sys/dev/netif/rum/if_rum.c

   1 /*      $OpenBSD: if_rum.c,v 1.40 2006/09/18 16:20:20 damien Exp $      */
   2 /*      $DragonFly: src/sys/dev/netif/rum/if_rum.c,v 1.9 2007/03/27 13:34:53 sephe Exp $        */
   3
   4 /*-
   5  * Copyright (c) 2005, 2006 Damien Bergamini <damien.bergamini@free.fr>
   6  * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
   7  *
   8  * Permission to use, copy, modify, and distribute this software for any
   9  * purpose with or without fee is hereby granted, provided that the above
  10  * copyright notice and this permission notice appear in all copies.
  11  *
  12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19  */
  20
  21 /*-
  22  * Ralink Technology RT2501USB/RT2601USB chipset driver
  23  * http://www.ralinktech.com/
  24  */
  25
  26 #include <sys/param.h>
  27 #include <sys/bus.h>
  28 #include <sys/endian.h>
  29 #include <sys/kernel.h>
  30 #include <sys/malloc.h>
  31 #include <sys/mbuf.h>
  32 #include <sys/rman.h>
  33 #include <sys/serialize.h>
  34 #include <sys/socket.h>
  35 #include <sys/sockio.h>
  36
  37 #include <net/bpf.h>
  38 #include <net/ethernet.h>
  39 #include <net/if.h>
  40 #include <net/if_arp.h>
  41 #include <net/if_dl.h>
  42 #include <net/if_media.h>
  43 #include <net/ifq_var.h>
  44
  45 #include <netproto/802_11/ieee80211_var.h>
  46 #include <netproto/802_11/ieee80211_radiotap.h>
  47 #include <netproto/802_11/wlan_ratectl/onoe/ieee80211_onoe_param.h>
  48
  49 #include <bus/usb/usb.h>
  50 #include <bus/usb/usbdi.h>
  51 #include <bus/usb/usbdi_util.h>
  52 #include <bus/usb/usbdevs.h>
  53
  54 #include "if_rumreg.h"
  55 #include "if_rumvar.h"
  56 #include "rum_ucode.h"
  57
  58 #ifdef USB_DEBUG
  59 #define RUM_DEBUG
  60 #endif
  61
  62 #ifdef RUM_DEBUG
  63 #define DPRINTF(x)      do { if (rum_debug) logprintf x; } while (0)
  64 #define DPRINTFN(n, x)  do { if (rum_debug >= (n)) logprintf x; } while (0)
  65 int rum_debug = 0;
  66 #else
  67 #define DPRINTF(x)
  68 #define DPRINTFN(n, x)
  69 #endif
  70
  71 /* various supported device vendors/products */
  72 static const struct usb_devno rum_devs[] = {
  73         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_HWU54DM },
  74         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573 },
  75         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573_1 },
  76         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573_2 },
  77         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_WUG2700 },
  78         { USB_VENDOR_AMIT,              USB_PRODUCT_AMIT_CGWLUSB2GO },
  79         { USB_VENDOR_ASUS,              USB_PRODUCT_ASUS_WL167G_2 },
  80         { USB_VENDOR_ASUS,              USB_PRODUCT_ASUS_WL167G_3 },
  81         { USB_VENDOR_BELKIN,            USB_PRODUCT_BELKIN_F5D7050A },
  82         { USB_VENDOR_BELKIN,            USB_PRODUCT_BELKIN_F5D9050V3 },
  83         { USB_VENDOR_LINKSYS4,          USB_PRODUCT_LINKSYS4_WUSB54GC },
  84         { USB_VENDOR_LINKSYS4,          USB_PRODUCT_LINKSYS4_WUSB54GR },
  85         { USB_VENDOR_CONCEPTRONIC,      USB_PRODUCT_CONCEPTRONIC_C54RU2 },
  86         { USB_VENDOR_DICKSMITH,         USB_PRODUCT_DICKSMITH_CWD854F },
  87         { USB_VENDOR_DICKSMITH,         USB_PRODUCT_DICKSMITH_RT2573 },
  88         { USB_VENDOR_DLINK2,            USB_PRODUCT_DLINK2_DWLG122C1 },
  89         { USB_VENDOR_DLINK2,            USB_PRODUCT_DLINK2_WUA1340 },
  90         { USB_VENDOR_GIGABYTE,          USB_PRODUCT_GIGABYTE_GNWB01GS },
  91         { USB_VENDOR_GIGABYTE,          USB_PRODUCT_GIGABYTE_GNWI05GS },
  92         { USB_VENDOR_GIGASET,           USB_PRODUCT_GIGASET_RT2573 },
  93         { USB_VENDOR_GOODWAY,           USB_PRODUCT_GOODWAY_RT2573 },
  94         { USB_VENDOR_GUILLEMOT,         USB_PRODUCT_GUILLEMOT_HWGUSB254LB },
  95         { USB_VENDOR_GUILLEMOT,         USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP },
  96         { USB_VENDOR_HUAWEI3COM,        USB_PRODUCT_HUAWEI3COM_RT2573 },
  97         { USB_VENDOR_MELCO,             USB_PRODUCT_MELCO_G54HP },
  98         { USB_VENDOR_MELCO,             USB_PRODUCT_MELCO_SG54HP },
  99         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573 },
 100         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_1 },
 101         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_2 },
 102         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_3 },
 103         { USB_VENDOR_NOVATECH,          USB_PRODUCT_NOVATECH_RT2573 },
 104         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUS54HP },
 105         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUS54MINI2 },
 106         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUSMM },
 107         { USB_VENDOR_QCOM,              USB_PRODUCT_QCOM_RT2573 },
 108         { USB_VENDOR_QCOM,              USB_PRODUCT_QCOM_RT2573_2 },
 109         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2573 },
 110         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2671 },
 111         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2573_2 },
 112         { USB_VENDOR_SITECOMEU,         USB_PRODUCT_SITECOMEU_WL113R2 },
 113         { USB_VENDOR_SITECOMEU,         USB_PRODUCT_SITECOMEU_WL172 },
 114         { USB_VENDOR_SURECOM,           USB_PRODUCT_SURECOM_RT2573 }
 115 };
 116
 117 #ifdef notyet
 118 Static void             rum_attachhook(void *);
 119 #endif
 120 Static int              rum_alloc_tx_list(struct rum_softc *);
 121 Static void             rum_free_tx_list(struct rum_softc *);
 122 Static int              rum_alloc_rx_list(struct rum_softc *);
 123 Static void             rum_free_rx_list(struct rum_softc *);
 124 Static int              rum_media_change(struct ifnet *);
 125 Static void             rum_next_scan(void *);
 126 Static void             rum_task(void *);
 127 Static int              rum_newstate(struct ieee80211com *,
 128                             enum ieee80211_state, int);
 129 Static void             rum_txeof(usbd_xfer_handle, usbd_private_handle,
 130                             usbd_status);
 131 Static void             rum_rxeof(usbd_xfer_handle, usbd_private_handle,
 132                             usbd_status);
 133 Static uint8_t          rum_rxrate(struct rum_rx_desc *);
 134 Static uint16_t         rum_txtime(int, int, uint32_t);
 135 Static uint8_t          rum_plcp_signal(int);
 136 Static void             rum_setup_tx_desc(struct rum_softc *,
 137                             struct rum_tx_desc *, uint32_t, uint16_t, int,
 138                             int);
 139 Static int              rum_tx_data(struct rum_softc *, struct mbuf *,
 140                             struct ieee80211_node *);
 141 Static void             rum_start(struct ifnet *);
 142 Static void             rum_watchdog(struct ifnet *);
 143 Static int              rum_ioctl(struct ifnet *, u_long, caddr_t,
 144                                   struct ucred *);
 145 Static void             rum_eeprom_read(struct rum_softc *, uint16_t, void *,
 146                             int);
 147 Static uint32_t         rum_read(struct rum_softc *, uint16_t);
 148 Static void             rum_read_multi(struct rum_softc *, uint16_t, void *,
 149                             int);
 150 Static void             rum_write(struct rum_softc *, uint16_t, uint32_t);
 151 Static void             rum_write_multi(struct rum_softc *, uint16_t, void *,
 152                             size_t);
 153 Static void             rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
 154 Static uint8_t          rum_bbp_read(struct rum_softc *, uint8_t);
 155 Static void             rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
 156 Static void             rum_select_antenna(struct rum_softc *);
 157 Static void             rum_enable_mrr(struct rum_softc *);
 158 Static void             rum_set_txpreamble(struct rum_softc *);
 159 Static void             rum_set_basicrates(struct rum_softc *);
 160 Static void             rum_select_band(struct rum_softc *,
 161                             struct ieee80211_channel *);
 162 Static void             rum_set_chan(struct rum_softc *,
 163                             struct ieee80211_channel *);
 164 Static void             rum_enable_tsf_sync(struct rum_softc *);
 165 Static void             rum_update_slot(struct rum_softc *);
 166 Static void             rum_set_bssid(struct rum_softc *, const uint8_t *);
 167 Static void             rum_set_macaddr(struct rum_softc *, const uint8_t *);
 168 Static void             rum_update_promisc(struct rum_softc *);
 169 Static const char       *rum_get_rf(int);
 170 Static void             rum_read_eeprom(struct rum_softc *);
 171 Static int              rum_bbp_init(struct rum_softc *);
 172 Static void             rum_init(void *);
 173 Static void             rum_stop(struct rum_softc *);
 174 Static int              rum_load_microcode(struct rum_softc *, const uint8_t *,
 175                             size_t);
 176 Static int              rum_prepare_beacon(struct rum_softc *);
 177
 178 Static void             rum_stats_timeout(void *);
 179 Static void             rum_stats_update(usbd_xfer_handle, usbd_private_handle,
 180                                          usbd_status);
 181 Static void             rum_stats(struct ieee80211com *,
 182                                   struct ieee80211_node *,
 183                                   struct ieee80211_ratectl_stats *);
 184 Static void             rum_ratectl_change(struct ieee80211com *ic, u_int,
 185                                            u_int);
 186 Static int              rum_get_rssi(struct rum_softc *, uint8_t);
 187
 188 /*
 189  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
 190  */
 191 static const struct ieee80211_rateset rum_rateset_11a =
 192         { 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
 193
 194 static const struct ieee80211_rateset rum_rateset_11b =
 195         { 4, { 2, 4, 11, 22 } };
 196
 197 static const struct ieee80211_rateset rum_rateset_11g =
 198         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
 199
 200 static const struct {
 201         uint32_t        reg;
 202         uint32_t        val;
 203 } rum_def_mac[] = {
 204         RT2573_DEF_MAC
 205 };
 206
 207 static const struct {
 208         uint8_t reg;
 209         uint8_t val;
 210 } rum_def_bbp[] = {
 211         RT2573_DEF_BBP
 212 };
 213
 214 static const struct rfprog {
 215         uint8_t         chan;
 216         uint32_t        r1, r2, r3, r4;
 217 }  rum_rf5226[] = {
 218         RT2573_RF5226
 219 }, rum_rf5225[] = {
 220         RT2573_RF5225
 221 };
 222
 223 USB_DECLARE_DRIVER(rum);
 224 DRIVER_MODULE(rum, uhub, rum_driver, rum_devclass, usbd_driver_load, 0);
 225
 226 USB_MATCH(rum)
 227 {
 228         USB_MATCH_START(rum, uaa);
 229
 230         if (uaa->iface != NULL)
 231                 return UMATCH_NONE;
 232
 233         return (usb_lookup(rum_devs, uaa->vendor, uaa->product) != NULL) ?
