sys/dev/usb/wlan/if_run.c

   1 /*-
   2  * Copyright (c) 2008,2010 Damien Bergamini <damien.bergamini@free.fr>
   3  * ported to FreeBSD by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
   4  * USB Consulting, Hans Petter Selasky <hselasky@freebsd.org>
   5  * Copyright (c) 2013-2014 Kevin Lo
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/cdefs.h>
  21 __FBSDID("$FreeBSD$");
  22
  23 /*-
  24  * Ralink Technology RT2700U/RT2800U/RT3000U/RT3900E chipset driver.
  25  * http://www.ralinktech.com/
  26  */
  27
  28 #include "opt_wlan.h"
  29
  30 #include <sys/param.h>
  31 #include <sys/eventhandler.h>
  32 #include <sys/sockio.h>
  33 #include <sys/sysctl.h>
  34 #include <sys/lock.h>
  35 #include <sys/mutex.h>
  36 #include <sys/mbuf.h>
  37 #include <sys/kernel.h>
  38 #include <sys/socket.h>
  39 #include <sys/systm.h>
  40 #include <sys/malloc.h>
  41 #include <sys/module.h>
  42 #include <sys/bus.h>
  43 #include <sys/endian.h>
  44 #include <sys/linker.h>
  45 #include <sys/firmware.h>
  46 #include <sys/kdb.h>
  47
  48 #include <net/bpf.h>
  49 #include <net/if.h>
  50 #include <net/if_var.h>
  51 #include <net/if_arp.h>
  52 #include <net/ethernet.h>
  53 #include <net/if_dl.h>
  54 #include <net/if_media.h>
  55 #include <net/if_types.h>
  56
  57 #include <netinet/in.h>
  58 #include <netinet/in_systm.h>
  59 #include <netinet/in_var.h>
  60 #include <netinet/if_ether.h>
  61 #include <netinet/ip.h>
  62
  63 #include <net80211/ieee80211_var.h>
  64 #include <net80211/ieee80211_regdomain.h>
  65 #include <net80211/ieee80211_radiotap.h>
  66 #include <net80211/ieee80211_ratectl.h>
  67
  68 #include <dev/usb/usb.h>
  69 #include <dev/usb/usbdi.h>
  70 #include "usbdevs.h"
  71
  72 #define USB_DEBUG_VAR   run_debug
  73 #include <dev/usb/usb_debug.h>
  74 #include <dev/usb/usb_msctest.h>
  75
  76 #include <dev/usb/wlan/if_runreg.h>
  77 #include <dev/usb/wlan/if_runvar.h>
  78
  79 #ifdef  USB_DEBUG
  80 #define RUN_DEBUG
  81 #endif
  82
  83 #ifdef  RUN_DEBUG
  84 int run_debug = 0;
  85 static SYSCTL_NODE(_hw_usb, OID_AUTO, run, CTLFLAG_RW, 0, "USB run");
  86 SYSCTL_INT(_hw_usb_run, OID_AUTO, debug, CTLFLAG_RWTUN, &run_debug, 0,
  87     "run debug level");
  88
  89 enum {
  90         RUN_DEBUG_XMIT          = 0x00000001,   /* basic xmit operation */
  91         RUN_DEBUG_XMIT_DESC     = 0x00000002,   /* xmit descriptors */
  92         RUN_DEBUG_RECV          = 0x00000004,   /* basic recv operation */
  93         RUN_DEBUG_RECV_DESC     = 0x00000008,   /* recv descriptors */
  94         RUN_DEBUG_STATE         = 0x00000010,   /* 802.11 state transitions */
  95         RUN_DEBUG_RATE          = 0x00000020,   /* rate adaptation */
  96         RUN_DEBUG_USB           = 0x00000040,   /* usb requests */
  97         RUN_DEBUG_FIRMWARE      = 0x00000080,   /* firmware(9) loading debug */
  98         RUN_DEBUG_BEACON        = 0x00000100,   /* beacon handling */
  99         RUN_DEBUG_INTR          = 0x00000200,   /* ISR */
 100         RUN_DEBUG_TEMP          = 0x00000400,   /* temperature calibration */
 101         RUN_DEBUG_ROM           = 0x00000800,   /* various ROM info */
 102         RUN_DEBUG_KEY           = 0x00001000,   /* crypto keys management */
 103         RUN_DEBUG_TXPWR         = 0x00002000,   /* dump Tx power values */
 104         RUN_DEBUG_RSSI          = 0x00004000,   /* dump RSSI lookups */
 105         RUN_DEBUG_RESET         = 0x00008000,   /* initialization progress */
 106         RUN_DEBUG_CALIB         = 0x00010000,   /* calibration progress */
 107         RUN_DEBUG_CMD           = 0x00020000,   /* command queue */
 108         RUN_DEBUG_ANY           = 0xffffffff
 109 };
 110
 111 #define RUN_DPRINTF(_sc, _m, ...) do {                  \
 112         if (run_debug & (_m))                           \
 113                 device_printf((_sc)->sc_dev, __VA_ARGS__);      \
 114 } while(0)
 115 #else
 116 #define RUN_DPRINTF(_sc, _m, ...)       do { (void) _sc; } while (0)
 117 #endif
 118
 119 #define IEEE80211_HAS_ADDR4(wh) IEEE80211_IS_DSTODS(wh)
 120
 121 /*
 122  * Because of LOR in run_key_delete(), use atomic instead.
 123  * '& RUN_CMDQ_MASQ' is to loop cmdq[].
 124  */
 125 #define RUN_CMDQ_GET(c) (atomic_fetchadd_32((c), 1) & RUN_CMDQ_MASQ)
 126
 127 static const STRUCT_USB_HOST_ID run_devs[] = {
 128 #define RUN_DEV(v,p)    { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
 129 #define RUN_DEV_EJECT(v,p)      \
 130         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, RUN_EJECT) }
 131 #define RUN_EJECT       1
 132     RUN_DEV(ABOCOM,             RT2770),
 133     RUN_DEV(ABOCOM,             RT2870),
 134     RUN_DEV(ABOCOM,             RT3070),
 135     RUN_DEV(ABOCOM,             RT3071),
 136     RUN_DEV(ABOCOM,             RT3072),
 137     RUN_DEV(ABOCOM2,            RT2870_1),
 138     RUN_DEV(ACCTON,             RT2770),
 139     RUN_DEV(ACCTON,             RT2870_1),
 140     RUN_DEV(ACCTON,             RT2870_2),
 141     RUN_DEV(ACCTON,             RT2870_3),
 142     RUN_DEV(ACCTON,             RT2870_4),
 143     RUN_DEV(ACCTON,             RT2870_5),
 144     RUN_DEV(ACCTON,             RT3070),
 145     RUN_DEV(ACCTON,             RT3070_1),
 146     RUN_DEV(ACCTON,             RT3070_2),
 147     RUN_DEV(ACCTON,             RT3070_3),
 148     RUN_DEV(ACCTON,             RT3070_4),
 149     RUN_DEV(ACCTON,             RT3070_5),
 150     RUN_DEV(AIRTIES,            RT3070),
 151     RUN_DEV(ALLWIN,             RT2070),
 152     RUN_DEV(ALLWIN,             RT2770),
 153     RUN_DEV(ALLWIN,             RT2870),
 154     RUN_DEV(ALLWIN,             RT3070),
 155     RUN_DEV(ALLWIN,             RT3071),
 156     RUN_DEV(ALLWIN,             RT3072),
 157     RUN_DEV(ALLWIN,             RT3572),
 158     RUN_DEV(AMIGO,              RT2870_1),
 159     RUN_DEV(AMIGO,              RT2870_2),
 160     RUN_DEV(AMIT,               CGWLUSB2GNR),
 161     RUN_DEV(AMIT,               RT2870_1),
 162     RUN_DEV(AMIT2,              RT2870),
 163     RUN_DEV(ASUS,               RT2870_1),
 164     RUN_DEV(ASUS,               RT2870_2),
 165     RUN_DEV(ASUS,               RT2870_3),
 166     RUN_DEV(ASUS,               RT2870_4),
 167     RUN_DEV(ASUS,               RT2870_5),
 168     RUN_DEV(ASUS,               USBN13),
 169     RUN_DEV(ASUS,               RT3070_1),
 170     RUN_DEV(ASUS,               USBN66),
 171     RUN_DEV(ASUS,               USB_N53),
 172     RUN_DEV(ASUS2,              USBN11),
 173     RUN_DEV(AZUREWAVE,          RT2870_1),
 174     RUN_DEV(AZUREWAVE,          RT2870_2),
 175     RUN_DEV(AZUREWAVE,          RT3070_1),
 176     RUN_DEV(AZUREWAVE,          RT3070_2),
 177     RUN_DEV(AZUREWAVE,          RT3070_3),
 178     RUN_DEV(BELKIN,             F9L1103),
 179     RUN_DEV(BELKIN,             F5D8053V3),
 180     RUN_DEV(BELKIN,             F5D8055),
 181     RUN_DEV(BELKIN,             F5D8055V2),
 182     RUN_DEV(BELKIN,             F6D4050V1),
 183     RUN_DEV(BELKIN,             F6D4050V2),
 184     RUN_DEV(BELKIN,             RT2870_1),
 185     RUN_DEV(BELKIN,             RT2870_2),
 186     RUN_DEV(CISCOLINKSYS,       AE1000),
 187     RUN_DEV(CISCOLINKSYS2,      RT3070),
 188     RUN_DEV(CISCOLINKSYS3,      RT3070),
 189     RUN_DEV(CONCEPTRONIC2,      RT2870_1),
 190     RUN_DEV(CONCEPTRONIC2,      RT2870_2),
 191     RUN_DEV(CONCEPTRONIC2,      RT2870_3),
 192     RUN_DEV(CONCEPTRONIC2,      RT2870_4),
 193     RUN_DEV(CONCEPTRONIC2,      RT2870_5),
 194     RUN_DEV(CONCEPTRONIC2,      RT2870_6),
 195     RUN_DEV(CONCEPTRONIC2,      RT2870_7),
 196     RUN_DEV(CONCEPTRONIC2,      RT2870_8),
 197     RUN_DEV(CONCEPTRONIC2,      RT3070_1),
 198     RUN_DEV(CONCEPTRONIC2,      RT3070_2),
 199     RUN_DEV(CONCEPTRONIC2,      VIGORN61),
 200     RUN_DEV(COREGA,             CGWLUSB300GNM),
 201     RUN_DEV(COREGA,             RT2870_1),
 202     RUN_DEV(COREGA,             RT2870_2),
 203     RUN_DEV(COREGA,             RT2870_3),
 204     RUN_DEV(COREGA,             RT3070),
 205     RUN_DEV(CYBERTAN,           RT2870),
 206     RUN_DEV(DLINK,              RT2870),
 207     RUN_DEV(DLINK,              RT3072),
 208     RUN_DEV(DLINK,              DWA125A3),
 209     RUN_DEV(DLINK,              DWA127),
 210     RUN_DEV(DLINK,              DWA140B3),
 211     RUN_DEV(DLINK,              DWA160B2),
 212     RUN_DEV(DLINK,              DWA140D1),
 213     RUN_DEV(DLINK,              DWA162),
 214     RUN_DEV(DLINK2,             DWA130),
 215     RUN_DEV(DLINK2,             RT2870_1),
 216     RUN_DEV(DLINK2,             RT2870_2),
 217     RUN_DEV(DLINK2,             RT3070_1),
 218     RUN_DEV(DLINK2,             RT3070_2),
 219     RUN_DEV(DLINK2,             RT3070_3),
 220     RUN_DEV(DLINK2,             RT3070_4),
 221     RUN_DEV(DLINK2,             RT3070_5),
 222     RUN_DEV(DLINK2,             RT3072),
 223     RUN_DEV(DLINK2,             RT3072_1),
 224     RUN_DEV(EDIMAX,             EW7717),
 225     RUN_DEV(EDIMAX,             EW7718),
 226     RUN_DEV(EDIMAX,             EW7733UND),
 227     RUN_DEV(EDIMAX,             RT2870_1),
 228     RUN_DEV(ENCORE,             RT3070_1),
 229     RUN_DEV(ENCORE,             RT3070_2),
 230     RUN_DEV(ENCORE,             RT3070_3),
 231     RUN_DEV(GIGABYTE,           GNWB31N),
 232     RUN_DEV(GIGABYTE,           GNWB32L),
 233     RUN_DEV(GIGABYTE,           RT2870_1),
 234     RUN_DEV(GIGASET,            RT3070_1),
 235     RUN_DEV(GIGASET,            RT3070_2),
 236     RUN_DEV(GUILLEMOT,          HWNU300),
 237     RUN_DEV(HAWKING,            HWUN2),
 238     RUN_DEV(HAWKING,            RT2870_1),
 239     RUN_DEV(HAWKING,            RT2870_2),
 240     RUN_DEV(HAWKING,            RT3070),
 241     RUN_DEV(IODATA,             RT3072_1),
 242     RUN_DEV(IODATA,             RT3072_2),
 243     RUN_DEV(IODATA,             RT3072_3),
 244     RUN_DEV(IODATA,             RT3072_4),
 245     RUN_DEV(LINKSYS4,           RT3070),
 246     RUN_DEV(LINKSYS4,           WUSB100),
 247     RUN_DEV(LINKSYS4,           WUSB54GCV3),
 248     RUN_DEV(LINKSYS4,           WUSB600N),
 249     RUN_DEV(LINKSYS4,           WUSB600NV2),
 250     RUN_DEV(LOGITEC,            RT2870_1),
 251     RUN_DEV(LOGITEC,            RT2870_2),
 252     RUN_DEV(LOGITEC,            RT2870_3),
 253     RUN_DEV(LOGITEC,            LANW300NU2),
 254     RUN_DEV(LOGITEC,            LANW150NU2),
 255     RUN_DEV(LOGITEC,            LANW300NU2S),
 256     RUN_DEV(MELCO,              WLIUCG300HP),
 257     RUN_DEV(MELCO,              RT2870_2),
 258     RUN_DEV(MELCO,              WLIUCAG300N),
 259     RUN_DEV(MELCO,              WLIUCG300N),
 260     RUN_DEV(MELCO,              WLIUCG301N),
 261     RUN_DEV(MELCO,              WLIUCGN),
 262     RUN_DEV(MELCO,              WLIUCGNM),
 263     RUN_DEV(MELCO,              WLIUCG300HPV1),
 264     RUN_DEV(MELCO,              WLIUCGNM2),
 265     RUN_DEV(MOTOROLA4,          RT2770),
 266     RUN_DEV(MOTOROLA4,          RT3070),
 267     RUN_DEV(MSI,                RT3070_1),
 268     RUN_DEV(MSI,                RT3070_2),
 269     RUN_DEV(MSI,                RT3070_3),
 270     RUN_DEV(MSI,                RT3070_4),
 271     RUN_DEV(MSI,                RT3070_5),
 272     RUN_DEV(MSI,                RT3070_6),
 273     RUN_DEV(MSI,                RT3070_7),
 274     RUN_DEV(MSI,                RT3070_8),
 275     RUN_DEV(MSI,                RT3070_9),
 276     RUN_DEV(MSI,                RT3070_10),
 277     RUN_DEV(MSI,                RT3070_11),
 278     RUN_DEV(NETGEAR,            WNDA4100),
 279     RUN_DEV(OVISLINK,           RT3072),
 280     RUN_DEV(PARA,               RT3070),
 281     RUN_DEV(PEGATRON,           RT2870),
 282     RUN_DEV(PEGATRON,           RT3070),
 283     RUN_DEV(PEGATRON,           RT3070_2),
 284     RUN_DEV(PEGATRON,           RT3070_3),
 285     RUN_DEV(PHILIPS,            RT2870),
 286     RUN_DEV(PLANEX2,            GWUS300MINIS),
 287     RUN_DEV(PLANEX2,            GWUSMICRON),
 288     RUN_DEV(PLANEX2,            RT2870),
 289     RUN_DEV(PLANEX2,            RT3070),
 290     RUN_DEV(QCOM,               RT2870),
 291     RUN_DEV(QUANTA,             RT3070),
 292     RUN_DEV(RALINK,             RT2070),
 293     RUN_DEV(RALINK,             RT2770),
 294     RUN_DEV(RALINK,             RT2870),
 295     RUN_DEV(RALINK,             RT3070),
 296     RUN_DEV(RALINK,             RT3071),
 297     RUN_DEV(RALINK,             RT3072),
 298     RUN_DEV(RALINK,             RT3370),
 299     RUN_DEV(RALINK,             RT3572),
 300     RUN_DEV(RALINK,             RT3573),
 301     RUN_DEV(RALINK,             RT5370),
 302     RUN_DEV(RALINK,             RT5372),
 303     RUN_DEV(RALINK,             RT5572),
 304     RUN_DEV(RALINK,             RT8070),
 305     RUN_DEV(SAMSUNG,            WIS09ABGN),
 306     RUN_DEV(SAMSUNG2,           RT2870_1),
 307     RUN_DEV(SENAO,              RT2870_1),
 308     RUN_DEV(SENAO,              RT2870_2),
 309     RUN_DEV(SENAO,              RT2870_3),
 310     RUN_DEV(SENAO,              RT2870_4),
 311     RUN_DEV(SENAO,              RT3070),
 312     RUN_DEV(SENAO,              RT3071),
 313     RUN_DEV(SENAO,              RT3072_1),
 314     RUN_DEV(SENAO,              RT3072_2),
 315     RUN_DEV(SENAO,              RT3072_3),
 316     RUN_DEV(SENAO,              RT3072_4),
 317     RUN_DEV(SENAO,              RT3072_5),
 318     RUN_DEV(SITECOMEU,          RT2770),
 319     RUN_DEV(SITECOMEU,          RT2870_1),
 320     RUN_DEV(SITECOMEU,          RT2870_2),
 321     RUN_DEV(SITECOMEU,          RT2870_3),
 322     RUN_DEV(SITECOMEU,          RT2870_4),
 323     RUN_DEV(SITECOMEU,          RT3070),
 324     RUN_DEV(SITECOMEU,          RT3070_2),
 325     RUN_DEV(SITECOMEU,          RT3070_3),
 326     RUN_DEV(SITECOMEU,          RT3070_4),
 327     RUN_DEV(SITECOMEU,          RT3071),
 328     RUN_DEV(SITECOMEU,          RT3072_1),
 329     RUN_DEV(SITECOMEU,          RT3072_2),
 330     RUN_DEV(SITECOMEU,          RT3072_3),
 331     RUN_DEV(SITECOMEU,          RT3072_4),
 332     RUN_DEV(SITECOMEU,          RT3072_5),
 333     RUN_DEV(SITECOMEU,          RT3072_6),
 334     RUN_DEV(SITECOMEU,          WL608),
 335     RUN_DEV(SPARKLAN,           RT2870_1),
 336     RUN_DEV(SPARKLAN,           RT3070),
 337     RUN_DEV(SWEEX2,             LW153),
 338     RUN_DEV(SWEEX2,             LW303),
 339     RUN_DEV(SWEEX2,             LW313),
 340     RUN_DEV(TOSHIBA,            RT3070),
 341     RUN_DEV(UMEDIA,             RT2870_1),
 342     RUN_DEV(ZCOM,               RT2870_1),
 343     RUN_DEV(ZCOM,               RT2870_2),
 344     RUN_DEV(ZINWELL,            RT2870_1),
 345     RUN_DEV(ZINWELL,            RT2870_2),
 346     RUN_DEV(ZINWELL,            RT3070),
 347     RUN_DEV(ZINWELL,            RT3072_1),
 348     RUN_DEV(ZINWELL,            RT3072_2),
 349     RUN_DEV(ZYXEL,              RT2870_1),
 350     RUN_DEV(ZYXEL,              RT2870_2),
 351     RUN_DEV(ZYXEL,              RT3070),
 352     RUN_DEV_EJECT(ZYXEL,        NWD2705),
 353     RUN_DEV_EJECT(RALINK,       RT_STOR),
 354 #undef RUN_DEV_EJECT
 355 #undef RUN_DEV
 356 };
 357
 358 static device_probe_t   run_match;
 359 static device_attach_t  run_attach;
 360 static device_detach_t  run_detach;
 361
 362 static usb_callback_t   run_bulk_rx_callback;
 363 static usb_callback_t   run_bulk_tx_callback0;
 364 static usb_callback_t   run_bulk_tx_callback1;
 365 static usb_callback_t   run_bulk_tx_callback2;
 366 static usb_callback_t   run_bulk_tx_callback3;
 367 static usb_callback_t   run_bulk_tx_callback4;
 368 static usb_callback_t   run_bulk_tx_callback5;
 369
 370 static void     run_autoinst(void *, struct usb_device *,
 371                     struct usb_attach_arg *);
 372 static int      run_driver_loaded(struct module *, int, void *);
 373 static void     run_bulk_tx_callbackN(struct usb_xfer *xfer,
 374                     usb_error_t error, u_int index);
 375 static struct ieee80211vap *run_vap_create(struct ieee80211com *,
 376                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 377                     const uint8_t [IEEE80211_ADDR_LEN],
 378                     const uint8_t [IEEE80211_ADDR_LEN]);
 379 static void     run_vap_delete(struct ieee80211vap *);
 380 static void     run_cmdq_cb(void *, int);
 381 static void     run_setup_tx_list(struct run_softc *,
 382                     struct run_endpoint_queue *);
 383 static void     run_unsetup_tx_list(struct run_softc *,
 384                     struct run_endpoint_queue *);
 385 static int      run_load_microcode(struct run_softc *);
 386 static int      run_reset(struct run_softc *);
 387 static usb_error_t run_do_request(struct run_softc *,
 388                     struct usb_device_request *, void *);
 389 static int      run_read(struct run_softc *, uint16_t, uint32_t *);
 390 static int      run_read_region_1(struct run_softc *, uint16_t, uint8_t *, int);
 391 static int      run_write_2(struct run_softc *, uint16_t, uint16_t);
 392 static int      run_write(struct run_softc *, uint16_t, uint32_t);
 393 static int      run_write_region_1(struct run_softc *, uint16_t,
 394                     const uint8_t *, int);
 395 static int      run_set_region_4(struct run_softc *, uint16_t, uint32_t, int);
 396 static int      run_efuse_read(struct run_softc *, uint16_t, uint16_t *, int);
 397 static int      run_efuse_read_2(struct run_softc *, uint16_t, uint16_t *);
 398 static int      run_eeprom_read_2(struct run_softc *, uint16_t, uint16_t *);
 399 static int      run_rt2870_rf_write(struct run_softc *, uint32_t);
 400 static int      run_rt3070_rf_read(struct run_softc *, uint8_t, uint8_t *);
 401 static int      run_rt3070_rf_write(struct run_softc *, uint8_t, uint8_t);
 402 static int      run_bbp_read(struct run_softc *, uint8_t, uint8_t *);
 403 static int      run_bbp_write(struct run_softc *, uint8_t, uint8_t);
 404 static int      run_mcu_cmd(struct run_softc *, uint8_t, uint16_t);
 405 static const char *run_get_rf(uint16_t);
 406 static void     run_rt3593_get_txpower(struct run_softc *);
 407 static void     run_get_txpower(struct run_softc *);
 408 static int      run_read_eeprom(struct run_softc *);
 409 static struct ieee80211_node *run_node_alloc(struct ieee80211vap *,
 410                             const uint8_t mac[IEEE80211_ADDR_LEN]);
 411 static int      run_media_change(struct ifnet *);
 412 static int      run_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 413 static int      run_wme_update(struct ieee80211com *);
 414 static void     run_key_set_cb(void *);
 415 static int      run_key_set(struct ieee80211vap *, struct ieee80211_key *);
 416 static void     run_key_delete_cb(void *);
 417 static int      run_key_delete(struct ieee80211vap *, struct ieee80211_key *);
 418 static void     run_ratectl_to(void *);
 419 static void     run_ratectl_cb(void *, int);
 420 static void     run_drain_fifo(void *);
 421 static void     run_iter_func(void *, struct ieee80211_node *);
 422 static void     run_newassoc_cb(void *);
 423 static void     run_newassoc(struct ieee80211_node *, int);
 424 static void     run_recv_mgmt(struct ieee80211_node *, struct mbuf *, int,
 425                     const struct ieee80211_rx_stats *, int, int);
 426 static void     run_rx_frame(struct run_softc *, struct mbuf *, uint32_t);
 427 static void     run_tx_free(struct run_endpoint_queue *pq,
 428                     struct run_tx_data *, int);
 429 static void     run_set_tx_desc(struct run_softc *, struct run_tx_data *);
 430 static int      run_tx(struct run_softc *, struct mbuf *,
 431                     struct ieee80211_node *);
 432 static int      run_tx_mgt(struct run_softc *, struct mbuf *,
 433                     struct ieee80211_node *);
 434 static int      run_sendprot(struct run_softc *, const struct mbuf *,
 435                     struct ieee80211_node *, int, int);
 436 static int      run_tx_param(struct run_softc *, struct mbuf *,
 437                     struct ieee80211_node *,
 438                     const struct ieee80211_bpf_params *);
 439 static int      run_raw_xmit(struct ieee80211_node *, struct mbuf *,
 440                     const struct ieee80211_bpf_params *);
 441 static int      run_transmit(struct ieee80211com *, struct mbuf *);
 442 static void     run_start(struct run_softc *);
 443 static void     run_parent(struct ieee80211com *);
 444 static void     run_iq_calib(struct run_softc *, u_int);
 445 static void     run_set_agc(struct run_softc *, uint8_t);
 446 static void     run_select_chan_group(struct run_softc *, int);
 447 static void     run_set_rx_antenna(struct run_softc *, int);
 448 static void     run_rt2870_set_chan(struct run_softc *, u_int);
 449 static void     run_rt3070_set_chan(struct run_softc *, u_int);
 450 static void     run_rt3572_set_chan(struct run_softc *, u_int);
 451 static void     run_rt3593_set_chan(struct run_softc *, u_int);
 452 static void     run_rt5390_set_chan(struct run_softc *, u_int);
 453 static void     run_rt5592_set_chan(struct run_softc *, u_int);
 454 static int      run_set_chan(struct run_softc *, struct ieee80211_channel *);
 455 static void     run_set_channel(struct ieee80211com *);
 456 static void     run_getradiocaps(struct ieee80211com *, int, int *,
 457                     struct ieee80211_channel[]);
 458 static void     run_scan_start(struct ieee80211com *);
 459 static void     run_scan_end(struct ieee80211com *);
 460 static void     run_update_beacon(struct ieee80211vap *, int);
 461 static void     run_update_beacon_cb(void *);
 462 static void     run_updateprot(struct ieee80211com *);
 463 static void     run_updateprot_cb(void *);
 464 static void     run_usb_timeout_cb(void *);
 465 static void     run_reset_livelock(struct run_softc *);
 466 static void     run_enable_tsf_sync(struct run_softc *);
 467 static void     run_enable_tsf(struct run_softc *);
 468 static void     run_disable_tsf(struct run_softc *);
 469 static void     run_get_tsf(struct run_softc *, uint64_t *);
 470 static void     run_enable_mrr(struct run_softc *);
 471 static void     run_set_txpreamble(struct run_softc *);
 472 static void     run_set_basicrates(struct run_softc *);
 473 static void     run_set_leds(struct run_softc *, uint16_t);
 474 static void     run_set_bssid(struct run_softc *, const uint8_t *);
 475 static void     run_set_macaddr(struct run_softc *, const uint8_t *);
 476 static void     run_updateslot(struct ieee80211com *);
 477 static void     run_updateslot_cb(void *);
 478 static void     run_update_mcast(struct ieee80211com *);
 479 static int8_t   run_rssi2dbm(struct run_softc *, uint8_t, uint8_t);
 480 static void     run_update_promisc_locked(struct run_softc *);
 481 static void     run_update_promisc(struct ieee80211com *);
 482 static void     run_rt5390_bbp_init(struct run_softc *);
 483 static int      run_bbp_init(struct run_softc *);
 484 static int      run_rt3070_rf_init(struct run_softc *);
 485 static void     run_rt3593_rf_init(struct run_softc *);
 486 static void     run_rt5390_rf_init(struct run_softc *);
 487 static int      run_rt3070_filter_calib(struct run_softc *, uint8_t, uint8_t,
 488                     uint8_t *);
 489 static void     run_rt3070_rf_setup(struct run_softc *);
 490 static void     run_rt3593_rf_setup(struct run_softc *);
 491 static void     run_rt5390_rf_setup(struct run_softc *);
 492 static int      run_txrx_enable(struct run_softc *);
 493 static void     run_adjust_freq_offset(struct run_softc *);
 494 static void     run_init_locked(struct run_softc *);
 495 static void     run_stop(void *);
 496 static void     run_delay(struct run_softc *, u_int);
 497
 498 static eventhandler_tag run_etag;
 499
 500 static const struct rt2860_rate {
 501         uint8_t         rate;
 502         uint8_t         mcs;
 503         enum            ieee80211_phytype phy;
 504         uint8_t         ctl_ridx;
 505         uint16_t        sp_ack_dur;
 506         uint16_t        lp_ack_dur;
 507 } rt2860_rates[] = {
 508         {   2, 0, IEEE80211_T_DS,   0, 314, 314 },
 509         {   4, 1, IEEE80211_T_DS,   1, 258, 162 },
 510         {  11, 2, IEEE80211_T_DS,   2, 223, 127 },
 511         {  22, 3, IEEE80211_T_DS,   3, 213, 117 },
 512         {  12, 0, IEEE80211_T_OFDM, 4,  60,  60 },
 513         {  18, 1, IEEE80211_T_OFDM, 4,  52,  52 },
 514         {  24, 2, IEEE80211_T_OFDM, 6,  48,  48 },
 515         {  36, 3, IEEE80211_T_OFDM, 6,  44,  44 },
 516         {  48, 4, IEEE80211_T_OFDM, 8,  44,  44 },
 517         {  72, 5, IEEE80211_T_OFDM, 8,  40,  40 },
 518         {  96, 6, IEEE80211_T_OFDM, 8,  40,  40 },
 519         { 108, 7, IEEE80211_T_OFDM, 8,  40,  40 }
 520 };
 521
 522 static const struct {
 523         uint16_t        reg;
 524         uint32_t        val;
 525 } rt2870_def_mac[] = {
 526         RT2870_DEF_MAC
 527 };
 528
 529 static const struct {
 530         uint8_t reg;
 531         uint8_t val;
 532 } rt2860_def_bbp[] = {
 533         RT2860_DEF_BBP
 534 },rt5390_def_bbp[] = {
 535         RT5390_DEF_BBP
 536 },rt5592_def_bbp[] = {
 537         RT5592_DEF_BBP
 538 };
 539
 540 /*
 541  * Default values for BBP register R196 for RT5592.
