sys/dev/usb/wlan/if_run.c

   1 /*-
   2  * Copyright (c) 2008,2010 Damien Bergamini <damien.bergamini@free.fr>
   3  * ported to FreeBSD by Akinori Furukoshi <moonlightakkiy@yahoo.ca>
   4  * USB Consulting, Hans Petter Selasky <hselasky@freebsd.org>
   5  * Copyright (c) 2013-2014 Kevin Lo
   6  *
   7  * Permission to use, copy, modify, and distribute this software for any
   8  * purpose with or without fee is hereby granted, provided that the above
   9  * copyright notice and this permission notice appear in all copies.
  10  *
  11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  18  */
  19
  20 #include <sys/cdefs.h>
  21 __FBSDID("$FreeBSD$");
  22
  23 /*-
  24  * Ralink Technology RT2700U/RT2800U/RT3000U/RT3900E chipset driver.
  25  * http://www.ralinktech.com/
  26  */
  27
  28 #include <sys/param.h>
  29 #include <sys/sockio.h>
  30 #include <sys/sysctl.h>
  31 #include <sys/lock.h>
  32 #include <sys/mutex.h>
  33 #include <sys/mbuf.h>
  34 #include <sys/kernel.h>
  35 #include <sys/socket.h>
  36 #include <sys/systm.h>
  37 #include <sys/malloc.h>
  38 #include <sys/module.h>
  39 #include <sys/bus.h>
  40 #include <sys/endian.h>
  41 #include <sys/linker.h>
  42 #include <sys/firmware.h>
  43 #include <sys/kdb.h>
  44
  45 #include <net/bpf.h>
  46 #include <net/if.h>
  47 #include <net/if_arp.h>
  48 #include <net/ethernet.h>
  49 #include <net/if_dl.h>
  50 #include <net/if_media.h>
  51 #include <net/if_types.h>
  52
  53 #include <netinet/in.h>
  54 #include <netinet/in_systm.h>
  55 #include <netinet/in_var.h>
  56 #include <netinet/if_ether.h>
  57 #include <netinet/ip.h>
  58
  59 #include <net80211/ieee80211_var.h>
  60 #include <net80211/ieee80211_regdomain.h>
  61 #include <net80211/ieee80211_radiotap.h>
  62 #include <net80211/ieee80211_ratectl.h>
  63
  64 #include <dev/usb/usb.h>
  65 #include <dev/usb/usbdi.h>
  66 #include "usbdevs.h"
  67
  68 #define USB_DEBUG_VAR   run_debug
  69 #include <dev/usb/usb_debug.h>
  70 #include <dev/usb/usb_msctest.h>
  71
  72 #include <dev/usb/wlan/if_runreg.h>
  73 #include <dev/usb/wlan/if_runvar.h>
  74
  75 #ifdef  USB_DEBUG
  76 #define RUN_DEBUG
  77 #endif
  78
  79 #ifdef  RUN_DEBUG
  80 int run_debug = 0;
  81 static SYSCTL_NODE(_hw_usb, OID_AUTO, run, CTLFLAG_RW, 0, "USB run");
  82 SYSCTL_INT(_hw_usb_run, OID_AUTO, debug, CTLFLAG_RW, &run_debug, 0,
  83     "run debug level");
  84 #endif
  85
  86 #define IEEE80211_HAS_ADDR4(wh) \
  87         (((wh)->i_fc[1] & IEEE80211_FC1_DIR_MASK) == IEEE80211_FC1_DIR_DSTODS)
  88
  89 /*
  90  * Because of LOR in run_key_delete(), use atomic instead.
  91  * '& RUN_CMDQ_MASQ' is to loop cmdq[].
  92  */
  93 #define RUN_CMDQ_GET(c) (atomic_fetchadd_32((c), 1) & RUN_CMDQ_MASQ)
  94
  95 static const STRUCT_USB_HOST_ID run_devs[] = {
  96 #define RUN_DEV(v,p)    { USB_VP(USB_VENDOR_##v, USB_PRODUCT_##v##_##p) }
  97 #define RUN_DEV_EJECT(v,p)      \
  98         { USB_VPI(USB_VENDOR_##v, USB_PRODUCT_##v##_##p, RUN_EJECT) }
  99 #define RUN_EJECT       1
 100     RUN_DEV(ABOCOM,             RT2770),
 101     RUN_DEV(ABOCOM,             RT2870),
 102     RUN_DEV(ABOCOM,             RT3070),
 103     RUN_DEV(ABOCOM,             RT3071),
 104     RUN_DEV(ABOCOM,             RT3072),
 105     RUN_DEV(ABOCOM2,            RT2870_1),
 106     RUN_DEV(ACCTON,             RT2770),
 107     RUN_DEV(ACCTON,             RT2870_1),
 108     RUN_DEV(ACCTON,             RT2870_2),
 109     RUN_DEV(ACCTON,             RT2870_3),
 110     RUN_DEV(ACCTON,             RT2870_4),
 111     RUN_DEV(ACCTON,             RT2870_5),
 112     RUN_DEV(ACCTON,             RT3070),
 113     RUN_DEV(ACCTON,             RT3070_1),
 114     RUN_DEV(ACCTON,             RT3070_2),
 115     RUN_DEV(ACCTON,             RT3070_3),
 116     RUN_DEV(ACCTON,             RT3070_4),
 117     RUN_DEV(ACCTON,             RT3070_5),
 118     RUN_DEV(AIRTIES,            RT3070),
 119     RUN_DEV(ALLWIN,             RT2070),
 120     RUN_DEV(ALLWIN,             RT2770),
 121     RUN_DEV(ALLWIN,             RT2870),
 122     RUN_DEV(ALLWIN,             RT3070),
 123     RUN_DEV(ALLWIN,             RT3071),
 124     RUN_DEV(ALLWIN,             RT3072),
 125     RUN_DEV(ALLWIN,             RT3572),
 126     RUN_DEV(AMIGO,              RT2870_1),
 127     RUN_DEV(AMIGO,              RT2870_2),
 128     RUN_DEV(AMIT,               CGWLUSB2GNR),
 129     RUN_DEV(AMIT,               RT2870_1),
 130     RUN_DEV(AMIT2,              RT2870),
 131     RUN_DEV(ASUS,               RT2870_1),
 132     RUN_DEV(ASUS,               RT2870_2),
 133     RUN_DEV(ASUS,               RT2870_3),
 134     RUN_DEV(ASUS,               RT2870_4),
 135     RUN_DEV(ASUS,               RT2870_5),
 136     RUN_DEV(ASUS,               USBN13),
 137     RUN_DEV(ASUS,               RT3070_1),
 138     RUN_DEV(ASUS,               USBN66),
 139     RUN_DEV(ASUS,               USB_N53),
 140     RUN_DEV(ASUS2,              USBN11),
 141     RUN_DEV(AZUREWAVE,          RT2870_1),
 142     RUN_DEV(AZUREWAVE,          RT2870_2),
 143     RUN_DEV(AZUREWAVE,          RT3070_1),
 144     RUN_DEV(AZUREWAVE,          RT3070_2),
 145     RUN_DEV(AZUREWAVE,          RT3070_3),
 146     RUN_DEV(BELKIN,             F9L1103),
 147     RUN_DEV(BELKIN,             F5D8053V3),
 148     RUN_DEV(BELKIN,             F5D8055),
 149     RUN_DEV(BELKIN,             F5D8055V2),
 150     RUN_DEV(BELKIN,             F6D4050V1),
 151     RUN_DEV(BELKIN,             F6D4050V2),
 152     RUN_DEV(BELKIN,             RT2870_1),
 153     RUN_DEV(BELKIN,             RT2870_2),
 154     RUN_DEV(CISCOLINKSYS,       AE1000),
 155     RUN_DEV(CISCOLINKSYS2,      RT3070),
 156     RUN_DEV(CISCOLINKSYS3,      RT3070),
 157     RUN_DEV(CONCEPTRONIC2,      RT2870_1),
 158     RUN_DEV(CONCEPTRONIC2,      RT2870_2),
 159     RUN_DEV(CONCEPTRONIC2,      RT2870_3),
 160     RUN_DEV(CONCEPTRONIC2,      RT2870_4),
 161     RUN_DEV(CONCEPTRONIC2,      RT2870_5),
 162     RUN_DEV(CONCEPTRONIC2,      RT2870_6),
 163     RUN_DEV(CONCEPTRONIC2,      RT2870_7),
 164     RUN_DEV(CONCEPTRONIC2,      RT2870_8),
 165     RUN_DEV(CONCEPTRONIC2,      RT3070_1),
 166     RUN_DEV(CONCEPTRONIC2,      RT3070_2),
 167     RUN_DEV(CONCEPTRONIC2,      VIGORN61),
 168     RUN_DEV(COREGA,             CGWLUSB300GNM),
 169     RUN_DEV(COREGA,             RT2870_1),
 170     RUN_DEV(COREGA,             RT2870_2),
 171     RUN_DEV(COREGA,             RT2870_3),
 172     RUN_DEV(COREGA,             RT3070),
 173     RUN_DEV(CYBERTAN,           RT2870),
 174     RUN_DEV(DLINK,              RT2870),
 175     RUN_DEV(DLINK,              RT3072),
 176     RUN_DEV(DLINK,              DWA127),
 177     RUN_DEV(DLINK,              DWA140B3),
 178     RUN_DEV(DLINK,              DWA160B2),
 179     RUN_DEV(DLINK,              DWA140D1),
 180     RUN_DEV(DLINK,              DWA162),
 181     RUN_DEV(DLINK2,             DWA130),
 182     RUN_DEV(DLINK2,             RT2870_1),
 183     RUN_DEV(DLINK2,             RT2870_2),
 184     RUN_DEV(DLINK2,             RT3070_1),
 185     RUN_DEV(DLINK2,             RT3070_2),
 186     RUN_DEV(DLINK2,             RT3070_3),
 187     RUN_DEV(DLINK2,             RT3070_4),
 188     RUN_DEV(DLINK2,             RT3070_5),
 189     RUN_DEV(DLINK2,             RT3072),
 190     RUN_DEV(DLINK2,             RT3072_1),
 191     RUN_DEV(EDIMAX,             EW7717),
 192     RUN_DEV(EDIMAX,             EW7718),
 193     RUN_DEV(EDIMAX,             EW7733UND),
 194     RUN_DEV(EDIMAX,             RT2870_1),
 195     RUN_DEV(ENCORE,             RT3070_1),
 196     RUN_DEV(ENCORE,             RT3070_2),
 197     RUN_DEV(ENCORE,             RT3070_3),
 198     RUN_DEV(GIGABYTE,           GNWB31N),
 199     RUN_DEV(GIGABYTE,           GNWB32L),
 200     RUN_DEV(GIGABYTE,           RT2870_1),
 201     RUN_DEV(GIGASET,            RT3070_1),
 202     RUN_DEV(GIGASET,            RT3070_2),
 203     RUN_DEV(GUILLEMOT,          HWNU300),
 204     RUN_DEV(HAWKING,            HWUN2),
 205     RUN_DEV(HAWKING,            RT2870_1),
 206     RUN_DEV(HAWKING,            RT2870_2),
 207     RUN_DEV(HAWKING,            RT3070),
 208     RUN_DEV(IODATA,             RT3072_1),
 209     RUN_DEV(IODATA,             RT3072_2),
 210     RUN_DEV(IODATA,             RT3072_3),
 211     RUN_DEV(IODATA,             RT3072_4),
 212     RUN_DEV(LINKSYS4,           RT3070),
 213     RUN_DEV(LINKSYS4,           WUSB100),
 214     RUN_DEV(LINKSYS4,           WUSB54GCV3),
 215     RUN_DEV(LINKSYS4,           WUSB600N),
 216     RUN_DEV(LINKSYS4,           WUSB600NV2),
 217     RUN_DEV(LOGITEC,            RT2870_1),
 218     RUN_DEV(LOGITEC,            RT2870_2),
 219     RUN_DEV(LOGITEC,            RT2870_3),
 220     RUN_DEV(LOGITEC,            LANW300NU2),
 221     RUN_DEV(LOGITEC,            LANW150NU2),
 222     RUN_DEV(LOGITEC,            LANW300NU2S),
 223     RUN_DEV(MELCO,              WLIUCG300HP),
 224     RUN_DEV(MELCO,              RT2870_2),
 225     RUN_DEV(MELCO,              WLIUCAG300N),
 226     RUN_DEV(MELCO,              WLIUCG300N),
 227     RUN_DEV(MELCO,              WLIUCG301N),
 228     RUN_DEV(MELCO,              WLIUCGN),
 229     RUN_DEV(MELCO,              WLIUCGNM),
 230     RUN_DEV(MELCO,              WLIUCG300HPV1),
 231     RUN_DEV(MELCO,              WLIUCGNM2),
 232     RUN_DEV(MOTOROLA4,          RT2770),
 233     RUN_DEV(MOTOROLA4,          RT3070),
 234     RUN_DEV(MSI,                RT3070_1),
 235     RUN_DEV(MSI,                RT3070_2),
 236     RUN_DEV(MSI,                RT3070_3),
 237     RUN_DEV(MSI,                RT3070_4),
 238     RUN_DEV(MSI,                RT3070_5),
 239     RUN_DEV(MSI,                RT3070_6),
 240     RUN_DEV(MSI,                RT3070_7),
 241     RUN_DEV(MSI,                RT3070_8),
 242     RUN_DEV(MSI,                RT3070_9),
 243     RUN_DEV(MSI,                RT3070_10),
 244     RUN_DEV(MSI,                RT3070_11),
 245     RUN_DEV(NETGEAR,            WNDA4100),
 246     RUN_DEV(OVISLINK,           RT3072),
 247     RUN_DEV(PARA,               RT3070),
 248     RUN_DEV(PEGATRON,           RT2870),
 249     RUN_DEV(PEGATRON,           RT3070),
 250     RUN_DEV(PEGATRON,           RT3070_2),
 251     RUN_DEV(PEGATRON,           RT3070_3),
 252     RUN_DEV(PHILIPS,            RT2870),
 253     RUN_DEV(PLANEX2,            GWUS300MINIS),
 254     RUN_DEV(PLANEX2,            GWUSMICRON),
 255     RUN_DEV(PLANEX2,            RT2870),
 256     RUN_DEV(PLANEX2,            RT3070),
 257     RUN_DEV(QCOM,               RT2870),
 258     RUN_DEV(QUANTA,             RT3070),
 259     RUN_DEV(RALINK,             RT2070),
 260     RUN_DEV(RALINK,             RT2770),
 261     RUN_DEV(RALINK,             RT2870),
 262     RUN_DEV(RALINK,             RT3070),
 263     RUN_DEV(RALINK,             RT3071),
 264     RUN_DEV(RALINK,             RT3072),
 265     RUN_DEV(RALINK,             RT3370),
 266     RUN_DEV(RALINK,             RT3572),
 267     RUN_DEV(RALINK,             RT3573),
 268     RUN_DEV(RALINK,             RT5370),
 269     RUN_DEV(RALINK,             RT5572),
 270     RUN_DEV(RALINK,             RT8070),
 271     RUN_DEV(SAMSUNG,            WIS09ABGN),
 272     RUN_DEV(SAMSUNG2,           RT2870_1),
 273     RUN_DEV(SENAO,              RT2870_1),
 274     RUN_DEV(SENAO,              RT2870_2),
 275     RUN_DEV(SENAO,              RT2870_3),
 276     RUN_DEV(SENAO,              RT2870_4),
 277     RUN_DEV(SENAO,              RT3070),
 278     RUN_DEV(SENAO,              RT3071),
 279     RUN_DEV(SENAO,              RT3072_1),
 280     RUN_DEV(SENAO,              RT3072_2),
 281     RUN_DEV(SENAO,              RT3072_3),
 282     RUN_DEV(SENAO,              RT3072_4),
 283     RUN_DEV(SENAO,              RT3072_5),
 284     RUN_DEV(SITECOMEU,          RT2770),
 285     RUN_DEV(SITECOMEU,          RT2870_1),
 286     RUN_DEV(SITECOMEU,          RT2870_2),
 287     RUN_DEV(SITECOMEU,          RT2870_3),
 288     RUN_DEV(SITECOMEU,          RT2870_4),
 289     RUN_DEV(SITECOMEU,          RT3070),
 290     RUN_DEV(SITECOMEU,          RT3070_2),
 291     RUN_DEV(SITECOMEU,          RT3070_3),
 292     RUN_DEV(SITECOMEU,          RT3070_4),
 293     RUN_DEV(SITECOMEU,          RT3071),
 294     RUN_DEV(SITECOMEU,          RT3072_1),
 295     RUN_DEV(SITECOMEU,          RT3072_2),
 296     RUN_DEV(SITECOMEU,          RT3072_3),
 297     RUN_DEV(SITECOMEU,          RT3072_4),
 298     RUN_DEV(SITECOMEU,          RT3072_5),
 299     RUN_DEV(SITECOMEU,          RT3072_6),
 300     RUN_DEV(SITECOMEU,          WL608),
 301     RUN_DEV(SPARKLAN,           RT2870_1),
 302     RUN_DEV(SPARKLAN,           RT3070),
 303     RUN_DEV(SWEEX2,             LW153),
 304     RUN_DEV(SWEEX2,             LW303),
 305     RUN_DEV(SWEEX2,             LW313),
 306     RUN_DEV(TOSHIBA,            RT3070),
 307     RUN_DEV(UMEDIA,             RT2870_1),
 308     RUN_DEV(ZCOM,               RT2870_1),
 309     RUN_DEV(ZCOM,               RT2870_2),
 310     RUN_DEV(ZINWELL,            RT2870_1),
 311     RUN_DEV(ZINWELL,            RT2870_2),
 312     RUN_DEV(ZINWELL,            RT3070),
 313     RUN_DEV(ZINWELL,            RT3072_1),
 314     RUN_DEV(ZINWELL,            RT3072_2),
 315     RUN_DEV(ZYXEL,              RT2870_1),
 316     RUN_DEV(ZYXEL,              RT2870_2),
 317     RUN_DEV(ZYXEL,              RT3070),
 318     RUN_DEV_EJECT(ZYXEL,        NWD2705),
 319     RUN_DEV_EJECT(RALINK,       RT_STOR),
 320 #undef RUN_DEV_EJECT
 321 #undef RUN_DEV
 322 };
 323
 324 static device_probe_t   run_match;
 325 static device_attach_t  run_attach;
 326 static device_detach_t  run_detach;
 327
 328 static usb_callback_t   run_bulk_rx_callback;
 329 static usb_callback_t   run_bulk_tx_callback0;
 330 static usb_callback_t   run_bulk_tx_callback1;
 331 static usb_callback_t   run_bulk_tx_callback2;
 332 static usb_callback_t   run_bulk_tx_callback3;
 333 static usb_callback_t   run_bulk_tx_callback4;
 334 static usb_callback_t   run_bulk_tx_callback5;
 335
 336 static void     run_autoinst(void *, struct usb_device *,
 337                     struct usb_attach_arg *);
 338 static int      run_driver_loaded(struct module *, int, void *);
 339 static void     run_bulk_tx_callbackN(struct usb_xfer *xfer,
 340                     usb_error_t error, u_int index);
 341 static struct ieee80211vap *run_vap_create(struct ieee80211com *,
 342                     const char [IFNAMSIZ], int, enum ieee80211_opmode, int,
 343                     const uint8_t [IEEE80211_ADDR_LEN],
 344                     const uint8_t [IEEE80211_ADDR_LEN]);
 345 static void     run_vap_delete(struct ieee80211vap *);
 346 static void     run_cmdq_cb(void *, int);
 347 static void     run_setup_tx_list(struct run_softc *,
 348                     struct run_endpoint_queue *);
 349 static void     run_unsetup_tx_list(struct run_softc *,
 350                     struct run_endpoint_queue *);
 351 static int      run_load_microcode(struct run_softc *);
 352 static int      run_reset(struct run_softc *);
 353 static usb_error_t run_do_request(struct run_softc *,
 354                     struct usb_device_request *, void *);
 355 static int      run_read(struct run_softc *, uint16_t, uint32_t *);
 356 static int      run_read_region_1(struct run_softc *, uint16_t, uint8_t *, int);
 357 static int      run_write_2(struct run_softc *, uint16_t, uint16_t);
 358 static int      run_write(struct run_softc *, uint16_t, uint32_t);
 359 static int      run_write_region_1(struct run_softc *, uint16_t,
 360                     const uint8_t *, int);
 361 static int      run_set_region_4(struct run_softc *, uint16_t, uint32_t, int);
 362 static int      run_efuse_read(struct run_softc *, uint16_t, uint16_t *, int);
 363 static int      run_efuse_read_2(struct run_softc *, uint16_t, uint16_t *);
 364 static int      run_eeprom_read_2(struct run_softc *, uint16_t, uint16_t *);
 365 static int      run_rt2870_rf_write(struct run_softc *, uint32_t);
 366 static int      run_rt3070_rf_read(struct run_softc *, uint8_t, uint8_t *);
 367 static int      run_rt3070_rf_write(struct run_softc *, uint8_t, uint8_t);
 368 static int      run_bbp_read(struct run_softc *, uint8_t, uint8_t *);
 369 static int      run_bbp_write(struct run_softc *, uint8_t, uint8_t);
 370 static int      run_mcu_cmd(struct run_softc *, uint8_t, uint16_t);
 371 static const char *run_get_rf(uint16_t);
 372 static void     run_rt3593_get_txpower(struct run_softc *);
 373 static void     run_get_txpower(struct run_softc *);
 374 static int      run_read_eeprom(struct run_softc *);
 375 static struct ieee80211_node *run_node_alloc(struct ieee80211vap *,
 376                             const uint8_t mac[IEEE80211_ADDR_LEN]);
 377 static int      run_media_change(struct ifnet *);
 378 static int      run_newstate(struct ieee80211vap *, enum ieee80211_state, int);
 379 static int      run_wme_update(struct ieee80211com *);
 380 static void     run_wme_update_cb(void *);
 381 static void     run_key_update_begin(struct ieee80211vap *);
 382 static void     run_key_update_end(struct ieee80211vap *);
 383 static void     run_key_set_cb(void *);
 384 static int      run_key_set(struct ieee80211vap *, struct ieee80211_key *,
 385                     const uint8_t mac[IEEE80211_ADDR_LEN]);
 386 static void     run_key_delete_cb(void *);
 387 static int      run_key_delete(struct ieee80211vap *, struct ieee80211_key *);
 388 static void     run_ratectl_to(void *);
 389 static void     run_ratectl_cb(void *, int);
 390 static void     run_drain_fifo(void *);
 391 static void     run_iter_func(void *, struct ieee80211_node *);
 392 static void     run_newassoc_cb(void *);
 393 static void     run_newassoc(struct ieee80211_node *, int);
 394 static void     run_rx_frame(struct run_softc *, struct mbuf *, uint32_t);
 395 static void     run_tx_free(struct run_endpoint_queue *pq,
 396                     struct run_tx_data *, int);
 397 static void     run_set_tx_desc(struct run_softc *, struct run_tx_data *);
 398 static int      run_tx(struct run_softc *, struct mbuf *,
 399                     struct ieee80211_node *);
 400 static int      run_tx_mgt(struct run_softc *, struct mbuf *,
 401                     struct ieee80211_node *);
 402 static int      run_sendprot(struct run_softc *, const struct mbuf *,
 403                     struct ieee80211_node *, int, int);
 404 static int      run_tx_param(struct run_softc *, struct mbuf *,
 405                     struct ieee80211_node *,
 406                     const struct ieee80211_bpf_params *);
 407 static int      run_raw_xmit(struct ieee80211_node *, struct mbuf *,
 408                     const struct ieee80211_bpf_params *);
 409 static void     run_start(struct ifnet *);
 410 static int      run_ioctl(struct ifnet *, u_long, caddr_t);
 411 static void     run_iq_calib(struct run_softc *, u_int);
 412 static void     run_set_agc(struct run_softc *, uint8_t);
 413 static void     run_select_chan_group(struct run_softc *, int);
 414 static void     run_set_rx_antenna(struct run_softc *, int);
 415 static void     run_rt2870_set_chan(struct run_softc *, u_int);
 416 static void     run_rt3070_set_chan(struct run_softc *, u_int);
 417 static void     run_rt3572_set_chan(struct run_softc *, u_int);
 418 static void     run_rt3593_set_chan(struct run_softc *, u_int);
 419 static void     run_rt5390_set_chan(struct run_softc *, u_int);
 420 static void     run_rt5592_set_chan(struct run_softc *, u_int);
 421 static int      run_set_chan(struct run_softc *, struct ieee80211_channel *);
 422 static void     run_set_channel(struct ieee80211com *);
 423 static void     run_scan_start(struct ieee80211com *);
 424 static void     run_scan_end(struct ieee80211com *);
 425 static void     run_update_beacon(struct ieee80211vap *, int);
 426 static void     run_update_beacon_cb(void *);
 427 static void     run_updateprot(struct ieee80211com *);
 428 static void     run_updateprot_cb(void *);
 429 static void     run_usb_timeout_cb(void *);
 430 static void     run_reset_livelock(struct run_softc *);
 431 static void     run_enable_tsf_sync(struct run_softc *);
 432 static void     run_enable_mrr(struct run_softc *);
 433 static void     run_set_txpreamble(struct run_softc *);
 434 static void     run_set_basicrates(struct run_softc *);
 435 static void     run_set_leds(struct run_softc *, uint16_t);
 436 static void     run_set_bssid(struct run_softc *, const uint8_t *);
 437 static void     run_set_macaddr(struct run_softc *, const uint8_t *);
 438 static void     run_updateslot(struct ifnet *);
 439 static void     run_updateslot_cb(void *);
 440 static void     run_update_mcast(struct ifnet *);
 441 static int8_t   run_rssi2dbm(struct run_softc *, uint8_t, uint8_t);
 442 static void     run_update_promisc_locked(struct ifnet *);
 443 static void     run_update_promisc(struct ifnet *);
 444 static void     run_rt5390_bbp_init(struct run_softc *);
 445 static int      run_bbp_init(struct run_softc *);
 446 static int      run_rt3070_rf_init(struct run_softc *);
 447 static void     run_rt3593_rf_init(struct run_softc *);
 448 static void     run_rt5390_rf_init(struct run_softc *);
 449 static int      run_rt3070_filter_calib(struct run_softc *, uint8_t, uint8_t,
 450                     uint8_t *);
 451 static void     run_rt3070_rf_setup(struct run_softc *);
 452 static void     run_rt3593_rf_setup(struct run_softc *);
 453 static void     run_rt5390_rf_setup(struct run_softc *);
 454 static int      run_txrx_enable(struct run_softc *);
 455 static void     run_adjust_freq_offset(struct run_softc *);
 456 static void     run_init(void *);
 457 static void     run_init_locked(struct run_softc *);
 458 static void     run_stop(void *);
 459 static void     run_delay(struct run_softc *, u_int);
 460
 461 static eventhandler_tag run_etag;
 462
 463 static const struct rt2860_rate {
 464         uint8_t         rate;
 465         uint8_t         mcs;
 466         enum            ieee80211_phytype phy;
 467         uint8_t         ctl_ridx;
 468         uint16_t        sp_ack_dur;
 469         uint16_t        lp_ack_dur;
 470 } rt2860_rates[] = {
 471         {   2, 0, IEEE80211_T_DS,   0, 314, 314 },
 472         {   4, 1, IEEE80211_T_DS,   1, 258, 162 },
 473         {  11, 2, IEEE80211_T_DS,   2, 223, 127 },
 474         {  22, 3, IEEE80211_T_DS,   3, 213, 117 },
 475         {  12, 0, IEEE80211_T_OFDM, 4,  60,  60 },
 476         {  18, 1, IEEE80211_T_OFDM, 4,  52,  52 },
 477         {  24, 2, IEEE80211_T_OFDM, 6,  48,  48 },
 478         {  36, 3, IEEE80211_T_OFDM, 6,  44,  44 },
 479         {  48, 4, IEEE80211_T_OFDM, 8,  44,  44 },
 480         {  72, 5, IEEE80211_T_OFDM, 8,  40,  40 },
 481         {  96, 6, IEEE80211_T_OFDM, 8,  40,  40 },
 482         { 108, 7, IEEE80211_T_OFDM, 8,  40,  40 }
 483 };
 484
 485 static const struct {
 486         uint16_t        reg;
 487         uint32_t        val;
 488 } rt2870_def_mac[] = {
 489         RT2870_DEF_MAC
 490 };
 491
 492 static const struct {
 493         uint8_t reg;
 494         uint8_t val;
 495 } rt2860_def_bbp[] = {
 496         RT2860_DEF_BBP
 497 },rt5390_def_bbp[] = {
 498         RT5390_DEF_BBP
 499 },rt5592_def_bbp[] = {
 500         RT5592_DEF_BBP
 501 };
 502
 503 /*
 504  * Default values for BBP register R196 for RT5592.
