sys/dev/usb/if_rum.c

   1 /*      $FreeBSD$       */
   2
   3 /*-
   4  * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
   5  * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/cdefs.h>
  21 __FBSDID("$FreeBSD$");
  22
  23 /*-
  24  * Ralink Technology RT2501USB/RT2601USB chipset driver
  25  * http://www.ralinktech.com.tw/
  26  */
  27
  28 #include <sys/param.h>
  29 #include <sys/sysctl.h>
  30 #include <sys/sockio.h>
  31 #include <sys/mbuf.h>
  32 #include <sys/kernel.h>
  33 #include <sys/socket.h>
  34 #include <sys/systm.h>
  35 #include <sys/malloc.h>
  36 #include <sys/module.h>
  37 #include <sys/bus.h>
  38 #include <sys/endian.h>
  39
  40 #include <machine/bus.h>
  41 #include <machine/resource.h>
  42 #include <sys/rman.h>
  43
  44 #include <net/bpf.h>
  45 #include <net/if.h>
  46 #include <net/if_arp.h>
  47 #include <net/ethernet.h>
  48 #include <net/if_dl.h>
  49 #include <net/if_media.h>
  50 #include <net/if_types.h>
  51
  52 #include <net80211/ieee80211_var.h>
  53 #include <net80211/ieee80211_amrr.h>
  54 #include <net80211/ieee80211_radiotap.h>
  55
  56 #include <dev/usb/usb.h>
  57 #include <dev/usb/usbdi.h>
  58 #include <dev/usb/usbdi_util.h>
  59 #include "usbdevs.h"
  60
  61 #include <dev/usb/if_rumreg.h>
  62 #include <dev/usb/if_rumvar.h>
  63 #include <dev/usb/rt2573_ucode.h>
  64
  65 #ifdef USB_DEBUG
  66 #define DPRINTF(x)      do { if (rumdebug > 0) logprintf x; } while (0)
  67 #define DPRINTFN(n, x)  do { if (rumdebug >= (n)) logprintf x; } while (0)
  68 int rumdebug = 0;
  69 SYSCTL_NODE(_hw_usb, OID_AUTO, rum, CTLFLAG_RW, 0, "USB rum");
  70 SYSCTL_INT(_hw_usb_rum, OID_AUTO, debug, CTLFLAG_RW, &rumdebug, 0,
  71     "rum debug level");
  72 #else
  73 #define DPRINTF(x)
  74 #define DPRINTFN(n, x)
  75 #endif
  76
  77 /* various supported device vendors/products */
  78 static const struct usb_devno rum_devs[] = {
  79         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_HWU54DM },
  80         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573_2 },
  81         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573_3 },
  82         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_RT2573_4 },
  83         { USB_VENDOR_ABOCOM,            USB_PRODUCT_ABOCOM_WUG2700 },
  84         { USB_VENDOR_AMIT,              USB_PRODUCT_AMIT_CGWLUSB2GO },
  85         { USB_VENDOR_ASUS,              USB_PRODUCT_ASUS_RT2573_1 },
  86         { USB_VENDOR_ASUS,              USB_PRODUCT_ASUS_RT2573_2 },
  87         { USB_VENDOR_BELKIN,            USB_PRODUCT_BELKIN_F5D7050A },
  88         { USB_VENDOR_BELKIN,            USB_PRODUCT_BELKIN_F5D9050V3 },
  89         { USB_VENDOR_CISCOLINKSYS,      USB_PRODUCT_CISCOLINKSYS_WUSB54GC },
  90         { USB_VENDOR_CISCOLINKSYS,      USB_PRODUCT_CISCOLINKSYS_WUSB54GR },
  91         { USB_VENDOR_CONCEPTRONIC2,     USB_PRODUCT_CONCEPTRONIC2_C54RU2 },
  92         { USB_VENDOR_DICKSMITH,         USB_PRODUCT_DICKSMITH_CWD854F },
  93         { USB_VENDOR_DICKSMITH,         USB_PRODUCT_DICKSMITH_RT2573 },
  94         { USB_VENDOR_DLINK2,            USB_PRODUCT_DLINK2_DWLG122C1 },
  95         { USB_VENDOR_DLINK2,            USB_PRODUCT_DLINK2_WUA1340 },
  96         { USB_VENDOR_GIGABYTE,          USB_PRODUCT_GIGABYTE_GNWB01GS },
  97         { USB_VENDOR_GIGABYTE,          USB_PRODUCT_GIGABYTE_GNWI05GS },
  98         { USB_VENDOR_GIGASET,           USB_PRODUCT_GIGASET_RT2573 },
  99         { USB_VENDOR_GOODWAY,           USB_PRODUCT_GOODWAY_RT2573 },
 100         { USB_VENDOR_GUILLEMOT,         USB_PRODUCT_GUILLEMOT_HWGUSB254LB },
 101         { USB_VENDOR_GUILLEMOT,         USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP },
 102         { USB_VENDOR_HUAWEI3COM,        USB_PRODUCT_HUAWEI3COM_WUB320G },
 103         { USB_VENDOR_MELCO,             USB_PRODUCT_MELCO_G54HP },
 104         { USB_VENDOR_MELCO,             USB_PRODUCT_MELCO_SG54HP },
 105         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_1 },
 106         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_2 },
 107         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_3 },
 108         { USB_VENDOR_MSI,               USB_PRODUCT_MSI_RT2573_4 },
 109         { USB_VENDOR_NOVATECH,          USB_PRODUCT_NOVATECH_RT2573 },
 110         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUS54HP },
 111         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUS54MINI2 },
 112         { USB_VENDOR_PLANEX2,           USB_PRODUCT_PLANEX2_GWUSMM },
 113         { USB_VENDOR_QCOM,              USB_PRODUCT_QCOM_RT2573 },
 114         { USB_VENDOR_QCOM,              USB_PRODUCT_QCOM_RT2573_2 },
 115         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2573 },
 116         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2573_2 },
 117         { USB_VENDOR_RALINK,            USB_PRODUCT_RALINK_RT2671 },
 118         { USB_VENDOR_SITECOMEU,         USB_PRODUCT_SITECOMEU_WL113R2 },
 119         { USB_VENDOR_SITECOMEU,         USB_PRODUCT_SITECOMEU_WL172 },
 120         { USB_VENDOR_SURECOM,           USB_PRODUCT_SURECOM_RT2573 }
 121 };
 122
 123 MODULE_DEPEND(rum, wlan, 1, 1, 1);
 124 MODULE_DEPEND(rum, wlan_amrr, 1, 1, 1);
 125
 126 static int              rum_alloc_tx_list(struct rum_softc *);
 127 static void             rum_free_tx_list(struct rum_softc *);
 128 static int              rum_alloc_rx_list(struct rum_softc *);
 129 static void             rum_free_rx_list(struct rum_softc *);
 130 static int              rum_media_change(struct ifnet *);
 131 static void             rum_next_scan(void *);
 132 static void             rum_task(void *);
 133 static int              rum_newstate(struct ieee80211com *,
 134                             enum ieee80211_state, int);
 135 static void             rum_txeof(usbd_xfer_handle, usbd_private_handle,
 136                             usbd_status);
 137 static void             rum_rxeof(usbd_xfer_handle, usbd_private_handle,
 138                             usbd_status);
 139 static int              rum_rxrate(struct rum_rx_desc *);
 140 static int              rum_ack_rate(struct ieee80211com *, int);
 141 static uint16_t         rum_txtime(int, int, uint32_t);
 142 static uint8_t          rum_plcp_signal(int);
 143 static void             rum_setup_tx_desc(struct rum_softc *,
 144                             struct rum_tx_desc *, uint32_t, uint16_t, int,
 145                             int);
 146 static int              rum_tx_mgt(struct rum_softc *, struct mbuf *,
 147                             struct ieee80211_node *);
 148 static int              rum_tx_raw(struct rum_softc *, struct mbuf *,
 149                             struct ieee80211_node *,
 150                             const struct ieee80211_bpf_params *);
 151 static int              rum_tx_data(struct rum_softc *, struct mbuf *,
 152                             struct ieee80211_node *);
 153 static void             rum_start(struct ifnet *);
 154 static void             rum_watchdog(void *);
 155 static int              rum_ioctl(struct ifnet *, u_long, caddr_t);
 156 static void             rum_eeprom_read(struct rum_softc *, uint16_t, void *,
 157                             int);
 158 static uint32_t         rum_read(struct rum_softc *, uint16_t);
 159 static void             rum_read_multi(struct rum_softc *, uint16_t, void *,
 160                             int);
 161 static void             rum_write(struct rum_softc *, uint16_t, uint32_t);
 162 static void             rum_write_multi(struct rum_softc *, uint16_t, void *,
 163                             size_t);
 164 static void             rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
 165 static uint8_t          rum_bbp_read(struct rum_softc *, uint8_t);
 166 static void             rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
 167 static void             rum_select_antenna(struct rum_softc *);
 168 static void             rum_enable_mrr(struct rum_softc *);
 169 static void             rum_set_txpreamble(struct rum_softc *);
 170 static void             rum_set_basicrates(struct rum_softc *);
 171 static void             rum_select_band(struct rum_softc *,
 172                             struct ieee80211_channel *);
 173 static void             rum_set_chan(struct rum_softc *,
 174                             struct ieee80211_channel *);
 175 static void             rum_enable_tsf_sync(struct rum_softc *);
 176 static void             rum_update_slot(struct ifnet *);
