Home | History | Annotate | Line # | Download | only in ic
      1 /*	$NetBSD: rt2860.c,v 1.36 2021/06/16 00:21:18 riastradh Exp $	*/
      2 /*	$OpenBSD: rt2860.c,v 1.90 2016/04/13 10:49:26 mpi Exp $	*/
      3 /*	$FreeBSD: head/sys/dev/ral/rt2860.c 306591 2016-10-02 20:35:55Z avos $ */
      4 
      5 /*-
      6  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini (at) free.fr>
      7  * Copyright (c) 2012 Bernhard Schmidt <bschmidt (at) FreeBSD.org>
      8  *
      9  * Permission to use, copy, modify, and distribute this software for any
     10  * purpose with or without fee is hereby granted, provided that the above
     11  * copyright notice and this permission notice appear in all copies.
     12  *
     13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
     14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
     15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
     16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
     17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
     18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
     19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
     20  */
     21 
     22 /*-
     23  * Ralink Technology RT2860/RT3090/RT3390/RT3562/RT5390/RT5392 chipset driver
     24  * http://www.ralinktech.com/
     25  */
     26 
     27 #include <sys/cdefs.h>
     28 __KERNEL_RCSID(0, "$NetBSD: rt2860.c,v 1.36 2021/06/16 00:21:18 riastradh Exp $");
     29 
     30 #include <sys/param.h>
     31 #include <sys/sockio.h>
     32 #include <sys/sysctl.h>
     33 #include <sys/mbuf.h>
     34 #include <sys/kernel.h>
     35 #include <sys/socket.h>
     36 #include <sys/systm.h>
     37 #include <sys/malloc.h>
     38 #include <sys/queue.h>
     39 #include <sys/callout.h>
     40 #include <sys/module.h>
     41 #include <sys/conf.h>
     42 #include <sys/device.h>
     43 #include <sys/endian.h>
     44 #include <sys/cprng.h>
     45 
     46 #include <sys/bus.h>
     47 #include <sys/intr.h>
     48 
     49 #include <net/bpf.h>
     50 #include <net/if.h>
     51 #include <net/if_dl.h>
     52 #include <net/if_ether.h>
     53 #include <net/if_media.h>
     54 
     55 #include <net80211/ieee80211_var.h>
     56 #include <net80211/ieee80211_amrr.h>
     57 #include <net80211/ieee80211_radiotap.h>
     58 
     59 #include <dev/firmload.h>
     60 
     61 #include <dev/ic/rt2860var.h>
     62 #include <dev/ic/rt2860reg.h>
     63 
     64 #include <dev/pci/pcidevs.h>
     65 
     66 #ifdef RAL_DEBUG
     67 #define DPRINTF(x)	do { if (rt2860_debug > 0) printf x; } while (0)
     68 #define DPRINTFN(n, x)	do { if (rt2860_debug >= (n)) printf x; } while (0)
     69 int rt2860_debug = 0;
     70 #else
     71 #define DPRINTF(x)
     72 #define DPRINTFN(n, x)
     73 #endif
     74 #define MAXQS	6 /* Tx (4 EDCAs + HCCA + Mgt) and Rx rings */
     75 
     76 static void	rt2860_attachhook(device_t);
     77 static bool	rt2860_suspend(device_t self, const pmf_qual_t *qual);
     78 static bool	rt2860_wakeup(device_t self, const pmf_qual_t *qual);
     79 static int	rt2860_alloc_tx_ring(struct rt2860_softc *,
     80 		    struct rt2860_tx_ring *);
     81 static void	rt2860_reset_tx_ring(struct rt2860_softc *,
     82 		    struct rt2860_tx_ring *);
     83 static void	rt2860_free_tx_ring(struct rt2860_softc *,
     84 		    struct rt2860_tx_ring *);
     85 static int	rt2860_alloc_tx_pool(struct rt2860_softc *);
     86 static void	rt2860_free_tx_pool(struct rt2860_softc *);
     87 static int	rt2860_alloc_rx_ring(struct rt2860_softc *,
     88 		    struct rt2860_rx_ring *);
     89 static void	rt2860_reset_rx_ring(struct rt2860_softc *,
     90 		    struct rt2860_rx_ring *);
     91 static void	rt2860_free_rx_ring(struct rt2860_softc *,
     92 		    struct rt2860_rx_ring *);
     93 static struct	ieee80211_node *rt2860_node_alloc(struct ieee80211_node_table *);
     94 static int	rt2860_media_change(struct ifnet *);
     95 static void	rt2860_iter_func(void *, struct ieee80211_node *);
     96 static void	rt2860_updatestats(struct rt2860_softc *);
     97 static void	rt2860_update_promisc(struct ifnet *);
     98 static void	rt2860_newassoc(struct ieee80211_node *,
     99 		    int);
    100 #ifdef notyet
    101 static int	rt2860_ampdu_rx_start(struct ieee80211com *,
    102 		    struct ieee80211_node *, uint8_t);
    103 static void	rt2860_ampdu_rx_stop(struct ieee80211com *,
    104 		    struct ieee80211_node *, uint8_t);
    105 #endif
    106 static int	rt2860_newstate(struct ieee80211com *, enum ieee80211_state,
    107 		    int);
    108 static uint16_t	rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
    109 static uint16_t	rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
    110 static void	rt2860_intr_coherent(struct rt2860_softc *);
    111 static void	rt2860_drain_stats_fifo(struct rt2860_softc *);
    112 static void	rt2860_tx_intr(struct rt2860_softc *, int);
    113 static void	rt2860_rx_intr(struct rt2860_softc *);
    114 static void	rt2860_tbtt_intr(struct rt2860_softc *);
    115 static void	rt2860_gp_intr(struct rt2860_softc *);
    116 static int	rt2860_tx(struct rt2860_softc *, struct mbuf **,
    117 		    struct ieee80211_node *);
    118 static void	rt2860_start(struct ifnet *);
    119 static void	rt2860_watchdog(struct ifnet *);
    120 static int	rt2860_ioctl(struct ifnet *, u_long, void *);
    121 static void	rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
    122 static uint8_t	rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
    123 static void	rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
    124 static uint8_t	rt3090_rf_read(struct rt2860_softc *, uint8_t);
    125 static void	rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
    126 static int	rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
    127 static void	rt2860_enable_mrr(struct rt2860_softc *);
    128 static void	rt2860_set_txpreamble(struct rt2860_softc *);
    129 static void	rt2860_set_basicrates(struct rt2860_softc *);
    130 static void	rt2860_select_chan_group(struct rt2860_softc *, int);
    131 static void	rt2860_set_chan(struct rt2860_softc *, u_int);
    132 static void	rt3090_set_chan(struct rt2860_softc *, u_int);
    133 static void	rt5390_set_chan(struct rt2860_softc *, u_int);
    134 static void	rt3090_rf_init(struct rt2860_softc *);
    135 static void	rt5390_rf_init(struct rt2860_softc *);
    136 static void	rt3090_rf_wakeup(struct rt2860_softc *);
    137 static void	rt5390_rf_wakeup(struct rt2860_softc *);
    138 static int	rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
    139 		    uint8_t *);
    140 static void	rt3090_rf_setup(struct rt2860_softc *);
    141 static void	rt2860_set_leds(struct rt2860_softc *, uint16_t);
    142 static void	rt2860_set_gp_timer(struct rt2860_softc *, int);
    143 static void	rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
    144 static void	rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
    145 static void	rt2860_updateslot(struct ifnet *);
    146 static void	rt2860_updateprot(struct ieee80211com *);
    147 static int	rt2860_updateedca(struct ieee80211com *);
    148 
    149 #ifdef HW_CRYPTO
    150 static int	rt2860_set_key(struct ieee80211com *,
    151 		    const struct ieee80211_key *, const uint8_t *);
    152 static int	rt2860_delete_key(struct ieee80211com *,
    153 		    const struct ieee80211_key *);
    154 #endif
    155 static int8_t	rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
    156 static const char *	rt2860_get_rf(uint32_t);
    157 static int	rt2860_read_eeprom(struct rt2860_softc *);
    158 static int	rt2860_bbp_init(struct rt2860_softc *);
    159 static int	rt5390_bbp_init(struct rt2860_softc *);
    160 static int	rt2860_txrx_enable(struct rt2860_softc *);
    161 static int	rt2860_init(struct ifnet *);
    162 static void	rt2860_stop(struct ifnet *, int);
    163 static int	rt2860_load_microcode(struct rt2860_softc *);
    164 #if 0
    165 static void	rt2860_calib(struct rt2860_softc *);
    166 #endif
    167 static void	rt3090_set_rx_antenna(struct rt2860_softc *, int);
    168 static void	rt2860_switch_chan(struct rt2860_softc *,
    169 		    struct ieee80211_channel *);
    170 #ifndef IEEE80211_STA_ONLY
    171 static int	rt2860_setup_beacon(struct rt2860_softc *);
    172 #endif
    173 static void	rt2860_enable_tsf_sync(struct rt2860_softc *);
    174 static void	rt2860_softintr(void *);
    175 
    176 static const struct {
    177 	uint32_t	reg;
    178 	uint32_t	val;
    179 } rt2860_def_mac[] = {
    180 	RT2860_DEF_MAC
    181 };
    182 
    183 static const struct {
    184 	uint8_t	reg;
    185 	uint8_t	val;
    186 } rt2860_def_bbp[] = {
    187 	RT2860_DEF_BBP
    188 }, rt5390_def_bbp[] = {
    189 	RT5390_DEF_BBP
    190 };
    191 
    192 static const struct rfprog {
    193 	uint8_t		chan;
    194 	uint32_t	r1, r2, r3, r4;
    195 } rt2860_rf2850[] = {
    196 	RT2860_RF2850
    197 };
    198 
    199 static const struct {
    200 	uint8_t	n, r, k;
    201 } rt3090_freqs[] = {
    202 	RT3070_RF3052
    203 };
    204 
    205 static const struct {
    206 	uint8_t	reg;
    207 	uint8_t	val;
    208 }  rt3090_def_rf[] = {
    209 	RT3070_DEF_RF
    210 }, rt3572_def_rf[] = {
    211 	RT3572_DEF_RF
    212 }, rt5390_def_rf[] = {
    213 	RT5390_DEF_RF
    214 }, rt5392_def_rf[] = {
    215 	RT5392_DEF_RF
    216 };
    217 
    218 int
    219 rt2860_attach(void *xsc, int id)
    220 {
    221 	struct rt2860_softc *sc = xsc;
    222 	struct ieee80211com *ic = &sc->sc_ic;
    223 	int qid, ntries, error;
    224 	uint32_t tmp;
    225 
    226 	sc->amrr.amrr_min_success_threshold =  1;
    227 	sc->amrr.amrr_max_success_threshold = 15;
    228 
    229 	/* wait for NIC to initialize */
    230 	for (ntries = 0; ntries < 100; ntries++) {
    231 		tmp = RAL_READ(sc, RT2860_ASIC_VER_ID);
    232 		if (tmp != 0 && tmp != 0xffffffff)
    233 			break;
    234 		DELAY(10);
    235 	}
    236 	if (ntries == 100) {
    237 		aprint_error_dev(sc->sc_dev,
    238 		    "timeout waiting for NIC to initialize\n");
    239 		return ETIMEDOUT;
    240 	}
    241 	sc->mac_ver = tmp >> 16;
    242 	sc->mac_rev = tmp & 0xffff;
    243 
    244 	if (sc->mac_ver != 0x2860 &&
    245 	    (id == PCI_PRODUCT_RALINK_RT2890 ||
    246 	     id == PCI_PRODUCT_RALINK_RT2790 ||
    247 	     id == PCI_PRODUCT_AWT_RT2890))
    248 		sc->sc_flags |= RT2860_ADVANCED_PS;
    249 
    250 	/* retrieve RF rev. no and various other things from EEPROM */
    251 	rt2860_read_eeprom(sc);
    252 	aprint_normal_dev(sc->sc_dev, "802.11 address %s\n",
    253 	    ether_sprintf(ic->ic_myaddr));
    254 	aprint_normal_dev(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
    255 	    "RF %s (MIMO %dT%dR)\n",
    256 	    sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
    257 	    sc->ntxchains, sc->nrxchains);
    258 
    259 	sc->sc_soft_ih = softint_establish(SOFTINT_NET, rt2860_softintr, sc);
    260 	if (sc->sc_soft_ih == NULL) {
    261 		aprint_error_dev(sc->sc_dev, "could not establish softint\n");
    262 		error = EINVAL;
    263 		goto fail0;
    264 	}
    265 
    266 	/*
    267 	 * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
    268 	 */
    269 	for (qid = 0; qid < MAXQS; qid++) {
    270 		if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
    271 			aprint_error_dev(sc->sc_dev,
    272 			    "could not allocate Tx ring %d\n", qid);
    273 			goto fail1;
    274 		}
    275 	}
    276 
    277 	if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
    278 		aprint_error_dev(sc->sc_dev, "could not allocate Rx ring\n");
    279 		goto fail1;
    280 	}
    281 
    282 	if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
    283 		aprint_error_dev(sc->sc_dev, "could not allocate Tx pool\n");
    284 		goto fail2;
    285 	}
    286 
    287 	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
    288 	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
    289 	    WME_AC_VO : 5;
    290 
    291 	config_mountroot(sc->sc_dev, rt2860_attachhook);
    292 
    293 	return 0;
    294 
    295 fail2:	rt2860_free_rx_ring(sc, &sc->rxq);
    296 fail1:	while (--qid >= 0)
    297 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
    298 fail0:	softint_disestablish(sc->sc_soft_ih);
    299 	sc->sc_soft_ih = NULL;
    300 	return error;
    301 }
    302 
    303 static int
    304 firmware_load(const char *dname, const char *iname, uint8_t **ucodep,
    305     size_t *sizep)
    306 {
    307 	firmware_handle_t fh;
    308 	int error;
    309 
    310 	if ((error = firmware_open(dname, iname, &fh)) != 0)
    311 		return (error);
    312 	*sizep = firmware_get_size(fh);
    313 	if ((*ucodep = firmware_malloc(*sizep)) == NULL) {
    314 		firmware_close(fh);
    315 		return (ENOMEM);
    316 	}
    317 	if ((error = firmware_read(fh, 0, *ucodep, *sizep)) != 0)
    318 		firmware_free(*ucodep, *sizep);
    319 	firmware_close(fh);
    320 
    321 	return (error);
    322 }
    323 
    324 static void
    325 rt2860_attachhook(device_t self)
    326 {
    327 	struct rt2860_softc *sc = device_private(self);
    328 	struct ieee80211com *ic = &sc->sc_ic;
    329 	struct ifnet *ifp = &sc->sc_if;
    330 	int i, error;
    331 
    332 	error = firmware_load("ral", "ral-rt2860", &sc->ucode, &sc->ucsize);
    333 	if (error != 0) {
    334 		aprint_error_dev(sc->sc_dev,
    335 		    "error %d, could not read firmware file %s\n",
    336 		    error, "ral-rt2860");
    337 		return;
    338 	}
    339 
    340 	ic->ic_ifp = ifp;
    341 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
    342 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
    343 	ic->ic_state = IEEE80211_S_INIT;
    344 
    345 	/* set device capabilities */
    346 	ic->ic_caps =
    347 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
    348 #ifndef IEEE80211_STA_ONLY
    349 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
    350 	    IEEE80211_C_HOSTAP |	/* HostAP mode supported */
    351 #ifdef IEEE80211_C_APPMGT
    352 	    IEEE80211_C_APPMGT |	/* HostAP power management */
    353 #endif
    354 #endif
    355 	    IEEE80211_C_WDS |		/* 4-address traffic works */
    356 	    IEEE80211_C_WME |		/* 802.11e */
    357 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
    358 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
    359 #ifdef HW_CRYPTO
    360 	    IEEE80211_C_WEP |		/* WEP */
    361 #endif
    362 	    IEEE80211_C_WPA; 		/* 802.11i */
    363 
    364 	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850) {
    365 		/* set supported .11a rates */
    366 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
    367 		    ieee80211_std_rateset_11a;
    368 
    369 		/* set supported .11a channels */
    370 		for (i = 14; i < (int)__arraycount(rt2860_rf2850); i++) {
    371 			uint8_t chan = rt2860_rf2850[i].chan;
    372 			ic->ic_channels[chan].ic_freq =
    373 			    ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
    374 			ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
    375 		}
    376 	}
    377 
    378 	/* set supported .11b and .11g rates */
    379 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
    380 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
    381 
    382 	/* set supported .11b and .11g channels (1 through 14) */
    383 	for (i = 1; i <= 14; i++) {
    384 		ic->ic_channels[i].ic_freq =
    385 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
    386 		ic->ic_channels[i].ic_flags =
    387 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
    388 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
    389 	}
    390 
    391 	/* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
    392 	ic->ic_max_aid = uimin(IEEE80211_AID_MAX, RT2860_WCID_MAX);
    393 
    394 	ifp->if_softc = sc;
    395 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
    396 	ifp->if_init = rt2860_init;
    397 	ifp->if_ioctl = rt2860_ioctl;
    398 	ifp->if_start = rt2860_start;
    399 	ifp->if_stop = rt2860_stop;
    400 	ifp->if_watchdog = rt2860_watchdog;
    401 	IFQ_SET_READY(&ifp->if_snd);
    402 	memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
    403 
    404 	if_initialize(ifp);
    405 	ieee80211_ifattach(ic);
    406 	/* Use common softint-based if_input */
    407 	ifp->if_percpuq = if_percpuq_create(ifp);
    408 	if_register(ifp);
    409 
    410 	ic->ic_node_alloc = rt2860_node_alloc;
    411 	ic->ic_newassoc = rt2860_newassoc;
    412 #ifdef notyet
    413 	ic->ic_ampdu_rx_start = rt2860_ampdu_rx_start;
    414 	ic->ic_ampdu_rx_stop = rt2860_ampdu_rx_stop;
    415 #endif
    416 	ic->ic_updateslot = rt2860_updateslot;
    417 	ic->ic_wme.wme_update = rt2860_updateedca;
    418 #ifdef HW_CRYPTO
    419 	ic->ic_crypto.cs_key_set = rt2860_set_key;
    420 	ic->ic_crypto.cs_key_delete = rt2860_delete_key;
    421 #endif
    422 	/* override state transition machine */
    423 	sc->sc_newstate = ic->ic_newstate;
    424 	ic->ic_newstate = rt2860_newstate;
    425 	ieee80211_media_init(ic, rt2860_media_change, ieee80211_media_status);
    426 
    427 	bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
    428 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
    429 
    430 	sc->sc_rxtap_len = roundup(sizeof(sc->sc_rxtap), sizeof(u_int32_t));
    431 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
    432 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2860_RX_RADIOTAP_PRESENT);
    433 
    434 	sc->sc_txtap_len = roundup(sizeof(sc->sc_txtap), sizeof(u_int32_t));
    435 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
    436 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2860_TX_RADIOTAP_PRESENT);
    437 
    438 	ieee80211_announce(ic);
    439 
    440 	if (pmf_device_register(sc->sc_dev, rt2860_wakeup, rt2860_suspend))
    441 		pmf_class_network_register(sc->sc_dev, ifp);
    442 	else
    443 		aprint_error_dev(sc->sc_dev,
    444 		    "couldn't establish power handler\n");
    445 }
    446 
    447 int
    448 rt2860_detach(void *xsc)
    449 {
    450 	struct rt2860_softc *sc = xsc;
    451 	struct ifnet *ifp = &sc->sc_if;
    452 	int qid;
    453 
    454 	pmf_device_deregister(sc->sc_dev);
    455 
    456 	rt2860_stop(ifp, 1);
    457 
    458 	ieee80211_ifdetach(&sc->sc_ic);	/* free all nodes */
    459 	if_detach(ifp);
    460 
    461 	for (qid = 0; qid < MAXQS; qid++)
    462 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
    463 	rt2860_free_rx_ring(sc, &sc->rxq);
    464 	rt2860_free_tx_pool(sc);
    465 
    466 	if (sc->sc_soft_ih != NULL) {
    467 		softint_disestablish(sc->sc_soft_ih);
    468 		sc->sc_soft_ih = NULL;
    469 	}
    470 
    471 	if (sc->ucode != NULL)
    472 		firmware_free(sc->ucode, sc->ucsize);
    473 
    474 	return 0;
    475 }
    476 
    477 static bool
    478 rt2860_suspend(device_t self, const pmf_qual_t *qual)
    479 {
    480 	struct rt2860_softc *sc = device_private(self);
    481 	struct ifnet *ifp = &sc->sc_if;
    482 
    483 	if (ifp->if_flags & IFF_RUNNING)
    484 		rt2860_stop(ifp, 1);
    485 
    486 	return true;
    487 }
    488 
    489 static bool
    490 rt2860_wakeup(device_t self, const pmf_qual_t *qual)
    491 {
    492 	struct rt2860_softc *sc = device_private(self);
    493 	struct ifnet *ifp = &sc->sc_if;
    494 	int s;
    495 
    496 	s = splnet();
    497 	if (ifp->if_flags & IFF_UP)
    498 		rt2860_init(ifp);
    499 	splx(s);
    500 
    501 	return true;
    502 }
    503 
    504 static int
    505 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
    506 {
    507 	int nsegs, size, error;
    508 
    509 	size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
    510 
    511 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
    512 	    BUS_DMA_NOWAIT, &ring->map);
    513 	if (error != 0) {
    514 		aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
    515 		goto fail;
    516 	}
    517 
    518 	/* Tx rings must be 4-DWORD aligned */
    519 	error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,
    520 	    &nsegs, BUS_DMA_NOWAIT);
    521 	if (error != 0) {
    522 		aprint_error_dev(sc->sc_dev,
    523 		    "could not allocate DMA memory\n");
    524 		goto fail;
    525 	}
    526 
    527 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,
    528 	    (void **)&ring->txd, BUS_DMA_NOWAIT);
    529 	if (error != 0) {
    530 		aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
    531 		goto fail;
    532 	}
    533 
    534 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->txd, size, NULL,
    535 	    BUS_DMA_NOWAIT);
    536 	if (error != 0) {
    537 		aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
    538 		goto fail;
    539 	}
    540 
    541 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE);
    542 
    543 	ring->paddr = ring->map->dm_segs[0].ds_addr;
    544 
    545 	return 0;
    546 
    547 fail:	rt2860_free_tx_ring(sc, ring);
    548 	return error;
    549 }
    550 
    551 static void
    552 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
    553 {
    554 	struct rt2860_tx_data *data;
    555 	int i;
    556 
    557 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
    558 		if ((data = ring->data[i]) == NULL)
    559 			continue;	/* nothing mapped in this slot */
    560 
    561 		if (data->ni != NULL) {
    562 			ieee80211_free_node(data->ni);
    563 			data->ni = NULL;
    564 		}
    565 
    566 		if (data->m != NULL) {
    567 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
    568 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
    569 			bus_dmamap_unload(sc->sc_dmat, data->map);
    570 			m_freem(data->m);
    571 			data->m = NULL;
    572 		}
    573 
    574 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
    575 		ring->data[i] = NULL;
    576 	}
    577 
    578 	ring->queued = 0;
    579 	ring->cur = ring->next = 0;
    580 }
    581 
    582 static void
    583 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
    584 {
    585 	struct rt2860_tx_data *data;
    586 	int i;
    587 
    588 	if (ring->txd != NULL) {
    589 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
    590 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
    591 		bus_dmamap_unload(sc->sc_dmat, ring->map);
    592 		bus_dmamem_unmap(sc->sc_dmat, (void *)ring->txd,
    593 		    RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd));
    594 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
    595 	}
    596 	if (ring->map != NULL)
    597 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
    598 
    599 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
    600 		if ((data = ring->data[i]) == NULL)
    601 			continue;	/* nothing mapped in this slot */
    602 
    603 		if (data->ni != NULL) {
    604 			ieee80211_free_node(data->ni);
    605 			data->ni = NULL;
    606 		}
    607 		if (data->m != NULL) {
    608 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
    609 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
    610 			bus_dmamap_unload(sc->sc_dmat, data->map);
    611 			m_freem(data->m);
    612 			data->m = NULL;
    613 		}
    614 
    615 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
    616 		ring->data[i] = NULL;
    617 	}
    618 	ring->queued = 0;
    619 	ring->cur = ring->next = 0;
    620 }
    621 
    622 /*
    623  * Allocate a pool of TX Wireless Information blocks.