 505  */
 506 static const uint8_t rt5592_bbp_r196[] = {
 507         0xe0, 0x1f, 0x38, 0x32, 0x08, 0x28, 0x19, 0x0a, 0xff, 0x00,
 508         0x16, 0x10, 0x10, 0x0b, 0x36, 0x2c, 0x26, 0x24, 0x42, 0x36,
 509         0x30, 0x2d, 0x4c, 0x46, 0x3d, 0x40, 0x3e, 0x42, 0x3d, 0x40,
 510         0x3c, 0x34, 0x2c, 0x2f, 0x3c, 0x35, 0x2e, 0x2a, 0x49, 0x41,
 511         0x36, 0x31, 0x30, 0x30, 0x0e, 0x0d, 0x28, 0x21, 0x1c, 0x16,
 512         0x50, 0x4a, 0x43, 0x40, 0x10, 0x10, 0x10, 0x10, 0x00, 0x00,
 513         0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
 514         0x00, 0x00, 0x7d, 0x14, 0x32, 0x2c, 0x36, 0x4c, 0x43, 0x2c,
 515         0x2e, 0x36, 0x30, 0x6e
 516 };
 517
 518 static const struct rfprog {
 519         uint8_t         chan;
 520         uint32_t        r1, r2, r3, r4;
 521 } rt2860_rf2850[] = {
 522         RT2860_RF2850
 523 };
 524
 525 struct {
 526         uint8_t n, r, k;
 527 } rt3070_freqs[] = {
 528         RT3070_RF3052
 529 };
 530
 531 static const struct rt5592_freqs {
 532         uint16_t        n;
 533         uint8_t         k, m, r;
 534 } rt5592_freqs_20mhz[] = {
 535         RT5592_RF5592_20MHZ
 536 },rt5592_freqs_40mhz[] = {
 537         RT5592_RF5592_40MHZ
 538 };
 539
 540 static const struct {
 541         uint8_t reg;
 542         uint8_t val;
 543 } rt3070_def_rf[] = {
 544         RT3070_DEF_RF
 545 },rt3572_def_rf[] = {
 546         RT3572_DEF_RF
 547 },rt3593_def_rf[] = {
 548         RT3593_DEF_RF
 549 },rt5390_def_rf[] = {
 550         RT5390_DEF_RF
 551 },rt5392_def_rf[] = {
 552         RT5392_DEF_RF
 553 },rt5592_def_rf[] = {
 554         RT5592_DEF_RF
 555 },rt5592_2ghz_def_rf[] = {
 556         RT5592_2GHZ_DEF_RF
 557 },rt5592_5ghz_def_rf[] = {
 558         RT5592_5GHZ_DEF_RF
 559 };
 560
 561 static const struct {
 562         u_int   firstchan;
 563         u_int   lastchan;
 564         uint8_t reg;
 565         uint8_t val;
 566 } rt5592_chan_5ghz[] = {
 567         RT5592_CHAN_5GHZ
 568 };
 569
 570 static const struct usb_config run_config[RUN_N_XFER] = {
 571     [RUN_BULK_TX_BE] = {
 572         .type = UE_BULK,
 573         .endpoint = UE_ADDR_ANY,
 574         .ep_index = 0,
 575         .direction = UE_DIR_OUT,
 576         .bufsize = RUN_MAX_TXSZ,
 577         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 578         .callback = run_bulk_tx_callback0,
 579         .timeout = 5000,        /* ms */
 580     },
 581     [RUN_BULK_TX_BK] = {
 582         .type = UE_BULK,
 583         .endpoint = UE_ADDR_ANY,
 584         .direction = UE_DIR_OUT,
 585         .ep_index = 1,
 586         .bufsize = RUN_MAX_TXSZ,
 587         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 588         .callback = run_bulk_tx_callback1,
 589         .timeout = 5000,        /* ms */
 590     },
 591     [RUN_BULK_TX_VI] = {
 592         .type = UE_BULK,
 593         .endpoint = UE_ADDR_ANY,
 594         .direction = UE_DIR_OUT,
 595         .ep_index = 2,
 596         .bufsize = RUN_MAX_TXSZ,
 597         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 598         .callback = run_bulk_tx_callback2,
 599         .timeout = 5000,        /* ms */
 600     },
 601     [RUN_BULK_TX_VO] = {
 602         .type = UE_BULK,
 603         .endpoint = UE_ADDR_ANY,
 604         .direction = UE_DIR_OUT,
 605         .ep_index = 3,
 606         .bufsize = RUN_MAX_TXSZ,
 607         .flags = {.pipe_bof = 1,.force_short_xfer = 1,},
 608         .callback = run_bulk_tx_callback3,
 609         .timeout = 5000,        /* ms */
 610     },
 611     [RUN_BULK_TX_HCCA] = {
 612         .type = UE_BULK,
 613         .endpoint = UE_ADDR_ANY,
 614         .direction = UE_DIR_OUT,
 615         .ep_index = 4,
 616         .bufsize = RUN_MAX_TXSZ,
 617         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 618         .callback = run_bulk_tx_callback4,
 619         .timeout = 5000,        /* ms */
 620     },
 621     [RUN_BULK_TX_PRIO] = {
 622         .type = UE_BULK,
 623         .endpoint = UE_ADDR_ANY,
 624         .direction = UE_DIR_OUT,
 625         .ep_index = 5,
 626         .bufsize = RUN_MAX_TXSZ,
 627         .flags = {.pipe_bof = 1,.force_short_xfer = 1,.no_pipe_ok = 1,},
 628         .callback = run_bulk_tx_callback5,
 629         .timeout = 5000,        /* ms */
 630     },
 631     [RUN_BULK_RX] = {
 632         .type = UE_BULK,
 633         .endpoint = UE_ADDR_ANY,
 634         .direction = UE_DIR_IN,
 635         .bufsize = RUN_MAX_RXSZ,
 636         .flags = {.pipe_bof = 1,.short_xfer_ok = 1,},
 637         .callback = run_bulk_rx_callback,
 638     }
 639 };
 640
 641 static void
 642 run_autoinst(void *arg, struct usb_device *udev,
 643     struct usb_attach_arg *uaa)
 644 {
 645         struct usb_interface *iface;
 646         struct usb_interface_descriptor *id;
 647
 648         if (uaa->dev_state != UAA_DEV_READY)
 649                 return;
 650
 651         iface = usbd_get_iface(udev, 0);
 652         if (iface == NULL)
 653                 return;
 654         id = iface->idesc;
 655         if (id == NULL || id->bInterfaceClass != UICLASS_MASS)
 656                 return;
 657         if (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa))
 658                 return;
 659
 660         if (usb_msc_eject(udev, 0, MSC_EJECT_STOPUNIT) == 0)
 661                 uaa->dev_state = UAA_DEV_EJECTING;
 662 }
 663
 664 static int
 665 run_driver_loaded(struct module *mod, int what, void *arg)
 666 {
 667         switch (what) {
 668         case MOD_LOAD:
 669                 run_etag = EVENTHANDLER_REGISTER(usb_dev_configured,
 670                     run_autoinst, NULL, EVENTHANDLER_PRI_ANY);
 671                 break;
 672         case MOD_UNLOAD:
 673                 EVENTHANDLER_DEREGISTER(usb_dev_configured, run_etag);
 674                 break;
 675         default:
 676                 return (EOPNOTSUPP);
 677         }
 678         return (0);
 679 }
 680
 681 static int
 682 run_match(device_t self)
 683 {
 684         struct usb_attach_arg *uaa = device_get_ivars(self);
 685
 686         if (uaa->usb_mode != USB_MODE_HOST)
 687                 return (ENXIO);
 688         if (uaa->info.bConfigIndex != 0)
 689                 return (ENXIO);
 690         if (uaa->info.bIfaceIndex != RT2860_IFACE_INDEX)
 691                 return (ENXIO);
 692
 693         return (usbd_lookup_id_by_uaa(run_devs, sizeof(run_devs), uaa));
 694 }
 695
 696 static int
 697 run_attach(device_t self)
 698 {
 699         struct run_softc *sc = device_get_softc(self);
 700         struct usb_attach_arg *uaa = device_get_ivars(self);
 701         struct ieee80211com *ic;
 702         struct ifnet *ifp;
 703         uint32_t ver;
 704         int ntries, error;
 705         uint8_t iface_index, bands;
 706
 707         device_set_usb_desc(self);
 708         sc->sc_udev = uaa->device;
 709         sc->sc_dev = self;
 710         if (USB_GET_DRIVER_INFO(uaa) != RUN_EJECT)
 711                 sc->sc_flags |= RUN_FLAG_FWLOAD_NEEDED;
 712
 713         mtx_init(&sc->sc_mtx, device_get_nameunit(sc->sc_dev),
 714             MTX_NETWORK_LOCK, MTX_DEF);
 715
 716         iface_index = RT2860_IFACE_INDEX;
 717
 718         error = usbd_transfer_setup(uaa->device, &iface_index,
 719             sc->sc_xfer, run_config, RUN_N_XFER, sc, &sc->sc_mtx);
 720         if (error) {
 721                 device_printf(self, "could not allocate USB transfers, "
 722                     "err=%s\n", usbd_errstr(error));
 723                 goto detach;
 724         }
 725
 726         RUN_LOCK(sc);
 727
 728         /* wait for the chip to settle */
 729         for (ntries = 0; ntries < 100; ntries++) {
 730                 if (run_read(sc, RT2860_ASIC_VER_ID, &ver) != 0) {
 731                         RUN_UNLOCK(sc);
 732                         goto detach;
 733                 }
 734                 if (ver != 0 && ver != 0xffffffff)
 735                         break;
 736                 run_delay(sc, 10);
 737         }
 738         if (ntries == 100) {
 739                 device_printf(sc->sc_dev,
 740                     "timeout waiting for NIC to initialize\n");
 741                 RUN_UNLOCK(sc);
 742                 goto detach;
 743         }
 744         sc->mac_ver = ver >> 16;
 745         sc->mac_rev = ver & 0xffff;
 746
 747         /* retrieve RF rev. no and various other things from EEPROM */
 748         run_read_eeprom(sc);
 749
 750         device_printf(sc->sc_dev,
 751             "MAC/BBP RT%04X (rev 0x%04X), RF %s (MIMO %dT%dR), address %s\n",
 752             sc->mac_ver, sc->mac_rev, run_get_rf(sc->rf_rev),
 753             sc->ntxchains, sc->nrxchains, ether_sprintf(sc->sc_bssid));
 754
 755         RUN_UNLOCK(sc);
 756
 757         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
 758         if (ifp == NULL) {
 759                 device_printf(sc->sc_dev, "can not if_alloc()\n");
 760                 goto detach;
 761         }
 762         ic = ifp->if_l2com;
 763
 764         ifp->if_softc = sc;
 765         if_initname(ifp, "run", device_get_unit(sc->sc_dev));
 766         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
 767         ifp->if_init = run_init;
 768         ifp->if_ioctl = run_ioctl;
 769         ifp->if_start = run_start;
 770         IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
 771         ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
 772         IFQ_SET_READY(&ifp->if_snd);
 773
 774         ic->ic_ifp = ifp;
 775         ic->ic_phytype = IEEE80211_T_OFDM;      /* not only, but not used */
 776         ic->ic_opmode = IEEE80211_M_STA;        /* default to BSS mode */
 777
 778         /* set device capabilities */
 779         ic->ic_caps =
 780             IEEE80211_C_STA |           /* station mode supported */
 781             IEEE80211_C_MONITOR |       /* monitor mode supported */
 782             IEEE80211_C_IBSS |
 783             IEEE80211_C_HOSTAP |
 784             IEEE80211_C_WDS |           /* 4-address traffic works */
 785             IEEE80211_C_MBSS |
 786             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
 787             IEEE80211_C_SHSLOT |        /* short slot time supported */
 788             IEEE80211_C_WME |           /* WME */
 789             IEEE80211_C_WPA;            /* WPA1|WPA2(RSN) */
 790
 791         ic->ic_cryptocaps =
 792             IEEE80211_CRYPTO_WEP |
 793             IEEE80211_CRYPTO_AES_CCM |
 794             IEEE80211_CRYPTO_TKIPMIC |
 795             IEEE80211_CRYPTO_TKIP;
 796
 797         ic->ic_flags |= IEEE80211_F_DATAPAD;
 798         ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
 799
 800         bands = 0;
 801         setbit(&bands, IEEE80211_MODE_11B);
 802         setbit(&bands, IEEE80211_MODE_11G);
 803         if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850 ||
 804             sc->rf_rev == RT3070_RF_3052 || sc->rf_rev == RT3593_RF_3053 ||
 805             sc->rf_rev == RT5592_RF_5592)
 806                 setbit(&bands, IEEE80211_MODE_11A);
 807         ieee80211_init_channels(ic, NULL, &bands);
 808
 809         ieee80211_ifattach(ic, sc->sc_bssid);
 810
 811         ic->ic_scan_start = run_scan_start;
 812         ic->ic_scan_end = run_scan_end;
 813         ic->ic_set_channel = run_set_channel;
 814         ic->ic_node_alloc = run_node_alloc;
 815         ic->ic_newassoc = run_newassoc;
 816         ic->ic_updateslot = run_updateslot;
 817         ic->ic_update_mcast = run_update_mcast;
 818         ic->ic_wme.wme_update = run_wme_update;
 819         ic->ic_raw_xmit = run_raw_xmit;
 820         ic->ic_update_promisc = run_update_promisc;
 821
 822         ic->ic_vap_create = run_vap_create;
 823         ic->ic_vap_delete = run_vap_delete;
 824
 825         ieee80211_radiotap_attach(ic,
 826             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
 827                 RUN_TX_RADIOTAP_PRESENT,
 828             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
 829                 RUN_RX_RADIOTAP_PRESENT);
 830
 831         TASK_INIT(&sc->cmdq_task, 0, run_cmdq_cb, sc);
 832         TASK_INIT(&sc->ratectl_task, 0, run_ratectl_cb, sc);
 833         usb_callout_init_mtx(&sc->ratectl_ch, &sc->sc_mtx, 0);
 834
 835         if (bootverbose)
 836                 ieee80211_announce(ic);
 837
 838         return (0);
 839
 840 detach:
 841         run_detach(self);
 842         return (ENXIO);
 843 }
 844
 845 static int
 846 run_detach(device_t self)
 847 {
 848         struct run_softc *sc = device_get_softc(self);
 849         struct ifnet *ifp = sc->sc_ifp;
 850         struct ieee80211com *ic;
 851         int i;
 852
 853         RUN_LOCK(sc);
 854         sc->sc_detached = 1;
 855         RUN_UNLOCK(sc);
 856
 857         /* stop all USB transfers */
 858         usbd_transfer_unsetup(sc->sc_xfer, RUN_N_XFER);
 859
 860         RUN_LOCK(sc);
 861         sc->ratectl_run = RUN_RATECTL_OFF;
 862         sc->cmdq_run = sc->cmdq_key_set = RUN_CMDQ_ABORT;
 863
 864         /* free TX list, if any */
 865         for (i = 0; i != RUN_EP_QUEUES; i++)
 866                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
 867         RUN_UNLOCK(sc);
 868
 869         if (ifp) {
 870                 ic = ifp->if_l2com;
 871                 /* drain tasks */
 872                 usb_callout_drain(&sc->ratectl_ch);
 873                 ieee80211_draintask(ic, &sc->cmdq_task);
 874                 ieee80211_draintask(ic, &sc->ratectl_task);
 875                 ieee80211_ifdetach(ic);
 876                 if_free(ifp);
 877         }
 878
 879         mtx_destroy(&sc->sc_mtx);
 880
 881         return (0);
 882 }
 883
 884 static struct ieee80211vap *
 885 run_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
 886     enum ieee80211_opmode opmode, int flags,
 887     const uint8_t bssid[IEEE80211_ADDR_LEN],
 888     const uint8_t mac[IEEE80211_ADDR_LEN])
 889 {
 890         struct ifnet *ifp = ic->ic_ifp;
 891         struct run_softc *sc = ifp->if_softc;
 892         struct run_vap *rvp;
 893         struct ieee80211vap *vap;
 894         int i;
 895
 896         if (sc->rvp_cnt >= RUN_VAP_MAX) {
 897                 if_printf(ifp, "number of VAPs maxed out\n");
 898                 return (NULL);
 899         }
 900
 901         switch (opmode) {
 902         case IEEE80211_M_STA:
 903                 /* enable s/w bmiss handling for sta mode */
 904                 flags |= IEEE80211_CLONE_NOBEACONS;
 905                 /* fall though */
 906         case IEEE80211_M_IBSS:
 907         case IEEE80211_M_MONITOR:
 908         case IEEE80211_M_HOSTAP:
 909         case IEEE80211_M_MBSS:
 910                 /* other than WDS vaps, only one at a time */
 911                 if (!TAILQ_EMPTY(&ic->ic_vaps))
 912                         return (NULL);
 913                 break;
 914         case IEEE80211_M_WDS:
 915                 TAILQ_FOREACH(vap, &ic->ic_vaps, iv_next){
 916                         if(vap->iv_opmode != IEEE80211_M_HOSTAP)
 917                                 continue;
 918                         /* WDS vap's always share the local mac address. */
 919                         flags &= ~IEEE80211_CLONE_BSSID;
 920                         break;
 921                 }
 922                 if (vap == NULL) {
 923                         if_printf(ifp, "wds only supported in ap mode\n");
 924                         return (NULL);
 925                 }
 926                 break;
 927         default:
 928                 if_printf(ifp, "unknown opmode %d\n", opmode);
 929                 return (NULL);
 930         }
 931
 932         rvp = (struct run_vap *) malloc(sizeof(struct run_vap),
 933             M_80211_VAP, M_NOWAIT | M_ZERO);
 934         if (rvp == NULL)
 935                 return (NULL);
 936         vap = &rvp->vap;
 937
 938         if (ieee80211_vap_setup(ic, vap, name, unit,
 939             opmode, flags, bssid, mac) != 0) {
 940                 /* out of memory */
 941                 free(rvp, M_80211_VAP);
 942                 return (NULL);
 943         }
 944
 945         vap->iv_key_update_begin = run_key_update_begin;
 946         vap->iv_key_update_end = run_key_update_end;
 947         vap->iv_update_beacon = run_update_beacon;
 948         vap->iv_max_aid = RT2870_WCID_MAX;
 949         /*
 950          * To delete the right key from h/w, we need wcid.
 951          * Luckily, there is unused space in ieee80211_key{}, wk_pad,
 952          * and matching wcid will be written into there. So, cast
 953          * some spells to remove 'const' from ieee80211_key{}
 954          */
 955         vap->iv_key_delete = (void *)run_key_delete;
 956         vap->iv_key_set = (void *)run_key_set;
 957
 958         /* override state transition machine */
 959         rvp->newstate = vap->iv_newstate;
 960         vap->iv_newstate = run_newstate;
 961
 962         ieee80211_ratectl_init(vap);
 963         ieee80211_ratectl_setinterval(vap, 1000 /* 1 sec */);
 964
 965         /* complete setup */
 966         ieee80211_vap_attach(vap, run_media_change, ieee80211_media_status);
 967
 968         /* make sure id is always unique */
 969         for (i = 0; i < RUN_VAP_MAX; i++) {
 970                 if((sc->rvp_bmap & 1 << i) == 0){
 971                         sc->rvp_bmap |= 1 << i;
 972                         rvp->rvp_id = i;
 973                         break;
 974                 }
 975         }
 976         if (sc->rvp_cnt++ == 0)
 977                 ic->ic_opmode = opmode;
 978
 979         if (opmode == IEEE80211_M_HOSTAP)
 980                 sc->cmdq_run = RUN_CMDQ_GO;
 981
 982         DPRINTF("rvp_id=%d bmap=%x rvp_cnt=%d\n",
 983             rvp->rvp_id, sc->rvp_bmap, sc->rvp_cnt);
 984
 985         return (vap);
 986 }
 987
 988 static void
 989 run_vap_delete(struct ieee80211vap *vap)
 990 {
 991         struct run_vap *rvp = RUN_VAP(vap);
 992         struct ifnet *ifp;
 993         struct ieee80211com *ic;
 994         struct run_softc *sc;
 995         uint8_t rvp_id;
 996
 997         if (vap == NULL)
 998                 return;
 999
1000         ic = vap->iv_ic;
1001         ifp = ic->ic_ifp;
1002
1003         sc = ifp->if_softc;
1004
1005         RUN_LOCK(sc);
1006
1007         m_freem(rvp->beacon_mbuf);
1008         rvp->beacon_mbuf = NULL;
1009
1010         rvp_id = rvp->rvp_id;
1011         sc->ratectl_run &= ~(1 << rvp_id);
1012         sc->rvp_bmap &= ~(1 << rvp_id);
1013         run_set_region_4(sc, RT2860_SKEY(rvp_id, 0), 0, 128);
1014         run_set_region_4(sc, RT2860_BCN_BASE(rvp_id), 0, 512);
1015         --sc->rvp_cnt;
1016
1017         DPRINTF("vap=%p rvp_id=%d bmap=%x rvp_cnt=%d\n",
1018             vap, rvp_id, sc->rvp_bmap, sc->rvp_cnt);
1019
1020         RUN_UNLOCK(sc);
1021
1022         ieee80211_ratectl_deinit(vap);
1023         ieee80211_vap_detach(vap);
1024         free(rvp, M_80211_VAP);
1025 }
1026
1027 /*
1028  * There are numbers of functions need to be called in context thread.
1029  * Rather than creating taskqueue event for each of those functions,
1030  * here is all-for-one taskqueue callback function. This function
1031  * gurantees deferred functions are executed in the same order they
1032  * were enqueued.
1033  * '& RUN_CMDQ_MASQ' is to loop cmdq[].
1034  */
1035 static void
1036 run_cmdq_cb(void *arg, int pending)
1037 {
1038         struct run_softc *sc = arg;
1039         uint8_t i;
1040
1041         /* call cmdq[].func locked */
1042         RUN_LOCK(sc);
1043         for (i = sc->cmdq_exec; sc->cmdq[i].func && pending;
1044             i = sc->cmdq_exec, pending--) {
1045                 DPRINTFN(6, "cmdq_exec=%d pending=%d\n", i, pending);
1046                 if (sc->cmdq_run == RUN_CMDQ_GO) {
1047                         /*
1048                          * If arg0 is NULL, callback func needs more
1049                          * than one arg. So, pass ptr to cmdq struct.
1050                          */
1051                         if (sc->cmdq[i].arg0)
1052                                 sc->cmdq[i].func(sc->cmdq[i].arg0);
1053                         else
1054                                 sc->cmdq[i].func(&sc->cmdq[i]);
1055                 }
1056                 sc->cmdq[i].arg0 = NULL;
1057                 sc->cmdq[i].func = NULL;
1058                 sc->cmdq_exec++;
1059                 sc->cmdq_exec &= RUN_CMDQ_MASQ;
1060         }
1061         RUN_UNLOCK(sc);
1062 }
1063
1064 static void
1065 run_setup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
1066 {
1067         struct run_tx_data *data;
1068
1069         memset(pq, 0, sizeof(*pq));
1070
1071         STAILQ_INIT(&pq->tx_qh);
1072         STAILQ_INIT(&pq->tx_fh);
1073
1074         for (data = &pq->tx_data[0];
1075             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
1076                 data->sc = sc;
1077                 STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
1078         }
1079         pq->tx_nfree = RUN_TX_RING_COUNT;
1080 }
1081
1082 static void
1083 run_unsetup_tx_list(struct run_softc *sc, struct run_endpoint_queue *pq)
1084 {
1085         struct run_tx_data *data;
1086
1087         /* make sure any subsequent use of the queues will fail */
1088         pq->tx_nfree = 0;
1089         STAILQ_INIT(&pq->tx_fh);
1090         STAILQ_INIT(&pq->tx_qh);
1091
1092         /* free up all node references and mbufs */
1093         for (data = &pq->tx_data[0];
1094             data < &pq->tx_data[RUN_TX_RING_COUNT]; data++) {
1095                 if (data->m != NULL) {
1096                         m_freem(data->m);
1097                         data->m = NULL;
1098                 }
1099                 if (data->ni != NULL) {
1100                         ieee80211_free_node(data->ni);
1101                         data->ni = NULL;
1102                 }
1103         }
1104 }
1105
1106 static int
1107 run_load_microcode(struct run_softc *sc)
1108 {
1109         usb_device_request_t req;
1110         const struct firmware *fw;
1111         const u_char *base;
1112         uint32_t tmp;
1113         int ntries, error;
1114         const uint64_t *temp;
1115         uint64_t bytes;
1116
1117         RUN_UNLOCK(sc);
1118         fw = firmware_get("runfw");
1119         RUN_LOCK(sc);
1120         if (fw == NULL) {
1121                 device_printf(sc->sc_dev,
1122                     "failed loadfirmware of file %s\n", "runfw");
1123                 return ENOENT;
1124         }
1125
1126         if (fw->datasize != 8192) {
1127                 device_printf(sc->sc_dev,
1128                     "invalid firmware size (should be 8KB)\n");
1129                 error = EINVAL;
1130                 goto fail;
1131         }
1132
1133         /*
1134          * RT3071/RT3072 use a different firmware
1135          * run-rt2870 (8KB) contains both,
1136          * first half (4KB) is for rt2870,
1137          * last half is for rt3071.
1138          */
1139         base = fw->data;
1140         if ((sc->mac_ver) != 0x2860 &&
1141             (sc->mac_ver) != 0x2872 &&
1142             (sc->mac_ver) != 0x3070) {
1143                 base += 4096;
1144         }
1145
1146         /* cheap sanity check */
1147         temp = fw->data;
1148         bytes = *temp;
1149         if (bytes != be64toh(0xffffff0210280210ULL)) {
1150                 device_printf(sc->sc_dev, "firmware checksum failed\n");
1151                 error = EINVAL;
1152                 goto fail;
1153         }
1154
1155         /* write microcode image */
1156         if (sc->sc_flags & RUN_FLAG_FWLOAD_NEEDED) {
1157                 run_write_region_1(sc, RT2870_FW_BASE, base, 4096);
1158                 run_write(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
1159                 run_write(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
1160         }
1161
1162         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1163         req.bRequest = RT2870_RESET;
1164         USETW(req.wValue, 8);
1165         USETW(req.wIndex, 0);
1166         USETW(req.wLength, 0);
1167         if ((error = usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL))
1168             != 0) {
1169                 device_printf(sc->sc_dev, "firmware reset failed\n");
1170                 goto fail;
1171         }
1172
1173         run_delay(sc, 10);
1174
1175         run_write(sc, RT2860_H2M_BBPAGENT, 0);
1176         run_write(sc, RT2860_H2M_MAILBOX, 0);
1177         run_write(sc, RT2860_H2M_INTSRC, 0);
1178         if ((error = run_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0)) != 0)
1179                 goto fail;
1180
1181         /* wait until microcontroller is ready */
1182         for (ntries = 0; ntries < 1000; ntries++) {
1183                 if ((error = run_read(sc, RT2860_SYS_CTRL, &tmp)) != 0)
1184                         goto fail;
1185                 if (tmp & RT2860_MCU_READY)
1186                         break;
1187                 run_delay(sc, 10);
1188         }
1189         if (ntries == 1000) {
1190                 device_printf(sc->sc_dev,
1191                     "timeout waiting for MCU to initialize\n");
1192                 error = ETIMEDOUT;
1193                 goto fail;
1194         }
1195         device_printf(sc->sc_dev, "firmware %s ver. %u.%u loaded\n",
1196             (base == fw->data) ? "RT2870" : "RT3071",
1197             *(base + 4092), *(base + 4093));
1198
1199 fail:
1200         firmware_put(fw, FIRMWARE_UNLOAD);
1201         return (error);
1202 }
1203
1204 static int
1205 run_reset(struct run_softc *sc)
1206 {
1207         usb_device_request_t req;
1208
1209         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1210         req.bRequest = RT2870_RESET;
1211         USETW(req.wValue, 1);
1212         USETW(req.wIndex, 0);
1213         USETW(req.wLength, 0);
1214         return (usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, NULL));
1215 }
1216
1217 static usb_error_t
1218 run_do_request(struct run_softc *sc,
1219     struct usb_device_request *req, void *data)
1220 {
1221         usb_error_t err;
1222         int ntries = 10;
1223
1224         RUN_LOCK_ASSERT(sc, MA_OWNED);
1225
1226         while (ntries--) {
1227                 err = usbd_do_request_flags(sc->sc_udev, &sc->sc_mtx,
1228                     req, data, 0, NULL, 250 /* ms */);
1229                 if (err == 0)
1230                         break;
1231                 DPRINTFN(1, "Control request failed, %s (retrying)\n",
1232                     usbd_errstr(err));
1233                 run_delay(sc, 10);
1234         }
1235         return (err);
1236 }
1237
1238 static int
1239 run_read(struct run_softc *sc, uint16_t reg, uint32_t *val)
1240 {
1241         uint32_t tmp;
1242         int error;
1243
1244         error = run_read_region_1(sc, reg, (uint8_t *)&tmp, sizeof tmp);
1245         if (error == 0)
1246                 *val = le32toh(tmp);
1247         else
1248                 *val = 0xffffffff;
1249         return (error);
1250 }
1251
1252 static int
1253 run_read_region_1(struct run_softc *sc, uint16_t reg, uint8_t *buf, int len)
1254 {
1255         usb_device_request_t req;
1256
1257         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1258         req.bRequest = RT2870_READ_REGION_1;
1259         USETW(req.wValue, 0);
1260         USETW(req.wIndex, reg);
1261         USETW(req.wLength, len);
1262
1263         return (run_do_request(sc, &req, buf));
1264 }
1265
1266 static int
1267 run_write_2(struct run_softc *sc, uint16_t reg, uint16_t val)
1268 {
1269         usb_device_request_t req;
1270
1271         req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1272         req.bRequest = RT2870_WRITE_2;
1273         USETW(req.wValue, val);
1274         USETW(req.wIndex, reg);
1275         USETW(req.wLength, 0);
1276
1277         return (run_do_request(sc, &req, NULL));
1278 }
1279
1280 static int
1281 run_write(struct run_softc *sc, uint16_t reg, uint32_t val)
1282 {
1283         int error;
1284
1285         if ((error = run_write_2(sc, reg, val & 0xffff)) == 0)
1286                 error = run_write_2(sc, reg + 2, val >> 16);
1287         return (error);
1288 }
1289
1290 static int
1291 run_write_region_1(struct run_softc *sc, uint16_t reg, const uint8_t *buf,
1292     int len)
1293 {
1294 #if 1
1295         int i, error = 0;
1296         /*
1297          * NB: the WRITE_REGION_1 command is not stable on RT2860.
1298          * We thus issue multiple WRITE_2 commands instead.
1299          */
1300         KASSERT((len & 1) == 0, ("run_write_region_1: Data too long.\n"));
1301         for (i = 0; i < len && error == 0; i += 2)
1302                 error = run_write_2(sc, reg + i, buf[i] | buf[i + 1] << 8);
1303         return (error);
1304 #else
1305         usb_device_request_t req;
1306         int error = 0;
1307
1308         /*
1309          * NOTE: It appears the WRITE_REGION_1 command cannot be
1310          * passed a huge amount of data, which will crash the
1311          * firmware. Limit amount of data passed to 64-bytes at a
1312          * time.
1313          */
1314         while (len > 0) {
1315                 int delta = 64;
1316                 if (delta > len)
1317                         delta = len;
1318
1319                 req.bmRequestType = UT_WRITE_VENDOR_DEVICE;
1320                 req.bRequest = RT2870_WRITE_REGION_1;
1321                 USETW(req.wValue, 0);
1322                 USETW(req.wIndex, reg);
1323                 USETW(req.wLength, delta);
1324                 error = run_do_request(sc, &req, __DECONST(uint8_t *, buf));
1325                 if (error != 0)
1326                         break;
1327                 reg += delta;
1328                 buf += delta;
1329                 len -= delta;
1330         }
1331         return (error);
1332 #endif
1333 }
1334
1335 static int
1336 run_set_region_4(struct run_softc *sc, uint16_t reg, uint32_t val, int len)
1337 {
1338         int i, error = 0;
1339
1340         KASSERT((len & 3) == 0, ("run_set_region_4: Invalid data length.\n"));
1341         for (i = 0; i < len && error == 0; i += 4)
1342                 error = run_write(sc, reg + i, val);
1343         return (error);
1344 }
1345
1346 static int
1347 run_efuse_read(struct run_softc *sc, uint16_t addr, uint16_t *val, int count)
1348 {
1349         uint32_t tmp;
1350         uint16_t reg;
1351         int error, ntries;
1352
1353         if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1354                 return (error);
1355
1356         if (count == 2)
1357                 addr *= 2;
1358         /*-
1359          * Read one 16-byte block into registers EFUSE_DATA[0-3]:
1360          * DATA0: F E D C
1361          * DATA1: B A 9 8
1362          * DATA2: 7 6 5 4
1363          * DATA3: 3 2 1 0
1364          */
1365         tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
1366         tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
1367         run_write(sc, RT3070_EFUSE_CTRL, tmp);
1368         for (ntries = 0; ntries < 100; ntries++) {
1369                 if ((error = run_read(sc, RT3070_EFUSE_CTRL, &tmp)) != 0)
1370                         return (error);
1371                 if (!(tmp & RT3070_EFSROM_KICK))
1372                         break;
1373                 run_delay(sc, 2);
1374         }
1375         if (ntries == 100)
1376                 return (ETIMEDOUT);
1377
1378         if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK) {
1379                 *val = 0xffff;  /* address not found */
1380                 return (0);
1381         }
1382         /* determine to which 32-bit register our 16-bit word belongs */
1383         reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1384         if ((error = run_read(sc, reg, &tmp)) != 0)
1385                 return (error);
1386
1387         tmp >>= (8 * (addr & 0x3));
1388         *val = (addr & 1) ? tmp >> 16 : tmp & 0xffff;
1389
1390         return (0);
1391 }
1392
1393 /* Read 16-bit from eFUSE ROM for RT3xxx. */
1394 static int
1395 run_efuse_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1396 {
1397         return (run_efuse_read(sc, addr, val, 2));
1398 }
1399
1400 static int
1401 run_eeprom_read_2(struct run_softc *sc, uint16_t addr, uint16_t *val)
1402 {
1403         usb_device_request_t req;
1404         uint16_t tmp;
1405         int error;
1406
1407         addr *= 2;
1408         req.bmRequestType = UT_READ_VENDOR_DEVICE;
1409         req.bRequest = RT2870_EEPROM_READ;
1410         USETW(req.wValue, 0);
1411         USETW(req.wIndex, addr);
1412         USETW(req.wLength, sizeof(tmp));
1413
1414         error = usbd_do_request(sc->sc_udev, &sc->sc_mtx, &req, &tmp);
1415         if (error == 0)
1416                 *val = le16toh(tmp);
1417         else
1418                 *val = 0xffff;
1419         return (error);
1420 }
1421
1422 static __inline int
1423 run_srom_read(struct run_softc *sc, uint16_t addr, uint16_t *val)
1424 {
1425         /* either eFUSE ROM or EEPROM */
1426         return sc->sc_srom_read(sc, addr, val);
1427 }
1428
1429 static int
1430 run_rt2870_rf_write(struct run_softc *sc, uint32_t val)
1431 {
1432         uint32_t tmp;
1433         int error, ntries;
1434
1435         for (ntries = 0; ntries < 10; ntries++) {
1436                 if ((error = run_read(sc, RT2860_RF_CSR_CFG0, &tmp)) != 0)
1437                         return (error);
1438                 if (!(tmp & RT2860_RF_REG_CTRL))
1439                         break;
1440         }
1441         if (ntries == 10)
1442                 return (ETIMEDOUT);
1443
1444         return (run_write(sc, RT2860_RF_CSR_CFG0, val));
1445 }
1446
1447 static int
1448 run_rt3070_rf_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1449 {
1450         uint32_t tmp;
1451         int error, ntries;
1452
1453         for (ntries = 0; ntries < 100; ntries++) {
1454                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1455                         return (error);
1456                 if (!(tmp & RT3070_RF_KICK))
1457                         break;
1458         }
1459         if (ntries == 100)
1460                 return (ETIMEDOUT);
1461
1462         tmp = RT3070_RF_KICK | reg << 8;
1463         if ((error = run_write(sc, RT3070_RF_CSR_CFG, tmp)) != 0)
1464                 return (error);
1465
1466         for (ntries = 0; ntries < 100; ntries++) {
1467                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1468                         return (error);
1469                 if (!(tmp & RT3070_RF_KICK))
1470                         break;
1471         }
1472         if (ntries == 100)
1473                 return (ETIMEDOUT);
1474
1475         *val = tmp & 0xff;
1476         return (0);
1477 }
1478
1479 static int
1480 run_rt3070_rf_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1481 {
1482         uint32_t tmp;
1483         int error, ntries;
1484
1485         for (ntries = 0; ntries < 10; ntries++) {
1486                 if ((error = run_read(sc, RT3070_RF_CSR_CFG, &tmp)) != 0)
1487                         return (error);
1488                 if (!(tmp & RT3070_RF_KICK))
1489                         break;
1490         }
1491         if (ntries == 10)
1492                 return (ETIMEDOUT);
1493
1494         tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
1495         return (run_write(sc, RT3070_RF_CSR_CFG, tmp));
1496 }
1497
1498 static int
1499 run_bbp_read(struct run_softc *sc, uint8_t reg, uint8_t *val)
1500 {
1501         uint32_t tmp;
1502         int ntries, error;
1503
1504         for (ntries = 0; ntries < 10; ntries++) {
1505                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1506                         return (error);
1507                 if (!(tmp & RT2860_BBP_CSR_KICK))
1508                         break;
1509         }
1510         if (ntries == 10)
1511                 return (ETIMEDOUT);
1512
1513         tmp = RT2860_BBP_CSR_READ | RT2860_BBP_CSR_KICK | reg << 8;
1514         if ((error = run_write(sc, RT2860_BBP_CSR_CFG, tmp)) != 0)
1515                 return (error);
1516
1517         for (ntries = 0; ntries < 10; ntries++) {
1518                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1519                         return (error);
1520                 if (!(tmp & RT2860_BBP_CSR_KICK))
1521                         break;
1522         }
1523         if (ntries == 10)
1524                 return (ETIMEDOUT);
1525
1526         *val = tmp & 0xff;
1527         return (0);
1528 }
1529
1530 static int
1531 run_bbp_write(struct run_softc *sc, uint8_t reg, uint8_t val)
1532 {
1533         uint32_t tmp;
1534         int ntries, error;
1535
1536         for (ntries = 0; ntries < 10; ntries++) {
1537                 if ((error = run_read(sc, RT2860_BBP_CSR_CFG, &tmp)) != 0)
1538                         return (error);
1539                 if (!(tmp & RT2860_BBP_CSR_KICK))
1540                         break;
1541         }
1542         if (ntries == 10)
1543                 return (ETIMEDOUT);
1544
1545         tmp = RT2860_BBP_CSR_KICK | reg << 8 | val;
1546         return (run_write(sc, RT2860_BBP_CSR_CFG, tmp));
1547 }
1548
1549 /*
1550  * Send a command to the 8051 microcontroller unit.
