xref: /netbsd-src/sys/dev/usb/if_rum.c (revision 4b71a66d0f279143147d63ebfcfd8a59499a3684)
1 /*	$OpenBSD: if_rum.c,v 1.40 2006/09/18 16:20:20 damien Exp $	*/
2 /*	$NetBSD: if_rum.c,v 1.21 2008/05/24 16:40:58 cube Exp $	*/
3 
4 /*-
5  * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
6  * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
7  *
8  * Permission to use, copy, modify, and distribute this software for any
9  * purpose with or without fee is hereby granted, provided that the above
10  * copyright notice and this permission notice appear in all copies.
11  *
12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19  */
20 
21 /*-
22  * Ralink Technology RT2501USB/RT2601USB chipset driver
23  * http://www.ralinktech.com.tw/
24  */
25 
26 #include <sys/cdefs.h>
27 __KERNEL_RCSID(0, "$NetBSD: if_rum.c,v 1.21 2008/05/24 16:40:58 cube Exp $");
28 
29 #include "bpfilter.h"
30 
31 #include <sys/param.h>
32 #include <sys/sockio.h>
33 #include <sys/sysctl.h>
34 #include <sys/mbuf.h>
35 #include <sys/kernel.h>
36 #include <sys/socket.h>
37 #include <sys/systm.h>
38 #include <sys/malloc.h>
39 #include <sys/conf.h>
40 #include <sys/device.h>
41 
42 #include <sys/bus.h>
43 #include <machine/endian.h>
44 #include <sys/intr.h>
45 
46 #if NBPFILTER > 0
47 #include <net/bpf.h>
48 #endif
49 #include <net/if.h>
50 #include <net/if_arp.h>
51 #include <net/if_dl.h>
52 #include <net/if_ether.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 
56 #include <netinet/in.h>
57 #include <netinet/in_systm.h>
58 #include <netinet/in_var.h>
59 #include <netinet/ip.h>
60 
61 #include <net80211/ieee80211_netbsd.h>
62 #include <net80211/ieee80211_var.h>
63 #include <net80211/ieee80211_amrr.h>
64 #include <net80211/ieee80211_radiotap.h>
65 
66 #include <dev/firmload.h>
67 
68 #include <dev/usb/usb.h>
69 #include <dev/usb/usbdi.h>
70 #include <dev/usb/usbdi_util.h>
71 #include <dev/usb/usbdevs.h>
72 
73 #include <dev/usb/if_rumreg.h>
74 #include <dev/usb/if_rumvar.h>
75 
76 #ifdef USB_DEBUG
77 #define RUM_DEBUG
78 #endif
79 
80 #ifdef RUM_DEBUG
81 #define DPRINTF(x)	do { if (rum_debug) logprintf x; } while (0)
82 #define DPRINTFN(n, x)	do { if (rum_debug >= (n)) logprintf x; } while (0)
83 int rum_debug = 1;
84 #else
85 #define DPRINTF(x)
86 #define DPRINTFN(n, x)
87 #endif
88 
89 /* various supported device vendors/products */
90 static const struct usb_devno rum_devs[] = {
91 	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_HWU54DM },
92 	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_2 },
93 	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_3 },
94 	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_RT2573_4 },
95 	{ USB_VENDOR_ABOCOM,		USB_PRODUCT_ABOCOM_WUG2700 },
96 	{ USB_VENDOR_AMIT,		USB_PRODUCT_AMIT_CGWLUSB2GO },
97 	{ USB_VENDOR_ASUSTEK,		USB_PRODUCT_ASUSTEK_WL167G_2 },
98 	{ USB_VENDOR_ASUSTEK,		USB_PRODUCT_ASUSTEK_WL167G_3 },
99 	{ USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D7050A },
100 	{ USB_VENDOR_BELKIN,		USB_PRODUCT_BELKIN_F5D9050V3 },
101 	{ USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GC },
102 	{ USB_VENDOR_CISCOLINKSYS,	USB_PRODUCT_CISCOLINKSYS_WUSB54GR },
103 	{ USB_VENDOR_CONCEPTRONIC,	USB_PRODUCT_CONCEPTRONIC_C54RU2 },
104 	{ USB_VENDOR_COREGA,		USB_PRODUCT_COREGA_CGWLUSB2GL },
105 	{ USB_VENDOR_DICKSMITH,		USB_PRODUCT_DICKSMITH_CWD854F },
106 	{ USB_VENDOR_DICKSMITH,		USB_PRODUCT_DICKSMITH_RT2573 },
107 	{ USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_DWLG122C1 },
108 	{ USB_VENDOR_DLINK2,		USB_PRODUCT_DLINK2_WUA1340 },
109 	{ USB_VENDOR_GIGABYTE,		USB_PRODUCT_GIGABYTE_GNWB01GS },
110 	{ USB_VENDOR_GIGABYTE,		USB_PRODUCT_GIGABYTE_GNWI05GS },
111 	{ USB_VENDOR_GIGASET,		USB_PRODUCT_GIGASET_RT2573 },
112 	{ USB_VENDOR_GOODWAY,		USB_PRODUCT_GOODWAY_RT2573 },
113 	{ USB_VENDOR_GUILLEMOT,		USB_PRODUCT_GUILLEMOT_HWGUSB254LB },
114 	{ USB_VENDOR_GUILLEMOT,		USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP },
115 	{ USB_VENDOR_HUAWEI3COM,	USB_PRODUCT_HUAWEI3COM_RT2573 },
116 	{ USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_G54HP },
117 	{ USB_VENDOR_MELCO,		USB_PRODUCT_MELCO_SG54HP },
118 	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573 },
119 	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_2 },
120 	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_3 },
121 	{ USB_VENDOR_MSI,		USB_PRODUCT_MSI_RT2573_4 },
122 	{ USB_VENDOR_NOVATECH,		USB_PRODUCT_NOVATECH_RT2573 },
123 	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUS54HP },
124 	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUS54MINI2 },
125 	{ USB_VENDOR_PLANEX2,		USB_PRODUCT_PLANEX2_GWUSMM },
126 	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573 },
127 	{ USB_VENDOR_QCOM,		USB_PRODUCT_QCOM_RT2573_2 },
128 	{ USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2573 },
129 	{ USB_VENDOR_RALINK_2,          USB_PRODUCT_RALINK_2_RT2573 },
130 	{ USB_VENDOR_RALINK,		USB_PRODUCT_RALINK_RT2671 },
131 	{ USB_VENDOR_SITECOMEU,		USB_PRODUCT_SITECOMEU_WL113R2 },
132 	{ USB_VENDOR_SITECOMEU,		USB_PRODUCT_SITECOMEU_WL172 },
133 	{ USB_VENDOR_SURECOM,		USB_PRODUCT_SURECOM_RT2573 }
134 };
135 
136 Static int		rum_attachhook(void *);
137 Static int		rum_alloc_tx_list(struct rum_softc *);
138 Static void		rum_free_tx_list(struct rum_softc *);
139 Static int		rum_alloc_rx_list(struct rum_softc *);
140 Static void		rum_free_rx_list(struct rum_softc *);
141 Static int		rum_media_change(struct ifnet *);
142 Static void		rum_next_scan(void *);
143 Static void		rum_task(void *);
144 Static int		rum_newstate(struct ieee80211com *,
145 			    enum ieee80211_state, int);
146 Static void		rum_txeof(usbd_xfer_handle, usbd_private_handle,
147 			    usbd_status);
148 Static void		rum_rxeof(usbd_xfer_handle, usbd_private_handle,
149 			    usbd_status);
150 #if NBPFILTER > 0
151 Static uint8_t		rum_rxrate(const struct rum_rx_desc *);
152 #endif
153 Static int		rum_ack_rate(struct ieee80211com *, int);
154 Static uint16_t		rum_txtime(int, int, uint32_t);
155 Static uint8_t		rum_plcp_signal(int);
156 Static void		rum_setup_tx_desc(struct rum_softc *,
157 			    struct rum_tx_desc *, uint32_t, uint16_t, int,
158 			    int);
159 Static int		rum_tx_mgt(struct rum_softc *, struct mbuf *,
160 			    struct ieee80211_node *);
161 Static int		rum_tx_data(struct rum_softc *, struct mbuf *,
162 			    struct ieee80211_node *);
163 Static void		rum_start(struct ifnet *);
164 Static void		rum_watchdog(struct ifnet *);
165 Static int		rum_ioctl(struct ifnet *, u_long, void *);
166 Static void		rum_eeprom_read(struct rum_softc *, uint16_t, void *,
167 			    int);
168 Static uint32_t		rum_read(struct rum_softc *, uint16_t);
169 Static void		rum_read_multi(struct rum_softc *, uint16_t, void *,
170 			    int);
171 Static void		rum_write(struct rum_softc *, uint16_t, uint32_t);
172 Static void		rum_write_multi(struct rum_softc *, uint16_t, void *,
173 			    size_t);
174 Static void		rum_bbp_write(struct rum_softc *, uint8_t, uint8_t);
175 Static uint8_t		rum_bbp_read(struct rum_softc *, uint8_t);
176 Static void		rum_rf_write(struct rum_softc *, uint8_t, uint32_t);
177 Static void		rum_select_antenna(struct rum_softc *);
178 Static void		rum_enable_mrr(struct rum_softc *);
179 Static void		rum_set_txpreamble(struct rum_softc *);
180 Static void		rum_set_basicrates(struct rum_softc *);
181 Static void		rum_select_band(struct rum_softc *,
182 			    struct ieee80211_channel *);
183 Static void		rum_set_chan(struct rum_softc *,
184 			    struct ieee80211_channel *);
185 Static void		rum_enable_tsf_sync(struct rum_softc *);
186 Static void		rum_update_slot(struct rum_softc *);
187 Static void		rum_set_bssid(struct rum_softc *, const uint8_t *);
188 Static void		rum_set_macaddr(struct rum_softc *, const uint8_t *);
189 Static void		rum_update_promisc(struct rum_softc *);
190 Static const char	*rum_get_rf(int);
191 Static void		rum_read_eeprom(struct rum_softc *);
192 Static int		rum_bbp_init(struct rum_softc *);
193 Static int		rum_init(struct ifnet *);
194 Static void		rum_stop(struct ifnet *, int);
195 Static int		rum_load_microcode(struct rum_softc *, const u_char *,
196 			    size_t);
197 Static int		rum_prepare_beacon(struct rum_softc *);
198 Static void		rum_newassoc(struct ieee80211_node *, int);
199 Static void		rum_amrr_start(struct rum_softc *,
200 			    struct ieee80211_node *);
201 Static void		rum_amrr_timeout(void *);
202 Static void		rum_amrr_update(usbd_xfer_handle, usbd_private_handle,
203 			    usbd_status status);
204 
205 /*
206  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
207  */
208 static const struct ieee80211_rateset rum_rateset_11a =
209 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
210 
211 static const struct ieee80211_rateset rum_rateset_11b =
212 	{ 4, { 2, 4, 11, 22 } };
213 
214 static const struct ieee80211_rateset rum_rateset_11g =
215 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
216 
217 static const struct {
218 	uint32_t	reg;
219 	uint32_t	val;
220 } rum_def_mac[] = {
221 	RT2573_DEF_MAC
222 };
223 
224 static const struct {
225 	uint8_t	reg;
226 	uint8_t	val;
227 } rum_def_bbp[] = {
228 	RT2573_DEF_BBP
229 };
230 
231 static const struct rfprog {
232 	uint8_t		chan;
233 	uint32_t	r1, r2, r3, r4;
234 }  rum_rf5226[] = {
235 	RT2573_RF5226
236 }, rum_rf5225[] = {
237 	RT2573_RF5225
238 };
239 
240 USB_DECLARE_DRIVER(rum);
241 
242 USB_MATCH(rum)
243 {
244 	USB_MATCH_START(rum, uaa);
245 
246 	return (usb_lookup(rum_devs, uaa->vendor, uaa->product) != NULL) ?