 177 static void             rum_set_bssid(struct rum_softc *, const uint8_t *);
 178 static void             rum_set_macaddr(struct rum_softc *, const uint8_t *);
 179 static void             rum_update_promisc(struct rum_softc *);
 180 static const char       *rum_get_rf(int);
 181 static void             rum_read_eeprom(struct rum_softc *);
 182 static int              rum_bbp_init(struct rum_softc *);
 183 static void             rum_init(void *);
 184 static void             rum_stop(void *);
 185 static int              rum_load_microcode(struct rum_softc *, const u_char *,
 186                             size_t);
 187 static int              rum_prepare_beacon(struct rum_softc *);
 188 static int              rum_raw_xmit(struct ieee80211_node *, struct mbuf *,
 189                             const struct ieee80211_bpf_params *);
 190 static void             rum_amrr_start(struct rum_softc *,
 191                             struct ieee80211_node *);
 192 static void             rum_amrr_timeout(void *);
 193 static void             rum_amrr_update(usbd_xfer_handle, usbd_private_handle,
 194                             usbd_status status);
 195
 196 static const struct {
 197         uint32_t        reg;
 198         uint32_t        val;
 199 } rum_def_mac[] = {
 200         { RT2573_TXRX_CSR0,  0x025fb032 },
 201         { RT2573_TXRX_CSR1,  0x9eaa9eaf },
 202         { RT2573_TXRX_CSR2,  0x8a8b8c8d },
 203         { RT2573_TXRX_CSR3,  0x00858687 },
 204         { RT2573_TXRX_CSR7,  0x2e31353b },
 205         { RT2573_TXRX_CSR8,  0x2a2a2a2c },
 206         { RT2573_TXRX_CSR15, 0x0000000f },
 207         { RT2573_MAC_CSR6,   0x00000fff },
 208         { RT2573_MAC_CSR8,   0x016c030a },
 209         { RT2573_MAC_CSR10,  0x00000718 },
 210         { RT2573_MAC_CSR12,  0x00000004 },
 211         { RT2573_MAC_CSR13,  0x00007f00 },
 212         { RT2573_SEC_CSR0,   0x00000000 },
 213         { RT2573_SEC_CSR1,   0x00000000 },
 214         { RT2573_SEC_CSR5,   0x00000000 },
 215         { RT2573_PHY_CSR1,   0x000023b0 },
 216         { RT2573_PHY_CSR5,   0x00040a06 },
 217         { RT2573_PHY_CSR6,   0x00080606 },
 218         { RT2573_PHY_CSR7,   0x00000408 },
 219         { RT2573_AIFSN_CSR,  0x00002273 },
 220         { RT2573_CWMIN_CSR,  0x00002344 },
 221         { RT2573_CWMAX_CSR,  0x000034aa }
 222 };
 223
 224 static const struct {
 225         uint8_t reg;
 226         uint8_t val;
 227 } rum_def_bbp[] = {
 228         {   3, 0x80 },
 229         {  15, 0x30 },
 230         {  17, 0x20 },
 231         {  21, 0xc8 },
 232         {  22, 0x38 },
 233         {  23, 0x06 },
 234         {  24, 0xfe },
 235         {  25, 0x0a },
 236         {  26, 0x0d },
 237         {  32, 0x0b },
 238         {  34, 0x12 },
 239         {  37, 0x07 },
 240         {  39, 0xf8 },
 241         {  41, 0x60 },
 242         {  53, 0x10 },
 243         {  54, 0x18 },
 244         {  60, 0x10 },
 245         {  61, 0x04 },
 246         {  62, 0x04 },
 247         {  75, 0xfe },
 248         {  86, 0xfe },
 249         {  88, 0xfe },
 250         {  90, 0x0f },
 251         {  99, 0x00 },
 252         { 102, 0x16 },
 253         { 107, 0x04 }
 254 };
 255
 256 static const struct rfprog {
 257         uint8_t         chan;
 258         uint32_t        r1, r2, r3, r4;
 259 }  rum_rf5226[] = {
 260         {   1, 0x00b03, 0x001e1, 0x1a014, 0x30282 },
 261         {   2, 0x00b03, 0x001e1, 0x1a014, 0x30287 },
 262         {   3, 0x00b03, 0x001e2, 0x1a014, 0x30282 },
 263         {   4, 0x00b03, 0x001e2, 0x1a014, 0x30287 },
 264         {   5, 0x00b03, 0x001e3, 0x1a014, 0x30282 },
 265         {   6, 0x00b03, 0x001e3, 0x1a014, 0x30287 },
 266         {   7, 0x00b03, 0x001e4, 0x1a014, 0x30282 },
 267         {   8, 0x00b03, 0x001e4, 0x1a014, 0x30287 },
 268         {   9, 0x00b03, 0x001e5, 0x1a014, 0x30282 },
 269         {  10, 0x00b03, 0x001e5, 0x1a014, 0x30287 },
 270         {  11, 0x00b03, 0x001e6, 0x1a014, 0x30282 },
 271         {  12, 0x00b03, 0x001e6, 0x1a014, 0x30287 },
 272         {  13, 0x00b03, 0x001e7, 0x1a014, 0x30282 },
 273         {  14, 0x00b03, 0x001e8, 0x1a014, 0x30284 },
 274
 275         {  34, 0x00b03, 0x20266, 0x36014, 0x30282 },
 276         {  38, 0x00b03, 0x20267, 0x36014, 0x30284 },
 277         {  42, 0x00b03, 0x20268, 0x36014, 0x30286 },
 278         {  46, 0x00b03, 0x20269, 0x36014, 0x30288 },
 279
 280         {  36, 0x00b03, 0x00266, 0x26014, 0x30288 },
 281         {  40, 0x00b03, 0x00268, 0x26014, 0x30280 },
 282         {  44, 0x00b03, 0x00269, 0x26014, 0x30282 },
 283         {  48, 0x00b03, 0x0026a, 0x26014, 0x30284 },
 284         {  52, 0x00b03, 0x0026b, 0x26014, 0x30286 },
 285         {  56, 0x00b03, 0x0026c, 0x26014, 0x30288 },
 286         {  60, 0x00b03, 0x0026e, 0x26014, 0x30280 },
 287         {  64, 0x00b03, 0x0026f, 0x26014, 0x30282 },
 288
 289         { 100, 0x00b03, 0x0028a, 0x2e014, 0x30280 },
 290         { 104, 0x00b03, 0x0028b, 0x2e014, 0x30282 },
 291         { 108, 0x00b03, 0x0028c, 0x2e014, 0x30284 },
 292         { 112, 0x00b03, 0x0028d, 0x2e014, 0x30286 },
 293         { 116, 0x00b03, 0x0028e, 0x2e014, 0x30288 },
 294         { 120, 0x00b03, 0x002a0, 0x2e014, 0x30280 },
 295         { 124, 0x00b03, 0x002a1, 0x2e014, 0x30282 },
 296         { 128, 0x00b03, 0x002a2, 0x2e014, 0x30284 },
 297         { 132, 0x00b03, 0x002a3, 0x2e014, 0x30286 },
 298         { 136, 0x00b03, 0x002a4, 0x2e014, 0x30288 },
 299         { 140, 0x00b03, 0x002a6, 0x2e014, 0x30280 },
 300
 301         { 149, 0x00b03, 0x002a8, 0x2e014, 0x30287 },
 302         { 153, 0x00b03, 0x002a9, 0x2e014, 0x30289 },
 303         { 157, 0x00b03, 0x002ab, 0x2e014, 0x30281 },
 304         { 161, 0x00b03, 0x002ac, 0x2e014, 0x30283 },
 305         { 165, 0x00b03, 0x002ad, 0x2e014, 0x30285 }
 306 }, rum_rf5225[] = {
 307         {   1, 0x00b33, 0x011e1, 0x1a014, 0x30282 },
 308         {   2, 0x00b33, 0x011e1, 0x1a014, 0x30287 },
 309         {   3, 0x00b33, 0x011e2, 0x1a014, 0x30282 },
 310         {   4, 0x00b33, 0x011e2, 0x1a014, 0x30287 },
 311         {   5, 0x00b33, 0x011e3, 0x1a014, 0x30282 },
 312         {   6, 0x00b33, 0x011e3, 0x1a014, 0x30287 },
 313         {   7, 0x00b33, 0x011e4, 0x1a014, 0x30282 },
 314         {   8, 0x00b33, 0x011e4, 0x1a014, 0x30287 },
 315         {   9, 0x00b33, 0x011e5, 0x1a014, 0x30282 },
 316         {  10, 0x00b33, 0x011e5, 0x1a014, 0x30287 },
 317         {  11, 0x00b33, 0x011e6, 0x1a014, 0x30282 },
 318         {  12, 0x00b33, 0x011e6, 0x1a014, 0x30287 },
 319         {  13, 0x00b33, 0x011e7, 0x1a014, 0x30282 },
 320         {  14, 0x00b33, 0x011e8, 0x1a014, 0x30284 },
 321
 322         {  34, 0x00b33, 0x01266, 0x26014, 0x30282 },
 323         {  38, 0x00b33, 0x01267, 0x26014, 0x30284 },
 324         {  42, 0x00b33, 0x01268, 0x26014, 0x30286 },
 325         {  46, 0x00b33, 0x01269, 0x26014, 0x30288 },
 326
 327         {  36, 0x00b33, 0x01266, 0x26014, 0x30288 },
 328         {  40, 0x00b33, 0x01268, 0x26014, 0x30280 },
 329         {  44, 0x00b33, 0x01269, 0x26014, 0x30282 },
 330         {  48, 0x00b33, 0x0126a, 0x26014, 0x30284 },
 331         {  52, 0x00b33, 0x0126b, 0x26014, 0x30286 },
 332         {  56, 0x00b33, 0x0126c, 0x26014, 0x30288 },
 333         {  60, 0x00b33, 0x0126e, 0x26014, 0x30280 },
 334         {  64, 0x00b33, 0x0126f, 0x26014, 0x30282 },
 335
 336         { 100, 0x00b33, 0x0128a, 0x2e014, 0x30280 },
 337         { 104, 0x00b33, 0x0128b, 0x2e014, 0x30282 },
 338         { 108, 0x00b33, 0x0128c, 0x2e014, 0x30284 },
 339         { 112, 0x00b33, 0x0128d, 0x2e014, 0x30286 },
 340         { 116, 0x00b33, 0x0128e, 0x2e014, 0x30288 },
 341         { 120, 0x00b33, 0x012a0, 0x2e014, 0x30280 },
 342         { 124, 0x00b33, 0x012a1, 0x2e014, 0x30282 },
 343         { 128, 0x00b33, 0x012a2, 0x2e014, 0x30284 },
 344         { 132, 0x00b33, 0x012a3, 0x2e014, 0x30286 },
 345         { 136, 0x00b33, 0x012a4, 0x2e014, 0x30288 },
 346         { 140, 0x00b33, 0x012a6, 0x2e014, 0x30280 },
 347
 348         { 149, 0x00b33, 0x012a8, 0x2e014, 0x30287 },
 349         { 153, 0x00b33, 0x012a9, 0x2e014, 0x30289 },
 350         { 157, 0x00b33, 0x012ab, 0x2e014, 0x30281 },
 351         { 161, 0x00b33, 0x012ac, 0x2e014, 0x30283 },
 352         { 165, 0x00b33, 0x012ad, 0x2e014, 0x30285 }
 353 };
 354
 355 USB_DECLARE_DRIVER(rum);
 356
 357 USB_MATCH(rum)
 358 {
 359         USB_MATCH_START(rum, uaa);
 360
 361         if (uaa->iface != NULL)
 362                 return UMATCH_NONE;
 363
 364         return (usb_lookup(rum_devs, uaa->vendor, uaa->product) != NULL) ?