 234             UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
 235 }
 236
 237 USB_ATTACH(rum)
 238 {
 239         USB_ATTACH_START(rum, sc, uaa);
 240         struct ieee80211com *ic = &sc->sc_ic;
 241         struct ifnet *ifp = &ic->ic_if;
 242         usb_interface_descriptor_t *id;
 243         usb_endpoint_descriptor_t *ed;
 244         usbd_status error;
 245         char devinfo[1024];
 246         int i, ntries;
 247         uint32_t tmp;
 248
 249         sc->sc_udev = uaa->device;
 250
 251         usbd_devinfo(uaa->device, 0, devinfo);
 252         USB_ATTACH_SETUP;
 253
 254         if (usbd_set_config_no(sc->sc_udev, RT2573_CONFIG_NO, 0) != 0) {
 255                 kprintf("%s: could not set configuration no\n",
 256                     USBDEVNAME(sc->sc_dev));
 257                 USB_ATTACH_ERROR_RETURN;
 258         }
 259
 260         /* get the first interface handle */
 261         error = usbd_device2interface_handle(sc->sc_udev, RT2573_IFACE_INDEX,
 262             &sc->sc_iface);
 263         if (error != 0) {
 264                 kprintf("%s: could not get interface handle\n",
 265                     USBDEVNAME(sc->sc_dev));
 266                 USB_ATTACH_ERROR_RETURN;
 267         }
 268
 269         /*
 270          * Find endpoints.
 271          */
 272         id = usbd_get_interface_descriptor(sc->sc_iface);
 273
 274         sc->sc_rx_no = sc->sc_tx_no = -1;
 275         for (i = 0; i < id->bNumEndpoints; i++) {
 276                 ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
 277                 if (ed == NULL) {
 278                         kprintf("%s: no endpoint descriptor for iface %d\n",
 279                             USBDEVNAME(sc->sc_dev), i);
 280                         USB_ATTACH_ERROR_RETURN;
 281                 }
 282
 283                 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
 284                     UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
 285                         sc->sc_rx_no = ed->bEndpointAddress;
 286                 else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
 287                     UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
 288                         sc->sc_tx_no = ed->bEndpointAddress;
 289         }
 290         if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
 291                 kprintf("%s: missing endpoint\n", USBDEVNAME(sc->sc_dev));
 292                 USB_ATTACH_ERROR_RETURN;
 293         }
 294
 295         usb_init_task(&sc->sc_task, rum_task, sc);
 296
 297         callout_init(&sc->scan_ch);
 298         callout_init(&sc->stats_ch);
 299
 300         /* retrieve RT2573 rev. no */
 301         for (ntries = 0; ntries < 1000; ntries++) {
 302                 if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
 303                         break;
 304                 DELAY(1000);
 305         }
 306         if (ntries == 1000) {
 307                 kprintf("%s: timeout waiting for chip to settle\n",
 308                     USBDEVNAME(sc->sc_dev));
 309                 USB_ATTACH_ERROR_RETURN;
 310         }
 311
 312         /* retrieve MAC address and various other things from EEPROM */
 313         rum_read_eeprom(sc);
 314
 315         kprintf("%s: MAC/BBP RT%04x (rev 0x%05x), RF %s, address %6D\n",
 316             USBDEVNAME(sc->sc_dev), sc->macbbp_rev, tmp,
 317             rum_get_rf(sc->rf_rev), ic->ic_myaddr, ":");
 318
 319         error = rum_load_microcode(sc, rt2573, sizeof(rt2573));
 320         if (error != 0) {
 321                 device_printf(self, "can't load microcode\n");
 322                 USB_ATTACH_ERROR_RETURN;
 323         }
 324
 325         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 326         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 327         ic->ic_state = IEEE80211_S_INIT;
 328
 329         /* set device capabilities */
 330         ic->ic_caps =
 331             IEEE80211_C_IBSS |          /* IBSS mode supported */
 332             IEEE80211_C_MONITOR |       /* monitor mode supported */
 333             IEEE80211_C_HOSTAP |        /* HostAp mode supported */
 334             IEEE80211_C_TXPMGT |        /* tx power management */
 335             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 336             IEEE80211_C_SHSLOT |        /* short slot time supported */
 337             IEEE80211_C_WPA;            /* WPA 1+2 */
 338
 339         if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
 340                 /* set supported .11a rates */
 341                 ic->ic_sup_rates[IEEE80211_MODE_11A] = rum_rateset_11a;
 342
 343                 /* set supported .11a channels */
 344                 for (i = 34; i <= 46; i += 4) {
 345                         ic->ic_channels[i].ic_freq =
 346                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 347                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 348                 }
 349                 for (i = 36; i <= 64; i += 4) {
 350                         ic->ic_channels[i].ic_freq =
 351                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 352                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 353                 }
 354                 for (i = 100; i <= 140; i += 4) {
 355                         ic->ic_channels[i].ic_freq =
 356                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 357                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 358                 }
 359                 for (i = 149; i <= 165; i += 4) {
 360                         ic->ic_channels[i].ic_freq =
 361                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 362                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 363                 }
 364         }
 365
 366         /* set supported .11b and .11g rates */
 367         ic->ic_sup_rates[IEEE80211_MODE_11B] = rum_rateset_11b;
 368         ic->ic_sup_rates[IEEE80211_MODE_11G] = rum_rateset_11g;
 369
 370         /* set supported .11b and .11g channels (1 through 14) */
 371         for (i = 1; i <= 14; i++) {
 372                 ic->ic_channels[i].ic_freq =
 373                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 374                 ic->ic_channels[i].ic_flags =
 375                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
 376                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
 377         }
 378
 379         if_initname(ifp, device_get_name(self), device_get_unit(self));
 380         ifp->if_softc = sc;
 381         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 382         ifp->if_init = rum_init;
 383         ifp->if_ioctl = rum_ioctl;
 384         ifp->if_start = rum_start;
 385         ifp->if_watchdog = rum_watchdog;
 386         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
 387         ifq_set_ready(&ifp->if_snd);
 388
 389         ic->ic_ratectl.rc_st_ratectl_cap = IEEE80211_RATECTL_CAP_ONOE;
 390         ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_ONOE;
 391         ic->ic_ratectl.rc_st_valid_stats =
 392                 IEEE80211_RATECTL_STATS_PKT_NORETRY |
 393                 IEEE80211_RATECTL_STATS_PKT_OK |
 394                 IEEE80211_RATECTL_STATS_PKT_ERR |
 395                 IEEE80211_RATECTL_STATS_RETRIES;
 396         ic->ic_ratectl.rc_st_stats = rum_stats;
 397         ic->ic_ratectl.rc_st_change = rum_ratectl_change;
 398
 399         ieee80211_ifattach(ic);
 400
 401         /* Enable software beacon missing handling. */
 402         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 403
 404         /* override state transition machine */
 405         sc->sc_newstate = ic->ic_newstate;
 406         ic->ic_newstate = rum_newstate;
 407         ieee80211_media_init(ic, rum_media_change, ieee80211_media_status);
 408
 409         bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
 410             sizeof(struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
 411             &sc->sc_drvbpf);
 412
 413         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 414         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 415         sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
 416
 417         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 418         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 419         sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
 420
 421         if (bootverbose)
 422                 ieee80211_announce(ic);
 423
 424         USB_ATTACH_SUCCESS_RETURN;
 425 }
 426
 427 USB_DETACH(rum)
 428 {
 429         USB_DETACH_START(rum, sc);
 430         struct ifnet *ifp = &sc->sc_ic.ic_if;
 431
 432 #ifdef spl
 433         s = splusb();
 434 #endif
 435
 436         lwkt_serialize_enter(ifp->if_serializer);
 437
 438         callout_stop(&sc->scan_ch);
 439         callout_stop(&sc->stats_ch);
 440
 441         sc->sc_flags |= RUM_FLAG_SYNCTASK;
 442         rum_stop(sc);
 443
 444         lwkt_serialize_exit(ifp->if_serializer);
 445
 446         usb_rem_task(sc->sc_udev, &sc->sc_task);
 447
 448         bpfdetach(ifp);
 449         ieee80211_ifdetach(&sc->sc_ic); /* free all nodes */
 450
 451         if (sc->stats_xfer != NULL) {
 452                 usbd_free_xfer(sc->stats_xfer);
 453                 sc->stats_xfer = NULL;
 454         }
 455
 456         if (sc->sc_rx_pipeh != NULL) {
 457                 usbd_abort_pipe(sc->sc_rx_pipeh);
 458                 usbd_close_pipe(sc->sc_rx_pipeh);
 459         }
 460
 461         if (sc->sc_tx_pipeh != NULL) {
 462                 usbd_abort_pipe(sc->sc_tx_pipeh);
 463                 usbd_close_pipe(sc->sc_tx_pipeh);
 464         }
 465
 466         rum_free_rx_list(sc);
 467         rum_free_tx_list(sc);
 468
 469 #ifdef spl
 470         splx(s);
 471 #endif
 472         return 0;
 473 }
 474
 475 Static int
 476 rum_alloc_tx_list(struct rum_softc *sc)
 477 {
 478         struct rum_tx_data *data;
 479         int i, error;
 480
 481         sc->tx_queued = 0;
 482
 483         for (i = 0; i < RT2573_TX_LIST_COUNT; i++) {
 484                 data = &sc->tx_data[i];
 485
 486                 data->sc = sc;
 487
 488                 data->xfer = usbd_alloc_xfer(sc->sc_udev);
 489                 if (data->xfer == NULL) {
 490                         kprintf("%s: could not allocate tx xfer\n",
 491                             USBDEVNAME(sc->sc_dev));
 492                         error = ENOMEM;
 493                         goto fail;
 494                 }
 495
 496                 data->buf = usbd_alloc_buffer(data->xfer,
 497                     RT2573_TX_DESC_SIZE + IEEE80211_MAX_LEN);
 498                 if (data->buf == NULL) {
 499                         kprintf("%s: could not allocate tx buffer\n",
 500                             USBDEVNAME(sc->sc_dev));
 501                         error = ENOMEM;