 542  */
 543 static const uint8_t rt5592_bbp_r196[] = {
 544         0xe0, 0x1f, 0x38, 0x32, 0x08, 0x28, 0x19, 0x0a, 0xff, 0x00,
 545         0x16, 0x10, 0x10, 0x0b, 0x36, 0x2c, 0x26, 0x24, 0x42, 0x36,
 546         0x30, 0x2d, 0x4c, 0x46, 0x3d, 0x40, 0x3e, 0x42, 0x3d, 0x40,
 547         0x3c, 0x34, 0x2c, 0x2f, 0x3c, 0x35, 0x2e, 0x2a, 0x49, 0x41,
 548         0x36, 0x31, 0x30, 0x30, 0x0e, 0x0d, 0x28, 0x21, 0x1c, 0x16,
 549         0x50, 0x4a, 0x43, 0x40, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00,
 550         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 551         0x00, 0x00, 0x7d, 0x14, 0x32, 0x2c, 0x36, 0x4c, 0x43, 0x2c,
 552         0x2e, 0x36, 0x30, 0x6e
 553 };
 554
 555 static const struct rfprog {
 556         uint8_t         chan;
 557         uint32_t        r1, r2, r3, r4;
 558 } rt2860_rf2850[] = {
 559         RT2860_RF2850
 560 };
 561
 562 struct {
 563         uint8_t n, r, k;
 564 } rt3070_freqs[] = {
 565         RT3070_RF3052
 566 };
 567
 568 static const struct rt5592_freqs {
 569         uint16_t        n;
 570         uint8_t         k, m, r;
 571 } rt5592_freqs_20mhz[] = {
 572         RT5592_RF5592_20MHZ
 573 },rt5592_freqs_40mhz[] = {
 574         RT5592_RF5592_40MHZ
 575 };
 576
 577 static const struct {
 578         uint8_t reg;
 579         uint8_t val;
 580 } rt3070_def_rf[] = {
 581         RT3070_DEF_RF
 582 },rt3572_def_rf[] = {
 583         RT3572_DEF_RF
 584 },rt3593_def_rf[] = {
 585         RT3593_DEF_RF
 586 },rt5390_def_rf[] = {
 587         RT5390_DEF_RF
 588 },rt5392_def_rf[] = {
 589         RT5392_DEF_RF
 590 },rt5592_def_rf[] = {
 591         RT5592_DEF_RF
 592 },rt5592_2ghz_def_rf[] = {
 593         RT5592_2GHZ_DEF_RF
 594 },rt5592_5ghz_def_rf[] = {
 595         RT5592_5GHZ_DEF_RF
 596 };
 597
 598 static const struct {
 599         u_int   firstchan;
 600         u_int   lastchan;
 601         uint8_t reg;
 602         uint8_t val;
 603 } rt5592_chan_5ghz[] = {
 604         RT5592_CHAN_5GHZ
 605 };
 606
 607 static const struct usb_config run_config[RUN_N_XFER] = {
 608     [RUN_BULK_TX_BE] = {
 609         .type = UE_BULK,
 610         .endpoint = UE_ADDR_ANY,
 611         .ep_index = 0,
 612         .direction = UE_DIR_OUT,
 613         .bufsize = RUN_MAX_TXSZ,
 614         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 615         .callback = run_bulk_tx_callback0,
 616         .timeout = 5000,        /* ms */
 617     },
 618     [RUN_BULK_TX_BK] = {
 619         .type = UE_BULK,
 620         .endpoint = UE_ADDR_ANY,
 621         .direction = UE_DIR_OUT,
 622         .ep_index = 1,
 623         .bufsize = RUN_MAX_TXSZ,
 624         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 625         .callback = run_bulk_tx_callback1,
 626         .timeout = 5000,        /* ms */
 627     },
 628     [RUN_BULK_TX_VI] = {
 629         .type = UE_BULK,
 630         .endpoint = UE_ADDR_ANY,
 631         .direction = UE_DIR_OUT,
 632         .ep_index = 2,
 633         .bufsize = RUN_MAX_TXSZ,
 634         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 635         .callback = run_bulk_tx_callback2,
 636         .timeout = 5000,        /* ms */
 637     },
 638     [RUN_BULK_TX_VO] = {
 639         .type = UE_BULK,
 640         .endpoint = UE_ADDR_ANY,
 641         .direction = UE_DIR_OUT,
 642         .ep_index = 3,
 643         .bufsize = RUN_MAX_TXSZ,
 644         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 645         .callback = run_bulk_tx_callback3,
 646         .timeout = 5000,        /* ms */
 647     },
 648     [RUN_BULK_TX_HCCA] = {
 649         .type = UE_BULK,
 650         .endpoint = UE_ADDR_ANY,
 651         .direction = UE_DIR_OUT,
 652         .ep_index = 4,
 653         .bufsize = RUN_MAX_TXSZ,
 654         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 655         .callback = run_bulk_tx_callback4,
 656         .timeout = 5000,        /* ms */
 657     },
 658     [RUN_BULK_TX_PRIO] = {
 659         .type = UE_BULK,
 660         .endpoint = UE_ADDR_ANY,
 661         .direction = UE_DIR_OUT,
 662         .ep_index = 5,
 663         .bufsize = RUN_MAX_TXSZ,
 664         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 665         .callback = run_bulk_tx_callback5,
 666         .timeout = 5000,        /* ms */
 667     },
 668     [RUN_BULK_RX] = {
 669         .type = UE_BULK,
 670         .endpoint = UE_ADDR_ANY,
 671         .direction = UE_DIR_IN,
 672         .bufsize = RUN_MAX_RXSZ,
 673         .flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
 674         .callback = run_bulk_rx_callback,
 675     }
 676 };
 677
 678 static void
 679 run_autoinst(void *arg, struct usb_device *udev,
 680     struct usb_attach_arg *uaa)
 681 {
 682         struct usb_interface *iface;
 683         struct usb_interface_descriptor *id;
 684
 685         if (uaa->dev_state != UAA_DEV_READY)
 686                 return;
 687
 688         iface = usbd_get_iface(udev, 0);
 689         if (iface == NULL)
 690                 return;
 691         id = iface->idesc;
 692         if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
 693                 return;
 694         if (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa))
 695                 return;
 696
 697         if (usb_msc_eject(udev, 0, MSC_EJECT_STOPUNIT) == 0)
 698                 uaa->dev_state = UAA_DEV_EJECTING;
 699 }
 700
 701 static int
 702 run_driver_loaded(struct module *mod, int what, void *arg)
 703 {
 704         switch (what) {
 705         case MOD_LOAD:
 706                 run_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
 707                     run_autoinst, NULL, EVENTHANDLER_PRI_ANY);
 708                 break;
 709         case MOD_UNLOAD:
 710                 EVENTHANDLER_DEREGISTER(usb_dev_configured, run_etag);
 711                 break;
 712         default:
 713                 return (EOPNOTSUPP);
 714         }
 715         return (0);
 716 }
 717
 718 static int
 719 run_match(device_t self)
 720 {
 721         struct usb_attach_arg *uaa = device_get_ivars(self);
 722
 723         if (uaa->usb_mode != USB_MODE_HOST)
 724                 return (ENXIO);
 725         if (uaa->info.bConfigIndex != 0)
 726                 return (ENXIO);
 727         if (uaa->info.bIfaceIndex != RT2860_IFACE_INDEX)
 728                 return (ENXIO);
 729
 730         return (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa));
 731 }
 732
 733 static int
 734 run_attach(device_t self)
 735 {
 736         struct run_softc *sc = device_get_softc(self);
 737         struct usb_attach_arg *uaa = device_get_ivars(self);
 738         struct ieee80211com *ic = &sc->sc_ic;
 739         uint32_t ver;
 740         uint8_t iface_index;
 741         int ntries, error;
 742
 743         device_set_usb_desc(self);
 744         sc->sc_udev = uaa->device;
 745         sc->sc_dev = self;
 746         if (USB_GET_DRIVER_INFO(uaa) != RUN_EJECT)
 747                 sc->sc_flags |= RUN_FLAG_FWLOAD_NEEDED;
 748
 749         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
 750             MTX_NETWORK_LOCK, MTX_DEF);
 751         mbufq_init(&sc->sc_snd, ifqmaxlen);
 752
 753         iface_index = RT2860_IFACE_INDEX;
 754
 755         error = usbd_transfer_setup(uaa->device, &iface_index,
 756             sc->sc_xfer, run_config, RUN_N_XFER, sc, &sc->sc_mtx);
 757         if (error) {
 758                 device_printf(self, "could not allocate USB transfers, "
 759                     "err=%s\n", usbd_errstr(error));
 760                 goto detach;
 761         }
 762
 763         RUN_LOCK(sc);
 764
 765         /* wait for the chip to settle */
 766         for (ntries = 0; ntries < 100; ntries++) {
 767                 if (run_read(sc, RT2860_ASIC_VER_ID, &ver) != 0) {
 768                         RUN_UNLOCK(sc);
 769                         goto detach;
 770                 }
 771                 if (ver != 0 && ver != 0xffffffff)
 772                         break;
 773                 run_delay(sc, 10);
 774         }
 775         if (ntries == 100) {
 776                 device_printf(sc->sc_dev,
 777                     "timeout waiting for NIC to initialize\n");
 778                 RUN_UNLOCK(sc);
 779                 goto detach;
 780         }
 781         sc->mac_ver = ver >> 16;
 782         sc->mac_rev = ver & 0xffff;
 783
 784         /* retrieve RF rev. no and various other things from EEPROM */
 785         run_read_eeprom(sc);
 786
 787         device_printf(sc->sc_dev,
 788             "MAC/BBP RT%04X (rev 0x%04X), RF %s (MIMO %dT%dR), address %s\n",
 789             sc->mac_ver, sc->mac_rev, run_get_rf(sc->rf_rev),
 790             sc->ntxchains, sc->nrxchains, ether_sprintf(ic->ic_macaddr));
 791
 792         RUN_UNLOCK(sc);
 793
 794         ic->ic_softc = sc;
 795         ic->ic_name = device_get_nameunit(self);
 796         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 797         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 798
 799         /* set device capabilities */
 800         ic->ic_caps =
 801             IEEE80211_C_STA |           /* station mode supported */
 802             IEEE80211_C_MONITOR |       /* monitor mode supported */
 803             IEEE80211_C_IBSS |
 804             IEEE80211_C_HOSTAP |
 805             IEEE80211_C_WDS |           /* 4-address traffic works */
 806             IEEE80211_C_MBSS |
 807             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 808             IEEE80211_C_SHSLOT |        /* short slot time supported */
 809             IEEE80211_C_WME |           /* WME */
 810             IEEE80211_C_WPA;            /* WPA1|WPA2(RSN) */
 811
 812         ic->ic_cryptocaps =
 813             IEEE80211_CRYPTO_WEP |
 814             IEEE80211_CRYPTO_AES_CCM |
 815             IEEE80211_CRYPTO_TKIPMIC |
 816             IEEE80211_CRYPTO_TKIP;
 817
 818         ic->ic_flags |= IEEE80211_F_DATAPAD;
 819         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 820
 821         run_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
 822             ic->ic_channels);
 823
 824         ieee80211_ifattach(ic);
 825
 826         ic->ic_scan_start = run_scan_start;
 827         ic->ic_scan_end = run_scan_end;
 828         ic->ic_set_channel = run_set_channel;
 829         ic->ic_getradiocaps = run_getradiocaps;
 830         ic->ic_node_alloc = run_node_alloc;
 831         ic->ic_newassoc = run_newassoc;
 832         ic->ic_updateslot = run_updateslot;
 833         ic->ic_update_mcast = run_update_mcast;
 834         ic->ic_wme.wme_update = run_wme_update;
 835         ic->ic_raw_xmit = run_raw_xmit;
 836         ic->ic_update_promisc = run_update_promisc;
 837         ic->ic_vap_create = run_vap_create;
 838         ic->ic_vap_delete = run_vap_delete;
 839         ic->ic_transmit = run_transmit;
 840         ic->ic_parent = run_parent;
 841
 842         ieee80211_radiotap_attach(ic,
 843             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 844                 RUN_TX_RADIOTAP_PRESENT,
 845             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 846                 RUN_RX_RADIOTAP_PRESENT);
 847
 848         TASK_INIT(&sc->cmdq_task, 0, run_cmdq_cb, sc);
 849         TASK_INIT(&sc->ratectl_task, 0, run_ratectl_cb, sc);
 850         usb_callout_init_mtx(&sc->ratectl_ch, &sc->sc_mtx, 0);
 851
 852         if (bootverbose)
 853                 ieee80211_announce(ic);
 854
 855         return (0);
 856
 857 detach:
 858         run_detach(self);
 859         return (ENXIO);
 860 }
 861
 862 static void
 863 run_drain_mbufq(struct run_softc *sc)
 864 {
 865         struct mbuf *m;
 866         struct ieee80211_node *ni;
 867
 868         RUN_LOCK_ASSERT(sc, MA_OWNED);
 869         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 870                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
 871                 m->m_pkthdr.rcvif = NULL;
 872                 ieee80211_free_node(ni);
 873                 m_freem(m);
 874         }
 875 }
 876
 877 static int
 878 run_detach(device_t self)
 879 {
 880         struct run_softc *sc = device_get_softc(self);
 881         struct ieee80211com *ic = &sc->sc_ic;
 882         int i;
 883
 884         RUN_LOCK(sc);
 885         sc->sc_detached = 1;
 886         RUN_UNLOCK(sc);
 887
 888         /* stop all USB transfers */
 889         usbd_transfer_unsetup(sc->sc_xfer, RUN_N_XFER);
 890
 891         RUN_LOCK(sc);
 892         sc->ratectl_run = RUN_RATECTL_OFF;
 893         sc->cmdq_run = sc->cmdq_key_set = RUN_CMDQ_ABORT;
 894
 895         /* free TX list, if any */
 896         for (i = 0; i != RUN_EP_QUEUES; i++)
 897                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
 898
 899         /* Free TX queue */
 900         run_drain_mbufq(sc);
 901         RUN_UNLOCK(sc);
 902
 903         if (sc->sc_ic.ic_softc == sc) {
 904                 /* drain tasks */
 905                 usb_callout_drain(&sc->ratectl_ch);
 906                 ieee80211_draintask(ic, &sc->cmdq_task);
 907                 ieee80211_draintask(ic, &sc->ratectl_task);
 908                 ieee80211_ifdetach(ic);
 909         }
 910
 911         mtx_destroy(&sc->sc_mtx);
 912
 913         return (0);
 914 }
 915
 916 static struct ieee80211vap *
 917 run_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 918     enum ieee80211_opmode opmode, int flags,
 919     const uint8_t bssid[IEEE80211_ADDR_LEN],
 920     const uint8_t mac[IEEE80211_ADDR_LEN])
 921 {
 922         struct run_softc *sc = ic->ic_softc;
 923         struct run_vap *rvp;
 924         struct ieee80211vap *vap;
 925         int i;
 926
 927         if (sc->rvp_cnt >= RUN_VAP_MAX) {
 928                 device_printf(sc->sc_dev, "number of VAPs maxed out\n");
 929                 return (NULL);
 930         }
 931
 932         switch (opmode) {
 933         case IEEE80211_M_STA:
 934                 /* enable s/w bmiss handling for sta mode */
 935                 flags |= IEEE80211_CLONE_NOBEACONS;
 936                 /* fall though */
 937         case IEEE80211_M_IBSS:
 938         case IEEE80211_M_MONITOR:
 939         case IEEE80211_M_HOSTAP:
 940         case IEEE80211_M_MBSS:
 941                 /* other than WDS vaps, only one at a time */
 942                 if (!TAILQ_EMPTY(&ic->ic_vaps))
 943                         return (NULL);
 944                 break;
 945         case IEEE80211_M_WDS:
 946                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next){
 947                         if(vap->iv_opmode != IEEE80211_M_HOSTAP)
 948                                 continue;
 949                         /* WDS vap's always share the local mac address. */
 950                         flags &= ~IEEE80211_CLONE_BSSID;
 951                         break;
 952                 }
 953                 if (vap == NULL) {
 954                         device_printf(sc->sc_dev,
 955                             "wds only supported in ap mode\n");
 956                         return (NULL);
 957                 }
 958                 break;
 959         default:
 960                 device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
 961                 return (NULL);
 962         }
 963
 964         rvp = malloc(sizeof(struct run_vap), M_80211_VAP, M_WAITOK | M_ZERO);
 965         vap = &rvp->vap;
 966
 967         if (ieee80211_vap_setup(ic, vap, name, unit, opmode, flags,
 968             bssid) != 0) {
 969                 /* out of memory */
 970                 free(rvp, M_80211_VAP);
 971                 return (NULL);
 972         }
 973
 974         vap->iv_update_beacon = run_update_beacon;
 975         vap->iv_max_aid = RT2870_WCID_MAX;
 976         /*
 977          * To delete the right key from h/w, we need wcid.
 978          * Luckily, there is unused space in ieee80211_key{}, wk_pad,
 979          * and matching wcid will be written into there. So, cast
 980          * some spells to remove 'const' from ieee80211_key{}
 981          */
 982         vap->iv_key_delete = (void *)run_key_delete;
 983         vap->iv_key_set = (void *)run_key_set;
 984
 985         /* override state transition machine */
 986         rvp->newstate = vap->iv_newstate;
 987         vap->iv_newstate = run_newstate;
 988         if (opmode == IEEE80211_M_IBSS) {
 989                 rvp->recv_mgmt = vap->iv_recv_mgmt;
 990                 vap->iv_recv_mgmt = run_recv_mgmt;
 991         }
 992
 993         ieee80211_ratectl_init(vap);
 994         ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
 995
 996         /* complete setup */
 997         ieee80211_vap_attach(vap, run_media_change, ieee80211_media_status,
 998             mac);
 999
1000         /* make sure id is always unique */
1001         for (i = 0; i < RUN_VAP_MAX; i++) {
1002                 if((sc->rvp_bmap & 1 << i) == 0){
1003                         sc->rvp_bmap |= 1 << i;
1004                         rvp->rvp_id = i;
1005                         break;
1006                 }
1007         }
1008         if (sc->rvp_cnt++ == 0)
1009                 ic->ic_opmode = opmode;
1010
1011         if (opmode == IEEE80211_M_HOSTAP)
1012                 sc->cmdq_run = RUN_CMDQ_GO;
1013
1014         RUN_DPRINTF(sc, RUN_DEBUG_STATE, "rvp_id=%d bmap=%x rvp_cnt=%d\n",
1015             rvp->rvp_id, sc->rvp_bmap, sc->rvp_cnt);
1016
1017         return (vap);
1018 }
1019
1020 static void
1021 run_vap_delete(struct ieee80211vap *vap)
1022 {
1023         struct run_vap *rvp = RUN_VAP(vap);
1024         struct ieee80211com *ic;
1025         struct run_softc *sc;
1026         uint8_t rvp_id;
1027
1028         if (vap == NULL)
1029                 return;
1030
1031         ic = vap->iv_ic;
1032         sc = ic->ic_softc;
1033
1034         RUN_LOCK(sc);
1035
1036         m_freem(rvp->beacon_mbuf);
1037         rvp->beacon_mbuf = NULL;
1038
1039         rvp_id = rvp->rvp_id;
1040         sc->ratectl_run &= ~(1 << rvp_id);
1041         sc->rvp_bmap &= ~(1 << rvp_id);
1042         run_set_region_4(sc, RT2860_SKEY(rvp_id, 0), 0, 128);
1043         run_set_region_4(sc, RT2860_BCN_BASE(rvp_id), 0, 512);
1044         --sc->rvp_cnt;
1045
1046         RUN_DPRINTF(sc, RUN_DEBUG_STATE,
1047             "vap=%p rvp_id=%d bmap=%x rvp_cnt=%d\n",
1048             vap, rvp_id, sc->rvp_bmap, sc->rvp_cnt);
1049
1050         RUN_UNLOCK(sc);
1051
1052         ieee80211_ratectl_deinit(vap);
1053         ieee80211_vap_detach(vap);
1054         free(rvp, M_80211_VAP);
1055 }
1056
1057 /*
1058  * There are numbers of functions need to be called in context thread.
1059  * Rather than creating taskqueue event for each of those functions,
1060  * here is all-for-one taskqueue callback function. This function
1061  * guarantees deferred functions are executed in the same order they
1062  * were enqueued.
1063  * '& RUN_CMDQ_MASQ' is to loop cmdq[].
1064  */
1065 static void
1066 run_cmdq_cb(void *arg, int pending)
1067 {
1068         struct run_softc *sc = arg;
1069         uint8_t i;
1070
1071         /* call cmdq[].func locked */
1072         RUN_LOCK(sc);
1073         for (i = sc->cmdq_exec; sc->cmdq[i].func && pending;
1074             i = sc->cmdq_exec, pending--) {
1075                 RUN_DPRINTF(sc, RUN_DEBUG_CMD, "cmdq_exec=%d pending=%d\n",
1076                     i, pending);
1077                 if (sc->cmdq_run == RUN_CMDQ_GO) {
1078                         /*
1079                          * If arg0 is NULL, callback func needs more
1080                          * than one arg. So, pass ptr to cmdq struct.
1081                          */
1082                         if (sc->cmdq[i].arg0)
1083                                 sc->cmdq[i].func(sc->cmdq[i].arg0);
1084                         else
1085                                 sc->cmdq[i].func(&sc->cmdq[i]);
1086                 }
1087                 sc->cmdq[i].arg0 = NULL;
1088                 sc->cmdq[i].func = NULL;
1089                 sc->cmdq_exec++;
1090                 sc->cmdq_exec &= RUN_CMDQ_MASQ;
1091         }
1092         RUN_UNLOCK(sc);
1093 }
1094
1095 static void
1096 run_setup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
1097 {
1098         struct run_tx_data *data;
1099
1100         memset(pq, 0, sizeof(*pq));
1101
1102         STAILQ_INIT(&pq->tx_qh);
1103         STAILQ_INIT(&pq->tx_fh);
1104
1105         for (data = &pq->tx_data[0];
1106             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
1107                 data->sc = sc;
1108                 STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
1109         }
1110         pq->tx_nfree = RUN_TX_RING_COUNT;
1111 }
1112
1113 static void
1114 run_unsetup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
1115 {
1116         struct run_tx_data *data;
1117
1118         /* make sure any subsequent use of the queues will fail */
1119         pq->tx_nfree = 0;
1120         STAILQ_INIT(&pq->tx_fh);
1121         STAILQ_INIT(&pq->tx_qh);
1122
1123         /* free up all node references and mbufs */
1124         for (data = &pq->tx_data[0];
1125             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
1126                 if (data->m != NULL) {
1127                         m_freem(data->m);
1128                         data->m = NULL;
1129                 }
1130                 if (data->ni != NULL) {
1131                         ieee80211_free_node(data->ni);
1132                         data->ni = NULL;
1133                 }
1134         }
1135 }
1136
1137 static int
1138 run_load_microcode(struct run_softc *sc)
1139 {
1140         usb_device_request_t req;
1141         const struct firmware *fw;
1142         const u_char *base;
1143         uint32_t tmp;
1144         int ntries, error;
1145         const uint64_t *temp;
1146         uint64_t bytes;
1147
1148         RUN_UNLOCK(sc);
1149         fw = firmware_get("runfw");
1150         RUN_LOCK(sc);
1151         if (fw == NULL) {
1152                 device_printf(sc->sc_dev,
1153                     "failed loadfirmware of file %s\n", "runfw");
1154                 return ENOENT;
1155         }
1156
1157         if (fw->datasize != 8192) {
1158                 device_printf(sc->sc_dev,
1159                     "invalid firmware size (should be 8KB)\n");
1160                 error = EINVAL;
1161                 goto fail;
1162         }
1163
1164         /*
1165          * RT3071/RT3072 use a different firmware
1166          * run-rt2870 (8KB) contains both,
1167          * first half (4KB) is for rt2870,
1168          * last half is for rt3071.
1169          */
1170         base = fw->data;
1171         if ((sc->mac_ver) != 0x2860 &&
1172             (sc->mac_ver) != 0x2872 &&
1173             (sc->mac_ver) != 0x3070) {
1174                 base += 4096;
1175         }
1176
1177         /* cheap sanity check */
1178         temp = fw->data;
1179         bytes = *temp;
1180         if (bytes != be64toh(0xffffff0210280210ULL)) {
1181                 device_printf(sc->sc_dev, "firmware checksum failed\n");
1182                 error = EINVAL;
1183                 goto fail;
1184         }
1185
1186         /* write microcode image */
1187         if (sc->sc_flags & RUN_FLAG_FWLOAD_NEEDED) {
1188                 run_write_region_1(sc, RT2870_FW_BASE, base, 4096);
1189                 run_write(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
1190                 run_write(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
1191         }
1192
1193         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1194         req.bRequest = RT2870_RESET;
1195         USETW(req.wValue, 8);
1196         USETW(req.wIndex, 0);
1197         USETW(req.wLength, 0);
1198         if ((error = usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL))
1199             != 0) {
1200                 device_printf(sc->sc_dev, "firmware reset failed\n");
1201                 goto fail;
1202         }
1203
1204         run_delay(sc, 10);
1205
1206         run_write(sc, RT2860_H2M_BBPAGENT, 0);
1207         run_write(sc, RT2860_H2M_MAILBOX, 0);
1208         run_write(sc, RT2860_H2M_INTSRC, 0);
1209         if ((error = run_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0)) != 0)
1210                 goto fail;
1211
1212         /* wait until microcontroller is ready */
1213         for (ntries = 0; ntries < 1000; ntries++) {
1214                 if ((error = run_read(sc, RT2860_SYS_CTRL, &tmp)) != 0)
1215                         goto fail;
1216                 if (tmp & RT2860_MCU_READY)
1217                         break;
1218                 run_delay(sc, 10);
1219         }
1220         if (ntries == 1000) {
1221                 device_printf(sc->sc_dev,
1222                     "timeout waiting for MCU to initialize\n");
1223                 error = ETIMEDOUT;
1224                 goto fail;
1225         }
1226         device_printf(sc->sc_dev, "firmware %s ver. %u.%u loaded\n",
1227             (base == fw->data) ? "RT2870" : "RT3071",
1228             *(base + 4092), *(base + 4093));
1229
1230 fail:
1231         firmware_put(fw, FIRMWARE_UNLOAD);
1232         return (error);
1233 }
1234
1235 static int
1236 run_reset(struct run_softc *sc)
1237 {
1238         usb_device_request_t req;
1239
1240         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1241         req.bRequest = RT2870_RESET;
1242         USETW(req.wValue, 1);
1243         USETW(req.wIndex, 0);
1244         USETW(req.wLength, 0);
1245         return (usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL));
1246 }
1247
1248 static usb_error_t
1249 run_do_request(struct run_softc *sc,
1250     struct usb_device_request *req, void *data)
1251 {
1252         usb_error_t err;
1253         int ntries = 10;
1254
1255         RUN_LOCK_ASSERT(sc, MA_OWNED);
1256
1257         while (ntries--) {
1258                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
1259                     req, data, 0, NULL, 250 /* ms */);
1260                 if (err == 0)
1261                         break;
1262                 RUN_DPRINTF(sc, RUN_DEBUG_USB,
1263                     "Control request failed, %s (retrying)\n",
1264                     usbd_errstr(err));
1265                 run_delay(sc, 10);
1266         }
1267         return (err);
1268 }
1269
1270 static int
1271 run_read(struct run_softc *sc, uint16_t reg, uint32_t *val)
1272 {
1273         uint32_t tmp;
1274         int error;
1275
1276         error = run_read_region_1(sc, reg, (uint8_t *)&tmp, sizeof tmp);
1277         if (error == 0)
1278                 *val = le32toh(tmp);
1279         else
1280                 *val = 0xffffffff;
1281         return (error);
1282 }
1283
1284 static int
1285 run_read_region_1(struct run_softc *sc, uint16_t reg, uint8_t *buf, int len)
1286 {
1287         usb_device_request_t req;
1288
1289         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1290         req.bRequest = RT2870_READ_REGION_1;
1291         USETW(req.wValue, 0);
1292         USETW(req.wIndex, reg);
1293         USETW(req.wLength, len);
1294
1295         return (run_do_request(sc, &req, buf));
1296 }
1297
1298 static int
1299 run_write_2(struct run_softc *sc, uint16_t reg, uint16_t val)
1300 {
1301         usb_device_request_t req;
1302
1303         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1304         req.bRequest = RT2870_WRITE_2;
1305         USETW(req.wValue, val);
1306         USETW(req.wIndex, reg);
1307         USETW(req.wLength, 0);
1308
1309         return (run_do_request(sc, &req, NULL));
1310 }
1311
1312 static int
1313 run_write(struct run_softc *sc, uint16_t reg, uint32_t val)
1314 {
1315         int error;
1316
1317         if ((error = run_write_2(sc, reg, val & 0xffff)) == 0)
1318                 error = run_write_2(sc, reg + 2, val >> 16);
1319         return (error);
1320 }
1321
1322 static int
1323 run_write_region_1(struct run_softc *sc, uint16_t reg, const uint8_t *buf,
1324     int len)
1325 {
1326 #if 1
1327         int i, error = 0;
1328         /*
1329          * NB: the WRITE_REGION_1 command is not stable on RT2860.
1330          * We thus issue multiple WRITE_2 commands instead.
1331          */
1332         KASSERT((len & 1) == 0, ("run_write_region_1: Data too long.\n"));
1333         for (i = 0; i < len && error == 0; i += 2)
1334                 error = run_write_2(sc, reg + i, buf[i] | buf[i + 1] << 8);
1335         return (error);
1336 #else
1337         usb_device_request_t req;
1338         int error = 0;
1339
1340         /*
1341          * NOTE: It appears the WRITE_REGION_1 command cannot be
1342          * passed a huge amount of data, which will crash the
1343          * firmware. Limit amount of data passed to 64-bytes at a
1344          * time.
1345          */
1346         while (len > 0) {
1347                 int delta = 64;
1348                 if (delta > len)
1349                         delta = len;
1350
1351                 req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1352                 req.bRequest = RT2870_WRITE_REGION_1;
1353                 USETW(req.wValue, 0);
1354                 USETW(req.wIndex, reg);
1355                 USETW(req.wLength, delta);
1356                 error = run_do_request(sc, &req, __DECONST(uint8_t *, buf));
1357                 if (error != 0)
1358                         break;
1359                 reg += delta;
1360                 buf += delta;
1361                 len -= delta;
1362         }
1363         return (error);
1364 #endif
1365 }
1366
1367 static int
1368 run_set_region_4(struct run_softc *sc, uint16_t reg, uint32_t val, int len)
1369 {
1370         int i, error = 0;
1371
1372         KASSERT((len & 3) == 0, ("run_set_region_4: Invalid data length.\n"));
1373         for (i = 0; i < len && error == 0; i += 4)
1374                 error = run_write(sc, reg + i, val);
1375         return (error);
1376 }
1377
1378 static int
1379 run_efuse_read(struct run_softc *sc, uint16_t addr, uint16_t *val, int count)
1380 {
1381         uint32_t tmp;
1382         uint16_t reg;
1383         int error, ntries;
1384
1385         if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1386                 return (error);
1387
1388         if (count == 2)
1389                 addr *= 2;
1390         /*-
1391          * Read one 16-byte block into registers EFUSE_DATA[0-3]:
1392          * DATA0: F E D C
1393          * DATA1: B A 9 8
1394          * DATA2: 7 6 5 4
1395          * DATA3: 3 2 1 0
1396          */
1397         tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
1398         tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
1399         run_write(sc, RT3070_EFUSE_CTRL, tmp);
1400         for (ntries = 0; ntries < 100; ntries++) {
1401                 if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1402                         return (error);
1403                 if (!(tmp & RT3070_EFSROM_KICK))
1404                         break;
1405                 run_delay(sc, 2);
1406         }
1407         if (ntries == 100)
1408                 return (ETIMEDOUT);
1409
1410         if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK) {
1411                 *val = 0xffff;  /* address not found */
1412                 return (0);
1413         }
1414         /* determine to which 32-bit register our 16-bit word belongs */
1415         reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1416         if ((error = run_read(sc, reg, &tmp)) != 0)
1417                 return (error);
1418
1419         tmp >>= (8 * (addr & 0x3));
1420         *val = (addr & 1) ? tmp >> 16 : tmp & 0xffff;
1421
1422         return (0);
1423 }
1424
1425 /* Read 16-bit from eFUSE ROM for RT3xxx. */
1426 static int
1427 run_efuse_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1428 {
1429         return (run_efuse_read(sc, addr, val, 2));
1430 }
1431
1432 static int
1433 run_eeprom_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1434 {
1435         usb_device_request_t req;
1436         uint16_t tmp;
1437         int error;
1438
1439         addr *= 2;
1440         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1441         req.bRequest = RT2870_EEPROM_READ;
1442         USETW(req.wValue, 0);
1443         USETW(req.wIndex, addr);
1444         USETW(req.wLength, sizeof(tmp));
1445
1446         error = usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, &tmp);
1447         if (error == 0)
1448                 *val = le16toh(tmp);
1449         else
1450                 *val = 0xffff;
1451         return (error);
1452 }
1453
1454 static __inline int
1455 run_srom_read(struct run_softc *sc, uint16_t addr, uint16_t *val)
1456 {
1457         /* either eFUSE ROM or EEPROM */
1458         return sc->sc_srom_read(sc, addr, val);
1459 }
1460
1461 static int
1462 run_rt2870_rf_write(struct run_softc *sc, uint32_t val)
1463 {
1464         uint32_t tmp;
1465         int error, ntries;
1466
1467         for (ntries = 0; ntries < 10; ntries++) {
1468                 if ((error = run_read(sc, RT2860_RF_CSR_CFG0, &tmp)) != 0)
1469                         return (error);
1470                 if (!(tmp & RT2860_RF_REG_CTRL))
1471                         break;
1472         }
1473         if (ntries == 10)
1474                 return (ETIMEDOUT);
1475
1476         return (run_write(sc, RT2860_RF_CSR_CFG0, val));
1477 }
1478
1479 static int
1480 run_rt3070_rf_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1481 {
1482         uint32_t tmp;
1483         int error, ntries;
1484
1485         for (ntries = 0; ntries < 100; ntries++) {
1486                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1487                         return (error);
1488                 if (!(tmp & RT3070_RF_KICK))
1489                         break;
1490         }
1491         if (ntries == 100)
1492                 return (ETIMEDOUT);
1493
1494         tmp = RT3070_RF_KICK | reg << 8;
1495         if ((error = run_write(sc, RT3070_RF_CSR_CFG, tmp)) != 0)
1496                 return (error);
1497
1498         for (ntries = 0; ntries < 100; ntries++) {
1499                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1500                         return (error);
1501                 if (!(tmp & RT3070_RF_KICK))
1502                         break;
1503         }
1504         if (ntries == 100)
1505                 return (ETIMEDOUT);
1506
1507         *val = tmp & 0xff;
1508         return (0);
1509 }
1510
1511 static int
1512 run_rt3070_rf_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1513 {
1514         uint32_t tmp;
1515         int error, ntries;
1516
1517         for (ntries = 0; ntries < 10; ntries++) {
1518                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1519                         return (error);
1520                 if (!(tmp & RT3070_RF_KICK))
1521                         break;
1522         }
1523         if (ntries == 10)
1524                 return (ETIMEDOUT);
1525
1526         tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
1527         return (run_write(sc, RT3070_RF_CSR_CFG, tmp));
1528 }
1529
1530 static int
1531 run_bbp_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1532 {
1533         uint32_t tmp;
1534         int ntries, error;
1535
1536         for (ntries = 0; ntries < 10; ntries++) {
1537                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1538                         return (error);
1539                 if (!(tmp & RT2860_BBP_CSR_KICK))
1540                         break;
1541         }
1542         if (ntries == 10)
1543                 return (ETIMEDOUT);
1544
1545         tmp = RT2860_BBP_CSR_READ | RT2860_BBP_CSR_KICK | reg << 8;
1546         if ((error = run_write(sc, RT2860_BBP_CSR_CFG, tmp)) != 0)
1547                 return (error);
1548
1549         for (ntries = 0; ntries < 10; ntries++) {
1550                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1551                         return (error);
1552                 if (!(tmp & RT2860_BBP_CSR_KICK))
1553                         break;
1554         }
1555         if (ntries == 10)
1556                 return (ETIMEDOUT);
1557
1558         *val = tmp & 0xff;
1559         return (0);
1560 }
1561
1562 static int
1563 run_bbp_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1564 {
1565         uint32_t tmp;
1566         int ntries, error;
1567
1568         for (ntries = 0; ntries < 10; ntries++) {
1569                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1570                         return (error);
1571                 if (!(tmp & RT2860_BBP_CSR_KICK))
1572                         break;
1573         }
1574         if (ntries == 10)
1575                 return (ETIMEDOUT);
1576
1577         tmp = RT2860_BBP_CSR_KICK | reg << 8 | val;
1578         return (run_write(sc, RT2860_BBP_CSR_CFG, tmp));
1579 }
1580
1581 /*
1582  * Send a command to the 8051 microcontroller unit.
