sys/bus/u4b/wlan/if_run.c

   1 /*-
   2  * Copyright (c) 2008,2010 Damien Bergamini <damien.bergamini@free.fr>
   3  * ported to FreeBSD by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
   4  * USB Consulting, Hans Petter Selasky <hselasky@freebsd.org>
   5  * Copyright (c) 2013-2014 Kevin Lo
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  *
  19  * $FreeBSD: head/sys/dev/usb/wlan/if_run.c 270643 2014-08-26 02:20:37Z kevlo $
  20  */
  21
  22 /*-
  23  * Ralink Technology RT2700U/RT2800U/RT3000U/RT3900E chipset driver.
  24  * http://www.ralinktech.com/
  25  */
  26
  27 #include <sys/param.h>
  28 #include <sys/sockio.h>
  29 #include <sys/sysctl.h>
  30 #include <sys/lock.h>
  31 #include <sys/mbuf.h>
  32 #include <sys/kernel.h>
  33 #include <sys/socket.h>
  34 #include <sys/systm.h>
  35 #include <sys/malloc.h>
  36 #include <sys/module.h>
  37 #include <sys/bus.h>
  38 #include <sys/endian.h>
  39 #include <sys/linker.h>
  40 #include <sys/firmware.h>
  41
  42 #include <sys/rman.h>
  43
  44 #include <net/bpf.h>
  45 #include <net/if.h>
  46 #include <net/if_var.h>
  47 #include <net/if_arp.h>
  48 #include <net/ethernet.h>
  49 #include <net/if_dl.h>
  50 #include <net/if_media.h>
  51 #include <net/if_types.h>
  52 #include <net/ifq_var.h>
  53
  54 #include <netinet/in.h>
  55 #include <netinet/in_systm.h>
  56 #include <netinet/in_var.h>
  57 #include <netinet/if_ether.h>
  58 #include <netinet/ip.h>
  59
  60 #include <netproto/802_11/ieee80211_var.h>
  61 #include <netproto/802_11/ieee80211_regdomain.h>
  62 #include <netproto/802_11/ieee80211_radiotap.h>
  63 #include <netproto/802_11/ieee80211_ratectl.h>
  64
  65 #include <bus/u4b/usb.h>
  66 #include <bus/u4b/usbdi.h>
  67 #include "usbdevs.h"
  68
  69 #define USB_DEBUG_VAR   run_debug
  70 #include <bus/u4b/usb_debug.h>
  71 #include <bus/u4b/usb_msctest.h>
  72
  73 #include <bus/u4b/wlan/if_runreg.h>
  74 #include <bus/u4b/wlan/if_runvar.h>
  75
  76 #ifdef  USB_DEBUG
  77 #define RUN_DEBUG
  78 #endif
  79
  80 #ifdef  RUN_DEBUG
  81 int run_debug = 0;
  82 static SYSCTL_NODE(_hw_usb, OID_AUTO, run, CTLFLAG_RW, 0, "USB run");
  83 SYSCTL_INT(_hw_usb_run, OID_AUTO, debug, CTLFLAG_RW, &run_debug, 0,
  84     "run debug level");
  85 #endif
  86
  87 #define IEEE80211_HAS_ADDR4(wh) \
  88         (((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
  89
  90 /*
  91  * Because of LOR in run_key_delete(), use atomic instead.
  92  * '& RUN_CMDQ_MASQ' is to loop cmdq[].
  93  */
  94 #define RUN_CMDQ_GET(c) (atomic_fetchadd_32((c), 1) & RUN_CMDQ_MASQ)
  95
  96 static const STRUCT_USB_HOST_ID run_devs[] = {
  97 #define RUN_DEV(v,p)    { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
  98 #define RUN_DEV_EJECT(v,p)      \
  99         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, RUN_EJECT) }
 100 #define RUN_EJECT       1
 101     RUN_DEV(ABOCOM,             RT2770),
 102     RUN_DEV(ABOCOM,             RT2870),
 103     RUN_DEV(ABOCOM,             RT3070),
 104     RUN_DEV(ABOCOM,             RT3071),
 105     RUN_DEV(ABOCOM,             RT3072),
 106     RUN_DEV(ABOCOM2,            RT2870_1),
 107     RUN_DEV(ACCTON,             RT2770),
 108     RUN_DEV(ACCTON,             RT2870_1),
 109     RUN_DEV(ACCTON,             RT2870_2),
 110     RUN_DEV(ACCTON,             RT2870_3),
 111     RUN_DEV(ACCTON,             RT2870_4),
 112     RUN_DEV(ACCTON,             RT2870_5),
 113     RUN_DEV(ACCTON,             RT3070),
 114     RUN_DEV(ACCTON,             RT3070_1),
 115     RUN_DEV(ACCTON,             RT3070_2),
 116     RUN_DEV(ACCTON,             RT3070_3),
 117     RUN_DEV(ACCTON,             RT3070_4),
 118     RUN_DEV(ACCTON,             RT3070_5),
 119     RUN_DEV(AIRTIES,            RT3070),
 120     RUN_DEV(ALLWIN,             RT2070),
 121     RUN_DEV(ALLWIN,             RT2770),
 122     RUN_DEV(ALLWIN,             RT2870),
 123     RUN_DEV(ALLWIN,             RT3070),
 124     RUN_DEV(ALLWIN,             RT3071),
 125     RUN_DEV(ALLWIN,             RT3072),
 126     RUN_DEV(ALLWIN,             RT3572),
 127     RUN_DEV(AMIGO,              RT2870_1),
 128     RUN_DEV(AMIGO,              RT2870_2),
 129     RUN_DEV(AMIT,               CGWLUSB2GNR),
 130     RUN_DEV(AMIT,               RT2870_1),
 131     RUN_DEV(AMIT2,              RT2870),
 132     RUN_DEV(ASUS,               RT2870_1),
 133     RUN_DEV(ASUS,               RT2870_2),
 134     RUN_DEV(ASUS,               RT2870_3),
 135     RUN_DEV(ASUS,               RT2870_4),
 136     RUN_DEV(ASUS,               RT2870_5),
 137     RUN_DEV(ASUS,               USBN13),
 138     RUN_DEV(ASUS,               RT3070_1),
 139     RUN_DEV(ASUS,               USBN66),
 140     RUN_DEV(ASUS,               USB_N53),
 141     RUN_DEV(ASUS2,              USBN11),
 142     RUN_DEV(AZUREWAVE,          RT2870_1),
 143     RUN_DEV(AZUREWAVE,          RT2870_2),
 144     RUN_DEV(AZUREWAVE,          RT3070_1),
 145     RUN_DEV(AZUREWAVE,          RT3070_2),
 146     RUN_DEV(AZUREWAVE,          RT3070_3),
 147     RUN_DEV(BELKIN,             F9L1103),
 148     RUN_DEV(BELKIN,             F5D8053V3),
 149     RUN_DEV(BELKIN,             F5D8055),
 150     RUN_DEV(BELKIN,             F5D8055V2),
 151     RUN_DEV(BELKIN,             F6D4050V1),
 152     RUN_DEV(BELKIN,             F6D4050V2),
 153     RUN_DEV(BELKIN,             RT2870_1),
 154     RUN_DEV(BELKIN,             RT2870_2),
 155     RUN_DEV(CISCOLINKSYS,       AE1000),
 156     RUN_DEV(CISCOLINKSYS2,      RT3070),
 157     RUN_DEV(CISCOLINKSYS3,      RT3070),
 158     RUN_DEV(CONCEPTRONIC2,      RT2870_1),
 159     RUN_DEV(CONCEPTRONIC2,      RT2870_2),
 160     RUN_DEV(CONCEPTRONIC2,      RT2870_3),
 161     RUN_DEV(CONCEPTRONIC2,      RT2870_4),
 162     RUN_DEV(CONCEPTRONIC2,      RT2870_5),
 163     RUN_DEV(CONCEPTRONIC2,      RT2870_6),
 164     RUN_DEV(CONCEPTRONIC2,      RT2870_7),
 165     RUN_DEV(CONCEPTRONIC2,      RT2870_8),
 166     RUN_DEV(CONCEPTRONIC2,      RT3070_1),
 167     RUN_DEV(CONCEPTRONIC2,      RT3070_2),
 168     RUN_DEV(CONCEPTRONIC2,      VIGORN61),
 169     RUN_DEV(COREGA,             CGWLUSB300GNM),
 170     RUN_DEV(COREGA,             RT2870_1),
 171     RUN_DEV(COREGA,             RT2870_2),
 172     RUN_DEV(COREGA,             RT2870_3),
 173     RUN_DEV(COREGA,             RT3070),
 174     RUN_DEV(CYBERTAN,           RT2870),
 175     RUN_DEV(DLINK,              RT2870),
 176     RUN_DEV(DLINK,              RT3072),
 177     RUN_DEV(DLINK,              DWA127),
 178     RUN_DEV(DLINK,              DWA140B3),
 179     RUN_DEV(DLINK,              DWA160B2),
 180     RUN_DEV(DLINK,              DWA140D1),
 181     RUN_DEV(DLINK,              DWA162),
 182     RUN_DEV(DLINK2,             DWA130),
 183     RUN_DEV(DLINK2,             RT2870_1),
 184     RUN_DEV(DLINK2,             RT2870_2),
 185     RUN_DEV(DLINK2,             RT3070_1),
 186     RUN_DEV(DLINK2,             RT3070_2),
 187     RUN_DEV(DLINK2,             RT3070_3),
 188     RUN_DEV(DLINK2,             RT3070_4),
 189     RUN_DEV(DLINK2,             RT3070_5),
 190     RUN_DEV(DLINK2,             RT3072),
 191     RUN_DEV(DLINK2,             RT3072_1),
 192     RUN_DEV(EDIMAX,             EW7717),
 193     RUN_DEV(EDIMAX,             EW7718),
 194     RUN_DEV(EDIMAX,             EW7733UND),
 195     RUN_DEV(EDIMAX,             RT2870_1),
 196     RUN_DEV(ENCORE,             RT3070_1),
 197     RUN_DEV(ENCORE,             RT3070_2),
 198     RUN_DEV(ENCORE,             RT3070_3),
 199     RUN_DEV(GIGABYTE,           GNWB31N),
 200     RUN_DEV(GIGABYTE,           GNWB32L),
 201     RUN_DEV(GIGABYTE,           RT2870_1),
 202     RUN_DEV(GIGASET,            RT3070_1),
 203     RUN_DEV(GIGASET,            RT3070_2),
 204     RUN_DEV(GUILLEMOT,          HWNU300),
 205     RUN_DEV(HAWKING,            HWUN2),
 206     RUN_DEV(HAWKING,            RT2870_1),
 207     RUN_DEV(HAWKING,            RT2870_2),
 208     RUN_DEV(HAWKING,            RT3070),
 209     RUN_DEV(IODATA,             RT3072_1),
 210     RUN_DEV(IODATA,             RT3072_2),
 211     RUN_DEV(IODATA,             RT3072_3),
 212     RUN_DEV(IODATA,             RT3072_4),
 213     RUN_DEV(LINKSYS4,           RT3070),
 214     RUN_DEV(LINKSYS4,           WUSB100),
 215     RUN_DEV(LINKSYS4,           WUSB54GCV3),
 216     RUN_DEV(LINKSYS4,           WUSB600N),
 217     RUN_DEV(LINKSYS4,           WUSB600NV2),
 218     RUN_DEV(LOGITEC,            RT2870_1),
 219     RUN_DEV(LOGITEC,            RT2870_2),
 220     RUN_DEV(LOGITEC,            RT2870_3),
 221     RUN_DEV(LOGITEC,            LANW300NU2),
 222     RUN_DEV(LOGITEC,            LANW150NU2),
 223     RUN_DEV(LOGITEC,            LANW300NU2S),
 224     RUN_DEV(MELCO,              RT2870_1),
 225     RUN_DEV(MELCO,              RT2870_2),
 226     RUN_DEV(MELCO,              WLIUCAG300N),
 227     RUN_DEV(MELCO,              WLIUCG300N),
 228     RUN_DEV(MELCO,              WLIUCG301N),
 229     RUN_DEV(MELCO,              WLIUCGN),
 230     RUN_DEV(MELCO,              WLIUCGNM),
 231     RUN_DEV(MELCO,              WLIUCGNM2),
 232     RUN_DEV(MOTOROLA4,          RT2770),
 233     RUN_DEV(MOTOROLA4,          RT3070),
 234     RUN_DEV(MSI,                RT3070_1),
 235     RUN_DEV(MSI,                RT3070_2),
 236     RUN_DEV(MSI,                RT3070_3),
 237     RUN_DEV(MSI,                RT3070_4),
 238     RUN_DEV(MSI,                RT3070_5),
 239     RUN_DEV(MSI,                RT3070_6),
 240     RUN_DEV(MSI,                RT3070_7),
 241     RUN_DEV(MSI,                RT3070_8),
 242     RUN_DEV(MSI,                RT3070_9),
 243     RUN_DEV(MSI,                RT3070_10),
 244     RUN_DEV(MSI,                RT3070_11),
 245     RUN_DEV(OVISLINK,           RT3072),
 246     RUN_DEV(PARA,               RT3070),
 247     RUN_DEV(PEGATRON,           RT2870),
 248     RUN_DEV(PEGATRON,           RT3070),
 249     RUN_DEV(PEGATRON,           RT3070_2),
 250     RUN_DEV(PEGATRON,           RT3070_3),
 251     RUN_DEV(PHILIPS,            RT2870),
 252     RUN_DEV(PLANEX2,            GWUS300MINIS),
 253     RUN_DEV(PLANEX2,            GWUSMICRON),
 254     RUN_DEV(PLANEX2,            RT2870),
 255     RUN_DEV(PLANEX2,            RT3070),
 256     RUN_DEV(QCOM,               RT2870),
 257     RUN_DEV(QUANTA,             RT3070),
 258     RUN_DEV(RALINK,             RT2070),
 259     RUN_DEV(RALINK,             RT2770),
 260     RUN_DEV(RALINK,             RT2870),
 261     RUN_DEV(RALINK,             RT3070),
 262     RUN_DEV(RALINK,             RT3071),
 263     RUN_DEV(RALINK,             RT3072),
 264     RUN_DEV(RALINK,             RT3370),
 265     RUN_DEV(RALINK,             RT3572),
 266     RUN_DEV(RALINK,             RT3573),
 267     RUN_DEV(RALINK,             RT5370),
 268     RUN_DEV(RALINK,             RT5572),
 269     RUN_DEV(RALINK,             RT8070),
 270     RUN_DEV(SAMSUNG,            WIS09ABGN),
 271     RUN_DEV(SAMSUNG2,           RT2870_1),
 272     RUN_DEV(SENAO,              RT2870_1),
 273     RUN_DEV(SENAO,              RT2870_2),
 274     RUN_DEV(SENAO,              RT2870_3),
 275     RUN_DEV(SENAO,              RT2870_4),
 276     RUN_DEV(SENAO,              RT3070),
 277     RUN_DEV(SENAO,              RT3071),
 278     RUN_DEV(SENAO,              RT3072_1),
 279     RUN_DEV(SENAO,              RT3072_2),
 280     RUN_DEV(SENAO,              RT3072_3),
 281     RUN_DEV(SENAO,              RT3072_4),
 282     RUN_DEV(SENAO,              RT3072_5),
 283     RUN_DEV(SITECOMEU,          RT2770),
 284     RUN_DEV(SITECOMEU,          RT2870_1),
 285     RUN_DEV(SITECOMEU,          RT2870_2),
 286     RUN_DEV(SITECOMEU,          RT2870_3),
 287     RUN_DEV(SITECOMEU,          RT2870_4),
 288     RUN_DEV(SITECOMEU,          RT3070),
 289     RUN_DEV(SITECOMEU,          RT3070_2),
 290     RUN_DEV(SITECOMEU,          RT3070_3),
 291     RUN_DEV(SITECOMEU,          RT3070_4),
 292     RUN_DEV(SITECOMEU,          RT3071),
 293     RUN_DEV(SITECOMEU,          RT3072_1),
 294     RUN_DEV(SITECOMEU,          RT3072_2),
 295     RUN_DEV(SITECOMEU,          RT3072_3),
 296     RUN_DEV(SITECOMEU,          RT3072_4),
 297     RUN_DEV(SITECOMEU,          RT3072_5),
 298     RUN_DEV(SITECOMEU,          RT3072_6),
 299     RUN_DEV(SITECOMEU,          WL608),
 300     RUN_DEV(SPARKLAN,           RT2870_1),
 301     RUN_DEV(SPARKLAN,           RT3070),
 302     RUN_DEV(SWEEX2,             LW153),
 303     RUN_DEV(SWEEX2,             LW303),
 304     RUN_DEV(SWEEX2,             LW313),
 305     RUN_DEV(TOSHIBA,            RT3070),
 306     RUN_DEV(UMEDIA,             RT2870_1),
 307     RUN_DEV(ZCOM,               RT2870_1),
 308     RUN_DEV(ZCOM,               RT2870_2),
 309     RUN_DEV(ZINWELL,            RT2870_1),
 310     RUN_DEV(ZINWELL,            RT2870_2),
 311     RUN_DEV(ZINWELL,            RT3070),
 312     RUN_DEV(ZINWELL,            RT3072_1),
 313     RUN_DEV(ZINWELL,            RT3072_2),
 314     RUN_DEV(ZYXEL,              RT2870_1),
 315     RUN_DEV(ZYXEL,              RT2870_2),
 316     RUN_DEV(ZYXEL,              RT3070),
 317     RUN_DEV_EJECT(ZYXEL,        NWD2705),
 318     RUN_DEV_EJECT(RALINK,       RT_STOR),
 319 #undef RUN_DEV_EJECT
 320 #undef RUN_DEV
 321 };
 322
 323 static device_probe_t   run_match;
 324 static device_attach_t  run_attach;
 325 static device_detach_t  run_detach;
 326
 327 static usb_callback_t   run_bulk_rx_callback;
 328 static usb_callback_t   run_bulk_tx_callback0;
 329 static usb_callback_t   run_bulk_tx_callback1;
 330 static usb_callback_t   run_bulk_tx_callback2;
 331 static usb_callback_t   run_bulk_tx_callback3;
 332 static usb_callback_t   run_bulk_tx_callback4;
 333 static usb_callback_t   run_bulk_tx_callback5;
 334
 335 static void     run_autoinst(void *, struct usb_device *,
 336                     struct usb_attach_arg *);
 337 static int      run_driver_loaded(struct module *, int, void *);
 338 static void     run_bulk_tx_callbackN(struct usb_xfer *xfer,
 339                     usb_error_t error, u_int index);
 340 static struct ieee80211vap *run_vap_create(struct ieee80211com *,
 341                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 342                     const uint8_t [IEEE80211_ADDR_LEN],
 343                     const uint8_t [IEEE80211_ADDR_LEN]);
 344 static void     run_vap_delete(struct ieee80211vap *);
 345 static void     run_cmdq_cb(void *, int);
 346 static void     run_setup_tx_list(struct run_softc *,
 347                     struct run_endpoint_queue *);
 348 static void     run_unsetup_tx_list(struct run_softc *,
 349                     struct run_endpoint_queue *);
 350 static int      run_load_microcode(struct run_softc *);
 351 static int      run_reset(struct run_softc *);
 352 static usb_error_t run_do_request(struct run_softc *,
 353                     struct usb_device_request *, void *);
 354 static int      run_read(struct run_softc *, uint16_t, uint32_t *);
 355 static int      run_read_region_1(struct run_softc *, uint16_t, uint8_t *, int);
 356 static int      run_write_2(struct run_softc *, uint16_t, uint16_t);
 357 static int      run_write(struct run_softc *, uint16_t, uint32_t);
 358 static int      run_write_region_1(struct run_softc *, uint16_t,
 359                     const uint8_t *, int);
 360 static int      run_set_region_4(struct run_softc *, uint16_t, uint32_t, int);
 361 static int      run_efuse_read(struct run_softc *, uint16_t, uint16_t *, int);
 362 static int      run_efuse_read_2(struct run_softc *, uint16_t, uint16_t *);
 363 static int      run_eeprom_read_2(struct run_softc *, uint16_t, uint16_t *);
 364 static int      run_rt2870_rf_write(struct run_softc *, uint32_t);
 365 static int      run_rt3070_rf_read(struct run_softc *, uint8_t, uint8_t *);
 366 static int      run_rt3070_rf_write(struct run_softc *, uint8_t, uint8_t);
 367 static int      run_bbp_read(struct run_softc *, uint8_t, uint8_t *);
 368 static int      run_bbp_write(struct run_softc *, uint8_t, uint8_t);
 369 static int      run_mcu_cmd(struct run_softc *, uint8_t, uint16_t);
 370 static const char *run_get_rf(uint16_t);
 371 static void     run_rt3593_get_txpower(struct run_softc *);
 372 static void     run_get_txpower(struct run_softc *);
 373 static int      run_read_eeprom(struct run_softc *);
 374 static struct ieee80211_node *run_node_alloc(struct ieee80211vap *,
 375                             const uint8_t mac[IEEE80211_ADDR_LEN]);
 376 static int      run_media_change(struct ifnet *);
 377 static int      run_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 378 static int      run_wme_update(struct ieee80211com *);
 379 static void     run_wme_update_cb(void *);
 380 static void     run_key_update_begin(struct ieee80211vap *);
 381 static void     run_key_update_end(struct ieee80211vap *);
 382 static void     run_key_set_cb(void *);
 383 static int      run_key_set(struct ieee80211vap *, struct ieee80211_key *,
 384                     const uint8_t mac[IEEE80211_ADDR_LEN]);
 385 static void     run_key_delete_cb(void *);
 386 static int      run_key_delete(struct ieee80211vap *, struct ieee80211_key *);
 387 static void     run_ratectl_to(void *);
 388 static void     run_ratectl_cb(void *, int);
 389 static void     run_drain_fifo(void *);
 390 static void     run_iter_func(void *, struct ieee80211_node *);
 391 static void     run_newassoc_cb(void *);
 392 static void     run_newassoc(struct ieee80211_node *, int);
 393 static void     run_rx_frame(struct run_softc *, struct mbuf *, uint32_t);
 394 static void     run_tx_free(struct run_endpoint_queue *pq,
 395                     struct run_tx_data *, int);
 396 static void     run_set_tx_desc(struct run_softc *, struct run_tx_data *);
 397 static int      run_tx(struct run_softc *, struct mbuf *,
 398                     struct ieee80211_node *);
 399 static int      run_tx_mgt(struct run_softc *, struct mbuf *,
 400                     struct ieee80211_node *);
 401 static int      run_sendprot(struct run_softc *, const struct mbuf *,
 402                     struct ieee80211_node *, int, int);
 403 static int      run_tx_param(struct run_softc *, struct mbuf *,
 404                     struct ieee80211_node *,
 405                     const struct ieee80211_bpf_params *);
 406 static int      run_raw_xmit(struct ieee80211_node *, struct mbuf *,
 407                     const struct ieee80211_bpf_params *);
 408 static void     run_start(struct ifnet *, struct ifaltq_subque *);
 409 static int      run_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
 410 static void     run_iq_calib(struct run_softc *, u_int);
 411 static void     run_set_agc(struct run_softc *, uint8_t);
 412 static void     run_select_chan_group(struct run_softc *, int);
 413 static void     run_set_rx_antenna(struct run_softc *, int);
 414 static void     run_rt2870_set_chan(struct run_softc *, u_int);
 415 static void     run_rt3070_set_chan(struct run_softc *, u_int);
 416 static void     run_rt3572_set_chan(struct run_softc *, u_int);
 417 static void     run_rt3593_set_chan(struct run_softc *, u_int);
 418 static void     run_rt5390_set_chan(struct run_softc *, u_int);
 419 static void     run_rt5592_set_chan(struct run_softc *, u_int);
 420 static int      run_set_chan(struct run_softc *, struct ieee80211_channel *);
 421 static void     run_set_channel(struct ieee80211com *);
 422 static void     run_scan_start(struct ieee80211com *);
 423 static void     run_scan_end(struct ieee80211com *);
 424 static void     run_update_beacon(struct ieee80211vap *, int);
 425 static void     run_update_beacon_cb(void *);
 426 static void     run_updateprot(struct ieee80211com *);
 427 static void     run_updateprot_cb(void *);
 428 static void     run_usb_timeout_cb(void *);
 429 static void     run_reset_livelock(struct run_softc *);
 430 static void     run_enable_tsf_sync(struct run_softc *);
 431 static void     run_enable_mrr(struct run_softc *);
 432 static void     run_set_txpreamble(struct run_softc *);
 433 static void     run_set_basicrates(struct run_softc *);
 434 static void     run_set_leds(struct run_softc *, uint16_t);
 435 static void     run_set_bssid(struct run_softc *, const uint8_t *);
 436 static void     run_set_macaddr(struct run_softc *, const uint8_t *);
 437 static void     run_updateslot(struct ieee80211com *);
 438 static void     run_updateslot_cb(void *);
 439 static void     run_update_mcast(struct ieee80211com *);
 440 static int8_t   run_rssi2dbm(struct run_softc *, uint8_t, uint8_t);
 441 static void     run_update_promisc_locked(struct run_softc *);
 442 static void     run_update_promisc(struct ieee80211com *);
 443 static void     run_rt5390_bbp_init(struct run_softc *);
 444 static int      run_bbp_init(struct run_softc *);
 445 static int      run_rt3070_rf_init(struct run_softc *);
 446 static void     run_rt3593_rf_init(struct run_softc *);
 447 static void     run_rt5390_rf_init(struct run_softc *);
 448 static int      run_rt3070_filter_calib(struct run_softc *, uint8_t, uint8_t,
 449                     uint8_t *);
 450 static void     run_rt3070_rf_setup(struct run_softc *);
 451 static void     run_rt3593_rf_setup(struct run_softc *);
 452 static void     run_rt5390_rf_setup(struct run_softc *);
 453 static int      run_txrx_enable(struct run_softc *);
 454 static void     run_adjust_freq_offset(struct run_softc *);
 455 static void     run_init(void *);
 456 static void     run_init_locked(struct run_softc *);
 457 static void     run_stop(void *);
 458 static void     run_delay(struct run_softc *, u_int);
 459
 460 static eventhandler_tag run_etag;
 461
 462 static const struct rt2860_rate {
 463         uint8_t         rate;
 464         uint8_t         mcs;
 465         enum            ieee80211_phytype phy;
 466         uint8_t         ctl_ridx;
 467         uint16_t        sp_ack_dur;
 468         uint16_t        lp_ack_dur;
 469 } rt2860_rates[] = {
 470         {   2, 0, IEEE80211_T_DS,   0, 314, 314 },
 471         {   4, 1, IEEE80211_T_DS,   1, 258, 162 },
 472         {  11, 2, IEEE80211_T_DS,   2, 223, 127 },
 473         {  22, 3, IEEE80211_T_DS,   3, 213, 117 },
 474         {  12, 0, IEEE80211_T_OFDM, 4,  60,  60 },
 475         {  18, 1, IEEE80211_T_OFDM, 4,  52,  52 },
 476         {  24, 2, IEEE80211_T_OFDM, 6,  48,  48 },
 477         {  36, 3, IEEE80211_T_OFDM, 6,  44,  44 },
 478         {  48, 4, IEEE80211_T_OFDM, 8,  44,  44 },
 479         {  72, 5, IEEE80211_T_OFDM, 8,  40,  40 },
 480         {  96, 6, IEEE80211_T_OFDM, 8,  40,  40 },
 481         { 108, 7, IEEE80211_T_OFDM, 8,  40,  40 }
 482 };
 483
 484 static const struct {
 485         uint16_t        reg;
 486         uint32_t        val;
 487 } rt2870_def_mac[] = {
 488         RT2870_DEF_MAC
 489 };
 490
 491 static const struct {
 492         uint8_t reg;
 493         uint8_t val;
 494 } rt2860_def_bbp[] = {
 495         RT2860_DEF_BBP
 496 },rt5390_def_bbp[] = {
 497         RT5390_DEF_BBP
 498 },rt5592_def_bbp[] = {
 499         RT5592_DEF_BBP
 500 };
 501
 502 /*
 503  * Default values for BBP register R196 for RT5592.
