if_rum.c revision 187970
1/*-
2 * Copyright (c) 2005-2007 Damien Bergamini <damien.bergamini@free.fr>
3 * Copyright (c) 2006 Niall O'Higgins <niallo@openbsd.org>
4 * Copyright (c) 2007-2008 Hans Petter Selasky <hselasky@freebsd.org>
5 *
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
9 *
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17 */
18
19/*
20 * NOTE: all function names beginning like "rum_cfg_" can only
21 * be called from within the config thread function !
22 */
23
24#include <sys/cdefs.h>
25__FBSDID("$FreeBSD: head/sys/dev/usb2/wlan/if_rum2.c 187970 2009-02-01 00:51:25Z thompsa $");
26
27/*-
28 * Ralink Technology RT2501USB/RT2601USB chipset driver
29 * http://www.ralinktech.com.tw/
30 */
31
32#include <dev/usb2/include/usb2_devid.h>
33#include <dev/usb2/include/usb2_standard.h>
34#include <dev/usb2/include/usb2_mfunc.h>
35#include <dev/usb2/include/usb2_error.h>
36
37#define	usb2_config_td_cc rum_config_copy
38#define	usb2_config_td_softc rum_softc
39
40#define	USB_DEBUG_VAR rum_debug
41
42#include <dev/usb2/core/usb2_core.h>
43#include <dev/usb2/core/usb2_lookup.h>
44#include <dev/usb2/core/usb2_process.h>
45#include <dev/usb2/core/usb2_config_td.h>
46#include <dev/usb2/core/usb2_debug.h>
47#include <dev/usb2/core/usb2_request.h>
48#include <dev/usb2/core/usb2_busdma.h>
49#include <dev/usb2/core/usb2_util.h>
50
51#include <dev/usb2/wlan/usb2_wlan.h>
52#include <dev/usb2/wlan/if_rumreg.h>
53#include <dev/usb2/wlan/if_rumvar.h>
54#include <dev/usb2/wlan/if_rumfw.h>
55
56#if USB_DEBUG
57static int rum_debug = 0;
58
59SYSCTL_NODE(_hw_usb2, OID_AUTO, rum, CTLFLAG_RW, 0, "USB rum");
60SYSCTL_INT(_hw_usb2_rum, OID_AUTO, debug, CTLFLAG_RW, &rum_debug, 0,
61    "Debug level");
62#endif
63
64/* prototypes */
65
66static device_probe_t rum_probe;
67static device_attach_t rum_attach;
68static device_detach_t rum_detach;
69
70static usb2_callback_t rum_bulk_read_callback;
71static usb2_callback_t rum_bulk_read_clear_stall_callback;
72static usb2_callback_t rum_bulk_write_callback;
73static usb2_callback_t rum_bulk_write_clear_stall_callback;
74
75static usb2_config_td_command_t rum_cfg_first_time_setup;
76static usb2_config_td_command_t rum_config_copy;
77static usb2_config_td_command_t rum_cfg_scan_start;
78static usb2_config_td_command_t rum_cfg_scan_end;
79static usb2_config_td_command_t rum_cfg_select_band;
80static usb2_config_td_command_t rum_cfg_set_chan;
81static usb2_config_td_command_t rum_cfg_enable_tsf_sync;
82static usb2_config_td_command_t rum_cfg_enable_mrr;
83static usb2_config_td_command_t rum_cfg_update_slot;
84static usb2_config_td_command_t rum_cfg_select_antenna;
85static usb2_config_td_command_t rum_cfg_set_txpreamble;
86static usb2_config_td_command_t rum_cfg_update_promisc;
87static usb2_config_td_command_t rum_cfg_pre_init;
88static usb2_config_td_command_t rum_cfg_init;
89static usb2_config_td_command_t rum_cfg_pre_stop;
90static usb2_config_td_command_t rum_cfg_stop;
91static usb2_config_td_command_t rum_cfg_amrr_timeout;
92static usb2_config_td_command_t rum_cfg_prepare_beacon;
93static usb2_config_td_command_t rum_cfg_newstate;
94
95static const char *rum_get_rf(uint32_t);
96static int	rum_ioctl_cb(struct ifnet *, u_long, caddr_t);
97static void	rum_std_command(struct ieee80211com *, usb2_config_td_command_t *);
98static void	rum_scan_start_cb(struct ieee80211com *);
99static void	rum_scan_end_cb(struct ieee80211com *);
100static void	rum_set_channel_cb(struct ieee80211com *);
101static uint16_t	rum_cfg_eeprom_read_2(struct rum_softc *, uint16_t);
102static uint32_t	rum_cfg_bbp_disbusy(struct rum_softc *);
103static uint32_t	rum_cfg_read(struct rum_softc *, uint16_t);
104static uint8_t	rum_cfg_bbp_init(struct rum_softc *);
105static uint8_t	rum_cfg_bbp_read(struct rum_softc *, uint8_t);
106static void	rum_cfg_amrr_start(struct rum_softc *);
107static void	rum_cfg_bbp_write(struct rum_softc *, uint8_t, uint8_t);
108static void	rum_cfg_do_request(struct rum_softc *,
109		    struct usb2_device_request *, void *);
110static void	rum_cfg_eeprom_read(struct rum_softc *, uint16_t, void *,
111		    uint16_t);
112static void	rum_cfg_load_microcode(struct rum_softc *, const uint8_t *,
113		    uint16_t);
114static void	rum_cfg_read_eeprom(struct rum_softc *);
115static void	rum_cfg_read_multi(struct rum_softc *, uint16_t, void *,
116		    uint16_t);
117static void	rum_cfg_rf_write(struct rum_softc *, uint8_t, uint32_t);
118static void	rum_cfg_set_bssid(struct rum_softc *, uint8_t *);
119static void	rum_cfg_set_macaddr(struct rum_softc *, uint8_t *);
120static void	rum_cfg_write(struct rum_softc *, uint16_t, uint32_t);
121static void	rum_cfg_write_multi(struct rum_softc *, uint16_t, void *,
122		    uint16_t);
123static void	rum_end_of_commands(struct rum_softc *);
124static void	rum_init_cb(void *);
125static void	rum_start_cb(struct ifnet *);
126static void	rum_watchdog(void *);
127static uint8_t	rum_get_rssi(struct rum_softc *, uint8_t);
128static struct ieee80211vap *rum_vap_create(struct ieee80211com *,
129		    const char[], int, int, int, const uint8_t[],
130		    const uint8_t[]);
131static void	rum_vap_delete(struct ieee80211vap *);
132static struct ieee80211_node *rum_node_alloc(struct ieee80211vap *,
133		    const uint8_t[]);
134static void	rum_newassoc(struct ieee80211_node *, int);
135static void	rum_cfg_disable_tsf_sync(struct rum_softc *);
136static void	rum_cfg_set_run(struct rum_softc *, struct rum_config_copy *);
137static void	rum_fill_write_queue(struct rum_softc *);
138static void	rum_tx_clean_queue(struct rum_softc *);
139static void	rum_tx_freem(struct mbuf *);
140static void	rum_tx_mgt(struct rum_softc *, struct mbuf *,
141		    struct ieee80211_node *);
142static struct ieee80211vap *rum_get_vap(struct rum_softc *);
143static void	rum_tx_data(struct rum_softc *, struct mbuf *,
144		    struct ieee80211_node *);
145static void	rum_tx_prot(struct rum_softc *, const struct mbuf *,
146		    struct ieee80211_node *, uint8_t, uint16_t);
147static void	rum_tx_raw(struct rum_softc *, struct mbuf *,
148		    struct ieee80211_node *,
149		    const struct ieee80211_bpf_params *);
150static int	rum_raw_xmit_cb(struct ieee80211_node *, struct mbuf *,
151		    const struct ieee80211_bpf_params *);
152static void	rum_setup_desc_and_tx(struct rum_softc *, struct mbuf *,
153		    uint32_t, uint16_t, uint16_t);
154static int	rum_newstate_cb(struct ieee80211vap *,
155		    enum ieee80211_state nstate, int arg);
156static void	rum_update_mcast_cb(struct ifnet *);
157static void	rum_update_promisc_cb(struct ifnet *);
158
159/* various supported device vendors/products */
160static const struct usb2_device_id rum_devs[] = {
161	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_HWU54DM, 0)},
162	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_RT2573_2, 0)},
163	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_RT2573_3, 0)},
164	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_RT2573_4, 0)},
165	{USB_VPI(USB_VENDOR_ABOCOM, USB_PRODUCT_ABOCOM_WUG2700, 0)},
166	{USB_VPI(USB_VENDOR_AMIT, USB_PRODUCT_AMIT_CGWLUSB2GO, 0)},
167	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_RT2573_1, 0)},
168	{USB_VPI(USB_VENDOR_ASUS, USB_PRODUCT_ASUS_RT2573_2, 0)},
169	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D7050A, 0)},
170	{USB_VPI(USB_VENDOR_BELKIN, USB_PRODUCT_BELKIN_F5D9050V3, 0)},
171	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GC, 0)},
172	{USB_VPI(USB_VENDOR_CISCOLINKSYS, USB_PRODUCT_CISCOLINKSYS_WUSB54GR, 0)},
173	{USB_VPI(USB_VENDOR_CONCEPTRONIC2, USB_PRODUCT_CONCEPTRONIC2_C54RU2, 0)},
174	{USB_VPI(USB_VENDOR_COREGA, USB_PRODUCT_COREGA_CGWLUSB2GL, 0)},
175	{USB_VPI(USB_VENDOR_COREGA, USB_PRODUCT_COREGA_CGWLUSB2GPX, 0)},
176	{USB_VPI(USB_VENDOR_DICKSMITH, USB_PRODUCT_DICKSMITH_CWD854F, 0)},
177	{USB_VPI(USB_VENDOR_DICKSMITH, USB_PRODUCT_DICKSMITH_RT2573, 0)},
178	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_DWLG122C1, 0)},
179	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_WUA1340, 0)},
180	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_DWA111, 0)},
181	{USB_VPI(USB_VENDOR_DLINK2, USB_PRODUCT_DLINK2_DWA110, 0)},
182	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWB01GS, 0)},
183	{USB_VPI(USB_VENDOR_GIGABYTE, USB_PRODUCT_GIGABYTE_GNWI05GS, 0)},
184	{USB_VPI(USB_VENDOR_GIGASET, USB_PRODUCT_GIGASET_RT2573, 0)},
185	{USB_VPI(USB_VENDOR_GOODWAY, USB_PRODUCT_GOODWAY_RT2573, 0)},
186	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254LB, 0)},
187	{USB_VPI(USB_VENDOR_GUILLEMOT, USB_PRODUCT_GUILLEMOT_HWGUSB254V2AP, 0)},
188	{USB_VPI(USB_VENDOR_HUAWEI3COM, USB_PRODUCT_HUAWEI3COM_WUB320G, 0)},
189	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_G54HP, 0)},
190	{USB_VPI(USB_VENDOR_MELCO, USB_PRODUCT_MELCO_SG54HP, 0)},
191	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_1, 0)},
192	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_2, 0)},
193	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_3, 0)},
194	{USB_VPI(USB_VENDOR_MSI, USB_PRODUCT_MSI_RT2573_4, 0)},
195	{USB_VPI(USB_VENDOR_NOVATECH, USB_PRODUCT_NOVATECH_RT2573, 0)},
196	{USB_VPI(USB_VENDOR_PLANEX2, USB_PRODUCT_PLANEX2_GWUS54HP, 0)},
197	{USB_VPI(USB_VENDOR_PLANEX2, USB_PRODUCT_PLANEX2_GWUS54MINI2, 0)},
198	{USB_VPI(USB_VENDOR_PLANEX2, USB_PRODUCT_PLANEX2_GWUSMM, 0)},
199	{USB_VPI(USB_VENDOR_QCOM, USB_PRODUCT_QCOM_RT2573, 0)},
200	{USB_VPI(USB_VENDOR_QCOM, USB_PRODUCT_QCOM_RT2573_2, 0)},
201	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2573, 0)},
202	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2573_2, 0)},
203	{USB_VPI(USB_VENDOR_RALINK, USB_PRODUCT_RALINK_RT2671, 0)},
204	{USB_VPI(USB_VENDOR_SITECOMEU, USB_PRODUCT_SITECOMEU_WL113R2, 0)},
205	{USB_VPI(USB_VENDOR_SITECOMEU, USB_PRODUCT_SITECOMEU_WL172, 0)},
206	{USB_VPI(USB_VENDOR_SPARKLAN, USB_PRODUCT_SPARKLAN_RT2573, 0)},
207	{USB_VPI(USB_VENDOR_SURECOM, USB_PRODUCT_SURECOM_RT2573, 0)},
208};
209
210struct rum_def_mac {
211	uint32_t reg;
212	uint32_t val;
213};
214
215static const struct rum_def_mac rum_def_mac[] = {
216	{RT2573_TXRX_CSR0, 0x025fb032},
217	{RT2573_TXRX_CSR1, 0x9eaa9eaf},
218	{RT2573_TXRX_CSR2, 0x8a8b8c8d},
219	{RT2573_TXRX_CSR3, 0x00858687},
220	{RT2573_TXRX_CSR7, 0x2e31353b},
221	{RT2573_TXRX_CSR8, 0x2a2a2a2c},
222	{RT2573_TXRX_CSR15, 0x0000000f},
223	{RT2573_MAC_CSR6, 0x00000fff},
224	{RT2573_MAC_CSR8, 0x016c030a},
225	{RT2573_MAC_CSR10, 0x00000718},
226	{RT2573_MAC_CSR12, 0x00000004},
227	{RT2573_MAC_CSR13, 0x00007f00},
228	{RT2573_SEC_CSR0, 0x00000000},
229	{RT2573_SEC_CSR1, 0x00000000},
230	{RT2573_SEC_CSR5, 0x00000000},
231	{RT2573_PHY_CSR1, 0x000023b0},
232	{RT2573_PHY_CSR5, 0x00040a06},
233	{RT2573_PHY_CSR6, 0x00080606},
234	{RT2573_PHY_CSR7, 0x00000408},
235	{RT2573_AIFSN_CSR, 0x00002273},
236	{RT2573_CWMIN_CSR, 0x00002344},
237	{RT2573_CWMAX_CSR, 0x000034aa}
238};
239
240struct rum_def_bbp {
241	uint8_t	reg;
242	uint8_t	val;
243};
244
245static const struct rum_def_bbp rum_def_bbp[] = {
246	{3, 0x80},
247	{15, 0x30},
248	{17, 0x20},
249	{21, 0xc8},
250	{22, 0x38},
251	{23, 0x06},
252	{24, 0xfe},
253	{25, 0x0a},
254	{26, 0x0d},
255	{32, 0x0b},
256	{34, 0x12},
257	{37, 0x07},
258	{39, 0xf8},
259	{41, 0x60},
260	{53, 0x10},
261	{54, 0x18},
262	{60, 0x10},
263	{61, 0x04},
264	{62, 0x04},
265	{75, 0xfe},
266	{86, 0xfe},
267	{88, 0xfe},
268	{90, 0x0f},
269	{99, 0x00},
