sys/dev/usb/wlan/if_run.c

   1 /*      $FreeBSD$       */
   2
   3 /*-
   4  * Copyright (c) 2008,2010 Damien Bergamini <damien.bergamini@free.fr>
   5  * ported to FreeBSD by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
   6  * USB Consulting, Hans Petter Selasky <hselasky@freebsd.org>
   7  *
   8  * Permission to use, copy, modify, and distribute this software for any
   9  * purpose with or without fee is hereby granted, provided that the above
  10  * copyright notice and this permission notice appear in all copies.
  11  *
  12  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  13  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  14  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  15  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  16  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19  */
  20
  21 #include <sys/cdefs.h>
  22 __FBSDID("$FreeBSD$");
  23
  24 /*-
  25  * Ralink Technology RT2700U/RT2800U/RT3000U chipset driver.
  26  * http://www.ralinktech.com/
  27  */
  28
  29 #include <sys/param.h>
  30 #include <sys/sockio.h>
  31 #include <sys/sysctl.h>
  32 #include <sys/lock.h>
  33 #include <sys/mutex.h>
  34 #include <sys/mbuf.h>
  35 #include <sys/kernel.h>
  36 #include <sys/socket.h>
  37 #include <sys/systm.h>
  38 #include <sys/malloc.h>
  39 #include <sys/module.h>
  40 #include <sys/bus.h>
  41 #include <sys/endian.h>
  42 #include <sys/systm.h>
  43 #include <sys/linker.h>
  44 #include <sys/firmware.h>
  45 #include <sys/kdb.h>
  46
  47 #include <machine/bus.h>
  48 #include <machine/resource.h>
  49 #include <sys/rman.h>
  50
  51 #include <net/bpf.h>
  52 #include <net/if.h>
  53 #include <net/if_arp.h>
  54 #include <net/ethernet.h>
  55 #include <net/if_dl.h>
  56 #include <net/if_media.h>
  57 #include <net/if_types.h>
  58
  59 #include <netinet/in.h>
  60 #include <netinet/in_systm.h>
  61 #include <netinet/in_var.h>
  62 #include <netinet/if_ether.h>
  63 #include <netinet/ip.h>
  64
  65 #include <net80211/ieee80211_var.h>
  66 #include <net80211/ieee80211_regdomain.h>
  67 #include <net80211/ieee80211_radiotap.h>
  68 #include <net80211/ieee80211_ratectl.h>
  69
  70 #include <dev/usb/usb.h>
  71 #include <dev/usb/usbdi.h>
  72 #include "usbdevs.h"
  73
  74 #define USB_DEBUG_VAR run_debug
  75 #include <dev/usb/usb_debug.h>
  76
  77 #include "if_runreg.h"          /* shared with ral(4) */
  78 #include "if_runvar.h"
  79
  80 #define nitems(_a)      (sizeof((_a)) / sizeof((_a)[0]))
  81
  82 #ifdef  USB_DEBUG
  83 #define RUN_DEBUG
  84 #endif
  85
  86 #ifdef  RUN_DEBUG
  87 int run_debug = 0;
  88 SYSCTL_NODE(_hw_usb, OID_AUTO, run, CTLFLAG_RW, 0, "USB run");
  89 SYSCTL_INT(_hw_usb_run, OID_AUTO, debug, CTLFLAG_RW, &run_debug, 0,
  90     "run debug level");
  91 #endif
  92
  93 #define IEEE80211_HAS_ADDR4(wh) \
  94         (((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
  95
  96 static const struct usb_device_id run_devs[] = {
  97     { USB_VP(USB_VENDOR_ABOCOM,         USB_PRODUCT_ABOCOM_RT2770) },
  98     { USB_VP(USB_VENDOR_ABOCOM,         USB_PRODUCT_ABOCOM_RT2870) },
  99     { USB_VP(USB_VENDOR_ABOCOM,         USB_PRODUCT_ABOCOM_RT3070) },
 100     { USB_VP(USB_VENDOR_ABOCOM,         USB_PRODUCT_ABOCOM_RT3071) },
 101     { USB_VP(USB_VENDOR_ABOCOM,         USB_PRODUCT_ABOCOM_RT3072) },
 102     { USB_VP(USB_VENDOR_ABOCOM2,        USB_PRODUCT_ABOCOM2_RT2870_1) },
 103     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT2770) },
 104     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT2870_1) },
 105     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT2870_2) },
 106     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT2870_3) },
 107     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT2870_4) },
 108     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT2870_5) },
 109     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT3070) },
 110     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT3070_1) },
 111     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT3070_2) },
 112     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT3070_3) },
 113     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT3070_4) },
 114     { USB_VP(USB_VENDOR_ACCTON,         USB_PRODUCT_ACCTON_RT3070_5) },
 115     { USB_VP(USB_VENDOR_AIRTIES,        USB_PRODUCT_AIRTIES_RT3070) },
 116     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT2070) },
 117     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT2770) },
 118     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT2870) },
 119     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT3070) },
 120     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT3071) },
 121     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT3072) },
 122     { USB_VP(USB_VENDOR_ALLWIN,         USB_PRODUCT_ALLWIN_RT3572) },
 123     { USB_VP(USB_VENDOR_AMIGO,          USB_PRODUCT_AMIGO_RT2870_1) },
 124     { USB_VP(USB_VENDOR_AMIGO,          USB_PRODUCT_AMIGO_RT2870_2) },
 125     { USB_VP(USB_VENDOR_AMIT,           USB_PRODUCT_AMIT_CGWLUSB2GNR) },
 126     { USB_VP(USB_VENDOR_AMIT,           USB_PRODUCT_AMIT_RT2870_1) },
 127     { USB_VP(USB_VENDOR_AMIT2,          USB_PRODUCT_AMIT2_RT2870) },
 128     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_RT2870_1) },
 129     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_RT2870_2) },
 130     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_RT2870_3) },
 131     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_RT2870_4) },
 132     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_RT2870_5) },
 133     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_USBN13) },
 134     { USB_VP(USB_VENDOR_ASUS,           USB_PRODUCT_ASUS_RT3070_1) },
 135     { USB_VP(USB_VENDOR_ASUS2,          USB_PRODUCT_ASUS2_USBN11) },
 136     { USB_VP(USB_VENDOR_AZUREWAVE,      USB_PRODUCT_AZUREWAVE_RT2870_1) },
 137     { USB_VP(USB_VENDOR_AZUREWAVE,      USB_PRODUCT_AZUREWAVE_RT2870_2) },
 138     { USB_VP(USB_VENDOR_AZUREWAVE,      USB_PRODUCT_AZUREWAVE_RT3070_1) },
 139     { USB_VP(USB_VENDOR_AZUREWAVE,      USB_PRODUCT_AZUREWAVE_RT3070_2) },
 140     { USB_VP(USB_VENDOR_AZUREWAVE,      USB_PRODUCT_AZUREWAVE_RT3070_3) },
 141     { USB_VP(USB_VENDOR_BELKIN,         USB_PRODUCT_BELKIN_F5D8053V3) },
 142     { USB_VP(USB_VENDOR_BELKIN,         USB_PRODUCT_BELKIN_F5D8055) },
 143     { USB_VP(USB_VENDOR_BELKIN,         USB_PRODUCT_BELKIN_F6D4050V1) },
 144     { USB_VP(USB_VENDOR_BELKIN,         USB_PRODUCT_BELKIN_RT2870_1) },
 145     { USB_VP(USB_VENDOR_BELKIN,         USB_PRODUCT_BELKIN_RT2870_2) },
 146     { USB_VP(USB_VENDOR_CISCOLINKSYS2,  USB_PRODUCT_CISCOLINKSYS2_RT3070) },
 147     { USB_VP(USB_VENDOR_CISCOLINKSYS3,  USB_PRODUCT_CISCOLINKSYS2_RT3070) },
 148     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_1) },
 149     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_2) },
 150     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_3) },
 151     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_4) },
 152     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_5) },
 153     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_6) },
 154     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_7) },
 155     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT2870_8) },
 156     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT3070_1) },
 157     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_RT3070_2) },
 158     { USB_VP(USB_VENDOR_CONCEPTRONIC2,  USB_PRODUCT_CONCEPTRONIC2_VIGORN61) },
 159     { USB_VP(USB_VENDOR_COREGA,         USB_PRODUCT_COREGA_CGWLUSB300GNM) },
 160     { USB_VP(USB_VENDOR_COREGA,         USB_PRODUCT_COREGA_RT2870_1) },
 161     { USB_VP(USB_VENDOR_COREGA,         USB_PRODUCT_COREGA_RT2870_2) },
 162     { USB_VP(USB_VENDOR_COREGA,         USB_PRODUCT_COREGA_RT2870_3) },
 163     { USB_VP(USB_VENDOR_COREGA,         USB_PRODUCT_COREGA_RT3070) },
 164     { USB_VP(USB_VENDOR_CYBERTAN,       USB_PRODUCT_CYBERTAN_RT2870) },
 165     { USB_VP(USB_VENDOR_DLINK,          USB_PRODUCT_DLINK_RT2870) },
 166     { USB_VP(USB_VENDOR_DLINK,          USB_PRODUCT_DLINK_RT3072) },
 167     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_DWA130) },
 168     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT2870_1) },
 169     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT2870_2) },
 170     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3070_1) },
 171     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3070_2) },
 172     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3070_3) },
 173     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3070_4) },
 174     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3070_5) },
 175     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3072) },
 176     { USB_VP(USB_VENDOR_DLINK2,         USB_PRODUCT_DLINK2_RT3072_1) },
 177     { USB_VP(USB_VENDOR_EDIMAX,         USB_PRODUCT_EDIMAX_EW7717) },
 178     { USB_VP(USB_VENDOR_EDIMAX,         USB_PRODUCT_EDIMAX_EW7718) },
 179     { USB_VP(USB_VENDOR_EDIMAX,         USB_PRODUCT_EDIMAX_RT2870_1) },
 180     { USB_VP(USB_VENDOR_ENCORE,         USB_PRODUCT_ENCORE_RT3070_1) },
 181     { USB_VP(USB_VENDOR_ENCORE,         USB_PRODUCT_ENCORE_RT3070_2) },
 182     { USB_VP(USB_VENDOR_ENCORE,         USB_PRODUCT_ENCORE_RT3070_3) },
 183     { USB_VP(USB_VENDOR_GIGABYTE,       USB_PRODUCT_GIGABYTE_GNWB31N) },
 184     { USB_VP(USB_VENDOR_GIGABYTE,       USB_PRODUCT_GIGABYTE_GNWB32L) },
 185     { USB_VP(USB_VENDOR_GIGABYTE,       USB_PRODUCT_GIGABYTE_RT2870_1) },
 186     { USB_VP(USB_VENDOR_GIGASET,        USB_PRODUCT_GIGASET_RT3070_1) },
 187     { USB_VP(USB_VENDOR_GIGASET,        USB_PRODUCT_GIGASET_RT3070_2) },
 188     { USB_VP(USB_VENDOR_GUILLEMOT,      USB_PRODUCT_GUILLEMOT_HWNU300) },
 189     { USB_VP(USB_VENDOR_HAWKING,        USB_PRODUCT_HAWKING_HWUN2) },
 190     { USB_VP(USB_VENDOR_HAWKING,        USB_PRODUCT_HAWKING_RT2870_1) },
 191     { USB_VP(USB_VENDOR_HAWKING,        USB_PRODUCT_HAWKING_RT2870_2) },
 192     { USB_VP(USB_VENDOR_HAWKING,        USB_PRODUCT_HAWKING_RT3070) },
 193     { USB_VP(USB_VENDOR_IODATA,         USB_PRODUCT_IODATA_RT3072_1) },
 194     { USB_VP(USB_VENDOR_IODATA,         USB_PRODUCT_IODATA_RT3072_2) },
 195     { USB_VP(USB_VENDOR_IODATA,         USB_PRODUCT_IODATA_RT3072_3) },
 196     { USB_VP(USB_VENDOR_IODATA,         USB_PRODUCT_IODATA_RT3072_4) },
 197     { USB_VP(USB_VENDOR_LINKSYS4,       USB_PRODUCT_LINKSYS4_RT3070) },
 198     { USB_VP(USB_VENDOR_LINKSYS4,       USB_PRODUCT_LINKSYS4_WUSB100) },
 199     { USB_VP(USB_VENDOR_LINKSYS4,       USB_PRODUCT_LINKSYS4_WUSB54GCV3) },
 200     { USB_VP(USB_VENDOR_LINKSYS4,       USB_PRODUCT_LINKSYS4_WUSB600N) },
 201     { USB_VP(USB_VENDOR_LINKSYS4,       USB_PRODUCT_LINKSYS4_WUSB600NV2) },
 202     { USB_VP(USB_VENDOR_LOGITEC,        USB_PRODUCT_LOGITEC_RT2870_1) },
 203     { USB_VP(USB_VENDOR_LOGITEC,        USB_PRODUCT_LOGITEC_RT2870_2) },
 204     { USB_VP(USB_VENDOR_LOGITEC,        USB_PRODUCT_LOGITEC_RT2870_3) },
 205     { USB_VP(USB_VENDOR_MELCO,          USB_PRODUCT_MELCO_RT2870_1) },
 206     { USB_VP(USB_VENDOR_MELCO,          USB_PRODUCT_MELCO_RT2870_2) },
 207     { USB_VP(USB_VENDOR_MELCO,          USB_PRODUCT_MELCO_WLIUCAG300N) },
 208     { USB_VP(USB_VENDOR_MELCO,          USB_PRODUCT_MELCO_WLIUCG300N) },
 209     { USB_VP(USB_VENDOR_MELCO,          USB_PRODUCT_MELCO_WLIUCGN) },
 210     { USB_VP(USB_VENDOR_MOTOROLA4,      USB_PRODUCT_MOTOROLA4_RT2770) },
 211     { USB_VP(USB_VENDOR_MOTOROLA4,      USB_PRODUCT_MOTOROLA4_RT3070) },
 212     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_1) },
 213     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_2) },
 214     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_3) },
 215     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_4) },
 216     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_5) },
 217     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_6) },
 218     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_7) },
 219     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_8) },
 220     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_9) },
 221     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_10) },
 222     { USB_VP(USB_VENDOR_MSI,            USB_PRODUCT_MSI_RT3070_11) },
 223     { USB_VP(USB_VENDOR_OVISLINK,       USB_PRODUCT_OVISLINK_RT3072) },
 224     { USB_VP(USB_VENDOR_PARA,           USB_PRODUCT_PARA_RT3070) },
 225     { USB_VP(USB_VENDOR_PEGATRON,       USB_PRODUCT_PEGATRON_RT2870) },
 226     { USB_VP(USB_VENDOR_PEGATRON,       USB_PRODUCT_PEGATRON_RT3070) },
 227     { USB_VP(USB_VENDOR_PEGATRON,       USB_PRODUCT_PEGATRON_RT3070_2) },
 228     { USB_VP(USB_VENDOR_PEGATRON,       USB_PRODUCT_PEGATRON_RT3070_3) },
 229     { USB_VP(USB_VENDOR_PHILIPS,        USB_PRODUCT_PHILIPS_RT2870) },
 230     { USB_VP(USB_VENDOR_PLANEX2,        USB_PRODUCT_PLANEX2_GWUS300MINIS) },
 231     { USB_VP(USB_VENDOR_PLANEX2,        USB_PRODUCT_PLANEX2_GWUSMICRON) },
 232     { USB_VP(USB_VENDOR_PLANEX2,        USB_PRODUCT_PLANEX2_RT2870) },
 233     { USB_VP(USB_VENDOR_PLANEX2,        USB_PRODUCT_PLANEX2_RT3070) },
 234     { USB_VP(USB_VENDOR_QCOM,           USB_PRODUCT_QCOM_RT2870) },
 235     { USB_VP(USB_VENDOR_QUANTA,         USB_PRODUCT_QUANTA_RT3070) },
 236     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT2070) },
 237     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT2770) },
 238     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT2870) },
 239     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT3070) },
 240     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT3071) },
 241     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT3072) },
 242     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT3370) },
 243     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT3572) },
 244     { USB_VP(USB_VENDOR_RALINK,         USB_PRODUCT_RALINK_RT8070) },
 245     { USB_VP(USB_VENDOR_SAMSUNG2,       USB_PRODUCT_SAMSUNG2_RT2870_1) },
 246     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT2870_1) },
 247     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT2870_2) },
 248     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT2870_3) },
 249     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT2870_4) },
 250     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3070) },
 251     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3071) },
 252     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3072_1) },
 253     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3072_2) },
 254     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3072_3) },
 255     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3072_4) },
 256     { USB_VP(USB_VENDOR_SENAO,          USB_PRODUCT_SENAO_RT3072_5) },
 257     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT2770) },
 258     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT2870_1) },
 259     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT2870_2) },
 260     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT2870_3) },
 261     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT2870_4) },
 262     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3070) },
 263     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3070_2) },
 264     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3070_3) },
 265     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3070_4) },
 266     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3071) },
 267     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3072_1) },
 268     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3072_2) },
 269     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3072_3) },
 270     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3072_4) },
 271     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3072_5) },
 272     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_RT3072_6) },
 273     { USB_VP(USB_VENDOR_SITECOMEU,      USB_PRODUCT_SITECOMEU_WL608) },
 274     { USB_VP(USB_VENDOR_SPARKLAN,       USB_PRODUCT_SPARKLAN_RT2870_1) },
 275     { USB_VP(USB_VENDOR_SPARKLAN,       USB_PRODUCT_SPARKLAN_RT3070) },
 276     { USB_VP(USB_VENDOR_SWEEX2,         USB_PRODUCT_SWEEX2_LW153) },
 277     { USB_VP(USB_VENDOR_SWEEX2,         USB_PRODUCT_SWEEX2_LW303) },
 278     { USB_VP(USB_VENDOR_SWEEX2,         USB_PRODUCT_SWEEX2_LW313) },
 279     { USB_VP(USB_VENDOR_TOSHIBA,        USB_PRODUCT_TOSHIBA_RT3070) },
 280     { USB_VP(USB_VENDOR_UMEDIA,         USB_PRODUCT_UMEDIA_RT2870_1) },
 281     { USB_VP(USB_VENDOR_ZCOM,           USB_PRODUCT_ZCOM_RT2870_1) },
 282     { USB_VP(USB_VENDOR_ZCOM,           USB_PRODUCT_ZCOM_RT2870_2) },
 283     { USB_VP(USB_VENDOR_ZINWELL,        USB_PRODUCT_ZINWELL_RT2870_1) },
 284     { USB_VP(USB_VENDOR_ZINWELL,        USB_PRODUCT_ZINWELL_RT2870_2) },
 285     { USB_VP(USB_VENDOR_ZINWELL,        USB_PRODUCT_ZINWELL_RT3070) },
 286     { USB_VP(USB_VENDOR_ZINWELL,        USB_PRODUCT_ZINWELL_RT3072_1) },
 287     { USB_VP(USB_VENDOR_ZINWELL,        USB_PRODUCT_ZINWELL_RT3072_2) },
 288     { USB_VP(USB_VENDOR_ZYXEL,          USB_PRODUCT_ZYXEL_RT2870_1) },
 289     { USB_VP(USB_VENDOR_ZYXEL,          USB_PRODUCT_ZYXEL_RT2870_2) },
 290 };
 291
 292 MODULE_DEPEND(run, wlan, 1, 1, 1);
 293 MODULE_DEPEND(run, usb, 1, 1, 1);
 294 MODULE_DEPEND(run, firmware, 1, 1, 1);
 295
 296 static device_probe_t   run_match;
 297 static device_attach_t  run_attach;
 298 static device_detach_t  run_detach;
 299
 300 static usb_callback_t   run_bulk_rx_callback;
 301 static usb_callback_t   run_bulk_tx_callback0;
 302 static usb_callback_t   run_bulk_tx_callback1;
 303 static usb_callback_t   run_bulk_tx_callback2;
 304 static usb_callback_t   run_bulk_tx_callback3;
 305 static usb_callback_t   run_bulk_tx_callback4;
 306 static usb_callback_t   run_bulk_tx_callback5;
 307
 308 static void     run_bulk_tx_callbackN(struct usb_xfer *xfer,
 309                     usb_error_t error, unsigned int index);
 310 static struct ieee80211vap *run_vap_create(struct ieee80211com *,
 311                     const char name[IFNAMSIZ], int unit, int opmode, int flags,
 312                     const uint8_t bssid[IEEE80211_ADDR_LEN], const uint8_t
 313                     mac[IEEE80211_ADDR_LEN]);
 314 static void     run_vap_delete(struct ieee80211vap *);
 315 static void     run_setup_tx_list(struct run_softc *,
 316                     struct run_endpoint_queue *);
 317 static void     run_unsetup_tx_list(struct run_softc *,
 318                     struct run_endpoint_queue *);
 319 static int      run_load_microcode(struct run_softc *);
 320 static int      run_reset(struct run_softc *);
 321 static usb_error_t run_do_request(struct run_softc *,
 322                     struct usb_device_request *, void *);
 323 static int      run_read(struct run_softc *, uint16_t, uint32_t *);
 324 static int      run_read_region_1(struct run_softc *, uint16_t, uint8_t *, int);
 325 static int      run_write_2(struct run_softc *, uint16_t, uint16_t);
 326 static int      run_write(struct run_softc *, uint16_t, uint32_t);
 327 static int      run_write_region_1(struct run_softc *, uint16_t,
 328                     const uint8_t *, int);
 329 static int      run_set_region_4(struct run_softc *, uint16_t, uint32_t, int);
 330 static int      run_efuse_read_2(struct run_softc *, uint16_t, uint16_t *);
 331 static int      run_eeprom_read_2(struct run_softc *, uint16_t, uint16_t *);
 332 static int      run_rt2870_rf_write(struct run_softc *, uint8_t, uint32_t);
 333 static int      run_rt3070_rf_read(struct run_softc *, uint8_t, uint8_t *);
 334 static int      run_rt3070_rf_write(struct run_softc *, uint8_t, uint8_t);
 335 static int      run_bbp_read(struct run_softc *, uint8_t, uint8_t *);
 336 static int      run_bbp_write(struct run_softc *, uint8_t, uint8_t);
 337 static int      run_mcu_cmd(struct run_softc *, uint8_t, uint16_t);
 338 static const char *run_get_rf(int);
 339 static int      run_read_eeprom(struct run_softc *);
 340 static struct ieee80211_node *run_node_alloc(struct ieee80211vap *,
 341                             const uint8_t mac[IEEE80211_ADDR_LEN]);
 342 static int      run_media_change(struct ifnet *);
 343 static int      run_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 344 static int      run_wme_update(struct ieee80211com *);
 345 static void     run_wme_update_cb(void *, int);