 504  */
 505 static const uint8_t rt5592_bbp_r196[] = {
 506         0xe0, 0x1f, 0x38, 0x32, 0x08, 0x28, 0x19, 0x0a, 0xff, 0x00,
 507         0x16, 0x10, 0x10, 0x0b, 0x36, 0x2c, 0x26, 0x24, 0x42, 0x36,
 508         0x30, 0x2d, 0x4c, 0x46, 0x3d, 0x40, 0x3e, 0x42, 0x3d, 0x40,
 509         0x3c, 0x34, 0x2c, 0x2f, 0x3c, 0x35, 0x2e, 0x2a, 0x49, 0x41,
 510         0x36, 0x31, 0x30, 0x30, 0x0e, 0x0d, 0x28, 0x21, 0x1c, 0x16,
 511         0x50, 0x4a, 0x43, 0x40, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00,
 512         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 513         0x00, 0x00, 0x7d, 0x14, 0x32, 0x2c, 0x36, 0x4c, 0x43, 0x2c,
 514         0x2e, 0x36, 0x30, 0x6e
 515 };
 516
 517 static const struct rfprog {
 518         uint8_t         chan;
 519         uint32_t        r1, r2, r3, r4;
 520 } rt2860_rf2850[] = {
 521         RT2860_RF2850
 522 };
 523
 524 struct {
 525         uint8_t n, r, k;
 526 } rt3070_freqs[] = {
 527         RT3070_RF3052
 528 };
 529
 530 static const struct rt5592_freqs {
 531         uint16_t        n;
 532         uint8_t         k, m, r;
 533 } rt5592_freqs_20mhz[] = {
 534         RT5592_RF5592_20MHZ
 535 },rt5592_freqs_40mhz[] = {
 536         RT5592_RF5592_40MHZ
 537 };
 538
 539 static const struct {
 540         uint8_t reg;
 541         uint8_t val;
 542 } rt3070_def_rf[] = {
 543         RT3070_DEF_RF
 544 },rt3572_def_rf[] = {
 545         RT3572_DEF_RF
 546 },rt3593_def_rf[] = {
 547         RT3593_DEF_RF
 548 },rt5390_def_rf[] = {
 549         RT5390_DEF_RF
 550 },rt5392_def_rf[] = {
 551         RT5392_DEF_RF
 552 },rt5592_def_rf[] = {
 553         RT5592_DEF_RF
 554 },rt5592_2ghz_def_rf[] = {
 555         RT5592_2GHZ_DEF_RF
 556 },rt5592_5ghz_def_rf[] = {
 557         RT5592_5GHZ_DEF_RF
 558 };
 559
 560 static const struct {
 561         u_int   firstchan;
 562         u_int   lastchan;
 563         uint8_t reg;
 564         uint8_t val;
 565 } rt5592_chan_5ghz[] = {
 566         RT5592_CHAN_5GHZ
 567 };
 568
 569 static const struct usb_config run_config[RUN_N_XFER] = {
 570     [RUN_BULK_TX_BE] = {
 571         .type = UE_BULK,
 572         .endpoint = UE_ADDR_ANY,
 573         .ep_index = 0,
 574         .direction = UE_DIR_OUT,
 575         .bufsize = RUN_MAX_TXSZ,
 576         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 577         .callback = run_bulk_tx_callback0,
 578         .timeout = 5000,        /* ms */
 579     },
 580     [RUN_BULK_TX_BK] = {
 581         .type = UE_BULK,
 582         .endpoint = UE_ADDR_ANY,
 583         .direction = UE_DIR_OUT,
 584         .ep_index = 1,
 585         .bufsize = RUN_MAX_TXSZ,
 586         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 587         .callback = run_bulk_tx_callback1,
 588         .timeout = 5000,        /* ms */
 589     },
 590     [RUN_BULK_TX_VI] = {
 591         .type = UE_BULK,
 592         .endpoint = UE_ADDR_ANY,
 593         .direction = UE_DIR_OUT,
 594         .ep_index = 2,
 595         .bufsize = RUN_MAX_TXSZ,
 596         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 597         .callback = run_bulk_tx_callback2,
 598         .timeout = 5000,        /* ms */
 599     },
 600     [RUN_BULK_TX_VO] = {
 601         .type = UE_BULK,
 602         .endpoint = UE_ADDR_ANY,
 603         .direction = UE_DIR_OUT,
 604         .ep_index = 3,
 605         .bufsize = RUN_MAX_TXSZ,
 606         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 607         .callback = run_bulk_tx_callback3,
 608         .timeout = 5000,        /* ms */
 609     },
 610     [RUN_BULK_TX_HCCA] = {
 611         .type = UE_BULK,
 612         .endpoint = UE_ADDR_ANY,
 613         .direction = UE_DIR_OUT,
 614         .ep_index = 4,
 615         .bufsize = RUN_MAX_TXSZ,
 616         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 617         .callback = run_bulk_tx_callback4,
 618         .timeout = 5000,        /* ms */
 619     },
 620     [RUN_BULK_TX_PRIO] = {
 621         .type = UE_BULK,
 622         .endpoint = UE_ADDR_ANY,
 623         .direction = UE_DIR_OUT,
 624         .ep_index = 5,
 625         .bufsize = RUN_MAX_TXSZ,
 626         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 627         .callback = run_bulk_tx_callback5,
 628         .timeout = 5000,        /* ms */
 629     },
 630     [RUN_BULK_RX] = {
 631         .type = UE_BULK,
 632         .endpoint = UE_ADDR_ANY,
 633         .direction = UE_DIR_IN,
 634         .bufsize = RUN_MAX_RXSZ,
 635         .flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
 636         .callback = run_bulk_rx_callback,
 637     }
 638 };
 639
 640 static void
 641 run_autoinst(void *arg, struct usb_device *udev,
 642     struct usb_attach_arg *uaa)
 643 {
 644         struct usb_interface *iface;
 645         struct usb_interface_descriptor *id;
 646
 647         if (uaa->dev_state != UAA_DEV_READY)
 648                 return;
 649
 650         iface = usbd_get_iface(udev, 0);
 651         if (iface == NULL)
 652                 return;
 653         id = iface->idesc;
 654         if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
 655                 return;
 656         if (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa))
 657                 return;
 658
 659         if (usb_msc_eject(udev, 0, MSC_EJECT_STOPUNIT) == 0)
 660                 uaa->dev_state = UAA_DEV_EJECTING;
 661 }
 662
 663 static int
 664 run_driver_loaded(struct module *mod, int what, void *arg)
 665 {
 666         switch (what) {
 667         case MOD_LOAD:
 668                 run_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
 669                     run_autoinst, NULL, EVENTHANDLER_PRI_ANY);
 670                 break;
 671         case MOD_UNLOAD:
 672                 EVENTHANDLER_DEREGISTER(usb_dev_configured, run_etag);
 673                 break;
 674         default:
 675                 return (EOPNOTSUPP);
 676         }
 677         return (0);
 678 }
 679
 680 static int
 681 run_match(device_t self)
 682 {
 683         struct usb_attach_arg *uaa = device_get_ivars(self);
 684
 685         if (uaa->usb_mode != USB_MODE_HOST)
 686                 return (ENXIO);
 687         if (uaa->info.bConfigIndex != 0)
 688                 return (ENXIO);
 689         if (uaa->info.bIfaceIndex != RT2860_IFACE_INDEX)
 690                 return (ENXIO);
 691
 692         return (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa));
 693 }
 694
 695 static int
 696 run_attach(device_t self)
 697 {
 698         struct run_softc *sc = device_get_softc(self);
 699         struct usb_attach_arg *uaa = device_get_ivars(self);
 700         struct ieee80211com *ic;
 701         struct ifnet *ifp;
 702         uint32_t ver;
 703         int ntries, error;
 704         uint8_t iface_index, bands;
 705         char ethstr[ETHER_ADDRSTRLEN + 1];
 706
 707         wlan_serialize_enter();
 708
 709         device_set_usb_desc(self);
 710         sc->sc_udev = uaa->device;
 711         sc->sc_dev = self;
 712         if (USB_GET_DRIVER_INFO(uaa) != RUN_EJECT)
 713                 sc->sc_flags |= RUN_FLAG_FWLOAD_NEEDED;
 714
 715         lockinit(&sc->sc_lock, device_get_nameunit(sc->sc_dev),
 716             0, LK_CANRECURSE);
 717
 718         iface_index = RT2860_IFACE_INDEX;
 719
 720         error = usbd_transfer_setup(uaa->device, &iface_index,
 721             sc->sc_xfer, run_config, RUN_N_XFER, sc, &sc->sc_lock);
 722         if (error) {
 723                 device_printf(self, "could not allocate USB transfers, "
 724                     "err=%s\n", usbd_errstr(error));
 725                 goto detach;
 726         }
 727
 728         RUN_LOCK(sc);
 729
 730         /* wait for the chip to settle */
 731         for (ntries = 0; ntries < 100; ntries++) {
 732                 if (run_read(sc, RT2860_ASIC_VER_ID, &ver) != 0) {
 733                         RUN_UNLOCK(sc);
 734                         goto detach;
 735                 }
 736                 if (ver != 0 && ver != 0xffffffff)
 737                         break;
 738                 run_delay(sc, 10);
 739         }
 740         if (ntries == 100) {
 741                 device_printf(sc->sc_dev,
 742                     "timeout waiting for NIC to initialize\n");
 743                 RUN_UNLOCK(sc);
 744                 goto detach;
 745         }
 746         sc->mac_ver = ver >> 16;
 747         sc->mac_rev = ver & 0xffff;
 748
 749         /* retrieve RF rev. no and various other things from EEPROM */
 750         run_read_eeprom(sc);
 751
 752         device_printf(sc->sc_dev,
 753             "MAC/BBP RT%04X (rev 0x%04X), RF %s (MIMO %dT%dR), address %s\n",
 754             sc->mac_ver, sc->mac_rev, run_get_rf(sc->rf_rev),
 755             sc->ntxchains, sc->nrxchains, kether_ntoa(sc->sc_bssid, ethstr));
 756
 757         RUN_UNLOCK(sc);
 758
 759         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 760         if (ifp == NULL) {
 761                 device_printf(sc->sc_dev, "can not if_alloc()\n");
 762                 goto detach;
 763         }
 764         ic = ifp->if_l2com;
 765
 766         ifp->if_softc = sc;
 767         if_initname(ifp, "run", device_get_unit(sc->sc_dev));
 768         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 769         ifp->if_init = run_init;
 770         ifp->if_ioctl = run_ioctl;
 771         ifp->if_start = run_start;
 772         ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
 773 #if 0 /* XXX swildner: see c3d4131842e47b168d93a0650d58d425ebeef789 */
 774         ifq_set_ready(&ifp->if_snd);
 775 #endif
 776
 777         ic->ic_ifp = ifp;
 778         ic->ic_softc = sc;
 779         ic->ic_name = device_get_nameunit(sc->sc_dev);
 780         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 781         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 782
 783         /* set device capabilities */
 784         ic->ic_caps =
 785             IEEE80211_C_STA |           /* station mode supported */
 786             IEEE80211_C_MONITOR |       /* monitor mode supported */
 787             IEEE80211_C_IBSS |
 788             IEEE80211_C_HOSTAP |
 789             IEEE80211_C_WDS |           /* 4-address traffic works */
 790             IEEE80211_C_MBSS |
 791             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 792             IEEE80211_C_SHSLOT |        /* short slot time supported */
 793             IEEE80211_C_WME |           /* WME */
 794             IEEE80211_C_WPA;            /* WPA1|WPA2(RSN) */
 795
 796         ic->ic_cryptocaps =
 797             IEEE80211_CRYPTO_WEP |
 798             IEEE80211_CRYPTO_AES_CCM |
 799             IEEE80211_CRYPTO_TKIPMIC |
 800             IEEE80211_CRYPTO_TKIP;
 801
 802         ic->ic_flags |= IEEE80211_F_DATAPAD;
 803         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 804
 805         bands = 0;
 806         setbit(&bands, IEEE80211_MODE_11B);
 807         setbit(&bands, IEEE80211_MODE_11G);
 808         if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850 ||
 809             sc->rf_rev == RT3070_RF_3052 || sc->rf_rev == RT3593_RF_3053 ||
 810             sc->rf_rev == RT5592_RF_5592)
 811                 setbit(&bands, IEEE80211_MODE_11A);
 812         ieee80211_init_channels(ic, NULL, &bands);
 813
 814         ieee80211_ifattach(ic, sc->sc_bssid);
 815
 816         ic->ic_scan_start = run_scan_start;
 817         ic->ic_scan_end = run_scan_end;
 818         ic->ic_set_channel = run_set_channel;
 819         ic->ic_node_alloc = run_node_alloc;
 820         ic->ic_newassoc = run_newassoc;
 821         ic->ic_updateslot = run_updateslot;
 822         ic->ic_update_mcast = run_update_mcast;
 823         ic->ic_wme.wme_update = run_wme_update;
 824         ic->ic_raw_xmit = run_raw_xmit;
 825         ic->ic_update_promisc = run_update_promisc;
 826
 827         ic->ic_vap_create = run_vap_create;
 828         ic->ic_vap_delete = run_vap_delete;
 829
 830         ieee80211_radiotap_attach(ic,
 831             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 832                 RUN_TX_RADIOTAP_PRESENT,
 833             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 834                 RUN_RX_RADIOTAP_PRESENT);
 835
 836         TASK_INIT(&sc->cmdq_task, 0, run_cmdq_cb, sc);
 837         TASK_INIT(&sc->ratectl_task, 0, run_ratectl_cb, sc);
 838         usb_callout_init_mtx(&sc->ratectl_ch, &sc->sc_lock, 1);
 839
 840         if (bootverbose)
 841                 ieee80211_announce(ic);
 842
 843         wlan_serialize_exit();
 844         return (0);
 845
 846 detach:
 847         wlan_serialize_exit();
 848         run_detach(self);
 849         return (ENXIO);
 850 }
 851
 852 static int
 853 run_detach(device_t self)
 854 {
 855         struct run_softc *sc = device_get_softc(self);
 856         struct ifnet *ifp = sc->sc_ifp;
 857         struct ieee80211com *ic;
 858         int i;
 859
 860         wlan_serialize_enter();
 861         sc->sc_detached = 1;
 862
 863         /* stop all USB transfers */
 864         usbd_transfer_unsetup(sc->sc_xfer, RUN_N_XFER);
 865
 866         RUN_LOCK(sc);
 867         sc->ratectl_run = RUN_RATECTL_OFF;
 868         sc->cmdq_run = sc->cmdq_key_set = RUN_CMDQ_ABORT;
 869
 870         /* free TX list, if any */
 871         for (i = 0; i != RUN_EP_QUEUES; i++)
 872                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
 873         RUN_UNLOCK(sc);
 874
 875         if (ifp) {
 876                 ic = ifp->if_l2com;
 877                 /* drain tasks */
 878                 usb_callout_drain(&sc->ratectl_ch);
 879                 ieee80211_draintask(ic, &sc->cmdq_task);
 880                 ieee80211_draintask(ic, &sc->ratectl_task);
 881                 ieee80211_ifdetach(ic);
 882                 if_free(ifp);
 883         }
 884
 885         lockuninit(&sc->sc_lock);
 886
 887         wlan_serialize_exit();
 888         return (0);
 889 }
 890
 891 static struct ieee80211vap *
 892 run_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 893     enum ieee80211_opmode opmode, int flags,
 894     const uint8_t bssid[IEEE80211_ADDR_LEN],
 895     const uint8_t mac[IEEE80211_ADDR_LEN])
 896 {
 897         struct ifnet *ifp = ic->ic_ifp;
 898         struct run_softc *sc = ifp->if_softc;
 899         struct run_vap *rvp;
 900         struct ieee80211vap *vap;
 901         int i;
 902
 903         if (sc->rvp_cnt >= RUN_VAP_MAX) {
 904                 if_printf(ifp, "number of VAPs maxed out\n");
 905                 return (NULL);
 906         }
 907
 908         switch (opmode) {
 909         case IEEE80211_M_STA:
 910                 /* enable s/w bmiss handling for sta mode */
 911                 flags |= IEEE80211_CLONE_NOBEACONS;
 912                 /* fall though */
 913         case IEEE80211_M_IBSS:
 914         case IEEE80211_M_MONITOR:
 915         case IEEE80211_M_HOSTAP:
 916         case IEEE80211_M_MBSS:
 917                 /* other than WDS vaps, only one at a time */
 918                 if (!TAILQ_EMPTY(&ic->ic_vaps))
 919                         return (NULL);
 920                 break;
 921         case IEEE80211_M_WDS:
 922                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next){
 923                         if(vap->iv_opmode != IEEE80211_M_HOSTAP)
 924                                 continue;
 925                         /* WDS vap's always share the local mac address. */
 926                         flags &= ~IEEE80211_CLONE_BSSID;
 927                         break;
 928                 }
 929                 if (vap == NULL) {
 930                         if_printf(ifp, "wds only supported in ap mode\n");
 931                         return (NULL);
 932                 }
 933                 break;
 934         default:
 935                 if_printf(ifp, "unknown opmode %d\n", opmode);
 936                 return (NULL);
 937         }
 938
 939         rvp = (struct run_vap *) kmalloc(sizeof(struct run_vap),
 940             M_80211_VAP, M_INTWAIT | M_ZERO);
 941         vap = &rvp->vap;
 942
 943         if (ieee80211_vap_setup(ic, vap, name, unit,
 944             opmode, flags, bssid, mac) != 0) {
 945                 /* out of memory */
 946                 kfree(rvp, M_80211_VAP);
 947                 return (NULL);
 948         }
 949
 950         vap->iv_key_update_begin = run_key_update_begin;
 951         vap->iv_key_update_end = run_key_update_end;
 952         vap->iv_update_beacon = run_update_beacon;
 953         vap->iv_max_aid = RT2870_WCID_MAX;
 954         /*
 955          * To delete the right key from h/w, we need wcid.
 956          * Luckily, there is unused space in ieee80211_key{}, wk_pad,
 957          * and matching wcid will be written into there. So, cast
 958          * some spells to remove 'const' from ieee80211_key{}
 959          */
 960         vap->iv_key_delete = (void *)run_key_delete;
 961         vap->iv_key_set = (void *)run_key_set;
 962
 963         /* override state transition machine */
 964         rvp->newstate = vap->iv_newstate;
 965         vap->iv_newstate = run_newstate;
 966
 967         ieee80211_ratectl_init(vap);
 968         ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
 969
 970         /* complete setup */
 971         ieee80211_vap_attach(vap, run_media_change, ieee80211_media_status);
 972
 973         /* make sure id is always unique */
 974         for (i = 0; i < RUN_VAP_MAX; i++) {
 975                 if((sc->rvp_bmap & 1 << i) == 0){
 976                         sc->rvp_bmap |= 1 << i;
 977                         rvp->rvp_id = i;
 978                         break;
 979                 }
 980         }
 981         if (sc->rvp_cnt++ == 0)
 982                 ic->ic_opmode = opmode;
 983
 984         if (opmode == IEEE80211_M_HOSTAP)
 985                 sc->cmdq_run = RUN_CMDQ_GO;
 986
 987         DPRINTF("rvp_id=%d bmap=%x rvp_cnt=%d\n",
 988             rvp->rvp_id, sc->rvp_bmap, sc->rvp_cnt);
 989
 990         return (vap);
 991 }
 992
 993 static void
 994 run_vap_delete(struct ieee80211vap *vap)
 995 {
 996         struct run_vap *rvp = RUN_VAP(vap);
 997         struct ifnet *ifp;
 998         struct ieee80211com *ic;
 999         struct run_softc *sc;
1000         uint8_t rvp_id;
1001
1002         if (vap == NULL)
1003                 return;
1004
1005         ic = vap->iv_ic;
1006         ifp = ic->ic_ifp;
1007
1008         sc = ifp->if_softc;
1009
1010         RUN_LOCK(sc);
1011
1012         m_freem(rvp->beacon_mbuf);
1013         rvp->beacon_mbuf = NULL;
1014
1015         rvp_id = rvp->rvp_id;
1016         sc->ratectl_run &= ~(1 << rvp_id);
1017         sc->rvp_bmap &= ~(1 << rvp_id);
1018         run_set_region_4(sc, RT2860_SKEY(rvp_id, 0), 0, 128);
1019         run_set_region_4(sc, RT2860_BCN_BASE(rvp_id), 0, 512);
1020         --sc->rvp_cnt;
1021
1022         DPRINTF("vap=%p rvp_id=%d bmap=%x rvp_cnt=%d\n",
1023             vap, rvp_id, sc->rvp_bmap, sc->rvp_cnt);
1024
1025         RUN_UNLOCK(sc);
1026
1027         ieee80211_ratectl_deinit(vap);
1028         ieee80211_vap_detach(vap);
1029         kfree(rvp, M_80211_VAP);
1030 }
1031
1032 /*
1033  * There are numbers of functions need to be called in context thread.
1034  * Rather than creating taskqueue event for each of those functions,
1035  * here is all-for-one taskqueue callback function. This function
1036  * gurantees deferred functions are executed in the same order they
1037  * were enqueued.
1038  * '& RUN_CMDQ_MASQ' is to loop cmdq[].
1039  */
1040 static void
1041 run_cmdq_cb(void *arg, int pending)
1042 {
1043         struct run_softc *sc = arg;
1044         uint8_t i;
1045
1046         /* call cmdq[].func locked */
1047         RUN_LOCK(sc);
1048         for (i = sc->cmdq_exec; sc->cmdq[i].func && pending;
1049             i = sc->cmdq_exec, pending--) {
1050                 DPRINTFN(6, "cmdq_exec=%d pending=%d\n", i, pending);
1051                 if (sc->cmdq_run == RUN_CMDQ_GO) {
1052                         /*
1053                          * If arg0 is NULL, callback func needs more
1054                          * than one arg. So, pass ptr to cmdq struct.
1055                          */
1056                         if (sc->cmdq[i].arg0)
1057                                 sc->cmdq[i].func(sc->cmdq[i].arg0);
1058                         else
1059                                 sc->cmdq[i].func(&sc->cmdq[i]);
1060                 }
1061                 sc->cmdq[i].arg0 = NULL;
1062                 sc->cmdq[i].func = NULL;
1063                 sc->cmdq_exec++;
1064                 sc->cmdq_exec &= RUN_CMDQ_MASQ;
1065         }
1066         RUN_UNLOCK(sc);
1067 }
1068
1069 static void
1070 run_setup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
1071 {
1072         struct run_tx_data *data;
1073
1074         memset(pq, 0, sizeof(*pq));
1075
1076         STAILQ_INIT(&pq->tx_qh);
1077         STAILQ_INIT(&pq->tx_fh);
1078
1079         for (data = &pq->tx_data[0];
1080             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
1081                 data->sc = sc;
1082                 STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
1083         }
1084         pq->tx_nfree = RUN_TX_RING_COUNT;
1085 }
1086
1087 static void
1088 run_unsetup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
1089 {
1090         struct run_tx_data *data;
1091
1092         /* make sure any subsequent use of the queues will fail */
1093         pq->tx_nfree = 0;
1094         STAILQ_INIT(&pq->tx_fh);
1095         STAILQ_INIT(&pq->tx_qh);
1096
1097         /* free up all node references and mbufs */
1098         for (data = &pq->tx_data[0];
1099             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
1100                 if (data->m != NULL) {
1101                         m_freem(data->m);
1102                         data->m = NULL;
1103                 }
1104                 if (data->ni != NULL) {
1105                         ieee80211_free_node(data->ni);
1106                         data->ni = NULL;
1107                 }
1108         }
1109 }
1110
1111 static int
1112 run_load_microcode(struct run_softc *sc)
1113 {
1114         usb_device_request_t req;
1115         const struct firmware *fw;
1116         const u_char *base;
1117         uint32_t tmp;
1118         int ntries, error;
1119         const uint64_t *temp;
1120         uint64_t bytes;
1121
1122         wlan_assert_serialized();
1123
1124         wlan_serialize_exit();
1125         fw = firmware_get("runfw");
1126         wlan_serialize_enter();
1127         if (fw == NULL) {
1128                 device_printf(sc->sc_dev,
1129                     "failed loadfirmware of file %s\n", "runfw");
1130                 return ENOENT;
1131         }
1132
1133         if (fw->datasize != 8192) {
1134                 device_printf(sc->sc_dev,
1135                     "invalid firmware size (should be 8KB)\n");
1136                 error = EINVAL;
1137                 goto fail;
1138         }
1139
1140         /*
1141          * RT3071/RT3072 use a different firmware
1142          * run-rt2870 (8KB) contains both,
1143          * first half (4KB) is for rt2870,
1144          * last half is for rt3071.
1145          */
1146         base = fw->data;
1147         if ((sc->mac_ver) != 0x2860 &&
1148             (sc->mac_ver) != 0x2872 &&
1149             (sc->mac_ver) != 0x3070) {
1150                 base += 4096;
1151         }
1152
1153         /* cheap sanity check */
1154         temp = fw->data;
1155         bytes = *temp;
1156         if (bytes != be64toh(0xffffff0210280210ULL)) {
1157                 device_printf(sc->sc_dev, "firmware checksum failed\n");
1158                 error = EINVAL;
1159                 goto fail;
1160         }
1161
1162         /* write microcode image */
1163         if (sc->sc_flags & RUN_FLAG_FWLOAD_NEEDED) {
1164                 run_write_region_1(sc, RT2870_FW_BASE, base, 4096);
1165                 run_write(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
1166                 run_write(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
1167         }
1168
1169         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1170         req.bRequest = RT2870_RESET;
1171         USETW(req.wValue, 8);
1172         USETW(req.wIndex, 0);
1173         USETW(req.wLength, 0);
1174         if ((error = usbd_do_request(sc->sc_udev, &sc->sc_lock, &req, NULL))
1175             != 0) {
1176                 device_printf(sc->sc_dev, "firmware reset failed\n");
1177                 goto fail;
1178         }
1179
1180         run_delay(sc, 10);
1181
1182         run_write(sc, RT2860_H2M_BBPAGENT, 0);
1183         run_write(sc, RT2860_H2M_MAILBOX, 0);
1184         run_write(sc, RT2860_H2M_INTSRC, 0);
1185         if ((error = run_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0)) != 0)
1186                 goto fail;
1187
1188         /* wait until microcontroller is ready */
1189         for (ntries = 0; ntries < 1000; ntries++) {
1190                 if ((error = run_read(sc, RT2860_SYS_CTRL, &tmp)) != 0)
1191                         goto fail;
1192                 if (tmp & RT2860_MCU_READY)
1193                         break;
1194                 run_delay(sc, 10);
1195         }
1196         if (ntries == 1000) {
1197                 device_printf(sc->sc_dev,
1198                     "timeout waiting for MCU to initialize\n");
1199                 error = ETIMEDOUT;
1200                 goto fail;
1201         }
1202         device_printf(sc->sc_dev, "firmware %s ver. %u.%u loaded\n",
1203             (base == fw->data) ? "RT2870" : "RT3071",
1204             *(base + 4092), *(base + 4093));
1205
1206 fail:
1207         firmware_put(fw, FIRMWARE_UNLOAD);
1208         return (error);
1209 }
1210
1211 static int
1212 run_reset(struct run_softc *sc)
1213 {
1214         usb_device_request_t req;
1215         usb_error_t error;
1216
1217         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1218         req.bRequest = RT2870_RESET;
1219         USETW(req.wValue, 1);
1220         USETW(req.wIndex, 0);
1221         USETW(req.wLength, 0);
1222         error = usbd_do_request(sc->sc_udev, &sc->sc_lock, &req, NULL);
1223         return (error);
1224 }
1225
1226 static usb_error_t
1227 run_do_request(struct run_softc *sc,
1228     struct usb_device_request *req, void *data)
1229 {
1230         usb_error_t err;
1231         int ntries = 10;
1232
1233         RUN_LOCK_ASSERT(sc, MA_OWNED);
1234
1235         while (ntries--) {
1236                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_lock,
1237                     req, data, 0, NULL, 250 /* ms */);
1238                 if (err == 0)
1239                         break;
1240                 DPRINTFN(1, "Control request failed, %s (retrying)\n",
1241                     usbd_errstr(err));
1242                 run_delay(sc, 10);
1243         }
1244         return (err);
1245 }
1246
1247 static int
1248 run_read(struct run_softc *sc, uint16_t reg, uint32_t *val)
1249 {
1250         uint32_t tmp;
1251         int error;
1252
1253         error = run_read_region_1(sc, reg, (uint8_t *)&tmp, sizeof tmp);
1254         if (error == 0)
1255                 *val = le32toh(tmp);
1256         else
1257                 *val = 0xffffffff;
1258         return (error);
1259 }
1260
1261 static int
1262 run_read_region_1(struct run_softc *sc, uint16_t reg, uint8_t *buf, int len)
1263 {
1264         usb_device_request_t req;
1265
1266         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1267         req.bRequest = RT2870_READ_REGION_1;
1268         USETW(req.wValue, 0);
1269         USETW(req.wIndex, reg);
1270         USETW(req.wLength, len);
1271
1272         return (run_do_request(sc, &req, buf));
1273 }
1274
1275 static int
1276 run_write_2(struct run_softc *sc, uint16_t reg, uint16_t val)
1277 {
1278         usb_device_request_t req;
1279
1280         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1281         req.bRequest = RT2870_WRITE_2;
1282         USETW(req.wValue, val);
1283         USETW(req.wIndex, reg);
1284         USETW(req.wLength, 0);
1285
1286         return (run_do_request(sc, &req, NULL));
1287 }
1288
1289 static int
1290 run_write(struct run_softc *sc, uint16_t reg, uint32_t val)
1291 {
1292         int error;
1293
1294         if ((error = run_write_2(sc, reg, val & 0xffff)) == 0)
1295                 error = run_write_2(sc, reg + 2, val >> 16);
1296         return (error);
1297 }
1298
1299 static int
1300 run_write_region_1(struct run_softc *sc, uint16_t reg, const uint8_t *buf,
1301     int len)
1302 {
1303 #if 1
1304         int i, error = 0;
1305         /*
1306          * NB: the WRITE_REGION_1 command is not stable on RT2860.
1307          * We thus issue multiple WRITE_2 commands instead.
1308          */
1309         KASSERT((len & 1) == 0, ("run_write_region_1: Data too long.\n"));
1310         for (i = 0; i < len && error == 0; i += 2)
1311                 error = run_write_2(sc, reg + i, buf[i] | buf[i + 1] << 8);
1312         return (error);
1313 #else
1314         usb_device_request_t req;
1315         int error = 0;
1316
1317         /*
1318          * NOTE: It appears the WRITE_REGION_1 command cannot be
1319          * passed a huge amount of data, which will crash the
1320          * firmware. Limit amount of data passed to 64-bytes at a
1321          * time.
1322          */
1323         while (len > 0) {
1324                 int delta = 64;
1325                 if (delta > len)
1326                         delta = len;
1327
1328                 req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1329                 req.bRequest = RT2870_WRITE_REGION_1;
1330                 USETW(req.wValue, 0);
1331                 USETW(req.wIndex, reg);
1332                 USETW(req.wLength, delta);
1333                 error = run_do_request(sc, &req, __DECONST(uint8_t *, buf));
1334                 if (error != 0)
1335                         break;
1336                 reg += delta;
1337                 buf += delta;
1338                 len -= delta;
1339         }
1340         return (error);
1341 #endif
1342 }
1343
1344 static int
1345 run_set_region_4(struct run_softc *sc, uint16_t reg, uint32_t val, int len)
1346 {
1347         int i, error = 0;
1348
1349         KASSERT((len & 3) == 0, ("run_set_region_4: Invalid data length.\n"));
1350         for (i = 0; i < len && error == 0; i += 4)
1351                 error = run_write(sc, reg + i, val);
1352         return (error);
1353 }
1354
1355 static int
1356 run_efuse_read(struct run_softc *sc, uint16_t addr, uint16_t *val, int count)
1357 {
1358         uint32_t tmp;
1359         uint16_t reg;
1360         int error, ntries;
1361
1362         if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1363                 return (error);
1364
1365         if (count == 2)
1366                 addr *= 2;
1367         /*-
1368          * Read one 16-byte block into registers EFUSE_DATA[0-3]:
1369          * DATA0: F E D C
1370          * DATA1: B A 9 8
1371          * DATA2: 7 6 5 4
1372          * DATA3: 3 2 1 0
1373          */
1374         tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
1375         tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
1376         run_write(sc, RT3070_EFUSE_CTRL, tmp);
1377         for (ntries = 0; ntries < 100; ntries++) {
1378                 if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1379                         return (error);
1380                 if (!(tmp & RT3070_EFSROM_KICK))
1381                         break;
1382                 run_delay(sc, 2);
1383         }
1384         if (ntries == 100)
1385                 return (ETIMEDOUT);
1386
1387         if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK) {
1388                 *val = 0xffff;  /* address not found */
1389                 return (0);
1390         }
1391         /* determine to which 32-bit register our 16-bit word belongs */
1392         reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1393         if ((error = run_read(sc, reg, &tmp)) != 0)
1394                 return (error);
1395
1396         tmp >>= (8 * (addr & 0x3));
1397         *val = (addr & 1) ? tmp >> 16 : tmp & 0xffff;
1398
1399         return (0);
1400 }
1401
1402 /* Read 16-bit from eFUSE ROM for RT3xxx. */
1403 static int
1404 run_efuse_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1405 {
1406         return (run_efuse_read(sc, addr, val, 2));
1407 }
1408
1409 static int
1410 run_eeprom_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1411 {
1412         usb_device_request_t req;
1413         uint16_t tmp;
1414         int error;
1415
1416         addr *= 2;
1417         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1418         req.bRequest = RT2870_EEPROM_READ;
1419         USETW(req.wValue, 0);
1420         USETW(req.wIndex, addr);
1421         USETW(req.wLength, sizeof(tmp));
1422
1423         error = usbd_do_request(sc->sc_udev, &sc->sc_lock, &req, &tmp);
1424         if (error == 0)
1425                 *val = le16toh(tmp);
1426         else
1427                 *val = 0xffff;
1428         return (error);
1429 }
1430
1431 static __inline int
1432 run_srom_read(struct run_softc *sc, uint16_t addr, uint16_t *val)
1433 {
1434         /* either eFUSE ROM or EEPROM */
1435         return sc->sc_srom_read(sc, addr, val);
1436 }
1437
1438 static int
1439 run_rt2870_rf_write(struct run_softc *sc, uint32_t val)
1440 {
1441         uint32_t tmp;
1442         int error, ntries;
1443
1444         for (ntries = 0; ntries < 10; ntries++) {
1445                 if ((error = run_read(sc, RT2860_RF_CSR_CFG0, &tmp)) != 0)
1446                         return (error);
1447                 if (!(tmp & RT2860_RF_REG_CTRL))
1448                         break;
1449         }
1450         if (ntries == 10)
1451                 return (ETIMEDOUT);
1452
1453         return (run_write(sc, RT2860_RF_CSR_CFG0, val));
1454 }
1455
1456 static int
1457 run_rt3070_rf_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1458 {
1459         uint32_t tmp;
1460         int error, ntries;
1461
1462         for (ntries = 0; ntries < 100; ntries++) {
1463                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1464                         return (error);
1465                 if (!(tmp & RT3070_RF_KICK))
1466                         break;
1467         }
1468         if (ntries == 100)
1469                 return (ETIMEDOUT);
1470
1471         tmp = RT3070_RF_KICK | reg << 8;
1472         if ((error = run_write(sc, RT3070_RF_CSR_CFG, tmp)) != 0)
1473                 return (error);
1474
1475         for (ntries = 0; ntries < 100; ntries++) {
1476                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1477                         return (error);
1478                 if (!(tmp & RT3070_RF_KICK))
1479                         break;
1480         }
1481         if (ntries == 100)
1482                 return (ETIMEDOUT);
1483
1484         *val = tmp & 0xff;
1485         return (0);
1486 }
1487
1488 static int
1489 run_rt3070_rf_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1490 {
1491         uint32_t tmp;
1492         int error, ntries;
1493
1494         for (ntries = 0; ntries < 10; ntries++) {
1495                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1496                         return (error);
1497                 if (!(tmp & RT3070_RF_KICK))
1498                         break;
1499         }
1500         if (ntries == 10)
1501                 return (ETIMEDOUT);
1502
1503         tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
1504         return (run_write(sc, RT3070_RF_CSR_CFG, tmp));
1505 }
1506
1507 static int
1508 run_bbp_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1509 {
1510         uint32_t tmp;
1511         int ntries, error;
1512
1513         for (ntries = 0; ntries < 10; ntries++) {
1514                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1515                         return (error);
1516                 if (!(tmp & RT2860_BBP_CSR_KICK))
1517                         break;
1518         }
1519         if (ntries == 10)
1520                 return (ETIMEDOUT);
1521
1522         tmp = RT2860_BBP_CSR_READ | RT2860_BBP_CSR_KICK | reg << 8;
1523         if ((error = run_write(sc, RT2860_BBP_CSR_CFG, tmp)) != 0)
1524                 return (error);
1525
1526         for (ntries = 0; ntries < 10; ntries++) {
1527                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1528                         return (error);
1529                 if (!(tmp & RT2860_BBP_CSR_KICK))
1530                         break;
1531         }
1532         if (ntries == 10)
1533                 return (ETIMEDOUT);
1534
1535         *val = tmp & 0xff;
1536         return (0);
1537 }
1538
1539 static int
1540 run_bbp_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1541 {
1542         uint32_t tmp;
1543         int ntries, error;
1544
1545         for (ntries = 0; ntries < 10; ntries++) {
1546                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1547                         return (error);
1548                 if (!(tmp & RT2860_BBP_CSR_KICK))
1549                         break;
1550         }
1551         if (ntries == 10)
1552                 return (ETIMEDOUT);
1553
1554         tmp = RT2860_BBP_CSR_KICK | reg << 8 | val;
1555         return (run_write(sc, RT2860_BBP_CSR_CFG, tmp));
1556 }
1557
1558 /*
1559  * Send a command to the 8051 microcontroller unit.
