xref: /illumos-gate/usr/src/uts/common/io/rum/rum.c (revision 4c17c04f214dbe4ce468ba6e06def8cbefbead74)
1 /*
2  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
3  * Use is subject to license terms.
4  */
5 
6 /*
7  * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
8  * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
9  *
10  * Permission to use, copy, modify, and distribute this software for any
11  * purpose with or without fee is hereby granted, provided that the above
12  * copyright notice and this permission notice appear in all copies.
13  *
14  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
15  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
16  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
17  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
18  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
19  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
20  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21  */
22 
23 /*
24  * Ralink Technology RT2501USB/RT2601USB chipset driver
25  * http://www.ralinktech.com.tw/
26  */
27 
28 #include <sys/types.h>
29 #include <sys/byteorder.h>
30 #include <sys/conf.h>
31 #include <sys/cmn_err.h>
32 #include <sys/stat.h>
33 #include <sys/ddi.h>
34 #include <sys/sunddi.h>
35 #include <sys/strsubr.h>
36 #include <sys/ethernet.h>
37 #include <inet/common.h>
38 #include <inet/nd.h>
39 #include <inet/mi.h>
40 #include <sys/note.h>
41 #include <sys/stream.h>
42 #include <sys/strsun.h>
43 #include <sys/modctl.h>
44 #include <sys/devops.h>
45 #include <sys/dlpi.h>
46 #include <sys/mac_provider.h>
47 #include <sys/mac_wifi.h>
48 #include <sys/net80211.h>
49 #include <sys/net80211_proto.h>
50 #include <sys/varargs.h>
51 #include <sys/policy.h>
52 #include <sys/pci.h>
53 #include <sys/crypto/common.h>
54 #include <sys/crypto/api.h>
55 #include <inet/wifi_ioctl.h>
56 
57 #define	USBDRV_MAJOR_VER	2
58 #define	USBDRV_MINOR_VER	0
59 #include <sys/usb/usba.h>
60 
61 #include "rum_reg.h"
62 #include "rum_var.h"
63 #include "rt2573_ucode.h"
64 
65 static void *rum_soft_state_p = NULL;
66 
67 #define	RAL_TXBUF_SIZE  	(IEEE80211_MAX_LEN)
68 #define	RAL_RXBUF_SIZE  	(IEEE80211_MAX_LEN)
69 
70 /* quickly determine if a given rate is CCK or OFDM */
71 #define	RUM_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
72 #define	RUM_ACK_SIZE	14	/* 10 + 4(FCS) */
73 #define	RUM_CTS_SIZE	14	/* 10 + 4(FCS) */
74 
75 #define	RUM_N(a)		(sizeof (a) / sizeof ((a)[0]))
76 
77 /*
78  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
79  */
80 static const struct ieee80211_rateset rum_rateset_11a =
81 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
82 
83 static const struct ieee80211_rateset rum_rateset_11b =
84 	{ 4, { 2, 4, 11, 22 } };
85 
86 static const struct ieee80211_rateset rum_rateset_11g =
87 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
88 
89 static const struct {
90 	uint32_t	reg;
91 	uint32_t	val;
92 } rum_def_mac[] = {
93 	{ RT2573_TXRX_CSR0,  0x025fb032 },
94 	{ RT2573_TXRX_CSR1,  0x9eaa9eaf },
95 	{ RT2573_TXRX_CSR2,  0x8a8b8c8d },
96 	{ RT2573_TXRX_CSR3,  0x00858687 },
97 	{ RT2573_TXRX_CSR7,  0x2e31353b },
98 	{ RT2573_TXRX_CSR8,  0x2a2a2a2c },
99 	{ RT2573_TXRX_CSR15, 0x0000000f },
100 	{ RT2573_MAC_CSR6,   0x00000fff },
101 	{ RT2573_MAC_CSR8,   0x016c030a },
102 	{ RT2573_MAC_CSR10,  0x00000718 },
103 	{ RT2573_MAC_CSR12,  0x00000004 },
104 	{ RT2573_MAC_CSR13,  0x00007f00 },
105 	{ RT2573_SEC_CSR0,   0x00000000 },
106 	{ RT2573_SEC_CSR1,   0x00000000 },
107 	{ RT2573_SEC_CSR5,   0x00000000 },
108 	{ RT2573_PHY_CSR1,   0x000023b0 },
109 	{ RT2573_PHY_CSR5,   0x00040a06 },
110 	{ RT2573_PHY_CSR6,   0x00080606 },
111 	{ RT2573_PHY_CSR7,   0x00000408 },
112 	{ RT2573_AIFSN_CSR,  0x00002273 },
113 	{ RT2573_CWMIN_CSR,  0x00002344 },
114 	{ RT2573_CWMAX_CSR,  0x000034aa }
115 };
116 
117 static const struct {
118 	uint8_t	reg;
119 	uint8_t	val;
120 } rum_def_bbp[] = {
121 	{   3, 0x80 },
122 	{  15, 0x30 },
123 	{  17, 0x20 },
124 	{  21, 0xc8 },
125 	{  22, 0x38 },
126 	{  23, 0x06 },
127 	{  24, 0xfe },
128 	{  25, 0x0a },
129 	{  26, 0x0d },
130 	{  32, 0x0b },
131 	{  34, 0x12 },
132 	{  37, 0x07 },
133 	{  39, 0xf8 },
134 	{  41, 0x60 },
135 	{  53, 0x10 },
136 	{  54, 0x18 },
137 	{  60, 0x10 },
138 	{  61, 0x04 },
139 	{  62, 0x04 },
140 	{  75, 0xfe },
141 	{  86, 0xfe },
142 	{  88, 0xfe },
143 	{  90, 0x0f },
144 	{  99, 0x00 },
145 	{ 102, 0x16 },
146 	{ 107, 0x04 }
147 };
148 
149 static const struct rfprog {
150 	uint8_t		chan;
151 	uint32_t	r1, r2, r3, r4;
152 }  rum_rf5226[] = {
153 	{   1, 0x00b03, 0x001e1, 0x1a014, 0x30282 },
154 	{   2, 0x00b03, 0x001e1, 0x1a014, 0x30287 },
155 	{   3, 0x00b03, 0x001e2, 0x1a014, 0x30282 },
156 	{   4, 0x00b03, 0x001e2, 0x1a014, 0x30287 },
157 	{   5, 0x00b03, 0x001e3, 0x1a014, 0x30282 },
158 	{   6, 0x00b03, 0x001e3, 0x1a014, 0x30287 },
159 	{   7, 0x00b03, 0x001e4, 0x1a014, 0x30282 },
160 	{   8, 0x00b03, 0x001e4, 0x1a014, 0x30287 },
161 	{   9, 0x00b03, 0x001e5, 0x1a014, 0x30282 },
162 	{  10, 0x00b03, 0x001e5, 0x1a014, 0x30287 },
163 	{  11, 0x00b03, 0x001e6, 0x1a014, 0x30282 },
164 	{  12, 0x00b03, 0x001e6, 0x1a014, 0x30287 },
165 	{  13, 0x00b03, 0x001e7, 0x1a014, 0x30282 },
166 	{  14, 0x00b03, 0x001e8, 0x1a014, 0x30284 },
167 
168 	{  34, 0x00b03, 0x20266, 0x36014, 0x30282 },
169 	{  38, 0x00b03, 0x20267, 0x36014, 0x30284 },
170 	{  42, 0x00b03, 0x20268, 0x36014, 0x30286 },
171 	{  46, 0x00b03, 0x20269, 0x36014, 0x30288 },
172 
173 	{  36, 0x00b03, 0x00266, 0x26014, 0x30288 },
174 	{  40, 0x00b03, 0x00268, 0x26014, 0x30280 },
175 	{  44, 0x00b03, 0x00269, 0x26014, 0x30282 },
176 	{  48, 0x00b03, 0x0026a, 0x26014, 0x30284 },
177 	{  52, 0x00b03, 0x0026b, 0x26014, 0x30286 },
178 	{  56, 0x00b03, 0x0026c, 0x26014, 0x30288 },
179 	{  60, 0x00b03, 0x0026e, 0x26014, 0x30280 },
180 	{  64, 0x00b03, 0x0026f, 0x26014, 0x30282 },
181 
182 	{ 100, 0x00b03, 0x0028a, 0x2e014, 0x30280 },
183 	{ 104, 0x00b03, 0x0028b, 0x2e014, 0x30282 },
184 	{ 108, 0x00b03, 0x0028c, 0x2e014, 0x30284 },
185 	{ 112, 0x00b03, 0x0028d, 0x2e014, 0x30286 },
186 	{ 116, 0x00b03, 0x0028e, 0x2e014, 0x30288 },
187 	{ 120, 0x00b03, 0x002a0, 0x2e014, 0x30280 },
188 	{ 124, 0x00b03, 0x002a1, 0x2e014, 0x30282 },
189 	{ 128, 0x00b03, 0x002a2, 0x2e014, 0x30284 },
190 	{ 132, 0x00b03, 0x002a3, 0x2e014, 0x30286 },
191 	{ 136, 0x00b03, 0x002a4, 0x2e014, 0x30288 },
192 	{ 140, 0x00b03, 0x002a6, 0x2e014, 0x30280 },
193 
194 	{ 149, 0x00b03, 0x002a8, 0x2e014, 0x30287 },
195 	{ 153, 0x00b03, 0x002a9, 0x2e014, 0x30289 },
196 	{ 157, 0x00b03, 0x002ab, 0x2e014, 0x30281 },
197 	{ 161, 0x00b03, 0x002ac, 0x2e014, 0x30283 },
198 	{ 165, 0x00b03, 0x002ad, 0x2e014, 0x30285 }
199 }, rum_rf5225[] = {
200 	{   1, 0x00b33, 0x011e1, 0x1a014, 0x30282 },
201 	{   2, 0x00b33, 0x011e1, 0x1a014, 0x30287 },
202 	{   3, 0x00b33, 0x011e2, 0x1a014, 0x30282 },
203 	{   4, 0x00b33, 0x011e2, 0x1a014, 0x30287 },
204 	{   5, 0x00b33, 0x011e3, 0x1a014, 0x30282 },
205 	{   6, 0x00b33, 0x011e3, 0x1a014, 0x30287 },
206 	{   7, 0x00b33, 0x011e4, 0x1a014, 0x30282 },
207 	{   8, 0x00b33, 0x011e4, 0x1a014, 0x30287 },
208 	{   9, 0x00b33, 0x011e5, 0x1a014, 0x30282 },
209 	{  10, 0x00b33, 0x011e5, 0x1a014, 0x30287 },
210 	{  11, 0x00b33, 0x011e6, 0x1a014, 0x30282 },
211 	{  12, 0x00b33, 0x011e6, 0x1a014, 0x30287 },
212 	{  13, 0x00b33, 0x011e7, 0x1a014, 0x30282 },
213 	{  14, 0x00b33, 0x011e8, 0x1a014, 0x30284 },
214 
215 	{  34, 0x00b33, 0x01266, 0x26014, 0x30282 },
216 	{  38, 0x00b33, 0x01267, 0x26014, 0x30284 },
217 	{  42, 0x00b33, 0x01268, 0x26014, 0x30286 },
218 	{  46, 0x00b33, 0x01269, 0x26014, 0x30288 },
219 
220 	{  36, 0x00b33, 0x01266, 0x26014, 0x30288 },
221 	{  40, 0x00b33, 0x01268, 0x26014, 0x30280 },
222 	{  44, 0x00b33, 0x01269, 0x26014, 0x30282 },
223 	{  48, 0x00b33, 0x0126a, 0x26014, 0x30284 },
224 	{  52, 0x00b33, 0x0126b, 0x26014, 0x30286 },
225 	{  56, 0x00b33, 0x0126c, 0x26014, 0x30288 },
226 	{  60, 0x00b33, 0x0126e, 0x26014, 0x30280 },
227 	{  64, 0x00b33, 0x0126f, 0x26014, 0x30282 },
228 
229 	{ 100, 0x00b33, 0x0128a, 0x2e014, 0x30280 },
230 	{ 104, 0x00b33, 0x0128b, 0x2e014, 0x30282 },
231 	{ 108, 0x00b33, 0x0128c, 0x2e014, 0x30284 },
232 	{ 112, 0x00b33, 0x0128d, 0x2e014, 0x30286 },
233 	{ 116, 0x00b33, 0x0128e, 0x2e014, 0x30288 },
234 	{ 120, 0x00b33, 0x012a0, 0x2e014, 0x30280 },
235 	{ 124, 0x00b33, 0x012a1, 0x2e014, 0x30282 },
236 	{ 128, 0x00b33, 0x012a2, 0x2e014, 0x30284 },
237 	{ 132, 0x00b33, 0x012a3, 0x2e014, 0x30286 },
238 	{ 136, 0x00b33, 0x012a4, 0x2e014, 0x30288 },
239 	{ 140, 0x00b33, 0x012a6, 0x2e014, 0x30280 },
240 
241 	{ 149, 0x00b33, 0x012a8, 0x2e014, 0x30287 },
242 	{ 153, 0x00b33, 0x012a9, 0x2e014, 0x30289 },
243 	{ 157, 0x00b33, 0x012ab, 0x2e014, 0x30281 },
