xref: /dragonfly/sys/dev/netif/ral/rt2860.c (revision 279dd846)
1 /*-
2  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
3  * Copyright (c) 2012 Bernhard Schmidt <bschmidt@FreeBSD.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $OpenBSD: rt2860.c,v 1.65 2010/10/23 14:24:54 damien Exp $
18  * $FreeBSD: src/sys/dev/ral/rt2860.c,v 1.3 2012/12/04 11:18:52 svnexp Exp $
19  */
20 
21 /*-
22  * Ralink Technology RT2860/RT3090/RT3390/RT3562 chipset driver
23  * http://www.ralinktech.com/
24  */
25 
26 #include <sys/param.h>
27 #include <sys/sysctl.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/malloc.h>
34 #include <sys/module.h>
35 #include <sys/bus.h>
36 #include <sys/endian.h>
37 #include <sys/firmware.h>
38 
39 #include <sys/rman.h>
40 
41 #include <net/bpf.h>
42 #include <net/if.h>
43 #include <net/if_arp.h>
44 #include <net/ethernet.h>
45 #include <net/if_dl.h>
46 #include <net/if_media.h>
47 #include <net/if_types.h>
48 #include <net/ifq_var.h>
49 
50 #include <netproto/802_11/ieee80211_var.h>
51 #include <netproto/802_11/ieee80211_radiotap.h>
52 #include <netproto/802_11/ieee80211_regdomain.h>
53 #include <netproto/802_11/ieee80211_ratectl.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/in_var.h>
58 #include <netinet/ip.h>
59 #include <netinet/if_ether.h>
60 
61 #include <dev/netif/ral/rt2860reg.h>
62 #include <dev/netif/ral/rt2860var.h>
63 
64 #define RAL_DEBUG
65 #ifdef RAL_DEBUG
66 #define DPRINTF(x)	do { if (sc->sc_debug > 0) kprintf x; } while (0)
67 #define DPRINTFN(n, x)	do { if (sc->sc_debug >= (n)) kprintf x; } while (0)
68 #else
69 #define DPRINTF(x)
70 #define DPRINTFN(n, x)
71 #endif
72 
73 static struct ieee80211vap *rt2860_vap_create(struct ieee80211com *,
74 			    const char [IFNAMSIZ], int,
75 			    enum ieee80211_opmode,
76 			    int, const uint8_t [IEEE80211_ADDR_LEN],
77 			    const uint8_t [IEEE80211_ADDR_LEN]);
78 static void	rt2860_vap_delete(struct ieee80211vap *);
79 static void	rt2860_dma_map_addr(void *, bus_dma_segment_t *, int, int);
80 static int	rt2860_alloc_tx_ring(struct rt2860_softc *,
81 		    struct rt2860_tx_ring *);
82 static void	rt2860_reset_tx_ring(struct rt2860_softc *,
83 		    struct rt2860_tx_ring *);
84 static void	rt2860_free_tx_ring(struct rt2860_softc *,
85 		    struct rt2860_tx_ring *);
86 static int	rt2860_alloc_tx_pool(struct rt2860_softc *);
87 static void	rt2860_free_tx_pool(struct rt2860_softc *);
88 static int	rt2860_alloc_rx_ring(struct rt2860_softc *,
89 		    struct rt2860_rx_ring *);
90 static void	rt2860_reset_rx_ring(struct rt2860_softc *,
91 		    struct rt2860_rx_ring *);
92 static void	rt2860_free_rx_ring(struct rt2860_softc *,
93 		    struct rt2860_rx_ring *);
94 static void	rt2860_updatestats(struct rt2860_softc *);
95 static void	rt2860_newassoc(struct ieee80211_node *, int);
96 static void	rt2860_node_free(struct ieee80211_node *);
97 #ifdef IEEE80211_HT
98 static int	rt2860_ampdu_rx_start(struct ieee80211com *,
99 		    struct ieee80211_node *, uint8_t);
100 static void	rt2860_ampdu_rx_stop(struct ieee80211com *,
101 		    struct ieee80211_node *, uint8_t);
102 #endif
103 static int	rt2860_newstate(struct ieee80211vap *, enum ieee80211_state,
104 		    int);
105 static uint16_t	rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
106 static uint16_t	rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
107 static void	rt2860_intr_coherent(struct rt2860_softc *);
108 static void	rt2860_drain_stats_fifo(struct rt2860_softc *);
109 static void	rt2860_tx_intr(struct rt2860_softc *, int);
110 static void	rt2860_rx_intr(struct rt2860_softc *);
111 static void	rt2860_tbtt_intr(struct rt2860_softc *);
112 static void	rt2860_gp_intr(struct rt2860_softc *);
113 static int	rt2860_tx(struct rt2860_softc *, struct mbuf *,
114 		    struct ieee80211_node *);
115 static int	rt2860_raw_xmit(struct ieee80211_node *, struct mbuf *,
116 		    const struct ieee80211_bpf_params *);
117 #if 0
118 static int	rt2860_tx_raw(struct rt2860_softc *, struct mbuf *,
119 		    struct ieee80211_node *,
120 		    const struct ieee80211_bpf_params *params);
121 #endif
122 static void	rt2860_start(struct ifnet *, struct ifaltq_subque *);
123 static void	rt2860_start_locked(struct ifnet *);
124 static void	rt2860_watchdog(void *);
125 static int	rt2860_ioctl(struct ifnet *, u_long, caddr_t, struct ucred *);
126 static void	rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
127 static uint8_t	rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
128 static void	rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
129 static uint8_t	rt3090_rf_read(struct rt2860_softc *, uint8_t);
130 static void	rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
131 static int	rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
132 static void	rt2860_enable_mrr(struct rt2860_softc *);
133 static void	rt2860_set_txpreamble(struct rt2860_softc *);
134 static void	rt2860_set_basicrates(struct rt2860_softc *,
135 		    const struct ieee80211_rateset *);
136 static void	rt2860_scan_start(struct ieee80211com *);
137 static void	rt2860_scan_end(struct ieee80211com *);
138 static void	rt2860_set_channel(struct ieee80211com *);
139 static void	rt2860_select_chan_group(struct rt2860_softc *, int);
140 static void	rt2860_set_chan(struct rt2860_softc *, u_int);
141 static void	rt3090_set_chan(struct rt2860_softc *, u_int);
142 static int	rt3090_rf_init(struct rt2860_softc *);
143 static void	rt3090_rf_wakeup(struct rt2860_softc *);
144 static int	rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
145 		    uint8_t *);
146 static void	rt3090_rf_setup(struct rt2860_softc *);
147 static void	rt2860_set_leds(struct rt2860_softc *, uint16_t);
148 static void	rt2860_set_gp_timer(struct rt2860_softc *, int);
149 static void	rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
150 static void	rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
151 static void	rt2860_update_promisc(struct ifnet *);
152 static void	rt2860_updateslot(struct ifnet *);
153 static void	rt2860_updateprot(struct ifnet *);
154 static int	rt2860_updateedca(struct ieee80211com *);
155 #ifdef HW_CRYPTO
156 static int	rt2860_set_key(struct ieee80211com *, struct ieee80211_node *,
157 		    struct ieee80211_key *);
158 static void	rt2860_delete_key(struct ieee80211com *,
159 		    struct ieee80211_node *, struct ieee80211_key *);
160 #endif
161 static int8_t	rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
162 static const char *rt2860_get_rf(uint8_t);
163 static int	rt2860_read_eeprom(struct rt2860_softc *,
164 		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
165 static int	rt2860_bbp_init(struct rt2860_softc *);
166 static int	rt2860_txrx_enable(struct rt2860_softc *);
167 static void	rt2860_init(void *);
168 static void	rt2860_init_locked(struct rt2860_softc *);
169 static void	rt2860_stop(void *);
170 static void	rt2860_stop_locked(struct rt2860_softc *);
171 static int	rt2860_load_microcode(struct rt2860_softc *);
172 #ifdef NOT_YET
173 static void	rt2860_calib(struct rt2860_softc *);
174 #endif
175 static void	rt3090_set_rx_antenna(struct rt2860_softc *, int);
176 static void	rt2860_switch_chan(struct rt2860_softc *,
177 		    struct ieee80211_channel *);
178 static int	rt2860_setup_beacon(struct rt2860_softc *,
179 		    struct ieee80211vap *);
180 static void	rt2860_enable_tsf_sync(struct rt2860_softc *);
181 
182 static const struct {
183 	uint32_t	reg;
184 	uint32_t	val;
185 } rt2860_def_mac[] = {
186 	RT2860_DEF_MAC
187 };
188 
189 static const struct {
190 	uint8_t	reg;
191 	uint8_t	val;
192 } rt2860_def_bbp[] = {
193 	RT2860_DEF_BBP
194 };
195 
196 static const struct rfprog {
197 	uint8_t		chan;
198 	uint32_t	r1, r2, r3, r4;
199 } rt2860_rf2850[] = {
200 	RT2860_RF2850
201 };
202 
203 struct {
204 	uint8_t	n, r, k;
205 } rt3090_freqs[] = {
206 	RT3070_RF3052
207 };
208 
209 static const struct {
210 	uint8_t	reg;
211 	uint8_t	val;
212 }  rt3090_def_rf[] = {
213 	RT3070_DEF_RF
214 };
215 
216 int
217 rt2860_attach(device_t dev, int id)
218 {
219 	struct rt2860_softc *sc = device_get_softc(dev);
220 	struct ieee80211com *ic;
221 	struct ifnet *ifp;
222 	uint32_t tmp;
223 	int error, ntries, qid;
224 	uint8_t bands;
225 	uint8_t macaddr[IEEE80211_ADDR_LEN];
226 	struct sysctl_ctx_list *ctx;
227 	struct sysctl_oid *tree;
228 
229 	sc->sc_dev = dev;
230 	sc->sc_debug = 0;
231 
232 	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
233 	if (ifp == NULL) {
234 		device_printf(sc->sc_dev, "can not if_alloc()\n");
235 		return ENOMEM;
236 	}
237 	ic = ifp->if_l2com;
238 
239 	callout_init(&sc->watchdog_ch);
240 
241 	/* wait for NIC to initialize */
242 	for (ntries = 0; ntries < 100; ntries++) {
243 		tmp = RAL_READ(sc, RT2860_ASIC_VER_ID);
244 		if (tmp != 0 && tmp != 0xffffffff)
245 			break;
246 		DELAY(10);
247 	}
248 	if (ntries == 100) {
249 		device_printf(sc->sc_dev,
250 		    "timeout waiting for NIC to initialize\n");
251 		error = EIO;
252 		goto fail1;
253 	}
254 	sc->mac_ver = tmp >> 16;
255 	sc->mac_rev = tmp & 0xffff;
256 
257 	if (sc->mac_ver != 0x2860 &&
258 	    (id == 0x0681 || id == 0x0781 || id == 0x1059))
259 		sc->sc_flags |= RT2860_ADVANCED_PS;
260 
261 	/* retrieve RF rev. no and various other things from EEPROM */
262 	rt2860_read_eeprom(sc, macaddr);
263 	if (bootverbose) {
264 		char ethstr[ETHER_ADDRSTRLEN + 1];
265 
266 		device_printf(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
267 		    "RF %s (MIMO %dT%dR), address %s\n",
268 		    sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
269 		    sc->ntxchains, sc->nrxchains,
270 		    kether_ntoa(macaddr, ethstr));
271 	}
272 
273 	/*
274 	 * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
275 	 */
276 	for (qid = 0; qid < 6; qid++) {
277 		if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
278 			device_printf(sc->sc_dev,
279 			    "could not allocate Tx ring %d\n", qid);
280 			goto fail2;
281 		}
282 	}
283 
284 	if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
285 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
286 		goto fail2;
287 	}
288 
289 	if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
290 		device_printf(sc->sc_dev, "could not allocate Tx pool\n");
291 		goto fail3;
292 	}
293 
294 	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
295 	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
296 	    WME_AC_VO : 5;
297 
298 	ifp->if_softc = sc;
299 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
300 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
301 	ifp->if_init = rt2860_init;
302 	ifp->if_ioctl = rt2860_ioctl;
303 	ifp->if_start = rt2860_start;
304 	ifq_set_maxlen(&ifp->if_snd, ifqmaxlen);
305 #ifdef notyet
306 	ifq_set_ready(&ifp->if_snd);
307 #endif
308 
309 	ic->ic_ifp = ifp;
310 	ic->ic_opmode = IEEE80211_M_STA;
311 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
312 
313 	/* set device capabilities */
314 	ic->ic_caps =
315 		  IEEE80211_C_STA		/* station mode */
316 		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
317 		| IEEE80211_C_HOSTAP		/* hostap mode */
318 		| IEEE80211_C_MONITOR		/* monitor mode */
319 		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
320 		| IEEE80211_C_WDS		/* 4-address traffic works */
321 		| IEEE80211_C_MBSS		/* mesh point link mode */
322 		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
323 		| IEEE80211_C_SHSLOT		/* short slot time supported */
324 		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
325 #if 0
326 		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
327 #endif
328 		| IEEE80211_C_WME		/* 802.11e */
329 		;
330 
331 	bands = 0;
332 	setbit(&bands, IEEE80211_MODE_11B);
333 	setbit(&bands, IEEE80211_MODE_11G);
334 	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850)
335 		setbit(&bands, IEEE80211_MODE_11A);
336 	ieee80211_init_channels(ic, NULL, &bands);
337 
338 	ieee80211_ifattach(ic, macaddr);
339 
340 	ic->ic_wme.wme_update = rt2860_updateedca;
341 	ic->ic_scan_start = rt2860_scan_start;
342 	ic->ic_scan_end = rt2860_scan_end;
343 	ic->ic_set_channel = rt2860_set_channel;
344 	ic->ic_updateslot = rt2860_updateslot;
345 	ic->ic_update_promisc = rt2860_update_promisc;
346 	ic->ic_raw_xmit = rt2860_raw_xmit;
347 	sc->sc_node_free = ic->ic_node_free;
348 	ic->ic_node_free = rt2860_node_free;
349 	ic->ic_newassoc = rt2860_newassoc;
350 
351 	ic->ic_vap_create = rt2860_vap_create;
352 	ic->ic_vap_delete = rt2860_vap_delete;
353 
354 	ieee80211_radiotap_attach(ic,
355 	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
356 		RT2860_TX_RADIOTAP_PRESENT,
357 	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
358 		RT2860_RX_RADIOTAP_PRESENT);
359 
360 	ctx = device_get_sysctl_ctx(sc->sc_dev);
361 	tree = device_get_sysctl_tree(sc->sc_dev);
362 #ifdef RAL_DEBUG
363 	SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
364 	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
365 #endif
366 	if (bootverbose)
367 		ieee80211_announce(ic);
368 
369 	return 0;
370 
371 fail3:	rt2860_free_rx_ring(sc, &sc->rxq);
372 fail2:	while (--qid >= 0)
373 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
374 fail1:
375 	if_free(ifp);
376 	return error;
377 }
378 
379 int
380 rt2860_detach(void *xsc)
381 {
382 	struct rt2860_softc *sc = xsc;
383 	struct ifnet *ifp =  sc->sc_ifp;
384 	struct ieee80211com *ic = ifp->if_l2com;
385 	int qid;
386 
387 	rt2860_stop_locked(sc);
388 
389 	ieee80211_ifdetach(ic);
390 
391 	for (qid = 0; qid < 6; qid++)
392 		rt2860_free_tx_ring(sc, &sc->txq[qid]);
393 	rt2860_free_rx_ring(sc, &sc->rxq);
394 	rt2860_free_tx_pool(sc);
395 
396 	if_free(ifp);
397 
398 	return 0;
399 }
400 
401 void
402 rt2860_shutdown(void *xsc)
403 {
404 	struct rt2860_softc *sc = xsc;
405 
406 	rt2860_stop(sc);
407 }
408 
409 void
410 rt2860_suspend(void *xsc)
411 {
412 	struct rt2860_softc *sc = xsc;
413 
414 	rt2860_stop(sc);
415 }
416 
417 void
418 rt2860_resume(void *xsc)
419 {
420 	struct rt2860_softc *sc = xsc;
421 	struct ifnet *ifp = sc->sc_ifp;
422 
423 	if (ifp->if_flags & IFF_UP)
424 		rt2860_init(sc);
425 }
426 
427 static struct ieee80211vap *
428 rt2860_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
429     enum ieee80211_opmode opmode, int flags,
430     const uint8_t bssid[IEEE80211_ADDR_LEN],
431     const uint8_t mac[IEEE80211_ADDR_LEN])
432 {
433 	struct ifnet *ifp = ic->ic_ifp;
434 	struct rt2860_vap *rvp;
435 	struct ieee80211vap *vap;
436 
437 	switch (opmode) {
438 	case IEEE80211_M_STA:
439 	case IEEE80211_M_IBSS:
440 	case IEEE80211_M_AHDEMO:
441 	case IEEE80211_M_MONITOR:
442 	case IEEE80211_M_HOSTAP:
443 	case IEEE80211_M_MBSS:
444 		/* XXXRP: TBD */
445 		if (!TAILQ_EMPTY(&ic->ic_vaps)) {
446 			if_printf(ifp, "only 1 vap supported\n");
447 			return NULL;
448 		}
449 		if (opmode == IEEE80211_M_STA)
450 			flags |= IEEE80211_CLONE_NOBEACONS;
451 		break;
452 	case IEEE80211_M_WDS:
453 		if (TAILQ_EMPTY(&ic->ic_vaps) ||
454 		    ic->ic_opmode != IEEE80211_M_HOSTAP) {
455 			if_printf(ifp, "wds only supported in ap mode\n");
456 			return NULL;
457 		}
458 		/*
459 		 * Silently remove any request for a unique
460 		 * bssid; WDS vap's always share the local
461 		 * mac address.