1560  */
1561 static int
1562 run_mcu_cmd(struct run_softc *sc, uint8_t cmd, uint16_t arg)
1563 {
1564         uint32_t tmp;
1565         int error, ntries;
1566
1567         for (ntries = 0; ntries < 100; ntries++) {
1568                 if ((error = run_read(sc, RT2860_H2M_MAILBOX, &tmp)) != 0)
1569                         return error;
1570                 if (!(tmp & RT2860_H2M_BUSY))
1571                         break;
1572         }
1573         if (ntries == 100)
1574                 return ETIMEDOUT;
1575
1576         tmp = RT2860_H2M_BUSY | RT2860_TOKEN_NO_INTR << 16 | arg;
1577         if ((error = run_write(sc, RT2860_H2M_MAILBOX, tmp)) == 0)
1578                 error = run_write(sc, RT2860_HOST_CMD, cmd);
1579         return (error);
1580 }
1581
1582 /*
1583  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
1584  * Used to adjust per-rate Tx power registers.
1585  */
1586 static __inline uint32_t
1587 b4inc(uint32_t b32, int8_t delta)
1588 {
1589         int8_t i, b4;
1590
1591         for (i = 0; i < 8; i++) {
1592                 b4 = b32 & 0xf;
1593                 b4 += delta;
1594                 if (b4 < 0)
1595                         b4 = 0;
1596                 else if (b4 > 0xf)
1597                         b4 = 0xf;
1598                 b32 = b32 >> 4 | b4 << 28;
1599         }
1600         return (b32);
1601 }
1602
1603 static const char *
1604 run_get_rf(uint16_t rev)
1605 {
1606         switch (rev) {
1607         case RT2860_RF_2820:    return "RT2820";
1608         case RT2860_RF_2850:    return "RT2850";
1609         case RT2860_RF_2720:    return "RT2720";
1610         case RT2860_RF_2750:    return "RT2750";
1611         case RT3070_RF_3020:    return "RT3020";
1612         case RT3070_RF_2020:    return "RT2020";
1613         case RT3070_RF_3021:    return "RT3021";
1614         case RT3070_RF_3022:    return "RT3022";
1615         case RT3070_RF_3052:    return "RT3052";
1616         case RT3593_RF_3053:    return "RT3053";
1617         case RT5592_RF_5592:    return "RT5592";
1618         case RT5390_RF_5370:    return "RT5370";
1619         case RT5390_RF_5372:    return "RT5372";
1620         }
1621         return ("unknown");
1622 }
1623
1624 static void
1625 run_rt3593_get_txpower(struct run_softc *sc)
1626 {
1627         uint16_t addr, val;
1628         int i;
1629
1630         /* Read power settings for 2GHz channels. */
1631         for (i = 0; i < 14; i += 2) {
1632                 addr = (sc->ntxchains == 3) ? RT3593_EEPROM_PWR2GHZ_BASE1 :
1633                     RT2860_EEPROM_PWR2GHZ_BASE1;
1634                 run_srom_read(sc, addr + i / 2, &val);
1635                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1636                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1637
1638                 addr = (sc->ntxchains == 3) ? RT3593_EEPROM_PWR2GHZ_BASE2 :
1639                     RT2860_EEPROM_PWR2GHZ_BASE2;
1640                 run_srom_read(sc, addr + i / 2, &val);
1641                 sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1642                 sc->txpow2[i + 1] = (int8_t)(val >> 8);
1643
1644                 if (sc->ntxchains == 3) {
1645                         run_srom_read(sc, RT3593_EEPROM_PWR2GHZ_BASE3 + i / 2,
1646                             &val);
1647                         sc->txpow3[i + 0] = (int8_t)(val & 0xff);
1648                         sc->txpow3[i + 1] = (int8_t)(val >> 8);
1649                 }
1650         }
1651         /* Fix broken Tx power entries. */
1652         for (i = 0; i < 14; i++) {
1653                 if (sc->txpow1[i] > 31)
1654                         sc->txpow1[i] = 5;
1655                 if (sc->txpow2[i] > 31)
1656                         sc->txpow2[i] = 5;
1657                 if (sc->ntxchains == 3) {
1658                         if (sc->txpow3[i] > 31)
1659                                 sc->txpow3[i] = 5;
1660                 }
1661         }
1662         /* Read power settings for 5GHz channels. */
1663         for (i = 0; i < 40; i += 2) {
1664                 run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1665                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1666                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1667
1668                 run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1669                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1670                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1671
1672                 if (sc->ntxchains == 3) {
1673                         run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE3 + i / 2,
1674                             &val);
1675                         sc->txpow3[i + 14] = (int8_t)(val & 0xff);
1676                         sc->txpow3[i + 15] = (int8_t)(val >> 8);
1677                 }
1678         }
1679 }
1680
1681 static void
1682 run_get_txpower(struct run_softc *sc)
1683 {
1684         uint16_t val;
1685         int i;
1686
1687         /* Read power settings for 2GHz channels. */
1688         for (i = 0; i < 14; i += 2) {
1689                 run_srom_read(sc, RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2, &val);
1690                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1691                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1692
1693                 if (sc->mac_ver != 0x5390) {
1694                         run_srom_read(sc,
1695                             RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2, &val);
1696                         sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1697                         sc->txpow2[i + 1] = (int8_t)(val >> 8);
1698                 }
1699         }
1700         /* Fix broken Tx power entries. */
1701         for (i = 0; i < 14; i++) {
1702                 if (sc->mac_ver >= 0x5390) {
1703                         if (sc->txpow1[i] < 0 || sc->txpow1[i] > 27)
1704                                 sc->txpow1[i] = 5;
1705                 } else {
1706                         if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
1707                                 sc->txpow1[i] = 5;
1708                 }
1709                 if (sc->mac_ver > 0x5390) {
1710                         if (sc->txpow2[i] < 0 || sc->txpow2[i] > 27)
1711                                 sc->txpow2[i] = 5;
1712                 } else if (sc->mac_ver < 0x5390) {
1713                         if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
1714                                 sc->txpow2[i] = 5;
1715                 }
1716                 DPRINTF("chan %d: power1=%d, power2=%d\n",
1717                     rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]);
1718         }
1719         /* Read power settings for 5GHz channels. */
1720         for (i = 0; i < 40; i += 2) {
1721                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1722                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1723                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1724
1725                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1726                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1727                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1728         }
1729         /* Fix broken Tx power entries. */
1730         for (i = 0; i < 40; i++ ) {
1731                 if (sc->mac_ver != 0x5592) {
1732                         if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
1733                                 sc->txpow1[14 + i] = 5;
1734                         if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
1735                                 sc->txpow2[14 + i] = 5;
1736                 }
1737                 DPRINTF("chan %d: power1=%d, power2=%d\n",
1738                     rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
1739                     sc->txpow2[14 + i]);
1740         }
1741 }
1742
1743 static int
1744 run_read_eeprom(struct run_softc *sc)
1745 {
1746         int8_t delta_2ghz, delta_5ghz;
1747         uint32_t tmp;
1748         uint16_t val;
1749         int ridx, ant, i;
1750
1751         /* check whether the ROM is eFUSE ROM or EEPROM */
1752         sc->sc_srom_read = run_eeprom_read_2;
1753         if (sc->mac_ver >= 0x3070) {
1754                 run_read(sc, RT3070_EFUSE_CTRL, &tmp);
1755                 DPRINTF("EFUSE_CTRL=0x%08x\n", tmp);
1756                 if ((tmp & RT3070_SEL_EFUSE) || sc->mac_ver == 0x3593)
1757                         sc->sc_srom_read = run_efuse_read_2;
1758         }
1759
1760         /* read ROM version */
1761         run_srom_read(sc, RT2860_EEPROM_VERSION, &val);
1762         DPRINTF("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8);
1763
1764         /* read MAC address */
1765         run_srom_read(sc, RT2860_EEPROM_MAC01, &val);
1766         sc->sc_bssid[0] = val & 0xff;
1767         sc->sc_bssid[1] = val >> 8;
1768         run_srom_read(sc, RT2860_EEPROM_MAC23, &val);
1769         sc->sc_bssid[2] = val & 0xff;
1770         sc->sc_bssid[3] = val >> 8;
1771         run_srom_read(sc, RT2860_EEPROM_MAC45, &val);
1772         sc->sc_bssid[4] = val & 0xff;
1773         sc->sc_bssid[5] = val >> 8;
1774
1775         if (sc->mac_ver < 0x3593) {
1776                 /* read vender BBP settings */
1777                 for (i = 0; i < 10; i++) {
1778                         run_srom_read(sc, RT2860_EEPROM_BBP_BASE + i, &val);
1779                         sc->bbp[i].val = val & 0xff;
1780                         sc->bbp[i].reg = val >> 8;
1781                         DPRINTF("BBP%d=0x%02x\n", sc->bbp[i].reg,
1782                             sc->bbp[i].val);
1783                 }
1784                 if (sc->mac_ver >= 0x3071) {
1785                         /* read vendor RF settings */
1786                         for (i = 0; i < 10; i++) {
1787                                 run_srom_read(sc, RT3071_EEPROM_RF_BASE + i,
1788                                    &val);
1789                                 sc->rf[i].val = val & 0xff;
1790                                 sc->rf[i].reg = val >> 8;
1791                                 DPRINTF("RF%d=0x%02x\n", sc->rf[i].reg,
1792                                     sc->rf[i].val);
1793                         }
1794                 }
1795         }
1796
1797         /* read RF frequency offset from EEPROM */
1798         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_FREQ_LEDS :
1799             RT3593_EEPROM_FREQ, &val);
1800         sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
1801         DPRINTF("EEPROM freq offset %d\n", sc->freq & 0xff);
1802
1803         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_FREQ_LEDS :
1804             RT3593_EEPROM_FREQ_LEDS, &val);
1805         if (val >> 8 != 0xff) {
1806                 /* read LEDs operating mode */
1807                 sc->leds = val >> 8;
1808                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED1 :
1809                     RT3593_EEPROM_LED1, &sc->led[0]);
1810                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED2 :
1811                     RT3593_EEPROM_LED2, &sc->led[1]);
1812                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED3 :
1813                     RT3593_EEPROM_LED3, &sc->led[2]);
1814         } else {
1815                 /* broken EEPROM, use default settings */
1816                 sc->leds = 0x01;
1817                 sc->led[0] = 0x5555;
1818                 sc->led[1] = 0x2221;
1819                 sc->led[2] = 0x5627;    /* differs from RT2860 */
1820         }
1821         DPRINTF("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
1822             sc->leds, sc->led[0], sc->led[1], sc->led[2]);
1823
1824         /* read RF information */
1825         if (sc->mac_ver == 0x5390 || sc->mac_ver ==0x5392)
1826                 run_srom_read(sc, 0x00, &val);
1827         else
1828                 run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1829
1830         if (val == 0xffff) {
1831                 device_printf(sc->sc_dev,
1832                     "invalid EEPROM antenna info, using default\n");
1833                 DPRINTF("invalid EEPROM antenna info, using default\n");
1834                 if (sc->mac_ver == 0x3572) {
1835                         /* default to RF3052 2T2R */
1836                         sc->rf_rev = RT3070_RF_3052;
1837                         sc->ntxchains = 2;
1838                         sc->nrxchains = 2;
1839                 } else if (sc->mac_ver >= 0x3070) {
1840                         /* default to RF3020 1T1R */
1841                         sc->rf_rev = RT3070_RF_3020;
1842                         sc->ntxchains = 1;
1843                         sc->nrxchains = 1;
1844                 } else {
1845                         /* default to RF2820 1T2R */
1846                         sc->rf_rev = RT2860_RF_2820;
1847                         sc->ntxchains = 1;
1848                         sc->nrxchains = 2;
1849                 }
1850         } else {
1851                 if (sc->mac_ver == 0x5390 || sc->mac_ver ==0x5392) {
1852                         sc->rf_rev = val;
1853                         run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1854                 } else
1855                         sc->rf_rev = (val >> 8) & 0xf;
1856                 sc->ntxchains = (val >> 4) & 0xf;
1857                 sc->nrxchains = val & 0xf;
1858         }
1859         DPRINTF("EEPROM RF rev=0x%04x chains=%dT%dR\n",
1860             sc->rf_rev, sc->ntxchains, sc->nrxchains);
1861
1862         /* check if RF supports automatic Tx access gain control */
1863         run_srom_read(sc, RT2860_EEPROM_CONFIG, &val);
1864         DPRINTF("EEPROM CFG 0x%04x\n", val);
1865         /* check if driver should patch the DAC issue */
1866         if ((val >> 8) != 0xff)
1867                 sc->patch_dac = (val >> 15) & 1;
1868         if ((val & 0xff) != 0xff) {
1869                 sc->ext_5ghz_lna = (val >> 3) & 1;
1870                 sc->ext_2ghz_lna = (val >> 2) & 1;
1871                 /* check if RF supports automatic Tx access gain control */
1872                 sc->calib_2ghz = sc->calib_5ghz = (val >> 1) & 1;
1873                 /* check if we have a hardware radio switch */
1874                 sc->rfswitch = val & 1;
1875         }
1876
1877         /* Read Tx power settings. */
1878         if (sc->mac_ver == 0x3593)
1879                 run_rt3593_get_txpower(sc);
1880         else
1881                 run_get_txpower(sc);
1882
1883         /* read Tx power compensation for each Tx rate */
1884         run_srom_read(sc, RT2860_EEPROM_DELTAPWR, &val);
1885         delta_2ghz = delta_5ghz = 0;
1886         if ((val & 0xff) != 0xff && (val & 0x80)) {
1887                 delta_2ghz = val & 0xf;
1888                 if (!(val & 0x40))      /* negative number */
1889                         delta_2ghz = -delta_2ghz;
1890         }
1891         val >>= 8;
1892         if ((val & 0xff) != 0xff && (val & 0x80)) {
1893                 delta_5ghz = val & 0xf;
1894                 if (!(val & 0x40))      /* negative number */
1895                         delta_5ghz = -delta_5ghz;
1896         }
1897         DPRINTF("power compensation=%d (2GHz), %d (5GHz)\n",
1898             delta_2ghz, delta_5ghz);
1899
1900         for (ridx = 0; ridx < 5; ridx++) {
1901                 uint32_t reg;
1902
1903                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2, &val);
1904                 reg = val;
1905                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1, &val);
1906                 reg |= (uint32_t)val << 16;
1907
1908                 sc->txpow20mhz[ridx] = reg;
1909                 sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
1910                 sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
1911
1912                 DPRINTF("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
1913                     "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
1914                     sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]);
1915         }
1916
1917         /* Read RSSI offsets and LNA gains from EEPROM. */
1918         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI1_2GHZ :
1919             RT3593_EEPROM_RSSI1_2GHZ, &val);
1920         sc->rssi_2ghz[0] = val & 0xff;  /* Ant A */
1921         sc->rssi_2ghz[1] = val >> 8;    /* Ant B */
1922         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI2_2GHZ :
1923             RT3593_EEPROM_RSSI2_2GHZ, &val);
1924         if (sc->mac_ver >= 0x3070) {
1925                 if (sc->mac_ver == 0x3593) {
1926                         sc->txmixgain_2ghz = 0;
1927                         sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1928                 } else {
1929                         /*
1930                          * On RT3070 chips (limited to 2 Rx chains), this ROM
1931                          * field contains the Tx mixer gain for the 2GHz band.
1932                          */
1933                         if ((val & 0xff) != 0xff)
1934                                 sc->txmixgain_2ghz = val & 0x7;
1935                 }
1936                 DPRINTF("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz);
1937         } else
1938                 sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1939         if (sc->mac_ver == 0x3593)
1940                 run_srom_read(sc, RT3593_EEPROM_LNA_5GHZ, &val);
1941         sc->lna[2] = val >> 8;          /* channel group 2 */
1942
1943         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI1_5GHZ :
1944             RT3593_EEPROM_RSSI1_5GHZ, &val);
1945         sc->rssi_5ghz[0] = val & 0xff;  /* Ant A */
1946         sc->rssi_5ghz[1] = val >> 8;    /* Ant B */
1947         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI2_5GHZ :
1948             RT3593_EEPROM_RSSI2_5GHZ, &val);
1949         if (sc->mac_ver == 0x3572) {
1950                 /*
1951                  * On RT3572 chips (limited to 2 Rx chains), this ROM
1952                  * field contains the Tx mixer gain for the 5GHz band.
1953                  */
1954                 if ((val & 0xff) != 0xff)
1955                         sc->txmixgain_5ghz = val & 0x7;
1956                 DPRINTF("tx mixer gain=%u (5GHz)\n", sc->txmixgain_5ghz);
1957         } else
1958                 sc->rssi_5ghz[2] = val & 0xff;  /* Ant C */
1959         if (sc->mac_ver == 0x3593) {
1960                 sc->txmixgain_5ghz = 0;
1961                 run_srom_read(sc, RT3593_EEPROM_LNA_5GHZ, &val);
1962         }
1963         sc->lna[3] = val >> 8;          /* channel group 3 */
1964
1965         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LNA :
1966             RT3593_EEPROM_LNA, &val);
1967         sc->lna[0] = val & 0xff;        /* channel group 0 */
1968         sc->lna[1] = val >> 8;          /* channel group 1 */
1969
1970         /* fix broken 5GHz LNA entries */
1971         if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
1972                 DPRINTF("invalid LNA for channel group %d\n", 2);
1973                 sc->lna[2] = sc->lna[1];
1974         }
1975         if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
1976                 DPRINTF("invalid LNA for channel group %d\n", 3);
1977                 sc->lna[3] = sc->lna[1];
1978         }
1979
1980         /* fix broken RSSI offset entries */
1981         for (ant = 0; ant < 3; ant++) {
1982                 if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
1983                         DPRINTF("invalid RSSI%d offset: %d (2GHz)\n",
1984                             ant + 1, sc->rssi_2ghz[ant]);
1985                         sc->rssi_2ghz[ant] = 0;
1986                 }
1987                 if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
1988                         DPRINTF("invalid RSSI%d offset: %d (5GHz)\n",
1989                             ant + 1, sc->rssi_5ghz[ant]);
1990                         sc->rssi_5ghz[ant] = 0;
1991                 }
1992         }
1993         return (0);
1994 }
1995
1996 static struct ieee80211_node *
1997 run_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
1998 {
1999         return kmalloc(sizeof (struct run_node), M_DEVBUF, M_WAITOK | M_ZERO);
2000 }
2001
2002 static int
2003 run_media_change(struct ifnet *ifp)
2004 {
2005         struct ieee80211vap *vap = ifp->if_softc;
2006         struct ieee80211com *ic = vap->iv_ic;
2007         const struct ieee80211_txparam *tp;
2008         struct run_softc *sc = ic->ic_ifp->if_softc;
2009         uint8_t rate, ridx;
2010         int error;
2011
2012         RUN_LOCK(sc);
2013
2014         error = ieee80211_media_change(ifp);
2015         if (error != ENETRESET) {
2016                 RUN_UNLOCK(sc);
2017                 return (error);
2018         }
2019
2020         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2021         if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
2022                 struct ieee80211_node *ni;
2023                 struct run_node *rn;
2024
2025                 rate = ic->ic_sup_rates[ic->ic_curmode].
2026                     rs_rates[tp->ucastrate] & IEEE80211_RATE_VAL;
2027                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2028                         if (rt2860_rates[ridx].rate == rate)
2029                                 break;
2030                 ni = ieee80211_ref_node(vap->iv_bss);
2031                 rn = (struct run_node *)ni;
2032                 rn->fix_ridx = ridx;
2033                 DPRINTF("rate=%d, fix_ridx=%d\n", rate, rn->fix_ridx);
2034                 ieee80211_free_node(ni);
2035         }
2036
2037 #if 0
2038         if ((ifp->if_flags & IFF_UP) &&
2039             (ifp->if_flags &  IFF_RUNNING)){
2040                 run_init_locked(sc);
2041         }
2042 #endif
2043
2044         RUN_UNLOCK(sc);
2045
2046         return (0);
2047 }
2048
2049 static int
2050 run_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2051 {
2052         const struct ieee80211_txparam *tp;
2053         struct ieee80211com *ic = vap->iv_ic;
2054         struct run_softc *sc = ic->ic_ifp->if_softc;
2055         struct run_vap *rvp = RUN_VAP(vap);
2056         enum ieee80211_state ostate;
2057         uint32_t sta[3];
2058         uint32_t tmp;
2059         uint8_t ratectl;
2060         uint8_t restart_ratectl = 0;
2061         uint8_t bid = 1 << rvp->rvp_id;
2062
2063         ostate = vap->iv_state;
2064         DPRINTF("%s -> %s\n",
2065                 ieee80211_state_name[ostate],
2066                 ieee80211_state_name[nstate]);
2067
2068         RUN_LOCK(sc);
2069
2070         ratectl = sc->ratectl_run; /* remember current state */
2071         sc->ratectl_run = RUN_RATECTL_OFF;
2072         usb_callout_stop(&sc->ratectl_ch);
2073
2074         if (ostate == IEEE80211_S_RUN) {
2075                 /* turn link LED off */
2076                 run_set_leds(sc, RT2860_LED_RADIO);
2077         }
2078
2079         switch (nstate) {
2080         case IEEE80211_S_INIT:
2081                 restart_ratectl = 1;
2082
2083                 if (ostate != IEEE80211_S_RUN)
2084                         break;
2085
2086                 ratectl &= ~bid;
2087                 sc->runbmap &= ~bid;
2088
2089                 /* abort TSF synchronization if there is no vap running */
2090                 if (--sc->running == 0) {
2091                         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
2092                         run_write(sc, RT2860_BCN_TIME_CFG,
2093                             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
2094                             RT2860_TBTT_TIMER_EN));
2095                 }
2096                 break;
2097
2098         case IEEE80211_S_RUN:
2099                 if (!(sc->runbmap & bid)) {
2100                         if(sc->running++)
2101                                 restart_ratectl = 1;
2102                         sc->runbmap |= bid;
2103                 }
2104
2105                 m_freem(rvp->beacon_mbuf);
2106                 rvp->beacon_mbuf = NULL;
2107
2108                 switch (vap->iv_opmode) {
2109                 case IEEE80211_M_HOSTAP:
2110                 case IEEE80211_M_MBSS:
2111                         sc->ap_running |= bid;
2112                         ic->ic_opmode = vap->iv_opmode;
2113                         run_update_beacon_cb(vap);
2114                         break;
2115                 case IEEE80211_M_IBSS:
2116                         sc->adhoc_running |= bid;
2117                         if (!sc->ap_running)
2118                                 ic->ic_opmode = vap->iv_opmode;
2119                         run_update_beacon_cb(vap);
2120                         break;
2121                 case IEEE80211_M_STA:
2122                         sc->sta_running |= bid;
2123                         if (!sc->ap_running && !sc->adhoc_running)
2124                                 ic->ic_opmode = vap->iv_opmode;
2125
2126                         /* read statistic counters (clear on read) */
2127                         run_read_region_1(sc, RT2860_TX_STA_CNT0,
2128                             (uint8_t *)sta, sizeof sta);
2129
2130                         break;
2131                 default:
2132                         ic->ic_opmode = vap->iv_opmode;
2133                         break;
2134                 }
2135
2136                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
2137                         struct ieee80211_node *ni;
2138
2139                         if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) {
2140                                 RUN_UNLOCK(sc);
2141                                 return (-1);
2142                         }
2143                         run_updateslot(ic);
2144                         run_enable_mrr(sc);
2145                         run_set_txpreamble(sc);
2146                         run_set_basicrates(sc);
2147                         ni = ieee80211_ref_node(vap->iv_bss);
2148                         IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
2149                         run_set_bssid(sc, ni->ni_bssid);
2150                         ieee80211_free_node(ni);
2151                         run_enable_tsf_sync(sc);
2152
2153                         /* enable automatic rate adaptation */
2154                         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2155                         if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
2156                                 ratectl |= bid;
2157                 }
2158
2159                 /* turn link LED on */
2160                 run_set_leds(sc, RT2860_LED_RADIO |
2161                     (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan) ?
2162                      RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
2163
2164                 break;
2165         default:
2166                 DPRINTFN(6, "undefined case\n");
2167                 break;
2168         }
2169
2170         /* restart amrr for running VAPs */
2171         if ((sc->ratectl_run = ratectl) && restart_ratectl)
2172                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2173
2174         RUN_UNLOCK(sc);
2175
2176         return(rvp->newstate(vap, nstate, arg));
2177 }
2178
2179 /* ARGSUSED */
2180 static void
2181 run_wme_update_cb(void *arg)
2182 {
2183         struct ieee80211com *ic = arg;
2184         struct run_softc *sc = ic->ic_ifp->if_softc;
2185         struct ieee80211_wme_state *wmesp = &ic->ic_wme;
2186         int aci, error = 0;
2187
2188         RUN_LOCK_ASSERT(sc, MA_OWNED);
2189
2190         /* update MAC TX configuration registers */
2191         for (aci = 0; aci < WME_NUM_AC; aci++) {
2192                 error = run_write(sc, RT2860_EDCA_AC_CFG(aci),
2193                     wmesp->wme_params[aci].wmep_logcwmax << 16 |
2194                     wmesp->wme_params[aci].wmep_logcwmin << 12 |
2195                     wmesp->wme_params[aci].wmep_aifsn  <<  8 |
2196                     wmesp->wme_params[aci].wmep_txopLimit);
2197                 if (error) goto err;
2198         }
2199
2200         /* update SCH/DMA registers too */
2201         error = run_write(sc, RT2860_WMM_AIFSN_CFG,
2202             wmesp->wme_params[WME_AC_VO].wmep_aifsn  << 12 |
2203             wmesp->wme_params[WME_AC_VI].wmep_aifsn  <<  8 |
2204             wmesp->wme_params[WME_AC_BK].wmep_aifsn  <<  4 |
2205             wmesp->wme_params[WME_AC_BE].wmep_aifsn);
2206         if (error) goto err;
2207         error = run_write(sc, RT2860_WMM_CWMIN_CFG,
2208             wmesp->wme_params[WME_AC_VO].wmep_logcwmin << 12 |
2209             wmesp->wme_params[WME_AC_VI].wmep_logcwmin <<  8 |
2210             wmesp->wme_params[WME_AC_BK].wmep_logcwmin <<  4 |
2211             wmesp->wme_params[WME_AC_BE].wmep_logcwmin);
2212         if (error) goto err;
2213         error = run_write(sc, RT2860_WMM_CWMAX_CFG,
2214             wmesp->wme_params[WME_AC_VO].wmep_logcwmax << 12 |
2215             wmesp->wme_params[WME_AC_VI].wmep_logcwmax <<  8 |
2216             wmesp->wme_params[WME_AC_BK].wmep_logcwmax <<  4 |
2217             wmesp->wme_params[WME_AC_BE].wmep_logcwmax);
2218         if (error) goto err;
2219         error = run_write(sc, RT2860_WMM_TXOP0_CFG,
2220             wmesp->wme_params[WME_AC_BK].wmep_txopLimit << 16 |
2221             wmesp->wme_params[WME_AC_BE].wmep_txopLimit);
2222         if (error) goto err;
2223         error = run_write(sc, RT2860_WMM_TXOP1_CFG,
2224             wmesp->wme_params[WME_AC_VO].wmep_txopLimit << 16 |
2225             wmesp->wme_params[WME_AC_VI].wmep_txopLimit);
2226
2227 err:
2228         if (error)
2229                 DPRINTF("WME update failed\n");
2230
2231         return;
2232 }
2233
2234 static int
2235 run_wme_update(struct ieee80211com *ic)
2236 {
2237         struct run_softc *sc = ic->ic_ifp->if_softc;
2238
2239 #if defined(__DragonFly__)
2240         if (lockstatus(&ic->ic_comlock, curthread) == LK_EXCLUSIVE) {
2241 #else
2242         if (mtx_owned(&ic->ic_comlock.mtx)) {
2243 #endif
2244                 uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
2245                 DPRINTF("cmdq_store=%d\n", i);
2246                 sc->cmdq[i].func = run_wme_update_cb;
2247                 sc->cmdq[i].arg0 = ic;
2248                 ieee80211_runtask(ic, &sc->cmdq_task);
2249                 return (0);
2250         }
2251
2252         RUN_LOCK(sc);
2253         run_wme_update_cb(ic);
2254         RUN_UNLOCK(sc);
2255
2256         /* return whatever, upper layer desn't care anyway */
2257         return (0);
2258 }
2259
2260 static void
2261 run_key_update_begin(struct ieee80211vap *vap)
2262 {
2263         /*
2264          * To avoid out-of-order events, both run_key_set() and
2265          * _delete() are deferred and handled by run_cmdq_cb().
2266          * So, there is nothing we need to do here.
