/usr/src/sys/dev/ic/rt2860.c

Bug Summary

File:	dev/ic/rt2860.c
Warning:	line 764, column 9 Result of 'malloc' is converted to a pointer of type 'struct ieee80211_node', which is incompatible with sizeof operand type 'struct rt2860_node'

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name rt2860.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -ffreestanding -mcmodel=kernel -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -target-feature -sse2 -target-feature -sse -target-feature -3dnow -target-feature -mmx -target-feature +save-args -target-feature +retpoline-external-thunk -disable-red-zone -no-implicit-float -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -nostdsysteminc -nobuiltininc -resource-dir /usr/local/llvm16/lib/clang/16 -I /usr/src/sys -I /usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -I /usr/src/sys/arch -I /usr/src/sys/dev/pci/drm/include -I /usr/src/sys/dev/pci/drm/include/uapi -I /usr/src/sys/dev/pci/drm/amd/include/asic_reg -I /usr/src/sys/dev/pci/drm/amd/include -I /usr/src/sys/dev/pci/drm/amd/amdgpu -I /usr/src/sys/dev/pci/drm/amd/display -I /usr/src/sys/dev/pci/drm/amd/display/include -I /usr/src/sys/dev/pci/drm/amd/display/dc -I /usr/src/sys/dev/pci/drm/amd/display/amdgpu_dm -I /usr/src/sys/dev/pci/drm/amd/pm/inc -I /usr/src/sys/dev/pci/drm/amd/pm/legacy-dpm -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu11 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu12 -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/smu13 -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/inc -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/hwmgr -I /usr/src/sys/dev/pci/drm/amd/pm/powerplay/smumgr -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc -I /usr/src/sys/dev/pci/drm/amd/pm/swsmu/inc/pmfw_if -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc -I /usr/src/sys/dev/pci/drm/amd/display/dc/inc/hw -I /usr/src/sys/dev/pci/drm/amd/display/dc/clk_mgr -I /usr/src/sys/dev/pci/drm/amd/display/modules/inc -I /usr/src/sys/dev/pci/drm/amd/display/modules/hdcp -I /usr/src/sys/dev/pci/drm/amd/display/dmub/inc -I /usr/src/sys/dev/pci/drm/i915 -D DDB -D DIAGNOSTIC -D KTRACE -D ACCOUNTING -D KMEMSTATS -D PTRACE -D POOL_DEBUG -D CRYPTO -D SYSVMSG -D SYSVSEM -D SYSVSHM -D UVM_SWAP_ENCRYPT -D FFS -D FFS2 -D FFS_SOFTUPDATES -D UFS_DIRHASH -D QUOTA -D EXT2FS -D MFS -D NFSCLIENT -D NFSSERVER -D CD9660 -D UDF -D MSDOSFS -D FIFO -D FUSE -D SOCKET_SPLICE -D TCP_ECN -D TCP_SIGNATURE -D INET6 -D IPSEC -D PPP_BSDCOMP -D PPP_DEFLATE -D PIPEX -D MROUTING -D MPLS -D BOOT_CONFIG -D USER_PCICONF -D APERTURE -D MTRR -D NTFS -D SUSPEND -D HIBERNATE -D PCIVERBOSE -D USBVERBOSE -D WSDISPLAY_COMPAT_USL -D WSDISPLAY_COMPAT_RAWKBD -D WSDISPLAY_DEFAULTSCREENS=6 -D X86EMU -D ONEWIREVERBOSE -D MULTIPROCESSOR -D MAXUSERS=80 -D _KERNEL -O2 -Wno-pointer-sign -Wno-address-of-packed-member -Wno-constant-conversion -Wno-unused-but-set-variable -Wno-gnu-folding-constant -fdebug-compilation-dir=/usr/src/sys/arch/amd64/compile/GENERIC.MP/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -o /home/ben/Projects/scan/2024-01-11-110808-61670-1 -x c /usr/src/sys/dev/ic/rt2860.c

1	/* $OpenBSD: rt2860.c,v 1.102 2022/04/21 21:03:02 stsp Exp $ */
2
3	/*-
4	* Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
5	*
6	* Permission to use, copy, modify, and distribute this software for any
7	* purpose with or without fee is hereby granted, provided that the above
8	* copyright notice and this permission notice appear in all copies.
9	*
10	* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11	* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12	* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13	* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14	* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15	* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16	* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17	*/
18
19	/*-
20	* Ralink Technology RT2860/RT3090/RT3290/RT3390/RT3562/RT5390/
21	* RT5392 chipset driver
22	* http://www.ralinktech.com/
23	*/
24
25	#include "bpfilter.h"
26
27	#include <sys/param.h>
28	#include <sys/sockio.h>
29	#include <sys/mbuf.h>
30	#include <sys/kernel.h>
31	#include <sys/socket.h>
32	#include <sys/systm.h>
33	#include <sys/malloc.h>
34	#include <sys/queue.h>
35	#include <sys/timeout.h>
36	#include <sys/conf.h>
37	#include <sys/device.h>
38	#include <sys/endian.h>
39
40	#include <machine/bus.h>
41	#include <machine/intr.h>
42
43	#if NBPFILTER1 > 0
44	#include <net/bpf.h>
45	#endif
46	#include <net/if.h>
47	#include <net/if_dl.h>
48	#include <net/if_media.h>
49
50	#include <netinet/in.h>
51	#include <netinet/if_ether.h>
52
53	#include <net80211/ieee80211_var.h>
54	#include <net80211/ieee80211_amrr.h>
55	#include <net80211/ieee80211_radiotap.h>
56
57	#include <dev/ic/rt2860var.h>
58	#include <dev/ic/rt2860reg.h>
59
60	#include <dev/pci/pcidevs.h>
61
62	#ifdef RAL_DEBUG
63	#define DPRINTF(x) do { if (rt2860_debug > 0) printf x; } while (0)
64	#define DPRINTFN(n, x) do { if (rt2860_debug >= (n)) printf x; } while (0)
65	int rt2860_debug = 0;
66	#else
67	#define DPRINTF(x)
68	#define DPRINTFN(n, x)
69	#endif
70
71	void rt2860_attachhook(struct device *);
72	int rt2860_alloc_tx_ring(struct rt2860_softc *,
73	struct rt2860_tx_ring *);
74	void rt2860_reset_tx_ring(struct rt2860_softc *,
75	struct rt2860_tx_ring *);
76	void rt2860_free_tx_ring(struct rt2860_softc *,
77	struct rt2860_tx_ring *);
78	int rt2860_alloc_tx_pool(struct rt2860_softc *);
79	void rt2860_free_tx_pool(struct rt2860_softc *);
80	int rt2860_alloc_rx_ring(struct rt2860_softc *,
81	struct rt2860_rx_ring *);
82	void rt2860_reset_rx_ring(struct rt2860_softc *,
83	struct rt2860_rx_ring *);
84	void rt2860_free_rx_ring(struct rt2860_softc *,
85	struct rt2860_rx_ring *);
86	struct ieee80211_node rt2860_node_alloc(struct ieee80211com );
87	int rt2860_media_change(struct ifnet *);
88	void rt2860_iter_func(void , struct ieee80211_node );
89	void rt2860_updatestats(struct rt2860_softc *);
90	void rt2860_newassoc(struct ieee80211com , struct ieee80211_node ,
91	int);
92	void rt2860_node_leave(struct ieee80211com *,
93	struct ieee80211_node *);
94	int rt2860_ampdu_rx_start(struct ieee80211com *,
95	struct ieee80211_node *, uint8_t);
96	void rt2860_ampdu_rx_stop(struct ieee80211com *,
97	struct ieee80211_node *, uint8_t);
98	int rt2860_newstate(struct ieee80211com *, enum ieee80211_state,
99	int);
100	uint16_t rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
101	uint16_t rt3290_efuse_read_2(struct rt2860_softc *, uint16_t);
102	uint16_t rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
103	void rt2860_intr_coherent(struct rt2860_softc *);
104	void rt2860_drain_stats_fifo(struct rt2860_softc *);
105	void rt2860_tx_intr(struct rt2860_softc *, int);
106	void rt2860_rx_intr(struct rt2860_softc *);
107	void rt2860_tbtt_intr(struct rt2860_softc *);
108	void rt2860_gp_intr(struct rt2860_softc *);
109	int rt2860_tx(struct rt2860_softc , struct mbuf ,
110	struct ieee80211_node *);
111	void rt2860_start(struct ifnet *);
112	void rt2860_watchdog(struct ifnet *);
113	int rt2860_ioctl(struct ifnet *, u_long, caddr_t);
114	void rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
115	uint8_t rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
116	void rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
117	uint8_t rt3090_rf_read(struct rt2860_softc *, uint8_t);
118	void rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
119	int rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
120	void rt2860_enable_mrr(struct rt2860_softc *);
121	void rt2860_set_txpreamble(struct rt2860_softc *);
122	void rt2860_set_basicrates(struct rt2860_softc *);
123	void rt2860_select_chan_group(struct rt2860_softc *, int);
124	void rt2860_set_chan(struct rt2860_softc *, u_int);
125	void rt3090_set_chan(struct rt2860_softc *, u_int);
126	void rt5390_set_chan(struct rt2860_softc *, u_int);
127	int rt3090_rf_init(struct rt2860_softc *);
128	void rt5390_rf_init(struct rt2860_softc *);
129	void rt3090_rf_wakeup(struct rt2860_softc *);
130	void rt5390_rf_wakeup(struct rt2860_softc *);
131	int rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
132	uint8_t *);
133	void rt3090_rf_setup(struct rt2860_softc *);
134	void rt2860_set_leds(struct rt2860_softc *, uint16_t);
135	void rt2860_set_gp_timer(struct rt2860_softc *, int);
136	void rt2860_set_bssid(struct rt2860_softc , const uint8_t );
137	void rt2860_set_macaddr(struct rt2860_softc , const uint8_t );
138	void rt2860_updateslot(struct ieee80211com *);
139	void rt2860_updateprot(struct ieee80211com *);
140	void rt2860_updateedca(struct ieee80211com *);
141	int rt2860_set_key(struct ieee80211com , struct ieee80211_node ,
142	struct ieee80211_key *);
143	void rt2860_delete_key(struct ieee80211com *,
144	struct ieee80211_node , struct ieee80211_key );
145	#if NBPFILTER1 > 0
146	int8_t rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
147	#endif
148	const char * rt2860_get_rf(uint16_t);
149	int rt2860_read_eeprom(struct rt2860_softc *);
150	int rt2860_bbp_init(struct rt2860_softc *);
151	void rt5390_bbp_init(struct rt2860_softc *);
152	int rt3290_wlan_enable(struct rt2860_softc *);
153	int rt2860_txrx_enable(struct rt2860_softc *);
154	int rt2860_init(struct ifnet *);
155	void rt2860_stop(struct ifnet *, int);
156	int rt2860_load_microcode(struct rt2860_softc *);
157	void rt2860_calib(struct rt2860_softc *);
158	void rt3090_set_rx_antenna(struct rt2860_softc *, int);
159	void rt2860_switch_chan(struct rt2860_softc *,
160	struct ieee80211_channel *);
161	#ifndef IEEE80211_STA_ONLY
162	int rt2860_setup_beacon(struct rt2860_softc *);
163	#endif
164	void rt2860_enable_tsf_sync(struct rt2860_softc *);
165
166	static const struct {
167	uint32_t reg;
168	uint32_t val;
169	} rt2860_def_mac[] = {
170	RT2860_DEF_MAC{ 0x042c, 0xf8f0e8e0 }, { 0x0430, 0x6f77d0c8 }, { 0x1408, 0x0000013f }, { 0x140c, 0x00008003 }, { 0x1004, 0x00000000 }, { 0x1400, 0x00017f97 }, { 0x1104, 0x00000209 }, { 0x1330, 0x00000000 } , { 0x1334, 0x00080606 }, { 0x1350, 0x00001020 }, { 0x1348, 0x000a2090 }, { 0x1018, 0x00001f00 }, { 0x102c, 0x7f031e46 }, { 0x0214, 0x00002273 }, { 0x0218, 0x00002344 }, { 0x021c, 0x000034aa } , { 0x040c, 0x1f3fbf9f }, { 0x134c, 0x47d01f0f }, { 0x1404, 0x00000013 }, { 0x1364, 0x05740003 }, { 0x1368, 0x05740003 }, { 0x1374, 0x01744004 }, { 0x1378, 0x03f44084 }, { 0x136c, 0x01744004 } , { 0x1370, 0x03f54084 }, { 0x1340, 0x0000583f }, { 0x1608, 0x00000002 }, { 0x1344, 0x00092b20 }, { 0x1380, 0x002400ca }, { 0x1100, 0x33a41010 }, { 0x1204, 0x00000003 }