270	{102, 0x16},
271	{107, 0x04}
272};
273
274struct rfprog {
275	uint8_t	chan;
276	uint32_t r1, r2, r3, r4;
277};
278
279static const struct rfprog rum_rf5226[] = {
280	{1, 0x00b03, 0x001e1, 0x1a014, 0x30282},
281	{2, 0x00b03, 0x001e1, 0x1a014, 0x30287},
282	{3, 0x00b03, 0x001e2, 0x1a014, 0x30282},
283	{4, 0x00b03, 0x001e2, 0x1a014, 0x30287},
284	{5, 0x00b03, 0x001e3, 0x1a014, 0x30282},
285	{6, 0x00b03, 0x001e3, 0x1a014, 0x30287},
286	{7, 0x00b03, 0x001e4, 0x1a014, 0x30282},
287	{8, 0x00b03, 0x001e4, 0x1a014, 0x30287},
288	{9, 0x00b03, 0x001e5, 0x1a014, 0x30282},
289	{10, 0x00b03, 0x001e5, 0x1a014, 0x30287},
290	{11, 0x00b03, 0x001e6, 0x1a014, 0x30282},
291	{12, 0x00b03, 0x001e6, 0x1a014, 0x30287},
292	{13, 0x00b03, 0x001e7, 0x1a014, 0x30282},
293	{14, 0x00b03, 0x001e8, 0x1a014, 0x30284},
294
295	{34, 0x00b03, 0x20266, 0x36014, 0x30282},
296	{38, 0x00b03, 0x20267, 0x36014, 0x30284},
297	{42, 0x00b03, 0x20268, 0x36014, 0x30286},
298	{46, 0x00b03, 0x20269, 0x36014, 0x30288},
299
300	{36, 0x00b03, 0x00266, 0x26014, 0x30288},
301	{40, 0x00b03, 0x00268, 0x26014, 0x30280},
302	{44, 0x00b03, 0x00269, 0x26014, 0x30282},
303	{48, 0x00b03, 0x0026a, 0x26014, 0x30284},
304	{52, 0x00b03, 0x0026b, 0x26014, 0x30286},
305	{56, 0x00b03, 0x0026c, 0x26014, 0x30288},
306	{60, 0x00b03, 0x0026e, 0x26014, 0x30280},
307	{64, 0x00b03, 0x0026f, 0x26014, 0x30282},
308
309	{100, 0x00b03, 0x0028a, 0x2e014, 0x30280},
310	{104, 0x00b03, 0x0028b, 0x2e014, 0x30282},
311	{108, 0x00b03, 0x0028c, 0x2e014, 0x30284},
312	{112, 0x00b03, 0x0028d, 0x2e014, 0x30286},
313	{116, 0x00b03, 0x0028e, 0x2e014, 0x30288},
314	{120, 0x00b03, 0x002a0, 0x2e014, 0x30280},
315	{124, 0x00b03, 0x002a1, 0x2e014, 0x30282},
316	{128, 0x00b03, 0x002a2, 0x2e014, 0x30284},
317	{132, 0x00b03, 0x002a3, 0x2e014, 0x30286},
318	{136, 0x00b03, 0x002a4, 0x2e014, 0x30288},
319	{140, 0x00b03, 0x002a6, 0x2e014, 0x30280},
320
321	{149, 0x00b03, 0x002a8, 0x2e014, 0x30287},
322	{153, 0x00b03, 0x002a9, 0x2e014, 0x30289},
323	{157, 0x00b03, 0x002ab, 0x2e014, 0x30281},
324	{161, 0x00b03, 0x002ac, 0x2e014, 0x30283},
325	{165, 0x00b03, 0x002ad, 0x2e014, 0x30285}
326};
327
328static const struct rfprog rum_rf5225[] = {
329	{1, 0x00b33, 0x011e1, 0x1a014, 0x30282},
330	{2, 0x00b33, 0x011e1, 0x1a014, 0x30287},
331	{3, 0x00b33, 0x011e2, 0x1a014, 0x30282},
332	{4, 0x00b33, 0x011e2, 0x1a014, 0x30287},
333	{5, 0x00b33, 0x011e3, 0x1a014, 0x30282},
334	{6, 0x00b33, 0x011e3, 0x1a014, 0x30287},
335	{7, 0x00b33, 0x011e4, 0x1a014, 0x30282},
336	{8, 0x00b33, 0x011e4, 0x1a014, 0x30287},
337	{9, 0x00b33, 0x011e5, 0x1a014, 0x30282},
338	{10, 0x00b33, 0x011e5, 0x1a014, 0x30287},
339	{11, 0x00b33, 0x011e6, 0x1a014, 0x30282},
340	{12, 0x00b33, 0x011e6, 0x1a014, 0x30287},
341	{13, 0x00b33, 0x011e7, 0x1a014, 0x30282},
342	{14, 0x00b33, 0x011e8, 0x1a014, 0x30284},
343
344	{34, 0x00b33, 0x01266, 0x26014, 0x30282},
345	{38, 0x00b33, 0x01267, 0x26014, 0x30284},
346	{42, 0x00b33, 0x01268, 0x26014, 0x30286},
347	{46, 0x00b33, 0x01269, 0x26014, 0x30288},
348
349	{36, 0x00b33, 0x01266, 0x26014, 0x30288},
350	{40, 0x00b33, 0x01268, 0x26014, 0x30280},
351	{44, 0x00b33, 0x01269, 0x26014, 0x30282},
352	{48, 0x00b33, 0x0126a, 0x26014, 0x30284},
353	{52, 0x00b33, 0x0126b, 0x26014, 0x30286},
354	{56, 0x00b33, 0x0126c, 0x26014, 0x30288},
355	{60, 0x00b33, 0x0126e, 0x26014, 0x30280},
356	{64, 0x00b33, 0x0126f, 0x26014, 0x30282},
357
358	{100, 0x00b33, 0x0128a, 0x2e014, 0x30280},
359	{104, 0x00b33, 0x0128b, 0x2e014, 0x30282},
360	{108, 0x00b33, 0x0128c, 0x2e014, 0x30284},
361	{112, 0x00b33, 0x0128d, 0x2e014, 0x30286},
362	{116, 0x00b33, 0x0128e, 0x2e014, 0x30288},
363	{120, 0x00b33, 0x012a0, 0x2e014, 0x30280},
364	{124, 0x00b33, 0x012a1, 0x2e014, 0x30282},
365	{128, 0x00b33, 0x012a2, 0x2e014, 0x30284},
366	{132, 0x00b33, 0x012a3, 0x2e014, 0x30286},
367	{136, 0x00b33, 0x012a4, 0x2e014, 0x30288},
368	{140, 0x00b33, 0x012a6, 0x2e014, 0x30280},
369
370	{149, 0x00b33, 0x012a8, 0x2e014, 0x30287},
371	{153, 0x00b33, 0x012a9, 0x2e014, 0x30289},
372	{157, 0x00b33, 0x012ab, 0x2e014, 0x30281},
373	{161, 0x00b33, 0x012ac, 0x2e014, 0x30283},
374	{165, 0x00b33, 0x012ad, 0x2e014, 0x30285}
375};
376
377static const struct usb2_config rum_config[RUM_N_TRANSFER] = {
378	[RUM_BULK_DT_WR] = {
379		.type = UE_BULK,
380		.endpoint = UE_ADDR_ANY,
381		.direction = UE_DIR_OUT,
382		.mh.bufsize = (MCLBYTES + RT2573_TX_DESC_SIZE + 8),
383		.mh.flags = {.pipe_bof = 1,.force_short_xfer = 1,},
384		.mh.callback = &rum_bulk_write_callback,
385		.mh.timeout = 5000,	/* ms */
386	},
387
388	[RUM_BULK_DT_RD] = {
389		.type = UE_BULK,
390		.endpoint = UE_ADDR_ANY,
391		.direction = UE_DIR_IN,
392		.mh.bufsize = (MCLBYTES + RT2573_RX_DESC_SIZE),
393		.mh.flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
394		.mh.callback = &rum_bulk_read_callback,
395	},
396
397	[RUM_BULK_CS_WR] = {
398		.type = UE_CONTROL,
399		.endpoint = 0x00,	/* Control pipe */
400		.direction = UE_DIR_ANY,
401		.mh.bufsize = sizeof(struct usb2_device_request),
402		.mh.callback = &rum_bulk_write_clear_stall_callback,
403		.mh.timeout = 1000,	/* 1 second */
404		.mh.interval = 50,	/* 50ms */
405	},
406
407	[RUM_BULK_CS_RD] = {
408		.type = UE_CONTROL,
409		.endpoint = 0x00,	/* Control pipe */
410		.direction = UE_DIR_ANY,
411		.mh.bufsize = sizeof(struct usb2_device_request),
412		.mh.callback = &rum_bulk_read_clear_stall_callback,
413		.mh.timeout = 1000,	/* 1 second */
414		.mh.interval = 50,	/* 50ms */
415	},
416};
417
418static devclass_t rum_devclass;
419
420static device_method_t rum_methods[] = {
421	DEVMETHOD(device_probe, rum_probe),
422	DEVMETHOD(device_attach, rum_attach),
423	DEVMETHOD(device_detach, rum_detach),
424	{0, 0}
425};
426
427static driver_t rum_driver = {
428	.name = "rum",
429	.methods = rum_methods,
430	.size = sizeof(struct rum_softc),
431};
432
433DRIVER_MODULE(rum, ushub, rum_driver, rum_devclass, NULL, 0);
434MODULE_DEPEND(rum, usb2_wlan, 1, 1, 1);
435MODULE_DEPEND(rum, usb2_core, 1, 1, 1);
436MODULE_DEPEND(rum, wlan, 1, 1, 1);
437MODULE_DEPEND(rum, wlan_amrr, 1, 1, 1);
438
439static int
440rum_probe(device_t dev)
441{
442	struct usb2_attach_arg *uaa = device_get_ivars(dev);
443
444	if (uaa->usb2_mode != USB_MODE_HOST) {
445		return (ENXIO);
446	}
447	if (uaa->info.bConfigIndex != 0) {
448		return (ENXIO);
449	}
450	if (uaa->info.bIfaceIndex != RT2573_IFACE_INDEX) {
451		return (ENXIO);
452	}
453	return (usb2_lookup_id_by_uaa(rum_devs, sizeof(rum_devs), uaa));
454}
455
456static int
457rum_attach(device_t dev)
458{
459	struct usb2_attach_arg *uaa = device_get_ivars(dev);
460	struct rum_softc *sc = device_get_softc(dev);
461	int error;
462	uint8_t iface_index;
463
464	device_set_usb2_desc(dev);
465
466	mtx_init(&sc->sc_mtx, "rum lock", MTX_NETWORK_LOCK,
467	    MTX_DEF | MTX_RECURSE);
468
469	snprintf(sc->sc_name, sizeof(sc->sc_name), "%s",
470	    device_get_nameunit(dev));
471
472	sc->sc_udev = uaa->device;
473	sc->sc_unit = device_get_unit(dev);
474
475	usb2_callout_init_mtx(&sc->sc_watchdog, &sc->sc_mtx, 0);
476
477	iface_index = RT2573_IFACE_INDEX;
478	error = usb2_transfer_setup(uaa->device, &iface_index,
479	    sc->sc_xfer, rum_config, RUM_N_TRANSFER, sc, &sc->sc_mtx);
480	if (error) {
481		device_printf(dev, "could not allocate USB transfers, "
482		    "err=%s\n", usb2_errstr(error));
483		goto detach;
484	}
485	error = usb2_config_td_setup(&sc->sc_config_td, sc, &sc->sc_mtx,
486	    &rum_end_of_commands,
487	    sizeof(struct usb2_config_td_cc), 24);
488	if (error) {
489		device_printf(dev, "could not setup config "
490		    "thread!\n");
491		goto detach;
492	}
493	mtx_lock(&sc->sc_mtx);
494
495	/* start setup */
496
497	usb2_config_td_queue_command
498	    (&sc->sc_config_td, NULL, &rum_cfg_first_time_setup, 0, 0);
499
500	rum_watchdog(sc);
501	mtx_unlock(&sc->sc_mtx);
502	return (0);			/* success */
503
504detach:
505	rum_detach(dev);
506	return (ENXIO);			/* failure */
507}
508
509static int
510rum_detach(device_t dev)
511{
512	struct rum_softc *sc = device_get_softc(dev);
513	struct ieee80211com *ic;
514	struct ifnet *ifp;
515
516	usb2_config_td_drain(&sc->sc_config_td);
517
518	mtx_lock(&sc->sc_mtx);
519
520	usb2_callout_stop(&sc->sc_watchdog);
521
522	rum_cfg_pre_stop(sc, NULL, 0);
523
524	ifp = sc->sc_ifp;
525	ic = ifp->if_l2com;
526
527	mtx_unlock(&sc->sc_mtx);
528
529	/* stop all USB transfers first */
530	usb2_transfer_unsetup(sc->sc_xfer, RUM_N_TRANSFER);
531
532	/* get rid of any late children */
533	bus_generic_detach(dev);
534
535	if (ifp) {
536		bpfdetach(ifp);
537		ieee80211_ifdetach(ic);
538		if_free(ifp);
539	}
540	usb2_config_td_unsetup(&sc->sc_config_td);
541
542	usb2_callout_drain(&sc->sc_watchdog);
543
544	mtx_destroy(&sc->sc_mtx);
545
546	return (0);
547}
548
549static void
550rum_cfg_do_request(struct rum_softc *sc, struct usb2_device_request *req,
551    void *data)
552{
553	uint16_t length;
554	usb2_error_t err;
555
556repeat:
557
558	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
559		goto error;
560	}
561	err = usb2_do_request_flags
562	    (sc->sc_udev, &sc->sc_mtx, req, data, 0, NULL, 1000);
563
564	if (err) {
565
566		DPRINTF("device request failed, err=%s "
567		    "(ignored)\n", usb2_errstr(err));
568
569		/* wait a little before next try */
570		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 4)) {
571			goto error;
572		}
573		/* try until we are detached */
574		goto repeat;
575
576error:
577		/* the device has been detached */
578		length = UGETW(req->wLength);
579
580		if ((req->bmRequestType & UT_READ) && length) {
581			bzero(data, length);
582		}
583	}
584}
585
586static void
587rum_cfg_eeprom_read(struct rum_softc *sc, uint16_t addr, void *buf, uint16_t len)
588{
589	struct usb2_device_request req;
590
591	req.bmRequestType = UT_READ_VENDOR_DEVICE;
592	req.bRequest = RT2573_READ_EEPROM;
593	USETW(req.wValue, 0);
594	USETW(req.wIndex, addr);
595	USETW(req.wLength, len);
596
597	rum_cfg_do_request(sc, &req, buf);
598}
599
600static uint16_t
601rum_cfg_eeprom_read_2(struct rum_softc *sc, uint16_t addr)
602{
603	uint16_t tmp;
604
605	rum_cfg_eeprom_read(sc, addr, &tmp, sizeof(tmp));
606	return (le16toh(tmp));
607}
608
609static uint32_t
610rum_cfg_read(struct rum_softc *sc, uint16_t reg)
611{
612	uint32_t val;
613
614	rum_cfg_read_multi(sc, reg, &val, sizeof(val));
615	return (le32toh(val));
616}
617
618static void
619rum_cfg_read_multi(struct rum_softc *sc, uint16_t reg, void *buf, uint16_t len)
620{
621	struct usb2_device_request req;
622
623	req.bmRequestType = UT_READ_VENDOR_DEVICE;
624	req.bRequest = RT2573_READ_MULTI_MAC;
625	USETW(req.wValue, 0);
626	USETW(req.wIndex, reg);
627	USETW(req.wLength, len);
628
629	rum_cfg_do_request(sc, &req, buf);
630}
631
632static void
633rum_cfg_write(struct rum_softc *sc, uint16_t reg, uint32_t val)
634{
635	uint32_t tmp = htole32(val);
636
637	rum_cfg_write_multi(sc, reg, &tmp, sizeof(tmp));
638}
639
640static void
641rum_cfg_write_multi(struct rum_softc *sc, uint16_t reg, void *buf, uint16_t len)
642{
643	struct usb2_device_request req;
644
645	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
646	req.bRequest = RT2573_WRITE_MULTI_MAC;
647	USETW(req.wValue, 0);
648	USETW(req.wIndex, reg);
649	USETW(req.wLength, len);
650
651	rum_cfg_do_request(sc, &req, buf);
652}
653
654static uint32_t
655rum_cfg_bbp_disbusy(struct rum_softc *sc)
656{
657	uint32_t tmp;
