xref: /freebsd/sys/dev/usb/wlan/if_rum.c (revision b3aaa0cc21c63d388230c7ef2a80abd631ff20d5)
1 /*	$FreeBSD$	*/
2 
3 /*-
4  * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
5  * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
6  * Copyright (c) 2007-2008 Hans Petter Selasky <hselasky@FreeBSD.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 #include <sys/cdefs.h>
22 __FBSDID("$FreeBSD$");
23 
24 /*-
25  * Ralink Technology RT2501USB/RT2601USB chipset driver
26  * http://www.ralinktech.com.tw/
27  */
28 
29 #include "usbdevs.h"
30 #include <dev/usb/usb.h>
31 #include <dev/usb/usb_mfunc.h>
32 #include <dev/usb/usb_error.h>
33 
34 #define	USB_DEBUG_VAR rum_debug
35 
36 #include <dev/usb/usb_core.h>
37 #include <dev/usb/usb_lookup.h>
38 #include <dev/usb/usb_process.h>
39 #include <dev/usb/usb_debug.h>
40 #include <dev/usb/usb_request.h>
41 #include <dev/usb/usb_busdma.h>
42 #include <dev/usb/usb_util.h>
43 
44 #include <dev/usb/wlan/usb_wlan.h>
45 #include <dev/usb/wlan/if_rumreg.h>
46 #include <dev/usb/wlan/if_rumvar.h>
47 #include <dev/usb/wlan/if_rumfw.h>
48 
49 #if USB_DEBUG
50 static int rum_debug = 0;
51 
52 SYSCTL_NODE(_hw_usb2, OID_AUTO, rum, CTLFLAG_RW, 0, "USB rum");
53 SYSCTL_INT(_hw_usb2_rum, OID_AUTO, debug, CTLFLAG_RW, &rum_debug, 0,
54     "Debug level");
55 #endif
56 
57 #define	rum_do_request(sc,req,data) \
58   usb2_do_request_proc((sc)->sc_udev, &(sc)->sc_tq, req, data, 0, NULL, 5000)
59 
60 static const struct usb2_device_id rum_devs[] = {
61     { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_HWU54DM) },
62     { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_2) },
63     { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_3) },
64     { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_4) },
65     { USB_VP(USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_WUG2700) },
66     { USB_VP(USB_VENDOR_AMIT,		USB_PRODUCT_AMIT_CGWLUSB2GO) },
67     { USB_VP(USB_VENDOR_ASUS,		USB_PRODUCT_ASUS_RT2573_1) },
68     { USB_VP(USB_VENDOR_ASUS,		USB_PRODUCT_ASUS_RT2573_2) },
69     { USB_VP(USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D7050A) },
70     { USB_VP(USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D9050V3) },
71     { USB_VP(USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GC) },
72     { USB_VP(USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GR) },
73     { USB_VP(USB_VENDOR_CONCEPTRONIC2,	USB_PRODUCT_CONCEPTRONIC2_C54RU2) },
74     { USB_VP(USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GL) },
75     { USB_VP(USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GPX) },
76     { USB_VP(USB_VENDOR_DICKSMITH,	USB_PRODUCT_DICKSMITH_CWD854F) },
77     { USB_VP(USB_VENDOR_DICKSMITH,	USB_PRODUCT_DICKSMITH_RT2573) },
78     { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWLG122C1) },
79     { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_WUA1340) },
80     { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA111) },
81     { USB_VP(USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWA110) },
82     { USB_VP(USB_VENDOR_GIGABYTE,	USB_PRODUCT_GIGABYTE_GNWB01GS) },
83     { USB_VP(USB_VENDOR_GIGABYTE,	USB_PRODUCT_GIGABYTE_GNWI05GS) },
84     { USB_VP(USB_VENDOR_GIGASET,	USB_PRODUCT_GIGASET_RT2573) },
85     { USB_VP(USB_VENDOR_GOODWAY,	USB_PRODUCT_GOODWAY_RT2573) },
86     { USB_VP(USB_VENDOR_GUILLEMOT,	USB_PRODUCT_GUILLEMOT_HWGUSB254LB) },
87     { USB_VP(USB_VENDOR_GUILLEMOT,	USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP) },
88     { USB_VP(USB_VENDOR_HUAWEI3COM,	USB_PRODUCT_HUAWEI3COM_WUB320G) },
89     { USB_VP(USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_G54HP) },
90     { USB_VP(USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_SG54HP) },
91     { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_1) },
92     { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_2) },
93     { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_3) },
94     { USB_VP(USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_4) },
95     { USB_VP(USB_VENDOR_NOVATECH,	USB_PRODUCT_NOVATECH_RT2573) },
96     { USB_VP(USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GWUS54HP) },
97     { USB_VP(USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GWUS54MINI2) },
98     { USB_VP(USB_VENDOR_PLANEX2,	USB_PRODUCT_PLANEX2_GWUSMM) },
99     { USB_VP(USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573) },
100     { USB_VP(USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573_2) },
101     { USB_VP(USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573) },
102     { USB_VP(USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573_2) },
103     { USB_VP(USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2671) },
104     { USB_VP(USB_VENDOR_SITECOMEU,	USB_PRODUCT_SITECOMEU_WL113R2) },
105     { USB_VP(USB_VENDOR_SITECOMEU,	USB_PRODUCT_SITECOMEU_WL172) },
106     { USB_VP(USB_VENDOR_SPARKLAN,	USB_PRODUCT_SPARKLAN_RT2573) },
107     { USB_VP(USB_VENDOR_SURECOM,	USB_PRODUCT_SURECOM_RT2573) },
108 };
109 
110 MODULE_DEPEND(rum, wlan, 1, 1, 1);
111 MODULE_DEPEND(rum, wlan_amrr, 1, 1, 1);
112 MODULE_DEPEND(rum, usb, 1, 1, 1);
113 
114 static device_probe_t rum_match;
115 static device_attach_t rum_attach;
116 static device_detach_t rum_detach;
117 
118 static usb2_callback_t rum_bulk_read_callback;
119 static usb2_callback_t rum_bulk_write_callback;
120 
121 static usb2_proc_callback_t rum_attach_post;
122 static usb2_proc_callback_t rum_task;
123 static usb2_proc_callback_t rum_scantask;
124 static usb2_proc_callback_t rum_promisctask;
125 static usb2_proc_callback_t rum_amrr_task;
126 static usb2_proc_callback_t rum_init_task;
127 static usb2_proc_callback_t rum_stop_task;
128 
129 static struct ieee80211vap *rum_vap_create(struct ieee80211com *,
130 			    const char name[IFNAMSIZ], int unit, int opmode,
131 			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
132 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
133 static void		rum_vap_delete(struct ieee80211vap *);
134 static void		rum_tx_free(struct rum_tx_data *, int);
135 static void		rum_setup_tx_list(struct rum_softc *);
136 static void		rum_unsetup_tx_list(struct rum_softc *);
137 static int		rum_newstate(struct ieee80211vap *,
138 			    enum ieee80211_state, int);
139 static void		rum_setup_tx_desc(struct rum_softc *,
140 			    struct rum_tx_desc *, uint32_t, uint16_t, int,
141 			    int);
142 static int		rum_tx_mgt(struct rum_softc *, struct mbuf *,
143 			    struct ieee80211_node *);
144 static int		rum_tx_raw(struct rum_softc *, struct mbuf *,
145 			    struct ieee80211_node *,
146 			    const struct ieee80211_bpf_params *);
147 static int		rum_tx_data(struct rum_softc *, struct mbuf *,
148 			    struct ieee80211_node *);
149 static void		rum_start(struct ifnet *);
150 static int		rum_ioctl(struct ifnet *, u_long, caddr_t);
151 static void		rum_eeprom_read(struct rum_softc *, uint16_t, void *,
152 			    int);
153 static uint32_t		rum_read(struct rum_softc *, uint16_t);
154 static void		rum_read_multi(struct rum_softc *, uint16_t, void *,
155 			    int);
156 static void		rum_write(struct rum_softc *, uint16_t, uint32_t);
157 static void		rum_write_multi(struct rum_softc *, uint16_t, void *,
158 			    size_t);
159 static void		rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
160 static uint8_t		rum_bbp_read(struct rum_softc *, uint8_t);
161 static void		rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
162 static void		rum_select_antenna(struct rum_softc *);
163 static void		rum_enable_mrr(struct rum_softc *);
164 static void		rum_set_txpreamble(struct rum_softc *);
165 static void		rum_set_basicrates(struct rum_softc *);
166 static void		rum_select_band(struct rum_softc *,
167 			    struct ieee80211_channel *);
168 static void		rum_set_chan(struct rum_softc *,
169 			    struct ieee80211_channel *);
170 static void		rum_enable_tsf_sync(struct rum_softc *);
171 static void		rum_update_slot(struct ifnet *);
172 static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
173 static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
174 static const char	*rum_get_rf(int);
175 static void		rum_read_eeprom(struct rum_softc *);
176 static int		rum_bbp_init(struct rum_softc *);
177 static void		rum_init(void *);
178 static int		rum_load_microcode(struct rum_softc *, const u_char *,
179 			    size_t);
180 static int		rum_prepare_beacon(struct rum_softc *,
181 			    struct ieee80211vap *);
182 static int		rum_raw_xmit(struct ieee80211_node *, struct mbuf *,
183 			    const struct ieee80211_bpf_params *);
184 static struct ieee80211_node *rum_node_alloc(struct ieee80211vap *,
185 			    const uint8_t mac[IEEE80211_ADDR_LEN]);
186 static void		rum_newassoc(struct ieee80211_node *, int);
187 static void		rum_scan_start(struct ieee80211com *);
188 static void		rum_scan_end(struct ieee80211com *);
189 static void		rum_set_channel(struct ieee80211com *);
190 static int		rum_get_rssi(struct rum_softc *, uint8_t);
191 static void		rum_amrr_start(struct rum_softc *,
192 			    struct ieee80211_node *);
193 static void		rum_amrr_timeout(void *);
194 static int		rum_pause(struct rum_softc *, int);
195 static void		rum_queue_command(struct rum_softc *,
196 			    usb2_proc_callback_t *, struct usb2_proc_msg *,
197 			    struct usb2_proc_msg *);
198 
199 static const struct {
200 	uint32_t	reg;
201 	uint32_t	val;
202 } rum_def_mac[] = {