1583  */
1584 static int
1585 run_mcu_cmd(struct run_softc *sc, uint8_t cmd, uint16_t arg)
1586 {
1587         uint32_t tmp;
1588         int error, ntries;
1589
1590         for (ntries = 0; ntries < 100; ntries++) {
1591                 if ((error = run_read(sc, RT2860_H2M_MAILBOX, &tmp)) != 0)
1592                         return error;
1593                 if (!(tmp & RT2860_H2M_BUSY))
1594                         break;
1595         }
1596         if (ntries == 100)
1597                 return ETIMEDOUT;
1598
1599         tmp = RT2860_H2M_BUSY | RT2860_TOKEN_NO_INTR << 16 | arg;
1600         if ((error = run_write(sc, RT2860_H2M_MAILBOX, tmp)) == 0)
1601                 error = run_write(sc, RT2860_HOST_CMD, cmd);
1602         return (error);
1603 }
1604
1605 /*
1606  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
1607  * Used to adjust per-rate Tx power registers.
1608  */
1609 static __inline uint32_t
1610 b4inc(uint32_t b32, int8_t delta)
1611 {
1612         int8_t i, b4;
1613
1614         for (i = 0; i < 8; i++) {
1615                 b4 = b32 & 0xf;
1616                 b4 += delta;
1617                 if (b4 < 0)
1618                         b4 = 0;
1619                 else if (b4 > 0xf)
1620                         b4 = 0xf;
1621                 b32 = b32 >> 4 | b4 << 28;
1622         }
1623         return (b32);
1624 }
1625
1626 static const char *
1627 run_get_rf(uint16_t rev)
1628 {
1629         switch (rev) {
1630         case RT2860_RF_2820:    return "RT2820";
1631         case RT2860_RF_2850:    return "RT2850";
1632         case RT2860_RF_2720:    return "RT2720";
1633         case RT2860_RF_2750:    return "RT2750";
1634         case RT3070_RF_3020:    return "RT3020";
1635         case RT3070_RF_2020:    return "RT2020";
1636         case RT3070_RF_3021:    return "RT3021";
1637         case RT3070_RF_3022:    return "RT3022";
1638         case RT3070_RF_3052:    return "RT3052";
1639         case RT3593_RF_3053:    return "RT3053";
1640         case RT5592_RF_5592:    return "RT5592";
1641         case RT5390_RF_5370:    return "RT5370";
1642         case RT5390_RF_5372:    return "RT5372";
1643         }
1644         return ("unknown");
1645 }
1646
1647 static void
1648 run_rt3593_get_txpower(struct run_softc *sc)
1649 {
1650         uint16_t addr, val;
1651         int i;
1652
1653         /* Read power settings for 2GHz channels. */
1654         for (i = 0; i < 14; i += 2) {
1655                 addr = (sc->ntxchains == 3) ? RT3593_EEPROM_PWR2GHZ_BASE1 :
1656                     RT2860_EEPROM_PWR2GHZ_BASE1;
1657                 run_srom_read(sc, addr + i / 2, &val);
1658                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1659                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1660
1661                 addr = (sc->ntxchains == 3) ? RT3593_EEPROM_PWR2GHZ_BASE2 :
1662                     RT2860_EEPROM_PWR2GHZ_BASE2;
1663                 run_srom_read(sc, addr + i / 2, &val);
1664                 sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1665                 sc->txpow2[i + 1] = (int8_t)(val >> 8);
1666
1667                 if (sc->ntxchains == 3) {
1668                         run_srom_read(sc, RT3593_EEPROM_PWR2GHZ_BASE3 + i / 2,
1669                             &val);
1670                         sc->txpow3[i + 0] = (int8_t)(val & 0xff);
1671                         sc->txpow3[i + 1] = (int8_t)(val >> 8);
1672                 }
1673         }
1674         /* Fix broken Tx power entries. */
1675         for (i = 0; i < 14; i++) {
1676                 if (sc->txpow1[i] > 31)
1677                         sc->txpow1[i] = 5;
1678                 if (sc->txpow2[i] > 31)
1679                         sc->txpow2[i] = 5;
1680                 if (sc->ntxchains == 3) {
1681                         if (sc->txpow3[i] > 31)
1682                                 sc->txpow3[i] = 5;
1683                 }
1684         }
1685         /* Read power settings for 5GHz channels. */
1686         for (i = 0; i < 40; i += 2) {
1687                 run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1688                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1689                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1690
1691                 run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1692                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1693                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1694
1695                 if (sc->ntxchains == 3) {
1696                         run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE3 + i / 2,
1697                             &val);
1698                         sc->txpow3[i + 14] = (int8_t)(val & 0xff);
1699                         sc->txpow3[i + 15] = (int8_t)(val >> 8);
1700                 }
1701         }
1702 }
1703
1704 static void
1705 run_get_txpower(struct run_softc *sc)
1706 {
1707         uint16_t val;
1708         int i;
1709
1710         /* Read power settings for 2GHz channels. */
1711         for (i = 0; i < 14; i += 2) {
1712                 run_srom_read(sc, RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2, &val);
1713                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1714                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1715
1716                 if (sc->mac_ver != 0x5390) {
1717                         run_srom_read(sc,
1718                             RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2, &val);
1719                         sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1720                         sc->txpow2[i + 1] = (int8_t)(val >> 8);
1721                 }
1722         }
1723         /* Fix broken Tx power entries. */
1724         for (i = 0; i < 14; i++) {
1725                 if (sc->mac_ver >= 0x5390) {
1726                         if (sc->txpow1[i] < 0 || sc->txpow1[i] > 39)
1727                                 sc->txpow1[i] = 5;
1728                 } else {
1729                         if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
1730                                 sc->txpow1[i] = 5;
1731                 }
1732                 if (sc->mac_ver > 0x5390) {
1733                         if (sc->txpow2[i] < 0 || sc->txpow2[i] > 39)
1734                                 sc->txpow2[i] = 5;
1735                 } else if (sc->mac_ver < 0x5390) {
1736                         if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
1737                                 sc->txpow2[i] = 5;
1738                 }
1739                 RUN_DPRINTF(sc, RUN_DEBUG_TXPWR,
1740                     "chan %d: power1=%d, power2=%d\n",
1741                     rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]);
1742         }
1743         /* Read power settings for 5GHz channels. */
1744         for (i = 0; i < 40; i += 2) {
1745                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1746                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1747                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1748
1749                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1750                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1751                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1752         }
1753         /* Fix broken Tx power entries. */
1754         for (i = 0; i < 40; i++ ) {
1755                 if (sc->mac_ver != 0x5592) {
1756                         if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
1757                                 sc->txpow1[14 + i] = 5;
1758                         if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
1759                                 sc->txpow2[14 + i] = 5;
1760                 }
1761                 RUN_DPRINTF(sc, RUN_DEBUG_TXPWR,
1762                     "chan %d: power1=%d, power2=%d\n",
1763                     rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
1764                     sc->txpow2[14 + i]);
1765         }
1766 }
1767
1768 static int
1769 run_read_eeprom(struct run_softc *sc)
1770 {
1771         struct ieee80211com *ic = &sc->sc_ic;
1772         int8_t delta_2ghz, delta_5ghz;
1773         uint32_t tmp;
1774         uint16_t val;
1775         int ridx, ant, i;
1776
1777         /* check whether the ROM is eFUSE ROM or EEPROM */
1778         sc->sc_srom_read = run_eeprom_read_2;
1779         if (sc->mac_ver >= 0x3070) {
1780                 run_read(sc, RT3070_EFUSE_CTRL, &tmp);
1781                 RUN_DPRINTF(sc, RUN_DEBUG_ROM, "EFUSE_CTRL=0x%08x\n", tmp);
1782                 if ((tmp & RT3070_SEL_EFUSE) || sc->mac_ver == 0x3593)
1783                         sc->sc_srom_read = run_efuse_read_2;
1784         }
1785
1786         /* read ROM version */
1787         run_srom_read(sc, RT2860_EEPROM_VERSION, &val);
1788         RUN_DPRINTF(sc, RUN_DEBUG_ROM,
1789             "EEPROM rev=%d, FAE=%d\n", val >> 8, val & 0xff);
1790
1791         /* read MAC address */
1792         run_srom_read(sc, RT2860_EEPROM_MAC01, &val);
1793         ic->ic_macaddr[0] = val & 0xff;
1794         ic->ic_macaddr[1] = val >> 8;
1795         run_srom_read(sc, RT2860_EEPROM_MAC23, &val);
1796         ic->ic_macaddr[2] = val & 0xff;
1797         ic->ic_macaddr[3] = val >> 8;
1798         run_srom_read(sc, RT2860_EEPROM_MAC45, &val);
1799         ic->ic_macaddr[4] = val & 0xff;
1800         ic->ic_macaddr[5] = val >> 8;
1801
1802         if (sc->mac_ver < 0x3593) {
1803                 /* read vender BBP settings */
1804                 for (i = 0; i < 10; i++) {
1805                         run_srom_read(sc, RT2860_EEPROM_BBP_BASE + i, &val);
1806                         sc->bbp[i].val = val & 0xff;
1807                         sc->bbp[i].reg = val >> 8;
1808                         RUN_DPRINTF(sc, RUN_DEBUG_ROM,
1809                             "BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val);
1810                 }
1811                 if (sc->mac_ver >= 0x3071) {
1812                         /* read vendor RF settings */
1813                         for (i = 0; i < 10; i++) {
1814                                 run_srom_read(sc, RT3071_EEPROM_RF_BASE + i,
1815                                    &val);
1816                                 sc->rf[i].val = val & 0xff;
1817                                 sc->rf[i].reg = val >> 8;
1818                                 RUN_DPRINTF(sc, RUN_DEBUG_ROM, "RF%d=0x%02x\n",
1819                                     sc->rf[i].reg, sc->rf[i].val);
1820                         }
1821                 }
1822         }
1823
1824         /* read RF frequency offset from EEPROM */
1825         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_FREQ_LEDS :
1826             RT3593_EEPROM_FREQ, &val);
1827         sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
1828         RUN_DPRINTF(sc, RUN_DEBUG_ROM, "EEPROM freq offset %d\n",
1829             sc->freq & 0xff);
1830
1831         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_FREQ_LEDS :
1832             RT3593_EEPROM_FREQ_LEDS, &val);
1833         if (val >> 8 != 0xff) {
1834                 /* read LEDs operating mode */
1835                 sc->leds = val >> 8;
1836                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED1 :
1837                     RT3593_EEPROM_LED1, &sc->led[0]);
1838                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED2 :
1839                     RT3593_EEPROM_LED2, &sc->led[1]);
1840                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED3 :
1841                     RT3593_EEPROM_LED3, &sc->led[2]);
1842         } else {
1843                 /* broken EEPROM, use default settings */
1844                 sc->leds = 0x01;
1845                 sc->led[0] = 0x5555;
1846                 sc->led[1] = 0x2221;
1847                 sc->led[2] = 0x5627;    /* differs from RT2860 */
1848         }
1849         RUN_DPRINTF(sc, RUN_DEBUG_ROM,
1850             "EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
1851             sc->leds, sc->led[0], sc->led[1], sc->led[2]);
1852
1853         /* read RF information */
1854         if (sc->mac_ver == 0x5390 || sc->mac_ver ==0x5392)
1855                 run_srom_read(sc, 0x00, &val);
1856         else
1857                 run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1858
1859         if (val == 0xffff) {
1860                 device_printf(sc->sc_dev,
1861                     "invalid EEPROM antenna info, using default\n");
1862                 if (sc->mac_ver == 0x3572) {
1863                         /* default to RF3052 2T2R */
1864                         sc->rf_rev = RT3070_RF_3052;
1865                         sc->ntxchains = 2;
1866                         sc->nrxchains = 2;
1867                 } else if (sc->mac_ver >= 0x3070) {
1868                         /* default to RF3020 1T1R */
1869                         sc->rf_rev = RT3070_RF_3020;
1870                         sc->ntxchains = 1;
1871                         sc->nrxchains = 1;
1872                 } else {
1873                         /* default to RF2820 1T2R */
1874                         sc->rf_rev = RT2860_RF_2820;
1875                         sc->ntxchains = 1;
1876                         sc->nrxchains = 2;
1877                 }
1878         } else {
1879                 if (sc->mac_ver == 0x5390 || sc->mac_ver ==0x5392) {
1880                         sc->rf_rev = val;
1881                         run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1882                 } else
1883                         sc->rf_rev = (val >> 8) & 0xf;
1884                 sc->ntxchains = (val >> 4) & 0xf;
1885                 sc->nrxchains = val & 0xf;
1886         }
1887         RUN_DPRINTF(sc, RUN_DEBUG_ROM, "EEPROM RF rev=0x%04x chains=%dT%dR\n",
1888             sc->rf_rev, sc->ntxchains, sc->nrxchains);
1889
1890         /* check if RF supports automatic Tx access gain control */
1891         run_srom_read(sc, RT2860_EEPROM_CONFIG, &val);
1892         RUN_DPRINTF(sc, RUN_DEBUG_ROM, "EEPROM CFG 0x%04x\n", val);
1893         /* check if driver should patch the DAC issue */
1894         if ((val >> 8) != 0xff)
1895                 sc->patch_dac = (val >> 15) & 1;
1896         if ((val & 0xff) != 0xff) {
1897                 sc->ext_5ghz_lna = (val >> 3) & 1;
1898                 sc->ext_2ghz_lna = (val >> 2) & 1;
1899                 /* check if RF supports automatic Tx access gain control */
1900                 sc->calib_2ghz = sc->calib_5ghz = (val >> 1) & 1;
1901                 /* check if we have a hardware radio switch */
1902                 sc->rfswitch = val & 1;
1903         }
1904
1905         /* Read Tx power settings. */
1906         if (sc->mac_ver == 0x3593)
1907                 run_rt3593_get_txpower(sc);
1908         else
1909                 run_get_txpower(sc);
1910
1911         /* read Tx power compensation for each Tx rate */
1912         run_srom_read(sc, RT2860_EEPROM_DELTAPWR, &val);
1913         delta_2ghz = delta_5ghz = 0;
1914         if ((val & 0xff) != 0xff && (val & 0x80)) {
1915                 delta_2ghz = val & 0xf;
1916                 if (!(val & 0x40))      /* negative number */
1917                         delta_2ghz = -delta_2ghz;
1918         }
1919         val >>= 8;
1920         if ((val & 0xff) != 0xff && (val & 0x80)) {
1921                 delta_5ghz = val & 0xf;
1922                 if (!(val & 0x40))      /* negative number */
1923                         delta_5ghz = -delta_5ghz;
1924         }
1925         RUN_DPRINTF(sc, RUN_DEBUG_ROM | RUN_DEBUG_TXPWR,
1926             "power compensation=%d (2GHz), %d (5GHz)\n", delta_2ghz, delta_5ghz);
1927
1928         for (ridx = 0; ridx < 5; ridx++) {
1929                 uint32_t reg;
1930
1931                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2, &val);
1932                 reg = val;
1933                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1, &val);
1934                 reg |= (uint32_t)val << 16;
1935
1936                 sc->txpow20mhz[ridx] = reg;
1937                 sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
1938                 sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
1939
1940                 RUN_DPRINTF(sc, RUN_DEBUG_ROM | RUN_DEBUG_TXPWR,
1941                     "ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
1942                     "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
1943                     sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]);
1944         }
1945
1946         /* Read RSSI offsets and LNA gains from EEPROM. */
1947         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI1_2GHZ :
1948             RT3593_EEPROM_RSSI1_2GHZ, &val);
1949         sc->rssi_2ghz[0] = val & 0xff;  /* Ant A */
1950         sc->rssi_2ghz[1] = val >> 8;    /* Ant B */
1951         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI2_2GHZ :
1952             RT3593_EEPROM_RSSI2_2GHZ, &val);
1953         if (sc->mac_ver >= 0x3070) {
1954                 if (sc->mac_ver == 0x3593) {
1955                         sc->txmixgain_2ghz = 0;
1956                         sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1957                 } else {
1958                         /*
1959                          * On RT3070 chips (limited to 2 Rx chains), this ROM
1960                          * field contains the Tx mixer gain for the 2GHz band.
1961                          */
1962                         if ((val & 0xff) != 0xff)
1963                                 sc->txmixgain_2ghz = val & 0x7;
1964                 }
1965                 RUN_DPRINTF(sc, RUN_DEBUG_ROM, "tx mixer gain=%u (2GHz)\n",
1966                     sc->txmixgain_2ghz);
1967         } else
1968                 sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1969         if (sc->mac_ver == 0x3593)
1970                 run_srom_read(sc, RT3593_EEPROM_LNA_5GHZ, &val);
1971         sc->lna[2] = val >> 8;          /* channel group 2 */
1972
1973         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI1_5GHZ :
1974             RT3593_EEPROM_RSSI1_5GHZ, &val);
1975         sc->rssi_5ghz[0] = val & 0xff;  /* Ant A */
1976         sc->rssi_5ghz[1] = val >> 8;    /* Ant B */
1977         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI2_5GHZ :
1978             RT3593_EEPROM_RSSI2_5GHZ, &val);
1979         if (sc->mac_ver == 0x3572) {
1980                 /*
1981                  * On RT3572 chips (limited to 2 Rx chains), this ROM
1982                  * field contains the Tx mixer gain for the 5GHz band.
1983                  */
1984                 if ((val & 0xff) != 0xff)
1985                         sc->txmixgain_5ghz = val & 0x7;
1986                 RUN_DPRINTF(sc, RUN_DEBUG_ROM, "tx mixer gain=%u (5GHz)\n",
1987                     sc->txmixgain_5ghz);
1988         } else
1989                 sc->rssi_5ghz[2] = val & 0xff;  /* Ant C */
1990         if (sc->mac_ver == 0x3593) {
1991                 sc->txmixgain_5ghz = 0;
1992                 run_srom_read(sc, RT3593_EEPROM_LNA_5GHZ, &val);
1993         }
1994         sc->lna[3] = val >> 8;          /* channel group 3 */
1995
1996         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LNA :
1997             RT3593_EEPROM_LNA, &val);
1998         sc->lna[0] = val & 0xff;        /* channel group 0 */
1999         sc->lna[1] = val >> 8;          /* channel group 1 */
2000
2001         /* fix broken 5GHz LNA entries */
2002         if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
2003                 RUN_DPRINTF(sc, RUN_DEBUG_ROM,
2004                     "invalid LNA for channel group %d\n", 2);
2005                 sc->lna[2] = sc->lna[1];
2006         }
2007         if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
2008                 RUN_DPRINTF(sc, RUN_DEBUG_ROM,
2009                     "invalid LNA for channel group %d\n", 3);
2010                 sc->lna[3] = sc->lna[1];
2011         }
2012
2013         /* fix broken RSSI offset entries */
2014         for (ant = 0; ant < 3; ant++) {
2015                 if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
2016                         RUN_DPRINTF(sc, RUN_DEBUG_ROM | RUN_DEBUG_RSSI,
2017                             "invalid RSSI%d offset: %d (2GHz)\n",
2018                             ant + 1, sc->rssi_2ghz[ant]);
2019                         sc->rssi_2ghz[ant] = 0;
2020                 }
2021                 if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
2022                         RUN_DPRINTF(sc, RUN_DEBUG_ROM | RUN_DEBUG_RSSI,
2023                             "invalid RSSI%d offset: %d (5GHz)\n",
2024                             ant + 1, sc->rssi_5ghz[ant]);
2025                         sc->rssi_5ghz[ant] = 0;
2026                 }
2027         }
2028         return (0);
2029 }
2030
2031 static struct ieee80211_node *
2032 run_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
2033 {
2034         return malloc(sizeof (struct run_node), M_80211_NODE,
2035             M_NOWAIT | M_ZERO);
2036 }
2037
2038 static int
2039 run_media_change(struct ifnet *ifp)
2040 {
2041         struct ieee80211vap *vap = ifp->if_softc;
2042         struct ieee80211com *ic = vap->iv_ic;
2043         const struct ieee80211_txparam *tp;
2044         struct run_softc *sc = ic->ic_softc;
2045         uint8_t rate, ridx;
2046         int error;
2047
2048         RUN_LOCK(sc);
2049
2050         error = ieee80211_media_change(ifp);
2051         if (error != ENETRESET) {
2052                 RUN_UNLOCK(sc);
2053                 return (error);
2054         }
2055
2056         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2057         if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
2058                 struct ieee80211_node *ni;
2059                 struct run_node *rn;
2060
2061                 rate = ic->ic_sup_rates[ic->ic_curmode].
2062                     rs_rates[tp->ucastrate] & IEEE80211_RATE_VAL;
2063                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2064                         if (rt2860_rates[ridx].rate == rate)
2065                                 break;
2066                 ni = ieee80211_ref_node(vap->iv_bss);
2067                 rn = RUN_NODE(ni);
2068                 rn->fix_ridx = ridx;
2069                 RUN_DPRINTF(sc, RUN_DEBUG_RATE, "rate=%d, fix_ridx=%d\n",
2070                     rate, rn->fix_ridx);
2071                 ieee80211_free_node(ni);
2072         }
2073
2074 #if 0
2075         if ((ifp->if_flags & IFF_UP) &&
2076             (ifp->if_drv_flags &  RUN_RUNNING)){
2077                 run_init_locked(sc);
2078         }
2079 #endif
2080
2081         RUN_UNLOCK(sc);
2082
2083         return (0);
2084 }
2085
2086 static int
2087 run_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2088 {
2089         const struct ieee80211_txparam *tp;
2090         struct ieee80211com *ic = vap->iv_ic;
2091         struct run_softc *sc = ic->ic_softc;
2092         struct run_vap *rvp = RUN_VAP(vap);
2093         enum ieee80211_state ostate;
2094         uint32_t sta[3];
2095         uint8_t ratectl;
2096         uint8_t restart_ratectl = 0;
2097         uint8_t bid = 1 << rvp->rvp_id;
2098
2099         ostate = vap->iv_state;
2100         RUN_DPRINTF(sc, RUN_DEBUG_STATE, "%s -> %s\n",
2101                 ieee80211_state_name[ostate],
2102                 ieee80211_state_name[nstate]);
2103
2104         IEEE80211_UNLOCK(ic);
2105         RUN_LOCK(sc);
2106
2107         ratectl = sc->ratectl_run; /* remember current state */
2108         sc->ratectl_run = RUN_RATECTL_OFF;
2109         usb_callout_stop(&sc->ratectl_ch);
2110
2111         if (ostate == IEEE80211_S_RUN) {
2112                 /* turn link LED off */
2113                 run_set_leds(sc, RT2860_LED_RADIO);
2114         }
2115
2116         switch (nstate) {
2117         case IEEE80211_S_INIT:
2118                 restart_ratectl = 1;
2119
2120                 if (ostate != IEEE80211_S_RUN)
2121                         break;
2122
2123                 ratectl &= ~bid;
2124                 sc->runbmap &= ~bid;
2125
2126                 /* abort TSF synchronization if there is no vap running */
2127                 if (--sc->running == 0)
2128                         run_disable_tsf(sc);
2129                 break;
2130
2131         case IEEE80211_S_RUN:
2132                 if (!(sc->runbmap & bid)) {
2133                         if(sc->running++)
2134                                 restart_ratectl = 1;
2135                         sc->runbmap |= bid;
2136                 }
2137
2138                 m_freem(rvp->beacon_mbuf);
2139                 rvp->beacon_mbuf = NULL;
2140
2141                 switch (vap->iv_opmode) {
2142                 case IEEE80211_M_HOSTAP:
2143                 case IEEE80211_M_MBSS:
2144                         sc->ap_running |= bid;
2145                         ic->ic_opmode = vap->iv_opmode;
2146                         run_update_beacon_cb(vap);
2147                         break;
2148                 case IEEE80211_M_IBSS:
2149                         sc->adhoc_running |= bid;
2150                         if (!sc->ap_running)
2151                                 ic->ic_opmode = vap->iv_opmode;
2152                         run_update_beacon_cb(vap);
2153                         break;
2154                 case IEEE80211_M_STA:
2155                         sc->sta_running |= bid;
2156                         if (!sc->ap_running && !sc->adhoc_running)
2157                                 ic->ic_opmode = vap->iv_opmode;
2158
2159                         /* read statistic counters (clear on read) */
2160                         run_read_region_1(sc, RT2860_TX_STA_CNT0,
2161                             (uint8_t *)sta, sizeof sta);
2162
2163                         break;
2164                 default:
2165                         ic->ic_opmode = vap->iv_opmode;
2166                         break;
2167                 }
2168
2169                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
2170                         struct ieee80211_node *ni;
2171
2172                         if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) {
2173                                 RUN_UNLOCK(sc);
2174                                 IEEE80211_LOCK(ic);
2175                                 return (-1);
2176                         }
2177                         run_updateslot(ic);
2178                         run_enable_mrr(sc);
2179                         run_set_txpreamble(sc);
2180                         run_set_basicrates(sc);
2181                         ni = ieee80211_ref_node(vap->iv_bss);
2182                         IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
2183                         run_set_bssid(sc, sc->sc_bssid);
2184                         ieee80211_free_node(ni);
2185                         run_enable_tsf_sync(sc);
2186
2187                         /* enable automatic rate adaptation */
2188                         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2189                         if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
2190                                 ratectl |= bid;
2191                 } else
2192                         run_enable_tsf(sc);
2193
2194                 /* turn link LED on */
2195                 run_set_leds(sc, RT2860_LED_RADIO |
2196                     (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan) ?
2197                      RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
2198
2199                 break;
2200         default:
2201                 RUN_DPRINTF(sc, RUN_DEBUG_STATE, "undefined state\n");
2202                 break;
2203         }
2204
2205         /* restart amrr for running VAPs */
2206         if ((sc->ratectl_run = ratectl) && restart_ratectl)
2207                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2208
2209         RUN_UNLOCK(sc);
2210         IEEE80211_LOCK(ic);
2211
2212         return(rvp->newstate(vap, nstate, arg));
2213 }
2214
2215 static int
2216 run_wme_update(struct ieee80211com *ic)
2217 {
2218         struct chanAccParams chp;
2219         struct run_softc *sc = ic->ic_softc;
2220         const struct wmeParams *ac;
2221         int aci, error = 0;
2222
2223         ieee80211_wme_ic_getparams(ic, &chp);
2224         ac = chp.cap_wmeParams;
2225
2226         /* update MAC TX configuration registers */
2227         RUN_LOCK(sc);
2228         for (aci = 0; aci < WME_NUM_AC; aci++) {
2229                 error = run_write(sc, RT2860_EDCA_AC_CFG(aci),
2230                     ac[aci].wmep_logcwmax << 16 |
2231                     ac[aci].wmep_logcwmin << 12 |
2232                     ac[aci].wmep_aifsn    <<  8 |
2233                     ac[aci].wmep_txopLimit);
2234                 if (error) goto err;
2235         }
2236
2237         /* update SCH/DMA registers too */
2238         error = run_write(sc, RT2860_WMM_AIFSN_CFG,
2239             ac[WME_AC_VO].wmep_aifsn  << 12 |
2240             ac[WME_AC_VI].wmep_aifsn  <<  8 |
2241             ac[WME_AC_BK].wmep_aifsn  <<  4 |
2242             ac[WME_AC_BE].wmep_aifsn);
2243         if (error) goto err;
2244         error = run_write(sc, RT2860_WMM_CWMIN_CFG,
2245             ac[WME_AC_VO].wmep_logcwmin << 12 |
2246             ac[WME_AC_VI].wmep_logcwmin <<  8 |
2247             ac[WME_AC_BK].wmep_logcwmin <<  4 |
2248             ac[WME_AC_BE].wmep_logcwmin);
2249         if (error) goto err;
2250         error = run_write(sc, RT2860_WMM_CWMAX_CFG,
2251             ac[WME_AC_VO].wmep_logcwmax << 12 |
2252             ac[WME_AC_VI].wmep_logcwmax <<  8 |
2253             ac[WME_AC_BK].wmep_logcwmax <<  4 |
2254             ac[WME_AC_BE].wmep_logcwmax);
2255         if (error) goto err;
2256         error = run_write(sc, RT2860_WMM_TXOP0_CFG,
2257             ac[WME_AC_BK].wmep_txopLimit << 16 |
2258             ac[WME_AC_BE].wmep_txopLimit);
2259         if (error) goto err;
2260         error = run_write(sc, RT2860_WMM_TXOP1_CFG,
2261             ac[WME_AC_VO].wmep_txopLimit << 16 |
2262             ac[WME_AC_VI].wmep_txopLimit);
2263
2264 err:
2265         RUN_UNLOCK(sc);
2266         if (error)
2267                 RUN_DPRINTF(sc, RUN_DEBUG_USB, "WME update failed\n");
2268
2269         return (error);
2270 }
2271
2272 static void
2273 run_key_set_cb(void *arg)
2274 {
2275         struct run_cmdq *cmdq = arg;
2276         struct ieee80211vap *vap = cmdq->arg1;
2277         struct ieee80211_key *k = cmdq->k;
2278         struct ieee80211com *ic = vap->iv_ic;
2279         struct run_softc *sc = ic->ic_softc;
2280         struct ieee80211_node *ni;
2281         u_int cipher = k->wk_cipher->ic_cipher;
2282         uint32_t attr;
2283         uint16_t base, associd;
2284         uint8_t mode, wcid, iv[8];
2285
2286         RUN_LOCK_ASSERT(sc, MA_OWNED);
2287
2288         if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2289                 ni = ieee80211_find_vap_node(&ic->ic_sta, vap, cmdq->mac);
2290         else
2291                 ni = vap->iv_bss;
2292         associd = (ni != NULL) ? ni->ni_associd : 0;
2293
2294         /* map net80211 cipher to RT2860 security mode */
2295         switch (cipher) {
2296         case IEEE80211_CIPHER_WEP:
2297                 if(k->wk_keylen < 8)
2298                         mode = RT2860_MODE_WEP40;
2299                 else
2300                         mode = RT2860_MODE_WEP104;
2301                 break;
2302         case IEEE80211_CIPHER_TKIP:
2303                 mode = RT2860_MODE_TKIP;
2304                 break;
2305         case IEEE80211_CIPHER_AES_CCM:
2306                 mode = RT2860_MODE_AES_CCMP;
2307                 break;
2308         default:
2309                 RUN_DPRINTF(sc, RUN_DEBUG_KEY, "undefined case\n");
2310                 return;
2311         }
2312
2313         RUN_DPRINTF(sc, RUN_DEBUG_KEY,
2314             "associd=%x, keyix=%d, mode=%x, type=%s, tx=%s, rx=%s\n",
2315             associd, k->wk_keyix, mode,
2316             (k->wk_flags & IEEE80211_KEY_GROUP) ? "group" : "pairwise",
2317             (k->wk_flags & IEEE80211_KEY_XMIT) ? "on" : "off",
2318             (k->wk_flags & IEEE80211_KEY_RECV) ? "on" : "off");
2319
2320         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2321                 wcid = 0;       /* NB: update WCID0 for group keys */
2322                 base = RT2860_SKEY(RUN_VAP(vap)->rvp_id, k->wk_keyix);
2323         } else {
2324                 wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
2325                     1 : RUN_AID2WCID(associd);
2326                 base = RT2860_PKEY(wcid);
2327         }
2328
2329         if (cipher == IEEE80211_CIPHER_TKIP) {
2330                 if(run_write_region_1(sc, base, k->wk_key, 16))
2331                         return;
2332                 if(run_write_region_1(sc, base + 16, &k->wk_key[16], 8))        /* wk_txmic */
2333                         return;
2334                 if(run_write_region_1(sc, base + 24, &k->wk_key[24], 8))        /* wk_rxmic */
2335                         return;
2336         } else {
2337                 /* roundup len to 16-bit: XXX fix write_region_1() instead */
2338                 if(run_write_region_1(sc, base, k->wk_key, (k->wk_keylen + 1) & ~1))
2339                         return;
2340         }
2341
2342         if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
2343             (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))) {
2344                 /* set initial packet number in IV+EIV */
2345                 if (cipher == IEEE80211_CIPHER_WEP) {
2346                         memset(iv, 0, sizeof iv);
2347                         iv[3] = vap->iv_def_txkey << 6;
2348                 } else {
2349                         if (cipher == IEEE80211_CIPHER_TKIP) {
2350                                 iv[0] = k->wk_keytsc >> 8;
2351                                 iv[1] = (iv[0] | 0x20) & 0x7f;
2352                                 iv[2] = k->wk_keytsc;
2353                         } else /* CCMP */ {
2354                                 iv[0] = k->wk_keytsc;
2355                                 iv[1] = k->wk_keytsc >> 8;
2356                                 iv[2] = 0;
2357                         }
2358                         iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
2359                         iv[4] = k->wk_keytsc >> 16;
2360                         iv[5] = k->wk_keytsc >> 24;
2361                         iv[6] = k->wk_keytsc >> 32;
2362                         iv[7] = k->wk_keytsc >> 40;
2363                 }
2364                 if (run_write_region_1(sc, RT2860_IVEIV(wcid), iv, 8))
2365                         return;
2366         }
2367
2368         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2369                 /* install group key */
2370                 if (run_read(sc, RT2860_SKEY_MODE_0_7, &attr))
2371                         return;
2372                 attr &= ~(0xf << (k->wk_keyix * 4));
2373                 attr |= mode << (k->wk_keyix * 4);
2374                 if (run_write(sc, RT2860_SKEY_MODE_0_7, attr))
2375                         return;
2376         } else {
2377                 /* install pairwise key */
2378                 if (run_read(sc, RT2860_WCID_ATTR(wcid), &attr))
2379                         return;
2380                 attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
2381                 if (run_write(sc, RT2860_WCID_ATTR(wcid), attr))
2382                         return;
2383         }
2384
2385         /* TODO create a pass-thru key entry? */
2386
2387         /* need wcid to delete the right key later */
2388         k->wk_pad = wcid;
2389 }
2390
2391 /*
2392  * Don't have to be deferred, but in order to keep order of
2393  * execution, i.e. with run_key_delete(), defer this and let
2394  * run_cmdq_cb() maintain the order.