462 		 */
463 		flags &= ~IEEE80211_CLONE_BSSID;
464 		break;
465 	default:
466 		if_printf(ifp, "unknown opmode %d\n", opmode);
467 		return NULL;
468 	}
469 	rvp = kmalloc(sizeof(struct rt2860_vap), M_80211_VAP, M_NOWAIT | M_ZERO);
470 	if (rvp == NULL)
471 		return NULL;
472 	vap = &rvp->ral_vap;
473 	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
474 
475 	/* override state transition machine */
476 	rvp->ral_newstate = vap->iv_newstate;
477 	vap->iv_newstate = rt2860_newstate;
478 #if 0
479 	vap->iv_update_beacon = rt2860_beacon_update;
480 #endif
481 
482 	/* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
483 	vap->iv_max_aid = min(IEEE80211_AID_MAX, RT2860_WCID_MAX);
484 
485 	ieee80211_ratectl_init(vap);
486 	/* complete setup */
487 	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
488 	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
489 		ic->ic_opmode = opmode;
490 	return vap;
491 }
492 
493 static void
494 rt2860_vap_delete(struct ieee80211vap *vap)
495 {
496 	struct rt2860_vap *rvp = RT2860_VAP(vap);
497 
498 	ieee80211_ratectl_deinit(vap);
499 	ieee80211_vap_detach(vap);
500 	kfree(rvp, M_80211_VAP);
501 }
502 
503 static void
504 rt2860_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
505 {
506 	if (error != 0)
507 		return;
508 
509 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
510 
511 	*(bus_addr_t *)arg = segs[0].ds_addr;
512 }
513 
514 
515 static int
516 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
517 {
518 	int size, error;
519 
520 	size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
521 
522 	error = bus_dma_tag_create(ring->desc_dmat, 16, 0,
523 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
524 	    size, 1, size, 0, &ring->desc_dmat);
525 	if (error != 0) {
526 		device_printf(sc->sc_dev, "could not create desc DMA map\n");
527 		goto fail;
528 	}
529 
530 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->txd,
531 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
532 	if (error != 0) {
533 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
534 		goto fail;
535 	}
536 
537 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->txd,
538 	    size, rt2860_dma_map_addr, &ring->paddr, 0);
539 	if (error != 0) {
540 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
541 		goto fail;
542 	}
543 
544 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
545 
546 	return 0;
547 
548 fail:	rt2860_free_tx_ring(sc, ring);
549 	return error;
550 }
551 
552 void
553 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
554 {
555 	struct rt2860_tx_data *data;
556 	int i;
557 
558 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
559 		if ((data = ring->data[i]) == NULL)
560 			continue;	/* nothing mapped in this slot */
561 
562 		if (data->m != NULL) {
563 			bus_dmamap_sync(sc->txwi_dmat, data->map,
564 			    BUS_DMASYNC_POSTWRITE);
565 			bus_dmamap_unload(sc->txwi_dmat, data->map);
566 			m_freem(data->m);
567 			data->m = NULL;
568 		}
569 		if (data->ni != NULL) {
570 			ieee80211_free_node(data->ni);
571 			data->ni = NULL;
572 		}
573 
574 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
575 		ring->data[i] = NULL;
576 	}
577 
578 	ring->queued = 0;
579 	ring->cur = ring->next = 0;
580 }
581 
582 void
583 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
584 {
585 	struct rt2860_tx_data *data;
586 	int i;
587 
588 	if (ring->txd != NULL) {
589 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
590 		    BUS_DMASYNC_POSTWRITE);
591 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
592 		bus_dmamem_free(ring->desc_dmat, ring->txd, ring->desc_map);
593 	}
594 	if (ring->desc_dmat != NULL)
595 		bus_dma_tag_destroy(ring->desc_dmat);
596 
597 	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
598 		if ((data = ring->data[i]) == NULL)
599 			continue;	/* nothing mapped in this slot */
600 
601 		if (data->m != NULL) {
602 			bus_dmamap_sync(sc->txwi_dmat, data->map,
603 			    BUS_DMASYNC_POSTWRITE);
604 			bus_dmamap_unload(sc->txwi_dmat, data->map);
605 			m_freem(data->m);
606 		}
607 		if (data->ni != NULL)
608 			ieee80211_free_node(data->ni);
609 
610 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
611 	}
612 }
613 
614 /*
615  * Allocate a pool of TX Wireless Information blocks.
616  */
617 int
618 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
619 {
620 	caddr_t vaddr;
621 	bus_addr_t paddr;
622 	int i, size, error;
623 
624 	size = RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ;
625 
626 	/* init data_pool early in case of failure.. */
627 	SLIST_INIT(&sc->data_pool);
628 
629 	error = bus_dma_tag_create(sc->txwi_dmat, 1, 0,
630 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
631 	    size, 1, size, 0, &sc->txwi_dmat);
632 	if (error != 0) {
633 		device_printf(sc->sc_dev, "could not create txwi DMA tag\n");
634 		goto fail;
635 	}
636 
637 	error = bus_dmamem_alloc(sc->txwi_dmat, (void **)&sc->txwi_vaddr,
638 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &sc->txwi_map);
639 	if (error != 0) {
640 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
641 		goto fail;
642 	}
643 
644 	error = bus_dmamap_load(sc->txwi_dmat, sc->txwi_map,
645 	    sc->txwi_vaddr, size, rt2860_dma_map_addr, &paddr, 0);
646 	if (error != 0) {
647 		device_printf(sc->sc_dev, "could not load txwi DMA map\n");
648 		goto fail;
649 	}
650 
651 	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
652 
653 	vaddr = sc->txwi_vaddr;
654 	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
655 		struct rt2860_tx_data *data = &sc->data[i];
656 
657 		error = bus_dmamap_create(sc->txwi_dmat, 0, &data->map);
658 		if (error != 0) {
659 			device_printf(sc->sc_dev, "could not create DMA map\n");
660 			goto fail;
661 		}
662 		data->txwi = (struct rt2860_txwi *)vaddr;
663 		data->paddr = paddr;
664 		vaddr += RT2860_TXWI_DMASZ;
665 		paddr += RT2860_TXWI_DMASZ;
666 
667 		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
668 	}
669 
670 	return 0;
671 
672 fail:	rt2860_free_tx_pool(sc);
673 	return error;
674 }
675 
676 void
677 rt2860_free_tx_pool(struct rt2860_softc *sc)
678 {
679 	if (sc->txwi_vaddr != NULL) {
680 		bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map,
681 		    BUS_DMASYNC_POSTWRITE);
682 		bus_dmamap_unload(sc->txwi_dmat, sc->txwi_map);
683 		bus_dmamem_free(sc->txwi_dmat, sc->txwi_vaddr, sc->txwi_map);
684 	}
685 	if (sc->txwi_dmat != NULL)
686 		bus_dma_tag_destroy(sc->txwi_dmat);
687 
688 	while (!SLIST_EMPTY(&sc->data_pool)) {
689 		struct rt2860_tx_data *data;
690 		data = SLIST_FIRST(&sc->data_pool);
691 		bus_dmamap_destroy(sc->txwi_dmat, data->map);
692 		SLIST_REMOVE_HEAD(&sc->data_pool, next);
693 	}
694 }
695 
696 int
697 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
698 {
699 	bus_addr_t physaddr;
700 	int i, size, error;
701 
702 	size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
703 
704 	error = bus_dma_tag_create(ring->desc_dmat, 16, 0,
705 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
706 	    size, 1, size, 0, &ring->desc_dmat);
707 	if (error != 0) {
708 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
709 		goto fail;
710 	}
711 
712 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->rxd,
713 	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
714 	if (error != 0) {
715 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
716 		goto fail;
717 	}
718 
719 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->rxd,
720 	    size, rt2860_dma_map_addr, &ring->paddr, 0);
721 	if (error != 0) {
722 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
723 		goto fail;
724 	}
725 
726 	error = bus_dma_tag_create(ring->data_dmat, 1, 0,
727 	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
728 	    1, MCLBYTES, 0, &ring->data_dmat);
729 	if (error != 0) {
730 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
731 		goto fail;
732 	}
733 
734 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
735 		struct rt2860_rx_data *data = &ring->data[i];
736 		struct rt2860_rxd *rxd = &ring->rxd[i];
737 
738 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
739 		if (error != 0) {
740 			device_printf(sc->sc_dev, "could not create DMA map\n");
741 			goto fail;
742 		}
743 
744 		data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
745 		if (data->m == NULL) {
746 			device_printf(sc->sc_dev,
747 			    "could not allocate rx mbuf\n");
748 			error = ENOMEM;
749 			goto fail;
750 		}
751 
752 		error = bus_dmamap_load(ring->data_dmat, data->map,
753 		    mtod(data->m, void *), MCLBYTES, rt2860_dma_map_addr,
754 		    &physaddr, 0);
755 		if (error != 0) {
756 			device_printf(sc->sc_dev,
757 			    "could not load rx buf DMA map");
758 			goto fail;
759 		}
760 
761 		rxd->sdp0 = htole32(physaddr);
762 		rxd->sdl0 = htole16(MCLBYTES);
763 	}
764 
765 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
766 
767 	return 0;
768 
769 fail:	rt2860_free_rx_ring(sc, ring);
770 	return error;
771 }
772 
773 void
774 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
775 {
776 	int i;
777 
778 	for (i = 0; i < RT2860_RX_RING_COUNT; i++)
779 		ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE);
780 
781 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
782 
783 	ring->cur = 0;
784 }
785 
786 void
787 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
788 {
789 	int i;
790 
791 	if (ring->rxd != NULL) {
792 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
793 		    BUS_DMASYNC_POSTWRITE);
794 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
795 		bus_dmamem_free(ring->desc_dmat, ring->rxd, ring->desc_map);
796 	}
797 	if (ring->desc_dmat != NULL)
798 		bus_dma_tag_destroy(ring->desc_dmat);
799 
800 	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
801 		struct rt2860_rx_data *data = &ring->data[i];
802 
803 		if (data->m != NULL) {
804 			bus_dmamap_sync(ring->data_dmat, data->map,
805 			    BUS_DMASYNC_POSTREAD);
806 			bus_dmamap_unload(ring->data_dmat, data->map);
807 			m_freem(data->m);
808 		}
809 		if (data->map != NULL)
810 			bus_dmamap_destroy(ring->data_dmat, data->map);
811 	}
812 	if (ring->data_dmat != NULL)
813 		bus_dma_tag_destroy(ring->data_dmat);
814 }
815 
816 static void
817 rt2860_updatestats(struct rt2860_softc *sc)
818 {
819 	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
820 
821 	/*
822 	 * In IBSS or HostAP modes (when the hardware sends beacons), the
823 	 * MAC can run into a livelock and start sending CTS-to-self frames
824 	 * like crazy if protection is enabled.  Fortunately, we can detect
825 	 * when such a situation occurs and reset the MAC.
826 	 */
827 	if (ic->ic_curmode != IEEE80211_M_STA) {
828 		/* check if we're in a livelock situation.. */
829 		uint32_t tmp = RAL_READ(sc, RT2860_DEBUG);
830 		if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
831 			/* ..and reset MAC/BBP for a while.. */
832 			DPRINTF(("CTS-to-self livelock detected\n"));
833 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
834 			RAL_BARRIER_WRITE(sc);
835 			DELAY(1);
836 			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
837 			    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
838 		}
839 	}
840 }
841 
842 static void
843 rt2860_newassoc(struct ieee80211_node *ni, int isnew)
844 {
845 	struct ieee80211com *ic = ni->ni_ic;
846 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
847 	uint8_t wcid;
848 	char ethstr[ETHER_ADDRSTRLEN + 1];
849 
850 	wcid = IEEE80211_AID(ni->ni_associd);
851 	if (isnew && ni->ni_associd != 0) {
852 		sc->wcid2ni[wcid] = ni;
853 
854 		/* init WCID table entry */
855 		RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),
856 		    ni->ni_macaddr, IEEE80211_ADDR_LEN);
857 	}
858 	DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
859 	    isnew, kether_ntoa(ni->ni_macaddr, ethstr), wcid));
860 }
861 
862 static void
863 rt2860_node_free(struct ieee80211_node *ni)
864 {
865 	struct ieee80211com *ic = ni->ni_ic;
866 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
867 	uint8_t wcid;
868 
869 	if (ni->ni_associd != 0) {
870 		wcid = IEEE80211_AID(ni->ni_associd);
871 
872 		/* clear Rx WCID search table entry */
873 		RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(wcid), 0, 2);
874 	}
875 	sc->sc_node_free(ni);
876 }
877 
878 #ifdef IEEE80211_HT
879 static int
880 rt2860_ampdu_rx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
881     uint8_t tid)
882 {
883 	struct rt2860_softc *sc = ic->ic_softc;
884 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
885 	uint32_t tmp;
886 
887 	/* update BA session mask */
888 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
889 	tmp |= (1 << tid) << 16;
890 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
891 	return 0;
892 }
893 
894 static void
895 rt2860_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
896     uint8_t tid)
897 {
898 	struct rt2860_softc *sc = ic->ic_softc;
899 	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
900 	uint32_t tmp;
901 
902 	/* update BA session mask */
903 	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
904 	tmp &= ~((1 << tid) << 16);
905 	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
906 }
907 #endif
908 
909 int
910 rt2860_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
911 {
912 	struct rt2860_vap *rvp = RT2860_VAP(vap);
913 	struct ieee80211com *ic = vap->iv_ic;
914 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
915 	uint32_t tmp;
916 	int error;
917 
918 	if (vap->iv_state == IEEE80211_S_RUN) {
919 		/* turn link LED off */
920 		rt2860_set_leds(sc, RT2860_LED_RADIO);
921 	}
922 
923 	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
924 		/* abort TSF synchronization */
925 		tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
926 		RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
927 		    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
928 		    RT2860_TBTT_TIMER_EN));
929 	}
930 
931 	rt2860_set_gp_timer(sc, 0);
932 
933 	error = rvp->ral_newstate(vap, nstate, arg);
934 	if (error != 0)
935 		return (error);
936 
937 	if (nstate == IEEE80211_S_RUN) {
938 		struct ieee80211_node *ni = vap->iv_bss;
939 
940 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
941 			rt2860_enable_mrr(sc);
942 			rt2860_set_txpreamble(sc);
943 			rt2860_set_basicrates(sc, &ni->ni_rates);
944 			rt2860_set_bssid(sc, ni->ni_bssid);
945 		}
946 
947 		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
948 		    vap->iv_opmode == IEEE80211_M_IBSS ||
949 		    vap->iv_opmode == IEEE80211_M_MBSS) {
950 			error = rt2860_setup_beacon(sc, vap);
951 			if (error != 0)
952 				return error;
953 		}
954 
955 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
956 			rt2860_enable_tsf_sync(sc);
957 			rt2860_set_gp_timer(sc, 500);
958 		}
959 
960 		/* turn link LED on */
961 		rt2860_set_leds(sc, RT2860_LED_RADIO |
962 		    (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan) ?
963 		     RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
964 	}
965 	return error;
966 }
967 
968 /* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
969 static uint16_t
970 rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
971 {
972 	uint32_t tmp;
973 	uint16_t reg;
974 	int ntries;
975 
976 	addr *= 2;
977 	/*-
978 	 * Read one 16-byte block into registers EFUSE_DATA[0-3]:
979 	 * DATA0: F E D C
980 	 * DATA1: B A 9 8
981 	 * DATA2: 7 6 5 4
982 	 * DATA3: 3 2 1 0
983 	 */
984 	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
985 	tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
986 	tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
987 	RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp);
988 	for (ntries = 0; ntries < 500; ntries++) {
989 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
990 		if (!(tmp & RT3070_EFSROM_KICK))
991 			break;
992 		DELAY(2);
993 	}
994 	if (ntries == 500)
995 		return 0xffff;
996 
997 	if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK)
998 		return 0xffff;	/* address not found */
999 
1000 	/* determine to which 32-bit register our 16-bit word belongs */
1001 	reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
1002 	tmp = RAL_READ(sc, reg);
1003 
1004 	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
1005 }
1006 
1007 /*
1008  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
1009  * 93C66 or 93C86).
1010  */
1011 static uint16_t
1012 rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
1013 {
1014 	uint32_t tmp;
1015 	uint16_t val;
1016 	int n;
1017 
1018 	/* clock C once before the first command */
1019 	RT2860_EEPROM_CTL(sc, 0);
1020 
1021 	RT2860_EEPROM_CTL(sc, RT2860_S);
1022 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1023 	RT2860_EEPROM_CTL(sc, RT2860_S);
1024 
1025 	/* write start bit (1) */
1026 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1027 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1028 
1029 	/* write READ opcode (10) */
1030 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1031 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1032 	RT2860_EEPROM_CTL(sc, RT2860_S);
1033 	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1034 
1035 	/* write address (A5-A0 or A7-A0) */
1036 	n = ((RAL_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
1037 	for (; n >= 0; n--) {
1038 		RT2860_EEPROM_CTL(sc, RT2860_S |
1039 		    (((addr >> n) & 1) << RT2860_SHIFT_D));
1040 		RT2860_EEPROM_CTL(sc, RT2860_S |
1041 		    (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
1042 	}
1043 
1044 	RT2860_EEPROM_CTL(sc, RT2860_S);
1045 
1046 	/* read data Q15-Q0 */
1047 	val = 0;
1048 	for (n = 15; n >= 0; n--) {
1049 		RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1050 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
1051 		val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
1052 		RT2860_EEPROM_CTL(sc, RT2860_S);
1053 	}
1054 
1055 	RT2860_EEPROM_CTL(sc, 0);
1056 
1057 	/* clear Chip Select and clock C */
1058 	RT2860_EEPROM_CTL(sc, RT2860_S);
1059 	RT2860_EEPROM_CTL(sc, 0);
1060 	RT2860_EEPROM_CTL(sc, RT2860_C);
1061 
1062 	return val;
1063 }
1064 
1065 static __inline uint16_t
1066 rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
1067 {
1068 	/* either eFUSE ROM or EEPROM */
1069 	return sc->sc_srom_read(sc, addr);
1070 }
1071 
1072 static void
1073 rt2860_intr_coherent(struct rt2860_softc *sc)
1074 {
1075 	uint32_t tmp;
1076 
1077 	/* DMA finds data coherent event when checking the DDONE bit */
1078 
1079 	DPRINTF(("Tx/Rx Coherent interrupt\n"));
1080 
1081 	/* restart DMA engine */
1082 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
1083 	tmp &= ~(RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
1084 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
1085 
1086 	(void)rt2860_txrx_enable(sc);
1087 }
1088 
1089 static void
1090 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1091 {
1092 	struct ifnet *ifp = sc->sc_ifp;
1093 	struct ieee80211_node *ni;
1094 	uint32_t stat;
1095 	int retrycnt;
1096 	uint8_t wcid, mcs, pid;
1097 
1098 	/* drain Tx status FIFO (maxsize = 16) */
1099 	while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
1100 		DPRINTFN(4, ("tx stat 0x%08x\n", stat));
1101 
1102 		wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
1103 		ni = sc->wcid2ni[wcid];
1104 
1105 		/* if no ACK was requested, no feedback is available */
1106 		if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff || ni == NULL)
1107 			continue;
1108 
1109 		/* update per-STA AMRR stats */
1110 		if (stat & RT2860_TXQ_OK) {
1111 			/*
1112 			 * Check if there were retries, ie if the Tx success
1113 			 * rate is different from the requested rate.  Note
1114 			 * that it works only because we do not allow rate
1115 			 * fallback from OFDM to CCK.