203 	{ RT2573_TXRX_CSR0,  0x025fb032 },
204 	{ RT2573_TXRX_CSR1,  0x9eaa9eaf },
205 	{ RT2573_TXRX_CSR2,  0x8a8b8c8d },
206 	{ RT2573_TXRX_CSR3,  0x00858687 },
207 	{ RT2573_TXRX_CSR7,  0x2e31353b },
208 	{ RT2573_TXRX_CSR8,  0x2a2a2a2c },
209 	{ RT2573_TXRX_CSR15, 0x0000000f },
210 	{ RT2573_MAC_CSR6,   0x00000fff },
211 	{ RT2573_MAC_CSR8,   0x016c030a },
212 	{ RT2573_MAC_CSR10,  0x00000718 },
213 	{ RT2573_MAC_CSR12,  0x00000004 },
214 	{ RT2573_MAC_CSR13,  0x00007f00 },
215 	{ RT2573_SEC_CSR0,   0x00000000 },
216 	{ RT2573_SEC_CSR1,   0x00000000 },
217 	{ RT2573_SEC_CSR5,   0x00000000 },
218 	{ RT2573_PHY_CSR1,   0x000023b0 },
219 	{ RT2573_PHY_CSR5,   0x00040a06 },
220 	{ RT2573_PHY_CSR6,   0x00080606 },
221 	{ RT2573_PHY_CSR7,   0x00000408 },
222 	{ RT2573_AIFSN_CSR,  0x00002273 },
223 	{ RT2573_CWMIN_CSR,  0x00002344 },
224 	{ RT2573_CWMAX_CSR,  0x000034aa }
225 };
226 
227 static const struct {
228 	uint8_t	reg;
229 	uint8_t	val;
230 } rum_def_bbp[] = {
231 	{   3, 0x80 },
232 	{  15, 0x30 },
233 	{  17, 0x20 },
234 	{  21, 0xc8 },
235 	{  22, 0x38 },
236 	{  23, 0x06 },
237 	{  24, 0xfe },
238 	{  25, 0x0a },
239 	{  26, 0x0d },
240 	{  32, 0x0b },
241 	{  34, 0x12 },
242 	{  37, 0x07 },
243 	{  39, 0xf8 },
244 	{  41, 0x60 },
245 	{  53, 0x10 },
246 	{  54, 0x18 },
247 	{  60, 0x10 },
248 	{  61, 0x04 },
249 	{  62, 0x04 },
250 	{  75, 0xfe },
251 	{  86, 0xfe },
252 	{  88, 0xfe },
253 	{  90, 0x0f },
254 	{  99, 0x00 },
255 	{ 102, 0x16 },
256 	{ 107, 0x04 }
257 };
258 
259 static const struct rfprog {
260 	uint8_t		chan;
261 	uint32_t	r1, r2, r3, r4;
262 }  rum_rf5226[] = {
263 	{   1, 0x00b03, 0x001e1, 0x1a014, 0x30282 },
264 	{   2, 0x00b03, 0x001e1, 0x1a014, 0x30287 },
265 	{   3, 0x00b03, 0x001e2, 0x1a014, 0x30282 },
266 	{   4, 0x00b03, 0x001e2, 0x1a014, 0x30287 },
267 	{   5, 0x00b03, 0x001e3, 0x1a014, 0x30282 },
268 	{   6, 0x00b03, 0x001e3, 0x1a014, 0x30287 },
269 	{   7, 0x00b03, 0x001e4, 0x1a014, 0x30282 },
270 	{   8, 0x00b03, 0x001e4, 0x1a014, 0x30287 },
271 	{   9, 0x00b03, 0x001e5, 0x1a014, 0x30282 },
272 	{  10, 0x00b03, 0x001e5, 0x1a014, 0x30287 },
273 	{  11, 0x00b03, 0x001e6, 0x1a014, 0x30282 },
274 	{  12, 0x00b03, 0x001e6, 0x1a014, 0x30287 },
275 	{  13, 0x00b03, 0x001e7, 0x1a014, 0x30282 },
276 	{  14, 0x00b03, 0x001e8, 0x1a014, 0x30284 },
277 
278 	{  34, 0x00b03, 0x20266, 0x36014, 0x30282 },
279 	{  38, 0x00b03, 0x20267, 0x36014, 0x30284 },
280 	{  42, 0x00b03, 0x20268, 0x36014, 0x30286 },
281 	{  46, 0x00b03, 0x20269, 0x36014, 0x30288 },
282 
283 	{  36, 0x00b03, 0x00266, 0x26014, 0x30288 },
284 	{  40, 0x00b03, 0x00268, 0x26014, 0x30280 },
285 	{  44, 0x00b03, 0x00269, 0x26014, 0x30282 },
286 	{  48, 0x00b03, 0x0026a, 0x26014, 0x30284 },
287 	{  52, 0x00b03, 0x0026b, 0x26014, 0x30286 },
288 	{  56, 0x00b03, 0x0026c, 0x26014, 0x30288 },
289 	{  60, 0x00b03, 0x0026e, 0x26014, 0x30280 },
290 	{  64, 0x00b03, 0x0026f, 0x26014, 0x30282 },
291 
292 	{ 100, 0x00b03, 0x0028a, 0x2e014, 0x30280 },
293 	{ 104, 0x00b03, 0x0028b, 0x2e014, 0x30282 },
294 	{ 108, 0x00b03, 0x0028c, 0x2e014, 0x30284 },
295 	{ 112, 0x00b03, 0x0028d, 0x2e014, 0x30286 },
296 	{ 116, 0x00b03, 0x0028e, 0x2e014, 0x30288 },
297 	{ 120, 0x00b03, 0x002a0, 0x2e014, 0x30280 },
298 	{ 124, 0x00b03, 0x002a1, 0x2e014, 0x30282 },
299 	{ 128, 0x00b03, 0x002a2, 0x2e014, 0x30284 },
300 	{ 132, 0x00b03, 0x002a3, 0x2e014, 0x30286 },
301 	{ 136, 0x00b03, 0x002a4, 0x2e014, 0x30288 },
302 	{ 140, 0x00b03, 0x002a6, 0x2e014, 0x30280 },
303 
304 	{ 149, 0x00b03, 0x002a8, 0x2e014, 0x30287 },
305 	{ 153, 0x00b03, 0x002a9, 0x2e014, 0x30289 },
306 	{ 157, 0x00b03, 0x002ab, 0x2e014, 0x30281 },
307 	{ 161, 0x00b03, 0x002ac, 0x2e014, 0x30283 },
308 	{ 165, 0x00b03, 0x002ad, 0x2e014, 0x30285 }
309 }, rum_rf5225[] = {
310 	{   1, 0x00b33, 0x011e1, 0x1a014, 0x30282 },
311 	{   2, 0x00b33, 0x011e1, 0x1a014, 0x30287 },
312 	{   3, 0x00b33, 0x011e2, 0x1a014, 0x30282 },
313 	{   4, 0x00b33, 0x011e2, 0x1a014, 0x30287 },
314 	{   5, 0x00b33, 0x011e3, 0x1a014, 0x30282 },
315 	{   6, 0x00b33, 0x011e3, 0x1a014, 0x30287 },
316 	{   7, 0x00b33, 0x011e4, 0x1a014, 0x30282 },
317 	{   8, 0x00b33, 0x011e4, 0x1a014, 0x30287 },
318 	{   9, 0x00b33, 0x011e5, 0x1a014, 0x30282 },
319 	{  10, 0x00b33, 0x011e5, 0x1a014, 0x30287 },
320 	{  11, 0x00b33, 0x011e6, 0x1a014, 0x30282 },
321 	{  12, 0x00b33, 0x011e6, 0x1a014, 0x30287 },
322 	{  13, 0x00b33, 0x011e7, 0x1a014, 0x30282 },
323 	{  14, 0x00b33, 0x011e8, 0x1a014, 0x30284 },
324 
325 	{  34, 0x00b33, 0x01266, 0x26014, 0x30282 },
326 	{  38, 0x00b33, 0x01267, 0x26014, 0x30284 },
327 	{  42, 0x00b33, 0x01268, 0x26014, 0x30286 },
328 	{  46, 0x00b33, 0x01269, 0x26014, 0x30288 },
329 
330 	{  36, 0x00b33, 0x01266, 0x26014, 0x30288 },
331 	{  40, 0x00b33, 0x01268, 0x26014, 0x30280 },
332 	{  44, 0x00b33, 0x01269, 0x26014, 0x30282 },
333 	{  48, 0x00b33, 0x0126a, 0x26014, 0x30284 },
334 	{  52, 0x00b33, 0x0126b, 0x26014, 0x30286 },
335 	{  56, 0x00b33, 0x0126c, 0x26014, 0x30288 },
336 	{  60, 0x00b33, 0x0126e, 0x26014, 0x30280 },
337 	{  64, 0x00b33, 0x0126f, 0x26014, 0x30282 },
338 
339 	{ 100, 0x00b33, 0x0128a, 0x2e014, 0x30280 },
340 	{ 104, 0x00b33, 0x0128b, 0x2e014, 0x30282 },
341 	{ 108, 0x00b33, 0x0128c, 0x2e014, 0x30284 },
342 	{ 112, 0x00b33, 0x0128d, 0x2e014, 0x30286 },
343 	{ 116, 0x00b33, 0x0128e, 0x2e014, 0x30288 },
344 	{ 120, 0x00b33, 0x012a0, 0x2e014, 0x30280 },
345 	{ 124, 0x00b33, 0x012a1, 0x2e014, 0x30282 },
346 	{ 128, 0x00b33, 0x012a2, 0x2e014, 0x30284 },
347 	{ 132, 0x00b33, 0x012a3, 0x2e014, 0x30286 },
348 	{ 136, 0x00b33, 0x012a4, 0x2e014, 0x30288 },
349 	{ 140, 0x00b33, 0x012a6, 0x2e014, 0x30280 },
350 
351 	{ 149, 0x00b33, 0x012a8, 0x2e014, 0x30287 },
352 	{ 153, 0x00b33, 0x012a9, 0x2e014, 0x30289 },
353 	{ 157, 0x00b33, 0x012ab, 0x2e014, 0x30281 },
354 	{ 161, 0x00b33, 0x012ac, 0x2e014, 0x30283 },
355 	{ 165, 0x00b33, 0x012ad, 0x2e014, 0x30285 }
356 };
357 
358 static const struct usb2_config rum_config[RUM_N_TRANSFER] = {
359 	[RUM_BULK_WR] = {
360 		.type = UE_BULK,
361 		.endpoint = UE_ADDR_ANY,
362 		.direction = UE_DIR_OUT,
363 		.mh.bufsize = (MCLBYTES + RT2573_TX_DESC_SIZE + 8),
364 		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
365 		.mh.callback = rum_bulk_write_callback,
366 		.mh.timeout = 5000,	/* ms */
367 	},
368 	[RUM_BULK_RD] = {
369 		.type = UE_BULK,
370 		.endpoint = UE_ADDR_ANY,
371 		.direction = UE_DIR_IN,
372 		.mh.bufsize = (MCLBYTES + RT2573_RX_DESC_SIZE),
373 		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
374 		.mh.callback = rum_bulk_read_callback,
375 	},
376 };
377 
378 static int
379 rum_match(device_t self)
380 {
381 	struct usb2_attach_arg *uaa = device_get_ivars(self);
382 
383 	if (uaa->usb2_mode != USB_MODE_HOST)
384 		return (ENXIO);
385 	if (uaa->info.bConfigIndex != 0)
386 		return (ENXIO);
387 	if (uaa->info.bIfaceIndex != RT2573_IFACE_INDEX)
388 		return (ENXIO);
389 
390 	return (usb2_lookup_id_by_uaa(rum_devs, sizeof(rum_devs), uaa));
391 }
392 
393 static int
394 rum_attach(device_t self)
395 {
396 	struct usb2_attach_arg *uaa = device_get_ivars(self);
397 	struct rum_softc *sc = device_get_softc(self);
398 	uint8_t iface_index;
399 	int error;
400 
401 	device_set_usb2_desc(self);
402 	sc->sc_udev = uaa->device;
403 	sc->sc_dev = self;
404 
405 	mtx_init(&sc->sc_mtx, device_get_nameunit(self),
406 	    MTX_NETWORK_LOCK, MTX_DEF);
407 
408 	iface_index = RT2573_IFACE_INDEX;
409 	error = usb2_transfer_setup(uaa->device, &iface_index,
410 	    sc->sc_xfer, rum_config, RUM_N_TRANSFER, sc, &sc->sc_mtx);
411 	if (error) {
412 		device_printf(self, "could not allocate USB transfers, "
413 		    "err=%s\n", usb2_errstr(error));
414 		goto detach;
415 	}
416 	error = usb2_proc_create(&sc->sc_tq, &sc->sc_mtx,
417 	    device_get_nameunit(self), USB_PRI_MED);
418 	if (error) {
419 		device_printf(self, "could not setup config thread!\n");
420 		goto detach;
421 	}
422 
423 	/* fork rest of the attach code */
424 	RUM_LOCK(sc);
425 	rum_queue_command(sc, rum_attach_post,
426 	    &sc->sc_synctask[0].hdr,
427 	    &sc->sc_synctask[1].hdr);
428 	RUM_UNLOCK(sc);
429 	return (0);
430 
431 detach:
432 	rum_detach(self);
433 	return (ENXIO);			/* failure */
434 }
435 
436 static void
437 rum_attach_post(struct usb2_proc_msg *pm)
438 {
439 	struct rum_task *task = (struct rum_task *)pm;
440 	struct rum_softc *sc = task->sc;
441 	struct ifnet *ifp;
442 	struct ieee80211com *ic;
443 	unsigned int ntries;
444 	int error;
445 	uint32_t tmp;
446 	uint8_t bands;
447 
448 	/* retrieve RT2573 rev. no */
449 	for (ntries = 0; ntries < 100; ntries++) {
450 		if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
451 			break;
452 		if (rum_pause(sc, hz / 100))
453 			break;
454 	}
455 	if (ntries == 100) {
456 		device_printf(sc->sc_dev, "timeout waiting for chip to settle\n");
457 		return;
458 	}
459 
460 	/* retrieve MAC address and various other things from EEPROM */
461 	rum_read_eeprom(sc);
462 
463 	device_printf(sc->sc_dev, "MAC/BBP RT2573 (rev 0x%05x), RF %s\n",
464 	    tmp, rum_get_rf(sc->rf_rev));
465 
466 	error = rum_load_microcode(sc, rt2573_ucode, sizeof(rt2573_ucode));
467 	if (error != 0) {
468 		RUM_UNLOCK(sc);
469 		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
470 		return;
471 	}
472 	RUM_UNLOCK(sc);
473 
474 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
475 	if (ifp == NULL) {
476 		device_printf(sc->sc_dev, "can not if_alloc()\n");
477 		RUM_LOCK(sc);
478 		return;
479 	}