658	uint8_t to;
659
660	for (to = 0;; to++) {
661		if (to < 100) {
662			tmp = rum_cfg_read(sc, RT2573_PHY_CSR3);
663
664			if ((tmp & RT2573_BBP_BUSY) == 0) {
665				return (tmp);
666			}
667			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
668				break;
669			}
670		} else {
671			break;
672		}
673	}
674	DPRINTF("could not disbusy BBP\n");
675	return (RT2573_BBP_BUSY);	/* failure */
676}
677
678static void
679rum_cfg_bbp_write(struct rum_softc *sc, uint8_t reg, uint8_t val)
680{
681	uint32_t tmp;
682
683	if (rum_cfg_bbp_disbusy(sc) & RT2573_BBP_BUSY) {
684		return;
685	}
686	tmp = RT2573_BBP_BUSY | ((reg & 0x7f) << 8) | val;
687	rum_cfg_write(sc, RT2573_PHY_CSR3, tmp);
688}
689
690static uint8_t
691rum_cfg_bbp_read(struct rum_softc *sc, uint8_t reg)
692{
693	uint32_t val;
694
695	if (rum_cfg_bbp_disbusy(sc) & RT2573_BBP_BUSY) {
696		return (0);
697	}
698	val = RT2573_BBP_BUSY | RT2573_BBP_READ | (reg << 8);
699	rum_cfg_write(sc, RT2573_PHY_CSR3, val);
700
701	val = rum_cfg_bbp_disbusy(sc);
702	return (val & 0xff);
703}
704
705static void
706rum_cfg_rf_write(struct rum_softc *sc, uint8_t reg, uint32_t val)
707{
708	uint32_t tmp;
709	uint8_t to;
710
711	reg &= 3;
712
713	for (to = 0;; to++) {
714		if (to < 100) {
715			tmp = rum_cfg_read(sc, RT2573_PHY_CSR4);
716			if (!(tmp & RT2573_RF_BUSY)) {
717				break;
718			}
719			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
720				return;
721			}
722		} else {
723			DPRINTF("could not write to RF\n");
724			return;
725		}
726	}
727
728	tmp = RT2573_RF_BUSY | RT2573_RF_20BIT | ((val & 0xfffff) << 2) | reg;
729	rum_cfg_write(sc, RT2573_PHY_CSR4, tmp);
730
731	DPRINTFN(16, "RF R[%u] <- 0x%05x\n", reg, val & 0xfffff);
732}
733
734static void
735rum_cfg_first_time_setup(struct rum_softc *sc,
736    struct usb2_config_td_cc *cc, uint16_t refcount)
737{
738	struct ieee80211com *ic;
739	struct ifnet *ifp;
740	uint32_t tmp;
741	uint16_t i;
742	uint8_t bands;
743
744	/* setup RX tap header */
745	sc->sc_rxtap_len = sizeof(sc->sc_rxtap);
746	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
747	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2573_RX_RADIOTAP_PRESENT);
748
749	/* setup TX tap header */
750	sc->sc_txtap_len = sizeof(sc->sc_txtap);
751	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
752	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2573_TX_RADIOTAP_PRESENT);
753
754	/* retrieve RT2573 rev. no */
755	for (i = 0; i < 100; i++) {
756
757		tmp = rum_cfg_read(sc, RT2573_MAC_CSR0);
758		if (tmp != 0) {
759			break;
760		}
761		/* wait a little */
762		if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
763			/* device detached */
764			goto done;
765		}
766	}
767
768	if (tmp == 0) {
769		DPRINTF("chip is maybe not ready\n");
770	}
771	/* retrieve MAC address and various other things from EEPROM */
772	rum_cfg_read_eeprom(sc);
773
774	printf("%s: MAC/BBP RT2573 (rev 0x%05x), RF %s\n",
775	    sc->sc_name, tmp, rum_get_rf(sc->sc_rf_rev));
776
777	rum_cfg_load_microcode(sc, rt2573_ucode, sizeof(rt2573_ucode));
778
779	mtx_unlock(&sc->sc_mtx);
780
781	ifp = if_alloc(IFT_IEEE80211);
782
783	mtx_lock(&sc->sc_mtx);
784
785	if (ifp == NULL) {
786		DPRINTFN(0, "could not if_alloc()!\n");
787		goto done;
788	}
789	sc->sc_ifp = ifp;
790	ic = ifp->if_l2com;
791
792	ifp->if_softc = sc;
793	if_initname(ifp, "rum", sc->sc_unit);
794	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
795	ifp->if_init = &rum_init_cb;
796	ifp->if_ioctl = &rum_ioctl_cb;
797	ifp->if_start = &rum_start_cb;
798	ifp->if_watchdog = NULL;
799	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
800	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
801	IFQ_SET_READY(&ifp->if_snd);
802
803	bcopy(sc->sc_myaddr, ic->ic_myaddr, sizeof(ic->ic_myaddr));
804
805	ic->ic_ifp = ifp;
806	ic->ic_phytype = IEEE80211_T_OFDM;	/* not only, but not used */
807	ic->ic_opmode = IEEE80211_M_STA;
808
809	/* set device capabilities */
810	ic->ic_caps =
811	    IEEE80211_C_STA		/* station mode supported */
812	    | IEEE80211_C_IBSS		/* IBSS mode supported */
813	    | IEEE80211_C_MONITOR	/* monitor mode supported */
814	    | IEEE80211_C_HOSTAP	/* HostAp mode supported */
815	    | IEEE80211_C_TXPMGT	/* tx power management */
816	    | IEEE80211_C_SHPREAMBLE	/* short preamble supported */
817	    | IEEE80211_C_SHSLOT	/* short slot time supported */
818	    | IEEE80211_C_BGSCAN	/* bg scanning supported */
819	    | IEEE80211_C_WPA		/* 802.11i */
820	    ;
821
822	bands = 0;
823	setbit(&bands, IEEE80211_MODE_11B);
824	setbit(&bands, IEEE80211_MODE_11G);
825	ieee80211_init_channels(ic, NULL, &bands);
826
827	if ((sc->sc_rf_rev == RT2573_RF_5225) ||
828	    (sc->sc_rf_rev == RT2573_RF_5226)) {
829
830		struct ieee80211_channel *c;
831
832		/* set supported .11a channels */
833		for (i = 34; i <= 46; i += 4) {
834			c = ic->ic_channels + (ic->ic_nchans++);
835			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
836			c->ic_flags = IEEE80211_CHAN_A;
837			c->ic_ieee = i;
838		}
839		for (i = 36; i <= 64; i += 4) {
840			c = ic->ic_channels + (ic->ic_nchans++);
841			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
842			c->ic_flags = IEEE80211_CHAN_A;
843			c->ic_ieee = i;
844		}
845		for (i = 100; i <= 140; i += 4) {
846			c = ic->ic_channels + (ic->ic_nchans++);
847			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
848			c->ic_flags = IEEE80211_CHAN_A;
849			c->ic_ieee = i;
850		}
851		for (i = 149; i <= 165; i += 4) {
852			c = ic->ic_channels + (ic->ic_nchans++);
853			c->ic_freq = ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
854			c->ic_flags = IEEE80211_CHAN_A;
855			c->ic_ieee = i;
856		}
857	}
858	mtx_unlock(&sc->sc_mtx);
859
860	ieee80211_ifattach(ic);
861
862	mtx_lock(&sc->sc_mtx);
863
864	ic->ic_newassoc = &rum_newassoc;
865	ic->ic_raw_xmit = &rum_raw_xmit_cb;
866	ic->ic_node_alloc = &rum_node_alloc;
867	ic->ic_update_mcast = &rum_update_mcast_cb;
868	ic->ic_update_promisc = &rum_update_promisc_cb;
869	ic->ic_scan_start = &rum_scan_start_cb;
870	ic->ic_scan_end = &rum_scan_end_cb;
871	ic->ic_set_channel = &rum_set_channel_cb;
872	ic->ic_vap_create = &rum_vap_create;
873	ic->ic_vap_delete = &rum_vap_delete;
874
875	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
876
877	mtx_unlock(&sc->sc_mtx);
878
879	bpfattach(ifp, DLT_IEEE802_11_RADIO,
880	    sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap));
881
882	if (bootverbose) {
883		ieee80211_announce(ic);
884	}
885	mtx_lock(&sc->sc_mtx);
886done:
887	return;
888}
889
890static void
891rum_end_of_commands(struct rum_softc *sc)
892{
893	sc->sc_flags &= ~RUM_FLAG_WAIT_COMMAND;
894
895	/* start write transfer, if not started */
896	usb2_transfer_start(sc->sc_xfer[RUM_BULK_DT_WR]);
897}
898
899static void
900rum_config_copy_chan(struct rum_config_copy_chan *cc,
901    struct ieee80211com *ic, struct ieee80211_channel *c)
902{
903	if (!c)
904		return;
905	cc->chan_to_ieee =
906	    ieee80211_chan2ieee(ic, c);
907	if (c != IEEE80211_CHAN_ANYC) {
908		cc->chan_to_mode =
909		    ieee80211_chan2mode(c);
910		if (IEEE80211_IS_CHAN_B(c))
911			cc->chan_is_b = 1;
912		if (IEEE80211_IS_CHAN_A(c))
913			cc->chan_is_a = 1;
914		if (IEEE80211_IS_CHAN_2GHZ(c))
915			cc->chan_is_2ghz = 1;
916		if (IEEE80211_IS_CHAN_5GHZ(c))
917			cc->chan_is_5ghz = 1;
918		if (IEEE80211_IS_CHAN_ANYG(c))
919			cc->chan_is_g = 1;
920	}
921}
922
923static void
924rum_config_copy(struct rum_softc *sc,
925    struct usb2_config_td_cc *cc, uint16_t refcount)
926{
927	struct ifnet *ifp;
928	struct ieee80211com *ic;
929	struct ieee80211_node *ni;
930	struct ieee80211vap *vap;
931	const struct ieee80211_txparam *tp;
932
933	bzero(cc, sizeof(*cc));
934
935	ifp = sc->sc_ifp;
936	if (ifp) {
937		cc->if_flags = ifp->if_flags;
938		bcopy(ifp->if_broadcastaddr, cc->if_broadcastaddr,
939		    sizeof(cc->if_broadcastaddr));
940
941		ic = ifp->if_l2com;
942		if (ic) {
943			rum_config_copy_chan(&cc->ic_curchan, ic, ic->ic_curchan);
944			rum_config_copy_chan(&cc->ic_bsschan, ic, ic->ic_bsschan);
945			vap = TAILQ_FIRST(&ic->ic_vaps);
946			if (vap) {
947				ni = vap->iv_bss;
948				if (ni) {
949					cc->iv_bss.ni_intval = ni->ni_intval;
950					bcopy(ni->ni_bssid, cc->iv_bss.ni_bssid,
951					    sizeof(cc->iv_bss.ni_bssid));
952				}
953				tp = vap->iv_txparms + cc->ic_bsschan.chan_to_mode;
954				if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
955					cc->iv_bss.fixed_rate_none = 1;
956				}
957			}
958			cc->ic_opmode = ic->ic_opmode;
959			cc->ic_flags = ic->ic_flags;
960			cc->ic_txpowlimit = ic->ic_txpowlimit;
961			cc->ic_curmode = ic->ic_curmode;
962
963			bcopy(ic->ic_myaddr, cc->ic_myaddr,
964			    sizeof(cc->ic_myaddr));
965		}
966	}
967	sc->sc_flags |= RUM_FLAG_WAIT_COMMAND;
968}
969
970static const char *
971rum_get_rf(uint32_t rev)
972{
973	;				/* indent fix */
974	switch (rev) {
975	case RT2573_RF_2527:
976		return "RT2527 (MIMO XR)";
977	case RT2573_RF_2528:
978		return "RT2528";
979	case RT2573_RF_5225:
980		return "RT5225 (MIMO XR)";
981	case RT2573_RF_5226:
982		return "RT5226";
983	default:
984		return "unknown";
985	}
986}
987
988static void
989rum_bulk_read_callback(struct usb2_xfer *xfer)
990{
991	struct rum_softc *sc = xfer->priv_sc;
992	struct ifnet *ifp = sc->sc_ifp;
993	struct ieee80211com *ic = ifp->if_l2com;
994	struct ieee80211_node *ni;
995
996	struct mbuf *m = NULL;
997	uint32_t flags;
998	uint32_t max_len;
999	uint8_t rssi = 0;
1000
1001	switch (USB_GET_STATE(xfer)) {
1002	case USB_ST_TRANSFERRED:
1003
1004		DPRINTFN(15, "rx done, actlen=%d\n", xfer->actlen);
1005
1006		if (xfer->actlen < (RT2573_RX_DESC_SIZE + IEEE80211_MIN_LEN)) {
1007			DPRINTF("too short transfer, "
1008			    "%d bytes\n", xfer->actlen);
1009			ifp->if_ierrors++;
1010			goto tr_setup;
1011		}
1012		usb2_copy_out(xfer->frbuffers, 0,
1013		    &sc->sc_rx_desc, RT2573_RX_DESC_SIZE);
1014
1015		flags = le32toh(sc->sc_rx_desc.flags);
1016
1017		if (flags & RT2573_RX_CRC_ERROR) {
1018			/*
1019		         * This should not happen since we did not
1020		         * request to receive those frames when we
1021		         * filled RAL_TXRX_CSR2:
1022		         */
1023			DPRINTFN(6, "PHY or CRC error\n");
1024			ifp->if_ierrors++;
1025			goto tr_setup;
1026		}
1027		m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1028
1029		if (m == NULL) {
1030			DPRINTF("could not allocate mbuf\n");
1031			ifp->if_ierrors++;
1032			goto tr_setup;
1033		}
1034		max_len = (xfer->actlen - RT2573_RX_DESC_SIZE);
1035
1036		usb2_copy_out(xfer->frbuffers, RT2573_RX_DESC_SIZE,
1037		    m->m_data, max_len);
1038
1039		/* finalize mbuf */
1040		m->m_pkthdr.rcvif = ifp;
1041		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
1042
1043		if (m->m_len > max_len) {
1044			DPRINTF("invalid length in RX "
1045			    "descriptor, %u bytes, received %u bytes\n",
1046			    m->m_len, max_len);
1047			ifp->if_ierrors++;
1048			m_freem(m);
1049			m = NULL;
1050			goto tr_setup;
1051		}
1052		rssi = rum_get_rssi(sc, sc->sc_rx_desc.rssi);
1053
1054		DPRINTF("real length=%d bytes, rssi=%d\n", m->m_len, rssi);
1055
1056		if (bpf_peers_present(ifp->if_bpf)) {
1057			struct rum_rx_radiotap_header *tap = &sc->sc_rxtap;
1058
1059			tap->wr_flags = IEEE80211_RADIOTAP_F_FCS;
1060			tap->wr_rate = ieee80211_plcp2rate(sc->sc_rx_desc.rate,
1061			    (sc->sc_rx_desc.flags & htole32(RT2573_RX_OFDM)) ?
