUCT_GOODWAY_RT2573 },
  86         { USB_VENDOR_HUAWEI3COM,        USB_PRODUCT_HUAWEI3COM_RT2573 },
  87         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573 },
  88         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_2 },
  89         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_3 },
  90         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUSMM },
  91         { USB_VENDOR_QCOM,              USB_PRODUCT_QCOM_RT2573 },
  92         { USB_VENDOR_QCOM,              USB_PRODUCT_QCOM_RT2573_2 },
  93         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2573 },
  94         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2671 },
  95         { USB_VENDOR_SITECOMEU,         USB_PRODUCT_SITECOMEU_WL113R2 },
  96         { USB_VENDOR_SITECOMEU,         USB_PRODUCT_SITECOMEU_WL172 },
  97         { USB_VENDOR_SURECOM,           USB_PRODUCT_SURECOM_RT2573 }
  98 };
  99
 100 #ifdef notyet
 101 Static void             rum_attachhook(void *);
 102 #endif
 103 Static int              rum_alloc_tx_list(struct rum_softc *);
 104 Static void             rum_free_tx_list(struct rum_softc *);
 105 Static int              rum_alloc_rx_list(struct rum_softc *);
 106 Static void             rum_free_rx_list(struct rum_softc *);
 107 Static int              rum_media_change(struct ifnet *);
 108 Static void             rum_next_scan(void *);
 109 Static void             rum_task(void *);
 110 Static int              rum_newstate(struct ieee80211com *,
 111                             enum ieee80211_state, int);
 112 Static void             rum_txeof(usbd_xfer_handle, usbd_private_handle,
 113                             usbd_status);
 114 Static void             rum_rxeof(usbd_xfer_handle, usbd_private_handle,
 115                             usbd_status);
 116 Static uint8_t          rum_rxrate(struct rum_rx_desc *);
 117 Static int              rum_ack_rate(struct ieee80211com *, int);
 118 Static uint16_t         rum_txtime(int, int, uint32_t);
 119 Static uint8_t          rum_plcp_signal(int);
 120 Static void             rum_setup_tx_desc(struct rum_softc *,
 121                             struct rum_tx_desc *, uint32_t, uint16_t, int,
 122                             int);
 123 Static int              rum_tx_data(struct rum_softc *, struct mbuf *,
 124                             struct ieee80211_node *);
 125 Static void             rum_start(struct ifnet *);
 126 Static void             rum_watchdog(struct ifnet *);
 127 Static int              rum_ioctl(struct ifnet *, u_long, caddr_t,
 128                                   struct ucred *);
 129 Static void             rum_eeprom_read(struct rum_softc *, uint16_t, void *,
 130                             int);
 131 Static uint32_t         rum_read(struct rum_softc *, uint16_t);
 132 Static void             rum_read_multi(struct rum_softc *, uint16_t, void *,
 133                             int);
 134 Static void             rum_write(struct rum_softc *, uint16_t, uint32_t);
 135 Static void             rum_write_multi(struct rum_softc *, uint16_t, void *,
 136                             size_t);
 137 Static void             rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
 138 Static uint8_t          rum_bbp_read(struct rum_softc *, uint8_t);
 139 Static void             rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
 140 Static void             rum_select_antenna(struct rum_softc *);
 141 Static void             rum_enable_mrr(struct rum_softc *);
 142 Static void             rum_set_txpreamble(struct rum_softc *);
 143 Static void             rum_set_basicrates(struct rum_softc *);
 144 Static void             rum_select_band(struct rum_softc *,
 145                             struct ieee80211_channel *);
 146 Static void             rum_set_chan(struct rum_softc *,
 147                             struct ieee80211_channel *);
 148 Static void             rum_enable_tsf_sync(struct rum_softc *);
 149 Static void             rum_update_slot(struct rum_softc *);
 150 Static void             rum_set_bssid(struct rum_softc *, const uint8_t *);
 151 Static void             rum_set_macaddr(struct rum_softc *, const uint8_t *);
 152 Static void             rum_update_promisc(struct rum_softc *);
 153 Static const char       *rum_get_rf(int);
 154 Static void             rum_read_eeprom(struct rum_softc *);
 155 Static int              rum_bbp_init(struct rum_softc *);
 156 Static void             rum_init(void *);
 157 Static void             rum_stop(struct rum_softc *);
 158 Static int              rum_load_microcode(struct rum_softc *, const uint8_t *,
 159                             size_t);
 160 Static int              rum_prepare_beacon(struct rum_softc *);
 161
 162 Static void             rum_stats_timeout(void *);
 163 Static void             rum_stats_update(usbd_xfer_handle, usbd_private_handle,
 164                                          usbd_status);
 165 Static void             rum_stats(struct ieee80211com *,
 166                                   struct ieee80211_node *,
 167                                   struct ieee80211_ratectl_stats *);
 168 Static void             rum_ratectl_change(struct ieee80211com *ic, u_int,
 169                                            u_int);
 170
 171 /*
 172  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
 173  */
 174 static const struct ieee80211_rateset rum_rateset_11a =
 175         { 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
 176
 177 static const struct ieee80211_rateset rum_rateset_11b =
 178         { 4, { 2, 4, 11, 22 } };
 179
 180 static const struct ieee80211_rateset rum_rateset_11g =
 181         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 182
 183 static const struct {
 184         uint32_t        reg;
 185         uint32_t        val;
 186 } rum_def_mac[] = {
 187         RT2573_DEF_MAC
 188 };
 189
 190 static const struct {
 191         uint8_t reg;
 192         uint8_t val;
 193 } rum_def_bbp[] = {
 194         RT2573_DEF_BBP
 195 };
 196
 197 static const struct rfprog {
 198         uint8_t         chan;
 199         uint32_t        r1, r2, r3, r4;
 200 }  rum_rf5226[] = {
 201         RT2573_RF5226
 202 }, rum_rf5225[] = {
 203         RT2573_RF5225
 204 };
 205
 206 USB_DECLARE_DRIVER(rum);
 207 DRIVER_MODULE(rum, uhub, rum_driver, rum_devclass, usbd_driver_load, 0);
 208
 209 USB_MATCH(rum)
 210 {
 211         USB_MATCH_START(rum, uaa);
 212
 213         if (uaa->iface != NULL)
 214                 return UMATCH_NONE;
 215
 216         return (usb_lookup(rum_devs, uaa->vendor, uaa->product) != NULL) ?
 217             UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
 218 }
 219
 220 USB_ATTACH(rum)
 221 {
 222         USB_ATTACH_START(rum, sc, uaa);
 223         struct ieee80211com *ic = &sc->sc_ic;
 224         struct ifnet *ifp = &ic->ic_if;
 225         usb_interface_descriptor_t *id;
 226         usb_endpoint_descriptor_t *ed;
 227         usbd_status error;
 228         char devinfo[1024];
 229         int i, ntries;
 230         uint32_t tmp;
 231
 232         sc->sc_udev = uaa->device;
 233
 234         usbd_devinfo(uaa->device, 0, devinfo);
 235         USB_ATTACH_SETUP;
 236
 237         if (usbd_set_config_no(sc->sc_udev, RT2573_CONFIG_NO, 0) != 0) {
 238                 printf("%s: could not set configuration no\n",
 239                     USBDEVNAME(sc->sc_dev));
 240                 USB_ATTACH_ERROR_RETURN;
 241         }
 242
 243         /* get the first interface handle */
 244         error = usbd_device2interface_handle(sc->sc_udev, RT2573_IFACE_INDEX,
 245             &sc->sc_iface);
 246         if (error != 0) {
 247                 printf("%s: could not get interface handle\n",
 248                     USBDEVNAME(sc->sc_dev));
 249                 USB_ATTACH_ERROR_RETURN;
 250         }
 251
 252         /*
 253          * Find endpoints.