244 	{ 161, 0x00b33, 0x012ac, 0x2e014, 0x30283 },
245 	{ 165, 0x00b33, 0x012ad, 0x2e014, 0x30285 }
246 };
247 
248 /*
249  * device operations
250  */
251 static int rum_attach(dev_info_t *, ddi_attach_cmd_t);
252 static int rum_detach(dev_info_t *, ddi_detach_cmd_t);
253 
254 /*
255  * Module Loading Data & Entry Points
256  */
257 DDI_DEFINE_STREAM_OPS(rum_dev_ops, nulldev, nulldev, rum_attach,
258     rum_detach, nodev, NULL, D_MP, NULL, ddi_quiesce_not_needed);
259 
260 static struct modldrv rum_modldrv = {
261 	&mod_driverops,		/* Type of module.  This one is a driver */
262 	"rum driver v1.1",	/* short description */
263 	&rum_dev_ops		/* driver specific ops */
264 };
265 
266 static struct modlinkage modlinkage = {
267 	MODREV_1,
268 	(void *)&rum_modldrv,
269 	NULL
270 };
271 
272 static int	rum_m_stat(void *,  uint_t, uint64_t *);
273 static int	rum_m_start(void *);
274 static void	rum_m_stop(void *);
275 static int	rum_m_promisc(void *, boolean_t);
276 static int	rum_m_multicst(void *, boolean_t, const uint8_t *);
277 static int	rum_m_unicst(void *, const uint8_t *);
278 static mblk_t	*rum_m_tx(void *, mblk_t *);
279 static void	rum_m_ioctl(void *, queue_t *, mblk_t *);
280 static int	rum_m_setprop(void *, const char *, mac_prop_id_t,
281     uint_t, const void *);
282 static int	rum_m_getprop(void *, const char *, mac_prop_id_t,
283     uint_t, uint_t, void *, uint_t *);
284 
285 static mac_callbacks_t rum_m_callbacks = {
286 	MC_IOCTL | MC_SETPROP | MC_GETPROP,
287 	rum_m_stat,
288 	rum_m_start,
289 	rum_m_stop,
290 	rum_m_promisc,
291 	rum_m_multicst,
292 	rum_m_unicst,
293 	rum_m_tx,
294 	rum_m_ioctl,
295 	NULL,		/* mc_getcapab */
296 	NULL,
297 	NULL,
298 	rum_m_setprop,
299 	rum_m_getprop
300 };
301 
302 extern const char *usb_str_cr(int);
303 static void rum_amrr_start(struct rum_softc *, struct ieee80211_node *);
304 static int  rum_tx_trigger(struct rum_softc *, mblk_t *);
305 static int  rum_rx_trigger(struct rum_softc *);
306 
307 uint32_t rum_dbg_flags = 0;
308 
309 #ifdef DEBUG
310 void
311 ral_debug(uint32_t dbg_flags, const int8_t *fmt, ...)
312 {
313 	va_list args;
314 
315 	if (dbg_flags & rum_dbg_flags) {
316 		va_start(args, fmt);
317 		vcmn_err(CE_CONT, fmt, args);
318 		va_end(args);
319 	}
320 }
321 #endif
322 
323 static void
324 rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
325 {
326 	usb_ctrl_setup_t req;
327 	usb_cr_t cr;
328 	usb_cb_flags_t cf;
329 	mblk_t *mp;
330 	int err;
331 
332 	bzero(&req, sizeof (req));
333 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
334 	req.bRequest = RT2573_READ_MULTI_MAC;
335 	req.wValue = 0;
336 	req.wIndex = reg;
337 	req.wLength = (uint16_t)len;
338 	req.attrs = USB_ATTRS_AUTOCLEARING;
339 
340 	mp = NULL;
341 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
342 	    &cr, &cf, 0);
343 
344 	if (err != USB_SUCCESS) {
345 		RAL_DEBUG(RAL_DBG_ERR,
346 		    "rum_read_multi(): could not read MAC register:"
347 		    "cr:%s(%d), cf:(%x)\n",
348 		    usb_str_cr(cr), cr, cf);
349 		return;
350 	}
351 
352 	bcopy(mp->b_rptr, buf, len);
353 	freemsg(mp);
354 }
355 
356 static uint32_t
357 rum_read(struct rum_softc *sc, uint16_t reg)
358 {
359 	uint32_t val;
360 
361 	rum_read_multi(sc, reg, &val, sizeof (val));
362 
363 	return (LE_32(val));
364 }
365 
366 static void
367 rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
368 {
369 	usb_ctrl_setup_t req;
370 	usb_cr_t cr;
371 	usb_cb_flags_t cf;
372 	mblk_t *mp;
373 	int err;
374 
375 	bzero(&req, sizeof (req));
376 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
377 	req.bRequest = RT2573_WRITE_MULTI_MAC;
378 	req.wValue = 0;
379 	req.wIndex = reg;
380 	req.wLength = (uint16_t)len;
381 	req.attrs = USB_ATTRS_NONE;
382 
383 	if ((mp = allocb(len, BPRI_HI)) == NULL) {
384 		RAL_DEBUG(RAL_DBG_ERR, "rum_write_multi(): failed alloc mblk.");
385 		return;
386 	}
387 
388 	bcopy(buf, mp->b_wptr, len);
389 	mp->b_wptr += len;
390 
391 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
392 	    &cr, &cf, 0);
393 
394 	if (err != USB_SUCCESS) {
395 		RAL_DEBUG(RAL_DBG_USB,
396 		    "rum_write_multi(): could not write MAC register:"
397 		    "cr:%s(%d), cf:(%x)\n",
398 		    usb_str_cr(cr), cr, cf);
399 	}
400 
401 	freemsg(mp);
402 }
403 
404 static void
405 rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
406 {
407 	uint32_t tmp = LE_32(val);
408 
409 	rum_write_multi(sc, reg, &tmp, sizeof (tmp));
410 }
411 
412 #define	UGETDW(w) ((w)[0] | ((w)[1] << 8) | ((w)[2] << 16) | ((w)[3] << 24))
413 
414 static int
415 rum_load_microcode(struct rum_softc *sc)
416 {
417 	usb_ctrl_setup_t req;
418 	usb_cr_t cr;
419 	usb_cb_flags_t cf;
420 	int err;
421 
422 	const uint8_t *ucode;
423 	int size;
424 	uint16_t reg = RT2573_MCU_CODE_BASE;
425 
426 	ucode = rt2573_ucode;
427 	size  = sizeof (rt2573_ucode);
428 
429 	/* copy firmware image into NIC */
430 	for (; size >= 4; reg += 4, ucode += 4, size -= 4) {
431 		rum_write(sc, reg, UGETDW(ucode));
432 		/* rum_write(sc, reg, *(uint32_t *)(ucode)); */
433 	}
434 
435 	bzero(&req, sizeof (req));
436 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_HOST_TO_DEV;
437 	req.bRequest = RT2573_MCU_CNTL;
438 	req.wValue = RT2573_MCU_RUN;
439 	req.wIndex = 0;
440 	req.wLength = 0;
441 	req.attrs = USB_ATTRS_NONE;
442 
443 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, NULL,
444 	    &cr, &cf, 0);
445 
446 	if (err != USB_SUCCESS) {
447 		RAL_DEBUG(RAL_DBG_ERR,
448 		    "rum_load_microcode(): could not run firmware: "
449 		    "cr:%s(%d), cf:(%x)\n",
450 		    usb_str_cr(cr), cr, cf);
451 	}
452 
453 	RAL_DEBUG(RAL_DBG_MSG,
454 	    "rum_load_microcode(%d): done\n", sizeof (rt2573_ucode));
455 
456 	return (err);
457 }
458 
459 static void
460 rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
461 {
462 	usb_ctrl_setup_t req;
463 	usb_cr_t cr;
464 	usb_cb_flags_t cf;
465 	mblk_t *mp;
466 	int err;
467 
468 	bzero(&req, sizeof (req));
469 	req.bmRequestType = USB_DEV_REQ_TYPE_VENDOR | USB_DEV_REQ_DEV_TO_HOST;
470 	req.bRequest = RT2573_READ_EEPROM;
471 	req.wValue = 0;
472 	req.wIndex = addr;
473 	req.wLength = (uint16_t)len;
474 
475 	mp = NULL;
476 	err = usb_pipe_ctrl_xfer_wait(sc->sc_udev->dev_default_ph, &req, &mp,
477 	    &cr, &cf, 0);
478 
479 	if (err != USB_SUCCESS) {
480 		RAL_DEBUG(RAL_DBG_USB,
481 		    "rum_eeprom_read(): could not read EEPROM:"
482 		    "cr:%s(%d), cf:(%x)\n",
483 		    usb_str_cr(cr), cr, cf);
484 		return;
485 	}
486 
487 	bcopy(mp->b_rptr, buf, len);
488 	freemsg(mp);
489 }
490 
491 /* ARGSUSED */
492 static void
493 rum_txeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
494 {
495 	struct rum_softc *sc = (struct rum_softc *)req->bulk_client_private;
496 	struct ieee80211com *ic = &sc->sc_ic;
497 
498 	RAL_DEBUG(RAL_DBG_TX,
499 	    "rum_txeof(): cr:%s(%d), flags:0x%x, tx_queued:%d",
500 	    usb_str_cr(req->bulk_completion_reason),
501 	    req->bulk_completion_reason,
502 	    req->bulk_cb_flags,
503 	    sc->tx_queued);
504 
505 	if (req->bulk_completion_reason != USB_CR_OK)
506 		sc->sc_tx_err++;
507 
508 	mutex_enter(&sc->tx_lock);
509 
510 	sc->tx_queued--;
511 	sc->sc_tx_timer = 0;
512 
513 	if (sc->sc_need_sched) {
514 		sc->sc_need_sched = 0;
515 		mac_tx_update(ic->ic_mach);
516 	}
517 
518 	mutex_exit(&sc->tx_lock);
519 	usb_free_bulk_req(req);
520 }
521 
522 /* ARGSUSED */
523 static void
524 rum_rxeof(usb_pipe_handle_t pipe, usb_bulk_req_t *req)
525 {
526 	struct rum_softc *sc = (struct rum_softc *)req->bulk_client_private;
527 	struct ieee80211com *ic = &sc->sc_ic;
528 
529 	struct rum_rx_desc *desc;
530 	struct ieee80211_frame *wh;
531 	struct ieee80211_node *ni;
532 
533 	mblk_t *m, *mp;
534 	int len, pktlen;
535 	char *rxbuf;
536 
537 	mp = req->bulk_data;
538 	req->bulk_data = NULL;
539 
540 	RAL_DEBUG(RAL_DBG_RX,
541 	    "rum_rxeof(): cr:%s(%d), flags:0x%x, rx_queued:%d",
542 	    usb_str_cr(req->bulk_completion_reason),
543 	    req->bulk_completion_reason,
544 	    req->bulk_cb_flags,
545 	    sc->rx_queued);
546 
547 	if (req->bulk_completion_reason != USB_CR_OK) {
548 		sc->sc_rx_err++;
549 		goto fail;
550 	}
551 
552 	len = msgdsize(mp);
553 	rxbuf = (char *)mp->b_rptr;
554 
555 
556 	if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
557 		RAL_DEBUG(RAL_DBG_ERR,
558 		    "rum_rxeof(): xfer too short %d\n", len);
559 		sc->sc_rx_err++;
560 		goto fail;
561 	}
562 
563 	/* rx descriptor is located at the head, different from RT2500USB */
564 	desc = (struct rum_rx_desc *)rxbuf;
565 
566 	if (LE_32(desc->flags) & RT2573_RX_CRC_ERROR) {
567 		/*
568 		 * This should not happen since we did not request to receive
569 		 * those frames when we filled RT2573_TXRX_CSR0.