2267          */
2268 }
2269
2270 static void
2271 run_key_update_end(struct ieee80211vap *vap)
2272 {
2273         /* null */
2274 }
2275
2276 static void
2277 run_key_set_cb(void *arg)
2278 {
2279         struct run_cmdq *cmdq = arg;
2280         struct ieee80211vap *vap = cmdq->arg1;
2281         struct ieee80211_key *k = cmdq->k;
2282         struct ieee80211com *ic = vap->iv_ic;
2283         struct run_softc *sc = ic->ic_ifp->if_softc;
2284         struct ieee80211_node *ni;
2285         uint32_t attr;
2286         uint16_t base, associd;
2287         uint8_t mode, wcid, iv[8];
2288
2289         RUN_LOCK_ASSERT(sc, MA_OWNED);
2290
2291         if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2292                 ni = ieee80211_find_vap_node(&ic->ic_sta, vap, cmdq->mac);
2293         else
2294                 ni = vap->iv_bss;
2295         associd = (ni != NULL) ? ni->ni_associd : 0;
2296
2297         /* map net80211 cipher to RT2860 security mode */
2298         switch (k->wk_cipher->ic_cipher) {
2299         case IEEE80211_CIPHER_WEP:
2300                 if(k->wk_keylen < 8)
2301                         mode = RT2860_MODE_WEP40;
2302                 else
2303                         mode = RT2860_MODE_WEP104;
2304                 break;
2305         case IEEE80211_CIPHER_TKIP:
2306                 mode = RT2860_MODE_TKIP;
2307                 break;
2308         case IEEE80211_CIPHER_AES_CCM:
2309                 mode = RT2860_MODE_AES_CCMP;
2310                 break;
2311         default:
2312                 DPRINTF("undefined case\n");
2313                 return;
2314         }
2315
2316         DPRINTFN(1, "associd=%x, keyix=%d, mode=%x, type=%s, tx=%s, rx=%s\n",
2317             associd, k->wk_keyix, mode,
2318             (k->wk_flags & IEEE80211_KEY_GROUP) ? "group" : "pairwise",
2319             (k->wk_flags & IEEE80211_KEY_XMIT) ? "on" : "off",
2320             (k->wk_flags & IEEE80211_KEY_RECV) ? "on" : "off");
2321
2322         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2323                 wcid = 0;       /* NB: update WCID0 for group keys */
2324                 base = RT2860_SKEY(RUN_VAP(vap)->rvp_id, k->wk_keyix);
2325         } else {
2326                 wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
2327                     1 : RUN_AID2WCID(associd);
2328                 base = RT2860_PKEY(wcid);
2329         }
2330
2331         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
2332                 if(run_write_region_1(sc, base, k->wk_key, 16))
2333                         return;
2334                 if(run_write_region_1(sc, base + 16, &k->wk_key[16], 8))        /* wk_txmic */
2335                         return;
2336                 if(run_write_region_1(sc, base + 24, &k->wk_key[24], 8))        /* wk_rxmic */
2337                         return;
2338         } else {
2339                 /* roundup len to 16-bit: XXX fix write_region_1() instead */
2340                 if(run_write_region_1(sc, base, k->wk_key, (k->wk_keylen + 1) & ~1))
2341                         return;
2342         }
2343
2344         if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
2345             (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))) {
2346                 /* set initial packet number in IV+EIV */
2347                 if (k->wk_cipher == IEEE80211_CIPHER_WEP) {
2348                         memset(iv, 0, sizeof iv);
2349                         iv[3] = vap->iv_def_txkey << 6;
2350                 } else {
2351                         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
2352                                 iv[0] = k->wk_keytsc >> 8;
2353                                 iv[1] = (iv[0] | 0x20) & 0x7f;
2354                                 iv[2] = k->wk_keytsc;
2355                         } else /* CCMP */ {
2356                                 iv[0] = k->wk_keytsc;
2357                                 iv[1] = k->wk_keytsc >> 8;
2358                                 iv[2] = 0;
2359                         }
2360                         iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
2361                         iv[4] = k->wk_keytsc >> 16;
2362                         iv[5] = k->wk_keytsc >> 24;
2363                         iv[6] = k->wk_keytsc >> 32;
2364                         iv[7] = k->wk_keytsc >> 40;
2365                 }
2366                 if (run_write_region_1(sc, RT2860_IVEIV(wcid), iv, 8))
2367                         return;
2368         }
2369
2370         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2371                 /* install group key */
2372                 if (run_read(sc, RT2860_SKEY_MODE_0_7, &attr))
2373                         return;
2374                 attr &= ~(0xf << (k->wk_keyix * 4));
2375                 attr |= mode << (k->wk_keyix * 4);
2376                 if (run_write(sc, RT2860_SKEY_MODE_0_7, attr))
2377                         return;
2378         } else {
2379                 /* install pairwise key */
2380                 if (run_read(sc, RT2860_WCID_ATTR(wcid), &attr))
2381                         return;
2382                 attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
2383                 if (run_write(sc, RT2860_WCID_ATTR(wcid), attr))
2384                         return;
2385         }
2386
2387         /* TODO create a pass-thru key entry? */
2388
2389         /* need wcid to delete the right key later */
2390         k->wk_pad = wcid;
2391 }
2392
2393 /*
2394  * Don't have to be deferred, but in order to keep order of
2395  * execution, i.e. with run_key_delete(), defer this and let
2396  * run_cmdq_cb() maintain the order.
2397  *
2398  * return 0 on error
2399  */
2400 static int
2401 run_key_set(struct ieee80211vap *vap, struct ieee80211_key *k,
2402                 const uint8_t mac[IEEE80211_ADDR_LEN])
2403 {
2404         struct ieee80211com *ic = vap->iv_ic;
2405         struct run_softc *sc = ic->ic_ifp->if_softc;
2406         uint32_t i;
2407
2408         i = RUN_CMDQ_GET(&sc->cmdq_store);
2409         DPRINTF("cmdq_store=%d\n", i);
2410         sc->cmdq[i].func = run_key_set_cb;
2411         sc->cmdq[i].arg0 = NULL;
2412         sc->cmdq[i].arg1 = vap;
2413         sc->cmdq[i].k = k;
2414         IEEE80211_ADDR_COPY(sc->cmdq[i].mac, mac);
2415         ieee80211_runtask(ic, &sc->cmdq_task);
2416
2417         /*
2418          * To make sure key will be set when hostapd
2419          * calls iv_key_set() before if_init().
2420          */
2421         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
2422                 RUN_LOCK(sc);
2423                 sc->cmdq_key_set = RUN_CMDQ_GO;
2424                 RUN_UNLOCK(sc);
2425         }
2426
2427         return (1);
2428 }
2429
2430 /*
2431  * If wlan is destroyed without being brought down i.e. without
2432  * wlan down or wpa_cli terminate, this function is called after
2433  * vap is gone. Don't refer it.
2434  */
2435 static void
2436 run_key_delete_cb(void *arg)
2437 {
2438         struct run_cmdq *cmdq = arg;
2439         struct run_softc *sc = cmdq->arg1;
2440         struct ieee80211_key *k = &cmdq->key;
2441         uint32_t attr;
2442         uint8_t wcid;
2443
2444         RUN_LOCK_ASSERT(sc, MA_OWNED);
2445
2446         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2447                 /* remove group key */
2448                 DPRINTF("removing group key\n");
2449                 run_read(sc, RT2860_SKEY_MODE_0_7, &attr);
2450                 attr &= ~(0xf << (k->wk_keyix * 4));
2451                 run_write(sc, RT2860_SKEY_MODE_0_7, attr);
2452         } else {
2453                 /* remove pairwise key */
2454                 DPRINTF("removing key for wcid %x\n", k->wk_pad);
2455                 /* matching wcid was written to wk_pad in run_key_set() */
2456                 wcid = k->wk_pad;
2457                 run_read(sc, RT2860_WCID_ATTR(wcid), &attr);
2458                 attr &= ~0xf;
2459                 run_write(sc, RT2860_WCID_ATTR(wcid), attr);
2460                 run_set_region_4(sc, RT2860_WCID_ENTRY(wcid), 0, 8);
2461         }
2462
2463         k->wk_pad = 0;
2464 }
2465
2466 /*
2467  * return 0 on error
2468  */
2469 static int
2470 run_key_delete(struct ieee80211vap *vap, struct ieee80211_key *k)
2471 {
2472         struct ieee80211com *ic = vap->iv_ic;
2473         struct run_softc *sc = ic->ic_ifp->if_softc;
2474         struct ieee80211_key *k0;
2475         uint32_t i;
2476
2477         /*
2478          * When called back, key might be gone. So, make a copy
2479          * of some values need to delete keys before deferring.
2480          * But, because of LOR with node lock, cannot use lock here.
2481          * So, use atomic instead.
2482          */
2483         i = RUN_CMDQ_GET(&sc->cmdq_store);
2484         DPRINTF("cmdq_store=%d\n", i);
2485         sc->cmdq[i].func = run_key_delete_cb;
2486         sc->cmdq[i].arg0 = NULL;
2487         sc->cmdq[i].arg1 = sc;
2488         k0 = &sc->cmdq[i].key;
2489         k0->wk_flags = k->wk_flags;
2490         k0->wk_keyix = k->wk_keyix;
2491         /* matching wcid was written to wk_pad in run_key_set() */
2492         k0->wk_pad = k->wk_pad;
2493         ieee80211_runtask(ic, &sc->cmdq_task);
2494         return (1);     /* return fake success */
2495
2496 }
2497
2498 static void
2499 run_ratectl_to(void *arg)
2500 {
2501         struct run_softc *sc = arg;
2502
2503         /* do it in a process context, so it can go sleep */
2504         ieee80211_runtask(sc->sc_ifp->if_l2com, &sc->ratectl_task);
2505         /* next timeout will be rescheduled in the callback task */
2506 }
2507
2508 /* ARGSUSED */
2509 static void
2510 run_ratectl_cb(void *arg, int pending)
2511 {
2512         struct run_softc *sc = arg;
2513         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2514         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2515
2516         if (vap == NULL)
2517                 return;
2518
2519         if (sc->rvp_cnt > 1 || vap->iv_opmode != IEEE80211_M_STA) {
2520                 /*
2521                  * run_reset_livelock() doesn't do anything with AMRR,
2522                  * but Ralink wants us to call it every 1 sec. So, we
2523                  * piggyback here rather than creating another callout.
2524                  * Livelock may occur only in HOSTAP or IBSS mode
2525                  * (when h/w is sending beacons).
2526                  */
2527                 RUN_LOCK(sc);
2528                 run_reset_livelock(sc);
2529                 /* just in case, there are some stats to drain */
2530                 run_drain_fifo(sc);
2531                 RUN_UNLOCK(sc);
2532         }
2533
2534         ieee80211_iterate_nodes(&ic->ic_sta, run_iter_func, sc);
2535
2536         RUN_LOCK(sc);
2537         if(sc->ratectl_run != RUN_RATECTL_OFF)
2538                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2539         RUN_UNLOCK(sc);
2540 }
2541
2542 static void
2543 run_drain_fifo(void *arg)
2544 {
2545         struct run_softc *sc = arg;
2546         struct ifnet *ifp = sc->sc_ifp;
2547         uint32_t stat;
2548         uint16_t (*wstat)[3];
2549         uint8_t wcid, mcs, pid;
2550         int8_t retry;
2551
2552         RUN_LOCK_ASSERT(sc, MA_OWNED);
2553
2554         for (;;) {
2555                 /* drain Tx status FIFO (maxsize = 16) */
2556                 run_read(sc, RT2860_TX_STAT_FIFO, &stat);
2557                 DPRINTFN(4, "tx stat 0x%08x\n", stat);
2558                 if (!(stat & RT2860_TXQ_VLD))
2559                         break;
2560
2561                 wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
2562
2563                 /* if no ACK was requested, no feedback is available */
2564                 if (!(stat & RT2860_TXQ_ACKREQ) || wcid > RT2870_WCID_MAX ||
2565                     wcid == 0)
2566                         continue;
2567
2568                 /*
2569                  * Even though each stat is Tx-complete-status like format,
2570                  * the device can poll stats. Because there is no guarantee
2571                  * that the referring node is still around when read the stats.
2572                  * So that, if we use ieee80211_ratectl_tx_update(), we will
2573                  * have hard time not to refer already freed node.
2574                  *
2575                  * To eliminate such page faults, we poll stats in softc.
2576                  * Then, update the rates later with ieee80211_ratectl_tx_update().
2577                  */
2578                 wstat = &(sc->wcid_stats[wcid]);
2579                 (*wstat)[RUN_TXCNT]++;
2580                 if (stat & RT2860_TXQ_OK)
2581                         (*wstat)[RUN_SUCCESS]++;
2582                 else
2583                         ifp->if_oerrors++;
2584                 /*
2585                  * Check if there were retries, ie if the Tx success rate is
2586                  * different from the requested rate. Note that it works only
2587                  * because we do not allow rate fallback from OFDM to CCK.
2588                  */
2589                 mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
2590                 pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
2591                 if ((retry = pid -1 - mcs) > 0) {
2592                         (*wstat)[RUN_TXCNT] += retry;
2593                         (*wstat)[RUN_RETRY] += retry;
2594                 }
2595         }
2596         DPRINTFN(3, "count=%d\n", sc->fifo_cnt);
2597
2598         sc->fifo_cnt = 0;
2599 }
2600
2601 static void
2602 run_iter_func(void *arg, struct ieee80211_node *ni)
2603 {
2604         struct run_softc *sc = arg;
2605         struct ieee80211vap *vap = ni->ni_vap;
2606         struct ieee80211com *ic = ni->ni_ic;
2607         struct ifnet *ifp = ic->ic_ifp;
2608         struct run_node *rn = (void *)ni;
2609         union run_stats sta[2];
2610         uint16_t (*wstat)[3];
2611         int txcnt, success, retrycnt, error;
2612
2613         RUN_LOCK(sc);
2614
2615         /* Check for special case */
2616         if (sc->rvp_cnt <= 1 && vap->iv_opmode == IEEE80211_M_STA &&
2617             ni != vap->iv_bss)
2618                 goto fail;
2619
2620         if (sc->rvp_cnt <= 1 && (vap->iv_opmode == IEEE80211_M_IBSS ||
2621             vap->iv_opmode == IEEE80211_M_STA)) {
2622                 /* read statistic counters (clear on read) and update AMRR state */
2623                 error = run_read_region_1(sc, RT2860_TX_STA_CNT0, (uint8_t *)sta,
2624                     sizeof sta);
2625                 if (error != 0)
2626                         goto fail;
2627
2628                 /* count failed TX as errors */
2629                 ifp->if_oerrors += le16toh(sta[0].error.fail);
2630
2631                 retrycnt = le16toh(sta[1].tx.retry);
2632                 success = le16toh(sta[1].tx.success);
2633                 txcnt = retrycnt + success + le16toh(sta[0].error.fail);
2634
2635                 DPRINTFN(3, "retrycnt=%d success=%d failcnt=%d\n",
2636                         retrycnt, success, le16toh(sta[0].error.fail));
2637         } else {
2638                 wstat = &(sc->wcid_stats[RUN_AID2WCID(ni->ni_associd)]);
2639
2640                 if (wstat == &(sc->wcid_stats[0]) ||
2641                     wstat > &(sc->wcid_stats[RT2870_WCID_MAX]))
2642                         goto fail;
2643
2644                 txcnt = (*wstat)[RUN_TXCNT];
2645                 success = (*wstat)[RUN_SUCCESS];
2646                 retrycnt = (*wstat)[RUN_RETRY];
2647                 DPRINTFN(3, "retrycnt=%d txcnt=%d success=%d\n",
2648                     retrycnt, txcnt, success);
2649
2650                 memset(wstat, 0, sizeof(*wstat));
2651         }
2652
2653         ieee80211_ratectl_tx_update(vap, ni, &txcnt, &success, &retrycnt);
2654         rn->amrr_ridx = ieee80211_ratectl_rate(ni, NULL, 0);
2655
2656 fail:
2657         RUN_UNLOCK(sc);
2658
2659         DPRINTFN(3, "ridx=%d\n", rn->amrr_ridx);
2660 }
2661
2662 static void
2663 run_newassoc_cb(void *arg)
2664 {
2665         struct run_cmdq *cmdq = arg;
2666         struct ieee80211_node *ni = cmdq->arg1;
2667         struct run_softc *sc = ni->ni_vap->iv_ic->ic_ifp->if_softc;
2668         uint8_t wcid = cmdq->wcid;
2669
2670         RUN_LOCK_ASSERT(sc, MA_OWNED);
2671
2672         run_write_region_1(sc, RT2860_WCID_ENTRY(wcid),
2673             ni->ni_macaddr, IEEE80211_ADDR_LEN);
2674
2675         memset(&(sc->wcid_stats[wcid]), 0, sizeof(sc->wcid_stats[wcid]));
2676 }
2677
2678 static void
2679 run_newassoc(struct ieee80211_node *ni, int isnew)
2680 {
2681         struct run_node *rn = (void *)ni;
2682         struct ieee80211_rateset *rs = &ni->ni_rates;
2683         struct ieee80211vap *vap = ni->ni_vap;
2684         struct ieee80211com *ic = vap->iv_ic;
2685         struct run_softc *sc = ic->ic_ifp->if_softc;
2686         uint8_t rate;
2687         uint8_t ridx;
2688         uint8_t wcid;
2689         int i, j;
2690 #ifdef RUN_DEBUG
2691         char ethstr[ETHER_ADDRSTRLEN + 1];
2692 #endif
2693
2694         wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
2695             1 : RUN_AID2WCID(ni->ni_associd);
2696
2697         if (wcid > RT2870_WCID_MAX) {
2698                 device_printf(sc->sc_dev, "wcid=%d out of range\n", wcid);
2699                 return;
2700         }
2701
2702         /* only interested in true associations */
2703         if (isnew && ni->ni_associd != 0) {
2704
2705                 /*
2706                  * This function could is called though timeout function.
2707                  * Need to defer.
2708                  */
2709                 uint32_t cnt = RUN_CMDQ_GET(&sc->cmdq_store);
2710                 DPRINTF("cmdq_store=%d\n", cnt);
2711                 sc->cmdq[cnt].func = run_newassoc_cb;
2712                 sc->cmdq[cnt].arg0 = NULL;
2713                 sc->cmdq[cnt].arg1 = ni;
2714                 sc->cmdq[cnt].wcid = wcid;
2715                 ieee80211_runtask(ic, &sc->cmdq_task);
2716         }
2717
2718         DPRINTF("new assoc isnew=%d associd=%x addr=%s\n",
2719             isnew, ni->ni_associd, kether_ntoa(ni->ni_macaddr, ethstr));
2720
2721         for (i = 0; i < rs->rs_nrates; i++) {
2722                 rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
2723                 /* convert 802.11 rate to hardware rate index */
2724                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2725                         if (rt2860_rates[ridx].rate == rate)
2726                                 break;
2727                 rn->ridx[i] = ridx;
2728                 /* determine rate of control response frames */
2729                 for (j = i; j >= 0; j--) {
2730                         if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
2731                             rt2860_rates[rn->ridx[i]].phy ==
2732                             rt2860_rates[rn->ridx[j]].phy)
2733                                 break;
2734                 }
2735                 if (j >= 0) {
2736                         rn->ctl_ridx[i] = rn->ridx[j];
2737                 } else {
2738                         /* no basic rate found, use mandatory one */
2739                         rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
2740                 }
2741                 DPRINTF("rate=0x%02x ridx=%d ctl_ridx=%d\n",
2742                     rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]);
2743         }
2744         rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
2745         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2746                 if (rt2860_rates[ridx].rate == rate)
2747                         break;
2748         rn->mgt_ridx = ridx;
2749         DPRINTF("rate=%d, mgmt_ridx=%d\n", rate, rn->mgt_ridx);
2750
2751         RUN_LOCK(sc);
2752         if(sc->ratectl_run != RUN_RATECTL_OFF)
2753                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2754         RUN_UNLOCK(sc);
2755 }
2756
2757 /*
2758  * Return the Rx chain with the highest RSSI for a given frame.
2759  */
2760 static __inline uint8_t
2761 run_maxrssi_chain(struct run_softc *sc, const struct rt2860_rxwi *rxwi)
2762 {
2763         uint8_t rxchain = 0;
2764
2765         if (sc->nrxchains > 1) {
2766                 if (rxwi->rssi[1] > rxwi->rssi[rxchain])
2767                         rxchain = 1;
2768                 if (sc->nrxchains > 2)
2769                         if (rxwi->rssi[2] > rxwi->rssi[rxchain])
2770                                 rxchain = 2;
2771         }
2772         return (rxchain);
2773 }
2774
2775 static void
2776 run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen)
2777 {
2778         struct ifnet *ifp = sc->sc_ifp;
2779         struct ieee80211com *ic = ifp->if_l2com;
2780         struct ieee80211_frame *wh;
2781         struct ieee80211_node *ni;
2782         struct rt2870_rxd *rxd;
2783         struct rt2860_rxwi *rxwi;
2784         uint32_t flags;
2785         uint16_t len, rxwisize;
2786         uint8_t ant, rssi;
2787         int8_t nf;
2788
2789         rxwi = mtod(m, struct rt2860_rxwi *);
2790         len = le16toh(rxwi->len) & 0xfff;
2791         rxwisize = sizeof(struct rt2860_rxwi);
2792         if (sc->mac_ver == 0x5592)
2793                 rxwisize += sizeof(uint64_t);
2794         else if (sc->mac_ver == 0x3593)
2795                 rxwisize += sizeof(uint32_t);
2796         if (__predict_false(len > dmalen)) {
2797                 m_freem(m);
2798                 ifp->if_ierrors++;
2799                 DPRINTF("bad RXWI length %u > %u\n", len, dmalen);
2800                 return;
2801         }
2802         /* Rx descriptor is located at the end */
2803         rxd = (struct rt2870_rxd *)(mtod(m, caddr_t) + dmalen);
2804         flags = le32toh(rxd->flags);
2805
2806         if (__predict_false(flags & (RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
2807                 m_freem(m);
2808                 ifp->if_ierrors++;
2809                 DPRINTF("%s error.\n", (flags & RT2860_RX_CRCERR)?"CRC":"ICV");
2810                 return;
2811         }
2812
2813         m->m_data += rxwisize;
2814         m->m_pkthdr.len = m->m_len -= rxwisize;
2815
2816         wh = mtod(m, struct ieee80211_frame *);
2817
2818         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2819                 wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
2820                 m->m_flags |= M_WEP;
2821         }
2822
2823         if (flags & RT2860_RX_L2PAD) {
2824                 DPRINTFN(8, "received RT2860_RX_L2PAD frame\n");
2825                 len += 2;
2826         }
2827
2828         ni = ieee80211_find_rxnode(ic,
2829             mtod(m, struct ieee80211_frame_min *));
2830
2831         if (__predict_false(flags & RT2860_RX_MICERR)) {
2832                 /* report MIC failures to net80211 for TKIP */
2833                 if (ni != NULL)
2834                         ieee80211_notify_michael_failure(ni->ni_vap, wh,
2835                             rxwi->keyidx);
2836                 m_freem(m);
2837                 ifp->if_ierrors++;
2838                 DPRINTF("MIC error. Someone is lying.\n");
2839                 return;
2840         }
2841
2842         ant = run_maxrssi_chain(sc, rxwi);
2843         rssi = rxwi->rssi[ant];
2844         nf = run_rssi2dbm(sc, rssi, ant);
2845
2846         m->m_pkthdr.rcvif = ifp;
2847         m->m_pkthdr.len = m->m_len = len;
2848
2849         if (ni != NULL) {
2850                 (void)ieee80211_input(ni, m, rssi, nf);
2851                 ieee80211_free_node(ni);
2852         } else {
2853                 (void)ieee80211_input_all(ic, m, rssi, nf);
2854         }
2855
2856         if (__predict_false(ieee80211_radiotap_active(ic))) {
2857                 struct run_rx_radiotap_header *tap = &sc->sc_rxtap;
2858                 uint16_t phy;
2859
2860                 tap->wr_flags = 0;
2861                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2862                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2863                 tap->wr_antsignal = rssi;
2864                 tap->wr_antenna = ant;
2865                 tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant);
2866                 tap->wr_rate = 2;       /* in case it can't be found below */
2867                 phy = le16toh(rxwi->phy);
2868                 switch (phy & RT2860_PHY_MODE) {
2869                 case RT2860_PHY_CCK:
2870                         switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
2871                         case 0: tap->wr_rate =   2; break;
2872                         case 1: tap->wr_rate =   4; break;
2873                         case 2: tap->wr_rate =  11; break;
2874                         case 3: tap->wr_rate =  22; break;
2875                         }
2876                         if (phy & RT2860_PHY_SHPRE)
2877                                 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2878                         break;
2879                 case RT2860_PHY_OFDM:
2880                         switch (phy & RT2860_PHY_MCS) {
2881                         case 0: tap->wr_rate =  12; break;
2882                         case 1: tap->wr_rate =  18; break;
2883                         case 2: tap->wr_rate =  24; break;
2884                         case 3: tap->wr_rate =  36; break;
2885                         case 4: tap->wr_rate =  48; break;
2886                         case 5: tap->wr_rate =  72; break;
2887                         case 6: tap->wr_rate =  96; break;
2888                         case 7: tap->wr_rate = 108; break;
2889                         }
2890                         break;
2891                 }
2892         }
2893 }
2894
2895 static void
2896 run_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2897 {
2898         struct run_softc *sc = usbd_xfer_softc(xfer);
2899         struct ifnet *ifp = sc->sc_ifp;
2900         struct mbuf *m = NULL;
2901         struct mbuf *m0;
2902         uint32_t dmalen;
2903         uint16_t rxwisize;
2904         int xferlen;
2905
2906         rxwisize = sizeof(struct rt2860_rxwi);
2907         if (sc->mac_ver == 0x5592)
2908                 rxwisize += sizeof(uint64_t);
2909         else if (sc->mac_ver == 0x3593)
2910                 rxwisize += sizeof(uint32_t);
2911
2912         usbd_xfer_status(xfer, &xferlen, NULL, NULL, NULL);
2913
2914         switch (USB_GET_STATE(xfer)) {
2915         case USB_ST_TRANSFERRED:
2916
2917                 DPRINTFN(15, "rx done, actlen=%d\n", xferlen);
2918
2919                 if (xferlen < (int)(sizeof(uint32_t) + rxwisize +
2920                     sizeof(struct rt2870_rxd))) {
2921                         DPRINTF("xfer too short %d\n", xferlen);
2922                         goto tr_setup;
2923                 }
2924
2925                 m = sc->rx_m;
2926                 sc->rx_m = NULL;
2927
2928                 /* FALLTHROUGH */
2929         case USB_ST_SETUP:
2930 tr_setup:
2931                 if (sc->rx_m == NULL) {
2932                         sc->rx_m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
2933                             MJUMPAGESIZE /* xfer can be bigger than MCLBYTES */);
2934                 }
2935                 if (sc->rx_m == NULL) {
2936                         DPRINTF("could not allocate mbuf - idle with stall\n");
2937                         ifp->if_ierrors++;
2938                         usbd_xfer_set_stall(xfer);
2939                         usbd_xfer_set_frames(xfer, 0);
2940                 } else {
2941                         /*
2942                          * Directly loading a mbuf cluster into DMA to
2943                          * save some data copying. This works because
2944                          * there is only one cluster.
2945                          */
2946                         usbd_xfer_set_frame_data(xfer, 0,
2947                             mtod(sc->rx_m, caddr_t), RUN_MAX_RXSZ);
2948                         usbd_xfer_set_frames(xfer, 1);
2949                 }
2950                 usbd_transfer_submit(xfer);
2951                 break;
2952
2953         default:        /* Error */
2954                 if (error != USB_ERR_CANCELLED) {
2955                         /* try to clear stall first */
2956                         usbd_xfer_set_stall(xfer);
2957
2958                         if (error == USB_ERR_TIMEOUT)
2959                                 device_printf(sc->sc_dev, "device timeout\n");
2960
2961                         ifp->if_ierrors++;
2962
2963                         goto tr_setup;
2964                 }
2965                 if (sc->rx_m != NULL) {
2966                         m_freem(sc->rx_m);
2967                         sc->rx_m = NULL;
2968                 }
2969                 break;
2970         }
2971
2972         if (m == NULL)
2973                 return;
2974
2975         /* inputting all the frames must be last */
2976
2977         RUN_UNLOCK(sc);
2978
2979         m->m_pkthdr.len = m->m_len = xferlen;
2980
2981         /* HW can aggregate multiple 802.11 frames in a single USB xfer */
2982         for(;;) {
2983                 dmalen = le32toh(*mtod(m, uint32_t *)) & 0xffff;
2984
2985                 if ((dmalen >= (uint32_t)-8) || (dmalen == 0) ||
2986                     ((dmalen & 3) != 0)) {
2987                         DPRINTF("bad DMA length %u\n", dmalen);
2988                         break;
2989                 }
2990                 if ((dmalen + 8) > (uint32_t)xferlen) {
2991                         DPRINTF("bad DMA length %u > %d\n",
2992                         dmalen + 8, xferlen);
2993                         break;
2994                 }
2995
2996                 /* If it is the last one or a single frame, we won't copy. */
2997                 if ((xferlen -= dmalen + 8) <= 8) {
2998                         /* trim 32-bit DMA-len header */
2999                         m->m_data += 4;
3000                         m->m_pkthdr.len = m->m_len -= 4;
3001                         run_rx_frame(sc, m, dmalen);
3002                         m = NULL;       /* don't free source buffer */
3003                         break;
3004                 }
3005
3006                 /* copy aggregated frames to another mbuf */
3007                 m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
3008                 if (__predict_false(m0 == NULL)) {
3009                         DPRINTF("could not allocate mbuf\n");
3010                         ifp->if_ierrors++;
3011                         break;
3012                 }
3013                 m_copydata(m, 4 /* skip 32-bit DMA-len header */,
3014                     dmalen + sizeof(struct rt2870_rxd), mtod(m0, caddr_t));
3015                 m0->m_pkthdr.len = m0->m_len =
3016                     dmalen + sizeof(struct rt2870_rxd);
3017                 run_rx_frame(sc, m0, dmalen);
3018
3019                 /* update data ptr */
3020                 m->m_data += dmalen + 8;
3021                 m->m_pkthdr.len = m->m_len -= dmalen + 8;
3022         }
3023
3024         /* make sure we free the source buffer, if any */
3025         m_freem(m);
3026
3027         RUN_LOCK(sc);
3028 }
3029
3030 static void
3031 run_tx_free(struct run_endpoint_queue *pq,
3032     struct run_tx_data *data, int txerr)
3033 {
3034         if (data->m != NULL) {
3035                 if (data->m->m_flags & M_TXCB)
3036                         ieee80211_process_callback(data->ni, data->m,
3037                             txerr ? ETIMEDOUT : 0);
3038                 m_freem(data->m);
3039                 data->m = NULL;
3040
3041                 if (data->ni == NULL) {
3042                         DPRINTF("no node\n");
3043                 } else {
3044                         ieee80211_free_node(data->ni);
3045                         data->ni = NULL;
3046                 }
3047         }
3048
3049         STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
3050         pq->tx_nfree++;
3051 }
3052
3053 static void
3054 run_bulk_tx_callbackN(struct usb_xfer *xfer, usb_error_t error, u_int index)
3055 {
3056         struct run_softc *sc = usbd_xfer_softc(xfer);
3057         struct ifnet *ifp = sc->sc_ifp;
3058         struct ieee80211com *ic = ifp->if_l2com;
3059         struct run_tx_data *data;
3060         struct ieee80211vap *vap = NULL;
3061         struct usb_page_cache *pc;
3062         struct run_endpoint_queue *pq = &sc->sc_epq[index];
3063         struct mbuf *m;
3064         usb_frlength_t size;
3065         int actlen;
3066         int sumlen;
3067
3068         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
3069
3070         switch (USB_GET_STATE(xfer)) {
3071         case USB_ST_TRANSFERRED:
3072                 DPRINTFN(11, "transfer complete: %d "
3073                     "bytes @ index %d\n", actlen, index);
3074
3075                 data = usbd_xfer_get_priv(xfer);
3076
3077                 run_tx_free(pq, data, 0);
3078                 ifq_clr_oactive(&ifp->if_snd);
3079
3080                 usbd_xfer_set_priv(xfer, NULL);
3081
3082                 ifp->if_opackets++;
3083
3084                 /* FALLTHROUGH */
3085         case USB_ST_SETUP:
3086 tr_setup:
3087                 data = STAILQ_FIRST(&pq->tx_qh);
3088                 if (data == NULL)
3089                         break;
3090
3091                 STAILQ_REMOVE_HEAD(&pq->tx_qh, next);
3092
3093                 m = data->m;
3094                 size = (sc->mac_ver == 0x5592) ?