 254          */
 255         id = usbd_get_interface_descriptor(sc->sc_iface);
 256
 257         sc->sc_rx_no = sc->sc_tx_no = -1;
 258         for (i = 0; i < id->bNumEndpoints; i++) {
 259                 ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
 260                 if (ed == NULL) {
 261                         printf("%s: no endpoint descriptor for iface %d\n",
 262                             USBDEVNAME(sc->sc_dev), i);
 263                         USB_ATTACH_ERROR_RETURN;
 264                 }
 265
 266                 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
 267                     UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
 268                         sc->sc_rx_no = ed->bEndpointAddress;
 269                 else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
 270                     UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
 271                         sc->sc_tx_no = ed->bEndpointAddress;
 272         }
 273         if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
 274                 printf("%s: missing endpoint\n", USBDEVNAME(sc->sc_dev));
 275                 USB_ATTACH_ERROR_RETURN;
 276         }
 277
 278         usb_init_task(&sc->sc_task, rum_task, sc);
 279
 280         callout_init(&sc->scan_ch);
 281         callout_init(&sc->stats_ch);
 282
 283         /* retrieve RT2573 rev. no */
 284         for (ntries = 0; ntries < 1000; ntries++) {
 285                 if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
 286                         break;
 287                 DELAY(1000);
 288         }
 289         if (ntries == 1000) {
 290                 printf("%s: timeout waiting for chip to settle\n",
 291                     USBDEVNAME(sc->sc_dev));
 292                 USB_ATTACH_ERROR_RETURN;
 293         }
 294
 295         /* retrieve MAC address and various other things from EEPROM */
 296         rum_read_eeprom(sc);
 297
 298         printf("%s: MAC/BBP RT%04x (rev 0x%05x), RF %s, address %6D\n",
 299             USBDEVNAME(sc->sc_dev), sc->macbbp_rev, tmp,
 300             rum_get_rf(sc->rf_rev), ic->ic_myaddr, ":");
 301
 302         error = rum_load_microcode(sc, rt2573, sizeof(rt2573));
 303         if (error != 0) {
 304                 device_printf(self, "can't load microcode\n");
 305                 USB_ATTACH_ERROR_RETURN;
 306         }
 307
 308         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 309         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 310         ic->ic_state = IEEE80211_S_INIT;
 311
 312         /* set device capabilities */
 313         ic->ic_caps =
 314             IEEE80211_C_IBSS |          /* IBSS mode supported */
 315             IEEE80211_C_MONITOR |       /* monitor mode supported */
 316             IEEE80211_C_HOSTAP |        /* HostAp mode supported */
 317             IEEE80211_C_TXPMGT |        /* tx power management */
 318             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 319             IEEE80211_C_SHSLOT |        /* short slot time supported */
 320             IEEE80211_C_WPA;            /* WPA 1+2 */
 321
 322         if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
 323                 /* set supported .11a rates */
 324                 ic->ic_sup_rates[IEEE80211_MODE_11A] = rum_rateset_11a;
 325
 326                 /* set supported .11a channels */
 327                 for (i = 34; i <= 46; i += 4) {
 328                         ic->ic_channels[i].ic_freq =
 329                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 330                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 331                 }
 332                 for (i = 36; i <= 64; i += 4) {
 333                         ic->ic_channels[i].ic_freq =
 334                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 335                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 336                 }
 337                 for (i = 100; i <= 140; i += 4) {
 338                         ic->ic_channels[i].ic_freq =
 339                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 340                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 341                 }
 342                 for (i = 149; i <= 165; i += 4) {
 343                         ic->ic_channels[i].ic_freq =
 344                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 345                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 346                 }
 347         }
 348
 349         /* set supported .11b and .11g rates */
 350         ic->ic_sup_rates[IEEE80211_MODE_11B] = rum_rateset_11b;
 351         ic->ic_sup_rates[IEEE80211_MODE_11G] = rum_rateset_11g;
 352
 353         /* set supported .11b and .11g channels (1 through 14) */
 354         for (i = 1; i <= 14; i++) {
 355                 ic->ic_channels[i].ic_freq =
 356                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 357                 ic->ic_channels[i].ic_flags =
 358                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
 359                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
 360         }
 361
 362         if_initname(ifp, device_get_name(self), device_get_unit(self));
 363         ifp->if_softc = sc;
 364         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 365         ifp->if_init = rum_init;
 366         ifp->if_ioctl = rum_ioctl;
 367         ifp->if_start = rum_start;
 368         ifp->if_watchdog = rum_watchdog;
 369         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 370         ifq_set_ready(&ifp->if_snd);
 371
 372         ic->ic_ratectl.rc_st_ratectl_cap = IEEE80211_RATECTL_CAP_ONOE;
 373         ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_ONOE;
 374         ic->ic_ratectl.rc_st_valid_stats =
 375                 IEEE80211_RATECTL_STATS_PKT_NORETRY |
 376                 IEEE80211_RATECTL_STATS_PKT_OK |
 377                 IEEE80211_RATECTL_STATS_PKT_ERR |
 378                 IEEE80211_RATECTL_STATS_RETRIES;
 379         ic->ic_ratectl.rc_st_stats = rum_stats;
 380         ic->ic_ratectl.rc_st_change = rum_ratectl_change;
 381
 382         ieee80211_ifattach(ic);
 383
 384         /* override state transition machine */
 385         sc->sc_newstate = ic->ic_newstate;
 386         ic->ic_newstate = rum_newstate;
 387         ieee80211_media_init(ic, rum_media_change, ieee80211_media_status);
 388
 389         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 390             sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
 391             &sc->sc_drvbpf);
 392
 393         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 394         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 395         sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
 396
 397         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 398         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 399         sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
 400
 401         if (bootverbose)
 402                 ieee80211_announce(ic);
 403
 404         USB_ATTACH_SUCCESS_RETURN;
 405 }
 406
 407 USB_DETACH(rum)
 408 {
 409         USB_DETACH_START(rum, sc);
 410         struct ifnet *ifp = &sc->sc_ic.ic_if;
 411
 412 #ifdef spl
 413         s = splusb();
 414 #endif
 415
 416         lwkt_serialize_enter(ifp->if_serializer);
 417
 418         callout_stop(&sc->scan_ch);
 419         callout_stop(&sc->stats_ch);
 420
 421         sc->sc_flags |= RUM_FLAG_SYNCTASK;
 422         rum_stop(sc);
 423
 424         lwkt_serialize_exit(ifp->if_serializer);
 425
 426         usb_rem_task(sc->sc_udev, &sc->sc_task);
 427
 428         bpfdetach(ifp);
 429         ieee80211_ifdetach(&sc->sc_ic); /* free all nodes */
 430
 431         if (sc->stats_xfer != NULL) {
 432                 usbd_free_xfer(sc->stats_xfer);
 433                 sc->stats_xfer = NULL;
 434         }
 435
 436         if (sc->sc_rx_pipeh != NULL) {
 437                 usbd_abort_pipe(sc->sc_rx_pipeh);
 438                 usbd_close_pipe(sc->sc_rx_pipeh);
 439         }
 440
 441         if (sc->sc_tx_pipeh != NULL) {
 442                 usbd_abort_pipe(sc->sc_tx_pipeh);
 443                 usbd_close_pipe(sc->sc_tx_pipeh);
 444         }
 445
 446         rum_free_rx_list(sc);
 447         rum_free_tx_list(sc);
 448
 449 #ifdef spl
 450         splx(s);
 451 #endif
 452         return 0;
 453 }
 454
 455 Static int
 456 rum_alloc_tx_list(struct rum_softc *sc)
 457 {
 458         struct rum_tx_data *data;
 459         int i, error;
 460
 461         sc->tx_queued = 0;
 462
 463         for (i = 0; i < RT2573_TX_LIST_COUNT; i++) {
 464                 data = &sc->tx_data[i];
 465
 466                 data->sc = sc;
 467
 468                 data->xfer = usbd_alloc_xfer(sc->sc_udev);
 469                 if (data->xfer == NULL) {
 470                         printf("%s: could not allocate tx xfer\n",
 471                             USBDEVNAME(sc->sc_dev));
 472                         error = ENOMEM;
 473                         goto fail;
 474                 }
 475
 476                 data->buf = usbd_alloc_buffer(data->xfer,
 477                     RT2573_TX_DESC_SIZE + IEEE80211_MAX_LEN);
 478                 if (data->buf == NULL) {
 479                         printf("%s: could not allocate tx buffer\n",
 480                             USBDEVNAME(sc->sc_dev));
 481                         error = ENOMEM;
 482                         goto fail;
 483                 }
 484
 485                 /* clean Tx descriptor */
 486                 bzero(data->buf, RT2573_TX_DESC_SIZE);
 487         }
 488
 489         return 0;
 490
 491 fail:   rum_free_tx_list(sc);
 492         return error;
 493 }
 494
 495 Static void
 496 rum_free_tx_list(struct rum_softc *sc)
 497 {
 498         struct rum_tx_data *data;
 499         int i;
 500
 501         for (i = 0; i < RT2573_TX_LIST_COUNT; i++) {
 502                 data = &sc->tx_data[i];
 503
 504                 if (data->xfer != NULL) {
 505                         usbd_free_xfer(data->xfer);
 506                         data->xfer = NULL;
 507                 }
 508
 509                 /*
 510                  * The node has already been freed at that point so don't call
 511                  * ieee80211_free_node() here.
