xref: /freebsd/sys/dev/ral/rt2860.c (revision 4ce386ff25d77954b8cfa11534f632172e848244)
1 /*-
2  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
3  * Copyright (c) 2012 Bernhard Schmidt <bschmidt@FreeBSD.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $OpenBSD: rt2860.c,v 1.65 2010/10/23 14:24:54 damien Exp $
18  */
19 
20 #include <sys/cdefs.h>
21 __FBSDID("$FreeBSD$");
22 
23 /*-
24  * Ralink Technology RT2860/RT3090/RT3390/RT3562/RT5390/RT5392 chipset driver
25  * http://www.ralinktech.com/
26  */
27 
28 #include <sys/param.h>
29 #include <sys/sysctl.h>
30 #include <sys/sockio.h>
31 #include <sys/mbuf.h>
32 #include <sys/kernel.h>
33 #include <sys/socket.h>
34 #include <sys/systm.h>
35 #include <sys/malloc.h>
36 #include <sys/lock.h>
37 #include <sys/mutex.h>
38 #include <sys/module.h>
39 #include <sys/bus.h>
40 #include <sys/endian.h>
41 #include <sys/firmware.h>
42 
43 #include <machine/bus.h>
44 #include <machine/resource.h>
45 #include <sys/rman.h>
46 
47 #include <net/bpf.h>
48 #include <net/if.h>
49 #include <net/if_var.h>
50 #include <net/if_arp.h>
51 #include <net/ethernet.h>
52 #include <net/if_dl.h>
53 #include <net/if_media.h>
54 #include <net/if_types.h>
55 
56 #include <net80211/ieee80211_var.h>
57 #include <net80211/ieee80211_radiotap.h>
58 #include <net80211/ieee80211_regdomain.h>
59 #include <net80211/ieee80211_ratectl.h>
60 
61 #include <netinet/in.h>
62 #include <netinet/in_systm.h>
63 #include <netinet/in_var.h>
64 #include <netinet/ip.h>
65 #include <netinet/if_ether.h>
66 
67 #include <dev/ral/rt2860reg.h>
68 #include <dev/ral/rt2860var.h>
69 
70 #define RAL_DEBUG
71 #ifdef RAL_DEBUG
72 #define DPRINTF(x)	do { if (sc->sc_debug > 0) printf x; } while (0)
73 #define DPRINTFN(n, x)	do { if (sc->sc_debug >= (n)) printf x; } while (0)
74 #else
75 #define DPRINTF(x)
76 #define DPRINTFN(n, x)
77 #endif
78 
79 static struct ieee80211vap *rt2860_vap_create(struct ieee80211com *,
80 			    const char [IFNAMSIZ], int, enum ieee80211_opmode,
81 			    int, const uint8_t [IEEE80211_ADDR_LEN],
82 			    const uint8_t [IEEE80211_ADDR_LEN]);
83 static void	rt2860_vap_delete(struct ieee80211vap *);
84 static void	rt2860_dma_map_addr(void *, bus_dma_segment_t *, int, int);
85 static int	rt2860_alloc_tx_ring(struct rt2860_softc *,
86 		    struct rt2860_tx_ring *);
87 static void	rt2860_reset_tx_ring(struct rt2860_softc *,
88 		    struct rt2860_tx_ring *);
89 static void	rt2860_free_tx_ring(struct rt2860_softc *,
90 		    struct rt2860_tx_ring *);
91 static int	rt2860_alloc_tx_pool(struct rt2860_softc *);
92 static void	rt2860_free_tx_pool(struct rt2860_softc *);
93 static int	rt2860_alloc_rx_ring(struct rt2860_softc *,
94 		    struct rt2860_rx_ring *);
95 static void	rt2860_reset_rx_ring(struct rt2860_softc *,
96 		    struct rt2860_rx_ring *);
97 static void	rt2860_free_rx_ring(struct rt2860_softc *,
98 		    struct rt2860_rx_ring *);
99 static void	rt2860_updatestats(struct rt2860_softc *);
100 static void	rt2860_newassoc(struct ieee80211_node *, int);
101 static void	rt2860_node_free(struct ieee80211_node *);
102 #ifdef IEEE80211_HT
103 static int	rt2860_ampdu_rx_start(struct ieee80211com *,
104 		    struct ieee80211_node *, uint8_t);
105 static void	rt2860_ampdu_rx_stop(struct ieee80211com *,
106 		    struct ieee80211_node *, uint8_t);
107 #endif
108 static int	rt2860_newstate(struct ieee80211vap *, enum ieee80211_state,
109 		    int);
110 static uint16_t	rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
111 static uint16_t	rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
112 static void	rt2860_intr_coherent(struct rt2860_softc *);
113 static void	rt2860_drain_stats_fifo(struct rt2860_softc *);
114 static void	rt2860_tx_intr(struct rt2860_softc *, int);
115 static void	rt2860_rx_intr(struct rt2860_softc *);
116 static void	rt2860_tbtt_intr(struct rt2860_softc *);
117 static void	rt2860_gp_intr(struct rt2860_softc *);
118 static int	rt2860_tx(struct rt2860_softc *, struct mbuf *,
119 		    struct ieee80211_node *);
120 static int	rt2860_raw_xmit(struct ieee80211_node *, struct mbuf *,
121 		    const struct ieee80211_bpf_params *);
122 static int	rt2860_tx_raw(struct rt2860_softc *, struct mbuf *,
123 		    struct ieee80211_node *,
124 		    const struct ieee80211_bpf_params *params);
125 static void	rt2860_start(struct ifnet *);
126 static void	rt2860_start_locked(struct ifnet *);
127 static void	rt2860_watchdog(void *);
128 static int	rt2860_ioctl(struct ifnet *, u_long, caddr_t);
129 static void	rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
130 static uint8_t	rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
131 static void	rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
132 static uint8_t	rt3090_rf_read(struct rt2860_softc *, uint8_t);
133 static void	rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
134 static int	rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
135 static void	rt2860_enable_mrr(struct rt2860_softc *);
136 static void	rt2860_set_txpreamble(struct rt2860_softc *);
137 static void	rt2860_set_basicrates(struct rt2860_softc *,
138 		    const struct ieee80211_rateset *);
139 static void	rt2860_scan_start(struct ieee80211com *);
140 static void	rt2860_scan_end(struct ieee80211com *);
141 static void	rt2860_set_channel(struct ieee80211com *);
142 static void	rt2860_select_chan_group(struct rt2860_softc *, int);
143 static void	rt2860_set_chan(struct rt2860_softc *, u_int);
144 static void	rt3090_set_chan(struct rt2860_softc *, u_int);
145 static void	rt5390_set_chan(struct rt2860_softc *, u_int);
146 static int	rt3090_rf_init(struct rt2860_softc *);
147 static void	rt5390_rf_init(struct rt2860_softc *);
148 static void	rt3090_rf_wakeup(struct rt2860_softc *);
149 static void	rt5390_rf_wakeup(struct rt2860_softc *);
150 static int	rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
151 		    uint8_t *);
152 static void	rt3090_rf_setup(struct rt2860_softc *);
153 static void	rt2860_set_leds(struct rt2860_softc *, uint16_t);
154 static void	rt2860_set_gp_timer(struct rt2860_softc *, int);
155 static void	rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
156 static void	rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
157 static void	rt2860_update_promisc(struct ifnet *);
158 static void	rt2860_updateslot(struct ifnet *);
159 static void	rt2860_updateprot(struct ifnet *);
160 static int	rt2860_updateedca(struct ieee80211com *);
161 #ifdef HW_CRYPTO
162 static int	rt2860_set_key(struct ieee80211com *, struct ieee80211_node *,
163 		    struct ieee80211_key *);
164 static void	rt2860_delete_key(struct ieee80211com *,
165 		    struct ieee80211_node *, struct ieee80211_key *);
166 #endif
167 static int8_t	rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
168 static const char *rt2860_get_rf(uint8_t);
169 static int	rt2860_read_eeprom(struct rt2860_softc *,
170 		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
171 static int	rt2860_bbp_init(struct rt2860_softc *);
172 static void	rt5390_bbp_init(struct rt2860_softc *);
173 static int	rt2860_txrx_enable(struct rt2860_softc *);
174 static void	rt2860_init(void *);
175 static void	rt2860_init_locked(struct rt2860_softc *);
176 static void	rt2860_stop(void *);
177 static void	rt2860_stop_locked(struct rt2860_softc *);
178 static int	rt2860_load_microcode(struct rt2860_softc *);
179 #ifdef NOT_YET
180 static void	rt2860_calib(struct rt2860_softc *);
181 #endif
182 static void	rt3090_set_rx_antenna(struct rt2860_softc *, int);
183 static void	rt2860_switch_chan(struct rt2860_softc *,
184 		    struct ieee80211_channel *);
185 static int	rt2860_setup_beacon(struct rt2860_softc *,
186 		    struct ieee80211vap *);
187 static void	rt2860_enable_tsf_sync(struct rt2860_softc *);
188 
189 static const struct {
190 	uint32_t	reg;
191 	uint32_t	val;
192 } rt2860_def_mac[] = {
193 	RT2860_DEF_MAC
194 };
195 
196 static const struct {
197 	uint8_t	reg;
198 	uint8_t	val;
199 } rt2860_def_bbp[] = {
200 	RT2860_DEF_BBP
201 }, rt5390_def_bbp[] = {
202 	RT5390_DEF_BBP
203 };
204 
205 static const struct rfprog {
206 	uint8_t		chan;
207 	uint32_t	r1, r2, r3, r4;
208 } rt2860_rf2850[] = {
209 	RT2860_RF2850
210 };
211 
212 struct {
213 	uint8_t	n, r, k;
214 } rt3090_freqs[] = {
215 	RT3070_RF3052
216 };
217 
218 static const struct {
219 	uint8_t	reg;
220 	uint8_t	val;
221 } rt3090_def_rf[] = {
222 	RT3070_DEF_RF
223 }, rt5390_def_rf[] = {
224 	RT5390_DEF_RF
225 }, rt5392_def_rf[] = {
226 	RT5392_DEF_RF
227 };
228 
229 int
230 rt2860_attach(device_t dev, int id)
231 {
232 	struct rt2860_softc *sc = device_get_softc(dev);
233 	struct ieee80211com *ic;
234 	struct ifnet *ifp;
235 	uint32_t tmp;
236 	int error, ntries, qid;
237 	uint8_t bands;
238 	uint8_t macaddr[IEEE80211_ADDR_LEN];
239 
240 	sc->sc_dev = dev;
241 	sc->sc_debug = 0;
242 
243 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
244 	if (ifp == NULL) {
245 		device_printf(sc->sc_dev, "can not if_alloc()\n");
246 		return ENOMEM;
247 	}
248 	ic = ifp->if_l2com;
249 
250 	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
251 	    MTX_DEF | MTX_RECURSE);
252 
253 	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
254 
255 	/* wait for NIC to initialize */
256 	for (ntries = 0; ntries < 100; ntries++) {
257 		tmp = RAL_READ(sc, RT2860_ASIC_VER_ID);
258 		if (tmp != 0 && tmp != 0xffffffff)
259 			break;
260 		DELAY(10);
261 	}
262 	if (ntries == 100) {
263 		device_printf(sc->sc_dev,
264 		    "timeout waiting for NIC to initialize\n");
265 		error = EIO;
266 		goto fail1;
267 	}
268 	sc->mac_ver = tmp >> 16;
269 	sc->mac_rev = tmp & 0xffff;
270 
271 	if (sc->mac_ver != 0x2860 &&
272 	    (id == 0x0681 || id == 0x0781 || id == 0x1059))
273 		sc->sc_flags |= RT2860_ADVANCED_PS;
274 
275 	/* retrieve RF rev. no and various other things from EEPROM */
276 	rt2860_read_eeprom(sc, macaddr);
277 	device_printf(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
278 	    "RF %s (MIMO %dT%dR), address %6D\n",
279 	    sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
280 	    sc->ntxchains, sc->nrxchains, macaddr, ":");
281 
282 	/*
283 	 * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
284 	 */
285 	for (qid = 0; qid < 6; qid++) {
286 		if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
287 			device_printf(sc->sc_dev,
288 			    "could not allocate Tx ring %d\n", qid);
289 			goto fail2;
290 		}
291 	}
292 
293 	if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
294 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
295 		goto fail2;
296 	}
297 
298 	if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
299 		device_printf(sc->sc_dev, "could not allocate Tx pool\n");
300 		goto fail3;
301 	}
302 
303 	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
304 	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
305 	    WME_AC_VO : 5;
306 
307 	ifp->if_softc = sc;
308 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
309 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
310 	ifp->if_init = rt2860_init;
311 	ifp->if_ioctl = rt2860_ioctl;
312 	ifp->if_start = rt2860_start;
313 	IFQ_SET_MAXLEN(&ifp->if_snd, ifqmaxlen);
314 	ifp->if_snd.ifq_drv_maxlen = ifqmaxlen;
315 	IFQ_SET_READY(&ifp->if_snd);
316 
317 	ic->ic_ifp = ifp;
318 	ic->ic_opmode = IEEE80211_M_STA;
319 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
320 
321 	/* set device capabilities */
322 	ic->ic_caps =
323 		  IEEE80211_C_STA		/* station mode */
324 		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
325 		| IEEE80211_C_HOSTAP		/* hostap mode */
326 		| IEEE80211_C_MONITOR		/* monitor mode */
327 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
328 		| IEEE80211_C_WDS		/* 4-address traffic works */
329 		| IEEE80211_C_MBSS		/* mesh point link mode */
330 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
331 		| IEEE80211_C_SHSLOT		/* short slot time supported */
332 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
333 #if 0
334 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
335 #endif
336 		| IEEE80211_C_WME		/* 802.11e */
337 		;
338 
339 	bands = 0;
340 	setbit(&bands, IEEE80211_MODE_11B);
341 	setbit(&bands, IEEE80211_MODE_11G);
342 	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850)
343 		setbit(&bands, IEEE80211_MODE_11A);
344 	ieee80211_init_channels(ic, NULL, &bands);
345 
346 	ieee80211_ifattach(ic, macaddr);
347 
348 	ic->ic_wme.wme_update = rt2860_updateedca;
349 	ic->ic_scan_start = rt2860_scan_start;
350 	ic->ic_scan_end = rt2860_scan_end;
351 	ic->ic_set_channel = rt2860_set_channel;
352 	ic->ic_updateslot = rt2860_updateslot;
353 	ic->ic_update_promisc = rt2860_update_promisc;
354 	ic->ic_raw_xmit = rt2860_raw_xmit;
355 	sc->sc_node_free = ic->ic_node_free;
356 	ic->ic_node_free = rt2860_node_free;
357 	ic->ic_newassoc = rt2860_newassoc;
358 
359 	ic->ic_vap_create = rt2860_vap_create;
360 	ic->ic_vap_delete = rt2860_vap_delete;
361 
362 	ieee80211_radiotap_attach(ic,
363 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
364 		RT2860_TX_RADIOTAP_PRESENT,
365 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
366 		RT2860_RX_RADIOTAP_PRESENT);
367 
368 #ifdef RAL_DEBUG
369 	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
370 	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
371 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
372 #endif
373 	if (bootverbose)
374 		ieee80211_announce(ic);
375 
376 	return 0;
377 
378 fail3:	rt2860_free_rx_ring(sc, &sc->rxq);
379 fail2:	while (--qid >= 0)
380 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
381 fail1:	mtx_destroy(&sc->sc_mtx);
382 	if_free(ifp);
383 	return error;
384 }
385 
386 int
387 rt2860_detach(void *xsc)
388 {
389 	struct rt2860_softc *sc = xsc;
390 	struct ifnet *ifp =  sc->sc_ifp;
391 	struct ieee80211com *ic = ifp->if_l2com;
392 	int qid;
393 
394 	RAL_LOCK(sc);
395 	rt2860_stop_locked(sc);
396 	RAL_UNLOCK(sc);
397 
398 	ieee80211_ifdetach(ic);
399 
400 	for (qid = 0; qid < 6; qid++)
401 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
402 	rt2860_free_rx_ring(sc, &sc->rxq);
403 	rt2860_free_tx_pool(sc);
404 
405 	if_free(ifp);
406 
407 	mtx_destroy(&sc->sc_mtx);
408 
409 	return 0;
410 }
411 
412 void
413 rt2860_shutdown(void *xsc)
414 {
415 	struct rt2860_softc *sc = xsc;
416 
417 	rt2860_stop(sc);
418 }
419 
420 void
421 rt2860_suspend(void *xsc)
422 {
423 	struct rt2860_softc *sc = xsc;
424 
425 	rt2860_stop(sc);
426 }
427 
428 void
429 rt2860_resume(void *xsc)
430 {
431 	struct rt2860_softc *sc = xsc;
432 	struct ifnet *ifp = sc->sc_ifp;
433 
434 	if (ifp->if_flags & IFF_UP)
435 		rt2860_init(sc);
436 }
437 
438 static struct ieee80211vap *
439 rt2860_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
440     enum ieee80211_opmode opmode, int flags,
441     const uint8_t bssid[IEEE80211_ADDR_LEN],
442     const uint8_t mac[IEEE80211_ADDR_LEN])
443 {
444 	struct ifnet *ifp = ic->ic_ifp;
445 	struct rt2860_vap *rvp;
446 	struct ieee80211vap *vap;
447 
448 	switch (opmode) {
449 	case IEEE80211_M_STA:
450 	case IEEE80211_M_IBSS:
451 	case IEEE80211_M_AHDEMO:
452 	case IEEE80211_M_MONITOR:
453 	case IEEE80211_M_HOSTAP:
454 	case IEEE80211_M_MBSS:
455 		/* XXXRP: TBD */
456 		if (!TAILQ_EMPTY(&ic->ic_vaps)) {
457 			if_printf(ifp, "only 1 vap supported\n");
458 			return NULL;
459 		}
460 		if (opmode == IEEE80211_M_STA)
461 			flags |= IEEE80211_CLONE_NOBEACONS;
462 		break;
463 	case IEEE80211_M_WDS:
464 		if (TAILQ_EMPTY(&ic->ic_vaps) ||
465 		    ic->ic_opmode != IEEE80211_M_HOSTAP) {
466 			if_printf(ifp, "wds only supported in ap mode\n");
467 			return NULL;
468 		}
469 		/*
470 		 * Silently remove any request for a unique
471 		 * bssid; WDS vap's always share the local
472 		 * mac address.