1116 			 */
1117 			mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
1118 			pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
1119 			if (mcs + 1 != pid)
1120 				retrycnt = 1;
1121 			else
1122 				retrycnt = 0;
1123 			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1124 			    IEEE80211_RATECTL_TX_SUCCESS, &retrycnt, NULL);
1125 		} else {
1126 			ieee80211_ratectl_tx_complete(ni->ni_vap, ni,
1127 			    IEEE80211_RATECTL_TX_FAILURE, &retrycnt, NULL);
1128 			IFNET_STAT_INC(ifp, oerrors, 1);
1129 		}
1130 	}
1131 }
1132 
1133 static void
1134 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1135 {
1136 	struct ifnet *ifp = sc->sc_ifp;
1137 	struct rt2860_tx_ring *ring = &sc->txq[qid];
1138 	uint32_t hw;
1139 
1140 	rt2860_drain_stats_fifo(sc);
1141 
1142 	hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid));
1143 	while (ring->next != hw) {
1144 		struct rt2860_tx_data *data = ring->data[ring->next];
1145 
1146 		if (data != NULL) {
1147 			bus_dmamap_sync(sc->txwi_dmat, data->map,
1148 			    BUS_DMASYNC_POSTWRITE);
1149 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1150 			if (data->m->m_flags & M_TXCB) {
1151 				ieee80211_process_callback(data->ni, data->m,
1152 				    0);
1153 			}
1154 			m_freem(data->m);
1155 			ieee80211_free_node(data->ni);
1156 			data->m = NULL;
1157 			data->ni = NULL;
1158 
1159 			SLIST_INSERT_HEAD(&sc->data_pool, data, next);
1160 			ring->data[ring->next] = NULL;
1161 
1162 			IFNET_STAT_INC(ifp, opackets, 1);
1163 		}
1164 		ring->queued--;
1165 		ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
1166 	}
1167 
1168 	sc->sc_tx_timer = 0;
1169 	if (ring->queued < RT2860_TX_RING_COUNT)
1170 		sc->qfullmsk &= ~(1 << qid);
1171 	ifq_clr_oactive(&ifp->if_snd);
1172 	rt2860_start_locked(ifp);
1173 }
1174 
1175 /*
1176  * Return the Rx chain with the highest RSSI for a given frame.
1177  */
1178 static __inline uint8_t
1179 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
1180 {
1181 	uint8_t rxchain = 0;
1182 
1183 	if (sc->nrxchains > 1) {
1184 		if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1185 			rxchain = 1;
1186 		if (sc->nrxchains > 2)
1187 			if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1188 				rxchain = 2;
1189 	}
1190 	return rxchain;
1191 }
1192 
1193 static void
1194 rt2860_rx_intr(struct rt2860_softc *sc)
1195 {
1196 	struct rt2860_rx_radiotap_header *tap;
1197 	struct ifnet *ifp = sc->sc_ifp;
1198 	struct ieee80211com *ic = ifp->if_l2com;
1199 	struct ieee80211_frame *wh;
1200 	struct ieee80211_node *ni;
1201 	struct mbuf *m, *m1;
1202 	bus_addr_t physaddr;
1203 	uint32_t hw;
1204 	uint16_t phy;
1205 	uint8_t ant;
1206 	int8_t rssi, nf;
1207 	int error;
1208 
1209 	hw = RAL_READ(sc, RT2860_FS_DRX_IDX) & 0xfff;
1210 	while (sc->rxq.cur != hw) {
1211 		struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1212 		struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1213 		struct rt2860_rxwi *rxwi;
1214 
1215 		bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1216 		    BUS_DMASYNC_POSTREAD);
1217 
1218 		if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))) {
1219 			DPRINTF(("RXD DDONE bit not set!\n"));
1220 			break;	/* should not happen */
1221 		}
1222 
1223 		if (__predict_false(rxd->flags &
1224 		    htole32(RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
1225 			IFNET_STAT_INC(ifp, ierrors, 1);
1226 			goto skip;
1227 		}
1228 
1229 #ifdef HW_CRYPTO
1230 		if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))) {
1231 			/* report MIC failures to net80211 for TKIP */
1232 			ic->ic_stats.is_rx_locmicfail++;
1233 			ieee80211_michael_mic_failure(ic, 0/* XXX */);
1234 			IFNET_STAT_INC(ifp, ierrors, 1);
1235 			goto skip;
1236 		}
1237 #endif
1238 
1239 		m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1240 		if (__predict_false(m1 == NULL)) {
1241 			IFNET_STAT_INC(ifp, ierrors, 1);
1242 			goto skip;
1243 		}
1244 
1245 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1246 		    BUS_DMASYNC_POSTREAD);
1247 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1248 
1249 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1250 		    mtod(m1, void *), MCLBYTES, rt2860_dma_map_addr,
1251 		    &physaddr, 0);
1252 		if (__predict_false(error != 0)) {
1253 			m_freem(m1);
1254 
1255 			/* try to reload the old mbuf */
1256 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1257 			    mtod(data->m, void *), MCLBYTES,
1258 			    rt2860_dma_map_addr, &physaddr, 0);
1259 			if (__predict_false(error != 0)) {
1260 				panic("%s: could not load old rx mbuf",
1261 				    device_get_name(sc->sc_dev));
1262 			}
1263 			/* physical address may have changed */
1264 			rxd->sdp0 = htole32(physaddr);
1265 			IFNET_STAT_INC(ifp, ierrors, 1);
1266 			goto skip;
1267 		}
1268 
1269 		/*
1270 		 * New mbuf successfully loaded, update Rx ring and continue
1271 		 * processing.
1272 		 */
1273 		m = data->m;
1274 		data->m = m1;
1275 		rxd->sdp0 = htole32(physaddr);
1276 
1277 		rxwi = mtod(m, struct rt2860_rxwi *);
1278 
1279 		/* finalize mbuf */
1280 		m->m_pkthdr.rcvif = ifp;
1281 		m->m_data = (caddr_t)(rxwi + 1);
1282 		m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;
1283 
1284 		wh = mtod(m, struct ieee80211_frame *);
1285 #ifdef HW_CRYPTO
1286 		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1287 			/* frame is decrypted by hardware */
1288 			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
1289 		}
1290 #endif
1291 
1292 		/* HW may insert 2 padding bytes after 802.11 header */
1293 		if (rxd->flags & htole32(RT2860_RX_L2PAD)) {
1294 			u_int hdrlen = ieee80211_hdrsize(wh);
1295 			ovbcopy(wh, (caddr_t)wh + 2, hdrlen);
1296 			m->m_data += 2;
1297 			wh = mtod(m, struct ieee80211_frame *);
1298 		}
1299 
1300 		ant = rt2860_maxrssi_chain(sc, rxwi);
1301 		rssi = rt2860_rssi2dbm(sc, rxwi->rssi[ant], ant);
1302 		nf = RT2860_NOISE_FLOOR;
1303 
1304 		if (ieee80211_radiotap_active(ic)) {
1305 			tap = &sc->sc_rxtap;
1306 			tap->wr_flags = 0;
1307 			tap->wr_antenna = ant;
1308 			tap->wr_antsignal = nf + rssi;
1309 			tap->wr_antnoise = nf;
1310 			/* in case it can't be found below */
1311 			tap->wr_rate = 2;
1312 			phy = le16toh(rxwi->phy);
1313 			switch (phy & RT2860_PHY_MODE) {
1314 			case RT2860_PHY_CCK:
1315 				switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
1316 				case 0:	tap->wr_rate =   2; break;
1317 				case 1:	tap->wr_rate =   4; break;
1318 				case 2:	tap->wr_rate =  11; break;
1319 				case 3:	tap->wr_rate =  22; break;
1320 				}
1321 				if (phy & RT2860_PHY_SHPRE)
1322 					tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1323 				break;
1324 			case RT2860_PHY_OFDM:
1325 				switch (phy & RT2860_PHY_MCS) {
1326 				case 0:	tap->wr_rate =  12; break;
1327 				case 1:	tap->wr_rate =  18; break;
1328 				case 2:	tap->wr_rate =  24; break;
1329 				case 3:	tap->wr_rate =  36; break;
1330 				case 4:	tap->wr_rate =  48; break;
1331 				case 5:	tap->wr_rate =  72; break;
1332 				case 6:	tap->wr_rate =  96; break;
1333 				case 7:	tap->wr_rate = 108; break;
1334 				}
1335 				break;
1336 			}
1337 		}
1338 
1339 		wh = mtod(m, struct ieee80211_frame *);
1340 
1341 		/* send the frame to the 802.11 layer */
1342 		ni = ieee80211_find_rxnode(ic,
1343 		    (struct ieee80211_frame_min *)wh);
1344 		if (ni != NULL) {
1345 			(void)ieee80211_input(ni, m, rssi - nf, nf);
1346 			ieee80211_free_node(ni);
1347 		} else
1348 			(void)ieee80211_input_all(ic, m, rssi - nf, nf);
1349 
1350 skip:		rxd->sdl0 &= ~htole16(RT2860_RX_DDONE);
1351 
1352 		bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1353 		    BUS_DMASYNC_PREWRITE);
1354 
1355 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
1356 	}
1357 
1358 	/* tell HW what we have processed */
1359 	RAL_WRITE(sc, RT2860_RX_CALC_IDX,
1360 	    (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
1361 }
1362 
1363 static void
1364 rt2860_tbtt_intr(struct rt2860_softc *sc)
1365 {
1366 #if 0
1367 	struct ieee80211com *ic = &sc->sc_ic;
1368 
1369 #ifndef IEEE80211_STA_ONLY
1370 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1371 		/* one less beacon until next DTIM */
1372 		if (ic->ic_dtim_count == 0)
1373 			ic->ic_dtim_count = ic->ic_dtim_period - 1;
1374 		else
1375 			ic->ic_dtim_count--;
1376 
1377 		/* update dynamic parts of beacon */
1378 		rt2860_setup_beacon(sc);
1379 
1380 		/* flush buffered multicast frames */
1381 		if (ic->ic_dtim_count == 0)
1382 			ieee80211_notify_dtim(ic);
1383 	}
1384 #endif
1385 	/* check if protection mode has changed */
1386 	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
1387 		rt2860_updateprot(ic);
1388 		sc->sc_ic_flags = ic->ic_flags;
1389 	}
1390 #endif
1391 }
1392 
1393 static void
1394 rt2860_gp_intr(struct rt2860_softc *sc)
1395 {
1396 	struct ieee80211com *ic = sc->sc_ifp->if_l2com;
1397 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1398 
1399 	DPRINTFN(2, ("GP timeout state=%d\n", vap->iv_state));
1400 
1401 	if (vap->iv_state == IEEE80211_S_RUN)
1402 		rt2860_updatestats(sc);
1403 }
1404 
1405 void
1406 rt2860_intr(void *arg)
1407 {
1408 	struct rt2860_softc *sc = arg;
1409 	uint32_t r;
1410 
1411 	r = RAL_READ(sc, RT2860_INT_STATUS);
1412 	if (__predict_false(r == 0xffffffff)) {
1413 		return;	/* device likely went away */
1414 	}
1415 	if (r == 0) {
1416 		return;	/* not for us */
1417 	}
1418 
1419 	/* acknowledge interrupts */
1420 	RAL_WRITE(sc, RT2860_INT_STATUS, r);
1421 
1422 	if (r & RT2860_TX_RX_COHERENT)
1423 		rt2860_intr_coherent(sc);
1424 
1425 	if (r & RT2860_MAC_INT_2)	/* TX status */
1426 		rt2860_drain_stats_fifo(sc);
1427 
1428 	if (r & RT2860_TX_DONE_INT5)
1429 		rt2860_tx_intr(sc, 5);
1430 
1431 	if (r & RT2860_RX_DONE_INT)
1432 		rt2860_rx_intr(sc);
1433 
1434 	if (r & RT2860_TX_DONE_INT4)
1435 		rt2860_tx_intr(sc, 4);
1436 
1437 	if (r & RT2860_TX_DONE_INT3)
1438 		rt2860_tx_intr(sc, 3);
1439 
1440 	if (r & RT2860_TX_DONE_INT2)
1441 		rt2860_tx_intr(sc, 2);
1442 
1443 	if (r & RT2860_TX_DONE_INT1)
1444 		rt2860_tx_intr(sc, 1);
1445 
1446 	if (r & RT2860_TX_DONE_INT0)
1447 		rt2860_tx_intr(sc, 0);
1448 
1449 	if (r & RT2860_MAC_INT_0)	/* TBTT */
1450 		rt2860_tbtt_intr(sc);
1451 
1452 	if (r & RT2860_MAC_INT_3)	/* Auto wakeup */
1453 		/* TBD wakeup */;
1454 
1455 	if (r & RT2860_MAC_INT_4)	/* GP timer */
1456 		rt2860_gp_intr(sc);
1457 }
1458 
1459 static int
1460 rt2860_tx(struct rt2860_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1461 {
1462 	struct ifnet *ifp = sc->sc_ifp;
1463 	struct ieee80211com *ic = ifp->if_l2com;
1464 	struct ieee80211vap *vap = ni->ni_vap;
1465 	struct rt2860_tx_ring *ring;
1466 	struct rt2860_tx_data *data;
1467 	struct rt2860_txd *txd;
1468 	struct rt2860_txwi *txwi;
1469 	struct ieee80211_frame *wh;
1470 	const struct ieee80211_txparam *tp;
1471 	struct ieee80211_key *k;
1472 	struct mbuf *m1;
1473 	bus_dma_segment_t segs[RT2860_MAX_SCATTER];
1474 	bus_dma_segment_t *seg;
1475 	u_int hdrlen;
1476 	uint16_t qos, dur;
1477 	uint8_t type, qsel, mcs, pid, tid, qid;
1478 	int i, nsegs, ntxds = 0, pad, rate, ridx, error;
1479 
1480 	/* the data pool contains at least one element, pick the first */
1481 	data = SLIST_FIRST(&sc->data_pool);
1482 
1483 	wh = mtod(m, struct ieee80211_frame *);
1484 
1485 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1486 		k = ieee80211_crypto_encap(ni, m);
1487 		if (k == NULL) {
1488 			m_freem(m);
1489 			return ENOBUFS;
1490 		}
1491 
1492 		/* packet header may have moved, reset our local pointer */
1493 		wh = mtod(m, struct ieee80211_frame *);
1494 	}
1495 
1496 	hdrlen = ieee80211_anyhdrsize(wh);
1497 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1498 
1499 	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1500 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1501 		rate = tp->mcastrate;
1502 	} else if (m->m_flags & M_EAPOL) {
1503 		rate = tp->mgmtrate;
1504 	} else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1505 		rate = tp->ucastrate;
1506 	} else {
1507 		(void) ieee80211_ratectl_rate(ni, NULL, 0);
1508 		rate = ni->ni_txrate;
1509 	}
1510 	rate &= IEEE80211_RATE_VAL;
1511 
1512 	qid = M_WME_GETAC(m);
1513 	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1514 		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
1515 		tid = qos & IEEE80211_QOS_TID;
1516 	} else {
1517 		qos = 0;
1518 		tid = 0;
1519 	}
1520 	ring = &sc->txq[qid];
1521 	ridx = ic->ic_rt->rateCodeToIndex[rate];
1522 
1523 	/* get MCS code from rate index */
1524 	mcs = rt2860_rates[ridx].mcs;
1525 
1526 	/* setup TX Wireless Information */
1527 	txwi = data->txwi;
1528 	txwi->flags = 0;
1529 	/* let HW generate seq numbers for non-QoS frames */
1530 	txwi->xflags = qos ? 0 : RT2860_TX_NSEQ;
1531 	if (type == IEEE80211_FC0_TYPE_DATA)
1532 		txwi->wcid = IEEE80211_AID(ni->ni_associd);
1533 	else
1534 		txwi->wcid = 0xff;
1535 	txwi->len = htole16(m->m_pkthdr.len);
1536 	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1537 		txwi->phy = htole16(RT2860_PHY_CCK);
1538 		if (ridx != RT2860_RIDX_CCK1 &&
1539 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1540 			mcs |= RT2860_PHY_SHPRE;
1541 	} else
1542 		txwi->phy = htole16(RT2860_PHY_OFDM);
1543 	txwi->phy |= htole16(mcs);
1544 
1545 	/*
1546 	 * We store the MCS code into the driver-private PacketID field.
1547 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1548 	 * that we know at which initial rate the frame was transmitted.
