1/*-
2 * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
3 * Copyright (c) 2012 Bernhard Schmidt <bschmidt@FreeBSD.org>
4 *
5 * Permission to use, copy, modify, and distribute this software for any
6 * purpose with or without fee is hereby granted, provided that the above
7 * copyright notice and this permission notice appear in all copies.
8 *
9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16 *
17 * $OpenBSD: rt2860.c,v 1.65 2010/10/23 14:24:54 damien Exp $
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: releng/12.0/sys/dev/ral/rt2860.c 327479 2018-01-02 00:07:28Z adrian $");
22
23/*-
24 * Ralink Technology RT2860/RT3090/RT3390/RT3562/RT5390/RT5392 chipset driver
25 * http://www.ralinktech.com/
26 */
27
28#include <sys/param.h>
29#include <sys/sysctl.h>
30#include <sys/sockio.h>
31#include <sys/mbuf.h>
32#include <sys/kernel.h>
33#include <sys/socket.h>
34#include <sys/systm.h>
35#include <sys/malloc.h>
36#include <sys/lock.h>
37#include <sys/mutex.h>
38#include <sys/module.h>
39#include <sys/bus.h>
40#include <sys/endian.h>
41#include <sys/firmware.h>
42
43#include <machine/bus.h>
44#include <machine/resource.h>
45#include <sys/rman.h>
46
47#include <net/bpf.h>
48#include <net/if.h>
49#include <net/if_var.h>
50#include <net/if_arp.h>
51#include <net/ethernet.h>
52#include <net/if_dl.h>
53#include <net/if_media.h>
54#include <net/if_types.h>
55
56#include <net80211/ieee80211_var.h>
57#include <net80211/ieee80211_radiotap.h>
58#include <net80211/ieee80211_regdomain.h>
59#include <net80211/ieee80211_ratectl.h>
60
61#include <netinet/in.h>
62#include <netinet/in_systm.h>
63#include <netinet/in_var.h>
64#include <netinet/ip.h>
65#include <netinet/if_ether.h>
66
67#include <dev/ral/rt2860reg.h>
68#include <dev/ral/rt2860var.h>
69
70#define RAL_DEBUG
71#ifdef RAL_DEBUG
72#define DPRINTF(x)	do { if (sc->sc_debug > 0) printf x; } while (0)
73#define DPRINTFN(n, x)	do { if (sc->sc_debug >= (n)) printf x; } while (0)
74#else
75#define DPRINTF(x)
76#define DPRINTFN(n, x)
77#endif
78
79static struct ieee80211vap *rt2860_vap_create(struct ieee80211com *,
80			    const char [IFNAMSIZ], int, enum ieee80211_opmode,
81			    int, const uint8_t [IEEE80211_ADDR_LEN],
82			    const uint8_t [IEEE80211_ADDR_LEN]);
83static void	rt2860_vap_delete(struct ieee80211vap *);
84static void	rt2860_dma_map_addr(void *, bus_dma_segment_t *, int, int);
85static int	rt2860_alloc_tx_ring(struct rt2860_softc *,
86		    struct rt2860_tx_ring *);
87static void	rt2860_reset_tx_ring(struct rt2860_softc *,
88		    struct rt2860_tx_ring *);
89static void	rt2860_free_tx_ring(struct rt2860_softc *,
90		    struct rt2860_tx_ring *);
91static int	rt2860_alloc_tx_pool(struct rt2860_softc *);
92static void	rt2860_free_tx_pool(struct rt2860_softc *);
93static int	rt2860_alloc_rx_ring(struct rt2860_softc *,
94		    struct rt2860_rx_ring *);
95static void	rt2860_reset_rx_ring(struct rt2860_softc *,
96		    struct rt2860_rx_ring *);
97static void	rt2860_free_rx_ring(struct rt2860_softc *,
98		    struct rt2860_rx_ring *);
99static void	rt2860_updatestats(struct rt2860_softc *);
100static void	rt2860_newassoc(struct ieee80211_node *, int);
101static void	rt2860_node_free(struct ieee80211_node *);
102#ifdef IEEE80211_HT
103static int	rt2860_ampdu_rx_start(struct ieee80211com *,
104		    struct ieee80211_node *, uint8_t);
105static void	rt2860_ampdu_rx_stop(struct ieee80211com *,
106		    struct ieee80211_node *, uint8_t);
107#endif
108static int	rt2860_newstate(struct ieee80211vap *, enum ieee80211_state,
109		    int);
110static uint16_t	rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
111static uint16_t	rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
112static void	rt2860_intr_coherent(struct rt2860_softc *);
113static void	rt2860_drain_stats_fifo(struct rt2860_softc *);
114static void	rt2860_tx_intr(struct rt2860_softc *, int);
115static void	rt2860_rx_intr(struct rt2860_softc *);
116static void	rt2860_tbtt_intr(struct rt2860_softc *);
117static void	rt2860_gp_intr(struct rt2860_softc *);
118static int	rt2860_tx(struct rt2860_softc *, struct mbuf *,
119		    struct ieee80211_node *);
120static int	rt2860_raw_xmit(struct ieee80211_node *, struct mbuf *,
121		    const struct ieee80211_bpf_params *);
122static int	rt2860_tx_raw(struct rt2860_softc *, struct mbuf *,
123		    struct ieee80211_node *,
124		    const struct ieee80211_bpf_params *params);
125static int	rt2860_transmit(struct ieee80211com *, struct mbuf *);
126static void	rt2860_start(struct rt2860_softc *);
127static void	rt2860_watchdog(void *);
128static void	rt2860_parent(struct ieee80211com *);
129static void	rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
130static uint8_t	rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
131static void	rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
132static uint8_t	rt3090_rf_read(struct rt2860_softc *, uint8_t);
133static void	rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
134static int	rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
135static void	rt2860_enable_mrr(struct rt2860_softc *);
136static void	rt2860_set_txpreamble(struct rt2860_softc *);
137static void	rt2860_set_basicrates(struct rt2860_softc *,
138		    const struct ieee80211_rateset *);
139static void	rt2860_scan_start(struct ieee80211com *);
140static void	rt2860_scan_end(struct ieee80211com *);
141static void	rt2860_getradiocaps(struct ieee80211com *, int, int *,
142		    struct ieee80211_channel[]);
143static void	rt2860_set_channel(struct ieee80211com *);
144static void	rt2860_select_chan_group(struct rt2860_softc *, int);
145static void	rt2860_set_chan(struct rt2860_softc *, u_int);
146static void	rt3090_set_chan(struct rt2860_softc *, u_int);
147static void	rt5390_set_chan(struct rt2860_softc *, u_int);
148static int	rt3090_rf_init(struct rt2860_softc *);
149static void	rt5390_rf_init(struct rt2860_softc *);
150static void	rt3090_rf_wakeup(struct rt2860_softc *);
151static void	rt5390_rf_wakeup(struct rt2860_softc *);
152static int	rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
153		    uint8_t *);
154static void	rt3090_rf_setup(struct rt2860_softc *);
155static void	rt2860_set_leds(struct rt2860_softc *, uint16_t);
156static void	rt2860_set_gp_timer(struct rt2860_softc *, int);
157static void	rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
158static void	rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
159static void	rt2860_update_promisc(struct ieee80211com *);
160static void	rt2860_updateslot(struct ieee80211com *);
161static void	rt2860_updateprot(struct rt2860_softc *);
162static int	rt2860_updateedca(struct ieee80211com *);
163#ifdef HW_CRYPTO
164static int	rt2860_set_key(struct ieee80211com *, struct ieee80211_node *,
165		    struct ieee80211_key *);
166static void	rt2860_delete_key(struct ieee80211com *,
167		    struct ieee80211_node *, struct ieee80211_key *);
168#endif
169static int8_t	rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
170static const char *rt2860_get_rf(uint16_t);
171static int	rt2860_read_eeprom(struct rt2860_softc *,
172		    uint8_t macaddr[IEEE80211_ADDR_LEN]);
173static int	rt2860_bbp_init(struct rt2860_softc *);
174static void	rt5390_bbp_init(struct rt2860_softc *);
175static int	rt2860_txrx_enable(struct rt2860_softc *);
176static void	rt2860_init(void *);
177static void	rt2860_init_locked(struct rt2860_softc *);
178static void	rt2860_stop(void *);
179static void	rt2860_stop_locked(struct rt2860_softc *);
180static int	rt2860_load_microcode(struct rt2860_softc *);
181#ifdef NOT_YET
182static void	rt2860_calib(struct rt2860_softc *);
183#endif
184static void	rt3090_set_rx_antenna(struct rt2860_softc *, int);
185static void	rt2860_switch_chan(struct rt2860_softc *,
186		    struct ieee80211_channel *);
187static int	rt2860_setup_beacon(struct rt2860_softc *,
188		    struct ieee80211vap *);
189static void	rt2860_enable_tsf_sync(struct rt2860_softc *);
190
191static const struct {
192	uint32_t	reg;
193	uint32_t	val;
194} rt2860_def_mac[] = {
195	RT2860_DEF_MAC
196};
197
198static const struct {
199	uint8_t	reg;
200	uint8_t	val;
201} rt2860_def_bbp[] = {
202	RT2860_DEF_BBP
203}, rt5390_def_bbp[] = {
204	RT5390_DEF_BBP
205};
206
207static const struct rfprog {
208	uint8_t		chan;
209	uint32_t	r1, r2, r3, r4;
210} rt2860_rf2850[] = {
211	RT2860_RF2850
212};
213
214struct {
215	uint8_t	n, r, k;
216} rt3090_freqs[] = {
217	RT3070_RF3052
218};
219
220static const struct {
221	uint8_t	reg;
222	uint8_t	val;
223} rt3090_def_rf[] = {
224	RT3070_DEF_RF
225}, rt5390_def_rf[] = {
226	RT5390_DEF_RF
227}, rt5392_def_rf[] = {
228	RT5392_DEF_RF
229};
230
231static const uint8_t rt2860_chan_2ghz[] =
232	{ 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
233static const uint8_t rt2860_chan_5ghz[] =
234	{ 36, 38, 40, 44, 46, 48, 52, 54, 56, 60, 62, 64, 100, 102, 104,
235	  108, 110, 112, 116, 118, 120, 124, 126, 128, 132, 134, 136, 140,
236	  149, 151, 153, 157, 159, 161, 165, 167, 169, 171, 173 };
237
238int
239rt2860_attach(device_t dev, int id)
240{
241	struct rt2860_softc *sc = device_get_softc(dev);
242	struct ieee80211com *ic = &sc->sc_ic;
243	uint32_t tmp;
244	int error, ntries, qid;
245
246	sc->sc_dev = dev;
247	sc->sc_debug = 0;
248
249	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
250	    MTX_DEF | MTX_RECURSE);
251
252	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
253	mbufq_init(&sc->sc_snd, ifqmaxlen);
254
255	/* wait for NIC to initialize */
256	for (ntries = 0; ntries < 100; ntries++) {
257		tmp = RAL_READ(sc, RT2860_ASIC_VER_ID);
258		if (tmp != 0 && tmp != 0xffffffff)
259			break;
260		DELAY(10);
261	}
262	if (ntries == 100) {
263		device_printf(sc->sc_dev,
264		    "timeout waiting for NIC to initialize\n");
265		error = EIO;
266		goto fail1;
267	}
268	sc->mac_ver = tmp >> 16;
269	sc->mac_rev = tmp & 0xffff;
270
271	if (sc->mac_ver != 0x2860 &&
272	    (id == 0x0681 || id == 0x0781 || id == 0x1059))
273		sc->sc_flags |= RT2860_ADVANCED_PS;
274
275	/* retrieve RF rev. no and various other things from EEPROM */
276	rt2860_read_eeprom(sc, ic->ic_macaddr);
277	device_printf(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
278	    "RF %s (MIMO %dT%dR), address %6D\n",
279	    sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
280	    sc->ntxchains, sc->nrxchains, ic->ic_macaddr, ":");
281
282	/*
283	 * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
284	 */
285	for (qid = 0; qid < 6; qid++) {
286		if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
287			device_printf(sc->sc_dev,
288			    "could not allocate Tx ring %d\n", qid);
289			goto fail2;
290		}
291	}
292
293	if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
294		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
295		goto fail2;
296	}
297
298	if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
299		device_printf(sc->sc_dev, "could not allocate Tx pool\n");
300		goto fail3;
301	}
302
303	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
304	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
305	    WME_AC_VO : 5;
306
307	ic->ic_softc = sc;
308	ic->ic_name = device_get_nameunit(dev);
309	ic->ic_opmode = IEEE80211_M_STA;
310	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
311
312	/* set device capabilities */
313	ic->ic_caps =
314		  IEEE80211_C_STA		/* station mode */
315		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
316		| IEEE80211_C_HOSTAP		/* hostap mode */
317		| IEEE80211_C_MONITOR		/* monitor mode */
318		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
319		| IEEE80211_C_WDS		/* 4-address traffic works */
320		| IEEE80211_C_MBSS		/* mesh point link mode */
321		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
322		| IEEE80211_C_SHSLOT		/* short slot time supported */
323		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
324#if 0
325		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
326#endif
327		| IEEE80211_C_WME		/* 802.11e */
328		;
329
330	rt2860_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
331	    ic->ic_channels);
332
333	ieee80211_ifattach(ic);
334
335	ic->ic_wme.wme_update = rt2860_updateedca;
336	ic->ic_scan_start = rt2860_scan_start;
337	ic->ic_scan_end = rt2860_scan_end;
338	ic->ic_getradiocaps = rt2860_getradiocaps;
339	ic->ic_set_channel = rt2860_set_channel;
340	ic->ic_updateslot = rt2860_updateslot;
341	ic->ic_update_promisc = rt2860_update_promisc;
342	ic->ic_raw_xmit = rt2860_raw_xmit;
343	sc->sc_node_free = ic->ic_node_free;
344	ic->ic_node_free = rt2860_node_free;
345	ic->ic_newassoc = rt2860_newassoc;
346	ic->ic_transmit = rt2860_transmit;
347	ic->ic_parent = rt2860_parent;
348	ic->ic_vap_create = rt2860_vap_create;
349	ic->ic_vap_delete = rt2860_vap_delete;
350
351	ieee80211_radiotap_attach(ic,
352	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
353		RT2860_TX_RADIOTAP_PRESENT,
354	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
355		RT2860_RX_RADIOTAP_PRESENT);
356
357#ifdef RAL_DEBUG
358	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
359	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
360	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
361#endif
362	if (bootverbose)
363		ieee80211_announce(ic);
364
365	return 0;
366
367fail3:	rt2860_free_rx_ring(sc, &sc->rxq);
368fail2:	while (--qid >= 0)
369		rt2860_free_tx_ring(sc, &sc->txq[qid]);
370fail1:	mtx_destroy(&sc->sc_mtx);
371	return error;
372}
373
374int
375rt2860_detach(void *xsc)
376{
377	struct rt2860_softc *sc = xsc;
378	struct ieee80211com *ic = &sc->sc_ic;
379	int qid;
380
381	RAL_LOCK(sc);
382	rt2860_stop_locked(sc);
383	RAL_UNLOCK(sc);
384
385	ieee80211_ifdetach(ic);
386	mbufq_drain(&sc->sc_snd);
387	for (qid = 0; qid < 6; qid++)
388		rt2860_free_tx_ring(sc, &sc->txq[qid]);
389	rt2860_free_rx_ring(sc, &sc->rxq);
390	rt2860_free_tx_pool(sc);
391
392	mtx_destroy(&sc->sc_mtx);
393
394	return 0;
395}
396
397void
398rt2860_shutdown(void *xsc)
399{
400	struct rt2860_softc *sc = xsc;
401
402	rt2860_stop(sc);
403}
404
405void
406rt2860_suspend(void *xsc)
407{
408	struct rt2860_softc *sc = xsc;
409
410	rt2860_stop(sc);
411}
412
413void
414rt2860_resume(void *xsc)
415{
416	struct rt2860_softc *sc = xsc;
417
418	if (sc->sc_ic.ic_nrunning > 0)
419		rt2860_init(sc);
420}
421
422static struct ieee80211vap *
423rt2860_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
424    enum ieee80211_opmode opmode, int flags,
425    const uint8_t bssid[IEEE80211_ADDR_LEN],
426    const uint8_t mac[IEEE80211_ADDR_LEN])
427{
428	struct rt2860_softc *sc = ic->ic_softc;
429	struct rt2860_vap *rvp;
430	struct ieee80211vap *vap;
431
432	switch (opmode) {
433	case IEEE80211_M_STA:
434	case IEEE80211_M_IBSS:
435	case IEEE80211_M_AHDEMO:
436	case IEEE80211_M_MONITOR:
437	case IEEE80211_M_HOSTAP:
438	case IEEE80211_M_MBSS:
439		/* XXXRP: TBD */
440		if (!TAILQ_EMPTY(&ic->ic_vaps)) {
441			device_printf(sc->sc_dev, "only 1 vap supported\n");
442			return NULL;
443		}
444		if (opmode == IEEE80211_M_STA)
445			flags |= IEEE80211_CLONE_NOBEACONS;
446		break;
447	case IEEE80211_M_WDS:
448		if (TAILQ_EMPTY(&ic->ic_vaps) ||
449		    ic->ic_opmode != IEEE80211_M_HOSTAP) {
450			device_printf(sc->sc_dev,
451			    "wds only supported in ap mode\n");
452			return NULL;
453		}
454		/*
455		 * Silently remove any request for a unique
456		 * bssid; WDS vap's always share the local
457		 * mac address.