1062			    IEEE80211_T_OFDM : IEEE80211_T_CCK);
1063			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1064			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1065			tap->wr_antenna = sc->sc_rx_ant;
1066			tap->wr_antsignal = rssi;
1067
1068			bpf_mtap2(ifp->if_bpf, tap, sc->sc_rxtap_len, m);
1069		}
1070	case USB_ST_SETUP:
1071tr_setup:
1072
1073		if (sc->sc_flags & RUM_FLAG_READ_STALL) {
1074			usb2_transfer_start(sc->sc_xfer[RUM_BULK_CS_RD]);
1075		} else {
1076			xfer->frlengths[0] = xfer->max_data_length;
1077			usb2_start_hardware(xfer);
1078		}
1079
1080		/*
1081		 * At the end of a USB callback it is always safe to unlock
1082		 * the private mutex of a device! That is why we do the
1083		 * "ieee80211_input" here, and not some lines up!
1084		 */
1085		if (m) {
1086			mtx_unlock(&sc->sc_mtx);
1087
1088			ni = ieee80211_find_rxnode(ic, mtod(m, struct ieee80211_frame_min *));
1089			if (ni != NULL) {
1090				if (ieee80211_input(ni, m, rssi, RT2573_NOISE_FLOOR, 0)) {
1091					/* ignore */
1092				}
1093				/* node is no longer needed */
1094				ieee80211_free_node(ni);
1095			} else {
1096				if (ieee80211_input_all(ic, m, rssi, RT2573_NOISE_FLOOR, 0)) {
1097					/* ignore */
1098				}
1099			}
1100
1101			mtx_lock(&sc->sc_mtx);
1102		}
1103		return;
1104
1105	default:			/* Error */
1106		if (xfer->error != USB_ERR_CANCELLED) {
1107			/* try to clear stall first */
1108			sc->sc_flags |= RUM_FLAG_READ_STALL;
1109			usb2_transfer_start(sc->sc_xfer[RUM_BULK_CS_RD]);
1110		}
1111		return;
1112
1113	}
1114}
1115
1116static void
1117rum_bulk_read_clear_stall_callback(struct usb2_xfer *xfer)
1118{
1119	struct rum_softc *sc = xfer->priv_sc;
1120	struct usb2_xfer *xfer_other = sc->sc_xfer[RUM_BULK_DT_RD];
1121
1122	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1123		DPRINTF("stall cleared\n");
1124		sc->sc_flags &= ~RUM_FLAG_READ_STALL;
1125		usb2_transfer_start(xfer_other);
1126	}
1127}
1128
1129static uint8_t
1130rum_plcp_signal(uint16_t rate)
1131{
1132	;				/* indent fix */
1133	switch (rate) {
1134		/* CCK rates (NB: not IEEE std, device-specific) */
1135	case 2:
1136		return (0x0);
1137	case 4:
1138		return (0x1);
1139	case 11:
1140		return (0x2);
1141	case 22:
1142		return (0x3);
1143
1144		/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1145	case 12:
1146		return (0xb);
1147	case 18:
1148		return (0xf);
1149	case 24:
1150		return (0xa);
1151	case 36:
1152		return (0xe);
1153	case 48:
1154		return (0x9);
1155	case 72:
1156		return (0xd);
1157	case 96:
1158		return (0x8);
1159	case 108:
1160		return (0xc);
1161
1162		/* XXX unsupported/unknown rate */
1163	default:
1164		return (0xff);
1165	}
1166}
1167
1168/*
1169 * We assume that "m->m_pkthdr.rcvif" is pointing to the "ni" that
1170 * should be freed, when "rum_setup_desc_and_tx" is called.
1171 */
1172
1173static void
1174rum_setup_desc_and_tx(struct rum_softc *sc, struct mbuf *m, uint32_t flags,
1175    uint16_t xflags, uint16_t rate)
1176{
1177	struct ifnet *ifp = sc->sc_ifp;
1178	struct ieee80211com *ic = ifp->if_l2com;
1179	struct mbuf *mm;
1180	enum ieee80211_phytype phytype;
1181	uint16_t plcp_length;
1182	uint16_t len;
1183	uint8_t remainder;
1184	uint8_t is_beacon;
1185
1186	if (xflags & RT2573_TX_BEACON) {
1187		xflags &= ~RT2573_TX_BEACON;
1188		is_beacon = 1;
1189	} else {
1190		is_beacon = 0;
1191	}
1192
1193	if (sc->sc_tx_queue.ifq_len >= IFQ_MAXLEN) {
1194		/* free packet */
1195		rum_tx_freem(m);
1196		ifp->if_oerrors++;
1197		return;
1198	}
1199	if (!((sc->sc_flags & RUM_FLAG_LL_READY) &&
1200	    (sc->sc_flags & RUM_FLAG_HL_READY))) {
1201		/* free packet */
1202		rum_tx_freem(m);
1203		ifp->if_oerrors++;
1204		return;
1205	}
1206	if (rate < 2) {
1207		DPRINTF("rate < 2!\n");
1208
1209		/* avoid division by zero */
1210		rate = 2;
1211	}
1212	ic->ic_lastdata = ticks;
1213	if (bpf_peers_present(ifp->if_bpf)) {
1214		struct rum_tx_radiotap_header *tap = &sc->sc_txtap;
1215
1216		tap->wt_flags = 0;
1217		tap->wt_rate = rate;
1218		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1219		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1220		tap->wt_antenna = sc->sc_tx_ant;
1221
1222		bpf_mtap2(ifp->if_bpf, tap, sc->sc_txtap_len, m);
1223	}
1224	len = m->m_pkthdr.len;
1225
1226	flags |= RT2573_TX_VALID;
1227	flags |= (len << 16);
1228
1229	sc->sc_tx_desc.flags = htole32(flags);
1230	sc->sc_tx_desc.xflags = htole16(xflags);
1231
1232	sc->sc_tx_desc.wme = htole16(RT2573_QID(0) | RT2573_AIFSN(2) |
1233	    RT2573_LOGCWMIN(4) | RT2573_LOGCWMAX(10));
1234
1235	/* setup PLCP fields */
1236	sc->sc_tx_desc.plcp_signal = rum_plcp_signal(rate);
1237	sc->sc_tx_desc.plcp_service = 4;
1238
1239	len += IEEE80211_CRC_LEN;
1240
1241	phytype = ieee80211_rate2phytype(sc->sc_rates, rate);
1242
1243	if (phytype == IEEE80211_T_OFDM) {
1244		sc->sc_tx_desc.flags |= htole32(RT2573_TX_OFDM);
1245
1246		plcp_length = (len & 0xfff);
1247		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 6;
1248		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0x3f;
1249	} else {
1250		plcp_length = ((16 * len) + rate - 1) / rate;
1251		if (rate == 22) {
1252			remainder = (16 * len) % 22;
1253			if ((remainder != 0) && (remainder < 7)) {
1254				sc->sc_tx_desc.plcp_service |=
1255				    RT2573_PLCP_LENGEXT;
1256			}
1257		}
1258		sc->sc_tx_desc.plcp_length_hi = plcp_length >> 8;
1259		sc->sc_tx_desc.plcp_length_lo = plcp_length & 0xff;
1260
1261		if ((rate != 2) && (ic->ic_flags & IEEE80211_F_SHPREAMBLE)) {
1262			sc->sc_tx_desc.plcp_signal |= 0x08;
1263		}
1264	}
1265
1266	if (sizeof(sc->sc_tx_desc) > MHLEN) {
1267		DPRINTF("No room for header structure!\n");
1268		rum_tx_freem(m);
1269		return;
1270	}
1271	mm = m_gethdr(M_NOWAIT, MT_DATA);
1272	if (mm == NULL) {
1273		DPRINTF("Could not allocate header mbuf!\n");
1274		rum_tx_freem(m);
1275		return;
1276	}
1277	bcopy(&sc->sc_tx_desc, mm->m_data, sizeof(sc->sc_tx_desc));
1278	mm->m_len = sizeof(sc->sc_tx_desc);
1279	mm->m_next = m;
1280	mm->m_pkthdr.len = mm->m_len + m->m_pkthdr.len;
1281	mm->m_pkthdr.rcvif = NULL;
1282
1283	if (is_beacon) {
1284
1285		if (mm->m_pkthdr.len > sizeof(sc->sc_beacon_buf)) {
1286			DPRINTFN(0, "Truncating beacon"
1287			    ", %u bytes!\n", mm->m_pkthdr.len);
1288			mm->m_pkthdr.len = sizeof(sc->sc_beacon_buf);
1289		}
1290		m_copydata(mm, 0, mm->m_pkthdr.len, sc->sc_beacon_buf);
1291
1292		/* copy the first 24 bytes of Tx descriptor into NIC memory */
1293		rum_cfg_write_multi(sc, RT2573_HW_BEACON_BASE0,
1294		    sc->sc_beacon_buf, mm->m_pkthdr.len);
1295		rum_tx_freem(mm);
1296		return;
1297	}
1298	/* start write transfer, if not started */
1299	_IF_ENQUEUE(&sc->sc_tx_queue, mm);
1300
1301	usb2_transfer_start(sc->sc_xfer[RUM_BULK_DT_WR]);
1302}
1303
1304static void
1305rum_bulk_write_callback(struct usb2_xfer *xfer)
1306{
1307	struct rum_softc *sc = xfer->priv_sc;
1308	struct ifnet *ifp = sc->sc_ifp;
1309	struct mbuf *m;
1310	uint16_t temp_len;
1311	uint8_t align;
1312
1313	switch (USB_GET_STATE(xfer)) {
1314	case USB_ST_TRANSFERRED:
1315		DPRINTFN(11, "transfer complete\n");
1316
1317		ifp->if_opackets++;
1318
1319	case USB_ST_SETUP:
1320		if (sc->sc_flags & RUM_FLAG_WRITE_STALL) {
1321			usb2_transfer_start(sc->sc_xfer[RUM_BULK_CS_WR]);
1322			break;
1323		}
1324		if (sc->sc_flags & RUM_FLAG_WAIT_COMMAND) {
1325			/*
1326			 * don't send anything while a command is pending !