    624  */
    625 static int
    626 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
    627 {
    628 	char *vaddr;
    629 	bus_addr_t paddr;
    630 	int i, nsegs, size, error;
    631 
    632 	size = RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ;
    633 
    634 	/* init data_pool early in case of failure.. */
    635 	SLIST_INIT(&sc->data_pool);
    636 
    637 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
    638 	    BUS_DMA_NOWAIT, &sc->txwi_map);
    639 	if (error != 0) {
    640 		aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
    641 		goto fail;
    642 	}
    643 
    644 	error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0,
    645 	    &sc->txwi_seg, 1, &nsegs, BUS_DMA_NOWAIT);
    646 	if (error != 0) {
    647 		aprint_error_dev(sc->sc_dev,
    648 		    "could not allocate DMA memory\n");
    649 		goto fail;
    650 	}
    651 
    652 	error = bus_dmamem_map(sc->sc_dmat, &sc->txwi_seg, nsegs, size,
    653 	    &sc->txwi_vaddr, BUS_DMA_NOWAIT);
    654 	if (error != 0) {
    655 		aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
    656 		goto fail;
    657 	}
    658 
    659 	error = bus_dmamap_load(sc->sc_dmat, sc->txwi_map, sc->txwi_vaddr,
    660 	    size, NULL, BUS_DMA_NOWAIT);
    661 	if (error != 0) {
    662 		aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
    663 		goto fail;
    664 	}
    665 
    666 	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0, size,
    667 	    BUS_DMASYNC_PREWRITE);
    668 
    669 	vaddr = sc->txwi_vaddr;
    670 	paddr = sc->txwi_map->dm_segs[0].ds_addr;
    671 	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
    672 		struct rt2860_tx_data *data = &sc->data[i];
    673 
    674 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
    675 		    RT2860_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
    676 		    &data->map); /* <0> */
    677 		if (error != 0) {
    678 			aprint_error_dev(sc->sc_dev,
    679 			    "could not create DMA map\n");
    680 			goto fail;
    681 		}
    682 		data->txwi = (struct rt2860_txwi *)vaddr;
    683 		data->paddr = paddr;
    684 		vaddr += RT2860_TXWI_DMASZ;
    685 		paddr += RT2860_TXWI_DMASZ;
    686 
    687 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
    688 	}
    689 
    690 	return 0;
    691 
    692 fail:	rt2860_free_tx_pool(sc);
    693 	return error;
    694 }
    695 
    696 static void
    697 rt2860_free_tx_pool(struct rt2860_softc *sc)
    698 {
    699 	if (sc->txwi_vaddr != NULL) {
    700 		bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0,
    701 		    sc->txwi_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
    702 		bus_dmamap_unload(sc->sc_dmat, sc->txwi_map);
    703 		bus_dmamem_unmap(sc->sc_dmat, sc->txwi_vaddr,
    704 		    RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ);
    705 		bus_dmamem_free(sc->sc_dmat, &sc->txwi_seg, 1);
    706 	}
    707 	if (sc->txwi_map != NULL)
    708 		bus_dmamap_destroy(sc->sc_dmat, sc->txwi_map);
    709 
    710 	while (!SLIST_EMPTY(&sc->data_pool)) {
    711 		struct rt2860_tx_data *data;
    712 		data = SLIST_FIRST(&sc->data_pool);
    713 		bus_dmamap_destroy(sc->sc_dmat, data->map);
    714 		SLIST_REMOVE_HEAD(&sc->data_pool, next);
    715 	}
    716 }
    717 
    718 static int
    719 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
    720 {
    721 	int i, nsegs, size, error;
    722 
    723 	size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
    724 
    725 	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
    726 	    BUS_DMA_NOWAIT, &ring->map);
    727 	if (error != 0) {
    728 		aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
    729 		goto fail;
    730 	}
    731 
    732 	/* Rx ring must be 4-DWORD aligned */
    733 	error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,
    734 	    &nsegs, BUS_DMA_NOWAIT);
    735 	if (error != 0) {
    736 		aprint_error_dev(sc->sc_dev,
    737 		    "could not allocate DMA memory\n");
    738 		goto fail;
    739 	}
    740 
    741 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,
    742 	    (void **)&ring->rxd, BUS_DMA_NOWAIT);
    743 	if (error != 0) {
    744 		aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
    745 		goto fail;
    746 	}
    747 
    748 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->rxd, size, NULL,
    749 	    BUS_DMA_NOWAIT);
    750 	if (error != 0) {
    751 		aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
    752 		goto fail;
    753 	}
    754 
    755 	ring->paddr = ring->map->dm_segs[0].ds_addr;
    756 
    757 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
    758 		struct rt2860_rx_data *data = &ring->data[i];
    759 		struct rt2860_rxd *rxd = &ring->rxd[i];
    760 		const char *msg;
    761 
    762 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
    763 		    0, BUS_DMA_NOWAIT, &data->map);
    764 		if (error != 0) {
    765 			aprint_error_dev(sc->sc_dev,
    766 			    "could not create DMA map\n");
    767 			goto fail;
    768 		}
    769 
    770 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
    771 		if (data->m == NULL) {
    772 			msg = "allocate Rx mbuf";
    773 			goto fail1;
    774 		}
    775 		MCLGET(data->m, M_DONTWAIT);
    776 		if ((data->m->m_flags & M_EXT) == 0) {
    777 			msg = "allocate Rx mbuf cluster";
    778 			goto fail1;
    779 		}
    780 
    781 
    782 		error = bus_dmamap_load(sc->sc_dmat, data->map,
    783 		    mtod(data->m, void *), MCLBYTES, NULL,
    784 		    BUS_DMA_READ | BUS_DMA_NOWAIT);
    785 		if (error != 0) {
    786 			msg = "load DMA map";
    787 		fail1:
    788 			aprint_error_dev(sc->sc_dev, "could not %s\n", msg);
    789 		    	m_freem(data->m);
    790 			data->m = NULL;
    791 			error = ENOBUFS;
    792 			goto fail;
    793 		}
    794 
    795 		rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
    796 		rxd->sdl0 = htole16(MCLBYTES);
    797 	}
    798 
    799 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE);
    800 
    801 	return 0;
    802 fail:	rt2860_free_rx_ring(sc, ring);
    803 	return error;
    804 }
    805 
    806 static void
    807 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
    808 {
    809 	int i;
    810 
    811 	for (i = 0; i < RT2860_RX_RING_COUNT; i++)
    812 		ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE);
    813 
    814 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
    815 	    BUS_DMASYNC_PREWRITE);
    816 
    817 	ring->cur = 0;
    818 }
    819 
    820 static void
    821 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
    822 {
    823 	int i;
    824 
    825 	if (ring->rxd != NULL) {
    826 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
    827 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
    828 		bus_dmamap_unload(sc->sc_dmat, ring->map);
    829 		bus_dmamem_unmap(sc->sc_dmat, (void *)ring->rxd,
    830 		    RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd));
    831 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
    832 		ring->rxd = NULL;
    833 	}
    834 	if (ring->map != NULL) {
    835 		bus_dmamap_destroy(sc->sc_dmat, ring->map);
    836 		ring->map = NULL;
    837 	}
    838 
    839 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
    840 		struct rt2860_rx_data *data = &ring->data[i];
    841 
    842 		if (data->m != NULL) {
    843 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
    844 			    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
    845 			bus_dmamap_unload(sc->sc_dmat, data->map);
    846 			m_freem(data->m);
    847 			data->m = NULL;
    848 		}
    849 		if (data->map != NULL) {
    850 			bus_dmamap_destroy(sc->sc_dmat, data->map);
    851 			data->map = NULL;
    852 		}
    853 	}
    854 }
    855 
    856 static struct ieee80211_node *
    857 rt2860_node_alloc(struct ieee80211_node_table *nt)
    858 {
    859 	struct rt2860_node *rn = malloc(sizeof(*rn), M_80211_NODE,
    860 	    M_NOWAIT | M_ZERO);
    861 	return rn ? &rn->ni : NULL;
    862 }
    863 
    864 static int
    865 rt2860_media_change(struct ifnet *ifp)
    866 {
    867 	struct rt2860_softc *sc = ifp->if_softc;
    868 	struct ieee80211com *ic = &sc->sc_ic;
    869 	uint8_t rate, ridx;
    870 	int error;
    871 
    872 	error = ieee80211_media_change(ifp);
    873 	if (error != ENETRESET)
    874 		return error;
    875 
    876 	if (ic->ic_fixed_rate != -1) {
    877 		rate = ic->ic_sup_rates[ic->ic_curmode].
    878 		    rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
    879 		for (ridx = 0; ridx <= RT2860_RIDX_MAX; ridx++)
    880 			if (rt2860_rates[ridx].rate == rate)
    881 				break;
    882 		sc->fixed_ridx = ridx;
    883 	}
    884 
    885 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
    886 	    (IFF_UP | IFF_RUNNING)) {
    887 		rt2860_stop(ifp, 0);
    888 		rt2860_init(ifp);
    889 	}
    890 	return 0;
    891 }
    892 
    893 static void
    894 rt2860_iter_func(void *arg, struct ieee80211_node *ni)
    895 {
    896 	struct rt2860_softc *sc = arg;
    897 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
    898 
    899 	ieee80211_amrr_choose(&sc->amrr, ni, &sc->amn[wcid]);
    900 }
    901 
    902 static void
    903 rt2860_updatestats(struct rt2860_softc *sc)
    904 {
    905 	struct ieee80211com *ic = &sc->sc_ic;
    906 	int s;
    907 
    908 #ifndef IEEE80211_STA_ONLY
    909 	/*
    910 	 * In IBSS or HostAP modes (when the hardware sends beacons), the
    911 	 * MAC can run into a livelock and start sending CTS-to-self frames
    912 	 * like crazy if protection is enabled.  Fortunately, we can detect
    913 	 * when such a situation occurs and reset the MAC.
    914 	 */
    915 	if (ic->ic_curmode != IEEE80211_M_STA) {
    916 		/* check if we're in a livelock situation.. */
    917 		uint32_t tmp = RAL_READ(sc, RT2860_DEBUG);
    918 		if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
    919 			/* ..and reset MAC/BBP for a while.. */
    920 			DPRINTF(("CTS-to-self livelock detected\n"));
    921 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
    922 			RAL_BARRIER_WRITE(sc);
    923 			DELAY(1);
    924 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
    925 			    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
    926 		}
    927 	}
    928 #endif
    929 	s = splnet();
    930 	if (ic->ic_opmode == IEEE80211_M_STA)
    931 		rt2860_iter_func(sc, ic->ic_bss);
    932 #ifndef IEEE80211_STA_ONLY
    933 	else
    934 		ieee80211_iterate_nodes(&ic->ic_sta, rt2860_iter_func, sc);
    935 #endif
    936 	splx(s);
    937 }
    938 
    939 static void
    940 rt2860_newassoc(struct ieee80211_node *ni, int isnew)
    941 {
    942 	struct rt2860_softc *sc = ni->ni_ic->ic_ifp->if_softc;
    943 	struct rt2860_node *rn = (void *)ni;
    944 	struct ieee80211_rateset *rs = &ni->ni_rates;
    945 	uint8_t rate, wcid = 0;
    946 	int ridx, i, j;
    947 
    948 	if (isnew && ni->ni_associd != 0) {
    949 		/* only interested in true associations */
    950 		wcid = rn->wcid = IEEE80211_AID(ni->ni_associd);
    951 
    952 		/* init WCID table entry */
    953 		RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),
    954 		    ni->ni_macaddr, IEEE80211_ADDR_LEN);
    955 	}
    956 	DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
    957 	    isnew, ether_sprintf(ni->ni_macaddr), wcid));
    958 
    959 	ieee80211_amrr_node_init(&sc->amrr, &sc->amn[wcid]);
    960 	/* start at lowest available bit-rate, AMRR will raise */
    961 	ni->ni_txrate = 0;
    962 
    963 	for (i = 0; i < rs->rs_nrates; i++) {
    964 		rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
    965 		/* convert 802.11 rate to hardware rate index */
    966 		for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
    967 			if (rt2860_rates[ridx].rate == rate)
    968 				break;
    969 		rn->ridx[i] = ridx;
    970 		/* determine rate of control response frames */
    971 		for (j = i; j >= 0; j--) {
    972 			if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
    973 			    rt2860_rates[rn->ridx[i]].phy ==
    974 			    rt2860_rates[rn->ridx[j]].phy)
    975 				break;
    976 		}
    977 		if (j >= 0) {
    978 			rn->ctl_ridx[i] = rn->ridx[j];
    979 		} else {
    980 			/* no basic rate found, use mandatory one */
    981 			rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
    982 		}
    983 		DPRINTF(("rate=0x%02x ridx=%d ctl_ridx=%d\n",
    984 		    rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]));
    985 	}
    986 }
    987 
    988 #ifdef notyet
    989 static int
    990 rt2860_ampdu_rx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
    991     uint8_t tid)
    992 {
    993 	struct rt2860_softc *sc = ic->ic_softc;
    994 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
    995 	uint32_t tmp;
    996 
    997 	/* update BA session mask */
    998 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
    999 	tmp |= (1 << tid) << 16;
   1000 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
   1001 	return 0;
   1002 }
   1003 
   1004 static void
   1005 rt2860_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
   1006     uint8_t tid)
   1007 {
   1008 	struct rt2860_softc *sc = ic->ic_softc;
   1009 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
   1010 	uint32_t tmp;
   1011 
   1012 	/* update BA session mask */
   1013 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
   1014 	tmp &= ~((1 << tid) << 16);
   1015 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
   1016 }
   1017 #endif
   1018 
   1019 static int
   1020 rt2860_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
   1021 {
   1022 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
   1023 	enum ieee80211_state ostate;
   1024 	uint32_t tmp;
   1025 
   1026 	ostate = ic->ic_state;
   1027 
   1028 	DPRINTF(("ostate = %d nstate = %d\n", ostate, nstate));
   1029 	if (ostate == IEEE80211_S_RUN) {
   1030 		/* turn link LED off */
   1031 		rt2860_set_leds(sc, RT2860_LED_RADIO);
   1032 	}
   1033 
   1034 	switch (nstate) {
   1035 	case IEEE80211_S_INIT:
   1036 		if (ostate == IEEE80211_S_RUN) {
   1037 			/* abort TSF synchronization */
   1038 			tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
   1039 			RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
   1040 			    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
   1041 			    RT2860_TBTT_TIMER_EN));
   1042 		}
   1043 		rt2860_set_gp_timer(sc, 0);
   1044 		break;
   1045 
   1046 	case IEEE80211_S_SCAN:
   1047 		rt2860_switch_chan(sc, ic->ic_curchan);
   1048 		if (ostate != IEEE80211_S_SCAN)
   1049 			rt2860_set_gp_timer(sc, 150);
   1050 		break;
   1051 
   1052 	case IEEE80211_S_AUTH:
   1053 	case IEEE80211_S_ASSOC:
   1054 		rt2860_set_gp_timer(sc, 0);
   1055 		rt2860_switch_chan(sc, ic->ic_curchan);
   1056 		break;
   1057 
   1058 	case IEEE80211_S_RUN:
   1059 		rt2860_set_gp_timer(sc, 0);
   1060 		rt2860_switch_chan(sc, ic->ic_curchan);
   1061 
   1062 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
   1063 			rt2860_updateslot(ic->ic_ifp);
   1064 			rt2860_enable_mrr(sc);
   1065 			rt2860_set_txpreamble(sc);
   1066 			rt2860_set_basicrates(sc);
   1067 			rt2860_set_bssid(sc, ic->ic_bss->ni_bssid);
   1068 		}
   1069 
   1070 #ifndef IEEE80211_STA_ONLY
   1071 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
   1072 		    ic->ic_opmode == IEEE80211_M_IBSS)
   1073 			(void)rt2860_setup_beacon(sc);
   1074 #endif
   1075 
   1076 		if (ic->ic_opmode == IEEE80211_M_STA) {
   1077 			/* fake a join to init the tx rate */
   1078 			rt2860_newassoc(ic->ic_bss, 1);
   1079 		}
   1080 
   1081 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
   1082 			rt2860_enable_tsf_sync(sc);
   1083 			rt2860_set_gp_timer(sc, 500);
   1084 		}
   1085 
   1086 		/* turn link LED on */
   1087 		rt2860_set_leds(sc, RT2860_LED_RADIO |
   1088 		    (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan) ?
   1089 		     RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
   1090 		break;
   1091 	}
   1092 
   1093 	return sc->sc_newstate(ic, nstate, arg);
   1094 }
   1095 
   1096 /* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
   1097 static uint16_t
   1098 rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
   1099 {
   1100 	uint32_t tmp;
   1101 	uint16_t reg;
   1102 	int ntries;
   1103 
   1104 	addr *= 2;
   1105 	/*-
   1106 	 * Read one 16-byte block into registers EFUSE_DATA[0-3]:
   1107 	 * DATA0: F E D C
   1108 	 * DATA1: B A 9 8
   1109 	 * DATA2: 7 6 5 4
   1110 	 * DATA3: 3 2 1 0
   1111 	 */
   1112 	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
   1113 	tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
   1114 	tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
   1115 	RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp);
   1116 	for (ntries = 0; ntries < 500; ntries++) {
   1117 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
   1118 		if (!(tmp & RT3070_EFSROM_KICK))
   1119 			break;
   1120 		DELAY(2);
   1121 	}
   1122 	if (ntries == 500)
   1123 		return 0xffff;
   1124 
   1125 	if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK)
   1126 		return 0xffff;	/* address not found */
   1127 
   1128 	/* determine to which 32-bit register our 16-bit word belongs */
   1129 	reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
   1130 	tmp = RAL_READ(sc, reg);
   1131 
   1132 	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
   1133 }
   1134 
   1135 /*
   1136  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
   1137  * 93C66 or 93C86).