171	};
172
173	static const struct {
174	uint8_t reg;
175	uint8_t val;
176	} rt2860_def_bbp[] = {
177	RT2860_DEF_BBP{ 65, 0x2c }, { 66, 0x38 }, { 68, 0x0b }, { 69, 0x12 }, { 70, 0x0a }, { 73, 0x10 }, { 81, 0x37 }, { 82, 0x62 }, { 83, 0x6a }, { 84, 0x99 }, { 86, 0x00 }, { 91, 0x04 }, { 92, 0x00 }, { 103, 0x00 }, { 105, 0x05 }, { 106, 0x35 }
178	},rt3290_def_bbp[] = {
179	RT3290_DEF_BBP{ 31, 0x08 }, { 68, 0x0b }, { 73, 0x13 }, { 75, 0x46 }, { 76, 0x28 }, { 77, 0x59 }, { 82, 0x62 }, { 83, 0x7a }, { 84, 0x9a }, { 86, 0x38 }, { 91, 0x04 }, { 103, 0xc0 }, { 104, 0x92 }, { 105, 0x3c }, { 106, 0x03 }, { 128, 0x12 }
180	},rt5390_def_bbp[] = {
181	RT5390_DEF_BBP{ 31, 0x08 }, { 65, 0x2c }, { 66, 0x38 }, { 68, 0x0b }, { 69, 0x0d }, { 70, 0x06 }, { 73, 0x13 }, { 75, 0x46 }, { 76, 0x28 }, { 77, 0x59 }, { 81, 0x37 }, { 82, 0x62 }, { 83, 0x7a }, { 84, 0x9a }, { 86, 0x38 }, { 91, 0x04 }, { 92, 0x02 }, { 103, 0xc0 }, { 104, 0x92 }, { 105, 0x3c }, { 106, 0x03 }, { 128, 0x12 }
182	};
183
184	static const struct rfprog {
185	uint8_t chan;
186	uint32_t r1, r2, r3, r4;
187	} rt2860_rf2850[] = {
188	RT2860_RF2850{ 1, 0x100bb3, 0x1301e1, 0x05a014, 0x001402 }, { 2, 0x100bb3, 0x1301e1, 0x05a014, 0x001407 }, { 3, 0x100bb3, 0x1301e2, 0x05a014 , 0x001402 }, { 4, 0x100bb3, 0x1301e2, 0x05a014, 0x001407 }, { 5, 0x100bb3, 0x1301e3, 0x05a014, 0x001402 }, { 6, 0x100bb3, 0x1301e3 , 0x05a014, 0x001407 }, { 7, 0x100bb3, 0x1301e4, 0x05a014, 0x001402 }, { 8, 0x100bb3, 0x1301e4, 0x05a014, 0x001407 }, { 9, 0x100bb3 , 0x1301e5, 0x05a014, 0x001402 }, { 10, 0x100bb3, 0x1301e5, 0x05a014 , 0x001407 }, { 11, 0x100bb3, 0x1301e6, 0x05a014, 0x001402 }, { 12, 0x100bb3, 0x1301e6, 0x05a014, 0x001407 }, { 13, 0x100bb3 , 0x1301e7, 0x05a014, 0x001402 }, { 14, 0x100bb3, 0x1301e8, 0x05a014 , 0x001404 }, { 36, 0x100bb3, 0x130266, 0x056014, 0x001408 }, { 38, 0x100bb3, 0x130267, 0x056014, 0x001404 }, { 40, 0x100bb2 , 0x1301a0, 0x056014, 0x001400 }, { 44, 0x100bb2, 0x1301a0, 0x056014 , 0x001408 }, { 46, 0x100bb2, 0x1301a1, 0x056014, 0x001402 }, { 48, 0x100bb2, 0x1301a1, 0x056014, 0x001406 }, { 52, 0x100bb2 , 0x1301a2, 0x056014, 0x001404 }, { 54, 0x100bb2, 0x1301a2, 0x056014 , 0x001408 }, { 56, 0x100bb2, 0x1301a3, 0x056014, 0x001402 }, { 60, 0x100bb2, 0x1301a4, 0x056014, 0x001400 }, { 62, 0x100bb2 , 0x1301a4, 0x056014, 0x001404 }, { 64, 0x100bb2, 0x1301a4, 0x056014 , 0x001408 }, { 100, 0x100bb2, 0x1301ac, 0x05e014, 0x001400 } , { 102, 0x100bb2, 0x1701ac, 0x15e014, 0x001404 }, { 104, 0x100bb2 , 0x1701ac, 0x15e014, 0x001408 }, { 108, 0x100bb3, 0x17028c, 0x15e014 , 0x001404 }, { 110, 0x100bb3, 0x13028d, 0x05e014, 0x001400 } , { 112, 0x100bb3, 0x13028d, 0x05e014, 0x001406 }, { 116, 0x100bb3 , 0x13028e, 0x05e014, 0x001408 }, { 118, 0x100bb3, 0x13028f, 0x05e014 , 0x001404 }, { 120, 0x100bb1, 0x1300e0, 0x05e014, 0x001400 } , { 124, 0x100bb1, 0x1300e0, 0x05e014, 0x001404 }, { 126, 0x100bb1 , 0x1300e0, 0x05e014, 0x001406 }, { 128, 0x100bb1, 0x1300e0, 0x05e014 , 0x001408 }, { 132, 0x100bb1, 0x1300e1, 0x05e014, 0x001402 } , { 134, 0x100bb1, 0x1300e1, 0x05e014, 0x001404 }, { 136, 0x100bb1 , 0x1300e1, 0x05e014, 0x001406 }, { 140, 0x100bb1, 0x1300e2, 0x05e014 , 0x001400 }, { 149, 0x100bb1, 0x1300e2, 0x05e014, 0x001409 } , { 151, 0x100bb1, 0x1300e3, 0x05e014, 0x001401 }, { 153, 0x100bb1 , 0x1300e3, 0x05e014, 0x001403 }, { 157, 0x100bb1, 0x1300e3, 0x05e014 , 0x001407 }, { 159, 0x100bb1, 0x1300e3, 0x05e014, 0x001409 } , { 161, 0x100bb1, 0x1300e4, 0x05e014, 0x001401 }, { 165, 0x100bb1 , 0x1300e4, 0x05e014, 0x001405 }, { 167, 0x100bb1, 0x1300f4, 0x05e014 , 0x001407 }, { 169, 0x100bb1, 0x1300f4, 0x05e014, 0x001409 } , { 171, 0x100bb1, 0x1300f5, 0x05e014, 0x001401 }, { 173, 0x100bb1 , 0x1300f5, 0x05e014, 0x001403 }
189	};
190
191	struct {
192	uint8_t n, r, k;
193	} rt3090_freqs[] = {
194	RT3070_RF3052{ 0xf1, 2, 2 }, { 0xf1, 2, 7 }, { 0xf2, 2, 2 }, { 0xf2, 2, 7 } , { 0xf3, 2, 2 }, { 0xf3, 2, 7 }, { 0xf4, 2, 2 }, { 0xf4, 2, 7 }, { 0xf5, 2, 2 }, { 0xf5, 2, 7 }, { 0xf6, 2, 2 }, { 0xf6, 2 , 7 }, { 0xf7, 2, 2 }, { 0xf8, 2, 4 }, { 0x56, 0, 4 }, { 0x56 , 0, 6 }, { 0x56, 0, 8 }, { 0x57, 0, 0 }, { 0x57, 0, 2 }, { 0x57 , 0, 4 }, { 0x57, 0, 8 }, { 0x57, 0, 10 }, { 0x58, 0, 0 }, { 0x58 , 0, 4 }, { 0x58, 0, 6 }, { 0x58, 0, 8 }, { 0x5b, 0, 8 }, { 0x5b , 0, 10 }, { 0x5c, 0, 0 }, { 0x5c, 0, 4 }, { 0x5c, 0, 6 }, { 0x5c , 0, 8 }, { 0x5d, 0, 0 }, { 0x5d, 0, 2 }, { 0x5d, 0, 4 }, { 0x5d , 0, 8 }, { 0x5d, 0, 10 }, { 0x5e, 0, 0 }, { 0x5e, 0, 4 }, { 0x5e , 0, 6 }, { 0x5e, 0, 8 }, { 0x5f, 0, 0 }, { 0x5f, 0, 9 }, { 0x5f , 0, 11 }, { 0x60, 0, 1 }, { 0x60, 0, 5 }, { 0x60, 0, 7 }, { 0x60 , 0, 9 }, { 0x61, 0, 1 }, { 0x61, 0, 3 }, { 0x61, 0, 5 }, { 0x61 , 0, 7 }, { 0x61, 0, 9 }
195	};
196
197	static const struct {
198	uint8_t reg;
199	uint8_t val;
200	} rt3090_def_rf[] = {
201	RT3070_DEF_RF{ 4, 0x40 }, { 5, 0x03 }, { 6, 0x02 }, { 7, 0x60 }, { 9, 0x0f }, { 10, 0x41 }, { 11, 0x21 }, { 12, 0x7b }, { 14, 0x90 }, { 15, 0x58 }, { 16, 0xb3 }, { 17, 0x92 }, { 18, 0x2c }, { 19, 0x02 }, { 20, 0xba }, { 21, 0xdb }, { 24, 0x16 }, { 25, 0x01 }, { 29, 0x1f }
202	}, rt3290_def_rf[] = {
203	RT3290_DEF_RF{ 1, 0x0f }, { 2, 0x80 }, { 3, 0x08 }, { 4, 0x00 }, { 6, 0xa0 }, { 8, 0xf3 }, { 9, 0x02 }, { 10, 0x53 }, { 11, 0x4a }, { 12 , 0x46 }, { 13, 0x9f }, { 18, 0x03 }, { 22, 0x20 }, { 25, 0x80 }, { 27, 0x09 }, { 29, 0x10 }, { 30, 0x10 }, { 31, 0x80 }, { 32, 0x80 }, { 33, 0x00 }, { 34, 0x05 }, { 35, 0x12 }, { 36, 0x00 }, { 38, 0x85 }, { 39, 0x1b }, { 40, 0x0b }, { 41, 0xbb }, { 42, 0xd5 }, { 43, 0x7b }, { 44, 0x0e }, { 45, 0xa2 }, { 46, 0x73 }, { 47, 0x00 }, { 48, 0x10 }, { 49, 0x98 }, { 52, 0x38 }, { 53, 0x00 }, { 54, 0x78 }, { 55, 0x43 }, { 56, 0x02 }, { 57, 0x80 }, { 58, 0x7f }, { 59, 0x09 }, { 60, 0x45 }, { 61, 0xc1 }
204	}, rt3572_def_rf[] = {
205	RT3572_DEF_RF{ 0, 0x70 }, { 1, 0x81 }, { 2, 0xf1 }, { 3, 0x02 }, { 4, 0x4c }, { 5, 0x05 }, { 6, 0x4a }, { 7, 0xd8 }, { 9, 0xc3 }, { 10, 0xf1 }, { 11, 0xb9 }, { 12, 0x70 }, { 13, 0x65 }, { 14, 0xa0 }, { 15, 0x53 }, { 16, 0x4c }, { 17, 0x23 }, { 18, 0xac }, { 19, 0x93 }, { 20, 0xb3 }, { 21, 0xd0 }, { 22, 0x00 }, { 23, 0x3c }, { 24, 0x16 }, { 25, 0x15 }, { 26, 0x85 }, { 27, 0x00 }, { 28, 0x00 }, { 29, 0x9b }, { 30, 0x09 }, { 31, 0x10 }
206	}, rt5390_def_rf[] = {
207	RT5390_DEF_RF{ 1, 0x0f }, { 2, 0x80 }, { 3, 0x88 }, { 5, 0x10 }, { 6, 0xa0 }, { 7, 0x00 }, { 10, 0x53 }, { 11, 0x4a }, { 12, 0x46 }, { 13 , 0x9f }, { 14, 0x00 }, { 15, 0x00 }, { 16, 0x00 }, { 18, 0x03 }, { 19, 0x00 }, { 20, 0x00 }, { 21, 0x00 }, { 22, 0x20 }, { 23, 0x00 }, { 24, 0x00 }, { 25, 0xc0 }, { 26, 0x00 }, { 27, 0x09 }, { 28, 0x00 }, { 29, 0x10 }, { 30, 0x10 }, { 31, 0x80 }, { 32, 0x80 }, { 33, 0x00 }, { 34, 0x07 }, { 35, 0x12 }, { 36, 0x00 }, { 37, 0x08 }, { 38, 0x85 }, { 39, 0x1b }, { 40, 0x0b }, { 41, 0xbb }, { 42, 0xd2 }, { 43, 0x9a }, { 44, 0x0e }, { 45, 0xa2 }, { 46, 0x7b }, { 47, 0x00 }, { 48, 0x10 }, { 49, 0x94 }, { 52, 0x38 }, { 53, 0x84 }, { 54, 0x78 }, { 55, 0x44 }, { 56, 0x22 }, { 57, 0x80 }, { 58, 0x7f }, { 59, 0x8f }, { 60, 0x45 }, { 61, 0xdd }, { 62, 0x00 }, { 63, 0x00 }
208	}, rt5392_def_rf[] = {
209	RT5392_DEF_RF{ 1, 0x17 }, { 3, 0x88 }, { 5, 0x10 }, { 6, 0xe0 }, { 7, 0x00 }, { 10, 0x53 }, { 11, 0x4a }, { 12, 0x46 }, { 13, 0x9f }, { 14, 0x00 }, { 15, 0x00 }, { 16, 0x00 }, { 18, 0x03 }, { 19, 0x4d }, { 20, 0x00 }, { 21, 0x8d }, { 22, 0x20 }, { 23, 0x0b }, { 24, 0x44 }, { 25, 0x80 }, { 26, 0x82 }, { 27, 0x09 }, { 28, 0x00 }, { 29, 0x10 }, { 30, 0x10 }, { 31, 0x80 }, { 32, 0x20 }, { 33, 0xc0 }, { 34, 0x07 }, { 35, 0x12 }, { 36, 0x00 }, { 37, 0x08 }, { 38, 0x89 }, { 39, 0x1b }, { 40, 0x0f }, { 41, 0xbb }, { 42, 0xd5 }, { 43, 0x9b }, { 44, 0x0e }, { 45, 0xa2 }, { 46, 0x73 }, { 47, 0x0c }, { 48, 0x10 }, { 49, 0x94 }, { 50, 0x94 }, { 51, 0x3a }, { 52, 0x48 }, { 53, 0x44 }, { 54, 0x38 }, { 55, 0x43 }, { 56, 0xa1 }, { 57, 0x00 }, { 58, 0x39 }, { 59, 0x07 }, { 60, 0x45 }, { 61, 0x91 }, { 62, 0x39 }, { 63, 0x07 }
210	};
211
212	int
213	rt2860_attach(void *xsc, int id)
214	{
215	struct rt2860_softc *sc = xsc;
216	struct ieee80211com *ic = &sc->sc_ic;
217	int qid, ntries, error;
218	uint32_t tmp, reg;
219
220	sc->amrr.amrr_min_success_threshold = 1;
221	sc->amrr.amrr_max_success_threshold = 15;
222
223	if (id == PCI_PRODUCT_RALINK_RT32900x3290)
224	reg = RT2860_PCI_CFG0x0000;
225	else
226	reg = RT2860_ASIC_VER_ID0x1000;
227
228	/* wait for NIC to initialize */
229	for (ntries = 0; ntries < 100; ntries++) {
230	tmp = RAL_READ(sc, reg)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((reg))));
231	if (tmp != 0 && tmp != 0xffffffff)
232	break;
233	DELAY(10)(*delay_func)(10);
234	}
235	if (ntries == 100) {
236	printf("%s: timeout waiting for NIC to initialize\n",
237	sc->sc_dev.dv_xname);
238	return ETIMEDOUT60;
239	}
240	sc->mac_ver = tmp >> 16;
241	sc->mac_rev = tmp & 0xffff;
242
243	if (sc->mac_ver != 0x2860 &&
244	(id == PCI_PRODUCT_RALINK_RT28900x0681 \|\|
245	id == PCI_PRODUCT_RALINK_RT27900x0781 \|\|
246	id == PCI_PRODUCT_AWT_RT28900x1059))
247	sc->sc_flags \|= RT2860_ADVANCED_PS(1 << 1);
248
249	/* retrieve RF rev. no and various other things from EEPROM */
250	rt2860_read_eeprom(sc);
251	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
252	printf("%s: MAC/BBP RT%X (rev 0x%04X), RF %s (MIMO %dT%dR)\n",
253	sc->sc_dev.dv_xname, sc->mac_ver, sc->mac_rev,
254	rt2860_get_rf(sc->rf_rev), sc->ntxchains, sc->nrxchains);
255
256	/*
257	* Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
258	*/
259	for (qid = 0; qid < 6; qid++) {
260	if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
261	printf("%s: could not allocate Tx ring %d\n",
262	sc->sc_dev.dv_xname, qid);
263	goto fail1;
264	}
265	}
266
267	if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
268	printf("%s: could not allocate Rx ring\n",
269	sc->sc_dev.dv_xname);
270	goto fail1;
271	}
272
273	if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
274	printf("%s: could not allocate Tx pool\n",
275	sc->sc_dev.dv_xname);
276	goto fail2;
277	}
278
279	/* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
280	sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
281	EDCA_AC_VO : 5;
282
283	config_mountroot(xsc, rt2860_attachhook);
284
285	return 0;
286
287	fail2: rt2860_free_rx_ring(sc, &sc->rxq);