2395  *
2396  * return 0 on error
2397  */
2398 static int
2399 run_key_set(struct ieee80211vap *vap, struct ieee80211_key *k)
2400 {
2401         struct ieee80211com *ic = vap->iv_ic;
2402         struct run_softc *sc = ic->ic_softc;
2403         uint32_t i;
2404
2405         i = RUN_CMDQ_GET(&sc->cmdq_store);
2406         RUN_DPRINTF(sc, RUN_DEBUG_KEY, "cmdq_store=%d\n", i);
2407         sc->cmdq[i].func = run_key_set_cb;
2408         sc->cmdq[i].arg0 = NULL;
2409         sc->cmdq[i].arg1 = vap;
2410         sc->cmdq[i].k = k;
2411         IEEE80211_ADDR_COPY(sc->cmdq[i].mac, k->wk_macaddr);
2412         ieee80211_runtask(ic, &sc->cmdq_task);
2413
2414         /*
2415          * To make sure key will be set when hostapd
2416          * calls iv_key_set() before if_init().
2417          */
2418         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
2419                 RUN_LOCK(sc);
2420                 sc->cmdq_key_set = RUN_CMDQ_GO;
2421                 RUN_UNLOCK(sc);
2422         }
2423
2424         return (1);
2425 }
2426
2427 /*
2428  * If wlan is destroyed without being brought down i.e. without
2429  * wlan down or wpa_cli terminate, this function is called after
2430  * vap is gone. Don't refer it.
2431  */
2432 static void
2433 run_key_delete_cb(void *arg)
2434 {
2435         struct run_cmdq *cmdq = arg;
2436         struct run_softc *sc = cmdq->arg1;
2437         struct ieee80211_key *k = &cmdq->key;
2438         uint32_t attr;
2439         uint8_t wcid;
2440
2441         RUN_LOCK_ASSERT(sc, MA_OWNED);
2442
2443         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2444                 /* remove group key */
2445                 RUN_DPRINTF(sc, RUN_DEBUG_KEY, "removing group key\n");
2446                 run_read(sc, RT2860_SKEY_MODE_0_7, &attr);
2447                 attr &= ~(0xf << (k->wk_keyix * 4));
2448                 run_write(sc, RT2860_SKEY_MODE_0_7, attr);
2449         } else {
2450                 /* remove pairwise key */
2451                 RUN_DPRINTF(sc, RUN_DEBUG_KEY,
2452                     "removing key for wcid %x\n", k->wk_pad);
2453                 /* matching wcid was written to wk_pad in run_key_set() */
2454                 wcid = k->wk_pad;
2455                 run_read(sc, RT2860_WCID_ATTR(wcid), &attr);
2456                 attr &= ~0xf;
2457                 run_write(sc, RT2860_WCID_ATTR(wcid), attr);
2458                 run_set_region_4(sc, RT2860_WCID_ENTRY(wcid), 0, 8);
2459         }
2460
2461         k->wk_pad = 0;
2462 }
2463
2464 /*
2465  * return 0 on error
2466  */
2467 static int
2468 run_key_delete(struct ieee80211vap *vap, struct ieee80211_key *k)
2469 {
2470         struct ieee80211com *ic = vap->iv_ic;
2471         struct run_softc *sc = ic->ic_softc;
2472         struct ieee80211_key *k0;
2473         uint32_t i;
2474
2475         /*
2476          * When called back, key might be gone. So, make a copy
2477          * of some values need to delete keys before deferring.
2478          * But, because of LOR with node lock, cannot use lock here.
2479          * So, use atomic instead.
2480          */
2481         i = RUN_CMDQ_GET(&sc->cmdq_store);
2482         RUN_DPRINTF(sc, RUN_DEBUG_KEY, "cmdq_store=%d\n", i);
2483         sc->cmdq[i].func = run_key_delete_cb;
2484         sc->cmdq[i].arg0 = NULL;
2485         sc->cmdq[i].arg1 = sc;
2486         k0 = &sc->cmdq[i].key;
2487         k0->wk_flags = k->wk_flags;
2488         k0->wk_keyix = k->wk_keyix;
2489         /* matching wcid was written to wk_pad in run_key_set() */
2490         k0->wk_pad = k->wk_pad;
2491         ieee80211_runtask(ic, &sc->cmdq_task);
2492         return (1);     /* return fake success */
2493
2494 }
2495
2496 static void
2497 run_ratectl_to(void *arg)
2498 {
2499         struct run_softc *sc = arg;
2500
2501         /* do it in a process context, so it can go sleep */
2502         ieee80211_runtask(&sc->sc_ic, &sc->ratectl_task);
2503         /* next timeout will be rescheduled in the callback task */
2504 }
2505
2506 /* ARGSUSED */
2507 static void
2508 run_ratectl_cb(void *arg, int pending)
2509 {
2510         struct run_softc *sc = arg;
2511         struct ieee80211com *ic = &sc->sc_ic;
2512         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2513
2514         if (vap == NULL)
2515                 return;
2516
2517         if (sc->rvp_cnt > 1 || vap->iv_opmode != IEEE80211_M_STA) {
2518                 /*
2519                  * run_reset_livelock() doesn't do anything with AMRR,
2520                  * but Ralink wants us to call it every 1 sec. So, we
2521                  * piggyback here rather than creating another callout.
2522                  * Livelock may occur only in HOSTAP or IBSS mode
2523                  * (when h/w is sending beacons).
2524                  */
2525                 RUN_LOCK(sc);
2526                 run_reset_livelock(sc);
2527                 /* just in case, there are some stats to drain */
2528                 run_drain_fifo(sc);
2529                 RUN_UNLOCK(sc);
2530         }
2531
2532         ieee80211_iterate_nodes(&ic->ic_sta, run_iter_func, sc);
2533
2534         RUN_LOCK(sc);
2535         if(sc->ratectl_run != RUN_RATECTL_OFF)
2536                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2537         RUN_UNLOCK(sc);
2538 }
2539
2540 static void
2541 run_drain_fifo(void *arg)
2542 {
2543         struct run_softc *sc = arg;
2544         uint32_t stat;
2545         uint16_t (*wstat)[3];
2546         uint8_t wcid, mcs, pid;
2547         int8_t retry;
2548
2549         RUN_LOCK_ASSERT(sc, MA_OWNED);
2550
2551         for (;;) {
2552                 /* drain Tx status FIFO (maxsize = 16) */
2553                 run_read(sc, RT2860_TX_STAT_FIFO, &stat);
2554                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "tx stat 0x%08x\n", stat);
2555                 if (!(stat & RT2860_TXQ_VLD))
2556                         break;
2557
2558                 wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
2559
2560                 /* if no ACK was requested, no feedback is available */
2561                 if (!(stat & RT2860_TXQ_ACKREQ) || wcid > RT2870_WCID_MAX ||
2562                     wcid == 0)
2563                         continue;
2564
2565                 /*
2566                  * Even though each stat is Tx-complete-status like format,
2567                  * the device can poll stats. Because there is no guarantee
2568                  * that the referring node is still around when read the stats.
2569                  * So that, if we use ieee80211_ratectl_tx_update(), we will
2570                  * have hard time not to refer already freed node.
2571                  *
2572                  * To eliminate such page faults, we poll stats in softc.
2573                  * Then, update the rates later with ieee80211_ratectl_tx_update().
2574                  */
2575                 wstat = &(sc->wcid_stats[wcid]);
2576                 (*wstat)[RUN_TXCNT]++;
2577                 if (stat & RT2860_TXQ_OK)
2578                         (*wstat)[RUN_SUCCESS]++;
2579                 else
2580                         counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2581                 /*
2582                  * Check if there were retries, ie if the Tx success rate is
2583                  * different from the requested rate. Note that it works only
2584                  * because we do not allow rate fallback from OFDM to CCK.
2585                  */
2586                 mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
2587                 pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
2588                 if ((retry = pid -1 - mcs) > 0) {
2589                         (*wstat)[RUN_TXCNT] += retry;
2590                         (*wstat)[RUN_RETRY] += retry;
2591                 }
2592         }
2593         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "count=%d\n", sc->fifo_cnt);
2594
2595         sc->fifo_cnt = 0;
2596 }
2597
2598 static void
2599 run_iter_func(void *arg, struct ieee80211_node *ni)
2600 {
2601         struct run_softc *sc = arg;
2602         struct ieee80211_ratectl_tx_stats *txs = &sc->sc_txs;
2603         struct ieee80211vap *vap = ni->ni_vap;
2604         struct run_node *rn = RUN_NODE(ni);
2605         union run_stats sta[2];
2606         uint16_t (*wstat)[3];
2607         int error;
2608
2609         RUN_LOCK(sc);
2610
2611         /* Check for special case */
2612         if (sc->rvp_cnt <= 1 && vap->iv_opmode == IEEE80211_M_STA &&
2613             ni != vap->iv_bss)
2614                 goto fail;
2615
2616         txs->flags = IEEE80211_RATECTL_TX_STATS_NODE |
2617                      IEEE80211_RATECTL_TX_STATS_RETRIES;
2618         txs->ni = ni;
2619         if (sc->rvp_cnt <= 1 && (vap->iv_opmode == IEEE80211_M_IBSS ||
2620             vap->iv_opmode == IEEE80211_M_STA)) {
2621                 /* read statistic counters (clear on read) and update AMRR state */
2622                 error = run_read_region_1(sc, RT2860_TX_STA_CNT0, (uint8_t *)sta,
2623                     sizeof sta);
2624                 if (error != 0)
2625                         goto fail;
2626
2627                 /* count failed TX as errors */
2628                 if_inc_counter(vap->iv_ifp, IFCOUNTER_OERRORS,
2629                     le16toh(sta[0].error.fail));
2630
2631                 txs->nretries = le16toh(sta[1].tx.retry);
2632                 txs->nsuccess = le16toh(sta[1].tx.success);
2633                 /* nretries??? */
2634                 txs->nframes = txs->nretries + txs->nsuccess +
2635                     le16toh(sta[0].error.fail);
2636
2637                 RUN_DPRINTF(sc, RUN_DEBUG_RATE,
2638                     "retrycnt=%d success=%d failcnt=%d\n",
2639                     txs->nretries, txs->nsuccess, le16toh(sta[0].error.fail));
2640         } else {
2641                 wstat = &(sc->wcid_stats[RUN_AID2WCID(ni->ni_associd)]);
2642
2643                 if (wstat == &(sc->wcid_stats[0]) ||
2644                     wstat > &(sc->wcid_stats[RT2870_WCID_MAX]))
2645                         goto fail;
2646
2647                 txs->nretries = (*wstat)[RUN_RETRY];
2648                 txs->nsuccess = (*wstat)[RUN_SUCCESS];
2649                 txs->nframes = (*wstat)[RUN_TXCNT];
2650                 RUN_DPRINTF(sc, RUN_DEBUG_RATE,
2651                     "retrycnt=%d txcnt=%d success=%d\n",
2652                     txs->nretries, txs->nframes, txs->nsuccess);
2653
2654                 memset(wstat, 0, sizeof(*wstat));
2655         }
2656
2657         ieee80211_ratectl_tx_update(vap, txs);
2658         rn->amrr_ridx = ieee80211_ratectl_rate(ni, NULL, 0);
2659
2660 fail:
2661         RUN_UNLOCK(sc);
2662
2663         RUN_DPRINTF(sc, RUN_DEBUG_RATE, "ridx=%d\n", rn->amrr_ridx);
2664 }
2665
2666 static void
2667 run_newassoc_cb(void *arg)
2668 {
2669         struct run_cmdq *cmdq = arg;
2670         struct ieee80211_node *ni = cmdq->arg1;
2671         struct run_softc *sc = ni->ni_vap->iv_ic->ic_softc;
2672         uint8_t wcid = cmdq->wcid;
2673
2674         RUN_LOCK_ASSERT(sc, MA_OWNED);
2675
2676         run_write_region_1(sc, RT2860_WCID_ENTRY(wcid),
2677             ni->ni_macaddr, IEEE80211_ADDR_LEN);
2678
2679         memset(&(sc->wcid_stats[wcid]), 0, sizeof(sc->wcid_stats[wcid]));
2680 }
2681
2682 static void
2683 run_newassoc(struct ieee80211_node *ni, int isnew)
2684 {
2685         struct run_node *rn = RUN_NODE(ni);
2686         struct ieee80211_rateset *rs = &ni->ni_rates;
2687         struct ieee80211vap *vap = ni->ni_vap;
2688         struct ieee80211com *ic = vap->iv_ic;
2689         struct run_softc *sc = ic->ic_softc;
2690         uint8_t rate;
2691         uint8_t ridx;
2692         uint8_t wcid;
2693         int i, j;
2694
2695         wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
2696             1 : RUN_AID2WCID(ni->ni_associd);
2697
2698         if (wcid > RT2870_WCID_MAX) {
2699                 device_printf(sc->sc_dev, "wcid=%d out of range\n", wcid);
2700                 return;
2701         }
2702
2703         /* only interested in true associations */
2704         if (isnew && ni->ni_associd != 0) {
2705
2706                 /*
2707                  * This function could is called though timeout function.
2708                  * Need to defer.
2709                  */
2710                 uint32_t cnt = RUN_CMDQ_GET(&sc->cmdq_store);
2711                 RUN_DPRINTF(sc, RUN_DEBUG_STATE, "cmdq_store=%d\n", cnt);
2712                 sc->cmdq[cnt].func = run_newassoc_cb;
2713                 sc->cmdq[cnt].arg0 = NULL;
2714                 sc->cmdq[cnt].arg1 = ni;
2715                 sc->cmdq[cnt].wcid = wcid;
2716                 ieee80211_runtask(ic, &sc->cmdq_task);
2717         }
2718
2719         RUN_DPRINTF(sc, RUN_DEBUG_STATE,
2720             "new assoc isnew=%d associd=%x addr=%s\n",
2721             isnew, ni->ni_associd, ether_sprintf(ni->ni_macaddr));
2722
2723         for (i = 0; i < rs->rs_nrates; i++) {
2724                 rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
2725                 /* convert 802.11 rate to hardware rate index */
2726                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2727                         if (rt2860_rates[ridx].rate == rate)
2728                                 break;
2729                 rn->ridx[i] = ridx;
2730                 /* determine rate of control response frames */
2731                 for (j = i; j >= 0; j--) {
2732                         if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
2733                             rt2860_rates[rn->ridx[i]].phy ==
2734                             rt2860_rates[rn->ridx[j]].phy)
2735                                 break;
2736                 }
2737                 if (j >= 0) {
2738                         rn->ctl_ridx[i] = rn->ridx[j];
2739                 } else {
2740                         /* no basic rate found, use mandatory one */
2741                         rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
2742                 }
2743                 RUN_DPRINTF(sc, RUN_DEBUG_STATE | RUN_DEBUG_RATE,
2744                     "rate=0x%02x ridx=%d ctl_ridx=%d\n",
2745                     rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]);
2746         }
2747         rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
2748         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2749                 if (rt2860_rates[ridx].rate == rate)
2750                         break;
2751         rn->mgt_ridx = ridx;
2752         RUN_DPRINTF(sc, RUN_DEBUG_STATE | RUN_DEBUG_RATE,
2753             "rate=%d, mgmt_ridx=%d\n", rate, rn->mgt_ridx);
2754
2755         RUN_LOCK(sc);
2756         if(sc->ratectl_run != RUN_RATECTL_OFF)
2757                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2758         RUN_UNLOCK(sc);
2759 }
2760
2761 /*
2762  * Return the Rx chain with the highest RSSI for a given frame.
2763  */
2764 static __inline uint8_t
2765 run_maxrssi_chain(struct run_softc *sc, const struct rt2860_rxwi *rxwi)
2766 {
2767         uint8_t rxchain = 0;
2768
2769         if (sc->nrxchains > 1) {
2770                 if (rxwi->rssi[1] > rxwi->rssi[rxchain])
2771                         rxchain = 1;
2772                 if (sc->nrxchains > 2)
2773                         if (rxwi->rssi[2] > rxwi->rssi[rxchain])
2774                                 rxchain = 2;
2775         }
2776         return (rxchain);
2777 }
2778
2779 static void
2780 run_recv_mgmt(struct ieee80211_node *ni, struct mbuf *m, int subtype,
2781     const struct ieee80211_rx_stats *rxs, int rssi, int nf)
2782 {
2783         struct ieee80211vap *vap = ni->ni_vap;
2784         struct run_softc *sc = vap->iv_ic->ic_softc;
2785         struct run_vap *rvp = RUN_VAP(vap);
2786         uint64_t ni_tstamp, rx_tstamp;
2787
2788         rvp->recv_mgmt(ni, m, subtype, rxs, rssi, nf);
2789
2790         if (vap->iv_state == IEEE80211_S_RUN &&
2791             (subtype == IEEE80211_FC0_SUBTYPE_BEACON ||
2792             subtype == IEEE80211_FC0_SUBTYPE_PROBE_RESP)) {
2793                 ni_tstamp = le64toh(ni->ni_tstamp.tsf);
2794                 RUN_LOCK(sc);
2795                 run_get_tsf(sc, &rx_tstamp);
2796                 RUN_UNLOCK(sc);
2797                 rx_tstamp = le64toh(rx_tstamp);
2798
2799                 if (ni_tstamp >= rx_tstamp) {
2800                         RUN_DPRINTF(sc, RUN_DEBUG_RECV | RUN_DEBUG_BEACON,
2801                             "ibss merge, tsf %ju tstamp %ju\n",
2802                             (uintmax_t)rx_tstamp, (uintmax_t)ni_tstamp);
2803                         (void) ieee80211_ibss_merge(ni);
2804                 }
2805         }
2806 }
2807
2808 static void
2809 run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen)
2810 {
2811         struct ieee80211com *ic = &sc->sc_ic;
2812         struct ieee80211_frame *wh;
2813         struct ieee80211_node *ni;
2814         struct rt2870_rxd *rxd;
2815         struct rt2860_rxwi *rxwi;
2816         uint32_t flags;
2817         uint16_t len, rxwisize;
2818         uint8_t ant, rssi;
2819         int8_t nf;
2820
2821         rxwisize = sizeof(struct rt2860_rxwi);
2822         if (sc->mac_ver == 0x5592)
2823                 rxwisize += sizeof(uint64_t);
2824         else if (sc->mac_ver == 0x3593)
2825                 rxwisize += sizeof(uint32_t);
2826
2827         if (__predict_false(dmalen <
2828             rxwisize + sizeof(struct ieee80211_frame_ack))) {
2829                 RUN_DPRINTF(sc, RUN_DEBUG_RECV,
2830                     "payload is too short: dma length %u < %zu\n",
2831                     dmalen, rxwisize + sizeof(struct ieee80211_frame_ack));
2832                 goto fail;
2833         }
2834
2835         rxwi = mtod(m, struct rt2860_rxwi *);
2836         len = le16toh(rxwi->len) & 0xfff;
2837
2838         if (__predict_false(len > dmalen - rxwisize)) {
2839                 RUN_DPRINTF(sc, RUN_DEBUG_RECV,
2840                     "bad RXWI length %u > %u\n", len, dmalen);
2841                 goto fail;
2842         }
2843
2844         /* Rx descriptor is located at the end */
2845         rxd = (struct rt2870_rxd *)(mtod(m, caddr_t) + dmalen);
2846         flags = le32toh(rxd->flags);
2847
2848         if (__predict_false(flags & (RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
2849                 RUN_DPRINTF(sc, RUN_DEBUG_RECV, "%s error.\n",
2850                     (flags & RT2860_RX_CRCERR)?"CRC":"ICV");
2851                 goto fail;
2852         }
2853
2854         if (flags & RT2860_RX_L2PAD) {
2855                 RUN_DPRINTF(sc, RUN_DEBUG_RECV,
2856                     "received RT2860_RX_L2PAD frame\n");
2857                 len += 2;
2858         }
2859
2860         m->m_data += rxwisize;
2861         m->m_pkthdr.len = m->m_len = len;
2862
2863         wh = mtod(m, struct ieee80211_frame *);
2864
2865         if ((wh->i_fc[1] & IEEE80211_FC1_PROTECTED) != 0 &&
2866             (flags & RT2860_RX_DEC) != 0) {
2867                 wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
2868                 m->m_flags |= M_WEP;
2869         }
2870
2871         if (len >= sizeof(struct ieee80211_frame_min)) {
2872                 ni = ieee80211_find_rxnode(ic,
2873                     mtod(m, struct ieee80211_frame_min *));
2874         } else
2875                 ni = NULL;
2876
2877         if (__predict_false(flags & RT2860_RX_MICERR)) {
2878                 /* report MIC failures to net80211 for TKIP */
2879                 if (ni != NULL)
2880                         ieee80211_notify_michael_failure(ni->ni_vap, wh,
2881                             rxwi->keyidx);
2882                 RUN_DPRINTF(sc, RUN_DEBUG_RECV,
2883                     "MIC error. Someone is lying.\n");
2884                 goto fail;
2885         }
2886
2887         ant = run_maxrssi_chain(sc, rxwi);
2888         rssi = rxwi->rssi[ant];
2889         nf = run_rssi2dbm(sc, rssi, ant);
2890
2891         if (__predict_false(ieee80211_radiotap_active(ic))) {
2892                 struct run_rx_radiotap_header *tap = &sc->sc_rxtap;
2893                 uint16_t phy;
2894
2895                 tap->wr_flags = 0;
2896                 if (flags & RT2860_RX_L2PAD)
2897                         tap->wr_flags |= IEEE80211_RADIOTAP_F_DATAPAD;
2898                 tap->wr_antsignal = rssi;
2899                 tap->wr_antenna = ant;
2900                 tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant);
2901                 tap->wr_rate = 2;       /* in case it can't be found below */
2902                 RUN_LOCK(sc);
2903                 run_get_tsf(sc, &tap->wr_tsf);
2904                 RUN_UNLOCK(sc);
2905                 phy = le16toh(rxwi->phy);
2906                 switch (phy & RT2860_PHY_MODE) {
2907                 case RT2860_PHY_CCK:
2908                         switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
2909                         case 0: tap->wr_rate =   2; break;
2910                         case 1: tap->wr_rate =   4; break;
2911                         case 2: tap->wr_rate =  11; break;
2912                         case 3: tap->wr_rate =  22; break;
2913                         }
2914                         if (phy & RT2860_PHY_SHPRE)
2915                                 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2916                         break;
2917                 case RT2860_PHY_OFDM:
2918                         switch (phy & RT2860_PHY_MCS) {
2919                         case 0: tap->wr_rate =  12; break;
2920                         case 1: tap->wr_rate =  18; break;
2921                         case 2: tap->wr_rate =  24; break;
2922                         case 3: tap->wr_rate =  36; break;
2923                         case 4: tap->wr_rate =  48; break;
2924                         case 5: tap->wr_rate =  72; break;
2925                         case 6: tap->wr_rate =  96; break;
2926                         case 7: tap->wr_rate = 108; break;
2927                         }
2928                         break;
2929                 }
2930         }
2931
2932         if (ni != NULL) {
2933                 (void)ieee80211_input(ni, m, rssi, nf);
2934                 ieee80211_free_node(ni);
2935         } else {
2936                 (void)ieee80211_input_all(ic, m, rssi, nf);
2937         }
2938
2939         return;
2940
2941 fail:
2942         m_freem(m);
2943         counter_u64_add(ic->ic_ierrors, 1);
2944 }
2945
2946 static void
2947 run_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2948 {
2949         struct run_softc *sc = usbd_xfer_softc(xfer);
2950         struct ieee80211com *ic = &sc->sc_ic;
2951         struct mbuf *m = NULL;
2952         struct mbuf *m0;
2953         uint32_t dmalen, mbuf_len;
2954         uint16_t rxwisize;
2955         int xferlen;
2956
2957         rxwisize = sizeof(struct rt2860_rxwi);
2958         if (sc->mac_ver == 0x5592)
2959                 rxwisize += sizeof(uint64_t);
2960         else if (sc->mac_ver == 0x3593)
2961                 rxwisize += sizeof(uint32_t);
2962
2963         usbd_xfer_status(xfer, &xferlen, NULL, NULL, NULL);
2964
2965         switch (USB_GET_STATE(xfer)) {
2966         case USB_ST_TRANSFERRED:
2967
2968                 RUN_DPRINTF(sc, RUN_DEBUG_RECV,
2969                     "rx done, actlen=%d\n", xferlen);
2970
2971                 if (xferlen < (int)(sizeof(uint32_t) + rxwisize +
2972                     sizeof(struct rt2870_rxd))) {
2973                         RUN_DPRINTF(sc, RUN_DEBUG_RECV_DESC | RUN_DEBUG_USB,
2974                             "xfer too short %d\n", xferlen);
2975                         goto tr_setup;
2976                 }
2977
2978                 m = sc->rx_m;
2979                 sc->rx_m = NULL;
2980
2981                 /* FALLTHROUGH */
2982         case USB_ST_SETUP:
2983 tr_setup:
2984                 if (sc->rx_m == NULL) {
2985                         sc->rx_m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
2986                             MJUMPAGESIZE /* xfer can be bigger than MCLBYTES */);
2987                 }
2988                 if (sc->rx_m == NULL) {
2989                         RUN_DPRINTF(sc, RUN_DEBUG_RECV | RUN_DEBUG_RECV_DESC,
2990                             "could not allocate mbuf - idle with stall\n");
2991                         counter_u64_add(ic->ic_ierrors, 1);
2992                         usbd_xfer_set_stall(xfer);
2993                         usbd_xfer_set_frames(xfer, 0);
2994                 } else {
2995                         /*
2996                          * Directly loading a mbuf cluster into DMA to
2997                          * save some data copying. This works because
2998                          * there is only one cluster.
2999                          */
3000                         usbd_xfer_set_frame_data(xfer, 0,
3001                             mtod(sc->rx_m, caddr_t), RUN_MAX_RXSZ);
3002                         usbd_xfer_set_frames(xfer, 1);
3003                 }
3004                 usbd_transfer_submit(xfer);
3005                 break;
3006
3007         default:        /* Error */
3008                 if (error != USB_ERR_CANCELLED) {
3009                         /* try to clear stall first */
3010                         usbd_xfer_set_stall(xfer);
3011                         if (error == USB_ERR_TIMEOUT)
3012                                 device_printf(sc->sc_dev, "device timeout\n");
3013                         counter_u64_add(ic->ic_ierrors, 1);
3014                         goto tr_setup;
3015                 }
3016                 if (sc->rx_m != NULL) {
3017                         m_freem(sc->rx_m);
3018                         sc->rx_m = NULL;
3019                 }
3020                 break;
3021         }
3022
3023         if (m == NULL)
3024                 return;
3025
3026         /* inputting all the frames must be last */
3027
3028         RUN_UNLOCK(sc);
3029
3030         m->m_pkthdr.len = m->m_len = xferlen;
3031
3032         /* HW can aggregate multiple 802.11 frames in a single USB xfer */
3033         for(;;) {
3034                 dmalen = le32toh(*mtod(m, uint32_t *)) & 0xffff;
3035
3036                 if ((dmalen >= (uint32_t)-8) || (dmalen == 0) ||
3037                     ((dmalen & 3) != 0)) {
3038                         RUN_DPRINTF(sc, RUN_DEBUG_RECV_DESC | RUN_DEBUG_USB,
3039                             "bad DMA length %u\n", dmalen);
3040                         break;
3041                 }
3042                 if ((dmalen + 8) > (uint32_t)xferlen) {
3043                         RUN_DPRINTF(sc, RUN_DEBUG_RECV_DESC | RUN_DEBUG_USB,
3044                             "bad DMA length %u > %d\n",
3045                         dmalen + 8, xferlen);
3046                         break;
3047                 }
3048
3049                 /* If it is the last one or a single frame, we won't copy. */
3050                 if ((xferlen -= dmalen + 8) <= 8) {
3051                         /* trim 32-bit DMA-len header */
3052                         m->m_data += 4;
3053                         m->m_pkthdr.len = m->m_len -= 4;
3054                         run_rx_frame(sc, m, dmalen);
3055                         m = NULL;       /* don't free source buffer */
3056                         break;
3057                 }
3058
3059                 mbuf_len = dmalen + sizeof(struct rt2870_rxd);
3060                 if (__predict_false(mbuf_len > MCLBYTES)) {
3061                         RUN_DPRINTF(sc, RUN_DEBUG_RECV_DESC | RUN_DEBUG_USB,
3062                             "payload is too big: mbuf_len %u\n", mbuf_len);
3063                         counter_u64_add(ic->ic_ierrors, 1);
3064                         break;
3065                 }
3066
3067                 /* copy aggregated frames to another mbuf */
3068                 m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
3069                 if (__predict_false(m0 == NULL)) {
3070                         RUN_DPRINTF(sc, RUN_DEBUG_RECV_DESC,
3071                             "could not allocate mbuf\n");
3072                         counter_u64_add(ic->ic_ierrors, 1);
3073                         break;
3074                 }
3075                 m_copydata(m, 4 /* skip 32-bit DMA-len header */,
3076                     mbuf_len, mtod(m0, caddr_t));
3077                 m0->m_pkthdr.len = m0->m_len = mbuf_len;
3078                 run_rx_frame(sc, m0, dmalen);
3079
3080                 /* update data ptr */
3081                 m->m_data += mbuf_len + 4;
3082                 m->m_pkthdr.len = m->m_len -= mbuf_len + 4;
3083         }
3084
3085         /* make sure we free the source buffer, if any */
3086         m_freem(m);
3087
3088         RUN_LOCK(sc);
3089 }
3090
3091 static void
3092 run_tx_free(struct run_endpoint_queue *pq,
3093     struct run_tx_data *data, int txerr)
3094 {
3095
3096         ieee80211_tx_complete(data->ni, data->m, txerr);
3097
3098         data->m = NULL;
3099         data->ni = NULL;
3100
3101         STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
3102         pq->tx_nfree++;
3103 }
3104
3105 static void
3106 run_bulk_tx_callbackN(struct usb_xfer *xfer, usb_error_t error, u_int index)
3107 {
3108         struct run_softc *sc = usbd_xfer_softc(xfer);
3109         struct ieee80211com *ic = &sc->sc_ic;
3110         struct run_tx_data *data;
3111         struct ieee80211vap *vap = NULL;
3112         struct usb_page_cache *pc;
3113         struct run_endpoint_queue *pq = &sc->sc_epq[index];
3114         struct mbuf *m;
3115         usb_frlength_t size;
3116         int actlen;
3117         int sumlen;
3118
3119         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
3120
3121         switch (USB_GET_STATE(xfer)) {
3122         case USB_ST_TRANSFERRED:
3123                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_USB,
3124                     "transfer complete: %d bytes @ index %d\n", actlen, index);
3125
3126                 data = usbd_xfer_get_priv(xfer);
3127                 run_tx_free(pq, data, 0);
3128                 usbd_xfer_set_priv(xfer, NULL);
3129
3130                 /* FALLTHROUGH */
3131         case USB_ST_SETUP:
3132 tr_setup:
3133                 data = STAILQ_FIRST(&pq->tx_qh);
3134                 if (data == NULL)
3135                         break;
3136
3137                 STAILQ_REMOVE_HEAD(&pq->tx_qh, next);
3138
3139                 m = data->m;
3140                 size = (sc->mac_ver == 0x5592) ?