   1138  */
   1139 static uint16_t
   1140 rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
   1141 {
   1142 	uint32_t tmp;
   1143 	uint16_t val;
   1144 	int n;
   1145 
   1146 	/* clock C once before the first command */
   1147 	RT2860_EEPROM_CTL(sc, 0);
   1148 
   1149 	RT2860_EEPROM_CTL(sc, RT2860_S);
   1150 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
   1151 	RT2860_EEPROM_CTL(sc, RT2860_S);
   1152 
   1153 	/* write start bit (1) */
   1154 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
   1155 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
   1156 
   1157 	/* write READ opcode (10) */
   1158 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
   1159 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
   1160 	RT2860_EEPROM_CTL(sc, RT2860_S);
   1161 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
   1162 
   1163 	/* write address (A5-A0 or A7-A0) */
   1164 	n = ((RAL_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
   1165 	for (; n >= 0; n--) {
   1166 		RT2860_EEPROM_CTL(sc, RT2860_S |
   1167 		    (((addr >> n) & 1) << RT2860_SHIFT_D));
   1168 		RT2860_EEPROM_CTL(sc, RT2860_S |
   1169 		    (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
   1170 	}
   1171 
   1172 	RT2860_EEPROM_CTL(sc, RT2860_S);
   1173 
   1174 	/* read data Q15-Q0 */
   1175 	val = 0;
   1176 	for (n = 15; n >= 0; n--) {
   1177 		RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
   1178 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
   1179 		val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
   1180 		RT2860_EEPROM_CTL(sc, RT2860_S);
   1181 	}
   1182 
   1183 	RT2860_EEPROM_CTL(sc, 0);
   1184 
   1185 	/* clear Chip Select and clock C */
   1186 	RT2860_EEPROM_CTL(sc, RT2860_S);
   1187 	RT2860_EEPROM_CTL(sc, 0);
   1188 	RT2860_EEPROM_CTL(sc, RT2860_C);
   1189 
   1190 	return val;
   1191 }
   1192 
   1193 static __inline uint16_t
   1194 rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
   1195 {
   1196 	/* either eFUSE ROM or EEPROM */
   1197 	return sc->sc_srom_read(sc, addr);
   1198 }
   1199 
   1200 static void
   1201 rt2860_intr_coherent(struct rt2860_softc *sc)
   1202 {
   1203 	uint32_t tmp;
   1204 
   1205 	/* DMA finds data coherent event when checking the DDONE bit */
   1206 
   1207 	DPRINTF(("Tx/Rx Coherent interrupt\n"));
   1208 
   1209 	/* restart DMA engine */
   1210 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
   1211 	tmp &= ~(RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
   1212 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
   1213 
   1214 	(void)rt2860_txrx_enable(sc);
   1215 }
   1216 
   1217 static void
   1218 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
   1219 {
   1220 	struct ifnet *ifp = &sc->sc_if;
   1221 	struct ieee80211_amrr_node *amn;
   1222 	uint32_t stat;
   1223 	uint8_t wcid, mcs, pid;
   1224 
   1225 	/* drain Tx status FIFO (maxsize = 16) */
   1226 	while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
   1227 		DPRINTFN(4, ("tx stat 0x%08x\n", stat));
   1228 
   1229 		wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
   1230 
   1231 		/* if no ACK was requested, no feedback is available */
   1232 		if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff)
   1233 			continue;
   1234 
   1235 		/* update per-STA AMRR stats */
   1236 		amn = &sc->amn[wcid];
   1237 		amn->amn_txcnt++;
   1238 		if (stat & RT2860_TXQ_OK) {
   1239 			/*
   1240 			 * Check if there were retries, ie if the Tx success
   1241 			 * rate is different from the requested rate.  Note
   1242 			 * that it works only because we do not allow rate
   1243 			 * fallback from OFDM to CCK.
   1244 			 */
   1245 			mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
   1246 			pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
   1247 			if (mcs + 1 != pid)
   1248 				amn->amn_retrycnt++;
   1249 		} else {
   1250 			amn->amn_retrycnt++;
   1251 			if_statinc(ifp, if_oerrors);
   1252 		}
   1253 	}
   1254 }
   1255 
   1256 static void
   1257 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
   1258 {
   1259 	struct ifnet *ifp = &sc->sc_if;
   1260 	struct rt2860_tx_ring *ring = &sc->txq[qid];
   1261 	uint32_t hw;
   1262 	int s;
   1263 
   1264 	s = splnet();
   1265 
   1266 	rt2860_drain_stats_fifo(sc);
   1267 
   1268 	hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid));
   1269 	DPRINTF(("%s: tx mbuf %#x\n", __func__, hw));
   1270 	while (ring->next != hw) {
   1271 		struct rt2860_tx_data *data = ring->data[ring->next];
   1272 
   1273 		if (data != NULL) {
   1274 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
   1275 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
   1276 			bus_dmamap_unload(sc->sc_dmat, data->map);
   1277 			m_freem(data->m);
   1278 			data->m = NULL;
   1279 			ieee80211_free_node(data->ni);
   1280 			data->ni = NULL;
   1281 
   1282 			SLIST_INSERT_HEAD(&sc->data_pool, data, next);
   1283 			ring->data[ring->next] = NULL;
   1284 
   1285 			if_statinc(ifp, if_opackets);
   1286 		}
   1287 		ring->queued--;
   1288 		ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
   1289 	}
   1290 
   1291 	sc->sc_tx_timer = 0;
   1292 	if (ring->queued <= RT2860_TX_RING_ONEMORE)
   1293 		sc->qfullmsk &= ~(1 << qid);
   1294 	ifp->if_flags &= ~IFF_OACTIVE;
   1295 	rt2860_start(ifp); /* in softint */
   1296 
   1297 	splx(s);
   1298 }
   1299 
   1300 /*
   1301  * Return the Rx chain with the highest RSSI for a given frame.
   1302  */
   1303 static __inline uint8_t
   1304 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
   1305 {
   1306 	uint8_t rxchain = 0;
   1307 
   1308 	if (sc->nrxchains > 1) {
   1309 		if (rxwi->rssi[1] > rxwi->rssi[rxchain])
   1310 			rxchain = 1;
   1311 		if (sc->nrxchains > 2)
   1312 			if (rxwi->rssi[2] > rxwi->rssi[rxchain])
   1313 				rxchain = 2;
   1314 	}
   1315 	return rxchain;
   1316 }
   1317 
   1318 static void
   1319 rt2860_rx_intr(struct rt2860_softc *sc)
   1320 {
   1321 	struct ieee80211com *ic = &sc->sc_ic;
   1322 	struct ifnet *ifp = &sc->sc_if;
   1323 	struct ieee80211_frame *wh;
   1324 	struct ieee80211_node *ni;
   1325 	struct mbuf *m, *m1;
   1326 	uint32_t hw;
   1327 	uint8_t ant, rssi;
   1328 	int error, s;
   1329 	struct rt2860_rx_radiotap_header *tap;
   1330 	uint16_t phy;
   1331 
   1332 	hw = RAL_READ(sc, RT2860_FS_DRX_IDX) & 0xfff;
   1333 	DPRINTF(("%s: rx mbuf %#x\n", __func__, hw));
   1334 	while (sc->rxq.cur != hw) {
   1335 		struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
   1336 		struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
   1337 		struct rt2860_rxwi *rxwi;
   1338 
   1339 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
   1340 		    sc->rxq.cur * sizeof (struct rt2860_rxd),
   1341 		    sizeof (struct rt2860_rxd), BUS_DMASYNC_POSTREAD);
   1342 
   1343 		if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))) {
   1344 			DPRINTF(("RXD DDONE bit not set!\n"));
   1345 			break;	/* should not happen */
   1346 		}
   1347 
   1348 		if (__predict_false(rxd->flags &
   1349 		    htole32(RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
   1350 			DPRINTF(("error %#x\n", rxd->flags));
   1351 			if_statinc(ifp, if_ierrors);
   1352 			goto skip;
   1353 		}
   1354 
   1355 
   1356 		MGETHDR(m1, M_DONTWAIT, MT_DATA);
   1357 		if (__predict_false(m1 == NULL)) {
   1358 			DPRINTF(("error2 %#x\n", rxd->flags));
   1359 			if_statinc(ifp, if_ierrors);
   1360 			goto skip;
   1361 		}
   1362 		MCLGET(m1, M_DONTWAIT);
   1363 		if (__predict_false((m1->m_flags & M_EXT) == 0)) {
   1364 			DPRINTF(("no mbuf\n"));
   1365 			m_freem(m1);
   1366 			if_statinc(ifp, if_ierrors);
   1367 			goto skip;
   1368 		}
   1369 
   1370 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
   1371 		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
   1372 		bus_dmamap_unload(sc->sc_dmat, data->map);
   1373 
   1374 		error = bus_dmamap_load(sc->sc_dmat, data->map,
   1375 		    mtod(m1, void *), MCLBYTES, NULL,
   1376 		    BUS_DMA_READ | BUS_DMA_NOWAIT);
   1377 		if (__predict_false(error != 0)) {
   1378 			DPRINTF(("dma error %d\n", error));
   1379 			m_freem(m1);
   1380 
   1381 			/* try to reload the old mbuf */
   1382 			error = bus_dmamap_load(sc->sc_dmat, data->map,
   1383 			    mtod(data->m, void *), MCLBYTES, NULL,
   1384 			    BUS_DMA_READ | BUS_DMA_NOWAIT);
   1385 			if (__predict_false(error != 0)) {
   1386 				panic("%s: could not load old rx mbuf",
   1387 				    device_xname(sc->sc_dev));
   1388 			}
   1389 			/* physical address may have changed */
   1390 			rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
   1391 			if_statinc(ifp, if_ierrors);
   1392 			goto skip;
   1393 		}
   1394 
   1395 		/*
   1396 		 * New mbuf successfully loaded, update Rx ring and continue
   1397 		 * processing.
   1398 		 */
   1399 		m = data->m;
   1400 		data->m = m1;
   1401 		rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
   1402 
   1403 		rxwi = mtod(m, struct rt2860_rxwi *);
   1404 
   1405 		/* finalize mbuf */
   1406 		m->m_data = (void *)(rxwi + 1);
   1407 		m_set_rcvif(m, ifp);
   1408 		m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;
   1409 
   1410 		wh = mtod(m, struct ieee80211_frame *);
   1411 #ifdef HW_CRYPTO
   1412 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
   1413 			/* frame is decrypted by hardware */
   1414 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
   1415 		}
   1416 #endif
   1417 
   1418 		/* HW may insert 2 padding bytes after 802.11 header */
   1419 		if (rxd->flags & htole32(RT2860_RX_L2PAD)) {
   1420 			u_int hdrlen = ieee80211_hdrsize(wh);
   1421 			memmove((char *)wh + 2, wh, hdrlen);
   1422 			m->m_data += 2;
   1423 			wh = mtod(m, struct ieee80211_frame *);
   1424 		}
   1425 
   1426 #ifdef HW_CRYPTO
   1427 		if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))) {
   1428 			/* report MIC failures to net80211 for TKIP */
   1429 			ieee80211_notify_michael_failure(ic, wh, 0/* XXX */);
   1430 			DPRINTF(("error2 %#x\n", rxd->flags));
   1431 			if_statinc(ifp, if_ierrors);
   1432 			goto skip;
   1433 		}
   1434 #endif
   1435 		ant = rt2860_maxrssi_chain(sc, rxwi);
   1436 		rssi = rxwi->rssi[ant];
   1437 
   1438 		s = splnet();
   1439 
   1440 		if (__predict_true(sc->sc_drvbpf == NULL))
   1441 			goto skipbpf;
   1442 
   1443 		tap = &sc->sc_rxtap;
   1444 		tap->wr_flags = 0;
   1445 		tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
   1446 		tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
   1447 		tap->wr_antsignal = rssi;
   1448 		tap->wr_antenna = ant;
   1449 		tap->wr_dbm_antsignal = rt2860_rssi2dbm(sc, rssi, ant);
   1450 		tap->wr_rate = 2;	/* in case it can't be found below */
   1451 		phy = le16toh(rxwi->phy);
   1452 		switch (phy & RT2860_PHY_MODE) {
   1453 		case RT2860_PHY_CCK:
   1454 			switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
   1455 			case 0:	tap->wr_rate =   2; break;
   1456 			case 1:	tap->wr_rate =   4; break;
   1457 			case 2:	tap->wr_rate =  11; break;
   1458 			case 3:	tap->wr_rate =  22; break;
   1459 			}
   1460 			if (phy & RT2860_PHY_SHPRE)
   1461 				tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
   1462 			break;
   1463 		case RT2860_PHY_OFDM:
   1464 			switch (phy & RT2860_PHY_MCS) {
   1465 			case 0:	tap->wr_rate =  12; break;
   1466 			case 1:	tap->wr_rate =  18; break;
   1467 			case 2:	tap->wr_rate =  24; break;
   1468 			case 3:	tap->wr_rate =  36; break;
   1469 			case 4:	tap->wr_rate =  48; break;
   1470 			case 5:	tap->wr_rate =  72; break;
   1471 			case 6:	tap->wr_rate =  96; break;
   1472 			case 7:	tap->wr_rate = 108; break;
   1473 			}
   1474 			break;
   1475 		}
   1476 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
   1477 skipbpf:
   1478 		/* grab a reference to the source node */
   1479 		ni = ieee80211_find_rxnode(ic,
   1480 		    (struct ieee80211_frame_min *)wh);
   1481 
   1482 		/* send the frame to the 802.11 layer */
   1483 		ieee80211_input(ic, m, ni, rssi, 0);
   1484 
   1485 		/* node is no longer needed */
   1486 		ieee80211_free_node(ni);
   1487 
   1488 		splx(s);
   1489 
   1490 skip:		rxd->sdl0 &= ~htole16(RT2860_RX_DDONE);
   1491 
   1492 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
   1493 		    sc->rxq.cur * sizeof (struct rt2860_rxd),
   1494 		    sizeof (struct rt2860_rxd), BUS_DMASYNC_PREWRITE);
   1495 
   1496 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
   1497 	}
   1498 
   1499 	/* tell HW what we have processed */
   1500 	RAL_WRITE(sc, RT2860_RX_CALC_IDX,
   1501 	    (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
   1502 }
   1503 
   1504 static void
   1505 rt2860_tbtt_intr(struct rt2860_softc *sc)
   1506 {
   1507 	struct ieee80211com *ic = &sc->sc_ic;
   1508 
   1509 #ifndef IEEE80211_STA_ONLY
   1510 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
   1511 		/* one less beacon until next DTIM */
   1512 		if (ic->ic_dtim_count == 0)
   1513 			ic->ic_dtim_count = ic->ic_dtim_period - 1;
   1514 		else
   1515 			ic->ic_dtim_count--;
   1516 
   1517 		/* update dynamic parts of beacon */
   1518 		rt2860_setup_beacon(sc);
   1519 
   1520 #if 0
   1521 		/* flush buffered multicast frames */
   1522 		if (ic->ic_dtim_count == 0)
   1523 			ieee80211_notify_dtim(ic);
   1524 #endif
   1525 	}
   1526 #endif
   1527 	/* check if protection mode has changed */
   1528 	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
   1529 		rt2860_updateprot(ic);
   1530 		sc->sc_ic_flags = ic->ic_flags;
   1531 	}
   1532 }
   1533 
   1534 static void
   1535 rt2860_gp_intr(struct rt2860_softc *sc)
   1536 {
   1537 	struct ieee80211com *ic = &sc->sc_ic;
   1538 	int s;
   1539 
   1540 	DPRINTFN(2, ("GP timeout state=%d\n", ic->ic_state));
   1541 
   1542 	s = splnet();
   1543 	if (ic->ic_state == IEEE80211_S_SCAN)
   1544 		ieee80211_next_scan(ic);
   1545 	else if (ic->ic_state == IEEE80211_S_RUN)
   1546 		rt2860_updatestats(sc);
   1547 	splx(s);
   1548 }
   1549 
   1550 int
   1551 rt2860_intr(void *arg)
   1552 {
   1553 	struct rt2860_softc *sc = arg;
   1554 	uint32_t r;
   1555 
   1556 	r = RAL_READ(sc, RT2860_INT_STATUS);
   1557 	if (__predict_false(r == 0xffffffff))
   1558 		return 0;	/* device likely went away */
   1559 	if (r == 0)
   1560 		return 0;	/* not for us */
   1561 
   1562 	softint_schedule(sc->sc_soft_ih);
   1563 	return 1;
   1564 }
   1565 
   1566 static void
   1567 rt2860_softintr(void *arg)
   1568 {
   1569 	struct rt2860_softc *sc = arg;
   1570 	uint32_t r;
   1571 
   1572 	r = RAL_READ(sc, RT2860_INT_STATUS);
   1573 	if (__predict_false(r == 0xffffffff))
   1574 		goto out;	/* device likely went away */
   1575 	if (r == 0)
   1576 		goto out;
   1577 
   1578 	/* acknowledge interrupts */
   1579 	RAL_WRITE(sc, RT2860_INT_STATUS, r);
   1580 
   1581 	if (r & RT2860_TX_RX_COHERENT)
   1582 		rt2860_intr_coherent(sc);
   1583 
   1584 	if (r & RT2860_MAC_INT_2)	/* TX status */
   1585 		rt2860_drain_stats_fifo(sc);
   1586 
   1587 	if (r & RT2860_TX_DONE_INT5)
   1588 		rt2860_tx_intr(sc, 5);
   1589 
   1590 	if (r & RT2860_RX_DONE_INT)
   1591 		rt2860_rx_intr(sc);
   1592 
   1593 	if (r & RT2860_TX_DONE_INT4)
   1594 		rt2860_tx_intr(sc, 4);
   1595 
   1596 	if (r & RT2860_TX_DONE_INT3)
   1597 		rt2860_tx_intr(sc, 3);
   1598 
   1599 	if (r & RT2860_TX_DONE_INT2)
   1600 		rt2860_tx_intr(sc, 2);
   1601 
   1602 	if (r & RT2860_TX_DONE_INT1)
   1603 		rt2860_tx_intr(sc, 1);
   1604 
   1605 	if (r & RT2860_TX_DONE_INT0)
   1606 		rt2860_tx_intr(sc, 0);
   1607 
   1608 	if (r & RT2860_MAC_INT_0)	/* TBTT */
   1609 		rt2860_tbtt_intr(sc);
   1610 
   1611 	if (r & RT2860_MAC_INT_3) {	/* Auto wakeup */
   1612 		/* TBD wakeup */
   1613 	}
   1614 
   1615 	if (r & RT2860_MAC_INT_4)	/* GP timer */
   1616 		rt2860_gp_intr(sc);
   1617 
   1618 out:
   1619 	/* enable interrupts */
   1620 	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
   1621 }
   1622 
   1623 static int
   1624 rt2860_tx(struct rt2860_softc *sc, struct mbuf **m0, struct ieee80211_node *ni)
   1625 {
   1626 	struct ieee80211com *ic = &sc->sc_ic;
   1627 	struct rt2860_node *rn = (void *)ni;
   1628 	struct rt2860_tx_ring *ring;
   1629 	struct rt2860_tx_data *data;
   1630 	struct rt2860_txd *txd;
   1631 	struct rt2860_txwi *txwi;
   1632 	struct ieee80211_frame *wh;
   1633 	struct mbuf *m = *m0;
   1634 	bus_dma_segment_t *seg;
   1635 	u_int hdrlen;
   1636 	uint16_t qos, dur;
   1637 	uint8_t type, qsel, mcs, pid, tid, qid;
   1638 	int nsegs, hasqos, ridx, ctl_ridx;
   1639 
   1640 	/* the data pool contains at least one element, pick the first */
   1641 	data = SLIST_FIRST(&sc->data_pool);
   1642 
   1643 	wh = mtod(m, struct ieee80211_frame *);
   1644 #ifndef HW_CRYPTO
   1645 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
   1646 		struct ieee80211_key *k = ieee80211_crypto_encap(ic, ni, m);
   1647 		if (k == NULL) {
   1648 			m_freem(m);
   1649 			*m0 = NULL;
   1650 			return ENOBUFS;
   1651 		}
   1652 
   1653 		/* packet header may have moved, reset our local pointer */
   1654 		wh = mtod(m, struct ieee80211_frame *);
   1655 	}
   1656 #endif
   1657 
   1658 	hdrlen = ieee80211_anyhdrsize(wh);
   1659 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
   1660 
   1661 	if ((hasqos = ieee80211_has_qos(wh))) {
   1662 		qos = ieee80211_get_qos(wh);
   1663 		tid = qos & IEEE80211_QOS_TID;
   1664 		qid = TID_TO_WME_AC(tid);
   1665 	} else {
   1666 		qos = 0;
   1667 		tid = 0;
   1668 		qid = (type == IEEE80211_FC0_TYPE_MGT) ?