3095                     sizeof(data->desc) + sizeof(uint32_t) : sizeof(data->desc);
3096                 if ((m->m_pkthdr.len +
3097                     size + 3 + 8) > RUN_MAX_TXSZ) {
3098                         DPRINTF("data overflow, %u bytes\n",
3099                             m->m_pkthdr.len);
3100
3101                         ifp->if_oerrors++;
3102
3103                         run_tx_free(pq, data, 1);
3104
3105                         goto tr_setup;
3106                 }
3107
3108                 pc = usbd_xfer_get_frame(xfer, 0);
3109                 usbd_copy_in(pc, 0, &data->desc, size);
3110                 usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
3111                 size += m->m_pkthdr.len;
3112                 /*
3113                  * Align end on a 4-byte boundary, pad 8 bytes (CRC +
3114                  * 4-byte padding), and be sure to zero those trailing
3115                  * bytes:
3116                  */
3117                 usbd_frame_zero(pc, size, ((-size) & 3) + 8);
3118                 size += ((-size) & 3) + 8;
3119
3120                 vap = data->ni->ni_vap;
3121                 if (ieee80211_radiotap_active_vap(vap)) {
3122                         struct run_tx_radiotap_header *tap = &sc->sc_txtap;
3123                         struct rt2860_txwi *txwi =
3124                             (struct rt2860_txwi *)(&data->desc + sizeof(struct rt2870_txd));
3125                         tap->wt_flags = 0;
3126                         tap->wt_rate = rt2860_rates[data->ridx].rate;
3127                         tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
3128                         tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
3129                         tap->wt_hwqueue = index;
3130                         if (le16toh(txwi->phy) & RT2860_PHY_SHPRE)
3131                                 tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3132
3133                         ieee80211_radiotap_tx(vap, m);
3134                 }
3135
3136                 DPRINTFN(11, "sending frame len=%u/%u  @ index %d\n",
3137                     m->m_pkthdr.len, size, index);
3138
3139                 usbd_xfer_set_frame_len(xfer, 0, size);
3140                 usbd_xfer_set_priv(xfer, data);
3141
3142                 usbd_transfer_submit(xfer);
3143
3144                 run_start(ifp, NULL);
3145
3146                 break;
3147
3148         default:
3149                 DPRINTF("USB transfer error, %s\n",
3150                     usbd_errstr(error));
3151
3152                 data = usbd_xfer_get_priv(xfer);
3153
3154                 ifp->if_oerrors++;
3155
3156                 if (data != NULL) {
3157                         if(data->ni != NULL)
3158                                 vap = data->ni->ni_vap;
3159                         run_tx_free(pq, data, error);
3160                         usbd_xfer_set_priv(xfer, NULL);
3161                 }
3162                 if (vap == NULL)
3163                         vap = TAILQ_FIRST(&ic->ic_vaps);
3164
3165                 if (error != USB_ERR_CANCELLED) {
3166                         if (error == USB_ERR_TIMEOUT) {
3167                                 device_printf(sc->sc_dev, "device timeout\n");
3168                                 uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
3169                                 DPRINTF("cmdq_store=%d\n", i);
3170                                 sc->cmdq[i].func = run_usb_timeout_cb;
3171                                 sc->cmdq[i].arg0 = vap;
3172                                 ieee80211_runtask(ic, &sc->cmdq_task);
3173                         }
3174
3175                         /*
3176                          * Try to clear stall first, also if other
3177                          * errors occur, hence clearing stall
3178                          * introduces a 50 ms delay:
3179                          */
3180                         usbd_xfer_set_stall(xfer);
3181                         goto tr_setup;
3182                 }
3183                 break;
3184         }
3185 }
3186
3187 static void
3188 run_bulk_tx_callback0(struct usb_xfer *xfer, usb_error_t error)
3189 {
3190         run_bulk_tx_callbackN(xfer, error, 0);
3191 }
3192
3193 static void
3194 run_bulk_tx_callback1(struct usb_xfer *xfer, usb_error_t error)
3195 {
3196         run_bulk_tx_callbackN(xfer, error, 1);
3197 }
3198
3199 static void
3200 run_bulk_tx_callback2(struct usb_xfer *xfer, usb_error_t error)
3201 {
3202         run_bulk_tx_callbackN(xfer, error, 2);
3203 }
3204
3205 static void
3206 run_bulk_tx_callback3(struct usb_xfer *xfer, usb_error_t error)
3207 {
3208         run_bulk_tx_callbackN(xfer, error, 3);
3209 }
3210
3211 static void
3212 run_bulk_tx_callback4(struct usb_xfer *xfer, usb_error_t error)
3213 {
3214         run_bulk_tx_callbackN(xfer, error, 4);
3215 }
3216
3217 static void
3218 run_bulk_tx_callback5(struct usb_xfer *xfer, usb_error_t error)
3219 {
3220         run_bulk_tx_callbackN(xfer, error, 5);
3221 }
3222
3223 static void
3224 run_set_tx_desc(struct run_softc *sc, struct run_tx_data *data)
3225 {
3226         struct mbuf *m = data->m;
3227         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3228         struct ieee80211vap *vap = data->ni->ni_vap;
3229         struct ieee80211_frame *wh;
3230         struct rt2870_txd *txd;
3231         struct rt2860_txwi *txwi;
3232         uint16_t xferlen, txwisize;
3233         uint16_t mcs;
3234         uint8_t ridx = data->ridx;
3235         uint8_t pad;
3236
3237         /* get MCS code from rate index */
3238         mcs = rt2860_rates[ridx].mcs;
3239
3240         txwisize = (sc->mac_ver == 0x5592) ?
3241             sizeof(*txwi) + sizeof(uint32_t) : sizeof(*txwi);
3242         xferlen = txwisize + m->m_pkthdr.len;
3243
3244         /* roundup to 32-bit alignment */
3245         xferlen = (xferlen + 3) & ~3;
3246
3247         txd = (struct rt2870_txd *)&data->desc;
3248         txd->len = htole16(xferlen);
3249
3250         wh = mtod(m, struct ieee80211_frame *);
3251
3252         /*
3253          * Ether both are true or both are false, the header
3254          * are nicely aligned to 32-bit. So, no L2 padding.
3255          */
3256         if(IEEE80211_HAS_ADDR4(wh) == IEEE80211_QOS_HAS_SEQ(wh))
3257                 pad = 0;
3258         else
3259                 pad = 2;
3260
3261         /* setup TX Wireless Information */
3262         txwi = (struct rt2860_txwi *)(txd + 1);
3263         txwi->len = htole16(m->m_pkthdr.len - pad);
3264         if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
3265                 mcs |= RT2860_PHY_CCK;
3266                 if (ridx != RT2860_RIDX_CCK1 &&
3267                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
3268                         mcs |= RT2860_PHY_SHPRE;
3269         } else
3270                 mcs |= RT2860_PHY_OFDM;
3271         txwi->phy |= htole16(mcs);
3272
3273         /* check if RTS/CTS or CTS-to-self protection is required */
3274         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3275             (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
3276              ((ic->ic_flags & IEEE80211_F_USEPROT) &&
3277               rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
3278                 txwi->txop |= RT2860_TX_TXOP_HT;
3279         else
3280                 txwi->txop |= RT2860_TX_TXOP_BACKOFF;
3281
3282         if (vap->iv_opmode != IEEE80211_M_STA && !IEEE80211_QOS_HAS_SEQ(wh))
3283                 txwi->xflags |= RT2860_TX_NSEQ;
3284 }
3285
3286 /* This function must be called locked */
3287 static int
3288 run_tx(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
3289 {
3290         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3291         struct ieee80211vap *vap = ni->ni_vap;
3292         struct ieee80211_frame *wh;
3293         struct ieee80211_channel *chan;
3294         const struct ieee80211_txparam *tp;
3295         struct run_node *rn = (void *)ni;
3296         struct run_tx_data *data;
3297         struct rt2870_txd *txd;
3298         struct rt2860_txwi *txwi;
3299         uint16_t qos;
3300         uint16_t dur;
3301         uint16_t qid;
3302         uint8_t type;
3303         uint8_t tid;
3304         uint8_t ridx;
3305         uint8_t ctl_ridx;
3306         uint8_t qflags;
3307         uint8_t xflags = 0;
3308         int hasqos;
3309
3310 #if 0 /* XXX swildner: lock needed? */
3311         RUN_LOCK_ASSERT(sc, MA_OWNED);
3312 #endif
3313
3314         wh = mtod(m, struct ieee80211_frame *);
3315
3316         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3317
3318         /*
3319          * There are 7 bulk endpoints: 1 for RX
3320          * and 6 for TX (4 EDCAs + HCCA + Prio).
3321          * Update 03-14-2009:  some devices like the Planex GW-US300MiniS
3322          * seem to have only 4 TX bulk endpoints (Fukaumi Naoki).
3323          */
3324         if ((hasqos = IEEE80211_QOS_HAS_SEQ(wh))) {
3325                 uint8_t *frm;
3326
3327                 if(IEEE80211_HAS_ADDR4(wh))
3328                         frm = ((struct ieee80211_qosframe_addr4 *)wh)->i_qos;
3329                 else
3330                         frm =((struct ieee80211_qosframe *)wh)->i_qos;
3331
3332                 qos = le16toh(*(const uint16_t *)frm);
3333                 tid = qos & IEEE80211_QOS_TID;
3334                 qid = TID_TO_WME_AC(tid);
3335         } else {
3336                 qos = 0;
3337                 tid = 0;
3338                 qid = WME_AC_BE;
3339         }
3340         qflags = (qid < 4) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_HCCA;
3341
3342         DPRINTFN(8, "qos %d\tqid %d\ttid %d\tqflags %x\n",
3343             qos, qid, tid, qflags);
3344
3345         chan = (ni->ni_chan != IEEE80211_CHAN_ANYC)?ni->ni_chan:ic->ic_curchan;
3346         tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
3347
3348         /* pickup a rate index */
3349         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
3350             type != IEEE80211_FC0_TYPE_DATA || m->m_flags & M_EAPOL) {
3351                 ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
3352                     RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
3353                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
3354         } else {
3355                 if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
3356                         ridx = rn->fix_ridx;
3357                 else
3358                         ridx = rn->amrr_ridx;
3359                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
3360         }
3361
3362         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3363             (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
3364              IEEE80211_QOS_ACKPOLICY_NOACK)) {
3365                 xflags |= RT2860_TX_ACK;
3366                 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
3367                         dur = rt2860_rates[ctl_ridx].sp_ack_dur;
3368                 else
3369                         dur = rt2860_rates[ctl_ridx].lp_ack_dur;
3370                 USETW(wh->i_dur, dur);
3371         }
3372
3373         /* reserve slots for mgmt packets, just in case */
3374         if (sc->sc_epq[qid].tx_nfree < 3) {
3375                 DPRINTFN(10, "tx ring %d is full\n", qid);
3376                 return (-1);
3377         }
3378
3379         data = STAILQ_FIRST(&sc->sc_epq[qid].tx_fh);
3380         STAILQ_REMOVE_HEAD(&sc->sc_epq[qid].tx_fh, next);
3381         sc->sc_epq[qid].tx_nfree--;
3382
3383         txd = (struct rt2870_txd *)&data->desc;
3384         txd->flags = qflags;
3385         txwi = (struct rt2860_txwi *)(txd + 1);
3386         txwi->xflags = xflags;
3387         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3388                 txwi->wcid = 0;
3389         else
3390                 txwi->wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
3391                     1 : RUN_AID2WCID(ni->ni_associd);
3392
3393         /* clear leftover garbage bits */
3394         txwi->flags = 0;
3395         txwi->txop = 0;
3396
3397         data->m = m;
3398         data->ni = ni;
3399         data->ridx = ridx;
3400
3401         run_set_tx_desc(sc, data);
3402
3403         /*
3404          * The chip keeps track of 2 kind of Tx stats,
3405          *  * TX_STAT_FIFO, for per WCID stats, and
3406          *  * TX_STA_CNT0 for all-TX-in-one stats.
3407          *
3408          * To use FIFO stats, we need to store MCS into the driver-private
3409          * PacketID field. So that, we can tell whose stats when we read them.
3410          * We add 1 to the MCS because setting the PacketID field to 0 means
3411          * that we don't want feedback in TX_STAT_FIFO.
3412          * And, that's what we want for STA mode, since TX_STA_CNT0 does the job.
3413          *
3414          * FIFO stats doesn't count Tx with WCID 0xff, so we do this in run_tx().
3415          */
3416         if (sc->rvp_cnt > 1 || vap->iv_opmode == IEEE80211_M_HOSTAP ||
3417             vap->iv_opmode == IEEE80211_M_MBSS) {
3418                 uint16_t pid = (rt2860_rates[ridx].mcs + 1) & 0xf;
3419                 txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
3420
3421                 /*
3422                  * Unlike PCI based devices, we don't get any interrupt from
3423                  * USB devices, so we simulate FIFO-is-full interrupt here.
3424                  * Ralink recomends to drain FIFO stats every 100 ms, but 16 slots
3425                  * quickly get fulled. To prevent overflow, increment a counter on
3426                  * every FIFO stat request, so we know how many slots are left.
3427                  * We do this only in HOSTAP or multiple vap mode since FIFO stats
3428                  * are used only in those modes.
3429                  * We just drain stats. AMRR gets updated every 1 sec by
3430                  * run_ratectl_cb() via callout.
3431                  * Call it early. Otherwise overflow.
3432                  */
3433                 if (sc->fifo_cnt++ == 10) {
3434                         /*
3435                          * With multiple vaps or if_bridge, if_start() is called
3436                          * with a non-sleepable lock, tcpinp. So, need to defer.
3437                          */
3438                         uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
3439                         DPRINTFN(6, "cmdq_store=%d\n", i);
3440                         sc->cmdq[i].func = run_drain_fifo;
3441                         sc->cmdq[i].arg0 = sc;
3442                         ieee80211_runtask(ic, &sc->cmdq_task);
3443                 }
3444         }
3445
3446         STAILQ_INSERT_TAIL(&sc->sc_epq[qid].tx_qh, data, next);
3447
3448         RUN_LOCK(sc);
3449         usbd_transfer_start(sc->sc_xfer[qid]);
3450         RUN_UNLOCK(sc);
3451
3452         DPRINTFN(8, "sending data frame len=%d rate=%d qid=%d\n",
3453             m->m_pkthdr.len + (int)(sizeof(struct rt2870_txd) +
3454             sizeof(struct rt2860_txwi)), rt2860_rates[ridx].rate, qid);
3455
3456         return (0);
3457 }
3458
3459 static int
3460 run_tx_mgt(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
3461 {
3462         struct ifnet *ifp = sc->sc_ifp;
3463         struct ieee80211com *ic = ifp->if_l2com;
3464         struct run_node *rn = (void *)ni;
3465         struct run_tx_data *data;
3466         struct ieee80211_frame *wh;
3467         struct rt2870_txd *txd;
3468         struct rt2860_txwi *txwi;
3469         uint16_t dur;
3470         uint8_t ridx = rn->mgt_ridx;
3471         uint8_t type;
3472         uint8_t xflags = 0;
3473         uint8_t wflags = 0;
3474
3475         RUN_LOCK_ASSERT(sc, MA_OWNED);
3476
3477         wh = mtod(m, struct ieee80211_frame *);
3478
3479         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3480
3481         /* tell hardware to add timestamp for probe responses */
3482         if ((wh->i_fc[0] &
3483             (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
3484             (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
3485                 wflags |= RT2860_TX_TS;
3486         else if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3487                 xflags |= RT2860_TX_ACK;
3488
3489                 dur = ieee80211_ack_duration(ic->ic_rt, rt2860_rates[ridx].rate,
3490                     ic->ic_flags & IEEE80211_F_SHPREAMBLE);
3491                 USETW(wh->i_dur, dur);
3492         }
3493
3494         if (sc->sc_epq[0].tx_nfree == 0) {
3495                 /* let caller free mbuf */
3496                 ifq_set_oactive(&ifp->if_snd);
3497                 return (EIO);
3498         }
3499         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3500         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3501         sc->sc_epq[0].tx_nfree--;
3502
3503         txd = (struct rt2870_txd *)&data->desc;
3504         txd->flags = RT2860_TX_QSEL_EDCA;
3505         txwi = (struct rt2860_txwi *)(txd + 1);
3506         txwi->wcid = 0xff;
3507         txwi->flags = wflags;
3508         txwi->xflags = xflags;
3509         txwi->txop = 0; /* clear leftover garbage bits */
3510
3511         data->m = m;
3512         data->ni = ni;
3513         data->ridx = ridx;
3514
3515         run_set_tx_desc(sc, data);
3516
3517         DPRINTFN(10, "sending mgt frame len=%d rate=%d\n", m->m_pkthdr.len +
3518             (int)(sizeof(struct rt2870_txd) + sizeof(struct rt2860_txwi)),
3519             rt2860_rates[ridx].rate);
3520
3521         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3522
3523         usbd_transfer_start(sc->sc_xfer[0]);
3524
3525         return (0);
3526 }
3527
3528 static int
3529 run_sendprot(struct run_softc *sc,
3530     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
3531 {
3532         struct ieee80211com *ic = ni->ni_ic;
3533         struct ieee80211_frame *wh;
3534         struct run_tx_data *data;
3535         struct rt2870_txd *txd;
3536         struct rt2860_txwi *txwi;
3537         struct mbuf *mprot;
3538         int ridx;
3539         int protrate;
3540         int ackrate;
3541         int pktlen;
3542         int isshort;
3543         uint16_t dur;
3544         uint8_t type;
3545         uint8_t wflags = 0;
3546         uint8_t xflags = 0;
3547
3548         RUN_LOCK_ASSERT(sc, MA_OWNED);
3549
3550         KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
3551             ("protection %d", prot));
3552
3553         wh = mtod(m, struct ieee80211_frame *);
3554         pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
3555         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3556
3557         protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
3558         ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
3559
3560         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
3561         dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort)
3562             + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
3563         wflags = RT2860_TX_FRAG;
3564
3565         /* check that there are free slots before allocating the mbuf */
3566         if (sc->sc_epq[0].tx_nfree == 0) {
3567                 /* let caller free mbuf */
3568                 ifq_set_oactive(&sc->sc_ifp->if_snd);
3569                 return (ENOBUFS);
3570         }
3571
3572         if (prot == IEEE80211_PROT_RTSCTS) {
3573                 /* NB: CTS is the same size as an ACK */
3574                 dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
3575                 xflags |= RT2860_TX_ACK;
3576                 mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
3577         } else {
3578                 mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
3579         }
3580         if (mprot == NULL) {
3581                 sc->sc_ifp->if_oerrors++;
3582                 DPRINTF("could not allocate mbuf\n");
3583                 return (ENOBUFS);
3584         }
3585
3586         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3587         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3588         sc->sc_epq[0].tx_nfree--;
3589
3590         txd = (struct rt2870_txd *)&data->desc;
3591         txd->flags = RT2860_TX_QSEL_EDCA;
3592         txwi = (struct rt2860_txwi *)(txd + 1);
3593         txwi->wcid = 0xff;
3594         txwi->flags = wflags;
3595         txwi->xflags = xflags;
3596         txwi->txop = 0; /* clear leftover garbage bits */
3597
3598         data->m = mprot;
3599         data->ni = ieee80211_ref_node(ni);
3600
3601         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
3602                 if (rt2860_rates[ridx].rate == protrate)
3603                         break;
3604         data->ridx = ridx;
3605
3606         run_set_tx_desc(sc, data);
3607
3608         DPRINTFN(1, "sending prot len=%u rate=%u\n",
3609             m->m_pkthdr.len, rate);
3610
3611         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3612
3613         usbd_transfer_start(sc->sc_xfer[0]);
3614
3615         return (0);
3616 }
3617
3618 static int
3619 run_tx_param(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
3620     const struct ieee80211_bpf_params *params)
3621 {
3622         struct ieee80211com *ic = ni->ni_ic;
3623         struct ieee80211_frame *wh;
3624         struct run_tx_data *data;
3625         struct rt2870_txd *txd;
3626         struct rt2860_txwi *txwi;
3627         uint8_t type;
3628         uint8_t ridx;
3629         uint8_t rate;
3630         uint8_t opflags = 0;
3631         uint8_t xflags = 0;
3632         int error;
3633
3634         RUN_LOCK_ASSERT(sc, MA_OWNED);
3635
3636         KASSERT(params != NULL, ("no raw xmit params"));
3637
3638         wh = mtod(m, struct ieee80211_frame *);
3639         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3640
3641         rate = params->ibp_rate0;
3642         if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
3643                 /* let caller free mbuf */
3644                 return (EINVAL);
3645         }
3646
3647         if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
3648                 xflags |= RT2860_TX_ACK;
3649         if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
3650                 error = run_sendprot(sc, m, ni,
3651                     params->ibp_flags & IEEE80211_BPF_RTS ?
3652                         IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
3653                     rate);
3654                 if (error) {
3655                         /* let caller free mbuf */
3656                         return error;
3657                 }
3658                 opflags |= /*XXX RT2573_TX_LONG_RETRY |*/ RT2860_TX_TXOP_SIFS;
3659         }
3660
3661         if (sc->sc_epq[0].tx_nfree == 0) {
3662                 /* let caller free mbuf */
3663                 ifq_set_oactive(&sc->sc_ifp->if_snd);
3664                 DPRINTF("sending raw frame, but tx ring is full\n");
3665                 return (EIO);
3666         }
3667         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3668         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3669         sc->sc_epq[0].tx_nfree--;
3670
3671         txd = (struct rt2870_txd *)&data->desc;
3672         txd->flags = RT2860_TX_QSEL_EDCA;
3673         txwi = (struct rt2860_txwi *)(txd + 1);
3674         txwi->wcid = 0xff;
3675         txwi->xflags = xflags;
3676         txwi->txop = opflags;
3677         txwi->flags = 0;        /* clear leftover garbage bits */
3678
3679         data->m = m;
3680         data->ni = ni;
3681         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
3682                 if (rt2860_rates[ridx].rate == rate)
3683                         break;
3684         data->ridx = ridx;
3685
3686         run_set_tx_desc(sc, data);
3687
3688         DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
3689             m->m_pkthdr.len, rate);
3690
3691         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3692
3693         usbd_transfer_start(sc->sc_xfer[0]);
3694
3695         return (0);
3696 }
3697
3698 static int
3699 run_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3700     const struct ieee80211_bpf_params *params)
3701 {
3702         struct ifnet *ifp = ni->ni_ic->ic_ifp;
3703         struct run_softc *sc = ifp->if_softc;
3704         int error = 0;
3705
3706         RUN_LOCK(sc);
3707
3708         /* prevent management frames from being sent if we're not ready */
3709         if (!(ifp->if_flags & IFF_RUNNING)) {
3710                 error = ENETDOWN;
3711                 goto done;
3712         }
3713
3714         if (params == NULL) {
3715                 /* tx mgt packet */
3716                 if ((error = run_tx_mgt(sc, m, ni)) != 0) {
3717                         ifp->if_oerrors++;
3718                         DPRINTF("mgt tx failed\n");
3719                         goto done;
3720                 }
3721         } else {
3722                 /* tx raw packet with param */
3723                 if ((error = run_tx_param(sc, m, ni, params)) != 0) {
3724                         ifp->if_oerrors++;
3725                         DPRINTF("tx with param failed\n");
3726                         goto done;
3727                 }
3728         }
3729
3730         ifp->if_opackets++;
3731
3732 done:
3733         RUN_UNLOCK(sc);
3734
3735         if (error != 0) {
3736                 if(m != NULL)
3737                         m_freem(m);
3738                 ieee80211_free_node(ni);
3739         }
3740
3741         return (error);
3742 }
3743
3744 static void
3745 run_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
3746 {
3747         struct run_softc *sc = ifp->if_softc;
3748         struct ieee80211_node *ni;
3749         struct mbuf *m = NULL;
3750
3751 #if 0
3752         ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
3753 #endif
3754         if ((ifp->if_flags & IFF_RUNNING) == 0)
3755                 return;
3756
3757         RUN_LOCK(sc);
3758         for (;;) {
3759                 /* send data frames */
3760                 m = ifq_dequeue(&ifp->if_snd);
3761                 if (m == NULL)
3762                         break;
3763
3764                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3765                 if (run_tx(sc, m, ni) != 0) {
3766                         ifq_prepend(&ifp->if_snd, m);
3767                         ifq_set_oactive(&ifp->if_snd);
3768                         break;
3769                 }
3770         }
3771         RUN_UNLOCK(sc);
3772 }
3773
3774 static int
3775 run_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
3776 {
3777         struct run_softc *sc = ifp->if_softc;
3778         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3779         struct ifreq *ifr = (struct ifreq *) data;
3780         int startall = 0;
3781         int error;
3782
3783         RUN_LOCK(sc);
3784         error = sc->sc_detached ? ENXIO : 0;
3785         RUN_UNLOCK(sc);
3786         if (error)
3787                 return (error);
3788
3789         switch (cmd) {
3790         case SIOCSIFFLAGS:
3791                 RUN_LOCK(sc);
3792                 if (ifp->if_flags & IFF_UP) {
3793                         if (!(ifp->if_flags & IFF_RUNNING)){
3794                                 startall = 1;
3795                                 run_init_locked(sc);
3796                         } else
3797                                 run_update_promisc_locked(sc);
3798                 } else {
3799                         if (ifp->if_flags & IFF_RUNNING &&
3800                             (ic->ic_nrunning == 0 || sc->rvp_cnt <= 1)) {
3801                                         run_stop(sc);
3802                         }
3803                 }
3804                 RUN_UNLOCK(sc);
3805                 if (startall)
3806                         ieee80211_start_all(ic);
3807                 break;
3808         case SIOCGIFMEDIA:
3809                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
3810                 break;
3811         case SIOCGIFADDR:
3812                 error = ether_ioctl(ifp, cmd, data);
3813                 break;
3814         default:
3815                 error = EINVAL;
3816                 break;
3817         }
3818
3819         return (error);
3820 }
3821
3822 static void
3823 run_iq_calib(struct run_softc *sc, u_int chan)
3824 {
3825         uint16_t val;
3826
3827         /* Tx0 IQ gain. */
3828         run_bbp_write(sc, 158, 0x2c);
3829         if (chan <= 14)
3830                 run_efuse_read(sc, RT5390_EEPROM_IQ_GAIN_CAL_TX0_2GHZ, &val, 1);
3831         else if (chan <= 64) {
3832                 run_efuse_read(sc,
3833                     RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5GHZ,
3834                     &val, 1);
3835         } else if (chan <= 138) {
3836                 run_efuse_read(sc,
3837                     RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5GHZ,
3838                     &val, 1);
3839         } else if (chan <= 165) {
3840                 run_efuse_read(sc,
3841             RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5GHZ,
3842                     &val, 1);
3843         } else
3844                 val = 0;
3845         run_bbp_write(sc, 159, val);
3846
3847         /* Tx0 IQ phase. */
3848         run_bbp_write(sc, 158, 0x2d);
3849         if (chan <= 14) {
3850                 run_efuse_read(sc, RT5390_EEPROM_IQ_PHASE_CAL_TX0_2GHZ,
3851                     &val, 1);
3852         } else if (chan <= 64) {
3853                 run_efuse_read(sc,
3854                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5GHZ,
3855                     &val, 1);
3856         } else if (chan <= 138) {
3857                 run_efuse_read(sc,
3858                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5GHZ,
3859                     &val, 1);
3860         } else if (chan <= 165) {
3861                 run_efuse_read(sc,
3862                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5GHZ,
3863                     &val, 1);
3864         } else
3865                 val = 0;
3866         run_bbp_write(sc, 159, val);
3867
3868         /* Tx1 IQ gain. */
3869         run_bbp_write(sc, 158, 0x4a);
3870         if (chan <= 14) {
3871                 run_efuse_read(sc, RT5390_EEPROM_IQ_GAIN_CAL_TX1_2GHZ,
3872                     &val, 1);
3873         } else if (chan <= 64) {
3874                 run_efuse_read(sc,
3875                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5GHZ,
3876                     &val, 1);
3877         } else if (chan <= 138) {
3878                 run_efuse_read(sc,
3879                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5GHZ,
3880                     &val, 1);
3881         } else if (chan <= 165) {
3882                 run_efuse_read(sc,
3883                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5GHZ,
3884                     &val, 1);
3885         } else
3886                 val = 0;
3887         run_bbp_write(sc, 159, val);
3888
3889         /* Tx1 IQ phase. */
3890         run_bbp_write(sc, 158, 0x4b);
3891         if (chan <= 14) {
3892                 run_efuse_read(sc, RT5390_EEPROM_IQ_PHASE_CAL_TX1_2GHZ,
3893                     &val, 1);
3894         } else if (chan <= 64) {
3895                 run_efuse_read(sc,
3896                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5GHZ,
3897                     &val, 1);
3898         } else if (chan <= 138) {
3899                 run_efuse_read(sc,
3900                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5GHZ,
3901                     &val, 1);