458		 */
459		flags &= ~IEEE80211_CLONE_BSSID;
460		break;
461	default:
462		device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
463		return NULL;
464	}
465	rvp = malloc(sizeof(struct rt2860_vap), M_80211_VAP, M_WAITOK | M_ZERO);
466	vap = &rvp->ral_vap;
467	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
468
469	/* override state transition machine */
470	rvp->ral_newstate = vap->iv_newstate;
471	vap->iv_newstate = rt2860_newstate;
472#if 0
473	vap->iv_update_beacon = rt2860_beacon_update;
474#endif
475
476	/* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
477	vap->iv_max_aid = min(IEEE80211_AID_MAX, RT2860_WCID_MAX);
478
479	ieee80211_ratectl_init(vap);
480	/* complete setup */
481	ieee80211_vap_attach(vap, ieee80211_media_change,
482	    ieee80211_media_status, mac);
483	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
484		ic->ic_opmode = opmode;
485	return vap;
486}
487
488static void
489rt2860_vap_delete(struct ieee80211vap *vap)
490{
491	struct rt2860_vap *rvp = RT2860_VAP(vap);
492
493	ieee80211_ratectl_deinit(vap);
494	ieee80211_vap_detach(vap);
495	free(rvp, M_80211_VAP);
496}
497
498static void
499rt2860_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
500{
501	if (error != 0)
502		return;
503
504	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
505
506	*(bus_addr_t *)arg = segs[0].ds_addr;
507}
508
509
510static int
511rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
512{
513	int size, error;
514
515	size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
516
517	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 16, 0,
518	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
519	    size, 1, size, 0, NULL, NULL, &ring->desc_dmat);
520	if (error != 0) {
521		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
522		goto fail;
523	}
524
525	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->txd,
526	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
527	if (error != 0) {
528		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
529		goto fail;
530	}
531
532	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->txd,
533	    size, rt2860_dma_map_addr, &ring->paddr, 0);
534	if (error != 0) {
535		device_printf(sc->sc_dev, "could not load desc DMA map\n");
536		goto fail;
537	}
538
539	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
540
541	return 0;
542
543fail:	rt2860_free_tx_ring(sc, ring);
544	return error;
545}
546
547void
548rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
549{
550	struct rt2860_tx_data *data;
551	int i;
552
553	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
554		if ((data = ring->data[i]) == NULL)
555			continue;	/* nothing mapped in this slot */
556
557		if (data->m != NULL) {
558			bus_dmamap_sync(sc->txwi_dmat, data->map,
559			    BUS_DMASYNC_POSTWRITE);
560			bus_dmamap_unload(sc->txwi_dmat, data->map);
561			m_freem(data->m);
562			data->m = NULL;
563		}
564		if (data->ni != NULL) {
565			ieee80211_free_node(data->ni);
566			data->ni = NULL;
567		}
568
569		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
570		ring->data[i] = NULL;
571	}
572
573	ring->queued = 0;
574	ring->cur = ring->next = 0;
575}
576
577void
578rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
579{
580	struct rt2860_tx_data *data;
581	int i;
582
583	if (ring->txd != NULL) {
584		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
585		    BUS_DMASYNC_POSTWRITE);
586		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
587		bus_dmamem_free(ring->desc_dmat, ring->txd, ring->desc_map);
588	}
589	if (ring->desc_dmat != NULL)
590		bus_dma_tag_destroy(ring->desc_dmat);
591
592	for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
593		if ((data = ring->data[i]) == NULL)
594			continue;	/* nothing mapped in this slot */
595
596		if (data->m != NULL) {
597			bus_dmamap_sync(sc->txwi_dmat, data->map,
598			    BUS_DMASYNC_POSTWRITE);
599			bus_dmamap_unload(sc->txwi_dmat, data->map);
600			m_freem(data->m);
601		}
602		if (data->ni != NULL)
603			ieee80211_free_node(data->ni);
604
605		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
606	}
607}
608
609/*
610 * Allocate a pool of TX Wireless Information blocks.
611 */
612int
613rt2860_alloc_tx_pool(struct rt2860_softc *sc)
614{
615	caddr_t vaddr;
616	bus_addr_t paddr;
617	int i, size, error;
618
619	size = RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ;
620
621	/* init data_pool early in case of failure.. */
622	SLIST_INIT(&sc->data_pool);
623
624	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
625	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
626	    size, 1, size, 0, NULL, NULL, &sc->txwi_dmat);
627	if (error != 0) {
628		device_printf(sc->sc_dev, "could not create txwi DMA tag\n");
629		goto fail;
630	}
631
632	error = bus_dmamem_alloc(sc->txwi_dmat, (void **)&sc->txwi_vaddr,
633	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &sc->txwi_map);
634	if (error != 0) {
635		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
636		goto fail;
637	}
638
639	error = bus_dmamap_load(sc->txwi_dmat, sc->txwi_map,
640	    sc->txwi_vaddr, size, rt2860_dma_map_addr, &paddr, 0);
641	if (error != 0) {
642		device_printf(sc->sc_dev, "could not load txwi DMA map\n");
643		goto fail;
644	}
645
646	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
647
648	vaddr = sc->txwi_vaddr;
649	for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
650		struct rt2860_tx_data *data = &sc->data[i];
651
652		error = bus_dmamap_create(sc->txwi_dmat, 0, &data->map);
653		if (error != 0) {
654			device_printf(sc->sc_dev, "could not create DMA map\n");
655			goto fail;
656		}
657		data->txwi = (struct rt2860_txwi *)vaddr;
658		data->paddr = paddr;
659		vaddr += RT2860_TXWI_DMASZ;
660		paddr += RT2860_TXWI_DMASZ;
661
662		SLIST_INSERT_HEAD(&sc->data_pool, data, next);
663	}
664
665	return 0;
666
667fail:	rt2860_free_tx_pool(sc);
668	return error;
669}
670
671void
672rt2860_free_tx_pool(struct rt2860_softc *sc)
673{
674	if (sc->txwi_vaddr != NULL) {
675		bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map,
676		    BUS_DMASYNC_POSTWRITE);
677		bus_dmamap_unload(sc->txwi_dmat, sc->txwi_map);
678		bus_dmamem_free(sc->txwi_dmat, sc->txwi_vaddr, sc->txwi_map);
679	}
680	if (sc->txwi_dmat != NULL)
681		bus_dma_tag_destroy(sc->txwi_dmat);
682
683	while (!SLIST_EMPTY(&sc->data_pool)) {
684		struct rt2860_tx_data *data;
685		data = SLIST_FIRST(&sc->data_pool);
686		bus_dmamap_destroy(sc->txwi_dmat, data->map);
687		SLIST_REMOVE_HEAD(&sc->data_pool, next);
688	}
689}
690
691int
692rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
693{
694	bus_addr_t physaddr;
695	int i, size, error;
696
697	size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
698
699	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 16, 0,
700	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
701	    size, 1, size, 0, NULL, NULL, &ring->desc_dmat);
702	if (error != 0) {
703		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
704		goto fail;
705	}
706
707	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->rxd,
708	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
709	if (error != 0) {
710		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
711		goto fail;
712	}
713
714	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->rxd,
715	    size, rt2860_dma_map_addr, &ring->paddr, 0);
716	if (error != 0) {
717		device_printf(sc->sc_dev, "could not load desc DMA map\n");
718		goto fail;
719	}
720
721	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
722	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
723	    1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
724	if (error != 0) {
725		device_printf(sc->sc_dev, "could not create data DMA tag\n");
726		goto fail;
727	}
728
729	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
730		struct rt2860_rx_data *data = &ring->data[i];
731		struct rt2860_rxd *rxd = &ring->rxd[i];
732
733		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
734		if (error != 0) {
735			device_printf(sc->sc_dev, "could not create DMA map\n");
736			goto fail;
737		}
738
739		data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
740		if (data->m == NULL) {
741			device_printf(sc->sc_dev,
742			    "could not allocate rx mbuf\n");
743			error = ENOMEM;
744			goto fail;
745		}
746
747		error = bus_dmamap_load(ring->data_dmat, data->map,
748		    mtod(data->m, void *), MCLBYTES, rt2860_dma_map_addr,
749		    &physaddr, 0);
750		if (error != 0) {
751			device_printf(sc->sc_dev,
752			    "could not load rx buf DMA map");
753			goto fail;
754		}
755
756		rxd->sdp0 = htole32(physaddr);
757		rxd->sdl0 = htole16(MCLBYTES);
758	}
759
760	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
761
762	return 0;
763
764fail:	rt2860_free_rx_ring(sc, ring);
765	return error;
766}
767
768void
769rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
770{
771	int i;
772
773	for (i = 0; i < RT2860_RX_RING_COUNT; i++)
774		ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE);
775
776	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
777
778	ring->cur = 0;
779}
780
781void
782rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
783{
784	int i;
785
786	if (ring->rxd != NULL) {
787		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
788		    BUS_DMASYNC_POSTWRITE);
789		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
790		bus_dmamem_free(ring->desc_dmat, ring->rxd, ring->desc_map);
791	}
792	if (ring->desc_dmat != NULL)
793		bus_dma_tag_destroy(ring->desc_dmat);
794
795	for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
796		struct rt2860_rx_data *data = &ring->data[i];
797
798		if (data->m != NULL) {
799			bus_dmamap_sync(ring->data_dmat, data->map,
800			    BUS_DMASYNC_POSTREAD);
801			bus_dmamap_unload(ring->data_dmat, data->map);
802			m_freem(data->m);
803		}
804		if (data->map != NULL)
805			bus_dmamap_destroy(ring->data_dmat, data->map);
806	}
807	if (ring->data_dmat != NULL)
808		bus_dma_tag_destroy(ring->data_dmat);
809}
810
811static void
812rt2860_updatestats(struct rt2860_softc *sc)
813{
814	struct ieee80211com *ic = &sc->sc_ic;
815
816	/*
817	 * In IBSS or HostAP modes (when the hardware sends beacons), the
818	 * MAC can run into a livelock and start sending CTS-to-self frames
819	 * like crazy if protection is enabled.  Fortunately, we can detect
820	 * when such a situation occurs and reset the MAC.
821	 */
822	if (ic->ic_curmode != IEEE80211_M_STA) {
823		/* check if we're in a livelock situation.. */
824		uint32_t tmp = RAL_READ(sc, RT2860_DEBUG);
825		if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
826			/* ..and reset MAC/BBP for a while.. */
827			DPRINTF(("CTS-to-self livelock detected\n"));
828			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
829			RAL_BARRIER_WRITE(sc);
830			DELAY(1);
831			RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
832			    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
833		}
834	}
835}
836
837static void
838rt2860_newassoc(struct ieee80211_node *ni, int isnew)
839{
840	struct ieee80211com *ic = ni->ni_ic;
841	struct rt2860_softc *sc = ic->ic_softc;
842	uint8_t wcid;
843
844	wcid = IEEE80211_AID(ni->ni_associd);
845	if (isnew && ni->ni_associd != 0) {
846		sc->wcid2ni[wcid] = ni;
847
848		/* init WCID table entry */
849		RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),
850		    ni->ni_macaddr, IEEE80211_ADDR_LEN);
851	}
852	DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
853	    isnew, ether_sprintf(ni->ni_macaddr), wcid));
854}
855
856static void
857rt2860_node_free(struct ieee80211_node *ni)
858{
859	struct ieee80211com *ic = ni->ni_ic;
860	struct rt2860_softc *sc = ic->ic_softc;
861	uint8_t wcid;
862
863	if (ni->ni_associd != 0) {
864		wcid = IEEE80211_AID(ni->ni_associd);
865
866		/* clear Rx WCID search table entry */
867		RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(wcid), 0, 2);
868	}
869	sc->sc_node_free(ni);
870}
871
872#ifdef IEEE80211_HT
873static int
874rt2860_ampdu_rx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
875    uint8_t tid)
876{
877	struct rt2860_softc *sc = ic->ic_softc;
878	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
879	uint32_t tmp;
880
881	/* update BA session mask */
882	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
883	tmp |= (1 << tid) << 16;
884	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
885	return 0;
886}
887
888static void
889rt2860_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
890    uint8_t tid)
891{
892	struct rt2860_softc *sc = ic->ic_softc;
893	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
894	uint32_t tmp;
895
896	/* update BA session mask */
897	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
898	tmp &= ~((1 << tid) << 16);
899	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
900}
901#endif
902
903static int
904rt2860_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
905{
906	struct rt2860_vap *rvp = RT2860_VAP(vap);
907	struct ieee80211com *ic = vap->iv_ic;
908	struct rt2860_softc *sc = ic->ic_softc;
909	uint32_t tmp;
910	int error;
911
912	if (vap->iv_state == IEEE80211_S_RUN) {
913		/* turn link LED off */
914		rt2860_set_leds(sc, RT2860_LED_RADIO);
915	}
916
917	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
918		/* abort TSF synchronization */
919		tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
920		RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
921		    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
922		    RT2860_TBTT_TIMER_EN));
923	}
924
925	rt2860_set_gp_timer(sc, 0);
926
927	error = rvp->ral_newstate(vap, nstate, arg);
928	if (error != 0)
929		return (error);
930
931	if (nstate == IEEE80211_S_RUN) {
932		struct ieee80211_node *ni = vap->iv_bss;
933
934		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
935			rt2860_enable_mrr(sc);
936			rt2860_set_txpreamble(sc);
937			rt2860_set_basicrates(sc, &ni->ni_rates);
938			rt2860_set_bssid(sc, ni->ni_bssid);
939		}
940
941		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
942		    vap->iv_opmode == IEEE80211_M_IBSS ||
943		    vap->iv_opmode == IEEE80211_M_MBSS) {
944			error = rt2860_setup_beacon(sc, vap);
945			if (error != 0)
946				return error;
947		}
948
949		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
950			rt2860_enable_tsf_sync(sc);
951			rt2860_set_gp_timer(sc, 500);
952		}
953
954		/* turn link LED on */
955		rt2860_set_leds(sc, RT2860_LED_RADIO |
956		    (IEEE80211_IS_CHAN_2GHZ(ni->ni_chan) ?
957		     RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
958	}
959	return error;
960}
961
962/* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
963static uint16_t
964rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
965{
966	uint32_t tmp;
967	uint16_t reg;
968	int ntries;
969
970	addr *= 2;
971	/*-
972	 * Read one 16-byte block into registers EFUSE_DATA[0-3]:
973	 * DATA0: F E D C
974	 * DATA1: B A 9 8
975	 * DATA2: 7 6 5 4
976	 * DATA3: 3 2 1 0
977	 */
978	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
979	tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
980	tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
981	RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp);
982	for (ntries = 0; ntries < 500; ntries++) {
983		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
984		if (!(tmp & RT3070_EFSROM_KICK))
985			break;
986		DELAY(2);
987	}
988	if (ntries == 500)
989		return 0xffff;
990
991	if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK)
992		return 0xffff;	/* address not found */
993
994	/* determine to which 32-bit register our 16-bit word belongs */
995	reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
996	tmp = RAL_READ(sc, reg);
997
998	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
999}
1000
1001/*
1002 * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
1003 * 93C66 or 93C86).
1004 */
1005static uint16_t
1006rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
1007{
1008	uint32_t tmp;
1009	uint16_t val;
1010	int n;
1011
1012	/* clock C once before the first command */
1013	RT2860_EEPROM_CTL(sc, 0);
1014
1015	RT2860_EEPROM_CTL(sc, RT2860_S);
1016	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1017	RT2860_EEPROM_CTL(sc, RT2860_S);
1018
1019	/* write start bit (1) */
1020	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1021	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1022
1023	/* write READ opcode (10) */
1024	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
1025	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
1026	RT2860_EEPROM_CTL(sc, RT2860_S);
1027	RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1028
1029	/* write address (A5-A0 or A7-A0) */
1030	n = ((RAL_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
1031	for (; n >= 0; n--) {
1032		RT2860_EEPROM_CTL(sc, RT2860_S |
1033		    (((addr >> n) & 1) << RT2860_SHIFT_D));
1034		RT2860_EEPROM_CTL(sc, RT2860_S |
1035		    (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
1036	}
1037
1038	RT2860_EEPROM_CTL(sc, RT2860_S);
1039
1040	/* read data Q15-Q0 */
1041	val = 0;
1042	for (n = 15; n >= 0; n--) {
1043		RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
1044		tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
1045		val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
1046		RT2860_EEPROM_CTL(sc, RT2860_S);
1047	}
1048
1049	RT2860_EEPROM_CTL(sc, 0);
1050
1051	/* clear Chip Select and clock C */
1052	RT2860_EEPROM_CTL(sc, RT2860_S);
1053	RT2860_EEPROM_CTL(sc, 0);
1054	RT2860_EEPROM_CTL(sc, RT2860_C);
1055
1056	return val;
1057}
1058
1059static __inline uint16_t
1060rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
1061{
1062	/* either eFUSE ROM or EEPROM */
1063	return sc->sc_srom_read(sc, addr);
1064}
1065
1066static void
1067rt2860_intr_coherent(struct rt2860_softc *sc)
1068{
1069	uint32_t tmp;
1070
1071	/* DMA finds data coherent event when checking the DDONE bit */
1072
1073	DPRINTF(("Tx/Rx Coherent interrupt\n"));
1074
1075	/* restart DMA engine */
1076	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
1077	tmp &= ~(RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
1078	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
1079
1080	(void)rt2860_txrx_enable(sc);
1081}
1082
1083static void
1084rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1085{
1086	struct ieee80211_ratectl_tx_status *txs = &sc->sc_txs;
1087	struct ieee80211_node *ni;
1088	uint32_t stat;
1089	uint8_t wcid, mcs, pid;
1090
1091	/* drain Tx status FIFO (maxsize = 16) */
1092	txs->flags = IEEE80211_RATECTL_STATUS_LONG_RETRY;
1093	while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
1094		DPRINTFN(4, ("tx stat 0x%08x\n", stat));
1095
1096		wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
1097		if (wcid == 0xFF)
1098			continue;
1099
1100		ni = sc->wcid2ni[wcid];
1101
1102		/* if no ACK was requested, no feedback is available */
1103		if (!(stat & RT2860_TXQ_ACKREQ) || ni == NULL)
1104			continue;
1105
1106		/* update per-STA AMRR stats */
1107		if (stat & RT2860_TXQ_OK) {
1108			/*
1109			 * Check if there were retries, ie if the Tx success
1110			 * rate is different from the requested rate.  Note
1111			 * that it works only because we do not allow rate
1112			 * fallback from OFDM to CCK.
1113			 */
1114			mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
1115			pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
1116			if (mcs + 1 != pid)
1117				txs->long_retries = 1;
1118			else
1119				txs->long_retries = 0;
1120			txs->status = IEEE80211_RATECTL_TX_SUCCESS;
1121			ieee80211_ratectl_tx_complete(ni, txs);
1122		} else {
1123			txs->status = IEEE80211_RATECTL_TX_FAIL_UNSPECIFIED;
1124			txs->long_retries = 1;	/* XXX */
1125			ieee80211_ratectl_tx_complete(ni, txs);
1126			if_inc_counter(ni->ni_vap->iv_ifp,
1127			    IFCOUNTER_OERRORS, 1);
1128		}
1129	}
1130}
1131
1132static void
1133rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1134{
1135	struct rt2860_tx_ring *ring = &sc->txq[qid];
1136	uint32_t hw;
1137
1138	rt2860_drain_stats_fifo(sc);
1139
1140	hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid));
1141	while (ring->next != hw) {
1142		struct rt2860_tx_data *data = ring->data[ring->next];
1143
1144		if (data != NULL) {
1145			bus_dmamap_sync(sc->txwi_dmat, data->map,
1146			    BUS_DMASYNC_POSTWRITE);
1147			bus_dmamap_unload(sc->txwi_dmat, data->map);
1148			ieee80211_tx_complete(data->ni, data->m, 0);
1149			data->ni = NULL;
1150			data->m = NULL;
1151			SLIST_INSERT_HEAD(&sc->data_pool, data, next);
1152			ring->data[ring->next] = NULL;
1153		}
1154		ring->queued--;
1155		ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
1156	}
1157
1158	sc->sc_tx_timer = 0;
1159	if (ring->queued < RT2860_TX_RING_COUNT)
1160		sc->qfullmsk &= ~(1 << qid);
1161	rt2860_start(sc);
1162}
1163
1164/*
1165 * Return the Rx chain with the highest RSSI for a given frame.