 502                         goto fail;
 503                 }
 504
 505                 /* clean Tx descriptor */
 506                 bzero(data->buf, RT2573_TX_DESC_SIZE);
 507         }
 508
 509         return 0;
 510
 511 fail:   rum_free_tx_list(sc);
 512         return error;
 513 }
 514
 515 Static void
 516 rum_free_tx_list(struct rum_softc *sc)
 517 {
 518         struct rum_tx_data *data;
 519         int i;
 520
 521         for (i = 0; i < RT2573_TX_LIST_COUNT; i++) {
 522                 data = &sc->tx_data[i];
 523
 524                 if (data->xfer != NULL) {
 525                         usbd_free_xfer(data->xfer);
 526                         data->xfer = NULL;
 527                 }
 528
 529                 if (data->ni != NULL) {
 530                         ieee80211_free_node(data->ni);
 531                         data->ni = NULL;
 532                 }
 533         }
 534 }
 535
 536 Static int
 537 rum_alloc_rx_list(struct rum_softc *sc)
 538 {
 539         struct rum_rx_data *data;
 540         int i, error;
 541
 542         for (i = 0; i < RT2573_RX_LIST_COUNT; i++) {
 543                 data = &sc->rx_data[i];
 544
 545                 data->sc = sc;
 546
 547                 data->xfer = usbd_alloc_xfer(sc->sc_udev);
 548                 if (data->xfer == NULL) {
 549                         kprintf("%s: could not allocate rx xfer\n",
 550                             USBDEVNAME(sc->sc_dev));
 551                         error = ENOMEM;
 552                         goto fail;
 553                 }
 554
 555                 if (usbd_alloc_buffer(data->xfer, MCLBYTES) == NULL) {
 556                         kprintf("%s: could not allocate rx buffer\n",
 557                             USBDEVNAME(sc->sc_dev));
 558                         error = ENOMEM;
 559                         goto fail;
 560                 }
 561
 562                 data->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 563                 if (data->m == NULL) {
 564                         kprintf("%s: could not allocate rx mbuf\n",
 565                             USBDEVNAME(sc->sc_dev));
 566                         error = ENOMEM;
 567                         goto fail;
 568                 }
 569
 570                 data->buf = mtod(data->m, uint8_t *);
 571                 bzero(data->buf, sizeof(struct rum_rx_desc));
 572         }
 573
 574         return 0;
 575
 576 fail:   rum_free_tx_list(sc);
 577         return error;
 578 }
 579
 580 Static void
 581 rum_free_rx_list(struct rum_softc *sc)
 582 {
 583         struct rum_rx_data *data;
 584         int i;
 585
 586         for (i = 0; i < RT2573_RX_LIST_COUNT; i++) {
 587                 data = &sc->rx_data[i];
 588
 589                 if (data->xfer != NULL) {
 590                         usbd_free_xfer(data->xfer);
 591                         data->xfer = NULL;
 592                 }
 593
 594                 if (data->m != NULL) {
 595                         m_freem(data->m);
 596                         data->m = NULL;
 597                 }
 598         }
 599 }
 600
 601 Static int
 602 rum_media_change(struct ifnet *ifp)
 603 {
 604         int error;
 605
 606         error = ieee80211_media_change(ifp);
 607         if (error != ENETRESET)
 608                 return error;
 609
 610         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
 611                 rum_init(ifp->if_softc);
 612
 613         return 0;
 614 }
 615
 616 /*
 617  * This function is called periodically (every 200ms) during scanning to
 618  * switch from one channel to another.
 619  */
 620 Static void
 621 rum_next_scan(void *arg)
 622 {
 623         struct rum_softc *sc = arg;
 624         struct ieee80211com *ic = &sc->sc_ic;
 625         struct ifnet *ifp = &ic->ic_if;
 626
 627         lwkt_serialize_enter(ifp->if_serializer);
 628
 629         if (ic->ic_state == IEEE80211_S_SCAN)
 630                 ieee80211_next_scan(ic);
 631
 632         lwkt_serialize_exit(ifp->if_serializer);
 633 }
 634
 635 Static void
 636 rum_task(void *arg)
 637 {
 638         struct rum_softc *sc = arg;
 639         struct ieee80211com *ic = &sc->sc_ic;
 640         struct ifnet *ifp = &ic->ic_if;
 641         enum ieee80211_state ostate;
 642         struct ieee80211_node *ni;
 643         uint32_t tmp;
 644
 645         lwkt_serialize_enter(ifp->if_serializer);
 646
 647         ieee80211_ratectl_newstate(ic, sc->sc_state);
 648
 649         ostate = ic->ic_state;
 650
 651         switch (sc->sc_state) {
 652         case IEEE80211_S_INIT:
 653                 if (ostate == IEEE80211_S_RUN) {
 654                         /* abort TSF synchronization */
 655                         tmp = rum_read(sc, RT2573_TXRX_CSR9);
 656                         rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
 657                 }
 658                 break;
 659
 660         case IEEE80211_S_SCAN:
 661                 rum_set_chan(sc, ic->ic_curchan);
 662                 callout_reset(&sc->scan_ch, hz / 5, rum_next_scan, sc);
 663                 break;
 664
 665         case IEEE80211_S_AUTH:
 666                 rum_set_chan(sc, ic->ic_curchan);
 667                 break;
 668
 669         case IEEE80211_S_ASSOC:
 670                 rum_set_chan(sc, ic->ic_curchan);
 671                 break;
 672
 673         case IEEE80211_S_RUN:
 674                 rum_set_chan(sc, ic->ic_curchan);
 675
 676                 ni = ic->ic_bss;
 677
 678                 lwkt_serialize_exit(ifp->if_serializer);
 679
 680                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 681                         rum_update_slot(sc);
 682                         rum_enable_mrr(sc);
 683                         rum_set_txpreamble(sc);
 684                         rum_set_basicrates(sc);
 685                         rum_set_bssid(sc, ni->ni_bssid);
 686                 }
 687
 688                 if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
 689                     ic->ic_opmode == IEEE80211_M_IBSS)
 690                         rum_prepare_beacon(sc);
 691
 692                 if (ic->ic_opmode != IEEE80211_M_MONITOR)
 693                         rum_enable_tsf_sync(sc);
 694
 695                 /* clear statistic registers (STA_CSR0 to STA_CSR5) */
 696                 rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof(sc->sta));
 697
 698                 lwkt_serialize_enter(ifp->if_serializer);
 699
 700                 callout_reset(&sc->stats_ch, 4 * hz / 5, rum_stats_timeout, sc);
 701
 702                 break;
 703         }
 704
 705         sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
 706
 707         lwkt_serialize_exit(ifp->if_serializer);
 708 }
 709
 710 Static int
 711 rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 712 {
 713         struct rum_softc *sc = ic->ic_if.if_softc;
 714         struct ifnet *ifp = &ic->ic_if;
 715
 716         ASSERT_SERIALIZED(ifp->if_serializer);
 717
 718         callout_stop(&sc->scan_ch);
 719         callout_stop(&sc->stats_ch);
 720
 721         /* do it in a process context */
 722         sc->sc_state = nstate;
 723         sc->sc_arg = arg;
 724
 725         lwkt_serialize_exit(ifp->if_serializer);
 726         usb_rem_task(sc->sc_udev, &sc->sc_task);
 727
 728         if (sc->sc_flags & RUM_FLAG_SYNCTASK) {
 729                 usb_do_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER,
 730                             USBD_NO_TIMEOUT);
 731         } else {
 732                 usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
 733         }
 734         lwkt_serialize_enter(ifp->if_serializer);
 735
 736         return 0;
 737 }
 738
 739 /* quickly determine if a given rate is CCK or OFDM */
 740 #define RUM_RATE_IS_OFDM(rate)  ((rate) >= 12 && (rate) != 22)
 741
 742 #define RUM_ACK_SIZE    14      /* 10 + 4(FCS) */
 743 #define RUM_CTS_SIZE    14      /* 10 + 4(FCS) */
 744
 745 Static void
 746 rum_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 747 {
 748         struct rum_tx_data *data = priv;
 749         struct rum_softc *sc = data->sc;
 750         struct ieee80211com *ic = &sc->sc_ic;
 751         struct ifnet *ifp = &ic->ic_if;
 752
 753         if (status != USBD_NORMAL_COMPLETION) {
 754                 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
 755                         return;
 756
 757                 kprintf("%s: could not transmit buffer: %s\n",
 758                     USBDEVNAME(sc->sc_dev), usbd_errstr(status));
 759
 760                 if (status == USBD_STALLED)
 761                         usbd_clear_endpoint_stall_async(sc->sc_tx_pipeh);
 762
 763                 ifp->if_oerrors++;
 764                 return;
 765         }
 766
 767 #ifdef spl
 768         s = splnet();
 769 #endif
 770
 771         lwkt_serialize_enter(ifp->if_serializer);
 772
 773         m_freem(data->m);
 774         data->m = NULL;
 775         ieee80211_free_node(data->ni);
 776         data->ni = NULL;
 777
 778         bzero(data->buf, sizeof(struct rum_tx_data));
 779         sc->tx_queued--;
 780         ifp->if_opackets++;
 781
 782         DPRINTFN(10, ("tx done\n"));
 783
 784         sc->sc_tx_timer = 0;
 785         ifp->if_flags &= ~IFF_OACTIVE;
 786         rum_start(ifp);
 787
 788         lwkt_serialize_exit(ifp->if_serializer);
 789
 790 #ifdef spl
 791         splx(s);
 792 #endif
 793 }
 794
 795 Static void
 796 rum_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 797 {
 798         struct rum_rx_data *data = priv;
 799         struct rum_softc *sc = data->sc;
 800         struct ieee80211com *ic = &sc->sc_ic;
 801         struct ifnet *ifp = &ic->ic_if;
 802         struct rum_rx_desc *desc;
 803         struct ieee80211_frame_min *wh;
 804         struct ieee80211_node *ni;
 805         struct mbuf *mnew, *m;
 806         int len, rssi;
 807
 808         if (status != USBD_NORMAL_COMPLETION) {
 809                 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
 810                         return;
 811
 812                 if (status == USBD_STALLED)
 813                         usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
 814                 goto skip;
 815         }
 816
 817         usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
 818
 819         if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
 820                 DPRINTF(("%s: xfer too short %d\n", USBDEVNAME(sc->sc_dev),
 821                     len));
 822                 ifp->if_ierrors++;
 823                 goto skip;
 824         }
 825
 826         desc = (struct rum_rx_desc *)data->buf;
 827
 828         if (le32toh(desc->flags) & RT2573_RX_CRC_ERROR) {
 829                 /*
 830                  * This should not happen since we did not request to receive
 831                  * those frames when we filled RT2573_TXRX_CSR0.