 365             UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
 366 }
 367
 368 USB_ATTACH(rum)
 369 {
 370         USB_ATTACH_START(rum, sc, uaa);
 371         struct ieee80211com *ic = &sc->sc_ic;
 372         struct ifnet *ifp;
 373         const uint8_t *ucode = NULL;
 374         usb_interface_descriptor_t *id;
 375         usb_endpoint_descriptor_t *ed;
 376         usbd_status error;
 377         char devinfo[1024];
 378         int i, ntries, size;
 379         uint32_t tmp;
 380
 381         sc->sc_udev = uaa->device;
 382
 383         usbd_devinfo(sc->sc_udev, 0, devinfo);
 384         USB_ATTACH_SETUP;
 385
 386         if (usbd_set_config_no(sc->sc_udev, RT2573_CONFIG_NO, 0) != 0) {
 387                 printf("%s: could not set configuration no\n",
 388                     device_get_nameunit(sc->sc_dev));
 389                 USB_ATTACH_ERROR_RETURN;
 390         }
 391
 392         /* get the first interface handle */
 393         error = usbd_device2interface_handle(sc->sc_udev, RT2573_IFACE_INDEX,
 394             &sc->sc_iface);
 395         if (error != 0) {
 396                 printf("%s: could not get interface handle\n",
 397                     device_get_nameunit(sc->sc_dev));
 398                 USB_ATTACH_ERROR_RETURN;
 399         }
 400
 401         /*
 402          * Find endpoints.
 403          */
 404         id = usbd_get_interface_descriptor(sc->sc_iface);
 405
 406         sc->sc_rx_no = sc->sc_tx_no = -1;
 407         for (i = 0; i < id->bNumEndpoints; i++) {
 408                 ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
 409                 if (ed == NULL) {
 410                         printf("%s: no endpoint descriptor for iface %d\n",
 411                             device_get_nameunit(sc->sc_dev), i);
 412                         USB_ATTACH_ERROR_RETURN;
 413                 }
 414
 415                 if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
 416                     UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
 417                         sc->sc_rx_no = ed->bEndpointAddress;
 418                 else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
 419                     UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
 420                         sc->sc_tx_no = ed->bEndpointAddress;
 421         }
 422         if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
 423                 printf("%s: missing endpoint\n",
 424                     device_get_nameunit(sc->sc_dev));
 425                 USB_ATTACH_ERROR_RETURN;
 426         }
 427
 428         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev), MTX_NETWORK_LOCK,
 429             MTX_DEF | MTX_RECURSE);
 430
 431         usb_init_task(&sc->sc_task, rum_task, sc);
 432         callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
 433         callout_init(&sc->scan_ch, debug_mpsafenet ? CALLOUT_MPSAFE : 0);
 434
 435         callout_init(&sc->amrr_ch, 0);
 436
 437         /* retrieve RT2573 rev. no */
 438         for (ntries = 0; ntries < 1000; ntries++) {
 439                 if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
 440                         break;
 441                 DELAY(1000);
 442         }
 443         if (ntries == 1000) {
 444                 printf("%s: timeout waiting for chip to settle\n",
 445                     device_get_nameunit(sc->sc_dev));
 446                 USB_ATTACH_ERROR_RETURN;
 447         }
 448
 449         /* retrieve MAC address and various other things from EEPROM */
 450         rum_read_eeprom(sc);
 451
 452         printf("%s: MAC/BBP RT2573 (rev 0x%05x), RF %s\n",
 453             device_get_nameunit(sc->sc_dev), tmp, rum_get_rf(sc->rf_rev));
 454
 455         ucode = rt2573_ucode;
 456         size = sizeof rt2573_ucode;
 457         error = rum_load_microcode(sc, ucode, size);
 458         if (error != 0) {
 459                 device_printf(sc->sc_dev, "could not load 8051 microcode\n");
 460                 mtx_destroy(&sc->sc_mtx);
 461                 USB_ATTACH_ERROR_RETURN;
 462         }
 463
 464         ifp = sc->sc_ifp = if_alloc(IFT_ETHER);
 465         if (ifp == NULL) {
 466                 printf("%s: can not if_alloc()\n",
 467                     device_get_nameunit(sc->sc_dev));
 468                 mtx_destroy(&sc->sc_mtx);
 469                 USB_ATTACH_ERROR_RETURN;
 470         }
 471
 472         ifp->if_softc = sc;
 473         if_initname(ifp, "rum", device_get_unit(sc->sc_dev));
 474         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST |
 475             IFF_NEEDSGIANT; /* USB stack is still under Giant lock */
 476         ifp->if_init = rum_init;
 477         ifp->if_ioctl = rum_ioctl;
 478         ifp->if_start = rum_start;
 479         IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
 480         ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
 481         IFQ_SET_READY(&ifp->if_snd);
 482
 483         ic->ic_ifp = ifp;
 484         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 485         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 486         ic->ic_state = IEEE80211_S_INIT;
 487
 488         /* set device capabilities */
 489         ic->ic_caps =
 490             IEEE80211_C_IBSS |          /* IBSS mode supported */
 491             IEEE80211_C_MONITOR |       /* monitor mode supported */
 492             IEEE80211_C_HOSTAP |        /* HostAp mode supported */
 493             IEEE80211_C_TXPMGT |        /* tx power management */
 494             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 495             IEEE80211_C_SHSLOT |        /* short slot time supported */
 496             IEEE80211_C_WPA;            /* 802.11i */
 497
 498         if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
 499                 /* set supported .11a channels */
 500                 for (i = 34; i <= 46; i += 4) {
 501                         ic->ic_channels[i].ic_freq =
 502                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 503                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 504                 }
 505                 for (i = 36; i <= 64; i += 4) {
 506                         ic->ic_channels[i].ic_freq =
 507                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 508                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 509                 }
 510                 for (i = 100; i <= 140; i += 4) {
 511                         ic->ic_channels[i].ic_freq =
 512                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 513                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 514                 }
 515                 for (i = 149; i <= 165; i += 4) {
 516                         ic->ic_channels[i].ic_freq =
 517                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
 518                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
 519                 }
 520         }
 521
 522         /* set supported .11b and .11g channels (1 through 14) */
 523         for (i = 1; i <= 14; i++) {
 524                 ic->ic_channels[i].ic_freq =
 525                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
 526                 ic->ic_channels[i].ic_flags =
 527                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
 528                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
 529         }
 530
 531         ieee80211_ifattach(ic);
 532         /* enable s/w bmiss handling in sta mode */
 533         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 534
 535         /* override state transition machine */
 536         sc->sc_newstate = ic->ic_newstate;
 537         ic->ic_newstate = rum_newstate;
 538         ic->ic_raw_xmit = rum_raw_xmit;
 539         ieee80211_media_init(ic, rum_media_change, ieee80211_media_status);
 540
 541         ieee80211_amrr_init(&sc->amrr, ic, 1, 10);
 542
 543         bpfattach2(ifp, DLT_IEEE802_11_RADIO,
 544             sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN,
 545             &sc->sc_drvbpf);
 546
 547         sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
 548         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
 549         sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
 550
 551         sc->sc_txtap_len = sizeof sc->sc_txtapu;
 552         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
 553         sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
 554
 555         if (bootverbose)
 556                 ieee80211_announce(ic);
 557
 558         USB_ATTACH_SUCCESS_RETURN;
 559 }
 560
 561 USB_DETACH(rum)
 562 {
 563         USB_DETACH_START(rum, sc);
 564         struct ieee80211com *ic = &sc->sc_ic;
 565         struct ifnet *ifp = ic->ic_ifp;
 566
 567         rum_stop(sc);
 568         usb_rem_task(sc->sc_udev, &sc->sc_task);
 569         callout_stop(&sc->watchdog_ch);
 570         callout_stop(&sc->scan_ch);
 571         callout_stop(&sc->amrr_ch);
 572
 573         if (sc->amrr_xfer != NULL) {
 574                 usbd_free_xfer(sc->amrr_xfer);
 575                 sc->amrr_xfer = NULL;
 576         }
 577
 578         if (sc->sc_rx_pipeh != NULL) {
 579                 usbd_abort_pipe(sc->sc_rx_pipeh);
 580                 usbd_close_pipe(sc->sc_rx_pipeh);
 581         }
 582         if (sc->sc_tx_pipeh != NULL) {
 583                 usbd_abort_pipe(sc->sc_tx_pipeh);
 584                 usbd_close_pipe(sc->sc_tx_pipeh);
 585         }
 586
 587         rum_free_rx_list(sc);
 588         rum_free_tx_list(sc);
 589
 590         bpfdetach(ifp);
 591         ieee80211_ifdetach(ic);
 592         if_free(ifp);
 593
 594         mtx_destroy(&sc->sc_mtx);
 595
 596         return 0;
 597 }
 598
 599 static int
 600 rum_alloc_tx_list(struct rum_softc *sc)
 601 {
 602         struct rum_tx_data *data;
 603         int i, error;
 604
 605         sc->tx_queued = 0;
 606
 607         for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
 608                 data = &sc->tx_data[i];
 609
 610                 data->sc = sc;
 611
 612                 data->xfer = usbd_alloc_xfer(sc->sc_udev);
 613                 if (data->xfer == NULL) {
 614                         printf("%s: could not allocate tx xfer\n",
 615                             device_get_nameunit(sc->sc_dev));
 616                         error = ENOMEM;
 617                         goto fail;
 618                 }
 619                 data->buf = usbd_alloc_buffer(data->xfer,
 620                     RT2573_TX_DESC_SIZE + MCLBYTES);
 621                 if (data->buf == NULL) {
 622                         printf("%s: could not allocate tx buffer\n",
 623                             device_get_nameunit(sc->sc_dev));
 624                         error = ENOMEM;
 625                         goto fail;
 626                 }
 627                 /* clean Tx descriptor */
 628                 bzero(data->buf, RT2573_TX_DESC_SIZE);
 629         }
 630
 631         return 0;
 632
 633 fail:   rum_free_tx_list(sc);
 634         return error;
 635 }
 636
 637 static void
 638 rum_free_tx_list(struct rum_softc *sc)
 639 {
 640         struct rum_tx_data *data;
 641         int i;
 642
 643         for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
 644                 data = &sc->tx_data[i];
 645
 646                 if (data->xfer != NULL) {
 647                         usbd_free_xfer(data->xfer);
 648                         data->xfer = NULL;
 649                 }
 650
 651                 if (data->ni != NULL) {
 652                         ieee80211_free_node(data->ni);
 653                         data->ni = NULL;
 654                 }
 655         }
 656 }
 657
 658 static int
 659 rum_alloc_rx_list(struct rum_softc *sc)
 660 {
 661         struct rum_rx_data *data;
 662         int i, error;
 663
 664         for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
 665                 data = &sc->rx_data[i];
 666
 667                 data->sc = sc;
 668
 669                 data->xfer = usbd_alloc_xfer(sc->sc_udev);
 670                 if (data->xfer == NULL) {
 671                         printf("%s: could not allocate rx xfer\n",
 672                             device_get_nameunit(sc->sc_dev));
 673                         error = ENOMEM;
 674                         goto fail;
 675                 }
 676                 if (usbd_alloc_buffer(data->xfer, MCLBYTES) == NULL) {
 677                         printf("%s: could not allocate rx buffer\n",
 678                             device_get_nameunit(sc->sc_dev));
 679                         error = ENOMEM;
 680                         goto fail;
 681                 }
 682
 683                 data->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
 684                 if (data->m == NULL) {
 685                         printf("%s: could not allocate rx mbuf\n",
 686                             device_get_nameunit(sc->sc_dev));
 687                         error = ENOMEM;
 688                         goto fail;
 689                 }
 690
 691                 data->buf = mtod(data->m, uint8_t *);
 692         }
 693
 694         return 0;
 695
 696 fail:   rum_free_tx_list(sc);
 697         return error;
 698 }
 699
 700 static void
 701 rum_free_rx_list(struct rum_softc *sc)
 702 {
 703         struct rum_rx_data *data;
 704         int i;
 705
 706         for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
 707                 data = &sc->rx_data[i];
 708
 709                 if (data->xfer != NULL) {
 710                         usbd_free_xfer(data->xfer);
 711                         data->xfer = NULL;
 712                 }
 713                 if (data->m != NULL) {
 714                         m_freem(data->m);
 715                         data->m = NULL;
 716                 }
 717         }
 718 }
 719
 720 static int
 721 rum_media_change(struct ifnet *ifp)
 722 {
 723         struct rum_softc *sc = ifp->if_softc;
 724         int error;
 725
 726         RUM_LOCK(sc);
 727
 728         error = ieee80211_media_change(ifp);
 729         if (error != ENETRESET) {
 730                 RUM_UNLOCK(sc);
 731                 return error;
 732         }
 733
 734         if ((ifp->if_flags & IFF_UP) &&
 735             (ifp->if_drv_flags & IFF_DRV_RUNNING))
 736                 rum_init(sc);
 737
 738         RUM_UNLOCK(sc);
 739
 740         return 0;
 741 }
 742
 743 /*
 744  * This function is called periodically (every 200ms) during scanning to
 745  * switch from one channel to another.