 346 static void     run_key_update_begin(struct ieee80211vap *);
 347 static void     run_key_update_end(struct ieee80211vap *);
 348 static int      run_key_set(struct ieee80211vap *, const struct ieee80211_key *,
 349                             const uint8_t mac[IEEE80211_ADDR_LEN]);
 350 static int      run_key_delete(struct ieee80211vap *,
 351                     const struct ieee80211_key *);
 352 static void     run_ratectl_start(struct run_softc *, struct ieee80211_node *);
 353 static void     run_ratectl_to(void *);
 354 static void     run_ratectl_cb(void *, int);
 355 static void     run_iter_func(void *, struct ieee80211_node *);
 356 static void     run_newassoc(struct ieee80211_node *, int);
 357 static void     run_rx_frame(struct run_softc *, struct mbuf *, uint32_t);
 358 static void     run_tx_free(struct run_endpoint_queue *pq,
 359                     struct run_tx_data *, int);
 360 static void     run_set_tx_desc(struct run_softc *, struct run_tx_data *,
 361                     uint8_t, uint8_t, uint8_t, uint8_t, uint8_t, uint8_t);
 362 static int      run_tx(struct run_softc *, struct mbuf *,
 363                     struct ieee80211_node *);
 364 static int      run_tx_mgt(struct run_softc *, struct mbuf *,
 365                     struct ieee80211_node *);
 366 static int      run_sendprot(struct run_softc *, const struct mbuf *,
 367                     struct ieee80211_node *, int, int);
 368 static int      run_tx_param(struct run_softc *, struct mbuf *,
 369                     struct ieee80211_node *,
 370                     const struct ieee80211_bpf_params *);
 371 static int      run_raw_xmit(struct ieee80211_node *, struct mbuf *,
 372                     const struct ieee80211_bpf_params *);
 373 static void     run_start(struct ifnet *);
 374 static int      run_ioctl(struct ifnet *, u_long, caddr_t);
 375 static void     run_set_agc(struct run_softc *, uint8_t);
 376 static void     run_select_chan_group(struct run_softc *, int);
 377 static void     run_set_rx_antenna(struct run_softc *, int);
 378 static void     run_rt2870_set_chan(struct run_softc *, u_int);
 379 static void     run_rt3070_set_chan(struct run_softc *, u_int);
 380 static void     run_rt3572_set_chan(struct run_softc *, u_int);
 381 static int      run_set_chan(struct run_softc *, struct ieee80211_channel *);
 382 static void     run_set_channel(struct ieee80211com *);
 383 static void     run_scan_start(struct ieee80211com *);
 384 static void     run_scan_end(struct ieee80211com *);
 385 static uint8_t  run_rate2mcs(uint8_t);
 386 static void     run_update_beacon(struct ieee80211vap *, int);
 387 static void     run_update_beacon_locked(struct ieee80211vap *, int);
 388 static void     run_updateprot(struct ieee80211com *);
 389 static void     run_usb_timeout_cb(void *, int);
 390 static void     run_reset_livelock(struct run_softc *);
 391 static void     run_enable_tsf_sync(struct run_softc *);
 392 static void     run_enable_mrr(struct run_softc *);
 393 static void     run_set_txpreamble(struct run_softc *);
 394 static void     run_set_basicrates(struct run_softc *);
 395 static void     run_set_leds(struct run_softc *, uint16_t);
 396 static void     run_set_bssid(struct run_softc *, const uint8_t *);
 397 static void     run_set_macaddr(struct run_softc *, const uint8_t *);
 398 static void     run_updateslot(struct ifnet *);
 399 static int8_t   run_rssi2dbm(struct run_softc *, uint8_t, uint8_t);
 400 static void     run_update_promisc_locked(struct ifnet *);
 401 static void     run_update_promisc(struct ifnet *);
 402 static int      run_bbp_init(struct run_softc *);
 403 static int      run_rt3070_rf_init(struct run_softc *);
 404 static int      run_rt3070_filter_calib(struct run_softc *, uint8_t, uint8_t,
 405                     uint8_t *);
 406 static void     run_rt3070_rf_setup(struct run_softc *);
 407 static int      run_txrx_enable(struct run_softc *);
 408 static void     run_init(void *);
 409 static void     run_init_locked(struct run_softc *);
 410 static void     run_stop(void *);
 411 static void     run_delay(struct run_softc *, unsigned int);
 412
 413 static const struct {
 414         uint32_t        reg;
 415         uint32_t        val;
 416 } rt2870_def_mac[] = {
 417         RT2870_DEF_MAC
 418 };
 419
 420 static const struct {
 421         uint8_t reg;
 422         uint8_t val;
 423 } rt2860_def_bbp[] = {
 424         RT2860_DEF_BBP
 425 };
 426
 427 static const struct rfprog {
 428         uint8_t         chan;
 429         uint32_t        r1, r2, r3, r4;
 430 } rt2860_rf2850[] = {
 431         RT2860_RF2850
 432 };
 433
 434 struct {
 435         uint8_t n, r, k;
 436 } rt3070_freqs[] = {
 437         RT3070_RF3052
 438 };
 439
 440 static const struct {
 441         uint8_t reg;
 442         uint8_t val;
 443 } rt3070_def_rf[] = {
 444         RT3070_DEF_RF
 445 },rt3572_def_rf[] = {
 446         RT3572_DEF_RF
 447 };
 448
 449 static const struct usb_config run_config[RUN_N_XFER] = {
 450     [RUN_BULK_TX_BE] = {
 451         .type = UE_BULK,
 452         .endpoint = UE_ADDR_ANY,
 453         .ep_index = 0,
 454         .direction = UE_DIR_OUT,
 455         .bufsize = RUN_MAX_TXSZ,
 456         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 457         .callback = run_bulk_tx_callback0,
 458         .timeout = 5000,        /* ms */
 459     },
 460     [RUN_BULK_TX_BK] = {
 461         .type = UE_BULK,
 462         .endpoint = UE_ADDR_ANY,
 463         .direction = UE_DIR_OUT,
 464         .ep_index = 1,
 465         .bufsize = RUN_MAX_TXSZ,
 466         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 467         .callback = run_bulk_tx_callback1,
 468         .timeout = 5000,        /* ms */
 469     },
 470     [RUN_BULK_TX_VI] = {
 471         .type = UE_BULK,
 472         .endpoint = UE_ADDR_ANY,
 473         .direction = UE_DIR_OUT,
 474         .ep_index = 2,
 475         .bufsize = RUN_MAX_TXSZ,
 476         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 477         .callback = run_bulk_tx_callback2,
 478         .timeout = 5000,        /* ms */
 479     },
 480     [RUN_BULK_TX_VO] = {
 481         .type = UE_BULK,
 482         .endpoint = UE_ADDR_ANY,
 483         .direction = UE_DIR_OUT,
 484         .ep_index = 3,
 485         .bufsize = RUN_MAX_TXSZ,
 486         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 487         .callback = run_bulk_tx_callback3,
 488         .timeout = 5000,        /* ms */
 489     },
 490     [RUN_BULK_TX_HCCA] = {
 491         .type = UE_BULK,
 492         .endpoint = UE_ADDR_ANY,
 493         .direction = UE_DIR_OUT,
 494         .ep_index = 4,
 495         .bufsize = RUN_MAX_TXSZ,
 496         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 497         .callback = run_bulk_tx_callback4,
 498         .timeout = 5000,        /* ms */
 499     },
 500     [RUN_BULK_TX_PRIO] = {
 501         .type = UE_BULK,
 502         .endpoint = UE_ADDR_ANY,
 503         .direction = UE_DIR_OUT,
 504         .ep_index = 5,
 505         .bufsize = RUN_MAX_TXSZ,
 506         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 507         .callback = run_bulk_tx_callback5,
 508         .timeout = 5000,        /* ms */
 509     },
 510     [RUN_BULK_RX] = {
 511         .type = UE_BULK,
 512         .endpoint = UE_ADDR_ANY,
 513         .direction = UE_DIR_IN,
 514         .bufsize = RUN_MAX_RXSZ,
 515         .flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
 516         .callback = run_bulk_rx_callback,
 517     }
 518 };
 519
 520 int
 521 run_match(device_t self)
 522 {
 523         struct usb_attach_arg *uaa = device_get_ivars(self);
 524
 525         if (uaa->usb_mode != USB_MODE_HOST)
 526                 return (ENXIO);
 527         if (uaa->info.bConfigIndex != 0)
 528                 return (ENXIO);
 529         if (uaa->info.bIfaceIndex != RT2860_IFACE_INDEX)
 530                 return (ENXIO);
 531
 532         return (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa));
 533 }
 534
 535 static int
 536 run_attach(device_t self)
 537 {
 538         struct run_softc *sc = device_get_softc(self);
 539         struct usb_attach_arg *uaa = device_get_ivars(self);
 540         struct ieee80211com *ic;
 541         struct ifnet *ifp;
 542         uint32_t ver;
 543         int i, ntries, error;
 544         uint8_t iface_index, bands;
 545
 546         device_set_usb_desc(self);
 547         sc->sc_udev = uaa->device;
 548         sc->sc_dev = self;
 549
 550         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
 551             MTX_NETWORK_LOCK, MTX_DEF);
 552
 553         iface_index = RT2860_IFACE_INDEX;
 554         error = usbd_transfer_setup(uaa->device, &iface_index,
 555             sc->sc_xfer, run_config, RUN_N_XFER, sc, &sc->sc_mtx);
 556         if (error) {
 557                 device_printf(self, "could not allocate USB transfers, "
 558                     "err=%s\n", usbd_errstr(error));
 559                 goto detach;
 560         }
 561
 562         RUN_LOCK(sc);
 563
 564         /* wait for the chip to settle */
 565         for (ntries = 0; ntries < 100; ntries++) {
 566                 if (run_read(sc, RT2860_ASIC_VER_ID, &ver) != 0){
 567                         RUN_UNLOCK(sc);
 568                         goto detach;
 569                 }
 570                 if (ver != 0 && ver != 0xffffffff)
 571                         break;
 572                 run_delay(sc, 10);
 573         }
 574         if (ntries == 100) {
 575                 device_printf(sc->sc_dev,
 576                     "timeout waiting for NIC to initialize\n");
 577                 RUN_UNLOCK(sc);
 578                 goto detach;
 579         }
 580         sc->mac_ver = ver >> 16;
 581         sc->mac_rev = ver & 0xffff;
 582
 583         /* retrieve RF rev. no and various other things from EEPROM */
 584         run_read_eeprom(sc);
 585
 586         device_printf(sc->sc_dev,
 587             "MAC/BBP RT%04X (rev 0x%04X), RF %s (MIMO %dT%dR), address %s\n",
 588             sc->mac_ver, sc->mac_rev, run_get_rf(sc->rf_rev),
 589             sc->ntxchains, sc->nrxchains, ether_sprintf(sc->sc_bssid));
 590
 591         if ((error = run_load_microcode(sc)) != 0) {
 592                 device_printf(sc->sc_dev, "could not load 8051 microcode\n");
 593                 RUN_UNLOCK(sc);
 594                 goto detach;
 595         }
 596
 597         RUN_UNLOCK(sc);
 598
 599         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 600         if(ifp == NULL){
 601                 device_printf(sc->sc_dev, "can not if_alloc()\n");
 602                 goto detach;
 603         }
 604         ic = ifp->if_l2com;
 605
 606         ifp->if_softc = sc;
 607         if_initname(ifp, "run", device_get_unit(sc->sc_dev));
 608         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 609         ifp->if_init = run_init;
 610         ifp->if_ioctl = run_ioctl;
 611         ifp->if_start = run_start;
 612         IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
 613         ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
 614         IFQ_SET_READY(&ifp->if_snd);
 615
 616         ic->ic_ifp = ifp;
 617         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 618         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 619 #if 0
 620         ic->ic_state = IEEE80211_S_INIT;
 621 #endif
 622         /* set device capabilities */
 623         ic->ic_caps =
 624             IEEE80211_C_STA |           /* station mode supported */
 625             IEEE80211_C_MONITOR |       /* monitor mode supported */
 626             IEEE80211_C_IBSS |
 627             IEEE80211_C_HOSTAP |
 628             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 629             IEEE80211_C_SHSLOT |        /* short slot time supported */
 630             IEEE80211_C_WME |           /* WME */
 631             IEEE80211_C_WPA;            /* WPA1|WPA2(RSN) */
 632
 633         ic->ic_cryptocaps =
 634             IEEE80211_CRYPTO_WEP |
 635             IEEE80211_CRYPTO_AES_CCM |
 636             IEEE80211_CRYPTO_TKIPMIC |
 637             IEEE80211_CRYPTO_TKIP;
 638
 639         ic->ic_flags |= IEEE80211_F_DATAPAD;
 640         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 641
 642         bands = 0;
 643         setbit(&bands, IEEE80211_MODE_11B);
 644         setbit(&bands, IEEE80211_MODE_11G);
 645         ieee80211_init_channels(ic, NULL, &bands);
 646
 647         /*
 648          * Do this by own because h/w supports
 649          * more channels than ieee80211_init_channels()
 650          */
 651         if (sc->rf_rev == RT2860_RF_2750 ||
 652             sc->rf_rev == RT2860_RF_2850 ||
 653             sc->rf_rev == RT3070_RF_3052) {
 654                 /* set supported .11a rates */
 655                 for (i = 14; i < nitems(rt2860_rf2850); i++) {
 656                         uint8_t chan = rt2860_rf2850[i].chan;
 657                         ic->ic_channels[ic->ic_nchans].ic_freq =
 658                             ieee80211_ieee2mhz(chan, IEEE80211_CHAN_A);
 659                         ic->ic_channels[ic->ic_nchans].ic_ieee = chan;
 660                         ic->ic_channels[ic->ic_nchans].ic_flags = IEEE80211_CHAN_A;
 661                         ic->ic_channels[ic->ic_nchans].ic_extieee = 0;
 662                         ic->ic_nchans++;
 663                 }
 664         }
 665
 666         ieee80211_ifattach(ic, sc->sc_bssid);
 667
 668         ic->ic_scan_start = run_scan_start;
 669         ic->ic_scan_end = run_scan_end;
 670         ic->ic_set_channel = run_set_channel;
 671         ic->ic_node_alloc = run_node_alloc;
 672         ic->ic_newassoc = run_newassoc;
 673         //ic->ic_updateslot = run_updateslot;
 674         ic->ic_wme.wme_update = run_wme_update;
 675         ic->ic_raw_xmit = run_raw_xmit;
 676         ic->ic_update_promisc = run_update_promisc;
 677
 678         ic->ic_vap_create = run_vap_create;
 679         ic->ic_vap_delete = run_vap_delete;
 680
 681         ieee80211_radiotap_attach(ic,
 682             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 683                 RUN_TX_RADIOTAP_PRESENT,
 684             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 685                 RUN_RX_RADIOTAP_PRESENT);
 686
 687         if (bootverbose)
 688                 ieee80211_announce(ic);
 689
 690         return 0;
 691
 692 detach:
 693         run_detach(self);
 694         return(ENXIO);
 695 }
 696
 697 static int
 698 run_detach(device_t self)
 699 {
 700         struct run_softc *sc = device_get_softc(self);
 701         struct ifnet *ifp = sc->sc_ifp;
 702         struct ieee80211com *ic;
 703         int i;
 704
 705         /* stop all USB transfers */
 706         usbd_transfer_unsetup(sc->sc_xfer, RUN_N_XFER);
 707
 708         RUN_LOCK(sc);
 709         /* free TX list, if any */
 710         for (i = 0; i != RUN_EP_QUEUES; i++)
 711                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
 712         RUN_UNLOCK(sc);
 713
 714         if (ifp) {
 715                 ic = ifp->if_l2com;
 716                 ieee80211_ifdetach(ic);
 717                 if_free(ifp);
 718         }
 719
 720         mtx_destroy(&sc->sc_mtx);
 721
 722         return (0);
 723 }
 724
 725 static struct ieee80211vap *
 726 run_vap_create(struct ieee80211com *ic,
 727     const char name[IFNAMSIZ], int unit, int opmode, int flags,
 728     const uint8_t bssid[IEEE80211_ADDR_LEN],
 729     const uint8_t mac[IEEE80211_ADDR_LEN])
 730 {
 731         struct run_softc *sc = ic->ic_ifp->if_softc;
 732         struct run_vap *rvp;
 733         struct ieee80211vap *vap;
 734
 735         if (!TAILQ_EMPTY(&ic->ic_vaps))         /* only one at a time */
 736                 return NULL;
 737         sc->sc_rvp = rvp = (struct run_vap *) malloc(sizeof(struct run_vap),
 738             M_80211_VAP, M_NOWAIT | M_ZERO);
 739         if (rvp == NULL)
 740                 return NULL;
 741         vap = &rvp->vap;
 742         /* enable s/w bmiss handling for sta mode */
 743         ieee80211_vap_setup(ic, vap, name, unit, opmode,
 744             flags | IEEE80211_CLONE_NOBEACONS, bssid, mac);
 745
 746         vap->iv_key_update_begin = run_key_update_begin;
 747         vap->iv_key_update_end = run_key_update_end;
 748         vap->iv_key_delete = run_key_delete;
 749         vap->iv_key_set = run_key_set;
 750         vap->iv_update_beacon = run_update_beacon;
 751
 752         /* override state transition machine */
 753         rvp->newstate = vap->iv_newstate;
 754         vap->iv_newstate = run_newstate;
 755
 756         TASK_INIT(&rvp->ratectl_task, 0, run_ratectl_cb, rvp);
 757         TASK_INIT(&sc->wme_task, 0, run_wme_update_cb, ic);
 758         TASK_INIT(&sc->usb_timeout_task, 0, run_usb_timeout_cb, sc);
 759         callout_init((struct callout *)&rvp->ratectl_ch, 1);
 760         ieee80211_ratectl_init(vap);
 761         ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
 762
 763         /* complete setup */
 764         ieee80211_vap_attach(vap, run_media_change, ieee80211_media_status);
 765         ic->ic_opmode = opmode;
 766         return vap;
 767 }
 768
 769 static void
 770 run_vap_delete(struct ieee80211vap *vap)
 771 {
 772         struct run_vap *rvp = RUN_VAP(vap);
 773         struct ifnet *ifp;
 774         struct ieee80211com *ic;
 775         struct run_softc *sc;
 776
 777         if(vap == NULL)
 778                 return;
 779
 780         ic = vap->iv_ic;
 781         ifp = ic->ic_ifp;
 782
 783         sc = ifp->if_softc;
 784
 785         RUN_LOCK(sc);
 786         sc->sc_rvp->ratectl_run = RUN_RATECTL_OFF;
 787         RUN_UNLOCK(sc);
 788
 789         /* drain them all */
 790         usb_callout_drain(&sc->sc_rvp->ratectl_ch);
 791         ieee80211_draintask(ic, &sc->sc_rvp->ratectl_task);
 792         ieee80211_draintask(ic, &sc->wme_task);
 793         ieee80211_draintask(ic, &sc->usb_timeout_task);
 794
 795         ieee80211_ratectl_deinit(vap);
 796         ieee80211_vap_detach(vap);
 797         free(rvp, M_80211_VAP);
 798         sc->sc_rvp = NULL;
 799 }
 800
 801 static void
 802 run_setup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
 803 {
 804         struct run_tx_data *data;
 805
 806         memset(pq, 0, sizeof(*pq));
 807
 808         STAILQ_INIT(&pq->tx_qh);
 809         STAILQ_INIT(&pq->tx_fh);
 810
 811         for (data = &pq->tx_data[0];
 812             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
 813                 data->sc = sc;
 814                 STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
 815         }
 816         pq->tx_nfree = RUN_TX_RING_COUNT;
 817 }
 818
 819 static void
 820 run_unsetup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
 821 {
 822         struct run_tx_data *data;
 823
 824         /* make sure any subsequent use of the queues will fail */
 825         pq->tx_nfree = 0;
 826         STAILQ_INIT(&pq->tx_fh);
 827         STAILQ_INIT(&pq->tx_qh);
 828
 829         /* free up all node references and mbufs */
 830         for (data = &pq->tx_data[0];
 831             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++){
 832                 if (data->m != NULL) {
 833                         m_freem(data->m);
 834                         data->m = NULL;
 835                 }
 836                 if (data->ni != NULL) {
 837                         ieee80211_free_node(data->ni);
 838                         data->ni = NULL;
 839                 }
 840         }
 841 }
 842
 843 int
 844 run_load_microcode(struct run_softc *sc)
 845 {
 846         usb_device_request_t req;
 847         const struct firmware *fw;
 848         const u_char *base;
 849         uint32_t tmp;
 850         int ntries, error;
 851         const uint64_t *temp;
 852         uint64_t bytes;
 853
 854         RUN_UNLOCK(sc);
 855         fw = firmware_get("runfw");
 856         RUN_LOCK(sc);
 857         if(fw == NULL){
 858                 device_printf(sc->sc_dev,
 859                     "failed loadfirmware of file %s\n", "runfw");
 860                 return ENOENT;
 861         }
 862
 863         if (fw->datasize != 8192) {
 864                 device_printf(sc->sc_dev,
 865                     "invalid firmware size (should be 8KB)\n");
 866                 error = EINVAL;
 867                 goto fail;
 868         }
 869
 870         /*
 871          * RT3071/RT3072 use a different firmware
 872          * run-rt2870 (8KB) contains both,
 873          * first half (4KB) is for rt2870,
 874          * last half is for rt3071.