   1669 		    sc->mgtqid : WME_AC_BE;
   1670 	}
   1671 	KASSERT(qid < MAXQS);
   1672 	ring = &sc->txq[qid];
   1673 
   1674 	/* pickup a rate index */
   1675 	if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
   1676 	    type != IEEE80211_FC0_TYPE_DATA) {
   1677 		ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
   1678 		    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
   1679 		ctl_ridx = rt2860_rates[ridx].ctl_ridx;
   1680 	} else if (ic->ic_fixed_rate != -1) {
   1681 		ridx = sc->fixed_ridx;
   1682 		ctl_ridx = rt2860_rates[ridx].ctl_ridx;
   1683 	} else {
   1684 		ridx = rn->ridx[ni->ni_txrate];
   1685 		ctl_ridx = rn->ctl_ridx[ni->ni_txrate];
   1686 	}
   1687 
   1688 	/* get MCS code from rate index */
   1689 	mcs = rt2860_rates[ridx].mcs;
   1690 
   1691 	/* setup TX Wireless Information */
   1692 	txwi = data->txwi;
   1693 	txwi->flags = 0;
   1694 	/* let HW generate seq numbers for non-QoS frames */
   1695 	txwi->xflags = hasqos ? 0 : RT2860_TX_NSEQ;
   1696 	txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA) ? rn->wcid : 0xff;
   1697 	txwi->len = htole16(m->m_pkthdr.len);
   1698 	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
   1699 		txwi->phy = htole16(RT2860_PHY_CCK);
   1700 		if (ridx != RT2860_RIDX_CCK1 &&
   1701 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
   1702 			mcs |= RT2860_PHY_SHPRE;
   1703 	} else
   1704 		txwi->phy = htole16(RT2860_PHY_OFDM);
   1705 	txwi->phy |= htole16(mcs);
   1706 
   1707 	/*
   1708 	 * We store the MCS code into the driver-private PacketID field.
   1709 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
   1710 	 * that we know at which initial rate the frame was transmitted.
   1711 	 * We add 1 to the MCS code because setting the PacketID field to
   1712 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
   1713 	 */
   1714 	pid = (mcs + 1) & 0xf;
   1715 	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
   1716 
   1717 	/* check if RTS/CTS or CTS-to-self protection is required */
   1718 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
   1719 	    (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
   1720 	     ((ic->ic_flags & IEEE80211_F_USEPROT) &&
   1721 	      rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
   1722 		txwi->txop = RT2860_TX_TXOP_HT;
   1723 	else
   1724 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
   1725 
   1726 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
   1727 	    (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
   1728 	     IEEE80211_QOS_ACKPOLICY_NOACK)) {
   1729 		txwi->xflags |= RT2860_TX_ACK;
   1730 
   1731 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
   1732 			dur = rt2860_rates[ctl_ridx].sp_ack_dur;
   1733 		else
   1734 			dur = rt2860_rates[ctl_ridx].lp_ack_dur;
   1735 		*(uint16_t *)wh->i_dur = htole16(dur);
   1736 	}
   1737 #ifndef IEEE80211_STA_ONLY
   1738 	/* ask MAC to insert timestamp into probe responses */
   1739 	if ((wh->i_fc[0] &
   1740 	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
   1741 	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
   1742 	    /* NOTE: beacons do not pass through tx_data() */
   1743 		txwi->flags |= RT2860_TX_TS;
   1744 #endif
   1745 
   1746 	if (__predict_false(sc->sc_drvbpf != NULL)) {
   1747 		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
   1748 
   1749 		tap->wt_flags = 0;
   1750 		tap->wt_rate = rt2860_rates[ridx].rate;
   1751 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
   1752 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
   1753 		tap->wt_hwqueue = qid;
   1754 		if (mcs & RT2860_PHY_SHPRE)
   1755 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
   1756 
   1757 		bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m, BPF_D_OUT);
   1758 	}
   1759 
   1760 	/* copy and trim 802.11 header */
   1761 	memcpy(txwi + 1, wh, hdrlen);
   1762 	m_adj(m, hdrlen);
   1763 
   1764 	KASSERT (ring->queued <= RT2860_TX_RING_ONEMORE); /* <1> */
   1765 	if (bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m, BUS_DMA_NOWAIT)) {
   1766 		struct mbuf *m_new = m_defrag(m, M_DONTWAIT);
   1767 		if (m_new != NULL) {
   1768 			/* m got freed */
   1769 			m = m_new;
   1770 			*m0 = m_new;
   1771 		} else {
   1772 			return (ENOBUFS);
   1773 		}
   1774 		if (bus_dmamap_load_mbuf(sc->sc_dmat,
   1775 		    data->map, m, BUS_DMA_NOWAIT))
   1776 			return (EFBIG);
   1777 	}
   1778 
   1779 	/* The map will fit into the tx ring: (a "full" ring may have a few
   1780 	 * unused descriptors, at most (txds(MAX_SCATTER) - 1))
   1781 	 *
   1782 	 *   ring->queued + txds(data->map->nsegs)
   1783 	 * <=	{ <0> data->map->nsegs <= MAX_SCATTER }
   1784 	 *   ring->queued + txds(MAX_SCATTER)
   1785 	 * <=	{ <1> ring->queued <= TX_RING_MAX - txds(MAX_SCATTER) }
   1786 	 *   TX_RING_MAX - txds(MAX_SCATTER) + txds(MAX_SCATTER)
   1787 	 * <=   { arithmetic }
   1788 	 *   TX_RING_MAX
   1789 	 */
   1790 
   1791 	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
   1792 
   1793 	/* first segment is TXWI + 802.11 header */
   1794 	txd = &ring->txd[ring->cur];
   1795 	txd->sdp0 = htole32(data->paddr);
   1796 	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + hdrlen);
   1797 	txd->flags = qsel;
   1798 
   1799 	/* setup payload segments */
   1800 	seg = data->map->dm_segs;
   1801 	for (nsegs = data->map->dm_nsegs; nsegs >= 2; nsegs -= 2) {
   1802 		txd->sdp1 = htole32(seg->ds_addr);
   1803 		txd->sdl1 = htole16(seg->ds_len);
   1804 		seg++;
   1805 		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
   1806 		/* grab a new Tx descriptor */
   1807 		txd = &ring->txd[ring->cur];
   1808 		txd->sdp0 = htole32(seg->ds_addr);
   1809 		txd->sdl0 = htole16(seg->ds_len);
   1810 		txd->flags = qsel;
   1811 		seg++;
   1812 	}
   1813 	/* finalize last segment */
   1814 	if (nsegs > 0) {
   1815 		txd->sdp1 = htole32(seg->ds_addr);
   1816 		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
   1817 	} else {
   1818 		txd->sdl0 |= htole16(RT2860_TX_LS0);
   1819 		txd->sdl1 = 0;
   1820 	}
   1821 
   1822 	/* remove from the free pool and link it into the SW Tx slot */
   1823 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
   1824 	data->m = m;
   1825 	data->ni = ni;
   1826 	ring->data[ring->cur] = data;
   1827 
   1828 	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map,
   1829 	    (uintptr_t)txwi - (uintptr_t)sc->txwi_vaddr, RT2860_TXWI_DMASZ,
   1830 	    BUS_DMASYNC_PREWRITE);
   1831 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
   1832 	    BUS_DMASYNC_PREWRITE);
   1833 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
   1834 	    BUS_DMASYNC_PREWRITE);
   1835 
   1836 	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
   1837 	    qid, txwi->wcid, data->map->dm_nsegs, ridx));
   1838 
   1839 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
   1840 	ring->queued += 1 + (data->map->dm_nsegs / 2);
   1841 	if (ring->queued > RT2860_TX_RING_ONEMORE)
   1842 		sc->qfullmsk |= 1 << qid;
   1843 
   1844 	/* kick Tx */
   1845 	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
   1846 
   1847 	return 0;
   1848 }
   1849 
   1850 static void
   1851 rt2860_start(struct ifnet *ifp)
   1852 {
   1853 	struct rt2860_softc *sc = ifp->if_softc;
   1854 	struct ieee80211com *ic = &sc->sc_ic;
   1855 	struct ether_header *eh;
   1856 	struct ieee80211_node *ni;
   1857 	struct mbuf *m;
   1858 
   1859 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
   1860 		return;
   1861 
   1862 	for (;;) {
   1863 		if (SLIST_EMPTY(&sc->data_pool) || sc->qfullmsk != 0) {
   1864 			DPRINTF(("%s: stuffup\n", __func__));
   1865 			ifp->if_flags |= IFF_OACTIVE;
   1866 			break;
   1867 		}
   1868 		/* send pending management frames first */
   1869 		IF_DEQUEUE(&ic->ic_mgtq, m);
   1870 		if (m != NULL) {
   1871 			ni = M_GETCTX(m, struct ieee80211_node *);
   1872 			M_CLEARCTX(m);
   1873 			DPRINTF(("%s: send management\n", __func__));
   1874 			goto sendit;
   1875 		}
   1876 		if (ic->ic_state != IEEE80211_S_RUN) {
   1877 			DPRINTF(("%s: not running %d\n", __func__,
   1878 			    ic->ic_state));
   1879 			break;
   1880 		}
   1881 
   1882 		/* encapsulate and send data frames */
   1883 		IFQ_DEQUEUE(&ifp->if_snd, m);
   1884 		if (m == NULL) {
   1885 			DPRINTF(("%s: nothing to send\n", __func__));
   1886 			break;
   1887 		}
   1888 		if (m->m_len < (int)sizeof(*eh) &&
   1889 		    (m = m_pullup(m, sizeof(*eh))) == NULL) {
   1890 			DPRINTF(("%s: nothing to send\n", __func__));
   1891 			if_statinc(ifp, if_oerrors);
   1892 			continue;
   1893 		}
   1894 
   1895 		eh = mtod(m, struct ether_header *);
   1896 
   1897 		ni = ieee80211_find_txnode(ic, eh->ether_dhost);
   1898 		if (ni == NULL) {
   1899 			DPRINTF(("%s: can't find tx node\n", __func__));
   1900 			m_freem(m);
   1901 			if_statinc(ifp, if_oerrors);
   1902 			continue;
   1903 		}
   1904 
   1905 		bpf_mtap(ifp, m, BPF_D_OUT);
   1906 
   1907 		if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
   1908 			DPRINTF(("%s: can't encap\n", __func__));
   1909 			ieee80211_free_node(ni);
   1910 			if_statinc(ifp, if_oerrors);
   1911 			continue;
   1912 		}
   1913 sendit:
   1914 		bpf_mtap3(ic->ic_rawbpf, m, BPF_D_OUT);
   1915 
   1916 		if (rt2860_tx(sc, &m, ni) != 0) {
   1917 			DPRINTF(("%s: can't tx\n", __func__));
   1918 			m_freem(m);
   1919 			ieee80211_free_node(ni);
   1920 			if_statinc(ifp, if_oerrors);
   1921 			continue;
   1922 		}
   1923 
   1924 		sc->sc_tx_timer = 5;
   1925 		ifp->if_timer = 1;
   1926 	}
   1927 }
   1928 
   1929 static void
   1930 rt2860_watchdog(struct ifnet *ifp)
   1931 {
   1932 	struct rt2860_softc *sc = ifp->if_softc;
   1933 	struct ieee80211com *ic = &sc->sc_ic;
   1934 
   1935 	ifp->if_timer = 0;
   1936 
   1937 	if (sc->sc_tx_timer > 0) {
   1938 		if (--sc->sc_tx_timer == 0) {
   1939 			aprint_error_dev(sc->sc_dev, "device timeout\n");
   1940 			rt2860_stop(ifp, 0);
   1941 			rt2860_init(ifp);
   1942 			if_statinc(ifp, if_oerrors);
   1943 			return;
   1944 		}
   1945 		ifp->if_timer = 1;
   1946 	}
   1947 
   1948 	ieee80211_watchdog(ic);
   1949 }
   1950 
   1951 static int
   1952 rt2860_ioctl(struct ifnet *ifp, u_long cmd, void *data)
   1953 {
   1954 	struct rt2860_softc *sc = ifp->if_softc;
   1955 	struct ieee80211com *ic = &sc->sc_ic;
   1956 	int s, error = 0;
   1957 
   1958 	s = splnet();
   1959 
   1960 	switch (cmd) {
   1961 	case SIOCSIFFLAGS:
   1962 		if ((error = ifioctl_common(ifp, cmd, data)) != 0)
   1963 			break;
   1964 		switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
   1965 		case IFF_UP|IFF_RUNNING:
   1966 			rt2860_update_promisc(ifp);
   1967 			break;
   1968 		case IFF_UP:
   1969 			rt2860_init(ifp);
   1970 			break;
   1971 		case IFF_RUNNING:
   1972 			rt2860_stop(ifp, 1);
   1973 			break;
   1974 		case 0:
   1975 			break;
   1976 		}
   1977 		break;
   1978 
   1979 	case SIOCADDMULTI:
   1980 	case SIOCDELMULTI:
   1981 		if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
   1982 			/* setup multicast filter, etc */
   1983 			error = 0;
   1984 		}
   1985 		break;
   1986 
   1987 	case SIOCS80211CHANNEL:
   1988 		/*
   1989 		 * This allows for fast channel switching in monitor mode
   1990 		 * (used by kismet). In IBSS mode, we must explicitly reset
   1991 		 * the interface to generate a new beacon frame.
   1992 		 */
   1993 		error = ieee80211_ioctl(ic, cmd, data);
   1994 		if (error == ENETRESET &&
   1995 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
   1996 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
   1997 			    (IFF_UP | IFF_RUNNING))
   1998 				rt2860_switch_chan(sc, ic->ic_ibss_chan);
   1999 			error = 0;
   2000 		}
   2001 		break;
   2002 
   2003 	default:
   2004 		error = ieee80211_ioctl(ic, cmd, data);
   2005 	}
   2006 
   2007 	if (error == ENETRESET) {
   2008 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
   2009 		    (IFF_UP | IFF_RUNNING)) {
   2010 			rt2860_stop(ifp, 0);
   2011 			rt2860_init(ifp);
   2012 		}
   2013 		error = 0;
   2014 	}
   2015 
   2016 	splx(s);
   2017 
   2018 	return error;
   2019 }
   2020 
   2021 /*
   2022  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
   2023  * We access the BBP through the 8051 microcontroller unit which means that
   2024  * the microcode must be loaded first.
   2025  */
   2026 static void
   2027 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
   2028 {
   2029 	int ntries;
   2030 
   2031 	for (ntries = 0; ntries < 100; ntries++) {
   2032 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
   2033 			break;
   2034 		DELAY(1);
   2035 	}
   2036 	if (ntries == 100) {
   2037 		aprint_error_dev(sc->sc_dev,
   2038 		    "could not write to BBP through MCU\n");
   2039 		return;
   2040 	}
   2041 
   2042 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
   2043 	    RT2860_BBP_CSR_KICK | reg << 8 | val);
   2044 	RAL_BARRIER_WRITE(sc);
   2045 
   2046 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
   2047 	DELAY(1000);
   2048 }
   2049 
   2050 static uint8_t
   2051 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
   2052 {
   2053 	uint32_t val;
   2054 	int ntries;
   2055 
   2056 	for (ntries = 0; ntries < 100; ntries++) {
   2057 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
   2058 			break;
   2059 		DELAY(1);
   2060 	}
   2061 	if (ntries == 100) {
   2062 		aprint_error_dev(sc->sc_dev,
   2063 		    "could not read from BBP through MCU\n");
   2064 		return 0;
   2065 	}
   2066 
   2067 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
   2068 	    RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
   2069 	RAL_BARRIER_WRITE(sc);
   2070 
   2071 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
   2072 	DELAY(1000);
   2073 
   2074 	for (ntries = 0; ntries < 100; ntries++) {
   2075 		val = RAL_READ(sc, RT2860_H2M_BBPAGENT);
   2076 		if (!(val & RT2860_BBP_CSR_KICK))
   2077 			return val & 0xff;
   2078 		DELAY(1);
   2079 	}
   2080 	aprint_error_dev(sc->sc_dev, "could not read from BBP through MCU\n");
   2081 
   2082 	return 0;
   2083 }
   2084 
   2085 /*
   2086  * Write to one of the 4 programmable 24-bit RF registers.
   2087  */
   2088 static void
   2089 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
   2090 {
   2091 	uint32_t tmp;
   2092 	int ntries;
   2093 
   2094 	for (ntries = 0; ntries < 100; ntries++) {
   2095 		if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
   2096 			break;
   2097 		DELAY(1);
   2098 	}
   2099 	if (ntries == 100) {
   2100 		aprint_error_dev(sc->sc_dev, "could not write to RF\n");
   2101 		return;
   2102 	}
   2103 
   2104 	/* RF registers are 24-bit on the RT2860 */
   2105 	tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
   2106 	    (val & 0x3fffff) << 2 | (reg & 3);
   2107 	RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
   2108 }
   2109 
   2110 static uint8_t
   2111 rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
   2112 {
   2113 	uint32_t tmp;
   2114 	int ntries;
   2115 
   2116 	for (ntries = 0; ntries < 100; ntries++) {
   2117 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
   2118 			break;
   2119 		DELAY(1);
   2120 	}
   2121 	if (ntries == 100) {
   2122 		aprint_error_dev(sc->sc_dev, "could not read RF register\n");
   2123 		return 0xff;
   2124 	}
   2125 	tmp = RT3070_RF_KICK | reg << 8;
   2126 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
   2127 
   2128 	for (ntries = 0; ntries < 100; ntries++) {
   2129 		tmp = RAL_READ(sc, RT3070_RF_CSR_CFG);
   2130 		if (!(tmp & RT3070_RF_KICK))
   2131 			break;
   2132 		DELAY(1);
   2133 	}
   2134 	if (ntries == 100) {
   2135 		aprint_error_dev(sc->sc_dev, "could not read RF register\n");
   2136 		return 0xff;
   2137 	}
   2138 	return tmp & 0xff;
   2139 }
   2140 
   2141 static void
   2142 rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
   2143 {
   2144 	uint32_t tmp;
   2145 	int ntries;
   2146 
   2147 	for (ntries = 0; ntries < 10; ntries++) {
   2148 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
   2149 			break;
   2150 		DELAY(10);
   2151 	}
   2152 	if (ntries == 10) {
   2153 		aprint_error_dev(sc->sc_dev, "could not write to RF\n");
   2154 		return;
   2155 	}
   2156 
   2157 	tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
   2158 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
   2159 }
   2160 
   2161 /*
   2162  * Send a command to the 8051 microcontroller unit.