570 		 */
571 		RAL_DEBUG(RAL_DBG_ERR, "CRC error\n");
572 		sc->sc_rx_err++;
573 		goto fail;
574 	}
575 
576 	pktlen = (LE_32(desc->flags) >> 16) & 0xfff;
577 
578 	if (pktlen > (len - RT2573_RX_DESC_SIZE)) {
579 		RAL_DEBUG(RAL_DBG_ERR,
580 		    "rum_rxeof(): pktlen mismatch <%d, %d>.\n", pktlen, len);
581 		goto fail;
582 	}
583 
584 	if ((m = allocb(pktlen, BPRI_MED)) == NULL) {
585 		RAL_DEBUG(RAL_DBG_ERR,
586 		    "rum_rxeof(): allocate mblk failed.\n");
587 		sc->sc_rx_nobuf++;
588 		goto fail;
589 	}
590 
591 	bcopy(rxbuf + RT2573_RX_DESC_SIZE, m->b_rptr, pktlen);
592 	m->b_wptr += pktlen;
593 
594 	wh = (struct ieee80211_frame *)m->b_rptr;
595 	ni = ieee80211_find_rxnode(ic, wh);
596 
597 	/* send the frame to the 802.11 layer */
598 	(void) ieee80211_input(ic, m, ni, desc->rssi, 0);
599 
600 	/* node is no longer needed */
601 	ieee80211_free_node(ni);
602 
603 fail:
604 	mutex_enter(&sc->rx_lock);
605 	sc->rx_queued--;
606 	mutex_exit(&sc->rx_lock);
607 
608 	freemsg(mp);
609 	usb_free_bulk_req(req);
610 
611 	if (RAL_IS_RUNNING(sc))
612 		(void) rum_rx_trigger(sc);
613 }
614 
615 /*
616  * Return the expected ack rate for a frame transmitted at rate `rate'.
617  */
618 static int
619 rum_ack_rate(struct ieee80211com *ic, int rate)
620 {
621 	switch (rate) {
622 	/* CCK rates */
623 	case 2:
624 		return (2);
625 	case 4:
626 	case 11:
627 	case 22:
628 		return ((ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate);
629 
630 	/* OFDM rates */
631 	case 12:
632 	case 18:
633 		return (12);
634 	case 24:
635 	case 36:
636 		return (24);
637 	case 48:
638 	case 72:
639 	case 96:
640 	case 108:
641 		return (48);
642 	}
643 
644 	/* default to 1Mbps */
645 	return (2);
646 }
647 
648 /*
649  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
650  * The function automatically determines the operating mode depending on the
651  * given rate. `flags' indicates whether short preamble is in use or not.
652  */
653 static uint16_t
654 rum_txtime(int len, int rate, uint32_t flags)
655 {
656 	uint16_t txtime;
657 
658 	if (RUM_RATE_IS_OFDM(rate)) {
659 		/* IEEE Std 802.11a-1999, pp. 37 */
660 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
661 		txtime = 16 + 4 + 4 * txtime + 6;
662 	} else {
663 		/* IEEE Std 802.11b-1999, pp. 28 */
664 		txtime = (16 * len + rate - 1) / rate;
665 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
666 			txtime +=  72 + 24;
667 		else
668 			txtime += 144 + 48;
669 	}
670 	return (txtime);
671 }
672 
673 static uint8_t
674 rum_plcp_signal(int rate)
675 {
676 	switch (rate) {
677 	/* CCK rates (returned values are device-dependent) */
678 	case 2:		return (0x0);
679 	case 4:		return (0x1);
680 	case 11:	return (0x2);
681 	case 22:	return (0x3);
682 
683 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
684 	case 12:	return (0xb);
685 	case 18:	return (0xf);
686 	case 24:	return (0xa);
687 	case 36:	return (0xe);
688 	case 48:	return (0x9);
689 	case 72:	return (0xd);
690 	case 96:	return (0x8);
691 	case 108:	return (0xc);
692 
693 	/* unsupported rates (should not get there) */
694 	default:	return (0xff);
695 	}
696 }
697 
698 static void
699 rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
700     uint32_t flags, uint16_t xflags, int len, int rate)
701 {
702 	struct ieee80211com *ic = &sc->sc_ic;
703 	uint16_t plcp_length;
704 	int remainder;
705 
706 	desc->flags = LE_32(flags);
707 	desc->flags |= LE_32(RT2573_TX_VALID);
708 	desc->flags |= LE_32(len << 16);
709 
710 	desc->xflags = LE_16(xflags);
711 
712 	desc->wme = LE_16(RT2573_QID(0) | RT2573_AIFSN(2) |
713 	    RT2573_LOGCWMIN(4) | RT2573_LOGCWMAX(10));
714 
715 	/* setup PLCP fields */
716 	desc->plcp_signal  = rum_plcp_signal(rate);
717 	desc->plcp_service = 4;
718 
719 	len += IEEE80211_CRC_LEN;
720 	if (RUM_RATE_IS_OFDM(rate)) {
721 		desc->flags |= LE_32(RT2573_TX_OFDM);
722 
723 		plcp_length = len & 0xfff;
724 		desc->plcp_length_hi = plcp_length >> 6;
725 		desc->plcp_length_lo = plcp_length & 0x3f;
726 	} else {
727 		plcp_length = (16 * len + rate - 1) / rate;
728 		if (rate == 22) {
729 			remainder = (16 * len) % 22;
730 			if (remainder != 0 && remainder < 7)
731 				desc->plcp_service |= RT2573_PLCP_LENGEXT;
732 		}
733 		desc->plcp_length_hi = plcp_length >> 8;
734 		desc->plcp_length_lo = plcp_length & 0xff;
735 
736 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
737 			desc->plcp_signal |= 0x08;
738 	}
739 }
740 
741 #define	RUM_TX_TIMEOUT	5
742 
743 static int
744 rum_send(ieee80211com_t *ic, mblk_t *mp, uint8_t type)
745 {
746 	struct rum_softc *sc = (struct rum_softc *)ic;
747 	struct rum_tx_desc *desc;
748 
749 	struct ieee80211_frame *wh;
750 	struct ieee80211_key *k;
751 
752 	uint16_t dur;
753 	uint32_t flags = 0;
754 	int rate, err = DDI_SUCCESS, rv;
755 
756 	struct ieee80211_node *ni = NULL;
757 	mblk_t *m, *m0;
758 	int off, mblen, pktlen, xferlen;
759 
760 
761 	mutex_enter(&sc->tx_lock);
762 
763 	if (sc->tx_queued > RAL_TX_LIST_COUNT) {
764 		RAL_DEBUG(RAL_DBG_TX, "rum_send(): "
765 		    "no TX buffer available!\n");
766 		if ((type & IEEE80211_FC0_TYPE_MASK) ==
767 		    IEEE80211_FC0_TYPE_DATA) {
768 			sc->sc_need_sched = 1;
769 		}
770 		sc->sc_tx_nobuf++;
771 		err = ENOMEM;
772 		goto fail;
773 	}
774 
775 	m = allocb(RAL_TXBUF_SIZE + RT2573_TX_DESC_SIZE, BPRI_MED);
776 	if (m == NULL) {
777 		RAL_DEBUG(RAL_DBG_ERR, "rum_send(): can't alloc mblk.\n");
778 		err = DDI_FAILURE;
779 		goto fail;
780 	}
781 
782 	m->b_rptr += RT2573_TX_DESC_SIZE;	/* skip TX descriptor */
783 	m->b_wptr += RT2573_TX_DESC_SIZE;
784 
785 	for (off = 0, m0 = mp; m0 != NULL; m0 = m0->b_cont) {
786 		mblen = (uintptr_t)m0->b_wptr - (uintptr_t)m0->b_rptr;
787 		(void) memcpy(m->b_rptr + off, m0->b_rptr, mblen);
788 		off += mblen;
789 	}
790 	m->b_wptr += off;
791 
792 	wh = (struct ieee80211_frame *)m->b_rptr;
793 
794 	ni = ieee80211_find_txnode(ic, wh->i_addr1);
795 	if (ni == NULL) {
796 		err = DDI_FAILURE;
797 		sc->sc_tx_err++;
798 		freemsg(m);
799 		goto fail;
800 	}
801 
802 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
803 	    IEEE80211_FC0_TYPE_DATA) {
804 		(void) ieee80211_encap(ic, m, ni);
805 	}
806 
807 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
808 		k = ieee80211_crypto_encap(ic, m);
809 		if (k == NULL) {
810 			sc->sc_tx_err++;
811 			err = DDI_FAILURE;
812 			freemsg(m);
813 			goto fail;
814 		}
815 		/* packet header may have moved, reset our local pointer */
816 		wh = (struct ieee80211_frame *)m->b_rptr;
817 	}
818 
819 	m->b_rptr -= RT2573_TX_DESC_SIZE;	/* restore */
820 	desc = (struct rum_tx_desc *)m->b_rptr;
821 
822 	if ((type & IEEE80211_FC0_TYPE_MASK) ==
823 	    IEEE80211_FC0_TYPE_DATA) {	/* DATA */
824 		if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
825 			rate = ic->ic_bss->in_rates.ir_rates[ic->ic_fixed_rate];
826 		else
827 			rate = ni->in_rates.ir_rates[ni->in_txrate];
828 
829 		rate &= IEEE80211_RATE_VAL;
830 		if (rate <= 0) {
831 			rate = 2;	/* basic rate */
832 		}
833 
834 
835 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
836 			flags |= RT2573_TX_NEED_ACK;
837 			flags |= RT2573_TX_MORE_FRAG;
838 
839 			dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
840 			    ic->ic_flags) + sc->sifs;
841 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
842 		}
843 	} else {	/* MGMT */
844 		rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
845 
846 		if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
847 			flags |= RT2573_TX_NEED_ACK;
848 
849 			dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
850 			    ic->ic_flags) + sc->sifs;
851 			*(uint16_t *)(uintptr_t)wh->i_dur = LE_16(dur);
852 
853 			/* tell hardware to add timestamp for probe responses */
854 			if ((wh->i_fc[0] &
855 			    (IEEE80211_FC0_TYPE_MASK |
856 			    IEEE80211_FC0_SUBTYPE_MASK)) ==
857 			    (IEEE80211_FC0_TYPE_MGT |
858 			    IEEE80211_FC0_SUBTYPE_PROBE_RESP))
859 				flags |= RT2573_TX_TIMESTAMP;
860 		}
861 	}
862 
863 	pktlen = msgdsize(m) - RT2573_TX_DESC_SIZE;
864 	rum_setup_tx_desc(sc, desc, flags, 0, pktlen, rate);
865 
866 	/* align end on a 4-bytes boundary */
867 	xferlen = (RT2573_TX_DESC_SIZE + pktlen + 3) & ~3;
868 
869 	/*
870 	 * No space left in the last URB to store the extra 4 bytes, force
871 	 * sending of another URB.
