xref: /netbsd-src/sys/dev/ic/rt2860.c (revision a24efa7dea9f1f56c3bdb15a927d3516792ace1c)
1 /*	$NetBSD: rt2860.c,v 1.10 2016/05/26 05:04:46 ozaki-r Exp $	*/
2 /*	$OpenBSD: rt2860.c,v 1.90 2016/04/13 10:49:26 mpi Exp $	*/
3 
4 /*-
5  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*-
21  * Ralink Technology RT2860/RT3090/RT3390/RT3562 chipset driver
22  * http://www.ralinktech.com/
23  */
24 
25 #include <sys/cdefs.h>
26 __KERNEL_RCSID(0, "$NetBSD: rt2860.c,v 1.10 2016/05/26 05:04:46 ozaki-r Exp $");
27 
28 #include <sys/param.h>
29 #include <sys/sockio.h>
30 #include <sys/sysctl.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/queue.h>
37 #include <sys/callout.h>
38 #include <sys/module.h>
39 #include <sys/conf.h>
40 #include <sys/device.h>
41 #include <sys/endian.h>
42 #include <sys/cprng.h>
43 
44 #include <sys/bus.h>
45 #include <sys/intr.h>
46 
47 #include <net/bpf.h>
48 #include <net/if.h>
49 #include <net/if_dl.h>
50 #include <net/if_ether.h>
51 #include <net/if_media.h>
52 
53 #include <net80211/ieee80211_var.h>
54 #include <net80211/ieee80211_amrr.h>
55 #include <net80211/ieee80211_radiotap.h>
56 
57 #include <dev/firmload.h>
58 
59 #include <dev/ic/rt2860var.h>
60 #include <dev/ic/rt2860reg.h>
61 
62 #include <dev/pci/pcidevs.h>
63 
64 #ifdef RAL_DEBUG
65 #define DPRINTF(x)	do { if (rt2860_debug > 0) printf x; } while (0)
66 #define DPRINTFN(n, x)	do { if (rt2860_debug >= (n)) printf x; } while (0)
67 int rt2860_debug = 0;
68 #else
69 #define DPRINTF(x)
70 #define DPRINTFN(n, x)
71 #endif
72 #define MAXQS	6 /* Tx (4 EDCAs + HCCA + Mgt) and Rx rings */
73 
74 static void	rt2860_attachhook(device_t);
75 static int	rt2860_alloc_tx_ring(struct rt2860_softc *,
76 		    struct rt2860_tx_ring *);
77 static void	rt2860_reset_tx_ring(struct rt2860_softc *,
78 		    struct rt2860_tx_ring *);
79 static void	rt2860_free_tx_ring(struct rt2860_softc *,
80 		    struct rt2860_tx_ring *);
81 static int	rt2860_alloc_tx_pool(struct rt2860_softc *);
82 static void	rt2860_free_tx_pool(struct rt2860_softc *);
83 static int	rt2860_alloc_rx_ring(struct rt2860_softc *,
84 		    struct rt2860_rx_ring *);
85 static void	rt2860_reset_rx_ring(struct rt2860_softc *,
86 		    struct rt2860_rx_ring *);
87 static void	rt2860_free_rx_ring(struct rt2860_softc *,
88 		    struct rt2860_rx_ring *);
89 static struct	ieee80211_node *rt2860_node_alloc(struct ieee80211_node_table *);
90 static int	rt2860_media_change(struct ifnet *);
91 static void	rt2860_iter_func(void *, struct ieee80211_node *);
92 static void	rt2860_updatestats(struct rt2860_softc *);
93 static void	rt2860_newassoc(struct ieee80211_node *,
94 		    int);
95 #ifdef notyet
96 static int	rt2860_ampdu_rx_start(struct ieee80211com *,
97 		    struct ieee80211_node *, uint8_t);
98 static void	rt2860_ampdu_rx_stop(struct ieee80211com *,
99 		    struct ieee80211_node *, uint8_t);
100 #endif
101 static int	rt2860_newstate(struct ieee80211com *, enum ieee80211_state,
102 		    int);
103 static uint16_t	rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
104 static uint16_t	rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
105 static void	rt2860_intr_coherent(struct rt2860_softc *);
106 static void	rt2860_drain_stats_fifo(struct rt2860_softc *);
107 static void	rt2860_tx_intr(struct rt2860_softc *, int);
108 static void	rt2860_rx_intr(struct rt2860_softc *);
109 static void	rt2860_tbtt_intr(struct rt2860_softc *);
110 static void	rt2860_gp_intr(struct rt2860_softc *);
111 static int	rt2860_tx(struct rt2860_softc *, struct mbuf *,
112 		    struct ieee80211_node *);
113 static void	rt2860_start(struct ifnet *);
114 static void	rt2860_watchdog(struct ifnet *);
115 static int	rt2860_ioctl(struct ifnet *, u_long, void *);
116 static void	rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
117 static uint8_t	rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
118 static void	rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
119 static uint8_t	rt3090_rf_read(struct rt2860_softc *, uint8_t);
120 static void	rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
121 static int	rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
122 static void	rt2860_enable_mrr(struct rt2860_softc *);
123 static void	rt2860_set_txpreamble(struct rt2860_softc *);
124 static void	rt2860_set_basicrates(struct rt2860_softc *);
125 static void	rt2860_select_chan_group(struct rt2860_softc *, int);
126 static void	rt2860_set_chan(struct rt2860_softc *, u_int);
127 static void	rt3090_set_chan(struct rt2860_softc *, u_int);
128 static int	rt3090_rf_init(struct rt2860_softc *);
129 static void	rt3090_rf_wakeup(struct rt2860_softc *);
130 static int	rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
131 		    uint8_t *);
132 static void	rt3090_rf_setup(struct rt2860_softc *);
133 static void	rt2860_set_leds(struct rt2860_softc *, uint16_t);
134 static void	rt2860_set_gp_timer(struct rt2860_softc *, int);
135 static void	rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
136 static void	rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
137 static void	rt2860_updateslot(struct ifnet *);
138 static void	rt2860_updateprot(struct ieee80211com *);
139 static int	rt2860_updateedca(struct ieee80211com *);
140 static int	rt2860_set_key(struct ieee80211com *,
141 		    const struct ieee80211_key *, const uint8_t *);
142 static int	rt2860_delete_key(struct ieee80211com *,
143 		    const struct ieee80211_key *);
144 static int8_t	rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
145 static const char *	rt2860_get_rf(uint8_t);
146 static int	rt2860_read_eeprom(struct rt2860_softc *);
147 static int	rt2860_bbp_init(struct rt2860_softc *);
148 static int	rt2860_txrx_enable(struct rt2860_softc *);
149 static int	rt2860_init(struct ifnet *);
150 static void	rt2860_stop(struct ifnet *, int);
151 static int	rt2860_load_microcode(struct rt2860_softc *);
152 #if 0
153 static void	rt2860_calib(struct rt2860_softc *);
154 #endif
155 static void	rt3090_set_rx_antenna(struct rt2860_softc *, int);
156 static void	rt2860_switch_chan(struct rt2860_softc *,
157 		    struct ieee80211_channel *);
158 #ifndef IEEE80211_STA_ONLY
159 static int	rt2860_setup_beacon(struct rt2860_softc *);
160 #endif
161 static void	rt2860_enable_tsf_sync(struct rt2860_softc *);
162 
163 static const struct {
164 	uint32_t	reg;
165 	uint32_t	val;
166 } rt2860_def_mac[] = {
167 	RT2860_DEF_MAC
168 };
169 
170 static const struct {
171 	uint8_t	reg;
172 	uint8_t	val;
173 } rt2860_def_bbp[] = {
174 	RT2860_DEF_BBP
175 };
176 
177 static const struct rfprog {
178 	uint8_t		chan;
179 	uint32_t	r1, r2, r3, r4;
180 } rt2860_rf2850[] = {
181 	RT2860_RF2850
182 };
183 
184 struct {
185 	uint8_t	n, r, k;
186 } rt3090_freqs[] = {
187 	RT3070_RF3052
188 };
189 
190 static const struct {
191 	uint8_t	reg;
192 	uint8_t	val;
193 }  rt3090_def_rf[] = {
194 	RT3070_DEF_RF
195 }, rt3572_def_rf[] = {
196 	RT3572_DEF_RF
197 };
198 
199 int
200 rt2860_attach(void *xsc, int id)
201 {
202 	struct rt2860_softc *sc = xsc;
203 	struct ieee80211com *ic = &sc->sc_ic;
204 	int qid, ntries, error;
205 	uint32_t tmp;
206 
207 	sc->amrr.amrr_min_success_threshold =  1;
208 	sc->amrr.amrr_max_success_threshold = 15;
209 
210 	/* wait for NIC to initialize */
211 	for (ntries = 0; ntries < 100; ntries++) {
212 		tmp = RAL_READ(sc, RT2860_ASIC_VER_ID);
213 		if (tmp != 0 && tmp != 0xffffffff)
214 			break;
215 		DELAY(10);
216 	}
217 	if (ntries == 100) {
218 		aprint_error_dev(sc->sc_dev,
219 		    "timeout waiting for NIC to initialize\n");
220 		return ETIMEDOUT;
221 	}
222 	sc->mac_ver = tmp >> 16;
223 	sc->mac_rev = tmp & 0xffff;
224 
225 	if (sc->mac_ver != 0x2860 &&
226 	    (id == PCI_PRODUCT_RALINK_RT2890 ||
227 	     id == PCI_PRODUCT_RALINK_RT2790 ||
228 	     id == PCI_PRODUCT_AWT_RT2890))
229 		sc->sc_flags |= RT2860_ADVANCED_PS;
230 
231 	/* retrieve RF rev. no and various other things from EEPROM */
232 	rt2860_read_eeprom(sc);
233 	aprint_normal_dev(sc->sc_dev, "802.11 address %s\n",
234 	    ether_sprintf(ic->ic_myaddr));
235 	aprint_normal_dev(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
236 	    "RF %s (MIMO %dT%dR)\n",
237 	    sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
238 	    sc->ntxchains, sc->nrxchains);
239 
240 	/*
241 	 * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
242 	 */
243 	for (qid = 0; qid < MAXQS; qid++) {
244 		if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
245 			aprint_error_dev(sc->sc_dev,
246 			    "could not allocate Tx ring %d\n", qid);
247 			goto fail1;
248 		}
249 	}
250 
251 	if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
252 		aprint_error_dev(sc->sc_dev, "could not allocate Rx ring\n");
253 		goto fail1;
254 	}
255 
256 	if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
257 		aprint_error_dev(sc->sc_dev, "could not allocate Tx pool\n");
258 		goto fail2;
259 	}
260 
261 	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
262 	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
263 	    WME_AC_VO : 5;
264 
265 	config_mountroot(sc->sc_dev, rt2860_attachhook);
266 
267 	return 0;
268 
269 fail2:	rt2860_free_rx_ring(sc, &sc->rxq);
270 fail1:	while (--qid >= 0)
271 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
272 	return error;
273 }
274 
275 static int
276 firmware_load(const char *dname, const char *iname, uint8_t **ucodep,
277     size_t *sizep)
278 {
279 	firmware_handle_t fh;
280 	int error;
281 
282 	if ((error = firmware_open(dname, iname, &fh)) != 0)
283 		return (error);
284 	*sizep = firmware_get_size(fh);
285 	if ((*ucodep = firmware_malloc(*sizep)) == NULL) {
286 		firmware_close(fh);
287 		return (ENOMEM);
288 	}
289 	if ((error = firmware_read(fh, 0, *ucodep, *sizep)) != 0)
290 		firmware_free(*ucodep, *sizep);
291 	firmware_close(fh);
292 
293 	return (error);
294 }
295 
296 static void
297 rt2860_attachhook(device_t self)
298 {
299 	struct rt2860_softc *sc = device_private(self);
300 	struct ieee80211com *ic = &sc->sc_ic;
301 	struct ifnet *ifp = &sc->sc_if;
302 	int i, error;
303 
304 	error = firmware_load("ral", "ral-rt2860", &sc->ucode, &sc->ucsize);
305 	if (error != 0) {
306 		aprint_error_dev(sc->sc_dev,
307 		    "error %d, could not read firmware file %s\n",
308 		    error, "ral-rt2860");
309 		return;
310 	}
311 
312 	ic->ic_ifp = ifp;
313 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
314 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
315 	ic->ic_state = IEEE80211_S_INIT;
316 
317 	/* set device capabilities */
318 	ic->ic_caps =
319 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
320 #ifndef IEEE80211_STA_ONLY
321 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
322 	    IEEE80211_C_HOSTAP |	/* HostAP mode supported */
323 #ifdef IEEE80211_C_APPMGT
324 	    IEEE80211_C_APPMGT |	/* HostAP power management */
325 #endif
326 #endif
327 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
328 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
329 	    IEEE80211_C_WEP |		/* s/w WEP */
330 	    IEEE80211_C_WPA;		/* WPA/RSN */
331 
332 	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850) {
333 		/* set supported .11a rates */
334 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
335 		    ieee80211_std_rateset_11a;
336 
337 		/* set supported .11a channels */
338 		for (i = 14; i < (int)__arraycount(rt2860_rf2850); i++) {
339 			uint8_t chan = rt2860_rf2850[i].chan;
340 			ic->ic_channels[chan].ic_freq =
341 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
342 			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
343 		}
344 	}
345 
346 	/* set supported .11b and .11g rates */
347 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
348 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
349 
350 	/* set supported .11b and .11g channels (1 through 14) */
351 	for (i = 1; i <= 14; i++) {
352 		ic->ic_channels[i].ic_freq =
353 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
354 		ic->ic_channels[i].ic_flags =
355 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
356 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
357 	}
358 
359 	/* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
360 	ic->ic_max_aid = min(IEEE80211_AID_MAX, RT2860_WCID_MAX);
361 
362 	ifp->if_softc = sc;
363 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
364 	ifp->if_init = rt2860_init;
365 	ifp->if_ioctl = rt2860_ioctl;
366 	ifp->if_start = rt2860_start;
367 	ifp->if_watchdog = rt2860_watchdog;
368 	IFQ_SET_READY(&ifp->if_snd);
369 	memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
370 
371 	if_attach(ifp);
372 	ieee80211_ifattach(ic);
373 	ic->ic_node_alloc = rt2860_node_alloc;
374 	ic->ic_newassoc = rt2860_newassoc;
375 #ifdef notyet
376 	ic->ic_ampdu_rx_start = rt2860_ampdu_rx_start;
377 	ic->ic_ampdu_rx_stop = rt2860_ampdu_rx_stop;
378 #endif
379 	ic->ic_updateslot = rt2860_updateslot;
380 	ic->ic_wme.wme_update = rt2860_updateedca;
381 	ic->ic_crypto.cs_key_set = rt2860_set_key;
382 	ic->ic_crypto.cs_key_delete = rt2860_delete_key;
383 	/* override state transition machine */
384 	sc->sc_newstate = ic->ic_newstate;
385 	ic->ic_newstate = rt2860_newstate;
386 	ieee80211_media_init(ic, rt2860_media_change, ieee80211_media_status);
387 
388 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
389 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
390 
391 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
392 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
393 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2860_RX_RADIOTAP_PRESENT);
394 
395 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
396 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
397 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2860_TX_RADIOTAP_PRESENT);
398 
399 	ieee80211_announce(ic);
400 
401 	if (pmf_device_register(sc->sc_dev, NULL, NULL))
402 		pmf_class_network_register(sc->sc_dev, ifp);
403 	else
404 		aprint_error_dev(sc->sc_dev,
405 		    "couldn't establish power handler\n");
406 }
407 
408 int
409 rt2860_detach(void *xsc)
410 {
411 	struct rt2860_softc *sc = xsc;
412 	struct ifnet *ifp = &sc->sc_if;
413 	int qid;
414 
415 	pmf_device_deregister(sc->sc_dev);
416 
417 	rt2860_stop(ifp, 1);
418 
419 	ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
420 	if_detach(ifp);
421 
422 	for (qid = 0; qid < MAXQS; qid++)
423 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
424 	rt2860_free_rx_ring(sc, &sc->rxq);
425 	rt2860_free_tx_pool(sc);
426 
427 	if (sc->ucode != NULL)
428 		free(sc->ucode, M_DEVBUF);
429 
430 	return 0;
431 }
432 
433 void
434 rt2860_suspend(void *xsc)
435 {
436 	struct rt2860_softc *sc = xsc;
437 	struct ifnet *ifp = &sc->sc_if;
438 
439 	if (ifp->if_flags & IFF_RUNNING)
440 		rt2860_stop(ifp, 1);
441 }
442 
443 void
444 rt2860_wakeup(void *xsc)
445 {
446 	struct rt2860_softc *sc = xsc;
447 	struct ifnet *ifp = &sc->sc_if;
448 
449 	if (ifp->if_flags & IFF_UP)
450 		rt2860_init(ifp);
451 }
452 
453 static int
454 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
455 {
456 	int nsegs, size, error;
457 
458 	size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
459 
460 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
461 	    BUS_DMA_NOWAIT, &ring->map);
462 	if (error != 0) {
463 		aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
464 		goto fail;
465 	}
466 
467 	/* Tx rings must be 4-DWORD aligned */
468 	error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,
469 	    &nsegs, BUS_DMA_NOWAIT);
470 	if (error != 0) {
471 		aprint_error_dev(sc->sc_dev,
472 		    "could not allocate DMA memory\n");
473 		goto fail;
474 	}
475 
476 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,
477 	    (void **)&ring->txd, BUS_DMA_NOWAIT);
478 	if (error != 0) {
479 		aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
480 		goto fail;
481 	}
482 
483 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->txd, size, NULL,
484 	    BUS_DMA_NOWAIT);
485 	if (error != 0) {
486 		aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
487 		goto fail;
488 	}
489 
490 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE);
491 
492 	ring->paddr = ring->map->dm_segs[0].ds_addr;
493 
494 	return 0;
495 
496 fail:	rt2860_free_tx_ring(sc, ring);
497 	return error;
498 }
499 
500 static void
501 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
502 {
503 	struct rt2860_tx_data *data;
504 	int i;
505 
506 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
507 		if ((data = ring->data[i]) == NULL)
508 			continue;	/* nothing mapped in this slot */
509 
510 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
511 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
512 		bus_dmamap_unload(sc->sc_dmat, data->map);
513 		m_freem(data->m);
514 		data->m= NULL;
515 		data->ni = NULL;	/* node already freed */
516 
517 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
518 		ring->data[i] = NULL;
519 	}
520 
521 	ring->queued = 0;
522 	ring->cur = ring->next = 0;
523 }
524 
525 static void
526 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
527 {
528 	struct rt2860_tx_data *data;
529 	int i;
530 
531 	if (ring->txd != NULL) {
532 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
533 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
534 		bus_dmamap_unload(sc->sc_dmat, ring->map);
535 		bus_dmamem_unmap(sc->sc_dmat, (void *)ring->txd,
536 		    RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd));
537 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
538 	}
539 	if (ring->map != NULL)
540 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
541 
542 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
543 		if ((data = ring->data[i]) == NULL)
544 			continue;	/* nothing mapped in this slot */
545 
546 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
547 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
548 		bus_dmamap_unload(sc->sc_dmat, data->map);
549 		m_freem(data->m);
550 
551 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
552 	}
553 }
554 
555 /*
556  * Allocate a pool of TX Wireless Information blocks.