480 	ic = ifp->if_l2com;
481 
482 	ifp->if_softc = sc;
483 	if_initname(ifp, "rum", device_get_unit(sc->sc_dev));
484 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
485 	ifp->if_init = rum_init;
486 	ifp->if_ioctl = rum_ioctl;
487 	ifp->if_start = rum_start;
488 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
489 	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
490 	IFQ_SET_READY(&ifp->if_snd);
491 
492 	ic->ic_ifp = ifp;
493 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
494 	IEEE80211_ADDR_COPY(ic->ic_myaddr, sc->sc_bssid);
495 
496 	/* set device capabilities */
497 	ic->ic_caps =
498 	      IEEE80211_C_STA		/* station mode supported */
499 	    | IEEE80211_C_IBSS		/* IBSS mode supported */
500 	    | IEEE80211_C_MONITOR	/* monitor mode supported */
501 	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
502 	    | IEEE80211_C_TXPMGT	/* tx power management */
503 	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
504 	    | IEEE80211_C_SHSLOT	/* short slot time supported */
505 	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
506 	    | IEEE80211_C_WPA		/* 802.11i */
507 	    ;
508 
509 	bands = 0;
510 	setbit(&bands, IEEE80211_MODE_11B);
511 	setbit(&bands, IEEE80211_MODE_11G);
512 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226)
513 		setbit(&bands, IEEE80211_MODE_11A);
514 	ieee80211_init_channels(ic, NULL, &bands);
515 
516 	ieee80211_ifattach(ic);
517 	ic->ic_newassoc = rum_newassoc;
518 	ic->ic_raw_xmit = rum_raw_xmit;
519 	ic->ic_node_alloc = rum_node_alloc;
520 	ic->ic_scan_start = rum_scan_start;
521 	ic->ic_scan_end = rum_scan_end;
522 	ic->ic_set_channel = rum_set_channel;
523 
524 	ic->ic_vap_create = rum_vap_create;
525 	ic->ic_vap_delete = rum_vap_delete;
526 
527 	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
528 
529 	bpfattach(ifp, DLT_IEEE802_11_RADIO,
530 	    sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap));
531 
532 	sc->sc_rxtap_len = sizeof sc->sc_rxtap;
533 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
534 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
535 
536 	sc->sc_txtap_len = sizeof sc->sc_txtap;
537 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
538 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
539 
540 	if (bootverbose)
541 		ieee80211_announce(ic);
542 
543 	RUM_LOCK(sc);
544 }
545 
546 static int
547 rum_detach(device_t self)
548 {
549 	struct rum_softc *sc = device_get_softc(self);
550 	struct ifnet *ifp = sc->sc_ifp;
551 	struct ieee80211com *ic;
552 
553 	/* wait for any post attach or other command to complete */
554 	usb2_proc_drain(&sc->sc_tq);
555 
556 	/* stop all USB transfers */
557 	usb2_transfer_unsetup(sc->sc_xfer, RUM_N_TRANSFER);
558 	usb2_proc_free(&sc->sc_tq);
559 
560 	/* free TX list, if any */
561 	RUM_LOCK(sc);
562 	rum_unsetup_tx_list(sc);
563 	RUM_UNLOCK(sc);
564 
565 	if (ifp) {
566 		ic = ifp->if_l2com;
567 		bpfdetach(ifp);
568 		ieee80211_ifdetach(ic);
569 		if_free(ifp);
570 	}
571 
572 	mtx_destroy(&sc->sc_mtx);
573 
574 	return (0);
575 }
576 
577 static struct ieee80211vap *
578 rum_vap_create(struct ieee80211com *ic,
579 	const char name[IFNAMSIZ], int unit, int opmode, int flags,
580 	const uint8_t bssid[IEEE80211_ADDR_LEN],
581 	const uint8_t mac[IEEE80211_ADDR_LEN])
582 {
583 	struct rum_softc *sc = ic->ic_ifp->if_softc;
584 	struct rum_vap *rvp;
585 	struct ieee80211vap *vap;
586 
587 	if (!TAILQ_EMPTY(&ic->ic_vaps))		/* only one at a time */
588 		return NULL;
589 	rvp = (struct rum_vap *) malloc(sizeof(struct rum_vap),
590 	    M_80211_VAP, M_NOWAIT | M_ZERO);
591 	if (rvp == NULL)
592 		return NULL;
593 	vap = &rvp->vap;
594 	/* enable s/w bmiss handling for sta mode */
595 	ieee80211_vap_setup(ic, vap, name, unit, opmode,
596 	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
597 
598 	/* override state transition machine */
599 	rvp->newstate = vap->iv_newstate;
600 	vap->iv_newstate = rum_newstate;
601 
602 	rvp->sc = sc;
603 	usb2_callout_init_mtx(&rvp->amrr_ch, &sc->sc_mtx, 0);
604 	ieee80211_amrr_init(&rvp->amrr, vap,
605 	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
606 	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
607 	    1000 /* 1 sec */);
608 
609 	/* complete setup */
610 	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
611 	ic->ic_opmode = opmode;
612 	return vap;
613 }
614 
615 static void
616 rum_vap_delete(struct ieee80211vap *vap)
617 {
618 	struct rum_vap *rvp = RUM_VAP(vap);
619 
620 	usb2_callout_drain(&rvp->amrr_ch);
621 	ieee80211_amrr_cleanup(&rvp->amrr);
622 	ieee80211_vap_detach(vap);
623 	free(rvp, M_80211_VAP);
624 }
625 
626 static void
627 rum_tx_free(struct rum_tx_data *data, int txerr)
628 {
629 	struct rum_softc *sc = data->sc;
630 
631 	if (data->m != NULL) {
632 		if (data->m->m_flags & M_TXCB)
633 			ieee80211_process_callback(data->ni, data->m,
634 			    txerr ? ETIMEDOUT : 0);
635 		m_freem(data->m);
636 		data->m = NULL;
637 
638 		ieee80211_free_node(data->ni);
639 		data->ni = NULL;
640 	}
641 	STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
642 	sc->tx_nfree++;
643 }
644 
645 static void
646 rum_setup_tx_list(struct rum_softc *sc)
647 {
648 	struct rum_tx_data *data;
649 	int i;
650 
651 	sc->tx_nfree = 0;
652 	STAILQ_INIT(&sc->tx_q);
653 	STAILQ_INIT(&sc->tx_free);
654 
655 	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
656 		data = &sc->tx_data[i];
657 
658 		data->sc = sc;
659 		STAILQ_INSERT_TAIL(&sc->tx_free, data, next);
660 		sc->tx_nfree++;
661 	}
662 }
663 
664 static void
665 rum_unsetup_tx_list(struct rum_softc *sc)
666 {
667 	struct rum_tx_data *data;
668 	int i;
669 
670 	/* make sure any subsequent use of the queues will fail */
671 	sc->tx_nfree = 0;
672 	STAILQ_INIT(&sc->tx_q);
673 	STAILQ_INIT(&sc->tx_free);
674 
675 	/* free up all node references and mbufs */
676 	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
677 		data = &sc->tx_data[i];
678 
679 		if (data->m != NULL) {
680 			m_freem(data->m);
681 			data->m = NULL;
682 		}
683 		if (data->ni != NULL) {
684 			ieee80211_free_node(data->ni);
685 			data->ni = NULL;
686 		}
687 	}
688 }
689 
690 static void
691 rum_task(struct usb2_proc_msg *pm)
692 {
693 	struct rum_task *task = (struct rum_task *)pm;
694 	struct rum_softc *sc = task->sc;
695 	struct ifnet *ifp = sc->sc_ifp;
696 	struct ieee80211com *ic = ifp->if_l2com;
697 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
698 	struct rum_vap *rvp = RUM_VAP(vap);
699 	const struct ieee80211_txparam *tp;
700 	enum ieee80211_state ostate;
701 	struct ieee80211_node *ni;
702 	uint32_t tmp;
703 
704 	ostate = vap->iv_state;
705 
706 	switch (sc->sc_state) {
707 	case IEEE80211_S_INIT:
708 		if (ostate == IEEE80211_S_RUN) {
709 			/* abort TSF synchronization */
710 			tmp = rum_read(sc, RT2573_TXRX_CSR9);
711 			rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
712 		}
713 		break;
714 
715 	case IEEE80211_S_RUN:
716 		ni = vap->iv_bss;
717 
718 		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
719 			rum_update_slot(ic->ic_ifp);
720 			rum_enable_mrr(sc);
721 			rum_set_txpreamble(sc);
722 			rum_set_basicrates(sc);
723 			IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
724 			rum_set_bssid(sc, sc->sc_bssid);
725 		}
726 
727 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
728 		    vap->iv_opmode == IEEE80211_M_IBSS)
729 			rum_prepare_beacon(sc, vap);
730 
731 		if (vap->iv_opmode != IEEE80211_M_MONITOR)
732 			rum_enable_tsf_sync(sc);
733 
734 		/* enable automatic rate adaptation */
735 		tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
736 		if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
737 			rum_amrr_start(sc, ni);
738 		break;
739 	default:
740 		break;
741 	}
742 
743 	RUM_UNLOCK(sc);
744 	IEEE80211_LOCK(ic);
745 	rvp->newstate(vap, sc->sc_state, sc->sc_arg);
746 	if (vap->iv_newstate_cb != NULL)
747 		vap->iv_newstate_cb(vap, sc->sc_state, sc->sc_arg);
748 	IEEE80211_UNLOCK(ic);
749 	RUM_LOCK(sc);
750 }
751 
752 static int
753 rum_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
754 {
755 	struct rum_vap *rvp = RUM_VAP(vap);
756 	struct ieee80211com *ic = vap->iv_ic;
757 	struct rum_softc *sc = ic->ic_ifp->if_softc;
758 
759 	DPRINTF("%s -> %s\n",
760 		ieee80211_state_name[vap->iv_state],
761 		ieee80211_state_name[nstate]);
762 
763 	RUM_LOCK(sc);
764 	usb2_callout_stop(&rvp->amrr_ch);
765 
766 	/* do it in a process context */
767 	sc->sc_state = nstate;
768 	sc->sc_arg = arg;
769 	RUM_UNLOCK(sc);
770 
771 	if (nstate == IEEE80211_S_INIT) {
772 		rvp->newstate(vap, nstate, arg);
773 		return 0;
774 	} else {
775 		RUM_LOCK(sc);
776 		rum_queue_command(sc, rum_task, &sc->sc_task[0].hdr,
777 		    &sc->sc_task[1].hdr);
778 		RUM_UNLOCK(sc);
779 		return EINPROGRESS;
780 	}
781 }
782 
783 static void
784 rum_bulk_write_callback(struct usb2_xfer *xfer)
785 {
786 	struct rum_softc *sc = xfer->priv_sc;
787 	struct ifnet *ifp = sc->sc_ifp;
788 	struct ieee80211com *ic = ifp->if_l2com;
789 	struct ieee80211_channel *c = ic->ic_curchan;
790 	struct rum_tx_data *data;
791 	struct mbuf *m;
792 	unsigned int len;
793 
794 	switch (USB_GET_STATE(xfer)) {
795 	case USB_ST_TRANSFERRED:
796 		DPRINTFN(11, "transfer complete, %d bytes\n", xfer->actlen);
797 
798 		/* free resources */
799 		data = xfer->priv_fifo;
800 		rum_tx_free(data, 0);
801 		xfer->priv_fifo = NULL;
802 
803 		ifp->if_opackets++;
804 		ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