1327			 */
1328			break;
1329		}
1330		rum_fill_write_queue(sc);
1331
1332		_IF_DEQUEUE(&sc->sc_tx_queue, m);
1333
1334		if (m) {
1335
1336			if (m->m_pkthdr.len > (MCLBYTES + RT2573_TX_DESC_SIZE)) {
1337				DPRINTFN(0, "data overflow, %u bytes\n",
1338				    m->m_pkthdr.len);
1339				m->m_pkthdr.len = (MCLBYTES + RT2573_TX_DESC_SIZE);
1340			}
1341			usb2_m_copy_in(xfer->frbuffers, 0,
1342			    m, 0, m->m_pkthdr.len);
1343
1344			/* compute transfer length */
1345			temp_len = m->m_pkthdr.len;
1346
1347			/* make transfer length 32-bit aligned */
1348			align = (-(temp_len)) & 3;
1349
1350			/* check if we need to add four extra bytes */
1351			if (((temp_len + align) % 64) == 0) {
1352				align += 4;
1353			}
1354			/* check if we need to align length */
1355			if (align != 0) {
1356				/* zero the extra bytes */
1357				usb2_bzero(xfer->frbuffers, temp_len, align);
1358				temp_len += align;
1359			}
1360			DPRINTFN(11, "sending frame len=%u ferlen=%u\n",
1361			    m->m_pkthdr.len, temp_len);
1362
1363			xfer->frlengths[0] = temp_len;
1364			usb2_start_hardware(xfer);
1365
1366			/* free mbuf and node */
1367			rum_tx_freem(m);
1368
1369		}
1370		break;
1371
1372	default:			/* Error */
1373		DPRINTFN(11, "transfer error, %s\n",
1374		    usb2_errstr(xfer->error));
1375
1376		if (xfer->error != USB_ERR_CANCELLED) {
1377			/* try to clear stall first */
1378			sc->sc_flags |= RUM_FLAG_WRITE_STALL;
1379			usb2_transfer_start(sc->sc_xfer[RUM_BULK_CS_WR]);
1380		}
1381		ifp->if_oerrors++;
1382		break;
1383	}
1384}
1385
1386static void
1387rum_bulk_write_clear_stall_callback(struct usb2_xfer *xfer)
1388{
1389	struct rum_softc *sc = xfer->priv_sc;
1390	struct usb2_xfer *xfer_other = sc->sc_xfer[RUM_BULK_DT_WR];
1391
1392	if (usb2_clear_stall_callback(xfer, xfer_other)) {
1393		DPRINTF("stall cleared\n");
1394		sc->sc_flags &= ~RUM_FLAG_WRITE_STALL;
1395		usb2_transfer_start(xfer_other);
1396	}
1397}
1398
1399static void
1400rum_watchdog(void *arg)
1401{
1402	struct rum_softc *sc = arg;
1403
1404	mtx_assert(&sc->sc_mtx, MA_OWNED);
1405
1406	if (sc->sc_amrr_timer) {
1407		usb2_config_td_queue_command
1408		    (&sc->sc_config_td, NULL,
1409		    &rum_cfg_amrr_timeout, 0, 0);
1410	}
1411	usb2_callout_reset(&sc->sc_watchdog,
1412	    hz, &rum_watchdog, sc);
1413}
1414
1415static void
1416rum_init_cb(void *arg)
1417{
1418	struct rum_softc *sc = arg;
1419
1420	mtx_lock(&sc->sc_mtx);
1421	usb2_config_td_queue_command
1422	    (&sc->sc_config_td, &rum_cfg_pre_init,
1423	    &rum_cfg_init, 0, 0);
1424	mtx_unlock(&sc->sc_mtx);
1425}
1426
1427static int
1428rum_ioctl_cb(struct ifnet *ifp, u_long cmd, caddr_t data)
1429{
1430	struct rum_softc *sc = ifp->if_softc;
1431	struct ieee80211com *ic = ifp->if_l2com;
1432	int error;
1433
1434	switch (cmd) {
1435	case SIOCSIFFLAGS:
1436		mtx_lock(&sc->sc_mtx);
1437		if (ifp->if_flags & IFF_UP) {
1438			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1439				usb2_config_td_queue_command
1440				    (&sc->sc_config_td, &rum_cfg_pre_init,
1441				    &rum_cfg_init, 0, 0);
1442			}
1443		} else {
1444			if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
1445				usb2_config_td_queue_command
1446				    (&sc->sc_config_td, &rum_cfg_pre_stop,
1447				    &rum_cfg_stop, 0, 0);
1448			}
1449		}
1450		mtx_unlock(&sc->sc_mtx);
1451		error = 0;
1452		break;
1453
1454	case SIOCGIFMEDIA:
1455	case SIOCSIFMEDIA:
1456		error = ifmedia_ioctl(ifp, (void *)data, &ic->ic_media, cmd);
1457		break;
1458
1459	default:
1460		error = ether_ioctl(ifp, cmd, data);
1461	}
1462	return (error);
1463}
1464
1465static void
1466rum_start_cb(struct ifnet *ifp)
1467{
1468	struct rum_softc *sc = ifp->if_softc;
1469
1470	mtx_lock(&sc->sc_mtx);
1471	/* start write transfer, if not started */
1472	usb2_transfer_start(sc->sc_xfer[RUM_BULK_DT_WR]);
1473	mtx_unlock(&sc->sc_mtx);
1474}
1475
1476static void
1477rum_cfg_newstate(struct rum_softc *sc,
1478    struct usb2_config_td_cc *cc, uint16_t refcount)
1479{
1480	struct ifnet *ifp = sc->sc_ifp;
1481	struct ieee80211com *ic = ifp->if_l2com;
1482	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1483	struct rum_vap *uvp = RUM_VAP(vap);
1484	enum ieee80211_state ostate;
1485	enum ieee80211_state nstate;
1486	int arg;
1487
1488	ostate = vap->iv_state;
1489	nstate = sc->sc_ns_state;
1490	arg = sc->sc_ns_arg;
1491
1492	if (ostate == IEEE80211_S_INIT) {
1493		/* We are leaving INIT. TSF sync should be off. */
1494		rum_cfg_disable_tsf_sync(sc);
1495	}
1496	switch (nstate) {
1497	case IEEE80211_S_INIT:
1498		break;
1499
1500	case IEEE80211_S_RUN:
1501		rum_cfg_set_run(sc, cc);
1502		break;
1503
1504	default:
1505		break;
1506	}
1507
1508	mtx_unlock(&sc->sc_mtx);
1509	IEEE80211_LOCK(ic);
1510	uvp->newstate(vap, nstate, arg);
1511	if (vap->iv_newstate_cb != NULL)
1512		vap->iv_newstate_cb(vap, nstate, arg);
1513	IEEE80211_UNLOCK(ic);
1514	mtx_lock(&sc->sc_mtx);
1515}
1516
1517static int
1518rum_newstate_cb(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1519{
1520	struct rum_vap *uvp = RUM_VAP(vap);
1521	struct ieee80211com *ic = vap->iv_ic;
1522	struct rum_softc *sc = ic->ic_ifp->if_softc;
1523
1524	DPRINTF("setting new state: %d\n", nstate);
1525
1526	/* Special case - cannot defer this call and cannot block ! */
1527	if (nstate == IEEE80211_S_INIT) {
1528		/* stop timers */
1529		mtx_lock(&sc->sc_mtx);
1530		sc->sc_amrr_timer = 0;
1531		mtx_unlock(&sc->sc_mtx);
1532		return (uvp->newstate(vap, nstate, arg));
1533	}
1534	mtx_lock(&sc->sc_mtx);
1535	if (usb2_config_td_is_gone(&sc->sc_config_td)) {
1536		mtx_unlock(&sc->sc_mtx);
1537		return (0);		/* nothing to do */
1538	}
1539	/* store next state */
1540	sc->sc_ns_state = nstate;
1541	sc->sc_ns_arg = arg;
1542
1543	/* stop timers */
1544	sc->sc_amrr_timer = 0;
1545
1546	/*
1547	 * USB configuration can only be done from the USB configuration
1548	 * thread:
1549	 */
1550	usb2_config_td_queue_command
1551	    (&sc->sc_config_td, &rum_config_copy,
1552	    &rum_cfg_newstate, 0, 0);
1553
1554	mtx_unlock(&sc->sc_mtx);
1555
1556	return (EINPROGRESS);
1557}
1558
1559static void
1560rum_std_command(struct ieee80211com *ic, usb2_config_td_command_t *func)
1561{
1562	struct rum_softc *sc = ic->ic_ifp->if_softc;
1563
1564	mtx_lock(&sc->sc_mtx);
1565
1566	sc->sc_rates = ieee80211_get_ratetable(ic->ic_curchan);
1567
1568	usb2_config_td_queue_command
1569	    (&sc->sc_config_td, &rum_config_copy, func, 0, 0);
1570
1571	mtx_unlock(&sc->sc_mtx);
1572}
1573
1574static void
1575rum_scan_start_cb(struct ieee80211com *ic)
1576{
1577	rum_std_command(ic, &rum_cfg_scan_start);
1578}
1579
1580static void
1581rum_scan_end_cb(struct ieee80211com *ic)
1582{
1583	rum_std_command(ic, &rum_cfg_scan_end);
1584}
1585
1586static void
1587rum_set_channel_cb(struct ieee80211com *ic)
1588{
1589	rum_std_command(ic, &rum_cfg_set_chan);
1590}
1591
1592static void
1593rum_cfg_scan_start(struct rum_softc *sc,
1594    struct usb2_config_td_cc *cc, uint16_t refcount)
1595{
1596	/* abort TSF synchronization */
1597	rum_cfg_disable_tsf_sync(sc);
1598	rum_cfg_set_bssid(sc, cc->if_broadcastaddr);
1599}
1600
1601static void
1602rum_cfg_scan_end(struct rum_softc *sc,
1603    struct usb2_config_td_cc *cc, uint16_t refcount)
1604{
1605	/* enable TSF synchronization */
1606	rum_cfg_enable_tsf_sync(sc, cc, 0);
1607	rum_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1608}
1609
1610/*
1611 * Reprogram MAC/BBP to switch to a new band. Values taken from the reference
1612 * driver.
1613 */
1614static void
1615rum_cfg_select_band(struct rum_softc *sc,
1616    struct usb2_config_td_cc *cc, uint16_t refcount)
1617{
1618	uint32_t tmp;
1619	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1620
1621	/* update all BBP registers that depend on the band */
1622	bbp17 = 0x20;
1623	bbp96 = 0x48;
1624	bbp104 = 0x2c;
1625	bbp35 = 0x50;
1626	bbp97 = 0x48;
1627	bbp98 = 0x48;
1628
1629	if (cc->ic_curchan.chan_is_5ghz) {
1630		bbp17 += 0x08;
1631		bbp96 += 0x10;
1632		bbp104 += 0x0c;
1633		bbp35 += 0x10;
1634		bbp97 += 0x10;
1635		bbp98 += 0x10;
1636	}
1637	if ((cc->ic_curchan.chan_is_2ghz && sc->sc_ext_2ghz_lna) ||
1638	    (cc->ic_curchan.chan_is_5ghz && sc->sc_ext_5ghz_lna)) {
1639		bbp17 += 0x10;
1640		bbp96 += 0x10;
1641		bbp104 += 0x10;
1642	}
1643	sc->sc_bbp17 = bbp17;
1644	rum_cfg_bbp_write(sc, 17, bbp17);
1645	rum_cfg_bbp_write(sc, 96, bbp96);
1646	rum_cfg_bbp_write(sc, 104, bbp104);
1647
1648	if ((cc->ic_curchan.chan_is_2ghz && sc->sc_ext_2ghz_lna) ||
1649	    (cc->ic_curchan.chan_is_5ghz && sc->sc_ext_5ghz_lna)) {
1650		rum_cfg_bbp_write(sc, 75, 0x80);
1651		rum_cfg_bbp_write(sc, 86, 0x80);
1652		rum_cfg_bbp_write(sc, 88, 0x80);
1653	}
1654	rum_cfg_bbp_write(sc, 35, bbp35);
1655	rum_cfg_bbp_write(sc, 97, bbp97);
1656	rum_cfg_bbp_write(sc, 98, bbp98);
1657
1658	tmp = rum_cfg_read(sc, RT2573_PHY_CSR0);
1659	tmp &= ~(RT2573_PA_PE_2GHZ | RT2573_PA_PE_5GHZ);
1660	if (cc->ic_curchan.chan_is_2ghz)
1661		tmp |= RT2573_PA_PE_2GHZ;
1662	else
1663		tmp |= RT2573_PA_PE_5GHZ;
1664	rum_cfg_write(sc, RT2573_PHY_CSR0, tmp);
1665
1666	/* 802.11a uses a 16 microseconds short interframe space */
1667	sc->sc_sifs = cc->ic_curchan.chan_is_5ghz ? 16 : 10;
1668}
1669
1670static void
1671rum_cfg_set_chan(struct rum_softc *sc,
1672    struct usb2_config_td_cc *cc, uint16_t refcount)
1673{
1674	enum {
1675	N_RF5225 = (sizeof(rum_rf5225) / sizeof(rum_rf5225[0]))};
1676	const struct rfprog *rfprog;
1677	uint32_t chan;
1678	uint16_t i;
1679	uint8_t bbp3;
1680	uint8_t bbp94 = RT2573_BBPR94_DEFAULT;
1681	int8_t power;
1682
1683	chan = cc->ic_curchan.chan_to_ieee;
1684
1685	if ((chan == 0) ||
1686	    (chan == IEEE80211_CHAN_ANY)) {
1687		/* nothing to do */
1688		return;
1689	}
1690	if (chan == sc->sc_last_chan) {
1691		return;
1692	}
1693	sc->sc_last_chan = chan;
1694
1695	/* select the appropriate RF settings based on what EEPROM says */
1696	rfprog = ((sc->sc_rf_rev == RT2573_RF_5225) ||
1697	    (sc->sc_rf_rev == RT2573_RF_2527)) ? rum_rf5225 : rum_rf5226;
1698
1699	/* find the settings for this channel */
1700	for (i = 0;; i++) {
1701		if (i == (N_RF5225 - 1))
1702			break;
1703		if (rfprog[i].chan == chan)
1704			break;
1705	}
1706
1707	DPRINTF("chan=%d, i=%d\n", chan, i);
1708
1709	power = sc->sc_txpow[i];
1710	if (power < 0) {
1711		bbp94 += power;
1712		power = 0;
1713	} else if (power > 31) {
1714		bbp94 += power - 31;
1715		power = 31;
1716	}
1717	/*
1718	 * If we are switching from the 2GHz band to the 5GHz band or
1719	 * vice-versa, BBP registers need to be reprogrammed.