247 	    UMATCH_VENDOR_PRODUCT : UMATCH_NONE;
248 }
249 
250 Static int
251 rum_attachhook(void *xsc)
252 {
253 	struct rum_softc *sc = xsc;
254 	firmware_handle_t fwh;
255 	const char *name = "rum-rt2573";
256 	u_char *ucode;
257 	size_t size;
258 	int error;
259 
260 	if ((error = firmware_open("rum", name, &fwh)) != 0) {
261 		printf("%s: failed loadfirmware of file %s (error %d)\n",
262 		    USBDEVNAME(sc->sc_dev), name, error);
263 		return error;
264 	}
265 	size = firmware_get_size(fwh);
266 	ucode = firmware_malloc(size);
267 	if (ucode == NULL) {
268 		printf("%s: failed to allocate firmware memory\n",
269 		    USBDEVNAME(sc->sc_dev));
270 		firmware_close(fwh);
271 		return ENOMEM;;
272 	}
273 	error = firmware_read(fwh, 0, ucode, size);
274 	firmware_close(fwh);
275 	if (error != 0) {
276 		printf("%s: failed to read firmware (error %d)\n",
277 		    USBDEVNAME(sc->sc_dev), error);
278 		firmware_free(ucode, 0);
279 		return error;
280 	}
281 
282 	if (rum_load_microcode(sc, ucode, size) != 0) {
283 		printf("%s: could not load 8051 microcode\n",
284 		    USBDEVNAME(sc->sc_dev));
285 		firmware_free(ucode, 0);
286 		return ENXIO;
287 	}
288 
289 	firmware_free(ucode, 0);
290 	sc->sc_flags |= RT2573_FWLOADED;
291 
292 	return 0;
293 }
294 
295 USB_ATTACH(rum)
296 {
297 	USB_ATTACH_START(rum, sc, uaa);
298 	struct ieee80211com *ic = &sc->sc_ic;
299 	struct ifnet *ifp = &sc->sc_if;
300 	usb_interface_descriptor_t *id;
301 	usb_endpoint_descriptor_t *ed;
302 	usbd_status error;
303 	char *devinfop;
304 	int i, ntries;
305 	uint32_t tmp;
306 
307 	sc->sc_dev = self;
308 	sc->sc_udev = uaa->device;
309 	sc->sc_flags = 0;
310 
311 	devinfop = usbd_devinfo_alloc(sc->sc_udev, 0);
312 	USB_ATTACH_SETUP;
313 	aprint_normal_dev(self, "%s\n", devinfop);
314 	usbd_devinfo_free(devinfop);
315 
316 	if (usbd_set_config_no(sc->sc_udev, RT2573_CONFIG_NO, 0) != 0) {
317 		aprint_error_dev(self, "could not set configuration no\n");
318 		USB_ATTACH_ERROR_RETURN;
319 	}
320 
321 	/* get the first interface handle */
322 	error = usbd_device2interface_handle(sc->sc_udev, RT2573_IFACE_INDEX,
323 	    &sc->sc_iface);
324 	if (error != 0) {
325 		aprint_error_dev(self, "could not get interface handle\n");
326 		USB_ATTACH_ERROR_RETURN;
327 	}
328 
329 	/*
330 	 * Find endpoints.
331 	 */
332 	id = usbd_get_interface_descriptor(sc->sc_iface);
333 
334 	sc->sc_rx_no = sc->sc_tx_no = -1;
335 	for (i = 0; i < id->bNumEndpoints; i++) {
336 		ed = usbd_interface2endpoint_descriptor(sc->sc_iface, i);
337 		if (ed == NULL) {
338 			aprint_error_dev(self,
339 			    "no endpoint descriptor for iface %d\n", i);
340 			USB_ATTACH_ERROR_RETURN;
341 		}
342 
343 		if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_IN &&
344 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
345 			sc->sc_rx_no = ed->bEndpointAddress;
346 		else if (UE_GET_DIR(ed->bEndpointAddress) == UE_DIR_OUT &&
347 		    UE_GET_XFERTYPE(ed->bmAttributes) == UE_BULK)
348 			sc->sc_tx_no = ed->bEndpointAddress;
349 	}
350 	if (sc->sc_rx_no == -1 || sc->sc_tx_no == -1) {
351 		aprint_error_dev(self, "missing endpoint\n");
352 		USB_ATTACH_ERROR_RETURN;
353 	}
354 
355 	usb_init_task(&sc->sc_task, rum_task, sc);
356 	usb_callout_init(sc->sc_scan_ch);
357 
358 	sc->amrr.amrr_min_success_threshold =  1;
359 	sc->amrr.amrr_max_success_threshold = 10;
360 	usb_callout_init(sc->sc_amrr_ch);
361 
362 	/* retrieve RT2573 rev. no */
363 	for (ntries = 0; ntries < 1000; ntries++) {
364 		if ((tmp = rum_read(sc, RT2573_MAC_CSR0)) != 0)
365 			break;
366 		DELAY(1000);
367 	}
368 	if (ntries == 1000) {
369 		aprint_error_dev(self, "timeout waiting for chip to settle\n");
370 		USB_ATTACH_ERROR_RETURN;
371 	}
372 
373 	/* retrieve MAC address and various other things from EEPROM */
374 	rum_read_eeprom(sc);
375 
376 	aprint_normal_dev(self,
377 	    "MAC/BBP RT%04x (rev 0x%05x), RF %s, address %s\n",
378 	    sc->macbbp_rev, tmp,
379 	    rum_get_rf(sc->rf_rev), ether_sprintf(ic->ic_myaddr));
380 
381 	ic->ic_ifp = ifp;
382 	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
383 	ic->ic_opmode = IEEE80211_M_STA;	/* default to BSS mode */
384 	ic->ic_state = IEEE80211_S_INIT;
385 
386 	/* set device capabilities */
387 	ic->ic_caps =
388 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
389 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
390 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
391 	    IEEE80211_C_TXPMGT |	/* tx power management */
392 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
393 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
394 	    IEEE80211_C_WPA;		/* 802.11i */
395 
396 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_5226) {
397 		/* set supported .11a rates */
398 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rum_rateset_11a;
399 
400 		/* set supported .11a channels */
401 		for (i = 34; i <= 46; i += 4) {
402 			ic->ic_channels[i].ic_freq =
403 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
404 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
405 		}
406 		for (i = 36; i <= 64; i += 4) {
407 			ic->ic_channels[i].ic_freq =
408 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
409 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
410 		}
411 		for (i = 100; i <= 140; i += 4) {
412 			ic->ic_channels[i].ic_freq =
413 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
414 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
415 		}
416 		for (i = 149; i <= 165; i += 4) {
417 			ic->ic_channels[i].ic_freq =
418 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
419 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
420 		}
421 	}
422 
423 	/* set supported .11b and .11g rates */
424 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rum_rateset_11b;
425 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rum_rateset_11g;
426 
427 	/* set supported .11b and .11g channels (1 through 14) */
428 	for (i = 1; i <= 14; i++) {
429 		ic->ic_channels[i].ic_freq =
430 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
431 		ic->ic_channels[i].ic_flags =
432 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
433 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
434 	}
435 
436 	ifp->if_softc = sc;
437 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
438 	ifp->if_init = rum_init;
439 	ifp->if_ioctl = rum_ioctl;
440 	ifp->if_start = rum_start;
441 	ifp->if_watchdog = rum_watchdog;
442 	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
443 	IFQ_SET_READY(&ifp->if_snd);
444 	memcpy(ifp->if_xname, USBDEVNAME(sc->sc_dev), IFNAMSIZ);
445 
446 	if_attach(ifp);
447 	ieee80211_ifattach(ic);
448 	ic->ic_newassoc = rum_newassoc;
449 
450 	/* override state transition machine */
451 	sc->sc_newstate = ic->ic_newstate;
452 	ic->ic_newstate = rum_newstate;
453 	ieee80211_media_init(ic, rum_media_change, ieee80211_media_status);
454 
455 #if NBPFILTER > 0
456 	bpfattach2(ifp, DLT_IEEE802_11_RADIO,
457 	    sizeof (struct ieee80211_frame) + IEEE80211_RADIOTAP_HDRLEN, &sc->sc_drvbpf);
458 
459 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
460 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
461 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
462 
463 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
464 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
465 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
466 #endif
467 
468 	ieee80211_announce(ic);
469 
470 	usbd_add_drv_event(USB_EVENT_DRIVER_ATTACH, sc->sc_udev,
471 	    USBDEV(sc->sc_dev));
472 
473 	USB_ATTACH_SUCCESS_RETURN;
474 }
475 
476 USB_DETACH(rum)
477 {
478 	USB_DETACH_START(rum, sc);
479 	struct ieee80211com *ic = &sc->sc_ic;
480 	struct ifnet *ifp = &sc->sc_if;
481 	int s;
482 
483 	if (!ifp->if_softc)
484 		return 0;
485 
486 	s = splusb();
487 
488 	rum_stop(ifp, 1);
489 	usb_rem_task(sc->sc_udev, &sc->sc_task);
490 	usb_uncallout(sc->sc_scan_ch, rum_next_scan, sc);
491 	usb_uncallout(sc->sc_amrr_ch, rum_amrr_timeout, sc);
492 
493 	if (sc->amrr_xfer != NULL) {
494 		usbd_free_xfer(sc->amrr_xfer);
495 		sc->amrr_xfer = NULL;
496 	}
497 
498 	if (sc->sc_rx_pipeh != NULL) {
499 		usbd_abort_pipe(sc->sc_rx_pipeh);
500 		usbd_close_pipe(sc->sc_rx_pipeh);
501 	}
502 
503 	if (sc->sc_tx_pipeh != NULL) {
504 		usbd_abort_pipe(sc->sc_tx_pipeh);
505 		usbd_close_pipe(sc->sc_tx_pipeh);
506 	}
507 
508 #if NBPFILTER > 0
509 	bpfdetach(ifp);