1549 	 * We add 1 to the MCS code because setting the PacketID field to
1550 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1551 	 */
1552 	pid = (mcs + 1) & 0xf;
1553 	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1554 
1555 	/* check if RTS/CTS or CTS-to-self protection is required */
1556 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1557 	    (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
1558 	     ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1559 	      rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
1560 		txwi->txop = RT2860_TX_TXOP_HT;
1561 	else
1562 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1563 
1564 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1565 	    (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
1566 	     IEEE80211_QOS_ACKPOLICY_NOACK)) {
1567 		txwi->xflags |= RT2860_TX_ACK;
1568 
1569 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1570 			dur = rt2860_rates[ridx].sp_ack_dur;
1571 		else
1572 			dur = rt2860_rates[ridx].lp_ack_dur;
1573 		*(uint16_t *)wh->i_dur = htole16(dur);
1574 	}
1575 	/* ask MAC to insert timestamp into probe responses */
1576 	if ((wh->i_fc[0] &
1577 	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1578 	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1579 	    /* NOTE: beacons do not pass through tx_data() */
1580 		txwi->flags |= RT2860_TX_TS;
1581 
1582 	if (ieee80211_radiotap_active_vap(vap)) {
1583 		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1584 
1585 		tap->wt_flags = 0;
1586 		tap->wt_rate = rate;
1587 		if (mcs & RT2860_PHY_SHPRE)
1588 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1589 
1590 		ieee80211_radiotap_tx(vap, m);
1591 	}
1592 
1593 	pad = (hdrlen + 3) & ~3;
1594 
1595 	/* copy and trim 802.11 header */
1596 	memcpy(txwi + 1, wh, hdrlen);
1597 	m_adj(m, hdrlen);
1598 
1599 	error = bus_dmamap_load_mbuf_segment(sc->txwi_dmat, data->map, m, segs,
1600 	    1, &nsegs, BUS_DMA_NOWAIT);
1601 	if (__predict_false(error != 0 && error != EFBIG)) {
1602 		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1603 		    error);
1604 		m_freem(m);
1605 		return error;
1606 	}
1607 	if (__predict_true(error == 0)) {
1608 		/* determine how many TXDs are required */
1609 		ntxds = 1 + (nsegs / 2);
1610 
1611 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1612 			/* not enough free TXDs, force mbuf defrag */
1613 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1614 			error = EFBIG;
1615 		}
1616 	}
1617 	if (__predict_false(error != 0)) {
1618 		m1 = m_defrag(m, M_NOWAIT);
1619 		if (m1 == NULL) {
1620 			device_printf(sc->sc_dev,
1621 			    "could not defragment mbuf\n");
1622 			m_freem(m);
1623 			return ENOBUFS;
1624 		}
1625 		m = m1;
1626 
1627 		error = bus_dmamap_load_mbuf_segment(sc->txwi_dmat, data->map, m,
1628 		    segs, 1, &nsegs, BUS_DMA_NOWAIT);
1629 		if (__predict_false(error != 0)) {
1630 			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1631 			    error);
1632 			m_freem(m);
1633 			return error;
1634 		}
1635 
1636 		/* determine how many TXDs are now required */
1637 		ntxds = 1 + (nsegs / 2);
1638 
1639 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1640 			/* this is a hopeless case, drop the mbuf! */
1641 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1642 			m_freem(m);
1643 			return ENOBUFS;
1644 		}
1645 	}
1646 
1647 	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1648 
1649 	/* first segment is TXWI + 802.11 header */
1650 	txd = &ring->txd[ring->cur];
1651 	txd->sdp0 = htole32(data->paddr);
1652 	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
1653 	txd->flags = qsel;
1654 
1655 	/* setup payload segments */
1656 	seg = &segs[0];
1657 	for (i = nsegs; i >= 2; i -= 2) {
1658 		txd->sdp1 = htole32(seg->ds_addr);
1659 		txd->sdl1 = htole16(seg->ds_len);
1660 		seg++;
1661 		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1662 		/* grab a new Tx descriptor */
1663 		txd = &ring->txd[ring->cur];
1664 		txd->sdp0 = htole32(seg->ds_addr);
1665 		txd->sdl0 = htole16(seg->ds_len);
1666 		txd->flags = qsel;
1667 		seg++;
1668 	}
1669 	/* finalize last segment */
1670 	if (i > 0) {
1671 		txd->sdp1 = htole32(seg->ds_addr);
1672 		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1673 	} else {
1674 		txd->sdl0 |= htole16(RT2860_TX_LS0);
1675 		txd->sdl1 = 0;
1676 	}
1677 
1678 	/* remove from the free pool and link it into the SW Tx slot */
1679 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1680 	data->m = m;
1681 	data->ni = ni;
1682 	ring->data[ring->cur] = data;
1683 
1684 	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
1685 	bus_dmamap_sync(sc->txwi_dmat, data->map, BUS_DMASYNC_PREWRITE);
1686 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
1687 
1688 	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1689 	    qid, txwi->wcid, nsegs, ridx));
1690 
1691 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1692 	ring->queued += ntxds;
1693 	if (ring->queued >= RT2860_TX_RING_COUNT)
1694 		sc->qfullmsk |= 1 << qid;
1695 
1696 	/* kick Tx */
1697 	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1698 
1699 	return 0;
1700 }
1701 
1702 static int
1703 rt2860_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1704     const struct ieee80211_bpf_params *params)
1705 {
1706 	struct ieee80211com *ic = ni->ni_ic;
1707 	struct ifnet *ifp = ic->ic_ifp;
1708 	struct rt2860_softc *sc = ifp->if_softc;
1709 	int error;
1710 
1711 	/* prevent management frames from being sent if we're not ready */
1712 	if (!(ifp->if_flags & IFF_RUNNING)) {
1713 		m_freem(m);
1714 		ieee80211_free_node(ni);
1715 		return ENETDOWN;
1716 	}
1717 #if 0
1718 	if (params == NULL) {
1719 		/*
1720 		 * Legacy path; interpret frame contents to decide
1721 		 * precisely how to send the frame.
1722 		 */
1723 #endif
1724 		error = rt2860_tx(sc, m, ni);
1725 #if 0
1726 	} else {
1727 		/*
1728 		 * Caller supplied explicit parameters to use in
1729 		 * sending the frame.
1730 		 */
1731 		error = rt2860_tx_raw(sc, m, ni, params);
1732 	}
1733 #endif
1734 	if (error != 0) {
1735 		/* NB: m is reclaimed on tx failure */
1736 		ieee80211_free_node(ni);
1737 		IFNET_STAT_INC(ifp, oerrors, 1);
1738 	}
1739 	sc->sc_tx_timer = 5;
1740 	return error;
1741 }
1742 
1743 #if 0
1744 static int
1745 rt2860_tx_raw(struct rt2860_softc *sc, struct mbuf *m,
1746     struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
1747 {
1748 	struct ifnet *ifp = sc->sc_ifp;
1749 	struct ieee80211com *ic = ifp->if_l2com;
1750 	struct ieee80211vap *vap = ni->ni_vap;
1751 	struct rt2860_tx_ring *ring;
1752 	struct rt2860_tx_data *data;
1753 	struct rt2860_txd *txd;
1754 	struct rt2860_txwi *txwi;
1755 	struct ieee80211_frame *wh;
1756 	struct mbuf *m1;
1757 	bus_dma_segment_t segs[RT2860_MAX_SCATTER];
1758 	bus_dma_segment_t *seg;
1759 	u_int hdrlen;
1760 	uint16_t dur;
1761 	uint8_t type, qsel, mcs, pid, tid, qid;
1762 	int i, nsegs, ntxds, pad, rate, ridx, error;
1763 
1764 	/* the data pool contains at least one element, pick the first */
1765 	data = SLIST_FIRST(&sc->data_pool);
1766 
1767 	wh = mtod(m, struct ieee80211_frame *);
1768 	hdrlen = ieee80211_hdrsize(wh);
1769 	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1770 
1771 	/* Choose a TX rate index. */
1772 	rate = params->ibp_rate0;
1773 	ridx = ic->ic_rt->rateCodeToIndex[rate];
1774 	if (ridx == (uint8_t)-1) {
1775 		/* XXX fall back to mcast/mgmt rate? */
1776 		m_freem(m);
1777 		return EINVAL;
1778 	}
1779 
1780 	qid = params->ibp_pri & 3;
1781 	tid = 0;
1782 	ring = &sc->txq[qid];
1783 
1784 	/* get MCS code from rate index */
1785 	mcs = rt2860_rates[ridx].mcs;
1786 
1787 	/* setup TX Wireless Information */
1788 	txwi = data->txwi;
1789 	txwi->flags = 0;
1790 	/* let HW generate seq numbers for non-QoS frames */
1791 	txwi->xflags = params->ibp_pri & 3 ? 0 : RT2860_TX_NSEQ;
1792 	txwi->wcid = 0xff;
1793 	txwi->len = htole16(m->m_pkthdr.len);
1794 	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1795 		txwi->phy = htole16(RT2860_PHY_CCK);
1796 		if (ridx != RT2860_RIDX_CCK1 &&
1797 		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1798 			mcs |= RT2860_PHY_SHPRE;
1799 	} else
1800 		txwi->phy = htole16(RT2860_PHY_OFDM);
1801 	txwi->phy |= htole16(mcs);
1802 
1803 	/*
1804 	 * We store the MCS code into the driver-private PacketID field.
1805 	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1806 	 * that we know at which initial rate the frame was transmitted.
1807 	 * We add 1 to the MCS code because setting the PacketID field to
1808 	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1809 	 */
1810 	pid = (mcs + 1) & 0xf;
1811 	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1812 
1813 	/* check if RTS/CTS or CTS-to-self protection is required */
1814 	if (params->ibp_flags & IEEE80211_BPF_RTS ||
1815 	    params->ibp_flags & IEEE80211_BPF_CTS)
1816 		txwi->txop = RT2860_TX_TXOP_HT;
1817 	else
1818 		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1819 	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0) {
1820 		txwi->xflags |= RT2860_TX_ACK;
1821 
1822 		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1823 			dur = rt2860_rates[ridx].sp_ack_dur;
1824 		else
1825 			dur = rt2860_rates[ridx].lp_ack_dur;
1826 		*(uint16_t *)wh->i_dur = htole16(dur);
1827 	}
1828 	/* ask MAC to insert timestamp into probe responses */
1829 	if ((wh->i_fc[0] &
1830 	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1831 	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1832 	    /* NOTE: beacons do not pass through tx_data() */
1833 		txwi->flags |= RT2860_TX_TS;
1834 
1835 	if (ieee80211_radiotap_active_vap(vap)) {
1836 		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1837 
1838 		tap->wt_flags = 0;
1839 		tap->wt_rate = rate;
1840 		if (mcs & RT2860_PHY_SHPRE)
1841 			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1842 
1843 		ieee80211_radiotap_tx(vap, m);
1844 	}
1845 
1846 	pad = (hdrlen + 3) & ~3;
1847 
1848 	/* copy and trim 802.11 header */
1849 	memcpy(txwi + 1, wh, hdrlen);
1850 	m_adj(m, hdrlen);
1851 
1852 	error = bus_dmamap_load_mbuf_segment(sc->txwi_dmat, data->map, m, segs,
1853 	    1, &nsegs, BUS_DMA_NOWAIT);
1854 	if (__predict_false(error != 0 && error != EFBIG)) {
1855 		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1856 		    error);
1857 		m_freem(m);
1858 		return error;
1859 	}
1860 	if (__predict_true(error == 0)) {
1861 		/* determine how many TXDs are required */
1862 		ntxds = 1 + (nsegs / 2);
1863 
1864 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1865 			/* not enough free TXDs, force mbuf defrag */
1866 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1867 			error = EFBIG;
1868 		}
1869 	}
1870 	if (__predict_false(error != 0)) {
1871 		m1 = m_defrag(m, M_NOWAIT);
1872 		if (m1 == NULL) {
1873 			device_printf(sc->sc_dev,
1874 			    "could not defragment mbuf\n");
1875 			m_freem(m);
1876 			return ENOBUFS;
1877 		}
1878 		m = m1;
1879 
1880 		error = bus_dmamap_load_mbuf_segment(sc->txwi_dmat, data->map, m,
1881 		    segs, 1, &nsegs, BUS_DMA_NOWAIT);
1882 		if (__predict_false(error != 0)) {
1883 			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1884 			    error);
1885 			m_freem(m);
1886 			return error;
1887 		}
1888 
1889 		/* determine how many TXDs are now required */
1890 		ntxds = 1 + (nsegs / 2);
1891 
1892 		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1893 			/* this is a hopeless case, drop the mbuf! */
1894 			bus_dmamap_unload(sc->txwi_dmat, data->map);
1895 			m_freem(m);
1896 			return ENOBUFS;
1897 		}
1898 	}
1899 
1900 	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1901 
1902 	/* first segment is TXWI + 802.11 header */
1903 	txd = &ring->txd[ring->cur];
1904 	txd->sdp0 = htole32(data->paddr);
1905 	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
1906 	txd->flags = qsel;
1907 
1908 	/* setup payload segments */
1909 	seg = &segs[0];
1910 	for (i = nsegs; i >= 2; i -= 2) {
1911 		txd->sdp1 = htole32(seg->ds_addr);
1912 		txd->sdl1 = htole16(seg->ds_len);
1913 		seg++;
1914 		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1915 		/* grab a new Tx descriptor */
1916 		txd = &ring->txd[ring->cur];
1917 		txd->sdp0 = htole32(seg->ds_addr);
1918 		txd->sdl0 = htole16(seg->ds_len);
1919 		txd->flags = qsel;
1920 		seg++;
1921 	}
1922 	/* finalize last segment */
1923 	if (i > 0) {
1924 		txd->sdp1 = htole32(seg->ds_addr);
1925 		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1926 	} else {
1927 		txd->sdl0 |= htole16(RT2860_TX_LS0);
1928 		txd->sdl1 = 0;
1929 	}
1930 
1931 	/* remove from the free pool and link it into the SW Tx slot */
1932 	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1933 	data->m = m;
1934 	data->ni = ni;
1935 	ring->data[ring->cur] = data;
1936 
1937 	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
1938 	bus_dmamap_sync(sc->txwi_dmat, data->map, BUS_DMASYNC_PREWRITE);
1939 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
1940 
1941 	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1942 	    qid, txwi->wcid, nsegs, ridx));
1943 
1944 	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1945 	ring->queued += ntxds;
1946 	if (ring->queued >= RT2860_TX_RING_COUNT)
1947 		sc->qfullmsk |= 1 << qid;
1948 
1949 	/* kick Tx */
1950 	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1951 
1952 	return 0;
1953 }
1954 #endif
1955 
1956 static void
1957 rt2860_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
1958 {
1959 	ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
1960 	rt2860_start_locked(ifp);
1961 }
1962 
1963 static void
1964 rt2860_start_locked(struct ifnet *ifp)
1965 {
1966 	struct rt2860_softc *sc = ifp->if_softc;
1967 	struct ieee80211_node *ni;
1968 	struct mbuf *m;
1969 
1970 	if ((ifp->if_flags & IFF_RUNNING) == 0)
1971 		return;
1972 
1973 	for (;;) {
1974 		if (SLIST_EMPTY(&sc->data_pool) || sc->qfullmsk != 0) {
1975 			ifq_set_oactive(&ifp->if_snd);
1976 			break;
1977 		}
1978 		m = ifq_dequeue(&ifp->if_snd);
1979 		if (m == NULL)
1980 			break;
1981 		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1982 		if (rt2860_tx(sc, m, ni) != 0) {
1983 			ieee80211_free_node(ni);
1984 			IFNET_STAT_INC(ifp, oerrors, 1);
1985 			continue;
1986 		}
1987 		sc->sc_tx_timer = 5;
1988 	}
1989 }
1990 
1991 static void
1992 rt2860_watchdog(void *arg)
1993 {
1994 	struct rt2860_softc *sc = arg;
1995 	struct ifnet *ifp = sc->sc_ifp;
1996 
1997 	KASSERT(ifp->if_flags & IFF_RUNNING, ("not running"));
1998 
1999 	if (sc->sc_invalid)		/* card ejected */
2000 		return;
2001 
2002 	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
2003 		if_printf(ifp, "device timeout\n");
2004 		rt2860_stop_locked(sc);
2005 		rt2860_init_locked(sc);
2006 		IFNET_STAT_INC(ifp, oerrors, 1);
2007 		return;
2008 	}
2009 	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
2010 }
2011 
2012 static int
2013 rt2860_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *ucred)
2014 {
2015 	struct rt2860_softc *sc = ifp->if_softc;
2016 	struct ieee80211com *ic = ifp->if_l2com;
2017 	struct ifreq *ifr = (struct ifreq *)data;
2018 	int error = 0, startall = 0;
2019 
2020 	switch (cmd) {
2021 	case SIOCSIFFLAGS:
2022 		if (ifp->if_flags & IFF_UP) {
2023 			if (!(ifp->if_flags & IFF_RUNNING)) {
2024 				rt2860_init_locked(sc);
2025 				startall = 1;
2026 			} else
2027 				rt2860_update_promisc(ifp);
2028 		} else {
2029 			if (ifp->if_flags & IFF_RUNNING)
2030 				rt2860_stop_locked(sc);
2031 		}
2032 		if (startall)
2033 			ieee80211_start_all(ic);
2034 		break;
2035 	case SIOCGIFMEDIA:
2036 		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
2037 		break;
2038 	case SIOCSIFADDR:
2039 		error = ether_ioctl(ifp, cmd, data);
2040 		break;
2041 	default:
2042 		error = EINVAL;
2043 		break;
2044 	}
2045 	return error;
2046 }
2047 
2048 /*
2049  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
2050  * We access the BBP through the 8051 microcontroller unit which means that
2051  * the microcode must be loaded first.
2052  */
2053 void
2054 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2055 {
2056 	int ntries;
2057 
2058 	for (ntries = 0; ntries < 100; ntries++) {
2059 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2060 			break;
2061 		DELAY(1);
2062 	}
2063 	if (ntries == 100) {
2064 		device_printf(sc->sc_dev,
2065 		    "could not write to BBP through MCU\n");
2066 		return;
2067 	}
2068 
2069 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2070 	    RT2860_BBP_CSR_KICK | reg << 8 | val);
2071 	RAL_BARRIER_WRITE(sc);
2072 
2073 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
2074 	DELAY(1000);
2075 }
2076 
2077 uint8_t
2078 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
2079 {
2080 	uint32_t val;
2081 	int ntries;
2082 
2083 	for (ntries = 0; ntries < 100; ntries++) {
2084 		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2085 			break;
2086 		DELAY(1);
2087 	}
2088 	if (ntries == 100) {
2089 		device_printf(sc->sc_dev,
2090 		    "could not read from BBP through MCU\n");
2091 		return 0;
2092 	}
2093 
2094 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2095 	    RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
2096 	RAL_BARRIER_WRITE(sc);
2097 
2098 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
2099 	DELAY(1000);
2100 
2101 	for (ntries = 0; ntries < 100; ntries++) {
2102 		val = RAL_READ(sc, RT2860_H2M_BBPAGENT);
2103 		if (!(val & RT2860_BBP_CSR_KICK))
2104 			return val & 0xff;
2105 		DELAY(1);
2106 	}
2107 	device_printf(sc->sc_dev, "could not read from BBP through MCU\n");
2108 
2109 	return 0;
2110 }
2111 
2112 /*
2113  * Write to one of the 4 programmable 24-bit RF registers.