473 		 */
474 		flags &= ~IEEE80211_CLONE_BSSID;
475 		break;
476 	default:
477 		if_printf(ifp, "unknown opmode %d\n", opmode);
478 		return NULL;
479 	}
480 	rvp = malloc(sizeof(struct rt2860_vap), M_80211_VAP, M_NOWAIT | M_ZERO);
481 	if (rvp == NULL)
482 		return NULL;
483 	vap = &rvp->ral_vap;
484 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
485 
486 	/* override state transition machine */
487 	rvp->ral_newstate = vap->iv_newstate;
488 	vap->iv_newstate = rt2860_newstate;
489 #if 0
490 	vap->iv_update_beacon = rt2860_beacon_update;
491 #endif
492 
493 	/* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
494 	vap->iv_max_aid = min(IEEE80211_AID_MAX, RT2860_WCID_MAX);
495 
496 	ieee80211_ratectl_init(vap);
497 	/* complete setup */
498 	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
499 	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
500 		ic->ic_opmode = opmode;
501 	return vap;
502 }
503 
504 static void
505 rt2860_vap_delete(struct ieee80211vap *vap)
506 {
507 	struct rt2860_vap *rvp = RT2860_VAP(vap);
508 
509 	ieee80211_ratectl_deinit(vap);
510 	ieee80211_vap_detach(vap);
511 	free(rvp, M_80211_VAP);
512 }
513 
514 static void
515 rt2860_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
516 {
517 	if (error != 0)
518 		return;
519 
520 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
521 
522 	*(bus_addr_t *)arg = segs[0].ds_addr;
523 }
524 
525 
526 static int
527 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
528 {
529 	int size, error;
530 
531 	size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
532 
533 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 16, 0,
534 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
535 	    size, 1, size, 0, NULL, NULL, &ring->desc_dmat);
536 	if (error != 0) {
537 		device_printf(sc->sc_dev, "could not create desc DMA map\n");
538 		goto fail;
539 	}
540 
541 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->txd,
542 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
543 	if (error != 0) {
544 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
545 		goto fail;
546 	}
547 
548 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->txd,
549 	    size, rt2860_dma_map_addr, &ring->paddr, 0);
550 	if (error != 0) {
551 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
552 		goto fail;
553 	}
554 
555 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
556 
557 	return 0;
558 
559 fail:	rt2860_free_tx_ring(sc, ring);
560 	return error;
561 }
562 
563 void
564 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
565 {
566 	struct rt2860_tx_data *data;
567 	int i;
568 
569 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
570 		if ((data = ring->data[i]) == NULL)
571 			continue;	/* nothing mapped in this slot */
572 
573 		if (data->m != NULL) {
574 			bus_dmamap_sync(sc->txwi_dmat, data->map,
575 			    BUS_DMASYNC_POSTWRITE);
576 			bus_dmamap_unload(sc->txwi_dmat, data->map);
577 			m_freem(data->m);
578 			data->m = NULL;
579 		}
580 		if (data->ni != NULL) {
581 			ieee80211_free_node(data->ni);
582 			data->ni = NULL;
583 		}
584 
585 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
586 		ring->data[i] = NULL;
587 	}
588 
589 	ring->queued = 0;
590 	ring->cur = ring->next = 0;
591 }
592 
593 void
594 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
595 {
596 	struct rt2860_tx_data *data;
597 	int i;
598 
599 	if (ring->txd != NULL) {
600 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
601 		    BUS_DMASYNC_POSTWRITE);
602 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
603 		bus_dmamem_free(ring->desc_dmat, ring->txd, ring->desc_map);
604 	}
605 	if (ring->desc_dmat != NULL)
606 		bus_dma_tag_destroy(ring->desc_dmat);
607 
608 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
609 		if ((data = ring->data[i]) == NULL)
610 			continue;	/* nothing mapped in this slot */
611 
612 		if (data->m != NULL) {
613 			bus_dmamap_sync(sc->txwi_dmat, data->map,
614 			    BUS_DMASYNC_POSTWRITE);
615 			bus_dmamap_unload(sc->txwi_dmat, data->map);
616 			m_freem(data->m);
617 		}
618 		if (data->ni != NULL)
619 			ieee80211_free_node(data->ni);
620 
621 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
622 	}
623 }
624 
625 /*
626  * Allocate a pool of TX Wireless Information blocks.
627  */
628 int
629 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
630 {
631 	caddr_t vaddr;
632 	bus_addr_t paddr;
633 	int i, size, error;
634 
635 	size = RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ;
636 
637 	/* init data_pool early in case of failure.. */
638 	SLIST_INIT(&sc->data_pool);
639 
640 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
641 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
642 	    size, 1, size, 0, NULL, NULL, &sc->txwi_dmat);
643 	if (error != 0) {
644 		device_printf(sc->sc_dev, "could not create txwi DMA tag\n");
645 		goto fail;
646 	}
647 
648 	error = bus_dmamem_alloc(sc->txwi_dmat, (void **)&sc->txwi_vaddr,
649 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &sc->txwi_map);
650 	if (error != 0) {
651 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
652 		goto fail;
653 	}
654 
655 	error = bus_dmamap_load(sc->txwi_dmat, sc->txwi_map,
656 	    sc->txwi_vaddr, size, rt2860_dma_map_addr, &paddr, 0);
657 	if (error != 0) {
658 		device_printf(sc->sc_dev, "could not load txwi DMA map\n");
659 		goto fail;
660 	}
661 
662 	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
663 
664 	vaddr = sc->txwi_vaddr;
665 	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
666 		struct rt2860_tx_data *data = &sc->data[i];
667 
668 		error = bus_dmamap_create(sc->txwi_dmat, 0, &data->map);
669 		if (error != 0) {
670 			device_printf(sc->sc_dev, "could not create DMA map\n");
671 			goto fail;
672 		}
673 		data->txwi = (struct rt2860_txwi *)vaddr;
674 		data->paddr = paddr;
675 		vaddr += RT2860_TXWI_DMASZ;
676 		paddr += RT2860_TXWI_DMASZ;
677 
678 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
679 	}
680 
681 	return 0;
682 
683 fail:	rt2860_free_tx_pool(sc);
684 	return error;
685 }
686 
687 void
688 rt2860_free_tx_pool(struct rt2860_softc *sc)
689 {
690 	if (sc->txwi_vaddr != NULL) {
691 		bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map,
692 		    BUS_DMASYNC_POSTWRITE);
693 		bus_dmamap_unload(sc->txwi_dmat, sc->txwi_map);
694 		bus_dmamem_free(sc->txwi_dmat, sc->txwi_vaddr, sc->txwi_map);
695 	}
696 	if (sc->txwi_dmat != NULL)
697 		bus_dma_tag_destroy(sc->txwi_dmat);
698 
699 	while (!SLIST_EMPTY(&sc->data_pool)) {
700 		struct rt2860_tx_data *data;
701 		data = SLIST_FIRST(&sc->data_pool);
702 		bus_dmamap_destroy(sc->txwi_dmat, data->map);
703 		SLIST_REMOVE_HEAD(&sc->data_pool, next);
704 	}
705 }
706 
707 int
708 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
709 {
710 	bus_addr_t physaddr;
711 	int i, size, error;
712 
713 	size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
714 
715 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 16, 0,
716 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
717 	    size, 1, size, 0, NULL, NULL, &ring->desc_dmat);
718 	if (error != 0) {
719 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
720 		goto fail;
721 	}
722 
723 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->rxd,
724 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
725 	if (error != 0) {
726 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
727 		goto fail;
728 	}
729 
730 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->rxd,
731 	    size, rt2860_dma_map_addr, &ring->paddr, 0);
732 	if (error != 0) {
733 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
734 		goto fail;
735 	}
736 
737 	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
738 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
739 	    1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
740 	if (error != 0) {
741 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
742 		goto fail;
743 	}
744 
745 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
746 		struct rt2860_rx_data *data = &ring->data[i];
747 		struct rt2860_rxd *rxd = &ring->rxd[i];
748 
749 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
750 		if (error != 0) {
751 			device_printf(sc->sc_dev, "could not create DMA map\n");
752 			goto fail;
753 		}
754 
755 		data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
756 		if (data->m == NULL) {
757 			device_printf(sc->sc_dev,
758 			    "could not allocate rx mbuf\n");
759 			error = ENOMEM;
760 			goto fail;
761 		}
762 
763 		error = bus_dmamap_load(ring->data_dmat, data->map,
764 		    mtod(data->m, void *), MCLBYTES, rt2860_dma_map_addr,
765 		    &physaddr, 0);
766 		if (error != 0) {
767 			device_printf(sc->sc_dev,
768 			    "could not load rx buf DMA map");
769 			goto fail;
770 		}
771 
772 		rxd->sdp0 = htole32(physaddr);
773 		rxd->sdl0 = htole16(MCLBYTES);
774 	}
775 
776 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
777 
778 	return 0;
779 
780 fail:	rt2860_free_rx_ring(sc, ring);
781 	return error;
782 }
783 
784 void
785 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
786 {
787 	int i;
788 
789 	for (i = 0; i < RT2860_RX_RING_COUNT; i++)
790 		ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE);
791 
792 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
793 
794 	ring->cur = 0;
795 }
796 
797 void
798 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
799 {
800 	int i;
801 
802 	if (ring->rxd != NULL) {
803 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
804 		    BUS_DMASYNC_POSTWRITE);
805 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
806 		bus_dmamem_free(ring->desc_dmat, ring->rxd, ring->desc_map);
807 	}
808 	if (ring->desc_dmat != NULL)
809 		bus_dma_tag_destroy(ring->desc_dmat);
810 
811 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
812 		struct rt2860_rx_data *data = &ring->data[i];
813 
814 		if (data->m != NULL) {
815 			bus_dmamap_sync(ring->data_dmat, data->map,
816 			    BUS_DMASYNC_POSTREAD);
817 			bus_dmamap_unload(ring->data_dmat, data->map);
818 			m_freem(data->m);
819 		}
820 		if (data->map != NULL)
821 			bus_dmamap_destroy(ring->data_dmat, data->map);
822 	}
823 	if (ring->data_dmat != NULL)
824 		bus_dma_tag_destroy(ring->data_dmat);
825 }
826 
827 static void
828 rt2860_updatestats(struct rt2860_softc *sc)
829 {
830 	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
831 
832 	/*
833 	 * In IBSS or HostAP modes (when the hardware sends beacons), the
834 	 * MAC can run into a livelock and start sending CTS-to-self frames
835 	 * like crazy if protection is enabled.  Fortunately, we can detect
836 	 * when such a situation occurs and reset the MAC.
837 	 */
838 	if (ic->ic_curmode != IEEE80211_M_STA) {
839 		/* check if we're in a livelock situation.. */
840 		uint32_t tmp = RAL_READ(sc, RT2860_DEBUG);
841 		if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
842 			/* ..and reset MAC/BBP for a while.. */
843 			DPRINTF(("CTS-to-self livelock detected\n"));
844 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
845 			RAL_BARRIER_WRITE(sc);
846 			DELAY(1);
847 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
848 			    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
849 		}
850 	}
851 }
852 
853 static void
854 rt2860_newassoc(struct ieee80211_node *ni, int isnew)
855 {
856 	struct ieee80211com *ic = ni->ni_ic;
857 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
858 	uint8_t wcid;
859 
860 	wcid = IEEE80211_AID(ni->ni_associd);
861 	if (isnew && ni->ni_associd != 0) {
862 		sc->wcid2ni[wcid] = ni;
863 
864 		/* init WCID table entry */
865 		RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),
866 		    ni->ni_macaddr, IEEE80211_ADDR_LEN);
867 	}
868 	DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
869 	    isnew, ether_sprintf(ni->ni_macaddr), wcid));
870 }
871 
872 static void
873 rt2860_node_free(struct ieee80211_node *ni)
874 {
875 	struct ieee80211com *ic = ni->ni_ic;
876 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
877 	uint8_t wcid;
878 
879 	if (ni->ni_associd != 0) {
880 		wcid = IEEE80211_AID(ni->ni_associd);
881 
882 		/* clear Rx WCID search table entry */
883 		RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(wcid), 0, 2);
884 	}
885 	sc->sc_node_free(ni);
886 }
887 
888 #ifdef IEEE80211_HT
889 static int
890 rt2860_ampdu_rx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
891     uint8_t tid)
892 {
893 	struct rt2860_softc *sc = ic->ic_softc;
894 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
895 	uint32_t tmp;
896 
897 	/* update BA session mask */
898 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
899 	tmp |= (1 << tid) << 16;
900 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
901 	return 0;
902 }
903 
904 static void
905 rt2860_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
906     uint8_t tid)
907 {
908 	struct rt2860_softc *sc = ic->ic_softc;
909 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
910 	uint32_t tmp;
911 
912 	/* update BA session mask */
913 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
914 	tmp &= ~((1 << tid) << 16);
915 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
916 }
917 #endif
918 
919 int
920 rt2860_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
921 {
922 	struct rt2860_vap *rvp = RT2860_VAP(vap);
923 	struct ieee80211com *ic = vap->iv_ic;
924 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
925 	uint32_t tmp;
926 	int error;
927 
928 	if (vap->iv_state == IEEE80211_S_RUN) {
929 		/* turn link LED off */
930 		rt2860_set_leds(sc, RT2860_LED_RADIO);
931 	}
932 
933 	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
934 		/* abort TSF synchronization */
935 		tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
936 		RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
937 		    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
938 		    RT2860_TBTT_TIMER_EN));
939 	}
940 
941 	rt2860_set_gp_timer(sc, 0);
942 
943 	error = rvp->ral_newstate(vap, nstate, arg);
944 	if (error != 0)
945 		return (error);
946 
947 	if (nstate == IEEE80211_S_RUN) {
948 		struct ieee80211_node *ni = vap->iv_bss;
949 
950 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
951 			rt2860_enable_mrr(sc);
952 			rt2860_set_txpreamble(sc);
953 			rt2860_set_basicrates(sc, &ni->ni_rates);
954 			rt2860_set_bssid(sc, ni->ni_bssid);
955 		}
956 
957 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
958 		    vap->iv_opmode == IEEE80211_M_IBSS ||
959 		    vap->iv_opmode == IEEE80211_M_MBSS) {
960 			error = rt2860_setup_beacon(sc, vap);
961 			if (error != 0)
962 				return error;
963 		}
964 
965 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
966 			rt2860_enable_tsf_sync(sc);
967 			rt2860_set_gp_timer(sc, 500);
968 		}
969 
970 		/* turn link LED on */
971 		rt2860_set_leds(sc, RT2860_LED_RADIO |
972 		    (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan) ?
973 		     RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
974 	}
975 	return error;
976 }
977 
978 /* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
979 static uint16_t
980 rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
981 {
982 	uint32_t tmp;
983 	uint16_t reg;
984 	int ntries;
985 
986 	addr *= 2;
987 	/*-
988 	 * Read one 16-byte block into registers EFUSE_DATA[0-3]:
989 	 * DATA0: F E D C
990 	 * DATA1: B A 9 8
991 	 * DATA2: 7 6 5 4
992 	 * DATA3: 3 2 1 0
993 	 */
994 	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
995 	tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
996 	tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
997 	RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp);
998 	for (ntries = 0; ntries < 500; ntries++) {
999 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
1000 		if (!(tmp & RT3070_EFSROM_KICK))
1001 			break;
1002 		DELAY(2);
1003 	}
1004 	if (ntries == 500)
1005 		return 0xffff;
1006 
1007 	if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK)
1008 		return 0xffff;	/* address not found */
1009 
1010 	/* determine to which 32-bit register our 16-bit word belongs */
1011 	reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1012 	tmp = RAL_READ(sc, reg);
1013 
1014 	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
1015 }
1016 
1017 /*
1018  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
1019  * 93C66 or 93C86).
1020  */
1021 static uint16_t
1022 rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
1023 {
1024 	uint32_t tmp;
1025 	uint16_t val;
1026 	int n;
1027 
1028 	/* clock C once before the first command */
1029 	RT2860_EEPROM_CTL(sc, 0);
1030 
1031 	RT2860_EEPROM_CTL(sc, RT2860_S);
1032 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1033 	RT2860_EEPROM_CTL(sc, RT2860_S);
1034 
1035 	/* write start bit (1) */
1036 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1037 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1038 
1039 	/* write READ opcode (10) */
1040 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1041 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1042 	RT2860_EEPROM_CTL(sc, RT2860_S);
1043 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1044 
1045 	/* write address (A5-A0 or A7-A0) */
1046 	n = ((RAL_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
1047 	for (; n >= 0; n--) {
1048 		RT2860_EEPROM_CTL(sc, RT2860_S |
1049 		    (((addr >> n) & 1) << RT2860_SHIFT_D));
1050 		RT2860_EEPROM_CTL(sc, RT2860_S |
1051 		    (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
1052 	}
1053 
1054 	RT2860_EEPROM_CTL(sc, RT2860_S);
1055 
1056 	/* read data Q15-Q0 */
1057 	val = 0;
1058 	for (n = 15; n >= 0; n--) {
1059 		RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1060 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
1061 		val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
1062 		RT2860_EEPROM_CTL(sc, RT2860_S);
1063 	}
1064 
1065 	RT2860_EEPROM_CTL(sc, 0);
1066 
1067 	/* clear Chip Select and clock C */
1068 	RT2860_EEPROM_CTL(sc, RT2860_S);
1069 	RT2860_EEPROM_CTL(sc, 0);
1070 	RT2860_EEPROM_CTL(sc, RT2860_C);
1071 
1072 	return val;
1073 }
1074 
1075 static __inline uint16_t
1076 rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
1077 {
1078 	/* either eFUSE ROM or EEPROM */
1079 	return sc->sc_srom_read(sc, addr);
1080 }
1081 
1082 static void
1083 rt2860_intr_coherent(struct rt2860_softc *sc)
1084 {
1085 	uint32_t tmp;
1086 
1087 	/* DMA finds data coherent event when checking the DDONE bit */
1088 
1089 	DPRINTF(("Tx/Rx Coherent interrupt\n"));
1090 
1091 	/* restart DMA engine */
1092 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
1093 	tmp &= ~(RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
1094 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
1095 
1096 	(void)rt2860_txrx_enable(sc);
1097 }
1098 
1099 static void
1100 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1101 {
1102 	struct ifnet *ifp = sc->sc_ifp;
1103 	struct ieee80211_node *ni;
1104 	uint32_t stat;
1105 	int retrycnt;
1106 	uint8_t wcid, mcs, pid;
1107 
1108 	/* drain Tx status FIFO (maxsize = 16) */
1109 	while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
1110 		DPRINTFN(4, ("tx stat 0x%08x\n", stat));
1111 
1112 		wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
1113 		ni = sc->wcid2ni[wcid];
1114 
1115 		/* if no ACK was requested, no feedback is available */
1116 		if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff || ni == NULL)
1117 			continue;
1118 
1119 		/* update per-STA AMRR stats */
1120 		if (stat & RT2860_TXQ_OK) {
1121 			/*
1122 			 * Check if there were retries, ie if the Tx success
1123 			 * rate is different from the requested rate.  Note
1124 			 * that it works only because we do not allow rate
1125 			 * fallback from OFDM to CCK.
1126 			 */
1127 			mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
1128 			pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
1129 			if (mcs + 1 != pid)
1130 				retrycnt = 1;
1131 			else
1132 				retrycnt = 0;
1133 			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1134 			    IEEE80211_RATECTL_TX_SUCCESS, &retrycnt, NULL);
1135 		} else {
1136 			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1137 			    IEEE80211_RATECTL_TX_FAILURE, &retrycnt, NULL);
1138 			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1139 		}
1140 	}
1141 }
1142 
1143 static void
1144 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1145 {
1146 	struct ifnet *ifp = sc->sc_ifp;
1147 	struct rt2860_tx_ring *ring = &sc->txq[qid];
1148 	uint32_t hw;
1149 
1150 	rt2860_drain_stats_fifo(sc);
1151 
1152 	hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid));
1153 	while (ring->next != hw) {
1154 		struct rt2860_tx_data *data = ring->data[ring->next];
1155 
1156 		if (data != NULL) {
1157 			bus_dmamap_sync(sc->txwi_dmat, data->map,
1158 			    BUS_DMASYNC_POSTWRITE);
1159 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1160 			if (data->m->m_flags & M_TXCB) {
1161 				ieee80211_process_callback(data->ni, data->m,
1162 				    0);
1163 			}
1164 			m_freem(data->m);
1165 			ieee80211_free_node(data->ni);
1166 			data->m = NULL;
1167 			data->ni = NULL;
1168 
1169 			SLIST_INSERT_HEAD(&sc->data_pool, data, next);
1170 			ring->data[ring->next] = NULL;
1171 
1172 			if_inc_counter(ifp, IFCOUNTER_OPACKETS, 1);
1173 		}
1174 		ring->queued--;
1175 		ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
1176 	}
1177 
1178 	sc->sc_tx_timer = 0;
1179 	if (ring->queued < RT2860_TX_RING_COUNT)
1180 		sc->qfullmsk &= ~(1 << qid);
1181 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
1182 	rt2860_start_locked(ifp);
1183 }
1184 
1185 /*
1186  * Return the Rx chain with the highest RSSI for a given frame.