557  */
558 static int
559 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
560 {
561 	char *vaddr;
562 	bus_addr_t paddr;
563 	int i, nsegs, size, error;
564 
565 	size = RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ;
566 
567 	/* init data_pool early in case of failure.. */
568 	SLIST_INIT(&sc->data_pool);
569 
570 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
571 	    BUS_DMA_NOWAIT, &sc->txwi_map);
572 	if (error != 0) {
573 		aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
574 		goto fail;
575 	}
576 
577 	error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0,
578 	    &sc->txwi_seg, 1, &nsegs, BUS_DMA_NOWAIT);
579 	if (error != 0) {
580 		aprint_error_dev(sc->sc_dev,
581 		    "could not allocate DMA memory\n");
582 		goto fail;
583 	}
584 
585 	error = bus_dmamem_map(sc->sc_dmat, &sc->txwi_seg, nsegs, size,
586 	    &sc->txwi_vaddr, BUS_DMA_NOWAIT);
587 	if (error != 0) {
588 		aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
589 		goto fail;
590 	}
591 
592 	error = bus_dmamap_load(sc->sc_dmat, sc->txwi_map, sc->txwi_vaddr,
593 	    size, NULL, BUS_DMA_NOWAIT);
594 	if (error != 0) {
595 		aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
596 		goto fail;
597 	}
598 
599 	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0, size,
600 	    BUS_DMASYNC_PREWRITE);
601 
602 	vaddr = sc->txwi_vaddr;
603 	paddr = sc->txwi_map->dm_segs[0].ds_addr;
604 	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
605 		struct rt2860_tx_data *data = &sc->data[i];
606 
607 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
608 		    RT2860_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
609 		    &data->map); /* <0> */
610 		if (error != 0) {
611 			aprint_error_dev(sc->sc_dev,
612 			    "could not create DMA map\n");
613 			goto fail;
614 		}
615 		data->txwi = (struct rt2860_txwi *)vaddr;
616 		data->paddr = paddr;
617 		vaddr += RT2860_TXWI_DMASZ;
618 		paddr += RT2860_TXWI_DMASZ;
619 
620 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
621 	}
622 
623 	return 0;
624 
625 fail:	rt2860_free_tx_pool(sc);
626 	return error;
627 }
628 
629 static void
630 rt2860_free_tx_pool(struct rt2860_softc *sc)
631 {
632 	if (sc->txwi_vaddr != NULL) {
633 		bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0,
634 		    sc->txwi_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
635 		bus_dmamap_unload(sc->sc_dmat, sc->txwi_map);
636 		bus_dmamem_unmap(sc->sc_dmat, sc->txwi_vaddr,
637 		    RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ);
638 		bus_dmamem_free(sc->sc_dmat, &sc->txwi_seg, 1);
639 	}
640 	if (sc->txwi_map != NULL)
641 		bus_dmamap_destroy(sc->sc_dmat, sc->txwi_map);
642 
643 	while (!SLIST_EMPTY(&sc->data_pool)) {
644 		struct rt2860_tx_data *data;
645 		data = SLIST_FIRST(&sc->data_pool);
646 		bus_dmamap_destroy(sc->sc_dmat, data->map);
647 		SLIST_REMOVE_HEAD(&sc->data_pool, next);
648 	}
649 }
650 
651 static int
652 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
653 {
654 	int i, nsegs, size, error;
655 
656 	size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
657 
658 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
659 	    BUS_DMA_NOWAIT, &ring->map);
660 	if (error != 0) {
661 		aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
662 		goto fail;
663 	}
664 
665 	/* Rx ring must be 4-DWORD aligned */
666 	error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,
667 	    &nsegs, BUS_DMA_NOWAIT);
668 	if (error != 0) {
669 		aprint_error_dev(sc->sc_dev,
670 		    "could not allocate DMA memory\n");
671 		goto fail;
672 	}
673 
674 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,
675 	    (void **)&ring->rxd, BUS_DMA_NOWAIT);
676 	if (error != 0) {
677 		aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
678 		goto fail;
679 	}
680 
681 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->rxd, size, NULL,
682 	    BUS_DMA_NOWAIT);
683 	if (error != 0) {
684 		aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
685 		goto fail;
686 	}
687 
688 	ring->paddr = ring->map->dm_segs[0].ds_addr;
689 
690 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
691 		struct rt2860_rx_data *data = &ring->data[i];
692 		struct rt2860_rxd *rxd = &ring->rxd[i];
693 		const char *msg;
694 
695 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
696 		    0, BUS_DMA_NOWAIT, &data->map);
697 		if (error != 0) {
698 			aprint_error_dev(sc->sc_dev,
699 			    "could not create DMA map\n");
700 			goto fail;
701 		}
702 
703 		MGET(data->m, M_DONTWAIT, MT_DATA);
704 		if (data->m == NULL) {
705 			msg = "allocate Rx mbuf";
706 			goto fail1;
707 		}
708 		MCLGET(data->m, M_DONTWAIT);
709 		if ((data->m->m_flags & M_EXT) == 0) {
710 			msg = "allocate Rx mbuf cluster";
711 			goto fail1;
712 		}
713 
714 
715 		error = bus_dmamap_load(sc->sc_dmat, data->map,
716 		    mtod(data->m, void *), MCLBYTES, NULL,
717 		    BUS_DMA_READ | BUS_DMA_NOWAIT);
718 		if (error != 0) {
719 			msg = "load DMA map";
720 		fail1:
721 			aprint_error_dev(sc->sc_dev, "could not %s\n", msg);
722 		    	m_freem(data->m);
723 			data->m = NULL;
724 			error = ENOBUFS;
725 			goto fail;
726 		}
727 
728 		rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
729 		rxd->sdl0 = htole16(MCLBYTES);
730 	}
731 
732 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE);
733 
734 	return 0;
735 fail:	rt2860_free_rx_ring(sc, ring);
736 	return error;
737 }
738 
739 static void
740 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
741 {
742 	int i;
743 
744 	for (i = 0; i < RT2860_RX_RING_COUNT; i++)
745 		ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE);
746 
747 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
748 	    BUS_DMASYNC_PREWRITE);
749 
750 	ring->cur = 0;
751 }
752 
753 static void
754 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
755 {
756 	int i;
757 
758 	if (ring->rxd != NULL) {
759 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
760 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
761 		bus_dmamap_unload(sc->sc_dmat, ring->map);
762 		bus_dmamem_unmap(sc->sc_dmat, (void *)ring->rxd,
763 		    RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd));
764 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
765 		ring->rxd = NULL;
766 	}
767 	if (ring->map != NULL) {
768 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
769 		ring->map = NULL;
770 	}
771 
772 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
773 		struct rt2860_rx_data *data = &ring->data[i];
774 
775 		if (data->m != NULL) {
776 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
777 			    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
778 			bus_dmamap_unload(sc->sc_dmat, data->map);
779 			m_freem(data->m);
780 			data->m = NULL;
781 		}
782 		if (data->map != NULL) {
783 			bus_dmamap_destroy(sc->sc_dmat, data->map);
784 			data->map = NULL;
785 		}
786 	}
787 }
788 
789 static struct ieee80211_node *
790 rt2860_node_alloc(struct ieee80211_node_table *nt)
791 {
792 	struct rt2860_node *rn =
793 	    malloc(sizeof (struct rt2860_node), M_DEVBUF, M_NOWAIT | M_ZERO);
794 	return (rn) ? &rn->ni : NULL;
795 }
796 
797 static int
798 rt2860_media_change(struct ifnet *ifp)
799 {
800 	struct rt2860_softc *sc = ifp->if_softc;
801 	struct ieee80211com *ic = &sc->sc_ic;
802 	uint8_t rate, ridx;
803 	int error;
804 
805 	error = ieee80211_media_change(ifp);
806 	if (error != ENETRESET)
807 		return error;
808 
809 	if (ic->ic_fixed_rate != -1) {
810 		rate = ic->ic_sup_rates[ic->ic_curmode].
811 		    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
812 		for (ridx = 0; ridx <= RT2860_RIDX_MAX; ridx++)
813 			if (rt2860_rates[ridx].rate == rate)
814 				break;
815 		sc->fixed_ridx = ridx;
816 	}
817 
818 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
819 	    (IFF_UP | IFF_RUNNING)) {
820 		rt2860_stop(ifp, 0);
821 		rt2860_init(ifp);
822 	}
823 	return 0;
824 }
825 
826 static void
827 rt2860_iter_func(void *arg, struct ieee80211_node *ni)
828 {
829 	struct rt2860_softc *sc = arg;
830 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
831 
832 	ieee80211_amrr_choose(&sc->amrr, ni, &sc->amn[wcid]);
833 }
834 
835 static void
836 rt2860_updatestats(struct rt2860_softc *sc)
837 {
838 	struct ieee80211com *ic = &sc->sc_ic;
839 
840 #ifndef IEEE80211_STA_ONLY
841 	/*
842 	 * In IBSS or HostAP modes (when the hardware sends beacons), the
843 	 * MAC can run into a livelock and start sending CTS-to-self frames
844 	 * like crazy if protection is enabled.  Fortunately, we can detect
845 	 * when such a situation occurs and reset the MAC.
846 	 */
847 	if (ic->ic_curmode != IEEE80211_M_STA) {
848 		/* check if we're in a livelock situation.. */
849 		uint32_t tmp = RAL_READ(sc, RT2860_DEBUG);
850 		if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
851 			/* ..and reset MAC/BBP for a while.. */
852 			DPRINTF(("CTS-to-self livelock detected\n"));
853 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
854 			RAL_BARRIER_WRITE(sc);
855 			DELAY(1);
856 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
857 			    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
858 		}
859 	}
860 #endif
861 	if (ic->ic_opmode == IEEE80211_M_STA)
862 		rt2860_iter_func(sc, ic->ic_bss);
863 #ifndef IEEE80211_STA_ONLY
864 	else
865 		ieee80211_iterate_nodes(&ic->ic_sta, rt2860_iter_func, sc);
866 #endif
867 }
868 
869 static void
870 rt2860_newassoc(struct ieee80211_node *ni, int isnew)
871 {
872 	struct rt2860_softc *sc = ni->ni_ic->ic_ifp->if_softc;
873 	struct rt2860_node *rn = (void *)ni;
874 	struct ieee80211_rateset *rs = &ni->ni_rates;
875 	uint8_t rate, wcid = 0;
876 	int ridx, i, j;
877 
878 	if (isnew && ni->ni_associd != 0) {
879 		/* only interested in true associations */
880 		wcid = rn->wcid = IEEE80211_AID(ni->ni_associd);
881 
882 		/* init WCID table entry */
883 		RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),
884 		    ni->ni_macaddr, IEEE80211_ADDR_LEN);
885 	}
886 	DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
887 	    isnew, ether_sprintf(ni->ni_macaddr), wcid));
888 
889 	ieee80211_amrr_node_init(&sc->amrr, &sc->amn[wcid]);
890 	/* start at lowest available bit-rate, AMRR will raise */
891 	ni->ni_txrate = 0;
892 
893 	for (i = 0; i < rs->rs_nrates; i++) {
894 		rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
895 		/* convert 802.11 rate to hardware rate index */
896 		for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
897 			if (rt2860_rates[ridx].rate == rate)
898 				break;
899 		rn->ridx[i] = ridx;
900 		/* determine rate of control response frames */
901 		for (j = i; j >= 0; j--) {
902 			if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
903 			    rt2860_rates[rn->ridx[i]].phy ==
904 			    rt2860_rates[rn->ridx[j]].phy)
905 				break;
906 		}
907 		if (j >= 0) {
908 			rn->ctl_ridx[i] = rn->ridx[j];
909 		} else {
910 			/* no basic rate found, use mandatory one */
911 			rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
912 		}
913 		DPRINTF(("rate=0x%02x ridx=%d ctl_ridx=%d\n",
914 		    rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]));
915 	}
916 }
917 
918 #ifdef notyet
919 static int
920 rt2860_ampdu_rx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
921     uint8_t tid)
922 {
923 	struct rt2860_softc *sc = ic->ic_softc;
924 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
925 	uint32_t tmp;
926 
927 	/* update BA session mask */
928 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
929 	tmp |= (1 << tid) << 16;
930 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
931 	return 0;
932 }
933 
934 static void
935 rt2860_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
936     uint8_t tid)
937 {
938 	struct rt2860_softc *sc = ic->ic_softc;
939 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
940 	uint32_t tmp;
941 
942 	/* update BA session mask */
943 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
944 	tmp &= ~((1 << tid) << 16);
945 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
946 }
947 #endif
948 
949 static int
950 rt2860_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
951 {
952 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
953 	enum ieee80211_state ostate;
954 	uint32_t tmp;
955 
956 	ostate = ic->ic_state;
957 
958 	if (ostate == IEEE80211_S_RUN) {
959 		/* turn link LED off */
960 		rt2860_set_leds(sc, RT2860_LED_RADIO);
961 	}
962 
963 	switch (nstate) {
964 	case IEEE80211_S_INIT:
965 		if (ostate == IEEE80211_S_RUN) {
966 			/* abort TSF synchronization */
967 			tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
968 			RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
969 			    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
970 			    RT2860_TBTT_TIMER_EN));
971 		}
972 		rt2860_set_gp_timer(sc, 0);
973 		break;
974 
975 	case IEEE80211_S_SCAN:
976 		rt2860_switch_chan(sc, ic->ic_bss->ni_chan);
977 		if (ostate != IEEE80211_S_SCAN)
978 			rt2860_set_gp_timer(sc, 150);
979 		break;
980 
981 	case IEEE80211_S_AUTH:
982 	case IEEE80211_S_ASSOC:
983 		rt2860_set_gp_timer(sc, 0);
984 		rt2860_switch_chan(sc, ic->ic_bss->ni_chan);
985 		break;
986 
987 	case IEEE80211_S_RUN:
988 		rt2860_set_gp_timer(sc, 0);
989 		rt2860_switch_chan(sc, ic->ic_bss->ni_chan);
990 
991 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
992 			rt2860_updateslot(ic->ic_ifp);
993 			rt2860_enable_mrr(sc);
994 			rt2860_set_txpreamble(sc);
995 			rt2860_set_basicrates(sc);
996 			rt2860_set_bssid(sc, ic->ic_bss->ni_bssid);
997 		}
998 
999 #ifndef IEEE80211_STA_ONLY
1000 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
1001 		    ic->ic_opmode == IEEE80211_M_IBSS)
1002 			(void)rt2860_setup_beacon(sc);
1003 #endif
1004 
1005 		if (ic->ic_opmode == IEEE80211_M_STA) {
1006 			/* fake a join to init the tx rate */
1007 			rt2860_newassoc(ic->ic_bss, 1);
1008 		}
1009 
1010 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
1011 			rt2860_enable_tsf_sync(sc);
1012 			rt2860_set_gp_timer(sc, 500);
1013 		}
1014 
1015 		/* turn link LED on */
1016 		rt2860_set_leds(sc, RT2860_LED_RADIO |
1017 		    (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan) ?