805 
806 		/* FALLTHROUGH */
807 	case USB_ST_SETUP:
808 tr_setup:
809 		data = STAILQ_FIRST(&sc->tx_q);
810 		if (data) {
811 			STAILQ_REMOVE_HEAD(&sc->tx_q, next);
812 			m = data->m;
813 
814 			if (m->m_pkthdr.len > (MCLBYTES + RT2573_TX_DESC_SIZE)) {
815 				DPRINTFN(0, "data overflow, %u bytes\n",
816 				    m->m_pkthdr.len);
817 				m->m_pkthdr.len = (MCLBYTES + RT2573_TX_DESC_SIZE);
818 			}
819 			usb2_copy_in(xfer->frbuffers, 0, &data->desc,
820 			    RT2573_TX_DESC_SIZE);
821 			usb2_m_copy_in(xfer->frbuffers, RT2573_TX_DESC_SIZE, m,
822 			    0, m->m_pkthdr.len);
823 
824 			if (bpf_peers_present(ifp->if_bpf)) {
825 				struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
826 
827 				tap->wt_flags = 0;
828 				tap->wt_rate = data->rate;
829 				tap->wt_chan_freq = htole16(c->ic_freq);
830 				tap->wt_chan_flags = htole16(c->ic_flags);
831 				tap->wt_antenna = sc->tx_ant;
832 
833 				bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
834 			}
835 
836 			/* align end on a 4-bytes boundary */
837 			len = (RT2573_TX_DESC_SIZE + m->m_pkthdr.len + 3) & ~3;
838 			if ((len % 64) == 0)
839 				len += 4;
840 
841 			DPRINTFN(11, "sending frame len=%u xferlen=%u\n",
842 			    m->m_pkthdr.len, len);
843 
844 			xfer->frlengths[0] = len;
845 			xfer->priv_fifo = data;
846 
847 			usb2_start_hardware(xfer);
848 		}
849 		break;
850 
851 	default:			/* Error */
852 		DPRINTFN(11, "transfer error, %s\n",
853 		    usb2_errstr(xfer->error));
854 
855 		ifp->if_oerrors++;
856 		data = xfer->priv_fifo;
857 		if (data != NULL) {
858 			rum_tx_free(data, xfer->error);
859 			xfer->priv_fifo = NULL;
860 		}
861 
862 		if (xfer->error == USB_ERR_STALLED) {
863 			/* try to clear stall first */
864 			xfer->flags.stall_pipe = 1;
865 			goto tr_setup;
866 		}
867 		if (xfer->error == USB_ERR_TIMEOUT)
868 			device_printf(sc->sc_dev, "device timeout\n");
869 		break;
870 	}
871 }
872 
873 static void
874 rum_bulk_read_callback(struct usb2_xfer *xfer)
875 {
876 	struct rum_softc *sc = xfer->priv_sc;
877 	struct ifnet *ifp = sc->sc_ifp;
878 	struct ieee80211com *ic = ifp->if_l2com;
879 	struct ieee80211_node *ni;
880 	struct mbuf *m = NULL;
881 	uint32_t flags;
882 	uint8_t rssi = 0;
883 	unsigned int len;
884 
885 	switch (USB_GET_STATE(xfer)) {
886 	case USB_ST_TRANSFERRED:
887 
888 		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
889 
890 		len = xfer->actlen;
891 		if (len < RT2573_RX_DESC_SIZE + IEEE80211_MIN_LEN) {
892 			DPRINTF("%s: xfer too short %d\n",
893 			    device_get_nameunit(sc->sc_dev), len);
894 			ifp->if_ierrors++;
895 			goto tr_setup;
896 		}
897 
898 		len -= RT2573_RX_DESC_SIZE;
899 		usb2_copy_out(xfer->frbuffers, 0, &sc->sc_rx_desc,
900 		    RT2573_RX_DESC_SIZE);
901 
902 		rssi = rum_get_rssi(sc, sc->sc_rx_desc.rssi);
903 		flags = le32toh(sc->sc_rx_desc.flags);
904 		if (flags & RT2573_RX_CRC_ERROR) {
905 			/*
906 		         * This should not happen since we did not
907 		         * request to receive those frames when we
908 		         * filled RUM_TXRX_CSR2:
909 		         */
910 			DPRINTFN(5, "PHY or CRC error\n");
911 			ifp->if_ierrors++;
912 			goto tr_setup;
913 		}
914 
915 		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
916 		if (m == NULL) {
917 			DPRINTF("could not allocate mbuf\n");
918 			ifp->if_ierrors++;
919 			goto tr_setup;
920 		}
921 		usb2_copy_out(xfer->frbuffers, RT2573_RX_DESC_SIZE,
922 		    mtod(m, uint8_t *), len);
923 
924 		/* finalize mbuf */
925 		m->m_pkthdr.rcvif = ifp;
926 		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
927 
928 		if (bpf_peers_present(ifp->if_bpf)) {
929 			struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
930 
931 			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
932 			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
933 			    (flags & RT2573_RX_OFDM) ?
934 			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
935 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
936 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
937 			tap->wr_antenna = sc->rx_ant;
938 			tap->wr_antsignal = rssi;
939 
940 			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
941 		}
942 		/* FALLTHROUGH */
943 	case USB_ST_SETUP:
944 tr_setup:
945 		xfer->frlengths[0] = xfer->max_data_length;
946 		usb2_start_hardware(xfer);
947 
948 		/*
949 		 * At the end of a USB callback it is always safe to unlock
950 		 * the private mutex of a device! That is why we do the
951 		 * "ieee80211_input" here, and not some lines up!
952 		 */
953 		if (m) {
954 			RUM_UNLOCK(sc);
955 			ni = ieee80211_find_rxnode(ic,
956 			    mtod(m, struct ieee80211_frame_min *));
957 			if (ni != NULL) {
958 				(void) ieee80211_input(ni, m, rssi,
959 				    RT2573_NOISE_FLOOR, 0);
960 				ieee80211_free_node(ni);
961 			} else
962 				(void) ieee80211_input_all(ic, m, rssi,
963 				    RT2573_NOISE_FLOOR, 0);
964 			RUM_LOCK(sc);
965 		}
966 		return;
967 
968 	default:			/* Error */
969 		if (xfer->error != USB_ERR_CANCELLED) {
970 			/* try to clear stall first */
971 			xfer->flags.stall_pipe = 1;
972 			goto tr_setup;
973 		}
974 		return;
975 	}
976 }
977 
978 static uint8_t
979 rum_plcp_signal(int rate)
980 {
981 	switch (rate) {
982 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
983 	case 12:	return 0xb;
984 	case 18:	return 0xf;
985 	case 24:	return 0xa;
986 	case 36:	return 0xe;
987 	case 48:	return 0x9;
988 	case 72:	return 0xd;
989 	case 96:	return 0x8;
990 	case 108:	return 0xc;
991 
992 	/* CCK rates (NB: not IEEE std, device-specific) */
993 	case 2:		return 0x0;
994 	case 4:		return 0x1;
995 	case 11:	return 0x2;
996 	case 22:	return 0x3;
997 	}
998 	return 0xff;		/* XXX unsupported/unknown rate */
999 }
1000 
1001 static void
1002 rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1003     uint32_t flags, uint16_t xflags, int len, int rate)
1004 {
1005 	struct ifnet *ifp = sc->sc_ifp;
1006 	struct ieee80211com *ic = ifp->if_l2com;
1007 	uint16_t plcp_length;
1008 	int remainder;
1009 
1010 	desc->flags = htole32(flags);
1011 	desc->flags |= htole32(RT2573_TX_VALID);
1012 	desc->flags |= htole32(len << 16);
1013 
1014 	desc->xflags = htole16(xflags);
1015 
1016 	desc->wme = htole16(RT2573_QID(0) | RT2573_AIFSN(2) |
1017 	    RT2573_LOGCWMIN(4) | RT2573_LOGCWMAX(10));
1018 
1019 	/* setup PLCP fields */
1020 	desc->plcp_signal  = rum_plcp_signal(rate);
1021 	desc->plcp_service = 4;
1022 
1023 	len += IEEE80211_CRC_LEN;
1024 	if (ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM) {
1025 		desc->flags |= htole32(RT2573_TX_OFDM);
1026 
1027 		plcp_length = len & 0xfff;
1028 		desc->plcp_length_hi = plcp_length >> 6;
1029 		desc->plcp_length_lo = plcp_length & 0x3f;
1030 	} else {
1031 		plcp_length = (16 * len + rate - 1) / rate;
1032 		if (rate == 22) {
1033 			remainder = (16 * len) % 22;
1034 			if (remainder != 0 && remainder < 7)
1035 				desc->plcp_service |= RT2573_PLCP_LENGEXT;
1036 		}
1037 		desc->plcp_length_hi = plcp_length >> 8;
1038 		desc->plcp_length_lo = plcp_length & 0xff;
1039 
1040 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1041 			desc->plcp_signal |= 0x08;
1042 	}
1043 }
1044 
1045 #define RUM_TX_TIMEOUT	5000
1046 
1047 static int
1048 rum_sendprot(struct rum_softc *sc,
1049     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1050 {
1051 	struct ieee80211com *ic = ni->ni_ic;
1052 	const struct ieee80211_frame *wh;
1053 	struct rum_tx_data *data;
1054 	struct mbuf *mprot;
1055 	int protrate, ackrate, pktlen, flags, isshort;
1056 	uint16_t dur;
1057 
1058 	RUM_LOCK_ASSERT(sc, MA_OWNED);
1059 	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1060 	    ("protection %d", prot));
1061 
1062 	wh = mtod(m, const struct ieee80211_frame *);
1063 	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1064 
1065 	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
1066 	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
1067 
1068 	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1069 	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
1070 	    + ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1071 	flags = RT2573_TX_MORE_FRAG;
1072 	if (prot == IEEE80211_PROT_RTSCTS) {
1073 		/* NB: CTS is the same size as an ACK */
1074 		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
1075 		flags |= RT2573_TX_NEED_ACK;
1076 		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1077 	} else {
1078 		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1079 	}
1080 	if (mprot == NULL) {
1081 		/* XXX stat + msg */
1082 		return ENOBUFS;
1083 	}
1084 	data = STAILQ_FIRST(&sc->tx_free);
1085 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1086 	sc->tx_nfree--;
1087 
1088 	data->m = mprot;
1089 	data->ni = ieee80211_ref_node(ni);
1090 	data->rate = protrate;
1091 	rum_setup_tx_desc(sc, &data->desc, flags, 0, mprot->m_pkthdr.len, protrate);
1092 
1093 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1094 	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1095 
1096 	return 0;
1097 }
1098 
1099 static int
1100 rum_tx_mgt(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1101 {
1102 	struct ieee80211vap *vap = ni->ni_vap;
1103 	struct ifnet *ifp = sc->sc_ifp;
1104 	struct ieee80211com *ic = ifp->if_l2com;
1105 	struct rum_tx_data *data;
1106 	struct ieee80211_frame *wh;
1107 	const struct ieee80211_txparam *tp;
1108 	struct ieee80211_key *k;
1109 	uint32_t flags = 0;