1166 */
1167static __inline uint8_t
1168rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
1169{
1170	uint8_t rxchain = 0;
1171
1172	if (sc->nrxchains > 1) {
1173		if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1174			rxchain = 1;
1175		if (sc->nrxchains > 2)
1176			if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1177				rxchain = 2;
1178	}
1179	return rxchain;
1180}
1181
1182static void
1183rt2860_rx_intr(struct rt2860_softc *sc)
1184{
1185	struct rt2860_rx_radiotap_header *tap;
1186	struct ieee80211com *ic = &sc->sc_ic;
1187	struct ieee80211_frame *wh;
1188	struct ieee80211_node *ni;
1189	struct mbuf *m, *m1;
1190	bus_addr_t physaddr;
1191	uint32_t hw;
1192	uint16_t phy;
1193	uint8_t ant;
1194	int8_t rssi, nf;
1195	int error;
1196
1197	hw = RAL_READ(sc, RT2860_FS_DRX_IDX) & 0xfff;
1198	while (sc->rxq.cur != hw) {
1199		struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1200		struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1201		struct rt2860_rxwi *rxwi;
1202
1203		bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1204		    BUS_DMASYNC_POSTREAD);
1205
1206		if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))) {
1207			DPRINTF(("RXD DDONE bit not set!\n"));
1208			break;	/* should not happen */
1209		}
1210
1211		if (__predict_false(rxd->flags &
1212		    htole32(RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
1213			counter_u64_add(ic->ic_ierrors, 1);
1214			goto skip;
1215		}
1216
1217#ifdef HW_CRYPTO
1218		if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))) {
1219			/* report MIC failures to net80211 for TKIP */
1220			ic->ic_stats.is_rx_locmicfail++;
1221			ieee80211_michael_mic_failure(ic, 0/* XXX */);
1222			counter_u64_add(ic->ic_ierrors, 1);
1223			goto skip;
1224		}
1225#endif
1226
1227		m1 = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
1228		if (__predict_false(m1 == NULL)) {
1229			counter_u64_add(ic->ic_ierrors, 1);
1230			goto skip;
1231		}
1232
1233		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1234		    BUS_DMASYNC_POSTREAD);
1235		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1236
1237		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1238		    mtod(m1, void *), MCLBYTES, rt2860_dma_map_addr,
1239		    &physaddr, 0);
1240		if (__predict_false(error != 0)) {
1241			m_freem(m1);
1242
1243			/* try to reload the old mbuf */
1244			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1245			    mtod(data->m, void *), MCLBYTES,
1246			    rt2860_dma_map_addr, &physaddr, 0);
1247			if (__predict_false(error != 0)) {
1248				panic("%s: could not load old rx mbuf",
1249				    device_get_name(sc->sc_dev));
1250			}
1251			/* physical address may have changed */
1252			rxd->sdp0 = htole32(physaddr);
1253			counter_u64_add(ic->ic_ierrors, 1);
1254			goto skip;
1255		}
1256
1257		/*
1258		 * New mbuf successfully loaded, update Rx ring and continue
1259		 * processing.
1260		 */
1261		m = data->m;
1262		data->m = m1;
1263		rxd->sdp0 = htole32(physaddr);
1264
1265		rxwi = mtod(m, struct rt2860_rxwi *);
1266
1267		/* finalize mbuf */
1268		m->m_data = (caddr_t)(rxwi + 1);
1269		m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;
1270
1271		wh = mtod(m, struct ieee80211_frame *);
1272#ifdef HW_CRYPTO
1273		if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1274			/* frame is decrypted by hardware */
1275			wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
1276		}
1277#endif
1278
1279		/* HW may insert 2 padding bytes after 802.11 header */
1280		if (rxd->flags & htole32(RT2860_RX_L2PAD)) {
1281			u_int hdrlen = ieee80211_hdrsize(wh);
1282			ovbcopy(wh, (caddr_t)wh + 2, hdrlen);
1283			m->m_data += 2;
1284			wh = mtod(m, struct ieee80211_frame *);
1285		}
1286
1287		ant = rt2860_maxrssi_chain(sc, rxwi);
1288		rssi = rt2860_rssi2dbm(sc, rxwi->rssi[ant], ant);
1289		nf = RT2860_NOISE_FLOOR;
1290
1291		if (ieee80211_radiotap_active(ic)) {
1292			tap = &sc->sc_rxtap;
1293			tap->wr_flags = 0;
1294			tap->wr_antenna = ant;
1295			tap->wr_antsignal = nf + rssi;
1296			tap->wr_antnoise = nf;
1297			/* in case it can't be found below */
1298			tap->wr_rate = 2;
1299			phy = le16toh(rxwi->phy);
1300			switch (phy & RT2860_PHY_MODE) {
1301			case RT2860_PHY_CCK:
1302				switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
1303				case 0:	tap->wr_rate =   2; break;
1304				case 1:	tap->wr_rate =   4; break;
1305				case 2:	tap->wr_rate =  11; break;
1306				case 3:	tap->wr_rate =  22; break;
1307				}
1308				if (phy & RT2860_PHY_SHPRE)
1309					tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1310				break;
1311			case RT2860_PHY_OFDM:
1312				switch (phy & RT2860_PHY_MCS) {
1313				case 0:	tap->wr_rate =  12; break;
1314				case 1:	tap->wr_rate =  18; break;
1315				case 2:	tap->wr_rate =  24; break;
1316				case 3:	tap->wr_rate =  36; break;
1317				case 4:	tap->wr_rate =  48; break;
1318				case 5:	tap->wr_rate =  72; break;
1319				case 6:	tap->wr_rate =  96; break;
1320				case 7:	tap->wr_rate = 108; break;
1321				}
1322				break;
1323			}
1324		}
1325
1326		RAL_UNLOCK(sc);
1327		wh = mtod(m, struct ieee80211_frame *);
1328
1329		/* send the frame to the 802.11 layer */
1330		ni = ieee80211_find_rxnode(ic,
1331		    (struct ieee80211_frame_min *)wh);
1332		if (ni != NULL) {
1333			(void)ieee80211_input(ni, m, rssi - nf, nf);
1334			ieee80211_free_node(ni);
1335		} else
1336			(void)ieee80211_input_all(ic, m, rssi - nf, nf);
1337
1338		RAL_LOCK(sc);
1339
1340skip:		rxd->sdl0 &= ~htole16(RT2860_RX_DDONE);
1341
1342		bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1343		    BUS_DMASYNC_PREWRITE);
1344
1345		sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
1346	}
1347
1348	/* tell HW what we have processed */
1349	RAL_WRITE(sc, RT2860_RX_CALC_IDX,
1350	    (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
1351}
1352
1353static void
1354rt2860_tbtt_intr(struct rt2860_softc *sc)
1355{
1356#if 0
1357	struct ieee80211com *ic = &sc->sc_ic;
1358
1359#ifndef IEEE80211_STA_ONLY
1360	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1361		/* one less beacon until next DTIM */
1362		if (ic->ic_dtim_count == 0)
1363			ic->ic_dtim_count = ic->ic_dtim_period - 1;
1364		else
1365			ic->ic_dtim_count--;
1366
1367		/* update dynamic parts of beacon */
1368		rt2860_setup_beacon(sc);
1369
1370		/* flush buffered multicast frames */
1371		if (ic->ic_dtim_count == 0)
1372			ieee80211_notify_dtim(ic);
1373	}
1374#endif
1375	/* check if protection mode has changed */
1376	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
1377		rt2860_updateprot(sc);
1378		sc->sc_ic_flags = ic->ic_flags;
1379	}
1380#endif
1381}
1382
1383static void
1384rt2860_gp_intr(struct rt2860_softc *sc)
1385{
1386	struct ieee80211com *ic = &sc->sc_ic;
1387	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
1388
1389	DPRINTFN(2, ("GP timeout state=%d\n", vap->iv_state));
1390
1391	if (vap->iv_state == IEEE80211_S_RUN)
1392		rt2860_updatestats(sc);
1393}
1394
1395void
1396rt2860_intr(void *arg)
1397{
1398	struct rt2860_softc *sc = arg;
1399	uint32_t r;
1400
1401	RAL_LOCK(sc);
1402
1403#ifndef __HAIKU__
1404	r = RAL_READ(sc, RT2860_INT_STATUS);
1405	if (__predict_false(r == 0xffffffff)) {
1406		RAL_UNLOCK(sc);
1407		return;	/* device likely went away */
1408	}
1409	if (r == 0) {
1410		RAL_UNLOCK(sc);
1411		return;	/* not for us */
1412	}
1413#else
1414	r = atomic_get((int32 *)&sc->sc_intr_status);
1415#endif
1416
1417	/* acknowledge interrupts */
1418	RAL_WRITE(sc, RT2860_INT_STATUS, r);
1419
1420	if (r & RT2860_TX_RX_COHERENT)
1421		rt2860_intr_coherent(sc);
1422
1423	if (r & RT2860_MAC_INT_2)	/* TX status */
1424		rt2860_drain_stats_fifo(sc);
1425
1426	if (r & RT2860_TX_DONE_INT5)
1427		rt2860_tx_intr(sc, 5);
1428
1429	if (r & RT2860_RX_DONE_INT)
1430		rt2860_rx_intr(sc);
1431
1432	if (r & RT2860_TX_DONE_INT4)
1433		rt2860_tx_intr(sc, 4);
1434
1435	if (r & RT2860_TX_DONE_INT3)
1436		rt2860_tx_intr(sc, 3);
1437
1438	if (r & RT2860_TX_DONE_INT2)
1439		rt2860_tx_intr(sc, 2);
1440
1441	if (r & RT2860_TX_DONE_INT1)
1442		rt2860_tx_intr(sc, 1);
1443
1444	if (r & RT2860_TX_DONE_INT0)
1445		rt2860_tx_intr(sc, 0);
1446
1447	if (r & RT2860_MAC_INT_0)	/* TBTT */
1448		rt2860_tbtt_intr(sc);
1449
1450	if (r & RT2860_MAC_INT_3)	/* Auto wakeup */
1451		/* TBD wakeup */;
1452
1453	if (r & RT2860_MAC_INT_4)	/* GP timer */
1454		rt2860_gp_intr(sc);
1455
1456	RAL_UNLOCK(sc);
1457}
1458
1459static int
1460rt2860_tx(struct rt2860_softc *sc, struct mbuf *m, struct ieee80211_node *ni)
1461{
1462	struct ieee80211com *ic = &sc->sc_ic;
1463	struct ieee80211vap *vap = ni->ni_vap;
1464	struct rt2860_tx_ring *ring;
1465	struct rt2860_tx_data *data;
1466	struct rt2860_txd *txd;
1467	struct rt2860_txwi *txwi;
1468	struct ieee80211_frame *wh;
1469	const struct ieee80211_txparam *tp = ni->ni_txparms;
1470	struct ieee80211_key *k;
1471	struct mbuf *m1;
1472	bus_dma_segment_t segs[RT2860_MAX_SCATTER];
1473	bus_dma_segment_t *seg;
1474	u_int hdrlen;
1475	uint16_t qos, dur;
1476	uint8_t type, qsel, mcs, pid, tid, qid;
1477	int i, nsegs, ntxds, pad, rate, ridx, error;
1478
1479	/* the data pool contains at least one element, pick the first */
1480	data = SLIST_FIRST(&sc->data_pool);
1481
1482	wh = mtod(m, struct ieee80211_frame *);
1483
1484	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1485		k = ieee80211_crypto_encap(ni, m);
1486		if (k == NULL) {
1487			m_freem(m);
1488			return ENOBUFS;
1489		}
1490
1491		/* packet header may have moved, reset our local pointer */
1492		wh = mtod(m, struct ieee80211_frame *);
1493	}
1494
1495	hdrlen = ieee80211_anyhdrsize(wh);
1496	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1497
1498	if (m->m_flags & M_EAPOL) {
1499		rate = tp->mgmtrate;
1500	} else if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1501		rate = tp->mcastrate;
1502	} else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1503		rate = tp->ucastrate;
1504	} else {
1505		(void) ieee80211_ratectl_rate(ni, NULL, 0);
1506		rate = ni->ni_txrate;
1507	}
1508	rate &= IEEE80211_RATE_VAL;
1509
1510	qid = M_WME_GETAC(m);
1511	if (IEEE80211_QOS_HAS_SEQ(wh)) {
1512		qos = ((const struct ieee80211_qosframe *)wh)->i_qos[0];
1513		tid = qos & IEEE80211_QOS_TID;
1514	} else {
1515		qos = 0;
1516		tid = 0;
1517	}
1518	ring = &sc->txq[qid];
1519	ridx = ieee80211_legacy_rate_lookup(ic->ic_rt, rate);
1520
1521	/* get MCS code from rate index */
1522	mcs = rt2860_rates[ridx].mcs;
1523
1524	/* setup TX Wireless Information */
1525	txwi = data->txwi;
1526	txwi->flags = 0;
1527	/* let HW generate seq numbers for non-QoS frames */
1528	txwi->xflags = qos ? 0 : RT2860_TX_NSEQ;
1529	if (type == IEEE80211_FC0_TYPE_DATA)
1530		txwi->wcid = IEEE80211_AID(ni->ni_associd);
1531	else
1532		txwi->wcid = 0xff;
1533	txwi->len = htole16(m->m_pkthdr.len);
1534	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1535		txwi->phy = htole16(RT2860_PHY_CCK);
1536		if (ridx != RT2860_RIDX_CCK1 &&
1537		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1538			mcs |= RT2860_PHY_SHPRE;
1539	} else
1540		txwi->phy = htole16(RT2860_PHY_OFDM);
1541	txwi->phy |= htole16(mcs);
1542
1543	/*
1544	 * We store the MCS code into the driver-private PacketID field.
1545	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1546	 * that we know at which initial rate the frame was transmitted.
1547	 * We add 1 to the MCS code because setting the PacketID field to
1548	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1549	 */
1550	pid = (mcs + 1) & 0xf;
1551	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1552
1553	/* check if RTS/CTS or CTS-to-self protection is required */
1554	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1555	    (m->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold ||
1556	     ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1557	      rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
1558		txwi->txop = RT2860_TX_TXOP_HT;
1559	else
1560		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1561
1562	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1563	    (!qos || (qos & IEEE80211_QOS_ACKPOLICY) !=
1564	     IEEE80211_QOS_ACKPOLICY_NOACK)) {
1565		txwi->xflags |= RT2860_TX_ACK;
1566
1567		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1568			dur = rt2860_rates[ridx].sp_ack_dur;
1569		else
1570			dur = rt2860_rates[ridx].lp_ack_dur;
1571		*(uint16_t *)wh->i_dur = htole16(dur);
1572	}
1573	/* ask MAC to insert timestamp into probe responses */
1574	if ((wh->i_fc[0] &
1575	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1576	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1577	    /* NOTE: beacons do not pass through tx_data() */
1578		txwi->flags |= RT2860_TX_TS;
1579
1580	if (ieee80211_radiotap_active_vap(vap)) {
1581		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1582
1583		tap->wt_flags = 0;
1584		tap->wt_rate = rate;
1585		if (mcs & RT2860_PHY_SHPRE)
1586			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1587
1588		ieee80211_radiotap_tx(vap, m);
1589	}
1590
1591	pad = (hdrlen + 3) & ~3;
1592
1593	/* copy and trim 802.11 header */
1594	memcpy(txwi + 1, wh, hdrlen);
1595	m_adj(m, hdrlen);
1596
1597	error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m, segs,
1598	    &nsegs, 0);
1599	if (__predict_false(error != 0 && error != EFBIG)) {
1600		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1601		    error);
1602		m_freem(m);
1603		return error;
1604	}
1605	if (__predict_true(error == 0)) {
1606		/* determine how many TXDs are required */
1607		ntxds = 1 + (nsegs / 2);
1608
1609		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1610			/* not enough free TXDs, force mbuf defrag */
1611			bus_dmamap_unload(sc->txwi_dmat, data->map);
1612			error = EFBIG;
1613		}
1614	}
1615	if (__predict_false(error != 0)) {
1616		m1 = m_defrag(m, M_NOWAIT);
1617		if (m1 == NULL) {
1618			device_printf(sc->sc_dev,
1619			    "could not defragment mbuf\n");
1620			m_freem(m);
1621			return ENOBUFS;
1622		}
1623		m = m1;
1624
1625		error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m,
1626		    segs, &nsegs, 0);
1627		if (__predict_false(error != 0)) {
1628			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1629			    error);
1630			m_freem(m);
1631			return error;
1632		}
1633
1634		/* determine how many TXDs are now required */
1635		ntxds = 1 + (nsegs / 2);
1636
1637		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1638			/* this is a hopeless case, drop the mbuf! */
1639			bus_dmamap_unload(sc->txwi_dmat, data->map);
1640			m_freem(m);
1641			return ENOBUFS;
1642		}
1643	}
1644
1645	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1646
1647	/* first segment is TXWI + 802.11 header */
1648	txd = &ring->txd[ring->cur];
1649	txd->sdp0 = htole32(data->paddr);
1650	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
1651	txd->flags = qsel;
1652
1653	/* setup payload segments */
1654	seg = &segs[0];
1655	for (i = nsegs; i >= 2; i -= 2) {
1656		txd->sdp1 = htole32(seg->ds_addr);
1657		txd->sdl1 = htole16(seg->ds_len);
1658		seg++;
1659		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1660		/* grab a new Tx descriptor */
1661		txd = &ring->txd[ring->cur];
1662		txd->sdp0 = htole32(seg->ds_addr);
1663		txd->sdl0 = htole16(seg->ds_len);
1664		txd->flags = qsel;
1665		seg++;
1666	}
1667	/* finalize last segment */
1668	if (i > 0) {
1669		txd->sdp1 = htole32(seg->ds_addr);
1670		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1671	} else {
1672		txd->sdl0 |= htole16(RT2860_TX_LS0);
1673		txd->sdl1 = 0;
1674	}
1675
1676	/* remove from the free pool and link it into the SW Tx slot */
1677	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1678	data->m = m;
1679	data->ni = ni;
1680	ring->data[ring->cur] = data;
1681
1682	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
1683	bus_dmamap_sync(sc->txwi_dmat, data->map, BUS_DMASYNC_PREWRITE);
1684	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
1685
1686	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1687	    qid, txwi->wcid, nsegs, ridx));
1688
1689	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1690	ring->queued += ntxds;
1691	if (ring->queued >= RT2860_TX_RING_COUNT)
1692		sc->qfullmsk |= 1 << qid;
1693
1694	/* kick Tx */
1695	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1696
1697	return 0;
1698}
1699
1700static int
1701rt2860_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1702    const struct ieee80211_bpf_params *params)
1703{
1704	struct ieee80211com *ic = ni->ni_ic;
1705	struct rt2860_softc *sc = ic->ic_softc;
1706	int error;
1707
1708	RAL_LOCK(sc);
1709
1710	/* prevent management frames from being sent if we're not ready */
1711	if (!(sc->sc_flags & RT2860_RUNNING)) {
1712		RAL_UNLOCK(sc);
1713		m_freem(m);
1714		return ENETDOWN;
1715	}
1716	if (params == NULL) {
1717		/*
1718		 * Legacy path; interpret frame contents to decide
1719		 * precisely how to send the frame.