 512                  */
 513                 data->ni = NULL;
 514         }
 515 }
 516
 517 Static int
 518 rum_alloc_rx_list(struct rum_softc *sc)
 519 {
 520         struct rum_rx_data *data;
 521         int i, error;
 522
 523         for (i = 0; i < RT2573_RX_LIST_COUNT; i++) {
 524                 data = &sc->rx_data[i];
 525
 526                 data->sc = sc;
 527
 528                 data->xfer = usbd_alloc_xfer(sc->sc_udev);
 529                 if (data->xfer == NULL) {
 530                         printf("%s: could not allocate rx xfer\n",
 531                             USBDEVNAME(sc->sc_dev));
 532                         error = ENOMEM;
 533                         goto fail;
 534                 }
 535
 536                 if (usbd_alloc_buffer(data->xfer, MCLBYTES) == NULL) {
 537                         printf("%s: could not allocate rx buffer\n",
 538                             USBDEVNAME(sc->sc_dev));
 539                         error = ENOMEM;
 540                         goto fail;
 541                 }
 542
 543                 data->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 544                 if (data->m == NULL) {
 545                         printf("%s: could not allocate rx mbuf\n",
 546                             USBDEVNAME(sc->sc_dev));
 547                         error = ENOMEM;
 548                         goto fail;
 549                 }
 550
 551                 data->buf = mtod(data->m, uint8_t *);
 552                 bzero(data->buf, sizeof(struct rum_rx_desc));
 553         }
 554
 555         return 0;
 556
 557 fail:   rum_free_tx_list(sc);
 558         return error;
 559 }
 560
 561 Static void
 562 rum_free_rx_list(struct rum_softc *sc)
 563 {
 564         struct rum_rx_data *data;
 565         int i;
 566
 567         for (i = 0; i < RT2573_RX_LIST_COUNT; i++) {
 568                 data = &sc->rx_data[i];
 569
 570                 if (data->xfer != NULL) {
 571                         usbd_free_xfer(data->xfer);
 572                         data->xfer = NULL;
 573                 }
 574
 575                 if (data->m != NULL) {
 576                         m_freem(data->m);
 577                         data->m = NULL;
 578                 }
 579         }
 580 }
 581
 582 Static int
 583 rum_media_change(struct ifnet *ifp)
 584 {
 585         int error;
 586
 587         error = ieee80211_media_change(ifp);
 588         if (error != ENETRESET)
 589                 return error;
 590
 591         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
 592                 rum_init(ifp->if_softc);
 593
 594         return 0;
 595 }
 596
 597 /*
 598  * This function is called periodically (every 200ms) during scanning to
 599  * switch from one channel to another.
 600  */
 601 Static void
 602 rum_next_scan(void *arg)
 603 {
 604         struct rum_softc *sc = arg;
 605         struct ieee80211com *ic = &sc->sc_ic;
 606         struct ifnet *ifp = &ic->ic_if;
 607
 608         lwkt_serialize_enter(ifp->if_serializer);
 609
 610         if (ic->ic_state == IEEE80211_S_SCAN)
 611                 ieee80211_next_scan(ic);
 612
 613         lwkt_serialize_exit(ifp->if_serializer);
 614 }
 615
 616 Static void
 617 rum_task(void *arg)
 618 {
 619         struct rum_softc *sc = arg;
 620         struct ieee80211com *ic = &sc->sc_ic;
 621         struct ifnet *ifp = &ic->ic_if;
 622         enum ieee80211_state ostate;
 623         struct ieee80211_node *ni;
 624         uint32_t tmp;
 625
 626         lwkt_serialize_enter(ifp->if_serializer);
 627
 628         ieee80211_ratectl_newstate(ic, sc->sc_state);
 629
 630         ostate = ic->ic_state;
 631
 632         switch (sc->sc_state) {
 633         case IEEE80211_S_INIT:
 634                 if (ostate == IEEE80211_S_RUN) {
 635                         /* abort TSF synchronization */
 636                         tmp = rum_read(sc, RT2573_TXRX_CSR9);
 637                         rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
 638                 }
 639                 break;
 640
 641         case IEEE80211_S_SCAN:
 642                 rum_set_chan(sc, ic->ic_curchan);
 643                 callout_reset(&sc->scan_ch, hz / 5, rum_next_scan, sc);
 644                 break;
 645
 646         case IEEE80211_S_AUTH:
 647                 rum_set_chan(sc, ic->ic_curchan);
 648                 break;
 649
 650         case IEEE80211_S_ASSOC:
 651                 rum_set_chan(sc, ic->ic_curchan);
 652                 break;
 653
 654         case IEEE80211_S_RUN:
 655                 rum_set_chan(sc, ic->ic_curchan);
 656
 657                 ni = ic->ic_bss;
 658
 659                 lwkt_serialize_exit(ifp->if_serializer);
 660
 661                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 662                         rum_update_slot(sc);
 663                         rum_enable_mrr(sc);
 664                         rum_set_txpreamble(sc);
 665                         rum_set_basicrates(sc);
 666                         rum_set_bssid(sc, ni->ni_bssid);
 667                 }
 668
 669                 if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
 670                     ic->ic_opmode == IEEE80211_M_IBSS)
 671                         rum_prepare_beacon(sc);
 672
 673                 if (ic->ic_opmode != IEEE80211_M_MONITOR)
 674                         rum_enable_tsf_sync(sc);
 675
 676                 /* clear statistic registers (STA_CSR0 to STA_CSR5) */
 677                 rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof(sc->sta));
 678
 679                 lwkt_serialize_enter(ifp->if_serializer);
 680
 681                 callout_reset(&sc->stats_ch, 4 * hz / 5, rum_stats_timeout, sc);
 682
 683                 break;
 684         }
 685
 686         sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
 687
 688         lwkt_serialize_exit(ifp->if_serializer);
 689 }
 690
 691 Static int
 692 rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 693 {
 694         struct rum_softc *sc = ic->ic_if.if_softc;
 695         struct ifnet *ifp = &ic->ic_if;
 696
 697         ASSERT_SERIALIZED(ifp->if_serializer);
 698
 699         callout_stop(&sc->scan_ch);
 700         callout_stop(&sc->stats_ch);
 701
 702         /* do it in a process context */
 703         sc->sc_state = nstate;
 704         sc->sc_arg = arg;
 705
 706         lwkt_serialize_exit(ifp->if_serializer);
 707         usb_rem_task(sc->sc_udev, &sc->sc_task);
 708
 709         if (sc->sc_flags & RUM_FLAG_SYNCTASK) {
 710                 usb_do_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER,
 711                             USBD_NO_TIMEOUT);
 712         } else {
 713                 usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
 714         }
 715         lwkt_serialize_enter(ifp->if_serializer);
 716
 717         return 0;
 718 }
 719
 720 /* quickly determine if a given rate is CCK or OFDM */
 721 #define RUM_RATE_IS_OFDM(rate)  ((rate) >= 12 && (rate) != 22)
 722
 723 #define RUM_ACK_SIZE    14      /* 10 + 4(FCS) */
 724 #define RUM_CTS_SIZE    14      /* 10 + 4(FCS) */
 725
 726 Static void
 727 rum_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 728 {
 729         struct rum_tx_data *data = priv;
 730         struct rum_softc *sc = data->sc;
 731         struct ieee80211com *ic = &sc->sc_ic;
 732         struct ifnet *ifp = &ic->ic_if;
 733
 734         if (status != USBD_NORMAL_COMPLETION) {
 735                 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
 736                         return;
 737
 738                 printf("%s: could not transmit buffer: %s\n",
 739                     USBDEVNAME(sc->sc_dev), usbd_errstr(status));
 740
 741                 if (status == USBD_STALLED)
 742                         usbd_clear_endpoint_stall_async(sc->sc_tx_pipeh);
 743
 744                 ifp->if_oerrors++;
 745                 return;
 746         }
 747
 748 #ifdef spl
 749         s = splnet();
 750 #endif
 751
 752         lwkt_serialize_enter(ifp->if_serializer);
 753
 754         m_freem(data->m);
 755         data->m = NULL;
 756         ieee80211_free_node(data->ni);
 757         data->ni = NULL;
 758
 759         bzero(data->buf, sizeof(struct rum_tx_data));
 760         sc->tx_queued--;
 761         ifp->if_opackets++;
 762
 763         DPRINTFN(10, ("tx done\n"));
 764
 765         sc->sc_tx_timer = 0;
 766         ifp->if_flags &= ~IFF_OACTIVE;
 767         rum_start(ifp);
 768
 769         lwkt_serialize_exit(ifp->if_serializer);
 770
 771 #ifdef spl
 772         splx(s);
 773 #endif
 774 }
 775
 776 Static void
 777 rum_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 778 {
 779         struct rum_rx_data *data = priv;
 780         struct rum_softc *sc = data->sc;
 781         struct ieee80211com *ic = &sc->sc_ic;
 782         struct ifnet *ifp = &ic->ic_if;
 783         struct rum_rx_desc *desc;
 784         struct ieee80211_frame_min *wh;
 785         struct ieee80211_node *ni;
 786         struct mbuf *mnew, *m;
 787         int len;
 788
 789         if (status != USBD_NORMAL_COMPLETION) {
 790                 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
 791                         return;
 792
 793                 if (status == USBD_STALLED)
 794                         usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
 795                 goto skip;
 796         }
 797
 798         usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
 799
 800         if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
 801                 DPRINTF(("%s: xfer too short %d\n", USBDEVNAME(sc->sc_dev),
 802                     len));
 803                 ifp->if_ierrors++;
 804                 goto skip;
 805         }
 806
 807         desc = (struct rum_rx_desc *)data->buf;
 808
 809         if (le32toh(desc->flags) & RT2573_RX_CRC_ERROR) {
 810                 /*
 811                  * This should not happen since we did not request to receive
 812                  * those frames when we filled RT2573_TXRX_CSR0.