 832                  */
 833                 DPRINTFN(5, ("CRC error\n"));
 834                 ifp->if_ierrors++;
 835                 goto skip;
 836         }
 837
 838         mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 839         if (mnew == NULL) {
 840                 kprintf("%s: could not allocate rx mbuf\n",
 841                     USBDEVNAME(sc->sc_dev));
 842                 ifp->if_ierrors++;
 843                 goto skip;
 844         }
 845
 846         m = data->m;
 847         data->m = mnew;
 848         data->buf = mtod(data->m, uint8_t *);
 849
 850         /* finalize mbuf */
 851         m->m_pkthdr.rcvif = ifp;
 852         m->m_data = (caddr_t)(desc + 1);
 853         m->m_pkthdr.len = m->m_len = (le32toh(desc->flags) >> 16) & 0xfff;
 854
 855 #ifdef spl
 856         s = splnet();
 857 #endif
 858
 859         lwkt_serialize_enter(ifp->if_serializer);
 860
 861         rssi = rum_get_rssi(sc, desc->rssi);
 862
 863         wh = mtod(m, struct ieee80211_frame_min *);
 864         ni = ieee80211_find_rxnode(ic, wh);
 865
 866         /* Error happened during RSSI conversion. */
 867         if (rssi < 0)
 868                 rssi = ni->ni_rssi;
 869
 870         if (sc->sc_drvbpf != NULL) {
 871                 struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
 872
 873                 tap->wr_flags = 0;
 874                 tap->wr_rate = rum_rxrate(desc);
 875                 tap->wr_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
 876                 tap->wr_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
 877                 tap->wr_antenna = sc->rx_ant;
 878                 tap->wr_antsignal = rssi;
 879
 880                 bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
 881         }
 882
 883         /* send the frame to the 802.11 layer */
 884         ieee80211_input(ic, m, ni, rssi, 0);
 885
 886         /* node is no longer needed */
 887         ieee80211_free_node(ni);
 888
 889         /*
 890          * In HostAP mode, ieee80211_input() will enqueue packets in if_snd
 891          * without calling if_start().
 892          */
 893         if (!ifq_is_empty(&ifp->if_snd) && !(ifp->if_flags & IFF_OACTIVE))
 894                 rum_start(ifp);
 895
 896 #ifdef spl
 897         splx(s);
 898 #endif
 899
 900         lwkt_serialize_exit(ifp->if_serializer);
 901
 902         DPRINTFN(15, ("rx done\n"));
 903
 904 skip:   /* setup a new transfer */
 905         bzero(data->buf, sizeof(struct rum_rx_desc));
 906         usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data, data->buf, MCLBYTES,
 907             USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
 908         usbd_transfer(xfer);
 909 }
 910
 911 /*
 912  * This function is only used by the Rx radiotap code. It returns the rate at
 913  * which a given frame was received.
 914  */
 915 Static uint8_t
 916 rum_rxrate(struct rum_rx_desc *desc)
 917 {
 918         if (le32toh(desc->flags) & RT2573_RX_OFDM) {
 919                 /* reverse function of rum_plcp_signal */
 920                 switch (desc->rate) {
 921                 case 0xb:       return 12;
 922                 case 0xf:       return 18;
 923                 case 0xa:       return 24;
 924                 case 0xe:       return 36;
 925                 case 0x9:       return 48;
 926                 case 0xd:       return 72;
 927                 case 0x8:       return 96;
 928                 case 0xc:       return 108;
 929                 }
 930         } else {
 931                 if (desc->rate == 10)
 932                         return 2;
 933                 if (desc->rate == 20)
 934                         return 4;
 935                 if (desc->rate == 55)
 936                         return 11;
 937                 if (desc->rate == 110)
 938                         return 22;
 939         }
 940         return 2;       /* should not get there */
 941 }
 942
 943 /*
 944  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
 945  * The function automatically determines the operating mode depending on the
 946  * given rate. `flags' indicates whether short preamble is in use or not.
 947  */
 948 Static uint16_t
 949 rum_txtime(int len, int rate, uint32_t flags)
 950 {
 951         uint16_t txtime;
 952
 953         if (RUM_RATE_IS_OFDM(rate)) {
 954                 /* IEEE Std 802.11a-1999, pp. 37 */
 955                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
 956                 txtime = 16 + 4 + 4 * txtime + 6;
 957         } else {
 958                 /* IEEE Std 802.11b-1999, pp. 28 */
 959                 txtime = (16 * len + rate - 1) / rate;
 960                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
 961                         txtime +=  72 + 24;
 962                 else
 963                         txtime += 144 + 48;
 964         }
 965         return txtime;
 966 }
 967
 968 Static uint8_t
 969 rum_plcp_signal(int rate)
 970 {
 971         switch (rate) {
 972         /* CCK rates (returned values are device-dependent) */
 973         case 2:         return 0x0;
 974         case 4:         return 0x1;
 975         case 11:        return 0x2;
 976         case 22:        return 0x3;
 977
 978         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 979         case 12:        return 0xb;
 980         case 18:        return 0xf;
 981         case 24:        return 0xa;
 982         case 36:        return 0xe;
 983         case 48:        return 0x9;
 984         case 72:        return 0xd;
 985         case 96:        return 0x8;
 986         case 108:       return 0xc;
 987
 988         /* unsupported rates (should not get there) */
 989         default:        return 0xff;
 990         }
 991 }
 992
 993 Static void
 994 rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
 995     uint32_t flags, uint16_t xflags, int len, int rate)
 996 {
 997         struct ieee80211com *ic = &sc->sc_ic;
 998         uint16_t plcp_length;
 999         int remainder;
1000
1001         desc->flags = htole32(flags);
1002         desc->flags |= htole32(len << 16);
1003
1004         desc->xflags = htole16(xflags);
1005
1006         desc->wme = htole16(
1007             RT2573_QID(0) |
1008             RT2573_AIFSN(2) |
1009             RT2573_LOGCWMIN(4) |
1010             RT2573_LOGCWMAX(10));
1011
1012         /* setup PLCP fields */
1013         desc->plcp_signal  = rum_plcp_signal(rate);
1014         desc->plcp_service = 4;
1015
1016         len += IEEE80211_CRC_LEN;
1017         if (RUM_RATE_IS_OFDM(rate)) {
1018                 desc->flags |= htole32(RT2573_TX_OFDM);
1019
1020                 plcp_length = len & 0xfff;
1021                 desc->plcp_length_hi = plcp_length >> 6;
1022                 desc->plcp_length_lo = plcp_length & 0x3f;
1023         } else {
1024                 plcp_length = (16 * len + rate - 1) / rate;
1025                 if (rate == 22) {
1026                         remainder = (16 * len) % 22;
1027                         if (remainder != 0 && remainder < 7)
1028                                 desc->plcp_service |= RT2573_PLCP_LENGEXT;
1029                 }
1030                 desc->plcp_length_hi = plcp_length >> 8;
1031                 desc->plcp_length_lo = plcp_length & 0xff;
1032
1033                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1034                         desc->plcp_signal |= 0x08;
1035         }
1036         desc->flags |= htole32(RT2573_TX_VALID);
1037 }
1038
1039 #define RUM_TX_TIMEOUT  5000
1040
1041 Static int
1042 rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1043 {
1044         struct ieee80211com *ic = &sc->sc_ic;
1045         struct rum_tx_desc *desc;
1046         struct rum_tx_data *data;
1047         struct ieee80211_frame *wh;
1048         uint32_t flags = 0;
1049         uint16_t dur;
1050         usbd_status error;
1051         int xferlen, rate;
1052
1053         wh = mtod(m0, struct ieee80211_frame *);
1054
1055         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1056                 if (ieee80211_crypto_encap(ic, ni, m0) == NULL) {
1057                         m_freem(m0);
1058                         return ENOBUFS;
1059                 }
1060
1061                 /* packet header may have moved, reset our local pointer */
1062                 wh = mtod(m0, struct ieee80211_frame *);
1063         }
1064
1065         /* pickup a rate */
1066         if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
1067             IEEE80211_FC0_TYPE_MGT) {
1068                 /* mgmt frames are sent at the lowest available bit-rate */
1069                 rate = ni->ni_rates.rs_rates[0];
1070         } else {
1071                 if (ic->ic_fixed_rate != -1) {
1072                         rate = ic->ic_sup_rates[ic->ic_curmode].