1720		 */
1721		error = rt2860_tx(sc, m, ni);
1722	} else {
1723		/*
1724		 * Caller supplied explicit parameters to use in
1725		 * sending the frame.
1726		 */
1727		error = rt2860_tx_raw(sc, m, ni, params);
1728	}
1729	sc->sc_tx_timer = 5;
1730	RAL_UNLOCK(sc);
1731	return error;
1732}
1733
1734static int
1735rt2860_tx_raw(struct rt2860_softc *sc, struct mbuf *m,
1736    struct ieee80211_node *ni, const struct ieee80211_bpf_params *params)
1737{
1738	struct ieee80211com *ic = &sc->sc_ic;
1739	struct ieee80211vap *vap = ni->ni_vap;
1740	struct rt2860_tx_ring *ring;
1741	struct rt2860_tx_data *data;
1742	struct rt2860_txd *txd;
1743	struct rt2860_txwi *txwi;
1744	struct ieee80211_frame *wh;
1745	struct mbuf *m1;
1746	bus_dma_segment_t segs[RT2860_MAX_SCATTER];
1747	bus_dma_segment_t *seg;
1748	u_int hdrlen;
1749	uint16_t dur;
1750	uint8_t type, qsel, mcs, pid, tid, qid;
1751	int i, nsegs, ntxds, pad, rate, ridx, error;
1752
1753	/* the data pool contains at least one element, pick the first */
1754	data = SLIST_FIRST(&sc->data_pool);
1755
1756	wh = mtod(m, struct ieee80211_frame *);
1757	hdrlen = ieee80211_hdrsize(wh);
1758	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
1759
1760	/* Choose a TX rate index. */
1761	rate = params->ibp_rate0;
1762	ridx = ieee80211_legacy_rate_lookup(ic->ic_rt,
1763	    rate & IEEE80211_RATE_VAL);
1764	if (ridx == (uint8_t)-1) {
1765		/* XXX fall back to mcast/mgmt rate? */
1766		m_freem(m);
1767		return EINVAL;
1768	}
1769
1770	qid = params->ibp_pri & 3;
1771	tid = 0;
1772	ring = &sc->txq[qid];
1773
1774	/* get MCS code from rate index */
1775	mcs = rt2860_rates[ridx].mcs;
1776
1777	/* setup TX Wireless Information */
1778	txwi = data->txwi;
1779	txwi->flags = 0;
1780	/* let HW generate seq numbers for non-QoS frames */
1781	txwi->xflags = params->ibp_pri & 3 ? 0 : RT2860_TX_NSEQ;
1782	txwi->wcid = 0xff;
1783	txwi->len = htole16(m->m_pkthdr.len);
1784	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1785		txwi->phy = htole16(RT2860_PHY_CCK);
1786		if (ridx != RT2860_RIDX_CCK1 &&
1787		    (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1788			mcs |= RT2860_PHY_SHPRE;
1789	} else
1790		txwi->phy = htole16(RT2860_PHY_OFDM);
1791	txwi->phy |= htole16(mcs);
1792
1793	/*
1794	 * We store the MCS code into the driver-private PacketID field.
1795	 * The PacketID is latched into TX_STAT_FIFO when Tx completes so
1796	 * that we know at which initial rate the frame was transmitted.
1797	 * We add 1 to the MCS code because setting the PacketID field to
1798	 * 0 means that we don't want feedback in TX_STAT_FIFO.
1799	 */
1800	pid = (mcs + 1) & 0xf;
1801	txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
1802
1803	/* check if RTS/CTS or CTS-to-self protection is required */
1804	if (params->ibp_flags & IEEE80211_BPF_RTS ||
1805	    params->ibp_flags & IEEE80211_BPF_CTS)
1806		txwi->txop = RT2860_TX_TXOP_HT;
1807	else
1808		txwi->txop = RT2860_TX_TXOP_BACKOFF;
1809	if ((params->ibp_flags & IEEE80211_BPF_NOACK) == 0) {
1810		txwi->xflags |= RT2860_TX_ACK;
1811
1812		if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1813			dur = rt2860_rates[ridx].sp_ack_dur;
1814		else
1815			dur = rt2860_rates[ridx].lp_ack_dur;
1816		*(uint16_t *)wh->i_dur = htole16(dur);
1817	}
1818	/* ask MAC to insert timestamp into probe responses */
1819	if ((wh->i_fc[0] &
1820	     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1821	     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1822	    /* NOTE: beacons do not pass through tx_data() */
1823		txwi->flags |= RT2860_TX_TS;
1824
1825	if (ieee80211_radiotap_active_vap(vap)) {
1826		struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
1827
1828		tap->wt_flags = 0;
1829		tap->wt_rate = rate;
1830		if (mcs & RT2860_PHY_SHPRE)
1831			tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
1832
1833		ieee80211_radiotap_tx(vap, m);
1834	}
1835
1836	pad = (hdrlen + 3) & ~3;
1837
1838	/* copy and trim 802.11 header */
1839	memcpy(txwi + 1, wh, hdrlen);
1840	m_adj(m, hdrlen);
1841
1842	error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m, segs,
1843	    &nsegs, 0);
1844	if (__predict_false(error != 0 && error != EFBIG)) {
1845		device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1846		    error);
1847		m_freem(m);
1848		return error;
1849	}
1850	if (__predict_true(error == 0)) {
1851		/* determine how many TXDs are required */
1852		ntxds = 1 + (nsegs / 2);
1853
1854		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1855			/* not enough free TXDs, force mbuf defrag */
1856			bus_dmamap_unload(sc->txwi_dmat, data->map);
1857			error = EFBIG;
1858		}
1859	}
1860	if (__predict_false(error != 0)) {
1861		m1 = m_defrag(m, M_NOWAIT);
1862		if (m1 == NULL) {
1863			device_printf(sc->sc_dev,
1864			    "could not defragment mbuf\n");
1865			m_freem(m);
1866			return ENOBUFS;
1867		}
1868		m = m1;
1869
1870		error = bus_dmamap_load_mbuf_sg(sc->txwi_dmat, data->map, m,
1871		    segs, &nsegs, 0);
1872		if (__predict_false(error != 0)) {
1873			device_printf(sc->sc_dev, "can't map mbuf (error %d)\n",
1874			    error);
1875			m_freem(m);
1876			return error;
1877		}
1878
1879		/* determine how many TXDs are now required */
1880		ntxds = 1 + (nsegs / 2);
1881
1882		if (ring->queued + ntxds >= RT2860_TX_RING_COUNT) {
1883			/* this is a hopeless case, drop the mbuf! */
1884			bus_dmamap_unload(sc->txwi_dmat, data->map);
1885			m_freem(m);
1886			return ENOBUFS;
1887		}
1888	}
1889
1890	qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
1891
1892	/* first segment is TXWI + 802.11 header */
1893	txd = &ring->txd[ring->cur];
1894	txd->sdp0 = htole32(data->paddr);
1895	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + pad);
1896	txd->flags = qsel;
1897
1898	/* setup payload segments */
1899	seg = &segs[0];
1900	for (i = nsegs; i >= 2; i -= 2) {
1901		txd->sdp1 = htole32(seg->ds_addr);
1902		txd->sdl1 = htole16(seg->ds_len);
1903		seg++;
1904		ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1905		/* grab a new Tx descriptor */
1906		txd = &ring->txd[ring->cur];
1907		txd->sdp0 = htole32(seg->ds_addr);
1908		txd->sdl0 = htole16(seg->ds_len);
1909		txd->flags = qsel;
1910		seg++;
1911	}
1912	/* finalize last segment */
1913	if (i > 0) {
1914		txd->sdp1 = htole32(seg->ds_addr);
1915		txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
1916	} else {
1917		txd->sdl0 |= htole16(RT2860_TX_LS0);
1918		txd->sdl1 = 0;
1919	}
1920
1921	/* remove from the free pool and link it into the SW Tx slot */
1922	SLIST_REMOVE_HEAD(&sc->data_pool, next);
1923	data->m = m;
1924	data->ni = ni;
1925	ring->data[ring->cur] = data;
1926
1927	bus_dmamap_sync(sc->txwi_dmat, sc->txwi_map, BUS_DMASYNC_PREWRITE);
1928	bus_dmamap_sync(sc->txwi_dmat, data->map, BUS_DMASYNC_PREWRITE);
1929	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
1930
1931	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1932	    qid, txwi->wcid, nsegs, ridx));
1933
1934	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
1935	ring->queued += ntxds;
1936	if (ring->queued >= RT2860_TX_RING_COUNT)
1937		sc->qfullmsk |= 1 << qid;
1938
1939	/* kick Tx */
1940	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
1941
1942	return 0;
1943}
1944
1945static int
1946rt2860_transmit(struct ieee80211com *ic, struct mbuf *m)
1947{
1948	struct rt2860_softc *sc = ic->ic_softc;
1949	int error;
1950
1951	RAL_LOCK(sc);
1952	if ((sc->sc_flags & RT2860_RUNNING) == 0) {
1953		RAL_UNLOCK(sc);
1954		return (ENXIO);
1955	}
1956	error = mbufq_enqueue(&sc->sc_snd, m);
1957	if (error) {
1958		RAL_UNLOCK(sc);
1959		return (error);
1960	}
1961	rt2860_start(sc);
1962	RAL_UNLOCK(sc);
1963
1964	return (0);
1965}
1966
1967static void
1968rt2860_start(struct rt2860_softc *sc)
1969{
1970	struct ieee80211_node *ni;
1971	struct mbuf *m;
1972
1973	RAL_LOCK_ASSERT(sc);
1974
1975	if ((sc->sc_flags & RT2860_RUNNING) == 0)
1976		return;
1977
1978	while (!SLIST_EMPTY(&sc->data_pool) && sc->qfullmsk == 0 &&
1979	    (m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
1980		ni = (struct ieee80211_node *)m->m_pkthdr.rcvif;
1981		if (rt2860_tx(sc, m, ni) != 0) {
1982			if_inc_counter(ni->ni_vap->iv_ifp,
1983			    IFCOUNTER_OERRORS, 1);
1984			ieee80211_free_node(ni);
1985			continue;
1986		}
1987		sc->sc_tx_timer = 5;
1988	}
1989}
1990
1991static void
1992rt2860_watchdog(void *arg)
1993{
1994	struct rt2860_softc *sc = arg;
1995
1996	RAL_LOCK_ASSERT(sc);
1997
1998	KASSERT(sc->sc_flags & RT2860_RUNNING, ("not running"));
1999
2000	if (sc->sc_invalid)		/* card ejected */
2001		return;
2002
2003	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
2004		device_printf(sc->sc_dev, "device timeout\n");
2005		rt2860_stop_locked(sc);
2006		rt2860_init_locked(sc);
2007		counter_u64_add(sc->sc_ic.ic_oerrors, 1);
2008		return;
2009	}
2010	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
2011}
2012
2013static void
2014rt2860_parent(struct ieee80211com *ic)
2015{
2016	struct rt2860_softc *sc = ic->ic_softc;
2017	int startall = 0;
2018
2019	RAL_LOCK(sc);
2020	if (ic->ic_nrunning> 0) {
2021		if (!(sc->sc_flags & RT2860_RUNNING)) {
2022			rt2860_init_locked(sc);
2023			startall = 1;
2024		} else
2025			rt2860_update_promisc(ic);
2026	} else if (sc->sc_flags & RT2860_RUNNING)
2027		rt2860_stop_locked(sc);
2028	RAL_UNLOCK(sc);
2029	if (startall)
2030		ieee80211_start_all(ic);
2031}
2032
2033/*
2034 * Reading and writing from/to the BBP is different from RT2560 and RT2661.
2035 * We access the BBP through the 8051 microcontroller unit which means that
2036 * the microcode must be loaded first.
2037 */
2038void
2039rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2040{
2041	int ntries;
2042
2043	for (ntries = 0; ntries < 100; ntries++) {
2044		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2045			break;
2046		DELAY(1);
2047	}
2048	if (ntries == 100) {
2049		device_printf(sc->sc_dev,
2050			"could not write to BBP through MCU\n");
2051		return;
2052	}
2053
2054	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2055	    RT2860_BBP_CSR_KICK | reg << 8 | val);
2056	RAL_BARRIER_WRITE(sc);
2057
2058	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
2059	DELAY(1000);
2060}
2061
2062uint8_t
2063rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
2064{
2065	uint32_t val;
2066	int ntries;
2067
2068	for (ntries = 0; ntries < 100; ntries++) {
2069		if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
2070			break;
2071		DELAY(1);
2072	}
2073	if (ntries == 100) {
2074		device_printf(sc->sc_dev,
2075		    "could not read from BBP through MCU\n");
2076		return 0;
2077	}
2078
2079	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
2080	    RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
2081	RAL_BARRIER_WRITE(sc);
2082
2083	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
2084	DELAY(1000);
2085
2086	for (ntries = 0; ntries < 100; ntries++) {
2087		val = RAL_READ(sc, RT2860_H2M_BBPAGENT);
2088		if (!(val & RT2860_BBP_CSR_KICK))
2089			return val & 0xff;
2090		DELAY(1);
2091	}
2092	device_printf(sc->sc_dev, "could not read from BBP through MCU\n");
2093
2094	return 0;
2095}
2096
2097/*
2098 * Write to one of the 4 programmable 24-bit RF registers.
2099 */
2100static void
2101rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
2102{
2103	uint32_t tmp;
2104	int ntries;
2105
2106	for (ntries = 0; ntries < 100; ntries++) {
2107		if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
2108			break;
2109		DELAY(1);
2110	}
2111	if (ntries == 100) {
2112		device_printf(sc->sc_dev, "could not write to RF\n");
2113		return;
2114	}
2115
2116	/* RF registers are 24-bit on the RT2860 */
2117	tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
2118	    (val & 0x3fffff) << 2 | (reg & 3);
2119	RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
2120}
2121
2122static uint8_t
2123rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
2124{
2125	uint32_t tmp;
2126	int ntries;
2127
2128	for (ntries = 0; ntries < 100; ntries++) {
2129		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
2130			break;
2131		DELAY(1);
2132	}
2133	if (ntries == 100) {
2134		device_printf(sc->sc_dev, "could not read RF register\n");
2135		return 0xff;
2136	}
2137	tmp = RT3070_RF_KICK | reg << 8;
2138	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
2139
2140	for (ntries = 0; ntries < 100; ntries++) {
2141		tmp = RAL_READ(sc, RT3070_RF_CSR_CFG);
2142		if (!(tmp & RT3070_RF_KICK))
2143			break;
2144		DELAY(1);
2145	}
2146	if (ntries == 100) {
2147		device_printf(sc->sc_dev, "could not read RF register\n");
2148		return 0xff;
2149	}
2150	return tmp & 0xff;
2151}
2152
2153void
2154rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2155{
2156	uint32_t tmp;
2157	int ntries;
2158
2159	for (ntries = 0; ntries < 10; ntries++) {
2160		if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
2161			break;
2162		DELAY(10);
2163	}
2164	if (ntries == 10) {
2165		device_printf(sc->sc_dev, "could not write to RF\n");
2166		return;
2167	}
2168
2169	tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
2170	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
2171}
2172
2173/*
2174 * Send a command to the 8051 microcontroller unit.