288	fail1: while (--qid >= 0)
289	rt2860_free_tx_ring(sc, &sc->txq[qid]);
290	return error;
291	}
292
293	void
294	rt2860_attachhook(struct device *self)
295	{
296	struct rt2860_softc sc = (struct rt2860_softc )self;
297	struct ieee80211com *ic = &sc->sc_ic;
298	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
299	int i, error;
300
301	if (sc->mac_ver == 0x3290) {
302	error = loadfirmware("ral-rt3290", &sc->ucode, &sc->ucsize);
303	} else {
304	error = loadfirmware("ral-rt2860", &sc->ucode, &sc->ucsize);
305	}
306	if (error != 0) {
307	printf("%s: error %d, could not read firmware file %s\n",
308	sc->sc_dev.dv_xname, error, "ral-rt2860");
309	return;
310	}
311
312	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
313	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
314	ic->ic_state = IEEE80211_S_INIT;
315
316	/* set device capabilities */
317	ic->ic_caps =
318	IEEE80211_C_MONITOR0x00000200 \| /* monitor mode supported */
319	#ifndef IEEE80211_STA_ONLY
320	IEEE80211_C_IBSS0x00000002 \| /* IBSS mode supported */
321	IEEE80211_C_HOSTAP0x00000008 \| /* HostAP mode supported */
322	IEEE80211_C_APPMGT0x00000020 \| /* HostAP power management */
323	#endif
324	IEEE80211_C_SHPREAMBLE0x00000100 \| /* short preamble supported */
325	IEEE80211_C_SHSLOT0x00000080 \| /* short slot time supported */
326	IEEE80211_C_WEP0x00000001 \| /* s/w WEP */
327	IEEE80211_C_RSN0x00001000; /* WPA/RSN */
328
329	if (sc->rf_rev == RT2860_RF_27500x0004 \|\| sc->rf_rev == RT2860_RF_28500x0002) {
330	/* set supported .11a rates */
331	ic->ic_sup_rates[IEEE80211_MODE_11A] =
332	ieee80211_std_rateset_11a;
333
334	/* set supported .11a channels */
335	for (i = 14; i < nitems(rt2860_rf2850)(sizeof((rt2860_rf2850)) / sizeof((rt2860_rf2850)[0])); i++) {
336	uint8_t chan = rt2860_rf2850[i].chan;
337	ic->ic_channels[chan].ic_freq =
338	ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ0x0100);
339	ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A(0x0100 \| 0x0040);
340	}
341	}
342
343	/* set supported .11b and .11g rates */
344	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
345	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
346
347	/* set supported .11b and .11g channels (1 through 14) */
348	for (i = 1; i <= 14; i++) {
349	ic->ic_channels[i].ic_freq =
350	ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ0x0080);
351	ic->ic_channels[i].ic_flags =
352	IEEE80211_CHAN_CCK0x0020 \| IEEE80211_CHAN_OFDM0x0040 \|
353	IEEE80211_CHAN_DYN0x0400 \| IEEE80211_CHAN_2GHZ0x0080;
354	}
355
356	/* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
357	ic->ic_max_aid = min(IEEE80211_AID_MAX2007, RT2860_WCID_MAX254);
358
359	ifp->if_softc = sc;
360	ifp->if_flags = IFF_BROADCAST0x2 \| IFF_SIMPLEX0x800 \| IFF_MULTICAST0x8000;
361	ifp->if_ioctl = rt2860_ioctl;
362	ifp->if_start = rt2860_start;
363	ifp->if_watchdog = rt2860_watchdog;
364	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ)__builtin_memcpy((ifp->if_xname), (sc->sc_dev.dv_xname) , (16));
365
366	if_attach(ifp);
367	ieee80211_ifattach(ifp);
368	ic->ic_node_alloc = rt2860_node_alloc;
369	ic->ic_newassoc = rt2860_newassoc;
370	#ifndef IEEE80211_STA_ONLY
371	ic->ic_node_leave = rt2860_node_leave;
372	#endif
373	ic->ic_ampdu_rx_start = rt2860_ampdu_rx_start;
374	ic->ic_ampdu_rx_stop = rt2860_ampdu_rx_stop;
375	ic->ic_updateslot = rt2860_updateslot;
376	ic->ic_updateedca = rt2860_updateedca;
377	ic->ic_set_key = rt2860_set_key;
378	ic->ic_delete_key = rt2860_delete_key;
379	/* override state transition machine */
380	sc->sc_newstate = ic->ic_newstate;
381	ic->ic_newstate = rt2860_newstate;
382	ieee80211_media_init(ifp, rt2860_media_change, ieee80211_media_status);
383
384	#if NBPFILTER1 > 0
385	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO127,
386	sizeof (struct ieee80211_frame) + 64);
387
388	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
389	sc->sc_rxtapsc_rxtapu.th.wr_ihdr.it_len = htole16(sc->sc_rxtap_len)((__uint16_t)(sc->sc_rxtap_len));
390	sc->sc_rxtapsc_rxtapu.th.wr_ihdr.it_present = htole32(RT2860_RX_RADIOTAP_PRESENT)((__uint32_t)((1 << IEEE80211_RADIOTAP_FLAGS \| 1 << IEEE80211_RADIOTAP_RATE \| 1 << IEEE80211_RADIOTAP_CHANNEL \| 1 << IEEE80211_RADIOTAP_DBM_ANTSIGNAL \| 1 << IEEE80211_RADIOTAP_ANTENNA \| 1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL)));
391
392	sc->sc_txtap_len = sizeof sc->sc_txtapu;
393	sc->sc_txtapsc_txtapu.th.wt_ihdr.it_len = htole16(sc->sc_txtap_len)((__uint16_t)(sc->sc_txtap_len));
394	sc->sc_txtapsc_txtapu.th.wt_ihdr.it_present = htole32(RT2860_TX_RADIOTAP_PRESENT)((__uint32_t)((1 << IEEE80211_RADIOTAP_FLAGS \| 1 << IEEE80211_RADIOTAP_RATE \| 1 << IEEE80211_RADIOTAP_CHANNEL )));
395	#endif
396	}
397
398	int
399	rt2860_detach(void *xsc)
400	{
401	struct rt2860_softc *sc = xsc;
402	struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
403	int qid;
404
405	ieee80211_ifdetach(ifp); /* free all nodes */
406	if_detach(ifp);
407
408	for (qid = 0; qid < 6; qid++)
409	rt2860_free_tx_ring(sc, &sc->txq[qid]);
410	rt2860_free_rx_ring(sc, &sc->rxq);
411	rt2860_free_tx_pool(sc);
412
413	if (sc->ucode != NULL((void *)0))
414	free(sc->ucode, M_DEVBUF2, sc->ucsize);
415
416	return 0;
417	}
418
419	void
420	rt2860_suspend(void *xsc)
421	{
422	struct rt2860_softc *sc = xsc;
423	struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
424
425	if (ifp->if_flags & IFF_RUNNING0x40)
426	rt2860_stop(ifp, 1);
427	}
428
429	void
430	rt2860_wakeup(void *xsc)
431	{
432	struct rt2860_softc *sc = xsc;
433	struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
434
435	if (ifp->if_flags & IFF_UP0x1)
436	rt2860_init(ifp);
437	}
438
439	int
440	rt2860_alloc_tx_ring(struct rt2860_softc sc, struct rt2860_tx_ring ring)
441	{
442	int nsegs, size, error;
443
444	size = RT2860_TX_RING_COUNT64 * sizeof (struct rt2860_txd);
445
446	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size ), (1), (size), (0), (0x0001), (&ring->map))
447	BUS_DMA_NOWAIT, &ring->map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size ), (1), (size), (0), (0x0001), (&ring->map));
448	if (error != 0) {
449	printf("%s: could not create DMA map\n", sc->sc_dev.dv_xname);
450	goto fail;
451	}
452
453	/* Tx rings must be 4-DWORD aligned */
454	error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size ), (16), (0), (&ring->seg), (1), (&nsegs), (0x0001 \| 0x1000))
455	&nsegs, BUS_DMA_NOWAIT \| BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size ), (16), (0), (&ring->seg), (1), (&nsegs), (0x0001 \| 0x1000));
456	if (error != 0) {
457	printf("%s: could not allocate DMA memory\n",
458	sc->sc_dev.dv_xname);
459	goto fail;
460	}
461
462	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,((sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&ring ->seg), (nsegs), (size), ((caddr_t )&ring->txd), ( 0x0001))
463	(caddr_t )&ring->txd, BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&ring ->seg), (nsegs), (size), ((caddr_t *)&ring->txd), ( 0x0001));
464	if (error != 0) {
465	printf("%s: can't map DMA memory\n", sc->sc_dev.dv_xname);
466	goto fail;
467	}
468
469	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->txd, size, NULL,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (ring-> map), (ring->txd), (size), (((void )0)), (0x0001))
470	BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (ring-> map), (ring->txd), (size), (((void )0)), (0x0001));
471	if (error != 0) {
472	printf("%s: could not load DMA map\n", sc->sc_dev.dv_xname);
473	goto fail;
474	}
475
476	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (size), (0x04));
477
478	ring->paddr = ring->map->dm_segs[0].ds_addr;
479
480	return 0;
481
482	fail: rt2860_free_tx_ring(sc, ring);
483	return error;
484	}
485
486	void
487	rt2860_reset_tx_ring(struct rt2860_softc sc, struct rt2860_tx_ring ring)
488	{
489	struct rt2860_tx_data *data;
490	int i;
491
492	for (i = 0; i < RT2860_TX_RING_COUNT64; i++) {
493	if ((data = ring->data[i]) == NULL((void *)0))
494	continue; /* nothing mapped in this slot */
495
496	bus_dmamap_sync(sc->sc_dmat, data->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x08))
497	data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x08));
498	bus_dmamap_unload(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (data ->map));
499	m_freem(data->m);
500	data->m= NULL((void *)0);
501	data->ni = NULL((void )0); / node already freed */
502
503	SLIST_INSERT_HEAD(&sc->data_pool, data, next)do { (data)->next.sle_next = (&sc->data_pool)->slh_first ; (&sc->data_pool)->slh_first = (data); } while (0);
504	ring->data[i] = NULL((void *)0);
505	}
506
507	ring->queued = 0;
508	ring->cur = ring->next = 0;
509	}
510
511	void
512	rt2860_free_tx_ring(struct rt2860_softc sc, struct rt2860_tx_ring ring)
513	{
514	struct rt2860_tx_data *data;
515	int i;
516
517	if (ring->txd != NULL((void *)0)) {
518	bus_dmamap_sync(sc->sc_dmat, ring->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x08))
519	ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x08));
520	bus_dmamap_unload(sc->sc_dmat, ring->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (ring ->map));
521	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->txd,((sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), ((caddr_t )ring->txd), (64 sizeof (struct rt2860_txd)))
522	RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd))((sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), ((caddr_t )ring->txd), (64 sizeof (struct rt2860_txd)));
523	bus_dmamem_free(sc->sc_dmat, &ring->seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (& ring->seg), (1));
524	}
525	if (ring->map != NULL((void *)0))
526	bus_dmamap_destroy(sc->sc_dmat, ring->map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (ring ->map));
527
528	for (i = 0; i < RT2860_TX_RING_COUNT64; i++) {
529	if ((data = ring->data[i]) == NULL((void *)0))
530	continue; /* nothing mapped in this slot */
531
532	bus_dmamap_sync(sc->sc_dmat, data->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x08))
533	data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x08));
534	bus_dmamap_unload(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (data ->map));
535	m_freem(data->m);
536
537	SLIST_INSERT_HEAD(&sc->data_pool, data, next)do { (data)->next.sle_next = (&sc->data_pool)->slh_first ; (&sc->data_pool)->slh_first = (data); } while (0);
538	}
539	}
540
541	/*
542	* Allocate a pool of TX Wireless Information blocks.