2114  */
2115 static void
2116 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
2117 {
2118 	uint32_t tmp;
2119 	int ntries;
2120 
2121 	for (ntries = 0; ntries < 100; ntries++) {
2122 		if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
2123 			break;
2124 		DELAY(1);
2125 	}
2126 	if (ntries == 100) {
2127 		device_printf(sc->sc_dev, "could not write to RF\n");
2128 		return;
2129 	}
2130 
2131 	/* RF registers are 24-bit on the RT2860 */
2132 	tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
2133 	    (val & 0x3fffff) << 2 | (reg & 3);
2134 	RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
2135 }
2136 
2137 static uint8_t
2138 rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
2139 {
2140 	uint32_t tmp;
2141 	int ntries;
2142 
2143 	for (ntries = 0; ntries < 100; ntries++) {
2144 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
2145 			break;
2146 		DELAY(1);
2147 	}
2148 	if (ntries == 100) {
2149 		device_printf(sc->sc_dev, "could not read RF register\n");
2150 		return 0xff;
2151 	}
2152 	tmp = RT3070_RF_KICK | reg << 8;
2153 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
2154 
2155 	for (ntries = 0; ntries < 100; ntries++) {
2156 		tmp = RAL_READ(sc, RT3070_RF_CSR_CFG);
2157 		if (!(tmp & RT3070_RF_KICK))
2158 			break;
2159 		DELAY(1);
2160 	}
2161 	if (ntries == 100) {
2162 		device_printf(sc->sc_dev, "could not read RF register\n");
2163 		return 0xff;
2164 	}
2165 	return tmp & 0xff;
2166 }
2167 
2168 void
2169 rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2170 {
2171 	uint32_t tmp;
2172 	int ntries;
2173 
2174 	for (ntries = 0; ntries < 10; ntries++) {
2175 		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
2176 			break;
2177 		DELAY(10);
2178 	}
2179 	if (ntries == 10) {
2180 		device_printf(sc->sc_dev, "could not write to RF\n");
2181 		return;
2182 	}
2183 
2184 	tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
2185 	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
2186 }
2187 
2188 /*
2189  * Send a command to the 8051 microcontroller unit.
2190  */
2191 int
2192 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
2193 {
2194 	int slot, ntries;
2195 	uint32_t tmp;
2196 	uint8_t cid;
2197 
2198 	for (ntries = 0; ntries < 100; ntries++) {
2199 		if (!(RAL_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
2200 			break;
2201 		DELAY(2);
2202 	}
2203 	if (ntries == 100)
2204 		return EIO;
2205 
2206 	cid = wait ? cmd : RT2860_TOKEN_NO_INTR;
2207 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY | cid << 16 | arg);
2208 	RAL_BARRIER_WRITE(sc);
2209 	RAL_WRITE(sc, RT2860_HOST_CMD, cmd);
2210 
2211 	if (!wait)
2212 		return 0;
2213 	/* wait for the command to complete */
2214 	for (ntries = 0; ntries < 200; ntries++) {
2215 		tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID);
2216 		/* find the command slot */
2217 		for (slot = 0; slot < 4; slot++, tmp >>= 8)
2218 			if ((tmp & 0xff) == cid)
2219 				break;
2220 		if (slot < 4)
2221 			break;
2222 		DELAY(100);
2223 	}
2224 	if (ntries == 200) {
2225 		/* clear command and status */
2226 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2227 		RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2228 		return ETIMEDOUT;
2229 	}
2230 	/* get command status (1 means success) */
2231 	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS);
2232 	tmp = (tmp >> (slot * 8)) & 0xff;
2233 	DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
2234 	    cmd, slot, tmp));
2235 	/* clear command and status */
2236 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2237 	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2238 	return (tmp == 1) ? 0 : EIO;
2239 }
2240 
2241 static void
2242 rt2860_enable_mrr(struct rt2860_softc *sc)
2243 {
2244 #define CCK(mcs)	(mcs)
2245 #define OFDM(mcs)	(1 << 3 | (mcs))
2246 	RAL_WRITE(sc, RT2860_LG_FBK_CFG0,
2247 	    OFDM(6) << 28 |	/* 54->48 */
2248 	    OFDM(5) << 24 |	/* 48->36 */
2249 	    OFDM(4) << 20 |	/* 36->24 */
2250 	    OFDM(3) << 16 |	/* 24->18 */
2251 	    OFDM(2) << 12 |	/* 18->12 */
2252 	    OFDM(1) <<  8 |	/* 12-> 9 */
2253 	    OFDM(0) <<  4 |	/*  9-> 6 */
2254 	    OFDM(0));		/*  6-> 6 */
2255 
2256 	RAL_WRITE(sc, RT2860_LG_FBK_CFG1,
2257 	    CCK(2) << 12 |	/* 11->5.5 */
2258 	    CCK(1) <<  8 |	/* 5.5-> 2 */
2259 	    CCK(0) <<  4 |	/*   2-> 1 */
2260 	    CCK(0));		/*   1-> 1 */
2261 #undef OFDM
2262 #undef CCK
2263 }
2264 
2265 static void
2266 rt2860_set_txpreamble(struct rt2860_softc *sc)
2267 {
2268 	struct ifnet *ifp = sc->sc_ifp;
2269 	struct ieee80211com *ic = ifp->if_l2com;
2270 	uint32_t tmp;
2271 
2272 	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
2273 	tmp &= ~RT2860_CCK_SHORT_EN;
2274 	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
2275 		tmp |= RT2860_CCK_SHORT_EN;
2276 	RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
2277 }
2278 
2279 void
2280 rt2860_set_basicrates(struct rt2860_softc *sc,
2281     const struct ieee80211_rateset *rs)
2282 {
2283 #define RV(r)	((r) & IEEE80211_RATE_VAL)
2284 	struct ifnet *ifp = sc->sc_ifp;
2285 	struct ieee80211com *ic = ifp->if_l2com;
2286 	uint32_t mask = 0;
2287 	uint8_t rate;
2288 	int i;
2289 
2290 	for (i = 0; i < rs->rs_nrates; i++) {
2291 		rate = rs->rs_rates[i];
2292 
2293 		if (!(rate & IEEE80211_RATE_BASIC))
2294 			continue;
2295 
2296 		mask |= 1 << ic->ic_rt->rateCodeToIndex[RV(rate)];
2297 	}
2298 
2299 	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, mask);
2300 #undef RV
2301 }
2302 
2303 static void
2304 rt2860_scan_start(struct ieee80211com *ic)
2305 {
2306 	struct ifnet *ifp = ic->ic_ifp;
2307 	struct rt2860_softc *sc = ifp->if_softc;
2308 	uint32_t tmp;
2309 
2310 	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
2311 	RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
2312 	    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
2313 	    RT2860_TBTT_TIMER_EN));
2314 	rt2860_set_gp_timer(sc, 0);
2315 }
2316 
2317 static void
2318 rt2860_scan_end(struct ieee80211com *ic)
2319 {
2320 	struct ifnet *ifp = ic->ic_ifp;
2321 	struct rt2860_softc *sc = ifp->if_softc;
2322 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2323 
2324 	if (vap->iv_state == IEEE80211_S_RUN) {
2325 		rt2860_enable_tsf_sync(sc);
2326 		rt2860_set_gp_timer(sc, 500);
2327 	}
2328 }
2329 
2330 static void
2331 rt2860_set_channel(struct ieee80211com *ic)
2332 {
2333 	struct ifnet *ifp = ic->ic_ifp;
2334 	struct rt2860_softc *sc = ifp->if_softc;
2335 
2336 	rt2860_switch_chan(sc, ic->ic_curchan);
2337 }
2338 
2339 static void
2340 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2341 {
2342 	uint32_t tmp;
2343 	uint8_t agc;
2344 
2345 	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2346 	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2347 	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2348 	rt2860_mcu_bbp_write(sc, 86, 0x00);
2349 
2350 	if (group == 0) {
2351 		if (sc->ext_2ghz_lna) {
2352 			rt2860_mcu_bbp_write(sc, 82, 0x62);
2353 			rt2860_mcu_bbp_write(sc, 75, 0x46);
2354 		} else {
2355 			rt2860_mcu_bbp_write(sc, 82, 0x84);
2356 			rt2860_mcu_bbp_write(sc, 75, 0x50);
2357 		}
2358 	} else {
2359 		if (sc->ext_5ghz_lna) {
2360 			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2361 			rt2860_mcu_bbp_write(sc, 75, 0x46);
2362 		} else {
2363 			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2364 			rt2860_mcu_bbp_write(sc, 75, 0x50);
2365 		}
2366 	}
2367 
2368 	tmp = RAL_READ(sc, RT2860_TX_BAND_CFG);
2369 	tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
2370 	tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
2371 	RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
2372 
2373 	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2374 	tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
2375 	if (sc->nrxchains > 1)
2376 		tmp |= RT2860_LNA_PE1_EN;
2377 	if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
2378 		tmp |= RT3593_LNA_PE2_EN;
2379 	if (group == 0) {	/* 2GHz */
2380 		tmp |= RT2860_PA_PE_G0_EN;
2381 		if (sc->ntxchains > 1)
2382 			tmp |= RT2860_PA_PE_G1_EN;
2383 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2384 			tmp |= RT3593_PA_PE_G2_EN;
2385 	} else {		/* 5GHz */
2386 		tmp |= RT2860_PA_PE_A0_EN;
2387 		if (sc->ntxchains > 1)
2388 			tmp |= RT2860_PA_PE_A1_EN;
2389 		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2390 			tmp |= RT3593_PA_PE_A2_EN;
2391 	}
2392 	RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2393 
2394 	if (sc->mac_ver == 0x3593) {
2395 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
2396 		if (sc->sc_flags & RT2860_PCIE) {
2397 			tmp &= ~0x01010000;
2398 			if (group == 0)
2399 				tmp |= 0x00010000;
2400 		} else {
2401 			tmp &= ~0x00008080;
2402 			if (group == 0)
2403 				tmp |= 0x00000080;
2404 		}
2405 		tmp = (tmp & ~0x00001000) | 0x00000010;
2406 		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp);
2407 	}
2408 
2409 	/* set initial AGC value */
2410 	if (group == 0) {	/* 2GHz band */
2411 		if (sc->mac_ver >= 0x3071)
2412 			agc = 0x1c + sc->lna[0] * 2;
2413 		else
2414 			agc = 0x2e + sc->lna[0];
2415 	} else {		/* 5GHz band */
2416 		agc = 0x32 + (sc->lna[group] * 5) / 3;
2417 	}
2418 	rt2860_mcu_bbp_write(sc, 66, agc);
2419 
2420 	DELAY(1000);
2421 }
2422 
2423 static void
2424 rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
2425 {
2426 	const struct rfprog *rfprog = rt2860_rf2850;
2427 	uint32_t r2, r3, r4;
2428 	int8_t txpow1, txpow2;
2429 	u_int i;
2430 
2431 	/* find the settings for this channel (we know it exists) */
2432 	for (i = 0; rfprog[i].chan != chan; i++);
2433 
2434 	r2 = rfprog[i].r2;
2435 	if (sc->ntxchains == 1)
2436 		r2 |= 1 << 12;		/* 1T: disable Tx chain 2 */
2437 	if (sc->nrxchains == 1)
2438 		r2 |= 1 << 15 | 1 << 4;	/* 1R: disable Rx chains 2 & 3 */
2439 	else if (sc->nrxchains == 2)
2440 		r2 |= 1 << 4;		/* 2R: disable Rx chain 3 */
2441 
2442 	/* use Tx power values from EEPROM */
2443 	txpow1 = sc->txpow1[i];
2444 	txpow2 = sc->txpow2[i];
2445 	if (chan > 14) {
2446 		if (txpow1 >= 0)
2447 			txpow1 = txpow1 << 1 | 1;
2448 		else
2449 			txpow1 = (7 + txpow1) << 1;
2450 		if (txpow2 >= 0)
2451 			txpow2 = txpow2 << 1 | 1;
2452 		else
2453 			txpow2 = (7 + txpow2) << 1;
2454 	}
2455 	r3 = rfprog[i].r3 | txpow1 << 7;
2456 	r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
2457 
2458 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2459 	rt2860_rf_write(sc, RT2860_RF2, r2);
2460 	rt2860_rf_write(sc, RT2860_RF3, r3);
2461 	rt2860_rf_write(sc, RT2860_RF4, r4);
2462 
2463 	DELAY(200);
2464 
2465 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2466 	rt2860_rf_write(sc, RT2860_RF2, r2);
2467 	rt2860_rf_write(sc, RT2860_RF3, r3 | 1);
2468 	rt2860_rf_write(sc, RT2860_RF4, r4);
2469 
2470 	DELAY(200);
2471 
2472 	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2473 	rt2860_rf_write(sc, RT2860_RF2, r2);
2474 	rt2860_rf_write(sc, RT2860_RF3, r3);
2475 	rt2860_rf_write(sc, RT2860_RF4, r4);
2476 }
2477 
2478 static void
2479 rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
2480 {
2481 	int8_t txpow1, txpow2;
2482 	uint8_t rf;
2483 	int i;
2484 
2485 	/* RT3090 is 2GHz only */
2486 	KASSERT(chan >= 1 && chan <= 14, ("chan %d not support", chan));
2487 
2488 	/* find the settings for this channel (we know it exists) */
2489 	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2490 
2491 	/* use Tx power values from EEPROM */
2492 	txpow1 = sc->txpow1[i];
2493 	txpow2 = sc->txpow2[i];
2494 
2495 	rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
2496 	rf = rt3090_rf_read(sc, 3);
2497 	rf = (rf & ~0x0f) | rt3090_freqs[i].k;
2498 	rt3090_rf_write(sc, 3, rf);
2499 	rf = rt3090_rf_read(sc, 6);
2500 	rf = (rf & ~0x03) | rt3090_freqs[i].r;
2501 	rt3090_rf_write(sc, 6, rf);
2502 
2503 	/* set Tx0 power */
2504 	rf = rt3090_rf_read(sc, 12);
2505 	rf = (rf & ~0x1f) | txpow1;
2506 	rt3090_rf_write(sc, 12, rf);
2507 
2508 	/* set Tx1 power */
2509 	rf = rt3090_rf_read(sc, 13);
2510 	rf = (rf & ~0x1f) | txpow2;
2511 	rt3090_rf_write(sc, 13, rf);
2512 
2513 	rf = rt3090_rf_read(sc, 1);
2514 	rf &= ~0xfc;
2515 	if (sc->ntxchains == 1)
2516 		rf |= RT3070_TX1_PD | RT3070_TX2_PD;
2517 	else if (sc->ntxchains == 2)
2518 		rf |= RT3070_TX2_PD;
2519 	if (sc->nrxchains == 1)
2520 		rf |= RT3070_RX1_PD | RT3070_RX2_PD;
2521 	else if (sc->nrxchains == 2)
2522 		rf |= RT3070_RX2_PD;
2523 	rt3090_rf_write(sc, 1, rf);
2524 
2525 	/* set RF offset */
2526 	rf = rt3090_rf_read(sc, 23);
2527 	rf = (rf & ~0x7f) | sc->freq;
2528 	rt3090_rf_write(sc, 23, rf);
2529 
2530 	/* program RF filter */
2531 	rf = rt3090_rf_read(sc, 24);	/* Tx */
2532 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2533 	rt3090_rf_write(sc, 24, rf);
2534 	rf = rt3090_rf_read(sc, 31);	/* Rx */
2535 	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2536 	rt3090_rf_write(sc, 31, rf);
2537 
2538 	/* enable RF tuning */
2539 	rf = rt3090_rf_read(sc, 7);
2540 	rt3090_rf_write(sc, 7, rf | RT3070_TUNE);
2541 }
2542 
2543 static int
2544 rt3090_rf_init(struct rt2860_softc *sc)
2545 {
2546 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2547 	uint32_t tmp;
2548 	uint8_t rf, bbp;
2549 	int i;
2550 
2551 	rf = rt3090_rf_read(sc, 30);
2552 	/* toggle RF R30 bit 7 */
2553 	rt3090_rf_write(sc, 30, rf | 0x80);
2554 	DELAY(1000);
2555 	rt3090_rf_write(sc, 30, rf & ~0x80);
2556 
2557 	tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2558 	tmp &= ~0x1f000000;
2559 	if (sc->patch_dac && sc->mac_rev < 0x0211)
2560 		tmp |= 0x0d000000;	/* 1.35V */
2561 	else
2562 		tmp |= 0x01000000;	/* 1.2V */
2563 	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2564 
2565 	/* patch LNA_PE_G1 */
2566 	tmp = RAL_READ(sc, RT3070_GPIO_SWITCH);
2567 	RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
2568 
2569 	/* initialize RF registers to default value */
2570 	for (i = 0; i < N(rt3090_def_rf); i++) {
2571 		rt3090_rf_write(sc, rt3090_def_rf[i].reg,
2572 		    rt3090_def_rf[i].val);
2573 	}
2574 
2575 	/* select 20MHz bandwidth */
2576 	rt3090_rf_write(sc, 31, 0x14);
2577 
2578 	rf = rt3090_rf_read(sc, 6);
2579 	rt3090_rf_write(sc, 6, rf | 0x40);
2580 
2581 	if (sc->mac_ver != 0x3593) {
2582 		/* calibrate filter for 20MHz bandwidth */
2583 		sc->rf24_20mhz = 0x1f;	/* default value */
2584 		rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
2585 
2586 		/* select 40MHz bandwidth */
2587 		bbp = rt2860_mcu_bbp_read(sc, 4);
2588 		rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) | 0x10);
2589 		rf = rt3090_rf_read(sc, 31);
2590 		rt3090_rf_write(sc, 31, rf | 0x20);
2591 
2592 		/* calibrate filter for 40MHz bandwidth */
2593 		sc->rf24_40mhz = 0x2f;	/* default value */
2594 		rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
2595 
2596 		/* go back to 20MHz bandwidth */
2597 		bbp = rt2860_mcu_bbp_read(sc, 4);
2598 		rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
2599 	}
2600 	if (sc->mac_rev < 0x0211)
2601 		rt3090_rf_write(sc, 27, 0x03);
2602 
2603 	tmp = RAL_READ(sc, RT3070_OPT_14);
2604 	RAL_WRITE(sc, RT3070_OPT_14, tmp | 1);
2605 
2606 	if (sc->rf_rev == RT3070_RF_3020)
2607 		rt3090_set_rx_antenna(sc, 0);
2608 
2609 	bbp = rt2860_mcu_bbp_read(sc, 138);
2610 	if (sc->mac_ver == 0x3593) {
2611 		if (sc->ntxchains == 1)
2612 			bbp |= 0x60;	/* turn off DAC1 and DAC2 */
2613 		else if (sc->ntxchains == 2)
2614 			bbp |= 0x40;	/* turn off DAC2 */
2615 		if (sc->nrxchains == 1)
2616 			bbp &= ~0x06;	/* turn off ADC1 and ADC2 */
2617 		else if (sc->nrxchains == 2)
2618 			bbp &= ~0x04;	/* turn off ADC2 */
2619 	} else {
2620 		if (sc->ntxchains == 1)
2621 			bbp |= 0x20;	/* turn off DAC1 */
2622 		if (sc->nrxchains == 1)
2623 			bbp &= ~0x02;	/* turn off ADC1 */
2624 	}
2625 	rt2860_mcu_bbp_write(sc, 138, bbp);
2626 
2627 	rf = rt3090_rf_read(sc, 1);