3902         } else if (chan <= 165) {
3903                 run_efuse_read(sc,
3904                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5GHZ,
3905                     &val, 1);
3906         } else
3907                 val = 0;
3908         run_bbp_write(sc, 159, val);
3909
3910         /* RF IQ compensation control. */
3911         run_bbp_write(sc, 158, 0x04);
3912         run_efuse_read(sc, RT5390_EEPROM_RF_IQ_COMPENSATION_CTL,
3913             &val, 1);
3914         run_bbp_write(sc, 159, val);
3915
3916         /* RF IQ imbalance compensation control. */
3917         run_bbp_write(sc, 158, 0x03);
3918         run_efuse_read(sc,
3919             RT5390_EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CTL, &val, 1);
3920         run_bbp_write(sc, 159, val);
3921 }
3922
3923 static void
3924 run_set_agc(struct run_softc *sc, uint8_t agc)
3925 {
3926         uint8_t bbp;
3927
3928         if (sc->mac_ver == 0x3572) {
3929                 run_bbp_read(sc, 27, &bbp);
3930                 bbp &= ~(0x3 << 5);
3931                 run_bbp_write(sc, 27, bbp | 0 << 5);    /* select Rx0 */
3932                 run_bbp_write(sc, 66, agc);
3933                 run_bbp_write(sc, 27, bbp | 1 << 5);    /* select Rx1 */
3934                 run_bbp_write(sc, 66, agc);
3935         } else
3936                 run_bbp_write(sc, 66, agc);
3937 }
3938
3939 static void
3940 run_select_chan_group(struct run_softc *sc, int group)
3941 {
3942         uint32_t tmp;
3943         uint8_t agc;
3944
3945         run_bbp_write(sc, 62, 0x37 - sc->lna[group]);
3946         run_bbp_write(sc, 63, 0x37 - sc->lna[group]);
3947         run_bbp_write(sc, 64, 0x37 - sc->lna[group]);
3948         if (sc->mac_ver < 0x3572)
3949                 run_bbp_write(sc, 86, 0x00);
3950
3951         if (sc->mac_ver == 0x3593) {
3952                 run_bbp_write(sc, 77, 0x98);
3953                 run_bbp_write(sc, 83, (group == 0) ? 0x8a : 0x9a);
3954         }
3955
3956         if (group == 0) {
3957                 if (sc->ext_2ghz_lna) {
3958                         if (sc->mac_ver >= 0x5390)
3959                                 run_bbp_write(sc, 75, 0x52);
3960                         else {
3961                                 run_bbp_write(sc, 82, 0x62);
3962                                 run_bbp_write(sc, 75, 0x46);
3963                         }
3964                 } else {
3965                         if (sc->mac_ver == 0x5592) {
3966                                 run_bbp_write(sc, 79, 0x1c);
3967                                 run_bbp_write(sc, 80, 0x0e);
3968                                 run_bbp_write(sc, 81, 0x3a);
3969                                 run_bbp_write(sc, 82, 0x62);
3970
3971                                 run_bbp_write(sc, 195, 0x80);
3972                                 run_bbp_write(sc, 196, 0xe0);
3973                                 run_bbp_write(sc, 195, 0x81);
3974                                 run_bbp_write(sc, 196, 0x1f);
3975                                 run_bbp_write(sc, 195, 0x82);
3976                                 run_bbp_write(sc, 196, 0x38);
3977                                 run_bbp_write(sc, 195, 0x83);
3978                                 run_bbp_write(sc, 196, 0x32);
3979                                 run_bbp_write(sc, 195, 0x85);
3980                                 run_bbp_write(sc, 196, 0x28);
3981                                 run_bbp_write(sc, 195, 0x86);
3982                                 run_bbp_write(sc, 196, 0x19);
3983                         } else if (sc->mac_ver >= 0x5390)
3984                                 run_bbp_write(sc, 75, 0x50);
3985                         else {
3986                                 run_bbp_write(sc, 82,
3987                                     (sc->mac_ver == 0x3593) ? 0x62 : 0x84);
3988                                 run_bbp_write(sc, 75, 0x50);
3989                         }
3990                 }
3991         } else {
3992                 if (sc->mac_ver == 0x5592) {
3993                         run_bbp_write(sc, 79, 0x18);
3994                         run_bbp_write(sc, 80, 0x08);
3995                         run_bbp_write(sc, 81, 0x38);
3996                         run_bbp_write(sc, 82, 0x92);
3997
3998                         run_bbp_write(sc, 195, 0x80);
3999                         run_bbp_write(sc, 196, 0xf0);
4000                         run_bbp_write(sc, 195, 0x81);
4001                         run_bbp_write(sc, 196, 0x1e);
4002                         run_bbp_write(sc, 195, 0x82);
4003                         run_bbp_write(sc, 196, 0x28);
4004                         run_bbp_write(sc, 195, 0x83);
4005                         run_bbp_write(sc, 196, 0x20);
4006                         run_bbp_write(sc, 195, 0x85);
4007                         run_bbp_write(sc, 196, 0x7f);
4008                         run_bbp_write(sc, 195, 0x86);
4009                         run_bbp_write(sc, 196, 0x7f);
4010                 } else if (sc->mac_ver == 0x3572)
4011                         run_bbp_write(sc, 82, 0x94);
4012                 else
4013                         run_bbp_write(sc, 82,
4014                             (sc->mac_ver == 0x3593) ? 0x82 : 0xf2);
4015                 if (sc->ext_5ghz_lna)
4016                         run_bbp_write(sc, 75, 0x46);
4017                 else
4018                         run_bbp_write(sc, 75, 0x50);
4019         }
4020
4021         run_read(sc, RT2860_TX_BAND_CFG, &tmp);
4022         tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
4023         tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
4024         run_write(sc, RT2860_TX_BAND_CFG, tmp);
4025
4026         /* enable appropriate Power Amplifiers and Low Noise Amplifiers */
4027         tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
4028         if (sc->mac_ver == 0x3593)
4029                 tmp |= 1 << 29 | 1 << 28;
4030         if (sc->nrxchains > 1)
4031                 tmp |= RT2860_LNA_PE1_EN;
4032         if (group == 0) {       /* 2GHz */
4033                 tmp |= RT2860_PA_PE_G0_EN;
4034                 if (sc->ntxchains > 1)
4035                         tmp |= RT2860_PA_PE_G1_EN;
4036                 if (sc->mac_ver == 0x3593) {
4037                         if (sc->ntxchains > 2)
4038                                 tmp |= 1 << 25;
4039                 }
4040         } else {                /* 5GHz */
4041                 tmp |= RT2860_PA_PE_A0_EN;
4042                 if (sc->ntxchains > 1)
4043                         tmp |= RT2860_PA_PE_A1_EN;
4044         }
4045         if (sc->mac_ver == 0x3572) {
4046                 run_rt3070_rf_write(sc, 8, 0x00);
4047                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
4048                 run_rt3070_rf_write(sc, 8, 0x80);
4049         } else
4050                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
4051
4052         if (sc->mac_ver == 0x5592) {
4053                 run_bbp_write(sc, 195, 0x8d);
4054                 run_bbp_write(sc, 196, 0x1a);
4055         }
4056
4057         if (sc->mac_ver == 0x3593) {
4058                 run_read(sc, RT2860_GPIO_CTRL, &tmp);
4059                 tmp &= ~0x01010000;
4060                 if (group == 0)
4061                         tmp |= 0x00010000;
4062                 tmp = (tmp & ~0x00009090) | 0x00000090;
4063                 run_write(sc, RT2860_GPIO_CTRL, tmp);
4064         }
4065
4066         /* set initial AGC value */
4067         if (group == 0) {       /* 2GHz band */
4068                 if (sc->mac_ver >= 0x3070)
4069                         agc = 0x1c + sc->lna[0] * 2;
4070                 else
4071                         agc = 0x2e + sc->lna[0];
4072         } else {                /* 5GHz band */
4073                 if (sc->mac_ver == 0x5592)
4074                         agc = 0x24 + sc->lna[group] * 2;
4075                 else if (sc->mac_ver == 0x3572 || sc->mac_ver == 0x3593)
4076                         agc = 0x22 + (sc->lna[group] * 5) / 3;
4077                 else
4078                         agc = 0x32 + (sc->lna[group] * 5) / 3;
4079         }
4080         run_set_agc(sc, agc);
4081 }
4082
4083 static void
4084 run_rt2870_set_chan(struct run_softc *sc, u_int chan)
4085 {
4086         const struct rfprog *rfprog = rt2860_rf2850;
4087         uint32_t r2, r3, r4;
4088         int8_t txpow1, txpow2;
4089         int i;
4090
4091         /* find the settings for this channel (we know it exists) */
4092         for (i = 0; rfprog[i].chan != chan; i++);
4093
4094         r2 = rfprog[i].r2;
4095         if (sc->ntxchains == 1)
4096                 r2 |= 1 << 14;          /* 1T: disable Tx chain 2 */
4097         if (sc->nrxchains == 1)
4098                 r2 |= 1 << 17 | 1 << 6; /* 1R: disable Rx chains 2 & 3 */
4099         else if (sc->nrxchains == 2)
4100                 r2 |= 1 << 6;           /* 2R: disable Rx chain 3 */
4101
4102         /* use Tx power values from EEPROM */
4103         txpow1 = sc->txpow1[i];
4104         txpow2 = sc->txpow2[i];
4105
4106         /* Initialize RF R3 and R4. */
4107         r3 = rfprog[i].r3 & 0xffffc1ff;
4108         r4 = (rfprog[i].r4 & ~(0x001f87c0)) | (sc->freq << 15);
4109         if (chan > 14) {
4110                 if (txpow1 >= 0) {
4111                         txpow1 = (txpow1 > 0xf) ? (0xf) : (txpow1);
4112                         r3 |= (txpow1 << 10) | (1 << 9);
4113                 } else {
4114                         txpow1 += 7;
4115
4116                         /* txpow1 is not possible larger than 15. */
4117                         r3 |= (txpow1 << 10);
4118                 }
4119                 if (txpow2 >= 0) {
4120                         txpow2 = (txpow2 > 0xf) ? (0xf) : (txpow2);
4121                         r4 |= (txpow2 << 7) | (1 << 6);
4122                 } else {
4123                         txpow2 += 7;
4124                         r4 |= (txpow2 << 7);
4125                 }
4126         } else {
4127                 /* Set Tx0 power. */
4128                 r3 |= (txpow1 << 9);
4129
4130                 /* Set frequency offset and Tx1 power. */
4131                 r4 |= (txpow2 << 6);
4132         }
4133
4134         run_rt2870_rf_write(sc, rfprog[i].r1);
4135         run_rt2870_rf_write(sc, r2);
4136         run_rt2870_rf_write(sc, r3 & ~(1 << 2));
4137         run_rt2870_rf_write(sc, r4);
4138
4139         run_delay(sc, 10);
4140
4141         run_rt2870_rf_write(sc, rfprog[i].r1);
4142         run_rt2870_rf_write(sc, r2);
4143         run_rt2870_rf_write(sc, r3 | (1 << 2));
4144         run_rt2870_rf_write(sc, r4);
4145
4146         run_delay(sc, 10);
4147
4148         run_rt2870_rf_write(sc, rfprog[i].r1);
4149         run_rt2870_rf_write(sc, r2);
4150         run_rt2870_rf_write(sc, r3 & ~(1 << 2));
4151         run_rt2870_rf_write(sc, r4);
4152 }
4153
4154 static void
4155 run_rt3070_set_chan(struct run_softc *sc, u_int chan)
4156 {
4157         int8_t txpow1, txpow2;
4158         uint8_t rf;
4159         int i;
4160
4161         /* find the settings for this channel (we know it exists) */
4162         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4163
4164         /* use Tx power values from EEPROM */
4165         txpow1 = sc->txpow1[i];
4166         txpow2 = sc->txpow2[i];
4167
4168         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
4169
4170         /* RT3370/RT3390: RF R3 [7:4] is not reserved bits. */
4171         run_rt3070_rf_read(sc, 3, &rf);
4172         rf = (rf & ~0x0f) | rt3070_freqs[i].k;
4173         run_rt3070_rf_write(sc, 3, rf);
4174
4175         run_rt3070_rf_read(sc, 6, &rf);
4176         rf = (rf & ~0x03) | rt3070_freqs[i].r;
4177         run_rt3070_rf_write(sc, 6, rf);
4178
4179         /* set Tx0 power */
4180         run_rt3070_rf_read(sc, 12, &rf);
4181         rf = (rf & ~0x1f) | txpow1;
4182         run_rt3070_rf_write(sc, 12, rf);
4183
4184         /* set Tx1 power */
4185         run_rt3070_rf_read(sc, 13, &rf);
4186         rf = (rf & ~0x1f) | txpow2;
4187         run_rt3070_rf_write(sc, 13, rf);
4188
4189         run_rt3070_rf_read(sc, 1, &rf);
4190         rf &= ~0xfc;
4191         if (sc->ntxchains == 1)
4192                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
4193         else if (sc->ntxchains == 2)
4194                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
4195         if (sc->nrxchains == 1)
4196                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
4197         else if (sc->nrxchains == 2)
4198                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
4199         run_rt3070_rf_write(sc, 1, rf);
4200
4201         /* set RF offset */
4202         run_rt3070_rf_read(sc, 23, &rf);
4203         rf = (rf & ~0x7f) | sc->freq;
4204         run_rt3070_rf_write(sc, 23, rf);
4205
4206         /* program RF filter */
4207         run_rt3070_rf_read(sc, 24, &rf);        /* Tx */
4208         rf = (rf & ~0x3f) | sc->rf24_20mhz;
4209         run_rt3070_rf_write(sc, 24, rf);
4210         run_rt3070_rf_read(sc, 31, &rf);        /* Rx */
4211         rf = (rf & ~0x3f) | sc->rf24_20mhz;
4212         run_rt3070_rf_write(sc, 31, rf);
4213
4214         /* enable RF tuning */
4215         run_rt3070_rf_read(sc, 7, &rf);
4216         run_rt3070_rf_write(sc, 7, rf | 0x01);
4217 }
4218
4219 static void
4220 run_rt3572_set_chan(struct run_softc *sc, u_int chan)
4221 {
4222         int8_t txpow1, txpow2;
4223         uint32_t tmp;
4224         uint8_t rf;
4225         int i;
4226
4227         /* find the settings for this channel (we know it exists) */
4228         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4229
4230         /* use Tx power values from EEPROM */
4231         txpow1 = sc->txpow1[i];
4232         txpow2 = sc->txpow2[i];
4233
4234         if (chan <= 14) {
4235                 run_bbp_write(sc, 25, sc->bbp25);
4236                 run_bbp_write(sc, 26, sc->bbp26);
4237         } else {
4238                 /* enable IQ phase correction */
4239                 run_bbp_write(sc, 25, 0x09);
4240                 run_bbp_write(sc, 26, 0xff);
4241         }
4242
4243         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
4244         run_rt3070_rf_write(sc, 3, rt3070_freqs[i].k);
4245         run_rt3070_rf_read(sc, 6, &rf);
4246         rf  = (rf & ~0x0f) | rt3070_freqs[i].r;
4247         rf |= (chan <= 14) ? 0x08 : 0x04;
4248         run_rt3070_rf_write(sc, 6, rf);
4249
4250         /* set PLL mode */
4251         run_rt3070_rf_read(sc, 5, &rf);
4252         rf &= ~(0x08 | 0x04);
4253         rf |= (chan <= 14) ? 0x04 : 0x08;
4254         run_rt3070_rf_write(sc, 5, rf);
4255
4256         /* set Tx power for chain 0 */
4257         if (chan <= 14)
4258                 rf = 0x60 | txpow1;
4259         else
4260                 rf = 0xe0 | (txpow1 & 0xc) << 1 | (txpow1 & 0x3);
4261         run_rt3070_rf_write(sc, 12, rf);
4262
4263         /* set Tx power for chain 1 */
4264         if (chan <= 14)
4265                 rf = 0x60 | txpow2;
4266         else
4267                 rf = 0xe0 | (txpow2 & 0xc) << 1 | (txpow2 & 0x3);
4268         run_rt3070_rf_write(sc, 13, rf);
4269
4270         /* set Tx/Rx streams */
4271         run_rt3070_rf_read(sc, 1, &rf);
4272         rf &= ~0xfc;
4273         if (sc->ntxchains == 1)
4274                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
4275         else if (sc->ntxchains == 2)
4276                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
4277         if (sc->nrxchains == 1)
4278                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
4279         else if (sc->nrxchains == 2)
4280                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
4281         run_rt3070_rf_write(sc, 1, rf);
4282
4283         /* set RF offset */
4284         run_rt3070_rf_read(sc, 23, &rf);
4285         rf = (rf & ~0x7f) | sc->freq;
4286         run_rt3070_rf_write(sc, 23, rf);
4287
4288         /* program RF filter */
4289         rf = sc->rf24_20mhz;
4290         run_rt3070_rf_write(sc, 24, rf);        /* Tx */
4291         run_rt3070_rf_write(sc, 31, rf);        /* Rx */
4292
4293         /* enable RF tuning */
4294         run_rt3070_rf_read(sc, 7, &rf);
4295         rf = (chan <= 14) ? 0xd8 : ((rf & ~0xc8) | 0x14);
4296         run_rt3070_rf_write(sc, 7, rf);
4297
4298         /* TSSI */
4299         rf = (chan <= 14) ? 0xc3 : 0xc0;
4300         run_rt3070_rf_write(sc, 9, rf);
4301
4302         /* set loop filter 1 */
4303         run_rt3070_rf_write(sc, 10, 0xf1);
4304         /* set loop filter 2 */
4305         run_rt3070_rf_write(sc, 11, (chan <= 14) ? 0xb9 : 0x00);
4306
4307         /* set tx_mx2_ic */
4308         run_rt3070_rf_write(sc, 15, (chan <= 14) ? 0x53 : 0x43);
4309         /* set tx_mx1_ic */
4310         if (chan <= 14)
4311                 rf = 0x48 | sc->txmixgain_2ghz;
4312         else
4313                 rf = 0x78 | sc->txmixgain_5ghz;
4314         run_rt3070_rf_write(sc, 16, rf);
4315
4316         /* set tx_lo1 */
4317         run_rt3070_rf_write(sc, 17, 0x23);
4318         /* set tx_lo2 */
4319         if (chan <= 14)
4320                 rf = 0x93;
4321         else if (chan <= 64)
4322                 rf = 0xb7;
4323         else if (chan <= 128)
4324                 rf = 0x74;
4325         else
4326                 rf = 0x72;
4327         run_rt3070_rf_write(sc, 19, rf);
4328
4329         /* set rx_lo1 */
4330         if (chan <= 14)
4331                 rf = 0xb3;
4332         else if (chan <= 64)
4333                 rf = 0xf6;
4334         else if (chan <= 128)
4335                 rf = 0xf4;
4336         else
4337                 rf = 0xf3;
4338         run_rt3070_rf_write(sc, 20, rf);
4339
4340         /* set pfd_delay */
4341         if (chan <= 14)
4342                 rf = 0x15;
4343         else if (chan <= 64)
4344                 rf = 0x3d;
4345         else
4346                 rf = 0x01;
4347         run_rt3070_rf_write(sc, 25, rf);
4348
4349         /* set rx_lo2 */
4350         run_rt3070_rf_write(sc, 26, (chan <= 14) ? 0x85 : 0x87);
4351         /* set ldo_rf_vc */
4352         run_rt3070_rf_write(sc, 27, (chan <= 14) ? 0x00 : 0x01);
4353         /* set drv_cc */
4354         run_rt3070_rf_write(sc, 29, (chan <= 14) ? 0x9b : 0x9f);
4355
4356         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4357         tmp &= ~0x8080;
4358         if (chan <= 14)
4359                 tmp |= 0x80;
4360         run_write(sc, RT2860_GPIO_CTRL, tmp);
4361
4362         /* enable RF tuning */
4363         run_rt3070_rf_read(sc, 7, &rf);
4364         run_rt3070_rf_write(sc, 7, rf | 0x01);
4365
4366         run_delay(sc, 2);
4367 }
4368
4369 static void
4370 run_rt3593_set_chan(struct run_softc *sc, u_int chan)
4371 {
4372         int8_t txpow1, txpow2, txpow3;
4373         uint8_t h20mhz, rf;
4374         int i;
4375
4376         /* find the settings for this channel (we know it exists) */
4377         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4378
4379         /* use Tx power values from EEPROM */
4380         txpow1 = sc->txpow1[i];
4381         txpow2 = sc->txpow2[i];
4382         txpow3 = (sc->ntxchains == 3) ? sc->txpow3[i] : 0;
4383
4384         if (chan <= 14) {
4385                 run_bbp_write(sc, 25, sc->bbp25);
4386                 run_bbp_write(sc, 26, sc->bbp26);
4387         } else {
4388                 /* Enable IQ phase correction. */
4389                 run_bbp_write(sc, 25, 0x09);
4390                 run_bbp_write(sc, 26, 0xff);
4391         }
4392
4393         run_rt3070_rf_write(sc, 8, rt3070_freqs[i].n);
4394         run_rt3070_rf_write(sc, 9, rt3070_freqs[i].k & 0x0f);
4395         run_rt3070_rf_read(sc, 11, &rf);
4396         rf = (rf & ~0x03) | (rt3070_freqs[i].r & 0x03);
4397         run_rt3070_rf_write(sc, 11, rf);
4398
4399         /* Set pll_idoh. */
4400         run_rt3070_rf_read(sc, 11, &rf);
4401         rf &= ~0x4c;
4402         rf |= (chan <= 14) ? 0x44 : 0x48;
4403         run_rt3070_rf_write(sc, 11, rf);
4404
4405         if (chan <= 14)
4406                 rf = txpow1 & 0x1f;
4407         else
4408                 rf = 0x40 | ((txpow1 & 0x18) << 1) | (txpow1 & 0x07);
4409         run_rt3070_rf_write(sc, 53, rf);
4410
4411         if (chan <= 14)
4412                 rf = txpow2 & 0x1f;
4413         else
4414                 rf = 0x40 | ((txpow2 & 0x18) << 1) | (txpow2 & 0x07);
4415         run_rt3070_rf_write(sc, 55, rf);
4416
4417         if (chan <= 14)
4418                 rf = txpow3 & 0x1f;
4419         else
4420                 rf = 0x40 | ((txpow3 & 0x18) << 1) | (txpow3 & 0x07);
4421         run_rt3070_rf_write(sc, 54, rf);
4422
4423         rf = RT3070_RF_BLOCK | RT3070_PLL_PD;
4424         if (sc->ntxchains == 3)
4425                 rf |= RT3070_TX0_PD | RT3070_TX1_PD | RT3070_TX2_PD;
4426         else
4427                 rf |= RT3070_TX0_PD | RT3070_TX1_PD;
4428         rf |= RT3070_RX0_PD | RT3070_RX1_PD | RT3070_RX2_PD;
4429         run_rt3070_rf_write(sc, 1, rf);
4430
4431         run_adjust_freq_offset(sc);
4432
4433         run_rt3070_rf_write(sc, 31, (chan <= 14) ? 0xa0 : 0x80);
4434
4435         h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
4436         run_rt3070_rf_read(sc, 30, &rf);
4437         rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
4438         run_rt3070_rf_write(sc, 30, rf);
4439
4440         run_rt3070_rf_read(sc, 36, &rf);
4441         if (chan <= 14)
4442                 rf |= 0x80;
4443         else
4444                 rf &= ~0x80;
4445         run_rt3070_rf_write(sc, 36, rf);
4446
4447         /* Set vcolo_bs. */
4448         run_rt3070_rf_write(sc, 34, (chan <= 14) ? 0x3c : 0x20);
4449         /* Set pfd_delay. */
4450         run_rt3070_rf_write(sc, 12, (chan <= 14) ? 0x1a : 0x12);
4451
4452         /* Set vco bias current control. */
4453         run_rt3070_rf_read(sc, 6, &rf);
4454         rf &= ~0xc0;
4455         if (chan <= 14)
4456                 rf |= 0x40;
4457         else if (chan <= 128)
4458                 rf |= 0x80;
4459         else
4460                 rf |= 0x40;
4461         run_rt3070_rf_write(sc, 6, rf);
4462
4463         run_rt3070_rf_read(sc, 30, &rf);
4464         rf = (rf & ~0x18) | 0x10;
4465         run_rt3070_rf_write(sc, 30, rf);
4466
4467         run_rt3070_rf_write(sc, 10, (chan <= 14) ? 0xd3 : 0xd8);
4468         run_rt3070_rf_write(sc, 13, (chan <= 14) ? 0x12 : 0x23);
4469
4470         run_rt3070_rf_read(sc, 51, &rf);
4471         rf = (rf & ~0x03) | 0x01;
4472         run_rt3070_rf_write(sc, 51, rf);
4473         /* Set tx_mx1_cc. */
4474         run_rt3070_rf_read(sc, 51, &rf);
4475         rf &= ~0x1c;
4476         rf |= (chan <= 14) ? 0x14 : 0x10;
4477         run_rt3070_rf_write(sc, 51, rf);
4478         /* Set tx_mx1_ic. */
4479         run_rt3070_rf_read(sc, 51, &rf);
4480         rf &= ~0xe0;
4481         rf |= (chan <= 14) ? 0x60 : 0x40;
4482         run_rt3070_rf_write(sc, 51, rf);
4483         /* Set tx_lo1_ic. */
4484         run_rt3070_rf_read(sc, 49, &rf);
4485         rf &= ~0x1c;
4486         rf |= (chan <= 14) ? 0x0c : 0x08;
4487         run_rt3070_rf_write(sc, 49, rf);
4488         /* Set tx_lo1_en. */
4489         run_rt3070_rf_read(sc, 50, &rf);
4490         run_rt3070_rf_write(sc, 50, rf & ~0x20);
4491         /* Set drv_cc. */
4492         run_rt3070_rf_read(sc, 57, &rf);
4493         rf &= ~0xfc;
4494         rf |= (chan <= 14) ?  0x6c : 0x3c;
4495         run_rt3070_rf_write(sc, 57, rf);
4496         /* Set rx_mix1_ic, rxa_lnactr, lna_vc, lna_inbias_en and lna_en. */
4497         run_rt3070_rf_write(sc, 44, (chan <= 14) ? 0x93 : 0x9b);
4498         /* Set drv_gnd_a, tx_vga_cc_a and tx_mx2_gain. */
4499         run_rt3070_rf_write(sc, 52, (chan <= 14) ? 0x45 : 0x05);
4500         /* Enable VCO calibration. */
4501         run_rt3070_rf_read(sc, 3, &rf);
4502         rf &= ~RT5390_VCOCAL;
4503         rf |= (chan <= 14) ? RT5390_VCOCAL : 0xbe;
4504         run_rt3070_rf_write(sc, 3, rf);
4505
4506         if (chan <= 14)
4507                 rf = 0x23;
4508         else if (chan <= 64)
4509                 rf = 0x36;
4510         else if (chan <= 128)
4511                 rf = 0x32;
4512         else
4513                 rf = 0x30;
4514         run_rt3070_rf_write(sc, 39, rf);
4515         if (chan <= 14)
4516                 rf = 0xbb;
4517         else if (chan <= 64)
4518                 rf = 0xeb;
4519         else if (chan <= 128)
4520                 rf = 0xb3;
4521         else
4522                 rf = 0x9b;
4523         run_rt3070_rf_write(sc, 45, rf);
4524
4525         /* Set FEQ/AEQ control. */
4526         run_bbp_write(sc, 105, 0x34);
4527 }
4528
4529 static void
4530 run_rt5390_set_chan(struct run_softc *sc, u_int chan)
4531 {
4532         int8_t txpow1, txpow2;
4533         uint8_t rf;
4534         int i;
4535
4536         /* find the settings for this channel (we know it exists) */
4537         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4538
4539         /* use Tx power values from EEPROM */
4540         txpow1 = sc->txpow1[i];
4541         txpow2 = sc->txpow2[i];
4542
4543         run_rt3070_rf_write(sc, 8, rt3070_freqs[i].n);
4544         run_rt3070_rf_write(sc, 9, rt3070_freqs[i].k & 0x0f);
4545         run_rt3070_rf_read(sc, 11, &rf);
4546         rf = (rf & ~0x03) | (rt3070_freqs[i].r & 0x03);
4547         run_rt3070_rf_write(sc, 11, rf);
4548
4549         run_rt3070_rf_read(sc, 49, &rf);
4550         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
4551         /* The valid range of the RF R49 is 0x00 to 0x27. */
4552         if ((rf & 0x3f) > 0x27)
4553                 rf = (rf & ~0x3f) | 0x27;
4554         run_rt3070_rf_write(sc, 49, rf);
4555
4556         if (sc->mac_ver == 0x5392) {
4557                 run_rt3070_rf_read(sc, 50, &rf);
4558                 rf = (rf & ~0x3f) | (txpow2 & 0x3f);
4559                 /* The valid range of the RF R50 is 0x00 to 0x27. */
4560                 if ((rf & 0x3f) > 0x27)
4561                         rf = (rf & ~0x3f) | 0x27;
4562                 run_rt3070_rf_write(sc, 50, rf);
4563         }
4564
4565         run_rt3070_rf_read(sc, 1, &rf);
4566         rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
4567         if (sc->mac_ver == 0x5392)
4568                 rf |= RT3070_RX1_PD | RT3070_TX1_PD;
4569         run_rt3070_rf_write(sc, 1, rf);
4570
4571         if (sc->mac_ver != 0x5392) {
4572                 run_rt3070_rf_read(sc, 2, &rf);
4573                 rf |= 0x80;
4574                 run_rt3070_rf_write(sc, 2, rf);
4575                 run_delay(sc, 10);
4576                 rf &= 0x7f;
4577                 run_rt3070_rf_write(sc, 2, rf);
4578         }
4579
4580         run_adjust_freq_offset(sc);
4581
4582         if (sc->mac_ver == 0x5392) {
4583                 /* Fix for RT5392C. */
4584                 if (sc->mac_rev >= 0x0223) {
4585                         if (chan <= 4)
4586                                 rf = 0x0f;
4587                         else if (chan >= 5 && chan <= 7)
4588                                 rf = 0x0e;
4589                         else
4590                                 rf = 0x0d;
4591                         run_rt3070_rf_write(sc, 23, rf);
4592
4593                         if (chan <= 4)
4594                                 rf = 0x0c;
4595                         else if (chan == 5)
4596                                 rf = 0x0b;
4597                         else if (chan >= 6 && chan <= 7)
4598                                 rf = 0x0a;
4599                         else if (chan >= 8 && chan <= 10)
4600                                 rf = 0x09;
4601                         else
4602                                 rf = 0x08;
4603                         run_rt3070_rf_write(sc, 59, rf);
4604                 } else {
4605                         if (chan <= 11)
4606                                 rf = 0x0f;
4607                         else
4608                                 rf = 0x0b;
4609                         run_rt3070_rf_write(sc, 59, rf);
4610                 }
4611         } else {
4612                 /* Fix for RT5390F. */
4613                 if (sc->mac_rev >= 0x0502) {
4614                         if (chan <= 11)
4615                                 rf = 0x43;
4616                         else
4617                                 rf = 0x23;
4618                         run_rt3070_rf_write(sc, 55, rf);
4619
4620                         if (chan <= 11)
4621                                 rf = 0x0f;
4622                         else if (chan == 12)
4623                                 rf = 0x0d;
4624                         else
4625                                 rf = 0x0b;
4626                         run_rt3070_rf_write(sc, 59, rf);
4627                 } else {
4628                         run_rt3070_rf_write(sc, 55, 0x44);
4629                         run_rt3070_rf_write(sc, 59, 0x8f);
4630                 }
4631         }
4632
4633         /* Enable VCO calibration. */
4634         run_rt3070_rf_read(sc, 3, &rf);
4635         rf |= RT5390_VCOCAL;
4636         run_rt3070_rf_write(sc, 3, rf);
4637 }
4638
4639 static void
4640 run_rt5592_set_chan(struct run_softc *sc, u_int chan)
4641 {
4642         const struct rt5592_freqs *freqs;
4643         uint32_t tmp;
4644         uint8_t reg, rf, txpow_bound;
4645         int8_t txpow1, txpow2;
4646         int i;
4647
4648         run_read(sc, RT5592_DEBUG_INDEX, &tmp);
4649         freqs = (tmp & RT5592_SEL_XTAL) ?
4650             rt5592_freqs_40mhz : rt5592_freqs_20mhz;
4651
4652         /* find the settings for this channel (we know it exists) */
4653         for (i = 0; rt2860_rf2850[i].chan != chan; i++, freqs++);
4654
4655         /* use Tx power values from EEPROM */
4656         txpow1 = sc->txpow1[i];
4657         txpow2 = sc->txpow2[i];
4658
4659         run_read(sc, RT3070_LDO_CFG0, &tmp);
4660         tmp &= ~0x1c000000;
4661         if (chan > 14)
4662                 tmp |= 0x14000000;
4663         run_write(sc, RT3070_LDO_CFG0, tmp);
4664
4665         /* N setting. */
4666         run_rt3070_rf_write(sc, 8, freqs->n & 0xff);
4667         run_rt3070_rf_read(sc, 9, &rf);
4668         rf &= ~(1 << 4);
4669         rf |= ((freqs->n & 0x0100) >> 8) << 4;
4670         run_rt3070_rf_write(sc, 9, rf);
4671
4672         /* K setting. */
4673         run_rt3070_rf_read(sc, 9, &rf);
4674         rf &= ~0x0f;
4675         rf |= (freqs->k & 0x0f);
4676         run_rt3070_rf_write(sc, 9, rf);
4677
4678         /* Mode setting. */
4679         run_rt3070_rf_read(sc, 11, &rf);
4680         rf &= ~0x0c;
4681         rf |= ((freqs->m - 0x8) & 0x3) << 2;
4682         run_rt3070_rf_write(sc, 11, rf);
4683         run_rt3070_rf_read(sc, 9, &rf);
4684         rf &= ~(1 << 7);
4685         rf |= (((freqs->m - 0x8) & 0x4) >> 2) << 7;
4686         run_rt3070_rf_write(sc, 9, rf);
4687
4688         /* R setting. */
4689         run_rt3070_rf_read(sc, 11, &rf);
4690         rf &= ~0x03;
4691         rf |= (freqs->r - 0x1);
4692         run_rt3070_rf_write(sc, 11, rf);
4693
4694         if (chan <= 14) {
4695                 /* Initialize RF registers for 2GHZ. */
4696                 for (i = 0; i < NELEM(rt5592_2ghz_def_rf); i++) {
4697                         run_rt3070_rf_write(sc, rt5592_2ghz_def_rf[i].reg,
4698                             rt5592_2ghz_def_rf[i].val);
4699                 }
4700
4701                 rf = (chan <= 10) ? 0x07 : 0x06;
4702                 run_rt3070_rf_write(sc, 23, rf);
4703                 run_rt3070_rf_write(sc, 59, rf);
4704
4705                 run_rt3070_rf_write(sc, 55, 0x43);
4706
4707                 /*
4708                  * RF R49/R50 Tx power ALC code.