543	*/
544	int
545	rt2860_alloc_tx_pool(struct rt2860_softc *sc)
546	{
547	caddr_t vaddr;
548	bus_addr_t paddr;
549	int i, nsegs, size, error;
550
551	size = RT2860_TX_POOL_COUNT(64 * 2) * RT2860_TXWI_DMASZ(sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe ) + sizeof (uint16_t));
552
553	/* init data_pool early in case of failure.. */
554	SLIST_INIT(&sc->data_pool){ ((&sc->data_pool)->slh_first) = ((void *)0); };
555
556	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size ), (1), (size), (0), (0x0001), (&sc->txwi_map))
557	BUS_DMA_NOWAIT, &sc->txwi_map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size ), (1), (size), (0), (0x0001), (&sc->txwi_map));
558	if (error != 0) {
559	printf("%s: could not create DMA map\n", sc->sc_dev.dv_xname);
560	goto fail;
561	}
562
563	error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size ), ((1 << 12)), (0), (&sc->txwi_seg), (1), (& nsegs), (0x0001 \| 0x1000))
564	&sc->txwi_seg, 1, &nsegs, BUS_DMA_NOWAIT \| BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size ), ((1 << 12)), (0), (&sc->txwi_seg), (1), (& nsegs), (0x0001 \| 0x1000));
565	if (error != 0) {
566	printf("%s: could not allocate DMA memory\n",
567	sc->sc_dev.dv_xname);
568	goto fail;
569	}
570
571	error = bus_dmamem_map(sc->sc_dmat, &sc->txwi_seg, nsegs, size,(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc ->txwi_seg), (nsegs), (size), (&sc->txwi_vaddr), (0x0001 ))
572	&sc->txwi_vaddr, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&sc ->txwi_seg), (nsegs), (size), (&sc->txwi_vaddr), (0x0001 ));
573	if (error != 0) {
574	printf("%s: can't map DMA memory\n", sc->sc_dev.dv_xname);
575	goto fail;
576	}
577
578	error = bus_dmamap_load(sc->sc_dmat, sc->txwi_map, sc->txwi_vaddr,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc-> txwi_map), (sc->txwi_vaddr), (size), (((void )0)), (0x0001 ))
579	size, NULL, BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (sc-> txwi_map), (sc->txwi_vaddr), (size), (((void )0)), (0x0001 ));
580	if (error != 0) {
581	printf("%s: could not load DMA map\n", sc->sc_dev.dv_xname);
582	goto fail;
583	}
584
585	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0, size,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), (0), (size), (0x04))
586	BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), (0), (size), (0x04));
587
588	vaddr = sc->txwi_vaddr;
589	paddr = sc->txwi_map->dm_segs[0].ds_addr;
590	for (i = 0; i < RT2860_TX_POOL_COUNT(64 * 2); i++) {
591	struct rt2860_tx_data *data = &sc->data[i];
592
593	error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 << 11)), (15), ((1 << 11)), (0), (0x0001), (&data-> map))
594	RT2860_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 << 11)), (15), ((1 << 11)), (0), (0x0001), (&data-> map))
595	&data->map)((sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 << 11)), (15), ((1 << 11)), (0), (0x0001), (&data-> map)); / <0> */
596	if (error != 0) {
597	printf("%s: could not create DMA map\n",
598	sc->sc_dev.dv_xname);
599	goto fail;
600	}
601	data->txwi = (struct rt2860_txwi *)vaddr;
602	data->paddr = paddr;
603	vaddr += RT2860_TXWI_DMASZ(sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe ) + sizeof (uint16_t));
604	paddr += RT2860_TXWI_DMASZ(sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe ) + sizeof (uint16_t));
605
606	SLIST_INSERT_HEAD(&sc->data_pool, data, next)do { (data)->next.sle_next = (&sc->data_pool)->slh_first ; (&sc->data_pool)->slh_first = (data); } while (0);
607	}
608
609	return 0;
610
611	fail: rt2860_free_tx_pool(sc);
612	return error;
613	}
614
615	void
616	rt2860_free_tx_pool(struct rt2860_softc *sc)
617	{
618	if (sc->txwi_vaddr != NULL((void *)0)) {
619	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), (0), (sc->txwi_map->dm_mapsize), (0x08))
620	sc->txwi_map->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), (0), (sc->txwi_map->dm_mapsize), (0x08));
621	bus_dmamap_unload(sc->sc_dmat, sc->txwi_map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (sc-> txwi_map));
622	bus_dmamem_unmap(sc->sc_dmat, sc->txwi_vaddr,((sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (sc-> txwi_vaddr), ((64 2) * (sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe) + sizeof (uint16_t))))
623	RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ)((sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), (sc-> txwi_vaddr), ((64 2) * (sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe) + sizeof (uint16_t))));
624	bus_dmamem_free(sc->sc_dmat, &sc->txwi_seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (& sc->txwi_seg), (1));
625	}
626	if (sc->txwi_map != NULL((void *)0))
627	bus_dmamap_destroy(sc->sc_dmat, sc->txwi_map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (sc ->txwi_map));
628
629	while (!SLIST_EMPTY(&sc->data_pool)(((&sc->data_pool)->slh_first) == ((void *)0))) {
630	struct rt2860_tx_data *data;
631	data = SLIST_FIRST(&sc->data_pool)((&sc->data_pool)->slh_first);
632	bus_dmamap_destroy(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (data ->map));
633	SLIST_REMOVE_HEAD(&sc->data_pool, next)do { (&sc->data_pool)->slh_first = (&sc->data_pool )->slh_first->next.sle_next; } while (0);
634	}
635	}
636
637	int
638	rt2860_alloc_rx_ring(struct rt2860_softc sc, struct rt2860_rx_ring ring)
639	{
640	int i, nsegs, size, error;
641
642	size = RT2860_RX_RING_COUNT128 * sizeof (struct rt2860_rxd);
643
644	error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size ), (1), (size), (0), (0x0001), (&ring->map))
645	BUS_DMA_NOWAIT, &ring->map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), (size ), (1), (size), (0), (0x0001), (&ring->map));
646	if (error != 0) {
647	printf("%s: could not create DMA map\n", sc->sc_dev.dv_xname);
648	goto fail;
649	}
650
651	/* Rx ring must be 4-DWORD aligned */
652	error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size ), (16), (0), (&ring->seg), (1), (&nsegs), (0x0001 \| 0x1000))
653	&nsegs, BUS_DMA_NOWAIT \| BUS_DMA_ZERO)(*(sc->sc_dmat)->_dmamem_alloc)((sc->sc_dmat), (size ), (16), (0), (&ring->seg), (1), (&nsegs), (0x0001 \| 0x1000));
654	if (error != 0) {
655	printf("%s: could not allocate DMA memory\n",
656	sc->sc_dev.dv_xname);
657	goto fail;
658	}
659
660	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,((sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&ring ->seg), (nsegs), (size), ((caddr_t )&ring->rxd), ( 0x0001))
661	(caddr_t )&ring->rxd, BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamem_map)((sc->sc_dmat), (&ring ->seg), (nsegs), (size), ((caddr_t *)&ring->rxd), ( 0x0001));
662	if (error != 0) {
663	printf("%s: can't map DMA memory\n", sc->sc_dev.dv_xname);
664	goto fail;
665	}
666
667	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->rxd, size, NULL,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (ring-> map), (ring->rxd), (size), (((void )0)), (0x0001))
668	BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (ring-> map), (ring->rxd), (size), (((void )0)), (0x0001));
669	if (error != 0) {
670	printf("%s: could not load DMA map\n", sc->sc_dev.dv_xname);
671	goto fail;
672	}
673
674	ring->paddr = ring->map->dm_segs[0].ds_addr;
675
676	for (i = 0; i < RT2860_RX_RING_COUNT128; i++) {
677	struct rt2860_rx_data *data = &ring->data[i];
678	struct rt2860_rxd *rxd = &ring->rxd[i];
679
680	error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 << 11)), (1), ((1 << 11)), (0), (0x0001), (&data-> map))
681	0, BUS_DMA_NOWAIT, &data->map)(*(sc->sc_dmat)->_dmamap_create)((sc->sc_dmat), ((1 << 11)), (1), ((1 << 11)), (0), (0x0001), (&data-> map));
682	if (error != 0) {
683	printf("%s: could not create DMA map\n",
684	sc->sc_dev.dv_xname);
685	goto fail;
686	}
687
688	data->m = MCLGETL(NULL, M_DONTWAIT, MCLBYTES)m_clget((((void *)0)), (0x0002), ((1 << 11)));
689	if (data->m == NULL((void *)0)) {
690	printf("%s: could not allocate Rx mbuf\n",
691	sc->sc_dev.dv_xname);
692	error = ENOBUFS55;
693	goto fail;
694	}
695
696	error = bus_dmamap_load(sc->sc_dmat, data->map,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((data->m)->m_hdr.mh_data))), ((1 << 11)), (((void *)0)), (0x0200 \| 0x0001))
697	mtod(data->m, void ), MCLBYTES, NULL,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((data->m)->m_hdr.mh_data))), ((1 << 11)), (((void )0)), (0x0200 \| 0x0001))
698	BUS_DMA_READ \| BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((data->m)->m_hdr.mh_data))), ((1 << 11)), (((void *)0)), (0x0200 \| 0x0001));
699	if (error != 0) {
700	printf("%s: could not load DMA map\n",
701	sc->sc_dev.dv_xname);
702	goto fail;
703	}
704
705	rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr)((__uint32_t)(data->map->dm_segs[0].ds_addr));
706	rxd->sdl0 = htole16(MCLBYTES)((__uint16_t)((1 << 11)));
707	}
708
709	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (size), (0x04));
710
711	return 0;
712
713	fail: rt2860_free_rx_ring(sc, ring);
714	return error;
715	}
716
717	void
718	rt2860_reset_rx_ring(struct rt2860_softc sc, struct rt2860_rx_ring ring)
719	{
720	int i;
721
722	for (i = 0; i < RT2860_RX_RING_COUNT128; i++)
723	ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE)((__uint16_t)((1 << 15)));
724
725	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x04))
726	BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x04));
727
728	ring->cur = 0;
729	}
730
731	void
732	rt2860_free_rx_ring(struct rt2860_softc sc, struct rt2860_rx_ring ring)
733	{
734	int i;
735
736	if (ring->rxd != NULL((void *)0)) {
737	bus_dmamap_sync(sc->sc_dmat, ring->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x08))
738	ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x08));
739	bus_dmamap_unload(sc->sc_dmat, ring->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (ring ->map));
740	bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->rxd,((sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), ((caddr_t )ring->rxd), (128 sizeof (struct rt2860_rxd)))
741	RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd))((sc->sc_dmat)->_dmamem_unmap)((sc->sc_dmat), ((caddr_t )ring->rxd), (128 sizeof (struct rt2860_rxd)));
742	bus_dmamem_free(sc->sc_dmat, &ring->seg, 1)(*(sc->sc_dmat)->_dmamem_free)((sc->sc_dmat), (& ring->seg), (1));
743	}
744	if (ring->map != NULL((void *)0))
745	bus_dmamap_destroy(sc->sc_dmat, ring->map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (ring ->map));
746
747	for (i = 0; i < RT2860_RX_RING_COUNT128; i++) {
748	struct rt2860_rx_data *data = &ring->data[i];
749
750	if (data->m != NULL((void *)0)) {
751	bus_dmamap_sync(sc->sc_dmat, data->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x02))
752	data->map->dm_mapsize, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x02));
753	bus_dmamap_unload(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (data ->map));
754	m_freem(data->m);
755	}
756	if (data->map != NULL((void *)0))
757	bus_dmamap_destroy(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_destroy)((sc->sc_dmat), (data ->map));
758	}
759	}
760
761	struct ieee80211_node *
762	rt2860_node_alloc(struct ieee80211com *ic)
763	{
764	return malloc(sizeof (struct rt2860_node), M_DEVBUF2,
	Result of 'malloc' is converted to a pointer of type 'struct ieee80211_node', which is incompatible with sizeof operand type 'struct rt2860_node'
765	M_NOWAIT0x0002 \| M_ZERO0x0008);
766	}
767
768	int
769	rt2860_media_change(struct ifnet *ifp)
770	{
771	struct rt2860_softc *sc = ifp->if_softc;
772	struct ieee80211com *ic = &sc->sc_ic;
773	uint8_t rate, ridx;
774	int error;
775
776	error = ieee80211_media_change(ifp);
777	if (error != ENETRESET52)
778	return error;
779
780	if (ic->ic_fixed_rate != -1) {
781	rate = ic->ic_sup_rates[ic->ic_curmode].