 813                  */
 814                 DPRINTFN(5, ("CRC error\n"));
 815                 ifp->if_ierrors++;
 816                 goto skip;
 817         }
 818
 819         mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 820         if (mnew == NULL) {
 821                 printf("%s: could not allocate rx mbuf\n",
 822                     USBDEVNAME(sc->sc_dev));
 823                 ifp->if_ierrors++;
 824                 goto skip;
 825         }
 826
 827         m = data->m;
 828         data->m = mnew;
 829         data->buf = mtod(data->m, uint8_t *);
 830
 831         /* finalize mbuf */
 832         m->m_pkthdr.rcvif = ifp;
 833         m->m_data = (caddr_t)(desc + 1);
 834         m->m_pkthdr.len = m->m_len = (le32toh(desc->flags) >> 16) & 0xfff;
 835
 836 #ifdef spl
 837         s = splnet();
 838 #endif
 839
 840         lwkt_serialize_enter(ifp->if_serializer);
 841
 842         if (sc->sc_drvbpf != NULL) {
 843                 struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
 844
 845                 tap->wr_flags = 0;
 846                 tap->wr_rate = rum_rxrate(desc);
 847                 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
 848                 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
 849                 tap->wr_antenna = sc->rx_ant;
 850                 tap->wr_antsignal = desc->rssi;
 851
 852                 bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
 853         }
 854
 855         wh = mtod(m, struct ieee80211_frame_min *);
 856         ni = ieee80211_find_rxnode(ic, wh);
 857
 858         /* send the frame to the 802.11 layer */
 859         ieee80211_input(ic, m, ni, desc->rssi, 0);
 860
 861         /* node is no longer needed */
 862         ieee80211_free_node(ni);
 863
 864         /*
 865          * In HostAP mode, ieee80211_input() will enqueue packets in if_snd
 866          * without calling if_start().
 867          */
 868         if (!ifq_is_empty(&ifp->if_snd) && !(ifp->if_flags & IFF_OACTIVE))
 869                 rum_start(ifp);
 870
 871 #ifdef spl
 872         splx(s);
 873 #endif
 874
 875         lwkt_serialize_exit(ifp->if_serializer);
 876
 877         DPRINTFN(15, ("rx done\n"));
 878
 879 skip:   /* setup a new transfer */
 880         bzero(data->buf, sizeof(struct rum_rx_desc));
 881         usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data, data->buf, MCLBYTES,
 882             USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
 883         usbd_transfer(xfer);
 884 }
 885
 886 /*
 887  * This function is only used by the Rx radiotap code. It returns the rate at
 888  * which a given frame was received.
 889  */
 890 Static uint8_t
 891 rum_rxrate(struct rum_rx_desc *desc)
 892 {
 893         if (le32toh(desc->flags) & RT2573_RX_OFDM) {
 894                 /* reverse function of rum_plcp_signal */
 895                 switch (desc->rate) {
 896                 case 0xb:       return 12;
 897                 case 0xf:       return 18;
 898                 case 0xa:       return 24;
 899                 case 0xe:       return 36;
 900                 case 0x9:       return 48;
 901                 case 0xd:       return 72;
 902                 case 0x8:       return 96;
 903                 case 0xc:       return 108;
 904                 }
 905         } else {
 906                 if (desc->rate == 10)
 907                         return 2;
 908                 if (desc->rate == 20)
 909                         return 4;
 910                 if (desc->rate == 55)
 911                         return 11;
 912                 if (desc->rate == 110)
 913                         return 22;
 914         }
 915         return 2;       /* should not get there */
 916 }
 917
 918 /*
 919  * Return the expected ack rate for a frame transmitted at rate `rate'.
 920  * XXX: this should depend on the destination node basic rate set.
 921  */
 922 Static int
 923 rum_ack_rate(struct ieee80211com *ic, int rate)
 924 {
 925         switch (rate) {
 926         /* CCK rates */
 927         case 2:
 928                 return 2;
 929         case 4:
 930         case 11:
 931         case 22:
 932                 return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
 933
 934         /* OFDM rates */
 935         case 12:
 936         case 18:
 937                 return 12;
 938         case 24:
 939         case 36:
 940                 return 24;
 941         case 48:
 942         case 72:
 943         case 96:
 944         case 108:
 945                 return 48;
 946         }
 947
 948         /* default to 1Mbps */
 949         return 2;
 950 }
 951
 952 /*
 953  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
 954  * The function automatically determines the operating mode depending on the
 955  * given rate. `flags' indicates whether short preamble is in use or not.
 956  */
 957 Static uint16_t
 958 rum_txtime(int len, int rate, uint32_t flags)
 959 {
 960         uint16_t txtime;
 961
 962         if (RUM_RATE_IS_OFDM(rate)) {
 963                 /* IEEE Std 802.11a-1999, pp. 37 */
 964                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
 965                 txtime = 16 + 4 + 4 * txtime + 6;
 966         } else {
 967                 /* IEEE Std 802.11b-1999, pp. 28 */
 968                 txtime = (16 * len + rate - 1) / rate;
 969                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
 970                         txtime +=  72 + 24;
 971                 else
 972                         txtime += 144 + 48;
 973         }
 974         return txtime;
 975 }
 976
 977 Static uint8_t
 978 rum_plcp_signal(int rate)
 979 {
 980         switch (rate) {
 981         /* CCK rates (returned values are device-dependent) */
 982         case 2:         return 0x0;
 983         case 4:         return 0x1;
 984         case 11:        return 0x2;
 985         case 22:        return 0x3;
 986
 987         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 988         case 12:        return 0xb;
 989         case 18:        return 0xf;
 990         case 24:        return 0xa;
 991         case 36:        return 0xe;
 992         case 48:        return 0x9;
 993         case 72:        return 0xd;
 994         case 96:        return 0x8;
 995         case 108:       return 0xc;
 996
 997         /* unsupported rates (should not get there) */
 998         default:        return 0xff;
 999         }
1000 }
1001
1002 Static void
1003 rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1004     uint32_t flags, uint16_t xflags, int len, int rate)
1005 {
1006         struct ieee80211com *ic = &sc->sc_ic;
1007         uint16_t plcp_length;
1008         int remainder;
1009
1010         desc->flags = htole32(flags);
1011         desc->flags |= htole32(len << 16);
1012
1013         desc->xflags = htole16(xflags);
1014
1015         desc->wme = htole16(
1016             RT2573_QID(0) |
1017             RT2573_AIFSN(2) |
1018             RT2573_LOGCWMIN(4) |
1019             RT2573_LOGCWMAX(10));
1020
1021         /* setup PLCP fields */
1022         desc->plcp_signal  = rum_plcp_signal(rate);
1023         desc->plcp_service = 4;
1024
1025         len += IEEE80211_CRC_LEN;
1026         if (RUM_RATE_IS_OFDM(rate)) {
1027                 desc->flags |= htole32(RT2573_TX_OFDM);
1028
1029                 plcp_length = len & 0xfff;
1030                 desc->plcp_length_hi = plcp_length >> 6;
1031                 desc->plcp_length_lo = plcp_length & 0x3f;
1032         } else {
1033                 plcp_length = (16 * len + rate - 1) / rate;
1034                 if (rate == 22) {
1035                         remainder = (16 * len) % 22;
1036                         if (remainder != 0 && remainder < 7)
1037                                 desc->plcp_service |= RT2573_PLCP_LENGEXT;
1038                 }
1039                 desc->plcp_length_hi = plcp_length >> 8;
1040                 desc->plcp_length_lo = plcp_length & 0xff;
1041
1042                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1043                         desc->plcp_signal |= 0x08;
1044         }
1045         desc->flags |= htole32(RT2573_TX_VALID);
1046 }
1047
1048 #define RUM_TX_TIMEOUT  5000
1049
1050 Static int
1051 rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1052 {
1053         struct ieee80211com *ic = &sc->sc_ic;
1054         struct rum_tx_desc *desc;
1055         struct rum_tx_data *data;
1056         struct ieee80211_frame *wh;
1057         uint32_t flags = 0;
1058         uint16_t dur;
1059         usbd_status error;
1060         int xferlen, rate;
1061
1062         wh = mtod(m0, struct ieee80211_frame *);
1063
1064         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1065                 if (ieee80211_crypto_encap(ic, ni, m0) == NULL) {
1066                         m_freem(m0);
1067                         return ENOBUFS;
1068                 }
1069
1070                 /* packet header may have moved, reset our local pointer */
1071                 wh = mtod(m0, struct ieee80211_frame *);
1072         }
1073
1074         /* pickup a rate */
1075         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1076             IEEE80211_FC0_TYPE_MGT) {
1077                 /* mgmt frames are sent at the lowest available bit-rate */
1078                 rate = ni->ni_rates.rs_rates[0];
1079         } else {
1080                 if (ic->ic_fixed_rate != -1) {
1081                         rate = ic->ic_sup_rates[ic->ic_curmode].