872 	 */
873 	if ((xferlen % 64) == 0)
874 		xferlen += 4;
875 
876 	m->b_wptr = m->b_rptr + xferlen;
877 
878 	RAL_DEBUG(RAL_DBG_TX, "sending data frame len=%u rate=%u xfer len=%u\n",
879 	    pktlen, rate, xferlen);
880 
881 	rv = rum_tx_trigger(sc, m);
882 
883 	if (rv == 0) {
884 		ic->ic_stats.is_tx_frags++;
885 		ic->ic_stats.is_tx_bytes += pktlen;
886 	}
887 
888 fail:
889 	if (ni != NULL)
890 		ieee80211_free_node(ni);
891 
892 	if ((type & IEEE80211_FC0_TYPE_MASK) != IEEE80211_FC0_TYPE_DATA ||
893 	    err == 0) {
894 		freemsg(mp);
895 	}
896 
897 	mutex_exit(&sc->tx_lock);
898 
899 	return (err);
900 }
901 
902 static mblk_t *
903 rum_m_tx(void *arg, mblk_t *mp)
904 {
905 	struct rum_softc *sc = (struct rum_softc *)arg;
906 	struct ieee80211com *ic = &sc->sc_ic;
907 	mblk_t *next;
908 
909 	/*
910 	 * No data frames go out unless we're associated; this
911 	 * should not happen as the 802.11 layer does not enable
912 	 * the xmit queue until we enter the RUN state.
913 	 */
914 	if (ic->ic_state != IEEE80211_S_RUN) {
915 		RAL_DEBUG(RAL_DBG_ERR, "rum_m_tx(): "
916 		    "discard, state %u\n", ic->ic_state);
917 		freemsgchain(mp);
918 		return (NULL);
919 	}
920 
921 	while (mp != NULL) {
922 		next = mp->b_next;
923 		mp->b_next = NULL;
924 		if (rum_send(ic, mp, IEEE80211_FC0_TYPE_DATA) != DDI_SUCCESS) {
925 			mp->b_next = next;
926 			freemsgchain(mp);
927 			return (NULL);
928 		}
929 		mp = next;
930 	}
931 	return (mp);
932 }
933 
934 static void
935 rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
936 {
937 	uint32_t tmp;
938 	int ntries;
939 
940 	for (ntries = 0; ntries < 5; ntries++) {
941 		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
942 			break;
943 	}
944 	if (ntries == 5) {
945 		RAL_DEBUG(RAL_DBG_ERR,
946 		    "rum_bbp_write(): could not write to BBP\n");
947 		return;
948 	}
949 
950 	tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
951 	rum_write(sc, RT2573_PHY_CSR3, tmp);
952 }
953 
954 static uint8_t
955 rum_bbp_read(struct rum_softc *sc, uint8_t reg)
956 {
957 	uint32_t val;
958 	int ntries;
959 
960 	for (ntries = 0; ntries < 5; ntries++) {
961 		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
962 			break;
963 	}
964 	if (ntries == 5) {
965 		RAL_DEBUG(RAL_DBG_ERR, "rum_bbp_read(): could not read BBP\n");
966 		return (0);
967 	}
968 
969 	val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
970 	rum_write(sc, RT2573_PHY_CSR3, val);
971 
972 	for (ntries = 0; ntries < 100; ntries++) {
973 		val = rum_read(sc, RT2573_PHY_CSR3);
974 		if (!(val & RT2573_BBP_BUSY))
975 			return (val & 0xff);
976 		drv_usecwait(1);
977 	}
978 
979 	RAL_DEBUG(RAL_DBG_ERR, "rum_bbp_read(): could not read BBP\n");
980 	return (0);
981 }
982 
983 static void
984 rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
985 {
986 	uint32_t tmp;
987 	int ntries;
988 
989 	for (ntries = 0; ntries < 5; ntries++) {
990 		if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
991 			break;
992 	}
993 	if (ntries == 5) {
994 		RAL_DEBUG(RAL_DBG_ERR,
995 		    "rum_rf_write(): could not write to RF\n");
996 		return;
997 	}
998 
999 	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1000 	    (reg & 3);
1001 	rum_write(sc, RT2573_PHY_CSR4, tmp);
1002 
1003 	/* remember last written value in sc */
1004 	sc->rf_regs[reg] = val;
1005 
1006 	RAL_DEBUG(RAL_DBG_HW, "RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff);
1007 }
1008 
1009 static void
1010 rum_select_antenna(struct rum_softc *sc)
1011 {
1012 	uint8_t bbp4, bbp77;
1013 	uint32_t tmp;
1014 
1015 	bbp4  = rum_bbp_read(sc, 4);
1016 	bbp77 = rum_bbp_read(sc, 77);
1017 
1018 	/* make sure Rx is disabled before switching antenna */
1019 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1020 	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1021 
1022 	rum_bbp_write(sc,  4, bbp4);
1023 	rum_bbp_write(sc, 77, bbp77);
1024 
1025 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1026 }
1027 
1028 /*
1029  * Enable multi-rate retries for frames sent at OFDM rates.
1030  * In 802.11b/g mode, allow fallback to CCK rates.
1031  */
1032 static void
1033 rum_enable_mrr(struct rum_softc *sc)
1034 {
1035 	struct ieee80211com *ic = &sc->sc_ic;
1036 	uint32_t tmp;
1037 
1038 	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1039 
1040 	tmp &= ~RT2573_MRR_CCK_FALLBACK;
1041 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1042 		tmp |= RT2573_MRR_CCK_FALLBACK;
1043 	tmp |= RT2573_MRR_ENABLED;
1044 
1045 	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1046 }
1047 
1048 static void
1049 rum_set_txpreamble(struct rum_softc *sc)
1050 {
1051 	uint32_t tmp;
1052 
1053 	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1054 
1055 	tmp &= ~RT2573_SHORT_PREAMBLE;
1056 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1057 		tmp |= RT2573_SHORT_PREAMBLE;
1058 
1059 	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1060 }
1061 
1062 static void
1063 rum_set_basicrates(struct rum_softc *sc)
1064 {
1065 	struct ieee80211com *ic = &sc->sc_ic;
1066 
1067 	/* update basic rate set */
1068 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1069 		/* 11b basic rates: 1, 2Mbps */
1070 		rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1071 	} else if (IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->in_chan)) {
1072 		/* 11a basic rates: 6, 12, 24Mbps */
1073 		rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1074 	} else {
1075 		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1076 		rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1077 	}
1078 }
1079 
1080 /*
1081  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1082  * driver.
1083  */
1084 static void
1085 rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1086 {
1087 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1088 	uint32_t tmp;
1089 
1090 	/* update all BBP registers that depend on the band */
1091 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1092 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1093 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1094 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1095 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1096 	}
1097 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1098 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1099 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1100 	}
1101 
1102 	sc->bbp17 = bbp17;
1103 	rum_bbp_write(sc,  17, bbp17);
1104 	rum_bbp_write(sc,  96, bbp96);
1105 	rum_bbp_write(sc, 104, bbp104);
1106 
1107 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1108 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1109 		rum_bbp_write(sc, 75, 0x80);
1110 		rum_bbp_write(sc, 86, 0x80);
1111 		rum_bbp_write(sc, 88, 0x80);
1112 	}
1113 
1114 	rum_bbp_write(sc, 35, bbp35);
1115 	rum_bbp_write(sc, 97, bbp97);
1116 	rum_bbp_write(sc, 98, bbp98);
1117 
1118 	tmp = rum_read(sc, RT2573_PHY_CSR0);
1119 	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1120 	if (IEEE80211_IS_CHAN_2GHZ(c))
1121 		tmp |= RT2573_PA_PE_2GHZ;
1122 	else
1123 		tmp |= RT2573_PA_PE_5GHZ;
1124 	rum_write(sc, RT2573_PHY_CSR0, tmp);
1125 
1126 	/* 802.11a uses a 16 microseconds short interframe space */
1127 	sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1128 }
1129 
1130 static void
1131 rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1132 {
1133 	struct ieee80211com *ic = &sc->sc_ic;
1134 	const struct rfprog *rfprog;
1135 	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1136 	int8_t power;
1137 	uint_t i, chan;
1138 
1139 	chan = ieee80211_chan2ieee(ic, c);
1140 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1141 		return;
1142 
1143 	/* select the appropriate RF settings based on what EEPROM says */
1144 	rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1145 	    sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1146 
1147 	/* find the settings for this channel (we know it exists) */
1148 	for (i = 0; rfprog[i].chan != chan; i++) {
1149 	}
1150 
1151 	power = sc->txpow[i];
1152 	if (power < 0) {
1153 		bbp94 += power;
1154 		power = 0;
1155 	} else if (power > 31) {
1156 		bbp94 += power - 31;
1157 		power = 31;
1158 	}
1159 
1160 	/*
1161 	 * If we are switching from the 2GHz band to the 5GHz band or
1162 	 * vice-versa, BBP registers need to be reprogrammed.
1163 	 */
1164 	if (c->ich_flags != ic->ic_curchan->ich_flags) {
1165 		rum_select_band(sc, c);
1166 		rum_select_antenna(sc);
1167 	}
1168 	ic->ic_curchan = c;
1169 
1170 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1171 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1172 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1173 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1174 
1175 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1176 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1177 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1178 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1179 
1180 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1181 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1182 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1183 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1184 
1185 	drv_usecwait(10);
1186 
1187 	/* enable smart mode for MIMO-capable RFs */
1188 	bbp3 = rum_bbp_read(sc, 3);
1189 
1190 	bbp3 &= ~RT2573_SMART_MODE;
1191 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1192 		bbp3 |= RT2573_SMART_MODE;
1193 
1194 	rum_bbp_write(sc, 3, bbp3);
1195 
1196 	if (bbp94 != RT2573_BBPR94_DEFAULT)
1197 		rum_bbp_write(sc, 94, bbp94);
1198 }
1199 
1200 /*
1201  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1202  * and HostAP operating modes.
1203  */
1204 static void
1205 rum_enable_tsf_sync(struct rum_softc *sc)
1206 {
1207 	struct ieee80211com *ic = &sc->sc_ic;
1208 	uint32_t tmp;
1209 
1210 	if (ic->ic_opmode != IEEE80211_M_STA) {
1211 		/*
1212 		 * Change default 16ms TBTT adjustment to 8ms.
1213 		 * Must be done before enabling beacon generation.