782	rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL0x7f;
783	for (ridx = 0; ridx <= RT2860_RIDX_MAX11; ridx++)
784	if (rt2860_rates[ridx].rate == rate)
785	break;
786	sc->fixed_ridx = ridx;
787	}
788
789	if ((ifp->if_flags & (IFF_UP0x1 \| IFF_RUNNING0x40)) ==
790	(IFF_UP0x1 \| IFF_RUNNING0x40)) {
791	rt2860_stop(ifp, 0);
792	rt2860_init(ifp);
793	}
794	return 0;
795	}
796
797	void
798	rt2860_iter_func(void arg, struct ieee80211_node ni)
799	{
800	struct rt2860_softc *sc = arg;
801	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
802
803	ieee80211_amrr_choose(&sc->amrr, ni, &sc->amn[wcid]);
804	}
805
806	void
807	rt2860_updatestats(struct rt2860_softc *sc)
808	{
809	struct ieee80211com *ic = &sc->sc_ic;
810
811	#ifndef IEEE80211_STA_ONLY
812	/*
813	* In IBSS or HostAP modes (when the hardware sends beacons), the
814	* MAC can run into a livelock and start sending CTS-to-self frames
815	* like crazy if protection is enabled. Fortunately, we can detect
816	* when such a situation occurs and reset the MAC.
817	*/
818	if (ic->ic_curmode != IEEE80211_M_STA) {
819	/* check if we're in a livelock situation.. */
820	uint32_t tmp = RAL_READ(sc, RT2860_DEBUG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x10f4))));
821	if ((tmp & (1 << 29)) && (tmp & (1 << 7 \| 1 << 5))) {
822	/* ..and reset MAC/BBP for a while.. */
823	DPRINTF(("CTS-to-self livelock detected\n"));
824	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 0)))));
825	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
826	DELAY(1)(*delay_func)(1);
827	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 3) \| (1 << 2)))))
828	RT2860_MAC_RX_EN \| RT2860_MAC_TX_EN)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 3) \| (1 << 2)))));
829	}
830	}
831	#endif
832	if (ic->ic_opmode == IEEE80211_M_STA)
833	rt2860_iter_func(sc, ic->ic_bss);
834	#ifndef IEEE80211_STA_ONLY
835	else
836	ieee80211_iterate_nodes(ic, rt2860_iter_func, sc);
837	#endif
838	}
839
840	void
841	rt2860_newassoc(struct ieee80211com ic, struct ieee80211_node ni, int isnew)
842	{
843	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
844	struct rt2860_node rn = (void )ni;
845	struct ieee80211_rateset *rs = &ni->ni_rates;
846	uint8_t rate, wcid = 0;
847	int ridx, i, j;
848
849	if (isnew && ni->ni_associd != 0) {
850	/* only interested in true associations */
851	wcid = rn->wcid = IEEE80211_AID(ni->ni_associd)((ni->ni_associd) &~ 0xc000);
852
853	/* init WCID table entry */
854	RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x1800 + (wcid) * 8))), ((ni->ni_macaddr)), ((6))))
855	ni->ni_macaddr, IEEE80211_ADDR_LEN)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x1800 + (wcid) * 8))), ((ni->ni_macaddr)), ((6))));
856	}
857	DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
858	isnew, ether_sprintf(ni->ni_macaddr), wcid));
859
860	ieee80211_amrr_node_init(&sc->amrr, &sc->amn[wcid]);
861	/* start at lowest available bit-rate, AMRR will raise */
862	ni->ni_txrate = 0;
863
864	for (i = 0; i < rs->rs_nrates; i++) {
865	rate = rs->rs_rates[i] & IEEE80211_RATE_VAL0x7f;
866	/* convert 802.11 rate to hardware rate index */
867	for (ridx = 0; ridx < RT2860_RIDX_MAX11; ridx++)
868	if (rt2860_rates[ridx].rate == rate)
869	break;
870	rn->ridx[i] = ridx;
871	/* determine rate of control response frames */
872	for (j = i; j >= 0; j--) {
873	if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC0x80) &&
874	rt2860_rates[rn->ridx[i]].phy ==
875	rt2860_rates[rn->ridx[j]].phy)
876	break;
877	}
878	if (j >= 0) {
879	rn->ctl_ridx[i] = rn->ridx[j];
880	} else {
881	/* no basic rate found, use mandatory one */
882	rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
883	}
884	DPRINTF(("rate=0x%02x ridx=%d ctl_ridx=%d\n",
885	rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]));
886	}
887	}
888
889	#ifndef IEEE80211_STA_ONLY
890	void
891	rt2860_node_leave(struct ieee80211com ic, struct ieee80211_node ni)
892	{
893	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
894	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
895
896	/* clear Rx WCID search table entry */
897	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(wcid), 0, 2)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), (((0x1800 + (wcid) * 8))), ((0)), ((2))));
898	}
899	#endif
900
901	int
902	rt2860_ampdu_rx_start(struct ieee80211com ic, struct ieee80211_node ni,
903	uint8_t tid)
904	{
905	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
906	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
907	uint32_t tmp;
908
909	/* update BA session mask */
910	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4)(((sc)->sc_st)->read_4(((sc)->sc_sh), (((0x1800 + (wcid ) * 8) + 4))));
911	tmp \|= (1 << tid) << 16;
912	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1800 + ( wcid) * 8) + 4)), ((tmp))));
913	return 0;
914	}
915
916	void
917	rt2860_ampdu_rx_stop(struct ieee80211com ic, struct ieee80211_node ni,
918	uint8_t tid)
919	{
920	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
921	uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
922	uint32_t tmp;
923
924	/* update BA session mask */
925	tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4)(((sc)->sc_st)->read_4(((sc)->sc_sh), (((0x1800 + (wcid ) * 8) + 4))));
926	tmp &= ~((1 << tid) << 16);
927	RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1800 + ( wcid) * 8) + 4)), ((tmp))));
928	}
929
930	int
931	rt2860_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
932	{
933	struct rt2860_softc *sc = ic->ic_ific_ac.ac_if.if_softc;
934	enum ieee80211_state ostate;
935	uint32_t tmp;
936
937	ostate = ic->ic_state;
938
939	if (ostate == IEEE80211_S_RUN) {
940	/* turn link LED off */
941	rt2860_set_leds(sc, RT2860_LED_RADIO(1 << 13));
942	}
943
944	switch (nstate) {
945	case IEEE80211_S_INIT:
946	if (ostate == IEEE80211_S_RUN) {
947	/* abort TSF synchronization */
948	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1114))));
949	RAL_WRITE(sc, RT2860_BCN_TIME_CFG,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1114)), ( (tmp & ~((1 << 20) \| (1 << 16) \| (1 << 19 ))))))
950	tmp & ~(RT2860_BCN_TX_EN \| RT2860_TSF_TIMER_EN \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1114)), ( (tmp & ~((1 << 20) \| (1 << 16) \| (1 << 19 ))))))
951	RT2860_TBTT_TIMER_EN))(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1114)), ( (tmp & ~((1 << 20) \| (1 << 16) \| (1 << 19 ))))));
952	}
953	rt2860_set_gp_timer(sc, 0);
954	break;
955
956	case IEEE80211_S_SCAN:
957	rt2860_switch_chan(sc, ic->ic_bss->ni_chan);
958	if (ostate != IEEE80211_S_SCAN)
959	rt2860_set_gp_timer(sc, 150);
960	break;
961
962	case IEEE80211_S_AUTH:
963	case IEEE80211_S_ASSOC:
964	rt2860_set_gp_timer(sc, 0);
965	rt2860_switch_chan(sc, ic->ic_bss->ni_chan);
966	break;
967
968	case IEEE80211_S_RUN:
969	rt2860_set_gp_timer(sc, 0);
970	rt2860_switch_chan(sc, ic->ic_bss->ni_chan);
971
972	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
973	rt2860_updateslot(ic);
974	rt2860_enable_mrr(sc);
975	rt2860_set_txpreamble(sc);
976	rt2860_set_basicrates(sc);
977	rt2860_set_bssid(sc, ic->ic_bss->ni_bssid);
978	}
979
980	#ifndef IEEE80211_STA_ONLY
981	if (ic->ic_opmode == IEEE80211_M_HOSTAP \|\|
982	ic->ic_opmode == IEEE80211_M_IBSS)
983	(void)rt2860_setup_beacon(sc);
984	#endif
985
986	if (ic->ic_opmode == IEEE80211_M_STA) {
987	/* fake a join to init the tx rate */
988	rt2860_newassoc(ic, ic->ic_bss, 1);
989	}
990
991	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
992	rt2860_enable_tsf_sync(sc);
993	rt2860_set_gp_timer(sc, 500);
994	}
995
996	/* turn link LED on */
997	rt2860_set_leds(sc, RT2860_LED_RADIO(1 << 13) \|
998	(IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)(((ic->ic_bss->ni_chan)->ic_flags & 0x0080) != 0 ) ?
999	RT2860_LED_LINK_2GHZ(1 << 14) : RT2860_LED_LINK_5GHZ(1 << 15)));
1000	break;
1001	}
1002
1003	return sc->sc_newstate(ic, nstate, arg);
1004	}
1005
1006	/* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
1007	uint16_t
1008	rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
1009	{
1010	uint32_t tmp;
1011	uint16_t reg;
1012	int ntries;
1013
1014	addr *= 2;
1015	/*-
1016	* Read one 16-byte block into registers EFUSE_DATA[0-3]:
1017	* DATA0: F E D C
1018	* DATA1: B A 9 8
1019	* DATA2: 7 6 5 4
1020	* DATA3: 3 2 1 0
1021	*/
1022	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0580))));
1023	tmp &= ~(RT3070_EFSROM_MODE_MASK0x000000c0 \| RT3070_EFSROM_AIN_MASK0x03ff0000);
1024	tmp \|= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT16 \| RT3070_EFSROM_KICK(1U << 30);
1025	RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0580)), ( (tmp))));
1026	for (ntries = 0; ntries < 500; ntries++) {
1027	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0580))));
1028	if (!(tmp & RT3070_EFSROM_KICK(1U << 30)))
1029	break;
1030	DELAY(2)(*delay_func)(2);
1031	}
1032	if (ntries == 500)
1033	return 0xffff;
1034
1035	if ((tmp & RT3070_EFUSE_AOUT_MASK0x0000003f) == RT3070_EFUSE_AOUT_MASK0x0000003f)
1036	return 0xffff; /* address not found */
1037
1038	/* determine to which 32-bit register our 16-bit word belongs */
1039	reg = RT3070_EFUSE_DATA30x059c - (addr & 0xc);
1040	tmp = RAL_READ(sc, reg)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((reg))));
1041
1042	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
1043	}
1044
1045	/* Read 16 bits from eFUSE ROM (RT3290 only) */
1046	uint16_t
1047	rt3290_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
1048	{
1049	uint32_t tmp;
1050	uint16_t reg;
1051	int ntries;
1052
1053	addr *= 2;
1054	/*-
1055	* Read one 16-byte block into registers EFUSE_DATA[0-3]:
1056	* DATA3: 3 2 1 0
1057	* DATA2: 7 6 5 4
1058	* DATA1: B A 9 8
1059	* DATA0: F E D C
1060	*/
1061	tmp = RAL_READ(sc, RT3290_EFUSE_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0024))));
1062	tmp &= ~(RT3070_EFSROM_MODE_MASK0x000000c0 \| RT3070_EFSROM_AIN_MASK0x03ff0000);
1063	tmp \|= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT16 \| RT3070_EFSROM_KICK(1U << 30);
1064	RAL_WRITE(sc, RT3290_EFUSE_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0024)), ( (tmp))));
1065	for (ntries = 0; ntries < 500; ntries++) {
1066	tmp = RAL_READ(sc, RT3290_EFUSE_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0024))));
1067	if (!(tmp & RT3070_EFSROM_KICK(1U << 30)))
1068	break;
1069	DELAY(2)(*delay_func)(2);
1070	}
1071	if (ntries == 500)
1072	return 0xffff;
1073
1074	if ((tmp & RT3070_EFUSE_AOUT_MASK0x0000003f) == RT3070_EFUSE_AOUT_MASK0x0000003f)
1075	return 0xffff; /* address not found */
1076
1077	/* determine to which 32-bit register our 16-bit word belongs */
1078	reg = RT3290_EFUSE_DATA30x0028 + (addr & 0xc);
1079	tmp = RAL_READ(sc, reg)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((reg))));
1080
1081	return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
1082	}
1083
1084	/*
1085	* Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
1086	* 93C66 or 93C86).