1018 		     RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
1019 		break;
1020 	}
1021 
1022 	return sc->sc_newstate(ic, nstate, arg);
1023 }
1024 
1025 /* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
1026 static uint16_t
1027 rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
1028 {
1029 	uint32_t tmp;
1030 	uint16_t reg;
1031 	int ntries;
1032 
1033 	addr *= 2;
1034 	/*-
1035 	 * Read one 16-byte block into registers EFUSE_DATA[0-3]:
1036 	 * DATA0: F E D C
1037 	 * DATA1: B A 9 8
1038 	 * DATA2: 7 6 5 4
1039 	 * DATA3: 3 2 1 0
1040 	 */
1041 	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
1042 	tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
1043 	tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
1044 	RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp);
1045 	for (ntries = 0; ntries < 500; ntries++) {
1046 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
1047 		if (!(tmp & RT3070_EFSROM_KICK))
1048 			break;
1049 		DELAY(2);
1050 	}
1051 	if (ntries == 500)
1052 		return 0xffff;
1053 
1054 	if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK)
1055 		return 0xffff;	/* address not found */
1056 
1057 	/* determine to which 32-bit register our 16-bit word belongs */
1058 	reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1059 	tmp = RAL_READ(sc, reg);
1060 
1061 	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
1062 }
1063 
1064 /*
1065  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
1066  * 93C66 or 93C86).
1067  */
1068 static uint16_t
1069 rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
1070 {
1071 	uint32_t tmp;
1072 	uint16_t val;
1073 	int n;
1074 
1075 	/* clock C once before the first command */
1076 	RT2860_EEPROM_CTL(sc, 0);
1077 
1078 	RT2860_EEPROM_CTL(sc, RT2860_S);
1079 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1080 	RT2860_EEPROM_CTL(sc, RT2860_S);
1081 
1082 	/* write start bit (1) */
1083 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1084 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1085 
1086 	/* write READ opcode (10) */
1087 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1088 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1089 	RT2860_EEPROM_CTL(sc, RT2860_S);
1090 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1091 
1092 	/* write address (A5-A0 or A7-A0) */
1093 	n = ((RAL_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
1094 	for (; n >= 0; n--) {
1095 		RT2860_EEPROM_CTL(sc, RT2860_S |
1096 		    (((addr >> n) & 1) << RT2860_SHIFT_D));
1097 		RT2860_EEPROM_CTL(sc, RT2860_S |
1098 		    (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
1099 	}
1100 
1101 	RT2860_EEPROM_CTL(sc, RT2860_S);
1102 
1103 	/* read data Q15-Q0 */
1104 	val = 0;
1105 	for (n = 15; n >= 0; n--) {
1106 		RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1107 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
1108 		val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
1109 		RT2860_EEPROM_CTL(sc, RT2860_S);
1110 	}
1111 
1112 	RT2860_EEPROM_CTL(sc, 0);
1113 
1114 	/* clear Chip Select and clock C */
1115 	RT2860_EEPROM_CTL(sc, RT2860_S);
1116 	RT2860_EEPROM_CTL(sc, 0);
1117 	RT2860_EEPROM_CTL(sc, RT2860_C);
1118 
1119 	return val;
1120 }
1121 
1122 static __inline uint16_t
1123 rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
1124 {
1125 	/* either eFUSE ROM or EEPROM */
1126 	return sc->sc_srom_read(sc, addr);
1127 }
1128 
1129 static void
1130 rt2860_intr_coherent(struct rt2860_softc *sc)
1131 {
1132 	uint32_t tmp;
1133 
1134 	/* DMA finds data coherent event when checking the DDONE bit */
1135 
1136 	DPRINTF(("Tx/Rx Coherent interrupt\n"));
1137 
1138 	/* restart DMA engine */
1139 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
1140 	tmp &= ~(RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
1141 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
1142 
1143 	(void)rt2860_txrx_enable(sc);
1144 }
1145 
1146 static void
1147 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1148 {
1149 	struct ifnet *ifp = &sc->sc_if;
1150 	struct ieee80211_amrr_node *amn;
1151 	uint32_t stat;
1152 	uint8_t wcid, mcs, pid;
1153 
1154 	/* drain Tx status FIFO (maxsize = 16) */
1155 	while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
1156 		DPRINTFN(4, ("tx stat 0x%08x\n", stat));
1157 
1158 		wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
1159 
1160 		/* if no ACK was requested, no feedback is available */
1161 		if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff)
1162 			continue;
1163 
1164 		/* update per-STA AMRR stats */
1165 		amn = &sc->amn[wcid];
1166 		amn->amn_txcnt++;
1167 		if (stat & RT2860_TXQ_OK) {
1168 			/*
1169 			 * Check if there were retries, ie if the Tx success
1170 			 * rate is different from the requested rate.  Note
1171 			 * that it works only because we do not allow rate
1172 			 * fallback from OFDM to CCK.
1173 			 */
1174 			mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
1175 			pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
1176 			if (mcs + 1 != pid)
1177 				amn->amn_retrycnt++;
1178 		} else {
1179 			amn->amn_retrycnt++;
1180 			ifp->if_oerrors++;
1181 		}
1182 	}
1183 }
1184 
1185 static void
1186 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1187 {
1188 	struct ifnet *ifp = &sc->sc_if;
1189 	struct rt2860_tx_ring *ring = &sc->txq[qid];
1190 	uint32_t hw;
1191 
1192 	rt2860_drain_stats_fifo(sc);
1193 
1194 	hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid));
1195 	while (ring->next != hw) {
1196 		struct rt2860_tx_data *data = ring->data[ring->next];
1197 
1198 		if (data != NULL) {
1199 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1200 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
1201 			bus_dmamap_unload(sc->sc_dmat, data->map);
1202 			m_freem(data->m);
1203 			data->m= NULL;
1204 			ieee80211_free_node(data->ni);
1205 			data->ni = NULL;
1206 
1207 			SLIST_INSERT_HEAD(&sc->data_pool, data, next);
1208 			ring->data[ring->next] = NULL;
1209 
1210 			ifp->if_opackets++;
1211 		}
1212 		ring->queued--;
1213 		ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
1214 	}
1215 
1216 	sc->sc_tx_timer = 0;
1217 	if (ring->queued <= RT2860_TX_RING_ONEMORE)
1218 		sc->qfullmsk &= ~(1 << qid);
1219 	ifp->if_flags &= ~IFF_OACTIVE;
1220 	rt2860_start(ifp);
1221 }
1222 
1223 /*
1224  * Return the Rx chain with the highest RSSI for a given frame.
1225  */
1226 static __inline uint8_t
1227 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
1228 {
1229 	uint8_t rxchain = 0;
1230 
1231 	if (sc->nrxchains > 1) {
1232 		if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1233 			rxchain = 1;
1234 		if (sc->nrxchains > 2)
1235 			if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1236 				rxchain = 2;
1237 	}
1238 	return rxchain;
1239 }
1240 
1241 static void
1242 rt2860_rx_intr(struct rt2860_softc *sc)
1243 {
1244 	struct ieee80211com *ic = &sc->sc_ic;
1245 	struct ifnet *ifp = &sc->sc_if;
1246 	struct ieee80211_frame *wh;
1247 	struct ieee80211_node *ni;
1248 	struct mbuf *m, *m1;
1249 	uint32_t hw;
1250 	uint8_t ant, rssi;
1251 	int error;
1252 	struct rt2860_rx_radiotap_header *tap;
1253 	uint16_t phy;
1254 
1255 	hw = RAL_READ(sc, RT2860_FS_DRX_IDX) & 0xfff;
1256 	while (sc->rxq.cur != hw) {
1257 		struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1258 		struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1259 		struct rt2860_rxwi *rxwi;
1260 
1261 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1262 		    sc->rxq.cur * sizeof (struct rt2860_rxd),
1263 		    sizeof (struct rt2860_rxd), BUS_DMASYNC_POSTREAD);
1264 
1265 		if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))) {
1266 			DPRINTF(("RXD DDONE bit not set!\n"));
1267 			break;	/* should not happen */
1268 		}
1269 
1270 		if (__predict_false(rxd->flags &
1271 		    htole32(RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
1272 			ifp->if_ierrors++;
1273 			goto skip;
1274 		}
1275 
1276 		MGET(m1, M_DONTWAIT, MT_DATA);
1277 		if (__predict_false(m1 == NULL)) {
1278 			ifp->if_ierrors++;
1279 			goto skip;
1280 		}
1281 		MCLGET(m1, M_DONTWAIT);
1282 		if (__predict_false((m1->m_flags & M_EXT) == 0)) {
1283 			m_freem(m1);
1284 			ifp->if_ierrors++;
1285 			goto skip;
1286 		}
1287 
1288 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1289 		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1290 		bus_dmamap_unload(sc->sc_dmat, data->map);
1291 
1292 		error = bus_dmamap_load(sc->sc_dmat, data->map,
1293 		    mtod(m1, void *), MCLBYTES, NULL,
1294 		    BUS_DMA_READ | BUS_DMA_NOWAIT);
1295 		if (__predict_false(error != 0)) {
1296 			m_freem(m1);
1297 
1298 			/* try to reload the old mbuf */
1299 			error = bus_dmamap_load(sc->sc_dmat, data->map,
1300 			    mtod(data->m, void *), MCLBYTES, NULL,
1301 			    BUS_DMA_READ | BUS_DMA_NOWAIT);
1302 			if (__predict_false(error != 0)) {
1303 				panic("%s: could not load old rx mbuf",
1304 				    device_xname(sc->sc_dev));
1305 			}
1306 			/* physical address may have changed */
1307 			rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
1308 			ifp->if_ierrors++;
1309 			goto skip;
1310 		}
1311 
1312 		/*
1313 		 * New mbuf successfully loaded, update Rx ring and continue
1314 		 * processing.
1315 		 */
1316 		m = data->m;
1317 		data->m = m1;
1318 		rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
1319 
1320 		rxwi = mtod(m, struct rt2860_rxwi *);
1321 
1322 		/* finalize mbuf */
1323 		m->m_data = (void *)(rxwi + 1);
1324 		m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;
1325 
1326 		wh = mtod(m, struct ieee80211_frame *);
1327 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1328 			/* frame is decrypted by hardware */
1329 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
1330 		}
1331 
1332 		/* HW may insert 2 padding bytes after 802.11 header */
1333 		if (rxd->flags & htole32(RT2860_RX_L2PAD)) {
1334 			u_int hdrlen = ieee80211_hdrspace(ic, wh);
1335 			memmove((char *)wh + 2, wh, hdrlen);
1336 			m->m_data += 2;
1337 			wh = mtod(m, struct ieee80211_frame *);
1338 		}
1339 
1340 		if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))) {
1341 			/* report MIC failures to net80211 for TKIP */
1342 			ieee80211_notify_michael_failure(ic, wh, 0/* XXX */);
1343 			ifp->if_ierrors++;
1344 			goto skip;
1345 		}
1346 
1347 		ant = rt2860_maxrssi_chain(sc, rxwi);
1348 		rssi = rxwi->rssi[ant];
1349 
1350 		if (__predict_true(sc->sc_drvbpf == NULL))
1351 			goto skipbpf;
1352 
1353 		tap = &sc->sc_rxtap;
1354 		tap->wr_flags = 0;
1355 		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1356 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1357 		tap->wr_antsignal = rssi;
1358 		tap->wr_antenna = ant;
1359 		tap->wr_dbm_antsignal = rt2860_rssi2dbm(sc, rssi, ant);
1360 		tap->wr_rate = 2;	/* in case it can't be found below */
1361 		phy = le16toh(rxwi->phy);
1362 		switch (phy & RT2860_PHY_MODE) {
1363 		case RT2860_PHY_CCK:
1364 			switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
1365 			case 0:	tap->wr_rate =   2; break;
1366 			case 1:	tap->wr_rate =   4; break;
1367 			case 2:	tap->wr_rate =  11; break;
1368 			case 3:	tap->wr_rate =  22; break;
1369 			}
1370 			if (phy & RT2860_PHY_SHPRE)
1371 				tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1372 			break;
1373 		case RT2860_PHY_OFDM:
1374 			switch (phy & RT2860_PHY_MCS) {
1375 			case 0:	tap->wr_rate =  12; break;
1376 			case 1:	tap->wr_rate =  18; break;
1377 			case 2:	tap->wr_rate =  24; break;
1378 			case 3:	tap->wr_rate =  36; break;
1379 			case 4:	tap->wr_rate =  48; break;
1380 			case 5:	tap->wr_rate =  72; break;
1381 			case 6:	tap->wr_rate =  96; break;
1382 			case 7:	tap->wr_rate = 108; break;
1383 			}
1384 			break;
1385 		}
1386 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
1387 skipbpf:
1388 		/* grab a reference to the source node */
1389 		ni = ieee80211_find_rxnode(ic,
1390 		    (struct ieee80211_frame_min *)wh);
1391 
1392 		/* send the frame to the 802.11 layer */
1393 		ieee80211_input(ic, m, ni, rssi, 0);
1394 
1395 		/* node is no longer needed */
1396 		ieee80211_free_node(ni);
1397 
1398 skip:		rxd->sdl0 &= ~htole16(RT2860_RX_DDONE);
1399 
1400 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1401 		    sc->rxq.cur * sizeof (struct rt2860_rxd),
1402 		    sizeof (struct rt2860_rxd), BUS_DMASYNC_PREWRITE);
1403 
1404 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
1405 	}
1406 
1407 	/* tell HW what we have processed */
1408 	RAL_WRITE(sc, RT2860_RX_CALC_IDX,
1409 	    (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
1410 }
1411 
1412 static void
1413 rt2860_tbtt_intr(struct rt2860_softc *sc)
1414 {
1415 	struct ieee80211com *ic = &sc->sc_ic;
1416 
1417 #ifndef IEEE80211_STA_ONLY
1418 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1419 		/* one less beacon until next DTIM */
1420 		if (ic->ic_dtim_count == 0)
1421 			ic->ic_dtim_count = ic->ic_dtim_period - 1;
1422 		else
1423 			ic->ic_dtim_count--;
1424 
1425 		/* update dynamic parts of beacon */
1426 		rt2860_setup_beacon(sc);
1427 
1428 #if 0
1429 		/* flush buffered multicast frames */
1430 		if (ic->ic_dtim_count == 0)
1431 			ieee80211_notify_dtim(ic);
1432 #endif
1433 	}
1434 #endif
1435 	/* check if protection mode has changed */
1436 	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
1437 		rt2860_updateprot(ic);
1438 		sc->sc_ic_flags = ic->ic_flags;
1439 	}
1440 }
1441 
1442 static void
1443 rt2860_gp_intr(struct rt2860_softc *sc)
1444 {
1445 	struct ieee80211com *ic = &sc->sc_ic;
1446 
1447 	DPRINTFN(2, ("GP timeout state=%d\n", ic->ic_state));
1448 
1449 	if (ic->ic_state == IEEE80211_S_SCAN)
1450 		ieee80211_next_scan(ic);
1451 	else if (ic->ic_state == IEEE80211_S_RUN)
1452 		rt2860_updatestats(sc);
1453 }
1454 
1455 int
1456 rt2860_intr(void *arg)
1457 {
1458 	struct rt2860_softc *sc = arg;
1459 	uint32_t r;
1460 
1461 	r = RAL_READ(sc, RT2860_INT_STATUS);
1462 	if (__predict_false(r == 0xffffffff))
1463 		return 0;	/* device likely went away */
1464 	if (r == 0)
1465 		return 0;	/* not for us */
1466 
1467 	/* acknowledge interrupts */
1468 	RAL_WRITE(sc, RT2860_INT_STATUS, r);
1469 
1470 	if (r & RT2860_TX_RX_COHERENT)
1471 		rt2860_intr_coherent(sc);
1472 
1473 	if (r & RT2860_MAC_INT_2)	/* TX status */
1474 		rt2860_drain_stats_fifo(sc);
1475 
1476 	if (r & RT2860_TX_DONE_INT5)
1477 		rt2860_tx_intr(sc, 5);
1478 
1479 	if (r & RT2860_RX_DONE_INT)
1480 		rt2860_rx_intr(sc);
1481 
1482 	if (r & RT2860_TX_DONE_INT4)
1483 		rt2860_tx_intr(sc, 4);
1484 
1485 	if (r & RT2860_TX_DONE_INT3)
1486 		rt2860_tx_intr(sc, 3);
1487 
1488 	if (r & RT2860_TX_DONE_INT2)
1489 		rt2860_tx_intr(sc, 2);
1490 
1491 	if (r & RT2860_TX_DONE_INT1)
1492 		rt2860_tx_intr(sc, 1);
1493 
1494 	if (r & RT2860_TX_DONE_INT0)
1495 		rt2860_tx_intr(sc, 0);
1496 
1497 	if (r & RT2860_MAC_INT_0)	/* TBTT */
1498 		rt2860_tbtt_intr(sc);
1499 
1500 	if (r & RT2860_MAC_INT_3) {	/* Auto wakeup */
1501 		/* TBD wakeup */
1502 	}
1503 
1504 	if (r & RT2860_MAC_INT_4)	/* GP timer */
1505 		rt2860_gp_intr(sc);
1506 
1507 	return 1;
1508 }
1509 
1510 static int
1511 rt2860_tx(struct rt2860_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1512 {
1513 	struct ieee80211com *ic = &sc->sc_ic;
1514 	struct rt2860_node *rn = (void *)ni;
1515 	struct rt2860_tx_ring *ring;
1516 	struct rt2860_tx_data *data;
1517 	struct rt2860_txd *txd;
1518 	struct rt2860_txwi *txwi;
1519 	struct ieee80211_frame *wh;
1520 	bus_dma_segment_t *seg;
1521 	u_int hdrlen;
1522 	uint16_t qos, dur;
1523 	uint8_t type, qsel, mcs, pid, tid, qid;
1524 	int nsegs, hasqos, ridx, ctl_ridx;
1525 
1526 	/* the data pool contains at least one element, pick the first */
1527 	data = SLIST_FIRST(&sc->data_pool);
1528 
1529 	wh = mtod(m, struct ieee80211_frame *);
1530 	hdrlen = ieee80211_hdrspace(ic, wh);
1531 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1532 
1533 	if ((hasqos = ieee80211_has_qos(wh))) {
1534 		qos = ieee80211_get_qos(wh);
1535 		tid = qos & IEEE80211_QOS_TID;
1536 		qid = TID_TO_WME_AC(tid);
1537 	} else {
1538 		qos = 0;
1539 		tid = 0;
1540 		qid = (type == IEEE80211_FC0_TYPE_MGT) ?