 746  */
 747 static void
 748 rum_next_scan(void *arg)
 749 {
 750         struct rum_softc *sc = arg;
 751         struct ieee80211com *ic = &sc->sc_ic;
 752
 753         if (ic->ic_state == IEEE80211_S_SCAN)
 754                 ieee80211_next_scan(ic);
 755 }
 756
 757 static void
 758 rum_task(void *arg)
 759 {
 760         struct rum_softc *sc = arg;
 761         struct ieee80211com *ic = &sc->sc_ic;
 762         enum ieee80211_state ostate;
 763         struct ieee80211_node *ni;
 764         uint32_t tmp;
 765
 766         ostate = ic->ic_state;
 767
 768         RUM_LOCK(sc);
 769
 770         switch (sc->sc_state) {
 771         case IEEE80211_S_INIT:
 772                 if (ostate == IEEE80211_S_RUN) {
 773                         /* abort TSF synchronization */
 774                         tmp = rum_read(sc, RT2573_TXRX_CSR9);
 775                         rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
 776                 }
 777                 break;
 778
 779         case IEEE80211_S_SCAN:
 780                 rum_set_chan(sc, ic->ic_curchan);
 781                 callout_reset(&sc->scan_ch, hz / 5, rum_next_scan, sc);
 782                 break;
 783
 784         case IEEE80211_S_AUTH:
 785                 rum_set_chan(sc, ic->ic_curchan);
 786                 break;
 787
 788         case IEEE80211_S_ASSOC:
 789                 rum_set_chan(sc, ic->ic_curchan);
 790                 break;
 791
 792         case IEEE80211_S_RUN:
 793                 rum_set_chan(sc, ic->ic_curchan);
 794
 795                 ni = ic->ic_bss;
 796
 797                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 798                         rum_update_slot(ic->ic_ifp);
 799                         rum_enable_mrr(sc);
 800                         rum_set_txpreamble(sc);
 801                         rum_set_basicrates(sc);
 802                         rum_set_bssid(sc, ni->ni_bssid);
 803                 }
 804
 805                 if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
 806                     ic->ic_opmode == IEEE80211_M_IBSS)
 807                         rum_prepare_beacon(sc);
 808
 809                 if (ic->ic_opmode != IEEE80211_M_MONITOR)
 810                         rum_enable_tsf_sync(sc);
 811
 812                 /* enable automatic rate adaptation in STA mode */
 813                 if (ic->ic_opmode == IEEE80211_M_STA &&
 814                     ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
 815                         rum_amrr_start(sc, ni);
 816                 break;
 817         }
 818
 819         RUM_UNLOCK(sc);
 820
 821         sc->sc_newstate(ic, sc->sc_state, sc->sc_arg);
 822 }
 823
 824 static int
 825 rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 826 {
 827         struct rum_softc *sc = ic->ic_ifp->if_softc;
 828
 829         callout_stop(&sc->scan_ch);
 830         callout_stop(&sc->amrr_ch);
 831
 832         /* do it in a process context */
 833         sc->sc_state = nstate;
 834         sc->sc_arg = arg;
 835
 836         usb_rem_task(sc->sc_udev, &sc->sc_task);
 837         if (nstate == IEEE80211_S_INIT)
 838                 sc->sc_newstate(ic, nstate, arg);
 839         else
 840                 usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
 841         return 0;
 842 }
 843
 844 /* quickly determine if a given rate is CCK or OFDM */
 845 #define RUM_RATE_IS_OFDM(rate)  ((rate) >= 12 && (rate) != 22)
 846
 847 #define RUM_ACK_SIZE    14      /* 10 + 4(FCS) */
 848 #define RUM_CTS_SIZE    14      /* 10 + 4(FCS) */
 849
 850 static void
 851 rum_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 852 {
 853         struct rum_tx_data *data = priv;
 854         struct rum_softc *sc = data->sc;
 855         struct ifnet *ifp = sc->sc_ic.ic_ifp;
 856
 857         if (status != USBD_NORMAL_COMPLETION) {
 858                 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
 859                         return;
 860
 861                 printf("%s: could not transmit buffer: %s\n",
 862                     device_get_nameunit(sc->sc_dev), usbd_errstr(status));
 863
 864                 if (status == USBD_STALLED)
 865                         usbd_clear_endpoint_stall_async(sc->sc_tx_pipeh);
 866
 867                 ifp->if_oerrors++;
 868                 return;
 869         }
 870
 871         m_freem(data->m);
 872         data->m = NULL;
 873         ieee80211_free_node(data->ni);
 874         data->ni = NULL;
 875
 876         sc->tx_queued--;
 877         ifp->if_opackets++;
 878
 879         DPRINTFN(10, ("tx done\n"));
 880
 881         sc->sc_tx_timer = 0;
 882         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
 883         rum_start(ifp);
 884 }
 885
 886 static void
 887 rum_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
 888 {
 889         struct rum_rx_data *data = priv;
 890         struct rum_softc *sc = data->sc;
 891         struct ieee80211com *ic = &sc->sc_ic;
 892         struct ifnet *ifp = ic->ic_ifp;
 893         struct rum_rx_desc *desc;
 894         struct ieee80211_frame *wh;
 895         struct ieee80211_node *ni;
 896         struct mbuf *mnew, *m;
 897         int len;
 898
 899         if (status != USBD_NORMAL_COMPLETION) {
 900                 if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
 901                         return;
 902
 903                 if (status == USBD_STALLED)
 904                         usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
 905                 goto skip;
 906         }
 907
 908         usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
 909
 910         if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
 911                 DPRINTF(("%s: xfer too short %d\n",
 912                     device_get_nameunit(sc->sc_dev), len));
 913                 ifp->if_ierrors++;
 914                 goto skip;
 915         }
 916
 917         desc = (struct rum_rx_desc *)data->buf;
 918
 919         if (le32toh(desc->flags) & RT2573_RX_CRC_ERROR) {
 920                 /*
 921                  * This should not happen since we did not request to receive
 922                  * those frames when we filled RT2573_TXRX_CSR0.
 923                  */
 924                 DPRINTFN(5, ("CRC error\n"));
 925                 ifp->if_ierrors++;
 926                 goto skip;
 927         }
 928
 929         mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
 930         if (mnew == NULL) {
 931                 ifp->if_ierrors++;
 932                 goto skip;
 933         }
 934
 935         m = data->m;
 936         data->m = mnew;
 937         data->buf = mtod(data->m, uint8_t *);
 938
 939         /* finalize mbuf */
 940         m->m_pkthdr.rcvif = ifp;
 941         m->m_data = (caddr_t)(desc + 1);
 942         m->m_pkthdr.len = m->m_len = (le32toh(desc->flags) >> 16) & 0xfff;
 943
 944         if (bpf_peers_present(sc->sc_drvbpf)) {
 945                 struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
 946
 947                 tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
 948                 tap->wr_rate = rum_rxrate(desc);
 949                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
 950                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
 951                 tap->wr_antenna = sc->rx_ant;
 952                 tap->wr_antsignal = desc->rssi;
 953
 954                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
 955         }
 956
 957         wh = mtod(m, struct ieee80211_frame *);
 958         ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
 959
 960         /* send the frame to the 802.11 layer */
 961         ieee80211_input(ic, m, ni, desc->rssi, 0);
 962
 963         /* node is no longer needed */
 964         ieee80211_free_node(ni);
 965
 966         DPRINTFN(15, ("rx done\n"));
 967
 968 skip:   /* setup a new transfer */
 969         usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data, data->buf, MCLBYTES,
 970             USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
 971         usbd_transfer(xfer);
 972 }
 973
 974 /*
 975  * This function is only used by the Rx radiotap code.
 976  */
 977 static int
 978 rum_rxrate(struct rum_rx_desc *desc)
 979 {
 980         if (le32toh(desc->flags) & RT2573_RX_OFDM) {
 981                 /* reverse function of rum_plcp_signal */
 982                 switch (desc->rate) {
 983                 case 0xb:       return 12;
 984                 case 0xf:       return 18;
 985                 case 0xa:       return 24;
 986                 case 0xe:       return 36;
 987                 case 0x9:       return 48;
 988                 case 0xd:       return 72;
 989                 case 0x8:       return 96;
 990                 case 0xc:       return 108;
 991                 }
 992         } else {
 993                 if (desc->rate == 10)
 994                         return 2;
 995                 if (desc->rate == 20)
 996                         return 4;
 997                 if (desc->rate == 55)
 998                         return 11;
 999                 if (desc->rate == 110)
1000                         return 22;
1001         }
1002         return 2;       /* should not get there */
1003 }
1004
1005 /*
1006  * Return the expected ack rate for a frame transmitted at rate `rate'.