1110 	uint16_t dur;
1111 
1112 	RUM_LOCK_ASSERT(sc, MA_OWNED);
1113 
1114 	data = STAILQ_FIRST(&sc->tx_free);
1115 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1116 	sc->tx_nfree--;
1117 
1118 	wh = mtod(m0, struct ieee80211_frame *);
1119 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1120 		k = ieee80211_crypto_encap(ni, m0);
1121 		if (k == NULL) {
1122 			m_freem(m0);
1123 			return ENOBUFS;
1124 		}
1125 		wh = mtod(m0, struct ieee80211_frame *);
1126 	}
1127 
1128 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1129 
1130 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1131 		flags |= RT2573_TX_NEED_ACK;
1132 
1133 		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
1134 		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1135 		*(uint16_t *)wh->i_dur = htole16(dur);
1136 
1137 		/* tell hardware to add timestamp for probe responses */
1138 		if ((wh->i_fc[0] &
1139 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1140 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1141 			flags |= RT2573_TX_TIMESTAMP;
1142 	}
1143 
1144 	data->m = m0;
1145 	data->ni = ni;
1146 	data->rate = tp->mgmtrate;
1147 
1148 	rum_setup_tx_desc(sc, &data->desc, flags, 0, m0->m_pkthdr.len, tp->mgmtrate);
1149 
1150 	DPRINTFN(10, "sending mgt frame len=%d rate=%d\n",
1151 	    m0->m_pkthdr.len + (int)RT2573_TX_DESC_SIZE, tp->mgmtrate);
1152 
1153 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1154 	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1155 
1156 	return 0;
1157 }
1158 
1159 static int
1160 rum_tx_raw(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni,
1161     const struct ieee80211_bpf_params *params)
1162 {
1163 	struct rum_tx_data *data;
1164 	uint32_t flags;
1165 	int rate, error;
1166 
1167 	RUM_LOCK_ASSERT(sc, MA_OWNED);
1168 	KASSERT(params != NULL, ("no raw xmit params"));
1169 
1170 	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
1171 	/* XXX validate */
1172 	if (rate == 0) {
1173 		m_freem(m0);
1174 		return EINVAL;
1175 	}
1176 	flags = 0;
1177 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
1178 		flags |= RT2573_TX_NEED_ACK;
1179 	if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
1180 		error = rum_sendprot(sc, m0, ni,
1181 		    params->ibp_flags & IEEE80211_BPF_RTS ?
1182 			 IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
1183 		    rate);
1184 		if (error || sc->tx_nfree == 0) {
1185 			m_freem(m0);
1186 			return ENOBUFS;
1187 		}
1188 		flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
1189 	}
1190 
1191 	data = STAILQ_FIRST(&sc->tx_free);
1192 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1193 	sc->tx_nfree--;
1194 
1195 	data->m = m0;
1196 	data->ni = ni;
1197 	data->rate = rate;
1198 
1199 	/* XXX need to setup descriptor ourself */
1200 	rum_setup_tx_desc(sc, &data->desc, flags, 0, m0->m_pkthdr.len, rate);
1201 
1202 	DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
1203 	    m0->m_pkthdr.len, rate);
1204 
1205 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1206 	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1207 
1208 	return 0;
1209 }
1210 
1211 static int
1212 rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1213 {
1214 	struct ieee80211vap *vap = ni->ni_vap;
1215 	struct ifnet *ifp = sc->sc_ifp;
1216 	struct ieee80211com *ic = ifp->if_l2com;
1217 	struct rum_tx_data *data;
1218 	struct ieee80211_frame *wh;
1219 	const struct ieee80211_txparam *tp;
1220 	struct ieee80211_key *k;
1221 	uint32_t flags = 0;
1222 	uint16_t dur;
1223 	int error, rate;
1224 
1225 	RUM_LOCK_ASSERT(sc, MA_OWNED);
1226 
1227 	wh = mtod(m0, struct ieee80211_frame *);
1228 
1229 	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1230 	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
1231 		rate = tp->mcastrate;
1232 	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
1233 		rate = tp->ucastrate;
1234 	else
1235 		rate = ni->ni_txrate;
1236 
1237 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1238 		k = ieee80211_crypto_encap(ni, m0);
1239 		if (k == NULL) {
1240 			m_freem(m0);
1241 			return ENOBUFS;
1242 		}
1243 
1244 		/* packet header may have moved, reset our local pointer */
1245 		wh = mtod(m0, struct ieee80211_frame *);
1246 	}
1247 
1248 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1249 		int prot = IEEE80211_PROT_NONE;
1250 		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1251 			prot = IEEE80211_PROT_RTSCTS;
1252 		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1253 		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
1254 			prot = ic->ic_protmode;
1255 		if (prot != IEEE80211_PROT_NONE) {
1256 			error = rum_sendprot(sc, m0, ni, prot, rate);
1257 			if (error || sc->tx_nfree == 0) {
1258 				m_freem(m0);
1259 				return ENOBUFS;
1260 			}
1261 			flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
1262 		}
1263 	}
1264 
1265 	data = STAILQ_FIRST(&sc->tx_free);
1266 	STAILQ_REMOVE_HEAD(&sc->tx_free, next);
1267 	sc->tx_nfree--;
1268 
1269 	data->m = m0;
1270 	data->ni = ni;
1271 	data->rate = rate;
1272 
1273 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1274 		flags |= RT2573_TX_NEED_ACK;
1275 		flags |= RT2573_TX_MORE_FRAG;
1276 
1277 		dur = ieee80211_ack_duration(sc->sc_rates, rate,
1278 		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1279 		*(uint16_t *)wh->i_dur = htole16(dur);
1280 	}
1281 
1282 	rum_setup_tx_desc(sc, &data->desc, flags, 0, m0->m_pkthdr.len, rate);
1283 
1284 	DPRINTFN(10, "sending frame len=%d rate=%d\n",
1285 	    m0->m_pkthdr.len + (int)RT2573_TX_DESC_SIZE, rate);
1286 
1287 	STAILQ_INSERT_TAIL(&sc->tx_q, data, next);
1288 	usb2_transfer_start(sc->sc_xfer[RUM_BULK_WR]);
1289 
1290 	return 0;
1291 }
1292 
1293 static void
1294 rum_start(struct ifnet *ifp)
1295 {
1296 	struct rum_softc *sc = ifp->if_softc;
1297 	struct ieee80211_node *ni;
1298 	struct mbuf *m;
1299 
1300 	RUM_LOCK(sc);
1301 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1302 		RUM_UNLOCK(sc);
1303 		return;
1304 	}
1305 	for (;;) {
1306 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1307 		if (m == NULL)
1308 			break;
1309 		if (sc->tx_nfree < RUM_TX_MINFREE) {
1310 			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1311 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1312 			break;
1313 		}
1314 		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1315 		m = ieee80211_encap(ni, m);
1316 		if (m == NULL) {
1317 			ieee80211_free_node(ni);
1318 			continue;
1319 		}
1320 		if (rum_tx_data(sc, m, ni) != 0) {
1321 			ieee80211_free_node(ni);
1322 			ifp->if_oerrors++;
1323 			break;
1324 		}
1325 	}
1326 	RUM_UNLOCK(sc);
1327 }
1328 
1329 static int
1330 rum_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1331 {
1332 	struct rum_softc *sc = ifp->if_softc;
1333 	struct ieee80211com *ic = ifp->if_l2com;
1334 	struct ifreq *ifr = (struct ifreq *) data;
1335 	int error = 0, startall = 0;
1336 
1337 	switch (cmd) {
1338 	case SIOCSIFFLAGS:
1339 		RUM_LOCK(sc);
1340 		if (ifp->if_flags & IFF_UP) {
1341 			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1342 				rum_queue_command(sc, rum_init_task,
1343 				    &sc->sc_synctask[0].hdr,
1344 				    &sc->sc_synctask[1].hdr);
1345 				startall = 1;
1346 			} else
1347 				rum_queue_command(sc, rum_promisctask,
1348 				    &sc->sc_promisctask[0].hdr,
1349 				    &sc->sc_promisctask[1].hdr);
1350 		} else {
1351 			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1352 				rum_queue_command(sc, rum_stop_task,
1353 				    &sc->sc_synctask[0].hdr,
1354 				    &sc->sc_synctask[1].hdr);
1355 			}
1356 		}
1357 		RUM_UNLOCK(sc);
1358 		if (startall)
1359 			ieee80211_start_all(ic);
1360 		break;
1361 	case SIOCGIFMEDIA:
1362 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1363 		break;
1364 	case SIOCGIFADDR:
1365 		error = ether_ioctl(ifp, cmd, data);
1366 		break;
1367 	default:
1368 		error = EINVAL;
1369 		break;
1370 	}
1371 	return error;
1372 }
1373 
1374 static void
1375 rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1376 {
1377 	struct usb2_device_request req;
1378 	usb2_error_t error;
1379 
1380 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1381 	req.bRequest = RT2573_READ_EEPROM;
1382 	USETW(req.wValue, 0);
1383 	USETW(req.wIndex, addr);
1384 	USETW(req.wLength, len);
1385 
1386 	error = rum_do_request(sc, &req, buf);
1387 	if (error != 0) {
1388 		device_printf(sc->sc_dev, "could not read EEPROM: %s\n",
1389 		    usb2_errstr(error));
1390 	}
1391 }
1392 
1393 static uint32_t
1394 rum_read(struct rum_softc *sc, uint16_t reg)
1395 {
1396 	uint32_t val;
1397 
1398 	rum_read_multi(sc, reg, &val, sizeof val);
1399 
1400 	return le32toh(val);
1401 }
1402 
1403 static void
1404 rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1405 {
1406 	struct usb2_device_request req;
1407 	usb2_error_t error;
1408 
1409 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1410 	req.bRequest = RT2573_READ_MULTI_MAC;
1411 	USETW(req.wValue, 0);
1412 	USETW(req.wIndex, reg);
1413 	USETW(req.wLength, len);
1414 
1415 	error = rum_do_request(sc, &req, buf);
1416 	if (error != 0) {
1417 		device_printf(sc->sc_dev,
1418 		    "could not multi read MAC register: %s\n",
1419 		    usb2_errstr(error));
1420 	}
1421 }
1422 
1423 static void
1424 rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1425 {
1426 	uint32_t tmp = htole32(val);
1427 
1428 	rum_write_multi(sc, reg, &tmp, sizeof tmp);
1429 }
1430 