1720	 */
1721	rum_cfg_select_band(sc, cc, 0);
1722	rum_cfg_select_antenna(sc, cc, 0);
1723
1724	rum_cfg_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1725	rum_cfg_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1726	rum_cfg_rf_write(sc, RT2573_RF3, rfprog[i].r3 | (power << 7));
1727	rum_cfg_rf_write(sc, RT2573_RF4, rfprog[i].r4 | (sc->sc_rffreq << 10));
1728
1729	rum_cfg_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1730	rum_cfg_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1731	rum_cfg_rf_write(sc, RT2573_RF3, rfprog[i].r3 | (power << 7) | 1);
1732	rum_cfg_rf_write(sc, RT2573_RF4, rfprog[i].r4 | (sc->sc_rffreq << 10));
1733
1734	rum_cfg_rf_write(sc, RT2573_RF1, rfprog[i].r1);
1735	rum_cfg_rf_write(sc, RT2573_RF2, rfprog[i].r2);
1736	rum_cfg_rf_write(sc, RT2573_RF3, rfprog[i].r3 | (power << 7));
1737	rum_cfg_rf_write(sc, RT2573_RF4, rfprog[i].r4 | (sc->sc_rffreq << 10));
1738
1739	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1740		return;
1741	}
1742	/* enable smart mode for MIMO-capable RFs */
1743	bbp3 = rum_cfg_bbp_read(sc, 3);
1744
1745	if ((sc->sc_rf_rev == RT2573_RF_5225) ||
1746	    (sc->sc_rf_rev == RT2573_RF_2527))
1747		bbp3 &= ~RT2573_SMART_MODE;
1748	else
1749		bbp3 |= RT2573_SMART_MODE;
1750
1751	rum_cfg_bbp_write(sc, 3, bbp3);
1752
1753	rum_cfg_bbp_write(sc, 94, bbp94);
1754
1755	/* update basic rate set */
1756
1757	if (cc->ic_curchan.chan_is_b) {
1758		/* 11b basic rates: 1, 2Mbps */
1759		rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x3);
1760	} else if (cc->ic_curchan.chan_is_a) {
1761		/* 11a basic rates: 6, 12, 24Mbps */
1762		rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x150);
1763	} else {
1764		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1765		rum_cfg_write(sc, RT2573_TXRX_CSR5, 0xf);
1766	}
1767
1768	if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
1769		return;
1770	}
1771}
1772
1773static void
1774rum_cfg_set_run(struct rum_softc *sc,
1775    struct usb2_config_td_cc *cc)
1776{
1777
1778	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1779		rum_cfg_update_slot(sc, cc, 0);
1780		rum_cfg_enable_mrr(sc, cc, 0);
1781		rum_cfg_set_txpreamble(sc, cc, 0);
1782
1783		/* update basic rate set */
1784
1785		if (cc->ic_bsschan.chan_is_5ghz) {
1786			/* 11a basic rates: 6, 12, 24Mbps */
1787			rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x150);
1788		} else if (cc->ic_bsschan.chan_is_g) {
1789			/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
1790			rum_cfg_write(sc, RT2573_TXRX_CSR5, 0xf);
1791		} else {
1792			/* 11b basic rates: 1, 2Mbps */
1793			rum_cfg_write(sc, RT2573_TXRX_CSR5, 0x3);
1794		}
1795		rum_cfg_set_bssid(sc, cc->iv_bss.ni_bssid);
1796	}
1797	if ((cc->ic_opmode == IEEE80211_M_HOSTAP) ||
1798	    (cc->ic_opmode == IEEE80211_M_IBSS)) {
1799		rum_cfg_prepare_beacon(sc, cc, 0);
1800	}
1801	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
1802		rum_cfg_enable_tsf_sync(sc, cc, 0);
1803	}
1804	if (cc->iv_bss.fixed_rate_none) {
1805		/* enable automatic rate adaptation */
1806		rum_cfg_amrr_start(sc);
1807	}
1808}
1809
1810static void
1811rum_cfg_enable_tsf_sync(struct rum_softc *sc,
1812    struct usb2_config_td_cc *cc, uint16_t refcount)
1813{
1814	uint32_t tmp;
1815
1816	if (cc->ic_opmode != IEEE80211_M_STA) {
1817		/*
1818		 * Change default 16ms TBTT adjustment to 8ms.
1819		 * Must be done before enabling beacon generation.
1820		 */
1821		rum_cfg_write(sc, RT2573_TXRX_CSR10, (1 << 12) | 8);
1822	}
1823	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR9) & 0xff000000;
1824
1825	/* set beacon interval (in 1/16ms unit) */
1826	tmp |= cc->iv_bss.ni_intval * 16;
1827
1828	tmp |= RT2573_TSF_TICKING | RT2573_ENABLE_TBTT;
1829	if (cc->ic_opmode == IEEE80211_M_STA)
1830		tmp |= RT2573_TSF_MODE(1);
1831	else
1832		tmp |= RT2573_TSF_MODE(2) | RT2573_GENERATE_BEACON;
1833
1834	rum_cfg_write(sc, RT2573_TXRX_CSR9, tmp);
1835}
1836
1837static void
1838rum_cfg_disable_tsf_sync(struct rum_softc *sc)
1839{
1840	uint32_t tmp;
1841
1842	/* abort TSF synchronization */
1843	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR9);
1844	rum_cfg_write(sc, RT2573_TXRX_CSR9, tmp & ~0x00ffffff);
1845}
1846
1847/*
1848 * Enable multi-rate retries for frames sent at OFDM rates.
1849 * In 802.11b/g mode, allow fallback to CCK rates.
1850 */
1851static void
1852rum_cfg_enable_mrr(struct rum_softc *sc,
1853    struct usb2_config_td_cc *cc, uint16_t refcount)
1854{
1855	uint32_t tmp;
1856
1857	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR4);
1858
1859	if (cc->ic_curchan.chan_is_5ghz)
1860		tmp &= ~RT2573_MRR_CCK_FALLBACK;
1861	else
1862		tmp |= RT2573_MRR_CCK_FALLBACK;
1863
1864	tmp |= RT2573_MRR_ENABLED;
1865
1866	rum_cfg_write(sc, RT2573_TXRX_CSR4, tmp);
1867}
1868
1869static void
1870rum_cfg_update_slot(struct rum_softc *sc,
1871    struct usb2_config_td_cc *cc, uint16_t refcount)
1872{
1873	uint32_t tmp;
1874	uint8_t slottime;
1875
1876	slottime = (cc->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
1877
1878	tmp = rum_cfg_read(sc, RT2573_MAC_CSR9);
1879	tmp = (tmp & ~0xff) | slottime;
1880	rum_cfg_write(sc, RT2573_MAC_CSR9, tmp);
1881
1882	DPRINTF("setting slot time to %u us\n", slottime);
1883}
1884
1885static void
1886rum_cfg_set_txpreamble(struct rum_softc *sc,
1887    struct usb2_config_td_cc *cc, uint16_t refcount)
1888{
1889	uint32_t tmp;
1890
1891	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR4);
1892
1893	if (cc->ic_flags & IEEE80211_F_SHPREAMBLE)
1894		tmp |= RT2573_SHORT_PREAMBLE;
1895	else
1896		tmp &= ~RT2573_SHORT_PREAMBLE;
1897
1898	rum_cfg_write(sc, RT2573_TXRX_CSR4, tmp);
1899}
1900
1901static void
1902rum_cfg_set_bssid(struct rum_softc *sc, uint8_t *bssid)
1903{
1904	uint32_t tmp;
1905
1906	tmp = bssid[0] | (bssid[1] << 8) | (bssid[2] << 16) | (bssid[3] << 24);
1907	rum_cfg_write(sc, RT2573_MAC_CSR4, tmp);
1908
1909	tmp = (bssid[4]) | (bssid[5] << 8) | (RT2573_ONE_BSSID << 16);
1910	rum_cfg_write(sc, RT2573_MAC_CSR5, tmp);
1911}
1912
1913static void
1914rum_cfg_set_macaddr(struct rum_softc *sc, uint8_t *addr)
1915{
1916	uint32_t tmp;
1917
1918	tmp = addr[0] | (addr[1] << 8) | (addr[2] << 16) | (addr[3] << 24);
1919	rum_cfg_write(sc, RT2573_MAC_CSR2, tmp);
1920
1921	tmp = addr[4] | (addr[5] << 8) | (0xff << 16);
1922	rum_cfg_write(sc, RT2573_MAC_CSR3, tmp);
1923}
1924
1925static void
1926rum_cfg_update_promisc(struct rum_softc *sc,
1927    struct usb2_config_td_cc *cc, uint16_t refcount)
1928{
1929	uint32_t tmp;
1930
1931	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0);
1932
1933	if (cc->if_flags & IFF_PROMISC)
1934		tmp &= ~RT2573_DROP_NOT_TO_ME;
1935	else
1936		tmp |= RT2573_DROP_NOT_TO_ME;
1937
1938	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp);
1939
1940	DPRINTF("%s promiscuous mode\n",
1941	    (cc->if_flags & IFF_PROMISC) ?
1942	    "entering" : "leaving");
1943}
1944
1945static void
1946rum_cfg_select_antenna(struct rum_softc *sc,
1947    struct usb2_config_td_cc *cc, uint16_t refcount)
1948{
1949	uint32_t tmp;
1950	uint8_t bbp3;
1951	uint8_t bbp4;
1952	uint8_t bbp77;
1953	uint8_t rx_ant;
1954	uint8_t is_5ghz;
1955
1956	bbp3 = rum_cfg_bbp_read(sc, 3);
1957	bbp4 = rum_cfg_bbp_read(sc, 4);
1958	bbp77 = rum_cfg_bbp_read(sc, 77);
1959
1960	bbp3 &= ~0x01;
1961	bbp4 &= ~0x23;
1962
1963	rx_ant = sc->sc_rx_ant;
1964	is_5ghz = cc->ic_curchan.chan_is_5ghz;
1965
1966	switch (sc->sc_rf_rev) {
1967	case RT2573_RF_5226:
1968	case RT2573_RF_5225:
1969		if (rx_ant == 0) {
1970			/* Diversity */
1971			bbp4 |= 0x02;
1972			if (is_5ghz == 0)
1973				bbp4 |= 0x20;
1974		} else if (rx_ant == 1) {
1975			/* RX: Antenna A */
1976			bbp4 |= 0x01;
1977			if (is_5ghz)
1978				bbp77 &= ~0x03;
1979			else
1980				bbp77 |= 0x03;
1981		} else if (rx_ant == 2) {
1982			/* RX: Antenna B */
1983			bbp4 |= 0x01;
1984			if (is_5ghz)
1985				bbp77 |= 0x03;
1986			else
1987				bbp77 &= ~0x03;
1988		}
1989		break;
1990
1991	case RT2573_RF_2528:
1992	case RT2573_RF_2527:
1993		if (rx_ant == 0) {
1994			/* Diversity */
1995			bbp4 |= 0x22;
1996		} else if (rx_ant == 1) {
1997			/* RX: Antenna A */
1998			bbp4 |= 0x21;
1999			bbp77 |= 0x03;
2000		} else if (rx_ant == 2) {
2001			/* RX: Antenna B */
2002			bbp4 |= 0x21;
2003			bbp77 &= ~0x03;
2004		}
2005		break;
2006	default:
2007		break;
2008	}
2009	bbp4 &= ~(sc->sc_ftype << 5);
2010
2011	/* make sure Rx is disabled before switching antenna */
2012	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0);
2013	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2014
2015	rum_cfg_bbp_write(sc, 3, bbp3);
2016	rum_cfg_bbp_write(sc, 4, bbp4);
2017	rum_cfg_bbp_write(sc, 77, bbp77);
2018
2019	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp);
2020}
2021
2022static void
2023rum_cfg_read_eeprom(struct rum_softc *sc)
2024{
2025	uint16_t val;
2026
2027	/* read MAC address */
2028	rum_cfg_eeprom_read(sc, RT2573_EEPROM_ADDRESS, sc->sc_myaddr, 6);
2029
2030	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_ANTENNA);
2031	sc->sc_rf_rev = (val >> 11) & 0x1f;
2032	sc->sc_hw_radio = (val >> 10) & 0x1;
2033	sc->sc_ftype = (val >> 6) & 0x1;
2034	sc->sc_rx_ant = (val >> 4) & 0x3;
2035	sc->sc_tx_ant = (val >> 2) & 0x3;
2036	sc->sc_nb_ant = (val & 0x3);
2037
2038	DPRINTF("RF revision=%d\n", sc->sc_rf_rev);
2039
2040	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_CONFIG2);
2041	sc->sc_ext_5ghz_lna = (val >> 6) & 0x1;
2042	sc->sc_ext_2ghz_lna = (val >> 4) & 0x1;
2043
2044	DPRINTF("External 2GHz LNA=%d, External 5GHz LNA=%d\n",
2045	    sc->sc_ext_2ghz_lna, sc->sc_ext_5ghz_lna);
2046
2047	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_RSSI_2GHZ_OFFSET);
2048	if ((val & 0xff) != 0xff)
2049		sc->sc_rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
2050	else
2051		sc->sc_rssi_2ghz_corr = 0;
2052
2053	/* range check */
2054	if ((sc->sc_rssi_2ghz_corr < -10) ||
2055	    (sc->sc_rssi_2ghz_corr > 10)) {
2056		sc->sc_rssi_2ghz_corr = 0;
2057	}
2058	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_RSSI_5GHZ_OFFSET);
2059	if ((val & 0xff) != 0xff)
2060		sc->sc_rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2061	else
2062		sc->sc_rssi_5ghz_corr = 0;
2063
2064	/* range check */
2065	if ((sc->sc_rssi_5ghz_corr < -10) ||
2066	    (sc->sc_rssi_5ghz_corr > 10)) {
2067		sc->sc_rssi_5ghz_corr = 0;
2068	}
2069	if (sc->sc_ext_2ghz_lna) {
2070		sc->sc_rssi_2ghz_corr -= 14;
2071	}
2072	if (sc->sc_ext_5ghz_lna) {
2073		sc->sc_rssi_5ghz_corr -= 14;
2074	}
2075	DPRINTF("RSSI 2GHz corr=%d, RSSI 5GHz corr=%d\n",