4709                  * G-band bit<7:6>=1:0, bit<5:0> range from 0x0 ~ 0x27.
4710                  */
4711                 reg = 2;
4712                 txpow_bound = 0x27;
4713         } else {
4714                 /* Initialize RF registers for 5GHZ. */
4715                 for (i = 0; i < NELEM(rt5592_5ghz_def_rf); i++) {
4716                         run_rt3070_rf_write(sc, rt5592_5ghz_def_rf[i].reg,
4717                             rt5592_5ghz_def_rf[i].val);
4718                 }
4719                 for (i = 0; i < NELEM(rt5592_chan_5ghz); i++) {
4720                         if (chan >= rt5592_chan_5ghz[i].firstchan &&
4721                             chan <= rt5592_chan_5ghz[i].lastchan) {
4722                                 run_rt3070_rf_write(sc, rt5592_chan_5ghz[i].reg,
4723                                     rt5592_chan_5ghz[i].val);
4724                         }
4725                 }
4726
4727                 /*
4728                  * RF R49/R50 Tx power ALC code.
4729                  * A-band bit<7:6>=1:1, bit<5:0> range from 0x0 ~ 0x2b.
4730                  */
4731                 reg = 3;
4732                 txpow_bound = 0x2b;
4733         }
4734
4735         /* RF R49 ch0 Tx power ALC code. */
4736         run_rt3070_rf_read(sc, 49, &rf);
4737         rf &= ~0xc0;
4738         rf |= (reg << 6);
4739         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
4740         if ((rf & 0x3f) > txpow_bound)
4741                 rf = (rf & ~0x3f) | txpow_bound;
4742         run_rt3070_rf_write(sc, 49, rf);
4743
4744         /* RF R50 ch1 Tx power ALC code. */
4745         run_rt3070_rf_read(sc, 50, &rf);
4746         rf &= ~(1 << 7 | 1 << 6);
4747         rf |= (reg << 6);
4748         rf = (rf & ~0x3f) | (txpow2 & 0x3f);
4749         if ((rf & 0x3f) > txpow_bound)
4750                 rf = (rf & ~0x3f) | txpow_bound;
4751         run_rt3070_rf_write(sc, 50, rf);
4752
4753         /* Enable RF_BLOCK, PLL_PD, RX0_PD, and TX0_PD. */
4754         run_rt3070_rf_read(sc, 1, &rf);
4755         rf |= (RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD);
4756         if (sc->ntxchains > 1)
4757                 rf |= RT3070_TX1_PD;
4758         if (sc->nrxchains > 1)
4759                 rf |= RT3070_RX1_PD;
4760         run_rt3070_rf_write(sc, 1, rf);
4761
4762         run_rt3070_rf_write(sc, 6, 0xe4);
4763
4764         run_rt3070_rf_write(sc, 30, 0x10);
4765         run_rt3070_rf_write(sc, 31, 0x80);
4766         run_rt3070_rf_write(sc, 32, 0x80);
4767
4768         run_adjust_freq_offset(sc);
4769
4770         /* Enable VCO calibration. */
4771         run_rt3070_rf_read(sc, 3, &rf);
4772         rf |= RT5390_VCOCAL;
4773         run_rt3070_rf_write(sc, 3, rf);
4774 }
4775
4776 static void
4777 run_set_rx_antenna(struct run_softc *sc, int aux)
4778 {
4779         uint32_t tmp;
4780         uint8_t bbp152;
4781
4782         if (aux) {
4783                 if (sc->rf_rev == RT5390_RF_5370) {
4784                         run_bbp_read(sc, 152, &bbp152);
4785                         run_bbp_write(sc, 152, bbp152 & ~0x80);
4786                 } else {
4787                         run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 0);
4788                         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4789                         run_write(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
4790                 }
4791         } else {
4792                 if (sc->rf_rev == RT5390_RF_5370) {
4793                         run_bbp_read(sc, 152, &bbp152);
4794                         run_bbp_write(sc, 152, bbp152 | 0x80);
4795                 } else {
4796                         run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 1);
4797                         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4798                         run_write(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
4799                 }
4800         }
4801 }
4802
4803 static int
4804 run_set_chan(struct run_softc *sc, struct ieee80211_channel *c)
4805 {
4806         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
4807         u_int chan, group;
4808
4809         chan = ieee80211_chan2ieee(ic, c);
4810         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
4811                 return (EINVAL);
4812
4813         if (sc->mac_ver == 0x5592)
4814                 run_rt5592_set_chan(sc, chan);
4815         else if (sc->mac_ver >= 0x5390)
4816                 run_rt5390_set_chan(sc, chan);
4817         else if (sc->mac_ver == 0x3593)
4818                 run_rt3593_set_chan(sc, chan);
4819         else if (sc->mac_ver == 0x3572)
4820                 run_rt3572_set_chan(sc, chan);
4821         else if (sc->mac_ver >= 0x3070)
4822                 run_rt3070_set_chan(sc, chan);
4823         else
4824                 run_rt2870_set_chan(sc, chan);
4825
4826         /* determine channel group */
4827         if (chan <= 14)
4828                 group = 0;
4829         else if (chan <= 64)
4830                 group = 1;
4831         else if (chan <= 128)
4832                 group = 2;
4833         else
4834                 group = 3;
4835
4836         /* XXX necessary only when group has changed! */
4837         run_select_chan_group(sc, group);
4838
4839         run_delay(sc, 10);
4840
4841         /* Perform IQ calibration. */
4842         if (sc->mac_ver >= 0x5392)
4843                 run_iq_calib(sc, chan);
4844
4845         return (0);
4846 }
4847
4848 static void
4849 run_set_channel(struct ieee80211com *ic)
4850 {
4851         struct run_softc *sc = ic->ic_ifp->if_softc;
4852
4853         RUN_LOCK(sc);
4854         run_set_chan(sc, ic->ic_curchan);
4855         RUN_UNLOCK(sc);
4856
4857         return;
4858 }
4859
4860 static void
4861 run_scan_start(struct ieee80211com *ic)
4862 {
4863         struct run_softc *sc = ic->ic_ifp->if_softc;
4864         uint32_t tmp;
4865
4866         RUN_LOCK(sc);
4867
4868         /* abort TSF synchronization */
4869         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
4870         run_write(sc, RT2860_BCN_TIME_CFG,
4871             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
4872             RT2860_TBTT_TIMER_EN));
4873         run_set_bssid(sc, sc->sc_ifp->if_broadcastaddr);
4874
4875         RUN_UNLOCK(sc);
4876
4877         return;
4878 }
4879
4880 static void
4881 run_scan_end(struct ieee80211com *ic)
4882 {
4883         struct run_softc *sc = ic->ic_ifp->if_softc;
4884
4885         RUN_LOCK(sc);
4886
4887         run_enable_tsf_sync(sc);
4888         /* XXX keep local copy */
4889         run_set_bssid(sc, sc->sc_bssid);
4890
4891         RUN_UNLOCK(sc);
4892
4893         return;
4894 }
4895
4896 /*
4897  * Could be called from ieee80211_node_timeout()
4898  * (non-sleepable thread)
4899  */
4900 static void
4901 run_update_beacon(struct ieee80211vap *vap, int item)
4902 {
4903         struct ieee80211com *ic = vap->iv_ic;
4904         struct run_softc *sc = ic->ic_ifp->if_softc;
4905         struct run_vap *rvp = RUN_VAP(vap);
4906         int mcast = 0;
4907         uint32_t i;
4908
4909         KASSERT(vap != NULL, ("no beacon"));
4910
4911         switch (item) {
4912         case IEEE80211_BEACON_ERP:
4913                 run_updateslot(ic);
4914                 break;
4915         case IEEE80211_BEACON_HTINFO:
4916                 run_updateprot(ic);
4917                 break;
4918         case IEEE80211_BEACON_TIM:
4919                 mcast = 1;      /*TODO*/
4920                 break;
4921         default:
4922                 break;
4923         }
4924
4925         setbit(rvp->bo.bo_flags, item);
4926         ieee80211_beacon_update(vap->iv_bss, &rvp->bo, rvp->beacon_mbuf, mcast);
4927
4928         i = RUN_CMDQ_GET(&sc->cmdq_store);
4929         DPRINTF("cmdq_store=%d\n", i);
4930         sc->cmdq[i].func = run_update_beacon_cb;
4931         sc->cmdq[i].arg0 = vap;
4932         ieee80211_runtask(ic, &sc->cmdq_task);
4933
4934         return;
4935 }
4936
4937 static void
4938 run_update_beacon_cb(void *arg)
4939 {
4940         struct ieee80211vap *vap = arg;
4941         struct run_vap *rvp = RUN_VAP(vap);
4942         struct ieee80211com *ic = vap->iv_ic;
4943         struct run_softc *sc = ic->ic_ifp->if_softc;
4944         struct rt2860_txwi txwi;
4945         struct mbuf *m;
4946         uint16_t txwisize;
4947         uint8_t ridx;
4948
4949         if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC)
4950                 return;
4951         if (ic->ic_bsschan == IEEE80211_CHAN_ANYC)
4952                 return;
4953
4954         /*
4955          * No need to call ieee80211_beacon_update(), run_update_beacon()
4956          * is taking care of apropriate calls.
4957          */
4958         if (rvp->beacon_mbuf == NULL) {
4959                 rvp->beacon_mbuf = ieee80211_beacon_alloc(vap->iv_bss,
4960                     &rvp->bo);
4961                 if (rvp->beacon_mbuf == NULL)
4962                         return;
4963         }
4964         m = rvp->beacon_mbuf;
4965
4966         memset(&txwi, 0, sizeof(txwi));
4967         txwi.wcid = 0xff;
4968         txwi.len = htole16(m->m_pkthdr.len);
4969
4970         /* send beacons at the lowest available rate */
4971         ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
4972             RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
4973         txwi.phy = htole16(rt2860_rates[ridx].mcs);
4974         if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4975                 txwi.phy |= htole16(RT2860_PHY_OFDM);
4976         txwi.txop = RT2860_TX_TXOP_HT;
4977         txwi.flags = RT2860_TX_TS;
4978         txwi.xflags = RT2860_TX_NSEQ;
4979
4980         txwisize = (sc->mac_ver == 0x5592) ?
4981             sizeof(txwi) + sizeof(uint32_t) : sizeof(txwi);
4982         run_write_region_1(sc, RT2860_BCN_BASE(rvp->rvp_id), (uint8_t *)&txwi,
4983             txwisize);
4984         run_write_region_1(sc, RT2860_BCN_BASE(rvp->rvp_id) + txwisize,
4985             mtod(m, uint8_t *), (m->m_pkthdr.len + 1) & ~1);
4986 }
4987
4988 static void
4989 run_updateprot(struct ieee80211com *ic)
4990 {
4991         struct run_softc *sc = ic->ic_ifp->if_softc;
4992         uint32_t i;
4993
4994         i = RUN_CMDQ_GET(&sc->cmdq_store);
4995         DPRINTF("cmdq_store=%d\n", i);
4996         sc->cmdq[i].func = run_updateprot_cb;
4997         sc->cmdq[i].arg0 = ic;
4998         ieee80211_runtask(ic, &sc->cmdq_task);
4999 }
5000
5001 static void
5002 run_updateprot_cb(void *arg)
5003 {
5004         struct ieee80211com *ic = arg;
5005         struct run_softc *sc = ic->ic_ifp->if_softc;
5006         uint32_t tmp;
5007
5008         tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
5009         /* setup protection frame rate (MCS code) */
5010         tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
5011             rt2860_rates[RT2860_RIDX_OFDM6].mcs | RT2860_PHY_OFDM :
5012             rt2860_rates[RT2860_RIDX_CCK11].mcs;
5013
5014         /* CCK frames don't require protection */
5015         run_write(sc, RT2860_CCK_PROT_CFG, tmp);
5016         if (ic->ic_flags & IEEE80211_F_USEPROT) {
5017                 if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
5018                         tmp |= RT2860_PROT_CTRL_RTS_CTS;
5019                 else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
5020                         tmp |= RT2860_PROT_CTRL_CTS;
5021         }
5022         run_write(sc, RT2860_OFDM_PROT_CFG, tmp);
5023 }
5024
5025 static void
5026 run_usb_timeout_cb(void *arg)
5027 {
5028         struct ieee80211vap *vap = arg;
5029         struct run_softc *sc = vap->iv_ic->ic_ifp->if_softc;
5030
5031         RUN_LOCK_ASSERT(sc, MA_OWNED);
5032
5033         if(vap->iv_state == IEEE80211_S_RUN &&
5034             vap->iv_opmode != IEEE80211_M_STA)
5035                 run_reset_livelock(sc);
5036         else if (vap->iv_state == IEEE80211_S_SCAN) {
5037                 DPRINTF("timeout caused by scan\n");
5038                 /* cancel bgscan */
5039                 ieee80211_cancel_scan(vap);
5040         } else
5041                 DPRINTF("timeout by unknown cause\n");
5042 }
5043
5044 static void
5045 run_reset_livelock(struct run_softc *sc)
5046 {
5047         uint32_t tmp;
5048
5049         RUN_LOCK_ASSERT(sc, MA_OWNED);
5050
5051         /*
5052          * In IBSS or HostAP modes (when the hardware sends beacons), the MAC
5053          * can run into a livelock and start sending CTS-to-self frames like
5054          * crazy if protection is enabled.  Reset MAC/BBP for a while
5055          */
5056         run_read(sc, RT2860_DEBUG, &tmp);
5057         DPRINTFN(3, "debug reg %08x\n", tmp);
5058         if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
5059                 DPRINTF("CTS-to-self livelock detected\n");
5060                 run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
5061                 run_delay(sc, 1);
5062                 run_write(sc, RT2860_MAC_SYS_CTRL,
5063                     RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
5064         }
5065 }
5066
5067 static void
5068 run_update_promisc_locked(struct run_softc *sc)
5069 {
5070         uint32_t tmp;
5071
5072         run_read(sc, RT2860_RX_FILTR_CFG, &tmp);
5073
5074         tmp |= RT2860_DROP_UC_NOME;
5075         if (sc->sc_ifp->if_flags & IFF_PROMISC)
5076                 tmp &= ~RT2860_DROP_UC_NOME;
5077
5078         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
5079
5080         DPRINTF("%s promiscuous mode\n", (sc->sc_ifp->if_flags & IFF_PROMISC) ?
5081             "entering" : "leaving");
5082 }
5083
5084 static void
5085 run_update_promisc(struct ieee80211com *ic)
5086 {
5087         struct run_softc *sc = ic->ic_softc;
5088
5089         if ((ic->ic_ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
5090                 return;
5091
5092         RUN_LOCK(sc);
5093         run_update_promisc_locked(sc);
5094         RUN_UNLOCK(sc);
5095 }
5096
5097 static void
5098 run_enable_tsf_sync(struct run_softc *sc)
5099 {
5100         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5101         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5102         uint32_t tmp;
5103
5104         DPRINTF("rvp_id=%d ic_opmode=%d\n", RUN_VAP(vap)->rvp_id,
5105             ic->ic_opmode);
5106
5107         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
5108         tmp &= ~0x1fffff;
5109         tmp |= vap->iv_bss->ni_intval * 16;
5110         tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
5111
5112         if (ic->ic_opmode == IEEE80211_M_STA) {
5113                 /*
5114                  * Local TSF is always updated with remote TSF on beacon
5115                  * reception.
5116                  */
5117                 tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
5118         } else if (ic->ic_opmode == IEEE80211_M_IBSS) {
5119                 tmp |= RT2860_BCN_TX_EN;
5120                 /*
5121                  * Local TSF is updated with remote TSF on beacon reception
5122                  * only if the remote TSF is greater than local TSF.
5123                  */
5124                 tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
5125         } else if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5126                     ic->ic_opmode == IEEE80211_M_MBSS) {
5127                 tmp |= RT2860_BCN_TX_EN;
5128                 /* SYNC with nobody */
5129                 tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
5130         } else {
5131                 DPRINTF("Enabling TSF failed. undefined opmode\n");
5132                 return;
5133         }
5134
5135         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
5136 }
5137
5138 static void
5139 run_enable_mrr(struct run_softc *sc)
5140 {
5141 #define CCK(mcs)        (mcs)
5142 #define OFDM(mcs)       (1 << 3 | (mcs))
5143         run_write(sc, RT2860_LG_FBK_CFG0,
5144             OFDM(6) << 28 |     /* 54->48 */
5145             OFDM(5) << 24 |     /* 48->36 */
5146             OFDM(4) << 20 |     /* 36->24 */
5147             OFDM(3) << 16 |     /* 24->18 */
5148             OFDM(2) << 12 |     /* 18->12 */
5149             OFDM(1) <<  8 |     /* 12-> 9 */
5150             OFDM(0) <<  4 |     /*  9-> 6 */
5151             OFDM(0));           /*  6-> 6 */
5152
5153         run_write(sc, RT2860_LG_FBK_CFG1,
5154             CCK(2) << 12 |      /* 11->5.5 */
5155             CCK(1) <<  8 |      /* 5.5-> 2 */
5156             CCK(0) <<  4 |      /*   2-> 1 */
5157             CCK(0));            /*   1-> 1 */
5158 #undef OFDM
5159 #undef CCK
5160 }
5161
5162 static void
5163 run_set_txpreamble(struct run_softc *sc)
5164 {
5165         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5166         uint32_t tmp;
5167
5168         run_read(sc, RT2860_AUTO_RSP_CFG, &tmp);
5169         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
5170                 tmp |= RT2860_CCK_SHORT_EN;
5171         else
5172                 tmp &= ~RT2860_CCK_SHORT_EN;
5173         run_write(sc, RT2860_AUTO_RSP_CFG, tmp);
5174 }
5175
5176 static void
5177 run_set_basicrates(struct run_softc *sc)
5178 {
5179         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5180
5181         /* set basic rates mask */
5182         if (ic->ic_curmode == IEEE80211_MODE_11B)
5183                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
5184         else if (ic->ic_curmode == IEEE80211_MODE_11A)
5185                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
5186         else    /* 11g */
5187                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
5188 }
5189
5190 static void
5191 run_set_leds(struct run_softc *sc, uint16_t which)
5192 {
5193         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
5194             which | (sc->leds & 0x7f));
5195 }
5196
5197 static void
5198 run_set_bssid(struct run_softc *sc, const uint8_t *bssid)
5199 {
5200         run_write(sc, RT2860_MAC_BSSID_DW0,
5201             bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
5202         run_write(sc, RT2860_MAC_BSSID_DW1,
5203             bssid[4] | bssid[5] << 8);
5204 }
5205
5206 static void
5207 run_set_macaddr(struct run_softc *sc, const uint8_t *addr)
5208 {
5209         run_write(sc, RT2860_MAC_ADDR_DW0,
5210             addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
5211         run_write(sc, RT2860_MAC_ADDR_DW1,
5212             addr[4] | addr[5] << 8 | 0xff << 16);
5213 }
5214
5215 static void
5216 run_updateslot(struct ieee80211com *ic)
5217 {
5218         struct run_softc *sc = ic->ic_softc;
5219         uint32_t i;
5220
5221         i = RUN_CMDQ_GET(&sc->cmdq_store);
5222         DPRINTF("cmdq_store=%d\n", i);
5223         sc->cmdq[i].func = run_updateslot_cb;
5224         sc->cmdq[i].arg0 = ic->ic_ifp;
5225         ieee80211_runtask(ic, &sc->cmdq_task);
5226
5227         return;
5228 }
5229
5230 /* ARGSUSED */
5231 static void
5232 run_updateslot_cb(void *arg)
5233 {
5234         struct ifnet *ifp = arg;
5235         struct run_softc *sc = ifp->if_softc;
5236         struct ieee80211com *ic = ifp->if_l2com;
5237         uint32_t tmp;
5238
5239         run_read(sc, RT2860_BKOFF_SLOT_CFG, &tmp);
5240         tmp &= ~0xff;
5241         tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
5242         run_write(sc, RT2860_BKOFF_SLOT_CFG, tmp);
5243 }
5244
5245 static void
5246 run_update_mcast(struct ieee80211com *ic)
5247 {
5248         /* h/w filter supports getting everything or nothing */
5249         ic->ic_ifp->if_flags |= IFF_ALLMULTI;
5250 }
5251
5252 static int8_t
5253 run_rssi2dbm(struct run_softc *sc, uint8_t rssi, uint8_t rxchain)
5254 {
5255         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5256         struct ieee80211_channel *c = ic->ic_curchan;
5257         int delta;
5258
5259         if (IEEE80211_IS_CHAN_5GHZ(c)) {
5260                 u_int chan = ieee80211_chan2ieee(ic, c);
5261                 delta = sc->rssi_5ghz[rxchain];
5262
5263                 /* determine channel group */
5264                 if (chan <= 64)
5265                         delta -= sc->lna[1];
5266                 else if (chan <= 128)
5267                         delta -= sc->lna[2];
5268                 else
5269                         delta -= sc->lna[3];
5270         } else
5271                 delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
5272
5273         return (-12 - delta - rssi);
5274 }
5275
5276 static void
5277 run_rt5390_bbp_init(struct run_softc *sc)
5278 {
5279         int i;
5280         uint8_t bbp;
5281
5282         /* Apply maximum likelihood detection for 2 stream case. */
5283         run_bbp_read(sc, 105, &bbp);
5284         if (sc->nrxchains > 1)
5285                 run_bbp_write(sc, 105, bbp | RT5390_MLD);
5286
5287         /* Avoid data lost and CRC error. */
5288         run_bbp_read(sc, 4, &bbp);
5289         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5290
5291         if (sc->mac_ver == 0x5592) {
5292                 for (i = 0; i < NELEM(rt5592_def_bbp); i++) {
5293                         run_bbp_write(sc, rt5592_def_bbp[i].reg,
5294                             rt5592_def_bbp[i].val);
5295                 }
5296                 for (i = 0; i < NELEM(rt5592_bbp_r196); i++) {
5297                         run_bbp_write(sc, 195, i + 0x80);
5298                         run_bbp_write(sc, 196, rt5592_bbp_r196[i]);
5299                 }
5300         } else {
5301                 for (i = 0; i < NELEM(rt5390_def_bbp); i++) {
5302                         run_bbp_write(sc, rt5390_def_bbp[i].reg,
5303                             rt5390_def_bbp[i].val);
5304                 }
5305         }
5306         if (sc->mac_ver == 0x5392) {
5307                 run_bbp_write(sc, 88, 0x90);
5308                 run_bbp_write(sc, 95, 0x9a);
5309                 run_bbp_write(sc, 98, 0x12);
5310                 run_bbp_write(sc, 106, 0x12);
5311                 run_bbp_write(sc, 134, 0xd0);
5312                 run_bbp_write(sc, 135, 0xf6);
5313                 run_bbp_write(sc, 148, 0x84);
5314         }
5315
5316         run_bbp_read(sc, 152, &bbp);
5317         run_bbp_write(sc, 152, bbp | 0x80);
5318
5319         /* Fix BBP254 for RT5592C. */
5320         if (sc->mac_ver == 0x5592 && sc->mac_rev >= 0x0221) {
5321                 run_bbp_read(sc, 254, &bbp);
5322                 run_bbp_write(sc, 254, bbp | 0x80);
5323         }
5324
5325         /* Disable hardware antenna diversity. */
5326         if (sc->mac_ver == 0x5390)
5327                 run_bbp_write(sc, 154, 0);
5328
5329         /* Initialize Rx CCK/OFDM frequency offset report. */
5330         run_bbp_write(sc, 142, 1);
5331         run_bbp_write(sc, 143, 57);
5332 }
5333
5334 static int
5335 run_bbp_init(struct run_softc *sc)
5336 {
5337         int i, error, ntries;
5338         uint8_t bbp0;
5339
5340         /* wait for BBP to wake up */
5341         for (ntries = 0; ntries < 20; ntries++) {
5342                 if ((error = run_bbp_read(sc, 0, &bbp0)) != 0)
5343                         return error;
5344                 if (bbp0 != 0 && bbp0 != 0xff)
5345                         break;
5346         }
5347         if (ntries == 20)
5348                 return (ETIMEDOUT);
5349
5350         /* initialize BBP registers to default values */
5351         if (sc->mac_ver >= 0x5390)
5352                 run_rt5390_bbp_init(sc);
5353         else {
5354                 for (i = 0; i < NELEM(rt2860_def_bbp); i++) {
5355                         run_bbp_write(sc, rt2860_def_bbp[i].reg,
5356                             rt2860_def_bbp[i].val);
5357                 }
5358         }
5359
5360         if (sc->mac_ver == 0x3593) {
5361                 run_bbp_write(sc, 79, 0x13);
5362                 run_bbp_write(sc, 80, 0x05);
5363                 run_bbp_write(sc, 81, 0x33);
5364                 run_bbp_write(sc, 86, 0x46);
5365                 run_bbp_write(sc, 137, 0x0f);
5366         }
5367
5368         /* fix BBP84 for RT2860E */
5369         if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
5370                 run_bbp_write(sc, 84, 0x19);
5371
5372         if (sc->mac_ver >= 0x3070 && (sc->mac_ver != 0x3593 &&
5373             sc->mac_ver != 0x5592)) {
5374                 run_bbp_write(sc, 79, 0x13);
5375                 run_bbp_write(sc, 80, 0x05);
5376                 run_bbp_write(sc, 81, 0x33);
5377         } else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
5378                 run_bbp_write(sc, 69, 0x16);
5379                 run_bbp_write(sc, 73, 0x12);
5380         }
5381         return (0);
5382 }
5383
5384 static int
5385 run_rt3070_rf_init(struct run_softc *sc)
5386 {
5387         uint32_t tmp;
5388         uint8_t bbp4, mingain, rf, target;
5389         int i;
5390
5391         run_rt3070_rf_read(sc, 30, &rf);
5392         /* toggle RF R30 bit 7 */
5393         run_rt3070_rf_write(sc, 30, rf | 0x80);
5394         run_delay(sc, 10);
5395         run_rt3070_rf_write(sc, 30, rf & ~0x80);
5396
5397         /* initialize RF registers to default value */
5398         if (sc->mac_ver == 0x3572) {
5399                 for (i = 0; i < NELEM(rt3572_def_rf); i++) {
5400                         run_rt3070_rf_write(sc, rt3572_def_rf[i].reg,
5401                             rt3572_def_rf[i].val);
5402                 }
5403         } else {
5404                 for (i = 0; i < NELEM(rt3070_def_rf); i++) {
5405                         run_rt3070_rf_write(sc, rt3070_def_rf[i].reg,
5406                             rt3070_def_rf[i].val);
5407                 }
5408         }
5409
5410         if (sc->mac_ver == 0x3070 && sc->mac_rev < 0x0201) {
5411                 /*
5412                  * Change voltage from 1.2V to 1.35V for RT3070.
5413                  * The DAC issue (RT3070_LDO_CFG0) has been fixed
5414                  * in RT3070(F).
5415                  */
5416                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5417                 tmp = (tmp & ~0x0f000000) | 0x0d000000;
5418                 run_write(sc, RT3070_LDO_CFG0, tmp);
5419
5420         } else if (sc->mac_ver == 0x3071) {
5421                 run_rt3070_rf_read(sc, 6, &rf);
5422                 run_rt3070_rf_write(sc, 6, rf | 0x40);
5423                 run_rt3070_rf_write(sc, 31, 0x14);
5424
5425                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5426                 tmp &= ~0x1f000000;
5427                 if (sc->mac_rev < 0x0211)
5428                         tmp |= 0x0d000000;      /* 1.3V */
5429                 else
5430                         tmp |= 0x01000000;      /* 1.2V */
5431                 run_write(sc, RT3070_LDO_CFG0, tmp);
5432
5433                 /* patch LNA_PE_G1 */
5434                 run_read(sc, RT3070_GPIO_SWITCH, &tmp);
5435                 run_write(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
5436
5437         } else if (sc->mac_ver == 0x3572) {
5438                 run_rt3070_rf_read(sc, 6, &rf);
5439                 run_rt3070_rf_write(sc, 6, rf | 0x40);
5440
5441                 /* increase voltage from 1.2V to 1.35V */
5442                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5443                 tmp = (tmp & ~0x1f000000) | 0x0d000000;
5444                 run_write(sc, RT3070_LDO_CFG0, tmp);
5445
5446                 if (sc->mac_rev < 0x0211 || !sc->patch_dac) {
5447                         run_delay(sc, 1);       /* wait for 1msec */
5448                         /* decrease voltage back to 1.2V */
5449                         tmp = (tmp & ~0x1f000000) | 0x01000000;
5450                         run_write(sc, RT3070_LDO_CFG0, tmp);
5451                 }
5452         }
5453
5454         /* select 20MHz bandwidth */
5455         run_rt3070_rf_read(sc, 31, &rf);
5456         run_rt3070_rf_write(sc, 31, rf & ~0x20);
5457
5458         /* calibrate filter for 20MHz bandwidth */
5459         sc->rf24_20mhz = 0x1f;  /* default value */
5460         target = (sc->mac_ver < 0x3071) ? 0x16 : 0x13;
5461         run_rt3070_filter_calib(sc, 0x07, target, &sc->rf24_20mhz);
5462
5463         /* select 40MHz bandwidth */
5464         run_bbp_read(sc, 4, &bbp4);
5465         run_bbp_write(sc, 4, (bbp4 & ~0x18) | 0x10);
5466         run_rt3070_rf_read(sc, 31, &rf);
5467         run_rt3070_rf_write(sc, 31, rf | 0x20);
5468
5469         /* calibrate filter for 40MHz bandwidth */
5470         sc->rf24_40mhz = 0x2f;  /* default value */
5471         target = (sc->mac_ver < 0x3071) ? 0x19 : 0x15;
5472         run_rt3070_filter_calib(sc, 0x27, target, &sc->rf24_40mhz);
5473
5474         /* go back to 20MHz bandwidth */
5475         run_bbp_read(sc, 4, &bbp4);
5476         run_bbp_write(sc, 4, bbp4 & ~0x18);
5477
5478         if (sc->mac_ver == 0x3572) {
5479                 /* save default BBP registers 25 and 26 values */
5480                 run_bbp_read(sc, 25, &sc->bbp25);
5481                 run_bbp_read(sc, 26, &sc->bbp26);
5482         } else if (sc->mac_rev < 0x0201 || sc->mac_rev < 0x0211)
5483                 run_rt3070_rf_write(sc, 27, 0x03);
5484
5485         run_read(sc, RT3070_OPT_14, &tmp);
5486         run_write(sc, RT3070_OPT_14, tmp | 1);
5487
5488         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
5489                 run_rt3070_rf_read(sc, 17, &rf);
5490                 rf &= ~RT3070_TX_LO1;
5491                 if ((sc->mac_ver == 0x3070 ||
5492                      (sc->mac_ver == 0x3071 && sc->mac_rev >= 0x0211)) &&
5493                     !sc->ext_2ghz_lna)
5494                         rf |= 0x20;     /* fix for long range Rx issue */
5495                 mingain = (sc->mac_ver == 0x3070) ? 1 : 2;
5496                 if (sc->txmixgain_2ghz >= mingain)
5497                         rf = (rf & ~0x7) | sc->txmixgain_2ghz;
5498                 run_rt3070_rf_write(sc, 17, rf);
5499         }
5500
5501         if (sc->mac_ver == 0x3071) {
5502                 run_rt3070_rf_read(sc, 1, &rf);
5503                 rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
5504                 rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
5505                 run_rt3070_rf_write(sc, 1, rf);
5506
5507                 run_rt3070_rf_read(sc, 15, &rf);
5508                 run_rt3070_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
5509
5510                 run_rt3070_rf_read(sc, 20, &rf);
5511                 run_rt3070_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
5512
5513                 run_rt3070_rf_read(sc, 21, &rf);
5514                 run_rt3070_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
5515         }
5516
5517         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
5518                 /* fix Tx to Rx IQ glitch by raising RF voltage */
5519                 run_rt3070_rf_read(sc, 27, &rf);
5520                 rf &= ~0x77;
5521                 if (sc->mac_rev < 0x0211)
5522                         rf |= 0x03;
5523                 run_rt3070_rf_write(sc, 27, rf);
5524         }
5525         return (0);
5526 }
5527
5528 static void
5529 run_rt3593_rf_init(struct run_softc *sc)
5530 {
5531         uint32_t tmp;
5532         uint8_t rf;
5533         int i;
5534
5535         /* Disable the GPIO bits 4 and 7 for LNA PE control. */
5536         run_read(sc, RT3070_GPIO_SWITCH, &tmp);
5537         tmp &= ~(1 << 4 | 1 << 7);
5538         run_write(sc, RT3070_GPIO_SWITCH, tmp);
5539
5540         /* Initialize RF registers to default value. */
5541         for (i = 0; i < NELEM(rt3593_def_rf); i++) {
5542                 run_rt3070_rf_write(sc, rt3593_def_rf[i].reg,
5543                     rt3593_def_rf[i].val);
5544         }
5545
5546         /* Toggle RF R2 to initiate calibration. */
5547         run_rt3070_rf_write(sc, 2, RT5390_RESCAL);
5548
5549         /* Initialize RF frequency offset. */
5550         run_adjust_freq_offset(sc);
5551
5552         run_rt3070_rf_read(sc, 18, &rf);
5553         run_rt3070_rf_write(sc, 18, rf | RT3593_AUTOTUNE_BYPASS);
5554
5555         /*
5556          * Increase voltage from 1.2V to 1.35V, wait for 1 msec to
5557          * decrease voltage back to 1.2V.