1187  */
1188 static __inline uint8_t
1189 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
1190 {
1191 	uint8_t rxchain = 0;
1192 
1193 	if (sc->nrxchains > 1) {
1194 		if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1195 			rxchain = 1;
1196 		if (sc->nrxchains > 2)
1197 			if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1198 				rxchain = 2;
1199 	}
1200 	return rxchain;
1201 }
1202 
1203 static void
1204 rt2860_rx_intr(struct rt2860_softc *sc)
1205 {
1206 	struct rt2860_rx_radiotap_header *tap;
1207 	struct ifnet *ifp = sc->sc_ifp;
1208 	struct ieee80211com *ic = ifp->if_l2com;
1209 	struct ieee80211_frame *wh;
1210 	struct ieee80211_node *ni;
1211 	struct mbuf *m, *m1;
1212 	bus_addr_t physaddr;
1213 	uint32_t hw;
1214 	uint16_t phy;
1215 	uint8_t ant;
1216 	int8_t rssi, nf;
1217 	int error;
1218 
1219 	hw = RAL_READ(sc, RT2860_FS_DRX_IDX) & 0xfff;
1220 	while (sc->rxq.cur != hw) {
1221 		struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1222 		struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1223 		struct rt2860_rxwi *rxwi;
1224 
1225 		bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1226 		    BUS_DMASYNC_POSTREAD);
1227 
1228 		if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))) {
1229 			DPRINTF(("RXD DDONE bit not set!\n"));
1230 			break;	/* should not happen */
1231 		}
1232 
1233 		if (__predict_false(rxd->flags &
1234 		    htole32(RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
1235 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1236 			goto skip;
1237 		}
1238 
1239 #ifdef HW_CRYPTO
1240 		if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))) {
1241 			/* report MIC failures to net80211 for TKIP */
1242 			ic->ic_stats.is_rx_locmicfail++;
1243 			ieee80211_michael_mic_failure(ic, 0/* XXX */);
1244 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1245 			goto skip;
1246 		}
1247 #endif
1248 
1249 		m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1250 		if (__predict_false(m1 == NULL)) {
1251 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1252 			goto skip;
1253 		}
1254 
1255 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1256 		    BUS_DMASYNC_POSTREAD);
1257 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1258 
1259 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1260 		    mtod(m1, void *), MCLBYTES, rt2860_dma_map_addr,
1261 		    &physaddr, 0);
1262 		if (__predict_false(error != 0)) {
1263 			m_freem(m1);
1264 
1265 			/* try to reload the old mbuf */
1266 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1267 			    mtod(data->m, void *), MCLBYTES,
1268 			    rt2860_dma_map_addr, &physaddr, 0);
1269 			if (__predict_false(error != 0)) {
1270 				panic("%s: could not load old rx mbuf",
1271 				    device_get_name(sc->sc_dev));
1272 			}
1273 			/* physical address may have changed */
1274 			rxd->sdp0 = htole32(physaddr);
1275 			if_inc_counter(ifp, IFCOUNTER_IERRORS, 1);
1276 			goto skip;
1277 		}
1278 
1279 		/*
1280 		 * New mbuf successfully loaded, update Rx ring and continue
1281 		 * processing.
1282 		 */
1283 		m = data->m;
1284 		data->m = m1;
1285 		rxd->sdp0 = htole32(physaddr);
1286 
1287 		rxwi = mtod(m, struct rt2860_rxwi *);
1288 
1289 		/* finalize mbuf */
1290 		m->m_pkthdr.rcvif = ifp;
1291 		m->m_data = (caddr_t)(rxwi + 1);
1292 		m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;
1293 
1294 		wh = mtod(m, struct ieee80211_frame *);
1295 #ifdef HW_CRYPTO
1296 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1297 			/* frame is decrypted by hardware */
1298 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
1299 		}
1300 #endif
1301 
1302 		/* HW may insert 2 padding bytes after 802.11 header */
1303 		if (rxd->flags & htole32(RT2860_RX_L2PAD)) {
1304 			u_int hdrlen = ieee80211_hdrsize(wh);
1305 			ovbcopy(wh, (caddr_t)wh + 2, hdrlen);
1306 			m->m_data += 2;
1307 			wh = mtod(m, struct ieee80211_frame *);
1308 		}
1309 
1310 		ant = rt2860_maxrssi_chain(sc, rxwi);
1311 		rssi = rt2860_rssi2dbm(sc, rxwi->rssi[ant], ant);
1312 		nf = RT2860_NOISE_FLOOR;
1313 
1314 		if (ieee80211_radiotap_active(ic)) {
1315 			tap = &sc->sc_rxtap;
1316 			tap->wr_flags = 0;
1317 			tap->wr_antenna = ant;
1318 			tap->wr_antsignal = nf + rssi;
1319 			tap->wr_antnoise = nf;
1320 			/* in case it can't be found below */
1321 			tap->wr_rate = 2;
1322 			phy = le16toh(rxwi->phy);
1323 			switch (phy & RT2860_PHY_MODE) {
1324 			case RT2860_PHY_CCK:
1325 				switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
1326 				case 0:	tap->wr_rate =   2; break;
1327 				case 1:	tap->wr_rate =   4; break;
1328 				case 2:	tap->wr_rate =  11; break;
1329 				case 3:	tap->wr_rate =  22; break;
1330 				}
1331 				if (phy & RT2860_PHY_SHPRE)
1332 					tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1333 				break;
1334 			case RT2860_PHY_OFDM:
1335 				switch (phy & RT2860_PHY_MCS) {
1336 				case 0:	tap->wr_rate =  12; break;
1337 				case 1:	tap->wr_rate =  18; break;
1338 				case 2:	tap->wr_rate =  24; break;
1339 				case 3:	tap->wr_rate =  36; break;
1340 				case 4:	tap->wr_rate =  48; break;
1341 				case 5:	tap->wr_rate =  72; break;
1342 				case 6:	tap->wr_rate =  96; break;
1343 				case 7:	tap->wr_rate = 108; break;
1344 				}
1345 				break;
1346 			}
1347 		}
1348 
1349 		RAL_UNLOCK(sc);
1350 		wh = mtod(m, struct ieee80211_frame *);
1351 
1352 		/* send the frame to the 802.11 layer */
1353 		ni = ieee80211_find_rxnode(ic,
1354 		    (struct ieee80211_frame_min *)wh);
1355 		if (ni != NULL) {
1356 			(void)ieee80211_input(ni, m, rssi - nf, nf);
1357 			ieee80211_free_node(ni);
1358 		} else
1359 			(void)ieee80211_input_all(ic, m, rssi - nf, nf);
1360 
1361 		RAL_LOCK(sc);
1362 
1363 skip:		rxd->sdl0 &= ~htole16(RT2860_RX_DDONE);
1364 
1365 		bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1366 		    BUS_DMASYNC_PREWRITE);
1367 
1368 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
1369 	}
1370 
1371 	/* tell HW what we have processed */
1372 	RAL_WRITE(sc, RT2860_RX_CALC_IDX,
1373 	    (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
1374 }
1375 
1376 static void
1377 rt2860_tbtt_intr(struct rt2860_softc *sc)
1378 {
1379 #if 0
1380 	struct ieee80211com *ic = &sc->sc_ic;
1381 
1382 #ifndef IEEE80211_STA_ONLY
1383 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1384 		/* one less beacon until next DTIM */
1385 		if (ic->ic_dtim_count == 0)
1386 			ic->ic_dtim_count = ic->ic_dtim_period - 1;
1387 		else
1388 			ic->ic_dtim_count--;
1389 
1390 		/* update dynamic parts of beacon */
1391 		rt2860_setup_beacon(sc);
1392 
1393 		/* flush buffered multicast frames */
1394 		if (ic->ic_dtim_count == 0)
1395 			ieee80211_notify_dtim(ic);
1396 	}
1397 #endif
1398 	/* check if protection mode has changed */
1399 	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
1400 		rt2860_updateprot(ic);
1401 		sc->sc_ic_flags = ic->ic_flags;
1402 	}
1403 #endif
1404 }
1405 
1406 static void
1407 rt2860_gp_intr(struct rt2860_softc *sc)
1408 {
1409 	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1410 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1411 
1412 	DPRINTFN(2, ("GP timeout state=%d\n", vap->iv_state));
1413 
1414 	if (vap->iv_state == IEEE80211_S_RUN)
1415 		rt2860_updatestats(sc);
1416 }
1417 
1418 void
1419 rt2860_intr(void *arg)
1420 {
1421 	struct rt2860_softc *sc = arg;
1422 	uint32_t r;
1423 
1424 	RAL_LOCK(sc);
1425 
1426 	r = RAL_READ(sc, RT2860_INT_STATUS);
1427 	if (__predict_false(r == 0xffffffff)) {
1428 		RAL_UNLOCK(sc);
1429 		return;	/* device likely went away */
1430 	}
1431 	if (r == 0) {
1432 		RAL_UNLOCK(sc);
1433 		return;	/* not for us */
1434 	}
1435 
1436 	/* acknowledge interrupts */
1437 	RAL_WRITE(sc, RT2860_INT_STATUS, r);
1438 
1439 	if (r & RT2860_TX_RX_COHERENT)
1440 		rt2860_intr_coherent(sc);
1441 
1442 	if (r & RT2860_MAC_INT_2)	/* TX status */
1443 		rt2860_drain_stats_fifo(sc);
1444 
1445 	if (r & RT2860_TX_DONE_INT5)
1446 		rt2860_tx_intr(sc, 5);
1447 
1448 	if (r & RT2860_RX_DONE_INT)
1449 		rt2860_rx_intr(sc);
1450 
1451 	if (r & RT2860_TX_DONE_INT4)
1452 		rt2860_tx_intr(sc, 4);
1453 
1454 	if (r & RT2860_TX_DONE_INT3)
1455 		rt2860_tx_intr(sc, 3);
1456 
1457 	if (r & RT2860_TX_DONE_INT2)
1458 		rt2860_tx_intr(sc, 2);
1459 
1460 	if (r & RT2860_TX_DONE_INT1)
1461 		rt2860_tx_intr(sc, 1);
1462 
1463 	if (r & RT2860_TX_DONE_INT0)
1464 		rt2860_tx_intr(sc, 0);
1465 
1466 	if (r & RT2860_MAC_INT_0)	/* TBTT */
1467 		rt2860_tbtt_intr(sc);
1468 
1469 	if (r & RT2860_MAC_INT_3)	/* Auto wakeup */
1470 		/* TBD wakeup */;
1471 
1472 	if (r & RT2860_MAC_INT_4)	/* GP timer */
1473 		rt2860_gp_intr(sc);
1474 
1475 	RAL_UNLOCK(sc);
1476 }
1477 
1478 static int
1479 rt2860_tx(struct rt2860_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1480 {
1481 	struct ifnet *ifp = sc->sc_ifp;
1482 	struct ieee80211com *ic = ifp->if_l2com;
1483 	struct ieee80211vap *vap = ni->ni_vap;
1484 	struct rt2860_tx_ring *ring;
1485 	struct rt2860_tx_data *data;
1486 	struct rt2860_txd *txd;
1487 	struct rt2860_txwi *txwi;
1488 	struct ieee80211_frame *wh;
1489 	const struct ieee80211_txparam *tp;
1490 	struct ieee80211_key *k;
1491 	struct mbuf *m1;
1492 	bus_dma_segment_t segs[RT2860_MAX_SCATTER];
1493 	bus_dma_segment_t *seg;
1494 	u_int hdrlen;
1495 	uint16_t qos, dur;
1496 	uint8_t type, qsel, mcs, pid, tid, qid;
1497 	int i, nsegs, ntxds, pad, rate, ridx, error;
1498 
1499 	/* the data pool contains at least one element, pick the first */
1500 	data = SLIST_FIRST(&sc->data_pool);
1501 
1502 	wh = mtod(m, struct ieee80211_frame *);
1503 
1504 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1505 		k = ieee80211_crypto_encap(ni, m);
1506 		if (k == NULL) {
1507 			m_freem(m);
1508 			return ENOBUFS;
1509 		}
1510 
1511 		/* packet header may have moved, reset our local pointer */
1512 		wh = mtod(m, struct ieee80211_frame *);
1513 	}
1514 
1515 	hdrlen = ieee80211_anyhdrsize(wh);
1516 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1517 
1518 	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1519 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1520 		rate = tp->mcastrate;
1521 	} else if (m->m_flags & M_EAPOL) {
1522 		rate = tp->mgmtrate;
1523 	} else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1524 		rate = tp->ucastrate;
1525 	} else {
1526 		(void) ieee80211_ratectl_rate(ni, NULL, 0);
1527 		rate = ni->ni_txrate;
1528 	}
1529 	rate &= IEEE80211_RATE_VAL;
1530 
1531 	qid = M_WME_GETAC(m);
1532 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1533 		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
1534 		tid = qos & IEEE80211_QOS_TID;
1535 	} else {
1536 		qos = 0;
1537 		tid = 0;
1538 	}
1539 	ring = &sc->txq[qid];
1540 	ridx = ieee80211_legacy_rate_lookup(ic->ic_rt, rate);
1541 
1542 	/* get MCS code from rate index */
1543 	mcs = rt2860_rates[ridx].mcs;
1544 
1545 	/* setup TX Wireless Information */
1546 	txwi = data->txwi;
1547 	txwi->flags = 0;
1548 	/* let HW generate seq numbers for non-QoS frames */
1549 	txwi->xflags = qos ? 0 : RT2860_TX_NSEQ;
1550 	if (type == IEEE80211_FC0_TYPE_DATA)
1551 		txwi->wcid = IEEE80211_AID(ni->ni_associd);
1552 	else
1553 		txwi->wcid = 0xff;
1554 	txwi->len = htole16(m->m_pkthdr.len);
1555 	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1556 		txwi->phy = htole16(RT2860_PHY_CCK);
1557 		if (ridx != RT2860_RIDX_CCK1 &&
1558 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1559 			mcs |= RT2860_PHY_SHPRE;
1560 	} else
1561 		txwi->phy = htole16(RT2860_PHY_OFDM);
1562 	txwi->phy |= htole16(mcs);
1563 
1564 	/*
1565 	 * We store the MCS code into the driver-private PacketID field.
1566 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1567 	 * that we know at which initial rate the frame was transmitted.
1568 	 * We add 1 to the MCS code because setting the PacketID field to
1569 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1570 	 */
1571 	pid = (mcs + 1) & 0xf;
1572 	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1573 
1574 	/* check if RTS/CTS or CTS-to-self protection is required */
1575 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1576 	    (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
1577 	     ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1578 	      rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
1579 		txwi->txop = RT2860_TX_TXOP_HT;
1580 	else
1581 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1582 
1583 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1584 	    (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
1585 	     IEEE80211_QOS_ACKPOLICY_NOACK)) {
1586 		txwi->xflags |= RT2860_TX_ACK;
1587 
1588 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1589 			dur = rt2860_rates[ridx].sp_ack_dur;
1590 		else
1591 			dur = rt2860_rates[ridx].lp_ack_dur;
1592 		*(uint16_t *)wh->i_dur = htole16(dur);
1593 	}
1594 	/* ask MAC to insert timestamp into probe responses */
1595 	if ((wh->i_fc[0] &
1596 	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1597 	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1598 	    /* NOTE: beacons do not pass through tx_data() */
1599 		txwi->flags |= RT2860_TX_TS;
1600 
1601 	if (ieee80211_radiotap_active_vap(vap)) {
1602 		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1603 
1604 		tap->wt_flags = 0;
1605 		tap->wt_rate = rate;
1606 		if (mcs & RT2860_PHY_SHPRE)
1607 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1608 
1609 		ieee80211_radiotap_tx(vap, m);
1610 	}
1611 
1612 	pad = (hdrlen + 3) & ~3;
1613 
1614 	/* copy and trim 802.11 header */
1615 	memcpy(txwi + 1, wh, hdrlen);
1616 	m_adj(m, hdrlen);
1617 
1618 	error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m, segs,
1619 	    &nsegs, 0);
1620 	if (__predict_false(error != 0 && error != EFBIG)) {
1621 		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1622 		    error);
1623 		m_freem(m);
1624 		return error;
1625 	}
1626 	if (__predict_true(error == 0)) {
1627 		/* determine how many TXDs are required */
1628 		ntxds = 1 + (nsegs / 2);
1629 
1630 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1631 			/* not enough free TXDs, force mbuf defrag */
1632 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1633 			error = EFBIG;
1634 		}
1635 	}
1636 	if (__predict_false(error != 0)) {
1637 		m1 = m_defrag(m, M_NOWAIT);
1638 		if (m1 == NULL) {
1639 			device_printf(sc->sc_dev,
1640 			    "could not defragment mbuf\n");
1641 			m_freem(m);
1642 			return ENOBUFS;
1643 		}
1644 		m = m1;
1645 
1646 		error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m,
1647 		    segs, &nsegs, 0);
1648 		if (__predict_false(error != 0)) {
1649 			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1650 			    error);
1651 			m_freem(m);
1652 			return error;
1653 		}
1654 
1655 		/* determine how many TXDs are now required */
1656 		ntxds = 1 + (nsegs / 2);
1657 
1658 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1659 			/* this is a hopeless case, drop the mbuf! */
1660 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1661 			m_freem(m);
1662 			return ENOBUFS;
1663 		}
1664 	}
1665 
1666 	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1667 
1668 	/* first segment is TXWI + 802.11 header */
1669 	txd = &ring->txd[ring->cur];
1670 	txd->sdp0 = htole32(data->paddr);
1671 	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
1672 	txd->flags = qsel;
1673 
1674 	/* setup payload segments */
1675 	seg = &segs[0];
1676 	for (i = nsegs; i >= 2; i -= 2) {
1677 		txd->sdp1 = htole32(seg->ds_addr);
1678 		txd->sdl1 = htole16(seg->ds_len);
1679 		seg++;
1680 		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1681 		/* grab a new Tx descriptor */
1682 		txd = &ring->txd[ring->cur];
1683 		txd->sdp0 = htole32(seg->ds_addr);
1684 		txd->sdl0 = htole16(seg->ds_len);
1685 		txd->flags = qsel;
1686 		seg++;
1687 	}
1688 	/* finalize last segment */
1689 	if (i > 0) {
1690 		txd->sdp1 = htole32(seg->ds_addr);
1691 		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1692 	} else {
1693 		txd->sdl0 |= htole16(RT2860_TX_LS0);
1694 		txd->sdl1 = 0;
1695 	}
1696 
1697 	/* remove from the free pool and link it into the SW Tx slot */
1698 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1699 	data->m = m;
1700 	data->ni = ni;
1701 	ring->data[ring->cur] = data;
1702 
1703 	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
1704 	bus_dmamap_sync(sc->txwi_dmat, data->map, BUS_DMASYNC_PREWRITE);
1705 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
1706 
1707 	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1708 	    qid, txwi->wcid, nsegs, ridx));
1709 
1710 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1711 	ring->queued += ntxds;
1712 	if (ring->queued >= RT2860_TX_RING_COUNT)
1713 		sc->qfullmsk |= 1 << qid;
1714 
1715 	/* kick Tx */
1716 	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1717 
1718 	return 0;
1719 }
1720 
1721 static int
1722 rt2860_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1723     const struct ieee80211_bpf_params *params)
1724 {
1725 	struct ieee80211com *ic = ni->ni_ic;
1726 	struct ifnet *ifp = ic->ic_ifp;
1727 	struct rt2860_softc *sc = ifp->if_softc;
1728 	int error;
1729 
1730 	RAL_LOCK(sc);
1731 
1732 	/* prevent management frames from being sent if we're not ready */
1733 	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1734 		RAL_UNLOCK(sc);
1735 		m_freem(m);
1736 		ieee80211_free_node(ni);
1737 		return ENETDOWN;
1738 	}
1739 	if (params == NULL) {
1740 		/*
1741 		 * Legacy path; interpret frame contents to decide
1742 		 * precisely how to send the frame.