1551  */
1552 static int
1553 run_mcu_cmd(struct run_softc *sc, uint8_t cmd, uint16_t arg)
1554 {
1555         uint32_t tmp;
1556         int error, ntries;
1557
1558         for (ntries = 0; ntries < 100; ntries++) {
1559                 if ((error = run_read(sc, RT2860_H2M_MAILBOX, &tmp)) != 0)
1560                         return error;
1561                 if (!(tmp & RT2860_H2M_BUSY))
1562                         break;
1563         }
1564         if (ntries == 100)
1565                 return ETIMEDOUT;
1566
1567         tmp = RT2860_H2M_BUSY | RT2860_TOKEN_NO_INTR << 16 | arg;
1568         if ((error = run_write(sc, RT2860_H2M_MAILBOX, tmp)) == 0)
1569                 error = run_write(sc, RT2860_HOST_CMD, cmd);
1570         return (error);
1571 }
1572
1573 /*
1574  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
1575  * Used to adjust per-rate Tx power registers.
1576  */
1577 static __inline uint32_t
1578 b4inc(uint32_t b32, int8_t delta)
1579 {
1580         int8_t i, b4;
1581
1582         for (i = 0; i < 8; i++) {
1583                 b4 = b32 & 0xf;
1584                 b4 += delta;
1585                 if (b4 < 0)
1586                         b4 = 0;
1587                 else if (b4 > 0xf)
1588                         b4 = 0xf;
1589                 b32 = b32 >> 4 | b4 << 28;
1590         }
1591         return (b32);
1592 }
1593
1594 static const char *
1595 run_get_rf(uint16_t rev)
1596 {
1597         switch (rev) {
1598         case RT2860_RF_2820:    return "RT2820";
1599         case RT2860_RF_2850:    return "RT2850";
1600         case RT2860_RF_2720:    return "RT2720";
1601         case RT2860_RF_2750:    return "RT2750";
1602         case RT3070_RF_3020:    return "RT3020";
1603         case RT3070_RF_2020:    return "RT2020";
1604         case RT3070_RF_3021:    return "RT3021";
1605         case RT3070_RF_3022:    return "RT3022";
1606         case RT3070_RF_3052:    return "RT3052";
1607         case RT3593_RF_3053:    return "RT3053";
1608         case RT5592_RF_5592:    return "RT5592";
1609         case RT5390_RF_5370:    return "RT5370";
1610         case RT5390_RF_5372:    return "RT5372";
1611         }
1612         return ("unknown");
1613 }
1614
1615 static void
1616 run_rt3593_get_txpower(struct run_softc *sc)
1617 {
1618         uint16_t addr, val;
1619         int i;
1620
1621         /* Read power settings for 2GHz channels. */
1622         for (i = 0; i < 14; i += 2) {
1623                 addr = (sc->ntxchains == 3) ? RT3593_EEPROM_PWR2GHZ_BASE1 :
1624                     RT2860_EEPROM_PWR2GHZ_BASE1;
1625                 run_srom_read(sc, addr + i / 2, &val);
1626                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1627                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1628
1629                 addr = (sc->ntxchains == 3) ? RT3593_EEPROM_PWR2GHZ_BASE2 :
1630                     RT2860_EEPROM_PWR2GHZ_BASE2;
1631                 run_srom_read(sc, addr + i / 2, &val);
1632                 sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1633                 sc->txpow2[i + 1] = (int8_t)(val >> 8);
1634
1635                 if (sc->ntxchains == 3) {
1636                         run_srom_read(sc, RT3593_EEPROM_PWR2GHZ_BASE3 + i / 2,
1637                             &val);
1638                         sc->txpow3[i + 0] = (int8_t)(val & 0xff);
1639                         sc->txpow3[i + 1] = (int8_t)(val >> 8);
1640                 }
1641         }
1642         /* Fix broken Tx power entries. */
1643         for (i = 0; i < 14; i++) {
1644                 if (sc->txpow1[i] > 31)
1645                         sc->txpow1[i] = 5;
1646                 if (sc->txpow2[i] > 31)
1647                         sc->txpow2[i] = 5;
1648                 if (sc->ntxchains == 3) {
1649                         if (sc->txpow3[i] > 31)
1650                                 sc->txpow3[i] = 5;
1651                 }
1652         }
1653         /* Read power settings for 5GHz channels. */
1654         for (i = 0; i < 40; i += 2) {
1655                 run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1656                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1657                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1658
1659                 run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1660                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1661                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1662
1663                 if (sc->ntxchains == 3) {
1664                         run_srom_read(sc, RT3593_EEPROM_PWR5GHZ_BASE3 + i / 2,
1665                             &val);
1666                         sc->txpow3[i + 14] = (int8_t)(val & 0xff);
1667                         sc->txpow3[i + 15] = (int8_t)(val >> 8);
1668                 }
1669         }
1670 }
1671
1672 static void
1673 run_get_txpower(struct run_softc *sc)
1674 {
1675         uint16_t val;
1676         int i;
1677
1678         /* Read power settings for 2GHz channels. */
1679         for (i = 0; i < 14; i += 2) {
1680                 run_srom_read(sc, RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2, &val);
1681                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
1682                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
1683
1684                 if (sc->mac_ver != 0x5390) {
1685                         run_srom_read(sc,
1686                             RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2, &val);
1687                         sc->txpow2[i + 0] = (int8_t)(val & 0xff);
1688                         sc->txpow2[i + 1] = (int8_t)(val >> 8);
1689                 }
1690         }
1691         /* Fix broken Tx power entries. */
1692         for (i = 0; i < 14; i++) {
1693                 if (sc->mac_ver >= 0x5390) {
1694                         if (sc->txpow1[i] < 0 || sc->txpow1[i] > 27)
1695                                 sc->txpow1[i] = 5;
1696                 } else {
1697                         if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
1698                                 sc->txpow1[i] = 5;
1699                 }
1700                 if (sc->mac_ver > 0x5390) {
1701                         if (sc->txpow2[i] < 0 || sc->txpow2[i] > 27)
1702                                 sc->txpow2[i] = 5;
1703                 } else if (sc->mac_ver < 0x5390) {
1704                         if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
1705                                 sc->txpow2[i] = 5;
1706                 }
1707                 DPRINTF("chan %d: power1=%d, power2=%d\n",
1708                     rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]);
1709         }
1710         /* Read power settings for 5GHz channels. */
1711         for (i = 0; i < 40; i += 2) {
1712                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2, &val);
1713                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
1714                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
1715
1716                 run_srom_read(sc, RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2, &val);
1717                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
1718                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
1719         }
1720         /* Fix broken Tx power entries. */
1721         for (i = 0; i < 40; i++ ) {
1722                 if (sc->mac_ver != 0x5592) {
1723                         if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
1724                                 sc->txpow1[14 + i] = 5;
1725                         if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
1726                                 sc->txpow2[14 + i] = 5;
1727                 }
1728                 DPRINTF("chan %d: power1=%d, power2=%d\n",
1729                     rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
1730                     sc->txpow2[14 + i]);
1731         }
1732 }
1733
1734 static int
1735 run_read_eeprom(struct run_softc *sc)
1736 {
1737         int8_t delta_2ghz, delta_5ghz;
1738         uint32_t tmp;
1739         uint16_t val;
1740         int ridx, ant, i;
1741
1742         /* check whether the ROM is eFUSE ROM or EEPROM */
1743         sc->sc_srom_read = run_eeprom_read_2;
1744         if (sc->mac_ver >= 0x3070) {
1745                 run_read(sc, RT3070_EFUSE_CTRL, &tmp);
1746                 DPRINTF("EFUSE_CTRL=0x%08x\n", tmp);
1747                 if ((tmp & RT3070_SEL_EFUSE) || sc->mac_ver == 0x3593)
1748                         sc->sc_srom_read = run_efuse_read_2;
1749         }
1750
1751         /* read ROM version */
1752         run_srom_read(sc, RT2860_EEPROM_VERSION, &val);
1753         DPRINTF("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8);
1754
1755         /* read MAC address */
1756         run_srom_read(sc, RT2860_EEPROM_MAC01, &val);
1757         sc->sc_bssid[0] = val & 0xff;
1758         sc->sc_bssid[1] = val >> 8;
1759         run_srom_read(sc, RT2860_EEPROM_MAC23, &val);
1760         sc->sc_bssid[2] = val & 0xff;
1761         sc->sc_bssid[3] = val >> 8;
1762         run_srom_read(sc, RT2860_EEPROM_MAC45, &val);
1763         sc->sc_bssid[4] = val & 0xff;
1764         sc->sc_bssid[5] = val >> 8;
1765
1766         if (sc->mac_ver < 0x3593) {
1767                 /* read vender BBP settings */
1768                 for (i = 0; i < 10; i++) {
1769                         run_srom_read(sc, RT2860_EEPROM_BBP_BASE + i, &val);
1770                         sc->bbp[i].val = val & 0xff;
1771                         sc->bbp[i].reg = val >> 8;
1772                         DPRINTF("BBP%d=0x%02x\n", sc->bbp[i].reg,
1773                             sc->bbp[i].val);
1774                 }
1775                 if (sc->mac_ver >= 0x3071) {
1776                         /* read vendor RF settings */
1777                         for (i = 0; i < 10; i++) {
1778                                 run_srom_read(sc, RT3071_EEPROM_RF_BASE + i,
1779                                    &val);
1780                                 sc->rf[i].val = val & 0xff;
1781                                 sc->rf[i].reg = val >> 8;
1782                                 DPRINTF("RF%d=0x%02x\n", sc->rf[i].reg,
1783                                     sc->rf[i].val);
1784                         }
1785                 }
1786         }
1787
1788         /* read RF frequency offset from EEPROM */
1789         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_FREQ_LEDS :
1790             RT3593_EEPROM_FREQ, &val);
1791         sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
1792         DPRINTF("EEPROM freq offset %d\n", sc->freq & 0xff);
1793
1794         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_FREQ_LEDS :
1795             RT3593_EEPROM_FREQ_LEDS, &val);
1796         if (val >> 8 != 0xff) {
1797                 /* read LEDs operating mode */
1798                 sc->leds = val >> 8;
1799                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED1 :
1800                     RT3593_EEPROM_LED1, &sc->led[0]);
1801                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED2 :
1802                     RT3593_EEPROM_LED2, &sc->led[1]);
1803                 run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LED3 :
1804                     RT3593_EEPROM_LED3, &sc->led[2]);
1805         } else {
1806                 /* broken EEPROM, use default settings */
1807                 sc->leds = 0x01;
1808                 sc->led[0] = 0x5555;
1809                 sc->led[1] = 0x2221;
1810                 sc->led[2] = 0x5627;    /* differs from RT2860 */
1811         }
1812         DPRINTF("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
1813             sc->leds, sc->led[0], sc->led[1], sc->led[2]);
1814
1815         /* read RF information */
1816         if (sc->mac_ver == 0x5390 || sc->mac_ver ==0x5392)
1817                 run_srom_read(sc, 0x00, &val);
1818         else
1819                 run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1820
1821         if (val == 0xffff) {
1822                 device_printf(sc->sc_dev,
1823                     "invalid EEPROM antenna info, using default\n");
1824                 DPRINTF("invalid EEPROM antenna info, using default\n");
1825                 if (sc->mac_ver == 0x3572) {
1826                         /* default to RF3052 2T2R */
1827                         sc->rf_rev = RT3070_RF_3052;
1828                         sc->ntxchains = 2;
1829                         sc->nrxchains = 2;
1830                 } else if (sc->mac_ver >= 0x3070) {
1831                         /* default to RF3020 1T1R */
1832                         sc->rf_rev = RT3070_RF_3020;
1833                         sc->ntxchains = 1;
1834                         sc->nrxchains = 1;
1835                 } else {
1836                         /* default to RF2820 1T2R */
1837                         sc->rf_rev = RT2860_RF_2820;
1838                         sc->ntxchains = 1;
1839                         sc->nrxchains = 2;
1840                 }
1841         } else {
1842                 if (sc->mac_ver == 0x5390 || sc->mac_ver ==0x5392) {
1843                         sc->rf_rev = val;
1844                         run_srom_read(sc, RT2860_EEPROM_ANTENNA, &val);
1845                 } else
1846                         sc->rf_rev = (val >> 8) & 0xf;
1847                 sc->ntxchains = (val >> 4) & 0xf;
1848                 sc->nrxchains = val & 0xf;
1849         }
1850         DPRINTF("EEPROM RF rev=0x%04x chains=%dT%dR\n",
1851             sc->rf_rev, sc->ntxchains, sc->nrxchains);
1852
1853         /* check if RF supports automatic Tx access gain control */
1854         run_srom_read(sc, RT2860_EEPROM_CONFIG, &val);
1855         DPRINTF("EEPROM CFG 0x%04x\n", val);
1856         /* check if driver should patch the DAC issue */
1857         if ((val >> 8) != 0xff)
1858                 sc->patch_dac = (val >> 15) & 1;
1859         if ((val & 0xff) != 0xff) {
1860                 sc->ext_5ghz_lna = (val >> 3) & 1;
1861                 sc->ext_2ghz_lna = (val >> 2) & 1;
1862                 /* check if RF supports automatic Tx access gain control */
1863                 sc->calib_2ghz = sc->calib_5ghz = (val >> 1) & 1;
1864                 /* check if we have a hardware radio switch */
1865                 sc->rfswitch = val & 1;
1866         }
1867
1868         /* Read Tx power settings. */
1869         if (sc->mac_ver == 0x3593)
1870                 run_rt3593_get_txpower(sc);
1871         else
1872                 run_get_txpower(sc);
1873
1874         /* read Tx power compensation for each Tx rate */
1875         run_srom_read(sc, RT2860_EEPROM_DELTAPWR, &val);
1876         delta_2ghz = delta_5ghz = 0;
1877         if ((val & 0xff) != 0xff && (val & 0x80)) {
1878                 delta_2ghz = val & 0xf;
1879                 if (!(val & 0x40))      /* negative number */
1880                         delta_2ghz = -delta_2ghz;
1881         }
1882         val >>= 8;
1883         if ((val & 0xff) != 0xff && (val & 0x80)) {
1884                 delta_5ghz = val & 0xf;
1885                 if (!(val & 0x40))      /* negative number */
1886                         delta_5ghz = -delta_5ghz;
1887         }
1888         DPRINTF("power compensation=%d (2GHz), %d (5GHz)\n",
1889             delta_2ghz, delta_5ghz);
1890
1891         for (ridx = 0; ridx < 5; ridx++) {
1892                 uint32_t reg;
1893
1894                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2, &val);
1895                 reg = val;
1896                 run_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1, &val);
1897                 reg |= (uint32_t)val << 16;
1898
1899                 sc->txpow20mhz[ridx] = reg;
1900                 sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
1901                 sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
1902
1903                 DPRINTF("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
1904                     "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
1905                     sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]);
1906         }
1907
1908         /* Read RSSI offsets and LNA gains from EEPROM. */
1909         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI1_2GHZ :
1910             RT3593_EEPROM_RSSI1_2GHZ, &val);
1911         sc->rssi_2ghz[0] = val & 0xff;  /* Ant A */
1912         sc->rssi_2ghz[1] = val >> 8;    /* Ant B */
1913         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI2_2GHZ :
1914             RT3593_EEPROM_RSSI2_2GHZ, &val);
1915         if (sc->mac_ver >= 0x3070) {
1916                 if (sc->mac_ver == 0x3593) {
1917                         sc->txmixgain_2ghz = 0;
1918                         sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1919                 } else {
1920                         /*
1921                          * On RT3070 chips (limited to 2 Rx chains), this ROM
1922                          * field contains the Tx mixer gain for the 2GHz band.
1923                          */
1924                         if ((val & 0xff) != 0xff)
1925                                 sc->txmixgain_2ghz = val & 0x7;
1926                 }
1927                 DPRINTF("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz);
1928         } else
1929                 sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
1930         if (sc->mac_ver == 0x3593)
1931                 run_srom_read(sc, RT3593_EEPROM_LNA_5GHZ, &val);
1932         sc->lna[2] = val >> 8;          /* channel group 2 */
1933
1934         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI1_5GHZ :
1935             RT3593_EEPROM_RSSI1_5GHZ, &val);
1936         sc->rssi_5ghz[0] = val & 0xff;  /* Ant A */
1937         sc->rssi_5ghz[1] = val >> 8;    /* Ant B */
1938         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_RSSI2_5GHZ :
1939             RT3593_EEPROM_RSSI2_5GHZ, &val);
1940         if (sc->mac_ver == 0x3572) {
1941                 /*
1942                  * On RT3572 chips (limited to 2 Rx chains), this ROM
1943                  * field contains the Tx mixer gain for the 5GHz band.
1944                  */
1945                 if ((val & 0xff) != 0xff)
1946                         sc->txmixgain_5ghz = val & 0x7;
1947                 DPRINTF("tx mixer gain=%u (5GHz)\n", sc->txmixgain_5ghz);
1948         } else
1949                 sc->rssi_5ghz[2] = val & 0xff;  /* Ant C */
1950         if (sc->mac_ver == 0x3593) {
1951                 sc->txmixgain_5ghz = 0;
1952                 run_srom_read(sc, RT3593_EEPROM_LNA_5GHZ, &val);
1953         }
1954         sc->lna[3] = val >> 8;          /* channel group 3 */
1955
1956         run_srom_read(sc, (sc->mac_ver != 0x3593) ? RT2860_EEPROM_LNA :
1957             RT3593_EEPROM_LNA, &val);
1958         sc->lna[0] = val & 0xff;        /* channel group 0 */
1959         sc->lna[1] = val >> 8;          /* channel group 1 */
1960
1961         /* fix broken 5GHz LNA entries */
1962         if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
1963                 DPRINTF("invalid LNA for channel group %d\n", 2);
1964                 sc->lna[2] = sc->lna[1];
1965         }
1966         if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
1967                 DPRINTF("invalid LNA for channel group %d\n", 3);
1968                 sc->lna[3] = sc->lna[1];
1969         }
1970
1971         /* fix broken RSSI offset entries */
1972         for (ant = 0; ant < 3; ant++) {
1973                 if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
1974                         DPRINTF("invalid RSSI%d offset: %d (2GHz)\n",
1975                             ant + 1, sc->rssi_2ghz[ant]);
1976                         sc->rssi_2ghz[ant] = 0;
1977                 }
1978                 if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
1979                         DPRINTF("invalid RSSI%d offset: %d (5GHz)\n",
1980                             ant + 1, sc->rssi_5ghz[ant]);
1981                         sc->rssi_5ghz[ant] = 0;
1982                 }
1983         }
1984         return (0);
1985 }
1986
1987 static struct ieee80211_node *
1988 run_node_alloc(struct ieee80211vap *vap, const uint8_t mac[IEEE80211_ADDR_LEN])
1989 {
1990         return malloc(sizeof (struct run_node), M_80211_NODE,
1991             M_NOWAIT | M_ZERO);
1992 }
1993
1994 static int
1995 run_media_change(struct ifnet *ifp)
1996 {
1997         struct ieee80211vap *vap = ifp->if_softc;
1998         struct ieee80211com *ic = vap->iv_ic;
1999         const struct ieee80211_txparam *tp;
2000         struct run_softc *sc = ic->ic_ifp->if_softc;
2001         uint8_t rate, ridx;
2002         int error;
2003
2004         RUN_LOCK(sc);
2005
2006         error = ieee80211_media_change(ifp);
2007         if (error != ENETRESET) {
2008                 RUN_UNLOCK(sc);
2009                 return (error);
2010         }
2011
2012         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2013         if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
2014                 struct ieee80211_node *ni;
2015                 struct run_node *rn;
2016
2017                 rate = ic->ic_sup_rates[ic->ic_curmode].
2018                     rs_rates[tp->ucastrate] & IEEE80211_RATE_VAL;
2019                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2020                         if (rt2860_rates[ridx].rate == rate)
2021                                 break;
2022                 ni = ieee80211_ref_node(vap->iv_bss);
2023                 rn = (struct run_node *)ni;
2024                 rn->fix_ridx = ridx;
2025                 DPRINTF("rate=%d, fix_ridx=%d\n", rate, rn->fix_ridx);
2026                 ieee80211_free_node(ni);
2027         }
2028
2029 #if 0
2030         if ((ifp->if_flags & IFF_UP) &&
2031             (ifp->if_drv_flags &  IFF_DRV_RUNNING)){
2032                 run_init_locked(sc);
2033         }
2034 #endif
2035
2036         RUN_UNLOCK(sc);
2037
2038         return (0);
2039 }
2040
2041 static int
2042 run_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
2043 {
2044         const struct ieee80211_txparam *tp;
2045         struct ieee80211com *ic = vap->iv_ic;
2046         struct run_softc *sc = ic->ic_ifp->if_softc;
2047         struct run_vap *rvp = RUN_VAP(vap);
2048         enum ieee80211_state ostate;
2049         uint32_t sta[3];
2050         uint32_t tmp;
2051         uint8_t ratectl;
2052         uint8_t restart_ratectl = 0;
2053         uint8_t bid = 1 << rvp->rvp_id;
2054
2055         ostate = vap->iv_state;
2056         DPRINTF("%s -> %s\n",
2057                 ieee80211_state_name[ostate],
2058                 ieee80211_state_name[nstate]);
2059
2060         IEEE80211_UNLOCK(ic);
2061         RUN_LOCK(sc);
2062
2063         ratectl = sc->ratectl_run; /* remember current state */
2064         sc->ratectl_run = RUN_RATECTL_OFF;
2065         usb_callout_stop(&sc->ratectl_ch);
2066
2067         if (ostate == IEEE80211_S_RUN) {
2068                 /* turn link LED off */
2069                 run_set_leds(sc, RT2860_LED_RADIO);
2070         }
2071
2072         switch (nstate) {
2073         case IEEE80211_S_INIT:
2074                 restart_ratectl = 1;
2075
2076                 if (ostate != IEEE80211_S_RUN)
2077                         break;
2078
2079                 ratectl &= ~bid;
2080                 sc->runbmap &= ~bid;
2081
2082                 /* abort TSF synchronization if there is no vap running */
2083                 if (--sc->running == 0) {
2084                         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
2085                         run_write(sc, RT2860_BCN_TIME_CFG,
2086                             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
2087                             RT2860_TBTT_TIMER_EN));
2088                 }
2089                 break;
2090
2091         case IEEE80211_S_RUN:
2092                 if (!(sc->runbmap & bid)) {
2093                         if(sc->running++)
2094                                 restart_ratectl = 1;
2095                         sc->runbmap |= bid;
2096                 }
2097
2098                 m_freem(rvp->beacon_mbuf);
2099                 rvp->beacon_mbuf = NULL;
2100
2101                 switch (vap->iv_opmode) {
2102                 case IEEE80211_M_HOSTAP:
2103                 case IEEE80211_M_MBSS:
2104                         sc->ap_running |= bid;
2105                         ic->ic_opmode = vap->iv_opmode;
2106                         run_update_beacon_cb(vap);
2107                         break;
2108                 case IEEE80211_M_IBSS:
2109                         sc->adhoc_running |= bid;
2110                         if (!sc->ap_running)
2111                                 ic->ic_opmode = vap->iv_opmode;
2112                         run_update_beacon_cb(vap);
2113                         break;
2114                 case IEEE80211_M_STA:
2115                         sc->sta_running |= bid;
2116                         if (!sc->ap_running && !sc->adhoc_running)
2117                                 ic->ic_opmode = vap->iv_opmode;
2118
2119                         /* read statistic counters (clear on read) */
2120                         run_read_region_1(sc, RT2860_TX_STA_CNT0,
2121                             (uint8_t *)sta, sizeof sta);
2122
2123                         break;
2124                 default:
2125                         ic->ic_opmode = vap->iv_opmode;
2126                         break;
2127                 }
2128
2129                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
2130                         struct ieee80211_node *ni;
2131
2132                         if (ic->ic_bsschan == IEEE80211_CHAN_ANYC) {
2133                                 RUN_UNLOCK(sc);
2134                                 IEEE80211_LOCK(ic);
2135                                 return (-1);
2136                         }
2137                         run_updateslot(ic->ic_ifp);
2138                         run_enable_mrr(sc);
2139                         run_set_txpreamble(sc);
2140                         run_set_basicrates(sc);
2141                         ni = ieee80211_ref_node(vap->iv_bss);
2142                         IEEE80211_ADDR_COPY(sc->sc_bssid, ni->ni_bssid);
2143                         run_set_bssid(sc, ni->ni_bssid);
2144                         ieee80211_free_node(ni);
2145                         run_enable_tsf_sync(sc);
2146
2147                         /* enable automatic rate adaptation */
2148                         tp = &vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)];
2149                         if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE)
2150                                 ratectl |= bid;
2151                 }
2152
2153                 /* turn link LED on */
2154                 run_set_leds(sc, RT2860_LED_RADIO |
2155                     (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan) ?
2156                      RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
2157
2158                 break;
2159         default:
2160                 DPRINTFN(6, "undefined case\n");
2161                 break;
2162         }
2163
2164         /* restart amrr for running VAPs */
2165         if ((sc->ratectl_run = ratectl) && restart_ratectl)
2166                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2167
2168         RUN_UNLOCK(sc);
2169         IEEE80211_LOCK(ic);
2170
2171         return(rvp->newstate(vap, nstate, arg));
2172 }
2173
2174 /* ARGSUSED */
2175 static void
2176 run_wme_update_cb(void *arg)
2177 {
2178         struct ieee80211com *ic = arg;
2179         struct run_softc *sc = ic->ic_ifp->if_softc;
2180         struct ieee80211_wme_state *wmesp = &ic->ic_wme;
2181         int aci, error = 0;
2182
2183         RUN_LOCK_ASSERT(sc, MA_OWNED);
2184
2185         /* update MAC TX configuration registers */
2186         for (aci = 0; aci < WME_NUM_AC; aci++) {
2187                 error = run_write(sc, RT2860_EDCA_AC_CFG(aci),
2188                     wmesp->wme_params[aci].wmep_logcwmax << 16 |
2189                     wmesp->wme_params[aci].wmep_logcwmin << 12 |
2190                     wmesp->wme_params[aci].wmep_aifsn  <<  8 |
2191                     wmesp->wme_params[aci].wmep_txopLimit);
2192                 if (error) goto err;
2193         }
2194
2195         /* update SCH/DMA registers too */
2196         error = run_write(sc, RT2860_WMM_AIFSN_CFG,
2197             wmesp->wme_params[WME_AC_VO].wmep_aifsn  << 12 |
2198             wmesp->wme_params[WME_AC_VI].wmep_aifsn  <<  8 |
2199             wmesp->wme_params[WME_AC_BK].wmep_aifsn  <<  4 |
2200             wmesp->wme_params[WME_AC_BE].wmep_aifsn);
2201         if (error) goto err;
2202         error = run_write(sc, RT2860_WMM_CWMIN_CFG,
2203             wmesp->wme_params[WME_AC_VO].wmep_logcwmin << 12 |
2204             wmesp->wme_params[WME_AC_VI].wmep_logcwmin <<  8 |
2205             wmesp->wme_params[WME_AC_BK].wmep_logcwmin <<  4 |
2206             wmesp->wme_params[WME_AC_BE].wmep_logcwmin);
2207         if (error) goto err;
2208         error = run_write(sc, RT2860_WMM_CWMAX_CFG,
2209             wmesp->wme_params[WME_AC_VO].wmep_logcwmax << 12 |
2210             wmesp->wme_params[WME_AC_VI].wmep_logcwmax <<  8 |
2211             wmesp->wme_params[WME_AC_BK].wmep_logcwmax <<  4 |
2212             wmesp->wme_params[WME_AC_BE].wmep_logcwmax);
2213         if (error) goto err;
2214         error = run_write(sc, RT2860_WMM_TXOP0_CFG,
2215             wmesp->wme_params[WME_AC_BK].wmep_txopLimit << 16 |
2216             wmesp->wme_params[WME_AC_BE].wmep_txopLimit);
2217         if (error) goto err;
2218         error = run_write(sc, RT2860_WMM_TXOP1_CFG,
2219             wmesp->wme_params[WME_AC_VO].wmep_txopLimit << 16 |
2220             wmesp->wme_params[WME_AC_VI].wmep_txopLimit);
2221
2222 err:
2223         if (error)
2224                 DPRINTF("WME update failed\n");
2225
2226         return;
2227 }
2228
2229 static int
2230 run_wme_update(struct ieee80211com *ic)
2231 {
2232         struct run_softc *sc = ic->ic_ifp->if_softc;
2233
2234         /* sometime called wothout lock */
2235         if (mtx_owned(&ic->ic_comlock.mtx)) {
2236                 uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
2237                 DPRINTF("cmdq_store=%d\n", i);
2238                 sc->cmdq[i].func = run_wme_update_cb;
2239                 sc->cmdq[i].arg0 = ic;
2240                 ieee80211_runtask(ic, &sc->cmdq_task);
2241                 return (0);
2242         }
2243
2244         RUN_LOCK(sc);
2245         run_wme_update_cb(ic);
2246         RUN_UNLOCK(sc);
2247
2248         /* return whatever, upper layer desn't care anyway */
2249         return (0);
2250 }
2251
2252 static void
2253 run_key_update_begin(struct ieee80211vap *vap)
2254 {
2255         /*
2256          * To avoid out-of-order events, both run_key_set() and
2257          * _delete() are deferred and handled by run_cmdq_cb().
2258          * So, there is nothing we need to do here.