1087	*/
1088	uint16_t
1089	rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
1090	{
1091	uint32_t tmp;
1092	uint16_t val;
1093	int n;
1094
1095	/* clock C once before the first command */
1096	RT2860_EEPROM_CTL(sc, 0)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), (((0))))); bus_space_barrier(((sc))->sc_st, ((sc))-> sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0 );
1097
1098	RT2860_EEPROM_CTL(sc, RT2860_S)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1099	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 0)))))); bus_space_barrier (((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1100	RT2860_EEPROM_CTL(sc, RT2860_S)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1101
1102	/* write start bit (1) */
1103	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_D)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 2)))))); bus_space_barrier (((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1104	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_D \| RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 2) \| (1 << 0)))))); bus_space_barrier(((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800 , 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1105
1106	/* write READ opcode (10) */
1107	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_D)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 2)))))); bus_space_barrier (((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1108	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_D \| RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 2) \| (1 << 0)))))); bus_space_barrier(((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800 , 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1109	RT2860_EEPROM_CTL(sc, RT2860_S)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1110	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 0)))))); bus_space_barrier (((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1111
1112	/* write address (A5-A0 or A7-A0) */
1113	n = ((RAL_READ(sc, RT2860_PCI_EECTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0004)))) & 0x30) == 0) ? 5 : 7;
1114	for (; n >= 0; n--) {
1115	RT2860_EEPROM_CTL(sc, RT2860_S \|do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (((addr >> n) & 1) << 2)))))); bus_space_barrier(((sc))->sc_st, ((sc))->sc_sh , 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0)
1116	(((addr >> n) & 1) << RT2860_SHIFT_D))do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (((addr >> n) & 1) << 2)))))); bus_space_barrier(((sc))->sc_st, ((sc))->sc_sh , 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1117	RT2860_EEPROM_CTL(sc, RT2860_S \|do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (((addr >> n) & 1) << 2) \| (1 << 0)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0)
1118	(((addr >> n) & 1) << RT2860_SHIFT_D) \| RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (((addr >> n) & 1) << 2) \| (1 << 0)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1119	}
1120
1121	RT2860_EEPROM_CTL(sc, RT2860_S)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1122
1123	/* read data Q15-Q0 */
1124	val = 0;
1125	for (n = 15; n >= 0; n--) {
1126	RT2860_EEPROM_CTL(sc, RT2860_S \| RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1) \| (1 << 0)))))); bus_space_barrier (((sc))->sc_st, ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0);
1127	tmp = RAL_READ(sc, RT2860_PCI_EECTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0004))));
1128	val \|= ((tmp & RT2860_Q(1 << 3)) >> RT2860_SHIFT_Q3) << n;
1129	RT2860_EEPROM_CTL(sc, RT2860_S)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1130	}
1131
1132	RT2860_EEPROM_CTL(sc, 0)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), (((0))))); bus_space_barrier(((sc))->sc_st, ((sc))-> sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0 );
1133
1134	/* clear Chip Select and clock C */
1135	RT2860_EEPROM_CTL(sc, RT2860_S)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 1)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1136	RT2860_EEPROM_CTL(sc, 0)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), (((0))))); bus_space_barrier(((sc))->sc_st, ((sc))-> sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1); } while ( 0 );
1137	RT2860_EEPROM_CTL(sc, RT2860_C)do { ((((sc))->sc_st)->write_4((((sc))->sc_sh), ((0x0004 )), ((((1 << 0)))))); bus_space_barrier(((sc))->sc_st , ((sc))->sc_sh, 0, 0x1800, 0x01 \| 0x02); (*delay_func)(1) ; } while ( 0);
1138
1139	return val;
1140	}
1141
1142	static __inline uint16_t
1143	rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
1144	{
1145	/* either eFUSE ROM or EEPROM */
1146	return sc->sc_srom_read(sc, addr);
1147	}
1148
1149	void
1150	rt2860_intr_coherent(struct rt2860_softc *sc)
1151	{
1152	uint32_t tmp;
1153
1154	/* DMA finds data coherent event when checking the DDONE bit */
1155
1156	DPRINTF(("Tx/Rx Coherent interrupt\n"));
1157
1158	/* restart DMA engine */
1159	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0208))));
1160	tmp &= ~(RT2860_TX_WB_DDONE(1 << 6) \| RT2860_RX_DMA_EN(1 << 2) \| RT2860_TX_DMA_EN(1 << 0));
1161	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0208)), ( (tmp))));
1162
1163	(void)rt2860_txrx_enable(sc);
1164	}
1165
1166	void
1167	rt2860_drain_stats_fifo(struct rt2860_softc *sc)
1168	{
1169	struct ifnet *ifp = &sc->sc_ic.ic_ific_ac.ac_if;
1170	struct ieee80211_amrr_node *amn;
1171	uint32_t stat;
1172	uint8_t wcid, mcs, pid;
1173
1174	/* drain Tx status FIFO (maxsize = 16) */
1175	while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1718))))) & RT2860_TXQ_VLD(1 << 0)) {
1176	DPRINTFN(4, ("tx stat 0x%08x\n", stat));
1177
1178	wcid = (stat >> RT2860_TXQ_WCID_SHIFT8) & 0xff;
1179
1180	/* if no ACK was requested, no feedback is available */
1181	if (!(stat & RT2860_TXQ_ACKREQ(1 << 7)) \|\| wcid == 0xff)
1182	continue;
1183
1184	/* update per-STA AMRR stats */
1185	amn = &sc->amn[wcid];
1186	amn->amn_txcnt++;
1187	if (stat & RT2860_TXQ_OK(1 << 5)) {
1188	/*
1189	* Check if there were retries, ie if the Tx success
1190	* rate is different from the requested rate. Note
1191	* that it works only because we do not allow rate
1192	* fallback from OFDM to CCK.
1193	*/
1194	mcs = (stat >> RT2860_TXQ_MCS_SHIFT16) & 0x7f;
1195	pid = (stat >> RT2860_TXQ_PID_SHIFT1) & 0xf;
1196	if (mcs + 1 != pid)
1197	amn->amn_retrycnt++;
1198	} else {
1199	amn->amn_retrycnt++;
1200	ifp->if_oerrorsif_data.ifi_oerrors++;
1201	}
1202	}
1203	}
1204
1205	void
1206	rt2860_tx_intr(struct rt2860_softc *sc, int qid)
1207	{
1208	struct ieee80211com *ic = &sc->sc_ic;
1209	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
1210	struct rt2860_tx_ring *ring = &sc->txq[qid];
1211	uint32_t hw;
1212
1213	rt2860_drain_stats_fifo(sc);
1214
1215	hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid))(((sc)->sc_st)->read_4(((sc)->sc_sh), (((0x023c + (qid ) * 16)))));
1216	while (ring->next != hw) {
1217	struct rt2860_tx_data *data = ring->data[ring->next];
1218
1219	if (data != NULL((void *)0)) {
1220	bus_dmamap_sync(sc->sc_dmat, data->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x08))
1221	data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x08));
1222	bus_dmamap_unload(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (data ->map));
1223	m_freem(data->m);
1224	data->m= NULL((void *)0);
1225	ieee80211_release_node(ic, data->ni);
1226	data->ni = NULL((void *)0);
1227
1228	SLIST_INSERT_HEAD(&sc->data_pool, data, next)do { (data)->next.sle_next = (&sc->data_pool)->slh_first ; (&sc->data_pool)->slh_first = (data); } while (0);
1229	ring->data[ring->next] = NULL((void *)0);
1230	}
1231	ring->queued--;
1232	ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT64;
1233	}
1234
1235	sc->sc_tx_timer = 0;
1236	if (ring->queued <= RT2860_TX_RING_ONEMORE((64 - 1) - (1 + (15 / 2))))
1237	sc->qfullmsk &= ~(1 << qid);
1238	ifq_clr_oactive(&ifp->if_snd);
1239	rt2860_start(ifp);
1240	}
1241
1242	/*
1243	* Return the Rx chain with the highest RSSI for a given frame.
1244	*/
1245	static __inline uint8_t
1246	rt2860_maxrssi_chain(struct rt2860_softc sc, const struct rt2860_rxwi rxwi)
1247	{
1248	uint8_t rxchain = 0;
1249
1250	if (sc->nrxchains > 1) {
1251	if (rxwi->rssi[1] > rxwi->rssi[rxchain])
1252	rxchain = 1;
1253	if (sc->nrxchains > 2)
1254	if (rxwi->rssi[2] > rxwi->rssi[rxchain])
1255	rxchain = 2;
1256	}
1257	return rxchain;
1258	}
1259
1260	void
1261	rt2860_rx_intr(struct rt2860_softc *sc)
1262	{
1263	struct mbuf_list ml = MBUF_LIST_INITIALIZER(){ ((void )0), ((void )0), 0 };
1264	struct ieee80211com *ic = &sc->sc_ic;
1265	struct ifnet *ifp = &ic->ic_ific_ac.ac_if;
1266	struct ieee80211_frame *wh;
1267	struct ieee80211_rxinfo rxi;
1268	struct ieee80211_node *ni;
1269	struct mbuf m, m1;
1270	uint32_t hw;
1271	uint8_t ant, rssi;
1272	int error;
1273	#if NBPFILTER1 > 0
1274	struct rt2860_rx_radiotap_header *tap;
1275	uint16_t phy;
1276	#endif
1277
1278	hw = RAL_READ(sc, RT2860_FS_DRX_IDX)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x029c)))) & 0xfff;
1279	while (sc->rxq.cur != hw) {
1280	struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1281	struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
1282	struct rt2860_rxwi *rxwi;
1283
1284	bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,((sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> rxq.map), (sc->rxq.cur sizeof (struct rt2860_rxd)), (sizeof (struct rt2860_rxd)), (0x02))
1285	sc->rxq.cur * sizeof (struct rt2860_rxd),((sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> rxq.map), (sc->rxq.cur sizeof (struct rt2860_rxd)), (sizeof (struct rt2860_rxd)), (0x02))
1286	sizeof (struct rt2860_rxd), BUS_DMASYNC_POSTREAD)((sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> rxq.map), (sc->rxq.cur sizeof (struct rt2860_rxd)), (sizeof (struct rt2860_rxd)), (0x02));
1287
1288	if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))__builtin_expect(((!(rxd->sdl0 & ((__uint16_t)((1 << 15))))) != 0), 0)) {
1289	DPRINTF(("RXD DDONE bit not set!\n"));
1290	break; /* should not happen */
1291	}
1292
1293	if (__predict_false(rxd->flags &__builtin_expect(((rxd->flags & ((__uint32_t)((1 << 8) \| (1 << 9)))) != 0), 0)
1294	htole32(RT2860_RX_CRCERR \| RT2860_RX_ICVERR))__builtin_expect(((rxd->flags & ((__uint32_t)((1 << 8) \| (1 << 9)))) != 0), 0)) {
1295	ifp->if_ierrorsif_data.ifi_ierrors++;
1296	goto skip;
1297	}
1298
1299	if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))__builtin_expect(((rxd->flags & ((__uint32_t)((1 << 10)))) != 0), 0)) {
1300	/* report MIC failures to net80211 for TKIP */
1301	ic->ic_stats.is_rx_locmicfail++;
1302	ieee80211_michael_mic_failure(ic, 0/* XXX */);
1303	ifp->if_ierrorsif_data.ifi_ierrors++;
1304	goto skip;
1305	}
1306
1307	m1 = MCLGETL(NULL, M_DONTWAIT, MCLBYTES)m_clget((((void *)0)), (0x0002), ((1 << 11)));
1308	if (__predict_false(m1 == NULL)__builtin_expect(((m1 == ((void *)0)) != 0), 0)) {
1309	ifp->if_ierrorsif_data.ifi_ierrors++;
1310	goto skip;
1311	}
1312
1313	bus_dmamap_sync(sc->sc_dmat, data->map, 0,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x02))
1314	data->map->dm_mapsize, BUS_DMASYNC_POSTREAD)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x02));
1315	bus_dmamap_unload(sc->sc_dmat, data->map)(*(sc->sc_dmat)->_dmamap_unload)((sc->sc_dmat), (data ->map));
1316
1317	error = bus_dmamap_load(sc->sc_dmat, data->map,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((m1)->m_hdr.mh_data))), ((1 << 11)) , (((void *)0)), (0x0200 \| 0x0001))
1318	mtod(m1, void ), MCLBYTES, NULL,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((m1)->m_hdr.mh_data))), ((1 << 11)) , (((void )0)), (0x0200 \| 0x0001))
1319	BUS_DMA_READ \| BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((m1)->m_hdr.mh_data))), ((1 << 11)) , (((void *)0)), (0x0200 \| 0x0001));
1320	if (__predict_false(error != 0)__builtin_expect(((error != 0) != 0), 0)) {
1321	m_freem(m1);
1322
1323	/* try to reload the old mbuf */
1324	error = bus_dmamap_load(sc->sc_dmat, data->map,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((data->m)->m_hdr.mh_data))), ((1 << 11)), (((void *)0)), (0x0200 \| 0x0001))
1325	mtod(data->m, void ), MCLBYTES, NULL,((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((data->m)->m_hdr.mh_data))), ((1 << 11)), (((void )0)), (0x0200 \| 0x0001))
1326	BUS_DMA_READ \| BUS_DMA_NOWAIT)((sc->sc_dmat)->_dmamap_load)((sc->sc_dmat), (data-> map), (((void )((data->m)->m_hdr.mh_data))), ((1 << 11)), (((void *)0)), (0x0200 \| 0x0001));
1327	if (__predict_false(error != 0)__builtin_expect(((error != 0) != 0), 0)) {
1328	panic("%s: could not load old rx mbuf",
1329	sc->sc_dev.dv_xname);
1330	}
1331	/* physical address may have changed */
1332	rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr)((__uint32_t)(data->map->dm_segs[0].ds_addr));
1333	ifp->if_ierrorsif_data.ifi_ierrors++;
1334	goto skip;
1335	}
1336
1337	/*
1338	* New mbuf successfully loaded, update Rx ring and continue
1339	* processing.