1431 static void
1432 rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1433 {
1434 	struct usb2_device_request req;
1435 	usb2_error_t error;
1436 
1437 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1438 	req.bRequest = RT2573_WRITE_MULTI_MAC;
1439 	USETW(req.wValue, 0);
1440 	USETW(req.wIndex, reg);
1441 	USETW(req.wLength, len);
1442 
1443 	error = rum_do_request(sc, &req, buf);
1444 	if (error != 0) {
1445 		device_printf(sc->sc_dev,
1446 		    "could not multi write MAC register: %s\n",
1447 		    usb2_errstr(error));
1448 	}
1449 }
1450 
1451 static void
1452 rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1453 {
1454 	uint32_t tmp;
1455 	int ntries;
1456 
1457 	for (ntries = 0; ntries < 100; ntries++) {
1458 		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1459 			break;
1460 		if (rum_pause(sc, hz / 100))
1461 			break;
1462 	}
1463 	if (ntries == 100) {
1464 		device_printf(sc->sc_dev, "could not write to BBP\n");
1465 		return;
1466 	}
1467 
1468 	tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1469 	rum_write(sc, RT2573_PHY_CSR3, tmp);
1470 }
1471 
1472 static uint8_t
1473 rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1474 {
1475 	uint32_t val;
1476 	int ntries;
1477 
1478 	for (ntries = 0; ntries < 100; ntries++) {
1479 		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1480 			break;
1481 		if (rum_pause(sc, hz / 100))
1482 			break;
1483 	}
1484 	if (ntries == 100) {
1485 		device_printf(sc->sc_dev, "could not read BBP\n");
1486 		return 0;
1487 	}
1488 
1489 	val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1490 	rum_write(sc, RT2573_PHY_CSR3, val);
1491 
1492 	for (ntries = 0; ntries < 100; ntries++) {
1493 		val = rum_read(sc, RT2573_PHY_CSR3);
1494 		if (!(val & RT2573_BBP_BUSY))
1495 			return val & 0xff;
1496 		if (rum_pause(sc, hz / 100))
1497 			break;
1498 	}
1499 
1500 	device_printf(sc->sc_dev, "could not read BBP\n");
1501 	return 0;
1502 }
1503 
1504 static void
1505 rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1506 {
1507 	uint32_t tmp;
1508 	int ntries;
1509 
1510 	for (ntries = 0; ntries < 100; ntries++) {
1511 		if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1512 			break;
1513 		if (rum_pause(sc, hz / 100))
1514 			break;
1515 	}
1516 	if (ntries == 100) {
1517 		device_printf(sc->sc_dev, "could not write to RF\n");
1518 		return;
1519 	}
1520 
1521 	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1522 	    (reg & 3);
1523 	rum_write(sc, RT2573_PHY_CSR4, tmp);
1524 
1525 	/* remember last written value in sc */
1526 	sc->rf_regs[reg] = val;
1527 
1528 	DPRINTFN(15, "RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff);
1529 }
1530 
1531 static void
1532 rum_select_antenna(struct rum_softc *sc)
1533 {
1534 	uint8_t bbp4, bbp77;
1535 	uint32_t tmp;
1536 
1537 	bbp4  = rum_bbp_read(sc, 4);
1538 	bbp77 = rum_bbp_read(sc, 77);
1539 
1540 	/* TBD */
1541 
1542 	/* make sure Rx is disabled before switching antenna */
1543 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1544 	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1545 
1546 	rum_bbp_write(sc,  4, bbp4);
1547 	rum_bbp_write(sc, 77, bbp77);
1548 
1549 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1550 }
1551 
1552 /*
1553  * Enable multi-rate retries for frames sent at OFDM rates.
1554  * In 802.11b/g mode, allow fallback to CCK rates.
1555  */
1556 static void
1557 rum_enable_mrr(struct rum_softc *sc)
1558 {
1559 	struct ifnet *ifp = sc->sc_ifp;
1560 	struct ieee80211com *ic = ifp->if_l2com;
1561 	uint32_t tmp;
1562 
1563 	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1564 
1565 	tmp &= ~RT2573_MRR_CCK_FALLBACK;
1566 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan))
1567 		tmp |= RT2573_MRR_CCK_FALLBACK;
1568 	tmp |= RT2573_MRR_ENABLED;
1569 
1570 	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1571 }
1572 
1573 static void
1574 rum_set_txpreamble(struct rum_softc *sc)
1575 {
1576 	struct ifnet *ifp = sc->sc_ifp;
1577 	struct ieee80211com *ic = ifp->if_l2com;
1578 	uint32_t tmp;
1579 
1580 	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1581 
1582 	tmp &= ~RT2573_SHORT_PREAMBLE;
1583 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1584 		tmp |= RT2573_SHORT_PREAMBLE;
1585 
1586 	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1587 }
1588 
1589 static void
1590 rum_set_basicrates(struct rum_softc *sc)
1591 {
1592 	struct ifnet *ifp = sc->sc_ifp;
1593 	struct ieee80211com *ic = ifp->if_l2com;
1594 
1595 	/* update basic rate set */
1596 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1597 		/* 11b basic rates: 1, 2Mbps */
1598 		rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1599 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan)) {
1600 		/* 11a basic rates: 6, 12, 24Mbps */
1601 		rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1602 	} else {
1603 		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1604 		rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1605 	}
1606 }
1607 
1608 /*
1609  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1610  * driver.
1611  */
1612 static void
1613 rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1614 {
1615 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1616 	uint32_t tmp;
1617 
1618 	/* update all BBP registers that depend on the band */
1619 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1620 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1621 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1622 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1623 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1624 	}
1625 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1626 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1627 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1628 	}
1629 
1630 	sc->bbp17 = bbp17;
1631 	rum_bbp_write(sc,  17, bbp17);
1632 	rum_bbp_write(sc,  96, bbp96);
1633 	rum_bbp_write(sc, 104, bbp104);
1634 
1635 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1636 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1637 		rum_bbp_write(sc, 75, 0x80);
1638 		rum_bbp_write(sc, 86, 0x80);
1639 		rum_bbp_write(sc, 88, 0x80);
1640 	}
1641 
1642 	rum_bbp_write(sc, 35, bbp35);
1643 	rum_bbp_write(sc, 97, bbp97);
1644 	rum_bbp_write(sc, 98, bbp98);
1645 
1646 	tmp = rum_read(sc, RT2573_PHY_CSR0);
1647 	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1648 	if (IEEE80211_IS_CHAN_2GHZ(c))
1649 		tmp |= RT2573_PA_PE_2GHZ;
1650 	else
1651 		tmp |= RT2573_PA_PE_5GHZ;
1652 	rum_write(sc, RT2573_PHY_CSR0, tmp);
1653 }
1654 
1655 static void
1656 rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1657 {
1658 	struct ifnet *ifp = sc->sc_ifp;
1659 	struct ieee80211com *ic = ifp->if_l2com;
1660 	const struct rfprog *rfprog;
1661 	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1662 	int8_t power;
1663 	int i, chan;
1664 
1665 	chan = ieee80211_chan2ieee(ic, c);
1666 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1667 		return;
1668 
1669 	/* select the appropriate RF settings based on what EEPROM says */
1670 	rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1671 		  sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1672 
1673 	/* find the settings for this channel (we know it exists) */
1674 	for (i = 0; rfprog[i].chan != chan; i++);
1675 
1676 	power = sc->txpow[i];
1677 	if (power < 0) {
1678 		bbp94 += power;
1679 		power = 0;
1680 	} else if (power > 31) {
1681 		bbp94 += power - 31;
1682 		power = 31;
1683 	}
1684 
1685 	/*
1686 	 * If we are switching from the 2GHz band to the 5GHz band or
1687 	 * vice-versa, BBP registers need to be reprogrammed.
1688 	 */
1689 	if (c->ic_flags != ic->ic_curchan->ic_flags) {
1690 		rum_select_band(sc, c);
1691 		rum_select_antenna(sc);
1692 	}
1693 	ic->ic_curchan = c;
1694 
1695 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1696 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1697 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1698 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1699 
1700 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1701 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1702 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1703 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1704 
1705 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1706 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1707 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1708 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1709 
1710 	rum_pause(sc, hz / 100);
1711 
1712 	/* enable smart mode for MIMO-capable RFs */
1713 	bbp3 = rum_bbp_read(sc, 3);
1714 
1715 	bbp3 &= ~RT2573_SMART_MODE;
1716 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1717 		bbp3 |= RT2573_SMART_MODE;
1718 
1719 	rum_bbp_write(sc, 3, bbp3);
1720 
1721 	if (bbp94 != RT2573_BBPR94_DEFAULT)
1722 		rum_bbp_write(sc, 94, bbp94);
1723 }
1724 
1725 /*
1726  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1727  * and HostAP operating modes.
1728  */
1729 static void
1730 rum_enable_tsf_sync(struct rum_softc *sc)
1731 {
1732 	struct ifnet *ifp = sc->sc_ifp;
1733 	struct ieee80211com *ic = ifp->if_l2com;
1734 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1735 	uint32_t tmp;
1736 
1737 	if (vap->iv_opmode != IEEE80211_M_STA) {
1738 		/*
1739 		 * Change default 16ms TBTT adjustment to 8ms.
1740 		 * Must be done before enabling beacon generation.