2628 	rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
2629 	rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
2630 	rt3090_rf_write(sc, 1, rf);
2631 
2632 	rf = rt3090_rf_read(sc, 15);
2633 	rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
2634 
2635 	rf = rt3090_rf_read(sc, 17);
2636 	rf &= ~RT3070_TX_LO1;
2637 	if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
2638 		rf |= 0x20;	/* fix for long range Rx issue */
2639 	if (sc->txmixgain_2ghz >= 2)
2640 		rf = (rf & ~0x7) | sc->txmixgain_2ghz;
2641 	rt3090_rf_write(sc, 17, rf);
2642 
2643 	rf = rt3090_rf_read(sc, 20);
2644 	rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
2645 
2646 	rf = rt3090_rf_read(sc, 21);
2647 	rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
2648 
2649 	return 0;
2650 #undef N
2651 }
2652 
2653 void
2654 rt3090_rf_wakeup(struct rt2860_softc *sc)
2655 {
2656 	uint32_t tmp;
2657 	uint8_t rf;
2658 
2659 	if (sc->mac_ver == 0x3593) {
2660 		/* enable VCO */
2661 		rf = rt3090_rf_read(sc, 1);
2662 		rt3090_rf_write(sc, 1, rf | RT3593_VCO);
2663 
2664 		/* initiate VCO calibration */
2665 		rf = rt3090_rf_read(sc, 3);
2666 		rt3090_rf_write(sc, 3, rf | RT3593_VCOCAL);
2667 
2668 		/* enable VCO bias current control */
2669 		rf = rt3090_rf_read(sc, 6);
2670 		rt3090_rf_write(sc, 6, rf | RT3593_VCO_IC);
2671 
2672 		/* initiate res calibration */
2673 		rf = rt3090_rf_read(sc, 2);
2674 		rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2675 
2676 		/* set reference current control to 0.33 mA */
2677 		rf = rt3090_rf_read(sc, 22);
2678 		rf &= ~RT3593_CP_IC_MASK;
2679 		rf |= 1 << RT3593_CP_IC_SHIFT;
2680 		rt3090_rf_write(sc, 22, rf);
2681 
2682 		/* enable RX CTB */
2683 		rf = rt3090_rf_read(sc, 46);
2684 		rt3090_rf_write(sc, 46, rf | RT3593_RX_CTB);
2685 
2686 		rf = rt3090_rf_read(sc, 20);
2687 		rf &= ~(RT3593_LDO_RF_VC_MASK | RT3593_LDO_PLL_VC_MASK);
2688 		rt3090_rf_write(sc, 20, rf);
2689 	} else {
2690 		/* enable RF block */
2691 		rf = rt3090_rf_read(sc, 1);
2692 		rt3090_rf_write(sc, 1, rf | RT3070_RF_BLOCK);
2693 
2694 		/* enable VCO bias current control */
2695 		rf = rt3090_rf_read(sc, 7);
2696 		rt3090_rf_write(sc, 7, rf | 0x30);
2697 
2698 		rf = rt3090_rf_read(sc, 9);
2699 		rt3090_rf_write(sc, 9, rf | 0x0e);
2700 
2701 		/* enable RX CTB */
2702 		rf = rt3090_rf_read(sc, 21);
2703 		rt3090_rf_write(sc, 21, rf | RT3070_RX_CTB);
2704 
2705 		/* fix Tx to Rx IQ glitch by raising RF voltage */
2706 		rf = rt3090_rf_read(sc, 27);
2707 		rf &= ~0x77;
2708 		if (sc->mac_rev < 0x0211)
2709 			rf |= 0x03;
2710 		rt3090_rf_write(sc, 27, rf);
2711 	}
2712 	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2713 		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2714 		tmp = (tmp & ~0x1f000000) | 0x0d000000;
2715 		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2716 	}
2717 }
2718 
2719 int
2720 rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
2721     uint8_t *val)
2722 {
2723 	uint8_t rf22, rf24;
2724 	uint8_t bbp55_pb, bbp55_sb, delta;
2725 	int ntries;
2726 
2727 	/* program filter */
2728 	rf24 = rt3090_rf_read(sc, 24);
2729 	rf24 = (rf24 & 0xc0) | init;	/* initial filter value */
2730 	rt3090_rf_write(sc, 24, rf24);
2731 
2732 	/* enable baseband loopback mode */
2733 	rf22 = rt3090_rf_read(sc, 22);
2734 	rt3090_rf_write(sc, 22, rf22 | RT3070_BB_LOOPBACK);
2735 
2736 	/* set power and frequency of passband test tone */
2737 	rt2860_mcu_bbp_write(sc, 24, 0x00);
2738 	for (ntries = 0; ntries < 100; ntries++) {
2739 		/* transmit test tone */
2740 		rt2860_mcu_bbp_write(sc, 25, 0x90);
2741 		DELAY(1000);
2742 		/* read received power */
2743 		bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
2744 		if (bbp55_pb != 0)
2745 			break;
2746 	}
2747 	if (ntries == 100)
2748 		return ETIMEDOUT;
2749 
2750 	/* set power and frequency of stopband test tone */
2751 	rt2860_mcu_bbp_write(sc, 24, 0x06);
2752 	for (ntries = 0; ntries < 100; ntries++) {
2753 		/* transmit test tone */
2754 		rt2860_mcu_bbp_write(sc, 25, 0x90);
2755 		DELAY(1000);
2756 		/* read received power */
2757 		bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
2758 
2759 		delta = bbp55_pb - bbp55_sb;
2760 		if (delta > target)
2761 			break;
2762 
2763 		/* reprogram filter */
2764 		rf24++;
2765 		rt3090_rf_write(sc, 24, rf24);
2766 	}
2767 	if (ntries < 100) {
2768 		if (rf24 != init)
2769 			rf24--;	/* backtrack */
2770 		*val = rf24;
2771 		rt3090_rf_write(sc, 24, rf24);
2772 	}
2773 
2774 	/* restore initial state */
2775 	rt2860_mcu_bbp_write(sc, 24, 0x00);
2776 
2777 	/* disable baseband loopback mode */
2778 	rf22 = rt3090_rf_read(sc, 22);
2779 	rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK);
2780 
2781 	return 0;
2782 }
2783 
2784 static void
2785 rt3090_rf_setup(struct rt2860_softc *sc)
2786 {
2787 	uint8_t bbp;
2788 	int i;
2789 
2790 	if (sc->mac_rev >= 0x0211) {
2791 		/* enable DC filter */
2792 		rt2860_mcu_bbp_write(sc, 103, 0xc0);
2793 
2794 		/* improve power consumption */
2795 		bbp = rt2860_mcu_bbp_read(sc, 31);
2796 		rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
2797 	}
2798 
2799 	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
2800 	if (sc->mac_rev < 0x0211) {
2801 		RAL_WRITE(sc, RT2860_TX_SW_CFG2,
2802 		    sc->patch_dac ? 0x2c : 0x0f);
2803 	} else
2804 		RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
2805 
2806 	/* initialize RF registers from ROM */
2807 	for (i = 0; i < 10; i++) {
2808 		if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
2809 			continue;
2810 		rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
2811 	}
2812 }
2813 
2814 static void
2815 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
2816 {
2817 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
2818 	    which | (sc->leds & 0x7f), 0);
2819 }
2820 
2821 /*
2822  * Hardware has a general-purpose programmable timer interrupt that can
2823  * periodically raise MAC_INT_4.
2824  */
2825 static void
2826 rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
2827 {
2828 	uint32_t tmp;
2829 
2830 	/* disable GP timer before reprogramming it */
2831 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
2832 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN);
2833 
2834 	if (ms == 0)
2835 		return;
2836 
2837 	tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG);
2838 	ms *= 16;	/* Unit: 64us */
2839 	tmp = (tmp & 0xffff) | ms << RT2860_GP_TIMER_SHIFT;
2840 	RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp);
2841 
2842 	/* enable GP timer */
2843 	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
2844 	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp | RT2860_GP_TIMER_EN);
2845 }
2846 
2847 static void
2848 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
2849 {
2850 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,
2851 	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
2852 	RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,
2853 	    bssid[4] | bssid[5] << 8);
2854 }
2855 
2856 static void
2857 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
2858 {
2859 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,
2860 	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
2861 	RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,
2862 	    addr[4] | addr[5] << 8 | 0xff << 16);
2863 }
2864 
2865 static void
2866 rt2860_updateslot(struct ifnet *ifp)
2867 {
2868 	struct rt2860_softc *sc = ifp->if_softc;
2869 	struct ieee80211com *ic = ifp->if_l2com;
2870 	uint32_t tmp;
2871 
2872 	tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG);
2873 	tmp &= ~0xff;
2874 	tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2875 	RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
2876 }
2877 
2878 static void
2879 rt2860_updateprot(struct ifnet *ifp)
2880 {
2881 	struct rt2860_softc *sc = ifp->if_softc;
2882 	struct ieee80211com *ic = ifp->if_l2com;
2883 	uint32_t tmp;
2884 
2885 	tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
2886 	/* setup protection frame rate (MCS code) */
2887 	tmp |= IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ?
2888 	    rt2860_rates[RT2860_RIDX_OFDM6].mcs :
2889 	    rt2860_rates[RT2860_RIDX_CCK11].mcs;
2890 
2891 	/* CCK frames don't require protection */
2892 	RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
2893 
2894 	if (ic->ic_flags & IEEE80211_F_USEPROT) {
2895 		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2896 			tmp |= RT2860_PROT_CTRL_RTS_CTS;
2897 		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2898 			tmp |= RT2860_PROT_CTRL_CTS;
2899 	}
2900 	RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
2901 }
2902 
2903 static void
2904 rt2860_update_promisc(struct ifnet *ifp)
2905 {
2906 	struct rt2860_softc *sc = ifp->if_softc;
2907 	uint32_t tmp;
2908 
2909 	tmp = RAL_READ(sc, RT2860_RX_FILTR_CFG);
2910 	tmp &= ~RT2860_DROP_NOT_MYBSS;
2911 	if (!(ifp->if_flags & IFF_PROMISC))
2912 		tmp |= RT2860_DROP_NOT_MYBSS;
2913 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
2914 }
2915 
2916 static int
2917 rt2860_updateedca(struct ieee80211com *ic)
2918 {
2919 	struct rt2860_softc *sc = ic->ic_ifp->if_softc;
2920 	const struct wmeParams *wmep;
2921 	int aci;
2922 
2923 	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
2924 
2925 	/* update MAC TX configuration registers */
2926 	for (aci = 0; aci < WME_NUM_AC; aci++) {
2927 		RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),
2928 		    wmep[aci].wmep_logcwmax << 16 |
2929 		    wmep[aci].wmep_logcwmin << 12 |
2930 		    wmep[aci].wmep_aifsn  <<  8 |
2931 		    wmep[aci].wmep_txopLimit);
2932 	}
2933 
2934 	/* update SCH/DMA registers too */
2935 	RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,
2936 	    wmep[WME_AC_VO].wmep_aifsn  << 12 |
2937 	    wmep[WME_AC_VI].wmep_aifsn  <<  8 |
2938 	    wmep[WME_AC_BK].wmep_aifsn  <<  4 |
2939 	    wmep[WME_AC_BE].wmep_aifsn);
2940 	RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,
2941 	    wmep[WME_AC_VO].wmep_logcwmin << 12 |
2942 	    wmep[WME_AC_VI].wmep_logcwmin <<  8 |
2943 	    wmep[WME_AC_BK].wmep_logcwmin <<  4 |
2944 	    wmep[WME_AC_BE].wmep_logcwmin);
2945 	RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,
2946 	    wmep[WME_AC_VO].wmep_logcwmax << 12 |
2947 	    wmep[WME_AC_VI].wmep_logcwmax <<  8 |
2948 	    wmep[WME_AC_BK].wmep_logcwmax <<  4 |
2949 	    wmep[WME_AC_BE].wmep_logcwmax);
2950 	RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,
2951 	    wmep[WME_AC_BK].wmep_txopLimit << 16 |
2952 	    wmep[WME_AC_BE].wmep_txopLimit);
2953 	RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,
2954 	    wmep[WME_AC_VO].wmep_txopLimit << 16 |
2955 	    wmep[WME_AC_VI].wmep_txopLimit);
2956 
2957 	return 0;
2958 }
2959 
2960 #ifdef HW_CRYPTO
2961 static int
2962 rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
2963     struct ieee80211_key *k)
2964 {
2965 	struct rt2860_softc *sc = ic->ic_softc;
2966 	bus_size_t base;
2967 	uint32_t attr;
2968 	uint8_t mode, wcid, iv[8];
2969 
2970 	/* defer setting of WEP keys until interface is brought up */
2971 	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
2972 	    (IFF_UP | IFF_RUNNING))
2973 		return 0;
2974 
2975 	/* map net80211 cipher to RT2860 security mode */
2976 	switch (k->k_cipher) {
2977 	case IEEE80211_CIPHER_WEP40:
2978 		mode = RT2860_MODE_WEP40;
2979 		break;
2980 	case IEEE80211_CIPHER_WEP104:
2981 		mode = RT2860_MODE_WEP104;
2982 		break;
2983 	case IEEE80211_CIPHER_TKIP:
2984 		mode = RT2860_MODE_TKIP;
2985 		break;
2986 	case IEEE80211_CIPHER_CCMP:
2987 		mode = RT2860_MODE_AES_CCMP;
2988 		break;
2989 	default:
2990 		return EINVAL;
2991 	}
2992 
2993 	if (k->k_flags & IEEE80211_KEY_GROUP) {
2994 		wcid = 0;	/* NB: update WCID0 for group keys */
2995 		base = RT2860_SKEY(0, k->k_id);
2996 	} else {
2997 		wcid = ((struct rt2860_node *)ni)->wcid;
2998 		base = RT2860_PKEY(wcid);
2999 	}
3000 
3001 	if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3002 		RAL_WRITE_REGION_1(sc, base, k->k_key, 16);
3003 #ifndef IEEE80211_STA_ONLY
3004 		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
3005 			RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[16], 8);
3006 			RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[24], 8);
3007 		} else
3008 #endif
3009 		{
3010 			RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[24], 8);
3011 			RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[16], 8);
3012 		}
3013 	} else
3014 		RAL_WRITE_REGION_1(sc, base, k->k_key, k->k_len);
3015 
3016 	if (!(k->k_flags & IEEE80211_KEY_GROUP) ||
3017 	    (k->k_flags & IEEE80211_KEY_TX)) {
3018 		/* set initial packet number in IV+EIV */
3019 		if (k->k_cipher == IEEE80211_CIPHER_WEP40 ||
3020 		    k->k_cipher == IEEE80211_CIPHER_WEP104) {
3021 			uint32_t val = arc4random();
3022 			/* skip weak IVs from Fluhrer/Mantin/Shamir */
3023 			if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
3024 				val += 0x000100;
3025 			iv[0] = val;
3026 			iv[1] = val >> 8;
3027 			iv[2] = val >> 16;
3028 			iv[3] = k->k_id << 6;
3029 			iv[4] = iv[5] = iv[6] = iv[7] = 0;
3030 		} else {
3031 			if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3032 				iv[0] = k->k_tsc >> 8;
3033 				iv[1] = (iv[0] | 0x20) & 0x7f;
3034 				iv[2] = k->k_tsc;
3035 			} else /* CCMP */ {
3036 				iv[0] = k->k_tsc;
3037 				iv[1] = k->k_tsc >> 8;
3038 				iv[2] = 0;
3039 			}
3040 			iv[3] = k->k_id << 6 | IEEE80211_WEP_EXTIV;
3041 			iv[4] = k->k_tsc >> 16;
3042 			iv[5] = k->k_tsc >> 24;
3043 			iv[6] = k->k_tsc >> 32;
3044 			iv[7] = k->k_tsc >> 40;
3045 		}
3046 		RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8);
3047 	}
3048 
3049 	if (k->k_flags & IEEE80211_KEY_GROUP) {
3050 		/* install group key */
3051 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
3052 		attr &= ~(0xf << (k->k_id * 4));
3053 		attr |= mode << (k->k_id * 4);
3054 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
3055 	} else {
3056 		/* install pairwise key */
3057 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
3058 		attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
3059 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
3060 	}
3061 	return 0;
3062 }
3063 
3064 static void
3065 rt2860_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
3066     struct ieee80211_key *k)
3067 {
3068 	struct rt2860_softc *sc = ic->ic_softc;
3069 	uint32_t attr;
3070 	uint8_t wcid;
3071 
3072 	if (k->k_flags & IEEE80211_KEY_GROUP) {
3073 		/* remove group key */
3074 		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
3075 		attr &= ~(0xf << (k->k_id * 4));
3076 		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
3077 
3078 	} else {
3079 		/* remove pairwise key */
3080 		wcid = ((struct rt2860_node *)ni)->wcid;
3081 		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
3082 		attr &= ~0xf;
3083 		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
3084 	}
3085 }
3086 #endif
3087 
3088 static int8_t
3089 rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
3090 {
3091 	struct ifnet *ifp = sc->sc_ifp;
3092 	struct ieee80211com *ic = ifp->if_l2com;
3093 	struct ieee80211_channel *c = ic->ic_curchan;
3094 	int delta;
3095 
3096 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
3097 		u_int chan = ieee80211_chan2ieee(ic, c);
3098 		delta = sc->rssi_5ghz[rxchain];
3099 
3100 		/* determine channel group */
3101 		if (chan <= 64)
3102 			delta -= sc->lna[1];
3103 		else if (chan <= 128)
3104 			delta -= sc->lna[2];
3105 		else
3106 			delta -= sc->lna[3];
3107 	} else
3108 		delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
3109 
3110 	return -12 - delta - rssi;
3111 }
3112 
3113 /*
3114  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
3115  * Used to adjust per-rate Tx power registers.