 875          */
 876         base = fw->data;
 877         if ((sc->mac_ver) != 0x2860 &&
 878             (sc->mac_ver) != 0x2872 &&
 879             (sc->mac_ver) != 0x3070){
 880                 base += 4096;
 881         }
 882
 883         /* cheap sanity check */
 884         temp = fw->data;
 885         bytes = *temp;
 886         if(bytes != be64toh(0xffffff0210280210)) {
 887                 device_printf(sc->sc_dev, "firmware checksum failed\n");
 888                 error = EINVAL;
 889                 goto fail;
 890         }
 891
 892         run_read(sc, RT2860_ASIC_VER_ID, &tmp);
 893         /* write microcode image */
 894         run_write_region_1(sc, RT2870_FW_BASE, base, 4096);
 895         run_write(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
 896         run_write(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
 897
 898         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
 899         req.bRequest = RT2870_RESET;
 900         USETW(req.wValue, 8);
 901         USETW(req.wIndex, 0);
 902         USETW(req.wLength, 0);
 903         if ((error = usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL)) != 0) {
 904                 device_printf(sc->sc_dev, "firmware reset failed\n");
 905                 goto fail;
 906         }
 907
 908         run_delay(sc, 10);
 909
 910         run_write(sc, RT2860_H2M_MAILBOX, 0);
 911         if ((error = run_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0)) != 0)
 912                 goto fail;
 913
 914         /* wait until microcontroller is ready */
 915         for (ntries = 0; ntries < 1000; ntries++) {
 916                 if ((error = run_read(sc, RT2860_SYS_CTRL, &tmp)) != 0) {
 917                         goto fail;
 918                 }
 919                 if (tmp & RT2860_MCU_READY)
 920                         break;
 921                 run_delay(sc, 10);
 922         }
 923         if (ntries == 1000) {
 924                 device_printf(sc->sc_dev,
 925                     "timeout waiting for MCU to initialize\n");
 926                 error = ETIMEDOUT;
 927                 goto fail;
 928         }
 929         device_printf(sc->sc_dev, "firmware %s loaded\n",
 930             (base == fw->data) ? "RT2870" : "RT3071");
 931
 932 fail:
 933         firmware_put(fw, FIRMWARE_UNLOAD);
 934         return (error);
 935 }
 936
 937 int
 938 run_reset(struct run_softc *sc)
 939 {
 940         usb_device_request_t req;
 941
 942         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
 943         req.bRequest = RT2870_RESET;
 944         USETW(req.wValue, 1);
 945         USETW(req.wIndex, 0);
 946         USETW(req.wLength, 0);
 947         return usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL);
 948 }
 949
 950 static usb_error_t
 951 run_do_request(struct run_softc *sc,
 952     struct usb_device_request *req, void *data)
 953 {
 954         usb_error_t err;
 955         int ntries = 10;
 956
 957         RUN_LOCK_ASSERT(sc, MA_OWNED);
 958
 959         while (ntries--) {
 960                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
 961                     req, data, 0, NULL, 250 /* ms */);
 962                 if (err == 0)
 963                         break;
 964                 DPRINTFN(1, "Control request failed, %s (retrying)\n",
 965                     usbd_errstr(err));
 966                 run_delay(sc, 10);
 967         }
 968         return (err);
 969 }
 970
 971 static int
 972 run_read(struct run_softc *sc, uint16_t reg, uint32_t *val)
 973 {
 974         uint32_t tmp;
 975         int error;
 976
 977         error = run_read_region_1(sc, reg, (uint8_t *)&tmp, sizeof tmp);
 978         if (error == 0)
 979                 *val = le32toh(tmp);
 980         else
 981                 *val = 0xffffffff;
 982         return error;
 983 }
 984
 985 static int
 986 run_read_region_1(struct run_softc *sc, uint16_t reg, uint8_t *buf, int len)
 987 {
 988         usb_device_request_t req;
 989
 990         req.bmRequestType = UT_READ_VENDOR_DEVICE;
 991         req.bRequest = RT2870_READ_REGION_1;
 992         USETW(req.wValue, 0);
 993         USETW(req.wIndex, reg);
 994         USETW(req.wLength, len);
 995
 996         return run_do_request(sc, &req, buf);
 997 }
 998
 999 static int
1000 run_write_2(struct run_softc *sc, uint16_t reg, uint16_t val)
1001 {
1002         usb_device_request_t req;
1003
1004         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1005         req.bRequest = RT2870_WRITE_2;
1006         USETW(req.wValue, val);
1007         USETW(req.wIndex, reg);
1008         USETW(req.wLength, 0);
1009
1010         return run_do_request(sc, &req, NULL);
1011 }
1012
1013 static int
1014 run_write(struct run_softc *sc, uint16_t reg, uint32_t val)
1015 {
1016         int error;
1017
1018         if ((error = run_write_2(sc, reg, val & 0xffff)) == 0)
1019                 error = run_write_2(sc, reg + 2, val >> 16);
1020         return error;
1021 }
1022
1023 static int
1024 run_write_region_1(struct run_softc *sc, uint16_t reg, const uint8_t *buf,
1025     int len)
1026 {
1027 #if 1
1028         int i, error = 0;
1029         /*
1030          * NB: the WRITE_REGION_1 command is not stable on RT2860.
1031          * We thus issue multiple WRITE_2 commands instead.
1032          */
1033         KASSERT((len & 1) == 0, ("run_write_region_1: Data too long.\n"));
1034         for (i = 0; i < len && error == 0; i += 2)
1035                 error = run_write_2(sc, reg + i, buf[i] | buf[i + 1] << 8);
1036         return error;
1037 #else
1038         usb_device_request_t req;
1039
1040         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1041         req.bRequest = RT2870_WRITE_REGION_1;
1042         USETW(req.wValue, 0);
1043         USETW(req.wIndex, reg);
1044         USETW(req.wLength, len);
1045         return run_do_request(sc, &req, buf);
1046 #endif
1047 }
1048
1049 static int
1050 run_set_region_4(struct run_softc *sc, uint16_t reg, uint32_t val, int len)
1051 {
1052         int i, error = 0;
1053
1054         KASSERT((len & 3) == 0, ("run_set_region_4: Invalid data length.\n"));
1055         for (i = 0; i < len && error == 0; i += 4)
1056                 error = run_write(sc, reg + i, val);
1057         return error;
1058 }
1059
1060 /* Read 16-bit from eFUSE ROM (RT3070 only.) */
1061 static int
1062 run_efuse_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1063 {
1064         uint32_t tmp;
1065         uint16_t reg;
1066         int error, ntries;
1067
1068         if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1069                 return error;
1070
1071         addr *= 2;
1072         /*-
1073          * Read one 16-byte block into registers EFUSE_DATA[0-3]:
1074          * DATA0: F E D C
1075          * DATA1: B A 9 8
1076          * DATA2: 7 6 5 4
1077          * DATA3: 3 2 1 0
1078          */
1079         tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
1080         tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
1081         run_write(sc, RT3070_EFUSE_CTRL, tmp);
1082         for (ntries = 0; ntries < 100; ntries++) {
1083                 if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1084                         return error;
1085                 if (!(tmp & RT3070_EFSROM_KICK))
1086                         break;
1087                 run_delay(sc, 2);
1088         }
1089         if (ntries == 100)
1090                 return ETIMEDOUT;
1091
1092         if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK) {
1093                 *val = 0xffff;  /* address not found */
1094                 return 0;
1095         }
1096         /* determine to which 32-bit register our 16-bit word belongs */
1097         reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1098         if ((error = run_read(sc, reg, &tmp)) != 0)
1099                 return error;
1100
1101         *val = (addr & 2) ? tmp >> 16 : tmp & 0xffff;
1102         return 0;
1103 }
1104
1105 static int
1106 run_eeprom_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1107 {
1108         usb_device_request_t req;
1109         uint16_t tmp;
1110         int error;
1111
1112         addr *= 2;
1113         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1114         req.bRequest = RT2870_EEPROM_READ;
1115         USETW(req.wValue, 0);
1116         USETW(req.wIndex, addr);
1117         USETW(req.wLength, sizeof tmp);
1118
1119         error = usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, &tmp);
1120         if (error == 0)
1121                 *val = le16toh(tmp);
1122         else
1123                 *val = 0xffff;
1124         return error;
1125 }
1126
1127 static __inline int
1128 run_srom_read(struct run_softc *sc, uint16_t addr, uint16_t *val)
1129 {
1130         /* either eFUSE ROM or EEPROM */
1131         return sc->sc_srom_read(sc, addr, val);
1132 }
1133
1134 static int
1135 run_rt2870_rf_write(struct run_softc *sc, uint8_t reg, uint32_t val)
1136 {
1137         uint32_t tmp;
1138         int error, ntries;
1139
1140         for (ntries = 0; ntries < 10; ntries++) {
1141                 if ((error = run_read(sc, RT2860_RF_CSR_CFG0, &tmp)) != 0)
1142                         return error;
1143                 if (!(tmp & RT2860_RF_REG_CTRL))
1144                         break;
1145         }
1146         if (ntries == 10)
1147                 return ETIMEDOUT;
1148
1149         /* RF registers are 24-bit on the RT2860 */
1150         tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
1151             (val & 0x3fffff) << 2 | (reg & 3);
1152         return run_write(sc, RT2860_RF_CSR_CFG0, tmp);
1153 }
1154
1155 static int
1156 run_rt3070_rf_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1157 {
1158         uint32_t tmp;
1159         int error, ntries;
1160
1161         for (ntries = 0; ntries < 100; ntries++) {
1162                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1163                         return error;
1164                 if (!(tmp & RT3070_RF_KICK))
1165                         break;
1166         }
1167         if (ntries == 100)
1168                 return ETIMEDOUT;
1169
1170         tmp = RT3070_RF_KICK | reg << 8;
1171         if ((error = run_write(sc, RT3070_RF_CSR_CFG, tmp)) != 0)
1172                 return error;
1173
1174         for (ntries = 0; ntries < 100; ntries++) {
1175                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1176                         return error;
1177                 if (!(tmp & RT3070_RF_KICK))
1178                         break;
1179         }
1180         if (ntries == 100)
1181                 return ETIMEDOUT;
1182
1183         *val = tmp & 0xff;
1184         return 0;
1185 }
1186
1187 static int
1188 run_rt3070_rf_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1189 {
1190         uint32_t tmp;
1191         int error, ntries;
1192
1193         for (ntries = 0; ntries < 10; ntries++) {
1194                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1195                         return error;
1196                 if (!(tmp & RT3070_RF_KICK))
1197                         break;
1198         }
1199         if (ntries == 10)
1200                 return ETIMEDOUT;
1201
1202         tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
1203         return run_write(sc, RT3070_RF_CSR_CFG, tmp);
1204 }
1205
1206 static int
1207 run_bbp_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1208 {
1209         uint32_t tmp;
1210         int ntries, error;
1211
1212         for (ntries = 0; ntries < 10; ntries++) {
1213                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1214                         return error;
1215                 if (!(tmp & RT2860_BBP_CSR_KICK))
1216                         break;
1217         }
1218         if (ntries == 10)
1219                 return ETIMEDOUT;
1220
1221         tmp = RT2860_BBP_CSR_READ | RT2860_BBP_CSR_KICK | reg << 8;
1222         if ((error = run_write(sc, RT2860_BBP_CSR_CFG, tmp)) != 0)
1223                 return error;
1224
1225         for (ntries = 0; ntries < 10; ntries++) {
1226                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1227                         return error;
1228                 if (!(tmp & RT2860_BBP_CSR_KICK))
1229                         break;
1230         }
1231         if (ntries == 10)
1232                 return ETIMEDOUT;
1233
1234         *val = tmp & 0xff;
1235         return 0;
1236 }
1237
1238 static int
1239 run_bbp_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1240 {
1241         uint32_t tmp;
1242         int ntries, error;
1243
1244         for (ntries = 0; ntries < 10; ntries++) {
1245                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1246                         return error;
1247                 if (!(tmp & RT2860_BBP_CSR_KICK))
1248                         break;
1249         }
1250         if (ntries == 10)
1251                 return ETIMEDOUT;
1252
1253         tmp = RT2860_BBP_CSR_KICK | reg << 8 | val;
1254         return run_write(sc, RT2860_BBP_CSR_CFG, tmp);
1255 }
1256
1257 /*
1258  * Send a command to the 8051 microcontroller unit.
1259  */
1260 static int
1261 run_mcu_cmd(struct run_softc *sc, uint8_t cmd, uint16_t arg)
1262 {
1263         uint32_t tmp;
1264         int error, ntries;
1265
1266         for (ntries = 0; ntries < 100; ntries++) {
1267                 if ((error = run_read(sc, RT2860_H2M_MAILBOX, &tmp)) != 0)
1268                         return error;
1269                 if (!(tmp & RT2860_H2M_BUSY))
1270                         break;
1271         }
1272         if (ntries == 100)
1273                 return ETIMEDOUT;
1274
1275         tmp = RT2860_H2M_BUSY | RT2860_TOKEN_NO_INTR << 16 | arg;
1276         if ((error = run_write(sc, RT2860_H2M_MAILBOX, tmp)) == 0)
1277                 error = run_write(sc, RT2860_HOST_CMD, cmd);
1278         return error;
1279 }
1280
1281 /*
1282  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
1283  * Used to adjust per-rate Tx power registers.
1284  */
1285 static __inline uint32_t
1286 b4inc(uint32_t b32, int8_t delta)
1287 {
1288         int8_t i, b4;
1289
1290         for (i = 0; i < 8; i++) {
1291                 b4 = b32 & 0xf;
1292                 b4 += delta;
1293                 if (b4 < 0)
1294                         b4 = 0;
1295                 else if (b4 > 0xf)
1296                         b4 = 0xf;
1297                 b32 = b32 >> 4 | b4 << 28;
1298         }
1299         return b32;
1300 }
1301
1302 static const char *
1303 run_get_rf(int rev)
1304 {
1305         switch (rev) {
1306         case RT2860_RF_2820:    return "RT2820";
1307         case RT2860_RF_2850:    return "RT2850";
1308         case RT2860_RF_2720:    return "RT2720";
1309         case RT2860_RF_2750:    return "RT2750";
1310         case RT3070_RF_3020:    return "RT3020";
1311         case RT3070_RF_2020:    return "RT2020";
1312         case RT3070_RF_3021:    return "RT3021";
1313         case RT3070_RF_3022:    return "RT3022";
1314         case RT3070_RF_3052:    return "RT3052";
1315         }
1316         return "unknown";
1317 }
1318
1319 int
1320 run_read_eeprom(struct run_softc *sc)
1321 {
1322         int8_t delta_2ghz, delta_5ghz;
1323         uint32_t tmp;
1324         uint16_t val;
1325         int ridx, ant, i;
1326
1327         /* check whether the ROM is eFUSE ROM or EEPROM */
1328         sc->sc_srom_read = run_eeprom_read_2;
1329         if (sc->mac_ver >= 0x3070) {
1330                 run_read(sc, RT3070_EFUSE_CTRL, &tmp);
1331                 DPRINTF("EFUSE_CTRL=0x%08x\n", tmp);
1332                 if (tmp & RT3070_SEL_EFUSE)
1333                         sc->sc_srom_read = run_efuse_read_2;
1334         }
1335
1336         /* read ROM version */
1337         run_srom_read(sc, RT2860_EEPROM_VERSION, &val);
1338         DPRINTF("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8);
1339
1340         /* read MAC address */
1341         run_srom_read(sc, RT2860_EEPROM_MAC01, &val);
1342         sc->sc_bssid[0] = val & 0xff;
1343         sc->sc_bssid[1] = val >> 8;
1344         run_srom_read(sc, RT2860_EEPROM_MAC23, &val);
1345         sc->sc_bssid[2] = val & 0xff;
1346         sc->sc_bssid[3] = val >> 8;
1347         run_srom_read(sc, RT2860_EEPROM_MAC45, &val);
1348         sc->sc_bssid[4] = val & 0xff;
1349         sc->sc_bssid[5] = val >> 8;
1350
1351         /* read vender BBP settings */
1352         for (i = 0; i < 10; i++) {
1353                 run_srom_read(sc, RT2860_EEPROM_BBP_BASE + i, &val);
1354                 sc->bbp[i].val = val & 0xff;
1355                 sc->bbp[i].reg = val >> 8;
1356                 DPRINTF("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val);
1357         }
1358         if (sc->mac_ver >= 0x3071) {
1359                 /* read vendor RF settings */
1360                 for (i = 0; i < 10; i++) {
1361                         run_srom_read(sc, RT3071_EEPROM_RF_BASE + i, &val);
1362                         sc->rf[i].val = val & 0xff;
1363                         sc->rf[i].reg = val >> 8;
1364                         DPRINTF("RF%d=0x%02x\n", sc->rf[i].reg,
1365                             sc->rf[i].val);
1366                 }
1367         }
1368
1369         /* read RF frequency offset from EEPROM */
1370         run_srom_read(sc, RT2860_EEPROM_FREQ_LEDS, &val);
1371         sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
1372         DPRINTF("EEPROM freq offset %d\n", sc->freq & 0xff);
1373
1374         if (val >> 8 != 0xff) {
1375                 /* read LEDs operating mode */
1376                 sc->leds = val >> 8;
1377                 run_srom_read(sc, RT2860_EEPROM_LED1, &sc->led[0]);
1378                 run_srom_read(sc, RT2860_EEPROM_LED2, &sc->led[1]);
1379                 run_srom_read(sc, RT2860_EEPROM_LED3, &sc->led[2]);
1380         } else {
1381                 /* broken EEPROM, use default settings */
1382                 sc->leds = 0x01;
1383                 sc->led[0] = 0x5555;
1384                 sc->led[1] = 0x2221;
1385                 sc->led[2] = 0x5627;    /* differs from RT2860 */
1386         }
1387         DPRINTF("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
1388             sc->leds, sc->led[0], sc->led[1], sc->led[2]);
1389
1390         /* read RF information */
1391         run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1392         if (val == 0xffff) {
1393                 DPRINTF("invalid EEPROM antenna info, using default\n");
1394                 if (sc->mac_ver == 0x3572) {
1395                         /* default to RF3052 2T2R */
1396                         sc->rf_rev = RT3070_RF_3052;
1397                         sc->ntxchains = 2;
1398                         sc->nrxchains = 2;
1399                 } else if (sc->mac_ver >= 0x3070) {
1400                         /* default to RF3020 1T1R */
1401                         sc->rf_rev = RT3070_RF_3020;
1402                         sc->ntxchains = 1;
1403                         sc->nrxchains = 1;
1404                 } else {
1405                         /* default to RF2820 1T2R */
1406                         sc->rf_rev = RT2860_RF_2820;
1407                         sc->ntxchains = 1;
1408                         sc->nrxchains = 2;
1409                 }
1410         } else {
1411                 sc->rf_rev = (val >> 8) & 0xf;
1412                 sc->ntxchains = (val >> 4) & 0xf;
1413                 sc->nrxchains = val & 0xf;
1414         }
1415         DPRINTF("EEPROM RF rev=0x%02x chains=%dT%dR\n",
1416             sc->rf_rev, sc->ntxchains, sc->nrxchains);
1417
1418         run_srom_read(sc, RT2860_EEPROM_CONFIG, &val);
1419         DPRINTF("EEPROM CFG 0x%04x\n", val);
1420         /* check if driver should patch the DAC issue */
1421         if ((val >> 8) != 0xff)
1422                 sc->patch_dac = (val >> 15) & 1;
1423         if ((val & 0xff) != 0xff) {
1424                 sc->ext_5ghz_lna = (val >> 3) & 1;
1425                 sc->ext_2ghz_lna = (val >> 2) & 1;
1426                 /* check if RF supports automatic Tx access gain control */
1427                 sc->calib_2ghz = sc->calib_5ghz = (val >> 1) & 1;
1428                 /* check if we have a hardware radio switch */
1429                 sc->rfswitch = val & 1;
1430         }
1431
1432         /* read power settings for 2GHz channels */
1433         for (i = 0; i < 14; i += 2) {
1434                 run_srom_read(sc, RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2, &val);
1435                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1436                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1437
1438                 run_srom_read(sc, RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2, &val);
1439                 sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1440                 sc->txpow2[i + 1] = (int8_t)(val >> 8);
1441         }
1442         /* fix broken Tx power entries */
1443         for (i = 0; i < 14; i++) {
1444                 if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
1445                         sc->txpow1[i] = 5;
1446                 if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
1447                         sc->txpow2[i] = 5;
1448                 DPRINTF("chan %d: power1=%d, power2=%d\n",
1449                     rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]);
1450         }
1451         /* read power settings for 5GHz channels */
1452         for (i = 0; i < 40; i += 2) {
1453                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1454                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1455                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1456
1457                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1458                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1459                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1460         }
1461         /* fix broken Tx power entries */
1462         for (i = 0; i < 40; i++) {
1463                 if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
1464                         sc->txpow1[14 + i] = 5;
1465                 if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
1466                         sc->txpow2[14 + i] = 5;
1467                 DPRINTF("chan %d: power1=%d, power2=%d\n",
1468                     rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
1469                     sc->txpow2[14 + i]);
1470         }
1471
1472         /* read Tx power compensation for each Tx rate */
1473         run_srom_read(sc, RT2860_EEPROM_DELTAPWR, &val);
1474         delta_2ghz = delta_5ghz = 0;
1475         if ((val & 0xff) != 0xff && (val & 0x80)) {
1476                 delta_2ghz = val & 0xf;
1477                 if (!(val & 0x40))      /* negative number */
1478                         delta_2ghz = -delta_2ghz;
1479         }
1480         val >>= 8;
1481         if ((val & 0xff) != 0xff && (val & 0x80)) {
1482                 delta_5ghz = val & 0xf;
1483                 if (!(val & 0x40))      /* negative number */
1484                         delta_5ghz = -delta_5ghz;
1485         }
1486         DPRINTF("power compensation=%d (2GHz), %d (5GHz)\n",
1487             delta_2ghz, delta_5ghz);
1488
1489         for (ridx = 0; ridx < 5; ridx++) {
1490                 uint32_t reg;
1491
1492                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx, &val);
1493                 reg = (uint32_t)val << 16;
1494                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx + 1, &val);
1495                 reg |= val;
1496
1497                 sc->txpow20mhz[ridx] = reg;
1498                 sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
1499                 sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
1500
1501                 DPRINTF("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
1502                     "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
1503                     sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]);
1504         }
1505
1506         /* read RSSI offsets and LNA gains from EEPROM */
1507         run_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ, &val);
1508         sc->rssi_2ghz[0] = val & 0xff;  /* Ant A */
1509         sc->rssi_2ghz[1] = val >> 8;    /* Ant B */
1510         run_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ, &val);
1511         if (sc->mac_ver >= 0x3070) {
1512                 /*
1513                  * On RT3070 chips (limited to 2 Rx chains), this ROM
1514                  * field contains the Tx mixer gain for the 2GHz band.
1515                  */
1516                 if ((val & 0xff) != 0xff)
1517                         sc->txmixgain_2ghz = val & 0x7;
1518                 DPRINTF("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz);
1519         } else
1520                 sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1521         sc->lna[2] = val >> 8;          /* channel group 2 */
1522
1523         run_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ, &val);
1524         sc->rssi_5ghz[0] = val & 0xff;  /* Ant A */
1525         sc->rssi_5ghz[1] = val >> 8;    /* Ant B */
1526         run_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ, &val);
1527         if (sc->mac_ver == 0x3572) {
1528                 /*
1529                  * On RT3572 chips (limited to 2 Rx chains), this ROM
1530                  * field contains the Tx mixer gain for the 5GHz band.