510 #endif
511 	ieee80211_ifdetach(ic);	/* free all nodes */
512 	if_detach(ifp);
513 
514 	splx(s);
515 
516 	usbd_add_drv_event(USB_EVENT_DRIVER_DETACH, sc->sc_udev,
517 	    USBDEV(sc->sc_dev));
518 
519 	return 0;
520 }
521 
522 Static int
523 rum_alloc_tx_list(struct rum_softc *sc)
524 {
525 	struct rum_tx_data *data;
526 	int i, error;
527 
528 	sc->tx_queued = 0;
529 
530 	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
531 		data = &sc->tx_data[i];
532 
533 		data->sc = sc;
534 
535 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
536 		if (data->xfer == NULL) {
537 			printf("%s: could not allocate tx xfer\n",
538 			    USBDEVNAME(sc->sc_dev));
539 			error = ENOMEM;
540 			goto fail;
541 		}
542 
543 		data->buf = usbd_alloc_buffer(data->xfer,
544 		    RT2573_TX_DESC_SIZE + MCLBYTES);
545 		if (data->buf == NULL) {
546 			printf("%s: could not allocate tx buffer\n",
547 			    USBDEVNAME(sc->sc_dev));
548 			error = ENOMEM;
549 			goto fail;
550 		}
551 
552 		/* clean Tx descriptor */
553 		bzero(data->buf, RT2573_TX_DESC_SIZE);
554 	}
555 
556 	return 0;
557 
558 fail:	rum_free_tx_list(sc);
559 	return error;
560 }
561 
562 Static void
563 rum_free_tx_list(struct rum_softc *sc)
564 {
565 	struct rum_tx_data *data;
566 	int i;
567 
568 	for (i = 0; i < RUM_TX_LIST_COUNT; i++) {
569 		data = &sc->tx_data[i];
570 
571 		if (data->xfer != NULL) {
572 			usbd_free_xfer(data->xfer);
573 			data->xfer = NULL;
574 		}
575 
576 		if (data->ni != NULL) {
577 			ieee80211_free_node(data->ni);
578 			data->ni = NULL;
579 		}
580 	}
581 }
582 
583 Static int
584 rum_alloc_rx_list(struct rum_softc *sc)
585 {
586 	struct rum_rx_data *data;
587 	int i, error;
588 
589 	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
590 		data = &sc->rx_data[i];
591 
592 		data->sc = sc;
593 
594 		data->xfer = usbd_alloc_xfer(sc->sc_udev);
595 		if (data->xfer == NULL) {
596 			printf("%s: could not allocate rx xfer\n",
597 			    USBDEVNAME(sc->sc_dev));
598 			error = ENOMEM;
599 			goto fail;
600 		}
601 
602 		if (usbd_alloc_buffer(data->xfer, MCLBYTES) == NULL) {
603 			printf("%s: could not allocate rx buffer\n",
604 			    USBDEVNAME(sc->sc_dev));
605 			error = ENOMEM;
606 			goto fail;
607 		}
608 
609 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
610 		if (data->m == NULL) {
611 			printf("%s: could not allocate rx mbuf\n",
612 			    USBDEVNAME(sc->sc_dev));
613 			error = ENOMEM;
614 			goto fail;
615 		}
616 
617 		MCLGET(data->m, M_DONTWAIT);
618 		if (!(data->m->m_flags & M_EXT)) {
619 			printf("%s: could not allocate rx mbuf cluster\n",
620 			    USBDEVNAME(sc->sc_dev));
621 			error = ENOMEM;
622 			goto fail;
623 		}
624 
625 		data->buf = mtod(data->m, uint8_t *);
626 	}
627 
628 	return 0;
629 
630 fail:	rum_free_tx_list(sc);
631 	return error;
632 }
633 
634 Static void
635 rum_free_rx_list(struct rum_softc *sc)
636 {
637 	struct rum_rx_data *data;
638 	int i;
639 
640 	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
641 		data = &sc->rx_data[i];
642 
643 		if (data->xfer != NULL) {
644 			usbd_free_xfer(data->xfer);
645 			data->xfer = NULL;
646 		}
647 
648 		if (data->m != NULL) {
649 			m_freem(data->m);
650 			data->m = NULL;
651 		}
652 	}
653 }
654 
655 Static int
656 rum_media_change(struct ifnet *ifp)
657 {
658 	int error;
659 
660 	error = ieee80211_media_change(ifp);
661 	if (error != ENETRESET)
662 		return error;
663 
664 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
665 		rum_init(ifp);
666 
667 	return 0;
668 }
669 
670 /*
671  * This function is called periodically (every 200ms) during scanning to
672  * switch from one channel to another.
673  */
674 Static void
675 rum_next_scan(void *arg)
676 {
677 	struct rum_softc *sc = arg;
678 	struct ieee80211com *ic = &sc->sc_ic;
679 
680 	if (ic->ic_state == IEEE80211_S_SCAN)
681 		ieee80211_next_scan(ic);
682 }
683 
684 Static void
685 rum_task(void *arg)
686 {
687 	struct rum_softc *sc = arg;
688 	struct ieee80211com *ic = &sc->sc_ic;
689 	enum ieee80211_state ostate;
690 	struct ieee80211_node *ni;
691 	uint32_t tmp;
692 
693 	ostate = ic->ic_state;
694 
695 	switch (sc->sc_state) {
696 	case IEEE80211_S_INIT:
697 		if (ostate == IEEE80211_S_RUN) {
698 			/* abort TSF synchronization */
699 			tmp = rum_read(sc, RT2573_TXRX_CSR9);
700 			rum_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
701 		}
702 		break;
703 
704 	case IEEE80211_S_SCAN:
705 		rum_set_chan(sc, ic->ic_curchan);
706 		usb_callout(sc->sc_scan_ch, hz / 5, rum_next_scan, sc);
707 		break;
708 
709 	case IEEE80211_S_AUTH:
710 		rum_set_chan(sc, ic->ic_curchan);
711 		break;
712 
713 	case IEEE80211_S_ASSOC:
714 		rum_set_chan(sc, ic->ic_curchan);
715 		break;
716 
717 	case IEEE80211_S_RUN:
718 		rum_set_chan(sc, ic->ic_curchan);
719 
720 		ni = ic->ic_bss;
721 
722 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
723 			rum_update_slot(sc);
724 			rum_enable_mrr(sc);
725 			rum_set_txpreamble(sc);
726 			rum_set_basicrates(sc);
727 			rum_set_bssid(sc, ni->ni_bssid);
728 		}
729 
730 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
731 		    ic->ic_opmode == IEEE80211_M_IBSS)
732 			rum_prepare_beacon(sc);
733 
734 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
735 			rum_enable_tsf_sync(sc);
736 
737 		if (ic->ic_opmode == IEEE80211_M_STA) {
738 			/* fake a join to init the tx rate */
739 			rum_newassoc(ic->ic_bss, 1);
740 
741 			/* enable automatic rate adaptation in STA mode */
742 			if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE)
743 				rum_amrr_start(sc, ni);
744 		}
745 
746 		break;
747 	}
748 
749 	sc->sc_newstate(ic, sc->sc_state, -1);
750 }
751 
752 Static int
753 rum_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
754 {
755 	struct rum_softc *sc = ic->ic_ifp->if_softc;
756 
757 	usb_rem_task(sc->sc_udev, &sc->sc_task);
758 	usb_uncallout(sc->sc_scan_ch, rum_next_scan, sc);
759 	usb_uncallout(sc->sc_amrr_ch, rum_amrr_timeout, sc);
760 
761 	/* do it in a process context */
762 	sc->sc_state = nstate;
763 	usb_add_task(sc->sc_udev, &sc->sc_task, USB_TASKQ_DRIVER);
764 
765 	return 0;
766 }
767 
768 /* quickly determine if a given rate is CCK or OFDM */
769 #define RUM_RATE_IS_OFDM(rate)	((rate) >= 12 && (rate) != 22)
770 
771 #define RUM_ACK_SIZE	14	/* 10 + 4(FCS) */
772 #define RUM_CTS_SIZE	14	/* 10 + 4(FCS) */
773 
774 Static void
775 rum_txeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
776 {
777 	struct rum_tx_data *data = priv;
778 	struct rum_softc *sc = data->sc;
779 	struct ifnet *ifp = &sc->sc_if;
780 	int s;
781 
782 	if (status != USBD_NORMAL_COMPLETION) {
783 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
784 			return;
785 
786 		printf("%s: could not transmit buffer: %s\n",
787 		    USBDEVNAME(sc->sc_dev), usbd_errstr(status));
788 
789 		if (status == USBD_STALLED)
790 			usbd_clear_endpoint_stall_async(sc->sc_tx_pipeh);
791 
792 		ifp->if_oerrors++;
793 		return;
794 	}
795 
796 	s = splnet();
797 
798 	ieee80211_free_node(data->ni);
799 	data->ni = NULL;
800 
801 	sc->tx_queued--;
802 	ifp->if_opackets++;
803 
804 	DPRINTFN(10, ("tx done\n"));
805 
806 	sc->sc_tx_timer = 0;
807 	ifp->if_flags &= ~IFF_OACTIVE;
808 	rum_start(ifp);
809 
810 	splx(s);
811 }
812 
813 Static void
814 rum_rxeof(usbd_xfer_handle xfer, usbd_private_handle priv, usbd_status status)
815 {
816 	struct rum_rx_data *data = priv;
817 	struct rum_softc *sc = data->sc;
818 	struct ieee80211com *ic = &sc->sc_ic;
819 	struct ifnet *ifp = &sc->sc_if;
820 	struct rum_rx_desc *desc;
821 	struct ieee80211_frame *wh;
822 	struct ieee80211_node *ni;
823 	struct mbuf *mnew, *m;
824 	int s, len;
825 
826 	if (status != USBD_NORMAL_COMPLETION) {
827 		if (status == USBD_NOT_STARTED || status == USBD_CANCELLED)
828 			return;
829 
830 		if (status == USBD_STALLED)
831 			usbd_clear_endpoint_stall_async(sc->sc_rx_pipeh);
832 		goto skip;
833 	}
834 
835 	usbd_get_xfer_status(xfer, NULL, NULL, &len, NULL);
836 
837 	if (len < RT2573_RX_DESC_SIZE + sizeof (struct ieee80211_frame_min)) {
838 		DPRINTF(("%s: xfer too short %d\n", USBDEVNAME(sc->sc_dev),
839 		    len));
840 		ifp->if_ierrors++;
841 		goto skip;
842 	}
843 
844 	desc = (struct rum_rx_desc *)data->buf;
845 
846 	if (le32toh(desc->flags) & RT2573_RX_CRC_ERROR) {
847 		/*
848 		 * This should not happen since we did not request to receive
849 		 * those frames when we filled RT2573_TXRX_CSR0.