1007  */
1008 static int
1009 rum_ack_rate(struct ieee80211com *ic, int rate)
1010 {
1011         switch (rate) {
1012         /* CCK rates */
1013         case 2:
1014                 return 2;
1015         case 4:
1016         case 11:
1017         case 22:
1018                 return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1019
1020         /* OFDM rates */
1021         case 12:
1022         case 18:
1023                 return 12;
1024         case 24:
1025         case 36:
1026                 return 24;
1027         case 48:
1028         case 72:
1029         case 96:
1030         case 108:
1031                 return 48;
1032         }
1033
1034         /* default to 1Mbps */
1035         return 2;
1036 }
1037
1038 /*
1039  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1040  * The function automatically determines the operating mode depending on the
1041  * given rate. `flags' indicates whether short preamble is in use or not.
1042  */
1043 static uint16_t
1044 rum_txtime(int len, int rate, uint32_t flags)
1045 {
1046         uint16_t txtime;
1047
1048         if (RUM_RATE_IS_OFDM(rate)) {
1049                 /* IEEE Std 802.11a-1999, pp. 37 */
1050                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1051                 txtime = 16 + 4 + 4 * txtime + 6;
1052         } else {
1053                 /* IEEE Std 802.11b-1999, pp. 28 */
1054                 txtime = (16 * len + rate - 1) / rate;
1055                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1056                         txtime +=  72 + 24;
1057                 else
1058                         txtime += 144 + 48;
1059         }
1060         return txtime;
1061 }
1062
1063 static uint8_t
1064 rum_plcp_signal(int rate)
1065 {
1066         switch (rate) {
1067         /* CCK rates (returned values are device-dependent) */
1068         case 2:         return 0x0;
1069         case 4:         return 0x1;
1070         case 11:        return 0x2;
1071         case 22:        return 0x3;
1072
1073         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1074         case 12:        return 0xb;
1075         case 18:        return 0xf;
1076         case 24:        return 0xa;
1077         case 36:        return 0xe;
1078         case 48:        return 0x9;
1079         case 72:        return 0xd;
1080         case 96:        return 0x8;
1081         case 108:       return 0xc;
1082
1083         /* unsupported rates (should not get there) */
1084         default:        return 0xff;
1085         }
1086 }
1087
1088 static void
1089 rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1090     uint32_t flags, uint16_t xflags, int len, int rate)
1091 {
1092         struct ieee80211com *ic = &sc->sc_ic;
1093         uint16_t plcp_length;
1094         int remainder;
1095
1096         desc->flags = htole32(flags);
1097         desc->flags |= htole32(RT2573_TX_VALID);
1098         desc->flags |= htole32(len << 16);
1099
1100         desc->xflags = htole16(xflags);
1101
1102         desc->wme = htole16(RT2573_QID(0) | RT2573_AIFSN(2) |
1103             RT2573_LOGCWMIN(4) | RT2573_LOGCWMAX(10));
1104
1105         /* setup PLCP fields */
1106         desc->plcp_signal  = rum_plcp_signal(rate);
1107         desc->plcp_service = 4;
1108
1109         len += IEEE80211_CRC_LEN;
1110         if (RUM_RATE_IS_OFDM(rate)) {
1111                 desc->flags |= htole32(RT2573_TX_OFDM);
1112
1113                 plcp_length = len & 0xfff;
1114                 desc->plcp_length_hi = plcp_length >> 6;
1115                 desc->plcp_length_lo = plcp_length & 0x3f;
1116         } else {
1117                 plcp_length = (16 * len + rate - 1) / rate;
1118                 if (rate == 22) {
1119                         remainder = (16 * len) % 22;
1120                         if (remainder != 0 && remainder < 7)
1121                                 desc->plcp_service |= RT2573_PLCP_LENGEXT;
1122                 }
1123                 desc->plcp_length_hi = plcp_length >> 8;
1124                 desc->plcp_length_lo = plcp_length & 0xff;
1125
1126                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1127                         desc->plcp_signal |= 0x08;
1128         }
1129 }
1130
1131 #define RUM_TX_TIMEOUT  5000
1132
1133 static int
1134 rum_tx_mgt(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1135 {
1136         struct ieee80211com *ic = &sc->sc_ic;
1137         struct rum_tx_desc *desc;
1138         struct rum_tx_data *data;
1139         struct ieee80211_frame *wh;
1140         uint32_t flags = 0;
1141         uint16_t dur;
1142         usbd_status error;
1143         int xferlen, rate;
1144
1145         data = &sc->tx_data[0];
1146         desc = (struct rum_tx_desc *)data->buf;
1147
1148         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1149
1150         data->m = m0;
1151         data->ni = ni;
1152
1153         wh = mtod(m0, struct ieee80211_frame *);
1154
1155         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1156                 flags |= RT2573_TX_NEED_ACK;
1157
1158                 dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1159                     ic->ic_flags) + sc->sifs;
1160                 *(uint16_t *)wh->i_dur = htole16(dur);
1161
1162                 /* tell hardware to add timestamp for probe responses */
1163                 if ((wh->i_fc[0] &
1164                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1165                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1166                         flags |= RT2573_TX_TIMESTAMP;
1167         }
1168
1169         if (bpf_peers_present(sc->sc_drvbpf)) {
1170                 struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1171
1172                 tap->wt_flags = 0;
1173                 tap->wt_rate = rate;
1174                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1175                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1176                 tap->wt_antenna = sc->tx_ant;
1177
1178                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1179         }
1180
1181         m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1182         rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1183
1184         /* align end on a 4-bytes boundary */
1185         xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1186
1187         /*
1188          * No space left in the last URB to store the extra 4 bytes, force
1189          * sending of another URB.
1190          */
1191         if ((xferlen % 64) == 0)
1192                 xferlen += 4;
1193
1194         DPRINTFN(10, ("sending mgt frame len=%d rate=%d xfer len=%d\n",
1195             m0->m_pkthdr.len + (int)RT2573_TX_DESC_SIZE, rate, xferlen));
1196
1197         usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1198             USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1199
1200         error = usbd_transfer(data->xfer);
1201         if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1202                 m_freem(m0);
1203                 data->m = NULL;
1204                 data->ni = NULL;
1205                 return error;
1206         }
1207
1208         sc->tx_queued++;
1209
1210         return 0;
1211 }
1212
1213 static int
1214 rum_tx_raw(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1215     const struct ieee80211_bpf_params *params)
1216 {
1217         struct ieee80211com *ic = &sc->sc_ic;
1218         struct rum_tx_desc *desc;
1219         struct rum_tx_data *data;
1220         uint32_t flags;
1221         usbd_status error;
1222         int xferlen, rate;
1223
1224         data = &sc->tx_data[0];
1225         desc = (struct rum_tx_desc *)data->buf;
1226
1227         rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1228         /* XXX validate */
1229         if (rate == 0) {
1230                 m_freem(m0);
1231                 return EINVAL;
1232         }
1233
1234         if (bpf_peers_present(sc->sc_drvbpf)) {
1235                 struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1236
1237                 tap->wt_flags = 0;
1238                 tap->wt_rate = rate;
1239                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1240                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1241                 tap->wt_antenna = sc->tx_ant;
1242
1243                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1244         }
1245
1246         data->m = m0;
1247         data->ni = ni;
1248
1249         flags = 0;
1250         if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1251                 flags |= RT2573_TX_NEED_ACK;
1252
1253         m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1254         /* XXX need to setup descriptor ourself */
1255         rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1256
1257         /* align end on a 4-bytes boundary */
1258         xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1259
1260         /*
1261          * No space left in the last URB to store the extra 4 bytes, force
1262          * sending of another URB.
1263          */
1264         if ((xferlen % 64) == 0)
1265                 xferlen += 4;
1266
1267         DPRINTFN(10, ("sending raw frame len=%u rate=%u xfer len=%u\n",
1268             m0->m_pkthdr.len, rate, xferlen));
1269
1270         usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf,
1271             xferlen, USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT,
1272             rum_txeof);
1273
1274         error = usbd_transfer(data->xfer);
1275         if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS)
1276                 return error;
1277
1278         sc->tx_queued++;
1279
1280         return 0;
1281 }
1282
1283 static int
1284 rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1285 {
1286         struct ieee80211com *ic = &sc->sc_ic;
1287         struct rum_tx_desc *desc;
1288         struct rum_tx_data *data;
1289         struct ieee80211_frame *wh;
1290         struct ieee80211_key *k;
1291         uint32_t flags = 0;
1292         uint16_t dur;
1293         usbd_status error;
1294         int rate, xferlen;
1295
1296         wh = mtod(m0, struct ieee80211_frame *);
1297
1298         if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
1299                 rate = ic->ic_bss->ni_rates.rs_rates[ic->ic_fixed_rate];
1300         else
1301                 rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1302
1303         rate &= IEEE80211_RATE_VAL;
1304
1305         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1306                 k = ieee80211_crypto_encap(ic, ni, m0);
1307                 if (k == NULL) {
1308                         m_freem(m0);
1309                         return ENOBUFS;
1310                 }
1311
1312                 /* packet header may have moved, reset our local pointer */
1313                 wh = mtod(m0, struct ieee80211_frame *);
1314         }
1315
1316         data = &sc->tx_data[0];
1317         desc = (struct rum_tx_desc *)data->buf;
1318
1319         data->m = m0;
1320         data->ni = ni;
1321
1322         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1323                 flags |= RT2573_TX_NEED_ACK;
1324                 flags |= RT2573_TX_MORE_FRAG;
1325
1326                 dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1327                     ic->ic_flags) + sc->sifs;
1328                 *(uint16_t *)wh->i_dur = htole16(dur);
1329         }
1330
1331         if (bpf_peers_present(sc->sc_drvbpf)) {
1332                 struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1333
1334                 tap->wt_flags = 0;
1335                 tap->wt_rate = rate;
1336                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1337                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1338                 tap->wt_antenna = sc->tx_ant;
1339
1340                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1341         }
1342
1343         m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1344         rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1345
1346         /* align end on a 4-bytes boundary */
1347         xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1348
1349         /*
1350          * No space left in the last URB to store the extra 4 bytes, force
1351          * sending of another URB.