1531                  */
1532                 if ((val & 0xff) != 0xff)
1533                         sc->txmixgain_5ghz = val & 0x7;
1534                 DPRINTF("tx mixer gain=%u (5GHz)\n", sc->txmixgain_5ghz);
1535         } else
1536                 sc->rssi_5ghz[2] = val & 0xff;  /* Ant C */
1537         sc->lna[3] = val >> 8;          /* channel group 3 */
1538
1539         run_srom_read(sc, RT2860_EEPROM_LNA, &val);
1540         sc->lna[0] = val & 0xff;        /* channel group 0 */
1541         sc->lna[1] = val >> 8;          /* channel group 1 */
1542
1543         /* fix broken 5GHz LNA entries */
1544         if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
1545                 DPRINTF("invalid LNA for channel group %d\n", 2);
1546                 sc->lna[2] = sc->lna[1];
1547         }
1548         if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
1549                 DPRINTF("invalid LNA for channel group %d\n", 3);
1550                 sc->lna[3] = sc->lna[1];
1551         }
1552
1553         /* fix broken RSSI offset entries */
1554         for (ant = 0; ant < 3; ant++) {
1555                 if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
1556                         DPRINTF("invalid RSSI%d offset: %d (2GHz)\n",
1557                             ant + 1, sc->rssi_2ghz[ant]);
1558                         sc->rssi_2ghz[ant] = 0;
1559                 }
1560                 if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
1561                         DPRINTF("invalid RSSI%d offset: %d (5GHz)\n",
1562                             ant + 1, sc->rssi_5ghz[ant]);
1563                         sc->rssi_5ghz[ant] = 0;
1564                 }
1565         }
1566         return 0;
1567 }
1568
1569 struct ieee80211_node *
1570 run_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
1571 {
1572         return malloc(sizeof (struct run_node), M_DEVBUF, M_NOWAIT | M_ZERO);
1573 }
1574
1575 static int
1576 run_media_change(struct ifnet *ifp)
1577 {
1578         const struct ieee80211_txparam *tp;
1579         struct run_softc *sc = ifp->if_softc;
1580         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1581         struct ieee80211vap *vap = &sc->sc_rvp->vap;
1582         uint8_t rate, ridx;
1583         int error;
1584
1585         RUN_LOCK(sc);
1586
1587         error = ieee80211_media_change(ifp);
1588         if (error != ENETRESET)
1589                 RUN_UNLOCK(sc);
1590                 return error;
1591
1592         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1593         if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1594                 rate = ic->ic_sup_rates[ic->ic_curmode].
1595                     rs_rates[tp->ucastrate] & IEEE80211_RATE_VAL;
1596                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
1597                         if (rt2860_rates[ridx].rate == rate)
1598                                 break;
1599                 sc->fixed_ridx = ridx;
1600         }
1601
1602         if ((ifp->if_flags & IFF_UP) &&
1603             (ifp->if_drv_flags &  IFF_DRV_RUNNING)){
1604                 run_init_locked(sc);
1605         }
1606
1607         RUN_UNLOCK(sc);
1608
1609         return 0;
1610 }
1611
1612 static int
1613 run_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
1614 {
1615         const struct ieee80211_txparam *tp;
1616         struct ieee80211com *ic = vap->iv_ic;
1617         struct run_softc *sc = ic->ic_ifp->if_softc;
1618         struct run_vap *rvp = RUN_VAP(vap);
1619         enum ieee80211_state ostate;
1620         struct ieee80211_node *ni;
1621         uint32_t tmp;
1622         uint8_t wcid;
1623
1624         ostate = vap->iv_state;
1625         DPRINTF("%s -> %s\n",
1626                 ieee80211_state_name[ostate],
1627                 ieee80211_state_name[nstate]);
1628
1629         IEEE80211_UNLOCK(ic);
1630         RUN_LOCK(sc);
1631
1632         sc->sc_rvp->ratectl_run = RUN_RATECTL_OFF;
1633         usb_callout_stop(&rvp->ratectl_ch);
1634
1635         if (ostate == IEEE80211_S_RUN) {
1636                 /* turn link LED off */
1637                 run_set_leds(sc, RT2860_LED_RADIO);
1638         }
1639
1640         switch (nstate) {
1641         case IEEE80211_S_INIT:
1642                 if (ostate == IEEE80211_S_RUN) {
1643                         /* abort TSF synchronization */
1644                         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
1645                         run_write(sc, RT2860_BCN_TIME_CFG,
1646                             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
1647                             RT2860_TBTT_TIMER_EN));
1648                 }
1649                 break;
1650
1651         case IEEE80211_S_RUN:
1652                 ni = vap->iv_bss;
1653
1654                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
1655                         run_updateslot(ic->ic_ifp);
1656                         run_enable_mrr(sc);
1657                         run_set_txpreamble(sc);
1658                         run_set_basicrates(sc);
1659                         IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
1660                         run_set_bssid(sc, ni->ni_bssid);
1661                 }
1662
1663                 if (vap->iv_opmode == IEEE80211_M_STA) {
1664                         /* add BSS entry to the WCID table */
1665                         wcid = RUN_AID2WCID(ni->ni_associd);
1666                         run_write_region_1(sc, RT2860_WCID_ENTRY(wcid),
1667                             ni->ni_macaddr, IEEE80211_ADDR_LEN);
1668                 }
1669
1670                 if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
1671                     vap->iv_opmode == IEEE80211_M_IBSS)
1672                         run_update_beacon_locked(vap, 0);
1673
1674                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
1675                         run_enable_tsf_sync(sc);
1676                 } /* else tsf */
1677
1678                 /* enable automatic rate adaptation */
1679                 tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
1680                 if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
1681                         run_ratectl_start(sc, ni);
1682
1683                 /* turn link LED on */
1684                 run_set_leds(sc, RT2860_LED_RADIO |
1685                     (IEEE80211_IS_CHAN_2GHZ(vap->iv_bss->ni_chan) ?
1686                      RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
1687
1688                 break;
1689         default:
1690                 DPRINTFN(6, "undefined case\n");
1691                 break;
1692         }
1693
1694         RUN_UNLOCK(sc);
1695         IEEE80211_LOCK(ic);
1696
1697         return(rvp->newstate(vap, nstate, arg));
1698 }
1699
1700 /* another taskqueue, so usbd_do_request() can go sleep */
1701 static int
1702 run_wme_update(struct ieee80211com *ic)
1703 {
1704         struct run_softc *sc = ic->ic_ifp->if_softc;
1705
1706         ieee80211_runtask(ic, &sc->wme_task);
1707
1708         /* return whatever, upper layer desn't care anyway */
1709         return 0;
1710 }
1711
1712 /* ARGSUSED */
1713 static void
1714 run_wme_update_cb(void *arg, int pending)
1715 {
1716         struct ieee80211com *ic = arg;
1717         struct run_softc *sc = ic->ic_ifp->if_softc;
1718         struct ieee80211_wme_state *wmesp = &ic->ic_wme;
1719         int aci, error = 0;
1720
1721         RUN_LOCK(sc);
1722
1723         /* update MAC TX configuration registers */
1724         for (aci = 0; aci < WME_NUM_AC; aci++) {
1725                 error = run_write(sc, RT2860_EDCA_AC_CFG(aci),
1726                     wmesp->wme_params[aci].wmep_logcwmax << 16 |
1727                     wmesp->wme_params[aci].wmep_logcwmin << 12 |
1728                     wmesp->wme_params[aci].wmep_aifsn  <<  8 |
1729                     wmesp->wme_params[aci].wmep_txopLimit);
1730                 if(error) goto err;
1731         }
1732
1733         /* update SCH/DMA registers too */
1734         error = run_write(sc, RT2860_WMM_AIFSN_CFG,
1735             wmesp->wme_params[WME_AC_VO].wmep_aifsn  << 12 |
1736             wmesp->wme_params[WME_AC_VI].wmep_aifsn  <<  8 |
1737             wmesp->wme_params[WME_AC_BK].wmep_aifsn  <<  4 |
1738             wmesp->wme_params[WME_AC_BE].wmep_aifsn);
1739         if(error) goto err;
1740         error = run_write(sc, RT2860_WMM_CWMIN_CFG,
1741             wmesp->wme_params[WME_AC_VO].wmep_logcwmin << 12 |
1742             wmesp->wme_params[WME_AC_VI].wmep_logcwmin <<  8 |
1743             wmesp->wme_params[WME_AC_BK].wmep_logcwmin <<  4 |
1744             wmesp->wme_params[WME_AC_BE].wmep_logcwmin);
1745         if(error) goto err;
1746         error = run_write(sc, RT2860_WMM_CWMAX_CFG,
1747             wmesp->wme_params[WME_AC_VO].wmep_logcwmax << 12 |
1748             wmesp->wme_params[WME_AC_VI].wmep_logcwmax <<  8 |
1749             wmesp->wme_params[WME_AC_BK].wmep_logcwmax <<  4 |
1750             wmesp->wme_params[WME_AC_BE].wmep_logcwmax);
1751         if(error) goto err;
1752         error = run_write(sc, RT2860_WMM_TXOP0_CFG,
1753             wmesp->wme_params[WME_AC_BK].wmep_txopLimit << 16 |
1754             wmesp->wme_params[WME_AC_BE].wmep_txopLimit);
1755         if(error) goto err;
1756         error = run_write(sc, RT2860_WMM_TXOP1_CFG,
1757             wmesp->wme_params[WME_AC_VO].wmep_txopLimit << 16 |
1758             wmesp->wme_params[WME_AC_VI].wmep_txopLimit);
1759
1760 err:
1761         if(error)
1762                 DPRINTF("WME update failed\n");
1763
1764         RUN_UNLOCK(sc);
1765         return;
1766 }
1767
1768 static void
1769 run_key_update_begin(struct ieee80211vap *vap)
1770 {
1771         /*
1772          * Because run_key_delete() needs special attention
1773          * on lock related operation, lock handling is being done
1774          * differently in run_key_set and _delete.
1775          *
1776          * So, we don't use key_update_begin and _end.
1777          */
1778 }
1779
1780 static void
1781 run_key_update_end(struct ieee80211vap *vap)
1782 {
1783         /* null */
1784 }
1785
1786 /*
1787  * return 0 on error
1788  */
1789 static int
1790 run_key_set(struct ieee80211vap *vap, const struct ieee80211_key *k,
1791                 const uint8_t mac[IEEE80211_ADDR_LEN])
1792 {
1793         struct ieee80211com *ic = vap->iv_ic;
1794         struct ifnet *ifp = ic->ic_ifp;
1795         struct run_softc *sc = ifp->if_softc;
1796         struct ieee80211_node *ni;
1797         uint32_t attr;
1798         uint16_t base, associd;
1799         uint8_t mode, wcid, txmic, rxmic, iv[8];
1800         int error = 0;
1801
1802         RUN_LOCK(sc);
1803
1804         if(vap->iv_opmode == IEEE80211_M_HOSTAP){
1805                 ni = ieee80211_find_vap_node(&ic->ic_sta, vap, mac);
1806                 associd = (ni != NULL) ? ni->ni_associd : 0;
1807                 if(ni != NULL)
1808                         ieee80211_free_node(ni);
1809                 txmic = 24;
1810                 rxmic = 16;
1811         } else {
1812                 ni = vap->iv_bss;
1813                 associd = (ni != NULL) ? ni->ni_associd : 0;
1814                 txmic = 16;
1815                 rxmic = 24;
1816         }
1817
1818         /* map net80211 cipher to RT2860 security mode */
1819         switch (k->wk_cipher->ic_cipher) {
1820         case IEEE80211_CIPHER_WEP:
1821                 if(k->wk_keylen < 8)
1822                         mode = RT2860_MODE_WEP40;
1823                 else
1824                         mode = RT2860_MODE_WEP104;
1825                 break;
1826         case IEEE80211_CIPHER_TKIP:
1827                 mode = RT2860_MODE_TKIP;
1828                 break;
1829         case IEEE80211_CIPHER_AES_CCM:
1830                 mode = RT2860_MODE_AES_CCMP;
1831                 break;
1832         default:
1833                 DPRINTF("undefined case\n");
1834                 goto fail;
1835         }
1836
1837         DPRINTFN(1, "associd=%x, keyix=%d, mode=%x, type=%s\n",
1838             associd, k->wk_keyix, mode,
1839             (k->wk_flags & IEEE80211_KEY_GROUP) ? "group" : "pairwise");
1840
1841         if (k->wk_flags & IEEE80211_KEY_GROUP) {
1842                 wcid = 0;       /* NB: update WCID0 for group keys */
1843                 base = RT2860_SKEY(0, k->wk_keyix);
1844         } else {
1845                 wcid = RUN_AID2WCID(associd);
1846                 base = RT2860_PKEY(wcid);
1847         }
1848
1849         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
1850                 if(run_write_region_1(sc, base, k->wk_key, 16))
1851                         goto fail;
1852                 if(run_write_region_1(sc, base + 16, &k->wk_key[txmic], 8))     /* wk_txmic */
1853                         goto fail;
1854                 if(run_write_region_1(sc, base + 24, &k->wk_key[rxmic], 8))     /* wk_rxmic */
1855                         goto fail;
1856         } else {
1857                 /* roundup len to 16-bit: XXX fix write_region_1() instead */
1858                 if(run_write_region_1(sc, base, k->wk_key, (k->wk_keylen + 1) & ~1))
1859                         goto fail;
1860         }
1861
1862         if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
1863             (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))) {
1864                 /* set initial packet number in IV+EIV */
1865                 if (k->wk_cipher == IEEE80211_CIPHER_WEP){
1866                         memset(iv, 0, sizeof iv);
1867                         iv[3] = sc->sc_rvp->vap.iv_def_txkey << 6;
1868                 } else {
1869                         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
1870                                 iv[0] = k->wk_keytsc >> 8;
1871                                 iv[1] = (iv[0] | 0x20) & 0x7f;
1872                                 iv[2] = k->wk_keytsc;
1873                         } else /* CCMP */ {
1874                                 iv[0] = k->wk_keytsc;
1875                                 iv[1] = k->wk_keytsc >> 8;
1876                                 iv[2] = 0;
1877                         }
1878                         iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
1879                         iv[4] = k->wk_keytsc >> 16;
1880                         iv[5] = k->wk_keytsc >> 24;
1881                         iv[6] = k->wk_keytsc >> 32;
1882                         iv[7] = k->wk_keytsc >> 40;
1883                 }
1884                 if(run_write_region_1(sc, RT2860_IVEIV(wcid), iv, 8))
1885                         goto fail;
1886         }
1887
1888         if (k->wk_flags & IEEE80211_KEY_GROUP) {
1889                 /* install group key */
1890                 if(run_read(sc, RT2860_SKEY_MODE_0_7, &attr))
1891                         goto fail;
1892                 attr &= ~(0xf << (k->wk_keyix * 4));
1893                 attr |= mode << (k->wk_keyix * 4);
1894                 if(run_write(sc, RT2860_SKEY_MODE_0_7, attr))
1895                         goto fail;
1896         } else {
1897                 /* install pairwise key */
1898                 if(run_read(sc, RT2860_WCID_ATTR(wcid), &attr))
1899                         goto fail;
1900                 attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
1901                 if(run_write(sc, RT2860_WCID_ATTR(wcid), attr))
1902                         goto fail;
1903         }
1904
1905         /* TODO create a pass-thru key entry? */
1906
1907 fail:
1908         RUN_UNLOCK(sc);
1909         return (error? 0 : 1);
1910 }
1911
1912 /*
1913  * return 0 on error
1914  */
1915 static int
1916 run_key_delete(struct ieee80211vap *vap, const struct ieee80211_key *k)
1917 {
1918         struct ieee80211com *ic = vap->iv_ic;
1919         struct run_softc *sc = ic->ic_ifp->if_softc;
1920         struct ieee80211_node *ni = vap->iv_bss;
1921         struct ieee80211_node_table *nt = &ic->ic_sta;
1922         uint32_t attr;
1923         uint8_t wcid;
1924         int error = 0;
1925         uint8_t nislocked, cislocked;
1926
1927         if((nislocked = IEEE80211_NODE_IS_LOCKED(nt)))
1928                 IEEE80211_NODE_UNLOCK(nt);
1929         if((cislocked = mtx_owned(&ic->ic_comlock.mtx)))
1930                 IEEE80211_UNLOCK(ic);
1931         RUN_LOCK(sc);
1932
1933         if (k->wk_flags & IEEE80211_KEY_GROUP) {
1934                 /* remove group key */
1935                 if(run_read(sc, RT2860_SKEY_MODE_0_7, &attr))
1936                         goto fail;
1937                 attr &= ~(0xf << (k->wk_keyix * 4));
1938                 if(run_write(sc, RT2860_SKEY_MODE_0_7, attr))
1939                         goto fail;
1940         } else {
1941                 /* remove pairwise key */
1942                 wcid = RUN_AID2WCID((ni != NULL) ? ni->ni_associd : 0);
1943                 if(run_read(sc, RT2860_WCID_ATTR(wcid), &attr))
1944                         goto fail;
1945                 attr &= ~0xf;
1946                 if(run_write(sc, RT2860_WCID_ATTR(wcid), attr))
1947                         goto fail;
1948         }
1949
1950 fail:
1951         RUN_UNLOCK(sc);
1952         if(cislocked)
1953                 IEEE80211_LOCK(ic);
1954         if(nislocked)
1955                 IEEE80211_NODE_LOCK(nt);
1956
1957         return (error? 0 : 1);
1958 }
1959
1960 static void
1961 run_ratectl_start(struct run_softc *sc, struct ieee80211_node *ni)
1962 {
1963         struct ieee80211vap *vap = ni->ni_vap;
1964         struct run_vap *rvp = RUN_VAP(vap);
1965         uint32_t sta[3];
1966
1967         RUN_LOCK_ASSERT(sc, MA_OWNED);
1968
1969         /* read statistic counters (clear on read) and update AMRR state */
1970         run_read_region_1(sc, RT2860_TX_STA_CNT0,
1971             (uint8_t *)sta, sizeof sta);
1972
1973         ieee80211_ratectl_node_init(ni);
1974
1975         /* start at lowest available bit-rate, AMRR will raise */
1976         ni->ni_txrate = 2;
1977
1978         /* start calibration timer */
1979         rvp->ratectl_run = RUN_RATECTL_ON;
1980         usb_callout_reset(&rvp->ratectl_ch, hz, run_ratectl_to, rvp);
1981 }
1982
1983 static void
1984 run_ratectl_to(void *arg)
1985 {
1986         struct run_vap *rvp = arg;
1987
1988         /* do it in a process context, so it can go sleep */
1989         ieee80211_runtask(rvp->vap.iv_ic, &rvp->ratectl_task);
1990         /* next timeout will be rescheduled in the callback task */
1991 }
1992
1993 /* ARGSUSED */
1994 static void
1995 run_ratectl_cb(void *arg, int pending)
1996 {
1997         struct run_vap *rvp = arg;
1998         struct ieee80211vap *vap = &rvp->vap;
1999         struct ieee80211com *ic = vap->iv_ic;
2000         struct run_softc *sc = ic->ic_ifp->if_softc;
2001
2002         if (ic->ic_opmode == IEEE80211_M_STA)
2003                 run_iter_func(rvp, vap->iv_bss);
2004         else {
2005                 /*
2006                  * run_reset_livelock() doesn't do anything with AMRR,
2007                  * but Ralink wants us to call it every 1 sec. So, we
2008                  * piggyback here rather than creating another callout.
2009                  * Livelock may occur only in HOSTAP or IBSS mode
2010                  * (when h/w is sending beacons).
2011                  */
2012                 RUN_LOCK(sc);
2013                 run_reset_livelock(sc);
2014                 RUN_UNLOCK(sc);
2015                 ieee80211_iterate_nodes(&ic->ic_sta, run_iter_func, rvp);
2016         }
2017
2018         if(rvp->ratectl_run == RUN_RATECTL_ON)
2019                 usb_callout_reset(&rvp->ratectl_ch, hz, run_ratectl_to, rvp);
2020 }
2021
2022
2023 static void
2024 run_iter_func(void *arg, struct ieee80211_node *ni)
2025 {
2026         struct run_vap *rvp = arg;
2027         struct ieee80211com *ic = rvp->vap.iv_ic;
2028         struct ifnet *ifp = ic->ic_ifp;
2029         struct run_softc *sc = ifp->if_softc;
2030         struct ieee80211_node_table *nt = &ic->ic_sta;
2031         uint32_t sta[3], stat;
2032         int error;
2033         uint8_t wcid, mcs, pid;
2034         struct ieee80211vap *vap = ni->ni_vap;
2035         int txcnt = 0, success = 0, retrycnt = 0;
2036
2037         if(ic->ic_opmode != IEEE80211_M_STA)
2038                 IEEE80211_NODE_ITERATE_UNLOCK(nt);
2039
2040         RUN_LOCK(sc);
2041
2042         if(ic->ic_opmode != IEEE80211_M_STA){
2043                 /* drain Tx status FIFO (maxsize = 16) */
2044                 run_read(sc, RT2860_TX_STAT_FIFO, &stat);
2045                 while (stat & RT2860_TXQ_VLD) {
2046                         DPRINTFN(4, "tx stat 0x%08x\n", stat);
2047
2048                         wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
2049
2050                         /* if no ACK was requested, no feedback is available */
2051                         if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff)
2052                                 continue;
2053
2054                         /* update per-STA AMRR stats */
2055                         if (stat & RT2860_TXQ_OK) {
2056                                 /*
2057                                  * Check if there were retries, ie if the Tx
2058                                  * success rate is different from the requested
2059                                  * rate.  Note that it works only because we do
2060                                  * not allow rate fallback from OFDM to CCK.