1082                             rs_rates[ic->ic_fixed_rate];
1083                 } else
1084                         rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1085         }
1086         rate &= IEEE80211_RATE_VAL;
1087         if (rate == 0)
1088                 rate = 2;       /* fallback to 1Mbps; should not happen  */
1089
1090         data = &sc->tx_data[0];
1091         desc = (struct rum_tx_desc *)data->buf;
1092
1093         data->m = m0;
1094         data->ni = ni;
1095
1096         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1097                 flags |= RT2573_TX_ACK;
1098
1099                 dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1100                     ic->ic_flags) + sc->sifs;
1101                 *(uint16_t *)wh->i_dur = htole16(dur);
1102
1103                 /* tell hardware to set timestamp in probe responses */
1104                 if ((wh->i_fc[0] &
1105                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1106                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1107                         flags |= RT2573_TX_TIMESTAMP;
1108         }
1109
1110         if (sc->sc_drvbpf != NULL) {
1111                 struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1112
1113                 tap->wt_flags = 0;
1114                 tap->wt_rate = rate;
1115                 tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1116                 tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1117                 tap->wt_antenna = sc->tx_ant;
1118
1119                 bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1120         }
1121
1122         m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1123         rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1124
1125         /* align end on a 4-bytes boundary */
1126         xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1127
1128         /*
1129          * No space left in the last URB to store the extra 4 bytes, force
1130          * sending of another URB.
1131          */
1132         if ((xferlen % 64) == 0)
1133                 xferlen += 4;
1134
1135         DPRINTFN(10, ("sending frame len=%u rate=%u xfer len=%u\n",
1136             m0->m_pkthdr.len + RT2573_TX_DESC_SIZE, rate, xferlen));
1137
1138         usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1139             USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1140
1141         error = usbd_transfer(data->xfer);
1142         if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1143                 m_freem(m0);
1144                 return error;
1145         }
1146
1147         sc->tx_queued++;
1148
1149         return 0;
1150 }
1151
1152 Static void
1153 rum_start(struct ifnet *ifp)
1154 {
1155         struct rum_softc *sc = ifp->if_softc;
1156         struct ieee80211com *ic = &sc->sc_ic;
1157         struct ieee80211_node *ni;
1158         struct mbuf *m0;
1159
1160         ASSERT_SERIALIZED(ifp->if_serializer);
1161
1162         /*
1163          * net80211 may still try to send management frames even if the
1164          * IFF_RUNNING flag is not set...
1165          */
1166         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1167                 return;
1168
1169         for (;;) {
1170                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1171                         if (sc->tx_queued >= RT2573_TX_LIST_COUNT) {
1172                                 ifp->if_flags |= IFF_OACTIVE;
1173                                 break;
1174                         }
1175                         IF_DEQUEUE(&ic->ic_mgtq, m0);
1176
1177                         ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1178                         m0->m_pkthdr.rcvif = NULL;
1179
1180                         BPF_MTAP(ifp, m0);
1181
1182                         if (rum_tx_data(sc, m0, ni) != 0)
1183                                 break;
1184
1185                 } else {
1186                         struct ether_header *eh;
1187
1188                         if (ic->ic_state != IEEE80211_S_RUN)
1189                                 break;
1190
1191                         m0 = ifq_poll(&ifp->if_snd);
1192                         if (m0 == NULL)
1193                                 break;
1194                         if (sc->tx_queued >= RT2573_TX_LIST_COUNT) {
1195                                 ifp->if_flags |= IFF_OACTIVE;
1196                                 break;
1197                         }
1198                         ifq_dequeue(&ifp->if_snd, m0);
1199
1200                         if (m0->m_len < sizeof (struct ether_header) &&
1201                             !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1202                                 continue;
1203
1204                         eh = mtod(m0, struct ether_header *);
1205                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1206                         if (ni == NULL) {
1207                                 m_freem(m0);
1208                                 continue;
1209                         }
1210
1211                         BPF_MTAP(ifp, m0);
1212
1213                         m0 = ieee80211_encap(ic, m0, ni);
1214                         if (m0 == NULL)
1215                                 continue;
1216
1217                         if (ic->ic_rawbpf != NULL)
1218                                 bpf_mtap(ic->ic_rawbpf, m0);
1219
1220                         if (rum_tx_data(sc, m0, ni) != 0) {
1221                                 if (ni != NULL)
1222                                         ieee80211_free_node(ni);
1223                                 ifp->if_oerrors++;
1224                                 break;
1225                         }
1226                 }
1227
1228                 sc->sc_tx_timer = 5;
1229                 ifp->if_timer = 1;
1230         }
1231 }
1232
1233 Static void
1234 rum_watchdog(struct ifnet *ifp)
1235 {
1236         struct rum_softc *sc = ifp->if_softc;
1237
1238         ASSERT_SERIALIZED(ifp->if_serializer);
1239
1240         ifp->if_timer = 0;
1241
1242         if (sc->sc_tx_timer > 0) {
1243                 if (--sc->sc_tx_timer == 0) {
1244                         printf("%s: device timeout\n", USBDEVNAME(sc->sc_dev));
1245                         /*rum_init(sc); XXX needs a process context! */
1246                         ifp->if_oerrors++;
1247                         return;
1248                 }
1249                 ifp->if_timer = 1;
1250         }
1251
1252         ieee80211_watchdog(&sc->sc_ic);
1253 }
1254
1255 Static int
1256 rum_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1257 {
1258         struct rum_softc *sc = ifp->if_softc;
1259         struct ieee80211com *ic = &sc->sc_ic;
1260         int error = 0;
1261
1262         ASSERT_SERIALIZED(ifp->if_serializer);
1263
1264 #ifdef spl
1265         s = splnet();
1266 #endif
1267
1268         switch (cmd) {
1269         case SIOCSIFFLAGS:
1270                 if (ifp->if_flags & IFF_UP) {
1271                         if (ifp->if_flags & IFF_RUNNING)
1272                                 rum_update_promisc(sc);
1273                         else
1274                                 rum_init(sc);
1275                 } else {
1276                         if (ifp->if_flags & IFF_RUNNING)
1277                                 rum_stop(sc);
1278                 }
1279                 break;
1280         default:
1281                 error = ieee80211_ioctl(ic, cmd, data, cr);
1282                 break;
1283         }
1284
1285         if (error == ENETRESET) {
1286                 struct ieee80211req *ireq = (struct ieee80211req *)data;
1287
1288                 if (cmd == SIOCS80211 &&
1289                     ireq->i_type == IEEE80211_IOC_CHANNEL &&
1290                     ic->ic_opmode == IEEE80211_M_MONITOR) {
1291                         /*
1292                          * This allows for fast channel switching in monitor mode
1293                          * (used by kismet). In IBSS mode, we must explicitly reset
1294                          * the interface to generate a new beacon frame.