1741 		 */
1742 		rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1743 	}
1744 
1745 	tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1746 
1747 	/* set beacon interval (in 1/16ms unit) */
1748 	tmp |= vap->iv_bss->ni_intval * 16;
1749 
1750 	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1751 	if (vap->iv_opmode == IEEE80211_M_STA)
1752 		tmp |= RT2573_TSF_MODE(1);
1753 	else
1754 		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1755 
1756 	rum_write(sc, RT2573_TXRX_CSR9, tmp);
1757 }
1758 
1759 static void
1760 rum_update_slot(struct ifnet *ifp)
1761 {
1762 	struct rum_softc *sc = ifp->if_softc;
1763 	struct ieee80211com *ic = ifp->if_l2com;
1764 	uint8_t slottime;
1765 	uint32_t tmp;
1766 
1767 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1768 
1769 	tmp = rum_read(sc, RT2573_MAC_CSR9);
1770 	tmp = (tmp & ~0xff) | slottime;
1771 	rum_write(sc, RT2573_MAC_CSR9, tmp);
1772 
1773 	DPRINTF("setting slot time to %uus\n", slottime);
1774 }
1775 
1776 static void
1777 rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1778 {
1779 	uint32_t tmp;
1780 
1781 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1782 	rum_write(sc, RT2573_MAC_CSR4, tmp);
1783 
1784 	tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1785 	rum_write(sc, RT2573_MAC_CSR5, tmp);
1786 }
1787 
1788 static void
1789 rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1790 {
1791 	uint32_t tmp;
1792 
1793 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1794 	rum_write(sc, RT2573_MAC_CSR2, tmp);
1795 
1796 	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1797 	rum_write(sc, RT2573_MAC_CSR3, tmp);
1798 }
1799 
1800 static void
1801 rum_promisctask(struct usb2_proc_msg *pm)
1802 {
1803 	struct rum_task *task = (struct rum_task *)pm;
1804 	struct rum_softc *sc = task->sc;
1805 	struct ifnet *ifp = sc->sc_ifp;
1806 	uint32_t tmp;
1807 
1808 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1809 
1810 	tmp &= ~RT2573_DROP_NOT_TO_ME;
1811 	if (!(ifp->if_flags & IFF_PROMISC))
1812 		tmp |= RT2573_DROP_NOT_TO_ME;
1813 
1814 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1815 
1816 	DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1817 	    "entering" : "leaving");
1818 }
1819 
1820 static const char *
1821 rum_get_rf(int rev)
1822 {
1823 	switch (rev) {
1824 	case RT2573_RF_2527:	return "RT2527 (MIMO XR)";
1825 	case RT2573_RF_2528:	return "RT2528";
1826 	case RT2573_RF_5225:	return "RT5225 (MIMO XR)";
1827 	case RT2573_RF_5226:	return "RT5226";
1828 	default:		return "unknown";
1829 	}
1830 }
1831 
1832 static void
1833 rum_read_eeprom(struct rum_softc *sc)
1834 {
1835 	uint16_t val;
1836 #ifdef RUM_DEBUG
1837 	int i;
1838 #endif
1839 
1840 	/* read MAC address */
1841 	rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, sc->sc_bssid, 6);
1842 
1843 	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1844 	val = le16toh(val);
1845 	sc->rf_rev =   (val >> 11) & 0x1f;
1846 	sc->hw_radio = (val >> 10) & 0x1;
1847 	sc->rx_ant =   (val >> 4)  & 0x3;
1848 	sc->tx_ant =   (val >> 2)  & 0x3;
1849 	sc->nb_ant =   val & 0x3;
1850 
1851 	DPRINTF("RF revision=%d\n", sc->rf_rev);
1852 
1853 	rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1854 	val = le16toh(val);
1855 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
1856 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
1857 
1858 	DPRINTF("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1859 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna);
1860 
1861 	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1862 	val = le16toh(val);
1863 	if ((val & 0xff) != 0xff)
1864 		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
1865 
1866 	/* Only [-10, 10] is valid */
1867 	if (sc->rssi_2ghz_corr < -10 || sc->rssi_2ghz_corr > 10)
1868 		sc->rssi_2ghz_corr = 0;
1869 
1870 	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1871 	val = le16toh(val);
1872 	if ((val & 0xff) != 0xff)
1873 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
1874 
1875 	/* Only [-10, 10] is valid */
1876 	if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
1877 		sc->rssi_5ghz_corr = 0;
1878 
1879 	if (sc->ext_2ghz_lna)
1880 		sc->rssi_2ghz_corr -= 14;
1881 	if (sc->ext_5ghz_lna)
1882 		sc->rssi_5ghz_corr -= 14;
1883 
1884 	DPRINTF("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1885 	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr);
1886 
1887 	rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1888 	val = le16toh(val);
1889 	if ((val & 0xff) != 0xff)
1890 		sc->rffreq = val & 0xff;
1891 
1892 	DPRINTF("RF freq=%d\n", sc->rffreq);
1893 
1894 	/* read Tx power for all a/b/g channels */
1895 	rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1896 	/* XXX default Tx power for 802.11a channels */
1897 	memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1898 #ifdef RUM_DEBUG
1899 	for (i = 0; i < 14; i++)
1900 		DPRINTF("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]);
1901 #endif
1902 
1903 	/* read default values for BBP registers */
1904 	rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1905 #ifdef RUM_DEBUG
1906 	for (i = 0; i < 14; i++) {
1907 		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1908 			continue;
1909 		DPRINTF("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1910 		    sc->bbp_prom[i].val);
1911 	}
1912 #endif
1913 }
1914 
1915 static int
1916 rum_bbp_init(struct rum_softc *sc)
1917 {
1918 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
1919 	int i, ntries;
1920 
1921 	/* wait for BBP to be ready */
1922 	for (ntries = 0; ntries < 100; ntries++) {
1923 		const uint8_t val = rum_bbp_read(sc, 0);
1924 		if (val != 0 && val != 0xff)
1925 			break;
1926 		if (rum_pause(sc, hz / 100))
1927 			break;
1928 	}
1929 	if (ntries == 100) {
1930 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
1931 		return EIO;
1932 	}
1933 
1934 	/* initialize BBP registers to default values */
1935 	for (i = 0; i < N(rum_def_bbp); i++)
1936 		rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1937 
1938 	/* write vendor-specific BBP values (from EEPROM) */
1939 	for (i = 0; i < 16; i++) {
1940 		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1941 			continue;
1942 		rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1943 	}
1944 
1945 	return 0;
1946 #undef N
1947 }
1948 
1949 static void
1950 rum_init_task(struct usb2_proc_msg *pm)
1951 {
1952 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
1953 	struct rum_task *task = (struct rum_task *)pm;
1954 	struct rum_softc *sc = task->sc;
1955 	struct ifnet *ifp = sc->sc_ifp;
1956 	struct ieee80211com *ic = ifp->if_l2com;
1957 	uint32_t tmp;
1958 	usb2_error_t error;
1959 	int i, ntries;
1960 
1961 	RUM_LOCK_ASSERT(sc, MA_OWNED);
1962 
1963 	rum_stop_task(pm);
1964 
1965 	/* initialize MAC registers to default values */
1966 	for (i = 0; i < N(rum_def_mac); i++)
1967 		rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1968 
1969 	/* set host ready */
1970 	rum_write(sc, RT2573_MAC_CSR1, 3);
1971 	rum_write(sc, RT2573_MAC_CSR1, 0);
1972 
1973 	/* wait for BBP/RF to wakeup */
1974 	for (ntries = 0; ntries < 100; ntries++) {
1975 		if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1976 			break;
1977 		rum_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
1978 		if (rum_pause(sc, hz / 100))
1979 			break;
1980 	}
1981 	if (ntries == 100) {
1982 		device_printf(sc->sc_dev,
1983 		    "timeout waiting for BBP/RF to wakeup\n");
1984 		goto fail;
1985 	}
1986 
1987 	if ((error = rum_bbp_init(sc)) != 0)
1988 		goto fail;
1989 
1990 	/* select default channel */
1991 	rum_select_band(sc, ic->ic_curchan);
1992 	rum_select_antenna(sc);
1993 	rum_set_chan(sc, ic->ic_curchan);
1994 
1995 	/* clear STA registers */
1996 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
1997 
1998 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
1999 	rum_set_macaddr(sc, ic->ic_myaddr);
2000 
2001 	/* initialize ASIC */
2002 	rum_write(sc, RT2573_MAC_CSR1, 4);
2003 
2004 	/*
2005 	 * Allocate Tx and Rx xfer queues.
2006 	 */
2007 	rum_setup_tx_list(sc);
2008 
2009 	/* update Rx filter */
2010 	tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2011 
2012 	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2013 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2014 		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2015 		       RT2573_DROP_ACKCTS;
2016 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2017 			tmp |= RT2573_DROP_TODS;
2018 		if (!(ifp->if_flags & IFF_PROMISC))
2019 			tmp |= RT2573_DROP_NOT_TO_ME;
2020 	}
2021 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
2022 
2023 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2024 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2025 	usb2_transfer_set_stall(sc->sc_xfer[RUM_BULK_WR]);
2026 	usb2_transfer_start(sc->sc_xfer[RUM_BULK_RD]);
2027 	return;
2028 
2029 fail:	rum_stop_task(pm);
2030 #undef N
2031 }
2032 
2033 static void
2034 rum_init(void *priv)
2035 {
2036 	struct rum_softc *sc = priv;
2037 	struct ifnet *ifp = sc->sc_ifp;
2038 	struct ieee80211com *ic = ifp->if_l2com;
2039 
2040 	RUM_LOCK(sc);
2041 	rum_queue_command(sc, rum_init_task,
2042 	    &sc->sc_synctask[0].hdr,
2043 	    &sc->sc_synctask[1].hdr);
2044 	RUM_UNLOCK(sc);
2045 
2046 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2047 		ieee80211_start_all(ic);		/* start all vap's */
2048 }
2049 
2050 static void
2051 rum_stop_task(struct usb2_proc_msg *pm)
2052 {
2053 	struct rum_task *task = (struct rum_task *)pm;
2054 	struct rum_softc *sc = task->sc;
2055 	struct ifnet *ifp = sc->sc_ifp;
2056 	uint32_t tmp;
2057 
2058 	RUM_LOCK_ASSERT(sc, MA_OWNED);
2059 
2060 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2061 
2062 	RUM_UNLOCK(sc);
2063 
2064 	/*
2065 	 * Drain the USB transfers, if not already drained:
2066 	 */
2067 	usb2_transfer_drain(sc->sc_xfer[RUM_BULK_WR]);
2068 	usb2_transfer_drain(sc->sc_xfer[RUM_BULK_RD]);
2069 
2070 	RUM_LOCK(sc);
2071 
2072 	rum_unsetup_tx_list(sc);
2073 
2074 	/* disable Rx */
2075 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
2076 	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2077 
2078 	/* reset ASIC */
2079 	rum_write(sc, RT2573_MAC_CSR1, 3);
2080 	rum_write(sc, RT2573_MAC_CSR1, 0);
2081 }
2082 
2083 static int
2084 rum_load_microcode(struct rum_softc *sc, const u_char *ucode, size_t size)
2085 {
2086 	struct usb2_device_request req;
2087 	uint16_t reg = RT2573_MCU_CODE_BASE;
2088 	usb2_error_t error;
2089 
2090 	/* copy firmware image into NIC */
2091 	for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2092 		rum_write(sc, reg, UGETDW(ucode));
2093 
2094 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2095 	req.bRequest = RT2573_MCU_CNTL;
2096 	USETW(req.wValue, RT2573_MCU_RUN);
2097 	USETW(req.wIndex, 0);
2098 	USETW(req.wLength, 0);
2099 
2100 	error = rum_do_request(sc, &req, NULL);
2101 	if (error != 0) {
2102 		device_printf(sc->sc_dev, "could not run firmware: %s\n",
2103 		    usb2_errstr(error));
2104 	}
2105 	return error;
2106 }
2107 
2108 static int
2109 rum_prepare_beacon(struct rum_softc *sc, struct ieee80211vap *vap)
2110 {
2111 	struct ieee80211com *ic = vap->iv_ic;
2112 	const struct ieee80211_txparam *tp;
2113 	struct rum_tx_desc desc;
2114 	struct mbuf *m0;
2115 
2116 	m0 = ieee80211_beacon_alloc(vap->iv_bss, &RUM_VAP(vap)->bo);
2117 	if (m0 == NULL) {
2118 		return ENOBUFS;
2119 	}
2120 
2121 	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2122 	rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2123 	    m0->m_pkthdr.len, tp->mgmtrate);
2124 
2125 	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2126 	rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2127 
2128 	/* copy beacon header and payload into NIC memory */
2129 	rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2130 	    m0->m_pkthdr.len);
2131 
2132 	m_freem(m0);
2133 
2134 	return 0;
2135 }
2136 
2137 static int
2138 rum_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2139     const struct ieee80211_bpf_params *params)
2140 {
2141 	struct ifnet *ifp = ni->ni_ic->ic_ifp;
2142 	struct rum_softc *sc = ifp->if_softc;
2143 
2144 	RUM_LOCK(sc);
2145 	/* prevent management frames from being sent if we're not ready */
2146 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2147 		RUM_UNLOCK(sc);
2148 		m_freem(m);
2149 		ieee80211_free_node(ni);
2150 		return ENETDOWN;
2151 	}
2152 	if (sc->tx_nfree < RUM_TX_MINFREE) {
2153 		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2154 		RUM_UNLOCK(sc);
2155 		m_freem(m);
2156 		ieee80211_free_node(ni);
2157 		return EIO;
2158 	}
2159 
2160 	ifp->if_opackets++;
2161 
2162 	if (params == NULL) {
2163 		/*
2164 		 * Legacy path; interpret frame contents to decide
2165 		 * precisely how to send the frame.