1352          */
1353         if ((xferlen % 64) == 0)
1354                 xferlen += 4;
1355
1356         DPRINTFN(10, ("sending frame len=%d rate=%d xfer len=%d\n",
1357             m0->m_pkthdr.len + (int)RT2573_TX_DESC_SIZE, rate, xferlen));
1358
1359         usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1360             USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1361
1362         error = usbd_transfer(data->xfer);
1363         if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1364                 m_freem(m0);
1365                 data->m = NULL;
1366                 data->ni = NULL;
1367                 return error;
1368         }
1369
1370         sc->tx_queued++;
1371
1372         return 0;
1373 }
1374
1375 static void
1376 rum_start(struct ifnet *ifp)
1377 {
1378         struct rum_softc *sc = ifp->if_softc;
1379         struct ieee80211com *ic = &sc->sc_ic;
1380         struct ieee80211_node *ni;
1381         struct mbuf *m0;
1382         struct ether_header *eh;
1383
1384         RUM_LOCK(sc);
1385
1386         for (;;) {
1387                 IF_POLL(&ic->ic_mgtq, m0);
1388                 if (m0 != NULL) {
1389                         if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1390                                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1391                                 break;
1392                         }
1393                         IF_DEQUEUE(&ic->ic_mgtq, m0);
1394
1395                         ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1396                         m0->m_pkthdr.rcvif = NULL;
1397
1398                         if (bpf_peers_present(ic->ic_rawbpf))
1399                                 bpf_mtap(ic->ic_rawbpf, m0);
1400
1401                         if (rum_tx_mgt(sc, m0, ni) != 0) {
1402                                 ieee80211_free_node(ni);
1403                                 break;
1404                         }
1405                 } else {
1406                         if (ic->ic_state != IEEE80211_S_RUN)
1407                                 break;
1408                         IFQ_DRV_DEQUEUE(&ifp->if_snd, m0);
1409                         if (m0 == NULL)
1410                                 break;
1411                         if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1412                                 IFQ_DRV_PREPEND(&ifp->if_snd, m0);
1413                                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1414                                 break;
1415                         }
1416
1417                         if (m0->m_len < sizeof (struct ether_header) &&
1418                             !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1419                                 continue;
1420
1421                         eh = mtod(m0, struct ether_header *);
1422                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1423                         if (ni == NULL) {
1424                                 m_freem(m0);
1425                                 continue;
1426                         }
1427                         BPF_MTAP(ifp, m0);
1428
1429                         m0 = ieee80211_encap(ic, m0, ni);
1430                         if (m0 == NULL) {
1431                                 ieee80211_free_node(ni);
1432                                 continue;
1433                         }
1434
1435                         if (bpf_peers_present(ic->ic_rawbpf))
1436                                 bpf_mtap(ic->ic_rawbpf, m0);
1437
1438                         if (rum_tx_data(sc, m0, ni) != 0) {
1439                                 ieee80211_free_node(ni);
1440                                 ifp->if_oerrors++;
1441                                 break;
1442                         }
1443                 }
1444
1445                 sc->sc_tx_timer = 5;
1446                 callout_reset(&sc->watchdog_ch, hz, rum_watchdog, sc);
1447         }
1448
1449         RUM_UNLOCK(sc);
1450 }
1451
1452 static void
1453 rum_watchdog(void *arg)
1454 {
1455         struct rum_softc *sc = (struct rum_softc *)arg;
1456         struct ieee80211com *ic = &sc->sc_ic;
1457
1458         if (sc->sc_tx_timer > 0) {
1459                 if (--sc->sc_tx_timer == 0) {
1460                         device_printf(sc->sc_dev, "device timeout\n");
1461                         /*rum_init(ifp); XXX needs a process context! */
1462                         sc->sc_ifp->if_oerrors++;
1463                         return;
1464                 }
1465                 callout_reset(&sc->watchdog_ch, hz, rum_watchdog, sc);
1466         }
1467
1468         ieee80211_watchdog(ic);
1469 }
1470
1471 static int
1472 rum_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1473 {
1474         struct rum_softc *sc = ifp->if_softc;
1475         struct ieee80211com *ic = &sc->sc_ic;
1476         int error = 0;
1477
1478         RUM_LOCK(sc);
1479
1480         switch (cmd) {
1481         case SIOCSIFFLAGS:
1482                 if (ifp->if_flags & IFF_UP) {
1483                         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1484                                 rum_update_promisc(sc);
1485                         else
1486                                 rum_init(sc);
1487                 } else {
1488                         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1489                                 rum_stop(sc);
1490                 }
1491                 break;
1492         default:
1493                 error = ieee80211_ioctl(ic, cmd, data);
1494         }
1495
1496         if (error == ENETRESET) {
1497                 if ((ifp->if_flags & IFF_UP) &&
1498                     (ifp->if_drv_flags & IFF_DRV_RUNNING) &&
1499                     (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
1500                         rum_init(sc);
1501                 error = 0;
1502         }
1503
1504         RUM_UNLOCK(sc);
1505
1506         return error;
1507 }
1508
1509 static void
1510 rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1511 {
1512         usb_device_request_t req;
1513         usbd_status error;
1514
1515         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1516         req.bRequest = RT2573_READ_EEPROM;
1517         USETW(req.wValue, 0);
1518         USETW(req.wIndex, addr);
1519         USETW(req.wLength, len);
1520
1521         error = usbd_do_request(sc->sc_udev, &req, buf);
1522         if (error != 0) {
1523                 printf("%s: could not read EEPROM: %s\n",
1524                     device_get_nameunit(sc->sc_dev), usbd_errstr(error));
1525         }
1526 }
1527
1528 static uint32_t
1529 rum_read(struct rum_softc *sc, uint16_t reg)
1530 {
1531         uint32_t val;
1532
1533         rum_read_multi(sc, reg, &val, sizeof val);
1534
1535         return le32toh(val);
1536 }
1537
1538 static void
1539 rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1540 {
1541         usb_device_request_t req;
1542         usbd_status error;
1543
1544         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1545         req.bRequest = RT2573_READ_MULTI_MAC;
1546         USETW(req.wValue, 0);
1547         USETW(req.wIndex, reg);
1548         USETW(req.wLength, len);
1549
1550         error = usbd_do_request(sc->sc_udev, &req, buf);
1551         if (error != 0) {
1552                 printf("%s: could not multi read MAC register: %s\n",
1553                     device_get_nameunit(sc->sc_dev), usbd_errstr(error));
1554         }
1555 }
1556
1557 static void
1558 rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1559 {
1560         uint32_t tmp = htole32(val);
1561
1562         rum_write_multi(sc, reg, &tmp, sizeof tmp);
1563 }
1564
1565 static void
1566 rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1567 {
1568         usb_device_request_t req;
1569         usbd_status error;
1570
1571         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1572         req.bRequest = RT2573_WRITE_MULTI_MAC;
1573         USETW(req.wValue, 0);
1574         USETW(req.wIndex, reg);
1575         USETW(req.wLength, len);
1576
1577         error = usbd_do_request(sc->sc_udev, &req, buf);
1578         if (error != 0) {
1579                 printf("%s: could not multi write MAC register: %s\n",
1580                     device_get_nameunit(sc->sc_dev), usbd_errstr(error));
1581         }
1582 }
1583
1584 static void
1585 rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1586 {
1587         uint32_t tmp;
1588         int ntries;
1589
1590         for (ntries = 0; ntries < 5; ntries++) {
1591                 if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1592                         break;
1593         }
1594         if (ntries == 5) {
1595                 printf("%s: could not write to BBP\n",
1596                     device_get_nameunit(sc->sc_dev));
1597                 return;
1598         }
1599
1600         tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1601         rum_write(sc, RT2573_PHY_CSR3, tmp);
1602 }
1603
1604 static uint8_t
1605 rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1606 {
1607         uint32_t val;
1608         int ntries;
1609
1610         for (ntries = 0; ntries < 5; ntries++) {
1611                 if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1612                         break;
1613         }
1614         if (ntries == 5) {
1615                 printf("%s: could not read BBP\n",
1616                     device_get_nameunit(sc->sc_dev));
1617                 return 0;
1618         }
1619
1620         val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1621         rum_write(sc, RT2573_PHY_CSR3, val);
1622
1623         for (ntries = 0; ntries < 100; ntries++) {
1624                 val = rum_read(sc, RT2573_PHY_CSR3);
1625                 if (!(val & RT2573_BBP_BUSY))
1626                         return val & 0xff;
1627                 DELAY(1);
1628         }
1629
1630         printf("%s: could not read BBP\n", device_get_nameunit(sc->sc_dev));
1631         return 0;
1632 }
1633
1634 static void
1635 rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1636 {
1637         uint32_t tmp;
1638         int ntries;
1639
1640         for (ntries = 0; ntries < 5; ntries++) {
1641                 if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1642                         break;
1643         }
1644         if (ntries == 5) {
1645                 printf("%s: could not write to RF\n",
1646                     device_get_nameunit(sc->sc_dev));
1647                 return;
1648         }
1649
1650         tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1651             (reg & 3);
1652         rum_write(sc, RT2573_PHY_CSR4, tmp);
1653
1654         /* remember last written value in sc */
1655         sc->rf_regs[reg] = val;
1656
1657         DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff));
1658 }
1659
1660 static void
1661 rum_select_antenna(struct rum_softc *sc)
1662 {
1663         uint8_t bbp4, bbp77;
1664         uint32_t tmp;
1665
1666         bbp4  = rum_bbp_read(sc, 4);
1667         bbp77 = rum_bbp_read(sc, 77);
1668
1669         /* TBD */
1670
1671         /* make sure Rx is disabled before switching antenna */
1672         tmp = rum_read(sc, RT2573_TXRX_CSR0);
1673         rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1674
1675         rum_bbp_write(sc,  4, bbp4);
1676         rum_bbp_write(sc, 77, bbp77);
1677
1678         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1679 }
1680
1681 /*
1682  * Enable multi-rate retries for frames sent at OFDM rates.
1683  * In 802.11b/g mode, allow fallback to CCK rates.
1684  */
1685 static void
1686 rum_enable_mrr(struct rum_softc *sc)
1687 {
1688         struct ieee80211com *ic = &sc->sc_ic;
1689         uint32_t tmp;
1690
1691         tmp = rum_read(sc, RT2573_TXRX_CSR4);
1692
1693         tmp &= ~RT2573_MRR_CCK_FALLBACK;
1694         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1695                 tmp |= RT2573_MRR_CCK_FALLBACK;
1696         tmp |= RT2573_MRR_ENABLED;
1697
1698         rum_write(sc, RT2573_TXRX_CSR4, tmp);
1699 }
1700
1701 static void
1702 rum_set_txpreamble(struct rum_softc *sc)
1703 {
1704         uint32_t tmp;
1705
1706         tmp = rum_read(sc, RT2573_TXRX_CSR4);
1707
1708         tmp &= ~RT2573_SHORT_PREAMBLE;
1709         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1710                 tmp |= RT2573_SHORT_PREAMBLE;
1711
1712         rum_write(sc, RT2573_TXRX_CSR4, tmp);
1713 }
1714
1715 static void
1716 rum_set_basicrates(struct rum_softc *sc)
1717 {
1718         struct ieee80211com *ic = &sc->sc_ic;
1719
1720         /* update basic rate set */
1721         if (ic->ic_curmode == IEEE80211_MODE_11B) {
1722                 /* 11b basic rates: 1, 2Mbps */
1723                 rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1724         } else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan)) {
1725                 /* 11a basic rates: 6, 12, 24Mbps */
1726                 rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1727         } else {
1728                 /* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1729                 rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1730         }
1731 }
1732
1733 /*
1734  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1735  * driver.