2259          */
2260 }
2261
2262 static void
2263 run_key_update_end(struct ieee80211vap *vap)
2264 {
2265         /* null */
2266 }
2267
2268 static void
2269 run_key_set_cb(void *arg)
2270 {
2271         struct run_cmdq *cmdq = arg;
2272         struct ieee80211vap *vap = cmdq->arg1;
2273         struct ieee80211_key *k = cmdq->k;
2274         struct ieee80211com *ic = vap->iv_ic;
2275         struct run_softc *sc = ic->ic_ifp->if_softc;
2276         struct ieee80211_node *ni;
2277         uint32_t attr;
2278         uint16_t base, associd;
2279         uint8_t mode, wcid, iv[8];
2280
2281         RUN_LOCK_ASSERT(sc, MA_OWNED);
2282
2283         if (vap->iv_opmode == IEEE80211_M_HOSTAP)
2284                 ni = ieee80211_find_vap_node(&ic->ic_sta, vap, cmdq->mac);
2285         else
2286                 ni = vap->iv_bss;
2287         associd = (ni != NULL) ? ni->ni_associd : 0;
2288
2289         /* map net80211 cipher to RT2860 security mode */
2290         switch (k->wk_cipher->ic_cipher) {
2291         case IEEE80211_CIPHER_WEP:
2292                 if(k->wk_keylen < 8)
2293                         mode = RT2860_MODE_WEP40;
2294                 else
2295                         mode = RT2860_MODE_WEP104;
2296                 break;
2297         case IEEE80211_CIPHER_TKIP:
2298                 mode = RT2860_MODE_TKIP;
2299                 break;
2300         case IEEE80211_CIPHER_AES_CCM:
2301                 mode = RT2860_MODE_AES_CCMP;
2302                 break;
2303         default:
2304                 DPRINTF("undefined case\n");
2305                 return;
2306         }
2307
2308         DPRINTFN(1, "associd=%x, keyix=%d, mode=%x, type=%s, tx=%s, rx=%s\n",
2309             associd, k->wk_keyix, mode,
2310             (k->wk_flags & IEEE80211_KEY_GROUP) ? "group" : "pairwise",
2311             (k->wk_flags & IEEE80211_KEY_XMIT) ? "on" : "off",
2312             (k->wk_flags & IEEE80211_KEY_RECV) ? "on" : "off");
2313
2314         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2315                 wcid = 0;       /* NB: update WCID0 for group keys */
2316                 base = RT2860_SKEY(RUN_VAP(vap)->rvp_id, k->wk_keyix);
2317         } else {
2318                 wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
2319                     1 : RUN_AID2WCID(associd);
2320                 base = RT2860_PKEY(wcid);
2321         }
2322
2323         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
2324                 if(run_write_region_1(sc, base, k->wk_key, 16))
2325                         return;
2326                 if(run_write_region_1(sc, base + 16, &k->wk_key[16], 8))        /* wk_txmic */
2327                         return;
2328                 if(run_write_region_1(sc, base + 24, &k->wk_key[24], 8))        /* wk_rxmic */
2329                         return;
2330         } else {
2331                 /* roundup len to 16-bit: XXX fix write_region_1() instead */
2332                 if(run_write_region_1(sc, base, k->wk_key, (k->wk_keylen + 1) & ~1))
2333                         return;
2334         }
2335
2336         if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
2337             (k->wk_flags & (IEEE80211_KEY_XMIT | IEEE80211_KEY_RECV))) {
2338                 /* set initial packet number in IV+EIV */
2339                 if (k->wk_cipher == IEEE80211_CIPHER_WEP) {
2340                         memset(iv, 0, sizeof iv);
2341                         iv[3] = vap->iv_def_txkey << 6;
2342                 } else {
2343                         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
2344                                 iv[0] = k->wk_keytsc >> 8;
2345                                 iv[1] = (iv[0] | 0x20) & 0x7f;
2346                                 iv[2] = k->wk_keytsc;
2347                         } else /* CCMP */ {
2348                                 iv[0] = k->wk_keytsc;
2349                                 iv[1] = k->wk_keytsc >> 8;
2350                                 iv[2] = 0;
2351                         }
2352                         iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
2353                         iv[4] = k->wk_keytsc >> 16;
2354                         iv[5] = k->wk_keytsc >> 24;
2355                         iv[6] = k->wk_keytsc >> 32;
2356                         iv[7] = k->wk_keytsc >> 40;
2357                 }
2358                 if (run_write_region_1(sc, RT2860_IVEIV(wcid), iv, 8))
2359                         return;
2360         }
2361
2362         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2363                 /* install group key */
2364                 if (run_read(sc, RT2860_SKEY_MODE_0_7, &attr))
2365                         return;
2366                 attr &= ~(0xf << (k->wk_keyix * 4));
2367                 attr |= mode << (k->wk_keyix * 4);
2368                 if (run_write(sc, RT2860_SKEY_MODE_0_7, attr))
2369                         return;
2370         } else {
2371                 /* install pairwise key */
2372                 if (run_read(sc, RT2860_WCID_ATTR(wcid), &attr))
2373                         return;
2374                 attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
2375                 if (run_write(sc, RT2860_WCID_ATTR(wcid), attr))
2376                         return;
2377         }
2378
2379         /* TODO create a pass-thru key entry? */
2380
2381         /* need wcid to delete the right key later */
2382         k->wk_pad = wcid;
2383 }
2384
2385 /*
2386  * Don't have to be deferred, but in order to keep order of
2387  * execution, i.e. with run_key_delete(), defer this and let
2388  * run_cmdq_cb() maintain the order.
2389  *
2390  * return 0 on error
2391  */
2392 static int
2393 run_key_set(struct ieee80211vap *vap, struct ieee80211_key *k,
2394                 const uint8_t mac[IEEE80211_ADDR_LEN])
2395 {
2396         struct ieee80211com *ic = vap->iv_ic;
2397         struct run_softc *sc = ic->ic_ifp->if_softc;
2398         uint32_t i;
2399
2400         i = RUN_CMDQ_GET(&sc->cmdq_store);
2401         DPRINTF("cmdq_store=%d\n", i);
2402         sc->cmdq[i].func = run_key_set_cb;
2403         sc->cmdq[i].arg0 = NULL;
2404         sc->cmdq[i].arg1 = vap;
2405         sc->cmdq[i].k = k;
2406         IEEE80211_ADDR_COPY(sc->cmdq[i].mac, mac);
2407         ieee80211_runtask(ic, &sc->cmdq_task);
2408
2409         /*
2410          * To make sure key will be set when hostapd
2411          * calls iv_key_set() before if_init().
2412          */
2413         if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
2414                 RUN_LOCK(sc);
2415                 sc->cmdq_key_set = RUN_CMDQ_GO;
2416                 RUN_UNLOCK(sc);
2417         }
2418
2419         return (1);
2420 }
2421
2422 /*
2423  * If wlan is destroyed without being brought down i.e. without
2424  * wlan down or wpa_cli terminate, this function is called after
2425  * vap is gone. Don't refer it.
2426  */
2427 static void
2428 run_key_delete_cb(void *arg)
2429 {
2430         struct run_cmdq *cmdq = arg;
2431         struct run_softc *sc = cmdq->arg1;
2432         struct ieee80211_key *k = &cmdq->key;
2433         uint32_t attr;
2434         uint8_t wcid;
2435
2436         RUN_LOCK_ASSERT(sc, MA_OWNED);
2437
2438         if (k->wk_flags & IEEE80211_KEY_GROUP) {
2439                 /* remove group key */
2440                 DPRINTF("removing group key\n");
2441                 run_read(sc, RT2860_SKEY_MODE_0_7, &attr);
2442                 attr &= ~(0xf << (k->wk_keyix * 4));
2443                 run_write(sc, RT2860_SKEY_MODE_0_7, attr);
2444         } else {
2445                 /* remove pairwise key */
2446                 DPRINTF("removing key for wcid %x\n", k->wk_pad);
2447                 /* matching wcid was written to wk_pad in run_key_set() */
2448                 wcid = k->wk_pad;
2449                 run_read(sc, RT2860_WCID_ATTR(wcid), &attr);
2450                 attr &= ~0xf;
2451                 run_write(sc, RT2860_WCID_ATTR(wcid), attr);
2452                 run_set_region_4(sc, RT2860_WCID_ENTRY(wcid), 0, 8);
2453         }
2454
2455         k->wk_pad = 0;
2456 }
2457
2458 /*
2459  * return 0 on error
2460  */
2461 static int
2462 run_key_delete(struct ieee80211vap *vap, struct ieee80211_key *k)
2463 {
2464         struct ieee80211com *ic = vap->iv_ic;
2465         struct run_softc *sc = ic->ic_ifp->if_softc;
2466         struct ieee80211_key *k0;
2467         uint32_t i;
2468
2469         /*
2470          * When called back, key might be gone. So, make a copy
2471          * of some values need to delete keys before deferring.
2472          * But, because of LOR with node lock, cannot use lock here.
2473          * So, use atomic instead.
2474          */
2475         i = RUN_CMDQ_GET(&sc->cmdq_store);
2476         DPRINTF("cmdq_store=%d\n", i);
2477         sc->cmdq[i].func = run_key_delete_cb;
2478         sc->cmdq[i].arg0 = NULL;
2479         sc->cmdq[i].arg1 = sc;
2480         k0 = &sc->cmdq[i].key;
2481         k0->wk_flags = k->wk_flags;
2482         k0->wk_keyix = k->wk_keyix;
2483         /* matching wcid was written to wk_pad in run_key_set() */
2484         k0->wk_pad = k->wk_pad;
2485         ieee80211_runtask(ic, &sc->cmdq_task);
2486         return (1);     /* return fake success */
2487
2488 }
2489
2490 static void
2491 run_ratectl_to(void *arg)
2492 {
2493         struct run_softc *sc = arg;
2494
2495         /* do it in a process context, so it can go sleep */
2496         ieee80211_runtask(sc->sc_ifp->if_l2com, &sc->ratectl_task);
2497         /* next timeout will be rescheduled in the callback task */
2498 }
2499
2500 /* ARGSUSED */
2501 static void
2502 run_ratectl_cb(void *arg, int pending)
2503 {
2504         struct run_softc *sc = arg;
2505         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
2506         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2507
2508         if (vap == NULL)
2509                 return;
2510
2511         if (sc->rvp_cnt > 1 || vap->iv_opmode != IEEE80211_M_STA) {
2512                 /*
2513                  * run_reset_livelock() doesn't do anything with AMRR,
2514                  * but Ralink wants us to call it every 1 sec. So, we
2515                  * piggyback here rather than creating another callout.
2516                  * Livelock may occur only in HOSTAP or IBSS mode
2517                  * (when h/w is sending beacons).
2518                  */
2519                 RUN_LOCK(sc);
2520                 run_reset_livelock(sc);
2521                 /* just in case, there are some stats to drain */
2522                 run_drain_fifo(sc);
2523                 RUN_UNLOCK(sc);
2524         }
2525
2526         ieee80211_iterate_nodes(&ic->ic_sta, run_iter_func, sc);
2527
2528         RUN_LOCK(sc);
2529         if(sc->ratectl_run != RUN_RATECTL_OFF)
2530                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2531         RUN_UNLOCK(sc);
2532 }
2533
2534 static void
2535 run_drain_fifo(void *arg)
2536 {
2537         struct run_softc *sc = arg;
2538         struct ifnet *ifp = sc->sc_ifp;
2539         uint32_t stat;
2540         uint16_t (*wstat)[3];
2541         uint8_t wcid, mcs, pid;
2542         int8_t retry;
2543
2544         RUN_LOCK_ASSERT(sc, MA_OWNED);
2545
2546         for (;;) {
2547                 /* drain Tx status FIFO (maxsize = 16) */
2548                 run_read(sc, RT2860_TX_STAT_FIFO, &stat);
2549                 DPRINTFN(4, "tx stat 0x%08x\n", stat);
2550                 if (!(stat & RT2860_TXQ_VLD))
2551                         break;
2552
2553                 wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
2554
2555                 /* if no ACK was requested, no feedback is available */
2556                 if (!(stat & RT2860_TXQ_ACKREQ) || wcid > RT2870_WCID_MAX ||
2557                     wcid == 0)
2558                         continue;
2559
2560                 /*
2561                  * Even though each stat is Tx-complete-status like format,
2562                  * the device can poll stats. Because there is no guarantee
2563                  * that the referring node is still around when read the stats.
2564                  * So that, if we use ieee80211_ratectl_tx_update(), we will
2565                  * have hard time not to refer already freed node.
2566                  *
2567                  * To eliminate such page faults, we poll stats in softc.
2568                  * Then, update the rates later with ieee80211_ratectl_tx_update().
2569                  */
2570                 wstat = &(sc->wcid_stats[wcid]);
2571                 (*wstat)[RUN_TXCNT]++;
2572                 if (stat & RT2860_TXQ_OK)
2573                         (*wstat)[RUN_SUCCESS]++;
2574                 else
2575                         ifp->if_oerrors++;
2576                 /*
2577                  * Check if there were retries, ie if the Tx success rate is
2578                  * different from the requested rate. Note that it works only
2579                  * because we do not allow rate fallback from OFDM to CCK.
2580                  */
2581                 mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
2582                 pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
2583                 if ((retry = pid -1 - mcs) > 0) {
2584                         (*wstat)[RUN_TXCNT] += retry;
2585                         (*wstat)[RUN_RETRY] += retry;
2586                 }
2587         }
2588         DPRINTFN(3, "count=%d\n", sc->fifo_cnt);
2589
2590         sc->fifo_cnt = 0;
2591 }
2592
2593 static void
2594 run_iter_func(void *arg, struct ieee80211_node *ni)
2595 {
2596         struct run_softc *sc = arg;
2597         struct ieee80211vap *vap = ni->ni_vap;
2598         struct ieee80211com *ic = ni->ni_ic;
2599         struct ifnet *ifp = ic->ic_ifp;
2600         struct run_node *rn = (void *)ni;
2601         union run_stats sta[2];
2602         uint16_t (*wstat)[3];
2603         int txcnt, success, retrycnt, error;
2604
2605         RUN_LOCK(sc);
2606
2607         /* Check for special case */
2608         if (sc->rvp_cnt <= 1 && vap->iv_opmode == IEEE80211_M_STA &&
2609             ni != vap->iv_bss)
2610                 goto fail;
2611
2612         if (sc->rvp_cnt <= 1 && (vap->iv_opmode == IEEE80211_M_IBSS ||
2613             vap->iv_opmode == IEEE80211_M_STA)) {
2614                 /* read statistic counters (clear on read) and update AMRR state */
2615                 error = run_read_region_1(sc, RT2860_TX_STA_CNT0, (uint8_t *)sta,
2616                     sizeof sta);
2617                 if (error != 0)
2618                         goto fail;
2619
2620                 /* count failed TX as errors */
2621                 ifp->if_oerrors += le16toh(sta[0].error.fail);
2622
2623                 retrycnt = le16toh(sta[1].tx.retry);
2624                 success = le16toh(sta[1].tx.success);
2625                 txcnt = retrycnt + success + le16toh(sta[0].error.fail);
2626
2627                 DPRINTFN(3, "retrycnt=%d success=%d failcnt=%d\n",
2628                         retrycnt, success, le16toh(sta[0].error.fail));
2629         } else {
2630                 wstat = &(sc->wcid_stats[RUN_AID2WCID(ni->ni_associd)]);
2631
2632                 if (wstat == &(sc->wcid_stats[0]) ||
2633                     wstat > &(sc->wcid_stats[RT2870_WCID_MAX]))
2634                         goto fail;
2635
2636                 txcnt = (*wstat)[RUN_TXCNT];
2637                 success = (*wstat)[RUN_SUCCESS];
2638                 retrycnt = (*wstat)[RUN_RETRY];
2639                 DPRINTFN(3, "retrycnt=%d txcnt=%d success=%d\n",
2640                     retrycnt, txcnt, success);
2641
2642                 memset(wstat, 0, sizeof(*wstat));
2643         }
2644
2645         ieee80211_ratectl_tx_update(vap, ni, &txcnt, &success, &retrycnt);
2646         rn->amrr_ridx = ieee80211_ratectl_rate(ni, NULL, 0);
2647
2648 fail:
2649         RUN_UNLOCK(sc);
2650
2651         DPRINTFN(3, "ridx=%d\n", rn->amrr_ridx);
2652 }
2653
2654 static void
2655 run_newassoc_cb(void *arg)
2656 {
2657         struct run_cmdq *cmdq = arg;
2658         struct ieee80211_node *ni = cmdq->arg1;
2659         struct run_softc *sc = ni->ni_vap->iv_ic->ic_ifp->if_softc;
2660         uint8_t wcid = cmdq->wcid;
2661
2662         RUN_LOCK_ASSERT(sc, MA_OWNED);
2663
2664         run_write_region_1(sc, RT2860_WCID_ENTRY(wcid),
2665             ni->ni_macaddr, IEEE80211_ADDR_LEN);
2666
2667         memset(&(sc->wcid_stats[wcid]), 0, sizeof(sc->wcid_stats[wcid]));
2668 }
2669
2670 static void
2671 run_newassoc(struct ieee80211_node *ni, int isnew)
2672 {
2673         struct run_node *rn = (void *)ni;
2674         struct ieee80211_rateset *rs = &ni->ni_rates;
2675         struct ieee80211vap *vap = ni->ni_vap;
2676         struct ieee80211com *ic = vap->iv_ic;
2677         struct run_softc *sc = ic->ic_ifp->if_softc;
2678         uint8_t rate;
2679         uint8_t ridx;
2680         uint8_t wcid;
2681         int i, j;
2682
2683         wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
2684             1 : RUN_AID2WCID(ni->ni_associd);
2685
2686         if (wcid > RT2870_WCID_MAX) {
2687                 device_printf(sc->sc_dev, "wcid=%d out of range\n", wcid);
2688                 return;
2689         }
2690
2691         /* only interested in true associations */
2692         if (isnew && ni->ni_associd != 0) {
2693
2694                 /*
2695                  * This function could is called though timeout function.
2696                  * Need to defer.
2697                  */
2698                 uint32_t cnt = RUN_CMDQ_GET(&sc->cmdq_store);
2699                 DPRINTF("cmdq_store=%d\n", cnt);
2700                 sc->cmdq[cnt].func = run_newassoc_cb;
2701                 sc->cmdq[cnt].arg0 = NULL;
2702                 sc->cmdq[cnt].arg1 = ni;
2703                 sc->cmdq[cnt].wcid = wcid;
2704                 ieee80211_runtask(ic, &sc->cmdq_task);
2705         }
2706
2707         DPRINTF("new assoc isnew=%d associd=%x addr=%s\n",
2708             isnew, ni->ni_associd, ether_sprintf(ni->ni_macaddr));
2709
2710         for (i = 0; i < rs->rs_nrates; i++) {
2711                 rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
2712                 /* convert 802.11 rate to hardware rate index */
2713                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2714                         if (rt2860_rates[ridx].rate == rate)
2715                                 break;
2716                 rn->ridx[i] = ridx;
2717                 /* determine rate of control response frames */
2718                 for (j = i; j >= 0; j--) {
2719                         if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
2720                             rt2860_rates[rn->ridx[i]].phy ==
2721                             rt2860_rates[rn->ridx[j]].phy)
2722                                 break;
2723                 }
2724                 if (j >= 0) {
2725                         rn->ctl_ridx[i] = rn->ridx[j];
2726                 } else {
2727                         /* no basic rate found, use mandatory one */
2728                         rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
2729                 }
2730                 DPRINTF("rate=0x%02x ridx=%d ctl_ridx=%d\n",
2731                     rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]);
2732         }
2733         rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
2734         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
2735                 if (rt2860_rates[ridx].rate == rate)
2736                         break;
2737         rn->mgt_ridx = ridx;
2738         DPRINTF("rate=%d, mgmt_ridx=%d\n", rate, rn->mgt_ridx);
2739
2740         RUN_LOCK(sc);
2741         if(sc->ratectl_run != RUN_RATECTL_OFF)
2742                 usb_callout_reset(&sc->ratectl_ch, hz, run_ratectl_to, sc);
2743         RUN_UNLOCK(sc);
2744 }
2745
2746 /*
2747  * Return the Rx chain with the highest RSSI for a given frame.
2748  */
2749 static __inline uint8_t
2750 run_maxrssi_chain(struct run_softc *sc, const struct rt2860_rxwi *rxwi)
2751 {
2752         uint8_t rxchain = 0;
2753
2754         if (sc->nrxchains > 1) {
2755                 if (rxwi->rssi[1] > rxwi->rssi[rxchain])
2756                         rxchain = 1;
2757                 if (sc->nrxchains > 2)
2758                         if (rxwi->rssi[2] > rxwi->rssi[rxchain])
2759                                 rxchain = 2;
2760         }
2761         return (rxchain);
2762 }
2763
2764 static void
2765 run_rx_frame(struct run_softc *sc, struct mbuf *m, uint32_t dmalen)
2766 {
2767         struct ifnet *ifp = sc->sc_ifp;
2768         struct ieee80211com *ic = ifp->if_l2com;
2769         struct ieee80211_frame *wh;
2770         struct ieee80211_node *ni;
2771         struct rt2870_rxd *rxd;
2772         struct rt2860_rxwi *rxwi;
2773         uint32_t flags;
2774         uint16_t len, rxwisize;
2775         uint8_t ant, rssi;
2776         int8_t nf;
2777
2778         rxwi = mtod(m, struct rt2860_rxwi *);
2779         len = le16toh(rxwi->len) & 0xfff;
2780         rxwisize = sizeof(struct rt2860_rxwi);
2781         if (sc->mac_ver == 0x5592)
2782                 rxwisize += sizeof(uint64_t);
2783         else if (sc->mac_ver == 0x3593)
2784                 rxwisize += sizeof(uint32_t);
2785         if (__predict_false(len > dmalen)) {
2786                 m_freem(m);
2787                 ifp->if_ierrors++;
2788                 DPRINTF("bad RXWI length %u > %u\n", len, dmalen);
2789                 return;
2790         }
2791         /* Rx descriptor is located at the end */
2792         rxd = (struct rt2870_rxd *)(mtod(m, caddr_t) + dmalen);
2793         flags = le32toh(rxd->flags);
2794
2795         if (__predict_false(flags & (RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
2796                 m_freem(m);
2797                 ifp->if_ierrors++;
2798                 DPRINTF("%s error.\n", (flags & RT2860_RX_CRCERR)?"CRC":"ICV");
2799                 return;
2800         }
2801
2802         m->m_data += rxwisize;
2803         m->m_pkthdr.len = m->m_len -= rxwisize;
2804
2805         wh = mtod(m, struct ieee80211_frame *);
2806
2807         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
2808                 wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
2809                 m->m_flags |= M_WEP;
2810         }
2811
2812         if (flags & RT2860_RX_L2PAD) {
2813                 DPRINTFN(8, "received RT2860_RX_L2PAD frame\n");
2814                 len += 2;
2815         }
2816
2817         ni = ieee80211_find_rxnode(ic,
2818             mtod(m, struct ieee80211_frame_min *));
2819
2820         if (__predict_false(flags & RT2860_RX_MICERR)) {
2821                 /* report MIC failures to net80211 for TKIP */
2822                 if (ni != NULL)
2823                         ieee80211_notify_michael_failure(ni->ni_vap, wh,
2824                             rxwi->keyidx);
2825                 m_freem(m);
2826                 ifp->if_ierrors++;
2827                 DPRINTF("MIC error. Someone is lying.\n");
2828                 return;
2829         }
2830
2831         ant = run_maxrssi_chain(sc, rxwi);
2832         rssi = rxwi->rssi[ant];
2833         nf = run_rssi2dbm(sc, rssi, ant);
2834
2835         m->m_pkthdr.rcvif = ifp;
2836         m->m_pkthdr.len = m->m_len = len;
2837
2838         if (ni != NULL) {
2839                 (void)ieee80211_input(ni, m, rssi, nf);
2840                 ieee80211_free_node(ni);
2841         } else {
2842                 (void)ieee80211_input_all(ic, m, rssi, nf);
2843         }
2844
2845         if (__predict_false(ieee80211_radiotap_active(ic))) {
2846                 struct run_rx_radiotap_header *tap = &sc->sc_rxtap;
2847                 uint16_t phy;
2848
2849                 tap->wr_flags = 0;
2850                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
2851                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
2852                 tap->wr_antsignal = rssi;
2853                 tap->wr_antenna = ant;
2854                 tap->wr_dbm_antsignal = run_rssi2dbm(sc, rssi, ant);
2855                 tap->wr_rate = 2;       /* in case it can't be found below */
2856                 phy = le16toh(rxwi->phy);
2857                 switch (phy & RT2860_PHY_MODE) {
2858                 case RT2860_PHY_CCK:
2859                         switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
2860                         case 0: tap->wr_rate =   2; break;
2861                         case 1: tap->wr_rate =   4; break;
2862                         case 2: tap->wr_rate =  11; break;
2863                         case 3: tap->wr_rate =  22; break;
2864                         }
2865                         if (phy & RT2860_PHY_SHPRE)
2866                                 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
2867                         break;
2868                 case RT2860_PHY_OFDM:
2869                         switch (phy & RT2860_PHY_MCS) {
2870                         case 0: tap->wr_rate =  12; break;
2871                         case 1: tap->wr_rate =  18; break;
2872                         case 2: tap->wr_rate =  24; break;
2873                         case 3: tap->wr_rate =  36; break;
2874                         case 4: tap->wr_rate =  48; break;
2875                         case 5: tap->wr_rate =  72; break;
2876                         case 6: tap->wr_rate =  96; break;
2877                         case 7: tap->wr_rate = 108; break;
2878                         }
2879                         break;
2880                 }
2881         }
2882 }
2883
2884 static void
2885 run_bulk_rx_callback(struct usb_xfer *xfer, usb_error_t error)
2886 {
2887         struct run_softc *sc = usbd_xfer_softc(xfer);
2888         struct ifnet *ifp = sc->sc_ifp;
2889         struct mbuf *m = NULL;
2890         struct mbuf *m0;
2891         uint32_t dmalen;
2892         uint16_t rxwisize;
2893         int xferlen;
2894
2895         rxwisize = sizeof(struct rt2860_rxwi);
2896         if (sc->mac_ver == 0x5592)
2897                 rxwisize += sizeof(uint64_t);
2898         else if (sc->mac_ver == 0x3593)
2899                 rxwisize += sizeof(uint32_t);
2900
2901         usbd_xfer_status(xfer, &xferlen, NULL, NULL, NULL);
2902
2903         switch (USB_GET_STATE(xfer)) {
2904         case USB_ST_TRANSFERRED:
2905
2906                 DPRINTFN(15, "rx done, actlen=%d\n", xferlen);
2907
2908                 if (xferlen < (int)(sizeof(uint32_t) + rxwisize +
2909                     sizeof(struct rt2870_rxd))) {
2910                         DPRINTF("xfer too short %d\n", xferlen);
2911                         goto tr_setup;
2912                 }
2913
2914                 m = sc->rx_m;
2915                 sc->rx_m = NULL;
2916
2917                 /* FALLTHROUGH */
2918         case USB_ST_SETUP:
2919 tr_setup:
2920                 if (sc->rx_m == NULL) {
2921                         sc->rx_m = m_getjcl(M_NOWAIT, MT_DATA, M_PKTHDR,
2922                             MJUMPAGESIZE /* xfer can be bigger than MCLBYTES */);
2923                 }
2924                 if (sc->rx_m == NULL) {
2925                         DPRINTF("could not allocate mbuf - idle with stall\n");
2926                         ifp->if_ierrors++;
2927                         usbd_xfer_set_stall(xfer);
2928                         usbd_xfer_set_frames(xfer, 0);
2929                 } else {
2930                         /*
2931                          * Directly loading a mbuf cluster into DMA to
2932                          * save some data copying. This works because
2933                          * there is only one cluster.
2934                          */
2935                         usbd_xfer_set_frame_data(xfer, 0,
2936                             mtod(sc->rx_m, caddr_t), RUN_MAX_RXSZ);
2937                         usbd_xfer_set_frames(xfer, 1);
2938                 }
2939                 usbd_transfer_submit(xfer);
2940                 break;
2941
2942         default:        /* Error */
2943                 if (error != USB_ERR_CANCELLED) {
2944                         /* try to clear stall first */
2945                         usbd_xfer_set_stall(xfer);
2946
2947                         if (error == USB_ERR_TIMEOUT)
2948                                 device_printf(sc->sc_dev, "device timeout\n");
2949
2950                         ifp->if_ierrors++;
2951
2952                         goto tr_setup;
2953                 }
2954                 if (sc->rx_m != NULL) {
2955                         m_freem(sc->rx_m);
2956                         sc->rx_m = NULL;
2957                 }
2958                 break;
2959         }
2960
2961         if (m == NULL)
2962                 return;
2963
2964         /* inputting all the frames must be last */
2965
2966         RUN_UNLOCK(sc);
2967
2968         m->m_pkthdr.len = m->m_len = xferlen;
2969
2970         /* HW can aggregate multiple 802.11 frames in a single USB xfer */
2971         for(;;) {
2972                 dmalen = le32toh(*mtod(m, uint32_t *)) & 0xffff;
2973
2974                 if ((dmalen >= (uint32_t)-8) || (dmalen == 0) ||
2975                     ((dmalen & 3) != 0)) {
2976                         DPRINTF("bad DMA length %u\n", dmalen);
2977                         break;
2978                 }
2979                 if ((dmalen + 8) > (uint32_t)xferlen) {
2980                         DPRINTF("bad DMA length %u > %d\n",
2981                         dmalen + 8, xferlen);
2982                         break;
2983                 }
2984
2985                 /* If it is the last one or a single frame, we won't copy. */
2986                 if ((xferlen -= dmalen + 8) <= 8) {
2987                         /* trim 32-bit DMA-len header */
2988                         m->m_data += 4;
2989                         m->m_pkthdr.len = m->m_len -= 4;
2990                         run_rx_frame(sc, m, dmalen);
2991                         m = NULL;       /* don't free source buffer */
2992                         break;
2993                 }
2994
2995                 /* copy aggregated frames to another mbuf */
2996                 m0 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
2997                 if (__predict_false(m0 == NULL)) {
2998                         DPRINTF("could not allocate mbuf\n");
2999                         ifp->if_ierrors++;
3000                         break;
3001                 }
3002                 m_copydata(m, 4 /* skip 32-bit DMA-len header */,
3003                     dmalen + sizeof(struct rt2870_rxd), mtod(m0, caddr_t));
3004                 m0->m_pkthdr.len = m0->m_len =
3005                     dmalen + sizeof(struct rt2870_rxd);
3006                 run_rx_frame(sc, m0, dmalen);
3007
3008                 /* update data ptr */
3009                 m->m_data += dmalen + 8;
3010                 m->m_pkthdr.len = m->m_len -= dmalen + 8;
3011         }
3012
3013         /* make sure we free the source buffer, if any */
3014         m_freem(m);
3015
3016         RUN_LOCK(sc);
3017 }
3018
3019 static void
3020 run_tx_free(struct run_endpoint_queue *pq,
3021     struct run_tx_data *data, int txerr)
3022 {
3023         if (data->m != NULL) {
3024                 if (data->m->m_flags & M_TXCB)
3025                         ieee80211_process_callback(data->ni, data->m,
3026                             txerr ? ETIMEDOUT : 0);
3027                 m_freem(data->m);
3028                 data->m = NULL;
3029
3030                 if (data->ni == NULL) {
3031                         DPRINTF("no node\n");
3032                 } else {
3033                         ieee80211_free_node(data->ni);
3034                         data->ni = NULL;
3035                 }
3036         }
3037
3038         STAILQ_INSERT_TAIL(&pq->tx_fh, data, next);
3039         pq->tx_nfree++;
3040 }
3041
3042 static void
3043 run_bulk_tx_callbackN(struct usb_xfer *xfer, usb_error_t error, u_int index)
3044 {
3045         struct run_softc *sc = usbd_xfer_softc(xfer);
3046         struct ifnet *ifp = sc->sc_ifp;
3047         struct ieee80211com *ic = ifp->if_l2com;
3048         struct run_tx_data *data;
3049         struct ieee80211vap *vap = NULL;
3050         struct usb_page_cache *pc;
3051         struct run_endpoint_queue *pq = &sc->sc_epq[index];
3052         struct mbuf *m;
3053         usb_frlength_t size;
3054         int actlen;
3055         int sumlen;
3056
3057         usbd_xfer_status(xfer, &actlen, &sumlen, NULL, NULL);
3058
3059         switch (USB_GET_STATE(xfer)) {
3060         case USB_ST_TRANSFERRED:
3061                 DPRINTFN(11, "transfer complete: %d "
3062                     "bytes @ index %d\n", actlen, index);
3063
3064                 data = usbd_xfer_get_priv(xfer);
3065
3066                 run_tx_free(pq, data, 0);
3067                 ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
3068
3069                 usbd_xfer_set_priv(xfer, NULL);
3070
3071                 ifp->if_opackets++;
3072
3073                 /* FALLTHROUGH */
3074         case USB_ST_SETUP:
3075 tr_setup:
3076                 data = STAILQ_FIRST(&pq->tx_qh);
3077                 if (data == NULL)
3078                         break;
3079
3080                 STAILQ_REMOVE_HEAD(&pq->tx_qh, next);
3081
3082                 m = data->m;
3083                 size = (sc->mac_ver == 0x5592) ?