2166 		 */
2167 		if (rum_tx_mgt(sc, m, ni) != 0)
2168 			goto bad;
2169 	} else {
2170 		/*
2171 		 * Caller supplied explicit parameters to use in
2172 		 * sending the frame.
2173 		 */
2174 		if (rum_tx_raw(sc, m, ni, params) != 0)
2175 			goto bad;
2176 	}
2177 	RUM_UNLOCK(sc);
2178 
2179 	return 0;
2180 bad:
2181 	ifp->if_oerrors++;
2182 	RUM_UNLOCK(sc);
2183 	ieee80211_free_node(ni);
2184 	return EIO;
2185 }
2186 
2187 static void
2188 rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
2189 {
2190 	struct ieee80211vap *vap = ni->ni_vap;
2191 	struct rum_vap *rvp = RUM_VAP(vap);
2192 
2193 	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2194 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2195 
2196 	ieee80211_amrr_node_init(&rvp->amrr, &RUM_NODE(ni)->amn, ni);
2197 
2198 	usb2_callout_reset(&rvp->amrr_ch, hz, rum_amrr_timeout, rvp);
2199 }
2200 
2201 static void
2202 rum_amrr_timeout(void *arg)
2203 {
2204 	struct rum_vap *rvp = arg;
2205 	struct rum_softc *sc = rvp->sc;
2206 
2207 	rum_queue_command(sc, rum_amrr_task,
2208 	    &rvp->amrr_task[0].hdr, &rvp->amrr_task[1].hdr);
2209 }
2210 
2211 static void
2212 rum_amrr_task(struct usb2_proc_msg *pm)
2213 {
2214 	struct rum_task *task = (struct rum_task *)pm;
2215 	struct rum_softc *sc = task->sc;
2216 	struct ifnet *ifp = sc->sc_ifp;
2217 	struct ieee80211com *ic = ifp->if_l2com;
2218 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2219 	struct rum_vap *rvp = RUM_VAP(vap);
2220 	struct ieee80211_node *ni = vap->iv_bss;
2221 	int ok, fail;
2222 
2223 	/* read and clear statistic registers (STA_CSR0 to STA_CSR10) */
2224 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof(sc->sta));
2225 
2226 	ok = (le32toh(sc->sta[4]) >> 16) +	/* TX ok w/o retry */
2227 	    (le32toh(sc->sta[5]) & 0xffff);	/* TX ok w/ retry */
2228 	fail = (le32toh(sc->sta[5]) >> 16);	/* TX retry-fail count */
2229 
2230 	ieee80211_amrr_tx_update(&RUM_NODE(ni)->amn,
2231 	    ok+fail, ok, (le32toh(sc->sta[5]) & 0xffff) + fail);
2232 	(void) ieee80211_amrr_choose(ni, &RUM_NODE(ni)->amn);
2233 
2234 	ifp->if_oerrors += fail;	/* count TX retry-fail as Tx errors */
2235 
2236 	usb2_callout_reset(&rvp->amrr_ch, hz, rum_amrr_timeout, rvp);
2237 }
2238 
2239 /* ARGUSED */
2240 static struct ieee80211_node *
2241 rum_node_alloc(struct ieee80211vap *vap __unused,
2242 	const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2243 {
2244 	struct rum_node *rn;
2245 
2246 	rn = malloc(sizeof(struct rum_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2247 	return rn != NULL ? &rn->ni : NULL;
2248 }
2249 
2250 static void
2251 rum_newassoc(struct ieee80211_node *ni, int isnew)
2252 {
2253 	struct ieee80211vap *vap = ni->ni_vap;
2254 
2255 	ieee80211_amrr_node_init(&RUM_VAP(vap)->amrr, &RUM_NODE(ni)->amn, ni);
2256 }
2257 
2258 static void
2259 rum_scan_start(struct ieee80211com *ic)
2260 {
2261 	struct rum_softc *sc = ic->ic_ifp->if_softc;
2262 
2263 	RUM_LOCK(sc);
2264 	/* do it in a process context */
2265 	sc->sc_scan_action = RUM_SCAN_START;
2266 	rum_queue_command(sc, rum_scantask,
2267 	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
2268 	RUM_UNLOCK(sc);
2269 
2270 }
2271 
2272 static void
2273 rum_scan_end(struct ieee80211com *ic)
2274 {
2275 	struct rum_softc *sc = ic->ic_ifp->if_softc;
2276 
2277 	RUM_LOCK(sc);
2278 	/* do it in a process context */
2279 	sc->sc_scan_action = RUM_SCAN_END;
2280 	rum_queue_command(sc, rum_scantask,
2281 	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
2282 	RUM_UNLOCK(sc);
2283 
2284 }
2285 
2286 static void
2287 rum_set_channel(struct ieee80211com *ic)
2288 {
2289 	struct rum_softc *sc = ic->ic_ifp->if_softc;
2290 
2291 	RUM_LOCK(sc);
2292 	/* do it in a process context */
2293 	sc->sc_scan_action = RUM_SET_CHANNEL;
2294 	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
2295 	rum_queue_command(sc, rum_scantask,
2296 	    &sc->sc_scantask[0].hdr, &sc->sc_scantask[1].hdr);
2297 	RUM_UNLOCK(sc);
2298 }
2299 
2300 static void
2301 rum_scantask(struct usb2_proc_msg *pm)
2302 {
2303 	struct rum_task *task = (struct rum_task *)pm;
2304 	struct rum_softc *sc = task->sc;
2305 	struct ifnet *ifp = sc->sc_ifp;
2306 	struct ieee80211com *ic = ifp->if_l2com;
2307 	uint32_t tmp;
2308 
2309 	RUM_LOCK_ASSERT(sc, MA_OWNED);
2310 
2311 	switch (sc->sc_scan_action) {
2312 	case RUM_SCAN_START:
2313 		/* abort TSF synchronization */
2314 		tmp = rum_read(sc, RT2573_TXRX_CSR9);
2315 		rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
2316 		rum_set_bssid(sc, ifp->if_broadcastaddr);
2317 		break;
2318 
2319 	case RUM_SET_CHANNEL:
2320 		rum_set_chan(sc, ic->ic_curchan);
2321 		break;
2322 
2323 	default: /* RUM_SCAN_END */
2324 		rum_enable_tsf_sync(sc);
2325 		rum_set_bssid(sc, sc->sc_bssid);
2326 		break;
2327 	}
2328 }
2329 
2330 static int
2331 rum_get_rssi(struct rum_softc *sc, uint8_t raw)
2332 {
2333 	struct ifnet *ifp = sc->sc_ifp;
2334 	struct ieee80211com *ic = ifp->if_l2com;
2335 	int lna, agc, rssi;
2336 
2337 	lna = (raw >> 5) & 0x3;
2338 	agc = raw & 0x1f;
2339 
2340 	if (lna == 0) {
2341 		/*
2342 		 * No RSSI mapping
2343 		 *
2344 		 * NB: Since RSSI is relative to noise floor, -1 is
2345 		 *     adequate for caller to know error happened.
2346 		 */
2347 		return -1;
2348 	}
2349 
2350 	rssi = (2 * agc) - RT2573_NOISE_FLOOR;
2351 
2352 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
2353 		rssi += sc->rssi_2ghz_corr;
2354 
2355 		if (lna == 1)
2356 			rssi -= 64;
2357 		else if (lna == 2)
2358 			rssi -= 74;
2359 		else if (lna == 3)
2360 			rssi -= 90;
2361 	} else {
2362 		rssi += sc->rssi_5ghz_corr;
2363 
2364 		if (!sc->ext_5ghz_lna && lna != 1)
2365 			rssi += 4;
2366 
2367 		if (lna == 1)
2368 			rssi -= 64;
2369 		else if (lna == 2)
2370 			rssi -= 86;
2371 		else if (lna == 3)
2372 			rssi -= 100;
2373 	}
2374 	return rssi;
2375 }
2376 
2377 static int
2378 rum_pause(struct rum_softc *sc, int timeout)
2379 {
2380 	if (usb2_proc_is_gone(&sc->sc_tq))
2381 		return (1);
2382 
2383 	usb2_pause_mtx(&sc->sc_mtx, timeout);
2384 	return (0);
2385 }
2386 
2387 static void
2388 rum_queue_command(struct rum_softc *sc, usb2_proc_callback_t *fn,
2389     struct usb2_proc_msg *t0, struct usb2_proc_msg *t1)
2390 {
2391 	struct rum_task *task;
2392 
2393 	RUM_LOCK_ASSERT(sc, MA_OWNED);
2394 
2395 	if (usb2_proc_is_gone(&sc->sc_tq)) {
2396 		DPRINTF("proc is gone\n");
2397 		return;         /* nothing to do */
2398 	}
2399 	/*
2400 	 * NOTE: The task cannot get executed before we drop the
2401 	 * "sc_mtx" mutex. It is safe to update fields in the message
2402 	 * structure after that the message got queued.
2403 	 */
2404 	task = (struct rum_task *)
2405 	  usb2_proc_msignal(&sc->sc_tq, t0, t1);
2406 
2407 	/* Setup callback and softc pointers */
2408 	task->hdr.pm_callback = fn;
2409 	task->sc = sc;
2410 
2411         /*
2412          * Init and stop must be synchronous!
2413          */
2414         if ((fn == rum_init_task) || (fn == rum_stop_task))
2415                 usb2_proc_mwait(&sc->sc_tq, t0, t1);
2416 }
2417 
2418 static device_method_t rum_methods[] = {
2419 	/* Device interface */
2420 	DEVMETHOD(device_probe,		rum_match),
2421 	DEVMETHOD(device_attach,	rum_attach),
2422 	DEVMETHOD(device_detach,	rum_detach),
2423 
2424 	{ 0, 0 }
2425 };
2426 
2427 static driver_t rum_driver = {
2428 	.name = "rum",
2429 	.methods = rum_methods,
2430 	.size = sizeof(struct rum_softc),
2431 };
2432 
2433 static devclass_t rum_devclass;
2434 
2435 DRIVER_MODULE(rum, ushub, rum_driver, rum_devclass, NULL, 0);
2436