3141                     sizeof(data->desc) + sizeof(uint32_t) : sizeof(data->desc);
3142                 if ((m->m_pkthdr.len +
3143                     size + 3 + 8) > RUN_MAX_TXSZ) {
3144                         RUN_DPRINTF(sc, RUN_DEBUG_XMIT_DESC | RUN_DEBUG_USB,
3145                             "data overflow, %u bytes\n", m->m_pkthdr.len);
3146                         run_tx_free(pq, data, 1);
3147                         goto tr_setup;
3148                 }
3149
3150                 pc = usbd_xfer_get_frame(xfer, 0);
3151                 usbd_copy_in(pc, 0, &data->desc, size);
3152                 usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
3153                 size += m->m_pkthdr.len;
3154                 /*
3155                  * Align end on a 4-byte boundary, pad 8 bytes (CRC +
3156                  * 4-byte padding), and be sure to zero those trailing
3157                  * bytes:
3158                  */
3159                 usbd_frame_zero(pc, size, ((-size) & 3) + 8);
3160                 size += ((-size) & 3) + 8;
3161
3162                 vap = data->ni->ni_vap;
3163                 if (ieee80211_radiotap_active_vap(vap)) {
3164                         const struct ieee80211_frame *wh;
3165                         struct run_tx_radiotap_header *tap = &sc->sc_txtap;
3166                         struct rt2860_txwi *txwi =
3167                             (struct rt2860_txwi *)(&data->desc + sizeof(struct rt2870_txd));
3168                         int has_l2pad;
3169
3170                         wh = mtod(m, struct ieee80211_frame *);
3171                         has_l2pad = IEEE80211_HAS_ADDR4(wh) !=
3172                             IEEE80211_QOS_HAS_SEQ(wh);
3173
3174                         tap->wt_flags = 0;
3175                         tap->wt_rate = rt2860_rates[data->ridx].rate;
3176                         tap->wt_hwqueue = index;
3177                         if (le16toh(txwi->phy) & RT2860_PHY_SHPRE)
3178                                 tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3179                         if (has_l2pad)
3180                                 tap->wt_flags |= IEEE80211_RADIOTAP_F_DATAPAD;
3181
3182                         ieee80211_radiotap_tx(vap, m);
3183                 }
3184
3185                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_USB,
3186                     "sending frame len=%u/%u @ index %d\n",
3187                     m->m_pkthdr.len, size, index);
3188
3189                 usbd_xfer_set_frame_len(xfer, 0, size);
3190                 usbd_xfer_set_priv(xfer, data);
3191                 usbd_transfer_submit(xfer);
3192                 run_start(sc);
3193
3194                 break;
3195
3196         default:
3197                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_USB,
3198                     "USB transfer error, %s\n", usbd_errstr(error));
3199
3200                 data = usbd_xfer_get_priv(xfer);
3201
3202                 if (data != NULL) {
3203                         if(data->ni != NULL)
3204                                 vap = data->ni->ni_vap;
3205                         run_tx_free(pq, data, error);
3206                         usbd_xfer_set_priv(xfer, NULL);
3207                 }
3208
3209                 if (vap == NULL)
3210                         vap = TAILQ_FIRST(&ic->ic_vaps);
3211
3212                 if (error != USB_ERR_CANCELLED) {
3213                         if (error == USB_ERR_TIMEOUT) {
3214                                 device_printf(sc->sc_dev, "device timeout\n");
3215                                 uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
3216                                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_USB,
3217                                     "cmdq_store=%d\n", i);
3218                                 sc->cmdq[i].func = run_usb_timeout_cb;
3219                                 sc->cmdq[i].arg0 = vap;
3220                                 ieee80211_runtask(ic, &sc->cmdq_task);
3221                         }
3222
3223                         /*
3224                          * Try to clear stall first, also if other
3225                          * errors occur, hence clearing stall
3226                          * introduces a 50 ms delay:
3227                          */
3228                         usbd_xfer_set_stall(xfer);
3229                         goto tr_setup;
3230                 }
3231                 break;
3232         }
3233 }
3234
3235 static void
3236 run_bulk_tx_callback0(struct usb_xfer *xfer, usb_error_t error)
3237 {
3238         run_bulk_tx_callbackN(xfer, error, 0);
3239 }
3240
3241 static void
3242 run_bulk_tx_callback1(struct usb_xfer *xfer, usb_error_t error)
3243 {
3244         run_bulk_tx_callbackN(xfer, error, 1);
3245 }
3246
3247 static void
3248 run_bulk_tx_callback2(struct usb_xfer *xfer, usb_error_t error)
3249 {
3250         run_bulk_tx_callbackN(xfer, error, 2);
3251 }
3252
3253 static void
3254 run_bulk_tx_callback3(struct usb_xfer *xfer, usb_error_t error)
3255 {
3256         run_bulk_tx_callbackN(xfer, error, 3);
3257 }
3258
3259 static void
3260 run_bulk_tx_callback4(struct usb_xfer *xfer, usb_error_t error)
3261 {
3262         run_bulk_tx_callbackN(xfer, error, 4);
3263 }
3264
3265 static void
3266 run_bulk_tx_callback5(struct usb_xfer *xfer, usb_error_t error)
3267 {
3268         run_bulk_tx_callbackN(xfer, error, 5);
3269 }
3270
3271 static void
3272 run_set_tx_desc(struct run_softc *sc, struct run_tx_data *data)
3273 {
3274         struct mbuf *m = data->m;
3275         struct ieee80211com *ic = &sc->sc_ic;
3276         struct ieee80211vap *vap = data->ni->ni_vap;
3277         struct ieee80211_frame *wh;
3278         struct rt2870_txd *txd;
3279         struct rt2860_txwi *txwi;
3280         uint16_t xferlen, txwisize;
3281         uint16_t mcs;
3282         uint8_t ridx = data->ridx;
3283         uint8_t pad;
3284
3285         /* get MCS code from rate index */
3286         mcs = rt2860_rates[ridx].mcs;
3287
3288         txwisize = (sc->mac_ver == 0x5592) ?
3289             sizeof(*txwi) + sizeof(uint32_t) : sizeof(*txwi);
3290         xferlen = txwisize + m->m_pkthdr.len;
3291
3292         /* roundup to 32-bit alignment */
3293         xferlen = (xferlen + 3) & ~3;
3294
3295         txd = (struct rt2870_txd *)&data->desc;
3296         txd->len = htole16(xferlen);
3297
3298         wh = mtod(m, struct ieee80211_frame *);
3299
3300         /*
3301          * Ether both are true or both are false, the header
3302          * are nicely aligned to 32-bit. So, no L2 padding.
3303          */
3304         if(IEEE80211_HAS_ADDR4(wh) == IEEE80211_QOS_HAS_SEQ(wh))
3305                 pad = 0;
3306         else
3307                 pad = 2;
3308
3309         /* setup TX Wireless Information */
3310         txwi = (struct rt2860_txwi *)(txd + 1);
3311         txwi->len = htole16(m->m_pkthdr.len - pad);
3312         if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
3313                 mcs |= RT2860_PHY_CCK;
3314                 if (ridx != RT2860_RIDX_CCK1 &&
3315                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
3316                         mcs |= RT2860_PHY_SHPRE;
3317         } else
3318                 mcs |= RT2860_PHY_OFDM;
3319         txwi->phy = htole16(mcs);
3320
3321         /* check if RTS/CTS or CTS-to-self protection is required */
3322         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3323             (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
3324              ((ic->ic_flags & IEEE80211_F_USEPROT) &&
3325               rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
3326                 txwi->txop |= RT2860_TX_TXOP_HT;
3327         else
3328                 txwi->txop |= RT2860_TX_TXOP_BACKOFF;
3329
3330         if (vap->iv_opmode != IEEE80211_M_STA && !IEEE80211_QOS_HAS_SEQ(wh))
3331                 txwi->xflags |= RT2860_TX_NSEQ;
3332 }
3333
3334 /* This function must be called locked */
3335 static int
3336 run_tx(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
3337 {
3338         struct ieee80211com *ic = &sc->sc_ic;
3339         struct ieee80211vap *vap = ni->ni_vap;
3340         struct ieee80211_frame *wh;
3341         const struct ieee80211_txparam *tp = ni->ni_txparms;
3342         struct run_node *rn = RUN_NODE(ni);
3343         struct run_tx_data *data;
3344         struct rt2870_txd *txd;
3345         struct rt2860_txwi *txwi;
3346         uint16_t qos;
3347         uint16_t dur;
3348         uint16_t qid;
3349         uint8_t type;
3350         uint8_t tid;
3351         uint8_t ridx;
3352         uint8_t ctl_ridx;
3353         uint8_t qflags;
3354         uint8_t xflags = 0;
3355         int hasqos;
3356
3357         RUN_LOCK_ASSERT(sc, MA_OWNED);
3358
3359         wh = mtod(m, struct ieee80211_frame *);
3360
3361         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3362
3363         /*
3364          * There are 7 bulk endpoints: 1 for RX
3365          * and 6 for TX (4 EDCAs + HCCA + Prio).
3366          * Update 03-14-2009:  some devices like the Planex GW-US300MiniS
3367          * seem to have only 4 TX bulk endpoints (Fukaumi Naoki).
3368          */
3369         if ((hasqos = IEEE80211_QOS_HAS_SEQ(wh))) {
3370                 uint8_t *frm;
3371
3372                 frm = ieee80211_getqos(wh);
3373                 qos = le16toh(*(const uint16_t *)frm);
3374                 tid = qos & IEEE80211_QOS_TID;
3375                 qid = TID_TO_WME_AC(tid);
3376         } else {
3377                 qos = 0;
3378                 tid = 0;
3379                 qid = WME_AC_BE;
3380         }
3381         qflags = (qid < 4) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_HCCA;
3382
3383         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "qos %d\tqid %d\ttid %d\tqflags %x\n",
3384             qos, qid, tid, qflags);
3385
3386         /* pickup a rate index */
3387         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
3388             type != IEEE80211_FC0_TYPE_DATA || m->m_flags & M_EAPOL) {
3389                 ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
3390                     RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
3391                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
3392         } else {
3393                 if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
3394                         ridx = rn->fix_ridx;
3395                 else
3396                         ridx = rn->amrr_ridx;
3397                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
3398         }
3399
3400         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3401             (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
3402              IEEE80211_QOS_ACKPOLICY_NOACK)) {
3403                 xflags |= RT2860_TX_ACK;
3404                 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
3405                         dur = rt2860_rates[ctl_ridx].sp_ack_dur;
3406                 else
3407                         dur = rt2860_rates[ctl_ridx].lp_ack_dur;
3408                 USETW(wh->i_dur, dur);
3409         }
3410
3411         /* reserve slots for mgmt packets, just in case */
3412         if (sc->sc_epq[qid].tx_nfree < 3) {
3413                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "tx ring %d is full\n", qid);
3414                 return (-1);
3415         }
3416
3417         data = STAILQ_FIRST(&sc->sc_epq[qid].tx_fh);
3418         STAILQ_REMOVE_HEAD(&sc->sc_epq[qid].tx_fh, next);
3419         sc->sc_epq[qid].tx_nfree--;
3420
3421         txd = (struct rt2870_txd *)&data->desc;
3422         txd->flags = qflags;
3423         txwi = (struct rt2860_txwi *)(txd + 1);
3424         txwi->xflags = xflags;
3425         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3426                 txwi->wcid = 0;
3427         else
3428                 txwi->wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
3429                     1 : RUN_AID2WCID(ni->ni_associd);
3430
3431         /* clear leftover garbage bits */
3432         txwi->flags = 0;
3433         txwi->txop = 0;
3434
3435         data->m = m;
3436         data->ni = ni;
3437         data->ridx = ridx;
3438
3439         run_set_tx_desc(sc, data);
3440
3441         /*
3442          * The chip keeps track of 2 kind of Tx stats,
3443          *  * TX_STAT_FIFO, for per WCID stats, and
3444          *  * TX_STA_CNT0 for all-TX-in-one stats.
3445          *
3446          * To use FIFO stats, we need to store MCS into the driver-private
3447          * PacketID field. So that, we can tell whose stats when we read them.
3448          * We add 1 to the MCS because setting the PacketID field to 0 means
3449          * that we don't want feedback in TX_STAT_FIFO.
3450          * And, that's what we want for STA mode, since TX_STA_CNT0 does the job.
3451          *
3452          * FIFO stats doesn't count Tx with WCID 0xff, so we do this in run_tx().
3453          */
3454         if (sc->rvp_cnt > 1 || vap->iv_opmode == IEEE80211_M_HOSTAP ||
3455             vap->iv_opmode == IEEE80211_M_MBSS) {
3456                 uint16_t pid = (rt2860_rates[ridx].mcs + 1) & 0xf;
3457                 txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
3458
3459                 /*
3460                  * Unlike PCI based devices, we don't get any interrupt from
3461                  * USB devices, so we simulate FIFO-is-full interrupt here.
3462                  * Ralink recommends to drain FIFO stats every 100 ms, but 16 slots
3463                  * quickly get fulled. To prevent overflow, increment a counter on
3464                  * every FIFO stat request, so we know how many slots are left.
3465                  * We do this only in HOSTAP or multiple vap mode since FIFO stats
3466                  * are used only in those modes.
3467                  * We just drain stats. AMRR gets updated every 1 sec by
3468                  * run_ratectl_cb() via callout.
3469                  * Call it early. Otherwise overflow.
3470                  */
3471                 if (sc->fifo_cnt++ == 10) {
3472                         /*
3473                          * With multiple vaps or if_bridge, if_start() is called
3474                          * with a non-sleepable lock, tcpinp. So, need to defer.
3475                          */
3476                         uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
3477                         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "cmdq_store=%d\n", i);
3478                         sc->cmdq[i].func = run_drain_fifo;
3479                         sc->cmdq[i].arg0 = sc;
3480                         ieee80211_runtask(ic, &sc->cmdq_task);
3481                 }
3482         }
3483
3484         STAILQ_INSERT_TAIL(&sc->sc_epq[qid].tx_qh, data, next);
3485
3486         usbd_transfer_start(sc->sc_xfer[qid]);
3487
3488         RUN_DPRINTF(sc, RUN_DEBUG_XMIT,
3489             "sending data frame len=%d rate=%d qid=%d\n",
3490             m->m_pkthdr.len + (int)(sizeof(struct rt2870_txd) +
3491             sizeof(struct rt2860_txwi)), rt2860_rates[ridx].rate, qid);
3492
3493         return (0);
3494 }
3495
3496 static int
3497 run_tx_mgt(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
3498 {
3499         struct ieee80211com *ic = &sc->sc_ic;
3500         struct run_node *rn = RUN_NODE(ni);
3501         struct run_tx_data *data;
3502         struct ieee80211_frame *wh;
3503         struct rt2870_txd *txd;
3504         struct rt2860_txwi *txwi;
3505         uint16_t dur;
3506         uint8_t ridx = rn->mgt_ridx;
3507         uint8_t xflags = 0;
3508         uint8_t wflags = 0;
3509
3510         RUN_LOCK_ASSERT(sc, MA_OWNED);
3511
3512         wh = mtod(m, struct ieee80211_frame *);
3513
3514         /* tell hardware to add timestamp for probe responses */
3515         if ((wh->i_fc[0] &
3516             (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
3517             (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
3518                 wflags |= RT2860_TX_TS;
3519         else if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3520                 xflags |= RT2860_TX_ACK;
3521
3522                 dur = ieee80211_ack_duration(ic->ic_rt, rt2860_rates[ridx].rate,
3523                     ic->ic_flags & IEEE80211_F_SHPREAMBLE);
3524                 USETW(wh->i_dur, dur);
3525         }
3526
3527         if (sc->sc_epq[0].tx_nfree == 0)
3528                 /* let caller free mbuf */
3529                 return (EIO);
3530         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3531         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3532         sc->sc_epq[0].tx_nfree--;
3533
3534         txd = (struct rt2870_txd *)&data->desc;
3535         txd->flags = RT2860_TX_QSEL_EDCA;
3536         txwi = (struct rt2860_txwi *)(txd + 1);
3537         txwi->wcid = 0xff;
3538         txwi->flags = wflags;
3539         txwi->xflags = xflags;
3540         txwi->txop = 0; /* clear leftover garbage bits */
3541
3542         data->m = m;
3543         data->ni = ni;
3544         data->ridx = ridx;
3545
3546         run_set_tx_desc(sc, data);
3547
3548         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "sending mgt frame len=%d rate=%d\n",
3549             m->m_pkthdr.len + (int)(sizeof(struct rt2870_txd) +
3550             sizeof(struct rt2860_txwi)), rt2860_rates[ridx].rate);
3551
3552         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3553
3554         usbd_transfer_start(sc->sc_xfer[0]);
3555
3556         return (0);
3557 }
3558
3559 static int
3560 run_sendprot(struct run_softc *sc,
3561     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
3562 {
3563         struct ieee80211com *ic = ni->ni_ic;
3564         struct run_tx_data *data;
3565         struct rt2870_txd *txd;
3566         struct rt2860_txwi *txwi;
3567         struct mbuf *mprot;
3568         int ridx;
3569         int protrate;
3570         uint8_t wflags = 0;
3571         uint8_t xflags = 0;
3572
3573         RUN_LOCK_ASSERT(sc, MA_OWNED);
3574
3575         /* check that there are free slots before allocating the mbuf */
3576         if (sc->sc_epq[0].tx_nfree == 0)
3577                 /* let caller free mbuf */
3578                 return (ENOBUFS);
3579
3580         mprot = ieee80211_alloc_prot(ni, m, rate, prot);
3581         if (mprot == NULL) {
3582                 if_inc_counter(ni->ni_vap->iv_ifp, IFCOUNTER_OERRORS, 1);
3583                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "could not allocate mbuf\n");
3584                 return (ENOBUFS);
3585         }
3586
3587         protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
3588         wflags = RT2860_TX_FRAG;
3589         xflags = 0;
3590         if (prot == IEEE80211_PROT_RTSCTS)
3591                 xflags |= RT2860_TX_ACK;
3592
3593         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3594         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3595         sc->sc_epq[0].tx_nfree--;
3596
3597         txd = (struct rt2870_txd *)&data->desc;
3598         txd->flags = RT2860_TX_QSEL_EDCA;
3599         txwi = (struct rt2860_txwi *)(txd + 1);
3600         txwi->wcid = 0xff;
3601         txwi->flags = wflags;
3602         txwi->xflags = xflags;
3603         txwi->txop = 0; /* clear leftover garbage bits */
3604
3605         data->m = mprot;
3606         data->ni = ieee80211_ref_node(ni);
3607
3608         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
3609                 if (rt2860_rates[ridx].rate == protrate)
3610                         break;
3611         data->ridx = ridx;
3612
3613         run_set_tx_desc(sc, data);
3614
3615         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "sending prot len=%u rate=%u\n",
3616             m->m_pkthdr.len, rate);
3617
3618         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3619
3620         usbd_transfer_start(sc->sc_xfer[0]);
3621
3622         return (0);
3623 }
3624
3625 static int
3626 run_tx_param(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
3627     const struct ieee80211_bpf_params *params)
3628 {
3629         struct ieee80211com *ic = ni->ni_ic;
3630         struct run_tx_data *data;
3631         struct rt2870_txd *txd;
3632         struct rt2860_txwi *txwi;
3633         uint8_t ridx;
3634         uint8_t rate;
3635         uint8_t opflags = 0;
3636         uint8_t xflags = 0;
3637         int error;
3638
3639         RUN_LOCK_ASSERT(sc, MA_OWNED);
3640
3641         KASSERT(params != NULL, ("no raw xmit params"));
3642
3643         rate = params->ibp_rate0;
3644         if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
3645                 /* let caller free mbuf */
3646                 return (EINVAL);
3647         }
3648
3649         if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
3650                 xflags |= RT2860_TX_ACK;
3651         if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
3652                 error = run_sendprot(sc, m, ni,
3653                     params->ibp_flags & IEEE80211_BPF_RTS ?
3654                         IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
3655                     rate);
3656                 if (error) {
3657                         /* let caller free mbuf */
3658                         return error;
3659                 }
3660                 opflags |= /*XXX RT2573_TX_LONG_RETRY |*/ RT2860_TX_TXOP_SIFS;
3661         }
3662
3663         if (sc->sc_epq[0].tx_nfree == 0) {
3664                 /* let caller free mbuf */
3665                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT,
3666                     "sending raw frame, but tx ring is full\n");
3667                 return (EIO);
3668         }
3669         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3670         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3671         sc->sc_epq[0].tx_nfree--;
3672
3673         txd = (struct rt2870_txd *)&data->desc;
3674         txd->flags = RT2860_TX_QSEL_EDCA;
3675         txwi = (struct rt2860_txwi *)(txd + 1);
3676         txwi->wcid = 0xff;
3677         txwi->xflags = xflags;
3678         txwi->txop = opflags;
3679         txwi->flags = 0;        /* clear leftover garbage bits */
3680
3681         data->m = m;
3682         data->ni = ni;
3683         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
3684                 if (rt2860_rates[ridx].rate == rate)
3685                         break;
3686         data->ridx = ridx;
3687
3688         run_set_tx_desc(sc, data);
3689
3690         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "sending raw frame len=%u rate=%u\n",
3691             m->m_pkthdr.len, rate);
3692
3693         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3694
3695         usbd_transfer_start(sc->sc_xfer[0]);
3696
3697         return (0);
3698 }
3699
3700 static int
3701 run_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3702     const struct ieee80211_bpf_params *params)
3703 {
3704         struct run_softc *sc = ni->ni_ic->ic_softc;
3705         int error = 0;
3706
3707         RUN_LOCK(sc);
3708
3709         /* prevent management frames from being sent if we're not ready */
3710         if (!(sc->sc_flags & RUN_RUNNING)) {
3711                 error = ENETDOWN;
3712                 goto done;
3713         }
3714
3715         if (params == NULL) {
3716                 /* tx mgt packet */
3717                 if ((error = run_tx_mgt(sc, m, ni)) != 0) {
3718                         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "mgt tx failed\n");
3719                         goto done;
3720                 }
3721         } else {
3722                 /* tx raw packet with param */
3723                 if ((error = run_tx_param(sc, m, ni, params)) != 0) {
3724                         RUN_DPRINTF(sc, RUN_DEBUG_XMIT, "tx with param failed\n");
3725                         goto done;
3726                 }
3727         }
3728
3729 done:
3730         RUN_UNLOCK(sc);
3731
3732         if (error != 0) {
3733                 if(m != NULL)
3734                         m_freem(m);
3735         }
3736
3737         return (error);
3738 }
3739
3740 static int
3741 run_transmit(struct ieee80211com *ic, struct mbuf *m)
3742 {
3743         struct run_softc *sc = ic->ic_softc;
3744         int error;
3745
3746         RUN_LOCK(sc);
3747         if ((sc->sc_flags & RUN_RUNNING) == 0) {
3748                 RUN_UNLOCK(sc);
3749                 return (ENXIO);
3750         }
3751         error = mbufq_enqueue(&sc->sc_snd, m);
3752         if (error) {
3753                 RUN_UNLOCK(sc);
3754                 return (error);
3755         }
3756         run_start(sc);
3757         RUN_UNLOCK(sc);
3758
3759         return (0);
3760 }
3761
3762 static void
3763 run_start(struct run_softc *sc)
3764 {
3765         struct ieee80211_node *ni;
3766         struct mbuf *m;
3767
3768         RUN_LOCK_ASSERT(sc, MA_OWNED);
3769
3770         if ((sc->sc_flags & RUN_RUNNING) == 0)
3771                 return;
3772
3773         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
3774                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3775                 if (run_tx(sc, m, ni) != 0) {
3776                         mbufq_prepend(&sc->sc_snd, m);
3777                         break;
3778                 }
3779         }
3780 }
3781
3782 static void
3783 run_parent(struct ieee80211com *ic)
3784 {
3785         struct run_softc *sc = ic->ic_softc;
3786         int startall = 0;
3787
3788         RUN_LOCK(sc);
3789         if (sc->sc_detached) {
3790                 RUN_UNLOCK(sc);
3791                 return;
3792         }
3793
3794         if (ic->ic_nrunning > 0) {
3795                 if (!(sc->sc_flags & RUN_RUNNING)) {
3796                         startall = 1;
3797                         run_init_locked(sc);
3798                 } else
3799                         run_update_promisc_locked(sc);
3800         } else if ((sc->sc_flags & RUN_RUNNING) && sc->rvp_cnt <= 1)
3801                 run_stop(sc);
3802         RUN_UNLOCK(sc);
3803         if (startall)
3804                 ieee80211_start_all(ic);
3805 }
3806
3807 static void
3808 run_iq_calib(struct run_softc *sc, u_int chan)
3809 {
3810         uint16_t val;
3811
3812         /* Tx0 IQ gain. */
3813         run_bbp_write(sc, 158, 0x2c);
3814         if (chan <= 14)
3815                 run_efuse_read(sc, RT5390_EEPROM_IQ_GAIN_CAL_TX0_2GHZ, &val, 1);
3816         else if (chan <= 64) {
3817                 run_efuse_read(sc,
3818                     RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5GHZ,
3819                     &val, 1);
3820         } else if (chan <= 138) {
3821                 run_efuse_read(sc,
3822                     RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5GHZ,
3823                     &val, 1);
3824         } else if (chan <= 165) {
3825                 run_efuse_read(sc,
3826             RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5GHZ,
3827                     &val, 1);
3828         } else
3829                 val = 0;
3830         run_bbp_write(sc, 159, val);
3831
3832         /* Tx0 IQ phase. */
3833         run_bbp_write(sc, 158, 0x2d);
3834         if (chan <= 14) {
3835                 run_efuse_read(sc, RT5390_EEPROM_IQ_PHASE_CAL_TX0_2GHZ,
3836                     &val, 1);
3837         } else if (chan <= 64) {
3838                 run_efuse_read(sc,
3839                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5GHZ,
3840                     &val, 1);
3841         } else if (chan <= 138) {
3842                 run_efuse_read(sc,
3843                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5GHZ,
3844                     &val, 1);
3845         } else if (chan <= 165) {
3846                 run_efuse_read(sc,
3847                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5GHZ,
3848                     &val, 1);
3849         } else
3850                 val = 0;
3851         run_bbp_write(sc, 159, val);
3852
3853         /* Tx1 IQ gain. */
3854         run_bbp_write(sc, 158, 0x4a);
3855         if (chan <= 14) {
3856                 run_efuse_read(sc, RT5390_EEPROM_IQ_GAIN_CAL_TX1_2GHZ,
3857                     &val, 1);
3858         } else if (chan <= 64) {
3859                 run_efuse_read(sc,
3860                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5GHZ,
3861                     &val, 1);
3862         } else if (chan <= 138) {
3863                 run_efuse_read(sc,
3864                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5GHZ,
3865                     &val, 1);
3866         } else if (chan <= 165) {
3867                 run_efuse_read(sc,
3868                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5GHZ,
3869                     &val, 1);
3870         } else
3871                 val = 0;
3872         run_bbp_write(sc, 159, val);
3873
3874         /* Tx1 IQ phase. */
3875         run_bbp_write(sc, 158, 0x4b);
3876         if (chan <= 14) {
3877                 run_efuse_read(sc, RT5390_EEPROM_IQ_PHASE_CAL_TX1_2GHZ,
3878                     &val, 1);
3879         } else if (chan <= 64) {
3880                 run_efuse_read(sc,
3881                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5GHZ,
3882                     &val, 1);
3883         } else if (chan <= 138) {
3884                 run_efuse_read(sc,
3885                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5GHZ,
3886                     &val, 1);
3887         } else if (chan <= 165) {
3888                 run_efuse_read(sc,
3889                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5GHZ,
3890                     &val, 1);
3891         } else
3892                 val = 0;
3893         run_bbp_write(sc, 159, val);
3894
3895         /* RF IQ compensation control. */
3896         run_bbp_write(sc, 158, 0x04);
3897         run_efuse_read(sc, RT5390_EEPROM_RF_IQ_COMPENSATION_CTL,
3898             &val, 1);
3899         run_bbp_write(sc, 159, val);
3900
3901         /* RF IQ imbalance compensation control. */
3902         run_bbp_write(sc, 158, 0x03);
3903         run_efuse_read(sc,
3904             RT5390_EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CTL, &val, 1);
3905         run_bbp_write(sc, 159, val);
3906 }
3907
3908 static void
3909 run_set_agc(struct run_softc *sc, uint8_t agc)
3910 {
3911         uint8_t bbp;
3912
3913         if (sc->mac_ver == 0x3572) {
3914                 run_bbp_read(sc, 27, &bbp);
3915                 bbp &= ~(0x3 << 5);
3916                 run_bbp_write(sc, 27, bbp | 0 << 5);    /* select Rx0 */