1073                             rs_rates[ic->ic_fixed_rate];
1074                 } else
1075                         rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1076         }
1077         rate &= IEEE80211_RATE_VAL;
1078         if (rate == 0)
1079                 rate = 2;       /* fallback to 1Mbps; should not happen  */
1080
1081         data = &sc->tx_data[0];
1082         desc = (struct rum_tx_desc *)data->buf;
1083
1084         data->m = m0;
1085         data->ni = ni;
1086
1087         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1088                 flags |= RT2573_TX_ACK;
1089
1090                 dur = rum_txtime(RUM_ACK_SIZE, ieee80211_ack_rate(ni, rate),
1091                     ic->ic_flags) + sc->sifs;
1092                 *(uint16_t *)wh->i_dur = htole16(dur);
1093
1094                 /* tell hardware to set timestamp in probe responses */
1095                 if ((wh->i_fc[0] &
1096                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1097                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1098                         flags |= RT2573_TX_TIMESTAMP;
1099         }
1100
1101         if (sc->sc_drvbpf != NULL) {
1102                 struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1103
1104                 tap->wt_flags = 0;
1105                 tap->wt_rate = rate;
1106                 tap->wt_chan_freq = htole16(ic->ic_bss->ni_chan->ic_freq);
1107                 tap->wt_chan_flags = htole16(ic->ic_bss->ni_chan->ic_flags);
1108                 tap->wt_antenna = sc->tx_ant;
1109
1110                 bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1111         }
1112
1113         m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1114         rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1115
1116         /* align end on a 4-bytes boundary */
1117         xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1118
1119         /*
1120          * No space left in the last URB to store the extra 4 bytes, force
1121          * sending of another URB.
1122          */
1123         if ((xferlen % 64) == 0)
1124                 xferlen += 4;
1125
1126         DPRINTFN(10, ("sending frame len=%u rate=%u xfer len=%u\n",
1127             m0->m_pkthdr.len + RT2573_TX_DESC_SIZE, rate, xferlen));
1128
1129         usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1130             USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1131
1132         error = usbd_transfer(data->xfer);
1133         if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1134                 m_freem(m0);
1135                 return error;
1136         }
1137
1138         sc->tx_queued++;
1139
1140         return 0;
1141 }
1142
1143 Static void
1144 rum_start(struct ifnet *ifp)
1145 {
1146         struct rum_softc *sc = ifp->if_softc;
1147         struct ieee80211com *ic = &sc->sc_ic;
1148         struct ieee80211_node *ni;
1149         struct mbuf *m0;
1150
1151         ASSERT_SERIALIZED(ifp->if_serializer);
1152
1153         /*
1154          * net80211 may still try to send management frames even if the
1155          * IFF_RUNNING flag is not set...
1156          */
1157         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1158                 return;
1159
1160         for (;;) {
1161                 if (!IF_QEMPTY(&ic->ic_mgtq)) {
1162                         if (sc->tx_queued >= RT2573_TX_LIST_COUNT) {
1163                                 ifp->if_flags |= IFF_OACTIVE;
1164                                 break;
1165                         }
1166                         IF_DEQUEUE(&ic->ic_mgtq, m0);
1167
1168                         ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1169                         m0->m_pkthdr.rcvif = NULL;
1170
1171                         BPF_MTAP(ifp, m0);
1172
1173                         if (rum_tx_data(sc, m0, ni) != 0)
1174                                 break;
1175
1176                 } else {
1177                         struct ether_header *eh;
1178
1179                         if (ic->ic_state != IEEE80211_S_RUN)
1180                                 break;
1181
1182                         m0 = ifq_poll(&ifp->if_snd);
1183                         if (m0 == NULL)
1184                                 break;
1185                         if (sc->tx_queued >= RT2573_TX_LIST_COUNT) {
1186                                 ifp->if_flags |= IFF_OACTIVE;
1187                                 break;
1188                         }
1189                         ifq_dequeue(&ifp->if_snd, m0);
1190
1191                         if (m0->m_len < sizeof (struct ether_header) &&
1192                             !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1193                                 continue;
1194
1195                         eh = mtod(m0, struct ether_header *);
1196                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1197                         if (ni == NULL) {
1198                                 m_freem(m0);
1199                                 continue;
1200                         }
1201
1202                         BPF_MTAP(ifp, m0);
1203
1204                         m0 = ieee80211_encap(ic, m0, ni);
1205                         if (m0 == NULL)
1206                                 continue;
1207
1208                         if (ic->ic_rawbpf != NULL)
1209                                 bpf_mtap(ic->ic_rawbpf, m0);
1210
1211                         if (rum_tx_data(sc, m0, ni) != 0) {
1212                                 if (ni != NULL)
1213                                         ieee80211_free_node(ni);
1214                                 ifp->if_oerrors++;
1215                                 break;
1216                         }
1217                 }
1218
1219                 sc->sc_tx_timer = 5;
1220                 ifp->if_timer = 1;
1221         }
1222 }
1223
1224 Static void
1225 rum_watchdog(struct ifnet *ifp)
1226 {
1227         struct rum_softc *sc = ifp->if_softc;
1228
1229         ASSERT_SERIALIZED(ifp->if_serializer);
1230
1231         ifp->if_timer = 0;
1232
1233         if (sc->sc_tx_timer > 0) {
1234                 if (--sc->sc_tx_timer == 0) {
1235                         kprintf("%s: device timeout\n", USBDEVNAME(sc->sc_dev));
1236                         /*rum_init(sc); XXX needs a process context! */
1237                         ifp->if_oerrors++;
1238                         return;
1239                 }
1240                 ifp->if_timer = 1;
1241         }
1242
1243         ieee80211_watchdog(&sc->sc_ic);
1244 }
1245
1246 Static int
1247 rum_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1248 {
1249         struct rum_softc *sc = ifp->if_softc;
1250         struct ieee80211com *ic = &sc->sc_ic;
1251         int error = 0;
1252
1253         ASSERT_SERIALIZED(ifp->if_serializer);
1254
1255 #ifdef spl
1256         s = splnet();
1257 #endif
1258
1259         switch (cmd) {
1260         case SIOCSIFFLAGS:
1261                 if (ifp->if_flags & IFF_UP) {
1262                         if (ifp->if_flags & IFF_RUNNING)
1263                                 rum_update_promisc(sc);
1264                         else
1265                                 rum_init(sc);
1266                 } else {
1267                         if (ifp->if_flags & IFF_RUNNING)
1268                                 rum_stop(sc);
1269                 }
1270                 break;
1271         default:
1272                 error = ieee80211_ioctl(ic, cmd, data, cr);
1273                 break;
1274         }
1275
1276         if (error == ENETRESET) {
1277                 struct ieee80211req *ireq = (struct ieee80211req *)data;
1278
1279                 if (cmd == SIOCS80211 &&
1280                     ireq->i_type == IEEE80211_IOC_CHANNEL &&
1281                     ic->ic_opmode == IEEE80211_M_MONITOR) {
1282                         /*
1283                          * This allows for fast channel switching in monitor mode
1284                          * (used by kismet). In IBSS mode, we must explicitly reset
1285                          * the interface to generate a new beacon frame.