1541 		    sc->mgtqid : WME_AC_BE;
1542 	}
1543 	KASSERT(qid < MAXQS);
1544 	ring = &sc->txq[qid];
1545 
1546 	/* pickup a rate index */
1547 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
1548 	    type != IEEE80211_FC0_TYPE_DATA) {
1549 		ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1550 		    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
1551 		ctl_ridx = rt2860_rates[ridx].ctl_ridx;
1552 	} else if (ic->ic_fixed_rate != -1) {
1553 		ridx = sc->fixed_ridx;
1554 		ctl_ridx = rt2860_rates[ridx].ctl_ridx;
1555 	} else {
1556 		ridx = rn->ridx[ni->ni_txrate];
1557 		ctl_ridx = rn->ctl_ridx[ni->ni_txrate];
1558 	}
1559 
1560 	/* get MCS code from rate index */
1561 	mcs = rt2860_rates[ridx].mcs;
1562 
1563 	/* setup TX Wireless Information */
1564 	txwi = data->txwi;
1565 	txwi->flags = 0;
1566 	/* let HW generate seq numbers for non-QoS frames */
1567 	txwi->xflags = hasqos ? 0 : RT2860_TX_NSEQ;
1568 	txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA) ? rn->wcid : 0xff;
1569 	txwi->len = htole16(m->m_pkthdr.len);
1570 	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1571 		txwi->phy = htole16(RT2860_PHY_CCK);
1572 		if (ridx != RT2860_RIDX_CCK1 &&
1573 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1574 			mcs |= RT2860_PHY_SHPRE;
1575 	} else
1576 		txwi->phy = htole16(RT2860_PHY_OFDM);
1577 	txwi->phy |= htole16(mcs);
1578 
1579 	/*
1580 	 * We store the MCS code into the driver-private PacketID field.
1581 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1582 	 * that we know at which initial rate the frame was transmitted.
1583 	 * We add 1 to the MCS code because setting the PacketID field to
1584 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1585 	 */
1586 	pid = (mcs + 1) & 0xf;
1587 	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1588 
1589 	/* check if RTS/CTS or CTS-to-self protection is required */
1590 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1591 	    (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
1592 	     ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1593 	      rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
1594 		txwi->txop = RT2860_TX_TXOP_HT;
1595 	else
1596 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1597 
1598 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1599 	    (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
1600 	     IEEE80211_QOS_ACKPOLICY_NOACK)) {
1601 		txwi->xflags |= RT2860_TX_ACK;
1602 
1603 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1604 			dur = rt2860_rates[ctl_ridx].sp_ack_dur;
1605 		else
1606 			dur = rt2860_rates[ctl_ridx].lp_ack_dur;
1607 		*(uint16_t *)wh->i_dur = htole16(dur);
1608 	}
1609 #ifndef IEEE80211_STA_ONLY
1610 	/* ask MAC to insert timestamp into probe responses */
1611 	if ((wh->i_fc[0] &
1612 	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1613 	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1614 	    /* NOTE: beacons do not pass through tx_data() */
1615 		txwi->flags |= RT2860_TX_TS;
1616 #endif
1617 
1618 	if (__predict_false(sc->sc_drvbpf != NULL)) {
1619 		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1620 
1621 		tap->wt_flags = 0;
1622 		tap->wt_rate = rt2860_rates[ridx].rate;
1623 		tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq);
1624 		tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags);
1625 		tap->wt_hwqueue = qid;
1626 		if (mcs & RT2860_PHY_SHPRE)
1627 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1628 
1629 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m);
1630 	}
1631 
1632 	/* copy and trim 802.11 header */
1633 	memcpy(txwi + 1, wh, hdrlen);
1634 	m_adj(m, hdrlen);
1635 
1636 	KASSERT (ring->queued <= RT2860_TX_RING_ONEMORE); /* <1> */
1637 	if (bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m, BUS_DMA_NOWAIT)) {
1638 		if (m_defrag(m, M_DONTWAIT))
1639 			return (ENOBUFS);
1640 		if (bus_dmamap_load_mbuf(sc->sc_dmat,
1641 		    data->map, m, BUS_DMA_NOWAIT))
1642 			return (EFBIG);
1643 	}
1644 
1645 	/* The map will fit into the tx ring: (a "full" ring may have a few
1646 	 * unused descriptors, at most (txds(MAX_SCATTER) - 1))
1647 	 *
1648 	 *   ring->queued + txds(data->map->nsegs)
1649 	 * <=	{ <0> data->map->nsegs <= MAX_SCATTER }
1650 	 *   ring->queued + txds(MAX_SCATTER)
1651 	 * <=	{ <1> ring->queued <= TX_RING_MAX - txds(MAX_SCATTER) }
1652 	 *   TX_RING_MAX - txds(MAX_SCATTER) + txds(MAX_SCATTER)
1653 	 * <=   { arithmetic }
1654 	 *   TX_RING_MAX
1655 	 */
1656 
1657 	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1658 
1659 	/* first segment is TXWI + 802.11 header */
1660 	txd = &ring->txd[ring->cur];
1661 	txd->sdp0 = htole32(data->paddr);
1662 	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + hdrlen);
1663 	txd->flags = qsel;
1664 
1665 	/* setup payload segments */
1666 	seg = data->map->dm_segs;
1667 	for (nsegs = data->map->dm_nsegs; nsegs >= 2; nsegs -= 2) {
1668 		txd->sdp1 = htole32(seg->ds_addr);
1669 		txd->sdl1 = htole16(seg->ds_len);
1670 		seg++;
1671 		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1672 		/* grab a new Tx descriptor */
1673 		txd = &ring->txd[ring->cur];
1674 		txd->sdp0 = htole32(seg->ds_addr);
1675 		txd->sdl0 = htole16(seg->ds_len);
1676 		txd->flags = qsel;
1677 		seg++;
1678 	}
1679 	/* finalize last segment */
1680 	if (nsegs > 0) {
1681 		txd->sdp1 = htole32(seg->ds_addr);
1682 		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1683 	} else {
1684 		txd->sdl0 |= htole16(RT2860_TX_LS0);
1685 		txd->sdl1 = 0;
1686 	}
1687 
1688 	/* remove from the free pool and link it into the SW Tx slot */
1689 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1690 	data->m = m;
1691 	data->ni = ni;
1692 	ring->data[ring->cur] = data;
1693 
1694 	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map,
1695 	    (uintptr_t)txwi - (uintptr_t)sc->txwi_vaddr, RT2860_TXWI_DMASZ,
1696 	    BUS_DMASYNC_PREWRITE);
1697 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1698 	    BUS_DMASYNC_PREWRITE);
1699 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
1700 	    BUS_DMASYNC_PREWRITE);
1701 
1702 	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1703 	    qid, txwi->wcid, data->map->dm_nsegs, ridx));
1704 
1705 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1706 	ring->queued += 1 + (data->map->dm_nsegs / 2);
1707 	if (ring->queued > RT2860_TX_RING_ONEMORE)
1708 		sc->qfullmsk |= 1 << qid;
1709 
1710 	/* kick Tx */
1711 	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1712 
1713 	return 0;
1714 }
1715 
1716 static void
1717 rt2860_start(struct ifnet *ifp)
1718 {
1719 	struct rt2860_softc *sc = ifp->if_softc;
1720 	struct ieee80211com *ic = &sc->sc_ic;
1721 	struct ether_header *eh;
1722 	struct ieee80211_node *ni;
1723 	struct mbuf *m;
1724 
1725 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1726 		return;
1727 
1728 	for (;;) {
1729 		if (SLIST_EMPTY(&sc->data_pool) || sc->qfullmsk != 0) {
1730 			ifp->if_flags |= IFF_OACTIVE;
1731 			break;
1732 		}
1733 		/* send pending management frames first */
1734 		IF_DEQUEUE(&ic->ic_mgtq, m);
1735 		if (m != NULL) {
1736 			ni = M_GETCTX(m, struct ieee80211_node *);
1737 			M_CLEARCTX(m);
1738 			goto sendit;
1739 		}
1740 		if (ic->ic_state != IEEE80211_S_RUN)
1741 			break;
1742 
1743 		/* encapsulate and send data frames */
1744 		IFQ_DEQUEUE(&ifp->if_snd, m);
1745 		if (m == NULL)
1746 			break;
1747 		if (m->m_len < (int)sizeof(*eh) &&
1748 		    (m = m_pullup(m, sizeof(*eh))) == NULL) {
1749 			ifp->if_oerrors++;
1750 			continue;
1751 		}
1752 
1753 		eh = mtod(m, struct ether_header *);
1754 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1755 		if (ni == NULL) {
1756 			m_freem(m);
1757 			ifp->if_oerrors++;
1758 			continue;
1759 		}
1760 
1761 		bpf_mtap(ifp, m);
1762 
1763 		if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
1764 			ieee80211_free_node(ni);
1765 			ifp->if_oerrors++;
1766 			continue;
1767 		}
1768 sendit:
1769 		bpf_mtap3(ic->ic_rawbpf, m);
1770 
1771 		if (rt2860_tx(sc, m, ni) != 0) {
1772 			m_freem(m);
1773 			ieee80211_free_node(ni);
1774 			ifp->if_oerrors++;
1775 			continue;
1776 		}
1777 
1778 		sc->sc_tx_timer = 5;
1779 		ifp->if_timer = 1;
1780 	}
1781 }
1782 
1783 static void
1784 rt2860_watchdog(struct ifnet *ifp)
1785 {
1786 	struct rt2860_softc *sc = ifp->if_softc;
1787 	struct ieee80211com *ic = &sc->sc_ic;
1788 
1789 	ifp->if_timer = 0;
1790 
1791 	if (sc->sc_tx_timer > 0) {
1792 		if (--sc->sc_tx_timer == 0) {
1793 			aprint_error_dev(sc->sc_dev, "device timeout\n");
1794 			rt2860_stop(ifp, 0);
1795 			rt2860_init(ifp);
1796 			ifp->if_oerrors++;
1797 			return;
1798 		}
1799 		ifp->if_timer = 1;
1800 	}
1801 
1802 	ieee80211_watchdog(ic);
1803 }
1804 
1805 static int
1806 rt2860_ioctl(struct ifnet *ifp, u_long cmd, void *data)
1807 {
1808 	struct rt2860_softc *sc = ifp->if_softc;
1809 	struct ieee80211com *ic = &sc->sc_ic;
1810 	int s, error = 0;
1811 
1812 	s = splnet();
1813 
1814 	switch (cmd) {
1815 	case SIOCSIFFLAGS:
1816 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
1817 			break;
1818 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
1819 		case IFF_UP|IFF_RUNNING:
1820 			break;
1821 		case IFF_UP:
1822 			rt2860_init(ifp);
1823 			break;
1824 		case IFF_RUNNING:
1825 			rt2860_stop(ifp, 1);
1826 			break;
1827 		case 0:
1828 			break;
1829 		}
1830 		break;
1831 
1832 	case SIOCADDMULTI:
1833 	case SIOCDELMULTI:
1834 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
1835 			/* setup multicast filter, etc */
1836 			error = 0;
1837 		}
1838 		break;
1839 
1840 	default:
1841 		error = ieee80211_ioctl(ic, cmd, data);
1842 	}
1843 
1844 	if (error == ENETRESET) {
1845 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1846 		    (IFF_UP | IFF_RUNNING)) {
1847 			rt2860_stop(ifp, 0);
1848 			rt2860_init(ifp);
1849 		}
1850 		error = 0;
1851 	}
1852 
1853 	splx(s);
1854 
1855 	return error;
1856 }
1857 
1858 /*
1859  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
1860  * We access the BBP through the 8051 microcontroller unit which means that
1861  * the microcode must be loaded first.
1862  */
1863 static void
1864 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
1865 {
1866 	int ntries;
1867 
1868 	for (ntries = 0; ntries < 100; ntries++) {
1869 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
1870 			break;
1871 		DELAY(1);
1872 	}
1873 	if (ntries == 100) {
1874 		aprint_error_dev(sc->sc_dev,
1875 		    "could not write to BBP through MCU\n");
1876 		return;
1877 	}
1878 
1879 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
1880 	    RT2860_BBP_CSR_KICK | reg << 8 | val);
1881 	RAL_BARRIER_WRITE(sc);
1882 
1883 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
1884 	DELAY(1000);
1885 }
1886 
1887 static uint8_t
1888 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
1889 {
1890 	uint32_t val;
1891 	int ntries;
1892 
1893 	for (ntries = 0; ntries < 100; ntries++) {
1894 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
1895 			break;
1896 		DELAY(1);
1897 	}
1898 	if (ntries == 100) {
1899 		aprint_error_dev(sc->sc_dev,
1900 		    "could not read from BBP through MCU\n");
1901 		return 0;
1902 	}
1903 
1904 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
1905 	    RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
1906 	RAL_BARRIER_WRITE(sc);
1907 
1908 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
1909 	DELAY(1000);
1910 
1911 	for (ntries = 0; ntries < 100; ntries++) {
1912 		val = RAL_READ(sc, RT2860_H2M_BBPAGENT);
1913 		if (!(val & RT2860_BBP_CSR_KICK))
1914 			return val & 0xff;
1915 		DELAY(1);
1916 	}
1917 	aprint_error_dev(sc->sc_dev, "could not read from BBP through MCU\n");
1918 
1919 	return 0;
1920 }
1921 
1922 /*
1923  * Write to one of the 4 programmable 24-bit RF registers.
1924  */
1925 static void
1926 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
1927 {
1928 	uint32_t tmp;
1929 	int ntries;
1930 
1931 	for (ntries = 0; ntries < 100; ntries++) {
1932 		if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
1933 			break;
1934 		DELAY(1);
1935 	}
1936 	if (ntries == 100) {
1937 		aprint_error_dev(sc->sc_dev, "could not write to RF\n");
1938 		return;
1939 	}
1940 
1941 	/* RF registers are 24-bit on the RT2860 */
1942 	tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
1943 	    (val & 0x3fffff) << 2 | (reg & 3);
1944 	RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
1945 }
1946 
1947 static uint8_t
1948 rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
1949 {
1950 	uint32_t tmp;
1951 	int ntries;
1952 
1953 	for (ntries = 0; ntries < 100; ntries++) {
1954 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
1955 			break;
1956 		DELAY(1);
1957 	}
1958 	if (ntries == 100) {
1959 		aprint_error_dev(sc->sc_dev, "could not read RF register\n");
1960 		return 0xff;
1961 	}
1962 	tmp = RT3070_RF_KICK | reg << 8;
1963 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
1964 
1965 	for (ntries = 0; ntries < 100; ntries++) {
1966 		tmp = RAL_READ(sc, RT3070_RF_CSR_CFG);
1967 		if (!(tmp & RT3070_RF_KICK))
1968 			break;
1969 		DELAY(1);
1970 	}
1971 	if (ntries == 100) {
1972 		aprint_error_dev(sc->sc_dev, "could not read RF register\n");
1973 		return 0xff;
1974 	}
1975 	return tmp & 0xff;
1976 }
1977 
1978 static void
1979 rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
1980 {
1981 	uint32_t tmp;
1982 	int ntries;
1983 
1984 	for (ntries = 0; ntries < 10; ntries++) {
1985 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
1986 			break;
1987 		DELAY(10);
1988 	}
1989 	if (ntries == 10) {
1990 		aprint_error_dev(sc->sc_dev, "could not write to RF\n");
1991 		return;
1992 	}
1993 
1994 	tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
1995 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
1996 }
1997 
1998 /*
1999  * Send a command to the 8051 microcontroller unit.