1743 		 */
1744 		error = rt2860_tx(sc, m, ni);
1745 	} else {
1746 		/*
1747 		 * Caller supplied explicit parameters to use in
1748 		 * sending the frame.
1749 		 */
1750 		error = rt2860_tx_raw(sc, m, ni, params);
1751 	}
1752 	if (error != 0) {
1753 		/* NB: m is reclaimed on tx failure */
1754 		ieee80211_free_node(ni);
1755 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
1756 	}
1757 	sc->sc_tx_timer = 5;
1758 	RAL_UNLOCK(sc);
1759 	return error;
1760 }
1761 
1762 static int
1763 rt2860_tx_raw(struct rt2860_softc *sc, struct mbuf *m,
1764     struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
1765 {
1766 	struct ifnet *ifp = sc->sc_ifp;
1767 	struct ieee80211com *ic = ifp->if_l2com;
1768 	struct ieee80211vap *vap = ni->ni_vap;
1769 	struct rt2860_tx_ring *ring;
1770 	struct rt2860_tx_data *data;
1771 	struct rt2860_txd *txd;
1772 	struct rt2860_txwi *txwi;
1773 	struct ieee80211_frame *wh;
1774 	struct mbuf *m1;
1775 	bus_dma_segment_t segs[RT2860_MAX_SCATTER];
1776 	bus_dma_segment_t *seg;
1777 	u_int hdrlen;
1778 	uint16_t dur;
1779 	uint8_t type, qsel, mcs, pid, tid, qid;
1780 	int i, nsegs, ntxds, pad, rate, ridx, error;
1781 
1782 	/* the data pool contains at least one element, pick the first */
1783 	data = SLIST_FIRST(&sc->data_pool);
1784 
1785 	wh = mtod(m, struct ieee80211_frame *);
1786 	hdrlen = ieee80211_hdrsize(wh);
1787 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1788 
1789 	/* Choose a TX rate index. */
1790 	rate = params->ibp_rate0;
1791 	ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
1792 	    rate & IEEE80211_RATE_VAL);
1793 	if (ridx == (uint8_t)-1) {
1794 		/* XXX fall back to mcast/mgmt rate? */
1795 		m_freem(m);
1796 		return EINVAL;
1797 	}
1798 
1799 	qid = params->ibp_pri & 3;
1800 	tid = 0;
1801 	ring = &sc->txq[qid];
1802 
1803 	/* get MCS code from rate index */
1804 	mcs = rt2860_rates[ridx].mcs;
1805 
1806 	/* setup TX Wireless Information */
1807 	txwi = data->txwi;
1808 	txwi->flags = 0;
1809 	/* let HW generate seq numbers for non-QoS frames */
1810 	txwi->xflags = params->ibp_pri & 3 ? 0 : RT2860_TX_NSEQ;
1811 	txwi->wcid = 0xff;
1812 	txwi->len = htole16(m->m_pkthdr.len);
1813 	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1814 		txwi->phy = htole16(RT2860_PHY_CCK);
1815 		if (ridx != RT2860_RIDX_CCK1 &&
1816 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1817 			mcs |= RT2860_PHY_SHPRE;
1818 	} else
1819 		txwi->phy = htole16(RT2860_PHY_OFDM);
1820 	txwi->phy |= htole16(mcs);
1821 
1822 	/*
1823 	 * We store the MCS code into the driver-private PacketID field.
1824 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1825 	 * that we know at which initial rate the frame was transmitted.
1826 	 * We add 1 to the MCS code because setting the PacketID field to
1827 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1828 	 */
1829 	pid = (mcs + 1) & 0xf;
1830 	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1831 
1832 	/* check if RTS/CTS or CTS-to-self protection is required */
1833 	if (params->ibp_flags & IEEE80211_BPF_RTS ||
1834 	    params->ibp_flags & IEEE80211_BPF_CTS)
1835 		txwi->txop = RT2860_TX_TXOP_HT;
1836 	else
1837 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1838 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0) {
1839 		txwi->xflags |= RT2860_TX_ACK;
1840 
1841 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1842 			dur = rt2860_rates[ridx].sp_ack_dur;
1843 		else
1844 			dur = rt2860_rates[ridx].lp_ack_dur;
1845 		*(uint16_t *)wh->i_dur = htole16(dur);
1846 	}
1847 	/* ask MAC to insert timestamp into probe responses */
1848 	if ((wh->i_fc[0] &
1849 	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1850 	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1851 	    /* NOTE: beacons do not pass through tx_data() */
1852 		txwi->flags |= RT2860_TX_TS;
1853 
1854 	if (ieee80211_radiotap_active_vap(vap)) {
1855 		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1856 
1857 		tap->wt_flags = 0;
1858 		tap->wt_rate = rate;
1859 		if (mcs & RT2860_PHY_SHPRE)
1860 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1861 
1862 		ieee80211_radiotap_tx(vap, m);
1863 	}
1864 
1865 	pad = (hdrlen + 3) & ~3;
1866 
1867 	/* copy and trim 802.11 header */
1868 	memcpy(txwi + 1, wh, hdrlen);
1869 	m_adj(m, hdrlen);
1870 
1871 	error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m, segs,
1872 	    &nsegs, 0);
1873 	if (__predict_false(error != 0 && error != EFBIG)) {
1874 		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1875 		    error);
1876 		m_freem(m);
1877 		return error;
1878 	}
1879 	if (__predict_true(error == 0)) {
1880 		/* determine how many TXDs are required */
1881 		ntxds = 1 + (nsegs / 2);
1882 
1883 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1884 			/* not enough free TXDs, force mbuf defrag */
1885 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1886 			error = EFBIG;
1887 		}
1888 	}
1889 	if (__predict_false(error != 0)) {
1890 		m1 = m_defrag(m, M_NOWAIT);
1891 		if (m1 == NULL) {
1892 			device_printf(sc->sc_dev,
1893 			    "could not defragment mbuf\n");
1894 			m_freem(m);
1895 			return ENOBUFS;
1896 		}
1897 		m = m1;
1898 
1899 		error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m,
1900 		    segs, &nsegs, 0);
1901 		if (__predict_false(error != 0)) {
1902 			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1903 			    error);
1904 			m_freem(m);
1905 			return error;
1906 		}
1907 
1908 		/* determine how many TXDs are now required */
1909 		ntxds = 1 + (nsegs / 2);
1910 
1911 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1912 			/* this is a hopeless case, drop the mbuf! */
1913 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1914 			m_freem(m);
1915 			return ENOBUFS;
1916 		}
1917 	}
1918 
1919 	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1920 
1921 	/* first segment is TXWI + 802.11 header */
1922 	txd = &ring->txd[ring->cur];
1923 	txd->sdp0 = htole32(data->paddr);
1924 	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
1925 	txd->flags = qsel;
1926 
1927 	/* setup payload segments */
1928 	seg = &segs[0];
1929 	for (i = nsegs; i >= 2; i -= 2) {
1930 		txd->sdp1 = htole32(seg->ds_addr);
1931 		txd->sdl1 = htole16(seg->ds_len);
1932 		seg++;
1933 		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1934 		/* grab a new Tx descriptor */
1935 		txd = &ring->txd[ring->cur];
1936 		txd->sdp0 = htole32(seg->ds_addr);
1937 		txd->sdl0 = htole16(seg->ds_len);
1938 		txd->flags = qsel;
1939 		seg++;
1940 	}
1941 	/* finalize last segment */
1942 	if (i > 0) {
1943 		txd->sdp1 = htole32(seg->ds_addr);
1944 		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1945 	} else {
1946 		txd->sdl0 |= htole16(RT2860_TX_LS0);
1947 		txd->sdl1 = 0;
1948 	}
1949 
1950 	/* remove from the free pool and link it into the SW Tx slot */
1951 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1952 	data->m = m;
1953 	data->ni = ni;
1954 	ring->data[ring->cur] = data;
1955 
1956 	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
1957 	bus_dmamap_sync(sc->txwi_dmat, data->map, BUS_DMASYNC_PREWRITE);
1958 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
1959 
1960 	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1961 	    qid, txwi->wcid, nsegs, ridx));
1962 
1963 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1964 	ring->queued += ntxds;
1965 	if (ring->queued >= RT2860_TX_RING_COUNT)
1966 		sc->qfullmsk |= 1 << qid;
1967 
1968 	/* kick Tx */
1969 	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1970 
1971 	return 0;
1972 }
1973 
1974 static void
1975 rt2860_start(struct ifnet *ifp)
1976 {
1977 	struct rt2860_softc *sc = ifp->if_softc;
1978 
1979 	RAL_LOCK(sc);
1980 	rt2860_start_locked(ifp);
1981 	RAL_UNLOCK(sc);
1982 }
1983 
1984 static void
1985 rt2860_start_locked(struct ifnet *ifp)
1986 {
1987 	struct rt2860_softc *sc = ifp->if_softc;
1988 	struct ieee80211_node *ni;
1989 	struct mbuf *m;
1990 
1991 	RAL_LOCK_ASSERT(sc);
1992 
1993 	if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0 ||
1994 	    (ifp->if_drv_flags & IFF_DRV_OACTIVE))
1995 		return;
1996 
1997 	for (;;) {
1998 		if (SLIST_EMPTY(&sc->data_pool) || sc->qfullmsk != 0) {
1999 			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
2000 			break;
2001 		}
2002 		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
2003 		if (m == NULL)
2004 			break;
2005 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
2006 		if (rt2860_tx(sc, m, ni) != 0) {
2007 			ieee80211_free_node(ni);
2008 			if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
2009 			continue;
2010 		}
2011 		sc->sc_tx_timer = 5;
2012 	}
2013 }
2014 
2015 static void
2016 rt2860_watchdog(void *arg)
2017 {
2018 	struct rt2860_softc *sc = arg;
2019 	struct ifnet *ifp = sc->sc_ifp;
2020 
2021 	RAL_LOCK_ASSERT(sc);
2022 
2023 	KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
2024 
2025 	if (sc->sc_invalid)		/* card ejected */
2026 		return;
2027 
2028 	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
2029 		if_printf(ifp, "device timeout\n");
2030 		rt2860_stop_locked(sc);
2031 		rt2860_init_locked(sc);
2032 		if_inc_counter(ifp, IFCOUNTER_OERRORS, 1);
2033 		return;
2034 	}
2035 	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
2036 }
2037 
2038 static int
2039 rt2860_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
2040 {
2041 	struct rt2860_softc *sc = ifp->if_softc;
2042 	struct ieee80211com *ic = ifp->if_l2com;
2043 	struct ifreq *ifr = (struct ifreq *)data;
2044 	int error = 0, startall = 0;
2045 
2046 	switch (cmd) {
2047 	case SIOCSIFFLAGS:
2048 		RAL_LOCK(sc);
2049 		if (ifp->if_flags & IFF_UP) {
2050 			if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
2051 				rt2860_init_locked(sc);
2052 				startall = 1;
2053 			} else
2054 				rt2860_update_promisc(ifp);
2055 		} else {
2056 			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2057 				rt2860_stop_locked(sc);
2058 		}
2059 		RAL_UNLOCK(sc);
2060 		if (startall)
2061 			ieee80211_start_all(ic);
2062 		break;
2063 	case SIOCGIFMEDIA:
2064 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2065 		break;
2066 	case SIOCSIFADDR:
2067 		error = ether_ioctl(ifp, cmd, data);
2068 		break;
2069 	default:
2070 		error = EINVAL;
2071 		break;
2072 	}
2073 	return error;
2074 }
2075 
2076 /*
2077  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
2078  * We access the BBP through the 8051 microcontroller unit which means that
2079  * the microcode must be loaded first.
2080  */
2081 void
2082 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2083 {
2084 	int ntries;
2085 
2086 	for (ntries = 0; ntries < 100; ntries++) {
2087 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2088 			break;
2089 		DELAY(1);
2090 	}
2091 	if (ntries == 100) {
2092 		device_printf(sc->sc_dev,
2093 			"could not write to BBP through MCU\n");
2094 		return;
2095 	}
2096 
2097 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2098 	    RT2860_BBP_CSR_KICK | reg << 8 | val);
2099 	RAL_BARRIER_WRITE(sc);
2100 
2101 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
2102 	DELAY(1000);
2103 }
2104 
2105 uint8_t
2106 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
2107 {
2108 	uint32_t val;
2109 	int ntries;
2110 
2111 	for (ntries = 0; ntries < 100; ntries++) {
2112 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2113 			break;
2114 		DELAY(1);
2115 	}
2116 	if (ntries == 100) {
2117 		device_printf(sc->sc_dev,
2118 		    "could not read from BBP through MCU\n");
2119 		return 0;
2120 	}
2121 
2122 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2123 	    RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
2124 	RAL_BARRIER_WRITE(sc);
2125 
2126 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
2127 	DELAY(1000);
2128 
2129 	for (ntries = 0; ntries < 100; ntries++) {
2130 		val = RAL_READ(sc, RT2860_H2M_BBPAGENT);
2131 		if (!(val & RT2860_BBP_CSR_KICK))
2132 			return val & 0xff;
2133 		DELAY(1);
2134 	}
2135 	device_printf(sc->sc_dev, "could not read from BBP through MCU\n");
2136 
2137 	return 0;
2138 }
2139 
2140 /*
2141  * Write to one of the 4 programmable 24-bit RF registers.
2142  */
2143 static void
2144 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
2145 {
2146 	uint32_t tmp;
2147 	int ntries;
2148 
2149 	for (ntries = 0; ntries < 100; ntries++) {
2150 		if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
2151 			break;
2152 		DELAY(1);
2153 	}
2154 	if (ntries == 100) {
2155 		device_printf(sc->sc_dev, "could not write to RF\n");
2156 		return;
2157 	}
2158 
2159 	/* RF registers are 24-bit on the RT2860 */
2160 	tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
2161 	    (val & 0x3fffff) << 2 | (reg & 3);
2162 	RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
2163 }
2164 
2165 static uint8_t
2166 rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
2167 {
2168 	uint32_t tmp;
2169 	int ntries;
2170 
2171 	for (ntries = 0; ntries < 100; ntries++) {
2172 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
2173 			break;
2174 		DELAY(1);
2175 	}
2176 	if (ntries == 100) {
2177 		device_printf(sc->sc_dev, "could not read RF register\n");
2178 		return 0xff;
2179 	}
2180 	tmp = RT3070_RF_KICK | reg << 8;
2181 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
2182 
2183 	for (ntries = 0; ntries < 100; ntries++) {
2184 		tmp = RAL_READ(sc, RT3070_RF_CSR_CFG);
2185 		if (!(tmp & RT3070_RF_KICK))
2186 			break;
2187 		DELAY(1);
2188 	}
2189 	if (ntries == 100) {
2190 		device_printf(sc->sc_dev, "could not read RF register\n");
2191 		return 0xff;
2192 	}
2193 	return tmp & 0xff;
2194 }
2195 
2196 void
2197 rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2198 {
2199 	uint32_t tmp;
2200 	int ntries;
2201 
2202 	for (ntries = 0; ntries < 10; ntries++) {
2203 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
2204 			break;
2205 		DELAY(10);
2206 	}
2207 	if (ntries == 10) {
2208 		device_printf(sc->sc_dev, "could not write to RF\n");
2209 		return;
2210 	}
2211 
2212 	tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
2213 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
2214 }
2215 
2216 /*
2217  * Send a command to the 8051 microcontroller unit.