1286                          */
1287                         rum_set_chan(sc, ic->ic_ibss_chan);
1288                 } else if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1289                     (IFF_UP | IFF_RUNNING)) {
1290                         rum_init(sc);
1291                 }
1292                 error = 0;
1293         }
1294
1295 #ifdef spl
1296         splx(s);
1297 #endif
1298
1299         return error;
1300 }
1301
1302 Static void
1303 rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1304 {
1305         usb_device_request_t req;
1306         usbd_status error;
1307
1308         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1309         req.bRequest = RT2573_READ_EEPROM;
1310         USETW(req.wValue, 0);
1311         USETW(req.wIndex, addr);
1312         USETW(req.wLength, len);
1313
1314         error = usbd_do_request(sc->sc_udev, &req, buf);
1315         if (error != 0) {
1316                 kprintf("%s: could not read EEPROM: %s\n",
1317                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1318         }
1319 }
1320
1321 Static uint32_t
1322 rum_read(struct rum_softc *sc, uint16_t reg)
1323 {
1324         uint32_t val;
1325
1326         rum_read_multi(sc, reg, &val, sizeof val);
1327
1328         return le32toh(val);
1329 }
1330
1331 Static void
1332 rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1333 {
1334         usb_device_request_t req;
1335         usbd_status error;
1336
1337         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1338         req.bRequest = RT2573_READ_MULTI_MAC;
1339         USETW(req.wValue, 0);
1340         USETW(req.wIndex, reg);
1341         USETW(req.wLength, len);
1342
1343         error = usbd_do_request(sc->sc_udev, &req, buf);
1344         if (error != 0) {
1345                 kprintf("%s: could not multi read MAC register: %s\n",
1346                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1347         }
1348 }
1349
1350 Static void
1351 rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1352 {
1353         uint32_t tmp = htole32(val);
1354
1355         rum_write_multi(sc, reg, &tmp, sizeof tmp);
1356 }
1357
1358 Static void
1359 rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1360 {
1361         usb_device_request_t req;
1362         usbd_status error;
1363
1364         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1365         req.bRequest = RT2573_WRITE_MULTI_MAC;
1366         USETW(req.wValue, 0);
1367         USETW(req.wIndex, reg);
1368         USETW(req.wLength, len);
1369
1370         error = usbd_do_request(sc->sc_udev, &req, buf);
1371         if (error != 0) {
1372                 kprintf("%s: could not multi write MAC register: %s\n",
1373                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1374         }
1375 }
1376
1377 Static void
1378 rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1379 {
1380         uint32_t tmp;
1381         int ntries;
1382
1383         for (ntries = 0; ntries < 5; ntries++) {
1384                 if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1385                         break;
1386         }
1387         if (ntries == 5) {
1388                 kprintf("%s: could not write to BBP\n", USBDEVNAME(sc->sc_dev));
1389                 return;
1390         }
1391
1392         tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1393         rum_write(sc, RT2573_PHY_CSR3, tmp);
1394 }
1395
1396 Static uint8_t
1397 rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1398 {
1399         uint32_t val;
1400         int ntries;
1401
1402         for (ntries = 0; ntries < 5; ntries++) {
1403                 if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1404                         break;
1405         }
1406         if (ntries == 5) {
1407                 kprintf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1408                 return 0;
1409         }
1410
1411         val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1412         rum_write(sc, RT2573_PHY_CSR3, val);
1413
1414         for (ntries = 0; ntries < 100; ntries++) {
1415                 val = rum_read(sc, RT2573_PHY_CSR3);
1416                 if (!(val & RT2573_BBP_BUSY))
1417                         return val & 0xff;
1418                 DELAY(1);
1419         }
1420
1421         kprintf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1422         return 0;
1423 }
1424
1425 Static void
1426 rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1427 {
1428         uint32_t tmp;
1429         int ntries;
1430
1431         for (ntries = 0; ntries < 5; ntries++) {
1432                 if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1433                         break;
1434         }
1435         if (ntries == 5) {
1436                 kprintf("%s: could not write to RF\n", USBDEVNAME(sc->sc_dev));
1437                 return;
1438         }
1439
1440         tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1441             (reg & 3);
1442         rum_write(sc, RT2573_PHY_CSR4, tmp);
1443
1444         /* remember last written value in sc */
1445         sc->rf_regs[reg] = val;
1446
1447         DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff));
1448 }
1449
1450 Static void
1451 rum_select_antenna(struct rum_softc *sc)
1452 {
1453         uint8_t bbp4, bbp77;
1454         uint32_t tmp;
1455
1456         bbp4  = rum_bbp_read(sc, 4);
1457         bbp77 = rum_bbp_read(sc, 77);
1458
1459         /* TBD */
1460
1461         /* make sure Rx is disabled before switching antenna */
1462         tmp = rum_read(sc, RT2573_TXRX_CSR0);
1463         rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1464
1465         rum_bbp_write(sc,  4, bbp4);
1466         rum_bbp_write(sc, 77, bbp77);
1467
1468         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1469 }
1470
1471 /*
1472  * Enable multi-rate retries for frames sent at OFDM rates.
1473  * In 802.11b/g mode, allow fallback to CCK rates.
1474  */
1475 Static void
1476 rum_enable_mrr(struct rum_softc *sc)
1477 {
1478         struct ieee80211com *ic = &sc->sc_ic;
1479         uint32_t tmp;
1480
1481         tmp = rum_read(sc, RT2573_TXRX_CSR4);
1482
1483         tmp &= ~RT2573_MRR_CCK_FALLBACK;
1484         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1485                 tmp |= RT2573_MRR_CCK_FALLBACK;
1486         tmp |= RT2573_MRR_ENABLED;
1487
1488         rum_write(sc, RT2573_TXRX_CSR4, tmp);
1489 }
1490
1491 Static void
1492 rum_set_txpreamble(struct rum_softc *sc)
1493 {
1494         uint32_t tmp;
1495
1496         tmp = rum_read(sc, RT2573_TXRX_CSR4);
1497
1498         tmp &= ~RT2573_SHORT_PREAMBLE;
1499         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1500                 tmp |= RT2573_SHORT_PREAMBLE;
1501
1502         rum_write(sc, RT2573_TXRX_CSR4, tmp);
1503 }
1504
1505 Static void
1506 rum_set_basicrates(struct rum_softc *sc)
1507 {
1508         struct ieee80211com *ic = &sc->sc_ic;
1509
1510         /* update basic rate set */
1511         if (ic->ic_curmode == IEEE80211_MODE_11B) {
1512                 /* 11b basic rates: 1, 2Mbps */
1513                 rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1514         } else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan)) {
1515                 /* 11a basic rates: 6, 12, 24Mbps */
1516                 rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1517         } else {
1518                 /* 11g basic rates: 1, 2, 5.5, 11, 6, 12, 24Mbps */
1519                 rum_write(sc, RT2573_TXRX_CSR5, 0x15f);
1520         }
1521 }
1522
1523 /*
1524  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1525  * driver.
1526  */
1527 Static void
1528 rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1529 {
1530         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1531         uint32_t tmp;
1532
1533         /* update all BBP registers that depend on the band */
1534         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1535         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1536         if (IEEE80211_IS_CHAN_5GHZ(c)) {
1537                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1538                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1539         }
1540         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1541             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1542                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1543         }
1544
1545         sc->bbp17 = bbp17;
1546         rum_bbp_write(sc,  17, bbp17);
1547         rum_bbp_write(sc,  96, bbp96);
1548         rum_bbp_write(sc, 104, bbp104);
1549
1550         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1551             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1552                 rum_bbp_write(sc, 75, 0x80);
1553                 rum_bbp_write(sc, 86, 0x80);
1554                 rum_bbp_write(sc, 88, 0x80);
1555         }
1556
1557         rum_bbp_write(sc, 35, bbp35);
1558         rum_bbp_write(sc, 97, bbp97);
1559         rum_bbp_write(sc, 98, bbp98);
1560
1561         tmp = rum_read(sc, RT2573_PHY_CSR0);
1562         tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1563         if (IEEE80211_IS_CHAN_2GHZ(c))
1564                 tmp |= RT2573_PA_PE_2GHZ;
1565         else
1566                 tmp |= RT2573_PA_PE_5GHZ;
1567         rum_write(sc, RT2573_PHY_CSR0, tmp);
1568
1569         /* 802.11a uses a 16 microseconds short interframe space */
1570         sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1571 }
1572
1573 Static void
1574 rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1575 {
1576         struct ieee80211com *ic = &sc->sc_ic;
1577         struct ifnet *ifp = &ic->ic_if;
1578         const struct rfprog *rfprog;
1579         uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1580         int8_t power;
1581         u_int i, chan;
1582
1583         ASSERT_SERIALIZED(ifp->if_serializer);
1584
1585         chan = ieee80211_chan2ieee(ic, c);
1586         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1587                 return;
1588
1589         lwkt_serialize_exit(ifp->if_serializer);
1590
1591         /* select the appropriate RF settings based on what EEPROM says */
1592         rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1593                   sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1594
1595         /* find the settings for this channel (we know it exists) */
1596         for (i = 0; rfprog[i].chan != chan; i++)
1597                 ;       /* EMPTY */
1598
1599         power = sc->txpow[i];
1600         if (power < 0) {
1601                 bbp94 += power;
1602                 power = 0;
1603         } else if (power > 31) {
1604                 bbp94 += power - 31;
1605                 power = 31;
1606         }
1607
1608         /*
1609          * If we are switching from the 2GHz band to the 5GHz band or
1610          * vice-versa, BBP registers need to be reprogrammed.
1611          */
1612         if (c->ic_flags != sc->sc_curchan->ic_flags) {
1613                 rum_select_band(sc, c);
1614                 rum_select_antenna(sc);
1615         }
1616         sc->sc_curchan = c;
1617
1618         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1619         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1620         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1621         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1622
1623         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1624         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1625         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1626         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1627
1628         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1629         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1630         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1631         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1632
1633         DELAY(10);
1634
1635         /* enable smart mode for MIMO-capable RFs */
1636         bbp3 = rum_bbp_read(sc, 3);
1637
1638         bbp3 &= ~RT2573_SMART_MODE;
1639         if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1640                 bbp3 |= RT2573_SMART_MODE;
1641
1642         rum_bbp_write(sc, 3, bbp3);
1643
1644         if (bbp94 != RT2573_BBPR94_DEFAULT)
1645                 rum_bbp_write(sc, 94, bbp94);
1646
1647         lwkt_serialize_enter(ifp->if_serializer);
1648 }
1649
1650 /*
1651  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1652  * and HostAP operating modes.
1653  */
1654 Static void
1655 rum_enable_tsf_sync(struct rum_softc *sc)
1656 {
1657         struct ieee80211com *ic = &sc->sc_ic;
1658         uint32_t tmp;
1659
1660         if (ic->ic_opmode != IEEE80211_M_STA) {
1661                 /*
1662                  * Change default 16ms TBTT adjustment to 8ms.
1663                  * Must be done before enabling beacon generation.