3116  */
3117 static __inline uint32_t
3118 b4inc(uint32_t b32, int8_t delta)
3119 {
3120 	int8_t i, b4;
3121 
3122 	for (i = 0; i < 8; i++) {
3123 		b4 = b32 & 0xf;
3124 		b4 += delta;
3125 		if (b4 < 0)
3126 			b4 = 0;
3127 		else if (b4 > 0xf)
3128 			b4 = 0xf;
3129 		b32 = b32 >> 4 | b4 << 28;
3130 	}
3131 	return b32;
3132 }
3133 
3134 static const char *
3135 rt2860_get_rf(uint8_t rev)
3136 {
3137 	switch (rev) {
3138 	case RT2860_RF_2820:	return "RT2820";
3139 	case RT2860_RF_2850:	return "RT2850";
3140 	case RT2860_RF_2720:	return "RT2720";
3141 	case RT2860_RF_2750:	return "RT2750";
3142 	case RT3070_RF_3020:	return "RT3020";
3143 	case RT3070_RF_2020:	return "RT2020";
3144 	case RT3070_RF_3021:	return "RT3021";
3145 	case RT3070_RF_3022:	return "RT3022";
3146 	case RT3070_RF_3052:	return "RT3052";
3147 	case RT3070_RF_3320:	return "RT3320";
3148 	case RT3070_RF_3053:	return "RT3053";
3149 	default:		return "unknown";
3150 	}
3151 }
3152 
3153 static int
3154 rt2860_read_eeprom(struct rt2860_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
3155 {
3156 	int8_t delta_2ghz, delta_5ghz;
3157 	uint32_t tmp;
3158 	uint16_t val;
3159 	int ridx, ant, i;
3160 
3161 	/* check whether the ROM is eFUSE ROM or EEPROM */
3162 	sc->sc_srom_read = rt2860_eeprom_read_2;
3163 	if (sc->mac_ver >= 0x3071) {
3164 		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
3165 		DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
3166 		if (tmp & RT3070_SEL_EFUSE)
3167 			sc->sc_srom_read = rt3090_efuse_read_2;
3168 	}
3169 
3170 	/* read EEPROM version */
3171 	val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION);
3172 	DPRINTF(("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8));
3173 
3174 	/* read MAC address */
3175 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC01);
3176 	macaddr[0] = val & 0xff;
3177 	macaddr[1] = val >> 8;
3178 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC23);
3179 	macaddr[2] = val & 0xff;
3180 	macaddr[3] = val >> 8;
3181 	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC45);
3182 	macaddr[4] = val & 0xff;
3183 	macaddr[5] = val >> 8;
3184 
3185 	/* read country code */
3186 	val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY);
3187 	DPRINTF(("EEPROM region code=0x%04x\n", val));
3188 
3189 	/* read vendor BBP settings */
3190 	for (i = 0; i < 8; i++) {
3191 		val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE + i);
3192 		sc->bbp[i].val = val & 0xff;
3193 		sc->bbp[i].reg = val >> 8;
3194 		DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
3195 	}
3196 	if (sc->mac_ver >= 0x3071) {
3197 		/* read vendor RF settings */
3198 		for (i = 0; i < 10; i++) {
3199 			val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE + i);
3200 			sc->rf[i].val = val & 0xff;
3201 			sc->rf[i].reg = val >> 8;
3202 			DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
3203 			    sc->rf[i].val));
3204 		}
3205 	}
3206 
3207 	/* read RF frequency offset from EEPROM */
3208 	val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS);
3209 	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
3210 	DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
3211 	if ((val >> 8) != 0xff) {
3212 		/* read LEDs operating mode */
3213 		sc->leds = val >> 8;
3214 		sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED1);
3215 		sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED2);
3216 		sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED3);
3217 	} else {
3218 		/* broken EEPROM, use default settings */
3219 		sc->leds = 0x01;
3220 		sc->led[0] = 0x5555;
3221 		sc->led[1] = 0x2221;
3222 		sc->led[2] = 0xa9f8;
3223 	}
3224 	DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
3225 	    sc->leds, sc->led[0], sc->led[1], sc->led[2]));
3226 
3227 	/* read RF information */
3228 	val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA);
3229 	if (val == 0xffff) {
3230 		DPRINTF(("invalid EEPROM antenna info, using default\n"));
3231 		if (sc->mac_ver == 0x3593) {
3232 			/* default to RF3053 3T3R */
3233 			sc->rf_rev = RT3070_RF_3053;
3234 			sc->ntxchains = 3;
3235 			sc->nrxchains = 3;
3236 		} else if (sc->mac_ver >= 0x3071) {
3237 			/* default to RF3020 1T1R */
3238 			sc->rf_rev = RT3070_RF_3020;
3239 			sc->ntxchains = 1;
3240 			sc->nrxchains = 1;
3241 		} else {
3242 			/* default to RF2820 1T2R */
3243 			sc->rf_rev = RT2860_RF_2820;
3244 			sc->ntxchains = 1;
3245 			sc->nrxchains = 2;
3246 		}
3247 	} else {
3248 		sc->rf_rev = (val >> 8) & 0xf;
3249 		sc->ntxchains = (val >> 4) & 0xf;
3250 		sc->nrxchains = val & 0xf;
3251 	}
3252 	DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
3253 	    sc->rf_rev, sc->ntxchains, sc->nrxchains));
3254 
3255 	/* check if RF supports automatic Tx access gain control */
3256 	val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG);
3257 	DPRINTF(("EEPROM CFG 0x%04x\n", val));
3258 	/* check if driver should patch the DAC issue */
3259 	if ((val >> 8) != 0xff)
3260 		sc->patch_dac = (val >> 15) & 1;
3261 	if ((val & 0xff) != 0xff) {
3262 		sc->ext_5ghz_lna = (val >> 3) & 1;
3263 		sc->ext_2ghz_lna = (val >> 2) & 1;
3264 		/* check if RF supports automatic Tx access gain control */
3265 		sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */;
3266 		/* check if we have a hardware radio switch */
3267 		sc->rfswitch = val & 1;
3268 	}
3269 	if (sc->sc_flags & RT2860_ADVANCED_PS) {
3270 		/* read PCIe power save level */
3271 		val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
3272 		if ((val & 0xff) != 0xff) {
3273 			sc->pslevel = val & 0x3;
3274 			val = rt2860_srom_read(sc, RT2860_EEPROM_REV);
3275 			if ((val & 0xff80) != 0x9280)
3276 				sc->pslevel = MIN(sc->pslevel, 1);
3277 			DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
3278 		}
3279 	}
3280 
3281 	/* read power settings for 2GHz channels */
3282 	for (i = 0; i < 14; i += 2) {
3283 		val = rt2860_srom_read(sc,
3284 		    RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
3285 		sc->txpow1[i + 0] = (int8_t)(val & 0xff);
3286 		sc->txpow1[i + 1] = (int8_t)(val >> 8);
3287 
3288 		val = rt2860_srom_read(sc,
3289 		    RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
3290 		sc->txpow2[i + 0] = (int8_t)(val & 0xff);
3291 		sc->txpow2[i + 1] = (int8_t)(val >> 8);
3292 	}
3293 	/* fix broken Tx power entries */
3294 	for (i = 0; i < 14; i++) {
3295 		if (sc->txpow1[i] < 0 || sc->txpow1[i] > 31)
3296 			sc->txpow1[i] = 5;
3297 		if (sc->txpow2[i] < 0 || sc->txpow2[i] > 31)
3298 			sc->txpow2[i] = 5;
3299 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3300 		    rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
3301 	}
3302 	/* read power settings for 5GHz channels */
3303 	for (i = 0; i < 40; i += 2) {
3304 		val = rt2860_srom_read(sc,
3305 		    RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
3306 		sc->txpow1[i + 14] = (int8_t)(val & 0xff);
3307 		sc->txpow1[i + 15] = (int8_t)(val >> 8);
3308 
3309 		val = rt2860_srom_read(sc,
3310 		    RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
3311 		sc->txpow2[i + 14] = (int8_t)(val & 0xff);
3312 		sc->txpow2[i + 15] = (int8_t)(val >> 8);
3313 	}
3314 	/* fix broken Tx power entries */
3315 	for (i = 0; i < 40; i++) {
3316 		if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
3317 			sc->txpow1[14 + i] = 5;
3318 		if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
3319 			sc->txpow2[14 + i] = 5;
3320 		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3321 		    rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
3322 		    sc->txpow2[14 + i]));
3323 	}
3324 
3325 	/* read Tx power compensation for each Tx rate */
3326 	val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR);
3327 	delta_2ghz = delta_5ghz = 0;
3328 	if ((val & 0xff) != 0xff && (val & 0x80)) {
3329 		delta_2ghz = val & 0xf;
3330 		if (!(val & 0x40))	/* negative number */
3331 			delta_2ghz = -delta_2ghz;
3332 	}
3333 	val >>= 8;
3334 	if ((val & 0xff) != 0xff && (val & 0x80)) {
3335 		delta_5ghz = val & 0xf;
3336 		if (!(val & 0x40))	/* negative number */
3337 			delta_5ghz = -delta_5ghz;
3338 	}
3339 	DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
3340 	    delta_2ghz, delta_5ghz));
3341 
3342 	for (ridx = 0; ridx < 5; ridx++) {
3343 		uint32_t reg;
3344 
3345 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2);
3346 		reg = val;
3347 		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1);
3348 		reg |= (uint32_t)val << 16;
3349 
3350 		sc->txpow20mhz[ridx] = reg;
3351 		sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
3352 		sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
3353 
3354 		DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
3355 		    "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
3356 		    sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
3357 	}
3358 
3359 	/* read factory-calibrated samples for temperature compensation */
3360 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
3361 	sc->tssi_2ghz[0] = val & 0xff;	/* [-4] */
3362 	sc->tssi_2ghz[1] = val >> 8;	/* [-3] */
3363 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
3364 	sc->tssi_2ghz[2] = val & 0xff;	/* [-2] */
3365 	sc->tssi_2ghz[3] = val >> 8;	/* [-1] */
3366 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
3367 	sc->tssi_2ghz[4] = val & 0xff;	/* [+0] */
3368 	sc->tssi_2ghz[5] = val >> 8;	/* [+1] */
3369 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
3370 	sc->tssi_2ghz[6] = val & 0xff;	/* [+2] */
3371 	sc->tssi_2ghz[7] = val >> 8;	/* [+3] */
3372 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
3373 	sc->tssi_2ghz[8] = val & 0xff;	/* [+4] */
3374 	sc->step_2ghz = val >> 8;
3375 	DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3376 	    "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
3377 	    sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
3378 	    sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
3379 	    sc->tssi_2ghz[8], sc->step_2ghz));
3380 	/* check that ref value is correct, otherwise disable calibration */
3381 	if (sc->tssi_2ghz[4] == 0xff)
3382 		sc->calib_2ghz = 0;
3383 
3384 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
3385 	sc->tssi_5ghz[0] = val & 0xff;	/* [-4] */
3386 	sc->tssi_5ghz[1] = val >> 8;	/* [-3] */
3387 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
3388 	sc->tssi_5ghz[2] = val & 0xff;	/* [-2] */
3389 	sc->tssi_5ghz[3] = val >> 8;	/* [-1] */
3390 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
3391 	sc->tssi_5ghz[4] = val & 0xff;	/* [+0] */
3392 	sc->tssi_5ghz[5] = val >> 8;	/* [+1] */
3393 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
3394 	sc->tssi_5ghz[6] = val & 0xff;	/* [+2] */
3395 	sc->tssi_5ghz[7] = val >> 8;	/* [+3] */
3396 	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
3397 	sc->tssi_5ghz[8] = val & 0xff;	/* [+4] */
3398 	sc->step_5ghz = val >> 8;
3399 	DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3400 	    "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
3401 	    sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
3402 	    sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
3403 	    sc->tssi_5ghz[8], sc->step_5ghz));
3404 	/* check that ref value is correct, otherwise disable calibration */
3405 	if (sc->tssi_5ghz[4] == 0xff)
3406 		sc->calib_5ghz = 0;
3407 
3408 	/* read RSSI offsets and LNA gains from EEPROM */
3409 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
3410 	sc->rssi_2ghz[0] = val & 0xff;	/* Ant A */
3411 	sc->rssi_2ghz[1] = val >> 8;	/* Ant B */
3412 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
3413 	if (sc->mac_ver >= 0x3071) {
3414 		/*
3415 		 * On RT3090 chips (limited to 2 Rx chains), this ROM
3416 		 * field contains the Tx mixer gain for the 2GHz band.