1736  */
1737 static void
1738 rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1739 {
1740         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1741         uint32_t tmp;
1742
1743         /* update all BBP registers that depend on the band */
1744         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1745         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1746         if (IEEE80211_IS_CHAN_5GHZ(c)) {
1747                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1748                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1749         }
1750         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1751             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1752                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1753         }
1754
1755         sc->bbp17 = bbp17;
1756         rum_bbp_write(sc,  17, bbp17);
1757         rum_bbp_write(sc,  96, bbp96);
1758         rum_bbp_write(sc, 104, bbp104);
1759
1760         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1761             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1762                 rum_bbp_write(sc, 75, 0x80);
1763                 rum_bbp_write(sc, 86, 0x80);
1764                 rum_bbp_write(sc, 88, 0x80);
1765         }
1766
1767         rum_bbp_write(sc, 35, bbp35);
1768         rum_bbp_write(sc, 97, bbp97);
1769         rum_bbp_write(sc, 98, bbp98);
1770
1771         tmp = rum_read(sc, RT2573_PHY_CSR0);
1772         tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1773         if (IEEE80211_IS_CHAN_2GHZ(c))
1774                 tmp |= RT2573_PA_PE_2GHZ;
1775         else
1776                 tmp |= RT2573_PA_PE_5GHZ;
1777         rum_write(sc, RT2573_PHY_CSR0, tmp);
1778
1779         /* 802.11a uses a 16 microseconds short interframe space */
1780         sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1781 }
1782
1783 static void
1784 rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1785 {
1786         struct ieee80211com *ic = &sc->sc_ic;
1787         const struct rfprog *rfprog;
1788         uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1789         int8_t power;
1790         u_int i, chan;
1791
1792         chan = ieee80211_chan2ieee(ic, c);
1793         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1794                 return;
1795
1796         /* select the appropriate RF settings based on what EEPROM says */
1797         rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1798                   sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1799
1800         /* find the settings for this channel (we know it exists) */
1801         for (i = 0; rfprog[i].chan != chan; i++);
1802
1803         power = sc->txpow[i];
1804         if (power < 0) {
1805                 bbp94 += power;
1806                 power = 0;
1807         } else if (power > 31) {
1808                 bbp94 += power - 31;
1809                 power = 31;
1810         }
1811
1812         /*
1813          * If we are switching from the 2GHz band to the 5GHz band or
1814          * vice-versa, BBP registers need to be reprogrammed.
1815          */
1816         if (c->ic_flags != ic->ic_curchan->ic_flags) {
1817                 rum_select_band(sc, c);
1818                 rum_select_antenna(sc);
1819         }
1820         ic->ic_curchan = c;
1821
1822         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1823         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1824         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1825         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1826
1827         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1828         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1829         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1830         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1831
1832         rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1833         rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1834         rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1835         rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1836
1837         DELAY(10);
1838
1839         /* enable smart mode for MIMO-capable RFs */
1840         bbp3 = rum_bbp_read(sc, 3);
1841
1842         bbp3 &= ~RT2573_SMART_MODE;
1843         if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1844                 bbp3 |= RT2573_SMART_MODE;
1845
1846         rum_bbp_write(sc, 3, bbp3);
1847
1848         if (bbp94 != RT2573_BBPR94_DEFAULT)
1849                 rum_bbp_write(sc, 94, bbp94);
1850 }
1851
1852 /*
1853  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1854  * and HostAP operating modes.
1855  */
1856 static void
1857 rum_enable_tsf_sync(struct rum_softc *sc)
1858 {
1859         struct ieee80211com *ic = &sc->sc_ic;
1860         uint32_t tmp;
1861
1862         if (ic->ic_opmode != IEEE80211_M_STA) {
1863                 /*
1864                  * Change default 16ms TBTT adjustment to 8ms.
1865                  * Must be done before enabling beacon generation.
1866                  */
1867                 rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1868         }
1869
1870         tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1871
1872         /* set beacon interval (in 1/16ms unit) */
1873         tmp |= ic->ic_bss->ni_intval * 16;
1874
1875         tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1876         if (ic->ic_opmode == IEEE80211_M_STA)
1877                 tmp |= RT2573_TSF_MODE(1);
1878         else
1879                 tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1880
1881         rum_write(sc, RT2573_TXRX_CSR9, tmp);
1882 }
1883
1884 static void
1885 rum_update_slot(struct ifnet *ifp)
1886 {
1887         struct rum_softc *sc = ifp->if_softc;
1888         struct ieee80211com *ic = &sc->sc_ic;
1889         uint8_t slottime;
1890         uint32_t tmp;
1891
1892         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1893
1894         tmp = rum_read(sc, RT2573_MAC_CSR9);
1895         tmp = (tmp & ~0xff) | slottime;
1896         rum_write(sc, RT2573_MAC_CSR9, tmp);
1897
1898         DPRINTF(("setting slot time to %uus\n", slottime));
1899 }
1900
1901 static void
1902 rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1903 {
1904         uint32_t tmp;
1905
1906         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1907         rum_write(sc, RT2573_MAC_CSR4, tmp);
1908
1909         tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1910         rum_write(sc, RT2573_MAC_CSR5, tmp);
1911 }
1912
1913 static void
1914 rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1915 {
1916         uint32_t tmp;
1917
1918         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1919         rum_write(sc, RT2573_MAC_CSR2, tmp);
1920
1921         tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1922         rum_write(sc, RT2573_MAC_CSR3, tmp);
1923 }
1924
1925 static void
1926 rum_update_promisc(struct rum_softc *sc)
1927 {
1928         struct ifnet *ifp = sc->sc_ic.ic_ifp;
1929         uint32_t tmp;
1930
1931         tmp = rum_read(sc, RT2573_TXRX_CSR0);
1932
1933         tmp &= ~RT2573_DROP_NOT_TO_ME;
1934         if (!(ifp->if_flags & IFF_PROMISC))
1935                 tmp |= RT2573_DROP_NOT_TO_ME;
1936
1937         rum_write(sc, RT2573_TXRX_CSR0, tmp);
1938
1939         DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1940             "entering" : "leaving"));
1941 }
1942
1943 static const char *
1944 rum_get_rf(int rev)
1945 {
1946         switch (rev) {
1947         case RT2573_RF_2527:    return "RT2527 (MIMO XR)";
1948         case RT2573_RF_2528:    return "RT2528";
1949         case RT2573_RF_5225:    return "RT5225 (MIMO XR)";
1950         case RT2573_RF_5226:    return "RT5226";
1951         default:                return "unknown";
1952         }
1953 }
1954
1955 static void
1956 rum_read_eeprom(struct rum_softc *sc)
1957 {
1958         struct ieee80211com *ic = &sc->sc_ic;
1959         uint16_t val;
1960 #ifdef RUM_DEBUG
1961         int i;
1962 #endif
1963
1964         /* read MAC address */
1965         rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1966
1967         rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1968         val = le16toh(val);
1969         sc->rf_rev =   (val >> 11) & 0x1f;
1970         sc->hw_radio = (val >> 10) & 0x1;
1971         sc->rx_ant =   (val >> 4)  & 0x3;
1972         sc->tx_ant =   (val >> 2)  & 0x3;
1973         sc->nb_ant =   val & 0x3;
1974
1975         DPRINTF(("RF revision=%d\n", sc->rf_rev));
1976
1977         rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1978         val = le16toh(val);
1979         sc->ext_5ghz_lna = (val >> 6) & 0x1;
1980         sc->ext_2ghz_lna = (val >> 4) & 0x1;
1981
1982         DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1983             sc->ext_2ghz_lna, sc->ext_5ghz_lna));
1984
1985         rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1986         val = le16toh(val);
1987         if ((val & 0xff) != 0xff)
1988                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
1989
1990         rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1991         val = le16toh(val);
1992         if ((val & 0xff) != 0xff)
1993                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
1994
1995         DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1996             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
1997
1998         rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1999         val = le16toh(val);
2000         if ((val & 0xff) != 0xff)
2001                 sc->rffreq = val & 0xff;
2002
2003         DPRINTF(("RF freq=%d\n", sc->rffreq));
2004
2005         /* read Tx power for all a/b/g channels */
2006         rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
2007         /* XXX default Tx power for 802.11a channels */
2008         memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
2009 #ifdef RUM_DEBUG
2010         for (i = 0; i < 14; i++)
2011                 DPRINTF(("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]));
2012 #endif
2013
2014         /* read default values for BBP registers */
2015         rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
2016 #ifdef RUM_DEBUG
2017         for (i = 0; i < 14; i++) {
2018                 if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
2019                         continue;
2020                 DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
2021                     sc->bbp_prom[i].val));
2022         }
2023 #endif
2024 }
2025
2026 static int
2027 rum_bbp_init(struct rum_softc *sc)
2028 {
2029 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
2030         int i, ntries;
2031
2032         /* wait for BBP to be ready */
2033         for (ntries = 0; ntries < 100; ntries++) {
2034                 const uint8_t val = rum_bbp_read(sc, 0);
2035                 if (val != 0 && val != 0xff)
2036                         break;
2037                 DELAY(1000);
2038         }
2039         if (ntries == 100) {
2040                 device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2041                 return EIO;
2042         }
2043
2044         /* initialize BBP registers to default values */
2045         for (i = 0; i < N(rum_def_bbp); i++)
2046                 rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
2047
2048         /* write vendor-specific BBP values (from EEPROM) */
2049         for (i = 0; i < 16; i++) {
2050                 if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
2051                         continue;
2052                 rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2053         }
2054
2055         return 0;
2056 #undef N
2057 }
2058
2059 static void
2060 rum_init(void *priv)
2061 {
2062 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
2063         struct rum_softc *sc = priv;
2064         struct ieee80211com *ic = &sc->sc_ic;
2065         struct ifnet *ifp = ic->ic_ifp;
2066         struct rum_rx_data *data;
2067         uint32_t tmp;
2068         usbd_status error;
2069         int i, ntries;
2070
2071         rum_stop(sc);
2072
2073         /* initialize MAC registers to default values */
2074         for (i = 0; i < N(rum_def_mac); i++)
2075                 rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
2076
2077         /* set host ready */
2078         rum_write(sc, RT2573_MAC_CSR1, 3);
2079         rum_write(sc, RT2573_MAC_CSR1, 0);
2080
2081         /* wait for BBP/RF to wakeup */
2082         for (ntries = 0; ntries < 1000; ntries++) {
2083                 if (rum_read(sc, RT2573_MAC_CSR12) & 8)
2084                         break;
2085                 rum_write(sc, RT2573_MAC_CSR12, 4);     /* force wakeup */
2086                 DELAY(1000);
2087         }
2088         if (ntries == 1000) {
2089                 printf("%s: timeout waiting for BBP/RF to wakeup\n",
2090                     device_get_nameunit(sc->sc_dev));
2091                 goto fail;
2092         }
2093
2094         if ((error = rum_bbp_init(sc)) != 0)
2095                 goto fail;
2096
2097         /* select default channel */
2098         rum_select_band(sc, ic->ic_curchan);
2099         rum_select_antenna(sc);
2100         rum_set_chan(sc, ic->ic_curchan);
2101
2102         /* clear STA registers */
2103         rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2104
2105         IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2106         rum_set_macaddr(sc, ic->ic_myaddr);
2107
2108         /* initialize ASIC */
2109         rum_write(sc, RT2573_MAC_CSR1, 4);
2110
2111         /*
2112          * Allocate xfer for AMRR statistics requests.