2175 */
2176int
2177rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
2178{
2179	int slot, ntries;
2180	uint32_t tmp;
2181	uint8_t cid;
2182
2183	for (ntries = 0; ntries < 100; ntries++) {
2184		if (!(RAL_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
2185			break;
2186		DELAY(2);
2187	}
2188	if (ntries == 100)
2189		return EIO;
2190
2191	cid = wait ? cmd : RT2860_TOKEN_NO_INTR;
2192	RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY | cid << 16 | arg);
2193	RAL_BARRIER_WRITE(sc);
2194	RAL_WRITE(sc, RT2860_HOST_CMD, cmd);
2195
2196	if (!wait)
2197		return 0;
2198	/* wait for the command to complete */
2199	for (ntries = 0; ntries < 200; ntries++) {
2200		tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID);
2201		/* find the command slot */
2202		for (slot = 0; slot < 4; slot++, tmp >>= 8)
2203			if ((tmp & 0xff) == cid)
2204				break;
2205		if (slot < 4)
2206			break;
2207		DELAY(100);
2208	}
2209	if (ntries == 200) {
2210		/* clear command and status */
2211		RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2212		RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2213		return ETIMEDOUT;
2214	}
2215	/* get command status (1 means success) */
2216	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS);
2217	tmp = (tmp >> (slot * 8)) & 0xff;
2218	DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
2219	    cmd, slot, tmp));
2220	/* clear command and status */
2221	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
2222	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
2223	return (tmp == 1) ? 0 : EIO;
2224}
2225
2226static void
2227rt2860_enable_mrr(struct rt2860_softc *sc)
2228{
2229#define CCK(mcs)	(mcs)
2230#define OFDM(mcs)	(1 << 3 | (mcs))
2231	RAL_WRITE(sc, RT2860_LG_FBK_CFG0,
2232	    OFDM(6) << 28 |	/* 54->48 */
2233	    OFDM(5) << 24 |	/* 48->36 */
2234	    OFDM(4) << 20 |	/* 36->24 */
2235	    OFDM(3) << 16 |	/* 24->18 */
2236	    OFDM(2) << 12 |	/* 18->12 */
2237	    OFDM(1) <<  8 |	/* 12-> 9 */
2238	    OFDM(0) <<  4 |	/*  9-> 6 */
2239	    OFDM(0));		/*  6-> 6 */
2240
2241	RAL_WRITE(sc, RT2860_LG_FBK_CFG1,
2242	    CCK(2) << 12 |	/* 11->5.5 */
2243	    CCK(1) <<  8 |	/* 5.5-> 2 */
2244	    CCK(0) <<  4 |	/*   2-> 1 */
2245	    CCK(0));		/*   1-> 1 */
2246#undef OFDM
2247#undef CCK
2248}
2249
2250static void
2251rt2860_set_txpreamble(struct rt2860_softc *sc)
2252{
2253	struct ieee80211com *ic = &sc->sc_ic;
2254	uint32_t tmp;
2255
2256	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
2257	tmp &= ~RT2860_CCK_SHORT_EN;
2258	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
2259		tmp |= RT2860_CCK_SHORT_EN;
2260	RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
2261}
2262
2263void
2264rt2860_set_basicrates(struct rt2860_softc *sc,
2265    const struct ieee80211_rateset *rs)
2266{
2267	struct ieee80211com *ic = &sc->sc_ic;
2268	uint32_t mask = 0;
2269	uint8_t rate;
2270	int i;
2271
2272	for (i = 0; i < rs->rs_nrates; i++) {
2273		rate = rs->rs_rates[i];
2274
2275		if (!(rate & IEEE80211_RATE_BASIC))
2276			continue;
2277
2278		mask |= 1 << ieee80211_legacy_rate_lookup(ic->ic_rt,
2279		    IEEE80211_RV(rate));
2280	}
2281
2282	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, mask);
2283}
2284
2285static void
2286rt2860_scan_start(struct ieee80211com *ic)
2287{
2288	struct rt2860_softc *sc = ic->ic_softc;
2289	uint32_t tmp;
2290
2291	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
2292	RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
2293	    tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
2294	    RT2860_TBTT_TIMER_EN));
2295	rt2860_set_gp_timer(sc, 0);
2296}
2297
2298static void
2299rt2860_scan_end(struct ieee80211com *ic)
2300{
2301	struct rt2860_softc *sc = ic->ic_softc;
2302	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2303
2304	if (vap->iv_state == IEEE80211_S_RUN) {
2305		rt2860_enable_tsf_sync(sc);
2306		rt2860_set_gp_timer(sc, 500);
2307	}
2308}
2309
2310static void
2311rt2860_getradiocaps(struct ieee80211com *ic, int maxchans, int *nchans,
2312    struct ieee80211_channel chans[])
2313{
2314	struct rt2860_softc *sc = ic->ic_softc;
2315	uint8_t bands[IEEE80211_MODE_BYTES];
2316
2317	memset(bands, 0, sizeof(bands));
2318	setbit(bands, IEEE80211_MODE_11B);
2319	setbit(bands, IEEE80211_MODE_11G);
2320	ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
2321	    rt2860_chan_2ghz, nitems(rt2860_chan_2ghz), bands, 0);
2322
2323	if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850) {
2324		setbit(bands, IEEE80211_MODE_11A);
2325		ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
2326		    rt2860_chan_5ghz, nitems(rt2860_chan_5ghz), bands, 0);
2327	}
2328}
2329
2330static void
2331rt2860_set_channel(struct ieee80211com *ic)
2332{
2333	struct rt2860_softc *sc = ic->ic_softc;
2334
2335	RAL_LOCK(sc);
2336	rt2860_switch_chan(sc, ic->ic_curchan);
2337	RAL_UNLOCK(sc);
2338}
2339
2340static void
2341rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2342{
2343	uint32_t tmp;
2344	uint8_t agc;
2345
2346	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2347	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2348	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2349	rt2860_mcu_bbp_write(sc, 86, 0x00);
2350
2351	if (group == 0) {
2352		if (sc->ext_2ghz_lna) {
2353			rt2860_mcu_bbp_write(sc, 82, 0x62);
2354			rt2860_mcu_bbp_write(sc, 75, 0x46);
2355		} else {
2356			rt2860_mcu_bbp_write(sc, 82, 0x84);
2357			rt2860_mcu_bbp_write(sc, 75, 0x50);
2358		}
2359	} else {
2360		if (sc->ext_5ghz_lna) {
2361			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2362			rt2860_mcu_bbp_write(sc, 75, 0x46);
2363		} else {
2364			rt2860_mcu_bbp_write(sc, 82, 0xf2);
2365			rt2860_mcu_bbp_write(sc, 75, 0x50);
2366		}
2367	}
2368
2369	tmp = RAL_READ(sc, RT2860_TX_BAND_CFG);
2370	tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
2371	tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
2372	RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
2373
2374	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2375	tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
2376	if (sc->nrxchains > 1)
2377		tmp |= RT2860_LNA_PE1_EN;
2378	if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
2379		tmp |= RT3593_LNA_PE2_EN;
2380	if (group == 0) {	/* 2GHz */
2381		tmp |= RT2860_PA_PE_G0_EN;
2382		if (sc->ntxchains > 1)
2383			tmp |= RT2860_PA_PE_G1_EN;
2384		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2385			tmp |= RT3593_PA_PE_G2_EN;
2386	} else {		/* 5GHz */
2387		tmp |= RT2860_PA_PE_A0_EN;
2388		if (sc->ntxchains > 1)
2389			tmp |= RT2860_PA_PE_A1_EN;
2390		if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2391			tmp |= RT3593_PA_PE_A2_EN;
2392	}
2393	RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
2394
2395	if (sc->mac_ver == 0x3593) {
2396		tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
2397		if (sc->sc_flags & RT2860_PCIE) {
2398			tmp &= ~0x01010000;
2399			if (group == 0)
2400				tmp |= 0x00010000;
2401		} else {
2402			tmp &= ~0x00008080;
2403			if (group == 0)
2404				tmp |= 0x00000080;
2405		}
2406		tmp = (tmp & ~0x00001000) | 0x00000010;
2407		RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp);
2408	}
2409
2410	/* set initial AGC value */
2411	if (group == 0) {	/* 2GHz band */
2412		if (sc->mac_ver >= 0x3071)
2413			agc = 0x1c + sc->lna[0] * 2;
2414		else
2415			agc = 0x2e + sc->lna[0];
2416	} else {		/* 5GHz band */
2417		agc = 0x32 + (sc->lna[group] * 5) / 3;
2418	}
2419	rt2860_mcu_bbp_write(sc, 66, agc);
2420
2421	DELAY(1000);
2422}
2423
2424static void
2425rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
2426{
2427	const struct rfprog *rfprog = rt2860_rf2850;
2428	uint32_t r2, r3, r4;
2429	int8_t txpow1, txpow2;
2430	u_int i;
2431
2432	/* find the settings for this channel (we know it exists) */
2433	for (i = 0; rfprog[i].chan != chan; i++);
2434
2435	r2 = rfprog[i].r2;
2436	if (sc->ntxchains == 1)
2437		r2 |= 1 << 12;		/* 1T: disable Tx chain 2 */
2438	if (sc->nrxchains == 1)
2439		r2 |= 1 << 15 | 1 << 4;	/* 1R: disable Rx chains 2 & 3 */
2440	else if (sc->nrxchains == 2)
2441		r2 |= 1 << 4;		/* 2R: disable Rx chain 3 */
2442
2443	/* use Tx power values from EEPROM */
2444	txpow1 = sc->txpow1[i];
2445	txpow2 = sc->txpow2[i];
2446	if (chan > 14) {
2447		if (txpow1 >= 0)
2448			txpow1 = txpow1 << 1 | 1;
2449		else
2450			txpow1 = (7 + txpow1) << 1;
2451		if (txpow2 >= 0)
2452			txpow2 = txpow2 << 1 | 1;
2453		else
2454			txpow2 = (7 + txpow2) << 1;
2455	}
2456	r3 = rfprog[i].r3 | txpow1 << 7;
2457	r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
2458
2459	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2460	rt2860_rf_write(sc, RT2860_RF2, r2);
2461	rt2860_rf_write(sc, RT2860_RF3, r3);
2462	rt2860_rf_write(sc, RT2860_RF4, r4);
2463
2464	DELAY(200);
2465
2466	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2467	rt2860_rf_write(sc, RT2860_RF2, r2);
2468	rt2860_rf_write(sc, RT2860_RF3, r3 | 1);
2469	rt2860_rf_write(sc, RT2860_RF4, r4);
2470
2471	DELAY(200);
2472
2473	rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
2474	rt2860_rf_write(sc, RT2860_RF2, r2);
2475	rt2860_rf_write(sc, RT2860_RF3, r3);
2476	rt2860_rf_write(sc, RT2860_RF4, r4);
2477}
2478
2479static void
2480rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
2481{
2482	int8_t txpow1, txpow2;
2483	uint8_t rf;
2484	int i;
2485
2486	/* RT3090 is 2GHz only */
2487	KASSERT(chan >= 1 && chan <= 14, ("chan %d not support", chan));
2488
2489	/* find the settings for this channel (we know it exists) */
2490	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2491
2492	/* use Tx power values from EEPROM */
2493	txpow1 = sc->txpow1[i];
2494	txpow2 = sc->txpow2[i];
2495
2496	rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
2497	rf = rt3090_rf_read(sc, 3);
2498	rf = (rf & ~0x0f) | rt3090_freqs[i].k;
2499	rt3090_rf_write(sc, 3, rf);
2500	rf = rt3090_rf_read(sc, 6);
2501	rf = (rf & ~0x03) | rt3090_freqs[i].r;
2502	rt3090_rf_write(sc, 6, rf);
2503
2504	/* set Tx0 power */
2505	rf = rt3090_rf_read(sc, 12);
2506	rf = (rf & ~0x1f) | txpow1;
2507	rt3090_rf_write(sc, 12, rf);
2508
2509	/* set Tx1 power */
2510	rf = rt3090_rf_read(sc, 13);
2511	rf = (rf & ~0x1f) | txpow2;
2512	rt3090_rf_write(sc, 13, rf);
2513
2514	rf = rt3090_rf_read(sc, 1);
2515	rf &= ~0xfc;
2516	if (sc->ntxchains == 1)
2517		rf |= RT3070_TX1_PD | RT3070_TX2_PD;
2518	else if (sc->ntxchains == 2)
2519		rf |= RT3070_TX2_PD;
2520	if (sc->nrxchains == 1)
2521		rf |= RT3070_RX1_PD | RT3070_RX2_PD;
2522	else if (sc->nrxchains == 2)
2523		rf |= RT3070_RX2_PD;
2524	rt3090_rf_write(sc, 1, rf);
2525
2526	/* set RF offset */
2527	rf = rt3090_rf_read(sc, 23);
2528	rf = (rf & ~0x7f) | sc->freq;
2529	rt3090_rf_write(sc, 23, rf);
2530
2531	/* program RF filter */
2532	rf = rt3090_rf_read(sc, 24);	/* Tx */
2533	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2534	rt3090_rf_write(sc, 24, rf);
2535	rf = rt3090_rf_read(sc, 31);	/* Rx */
2536	rf = (rf & ~0x3f) | sc->rf24_20mhz;
2537	rt3090_rf_write(sc, 31, rf);
2538
2539	/* enable RF tuning */
2540	rf = rt3090_rf_read(sc, 7);
2541	rt3090_rf_write(sc, 7, rf | RT3070_TUNE);
2542}
2543
2544static void
2545rt5390_set_chan(struct rt2860_softc *sc, u_int chan)
2546{
2547	uint8_t h20mhz, rf, tmp;
2548	int8_t txpow1, txpow2;
2549	int i;
2550
2551	/* RT5390 is 2GHz only */
2552	KASSERT(chan >= 1 && chan <= 14, ("chan %d not support", chan));
2553
2554	/* find the settings for this channel (we know it exists) */
2555	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2556
2557	/* use Tx power values from EEPROM */
2558	txpow1 = sc->txpow1[i];
2559	txpow2 = sc->txpow2[i];
2560
2561	rt3090_rf_write(sc, 8, rt3090_freqs[i].n);
2562	rt3090_rf_write(sc, 9, rt3090_freqs[i].k & 0x0f);
2563	rf = rt3090_rf_read(sc, 11);
2564	rf = (rf & ~0x03) | (rt3090_freqs[i].r & 0x03);
2565	rt3090_rf_write(sc, 11, rf);
2566
2567	rf = rt3090_rf_read(sc, 49);
2568	rf = (rf & ~0x3f) | (txpow1 & 0x3f);
2569	/* the valid range of the RF R49 is 0x00~0x27 */
2570	if ((rf & 0x3f) > 0x27)
2571		rf = (rf & ~0x3f) | 0x27;
2572	rt3090_rf_write(sc, 49, rf);
2573	if (sc->mac_ver == 0x5392) {
2574		rf = rt3090_rf_read(sc, 50);
2575		rf = (rf & ~0x3f) | (txpow2 & 0x3f);
2576		/* the valid range of the RF R50 is 0x00~0x27 */
2577		if ((rf & 0x3f) > 0x27)
2578			rf = (rf & ~0x3f) | 0x27;
2579		rt3090_rf_write(sc, 50, rf);
2580	}
2581
2582	rf = rt3090_rf_read(sc, 1);
2583	rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
2584	if (sc->mac_ver == 0x5392)
2585		rf |= RT3070_RX1_PD | RT3070_TX1_PD;
2586	rt3090_rf_write(sc, 1, rf);
2587
2588	rf = rt3090_rf_read(sc, 2);
2589	rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2590	DELAY(1000);
2591	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
2592
2593	rf = rt3090_rf_read(sc, 17);
2594	tmp = rf;
2595	rf = (rf & ~0x7f) | (sc->freq & 0x7f);
2596	rf = MIN(rf, 0x5f);
2597	if (tmp != rf)
2598		rt2860_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf, 0);
2599
2600	if (sc->mac_ver == 0x5390) {
2601		if (chan <= 4)
2602			rf = 0x73;
2603		else if (chan >= 5 && chan <= 6)
2604			rf = 0x63;
2605		else if (chan >= 7 && chan <= 10)
2606			rf = 0x53;
2607		else
2608			rf = 43;
2609		rt3090_rf_write(sc, 55, rf);
2610
2611		if (chan == 1)
2612			rf = 0x0c;
2613		else if (chan == 2)
2614			rf = 0x0b;
2615		else if (chan == 3)
2616			rf = 0x0a;
2617		else if (chan >= 4 && chan <= 6)
2618			rf = 0x09;
2619		else if (chan >= 7 && chan <= 12)
2620			rf = 0x08;
2621		else if (chan == 13)
2622			rf = 0x07;
2623		else
2624			rf = 0x06;
2625		rt3090_rf_write(sc, 59, rf);
2626	}
2627
2628	/* Tx/Rx h20M */
2629	h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
2630	rf = rt3090_rf_read(sc, 30);
2631	rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
2632	rt3090_rf_write(sc, 30, rf);
2633
2634	/* Rx BB filter VCM */
2635	rf = rt3090_rf_read(sc, 30);
2636	rf = (rf & ~0x18) | 0x10;
2637	rt3090_rf_write(sc, 30, rf);
2638
2639	/* Initiate VCO calibration. */
2640	rf = rt3090_rf_read(sc, 3);
2641	rf |= RT3593_VCOCAL;
2642	rt3090_rf_write(sc, 3, rf);
2643}
2644
2645static int
2646rt3090_rf_init(struct rt2860_softc *sc)
2647{
2648	uint32_t tmp;
2649	uint8_t rf, bbp;
2650	int i;
2651
2652	rf = rt3090_rf_read(sc, 30);
2653	/* toggle RF R30 bit 7 */
2654	rt3090_rf_write(sc, 30, rf | 0x80);
2655	DELAY(1000);
2656	rt3090_rf_write(sc, 30, rf & ~0x80);
2657
2658	tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2659	tmp &= ~0x1f000000;
2660	if (sc->patch_dac && sc->mac_rev < 0x0211)
2661		tmp |= 0x0d000000;	/* 1.35V */
2662	else
2663		tmp |= 0x01000000;	/* 1.2V */
2664	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2665
2666	/* patch LNA_PE_G1 */
2667	tmp = RAL_READ(sc, RT3070_GPIO_SWITCH);
2668	RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
2669
2670	/* initialize RF registers to default value */
2671	for (i = 0; i < nitems(rt3090_def_rf); i++) {
2672		rt3090_rf_write(sc, rt3090_def_rf[i].reg,
2673		    rt3090_def_rf[i].val);
2674	}
2675
2676	/* select 20MHz bandwidth */
2677	rt3090_rf_write(sc, 31, 0x14);
2678
2679	rf = rt3090_rf_read(sc, 6);
2680	rt3090_rf_write(sc, 6, rf | 0x40);
2681
2682	if (sc->mac_ver != 0x3593) {
2683		/* calibrate filter for 20MHz bandwidth */
2684		sc->rf24_20mhz = 0x1f;	/* default value */
2685		rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
2686
2687		/* select 40MHz bandwidth */
2688		bbp = rt2860_mcu_bbp_read(sc, 4);
2689		rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) | 0x10);
2690		rf = rt3090_rf_read(sc, 31);
2691		rt3090_rf_write(sc, 31, rf | 0x20);
2692
2693		/* calibrate filter for 40MHz bandwidth */
2694		sc->rf24_40mhz = 0x2f;	/* default value */
2695		rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
2696
2697		/* go back to 20MHz bandwidth */
2698		bbp = rt2860_mcu_bbp_read(sc, 4);
2699		rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
2700	}
2701	if (sc->mac_rev < 0x0211)
2702		rt3090_rf_write(sc, 27, 0x03);
2703
2704	tmp = RAL_READ(sc, RT3070_OPT_14);
2705	RAL_WRITE(sc, RT3070_OPT_14, tmp | 1);
2706
2707	if (sc->rf_rev == RT3070_RF_3020)
2708		rt3090_set_rx_antenna(sc, 0);
2709
2710	bbp = rt2860_mcu_bbp_read(sc, 138);
2711	if (sc->mac_ver == 0x3593) {
2712		if (sc->ntxchains == 1)
2713			bbp |= 0x60;	/* turn off DAC1 and DAC2 */
2714		else if (sc->ntxchains == 2)
2715			bbp |= 0x40;	/* turn off DAC2 */
2716		if (sc->nrxchains == 1)
2717			bbp &= ~0x06;	/* turn off ADC1 and ADC2 */
2718		else if (sc->nrxchains == 2)
2719			bbp &= ~0x04;	/* turn off ADC2 */
2720	} else {
2721		if (sc->ntxchains == 1)
2722			bbp |= 0x20;	/* turn off DAC1 */
2723		if (sc->nrxchains == 1)
2724			bbp &= ~0x02;	/* turn off ADC1 */
2725	}
2726	rt2860_mcu_bbp_write(sc, 138, bbp);
2727
2728	rf = rt3090_rf_read(sc, 1);
2729	rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
2730	rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
2731	rt3090_rf_write(sc, 1, rf);
2732
2733	rf = rt3090_rf_read(sc, 15);
2734	rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
2735
2736	rf = rt3090_rf_read(sc, 17);
2737	rf &= ~RT3070_TX_LO1;
2738	if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
2739		rf |= 0x20;	/* fix for long range Rx issue */
2740	if (sc->txmixgain_2ghz >= 2)
2741		rf = (rf & ~0x7) | sc->txmixgain_2ghz;
2742	rt3090_rf_write(sc, 17, rf);
2743
2744	rf = rt3090_rf_read(sc, 20);
2745	rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
2746
2747	rf = rt3090_rf_read(sc, 21);
2748	rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
2749
2750	return (0);
2751}
2752
2753static void
2754rt5390_rf_init(struct rt2860_softc *sc)
2755{
2756	uint8_t rf, bbp;
2757	int i;
2758