1214 		 */
1215 		rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1216 	}
1217 
1218 	tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1219 
1220 	/* set beacon interval (in 1/16ms unit) */
1221 	tmp |= ic->ic_bss->in_intval * 16;
1222 
1223 	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1224 	if (ic->ic_opmode == IEEE80211_M_STA)
1225 		tmp |= RT2573_TSF_MODE(1);
1226 	else
1227 		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1228 
1229 	rum_write(sc, RT2573_TXRX_CSR9, tmp);
1230 }
1231 
1232 /* ARGSUSED */
1233 static void
1234 rum_update_slot(struct ieee80211com *ic, int onoff)
1235 {
1236 	struct rum_softc *sc = (struct rum_softc *)ic;
1237 	uint8_t slottime;
1238 	uint32_t tmp;
1239 
1240 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1241 
1242 	tmp = rum_read(sc, RT2573_MAC_CSR9);
1243 	tmp = (tmp & ~0xff) | slottime;
1244 	rum_write(sc, RT2573_MAC_CSR9, tmp);
1245 
1246 	RAL_DEBUG(RAL_DBG_HW, "setting slot time to %uus\n", slottime);
1247 }
1248 
1249 static void
1250 rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1251 {
1252 	uint32_t tmp;
1253 
1254 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1255 	rum_write(sc, RT2573_MAC_CSR4, tmp);
1256 
1257 	tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1258 	rum_write(sc, RT2573_MAC_CSR5, tmp);
1259 }
1260 
1261 static void
1262 rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1263 {
1264 	uint32_t tmp;
1265 
1266 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1267 	rum_write(sc, RT2573_MAC_CSR2, tmp);
1268 
1269 	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1270 	rum_write(sc, RT2573_MAC_CSR3, tmp);
1271 
1272 	RAL_DEBUG(RAL_DBG_HW,
1273 	    "setting MAC address to " MACSTR "\n", MAC2STR(addr));
1274 }
1275 
1276 static void
1277 rum_update_promisc(struct rum_softc *sc)
1278 {
1279 	uint32_t tmp;
1280 
1281 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1282 
1283 	tmp &= ~RT2573_DROP_NOT_TO_ME;
1284 	if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1285 		tmp |= RT2573_DROP_NOT_TO_ME;
1286 
1287 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1288 
1289 	RAL_DEBUG(RAL_DBG_HW, "%s promiscuous mode\n",
1290 	    (sc->sc_rcr & RAL_RCR_PROMISC) ?  "entering" : "leaving");
1291 }
1292 
1293 static const char *
1294 rum_get_rf(int rev)
1295 {
1296 	switch (rev) {
1297 	case RT2573_RF_2527:	return ("RT2527 (MIMO XR)");
1298 	case RT2573_RF_2528:	return ("RT2528");
1299 	case RT2573_RF_5225:	return ("RT5225 (MIMO XR)");
1300 	case RT2573_RF_5226:	return ("RT5226");
1301 	default:		return ("unknown");
1302 	}
1303 }
1304 
1305 static void
1306 rum_read_eeprom(struct rum_softc *sc)
1307 {
1308 	struct ieee80211com *ic = &sc->sc_ic;
1309 	uint16_t val;
1310 
1311 	/* read MAC address */
1312 	rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_macaddr, 6);
1313 
1314 	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1315 	val = LE_16(val);
1316 	sc->rf_rev =   (val >> 11) & 0x1f;
1317 	sc->hw_radio = (val >> 10) & 0x1;
1318 	sc->rx_ant =   (val >> 4)  & 0x3;
1319 	sc->tx_ant =   (val >> 2)  & 0x3;
1320 	sc->nb_ant =   val & 0x3;
1321 
1322 	RAL_DEBUG(RAL_DBG_HW, "RF revision=%d\n", sc->rf_rev);
1323 
1324 	rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1325 	val = LE_16(val);
1326 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
1327 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
1328 
1329 	RAL_DEBUG(RAL_DBG_HW, "External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1330 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna);
1331 
1332 	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1333 	val = LE_16(val);
1334 	if ((val & 0xff) != 0xff)
1335 		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
1336 
1337 	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1338 	val = LE_16(val);
1339 	if ((val & 0xff) != 0xff)
1340 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
1341 
1342 	RAL_DEBUG(RAL_DBG_HW, "RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1343 	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr);
1344 
1345 	rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1346 	val = LE_16(val);
1347 	if ((val & 0xff) != 0xff)
1348 		sc->rffreq = val & 0xff;
1349 
1350 	RAL_DEBUG(RAL_DBG_HW, "RF freq=%d\n", sc->rffreq);
1351 
1352 	/* read Tx power for all a/b/g channels */
1353 	rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1354 	/* default Tx power for 802.11a channels */
1355 	(void) memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1356 
1357 	/* read default values for BBP registers */
1358 	rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1359 }
1360 
1361 static int
1362 rum_bbp_init(struct rum_softc *sc)
1363 {
1364 	int i, ntries;
1365 
1366 	/* wait for BBP to be ready */
1367 	for (ntries = 0; ntries < 100; ntries++) {
1368 		const uint8_t val = rum_bbp_read(sc, 0);
1369 		if (val != 0 && val != 0xff)
1370 			break;
1371 		drv_usecwait(1000);
1372 	}
1373 	if (ntries == 100) {
1374 		RAL_DEBUG(RAL_DBG_ERR, "timeout waiting for BBP\n");
1375 		return (EIO);
1376 	}
1377 
1378 	/* initialize BBP registers to default values */
1379 	for (i = 0; i < RUM_N(rum_def_bbp); i++)
1380 		rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1381 
1382 	/* write vendor-specific BBP values (from EEPROM) */
1383 	for (i = 0; i < 16; i++) {
1384 		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1385 			continue;
1386 		rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1387 	}
1388 
1389 	return (0);
1390 }
1391 
1392 /*
1393  * This function is called periodically (every 200ms) during scanning to
1394  * switch from one channel to another.
1395  */
1396 static void
1397 rum_next_scan(void *arg)
1398 {
1399 	struct rum_softc *sc = arg;
1400 	struct ieee80211com *ic = &sc->sc_ic;
1401 
1402 	if (ic->ic_state == IEEE80211_S_SCAN)
1403 		ieee80211_next_scan(ic);
1404 }
1405 
1406 static int
1407 rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
1408 {
1409 	struct rum_softc *sc = (struct rum_softc *)ic;
1410 	enum ieee80211_state ostate;
1411 	struct ieee80211_node *ni;
1412 	int err;
1413 	uint32_t tmp;
1414 
1415 	RAL_LOCK(sc);
1416 
1417 	ostate = ic->ic_state;
1418 
1419 	if (sc->sc_scan_id != 0) {
1420 		(void) untimeout(sc->sc_scan_id);
1421 		sc->sc_scan_id = 0;
1422 	}
1423 
1424 	if (sc->sc_amrr_id != 0) {
1425 		(void) untimeout(sc->sc_amrr_id);
1426 		sc->sc_amrr_id = 0;
1427 	}
1428 
1429 	switch (nstate) {
1430 	case IEEE80211_S_INIT:
1431 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_INIT ...\n");
1432 		if (ostate == IEEE80211_S_RUN) {
1433 			/* abort TSF synchronization */
1434 			tmp = rum_read(sc, RT2573_TXRX_CSR9);
1435 			rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
1436 		}
1437 		break;
1438 
1439 	case IEEE80211_S_SCAN:
1440 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_SCAN ...\n");
1441 		rum_set_chan(sc, ic->ic_curchan);
1442 		sc->sc_scan_id = timeout(rum_next_scan, (void *)sc,
1443 		    drv_usectohz(sc->dwelltime * 1000));
1444 		break;
1445 
1446 	case IEEE80211_S_AUTH:
1447 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_AUTH ...\n");
1448 		rum_set_chan(sc, ic->ic_curchan);
1449 		break;
1450 
1451 	case IEEE80211_S_ASSOC:
1452 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_ASSOC ...\n");
1453 		rum_set_chan(sc, ic->ic_curchan);
1454 		break;
1455 
1456 	case IEEE80211_S_RUN:
1457 		RAL_DEBUG(RAL_DBG_MSG, "-> IEEE80211_S_RUN ...\n");
1458 		rum_set_chan(sc, ic->ic_curchan);
1459 
1460 		ni = ic->ic_bss;
1461 
1462 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1463 			rum_update_slot(ic, 1);
1464 			rum_enable_mrr(sc);
1465 			rum_set_txpreamble(sc);
1466 			rum_set_basicrates(sc);
1467 			rum_set_bssid(sc, ni->in_bssid);
1468 		}
1469 
1470 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1471 			rum_enable_tsf_sync(sc);
1472 
1473 		/* enable automatic rate adaptation in STA mode */
1474 		if (ic->ic_opmode == IEEE80211_M_STA &&
1475 		    ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
1476 			rum_amrr_start(sc, ni);
1477 		break;
1478 	}
1479 
1480 	RAL_UNLOCK(sc);
1481 
1482 	err = sc->sc_newstate(ic, nstate, arg);
1483 	/*
1484 	 * Finally, start any timers.
1485 	 */
1486 	if (nstate == IEEE80211_S_RUN)
1487 		ieee80211_start_watchdog(ic, 1);
1488 
1489 	return (err);
1490 }
1491 
1492 static void
1493 rum_close_pipes(struct rum_softc *sc)
1494 {
1495 	usb_flags_t flags = USB_FLAGS_SLEEP;
1496 
1497 	if (sc->sc_rx_pipeh != NULL) {
1498 		usb_pipe_reset(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
1499 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh, flags, NULL, 0);
1500 		sc->sc_rx_pipeh = NULL;
1501 	}
1502 
1503 	if (sc->sc_tx_pipeh != NULL) {
1504 		usb_pipe_reset(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
1505 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh, flags, NULL, 0);
1506 		sc->sc_tx_pipeh = NULL;
1507 	}
1508 }
1509 
1510 static int
1511 rum_open_pipes(struct rum_softc *sc)
1512 {
1513 	usb_ep_data_t *ep_node;
1514 	usb_pipe_policy_t policy;
1515 	int err;