1295                          */
1296                         rum_set_chan(sc, ic->ic_ibss_chan);
1297                 } else if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1298                     (IFF_UP | IFF_RUNNING)) {
1299                         rum_init(sc);
1300                 }
1301                 error = 0;
1302         }
1303
1304 #ifdef spl
1305         splx(s);
1306 #endif
1307
1308         return error;
1309 }
1310
1311 Static void
1312 rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1313 {
1314         usb_device_request_t req;
1315         usbd_status error;
1316
1317         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1318         req.bRequest = RT2573_READ_EEPROM;
1319         USETW(req.wValue, 0);
1320         USETW(req.wIndex, addr);
1321         USETW(req.wLength, len);
1322
1323         error = usbd_do_request(sc->sc_udev, &req, buf);
1324         if (error != 0) {
1325                 printf("%s: could not read EEPROM: %s\n",
1326                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1327         }
1328 }
1329
1330 Static uint32_t
1331 rum_read(struct rum_softc *sc, uint16_t reg)
1332 {
1333         uint32_t val;
1334
1335         rum_read_multi(sc, reg, &val, sizeof val);
1336
1337         return le32toh(val);
1338 }
1339
1340 Static void
1341 rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1342 {
1343         usb_device_request_t req;
1344         usbd_status error;
1345
1346         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1347         req.bRequest = RT2573_READ_MULTI_MAC;
1348         USETW(req.wValue, 0);
1349         USETW(req.wIndex, reg);
1350         USETW(req.wLength, len);
1351
1352         error = usbd_do_request(sc->sc_udev, &req, buf);
1353         if (error != 0) {
1354                 printf("%s: could not multi read MAC register: %s\n",
1355                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1356         }
1357 }
1358
1359 Static void
1360 rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1361 {
1362         uint32_t tmp = htole32(val);
1363
1364         rum_write_multi(sc, reg, &tmp, sizeof tmp);
1365 }
1366
1367 Static void
1368 rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1369 {
1370         usb_device_request_t req;
1371         usbd_status error;
1372
1373         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1374         req.bRequest = RT2573_WRITE_MULTI_MAC;
1375         USETW(req.wValue, 0);
1376         USETW(req.wIndex, reg);
1377         USETW(req.wLength, len);
1378
1379         error = usbd_do_request(sc->sc_udev, &req, buf);
1380         if (error != 0) {
1381                 printf("%s: could not multi write MAC register: %s\n",
1382                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1383         }
1384 }
1385
1386 Static void
1387 rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1388 {
1389         uint32_t tmp;
1390         int ntries;
1391
1392         for (ntries = 0; ntries < 5; ntries++) {
1393                 if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1394                         break;
1395         }
1396         if (ntries == 5) {
1397                 printf("%s: could not write to BBP\n", USBDEVNAME(sc->sc_dev));
1398                 return;
1399         }
1400
1401         tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1402         rum_write(sc, RT2573_PHY_CSR3, tmp);
1403 }
1404
1405 Static uint8_t
1406 rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1407 {
1408         uint32_t val;
1409         int ntries;
1410
1411         for (ntries = 0; ntries < 5; ntries++) {
1412                 if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1413                         break;
1414         }
1415         if (ntries == 5) {
1416                 printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1417                 return 0;
1418         }
1419
1420         val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1421         rum_write(sc, RT2573_PHY_CSR3, val);
1422
1423         for (ntries = 0; ntries < 100; ntries++) {
1424                 val = rum_read(sc, RT2573_PHY_CSR3);
1425                 if (!(val & RT2573_BBP_BUSY))
1426                         return val & 0xff;
1427                 DELAY(1);
1428         }
1429
1430         printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1431         return 0;
1432 }
1433
1434 Static void
1435 rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1436 {
1437         uint32_t tmp;
1438         int ntries;
1439
1440         for (ntries = 0; ntries < 5; ntries++) {
1441                 if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1442                         break;
1443         }
1444         if (ntries == 5) {
1445                 printf("%s: could not write to RF\n", USBDEVNAME(sc->sc_dev));
1446                 return;
1447         }
1448
1449         tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1450             (reg & 3);
1451         rum_write(sc, RT2573_PHY_CSR4, tmp);
1452
1453         /* remember last written value in sc */
1454         sc->rf_regs[reg] = val;
1455
1456         DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff));
1457 }
1458
1459 Static void
1460 rum_select_antenna(struct rum_softc *sc)
1461 {
1462         uint8_t bbp4, bbp77;
1463         uint32_t tmp;
1464
1465         bbp4  = rum_bbp_read(sc, 4);
1466         bbp77 = rum_bbp_read(sc, 77);
1467
1468         /* TBD */
1469
1470         /* make sure Rx is disabled before switching antenna */
1471         tmp = rum_read(sc, RT2573_TXRX_CSR0);
1472         rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1473
1474         rum_bbp_write(sc,  4, bbp4);
1475         rum_bbp_write(sc, 77, bbp77);
1476
1477         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1478 }
1479
1480 /*
1481  * Enable multi-rate retries for frames sent at OFDM rates.
1482  * In 802.11b/g mode, allow fallback to CCK rates.
1483  */
1484 Static void
1485 rum_enable_mrr(struct rum_softc *sc)
1486 {
1487         struct ieee80211com *ic = &sc->sc_ic;
1488         uint32_t tmp;
1489
1490         tmp = rum_read(sc, RT2573_TXRX_CSR4);
1491
1492         tmp &= ~RT2573_MRR_CCK_FALLBACK;
1493         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1494                 tmp |= RT2573_MRR_CCK_FALLBACK;
1495         tmp |= RT2573_MRR_ENABLED;
1496
1497         rum_write(sc, RT2573_TXRX_CSR4, tmp);
1498 }
1499
1500 Static void
1501 rum_set_txpreamble(struct rum_softc *sc)
1502 {
1503         uint32_t tmp;
1504
1505         tmp = rum_read(sc, RT2573_TXRX_CSR4);
1506
1507         tmp &= ~RT2573_SHORT_PREAMBLE;
1508         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1509                 tmp |= RT2573_SHORT_PREAMBLE;
1510
1511         rum_write(sc, RT2573_TXRX_CSR4, tmp);
1512 }
1513
1514 Static void
1515 rum_set_basicrates(struct rum_softc *sc)
1516 {
1517         struct ieee80211com *ic = &sc->sc_ic;
1518
1519         /* update basic rate set */
1520         if (ic->ic_curmode == IEEE80211_MODE_11B) {
1521                 /* 11b basic rates: 1, 2Mbps */
1522                 rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1523         } else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan)) {
1524                 /* 11a basic rates: 6, 12, 24Mbps */
1525                 rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1526         } else {
1527                 /* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1528                 rum_write(sc, RT2573_TXRX_CSR5, 0x15f);
1529         }
1530 }
1531
1532 /*
1533  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1534  * driver.
1535  */
1536 Static void
1537 rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1538 {
1539         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1540         uint32_t tmp;
1541
1542         /* update all BBP registers that depend on the band */
1543         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1544         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1545         if (IEEE80211_IS_CHAN_5GHZ(c)) {
1546                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1547                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1548         }
1549         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1550             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1551                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1552         }
1553
1554         sc->bbp17 = bbp17;
1555         rum_bbp_write(sc,  17, bbp17);
1556         rum_bbp_write(sc,  96, bbp96);
1557         rum_bbp_write(sc, 104, bbp104);
1558
1559         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1560             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1561                 rum_bbp_write(sc, 75, 0x80);
1562                 rum_bbp_write(sc, 86, 0x80);
1563                 rum_bbp_write(sc, 88, 0x80);
1564         }
1565
1566         rum_bbp_write(sc, 35, bbp35);
1567         rum_bbp_write(sc, 97, bbp97);
1568         rum_bbp_write(sc, 98, bbp98);
1569
1570         tmp = rum_read(sc, RT2573_PHY_CSR0);
1571         tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1572         if (IEEE80211_IS_CHAN_2GHZ(c))
1573                 tmp |= RT2573_PA_PE_2GHZ;
1574         else
1575                 tmp |= RT2573_PA_PE_5GHZ;
1576         rum_write(sc, RT2573_PHY_CSR0, tmp);
1577
1578         /* 802.11a uses a 16 microseconds short interframe space */
1579         sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1580 }
1581
1582 Static void
1583 rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1584 {
1585         struct ieee80211com *ic = &sc->sc_ic;
1586         struct ifnet *ifp = &ic->ic_if;
1587         const struct rfprog *rfprog;
1588         uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1589         int8_t power;
1590         u_int i, chan;
1591
1592         ASSERT_SERIALIZED(ifp->if_serializer);
1593
1594         chan = ieee80211_chan2ieee(ic, c);
1595         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1596                 return;
1597
1598         lwkt_serialize_exit(ifp->if_serializer);
1599
1600         /* select the appropriate RF settings based on what EEPROM says */
1601         rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1602                   sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1603
1604         /* find the settings for this channel (we know it exists) */
1605         for (i = 0; rfprog[i].chan != chan; i++)
1606                 ;       /* EMPTY */
1607
1608         power = sc->txpow[i];
1609         if (power < 0) {
1610                 bbp94 += power;
1611                 power = 0;
1612         } else if (power > 31) {
1613                 bbp94 += power - 31;
1614                 power = 31;
1615         }
1616
1617         /*
1618          * If we are switching from the 2GHz band to the 5GHz band or
1619          * vice-versa, BBP registers need to be reprogrammed.
1620          */
1621         if (c->ic_flags != sc->sc_curchan->ic_flags) {
1622                 rum_select_band(sc, c);
1623                 rum_select_antenna(sc);
1624         }
1625         sc->sc_curchan = c;
1626
1627         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1628         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1629         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1630         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1631
1632         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1633         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1634         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1635         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1636
1637         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1638         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1639         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1640         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1641
1642         DELAY(10);
1643
1644         /* enable smart mode for MIMO-capable RFs */
1645         bbp3 = rum_bbp_read(sc, 3);
1646
1647         bbp3 &= ~RT2573_SMART_MODE;
1648         if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1649                 bbp3 |= RT2573_SMART_MODE;
1650
1651         rum_bbp_write(sc, 3, bbp3);
1652
1653         if (bbp94 != RT2573_BBPR94_DEFAULT)
1654                 rum_bbp_write(sc, 94, bbp94);
1655
1656         lwkt_serialize_enter(ifp->if_serializer);
1657 }
1658
1659 /*
1660  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1661  * and HostAP operating modes.
1662  */
1663 Static void
1664 rum_enable_tsf_sync(struct rum_softc *sc)
1665 {
1666         struct ieee80211com *ic = &sc->sc_ic;
1667         uint32_t tmp;
1668
1669         if (ic->ic_opmode != IEEE80211_M_STA) {
1670                 /*
1671                  * Change default 16ms TBTT adjustment to 8ms.
1672                  * Must be done before enabling beacon generation.