2759	rf = rt3090_rf_read(sc, 2);
2760	/* Toggle RF R2 bit 7. */
2761	rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2762	DELAY(1000);
2763	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
2764
2765	/* Initialize RF registers to default value. */
2766	if (sc->mac_ver == 0x5392) {
2767		for (i = 0; i < nitems(rt5392_def_rf); i++) {
2768			rt3090_rf_write(sc, rt5392_def_rf[i].reg,
2769			    rt5392_def_rf[i].val);
2770		}
2771	} else {
2772		for (i = 0; i < nitems(rt5390_def_rf); i++) {
2773			rt3090_rf_write(sc, rt5390_def_rf[i].reg,
2774			    rt5390_def_rf[i].val);
2775		}
2776	}
2777
2778	sc->rf24_20mhz = 0x1f;
2779	sc->rf24_40mhz = 0x2f;
2780
2781	if (sc->mac_rev < 0x0211)
2782		rt3090_rf_write(sc, 27, 0x03);
2783
2784	/* Set led open drain enable. */
2785	RAL_WRITE(sc, RT3070_OPT_14, RAL_READ(sc, RT3070_OPT_14) | 1);
2786
2787	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
2788	RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
2789
2790	if (sc->mac_ver == 0x5390)
2791		rt3090_set_rx_antenna(sc, 0);
2792
2793	/* Patch RSSI inaccurate issue. */
2794	rt2860_mcu_bbp_write(sc, 79, 0x13);
2795	rt2860_mcu_bbp_write(sc, 80, 0x05);
2796	rt2860_mcu_bbp_write(sc, 81, 0x33);
2797
2798	/* Enable DC filter. */
2799	if (sc->mac_rev >= 0x0211)
2800		rt2860_mcu_bbp_write(sc, 103, 0xc0);
2801
2802	bbp = rt2860_mcu_bbp_read(sc, 138);
2803	if (sc->ntxchains == 1)
2804		bbp |= 0x20;	/* Turn off DAC1. */
2805	if (sc->nrxchains == 1)
2806		bbp &= ~0x02;	/* Turn off ADC1. */
2807	rt2860_mcu_bbp_write(sc, 138, bbp);
2808
2809	/* Enable RX LO1 and LO2. */
2810	rt3090_rf_write(sc, 38, rt3090_rf_read(sc, 38) & ~RT5390_RX_LO1);
2811	rt3090_rf_write(sc, 39, rt3090_rf_read(sc, 39) & ~RT5390_RX_LO2);
2812
2813	/* Avoid data lost and CRC error. */
2814	rt2860_mcu_bbp_write(sc, 4,
2815	    rt2860_mcu_bbp_read(sc, 4) | RT5390_MAC_IF_CTRL);
2816
2817	rf = rt3090_rf_read(sc, 30);
2818	rf = (rf & ~0x18) | 0x10;
2819	rt3090_rf_write(sc, 30, rf);
2820}
2821
2822static void
2823rt3090_rf_wakeup(struct rt2860_softc *sc)
2824{
2825	uint32_t tmp;
2826	uint8_t rf;
2827
2828	if (sc->mac_ver == 0x3593) {
2829		/* enable VCO */
2830		rf = rt3090_rf_read(sc, 1);
2831		rt3090_rf_write(sc, 1, rf | RT3593_VCO);
2832
2833		/* initiate VCO calibration */
2834		rf = rt3090_rf_read(sc, 3);
2835		rt3090_rf_write(sc, 3, rf | RT3593_VCOCAL);
2836
2837		/* enable VCO bias current control */
2838		rf = rt3090_rf_read(sc, 6);
2839		rt3090_rf_write(sc, 6, rf | RT3593_VCO_IC);
2840
2841		/* initiate res calibration */
2842		rf = rt3090_rf_read(sc, 2);
2843		rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
2844
2845		/* set reference current control to 0.33 mA */
2846		rf = rt3090_rf_read(sc, 22);
2847		rf &= ~RT3593_CP_IC_MASK;
2848		rf |= 1 << RT3593_CP_IC_SHIFT;
2849		rt3090_rf_write(sc, 22, rf);
2850
2851		/* enable RX CTB */
2852		rf = rt3090_rf_read(sc, 46);
2853		rt3090_rf_write(sc, 46, rf | RT3593_RX_CTB);
2854
2855		rf = rt3090_rf_read(sc, 20);
2856		rf &= ~(RT3593_LDO_RF_VC_MASK | RT3593_LDO_PLL_VC_MASK);
2857		rt3090_rf_write(sc, 20, rf);
2858	} else {
2859		/* enable RF block */
2860		rf = rt3090_rf_read(sc, 1);
2861		rt3090_rf_write(sc, 1, rf | RT3070_RF_BLOCK);
2862
2863		/* enable VCO bias current control */
2864		rf = rt3090_rf_read(sc, 7);
2865		rt3090_rf_write(sc, 7, rf | 0x30);
2866
2867		rf = rt3090_rf_read(sc, 9);
2868		rt3090_rf_write(sc, 9, rf | 0x0e);
2869
2870		/* enable RX CTB */
2871		rf = rt3090_rf_read(sc, 21);
2872		rt3090_rf_write(sc, 21, rf | RT3070_RX_CTB);
2873
2874		/* fix Tx to Rx IQ glitch by raising RF voltage */
2875		rf = rt3090_rf_read(sc, 27);
2876		rf &= ~0x77;
2877		if (sc->mac_rev < 0x0211)
2878			rf |= 0x03;
2879		rt3090_rf_write(sc, 27, rf);
2880	}
2881	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2882		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2883		tmp = (tmp & ~0x1f000000) | 0x0d000000;
2884		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2885	}
2886}
2887
2888static void
2889rt5390_rf_wakeup(struct rt2860_softc *sc)
2890{
2891	uint32_t tmp;
2892	uint8_t rf;
2893
2894	rf = rt3090_rf_read(sc, 1);
2895	rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD |
2896	    RT3070_TX0_PD;
2897	if (sc->mac_ver == 0x5392)
2898		rf |= RT3070_RX1_PD | RT3070_TX1_PD;
2899	rt3090_rf_write(sc, 1, rf);
2900
2901	rf = rt3090_rf_read(sc, 6);
2902	rf |= RT3593_VCO_IC | RT3593_VCOCAL;
2903	if (sc->mac_ver == 0x5390)
2904		rf &= ~RT3593_VCO_IC;
2905	rt3090_rf_write(sc, 6, rf);
2906
2907	rt3090_rf_write(sc, 2, rt3090_rf_read(sc, 2) | RT3593_RESCAL);
2908
2909	rf = rt3090_rf_read(sc, 22);
2910	rf = (rf & ~0xe0) | 0x20;
2911	rt3090_rf_write(sc, 22, rf);
2912
2913	rt3090_rf_write(sc, 42, rt3090_rf_read(sc, 42) | RT5390_RX_CTB);
2914	rt3090_rf_write(sc, 20, rt3090_rf_read(sc, 20) & ~0x77);
2915	rt3090_rf_write(sc, 3, rt3090_rf_read(sc, 3) | RT3593_VCOCAL);
2916
2917	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2918		tmp = RAL_READ(sc, RT3070_LDO_CFG0);
2919		tmp = (tmp & ~0x1f000000) | 0x0d000000;
2920		RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
2921	}
2922}
2923
2924static int
2925rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
2926    uint8_t *val)
2927{
2928	uint8_t rf22, rf24;
2929	uint8_t bbp55_pb, bbp55_sb, delta;
2930	int ntries;
2931
2932	/* program filter */
2933	rf24 = rt3090_rf_read(sc, 24);
2934	rf24 = (rf24 & 0xc0) | init;	/* initial filter value */
2935	rt3090_rf_write(sc, 24, rf24);
2936
2937	/* enable baseband loopback mode */
2938	rf22 = rt3090_rf_read(sc, 22);
2939	rt3090_rf_write(sc, 22, rf22 | RT3070_BB_LOOPBACK);
2940
2941	/* set power and frequency of passband test tone */
2942	rt2860_mcu_bbp_write(sc, 24, 0x00);
2943	for (ntries = 0; ntries < 100; ntries++) {
2944		/* transmit test tone */
2945		rt2860_mcu_bbp_write(sc, 25, 0x90);
2946		DELAY(1000);
2947		/* read received power */
2948		bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
2949		if (bbp55_pb != 0)
2950			break;
2951	}
2952	if (ntries == 100)
2953		return (ETIMEDOUT);
2954
2955	/* set power and frequency of stopband test tone */
2956	rt2860_mcu_bbp_write(sc, 24, 0x06);
2957	for (ntries = 0; ntries < 100; ntries++) {
2958		/* transmit test tone */
2959		rt2860_mcu_bbp_write(sc, 25, 0x90);
2960		DELAY(1000);
2961		/* read received power */
2962		bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
2963
2964		delta = bbp55_pb - bbp55_sb;
2965		if (delta > target)
2966			break;
2967
2968		/* reprogram filter */
2969		rf24++;
2970		rt3090_rf_write(sc, 24, rf24);
2971	}
2972	if (ntries < 100) {
2973		if (rf24 != init)
2974			rf24--;	/* backtrack */
2975		*val = rf24;
2976		rt3090_rf_write(sc, 24, rf24);
2977	}
2978
2979	/* restore initial state */
2980	rt2860_mcu_bbp_write(sc, 24, 0x00);
2981
2982	/* disable baseband loopback mode */
2983	rf22 = rt3090_rf_read(sc, 22);
2984	rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK);
2985
2986	return (0);
2987}
2988
2989static void
2990rt3090_rf_setup(struct rt2860_softc *sc)
2991{
2992	uint8_t bbp;
2993	int i;
2994
2995	if (sc->mac_rev >= 0x0211) {
2996		/* enable DC filter */
2997		rt2860_mcu_bbp_write(sc, 103, 0xc0);
2998
2999		/* improve power consumption */
3000		bbp = rt2860_mcu_bbp_read(sc, 31);
3001		rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
3002	}
3003
3004	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
3005	if (sc->mac_rev < 0x0211) {
3006		RAL_WRITE(sc, RT2860_TX_SW_CFG2,
3007		    sc->patch_dac ? 0x2c : 0x0f);
3008	} else
3009		RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
3010
3011	/* initialize RF registers from ROM */
3012	if (sc->mac_ver < 0x5390) {
3013		for (i = 0; i < 10; i++) {
3014			if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
3015				continue;
3016			rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
3017		}
3018	}
3019}
3020
3021static void
3022rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
3023{
3024	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
3025	    which | (sc->leds & 0x7f), 0);
3026}
3027
3028/*
3029 * Hardware has a general-purpose programmable timer interrupt that can
3030 * periodically raise MAC_INT_4.
3031 */
3032static void
3033rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
3034{
3035	uint32_t tmp;
3036
3037	/* disable GP timer before reprogramming it */
3038	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
3039	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN);
3040
3041	if (ms == 0)
3042		return;
3043
3044	tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG);
3045	ms *= 16;	/* Unit: 64us */
3046	tmp = (tmp & 0xffff) | ms << RT2860_GP_TIMER_SHIFT;
3047	RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp);
3048
3049	/* enable GP timer */
3050	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
3051	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp | RT2860_GP_TIMER_EN);
3052}
3053
3054static void
3055rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
3056{
3057	RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,
3058	    bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
3059	RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,
3060	    bssid[4] | bssid[5] << 8);
3061}
3062
3063static void
3064rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
3065{
3066	RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,
3067	    addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
3068	RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,
3069	    addr[4] | addr[5] << 8 | 0xff << 16);
3070}
3071
3072static void
3073rt2860_updateslot(struct ieee80211com *ic)
3074{
3075	struct rt2860_softc *sc = ic->ic_softc;
3076	uint32_t tmp;
3077
3078	tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG);
3079	tmp &= ~0xff;
3080	tmp |= IEEE80211_GET_SLOTTIME(ic);
3081	RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
3082}
3083
3084static void
3085rt2860_updateprot(struct rt2860_softc *sc)
3086{
3087	struct ieee80211com *ic = &sc->sc_ic;
3088	uint32_t tmp;
3089
3090	tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
3091	/* setup protection frame rate (MCS code) */
3092	tmp |= IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ?
3093	    rt2860_rates[RT2860_RIDX_OFDM6].mcs :
3094	    rt2860_rates[RT2860_RIDX_CCK11].mcs;
3095
3096	/* CCK frames don't require protection */
3097	RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
3098
3099	if (ic->ic_flags & IEEE80211_F_USEPROT) {
3100		if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
3101			tmp |= RT2860_PROT_CTRL_RTS_CTS;
3102		else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
3103			tmp |= RT2860_PROT_CTRL_CTS;
3104	}
3105	RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
3106}
3107
3108static void
3109rt2860_update_promisc(struct ieee80211com *ic)
3110{
3111	struct rt2860_softc *sc = ic->ic_softc;
3112	uint32_t tmp;
3113
3114	tmp = RAL_READ(sc, RT2860_RX_FILTR_CFG);
3115	tmp &= ~RT2860_DROP_NOT_MYBSS;
3116	if (ic->ic_promisc == 0)
3117		tmp |= RT2860_DROP_NOT_MYBSS;
3118	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
3119}
3120
3121static int
3122rt2860_updateedca(struct ieee80211com *ic)
3123{
3124	struct rt2860_softc *sc = ic->ic_softc;
3125	struct chanAccParams chp;
3126	const struct wmeParams *wmep;
3127	int aci;
3128
3129	ieee80211_wme_ic_getparams(ic, &chp);
3130
3131	wmep = chp.cap_wmeParams;
3132
3133	/* update MAC TX configuration registers */
3134	for (aci = 0; aci < WME_NUM_AC; aci++) {
3135		RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),
3136		    wmep[aci].wmep_logcwmax << 16 |
3137		    wmep[aci].wmep_logcwmin << 12 |
3138		    wmep[aci].wmep_aifsn  <<  8 |
3139		    wmep[aci].wmep_txopLimit);
3140	}
3141
3142	/* update SCH/DMA registers too */
3143	RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,
3144	    wmep[WME_AC_VO].wmep_aifsn  << 12 |
3145	    wmep[WME_AC_VI].wmep_aifsn  <<  8 |
3146	    wmep[WME_AC_BK].wmep_aifsn  <<  4 |
3147	    wmep[WME_AC_BE].wmep_aifsn);
3148	RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,
3149	    wmep[WME_AC_VO].wmep_logcwmin << 12 |
3150	    wmep[WME_AC_VI].wmep_logcwmin <<  8 |
3151	    wmep[WME_AC_BK].wmep_logcwmin <<  4 |
3152	    wmep[WME_AC_BE].wmep_logcwmin);
3153	RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,
3154	    wmep[WME_AC_VO].wmep_logcwmax << 12 |
3155	    wmep[WME_AC_VI].wmep_logcwmax <<  8 |
3156	    wmep[WME_AC_BK].wmep_logcwmax <<  4 |
3157	    wmep[WME_AC_BE].wmep_logcwmax);
3158	RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,
3159	    wmep[WME_AC_BK].wmep_txopLimit << 16 |
3160	    wmep[WME_AC_BE].wmep_txopLimit);
3161	RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,
3162	    wmep[WME_AC_VO].wmep_txopLimit << 16 |
3163	    wmep[WME_AC_VI].wmep_txopLimit);
3164
3165	return 0;
3166}
3167
3168#ifdef HW_CRYPTO
3169static int
3170rt2860_set_key(struct ieee80211com *ic, struct ieee80211_node *ni,
3171    struct ieee80211_key *k)
3172{
3173	struct rt2860_softc *sc = ic->ic_softc;
3174	bus_size_t base;
3175	uint32_t attr;
3176	uint8_t mode, wcid, iv[8];
3177
3178	/* defer setting of WEP keys until interface is brought up */
3179	if ((ic->ic_if.if_flags & (IFF_UP | IFF_RUNNING)) !=
3180	    (IFF_UP | IFF_RUNNING))
3181		return 0;
3182
3183	/* map net80211 cipher to RT2860 security mode */
3184	switch (k->k_cipher) {
3185	case IEEE80211_CIPHER_WEP40:
3186		mode = RT2860_MODE_WEP40;
3187		break;
3188	case IEEE80211_CIPHER_WEP104:
3189		mode = RT2860_MODE_WEP104;
3190		break;
3191	case IEEE80211_CIPHER_TKIP:
3192		mode = RT2860_MODE_TKIP;
3193		break;
3194	case IEEE80211_CIPHER_CCMP:
3195		mode = RT2860_MODE_AES_CCMP;
3196		break;
3197	default:
3198		return EINVAL;
3199	}
3200
3201	if (k->k_flags & IEEE80211_KEY_GROUP) {
3202		wcid = 0;	/* NB: update WCID0 for group keys */
3203		base = RT2860_SKEY(0, k->k_id);
3204	} else {
3205		wcid = ((struct rt2860_node *)ni)->wcid;
3206		base = RT2860_PKEY(wcid);
3207	}
3208
3209	if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3210		RAL_WRITE_REGION_1(sc, base, k->k_key, 16);
3211#ifndef IEEE80211_STA_ONLY
3212		if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
3213			RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[16], 8);
3214			RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[24], 8);
3215		} else
3216#endif
3217		{
3218			RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[24], 8);
3219			RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[16], 8);
3220		}
3221	} else
3222		RAL_WRITE_REGION_1(sc, base, k->k_key, k->k_len);
3223
3224	if (!(k->k_flags & IEEE80211_KEY_GROUP) ||
3225	    (k->k_flags & IEEE80211_KEY_TX)) {
3226		/* set initial packet number in IV+EIV */
3227		if (k->k_cipher == IEEE80211_CIPHER_WEP40 ||
3228		    k->k_cipher == IEEE80211_CIPHER_WEP104) {
3229			uint32_t val = arc4random();
3230			/* skip weak IVs from Fluhrer/Mantin/Shamir */
3231			if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
3232				val += 0x000100;
3233			iv[0] = val;
3234			iv[1] = val >> 8;
3235			iv[2] = val >> 16;
3236			iv[3] = k->k_id << 6;
3237			iv[4] = iv[5] = iv[6] = iv[7] = 0;
3238		} else {
3239			if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3240				iv[0] = k->k_tsc >> 8;
3241				iv[1] = (iv[0] | 0x20) & 0x7f;
3242				iv[2] = k->k_tsc;
3243			} else /* CCMP */ {
3244				iv[0] = k->k_tsc;
3245				iv[1] = k->k_tsc >> 8;
3246				iv[2] = 0;
3247			}
3248			iv[3] = k->k_id << 6 | IEEE80211_WEP_EXTIV;
3249			iv[4] = k->k_tsc >> 16;
3250			iv[5] = k->k_tsc >> 24;
3251			iv[6] = k->k_tsc >> 32;
3252			iv[7] = k->k_tsc >> 40;
3253		}
3254		RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8);
3255	}
3256
3257	if (k->k_flags & IEEE80211_KEY_GROUP) {
3258		/* install group key */
3259		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
3260		attr &= ~(0xf << (k->k_id * 4));
3261		attr |= mode << (k->k_id * 4);
3262		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
3263	} else {
3264		/* install pairwise key */
3265		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
3266		attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
3267		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
3268	}
3269	return 0;
3270}
3271
3272static void
3273rt2860_delete_key(struct ieee80211com *ic, struct ieee80211_node *ni,
3274    struct ieee80211_key *k)
3275{
3276	struct rt2860_softc *sc = ic->ic_softc;
3277	uint32_t attr;
3278	uint8_t wcid;
3279
3280	if (k->k_flags & IEEE80211_KEY_GROUP) {
3281		/* remove group key */
3282		attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
3283		attr &= ~(0xf << (k->k_id * 4));
3284		RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
3285
3286	} else {
3287		/* remove pairwise key */
3288		wcid = ((struct rt2860_node *)ni)->wcid;
3289		attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
3290		attr &= ~0xf;
3291		RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
3292	}
3293}
3294#endif
3295
3296static int8_t
3297rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
3298{
3299	struct ieee80211com *ic = &sc->sc_ic;
3300	struct ieee80211_channel *c = ic->ic_curchan;
3301	int delta;
3302
3303	if (IEEE80211_IS_CHAN_5GHZ(c)) {
3304		u_int chan = ieee80211_chan2ieee(ic, c);
3305		delta = sc->rssi_5ghz[rxchain];
3306
3307		/* determine channel group */
3308		if (chan <= 64)
3309			delta -= sc->lna[1];
3310		else if (chan <= 128)
3311			delta -= sc->lna[2];
3312		else
3313			delta -= sc->lna[3];
3314	} else
3315		delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
3316
3317	return -12 - delta - rssi;
3318}
3319
3320/*
3321 * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
3322 * Used to adjust per-rate Tx power registers.