2076	    sc->sc_rssi_2ghz_corr, sc->sc_rssi_5ghz_corr);
2077
2078	val = rum_cfg_eeprom_read_2(sc, RT2573_EEPROM_FREQ_OFFSET);
2079	if ((val & 0xff) != 0xff)
2080		sc->sc_rffreq = (val & 0xff);
2081	else
2082		sc->sc_rffreq = 0;
2083
2084	DPRINTF("RF freq=%d\n", sc->sc_rffreq);
2085
2086	/* read Tx power for all a/b/g channels */
2087	rum_cfg_eeprom_read(sc, RT2573_EEPROM_TXPOWER, sc->sc_txpow, 14);
2088
2089	/* XXX default Tx power for 802.11a channels */
2090	memset(sc->sc_txpow + 14, 24, sizeof(sc->sc_txpow) - 14);
2091
2092	/* read default values for BBP registers */
2093	rum_cfg_eeprom_read(sc, RT2573_EEPROM_BBP_BASE, sc->sc_bbp_prom, 2 * 16);
2094}
2095
2096static uint8_t
2097rum_cfg_bbp_init(struct rum_softc *sc)
2098{
2099	enum {
2100		N_DEF_BBP = (sizeof(rum_def_bbp) / sizeof(rum_def_bbp[0])),
2101	};
2102	uint16_t i;
2103	uint8_t to;
2104	uint8_t tmp;
2105
2106	/* wait for BBP to become ready */
2107	for (to = 0;; to++) {
2108		if (to < 100) {
2109			tmp = rum_cfg_bbp_read(sc, 0);
2110			if ((tmp != 0x00) &&
2111			    (tmp != 0xff)) {
2112				break;
2113			}
2114			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2115				return (1);	/* failure */
2116			}
2117		} else {
2118			DPRINTF("timeout waiting for BBP\n");
2119			return (1);	/* failure */
2120		}
2121	}
2122
2123	/* initialize BBP registers to default values */
2124	for (i = 0; i < N_DEF_BBP; i++) {
2125		rum_cfg_bbp_write(sc, rum_def_bbp[i].reg, rum_def_bbp[i].val);
2126	}
2127
2128	/* write vendor-specific BBP values (from EEPROM) */
2129	for (i = 0; i < 16; i++) {
2130		if ((sc->sc_bbp_prom[i].reg == 0) ||
2131		    (sc->sc_bbp_prom[i].reg == 0xff)) {
2132			continue;
2133		}
2134		rum_cfg_bbp_write(sc, sc->sc_bbp_prom[i].reg, sc->sc_bbp_prom[i].val);
2135	}
2136	return (0);
2137}
2138
2139static void
2140rum_cfg_pre_init(struct rum_softc *sc,
2141    struct usb2_config_td_cc *cc, uint16_t refcount)
2142{
2143	struct ifnet *ifp = sc->sc_ifp;
2144	struct ieee80211com *ic = ifp->if_l2com;
2145
2146	/* immediate configuration */
2147
2148	rum_cfg_pre_stop(sc, cc, 0);
2149
2150	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2151
2152	sc->sc_flags |= RUM_FLAG_HL_READY;
2153
2154	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2155}
2156
2157static void
2158rum_cfg_init(struct rum_softc *sc,
2159    struct usb2_config_td_cc *cc, uint16_t refcount)
2160{
2161	enum {
2162		N_DEF_MAC = (sizeof(rum_def_mac) / sizeof(rum_def_mac[0])),
2163	};
2164
2165	uint32_t tmp;
2166	uint16_t i;
2167	uint8_t to;
2168
2169	/* delayed configuration */
2170
2171	rum_cfg_stop(sc, cc, 0);
2172
2173	/* initialize MAC registers to default values */
2174	for (i = 0; i < N_DEF_MAC; i++) {
2175		rum_cfg_write(sc, rum_def_mac[i].reg, rum_def_mac[i].val);
2176	}
2177
2178	/* set host ready */
2179	rum_cfg_write(sc, RT2573_MAC_CSR1, 3);
2180	rum_cfg_write(sc, RT2573_MAC_CSR1, 0);
2181
2182	/* wait for BBP/RF to wakeup */
2183	for (to = 0;; to++) {
2184		if (to < 100) {
2185			if (rum_cfg_read(sc, RT2573_MAC_CSR12) & 8) {
2186				break;
2187			}
2188			rum_cfg_write(sc, RT2573_MAC_CSR12, 4);	/* force wakeup */
2189
2190			if (usb2_config_td_sleep(&sc->sc_config_td, hz / 100)) {
2191				goto fail;
2192			}
2193		} else {
2194			DPRINTF("timeout waiting for "
2195			    "BBP/RF to wakeup\n");
2196			goto fail;
2197		}
2198	}
2199
2200	if (rum_cfg_bbp_init(sc)) {
2201		goto fail;
2202	}
2203	/* select default channel */
2204
2205	sc->sc_last_chan = 0;
2206
2207	rum_cfg_set_chan(sc, cc, 0);
2208
2209	/* clear STA registers */
2210	rum_cfg_read_multi(sc, RT2573_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2211	/* set MAC address */
2212	rum_cfg_set_macaddr(sc, cc->ic_myaddr);
2213
2214	/* initialize ASIC */
2215	rum_cfg_write(sc, RT2573_MAC_CSR1, 4);
2216
2217	/*
2218	 * make sure that the first transaction
2219	 * clears the stall:
2220	 */
2221	sc->sc_flags |= (RUM_FLAG_READ_STALL |
2222	    RUM_FLAG_WRITE_STALL |
2223	    RUM_FLAG_LL_READY);
2224
2225	if ((sc->sc_flags & RUM_FLAG_LL_READY) &&
2226	    (sc->sc_flags & RUM_FLAG_HL_READY)) {
2227		struct ifnet *ifp = sc->sc_ifp;
2228		struct ieee80211com *ic = ifp->if_l2com;
2229
2230		/*
2231		 * start the USB transfers, if not already started:
2232		 */
2233		usb2_transfer_start(sc->sc_xfer[RUM_BULK_DT_RD]);
2234		usb2_transfer_start(sc->sc_xfer[RUM_BULK_DT_WR]);
2235
2236		/*
2237		 * start IEEE802.11 layer
2238		 */
2239		mtx_unlock(&sc->sc_mtx);
2240		ieee80211_start_all(ic);
2241		mtx_lock(&sc->sc_mtx);
2242	}
2243	/* update Rx filter */
2244	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0) & 0xffff;
2245
2246	tmp |= RT2573_DROP_PHY_ERROR | RT2573_DROP_CRC_ERROR;
2247
2248	if (cc->ic_opmode != IEEE80211_M_MONITOR) {
2249		tmp |= RT2573_DROP_CTL | RT2573_DROP_VER_ERROR |
2250		    RT2573_DROP_ACKCTS;
2251		if (cc->ic_opmode != IEEE80211_M_HOSTAP) {
2252			tmp |= RT2573_DROP_TODS;
2253		}
2254		if (!(cc->if_flags & IFF_PROMISC)) {
2255			tmp |= RT2573_DROP_NOT_TO_ME;
2256		}
2257	}
2258	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp);
2259
2260	return;
2261
2262fail:
2263	rum_cfg_pre_stop(sc, NULL, 0);
2264
2265	if (cc) {
2266		rum_cfg_stop(sc, cc, 0);
2267	}
2268}
2269
2270static void
2271rum_cfg_pre_stop(struct rum_softc *sc,
2272    struct usb2_config_td_cc *cc, uint16_t refcount)
2273{
2274	struct ifnet *ifp = sc->sc_ifp;
2275
2276	if (cc) {
2277		/* copy the needed configuration */
2278		rum_config_copy(sc, cc, refcount);
2279	}
2280	/* immediate configuration */
2281
2282	if (ifp) {
2283		/* clear flags */
2284		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
2285	}
2286	sc->sc_flags &= ~(RUM_FLAG_HL_READY |
2287	    RUM_FLAG_LL_READY);
2288
2289	/*
2290	 * stop all the transfers, if not already stopped:
2291	 */
2292	usb2_transfer_stop(sc->sc_xfer[RUM_BULK_DT_WR]);
2293	usb2_transfer_stop(sc->sc_xfer[RUM_BULK_DT_RD]);
2294	usb2_transfer_stop(sc->sc_xfer[RUM_BULK_CS_WR]);
2295	usb2_transfer_stop(sc->sc_xfer[RUM_BULK_CS_RD]);
2296
2297	/* clean up transmission */
2298	rum_tx_clean_queue(sc);
2299}
2300
2301static void
2302rum_cfg_stop(struct rum_softc *sc,
2303    struct usb2_config_td_cc *cc, uint16_t refcount)
2304{
2305	uint32_t tmp;
2306
2307	/* disable Rx */
2308	tmp = rum_cfg_read(sc, RT2573_TXRX_CSR0);
2309	rum_cfg_write(sc, RT2573_TXRX_CSR0, tmp | RT2573_DISABLE_RX);
2310
2311	/* reset ASIC */
2312	rum_cfg_write(sc, RT2573_MAC_CSR1, 3);
2313
2314	/* wait a little */
2315	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2316
2317	rum_cfg_write(sc, RT2573_MAC_CSR1, 0);
2318
2319	/* wait a little */
2320	usb2_config_td_sleep(&sc->sc_config_td, hz / 10);
2321}
2322
2323static void
2324rum_cfg_amrr_start(struct rum_softc *sc)
2325{
2326	struct ieee80211vap *vap;
2327	struct ieee80211_node *ni;
2328
2329	vap = rum_get_vap(sc);
2330
2331	if (vap == NULL) {
2332		return;
2333	}
2334	ni = vap->iv_bss;
2335	if (ni == NULL) {
2336		return;
2337	}
2338	/* init AMRR */
2339
2340	ieee80211_amrr_node_init(&RUM_VAP(vap)->amrr, &RUM_NODE(ni)->amn, ni);
2341
2342	/* enable AMRR timer */
2343
2344	sc->sc_amrr_timer = 1;
2345}
2346
2347static void
2348rum_cfg_amrr_timeout(struct rum_softc *sc,
2349    struct usb2_config_td_cc *cc, uint16_t refcount)
2350{
2351	struct ifnet *ifp = sc->sc_ifp;
2352	struct ieee80211vap *vap;
2353	struct ieee80211_node *ni;
2354	uint32_t ok;
2355	uint32_t fail;
2356
2357	/* clear statistic registers (STA_CSR0 to STA_CSR5) */
2358	rum_cfg_read_multi(sc, RT2573_STA_CSR0, sc->sc_sta, sizeof(sc->sc_sta));
2359
2360	vap = rum_get_vap(sc);
2361	if (vap == NULL) {
2362		return;
2363	}
2364	ni = vap->iv_bss;
2365	if (ni == NULL) {
2366		return;
2367	}
2368	if ((sc->sc_flags & RUM_FLAG_LL_READY) &&
2369	    (sc->sc_flags & RUM_FLAG_HL_READY)) {
2370
2371		ok = (le32toh(sc->sc_sta[4]) >> 16) +	/* TX ok w/o retry */
2372		    (le32toh(sc->sc_sta[5]) & 0xffff);	/* TX ok w/ retry */
2373		fail = (le32toh(sc->sc_sta[5]) >> 16);	/* TX retry-fail count */
2374
2375		if (sc->sc_amrr_timer) {
2376			ieee80211_amrr_tx_update(&RUM_NODE(vap->iv_bss)->amn,
2377			    ok + fail, ok, (le32toh(sc->sc_sta[5]) & 0xffff) + fail);
2378
2379			if (ieee80211_amrr_choose(ni, &RUM_NODE(ni)->amn)) {
2380				/* ignore */
2381			}
2382		}
2383		ifp->if_oerrors += fail;/* count TX retry-fail as Tx errors */
2384	}
2385}
2386
2387static void
2388rum_cfg_load_microcode(struct rum_softc *sc, const uint8_t *ucode, uint16_t size)
2389{
2390	struct usb2_device_request req;
2391	uint16_t reg = RT2573_MCU_CODE_BASE;
2392
2393	/* copy firmware image into NIC */
2394	while (size >= 4) {
2395		rum_cfg_write(sc, reg, UGETDW(ucode));
2396		reg += 4;
2397		ucode += 4;
2398		size -= 4;
2399	}
2400
2401	if (size != 0) {
2402		DPRINTF("possibly invalid firmware\n");
2403	}
2404	req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
2405	req.bRequest = RT2573_MCU_CNTL;
2406	USETW(req.wValue, RT2573_MCU_RUN);
2407	USETW(req.wIndex, 0);
2408	USETW(req.wLength, 0);
2409
2410	rum_cfg_do_request(sc, &req, NULL);
2411}
2412
2413static void
2414rum_cfg_prepare_beacon(struct rum_softc *sc,
2415    struct usb2_config_td_cc *cc, uint16_t refcount)
2416{
2417	struct ieee80211_node *ni;
2418	struct ieee80211vap *vap;
2419	struct ieee80211com *ic;
2420	const struct ieee80211_txparam *tp;
2421	struct mbuf *m;
2422
2423	vap = rum_get_vap(sc);
2424	if (vap == NULL) {
2425		return;
2426	}
2427	ni = vap->iv_bss;
2428	if (ni == NULL) {
2429		return;
2430	}
2431	ic = vap->iv_ic;
2432	if (ic == NULL) {
2433		return;
2434	}
2435	DPRINTFN(11, "Sending beacon frame.\n");
2436
2437	m = ieee80211_beacon_alloc(ni, &RUM_VAP(vap)->bo);
2438	if (m == NULL) {
2439		DPRINTFN(0, "could not allocate beacon\n");
2440		return;
2441	}
2442	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_bsschan)];
2443
2444	m->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2445	rum_setup_desc_and_tx(sc, m, RT2573_TX_TIMESTAMP, RT2573_TX_HWSEQ | RT2573_TX_BEACON, tp->mgmtrate);
2446}
2447
2448static uint8_t
2449rum_get_rssi(struct rum_softc *sc, uint8_t raw)
2450{
2451	struct ifnet *ifp = sc->sc_ifp;
2452	struct ieee80211com *ic = ifp->if_l2com;
2453	int16_t rssi;
2454	uint8_t lna;
2455	uint8_t agc;
2456
2457	lna = (raw >> 5) & 0x3;
2458	agc = raw & 0x1f;
2459
2460	if (lna == 0) {
2461		/*
2462                 * No RSSI mapping
2463                 *
2464                 * NB: Since RSSI is relative to noise floor, -1 is
2465                 *     adequate for caller to know error happened.