3417 		 */
3418 		if ((val & 0xff) != 0xff)
3419 			sc->txmixgain_2ghz = val & 0x7;
3420 		DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
3421 	} else
3422 		sc->rssi_2ghz[2] = val & 0xff;	/* Ant C */
3423 	sc->lna[2] = val >> 8;		/* channel group 2 */
3424 
3425 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
3426 	sc->rssi_5ghz[0] = val & 0xff;	/* Ant A */
3427 	sc->rssi_5ghz[1] = val >> 8;	/* Ant B */
3428 	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
3429 	sc->rssi_5ghz[2] = val & 0xff;	/* Ant C */
3430 	sc->lna[3] = val >> 8;		/* channel group 3 */
3431 
3432 	val = rt2860_srom_read(sc, RT2860_EEPROM_LNA);
3433 	if (sc->mac_ver >= 0x3071)
3434 		sc->lna[0] = RT3090_DEF_LNA;
3435 	else				/* channel group 0 */
3436 		sc->lna[0] = val & 0xff;
3437 	sc->lna[1] = val >> 8;		/* channel group 1 */
3438 
3439 	/* fix broken 5GHz LNA entries */
3440 	if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
3441 		DPRINTF(("invalid LNA for channel group %d\n", 2));
3442 		sc->lna[2] = sc->lna[1];
3443 	}
3444 	if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
3445 		DPRINTF(("invalid LNA for channel group %d\n", 3));
3446 		sc->lna[3] = sc->lna[1];
3447 	}
3448 
3449 	/* fix broken RSSI offset entries */
3450 	for (ant = 0; ant < 3; ant++) {
3451 		if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
3452 			DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
3453 			    ant + 1, sc->rssi_2ghz[ant]));
3454 			sc->rssi_2ghz[ant] = 0;
3455 		}
3456 		if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
3457 			DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
3458 			    ant + 1, sc->rssi_5ghz[ant]));
3459 			sc->rssi_5ghz[ant] = 0;
3460 		}
3461 	}
3462 
3463 	return 0;
3464 }
3465 
3466 int
3467 rt2860_bbp_init(struct rt2860_softc *sc)
3468 {
3469 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
3470 	int i, ntries;
3471 
3472 	/* wait for BBP to wake up */
3473 	for (ntries = 0; ntries < 20; ntries++) {
3474 		uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
3475 		if (bbp0 != 0 && bbp0 != 0xff)
3476 			break;
3477 	}
3478 	if (ntries == 20) {
3479 		device_printf(sc->sc_dev,
3480 		    "timeout waiting for BBP to wake up\n");
3481 		return ETIMEDOUT;
3482 	}
3483 
3484 	/* initialize BBP registers to default values */
3485 	for (i = 0; i < N(rt2860_def_bbp); i++) {
3486 		rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
3487 		    rt2860_def_bbp[i].val);
3488 	}
3489 
3490 	/* fix BBP84 for RT2860E */
3491 	if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
3492 		rt2860_mcu_bbp_write(sc, 84, 0x19);
3493 
3494 	if (sc->mac_ver >= 0x3071) {
3495 		rt2860_mcu_bbp_write(sc, 79, 0x13);
3496 		rt2860_mcu_bbp_write(sc, 80, 0x05);
3497 		rt2860_mcu_bbp_write(sc, 81, 0x33);
3498 	} else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
3499 		rt2860_mcu_bbp_write(sc, 69, 0x16);
3500 		rt2860_mcu_bbp_write(sc, 73, 0x12);
3501 	}
3502 
3503 	return 0;
3504 #undef N
3505 }
3506 
3507 static int
3508 rt2860_txrx_enable(struct rt2860_softc *sc)
3509 {
3510 	struct ifnet *ifp = sc->sc_ifp;
3511 	struct ieee80211com *ic = ifp->if_l2com;
3512 	uint32_t tmp;
3513 	int ntries;
3514 
3515 	/* enable Tx/Rx DMA engine */
3516 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
3517 	RAL_BARRIER_READ_WRITE(sc);
3518 	for (ntries = 0; ntries < 200; ntries++) {
3519 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3520 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3521 			break;
3522 		DELAY(1000);
3523 	}
3524 	if (ntries == 200) {
3525 		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3526 		return ETIMEDOUT;
3527 	}
3528 
3529 	DELAY(50);
3530 
3531 	tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
3532 	    RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
3533 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3534 
3535 	/* set Rx filter */
3536 	tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
3537 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
3538 		tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
3539 		    RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
3540 		    RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
3541 		    RT2860_DROP_CFACK | RT2860_DROP_CFEND;
3542 		if (ic->ic_opmode == IEEE80211_M_STA)
3543 			tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
3544 	}
3545 	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
3546 
3547 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
3548 	    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3549 
3550 	return 0;
3551 }
3552 
3553 static void
3554 rt2860_init(void *arg)
3555 {
3556 	struct rt2860_softc *sc = arg;
3557 	struct ifnet *ifp = sc->sc_ifp;
3558 	struct ieee80211com *ic = ifp->if_l2com;
3559 
3560 	rt2860_init_locked(sc);
3561 
3562 	if (ifp->if_flags & IFF_RUNNING)
3563 		ieee80211_start_all(ic);
3564 }
3565 
3566 static void
3567 rt2860_init_locked(struct rt2860_softc *sc)
3568 {
3569 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
3570 	struct ifnet *ifp = sc->sc_ifp;
3571 	struct ieee80211com *ic = ifp->if_l2com;
3572 	uint32_t tmp;
3573 	uint8_t bbp1, bbp3;
3574 	int i, qid, ridx, ntries, error;
3575 
3576 	if (sc->rfswitch) {
3577 		/* hardware has a radio switch on GPIO pin 2 */
3578 		if (!(RAL_READ(sc, RT2860_GPIO_CTRL) & (1 << 2))) {
3579 			device_printf(sc->sc_dev,
3580 			    "radio is disabled by hardware switch\n");
3581 #ifdef notyet
3582 			rt2860_stop_locked(sc);
3583 			return;
3584 #endif
3585 		}
3586 	}
3587 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE);
3588 
3589 	/* disable DMA */
3590 	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3591 	tmp &= 0xff0;
3592 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3593 
3594 	/* PBF hardware reset */
3595 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3596 	RAL_BARRIER_WRITE(sc);
3597 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3598 
3599 	if ((error = rt2860_load_microcode(sc)) != 0) {
3600 		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
3601 		rt2860_stop_locked(sc);
3602 		return;
3603 	}
3604 
3605 	rt2860_set_macaddr(sc, IF_LLADDR(ifp));
3606 
3607 	/* init Tx power for all Tx rates (from EEPROM) */
3608 	for (ridx = 0; ridx < 5; ridx++) {
3609 		if (sc->txpow20mhz[ridx] == 0xffffffff)
3610 			continue;
3611 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
3612 	}
3613 
3614 	for (ntries = 0; ntries < 100; ntries++) {
3615 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3616 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3617 			break;
3618 		DELAY(1000);
3619 	}
3620 	if (ntries == 100) {
3621 		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3622 		rt2860_stop_locked(sc);
3623 		return;
3624 	}
3625 	tmp &= 0xff0;
3626 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3627 
3628 	/* reset Rx ring and all 6 Tx rings */
3629 	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
3630 
3631 	/* PBF hardware reset */
3632 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3633 	RAL_BARRIER_WRITE(sc);
3634 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3635 
3636 	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE | RT2860_IO_RF_PE);
3637 
3638 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
3639 	RAL_BARRIER_WRITE(sc);
3640 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
3641 
3642 	for (i = 0; i < N(rt2860_def_mac); i++)
3643 		RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
3644 	if (sc->mac_ver >= 0x3071) {
3645 		/* set delay of PA_PE assertion to 1us (unit of 0.25us) */
3646 		RAL_WRITE(sc, RT2860_TX_SW_CFG0,
3647 		    4 << RT2860_DLY_PAPE_EN_SHIFT);
3648 	}
3649 
3650 	if (!(RAL_READ(sc, RT2860_PCI_CFG) & RT2860_PCI_CFG_PCI)) {
3651 		sc->sc_flags |= RT2860_PCIE;
3652 		/* PCIe has different clock cycle count than PCI */
3653 		tmp = RAL_READ(sc, RT2860_US_CYC_CNT);
3654 		tmp = (tmp & ~0xff) | 0x7d;
3655 		RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp);
3656 	}
3657 
3658 	/* wait while MAC is busy */
3659 	for (ntries = 0; ntries < 100; ntries++) {
3660 		if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG) &
3661 		    (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
3662 			break;
3663 		DELAY(1000);
3664 	}
3665 	if (ntries == 100) {
3666 		device_printf(sc->sc_dev, "timeout waiting for MAC\n");
3667 		rt2860_stop_locked(sc);
3668 		return;
3669 	}
3670 
3671 	/* clear Host to MCU mailbox */
3672 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
3673 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
3674 
3675 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
3676 	DELAY(1000);
3677 
3678 	if ((error = rt2860_bbp_init(sc)) != 0) {
3679 		rt2860_stop_locked(sc);
3680 		return;
3681 	}
3682 
3683 	/* clear RX WCID search table */
3684 	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
3685 	/* clear pairwise key table */
3686 	RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048);
3687 	/* clear IV/EIV table */
3688 	RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512);
3689 	/* clear WCID attribute table */
3690 	RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256);
3691 	/* clear shared key table */
3692 	RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
3693 	/* clear shared key mode */
3694 	RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
3695 
3696 	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
3697 	for (qid = 0; qid < 6; qid++) {
3698 		RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
3699 		RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
3700 		RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
3701 	}
3702 
3703 	/* init Rx ring */
3704 	RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
3705 	RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
3706 	RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
3707 
3708 	/* setup maximum buffer sizes */
3709 	RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
3710 	    (MCLBYTES - sizeof (struct rt2860_rxwi) - 2));
3711 
3712 	for (ntries = 0; ntries < 100; ntries++) {
3713 		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3714 		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3715 			break;
3716 		DELAY(1000);
3717 	}
3718 	if (ntries == 100) {
3719 		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3720 		rt2860_stop_locked(sc);
3721 		return;
3722 	}
3723 	tmp &= 0xff0;
3724 	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3725 
3726 	/* disable interrupts mitigation */
3727 	RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
3728 
3729 	/* write vendor-specific BBP values (from EEPROM) */
3730 	for (i = 0; i < 8; i++) {
3731 		if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
3732 			continue;
3733 		rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
3734 	}
3735 
3736 	/* select Main antenna for 1T1R devices */
3737 	if (sc->rf_rev == RT3070_RF_2020 ||
3738 	    sc->rf_rev == RT3070_RF_3020 ||
3739 	    sc->rf_rev == RT3070_RF_3320)
3740 		rt3090_set_rx_antenna(sc, 0);
3741 
3742 	/* send LEDs operating mode to microcontroller */
3743 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0], 0);
3744 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1], 0);
3745 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2], 0);
3746 
3747 	if (sc->mac_ver >= 0x3071)
3748 		rt3090_rf_init(sc);
3749 
3750 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP, 0x02ff, 1);
3751 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP, 0, 1);
3752 
3753 	if (sc->mac_ver >= 0x3071)
3754 		rt3090_rf_wakeup(sc);
3755 
3756 	/* disable non-existing Rx chains */
3757 	bbp3 = rt2860_mcu_bbp_read(sc, 3);
3758 	bbp3 &= ~(1 << 3 | 1 << 4);
3759 	if (sc->nrxchains == 2)
3760 		bbp3 |= 1 << 3;
3761 	else if (sc->nrxchains == 3)
3762 		bbp3 |= 1 << 4;
3763 	rt2860_mcu_bbp_write(sc, 3, bbp3);
3764 
3765 	/* disable non-existing Tx chains */
3766 	bbp1 = rt2860_mcu_bbp_read(sc, 1);
3767 	if (sc->ntxchains == 1)
3768 		bbp1 = (bbp1 & ~(1 << 3 | 1 << 4));
3769 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
3770 		bbp1 = (bbp1 & ~(1 << 4)) | 1 << 3;
3771 	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
3772 		bbp1 = (bbp1 & ~(1 << 3)) | 1 << 4;
3773 	rt2860_mcu_bbp_write(sc, 1, bbp1);
3774 
3775 	if (sc->mac_ver >= 0x3071)
3776 		rt3090_rf_setup(sc);
3777 
3778 	/* select default channel */
3779 	rt2860_switch_chan(sc, ic->ic_curchan);
3780 
3781 	/* reset RF from MCU */
3782 	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
3783 
3784 	/* set RTS threshold */
3785 	tmp = RAL_READ(sc, RT2860_TX_RTS_CFG);
3786 	tmp &= ~0xffff00;
3787 	tmp |= IEEE80211_RTS_DEFAULT << 8;
3788 	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);
3789 
3790 	/* setup initial protection mode */
3791 	rt2860_updateprot(ifp);
3792 
3793 	/* turn radio LED on */
3794 	rt2860_set_leds(sc, RT2860_LED_RADIO);
3795 
3796 	/* enable Tx/Rx DMA engine */
3797 	if ((error = rt2860_txrx_enable(sc)) != 0) {
3798 		rt2860_stop_locked(sc);
3799 		return;
3800 	}
3801 
3802 	/* clear pending interrupts */
3803 	RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
3804 	/* enable interrupts */
3805 	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
3806 
3807 	if (sc->sc_flags & RT2860_ADVANCED_PS)
3808 		rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);
3809 
3810 	ifq_clr_oactive(&ifp->if_snd);
3811 	ifp->if_flags |= IFF_RUNNING;
3812 
3813 	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
3814 #undef N
3815 }
3816 
3817 static void
3818 rt2860_stop(void *arg)
3819 {
3820 	struct rt2860_softc *sc = arg;
3821 
3822 	rt2860_stop_locked(sc);
3823 }
3824 
3825 static void
3826 rt2860_stop_locked(struct rt2860_softc *sc)
3827 {
3828 	struct ifnet *ifp = sc->sc_ifp;
3829 	uint32_t tmp;
3830 	int qid;
3831 
3832 	if (ifp->if_flags & IFF_RUNNING)
3833 		rt2860_set_leds(sc, 0);	/* turn all LEDs off */
3834 
3835 	callout_stop(&sc->watchdog_ch);
3836 	sc->sc_tx_timer = 0;
3837 	ifp->if_flags &= ~IFF_RUNNING;
3838 	ifq_clr_oactive(&ifp->if_snd);
3839 
3840 	/* disable interrupts */
3841 	RAL_WRITE(sc, RT2860_INT_MASK, 0);
3842 
3843 	/* disable GP timer */
3844 	rt2860_set_gp_timer(sc, 0);
3845 
3846 	/* disable Rx */
3847 	tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL);
3848 	tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3849 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
3850 
3851 	/* reset adapter */
3852 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
3853 	RAL_BARRIER_WRITE(sc);
3854 	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
3855 
3856 	/* reset Tx and Rx rings (and reclaim TXWIs) */
3857 	sc->qfullmsk = 0;
3858 	for (qid = 0; qid < 6; qid++)
3859 		rt2860_reset_tx_ring(sc, &sc->txq[qid]);
3860 	rt2860_reset_rx_ring(sc, &sc->rxq);
3861 }
3862 
3863 int
3864 rt2860_load_microcode(struct rt2860_softc *sc)
3865 {
3866 	const struct firmware *fp;
3867 	int ntries, error;
3868 
3869 	wlan_assert_serialized();
3870 	wlan_serialize_exit();
3871 	fp = firmware_get("rt2860fw");
3872 	wlan_serialize_enter();
3873 
3874 	if (fp == NULL) {
3875 		device_printf(sc->sc_dev,
3876 		    "unable to receive rt2860fw firmware image\n");
3877 		return EINVAL;
3878 	}
3879 
3880 	/* set "host program ram write selection" bit */
3881 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
3882 	/* write microcode image */
3883 	RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, fp->data, fp->datasize);
3884 	/* kick microcontroller unit */
3885 	RAL_WRITE(sc, RT2860_SYS_CTRL, 0);
3886 	RAL_BARRIER_WRITE(sc);
3887 	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
3888 
3889 	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
3890 	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
3891 
3892 	/* wait until microcontroller is ready */
3893 	RAL_BARRIER_READ_WRITE(sc);
3894 	for (ntries = 0; ntries < 1000; ntries++) {
3895 		if (RAL_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
3896 			break;
3897 		DELAY(1000);
3898 	}
3899 	if (ntries == 1000) {
3900 		device_printf(sc->sc_dev,
3901 		    "timeout waiting for MCU to initialize\n");
3902 		error = ETIMEDOUT;
3903 	} else
3904 		error = 0;
3905 
3906 	firmware_put(fp, FIRMWARE_UNLOAD);
3907 	return error;
3908 }
3909 
3910 /*
3911  * This function is called periodically to adjust Tx power based on
3912  * temperature variation.
3913  */
3914 #ifdef NOT_YET
3915 static void
3916 rt2860_calib(struct rt2860_softc *sc)
3917 {
3918 	struct ieee80211com *ic = &sc->sc_ic;
3919 	const uint8_t *tssi;
3920 	uint8_t step, bbp49;
3921 	int8_t ridx, d;
3922 
3923 	/* read current temperature */
3924 	bbp49 = rt2860_mcu_bbp_read(sc, 49);
3925 
3926 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)) {
3927 		tssi = &sc->tssi_2ghz[4];
3928 		step = sc->step_2ghz;
3929 	} else {
3930 		tssi = &sc->tssi_5ghz[4];
3931 		step = sc->step_5ghz;
3932 	}
3933 
3934 	if (bbp49 < tssi[0]) {		/* lower than reference */
3935 		/* use higher Tx power than default */
3936 		for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
3937 	} else if (bbp49 > tssi[0]) {	/* greater than reference */
3938 		/* use lower Tx power than default */
3939 		for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
3940 	} else {
3941 		/* use default Tx power */
3942 		d = 0;
3943 	}
3944 	d *= step;
3945 
3946 	DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
3947 
3948 	/* write adjusted Tx power values for each Tx rate */
3949 	for (ridx = 0; ridx < 5; ridx++) {
3950 		if (sc->txpow20mhz[ridx] == 0xffffffff)
3951 			continue;
3952 		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),
3953 		    b4inc(sc->txpow20mhz[ridx], d));
3954 	}
3955 }
3956 #endif
3957 
3958 static void
3959 rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
3960 {
3961 	uint32_t tmp;
3962 
3963 	if (aux) {
3964 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
3965 		RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp & ~RT2860_C);
3966 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
3967 		RAL_WRITE(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
3968 	} else {
3969 		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
3970 		RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp | RT2860_C);
3971 		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
3972 		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
3973 	}
3974 }
3975 
3976 static void
3977 rt2860_switch_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
3978 {
3979 	struct ifnet *ifp = sc->sc_ifp;
3980 	struct ieee80211com *ic = ifp->if_l2com;
3981 	u_int chan, group;
3982 
3983 	chan = ieee80211_chan2ieee(ic, c);
3984 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
3985 		return;
3986 
3987 	if (sc->mac_ver >= 0x3071)
3988 		rt3090_set_chan(sc, chan);
3989 	else
3990 		rt2860_set_chan(sc, chan);
3991 
3992 	/* determine channel group */
3993 	if (chan <= 14)
3994 		group = 0;
3995 	else if (chan <= 64)
3996 		group = 1;
3997 	else if (chan <= 128)
3998 		group = 2;
3999 	else
4000 		group = 3;
4001 
4002 	/* XXX necessary only when group has changed! */
4003 	rt2860_select_chan_group(sc, group);
4004 
4005 	DELAY(1000);
4006 }
4007 
4008 static int
4009 rt2860_setup_beacon(struct rt2860_softc *sc, struct ieee80211vap *vap)
4010 {
4011 	struct ieee80211com *ic = vap->iv_ic;
4012 	struct ieee80211_beacon_offsets bo;
4013 	struct rt2860_txwi txwi;
4014 	struct mbuf *m;
4015 	int ridx;
4016 
4017 	if ((m = ieee80211_beacon_alloc(vap->iv_bss, &bo)) == NULL)
4018 		return ENOBUFS;
4019 
4020 	memset(&txwi, 0, sizeof txwi);
4021 	txwi.wcid = 0xff;
4022 	txwi.len = htole16(m->m_pkthdr.len);
4023 	/* send beacons at the lowest available rate */
4024 	ridx = IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan) ?
4025 	    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
4026 	txwi.phy = htole16(rt2860_rates[ridx].mcs);
4027 	if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4028 		txwi.phy |= htole16(RT2860_PHY_OFDM);
4029 	txwi.txop = RT2860_TX_TXOP_HT;
4030 	txwi.flags = RT2860_TX_TS;
4031 	txwi.xflags = RT2860_TX_NSEQ;
4032 
4033 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),
4034 	    (uint8_t *)&txwi, sizeof txwi);
4035 	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
4036 	    mtod(m, uint8_t *), m->m_pkthdr.len);
4037 
4038 	m_freem(m);
4039 
4040 	return 0;
4041 }
4042 
4043 static void
4044 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
4045 {
4046 	struct ifnet *ifp = sc->sc_ifp;
4047 	struct ieee80211com *ic = ifp->if_l2com;
4048 	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4049 	uint32_t tmp;
4050 
4051 	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
4052 
4053 	tmp &= ~0x1fffff;
4054 	tmp |= vap->iv_bss->ni_intval * 16;
4055 	tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
4056 	if (vap->iv_opmode == IEEE80211_M_STA) {
4057 		/*
4058 		 * Local TSF is always updated with remote TSF on beacon
4059 		 * reception.
4060 		 */
4061 		tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
4062 	}
4063 	else if (vap->iv_opmode == IEEE80211_M_IBSS ||
4064 	    vap->iv_opmode == IEEE80211_M_MBSS) {
4065 		tmp |= RT2860_BCN_TX_EN;
4066 		/*
4067 		 * Local TSF is updated with remote TSF on beacon reception
4068 		 * only if the remote TSF is greater than local TSF.
4069 		 */
4070 		tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
4071 	} else if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
4072 		tmp |= RT2860_BCN_TX_EN;
4073 		/* SYNC with nobody */
4074 		tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
4075 	}
4076 
4077 	RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
4078 }
4079