2218  */
2219 int
2220 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
2221 {
2222 	int slot, ntries;
2223 	uint32_t tmp;
2224 	uint8_t cid;
2225 
2226 	for (ntries = 0; ntries < 100; ntries++) {
2227 		if (!(RAL_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
2228 			break;
2229 		DELAY(2);
2230 	}
2231 	if (ntries == 100)
2232 		return EIO;
2233 
2234 	cid = wait ? cmd : RT2860_TOKEN_NO_INTR;
2235 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY | cid << 16 | arg);
2236 	RAL_BARRIER_WRITE(sc);
2237 	RAL_WRITE(sc, RT2860_HOST_CMD, cmd);
2238 
2239 	if (!wait)
2240 		return 0;
2241 	/* wait for the command to complete */
2242 	for (ntries = 0; ntries < 200; ntries++) {
2243 		tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID);
2244 		/* find the command slot */
2245 		for (slot = 0; slot < 4; slot++, tmp >>= 8)
2246 			if ((tmp & 0xff) == cid)
2247 				break;
2248 		if (slot < 4)
2249 			break;
2250 		DELAY(100);
2251 	}
2252 	if (ntries == 200) {
2253 		/* clear command and status */
2254 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2255 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2256 		return ETIMEDOUT;
2257 	}
2258 	/* get command status (1 means success) */
2259 	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS);
2260 	tmp = (tmp >> (slot * 8)) & 0xff;
2261 	DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
2262 	    cmd, slot, tmp));
2263 	/* clear command and status */
2264 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2265 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2266 	return (tmp == 1) ? 0 : EIO;
2267 }
2268 
2269 static void
2270 rt2860_enable_mrr(struct rt2860_softc *sc)
2271 {
2272 #define CCK(mcs)	(mcs)
2273 #define OFDM(mcs)	(1 << 3 | (mcs))
2274 	RAL_WRITE(sc, RT2860_LG_FBK_CFG0,
2275 	    OFDM(6) << 28 |	/* 54->48 */
2276 	    OFDM(5) << 24 |	/* 48->36 */
2277 	    OFDM(4) << 20 |	/* 36->24 */
2278 	    OFDM(3) << 16 |	/* 24->18 */
2279 	    OFDM(2) << 12 |	/* 18->12 */
2280 	    OFDM(1) <<  8 |	/* 12-> 9 */
2281 	    OFDM(0) <<  4 |	/*  9-> 6 */
2282 	    OFDM(0));		/*  6-> 6 */
2283 
2284 	RAL_WRITE(sc, RT2860_LG_FBK_CFG1,
2285 	    CCK(2) << 12 |	/* 11->5.5 */
2286 	    CCK(1) <<  8 |	/* 5.5-> 2 */
2287 	    CCK(0) <<  4 |	/*   2-> 1 */
2288 	    CCK(0));		/*   1-> 1 */
2289 #undef OFDM
2290 #undef CCK
2291 }
2292 
2293 static void
2294 rt2860_set_txpreamble(struct rt2860_softc *sc)
2295 {
2296 	struct ifnet *ifp = sc->sc_ifp;
2297 	struct ieee80211com *ic = ifp->if_l2com;
2298 	uint32_t tmp;
2299 
2300 	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
2301 	tmp &= ~RT2860_CCK_SHORT_EN;
2302 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
2303 		tmp |= RT2860_CCK_SHORT_EN;
2304 	RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
2305 }
2306 
2307 void
2308 rt2860_set_basicrates(struct rt2860_softc *sc,
2309     const struct ieee80211_rateset *rs)
2310 {
2311 #define RV(r)	((r) & IEEE80211_RATE_VAL)
2312 	struct ifnet *ifp = sc->sc_ifp;
2313 	struct ieee80211com *ic = ifp->if_l2com;
2314 	uint32_t mask = 0;
2315 	uint8_t rate;
2316 	int i;
2317 
2318 	for (i = 0; i < rs->rs_nrates; i++) {
2319 		rate = rs->rs_rates[i];
2320 
2321 		if (!(rate & IEEE80211_RATE_BASIC))
2322 			continue;
2323 
2324 		mask |= 1 << ieee80211_legacy_rate_lookup(ic->ic_rt, RV(rate));
2325 	}
2326 
2327 	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, mask);
2328 #undef RV
2329 }
2330 
2331 static void
2332 rt2860_scan_start(struct ieee80211com *ic)
2333 {
2334 	struct ifnet *ifp = ic->ic_ifp;
2335 	struct rt2860_softc *sc = ifp->if_softc;
2336 	uint32_t tmp;
2337 
2338 	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
2339 	RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
2340 	    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
2341 	    RT2860_TBTT_TIMER_EN));
2342 	rt2860_set_gp_timer(sc, 0);
2343 }
2344 
2345 static void
2346 rt2860_scan_end(struct ieee80211com *ic)
2347 {
2348 	struct ifnet *ifp = ic->ic_ifp;
2349 	struct rt2860_softc *sc = ifp->if_softc;
2350 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2351 
2352 	if (vap->iv_state == IEEE80211_S_RUN) {
2353 		rt2860_enable_tsf_sync(sc);
2354 		rt2860_set_gp_timer(sc, 500);
2355 	}
2356 }
2357 
2358 static void
2359 rt2860_set_channel(struct ieee80211com *ic)
2360 {
2361 	struct ifnet *ifp = ic->ic_ifp;
2362 	struct rt2860_softc *sc = ifp->if_softc;
2363 
2364 	RAL_LOCK(sc);
2365 	rt2860_switch_chan(sc, ic->ic_curchan);
2366 	RAL_UNLOCK(sc);
2367 }
2368 
2369 static void
2370 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2371 {
2372 	uint32_t tmp;
2373 	uint8_t agc;
2374 
2375 	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2376 	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2377 	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2378 	rt2860_mcu_bbp_write(sc, 86, 0x00);
2379 
2380 	if (group == 0) {
2381 		if (sc->ext_2ghz_lna) {
2382 			rt2860_mcu_bbp_write(sc, 82, 0x62);
2383 			rt2860_mcu_bbp_write(sc, 75, 0x46);
2384 		} else {
2385 			rt2860_mcu_bbp_write(sc, 82, 0x84);
2386 			rt2860_mcu_bbp_write(sc, 75, 0x50);
2387 		}
2388 	} else {
2389 		if (sc->ext_5ghz_lna) {
2390 			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2391 			rt2860_mcu_bbp_write(sc, 75, 0x46);
2392 		} else {
2393 			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2394 			rt2860_mcu_bbp_write(sc, 75, 0x50);
2395 		}
2396 	}
2397 
2398 	tmp = RAL_READ(sc, RT2860_TX_BAND_CFG);
2399 	tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
2400 	tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
2401 	RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
2402 
2403 	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2404 	tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
2405 	if (sc->nrxchains > 1)
2406 		tmp |= RT2860_LNA_PE1_EN;
2407 	if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
2408 		tmp |= RT3593_LNA_PE2_EN;
2409 	if (group == 0) {	/* 2GHz */
2410 		tmp |= RT2860_PA_PE_G0_EN;
2411 		if (sc->ntxchains > 1)
2412 			tmp |= RT2860_PA_PE_G1_EN;
2413 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2414 			tmp |= RT3593_PA_PE_G2_EN;
2415 	} else {		/* 5GHz */
2416 		tmp |= RT2860_PA_PE_A0_EN;
2417 		if (sc->ntxchains > 1)
2418 			tmp |= RT2860_PA_PE_A1_EN;
2419 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2420 			tmp |= RT3593_PA_PE_A2_EN;
2421 	}
2422 	RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2423 
2424 	if (sc->mac_ver == 0x3593) {
2425 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
2426 		if (sc->sc_flags & RT2860_PCIE) {
2427 			tmp &= ~0x01010000;
2428 			if (group == 0)
2429 				tmp |= 0x00010000;
2430 		} else {
2431 			tmp &= ~0x00008080;
2432 			if (group == 0)
2433 				tmp |= 0x00000080;
2434 		}
2435 		tmp = (tmp & ~0x00001000) | 0x00000010;
2436 		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp);
2437 	}
2438 
2439 	/* set initial AGC value */
2440 	if (group == 0) {	/* 2GHz band */
2441 		if (sc->mac_ver >= 0x3071)
2442 			agc = 0x1c + sc->lna[0] * 2;
2443 		else
2444 			agc = 0x2e + sc->lna[0];
2445 	} else {		/* 5GHz band */
2446 		agc = 0x32 + (sc->lna[group] * 5) / 3;
2447 	}
2448 	rt2860_mcu_bbp_write(sc, 66, agc);
2449 
2450 	DELAY(1000);
2451 }
2452 
2453 static void
2454 rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
2455 {
2456 	const struct rfprog *rfprog = rt2860_rf2850;
2457 	uint32_t r2, r3, r4;
2458 	int8_t txpow1, txpow2;
2459 	u_int i;
2460 
2461 	/* find the settings for this channel (we know it exists) */
2462 	for (i = 0; rfprog[i].chan != chan; i++);
2463 
2464 	r2 = rfprog[i].r2;
2465 	if (sc->ntxchains == 1)
2466 		r2 |= 1 << 12;		/* 1T: disable Tx chain 2 */
2467 	if (sc->nrxchains == 1)
2468 		r2 |= 1 << 15 | 1 << 4;	/* 1R: disable Rx chains 2 & 3 */
2469 	else if (sc->nrxchains == 2)
2470 		r2 |= 1 << 4;		/* 2R: disable Rx chain 3 */
2471 
2472 	/* use Tx power values from EEPROM */
2473 	txpow1 = sc->txpow1[i];
2474 	txpow2 = sc->txpow2[i];
2475 	if (chan > 14) {
2476 		if (txpow1 >= 0)
2477 			txpow1 = txpow1 << 1 | 1;
2478 		else
2479 			txpow1 = (7 + txpow1) << 1;
2480 		if (txpow2 >= 0)
2481 			txpow2 = txpow2 << 1 | 1;
2482 		else
2483 			txpow2 = (7 + txpow2) << 1;
2484 	}
2485 	r3 = rfprog[i].r3 | txpow1 << 7;
2486 	r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
2487 
2488 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2489 	rt2860_rf_write(sc, RT2860_RF2, r2);
2490 	rt2860_rf_write(sc, RT2860_RF3, r3);
2491 	rt2860_rf_write(sc, RT2860_RF4, r4);
2492 
2493 	DELAY(200);
2494 
2495 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2496 	rt2860_rf_write(sc, RT2860_RF2, r2);
2497 	rt2860_rf_write(sc, RT2860_RF3, r3 | 1);
2498 	rt2860_rf_write(sc, RT2860_RF4, r4);
2499 
2500 	DELAY(200);
2501 
2502 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2503 	rt2860_rf_write(sc, RT2860_RF2, r2);
2504 	rt2860_rf_write(sc, RT2860_RF3, r3);
2505 	rt2860_rf_write(sc, RT2860_RF4, r4);
2506 }
2507 
2508 static void
2509 rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
2510 {
2511 	int8_t txpow1, txpow2;
2512 	uint8_t rf;
2513 	int i;
2514 
2515 	/* RT3090 is 2GHz only */
2516 	KASSERT(chan >= 1 && chan <= 14, ("chan %d not support", chan));
2517 
2518 	/* find the settings for this channel (we know it exists) */
2519 	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2520 
2521 	/* use Tx power values from EEPROM */
2522 	txpow1 = sc->txpow1[i];
2523 	txpow2 = sc->txpow2[i];
2524 
2525 	rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
2526 	rf = rt3090_rf_read(sc, 3);
2527 	rf = (rf & ~0x0f) | rt3090_freqs[i].k;
2528 	rt3090_rf_write(sc, 3, rf);
2529 	rf = rt3090_rf_read(sc, 6);
2530 	rf = (rf & ~0x03) | rt3090_freqs[i].r;
2531 	rt3090_rf_write(sc, 6, rf);
2532 
2533 	/* set Tx0 power */
2534 	rf = rt3090_rf_read(sc, 12);
2535 	rf = (rf & ~0x1f) | txpow1;
2536 	rt3090_rf_write(sc, 12, rf);
2537 
2538 	/* set Tx1 power */
2539 	rf = rt3090_rf_read(sc, 13);
2540 	rf = (rf & ~0x1f) | txpow2;
2541 	rt3090_rf_write(sc, 13, rf);
2542 
2543 	rf = rt3090_rf_read(sc, 1);
2544 	rf &= ~0xfc;
2545 	if (sc->ntxchains == 1)
2546 		rf |= RT3070_TX1_PD | RT3070_TX2_PD;
2547 	else if (sc->ntxchains == 2)
2548 		rf |= RT3070_TX2_PD;
2549 	if (sc->nrxchains == 1)
2550 		rf |= RT3070_RX1_PD | RT3070_RX2_PD;
2551 	else if (sc->nrxchains == 2)
2552 		rf |= RT3070_RX2_PD;
2553 	rt3090_rf_write(sc, 1, rf);
2554 
2555 	/* set RF offset */
2556 	rf = rt3090_rf_read(sc, 23);
2557 	rf = (rf & ~0x7f) | sc->freq;
2558 	rt3090_rf_write(sc, 23, rf);
2559 
2560 	/* program RF filter */
2561 	rf = rt3090_rf_read(sc, 24);	/* Tx */
2562 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2563 	rt3090_rf_write(sc, 24, rf);
2564 	rf = rt3090_rf_read(sc, 31);	/* Rx */
2565 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2566 	rt3090_rf_write(sc, 31, rf);
2567 
2568 	/* enable RF tuning */
2569 	rf = rt3090_rf_read(sc, 7);
2570 	rt3090_rf_write(sc, 7, rf | RT3070_TUNE);
2571 }
2572 
2573 static void
2574 rt5390_set_chan(struct rt2860_softc *sc, u_int chan)
2575 {
2576 	uint8_t h20mhz, rf, tmp;
2577 	int8_t txpow1, txpow2;
2578 	int i;
2579 
2580 	/* RT5390 is 2GHz only */
2581 	KASSERT(chan >= 1 && chan <= 14, ("chan %d not support", chan));
2582 
2583 	/* find the settings for this channel (we know it exists) */
2584 	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2585 
2586 	/* use Tx power values from EEPROM */
2587 	txpow1 = sc->txpow1[i];
2588 	txpow2 = sc->txpow2[i];
2589 
2590 	rt3090_rf_write(sc, 8, rt3090_freqs[i].n);
2591 	rt3090_rf_write(sc, 9, rt3090_freqs[i].k & 0x0f);
2592 	rf = rt3090_rf_read(sc, 11);
2593 	rf = (rf & ~0x03) | (rt3090_freqs[i].r & 0x03);
2594 	rt3090_rf_write(sc, 11, rf);
2595 
2596 	rf = rt3090_rf_read(sc, 49);
2597 	rf = (rf & ~0x3f) | (txpow1 & 0x3f);
2598 	/* the valid range of the RF R49 is 0x00~0x27 */
2599 	if ((rf & 0x3f) > 0x27)
2600 		rf = (rf & ~0x3f) | 0x27;
2601 	rt3090_rf_write(sc, 49, rf);
2602 	if (sc->mac_ver == 0x5392) {
2603 		rf = rt3090_rf_read(sc, 50);
2604 		rf = (rf & ~0x3f) | (txpow2 & 0x3f);
2605 		/* the valid range of the RF R50 is 0x00~0x27 */
2606 		if ((rf & 0x3f) > 0x27)
2607 			rf = (rf & ~0x3f) | 0x27;
2608 		rt3090_rf_write(sc, 50, rf);
2609 	}
2610 
2611 	rf = rt3090_rf_read(sc, 1);
2612 	rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
2613 	if (sc->mac_ver == 0x5392)
2614 		rf |= RT3070_RX1_PD | RT3070_TX1_PD;
2615 	rt3090_rf_write(sc, 1, rf);
2616 
2617 	rf = rt3090_rf_read(sc, 2);
2618 	rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2619 	DELAY(1000);
2620 	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
2621 
2622 	rf = rt3090_rf_read(sc, 17);
2623 	tmp = rf;
2624 	rf = (rf & ~0x7f) | (sc->freq & 0x7f);
2625 	rf = MIN(rf, 0x5f);
2626 	if (tmp != rf)
2627 		rt2860_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf, 0);
2628 
2629 	if (sc->mac_ver == 0x5390) {
2630 		if (chan <= 4)
2631 			rf = 0x73;
2632 		else if (chan >= 5 && chan <= 6)
2633 			rf = 0x63;
2634 		else if (chan >= 7 && chan <= 10)
2635 			rf = 0x53;
2636 		else
2637 			rf = 43;
2638 		rt3090_rf_write(sc, 55, rf);
2639 
2640 		if (chan == 1)
2641 			rf = 0x0c;
2642 		else if (chan == 2)
2643 			rf = 0x0b;
2644 		else if (chan == 3)
2645 			rf = 0x0a;
2646 		else if (chan >= 4 && chan <= 6)
2647 			rf = 0x09;
2648 		else if (chan >= 7 && chan <= 12)
2649 			rf = 0x08;
2650 		else if (chan == 13)
2651 			rf = 0x07;
2652 		else
2653 			rf = 0x06;
2654 		rt3090_rf_write(sc, 59, rf);
2655 	}
2656 
2657 	/* Tx/Rx h20M */
2658 	h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
2659 	rf = rt3090_rf_read(sc, 30);
2660 	rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
2661 	rt3090_rf_write(sc, 30, rf);
2662 
2663 	/* Rx BB filter VCM */
2664 	rf = rt3090_rf_read(sc, 30);
2665 	rf = (rf & ~0x18) | 0x10;
2666 	rt3090_rf_write(sc, 30, rf);
2667 
2668 	/* Initiate VCO calibration. */
2669 	rf = rt3090_rf_read(sc, 3);
2670 	rf |= RT3593_VCOCAL;
2671 	rt3090_rf_write(sc, 3, rf);
2672 }
2673 
2674 static int
2675 rt3090_rf_init(struct rt2860_softc *sc)
2676 {
2677 	uint32_t tmp;
2678 	uint8_t rf, bbp;
2679 	int i;
2680 
2681 	rf = rt3090_rf_read(sc, 30);
2682 	/* toggle RF R30 bit 7 */
2683 	rt3090_rf_write(sc, 30, rf | 0x80);
2684 	DELAY(1000);
2685 	rt3090_rf_write(sc, 30, rf & ~0x80);
2686 
2687 	tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2688 	tmp &= ~0x1f000000;
2689 	if (sc->patch_dac && sc->mac_rev < 0x0211)
2690 		tmp |= 0x0d000000;	/* 1.35V */
2691 	else
2692 		tmp |= 0x01000000;	/* 1.2V */
2693 	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2694 
2695 	/* patch LNA_PE_G1 */
2696 	tmp = RAL_READ(sc, RT3070_GPIO_SWITCH);
2697 	RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
2698 
2699 	/* initialize RF registers to default value */
2700 	for (i = 0; i < nitems(rt3090_def_rf); i++) {
2701 		rt3090_rf_write(sc, rt3090_def_rf[i].reg,
2702 		    rt3090_def_rf[i].val);
2703 	}
2704 
2705 	/* select 20MHz bandwidth */
2706 	rt3090_rf_write(sc, 31, 0x14);
2707 
2708 	rf = rt3090_rf_read(sc, 6);
2709 	rt3090_rf_write(sc, 6, rf | 0x40);
2710 
2711 	if (sc->mac_ver != 0x3593) {
2712 		/* calibrate filter for 20MHz bandwidth */
2713 		sc->rf24_20mhz = 0x1f;	/* default value */
2714 		rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
2715 
2716 		/* select 40MHz bandwidth */
2717 		bbp = rt2860_mcu_bbp_read(sc, 4);
2718 		rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) | 0x10);
2719 		rf = rt3090_rf_read(sc, 31);
2720 		rt3090_rf_write(sc, 31, rf | 0x20);
2721 
2722 		/* calibrate filter for 40MHz bandwidth */
2723 		sc->rf24_40mhz = 0x2f;	/* default value */
2724 		rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
2725 
2726 		/* go back to 20MHz bandwidth */
2727 		bbp = rt2860_mcu_bbp_read(sc, 4);
2728 		rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
2729 	}
2730 	if (sc->mac_rev < 0x0211)
2731 		rt3090_rf_write(sc, 27, 0x03);
2732 
2733 	tmp = RAL_READ(sc, RT3070_OPT_14);
2734 	RAL_WRITE(sc, RT3070_OPT_14, tmp | 1);
2735 
2736 	if (sc->rf_rev == RT3070_RF_3020)
2737 		rt3090_set_rx_antenna(sc, 0);
2738 
2739 	bbp = rt2860_mcu_bbp_read(sc, 138);
2740 	if (sc->mac_ver == 0x3593) {
2741 		if (sc->ntxchains == 1)
2742 			bbp |= 0x60;	/* turn off DAC1 and DAC2 */
2743 		else if (sc->ntxchains == 2)
2744 			bbp |= 0x40;	/* turn off DAC2 */
2745 		if (sc->nrxchains == 1)
2746 			bbp &= ~0x06;	/* turn off ADC1 and ADC2 */
2747 		else if (sc->nrxchains == 2)
2748 			bbp &= ~0x04;	/* turn off ADC2 */
2749 	} else {
2750 		if (sc->ntxchains == 1)
2751 			bbp |= 0x20;	/* turn off DAC1 */
2752 		if (sc->nrxchains == 1)
2753 			bbp &= ~0x02;	/* turn off ADC1 */
2754 	}
2755 	rt2860_mcu_bbp_write(sc, 138, bbp);
2756 
2757 	rf = rt3090_rf_read(sc, 1);
2758 	rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
2759 	rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
2760 	rt3090_rf_write(sc, 1, rf);
2761 
2762 	rf = rt3090_rf_read(sc, 15);
2763 	rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
2764 
2765 	rf = rt3090_rf_read(sc, 17);
2766 	rf &= ~RT3070_TX_LO1;
2767 	if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
2768 		rf |= 0x20;	/* fix for long range Rx issue */
2769 	if (sc->txmixgain_2ghz >= 2)
2770 		rf = (rf & ~0x7) | sc->txmixgain_2ghz;
2771 	rt3090_rf_write(sc, 17, rf);
2772 
2773 	rf = rt3090_rf_read(sc, 20);
2774 	rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
2775 
2776 	rf = rt3090_rf_read(sc, 21);
2777 	rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
2778 
2779 	return (0);
2780 }
2781 
2782 static void
2783 rt5390_rf_init(struct rt2860_softc *sc)
2784 {
2785 	uint8_t rf, bbp;
2786 	int i;
2787 
2788 	rf = rt3090_rf_read(sc, 2);
2789 	/* Toggle RF R2 bit 7. */
2790 	rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2791 	DELAY(1000);
2792 	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
2793 
2794 	/* Initialize RF registers to default value. */
2795 	if (sc->mac_ver == 0x5392) {