2061                                  */
2062                                 mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
2063                                 pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
2064                                 if (mcs + 1 != pid)
2065                                         retrycnt = 1;
2066                                 ieee80211_ratectl_tx_complete(vap, ni,
2067                                     IEEE80211_RATECTL_TX_SUCCESS,
2068                                     &retrycnt, NULL);
2069                         } else {
2070                                 retrycnt = 1;
2071                                 ieee80211_ratectl_tx_complete(vap, ni,
2072                                     IEEE80211_RATECTL_TX_SUCCESS,
2073                                     &retrycnt, NULL);
2074                                 ifp->if_oerrors++;
2075                         }
2076                         run_read_region_1(sc, RT2860_TX_STAT_FIFO,
2077                             (uint8_t *)&stat, sizeof stat);
2078                 }
2079         } else {
2080                 /* read statistic counters (clear on read) and update AMRR state */
2081                 error = run_read_region_1(sc, RT2860_TX_STA_CNT0, (uint8_t *)sta,
2082                     sizeof sta);
2083                 if (error != 0)
2084                         goto skip;
2085
2086                 DPRINTFN(3, "retrycnt=%d txcnt=%d failcnt=%d\n",
2087                     le32toh(sta[1]) >> 16, le32toh(sta[1]) & 0xffff,
2088                     le32toh(sta[0]) & 0xffff);
2089
2090                 /* count failed TX as errors */
2091                 ifp->if_oerrors += le32toh(sta[0]) & 0xffff;
2092
2093                 retrycnt =
2094                     (le32toh(sta[0]) & 0xffff) +        /* failed TX count */
2095                     (le32toh(sta[1]) >> 16);            /* TX retransmission count */
2096
2097                 txcnt =
2098                     retrycnt +
2099                     (le32toh(sta[1]) & 0xffff);         /* successful TX count */
2100
2101                 success =
2102                     (le32toh(sta[1]) >> 16) +
2103                     (le32toh(sta[1]) & 0xffff);
2104                 ieee80211_ratectl_tx_update(vap, ni, &txcnt, &success,
2105                     &retrycnt);
2106         }
2107
2108         ieee80211_ratectl_rate(ni, NULL, 0);
2109
2110 skip:;
2111         RUN_UNLOCK(sc);
2112
2113         if(ic->ic_opmode != IEEE80211_M_STA)
2114                 IEEE80211_NODE_ITERATE_LOCK(nt);
2115 }
2116
2117 static void
2118 run_newassoc(struct ieee80211_node *ni, int isnew)
2119 {
2120         struct run_node *rn = (void *)ni;
2121         struct ieee80211_rateset *rs = &ni->ni_rates;
2122         uint8_t rate;
2123         int ridx, i, j;
2124
2125         DPRINTF("new assoc isnew=%d addr=%s\n",
2126             isnew, ether_sprintf(ni->ni_macaddr));
2127
2128         for (i = 0; i < rs->rs_nrates; i++) {
2129                 rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
2130                 /* convert 802.11 rate to hardware rate index */
2131                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2132                         if (rt2860_rates[ridx].rate == rate)
2133                                 break;
2134                 rn->ridx[i] = ridx;
2135                 /* determine rate of control response frames */
2136                 for (j = i; j >= 0; j--) {
2137                         if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
2138                             rt2860_rates[rn->ridx[i]].phy ==
2139                             rt2860_rates[rn->ridx[j]].phy)
2140                                 break;
2141                 }
2142                 if (j >= 0) {
2143                         rn->ctl_ridx[i] = rn->ridx[j];
2144                 } else {
2145                         /* no basic rate found, use mandatory one */
2146                         rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
2147                 }
2148                 DPRINTF("rate=0x%02x ridx=%d ctl_ridx=%d\n",
2149                     rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]);
2150         }
2151 }
2152
2153 /*
2154  * Return the Rx chain with the highest RSSI for a given frame.
2155  */
2156 static __inline uint8_t
2157 run_maxrssi_chain(struct run_softc *sc, const struct rt2860_rxwi *rxwi)
2158 {
2159         uint8_t rxchain = 0;
2160
2161         if (sc->nrxchains > 1) {
2162                 if (rxwi->rssi[1] > rxwi->rssi[rxchain])
2163                         rxchain = 1;
2164                 if (sc->nrxchains > 2)
2165                         if (rxwi->rssi[2] > rxwi->rssi[rxchain])
2166                                 rxchain = 2;
2167         }
2168         return rxchain;
2169 }
2170
2171 static void
2172 run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen)
2173 {
2174         struct ifnet *ifp = sc->sc_ifp;
2175         struct ieee80211vap *vap = &sc->sc_rvp->vap;
2176         struct ieee80211com *ic = ifp->if_l2com;
2177         struct ieee80211_frame *wh;
2178         struct ieee80211_node *ni;
2179         struct rt2870_rxd *rxd;
2180         struct rt2860_rxwi *rxwi;
2181         uint32_t flags;
2182         uint16_t len, phy;
2183         uint8_t ant, rssi;
2184         int8_t nf;
2185
2186         rxwi = mtod(m, struct rt2860_rxwi *);
2187         len = le16toh(rxwi->len) & 0xfff;
2188         if (__predict_false(len > dmalen)) {
2189                 m_freem(m);
2190                 ifp->if_ierrors++;
2191                 DPRINTF("bad RXWI length %u > %u\n", len, dmalen);
2192                 return;
2193         }
2194         /* Rx descriptor is located at the end */
2195         rxd = (struct rt2870_rxd *)(mtod(m, caddr_t) + dmalen);
2196         flags = le32toh(rxd->flags);
2197
2198         if (__predict_false(flags & (RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
2199                 m_freem(m);
2200                 ifp->if_ierrors++;
2201                 DPRINTF("%s error.\n", (flags & RT2860_RX_CRCERR)?"CRC":"ICV");
2202                 return;
2203         }
2204
2205         m->m_data += sizeof(struct rt2860_rxwi);
2206         m->m_pkthdr.len = m->m_len -= sizeof(struct rt2860_rxwi);
2207
2208         wh = mtod(m, struct ieee80211_frame *);
2209
2210         if (wh->i_fc[1] & IEEE80211_FC1_WEP){
2211                 wh->i_fc[1] &= ~IEEE80211_FC1_WEP;
2212                 m->m_flags |= M_WEP;
2213         }
2214
2215         if (flags & RT2860_RX_L2PAD){
2216                 DPRINTFN(8, "received RT2860_RX_L2PAD frame\n");
2217                 len += 2;
2218         }
2219
2220         if (__predict_false(flags & RT2860_RX_MICERR)) {
2221                 /* report MIC failures to net80211 for TKIP */
2222                 ieee80211_notify_michael_failure(vap, wh, rxwi->keyidx);
2223                 m_freem(m);
2224                 ifp->if_ierrors++;
2225                 DPRINTF("MIC error. Someone is lying.\n");
2226                 return;
2227         }
2228
2229         ant = run_maxrssi_chain(sc, rxwi);
2230         rssi = rxwi->rssi[ant];
2231         nf = run_rssi2dbm(sc, rssi, ant);
2232
2233         m->m_pkthdr.rcvif = ifp;
2234         m->m_pkthdr.len = m->m_len = len;
2235
2236         ni = ieee80211_find_rxnode(ic,
2237             mtod(m, struct ieee80211_frame_min *));
2238         if (ni != NULL) {
2239                 (void)ieee80211_input(ni, m, rssi, nf);
2240                 ieee80211_free_node(ni);
2241         } else {
2242                 (void)ieee80211_input_all(ic, m, rssi, nf);
2243         }
2244
2245         if(__predict_false(ieee80211_radiotap_active(ic))){
2246                 struct run_rx_radiotap_header *tap = &sc->sc_rxtap;
2247
2248                 tap->wr_flags = 0;
2249                 tap->wr_chan_freq = htole16(ic->ic_bsschan->ic_freq);
2250                 tap->wr_chan_flags = htole16(ic->ic_bsschan->ic_flags);
2251                 tap->wr_antsignal = rssi;
2252                 tap->wr_antenna = ant;
2253                 tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant);
2254                 tap->wr_rate = 2;       /* in case it can't be found below */
2255                 phy = le16toh(rxwi->phy);
2256                 switch (phy & RT2860_PHY_MODE) {
2257                 case RT2860_PHY_CCK:
2258                         switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
2259                         case 0: tap->wr_rate =   2; break;
2260                         case 1: tap->wr_rate =   4; break;
2261                         case 2: tap->wr_rate =  11; break;
2262                         case 3: tap->wr_rate =  22; break;
2263                         }
2264                         if (phy & RT2860_PHY_SHPRE)
2265                                 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2266                         break;
2267                 case RT2860_PHY_OFDM:
2268                         switch (phy & RT2860_PHY_MCS) {
2269                         case 0: tap->wr_rate =  12; break;
2270                         case 1: tap->wr_rate =  18; break;
2271                         case 2: tap->wr_rate =  24; break;
2272                         case 3: tap->wr_rate =  36; break;
2273                         case 4: tap->wr_rate =  48; break;
2274                         case 5: tap->wr_rate =  72; break;
2275                         case 6: tap->wr_rate =  96; break;
2276                         case 7: tap->wr_rate = 108; break;
2277                         }
2278                         break;
2279                 }
2280         }
2281 }
2282
2283 static void
2284 run_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2285 {
2286         struct run_softc *sc = usbd_xfer_softc(xfer);
2287         struct ifnet *ifp = sc->sc_ifp;
2288         struct mbuf *m = NULL;
2289         struct mbuf *m0;
2290         uint32_t dmalen;
2291         int xferlen;
2292
2293         usbd_xfer_status(xfer, &xferlen, NULL, NULL, NULL);
2294
2295         switch (USB_GET_STATE(xfer)) {
2296         case USB_ST_TRANSFERRED:
2297
2298                 DPRINTFN(15, "rx done, actlen=%d\n", xferlen);
2299
2300                 if (xferlen < sizeof (uint32_t) +
2301                     sizeof (struct rt2860_rxwi) + sizeof (struct rt2870_rxd)) {
2302                         DPRINTF("xfer too short %d\n", xferlen);
2303                         goto tr_setup;
2304                 }
2305
2306                 m = sc->rx_m;
2307                 sc->rx_m = NULL;
2308
2309                 /* FALLTHROUGH */
2310         case USB_ST_SETUP:
2311 tr_setup:
2312                 if (sc->rx_m == NULL) {
2313                         sc->rx_m = m_getjcl(M_DONTWAIT, MT_DATA, M_PKTHDR,
2314                             MJUMPAGESIZE /* xfer can be bigger than MCLBYTES */);
2315                 }
2316                 if (sc->rx_m == NULL) {
2317                         DPRINTF("could not allocate mbuf - idle with stall\n");
2318                         ifp->if_ierrors++;
2319                         usbd_xfer_set_stall(xfer);
2320                         usbd_xfer_set_frames(xfer, 0);
2321                 } else {
2322                         /*
2323                          * Directly loading a mbuf cluster into DMA to
2324                          * save some data copying. This works because
2325                          * there is only one cluster.
2326                          */
2327                         usbd_xfer_set_frame_data(xfer, 0,
2328                             mtod(sc->rx_m, caddr_t), RUN_MAX_RXSZ);
2329                         usbd_xfer_set_frames(xfer, 1);
2330                 }
2331                 usbd_transfer_submit(xfer);
2332                 break;
2333
2334         default:        /* Error */
2335                 if (error != USB_ERR_CANCELLED) {
2336                         /* try to clear stall first */
2337                         usbd_xfer_set_stall(xfer);
2338
2339                         if (error == USB_ERR_TIMEOUT)
2340                                 device_printf(sc->sc_dev, "device timeout\n");
2341
2342                         ifp->if_ierrors++;
2343
2344                         goto tr_setup;
2345                 }
2346                 if(sc->rx_m != NULL){
2347                         m_freem(sc->rx_m);
2348                         sc->rx_m = NULL;
2349                 }
2350                 break;
2351         }
2352
2353         if (m == NULL)
2354                 return;
2355
2356         /* inputting all the frames must be last */
2357
2358         RUN_UNLOCK(sc);
2359
2360         m->m_pkthdr.len = m->m_len = xferlen;
2361
2362         /* HW can aggregate multiple 802.11 frames in a single USB xfer */
2363         for(;;) {
2364                 dmalen = le32toh(*mtod(m, uint32_t *)) & 0xffff;
2365
2366                 if ((dmalen == 0) || ((dmalen & 3) != 0)) {
2367                         DPRINTF("bad DMA length %u\n", dmalen);
2368                         break;
2369                 }
2370                 if ((dmalen + 8) > xferlen) {
2371                         DPRINTF("bad DMA length %u > %d\n",
2372                         dmalen + 8, xferlen);
2373                         break;
2374                 }
2375
2376                 /* If it is the last one or a single frame, we won't copy. */
2377                 if((xferlen -= dmalen + 8) <= 8){
2378                         /* trim 32-bit DMA-len header */
2379                         m->m_data += 4;
2380                         m->m_pkthdr.len = m->m_len -= 4;
2381                         run_rx_frame(sc, m, dmalen);
2382                         break;
2383                 }
2384
2385                 /* copy aggregated frames to another mbuf */
2386                 m0 = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
2387                 if (__predict_false(m0 == NULL)) {
2388                         DPRINTF("could not allocate mbuf\n");
2389                         ifp->if_ierrors++;
2390                         break;
2391                 }
2392                 m_copydata(m, 4 /* skip 32-bit DMA-len header */,
2393                     dmalen + sizeof(struct rt2870_rxd), mtod(m0, caddr_t));
2394                 m0->m_pkthdr.len = m0->m_len =
2395                     dmalen + sizeof(struct rt2870_rxd);
2396                 run_rx_frame(sc, m0, dmalen);
2397
2398                 /* update data ptr */
2399                 m->m_data += dmalen + 8;
2400                 m->m_pkthdr.len = m->m_len -= dmalen + 8;
2401         }
2402
2403         RUN_LOCK(sc);
2404 }
2405
2406 static void
2407 run_tx_free(struct run_endpoint_queue *pq,
2408     struct run_tx_data *data, int txerr)
2409 {
2410         if (data->m != NULL) {
2411                 if (data->m->m_flags & M_TXCB)
2412                         ieee80211_process_callback(data->ni, data->m,
2413                             txerr ? ETIMEDOUT : 0);
2414                 m_freem(data->m);
2415                 data->m = NULL;
2416
2417                 if(data->ni == NULL) {
2418                         DPRINTF("no node\n");
2419                 } else {
2420                         ieee80211_free_node(data->ni);
2421                         data->ni = NULL;
2422                 }
2423         }
2424
2425         STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
2426         pq->tx_nfree++;
2427 }
2428
2429 static void
2430 run_bulk_tx_callbackN(struct usb_xfer *xfer, usb_error_t error, unsigned int index)
2431 {
2432         struct run_softc *sc = usbd_xfer_softc(xfer);
2433         struct ifnet *ifp = sc->sc_ifp;
2434         struct run_tx_data *data;
2435         struct ieee80211vap *vap = NULL;
2436         struct usb_page_cache *pc;
2437         struct run_endpoint_queue *pq = &sc->sc_epq[index];
2438         struct mbuf *m;
2439         usb_frlength_t size;
2440         unsigned int len;
2441         int actlen;
2442         int sumlen;
2443
2444         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
2445
2446         switch (USB_GET_STATE(xfer)){
2447         case USB_ST_TRANSFERRED:
2448                 DPRINTFN(11, "transfer complete: %d "
2449                     "bytes @ index %d\n", actlen, index);
2450
2451                 data = usbd_xfer_get_priv(xfer);
2452
2453                 run_tx_free(pq, data, 0);
2454                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2455
2456                 usbd_xfer_set_priv(xfer, NULL);
2457
2458                 ifp->if_opackets++;
2459
2460                 /* FALLTHROUGH */
2461         case USB_ST_SETUP:
2462 tr_setup:
2463                 data = STAILQ_FIRST(&pq->tx_qh);
2464                 if(data == NULL)
2465                         break;
2466
2467                 STAILQ_REMOVE_HEAD(&pq->tx_qh, next);
2468
2469                 m = data->m;
2470                 if (m->m_pkthdr.len > RUN_MAX_TXSZ) {
2471                         DPRINTF("data overflow, %u bytes\n",
2472                             m->m_pkthdr.len);
2473
2474                         ifp->if_oerrors++;
2475
2476                         run_tx_free(pq, data, 1);
2477
2478                         goto tr_setup;
2479                 }
2480
2481                 pc = usbd_xfer_get_frame(xfer, 0);
2482                 size = sizeof(data->desc);
2483                 usbd_copy_in(pc, 0, &data->desc, size);
2484                 usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
2485
2486                 vap = data->ni->ni_vap;
2487                 if (ieee80211_radiotap_active_vap(vap)) {
2488                         struct run_tx_radiotap_header *tap = &sc->sc_txtap;
2489
2490                         tap->wt_flags = 0;
2491                         tap->wt_rate = rt2860_rates[data->ridx].rate;
2492                         tap->wt_chan_freq = htole16(vap->iv_bss->ni_chan->ic_freq);
2493                         tap->wt_chan_flags = htole16(vap->iv_bss->ni_chan->ic_flags);
2494                         tap->wt_hwqueue = index;
2495                         if (data->mcs & RT2860_PHY_SHPRE)
2496                                 tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2497
2498                         ieee80211_radiotap_tx(vap, m);
2499                 }
2500
2501                 /* align end on a 4-bytes boundary */
2502                 len = (size + m->m_pkthdr.len + 3) & ~3;
2503
2504                 DPRINTFN(11, "sending frame len=%u xferlen=%u @ index %d\n",
2505                         m->m_pkthdr.len, len, index);
2506
2507                 usbd_xfer_set_frame_len(xfer, 0, len);
2508                 usbd_xfer_set_priv(xfer, data);
2509
2510                 usbd_transfer_submit(xfer);
2511
2512                 RUN_UNLOCK(sc);
2513                 run_start(ifp);
2514                 RUN_LOCK(sc);
2515
2516                 break;
2517
2518         default:
2519                 DPRINTF("USB transfer error, %s\n",
2520                     usbd_errstr(error));
2521
2522                 data = usbd_xfer_get_priv(xfer);
2523
2524                 ifp->if_oerrors++;
2525
2526                 if (data != NULL) {
2527                         run_tx_free(pq, data, error);
2528                         usbd_xfer_set_priv(xfer, NULL);
2529                 }
2530
2531                 if (error != USB_ERR_CANCELLED) {
2532                         if (error == USB_ERR_TIMEOUT) {
2533                                 device_printf(sc->sc_dev, "device timeout\n");
2534                                 ieee80211_runtask(ifp->if_l2com, &sc->usb_timeout_task);
2535                         }
2536
2537                         /*
2538                          * Try to clear stall first, also if other
2539                          * errors occur, hence clearing stall
2540                          * introduces a 50 ms delay:
2541                          */
2542                         usbd_xfer_set_stall(xfer);
2543                         goto tr_setup;
2544                 }
2545                 break;
2546         }
2547 }
2548
2549 static void
2550 run_bulk_tx_callback0(struct usb_xfer *xfer, usb_error_t error)
2551 {
2552         run_bulk_tx_callbackN(xfer, error, 0);
2553 }
2554
2555 static void
2556 run_bulk_tx_callback1(struct usb_xfer *xfer, usb_error_t error)
2557 {
2558         run_bulk_tx_callbackN(xfer, error, 1);
2559 }
2560
2561 static void
2562 run_bulk_tx_callback2(struct usb_xfer *xfer, usb_error_t error)
2563 {
2564         run_bulk_tx_callbackN(xfer, error, 2);
2565 }
2566
2567 static void
2568 run_bulk_tx_callback3(struct usb_xfer *xfer, usb_error_t error)
2569 {
2570         run_bulk_tx_callbackN(xfer, error, 3);
2571 }
2572
2573 static void
2574 run_bulk_tx_callback4(struct usb_xfer *xfer, usb_error_t error)
2575 {
2576         run_bulk_tx_callbackN(xfer, error, 4);
2577 }
2578
2579 static void
2580 run_bulk_tx_callback5(struct usb_xfer *xfer, usb_error_t error)
2581 {
2582         run_bulk_tx_callbackN(xfer, error, 5);
2583 }
2584
2585 static void
2586 run_set_tx_desc(struct run_softc *sc, struct run_tx_data *data,
2587         uint8_t wflags, uint8_t xflags, uint8_t opflags, uint8_t dflags,
2588         uint8_t type, uint8_t pad)
2589 {
2590         struct mbuf *m = data->m;
2591         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2592         struct ieee80211vap *vap = &sc->sc_rvp->vap;
2593         struct ieee80211_frame *wh;
2594         struct rt2870_txd *txd;
2595         struct rt2860_txwi *txwi;
2596         int xferlen;
2597         uint8_t mcs;
2598         uint8_t ridx = data->ridx;
2599
2600         /* get MCS code from rate index */
2601         data->mcs = mcs = rt2860_rates[ridx].mcs;
2602
2603         xferlen = sizeof(*txwi) + m->m_pkthdr.len;
2604
2605         /* roundup to 32-bit alignment */
2606         xferlen = (xferlen + 3) & ~3;
2607
2608         txd = (struct rt2870_txd *)&data->desc;
2609         txd->flags = dflags;
2610         txd->len = htole16(xferlen);
2611
2612         /* setup TX Wireless Information */
2613         txwi = (struct rt2860_txwi *)(txd + 1);
2614         txwi->flags = wflags;
2615         txwi->xflags = xflags;
2616         txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA) ?
2617             RUN_AID2WCID(data->ni->ni_associd) : 0xff;
2618         txwi->len = htole16(m->m_pkthdr.len - pad);
2619         if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
2620                 txwi->phy = htole16(RT2860_PHY_CCK);
2621                 if (ridx != RT2860_RIDX_CCK1 &&
2622                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
2623                         mcs |= RT2860_PHY_SHPRE;
2624         } else
2625                 txwi->phy = htole16(RT2860_PHY_OFDM);
2626         txwi->phy |= htole16(mcs);
2627
2628         wh = mtod(m, struct ieee80211_frame *);
2629
2630         /* check if RTS/CTS or CTS-to-self protection is required */
2631         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
2632             (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
2633              ((ic->ic_flags & IEEE80211_F_USEPROT) &&
2634               rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
2635                 txwi->txop = RT2860_TX_TXOP_HT | opflags;
2636         else
2637                 txwi->txop = RT2860_TX_TXOP_BACKOFF | opflags;
2638 }
2639
2640 /* This function must be called locked */
2641 static int
2642 run_tx(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2643 {
2644         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2645         struct ieee80211vap *vap = &sc->sc_rvp->vap;
2646         struct ieee80211_frame *wh;
2647         const struct ieee80211_txparam *tp;
2648         struct run_tx_data *data;
2649         uint16_t qos;
2650         uint16_t dur;
2651         uint8_t type;
2652         uint8_t tid;
2653         uint8_t qid;
2654         uint8_t qflags;
2655         uint8_t pad;
2656         uint8_t xflags = 0;
2657         int hasqos;
2658         int ridx;
2659         int ctl_ridx;
2660
2661         RUN_LOCK_ASSERT(sc, MA_OWNED);
2662
2663         wh = mtod(m, struct ieee80211_frame *);
2664
2665         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2666
2667         /*
2668          * There are 7 bulk endpoints: 1 for RX
2669          * and 6 for TX (4 EDCAs + HCCA + Prio).
2670          * Update 03-14-2009:  some devices like the Planex GW-US300MiniS
2671          * seem to have only 4 TX bulk endpoints (Fukaumi Naoki).