2000  */
2001 static int
2002 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
2003 {
2004 	int slot, ntries;
2005 	uint32_t tmp;
2006 	uint8_t cid;
2007 
2008 	for (ntries = 0; ntries < 100; ntries++) {
2009 		if (!(RAL_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
2010 			break;
2011 		DELAY(2);
2012 	}
2013 	if (ntries == 100)
2014 		return EIO;
2015 
2016 	cid = wait ? cmd : RT2860_TOKEN_NO_INTR;
2017 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY | cid << 16 | arg);
2018 	RAL_BARRIER_WRITE(sc);
2019 	RAL_WRITE(sc, RT2860_HOST_CMD, cmd);
2020 
2021 	if (!wait)
2022 		return 0;
2023 	/* wait for the command to complete */
2024 	for (ntries = 0; ntries < 200; ntries++) {
2025 		tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID);
2026 		/* find the command slot */
2027 		for (slot = 0; slot < 4; slot++, tmp >>= 8)
2028 			if ((tmp & 0xff) == cid)
2029 				break;
2030 		if (slot < 4)
2031 			break;
2032 		DELAY(100);
2033 	}
2034 	if (ntries == 200) {
2035 		/* clear command and status */
2036 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2037 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2038 		return ETIMEDOUT;
2039 	}
2040 	/* get command status (1 means success) */
2041 	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS);
2042 	tmp = (tmp >> (slot * 8)) & 0xff;
2043 	DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
2044 	    cmd, slot, tmp));
2045 	/* clear command and status */
2046 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2047 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2048 	return (tmp == 1) ? 0 : EIO;
2049 }
2050 
2051 static void
2052 rt2860_enable_mrr(struct rt2860_softc *sc)
2053 {
2054 #define CCK(mcs)	(mcs)
2055 #define OFDM(mcs)	(1 << 3 | (mcs))
2056 	RAL_WRITE(sc, RT2860_LG_FBK_CFG0,
2057 	    OFDM(6) << 28 |	/* 54->48 */
2058 	    OFDM(5) << 24 |	/* 48->36 */
2059 	    OFDM(4) << 20 |	/* 36->24 */
2060 	    OFDM(3) << 16 |	/* 24->18 */
2061 	    OFDM(2) << 12 |	/* 18->12 */
2062 	    OFDM(1) <<  8 |	/* 12-> 9 */
2063 	    OFDM(0) <<  4 |	/*  9-> 6 */
2064 	    OFDM(0));		/*  6-> 6 */
2065 
2066 	RAL_WRITE(sc, RT2860_LG_FBK_CFG1,
2067 	    CCK(2) << 12 |	/* 11->5.5 */
2068 	    CCK(1) <<  8 |	/* 5.5-> 2 */
2069 	    CCK(0) <<  4 |	/*   2-> 1 */
2070 	    CCK(0));		/*   1-> 1 */
2071 #undef OFDM
2072 #undef CCK
2073 }
2074 
2075 static void
2076 rt2860_set_txpreamble(struct rt2860_softc *sc)
2077 {
2078 	uint32_t tmp;
2079 
2080 	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
2081 	tmp &= ~RT2860_CCK_SHORT_EN;
2082 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
2083 		tmp |= RT2860_CCK_SHORT_EN;
2084 	RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
2085 }
2086 
2087 static void
2088 rt2860_set_basicrates(struct rt2860_softc *sc)
2089 {
2090 	struct ieee80211com *ic = &sc->sc_ic;
2091 
2092 	/* set basic rates mask */
2093 	if (ic->ic_curmode == IEEE80211_MODE_11B)
2094 		RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
2095 	else if (ic->ic_curmode == IEEE80211_MODE_11A)
2096 		RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
2097 	else	/* 11g */
2098 		RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
2099 }
2100 
2101 static void
2102 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2103 {
2104 	uint32_t tmp;
2105 	uint8_t agc;
2106 
2107 	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2108 	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2109 	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2110 	rt2860_mcu_bbp_write(sc, 86, 0x00);
2111 
2112 	if (group == 0) {
2113 		if (sc->ext_2ghz_lna) {
2114 			rt2860_mcu_bbp_write(sc, 82, 0x62);
2115 			rt2860_mcu_bbp_write(sc, 75, 0x46);
2116 		} else {
2117 			rt2860_mcu_bbp_write(sc, 82, 0x84);
2118 			rt2860_mcu_bbp_write(sc, 75, 0x50);
2119 		}
2120 	} else {
2121 		if (sc->mac_ver == 0x3572)
2122 			rt2860_mcu_bbp_write(sc, 82, 0x94);
2123 		else
2124 			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2125 
2126 		if (sc->ext_5ghz_lna)
2127 			rt2860_mcu_bbp_write(sc, 75, 0x46);
2128 		else
2129 			rt2860_mcu_bbp_write(sc, 75, 0x50);
2130 	}
2131 
2132 	tmp = RAL_READ(sc, RT2860_TX_BAND_CFG);
2133 	tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
2134 	tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
2135 	RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
2136 
2137 	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2138 	tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
2139 	if (sc->nrxchains > 1)
2140 		tmp |= RT2860_LNA_PE1_EN;
2141 	if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
2142 		tmp |= RT3593_LNA_PE2_EN;
2143 	if (group == 0) {	/* 2GHz */
2144 		tmp |= RT2860_PA_PE_G0_EN;
2145 		if (sc->ntxchains > 1)
2146 			tmp |= RT2860_PA_PE_G1_EN;
2147 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2148 			tmp |= RT3593_PA_PE_G2_EN;
2149 	} else {		/* 5GHz */
2150 		tmp |= RT2860_PA_PE_A0_EN;
2151 		if (sc->ntxchains > 1)
2152 			tmp |= RT2860_PA_PE_A1_EN;
2153 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2154 			tmp |= RT3593_PA_PE_A2_EN;
2155 	}
2156 	if (sc->mac_ver == 0x3572) {
2157 		rt3090_rf_write(sc, 8, 0x00);
2158 		RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2159 		rt3090_rf_write(sc, 8, 0x80);
2160 	} else
2161 		RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2162 
2163 	if (sc->mac_ver == 0x3593) {
2164 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
2165 		if (sc->sc_flags & RT2860_PCIE) {
2166 			tmp &= ~0x01010000;
2167 			if (group == 0)
2168 				tmp |= 0x00010000;
2169 		} else {
2170 			tmp &= ~0x00008080;
2171 			if (group == 0)
2172 				tmp |= 0x00000080;
2173 		}
2174 		tmp = (tmp & ~0x00001000) | 0x00000010;
2175 		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp);
2176 	}
2177 
2178 	/* set initial AGC value */
2179 	if (group == 0) {	/* 2GHz band */
2180 		if (sc->mac_ver >= 0x3071)
2181 			agc = 0x1c + sc->lna[0] * 2;
2182 		else
2183 			agc = 0x2e + sc->lna[0];
2184 	} else {		/* 5GHz band */
2185 		if (sc->mac_ver == 0x3572)
2186 			agc = 0x22 + (sc->lna[group] * 5) / 3;
2187 		else
2188 			agc = 0x32 + (sc->lna[group] * 5) / 3;
2189 	}
2190 	rt2860_mcu_bbp_write(sc, 66, agc);
2191 
2192 	DELAY(1000);
2193 }
2194 
2195 static void
2196 rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
2197 {
2198 	const struct rfprog *rfprog = rt2860_rf2850;
2199 	uint32_t r2, r3, r4;
2200 	int8_t txpow1, txpow2;
2201 	u_int i;
2202 
2203 	/* find the settings for this channel (we know it exists) */
2204 	for (i = 0; rfprog[i].chan != chan; i++);
2205 
2206 	r2 = rfprog[i].r2;
2207 	if (sc->ntxchains == 1)
2208 		r2 |= 1 << 12;		/* 1T: disable Tx chain 2 */
2209 	if (sc->nrxchains == 1)
2210 		r2 |= 1 << 15 | 1 << 4;	/* 1R: disable Rx chains 2 & 3 */
2211 	else if (sc->nrxchains == 2)
2212 		r2 |= 1 << 4;		/* 2R: disable Rx chain 3 */
2213 
2214 	/* use Tx power values from EEPROM */
2215 	txpow1 = sc->txpow1[i];
2216 	txpow2 = sc->txpow2[i];
2217 	if (chan > 14) {
2218 		if (txpow1 >= 0)
2219 			txpow1 = txpow1 << 1 | 1;
2220 		else
2221 			txpow1 = (7 + txpow1) << 1;
2222 		if (txpow2 >= 0)
2223 			txpow2 = txpow2 << 1 | 1;
2224 		else
2225 			txpow2 = (7 + txpow2) << 1;
2226 	}
2227 	r3 = rfprog[i].r3 | txpow1 << 7;
2228 	r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
2229 
2230 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2231 	rt2860_rf_write(sc, RT2860_RF2, r2);
2232 	rt2860_rf_write(sc, RT2860_RF3, r3);
2233 	rt2860_rf_write(sc, RT2860_RF4, r4);
2234 
2235 	DELAY(200);
2236 
2237 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2238 	rt2860_rf_write(sc, RT2860_RF2, r2);
2239 	rt2860_rf_write(sc, RT2860_RF3, r3 | 1);
2240 	rt2860_rf_write(sc, RT2860_RF4, r4);
2241 
2242 	DELAY(200);
2243 
2244 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2245 	rt2860_rf_write(sc, RT2860_RF2, r2);
2246 	rt2860_rf_write(sc, RT2860_RF3, r3);
2247 	rt2860_rf_write(sc, RT2860_RF4, r4);
2248 }
2249 
2250 static void
2251 rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
2252 {
2253 	int8_t txpow1, txpow2;
2254 	uint8_t rf;
2255 	int i;
2256 
2257 	KASSERT(chan >= 1 && chan <= 14);	/* RT3090 is 2GHz only */
2258 
2259 	/* find the settings for this channel (we know it exists) */
2260 	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2261 
2262 	/* use Tx power values from EEPROM */
2263 	txpow1 = sc->txpow1[i];
2264 	txpow2 = sc->txpow2[i];
2265 
2266 	rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
2267 	rf = rt3090_rf_read(sc, 3);
2268 	rf = (rf & ~0x0f) | rt3090_freqs[i].k;
2269 	rt3090_rf_write(sc, 3, rf);
2270 	rf = rt3090_rf_read(sc, 6);
2271 	rf = (rf & ~0x03) | rt3090_freqs[i].r;
2272 	rt3090_rf_write(sc, 6, rf);
2273 
2274 	/* set Tx0 power */
2275 	rf = rt3090_rf_read(sc, 12);
2276 	rf = (rf & ~0x1f) | txpow1;
2277 	rt3090_rf_write(sc, 12, rf);
2278 
2279 	/* set Tx1 power */
2280 	rf = rt3090_rf_read(sc, 13);
2281 	rf = (rf & ~0x1f) | txpow2;
2282 	rt3090_rf_write(sc, 13, rf);
2283 
2284 	rf = rt3090_rf_read(sc, 1);
2285 	rf &= ~0xfc;
2286 	if (sc->ntxchains == 1)
2287 		rf |= RT3070_TX1_PD | RT3070_TX2_PD;
2288 	else if (sc->ntxchains == 2)
2289 		rf |= RT3070_TX2_PD;
2290 	if (sc->nrxchains == 1)
2291 		rf |= RT3070_RX1_PD | RT3070_RX2_PD;
2292 	else if (sc->nrxchains == 2)
2293 		rf |= RT3070_RX2_PD;
2294 	rt3090_rf_write(sc, 1, rf);
2295 
2296 	/* set RF offset */
2297 	rf = rt3090_rf_read(sc, 23);
2298 	rf = (rf & ~0x7f) | sc->freq;
2299 	rt3090_rf_write(sc, 23, rf);
2300 
2301 	/* program RF filter */
2302 	rf = rt3090_rf_read(sc, 24);	/* Tx */
2303 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2304 	rt3090_rf_write(sc, 24, rf);
2305 	rf = rt3090_rf_read(sc, 31);	/* Rx */
2306 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2307 	rt3090_rf_write(sc, 31, rf);
2308 
2309 	/* enable RF tuning */
2310 	rf = rt3090_rf_read(sc, 7);
2311 	rt3090_rf_write(sc, 7, rf | RT3070_TUNE);
2312 }
2313 
2314 static int
2315 rt3090_rf_init(struct rt2860_softc *sc)
2316 {
2317 	uint32_t tmp;
2318 	uint8_t rf, bbp;
2319 	int i;
2320 
2321 	rf = rt3090_rf_read(sc, 30);
2322 	/* toggle RF R30 bit 7 */
2323 	rt3090_rf_write(sc, 30, rf | 0x80);
2324 	DELAY(1000);
2325 	rt3090_rf_write(sc, 30, rf & ~0x80);
2326 
2327 	tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2328 	tmp &= ~0x1f000000;
2329 	if (sc->patch_dac && sc->mac_rev < 0x0211)
2330 		tmp |= 0x0d000000;	/* 1.35V */
2331 	else
2332 		tmp |= 0x01000000;	/* 1.2V */
2333 	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2334 
2335 	/* patch LNA_PE_G1 */
2336 	tmp = RAL_READ(sc, RT3070_GPIO_SWITCH);
2337 	RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
2338 
2339 	/* initialize RF registers to default value */
2340 	if (sc->mac_ver == 0x3572) {
2341 		for (i = 0; i < (int)__arraycount(rt3572_def_rf); i++) {
2342 			rt3090_rf_write(sc, rt3572_def_rf[i].reg,
2343 			    rt3572_def_rf[i].val);
2344 		}
2345 	} else {
2346 		for (i = 0; i < (int)__arraycount(rt3090_def_rf); i++) {
2347 			rt3090_rf_write(sc, rt3090_def_rf[i].reg,
2348 			    rt3090_def_rf[i].val);
2349 		}
2350 	}
2351 
2352 	/* select 20MHz bandwidth */
2353 	rt3090_rf_write(sc, 31, 0x14);
2354 
2355 	rf = rt3090_rf_read(sc, 6);
2356 	rt3090_rf_write(sc, 6, rf | 0x40);
2357 
2358 	if (sc->mac_ver != 0x3593) {
2359 		/* calibrate filter for 20MHz bandwidth */
2360 		sc->rf24_20mhz = 0x1f;	/* default value */
2361 		rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
2362 
2363 		/* select 40MHz bandwidth */
2364 		bbp = rt2860_mcu_bbp_read(sc, 4);
2365 		rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) | 0x10);
2366 		rf = rt3090_rf_read(sc, 31);
2367 		rt3090_rf_write(sc, 31, rf | 0x20);
2368 
2369 		/* calibrate filter for 40MHz bandwidth */
2370 		sc->rf24_40mhz = 0x2f;	/* default value */
2371 		rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
2372 
2373 		/* go back to 20MHz bandwidth */
2374 		bbp = rt2860_mcu_bbp_read(sc, 4);
2375 		rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
2376 	}
2377 	if (sc->mac_rev < 0x0211)
2378 		rt3090_rf_write(sc, 27, 0x03);
2379 
2380 	tmp = RAL_READ(sc, RT3070_OPT_14);
2381 	RAL_WRITE(sc, RT3070_OPT_14, tmp | 1);
2382 
2383 	if (sc->rf_rev == RT3070_RF_3020)
2384 		rt3090_set_rx_antenna(sc, 0);
2385 
2386 	bbp = rt2860_mcu_bbp_read(sc, 138);
2387 	if (sc->mac_ver == 0x3593) {
2388 		if (sc->ntxchains == 1)
2389 			bbp |= 0x60;	/* turn off DAC1 and DAC2 */
2390 		else if (sc->ntxchains == 2)
2391 			bbp |= 0x40;	/* turn off DAC2 */
2392 		if (sc->nrxchains == 1)
2393 			bbp &= ~0x06;	/* turn off ADC1 and ADC2 */
2394 		else if (sc->nrxchains == 2)
2395 			bbp &= ~0x04;	/* turn off ADC2 */
2396 	} else {
2397 		if (sc->ntxchains == 1)
2398 			bbp |= 0x20;	/* turn off DAC1 */
2399 		if (sc->nrxchains == 1)
2400 			bbp &= ~0x02;	/* turn off ADC1 */
2401 	}
2402 	rt2860_mcu_bbp_write(sc, 138, bbp);
2403 
2404 	rf = rt3090_rf_read(sc, 1);
2405 	rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
2406 	rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
2407 	rt3090_rf_write(sc, 1, rf);
2408 
2409 	rf = rt3090_rf_read(sc, 15);
2410 	rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
2411 
2412 	rf = rt3090_rf_read(sc, 17);
2413 	rf &= ~RT3070_TX_LO1;
2414 	if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
2415 		rf |= 0x20;	/* fix for long range Rx issue */
2416 	if (sc->txmixgain_2ghz >= 2)
2417 		rf = (rf & ~0x7) | sc->txmixgain_2ghz;
2418 	rt3090_rf_write(sc, 17, rf);
2419 
2420 	rf = rt3090_rf_read(sc, 20);
2421 	rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
2422 
2423 	rf = rt3090_rf_read(sc, 21);
2424 	rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
2425 
2426 	return 0;
2427 }
2428 
2429 static void
2430 rt3090_rf_wakeup(struct rt2860_softc *sc)
2431 {
2432 	uint32_t tmp;
2433 	uint8_t rf;
2434 
2435 	if (sc->mac_ver == 0x3593) {
2436 		/* enable VCO */
2437 		rf = rt3090_rf_read(sc, 1);
2438 		rt3090_rf_write(sc, 1, rf | RT3593_VCO);
2439 
2440 		/* initiate VCO calibration */
2441 		rf = rt3090_rf_read(sc, 3);
2442 		rt3090_rf_write(sc, 3, rf | RT3593_VCOCAL);
2443 
2444 		/* enable VCO bias current control */
2445 		rf = rt3090_rf_read(sc, 6);
2446 		rt3090_rf_write(sc, 6, rf | RT3593_VCO_IC);
2447 
2448 		/* initiate res calibration */
2449 		rf = rt3090_rf_read(sc, 2);