850 		 */
851 		DPRINTFN(5, ("CRC error\n"));
852 		ifp->if_ierrors++;
853 		goto skip;
854 	}
855 
856 	MGETHDR(mnew, M_DONTWAIT, MT_DATA);
857 	if (mnew == NULL) {
858 		printf("%s: could not allocate rx mbuf\n",
859 		    USBDEVNAME(sc->sc_dev));
860 		ifp->if_ierrors++;
861 		goto skip;
862 	}
863 
864 	MCLGET(mnew, M_DONTWAIT);
865 	if (!(mnew->m_flags & M_EXT)) {
866 		printf("%s: could not allocate rx mbuf cluster\n",
867 		    USBDEVNAME(sc->sc_dev));
868 		m_freem(mnew);
869 		ifp->if_ierrors++;
870 		goto skip;
871 	}
872 
873 	m = data->m;
874 	data->m = mnew;
875 	data->buf = mtod(data->m, uint8_t *);
876 
877 	/* finalize mbuf */
878 	m->m_pkthdr.rcvif = ifp;
879 	m->m_data = (void *)(desc + 1);
880 	m->m_pkthdr.len = m->m_len = (le32toh(desc->flags) >> 16) & 0xfff;
881 
882 	s = splnet();
883 
884 #if NBPFILTER > 0
885 	if (sc->sc_drvbpf != NULL) {
886 		struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
887 
888 		tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
889 		tap->wr_rate = rum_rxrate(desc);
890 		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
891 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
892 		tap->wr_antenna = sc->rx_ant;
893 		tap->wr_antsignal = desc->rssi;
894 
895 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
896 	}
897 #endif
898 
899 	wh = mtod(m, struct ieee80211_frame *);
900 	ni = ieee80211_find_rxnode(ic, (struct ieee80211_frame_min *)wh);
901 
902 	/* send the frame to the 802.11 layer */
903 	ieee80211_input(ic, m, ni, desc->rssi, 0);
904 
905 	/* node is no longer needed */
906 	ieee80211_free_node(ni);
907 
908 	splx(s);
909 
910 	DPRINTFN(15, ("rx done\n"));
911 
912 skip:	/* setup a new transfer */
913 	usbd_setup_xfer(xfer, sc->sc_rx_pipeh, data, data->buf, MCLBYTES,
914 	    USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
915 	usbd_transfer(xfer);
916 }
917 
918 /*
919  * This function is only used by the Rx radiotap code. It returns the rate at
920  * which a given frame was received.
921  */
922 #if NBPFILTER > 0
923 Static uint8_t
924 rum_rxrate(const struct rum_rx_desc *desc)
925 {
926 	if (le32toh(desc->flags) & RT2573_RX_OFDM) {
927 		/* reverse function of rum_plcp_signal */
928 		switch (desc->rate) {
929 		case 0xb:	return 12;
930 		case 0xf:	return 18;
931 		case 0xa:	return 24;
932 		case 0xe:	return 36;
933 		case 0x9:	return 48;
934 		case 0xd:	return 72;
935 		case 0x8:	return 96;
936 		case 0xc:	return 108;
937 		}
938 	} else {
939 		if (desc->rate == 10)
940 			return 2;
941 		if (desc->rate == 20)
942 			return 4;
943 		if (desc->rate == 55)
944 			return 11;
945 		if (desc->rate == 110)
946 			return 22;
947 	}
948 	return 2;	/* should not get there */
949 }
950 #endif
951 
952 /*
953  * Return the expected ack rate for a frame transmitted at rate `rate'.
954  * XXX: this should depend on the destination node basic rate set.
955  */
956 Static int
957 rum_ack_rate(struct ieee80211com *ic, int rate)
958 {
959 	switch (rate) {
960 	/* CCK rates */
961 	case 2:
962 		return 2;
963 	case 4:
964 	case 11:
965 	case 22:
966 		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
967 
968 	/* OFDM rates */
969 	case 12:
970 	case 18:
971 		return 12;
972 	case 24:
973 	case 36:
974 		return 24;
975 	case 48:
976 	case 72:
977 	case 96:
978 	case 108:
979 		return 48;
980 	}
981 
982 	/* default to 1Mbps */
983 	return 2;
984 }
985 
986 /*
987  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
988  * The function automatically determines the operating mode depending on the
989  * given rate. `flags' indicates whether short preamble is in use or not.
990  */
991 Static uint16_t
992 rum_txtime(int len, int rate, uint32_t flags)
993 {
994 	uint16_t txtime;
995 
996 	if (RUM_RATE_IS_OFDM(rate)) {
997 		/* IEEE Std 802.11a-1999, pp. 37 */
998 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
999 		txtime = 16 + 4 + 4 * txtime + 6;
1000 	} else {
1001 		/* IEEE Std 802.11b-1999, pp. 28 */
1002 		txtime = (16 * len + rate - 1) / rate;
1003 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1004 			txtime +=  72 + 24;
1005 		else
1006 			txtime += 144 + 48;
1007 	}
1008 	return txtime;
1009 }
1010 
1011 Static uint8_t
1012 rum_plcp_signal(int rate)
1013 {
1014 	switch (rate) {
1015 	/* CCK rates (returned values are device-dependent) */
1016 	case 2:		return 0x0;
1017 	case 4:		return 0x1;
1018 	case 11:	return 0x2;
1019 	case 22:	return 0x3;
1020 
1021 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1022 	case 12:	return 0xb;
1023 	case 18:	return 0xf;
1024 	case 24:	return 0xa;
1025 	case 36:	return 0xe;
1026 	case 48:	return 0x9;
1027 	case 72:	return 0xd;
1028 	case 96:	return 0x8;
1029 	case 108:	return 0xc;
1030 
1031 	/* unsupported rates (should not get there) */
1032 	default:	return 0xff;
1033 	}
1034 }
1035 
1036 Static void
1037 rum_setup_tx_desc(struct rum_softc *sc, struct rum_tx_desc *desc,
1038     uint32_t flags, uint16_t xflags, int len, int rate)
1039 {
1040 	struct ieee80211com *ic = &sc->sc_ic;
1041 	uint16_t plcp_length;
1042 	int remainder;
1043 
1044 	desc->flags = htole32(flags);
1045 	desc->flags |= htole32(RT2573_TX_VALID);
1046 	desc->flags |= htole32(len << 16);
1047 
1048 	desc->xflags = htole16(xflags);
1049 
1050 	desc->wme = htole16(
1051 	    RT2573_QID(0) |
1052 	    RT2573_AIFSN(2) |
1053 	    RT2573_LOGCWMIN(4) |
1054 	    RT2573_LOGCWMAX(10));
1055 
1056 	/* setup PLCP fields */
1057 	desc->plcp_signal  = rum_plcp_signal(rate);
1058 	desc->plcp_service = 4;
1059 
1060 	len += IEEE80211_CRC_LEN;
1061 	if (RUM_RATE_IS_OFDM(rate)) {
1062 		desc->flags |= htole32(RT2573_TX_OFDM);
1063 
1064 		plcp_length = len & 0xfff;
1065 		desc->plcp_length_hi = plcp_length >> 6;
1066 		desc->plcp_length_lo = plcp_length & 0x3f;
1067 	} else {
1068 		plcp_length = (16 * len + rate - 1) / rate;
1069 		if (rate == 22) {
1070 			remainder = (16 * len) % 22;
1071 			if (remainder != 0 && remainder < 7)
1072 				desc->plcp_service |= RT2573_PLCP_LENGEXT;
1073 		}
1074 		desc->plcp_length_hi = plcp_length >> 8;
1075 		desc->plcp_length_lo = plcp_length & 0xff;
1076 
1077 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1078 			desc->plcp_signal |= 0x08;
1079 	}
1080 }
1081 
1082 #define RUM_TX_TIMEOUT	5000
1083 
1084 Static int
1085 rum_tx_mgt(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1086 {
1087 	struct ieee80211com *ic = &sc->sc_ic;
1088 	struct rum_tx_desc *desc;
1089 	struct rum_tx_data *data;
1090 	struct ieee80211_frame *wh;
1091 	struct ieee80211_key *k;
1092 	uint32_t flags = 0;
1093 	uint16_t dur;
1094 	usbd_status error;
1095 	int xferlen, rate;
1096 
1097 	data = &sc->tx_data[0];
1098 	desc = (struct rum_tx_desc *)data->buf;
1099 
1100 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1101 
1102 	data->m = m0;
1103 	data->ni = ni;
1104 
1105 	wh = mtod(m0, struct ieee80211_frame *);
1106 
1107 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1108 		k = ieee80211_crypto_encap(ic, ni, m0);
1109 		if (k == NULL) {
1110 			m_freem(m0);
1111 			return ENOBUFS;
1112 		}
1113 	}
1114 
1115 	wh = mtod(m0, struct ieee80211_frame *);
1116 
1117 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1118 		flags |= RT2573_TX_NEED_ACK;
1119 
1120 		dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1121 		    ic->ic_flags) + sc->sifs;
1122 		*(uint16_t *)wh->i_dur = htole16(dur);
1123 
1124 		/* tell hardware to set timestamp in probe responses */
1125 		if ((wh->i_fc[0] &
1126 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1127 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1128 			flags |= RT2573_TX_TIMESTAMP;
1129 	}
1130 
1131 #if NBPFILTER > 0
1132 	if (sc->sc_drvbpf != NULL) {
1133 		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1134 
1135 		tap->wt_flags = 0;
1136 		tap->wt_rate = rate;
1137 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1138 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1139 		tap->wt_antenna = sc->tx_ant;
1140 
1141 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1142 	}
1143 #endif
1144 
1145 	m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1146 	rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1147 
1148 	/* align end on a 4-bytes boundary */
1149 	xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1150 
1151 	/*
1152 	 * No space left in the last URB to store the extra 4 bytes, force
1153 	 * sending of another URB.