1516 
1517 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
1518 	    USB_EP_ATTR_BULK, USB_EP_DIR_OUT);
1519 
1520 	bzero(&policy, sizeof (usb_pipe_policy_t));
1521 	policy.pp_max_async_reqs = RAL_TX_LIST_COUNT;
1522 
1523 	if ((err = usb_pipe_open(sc->sc_dev,
1524 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
1525 	    &sc->sc_tx_pipeh)) != USB_SUCCESS) {
1526 		RAL_DEBUG(RAL_DBG_ERR,
1527 		    "rum_open_pipes(): %x failed to open tx pipe\n", err);
1528 		goto fail;
1529 	}
1530 
1531 	RAL_DEBUG(RAL_DBG_MSG, "tx pipe opened\n");
1532 
1533 	ep_node = usb_lookup_ep_data(sc->sc_dev, sc->sc_udev, 0, 0, 0,
1534 	    USB_EP_ATTR_BULK, USB_EP_DIR_IN);
1535 
1536 	bzero(&policy, sizeof (usb_pipe_policy_t));
1537 	policy.pp_max_async_reqs = RAL_RX_LIST_COUNT + 32;
1538 
1539 	if ((err = usb_pipe_open(sc->sc_dev,
1540 	    &ep_node->ep_descr, &policy, USB_FLAGS_SLEEP,
1541 	    &sc->sc_rx_pipeh)) != USB_SUCCESS) {
1542 		RAL_DEBUG(RAL_DBG_ERR,
1543 		    "rum_open_pipes(): %x failed to open rx pipe\n", err);
1544 		goto fail;
1545 	}
1546 
1547 	RAL_DEBUG(RAL_DBG_MSG, "rx pipe opened\n");
1548 
1549 	return (USB_SUCCESS);
1550 
1551 fail:
1552 	if (sc->sc_rx_pipeh != NULL) {
1553 		usb_pipe_close(sc->sc_dev, sc->sc_rx_pipeh,
1554 		    USB_FLAGS_SLEEP, NULL, 0);
1555 		sc->sc_rx_pipeh = NULL;
1556 	}
1557 
1558 	if (sc->sc_tx_pipeh != NULL) {
1559 		usb_pipe_close(sc->sc_dev, sc->sc_tx_pipeh,
1560 		    USB_FLAGS_SLEEP, NULL, 0);
1561 		sc->sc_tx_pipeh = NULL;
1562 	}
1563 
1564 	return (USB_FAILURE);
1565 }
1566 
1567 static int
1568 rum_tx_trigger(struct rum_softc *sc, mblk_t *mp)
1569 {
1570 	usb_bulk_req_t *req;
1571 	int err;
1572 
1573 	sc->sc_tx_timer = RUM_TX_TIMEOUT;
1574 
1575 	req = usb_alloc_bulk_req(sc->sc_dev, 0, USB_FLAGS_SLEEP);
1576 	if (req == NULL) {
1577 		RAL_DEBUG(RAL_DBG_ERR,
1578 		    "rum_tx_trigger(): failed to allocate req");
1579 		freemsg(mp);
1580 		return (-1);
1581 	}
1582 
1583 	req->bulk_len		= msgdsize(mp);
1584 	req->bulk_data		= mp;
1585 	req->bulk_client_private = (usb_opaque_t)sc;
1586 	req->bulk_timeout	= RUM_TX_TIMEOUT;
1587 	req->bulk_attributes	= USB_ATTRS_AUTOCLEARING;
1588 	req->bulk_cb		= rum_txeof;
1589 	req->bulk_exc_cb	= rum_txeof;
1590 	req->bulk_completion_reason = 0;
1591 	req->bulk_cb_flags	= 0;
1592 
1593 	if ((err = usb_pipe_bulk_xfer(sc->sc_tx_pipeh, req, 0))
1594 	    != USB_SUCCESS) {
1595 
1596 		RAL_DEBUG(RAL_DBG_ERR, "rum_tx_trigger(): "
1597 		    "failed to do tx xfer, %d", err);
1598 		usb_free_bulk_req(req);
1599 		return (-1);
1600 	}
1601 
1602 	sc->tx_queued++;
1603 
1604 	return (0);
1605 }
1606 
1607 static int
1608 rum_rx_trigger(struct rum_softc *sc)
1609 {
1610 	usb_bulk_req_t *req;
1611 	int err;
1612 
1613 	req = usb_alloc_bulk_req(sc->sc_dev, RAL_RXBUF_SIZE, USB_FLAGS_SLEEP);
1614 	if (req == NULL) {
1615 		RAL_DEBUG(RAL_DBG_ERR,
1616 		    "rum_rx_trigger(): failed to allocate req");
1617 		return (-1);
1618 	}
1619 
1620 	req->bulk_len		= RAL_RXBUF_SIZE;
1621 	req->bulk_client_private = (usb_opaque_t)sc;
1622 	req->bulk_timeout	= 0;
1623 	req->bulk_attributes	= USB_ATTRS_SHORT_XFER_OK
1624 	    | USB_ATTRS_AUTOCLEARING;
1625 	req->bulk_cb		= rum_rxeof;
1626 	req->bulk_exc_cb	= rum_rxeof;
1627 	req->bulk_completion_reason = 0;
1628 	req->bulk_cb_flags	= 0;
1629 
1630 	err = usb_pipe_bulk_xfer(sc->sc_rx_pipeh, req, 0);
1631 
1632 	if (err != USB_SUCCESS) {
1633 		RAL_DEBUG(RAL_DBG_ERR, "rum_rx_trigger(): "
1634 		    "failed to do rx xfer, %d", err);
1635 		usb_free_bulk_req(req);
1636 
1637 		return (-1);
1638 	}
1639 
1640 	mutex_enter(&sc->rx_lock);
1641 	sc->rx_queued++;
1642 	mutex_exit(&sc->rx_lock);
1643 
1644 	return (0);
1645 }
1646 
1647 static void
1648 rum_init_tx_queue(struct rum_softc *sc)
1649 {
1650 	sc->tx_queued = 0;
1651 }
1652 
1653 static int
1654 rum_init_rx_queue(struct rum_softc *sc)
1655 {
1656 	int	i;
1657 
1658 	sc->rx_queued = 0;
1659 
1660 	for (i = 0; i < RAL_RX_LIST_COUNT; i++) {
1661 		if (rum_rx_trigger(sc) != 0) {
1662 			return (USB_FAILURE);
1663 		}
1664 	}
1665 
1666 	return (USB_SUCCESS);
1667 }
1668 
1669 static void
1670 rum_stop(struct rum_softc *sc)
1671 {
1672 	struct ieee80211com *ic = &sc->sc_ic;
1673 	uint32_t tmp;
1674 
1675 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1676 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1677 
1678 	RAL_LOCK(sc);
1679 
1680 	sc->sc_tx_timer = 0;
1681 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1682 
1683 	/* disable Rx */
1684 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1685 	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1686 
1687 	/* reset ASIC */
1688 	rum_write(sc, RT2573_MAC_CSR1, 3);
1689 	rum_write(sc, RT2573_MAC_CSR1, 0);
1690 
1691 	rum_close_pipes(sc);
1692 
1693 	RAL_UNLOCK(sc);
1694 }
1695 
1696 static int
1697 rum_init(struct rum_softc *sc)
1698 {
1699 	struct ieee80211com *ic = &sc->sc_ic;
1700 	uint32_t tmp;
1701 	int i, ntries;
1702 
1703 	rum_stop(sc);
1704 
1705 	/* initialize MAC registers to default values */
1706 	for (i = 0; i < RUM_N(rum_def_mac); i++)
1707 		rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1708 
1709 	/* set host ready */
1710 	rum_write(sc, RT2573_MAC_CSR1, 3);
1711 	rum_write(sc, RT2573_MAC_CSR1, 0);
1712 
1713 	/* wait for BBP/RF to wakeup */
1714 	for (ntries = 0; ntries < 1000; ntries++) {
1715 		if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1716 			break;
1717 		rum_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
1718 		drv_usecwait(1000);
1719 	}
1720 	if (ntries == 1000) {
1721 		RAL_DEBUG(RAL_DBG_ERR,
1722 		    "rum_init(): timeout waiting for BBP/RF to wakeup\n");
1723 		goto fail;
1724 	}
1725 
1726 	if (rum_bbp_init(sc) != 0)
1727 		goto fail;
1728 
1729 	/* select default channel */
1730 	rum_select_band(sc, ic->ic_curchan);
1731 	rum_select_antenna(sc);
1732 	rum_set_chan(sc, ic->ic_curchan);
1733 
1734 	/* clear STA registers */
1735 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof (sc->sta));
1736 
1737 	rum_set_macaddr(sc, ic->ic_macaddr);
1738 
1739 	/* initialize ASIC */
1740 	rum_write(sc, RT2573_MAC_CSR1, 4);
1741 
1742 	if (rum_open_pipes(sc) != USB_SUCCESS) {
1743 		RAL_DEBUG(RAL_DBG_ERR, "rum_init(): "
1744 		    "could not open pipes.\n");
1745 		goto fail;
1746 	}
1747 
1748 	rum_init_tx_queue(sc);
1749 
1750 	if (rum_init_rx_queue(sc) != USB_SUCCESS)
1751 		goto fail;
1752 
1753 	/* update Rx filter */
1754 	tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
1755 	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
1756 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1757 		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
1758 		    RT2573_DROP_ACKCTS;
1759 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
1760 			tmp |= RT2573_DROP_TODS;
1761 		if (!(sc->sc_rcr & RAL_RCR_PROMISC))
1762 			tmp |= RT2573_DROP_NOT_TO_ME;
1763 	}
1764 
1765 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1766 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
1767 
1768 	return (DDI_SUCCESS);
1769 fail:
1770 	rum_stop(sc);
1771 	return (DDI_FAILURE);
1772 }
1773 
1774 static int
1775 rum_disconnect(dev_info_t *devinfo)
1776 {
1777 	struct rum_softc *sc;
1778 	struct ieee80211com *ic;
1779 
1780 	RAL_DEBUG(RAL_DBG_MSG, "rum_disconnect()\n");
1781 
1782 	/*
1783 	 * We can't call rum_stop() here, since the hardware is removed,
1784 	 * we can't access the register anymore.
1785 	 */
1786 
1787 	sc = ddi_get_soft_state(rum_soft_state_p, ddi_get_instance(devinfo));
1788 	ic = &sc->sc_ic;
1789 
1790 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
1791 	ieee80211_stop_watchdog(ic);	/* stop the watchdog */
1792 
1793 	RAL_LOCK(sc);
1794 
1795 	sc->sc_tx_timer = 0;
1796 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
1797 
1798 	rum_close_pipes(sc);
1799 
1800 	RAL_UNLOCK(sc);
1801 
1802 	return (DDI_SUCCESS);
1803 }
1804 
1805 static int
1806 rum_reconnect(dev_info_t *devinfo)
1807 {
1808 	struct rum_softc *sc;
1809 	int err;
1810 
1811 	RAL_DEBUG(RAL_DBG_MSG, "rum_reconnect()\n");
1812 
1813 	sc = ddi_get_soft_state(rum_soft_state_p, ddi_get_instance(devinfo));
1814 
1815 	err = rum_load_microcode(sc);
1816 	if (err != USB_SUCCESS) {
1817 		RAL_DEBUG(RAL_DBG_ERR, "could not load 8051 microcode\n");
1818 		goto fail;
1819 	}
1820 
1821 	err = rum_init(sc);
1822 fail:
1823 	return (err);
1824 }
1825 
1826 #define	RUM_AMRR_MIN_SUCCESS_THRESHOLD	1
1827 #define	RUM_AMRR_MAX_SUCCESS_THRESHOLD	10
1828 
1829 /*
1830  * Naive implementation of the Adaptive Multi Rate Retry algorithm:
1831  * "IEEE 802.11 Rate Adaptation: A Practical Approach"
1832  * Mathieu Lacage, Hossein Manshaei, Thierry Turletti
1833  * INRIA Sophia - Projet Planete
1834  * http://www-sop.inria.fr/rapports/sophia/RR-5208.html
1835  *
1836  * This algorithm is particularly well suited for rum since it does not
1837  * require per-frame retry statistics.  Note however that since h/w does
1838  * not provide per-frame stats, we can't do per-node rate adaptation and
1839  * thus automatic rate adaptation is only enabled in STA operating mode.