2672          */
2673         if ((hasqos = IEEE80211_QOS_HAS_SEQ(wh))) {
2674                 uint8_t *frm;
2675
2676                 if(IEEE80211_HAS_ADDR4(wh))
2677                         frm = ((struct ieee80211_qosframe_addr4 *)wh)->i_qos;
2678                 else
2679                         frm =((struct ieee80211_qosframe *)wh)->i_qos;
2680
2681                 qos = le16toh(*(const uint16_t *)frm);
2682                 tid = qos & IEEE80211_QOS_TID;
2683                 qid = TID_TO_WME_AC(tid);
2684                 pad = 2;
2685         } else {
2686                 qos = 0;
2687                 tid = 0;
2688                 qid = WME_AC_BE;
2689                 pad = 0;
2690         }
2691         qflags = (qid < 4) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_HCCA;
2692
2693         DPRINTFN(8, "qos %d\tqid %d\ttid %d\tqflags %x\n",
2694             qos, qid, tid, qflags);
2695
2696         tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
2697
2698         /* pickup a rate index */
2699         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
2700             type != IEEE80211_FC0_TYPE_DATA) {
2701                 ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
2702                     RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
2703                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
2704         } else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
2705                 ridx = sc->fixed_ridx;
2706                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
2707         } else {
2708                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++){
2709                         if (rt2860_rates[ridx].rate == ni->ni_txrate)
2710                                 break;
2711                 }
2712                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
2713         }
2714
2715         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
2716             (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
2717              IEEE80211_QOS_ACKPOLICY_NOACK)) {
2718                 xflags |= RT2860_TX_ACK;
2719                 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
2720                         dur = rt2860_rates[ridx].sp_ack_dur;
2721                 else
2722                         dur = rt2860_rates[ridx].lp_ack_dur;
2723                 *(uint16_t *)wh->i_dur = htole16(dur);
2724         }
2725
2726         /* reserve slots for mgmt packets, just in case */
2727         if (sc->sc_epq[qid].tx_nfree < 3) {
2728                 DPRINTFN(10, "tx ring %d is full\n", qid);
2729                 return (-1);
2730         }
2731
2732         data = STAILQ_FIRST(&sc->sc_epq[qid].tx_fh);
2733         STAILQ_REMOVE_HEAD(&sc->sc_epq[qid].tx_fh, next);
2734         sc->sc_epq[qid].tx_nfree--;
2735
2736         data->m = m;
2737         data->ni = ni;
2738         data->ridx = ridx;
2739
2740         run_set_tx_desc(sc, data, 0, xflags, 0, qflags, type, pad);
2741
2742         STAILQ_INSERT_TAIL(&sc->sc_epq[qid].tx_qh, data, next);
2743
2744         usbd_transfer_start(sc->sc_xfer[qid]);
2745
2746         DPRINTFN(8, "sending data frame len=%d rate=%d qid=%d\n", m->m_pkthdr.len +
2747             (int)(sizeof (struct rt2870_txd) + sizeof (struct rt2860_rxwi)),
2748             rt2860_rates[ridx].rate, qid);
2749
2750         return (0);
2751 }
2752
2753 static int
2754 run_tx_mgt(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
2755 {
2756         const struct ieee80211_txparam *tp;
2757         struct ifnet *ifp = sc->sc_ifp;
2758         struct ieee80211vap *vap = ni->ni_vap;
2759         struct ieee80211com *ic = ifp->if_l2com;
2760         struct run_tx_data *data;
2761         struct ieee80211_frame *wh;
2762         int ridx;
2763         uint16_t dur;
2764         uint8_t type;
2765         uint8_t xflags = 0;
2766
2767         RUN_LOCK_ASSERT(sc, MA_OWNED);
2768
2769         wh = mtod(m, struct ieee80211_frame *);
2770
2771         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2772         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2773
2774         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
2775                 xflags |= RT2860_TX_ACK;
2776
2777                 dur = ieee80211_ack_duration(ic->ic_rt, tp->mgmtrate,
2778                     ic->ic_flags & IEEE80211_F_SHPREAMBLE);
2779                 *(uint16_t *)wh->i_dur = htole16(dur);
2780
2781                 /* tell hardware to add timestamp for probe responses */
2782                 if ((wh->i_fc[0] &
2783                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
2784                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
2785                         xflags |= RT2860_TX_TS;
2786         }
2787
2788         if (sc->sc_epq[0].tx_nfree == 0) {
2789                 /* let caller free mbuf */
2790                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2791                 return (EIO);
2792         }
2793         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
2794         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
2795         sc->sc_epq[0].tx_nfree--;
2796
2797         data->m = m;
2798         data->ni = ni;
2799         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2800                 if (rt2860_rates[ridx].rate == tp->mgmtrate)
2801                         break;
2802         data->ridx = ridx;
2803
2804         run_set_tx_desc(sc, data, 0, xflags, 0, RT2860_TX_QSEL_MGMT,
2805             wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK, 0);
2806
2807         DPRINTFN(10, "sending mgt frame len=%d rate=%d\n", m->m_pkthdr.len +
2808             (int)(sizeof (struct rt2870_txd) + sizeof (struct rt2860_rxwi)),
2809             tp->mgmtrate);
2810
2811         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
2812
2813         usbd_transfer_start(sc->sc_xfer[0]);
2814
2815         return (0);
2816 }
2817
2818 static int
2819 run_sendprot(struct run_softc *sc,
2820     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
2821 {
2822         struct ieee80211com *ic = ni->ni_ic;
2823         struct ieee80211_frame *wh;
2824         struct run_tx_data *data;
2825         struct mbuf *mprot;
2826         int ridx;
2827         int protrate;
2828         int ackrate;
2829         int pktlen;
2830         int isshort;
2831         uint16_t dur;
2832         uint8_t type;
2833         uint8_t wflags;
2834         uint8_t txflags = 0;
2835
2836         RUN_LOCK_ASSERT(sc, MA_OWNED);
2837
2838         KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
2839             ("protection %d", prot));
2840
2841         wh = mtod(m, struct ieee80211_frame *);
2842         pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
2843         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2844
2845         protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
2846         ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
2847
2848         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
2849         dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort);
2850             + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
2851         wflags = RT2860_TX_FRAG;
2852
2853         /* check that there are free slots before allocating the mbuf */
2854         if (sc->sc_epq[0].tx_nfree == 0) {
2855                 /* let caller free mbuf */
2856                 sc->sc_ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2857                 return (ENOBUFS);
2858         }
2859
2860         if (prot == IEEE80211_PROT_RTSCTS) {
2861                 /* NB: CTS is the same size as an ACK */
2862                 dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
2863                 txflags |= RT2860_TX_ACK;
2864                 mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
2865         } else {
2866                 mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
2867         }
2868         if (mprot == NULL) {
2869                 sc->sc_ifp->if_oerrors++;
2870                 DPRINTF("could not allocate mbuf\n");
2871                 return (ENOBUFS);
2872         }
2873
2874         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
2875         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
2876         sc->sc_epq[0].tx_nfree--;
2877
2878         data->m = mprot;
2879         data->ni = ieee80211_ref_node(ni);
2880
2881         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2882                 if (rt2860_rates[ridx].rate == protrate)
2883                         break;
2884         data->ridx = ridx;
2885
2886         run_set_tx_desc(sc, data, wflags, txflags, 0,
2887             RT2860_TX_QSEL_EDCA, type, 0);
2888
2889         DPRINTFN(1, "sending prot len=%u rate=%u\n",
2890             m->m_pkthdr.len, rate);
2891
2892         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
2893
2894         usbd_transfer_start(sc->sc_xfer[0]);
2895
2896         return (0);
2897 }
2898
2899 static int
2900 run_tx_param(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
2901     const struct ieee80211_bpf_params *params)
2902 {
2903         struct ieee80211com *ic = ni->ni_ic;
2904         struct ieee80211_frame *wh;
2905         struct run_tx_data *data;
2906         uint8_t type;
2907         uint8_t opflags;
2908         uint8_t txflags;
2909         int ridx;
2910         int rate;
2911         int error;
2912
2913         RUN_LOCK_ASSERT(sc, MA_OWNED);
2914
2915         KASSERT(params != NULL, ("no raw xmit params"));
2916
2917         wh = mtod(m, struct ieee80211_frame *);
2918         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
2919
2920         rate = params->ibp_rate0;
2921         if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
2922                 /* let caller free mbuf */
2923                 return (EINVAL);
2924         }
2925
2926         opflags = 0;
2927         txflags = 0;
2928         if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
2929                 txflags |= RT2860_TX_ACK;
2930         if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
2931                 error = run_sendprot(sc, m, ni,
2932                     params->ibp_flags & IEEE80211_BPF_RTS ?
2933                         IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
2934                     rate);
2935                 if (error) {
2936                         /* let caller free mbuf */
2937                         return (error);
2938                 }
2939                 opflags |= /*XXX RT2573_TX_LONG_RETRY |*/ RT2860_TX_TXOP_SIFS;
2940         }
2941
2942         if (sc->sc_epq[0].tx_nfree == 0) {
2943                 /* let caller free mbuf */
2944                 sc->sc_ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2945                 DPRINTF("sending raw frame, but tx ring is full\n");
2946                 return (EIO);
2947         }
2948         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
2949         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
2950         sc->sc_epq[0].tx_nfree--;
2951
2952         data->m = m;
2953         data->ni = ni;
2954         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2955                 if (rt2860_rates[ridx].rate == rate)
2956                         break;
2957         data->ridx = ridx;
2958
2959         run_set_tx_desc(sc, data, 0, txflags, opflags,
2960             RT2860_TX_QSEL_EDCA, type, 0);
2961
2962         DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
2963             m->m_pkthdr.len, rate);
2964
2965         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
2966
2967         usbd_transfer_start(sc->sc_xfer[0]);
2968
2969         return (0);
2970 }
2971
2972 static int
2973 run_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
2974     const struct ieee80211_bpf_params *params)
2975 {
2976         struct ifnet *ifp = ni->ni_ic->ic_ifp;
2977         struct run_softc *sc = ifp->if_softc;
2978         int error;
2979
2980         RUN_LOCK(sc);
2981
2982         /* prevent management frames from being sent if we're not ready */
2983         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2984                 error =  ENETDOWN;
2985                 goto bad;
2986         }
2987
2988         if (params == NULL) {
2989                 /* tx mgt packet */
2990                 if ((error = run_tx_mgt(sc, m, ni)) != 0){
2991                         ifp->if_oerrors++;
2992                         DPRINTF("mgt tx failed\n");
2993                         goto bad;
2994                 }
2995         } else {
2996                 /* tx raw packet with param */
2997                 if ((error = run_tx_param(sc, m, ni, params)) != 0){
2998                         ifp->if_oerrors++;
2999                         DPRINTF("tx with param failed\n");
3000                         goto bad;
3001                 }
3002         }
3003
3004         ifp->if_opackets++;
3005
3006         RUN_UNLOCK(sc);
3007
3008         return (0);
3009
3010 bad:
3011         RUN_UNLOCK(sc);
3012         if(m != NULL)
3013                 m_freem(m);
3014         ieee80211_free_node(ni);
3015
3016         return (error);
3017 }
3018
3019 static void
3020 run_start(struct ifnet *ifp)
3021 {
3022         struct run_softc *sc = ifp->if_softc;
3023         struct ieee80211_node *ni;
3024         struct mbuf *m;
3025
3026         RUN_LOCK(sc);
3027
3028         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
3029                 RUN_UNLOCK(sc);
3030                 return;
3031         }
3032
3033         for (;;) {
3034                 /* send data frames */
3035                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
3036                 if (m == NULL)
3037                         break;
3038
3039                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3040                 if (run_tx(sc, m, ni) != 0) {
3041                         IFQ_DRV_PREPEND(&ifp->if_snd, m);
3042                         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
3043                         break;
3044                 }
3045         }
3046
3047         RUN_UNLOCK(sc);
3048 }
3049
3050 static int
3051 run_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
3052 {
3053         struct run_softc *sc = ifp->if_softc;
3054         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3055         struct ifreq *ifr = (struct ifreq *) data;
3056         int error = 0, startall = 0;
3057
3058         switch (cmd) {
3059         case SIOCSIFFLAGS:
3060                 RUN_LOCK(sc);
3061                 if (ifp->if_flags & IFF_UP) {
3062                         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)){
3063                                 run_init_locked(sc);
3064                                 startall = 1;
3065                         } else
3066                                 run_update_promisc_locked(ifp);
3067                 } else {
3068                         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3069                                 run_stop(sc);
3070                 }
3071                 RUN_UNLOCK(sc);
3072                 if(startall)
3073                     ieee80211_start_all(ic);
3074                 break;
3075         case SIOCGIFMEDIA:
3076                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
3077                 break;
3078         case SIOCGIFADDR:
3079                 error = ether_ioctl(ifp, cmd, data);
3080                 break;
3081         default:
3082                 error = EINVAL;
3083                 break;
3084         }
3085
3086         return (error);
3087 }
3088
3089 static void
3090 run_set_agc(struct run_softc *sc, uint8_t agc)
3091 {
3092         uint8_t bbp;
3093
3094         if (sc->mac_ver == 0x3572) {
3095                 run_bbp_read(sc, 27, &bbp);
3096                 bbp &= ~(0x3 << 5);
3097                 run_bbp_write(sc, 27, bbp | 0 << 5);    /* select Rx0 */
3098                 run_bbp_write(sc, 66, agc);
3099                 run_bbp_write(sc, 27, bbp | 1 << 5);    /* select Rx1 */
3100                 run_bbp_write(sc, 66, agc);
3101         } else
3102                 run_bbp_write(sc, 66, agc);
3103 }
3104
3105 static void
3106 run_select_chan_group(struct run_softc *sc, int group)
3107 {
3108         uint32_t tmp;
3109         uint8_t agc;
3110
3111         run_bbp_write(sc, 62, 0x37 - sc->lna[group]);
3112         run_bbp_write(sc, 63, 0x37 - sc->lna[group]);
3113         run_bbp_write(sc, 64, 0x37 - sc->lna[group]);
3114         run_bbp_write(sc, 86, 0x00);
3115
3116         if (group == 0) {
3117                 if (sc->ext_2ghz_lna) {
3118                         run_bbp_write(sc, 82, 0x62);
3119                         run_bbp_write(sc, 75, 0x46);
3120                 } else {
3121                         run_bbp_write(sc, 82, 0x84);
3122                         run_bbp_write(sc, 75, 0x50);
3123                 }
3124         } else {
3125                 if (sc->mac_ver == 0x3572)
3126                         run_bbp_write(sc, 82, 0x94);
3127                 else
3128                         run_bbp_write(sc, 82, 0xf2);
3129                 if (sc->ext_5ghz_lna)
3130                         run_bbp_write(sc, 75, 0x46);
3131                 else
3132                         run_bbp_write(sc, 75, 0x50);
3133         }
3134
3135         run_read(sc, RT2860_TX_BAND_CFG, &tmp);
3136         tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
3137         tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
3138         run_write(sc, RT2860_TX_BAND_CFG, tmp);
3139
3140         /* enable appropriate Power Amplifiers and Low Noise Amplifiers */
3141         tmp = RT2860_RFTR_EN | RT2860_TRSW_EN;
3142         if (group == 0) {       /* 2GHz */
3143                 tmp |= RT2860_PA_PE_G0_EN | RT2860_LNA_PE_G0_EN;
3144                 if (sc->ntxchains > 1)
3145                         tmp |= RT2860_PA_PE_G1_EN;
3146                 if (sc->nrxchains > 1)
3147                         tmp |= RT2860_LNA_PE_G1_EN;
3148         } else {                /* 5GHz */
3149                 tmp |= RT2860_PA_PE_A0_EN | RT2860_LNA_PE_A0_EN;
3150                 if (sc->ntxchains > 1)
3151                         tmp |= RT2860_PA_PE_A1_EN;
3152                 if (sc->nrxchains > 1)
3153                         tmp |= RT2860_LNA_PE_A1_EN;
3154         }
3155         if (sc->mac_ver == 0x3572) {
3156                 run_rt3070_rf_write(sc, 8, 0x00);
3157                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
3158                 run_rt3070_rf_write(sc, 8, 0x80);
3159         } else
3160                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
3161
3162         /* set initial AGC value */
3163         if (group == 0) {       /* 2GHz band */
3164                 if (sc->mac_ver >= 0x3070)
3165                         agc = 0x1c + sc->lna[0] * 2;
3166                 else
3167                         agc = 0x2e + sc->lna[0];
3168         } else {                /* 5GHz band */
3169                 if (sc->mac_ver == 0x3572)
3170                         agc = 0x22 + (sc->lna[group] * 5) / 3;
3171                 else
3172                         agc = 0x32 + (sc->lna[group] * 5) / 3;
3173         }
3174         run_set_agc(sc, agc);
3175 }
3176
3177 static void
3178 run_rt2870_set_chan(struct run_softc *sc, uint32_t chan)
3179 {
3180         const struct rfprog *rfprog = rt2860_rf2850;
3181         uint32_t r2, r3, r4;
3182         int8_t txpow1, txpow2;
3183         int i;
3184
3185         /* find the settings for this channel (we know it exists) */
3186         for (i = 0; rfprog[i].chan != chan; i++);
3187
3188         r2 = rfprog[i].r2;
3189         if (sc->ntxchains == 1)
3190                 r2 |= 1 << 12;          /* 1T: disable Tx chain 2 */
3191         if (sc->nrxchains == 1)
3192                 r2 |= 1 << 15 | 1 << 4; /* 1R: disable Rx chains 2 & 3 */
3193         else if (sc->nrxchains == 2)
3194                 r2 |= 1 << 4;           /* 2R: disable Rx chain 3 */
3195
3196         /* use Tx power values from EEPROM */
3197         txpow1 = sc->txpow1[i];
3198         txpow2 = sc->txpow2[i];
3199         if (chan > 14) {
3200                 if (txpow1 >= 0)
3201                         txpow1 = txpow1 << 1;
3202                 else
3203                         txpow1 = (7 + txpow1) << 1 | 1;
3204                 if (txpow2 >= 0)
3205                         txpow2 = txpow2 << 1;
3206                 else
3207                         txpow2 = (7 + txpow2) << 1 | 1;
3208         }
3209         r3 = rfprog[i].r3 | txpow1 << 7;
3210         r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
3211
3212         run_rt2870_rf_write(sc, RT2860_RF1, rfprog[i].r1);
3213         run_rt2870_rf_write(sc, RT2860_RF2, r2);
3214         run_rt2870_rf_write(sc, RT2860_RF3, r3);
3215         run_rt2870_rf_write(sc, RT2860_RF4, r4);
3216
3217         run_delay(sc, 10);
3218
3219         run_rt2870_rf_write(sc, RT2860_RF1, rfprog[i].r1);
3220         run_rt2870_rf_write(sc, RT2860_RF2, r2);
3221         run_rt2870_rf_write(sc, RT2860_RF3, r3 | 1);
3222         run_rt2870_rf_write(sc, RT2860_RF4, r4);
3223
3224         run_delay(sc, 10);
3225
3226         run_rt2870_rf_write(sc, RT2860_RF1, rfprog[i].r1);
3227         run_rt2870_rf_write(sc, RT2860_RF2, r2);
3228         run_rt2870_rf_write(sc, RT2860_RF3, r3);
3229         run_rt2870_rf_write(sc, RT2860_RF4, r4);
3230 }
3231
3232 static void
3233 run_rt3070_set_chan(struct run_softc *sc, uint32_t chan)
3234 {
3235         int8_t txpow1, txpow2;
3236         uint8_t rf;
3237         int i;
3238
3239         /* RT3070 is 2GHz only */
3240         KASSERT(chan >= 1 && chan <= 14, ("wrong channel selected\n"));
3241
3242         /* find the settings for this channel (we know it exists) */
3243         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
3244
3245         /* use Tx power values from EEPROM */
3246         txpow1 = sc->txpow1[i];
3247         txpow2 = sc->txpow2[i];
3248
3249         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
3250         run_rt3070_rf_write(sc, 3, rt3070_freqs[i].k);
3251         run_rt3070_rf_read(sc, 6, &rf);
3252         rf = (rf & ~0x03) | rt3070_freqs[i].r;
3253         run_rt3070_rf_write(sc, 6, rf);
3254
3255         /* set Tx0 power */
3256         run_rt3070_rf_read(sc, 12, &rf);
3257         rf = (rf & ~0x1f) | txpow1;
3258         run_rt3070_rf_write(sc, 12, rf);
3259
3260         /* set Tx1 power */
3261         run_rt3070_rf_read(sc, 13, &rf);
3262         rf = (rf & ~0x1f) | txpow2;
3263         run_rt3070_rf_write(sc, 13, rf);
3264
3265         run_rt3070_rf_read(sc, 1, &rf);
3266         rf &= ~0xfc;
3267         if (sc->ntxchains == 1)
3268                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
3269         else if (sc->ntxchains == 2)
3270                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
3271         if (sc->nrxchains == 1)
3272                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
3273         else if (sc->nrxchains == 2)
3274                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
3275         run_rt3070_rf_write(sc, 1, rf);