1154 	 */
1155 	if ((xferlen % 64) == 0)
1156 		xferlen += 4;
1157 
1158 	DPRINTFN(10, ("sending msg frame len=%zu rate=%u xfer len=%u\n",
1159 	    (size_t)m0->m_pkthdr.len + RT2573_TX_DESC_SIZE,
1160 	    rate, xferlen));
1161 
1162 	usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1163 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1164 
1165 	error = usbd_transfer(data->xfer);
1166 	if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS) {
1167 		m_freem(m0);
1168 		return error;
1169 	}
1170 
1171 	sc->tx_queued++;
1172 
1173 	return 0;
1174 }
1175 
1176 Static int
1177 rum_tx_data(struct rum_softc *sc, struct mbuf *m0, struct ieee80211_node *ni)
1178 {
1179 	struct ieee80211com *ic = &sc->sc_ic;
1180 	struct rum_tx_desc *desc;
1181 	struct rum_tx_data *data;
1182 	struct ieee80211_frame *wh;
1183 	struct ieee80211_key *k;
1184 	uint32_t flags = 0;
1185 	uint16_t dur;
1186 	usbd_status error;
1187 	int xferlen, rate;
1188 
1189 	wh = mtod(m0, struct ieee80211_frame *);
1190 
1191 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE)
1192 		rate = ic->ic_bss->ni_rates.rs_rates[ic->ic_fixed_rate];
1193 	else
1194 		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1195 	if (rate == 0)
1196 		rate = 2;	/* XXX should not happen */
1197 	rate &= IEEE80211_RATE_VAL;
1198 
1199 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1200 		k = ieee80211_crypto_encap(ic, ni, m0);
1201 		if (k == NULL) {
1202 			m_freem(m0);
1203 			return ENOBUFS;
1204 		}
1205 
1206 		/* packet header may have moved, reset our local pointer */
1207 		wh = mtod(m0, struct ieee80211_frame *);
1208 	}
1209 
1210 	data = &sc->tx_data[0];
1211 	desc = (struct rum_tx_desc *)data->buf;
1212 
1213 	data->ni = ni;
1214 
1215 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1216 		flags |= RT2573_TX_NEED_ACK;
1217 
1218 		dur = rum_txtime(RUM_ACK_SIZE, rum_ack_rate(ic, rate),
1219 		    ic->ic_flags) + sc->sifs;
1220 		*(uint16_t *)wh->i_dur = htole16(dur);
1221 	}
1222 
1223 #if NBPFILTER > 0
1224 	if (sc->sc_drvbpf != NULL) {
1225 		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1226 
1227 		tap->wt_flags = 0;
1228 		tap->wt_rate = rate;
1229 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1230 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1231 		tap->wt_antenna = sc->tx_ant;
1232 
1233 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
1234 	}
1235 #endif
1236 
1237 	m_copydata(m0, 0, m0->m_pkthdr.len, data->buf + RT2573_TX_DESC_SIZE);
1238 	rum_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate);
1239 
1240 	/* align end on a 4-bytes boundary */
1241 	xferlen = (RT2573_TX_DESC_SIZE + m0->m_pkthdr.len + 3) & ~3;
1242 
1243 	/*
1244 	 * No space left in the last URB to store the extra 4 bytes, force
1245 	 * sending of another URB.
1246 	 */
1247 	if ((xferlen % 64) == 0)
1248 		xferlen += 4;
1249 
1250 	DPRINTFN(10, ("sending data frame len=%zu rate=%u xfer len=%u\n",
1251 	    (size_t)m0->m_pkthdr.len + RT2573_TX_DESC_SIZE,
1252 	    rate, xferlen));
1253 
1254 	/* mbuf is no longer needed */
1255 	m_freem(m0);
1256 
1257 	usbd_setup_xfer(data->xfer, sc->sc_tx_pipeh, data, data->buf, xferlen,
1258 	    USBD_FORCE_SHORT_XFER | USBD_NO_COPY, RUM_TX_TIMEOUT, rum_txeof);
1259 
1260 	error = usbd_transfer(data->xfer);
1261 	if (error != USBD_NORMAL_COMPLETION && error != USBD_IN_PROGRESS)
1262 		return error;
1263 
1264 	sc->tx_queued++;
1265 
1266 	return 0;
1267 }
1268 
1269 Static void
1270 rum_start(struct ifnet *ifp)
1271 {
1272 	struct rum_softc *sc = ifp->if_softc;
1273 	struct ieee80211com *ic = &sc->sc_ic;
1274 	struct ether_header *eh;
1275 	struct ieee80211_node *ni;
1276 	struct mbuf *m0;
1277 
1278 	for (;;) {
1279 		IF_POLL(&ic->ic_mgtq, m0);
1280 		if (m0 != NULL) {
1281 			if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1282 				ifp->if_flags |= IFF_OACTIVE;
1283 				break;
1284 			}
1285 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1286 
1287 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1288 			m0->m_pkthdr.rcvif = NULL;
1289 #if NBPFILTER > 0
1290 			if (ic->ic_rawbpf != NULL)
1291 				bpf_mtap(ic->ic_rawbpf, m0);
1292 #endif
1293 			if (rum_tx_mgt(sc, m0, ni) != 0)
1294 				break;
1295 
1296 		} else {
1297 			if (ic->ic_state != IEEE80211_S_RUN)
1298 				break;
1299 			IFQ_POLL(&ifp->if_snd, m0);
1300 			if (m0 == NULL)
1301 				break;
1302 			if (sc->tx_queued >= RUM_TX_LIST_COUNT) {
1303 				ifp->if_flags |= IFF_OACTIVE;
1304 				break;
1305 			}
1306 			IFQ_DEQUEUE(&ifp->if_snd, m0);
1307 			if (m0->m_len < sizeof(struct ether_header) &&
1308 			    !(m0 = m_pullup(m0, sizeof(struct ether_header))))
1309 				continue;
1310 
1311 			eh = mtod(m0, struct ether_header *);
1312 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1313 			if (ni == NULL) {
1314 				m_freem(m0);
1315 				continue;
1316 			}
1317 #if NBPFILTER > 0
1318 			if (ifp->if_bpf != NULL)
1319 				bpf_mtap(ifp->if_bpf, m0);
1320 #endif
1321 			m0 = ieee80211_encap(ic, m0, ni);
1322 			if (m0 == NULL) {
1323 				ieee80211_free_node(ni);
1324 				continue;
1325 			}
1326 #if NBPFILTER > 0
1327 			if (ic->ic_rawbpf != NULL)
1328 				bpf_mtap(ic->ic_rawbpf, m0);
1329 #endif
1330 			if (rum_tx_data(sc, m0, ni) != 0) {
1331 				ieee80211_free_node(ni);
1332 				ifp->if_oerrors++;
1333 				break;
1334 			}
1335 		}
1336 
1337 		sc->sc_tx_timer = 5;
1338 		ifp->if_timer = 1;
1339 	}
1340 }
1341 
1342 Static void
1343 rum_watchdog(struct ifnet *ifp)
1344 {
1345 	struct rum_softc *sc = ifp->if_softc;
1346 	struct ieee80211com *ic = &sc->sc_ic;
1347 
1348 	ifp->if_timer = 0;
1349 
1350 	if (sc->sc_tx_timer > 0) {
1351 		if (--sc->sc_tx_timer == 0) {
1352 			printf("%s: device timeout\n", USBDEVNAME(sc->sc_dev));
1353 			/*rum_init(ifp); XXX needs a process context! */
1354 			ifp->if_oerrors++;
1355 			return;
1356 		}
1357 		ifp->if_timer = 1;
1358 	}
1359 
1360 	ieee80211_watchdog(ic);
1361 }
1362 
1363 Static int
1364 rum_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1365 {
1366 	struct rum_softc *sc = ifp->if_softc;
1367 	struct ieee80211com *ic = &sc->sc_ic;
1368 	int s, error = 0;
1369 
1370 	s = splnet();
1371 
1372 	switch (cmd) {
1373 	case SIOCSIFFLAGS:
1374 		if (ifp->if_flags & IFF_UP) {
1375 			if (ifp->if_flags & IFF_RUNNING)
1376 				rum_update_promisc(sc);
1377 			else
1378 				rum_init(ifp);
1379 		} else {
1380 			if (ifp->if_flags & IFF_RUNNING)
1381 				rum_stop(ifp, 1);
1382 		}
1383 		break;
1384 
1385 	default:
1386 		error = ieee80211_ioctl(ic, cmd, data);
1387 	}
1388 
1389 	if (error == ENETRESET) {
1390 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1391 		    (IFF_UP | IFF_RUNNING))
1392 			rum_init(ifp);
1393 		error = 0;
1394 	}
1395 
1396 	splx(s);
1397 
1398 	return error;
1399 }
1400 
1401 Static void
1402 rum_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, int len)
1403 {
1404 	usb_device_request_t req;
1405 	usbd_status error;
1406 
1407 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1408 	req.bRequest = RT2573_READ_EEPROM;
1409 	USETW(req.wValue, 0);
1410 	USETW(req.wIndex, addr);
1411 	USETW(req.wLength, len);
1412 
1413 	error = usbd_do_request(sc->sc_udev, &req, buf);
1414 	if (error != 0) {
1415 		printf("%s: could not read EEPROM: %s\n",
1416 		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1417 	}
1418 }
1419 
1420 Static uint32_t
1421 rum_read(struct rum_softc *sc, uint16_t reg)
1422 {
1423 	uint32_t val;
1424 
1425 	rum_read_multi(sc, reg, &val, sizeof val);
1426 
1427 	return le32toh(val);
1428 }
1429 
1430 Static void
1431 rum_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, int len)
1432 {
1433 	usb_device_request_t req;
1434 	usbd_status error;
1435 
1436 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
1437 	req.bRequest = RT2573_READ_MULTI_MAC;
1438 	USETW(req.wValue, 0);
1439 	USETW(req.wIndex, reg);
1440 	USETW(req.wLength, len);
1441 
1442 	error = usbd_do_request(sc->sc_udev, &req, buf);
1443 	if (error != 0) {
1444 		printf("%s: could not multi read MAC register: %s\n",
1445 		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1446 	}
1447 }
1448 
1449 Static void
1450 rum_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
1451 {
1452 	uint32_t tmp = htole32(val);
1453 
1454 	rum_write_multi(sc, reg, &tmp, sizeof tmp);
1455 }
1456 
1457 Static void
1458 rum_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, size_t len)
1459 {
1460 	usb_device_request_t req;
1461 	usbd_status error;
1462 
1463 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1464 	req.bRequest = RT2573_WRITE_MULTI_MAC;