1673                  */
1674                 rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1675         }
1676
1677         tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1678
1679         /* set beacon interval (in 1/16ms unit) */
1680         tmp |= ic->ic_bss->ni_intval * 16;
1681
1682         tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1683         if (ic->ic_opmode == IEEE80211_M_STA)
1684                 tmp |= RT2573_TSF_MODE(1);
1685         else
1686                 tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1687
1688         rum_write(sc, RT2573_TXRX_CSR9, tmp);
1689 }
1690
1691 Static void
1692 rum_update_slot(struct rum_softc *sc)
1693 {
1694         struct ieee80211com *ic = &sc->sc_ic;
1695         uint8_t slottime;
1696         uint32_t tmp;
1697
1698         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1699
1700         tmp = rum_read(sc, RT2573_MAC_CSR9);
1701         tmp = (tmp & ~0xff) | slottime;
1702         rum_write(sc, RT2573_MAC_CSR9, tmp);
1703
1704         DPRINTF(("setting slot time to %uus\n", slottime));
1705 }
1706
1707 Static void
1708 rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1709 {
1710         uint32_t tmp;
1711
1712         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1713         rum_write(sc, RT2573_MAC_CSR4, tmp);
1714
1715         tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1716         rum_write(sc, RT2573_MAC_CSR5, tmp);
1717 }
1718
1719 Static void
1720 rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1721 {
1722         uint32_t tmp;
1723
1724         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1725         rum_write(sc, RT2573_MAC_CSR2, tmp);
1726
1727         tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1728         rum_write(sc, RT2573_MAC_CSR3, tmp);
1729 }
1730
1731 Static void
1732 rum_update_promisc(struct rum_softc *sc)
1733 {
1734         struct ifnet *ifp = &sc->sc_ic.ic_if;
1735         uint32_t tmp;
1736
1737         tmp = rum_read(sc, RT2573_TXRX_CSR0);
1738
1739         tmp &= ~RT2573_DROP_NOT_TO_ME;
1740         if (!(ifp->if_flags & IFF_PROMISC))
1741                 tmp |= RT2573_DROP_NOT_TO_ME;
1742
1743         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1744
1745         DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1746             "entering" : "leaving"));
1747 }
1748
1749 Static const char *
1750 rum_get_rf(int rev)
1751 {
1752         switch (rev) {
1753         case RT2573_RF_2527:    return "RT2527 (MIMO XR)";
1754         case RT2573_RF_2528:    return "RT2528";
1755         case RT2573_RF_5225:    return "RT5225 (MIMO XR)";
1756         case RT2573_RF_5226:    return "RT5226";
1757         default:                return "unknown";
1758         }
1759 }
1760
1761 Static void
1762 rum_read_eeprom(struct rum_softc *sc)
1763 {
1764         struct ieee80211com *ic = &sc->sc_ic;
1765         uint16_t val;
1766 #ifdef RUM_DEBUG
1767         int i;
1768 #endif
1769
1770         /* read MAC/BBP type */
1771         rum_eeprom_read(sc, RT2573_EEPROM_MACBBP, &val, 2);
1772         sc->macbbp_rev = le16toh(val);
1773
1774         /* read MAC address */
1775         rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1776
1777         rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1778         val = le16toh(val);
1779         sc->rf_rev =   (val >> 11) & 0x1f;
1780         sc->hw_radio = (val >> 10) & 0x1;
1781         sc->rx_ant =   (val >> 4)  & 0x3;
1782         sc->tx_ant =   (val >> 2)  & 0x3;
1783         sc->nb_ant =   val & 0x3;
1784
1785         DPRINTF(("RF revision=%d\n", sc->rf_rev));
1786
1787         rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1788         val = le16toh(val);
1789         sc->ext_5ghz_lna = (val >> 6) & 0x1;
1790         sc->ext_2ghz_lna = (val >> 4) & 0x1;
1791
1792         DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1793             sc->ext_2ghz_lna, sc->ext_5ghz_lna));
1794
1795         rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1796         val = le16toh(val);
1797         if ((val & 0xff) != 0xff)
1798                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
1799
1800         rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1801         val = le16toh(val);
1802         if ((val & 0xff) != 0xff)
1803                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
1804
1805         DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1806             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
1807
1808         rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1809         val = le16toh(val);
1810         if ((val & 0xff) != 0xff)
1811                 sc->rffreq = val & 0xff;
1812
1813         DPRINTF(("RF freq=%d\n", sc->rffreq));
1814
1815         /* read Tx power for all a/b/g channels */
1816         rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1817         /* XXX default Tx power for 802.11a channels */
1818         memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1819 #ifdef RUM_DEBUG
1820         for (i = 0; i < 14; i++)
1821                 DPRINTF(("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]));
1822 #endif
1823
1824         /* read default values for BBP registers */
1825         rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1826 #ifdef RUM_DEBUG
1827         for (i = 0; i < 14; i++) {
1828                 if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1829                         continue;
1830                 DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1831                     sc->bbp_prom[i].val));
1832         }
1833 #endif
1834 }
1835
1836 Static int
1837 rum_bbp_init(struct rum_softc *sc)
1838 {
1839 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1840         int i, ntries;
1841         uint8_t val;
1842
1843         /* wait for BBP to be ready */
1844         for (ntries = 0; ntries < 100; ntries++) {
1845                 val = rum_bbp_read(sc, 0);
1846                 if (val != 0 && val != 0xff)
1847                         break;
1848                 DELAY(1000);
1849         }
1850         if (ntries == 100) {
1851                 printf("%s: timeout waiting for BBP\n",
1852                     USBDEVNAME(sc->sc_dev));
1853                 return EIO;
1854         }
1855
1856         /* initialize BBP registers to default values */
1857         for (i = 0; i < N(rum_def_bbp); i++)
1858                 rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1859
1860         /* write vendor-specific BBP values (from EEPROM) */
1861         for (i = 0; i < 16; i++) {
1862                 if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1863                         continue;
1864                 rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1865         }
1866
1867         return 0;
1868 #undef N
1869 }
1870
1871 Static void
1872 rum_init(void *xsc)
1873 {
1874 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1875         struct rum_softc *sc = xsc;
1876         struct ieee80211com *ic = &sc->sc_ic;
1877         struct ifnet *ifp = &ic->ic_if;
1878         struct rum_rx_data *data;
1879         uint32_t tmp;
1880         usbd_status error;
1881         int i, ntries;
1882
1883         ASSERT_SERIALIZED(ifp->if_serializer);
1884
1885         rum_stop(sc);
1886
1887         /* initialize MAC registers to default values */
1888         for (i = 0; i < N(rum_def_mac); i++)
1889                 rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1890
1891         /* set host ready */
1892         rum_write(sc, RT2573_MAC_CSR1, 3);
1893         rum_write(sc, RT2573_MAC_CSR1, 0);
1894
1895         /* wait for BBP/RF to wakeup */
1896         for (ntries = 0; ntries < 1000; ntries++) {
1897                 if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1898                         break;
1899                 rum_write(sc, RT2573_MAC_CSR12, 4);     /* force wakeup */
1900                 DELAY(1000);
1901         }
1902         if (ntries == 1000) {
1903                 printf("%s: timeout waiting for BBP/RF to wakeup\n",
1904                     USBDEVNAME(sc->sc_dev));
1905                 goto fail;
1906         }
1907
1908         if ((error = rum_bbp_init(sc)) != 0)
1909                 goto fail;
1910
1911         /* select default channel */
1912         sc->sc_curchan = ic->ic_curchan = ic->ic_ibss_chan;
1913         rum_select_band(sc, sc->sc_curchan);
1914         rum_select_antenna(sc);
1915         rum_set_chan(sc, sc->sc_curchan);
1916
1917         /* clear STA registers */
1918         rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
1919
1920         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
1921         rum_set_macaddr(sc, ic->ic_myaddr);
1922
1923         /* initialize ASIC */
1924         rum_write(sc, RT2573_MAC_CSR1, 4);
1925
1926         /*
1927          * Allocate xfer for AMRR statistics requests.
1928          */
1929         sc->stats_xfer = usbd_alloc_xfer(sc->sc_udev);
1930         if (sc->stats_xfer == NULL) {
1931                 printf("%s: could not allocate AMRR xfer\n",
1932                     USBDEVNAME(sc->sc_dev));
1933                 goto fail;
1934         }
1935
1936         /*
1937          * Open Tx and Rx USB bulk pipes.
1938          */
1939         error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
1940             &sc->sc_tx_pipeh);
1941         if (error != 0) {
1942                 printf("%s: could not open Tx pipe: %s\n",
1943                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1944                 goto fail;
1945         }
1946
1947         error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
1948             &sc->sc_rx_pipeh);
1949         if (error != 0) {
1950                 printf("%s: could not open Rx pipe: %s\n",
1951                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1952                 goto fail;
1953         }
1954
1955         /*
1956          * Allocate Tx and Rx xfer queues.
1957          */
1958         error = rum_alloc_tx_list(sc);
1959         if (error != 0) {
1960                 printf("%s: could not allocate Tx list\n",
1961                     USBDEVNAME(sc->sc_dev));
1962                 goto fail;
1963         }
1964
1965         error = rum_alloc_rx_list(sc);
1966         if (error != 0) {
1967                 printf("%s: could not allocate Rx list\n",
1968                     USBDEVNAME(sc->sc_dev));
1969                 goto fail;
1970         }
1971
1972         /*
1973          * Start up the receive pipe.