3276
3277         /* set RF offset */
3278         run_rt3070_rf_read(sc, 23, &rf);
3279         rf = (rf & ~0x7f) | sc->freq;
3280         run_rt3070_rf_write(sc, 23, rf);
3281
3282         /* program RF filter */
3283         run_rt3070_rf_read(sc, 24, &rf);        /* Tx */
3284         rf = (rf & ~0x3f) | sc->rf24_20mhz;
3285         run_rt3070_rf_write(sc, 24, rf);
3286         run_rt3070_rf_read(sc, 31, &rf);        /* Rx */
3287         rf = (rf & ~0x3f) | sc->rf24_20mhz;
3288         run_rt3070_rf_write(sc, 31, rf);
3289
3290         /* enable RF tuning */
3291         run_rt3070_rf_read(sc, 7, &rf);
3292         run_rt3070_rf_write(sc, 7, rf | 0x01);
3293 }
3294
3295 static void
3296 run_rt3572_set_chan(struct run_softc *sc, u_int chan)
3297 {
3298         int8_t txpow1, txpow2;
3299         uint32_t tmp;
3300         uint8_t rf;
3301         int i;
3302
3303         /* find the settings for this channel (we know it exists) */
3304         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
3305
3306         /* use Tx power values from EEPROM */
3307         txpow1 = sc->txpow1[i];
3308         txpow2 = sc->txpow2[i];
3309
3310         if (chan <= 14) {
3311                 run_bbp_write(sc, 25, sc->bbp25);
3312                 run_bbp_write(sc, 26, sc->bbp26);
3313         } else {
3314                 /* enable IQ phase correction */
3315                 run_bbp_write(sc, 25, 0x09);
3316                 run_bbp_write(sc, 26, 0xff);
3317         }
3318
3319         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
3320         run_rt3070_rf_write(sc, 3, rt3070_freqs[i].k);
3321         run_rt3070_rf_read(sc, 6, &rf);
3322         rf  = (rf & ~0x0f) | rt3070_freqs[i].r;
3323         rf |= (chan <= 14) ? 0x08 : 0x04;
3324         run_rt3070_rf_write(sc, 6, rf);
3325
3326         /* set PLL mode */
3327         run_rt3070_rf_read(sc, 5, &rf);
3328         rf &= ~(0x08 | 0x04);
3329         rf |= (chan <= 14) ? 0x04 : 0x08;
3330         run_rt3070_rf_write(sc, 5, rf);
3331
3332         /* set Tx power for chain 0 */
3333         if (chan <= 14)
3334                 rf = 0x60 | txpow1;
3335         else
3336                 rf = 0xe0 | (txpow1 & 0xc) << 1 | (txpow1 & 0x3);
3337         run_rt3070_rf_write(sc, 12, rf);
3338
3339         /* set Tx power for chain 1 */
3340         if (chan <= 14)
3341                 rf = 0x60 | txpow2;
3342         else
3343                 rf = 0xe0 | (txpow2 & 0xc) << 1 | (txpow2 & 0x3);
3344         run_rt3070_rf_write(sc, 13, rf);
3345
3346         /* set Tx/Rx streams */
3347         run_rt3070_rf_read(sc, 1, &rf);
3348         rf &= ~0xfc;
3349         if (sc->ntxchains == 1)
3350                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
3351         else if (sc->ntxchains == 2)
3352                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
3353         if (sc->nrxchains == 1)
3354                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
3355         else if (sc->nrxchains == 2)
3356                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
3357         run_rt3070_rf_write(sc, 1, rf);
3358
3359         /* set RF offset */
3360         run_rt3070_rf_read(sc, 23, &rf);
3361         rf = (rf & ~0x7f) | sc->freq;
3362         run_rt3070_rf_write(sc, 23, rf);
3363
3364         /* program RF filter */
3365         rf = sc->rf24_20mhz;
3366         run_rt3070_rf_write(sc, 24, rf);        /* Tx */
3367         run_rt3070_rf_write(sc, 31, rf);        /* Rx */
3368
3369         /* enable RF tuning */
3370         run_rt3070_rf_read(sc, 7, &rf);
3371         rf = (chan <= 14) ? 0xd8 : ((rf & ~0xc8) | 0x14);
3372         run_rt3070_rf_write(sc, 7, rf);
3373
3374         /* TSSI */
3375         rf = (chan <= 14) ? 0xc3 : 0xc0;
3376         run_rt3070_rf_write(sc, 9, rf);
3377
3378         /* set loop filter 1 */
3379         run_rt3070_rf_write(sc, 10, 0xf1);
3380         /* set loop filter 2 */
3381         run_rt3070_rf_write(sc, 11, (chan <= 14) ? 0xb9 : 0x00);
3382
3383         /* set tx_mx2_ic */
3384         run_rt3070_rf_write(sc, 15, (chan <= 14) ? 0x53 : 0x43);
3385         /* set tx_mx1_ic */
3386         if (chan <= 14)
3387                 rf = 0x48 | sc->txmixgain_2ghz;
3388         else
3389                 rf = 0x78 | sc->txmixgain_5ghz;
3390         run_rt3070_rf_write(sc, 16, rf);
3391
3392         /* set tx_lo1 */
3393         run_rt3070_rf_write(sc, 17, 0x23);
3394         /* set tx_lo2 */
3395         if (chan <= 14)
3396                 rf = 0x93;
3397         else if (chan <= 64)
3398                 rf = 0xb7;
3399         else if (chan <= 128)
3400                 rf = 0x74;
3401         else
3402                 rf = 0x72;
3403         run_rt3070_rf_write(sc, 19, rf);
3404
3405         /* set rx_lo1 */
3406         if (chan <= 14)
3407                 rf = 0xb3;
3408         else if (chan <= 64)
3409                 rf = 0xf6;
3410         else if (chan <= 128)
3411                 rf = 0xf4;
3412         else
3413                 rf = 0xf3;
3414         run_rt3070_rf_write(sc, 20, rf);
3415
3416         /* set pfd_delay */
3417         if (chan <= 14)
3418                 rf = 0x15;
3419         else if (chan <= 64)
3420                 rf = 0x3d;
3421         else
3422                 rf = 0x01;
3423         run_rt3070_rf_write(sc, 25, rf);
3424
3425         /* set rx_lo2 */
3426         run_rt3070_rf_write(sc, 26, (chan <= 14) ? 0x85 : 0x87);
3427         /* set ldo_rf_vc */
3428         run_rt3070_rf_write(sc, 27, (chan <= 14) ? 0x00 : 0x01);
3429         /* set drv_cc */
3430         run_rt3070_rf_write(sc, 29, (chan <= 14) ? 0x9b : 0x9f);
3431
3432         run_read(sc, RT2860_GPIO_CTRL, &tmp);
3433         tmp &= ~0x8080;
3434         if (chan <= 14)
3435                 tmp |= 0x80;
3436         run_write(sc, RT2860_GPIO_CTRL, tmp);
3437
3438         /* enable RF tuning */
3439         run_rt3070_rf_read(sc, 7, &rf);
3440         run_rt3070_rf_write(sc, 7, rf | 0x01);
3441
3442         run_delay(sc, 2);
3443 }
3444
3445 static void
3446 run_set_rx_antenna(struct run_softc *sc, int aux)
3447 {
3448         uint32_t tmp;
3449
3450         if (aux) {
3451                 run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 0);
3452                 run_read(sc, RT2860_GPIO_CTRL, &tmp);
3453                 run_write(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
3454         } else {
3455                 run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 1);
3456                 run_read(sc, RT2860_GPIO_CTRL, &tmp);
3457                 run_write(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
3458         }
3459 }
3460
3461 static int
3462 run_set_chan(struct run_softc *sc, struct ieee80211_channel *c)
3463 {
3464         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3465         uint32_t chan, group;
3466
3467         chan = ieee80211_chan2ieee(ic, c);
3468         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3469                 return EINVAL;
3470
3471         if (sc->mac_ver == 0x3572)
3472                 run_rt3572_set_chan(sc, chan);
3473         else if (sc->mac_ver >= 0x3070)
3474                 run_rt3070_set_chan(sc, chan);
3475         else
3476                 run_rt2870_set_chan(sc, chan);
3477
3478         /* determine channel group */
3479         if (chan <= 14)
3480                 group = 0;
3481         else if (chan <= 64)
3482                 group = 1;
3483         else if (chan <= 128)
3484                 group = 2;
3485         else
3486                 group = 3;
3487
3488         /* XXX necessary only when group has changed! */
3489         run_select_chan_group(sc, group);
3490
3491         run_delay(sc, 10);
3492
3493         return 0;
3494 }
3495
3496 static void
3497 run_set_channel(struct ieee80211com *ic)
3498 {
3499         struct run_softc *sc = ic->ic_ifp->if_softc;
3500
3501         RUN_LOCK(sc);
3502         run_set_chan(sc, ic->ic_curchan);
3503         RUN_UNLOCK(sc);
3504
3505         return;
3506 }
3507
3508 static void
3509 run_scan_start(struct ieee80211com *ic)
3510 {
3511         struct run_softc *sc = ic->ic_ifp->if_softc;
3512         uint32_t tmp;
3513
3514         RUN_LOCK(sc);
3515
3516         /* abort TSF synchronization */
3517         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
3518         run_write(sc, RT2860_BCN_TIME_CFG,
3519             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
3520             RT2860_TBTT_TIMER_EN));
3521         run_set_bssid(sc, sc->sc_ifp->if_broadcastaddr);
3522
3523         RUN_UNLOCK(sc);
3524
3525         return;
3526 }
3527
3528 static void
3529 run_scan_end(struct ieee80211com *ic)
3530 {
3531         struct run_softc *sc = ic->ic_ifp->if_softc;
3532
3533         RUN_LOCK(sc);
3534
3535         run_enable_tsf_sync(sc);
3536         /* XXX keep local copy */
3537         run_set_bssid(sc, sc->sc_bssid);
3538
3539         RUN_UNLOCK(sc);
3540
3541         return;
3542 }
3543
3544 static uint8_t
3545 run_rate2mcs(uint8_t rate)
3546 {
3547         switch (rate) {
3548         /* CCK rates */
3549         case 2:         return 0;
3550         case 4:         return 1;
3551         case 11:        return 2;
3552         case 22:        return 3;
3553         /* OFDM rates */
3554         case 12:        return 0;
3555         case 18:        return 1;
3556         case 24:        return 2;
3557         case 36:        return 3;
3558         case 48:        return 4;
3559         case 72:        return 5;
3560         case 96:        return 6;
3561         case 108:       return 7;
3562         }
3563         return 0;       /* shouldn't get here */
3564 }
3565
3566 static void
3567 run_update_beacon_locked(struct ieee80211vap *vap, int item)
3568 {
3569         struct ieee80211com *ic = vap->iv_ic;
3570         struct run_softc *sc = ic->ic_ifp->if_softc;
3571         struct rt2860_txwi txwi;
3572         struct mbuf *m;
3573         int rate;
3574
3575         if ((m = ieee80211_beacon_alloc(vap->iv_bss, &RUN_VAP(vap)->bo)) == NULL)
3576                 return;
3577
3578         memset(&txwi, 0, sizeof txwi);
3579         txwi.wcid = 0xff;
3580         txwi.len = htole16(m->m_pkthdr.len);
3581         /* send beacons at the lowest available rate */
3582         rate = (ic->ic_curmode == IEEE80211_MODE_11A) ? 12 : 2;
3583         txwi.phy = htole16(run_rate2mcs(rate));
3584         if (rate == 12)
3585                 txwi.phy |= htole16(RT2860_PHY_OFDM);
3586         txwi.txop = RT2860_TX_TXOP_HT;
3587         txwi.flags = RT2860_TX_TS;
3588
3589         run_write_region_1(sc, RT2860_BCN_BASE(0),
3590             (u_int8_t *)&txwi, sizeof txwi);
3591         run_write_region_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
3592             mtod(m, uint8_t *), (m->m_pkthdr.len + 1) & ~1);    /* roundup len */
3593
3594         m_freem(m);
3595
3596         return;
3597 }
3598
3599 static void
3600 run_update_beacon(struct ieee80211vap *vap, int item)
3601 {
3602         struct ieee80211com *ic = vap->iv_ic;
3603         struct run_softc *sc = ic->ic_ifp->if_softc;
3604
3605         IEEE80211_UNLOCK(ic);
3606         RUN_LOCK(sc);
3607         run_update_beacon_locked(vap, item);
3608         RUN_UNLOCK(sc);
3609         IEEE80211_LOCK(ic);
3610
3611         return;
3612 }
3613
3614 static void
3615 run_updateprot(struct ieee80211com *ic)
3616 {
3617         struct run_softc *sc = ic->ic_ifp->if_softc;
3618         uint32_t tmp;
3619
3620         tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
3621         /* setup protection frame rate (MCS code) */
3622         tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
3623             rt2860_rates[RT2860_RIDX_OFDM6].mcs :
3624             rt2860_rates[RT2860_RIDX_CCK11].mcs;
3625
3626         /* CCK frames don't require protection */
3627         run_write(sc, RT2860_CCK_PROT_CFG, tmp);
3628         if (ic->ic_flags & IEEE80211_F_USEPROT) {
3629                 if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
3630                         tmp |= RT2860_PROT_CTRL_RTS_CTS;
3631                 else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
3632                         tmp |= RT2860_PROT_CTRL_CTS;
3633         }
3634         run_write(sc, RT2860_OFDM_PROT_CFG, tmp);
3635 }
3636
3637 static void
3638 run_usb_timeout_cb(void *arg, int pending)
3639 {
3640         struct run_softc *sc = arg;
3641         struct ieee80211vap *vap = &sc->sc_rvp->vap;
3642
3643         RUN_LOCK(sc);
3644
3645         if(vap->iv_state == IEEE80211_S_RUN &&
3646             vap->iv_opmode != IEEE80211_M_STA)
3647                 run_reset_livelock(sc);
3648         else if(vap->iv_state == IEEE80211_S_SCAN){
3649                 DPRINTF("timeout caused by scan\n");
3650                 /* cancel bgscan */
3651                 ieee80211_cancel_scan(vap);
3652         } else
3653                 DPRINTF("timeout by unknown cause\n");
3654
3655         RUN_UNLOCK(sc);
3656 }
3657
3658 static void
3659 run_reset_livelock(struct run_softc *sc)
3660 {
3661         uint32_t tmp;
3662
3663         /*
3664          * In IBSS or HostAP modes (when the hardware sends beacons), the MAC
3665          * can run into a livelock and start sending CTS-to-self frames like
3666          * crazy if protection is enabled.  Reset MAC/BBP for a while
3667          */
3668         run_read(sc, RT2860_DEBUG, &tmp);
3669         if((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))){
3670                 DPRINTF("CTS-to-self livelock detected\n");
3671                 run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
3672                 run_delay(sc, 1);
3673                 run_write(sc, RT2860_MAC_SYS_CTRL,
3674                     RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3675         }
3676 }
3677
3678 static void
3679 run_update_promisc_locked(struct ifnet *ifp)
3680 {
3681         struct run_softc *sc = ifp->if_softc;
3682         uint32_t tmp;
3683
3684         run_read(sc, RT2860_RX_FILTR_CFG, &tmp);
3685
3686         tmp |= RT2860_DROP_UC_NOME;
3687         if (ifp->if_flags & IFF_PROMISC)
3688                 tmp &= ~RT2860_DROP_UC_NOME;
3689
3690         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
3691
3692         DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
3693             "entering" : "leaving");
3694 }
3695
3696 static void
3697 run_update_promisc(struct ifnet *ifp)
3698 {
3699         struct run_softc *sc = ifp->if_softc;
3700
3701         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
3702                 return;
3703
3704         RUN_LOCK(sc);
3705         run_update_promisc_locked(ifp);
3706         RUN_UNLOCK(sc);
3707 }
3708
3709 static void
3710 run_enable_tsf_sync(struct run_softc *sc)
3711 {
3712         struct ifnet *ifp = sc->sc_ifp;
3713         struct ieee80211com *ic = ifp->if_l2com;
3714         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3715         uint32_t tmp;
3716
3717         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
3718         tmp &= ~0x1fffff;
3719         tmp |= vap->iv_bss->ni_intval * 16;
3720         tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
3721
3722         if (vap->iv_opmode == IEEE80211_M_STA) {
3723                 /*
3724                  * Local TSF is always updated with remote TSF on beacon
3725                  * reception.
3726                  */
3727                 tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
3728         } else if (vap->iv_opmode == IEEE80211_M_IBSS) {
3729                 tmp |= RT2860_BCN_TX_EN;
3730                 /*
3731                  * Local TSF is updated with remote TSF on beacon reception
3732                  * only if the remote TSF is greater than local TSF.
3733                  */
3734                 tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
3735         } else if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
3736                 tmp |= RT2860_BCN_TX_EN;
3737                 /* SYNC with nobody */
3738                 tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
3739         } else
3740                 DPRINTF("Enabling TSF failed. undefined opmode\n");
3741
3742         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
3743 }
3744
3745 static void
3746 run_enable_mrr(struct run_softc *sc)
3747 {
3748 #define CCK(mcs)        (mcs)
3749 #define OFDM(mcs)       (1 << 3 | (mcs))
3750         run_write(sc, RT2860_LG_FBK_CFG0,
3751             OFDM(6) << 28 |     /* 54->48 */
3752             OFDM(5) << 24 |     /* 48->36 */
3753             OFDM(4) << 20 |     /* 36->24 */
3754             OFDM(3) << 16 |     /* 24->18 */
3755             OFDM(2) << 12 |     /* 18->12 */
3756             OFDM(1) <<  8 |     /* 12-> 9 */
3757             OFDM(0) <<  4 |     /*  9-> 6 */
3758             OFDM(0));           /*  6-> 6 */
3759
3760         run_write(sc, RT2860_LG_FBK_CFG1,
3761             CCK(2) << 12 |      /* 11->5.5 */
3762             CCK(1) <<  8 |      /* 5.5-> 2 */
3763             CCK(0) <<  4 |      /*   2-> 1 */
3764             CCK(0));            /*   1-> 1 */
3765 #undef OFDM
3766 #undef CCK
3767 }
3768
3769 static void
3770 run_set_txpreamble(struct run_softc *sc)
3771 {
3772         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3773         uint32_t tmp;
3774
3775         run_read(sc, RT2860_AUTO_RSP_CFG, &tmp);
3776         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
3777                 tmp |= RT2860_CCK_SHORT_EN;
3778         else
3779                 tmp &= ~RT2860_CCK_SHORT_EN;
3780         run_write(sc, RT2860_AUTO_RSP_CFG, tmp);
3781 }
3782
3783 static void
3784 run_set_basicrates(struct run_softc *sc)
3785 {
3786         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3787
3788         /* set basic rates mask */
3789         if (ic->ic_curmode == IEEE80211_MODE_11B)
3790                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
3791         else if (ic->ic_curmode == IEEE80211_MODE_11A)
3792                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
3793         else    /* 11g */
3794                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
3795 }
3796
3797 static void
3798 run_set_leds(struct run_softc *sc, uint16_t which)
3799 {
3800         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
3801             which | (sc->leds & 0x7f));
3802 }
3803
3804 static void
3805 run_set_bssid(struct run_softc *sc, const uint8_t *bssid)
3806 {
3807         run_write(sc, RT2860_MAC_BSSID_DW0,
3808             bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
3809         run_write(sc, RT2860_MAC_BSSID_DW1,
3810             bssid[4] | bssid[5] << 8);
3811 }
3812
3813 static void
3814 run_set_macaddr(struct run_softc *sc, const uint8_t *addr)
3815 {
3816         run_write(sc, RT2860_MAC_ADDR_DW0,
3817             addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
3818         run_write(sc, RT2860_MAC_ADDR_DW1,
3819             addr[4] | addr[5] << 8 | 0xff << 16);
3820 }
3821
3822 /* ARGSUSED */
3823 static void
3824 run_updateslot(struct ifnet *ifp)
3825 {
3826         struct run_softc *sc = ifp->if_softc;
3827         struct ieee80211com *ic = ifp->if_l2com;
3828         uint32_t tmp;
3829
3830         run_read(sc, RT2860_BKOFF_SLOT_CFG, &tmp);
3831         tmp &= ~0xff;
3832         tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
3833         run_write(sc, RT2860_BKOFF_SLOT_CFG, tmp);
3834 }
3835
3836 static int8_t
3837 run_rssi2dbm(struct run_softc *sc, uint8_t rssi, uint8_t rxchain)
3838 {
3839         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3840         struct ieee80211_channel *c = ic->ic_curchan;
3841         int delta;
3842
3843         if (IEEE80211_IS_CHAN_5GHZ(c)) {
3844                 uint32_t chan = ieee80211_chan2ieee(ic, c);
3845                 delta = sc->rssi_5ghz[rxchain];
3846
3847                 /* determine channel group */
3848                 if (chan <= 64)
3849                         delta -= sc->lna[1];
3850                 else if (chan <= 128)
3851                         delta -= sc->lna[2];
3852                 else
3853                         delta -= sc->lna[3];
3854         } else
3855                 delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
3856
3857         return -12 - delta - rssi;
3858 }
3859
3860 static int
3861 run_bbp_init(struct run_softc *sc)
3862 {
3863         int i, error, ntries;
3864         uint8_t bbp0;
3865
3866         /* wait for BBP to wake up */
3867         for (ntries = 0; ntries < 20; ntries++) {
3868                 if ((error = run_bbp_read(sc, 0, &bbp0)) != 0)
3869                         return error;
3870                 if (bbp0 != 0 && bbp0 != 0xff)
3871                         break;
3872         }
3873         if (ntries == 20)
3874                 return ETIMEDOUT;
3875
3876         /* initialize BBP registers to default values */
3877         for (i = 0; i < nitems(rt2860_def_bbp); i++) {
3878                 run_bbp_write(sc, rt2860_def_bbp[i].reg,
3879                     rt2860_def_bbp[i].val);
3880         }
3881
3882         /* fix BBP84 for RT2860E */
3883         if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
3884                 run_bbp_write(sc, 84, 0x19);
3885
3886         if (sc->mac_ver >= 0x3070) {
3887                 run_bbp_write(sc, 79, 0x13);
3888                 run_bbp_write(sc, 80, 0x05);
3889                 run_bbp_write(sc, 81, 0x33);
3890         } else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
3891                 run_bbp_write(sc, 69, 0x16);
3892                 run_bbp_write(sc, 73, 0x12);
3893         }
3894         return 0;
3895 }
3896
3897 static int
3898 run_rt3070_rf_init(struct run_softc *sc)
3899 {
3900         uint32_t tmp;
3901         uint8_t rf, target, bbp4;
3902         int i;
3903
3904         run_rt3070_rf_read(sc, 30, &rf);
3905         /* toggle RF R30 bit 7 */
3906         run_rt3070_rf_write(sc, 30, rf | 0x80);
3907         run_delay(sc, 10);
3908         run_rt3070_rf_write(sc, 30, rf & ~0x80);
3909
3910         /* initialize RF registers to default value */
3911         if (sc->mac_ver == 0x3572) {
3912                 for (i = 0; i < nitems(rt3572_def_rf); i++) {
3913                         run_rt3070_rf_write(sc, rt3572_def_rf[i].reg,
3914                             rt3572_def_rf[i].val);
3915                 }
3916         } else {
3917                 for (i = 0; i < nitems(rt3070_def_rf); i++) {
3918                         run_rt3070_rf_write(sc, rt3070_def_rf[i].reg,
3919                             rt3070_def_rf[i].val);
3920                 }
3921         }
3922
3923         if (sc->mac_ver == 0x3070) {
3924                 /* change voltage from 1.2V to 1.35V for RT3070 */
3925                 run_read(sc, RT3070_LDO_CFG0, &tmp);
3926                 tmp = (tmp & ~0x0f000000) | 0x0d000000;
3927                 run_write(sc, RT3070_LDO_CFG0, tmp);
3928
3929         } else if (sc->mac_ver == 0x3071) {
3930                 run_rt3070_rf_read(sc, 6, &rf);
3931                 run_rt3070_rf_write(sc, 6, rf | 0x40);
3932                 run_rt3070_rf_write(sc, 31, 0x14);
3933
3934                 run_read(sc, RT3070_LDO_CFG0, &tmp);