2450 		rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2451 
2452 		/* set reference current control to 0.33 mA */
2453 		rf = rt3090_rf_read(sc, 22);
2454 		rf &= ~RT3593_CP_IC_MASK;
2455 		rf |= 1 << RT3593_CP_IC_SHIFT;
2456 		rt3090_rf_write(sc, 22, rf);
2457 
2458 		/* enable RX CTB */
2459 		rf = rt3090_rf_read(sc, 46);
2460 		rt3090_rf_write(sc, 46, rf | RT3593_RX_CTB);
2461 
2462 		rf = rt3090_rf_read(sc, 20);
2463 		rf &= ~(RT3593_LDO_RF_VC_MASK | RT3593_LDO_PLL_VC_MASK);
2464 		rt3090_rf_write(sc, 20, rf);
2465 	} else {
2466 		/* enable RF block */
2467 		rf = rt3090_rf_read(sc, 1);
2468 		rt3090_rf_write(sc, 1, rf | RT3070_RF_BLOCK);
2469 
2470 		/* enable VCO bias current control */
2471 		rf = rt3090_rf_read(sc, 7);
2472 		rt3090_rf_write(sc, 7, rf | 0x30);
2473 
2474 		rf = rt3090_rf_read(sc, 9);
2475 		rt3090_rf_write(sc, 9, rf | 0x0e);
2476 
2477 		/* enable RX CTB */
2478 		rf = rt3090_rf_read(sc, 21);
2479 		rt3090_rf_write(sc, 21, rf | RT3070_RX_CTB);
2480 
2481 		/* fix Tx to Rx IQ glitch by raising RF voltage */
2482 		rf = rt3090_rf_read(sc, 27);
2483 		rf &= ~0x77;
2484 		if (sc->mac_rev < 0x0211)
2485 			rf |= 0x03;
2486 		rt3090_rf_write(sc, 27, rf);
2487 	}
2488 	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2489 		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2490 		tmp = (tmp & ~0x1f000000) | 0x0d000000;
2491 		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2492 	}
2493 }
2494 
2495 static int
2496 rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
2497     uint8_t *val)
2498 {
2499 	uint8_t rf22, rf24;
2500 	uint8_t bbp55_pb, bbp55_sb, delta;
2501 	int ntries;
2502 
2503 	/* program filter */
2504 	rf24 = rt3090_rf_read(sc, 24);
2505 	rf24 = (rf24 & 0xc0) | init;	/* initial filter value */
2506 	rt3090_rf_write(sc, 24, rf24);
2507 
2508 	/* enable baseband loopback mode */
2509 	rf22 = rt3090_rf_read(sc, 22);
2510 	rt3090_rf_write(sc, 22, rf22 | RT3070_BB_LOOPBACK);
2511 
2512 	/* set power and frequency of passband test tone */
2513 	rt2860_mcu_bbp_write(sc, 24, 0x00);
2514 	for (ntries = 0; ntries < 100; ntries++) {
2515 		/* transmit test tone */
2516 		rt2860_mcu_bbp_write(sc, 25, 0x90);
2517 		DELAY(1000);
2518 		/* read received power */
2519 		bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
2520 		if (bbp55_pb != 0)
2521 			break;
2522 	}
2523 	if (ntries == 100)
2524 		return ETIMEDOUT;
2525 
2526 	/* set power and frequency of stopband test tone */
2527 	rt2860_mcu_bbp_write(sc, 24, 0x06);
2528 	for (ntries = 0; ntries < 100; ntries++) {
2529 		/* transmit test tone */
2530 		rt2860_mcu_bbp_write(sc, 25, 0x90);
2531 		DELAY(1000);
2532 		/* read received power */
2533 		bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
2534 
2535 		delta = bbp55_pb - bbp55_sb;
2536 		if (delta > target)
2537 			break;
2538 
2539 		/* reprogram filter */
2540 		rf24++;
2541 		rt3090_rf_write(sc, 24, rf24);
2542 	}
2543 	if (ntries < 100) {
2544 		if (rf24 != init)
2545 			rf24--;	/* backtrack */
2546 		*val = rf24;
2547 		rt3090_rf_write(sc, 24, rf24);
2548 	}
2549 
2550 	/* restore initial state */
2551 	rt2860_mcu_bbp_write(sc, 24, 0x00);
2552 
2553 	/* disable baseband loopback mode */
2554 	rf22 = rt3090_rf_read(sc, 22);
2555 	rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK);
2556 
2557 	return 0;
2558 }
2559 
2560 static void
2561 rt3090_rf_setup(struct rt2860_softc *sc)
2562 {
2563 	uint8_t bbp;
2564 	int i;
2565 
2566 	if (sc->mac_rev >= 0x0211) {
2567 		/* enable DC filter */
2568 		rt2860_mcu_bbp_write(sc, 103, 0xc0);
2569 
2570 		/* improve power consumption */
2571 		bbp = rt2860_mcu_bbp_read(sc, 31);
2572 		rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
2573 	}
2574 
2575 	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
2576 	if (sc->mac_rev < 0x0211) {
2577 		RAL_WRITE(sc, RT2860_TX_SW_CFG2,
2578 		    sc->patch_dac ? 0x2c : 0x0f);
2579 	} else
2580 		RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
2581 
2582 	/* initialize RF registers from ROM */
2583 	for (i = 0; i < 10; i++) {
2584 		if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
2585 			continue;
2586 		rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
2587 	}
2588 }
2589 
2590 static void
2591 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
2592 {
2593 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
2594 	    which | (sc->leds & 0x7f), 0);
2595 }
2596 
2597 /*
2598  * Hardware has a general-purpose programmable timer interrupt that can
2599  * periodically raise MAC_INT_4.
2600  */
2601 static void
2602 rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
2603 {
2604 	uint32_t tmp;
2605 
2606 	/* disable GP timer before reprogramming it */
2607 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
2608 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN);
2609 
2610 	if (ms == 0)
2611 		return;
2612 
2613 	tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG);
2614 	ms *= 16;	/* Unit: 64us */
2615 	tmp = (tmp & 0xffff) | ms << RT2860_GP_TIMER_SHIFT;
2616 	RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp);
2617 
2618 	/* enable GP timer */
2619 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
2620 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp | RT2860_GP_TIMER_EN);
2621 }
2622 
2623 static void
2624 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
2625 {
2626 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,
2627 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
2628 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,
2629 	    bssid[4] | bssid[5] << 8);
2630 }
2631 
2632 static void
2633 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
2634 {
2635 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,
2636 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
2637 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,
2638 	    addr[4] | addr[5] << 8 | 0xff << 16);
2639 }
2640 
2641 static void
2642 rt2860_updateslot(struct ifnet *ifp)
2643 {
2644 	struct rt2860_softc *sc = ifp->if_softc;
2645 	struct ieee80211com *ic = &sc->sc_ic;
2646 	uint32_t tmp;
2647 
2648 	tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG);
2649 	tmp &= ~0xff;
2650 	tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2651 	RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
2652 }
2653 
2654 static void
2655 rt2860_updateprot(struct ieee80211com *ic)
2656 {
2657 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
2658 	uint32_t tmp;
2659 
2660 	tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
2661 	/* setup protection frame rate (MCS code) */
2662 	tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
2663 	    rt2860_rates[RT2860_RIDX_OFDM6].mcs :
2664 	    rt2860_rates[RT2860_RIDX_CCK11].mcs;
2665 
2666 	/* CCK frames don't require protection */
2667 	RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
2668 
2669 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
2670 		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2671 			tmp |= RT2860_PROT_CTRL_RTS_CTS;
2672 		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2673 			tmp |= RT2860_PROT_CTRL_CTS;
2674 	}
2675 	RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
2676 }
2677 
2678 static int
2679 rt2860_updateedca(struct ieee80211com *ic)
2680 {
2681 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
2682 	int aci;
2683 
2684 	/* update MAC TX configuration registers */
2685 	for (aci = 0; aci < WME_NUM_AC; aci++) {
2686 		RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),
2687 		    ic->ic_wme.wme_params[aci].wmep_logcwmax << 16 |
2688 		    ic->ic_wme.wme_params[aci].wmep_logcwmin << 12 |
2689 		    ic->ic_wme.wme_params[aci].wmep_aifsn  <<  8 |
2690 		    ic->ic_wme.wme_params[aci].wmep_txopLimit);
2691 	}
2692 
2693 	/* update SCH/DMA registers too */
2694 	RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,
2695 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_aifsn  << 12 |
2696 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_aifsn  <<  8 |
2697 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_aifsn  <<  4 |
2698 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_aifsn);
2699 	RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,
2700 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_logcwmin << 12 |
2701 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_logcwmin <<  8 |
2702 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_logcwmin <<  4 |
2703 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_logcwmin);
2704 	RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,
2705 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_logcwmax << 12 |
2706 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_logcwmax <<  8 |
2707 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_logcwmax <<  4 |
2708 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_logcwmax);
2709 	RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,
2710 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_txopLimit << 16 |
2711 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_txopLimit);
2712 	RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,
2713 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_txopLimit << 16 |
2714 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_txopLimit);
2715 	return 0;
2716 }
2717 
2718 static int
2719 rt2860_set_key(struct ieee80211com *ic, const struct ieee80211_key *ck,
2720     const uint8_t *mac)
2721 {
2722 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
2723 	struct ieee80211_node *ni = ic->ic_bss;
2724 	bus_size_t base;
2725 	uint32_t attr;
2726 	uint8_t mode, wcid, iv[8];
2727 	struct ieee80211_key *k = __UNCONST(ck); /* XXX */
2728 
2729 	/* map net80211 cipher to RT2860 security mode */
2730 	switch (k->wk_cipher->ic_cipher) {
2731 	case IEEE80211_CIPHER_WEP:
2732 		k->wk_flags |= IEEE80211_KEY_GROUP; /* XXX */
2733 		if (k->wk_keylen == 5)
2734 			mode = RT2860_MODE_WEP40;
2735 		else
2736 			mode = RT2860_MODE_WEP104;
2737 		break;
2738 	case IEEE80211_CIPHER_TKIP:
2739 		mode = RT2860_MODE_TKIP;
2740 		break;
2741 	case IEEE80211_CIPHER_AES_CCM:
2742 		mode = RT2860_MODE_AES_CCMP;
2743 		break;
2744 	default:
2745 		return EINVAL;
2746 	}
2747 
2748 	if (k->wk_flags & IEEE80211_KEY_GROUP) {
2749 		wcid = 0;	/* NB: update WCID0 for group keys */
2750 		base = RT2860_SKEY(0, k->wk_keyix);
2751 	} else {
2752 		wcid = ((struct rt2860_node *)ni)->wcid;
2753 		base = RT2860_PKEY(wcid);
2754 	}
2755 
2756 	if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
2757 		RAL_WRITE_REGION_1(sc, base, k->wk_key, 16);
2758 #ifndef IEEE80211_STA_ONLY
2759 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2760 			RAL_WRITE_REGION_1(sc, base + 16, &k->wk_key[16], 8);
2761 			RAL_WRITE_REGION_1(sc, base + 24, &k->wk_key[24], 8);
2762 		} else
2763 #endif
2764 		{
2765 			RAL_WRITE_REGION_1(sc, base + 16, &k->wk_key[24], 8);
2766 			RAL_WRITE_REGION_1(sc, base + 24, &k->wk_key[16], 8);
2767 		}
2768 	} else
2769 		RAL_WRITE_REGION_1(sc, base, k->wk_key, k->wk_keylen);
2770 
2771 	if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
2772 	    (k->wk_flags & IEEE80211_KEY_XMIT)) {
2773 		/* set initial packet number in IV+EIV */
2774 		if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
2775 			uint32_t val = cprng_fast32();
2776 			/* skip weak IVs from Fluhrer/Mantin/Shamir */
2777 			if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
2778 				val += 0x000100;
2779 			iv[0] = val;
2780 			iv[1] = val >> 8;
2781 			iv[2] = val >> 16;
2782 			iv[3] = k->wk_keyix << 6;
2783 			iv[4] = iv[5] = iv[6] = iv[7] = 0;
2784 		} else {
2785 			if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
2786 				iv[0] = k->wk_keytsc >> 8;
2787 				iv[1] = (iv[0] | 0x20) & 0x7f;
2788 				iv[2] = k->wk_keytsc;
2789 			} else /* CCMP */ {
2790 				iv[0] = k->wk_keytsc;
2791 				iv[1] = k->wk_keytsc >> 8;
2792 				iv[2] = 0;
2793 			}
2794 			iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
2795 			iv[4] = k->wk_keytsc >> 16;
2796 			iv[5] = k->wk_keytsc >> 24;
2797 			iv[6] = k->wk_keytsc >> 32;
2798 			iv[7] = k->wk_keytsc >> 40;
2799 		}
2800 		RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8);
2801 	}
2802 
2803 	if (k->wk_flags & IEEE80211_KEY_GROUP) {
2804 		/* install group key */
2805 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
2806 		attr &= ~(0xf << (k->wk_keyix * 4));
2807 		attr |= mode << (k->wk_keyix * 4);
2808 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
2809 	} else {
2810 		/* install pairwise key */
2811 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
2812 		attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
2813 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
2814 	}
2815 	return 1;
2816 }
2817 
2818 static int
2819 rt2860_delete_key(struct ieee80211com *ic, const struct ieee80211_key *k)
2820 {
2821 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
2822 	struct ieee80211_node *ni = ic->ic_bss;
2823 	uint32_t attr;
2824 	uint8_t wcid;
2825 
2826 	if (k->wk_flags & IEEE80211_KEY_GROUP) {
2827 		/* remove group key */
2828 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
2829 		attr &= ~(0xf << (k->wk_keyix * 4));
2830 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
2831 
2832 	} else {
2833 		/* remove pairwise key */
2834 		wcid = ((struct rt2860_node *)ni)->wcid;
2835 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
2836 		attr &= ~0xf;
2837 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
2838 	}
2839 	return 1;
2840 }
2841 
2842 static int8_t
2843 rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
2844 {
2845 	struct ieee80211com *ic = &sc->sc_ic;
2846 	struct ieee80211_channel *c = ic->ic_ibss_chan;
2847 	int delta;
2848 
2849 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2850 		u_int chan = ieee80211_chan2ieee(ic, c);
2851 		delta = sc->rssi_5ghz[rxchain];
2852 
2853 		/* determine channel group */
2854 		if (chan <= 64)
2855 			delta -= sc->lna[1];
2856 		else if (chan <= 128)
2857 			delta -= sc->lna[2];
2858 		else
2859 			delta -= sc->lna[3];
2860 	} else
2861 		delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
2862 
2863 	return -12 - delta - rssi;
2864 }
2865 
2866 /*
2867  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
2868  * Used to adjust per-rate Tx power registers.