3323 */
3324static __inline uint32_t
3325b4inc(uint32_t b32, int8_t delta)
3326{
3327	int8_t i, b4;
3328
3329	for (i = 0; i < 8; i++) {
3330		b4 = b32 & 0xf;
3331		b4 += delta;
3332		if (b4 < 0)
3333			b4 = 0;
3334		else if (b4 > 0xf)
3335			b4 = 0xf;
3336		b32 = b32 >> 4 | b4 << 28;
3337	}
3338	return b32;
3339}
3340
3341static const char *
3342rt2860_get_rf(uint16_t rev)
3343{
3344	switch (rev) {
3345	case RT2860_RF_2820:	return "RT2820";
3346	case RT2860_RF_2850:	return "RT2850";
3347	case RT2860_RF_2720:	return "RT2720";
3348	case RT2860_RF_2750:	return "RT2750";
3349	case RT3070_RF_3020:	return "RT3020";
3350	case RT3070_RF_2020:	return "RT2020";
3351	case RT3070_RF_3021:	return "RT3021";
3352	case RT3070_RF_3022:	return "RT3022";
3353	case RT3070_RF_3052:	return "RT3052";
3354	case RT3070_RF_3320:	return "RT3320";
3355	case RT3070_RF_3053:	return "RT3053";
3356	case RT5390_RF_5360:	return "RT5360";
3357	case RT5390_RF_5390:	return "RT5390";
3358	default:		return "unknown";
3359	}
3360}
3361
3362static int
3363rt2860_read_eeprom(struct rt2860_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
3364{
3365	int8_t delta_2ghz, delta_5ghz;
3366	uint32_t tmp;
3367	uint16_t val;
3368	int ridx, ant, i;
3369
3370	/* check whether the ROM is eFUSE ROM or EEPROM */
3371	sc->sc_srom_read = rt2860_eeprom_read_2;
3372	if (sc->mac_ver >= 0x3071) {
3373		tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
3374		DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
3375		if (tmp & RT3070_SEL_EFUSE)
3376			sc->sc_srom_read = rt3090_efuse_read_2;
3377	}
3378
3379#ifdef RAL_DEBUG
3380	/* read EEPROM version */
3381	val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION);
3382	DPRINTF(("EEPROM rev=%d, FAE=%d\n", val >> 8, val & 0xff));
3383#endif
3384
3385	/* read MAC address */
3386	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC01);
3387	macaddr[0] = val & 0xff;
3388	macaddr[1] = val >> 8;
3389	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC23);
3390	macaddr[2] = val & 0xff;
3391	macaddr[3] = val >> 8;
3392	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC45);
3393	macaddr[4] = val & 0xff;
3394	macaddr[5] = val >> 8;
3395
3396#ifdef RAL_DEBUG
3397	/* read country code */
3398	val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY);
3399	DPRINTF(("EEPROM region code=0x%04x\n", val));
3400#endif
3401
3402	/* read vendor BBP settings */
3403	for (i = 0; i < 8; i++) {
3404		val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE + i);
3405		sc->bbp[i].val = val & 0xff;
3406		sc->bbp[i].reg = val >> 8;
3407		DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
3408	}
3409	if (sc->mac_ver >= 0x3071) {
3410		/* read vendor RF settings */
3411		for (i = 0; i < 10; i++) {
3412			val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE + i);
3413			sc->rf[i].val = val & 0xff;
3414			sc->rf[i].reg = val >> 8;
3415			DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
3416			    sc->rf[i].val));
3417		}
3418	}
3419
3420	/* read RF frequency offset from EEPROM */
3421	val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS);
3422	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
3423	DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
3424	if ((val >> 8) != 0xff) {
3425		/* read LEDs operating mode */
3426		sc->leds = val >> 8;
3427		sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED1);
3428		sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED2);
3429		sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED3);
3430	} else {
3431		/* broken EEPROM, use default settings */
3432		sc->leds = 0x01;
3433		sc->led[0] = 0x5555;
3434		sc->led[1] = 0x2221;
3435		sc->led[2] = 0xa9f8;
3436	}
3437	DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
3438	    sc->leds, sc->led[0], sc->led[1], sc->led[2]));
3439
3440	/* read RF information */
3441	val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA);
3442	if (sc->mac_ver >= 0x5390)
3443		sc->rf_rev = rt2860_srom_read(sc, RT2860_EEPROM_CHIPID);
3444	else
3445		sc->rf_rev = (val >> 8) & 0xf;
3446	sc->ntxchains = (val >> 4) & 0xf;
3447	sc->nrxchains = val & 0xf;
3448	DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
3449	    sc->rf_rev, sc->ntxchains, sc->nrxchains));
3450
3451	/* check if RF supports automatic Tx access gain control */
3452	val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG);
3453	DPRINTF(("EEPROM CFG 0x%04x\n", val));
3454	/* check if driver should patch the DAC issue */
3455	if ((val >> 8) != 0xff)
3456		sc->patch_dac = (val >> 15) & 1;
3457	if ((val & 0xff) != 0xff) {
3458		sc->ext_5ghz_lna = (val >> 3) & 1;
3459		sc->ext_2ghz_lna = (val >> 2) & 1;
3460		/* check if RF supports automatic Tx access gain control */
3461		sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */
3462		/* check if we have a hardware radio switch */
3463		sc->rfswitch = val & 1;
3464	}
3465	if (sc->sc_flags & RT2860_ADVANCED_PS) {
3466		/* read PCIe power save level */
3467		val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
3468		if ((val & 0xff) != 0xff) {
3469			sc->pslevel = val & 0x3;
3470			val = rt2860_srom_read(sc, RT2860_EEPROM_REV);
3471			if ((val & 0xff80) != 0x9280)
3472				sc->pslevel = MIN(sc->pslevel, 1);
3473			DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
3474		}
3475	}
3476
3477	/* read power settings for 2GHz channels */
3478	for (i = 0; i < 14; i += 2) {
3479		val = rt2860_srom_read(sc,
3480		    RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
3481		sc->txpow1[i + 0] = (int8_t)(val & 0xff);
3482		sc->txpow1[i + 1] = (int8_t)(val >> 8);
3483
3484		if (sc->mac_ver != 0x5390) {
3485			val = rt2860_srom_read(sc,
3486			    RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
3487			sc->txpow2[i + 0] = (int8_t)(val & 0xff);
3488			sc->txpow2[i + 1] = (int8_t)(val >> 8);
3489		}
3490	}
3491	/* fix broken Tx power entries */
3492	for (i = 0; i < 14; i++) {
3493		if (sc->txpow1[i] < 0 ||
3494		    sc->txpow1[i] > ((sc->mac_ver >= 0x5390) ? 39 : 31))
3495			sc->txpow1[i] = 5;
3496		if (sc->mac_ver != 0x5390) {
3497			if (sc->txpow2[i] < 0 ||
3498			    sc->txpow2[i] > ((sc->mac_ver == 0x5392) ? 39 : 31))
3499				sc->txpow2[i] = 5;
3500		}
3501		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3502		    rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
3503	}
3504	/* read power settings for 5GHz channels */
3505	for (i = 0; i < 40; i += 2) {
3506		val = rt2860_srom_read(sc,
3507		    RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
3508		sc->txpow1[i + 14] = (int8_t)(val & 0xff);
3509		sc->txpow1[i + 15] = (int8_t)(val >> 8);
3510
3511		val = rt2860_srom_read(sc,
3512		    RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
3513		sc->txpow2[i + 14] = (int8_t)(val & 0xff);
3514		sc->txpow2[i + 15] = (int8_t)(val >> 8);
3515	}
3516	/* fix broken Tx power entries */
3517	for (i = 0; i < 40; i++) {
3518		if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
3519			sc->txpow1[14 + i] = 5;
3520		if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
3521			sc->txpow2[14 + i] = 5;
3522		DPRINTF(("chan %d: power1=%d, power2=%d\n",
3523		    rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
3524		    sc->txpow2[14 + i]));
3525	}
3526
3527	/* read Tx power compensation for each Tx rate */
3528	val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR);
3529	delta_2ghz = delta_5ghz = 0;
3530	if ((val & 0xff) != 0xff && (val & 0x80)) {
3531		delta_2ghz = val & 0xf;
3532		if (!(val & 0x40))	/* negative number */
3533			delta_2ghz = -delta_2ghz;
3534	}
3535	val >>= 8;
3536	if ((val & 0xff) != 0xff && (val & 0x80)) {
3537		delta_5ghz = val & 0xf;
3538		if (!(val & 0x40))	/* negative number */
3539			delta_5ghz = -delta_5ghz;
3540	}
3541	DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
3542	    delta_2ghz, delta_5ghz));
3543
3544	for (ridx = 0; ridx < 5; ridx++) {
3545		uint32_t reg;
3546
3547		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2);
3548		reg = val;
3549		val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1);
3550		reg |= (uint32_t)val << 16;
3551
3552		sc->txpow20mhz[ridx] = reg;
3553		sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
3554		sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
3555
3556		DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
3557		    "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
3558		    sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
3559	}
3560
3561	/* read factory-calibrated samples for temperature compensation */
3562	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
3563	sc->tssi_2ghz[0] = val & 0xff;	/* [-4] */
3564	sc->tssi_2ghz[1] = val >> 8;	/* [-3] */
3565	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
3566	sc->tssi_2ghz[2] = val & 0xff;	/* [-2] */
3567	sc->tssi_2ghz[3] = val >> 8;	/* [-1] */
3568	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
3569	sc->tssi_2ghz[4] = val & 0xff;	/* [+0] */
3570	sc->tssi_2ghz[5] = val >> 8;	/* [+1] */
3571	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
3572	sc->tssi_2ghz[6] = val & 0xff;	/* [+2] */
3573	sc->tssi_2ghz[7] = val >> 8;	/* [+3] */
3574	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
3575	sc->tssi_2ghz[8] = val & 0xff;	/* [+4] */
3576	sc->step_2ghz = val >> 8;
3577	DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3578	    "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
3579	    sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
3580	    sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
3581	    sc->tssi_2ghz[8], sc->step_2ghz));
3582	/* check that ref value is correct, otherwise disable calibration */
3583	if (sc->tssi_2ghz[4] == 0xff)
3584		sc->calib_2ghz = 0;
3585
3586	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
3587	sc->tssi_5ghz[0] = val & 0xff;	/* [-4] */
3588	sc->tssi_5ghz[1] = val >> 8;	/* [-3] */
3589	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
3590	sc->tssi_5ghz[2] = val & 0xff;	/* [-2] */
3591	sc->tssi_5ghz[3] = val >> 8;	/* [-1] */
3592	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
3593	sc->tssi_5ghz[4] = val & 0xff;	/* [+0] */
3594	sc->tssi_5ghz[5] = val >> 8;	/* [+1] */
3595	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
3596	sc->tssi_5ghz[6] = val & 0xff;	/* [+2] */
3597	sc->tssi_5ghz[7] = val >> 8;	/* [+3] */
3598	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
3599	sc->tssi_5ghz[8] = val & 0xff;	/* [+4] */
3600	sc->step_5ghz = val >> 8;
3601	DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3602	    "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
3603	    sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
3604	    sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
3605	    sc->tssi_5ghz[8], sc->step_5ghz));
3606	/* check that ref value is correct, otherwise disable calibration */
3607	if (sc->tssi_5ghz[4] == 0xff)
3608		sc->calib_5ghz = 0;
3609
3610	/* read RSSI offsets and LNA gains from EEPROM */
3611	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
3612	sc->rssi_2ghz[0] = val & 0xff;	/* Ant A */
3613	sc->rssi_2ghz[1] = val >> 8;	/* Ant B */
3614	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
3615	if (sc->mac_ver >= 0x3071) {
3616		/*
3617		 * On RT3090 chips (limited to 2 Rx chains), this ROM
3618		 * field contains the Tx mixer gain for the 2GHz band.