1340	*/
1341	m = data->m;
1342	data->m = m1;
1343	rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr)((__uint32_t)(data->map->dm_segs[0].ds_addr));
1344
1345	rxwi = mtod(m, struct rt2860_rxwi )((struct rt2860_rxwi )((m)->m_hdr.mh_data));
1346
1347	/* finalize mbuf */
1348	m->m_datam_hdr.mh_data = (caddr_t)(rxwi + 1);
1349	m->m_pkthdrM_dat.MH.MH_pkthdr.len = m->m_lenm_hdr.mh_len = letoh16(rxwi->len)((__uint16_t)(rxwi->len)) & 0xfff;
1350
1351	wh = mtod(m, struct ieee80211_frame )((struct ieee80211_frame )((m)->m_hdr.mh_data));
1352	memset(&rxi, 0, sizeof(rxi))__builtin_memset((&rxi), (0), (sizeof(rxi)));
1353	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED0x40) {
1354	/* frame is decrypted by hardware */
1355	wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED0x40;
1356	rxi.rxi_flags \|= IEEE80211_RXI_HWDEC0x00000001;
1357	}
1358
1359	/* HW may insert 2 padding bytes after 802.11 header */
1360	if (rxd->flags & htole32(RT2860_RX_L2PAD)((__uint32_t)((1 << 14)))) {
1361	u_int hdrlen = ieee80211_get_hdrlen(wh);
1362	memmove((caddr_t)wh + 2, wh, hdrlen)__builtin_memmove(((caddr_t)wh + 2), (wh), (hdrlen));
1363	m->m_datam_hdr.mh_data += 2;
1364	wh = mtod(m, struct ieee80211_frame )((struct ieee80211_frame )((m)->m_hdr.mh_data));
1365	}
1366
1367	ant = rt2860_maxrssi_chain(sc, rxwi);
1368	rssi = rxwi->rssi[ant];
1369
1370	#if NBPFILTER1 > 0
1371	if (__predict_true(sc->sc_drvbpf == NULL)__builtin_expect(((sc->sc_drvbpf == ((void *)0)) != 0), 1))
1372	goto skipbpf;
1373
1374	tap = &sc->sc_rxtapsc_rxtapu.th;
1375	tap->wr_flags = 0;
1376	tap->wr_chan_freq = htole16(ic->ic_ibss_chan->ic_freq)((__uint16_t)(ic->ic_ibss_chan->ic_freq));
1377	tap->wr_chan_flags = htole16(ic->ic_ibss_chan->ic_flags)((__uint16_t)(ic->ic_ibss_chan->ic_flags));
1378	tap->wr_antsignal = rssi;
1379	tap->wr_antenna = ant;
1380	tap->wr_dbm_antsignal = rt2860_rssi2dbm(sc, rssi, ant);
1381	tap->wr_rate = 2; /* in case it can't be found below */
1382	phy = letoh16(rxwi->phy)((__uint16_t)(rxwi->phy));
1383	switch (phy & RT2860_PHY_MODE0xc000) {
1384	case RT2860_PHY_CCK(0 << 14):
1385	switch ((phy & RT2860_PHY_MCS0x7f) & ~RT2860_PHY_SHPRE(1 << 3)) {
1386	case 0: tap->wr_rate = 2; break;
1387	case 1: tap->wr_rate = 4; break;
1388	case 2: tap->wr_rate = 11; break;
1389	case 3: tap->wr_rate = 22; break;
1390	}
1391	if (phy & RT2860_PHY_SHPRE(1 << 3))
1392	tap->wr_flags \|= IEEE80211_RADIOTAP_F_SHORTPRE0x02;
1393	break;
1394	case RT2860_PHY_OFDM(1 << 14):
1395	switch (phy & RT2860_PHY_MCS0x7f) {
1396	case 0: tap->wr_rate = 12; break;
1397	case 1: tap->wr_rate = 18; break;
1398	case 2: tap->wr_rate = 24; break;
1399	case 3: tap->wr_rate = 36; break;
1400	case 4: tap->wr_rate = 48; break;
1401	case 5: tap->wr_rate = 72; break;
1402	case 6: tap->wr_rate = 96; break;
1403	case 7: tap->wr_rate = 108; break;
1404	}
1405	break;
1406	}
1407	bpf_mtap_hdr(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m,
1408	BPF_DIRECTION_IN(1 << 0));
1409	skipbpf:
1410	#endif
1411	/* grab a reference to the source node */
1412	ni = ieee80211_find_rxnode(ic, wh);
1413
1414	/* send the frame to the 802.11 layer */
1415	rxi.rxi_rssi = rssi;
1416	ieee80211_inputm(ifp, m, ni, &rxi, &ml);
1417
1418	/* node is no longer needed */
1419	ieee80211_release_node(ic, ni);
1420
1421	skip: rxd->sdl0 &= ~htole16(RT2860_RX_DDONE)((__uint16_t)((1 << 15)));
1422
1423	bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,((sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> rxq.map), (sc->rxq.cur sizeof (struct rt2860_rxd)), (sizeof (struct rt2860_rxd)), (0x04))
1424	sc->rxq.cur * sizeof (struct rt2860_rxd),((sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> rxq.map), (sc->rxq.cur sizeof (struct rt2860_rxd)), (sizeof (struct rt2860_rxd)), (0x04))
1425	sizeof (struct rt2860_rxd), BUS_DMASYNC_PREWRITE)((sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> rxq.map), (sc->rxq.cur sizeof (struct rt2860_rxd)), (sizeof (struct rt2860_rxd)), (0x04));
1426
1427	sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT128;
1428	}
1429	if_input(ifp, &ml);
1430
1431	/* tell HW what we have processed */
1432	RAL_WRITE(sc, RT2860_RX_CALC_IDX,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0298)), ( ((sc->rxq.cur - 1) % 128))))
1433	(sc->rxq.cur - 1) % RT2860_RX_RING_COUNT)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0298)), ( ((sc->rxq.cur - 1) % 128))));
1434	}
1435
1436	void
1437	rt2860_tbtt_intr(struct rt2860_softc *sc)
1438	{
1439	struct ieee80211com *ic = &sc->sc_ic;
1440
1441	#ifndef IEEE80211_STA_ONLY
1442	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
1443	/* one less beacon until next DTIM */
1444	if (ic->ic_dtim_count == 0)
1445	ic->ic_dtim_count = ic->ic_dtim_period - 1;
1446	else
1447	ic->ic_dtim_count--;
1448
1449	/* update dynamic parts of beacon */
1450	rt2860_setup_beacon(sc);
1451
1452	/* flush buffered multicast frames */
1453	if (ic->ic_dtim_count == 0)
1454	ieee80211_notify_dtim(ic);
1455	}
1456	#endif
1457	/* check if protection mode has changed */
1458	if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT0x00100000) {
1459	rt2860_updateprot(ic);
1460	sc->sc_ic_flags = ic->ic_flags;
1461	}
1462	}
1463
1464	void
1465	rt2860_gp_intr(struct rt2860_softc *sc)
1466	{
1467	struct ieee80211com *ic = &sc->sc_ic;
1468
1469	DPRINTFN(2, ("GP timeout state=%d\n", ic->ic_state));
1470
1471	if (ic->ic_state == IEEE80211_S_SCAN)
1472	ieee80211_next_scan(&ic->ic_ific_ac.ac_if);
1473	else if (ic->ic_state == IEEE80211_S_RUN)
1474	rt2860_updatestats(sc);
1475	}
1476
1477	int
1478	rt2860_intr(void *arg)
1479	{
1480	struct rt2860_softc *sc = arg;
1481	uint32_t r;
1482
1483	r = RAL_READ(sc, RT2860_INT_STATUS)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0200))));
1484	if (__predict_false(r == 0xffffffff)__builtin_expect(((r == 0xffffffff) != 0), 0))
1485	return 0; /* device likely went away */
1486	if (r == 0)
1487	return 0; /* not for us */
1488
1489	/* acknowledge interrupts */
1490	RAL_WRITE(sc, RT2860_INT_STATUS, r)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0200)), ( (r))));
1491
1492	if (r & RT2860_TX_RX_COHERENT(1 << 10))
1493	rt2860_intr_coherent(sc);
1494
1495	if (r & RT2860_MAC_INT_2(1 << 13)) /* TX status */
1496	rt2860_drain_stats_fifo(sc);
1497
1498	if (r & RT2860_TX_DONE_INT5(1 << 8))
1499	rt2860_tx_intr(sc, 5);
1500
1501	if (r & RT2860_RX_DONE_INT(1 << 2))
1502	rt2860_rx_intr(sc);
1503
1504	if (r & RT2860_TX_DONE_INT4(1 << 7))
1505	rt2860_tx_intr(sc, 4);
1506
1507	if (r & RT2860_TX_DONE_INT3(1 << 6))
1508	rt2860_tx_intr(sc, 3);
1509
1510	if (r & RT2860_TX_DONE_INT2(1 << 5))
1511	rt2860_tx_intr(sc, 2);
1512
1513	if (r & RT2860_TX_DONE_INT1(1 << 4))
1514	rt2860_tx_intr(sc, 1);
1515
1516	if (r & RT2860_TX_DONE_INT0(1 << 3))
1517	rt2860_tx_intr(sc, 0);
1518
1519	if (r & RT2860_MAC_INT_0(1 << 11)) /* TBTT */
1520	rt2860_tbtt_intr(sc);
1521
1522	if (r & RT2860_MAC_INT_3(1 << 14)) /* Auto wakeup */
1523	/* TBD wakeup */;
1524
1525	if (r & RT2860_MAC_INT_4(1 << 15)) /* GP timer */
1526	rt2860_gp_intr(sc);
1527
1528	return 1;
1529	}
1530
1531	int
1532	rt2860_tx(struct rt2860_softc sc, struct mbuf m, struct ieee80211_node *ni)
1533	{
1534	struct ieee80211com *ic = &sc->sc_ic;
1535	struct rt2860_node rn = (void )ni;
1536	struct rt2860_tx_ring *ring;
1537	struct rt2860_tx_data *data;
1538	struct rt2860_txd *txd;
1539	struct rt2860_txwi *txwi;
1540	struct ieee80211_frame *wh;
1541	bus_dma_segment_t *seg;
1542	u_int hdrlen;
1543	uint16_t qos, dur;
1544	uint8_t type, qsel, mcs, pid, tid, qid;
1545	int nsegs, hasqos, ridx, ctl_ridx;
1546
1547	/* the data pool contains at least one element, pick the first */
1548	data = SLIST_FIRST(&sc->data_pool)((&sc->data_pool)->slh_first);
1549
1550	wh = mtod(m, struct ieee80211_frame )((struct ieee80211_frame )((m)->m_hdr.mh_data));
1551	hdrlen = ieee80211_get_hdrlen(wh);
1552	type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK0x0c;
1553
1554	if ((hasqos = ieee80211_has_qos(wh))) {
1555	qos = ieee80211_get_qos(wh);
1556	tid = qos & IEEE80211_QOS_TID0x000f;
1557	qid = ieee80211_up_to_ac(ic, tid);
1558	} else {
1559	qos = 0;
1560	tid = 0;
1561	qid = (type == IEEE80211_FC0_TYPE_MGT0x00) ?