3084                     sizeof(data->desc) + sizeof(uint32_t) : sizeof(data->desc);
3085                 if ((m->m_pkthdr.len +
3086                     size + 3 + 8) > RUN_MAX_TXSZ) {
3087                         DPRINTF("data overflow, %u bytes\n",
3088                             m->m_pkthdr.len);
3089
3090                         ifp->if_oerrors++;
3091
3092                         run_tx_free(pq, data, 1);
3093
3094                         goto tr_setup;
3095                 }
3096
3097                 pc = usbd_xfer_get_frame(xfer, 0);
3098                 usbd_copy_in(pc, 0, &data->desc, size);
3099                 usbd_m_copy_in(pc, size, m, 0, m->m_pkthdr.len);
3100                 size += m->m_pkthdr.len;
3101                 /*
3102                  * Align end on a 4-byte boundary, pad 8 bytes (CRC +
3103                  * 4-byte padding), and be sure to zero those trailing
3104                  * bytes:
3105                  */
3106                 usbd_frame_zero(pc, size, ((-size) & 3) + 8);
3107                 size += ((-size) & 3) + 8;
3108
3109                 vap = data->ni->ni_vap;
3110                 if (ieee80211_radiotap_active_vap(vap)) {
3111                         struct run_tx_radiotap_header *tap = &sc->sc_txtap;
3112                         struct rt2860_txwi *txwi =
3113                             (struct rt2860_txwi *)(&data->desc + sizeof(struct rt2870_txd));
3114                         tap->wt_flags = 0;
3115                         tap->wt_rate = rt2860_rates[data->ridx].rate;
3116                         tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
3117                         tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
3118                         tap->wt_hwqueue = index;
3119                         if (le16toh(txwi->phy) & RT2860_PHY_SHPRE)
3120                                 tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
3121
3122                         ieee80211_radiotap_tx(vap, m);
3123                 }
3124
3125                 DPRINTFN(11, "sending frame len=%u/%u  @ index %d\n",
3126                     m->m_pkthdr.len, size, index);
3127
3128                 usbd_xfer_set_frame_len(xfer, 0, size);
3129                 usbd_xfer_set_priv(xfer, data);
3130
3131                 usbd_transfer_submit(xfer);
3132
3133                 RUN_UNLOCK(sc);
3134                 run_start(ifp);
3135                 RUN_LOCK(sc);
3136
3137                 break;
3138
3139         default:
3140                 DPRINTF("USB transfer error, %s\n",
3141                     usbd_errstr(error));
3142
3143                 data = usbd_xfer_get_priv(xfer);
3144
3145                 ifp->if_oerrors++;
3146
3147                 if (data != NULL) {
3148                         if(data->ni != NULL)
3149                                 vap = data->ni->ni_vap;
3150                         run_tx_free(pq, data, error);
3151                         usbd_xfer_set_priv(xfer, NULL);
3152                 }
3153                 if (vap == NULL)
3154                         vap = TAILQ_FIRST(&ic->ic_vaps);
3155
3156                 if (error != USB_ERR_CANCELLED) {
3157                         if (error == USB_ERR_TIMEOUT) {
3158                                 device_printf(sc->sc_dev, "device timeout\n");
3159                                 uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
3160                                 DPRINTF("cmdq_store=%d\n", i);
3161                                 sc->cmdq[i].func = run_usb_timeout_cb;
3162                                 sc->cmdq[i].arg0 = vap;
3163                                 ieee80211_runtask(ic, &sc->cmdq_task);
3164                         }
3165
3166                         /*
3167                          * Try to clear stall first, also if other
3168                          * errors occur, hence clearing stall
3169                          * introduces a 50 ms delay:
3170                          */
3171                         usbd_xfer_set_stall(xfer);
3172                         goto tr_setup;
3173                 }
3174                 break;
3175         }
3176 }
3177
3178 static void
3179 run_bulk_tx_callback0(struct usb_xfer *xfer, usb_error_t error)
3180 {
3181         run_bulk_tx_callbackN(xfer, error, 0);
3182 }
3183
3184 static void
3185 run_bulk_tx_callback1(struct usb_xfer *xfer, usb_error_t error)
3186 {
3187         run_bulk_tx_callbackN(xfer, error, 1);
3188 }
3189
3190 static void
3191 run_bulk_tx_callback2(struct usb_xfer *xfer, usb_error_t error)
3192 {
3193         run_bulk_tx_callbackN(xfer, error, 2);
3194 }
3195
3196 static void
3197 run_bulk_tx_callback3(struct usb_xfer *xfer, usb_error_t error)
3198 {
3199         run_bulk_tx_callbackN(xfer, error, 3);
3200 }
3201
3202 static void
3203 run_bulk_tx_callback4(struct usb_xfer *xfer, usb_error_t error)
3204 {
3205         run_bulk_tx_callbackN(xfer, error, 4);
3206 }
3207
3208 static void
3209 run_bulk_tx_callback5(struct usb_xfer *xfer, usb_error_t error)
3210 {
3211         run_bulk_tx_callbackN(xfer, error, 5);
3212 }
3213
3214 static void
3215 run_set_tx_desc(struct run_softc *sc, struct run_tx_data *data)
3216 {
3217         struct mbuf *m = data->m;
3218         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3219         struct ieee80211vap *vap = data->ni->ni_vap;
3220         struct ieee80211_frame *wh;
3221         struct rt2870_txd *txd;
3222         struct rt2860_txwi *txwi;
3223         uint16_t xferlen, txwisize;
3224         uint16_t mcs;
3225         uint8_t ridx = data->ridx;
3226         uint8_t pad;
3227
3228         /* get MCS code from rate index */
3229         mcs = rt2860_rates[ridx].mcs;
3230
3231         txwisize = (sc->mac_ver == 0x5592) ?
3232             sizeof(*txwi) + sizeof(uint32_t) : sizeof(*txwi);
3233         xferlen = txwisize + m->m_pkthdr.len;
3234
3235         /* roundup to 32-bit alignment */
3236         xferlen = (xferlen + 3) & ~3;
3237
3238         txd = (struct rt2870_txd *)&data->desc;
3239         txd->len = htole16(xferlen);
3240
3241         wh = mtod(m, struct ieee80211_frame *);
3242
3243         /*
3244          * Ether both are true or both are false, the header
3245          * are nicely aligned to 32-bit. So, no L2 padding.
3246          */
3247         if(IEEE80211_HAS_ADDR4(wh) == IEEE80211_QOS_HAS_SEQ(wh))
3248                 pad = 0;
3249         else
3250                 pad = 2;
3251
3252         /* setup TX Wireless Information */
3253         txwi = (struct rt2860_txwi *)(txd + 1);
3254         txwi->len = htole16(m->m_pkthdr.len - pad);
3255         if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
3256                 mcs |= RT2860_PHY_CCK;
3257                 if (ridx != RT2860_RIDX_CCK1 &&
3258                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
3259                         mcs |= RT2860_PHY_SHPRE;
3260         } else
3261                 mcs |= RT2860_PHY_OFDM;
3262         txwi->phy = htole16(mcs);
3263
3264         /* check if RTS/CTS or CTS-to-self protection is required */
3265         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3266             (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
3267              ((ic->ic_flags & IEEE80211_F_USEPROT) &&
3268               rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
3269                 txwi->txop |= RT2860_TX_TXOP_HT;
3270         else
3271                 txwi->txop |= RT2860_TX_TXOP_BACKOFF;
3272
3273         if (vap->iv_opmode != IEEE80211_M_STA && !IEEE80211_QOS_HAS_SEQ(wh))
3274                 txwi->xflags |= RT2860_TX_NSEQ;
3275 }
3276
3277 /* This function must be called locked */
3278 static int
3279 run_tx(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
3280 {
3281         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3282         struct ieee80211vap *vap = ni->ni_vap;
3283         struct ieee80211_frame *wh;
3284         struct ieee80211_channel *chan;
3285         const struct ieee80211_txparam *tp;
3286         struct run_node *rn = (void *)ni;
3287         struct run_tx_data *data;
3288         struct rt2870_txd *txd;
3289         struct rt2860_txwi *txwi;
3290         uint16_t qos;
3291         uint16_t dur;
3292         uint16_t qid;
3293         uint8_t type;
3294         uint8_t tid;
3295         uint8_t ridx;
3296         uint8_t ctl_ridx;
3297         uint8_t qflags;
3298         uint8_t xflags = 0;
3299         int hasqos;
3300
3301         RUN_LOCK_ASSERT(sc, MA_OWNED);
3302
3303         wh = mtod(m, struct ieee80211_frame *);
3304
3305         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3306
3307         /*
3308          * There are 7 bulk endpoints: 1 for RX
3309          * and 6 for TX (4 EDCAs + HCCA + Prio).
3310          * Update 03-14-2009:  some devices like the Planex GW-US300MiniS
3311          * seem to have only 4 TX bulk endpoints (Fukaumi Naoki).
3312          */
3313         if ((hasqos = IEEE80211_QOS_HAS_SEQ(wh))) {
3314                 uint8_t *frm;
3315
3316                 if(IEEE80211_HAS_ADDR4(wh))
3317                         frm = ((struct ieee80211_qosframe_addr4 *)wh)->i_qos;
3318                 else
3319                         frm =((struct ieee80211_qosframe *)wh)->i_qos;
3320
3321                 qos = le16toh(*(const uint16_t *)frm);
3322                 tid = qos & IEEE80211_QOS_TID;
3323                 qid = TID_TO_WME_AC(tid);
3324         } else {
3325                 qos = 0;
3326                 tid = 0;
3327                 qid = WME_AC_BE;
3328         }
3329         qflags = (qid < 4) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_HCCA;
3330
3331         DPRINTFN(8, "qos %d\tqid %d\ttid %d\tqflags %x\n",
3332             qos, qid, tid, qflags);
3333
3334         chan = (ni->ni_chan != IEEE80211_CHAN_ANYC)?ni->ni_chan:ic->ic_curchan;
3335         tp = &vap->iv_txparms[ieee80211_chan2mode(chan)];
3336
3337         /* pickup a rate index */
3338         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
3339             type != IEEE80211_FC0_TYPE_DATA || m->m_flags & M_EAPOL) {
3340                 ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
3341                     RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
3342                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
3343         } else {
3344                 if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE)
3345                         ridx = rn->fix_ridx;
3346                 else
3347                         ridx = rn->amrr_ridx;
3348                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
3349         }
3350
3351         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
3352             (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
3353              IEEE80211_QOS_ACKPOLICY_NOACK)) {
3354                 xflags |= RT2860_TX_ACK;
3355                 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
3356                         dur = rt2860_rates[ctl_ridx].sp_ack_dur;
3357                 else
3358                         dur = rt2860_rates[ctl_ridx].lp_ack_dur;
3359                 USETW(wh->i_dur, dur);
3360         }
3361
3362         /* reserve slots for mgmt packets, just in case */
3363         if (sc->sc_epq[qid].tx_nfree < 3) {
3364                 DPRINTFN(10, "tx ring %d is full\n", qid);
3365                 return (-1);
3366         }
3367
3368         data = STAILQ_FIRST(&sc->sc_epq[qid].tx_fh);
3369         STAILQ_REMOVE_HEAD(&sc->sc_epq[qid].tx_fh, next);
3370         sc->sc_epq[qid].tx_nfree--;
3371
3372         txd = (struct rt2870_txd *)&data->desc;
3373         txd->flags = qflags;
3374         txwi = (struct rt2860_txwi *)(txd + 1);
3375         txwi->xflags = xflags;
3376         if (IEEE80211_IS_MULTICAST(wh->i_addr1))
3377                 txwi->wcid = 0;
3378         else
3379                 txwi->wcid = (vap->iv_opmode == IEEE80211_M_STA) ?
3380                     1 : RUN_AID2WCID(ni->ni_associd);
3381
3382         /* clear leftover garbage bits */
3383         txwi->flags = 0;
3384         txwi->txop = 0;
3385
3386         data->m = m;
3387         data->ni = ni;
3388         data->ridx = ridx;
3389
3390         run_set_tx_desc(sc, data);
3391
3392         /*
3393          * The chip keeps track of 2 kind of Tx stats,
3394          *  * TX_STAT_FIFO, for per WCID stats, and
3395          *  * TX_STA_CNT0 for all-TX-in-one stats.
3396          *
3397          * To use FIFO stats, we need to store MCS into the driver-private
3398          * PacketID field. So that, we can tell whose stats when we read them.
3399          * We add 1 to the MCS because setting the PacketID field to 0 means
3400          * that we don't want feedback in TX_STAT_FIFO.
3401          * And, that's what we want for STA mode, since TX_STA_CNT0 does the job.
3402          *
3403          * FIFO stats doesn't count Tx with WCID 0xff, so we do this in run_tx().
3404          */
3405         if (sc->rvp_cnt > 1 || vap->iv_opmode == IEEE80211_M_HOSTAP ||
3406             vap->iv_opmode == IEEE80211_M_MBSS) {
3407                 uint16_t pid = (rt2860_rates[ridx].mcs + 1) & 0xf;
3408                 txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
3409
3410                 /*
3411                  * Unlike PCI based devices, we don't get any interrupt from
3412                  * USB devices, so we simulate FIFO-is-full interrupt here.
3413                  * Ralink recomends to drain FIFO stats every 100 ms, but 16 slots
3414                  * quickly get fulled. To prevent overflow, increment a counter on
3415                  * every FIFO stat request, so we know how many slots are left.
3416                  * We do this only in HOSTAP or multiple vap mode since FIFO stats
3417                  * are used only in those modes.
3418                  * We just drain stats. AMRR gets updated every 1 sec by
3419                  * run_ratectl_cb() via callout.
3420                  * Call it early. Otherwise overflow.
3421                  */
3422                 if (sc->fifo_cnt++ == 10) {
3423                         /*
3424                          * With multiple vaps or if_bridge, if_start() is called
3425                          * with a non-sleepable lock, tcpinp. So, need to defer.
3426                          */
3427                         uint32_t i = RUN_CMDQ_GET(&sc->cmdq_store);
3428                         DPRINTFN(6, "cmdq_store=%d\n", i);
3429                         sc->cmdq[i].func = run_drain_fifo;
3430                         sc->cmdq[i].arg0 = sc;
3431                         ieee80211_runtask(ic, &sc->cmdq_task);
3432                 }
3433         }
3434
3435         STAILQ_INSERT_TAIL(&sc->sc_epq[qid].tx_qh, data, next);
3436
3437         usbd_transfer_start(sc->sc_xfer[qid]);
3438
3439         DPRINTFN(8, "sending data frame len=%d rate=%d qid=%d\n",
3440             m->m_pkthdr.len + (int)(sizeof(struct rt2870_txd) +
3441             sizeof(struct rt2860_txwi)), rt2860_rates[ridx].rate, qid);
3442
3443         return (0);
3444 }
3445
3446 static int
3447 run_tx_mgt(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
3448 {
3449         struct ifnet *ifp = sc->sc_ifp;
3450         struct ieee80211com *ic = ifp->if_l2com;
3451         struct run_node *rn = (void *)ni;
3452         struct run_tx_data *data;
3453         struct ieee80211_frame *wh;
3454         struct rt2870_txd *txd;
3455         struct rt2860_txwi *txwi;
3456         uint16_t dur;
3457         uint8_t ridx = rn->mgt_ridx;
3458         uint8_t type;
3459         uint8_t xflags = 0;
3460         uint8_t wflags = 0;
3461
3462         RUN_LOCK_ASSERT(sc, MA_OWNED);
3463
3464         wh = mtod(m, struct ieee80211_frame *);
3465
3466         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3467
3468         /* tell hardware to add timestamp for probe responses */
3469         if ((wh->i_fc[0] &
3470             (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
3471             (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
3472                 wflags |= RT2860_TX_TS;
3473         else if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
3474                 xflags |= RT2860_TX_ACK;
3475
3476                 dur = ieee80211_ack_duration(ic->ic_rt, rt2860_rates[ridx].rate,
3477                     ic->ic_flags & IEEE80211_F_SHPREAMBLE);
3478                 USETW(wh->i_dur, dur);
3479         }
3480
3481         if (sc->sc_epq[0].tx_nfree == 0) {
3482                 /* let caller free mbuf */
3483                 ifp->if_drv_flags |= IFF_DRV_OACTIVE;
3484                 return (EIO);
3485         }
3486         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3487         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3488         sc->sc_epq[0].tx_nfree--;
3489
3490         txd = (struct rt2870_txd *)&data->desc;
3491         txd->flags = RT2860_TX_QSEL_EDCA;
3492         txwi = (struct rt2860_txwi *)(txd + 1);
3493         txwi->wcid = 0xff;
3494         txwi->flags = wflags;
3495         txwi->xflags = xflags;
3496         txwi->txop = 0; /* clear leftover garbage bits */
3497
3498         data->m = m;
3499         data->ni = ni;
3500         data->ridx = ridx;
3501
3502         run_set_tx_desc(sc, data);
3503
3504         DPRINTFN(10, "sending mgt frame len=%d rate=%d\n", m->m_pkthdr.len +
3505             (int)(sizeof(struct rt2870_txd) + sizeof(struct rt2860_txwi)),
3506             rt2860_rates[ridx].rate);
3507
3508         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3509
3510         usbd_transfer_start(sc->sc_xfer[0]);
3511
3512         return (0);
3513 }
3514
3515 static int
3516 run_sendprot(struct run_softc *sc,
3517     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
3518 {
3519         struct ieee80211com *ic = ni->ni_ic;
3520         struct ieee80211_frame *wh;
3521         struct run_tx_data *data;
3522         struct rt2870_txd *txd;
3523         struct rt2860_txwi *txwi;
3524         struct mbuf *mprot;
3525         int ridx;
3526         int protrate;
3527         int ackrate;
3528         int pktlen;
3529         int isshort;
3530         uint16_t dur;
3531         uint8_t type;
3532         uint8_t wflags = 0;
3533         uint8_t xflags = 0;
3534
3535         RUN_LOCK_ASSERT(sc, MA_OWNED);
3536
3537         KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
3538             ("protection %d", prot));
3539
3540         wh = mtod(m, struct ieee80211_frame *);
3541         pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
3542         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3543
3544         protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
3545         ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
3546
3547         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
3548         dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort)
3549             + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
3550         wflags = RT2860_TX_FRAG;
3551
3552         /* check that there are free slots before allocating the mbuf */
3553         if (sc->sc_epq[0].tx_nfree == 0) {
3554                 /* let caller free mbuf */
3555                 sc->sc_ifp->if_drv_flags |= IFF_DRV_OACTIVE;
3556                 return (ENOBUFS);
3557         }
3558
3559         if (prot == IEEE80211_PROT_RTSCTS) {
3560                 /* NB: CTS is the same size as an ACK */
3561                 dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
3562                 xflags |= RT2860_TX_ACK;
3563                 mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
3564         } else {
3565                 mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
3566         }
3567         if (mprot == NULL) {
3568                 sc->sc_ifp->if_oerrors++;
3569                 DPRINTF("could not allocate mbuf\n");
3570                 return (ENOBUFS);
3571         }
3572
3573         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3574         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3575         sc->sc_epq[0].tx_nfree--;
3576
3577         txd = (struct rt2870_txd *)&data->desc;
3578         txd->flags = RT2860_TX_QSEL_EDCA;
3579         txwi = (struct rt2860_txwi *)(txd + 1);
3580         txwi->wcid = 0xff;
3581         txwi->flags = wflags;
3582         txwi->xflags = xflags;
3583         txwi->txop = 0; /* clear leftover garbage bits */
3584
3585         data->m = mprot;
3586         data->ni = ieee80211_ref_node(ni);
3587
3588         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
3589                 if (rt2860_rates[ridx].rate == protrate)
3590                         break;
3591         data->ridx = ridx;
3592
3593         run_set_tx_desc(sc, data);
3594
3595         DPRINTFN(1, "sending prot len=%u rate=%u\n",
3596             m->m_pkthdr.len, rate);
3597
3598         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3599
3600         usbd_transfer_start(sc->sc_xfer[0]);
3601
3602         return (0);
3603 }
3604
3605 static int
3606 run_tx_param(struct run_softc *sc, struct mbuf *m, struct ieee80211_node *ni,
3607     const struct ieee80211_bpf_params *params)
3608 {
3609         struct ieee80211com *ic = ni->ni_ic;
3610         struct ieee80211_frame *wh;
3611         struct run_tx_data *data;
3612         struct rt2870_txd *txd;
3613         struct rt2860_txwi *txwi;
3614         uint8_t type;
3615         uint8_t ridx;
3616         uint8_t rate;
3617         uint8_t opflags = 0;
3618         uint8_t xflags = 0;
3619         int error;
3620
3621         RUN_LOCK_ASSERT(sc, MA_OWNED);
3622
3623         KASSERT(params != NULL, ("no raw xmit params"));
3624
3625         wh = mtod(m, struct ieee80211_frame *);
3626         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
3627
3628         rate = params->ibp_rate0;
3629         if (!ieee80211_isratevalid(ic->ic_rt, rate)) {
3630                 /* let caller free mbuf */
3631                 return (EINVAL);
3632         }
3633
3634         if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0)
3635                 xflags |= RT2860_TX_ACK;
3636         if (params->ibp_flags & (IEEE80211_BPF_RTS|IEEE80211_BPF_CTS)) {
3637                 error = run_sendprot(sc, m, ni,
3638                     params->ibp_flags & IEEE80211_BPF_RTS ?
3639                         IEEE80211_PROT_RTSCTS : IEEE80211_PROT_CTSONLY,
3640                     rate);
3641                 if (error) {
3642                         /* let caller free mbuf */
3643                         return error;
3644                 }
3645                 opflags |= /*XXX RT2573_TX_LONG_RETRY |*/ RT2860_TX_TXOP_SIFS;
3646         }
3647
3648         if (sc->sc_epq[0].tx_nfree == 0) {
3649                 /* let caller free mbuf */
3650                 sc->sc_ifp->if_drv_flags |= IFF_DRV_OACTIVE;
3651                 DPRINTF("sending raw frame, but tx ring is full\n");
3652                 return (EIO);
3653         }
3654         data = STAILQ_FIRST(&sc->sc_epq[0].tx_fh);
3655         STAILQ_REMOVE_HEAD(&sc->sc_epq[0].tx_fh, next);
3656         sc->sc_epq[0].tx_nfree--;
3657
3658         txd = (struct rt2870_txd *)&data->desc;
3659         txd->flags = RT2860_TX_QSEL_EDCA;
3660         txwi = (struct rt2860_txwi *)(txd + 1);
3661         txwi->wcid = 0xff;
3662         txwi->xflags = xflags;
3663         txwi->txop = opflags;
3664         txwi->flags = 0;        /* clear leftover garbage bits */
3665
3666         data->m = m;
3667         data->ni = ni;
3668         for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
3669                 if (rt2860_rates[ridx].rate == rate)
3670                         break;
3671         data->ridx = ridx;
3672
3673         run_set_tx_desc(sc, data);
3674
3675         DPRINTFN(10, "sending raw frame len=%u rate=%u\n",
3676             m->m_pkthdr.len, rate);
3677
3678         STAILQ_INSERT_TAIL(&sc->sc_epq[0].tx_qh, data, next);
3679
3680         usbd_transfer_start(sc->sc_xfer[0]);
3681
3682         return (0);
3683 }
3684
3685 static int
3686 run_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
3687     const struct ieee80211_bpf_params *params)
3688 {
3689         struct ifnet *ifp = ni->ni_ic->ic_ifp;
3690         struct run_softc *sc = ifp->if_softc;
3691         int error = 0;
3692
3693         RUN_LOCK(sc);
3694
3695         /* prevent management frames from being sent if we're not ready */
3696         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
3697                 error =  ENETDOWN;
3698                 goto done;
3699         }
3700
3701         if (params == NULL) {
3702                 /* tx mgt packet */
3703                 if ((error = run_tx_mgt(sc, m, ni)) != 0) {
3704                         ifp->if_oerrors++;
3705                         DPRINTF("mgt tx failed\n");
3706                         goto done;
3707                 }
3708         } else {
3709                 /* tx raw packet with param */
3710                 if ((error = run_tx_param(sc, m, ni, params)) != 0) {
3711                         ifp->if_oerrors++;
3712                         DPRINTF("tx with param failed\n");
3713                         goto done;
3714                 }
3715         }
3716
3717         ifp->if_opackets++;
3718
3719 done:
3720         RUN_UNLOCK(sc);
3721
3722         if (error != 0) {
3723                 if(m != NULL)
3724                         m_freem(m);
3725                 ieee80211_free_node(ni);
3726         }
3727
3728         return (error);
3729 }
3730
3731 static void
3732 run_start(struct ifnet *ifp)
3733 {
3734         struct run_softc *sc = ifp->if_softc;
3735         struct ieee80211_node *ni;
3736         struct mbuf *m;
3737
3738         RUN_LOCK(sc);
3739
3740         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
3741                 RUN_UNLOCK(sc);
3742                 return;
3743         }
3744
3745         for (;;) {
3746                 /* send data frames */
3747                 IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
3748                 if (m == NULL)
3749                         break;
3750
3751                 ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
3752                 if (run_tx(sc, m, ni) != 0) {
3753                         IFQ_DRV_PREPEND(&ifp->if_snd, m);
3754                         ifp->if_drv_flags |= IFF_DRV_OACTIVE;
3755                         break;
3756                 }
3757         }
3758
3759         RUN_UNLOCK(sc);
3760 }
3761
3762 static int
3763 run_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
3764 {
3765         struct run_softc *sc = ifp->if_softc;
3766         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
3767         struct ifreq *ifr = (struct ifreq *) data;
3768         int startall = 0;
3769         int error;
3770
3771         RUN_LOCK(sc);
3772         error = sc->sc_detached ? ENXIO : 0;
3773         RUN_UNLOCK(sc);
3774         if (error)
3775                 return (error);
3776
3777         switch (cmd) {
3778         case SIOCSIFFLAGS:
3779                 RUN_LOCK(sc);
3780                 if (ifp->if_flags & IFF_UP) {
3781                         if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)){
3782                                 startall = 1;
3783                                 run_init_locked(sc);
3784                         } else
3785                                 run_update_promisc_locked(ifp);
3786                 } else {
3787                         if (ifp->if_drv_flags & IFF_DRV_RUNNING &&
3788                             (ic->ic_nrunning == 0 || sc->rvp_cnt <= 1)) {
3789                                         run_stop(sc);
3790                         }
3791                 }
3792                 RUN_UNLOCK(sc);
3793                 if (startall)
3794                         ieee80211_start_all(ic);
3795                 break;
3796         case SIOCGIFMEDIA:
3797                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
3798                 break;
3799         case SIOCGIFADDR:
3800                 error = ether_ioctl(ifp, cmd, data);
3801                 break;
3802         default:
3803                 error = EINVAL;
3804                 break;
3805         }
3806
3807         return (error);
3808 }
3809
3810 static void
3811 run_iq_calib(struct run_softc *sc, u_int chan)
3812 {
3813         uint16_t val;
3814
3815         /* Tx0 IQ gain. */
3816         run_bbp_write(sc, 158, 0x2c);
3817         if (chan <= 14)
3818                 run_efuse_read(sc, RT5390_EEPROM_IQ_GAIN_CAL_TX0_2GHZ, &val, 1);
3819         else if (chan <= 64) {
3820                 run_efuse_read(sc,
3821                     RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH36_TO_CH64_5GHZ,
3822                     &val, 1);
3823         } else if (chan <= 138) {
3824                 run_efuse_read(sc,
3825                     RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH100_TO_CH138_5GHZ,
3826                     &val, 1);
3827         } else if (chan <= 165) {
3828                 run_efuse_read(sc,
3829             RT5390_EEPROM_IQ_GAIN_CAL_TX0_CH140_TO_CH165_5GHZ,
3830                     &val, 1);
3831         } else
3832                 val = 0;
3833         run_bbp_write(sc, 159, val);
3834
3835         /* Tx0 IQ phase. */
3836         run_bbp_write(sc, 158, 0x2d);
3837         if (chan <= 14) {
3838                 run_efuse_read(sc, RT5390_EEPROM_IQ_PHASE_CAL_TX0_2GHZ,
3839                     &val, 1);
3840         } else if (chan <= 64) {
3841                 run_efuse_read(sc,
3842                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH36_TO_CH64_5GHZ,
3843                     &val, 1);
3844         } else if (chan <= 138) {
3845                 run_efuse_read(sc,
3846                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH100_TO_CH138_5GHZ,
3847                     &val, 1);
3848         } else if (chan <= 165) {
3849                 run_efuse_read(sc,
3850                     RT5390_EEPROM_IQ_PHASE_CAL_TX0_CH140_TO_CH165_5GHZ,
3851                     &val, 1);
3852         } else
3853                 val = 0;
3854         run_bbp_write(sc, 159, val);
3855
3856         /* Tx1 IQ gain. */
3857         run_bbp_write(sc, 158, 0x4a);
3858         if (chan <= 14) {
3859                 run_efuse_read(sc, RT5390_EEPROM_IQ_GAIN_CAL_TX1_2GHZ,
3860                     &val, 1);
3861         } else if (chan <= 64) {
3862                 run_efuse_read(sc,
3863                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH36_TO_CH64_5GHZ,
3864                     &val, 1);
3865         } else if (chan <= 138) {
3866                 run_efuse_read(sc,
3867                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH100_TO_CH138_5GHZ,
3868                     &val, 1);
3869         } else if (chan <= 165) {
3870                 run_efuse_read(sc,
3871                     RT5390_EEPROM_IQ_GAIN_CAL_TX1_CH140_TO_CH165_5GHZ,
3872                     &val, 1);
3873         } else
3874                 val = 0;
3875         run_bbp_write(sc, 159, val);
3876
3877         /* Tx1 IQ phase. */
3878         run_bbp_write(sc, 158, 0x4b);
3879         if (chan <= 14) {
3880                 run_efuse_read(sc, RT5390_EEPROM_IQ_PHASE_CAL_TX1_2GHZ,
3881                     &val, 1);
3882         } else if (chan <= 64) {
3883                 run_efuse_read(sc,
3884                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH36_TO_CH64_5GHZ,
3885                     &val, 1);
3886         } else if (chan <= 138) {
3887                 run_efuse_read(sc,
3888                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH100_TO_CH138_5GHZ,