1840  */
1841 #define	is_success(amrr)	\
1842 	((amrr)->retrycnt < (amrr)->txcnt / 10)
1843 #define	is_failure(amrr)	\
1844 	((amrr)->retrycnt > (amrr)->txcnt / 3)
1845 #define	is_enough(amrr)		\
1846 	((amrr)->txcnt > 10)
1847 #define	is_min_rate(ni)		\
1848 	((ni)->in_txrate == 0)
1849 #define	is_max_rate(ni)		\
1850 	((ni)->in_txrate == (ni)->in_rates.ir_nrates - 1)
1851 #define	increase_rate(ni)	\
1852 	((ni)->in_txrate++)
1853 #define	decrease_rate(ni)	\
1854 	((ni)->in_txrate--)
1855 #define	reset_cnt(amrr)	do {	\
1856 	(amrr)->txcnt = (amrr)->retrycnt = 0;	\
1857 	_NOTE(CONSTCOND)	\
1858 } while (/* CONSTCOND */0)
1859 
1860 static void
1861 rum_ratectl(struct rum_amrr *amrr, struct ieee80211_node *ni)
1862 {
1863 	int need_change = 0;
1864 
1865 	if (is_success(amrr) && is_enough(amrr)) {
1866 		amrr->success++;
1867 		if (amrr->success >= amrr->success_threshold &&
1868 		    !is_max_rate(ni)) {
1869 			amrr->recovery = 1;
1870 			amrr->success = 0;
1871 			increase_rate(ni);
1872 			need_change = 1;
1873 		} else {
1874 			amrr->recovery = 0;
1875 		}
1876 	} else if (is_failure(amrr)) {
1877 		amrr->success = 0;
1878 		if (!is_min_rate(ni)) {
1879 			if (amrr->recovery) {
1880 				amrr->success_threshold *= 2;
1881 				if (amrr->success_threshold >
1882 				    RUM_AMRR_MAX_SUCCESS_THRESHOLD)
1883 					amrr->success_threshold =
1884 					    RUM_AMRR_MAX_SUCCESS_THRESHOLD;
1885 			} else {
1886 				amrr->success_threshold =
1887 				    RUM_AMRR_MIN_SUCCESS_THRESHOLD;
1888 			}
1889 			decrease_rate(ni);
1890 			need_change = 1;
1891 		}
1892 		amrr->recovery = 0;	/* original paper was incorrect */
1893 	}
1894 
1895 	if (is_enough(amrr) || need_change)
1896 		reset_cnt(amrr);
1897 }
1898 
1899 static void
1900 rum_amrr_timeout(void *arg)
1901 {
1902 	struct rum_softc *sc = (struct rum_softc *)arg;
1903 	struct rum_amrr *amrr = &sc->amrr;
1904 
1905 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof (sc->sta));
1906 
1907 	/* count TX retry-fail as Tx errors */
1908 	sc->sc_tx_err += LE_32(sc->sta[5]) >> 16;
1909 	sc->sc_tx_retries += ((LE_32(sc->sta[4]) >> 16) +
1910 	    (LE_32(sc->sta[5]) & 0xffff));
1911 
1912 	amrr->retrycnt =
1913 	    (LE_32(sc->sta[4]) >> 16) +		/* TX one-retry ok count */
1914 	    (LE_32(sc->sta[5]) & 0xffff) +	/* TX more-retry ok count */
1915 	    (LE_32(sc->sta[5]) >> 16);		/* TX retry-fail count */
1916 
1917 	amrr->txcnt =
1918 	    amrr->retrycnt +
1919 	    (LE_32(sc->sta[4]) & 0xffff);	/* TX no-retry ok count */
1920 
1921 	rum_ratectl(amrr, sc->sc_ic.ic_bss);
1922 
1923 	sc->sc_amrr_id = timeout(rum_amrr_timeout, (void *)sc,
1924 	    drv_usectohz(1000 * 1000)); /* 1 second */
1925 }
1926 
1927 static void
1928 rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
1929 {
1930 	struct rum_amrr *amrr = &sc->amrr;
1931 	int i;
1932 
1933 	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
1934 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof (sc->sta));
1935 
1936 	amrr->success = 0;
1937 	amrr->recovery = 0;
1938 	amrr->txcnt = amrr->retrycnt = 0;
1939 	amrr->success_threshold = RUM_AMRR_MIN_SUCCESS_THRESHOLD;
1940 
1941 	/* set rate to some reasonable initial value */
1942 	for (i = ni->in_rates.ir_nrates - 1;
1943 	    i > 0 && (ni->in_rates.ir_rates[i] & IEEE80211_RATE_VAL) > 72;
1944 	    i--) {
1945 	}
1946 
1947 	ni->in_txrate = i;
1948 
1949 	sc->sc_amrr_id = timeout(rum_amrr_timeout, (void *)sc,
1950 	    drv_usectohz(1000 * 1000)); /* 1 second */
1951 }
1952 
1953 void
1954 rum_watchdog(void *arg)
1955 {
1956 	struct rum_softc *sc = arg;
1957 	struct ieee80211com *ic = &sc->sc_ic;
1958 	int ntimer = 0;
1959 
1960 	RAL_LOCK(sc);
1961 	ic->ic_watchdog_timer = 0;
1962 
1963 	if (!RAL_IS_RUNNING(sc)) {
1964 		RAL_UNLOCK(sc);
1965 		return;
1966 	}
1967 
1968 	if (sc->sc_tx_timer > 0) {
1969 		if (--sc->sc_tx_timer == 0) {
1970 			RAL_DEBUG(RAL_DBG_ERR, "tx timer timeout\n");
1971 			RAL_UNLOCK(sc);
1972 			(void) rum_init(sc);
1973 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
1974 			return;
1975 		}
1976 	}
1977 
1978 	if (ic->ic_state == IEEE80211_S_RUN)
1979 		ntimer = 1;
1980 
1981 	RAL_UNLOCK(sc);
1982 
1983 	ieee80211_watchdog(ic);
1984 
1985 	if (ntimer)
1986 		ieee80211_start_watchdog(ic, ntimer);
1987 }
1988 
1989 static int
1990 rum_m_start(void *arg)
1991 {
1992 	struct rum_softc *sc = (struct rum_softc *)arg;
1993 	crypto_mech_type_t type;
1994 	int err;
1995 
1996 	type = crypto_mech2id(SUN_CKM_RC4); /* load rc4 module into kernel */
1997 	RAL_DEBUG(RAL_DBG_MSG, "rum_m_start(%d)\n", type);
1998 
1999 	/*
2000 	 * initialize RT2501USB hardware
2001 	 */
2002 	err = rum_init(sc);
2003 	if (err != DDI_SUCCESS) {
2004 		RAL_DEBUG(RAL_DBG_ERR, "device configuration failed\n");
2005 		goto fail;
2006 	}
2007 	sc->sc_flags |= RAL_FLAG_RUNNING;	/* RUNNING */
2008 	return (err);
2009 
2010 fail:
2011 	rum_stop(sc);
2012 	return (err);
2013 }
2014 
2015 static void
2016 rum_m_stop(void *arg)
2017 {
2018 	struct rum_softc *sc = (struct rum_softc *)arg;
2019 
2020 	RAL_DEBUG(RAL_DBG_MSG, "rum_m_stop()\n");
2021 
2022 	(void) rum_stop(sc);
2023 	sc->sc_flags &= ~RAL_FLAG_RUNNING;	/* STOP */
2024 }
2025 
2026 static int
2027 rum_m_unicst(void *arg, const uint8_t *macaddr)
2028 {
2029 	struct rum_softc *sc = (struct rum_softc *)arg;
2030 	struct ieee80211com *ic = &sc->sc_ic;
2031 
2032 	RAL_DEBUG(RAL_DBG_MSG, "rum_m_unicst(): " MACSTR "\n",
2033 	    MAC2STR(macaddr));
2034 
2035 	IEEE80211_ADDR_COPY(ic->ic_macaddr, macaddr);
2036 	(void) rum_set_macaddr(sc, (uint8_t *)macaddr);
2037 	(void) rum_init(sc);
2038 
2039 	return (0);
2040 }
2041 
2042 /*ARGSUSED*/
2043 static int
2044 rum_m_multicst(void *arg, boolean_t add, const uint8_t *mca)
2045 {
2046 	return (0);
2047 }
2048 
2049 static int
2050 rum_m_promisc(void *arg, boolean_t on)
2051 {
2052 	struct rum_softc *sc = (struct rum_softc *)arg;
2053 
2054 	RAL_DEBUG(RAL_DBG_MSG, "rum_m_promisc()\n");
2055 
2056 	if (on) {
2057 		sc->sc_rcr |= RAL_RCR_PROMISC;
2058 		sc->sc_rcr |= RAL_RCR_MULTI;
2059 	} else {
2060 		sc->sc_rcr &= ~RAL_RCR_PROMISC;
2061 		sc->sc_rcr &= ~RAL_RCR_MULTI;
2062 	}
2063 
2064 	rum_update_promisc(sc);
2065 	return (0);
2066 }
2067 
2068 /*
2069  * callback functions for /get/set properties
2070  */
2071 static int
2072 rum_m_setprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2073     uint_t wldp_length, const void *wldp_buf)
2074 {
2075 	struct rum_softc *sc = (struct rum_softc *)arg;
2076 	struct ieee80211com *ic = &sc->sc_ic;
2077 	int err;
2078 
2079 	err = ieee80211_setprop(ic, pr_name, wldp_pr_num,
2080 	    wldp_length, wldp_buf);
2081 	RAL_LOCK(sc);
2082 	if (err == ENETRESET) {
2083 		if (RAL_IS_RUNNING(sc)) {
2084 			RAL_UNLOCK(sc);
2085 			(void) rum_init(sc);
2086 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2087 			RAL_LOCK(sc);
2088 		}
2089 		err = 0;
2090 	}
2091 	RAL_UNLOCK(sc);
2092 
2093 	return (err);
2094 }
2095 
2096 static int
2097 rum_m_getprop(void *arg, const char *pr_name, mac_prop_id_t wldp_pr_num,
2098     uint_t pr_flags, uint_t wldp_length, void *wldp_buf, uint_t *perm)
2099 {
2100 	struct rum_softc *sc = (struct rum_softc *)arg;
2101 	int err;
2102 
2103 	err = ieee80211_getprop(&sc->sc_ic, pr_name, wldp_pr_num,
2104 	    pr_flags, wldp_length, wldp_buf, perm);
2105 
2106 	return (err);
2107 }
2108 
2109 static void
2110 rum_m_ioctl(void* arg, queue_t *wq, mblk_t *mp)
2111 {
2112 	struct rum_softc *sc = (struct rum_softc *)arg;
2113 	struct ieee80211com *ic = &sc->sc_ic;
2114 	int err;
2115 
2116 	err = ieee80211_ioctl(ic, wq, mp);
2117 	RAL_LOCK(sc);
2118 	if (err == ENETRESET) {
2119 		if (RAL_IS_RUNNING(sc)) {
2120 			RAL_UNLOCK(sc);
2121 			(void) rum_init(sc);
2122 			(void) ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2123 			RAL_LOCK(sc);
2124 		}
2125 	}
2126 	RAL_UNLOCK(sc);
2127 }
2128 
2129 static int
2130 rum_m_stat(void *arg, uint_t stat, uint64_t *val)
2131 {
2132 	struct rum_softc *sc  = (struct rum_softc *)arg;
2133 	ieee80211com_t	*ic = &sc->sc_ic;
2134 	ieee80211_node_t *ni;
2135 	struct ieee80211_rateset *rs;
2136 
2137 	RAL_LOCK(sc);
2138 
2139 	ni = ic->ic_bss;
2140 	rs = &ni->in_rates;
2141 
2142 	switch (stat) {
2143 	case MAC_STAT_IFSPEED:
2144 		*val = ((ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) ?