1465 	USETW(req.wValue, 0);
1466 	USETW(req.wIndex, reg);
1467 	USETW(req.wLength, len);
1468 
1469 	error = usbd_do_request(sc->sc_udev, &req, buf);
1470 	if (error != 0) {
1471 		printf("%s: could not multi write MAC register: %s\n",
1472 		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
1473 	}
1474 }
1475 
1476 Static void
1477 rum_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
1478 {
1479 	uint32_t tmp;
1480 	int ntries;
1481 
1482 	for (ntries = 0; ntries < 5; ntries++) {
1483 		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1484 			break;
1485 	}
1486 	if (ntries == 5) {
1487 		printf("%s: could not write to BBP\n", USBDEVNAME(sc->sc_dev));
1488 		return;
1489 	}
1490 
1491 	tmp = RT2573_BBP_BUSY | (reg & 0x7f) << 8 | val;
1492 	rum_write(sc, RT2573_PHY_CSR3, tmp);
1493 }
1494 
1495 Static uint8_t
1496 rum_bbp_read(struct rum_softc *sc, uint8_t reg)
1497 {
1498 	uint32_t val;
1499 	int ntries;
1500 
1501 	for (ntries = 0; ntries < 5; ntries++) {
1502 		if (!(rum_read(sc, RT2573_PHY_CSR3) & RT2573_BBP_BUSY))
1503 			break;
1504 	}
1505 	if (ntries == 5) {
1506 		printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1507 		return 0;
1508 	}
1509 
1510 	val = RT2573_BBP_BUSY | RT2573_BBP_READ | reg << 8;
1511 	rum_write(sc, RT2573_PHY_CSR3, val);
1512 
1513 	for (ntries = 0; ntries < 100; ntries++) {
1514 		val = rum_read(sc, RT2573_PHY_CSR3);
1515 		if (!(val & RT2573_BBP_BUSY))
1516 			return val & 0xff;
1517 		DELAY(1);
1518 	}
1519 
1520 	printf("%s: could not read BBP\n", USBDEVNAME(sc->sc_dev));
1521 	return 0;
1522 }
1523 
1524 Static void
1525 rum_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
1526 {
1527 	uint32_t tmp;
1528 	int ntries;
1529 
1530 	for (ntries = 0; ntries < 5; ntries++) {
1531 		if (!(rum_read(sc, RT2573_PHY_CSR4) & RT2573_RF_BUSY))
1532 			break;
1533 	}
1534 	if (ntries == 5) {
1535 		printf("%s: could not write to RF\n", USBDEVNAME(sc->sc_dev));
1536 		return;
1537 	}
1538 
1539 	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | (val & 0xfffff) << 2 |
1540 	    (reg & 3);
1541 	rum_write(sc, RT2573_PHY_CSR4, tmp);
1542 
1543 	/* remember last written value in sc */
1544 	sc->rf_regs[reg] = val;
1545 
1546 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0xfffff));
1547 }
1548 
1549 Static void
1550 rum_select_antenna(struct rum_softc *sc)
1551 {
1552 	uint8_t bbp4, bbp77;
1553 	uint32_t tmp;
1554 
1555 	bbp4  = rum_bbp_read(sc, 4);
1556 	bbp77 = rum_bbp_read(sc, 77);
1557 
1558 	/* TBD */
1559 
1560 	/* make sure Rx is disabled before switching antenna */
1561 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1562 	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
1563 
1564 	rum_bbp_write(sc,  4, bbp4);
1565 	rum_bbp_write(sc, 77, bbp77);
1566 
1567 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1568 }
1569 
1570 /*
1571  * Enable multi-rate retries for frames sent at OFDM rates.
1572  * In 802.11b/g mode, allow fallback to CCK rates.
1573  */
1574 Static void
1575 rum_enable_mrr(struct rum_softc *sc)
1576 {
1577 	struct ieee80211com *ic = &sc->sc_ic;
1578 	uint32_t tmp;
1579 
1580 	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1581 
1582 	tmp &= ~RT2573_MRR_CCK_FALLBACK;
1583 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan))
1584 		tmp |= RT2573_MRR_CCK_FALLBACK;
1585 	tmp |= RT2573_MRR_ENABLED;
1586 
1587 	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1588 }
1589 
1590 Static void
1591 rum_set_txpreamble(struct rum_softc *sc)
1592 {
1593 	uint32_t tmp;
1594 
1595 	tmp = rum_read(sc, RT2573_TXRX_CSR4);
1596 
1597 	tmp &= ~RT2573_SHORT_PREAMBLE;
1598 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
1599 		tmp |= RT2573_SHORT_PREAMBLE;
1600 
1601 	rum_write(sc, RT2573_TXRX_CSR4, tmp);
1602 }
1603 
1604 Static void
1605 rum_set_basicrates(struct rum_softc *sc)
1606 {
1607 	struct ieee80211com *ic = &sc->sc_ic;
1608 
1609 	/* update basic rate set */
1610 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
1611 		/* 11b basic rates: 1, 2Mbps */
1612 		rum_write(sc, RT2573_TXRX_CSR5, 0x3);
1613 	} else if (ic->ic_curmode == IEEE80211_MODE_11A) {
1614 		/* 11a basic rates: 6, 12, 24Mbps */
1615 		rum_write(sc, RT2573_TXRX_CSR5, 0x150);
1616 	} else {
1617 		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1618 		rum_write(sc, RT2573_TXRX_CSR5, 0xf);
1619 	}
1620 }
1621 
1622 /*
1623  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1624  * driver.
1625  */
1626 Static void
1627 rum_select_band(struct rum_softc *sc, struct ieee80211_channel *c)
1628 {
1629 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1630 	uint32_t tmp;
1631 
1632 	/* update all BBP registers that depend on the band */
1633 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1634 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1635 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1636 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1637 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1638 	}
1639 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1640 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1641 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1642 	}
1643 
1644 	sc->bbp17 = bbp17;
1645 	rum_bbp_write(sc,  17, bbp17);
1646 	rum_bbp_write(sc,  96, bbp96);
1647 	rum_bbp_write(sc, 104, bbp104);
1648 
1649 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1650 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1651 		rum_bbp_write(sc, 75, 0x80);
1652 		rum_bbp_write(sc, 86, 0x80);
1653 		rum_bbp_write(sc, 88, 0x80);
1654 	}
1655 
1656 	rum_bbp_write(sc, 35, bbp35);
1657 	rum_bbp_write(sc, 97, bbp97);
1658 	rum_bbp_write(sc, 98, bbp98);
1659 
1660 	tmp = rum_read(sc, RT2573_PHY_CSR0);
1661 	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1662 	if (IEEE80211_IS_CHAN_2GHZ(c))
1663 		tmp |= RT2573_PA_PE_2GHZ;
1664 	else
1665 		tmp |= RT2573_PA_PE_5GHZ;
1666 	rum_write(sc, RT2573_PHY_CSR0, tmp);
1667 
1668 	/* 802.11a uses a 16 microseconds short interframe space */
1669 	sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
1670 }
1671 
1672 Static void
1673 rum_set_chan(struct rum_softc *sc, struct ieee80211_channel *c)
1674 {
1675 	struct ieee80211com *ic = &sc->sc_ic;
1676 	const struct rfprog *rfprog;
1677 	uint8_t bbp3, bbp94 = RT2573_BBPR94_DEFAULT;
1678 	int8_t power;
1679 	u_int i, chan;
1680 
1681 	chan = ieee80211_chan2ieee(ic, c);
1682 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
1683 		return;
1684 
1685 	/* select the appropriate RF settings based on what EEPROM says */
1686 	rfprog = (sc->rf_rev == RT2573_RF_5225 ||
1687 		  sc->rf_rev == RT2573_RF_2527) ? rum_rf5225 : rum_rf5226;
1688 
1689 	/* find the settings for this channel (we know it exists) */
1690 	for (i = 0; rfprog[i].chan != chan; i++);
1691 
1692 	power = sc->txpow[i];
1693 	if (power < 0) {
1694 		bbp94 += power;
1695 		power = 0;
1696 	} else if (power > 31) {
1697 		bbp94 += power - 31;
1698 		power = 31;
1699 	}
1700 
1701 	/*
1702 	 * If we are switching from the 2GHz band to the 5GHz band or
1703 	 * vice-versa, BBP registers need to be reprogrammed.
1704 	 */
1705 	if (c->ic_flags != ic->ic_curchan->ic_flags) {
1706 		rum_select_band(sc, c);
1707 		rum_select_antenna(sc);
1708 	}
1709 	ic->ic_curchan = c;
1710 
1711 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1712 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1713 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1714 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1715 
1716 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1717 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1718 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7 | 1);
1719 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1720 
1721 	rum_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1722 	rum_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1723 	rum_rf_write(sc, RT2573_RF3, rfprog[i].r3 | power << 7);
1724 	rum_rf_write(sc, RT2573_RF4, rfprog[i].r4 | sc->rffreq << 10);
1725 
1726 	DELAY(10);
1727 
1728 	/* enable smart mode for MIMO-capable RFs */
1729 	bbp3 = rum_bbp_read(sc, 3);
1730 
1731 	bbp3 &= ~RT2573_SMART_MODE;
1732 	if (sc->rf_rev == RT2573_RF_5225 || sc->rf_rev == RT2573_RF_2527)
1733 		bbp3 |= RT2573_SMART_MODE;
1734 
1735 	rum_bbp_write(sc, 3, bbp3);
1736 
1737 	if (bbp94 != RT2573_BBPR94_DEFAULT)
1738 		rum_bbp_write(sc, 94, bbp94);
1739 }
1740 
1741 /*
1742  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
1743  * and HostAP operating modes.