3917                 run_bbp_write(sc, 66, agc);
3918                 run_bbp_write(sc, 27, bbp | 1 << 5);    /* select Rx1 */
3919                 run_bbp_write(sc, 66, agc);
3920         } else
3921                 run_bbp_write(sc, 66, agc);
3922 }
3923
3924 static void
3925 run_select_chan_group(struct run_softc *sc, int group)
3926 {
3927         uint32_t tmp;
3928         uint8_t agc;
3929
3930         run_bbp_write(sc, 62, 0x37 - sc->lna[group]);
3931         run_bbp_write(sc, 63, 0x37 - sc->lna[group]);
3932         run_bbp_write(sc, 64, 0x37 - sc->lna[group]);
3933         if (sc->mac_ver < 0x3572)
3934                 run_bbp_write(sc, 86, 0x00);
3935
3936         if (sc->mac_ver == 0x3593) {
3937                 run_bbp_write(sc, 77, 0x98);
3938                 run_bbp_write(sc, 83, (group == 0) ? 0x8a : 0x9a);
3939         }
3940
3941         if (group == 0) {
3942                 if (sc->ext_2ghz_lna) {
3943                         if (sc->mac_ver >= 0x5390)
3944                                 run_bbp_write(sc, 75, 0x52);
3945                         else {
3946                                 run_bbp_write(sc, 82, 0x62);
3947                                 run_bbp_write(sc, 75, 0x46);
3948                         }
3949                 } else {
3950                         if (sc->mac_ver == 0x5592) {
3951                                 run_bbp_write(sc, 79, 0x1c);
3952                                 run_bbp_write(sc, 80, 0x0e);
3953                                 run_bbp_write(sc, 81, 0x3a);
3954                                 run_bbp_write(sc, 82, 0x62);
3955
3956                                 run_bbp_write(sc, 195, 0x80);
3957                                 run_bbp_write(sc, 196, 0xe0);
3958                                 run_bbp_write(sc, 195, 0x81);
3959                                 run_bbp_write(sc, 196, 0x1f);
3960                                 run_bbp_write(sc, 195, 0x82);
3961                                 run_bbp_write(sc, 196, 0x38);
3962                                 run_bbp_write(sc, 195, 0x83);
3963                                 run_bbp_write(sc, 196, 0x32);
3964                                 run_bbp_write(sc, 195, 0x85);
3965                                 run_bbp_write(sc, 196, 0x28);
3966                                 run_bbp_write(sc, 195, 0x86);
3967                                 run_bbp_write(sc, 196, 0x19);
3968                         } else if (sc->mac_ver >= 0x5390)
3969                                 run_bbp_write(sc, 75, 0x50);
3970                         else {
3971                                 run_bbp_write(sc, 82,
3972                                     (sc->mac_ver == 0x3593) ? 0x62 : 0x84);
3973                                 run_bbp_write(sc, 75, 0x50);
3974                         }
3975                 }
3976         } else {
3977                 if (sc->mac_ver == 0x5592) {
3978                         run_bbp_write(sc, 79, 0x18);
3979                         run_bbp_write(sc, 80, 0x08);
3980                         run_bbp_write(sc, 81, 0x38);
3981                         run_bbp_write(sc, 82, 0x92);
3982
3983                         run_bbp_write(sc, 195, 0x80);
3984                         run_bbp_write(sc, 196, 0xf0);
3985                         run_bbp_write(sc, 195, 0x81);
3986                         run_bbp_write(sc, 196, 0x1e);
3987                         run_bbp_write(sc, 195, 0x82);
3988                         run_bbp_write(sc, 196, 0x28);
3989                         run_bbp_write(sc, 195, 0x83);
3990                         run_bbp_write(sc, 196, 0x20);
3991                         run_bbp_write(sc, 195, 0x85);
3992                         run_bbp_write(sc, 196, 0x7f);
3993                         run_bbp_write(sc, 195, 0x86);
3994                         run_bbp_write(sc, 196, 0x7f);
3995                 } else if (sc->mac_ver == 0x3572)
3996                         run_bbp_write(sc, 82, 0x94);
3997                 else
3998                         run_bbp_write(sc, 82,
3999                             (sc->mac_ver == 0x3593) ? 0x82 : 0xf2);
4000                 if (sc->ext_5ghz_lna)
4001                         run_bbp_write(sc, 75, 0x46);
4002                 else
4003                         run_bbp_write(sc, 75, 0x50);
4004         }
4005
4006         run_read(sc, RT2860_TX_BAND_CFG, &tmp);
4007         tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
4008         tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
4009         run_write(sc, RT2860_TX_BAND_CFG, tmp);
4010
4011         /* enable appropriate Power Amplifiers and Low Noise Amplifiers */
4012         tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
4013         if (sc->mac_ver == 0x3593)
4014                 tmp |= 1 << 29 | 1 << 28;
4015         if (sc->nrxchains > 1)
4016                 tmp |= RT2860_LNA_PE1_EN;
4017         if (group == 0) {       /* 2GHz */
4018                 tmp |= RT2860_PA_PE_G0_EN;
4019                 if (sc->ntxchains > 1)
4020                         tmp |= RT2860_PA_PE_G1_EN;
4021                 if (sc->mac_ver == 0x3593) {
4022                         if (sc->ntxchains > 2)
4023                                 tmp |= 1 << 25;
4024                 }
4025         } else {                /* 5GHz */
4026                 tmp |= RT2860_PA_PE_A0_EN;
4027                 if (sc->ntxchains > 1)
4028                         tmp |= RT2860_PA_PE_A1_EN;
4029         }
4030         if (sc->mac_ver == 0x3572) {
4031                 run_rt3070_rf_write(sc, 8, 0x00);
4032                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
4033                 run_rt3070_rf_write(sc, 8, 0x80);
4034         } else
4035                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
4036
4037         if (sc->mac_ver == 0x5592) {
4038                 run_bbp_write(sc, 195, 0x8d);
4039                 run_bbp_write(sc, 196, 0x1a);
4040         }
4041
4042         if (sc->mac_ver == 0x3593) {
4043                 run_read(sc, RT2860_GPIO_CTRL, &tmp);
4044                 tmp &= ~0x01010000;
4045                 if (group == 0)
4046                         tmp |= 0x00010000;
4047                 tmp = (tmp & ~0x00009090) | 0x00000090;
4048                 run_write(sc, RT2860_GPIO_CTRL, tmp);
4049         }
4050
4051         /* set initial AGC value */
4052         if (group == 0) {       /* 2GHz band */
4053                 if (sc->mac_ver >= 0x3070)
4054                         agc = 0x1c + sc->lna[0] * 2;
4055                 else
4056                         agc = 0x2e + sc->lna[0];
4057         } else {                /* 5GHz band */
4058                 if (sc->mac_ver == 0x5592)
4059                         agc = 0x24 + sc->lna[group] * 2;
4060                 else if (sc->mac_ver == 0x3572 || sc->mac_ver == 0x3593)
4061                         agc = 0x22 + (sc->lna[group] * 5) / 3;
4062                 else
4063                         agc = 0x32 + (sc->lna[group] * 5) / 3;
4064         }
4065         run_set_agc(sc, agc);
4066 }
4067
4068 static void
4069 run_rt2870_set_chan(struct run_softc *sc, u_int chan)
4070 {
4071         const struct rfprog *rfprog = rt2860_rf2850;
4072         uint32_t r2, r3, r4;
4073         int8_t txpow1, txpow2;
4074         int i;
4075
4076         /* find the settings for this channel (we know it exists) */
4077         for (i = 0; rfprog[i].chan != chan; i++);
4078
4079         r2 = rfprog[i].r2;
4080         if (sc->ntxchains == 1)
4081                 r2 |= 1 << 14;          /* 1T: disable Tx chain 2 */
4082         if (sc->nrxchains == 1)
4083                 r2 |= 1 << 17 | 1 << 6; /* 1R: disable Rx chains 2 & 3 */
4084         else if (sc->nrxchains == 2)
4085                 r2 |= 1 << 6;           /* 2R: disable Rx chain 3 */
4086
4087         /* use Tx power values from EEPROM */
4088         txpow1 = sc->txpow1[i];
4089         txpow2 = sc->txpow2[i];
4090
4091         /* Initialize RF R3 and R4. */
4092         r3 = rfprog[i].r3 & 0xffffc1ff;
4093         r4 = (rfprog[i].r4 & ~(0x001f87c0)) | (sc->freq << 15);
4094         if (chan > 14) {
4095                 if (txpow1 >= 0) {
4096                         txpow1 = (txpow1 > 0xf) ? (0xf) : (txpow1);
4097                         r3 |= (txpow1 << 10) | (1 << 9);
4098                 } else {
4099                         txpow1 += 7;
4100
4101                         /* txpow1 is not possible larger than 15. */
4102                         r3 |= (txpow1 << 10);
4103                 }
4104                 if (txpow2 >= 0) {
4105                         txpow2 = (txpow2 > 0xf) ? (0xf) : (txpow2);
4106                         r4 |= (txpow2 << 7) | (1 << 6);
4107                 } else {
4108                         txpow2 += 7;
4109                         r4 |= (txpow2 << 7);
4110                 }
4111         } else {
4112                 /* Set Tx0 power. */
4113                 r3 |= (txpow1 << 9);
4114
4115                 /* Set frequency offset and Tx1 power. */
4116                 r4 |= (txpow2 << 6);
4117         }
4118
4119         run_rt2870_rf_write(sc, rfprog[i].r1);
4120         run_rt2870_rf_write(sc, r2);
4121         run_rt2870_rf_write(sc, r3 & ~(1 << 2));
4122         run_rt2870_rf_write(sc, r4);
4123
4124         run_delay(sc, 10);
4125
4126         run_rt2870_rf_write(sc, rfprog[i].r1);
4127         run_rt2870_rf_write(sc, r2);
4128         run_rt2870_rf_write(sc, r3 | (1 << 2));
4129         run_rt2870_rf_write(sc, r4);
4130
4131         run_delay(sc, 10);
4132
4133         run_rt2870_rf_write(sc, rfprog[i].r1);
4134         run_rt2870_rf_write(sc, r2);
4135         run_rt2870_rf_write(sc, r3 & ~(1 << 2));
4136         run_rt2870_rf_write(sc, r4);
4137 }
4138
4139 static void
4140 run_rt3070_set_chan(struct run_softc *sc, u_int chan)
4141 {
4142         int8_t txpow1, txpow2;
4143         uint8_t rf;
4144         int i;
4145
4146         /* find the settings for this channel (we know it exists) */
4147         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4148
4149         /* use Tx power values from EEPROM */
4150         txpow1 = sc->txpow1[i];
4151         txpow2 = sc->txpow2[i];
4152
4153         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
4154
4155         /* RT3370/RT3390: RF R3 [7:4] is not reserved bits. */
4156         run_rt3070_rf_read(sc, 3, &rf);
4157         rf = (rf & ~0x0f) | rt3070_freqs[i].k;
4158         run_rt3070_rf_write(sc, 3, rf);
4159
4160         run_rt3070_rf_read(sc, 6, &rf);
4161         rf = (rf & ~0x03) | rt3070_freqs[i].r;
4162         run_rt3070_rf_write(sc, 6, rf);
4163
4164         /* set Tx0 power */
4165         run_rt3070_rf_read(sc, 12, &rf);
4166         rf = (rf & ~0x1f) | txpow1;
4167         run_rt3070_rf_write(sc, 12, rf);
4168
4169         /* set Tx1 power */
4170         run_rt3070_rf_read(sc, 13, &rf);
4171         rf = (rf & ~0x1f) | txpow2;
4172         run_rt3070_rf_write(sc, 13, rf);
4173
4174         run_rt3070_rf_read(sc, 1, &rf);
4175         rf &= ~0xfc;
4176         if (sc->ntxchains == 1)
4177                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
4178         else if (sc->ntxchains == 2)
4179                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
4180         if (sc->nrxchains == 1)
4181                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
4182         else if (sc->nrxchains == 2)
4183                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
4184         run_rt3070_rf_write(sc, 1, rf);
4185
4186         /* set RF offset */
4187         run_rt3070_rf_read(sc, 23, &rf);
4188         rf = (rf & ~0x7f) | sc->freq;
4189         run_rt3070_rf_write(sc, 23, rf);
4190
4191         /* program RF filter */
4192         run_rt3070_rf_read(sc, 24, &rf);        /* Tx */
4193         rf = (rf & ~0x3f) | sc->rf24_20mhz;
4194         run_rt3070_rf_write(sc, 24, rf);
4195         run_rt3070_rf_read(sc, 31, &rf);        /* Rx */
4196         rf = (rf & ~0x3f) | sc->rf24_20mhz;
4197         run_rt3070_rf_write(sc, 31, rf);
4198
4199         /* enable RF tuning */
4200         run_rt3070_rf_read(sc, 7, &rf);
4201         run_rt3070_rf_write(sc, 7, rf | 0x01);
4202 }
4203
4204 static void
4205 run_rt3572_set_chan(struct run_softc *sc, u_int chan)
4206 {
4207         int8_t txpow1, txpow2;
4208         uint32_t tmp;
4209         uint8_t rf;
4210         int i;
4211
4212         /* find the settings for this channel (we know it exists) */
4213         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4214
4215         /* use Tx power values from EEPROM */
4216         txpow1 = sc->txpow1[i];
4217         txpow2 = sc->txpow2[i];
4218
4219         if (chan <= 14) {
4220                 run_bbp_write(sc, 25, sc->bbp25);
4221                 run_bbp_write(sc, 26, sc->bbp26);
4222         } else {
4223                 /* enable IQ phase correction */
4224                 run_bbp_write(sc, 25, 0x09);
4225                 run_bbp_write(sc, 26, 0xff);
4226         }
4227
4228         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
4229         run_rt3070_rf_write(sc, 3, rt3070_freqs[i].k);
4230         run_rt3070_rf_read(sc, 6, &rf);
4231         rf  = (rf & ~0x0f) | rt3070_freqs[i].r;
4232         rf |= (chan <= 14) ? 0x08 : 0x04;
4233         run_rt3070_rf_write(sc, 6, rf);
4234
4235         /* set PLL mode */
4236         run_rt3070_rf_read(sc, 5, &rf);
4237         rf &= ~(0x08 | 0x04);
4238         rf |= (chan <= 14) ? 0x04 : 0x08;
4239         run_rt3070_rf_write(sc, 5, rf);
4240
4241         /* set Tx power for chain 0 */
4242         if (chan <= 14)
4243                 rf = 0x60 | txpow1;
4244         else
4245                 rf = 0xe0 | (txpow1 & 0xc) << 1 | (txpow1 & 0x3);
4246         run_rt3070_rf_write(sc, 12, rf);
4247
4248         /* set Tx power for chain 1 */
4249         if (chan <= 14)
4250                 rf = 0x60 | txpow2;
4251         else
4252                 rf = 0xe0 | (txpow2 & 0xc) << 1 | (txpow2 & 0x3);
4253         run_rt3070_rf_write(sc, 13, rf);
4254
4255         /* set Tx/Rx streams */
4256         run_rt3070_rf_read(sc, 1, &rf);
4257         rf &= ~0xfc;
4258         if (sc->ntxchains == 1)
4259                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
4260         else if (sc->ntxchains == 2)
4261                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
4262         if (sc->nrxchains == 1)
4263                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
4264         else if (sc->nrxchains == 2)
4265                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
4266         run_rt3070_rf_write(sc, 1, rf);
4267
4268         /* set RF offset */
4269         run_rt3070_rf_read(sc, 23, &rf);
4270         rf = (rf & ~0x7f) | sc->freq;
4271         run_rt3070_rf_write(sc, 23, rf);
4272
4273         /* program RF filter */
4274         rf = sc->rf24_20mhz;
4275         run_rt3070_rf_write(sc, 24, rf);        /* Tx */
4276         run_rt3070_rf_write(sc, 31, rf);        /* Rx */
4277
4278         /* enable RF tuning */
4279         run_rt3070_rf_read(sc, 7, &rf);
4280         rf = (chan <= 14) ? 0xd8 : ((rf & ~0xc8) | 0x14);
4281         run_rt3070_rf_write(sc, 7, rf);
4282
4283         /* TSSI */
4284         rf = (chan <= 14) ? 0xc3 : 0xc0;
4285         run_rt3070_rf_write(sc, 9, rf);
4286
4287         /* set loop filter 1 */
4288         run_rt3070_rf_write(sc, 10, 0xf1);
4289         /* set loop filter 2 */
4290         run_rt3070_rf_write(sc, 11, (chan <= 14) ? 0xb9 : 0x00);
4291
4292         /* set tx_mx2_ic */
4293         run_rt3070_rf_write(sc, 15, (chan <= 14) ? 0x53 : 0x43);
4294         /* set tx_mx1_ic */
4295         if (chan <= 14)
4296                 rf = 0x48 | sc->txmixgain_2ghz;
4297         else
4298                 rf = 0x78 | sc->txmixgain_5ghz;
4299         run_rt3070_rf_write(sc, 16, rf);
4300
4301         /* set tx_lo1 */
4302         run_rt3070_rf_write(sc, 17, 0x23);
4303         /* set tx_lo2 */
4304         if (chan <= 14)
4305                 rf = 0x93;
4306         else if (chan <= 64)
4307                 rf = 0xb7;
4308         else if (chan <= 128)
4309                 rf = 0x74;
4310         else
4311                 rf = 0x72;
4312         run_rt3070_rf_write(sc, 19, rf);
4313
4314         /* set rx_lo1 */
4315         if (chan <= 14)
4316                 rf = 0xb3;
4317         else if (chan <= 64)
4318                 rf = 0xf6;
4319         else if (chan <= 128)
4320                 rf = 0xf4;
4321         else
4322                 rf = 0xf3;
4323         run_rt3070_rf_write(sc, 20, rf);
4324
4325         /* set pfd_delay */
4326         if (chan <= 14)
4327                 rf = 0x15;
4328         else if (chan <= 64)
4329                 rf = 0x3d;
4330         else
4331                 rf = 0x01;
4332         run_rt3070_rf_write(sc, 25, rf);
4333
4334         /* set rx_lo2 */
4335         run_rt3070_rf_write(sc, 26, (chan <= 14) ? 0x85 : 0x87);
4336         /* set ldo_rf_vc */
4337         run_rt3070_rf_write(sc, 27, (chan <= 14) ? 0x00 : 0x01);
4338         /* set drv_cc */
4339         run_rt3070_rf_write(sc, 29, (chan <= 14) ? 0x9b : 0x9f);
4340
4341         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4342         tmp &= ~0x8080;
4343         if (chan <= 14)
4344                 tmp |= 0x80;
4345         run_write(sc, RT2860_GPIO_CTRL, tmp);
4346
4347         /* enable RF tuning */
4348         run_rt3070_rf_read(sc, 7, &rf);
4349         run_rt3070_rf_write(sc, 7, rf | 0x01);
4350
4351         run_delay(sc, 2);
4352 }
4353
4354 static void
4355 run_rt3593_set_chan(struct run_softc *sc, u_int chan)
4356 {
4357         int8_t txpow1, txpow2, txpow3;
4358         uint8_t h20mhz, rf;
4359         int i;
4360
4361         /* find the settings for this channel (we know it exists) */
4362         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4363
4364         /* use Tx power values from EEPROM */
4365         txpow1 = sc->txpow1[i];
4366         txpow2 = sc->txpow2[i];
4367         txpow3 = (sc->ntxchains == 3) ? sc->txpow3[i] : 0;
4368
4369         if (chan <= 14) {
4370                 run_bbp_write(sc, 25, sc->bbp25);
4371                 run_bbp_write(sc, 26, sc->bbp26);
4372         } else {
4373                 /* Enable IQ phase correction. */
4374                 run_bbp_write(sc, 25, 0x09);
4375                 run_bbp_write(sc, 26, 0xff);
4376         }
4377
4378         run_rt3070_rf_write(sc, 8, rt3070_freqs[i].n);
4379         run_rt3070_rf_write(sc, 9, rt3070_freqs[i].k & 0x0f);
4380         run_rt3070_rf_read(sc, 11, &rf);
4381         rf = (rf & ~0x03) | (rt3070_freqs[i].r & 0x03);
4382         run_rt3070_rf_write(sc, 11, rf);
4383
4384         /* Set pll_idoh. */
4385         run_rt3070_rf_read(sc, 11, &rf);
4386         rf &= ~0x4c;
4387         rf |= (chan <= 14) ? 0x44 : 0x48;
4388         run_rt3070_rf_write(sc, 11, rf);
4389
4390         if (chan <= 14)
4391                 rf = txpow1 & 0x1f;
4392         else
4393                 rf = 0x40 | ((txpow1 & 0x18) << 1) | (txpow1 & 0x07);
4394         run_rt3070_rf_write(sc, 53, rf);
4395
4396         if (chan <= 14)
4397                 rf = txpow2 & 0x1f;
4398         else
4399                 rf = 0x40 | ((txpow2 & 0x18) << 1) | (txpow2 & 0x07);
4400         run_rt3070_rf_write(sc, 55, rf);
4401
4402         if (chan <= 14)
4403                 rf = txpow3 & 0x1f;
4404         else
4405                 rf = 0x40 | ((txpow3 & 0x18) << 1) | (txpow3 & 0x07);
4406         run_rt3070_rf_write(sc, 54, rf);
4407
4408         rf = RT3070_RF_BLOCK | RT3070_PLL_PD;
4409         if (sc->ntxchains == 3)
4410                 rf |= RT3070_TX0_PD | RT3070_TX1_PD | RT3070_TX2_PD;
4411         else
4412                 rf |= RT3070_TX0_PD | RT3070_TX1_PD;
4413         rf |= RT3070_RX0_PD | RT3070_RX1_PD | RT3070_RX2_PD;
4414         run_rt3070_rf_write(sc, 1, rf);
4415
4416         run_adjust_freq_offset(sc);
4417
4418         run_rt3070_rf_write(sc, 31, (chan <= 14) ? 0xa0 : 0x80);
4419
4420         h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
4421         run_rt3070_rf_read(sc, 30, &rf);
4422         rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
4423         run_rt3070_rf_write(sc, 30, rf);
4424
4425         run_rt3070_rf_read(sc, 36, &rf);
4426         if (chan <= 14)
4427                 rf |= 0x80;
4428         else
4429                 rf &= ~0x80;
4430         run_rt3070_rf_write(sc, 36, rf);
4431
4432         /* Set vcolo_bs. */
4433         run_rt3070_rf_write(sc, 34, (chan <= 14) ? 0x3c : 0x20);
4434         /* Set pfd_delay. */
4435         run_rt3070_rf_write(sc, 12, (chan <= 14) ? 0x1a : 0x12);
4436
4437         /* Set vco bias current control. */
4438         run_rt3070_rf_read(sc, 6, &rf);
4439         rf &= ~0xc0;
4440         if (chan <= 14)
4441                 rf |= 0x40;
4442         else if (chan <= 128)
4443                 rf |= 0x80;
4444         else
4445                 rf |= 0x40;
4446         run_rt3070_rf_write(sc, 6, rf);
4447
4448         run_rt3070_rf_read(sc, 30, &rf);
4449         rf = (rf & ~0x18) | 0x10;
4450         run_rt3070_rf_write(sc, 30, rf);
4451
4452         run_rt3070_rf_write(sc, 10, (chan <= 14) ? 0xd3 : 0xd8);
4453         run_rt3070_rf_write(sc, 13, (chan <= 14) ? 0x12 : 0x23);
4454
4455         run_rt3070_rf_read(sc, 51, &rf);
4456         rf = (rf & ~0x03) | 0x01;
4457         run_rt3070_rf_write(sc, 51, rf);
4458         /* Set tx_mx1_cc. */
4459         run_rt3070_rf_read(sc, 51, &rf);
4460         rf &= ~0x1c;
4461         rf |= (chan <= 14) ? 0x14 : 0x10;
4462         run_rt3070_rf_write(sc, 51, rf);
4463         /* Set tx_mx1_ic. */
4464         run_rt3070_rf_read(sc, 51, &rf);
4465         rf &= ~0xe0;
4466         rf |= (chan <= 14) ? 0x60 : 0x40;
4467         run_rt3070_rf_write(sc, 51, rf);
4468         /* Set tx_lo1_ic. */
4469         run_rt3070_rf_read(sc, 49, &rf);
4470         rf &= ~0x1c;
4471         rf |= (chan <= 14) ? 0x0c : 0x08;
4472         run_rt3070_rf_write(sc, 49, rf);
4473         /* Set tx_lo1_en. */
4474         run_rt3070_rf_read(sc, 50, &rf);
4475         run_rt3070_rf_write(sc, 50, rf & ~0x20);
4476         /* Set drv_cc. */
4477         run_rt3070_rf_read(sc, 57, &rf);
4478         rf &= ~0xfc;
4479         rf |= (chan <= 14) ?  0x6c : 0x3c;
4480         run_rt3070_rf_write(sc, 57, rf);
4481         /* Set rx_mix1_ic, rxa_lnactr, lna_vc, lna_inbias_en and lna_en. */
4482         run_rt3070_rf_write(sc, 44, (chan <= 14) ? 0x93 : 0x9b);
4483         /* Set drv_gnd_a, tx_vga_cc_a and tx_mx2_gain. */
4484         run_rt3070_rf_write(sc, 52, (chan <= 14) ? 0x45 : 0x05);
4485         /* Enable VCO calibration. */
4486         run_rt3070_rf_read(sc, 3, &rf);
4487         rf &= ~RT5390_VCOCAL;
4488         rf |= (chan <= 14) ? RT5390_VCOCAL : 0xbe;
4489         run_rt3070_rf_write(sc, 3, rf);
4490
4491         if (chan <= 14)
4492                 rf = 0x23;
4493         else if (chan <= 64)
4494                 rf = 0x36;
4495         else if (chan <= 128)
4496                 rf = 0x32;
4497         else
4498                 rf = 0x30;
4499         run_rt3070_rf_write(sc, 39, rf);
4500         if (chan <= 14)
4501                 rf = 0xbb;
4502         else if (chan <= 64)
4503                 rf = 0xeb;
4504         else if (chan <= 128)
4505                 rf = 0xb3;
4506         else
4507                 rf = 0x9b;
4508         run_rt3070_rf_write(sc, 45, rf);
4509
4510         /* Set FEQ/AEQ control. */
4511         run_bbp_write(sc, 105, 0x34);
4512 }
4513
4514 static void
4515 run_rt5390_set_chan(struct run_softc *sc, u_int chan)
4516 {
4517         int8_t txpow1, txpow2;
4518         uint8_t rf;
4519         int i;
4520
4521         /* find the settings for this channel (we know it exists) */
4522         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4523
4524         /* use Tx power values from EEPROM */
4525         txpow1 = sc->txpow1[i];
4526         txpow2 = sc->txpow2[i];
4527
4528         run_rt3070_rf_write(sc, 8, rt3070_freqs[i].n);
4529         run_rt3070_rf_write(sc, 9, rt3070_freqs[i].k & 0x0f);
4530         run_rt3070_rf_read(sc, 11, &rf);
4531         rf = (rf & ~0x03) | (rt3070_freqs[i].r & 0x03);
4532         run_rt3070_rf_write(sc, 11, rf);
4533
4534         run_rt3070_rf_read(sc, 49, &rf);
4535         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
4536         /* The valid range of the RF R49 is 0x00 to 0x27. */
4537         if ((rf & 0x3f) > 0x27)
4538                 rf = (rf & ~0x3f) | 0x27;
4539         run_rt3070_rf_write(sc, 49, rf);
4540
4541         if (sc->mac_ver == 0x5392) {
4542                 run_rt3070_rf_read(sc, 50, &rf);
4543                 rf = (rf & ~0x3f) | (txpow2 & 0x3f);
4544                 /* The valid range of the RF R50 is 0x00 to 0x27. */
4545                 if ((rf & 0x3f) > 0x27)
4546                         rf = (rf & ~0x3f) | 0x27;
4547                 run_rt3070_rf_write(sc, 50, rf);
4548         }
4549
4550         run_rt3070_rf_read(sc, 1, &rf);
4551         rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
4552         if (sc->mac_ver == 0x5392)
4553                 rf |= RT3070_RX1_PD | RT3070_TX1_PD;
4554         run_rt3070_rf_write(sc, 1, rf);
4555
4556         if (sc->mac_ver != 0x5392) {
4557                 run_rt3070_rf_read(sc, 2, &rf);
4558                 rf |= 0x80;
4559                 run_rt3070_rf_write(sc, 2, rf);
4560                 run_delay(sc, 10);
4561                 rf &= 0x7f;
4562                 run_rt3070_rf_write(sc, 2, rf);
4563         }
4564
4565         run_adjust_freq_offset(sc);
4566
4567         if (sc->mac_ver == 0x5392) {
4568                 /* Fix for RT5392C. */
4569                 if (sc->mac_rev >= 0x0223) {
4570                         if (chan <= 4)
4571                                 rf = 0x0f;
4572                         else if (chan >= 5 && chan <= 7)
4573                                 rf = 0x0e;
4574                         else
4575                                 rf = 0x0d;
4576                         run_rt3070_rf_write(sc, 23, rf);
4577
4578                         if (chan <= 4)
4579                                 rf = 0x0c;
4580                         else if (chan == 5)
4581                                 rf = 0x0b;
4582                         else if (chan >= 6 && chan <= 7)
4583                                 rf = 0x0a;
4584                         else if (chan >= 8 && chan <= 10)
4585                                 rf = 0x09;
4586                         else
4587                                 rf = 0x08;
4588                         run_rt3070_rf_write(sc, 59, rf);
4589                 } else {
4590                         if (chan <= 11)
4591                                 rf = 0x0f;
4592                         else
4593                                 rf = 0x0b;
4594                         run_rt3070_rf_write(sc, 59, rf);
4595                 }
4596         } else {
4597                 /* Fix for RT5390F. */
4598                 if (sc->mac_rev >= 0x0502) {
4599                         if (chan <= 11)
4600                                 rf = 0x43;
4601                         else
4602                                 rf = 0x23;
4603                         run_rt3070_rf_write(sc, 55, rf);
4604
4605                         if (chan <= 11)
4606                                 rf = 0x0f;
4607                         else if (chan == 12)
4608                                 rf = 0x0d;
4609                         else
4610                                 rf = 0x0b;
4611                         run_rt3070_rf_write(sc, 59, rf);
4612                 } else {
4613                         run_rt3070_rf_write(sc, 55, 0x44);
4614                         run_rt3070_rf_write(sc, 59, 0x8f);
4615                 }
4616         }
4617
4618         /* Enable VCO calibration. */
4619         run_rt3070_rf_read(sc, 3, &rf);
4620         rf |= RT5390_VCOCAL;
4621         run_rt3070_rf_write(sc, 3, rf);
4622 }
4623
4624 static void
4625 run_rt5592_set_chan(struct run_softc *sc, u_int chan)
4626 {
4627         const struct rt5592_freqs *freqs;
4628         uint32_t tmp;
4629         uint8_t reg, rf, txpow_bound;
4630         int8_t txpow1, txpow2;
4631         int i;
4632
4633         run_read(sc, RT5592_DEBUG_INDEX, &tmp);
4634         freqs = (tmp & RT5592_SEL_XTAL) ?
4635             rt5592_freqs_40mhz : rt5592_freqs_20mhz;
4636
4637         /* find the settings for this channel (we know it exists) */
4638         for (i = 0; rt2860_rf2850[i].chan != chan; i++, freqs++);
4639
4640         /* use Tx power values from EEPROM */
4641         txpow1 = sc->txpow1[i];
4642         txpow2 = sc->txpow2[i];
4643
4644         run_read(sc, RT3070_LDO_CFG0, &tmp);
4645         tmp &= ~0x1c000000;
4646         if (chan > 14)
4647                 tmp |= 0x14000000;
4648         run_write(sc, RT3070_LDO_CFG0, tmp);
4649
4650         /* N setting. */
4651         run_rt3070_rf_write(sc, 8, freqs->n & 0xff);
4652         run_rt3070_rf_read(sc, 9, &rf);
4653         rf &= ~(1 << 4);
4654         rf |= ((freqs->n & 0x0100) >> 8) << 4;
4655         run_rt3070_rf_write(sc, 9, rf);
4656
4657         /* K setting. */
4658         run_rt3070_rf_read(sc, 9, &rf);
4659         rf &= ~0x0f;
4660         rf |= (freqs->k & 0x0f);
4661         run_rt3070_rf_write(sc, 9, rf);
4662
4663         /* Mode setting. */
4664         run_rt3070_rf_read(sc, 11, &rf);
4665         rf &= ~0x0c;
4666         rf |= ((freqs->m - 0x8) & 0x3) << 2;
4667         run_rt3070_rf_write(sc, 11, rf);
4668         run_rt3070_rf_read(sc, 9, &rf);
4669         rf &= ~(1 << 7);
4670         rf |= (((freqs->m - 0x8) & 0x4) >> 2) << 7;
4671         run_rt3070_rf_write(sc, 9, rf);
4672
4673         /* R setting. */
4674         run_rt3070_rf_read(sc, 11, &rf);
4675         rf &= ~0x03;
4676         rf |= (freqs->r - 0x1);
4677         run_rt3070_rf_write(sc, 11, rf);
4678
4679         if (chan <= 14) {
4680                 /* Initialize RF registers for 2GHZ. */
4681                 for (i = 0; i < nitems(rt5592_2ghz_def_rf); i++) {
4682                         run_rt3070_rf_write(sc, rt5592_2ghz_def_rf[i].reg,
4683                             rt5592_2ghz_def_rf[i].val);
4684                 }
4685
4686                 rf = (chan <= 10) ? 0x07 : 0x06;
4687                 run_rt3070_rf_write(sc, 23, rf);
4688                 run_rt3070_rf_write(sc, 59, rf);
4689
4690                 run_rt3070_rf_write(sc, 55, 0x43);
4691
4692                 /*
4693                  * RF R49/R50 Tx power ALC code.
4694                  * G-band bit<7:6>=1:0, bit<5:0> range from 0x0 ~ 0x27.