5558          */
5559         run_read(sc, RT3070_LDO_CFG0, &tmp);
5560         tmp = (tmp & ~0x1f000000) | 0x0d000000;
5561         run_write(sc, RT3070_LDO_CFG0, tmp);
5562         run_delay(sc, 1);
5563         tmp = (tmp & ~0x1f000000) | 0x01000000;
5564         run_write(sc, RT3070_LDO_CFG0, tmp);
5565
5566         sc->rf24_20mhz = 0x1f;
5567         sc->rf24_40mhz = 0x2f;
5568
5569         /* Save default BBP registers 25 and 26 values. */
5570         run_bbp_read(sc, 25, &sc->bbp25);
5571         run_bbp_read(sc, 26, &sc->bbp26);
5572
5573         run_read(sc, RT3070_OPT_14, &tmp);
5574         run_write(sc, RT3070_OPT_14, tmp | 1);
5575 }
5576
5577 static void
5578 run_rt5390_rf_init(struct run_softc *sc)
5579 {
5580         uint32_t tmp;
5581         uint8_t rf;
5582         int i;
5583
5584         /* Toggle RF R2 to initiate calibration. */
5585         if (sc->mac_ver == 0x5390) {
5586                 run_rt3070_rf_read(sc, 2, &rf);
5587                 run_rt3070_rf_write(sc, 2, rf | RT5390_RESCAL);
5588                 run_delay(sc, 10);
5589                 run_rt3070_rf_write(sc, 2, rf & ~RT5390_RESCAL);
5590         } else {
5591                 run_rt3070_rf_write(sc, 2, RT5390_RESCAL);
5592                 run_delay(sc, 10);
5593         }
5594
5595         /* Initialize RF registers to default value. */
5596         if (sc->mac_ver == 0x5592) {
5597                 for (i = 0; i < NELEM(rt5592_def_rf); i++) {
5598                         run_rt3070_rf_write(sc, rt5592_def_rf[i].reg,
5599                             rt5592_def_rf[i].val);
5600                 }
5601                 /* Initialize RF frequency offset. */
5602                 run_adjust_freq_offset(sc);
5603         } else if (sc->mac_ver == 0x5392) {
5604                 for (i = 0; i < NELEM(rt5392_def_rf); i++) {
5605                         run_rt3070_rf_write(sc, rt5392_def_rf[i].reg,
5606                             rt5392_def_rf[i].val);
5607                 }
5608                 if (sc->mac_rev >= 0x0223) {
5609                         run_rt3070_rf_write(sc, 23, 0x0f);
5610                         run_rt3070_rf_write(sc, 24, 0x3e);
5611                         run_rt3070_rf_write(sc, 51, 0x32);
5612                         run_rt3070_rf_write(sc, 53, 0x22);
5613                         run_rt3070_rf_write(sc, 56, 0xc1);
5614                         run_rt3070_rf_write(sc, 59, 0x0f);
5615                 }
5616         } else {
5617                 for (i = 0; i < NELEM(rt5390_def_rf); i++) {
5618                         run_rt3070_rf_write(sc, rt5390_def_rf[i].reg,
5619                             rt5390_def_rf[i].val);
5620                 }
5621                 if (sc->mac_rev >= 0x0502) {
5622                         run_rt3070_rf_write(sc, 6, 0xe0);
5623                         run_rt3070_rf_write(sc, 25, 0x80);
5624                         run_rt3070_rf_write(sc, 46, 0x73);
5625                         run_rt3070_rf_write(sc, 53, 0x00);
5626                         run_rt3070_rf_write(sc, 56, 0x42);
5627                         run_rt3070_rf_write(sc, 61, 0xd1);
5628                 }
5629         }
5630
5631         sc->rf24_20mhz = 0x1f;  /* default value */
5632         sc->rf24_40mhz = (sc->mac_ver == 0x5592) ? 0 : 0x2f;
5633
5634         if (sc->mac_rev < 0x0211)
5635                 run_rt3070_rf_write(sc, 27, 0x3);
5636
5637         run_read(sc, RT3070_OPT_14, &tmp);
5638         run_write(sc, RT3070_OPT_14, tmp | 1);
5639 }
5640
5641 static int
5642 run_rt3070_filter_calib(struct run_softc *sc, uint8_t init, uint8_t target,
5643     uint8_t *val)
5644 {
5645         uint8_t rf22, rf24;
5646         uint8_t bbp55_pb, bbp55_sb, delta;
5647         int ntries;
5648
5649         /* program filter */
5650         run_rt3070_rf_read(sc, 24, &rf24);
5651         rf24 = (rf24 & 0xc0) | init;    /* initial filter value */
5652         run_rt3070_rf_write(sc, 24, rf24);
5653
5654         /* enable baseband loopback mode */
5655         run_rt3070_rf_read(sc, 22, &rf22);
5656         run_rt3070_rf_write(sc, 22, rf22 | 0x01);
5657
5658         /* set power and frequency of passband test tone */
5659         run_bbp_write(sc, 24, 0x00);
5660         for (ntries = 0; ntries < 100; ntries++) {
5661                 /* transmit test tone */
5662                 run_bbp_write(sc, 25, 0x90);
5663                 run_delay(sc, 10);
5664                 /* read received power */
5665                 run_bbp_read(sc, 55, &bbp55_pb);
5666                 if (bbp55_pb != 0)
5667                         break;
5668         }
5669         if (ntries == 100)
5670                 return (ETIMEDOUT);
5671
5672         /* set power and frequency of stopband test tone */
5673         run_bbp_write(sc, 24, 0x06);
5674         for (ntries = 0; ntries < 100; ntries++) {
5675                 /* transmit test tone */
5676                 run_bbp_write(sc, 25, 0x90);
5677                 run_delay(sc, 10);
5678                 /* read received power */
5679                 run_bbp_read(sc, 55, &bbp55_sb);
5680
5681                 delta = bbp55_pb - bbp55_sb;
5682                 if (delta > target)
5683                         break;
5684
5685                 /* reprogram filter */
5686                 rf24++;
5687                 run_rt3070_rf_write(sc, 24, rf24);
5688         }
5689         if (ntries < 100) {
5690                 if (rf24 != init)
5691                         rf24--; /* backtrack */
5692                 *val = rf24;
5693                 run_rt3070_rf_write(sc, 24, rf24);
5694         }
5695
5696         /* restore initial state */
5697         run_bbp_write(sc, 24, 0x00);
5698
5699         /* disable baseband loopback mode */
5700         run_rt3070_rf_read(sc, 22, &rf22);
5701         run_rt3070_rf_write(sc, 22, rf22 & ~0x01);
5702
5703         return (0);
5704 }
5705
5706 static void
5707 run_rt3070_rf_setup(struct run_softc *sc)
5708 {
5709         uint8_t bbp, rf;
5710         int i;
5711
5712         if (sc->mac_ver == 0x3572) {
5713                 /* enable DC filter */
5714                 if (sc->mac_rev >= 0x0201)
5715                         run_bbp_write(sc, 103, 0xc0);
5716
5717                 run_bbp_read(sc, 138, &bbp);
5718                 if (sc->ntxchains == 1)
5719                         bbp |= 0x20;    /* turn off DAC1 */
5720                 if (sc->nrxchains == 1)
5721                         bbp &= ~0x02;   /* turn off ADC1 */
5722                 run_bbp_write(sc, 138, bbp);
5723
5724                 if (sc->mac_rev >= 0x0211) {
5725                         /* improve power consumption */
5726                         run_bbp_read(sc, 31, &bbp);
5727                         run_bbp_write(sc, 31, bbp & ~0x03);
5728                 }
5729
5730                 run_rt3070_rf_read(sc, 16, &rf);
5731                 rf = (rf & ~0x07) | sc->txmixgain_2ghz;
5732                 run_rt3070_rf_write(sc, 16, rf);
5733
5734         } else if (sc->mac_ver == 0x3071) {
5735                 if (sc->mac_rev >= 0x0211) {
5736                         /* enable DC filter */
5737                         run_bbp_write(sc, 103, 0xc0);
5738
5739                         /* improve power consumption */
5740                         run_bbp_read(sc, 31, &bbp);
5741                         run_bbp_write(sc, 31, bbp & ~0x03);
5742                 }
5743
5744                 run_bbp_read(sc, 138, &bbp);
5745                 if (sc->ntxchains == 1)
5746                         bbp |= 0x20;    /* turn off DAC1 */
5747                 if (sc->nrxchains == 1)
5748                         bbp &= ~0x02;   /* turn off ADC1 */
5749                 run_bbp_write(sc, 138, bbp);
5750
5751                 run_write(sc, RT2860_TX_SW_CFG1, 0);
5752                 if (sc->mac_rev < 0x0211) {
5753                         run_write(sc, RT2860_TX_SW_CFG2,
5754                             sc->patch_dac ? 0x2c : 0x0f);
5755                 } else
5756                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5757
5758         } else if (sc->mac_ver == 0x3070) {
5759                 if (sc->mac_rev >= 0x0201) {
5760                         /* enable DC filter */
5761                         run_bbp_write(sc, 103, 0xc0);
5762
5763                         /* improve power consumption */
5764                         run_bbp_read(sc, 31, &bbp);
5765                         run_bbp_write(sc, 31, bbp & ~0x03);
5766                 }
5767
5768                 if (sc->mac_rev < 0x0201) {
5769                         run_write(sc, RT2860_TX_SW_CFG1, 0);
5770                         run_write(sc, RT2860_TX_SW_CFG2, 0x2c);
5771                 } else
5772                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5773         }
5774
5775         /* initialize RF registers from ROM for >=RT3071*/
5776         if (sc->mac_ver >= 0x3071) {
5777                 for (i = 0; i < 10; i++) {
5778                         if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
5779                                 continue;
5780                         run_rt3070_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
5781                 }
5782         }
5783 }
5784
5785 static void
5786 run_rt3593_rf_setup(struct run_softc *sc)
5787 {
5788         uint8_t bbp, rf;
5789
5790         if (sc->mac_rev >= 0x0211) {
5791                 /* Enable DC filter. */
5792                 run_bbp_write(sc, 103, 0xc0);
5793         }
5794         run_write(sc, RT2860_TX_SW_CFG1, 0);
5795         if (sc->mac_rev < 0x0211) {
5796                 run_write(sc, RT2860_TX_SW_CFG2,
5797                     sc->patch_dac ? 0x2c : 0x0f);
5798         } else
5799                 run_write(sc, RT2860_TX_SW_CFG2, 0);
5800
5801         run_rt3070_rf_read(sc, 50, &rf);
5802         run_rt3070_rf_write(sc, 50, rf & ~RT3593_TX_LO2);
5803
5804         run_rt3070_rf_read(sc, 51, &rf);
5805         rf = (rf & ~(RT3593_TX_LO1 | 0x0c)) |
5806             ((sc->txmixgain_2ghz & 0x07) << 2);
5807         run_rt3070_rf_write(sc, 51, rf);
5808
5809         run_rt3070_rf_read(sc, 38, &rf);
5810         run_rt3070_rf_write(sc, 38, rf & ~RT5390_RX_LO1);
5811
5812         run_rt3070_rf_read(sc, 39, &rf);
5813         run_rt3070_rf_write(sc, 39, rf & ~RT5390_RX_LO2);
5814
5815         run_rt3070_rf_read(sc, 1, &rf);
5816         run_rt3070_rf_write(sc, 1, rf & ~(RT3070_RF_BLOCK | RT3070_PLL_PD));
5817
5818         run_rt3070_rf_read(sc, 30, &rf);
5819         rf = (rf & ~0x18) | 0x10;
5820         run_rt3070_rf_write(sc, 30, rf);
5821
5822         /* Apply maximum likelihood detection for 2 stream case. */
5823         run_bbp_read(sc, 105, &bbp);
5824         if (sc->nrxchains > 1)
5825                 run_bbp_write(sc, 105, bbp | RT5390_MLD);
5826
5827         /* Avoid data lost and CRC error. */
5828         run_bbp_read(sc, 4, &bbp);
5829         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5830
5831         run_bbp_write(sc, 92, 0x02);
5832         run_bbp_write(sc, 82, 0x82);
5833         run_bbp_write(sc, 106, 0x05);
5834         run_bbp_write(sc, 104, 0x92);
5835         run_bbp_write(sc, 88, 0x90);
5836         run_bbp_write(sc, 148, 0xc8);
5837         run_bbp_write(sc, 47, 0x48);
5838         run_bbp_write(sc, 120, 0x50);
5839
5840         run_bbp_write(sc, 163, 0x9d);
5841
5842         /* SNR mapping. */
5843         run_bbp_write(sc, 142, 0x06);
5844         run_bbp_write(sc, 143, 0xa0);
5845         run_bbp_write(sc, 142, 0x07);
5846         run_bbp_write(sc, 143, 0xa1);
5847         run_bbp_write(sc, 142, 0x08);
5848         run_bbp_write(sc, 143, 0xa2);
5849
5850         run_bbp_write(sc, 31, 0x08);
5851         run_bbp_write(sc, 68, 0x0b);
5852         run_bbp_write(sc, 105, 0x04);
5853 }
5854
5855 static void
5856 run_rt5390_rf_setup(struct run_softc *sc)
5857 {
5858         uint8_t bbp, rf;
5859
5860         if (sc->mac_rev >= 0x0211) {
5861                 /* Enable DC filter. */
5862                 run_bbp_write(sc, 103, 0xc0);
5863
5864                 if (sc->mac_ver != 0x5592) {
5865                         /* Improve power consumption. */
5866                         run_bbp_read(sc, 31, &bbp);
5867                         run_bbp_write(sc, 31, bbp & ~0x03);
5868                 }
5869         }
5870
5871         run_bbp_read(sc, 138, &bbp);
5872         if (sc->ntxchains == 1)
5873                 bbp |= 0x20;    /* turn off DAC1 */
5874         if (sc->nrxchains == 1)
5875                 bbp &= ~0x02;   /* turn off ADC1 */
5876         run_bbp_write(sc, 138, bbp);
5877
5878         run_rt3070_rf_read(sc, 38, &rf);
5879         run_rt3070_rf_write(sc, 38, rf & ~RT5390_RX_LO1);
5880
5881         run_rt3070_rf_read(sc, 39, &rf);
5882         run_rt3070_rf_write(sc, 39, rf & ~RT5390_RX_LO2);
5883
5884         /* Avoid data lost and CRC error. */
5885         run_bbp_read(sc, 4, &bbp);
5886         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5887
5888         run_rt3070_rf_read(sc, 30, &rf);
5889         rf = (rf & ~0x18) | 0x10;
5890         run_rt3070_rf_write(sc, 30, rf);
5891
5892         if (sc->mac_ver != 0x5592) {
5893                 run_write(sc, RT2860_TX_SW_CFG1, 0);
5894                 if (sc->mac_rev < 0x0211) {
5895                         run_write(sc, RT2860_TX_SW_CFG2,
5896                             sc->patch_dac ? 0x2c : 0x0f);
5897                 } else
5898                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5899         }
5900 }
5901
5902 static int
5903 run_txrx_enable(struct run_softc *sc)
5904 {
5905         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5906         uint32_t tmp;
5907         int error, ntries;
5908
5909         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
5910         for (ntries = 0; ntries < 200; ntries++) {
5911                 if ((error = run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp)) != 0)
5912                         return (error);
5913                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
5914                         break;
5915                 run_delay(sc, 50);
5916         }
5917         if (ntries == 200)
5918                 return (ETIMEDOUT);
5919
5920         run_delay(sc, 50);
5921
5922         tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN | RT2860_TX_WB_DDONE;
5923         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
5924
5925         /* enable Rx bulk aggregation (set timeout and limit) */
5926         tmp = RT2860_USB_TX_EN | RT2860_USB_RX_EN | RT2860_USB_RX_AGG_EN |
5927             RT2860_USB_RX_AGG_TO(128) | RT2860_USB_RX_AGG_LMT(2);
5928         run_write(sc, RT2860_USB_DMA_CFG, tmp);
5929
5930         /* set Rx filter */
5931         tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
5932         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
5933                 tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
5934                     RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
5935                     RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
5936                     RT2860_DROP_CFACK | RT2860_DROP_CFEND;
5937                 if (ic->ic_opmode == IEEE80211_M_STA)
5938                         tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
5939         }
5940         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
5941
5942         run_write(sc, RT2860_MAC_SYS_CTRL,
5943             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
5944
5945         return (0);
5946 }
5947
5948 static void
5949 run_adjust_freq_offset(struct run_softc *sc)
5950 {
5951         uint8_t rf, tmp;
5952
5953         run_rt3070_rf_read(sc, 17, &rf);
5954         tmp = rf;
5955         rf = (rf & ~0x7f) | (sc->freq & 0x7f);
5956         rf = MIN(rf, 0x5f);
5957
5958         if (tmp != rf)
5959                 run_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf);
5960 }
5961
5962 static void
5963 run_init_locked(struct run_softc *sc)
5964 {
5965         struct ifnet *ifp = sc->sc_ifp;
5966         struct ieee80211com *ic = ifp->if_l2com;
5967         uint32_t tmp;
5968         uint8_t bbp1, bbp3;
5969         int i;
5970         int ridx;
5971         int ntries;
5972
5973         if (ic->ic_nrunning > 1)
5974                 return;
5975
5976         run_stop(sc);
5977
5978         if (run_load_microcode(sc) != 0) {
5979                 device_printf(sc->sc_dev, "could not load 8051 microcode\n");
5980                 goto fail;
5981         }
5982
5983         for (ntries = 0; ntries < 100; ntries++) {
5984                 if (run_read(sc, RT2860_ASIC_VER_ID, &tmp) != 0)
5985                         goto fail;
5986                 if (tmp != 0 && tmp != 0xffffffff)
5987                         break;
5988                 run_delay(sc, 10);
5989         }
5990         if (ntries == 100)
5991                 goto fail;
5992
5993         for (i = 0; i != RUN_EP_QUEUES; i++)
5994                 run_setup_tx_list(sc, &sc->sc_epq[i]);
5995
5996         run_set_macaddr(sc, IF_LLADDR(ifp));
5997
5998         for (ntries = 0; ntries < 100; ntries++) {
5999                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6000                         goto fail;
6001                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
6002                         break;
6003                 run_delay(sc, 10);
6004         }
6005         if (ntries == 100) {
6006                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
6007                 goto fail;
6008         }
6009         tmp &= 0xff0;
6010         tmp |= RT2860_TX_WB_DDONE;
6011         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
6012
6013         /* turn off PME_OEN to solve high-current issue */
6014         run_read(sc, RT2860_SYS_CTRL, &tmp);
6015         run_write(sc, RT2860_SYS_CTRL, tmp & ~RT2860_PME_OEN);
6016
6017         run_write(sc, RT2860_MAC_SYS_CTRL,
6018             RT2860_BBP_HRST | RT2860_MAC_SRST);
6019         run_write(sc, RT2860_USB_DMA_CFG, 0);
6020
6021         if (run_reset(sc) != 0) {
6022                 device_printf(sc->sc_dev, "could not reset chipset\n");
6023                 goto fail;
6024         }
6025
6026         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
6027
6028         /* init Tx power for all Tx rates (from EEPROM) */
6029         for (ridx = 0; ridx < 5; ridx++) {
6030                 if (sc->txpow20mhz[ridx] == 0xffffffff)
6031                         continue;
6032                 run_write(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
6033         }
6034
6035         for (i = 0; i < NELEM(rt2870_def_mac); i++)
6036                 run_write(sc, rt2870_def_mac[i].reg, rt2870_def_mac[i].val);
6037         run_write(sc, RT2860_WMM_AIFSN_CFG, 0x00002273);
6038         run_write(sc, RT2860_WMM_CWMIN_CFG, 0x00002344);
6039         run_write(sc, RT2860_WMM_CWMAX_CFG, 0x000034aa);
6040
6041         if (sc->mac_ver >= 0x5390) {
6042                 run_write(sc, RT2860_TX_SW_CFG0,
6043                     4 << RT2860_DLY_PAPE_EN_SHIFT | 4);
6044                 if (sc->mac_ver >= 0x5392) {
6045                         run_write(sc, RT2860_MAX_LEN_CFG, 0x00002fff);
6046                         if (sc->mac_ver == 0x5592) {
6047                                 run_write(sc, RT2860_HT_FBK_CFG1, 0xedcba980);
6048                                 run_write(sc, RT2860_TXOP_HLDR_ET, 0x00000082);
6049                         } else {
6050                                 run_write(sc, RT2860_HT_FBK_CFG1, 0xedcb4980);
6051                                 run_write(sc, RT2860_LG_FBK_CFG0, 0xedcba322);
6052                         }
6053                 }
6054         } else if (sc->mac_ver == 0x3593) {
6055                 run_write(sc, RT2860_TX_SW_CFG0,
6056                     4 << RT2860_DLY_PAPE_EN_SHIFT | 2);
6057         } else if (sc->mac_ver >= 0x3070) {
6058                 /* set delay of PA_PE assertion to 1us (unit of 0.25us) */
6059                 run_write(sc, RT2860_TX_SW_CFG0,
6060                     4 << RT2860_DLY_PAPE_EN_SHIFT);
6061         }
6062
6063         /* wait while MAC is busy */
6064         for (ntries = 0; ntries < 100; ntries++) {
6065                 if (run_read(sc, RT2860_MAC_STATUS_REG, &tmp) != 0)
6066                         goto fail;
6067                 if (!(tmp & (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
6068                         break;
6069                 run_delay(sc, 10);
6070         }
6071         if (ntries == 100)
6072                 goto fail;
6073
6074         /* clear Host to MCU mailbox */
6075         run_write(sc, RT2860_H2M_BBPAGENT, 0);
6076         run_write(sc, RT2860_H2M_MAILBOX, 0);
6077         run_delay(sc, 10);
6078
6079         if (run_bbp_init(sc) != 0) {
6080                 device_printf(sc->sc_dev, "could not initialize BBP\n");
6081                 goto fail;
6082         }
6083
6084         /* abort TSF synchronization */
6085         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
6086         tmp &= ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
6087             RT2860_TBTT_TIMER_EN);
6088         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
6089
6090         /* clear RX WCID search table */
6091         run_set_region_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
6092         /* clear WCID attribute table */
6093         run_set_region_4(sc, RT2860_WCID_ATTR(0), 0, 8 * 32);
6094
6095         /* hostapd sets a key before init. So, don't clear it. */
6096         if (sc->cmdq_key_set != RUN_CMDQ_GO) {
6097                 /* clear shared key table */
6098                 run_set_region_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
6099                 /* clear shared key mode */
6100                 run_set_region_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
6101         }
6102
6103         run_read(sc, RT2860_US_CYC_CNT, &tmp);
6104         tmp = (tmp & ~0xff) | 0x1e;
6105         run_write(sc, RT2860_US_CYC_CNT, tmp);
6106
6107         if (sc->mac_rev != 0x0101)
6108                 run_write(sc, RT2860_TXOP_CTRL_CFG, 0x0000583f);
6109
6110         run_write(sc, RT2860_WMM_TXOP0_CFG, 0);
6111         run_write(sc, RT2860_WMM_TXOP1_CFG, 48 << 16 | 96);
6112
6113         /* write vendor-specific BBP values (from EEPROM) */
6114         if (sc->mac_ver < 0x3593) {
6115                 for (i = 0; i < 10; i++) {
6116                         if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
6117                                 continue;
6118                         run_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
6119                 }
6120         }
6121
6122         /* select Main antenna for 1T1R devices */
6123         if (sc->rf_rev == RT3070_RF_3020 || sc->rf_rev == RT5390_RF_5370)
6124                 run_set_rx_antenna(sc, 0);
6125
6126         /* send LEDs operating mode to microcontroller */
6127         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0]);
6128         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1]);
6129         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2]);
6130
6131         if (sc->mac_ver >= 0x5390)
6132                 run_rt5390_rf_init(sc);
6133         else if (sc->mac_ver == 0x3593)
6134                 run_rt3593_rf_init(sc);
6135         else if (sc->mac_ver >= 0x3070)
6136                 run_rt3070_rf_init(sc);
6137
6138         /* disable non-existing Rx chains */
6139         run_bbp_read(sc, 3, &bbp3);
6140         bbp3 &= ~(1 << 3 | 1 << 4);
6141         if (sc->nrxchains == 2)
6142                 bbp3 |= 1 << 3;
6143         else if (sc->nrxchains == 3)
6144                 bbp3 |= 1 << 4;
6145         run_bbp_write(sc, 3, bbp3);
6146
6147         /* disable non-existing Tx chains */
6148         run_bbp_read(sc, 1, &bbp1);
6149         if (sc->ntxchains == 1)
6150                 bbp1 &= ~(1 << 3 | 1 << 4);
6151         run_bbp_write(sc, 1, bbp1);
6152
6153         if (sc->mac_ver >= 0x5390)
6154                 run_rt5390_rf_setup(sc);
6155         else if (sc->mac_ver == 0x3593)
6156                 run_rt3593_rf_setup(sc);
6157         else if (sc->mac_ver >= 0x3070)
6158                 run_rt3070_rf_setup(sc);
6159
6160         /* select default channel */
6161         run_set_chan(sc, ic->ic_curchan);
6162
6163         /* setup initial protection mode */
6164         run_updateprot_cb(ic);
6165
6166         /* turn radio LED on */
6167         run_set_leds(sc, RT2860_LED_RADIO);
6168
6169         ifq_clr_oactive(&ifp->if_snd);
6170         ifp->if_flags |= IFF_RUNNING;
6171         sc->cmdq_run = RUN_CMDQ_GO;
6172
6173         for (i = 0; i != RUN_N_XFER; i++)
6174                 usbd_xfer_set_stall(sc->sc_xfer[i]);
6175
6176         usbd_transfer_start(sc->sc_xfer[RUN_BULK_RX]);
6177
6178         if (run_txrx_enable(sc) != 0)
6179                 goto fail;
6180
6181         return;
6182
6183 fail:
6184         run_stop(sc);
6185 }
6186
6187 static void
6188 run_init(void *arg)
6189 {
6190         struct run_softc *sc = arg;
6191         struct ifnet *ifp = sc->sc_ifp;
6192         struct ieee80211com *ic = ifp->if_l2com;
6193
6194         RUN_LOCK(sc);
6195         run_init_locked(sc);
6196         RUN_UNLOCK(sc);
6197
6198         if (ifp->if_flags & IFF_RUNNING)
6199                 ieee80211_start_all(ic);
6200 }
6201
6202 static void
6203 run_stop(void *arg)
6204 {
6205         struct run_softc *sc = (struct run_softc *)arg;
6206         struct ifnet *ifp = sc->sc_ifp;
6207         uint32_t tmp;
6208         int i;
6209         int ntries;
6210
6211         RUN_LOCK_ASSERT(sc, MA_OWNED);
6212
6213         if (ifp->if_flags & IFF_RUNNING)
6214                 run_set_leds(sc, 0);    /* turn all LEDs off */
6215
6216         ifp->if_flags &= ~IFF_RUNNING;
6217         ifq_clr_oactive(&ifp->if_snd);
6218
6219         sc->ratectl_run = RUN_RATECTL_OFF;
6220         sc->cmdq_run = sc->cmdq_key_set;
6221
6222         RUN_UNLOCK(sc);
6223
6224         for(i = 0; i < RUN_N_XFER; i++)
6225                 usbd_transfer_drain(sc->sc_xfer[i]);
6226
6227         RUN_LOCK(sc);
6228
6229         if (sc->rx_m != NULL) {
6230                 m_free(sc->rx_m);
6231                 sc->rx_m = NULL;
6232         }
6233
6234         /* Disable Tx/Rx DMA. */
6235         if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6236                 return;
6237         tmp &= ~(RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
6238         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
6239
6240         for (ntries = 0; ntries < 100; ntries++) {
6241                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6242                         return;
6243                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
6244                                 break;
6245                 run_delay(sc, 10);
6246         }
6247         if (ntries == 100) {
6248                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
6249                 return;
6250         }
6251
6252         /* disable Tx/Rx */
6253         run_read(sc, RT2860_MAC_SYS_CTRL, &tmp);
6254         tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
6255         run_write(sc, RT2860_MAC_SYS_CTRL, tmp);
6256
6257         /* wait for pending Tx to complete */
6258         for (ntries = 0; ntries < 100; ntries++) {
6259                 if (run_read(sc, RT2860_TXRXQ_PCNT, &tmp) != 0) {
6260                         DPRINTF("Cannot read Tx queue count\n");
6261                         break;
6262                 }
6263                 if ((tmp & RT2860_TX2Q_PCNT_MASK) == 0) {
6264                         DPRINTF("All Tx cleared\n");
6265                         break;
6266                 }
6267                 run_delay(sc, 10);
6268         }
6269         if (ntries >= 100)
6270                 DPRINTF("There are still pending Tx\n");
6271         run_delay(sc, 10);
6272         run_write(sc, RT2860_USB_DMA_CFG, 0);
6273
6274         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
6275         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
6276
6277         for (i = 0; i != RUN_EP_QUEUES; i++)
6278                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
6279 }
6280
6281 static void
6282 run_delay(struct run_softc *sc, u_int ms)
6283 {
6284         usb_pause_mtx(lockowned(&sc->sc_lock) ? &sc->sc_lock : NULL,
6285             USB_MS_TO_TICKS(ms));
6286 }
6287
6288 static device_method_t run_methods[] = {
6289         /* Device interface */
6290         DEVMETHOD(device_probe,         run_match),
6291         DEVMETHOD(device_attach,        run_attach),
6292         DEVMETHOD(device_detach,        run_detach),
6293         DEVMETHOD_END
6294 };
6295
6296 static driver_t run_driver = {
6297         .name = "run",
6298         .methods = run_methods,
6299         .size = sizeof(struct run_softc)
6300 };
6301
6302 static devclass_t run_devclass;
6303
6304 DRIVER_MODULE(run, uhub, run_driver, run_devclass, run_driver_loaded, NULL);
6305 MODULE_DEPEND(run, wlan, 1, 1, 1);
6306 MODULE_DEPEND(run, usb, 1, 1, 1);
6307 MODULE_DEPEND(run, firmware, 1, 1, 1);
6308 MODULE_VERSION(run, 1);