1664                  */
1665                 rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1666         }
1667
1668         tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1669
1670         /* set beacon interval (in 1/16ms unit) */
1671         tmp |= ic->ic_bss->ni_intval * 16;
1672
1673         tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1674         if (ic->ic_opmode == IEEE80211_M_STA)
1675                 tmp |= RT2573_TSF_MODE(1);
1676         else
1677                 tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1678
1679         rum_write(sc, RT2573_TXRX_CSR9, tmp);
1680 }
1681
1682 Static void
1683 rum_update_slot(struct rum_softc *sc)
1684 {
1685         struct ieee80211com *ic = &sc->sc_ic;
1686         uint8_t slottime;
1687         uint32_t tmp;
1688
1689         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1690
1691         tmp = rum_read(sc, RT2573_MAC_CSR9);
1692         tmp = (tmp & ~0xff) | slottime;
1693         rum_write(sc, RT2573_MAC_CSR9, tmp);
1694
1695         DPRINTF(("setting slot time to %uus\n", slottime));
1696 }
1697
1698 Static void
1699 rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1700 {
1701         uint32_t tmp;
1702
1703         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1704         rum_write(sc, RT2573_MAC_CSR4, tmp);
1705
1706         tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1707         rum_write(sc, RT2573_MAC_CSR5, tmp);
1708 }
1709
1710 Static void
1711 rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1712 {
1713         uint32_t tmp;
1714
1715         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1716         rum_write(sc, RT2573_MAC_CSR2, tmp);
1717
1718         tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1719         rum_write(sc, RT2573_MAC_CSR3, tmp);
1720 }
1721
1722 Static void
1723 rum_update_promisc(struct rum_softc *sc)
1724 {
1725         struct ifnet *ifp = &sc->sc_ic.ic_if;
1726         uint32_t tmp;
1727
1728         tmp = rum_read(sc, RT2573_TXRX_CSR0);
1729
1730         tmp &= ~RT2573_DROP_NOT_TO_ME;
1731         if (!(ifp->if_flags & IFF_PROMISC))
1732                 tmp |= RT2573_DROP_NOT_TO_ME;
1733
1734         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1735
1736         DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1737             "entering" : "leaving"));
1738 }
1739
1740 Static const char *
1741 rum_get_rf(int rev)
1742 {
1743         switch (rev) {
1744         case RT2573_RF_2527:    return "RT2527 (MIMO XR)";
1745         case RT2573_RF_2528:    return "RT2528";
1746         case RT2573_RF_5225:    return "RT5225 (MIMO XR)";
1747         case RT2573_RF_5226:    return "RT5226";
1748         default:                return "unknown";
1749         }
1750 }
1751
1752 Static void
1753 rum_read_eeprom(struct rum_softc *sc)
1754 {
1755         struct ieee80211com *ic = &sc->sc_ic;
1756         uint16_t val;
1757 #ifdef RUM_DEBUG
1758         int i;
1759 #endif
1760
1761         /* read MAC/BBP type */
1762         rum_eeprom_read(sc, RT2573_EEPROM_MACBBP, &val, 2);
1763         sc->macbbp_rev = le16toh(val);
1764
1765         /* read MAC address */
1766         rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1767
1768         rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1769         val = le16toh(val);
1770         sc->rf_rev =   (val >> 11) & 0x1f;
1771         sc->hw_radio = (val >> 10) & 0x1;
1772         sc->rx_ant =   (val >> 4)  & 0x3;
1773         sc->tx_ant =   (val >> 2)  & 0x3;
1774         sc->nb_ant =   val & 0x3;
1775
1776         DPRINTF(("RF revision=%d\n", sc->rf_rev));
1777
1778         rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1779         val = le16toh(val);
1780         sc->ext_5ghz_lna = (val >> 6) & 0x1;
1781         sc->ext_2ghz_lna = (val >> 4) & 0x1;
1782
1783         DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1784             sc->ext_2ghz_lna, sc->ext_5ghz_lna));
1785
1786         rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1787         val = le16toh(val);
1788         if ((val & 0xff) != 0xff)
1789                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
1790
1791         /* Only [-10, 10] is valid */
1792         if (sc->rssi_2ghz_corr < -10 || sc->rssi_2ghz_corr > 10)
1793                 sc->rssi_2ghz_corr = 0;
1794
1795         rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1796         val = le16toh(val);
1797         if ((val & 0xff) != 0xff)
1798                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
1799
1800         /* Only [-10, 10] is valid */
1801         if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
1802                 sc->rssi_5ghz_corr = 0;
1803
1804         if (sc->ext_2ghz_lna)
1805                 sc->rssi_2ghz_corr -= 14;
1806         if (sc->ext_5ghz_lna)
1807                 sc->rssi_5ghz_corr -= 14;
1808
1809         DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1810             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
1811
1812         rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1813         val = le16toh(val);
1814         if ((val & 0xff) != 0xff)
1815                 sc->rffreq = val & 0xff;
1816
1817         DPRINTF(("RF freq=%d\n", sc->rffreq));
1818
1819         /* read Tx power for all a/b/g channels */
1820         rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1821         /* XXX default Tx power for 802.11a channels */
1822         memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1823 #ifdef RUM_DEBUG
1824         for (i = 0; i < 14; i++)
1825                 DPRINTF(("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]));
1826 #endif
1827
1828         /* read default values for BBP registers */
1829         rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1830 #ifdef RUM_DEBUG
1831         for (i = 0; i < 14; i++) {
1832                 if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1833                         continue;
1834                 DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1835                     sc->bbp_prom[i].val));
1836         }
1837 #endif
1838 }
1839
1840 Static int
1841 rum_bbp_init(struct rum_softc *sc)
1842 {
1843 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1844         int i, ntries;
1845         uint8_t val;
1846
1847         /* wait for BBP to be ready */
1848         for (ntries = 0; ntries < 100; ntries++) {
1849                 val = rum_bbp_read(sc, 0);
1850                 if (val != 0 && val != 0xff)
1851                         break;
1852                 DELAY(1000);
1853         }
1854         if (ntries == 100) {
1855                 kprintf("%s: timeout waiting for BBP\n",
1856                     USBDEVNAME(sc->sc_dev));
1857                 return EIO;
1858         }
1859
1860         /* initialize BBP registers to default values */
1861         for (i = 0; i < N(rum_def_bbp); i++)
1862                 rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1863
1864         /* write vendor-specific BBP values (from EEPROM) */
1865         for (i = 0; i < 16; i++) {
1866                 if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1867                         continue;
1868                 rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1869         }
1870
1871         return 0;
1872 #undef N
1873 }
1874
1875 Static void
1876 rum_init(void *xsc)
1877 {
1878 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
1879         struct rum_softc *sc = xsc;
1880         struct ieee80211com *ic = &sc->sc_ic;
1881         struct ifnet *ifp = &ic->ic_if;
1882         struct rum_rx_data *data;
1883         uint32_t tmp;
1884         usbd_status error;
1885         int i, ntries;
1886
1887         ASSERT_SERIALIZED(ifp->if_serializer);
1888
1889         rum_stop(sc);
1890
1891         /* initialize MAC registers to default values */
1892         for (i = 0; i < N(rum_def_mac); i++)
1893                 rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1894
1895         /* set host ready */
1896         rum_write(sc, RT2573_MAC_CSR1, 3);
1897         rum_write(sc, RT2573_MAC_CSR1, 0);
1898
1899         /* wait for BBP/RF to wakeup */
1900         for (ntries = 0; ntries < 1000; ntries++) {
1901                 if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1902                         break;
1903                 rum_write(sc, RT2573_MAC_CSR12, 4);     /* force wakeup */
1904                 DELAY(1000);
1905         }
1906         if (ntries == 1000) {
1907                 kprintf("%s: timeout waiting for BBP/RF to wakeup\n",
1908                     USBDEVNAME(sc->sc_dev));
1909                 goto fail;
1910         }
1911
1912         if ((error = rum_bbp_init(sc)) != 0)
1913                 goto fail;
1914
1915         /* select default channel */
1916         sc->sc_curchan = ic->ic_curchan = ic->ic_ibss_chan;
1917         rum_select_band(sc, sc->sc_curchan);
1918         rum_select_antenna(sc);
1919         rum_set_chan(sc, sc->sc_curchan);
1920
1921         /* clear STA registers */
1922         rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
1923
1924         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
1925         rum_set_macaddr(sc, ic->ic_myaddr);
1926
1927         /* initialize ASIC */
1928         rum_write(sc, RT2573_MAC_CSR1, 4);
1929
1930         /*
1931          * Allocate xfer for AMRR statistics requests.
1932          */
1933         sc->stats_xfer = usbd_alloc_xfer(sc->sc_udev);
1934         if (sc->stats_xfer == NULL) {
1935                 kprintf("%s: could not allocate AMRR xfer\n",
1936                     USBDEVNAME(sc->sc_dev));
1937                 goto fail;
1938         }
1939
1940         /*
1941          * Open Tx and Rx USB bulk pipes.
1942          */
1943         error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
1944             &sc->sc_tx_pipeh);
1945         if (error != 0) {
1946                 kprintf("%s: could not open Tx pipe: %s\n",
1947                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1948                 goto fail;
1949         }
1950
1951         error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
1952             &sc->sc_rx_pipeh);
1953         if (error != 0) {
1954                 kprintf("%s: could not open Rx pipe: %s\n",
1955                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1956                 goto fail;
1957         }
1958
1959         /*
1960          * Allocate Tx and Rx xfer queues.
1961          */
1962         error = rum_alloc_tx_list(sc);
1963         if (error != 0) {
1964                 kprintf("%s: could not allocate Tx list\n",
1965                     USBDEVNAME(sc->sc_dev));
1966                 goto fail;
1967         }
1968
1969         error = rum_alloc_rx_list(sc);
1970         if (error != 0) {
1971                 kprintf("%s: could not allocate Rx list\n",
1972                     USBDEVNAME(sc->sc_dev));
1973                 goto fail;
1974         }
1975
1976         /*
1977          * Start up the receive pipe.