3889                     &val, 1);
3890         } else if (chan <= 165) {
3891                 run_efuse_read(sc,
3892                     RT5390_EEPROM_IQ_PHASE_CAL_TX1_CH140_TO_CH165_5GHZ,
3893                     &val, 1);
3894         } else
3895                 val = 0;
3896         run_bbp_write(sc, 159, val);
3897
3898         /* RF IQ compensation control. */
3899         run_bbp_write(sc, 158, 0x04);
3900         run_efuse_read(sc, RT5390_EEPROM_RF_IQ_COMPENSATION_CTL,
3901             &val, 1);
3902         run_bbp_write(sc, 159, val);
3903
3904         /* RF IQ imbalance compensation control. */
3905         run_bbp_write(sc, 158, 0x03);
3906         run_efuse_read(sc,
3907             RT5390_EEPROM_RF_IQ_IMBALANCE_COMPENSATION_CTL, &val, 1);
3908         run_bbp_write(sc, 159, val);
3909 }
3910
3911 static void
3912 run_set_agc(struct run_softc *sc, uint8_t agc)
3913 {
3914         uint8_t bbp;
3915
3916         if (sc->mac_ver == 0x3572) {
3917                 run_bbp_read(sc, 27, &bbp);
3918                 bbp &= ~(0x3 << 5);
3919                 run_bbp_write(sc, 27, bbp | 0 << 5);    /* select Rx0 */
3920                 run_bbp_write(sc, 66, agc);
3921                 run_bbp_write(sc, 27, bbp | 1 << 5);    /* select Rx1 */
3922                 run_bbp_write(sc, 66, agc);
3923         } else
3924                 run_bbp_write(sc, 66, agc);
3925 }
3926
3927 static void
3928 run_select_chan_group(struct run_softc *sc, int group)
3929 {
3930         uint32_t tmp;
3931         uint8_t agc;
3932
3933         run_bbp_write(sc, 62, 0x37 - sc->lna[group]);
3934         run_bbp_write(sc, 63, 0x37 - sc->lna[group]);
3935         run_bbp_write(sc, 64, 0x37 - sc->lna[group]);
3936         if (sc->mac_ver < 0x3572)
3937                 run_bbp_write(sc, 86, 0x00);
3938
3939         if (sc->mac_ver == 0x3593) {
3940                 run_bbp_write(sc, 77, 0x98);
3941                 run_bbp_write(sc, 83, (group == 0) ? 0x8a : 0x9a);
3942         }
3943
3944         if (group == 0) {
3945                 if (sc->ext_2ghz_lna) {
3946                         if (sc->mac_ver >= 0x5390)
3947                                 run_bbp_write(sc, 75, 0x52);
3948                         else {
3949                                 run_bbp_write(sc, 82, 0x62);
3950                                 run_bbp_write(sc, 75, 0x46);
3951                         }
3952                 } else {
3953                         if (sc->mac_ver == 0x5592) {
3954                                 run_bbp_write(sc, 79, 0x1c);
3955                                 run_bbp_write(sc, 80, 0x0e);
3956                                 run_bbp_write(sc, 81, 0x3a);
3957                                 run_bbp_write(sc, 82, 0x62);
3958
3959                                 run_bbp_write(sc, 195, 0x80);
3960                                 run_bbp_write(sc, 196, 0xe0);
3961                                 run_bbp_write(sc, 195, 0x81);
3962                                 run_bbp_write(sc, 196, 0x1f);
3963                                 run_bbp_write(sc, 195, 0x82);
3964                                 run_bbp_write(sc, 196, 0x38);
3965                                 run_bbp_write(sc, 195, 0x83);
3966                                 run_bbp_write(sc, 196, 0x32);
3967                                 run_bbp_write(sc, 195, 0x85);
3968                                 run_bbp_write(sc, 196, 0x28);
3969                                 run_bbp_write(sc, 195, 0x86);
3970                                 run_bbp_write(sc, 196, 0x19);
3971                         } else if (sc->mac_ver >= 0x5390)
3972                                 run_bbp_write(sc, 75, 0x50);
3973                         else {
3974                                 run_bbp_write(sc, 82,
3975                                     (sc->mac_ver == 0x3593) ? 0x62 : 0x84);
3976                                 run_bbp_write(sc, 75, 0x50);
3977                         }
3978                 }
3979         } else {
3980                 if (sc->mac_ver == 0x5592) {
3981                         run_bbp_write(sc, 79, 0x18);
3982                         run_bbp_write(sc, 80, 0x08);
3983                         run_bbp_write(sc, 81, 0x38);
3984                         run_bbp_write(sc, 82, 0x92);
3985
3986                         run_bbp_write(sc, 195, 0x80);
3987                         run_bbp_write(sc, 196, 0xf0);
3988                         run_bbp_write(sc, 195, 0x81);
3989                         run_bbp_write(sc, 196, 0x1e);
3990                         run_bbp_write(sc, 195, 0x82);
3991                         run_bbp_write(sc, 196, 0x28);
3992                         run_bbp_write(sc, 195, 0x83);
3993                         run_bbp_write(sc, 196, 0x20);
3994                         run_bbp_write(sc, 195, 0x85);
3995                         run_bbp_write(sc, 196, 0x7f);
3996                         run_bbp_write(sc, 195, 0x86);
3997                         run_bbp_write(sc, 196, 0x7f);
3998                 } else if (sc->mac_ver == 0x3572)
3999                         run_bbp_write(sc, 82, 0x94);
4000                 else
4001                         run_bbp_write(sc, 82,
4002                             (sc->mac_ver == 0x3593) ? 0x82 : 0xf2);
4003                 if (sc->ext_5ghz_lna)
4004                         run_bbp_write(sc, 75, 0x46);
4005                 else
4006                         run_bbp_write(sc, 75, 0x50);
4007         }
4008
4009         run_read(sc, RT2860_TX_BAND_CFG, &tmp);
4010         tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
4011         tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
4012         run_write(sc, RT2860_TX_BAND_CFG, tmp);
4013
4014         /* enable appropriate Power Amplifiers and Low Noise Amplifiers */
4015         tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
4016         if (sc->mac_ver == 0x3593)
4017                 tmp |= 1 << 29 | 1 << 28;
4018         if (sc->nrxchains > 1)
4019                 tmp |= RT2860_LNA_PE1_EN;
4020         if (group == 0) {       /* 2GHz */
4021                 tmp |= RT2860_PA_PE_G0_EN;
4022                 if (sc->ntxchains > 1)
4023                         tmp |= RT2860_PA_PE_G1_EN;
4024                 if (sc->mac_ver == 0x3593) {
4025                         if (sc->ntxchains > 2)
4026                                 tmp |= 1 << 25;
4027                 }
4028         } else {                /* 5GHz */
4029                 tmp |= RT2860_PA_PE_A0_EN;
4030                 if (sc->ntxchains > 1)
4031                         tmp |= RT2860_PA_PE_A1_EN;
4032         }
4033         if (sc->mac_ver == 0x3572) {
4034                 run_rt3070_rf_write(sc, 8, 0x00);
4035                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
4036                 run_rt3070_rf_write(sc, 8, 0x80);
4037         } else
4038                 run_write(sc, RT2860_TX_PIN_CFG, tmp);
4039
4040         if (sc->mac_ver == 0x5592) {
4041                 run_bbp_write(sc, 195, 0x8d);
4042                 run_bbp_write(sc, 196, 0x1a);
4043         }
4044
4045         if (sc->mac_ver == 0x3593) {
4046                 run_read(sc, RT2860_GPIO_CTRL, &tmp);
4047                 tmp &= ~0x01010000;
4048                 if (group == 0)
4049                         tmp |= 0x00010000;
4050                 tmp = (tmp & ~0x00009090) | 0x00000090;
4051                 run_write(sc, RT2860_GPIO_CTRL, tmp);
4052         }
4053
4054         /* set initial AGC value */
4055         if (group == 0) {       /* 2GHz band */
4056                 if (sc->mac_ver >= 0x3070)
4057                         agc = 0x1c + sc->lna[0] * 2;
4058                 else
4059                         agc = 0x2e + sc->lna[0];
4060         } else {                /* 5GHz band */
4061                 if (sc->mac_ver == 0x5592)
4062                         agc = 0x24 + sc->lna[group] * 2;
4063                 else if (sc->mac_ver == 0x3572 || sc->mac_ver == 0x3593)
4064                         agc = 0x22 + (sc->lna[group] * 5) / 3;
4065                 else
4066                         agc = 0x32 + (sc->lna[group] * 5) / 3;
4067         }
4068         run_set_agc(sc, agc);
4069 }
4070
4071 static void
4072 run_rt2870_set_chan(struct run_softc *sc, u_int chan)
4073 {
4074         const struct rfprog *rfprog = rt2860_rf2850;
4075         uint32_t r2, r3, r4;
4076         int8_t txpow1, txpow2;
4077         int i;
4078
4079         /* find the settings for this channel (we know it exists) */
4080         for (i = 0; rfprog[i].chan != chan; i++);
4081
4082         r2 = rfprog[i].r2;
4083         if (sc->ntxchains == 1)
4084                 r2 |= 1 << 14;          /* 1T: disable Tx chain 2 */
4085         if (sc->nrxchains == 1)
4086                 r2 |= 1 << 17 | 1 << 6; /* 1R: disable Rx chains 2 & 3 */
4087         else if (sc->nrxchains == 2)
4088                 r2 |= 1 << 6;           /* 2R: disable Rx chain 3 */
4089
4090         /* use Tx power values from EEPROM */
4091         txpow1 = sc->txpow1[i];
4092         txpow2 = sc->txpow2[i];
4093
4094         /* Initialize RF R3 and R4. */
4095         r3 = rfprog[i].r3 & 0xffffc1ff;
4096         r4 = (rfprog[i].r4 & ~(0x001f87c0)) | (sc->freq << 15);
4097         if (chan > 14) {
4098                 if (txpow1 >= 0) {
4099                         txpow1 = (txpow1 > 0xf) ? (0xf) : (txpow1);
4100                         r3 |= (txpow1 << 10) | (1 << 9);
4101                 } else {
4102                         txpow1 += 7;
4103
4104                         /* txpow1 is not possible larger than 15. */
4105                         r3 |= (txpow1 << 10);
4106                 }
4107                 if (txpow2 >= 0) {
4108                         txpow2 = (txpow2 > 0xf) ? (0xf) : (txpow2);
4109                         r4 |= (txpow2 << 7) | (1 << 6);
4110                 } else {
4111                         txpow2 += 7;
4112                         r4 |= (txpow2 << 7);
4113                 }
4114         } else {
4115                 /* Set Tx0 power. */
4116                 r3 |= (txpow1 << 9);
4117
4118                 /* Set frequency offset and Tx1 power. */
4119                 r4 |= (txpow2 << 6);
4120         }
4121
4122         run_rt2870_rf_write(sc, rfprog[i].r1);
4123         run_rt2870_rf_write(sc, r2);
4124         run_rt2870_rf_write(sc, r3 & ~(1 << 2));
4125         run_rt2870_rf_write(sc, r4);
4126
4127         run_delay(sc, 10);
4128
4129         run_rt2870_rf_write(sc, rfprog[i].r1);
4130         run_rt2870_rf_write(sc, r2);
4131         run_rt2870_rf_write(sc, r3 | (1 << 2));
4132         run_rt2870_rf_write(sc, r4);
4133
4134         run_delay(sc, 10);
4135
4136         run_rt2870_rf_write(sc, rfprog[i].r1);
4137         run_rt2870_rf_write(sc, r2);
4138         run_rt2870_rf_write(sc, r3 & ~(1 << 2));
4139         run_rt2870_rf_write(sc, r4);
4140 }
4141
4142 static void
4143 run_rt3070_set_chan(struct run_softc *sc, u_int chan)
4144 {
4145         int8_t txpow1, txpow2;
4146         uint8_t rf;
4147         int i;
4148
4149         /* find the settings for this channel (we know it exists) */
4150         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4151
4152         /* use Tx power values from EEPROM */
4153         txpow1 = sc->txpow1[i];
4154         txpow2 = sc->txpow2[i];
4155
4156         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
4157
4158         /* RT3370/RT3390: RF R3 [7:4] is not reserved bits. */
4159         run_rt3070_rf_read(sc, 3, &rf);
4160         rf = (rf & ~0x0f) | rt3070_freqs[i].k;
4161         run_rt3070_rf_write(sc, 3, rf);
4162
4163         run_rt3070_rf_read(sc, 6, &rf);
4164         rf = (rf & ~0x03) | rt3070_freqs[i].r;
4165         run_rt3070_rf_write(sc, 6, rf);
4166
4167         /* set Tx0 power */
4168         run_rt3070_rf_read(sc, 12, &rf);
4169         rf = (rf & ~0x1f) | txpow1;
4170         run_rt3070_rf_write(sc, 12, rf);
4171
4172         /* set Tx1 power */
4173         run_rt3070_rf_read(sc, 13, &rf);
4174         rf = (rf & ~0x1f) | txpow2;
4175         run_rt3070_rf_write(sc, 13, rf);
4176
4177         run_rt3070_rf_read(sc, 1, &rf);
4178         rf &= ~0xfc;
4179         if (sc->ntxchains == 1)
4180                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
4181         else if (sc->ntxchains == 2)
4182                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
4183         if (sc->nrxchains == 1)
4184                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
4185         else if (sc->nrxchains == 2)
4186                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
4187         run_rt3070_rf_write(sc, 1, rf);
4188
4189         /* set RF offset */
4190         run_rt3070_rf_read(sc, 23, &rf);
4191         rf = (rf & ~0x7f) | sc->freq;
4192         run_rt3070_rf_write(sc, 23, rf);
4193
4194         /* program RF filter */
4195         run_rt3070_rf_read(sc, 24, &rf);        /* Tx */
4196         rf = (rf & ~0x3f) | sc->rf24_20mhz;
4197         run_rt3070_rf_write(sc, 24, rf);
4198         run_rt3070_rf_read(sc, 31, &rf);        /* Rx */
4199         rf = (rf & ~0x3f) | sc->rf24_20mhz;
4200         run_rt3070_rf_write(sc, 31, rf);
4201
4202         /* enable RF tuning */
4203         run_rt3070_rf_read(sc, 7, &rf);
4204         run_rt3070_rf_write(sc, 7, rf | 0x01);
4205 }
4206
4207 static void
4208 run_rt3572_set_chan(struct run_softc *sc, u_int chan)
4209 {
4210         int8_t txpow1, txpow2;
4211         uint32_t tmp;
4212         uint8_t rf;
4213         int i;
4214
4215         /* find the settings for this channel (we know it exists) */
4216         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4217
4218         /* use Tx power values from EEPROM */
4219         txpow1 = sc->txpow1[i];
4220         txpow2 = sc->txpow2[i];
4221
4222         if (chan <= 14) {
4223                 run_bbp_write(sc, 25, sc->bbp25);
4224                 run_bbp_write(sc, 26, sc->bbp26);
4225         } else {
4226                 /* enable IQ phase correction */
4227                 run_bbp_write(sc, 25, 0x09);
4228                 run_bbp_write(sc, 26, 0xff);
4229         }
4230
4231         run_rt3070_rf_write(sc, 2, rt3070_freqs[i].n);
4232         run_rt3070_rf_write(sc, 3, rt3070_freqs[i].k);
4233         run_rt3070_rf_read(sc, 6, &rf);
4234         rf  = (rf & ~0x0f) | rt3070_freqs[i].r;
4235         rf |= (chan <= 14) ? 0x08 : 0x04;
4236         run_rt3070_rf_write(sc, 6, rf);
4237
4238         /* set PLL mode */
4239         run_rt3070_rf_read(sc, 5, &rf);
4240         rf &= ~(0x08 | 0x04);
4241         rf |= (chan <= 14) ? 0x04 : 0x08;
4242         run_rt3070_rf_write(sc, 5, rf);
4243
4244         /* set Tx power for chain 0 */
4245         if (chan <= 14)
4246                 rf = 0x60 | txpow1;
4247         else
4248                 rf = 0xe0 | (txpow1 & 0xc) << 1 | (txpow1 & 0x3);
4249         run_rt3070_rf_write(sc, 12, rf);
4250
4251         /* set Tx power for chain 1 */
4252         if (chan <= 14)
4253                 rf = 0x60 | txpow2;
4254         else
4255                 rf = 0xe0 | (txpow2 & 0xc) << 1 | (txpow2 & 0x3);
4256         run_rt3070_rf_write(sc, 13, rf);
4257
4258         /* set Tx/Rx streams */
4259         run_rt3070_rf_read(sc, 1, &rf);
4260         rf &= ~0xfc;
4261         if (sc->ntxchains == 1)
4262                 rf |= 1 << 7 | 1 << 5;  /* 1T: disable Tx chains 2 & 3 */
4263         else if (sc->ntxchains == 2)
4264                 rf |= 1 << 7;           /* 2T: disable Tx chain 3 */
4265         if (sc->nrxchains == 1)
4266                 rf |= 1 << 6 | 1 << 4;  /* 1R: disable Rx chains 2 & 3 */
4267         else if (sc->nrxchains == 2)
4268                 rf |= 1 << 6;           /* 2R: disable Rx chain 3 */
4269         run_rt3070_rf_write(sc, 1, rf);
4270
4271         /* set RF offset */
4272         run_rt3070_rf_read(sc, 23, &rf);
4273         rf = (rf & ~0x7f) | sc->freq;
4274         run_rt3070_rf_write(sc, 23, rf);
4275
4276         /* program RF filter */
4277         rf = sc->rf24_20mhz;
4278         run_rt3070_rf_write(sc, 24, rf);        /* Tx */
4279         run_rt3070_rf_write(sc, 31, rf);        /* Rx */
4280
4281         /* enable RF tuning */
4282         run_rt3070_rf_read(sc, 7, &rf);
4283         rf = (chan <= 14) ? 0xd8 : ((rf & ~0xc8) | 0x14);
4284         run_rt3070_rf_write(sc, 7, rf);
4285
4286         /* TSSI */
4287         rf = (chan <= 14) ? 0xc3 : 0xc0;
4288         run_rt3070_rf_write(sc, 9, rf);
4289
4290         /* set loop filter 1 */
4291         run_rt3070_rf_write(sc, 10, 0xf1);
4292         /* set loop filter 2 */
4293         run_rt3070_rf_write(sc, 11, (chan <= 14) ? 0xb9 : 0x00);
4294
4295         /* set tx_mx2_ic */
4296         run_rt3070_rf_write(sc, 15, (chan <= 14) ? 0x53 : 0x43);
4297         /* set tx_mx1_ic */
4298         if (chan <= 14)
4299                 rf = 0x48 | sc->txmixgain_2ghz;
4300         else
4301                 rf = 0x78 | sc->txmixgain_5ghz;
4302         run_rt3070_rf_write(sc, 16, rf);
4303
4304         /* set tx_lo1 */
4305         run_rt3070_rf_write(sc, 17, 0x23);
4306         /* set tx_lo2 */
4307         if (chan <= 14)
4308                 rf = 0x93;
4309         else if (chan <= 64)
4310                 rf = 0xb7;
4311         else if (chan <= 128)
4312                 rf = 0x74;
4313         else
4314                 rf = 0x72;
4315         run_rt3070_rf_write(sc, 19, rf);
4316
4317         /* set rx_lo1 */
4318         if (chan <= 14)
4319                 rf = 0xb3;
4320         else if (chan <= 64)
4321                 rf = 0xf6;
4322         else if (chan <= 128)
4323                 rf = 0xf4;
4324         else
4325                 rf = 0xf3;
4326         run_rt3070_rf_write(sc, 20, rf);
4327
4328         /* set pfd_delay */
4329         if (chan <= 14)
4330                 rf = 0x15;
4331         else if (chan <= 64)
4332                 rf = 0x3d;
4333         else
4334                 rf = 0x01;
4335         run_rt3070_rf_write(sc, 25, rf);
4336
4337         /* set rx_lo2 */
4338         run_rt3070_rf_write(sc, 26, (chan <= 14) ? 0x85 : 0x87);
4339         /* set ldo_rf_vc */
4340         run_rt3070_rf_write(sc, 27, (chan <= 14) ? 0x00 : 0x01);
4341         /* set drv_cc */
4342         run_rt3070_rf_write(sc, 29, (chan <= 14) ? 0x9b : 0x9f);
4343
4344         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4345         tmp &= ~0x8080;
4346         if (chan <= 14)
4347                 tmp |= 0x80;
4348         run_write(sc, RT2860_GPIO_CTRL, tmp);
4349
4350         /* enable RF tuning */
4351         run_rt3070_rf_read(sc, 7, &rf);
4352         run_rt3070_rf_write(sc, 7, rf | 0x01);
4353
4354         run_delay(sc, 2);
4355 }
4356
4357 static void
4358 run_rt3593_set_chan(struct run_softc *sc, u_int chan)
4359 {
4360         int8_t txpow1, txpow2, txpow3;
4361         uint8_t h20mhz, rf;
4362         int i;
4363
4364         /* find the settings for this channel (we know it exists) */
4365         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4366
4367         /* use Tx power values from EEPROM */
4368         txpow1 = sc->txpow1[i];
4369         txpow2 = sc->txpow2[i];
4370         txpow3 = (sc->ntxchains == 3) ? sc->txpow3[i] : 0;
4371
4372         if (chan <= 14) {
4373                 run_bbp_write(sc, 25, sc->bbp25);
4374                 run_bbp_write(sc, 26, sc->bbp26);
4375         } else {
4376                 /* Enable IQ phase correction. */
4377                 run_bbp_write(sc, 25, 0x09);
4378                 run_bbp_write(sc, 26, 0xff);
4379         }
4380
4381         run_rt3070_rf_write(sc, 8, rt3070_freqs[i].n);
4382         run_rt3070_rf_write(sc, 9, rt3070_freqs[i].k & 0x0f);
4383         run_rt3070_rf_read(sc, 11, &rf);
4384         rf = (rf & ~0x03) | (rt3070_freqs[i].r & 0x03);
4385         run_rt3070_rf_write(sc, 11, rf);
4386
4387         /* Set pll_idoh. */
4388         run_rt3070_rf_read(sc, 11, &rf);
4389         rf &= ~0x4c;
4390         rf |= (chan <= 14) ? 0x44 : 0x48;
4391         run_rt3070_rf_write(sc, 11, rf);
4392
4393         if (chan <= 14)
4394                 rf = txpow1 & 0x1f;
4395         else
4396                 rf = 0x40 | ((txpow1 & 0x18) << 1) | (txpow1 & 0x07);
4397         run_rt3070_rf_write(sc, 53, rf);
4398
4399         if (chan <= 14)
4400                 rf = txpow2 & 0x1f;
4401         else
4402                 rf = 0x40 | ((txpow2 & 0x18) << 1) | (txpow2 & 0x07);
4403         run_rt3070_rf_write(sc, 55, rf);
4404
4405         if (chan <= 14)
4406                 rf = txpow3 & 0x1f;
4407         else
4408                 rf = 0x40 | ((txpow3 & 0x18) << 1) | (txpow3 & 0x07);
4409         run_rt3070_rf_write(sc, 54, rf);
4410
4411         rf = RT3070_RF_BLOCK | RT3070_PLL_PD;
4412         if (sc->ntxchains == 3)
4413                 rf |= RT3070_TX0_PD | RT3070_TX1_PD | RT3070_TX2_PD;
4414         else
4415                 rf |= RT3070_TX0_PD | RT3070_TX1_PD;
4416         rf |= RT3070_RX0_PD | RT3070_RX1_PD | RT3070_RX2_PD;
4417         run_rt3070_rf_write(sc, 1, rf);
4418
4419         run_adjust_freq_offset(sc);
4420
4421         run_rt3070_rf_write(sc, 31, (chan <= 14) ? 0xa0 : 0x80);
4422
4423         h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
4424         run_rt3070_rf_read(sc, 30, &rf);
4425         rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
4426         run_rt3070_rf_write(sc, 30, rf);
4427
4428         run_rt3070_rf_read(sc, 36, &rf);
4429         if (chan <= 14)
4430                 rf |= 0x80;
4431         else
4432                 rf &= ~0x80;
4433         run_rt3070_rf_write(sc, 36, rf);
4434
4435         /* Set vcolo_bs. */
4436         run_rt3070_rf_write(sc, 34, (chan <= 14) ? 0x3c : 0x20);
4437         /* Set pfd_delay. */
4438         run_rt3070_rf_write(sc, 12, (chan <= 14) ? 0x1a : 0x12);
4439
4440         /* Set vco bias current control. */
4441         run_rt3070_rf_read(sc, 6, &rf);
4442         rf &= ~0xc0;
4443         if (chan <= 14)
4444                 rf |= 0x40;
4445         else if (chan <= 128)
4446                 rf |= 0x80;
4447         else
4448                 rf |= 0x40;
4449         run_rt3070_rf_write(sc, 6, rf);
4450
4451         run_rt3070_rf_read(sc, 30, &rf);
4452         rf = (rf & ~0x18) | 0x10;
4453         run_rt3070_rf_write(sc, 30, rf);
4454
4455         run_rt3070_rf_write(sc, 10, (chan <= 14) ? 0xd3 : 0xd8);
4456         run_rt3070_rf_write(sc, 13, (chan <= 14) ? 0x12 : 0x23);
4457
4458         run_rt3070_rf_read(sc, 51, &rf);
4459         rf = (rf & ~0x03) | 0x01;
4460         run_rt3070_rf_write(sc, 51, rf);
4461         /* Set tx_mx1_cc. */
4462         run_rt3070_rf_read(sc, 51, &rf);
4463         rf &= ~0x1c;
4464         rf |= (chan <= 14) ? 0x14 : 0x10;
4465         run_rt3070_rf_write(sc, 51, rf);
4466         /* Set tx_mx1_ic. */
4467         run_rt3070_rf_read(sc, 51, &rf);
4468         rf &= ~0xe0;
4469         rf |= (chan <= 14) ? 0x60 : 0x40;
4470         run_rt3070_rf_write(sc, 51, rf);
4471         /* Set tx_lo1_ic. */
4472         run_rt3070_rf_read(sc, 49, &rf);
4473         rf &= ~0x1c;
4474         rf |= (chan <= 14) ? 0x0c : 0x08;
4475         run_rt3070_rf_write(sc, 49, rf);
4476         /* Set tx_lo1_en. */
4477         run_rt3070_rf_read(sc, 50, &rf);
4478         run_rt3070_rf_write(sc, 50, rf & ~0x20);
4479         /* Set drv_cc. */
4480         run_rt3070_rf_read(sc, 57, &rf);
4481         rf &= ~0xfc;
4482         rf |= (chan <= 14) ?  0x6c : 0x3c;
4483         run_rt3070_rf_write(sc, 57, rf);
4484         /* Set rx_mix1_ic, rxa_lnactr, lna_vc, lna_inbias_en and lna_en. */
4485         run_rt3070_rf_write(sc, 44, (chan <= 14) ? 0x93 : 0x9b);
4486         /* Set drv_gnd_a, tx_vga_cc_a and tx_mx2_gain. */
4487         run_rt3070_rf_write(sc, 52, (chan <= 14) ? 0x45 : 0x05);
4488         /* Enable VCO calibration. */
4489         run_rt3070_rf_read(sc, 3, &rf);
4490         rf &= ~RT5390_VCOCAL;
4491         rf |= (chan <= 14) ? RT5390_VCOCAL : 0xbe;
4492         run_rt3070_rf_write(sc, 3, rf);
4493
4494         if (chan <= 14)
4495                 rf = 0x23;
4496         else if (chan <= 64)
4497                 rf = 0x36;
4498         else if (chan <= 128)
4499                 rf = 0x32;
4500         else
4501                 rf = 0x30;
4502         run_rt3070_rf_write(sc, 39, rf);
4503         if (chan <= 14)
4504                 rf = 0xbb;
4505         else if (chan <= 64)
4506                 rf = 0xeb;
4507         else if (chan <= 128)
4508                 rf = 0xb3;
4509         else
4510                 rf = 0x9b;
4511         run_rt3070_rf_write(sc, 45, rf);
4512
4513         /* Set FEQ/AEQ control. */
4514         run_bbp_write(sc, 105, 0x34);
4515 }
4516
4517 static void
4518 run_rt5390_set_chan(struct run_softc *sc, u_int chan)
4519 {
4520         int8_t txpow1, txpow2;
4521         uint8_t rf;
4522         int i;
4523
4524         /* find the settings for this channel (we know it exists) */
4525         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
4526
4527         /* use Tx power values from EEPROM */
4528         txpow1 = sc->txpow1[i];
4529         txpow2 = sc->txpow2[i];
4530
4531         run_rt3070_rf_write(sc, 8, rt3070_freqs[i].n);
4532         run_rt3070_rf_write(sc, 9, rt3070_freqs[i].k & 0x0f);
4533         run_rt3070_rf_read(sc, 11, &rf);
4534         rf = (rf & ~0x03) | (rt3070_freqs[i].r & 0x03);
4535         run_rt3070_rf_write(sc, 11, rf);
4536
4537         run_rt3070_rf_read(sc, 49, &rf);
4538         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
4539         /* The valid range of the RF R49 is 0x00 to 0x27. */
4540         if ((rf & 0x3f) > 0x27)
4541                 rf = (rf & ~0x3f) | 0x27;
4542         run_rt3070_rf_write(sc, 49, rf);
4543
4544         if (sc->mac_ver == 0x5392) {
4545                 run_rt3070_rf_read(sc, 50, &rf);
4546                 rf = (rf & ~0x3f) | (txpow2 & 0x3f);
4547                 /* The valid range of the RF R50 is 0x00 to 0x27. */
4548                 if ((rf & 0x3f) > 0x27)
4549                         rf = (rf & ~0x3f) | 0x27;
4550                 run_rt3070_rf_write(sc, 50, rf);
4551         }
4552
4553         run_rt3070_rf_read(sc, 1, &rf);
4554         rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
4555         if (sc->mac_ver == 0x5392)
4556                 rf |= RT3070_RX1_PD | RT3070_TX1_PD;
4557         run_rt3070_rf_write(sc, 1, rf);
4558
4559         if (sc->mac_ver != 0x5392) {
4560                 run_rt3070_rf_read(sc, 2, &rf);
4561                 rf |= 0x80;
4562                 run_rt3070_rf_write(sc, 2, rf);
4563                 run_delay(sc, 10);
4564                 rf &= 0x7f;
4565                 run_rt3070_rf_write(sc, 2, rf);
4566         }
4567
4568         run_adjust_freq_offset(sc);
4569
4570         if (sc->mac_ver == 0x5392) {
4571                 /* Fix for RT5392C. */
4572                 if (sc->mac_rev >= 0x0223) {
4573                         if (chan <= 4)
4574                                 rf = 0x0f;
4575                         else if (chan >= 5 && chan <= 7)
4576                                 rf = 0x0e;
4577                         else
4578                                 rf = 0x0d;
4579                         run_rt3070_rf_write(sc, 23, rf);
4580
4581                         if (chan <= 4)
4582                                 rf = 0x0c;
4583                         else if (chan == 5)
4584                                 rf = 0x0b;
4585                         else if (chan >= 6 && chan <= 7)
4586                                 rf = 0x0a;
4587                         else if (chan >= 8 && chan <= 10)
4588                                 rf = 0x09;
4589                         else
4590                                 rf = 0x08;
4591                         run_rt3070_rf_write(sc, 59, rf);
4592                 } else {
4593                         if (chan <= 11)
4594                                 rf = 0x0f;
4595                         else
4596                                 rf = 0x0b;
4597                         run_rt3070_rf_write(sc, 59, rf);
4598                 }
4599         } else {
4600                 /* Fix for RT5390F. */
4601                 if (sc->mac_rev >= 0x0502) {
4602                         if (chan <= 11)
4603                                 rf = 0x43;
4604                         else
4605                                 rf = 0x23;
4606                         run_rt3070_rf_write(sc, 55, rf);
4607
4608                         if (chan <= 11)
4609                                 rf = 0x0f;
4610                         else if (chan == 12)
4611                                 rf = 0x0d;
4612                         else
4613                                 rf = 0x0b;
4614                         run_rt3070_rf_write(sc, 59, rf);
4615                 } else {
4616                         run_rt3070_rf_write(sc, 55, 0x44);
4617                         run_rt3070_rf_write(sc, 59, 0x8f);
4618                 }
4619         }
4620
4621         /* Enable VCO calibration. */
4622         run_rt3070_rf_read(sc, 3, &rf);
4623         rf |= RT5390_VCOCAL;
4624         run_rt3070_rf_write(sc, 3, rf);
4625 }
4626
4627 static void
4628 run_rt5592_set_chan(struct run_softc *sc, u_int chan)
4629 {
4630         const struct rt5592_freqs *freqs;
4631         uint32_t tmp;
4632         uint8_t reg, rf, txpow_bound;
4633         int8_t txpow1, txpow2;
4634         int i;
4635
4636         run_read(sc, RT5592_DEBUG_INDEX, &tmp);
4637         freqs = (tmp & RT5592_SEL_XTAL) ?
4638             rt5592_freqs_40mhz : rt5592_freqs_20mhz;
4639
4640         /* find the settings for this channel (we know it exists) */
4641         for (i = 0; rt2860_rf2850[i].chan != chan; i++, freqs++);
4642
4643         /* use Tx power values from EEPROM */
4644         txpow1 = sc->txpow1[i];
4645         txpow2 = sc->txpow2[i];
4646
4647         run_read(sc, RT3070_LDO_CFG0, &tmp);
4648         tmp &= ~0x1c000000;
4649         if (chan > 14)
4650                 tmp |= 0x14000000;
4651         run_write(sc, RT3070_LDO_CFG0, tmp);
4652
4653         /* N setting. */
4654         run_rt3070_rf_write(sc, 8, freqs->n & 0xff);
4655         run_rt3070_rf_read(sc, 9, &rf);
4656         rf &= ~(1 << 4);
4657         rf |= ((freqs->n & 0x0100) >> 8) << 4;
4658         run_rt3070_rf_write(sc, 9, rf);
4659
4660         /* K setting. */
4661         run_rt3070_rf_read(sc, 9, &rf);
4662         rf &= ~0x0f;
4663         rf |= (freqs->k & 0x0f);
4664         run_rt3070_rf_write(sc, 9, rf);
4665
4666         /* Mode setting. */
4667         run_rt3070_rf_read(sc, 11, &rf);
4668         rf &= ~0x0c;
4669         rf |= ((freqs->m - 0x8) & 0x3) << 2;
4670         run_rt3070_rf_write(sc, 11, rf);
4671         run_rt3070_rf_read(sc, 9, &rf);
4672         rf &= ~(1 << 7);
4673         rf |= (((freqs->m - 0x8) & 0x4) >> 2) << 7;
4674         run_rt3070_rf_write(sc, 9, rf);
4675
4676         /* R setting. */
4677         run_rt3070_rf_read(sc, 11, &rf);
4678         rf &= ~0x03;
4679         rf |= (freqs->r - 0x1);
4680         run_rt3070_rf_write(sc, 11, rf);
4681
4682         if (chan <= 14) {
4683                 /* Initialize RF registers for 2GHZ. */
4684                 for (i = 0; i < nitems(rt5592_2ghz_def_rf); i++) {
4685                         run_rt3070_rf_write(sc, rt5592_2ghz_def_rf[i].reg,
4686                             rt5592_2ghz_def_rf[i].val);
4687                 }
4688
4689                 rf = (chan <= 10) ? 0x07 : 0x06;
4690                 run_rt3070_rf_write(sc, 23, rf);
4691                 run_rt3070_rf_write(sc, 59, rf);
4692
4693                 run_rt3070_rf_write(sc, 55, 0x43);
4694
4695                 /*
4696                  * RF R49/R50 Tx power ALC code.