2796 		for (i = 0; i < nitems(rt5392_def_rf); i++) {
2797 			rt3090_rf_write(sc, rt5392_def_rf[i].reg,
2798 			    rt5392_def_rf[i].val);
2799 		}
2800 	} else {
2801 		for (i = 0; i < nitems(rt5390_def_rf); i++) {
2802 			rt3090_rf_write(sc, rt5390_def_rf[i].reg,
2803 			    rt5390_def_rf[i].val);
2804 		}
2805 	}
2806 
2807 	sc->rf24_20mhz = 0x1f;
2808 	sc->rf24_40mhz = 0x2f;
2809 
2810 	if (sc->mac_rev < 0x0211)
2811 		rt3090_rf_write(sc, 27, 0x03);
2812 
2813 	/* Set led open drain enable. */
2814 	RAL_WRITE(sc, RT3070_OPT_14, RAL_READ(sc, RT3070_OPT_14) | 1);
2815 
2816 	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
2817 	RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
2818 
2819 	if (sc->mac_ver == 0x5390)
2820 		rt3090_set_rx_antenna(sc, 0);
2821 
2822 	/* Patch RSSI inaccurate issue. */
2823 	rt2860_mcu_bbp_write(sc, 79, 0x13);
2824 	rt2860_mcu_bbp_write(sc, 80, 0x05);
2825 	rt2860_mcu_bbp_write(sc, 81, 0x33);
2826 
2827 	/* Enable DC filter. */
2828 	if (sc->mac_rev >= 0x0211)
2829 		rt2860_mcu_bbp_write(sc, 103, 0xc0);
2830 
2831 	bbp = rt2860_mcu_bbp_read(sc, 138);
2832 	if (sc->ntxchains == 1)
2833 		bbp |= 0x20;	/* Turn off DAC1. */
2834 	if (sc->nrxchains == 1)
2835 		bbp &= ~0x02;	/* Turn off ADC1. */
2836 	rt2860_mcu_bbp_write(sc, 138, bbp);
2837 
2838 	/* Enable RX LO1 and LO2. */
2839 	rt3090_rf_write(sc, 38, rt3090_rf_read(sc, 38) & ~RT5390_RX_LO1);
2840 	rt3090_rf_write(sc, 39, rt3090_rf_read(sc, 39) & ~RT5390_RX_LO2);
2841 
2842 	/* Avoid data lost and CRC error. */
2843 	rt2860_mcu_bbp_write(sc, 4,
2844 	    rt2860_mcu_bbp_read(sc, 4) | RT5390_MAC_IF_CTRL);
2845 
2846 	rf = rt3090_rf_read(sc, 30);
2847 	rf = (rf & ~0x18) | 0x10;
2848 	rt3090_rf_write(sc, 30, rf);
2849 }
2850 
2851 static void
2852 rt3090_rf_wakeup(struct rt2860_softc *sc)
2853 {
2854 	uint32_t tmp;
2855 	uint8_t rf;
2856 
2857 	if (sc->mac_ver == 0x3593) {
2858 		/* enable VCO */
2859 		rf = rt3090_rf_read(sc, 1);
2860 		rt3090_rf_write(sc, 1, rf | RT3593_VCO);
2861 
2862 		/* initiate VCO calibration */
2863 		rf = rt3090_rf_read(sc, 3);
2864 		rt3090_rf_write(sc, 3, rf | RT3593_VCOCAL);
2865 
2866 		/* enable VCO bias current control */
2867 		rf = rt3090_rf_read(sc, 6);
2868 		rt3090_rf_write(sc, 6, rf | RT3593_VCO_IC);
2869 
2870 		/* initiate res calibration */
2871 		rf = rt3090_rf_read(sc, 2);
2872 		rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2873 
2874 		/* set reference current control to 0.33 mA */
2875 		rf = rt3090_rf_read(sc, 22);
2876 		rf &= ~RT3593_CP_IC_MASK;
2877 		rf |= 1 << RT3593_CP_IC_SHIFT;
2878 		rt3090_rf_write(sc, 22, rf);
2879 
2880 		/* enable RX CTB */
2881 		rf = rt3090_rf_read(sc, 46);
2882 		rt3090_rf_write(sc, 46, rf | RT3593_RX_CTB);
2883 
2884 		rf = rt3090_rf_read(sc, 20);
2885 		rf &= ~(RT3593_LDO_RF_VC_MASK | RT3593_LDO_PLL_VC_MASK);
2886 		rt3090_rf_write(sc, 20, rf);
2887 	} else {
2888 		/* enable RF block */
2889 		rf = rt3090_rf_read(sc, 1);
2890 		rt3090_rf_write(sc, 1, rf | RT3070_RF_BLOCK);
2891 
2892 		/* enable VCO bias current control */
2893 		rf = rt3090_rf_read(sc, 7);
2894 		rt3090_rf_write(sc, 7, rf | 0x30);
2895 
2896 		rf = rt3090_rf_read(sc, 9);
2897 		rt3090_rf_write(sc, 9, rf | 0x0e);
2898 
2899 		/* enable RX CTB */
2900 		rf = rt3090_rf_read(sc, 21);
2901 		rt3090_rf_write(sc, 21, rf | RT3070_RX_CTB);
2902 
2903 		/* fix Tx to Rx IQ glitch by raising RF voltage */
2904 		rf = rt3090_rf_read(sc, 27);
2905 		rf &= ~0x77;
2906 		if (sc->mac_rev < 0x0211)
2907 			rf |= 0x03;
2908 		rt3090_rf_write(sc, 27, rf);
2909 	}
2910 	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2911 		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2912 		tmp = (tmp & ~0x1f000000) | 0x0d000000;
2913 		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2914 	}
2915 }
2916 
2917 static void
2918 rt5390_rf_wakeup(struct rt2860_softc *sc)
2919 {
2920 	uint32_t tmp;
2921 	uint8_t rf;
2922 
2923 	rf = rt3090_rf_read(sc, 1);
2924 	rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD |
2925 	    RT3070_TX0_PD;
2926 	if (sc->mac_ver == 0x5392)
2927 		rf |= RT3070_RX1_PD | RT3070_TX1_PD;
2928 	rt3090_rf_write(sc, 1, rf);
2929 
2930 	rf = rt3090_rf_read(sc, 6);
2931 	rf |= RT3593_VCO_IC | RT3593_VCOCAL;
2932 	if (sc->mac_ver == 0x5390)
2933 		rf &= ~RT3593_VCO_IC;
2934 	rt3090_rf_write(sc, 6, rf);
2935 
2936 	rt3090_rf_write(sc, 2, rt3090_rf_read(sc, 2) | RT3593_RESCAL);
2937 
2938 	rf = rt3090_rf_read(sc, 22);
2939 	rf = (rf & ~0xe0) | 0x20;
2940 	rt3090_rf_write(sc, 22, rf);
2941 
2942 	rt3090_rf_write(sc, 42, rt3090_rf_read(sc, 42) | RT5390_RX_CTB);
2943 	rt3090_rf_write(sc, 20, rt3090_rf_read(sc, 20) & ~0x77);
2944 	rt3090_rf_write(sc, 3, rt3090_rf_read(sc, 3) | RT3593_VCOCAL);
2945 
2946 	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2947 		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2948 		tmp = (tmp & ~0x1f000000) | 0x0d000000;
2949 		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2950 	}
2951 }
2952 
2953 static int
2954 rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
2955     uint8_t *val)
2956 {
2957 	uint8_t rf22, rf24;
2958 	uint8_t bbp55_pb, bbp55_sb, delta;
2959 	int ntries;
2960 
2961 	/* program filter */
2962 	rf24 = rt3090_rf_read(sc, 24);
2963 	rf24 = (rf24 & 0xc0) | init;	/* initial filter value */
2964 	rt3090_rf_write(sc, 24, rf24);
2965 
2966 	/* enable baseband loopback mode */
2967 	rf22 = rt3090_rf_read(sc, 22);
2968 	rt3090_rf_write(sc, 22, rf22 | RT3070_BB_LOOPBACK);
2969 
2970 	/* set power and frequency of passband test tone */
2971 	rt2860_mcu_bbp_write(sc, 24, 0x00);
2972 	for (ntries = 0; ntries < 100; ntries++) {
2973 		/* transmit test tone */
2974 		rt2860_mcu_bbp_write(sc, 25, 0x90);
2975 		DELAY(1000);
2976 		/* read received power */
2977 		bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
2978 		if (bbp55_pb != 0)
2979 			break;
2980 	}
2981 	if (ntries == 100)
2982 		return (ETIMEDOUT);
2983 
2984 	/* set power and frequency of stopband test tone */
2985 	rt2860_mcu_bbp_write(sc, 24, 0x06);
2986 	for (ntries = 0; ntries < 100; ntries++) {
2987 		/* transmit test tone */
2988 		rt2860_mcu_bbp_write(sc, 25, 0x90);
2989 		DELAY(1000);
2990 		/* read received power */
2991 		bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
2992 
2993 		delta = bbp55_pb - bbp55_sb;
2994 		if (delta > target)
2995 			break;
2996 
2997 		/* reprogram filter */
2998 		rf24++;
2999 		rt3090_rf_write(sc, 24, rf24);
3000 	}
3001 	if (ntries < 100) {
3002 		if (rf24 != init)
3003 			rf24--;	/* backtrack */
3004 		*val = rf24;
3005 		rt3090_rf_write(sc, 24, rf24);
3006 	}
3007 
3008 	/* restore initial state */
3009 	rt2860_mcu_bbp_write(sc, 24, 0x00);
3010 
3011 	/* disable baseband loopback mode */
3012 	rf22 = rt3090_rf_read(sc, 22);
3013 	rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK);
3014 
3015 	return (0);
3016 }
3017 
3018 static void
3019 rt3090_rf_setup(struct rt2860_softc *sc)
3020 {
3021 	uint8_t bbp;
3022 	int i;
3023 
3024 	if (sc->mac_rev >= 0x0211) {
3025 		/* enable DC filter */
3026 		rt2860_mcu_bbp_write(sc, 103, 0xc0);
3027 
3028 		/* improve power consumption */
3029 		bbp = rt2860_mcu_bbp_read(sc, 31);
3030 		rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
3031 	}
3032 
3033 	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
3034 	if (sc->mac_rev < 0x0211) {
3035 		RAL_WRITE(sc, RT2860_TX_SW_CFG2,
3036 		    sc->patch_dac ? 0x2c : 0x0f);
3037 	} else
3038 		RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
3039 
3040 	/* initialize RF registers from ROM */
3041 	if (sc->mac_ver < 0x5390) {
3042 		for (i = 0; i < 10; i++) {
3043 			if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
3044 				continue;
3045 			rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
3046 		}
3047 	}
3048 }
3049 
3050 static void
3051 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
3052 {
3053 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
3054 	    which | (sc->leds & 0x7f), 0);
3055 }
3056 
3057 /*
3058  * Hardware has a general-purpose programmable timer interrupt that can
3059  * periodically raise MAC_INT_4.
3060  */
3061 static void
3062 rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
3063 {
3064 	uint32_t tmp;
3065 
3066 	/* disable GP timer before reprogramming it */
3067 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
3068 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN);
3069 
3070 	if (ms == 0)
3071 		return;
3072 
3073 	tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG);
3074 	ms *= 16;	/* Unit: 64us */
3075 	tmp = (tmp & 0xffff) | ms << RT2860_GP_TIMER_SHIFT;
3076 	RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp);
3077 
3078 	/* enable GP timer */
3079 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
3080 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp | RT2860_GP_TIMER_EN);
3081 }
3082 
3083 static void
3084 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
3085 {
3086 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,
3087 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
3088 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,
3089 	    bssid[4] | bssid[5] << 8);
3090 }
3091 
3092 static void
3093 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
3094 {
3095 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,
3096 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
3097 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,
3098 	    addr[4] | addr[5] << 8 | 0xff << 16);
3099 }
3100 
3101 static void
3102 rt2860_updateslot(struct ifnet *ifp)
3103 {
3104 	struct rt2860_softc *sc = ifp->if_softc;
3105 	struct ieee80211com *ic = ifp->if_l2com;
3106 	uint32_t tmp;
3107 
3108 	tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG);
3109 	tmp &= ~0xff;
3110 	tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
3111 	RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
3112 }
3113 
3114 static void
3115 rt2860_updateprot(struct ifnet *ifp)
3116 {
3117 	struct rt2860_softc *sc = ifp->if_softc;
3118 	struct ieee80211com *ic = ifp->if_l2com;
3119 	uint32_t tmp;
3120 
3121 	tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
3122 	/* setup protection frame rate (MCS code) */
3123 	tmp |= IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ?
3124 	    rt2860_rates[RT2860_RIDX_OFDM6].mcs :
3125 	    rt2860_rates[RT2860_RIDX_CCK11].mcs;
3126 
3127 	/* CCK frames don't require protection */
3128 	RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
3129 
3130 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
3131 		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
3132 			tmp |= RT2860_PROT_CTRL_RTS_CTS;
3133 		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
3134 			tmp |= RT2860_PROT_CTRL_CTS;
3135 	}
3136 	RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
3137 }
3138 
3139 static void
3140 rt2860_update_promisc(struct ifnet *ifp)
3141 {
3142 	struct rt2860_softc *sc = ifp->if_softc;
3143 	uint32_t tmp;
3144 
3145 	tmp = RAL_READ(sc, RT2860_RX_FILTR_CFG);
3146 	tmp &= ~RT2860_DROP_NOT_MYBSS;
3147 	if (!(ifp->if_flags & IFF_PROMISC))
3148 		tmp |= RT2860_DROP_NOT_MYBSS;
3149 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
3150 }
3151 
3152 static int
3153 rt2860_updateedca(struct ieee80211com *ic)
3154 {
3155 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
3156 	const struct wmeParams *wmep;
3157 	int aci;
3158 
3159 	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
3160 
3161 	/* update MAC TX configuration registers */
3162 	for (aci = 0; aci < WME_NUM_AC; aci++) {
3163 		RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),
3164 		    wmep[aci].wmep_logcwmax << 16 |
3165 		    wmep[aci].wmep_logcwmin << 12 |
3166 		    wmep[aci].wmep_aifsn  <<  8 |
3167 		    wmep[aci].wmep_txopLimit);
3168 	}
3169 
3170 	/* update SCH/DMA registers too */
3171 	RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,
3172 	    wmep[WME_AC_VO].wmep_aifsn  << 12 |
3173 	    wmep[WME_AC_VI].wmep_aifsn  <<  8 |
3174 	    wmep[WME_AC_BK].wmep_aifsn  <<  4 |
3175 	    wmep[WME_AC_BE].wmep_aifsn);
3176 	RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,
3177 	    wmep[WME_AC_VO].wmep_logcwmin << 12 |
3178 	    wmep[WME_AC_VI].wmep_logcwmin <<  8 |
3179 	    wmep[WME_AC_BK].wmep_logcwmin <<  4 |
3180 	    wmep[WME_AC_BE].wmep_logcwmin);
3181 	RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,
3182 	    wmep[WME_AC_VO].wmep_logcwmax << 12 |
3183 	    wmep[WME_AC_VI].wmep_logcwmax <<  8 |
3184 	    wmep[WME_AC_BK].wmep_logcwmax <<  4 |
3185 	    wmep[WME_AC_BE].wmep_logcwmax);
3186 	RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,
3187 	    wmep[WME_AC_BK].wmep_txopLimit << 16 |
3188 	    wmep[WME_AC_BE].wmep_txopLimit);
3189 	RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,
3190 	    wmep[WME_AC_VO].wmep_txopLimit << 16 |
3191 	    wmep[WME_AC_VI].wmep_txopLimit);
3192 
3193 	return 0;
3194 }
3195 
3196 #ifdef HW_CRYPTO
3197 static int
3198 rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
3199     struct ieee80211_key *k)
3200 {
3201 	struct rt2860_softc *sc = ic->ic_softc;
3202 	bus_size_t base;
3203 	uint32_t attr;
3204 	uint8_t mode, wcid, iv[8];
3205 
3206 	/* defer setting of WEP keys until interface is brought up */
3207 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
3208 	    (IFF_UP | IFF_RUNNING))
3209 		return 0;
3210 
3211 	/* map net80211 cipher to RT2860 security mode */
3212 	switch (k->k_cipher) {
3213 	case IEEE80211_CIPHER_WEP40:
3214 		mode = RT2860_MODE_WEP40;
3215 		break;
3216 	case IEEE80211_CIPHER_WEP104:
3217 		mode = RT2860_MODE_WEP104;
3218 		break;
3219 	case IEEE80211_CIPHER_TKIP:
3220 		mode = RT2860_MODE_TKIP;
3221 		break;
3222 	case IEEE80211_CIPHER_CCMP:
3223 		mode = RT2860_MODE_AES_CCMP;
3224 		break;
3225 	default:
3226 		return EINVAL;
3227 	}
3228 
3229 	if (k->k_flags & IEEE80211_KEY_GROUP) {
3230 		wcid = 0;	/* NB: update WCID0 for group keys */
3231 		base = RT2860_SKEY(0, k->k_id);
3232 	} else {
3233 		wcid = ((struct rt2860_node *)ni)->wcid;
3234 		base = RT2860_PKEY(wcid);
3235 	}
3236 
3237 	if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3238 		RAL_WRITE_REGION_1(sc, base, k->k_key, 16);
3239 #ifndef IEEE80211_STA_ONLY
3240 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
3241 			RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[16], 8);
3242 			RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[24], 8);
3243 		} else
3244 #endif
3245 		{
3246 			RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[24], 8);
3247 			RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[16], 8);
3248 		}
3249 	} else
3250 		RAL_WRITE_REGION_1(sc, base, k->k_key, k->k_len);
3251 
3252 	if (!(k->k_flags & IEEE80211_KEY_GROUP) ||
3253 	    (k->k_flags & IEEE80211_KEY_TX)) {
3254 		/* set initial packet number in IV+EIV */
3255 		if (k->k_cipher == IEEE80211_CIPHER_WEP40 ||
3256 		    k->k_cipher == IEEE80211_CIPHER_WEP104) {
3257 			uint32_t val = arc4random();
3258 			/* skip weak IVs from Fluhrer/Mantin/Shamir */
3259 			if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
3260 				val += 0x000100;
3261 			iv[0] = val;
3262 			iv[1] = val >> 8;
3263 			iv[2] = val >> 16;
3264 			iv[3] = k->k_id << 6;
3265 			iv[4] = iv[5] = iv[6] = iv[7] = 0;
3266 		} else {
3267 			if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3268 				iv[0] = k->k_tsc >> 8;
3269 				iv[1] = (iv[0] | 0x20) & 0x7f;
3270 				iv[2] = k->k_tsc;
3271 			} else /* CCMP */ {
3272 				iv[0] = k->k_tsc;
3273 				iv[1] = k->k_tsc >> 8;
3274 				iv[2] = 0;
3275 			}
3276 			iv[3] = k->k_id << 6 | IEEE80211_WEP_EXTIV;
3277 			iv[4] = k->k_tsc >> 16;
3278 			iv[5] = k->k_tsc >> 24;
3279 			iv[6] = k->k_tsc >> 32;
3280 			iv[7] = k->k_tsc >> 40;
3281 		}
3282 		RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8);
3283 	}
3284 
3285 	if (k->k_flags & IEEE80211_KEY_GROUP) {
3286 		/* install group key */
3287 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
3288 		attr &= ~(0xf << (k->k_id * 4));
3289 		attr |= mode << (k->k_id * 4);
3290 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
3291 	} else {
3292 		/* install pairwise key */
3293 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
3294 		attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
3295 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
3296 	}
3297 	return 0;
3298 }
3299 
3300 static void
3301 rt2860_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
3302     struct ieee80211_key *k)
3303 {
3304 	struct rt2860_softc *sc = ic->ic_softc;
3305 	uint32_t attr;
3306 	uint8_t wcid;
3307 
3308 	if (k->k_flags & IEEE80211_KEY_GROUP) {
3309 		/* remove group key */
3310 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
3311 		attr &= ~(0xf << (k->k_id * 4));
3312 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
3313 
3314 	} else {
3315 		/* remove pairwise key */
3316 		wcid = ((struct rt2860_node *)ni)->wcid;
3317 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
3318 		attr &= ~0xf;
3319 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
3320 	}
3321 }
3322 #endif
3323 
3324 static int8_t
3325 rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
3326 {
3327 	struct ifnet *ifp = sc->sc_ifp;
3328 	struct ieee80211com *ic = ifp->if_l2com;
3329 	struct ieee80211_channel *c = ic->ic_curchan;
3330 	int delta;
3331 
3332 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
3333 		u_int chan = ieee80211_chan2ieee(ic, c);
3334 		delta = sc->rssi_5ghz[rxchain];
3335 
3336 		/* determine channel group */
3337 		if (chan <= 64)
3338 			delta -= sc->lna[1];
3339 		else if (chan <= 128)
3340 			delta -= sc->lna[2];
3341 		else
3342 			delta -= sc->lna[3];
3343 	} else
3344 		delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
3345 
3346 	return -12 - delta - rssi;
3347 }
3348 
3349 /*
3350  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
3351  * Used to adjust per-rate Tx power registers.