   2163  */
   2164 static int
   2165 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
   2166 {
   2167 	int slot, ntries;
   2168 	uint32_t tmp;
   2169 	uint8_t cid;
   2170 
   2171 	for (ntries = 0; ntries < 100; ntries++) {
   2172 		if (!(RAL_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
   2173 			break;
   2174 		DELAY(2);
   2175 	}
   2176 	if (ntries == 100)
   2177 		return EIO;
   2178 
   2179 	cid = wait ? cmd : RT2860_TOKEN_NO_INTR;
   2180 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY | cid << 16 | arg);
   2181 	RAL_BARRIER_WRITE(sc);
   2182 	RAL_WRITE(sc, RT2860_HOST_CMD, cmd);
   2183 
   2184 	if (!wait)
   2185 		return 0;
   2186 	/* wait for the command to complete */
   2187 	for (ntries = 0; ntries < 200; ntries++) {
   2188 		tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID);
   2189 		/* find the command slot */
   2190 		for (slot = 0; slot < 4; slot++, tmp >>= 8)
   2191 			if ((tmp & 0xff) == cid)
   2192 				break;
   2193 		if (slot < 4)
   2194 			break;
   2195 		DELAY(100);
   2196 	}
   2197 	if (ntries == 200) {
   2198 		/* clear command and status */
   2199 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
   2200 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
   2201 		return ETIMEDOUT;
   2202 	}
   2203 	/* get command status (1 means success) */
   2204 	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS);
   2205 	tmp = (tmp >> (slot * 8)) & 0xff;
   2206 	DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
   2207 	    cmd, slot, tmp));
   2208 	/* clear command and status */
   2209 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
   2210 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
   2211 	return (tmp == 1) ? 0 : EIO;
   2212 }
   2213 
   2214 static void
   2215 rt2860_enable_mrr(struct rt2860_softc *sc)
   2216 {
   2217 #define CCK(mcs)	(mcs)
   2218 #define OFDM(mcs)	(1U << 3 | (mcs))
   2219 	RAL_WRITE(sc, RT2860_LG_FBK_CFG0,
   2220 	    OFDM(6) << 28 |	/* 54->48 */
   2221 	    OFDM(5) << 24 |	/* 48->36 */
   2222 	    OFDM(4) << 20 |	/* 36->24 */
   2223 	    OFDM(3) << 16 |	/* 24->18 */
   2224 	    OFDM(2) << 12 |	/* 18->12 */
   2225 	    OFDM(1) <<  8 |	/* 12-> 9 */
   2226 	    OFDM(0) <<  4 |	/*  9-> 6 */
   2227 	    OFDM(0));		/*  6-> 6 */
   2228 
   2229 	RAL_WRITE(sc, RT2860_LG_FBK_CFG1,
   2230 	    CCK(2) << 12 |	/* 11->5.5 */
   2231 	    CCK(1) <<  8 |	/* 5.5-> 2 */
   2232 	    CCK(0) <<  4 |	/*   2-> 1 */
   2233 	    CCK(0));		/*   1-> 1 */
   2234 #undef OFDM
   2235 #undef CCK
   2236 }
   2237 
   2238 static void
   2239 rt2860_set_txpreamble(struct rt2860_softc *sc)
   2240 {
   2241 	uint32_t tmp;
   2242 
   2243 	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
   2244 	tmp &= ~RT2860_CCK_SHORT_EN;
   2245 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
   2246 		tmp |= RT2860_CCK_SHORT_EN;
   2247 	RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
   2248 }
   2249 
   2250 static void
   2251 rt2860_set_basicrates(struct rt2860_softc *sc)
   2252 {
   2253 	struct ieee80211com *ic = &sc->sc_ic;
   2254 
   2255 	/* set basic rates mask */
   2256 	if (ic->ic_curmode == IEEE80211_MODE_11B)
   2257 		RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
   2258 	else if (ic->ic_curmode == IEEE80211_MODE_11A)
   2259 		RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
   2260 	else	/* 11g */
   2261 		RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
   2262 }
   2263 
   2264 static void
   2265 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
   2266 {
   2267 	uint32_t tmp;
   2268 	uint8_t agc;
   2269 
   2270 	/* Wait for BBP to settle */
   2271 	DELAY(1000);
   2272 
   2273 	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
   2274 	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
   2275 	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
   2276 	rt2860_mcu_bbp_write(sc, 86, 0x00);
   2277 
   2278 	if (group == 0) {
   2279 		if (sc->ext_2ghz_lna) {
   2280 			rt2860_mcu_bbp_write(sc, 82, 0x62);
   2281 			rt2860_mcu_bbp_write(sc, 75, 0x46);
   2282 		} else {
   2283 			rt2860_mcu_bbp_write(sc, 82, 0x84);
   2284 			rt2860_mcu_bbp_write(sc, 75, 0x50);
   2285 		}
   2286 	} else {
   2287 		if (sc->mac_ver == 0x3572)
   2288 			rt2860_mcu_bbp_write(sc, 82, 0x94);
   2289 		else
   2290 			rt2860_mcu_bbp_write(sc, 82, 0xf2);
   2291 
   2292 		if (sc->ext_5ghz_lna)
   2293 			rt2860_mcu_bbp_write(sc, 75, 0x46);
   2294 		else
   2295 			rt2860_mcu_bbp_write(sc, 75, 0x50);
   2296 	}
   2297 
   2298 	tmp = RAL_READ(sc, RT2860_TX_BAND_CFG);
   2299 	tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
   2300 	tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
   2301 	RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
   2302 
   2303 	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
   2304 	tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
   2305 	if (sc->nrxchains > 1)
   2306 		tmp |= RT2860_LNA_PE1_EN;
   2307 	if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
   2308 		tmp |= RT3593_LNA_PE2_EN;
   2309 	if (group == 0) {	/* 2GHz */
   2310 		tmp |= RT2860_PA_PE_G0_EN;
   2311 		if (sc->ntxchains > 1)
   2312 			tmp |= RT2860_PA_PE_G1_EN;
   2313 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
   2314 			tmp |= RT3593_PA_PE_G2_EN;
   2315 	} else {		/* 5GHz */
   2316 		tmp |= RT2860_PA_PE_A0_EN;
   2317 		if (sc->ntxchains > 1)
   2318 			tmp |= RT2860_PA_PE_A1_EN;
   2319 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
   2320 			tmp |= RT3593_PA_PE_A2_EN;
   2321 	}
   2322 	if (sc->mac_ver == 0x3572) {
   2323 		rt3090_rf_write(sc, 8, 0x00);
   2324 		RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
   2325 		rt3090_rf_write(sc, 8, 0x80);
   2326 	} else
   2327 		RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
   2328 
   2329 	if (sc->mac_ver == 0x3593) {
   2330 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
   2331 		if (sc->sc_flags & RT2860_PCIE) {
   2332 			tmp &= ~0x01010000;
   2333 			if (group == 0)
   2334 				tmp |= 0x00010000;
   2335 		} else {
   2336 			tmp &= ~0x00008080;
   2337 			if (group == 0)
   2338 				tmp |= 0x00000080;
   2339 		}
   2340 		tmp = (tmp & ~0x00001000) | 0x00000010;
   2341 		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp);
   2342 	}
   2343 
   2344 	/* set initial AGC value */
   2345 	if (group == 0) {	/* 2GHz band */
   2346 		if (sc->mac_ver >= 0x3071)
   2347 			agc = 0x1c + sc->lna[0] * 2;
   2348 		else
   2349 			agc = 0x2e + sc->lna[0];
   2350 	} else {		/* 5GHz band */
   2351 		if (sc->mac_ver == 0x3572)
   2352 			agc = 0x22 + (sc->lna[group] * 5) / 3;
   2353 		else
   2354 			agc = 0x32 + (sc->lna[group] * 5) / 3;
   2355 	}
   2356 	rt2860_mcu_bbp_write(sc, 66, agc);
   2357 
   2358 	DELAY(1000);
   2359 }
   2360 
   2361 static void
   2362 rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
   2363 {
   2364 	const struct rfprog *rfprog = rt2860_rf2850;
   2365 	uint32_t r2, r3, r4;
   2366 	int8_t txpow1, txpow2;
   2367 	u_int i;
   2368 
   2369 	/* find the settings for this channel (we know it exists) */
   2370 	for (i = 0; rfprog[i].chan != chan; i++);
   2371 
   2372 	r2 = rfprog[i].r2;
   2373 	if (sc->ntxchains == 1)
   2374 		r2 |= 1 << 12;		/* 1T: disable Tx chain 2 */
   2375 	if (sc->nrxchains == 1)
   2376 		r2 |= 1 << 15 | 1 << 4;	/* 1R: disable Rx chains 2 & 3 */
   2377 	else if (sc->nrxchains == 2)
   2378 		r2 |= 1 << 4;		/* 2R: disable Rx chain 3 */
   2379 
   2380 	/* use Tx power values from EEPROM */
   2381 	txpow1 = sc->txpow1[i];
   2382 	txpow2 = sc->txpow2[i];
   2383 	if (chan > 14) {
   2384 		if (txpow1 >= 0)
   2385 			txpow1 = txpow1 << 1 | 1;
   2386 		else
   2387 			txpow1 = (7 + txpow1) << 1;
   2388 		if (txpow2 >= 0)
   2389 			txpow2 = txpow2 << 1 | 1;
   2390 		else
   2391 			txpow2 = (7 + txpow2) << 1;
   2392 	}
   2393 	r3 = rfprog[i].r3 | txpow1 << 7;
   2394 	r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
   2395 
   2396 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
   2397 	rt2860_rf_write(sc, RT2860_RF2, r2);
   2398 	rt2860_rf_write(sc, RT2860_RF3, r3);
   2399 	rt2860_rf_write(sc, RT2860_RF4, r4);
   2400 
   2401 	DELAY(200);
   2402 
   2403 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
   2404 	rt2860_rf_write(sc, RT2860_RF2, r2);
   2405 	rt2860_rf_write(sc, RT2860_RF3, r3 | 1);
   2406 	rt2860_rf_write(sc, RT2860_RF4, r4);
   2407 
   2408 	DELAY(200);
   2409 
   2410 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
   2411 	rt2860_rf_write(sc, RT2860_RF2, r2);
   2412 	rt2860_rf_write(sc, RT2860_RF3, r3);
   2413 	rt2860_rf_write(sc, RT2860_RF4, r4);
   2414 }
   2415 
   2416 static void
   2417 rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
   2418 {
   2419 	int8_t txpow1, txpow2;
   2420 	uint8_t rf;
   2421 	int i;
   2422 
   2423 	KASSERT(chan >= 1 && chan <= 14);	/* RT3090 is 2GHz only */
   2424 
   2425 	/* find the settings for this channel (we know it exists) */
   2426 	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
   2427 
   2428 	/* use Tx power values from EEPROM */
   2429 	txpow1 = sc->txpow1[i];
   2430 	txpow2 = sc->txpow2[i];
   2431 
   2432 	rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
   2433 	rf = rt3090_rf_read(sc, 3);
   2434 	rf = (rf & ~0x0f) | rt3090_freqs[i].k;
   2435 	rt3090_rf_write(sc, 3, rf);
   2436 	rf = rt3090_rf_read(sc, 6);
   2437 	rf = (rf & ~0x03) | rt3090_freqs[i].r;
   2438 	rt3090_rf_write(sc, 6, rf);
   2439 
   2440 	/* set Tx0 power */
   2441 	rf = rt3090_rf_read(sc, 12);
   2442 	rf = (rf & ~0x1f) | txpow1;
   2443 	rt3090_rf_write(sc, 12, rf);
   2444 
   2445 	/* set Tx1 power */
   2446 	rf = rt3090_rf_read(sc, 13);
   2447 	rf = (rf & ~0x1f) | txpow2;
   2448 	rt3090_rf_write(sc, 13, rf);
   2449 
   2450 	rf = rt3090_rf_read(sc, 1);
   2451 	rf &= ~0xfc;
   2452 	if (sc->ntxchains == 1)
   2453 		rf |= RT3070_TX1_PD | RT3070_TX2_PD;
   2454 	else if (sc->ntxchains == 2)
   2455 		rf |= RT3070_TX2_PD;
   2456 	if (sc->nrxchains == 1)
   2457 		rf |= RT3070_RX1_PD | RT3070_RX2_PD;
   2458 	else if (sc->nrxchains == 2)
   2459 		rf |= RT3070_RX2_PD;
   2460 	rt3090_rf_write(sc, 1, rf);
   2461 
   2462 	/* set RF offset */
   2463 	rf = rt3090_rf_read(sc, 23);
   2464 	rf = (rf & ~0x7f) | sc->freq;
   2465 	rt3090_rf_write(sc, 23, rf);
   2466 
   2467 	/* program RF filter */
   2468 	rf = rt3090_rf_read(sc, 24);	/* Tx */
   2469 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
   2470 	rt3090_rf_write(sc, 24, rf);
   2471 	rf = rt3090_rf_read(sc, 31);	/* Rx */
   2472 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
   2473 	rt3090_rf_write(sc, 31, rf);
   2474 
   2475 	/* enable RF tuning */
   2476 	rf = rt3090_rf_read(sc, 7);
   2477 	rt3090_rf_write(sc, 7, rf | RT3070_TUNE);
   2478 }
   2479 
   2480 static void
   2481 rt5390_set_chan(struct rt2860_softc *sc, u_int chan)
   2482 {
   2483 	uint8_t h20mhz, rf, tmp;
   2484 	int8_t txpow1, txpow2;
   2485 	int i;
   2486 
   2487 	/* RT5390 is 2GHz only */
   2488 	KASSERT(chan >= 1 && chan <= 14);
   2489 
   2490 	/* find the settings for this channel (we know it exists) */
   2491 	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
   2492 
   2493 	/* use Tx power values from EEPROM */
   2494 	txpow1 = sc->txpow1[i];
   2495 	txpow2 = sc->txpow2[i];
   2496 
   2497 	rt3090_rf_write(sc, 8, rt3090_freqs[i].n);
   2498 	rt3090_rf_write(sc, 9, rt3090_freqs[i].k & 0x0f);
   2499 	rf = rt3090_rf_read(sc, 11);
   2500 	rf = (rf & ~0x03) | (rt3090_freqs[i].r & 0x03);
   2501 	rt3090_rf_write(sc, 11, rf);
   2502 
   2503 	rf = rt3090_rf_read(sc, 49);
   2504 	rf = (rf & ~0x3f) | (txpow1 & 0x3f);
   2505 	/* the valid range of the RF R49 is 0x00~0x27 */
   2506 	if ((rf & 0x3f) > 0x27)
   2507 		rf = (rf & ~0x3f) | 0x27;
   2508 	rt3090_rf_write(sc, 49, rf);
   2509 	if (sc->mac_ver == 0x5392) {
   2510 		rf = rt3090_rf_read(sc, 50);
   2511 		rf = (rf & ~0x3f) | (txpow2 & 0x3f);
   2512 		/* the valid range of the RF R50 is 0x00~0x27 */
   2513 		if ((rf & 0x3f) > 0x27)
   2514 			rf = (rf & ~0x3f) | 0x27;
   2515 		rt3090_rf_write(sc, 50, rf);
   2516 	}
   2517 
   2518 	rf = rt3090_rf_read(sc, 1);
   2519 	rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
   2520 	if (sc->mac_ver == 0x5392)
   2521 		rf |= RT3070_RX1_PD | RT3070_TX1_PD;
   2522 	rt3090_rf_write(sc, 1, rf);
   2523 
   2524 	rf = rt3090_rf_read(sc, 2);
   2525 	rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
   2526 	DELAY(1000);
   2527 	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
   2528 
   2529 	rf = rt3090_rf_read(sc, 17);
   2530 	tmp = rf;
   2531 	rf = (rf & ~0x7f) | (sc->freq & 0x7f);
   2532 	rf = MIN(rf, 0x5f);
   2533 	if (tmp != rf)
   2534 		rt2860_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf, 0);
   2535 
   2536 	if (sc->mac_ver == 0x5390) {
   2537 		if (chan <= 4)
   2538 			rf = 0x73;
   2539 		else if (chan >= 5 && chan <= 6)
   2540 			rf = 0x63;
   2541 		else if (chan >= 7 && chan <= 10)
   2542 			rf = 0x53;
   2543 		else
   2544 			rf = 43;
   2545 		rt3090_rf_write(sc, 55, rf);
   2546 
   2547 		if (chan == 1)
   2548 			rf = 0x0c;
   2549 		else if (chan == 2)
   2550 			rf = 0x0b;
   2551 		else if (chan == 3)
   2552 			rf = 0x0a;
   2553 		else if (chan >= 4 && chan <= 6)
   2554 			rf = 0x09;
   2555 		else if (chan >= 7 && chan <= 12)
   2556 			rf = 0x08;
   2557 		else if (chan == 13)
   2558 			rf = 0x07;
   2559 		else
   2560 			rf = 0x06;
   2561 		rt3090_rf_write(sc, 59, rf);
   2562 	}
   2563 
   2564 	/* Tx/Rx h20M */
   2565 	h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
   2566 	rf = rt3090_rf_read(sc, 30);
   2567 	rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
   2568 	rt3090_rf_write(sc, 30, rf);
   2569 
   2570 	/* Rx BB filter VCM */
   2571 	rf = rt3090_rf_read(sc, 30);
   2572 	rf = (rf & ~0x18) | 0x10;
   2573 	rt3090_rf_write(sc, 30, rf);
   2574 
   2575 	/* Initiate VCO calibration. */
   2576 	rf = rt3090_rf_read(sc, 3);
   2577 	rf |= RT3593_VCOCAL;
   2578 	rt3090_rf_write(sc, 3, rf);
   2579 }
   2580 
   2581 static void
   2582 rt3090_rf_init(struct rt2860_softc *sc)
   2583 {
   2584 	uint32_t tmp;
   2585 	uint8_t rf, bbp;
   2586 	int i;
   2587 
   2588 	rf = rt3090_rf_read(sc, 30);
   2589 	/* toggle RF R30 bit 7 */
   2590 	rt3090_rf_write(sc, 30, rf | 0x80);
   2591 	DELAY(1000);
   2592 	rt3090_rf_write(sc, 30, rf & ~0x80);
   2593 
   2594 	tmp = RAL_READ(sc, RT3070_LDO_CFG0);
   2595 	tmp &= ~0x1f000000;
   2596 	if (sc->patch_dac && sc->mac_rev < 0x0211)
   2597 		tmp |= 0x0d000000;	/* 1.35V */
   2598 	else
   2599 		tmp |= 0x01000000;	/* 1.2V */
   2600 	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
   2601 
   2602 	/* patch LNA_PE_G1 */
   2603 	tmp = RAL_READ(sc, RT3070_GPIO_SWITCH);
   2604 	RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
   2605 
   2606 	/* initialize RF registers to default value */
   2607 	if (sc->mac_ver == 0x3572) {
   2608 		for (i = 0; i < (int)__arraycount(rt3572_def_rf); i++) {
   2609 			rt3090_rf_write(sc, rt3572_def_rf[i].reg,
   2610 			    rt3572_def_rf[i].val);
   2611 		}
   2612 	} else {
   2613 		for (i = 0; i < (int)__arraycount(rt3090_def_rf); i++) {
   2614 			rt3090_rf_write(sc, rt3090_def_rf[i].reg,
   2615 			    rt3090_def_rf[i].val);
   2616 		}
   2617 	}
   2618 
   2619 	/* select 20MHz bandwidth */
   2620 	rt3090_rf_write(sc, 31, 0x14);
   2621 
   2622 	rf = rt3090_rf_read(sc, 6);
   2623 	rt3090_rf_write(sc, 6, rf | 0x40);
   2624 
   2625 	if (sc->mac_ver != 0x3593) {
   2626 		/* calibrate filter for 20MHz bandwidth */
   2627 		sc->rf24_20mhz = 0x1f;	/* default value */
   2628 		rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
   2629 
   2630 		/* select 40MHz bandwidth */
   2631 		bbp = rt2860_mcu_bbp_read(sc, 4);
   2632 		rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) | 0x10);
   2633 		rf = rt3090_rf_read(sc, 31);
   2634 		rt3090_rf_write(sc, 31, rf | 0x20);
   2635 
   2636 		/* calibrate filter for 40MHz bandwidth */
   2637 		sc->rf24_40mhz = 0x2f;	/* default value */
   2638 		rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
   2639 
   2640 		/* go back to 20MHz bandwidth */
   2641 		bbp = rt2860_mcu_bbp_read(sc, 4);
   2642 		rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
   2643 	}
   2644 	if (sc->mac_rev < 0x0211)
   2645 		rt3090_rf_write(sc, 27, 0x03);
   2646 
   2647 	tmp = RAL_READ(sc, RT3070_OPT_14);
   2648 	RAL_WRITE(sc, RT3070_OPT_14, tmp | 1);
   2649 
   2650 	if (sc->rf_rev == RT3070_RF_3020)
   2651 		rt3090_set_rx_antenna(sc, 0);
   2652 
   2653 	bbp = rt2860_mcu_bbp_read(sc, 138);
   2654 	if (sc->mac_ver == 0x3593) {
   2655 		if (sc->ntxchains == 1)
   2656 			bbp |= 0x60;	/* turn off DAC1 and DAC2 */
   2657 		else if (sc->ntxchains == 2)
   2658 			bbp |= 0x40;	/* turn off DAC2 */
   2659 		if (sc->nrxchains == 1)
   2660 			bbp &= ~0x06;	/* turn off ADC1 and ADC2 */
   2661 		else if (sc->nrxchains == 2)
   2662 			bbp &= ~0x04;	/* turn off ADC2 */
   2663 	} else {
   2664 		if (sc->ntxchains == 1)
   2665 			bbp |= 0x20;	/* turn off DAC1 */
   2666 		if (sc->nrxchains == 1)
   2667 			bbp &= ~0x02;	/* turn off ADC1 */
   2668 	}
   2669 	rt2860_mcu_bbp_write(sc, 138, bbp);
   2670 
   2671 	rf = rt3090_rf_read(sc, 1);
   2672 	rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
   2673 	rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
   2674 	rt3090_rf_write(sc, 1, rf);
   2675 
   2676 	rf = rt3090_rf_read(sc, 15);
   2677 	rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
   2678 
   2679 	rf = rt3090_rf_read(sc, 17);
   2680 	rf &= ~RT3070_TX_LO1;
   2681 	if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
   2682 		rf |= 0x20;	/* fix for long range Rx issue */
   2683 	if (sc->txmixgain_2ghz >= 2)
   2684 		rf = (rf & ~0x7) | sc->txmixgain_2ghz;
   2685 	rt3090_rf_write(sc, 17, rf);
   2686 
   2687 	rf = rt3090_rf_read(sc, 20);
   2688 	rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
   2689 
   2690 	rf = rt3090_rf_read(sc, 21);
   2691 	rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
   2692 }
   2693 
   2694 static void
   2695 rt5390_rf_init(struct rt2860_softc *sc)
   2696 {
   2697 	uint8_t rf, bbp;
   2698 	int i;
   2699 
   2700 	rf = rt3090_rf_read(sc, 2);
   2701 	/* Toggle RF R2 bit 7. */
   2702 	rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
   2703 	DELAY(1000);
   2704 	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
   2705 
   2706 	/* Initialize RF registers to default value. */
   2707 	if (sc->mac_ver == 0x5392) {
   2708 		for (i = 0; i < __arraycount(rt5392_def_rf); i++) {
   2709 			rt3090_rf_write(sc, rt5392_def_rf[i].reg,
   2710 			    rt5392_def_rf[i].val);
   2711 		}
   2712 	} else {
   2713 		for (i = 0; i < __arraycount(rt5390_def_rf); i++) {
   2714 			rt3090_rf_write(sc, rt5390_def_rf[i].reg,
   2715 			    rt5390_def_rf[i].val);
   2716 		}
   2717 	}
   2718 
   2719 	sc->rf24_20mhz = 0x1f;
   2720 	sc->rf24_40mhz = 0x2f;
   2721 
   2722 	if (sc->mac_rev < 0x0211)
   2723 		rt3090_rf_write(sc, 27, 0x03);
   2724 
   2725 	/* Set led open drain enable. */
   2726 	RAL_WRITE(sc, RT3070_OPT_14, RAL_READ(sc, RT3070_OPT_14) | 1);
   2727 
   2728 	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
   2729 	RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
   2730 
   2731 	if (sc->mac_ver == 0x5390)