4697                  * G-band bit<7:6>=1:0, bit<5:0> range from 0x0 ~ 0x27.
4698                  */
4699                 reg = 2;
4700                 txpow_bound = 0x27;
4701         } else {
4702                 /* Initialize RF registers for 5GHZ. */
4703                 for (i = 0; i < nitems(rt5592_5ghz_def_rf); i++) {
4704                         run_rt3070_rf_write(sc, rt5592_5ghz_def_rf[i].reg,
4705                             rt5592_5ghz_def_rf[i].val);
4706                 }
4707                 for (i = 0; i < nitems(rt5592_chan_5ghz); i++) {
4708                         if (chan >= rt5592_chan_5ghz[i].firstchan &&
4709                             chan <= rt5592_chan_5ghz[i].lastchan) {
4710                                 run_rt3070_rf_write(sc, rt5592_chan_5ghz[i].reg,
4711                                     rt5592_chan_5ghz[i].val);
4712                         }
4713                 }
4714
4715                 /*
4716                  * RF R49/R50 Tx power ALC code.
4717                  * A-band bit<7:6>=1:1, bit<5:0> range from 0x0 ~ 0x2b.
4718                  */
4719                 reg = 3;
4720                 txpow_bound = 0x2b;
4721         }
4722
4723         /* RF R49 ch0 Tx power ALC code. */
4724         run_rt3070_rf_read(sc, 49, &rf);
4725         rf &= ~0xc0;
4726         rf |= (reg << 6);
4727         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
4728         if ((rf & 0x3f) > txpow_bound)
4729                 rf = (rf & ~0x3f) | txpow_bound;
4730         run_rt3070_rf_write(sc, 49, rf);
4731
4732         /* RF R50 ch1 Tx power ALC code. */
4733         run_rt3070_rf_read(sc, 50, &rf);
4734         rf &= ~(1 << 7 | 1 << 6);
4735         rf |= (reg << 6);
4736         rf = (rf & ~0x3f) | (txpow2 & 0x3f);
4737         if ((rf & 0x3f) > txpow_bound)
4738                 rf = (rf & ~0x3f) | txpow_bound;
4739         run_rt3070_rf_write(sc, 50, rf);
4740
4741         /* Enable RF_BLOCK, PLL_PD, RX0_PD, and TX0_PD. */
4742         run_rt3070_rf_read(sc, 1, &rf);
4743         rf |= (RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD);
4744         if (sc->ntxchains > 1)
4745                 rf |= RT3070_TX1_PD;
4746         if (sc->nrxchains > 1)
4747                 rf |= RT3070_RX1_PD;
4748         run_rt3070_rf_write(sc, 1, rf);
4749
4750         run_rt3070_rf_write(sc, 6, 0xe4);
4751
4752         run_rt3070_rf_write(sc, 30, 0x10);
4753         run_rt3070_rf_write(sc, 31, 0x80);
4754         run_rt3070_rf_write(sc, 32, 0x80);
4755
4756         run_adjust_freq_offset(sc);
4757
4758         /* Enable VCO calibration. */
4759         run_rt3070_rf_read(sc, 3, &rf);
4760         rf |= RT5390_VCOCAL;
4761         run_rt3070_rf_write(sc, 3, rf);
4762 }
4763
4764 static void
4765 run_set_rx_antenna(struct run_softc *sc, int aux)
4766 {
4767         uint32_t tmp;
4768         uint8_t bbp152;
4769
4770         if (aux) {
4771                 if (sc->rf_rev == RT5390_RF_5370) {
4772                         run_bbp_read(sc, 152, &bbp152);
4773                         run_bbp_write(sc, 152, bbp152 & ~0x80);
4774                 } else {
4775                         run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 0);
4776                         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4777                         run_write(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
4778                 }
4779         } else {
4780                 if (sc->rf_rev == RT5390_RF_5370) {
4781                         run_bbp_read(sc, 152, &bbp152);
4782                         run_bbp_write(sc, 152, bbp152 | 0x80);
4783                 } else {
4784                         run_mcu_cmd(sc, RT2860_MCU_CMD_ANTSEL, 1);
4785                         run_read(sc, RT2860_GPIO_CTRL, &tmp);
4786                         run_write(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
4787                 }
4788         }
4789 }
4790
4791 static int
4792 run_set_chan(struct run_softc *sc, struct ieee80211_channel *c)
4793 {
4794         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
4795         u_int chan, group;
4796
4797         chan = ieee80211_chan2ieee(ic, c);
4798         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
4799                 return (EINVAL);
4800
4801         if (sc->mac_ver == 0x5592)
4802                 run_rt5592_set_chan(sc, chan);
4803         else if (sc->mac_ver >= 0x5390)
4804                 run_rt5390_set_chan(sc, chan);
4805         else if (sc->mac_ver == 0x3593)
4806                 run_rt3593_set_chan(sc, chan);
4807         else if (sc->mac_ver == 0x3572)
4808                 run_rt3572_set_chan(sc, chan);
4809         else if (sc->mac_ver >= 0x3070)
4810                 run_rt3070_set_chan(sc, chan);
4811         else
4812                 run_rt2870_set_chan(sc, chan);
4813
4814         /* determine channel group */
4815         if (chan <= 14)
4816                 group = 0;
4817         else if (chan <= 64)
4818                 group = 1;
4819         else if (chan <= 128)
4820                 group = 2;
4821         else
4822                 group = 3;
4823
4824         /* XXX necessary only when group has changed! */
4825         run_select_chan_group(sc, group);
4826
4827         run_delay(sc, 10);
4828
4829         /* Perform IQ calibration. */
4830         if (sc->mac_ver >= 0x5392)
4831                 run_iq_calib(sc, chan);
4832
4833         return (0);
4834 }
4835
4836 static void
4837 run_set_channel(struct ieee80211com *ic)
4838 {
4839         struct run_softc *sc = ic->ic_ifp->if_softc;
4840
4841         RUN_LOCK(sc);
4842         run_set_chan(sc, ic->ic_curchan);
4843         RUN_UNLOCK(sc);
4844
4845         return;
4846 }
4847
4848 static void
4849 run_scan_start(struct ieee80211com *ic)
4850 {
4851         struct run_softc *sc = ic->ic_ifp->if_softc;
4852         uint32_t tmp;
4853
4854         RUN_LOCK(sc);
4855
4856         /* abort TSF synchronization */
4857         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
4858         run_write(sc, RT2860_BCN_TIME_CFG,
4859             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
4860             RT2860_TBTT_TIMER_EN));
4861         run_set_bssid(sc, sc->sc_ifp->if_broadcastaddr);
4862
4863         RUN_UNLOCK(sc);
4864
4865         return;
4866 }
4867
4868 static void
4869 run_scan_end(struct ieee80211com *ic)
4870 {
4871         struct run_softc *sc = ic->ic_ifp->if_softc;
4872
4873         RUN_LOCK(sc);
4874
4875         run_enable_tsf_sync(sc);
4876         /* XXX keep local copy */
4877         run_set_bssid(sc, sc->sc_bssid);
4878
4879         RUN_UNLOCK(sc);
4880
4881         return;
4882 }
4883
4884 /*
4885  * Could be called from ieee80211_node_timeout()
4886  * (non-sleepable thread)
4887  */
4888 static void
4889 run_update_beacon(struct ieee80211vap *vap, int item)
4890 {
4891         struct ieee80211com *ic = vap->iv_ic;
4892         struct run_softc *sc = ic->ic_ifp->if_softc;
4893         struct run_vap *rvp = RUN_VAP(vap);
4894         int mcast = 0;
4895         uint32_t i;
4896
4897         KASSERT(vap != NULL, ("no beacon"));
4898
4899         switch (item) {
4900         case IEEE80211_BEACON_ERP:
4901                 run_updateslot(ic->ic_ifp);
4902                 break;
4903         case IEEE80211_BEACON_HTINFO:
4904                 run_updateprot(ic);
4905                 break;
4906         case IEEE80211_BEACON_TIM:
4907                 mcast = 1;      /*TODO*/
4908                 break;
4909         default:
4910                 break;
4911         }
4912
4913         setbit(rvp->bo.bo_flags, item);
4914         if (rvp->beacon_mbuf == NULL) {
4915                 rvp->beacon_mbuf = ieee80211_beacon_alloc(vap->iv_bss,
4916                     &rvp->bo);
4917                 if (rvp->beacon_mbuf == NULL)
4918                         return;
4919         }
4920         ieee80211_beacon_update(vap->iv_bss, &rvp->bo, rvp->beacon_mbuf, mcast);
4921
4922         i = RUN_CMDQ_GET(&sc->cmdq_store);
4923         DPRINTF("cmdq_store=%d\n", i);
4924         sc->cmdq[i].func = run_update_beacon_cb;
4925         sc->cmdq[i].arg0 = vap;
4926         ieee80211_runtask(ic, &sc->cmdq_task);
4927
4928         return;
4929 }
4930
4931 static void
4932 run_update_beacon_cb(void *arg)
4933 {
4934         struct ieee80211vap *vap = arg;
4935         struct run_vap *rvp = RUN_VAP(vap);
4936         struct ieee80211com *ic = vap->iv_ic;
4937         struct run_softc *sc = ic->ic_ifp->if_softc;
4938         struct rt2860_txwi txwi;
4939         struct mbuf *m;
4940         uint16_t txwisize;
4941         uint8_t ridx;
4942
4943         if (vap->iv_bss->ni_chan == IEEE80211_CHAN_ANYC)
4944                 return;
4945         if (ic->ic_bsschan == IEEE80211_CHAN_ANYC)
4946                 return;
4947
4948         /*
4949          * No need to call ieee80211_beacon_update(), run_update_beacon()
4950          * is taking care of apropriate calls.
4951          */
4952         if (rvp->beacon_mbuf == NULL) {
4953                 rvp->beacon_mbuf = ieee80211_beacon_alloc(vap->iv_bss,
4954                     &rvp->bo);
4955                 if (rvp->beacon_mbuf == NULL)
4956                         return;
4957         }
4958         m = rvp->beacon_mbuf;
4959
4960         memset(&txwi, 0, sizeof(txwi));
4961         txwi.wcid = 0xff;
4962         txwi.len = htole16(m->m_pkthdr.len);
4963
4964         /* send beacons at the lowest available rate */
4965         ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
4966             RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
4967         txwi.phy = htole16(rt2860_rates[ridx].mcs);
4968         if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4969                 txwi.phy |= htole16(RT2860_PHY_OFDM);
4970         txwi.txop = RT2860_TX_TXOP_HT;
4971         txwi.flags = RT2860_TX_TS;
4972         txwi.xflags = RT2860_TX_NSEQ;
4973
4974         txwisize = (sc->mac_ver == 0x5592) ?
4975             sizeof(txwi) + sizeof(uint32_t) : sizeof(txwi);
4976         run_write_region_1(sc, RT2860_BCN_BASE(rvp->rvp_id), (uint8_t *)&txwi,
4977             txwisize);
4978         run_write_region_1(sc, RT2860_BCN_BASE(rvp->rvp_id) + txwisize,
4979             mtod(m, uint8_t *), (m->m_pkthdr.len + 1) & ~1);
4980 }
4981
4982 static void
4983 run_updateprot(struct ieee80211com *ic)
4984 {
4985         struct run_softc *sc = ic->ic_ifp->if_softc;
4986         uint32_t i;
4987
4988         i = RUN_CMDQ_GET(&sc->cmdq_store);
4989         DPRINTF("cmdq_store=%d\n", i);
4990         sc->cmdq[i].func = run_updateprot_cb;
4991         sc->cmdq[i].arg0 = ic;
4992         ieee80211_runtask(ic, &sc->cmdq_task);
4993 }
4994
4995 static void
4996 run_updateprot_cb(void *arg)
4997 {
4998         struct ieee80211com *ic = arg;
4999         struct run_softc *sc = ic->ic_ifp->if_softc;
5000         uint32_t tmp;
5001
5002         tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
5003         /* setup protection frame rate (MCS code) */
5004         tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
5005             rt2860_rates[RT2860_RIDX_OFDM6].mcs | RT2860_PHY_OFDM :
5006             rt2860_rates[RT2860_RIDX_CCK11].mcs;
5007
5008         /* CCK frames don't require protection */
5009         run_write(sc, RT2860_CCK_PROT_CFG, tmp);
5010         if (ic->ic_flags & IEEE80211_F_USEPROT) {
5011                 if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
5012                         tmp |= RT2860_PROT_CTRL_RTS_CTS;
5013                 else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
5014                         tmp |= RT2860_PROT_CTRL_CTS;
5015         }
5016         run_write(sc, RT2860_OFDM_PROT_CFG, tmp);
5017 }
5018
5019 static void
5020 run_usb_timeout_cb(void *arg)
5021 {
5022         struct ieee80211vap *vap = arg;
5023         struct run_softc *sc = vap->iv_ic->ic_ifp->if_softc;
5024
5025         RUN_LOCK_ASSERT(sc, MA_OWNED);
5026
5027         if(vap->iv_state == IEEE80211_S_RUN &&
5028             vap->iv_opmode != IEEE80211_M_STA)
5029                 run_reset_livelock(sc);
5030         else if (vap->iv_state == IEEE80211_S_SCAN) {
5031                 DPRINTF("timeout caused by scan\n");
5032                 /* cancel bgscan */
5033                 ieee80211_cancel_scan(vap);
5034         } else
5035                 DPRINTF("timeout by unknown cause\n");
5036 }
5037
5038 static void
5039 run_reset_livelock(struct run_softc *sc)
5040 {
5041         uint32_t tmp;
5042
5043         RUN_LOCK_ASSERT(sc, MA_OWNED);
5044
5045         /*
5046          * In IBSS or HostAP modes (when the hardware sends beacons), the MAC
5047          * can run into a livelock and start sending CTS-to-self frames like
5048          * crazy if protection is enabled.  Reset MAC/BBP for a while
5049          */
5050         run_read(sc, RT2860_DEBUG, &tmp);
5051         DPRINTFN(3, "debug reg %08x\n", tmp);
5052         if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
5053                 DPRINTF("CTS-to-self livelock detected\n");
5054                 run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
5055                 run_delay(sc, 1);
5056                 run_write(sc, RT2860_MAC_SYS_CTRL,
5057                     RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
5058         }
5059 }
5060
5061 static void
5062 run_update_promisc_locked(struct ifnet *ifp)
5063 {
5064         struct run_softc *sc = ifp->if_softc;
5065         uint32_t tmp;
5066
5067         run_read(sc, RT2860_RX_FILTR_CFG, &tmp);
5068
5069         tmp |= RT2860_DROP_UC_NOME;
5070         if (ifp->if_flags & IFF_PROMISC)
5071                 tmp &= ~RT2860_DROP_UC_NOME;
5072
5073         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
5074
5075         DPRINTF("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
5076             "entering" : "leaving");
5077 }
5078
5079 static void
5080 run_update_promisc(struct ifnet *ifp)
5081 {
5082         struct run_softc *sc = ifp->if_softc;
5083
5084         if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0)
5085                 return;
5086
5087         RUN_LOCK(sc);
5088         run_update_promisc_locked(ifp);
5089         RUN_UNLOCK(sc);
5090 }
5091
5092 static void
5093 run_enable_tsf_sync(struct run_softc *sc)
5094 {
5095         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5096         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
5097         uint32_t tmp;
5098
5099         DPRINTF("rvp_id=%d ic_opmode=%d\n", RUN_VAP(vap)->rvp_id,
5100             ic->ic_opmode);
5101
5102         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
5103         tmp &= ~0x1fffff;
5104         tmp |= vap->iv_bss->ni_intval * 16;
5105         tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
5106
5107         if (ic->ic_opmode == IEEE80211_M_STA) {
5108                 /*
5109                  * Local TSF is always updated with remote TSF on beacon
5110                  * reception.
5111                  */
5112                 tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
5113         } else if (ic->ic_opmode == IEEE80211_M_IBSS) {
5114                 tmp |= RT2860_BCN_TX_EN;
5115                 /*
5116                  * Local TSF is updated with remote TSF on beacon reception
5117                  * only if the remote TSF is greater than local TSF.
5118                  */
5119                 tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
5120         } else if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
5121                     ic->ic_opmode == IEEE80211_M_MBSS) {
5122                 tmp |= RT2860_BCN_TX_EN;
5123                 /* SYNC with nobody */
5124                 tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
5125         } else {
5126                 DPRINTF("Enabling TSF failed. undefined opmode\n");
5127                 return;
5128         }
5129
5130         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
5131 }
5132
5133 static void
5134 run_enable_mrr(struct run_softc *sc)
5135 {
5136 #define CCK(mcs)        (mcs)
5137 #define OFDM(mcs)       (1 << 3 | (mcs))
5138         run_write(sc, RT2860_LG_FBK_CFG0,
5139             OFDM(6) << 28 |     /* 54->48 */
5140             OFDM(5) << 24 |     /* 48->36 */
5141             OFDM(4) << 20 |     /* 36->24 */
5142             OFDM(3) << 16 |     /* 24->18 */
5143             OFDM(2) << 12 |     /* 18->12 */
5144             OFDM(1) <<  8 |     /* 12-> 9 */
5145             OFDM(0) <<  4 |     /*  9-> 6 */
5146             OFDM(0));           /*  6-> 6 */
5147
5148         run_write(sc, RT2860_LG_FBK_CFG1,
5149             CCK(2) << 12 |      /* 11->5.5 */
5150             CCK(1) <<  8 |      /* 5.5-> 2 */
5151             CCK(0) <<  4 |      /*   2-> 1 */
5152             CCK(0));            /*   1-> 1 */
5153 #undef OFDM
5154 #undef CCK
5155 }
5156
5157 static void
5158 run_set_txpreamble(struct run_softc *sc)
5159 {
5160         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5161         uint32_t tmp;
5162
5163         run_read(sc, RT2860_AUTO_RSP_CFG, &tmp);
5164         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
5165                 tmp |= RT2860_CCK_SHORT_EN;
5166         else
5167                 tmp &= ~RT2860_CCK_SHORT_EN;
5168         run_write(sc, RT2860_AUTO_RSP_CFG, tmp);
5169 }
5170
5171 static void
5172 run_set_basicrates(struct run_softc *sc)
5173 {
5174         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5175
5176         /* set basic rates mask */
5177         if (ic->ic_curmode == IEEE80211_MODE_11B)
5178                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
5179         else if (ic->ic_curmode == IEEE80211_MODE_11A)
5180                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
5181         else    /* 11g */
5182                 run_write(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
5183 }
5184
5185 static void
5186 run_set_leds(struct run_softc *sc, uint16_t which)
5187 {
5188         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
5189             which | (sc->leds & 0x7f));
5190 }
5191
5192 static void
5193 run_set_bssid(struct run_softc *sc, const uint8_t *bssid)
5194 {
5195         run_write(sc, RT2860_MAC_BSSID_DW0,
5196             bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
5197         run_write(sc, RT2860_MAC_BSSID_DW1,
5198             bssid[4] | bssid[5] << 8);
5199 }
5200
5201 static void
5202 run_set_macaddr(struct run_softc *sc, const uint8_t *addr)
5203 {
5204         run_write(sc, RT2860_MAC_ADDR_DW0,
5205             addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
5206         run_write(sc, RT2860_MAC_ADDR_DW1,
5207             addr[4] | addr[5] << 8 | 0xff << 16);
5208 }
5209
5210 static void
5211 run_updateslot(struct ifnet *ifp)
5212 {
5213         struct run_softc *sc = ifp->if_softc;
5214         struct ieee80211com *ic = ifp->if_l2com;
5215         uint32_t i;
5216
5217         i = RUN_CMDQ_GET(&sc->cmdq_store);
5218         DPRINTF("cmdq_store=%d\n", i);
5219         sc->cmdq[i].func = run_updateslot_cb;
5220         sc->cmdq[i].arg0 = ifp;
5221         ieee80211_runtask(ic, &sc->cmdq_task);
5222
5223         return;
5224 }
5225
5226 /* ARGSUSED */
5227 static void
5228 run_updateslot_cb(void *arg)
5229 {
5230         struct ifnet *ifp = arg;
5231         struct run_softc *sc = ifp->if_softc;
5232         struct ieee80211com *ic = ifp->if_l2com;
5233         uint32_t tmp;
5234
5235         run_read(sc, RT2860_BKOFF_SLOT_CFG, &tmp);
5236         tmp &= ~0xff;
5237         tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
5238         run_write(sc, RT2860_BKOFF_SLOT_CFG, tmp);
5239 }
5240
5241 static void
5242 run_update_mcast(struct ifnet *ifp)
5243 {
5244         /* h/w filter supports getting everything or nothing */
5245         ifp->if_flags |= IFF_ALLMULTI;
5246 }
5247
5248 static int8_t
5249 run_rssi2dbm(struct run_softc *sc, uint8_t rssi, uint8_t rxchain)
5250 {
5251         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5252         struct ieee80211_channel *c = ic->ic_curchan;
5253         int delta;
5254
5255         if (IEEE80211_IS_CHAN_5GHZ(c)) {
5256                 u_int chan = ieee80211_chan2ieee(ic, c);
5257                 delta = sc->rssi_5ghz[rxchain];
5258
5259                 /* determine channel group */
5260                 if (chan <= 64)
5261                         delta -= sc->lna[1];
5262                 else if (chan <= 128)
5263                         delta -= sc->lna[2];
5264                 else
5265                         delta -= sc->lna[3];
5266         } else
5267                 delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
5268
5269         return (-12 - delta - rssi);
5270 }
5271
5272 static void
5273 run_rt5390_bbp_init(struct run_softc *sc)
5274 {
5275         int i;
5276         uint8_t bbp;
5277
5278         /* Apply maximum likelihood detection for 2 stream case. */
5279         run_bbp_read(sc, 105, &bbp);
5280         if (sc->nrxchains > 1)
5281                 run_bbp_write(sc, 105, bbp | RT5390_MLD);
5282
5283         /* Avoid data lost and CRC error. */
5284         run_bbp_read(sc, 4, &bbp);
5285         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5286
5287         if (sc->mac_ver == 0x5592) {
5288                 for (i = 0; i < nitems(rt5592_def_bbp); i++) {
5289                         run_bbp_write(sc, rt5592_def_bbp[i].reg,
5290                             rt5592_def_bbp[i].val);
5291                 }
5292                 for (i = 0; i < nitems(rt5592_bbp_r196); i++) {
5293                         run_bbp_write(sc, 195, i + 0x80);
5294                         run_bbp_write(sc, 196, rt5592_bbp_r196[i]);
5295                 }
5296         } else {
5297                 for (i = 0; i < nitems(rt5390_def_bbp); i++) {
5298                         run_bbp_write(sc, rt5390_def_bbp[i].reg,
5299                             rt5390_def_bbp[i].val);
5300                 }
5301         }
5302         if (sc->mac_ver == 0x5392) {
5303                 run_bbp_write(sc, 88, 0x90);
5304                 run_bbp_write(sc, 95, 0x9a);
5305                 run_bbp_write(sc, 98, 0x12);
5306                 run_bbp_write(sc, 106, 0x12);
5307                 run_bbp_write(sc, 134, 0xd0);
5308                 run_bbp_write(sc, 135, 0xf6);
5309                 run_bbp_write(sc, 148, 0x84);
5310         }
5311
5312         run_bbp_read(sc, 152, &bbp);
5313         run_bbp_write(sc, 152, bbp | 0x80);
5314
5315         /* Fix BBP254 for RT5592C. */
5316         if (sc->mac_ver == 0x5592 && sc->mac_rev >= 0x0221) {
5317                 run_bbp_read(sc, 254, &bbp);
5318                 run_bbp_write(sc, 254, bbp | 0x80);
5319         }
5320
5321         /* Disable hardware antenna diversity. */
5322         if (sc->mac_ver == 0x5390)
5323                 run_bbp_write(sc, 154, 0);
5324
5325         /* Initialize Rx CCK/OFDM frequency offset report. */
5326         run_bbp_write(sc, 142, 1);
5327         run_bbp_write(sc, 143, 57);
5328 }
5329
5330 static int
5331 run_bbp_init(struct run_softc *sc)
5332 {
5333         int i, error, ntries;
5334         uint8_t bbp0;
5335
5336         /* wait for BBP to wake up */
5337         for (ntries = 0; ntries < 20; ntries++) {
5338                 if ((error = run_bbp_read(sc, 0, &bbp0)) != 0)
5339                         return error;
5340                 if (bbp0 != 0 && bbp0 != 0xff)
5341                         break;
5342         }
5343         if (ntries == 20)
5344                 return (ETIMEDOUT);
5345
5346         /* initialize BBP registers to default values */
5347         if (sc->mac_ver >= 0x5390)
5348                 run_rt5390_bbp_init(sc);
5349         else {
5350                 for (i = 0; i < nitems(rt2860_def_bbp); i++) {
5351                         run_bbp_write(sc, rt2860_def_bbp[i].reg,
5352                             rt2860_def_bbp[i].val);
5353                 }
5354         }
5355
5356         if (sc->mac_ver == 0x3593) {
5357                 run_bbp_write(sc, 79, 0x13);
5358                 run_bbp_write(sc, 80, 0x05);
5359                 run_bbp_write(sc, 81, 0x33);
5360                 run_bbp_write(sc, 86, 0x46);
5361                 run_bbp_write(sc, 137, 0x0f);
5362         }
5363
5364         /* fix BBP84 for RT2860E */
5365         if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
5366                 run_bbp_write(sc, 84, 0x19);
5367
5368         if (sc->mac_ver >= 0x3070 && (sc->mac_ver != 0x3593 &&
5369             sc->mac_ver != 0x5592)) {
5370                 run_bbp_write(sc, 79, 0x13);
5371                 run_bbp_write(sc, 80, 0x05);
5372                 run_bbp_write(sc, 81, 0x33);
5373         } else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
5374                 run_bbp_write(sc, 69, 0x16);
5375                 run_bbp_write(sc, 73, 0x12);
5376         }
5377         return (0);
5378 }
5379
5380 static int
5381 run_rt3070_rf_init(struct run_softc *sc)
5382 {
5383         uint32_t tmp;
5384         uint8_t bbp4, mingain, rf, target;
5385         int i;
5386
5387         run_rt3070_rf_read(sc, 30, &rf);
5388         /* toggle RF R30 bit 7 */
5389         run_rt3070_rf_write(sc, 30, rf | 0x80);
5390         run_delay(sc, 10);
5391         run_rt3070_rf_write(sc, 30, rf & ~0x80);
5392
5393         /* initialize RF registers to default value */
5394         if (sc->mac_ver == 0x3572) {
5395                 for (i = 0; i < nitems(rt3572_def_rf); i++) {
5396                         run_rt3070_rf_write(sc, rt3572_def_rf[i].reg,
5397                             rt3572_def_rf[i].val);
5398                 }
5399         } else {
5400                 for (i = 0; i < nitems(rt3070_def_rf); i++) {
5401                         run_rt3070_rf_write(sc, rt3070_def_rf[i].reg,
5402                             rt3070_def_rf[i].val);
5403                 }
5404         }
5405
5406         if (sc->mac_ver == 0x3070 && sc->mac_rev < 0x0201) {
5407                 /*
5408                  * Change voltage from 1.2V to 1.35V for RT3070.
5409                  * The DAC issue (RT3070_LDO_CFG0) has been fixed
5410                  * in RT3070(F).
5411                  */
5412                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5413                 tmp = (tmp & ~0x0f000000) | 0x0d000000;
5414                 run_write(sc, RT3070_LDO_CFG0, tmp);
5415
5416         } else if (sc->mac_ver == 0x3071) {
5417                 run_rt3070_rf_read(sc, 6, &rf);
5418                 run_rt3070_rf_write(sc, 6, rf | 0x40);
5419                 run_rt3070_rf_write(sc, 31, 0x14);
5420
5421                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5422                 tmp &= ~0x1f000000;
5423                 if (sc->mac_rev < 0x0211)
5424                         tmp |= 0x0d000000;      /* 1.3V */
5425                 else
5426                         tmp |= 0x01000000;      /* 1.2V */
5427                 run_write(sc, RT3070_LDO_CFG0, tmp);
5428
5429                 /* patch LNA_PE_G1 */
5430                 run_read(sc, RT3070_GPIO_SWITCH, &tmp);
5431                 run_write(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
5432
5433         } else if (sc->mac_ver == 0x3572) {
5434                 run_rt3070_rf_read(sc, 6, &rf);
5435                 run_rt3070_rf_write(sc, 6, rf | 0x40);
5436
5437                 /* increase voltage from 1.2V to 1.35V */
5438                 run_read(sc, RT3070_LDO_CFG0, &tmp);
5439                 tmp = (tmp & ~0x1f000000) | 0x0d000000;
5440                 run_write(sc, RT3070_LDO_CFG0, tmp);
5441
5442                 if (sc->mac_rev < 0x0211 || !sc->patch_dac) {
5443                         run_delay(sc, 1);       /* wait for 1msec */
5444                         /* decrease voltage back to 1.2V */
5445                         tmp = (tmp & ~0x1f000000) | 0x01000000;
5446                         run_write(sc, RT3070_LDO_CFG0, tmp);
5447                 }
5448         }
5449
5450         /* select 20MHz bandwidth */
5451         run_rt3070_rf_read(sc, 31, &rf);
5452         run_rt3070_rf_write(sc, 31, rf & ~0x20);
5453
5454         /* calibrate filter for 20MHz bandwidth */
5455         sc->rf24_20mhz = 0x1f;  /* default value */
5456         target = (sc->mac_ver < 0x3071) ? 0x16 : 0x13;
5457         run_rt3070_filter_calib(sc, 0x07, target, &sc->rf24_20mhz);
5458
5459         /* select 40MHz bandwidth */
5460         run_bbp_read(sc, 4, &bbp4);
5461         run_bbp_write(sc, 4, (bbp4 & ~0x18) | 0x10);
5462         run_rt3070_rf_read(sc, 31, &rf);
5463         run_rt3070_rf_write(sc, 31, rf | 0x20);
5464
5465         /* calibrate filter for 40MHz bandwidth */
5466         sc->rf24_40mhz = 0x2f;  /* default value */
5467         target = (sc->mac_ver < 0x3071) ? 0x19 : 0x15;
5468         run_rt3070_filter_calib(sc, 0x27, target, &sc->rf24_40mhz);
5469
5470         /* go back to 20MHz bandwidth */
5471         run_bbp_read(sc, 4, &bbp4);
5472         run_bbp_write(sc, 4, bbp4 & ~0x18);
5473
5474         if (sc->mac_ver == 0x3572) {
5475                 /* save default BBP registers 25 and 26 values */
5476                 run_bbp_read(sc, 25, &sc->bbp25);
5477                 run_bbp_read(sc, 26, &sc->bbp26);
5478         } else if (sc->mac_rev < 0x0201 || sc->mac_rev < 0x0211)
5479                 run_rt3070_rf_write(sc, 27, 0x03);
5480
5481         run_read(sc, RT3070_OPT_14, &tmp);
5482         run_write(sc, RT3070_OPT_14, tmp | 1);
5483
5484         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
5485                 run_rt3070_rf_read(sc, 17, &rf);
5486                 rf &= ~RT3070_TX_LO1;
5487                 if ((sc->mac_ver == 0x3070 ||
5488                      (sc->mac_ver == 0x3071 && sc->mac_rev >= 0x0211)) &&
5489                     !sc->ext_2ghz_lna)
5490                         rf |= 0x20;     /* fix for long range Rx issue */
5491                 mingain = (sc->mac_ver == 0x3070) ? 1 : 2;
5492                 if (sc->txmixgain_2ghz >= mingain)
5493                         rf = (rf & ~0x7) | sc->txmixgain_2ghz;
5494                 run_rt3070_rf_write(sc, 17, rf);
5495         }
5496
5497         if (sc->mac_ver == 0x3071) {
5498                 run_rt3070_rf_read(sc, 1, &rf);
5499                 rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
5500                 rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
5501                 run_rt3070_rf_write(sc, 1, rf);
5502
5503                 run_rt3070_rf_read(sc, 15, &rf);
5504                 run_rt3070_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
5505
5506                 run_rt3070_rf_read(sc, 20, &rf);
5507                 run_rt3070_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
5508
5509                 run_rt3070_rf_read(sc, 21, &rf);
5510                 run_rt3070_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
5511         }
5512
5513         if (sc->mac_ver == 0x3070 || sc->mac_ver == 0x3071) {
5514                 /* fix Tx to Rx IQ glitch by raising RF voltage */
5515                 run_rt3070_rf_read(sc, 27, &rf);
5516                 rf &= ~0x77;
5517                 if (sc->mac_rev < 0x0211)
5518                         rf |= 0x03;
5519                 run_rt3070_rf_write(sc, 27, rf);
5520         }
5521         return (0);
5522 }
5523
5524 static void
5525 run_rt3593_rf_init(struct run_softc *sc)
5526 {
5527         uint32_t tmp;
5528         uint8_t rf;
5529         int i;
5530
5531         /* Disable the GPIO bits 4 and 7 for LNA PE control. */
5532         run_read(sc, RT3070_GPIO_SWITCH, &tmp);
5533         tmp &= ~(1 << 4 | 1 << 7);
5534         run_write(sc, RT3070_GPIO_SWITCH, tmp);
5535
5536         /* Initialize RF registers to default value. */
5537         for (i = 0; i < nitems(rt3593_def_rf); i++) {
5538                 run_rt3070_rf_write(sc, rt3593_def_rf[i].reg,
5539                     rt3593_def_rf[i].val);
5540         }
5541
5542         /* Toggle RF R2 to initiate calibration. */
5543         run_rt3070_rf_write(sc, 2, RT5390_RESCAL);
5544
5545         /* Initialize RF frequency offset. */
5546         run_adjust_freq_offset(sc);
5547
5548         run_rt3070_rf_read(sc, 18, &rf);
5549         run_rt3070_rf_write(sc, 18, rf | RT3593_AUTOTUNE_BYPASS);
5550
5551         /*
5552          * Increase voltage from 1.2V to 1.35V, wait for 1 msec to
5553          * decrease voltage back to 1.2V.