2466                 */
2467		return (0);
2468	}
2469	rssi = (2 * agc) - RT2573_NOISE_FLOOR;
2470
2471	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan)) {
2472
2473		rssi += sc->sc_rssi_2ghz_corr;
2474
2475		if (lna == 1)
2476			rssi -= 64;
2477		else if (lna == 2)
2478			rssi -= 74;
2479		else if (lna == 3)
2480			rssi -= 90;
2481	} else {
2482
2483		rssi += sc->sc_rssi_5ghz_corr;
2484
2485		if ((!sc->sc_ext_5ghz_lna) && (lna != 1))
2486			rssi += 4;
2487
2488		if (lna == 1)
2489			rssi -= 64;
2490		else if (lna == 2)
2491			rssi -= 86;
2492		else if (lna == 3)
2493			rssi -= 100;
2494	}
2495
2496	/* range check */
2497
2498	if (rssi < 0)
2499		rssi = 0;
2500	else if (rssi > 255)
2501		rssi = 255;
2502
2503	return (rssi);
2504}
2505
2506static struct ieee80211vap *
2507rum_vap_create(struct ieee80211com *ic,
2508    const char name[IFNAMSIZ], int unit, int opmode, int flags,
2509    const uint8_t bssid[IEEE80211_ADDR_LEN],
2510    const uint8_t mac[IEEE80211_ADDR_LEN])
2511{
2512	struct rum_vap *rvp;
2513	struct ieee80211vap *vap;
2514	struct rum_softc *sc = ic->ic_ifp->if_softc;
2515
2516	DPRINTF("\n");
2517
2518	/* Need to sync with config thread: */
2519	mtx_lock(&sc->sc_mtx);
2520	if (usb2_config_td_sync(&sc->sc_config_td)) {
2521		mtx_unlock(&sc->sc_mtx);
2522		/* config thread is gone */
2523		return (NULL);
2524	}
2525	mtx_unlock(&sc->sc_mtx);
2526
2527	if (!TAILQ_EMPTY(&ic->ic_vaps))	/* only one at a time */
2528		return NULL;
2529	rvp = (struct rum_vap *)malloc(sizeof(struct rum_vap),
2530	    M_80211_VAP, M_NOWAIT | M_ZERO);
2531	if (rvp == NULL)
2532		return NULL;
2533	vap = &rvp->vap;
2534	/* enable s/w bmiss handling for sta mode */
2535	ieee80211_vap_setup(ic, vap, name, unit, opmode,
2536	    flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
2537
2538	/* override state transition machine */
2539	rvp->newstate = vap->iv_newstate;
2540	vap->iv_newstate = &rum_newstate_cb;
2541
2542	ieee80211_amrr_init(&rvp->amrr, vap,
2543	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
2544	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
2545	    1000 /* 1 sec */ );
2546
2547	/* complete setup */
2548	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
2549
2550	/* store current operation mode */
2551	ic->ic_opmode = opmode;
2552
2553	return (vap);
2554}
2555
2556static void
2557rum_vap_delete(struct ieee80211vap *vap)
2558{
2559	struct rum_vap *rvp = RUM_VAP(vap);
2560	struct rum_softc *sc = vap->iv_ic->ic_ifp->if_softc;
2561
2562	DPRINTF("\n");
2563
2564	/* Need to sync with config thread: */
2565	mtx_lock(&sc->sc_mtx);
2566	if (usb2_config_td_sync(&sc->sc_config_td)) {
2567		/* ignore */
2568	}
2569	mtx_unlock(&sc->sc_mtx);
2570
2571	ieee80211_amrr_cleanup(&rvp->amrr);
2572	ieee80211_vap_detach(vap);
2573	free(rvp, M_80211_VAP);
2574}
2575
2576/* ARGUSED */
2577static struct ieee80211_node *
2578rum_node_alloc(struct ieee80211vap *vap __unused,
2579    const uint8_t mac[IEEE80211_ADDR_LEN] __unused)
2580{
2581	struct rum_node *rn;
2582
2583	rn = malloc(sizeof(struct rum_node), M_80211_NODE, M_NOWAIT | M_ZERO);
2584	return ((rn != NULL) ? &rn->ni : NULL);
2585}
2586
2587static void
2588rum_newassoc(struct ieee80211_node *ni, int isnew)
2589{
2590	struct ieee80211vap *vap = ni->ni_vap;
2591
2592	ieee80211_amrr_node_init(&RUM_VAP(vap)->amrr, &RUM_NODE(ni)->amn, ni);
2593}
2594
2595static void
2596rum_fill_write_queue(struct rum_softc *sc)
2597{
2598	struct ifnet *ifp = sc->sc_ifp;
2599	struct ieee80211_node *ni;
2600	struct mbuf *m;
2601
2602	/*
2603	 * We only fill up half of the queue with data frames. The rest is
2604	 * reserved for other kinds of frames.
2605	 */
2606
2607	while (sc->sc_tx_queue.ifq_len < (IFQ_MAXLEN / 2)) {
2608
2609		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2610		if (m == NULL)
2611			break;
2612
2613		ni = (void *)(m->m_pkthdr.rcvif);
2614		m = ieee80211_encap(ni, m);
2615		if (m == NULL) {
2616			ieee80211_free_node(ni);
2617			continue;
2618		}
2619		rum_tx_data(sc, m, ni);
2620	}
2621}
2622
2623static void
2624rum_tx_clean_queue(struct rum_softc *sc)
2625{
2626	struct mbuf *m;
2627
2628	for (;;) {
2629		_IF_DEQUEUE(&sc->sc_tx_queue, m);
2630
2631		if (!m) {
2632			break;
2633		}
2634		rum_tx_freem(m);
2635	}
2636}
2637
2638static void
2639rum_tx_freem(struct mbuf *m)
2640{
2641	struct ieee80211_node *ni;
2642
2643	while (m) {
2644		ni = (void *)(m->m_pkthdr.rcvif);
2645		if (!ni) {
2646			m = m_free(m);
2647			continue;
2648		}
2649		if (m->m_flags & M_TXCB) {
2650			ieee80211_process_callback(ni, m, 0);
2651		}
2652		m_freem(m);
2653		ieee80211_free_node(ni);
2654
2655		break;
2656	}
2657}
2658
2659static void
2660rum_tx_mgt(struct rum_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2661{
2662	struct ieee80211vap *vap = ni->ni_vap;
2663	struct ieee80211com *ic = ni->ni_ic;
2664	const struct ieee80211_txparam *tp;
2665	struct ieee80211_frame *wh;
2666	struct ieee80211_key *k;
2667	uint32_t flags;
2668	uint16_t dur;
2669
2670	tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2671
2672	wh = mtod(m, struct ieee80211_frame *);
2673	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2674		k = ieee80211_crypto_encap(ni, m);
2675		if (k == NULL) {
2676			m_freem(m);
2677			ieee80211_free_node(ni);
2678			return;
2679		}
2680		wh = mtod(m, struct ieee80211_frame *);
2681	}
2682	flags = 0;
2683	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2684		flags |= RT2573_TX_NEED_ACK;
2685
2686		dur = ieee80211_ack_duration(sc->sc_rates, tp->mgmtrate,
2687		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2688		USETW(wh->i_dur, dur);
2689
2690		/* tell hardware to add timestamp for probe responses */
2691		if ((wh->i_fc[0] &
2692		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
2693		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
2694			flags |= RT2573_TX_TIMESTAMP;
2695	}
2696	m->m_pkthdr.rcvif = (void *)ni;
2697	rum_setup_desc_and_tx(sc, m, flags, 0, tp->mgmtrate);
2698}
2699
2700static struct ieee80211vap *
2701rum_get_vap(struct rum_softc *sc)
2702{
2703	struct ifnet *ifp;
2704	struct ieee80211com *ic;
2705
2706	if (sc == NULL) {
2707		return NULL;
2708	}
2709	ifp = sc->sc_ifp;
2710	if (ifp == NULL) {
2711		return NULL;
2712	}
2713	ic = ifp->if_l2com;
2714	if (ic == NULL) {
2715		return NULL;
2716	}
2717	return TAILQ_FIRST(&ic->ic_vaps);
2718}
2719
2720static void
2721rum_tx_data(struct rum_softc *sc, struct mbuf *m,
2722    struct ieee80211_node *ni)
2723{
2724	struct ieee80211vap *vap = ni->ni_vap;
2725	struct ieee80211com *ic = ni->ni_ic;
2726	const struct ieee80211_txparam *tp;
2727	struct ieee80211_frame *wh;
2728	struct ieee80211_key *k;
2729	uint32_t flags = 0;
2730	uint16_t dur;
2731	uint16_t rate;
2732
2733	DPRINTFN(11, "Sending data.\n");
2734
2735	wh = mtod(m, struct ieee80211_frame *);
2736
2737	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2738	if (IEEE80211_IS_MULTICAST(wh->i_addr1))
2739		rate = tp->mcastrate;
2740	else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
2741		rate = tp->ucastrate;
2742	else
2743		rate = ni->ni_txrate;
2744
2745	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
2746		k = ieee80211_crypto_encap(ni, m);
2747		if (k == NULL) {
2748			m_freem(m);
2749			ieee80211_free_node(ni);
2750			return;
2751		}
2752		/* packet header may have moved, reset our local pointer */
2753		wh = mtod(m, struct ieee80211_frame *);
2754	}
2755	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2756		uint8_t prot = IEEE80211_PROT_NONE;
2757
2758		if (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
2759			prot = IEEE80211_PROT_RTSCTS;
2760		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2761		    ieee80211_rate2phytype(sc->sc_rates, rate) == IEEE80211_T_OFDM)
2762			prot = ic->ic_protmode;
2763		if (prot != IEEE80211_PROT_NONE) {
2764			rum_tx_prot(sc, m, ni, prot, rate);
2765			flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
2766		}
2767		flags |= RT2573_TX_NEED_ACK;
2768		flags |= RT2573_TX_MORE_FRAG;
2769
2770		dur = ieee80211_ack_duration(sc->sc_rates, rate,
2771		    ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2772		USETW(wh->i_dur, dur);
2773	}
2774	m->m_pkthdr.rcvif = (void *)ni;
2775	rum_setup_desc_and_tx(sc, m, flags, 0, rate);
2776}
2777
2778static void
2779rum_tx_prot(struct rum_softc *sc,
2780    const struct mbuf *m, struct ieee80211_node *ni,
2781    uint8_t prot, uint16_t rate)
2782{
2783	struct ieee80211com *ic = ni->ni_ic;
2784	const struct ieee80211_frame *wh;
2785	struct mbuf *mprot;
2786	uint32_t flags;
2787	uint16_t protrate;
2788	uint16_t ackrate;
2789	uint16_t pktlen;
2790	uint16_t dur;
2791	uint8_t isshort;
2792
2793	KASSERT((prot == IEEE80211_PROT_RTSCTS) ||
2794	    (prot == IEEE80211_PROT_CTSONLY),
2795	    ("protection %u", prot));
2796
2797	DPRINTFN(11, "Sending protection frame.\n");
2798
2799	wh = mtod(m, const struct ieee80211_frame *);
2800	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2801
2802	protrate = ieee80211_ctl_rate(sc->sc_rates, rate);
2803	ackrate = ieee80211_ack_rate(sc->sc_rates, rate);
2804
2805	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2806	dur = ieee80211_compute_duration(sc->sc_rates, pktlen, rate, isshort);
2807	+ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2808	flags = RT2573_TX_MORE_FRAG;
2809	if (prot == IEEE80211_PROT_RTSCTS) {
2810		/* NB: CTS is the same size as an ACK */
2811		dur += ieee80211_ack_duration(sc->sc_rates, rate, isshort);
2812		flags |= RT2573_TX_NEED_ACK;
2813		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2814	} else {
2815		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2816	}
2817	if (mprot == NULL) {
2818		return;
2819	}
2820	mprot->m_pkthdr.rcvif = (void *)ieee80211_ref_node(ni);
2821	rum_setup_desc_and_tx(sc, mprot, flags, 0, protrate);
2822}
2823
2824static void
2825rum_tx_raw(struct rum_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2826    const struct ieee80211_bpf_params *params)
2827{
2828	uint32_t flags;
2829	uint16_t rate;
2830
2831	DPRINTFN(11, "Sending raw frame.\n");
2832
2833	rate = params->ibp_rate0 & IEEE80211_RATE_VAL;
2834
2835	/* XXX validate */
2836	if (rate == 0) {
2837		m_freem(m);
2838		ieee80211_free_node(ni);
2839		return;
2840	}
2841	flags = 0;
2842	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2843		flags |= RT2573_TX_NEED_ACK;
2844	if (params->ibp_flags & (IEEE80211_BPF_RTS | IEEE80211_BPF_CTS)) {
2845		rum_tx_prot(sc, m, ni,
2846		    params->ibp_flags & IEEE80211_BPF_RTS ?
2847		    IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2848		    rate);
2849		flags |= RT2573_TX_LONG_RETRY | RT2573_TX_IFS_SIFS;
2850	}
2851	m->m_pkthdr.rcvif = (void *)ni;
2852	rum_setup_desc_and_tx(sc, m, flags, 0, rate);
2853}
2854
2855static int
2856rum_raw_xmit_cb(struct ieee80211_node *ni, struct mbuf *m,
2857    const struct ieee80211_bpf_params *params)
2858{
2859	struct ieee80211com *ic = ni->ni_ic;
2860	struct ifnet *ifp = ic->ic_ifp;
2861	struct rum_softc *sc = ifp->if_softc;
2862
2863	mtx_lock(&sc->sc_mtx);
2864	if (params == NULL) {
2865		/*
2866		 * Legacy path; interpret frame contents to decide
2867		 * precisely how to send the frame.
2868		 */
2869		rum_tx_mgt(sc, m, ni);
2870	} else {
2871		/*
2872		 * Caller supplied explicit parameters to use in
2873		 * sending the frame.
2874		 */
2875		rum_tx_raw(sc, m, ni, params);
2876	}
2877	mtx_unlock(&sc->sc_mtx);
2878	return (0);
2879}
2880
2881static void
2882rum_update_mcast_cb(struct ifnet *ifp)
2883{
2884	/* not supported */
2885}
2886
2887static void
2888rum_update_promisc_cb(struct ifnet *ifp)
2889{
2890	struct rum_softc *sc = ifp->if_softc;
2891
2892	mtx_lock(&sc->sc_mtx);
2893	usb2_config_td_queue_command
2894	    (&sc->sc_config_td, &rum_config_copy,
2895	    &rum_cfg_update_promisc, 0, 0);
2896	mtx_unlock(&sc->sc_mtx);
2897}
2898