3352  */
3353 static __inline uint32_t
3354 b4inc(uint32_t b32, int8_t delta)
3355 {
3356 	int8_t i, b4;
3357 
3358 	for (i = 0; i < 8; i++) {
3359 		b4 = b32 & 0xf;
3360 		b4 += delta;
3361 		if (b4 < 0)
3362 			b4 = 0;
3363 		else if (b4 > 0xf)
3364 			b4 = 0xf;
3365 		b32 = b32 >> 4 | b4 << 28;
3366 	}
3367 	return b32;
3368 }
3369 
3370 static const char *
3371 rt2860_get_rf(uint8_t rev)
3372 {
3373 	switch (rev) {
3374 	case RT2860_RF_2820:	return "RT2820";
3375 	case RT2860_RF_2850:	return "RT2850";
3376 	case RT2860_RF_2720:	return "RT2720";
3377 	case RT2860_RF_2750:	return "RT2750";
3378 	case RT3070_RF_3020:	return "RT3020";
3379 	case RT3070_RF_2020:	return "RT2020";
3380 	case RT3070_RF_3021:	return "RT3021";
3381 	case RT3070_RF_3022:	return "RT3022";
3382 	case RT3070_RF_3052:	return "RT3052";
3383 	case RT3070_RF_3320:	return "RT3320";
3384 	case RT3070_RF_3053:	return "RT3053";
3385 	case RT5390_RF_5390:	return "RT5390";
3386 	default:		return "unknown";
3387 	}
3388 }
3389 
3390 static int
3391 rt2860_read_eeprom(struct rt2860_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
3392 {
3393 	int8_t delta_2ghz, delta_5ghz;
3394 	uint32_t tmp;
3395 	uint16_t val;
3396 	int ridx, ant, i;
3397 
3398 	/* check whether the ROM is eFUSE ROM or EEPROM */
3399 	sc->sc_srom_read = rt2860_eeprom_read_2;
3400 	if (sc->mac_ver >= 0x3071) {
3401 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
3402 		DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
3403 		if (tmp & RT3070_SEL_EFUSE)
3404 			sc->sc_srom_read = rt3090_efuse_read_2;
3405 	}
3406 
3407 	/* read EEPROM version */
3408 	val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION);
3409 	DPRINTF(("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8));
3410 
3411 	/* read MAC address */
3412 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC01);
3413 	macaddr[0] = val & 0xff;
3414 	macaddr[1] = val >> 8;
3415 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC23);
3416 	macaddr[2] = val & 0xff;
3417 	macaddr[3] = val >> 8;
3418 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC45);
3419 	macaddr[4] = val & 0xff;
3420 	macaddr[5] = val >> 8;
3421 
3422 	/* read country code */
3423 	val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY);
3424 	DPRINTF(("EEPROM region code=0x%04x\n", val));
3425 
3426 	/* read vendor BBP settings */
3427 	for (i = 0; i < 8; i++) {
3428 		val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE + i);
3429 		sc->bbp[i].val = val & 0xff;
3430 		sc->bbp[i].reg = val >> 8;
3431 		DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
3432 	}
3433 	if (sc->mac_ver >= 0x3071) {
3434 		/* read vendor RF settings */
3435 		for (i = 0; i < 10; i++) {
3436 			val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE + i);
3437 			sc->rf[i].val = val & 0xff;
3438 			sc->rf[i].reg = val >> 8;
3439 			DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
3440 			    sc->rf[i].val));
3441 		}
3442 	}
3443 
3444 	/* read RF frequency offset from EEPROM */
3445 	val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS);
3446 	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
3447 	DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
3448 	if ((val >> 8) != 0xff) {
3449 		/* read LEDs operating mode */
3450 		sc->leds = val >> 8;
3451 		sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED1);
3452 		sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED2);
3453 		sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED3);
3454 	} else {
3455 		/* broken EEPROM, use default settings */
3456 		sc->leds = 0x01;
3457 		sc->led[0] = 0x5555;
3458 		sc->led[1] = 0x2221;
3459 		sc->led[2] = 0xa9f8;
3460 	}
3461 	DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
3462 	    sc->leds, sc->led[0], sc->led[1], sc->led[2]));
3463 
3464 	/* read RF information */
3465 	val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA);
3466 	if (val == 0xffff) {
3467 		DPRINTF(("invalid EEPROM antenna info, using default\n"));
3468 		if (sc->mac_ver >= 0x5390) {
3469 			/* default to RF5390 */
3470 			sc->rf_rev = RT5390_RF_5390;
3471 			sc->ntxchains = (sc->mac_ver == 0x5392) ? 2 : 1;
3472 			sc->nrxchains = (sc->mac_ver == 0x5392) ? 2 : 1;
3473 		} else if (sc->mac_ver == 0x3593) {
3474 			/* default to RF3053 3T3R */
3475 			sc->rf_rev = RT3070_RF_3053;
3476 			sc->ntxchains = 3;
3477 			sc->nrxchains = 3;
3478 		} else if (sc->mac_ver >= 0x3071) {
3479 			/* default to RF3020 1T1R */
3480 			sc->rf_rev = RT3070_RF_3020;
3481 			sc->ntxchains = 1;
3482 			sc->nrxchains = 1;
3483 		} else {
3484 			/* default to RF2820 1T2R */
3485 			sc->rf_rev = RT2860_RF_2820;
3486 			sc->ntxchains = 1;
3487 			sc->nrxchains = 2;
3488 		}
3489 	} else {
3490 		sc->rf_rev = (val >> 8) & 0xf;
3491 		if (sc->mac_ver >= 0x5390) {
3492 			sc->ntxchains = (sc->mac_ver == 0x5392) ? 2 : 1;
3493 			sc->nrxchains = (sc->mac_ver == 0x5392) ? 2 : 1;
3494 		} else {
3495 			sc->ntxchains = (val >> 4) & 0xf;
3496 			sc->nrxchains = val & 0xf;
3497 		}
3498 	}
3499 	DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
3500 	    sc->rf_rev, sc->ntxchains, sc->nrxchains));
3501 
3502 	/* check if RF supports automatic Tx access gain control */
3503 	val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG);
3504 	DPRINTF(("EEPROM CFG 0x%04x\n", val));
3505 	/* check if driver should patch the DAC issue */
3506 	if ((val >> 8) != 0xff)
3507 		sc->patch_dac = (val >> 15) & 1;
3508 	if ((val & 0xff) != 0xff) {
3509 		sc->ext_5ghz_lna = (val >> 3) & 1;
3510 		sc->ext_2ghz_lna = (val >> 2) & 1;
3511 		/* check if RF supports automatic Tx access gain control */
3512 		sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */;
3513 		/* check if we have a hardware radio switch */
3514 		sc->rfswitch = val & 1;
3515 	}
3516 	if (sc->sc_flags & RT2860_ADVANCED_PS) {
3517 		/* read PCIe power save level */
3518 		val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
3519 		if ((val & 0xff) != 0xff) {
3520 			sc->pslevel = val & 0x3;
3521 			val = rt2860_srom_read(sc, RT2860_EEPROM_REV);
3522 			if ((val & 0xff80) != 0x9280)
3523 				sc->pslevel = MIN(sc->pslevel, 1);
3524 			DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
3525 		}
3526 	}
3527 
3528 	/* read power settings for 2GHz channels */
3529 	for (i = 0; i < 14; i += 2) {
3530 		val = rt2860_srom_read(sc,
3531 		    RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
3532 		sc->txpow1[i + 0] = (int8_t)(val & 0xff);
3533 		sc->txpow1[i + 1] = (int8_t)(val >> 8);
3534 
3535 		if (sc->mac_ver != 0x5390) {
3536 			val = rt2860_srom_read(sc,
3537 			    RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
3538 			sc->txpow2[i + 0] = (int8_t)(val & 0xff);
3539 			sc->txpow2[i + 1] = (int8_t)(val >> 8);
3540 		}
3541 	}
3542 	/* fix broken Tx power entries */
3543 	for (i = 0; i < 14; i++) {
3544 		if (sc->txpow1[i] < 0 ||
3545 		    sc->txpow1[i] > ((sc->mac_ver >= 0x5390) ? 39 : 31))
3546 			sc->txpow1[i] = 5;
3547 		if (sc->mac_ver != 0x5390) {
3548 			if (sc->txpow2[i] < 0 ||
3549 			    sc->txpow2[i] > ((sc->mac_ver == 0x5392) ? 39 : 31))
3550 				sc->txpow2[i] = 5;
3551 		}
3552 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3553 		    rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
3554 	}
3555 	/* read power settings for 5GHz channels */
3556 	for (i = 0; i < 40; i += 2) {
3557 		val = rt2860_srom_read(sc,
3558 		    RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
3559 		sc->txpow1[i + 14] = (int8_t)(val & 0xff);
3560 		sc->txpow1[i + 15] = (int8_t)(val >> 8);
3561 
3562 		val = rt2860_srom_read(sc,
3563 		    RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
3564 		sc->txpow2[i + 14] = (int8_t)(val & 0xff);
3565 		sc->txpow2[i + 15] = (int8_t)(val >> 8);
3566 	}
3567 	/* fix broken Tx power entries */
3568 	for (i = 0; i < 40; i++) {
3569 		if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
3570 			sc->txpow1[14 + i] = 5;
3571 		if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
3572 			sc->txpow2[14 + i] = 5;
3573 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3574 		    rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
3575 		    sc->txpow2[14 + i]));
3576 	}
3577 
3578 	/* read Tx power compensation for each Tx rate */
3579 	val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR);
3580 	delta_2ghz = delta_5ghz = 0;
3581 	if ((val & 0xff) != 0xff && (val & 0x80)) {
3582 		delta_2ghz = val & 0xf;
3583 		if (!(val & 0x40))	/* negative number */
3584 			delta_2ghz = -delta_2ghz;
3585 	}
3586 	val >>= 8;
3587 	if ((val & 0xff) != 0xff && (val & 0x80)) {
3588 		delta_5ghz = val & 0xf;
3589 		if (!(val & 0x40))	/* negative number */
3590 			delta_5ghz = -delta_5ghz;
3591 	}
3592 	DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
3593 	    delta_2ghz, delta_5ghz));
3594 
3595 	for (ridx = 0; ridx < 5; ridx++) {
3596 		uint32_t reg;
3597 
3598 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2);
3599 		reg = val;
3600 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1);
3601 		reg |= (uint32_t)val << 16;
3602 
3603 		sc->txpow20mhz[ridx] = reg;
3604 		sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
3605 		sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
3606 
3607 		DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
3608 		    "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
3609 		    sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
3610 	}
3611 
3612 	/* read factory-calibrated samples for temperature compensation */
3613 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
3614 	sc->tssi_2ghz[0] = val & 0xff;	/* [-4] */
3615 	sc->tssi_2ghz[1] = val >> 8;	/* [-3] */
3616 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
3617 	sc->tssi_2ghz[2] = val & 0xff;	/* [-2] */
3618 	sc->tssi_2ghz[3] = val >> 8;	/* [-1] */
3619 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
3620 	sc->tssi_2ghz[4] = val & 0xff;	/* [+0] */
3621 	sc->tssi_2ghz[5] = val >> 8;	/* [+1] */
3622 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
3623 	sc->tssi_2ghz[6] = val & 0xff;	/* [+2] */
3624 	sc->tssi_2ghz[7] = val >> 8;	/* [+3] */
3625 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
3626 	sc->tssi_2ghz[8] = val & 0xff;	/* [+4] */
3627 	sc->step_2ghz = val >> 8;
3628 	DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3629 	    "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
3630 	    sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
3631 	    sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
3632 	    sc->tssi_2ghz[8], sc->step_2ghz));
3633 	/* check that ref value is correct, otherwise disable calibration */
3634 	if (sc->tssi_2ghz[4] == 0xff)
3635 		sc->calib_2ghz = 0;
3636 
3637 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
3638 	sc->tssi_5ghz[0] = val & 0xff;	/* [-4] */
3639 	sc->tssi_5ghz[1] = val >> 8;	/* [-3] */
3640 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
3641 	sc->tssi_5ghz[2] = val & 0xff;	/* [-2] */
3642 	sc->tssi_5ghz[3] = val >> 8;	/* [-1] */
3643 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
3644 	sc->tssi_5ghz[4] = val & 0xff;	/* [+0] */
3645 	sc->tssi_5ghz[5] = val >> 8;	/* [+1] */
3646 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
3647 	sc->tssi_5ghz[6] = val & 0xff;	/* [+2] */
3648 	sc->tssi_5ghz[7] = val >> 8;	/* [+3] */
3649 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
3650 	sc->tssi_5ghz[8] = val & 0xff;	/* [+4] */
3651 	sc->step_5ghz = val >> 8;
3652 	DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3653 	    "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
3654 	    sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
3655 	    sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
3656 	    sc->tssi_5ghz[8], sc->step_5ghz));
3657 	/* check that ref value is correct, otherwise disable calibration */
3658 	if (sc->tssi_5ghz[4] == 0xff)
3659 		sc->calib_5ghz = 0;
3660 
3661 	/* read RSSI offsets and LNA gains from EEPROM */
3662 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
3663 	sc->rssi_2ghz[0] = val & 0xff;	/* Ant A */
3664 	sc->rssi_2ghz[1] = val >> 8;	/* Ant B */
3665 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
3666 	if (sc->mac_ver >= 0x3071) {
3667 		/*
3668 		 * On RT3090 chips (limited to 2 Rx chains), this ROM
3669 		 * field contains the Tx mixer gain for the 2GHz band.