2113          */
2114         sc->amrr_xfer = usbd_alloc_xfer(sc->sc_udev);
2115         if (sc->amrr_xfer == NULL) {
2116                 printf("%s: could not allocate AMRR xfer\n",
2117                     device_get_nameunit(sc->sc_dev));
2118                 goto fail;
2119         }
2120
2121         /*
2122          * Open Tx and Rx USB bulk pipes.
2123          */
2124         error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
2125             &sc->sc_tx_pipeh);
2126         if (error != 0) {
2127                 printf("%s: could not open Tx pipe: %s\n",
2128                     device_get_nameunit(sc->sc_dev), usbd_errstr(error));
2129                 goto fail;
2130         }
2131         error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
2132             &sc->sc_rx_pipeh);
2133         if (error != 0) {
2134                 printf("%s: could not open Rx pipe: %s\n",
2135                     device_get_nameunit(sc->sc_dev), usbd_errstr(error));
2136                 goto fail;
2137         }
2138
2139         /*
2140          * Allocate Tx and Rx xfer queues.
2141          */
2142         error = rum_alloc_tx_list(sc);
2143         if (error != 0) {
2144                 printf("%s: could not allocate Tx list\n",
2145                     device_get_nameunit(sc->sc_dev));
2146                 goto fail;
2147         }
2148         error = rum_alloc_rx_list(sc);
2149         if (error != 0) {
2150                 printf("%s: could not allocate Rx list\n",
2151                     device_get_nameunit(sc->sc_dev));
2152                 goto fail;
2153         }
2154
2155         /*
2156          * Start up the receive pipe.
2157          */
2158         for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
2159                 data = &sc->rx_data[i];
2160
2161                 usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf,
2162                     MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
2163                 usbd_transfer(data->xfer);
2164         }
2165
2166         /* update Rx filter */
2167         tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2168
2169         tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2170         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2171                 tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2172                        RT2573_DROP_ACKCTS;
2173                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2174                         tmp |= RT2573_DROP_TODS;
2175                 if (!(ifp->if_flags & IFF_PROMISC))
2176                         tmp |= RT2573_DROP_NOT_TO_ME;
2177         }
2178         rum_write(sc, RT2573_TXRX_CSR0, tmp);
2179
2180         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2181         ifp->if_drv_flags |= IFF_DRV_RUNNING;
2182
2183         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2184                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2185                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2186         } else
2187                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2188
2189         return;
2190
2191 fail:   rum_stop(sc);
2192 #undef N
2193 }
2194
2195 static void
2196 rum_stop(void *priv)
2197 {
2198         struct rum_softc *sc = priv;
2199         struct ieee80211com *ic = &sc->sc_ic;
2200         struct ifnet *ifp = ic->ic_ifp;
2201         uint32_t tmp;
2202
2203         sc->sc_tx_timer = 0;
2204         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2205
2206         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2207
2208         /* disable Rx */
2209         tmp = rum_read(sc, RT2573_TXRX_CSR0);
2210         rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2211
2212         /* reset ASIC */
2213         rum_write(sc, RT2573_MAC_CSR1, 3);
2214         rum_write(sc, RT2573_MAC_CSR1, 0);
2215
2216         if (sc->amrr_xfer != NULL) {
2217                 usbd_free_xfer(sc->amrr_xfer);
2218                 sc->amrr_xfer = NULL;
2219         }
2220
2221         if (sc->sc_rx_pipeh != NULL) {
2222                 usbd_abort_pipe(sc->sc_rx_pipeh);
2223                 usbd_close_pipe(sc->sc_rx_pipeh);
2224                 sc->sc_rx_pipeh = NULL;
2225         }
2226         if (sc->sc_tx_pipeh != NULL) {
2227                 usbd_abort_pipe(sc->sc_tx_pipeh);
2228                 usbd_close_pipe(sc->sc_tx_pipeh);
2229                 sc->sc_tx_pipeh = NULL;
2230         }
2231
2232         rum_free_rx_list(sc);
2233         rum_free_tx_list(sc);
2234 }
2235
2236 static int
2237 rum_load_microcode(struct rum_softc *sc, const u_char *ucode, size_t size)
2238 {
2239         usb_device_request_t req;
2240         uint16_t reg = RT2573_MCU_CODE_BASE;
2241         usbd_status error;
2242
2243         /* copy firmware image into NIC */
2244         for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2245                 rum_write(sc, reg, UGETDW(ucode));
2246
2247         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2248         req.bRequest = RT2573_MCU_CNTL;
2249         USETW(req.wValue, RT2573_MCU_RUN);
2250         USETW(req.wIndex, 0);
2251         USETW(req.wLength, 0);
2252
2253         error = usbd_do_request(sc->sc_udev, &req, NULL);
2254         if (error != 0) {
2255                 printf("%s: could not run firmware: %s\n",
2256                     device_get_nameunit(sc->sc_dev), usbd_errstr(error));
2257         }
2258         return error;
2259 }
2260
2261 static int
2262 rum_prepare_beacon(struct rum_softc *sc)
2263 {
2264         struct ieee80211com *ic = &sc->sc_ic;
2265         struct rum_tx_desc desc;
2266         struct mbuf *m0;
2267         int rate;
2268
2269         m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo);
2270         if (m0 == NULL) {
2271                 return ENOBUFS;
2272         }
2273
2274         /* send beacons at the lowest available rate */
2275         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
2276
2277         rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2278             m0->m_pkthdr.len, rate);
2279
2280         /* copy the first 24 bytes of Tx descriptor into NIC memory */
2281         rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2282
2283         /* copy beacon header and payload into NIC memory */
2284         rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2285             m0->m_pkthdr.len);
2286
2287         m_freem(m0);
2288
2289         return 0;
2290 }
2291
2292 static int
2293 rum_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2294     const struct ieee80211_bpf_params *params)
2295 {
2296         struct ieee80211com *ic = ni->ni_ic;
2297         struct ifnet *ifp = ic->ic_ifp;
2298         struct rum_softc *sc = ifp->if_softc;
2299
2300         /* prevent management frames from being sent if we're not ready */
2301         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2302                 m_freem(m);
2303                 ieee80211_free_node(ni);
2304                 return ENETDOWN;
2305         }
2306         if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
2307                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2308                 m_freem(m);
2309                 ieee80211_free_node(ni);
2310                 return EIO;
2311         }
2312
2313         if (bpf_peers_present(ic->ic_rawbpf))
2314                 bpf_mtap(ic->ic_rawbpf, m);
2315
2316         ifp->if_opackets++;
2317
2318         if (params == NULL) {
2319                 /*
2320                  * Legacy path; interpret frame contents to decide
2321                  * precisely how to send the frame.
2322                  */
2323                 if (rum_tx_mgt(sc, m, ni) != 0)
2324                         goto bad;
2325         } else {
2326                 /*
2327                  * Caller supplied explicit parameters to use in
2328                  * sending the frame.
2329                  */
2330                 if (rum_tx_raw(sc, m, ni, params) != 0)
2331                         goto bad;
2332         }
2333         sc->sc_tx_timer = 5;
2334         callout_reset(&sc->watchdog_ch, hz, rum_watchdog, sc);
2335
2336         return 0;
2337 bad:
2338         ifp->if_oerrors++;
2339         ieee80211_free_node(ni);
2340         return EIO;
2341 }
2342
2343 static void
2344 rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
2345 {
2346         int i;
2347
2348         /* clear statistic registers (STA_CSR0 to STA_CSR5) */
2349         rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2350
2351         ieee80211_amrr_node_init(&sc->amrr, &sc->amn);
2352
2353         /* set rate to some reasonable initial value */
2354         for (i = ni->ni_rates.rs_nrates - 1;
2355              i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
2356              i--);
2357         ni->ni_txrate = i;
2358
2359         callout_reset(&sc->amrr_ch, hz, rum_amrr_timeout, sc);
2360 }
2361
2362 static void
2363 rum_amrr_timeout(void *arg)
2364 {
2365         struct rum_softc *sc = (struct rum_softc *)arg;
2366         usb_device_request_t req;
2367
2368         /*
2369          * Asynchronously read statistic registers (cleared by read).
2370          */
2371         req.bmRequestType = UT_READ_VENDOR_DEVICE;
2372         req.bRequest = RT2573_READ_MULTI_MAC;
2373         USETW(req.wValue, 0);
2374         USETW(req.wIndex, RT2573_STA_CSR0);
2375         USETW(req.wLength, sizeof sc->sta);
2376
2377         usbd_setup_default_xfer(sc->amrr_xfer, sc->sc_udev, sc,
2378             USBD_DEFAULT_TIMEOUT, &req, sc->sta, sizeof sc->sta, 0,
2379             rum_amrr_update);
2380         (void)usbd_transfer(sc->amrr_xfer);
2381 }
2382
2383 static void
2384 rum_amrr_update(usbd_xfer_handle xfer, usbd_private_handle priv,
2385     usbd_status status)
2386 {
2387         struct rum_softc *sc = (struct rum_softc *)priv;
2388         struct ifnet *ifp = sc->sc_ic.ic_ifp;
2389
2390         if (status != USBD_NORMAL_COMPLETION) {
2391                 device_printf(sc->sc_dev, "could not retrieve Tx statistics - "
2392                     "cancelling automatic rate control\n");
2393                 return;
2394         }
2395
2396         /* count TX retry-fail as Tx errors */
2397         ifp->if_oerrors += le32toh(sc->sta[5]) >> 16;
2398
2399         sc->amn.amn_retrycnt =
2400             (le32toh(sc->sta[4]) >> 16) +       /* TX one-retry ok count */
2401             (le32toh(sc->sta[5]) & 0xffff) +    /* TX more-retry ok count */
2402             (le32toh(sc->sta[5]) >> 16);        /* TX retry-fail count */
2403
2404         sc->amn.amn_txcnt =
2405             sc->amn.amn_retrycnt +
2406             (le32toh(sc->sta[4]) & 0xffff);     /* TX no-retry ok count */
2407
2408         ieee80211_amrr_choose(&sc->amrr, sc->sc_ic.ic_bss, &sc->amn);
2409
2410         callout_reset(&sc->amrr_ch, hz, rum_amrr_timeout, sc);
2411 }
2412
2413 DRIVER_MODULE(rum, uhub, rum_driver, rum_devclass, usbd_driver_load, 0);