   2732 		rt3090_set_rx_antenna(sc, 0);
   2733 
   2734 	/* Patch RSSI inaccurate issue. */
   2735 	rt2860_mcu_bbp_write(sc, 79, 0x13);
   2736 	rt2860_mcu_bbp_write(sc, 80, 0x05);
   2737 	rt2860_mcu_bbp_write(sc, 81, 0x33);
   2738 
   2739 	/* Enable DC filter. */
   2740 	if (sc->mac_rev >= 0x0211)
   2741 		rt2860_mcu_bbp_write(sc, 103, 0xc0);
   2742 
   2743 	bbp = rt2860_mcu_bbp_read(sc, 138);
   2744 	if (sc->ntxchains == 1)
   2745 		bbp |= 0x20;	/* Turn off DAC1. */
   2746 	if (sc->nrxchains == 1)
   2747 		bbp &= ~0x02;	/* Turn off ADC1. */
   2748 	rt2860_mcu_bbp_write(sc, 138, bbp);
   2749 
   2750 	/* Enable RX LO1 and LO2. */
   2751 	rt3090_rf_write(sc, 38, rt3090_rf_read(sc, 38) & ~RT5390_RX_LO1);
   2752 	rt3090_rf_write(sc, 39, rt3090_rf_read(sc, 39) & ~RT5390_RX_LO2);
   2753 
   2754 	/* Avoid data lost and CRC error. */
   2755 	rt2860_mcu_bbp_write(sc, 4,
   2756 	    rt2860_mcu_bbp_read(sc, 4) | RT5390_MAC_IF_CTRL);
   2757 
   2758 	rf = rt3090_rf_read(sc, 30);
   2759 	rf = (rf & ~0x18) | 0x10;
   2760 	rt3090_rf_write(sc, 30, rf);
   2761 }
   2762 
   2763 static void
   2764 rt3090_rf_wakeup(struct rt2860_softc *sc)
   2765 {
   2766 	uint32_t tmp;
   2767 	uint8_t rf;
   2768 
   2769 	if (sc->mac_ver == 0x3593) {
   2770 		/* enable VCO */
   2771 		rf = rt3090_rf_read(sc, 1);
   2772 		rt3090_rf_write(sc, 1, rf | RT3593_VCO);
   2773 
   2774 		/* initiate VCO calibration */
   2775 		rf = rt3090_rf_read(sc, 3);
   2776 		rt3090_rf_write(sc, 3, rf | RT3593_VCOCAL);
   2777 
   2778 		/* enable VCO bias current control */
   2779 		rf = rt3090_rf_read(sc, 6);
   2780 		rt3090_rf_write(sc, 6, rf | RT3593_VCO_IC);
   2781 
   2782 		/* initiate res calibration */
   2783 		rf = rt3090_rf_read(sc, 2);
   2784 		rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
   2785 
   2786 		/* set reference current control to 0.33 mA */
   2787 		rf = rt3090_rf_read(sc, 22);
   2788 		rf &= ~RT3593_CP_IC_MASK;
   2789 		rf |= 1 << RT3593_CP_IC_SHIFT;
   2790 		rt3090_rf_write(sc, 22, rf);
   2791 
   2792 		/* enable RX CTB */
   2793 		rf = rt3090_rf_read(sc, 46);
   2794 		rt3090_rf_write(sc, 46, rf | RT3593_RX_CTB);
   2795 
   2796 		rf = rt3090_rf_read(sc, 20);
   2797 		rf &= ~(RT3593_LDO_RF_VC_MASK | RT3593_LDO_PLL_VC_MASK);
   2798 		rt3090_rf_write(sc, 20, rf);
   2799 	} else {
   2800 		/* enable RF block */
   2801 		rf = rt3090_rf_read(sc, 1);
   2802 		rt3090_rf_write(sc, 1, rf | RT3070_RF_BLOCK);
   2803 
   2804 		/* enable VCO bias current control */
   2805 		rf = rt3090_rf_read(sc, 7);
   2806 		rt3090_rf_write(sc, 7, rf | 0x30);
   2807 
   2808 		rf = rt3090_rf_read(sc, 9);
   2809 		rt3090_rf_write(sc, 9, rf | 0x0e);
   2810 
   2811 		/* enable RX CTB */
   2812 		rf = rt3090_rf_read(sc, 21);
   2813 		rt3090_rf_write(sc, 21, rf | RT3070_RX_CTB);
   2814 
   2815 		/* fix Tx to Rx IQ glitch by raising RF voltage */
   2816 		rf = rt3090_rf_read(sc, 27);
   2817 		rf &= ~0x77;
   2818 		if (sc->mac_rev < 0x0211)
   2819 			rf |= 0x03;
   2820 		rt3090_rf_write(sc, 27, rf);
   2821 	}
   2822 	if (sc->patch_dac && sc->mac_rev < 0x0211) {
   2823 		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
   2824 		tmp = (tmp & ~0x1f000000) | 0x0d000000;
   2825 		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
   2826 	}
   2827 }
   2828 
   2829 static void
   2830 rt5390_rf_wakeup(struct rt2860_softc *sc)
   2831 {
   2832 	uint32_t tmp;
   2833 	uint8_t rf;
   2834 
   2835 	rf = rt3090_rf_read(sc, 1);
   2836 	rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD |
   2837 	    RT3070_TX0_PD;
   2838 	if (sc->mac_ver == 0x5392)
   2839 		rf |= RT3070_RX1_PD | RT3070_TX1_PD;
   2840 	rt3090_rf_write(sc, 1, rf);
   2841 
   2842 	rf = rt3090_rf_read(sc, 6);
   2843 	rf |= RT3593_VCO_IC | RT3593_VCOCAL;
   2844 	if (sc->mac_ver == 0x5390)
   2845 		rf &= ~RT3593_VCO_IC;
   2846 	rt3090_rf_write(sc, 6, rf);
   2847 
   2848 	rt3090_rf_write(sc, 2, rt3090_rf_read(sc, 2) | RT3593_RESCAL);
   2849 
   2850 	rf = rt3090_rf_read(sc, 22);
   2851 	rf = (rf & ~0xe0) | 0x20;
   2852 	rt3090_rf_write(sc, 22, rf);
   2853 
   2854 	rt3090_rf_write(sc, 42, rt3090_rf_read(sc, 42) | RT5390_RX_CTB);
   2855 	rt3090_rf_write(sc, 20, rt3090_rf_read(sc, 20) & ~0x77);
   2856 	rt3090_rf_write(sc, 3, rt3090_rf_read(sc, 3) | RT3593_VCOCAL);
   2857 
   2858 	if (sc->patch_dac && sc->mac_rev < 0x0211) {
   2859 		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
   2860 		tmp = (tmp & ~0x1f000000) | 0x0d000000;
   2861 		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
   2862 	}
   2863 }
   2864 
   2865 static int
   2866 rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
   2867     uint8_t *val)
   2868 {
   2869 	uint8_t rf22, rf24;
   2870 	uint8_t bbp55_pb, bbp55_sb, delta;
   2871 	int ntries;
   2872 
   2873 	/* program filter */
   2874 	rf24 = rt3090_rf_read(sc, 24);
   2875 	rf24 = (rf24 & 0xc0) | init;	/* initial filter value */
   2876 	rt3090_rf_write(sc, 24, rf24);
   2877 
   2878 	/* enable baseband loopback mode */
   2879 	rf22 = rt3090_rf_read(sc, 22);
   2880 	rt3090_rf_write(sc, 22, rf22 | RT3070_BB_LOOPBACK);
   2881 
   2882 	/* set power and frequency of passband test tone */
   2883 	rt2860_mcu_bbp_write(sc, 24, 0x00);
   2884 	for (ntries = 0; ntries < 100; ntries++) {
   2885 		/* transmit test tone */
   2886 		rt2860_mcu_bbp_write(sc, 25, 0x90);
   2887 		DELAY(1000);
   2888 		/* read received power */
   2889 		bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
   2890 		if (bbp55_pb != 0)
   2891 			break;
   2892 	}
   2893 	if (ntries == 100)
   2894 		return ETIMEDOUT;
   2895 
   2896 	/* set power and frequency of stopband test tone */
   2897 	rt2860_mcu_bbp_write(sc, 24, 0x06);
   2898 	for (ntries = 0; ntries < 100; ntries++) {
   2899 		/* transmit test tone */
   2900 		rt2860_mcu_bbp_write(sc, 25, 0x90);
   2901 		DELAY(1000);
   2902 		/* read received power */
   2903 		bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
   2904 
   2905 		delta = bbp55_pb - bbp55_sb;
   2906 		if (delta > target)
   2907 			break;
   2908 
   2909 		/* reprogram filter */
   2910 		rf24++;
   2911 		rt3090_rf_write(sc, 24, rf24);
   2912 	}
   2913 	if (ntries < 100) {
   2914 		if (rf24 != init)
   2915 			rf24--;	/* backtrack */
   2916 		*val = rf24;
   2917 		rt3090_rf_write(sc, 24, rf24);
   2918 	}
   2919 
   2920 	/* restore initial state */
   2921 	rt2860_mcu_bbp_write(sc, 24, 0x00);
   2922 
   2923 	/* disable baseband loopback mode */
   2924 	rf22 = rt3090_rf_read(sc, 22);
   2925 	rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK);
   2926 
   2927 	return 0;
   2928 }
   2929 
   2930 static void
   2931 rt3090_rf_setup(struct rt2860_softc *sc)
   2932 {
   2933 	uint8_t bbp;
   2934 	int i;
   2935 
   2936 	if (sc->mac_rev >= 0x0211) {
   2937 		/* enable DC filter */
   2938 		rt2860_mcu_bbp_write(sc, 103, 0xc0);
   2939 
   2940 		/* improve power consumption */
   2941 		bbp = rt2860_mcu_bbp_read(sc, 31);
   2942 		rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
   2943 	}
   2944 
   2945 	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
   2946 	if (sc->mac_rev < 0x0211) {
   2947 		RAL_WRITE(sc, RT2860_TX_SW_CFG2,
   2948 		    sc->patch_dac ? 0x2c : 0x0f);
   2949 	} else
   2950 		RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
   2951 
   2952 	/* initialize RF registers from ROM */
   2953 	if (sc->mac_ver < 0x5390) {
   2954 		for (i = 0; i < 10; i++) {
   2955 			if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
   2956 				continue;
   2957 			rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
   2958 		}
   2959 	}
   2960 }
   2961 
   2962 static void
   2963 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
   2964 {
   2965 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
   2966 	    which | (sc->leds & 0x7f), 0);
   2967 }
   2968 
   2969 /*
   2970  * Hardware has a general-purpose programmable timer interrupt that can
   2971  * periodically raise MAC_INT_4.
   2972  */
   2973 static void
   2974 rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
   2975 {
   2976 	uint32_t tmp;
   2977 
   2978 	/* disable GP timer before reprogramming it */
   2979 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
   2980 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN);
   2981 
   2982 	if (ms == 0)
   2983 		return;
   2984 
   2985 	tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG);
   2986 	ms *= 16;	/* Unit: 64us */
   2987 	tmp = (tmp & 0xffff) | ms << RT2860_GP_TIMER_SHIFT;
   2988 	RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp);
   2989 
   2990 	/* enable GP timer */
   2991 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
   2992 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp | RT2860_GP_TIMER_EN);
   2993 }
   2994 
   2995 static void
   2996 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
   2997 {
   2998 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,
   2999 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
   3000 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,
   3001 	    bssid[4] | bssid[5] << 8);
   3002 }
   3003 
   3004 static void
   3005 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
   3006 {
   3007 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,
   3008 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
   3009 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,
   3010 	    addr[4] | addr[5] << 8 | 0xff << 16);
   3011 }
   3012 
   3013 static void
   3014 rt2860_updateslot(struct ifnet *ifp)
   3015 {
   3016 	struct rt2860_softc *sc = ifp->if_softc;
   3017 	struct ieee80211com *ic = &sc->sc_ic;
   3018 	uint32_t tmp;
   3019 
   3020 	tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG);
   3021 	tmp &= ~0xff;
   3022 	tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
   3023 	RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
   3024 }
   3025 
   3026 static void
   3027 rt2860_updateprot(struct ieee80211com *ic)
   3028 {
   3029 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
   3030 	uint32_t tmp;
   3031 
   3032 	tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
   3033 	/* setup protection frame rate (MCS code) */
   3034 	tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
   3035 	    rt2860_rates[RT2860_RIDX_OFDM6].mcs :
   3036 	    rt2860_rates[RT2860_RIDX_CCK11].mcs;
   3037 
   3038 	/* CCK frames don't require protection */
   3039 	RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
   3040 
   3041 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
   3042 		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
   3043 			tmp |= RT2860_PROT_CTRL_RTS_CTS;
   3044 		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
   3045 			tmp |= RT2860_PROT_CTRL_CTS;
   3046 	}
   3047 	RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
   3048 }
   3049 
   3050 static void
   3051 rt2860_update_promisc(struct ifnet *ifp)
   3052 {
   3053 	struct rt2860_softc *sc = ifp->if_softc;
   3054 	uint32_t tmp;
   3055 
   3056 	tmp = RAL_READ(sc, RT2860_RX_FILTR_CFG);
   3057 	tmp &= ~RT2860_DROP_NOT_MYBSS;
   3058 	if (!(ifp->if_flags & IFF_PROMISC))
   3059 		tmp |= RT2860_DROP_NOT_MYBSS;
   3060 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
   3061 }
   3062 
   3063 static int
   3064 rt2860_updateedca(struct ieee80211com *ic)
   3065 {
   3066 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
   3067 	int aci;
   3068 
   3069 	/* update MAC TX configuration registers */
   3070 	for (aci = 0; aci < WME_NUM_AC; aci++) {
   3071 		RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),
   3072 		    ic->ic_wme.wme_params[aci].wmep_logcwmax << 16 |
   3073 		    ic->ic_wme.wme_params[aci].wmep_logcwmin << 12 |
   3074 		    ic->ic_wme.wme_params[aci].wmep_aifsn  <<  8 |
   3075 		    ic->ic_wme.wme_params[aci].wmep_txopLimit);
   3076 	}
   3077 
   3078 	/* update SCH/DMA registers too */
   3079 	RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,
   3080 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_aifsn  << 12 |
   3081 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_aifsn  <<  8 |
   3082 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_aifsn  <<  4 |
   3083 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_aifsn);
   3084 	RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,
   3085 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_logcwmin << 12 |
   3086 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_logcwmin <<  8 |
   3087 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_logcwmin <<  4 |
   3088 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_logcwmin);
   3089 	RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,
   3090 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_logcwmax << 12 |
   3091 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_logcwmax <<  8 |
   3092 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_logcwmax <<  4 |
   3093 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_logcwmax);
   3094 	RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,
   3095 	    ic->ic_wme.wme_params[WME_AC_BK].wmep_txopLimit << 16 |
   3096 	    ic->ic_wme.wme_params[WME_AC_BE].wmep_txopLimit);
   3097 	RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,
   3098 	    ic->ic_wme.wme_params[WME_AC_VO].wmep_txopLimit << 16 |
   3099 	    ic->ic_wme.wme_params[WME_AC_VI].wmep_txopLimit);
   3100 	return 0;
   3101 }
   3102 
   3103 #ifdef HW_CRYPTO
   3104 static int
   3105 rt2860_set_key(struct ieee80211com *ic, const struct ieee80211_key *ck,
   3106     const uint8_t *mac)
   3107 {
   3108 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
   3109 	struct ieee80211_node *ni = ic->ic_bss;
   3110 	bus_size_t base;
   3111 	uint32_t attr;
   3112 	uint8_t mode, wcid, iv[8];
   3113 	struct ieee80211_key *k = __UNCONST(ck); /* XXX */
   3114 
   3115 	DPRINTF(("%s: cipher %d\n", __func__, k->wk_cipher->ic_cipher));
   3116 	/* defer setting of WEP keys until interface is brought up */
   3117 	if ((ic->ic_ifp->if_flags & (IFF_UP | IFF_RUNNING)) !=
   3118 	    (IFF_UP | IFF_RUNNING)) {
   3119 		DPRINTF(("%s: not running %d\n", __func__,
   3120 		    k->wk_cipher->ic_cipher));
   3121 		return 1;
   3122 	}
   3123 	/* map net80211 cipher to RT2860 security mode */
   3124 	switch (k->wk_cipher->ic_cipher) {
   3125 	case IEEE80211_CIPHER_WEP:
   3126 		k->wk_flags |= IEEE80211_KEY_GROUP; /* XXX */
   3127 		if (k->wk_keylen == 5)
   3128 			mode = RT2860_MODE_WEP40;
   3129 		else
   3130 			mode = RT2860_MODE_WEP104;
   3131 		break;
   3132 	case IEEE80211_CIPHER_TKIP:
   3133 		mode = RT2860_MODE_TKIP;
   3134 		break;
   3135 	case IEEE80211_CIPHER_AES_CCM:
   3136 		mode = RT2860_MODE_AES_CCMP;
   3137 		break;
   3138 	default:
   3139 		DPRINTF(("%s: bad\n", __func__));
   3140 		return 0;
   3141 	}
   3142 
   3143 	if (k->wk_flags & IEEE80211_KEY_GROUP) {
   3144 		wcid = 0;	/* NB: update WCID0 for group keys */
   3145 		base = RT2860_SKEY(0, k->wk_keyix);
   3146 	} else {
   3147 		wcid = ((struct rt2860_node *)ni)->wcid;
   3148 		base = RT2860_PKEY(wcid);
   3149 	}
   3150 
   3151 	if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
   3152 		RAL_WRITE_REGION_1(sc, base, k->wk_key, 16);
   3153 #ifndef IEEE80211_STA_ONLY
   3154 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
   3155 			RAL_WRITE_REGION_1(sc, base + 16, &k->wk_key[16], 8);
   3156 			RAL_WRITE_REGION_1(sc, base + 24, &k->wk_key[24], 8);
   3157 		} else
   3158 #endif
   3159 		{
   3160 			RAL_WRITE_REGION_1(sc, base + 16, &k->wk_key[24], 8);
   3161 			RAL_WRITE_REGION_1(sc, base + 24, &k->wk_key[16], 8);
   3162 		}
   3163 	} else
   3164 		RAL_WRITE_REGION_1(sc, base, k->wk_key, k->wk_keylen);
   3165 
   3166 	if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
   3167 	    (k->wk_flags & IEEE80211_KEY_XMIT)) {
   3168 		/* set initial packet number in IV+EIV */
   3169 		if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
   3170 			uint32_t val = cprng_fast32();
   3171 			/* skip weak IVs from Fluhrer/Mantin/Shamir */
   3172 			if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
   3173 				val += 0x000100;
   3174 			iv[0] = val;
   3175 			iv[1] = val >> 8;
   3176 			iv[2] = val >> 16;
   3177 			iv[3] = k->wk_keyix << 6;
   3178 			iv[4] = iv[5] = iv[6] = iv[7] = 0;
   3179 		} else {
   3180 			if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
   3181 				iv[0] = k->wk_keytsc >> 8;
   3182 				iv[1] = (iv[0] | 0x20) & 0x7f;
   3183 				iv[2] = k->wk_keytsc;
   3184 			} else /* CCMP */ {
   3185 				iv[0] = k->wk_keytsc;
   3186 				iv[1] = k->wk_keytsc >> 8;
   3187 				iv[2] = 0;
   3188 			}
   3189 			iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
   3190 			iv[4] = k->wk_keytsc >> 16;
   3191 			iv[5] = k->wk_keytsc >> 24;
   3192 			iv[6] = k->wk_keytsc >> 32;
   3193 			iv[7] = k->wk_keytsc >> 40;
   3194 		}
   3195 		RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8);
   3196 	}
   3197 
   3198 	if (k->wk_flags & IEEE80211_KEY_GROUP) {
   3199 		/* install group key */
   3200 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
   3201 		attr &= ~(0xf << (k->wk_keyix * 4));
   3202 		attr |= mode << (k->wk_keyix * 4);
   3203 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
   3204 	} else {
   3205 		/* install pairwise key */
   3206 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
   3207 		attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
   3208 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
   3209 	}
   3210 	DPRINTF(("%s: ok\n", __func__));
   3211 	return 1;
   3212 }
   3213 
   3214 static int
   3215 rt2860_delete_key(struct ieee80211com *ic, const struct ieee80211_key *k)
   3216 {
   3217 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
   3218 	struct ieee80211_node *ni = ic->ic_bss;
   3219 	uint32_t attr;
   3220 	uint8_t wcid;
   3221 
   3222 	if (k->wk_flags & IEEE80211_KEY_GROUP) {
   3223 		/* remove group key */
   3224 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
   3225 		attr &= ~(0xf << (k->wk_keyix * 4));
   3226 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
   3227 
   3228 	} else {
   3229 		/* remove pairwise key */
   3230 		wcid = ((struct rt2860_node *)ni)->wcid;
   3231 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
   3232 		attr &= ~0xf;
   3233 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
   3234 	}
   3235 	return 1;
   3236 }
   3237 #endif
   3238 
   3239 static int8_t
   3240 rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
   3241 {
   3242 	struct ieee80211com *ic = &sc->sc_ic;
   3243 	struct ieee80211_channel *c = ic->ic_curchan;
   3244 	int delta;
   3245 
   3246 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
   3247 		u_int chan = ieee80211_chan2ieee(ic, c);
   3248 		delta = sc->rssi_5ghz[rxchain];
   3249 
   3250 		/* determine channel group */
   3251 		if (chan <= 64)
   3252 			delta -= sc->lna[1];
   3253 		else if (chan <= 128)
   3254 			delta -= sc->lna[2];
   3255 		else
   3256 			delta -= sc->lna[3];
   3257 	} else
   3258 		delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
   3259 
   3260 	return -12 - delta - rssi;
   3261 }
   3262 
   3263 /*
   3264  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
   3265  * Used to adjust per-rate Tx power registers.