3670 		 */
3671 		if ((val & 0xff) != 0xff)
3672 			sc->txmixgain_2ghz = val & 0x7;
3673 		DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
3674 	} else
3675 		sc->rssi_2ghz[2] = val & 0xff;	/* Ant C */
3676 	sc->lna[2] = val >> 8;		/* channel group 2 */
3677 
3678 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
3679 	sc->rssi_5ghz[0] = val & 0xff;	/* Ant A */
3680 	sc->rssi_5ghz[1] = val >> 8;	/* Ant B */
3681 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
3682 	sc->rssi_5ghz[2] = val & 0xff;	/* Ant C */
3683 	sc->lna[3] = val >> 8;		/* channel group 3 */
3684 
3685 	val = rt2860_srom_read(sc, RT2860_EEPROM_LNA);
3686 	if (sc->mac_ver >= 0x3071)
3687 		sc->lna[0] = RT3090_DEF_LNA;
3688 	else				/* channel group 0 */
3689 		sc->lna[0] = val & 0xff;
3690 	sc->lna[1] = val >> 8;		/* channel group 1 */
3691 
3692 	/* fix broken 5GHz LNA entries */
3693 	if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
3694 		DPRINTF(("invalid LNA for channel group %d\n", 2));
3695 		sc->lna[2] = sc->lna[1];
3696 	}
3697 	if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
3698 		DPRINTF(("invalid LNA for channel group %d\n", 3));
3699 		sc->lna[3] = sc->lna[1];
3700 	}
3701 
3702 	/* fix broken RSSI offset entries */
3703 	for (ant = 0; ant < 3; ant++) {
3704 		if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
3705 			DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
3706 			    ant + 1, sc->rssi_2ghz[ant]));
3707 			sc->rssi_2ghz[ant] = 0;
3708 		}
3709 		if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
3710 			DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
3711 			    ant + 1, sc->rssi_5ghz[ant]));
3712 			sc->rssi_5ghz[ant] = 0;
3713 		}
3714 	}
3715 
3716 	return 0;
3717 }
3718 
3719 static int
3720 rt2860_bbp_init(struct rt2860_softc *sc)
3721 {
3722 	int i, ntries;
3723 
3724 	/* wait for BBP to wake up */
3725 	for (ntries = 0; ntries < 20; ntries++) {
3726 		uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
3727 		if (bbp0 != 0 && bbp0 != 0xff)
3728 			break;
3729 	}
3730 	if (ntries == 20) {
3731 		device_printf(sc->sc_dev,
3732 		    "timeout waiting for BBP to wake up\n");
3733 		return (ETIMEDOUT);
3734 	}
3735 
3736 	/* initialize BBP registers to default values */
3737 	if (sc->mac_ver >= 0x5390)
3738 		rt5390_bbp_init(sc);
3739 	else {
3740 		for (i = 0; i < nitems(rt2860_def_bbp); i++) {
3741 			rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
3742 			    rt2860_def_bbp[i].val);
3743 		}
3744 	}
3745 
3746 	/* fix BBP84 for RT2860E */
3747 	if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
3748 		rt2860_mcu_bbp_write(sc, 84, 0x19);
3749 
3750 	if (sc->mac_ver >= 0x3071) {
3751 		rt2860_mcu_bbp_write(sc, 79, 0x13);
3752 		rt2860_mcu_bbp_write(sc, 80, 0x05);
3753 		rt2860_mcu_bbp_write(sc, 81, 0x33);
3754 	} else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
3755 		rt2860_mcu_bbp_write(sc, 69, 0x16);
3756 		rt2860_mcu_bbp_write(sc, 73, 0x12);
3757 	}
3758 
3759 	return 0;
3760 }
3761 
3762 static void
3763 rt5390_bbp_init(struct rt2860_softc *sc)
3764 {
3765 	uint8_t bbp;
3766 	int i;
3767 
3768 	/* Apply maximum likelihood detection for 2 stream case. */
3769 	if (sc->nrxchains > 1) {
3770 		bbp = rt2860_mcu_bbp_read(sc, 105);
3771 		rt2860_mcu_bbp_write(sc, 105, bbp | RT5390_MLD);
3772 	}
3773 
3774 	/* Avoid data lost and CRC error. */
3775 	bbp = rt2860_mcu_bbp_read(sc, 4);
3776 	rt2860_mcu_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
3777 
3778 	for (i = 0; i < nitems(rt5390_def_bbp); i++) {
3779 		rt2860_mcu_bbp_write(sc, rt5390_def_bbp[i].reg,
3780 		    rt5390_def_bbp[i].val);
3781 	}
3782 
3783 	if (sc->mac_ver == 0x5392) {
3784 		rt2860_mcu_bbp_write(sc, 84, 0x9a);
3785 		rt2860_mcu_bbp_write(sc, 95, 0x9a);
3786 		rt2860_mcu_bbp_write(sc, 98, 0x12);
3787 		rt2860_mcu_bbp_write(sc, 106, 0x05);
3788 		rt2860_mcu_bbp_write(sc, 134, 0xd0);
3789 		rt2860_mcu_bbp_write(sc, 135, 0xf6);
3790 	}
3791 
3792 	bbp = rt2860_mcu_bbp_read(sc, 152);
3793 	rt2860_mcu_bbp_write(sc, 152, bbp | 0x80);
3794 
3795 	/* Disable hardware antenna diversity. */
3796 	if (sc->mac_ver == 0x5390)
3797 		rt2860_mcu_bbp_write(sc, 154, 0);
3798 }
3799 
3800 static int
3801 rt2860_txrx_enable(struct rt2860_softc *sc)
3802 {
3803 	struct ifnet *ifp = sc->sc_ifp;
3804 	struct ieee80211com *ic = ifp->if_l2com;
3805 	uint32_t tmp;
3806 	int ntries;
3807 
3808 	/* enable Tx/Rx DMA engine */
3809 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
3810 	RAL_BARRIER_READ_WRITE(sc);
3811 	for (ntries = 0; ntries < 200; ntries++) {
3812 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3813 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3814 			break;
3815 		DELAY(1000);
3816 	}
3817 	if (ntries == 200) {
3818 		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3819 		return ETIMEDOUT;
3820 	}
3821 
3822 	DELAY(50);
3823 
3824 	tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
3825 	    RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
3826 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3827 
3828 	/* set Rx filter */
3829 	tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
3830 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
3831 		tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
3832 		    RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
3833 		    RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
3834 		    RT2860_DROP_CFACK | RT2860_DROP_CFEND;
3835 		if (ic->ic_opmode == IEEE80211_M_STA)
3836 			tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
3837 	}
3838 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
3839 
3840 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
3841 	    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3842 
3843 	return 0;
3844 }
3845 
3846 static void
3847 rt2860_init(void *arg)
3848 {
3849 	struct rt2860_softc *sc = arg;
3850 	struct ifnet *ifp = sc->sc_ifp;
3851 	struct ieee80211com *ic = ifp->if_l2com;
3852 
3853 	RAL_LOCK(sc);
3854 	rt2860_init_locked(sc);
3855 	RAL_UNLOCK(sc);
3856 
3857 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
3858 		ieee80211_start_all(ic);
3859 }
3860 
3861 static void
3862 rt2860_init_locked(struct rt2860_softc *sc)
3863 {
3864 	struct ifnet *ifp = sc->sc_ifp;
3865 	struct ieee80211com *ic = ifp->if_l2com;
3866 	uint32_t tmp;
3867 	uint8_t bbp1, bbp3;
3868 	int i, qid, ridx, ntries, error;
3869 
3870 	RAL_LOCK_ASSERT(sc);
3871 
3872 	if (sc->rfswitch) {
3873 		/* hardware has a radio switch on GPIO pin 2 */
3874 		if (!(RAL_READ(sc, RT2860_GPIO_CTRL) & (1 << 2))) {
3875 			device_printf(sc->sc_dev,
3876 			    "radio is disabled by hardware switch\n");
3877 #ifdef notyet
3878 			rt2860_stop_locked(sc);
3879 			return;
3880 #endif
3881 		}
3882 	}
3883 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE);
3884 
3885 	/* disable DMA */
3886 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3887 	tmp &= 0xff0;
3888 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3889 
3890 	/* PBF hardware reset */
3891 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3892 	RAL_BARRIER_WRITE(sc);
3893 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3894 
3895 	if ((error = rt2860_load_microcode(sc)) != 0) {
3896 		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
3897 		rt2860_stop_locked(sc);
3898 		return;
3899 	}
3900 
3901 	rt2860_set_macaddr(sc, IF_LLADDR(ifp));
3902 
3903 	/* init Tx power for all Tx rates (from EEPROM) */
3904 	for (ridx = 0; ridx < 5; ridx++) {
3905 		if (sc->txpow20mhz[ridx] == 0xffffffff)
3906 			continue;
3907 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
3908 	}
3909 
3910 	for (ntries = 0; ntries < 100; ntries++) {
3911 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3912 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3913 			break;
3914 		DELAY(1000);
3915 	}
3916 	if (ntries == 100) {
3917 		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3918 		rt2860_stop_locked(sc);
3919 		return;
3920 	}
3921 	tmp &= 0xff0;
3922 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3923 
3924 	/* reset Rx ring and all 6 Tx rings */
3925 	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
3926 
3927 	/* PBF hardware reset */
3928 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3929 	RAL_BARRIER_WRITE(sc);
3930 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3931 
3932 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE | RT2860_IO_RF_PE);
3933 
3934 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
3935 	RAL_BARRIER_WRITE(sc);
3936 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
3937 
3938 	for (i = 0; i < nitems(rt2860_def_mac); i++)
3939 		RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
3940 	if (sc->mac_ver >= 0x5390)
3941 		RAL_WRITE(sc, RT2860_TX_SW_CFG0, 0x00000404);
3942 	else if (sc->mac_ver >= 0x3071) {
3943 		/* set delay of PA_PE assertion to 1us (unit of 0.25us) */
3944 		RAL_WRITE(sc, RT2860_TX_SW_CFG0,
3945 		    4 << RT2860_DLY_PAPE_EN_SHIFT);
3946 	}
3947 
3948 	if (!(RAL_READ(sc, RT2860_PCI_CFG) & RT2860_PCI_CFG_PCI)) {
3949 		sc->sc_flags |= RT2860_PCIE;
3950 		/* PCIe has different clock cycle count than PCI */
3951 		tmp = RAL_READ(sc, RT2860_US_CYC_CNT);
3952 		tmp = (tmp & ~0xff) | 0x7d;
3953 		RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp);
3954 	}
3955 
3956 	/* wait while MAC is busy */
3957 	for (ntries = 0; ntries < 100; ntries++) {
3958 		if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG) &
3959 		    (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
3960 			break;
3961 		DELAY(1000);
3962 	}
3963 	if (ntries == 100) {
3964 		device_printf(sc->sc_dev, "timeout waiting for MAC\n");
3965 		rt2860_stop_locked(sc);
3966 		return;
3967 	}
3968 
3969 	/* clear Host to MCU mailbox */
3970 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
3971 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
3972 
3973 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
3974 	DELAY(1000);
3975 
3976 	if ((error = rt2860_bbp_init(sc)) != 0) {
3977 		rt2860_stop_locked(sc);
3978 		return;
3979 	}
3980 
3981 	/* clear RX WCID search table */
3982 	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
3983 	/* clear pairwise key table */
3984 	RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048);
3985 	/* clear IV/EIV table */
3986 	RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512);
3987 	/* clear WCID attribute table */
3988 	RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256);
3989 	/* clear shared key table */
3990 	RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
3991 	/* clear shared key mode */
3992 	RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
3993 
3994 	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
3995 	for (qid = 0; qid < 6; qid++) {
3996 		RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
3997 		RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
3998 		RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
3999 	}
4000 
4001 	/* init Rx ring */
4002 	RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
4003 	RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
4004 	RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
4005 
4006 	/* setup maximum buffer sizes */
4007 	RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
4008 	    (MCLBYTES - sizeof (struct rt2860_rxwi) - 2));
4009 
4010 	for (ntries = 0; ntries < 100; ntries++) {
4011 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
4012 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
4013 			break;
4014 		DELAY(1000);
4015 	}
4016 	if (ntries == 100) {
4017 		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
4018 		rt2860_stop_locked(sc);
4019 		return;
4020 	}
4021 	tmp &= 0xff0;
4022 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
4023 
4024 	/* disable interrupts mitigation */
4025 	RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
4026 
4027 	/* write vendor-specific BBP values (from EEPROM) */
4028 	for (i = 0; i < 8; i++) {
4029 		if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
4030 			continue;
4031 		rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
4032 	}
4033 
4034 	/* select Main antenna for 1T1R devices */
4035 	if (sc->rf_rev == RT3070_RF_2020 ||
4036 	    sc->rf_rev == RT3070_RF_3020 ||
4037 	    sc->rf_rev == RT3070_RF_3320 ||
4038 	    sc->mac_ver == 0x5390)
4039 		rt3090_set_rx_antenna(sc, 0);
4040 
4041 	/* send LEDs operating mode to microcontroller */
4042 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0], 0);
4043 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1], 0);
4044 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2], 0);
4045 
4046 	if (sc->mac_ver >= 0x5390)
4047 		rt5390_rf_init(sc);
4048 	else if (sc->mac_ver >= 0x3071) {
4049 		if ((error = rt3090_rf_init(sc)) != 0) {
4050 			rt2860_stop_locked(sc);
4051 			return;
4052 		}
4053 	}
4054 
4055 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP, 0x02ff, 1);
4056 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP, 0, 1);
4057 
4058 	if (sc->mac_ver >= 0x5390)
4059 		rt5390_rf_wakeup(sc);
4060 	else if (sc->mac_ver >= 0x3071)
4061 		rt3090_rf_wakeup(sc);
4062 
4063 	/* disable non-existing Rx chains */
4064 	bbp3 = rt2860_mcu_bbp_read(sc, 3);
4065 	bbp3 &= ~(1 << 3 | 1 << 4);
4066 	if (sc->nrxchains == 2)
4067 		bbp3 |= 1 << 3;
4068 	else if (sc->nrxchains == 3)
4069 		bbp3 |= 1 << 4;
4070 	rt2860_mcu_bbp_write(sc, 3, bbp3);
4071 
4072 	/* disable non-existing Tx chains */
4073 	bbp1 = rt2860_mcu_bbp_read(sc, 1);
4074 	if (sc->ntxchains == 1)
4075 		bbp1 = (bbp1 & ~(1 << 3 | 1 << 4));
4076 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
4077 		bbp1 = (bbp1 & ~(1 << 4)) | 1 << 3;
4078 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
4079 		bbp1 = (bbp1 & ~(1 << 3)) | 1 << 4;
4080 	rt2860_mcu_bbp_write(sc, 1, bbp1);
4081 
4082 	if (sc->mac_ver >= 0x3071)
4083 		rt3090_rf_setup(sc);
4084 
4085 	/* select default channel */
4086 	rt2860_switch_chan(sc, ic->ic_curchan);
4087 
4088 	/* reset RF from MCU */
4089 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
4090 
4091 	/* set RTS threshold */
4092 	tmp = RAL_READ(sc, RT2860_TX_RTS_CFG);
4093 	tmp &= ~0xffff00;
4094 	tmp |= IEEE80211_RTS_DEFAULT << 8;
4095 	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);
4096 
4097 	/* setup initial protection mode */
4098 	rt2860_updateprot(ifp);
4099 
4100 	/* turn radio LED on */
4101 	rt2860_set_leds(sc, RT2860_LED_RADIO);
4102 
4103 	/* enable Tx/Rx DMA engine */
4104 	if ((error = rt2860_txrx_enable(sc)) != 0) {
4105 		rt2860_stop_locked(sc);
4106 		return;
4107 	}
4108 
4109 	/* clear pending interrupts */
4110 	RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
4111 	/* enable interrupts */
4112 	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
4113 
4114 	if (sc->sc_flags & RT2860_ADVANCED_PS)
4115 		rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);
4116 
4117 	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
4118 	ifp->if_drv_flags |= IFF_DRV_RUNNING;
4119 
4120 	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
4121 }
4122 
4123 static void
4124 rt2860_stop(void *arg)
4125 {
4126 	struct rt2860_softc *sc = arg;
4127 
4128 	RAL_LOCK(sc);
4129 	rt2860_stop_locked(sc);
4130 	RAL_UNLOCK(sc);
4131 }
4132 
4133 static void
4134 rt2860_stop_locked(struct rt2860_softc *sc)
4135 {
4136 	struct ifnet *ifp = sc->sc_ifp;
4137 	uint32_t tmp;
4138 	int qid;
4139 
4140 	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
4141 		rt2860_set_leds(sc, 0);	/* turn all LEDs off */
4142 
4143 	callout_stop(&sc->watchdog_ch);
4144 	sc->sc_tx_timer = 0;
4145 	ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
4146 
4147 	/* disable interrupts */
4148 	RAL_WRITE(sc, RT2860_INT_MASK, 0);
4149 
4150 	/* disable GP timer */
4151 	rt2860_set_gp_timer(sc, 0);
4152 
4153 	/* disable Rx */
4154 	tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL);
4155 	tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
4156 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
4157 
4158 	/* reset adapter */
4159 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
4160 	RAL_BARRIER_WRITE(sc);
4161 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
4162 
4163 	/* reset Tx and Rx rings (and reclaim TXWIs) */
4164 	sc->qfullmsk = 0;
4165 	for (qid = 0; qid < 6; qid++)
4166 		rt2860_reset_tx_ring(sc, &sc->txq[qid]);
4167 	rt2860_reset_rx_ring(sc, &sc->rxq);
4168 }
4169 
4170 int
4171 rt2860_load_microcode(struct rt2860_softc *sc)
4172 {
4173 	const struct firmware *fp;
4174 	int ntries, error;
4175 
4176 	RAL_LOCK_ASSERT(sc);
4177 
4178 	RAL_UNLOCK(sc);
4179 	fp = firmware_get("rt2860fw");
4180 	RAL_LOCK(sc);
4181 	if (fp == NULL) {
4182 		device_printf(sc->sc_dev,
4183 		    "unable to receive rt2860fw firmware image\n");
4184 		return EINVAL;
4185 	}
4186 
4187 	/* set "host program ram write selection" bit */
4188 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
4189 	/* write microcode image */
4190 	RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, fp->data, fp->datasize);
4191 	/* kick microcontroller unit */
4192 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0);
4193 	RAL_BARRIER_WRITE(sc);
4194 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
4195 
4196 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
4197 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
4198 
4199 	/* wait until microcontroller is ready */
4200 	RAL_BARRIER_READ_WRITE(sc);
4201 	for (ntries = 0; ntries < 1000; ntries++) {
4202 		if (RAL_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
4203 			break;
4204 		DELAY(1000);
4205 	}
4206 	if (ntries == 1000) {
4207 		device_printf(sc->sc_dev,
4208 		    "timeout waiting for MCU to initialize\n");
4209 		error = ETIMEDOUT;
4210 	} else
4211 		error = 0;
4212 
4213 	firmware_put(fp, FIRMWARE_UNLOAD);
4214 	return error;
4215 }
4216 
4217 /*
4218  * This function is called periodically to adjust Tx power based on
4219  * temperature variation.
4220  */
4221 #ifdef NOT_YET
4222 static void
4223 rt2860_calib(struct rt2860_softc *sc)
4224 {
4225 	struct ieee80211com *ic = &sc->sc_ic;
4226 	const uint8_t *tssi;
4227 	uint8_t step, bbp49;
4228 	int8_t ridx, d;
4229 
4230 	/* read current temperature */
4231 	bbp49 = rt2860_mcu_bbp_read(sc, 49);
4232 
4233 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)) {
4234 		tssi = &sc->tssi_2ghz[4];
4235 		step = sc->step_2ghz;
4236 	} else {
4237 		tssi = &sc->tssi_5ghz[4];
4238 		step = sc->step_5ghz;
4239 	}
4240 
4241 	if (bbp49 < tssi[0]) {		/* lower than reference */
4242 		/* use higher Tx power than default */
4243 		for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
4244 	} else if (bbp49 > tssi[0]) {	/* greater than reference */
4245 		/* use lower Tx power than default */
4246 		for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
4247 	} else {
4248 		/* use default Tx power */
4249 		d = 0;
4250 	}
4251 	d *= step;
4252 
4253 	DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
4254 
4255 	/* write adjusted Tx power values for each Tx rate */
4256 	for (ridx = 0; ridx < 5; ridx++) {
4257 		if (sc->txpow20mhz[ridx] == 0xffffffff)
4258 			continue;
4259 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),
4260 		    b4inc(sc->txpow20mhz[ridx], d));
4261 	}
4262 }
4263 #endif
4264 
4265 static void
4266 rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
4267 {
4268 	uint32_t tmp;
4269 
4270 	if (aux) {
4271 		if (sc->mac_ver == 0x5390) {
4272 			rt2860_mcu_bbp_write(sc, 152,
4273 			    rt2860_mcu_bbp_read(sc, 152) & ~0x80);
4274 		} else {
4275 			tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
4276 			RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp & ~RT2860_C);
4277 			tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
4278 			RAL_WRITE(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
4279 		}
4280 	} else {
4281 		if (sc->mac_ver == 0x5390) {
4282 			rt2860_mcu_bbp_write(sc, 152,
4283 			    rt2860_mcu_bbp_read(sc, 152) | 0x80);
4284 		} else {
4285 			tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
4286 			RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp | RT2860_C);
4287 			tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
4288 			RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
4289 		}
4290 	}
4291 }
4292 
4293 static void
4294 rt2860_switch_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
4295 {
4296 	struct ifnet *ifp = sc->sc_ifp;
4297 	struct ieee80211com *ic = ifp->if_l2com;
4298 	u_int chan, group;
4299 
4300 	chan = ieee80211_chan2ieee(ic, c);
4301 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
4302 		return;
4303 
4304 	if (sc->mac_ver >= 0x5390)
4305 		rt5390_set_chan(sc, chan);
4306 	else if (sc->mac_ver >= 0x3071)
4307 		rt3090_set_chan(sc, chan);
4308 	else
4309 		rt2860_set_chan(sc, chan);
4310 
4311 	/* determine channel group */
4312 	if (chan <= 14)
4313 		group = 0;
4314 	else if (chan <= 64)
4315 		group = 1;
4316 	else if (chan <= 128)
4317 		group = 2;
4318 	else
4319 		group = 3;
4320 
4321 	/* XXX necessary only when group has changed! */
4322 	if (sc->mac_ver < 0x5390)
4323 		rt2860_select_chan_group(sc, group);
4324 
4325 	DELAY(1000);
4326 }
4327 
4328 static int
4329 rt2860_setup_beacon(struct rt2860_softc *sc, struct ieee80211vap *vap)
4330 {
4331 	struct ieee80211com *ic = vap->iv_ic;
4332 	struct ieee80211_beacon_offsets bo;
4333 	struct rt2860_txwi txwi;
4334 	struct mbuf *m;
4335 	int ridx;
4336 
4337 	if ((m = ieee80211_beacon_alloc(vap->iv_bss, &bo)) == NULL)
4338 		return ENOBUFS;
4339 
4340 	memset(&txwi, 0, sizeof txwi);
4341 	txwi.wcid = 0xff;
4342 	txwi.len = htole16(m->m_pkthdr.len);
4343 	/* send beacons at the lowest available rate */
4344 	ridx = IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan) ?
4345 	    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
4346 	txwi.phy = htole16(rt2860_rates[ridx].mcs);
4347 	if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4348 		txwi.phy |= htole16(RT2860_PHY_OFDM);
4349 	txwi.txop = RT2860_TX_TXOP_HT;
4350 	txwi.flags = RT2860_TX_TS;
4351 	txwi.xflags = RT2860_TX_NSEQ;
4352 
4353 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),
4354 	    (uint8_t *)&txwi, sizeof txwi);
4355 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
4356 	    mtod(m, uint8_t *), m->m_pkthdr.len);
4357 
4358 	m_freem(m);
4359 
4360 	return 0;
4361 }
4362 
4363 static void
4364 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
4365 {
4366 	struct ifnet *ifp = sc->sc_ifp;
4367 	struct ieee80211com *ic = ifp->if_l2com;
4368 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4369 	uint32_t tmp;
4370 
4371 	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
4372 
4373 	tmp &= ~0x1fffff;
4374 	tmp |= vap->iv_bss->ni_intval * 16;
4375 	tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
4376 	if (vap->iv_opmode == IEEE80211_M_STA) {
4377 		/*
4378 		 * Local TSF is always updated with remote TSF on beacon
4379 		 * reception.
4380 		 */
4381 		tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
4382 	}
4383 	else if (vap->iv_opmode == IEEE80211_M_IBSS ||
4384 	    vap->iv_opmode == IEEE80211_M_MBSS) {
4385 		tmp |= RT2860_BCN_TX_EN;
4386 		/*
4387 		 * Local TSF is updated with remote TSF on beacon reception
4388 		 * only if the remote TSF is greater than local TSF.
4389 		 */
4390 		tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
4391 	} else if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
4392 		tmp |= RT2860_BCN_TX_EN;
4393 		/* SYNC with nobody */
4394 		tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
4395 	}
4396 
4397 	RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
4398 }
4399