3935                 tmp &= ~0x1f000000;
3936                 if (sc->mac_rev < 0x0211)
3937                         tmp |= 0x0d000000;      /* 1.3V */
3938                 else
3939                         tmp |= 0x01000000;      /* 1.2V */
3940                 run_write(sc, RT3070_LDO_CFG0, tmp);
3941
3942                 /* patch LNA_PE_G1 */
3943                 run_read(sc, RT3070_GPIO_SWITCH, &tmp);
3944                 run_write(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
3945         } else if(sc->mac_ver == 0x3572){
3946                 run_rt3070_rf_read(sc, 6, &rf);
3947                 run_rt3070_rf_write(sc, 6, rf | 0x40);
3948
3949                 if (sc->mac_rev < 0x0211){
3950                         /* increase voltage from 1.2V to 1.35V */
3951                         run_read(sc, RT3070_LDO_CFG0, &tmp);
3952                         tmp = (tmp & ~0x0f000000) | 0x0d000000;
3953                         run_write(sc, RT3070_LDO_CFG0, tmp);
3954                 } else {
3955                         /* increase voltage from 1.2V to 1.35V */
3956                         run_read(sc, RT3070_LDO_CFG0, &tmp);
3957                         tmp = (tmp & ~0x1f000000) | 0x0d000000;
3958                         run_write(sc, RT3070_LDO_CFG0, tmp);
3959
3960                         run_delay(sc, 1);       /* wait for 1msec */
3961
3962                         /* decrease voltage back to 1.2V */
3963                         tmp = (tmp & ~0x1f000000) | 0x01000000;
3964                         run_write(sc, RT3070_LDO_CFG0, tmp);
3965                 }
3966         }
3967
3968         /* select 20MHz bandwidth */
3969         run_rt3070_rf_read(sc, 31, &rf);
3970         run_rt3070_rf_write(sc, 31, rf & ~0x20);
3971
3972         /* calibrate filter for 20MHz bandwidth */
3973         sc->rf24_20mhz = 0x1f;  /* default value */
3974         target = (sc->mac_ver < 0x3071) ? 0x16 : 0x13;
3975         run_rt3070_filter_calib(sc, 0x07, target, &sc->rf24_20mhz);
3976
3977         /* select 40MHz bandwidth */
3978         run_bbp_read(sc, 4, &bbp4);
3979         run_bbp_write(sc, 4, (bbp4 & ~0x08) | 0x10);
3980         run_rt3070_rf_read(sc, 31, &rf);
3981         run_rt3070_rf_write(sc, 31, rf | 0x20);
3982
3983         /* calibrate filter for 40MHz bandwidth */
3984         sc->rf24_40mhz = 0x2f;  /* default value */
3985         target = (sc->mac_ver < 0x3071) ? 0x19 : 0x15;
3986         run_rt3070_filter_calib(sc, 0x27, target, &sc->rf24_40mhz);
3987
3988         /* go back to 20MHz bandwidth */
3989         run_bbp_read(sc, 4, &bbp4);
3990         run_bbp_write(sc, 4, bbp4 & ~0x18);
3991
3992         if (sc->mac_ver == 0x3572) {
3993                 /* save default BBP registers 25 and 26 values */
3994                 run_bbp_read(sc, 25, &sc->bbp25);
3995                 run_bbp_read(sc, 26, &sc->bbp26);
3996         } else if (sc->mac_rev < 0x0211)
3997                 run_rt3070_rf_write(sc, 27, 0x03);
3998
3999         run_read(sc, RT3070_OPT_14, &tmp);
4000         run_write(sc, RT3070_OPT_14, tmp | 1);
4001
4002         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
4003                 run_rt3070_rf_read(sc, 17, &rf);
4004                 rf &= ~RT3070_TX_LO1;
4005                 if ((sc->mac_ver == 0x3070 ||
4006                      (sc->mac_ver == 0x3071 && sc->mac_rev >= 0x0211)) &&
4007                     !sc->ext_2ghz_lna)
4008                         rf |= 0x20;     /* fix for long range Rx issue */
4009                 if (sc->txmixgain_2ghz >= 1)
4010                         rf = (rf & ~0x7) | sc->txmixgain_2ghz;
4011                 run_rt3070_rf_write(sc, 17, rf);
4012         }
4013
4014         if (sc->mac_rev == 0x3071) {
4015                 run_rt3070_rf_read(sc, 1, &rf);
4016                 rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
4017                 rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
4018                 run_rt3070_rf_write(sc, 1, rf);
4019
4020                 run_rt3070_rf_read(sc, 15, &rf);
4021                 run_rt3070_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
4022
4023                 run_rt3070_rf_read(sc, 20, &rf);
4024                 run_rt3070_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
4025
4026                 run_rt3070_rf_read(sc, 21, &rf);
4027                 run_rt3070_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
4028         }
4029
4030         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
4031                 /* fix Tx to Rx IQ glitch by raising RF voltage */
4032                 run_rt3070_rf_read(sc, 27, &rf);
4033                 rf &= ~0x77;
4034                 if (sc->mac_rev < 0x0211)
4035                         rf |= 0x03;
4036                 run_rt3070_rf_write(sc, 27, rf);
4037         }
4038         return 0;
4039 }
4040
4041 static int
4042 run_rt3070_filter_calib(struct run_softc *sc, uint8_t init, uint8_t target,
4043     uint8_t *val)
4044 {
4045         uint8_t rf22, rf24;
4046         uint8_t bbp55_pb, bbp55_sb, delta;
4047         int ntries;
4048
4049         /* program filter */
4050         run_rt3070_rf_read(sc, 24, &rf24);
4051         rf24 = (rf24 & 0xc0) | init;    /* initial filter value */
4052         run_rt3070_rf_write(sc, 24, rf24);
4053
4054         /* enable baseband loopback mode */
4055         run_rt3070_rf_read(sc, 22, &rf22);
4056         run_rt3070_rf_write(sc, 22, rf22 | 0x01);
4057
4058         /* set power and frequency of passband test tone */
4059         run_bbp_write(sc, 24, 0x00);
4060         for (ntries = 0; ntries < 100; ntries++) {
4061                 /* transmit test tone */
4062                 run_bbp_write(sc, 25, 0x90);
4063                 run_delay(sc, 10);
4064                 /* read received power */
4065                 run_bbp_read(sc, 55, &bbp55_pb);
4066                 if (bbp55_pb != 0)
4067                         break;
4068         }
4069         if (ntries == 100)
4070                 return ETIMEDOUT;
4071
4072         /* set power and frequency of stopband test tone */
4073         run_bbp_write(sc, 24, 0x06);
4074         for (ntries = 0; ntries < 100; ntries++) {
4075                 /* transmit test tone */
4076                 run_bbp_write(sc, 25, 0x90);
4077                 run_delay(sc, 10);
4078                 /* read received power */
4079                 run_bbp_read(sc, 55, &bbp55_sb);
4080
4081                 delta = bbp55_pb - bbp55_sb;
4082                 if (delta > target)
4083                         break;
4084
4085                 /* reprogram filter */
4086                 rf24++;
4087                 run_rt3070_rf_write(sc, 24, rf24);
4088         }
4089         if (ntries < 100) {
4090                 if (rf24 != init)
4091                         rf24--; /* backtrack */
4092                 *val = rf24;
4093                 run_rt3070_rf_write(sc, 24, rf24);
4094         }
4095
4096         /* restore initial state */
4097         run_bbp_write(sc, 24, 0x00);
4098
4099         /* disable baseband loopback mode */
4100         run_rt3070_rf_read(sc, 22, &rf22);
4101         run_rt3070_rf_write(sc, 22, rf22 & ~0x01);
4102
4103         return 0;
4104 }
4105
4106 static void
4107 run_rt3070_rf_setup(struct run_softc *sc)
4108 {
4109         uint8_t bbp, rf;
4110         int i;
4111
4112         if (sc->mac_ver == 0x3572) {
4113                 /* enable DC filter */
4114                 if (sc->mac_rev >= 0x0201)
4115                         run_bbp_write(sc, 103, 0xc0);
4116
4117                 run_bbp_read(sc, 138, &bbp);
4118                 if (sc->ntxchains == 1)
4119                         bbp |= 0x20;    /* turn off DAC1 */
4120                 if (sc->nrxchains == 1)
4121                         bbp &= ~0x02;   /* turn off ADC1 */
4122                 run_bbp_write(sc, 138, bbp);
4123
4124                 if (sc->mac_rev >= 0x0211) {
4125                         /* improve power consumption */
4126                         run_bbp_read(sc, 31, &bbp);
4127                         run_bbp_write(sc, 31, bbp & ~0x03);
4128                 }
4129
4130                 run_rt3070_rf_read(sc, 16, &rf);
4131                 rf = (rf & ~0x07) | sc->txmixgain_2ghz;
4132                 run_rt3070_rf_write(sc, 16, rf);
4133
4134         } else if (sc->mac_ver == 0x3071) {
4135                 /* enable DC filter */
4136                 if (sc->mac_rev >= 0x0201)
4137                         run_bbp_write(sc, 103, 0xc0);
4138
4139                 run_bbp_read(sc, 138, &bbp);
4140                 if (sc->ntxchains == 1)
4141                         bbp |= 0x20;    /* turn off DAC1 */
4142                 if (sc->nrxchains == 1)
4143                         bbp &= ~0x02;   /* turn off ADC1 */
4144                 run_bbp_write(sc, 138, bbp);
4145
4146                 if (sc->mac_rev >= 0x0211) {
4147                         /* improve power consumption */
4148                         run_bbp_read(sc, 31, &bbp);
4149                         run_bbp_write(sc, 31, bbp & ~0x03);
4150                 }
4151
4152                 run_write(sc, RT2860_TX_SW_CFG1, 0);
4153                 if (sc->mac_rev < 0x0211) {
4154                         run_write(sc, RT2860_TX_SW_CFG2,
4155                             sc->patch_dac ? 0x2c : 0x0f);
4156                 } else
4157                         run_write(sc, RT2860_TX_SW_CFG2, 0);
4158
4159         } else if (sc->mac_ver == 0x3070) {
4160                 if (sc->mac_rev >= 0x0201) {
4161                         /* enable DC filter */
4162                         run_bbp_write(sc, 103, 0xc0);
4163
4164                         /* improve power consumption */
4165                         run_bbp_read(sc, 31, &bbp);
4166                         run_bbp_write(sc, 31, bbp & ~0x03);
4167                 }
4168
4169                 if (sc->mac_rev < 0x0211) {
4170                         run_write(sc, RT2860_TX_SW_CFG1, 0);
4171                         run_write(sc, RT2860_TX_SW_CFG2, 0x2c);
4172                 } else
4173                         run_write(sc, RT2860_TX_SW_CFG2, 0);
4174         }
4175
4176         /* initialize RF registers from ROM for >=RT3071*/
4177         if (sc->mac_ver >= 0x3071) {
4178                 for (i = 0; i < 10; i++) {
4179                         if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
4180                                 continue;
4181                         run_rt3070_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
4182                 }
4183         }
4184 }
4185
4186 static int
4187 run_txrx_enable(struct run_softc *sc)
4188 {
4189         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
4190         uint32_t tmp;
4191         int error, ntries;
4192
4193         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
4194         for (ntries = 0; ntries < 200; ntries++) {
4195                 if ((error = run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp)) != 0)
4196                         return error;
4197                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
4198                         break;
4199                 run_delay(sc, 50);
4200         }
4201         if (ntries == 200)
4202                 return ETIMEDOUT;
4203
4204         run_delay(sc, 50);
4205
4206         tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN | RT2860_TX_WB_DDONE;
4207         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
4208
4209         /* enable Rx bulk aggregation (set timeout and limit) */
4210         tmp = RT2860_USB_TX_EN | RT2860_USB_RX_EN | RT2860_USB_RX_AGG_EN |
4211             RT2860_USB_RX_AGG_TO(128) | RT2860_USB_RX_AGG_LMT(2);
4212         run_write(sc, RT2860_USB_DMA_CFG, tmp);
4213
4214         /* set Rx filter */
4215         tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
4216         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
4217                 tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
4218                     RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
4219                     RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
4220                     RT2860_DROP_CFACK | RT2860_DROP_CFEND;
4221                 if (ic->ic_opmode == IEEE80211_M_STA)
4222                         tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
4223         }
4224         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
4225
4226         run_write(sc, RT2860_MAC_SYS_CTRL,
4227             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
4228
4229         return 0;
4230 }
4231
4232 static void
4233 run_init_locked(struct run_softc *sc)
4234 {
4235         struct ifnet *ifp = sc->sc_ifp;
4236         struct ieee80211com *ic = ifp->if_l2com;
4237         uint32_t tmp;
4238         uint8_t bbp1, bbp3;
4239         int i;
4240         int ridx;
4241         int ntries;
4242
4243         run_stop(sc);
4244
4245         for (ntries = 0; ntries < 100; ntries++) {
4246                 if (run_read(sc, RT2860_ASIC_VER_ID, &tmp) != 0)
4247                         goto fail;
4248                 if (tmp != 0 && tmp != 0xffffffff)
4249                         break;
4250                 run_delay(sc, 10);
4251         }
4252         if (ntries == 100)
4253                 goto fail;
4254
4255         for (i = 0; i != RUN_EP_QUEUES; i++)
4256                 run_setup_tx_list(sc, &sc->sc_epq[i]);
4257
4258         run_set_macaddr(sc, IF_LLADDR(ifp));
4259
4260         for (ntries = 0; ntries < 100; ntries++) {
4261                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
4262                         goto fail;
4263                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
4264                         break;
4265                 run_delay(sc, 10);
4266         }
4267         if (ntries == 100) {
4268                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
4269                 goto fail;
4270         }
4271         tmp &= 0xff0;
4272         tmp |= RT2860_TX_WB_DDONE;
4273         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
4274
4275         /* turn off PME_OEN to solve high-current issue */
4276         run_read(sc, RT2860_SYS_CTRL, &tmp);
4277         run_write(sc, RT2860_SYS_CTRL, tmp & ~RT2860_PME_OEN);
4278
4279         run_write(sc, RT2860_MAC_SYS_CTRL,
4280             RT2860_BBP_HRST | RT2860_MAC_SRST);
4281         run_write(sc, RT2860_USB_DMA_CFG, 0);
4282
4283         if (run_reset(sc) != 0) {
4284                 device_printf(sc->sc_dev, "could not reset chipset\n");
4285                 goto fail;
4286         }
4287
4288         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
4289
4290         /* init Tx power for all Tx rates (from EEPROM) */
4291         for (ridx = 0; ridx < 5; ridx++) {
4292                 if (sc->txpow20mhz[ridx] == 0xffffffff)
4293                         continue;
4294                 run_write(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
4295         }
4296
4297         for (i = 0; i < nitems(rt2870_def_mac); i++)
4298                 run_write(sc, rt2870_def_mac[i].reg, rt2870_def_mac[i].val);
4299         run_write(sc, RT2860_WMM_AIFSN_CFG, 0x00002273);
4300         run_write(sc, RT2860_WMM_CWMIN_CFG, 0x00002344);
4301         run_write(sc, RT2860_WMM_CWMAX_CFG, 0x000034aa);
4302
4303         if (sc->mac_ver >= 0x3070) {
4304                 /* set delay of PA_PE assertion to 1us (unit of 0.25us) */
4305                 run_write(sc, RT2860_TX_SW_CFG0,
4306                     4 << RT2860_DLY_PAPE_EN_SHIFT);
4307         }
4308
4309         /* wait while MAC is busy */
4310         for (ntries = 0; ntries < 100; ntries++) {
4311                 if (run_read(sc, RT2860_MAC_STATUS_REG, &tmp) != 0)
4312                         goto fail;
4313                 if (!(tmp & (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
4314                         break;
4315                 run_delay(sc, 10);
4316         }
4317         if (ntries == 100)
4318                 goto fail;
4319
4320         /* clear Host to MCU mailbox */
4321         run_write(sc, RT2860_H2M_BBPAGENT, 0);
4322         run_write(sc, RT2860_H2M_MAILBOX, 0);
4323         run_delay(sc, 10);
4324
4325         if (run_bbp_init(sc) != 0) {
4326                 device_printf(sc->sc_dev, "could not initialize BBP\n");
4327                 goto fail;
4328         }
4329
4330         /* abort TSF synchronization */
4331         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
4332         tmp &= ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
4333             RT2860_TBTT_TIMER_EN);
4334         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
4335
4336         /* clear RX WCID search table */
4337         run_set_region_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
4338         /* clear WCID attribute table */
4339         run_set_region_4(sc, RT2860_WCID_ATTR(0), 0, 8 * 32);
4340         /* clear shared key table */
4341         run_set_region_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
4342         /* clear shared key mode */
4343         run_set_region_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
4344
4345         run_read(sc, RT2860_US_CYC_CNT, &tmp);
4346         tmp = (tmp & ~0xff) | 0x1e;
4347         run_write(sc, RT2860_US_CYC_CNT, tmp);
4348
4349         if (sc->mac_rev != 0x0101)
4350                 run_write(sc, RT2860_TXOP_CTRL_CFG, 0x0000583f);
4351
4352         run_write(sc, RT2860_WMM_TXOP0_CFG, 0);
4353         run_write(sc, RT2860_WMM_TXOP1_CFG, 48 << 16 | 96);
4354
4355         /* write vendor-specific BBP values (from EEPROM) */
4356         for (i = 0; i < 8; i++) {
4357                 if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
4358                         continue;
4359                 run_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
4360         }
4361
4362         /* select Main antenna for 1T1R devices */
4363         if (sc->rf_rev == RT3070_RF_3020)
4364                 run_set_rx_antenna(sc, 0);
4365
4366         /* send LEDs operating mode to microcontroller */
4367         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0]);
4368         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1]);
4369         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2]);
4370
4371         if (sc->mac_ver >= 0x3070)
4372                 run_rt3070_rf_init(sc);
4373
4374         /* disable non-existing Rx chains */
4375         run_bbp_read(sc, 3, &bbp3);
4376         bbp3 &= ~(1 << 3 | 1 << 4);
4377         if (sc->nrxchains == 2)
4378                 bbp3 |= 1 << 3;
4379         else if (sc->nrxchains == 3)
4380                 bbp3 |= 1 << 4;
4381         run_bbp_write(sc, 3, bbp3);
4382
4383         /* disable non-existing Tx chains */
4384         run_bbp_read(sc, 1, &bbp1);
4385         if (sc->ntxchains == 1)
4386                 bbp1 &= ~(1 << 3 | 1 << 4);
4387         run_bbp_write(sc, 1, bbp1);
4388
4389         if (sc->mac_ver >= 0x3070)
4390                 run_rt3070_rf_setup(sc);
4391
4392         /* select default channel */
4393         run_set_chan(sc, ic->ic_curchan);
4394
4395         /* setup initial protection mode */
4396         run_updateprot(ic);
4397
4398         /* turn radio LED on */
4399         run_set_leds(sc, RT2860_LED_RADIO);
4400
4401         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
4402         ifp->if_drv_flags |= IFF_DRV_RUNNING;
4403
4404         for(i = 0; i != RUN_N_XFER; i++)
4405                 usbd_xfer_set_stall(sc->sc_xfer[i]);
4406
4407         usbd_transfer_start(sc->sc_xfer[RUN_BULK_RX]);
4408
4409         if (run_txrx_enable(sc) != 0)
4410                 goto fail;
4411
4412         return;
4413
4414 fail:
4415         run_stop(sc);
4416 }
4417
4418 static void
4419 run_init(void *arg)
4420 {
4421         struct run_softc *sc = arg;
4422         struct ifnet *ifp = sc->sc_ifp;
4423         struct ieee80211com *ic = ifp->if_l2com;
4424
4425         RUN_LOCK(sc);
4426         run_init_locked(sc);
4427         RUN_UNLOCK(sc);
4428
4429         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
4430                 ieee80211_start_all(ic);
4431 }
4432
4433 static void
4434 run_stop(void *arg)
4435 {
4436         struct run_softc *sc = (struct run_softc *)arg;
4437         struct ifnet *ifp = sc->sc_ifp;
4438         struct ieee80211com *ic = ifp->if_l2com;
4439         uint32_t tmp;
4440         int i;
4441         int ntries;
4442
4443         RUN_LOCK_ASSERT(sc, MA_OWNED);
4444
4445         if(sc->sc_rvp != NULL){
4446                 sc->sc_rvp->ratectl_run = RUN_RATECTL_OFF;
4447                 if (ic->ic_flags & IEEE80211_F_SCAN)
4448                         ieee80211_cancel_scan(&sc->sc_rvp->vap);
4449         }
4450
4451         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
4452                 run_set_leds(sc, 0);    /* turn all LEDs off */
4453
4454         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
4455
4456         RUN_UNLOCK(sc);
4457
4458         for(i = 0; i < RUN_N_XFER; i++)
4459                 usbd_transfer_drain(sc->sc_xfer[i]);
4460
4461         RUN_LOCK(sc);
4462
4463         if(sc->rx_m != NULL){
4464                 m_free(sc->rx_m);
4465                 sc->rx_m = NULL;
4466         }
4467
4468         /* disable Tx/Rx */
4469         run_read(sc, RT2860_MAC_SYS_CTRL, &tmp);
4470         tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
4471         run_write(sc, RT2860_MAC_SYS_CTRL, tmp);
4472
4473         /* wait for pending Tx to complete */
4474         for (ntries = 0; ntries < 100; ntries++) {
4475                 if (run_read(sc, RT2860_TXRXQ_PCNT, &tmp) != 0){
4476                         DPRINTF("Cannot read Tx queue count\n");
4477                         break;
4478                 }
4479                 if ((tmp & RT2860_TX2Q_PCNT_MASK) == 0){
4480                         DPRINTF("All Tx cleared\n");
4481                         break;
4482                 }
4483                 run_delay(sc, 10);
4484         }
4485         if(ntries >= 100)
4486                 DPRINTF("There are still pending Tx\n");
4487         run_delay(sc, 10);
4488         run_write(sc, RT2860_USB_DMA_CFG, 0);
4489
4490         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
4491         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
4492
4493         for (i = 0; i != RUN_EP_QUEUES; i++)
4494                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
4495
4496         return;
4497 }
4498
4499 static void
4500 run_delay(struct run_softc *sc, unsigned int ms)
4501 {
4502         usb_pause_mtx(mtx_owned(&sc->sc_mtx) ?
4503             &sc->sc_mtx : NULL, USB_MS_TO_TICKS(ms));
4504 }
4505
4506 static device_method_t run_methods[] = {
4507         /* Device interface */
4508         DEVMETHOD(device_probe,         run_match),
4509         DEVMETHOD(device_attach,        run_attach),
4510         DEVMETHOD(device_detach,        run_detach),
4511
4512         { 0, 0 }
4513 };
4514
4515 static driver_t run_driver = {
4516         "run",
4517         run_methods,
4518         sizeof(struct run_softc)
4519 };
4520
4521 static devclass_t run_devclass;
4522
4523 DRIVER_MODULE(run, uhub, run_driver, run_devclass, NULL, 0);