1744  */
1745 Static void
1746 rum_enable_tsf_sync(struct rum_softc *sc)
1747 {
1748 	struct ieee80211com *ic = &sc->sc_ic;
1749 	uint32_t tmp;
1750 
1751 	if (ic->ic_opmode != IEEE80211_M_STA) {
1752 		/*
1753 		 * Change default 16ms TBTT adjustment to 8ms.
1754 		 * Must be done before enabling beacon generation.
1755 		 */
1756 		rum_write(sc, RT2573_TXRX_CSR10, 1 << 12 | 8);
1757 	}
1758 
1759 	tmp = rum_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1760 
1761 	/* set beacon interval (in 1/16ms unit) */
1762 	tmp |= ic->ic_bss->ni_intval * 16;
1763 
1764 	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1765 	if (ic->ic_opmode == IEEE80211_M_STA)
1766 		tmp |= RT2573_TSF_MODE(1);
1767 	else
1768 		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1769 
1770 	rum_write(sc, RT2573_TXRX_CSR9, tmp);
1771 }
1772 
1773 Static void
1774 rum_update_slot(struct rum_softc *sc)
1775 {
1776 	struct ieee80211com *ic = &sc->sc_ic;
1777 	uint8_t slottime;
1778 	uint32_t tmp;
1779 
1780 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1781 
1782 	tmp = rum_read(sc, RT2573_MAC_CSR9);
1783 	tmp = (tmp & ~0xff) | slottime;
1784 	rum_write(sc, RT2573_MAC_CSR9, tmp);
1785 
1786 	DPRINTF(("setting slot time to %uus\n", slottime));
1787 }
1788 
1789 Static void
1790 rum_set_bssid(struct rum_softc *sc, const uint8_t *bssid)
1791 {
1792 	uint32_t tmp;
1793 
1794 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
1795 	rum_write(sc, RT2573_MAC_CSR4, tmp);
1796 
1797 	tmp = bssid[4] | bssid[5] << 8 | RT2573_ONE_BSSID << 16;
1798 	rum_write(sc, RT2573_MAC_CSR5, tmp);
1799 }
1800 
1801 Static void
1802 rum_set_macaddr(struct rum_softc *sc, const uint8_t *addr)
1803 {
1804 	uint32_t tmp;
1805 
1806 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
1807 	rum_write(sc, RT2573_MAC_CSR2, tmp);
1808 
1809 	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
1810 	rum_write(sc, RT2573_MAC_CSR3, tmp);
1811 }
1812 
1813 Static void
1814 rum_update_promisc(struct rum_softc *sc)
1815 {
1816 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
1817 	uint32_t tmp;
1818 
1819 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
1820 
1821 	tmp &= ~RT2573_DROP_NOT_TO_ME;
1822 	if (!(ifp->if_flags & IFF_PROMISC))
1823 		tmp |= RT2573_DROP_NOT_TO_ME;
1824 
1825 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
1826 
1827 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
1828 	    "entering" : "leaving"));
1829 }
1830 
1831 Static const char *
1832 rum_get_rf(int rev)
1833 {
1834 	switch (rev) {
1835 	case RT2573_RF_2527:	return "RT2527 (MIMO XR)";
1836 	case RT2573_RF_2528:	return "RT2528";
1837 	case RT2573_RF_5225:	return "RT5225 (MIMO XR)";
1838 	case RT2573_RF_5226:	return "RT5226";
1839 	default:		return "unknown";
1840 	}
1841 }
1842 
1843 Static void
1844 rum_read_eeprom(struct rum_softc *sc)
1845 {
1846 	struct ieee80211com *ic = &sc->sc_ic;
1847 	uint16_t val;
1848 #ifdef RUM_DEBUG
1849 	int i;
1850 #endif
1851 
1852 	/* read MAC/BBP type */
1853 	rum_eeprom_read(sc, RT2573_EEPROM_MACBBP, &val, 2);
1854 	sc->macbbp_rev = le16toh(val);
1855 
1856 	/* read MAC address */
1857 	rum_eeprom_read(sc, RT2573_EEPROM_ADDRESS, ic->ic_myaddr, 6);
1858 
1859 	rum_eeprom_read(sc, RT2573_EEPROM_ANTENNA, &val, 2);
1860 	val = le16toh(val);
1861 	sc->rf_rev =   (val >> 11) & 0x1f;
1862 	sc->hw_radio = (val >> 10) & 0x1;
1863 	sc->rx_ant =   (val >> 4)  & 0x3;
1864 	sc->tx_ant =   (val >> 2)  & 0x3;
1865 	sc->nb_ant =   val & 0x3;
1866 
1867 	DPRINTF(("RF revision=%d\n", sc->rf_rev));
1868 
1869 	rum_eeprom_read(sc, RT2573_EEPROM_CONFIG2, &val, 2);
1870 	val = le16toh(val);
1871 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
1872 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
1873 
1874 	DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
1875 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
1876 
1877 	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET, &val, 2);
1878 	val = le16toh(val);
1879 	if ((val & 0xff) != 0xff)
1880 		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
1881 
1882 	rum_eeprom_read(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET, &val, 2);
1883 	val = le16toh(val);
1884 	if ((val & 0xff) != 0xff)
1885 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
1886 
1887 	DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
1888 	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
1889 
1890 	rum_eeprom_read(sc, RT2573_EEPROM_FREQ_OFFSET, &val, 2);
1891 	val = le16toh(val);
1892 	if ((val & 0xff) != 0xff)
1893 		sc->rffreq = val & 0xff;
1894 
1895 	DPRINTF(("RF freq=%d\n", sc->rffreq));
1896 
1897 	/* read Tx power for all a/b/g channels */
1898 	rum_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->txpow, 14);
1899 	/* XXX default Tx power for 802.11a channels */
1900 	memset(sc->txpow + 14, 24, sizeof (sc->txpow) - 14);
1901 #ifdef RUM_DEBUG
1902 	for (i = 0; i < 14; i++)
1903 		DPRINTF(("Channel=%d Tx power=%d\n", i + 1,  sc->txpow[i]));
1904 #endif
1905 
1906 	/* read default values for BBP registers */
1907 	rum_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->bbp_prom, 2 * 16);
1908 #ifdef RUM_DEBUG
1909 	for (i = 0; i < 14; i++) {
1910 		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1911 			continue;
1912 		DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
1913 		    sc->bbp_prom[i].val));
1914 	}
1915 #endif
1916 }
1917 
1918 Static int
1919 rum_bbp_init(struct rum_softc *sc)
1920 {
1921 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
1922 	int i, ntries;
1923 	uint8_t val;
1924 
1925 	/* wait for BBP to be ready */
1926 	for (ntries = 0; ntries < 100; ntries++) {
1927 		val = rum_bbp_read(sc, 0);
1928 		if (val != 0 && val != 0xff)
1929 			break;
1930 		DELAY(1000);
1931 	}
1932 	if (ntries == 100) {
1933 		printf("%s: timeout waiting for BBP\n",
1934 		    USBDEVNAME(sc->sc_dev));
1935 		return EIO;
1936 	}
1937 
1938 	/* initialize BBP registers to default values */
1939 	for (i = 0; i < N(rum_def_bbp); i++)
1940 		rum_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
1941 
1942 	/* write vendor-specific BBP values (from EEPROM) */
1943 	for (i = 0; i < 16; i++) {
1944 		if (sc->bbp_prom[i].reg == 0 || sc->bbp_prom[i].reg == 0xff)
1945 			continue;
1946 		rum_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
1947 	}
1948 
1949 	return 0;
1950 #undef N
1951 }
1952 
1953 Static int
1954 rum_init(struct ifnet *ifp)
1955 {
1956 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
1957 	struct rum_softc *sc = ifp->if_softc;
1958 	struct ieee80211com *ic = &sc->sc_ic;
1959 	struct rum_rx_data *data;
1960 	uint32_t tmp;
1961 	usbd_status error = 0;
1962 	int i, ntries;
1963 
1964 	if ((sc->sc_flags & RT2573_FWLOADED) == 0) {
1965 		if (rum_attachhook(sc))
1966 			goto fail;
1967 	}
1968 
1969 	rum_stop(ifp, 0);
1970 
1971 	/* initialize MAC registers to default values */
1972 	for (i = 0; i < N(rum_def_mac); i++)
1973 		rum_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
1974 
1975 	/* set host ready */
1976 	rum_write(sc, RT2573_MAC_CSR1, 3);
1977 	rum_write(sc, RT2573_MAC_CSR1, 0);
1978 
1979 	/* wait for BBP/RF to wakeup */
1980 	for (ntries = 0; ntries < 1000; ntries++) {
1981 		if (rum_read(sc, RT2573_MAC_CSR12) & 8)
1982 			break;
1983 		rum_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
1984 		DELAY(1000);
1985 	}
1986 	if (ntries == 1000) {
1987 		printf("%s: timeout waiting for BBP/RF to wakeup\n",
1988 		    USBDEVNAME(sc->sc_dev));
1989 		goto fail;
1990 	}
1991 
1992 	if ((error = rum_bbp_init(sc)) != 0)
1993 		goto fail;
1994 
1995 	/* select default channel */
1996 	rum_select_band(sc, ic->ic_curchan);
1997 	rum_select_antenna(sc);
1998 	rum_set_chan(sc, ic->ic_curchan);
1999 
2000 	/* clear STA registers */
2001 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2002 
2003 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
2004 	rum_set_macaddr(sc, ic->ic_myaddr);
2005 
2006 	/* initialize ASIC */
2007 	rum_write(sc, RT2573_MAC_CSR1, 4);
2008 
2009 	/*
2010 	 * Allocate xfer for AMRR statistics requests.
2011 	 */
2012 	sc->amrr_xfer = usbd_alloc_xfer(sc->sc_udev);
2013 	if (sc->amrr_xfer == NULL) {
2014 		printf("%s: could not allocate AMRR xfer\n",
2015 		    USBDEVNAME(sc->sc_dev));
2016 		goto fail;
2017 	}
2018 
2019 	/*
2020 	 * Open Tx and Rx USB bulk pipes.