   3266  */
   3267 static __inline uint32_t
   3268 b4inc(uint32_t b32, int8_t delta)
   3269 {
   3270 	int8_t i, b4;
   3271 
   3272 	for (i = 0; i < 8; i++) {
   3273 		b4 = b32 & 0xf;
   3274 		b4 += delta;
   3275 		if (b4 < 0)
   3276 			b4 = 0;
   3277 		else if (b4 > 0xf)
   3278 			b4 = 0xf;
   3279 		b32 = b32 >> 4 | (uint32_t)b4 << 28;
   3280 	}
   3281 	return b32;
   3282 }
   3283 
   3284 static const char *
   3285 rt2860_get_rf(uint32_t rev)
   3286 {
   3287 	switch (rev) {
   3288 	case RT2860_RF_2820:	return "RT2820";
   3289 	case RT2860_RF_2850:	return "RT2850";
   3290 	case RT2860_RF_2720:	return "RT2720";
   3291 	case RT2860_RF_2750:	return "RT2750";
   3292 	case RT3070_RF_3020:	return "RT3020";
   3293 	case RT3070_RF_2020:	return "RT2020";
   3294 	case RT3070_RF_3021:	return "RT3021";
   3295 	case RT3070_RF_3022:	return "RT3022";
   3296 	case RT3070_RF_3052:	return "RT3052";
   3297 	case RT3070_RF_3320:	return "RT3320";
   3298 	case RT3070_RF_3053:	return "RT3053";
   3299 	case RT5390_RF_5360:	return "RT5360";
   3300 	case RT5390_RF_5390:	return "RT5390";
   3301 	case RT5390_RF_5392:	return "RT5392";
   3302 	default:		return "unknown";
   3303 	}
   3304 }
   3305 
   3306 static int
   3307 rt2860_read_eeprom(struct rt2860_softc *sc)
   3308 {
   3309 	struct ieee80211com *ic = &sc->sc_ic;
   3310 	int8_t delta_2ghz, delta_5ghz;
   3311 	uint32_t tmp;
   3312 	uint16_t val;
   3313 	int ridx, ant, i;
   3314 
   3315 	/* check whether the ROM is eFUSE ROM or EEPROM */
   3316 	sc->sc_srom_read = rt2860_eeprom_read_2;
   3317 	if (sc->mac_ver >= 0x3071) {
   3318 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
   3319 		DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
   3320 		if (tmp & RT3070_SEL_EFUSE)
   3321 			sc->sc_srom_read = rt3090_efuse_read_2;
   3322 	}
   3323 
   3324 #ifdef RAL_DEBUG
   3325 	/* read EEPROM version */
   3326 	val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION);
   3327 	DPRINTF(("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8));
   3328 #endif
   3329 
   3330 	/* read MAC address */
   3331 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC01);
   3332 	ic->ic_myaddr[0] = val & 0xff;
   3333 	ic->ic_myaddr[1] = val >> 8;
   3334 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC23);
   3335 	ic->ic_myaddr[2] = val & 0xff;
   3336 	ic->ic_myaddr[3] = val >> 8;
   3337 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC45);
   3338 	ic->ic_myaddr[4] = val & 0xff;
   3339 	ic->ic_myaddr[5] = val >> 8;
   3340 
   3341 #ifdef RAL_DEBUG
   3342 	/* read country code */
   3343 	val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY);
   3344 	DPRINTF(("EEPROM region code=0x%04x\n", val));
   3345 #endif
   3346 
   3347 	/* read vendor BBP settings */
   3348 	for (i = 0; i < 8; i++) {
   3349 		val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE + i);
   3350 		sc->bbp[i].val = val & 0xff;
   3351 		sc->bbp[i].reg = val >> 8;
   3352 		DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
   3353 	}
   3354 	if (sc->mac_ver >= 0x3071) {
   3355 		/* read vendor RF settings */
   3356 		for (i = 0; i < 10; i++) {
   3357 			val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE + i);
   3358 			sc->rf[i].val = val & 0xff;
   3359 			sc->rf[i].reg = val >> 8;
   3360 			DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
   3361 			    sc->rf[i].val));
   3362 		}
   3363 	}
   3364 
   3365 	/* read RF frequency offset from EEPROM */
   3366 	val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS);
   3367 	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
   3368 	DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
   3369 	if ((val >> 8) != 0xff) {
   3370 		/* read LEDs operating mode */
   3371 		sc->leds = val >> 8;
   3372 		sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED1);
   3373 		sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED2);
   3374 		sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED3);
   3375 	} else {
   3376 		/* broken EEPROM, use default settings */
   3377 		sc->leds = 0x01;
   3378 		sc->led[0] = 0x5555;
   3379 		sc->led[1] = 0x2221;
   3380 		sc->led[2] = 0xa9f8;
   3381 	}
   3382 	DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
   3383 	    sc->leds, sc->led[0], sc->led[1], sc->led[2]));
   3384 
   3385 	/* read RF information */
   3386 	val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA);
   3387 	if (sc->mac_ver >= 0x5390)
   3388 		sc->rf_rev = rt2860_srom_read(sc, RT2860_EEPROM_CHIPID);
   3389 	else
   3390 		sc->rf_rev = (val >> 8) & 0xf;
   3391 	sc->ntxchains = (val >> 4) & 0xf;
   3392 	sc->nrxchains = val & 0xf;
   3393 	DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
   3394 	    sc->rf_rev, sc->ntxchains, sc->nrxchains));
   3395 
   3396 	/* check if RF supports automatic Tx access gain control */
   3397 	val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG);
   3398 	DPRINTF(("EEPROM CFG 0x%04x\n", val));
   3399 	/* check if driver should patch the DAC issue */
   3400 	if ((val >> 8) != 0xff)
   3401 		sc->patch_dac = (val >> 15) & 1;
   3402 	if ((val & 0xff) != 0xff) {
   3403 		sc->ext_5ghz_lna = (val >> 3) & 1;
   3404 		sc->ext_2ghz_lna = (val >> 2) & 1;
   3405 		/* check if RF supports automatic Tx access gain control */
   3406 		sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */
   3407 		/* check if we have a hardware radio switch */
   3408 		sc->rfswitch = val & 1;
   3409 	}
   3410 	if (sc->sc_flags & RT2860_ADVANCED_PS) {
   3411 		/* read PCIe power save level */
   3412 		val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
   3413 		if ((val & 0xff) != 0xff) {
   3414 			sc->pslevel = val & 0x3;
   3415 			val = rt2860_srom_read(sc, RT2860_EEPROM_REV);
   3416 			if ((val & 0xff80) != 0x9280)
   3417 				sc->pslevel = MIN(sc->pslevel, 1);
   3418 			DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
   3419 		}
   3420 	}
   3421 
   3422 	/* read power settings for 2GHz channels */
   3423 	for (i = 0; i < 14; i += 2) {
   3424 		val = rt2860_srom_read(sc,
   3425 		    RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
   3426 		sc->txpow1[i + 0] = (int8_t)(val & 0xff);
   3427 		sc->txpow1[i + 1] = (int8_t)(val >> 8);
   3428 
   3429 		if (sc->mac_ver != 0x5390) {
   3430 			val = rt2860_srom_read(sc,
   3431 			    RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
   3432 			sc->txpow2[i + 0] = (int8_t)(val & 0xff);
   3433 			sc->txpow2[i + 1] = (int8_t)(val >> 8);
   3434 		}
   3435 	    }
   3436 	/* fix broken Tx power entries */
   3437 	for (i = 0; i < 14; i++) {
   3438 		if (sc->txpow1[i] < 0 ||
   3439 		    sc->txpow1[i] > ((sc->mac_ver >= 0x5390) ? 39 : 31))
   3440 			sc->txpow1[i] = 5;
   3441 		if (sc->mac_ver != 0x5390) {
   3442 			if (sc->txpow2[i] < 0 ||
   3443 			    sc->txpow2[i] > ((sc->mac_ver >= 0x5392) ? 39 : 31))
   3444 				sc->txpow2[i] = 5;
   3445 		}
   3446 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
   3447 		    rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
   3448 	}
   3449 	/* read power settings for 5GHz channels */
   3450 	for (i = 0; i < 40; i += 2) {
   3451 		val = rt2860_srom_read(sc,
   3452 		    RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
   3453 		sc->txpow1[i + 14] = (int8_t)(val & 0xff);
   3454 		sc->txpow1[i + 15] = (int8_t)(val >> 8);
   3455 
   3456 		val = rt2860_srom_read(sc,
   3457 		    RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
   3458 		sc->txpow2[i + 14] = (int8_t)(val & 0xff);
   3459 		sc->txpow2[i + 15] = (int8_t)(val >> 8);
   3460 	}
   3461 	/* fix broken Tx power entries */
   3462 	for (i = 0; i < 40; i++) {
   3463 		if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
   3464 			sc->txpow1[14 + i] = 5;
   3465 		if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
   3466 			sc->txpow2[14 + i] = 5;
   3467 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
   3468 		    rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
   3469 		    sc->txpow2[14 + i]));
   3470 	}
   3471 
   3472 	/* read Tx power compensation for each Tx rate */
   3473 	val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR);
   3474 	delta_2ghz = delta_5ghz = 0;
   3475 	if ((val & 0xff) != 0xff && (val & 0x80)) {
   3476 		delta_2ghz = val & 0xf;
   3477 		if (!(val & 0x40))	/* negative number */
   3478 			delta_2ghz = -delta_2ghz;
   3479 	}
   3480 	val >>= 8;
   3481 	if ((val & 0xff) != 0xff && (val & 0x80)) {
   3482 		delta_5ghz = val & 0xf;
   3483 		if (!(val & 0x40))	/* negative number */
   3484 			delta_5ghz = -delta_5ghz;
   3485 	}
   3486 	DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
   3487 	    delta_2ghz, delta_5ghz));
   3488 
   3489 	for (ridx = 0; ridx < 5; ridx++) {
   3490 		uint32_t reg;
   3491 
   3492 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2);
   3493 		reg = val;
   3494 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1);
   3495 		reg |= (uint32_t)val << 16;
   3496 
   3497 		sc->txpow20mhz[ridx] = reg;
   3498 		sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
   3499 		sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
   3500 
   3501 		DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
   3502 		    "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
   3503 		    sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
   3504 	}
   3505 
   3506 	/* read factory-calibrated samples for temperature compensation */
   3507 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
   3508 	sc->tssi_2ghz[0] = val & 0xff;	/* [-4] */
   3509 	sc->tssi_2ghz[1] = val >> 8;	/* [-3] */
   3510 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
   3511 	sc->tssi_2ghz[2] = val & 0xff;	/* [-2] */
   3512 	sc->tssi_2ghz[3] = val >> 8;	/* [-1] */
   3513 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
   3514 	sc->tssi_2ghz[4] = val & 0xff;	/* [+0] */
   3515 	sc->tssi_2ghz[5] = val >> 8;	/* [+1] */
   3516 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
   3517 	sc->tssi_2ghz[6] = val & 0xff;	/* [+2] */
   3518 	sc->tssi_2ghz[7] = val >> 8;	/* [+3] */
   3519 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
   3520 	sc->tssi_2ghz[8] = val & 0xff;	/* [+4] */
   3521 	sc->step_2ghz = val >> 8;
   3522 	DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
   3523 	    "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
   3524 	    sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
   3525 	    sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
   3526 	    sc->tssi_2ghz[8], sc->step_2ghz));
   3527 	/* check that ref value is correct, otherwise disable calibration */
   3528 	if (sc->tssi_2ghz[4] == 0xff)
   3529 		sc->calib_2ghz = 0;
   3530 
   3531 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
   3532 	sc->tssi_5ghz[0] = val & 0xff;	/* [-4] */
   3533 	sc->tssi_5ghz[1] = val >> 8;	/* [-3] */
   3534 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
   3535 	sc->tssi_5ghz[2] = val & 0xff;	/* [-2] */
   3536 	sc->tssi_5ghz[3] = val >> 8;	/* [-1] */
   3537 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
   3538 	sc->tssi_5ghz[4] = val & 0xff;	/* [+0] */
   3539 	sc->tssi_5ghz[5] = val >> 8;	/* [+1] */
   3540 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
   3541 	sc->tssi_5ghz[6] = val & 0xff;	/* [+2] */
   3542 	sc->tssi_5ghz[7] = val >> 8;	/* [+3] */
   3543 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
   3544 	sc->tssi_5ghz[8] = val & 0xff;	/* [+4] */
   3545 	sc->step_5ghz = val >> 8;
   3546 	DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
   3547 	    "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
   3548 	    sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
   3549 	    sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
   3550 	    sc->tssi_5ghz[8], sc->step_5ghz));
   3551 	/* check that ref value is correct, otherwise disable calibration */
   3552 	if (sc->tssi_5ghz[4] == 0xff)
   3553 		sc->calib_5ghz = 0;
   3554 
   3555 	/* read RSSI offsets and LNA gains from EEPROM */
   3556 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
   3557 	sc->rssi_2ghz[0] = val & 0xff;	/* Ant A */
   3558 	sc->rssi_2ghz[1] = val >> 8;	/* Ant B */
   3559 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
   3560 	if (sc->mac_ver >= 0x3071) {
   3561 		/*
   3562 		 * On RT3090 chips (limited to 2 Rx chains), this ROM
   3563 		 * field contains the Tx mixer gain for the 2GHz band.
   3564 		 */
   3565 		if ((val & 0xff) != 0xff)
   3566 			sc->txmixgain_2ghz = val & 0x7;
   3567 		DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
   3568 	} else
   3569 		sc->rssi_2ghz[2] = val & 0xff;	/* Ant C */
   3570 	sc->lna[2] = val >> 8;		/* channel group 2 */
   3571 
   3572 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
   3573 	sc->rssi_5ghz[0] = val & 0xff;	/* Ant A */
   3574 	sc->rssi_5ghz[1] = val >> 8;	/* Ant B */
   3575 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
   3576 	sc->rssi_5ghz[2] = val & 0xff;	/* Ant C */
   3577 	sc->lna[3] = val >> 8;		/* channel group 3 */
   3578 
   3579 	val = rt2860_srom_read(sc, RT2860_EEPROM_LNA);
   3580 	if (sc->mac_ver >= 0x3071)
   3581 		sc->lna[0] = RT3090_DEF_LNA;
   3582 	else				/* channel group 0 */
   3583 		sc->lna[0] = val & 0xff;
   3584 	sc->lna[1] = val >> 8;		/* channel group 1 */
   3585 
   3586 	/* fix broken 5GHz LNA entries */
   3587 	if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
   3588 		DPRINTF(("invalid LNA for channel group %d\n", 2));
   3589 		sc->lna[2] = sc->lna[1];
   3590 	}
   3591 	if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
   3592 		DPRINTF(("invalid LNA for channel group %d\n", 3));
   3593 		sc->lna[3] = sc->lna[1];
   3594 	}
   3595 
   3596 	/* fix broken RSSI offset entries */
   3597 	for (ant = 0; ant < 3; ant++) {
   3598 		if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
   3599 			DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
   3600 			    ant + 1, sc->rssi_2ghz[ant]));
   3601 			sc->rssi_2ghz[ant] = 0;
   3602 		}
   3603 		if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
   3604 			DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
   3605 			    ant + 1, sc->rssi_5ghz[ant]));
   3606 			sc->rssi_5ghz[ant] = 0;
   3607 		}
   3608 	}
   3609 
   3610 	return 0;
   3611 }
   3612 
   3613 static int
   3614 rt2860_bbp_init(struct rt2860_softc *sc)
   3615 {
   3616 	int i, ntries;
   3617 
   3618 	/* wait for BBP to wake up */
   3619 	for (ntries = 0; ntries < 20; ntries++) {
   3620 		uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
   3621 		if (bbp0 != 0 && bbp0 != 0xff)
   3622 			break;
   3623 	}
   3624 	if (ntries == 20) {
   3625 		aprint_error_dev(sc->sc_dev,
   3626 		    "timeout waiting for BBP to wake up\n");
   3627 		return ETIMEDOUT;
   3628 	}
   3629 
   3630 	/* initialize BBP registers to default values */
   3631 	if (sc->mac_ver >= 0x5390)
   3632 		rt5390_bbp_init(sc);
   3633 	else {
   3634 		for (i = 0; i < (int)__arraycount(rt2860_def_bbp); i++) {
   3635 			rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
   3636 			    rt2860_def_bbp[i].val);
   3637 		}
   3638 	}
   3639 
   3640 	/* fix BBP84 for RT2860E */
   3641 	if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
   3642 		rt2860_mcu_bbp_write(sc, 84, 0x19);
   3643 
   3644 	if (sc->mac_ver >= 0x3071) {
   3645 		rt2860_mcu_bbp_write(sc, 79, 0x13);
   3646 		rt2860_mcu_bbp_write(sc, 80, 0x05);
   3647 		rt2860_mcu_bbp_write(sc, 81, 0x33);
   3648 	} else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
   3649 		rt2860_mcu_bbp_write(sc, 69, 0x16);
   3650 		rt2860_mcu_bbp_write(sc, 73, 0x12);
   3651 	}
   3652 
   3653 	return 0;
   3654 }
   3655 
   3656 static int
   3657 rt5390_bbp_init(struct rt2860_softc *sc)
   3658 {
   3659 	uint8_t bbp;
   3660 	int i;
   3661 
   3662 	/* Apply maximum likelihood detection for 2 stream case. */
   3663 	if (sc->nrxchains > 1) {
   3664 		bbp = rt2860_mcu_bbp_read(sc, 105);
   3665 		rt2860_mcu_bbp_write(sc, 105, bbp | RT5390_MLD);
   3666 	}
   3667 
   3668 	/* Avoid data lost and CRC error. */
   3669 	bbp = rt2860_mcu_bbp_read(sc, 4);
   3670 	rt2860_mcu_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
   3671 
   3672 	for (i = 0; i < __arraycount(rt5390_def_bbp); i++) {
   3673 		rt2860_mcu_bbp_write(sc, rt5390_def_bbp[i].reg,
   3674 		    rt5390_def_bbp[i].val);
   3675 	}
   3676 
   3677 	if (sc->mac_ver == 0x5392) {
   3678 		rt2860_mcu_bbp_write(sc, 84, 0x9a);
   3679 		rt2860_mcu_bbp_write(sc, 95, 0x9a);
   3680 		rt2860_mcu_bbp_write(sc, 98, 0x12);
   3681 		rt2860_mcu_bbp_write(sc, 106, 0x05);
   3682 		rt2860_mcu_bbp_write(sc, 134, 0xd0);
   3683 		rt2860_mcu_bbp_write(sc, 135, 0xf6);
   3684 	}
   3685 
   3686 	bbp = rt2860_mcu_bbp_read(sc, 152);
   3687 	rt2860_mcu_bbp_write(sc, 152, bbp | 0x80);
   3688 
   3689 	/* Disable hardware antenna diversity. */
   3690 	if (sc->mac_ver == 0x5390)
   3691 		rt2860_mcu_bbp_write(sc, 154, 0);
   3692 
   3693 	return 0;
   3694 }
   3695 
   3696 static int
   3697 rt2860_txrx_enable(struct rt2860_softc *sc)
   3698 {
   3699 	uint32_t tmp;
   3700 	int ntries;
   3701 
   3702 	/* enable Tx/Rx DMA engine */
   3703 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
   3704 	RAL_BARRIER_READ_WRITE(sc);
   3705 	for (ntries = 0; ntries < 200; ntries++) {
   3706 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
   3707 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
   3708 			break;
   3709 		DELAY(1000);
   3710 	}
   3711 	if (ntries == 200) {
   3712 		aprint_error_dev(sc->sc_dev,
   3713 		    "timeout waiting for DMA engine\n");
   3714 		return ETIMEDOUT;
   3715 	}
   3716 
   3717 	DELAY(50);
   3718 
   3719 	tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
   3720 	    RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
   3721 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
   3722 
   3723 	/* set Rx filter */
   3724 	tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
   3725 	if (sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR) {
   3726 		tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
   3727 		    RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
   3728 		    RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
   3729 		    RT2860_DROP_CFACK | RT2860_DROP_CFEND;
   3730 		if (sc->sc_ic.ic_opmode == IEEE80211_M_STA)
   3731 			tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
   3732 	}
   3733 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
   3734 
   3735 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
   3736 	    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
   3737 
   3738 	return 0;
   3739 }
   3740 
   3741 static int
   3742 rt2860_init(struct ifnet *ifp)
   3743 {
   3744 	struct rt2860_softc *sc = ifp->if_softc;
   3745 	struct ieee80211com *ic = &sc->sc_ic;
   3746 	uint32_t tmp;
   3747 	uint8_t bbp1, bbp3;
   3748 	int i, qid, ridx, ntries, error;
   3749 
   3750 	/* for CardBus, power on the socket */
   3751 	if (!(sc->sc_flags & RT2860_ENABLED)) {
   3752 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
   3753 			aprint_error_dev(sc->sc_dev,
   3754 			    "could not enable device\n");
   3755 			return EIO;
   3756 		}
   3757 		sc->sc_flags |= RT2860_ENABLED;