1978          */
1979         for (i = 0; i < RT2573_RX_LIST_COUNT; i++) {
1980                 data = &sc->rx_data[i];
1981
1982                 usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf,
1983                     MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
1984                 usbd_transfer(data->xfer);
1985         }
1986
1987         /* update Rx filter */
1988         tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
1989
1990         tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
1991         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1992                 tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
1993                        RT2573_DROP_ACKCTS;
1994                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1995                         tmp |= RT2573_DROP_TODS;
1996                 if (!(ifp->if_flags & IFF_PROMISC))
1997                         tmp |= RT2573_DROP_NOT_TO_ME;
1998         }
1999         rum_write(sc, RT2573_TXRX_CSR0, tmp);
2000
2001         ifp->if_flags &= ~IFF_OACTIVE;
2002         ifp->if_flags |= IFF_RUNNING;
2003
2004         if (ic->ic_opmode == IEEE80211_M_MONITOR)
2005                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2006         else
2007                 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2008
2009         return;
2010
2011 fail:   rum_stop(sc);
2012
2013 #undef N
2014 }
2015
2016 Static void
2017 rum_stop(struct rum_softc *sc)
2018 {
2019         struct ieee80211com *ic = &sc->sc_ic;
2020         struct ifnet *ifp = &ic->ic_if;
2021         uint32_t tmp;
2022
2023         ASSERT_SERIALIZED(ifp->if_serializer);
2024
2025         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);  /* free all nodes */
2026
2027         sc->sc_tx_timer = 0;
2028         ifp->if_timer = 0;
2029         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2030
2031         /* disable Rx */
2032         tmp = rum_read(sc, RT2573_TXRX_CSR0);
2033         rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2034
2035         /* reset ASIC */
2036         rum_write(sc, RT2573_MAC_CSR1, 3);
2037         rum_write(sc, RT2573_MAC_CSR1, 0);
2038
2039         if (sc->sc_rx_pipeh != NULL) {
2040                 usbd_abort_pipe(sc->sc_rx_pipeh);
2041                 usbd_close_pipe(sc->sc_rx_pipeh);
2042                 sc->sc_rx_pipeh = NULL;
2043         }
2044
2045         if (sc->sc_tx_pipeh != NULL) {
2046                 usbd_abort_pipe(sc->sc_tx_pipeh);
2047                 usbd_close_pipe(sc->sc_tx_pipeh);
2048                 sc->sc_tx_pipeh = NULL;
2049         }
2050
2051         rum_free_rx_list(sc);
2052         rum_free_tx_list(sc);
2053 }
2054
2055 Static int
2056 rum_load_microcode(struct rum_softc *sc, const uint8_t *ucode, size_t size)
2057 {
2058         usb_device_request_t req;
2059         uint16_t reg = RT2573_MCU_CODE_BASE;
2060         usbd_status error;
2061
2062         /* copy firmware image into NIC */
2063         for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2064                 rum_write(sc, reg, UGETDW(ucode));
2065
2066         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2067         req.bRequest = RT2573_MCU_CNTL;
2068         USETW(req.wValue, RT2573_MCU_RUN);
2069         USETW(req.wIndex, 0);
2070         USETW(req.wLength, 0);
2071
2072         error = usbd_do_request(sc->sc_udev, &req, NULL);
2073         if (error != 0) {
2074                 kprintf("%s: could not run firmware: %s\n",
2075                     USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2076         }
2077         return error;
2078 }
2079
2080 Static int
2081 rum_prepare_beacon(struct rum_softc *sc)
2082 {
2083         struct ieee80211com *ic = &sc->sc_ic;
2084         struct ieee80211_beacon_offsets bo;
2085         struct rum_tx_desc desc;
2086         struct mbuf *m0;
2087         int rate;
2088
2089         m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
2090         if (m0 == NULL) {
2091                 if_printf(&ic->ic_if, "could not allocate beacon frame\n");
2092                 return ENOBUFS;
2093         }
2094
2095         /* send beacons at the lowest available rate */
2096         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan) ? 12 : 2;
2097
2098         rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2099             m0->m_pkthdr.len, rate);
2100
2101         /* copy the first 24 bytes of Tx descriptor into NIC memory */
2102         rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2103
2104         /* copy beacon header and payload into NIC memory */
2105         rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2106             m0->m_pkthdr.len);
2107
2108         m_freem(m0);
2109
2110         return 0;
2111 }
2112
2113 Static void
2114 rum_stats_timeout(void *arg)
2115 {
2116         struct rum_softc *sc = arg;
2117         struct ifnet *ifp = &sc->sc_ic.ic_if;
2118         usb_device_request_t req;
2119
2120         lwkt_serialize_enter(ifp->if_serializer);
2121
2122         /*
2123          * Asynchronously read statistic registers (cleared by read).
2124          */
2125         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2126         req.bRequest = RT2573_READ_MULTI_MAC;
2127         USETW(req.wValue, 0);
2128         USETW(req.wIndex, RT2573_STA_CSR0);
2129         USETW(req.wLength, sizeof(sc->sta));
2130
2131         usbd_setup_default_xfer(sc->stats_xfer, sc->sc_udev, sc,
2132                                 USBD_DEFAULT_TIMEOUT, &req,
2133                                 sc->sta, sizeof(sc->sta), 0,
2134                                 rum_stats_update);
2135         usbd_transfer(sc->stats_xfer);
2136
2137         lwkt_serialize_exit(ifp->if_serializer);
2138 }
2139
2140 Static void
2141 rum_stats_update(usbd_xfer_handle xfer, usbd_private_handle priv,
2142                  usbd_status status)
2143 {
2144         struct rum_softc *sc = (struct rum_softc *)priv;
2145         struct ifnet *ifp = &sc->sc_ic.ic_if;
2146         struct ieee80211_ratectl_stats *stats = &sc->sc_stats;
2147
2148         if (status != USBD_NORMAL_COMPLETION) {
2149                 kprintf("%s: could not retrieve Tx statistics - cancelling "
2150                     "automatic rate control\n", USBDEVNAME(sc->sc_dev));
2151                 return;
2152         }
2153
2154         lwkt_serialize_enter(ifp->if_serializer);
2155
2156         /* count TX retry-fail as Tx errors */
2157         ifp->if_oerrors += RUM_TX_PKT_FAIL(sc);
2158
2159         stats->stats_pkt_noretry += RUM_TX_PKT_NO_RETRY(sc);
2160         stats->stats_pkt_ok += RUM_TX_PKT_NO_RETRY(sc) +
2161                                RUM_TX_PKT_ONE_RETRY(sc) +
2162                                RUM_TX_PKT_MULTI_RETRY(sc);
2163         stats->stats_pkt_err += RUM_TX_PKT_FAIL(sc);
2164
2165         stats->stats_retries += RUM_TX_PKT_ONE_RETRY(sc);
2166 #if 1
2167         /*
2168          * XXX Estimated average:
2169          * Actual number of retries for each packet should belong to
2170          * [2, RUM_TX_SHORT_RETRY_MAX]
2171          */
2172         stats->stats_retries += RUM_TX_PKT_MULTI_RETRY(sc) *
2173                                 ((2 + RUM_TX_SHORT_RETRY_MAX) / 2);
2174 #else
2175         stats->stats_retries += RUM_TX_PKT_MULTI_RETRY(sc);
2176 #endif
2177         stats->stats_retries += RUM_TX_PKT_FAIL(sc) * RUM_TX_SHORT_RETRY_MAX;
2178
2179         callout_reset(&sc->stats_ch, 4 * hz / 5, rum_stats_timeout, sc);
2180
2181         lwkt_serialize_exit(ifp->if_serializer);
2182 }
2183
2184 Static void
2185 rum_stats(struct ieee80211com *ic, struct ieee80211_node *ni __unused,
2186           struct ieee80211_ratectl_stats *stats)
2187 {
2188         struct ifnet *ifp = &ic->ic_if;
2189         struct rum_softc *sc = ifp->if_softc;
2190
2191         ASSERT_SERIALIZED(ifp->if_serializer);
2192
2193         bcopy(&sc->sc_stats, stats, sizeof(*stats));
2194         bzero(&sc->sc_stats, sizeof(sc->sc_stats));
2195 }
2196
2197 Static void
2198 rum_ratectl_change(struct ieee80211com *ic, u_int orc __unused, u_int nrc)
2199 {
2200         struct ieee80211_ratectl_state *st = &ic->ic_ratectl;
2201         struct ieee80211_onoe_param *oparam;
2202
2203         if (st->rc_st_param != NULL) {
2204                 kfree(st->rc_st_param, M_DEVBUF);
2205                 st->rc_st_param = NULL;
2206         }
2207
2208         switch (nrc) {
2209         case IEEE80211_RATECTL_ONOE:
2210                 oparam = kmalloc(sizeof(*oparam), M_DEVBUF, M_INTWAIT);
2211
2212                 IEEE80211_ONOE_PARAM_SETUP(oparam);
2213                 oparam->onoe_raise = 15;
2214
2215                 st->rc_st_param = oparam;
2216                 break;
2217         case IEEE80211_RATECTL_NONE:
2218                 /* This could only happen during detaching */
2219                 break;
2220         default:
2221                 panic("unknown rate control algo %u\n", nrc);
2222         }
2223 }
2224
2225 Static int
2226 rum_get_rssi(struct rum_softc *sc, uint8_t raw)
2227 {
2228         int lna, agc, rssi;
2229
2230         lna = (raw >> 5) & 0x3;
2231         agc = raw & 0x1f;
2232
2233         if (lna == 0) {
2234                 /*
2235                  * No RSSI mapping
2236                  *
2237                  * NB: Since RSSI is relative to noise floor, -1 is
2238                  *     adequate for caller to know error happened.
2239                  */
2240                 return -1;
2241         }
2242
2243         rssi = (2 * agc) - RT2573_NOISE_FLOOR;
2244
2245         if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
2246                 rssi += sc->rssi_2ghz_corr;
2247
2248                 if (lna == 1)
2249                         rssi -= 64;
2250                 else if (lna == 2)
2251                         rssi -= 74;
2252                 else if (lna == 3)
2253                         rssi -= 90;
2254         } else {
2255                 rssi += sc->rssi_5ghz_corr;
2256
2257                 if (!sc->ext_5ghz_lna && lna != 1)
2258                         rssi += 4;
2259
2260                 if (lna == 1)
2261                         rssi -= 64;
2262                 else if (lna == 2)
2263                         rssi -= 86;
2264                 else if (lna == 3)
2265                         rssi -= 100;
2266         }
2267         return rssi;
2268 }