2145 		    (rs->ir_rates[ni->in_txrate] & IEEE80211_RATE_VAL)
2146 		    : ic->ic_fixed_rate) * 500000ull;
2147 		break;
2148 	case MAC_STAT_NOXMTBUF:
2149 		*val = sc->sc_tx_nobuf;
2150 		break;
2151 	case MAC_STAT_NORCVBUF:
2152 		*val = sc->sc_rx_nobuf;
2153 		break;
2154 	case MAC_STAT_IERRORS:
2155 		*val = sc->sc_rx_err;
2156 		break;
2157 	case MAC_STAT_RBYTES:
2158 		*val = ic->ic_stats.is_rx_bytes;
2159 		break;
2160 	case MAC_STAT_IPACKETS:
2161 		*val = ic->ic_stats.is_rx_frags;
2162 		break;
2163 	case MAC_STAT_OBYTES:
2164 		*val = ic->ic_stats.is_tx_bytes;
2165 		break;
2166 	case MAC_STAT_OPACKETS:
2167 		*val = ic->ic_stats.is_tx_frags;
2168 		break;
2169 	case MAC_STAT_OERRORS:
2170 	case WIFI_STAT_TX_FAILED:
2171 		*val = sc->sc_tx_err;
2172 		break;
2173 	case WIFI_STAT_TX_RETRANS:
2174 		*val = sc->sc_tx_retries;
2175 		break;
2176 	case WIFI_STAT_FCS_ERRORS:
2177 	case WIFI_STAT_WEP_ERRORS:
2178 	case WIFI_STAT_TX_FRAGS:
2179 	case WIFI_STAT_MCAST_TX:
2180 	case WIFI_STAT_RTS_SUCCESS:
2181 	case WIFI_STAT_RTS_FAILURE:
2182 	case WIFI_STAT_ACK_FAILURE:
2183 	case WIFI_STAT_RX_FRAGS:
2184 	case WIFI_STAT_MCAST_RX:
2185 	case WIFI_STAT_RX_DUPS:
2186 		RAL_UNLOCK(sc);
2187 		return (ieee80211_stat(ic, stat, val));
2188 	default:
2189 		RAL_UNLOCK(sc);
2190 		return (ENOTSUP);
2191 	}
2192 	RAL_UNLOCK(sc);
2193 
2194 	return (0);
2195 }
2196 
2197 static int
2198 rum_attach(dev_info_t *devinfo, ddi_attach_cmd_t cmd)
2199 {
2200 	struct rum_softc *sc;
2201 	struct ieee80211com *ic;
2202 	int err, i, ntries;
2203 	uint32_t tmp;
2204 	int instance;
2205 
2206 	char strbuf[32];
2207 
2208 	wifi_data_t wd = { 0 };
2209 	mac_register_t *macp;
2210 
2211 	RAL_DEBUG(RAL_DBG_MSG, "rum_attach()\n");
2212 
2213 	if (cmd != DDI_ATTACH)
2214 		return (DDI_FAILURE);
2215 
2216 	instance = ddi_get_instance(devinfo);
2217 
2218 	if (ddi_soft_state_zalloc(rum_soft_state_p, instance) != DDI_SUCCESS) {
2219 		RAL_DEBUG(RAL_DBG_MSG, "rum_attach(): "
2220 		    "unable to alloc soft_state_p\n");
2221 		return (DDI_FAILURE);
2222 	}
2223 
2224 	sc = ddi_get_soft_state(rum_soft_state_p, instance);
2225 	ic = (ieee80211com_t *)&sc->sc_ic;
2226 	sc->sc_dev = devinfo;
2227 
2228 	if (usb_client_attach(devinfo, USBDRV_VERSION, 0) != USB_SUCCESS) {
2229 		RAL_DEBUG(RAL_DBG_ERR,
2230 		    "rum_attach(): usb_client_attach failed\n");
2231 		goto fail1;
2232 	}
2233 
2234 	if (usb_get_dev_data(devinfo, &sc->sc_udev,
2235 	    USB_PARSE_LVL_ALL, 0) != USB_SUCCESS) {
2236 		sc->sc_udev = NULL;
2237 		goto fail2;
2238 	}
2239 
2240 	mutex_init(&sc->sc_genlock, NULL, MUTEX_DRIVER, NULL);
2241 	mutex_init(&sc->tx_lock, NULL, MUTEX_DRIVER, NULL);
2242 	mutex_init(&sc->rx_lock, NULL, MUTEX_DRIVER, NULL);
2243 
2244 	/* retrieve RT2573 rev. no */
2245 	for (ntries = 0; ntries < 1000; ntries++) {
2246 		if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
2247 			break;
2248 		drv_usecwait(1000);
2249 	}
2250 	if (ntries == 1000) {
2251 		RAL_DEBUG(RAL_DBG_ERR,
2252 		    "rum_attach(): timeout waiting for chip to settle\n");
2253 		goto fail3;
2254 	}
2255 
2256 	/* retrieve MAC address and various other things from EEPROM */
2257 	rum_read_eeprom(sc);
2258 
2259 	RAL_DEBUG(RAL_DBG_MSG, "rum: MAC/BBP RT2573 (rev 0x%05x), RF %s\n",
2260 	    tmp, rum_get_rf(sc->rf_rev));
2261 
2262 	err = rum_load_microcode(sc);
2263 	if (err != USB_SUCCESS) {
2264 		RAL_DEBUG(RAL_DBG_ERR, "could not load 8051 microcode\n");
2265 		goto fail3;
2266 	}
2267 
2268 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
2269 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
2270 	ic->ic_state = IEEE80211_S_INIT;
2271 
2272 	ic->ic_maxrssi = 63;
2273 	ic->ic_set_shortslot = rum_update_slot;
2274 	ic->ic_xmit = rum_send;
2275 
2276 	/* set device capabilities */
2277 	ic->ic_caps =
2278 	    IEEE80211_C_TXPMGT |	/* tx power management */
2279 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
2280 	    IEEE80211_C_SHSLOT;		/* short slot time supported */
2281 
2282 	ic->ic_caps |= IEEE80211_C_WPA; /* Support WPA/WPA2 */
2283 
2284 #define	IEEE80211_CHAN_A	\
2285 	(IEEE80211_CHAN_5GHZ | IEEE80211_CHAN_OFDM)
2286 
2287 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
2288 		/* set supported .11a rates */
2289 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rum_rateset_11a;
2290 
2291 		/* set supported .11a channels */
2292 		for (i = 34; i <= 46; i += 4) {
2293 			ic->ic_sup_channels[i].ich_freq =
2294 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2295 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2296 		}
2297 		for (i = 36; i <= 64; i += 4) {
2298 			ic->ic_sup_channels[i].ich_freq =
2299 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2300 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2301 		}
2302 		for (i = 100; i <= 140; i += 4) {
2303 			ic->ic_sup_channels[i].ich_freq =
2304 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2305 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2306 		}
2307 		for (i = 149; i <= 165; i += 4) {
2308 			ic->ic_sup_channels[i].ich_freq =
2309 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
2310 			ic->ic_sup_channels[i].ich_flags = IEEE80211_CHAN_A;
2311 		}
2312 	}
2313 
2314 	/* set supported .11b and .11g rates */
2315 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rum_rateset_11b;
2316 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rum_rateset_11g;
2317 
2318 	/* set supported .11b and .11g channels (1 through 14) */
2319 	for (i = 1; i <= 14; i++) {
2320 		ic->ic_sup_channels[i].ich_freq =
2321 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
2322 		ic->ic_sup_channels[i].ich_flags =
2323 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
2324 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
2325 	}
2326 
2327 	ieee80211_attach(ic);
2328 
2329 	/* register WPA door */
2330 	ieee80211_register_door(ic, ddi_driver_name(devinfo),
2331 	    ddi_get_instance(devinfo));
2332 
2333 	/* override state transition machine */
2334 	sc->sc_newstate = ic->ic_newstate;
2335 	ic->ic_newstate = rum_newstate;
2336 	ic->ic_watchdog = rum_watchdog;
2337 	ieee80211_media_init(ic);
2338 	ic->ic_def_txkey = 0;
2339 
2340 	sc->sc_rcr = 0;
2341 	sc->dwelltime = 300;
2342 	sc->sc_flags &= ~RAL_FLAG_RUNNING;
2343 
2344 	/*
2345 	 * Provide initial settings for the WiFi plugin; whenever this
2346 	 * information changes, we need to call mac_plugindata_update()
2347 	 */
2348 	wd.wd_opmode = ic->ic_opmode;
2349 	wd.wd_secalloc = WIFI_SEC_NONE;
2350 	IEEE80211_ADDR_COPY(wd.wd_bssid, ic->ic_bss->in_bssid);
2351 
2352 	if ((macp = mac_alloc(MAC_VERSION)) == NULL) {
2353 		RAL_DEBUG(RAL_DBG_ERR, "rum_attach(): "
2354 		    "MAC version mismatch\n");
2355 		goto fail3;
2356 	}
2357 
2358 	macp->m_type_ident	= MAC_PLUGIN_IDENT_WIFI;
2359 	macp->m_driver		= sc;
2360 	macp->m_dip		= devinfo;
2361 	macp->m_src_addr	= ic->ic_macaddr;
2362 	macp->m_callbacks	= &rum_m_callbacks;
2363 	macp->m_min_sdu		= 0;
2364 	macp->m_max_sdu		= IEEE80211_MTU;
2365 	macp->m_pdata		= &wd;
2366 	macp->m_pdata_size	= sizeof (wd);
2367 
2368 	err = mac_register(macp, &ic->ic_mach);
2369 	mac_free(macp);
2370 	if (err != 0) {
2371 		RAL_DEBUG(RAL_DBG_ERR, "rum_attach(): "
2372 		    "mac_register() err %x\n", err);
2373 		goto fail3;
2374 	}
2375 
2376 	if (usb_register_hotplug_cbs(devinfo, rum_disconnect,
2377 	    rum_reconnect) != USB_SUCCESS) {
2378 		RAL_DEBUG(RAL_DBG_ERR,
2379 		    "rum_attach() failed to register events");
2380 		goto fail4;
2381 	}
2382 
2383 	/*
2384 	 * Create minor node of type DDI_NT_NET_WIFI
2385 	 */
2386 	(void) snprintf(strbuf, sizeof (strbuf), "%s%d",
2387 	    "rum", instance);
2388 	err = ddi_create_minor_node(devinfo, strbuf, S_IFCHR,
2389 	    instance + 1, DDI_NT_NET_WIFI, 0);
2390 
2391 	if (err != DDI_SUCCESS)
2392 		RAL_DEBUG(RAL_DBG_ERR, "ddi_create_minor_node() failed\n");
2393 
2394 	/*
2395 	 * Notify link is down now
2396 	 */
2397 	mac_link_update(ic->ic_mach, LINK_STATE_DOWN);
2398 
2399 	RAL_DEBUG(RAL_DBG_MSG, "rum_attach() done successfully.\n");
2400 	return (DDI_SUCCESS);
2401 
2402 fail4:
2403 	(void) mac_unregister(ic->ic_mach);
2404 fail3:
2405 	mutex_destroy(&sc->sc_genlock);
2406 	mutex_destroy(&sc->tx_lock);
2407 	mutex_destroy(&sc->rx_lock);
2408 fail2:
2409 	usb_client_detach(sc->sc_dev, sc->sc_udev);
2410 fail1:
2411 	ddi_soft_state_free(rum_soft_state_p, ddi_get_instance(devinfo));
2412 
2413 	return (DDI_FAILURE);
2414 }
2415 
2416 static int
2417 rum_detach(dev_info_t *devinfo, ddi_detach_cmd_t cmd)
2418 {
2419 	struct rum_softc *sc;
2420 
2421 	RAL_DEBUG(RAL_DBG_MSG, "rum_detach()\n");
2422 	sc = ddi_get_soft_state(rum_soft_state_p, ddi_get_instance(devinfo));
2423 
2424 	if (cmd != DDI_DETACH)
2425 		return (DDI_FAILURE);
2426 
2427 	rum_stop(sc);
2428 	usb_unregister_hotplug_cbs(devinfo);
2429 
2430 	/*
2431 	 * Unregister from the MAC layer subsystem
2432 	 */
2433 	if (mac_unregister(sc->sc_ic.ic_mach) != 0)
2434 		return (DDI_FAILURE);
2435 
2436 	/*
2437 	 * detach ieee80211 layer
2438 	 */
2439 	ieee80211_detach(&sc->sc_ic);
2440 
2441 	mutex_destroy(&sc->sc_genlock);
2442 	mutex_destroy(&sc->tx_lock);
2443 	mutex_destroy(&sc->rx_lock);
2444 
2445 	/* pipes will be closed in rum_stop() */
2446 	usb_client_detach(devinfo, sc->sc_udev);
2447 	sc->sc_udev = NULL;
2448 
2449 	ddi_remove_minor_node(devinfo, NULL);
2450 	ddi_soft_state_free(rum_soft_state_p, ddi_get_instance(devinfo));
2451 
2452 	return (DDI_SUCCESS);
2453 }
2454 
2455 int
2456 _info(struct modinfo *modinfop)
2457 {
2458 	return (mod_info(&modlinkage, modinfop));
2459 }
2460 
2461 int
2462 _init(void)
2463 {
2464 	int status;
2465 
2466 	status = ddi_soft_state_init(&rum_soft_state_p,
2467 	    sizeof (struct rum_softc), 1);
2468 	if (status != 0)
2469 		return (status);
2470 
2471 	mac_init_ops(&rum_dev_ops, "rum");
2472 	status = mod_install(&modlinkage);
2473 	if (status != 0) {
2474 		mac_fini_ops(&rum_dev_ops);
2475 		ddi_soft_state_fini(&rum_soft_state_p);
2476 	}
2477 	return (status);
2478 }
2479 
2480 int
2481 _fini(void)
2482 {
2483 	int status;
2484 
2485 	status = mod_remove(&modlinkage);
2486 	if (status == 0) {
2487 		mac_fini_ops(&rum_dev_ops);
2488 		ddi_soft_state_fini(&rum_soft_state_p);
2489 	}
2490 	return (status);
2491 }
2492