3619		 */
3620		if ((val & 0xff) != 0xff)
3621			sc->txmixgain_2ghz = val & 0x7;
3622		DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
3623	} else
3624		sc->rssi_2ghz[2] = val & 0xff;	/* Ant C */
3625	sc->lna[2] = val >> 8;		/* channel group 2 */
3626
3627	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
3628	sc->rssi_5ghz[0] = val & 0xff;	/* Ant A */
3629	sc->rssi_5ghz[1] = val >> 8;	/* Ant B */
3630	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
3631	sc->rssi_5ghz[2] = val & 0xff;	/* Ant C */
3632	sc->lna[3] = val >> 8;		/* channel group 3 */
3633
3634	val = rt2860_srom_read(sc, RT2860_EEPROM_LNA);
3635	if (sc->mac_ver >= 0x3071)
3636		sc->lna[0] = RT3090_DEF_LNA;
3637	else				/* channel group 0 */
3638		sc->lna[0] = val & 0xff;
3639	sc->lna[1] = val >> 8;		/* channel group 1 */
3640
3641	/* fix broken 5GHz LNA entries */
3642	if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
3643		DPRINTF(("invalid LNA for channel group %d\n", 2));
3644		sc->lna[2] = sc->lna[1];
3645	}
3646	if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
3647		DPRINTF(("invalid LNA for channel group %d\n", 3));
3648		sc->lna[3] = sc->lna[1];
3649	}
3650
3651	/* fix broken RSSI offset entries */
3652	for (ant = 0; ant < 3; ant++) {
3653		if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
3654			DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
3655			    ant + 1, sc->rssi_2ghz[ant]));
3656			sc->rssi_2ghz[ant] = 0;
3657		}
3658		if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
3659			DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
3660			    ant + 1, sc->rssi_5ghz[ant]));
3661			sc->rssi_5ghz[ant] = 0;
3662		}
3663	}
3664
3665	return 0;
3666}
3667
3668static int
3669rt2860_bbp_init(struct rt2860_softc *sc)
3670{
3671	int i, ntries;
3672
3673	/* wait for BBP to wake up */
3674	for (ntries = 0; ntries < 20; ntries++) {
3675		uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
3676		if (bbp0 != 0 && bbp0 != 0xff)
3677			break;
3678	}
3679	if (ntries == 20) {
3680		device_printf(sc->sc_dev,
3681		    "timeout waiting for BBP to wake up\n");
3682		return (ETIMEDOUT);
3683	}
3684
3685	/* initialize BBP registers to default values */
3686	if (sc->mac_ver >= 0x5390)
3687		rt5390_bbp_init(sc);
3688	else {
3689		for (i = 0; i < nitems(rt2860_def_bbp); i++) {
3690			rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
3691			    rt2860_def_bbp[i].val);
3692		}
3693	}
3694
3695	/* fix BBP84 for RT2860E */
3696	if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
3697		rt2860_mcu_bbp_write(sc, 84, 0x19);
3698
3699	if (sc->mac_ver >= 0x3071) {
3700		rt2860_mcu_bbp_write(sc, 79, 0x13);
3701		rt2860_mcu_bbp_write(sc, 80, 0x05);
3702		rt2860_mcu_bbp_write(sc, 81, 0x33);
3703	} else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
3704		rt2860_mcu_bbp_write(sc, 69, 0x16);
3705		rt2860_mcu_bbp_write(sc, 73, 0x12);
3706	}
3707
3708	return 0;
3709}
3710
3711static void
3712rt5390_bbp_init(struct rt2860_softc *sc)
3713{
3714	uint8_t bbp;
3715	int i;
3716
3717	/* Apply maximum likelihood detection for 2 stream case. */
3718	if (sc->nrxchains > 1) {
3719		bbp = rt2860_mcu_bbp_read(sc, 105);
3720		rt2860_mcu_bbp_write(sc, 105, bbp | RT5390_MLD);
3721	}
3722
3723	/* Avoid data lost and CRC error. */
3724	bbp = rt2860_mcu_bbp_read(sc, 4);
3725	rt2860_mcu_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
3726
3727	for (i = 0; i < nitems(rt5390_def_bbp); i++) {
3728		rt2860_mcu_bbp_write(sc, rt5390_def_bbp[i].reg,
3729		    rt5390_def_bbp[i].val);
3730	}
3731
3732	if (sc->mac_ver == 0x5392) {
3733		rt2860_mcu_bbp_write(sc, 84, 0x9a);
3734		rt2860_mcu_bbp_write(sc, 95, 0x9a);
3735		rt2860_mcu_bbp_write(sc, 98, 0x12);
3736		rt2860_mcu_bbp_write(sc, 106, 0x05);
3737		rt2860_mcu_bbp_write(sc, 134, 0xd0);
3738		rt2860_mcu_bbp_write(sc, 135, 0xf6);
3739	}
3740
3741	bbp = rt2860_mcu_bbp_read(sc, 152);
3742	rt2860_mcu_bbp_write(sc, 152, bbp | 0x80);
3743
3744	/* Disable hardware antenna diversity. */
3745	if (sc->mac_ver == 0x5390)
3746		rt2860_mcu_bbp_write(sc, 154, 0);
3747}
3748
3749static int
3750rt2860_txrx_enable(struct rt2860_softc *sc)
3751{
3752	struct ieee80211com *ic = &sc->sc_ic;
3753	uint32_t tmp;
3754	int ntries;
3755
3756	/* enable Tx/Rx DMA engine */
3757	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
3758	RAL_BARRIER_READ_WRITE(sc);
3759	for (ntries = 0; ntries < 200; ntries++) {
3760		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3761		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3762			break;
3763		DELAY(1000);
3764	}
3765	if (ntries == 200) {
3766		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3767		return ETIMEDOUT;
3768	}
3769
3770	DELAY(50);
3771
3772	tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
3773	    RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
3774	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3775
3776	/* set Rx filter */
3777	tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
3778	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
3779		tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
3780		    RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
3781		    RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
3782		    RT2860_DROP_CFACK | RT2860_DROP_CFEND;
3783		if (ic->ic_opmode == IEEE80211_M_STA)
3784			tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
3785	}
3786	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
3787
3788	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
3789	    RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
3790
3791	return 0;
3792}
3793
3794static void
3795rt2860_init(void *arg)
3796{
3797	struct rt2860_softc *sc = arg;
3798	struct ieee80211com *ic = &sc->sc_ic;
3799
3800	RAL_LOCK(sc);
3801	rt2860_init_locked(sc);
3802	RAL_UNLOCK(sc);
3803
3804	if (sc->sc_flags & RT2860_RUNNING)
3805		ieee80211_start_all(ic);
3806}
3807
3808static void
3809rt2860_init_locked(struct rt2860_softc *sc)
3810{
3811	struct ieee80211com *ic = &sc->sc_ic;
3812	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
3813	uint32_t tmp;
3814	uint8_t bbp1, bbp3;
3815	int i, qid, ridx, ntries, error;
3816
3817	RAL_LOCK_ASSERT(sc);
3818
3819	if (sc->rfswitch) {
3820		/* hardware has a radio switch on GPIO pin 2 */
3821		if (!(RAL_READ(sc, RT2860_GPIO_CTRL) & (1 << 2))) {
3822			device_printf(sc->sc_dev,
3823			    "radio is disabled by hardware switch\n");
3824#ifdef notyet
3825			rt2860_stop_locked(sc);
3826			return;
3827#endif
3828		}
3829	}
3830	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE);
3831
3832	/* disable DMA */
3833	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3834	tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
3835	    RT2860_TX_DMA_EN);
3836	tmp |= RT2860_TX_WB_DDONE;
3837	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3838
3839	/* reset DMA indexes */
3840	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, RT2860_RST_DRX_IDX0 |
3841	    RT2860_RST_DTX_IDX5 | RT2860_RST_DTX_IDX4 | RT2860_RST_DTX_IDX3 |
3842	    RT2860_RST_DTX_IDX2 | RT2860_RST_DTX_IDX1 | RT2860_RST_DTX_IDX0);
3843
3844	/* PBF hardware reset */
3845	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3846	RAL_BARRIER_WRITE(sc);
3847	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3848
3849	if ((error = rt2860_load_microcode(sc)) != 0) {
3850		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
3851		rt2860_stop_locked(sc);
3852		return;
3853	}
3854
3855	rt2860_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);
3856
3857	/* init Tx power for all Tx rates (from EEPROM) */
3858	for (ridx = 0; ridx < 5; ridx++) {
3859		if (sc->txpow20mhz[ridx] == 0xffffffff)
3860			continue;
3861		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
3862	}
3863
3864	for (ntries = 0; ntries < 100; ntries++) {
3865		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3866		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3867			break;
3868		DELAY(1000);
3869	}
3870	if (ntries == 100) {
3871		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3872		rt2860_stop_locked(sc);
3873		return;
3874	}
3875	tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
3876	    RT2860_TX_DMA_EN);
3877	tmp |= RT2860_TX_WB_DDONE;
3878	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3879
3880	/* reset Rx ring and all 6 Tx rings */
3881	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
3882
3883	/* PBF hardware reset */
3884	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
3885	RAL_BARRIER_WRITE(sc);
3886	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
3887
3888	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE | RT2860_IO_RF_PE);
3889
3890	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
3891	RAL_BARRIER_WRITE(sc);
3892	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
3893
3894	for (i = 0; i < nitems(rt2860_def_mac); i++)
3895		RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
3896	if (sc->mac_ver >= 0x5390)
3897		RAL_WRITE(sc, RT2860_TX_SW_CFG0, 0x00000404);
3898	else if (sc->mac_ver >= 0x3071) {
3899		/* set delay of PA_PE assertion to 1us (unit of 0.25us) */
3900		RAL_WRITE(sc, RT2860_TX_SW_CFG0,
3901		    4 << RT2860_DLY_PAPE_EN_SHIFT);
3902	}
3903
3904	if (!(RAL_READ(sc, RT2860_PCI_CFG) & RT2860_PCI_CFG_PCI)) {
3905		sc->sc_flags |= RT2860_PCIE;
3906		/* PCIe has different clock cycle count than PCI */
3907		tmp = RAL_READ(sc, RT2860_US_CYC_CNT);
3908		tmp = (tmp & ~0xff) | 0x7d;
3909		RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp);
3910	}
3911
3912	/* wait while MAC is busy */
3913	for (ntries = 0; ntries < 100; ntries++) {
3914		if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG) &
3915		    (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
3916			break;
3917		DELAY(1000);
3918	}
3919	if (ntries == 100) {
3920		device_printf(sc->sc_dev, "timeout waiting for MAC\n");
3921		rt2860_stop_locked(sc);
3922		return;
3923	}
3924
3925	/* clear Host to MCU mailbox */
3926	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
3927	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
3928
3929	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
3930	DELAY(1000);
3931
3932	if ((error = rt2860_bbp_init(sc)) != 0) {
3933		rt2860_stop_locked(sc);
3934		return;
3935	}
3936
3937	/* clear RX WCID search table */
3938	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
3939	/* clear pairwise key table */
3940	RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048);
3941	/* clear IV/EIV table */
3942	RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512);
3943	/* clear WCID attribute table */
3944	RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256);
3945	/* clear shared key table */
3946	RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
3947	/* clear shared key mode */
3948	RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
3949
3950	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
3951	for (qid = 0; qid < 6; qid++) {
3952		RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
3953		RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
3954		RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
3955	}
3956
3957	/* init Rx ring */
3958	RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
3959	RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
3960	RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
3961
3962	/* setup maximum buffer sizes */
3963	RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
3964	    (MCLBYTES - sizeof (struct rt2860_rxwi) - 2));
3965
3966	for (ntries = 0; ntries < 100; ntries++) {
3967		tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
3968		if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
3969			break;
3970		DELAY(1000);
3971	}
3972	if (ntries == 100) {
3973		device_printf(sc->sc_dev, "timeout waiting for DMA engine\n");
3974		rt2860_stop_locked(sc);
3975		return;
3976	}
3977	tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
3978	    RT2860_TX_DMA_EN);
3979	tmp |= RT2860_TX_WB_DDONE;
3980	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
3981
3982	/* disable interrupts mitigation */
3983	RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
3984
3985	/* write vendor-specific BBP values (from EEPROM) */
3986	for (i = 0; i < 8; i++) {
3987		if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
3988			continue;
3989		rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
3990	}
3991
3992	/* select Main antenna for 1T1R devices */
3993	if (sc->rf_rev == RT3070_RF_2020 ||
3994	    sc->rf_rev == RT3070_RF_3020 ||
3995	    sc->rf_rev == RT3070_RF_3320 ||
3996	    sc->mac_ver == 0x5390)
3997		rt3090_set_rx_antenna(sc, 0);
3998
3999	/* send LEDs operating mode to microcontroller */
4000	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0], 0);
4001	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1], 0);
4002	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2], 0);
4003
4004	if (sc->mac_ver >= 0x5390)
4005		rt5390_rf_init(sc);
4006	else if (sc->mac_ver >= 0x3071) {
4007		if ((error = rt3090_rf_init(sc)) != 0) {
4008			rt2860_stop_locked(sc);
4009			return;
4010		}
4011	}
4012
4013	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP, 0x02ff, 1);
4014	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP, 0, 1);
4015
4016	if (sc->mac_ver >= 0x5390)
4017		rt5390_rf_wakeup(sc);
4018	else if (sc->mac_ver >= 0x3071)
4019		rt3090_rf_wakeup(sc);
4020
4021	/* disable non-existing Rx chains */
4022	bbp3 = rt2860_mcu_bbp_read(sc, 3);
4023	bbp3 &= ~(1 << 3 | 1 << 4);
4024	if (sc->nrxchains == 2)
4025		bbp3 |= 1 << 3;
4026	else if (sc->nrxchains == 3)
4027		bbp3 |= 1 << 4;
4028	rt2860_mcu_bbp_write(sc, 3, bbp3);
4029
4030	/* disable non-existing Tx chains */
4031	bbp1 = rt2860_mcu_bbp_read(sc, 1);
4032	if (sc->ntxchains == 1)
4033		bbp1 = (bbp1 & ~(1 << 3 | 1 << 4));
4034	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
4035		bbp1 = (bbp1 & ~(1 << 4)) | 1 << 3;
4036	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
4037		bbp1 = (bbp1 & ~(1 << 3)) | 1 << 4;
4038	rt2860_mcu_bbp_write(sc, 1, bbp1);
4039
4040	if (sc->mac_ver >= 0x3071)
4041		rt3090_rf_setup(sc);
4042
4043	/* select default channel */
4044	rt2860_switch_chan(sc, ic->ic_curchan);
4045
4046	/* reset RF from MCU */
4047	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
4048
4049	/* set RTS threshold */
4050	tmp = RAL_READ(sc, RT2860_TX_RTS_CFG);
4051	tmp &= ~0xffff00;
4052	tmp |= IEEE80211_RTS_DEFAULT << 8;
4053	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);
4054
4055	/* setup initial protection mode */
4056	rt2860_updateprot(sc);
4057
4058	/* turn radio LED on */
4059	rt2860_set_leds(sc, RT2860_LED_RADIO);
4060
4061	/* enable Tx/Rx DMA engine */
4062	if ((error = rt2860_txrx_enable(sc)) != 0) {
4063		rt2860_stop_locked(sc);
4064		return;
4065	}
4066
4067	/* clear pending interrupts */
4068	RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
4069	/* enable interrupts */
4070	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
4071
4072	if (sc->sc_flags & RT2860_ADVANCED_PS)
4073		rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);
4074
4075	sc->sc_flags |= RT2860_RUNNING;
4076
4077	callout_reset(&sc->watchdog_ch, hz, rt2860_watchdog, sc);
4078}
4079
4080static void
4081rt2860_stop(void *arg)
4082{
4083	struct rt2860_softc *sc = arg;
4084
4085	RAL_LOCK(sc);
4086	rt2860_stop_locked(sc);
4087	RAL_UNLOCK(sc);
4088}
4089
4090static void
4091rt2860_stop_locked(struct rt2860_softc *sc)
4092{
4093	uint32_t tmp;
4094	int qid;
4095
4096	if (sc->sc_flags & RT2860_RUNNING)
4097		rt2860_set_leds(sc, 0);	/* turn all LEDs off */
4098
4099	callout_stop(&sc->watchdog_ch);
4100	sc->sc_tx_timer = 0;
4101	sc->sc_flags &= ~RT2860_RUNNING;
4102
4103	/* disable interrupts */
4104	RAL_WRITE(sc, RT2860_INT_MASK, 0);
4105
4106	/* disable GP timer */
4107	rt2860_set_gp_timer(sc, 0);
4108
4109	/* disable Rx */
4110	tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL);
4111	tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
4112	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
4113
4114	/* reset adapter */
4115	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
4116	RAL_BARRIER_WRITE(sc);
4117	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
4118
4119	/* reset Tx and Rx rings (and reclaim TXWIs) */
4120	sc->qfullmsk = 0;
4121	for (qid = 0; qid < 6; qid++)
4122		rt2860_reset_tx_ring(sc, &sc->txq[qid]);
4123	rt2860_reset_rx_ring(sc, &sc->rxq);
4124}
4125
4126int
4127rt2860_load_microcode(struct rt2860_softc *sc)
4128{
4129	const struct firmware *fp;
4130	int ntries, error;
4131
4132	RAL_LOCK_ASSERT(sc);
4133
4134	RAL_UNLOCK(sc);
4135	fp = firmware_get("rt2860fw");
4136	RAL_LOCK(sc);
4137	if (fp == NULL) {
4138		device_printf(sc->sc_dev,
4139		    "unable to receive rt2860fw firmware image\n");
4140		return EINVAL;
4141	}
4142
4143	/* set "host program ram write selection" bit */
4144	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
4145	/* write microcode image */
4146	RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, fp->data, fp->datasize);
4147	/* kick microcontroller unit */
4148	RAL_WRITE(sc, RT2860_SYS_CTRL, 0);
4149	RAL_BARRIER_WRITE(sc);
4150	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
4151
4152	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
4153	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
4154
4155	/* wait until microcontroller is ready */
4156	RAL_BARRIER_READ_WRITE(sc);
4157	for (ntries = 0; ntries < 1000; ntries++) {
4158		if (RAL_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
4159			break;
4160		DELAY(1000);
4161	}
4162	if (ntries == 1000) {
4163		device_printf(sc->sc_dev,
4164		    "timeout waiting for MCU to initialize\n");
4165		error = ETIMEDOUT;
4166	} else
4167		error = 0;
4168
4169	firmware_put(fp, FIRMWARE_UNLOAD);
4170	return error;
4171}
4172
4173/*
4174 * This function is called periodically to adjust Tx power based on
4175 * temperature variation.
4176 */
4177#ifdef NOT_YET
4178static void
4179rt2860_calib(struct rt2860_softc *sc)
4180{
4181	struct ieee80211com *ic = &sc->sc_ic;
4182	const uint8_t *tssi;
4183	uint8_t step, bbp49;
4184	int8_t ridx, d;
4185
4186	/* read current temperature */
4187	bbp49 = rt2860_mcu_bbp_read(sc, 49);
4188
4189	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)) {
4190		tssi = &sc->tssi_2ghz[4];
4191		step = sc->step_2ghz;
4192	} else {
4193		tssi = &sc->tssi_5ghz[4];
4194		step = sc->step_5ghz;
4195	}
4196
4197	if (bbp49 < tssi[0]) {		/* lower than reference */
4198		/* use higher Tx power than default */
4199		for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
4200	} else if (bbp49 > tssi[0]) {	/* greater than reference */
4201		/* use lower Tx power than default */
4202		for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
4203	} else {
4204		/* use default Tx power */
4205		d = 0;
4206	}
4207	d *= step;
4208
4209	DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
4210
4211	/* write adjusted Tx power values for each Tx rate */
4212	for (ridx = 0; ridx < 5; ridx++) {
4213		if (sc->txpow20mhz[ridx] == 0xffffffff)
4214			continue;
4215		RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),
4216		    b4inc(sc->txpow20mhz[ridx], d));
4217	}
4218}
4219#endif
4220
4221static void
4222rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
4223{
4224	uint32_t tmp;
4225
4226	if (aux) {
4227		if (sc->mac_ver == 0x5390) {
4228			rt2860_mcu_bbp_write(sc, 152,
4229			    rt2860_mcu_bbp_read(sc, 152) & ~0x80);
4230		} else {
4231			tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
4232			RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp & ~RT2860_C);
4233			tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
4234			RAL_WRITE(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
4235		}
4236	} else {
4237		if (sc->mac_ver == 0x5390) {
4238			rt2860_mcu_bbp_write(sc, 152,
4239			    rt2860_mcu_bbp_read(sc, 152) | 0x80);
4240		} else {
4241			tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
4242			RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp | RT2860_C);
4243			tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
4244			RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
4245		}
4246	}
4247}
4248
4249static void
4250rt2860_switch_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
4251{
4252	struct ieee80211com *ic = &sc->sc_ic;
4253	u_int chan, group;
4254
4255	chan = ieee80211_chan2ieee(ic, c);
4256	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
4257		return;
4258
4259	if (sc->mac_ver >= 0x5390)
4260		rt5390_set_chan(sc, chan);
4261	else if (sc->mac_ver >= 0x3071)
4262		rt3090_set_chan(sc, chan);
4263	else
4264		rt2860_set_chan(sc, chan);
4265
4266	/* determine channel group */
4267	if (chan <= 14)
4268		group = 0;
4269	else if (chan <= 64)
4270		group = 1;
4271	else if (chan <= 128)
4272		group = 2;
4273	else
4274		group = 3;
4275
4276	/* XXX necessary only when group has changed! */
4277	if (sc->mac_ver < 0x5390)
4278		rt2860_select_chan_group(sc, group);
4279
4280	DELAY(1000);
4281}
4282
4283static int
4284rt2860_setup_beacon(struct rt2860_softc *sc, struct ieee80211vap *vap)
4285{
4286	struct ieee80211com *ic = vap->iv_ic;
4287	struct rt2860_txwi txwi;
4288	struct mbuf *m;
4289	int ridx;
4290
4291	if ((m = ieee80211_beacon_alloc(vap->iv_bss)) == NULL)
4292		return ENOBUFS;
4293
4294	memset(&txwi, 0, sizeof txwi);
4295	txwi.wcid = 0xff;
4296	txwi.len = htole16(m->m_pkthdr.len);
4297	/* send beacons at the lowest available rate */
4298	ridx = IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan) ?
4299	    RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
4300	txwi.phy = htole16(rt2860_rates[ridx].mcs);
4301	if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4302		txwi.phy |= htole16(RT2860_PHY_OFDM);
4303	txwi.txop = RT2860_TX_TXOP_HT;
4304	txwi.flags = RT2860_TX_TS;
4305	txwi.xflags = RT2860_TX_NSEQ;
4306
4307	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),
4308	    (uint8_t *)&txwi, sizeof txwi);
4309	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
4310	    mtod(m, uint8_t *), m->m_pkthdr.len);
4311
4312	m_freem(m);
4313
4314	return 0;
4315}
4316
4317static void
4318rt2860_enable_tsf_sync(struct rt2860_softc *sc)
4319{
4320	struct ieee80211com *ic = &sc->sc_ic;
4321	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
4322	uint32_t tmp;
4323
4324	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
4325
4326	tmp &= ~0x1fffff;
4327	tmp |= vap->iv_bss->ni_intval * 16;
4328	tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
4329	if (vap->iv_opmode == IEEE80211_M_STA) {
4330		/*
4331		 * Local TSF is always updated with remote TSF on beacon
4332		 * reception.
4333		 */
4334		tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
4335	}
4336	else if (vap->iv_opmode == IEEE80211_M_IBSS ||
4337	    vap->iv_opmode == IEEE80211_M_MBSS) {
4338		tmp |= RT2860_BCN_TX_EN;
4339		/*
4340		 * Local TSF is updated with remote TSF on beacon reception
4341		 * only if the remote TSF is greater than local TSF.
4342		 */
4343		tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
4344	} else if (vap->iv_opmode == IEEE80211_M_HOSTAP) {
4345		tmp |= RT2860_BCN_TX_EN;
4346		/* SYNC with nobody */
4347		tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
4348	}
4349
4350	RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
4351}
4352