2021 	 */
2022 	error = usbd_open_pipe(sc->sc_iface, sc->sc_tx_no, USBD_EXCLUSIVE_USE,
2023 	    &sc->sc_tx_pipeh);
2024 	if (error != 0) {
2025 		printf("%s: could not open Tx pipe: %s\n",
2026 		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2027 		goto fail;
2028 	}
2029 
2030 	error = usbd_open_pipe(sc->sc_iface, sc->sc_rx_no, USBD_EXCLUSIVE_USE,
2031 	    &sc->sc_rx_pipeh);
2032 	if (error != 0) {
2033 		printf("%s: could not open Rx pipe: %s\n",
2034 		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2035 		goto fail;
2036 	}
2037 
2038 	/*
2039 	 * Allocate Tx and Rx xfer queues.
2040 	 */
2041 	error = rum_alloc_tx_list(sc);
2042 	if (error != 0) {
2043 		printf("%s: could not allocate Tx list\n",
2044 		    USBDEVNAME(sc->sc_dev));
2045 		goto fail;
2046 	}
2047 
2048 	error = rum_alloc_rx_list(sc);
2049 	if (error != 0) {
2050 		printf("%s: could not allocate Rx list\n",
2051 		    USBDEVNAME(sc->sc_dev));
2052 		goto fail;
2053 	}
2054 
2055 	/*
2056 	 * Start up the receive pipe.
2057 	 */
2058 	for (i = 0; i < RUM_RX_LIST_COUNT; i++) {
2059 		data = &sc->rx_data[i];
2060 
2061 		usbd_setup_xfer(data->xfer, sc->sc_rx_pipeh, data, data->buf,
2062 		    MCLBYTES, USBD_SHORT_XFER_OK, USBD_NO_TIMEOUT, rum_rxeof);
2063 		error = usbd_transfer(data->xfer);
2064 		if (error != USBD_NORMAL_COMPLETION &&
2065 		    error != USBD_IN_PROGRESS) {
2066 			printf("%s: could not queue Rx transfer\n",
2067 			    USBDEVNAME(sc->sc_dev));
2068 			goto fail;
2069 		}
2070 	}
2071 
2072 	/* update Rx filter */
2073 	tmp = rum_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2074 
2075 	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2076 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2077 		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2078 		       RT2573_DROP_ACKCTS;
2079 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2080 			tmp |= RT2573_DROP_TODS;
2081 		if (!(ifp->if_flags & IFF_PROMISC))
2082 			tmp |= RT2573_DROP_NOT_TO_ME;
2083 	}
2084 	rum_write(sc, RT2573_TXRX_CSR0, tmp);
2085 
2086 	ifp->if_flags &= ~IFF_OACTIVE;
2087 	ifp->if_flags |= IFF_RUNNING;
2088 
2089 	if (ic->ic_opmode == IEEE80211_M_MONITOR)
2090 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2091 	else
2092 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2093 
2094 	return 0;
2095 
2096 fail:	rum_stop(ifp, 1);
2097 	return error;
2098 #undef N
2099 }
2100 
2101 Static void
2102 rum_stop(struct ifnet *ifp, int disable)
2103 {
2104 	struct rum_softc *sc = ifp->if_softc;
2105 	struct ieee80211com *ic = &sc->sc_ic;
2106 	uint32_t tmp;
2107 
2108 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2109 
2110 	sc->sc_tx_timer = 0;
2111 	ifp->if_timer = 0;
2112 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2113 
2114 	/* disable Rx */
2115 	tmp = rum_read(sc, RT2573_TXRX_CSR0);
2116 	rum_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2117 
2118 	/* reset ASIC */
2119 	rum_write(sc, RT2573_MAC_CSR1, 3);
2120 	rum_write(sc, RT2573_MAC_CSR1, 0);
2121 
2122 	if (sc->sc_rx_pipeh != NULL) {
2123 		usbd_abort_pipe(sc->sc_rx_pipeh);
2124 		usbd_close_pipe(sc->sc_rx_pipeh);
2125 		sc->sc_rx_pipeh = NULL;
2126 	}
2127 
2128 	if (sc->sc_tx_pipeh != NULL) {
2129 		usbd_abort_pipe(sc->sc_tx_pipeh);
2130 		usbd_close_pipe(sc->sc_tx_pipeh);
2131 		sc->sc_tx_pipeh = NULL;
2132 	}
2133 
2134 	rum_free_rx_list(sc);
2135 	rum_free_tx_list(sc);
2136 }
2137 
2138 Static int
2139 rum_load_microcode(struct rum_softc *sc, const u_char *ucode, size_t size)
2140 {
2141 	usb_device_request_t req;
2142 	uint16_t reg = RT2573_MCU_CODE_BASE;
2143 	usbd_status error;
2144 
2145 	/* copy firmware image into NIC */
2146 	for (; size >= 4; reg += 4, ucode += 4, size -= 4)
2147 		rum_write(sc, reg, UGETDW(ucode));
2148 
2149 	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2150 	req.bRequest = RT2573_MCU_CNTL;
2151 	USETW(req.wValue, RT2573_MCU_RUN);
2152 	USETW(req.wIndex, 0);
2153 	USETW(req.wLength, 0);
2154 
2155 	error = usbd_do_request(sc->sc_udev, &req, NULL);
2156 	if (error != 0) {
2157 		printf("%s: could not run firmware: %s\n",
2158 		    USBDEVNAME(sc->sc_dev), usbd_errstr(error));
2159 	}
2160 	return error;
2161 }
2162 
2163 Static int
2164 rum_prepare_beacon(struct rum_softc *sc)
2165 {
2166 	struct ieee80211com *ic = &sc->sc_ic;
2167 	struct rum_tx_desc desc;
2168 	struct mbuf *m0;
2169 	int rate;
2170 
2171 	m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo);
2172 	if (m0 == NULL) {
2173 		aprint_error_dev(sc->sc_dev,
2174 		    "could not allocate beacon frame\n");
2175 		return ENOBUFS;
2176 	}
2177 
2178 	/* send beacons at the lowest available rate */
2179 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
2180 
2181 	rum_setup_tx_desc(sc, &desc, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ,
2182 	    m0->m_pkthdr.len, rate);
2183 
2184 	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2185 	rum_write_multi(sc, RT2573_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2186 
2187 	/* copy beacon header and payload into NIC memory */
2188 	rum_write_multi(sc, RT2573_HW_BEACON_BASE0 + 24, mtod(m0, uint8_t *),
2189 	    m0->m_pkthdr.len);
2190 
2191 	m_freem(m0);
2192 
2193 	return 0;
2194 }
2195 
2196 Static void
2197 rum_newassoc(struct ieee80211_node *ni, int isnew)
2198 {
2199 	/* start with lowest Tx rate */
2200 	ni->ni_txrate = 0;
2201 }
2202 
2203 Static void
2204 rum_amrr_start(struct rum_softc *sc, struct ieee80211_node *ni)
2205 {
2206 	int i;
2207 
2208 	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2209 	rum_read_multi(sc, RT2573_STA_CSR0, sc->sta, sizeof sc->sta);
2210 
2211 	ieee80211_amrr_node_init(&sc->amrr, &sc->amn);
2212 
2213 	/* set rate to some reasonable initial value */
2214 	for (i = ni->ni_rates.rs_nrates - 1;
2215 	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
2216 	     i--);
2217 	ni->ni_txrate = i;
2218 
2219 	usb_callout(sc->sc_amrr_ch, hz, rum_amrr_timeout, sc);
2220 }
2221 
2222 Static void
2223 rum_amrr_timeout(void *arg)
2224 {
2225 	struct rum_softc *sc = arg;
2226 	usb_device_request_t req;
2227 
2228 	/*
2229 	 * Asynchronously read statistic registers (cleared by read).
2230 	 */
2231 	req.bmRequestType = UT_READ_VENDOR_DEVICE;
2232 	req.bRequest = RT2573_READ_MULTI_MAC;
2233 	USETW(req.wValue, 0);
2234 	USETW(req.wIndex, RT2573_STA_CSR0);
2235 	USETW(req.wLength, sizeof sc->sta);
2236 
2237 	usbd_setup_default_xfer(sc->amrr_xfer, sc->sc_udev, sc,
2238 	    USBD_DEFAULT_TIMEOUT, &req, sc->sta, sizeof sc->sta, 0,
2239 	    rum_amrr_update);
2240 	(void)usbd_transfer(sc->amrr_xfer);
2241 }
2242 
2243 Static void
2244 rum_amrr_update(usbd_xfer_handle xfer, usbd_private_handle priv,
2245     usbd_status status)
2246 {
2247 	struct rum_softc *sc = (struct rum_softc *)priv;
2248 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2249 
2250 	if (status != USBD_NORMAL_COMPLETION) {
2251 		printf("%s: could not retrieve Tx statistics - cancelling "
2252 		    "automatic rate control\n", USBDEVNAME(sc->sc_dev));
2253 		return;
2254 	}
2255 
2256 	/* count TX retry-fail as Tx errors */
2257 	ifp->if_oerrors += le32toh(sc->sta[5]) >> 16;
2258 
2259 	sc->amn.amn_retrycnt =
2260 	    (le32toh(sc->sta[4]) >> 16) +	/* TX one-retry ok count */
2261 	    (le32toh(sc->sta[5]) & 0xffff) +	/* TX more-retry ok count */
2262 	    (le32toh(sc->sta[5]) >> 16);	/* TX retry-fail count */
2263 
2264 	sc->amn.amn_txcnt =
2265 	    sc->amn.amn_retrycnt +
2266 	    (le32toh(sc->sta[4]) & 0xffff);	/* TX no-retry ok count */
2267 
2268 	ieee80211_amrr_choose(&sc->amrr, sc->sc_ic.ic_bss, &sc->amn);
2269 
2270 	usb_callout(sc->sc_amrr_ch, hz, rum_amrr_timeout, sc);
2271 }
2272 
2273 int
2274 rum_activate(device_ptr_t self, enum devact act)
2275 {
2276 	switch (act) {
2277 	case DVACT_ACTIVATE:
2278 		return EOPNOTSUPP;
2279 
2280 	case DVACT_DEACTIVATE:
2281 		/*if_deactivate(&sc->sc_ic.ic_if);*/
2282 		break;
2283 	}
2284 
2285 	return 0;
2286 }
2287