2869  */
2870 static __inline uint32_t
2871 b4inc(uint32_t b32, int8_t delta)
2872 {
2873 	int8_t i, b4;
2874 
2875 	for (i = 0; i < 8; i++) {
2876 		b4 = b32 & 0xf;
2877 		b4 += delta;
2878 		if (b4 < 0)
2879 			b4 = 0;
2880 		else if (b4 > 0xf)
2881 			b4 = 0xf;
2882 		b32 = b32 >> 4 | b4 << 28;
2883 	}
2884 	return b32;
2885 }
2886 
2887 static const char *
2888 rt2860_get_rf(uint8_t rev)
2889 {
2890 	switch (rev) {
2891 	case RT2860_RF_2820:	return "RT2820";
2892 	case RT2860_RF_2850:	return "RT2850";
2893 	case RT2860_RF_2720:	return "RT2720";
2894 	case RT2860_RF_2750:	return "RT2750";
2895 	case RT3070_RF_3020:	return "RT3020";
2896 	case RT3070_RF_2020:	return "RT2020";
2897 	case RT3070_RF_3021:	return "RT3021";
2898 	case RT3070_RF_3022:	return "RT3022";
2899 	case RT3070_RF_3052:	return "RT3052";
2900 	case RT3070_RF_3320:	return "RT3320";
2901 	case RT3070_RF_3053:	return "RT3053";
2902 	default:		return "unknown";
2903 	}
2904 }
2905 
2906 static int
2907 rt2860_read_eeprom(struct rt2860_softc *sc)
2908 {
2909 	struct ieee80211com *ic = &sc->sc_ic;
2910 	int8_t delta_2ghz, delta_5ghz;
2911 	uint32_t tmp;
2912 	uint16_t val;
2913 	int ridx, ant, i;
2914 
2915 	/* check whether the ROM is eFUSE ROM or EEPROM */
2916 	sc->sc_srom_read = rt2860_eeprom_read_2;
2917 	if (sc->mac_ver >= 0x3071) {
2918 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
2919 		DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
2920 		if (tmp & RT3070_SEL_EFUSE)
2921 			sc->sc_srom_read = rt3090_efuse_read_2;
2922 	}
2923 
2924 	/* read EEPROM version */
2925 	val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION);
2926 	DPRINTF(("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8));
2927 
2928 	/* read MAC address */
2929 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC01);
2930 	ic->ic_myaddr[0] = val & 0xff;
2931 	ic->ic_myaddr[1] = val >> 8;
2932 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC23);
2933 	ic->ic_myaddr[2] = val & 0xff;
2934 	ic->ic_myaddr[3] = val >> 8;
2935 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC45);
2936 	ic->ic_myaddr[4] = val & 0xff;
2937 	ic->ic_myaddr[5] = val >> 8;
2938 
2939 	/* read country code */
2940 	val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY);
2941 	DPRINTF(("EEPROM region code=0x%04x\n", val));
2942 
2943 	/* read vendor BBP settings */
2944 	for (i = 0; i < 8; i++) {
2945 		val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE + i);
2946 		sc->bbp[i].val = val & 0xff;
2947 		sc->bbp[i].reg = val >> 8;
2948 		DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
2949 	}
2950 	if (sc->mac_ver >= 0x3071) {
2951 		/* read vendor RF settings */
2952 		for (i = 0; i < 10; i++) {
2953 			val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE + i);
2954 			sc->rf[i].val = val & 0xff;
2955 			sc->rf[i].reg = val >> 8;
2956 			DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
2957 			    sc->rf[i].val));
2958 		}
2959 	}
2960 
2961 	/* read RF frequency offset from EEPROM */
2962 	val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS);
2963 	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
2964 	DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
2965 	if ((val >> 8) != 0xff) {
2966 		/* read LEDs operating mode */
2967 		sc->leds = val >> 8;
2968 		sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED1);
2969 		sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED2);
2970 		sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED3);
2971 	} else {
2972 		/* broken EEPROM, use default settings */
2973 		sc->leds = 0x01;
2974 		sc->led[0] = 0x5555;
2975 		sc->led[1] = 0x2221;
2976 		sc->led[2] = 0xa9f8;
2977 	}
2978 	DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
2979 	    sc->leds, sc->led[0], sc->led[1], sc->led[2]));
2980 
2981 	/* read RF information */
2982 	val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA);
2983 	if (val == 0xffff) {
2984 		DPRINTF(("invalid EEPROM antenna info, using default\n"));
2985 		if (sc->mac_ver == 0x3593) {
2986 			/* default to RF3053 3T3R */
2987 			sc->rf_rev = RT3070_RF_3053;
2988 			sc->ntxchains = 3;
2989 			sc->nrxchains = 3;
2990 		} else if (sc->mac_ver >= 0x3071) {
2991 			/* default to RF3020 1T1R */
2992 			sc->rf_rev = RT3070_RF_3020;
2993 			sc->ntxchains = 1;
2994 			sc->nrxchains = 1;
2995 		} else {
2996 			/* default to RF2820 1T2R */
2997 			sc->rf_rev = RT2860_RF_2820;
2998 			sc->ntxchains = 1;
2999 			sc->nrxchains = 2;
3000 		}
3001 	} else {
3002 		sc->rf_rev = (val >> 8) & 0xf;
3003 		sc->ntxchains = (val >> 4) & 0xf;
3004 		sc->nrxchains = val & 0xf;
3005 	}
3006 	DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
3007 	    sc->rf_rev, sc->ntxchains, sc->nrxchains));
3008 
3009 	/* check if RF supports automatic Tx access gain control */
3010 	val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG);
3011 	DPRINTF(("EEPROM CFG 0x%04x\n", val));
3012 	/* check if driver should patch the DAC issue */
3013 	if ((val >> 8) != 0xff)
3014 		sc->patch_dac = (val >> 15) & 1;
3015 	if ((val & 0xff) != 0xff) {
3016 		sc->ext_5ghz_lna = (val >> 3) & 1;
3017 		sc->ext_2ghz_lna = (val >> 2) & 1;
3018 		/* check if RF supports automatic Tx access gain control */
3019 		sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */;
3020 		/* check if we have a hardware radio switch */
3021 		sc->rfswitch = val & 1;
3022 	}
3023 	if (sc->sc_flags & RT2860_ADVANCED_PS) {
3024 		/* read PCIe power save level */
3025 		val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
3026 		if ((val & 0xff) != 0xff) {
3027 			sc->pslevel = val & 0x3;
3028 			val = rt2860_srom_read(sc, RT2860_EEPROM_REV);
3029 			if ((val & 0xff80) != 0x9280)
3030 				sc->pslevel = MIN(sc->pslevel, 1);
3031 			DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
3032 		}
3033 	}
3034 
3035 	/* read power settings for 2GHz channels */
3036 	for (i = 0; i < 14; i += 2) {
3037 		val = rt2860_srom_read(sc,
3038 		    RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
3039 		sc->txpow1[i + 0] = (int8_t)(val & 0xff);
3040 		sc->txpow1[i + 1] = (int8_t)(val >> 8);
3041 
3042 		val = rt2860_srom_read(sc,
3043 		    RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
3044 		sc->txpow2[i + 0] = (int8_t)(val & 0xff);
3045 		sc->txpow2[i + 1] = (int8_t)(val >> 8);
3046 	}
3047 	/* fix broken Tx power entries */
3048 	for (i = 0; i < 14; i++) {
3049 		if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
3050 			sc->txpow1[i] = 5;
3051 		if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
3052 			sc->txpow2[i] = 5;
3053 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3054 		    rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
3055 	}
3056 	/* read power settings for 5GHz channels */
3057 	for (i = 0; i < 40; i += 2) {
3058 		val = rt2860_srom_read(sc,
3059 		    RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
3060 		sc->txpow1[i + 14] = (int8_t)(val & 0xff);
3061 		sc->txpow1[i + 15] = (int8_t)(val >> 8);
3062 
3063 		val = rt2860_srom_read(sc,
3064 		    RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
3065 		sc->txpow2[i + 14] = (int8_t)(val & 0xff);
3066 		sc->txpow2[i + 15] = (int8_t)(val >> 8);
3067 	}
3068 	/* fix broken Tx power entries */
3069 	for (i = 0; i < 40; i++) {
3070 		if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
3071 			sc->txpow1[14 + i] = 5;
3072 		if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
3073 			sc->txpow2[14 + i] = 5;
3074 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3075 		    rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
3076 		    sc->txpow2[14 + i]));
3077 	}
3078 
3079 	/* read Tx power compensation for each Tx rate */
3080 	val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR);
3081 	delta_2ghz = delta_5ghz = 0;
3082 	if ((val & 0xff) != 0xff && (val & 0x80)) {
3083 		delta_2ghz = val & 0xf;
3084 		if (!(val & 0x40))	/* negative number */
3085 			delta_2ghz = -delta_2ghz;
3086 	}
3087 	val >>= 8;
3088 	if ((val & 0xff) != 0xff && (val & 0x80)) {
3089 		delta_5ghz = val & 0xf;
3090 		if (!(val & 0x40))	/* negative number */
3091 			delta_5ghz = -delta_5ghz;
3092 	}
3093 	DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
3094 	    delta_2ghz, delta_5ghz));
3095 
3096 	for (ridx = 0; ridx < 5; ridx++) {
3097 		uint32_t reg;
3098 
3099 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2);
3100 		reg = val;
3101 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1);
3102 		reg |= (uint32_t)val << 16;
3103 
3104 		sc->txpow20mhz[ridx] = reg;
3105 		sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
3106 		sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
3107 
3108 		DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
3109 		    "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
3110 		    sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
3111 	}
3112 
3113 	/* read factory-calibrated samples for temperature compensation */
3114 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
3115 	sc->tssi_2ghz[0] = val & 0xff;	/* [-4] */
3116 	sc->tssi_2ghz[1] = val >> 8;	/* [-3] */
3117 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
3118 	sc->tssi_2ghz[2] = val & 0xff;	/* [-2] */
3119 	sc->tssi_2ghz[3] = val >> 8;	/* [-1] */
3120 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
3121 	sc->tssi_2ghz[4] = val & 0xff;	/* [+0] */
3122 	sc->tssi_2ghz[5] = val >> 8;	/* [+1] */
3123 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
3124 	sc->tssi_2ghz[6] = val & 0xff;	/* [+2] */
3125 	sc->tssi_2ghz[7] = val >> 8;	/* [+3] */
3126 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
3127 	sc->tssi_2ghz[8] = val & 0xff;	/* [+4] */
3128 	sc->step_2ghz = val >> 8;
3129 	DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3130 	    "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
3131 	    sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
3132 	    sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
3133 	    sc->tssi_2ghz[8], sc->step_2ghz));
3134 	/* check that ref value is correct, otherwise disable calibration */
3135 	if (sc->tssi_2ghz[4] == 0xff)
3136 		sc->calib_2ghz = 0;
3137 
3138 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
3139 	sc->tssi_5ghz[0] = val & 0xff;	/* [-4] */
3140 	sc->tssi_5ghz[1] = val >> 8;	/* [-3] */
3141 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
3142 	sc->tssi_5ghz[2] = val & 0xff;	/* [-2] */
3143 	sc->tssi_5ghz[3] = val >> 8;	/* [-1] */
3144 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
3145 	sc->tssi_5ghz[4] = val & 0xff;	/* [+0] */
3146 	sc->tssi_5ghz[5] = val >> 8;	/* [+1] */
3147 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
3148 	sc->tssi_5ghz[6] = val & 0xff;	/* [+2] */
3149 	sc->tssi_5ghz[7] = val >> 8;	/* [+3] */
3150 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
3151 	sc->tssi_5ghz[8] = val & 0xff;	/* [+4] */
3152 	sc->step_5ghz = val >> 8;
3153 	DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3154 	    "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
3155 	    sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
3156 	    sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
3157 	    sc->tssi_5ghz[8], sc->step_5ghz));
3158 	/* check that ref value is correct, otherwise disable calibration */
3159 	if (sc->tssi_5ghz[4] == 0xff)
3160 		sc->calib_5ghz = 0;
3161 
3162 	/* read RSSI offsets and LNA gains from EEPROM */
3163 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
3164 	sc->rssi_2ghz[0] = val & 0xff;	/* Ant A */
3165 	sc->rssi_2ghz[1] = val >> 8;	/* Ant B */
3166 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
3167 	if (sc->mac_ver >= 0x3071) {
3168 		/*
3169 		 * On RT3090 chips (limited to 2 Rx chains), this ROM
3170 		 * field contains the Tx mixer gain for the 2GHz band.
3171 		 */
3172 		if ((val & 0xff) != 0xff)
3173 			sc->txmixgain_2ghz = val & 0x7;
3174 		DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
3175 	} else
3176 		sc->rssi_2ghz[2] = val & 0xff;	/* Ant C */
3177 	sc->lna[2] = val >> 8;		/* channel group 2 */
3178 
3179 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
3180 	sc->rssi_5ghz[0] = val & 0xff;	/* Ant A */
3181 	sc->rssi_5ghz[1] = val >> 8;	/* Ant B */
3182 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
3183 	sc->rssi_5ghz[2] = val & 0xff;	/* Ant C */
3184 	sc->lna[3] = val >> 8;		/* channel group 3 */
3185 
3186 	val = rt2860_srom_read(sc, RT2860_EEPROM_LNA);
3187 	if (sc->mac_ver >= 0x3071)
3188 		sc->lna[0] = RT3090_DEF_LNA;
3189 	else				/* channel group 0 */
3190 		sc->lna[0] = val & 0xff;
3191 	sc->lna[1] = val >> 8;		/* channel group 1 */
3192 
3193 	/* fix broken 5GHz LNA entries */
3194 	if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
3195 		DPRINTF(("invalid LNA for channel group %d\n", 2));
3196 		sc->lna[2] = sc->lna[1];
3197 	}
3198 	if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
3199 		DPRINTF(("invalid LNA for channel group %d\n", 3));
3200 		sc->lna[3] = sc->lna[1];
3201 	}
3202 
3203 	/* fix broken RSSI offset entries */
3204 	for (ant = 0; ant < 3; ant++) {
3205 		if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
3206 			DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
3207 			    ant + 1, sc->rssi_2ghz[ant]));
3208 			sc->rssi_2ghz[ant] = 0;
3209 		}
3210 		if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
3211 			DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
3212 			    ant + 1, sc->rssi_5ghz[ant]));
3213 			sc->rssi_5ghz[ant] = 0;
3214 		}
3215 	}
3216 
3217 	return 0;
3218 }
3219 
3220 static int
3221 rt2860_bbp_init(struct rt2860_softc *sc)
3222 {
3223 	int i, ntries;
3224 
3225 	/* wait for BBP to wake up */
3226 	for (ntries = 0; ntries < 20; ntries++) {
3227 		uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
3228 		if (bbp0 != 0 && bbp0 != 0xff)
3229 			break;
3230 	}
3231 	if (ntries == 20) {
3232 		aprint_error_dev(sc->sc_dev,
3233 		    "timeout waiting for BBP to wake up\n");
3234 		return ETIMEDOUT;
3235 	}
3236 
3237 	/* initialize BBP registers to default values */
3238 	for (i = 0; i < (int)__arraycount(rt2860_def_bbp); i++) {
3239 		rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
3240 		    rt2860_def_bbp[i].val);
3241 	}
3242 
3243 	/* fix BBP84 for RT2860E */
3244 	if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
3245 		rt2860_mcu_bbp_write(sc, 84, 0x19);
3246 
3247 	if (sc->mac_ver >= 0x3071) {
3248 		rt2860_mcu_bbp_write(sc, 79, 0x13);
3249 		rt2860_mcu_bbp_write(sc, 80, 0x05);
3250 		rt2860_mcu_bbp_write(sc, 81, 0x33);
3251 	} else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
3252 		rt2860_mcu_bbp_write(sc, 69, 0x16);
3253 		rt2860_mcu_bbp_write(sc, 73, 0x12);
3254 	}
3255 
3256 	return 0;
3257 }
3258 
3259 static int
3260 rt2860_txrx_enable(struct rt2860_softc *sc)
3261 {
3262 	uint32_t tmp;
3263 	int ntries;
3264 
3265 	/* enable Tx/Rx DMA engine */
3266 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
3267 	RAL_BARRIER_READ_WRITE(sc);
3268 	for (ntries = 0; ntries < 200; ntries++) {
3269 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3270 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3271 			break;
3272 		DELAY(1000);
3273 	}
3274 	if (ntries == 200) {
3275 		aprint_error_dev(sc->sc_dev,
3276 		    "timeout waiting for DMA engine\n");
3277 		return ETIMEDOUT;
3278 	}
3279 
3280 	DELAY(50);
3281 
3282 	tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
3283 	    RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
3284 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3285 
3286 	/* set Rx filter */
3287 	tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
3288 	if (sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR) {
3289 		tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
3290 		    RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
3291 		    RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
3292 		    RT2860_DROP_CFACK | RT2860_DROP_CFEND;
3293 		if (sc->sc_ic.ic_opmode == IEEE80211_M_STA)
3294 			tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
3295 	}
3296 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
3297 
3298 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
3299 	    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3300 
3301 	return 0;
3302 }
3303 
3304 static int
3305 rt2860_init(struct ifnet *ifp)
3306 {
3307 	struct rt2860_softc *sc = ifp->if_softc;
3308 	struct ieee80211com *ic = &sc->sc_ic;
3309 	uint32_t tmp;
3310 	uint8_t bbp1, bbp3;
3311 	int i, qid, ridx, ntries, error;
3312 
3313 	/* for CardBus, power on the socket */
3314 	if (!(sc->sc_flags & RT2860_ENABLED)) {
3315 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