1974          */
1975         for (i = 0; i < RT2573_RX_LIST_COUNT; i++) {
1976                 data = &sc->rx_data[i];
1977
1978                 usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf,
1979                     MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
1980                 usbd_transfer(data->xfer);
1981         }
1982
1983         /* update Rx filter */
1984         tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
1985
1986         tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
1987         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1988                 tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
1989                        RT2573_DROP_ACKCTS;
1990                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1991                         tmp |= RT2573_DROP_TODS;
1992                 if (!(ifp->if_flags & IFF_PROMISC))
1993                         tmp |= RT2573_DROP_NOT_TO_ME;
1994         }
1995         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1996
1997         ifp->if_flags &= ~IFF_OACTIVE;
1998         ifp->if_flags |= IFF_RUNNING;
1999
2000         if (ic->ic_opmode == IEEE80211_M_MONITOR)
2001                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2002         else
2003                 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2004
2005         return;
2006
2007 fail:   rum_stop(sc);
2008
2009 #undef N
2010 }
2011
2012 Static void
2013 rum_stop(struct rum_softc *sc)
2014 {
2015         struct ieee80211com *ic = &sc->sc_ic;
2016         struct ifnet *ifp = &ic->ic_if;
2017         uint32_t tmp;
2018
2019         ASSERT_SERIALIZED(ifp->if_serializer);
2020
2021         sc->sc_tx_timer = 0;
2022         ifp->if_timer = 0;
2023         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2024
2025         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);  /* free all nodes */
2026
2027         /* disable Rx */
2028         tmp = rum_read(sc, RT2573_TXRX_CSR0);
2029         rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2030
2031         /* reset ASIC */
2032         rum_write(sc, RT2573_MAC_CSR1, 3);
2033         rum_write(sc, RT2573_MAC_CSR1, 0);
2034
2035         if (sc->sc_rx_pipeh != NULL) {
2036                 usbd_abort_pipe(sc->sc_rx_pipeh);
2037                 usbd_close_pipe(sc->sc_rx_pipeh);
2038                 sc->sc_rx_pipeh = NULL;
2039         }
2040
2041         if (sc->sc_tx_pipeh != NULL) {
2042                 usbd_abort_pipe(sc->sc_tx_pipeh);
2043                 usbd_close_pipe(sc->sc_tx_pipeh);
2044                 sc->sc_tx_pipeh = NULL;
2045         }
2046
2047         rum_free_rx_list(sc);
2048         rum_free_tx_list(sc);
2049 }
2050
2051 Static int
2052 rum_load_microcode(struct rum_softc *sc, const uint8_t *ucode, size_t size)
2053 {
2054         usb_device_request_t req;
2055         uint16_t reg = RT2573_MCU_CODE_BASE;
2056         usbd_status error;
2057
2058         /* copy firmware image into NIC */
2059         for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2060                 rum_write(sc, reg, UGETDW(ucode));
2061
2062         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2063         req.bRequest = RT2573_MCU_CNTL;
2064         USETW(req.wValue, RT2573_MCU_RUN);
2065         USETW(req.wIndex, 0);
2066         USETW(req.wLength, 0);
2067
2068         error = usbd_do_request(sc->sc_udev, &req, NULL);
2069         if (error != 0) {
2070                 printf("%s: could not run firmware: %s\n",
2071                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2072         }
2073         return error;
2074 }
2075
2076 Static int
2077 rum_prepare_beacon(struct rum_softc *sc)
2078 {
2079         struct ieee80211com *ic = &sc->sc_ic;
2080         struct ieee80211_beacon_offsets bo;
2081         struct rum_tx_desc desc;
2082         struct mbuf *m0;
2083         int rate;
2084
2085         m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
2086         if (m0 == NULL) {
2087                 if_printf(&ic->ic_if, "could not allocate beacon frame\n");
2088                 return ENOBUFS;
2089         }
2090
2091         /* send beacons at the lowest available rate */
2092         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan) ? 12 : 2;
2093
2094         rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2095             m0->m_pkthdr.len, rate);
2096
2097         /* copy the first 24 bytes of Tx descriptor into NIC memory */
2098         rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2099
2100         /* copy beacon header and payload into NIC memory */
2101         rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2102             m0->m_pkthdr.len);
2103
2104         m_freem(m0);
2105
2106         return 0;
2107 }
2108
2109 Static void
2110 rum_stats_timeout(void *arg)
2111 {
2112         struct rum_softc *sc = arg;
2113         struct ifnet *ifp = &sc->sc_ic.ic_if;
2114         usb_device_request_t req;
2115
2116         lwkt_serialize_enter(ifp->if_serializer);
2117
2118         /*
2119          * Asynchronously read statistic registers (cleared by read).
2120          */
2121         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2122         req.bRequest = RT2573_READ_MULTI_MAC;
2123         USETW(req.wValue, 0);
2124         USETW(req.wIndex, RT2573_STA_CSR0);
2125         USETW(req.wLength, sizeof(sc->sta));
2126
2127         usbd_setup_default_xfer(sc->stats_xfer, sc->sc_udev, sc,
2128                                 USBD_DEFAULT_TIMEOUT, &req,
2129                                 sc->sta, sizeof(sc->sta), 0,
2130                                 rum_stats_update);
2131         usbd_transfer(sc->stats_xfer);
2132
2133         lwkt_serialize_exit(ifp->if_serializer);
2134 }
2135
2136 Static void
2137 rum_stats_update(usbd_xfer_handle xfer, usbd_private_handle priv,
2138                  usbd_status status)
2139 {
2140         struct rum_softc *sc = (struct rum_softc *)priv;
2141         struct ifnet *ifp = &sc->sc_ic.ic_if;
2142         struct ieee80211_ratectl_stats *stats = &sc->sc_stats;
2143
2144         if (status != USBD_NORMAL_COMPLETION) {
2145                 printf("%s: could not retrieve Tx statistics - cancelling "
2146                     "automatic rate control\n", USBDEVNAME(sc->sc_dev));
2147                 return;
2148         }
2149
2150         lwkt_serialize_enter(ifp->if_serializer);
2151
2152         /* count TX retry-fail as Tx errors */
2153         ifp->if_oerrors += RUM_TX_PKT_FAIL(sc);
2154
2155         stats->stats_pkt_noretry += RUM_TX_PKT_NO_RETRY(sc);
2156         stats->stats_pkt_ok += RUM_TX_PKT_NO_RETRY(sc) +
2157                                RUM_TX_PKT_ONE_RETRY(sc) +
2158                                RUM_TX_PKT_MULTI_RETRY(sc);
2159         stats->stats_pkt_err += RUM_TX_PKT_FAIL(sc);
2160
2161         stats->stats_short_retries += RUM_TX_PKT_ONE_RETRY(sc);
2162 #if 1
2163         /*
2164          * XXX Estimated average:
2165          * Actual number of retries for each packet should belong to
2166          * [2, RUM_TX_SHORT_RETRY_MAX]
2167          */
2168         stats->stats_short_retries +=
2169                 RUM_TX_PKT_MULTI_RETRY(sc) *
2170                 ((2 + RUM_TX_SHORT_RETRY_MAX) / 2);
2171 #else
2172         stats->stats_short_retries += RUM_TX_PKT_MULTI_RETRY(sc);
2173 #endif
2174         stats->stats_short_retries +=
2175                 RUM_TX_PKT_FAIL(sc) * RUM_TX_SHORT_RETRY_MAX;
2176
2177         callout_reset(&sc->stats_ch, 4 * hz / 5, rum_stats_timeout, sc);
2178
2179         lwkt_serialize_exit(ifp->if_serializer);
2180 }
2181
2182 Static void
2183 rum_stats(struct ieee80211com *ic, struct ieee80211_node *ni __unused,
2184           struct ieee80211_ratectl_stats *stats)
2185 {
2186         struct ifnet *ifp = &ic->ic_if;
2187         struct rum_softc *sc = ifp->if_softc;
2188
2189         ASSERT_SERIALIZED(ifp->if_serializer);
2190
2191         bcopy(&sc->sc_stats, stats, sizeof(*stats));
2192         bzero(&sc->sc_stats, sizeof(sc->sc_stats));
2193 }
2194
2195 Static void
2196 rum_ratectl_change(struct ieee80211com *ic, u_int orc __unused, u_int nrc)
2197 {
2198         struct ieee80211_ratectl_state *st = &ic->ic_ratectl;
2199         struct ieee80211_onoe_param *oparam;
2200
2201         if (st->rc_st_param != NULL) {
2202                 kfree(st->rc_st_param, M_DEVBUF);
2203                 st->rc_st_param = NULL;
2204         }
2205
2206         switch (nrc) {
2207         case IEEE80211_RATECTL_ONOE:
2208                 oparam = kmalloc(sizeof(*oparam), M_DEVBUF, M_INTWAIT);
2209
2210                 IEEE80211_ONOE_PARAM_SETUP(oparam);
2211                 oparam->onoe_raise = 15;
2212
2213                 st->rc_st_param = oparam;
2214                 break;
2215         case IEEE80211_RATECTL_NONE:
2216                 /* This could only happen during detaching */
2217                 break;
2218         default:
2219                 panic("unknown rate control algo %u\n", nrc);
2220         }
2221 }