4695                  */
4696                 reg = 2;
4697                 txpow_bound = 0x27;
4698         } else {
4699                 /* Initialize RF registers for 5GHZ. */
4700                 for (i = 0; i < nitems(rt5592_5ghz_def_rf); i++) {
4701                         run_rt3070_rf_write(sc, rt5592_5ghz_def_rf[i].reg,
4702                             rt5592_5ghz_def_rf[i].val);
4703                 }
4704                 for (i = 0; i < nitems(rt5592_chan_5ghz); i++) {
4705                         if (chan >= rt5592_chan_5ghz[i].firstchan &&
4706                             chan <= rt5592_chan_5ghz[i].lastchan) {
4707                                 run_rt3070_rf_write(sc, rt5592_chan_5ghz[i].reg,
4708                                     rt5592_chan_5ghz[i].val);
4709                         }
4710                 }
4711
4712                 /*
4713                  * RF R49/R50 Tx power ALC code.
4714                  * A-band bit<7:6>=1:1, bit<5:0> range from 0x0 ~ 0x2b.
4715                  */
4716                 reg = 3;
4717                 txpow_bound = 0x2b;
4718         }
4719
4720         /* RF R49 ch0 Tx power ALC code. */
4721         run_rt3070_rf_read(sc, 49, &rf);
4722         rf &= ~0xc0;
4723         rf |= (reg << 6);
4724         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
4725         if ((rf & 0x3f) > txpow_bound)
4726                 rf = (rf & ~0x3f) | txpow_bound;
4727         run_rt3070_rf_write(sc, 49, rf);
4728
4729         /* RF R50 ch1 Tx power ALC code. */
4730         run_rt3070_rf_read(sc, 50, &rf);
4731         rf &= ~(1 << 7 | 1 << 6);
4732         rf |= (reg << 6);
4733         rf = (rf & ~0x3f) | (txpow2 & 0x3f);
4734         if ((rf & 0x3f) > txpow_bound)
4735                 rf = (rf & ~0x3f) | txpow_bound;
4736         run_rt3070_rf_write(sc, 50, rf);
4737
4738         /* Enable RF_BLOCK, PLL_PD, RX0_PD, and TX0_PD. */
4739         run_rt3070_rf_read(sc, 1, &rf);
4740         rf |= (RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD);
4741         if (sc->ntxchains > 1)
4742                 rf |= RT3070_TX1_PD;
4743         if (sc->nrxchains > 1)
4744                 rf |= RT3070_RX1_PD;
4745         run_rt3070_rf_write(sc, 1, rf);
4746
4747         run_rt3070_rf_write(sc, 6, 0xe4);
4748
4749         run_rt3070_rf_write(sc, 30, 0x10);
4750         run_rt3070_rf_write(sc, 31, 0x80);
4751         run_rt3070_rf_write(sc, 32, 0x80);
4752
4753         run_adjust_freq_offset(sc);
4754
4755         /* Enable VCO calibration. */
4756         run_rt3070_rf_read(sc, 3, &rf);
4757         rf |= RT5390_VCOCAL;
4758         run_rt3070_rf_write(sc, 3, rf);
4759 }
4760
4761 static void
4762 run_set_rx_antenna(struct run_softc *sc, int aux)
4763 {
4764         uint32_t tmp;
4765         uint8_t bbp152;
4766
4767         if (aux) {
4768                 if (sc->rf_rev == RT5390_RF_5370) {
4769                         run_bbp_read(sc, 152, &bbp152);
4770                         run_bbp_write(sc, 152, bbp152 & ~0x80);
4771                 } else {
4772                         run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 0);
4773                         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4774                         run_write(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
4775                 }
4776         } else {
4777                 if (sc->rf_rev == RT5390_RF_5370) {
4778                         run_bbp_read(sc, 152, &bbp152);
4779                         run_bbp_write(sc, 152, bbp152 | 0x80);
4780                 } else {
4781                         run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 1);
4782                         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4783                         run_write(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
4784                 }
4785         }
4786 }
4787
4788 static int
4789 run_set_chan(struct run_softc *sc, struct ieee80211_channel *c)
4790 {
4791         struct ieee80211com *ic = &sc->sc_ic;
4792         u_int chan, group;
4793
4794         chan = ieee80211_chan2ieee(ic, c);
4795         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
4796                 return (EINVAL);
4797
4798         if (sc->mac_ver == 0x5592)
4799                 run_rt5592_set_chan(sc, chan);
4800         else if (sc->mac_ver >= 0x5390)
4801                 run_rt5390_set_chan(sc, chan);
4802         else if (sc->mac_ver == 0x3593)
4803                 run_rt3593_set_chan(sc, chan);
4804         else if (sc->mac_ver == 0x3572)
4805                 run_rt3572_set_chan(sc, chan);
4806         else if (sc->mac_ver >= 0x3070)
4807                 run_rt3070_set_chan(sc, chan);
4808         else
4809                 run_rt2870_set_chan(sc, chan);
4810
4811         /* determine channel group */
4812         if (chan <= 14)
4813                 group = 0;
4814         else if (chan <= 64)
4815                 group = 1;
4816         else if (chan <= 128)
4817                 group = 2;
4818         else
4819                 group = 3;
4820
4821         /* XXX necessary only when group has changed! */
4822         run_select_chan_group(sc, group);
4823
4824         run_delay(sc, 10);
4825
4826         /* Perform IQ calibration. */
4827         if (sc->mac_ver >= 0x5392)
4828                 run_iq_calib(sc, chan);
4829
4830         return (0);
4831 }
4832
4833 static void
4834 run_set_channel(struct ieee80211com *ic)
4835 {
4836         struct run_softc *sc = ic->ic_softc;
4837
4838         RUN_LOCK(sc);
4839         run_set_chan(sc, ic->ic_curchan);
4840         RUN_UNLOCK(sc);
4841
4842         return;
4843 }
4844
4845 static void
4846 run_getradiocaps(struct ieee80211com *ic,
4847     int maxchans, int *nchans, struct ieee80211_channel chans[])
4848 {
4849         struct run_softc *sc = ic->ic_softc;
4850         uint8_t bands[IEEE80211_MODE_BYTES];
4851
4852         memset(bands, 0, sizeof(bands));
4853         setbit(bands, IEEE80211_MODE_11B);
4854         setbit(bands, IEEE80211_MODE_11G);
4855         ieee80211_add_channels_default_2ghz(chans, maxchans, nchans, bands, 0);
4856
4857         if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850 ||
4858             sc->rf_rev == RT3070_RF_3052 || sc->rf_rev == RT3593_RF_3053 ||
4859             sc->rf_rev == RT5592_RF_5592) {
4860                 setbit(bands, IEEE80211_MODE_11A);
4861                 ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
4862                     run_chan_5ghz, nitems(run_chan_5ghz), bands, 0);
4863         }
4864 }
4865
4866 static void
4867 run_scan_start(struct ieee80211com *ic)
4868 {
4869         struct run_softc *sc = ic->ic_softc;
4870
4871         RUN_LOCK(sc);
4872
4873         /* abort TSF synchronization */
4874         run_disable_tsf(sc);
4875         run_set_bssid(sc, ieee80211broadcastaddr);
4876
4877         RUN_UNLOCK(sc);
4878
4879         return;
4880 }
4881
4882 static void
4883 run_scan_end(struct ieee80211com *ic)
4884 {
4885         struct run_softc *sc = ic->ic_softc;
4886
4887         RUN_LOCK(sc);
4888
4889         run_enable_tsf_sync(sc);
4890         run_set_bssid(sc, sc->sc_bssid);
4891
4892         RUN_UNLOCK(sc);
4893
4894         return;
4895 }
4896
4897 /*
4898  * Could be called from ieee80211_node_timeout()
4899  * (non-sleepable thread)
4900  */
4901 static void
4902 run_update_beacon(struct ieee80211vap *vap, int item)
4903 {
4904         struct ieee80211com *ic = vap->iv_ic;
4905         struct ieee80211_beacon_offsets *bo = &vap->iv_bcn_off;
4906         struct ieee80211_node *ni = vap->iv_bss;
4907         struct run_softc *sc = ic->ic_softc;
4908         struct run_vap *rvp = RUN_VAP(vap);
4909         int mcast = 0;
4910         uint32_t i;
4911
4912         switch (item) {
4913         case IEEE80211_BEACON_ERP:
4914                 run_updateslot(ic);
4915                 break;
4916         case IEEE80211_BEACON_HTINFO:
4917                 run_updateprot(ic);
4918                 break;
4919         case IEEE80211_BEACON_TIM:
4920                 mcast = 1;      /*TODO*/
4921                 break;
4922         default:
4923                 break;
4924         }
4925
4926         setbit(bo->bo_flags, item);
4927         if (rvp->beacon_mbuf == NULL) {
4928                 rvp->beacon_mbuf = ieee80211_beacon_alloc(ni);
4929                 if (rvp->beacon_mbuf == NULL)
4930                         return;
4931         }
4932         ieee80211_beacon_update(ni, rvp->beacon_mbuf, mcast);
4933
4934         i = RUN_CMDQ_GET(&sc->cmdq_store);
4935         RUN_DPRINTF(sc, RUN_DEBUG_BEACON, "cmdq_store=%d\n", i);
4936         sc->cmdq[i].func = run_update_beacon_cb;
4937         sc->cmdq[i].arg0 = vap;
4938         ieee80211_runtask(ic, &sc->cmdq_task);
4939
4940         return;
4941 }
4942
4943 static void
4944 run_update_beacon_cb(void *arg)
4945 {
4946         struct ieee80211vap *vap = arg;
4947         struct ieee80211_node *ni = vap->iv_bss;
4948         struct run_vap *rvp = RUN_VAP(vap);
4949         struct ieee80211com *ic = vap->iv_ic;
4950         struct run_softc *sc = ic->ic_softc;
4951         struct rt2860_txwi txwi;
4952         struct mbuf *m;
4953         uint16_t txwisize;
4954         uint8_t ridx;
4955
4956         if (ni->ni_chan == IEEE80211_CHAN_ANYC)
4957                 return;
4958         if (ic->ic_bsschan == IEEE80211_CHAN_ANYC)
4959                 return;
4960
4961         /*
4962          * No need to call ieee80211_beacon_update(), run_update_beacon()
4963          * is taking care of appropriate calls.
4964          */
4965         if (rvp->beacon_mbuf == NULL) {
4966                 rvp->beacon_mbuf = ieee80211_beacon_alloc(ni);
4967                 if (rvp->beacon_mbuf == NULL)
4968                         return;
4969         }
4970         m = rvp->beacon_mbuf;
4971
4972         memset(&txwi, 0, sizeof(txwi));
4973         txwi.wcid = 0xff;
4974         txwi.len = htole16(m->m_pkthdr.len);
4975
4976         /* send beacons at the lowest available rate */
4977         ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
4978             RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
4979         txwi.phy = htole16(rt2860_rates[ridx].mcs);
4980         if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4981                 txwi.phy |= htole16(RT2860_PHY_OFDM);
4982         txwi.txop = RT2860_TX_TXOP_HT;
4983         txwi.flags = RT2860_TX_TS;
4984         txwi.xflags = RT2860_TX_NSEQ;
4985
4986         txwisize = (sc->mac_ver == 0x5592) ?
4987             sizeof(txwi) + sizeof(uint32_t) : sizeof(txwi);
4988         run_write_region_1(sc, RT2860_BCN_BASE(rvp->rvp_id), (uint8_t *)&txwi,
4989             txwisize);
4990         run_write_region_1(sc, RT2860_BCN_BASE(rvp->rvp_id) + txwisize,
4991             mtod(m, uint8_t *), (m->m_pkthdr.len + 1) & ~1);
4992 }
4993
4994 static void
4995 run_updateprot(struct ieee80211com *ic)
4996 {
4997         struct run_softc *sc = ic->ic_softc;
4998         uint32_t i;
4999
5000         i = RUN_CMDQ_GET(&sc->cmdq_store);
5001         RUN_DPRINTF(sc, RUN_DEBUG_BEACON, "cmdq_store=%d\n", i);
5002         sc->cmdq[i].func = run_updateprot_cb;
5003         sc->cmdq[i].arg0 = ic;
5004         ieee80211_runtask(ic, &sc->cmdq_task);
5005 }
5006
5007 static void
5008 run_updateprot_cb(void *arg)
5009 {
5010         struct ieee80211com *ic = arg;
5011         struct run_softc *sc = ic->ic_softc;
5012         uint32_t tmp;
5013
5014         tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
5015         /* setup protection frame rate (MCS code) */
5016         tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
5017             rt2860_rates[RT2860_RIDX_OFDM6].mcs | RT2860_PHY_OFDM :
5018             rt2860_rates[RT2860_RIDX_CCK11].mcs;
5019
5020         /* CCK frames don't require protection */
5021         run_write(sc, RT2860_CCK_PROT_CFG, tmp);
5022         if (ic->ic_flags & IEEE80211_F_USEPROT) {
5023                 if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
5024                         tmp |= RT2860_PROT_CTRL_RTS_CTS;
5025                 else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
5026                         tmp |= RT2860_PROT_CTRL_CTS;
5027         }
5028         run_write(sc, RT2860_OFDM_PROT_CFG, tmp);
5029 }
5030
5031 static void
5032 run_usb_timeout_cb(void *arg)
5033 {
5034         struct ieee80211vap *vap = arg;
5035         struct run_softc *sc = vap->iv_ic->ic_softc;
5036
5037         RUN_LOCK_ASSERT(sc, MA_OWNED);
5038
5039         if(vap->iv_state == IEEE80211_S_RUN &&
5040             vap->iv_opmode != IEEE80211_M_STA)
5041                 run_reset_livelock(sc);
5042         else if (vap->iv_state == IEEE80211_S_SCAN) {
5043                 RUN_DPRINTF(sc, RUN_DEBUG_USB | RUN_DEBUG_STATE,
5044                     "timeout caused by scan\n");
5045                 /* cancel bgscan */
5046                 ieee80211_cancel_scan(vap);
5047         } else
5048                 RUN_DPRINTF(sc, RUN_DEBUG_USB | RUN_DEBUG_STATE,
5049                     "timeout by unknown cause\n");
5050 }
5051
5052 static void
5053 run_reset_livelock(struct run_softc *sc)
5054 {
5055         uint32_t tmp;
5056
5057         RUN_LOCK_ASSERT(sc, MA_OWNED);
5058
5059         /*
5060          * In IBSS or HostAP modes (when the hardware sends beacons), the MAC
5061          * can run into a livelock and start sending CTS-to-self frames like
5062          * crazy if protection is enabled.  Reset MAC/BBP for a while
5063          */
5064         run_read(sc, RT2860_DEBUG, &tmp);
5065         RUN_DPRINTF(sc, RUN_DEBUG_RESET, "debug reg %08x\n", tmp);
5066         if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
5067                 RUN_DPRINTF(sc, RUN_DEBUG_RESET,
5068                     "CTS-to-self livelock detected\n");
5069                 run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
5070                 run_delay(sc, 1);
5071                 run_write(sc, RT2860_MAC_SYS_CTRL,
5072                     RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
5073         }
5074 }
5075
5076 static void
5077 run_update_promisc_locked(struct run_softc *sc)
5078 {
5079         uint32_t tmp;
5080
5081         run_read(sc, RT2860_RX_FILTR_CFG, &tmp);
5082
5083         tmp |= RT2860_DROP_UC_NOME;
5084         if (sc->sc_ic.ic_promisc > 0)
5085                 tmp &= ~RT2860_DROP_UC_NOME;
5086
5087         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
5088
5089         RUN_DPRINTF(sc, RUN_DEBUG_RECV, "%s promiscuous mode\n",
5090             (sc->sc_ic.ic_promisc > 0) ?  "entering" : "leaving");
5091 }
5092
5093 static void
5094 run_update_promisc(struct ieee80211com *ic)
5095 {
5096         struct run_softc *sc = ic->ic_softc;
5097
5098         if ((sc->sc_flags & RUN_RUNNING) == 0)
5099                 return;
5100
5101         RUN_LOCK(sc);
5102         run_update_promisc_locked(sc);
5103         RUN_UNLOCK(sc);
5104 }
5105
5106 static void
5107 run_enable_tsf_sync(struct run_softc *sc)
5108 {
5109         struct ieee80211com *ic = &sc->sc_ic;
5110         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5111         uint32_t tmp;
5112
5113         RUN_DPRINTF(sc, RUN_DEBUG_BEACON, "rvp_id=%d ic_opmode=%d\n",
5114             RUN_VAP(vap)->rvp_id, ic->ic_opmode);
5115
5116         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
5117         tmp &= ~0x1fffff;
5118         tmp |= vap->iv_bss->ni_intval * 16;
5119         tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
5120
5121         if (ic->ic_opmode == IEEE80211_M_STA) {
5122                 /*
5123                  * Local TSF is always updated with remote TSF on beacon
5124                  * reception.
5125                  */
5126                 tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
5127         } else if (ic->ic_opmode == IEEE80211_M_IBSS) {
5128                 tmp |= RT2860_BCN_TX_EN;
5129                 /*
5130                  * Local TSF is updated with remote TSF on beacon reception
5131                  * only if the remote TSF is greater than local TSF.
5132                  */
5133                 tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
5134         } else if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5135                     ic->ic_opmode == IEEE80211_M_MBSS) {
5136                 tmp |= RT2860_BCN_TX_EN;
5137                 /* SYNC with nobody */
5138                 tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
5139         } else {
5140                 RUN_DPRINTF(sc, RUN_DEBUG_BEACON,
5141                     "Enabling TSF failed. undefined opmode\n");
5142                 return;
5143         }
5144
5145         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
5146 }
5147
5148 static void
5149 run_enable_tsf(struct run_softc *sc)
5150 {
5151         uint32_t tmp;
5152
5153         if (run_read(sc, RT2860_BCN_TIME_CFG, &tmp) == 0) {
5154                 tmp &= ~(RT2860_BCN_TX_EN | RT2860_TBTT_TIMER_EN);
5155                 tmp |= RT2860_TSF_TIMER_EN;
5156                 run_write(sc, RT2860_BCN_TIME_CFG, tmp);
5157         }
5158 }
5159
5160 static void
5161 run_disable_tsf(struct run_softc *sc)
5162 {
5163         uint32_t tmp;
5164
5165         if (run_read(sc, RT2860_BCN_TIME_CFG, &tmp) == 0) {
5166                 tmp &= ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
5167                     RT2860_TBTT_TIMER_EN);
5168                 run_write(sc, RT2860_BCN_TIME_CFG, tmp);
5169         }
5170 }
5171
5172 static void
5173 run_get_tsf(struct run_softc *sc, uint64_t *buf)
5174 {
5175         run_read_region_1(sc, RT2860_TSF_TIMER_DW0, (uint8_t *)buf,
5176             sizeof(*buf));
5177 }
5178
5179 static void
5180 run_enable_mrr(struct run_softc *sc)
5181 {
5182 #define CCK(mcs)        (mcs)
5183 #define OFDM(mcs)       (1 << 3 | (mcs))
5184         run_write(sc, RT2860_LG_FBK_CFG0,
5185             OFDM(6) << 28 |     /* 54->48 */
5186             OFDM(5) << 24 |     /* 48->36 */
5187             OFDM(4) << 20 |     /* 36->24 */
5188             OFDM(3) << 16 |     /* 24->18 */
5189             OFDM(2) << 12 |     /* 18->12 */
5190             OFDM(1) <<  8 |     /* 12-> 9 */
5191             OFDM(0) <<  4 |     /*  9-> 6 */
5192             OFDM(0));           /*  6-> 6 */
5193
5194         run_write(sc, RT2860_LG_FBK_CFG1,
5195             CCK(2) << 12 |      /* 11->5.5 */
5196             CCK(1) <<  8 |      /* 5.5-> 2 */
5197             CCK(0) <<  4 |      /*   2-> 1 */
5198             CCK(0));            /*   1-> 1 */
5199 #undef OFDM
5200 #undef CCK
5201 }
5202
5203 static void
5204 run_set_txpreamble(struct run_softc *sc)
5205 {
5206         struct ieee80211com *ic = &sc->sc_ic;
5207         uint32_t tmp;
5208
5209         run_read(sc, RT2860_AUTO_RSP_CFG, &tmp);
5210         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
5211                 tmp |= RT2860_CCK_SHORT_EN;
5212         else
5213                 tmp &= ~RT2860_CCK_SHORT_EN;
5214         run_write(sc, RT2860_AUTO_RSP_CFG, tmp);
5215 }
5216
5217 static void
5218 run_set_basicrates(struct run_softc *sc)
5219 {
5220         struct ieee80211com *ic = &sc->sc_ic;
5221
5222         /* set basic rates mask */
5223         if (ic->ic_curmode == IEEE80211_MODE_11B)
5224                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
5225         else if (ic->ic_curmode == IEEE80211_MODE_11A)
5226                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
5227         else    /* 11g */
5228                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
5229 }
5230
5231 static void
5232 run_set_leds(struct run_softc *sc, uint16_t which)
5233 {
5234         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
5235             which | (sc->leds & 0x7f));
5236 }
5237
5238 static void
5239 run_set_bssid(struct run_softc *sc, const uint8_t *bssid)
5240 {
5241         run_write(sc, RT2860_MAC_BSSID_DW0,
5242             bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
5243         run_write(sc, RT2860_MAC_BSSID_DW1,
5244             bssid[4] | bssid[5] << 8);
5245 }
5246
5247 static void
5248 run_set_macaddr(struct run_softc *sc, const uint8_t *addr)
5249 {
5250         run_write(sc, RT2860_MAC_ADDR_DW0,
5251             addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
5252         run_write(sc, RT2860_MAC_ADDR_DW1,
5253             addr[4] | addr[5] << 8 | 0xff << 16);
5254 }
5255
5256 static void
5257 run_updateslot(struct ieee80211com *ic)
5258 {
5259         struct run_softc *sc = ic->ic_softc;
5260         uint32_t i;
5261
5262         i = RUN_CMDQ_GET(&sc->cmdq_store);
5263         RUN_DPRINTF(sc, RUN_DEBUG_BEACON, "cmdq_store=%d\n", i);
5264         sc->cmdq[i].func = run_updateslot_cb;
5265         sc->cmdq[i].arg0 = ic;
5266         ieee80211_runtask(ic, &sc->cmdq_task);
5267
5268         return;
5269 }
5270
5271 /* ARGSUSED */
5272 static void
5273 run_updateslot_cb(void *arg)
5274 {
5275         struct ieee80211com *ic = arg;
5276         struct run_softc *sc = ic->ic_softc;
5277         uint32_t tmp;
5278
5279         run_read(sc, RT2860_BKOFF_SLOT_CFG, &tmp);
5280         tmp &= ~0xff;
5281         tmp |= IEEE80211_GET_SLOTTIME(ic);
5282         run_write(sc, RT2860_BKOFF_SLOT_CFG, tmp);
5283 }
5284
5285 static void
5286 run_update_mcast(struct ieee80211com *ic)
5287 {
5288 }
5289
5290 static int8_t
5291 run_rssi2dbm(struct run_softc *sc, uint8_t rssi, uint8_t rxchain)
5292 {
5293         struct ieee80211com *ic = &sc->sc_ic;
5294         struct ieee80211_channel *c = ic->ic_curchan;
5295         int delta;
5296
5297         if (IEEE80211_IS_CHAN_5GHZ(c)) {
5298                 u_int chan = ieee80211_chan2ieee(ic, c);
5299                 delta = sc->rssi_5ghz[rxchain];
5300
5301                 /* determine channel group */
5302                 if (chan <= 64)
5303                         delta -= sc->lna[1];
5304                 else if (chan <= 128)
5305                         delta -= sc->lna[2];
5306                 else
5307                         delta -= sc->lna[3];
5308         } else
5309                 delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
5310
5311         return (-12 - delta - rssi);
5312 }
5313
5314 static void
5315 run_rt5390_bbp_init(struct run_softc *sc)
5316 {
5317         u_int i;
5318         uint8_t bbp;
5319
5320         /* Apply maximum likelihood detection for 2 stream case. */
5321         run_bbp_read(sc, 105, &bbp);
5322         if (sc->nrxchains > 1)
5323                 run_bbp_write(sc, 105, bbp | RT5390_MLD);
5324
5325         /* Avoid data lost and CRC error. */
5326         run_bbp_read(sc, 4, &bbp);
5327         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5328
5329         if (sc->mac_ver == 0x5592) {
5330                 for (i = 0; i < nitems(rt5592_def_bbp); i++) {
5331                         run_bbp_write(sc, rt5592_def_bbp[i].reg,
5332                             rt5592_def_bbp[i].val);
5333                 }
5334                 for (i = 0; i < nitems(rt5592_bbp_r196); i++) {
5335                         run_bbp_write(sc, 195, i + 0x80);
5336                         run_bbp_write(sc, 196, rt5592_bbp_r196[i]);
5337                 }
5338         } else {
5339                 for (i = 0; i < nitems(rt5390_def_bbp); i++) {
5340                         run_bbp_write(sc, rt5390_def_bbp[i].reg,
5341                             rt5390_def_bbp[i].val);
5342                 }
5343         }
5344         if (sc->mac_ver == 0x5392) {
5345                 run_bbp_write(sc, 88, 0x90);
5346                 run_bbp_write(sc, 95, 0x9a);
5347                 run_bbp_write(sc, 98, 0x12);
5348                 run_bbp_write(sc, 106, 0x12);
5349                 run_bbp_write(sc, 134, 0xd0);
5350                 run_bbp_write(sc, 135, 0xf6);
5351                 run_bbp_write(sc, 148, 0x84);
5352         }
5353
5354         run_bbp_read(sc, 152, &bbp);
5355         run_bbp_write(sc, 152, bbp | 0x80);
5356
5357         /* Fix BBP254 for RT5592C. */
5358         if (sc->mac_ver == 0x5592 && sc->mac_rev >= 0x0221) {
5359                 run_bbp_read(sc, 254, &bbp);
5360                 run_bbp_write(sc, 254, bbp | 0x80);
5361         }
5362
5363         /* Disable hardware antenna diversity. */
5364         if (sc->mac_ver == 0x5390)
5365                 run_bbp_write(sc, 154, 0);
5366
5367         /* Initialize Rx CCK/OFDM frequency offset report. */
5368         run_bbp_write(sc, 142, 1);
5369         run_bbp_write(sc, 143, 57);
5370 }
5371
5372 static int
5373 run_bbp_init(struct run_softc *sc)
5374 {
5375         int i, error, ntries;
5376         uint8_t bbp0;
5377
5378         /* wait for BBP to wake up */
5379         for (ntries = 0; ntries < 20; ntries++) {
5380                 if ((error = run_bbp_read(sc, 0, &bbp0)) != 0)
5381                         return error;
5382                 if (bbp0 != 0 && bbp0 != 0xff)
5383                         break;
5384         }
5385         if (ntries == 20)
5386                 return (ETIMEDOUT);
5387
5388         /* initialize BBP registers to default values */
5389         if (sc->mac_ver >= 0x5390)
5390                 run_rt5390_bbp_init(sc);
5391         else {
5392                 for (i = 0; i < nitems(rt2860_def_bbp); i++) {
5393                         run_bbp_write(sc, rt2860_def_bbp[i].reg,
5394                             rt2860_def_bbp[i].val);
5395                 }
5396         }
5397
5398         if (sc->mac_ver == 0x3593) {
5399                 run_bbp_write(sc, 79, 0x13);
5400                 run_bbp_write(sc, 80, 0x05);
5401                 run_bbp_write(sc, 81, 0x33);
5402                 run_bbp_write(sc, 86, 0x46);
5403                 run_bbp_write(sc, 137, 0x0f);
5404         }
5405
5406         /* fix BBP84 for RT2860E */
5407         if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
5408                 run_bbp_write(sc, 84, 0x19);
5409
5410         if (sc->mac_ver >= 0x3070 && (sc->mac_ver != 0x3593 &&
5411             sc->mac_ver != 0x5592)) {
5412                 run_bbp_write(sc, 79, 0x13);
5413                 run_bbp_write(sc, 80, 0x05);
5414                 run_bbp_write(sc, 81, 0x33);
5415         } else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
5416                 run_bbp_write(sc, 69, 0x16);
5417                 run_bbp_write(sc, 73, 0x12);
5418         }
5419         return (0);
5420 }
5421
5422 static int
5423 run_rt3070_rf_init(struct run_softc *sc)
5424 {
5425         uint32_t tmp;
5426         uint8_t bbp4, mingain, rf, target;
5427         u_int i;
5428
5429         run_rt3070_rf_read(sc, 30, &rf);
5430         /* toggle RF R30 bit 7 */
5431         run_rt3070_rf_write(sc, 30, rf | 0x80);
5432         run_delay(sc, 10);
5433         run_rt3070_rf_write(sc, 30, rf & ~0x80);
5434
5435         /* initialize RF registers to default value */
5436         if (sc->mac_ver == 0x3572) {
5437                 for (i = 0; i < nitems(rt3572_def_rf); i++) {
5438                         run_rt3070_rf_write(sc, rt3572_def_rf[i].reg,
5439                             rt3572_def_rf[i].val);
5440                 }
5441         } else {
5442                 for (i = 0; i < nitems(rt3070_def_rf); i++) {
5443                         run_rt3070_rf_write(sc, rt3070_def_rf[i].reg,
5444                             rt3070_def_rf[i].val);
5445                 }
5446         }
5447
5448         if (sc->mac_ver == 0x3070 && sc->mac_rev < 0x0201) {
5449                 /*
5450                  * Change voltage from 1.2V to 1.35V for RT3070.
5451                  * The DAC issue (RT3070_LDO_CFG0) has been fixed
5452                  * in RT3070(F).
5453                  */
5454                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5455                 tmp = (tmp & ~0x0f000000) | 0x0d000000;
5456                 run_write(sc, RT3070_LDO_CFG0, tmp);
5457
5458         } else if (sc->mac_ver == 0x3071) {
5459                 run_rt3070_rf_read(sc, 6, &rf);
5460                 run_rt3070_rf_write(sc, 6, rf | 0x40);
5461                 run_rt3070_rf_write(sc, 31, 0x14);
5462
5463                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5464                 tmp &= ~0x1f000000;
5465                 if (sc->mac_rev < 0x0211)
5466                         tmp |= 0x0d000000;      /* 1.3V */
5467                 else
5468                         tmp |= 0x01000000;      /* 1.2V */
5469                 run_write(sc, RT3070_LDO_CFG0, tmp);
5470
5471                 /* patch LNA_PE_G1 */
5472                 run_read(sc, RT3070_GPIO_SWITCH, &tmp);
5473                 run_write(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
5474
5475         } else if (sc->mac_ver == 0x3572) {
5476                 run_rt3070_rf_read(sc, 6, &rf);
5477                 run_rt3070_rf_write(sc, 6, rf | 0x40);
5478
5479                 /* increase voltage from 1.2V to 1.35V */
5480                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5481                 tmp = (tmp & ~0x1f000000) | 0x0d000000;
5482                 run_write(sc, RT3070_LDO_CFG0, tmp);
5483
5484                 if (sc->mac_rev < 0x0211 || !sc->patch_dac) {
5485                         run_delay(sc, 1);       /* wait for 1msec */
5486                         /* decrease voltage back to 1.2V */
5487                         tmp = (tmp & ~0x1f000000) | 0x01000000;
5488                         run_write(sc, RT3070_LDO_CFG0, tmp);
5489                 }
5490         }
5491
5492         /* select 20MHz bandwidth */
5493         run_rt3070_rf_read(sc, 31, &rf);
5494         run_rt3070_rf_write(sc, 31, rf & ~0x20);
5495
5496         /* calibrate filter for 20MHz bandwidth */
5497         sc->rf24_20mhz = 0x1f;  /* default value */
5498         target = (sc->mac_ver < 0x3071) ? 0x16 : 0x13;
5499         run_rt3070_filter_calib(sc, 0x07, target, &sc->rf24_20mhz);
5500
5501         /* select 40MHz bandwidth */
5502         run_bbp_read(sc, 4, &bbp4);
5503         run_bbp_write(sc, 4, (bbp4 & ~0x18) | 0x10);
5504         run_rt3070_rf_read(sc, 31, &rf);
5505         run_rt3070_rf_write(sc, 31, rf | 0x20);
5506
5507         /* calibrate filter for 40MHz bandwidth */
5508         sc->rf24_40mhz = 0x2f;  /* default value */
5509         target = (sc->mac_ver < 0x3071) ? 0x19 : 0x15;
5510         run_rt3070_filter_calib(sc, 0x27, target, &sc->rf24_40mhz);
5511
5512         /* go back to 20MHz bandwidth */
5513         run_bbp_read(sc, 4, &bbp4);
5514         run_bbp_write(sc, 4, bbp4 & ~0x18);
5515
5516         if (sc->mac_ver == 0x3572) {
5517                 /* save default BBP registers 25 and 26 values */
5518                 run_bbp_read(sc, 25, &sc->bbp25);
5519                 run_bbp_read(sc, 26, &sc->bbp26);
5520         } else if (sc->mac_rev < 0x0201 || sc->mac_rev < 0x0211)
5521                 run_rt3070_rf_write(sc, 27, 0x03);
5522
5523         run_read(sc, RT3070_OPT_14, &tmp);
5524         run_write(sc, RT3070_OPT_14, tmp | 1);
5525
5526         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
5527                 run_rt3070_rf_read(sc, 17, &rf);
5528                 rf &= ~RT3070_TX_LO1;
5529                 if ((sc->mac_ver == 0x3070 ||
5530                      (sc->mac_ver == 0x3071 && sc->mac_rev >= 0x0211)) &&
5531                     !sc->ext_2ghz_lna)
5532                         rf |= 0x20;     /* fix for long range Rx issue */
5533                 mingain = (sc->mac_ver == 0x3070) ? 1 : 2;
5534                 if (sc->txmixgain_2ghz >= mingain)
5535                         rf = (rf & ~0x7) | sc->txmixgain_2ghz;
5536                 run_rt3070_rf_write(sc, 17, rf);
5537         }
5538
5539         if (sc->mac_ver == 0x3071) {
5540                 run_rt3070_rf_read(sc, 1, &rf);
5541                 rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
5542                 rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
5543                 run_rt3070_rf_write(sc, 1, rf);
5544
5545                 run_rt3070_rf_read(sc, 15, &rf);
5546                 run_rt3070_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
5547
5548                 run_rt3070_rf_read(sc, 20, &rf);
5549                 run_rt3070_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
5550
5551                 run_rt3070_rf_read(sc, 21, &rf);
5552                 run_rt3070_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
5553         }
5554
5555         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
5556                 /* fix Tx to Rx IQ glitch by raising RF voltage */
5557                 run_rt3070_rf_read(sc, 27, &rf);
5558                 rf &= ~0x77;
5559                 if (sc->mac_rev < 0x0211)
5560                         rf |= 0x03;
5561                 run_rt3070_rf_write(sc, 27, rf);
5562         }
5563         return (0);
5564 }
5565
5566 static void
5567 run_rt3593_rf_init(struct run_softc *sc)
5568 {
5569         uint32_t tmp;
5570         uint8_t rf;
5571         u_int i;
5572
5573         /* Disable the GPIO bits 4 and 7 for LNA PE control. */
5574         run_read(sc, RT3070_GPIO_SWITCH, &tmp);
5575         tmp &= ~(1 << 4 | 1 << 7);
5576         run_write(sc, RT3070_GPIO_SWITCH, tmp);
5577
5578         /* Initialize RF registers to default value. */
5579         for (i = 0; i < nitems(rt3593_def_rf); i++) {
5580                 run_rt3070_rf_write(sc, rt3593_def_rf[i].reg,
5581                     rt3593_def_rf[i].val);
5582         }
5583
5584         /* Toggle RF R2 to initiate calibration. */
5585         run_rt3070_rf_write(sc, 2, RT5390_RESCAL);
5586
5587         /* Initialize RF frequency offset. */
5588         run_adjust_freq_offset(sc);
5589
5590         run_rt3070_rf_read(sc, 18, &rf);
5591         run_rt3070_rf_write(sc, 18, rf | RT3593_AUTOTUNE_BYPASS);
5592
5593         /*
5594          * Increase voltage from 1.2V to 1.35V, wait for 1 msec to
5595          * decrease voltage back to 1.2V.