5554          */
5555         run_read(sc, RT3070_LDO_CFG0, &tmp);
5556         tmp = (tmp & ~0x1f000000) | 0x0d000000;
5557         run_write(sc, RT3070_LDO_CFG0, tmp);
5558         run_delay(sc, 1);
5559         tmp = (tmp & ~0x1f000000) | 0x01000000;
5560         run_write(sc, RT3070_LDO_CFG0, tmp);
5561
5562         sc->rf24_20mhz = 0x1f;
5563         sc->rf24_40mhz = 0x2f;
5564
5565         /* Save default BBP registers 25 and 26 values. */
5566         run_bbp_read(sc, 25, &sc->bbp25);
5567         run_bbp_read(sc, 26, &sc->bbp26);
5568
5569         run_read(sc, RT3070_OPT_14, &tmp);
5570         run_write(sc, RT3070_OPT_14, tmp | 1);
5571 }
5572
5573 static void
5574 run_rt5390_rf_init(struct run_softc *sc)
5575 {
5576         uint32_t tmp;
5577         uint8_t rf;
5578         int i;
5579
5580         /* Toggle RF R2 to initiate calibration. */
5581         if (sc->mac_ver == 0x5390) {
5582                 run_rt3070_rf_read(sc, 2, &rf);
5583                 run_rt3070_rf_write(sc, 2, rf | RT5390_RESCAL);
5584                 run_delay(sc, 10);
5585                 run_rt3070_rf_write(sc, 2, rf & ~RT5390_RESCAL);
5586         } else {
5587                 run_rt3070_rf_write(sc, 2, RT5390_RESCAL);
5588                 run_delay(sc, 10);
5589         }
5590
5591         /* Initialize RF registers to default value. */
5592         if (sc->mac_ver == 0x5592) {
5593                 for (i = 0; i < nitems(rt5592_def_rf); i++) {
5594                         run_rt3070_rf_write(sc, rt5592_def_rf[i].reg,
5595                             rt5592_def_rf[i].val);
5596                 }
5597                 /* Initialize RF frequency offset. */
5598                 run_adjust_freq_offset(sc);
5599         } else if (sc->mac_ver == 0x5392) {
5600                 for (i = 0; i < nitems(rt5392_def_rf); i++) {
5601                         run_rt3070_rf_write(sc, rt5392_def_rf[i].reg,
5602                             rt5392_def_rf[i].val);
5603                 }
5604                 if (sc->mac_rev >= 0x0223) {
5605                         run_rt3070_rf_write(sc, 23, 0x0f);
5606                         run_rt3070_rf_write(sc, 24, 0x3e);
5607                         run_rt3070_rf_write(sc, 51, 0x32);
5608                         run_rt3070_rf_write(sc, 53, 0x22);
5609                         run_rt3070_rf_write(sc, 56, 0xc1);
5610                         run_rt3070_rf_write(sc, 59, 0x0f);
5611                 }
5612         } else {
5613                 for (i = 0; i < nitems(rt5390_def_rf); i++) {
5614                         run_rt3070_rf_write(sc, rt5390_def_rf[i].reg,
5615                             rt5390_def_rf[i].val);
5616                 }
5617                 if (sc->mac_rev >= 0x0502) {
5618                         run_rt3070_rf_write(sc, 6, 0xe0);
5619                         run_rt3070_rf_write(sc, 25, 0x80);
5620                         run_rt3070_rf_write(sc, 46, 0x73);
5621                         run_rt3070_rf_write(sc, 53, 0x00);
5622                         run_rt3070_rf_write(sc, 56, 0x42);
5623                         run_rt3070_rf_write(sc, 61, 0xd1);
5624                 }
5625         }
5626
5627         sc->rf24_20mhz = 0x1f;  /* default value */
5628         sc->rf24_40mhz = (sc->mac_ver == 0x5592) ? 0 : 0x2f;
5629
5630         if (sc->mac_rev < 0x0211)
5631                 run_rt3070_rf_write(sc, 27, 0x3);
5632
5633         run_read(sc, RT3070_OPT_14, &tmp);
5634         run_write(sc, RT3070_OPT_14, tmp | 1);
5635 }
5636
5637 static int
5638 run_rt3070_filter_calib(struct run_softc *sc, uint8_t init, uint8_t target,
5639     uint8_t *val)
5640 {
5641         uint8_t rf22, rf24;
5642         uint8_t bbp55_pb, bbp55_sb, delta;
5643         int ntries;
5644
5645         /* program filter */
5646         run_rt3070_rf_read(sc, 24, &rf24);
5647         rf24 = (rf24 & 0xc0) | init;    /* initial filter value */
5648         run_rt3070_rf_write(sc, 24, rf24);
5649
5650         /* enable baseband loopback mode */
5651         run_rt3070_rf_read(sc, 22, &rf22);
5652         run_rt3070_rf_write(sc, 22, rf22 | 0x01);
5653
5654         /* set power and frequency of passband test tone */
5655         run_bbp_write(sc, 24, 0x00);
5656         for (ntries = 0; ntries < 100; ntries++) {
5657                 /* transmit test tone */
5658                 run_bbp_write(sc, 25, 0x90);
5659                 run_delay(sc, 10);
5660                 /* read received power */
5661                 run_bbp_read(sc, 55, &bbp55_pb);
5662                 if (bbp55_pb != 0)
5663                         break;
5664         }
5665         if (ntries == 100)
5666                 return (ETIMEDOUT);
5667
5668         /* set power and frequency of stopband test tone */
5669         run_bbp_write(sc, 24, 0x06);
5670         for (ntries = 0; ntries < 100; ntries++) {
5671                 /* transmit test tone */
5672                 run_bbp_write(sc, 25, 0x90);
5673                 run_delay(sc, 10);
5674                 /* read received power */
5675                 run_bbp_read(sc, 55, &bbp55_sb);
5676
5677                 delta = bbp55_pb - bbp55_sb;
5678                 if (delta > target)
5679                         break;
5680
5681                 /* reprogram filter */
5682                 rf24++;
5683                 run_rt3070_rf_write(sc, 24, rf24);
5684         }
5685         if (ntries < 100) {
5686                 if (rf24 != init)
5687                         rf24--; /* backtrack */
5688                 *val = rf24;
5689                 run_rt3070_rf_write(sc, 24, rf24);
5690         }
5691
5692         /* restore initial state */
5693         run_bbp_write(sc, 24, 0x00);
5694
5695         /* disable baseband loopback mode */
5696         run_rt3070_rf_read(sc, 22, &rf22);
5697         run_rt3070_rf_write(sc, 22, rf22 & ~0x01);
5698
5699         return (0);
5700 }
5701
5702 static void
5703 run_rt3070_rf_setup(struct run_softc *sc)
5704 {
5705         uint8_t bbp, rf;
5706         int i;
5707
5708         if (sc->mac_ver == 0x3572) {
5709                 /* enable DC filter */
5710                 if (sc->mac_rev >= 0x0201)
5711                         run_bbp_write(sc, 103, 0xc0);
5712
5713                 run_bbp_read(sc, 138, &bbp);
5714                 if (sc->ntxchains == 1)
5715                         bbp |= 0x20;    /* turn off DAC1 */
5716                 if (sc->nrxchains == 1)
5717                         bbp &= ~0x02;   /* turn off ADC1 */
5718                 run_bbp_write(sc, 138, bbp);
5719
5720                 if (sc->mac_rev >= 0x0211) {
5721                         /* improve power consumption */
5722                         run_bbp_read(sc, 31, &bbp);
5723                         run_bbp_write(sc, 31, bbp & ~0x03);
5724                 }
5725
5726                 run_rt3070_rf_read(sc, 16, &rf);
5727                 rf = (rf & ~0x07) | sc->txmixgain_2ghz;
5728                 run_rt3070_rf_write(sc, 16, rf);
5729
5730         } else if (sc->mac_ver == 0x3071) {
5731                 if (sc->mac_rev >= 0x0211) {
5732                         /* enable DC filter */
5733                         run_bbp_write(sc, 103, 0xc0);
5734
5735                         /* improve power consumption */
5736                         run_bbp_read(sc, 31, &bbp);
5737                         run_bbp_write(sc, 31, bbp & ~0x03);
5738                 }
5739
5740                 run_bbp_read(sc, 138, &bbp);
5741                 if (sc->ntxchains == 1)
5742                         bbp |= 0x20;    /* turn off DAC1 */
5743                 if (sc->nrxchains == 1)
5744                         bbp &= ~0x02;   /* turn off ADC1 */
5745                 run_bbp_write(sc, 138, bbp);
5746
5747                 run_write(sc, RT2860_TX_SW_CFG1, 0);
5748                 if (sc->mac_rev < 0x0211) {
5749                         run_write(sc, RT2860_TX_SW_CFG2,
5750                             sc->patch_dac ? 0x2c : 0x0f);
5751                 } else
5752                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5753
5754         } else if (sc->mac_ver == 0x3070) {
5755                 if (sc->mac_rev >= 0x0201) {
5756                         /* enable DC filter */
5757                         run_bbp_write(sc, 103, 0xc0);
5758
5759                         /* improve power consumption */
5760                         run_bbp_read(sc, 31, &bbp);
5761                         run_bbp_write(sc, 31, bbp & ~0x03);
5762                 }
5763
5764                 if (sc->mac_rev < 0x0201) {
5765                         run_write(sc, RT2860_TX_SW_CFG1, 0);
5766                         run_write(sc, RT2860_TX_SW_CFG2, 0x2c);
5767                 } else
5768                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5769         }
5770
5771         /* initialize RF registers from ROM for >=RT3071*/
5772         if (sc->mac_ver >= 0x3071) {
5773                 for (i = 0; i < 10; i++) {
5774                         if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
5775                                 continue;
5776                         run_rt3070_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
5777                 }
5778         }
5779 }
5780
5781 static void
5782 run_rt3593_rf_setup(struct run_softc *sc)
5783 {
5784         uint8_t bbp, rf;
5785
5786         if (sc->mac_rev >= 0x0211) {
5787                 /* Enable DC filter. */
5788                 run_bbp_write(sc, 103, 0xc0);
5789         }
5790         run_write(sc, RT2860_TX_SW_CFG1, 0);
5791         if (sc->mac_rev < 0x0211) {
5792                 run_write(sc, RT2860_TX_SW_CFG2,
5793                     sc->patch_dac ? 0x2c : 0x0f);
5794         } else
5795                 run_write(sc, RT2860_TX_SW_CFG2, 0);
5796
5797         run_rt3070_rf_read(sc, 50, &rf);
5798         run_rt3070_rf_write(sc, 50, rf & ~RT3593_TX_LO2);
5799
5800         run_rt3070_rf_read(sc, 51, &rf);
5801         rf = (rf & ~(RT3593_TX_LO1 | 0x0c)) |
5802             ((sc->txmixgain_2ghz & 0x07) << 2);
5803         run_rt3070_rf_write(sc, 51, rf);
5804
5805         run_rt3070_rf_read(sc, 38, &rf);
5806         run_rt3070_rf_write(sc, 38, rf & ~RT5390_RX_LO1);
5807
5808         run_rt3070_rf_read(sc, 39, &rf);
5809         run_rt3070_rf_write(sc, 39, rf & ~RT5390_RX_LO2);
5810
5811         run_rt3070_rf_read(sc, 1, &rf);
5812         run_rt3070_rf_write(sc, 1, rf & ~(RT3070_RF_BLOCK | RT3070_PLL_PD));
5813
5814         run_rt3070_rf_read(sc, 30, &rf);
5815         rf = (rf & ~0x18) | 0x10;
5816         run_rt3070_rf_write(sc, 30, rf);
5817
5818         /* Apply maximum likelihood detection for 2 stream case. */
5819         run_bbp_read(sc, 105, &bbp);
5820         if (sc->nrxchains > 1)
5821                 run_bbp_write(sc, 105, bbp | RT5390_MLD);
5822
5823         /* Avoid data lost and CRC error. */
5824         run_bbp_read(sc, 4, &bbp);
5825         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5826
5827         run_bbp_write(sc, 92, 0x02);
5828         run_bbp_write(sc, 82, 0x82);
5829         run_bbp_write(sc, 106, 0x05);
5830         run_bbp_write(sc, 104, 0x92);
5831         run_bbp_write(sc, 88, 0x90);
5832         run_bbp_write(sc, 148, 0xc8);
5833         run_bbp_write(sc, 47, 0x48);
5834         run_bbp_write(sc, 120, 0x50);
5835
5836         run_bbp_write(sc, 163, 0x9d);
5837
5838         /* SNR mapping. */
5839         run_bbp_write(sc, 142, 0x06);
5840         run_bbp_write(sc, 143, 0xa0);
5841         run_bbp_write(sc, 142, 0x07);
5842         run_bbp_write(sc, 143, 0xa1);
5843         run_bbp_write(sc, 142, 0x08);
5844         run_bbp_write(sc, 143, 0xa2);
5845
5846         run_bbp_write(sc, 31, 0x08);
5847         run_bbp_write(sc, 68, 0x0b);
5848         run_bbp_write(sc, 105, 0x04);
5849 }
5850
5851 static void
5852 run_rt5390_rf_setup(struct run_softc *sc)
5853 {
5854         uint8_t bbp, rf;
5855
5856         if (sc->mac_rev >= 0x0211) {
5857                 /* Enable DC filter. */
5858                 run_bbp_write(sc, 103, 0xc0);
5859
5860                 if (sc->mac_ver != 0x5592) {
5861                         /* Improve power consumption. */
5862                         run_bbp_read(sc, 31, &bbp);
5863                         run_bbp_write(sc, 31, bbp & ~0x03);
5864                 }
5865         }
5866
5867         run_bbp_read(sc, 138, &bbp);
5868         if (sc->ntxchains == 1)
5869                 bbp |= 0x20;    /* turn off DAC1 */
5870         if (sc->nrxchains == 1)
5871                 bbp &= ~0x02;   /* turn off ADC1 */
5872         run_bbp_write(sc, 138, bbp);
5873
5874         run_rt3070_rf_read(sc, 38, &rf);
5875         run_rt3070_rf_write(sc, 38, rf & ~RT5390_RX_LO1);
5876
5877         run_rt3070_rf_read(sc, 39, &rf);
5878         run_rt3070_rf_write(sc, 39, rf & ~RT5390_RX_LO2);
5879
5880         /* Avoid data lost and CRC error. */
5881         run_bbp_read(sc, 4, &bbp);
5882         run_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
5883
5884         run_rt3070_rf_read(sc, 30, &rf);
5885         rf = (rf & ~0x18) | 0x10;
5886         run_rt3070_rf_write(sc, 30, rf);
5887
5888         if (sc->mac_ver != 0x5592) {
5889                 run_write(sc, RT2860_TX_SW_CFG1, 0);
5890                 if (sc->mac_rev < 0x0211) {
5891                         run_write(sc, RT2860_TX_SW_CFG2,
5892                             sc->patch_dac ? 0x2c : 0x0f);
5893                 } else
5894                         run_write(sc, RT2860_TX_SW_CFG2, 0);
5895         }
5896 }
5897
5898 static int
5899 run_txrx_enable(struct run_softc *sc)
5900 {
5901         struct ieee80211com *ic = sc->sc_ifp->if_l2com;
5902         uint32_t tmp;
5903         int error, ntries;
5904
5905         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
5906         for (ntries = 0; ntries < 200; ntries++) {
5907                 if ((error = run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp)) != 0)
5908                         return (error);
5909                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
5910                         break;
5911                 run_delay(sc, 50);
5912         }
5913         if (ntries == 200)
5914                 return (ETIMEDOUT);
5915
5916         run_delay(sc, 50);
5917
5918         tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN | RT2860_TX_WB_DDONE;
5919         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
5920
5921         /* enable Rx bulk aggregation (set timeout and limit) */
5922         tmp = RT2860_USB_TX_EN | RT2860_USB_RX_EN | RT2860_USB_RX_AGG_EN |
5923             RT2860_USB_RX_AGG_TO(128) | RT2860_USB_RX_AGG_LMT(2);
5924         run_write(sc, RT2860_USB_DMA_CFG, tmp);
5925
5926         /* set Rx filter */
5927         tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
5928         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
5929                 tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
5930                     RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
5931                     RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
5932                     RT2860_DROP_CFACK | RT2860_DROP_CFEND;
5933                 if (ic->ic_opmode == IEEE80211_M_STA)
5934                         tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
5935         }
5936         run_write(sc, RT2860_RX_FILTR_CFG, tmp);
5937
5938         run_write(sc, RT2860_MAC_SYS_CTRL,
5939             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
5940
5941         return (0);
5942 }
5943
5944 static void
5945 run_adjust_freq_offset(struct run_softc *sc)
5946 {
5947         uint8_t rf, tmp;
5948
5949         run_rt3070_rf_read(sc, 17, &rf);
5950         tmp = rf;
5951         rf = (rf & ~0x7f) | (sc->freq & 0x7f);
5952         rf = MIN(rf, 0x5f);
5953
5954         if (tmp != rf)
5955                 run_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf);
5956 }
5957
5958 static void
5959 run_init_locked(struct run_softc *sc)
5960 {
5961         struct ifnet *ifp = sc->sc_ifp;
5962         struct ieee80211com *ic = ifp->if_l2com;
5963         uint32_t tmp;
5964         uint8_t bbp1, bbp3;
5965         int i;
5966         int ridx;
5967         int ntries;
5968
5969         if (ic->ic_nrunning > 1)
5970                 return;
5971
5972         run_stop(sc);
5973
5974         if (run_load_microcode(sc) != 0) {
5975                 device_printf(sc->sc_dev, "could not load 8051 microcode\n");
5976                 goto fail;
5977         }
5978
5979         for (ntries = 0; ntries < 100; ntries++) {
5980                 if (run_read(sc, RT2860_ASIC_VER_ID, &tmp) != 0)
5981                         goto fail;
5982                 if (tmp != 0 && tmp != 0xffffffff)
5983                         break;
5984                 run_delay(sc, 10);
5985         }
5986         if (ntries == 100)
5987                 goto fail;
5988
5989         for (i = 0; i != RUN_EP_QUEUES; i++)
5990                 run_setup_tx_list(sc, &sc->sc_epq[i]);
5991
5992         run_set_macaddr(sc, IF_LLADDR(ifp));
5993
5994         for (ntries = 0; ntries < 100; ntries++) {
5995                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
5996                         goto fail;
5997                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
5998                         break;
5999                 run_delay(sc, 10);
6000         }
6001         if (ntries == 100) {
6002                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
6003                 goto fail;
6004         }
6005         tmp &= 0xff0;
6006         tmp |= RT2860_TX_WB_DDONE;
6007         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
6008
6009         /* turn off PME_OEN to solve high-current issue */
6010         run_read(sc, RT2860_SYS_CTRL, &tmp);
6011         run_write(sc, RT2860_SYS_CTRL, tmp & ~RT2860_PME_OEN);
6012
6013         run_write(sc, RT2860_MAC_SYS_CTRL,
6014             RT2860_BBP_HRST | RT2860_MAC_SRST);
6015         run_write(sc, RT2860_USB_DMA_CFG, 0);
6016
6017         if (run_reset(sc) != 0) {
6018                 device_printf(sc->sc_dev, "could not reset chipset\n");
6019                 goto fail;
6020         }
6021
6022         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
6023
6024         /* init Tx power for all Tx rates (from EEPROM) */
6025         for (ridx = 0; ridx < 5; ridx++) {
6026                 if (sc->txpow20mhz[ridx] == 0xffffffff)
6027                         continue;
6028                 run_write(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
6029         }
6030
6031         for (i = 0; i < nitems(rt2870_def_mac); i++)
6032                 run_write(sc, rt2870_def_mac[i].reg, rt2870_def_mac[i].val);
6033         run_write(sc, RT2860_WMM_AIFSN_CFG, 0x00002273);
6034         run_write(sc, RT2860_WMM_CWMIN_CFG, 0x00002344);
6035         run_write(sc, RT2860_WMM_CWMAX_CFG, 0x000034aa);
6036
6037         if (sc->mac_ver >= 0x5390) {
6038                 run_write(sc, RT2860_TX_SW_CFG0,
6039                     4 << RT2860_DLY_PAPE_EN_SHIFT | 4);
6040                 if (sc->mac_ver >= 0x5392) {
6041                         run_write(sc, RT2860_MAX_LEN_CFG, 0x00002fff);
6042                         if (sc->mac_ver == 0x5592) {
6043                                 run_write(sc, RT2860_HT_FBK_CFG1, 0xedcba980);
6044                                 run_write(sc, RT2860_TXOP_HLDR_ET, 0x00000082);
6045                         } else {
6046                                 run_write(sc, RT2860_HT_FBK_CFG1, 0xedcb4980);
6047                                 run_write(sc, RT2860_LG_FBK_CFG0, 0xedcba322);
6048                         }
6049                 }
6050         } else if (sc->mac_ver == 0x3593) {
6051                 run_write(sc, RT2860_TX_SW_CFG0,
6052                     4 << RT2860_DLY_PAPE_EN_SHIFT | 2);
6053         } else if (sc->mac_ver >= 0x3070) {
6054                 /* set delay of PA_PE assertion to 1us (unit of 0.25us) */
6055                 run_write(sc, RT2860_TX_SW_CFG0,
6056                     4 << RT2860_DLY_PAPE_EN_SHIFT);
6057         }
6058
6059         /* wait while MAC is busy */
6060         for (ntries = 0; ntries < 100; ntries++) {
6061                 if (run_read(sc, RT2860_MAC_STATUS_REG, &tmp) != 0)
6062                         goto fail;
6063                 if (!(tmp & (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
6064                         break;
6065                 run_delay(sc, 10);
6066         }
6067         if (ntries == 100)
6068                 goto fail;
6069
6070         /* clear Host to MCU mailbox */
6071         run_write(sc, RT2860_H2M_BBPAGENT, 0);
6072         run_write(sc, RT2860_H2M_MAILBOX, 0);
6073         run_delay(sc, 10);
6074
6075         if (run_bbp_init(sc) != 0) {
6076                 device_printf(sc->sc_dev, "could not initialize BBP\n");
6077                 goto fail;
6078         }
6079
6080         /* abort TSF synchronization */
6081         run_read(sc, RT2860_BCN_TIME_CFG, &tmp);
6082         tmp &= ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
6083             RT2860_TBTT_TIMER_EN);
6084         run_write(sc, RT2860_BCN_TIME_CFG, tmp);
6085
6086         /* clear RX WCID search table */
6087         run_set_region_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
6088         /* clear WCID attribute table */
6089         run_set_region_4(sc, RT2860_WCID_ATTR(0), 0, 8 * 32);
6090
6091         /* hostapd sets a key before init. So, don't clear it. */
6092         if (sc->cmdq_key_set != RUN_CMDQ_GO) {
6093                 /* clear shared key table */
6094                 run_set_region_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
6095                 /* clear shared key mode */
6096                 run_set_region_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
6097         }
6098
6099         run_read(sc, RT2860_US_CYC_CNT, &tmp);
6100         tmp = (tmp & ~0xff) | 0x1e;
6101         run_write(sc, RT2860_US_CYC_CNT, tmp);
6102
6103         if (sc->mac_rev != 0x0101)
6104                 run_write(sc, RT2860_TXOP_CTRL_CFG, 0x0000583f);
6105
6106         run_write(sc, RT2860_WMM_TXOP0_CFG, 0);
6107         run_write(sc, RT2860_WMM_TXOP1_CFG, 48 << 16 | 96);
6108
6109         /* write vendor-specific BBP values (from EEPROM) */
6110         if (sc->mac_ver < 0x3593) {
6111                 for (i = 0; i < 10; i++) {
6112                         if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
6113                                 continue;
6114                         run_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
6115                 }
6116         }
6117
6118         /* select Main antenna for 1T1R devices */
6119         if (sc->rf_rev == RT3070_RF_3020 || sc->rf_rev == RT5390_RF_5370)
6120                 run_set_rx_antenna(sc, 0);
6121
6122         /* send LEDs operating mode to microcontroller */
6123         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0]);
6124         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1]);
6125         (void)run_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2]);
6126
6127         if (sc->mac_ver >= 0x5390)
6128                 run_rt5390_rf_init(sc);
6129         else if (sc->mac_ver == 0x3593)
6130                 run_rt3593_rf_init(sc);
6131         else if (sc->mac_ver >= 0x3070)
6132                 run_rt3070_rf_init(sc);
6133
6134         /* disable non-existing Rx chains */
6135         run_bbp_read(sc, 3, &bbp3);
6136         bbp3 &= ~(1 << 3 | 1 << 4);
6137         if (sc->nrxchains == 2)
6138                 bbp3 |= 1 << 3;
6139         else if (sc->nrxchains == 3)
6140                 bbp3 |= 1 << 4;
6141         run_bbp_write(sc, 3, bbp3);
6142
6143         /* disable non-existing Tx chains */
6144         run_bbp_read(sc, 1, &bbp1);
6145         if (sc->ntxchains == 1)
6146                 bbp1 &= ~(1 << 3 | 1 << 4);
6147         run_bbp_write(sc, 1, bbp1);
6148
6149         if (sc->mac_ver >= 0x5390)
6150                 run_rt5390_rf_setup(sc);
6151         else if (sc->mac_ver == 0x3593)
6152                 run_rt3593_rf_setup(sc);
6153         else if (sc->mac_ver >= 0x3070)
6154                 run_rt3070_rf_setup(sc);
6155
6156         /* select default channel */
6157         run_set_chan(sc, ic->ic_curchan);
6158
6159         /* setup initial protection mode */
6160         run_updateprot_cb(ic);
6161
6162         /* turn radio LED on */
6163         run_set_leds(sc, RT2860_LED_RADIO);
6164
6165         ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
6166         ifp->if_drv_flags |= IFF_DRV_RUNNING;
6167         sc->cmdq_run = RUN_CMDQ_GO;
6168
6169         for (i = 0; i != RUN_N_XFER; i++)
6170                 usbd_xfer_set_stall(sc->sc_xfer[i]);
6171
6172         usbd_transfer_start(sc->sc_xfer[RUN_BULK_RX]);
6173
6174         if (run_txrx_enable(sc) != 0)
6175                 goto fail;
6176
6177         return;
6178
6179 fail:
6180         run_stop(sc);
6181 }
6182
6183 static void
6184 run_init(void *arg)
6185 {
6186         struct run_softc *sc = arg;
6187         struct ifnet *ifp = sc->sc_ifp;
6188         struct ieee80211com *ic = ifp->if_l2com;
6189
6190         RUN_LOCK(sc);
6191         run_init_locked(sc);
6192         RUN_UNLOCK(sc);
6193
6194         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
6195                 ieee80211_start_all(ic);
6196 }
6197
6198 static void
6199 run_stop(void *arg)
6200 {
6201         struct run_softc *sc = (struct run_softc *)arg;
6202         struct ifnet *ifp = sc->sc_ifp;
6203         uint32_t tmp;
6204         int i;
6205         int ntries;
6206
6207         RUN_LOCK_ASSERT(sc, MA_OWNED);
6208
6209         if (ifp->if_drv_flags & IFF_DRV_RUNNING)
6210                 run_set_leds(sc, 0);    /* turn all LEDs off */
6211
6212         ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
6213
6214         sc->ratectl_run = RUN_RATECTL_OFF;
6215         sc->cmdq_run = sc->cmdq_key_set;
6216
6217         RUN_UNLOCK(sc);
6218
6219         for(i = 0; i < RUN_N_XFER; i++)
6220                 usbd_transfer_drain(sc->sc_xfer[i]);
6221
6222         RUN_LOCK(sc);
6223
6224         if (sc->rx_m != NULL) {
6225                 m_free(sc->rx_m);
6226                 sc->rx_m = NULL;
6227         }
6228
6229         /* Disable Tx/Rx DMA. */
6230         if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6231                 return;
6232         tmp &= ~(RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
6233         run_write(sc, RT2860_WPDMA_GLO_CFG, tmp);
6234
6235         for (ntries = 0; ntries < 100; ntries++) {
6236                 if (run_read(sc, RT2860_WPDMA_GLO_CFG, &tmp) != 0)
6237                         return;
6238                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
6239                                 break;
6240                 run_delay(sc, 10);
6241         }
6242         if (ntries == 100) {
6243                 device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
6244                 return;
6245         }
6246
6247         /* disable Tx/Rx */
6248         run_read(sc, RT2860_MAC_SYS_CTRL, &tmp);
6249         tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
6250         run_write(sc, RT2860_MAC_SYS_CTRL, tmp);
6251
6252         /* wait for pending Tx to complete */
6253         for (ntries = 0; ntries < 100; ntries++) {
6254                 if (run_read(sc, RT2860_TXRXQ_PCNT, &tmp) != 0) {
6255                         DPRINTF("Cannot read Tx queue count\n");
6256                         break;
6257                 }
6258                 if ((tmp & RT2860_TX2Q_PCNT_MASK) == 0) {
6259                         DPRINTF("All Tx cleared\n");
6260                         break;
6261                 }
6262                 run_delay(sc, 10);
6263         }
6264         if (ntries >= 100)
6265                 DPRINTF("There are still pending Tx\n");
6266         run_delay(sc, 10);
6267         run_write(sc, RT2860_USB_DMA_CFG, 0);
6268
6269         run_write(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
6270         run_write(sc, RT2860_MAC_SYS_CTRL, 0);
6271
6272         for (i = 0; i != RUN_EP_QUEUES; i++)
6273                 run_unsetup_tx_list(sc, &sc->sc_epq[i]);
6274 }
6275
6276 static void
6277 run_delay(struct run_softc *sc, u_int ms)
6278 {
6279         usb_pause_mtx(mtx_owned(&sc->sc_mtx) ?
6280             &sc->sc_mtx : NULL, USB_MS_TO_TICKS(ms));
6281 }
6282
6283 static device_method_t run_methods[] = {
6284         /* Device interface */
6285         DEVMETHOD(device_probe,         run_match),
6286         DEVMETHOD(device_attach,        run_attach),
6287         DEVMETHOD(device_detach,        run_detach),
6288         DEVMETHOD_END
6289 };
6290
6291 static driver_t run_driver = {
6292         .name = "run",
6293         .methods = run_methods,
6294         .size = sizeof(struct run_softc)
6295 };
6296
6297 static devclass_t run_devclass;
6298
6299 DRIVER_MODULE(run, uhub, run_driver, run_devclass, run_driver_loaded, NULL);
6300 MODULE_DEPEND(run, wlan, 1, 1, 1);
6301 MODULE_DEPEND(run, usb, 1, 1, 1);
6302 MODULE_DEPEND(run, firmware, 1, 1, 1);
6303 MODULE_VERSION(run, 1);