3316 			aprint_error_dev(sc->sc_dev,
3317 			    "could not enable device\n");
3318 			return EIO;
3319 		}
3320 		sc->sc_flags |= RT2860_ENABLED;
3321 	}
3322 
3323 	if (sc->rfswitch) {
3324 		/* hardware has a radio switch on GPIO pin 2 */
3325 		if (!(RAL_READ(sc, RT2860_GPIO_CTRL) & (1 << 2))) {
3326 			aprint_normal_dev(sc->sc_dev,
3327 			    "radio is disabled by hardware switch\n");
3328 #ifdef notyet
3329 			rt2860_stop(ifp, 1);
3330 			return EPERM;
3331 #endif
3332 		}
3333 	}
3334 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE);
3335 
3336 	/* disable DMA */
3337 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3338 	tmp &= 0xff0;
3339 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3340 
3341 	/* PBF hardware reset */
3342 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3343 	RAL_BARRIER_WRITE(sc);
3344 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3345 
3346 	if ((error = rt2860_load_microcode(sc)) != 0) {
3347 		aprint_error_dev(sc->sc_dev,
3348 		    "could not load 8051 microcode\n");
3349 		rt2860_stop(ifp, 1);
3350 		return error;
3351 	}
3352 
3353 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
3354 	rt2860_set_macaddr(sc, ic->ic_myaddr);
3355 
3356 	/* init Tx power for all Tx rates (from EEPROM) */
3357 	for (ridx = 0; ridx < 5; ridx++) {
3358 		if (sc->txpow20mhz[ridx] == 0xffffffff)
3359 			continue;
3360 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
3361 	}
3362 
3363 	for (ntries = 0; ntries < 100; ntries++) {
3364 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3365 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3366 			break;
3367 		DELAY(1000);
3368 	}
3369 	if (ntries == 100) {
3370 		aprint_error_dev(sc->sc_dev,
3371 		    "timeout waiting for DMA engine\n");
3372 		rt2860_stop(ifp, 1);
3373 		return ETIMEDOUT;
3374 	}
3375 	tmp &= 0xff0;
3376 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3377 
3378 	/* reset Rx ring and all 6 Tx rings */
3379 	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
3380 
3381 	/* PBF hardware reset */
3382 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3383 	RAL_BARRIER_WRITE(sc);
3384 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3385 
3386 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE | RT2860_IO_RF_PE);
3387 
3388 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
3389 	RAL_BARRIER_WRITE(sc);
3390 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
3391 
3392 	for (i = 0; i < (int)__arraycount(rt2860_def_mac); i++)
3393 		RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
3394 	if (sc->mac_ver >= 0x3071) {
3395 		/* set delay of PA_PE assertion to 1us (unit of 0.25us) */
3396 		RAL_WRITE(sc, RT2860_TX_SW_CFG0,
3397 		    4 << RT2860_DLY_PAPE_EN_SHIFT);
3398 	}
3399 
3400 	if (!(RAL_READ(sc, RT2860_PCI_CFG) & RT2860_PCI_CFG_PCI)) {
3401 		sc->sc_flags |= RT2860_PCIE;
3402 		/* PCIe has different clock cycle count than PCI */
3403 		tmp = RAL_READ(sc, RT2860_US_CYC_CNT);
3404 		tmp = (tmp & ~0xff) | 0x7d;
3405 		RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp);
3406 	}
3407 
3408 	/* wait while MAC is busy */
3409 	for (ntries = 0; ntries < 100; ntries++) {
3410 		if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG) &
3411 		    (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
3412 			break;
3413 		DELAY(1000);
3414 	}
3415 	if (ntries == 100) {
3416 		aprint_error_dev(sc->sc_dev, "timeout waiting for MAC\n");
3417 		rt2860_stop(ifp, 1);
3418 		return ETIMEDOUT;
3419 	}
3420 
3421 	/* clear Host to MCU mailbox */
3422 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
3423 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
3424 
3425 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
3426 	DELAY(1000);
3427 
3428 	if ((error = rt2860_bbp_init(sc)) != 0) {
3429 		rt2860_stop(ifp, 1);
3430 		return error;
3431 	}
3432 
3433 	/* clear RX WCID search table */
3434 	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
3435 	/* clear pairwise key table */
3436 	RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048);
3437 	/* clear IV/EIV table */
3438 	RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512);
3439 	/* clear WCID attribute table */
3440 	RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256);
3441 	/* clear shared key table */
3442 	RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
3443 	/* clear shared key mode */
3444 	RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
3445 
3446 	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
3447 	for (qid = 0; qid < MAXQS; qid++) {
3448 		RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
3449 		RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
3450 		RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
3451 	}
3452 
3453 	/* init Rx ring */
3454 	RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
3455 	RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
3456 	RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
3457 
3458 	/* setup maximum buffer sizes */
3459 	RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
3460 	    (MCLBYTES - sizeof (struct rt2860_rxwi) - 2));
3461 
3462 	for (ntries = 0; ntries < 100; ntries++) {
3463 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3464 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3465 			break;
3466 		DELAY(1000);
3467 	}
3468 	if (ntries == 100) {
3469 		aprint_error_dev(sc->sc_dev,
3470 		    "timeout waiting for DMA engine\n");
3471 		rt2860_stop(ifp, 1);
3472 		return ETIMEDOUT;
3473 	}
3474 	tmp &= 0xff0;
3475 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3476 
3477 	/* disable interrupts mitigation */
3478 	RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
3479 
3480 	/* write vendor-specific BBP values (from EEPROM) */
3481 	for (i = 0; i < 8; i++) {
3482 		if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
3483 			continue;
3484 		rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
3485 	}
3486 
3487 	/* select Main antenna for 1T1R devices */
3488 	if (sc->rf_rev == RT3070_RF_2020 ||
3489 	    sc->rf_rev == RT3070_RF_3020 ||
3490 	    sc->rf_rev == RT3070_RF_3320)
3491 		rt3090_set_rx_antenna(sc, 0);
3492 
3493 	/* send LEDs operating mode to microcontroller */
3494 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0], 0);
3495 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1], 0);
3496 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2], 0);
3497 
3498 	if (sc->mac_ver >= 0x3071)
3499 		rt3090_rf_init(sc);
3500 
3501 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP, 0x02ff, 1);
3502 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP, 0, 1);
3503 
3504 	if (sc->mac_ver >= 0x3071)
3505 		rt3090_rf_wakeup(sc);
3506 
3507 	/* disable non-existing Rx chains */
3508 	bbp3 = rt2860_mcu_bbp_read(sc, 3);
3509 	bbp3 &= ~(1 << 3 | 1 << 4);
3510 	if (sc->nrxchains == 2)
3511 		bbp3 |= 1 << 3;
3512 	else if (sc->nrxchains == 3)
3513 		bbp3 |= 1 << 4;
3514 	rt2860_mcu_bbp_write(sc, 3, bbp3);
3515 
3516 	/* disable non-existing Tx chains */
3517 	bbp1 = rt2860_mcu_bbp_read(sc, 1);
3518 	if (sc->ntxchains == 1)
3519 		bbp1 = (bbp1 & ~(1 << 3 | 1 << 4));
3520 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
3521 		bbp1 = (bbp1 & ~(1 << 4)) | 1 << 3;
3522 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
3523 		bbp1 = (bbp1 & ~(1 << 3)) | 1 << 4;
3524 	rt2860_mcu_bbp_write(sc, 1, bbp1);
3525 
3526 	if (sc->mac_ver >= 0x3071)
3527 		rt3090_rf_setup(sc);
3528 
3529 	/* select default channel */
3530 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
3531 	rt2860_switch_chan(sc, ic->ic_ibss_chan);
3532 
3533 	/* reset RF from MCU */
3534 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
3535 
3536 	/* set RTS threshold */
3537 	tmp = RAL_READ(sc, RT2860_TX_RTS_CFG);
3538 	tmp &= ~0xffff00;
3539 	tmp |= ic->ic_rtsthreshold << 8;
3540 	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);
3541 
3542 	/* setup initial protection mode */
3543 	sc->sc_ic_flags = ic->ic_flags;
3544 	rt2860_updateprot(ic);
3545 
3546 	/* turn radio LED on */
3547 	rt2860_set_leds(sc, RT2860_LED_RADIO);
3548 
3549 	/* enable Tx/Rx DMA engine */
3550 	if ((error = rt2860_txrx_enable(sc)) != 0) {
3551 		rt2860_stop(ifp, 1);
3552 		return error;
3553 	}
3554 
3555 	/* clear pending interrupts */
3556 	RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
3557 	/* enable interrupts */
3558 	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
3559 
3560 	if (sc->sc_flags & RT2860_ADVANCED_PS)
3561 		rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);
3562 
3563 	ifp->if_flags |= IFF_RUNNING;
3564 	ifp->if_flags &= ~IFF_OACTIVE;
3565 
3566 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
3567 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
3568 	else
3569 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
3570 
3571 	return 0;
3572 }
3573 
3574 static void
3575 rt2860_stop(struct ifnet *ifp, int disable)
3576 {
3577 	struct rt2860_softc *sc = ifp->if_softc;
3578 	struct ieee80211com *ic = &sc->sc_ic;
3579 	uint32_t tmp;
3580 	int qid;
3581 
3582 	if (ifp->if_flags & IFF_RUNNING)
3583 		rt2860_set_leds(sc, 0);	/* turn all LEDs off */
3584 
3585 	sc->sc_tx_timer = 0;
3586 	ifp->if_timer = 0;
3587 	ifp->if_flags &= ~IFF_RUNNING;
3588 	ifp->if_flags &= ~IFF_OACTIVE;
3589 
3590 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
3591 
3592 	/* disable interrupts */
3593 	RAL_WRITE(sc, RT2860_INT_MASK, 0);
3594 
3595 	/* disable GP timer */
3596 	rt2860_set_gp_timer(sc, 0);
3597 
3598 	/* disable Rx */
3599 	tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL);
3600 	tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3601 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
3602 
3603 	/* reset adapter */
3604 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
3605 	RAL_BARRIER_WRITE(sc);
3606 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
3607 
3608 	/* reset Tx and Rx rings (and reclaim TXWIs) */
3609 	sc->qfullmsk = 0;
3610 	for (qid = 0; qid < MAXQS; qid++)
3611 		rt2860_reset_tx_ring(sc, &sc->txq[qid]);
3612 	rt2860_reset_rx_ring(sc, &sc->rxq);
3613 
3614 	/* for CardBus, power down the socket */
3615 	if (disable && sc->sc_disable != NULL) {
3616 		if (sc->sc_flags & RT2860_ENABLED) {
3617 			(*sc->sc_disable)(sc);
3618 			sc->sc_flags &= ~RT2860_ENABLED;
3619 		}
3620 	}
3621 }
3622 
3623 static int
3624 rt2860_load_microcode(struct rt2860_softc *sc)
3625 {
3626 	int ntries;
3627 
3628 	/* set "host program ram write selection" bit */
3629 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
3630 	/* write microcode image */
3631 	RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, sc->ucode, sc->ucsize);
3632 	/* kick microcontroller unit */
3633 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0);
3634 	RAL_BARRIER_WRITE(sc);
3635 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
3636 
3637 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
3638 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
3639 
3640 	/* wait until microcontroller is ready */
3641 	RAL_BARRIER_READ_WRITE(sc);
3642 	for (ntries = 0; ntries < 1000; ntries++) {
3643 		if (RAL_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
3644 			break;
3645 		DELAY(1000);
3646 	}
3647 	if (ntries == 1000) {
3648 		aprint_error_dev(sc->sc_dev,
3649 		    "timeout waiting for MCU to initialize\n");
3650 		return ETIMEDOUT;
3651 	}
3652 	return 0;
3653 }
3654 
3655 #if 0
3656 /*
3657  * This function is called periodically to adjust Tx power based on
3658  * temperature variation.
3659  */
3660 static void
3661 rt2860_calib(struct rt2860_softc *sc)
3662 {
3663 	struct ieee80211com *ic = &sc->sc_ic;
3664 	const uint8_t *tssi;
3665 	uint8_t step, bbp49;
3666 	int8_t ridx, d;
3667 
3668 	/* read current temperature */
3669 	bbp49 = rt2860_mcu_bbp_read(sc, 49);
3670 
3671 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)) {
3672 		tssi = &sc->tssi_2ghz[4];
3673 		step = sc->step_2ghz;
3674 	} else {
3675 		tssi = &sc->tssi_5ghz[4];
3676 		step = sc->step_5ghz;
3677 	}
3678 
3679 	if (bbp49 < tssi[0]) {		/* lower than reference */
3680 		/* use higher Tx power than default */
3681 		for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
3682 	} else if (bbp49 > tssi[0]) {	/* greater than reference */
3683 		/* use lower Tx power than default */
3684 		for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
3685 	} else {
3686 		/* use default Tx power */
3687 		d = 0;
3688 	}
3689 	d *= step;
3690 
3691 	DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
3692 
3693 	/* write adjusted Tx power values for each Tx rate */
3694 	for (ridx = 0; ridx < 5; ridx++) {
3695 		if (sc->txpow20mhz[ridx] == 0xffffffff)
3696 			continue;
3697 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),
3698 		    b4inc(sc->txpow20mhz[ridx], d));
3699 	}
3700 }
3701 #endif /* 0 */
3702 
3703 static void
3704 rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
3705 {
3706 	uint32_t tmp;
3707 
3708 	if (aux) {
3709 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
3710 		RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp & ~RT2860_C);
3711 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
3712 		RAL_WRITE(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
3713 	} else {
3714 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
3715 		RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp | RT2860_C);
3716 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
3717 		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
3718 	}
3719 }
3720 
3721 static void
3722 rt2860_switch_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
3723 {
3724 	struct ieee80211com *ic = &sc->sc_ic;
3725 	u_int chan, group;
3726 
3727 	chan = ieee80211_chan2ieee(ic, c);
3728 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3729 		return;
3730 
3731 	if (sc->mac_ver >= 0x3071)
3732 		rt3090_set_chan(sc, chan);
3733 	else
3734 		rt2860_set_chan(sc, chan);
3735 
3736 	/* determine channel group */
3737 	if (chan <= 14)
3738 		group = 0;
3739 	else if (chan <= 64)
3740 		group = 1;
3741 	else if (chan <= 128)
3742 		group = 2;
3743 	else
3744 		group = 3;
3745 
3746 	/* XXX necessary only when group has changed! */
3747 	rt2860_select_chan_group(sc, group);
3748 
3749 	DELAY(1000);
3750 }
3751 
3752 #ifndef IEEE80211_STA_ONLY
3753 static int
3754 rt2860_setup_beacon(struct rt2860_softc *sc)
3755 {
3756 	struct ieee80211com *ic = &sc->sc_ic;
3757 	struct rt2860_txwi txwi;
3758 	struct mbuf *m;
3759 	int ridx;
3760 
3761 	if ((m = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo)) == NULL)
3762 		return ENOBUFS;
3763 
3764 	memset(&txwi, 0, sizeof txwi);
3765 	txwi.wcid = 0xff;
3766 	txwi.len = htole16(m->m_pkthdr.len);
3767 	/* send beacons at the lowest available rate */
3768 	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
3769 	    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
3770 	txwi.phy = htole16(rt2860_rates[ridx].mcs);
3771 	if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
3772 		txwi.phy |= htole16(RT2860_PHY_OFDM);
3773 	txwi.txop = RT2860_TX_TXOP_HT;
3774 	txwi.flags = RT2860_TX_TS;
3775 	txwi.xflags = RT2860_TX_NSEQ;
3776 
3777 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),
3778 	    (uint8_t *)&txwi, sizeof txwi);
3779 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
3780 	    mtod(m, uint8_t *), m->m_pkthdr.len);
3781 
3782 	m_freem(m);
3783 
3784 	return 0;
3785 }
3786 #endif
3787 
3788 static void
3789 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
3790 {
3791 	struct ieee80211com *ic = &sc->sc_ic;
3792 	uint32_t tmp;
3793 
3794 	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
3795 
3796 	tmp &= ~0x1fffff;
3797 	tmp |= ic->ic_bss->ni_intval * 16;
3798 	tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
3799 	if (ic->ic_opmode == IEEE80211_M_STA) {
3800 		/*
3801 		 * Local TSF is always updated with remote TSF on beacon
3802 		 * reception.
3803 		 */
3804 		tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
3805 	}
3806 #ifndef IEEE80211_STA_ONLY
3807 	else if (ic->ic_opmode == IEEE80211_M_IBSS) {
3808 		tmp |= RT2860_BCN_TX_EN;
3809 		/*
3810 		 * Local TSF is updated with remote TSF on beacon reception
3811 		 * only if the remote TSF is greater than local TSF.
3812 		 */
3813 		tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
3814 	} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
3815 		tmp |= RT2860_BCN_TX_EN;
3816 		/* SYNC with nobody */
3817 		tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
3818 	}
3819 #endif
3820 
3821 	RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
3822 }
3823