5596          */
5597         run_read(sc, RT3070_LDO_CFG0, &tmp);
5598         tmp = (tmp & ~0x1f000000) | 0x0d000000;
5599         run_write(sc, RT3070_LDO_CFG0, tmp);
5600         run_delay(sc, 1);
5601         tmp = (tmp & ~0x1f000000) | 0x01000000;
5602         run_write(sc, RT3070_LDO_CFG0, tmp);
5603
5604         sc->rf24_20mhz = 0x1f;
5605         sc->rf24_40mhz = 0x2f;
5606
5607         /* Save default BBP registers 25 and 26 values. */
5608         run_bbp_read(sc, 25, &sc->bbp25);
5609         run_bbp_read(sc, 26, &sc->bbp26);
5610
5611         run_read(sc, RT3070_OPT_14, &tmp);
5612         run_write(sc, RT3070_OPT_14, tmp | 1);
5613 }
5614
5615 static void
5616 run_rt5390_rf_init(struct run_softc *sc)
5617 {
5618         uint32_t tmp;
5619         uint8_t rf;
5620         u_int i;
5621
5622         /* Toggle RF R2 to initiate calibration. */
5623         if (sc->mac_ver == 0x5390) {
5624                 run_rt3070_rf_read(sc, 2, &rf);
5625                 run_rt3070_rf_write(sc, 2, rf | RT5390_RESCAL);
5626                 run_delay(sc, 10);
5627                 run_rt3070_rf_write(sc, 2, rf & ~RT5390_RESCAL);
5628         } else {
5629                 run_rt3070_rf_write(sc, 2, RT5390_RESCAL);
5630                 run_delay(sc, 10);
5631         }
5632
5633         /* Initialize RF registers to default value. */
5634         if (sc->mac_ver == 0x5592) {
5635                 for (i = 0; i < nitems(rt5592_def_rf); i++) {
5636                         run_rt3070_rf_write(sc, rt5592_def_rf[i].reg,
5637                             rt5592_def_rf[i].val);
5638                 }
5639                 /* Initialize RF frequency offset. */
5640                 run_adjust_freq_offset(sc);
5641         } else if (sc->mac_ver == 0x5392) {
5642                 for (i = 0; i < nitems(rt5392_def_rf); i++) {
5643                         run_rt3070_rf_write(sc, rt5392_def_rf[i].reg,
5644                             rt5392_def_rf[i].val);
5645                 }
5646                 if (sc->mac_rev >= 0x0223) {
5647                         run_rt3070_rf_write(sc, 23, 0x0f);
5648                         run_rt3070_rf_write(sc, 24, 0x3e);
5649                         run_rt3070_rf_write(sc, 51, 0x32);
5650                         run_rt3070_rf_write(sc, 53, 0x22);
5651                         run_rt3070_rf_write(sc, 56, 0xc1);
5652                         run_rt3070_rf_write(sc, 59, 0x0f);
5653                 }
5654         } else {
5655                 for (i = 0; i < nitems(rt5390_def_rf); i++) {
5656                         run_rt3070_rf_write(sc, rt5390_def_rf[i].reg,
5657                             rt5390_def_rf[i].val);
5658                 }
5659                 if (sc->mac_rev >= 0x0502) {
5660                         run_rt3070_rf_write(sc, 6, 0xe0);
5661                         run_rt3070_rf_write(sc, 25, 0x80);
5662                         run_rt3070_rf_write(sc, 46, 0x73);
5663                         run_rt3070_rf_write(sc, 53, 0x00);
5664                         run_rt3070_rf_write(sc, 56, 0x42);
5665                         run_rt3070_rf_write(sc, 61, 0xd1);
5666                 }
5667         }
5668
5669         sc->rf24_20mhz = 0x1f;  /* default value */
5670         sc->rf24_40mhz = (sc->mac_ver == 0x5592) ? 0 : 0x2f;
5671
5672         if (sc->mac_rev < 0x0211)
5673                 run_rt3070_rf_write(sc, 27, 0x3);
5674
5675         run_read(sc, RT3070_OPT_14, &tmp);
5676         run_write(sc, RT3070_OPT_14, tmp | 1);
5677 }
5678
5679 static int
5680 run_rt3070_filter_calib(struct run_softc *sc, uint8_t init, uint8_t target,
5681     uint8_t *val)
5682 {
5683         uint8_t rf22, rf24;
5684         uint8_t bbp55_pb, bbp55_sb, delta;
5685         int ntries;
5686
5687         /* program filter */
5688         run_rt3070_rf_read(sc, 24, &rf24);
5689         rf24 = (rf24 & 0xc0) | init;    /* initial filter value */
5690         run_rt3070_rf_write(sc, 24, rf24);
5691
5692         /* enable baseband loopback mode */
5693         run_rt3070_rf_read(sc, 22, &rf22);
5694         run_rt3070_rf_write(sc, 22, rf22 | 0x01);
5695
5696         /* set power and frequency of passband test tone */
5697         run_bbp_write(sc, 24, 0x00);
5698         for (ntries = 0; ntries < 100; ntries++) {
5699                 /* transmit test tone */
5700                 run_bbp_write(sc, 25, 0x90);
5701                 run_delay(sc, 10);
5702                 /* read received power */
5703                 run_bbp_read(sc, 55, &bbp55_pb);
5704                 if (bbp55_pb != 0)
5705                         break;
5706         }
5707         if (ntries == 100)
5708                 return (ETIMEDOUT);
5709
5710         /* set power and frequency of stopband test tone */
5711         run_bbp_write(sc, 24, 0x06);
5712         for (ntries = 0; ntries < 100; ntries++) {
5713                 /* transmit test tone */
5714                 run_bbp_write(sc, 25, 0x90);
5715                 run_delay(sc, 10);
5716                 /* read received power */
5717                 run_bbp_read(sc, 55, &bbp55_sb);
5718
5719                 delta = bbp55_pb - bbp55_sb;
5720                 if (delta > target)
5721                         break;
5722
5723                 /* reprogram filter */
5724                 rf24++;
5725                 run_rt3070_rf_write(sc, 24, rf24);
5726         }
5727         if (ntries < 100) {
5728                 if (rf24 != init)
5729                         rf24--; /* backtrack */
5730                 *val = rf24;
5731                 run_rt3070_rf_write(sc, 24, rf24);
5732         }
5733
5734         /* restore initial state */
5735         run_bbp_write(sc, 24, 0x00);
5736
5737         /* disable baseband loopback mode */
5738         run_rt3070_rf_read(sc, 22, &rf22);
5739         run_rt3070_rf_write(sc, 22, rf22 & ~0x01);
5740
5741         return (0);
5742 }
5743
5744 static void
5745 run_rt3070_rf_setup(struct run_softc *sc)
5746 {
5747         uint8_t bbp, rf;
5748         int i;
5749
5750         if (sc->mac_ver == 0x3572) {
5751                 /* enable DC filter */
5752                 if (sc->mac_rev >= 0x0201)
5753                         run_bbp_write(sc, 103, 0xc0);
5754
5755                 run_bbp_read(sc, 138, &bbp);
5756                 if (sc->ntxchains == 1)
5757                         bbp |= 0x20;    /* turn off DAC1 */
5758                 if (sc->nrxchains == 1)
5759                         bbp &= ~0x02;   /* turn off ADC1 */
5760                 run_bbp_write(sc, 138, bbp);
5761
5762                 if (sc->mac_rev >= 0x0211) {
5763                         /* improve power consumption */
5764                         run_bbp_read(sc, 31, &bbp);
5765                         run_bbp_write(sc, 31, bbp & ~0x03);
5766                 }
5767
5768                 run_rt3070_rf_read(sc, 16, &rf);
5769                 rf = (rf & ~0x07) | sc->txmixgain_2ghz;
5770                 run_rt3070_rf_write(sc, 16, rf);
5771
5772         } else if (sc->mac_ver == 0x3071) {
5773                 if (sc->mac_rev >= 0x0211) {
5774                         /* enable DC filter */
5775                         run_bbp_write(sc, 103, 0xc0);
5776
5777                         /* improve power consumption */
5778                         run_bbp_read(sc, 31, &bbp);
5779                         run_bbp_write(sc, 31, bbp & ~0x03);
5780                 }
5781
5782                 run_bbp_read(sc, 138, &bbp);
5783                 if (sc->ntxchains == 1)
5784                         bbp |= 0x20;    /* turn off DAC1 */
5785                 if (sc->nrxchains == 1)
5786                         bbp &= ~0x02;   /* turn off ADC1 */
5787                 run_bbp_write(sc, 138, bbp);
5788
5789                 run_write(sc, RT2860_TX_SW_CFG1, 0);
5790                 if (sc->mac_rev < 0x0211) {
5791                         run_write(sc, RT2860_TX_SW_CFG2,
5792                             sc->patch_dac ? 0x2c : 0x0f);
5793                 } else
5794                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5795
5796         } else if (sc->mac_ver == 0x3070) {
5797                 if (sc->mac_rev >= 0x0201) {
5798                         /* enable DC filter */
5799                         run_bbp_write(sc, 103, 0xc0);
5800
5801                         /* improve power consumption */
5802                         run_bbp_read(sc, 31, &bbp);
5803                         run_bbp_write(sc, 31, bbp & ~0x03);
5804                 }
5805
5806                 if (sc->mac_rev < 0x0201) {
5807                         run_write(sc, RT2860_TX_SW_CFG1, 0);
5808                         run_write(sc, RT2860_TX_SW_CFG2, 0x2c);
5809                 } else
5810                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5811         }
5812
5813         /* initialize RF registers from ROM for >=RT3071*/
5814         if (sc->mac_ver >= 0x3071) {
5815                 for (i = 0; i < 10; i++) {
5816                         if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
5817                                 continue;
5818                         run_rt3070_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
5819                 }
5820         }
5821 }
5822
5823 static void
5824 run_rt3593_rf_setup(struct run_softc *sc)
5825 {
5826         uint8_t bbp, rf;
5827
5828         if (sc->mac_rev >= 0x0211) {
5829                 /* Enable DC filter. */
5830                 run_bbp_write(sc, 103, 0xc0);
5831         }
5832         run_write(sc, RT2860_TX_SW_CFG1, 0);
5833         if (sc->mac_rev < 0x0211) {
5834                 run_write(sc, RT2860_TX_SW_CFG2,
5835                     sc->patch_dac ? 0x2c : 0x0f);
5836         } else
5837                 run_write(sc, RT2860_TX_SW_CFG2, 0);
5838
5839         run_rt3070_rf_read(sc, 50, &rf);
5840         run_rt3070_rf_write(sc, 50, rf & ~RT3593_TX_LO2);
5841
5842         run_rt3070_rf_read(sc, 51, &rf);
5843         rf = (rf & ~(RT3593_TX_LO1 | 0x0c)) |
5844             ((sc->txmixgain_2ghz & 0x07) << 2);
5845         run_rt3070_rf_write(sc, 51, rf);
5846
5847         run_rt3070_rf_read(sc, 38, &rf);
5848         run_rt3070_rf_write(sc, 38, rf & ~RT5390_RX_LO1);
5849
5850         run_rt3070_rf_read(sc, 39, &rf);
5851         run_rt3070_rf_write(sc, 39, rf & ~RT5390_RX_LO2);
5852
5853         run_rt3070_rf_read(sc, 1, &rf);
5854         run_rt3070_rf_write(sc, 1, rf & ~(RT3070_RF_BLOCK | RT3070_PLL_PD));
5855
5856         run_rt3070_rf_read(sc, 30, &rf);
5857         rf = (rf & ~0x18) | 0x10;
5858         run_rt3070_rf_write(sc, 30, rf);
5859
5860         /* Apply maximum likelihood detection for 2 stream case. */
5861         run_bbp_read(sc, 105, &bbp);
5862         if (sc->nrxchains > 1)
5863                 run_bbp_write(sc, 105, bbp | RT5390_MLD);
5864
5865         /* Avoid data lost and CRC error. */
5866         run_bbp_read(sc, 4, &bbp);
5867         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5868
5869         run_bbp_write(sc, 92, 0x02);
5870         run_bbp_write(sc, 82, 0x82);
5871         run_bbp_write(sc, 106, 0x05);
5872         run_bbp_write(sc, 104, 0x92);
5873         run_bbp_write(sc, 88, 0x90);
5874         run_bbp_write(sc, 148, 0xc8);
5875         run_bbp_write(sc, 47, 0x48);
5876         run_bbp_write(sc, 120, 0x50);
5877
5878         run_bbp_write(sc, 163, 0x9d);
5879
5880         /* SNR mapping. */
5881         run_bbp_write(sc, 142, 0x06);
5882         run_bbp_write(sc, 143, 0xa0);
5883         run_bbp_write(sc, 142, 0x07);
5884         run_bbp_write(sc, 143, 0xa1);
5885         run_bbp_write(sc, 142, 0x08);
5886         run_bbp_write(sc, 143, 0xa2);
5887
5888         run_bbp_write(sc, 31, 0x08);
5889         run_bbp_write(sc, 68, 0x0b);
5890         run_bbp_write(sc, 105, 0x04);
5891 }
5892
5893 static void
5894 run_rt5390_rf_setup(struct run_softc *sc)
5895 {
5896         uint8_t bbp, rf;
5897
5898         if (sc->mac_rev >= 0x0211) {
5899                 /* Enable DC filter. */
5900                 run_bbp_write(sc, 103, 0xc0);
5901
5902                 if (sc->mac_ver != 0x5592) {
5903                         /* Improve power consumption. */
5904                         run_bbp_read(sc, 31, &bbp);
5905                         run_bbp_write(sc, 31, bbp & ~0x03);
5906                 }
5907         }
5908
5909         run_bbp_read(sc, 138, &bbp);
5910         if (sc->ntxchains == 1)
5911                 bbp |= 0x20;    /* turn off DAC1 */
5912         if (sc->nrxchains == 1)
5913                 bbp &= ~0x02;   /* turn off ADC1 */
5914         run_bbp_write(sc, 138, bbp);
5915
5916         run_rt3070_rf_read(sc, 38, &rf);
5917         run_rt3070_rf_write(sc, 38, rf & ~RT5390_RX_LO1);
5918
5919         run_rt3070_rf_read(sc, 39, &rf);
5920         run_rt3070_rf_write(sc, 39, rf & ~RT5390_RX_LO2);
5921
5922         /* Avoid data lost and CRC error. */
5923         run_bbp_read(sc, 4, &bbp);
5924         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5925
5926         run_rt3070_rf_read(sc, 30, &rf);
5927         rf = (rf & ~0x18) | 0x10;
5928         run_rt3070_rf_write(sc, 30, rf);
5929
5930         if (sc->mac_ver != 0x5592) {
5931                 run_write(sc, RT2860_TX_SW_CFG1, 0);
5932                 if (sc->mac_rev < 0x0211) {
5933                         run_write(sc, RT2860_TX_SW_CFG2,
5934                             sc->patch_dac ? 0x2c : 0x0f);
5935                 } else
5936                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5937         }
5938 }
5939
5940 static int
5941 run_txrx_enable(struct run_softc *sc)
5942 {
5943         struct ieee80211com *ic = &sc->sc_ic;
5944         uint32_t tmp;
5945         int error, ntries;
5946
5947         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
5948         for (ntries = 0; ntries < 200; ntries++) {
5949                 if ((error = run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp)) != 0)
5950                         return (error);
5951                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
5952                         break;
5953                 run_delay(sc, 50);
5954         }
5955         if (ntries == 200)
5956                 return (ETIMEDOUT);
5957
5958         run_delay(sc, 50);
5959
5960         tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN | RT2860_TX_WB_DDONE;
5961         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
5962
5963         /* enable Rx bulk aggregation (set timeout and limit) */
5964         tmp = RT2860_USB_TX_EN | RT2860_USB_RX_EN | RT2860_USB_RX_AGG_EN |
5965             RT2860_USB_RX_AGG_TO(128) | RT2860_USB_RX_AGG_LMT(2);
5966         run_write(sc, RT2860_USB_DMA_CFG, tmp);
5967
5968         /* set Rx filter */
5969         tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
5970         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
5971                 tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
5972                     RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
5973                     RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
5974                     RT2860_DROP_CFACK | RT2860_DROP_CFEND;
5975                 if (ic->ic_opmode == IEEE80211_M_STA)
5976                         tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
5977         }
5978         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
5979
5980         run_write(sc, RT2860_MAC_SYS_CTRL,
5981             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
5982
5983         return (0);
5984 }
5985
5986 static void
5987 run_adjust_freq_offset(struct run_softc *sc)
5988 {
5989         uint8_t rf, tmp;
5990
5991         run_rt3070_rf_read(sc, 17, &rf);
5992         tmp = rf;
5993         rf = (rf & ~0x7f) | (sc->freq & 0x7f);
5994         rf = MIN(rf, 0x5f);
5995
5996         if (tmp != rf)
5997                 run_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf);
5998 }
5999
6000 static void
6001 run_init_locked(struct run_softc *sc)
6002 {
6003         struct ieee80211com *ic = &sc->sc_ic;
6004         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
6005         uint32_t tmp;
6006         uint8_t bbp1, bbp3;
6007         int i;
6008         int ridx;
6009         int ntries;
6010
6011         if (ic->ic_nrunning > 1)
6012                 return;
6013
6014         run_stop(sc);
6015
6016         if (run_load_microcode(sc) != 0) {
6017                 device_printf(sc->sc_dev, "could not load 8051 microcode\n");
6018                 goto fail;
6019         }
6020
6021         for (ntries = 0; ntries < 100; ntries++) {
6022                 if (run_read(sc, RT2860_ASIC_VER_ID, &tmp) != 0)
6023                         goto fail;
6024                 if (tmp != 0 && tmp != 0xffffffff)
6025                         break;
6026                 run_delay(sc, 10);
6027         }
6028         if (ntries == 100)
6029                 goto fail;
6030
6031         for (i = 0; i != RUN_EP_QUEUES; i++)
6032                 run_setup_tx_list(sc, &sc->sc_epq[i]);
6033
6034         run_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);
6035
6036         for (ntries = 0; ntries < 100; ntries++) {
6037                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6038                         goto fail;
6039                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
6040                         break;
6041                 run_delay(sc, 10);
6042         }
6043         if (ntries == 100) {
6044                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
6045                 goto fail;
6046         }
6047         tmp &= 0xff0;
6048         tmp |= RT2860_TX_WB_DDONE;
6049         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
6050
6051         /* turn off PME_OEN to solve high-current issue */
6052         run_read(sc, RT2860_SYS_CTRL, &tmp);
6053         run_write(sc, RT2860_SYS_CTRL, tmp & ~RT2860_PME_OEN);
6054
6055         run_write(sc, RT2860_MAC_SYS_CTRL,
6056             RT2860_BBP_HRST | RT2860_MAC_SRST);
6057         run_write(sc, RT2860_USB_DMA_CFG, 0);
6058
6059         if (run_reset(sc) != 0) {
6060                 device_printf(sc->sc_dev, "could not reset chipset\n");
6061                 goto fail;
6062         }
6063
6064         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
6065
6066         /* init Tx power for all Tx rates (from EEPROM) */
6067         for (ridx = 0; ridx < 5; ridx++) {
6068                 if (sc->txpow20mhz[ridx] == 0xffffffff)
6069                         continue;
6070                 run_write(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
6071         }
6072
6073         for (i = 0; i < nitems(rt2870_def_mac); i++)
6074                 run_write(sc, rt2870_def_mac[i].reg, rt2870_def_mac[i].val);
6075         run_write(sc, RT2860_WMM_AIFSN_CFG, 0x00002273);
6076         run_write(sc, RT2860_WMM_CWMIN_CFG, 0x00002344);
6077         run_write(sc, RT2860_WMM_CWMAX_CFG, 0x000034aa);
6078
6079         if (sc->mac_ver >= 0x5390) {
6080                 run_write(sc, RT2860_TX_SW_CFG0,
6081                     4 << RT2860_DLY_PAPE_EN_SHIFT | 4);
6082                 if (sc->mac_ver >= 0x5392) {
6083                         run_write(sc, RT2860_MAX_LEN_CFG, 0x00002fff);
6084                         if (sc->mac_ver == 0x5592) {
6085                                 run_write(sc, RT2860_HT_FBK_CFG1, 0xedcba980);
6086                                 run_write(sc, RT2860_TXOP_HLDR_ET, 0x00000082);
6087                         } else {
6088                                 run_write(sc, RT2860_HT_FBK_CFG1, 0xedcb4980);
6089                                 run_write(sc, RT2860_LG_FBK_CFG0, 0xedcba322);
6090                         }
6091                 }
6092         } else if (sc->mac_ver == 0x3593) {
6093                 run_write(sc, RT2860_TX_SW_CFG0,
6094                     4 << RT2860_DLY_PAPE_EN_SHIFT | 2);
6095         } else if (sc->mac_ver >= 0x3070) {
6096                 /* set delay of PA_PE assertion to 1us (unit of 0.25us) */
6097                 run_write(sc, RT2860_TX_SW_CFG0,
6098                     4 << RT2860_DLY_PAPE_EN_SHIFT);
6099         }
6100
6101         /* wait while MAC is busy */
6102         for (ntries = 0; ntries < 100; ntries++) {
6103                 if (run_read(sc, RT2860_MAC_STATUS_REG, &tmp) != 0)
6104                         goto fail;
6105                 if (!(tmp & (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
6106                         break;
6107                 run_delay(sc, 10);
6108         }
6109         if (ntries == 100)
6110                 goto fail;
6111
6112         /* clear Host to MCU mailbox */
6113         run_write(sc, RT2860_H2M_BBPAGENT, 0);
6114         run_write(sc, RT2860_H2M_MAILBOX, 0);
6115         run_delay(sc, 10);
6116
6117         if (run_bbp_init(sc) != 0) {
6118                 device_printf(sc->sc_dev, "could not initialize BBP\n");
6119                 goto fail;
6120         }
6121
6122         /* abort TSF synchronization */
6123         run_disable_tsf(sc);
6124
6125         /* clear RX WCID search table */
6126         run_set_region_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
6127         /* clear WCID attribute table */
6128         run_set_region_4(sc, RT2860_WCID_ATTR(0), 0, 8 * 32);
6129
6130         /* hostapd sets a key before init. So, don't clear it. */
6131         if (sc->cmdq_key_set != RUN_CMDQ_GO) {
6132                 /* clear shared key table */
6133                 run_set_region_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
6134                 /* clear shared key mode */
6135                 run_set_region_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
6136         }
6137
6138         run_read(sc, RT2860_US_CYC_CNT, &tmp);
6139         tmp = (tmp & ~0xff) | 0x1e;
6140         run_write(sc, RT2860_US_CYC_CNT, tmp);
6141
6142         if (sc->mac_rev != 0x0101)
6143                 run_write(sc, RT2860_TXOP_CTRL_CFG, 0x0000583f);
6144
6145         run_write(sc, RT2860_WMM_TXOP0_CFG, 0);
6146         run_write(sc, RT2860_WMM_TXOP1_CFG, 48 << 16 | 96);
6147
6148         /* write vendor-specific BBP values (from EEPROM) */
6149         if (sc->mac_ver < 0x3593) {
6150                 for (i = 0; i < 10; i++) {
6151                         if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
6152                                 continue;
6153                         run_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
6154                 }
6155         }
6156
6157         /* select Main antenna for 1T1R devices */
6158         if (sc->rf_rev == RT3070_RF_3020 || sc->rf_rev == RT5390_RF_5370)
6159                 run_set_rx_antenna(sc, 0);
6160
6161         /* send LEDs operating mode to microcontroller */
6162         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0]);
6163         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1]);
6164         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2]);
6165
6166         if (sc->mac_ver >= 0x5390)
6167                 run_rt5390_rf_init(sc);
6168         else if (sc->mac_ver == 0x3593)
6169                 run_rt3593_rf_init(sc);
6170         else if (sc->mac_ver >= 0x3070)
6171                 run_rt3070_rf_init(sc);
6172
6173         /* disable non-existing Rx chains */
6174         run_bbp_read(sc, 3, &bbp3);
6175         bbp3 &= ~(1 << 3 | 1 << 4);
6176         if (sc->nrxchains == 2)
6177                 bbp3 |= 1 << 3;
6178         else if (sc->nrxchains == 3)
6179                 bbp3 |= 1 << 4;
6180         run_bbp_write(sc, 3, bbp3);
6181
6182         /* disable non-existing Tx chains */
6183         run_bbp_read(sc, 1, &bbp1);
6184         if (sc->ntxchains == 1)
6185                 bbp1 &= ~(1 << 3 | 1 << 4);
6186         run_bbp_write(sc, 1, bbp1);
6187
6188         if (sc->mac_ver >= 0x5390)
6189                 run_rt5390_rf_setup(sc);
6190         else if (sc->mac_ver == 0x3593)
6191                 run_rt3593_rf_setup(sc);
6192         else if (sc->mac_ver >= 0x3070)
6193                 run_rt3070_rf_setup(sc);
6194
6195         /* select default channel */
6196         run_set_chan(sc, ic->ic_curchan);
6197
6198         /* setup initial protection mode */
6199         run_updateprot_cb(ic);
6200
6201         /* turn radio LED on */
6202         run_set_leds(sc, RT2860_LED_RADIO);
6203
6204         sc->sc_flags |= RUN_RUNNING;
6205         sc->cmdq_run = RUN_CMDQ_GO;
6206
6207         for (i = 0; i != RUN_N_XFER; i++)
6208                 usbd_xfer_set_stall(sc->sc_xfer[i]);
6209
6210         usbd_transfer_start(sc->sc_xfer[RUN_BULK_RX]);
6211
6212         if (run_txrx_enable(sc) != 0)
6213                 goto fail;
6214
6215         return;
6216
6217 fail:
6218         run_stop(sc);
6219 }
6220
6221 static void
6222 run_stop(void *arg)
6223 {
6224         struct run_softc *sc = (struct run_softc *)arg;
6225         uint32_t tmp;
6226         int i;
6227         int ntries;
6228
6229         RUN_LOCK_ASSERT(sc, MA_OWNED);
6230
6231         if (sc->sc_flags & RUN_RUNNING)
6232                 run_set_leds(sc, 0);    /* turn all LEDs off */
6233
6234         sc->sc_flags &= ~RUN_RUNNING;
6235
6236         sc->ratectl_run = RUN_RATECTL_OFF;
6237         sc->cmdq_run = sc->cmdq_key_set;
6238
6239         RUN_UNLOCK(sc);
6240
6241         for(i = 0; i < RUN_N_XFER; i++)
6242                 usbd_transfer_drain(sc->sc_xfer[i]);
6243
6244         RUN_LOCK(sc);
6245
6246         run_drain_mbufq(sc);
6247
6248         if (sc->rx_m != NULL) {
6249                 m_free(sc->rx_m);
6250                 sc->rx_m = NULL;
6251         }
6252
6253         /* Disable Tx/Rx DMA. */
6254         if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6255                 return;
6256         tmp &= ~(RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
6257         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
6258
6259         for (ntries = 0; ntries < 100; ntries++) {
6260                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6261                         return;
6262                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
6263                                 break;
6264                 run_delay(sc, 10);
6265         }
6266         if (ntries == 100) {
6267                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
6268                 return;
6269         }
6270
6271         /* disable Tx/Rx */
6272         run_read(sc, RT2860_MAC_SYS_CTRL, &tmp);
6273         tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
6274         run_write(sc, RT2860_MAC_SYS_CTRL, tmp);
6275
6276         /* wait for pending Tx to complete */
6277         for (ntries = 0; ntries < 100; ntries++) {
6278                 if (run_read(sc, RT2860_TXRXQ_PCNT, &tmp) != 0) {
6279                         RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_RESET,
6280                             "Cannot read Tx queue count\n");
6281                         break;
6282                 }
6283                 if ((tmp & RT2860_TX2Q_PCNT_MASK) == 0) {
6284                         RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_RESET,
6285                             "All Tx cleared\n");
6286                         break;
6287                 }
6288                 run_delay(sc, 10);
6289         }
6290         if (ntries >= 100)
6291                 RUN_DPRINTF(sc, RUN_DEBUG_XMIT | RUN_DEBUG_RESET,
6292                     "There are still pending Tx\n");
6293         run_delay(sc, 10);
6294         run_write(sc, RT2860_USB_DMA_CFG, 0);
6295
6296         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
6297         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
6298
6299         for (i = 0; i != RUN_EP_QUEUES; i++)
6300                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
6301 }
6302
6303 static void
6304 run_delay(struct run_softc *sc, u_int ms)
6305 {
6306         usb_pause_mtx(mtx_owned(&sc->sc_mtx) ?
6307             &sc->sc_mtx : NULL, USB_MS_TO_TICKS(ms));
6308 }
6309
6310 static device_method_t run_methods[] = {
6311         /* Device interface */
6312         DEVMETHOD(device_probe,         run_match),
6313         DEVMETHOD(device_attach,        run_attach),
6314         DEVMETHOD(device_detach,        run_detach),
6315         DEVMETHOD_END
6316 };
6317
6318 static driver_t run_driver = {
6319         .name = "run",
6320         .methods = run_methods,
6321         .size = sizeof(struct run_softc)
6322 };
6323
6324 static devclass_t run_devclass;
6325
6326 DRIVER_MODULE(run, uhub, run_driver, run_devclass, run_driver_loaded, NULL);
6327 MODULE_DEPEND(run, wlan, 1, 1, 1);
6328 MODULE_DEPEND(run, usb, 1, 1, 1);
6329 MODULE_DEPEND(run, firmware, 1, 1, 1);
6330 MODULE_VERSION(run, 1);
6331 USB_PNP_HOST_INFO(run_devs);