   3758 	}
   3759 
   3760 	if (sc->rfswitch) {
   3761 		/* hardware has a radio switch on GPIO pin 2 */
   3762 		if (!(RAL_READ(sc, RT2860_GPIO_CTRL) & (1 << 2))) {
   3763 			aprint_normal_dev(sc->sc_dev,
   3764 			    "radio is disabled by hardware switch\n");
   3765 #ifdef notyet
   3766 			rt2860_stop(ifp, 1);
   3767 			return EPERM;
   3768 #endif
   3769 		}
   3770 	}
   3771 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE);
   3772 
   3773 	/* disable DMA */
   3774 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
   3775 	tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
   3776 	    RT2860_TX_DMA_EN);
   3777 	tmp |= RT2860_TX_WB_DDONE;
   3778 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
   3779 
   3780 	/* reset DMA indexes */
   3781 	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, RT2860_RST_DRX_IDX0 |
   3782 	    RT2860_RST_DTX_IDX5 | RT2860_RST_DTX_IDX4 | RT2860_RST_DTX_IDX3 |
   3783 	    RT2860_RST_DTX_IDX2 | RT2860_RST_DTX_IDX1 | RT2860_RST_DTX_IDX0);
   3784 
   3785 	/* PBF hardware reset */
   3786 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
   3787 	RAL_BARRIER_WRITE(sc);
   3788 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
   3789 
   3790 	if ((error = rt2860_load_microcode(sc)) != 0) {
   3791 		aprint_error_dev(sc->sc_dev,
   3792 		    "could not load 8051 microcode\n");
   3793 		rt2860_stop(ifp, 1);
   3794 		return error;
   3795 	}
   3796 
   3797 	IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
   3798 	rt2860_set_macaddr(sc, ic->ic_myaddr);
   3799 
   3800 	/* init Tx power for all Tx rates (from EEPROM) */
   3801 	for (ridx = 0; ridx < 5; ridx++) {
   3802 		if (sc->txpow20mhz[ridx] == 0xffffffff)
   3803 			continue;
   3804 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
   3805 	}
   3806 
   3807 	for (ntries = 0; ntries < 100; ntries++) {
   3808 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
   3809 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
   3810 			break;
   3811 		DELAY(1000);
   3812 	}
   3813 	if (ntries == 100) {
   3814 		aprint_error_dev(sc->sc_dev,
   3815 		    "timeout waiting for DMA engine\n");
   3816 		rt2860_stop(ifp, 1);
   3817 		return ETIMEDOUT;
   3818 	}
   3819 	tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
   3820 	    RT2860_TX_DMA_EN);
   3821 	tmp |= RT2860_TX_WB_DDONE;
   3822 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
   3823 
   3824 	/* reset Rx ring and all 6 Tx rings */
   3825 	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
   3826 
   3827 	/* PBF hardware reset */
   3828 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
   3829 	RAL_BARRIER_WRITE(sc);
   3830 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
   3831 
   3832 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE | RT2860_IO_RF_PE);
   3833 
   3834 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
   3835 	RAL_BARRIER_WRITE(sc);
   3836 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
   3837 
   3838 	for (i = 0; i < (int)__arraycount(rt2860_def_mac); i++)
   3839 		RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
   3840 	if (sc->mac_ver >= 0x5390)
   3841 		RAL_WRITE(sc, RT2860_TX_SW_CFG0, 0x00000404);
   3842 	else if (sc->mac_ver >= 0x3071) {
   3843 		/* set delay of PA_PE assertion to 1us (unit of 0.25us) */
   3844 		RAL_WRITE(sc, RT2860_TX_SW_CFG0,
   3845 		    4 << RT2860_DLY_PAPE_EN_SHIFT);
   3846 	}
   3847 
   3848 	if (!(RAL_READ(sc, RT2860_PCI_CFG) & RT2860_PCI_CFG_PCI)) {
   3849 		sc->sc_flags |= RT2860_PCIE;
   3850 		/* PCIe has different clock cycle count than PCI */
   3851 		tmp = RAL_READ(sc, RT2860_US_CYC_CNT);
   3852 		tmp = (tmp & ~0xff) | 0x7d;
   3853 		RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp);
   3854 	}
   3855 
   3856 	/* wait while MAC is busy */
   3857 	for (ntries = 0; ntries < 100; ntries++) {
   3858 		if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG) &
   3859 		    (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
   3860 			break;
   3861 		DELAY(1000);
   3862 	}
   3863 	if (ntries == 100) {
   3864 		aprint_error_dev(sc->sc_dev, "timeout waiting for MAC\n");
   3865 		rt2860_stop(ifp, 1);
   3866 		return ETIMEDOUT;
   3867 	}
   3868 
   3869 	/* clear Host to MCU mailbox */
   3870 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
   3871 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
   3872 
   3873 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
   3874 	DELAY(1000);
   3875 
   3876 	if ((error = rt2860_bbp_init(sc)) != 0) {
   3877 		rt2860_stop(ifp, 1);
   3878 		return error;
   3879 	}
   3880 
   3881 	/* clear RX WCID search table */
   3882 	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
   3883 	/* clear pairwise key table */
   3884 	RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048);
   3885 	/* clear IV/EIV table */
   3886 	RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512);
   3887 	/* clear WCID attribute table */
   3888 	RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256);
   3889 	/* clear shared key table */
   3890 	RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
   3891 	/* clear shared key mode */
   3892 	RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
   3893 
   3894 	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
   3895 	for (qid = 0; qid < MAXQS; qid++) {
   3896 		RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
   3897 		RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
   3898 		RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
   3899 	}
   3900 
   3901 	/* init Rx ring */
   3902 	RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
   3903 	RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
   3904 	RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
   3905 
   3906 	/* setup maximum buffer sizes */
   3907 	RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
   3908 	    (MCLBYTES - sizeof (struct rt2860_rxwi) - 2));
   3909 
   3910 	for (ntries = 0; ntries < 100; ntries++) {
   3911 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
   3912 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
   3913 			break;
   3914 		DELAY(1000);
   3915 	}
   3916 	if (ntries == 100) {
   3917 		aprint_error_dev(sc->sc_dev,
   3918 		    "timeout waiting for DMA engine\n");
   3919 		rt2860_stop(ifp, 1);
   3920 		return ETIMEDOUT;
   3921 	}
   3922 	tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
   3923 	    RT2860_TX_DMA_EN);
   3924 	tmp |= RT2860_TX_WB_DDONE;
   3925 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
   3926 
   3927 	/* disable interrupts mitigation */
   3928 	RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
   3929 
   3930 	/* write vendor-specific BBP values (from EEPROM) */
   3931 	for (i = 0; i < 8; i++) {
   3932 		if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
   3933 			continue;
   3934 		rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
   3935 	}
   3936 
   3937 	/* select Main antenna for 1T1R devices */
   3938 	if (sc->rf_rev == RT3070_RF_2020 ||
   3939 	    sc->rf_rev == RT3070_RF_3020 ||
   3940 	    sc->rf_rev == RT3070_RF_3320 ||
   3941 	    sc->rf_rev == RT5390_RF_5390)
   3942 		rt3090_set_rx_antenna(sc, 0);
   3943 
   3944 	/* send LEDs operating mode to microcontroller */
   3945 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0], 0);
   3946 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1], 0);
   3947 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2], 0);
   3948 
   3949 	if (sc->mac_ver >= 0x5390)
   3950 		rt5390_rf_init(sc);
   3951 	else if (sc->mac_ver >= 0x3071)
   3952 		rt3090_rf_init(sc);
   3953 
   3954 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP, 0x02ff, 1);
   3955 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP, 0, 1);
   3956 
   3957 	if (sc->mac_ver >= 0x5390)
   3958 		rt5390_rf_wakeup(sc);
   3959 	else if (sc->mac_ver >= 0x3071)
   3960 		rt3090_rf_wakeup(sc);
   3961 
   3962 	/* disable non-existing Rx chains */
   3963 	bbp3 = rt2860_mcu_bbp_read(sc, 3);
   3964 	bbp3 &= ~(1 << 3 | 1 << 4);
   3965 	if (sc->nrxchains == 2)
   3966 		bbp3 |= 1 << 3;
   3967 	else if (sc->nrxchains == 3)
   3968 		bbp3 |= 1 << 4;
   3969 	rt2860_mcu_bbp_write(sc, 3, bbp3);
   3970 
   3971 	/* disable non-existing Tx chains */
   3972 	bbp1 = rt2860_mcu_bbp_read(sc, 1);
   3973 	if (sc->ntxchains == 1)
   3974 		bbp1 = (bbp1 & ~(1 << 3 | 1 << 4));
   3975 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
   3976 		bbp1 = (bbp1 & ~(1 << 4)) | 1 << 3;
   3977 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
   3978 		bbp1 = (bbp1 & ~(1 << 3)) | 1 << 4;
   3979 	rt2860_mcu_bbp_write(sc, 1, bbp1);
   3980 
   3981 	if (sc->mac_ver >= 0x3071)
   3982 		rt3090_rf_setup(sc);
   3983 
   3984 	/* select default channel */
   3985 	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
   3986 	rt2860_switch_chan(sc, ic->ic_ibss_chan);
   3987 
   3988 	/* reset RF from MCU */
   3989 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
   3990 
   3991 	/* set RTS threshold */
   3992 	tmp = RAL_READ(sc, RT2860_TX_RTS_CFG);
   3993 	tmp &= ~0xffff00;
   3994 	tmp |= ic->ic_rtsthreshold << 8;
   3995 	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);
   3996 
   3997 	/* setup initial protection mode */
   3998 	sc->sc_ic_flags = ic->ic_flags;
   3999 	rt2860_updateprot(ic);
   4000 
   4001 	/* turn radio LED on */
   4002 	rt2860_set_leds(sc, RT2860_LED_RADIO);
   4003 
   4004 	/* enable Tx/Rx DMA engine */
   4005 	if ((error = rt2860_txrx_enable(sc)) != 0) {
   4006 		rt2860_stop(ifp, 1);
   4007 		return error;
   4008 	}
   4009 
   4010 	/* clear pending interrupts */
   4011 	RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
   4012 	/* enable interrupts */
   4013 	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
   4014 
   4015 	if (sc->sc_flags & RT2860_ADVANCED_PS)
   4016 		rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);
   4017 
   4018 	ifp->if_flags |= IFF_RUNNING;
   4019 	ifp->if_flags &= ~IFF_OACTIVE;
   4020 
   4021 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
   4022 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
   4023 	else
   4024 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
   4025 
   4026 	return 0;
   4027 }
   4028 
   4029 static void
   4030 rt2860_stop(struct ifnet *ifp, int disable)
   4031 {
   4032 	struct rt2860_softc *sc = ifp->if_softc;
   4033 	struct ieee80211com *ic = &sc->sc_ic;
   4034 	uint32_t tmp;
   4035 	int qid;
   4036 
   4037 	if (ifp->if_flags & IFF_RUNNING)
   4038 		rt2860_set_leds(sc, 0);	/* turn all LEDs off */
   4039 
   4040 	sc->sc_tx_timer = 0;
   4041 	ifp->if_timer = 0;
   4042 	ifp->if_flags &= ~IFF_RUNNING;
   4043 	ifp->if_flags &= ~IFF_OACTIVE;
   4044 
   4045 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
   4046 
   4047 	/* disable interrupts */
   4048 	RAL_WRITE(sc, RT2860_INT_MASK, 0);
   4049 
   4050 	/* disable GP timer */
   4051 	rt2860_set_gp_timer(sc, 0);
   4052 
   4053 	/* disable Rx */
   4054 	tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL);
   4055 	tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
   4056 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
   4057 
   4058 	/* reset adapter */
   4059 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
   4060 	RAL_BARRIER_WRITE(sc);
   4061 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
   4062 
   4063 	/* reset Tx and Rx rings (and reclaim TXWIs) */
   4064 	sc->qfullmsk = 0;
   4065 	for (qid = 0; qid < MAXQS; qid++)
   4066 		rt2860_reset_tx_ring(sc, &sc->txq[qid]);
   4067 	rt2860_reset_rx_ring(sc, &sc->rxq);
   4068 
   4069 	/* for CardBus, power down the socket */
   4070 	if (disable && sc->sc_disable != NULL) {
   4071 		if (sc->sc_flags & RT2860_ENABLED) {
   4072 			(*sc->sc_disable)(sc);
   4073 			sc->sc_flags &= ~RT2860_ENABLED;
   4074 		}
   4075 	}
   4076 }
   4077 
   4078 static int
   4079 rt2860_load_microcode(struct rt2860_softc *sc)
   4080 {
   4081 	int ntries;
   4082 
   4083 	/* set "host program ram write selection" bit */
   4084 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
   4085 	/* write microcode image */
   4086 	RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, sc->ucode, sc->ucsize);
   4087 	/* kick microcontroller unit */
   4088 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0);
   4089 	RAL_BARRIER_WRITE(sc);
   4090 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
   4091 
   4092 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
   4093 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
   4094 
   4095 	/* wait until microcontroller is ready */
   4096 	RAL_BARRIER_READ_WRITE(sc);
   4097 	for (ntries = 0; ntries < 1000; ntries++) {
   4098 		if (RAL_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
   4099 			break;
   4100 		DELAY(1000);
   4101 	}
   4102 	if (ntries == 1000) {
   4103 		aprint_error_dev(sc->sc_dev,
   4104 		    "timeout waiting for MCU to initialize\n");
   4105 		return ETIMEDOUT;
   4106 	}
   4107 	return 0;
   4108 }
   4109 
   4110 #if 0
   4111 /*
   4112  * This function is called periodically to adjust Tx power based on
   4113  * temperature variation.
   4114  */
   4115 static void
   4116 rt2860_calib(struct rt2860_softc *sc)
   4117 {
   4118 	struct ieee80211com *ic = &sc->sc_ic;
   4119 	const uint8_t *tssi;
   4120 	uint8_t step, bbp49;
   4121 	int8_t ridx, d;
   4122 
   4123 	/* read current temperature */
   4124 	bbp49 = rt2860_mcu_bbp_read(sc, 49);
   4125 
   4126 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)) {
   4127 		tssi = &sc->tssi_2ghz[4];
   4128 		step = sc->step_2ghz;
   4129 	} else {
   4130 		tssi = &sc->tssi_5ghz[4];
   4131 		step = sc->step_5ghz;
   4132 	}
   4133 
   4134 	if (bbp49 < tssi[0]) {		/* lower than reference */
   4135 		/* use higher Tx power than default */
   4136 		for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
   4137 	} else if (bbp49 > tssi[0]) {	/* greater than reference */
   4138 		/* use lower Tx power than default */
   4139 		for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
   4140 	} else {
   4141 		/* use default Tx power */
   4142 		d = 0;
   4143 	}
   4144 	d *= step;
   4145 
   4146 	DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
   4147 
   4148 	/* write adjusted Tx power values for each Tx rate */
   4149 	for (ridx = 0; ridx < 5; ridx++) {
   4150 		if (sc->txpow20mhz[ridx] == 0xffffffff)
   4151 			continue;
   4152 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),
   4153 		    b4inc(sc->txpow20mhz[ridx], d));
   4154 	}
   4155 }
   4156 #endif /* 0 */
   4157 
   4158 static void
   4159 rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
   4160 {
   4161 	uint32_t tmp;
   4162 
   4163 	if (aux) {
   4164 		if (sc->mac_ver == 0x5390) {
   4165 			rt2860_mcu_bbp_write(sc, 152,
   4166 			    rt2860_mcu_bbp_read(sc, 152) & ~0x80);
   4167 		} else {
   4168 			tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
   4169 			RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp & ~RT2860_C);
   4170 			tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
   4171 			RAL_WRITE(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
   4172 		}
   4173 	} else {
   4174 		if (sc->mac_ver == 0x5390) {
   4175 			rt2860_mcu_bbp_write(sc, 152,
   4176 			    rt2860_mcu_bbp_read(sc, 152) | 0x80);
   4177 		} else {
   4178 			tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
   4179 			RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp | RT2860_C);
   4180 			tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
   4181 			RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
   4182 		}
   4183 	}
   4184 }
   4185 
   4186 static void
   4187 rt2860_switch_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
   4188 {
   4189 	struct ieee80211com *ic = &sc->sc_ic;
   4190 	u_int chan, group;
   4191 
   4192 	chan = ieee80211_chan2ieee(ic, c);
   4193 	DPRINTF(("switch channel %u\n", chan));
   4194 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
   4195 		return;
   4196 
   4197 	if (sc->mac_ver >= 0x5390)
   4198 		rt5390_set_chan(sc, chan);
   4199 	else if (sc->mac_ver >= 0x3071)
   4200 		rt3090_set_chan(sc, chan);
   4201 	else
   4202 		rt2860_set_chan(sc, chan);
   4203 
   4204 	/* determine channel group */
   4205 	if (chan <= 14)
   4206 		group = 0;
   4207 	else if (chan <= 64)
   4208 		group = 1;
   4209 	else if (chan <= 128)
   4210 		group = 2;
   4211 	else
   4212 		group = 3;
   4213 
   4214 	/* XXX necessary only when group has changed! */
   4215 	if (sc->mac_ver < 0x5390)
   4216 		rt2860_select_chan_group(sc, group);
   4217 
   4218 	DELAY(1000);
   4219 }
   4220 
   4221 #ifndef IEEE80211_STA_ONLY
   4222 static int
   4223 rt2860_setup_beacon(struct rt2860_softc *sc)
   4224 {
   4225 	struct ieee80211com *ic = &sc->sc_ic;
   4226 	struct rt2860_txwi txwi;
   4227 	struct mbuf *m;
   4228 	int ridx;
   4229 
   4230 	if ((m = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo)) == NULL)
   4231 		return ENOBUFS;
   4232 
   4233 	memset(&txwi, 0, sizeof txwi);
   4234 	txwi.wcid = 0xff;
   4235 	txwi.len = htole16(m->m_pkthdr.len);
   4236 	/* send beacons at the lowest available rate */
   4237 	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
   4238 	    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
   4239 	txwi.phy = htole16(rt2860_rates[ridx].mcs);
   4240 	if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
   4241 		txwi.phy |= htole16(RT2860_PHY_OFDM);
   4242 	txwi.txop = RT2860_TX_TXOP_HT;
   4243 	txwi.flags = RT2860_TX_TS;
   4244 	txwi.xflags = RT2860_TX_NSEQ;
   4245 
   4246 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),
   4247 	    (uint8_t *)&txwi, sizeof txwi);
   4248 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
   4249 	    mtod(m, uint8_t *), m->m_pkthdr.len);
   4250 
   4251 	m_freem(m);
   4252 
   4253 	return 0;
   4254 }
   4255 #endif
   4256 
   4257 static void
   4258 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
   4259 {
   4260 	struct ieee80211com *ic = &sc->sc_ic;
   4261 	uint32_t tmp;
   4262 
   4263 	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
   4264 
   4265 	tmp &= ~0x1fffff;
   4266 	tmp |= ic->ic_bss->ni_intval * 16;
   4267 	tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
   4268 	if (ic->ic_opmode == IEEE80211_M_STA) {
   4269 		/*
   4270 		 * Local TSF is always updated with remote TSF on beacon
   4271 		 * reception.
   4272 		 */
   4273 		tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
   4274 	}
   4275 #ifndef IEEE80211_STA_ONLY
   4276 	else if (ic->ic_opmode == IEEE80211_M_IBSS) {
   4277 		tmp |= RT2860_BCN_TX_EN;
   4278 		/*
   4279 		 * Local TSF is updated with remote TSF on beacon reception
   4280 		 * only if the remote TSF is greater than local TSF.
   4281 		 */
   4282 		tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
   4283 	} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
   4284 		tmp |= RT2860_BCN_TX_EN;
   4285 		/* SYNC with nobody */
   4286 		tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
   4287 	}
   4288 #endif
   4289 
   4290 	RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
   4291 }
   4292