1562	sc->mgtqid : EDCA_AC_BE;
1563	}
1564	ring = &sc->txq[qid];
1565
1566	/* pickup a rate index */
1567	if (IEEE80211_IS_MULTICAST(wh->i_addr1)(*(wh->i_addr1) & 0x01) \|\|
1568	type != IEEE80211_FC0_TYPE_DATA0x08) {
1569	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
1570	RT2860_RIDX_OFDM64 : RT2860_RIDX_CCK10;
1571	ctl_ridx = rt2860_rates[ridx].ctl_ridx;
1572	} else if (ic->ic_fixed_rate != -1) {
1573	ridx = sc->fixed_ridx;
1574	ctl_ridx = rt2860_rates[ridx].ctl_ridx;
1575	} else {
1576	ridx = rn->ridx[ni->ni_txrate];
1577	ctl_ridx = rn->ctl_ridx[ni->ni_txrate];
1578	}
1579
1580	/* get MCS code from rate index */
1581	mcs = rt2860_rates[ridx].mcs;
1582
1583	/* setup TX Wireless Information */
1584	txwi = data->txwi;
1585	txwi->flags = 0;
1586	/* let HW generate seq numbers for non-QoS frames */
1587	txwi->xflags = hasqos ? 0 : RT2860_TX_NSEQ(1 << 1);
1588	txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA0x08) ? rn->wcid : 0xff;
1589	txwi->len = htole16(m->m_pkthdr.len)((__uint16_t)(m->M_dat.MH.MH_pkthdr.len));
1590	if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
1591	txwi->phy = htole16(RT2860_PHY_CCK)((__uint16_t)((0 << 14)));
1592	if (ridx != RT2860_RIDX_CCK10 &&
1593	(ic->ic_flags & IEEE80211_F_SHPREAMBLE0x00040000))
1594	mcs \|= RT2860_PHY_SHPRE(1 << 3);
1595	} else
1596	txwi->phy = htole16(RT2860_PHY_OFDM)((__uint16_t)((1 << 14)));
1597	txwi->phy \|= htole16(mcs)((__uint16_t)(mcs));
1598
1599	/*
1600	* We store the MCS code into the driver-private PacketID field.
1601	* The PacketID is latched into TX_STAT_FIFO when Tx completes so
1602	* that we know at which initial rate the frame was transmitted.
1603	* We add 1 to the MCS code because setting the PacketID field to
1604	* 0 means that we don't want feedback in TX_STAT_FIFO.
1605	*/
1606	pid = (mcs + 1) & 0xf;
1607	txwi->len \|= htole16(pid << RT2860_TX_PID_SHIFT)((__uint16_t)(pid << 12));
1608
1609	/* check if RTS/CTS or CTS-to-self protection is required */
1610	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)(*(wh->i_addr1) & 0x01) &&
1611	(m->m_pkthdrM_dat.MH.MH_pkthdr.len + IEEE80211_CRC_LEN4 > ic->ic_rtsthreshold \|\|
1612	((ic->ic_flags & IEEE80211_F_USEPROT0x00100000) &&
1613	rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
1614	txwi->txop = RT2860_TX_TXOP_HT0;
1615	else
1616	txwi->txop = RT2860_TX_TXOP_BACKOFF3;
1617
1618	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)(*(wh->i_addr1) & 0x01) &&
1619	(!hasqos \|\| (qos & IEEE80211_QOS_ACK_POLICY_MASK0x0060) !=
1620	IEEE80211_QOS_ACK_POLICY_NOACK0x0020)) {
1621	txwi->xflags \|= RT2860_TX_ACK(1 << 0);
1622
1623	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE0x00040000)
1624	dur = rt2860_rates[ctl_ridx].sp_ack_dur;
1625	else
1626	dur = rt2860_rates[ctl_ridx].lp_ack_dur;
1627	(uint16_t )wh->i_dur = htole16(dur)((__uint16_t)(dur));
1628	}
1629	#ifndef IEEE80211_STA_ONLY
1630	/* ask MAC to insert timestamp into probe responses */
1631	if ((wh->i_fc[0] &
1632	(IEEE80211_FC0_TYPE_MASK0x0c \| IEEE80211_FC0_SUBTYPE_MASK0xf0)) ==
1633	(IEEE80211_FC0_TYPE_MGT0x00 \| IEEE80211_FC0_SUBTYPE_PROBE_RESP0x50))
1634	/* NOTE: beacons do not pass through tx_data() */
1635	txwi->flags \|= RT2860_TX_TS(1 << 3);
1636	#endif
1637
1638	#if NBPFILTER1 > 0
1639	if (__predict_false(sc->sc_drvbpf != NULL)__builtin_expect(((sc->sc_drvbpf != ((void *)0)) != 0), 0)) {
1640	struct rt2860_tx_radiotap_header *tap = &sc->sc_txtapsc_txtapu.th;
1641
1642	tap->wt_flags = 0;
1643	tap->wt_rate = rt2860_rates[ridx].rate;
1644	tap->wt_chan_freq = htole16(ic->ic_ibss_chan->ic_freq)((__uint16_t)(ic->ic_ibss_chan->ic_freq));
1645	tap->wt_chan_flags = htole16(ic->ic_ibss_chan->ic_flags)((__uint16_t)(ic->ic_ibss_chan->ic_flags));
1646	if (mcs & RT2860_PHY_SHPRE(1 << 3))
1647	tap->wt_flags \|= IEEE80211_RADIOTAP_F_SHORTPRE0x02;
1648
1649	bpf_mtap_hdr(sc->sc_drvbpf, tap, sc->sc_txtap_len, m,
1650	BPF_DIRECTION_OUT(1 << 1));
1651	}
1652	#endif
1653
1654	/* copy and trim 802.11 header */
1655	memcpy(txwi + 1, wh, hdrlen)__builtin_memcpy((txwi + 1), (wh), (hdrlen));
1656	m_adj(m, hdrlen);
1657
1658	KASSERT (ring->queued <= RT2860_TX_RING_ONEMORE)((ring->queued <= ((64 - 1) - (1 + (15 / 2)))) ? (void) 0 : __assert("diagnostic ", "/usr/src/sys/dev/ic/rt2860.c", 1658 , "ring->queued <= RT2860_TX_RING_ONEMORE")); /* <1> */
1659
1660	if (bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), ( data->map), (m), (0x0001))) {
1661	if (m_defrag(m, M_DONTWAIT0x0002))
1662	return (ENOBUFS55);
1663	if (bus_dmamap_load_mbuf(sc->sc_dmat,(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), ( data->map), (m), (0x0001))
1664	data->map, m, BUS_DMA_NOWAIT)(*(sc->sc_dmat)->_dmamap_load_mbuf)((sc->sc_dmat), ( data->map), (m), (0x0001)))
1665	return (EFBIG27);
1666	}
1667
1668	/* The map will fit into the tx ring: (a "full" ring may have a few
1669	* unused descriptors, at most (txds(MAX_SCATTER) - 1))
1670	*
1671	* ring->queued + txds(data->map->nsegs)
1672	* <= { <0> data->map->nsegs <= MAX_SCATTER }
1673	* ring->queued + txds(MAX_SCATTER)
1674	* <= { <1> ring->queued <= TX_RING_MAX - txds(MAX_SCATTER) }
1675	* TX_RING_MAX - txds(MAX_SCATTER) + txds(MAX_SCATTER)
1676	* <= { arithmetic }
1677	* TX_RING_MAX
1678	*/
1679
1680	qsel = (qid < EDCA_NUM_AC4) ? RT2860_TX_QSEL_EDCA(2 << 1) : RT2860_TX_QSEL_MGMT(0 << 1);
1681
1682	/* first segment is TXWI + 802.11 header */
1683	txd = &ring->txd[ring->cur];
1684	txd->sdp0 = htole32(data->paddr)((__uint32_t)(data->paddr));
1685	txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + hdrlen)((__uint16_t)(sizeof (struct rt2860_txwi) + hdrlen));
1686	txd->flags = qsel;
1687
1688	/* setup payload segments */
1689	seg = data->map->dm_segs;
1690	for (nsegs = data->map->dm_nsegs; nsegs >= 2; nsegs -= 2) {
1691	txd->sdp1 = htole32(seg->ds_addr)((__uint32_t)(seg->ds_addr));
1692	txd->sdl1 = htole16(seg->ds_len)((__uint16_t)(seg->ds_len));
1693	seg++;
1694	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT64;
1695	/* grab a new Tx descriptor */
1696	txd = &ring->txd[ring->cur];
1697	txd->sdp0 = htole32(seg->ds_addr)((__uint32_t)(seg->ds_addr));
1698	txd->sdl0 = htole16(seg->ds_len)((__uint16_t)(seg->ds_len));
1699	txd->flags = qsel;
1700	seg++;
1701	}
1702	/* finalize last segment */
1703	if (nsegs > 0) {
1704	txd->sdp1 = htole32(seg->ds_addr)((__uint32_t)(seg->ds_addr));
1705	txd->sdl1 = htole16(seg->ds_len \| RT2860_TX_LS1)((__uint16_t)(seg->ds_len \| (1 << 14)));
1706	} else {
1707	txd->sdl0 \|= htole16(RT2860_TX_LS0)((__uint16_t)((1 << 14)));
1708	txd->sdl1 = 0;
1709	}
1710
1711	/* remove from the free pool and link it into the SW Tx slot */
1712	SLIST_REMOVE_HEAD(&sc->data_pool, next)do { (&sc->data_pool)->slh_first = (&sc->data_pool )->slh_first->next.sle_next; } while (0);
1713	data->m = m;
1714	data->ni = ni;
1715	ring->data[ring->cur] = data;
1716
1717	bus_dmamap_sync(sc->sc_dmat, sc->txwi_map,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), ((caddr_t)txwi - sc->txwi_vaddr), ((sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe) + sizeof (uint16_t ))), (0x04))
1718	(caddr_t)txwi - sc->txwi_vaddr, RT2860_TXWI_DMASZ,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), ((caddr_t)txwi - sc->txwi_vaddr), ((sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe) + sizeof (uint16_t ))), (0x04))
1719	BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (sc-> txwi_map), ((caddr_t)txwi - sc->txwi_vaddr), ((sizeof (struct rt2860_txwi) + sizeof (struct ieee80211_htframe) + sizeof (uint16_t ))), (0x04));
1720	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x04))
1721	BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (data-> map), (0), (data->map->dm_mapsize), (0x04));
1722	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x04))
1723	BUS_DMASYNC_PREWRITE)(*(sc->sc_dmat)->_dmamap_sync)((sc->sc_dmat), (ring-> map), (0), (ring->map->dm_mapsize), (0x04));
1724
1725	DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
1726	qid, txwi->wcid, data->map->dm_nsegs, ridx));
1727
1728	ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT64;
1729	ring->queued += 1 + (data->map->dm_nsegs / 2);
1730	if (ring->queued > RT2860_TX_RING_ONEMORE((64 - 1) - (1 + (15 / 2))))
1731	sc->qfullmsk \|= 1 << qid;
1732
1733	/* kick Tx */
1734	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x0238 + ( qid) * 16))), ((ring->cur))));
1735
1736	return 0;
1737	}
1738
1739	void
1740	rt2860_start(struct ifnet *ifp)
1741	{
1742	struct rt2860_softc *sc = ifp->if_softc;
1743	struct ieee80211com *ic = &sc->sc_ic;
1744	struct ieee80211_node *ni;
1745	struct mbuf *m;
1746
1747	if (!(ifp->if_flags & IFF_RUNNING0x40) \|\| ifq_is_oactive(&ifp->if_snd))
1748	return;
1749
1750	for (;;) {
1751	if (SLIST_EMPTY(&sc->data_pool)(((&sc->data_pool)->slh_first) == ((void *)0)) \|\| sc->qfullmsk != 0) {
1752	ifq_set_oactive(&ifp->if_snd);
1753	break;
1754	}
1755	/* send pending management frames first */
1756	m = mq_dequeue(&ic->ic_mgtq);
1757	if (m != NULL((void *)0)) {
1758	ni = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_cookie;
1759	goto sendit;
1760	}
1761	if (ic->ic_state != IEEE80211_S_RUN)
1762	break;
1763
1764	/* send buffered frames for power-save mode */
1765	m = mq_dequeue(&ic->ic_pwrsaveq);
1766	if (m != NULL((void *)0)) {
1767	ni = m->m_pkthdrM_dat.MH.MH_pkthdr.ph_cookie;
1768	goto sendit;
1769	}
1770
1771	/* encapsulate and send data frames */
1772	m = ifq_dequeue(&ifp->if_snd);
1773	if (m == NULL((void *)0))
1774	break;
1775	#if NBPFILTER1 > 0
1776	if (ifp->if_bpf != NULL((void *)0))
1777	bpf_mtap(ifp->if_bpf, m, BPF_DIRECTION_OUT(1 << 1));
1778	#endif
1779	if ((m = ieee80211_encap(ifp, m, &ni)) == NULL((void *)0))
1780	continue;
1781	sendit:
1782	#if NBPFILTER1 > 0
1783	if (ic->ic_rawbpf != NULL((void *)0))
1784	bpf_mtap(ic->ic_rawbpf, m, BPF_DIRECTION_OUT(1 << 1));
1785	#endif
1786	if (rt2860_tx(sc, m, ni) != 0) {
1787	m_freem(m);
1788	ieee80211_release_node(ic, ni);
1789	ifp->if_oerrorsif_data.ifi_oerrors++;
1790	continue;
1791	}
1792
1793	sc->sc_tx_timer = 5;
1794	ifp->if_timer = 1;
1795	}
1796	}
1797
1798	void
1799	rt2860_watchdog(struct ifnet *ifp)
1800	{
1801	struct rt2860_softc *sc = ifp->if_softc;
1802
1803	ifp->if_timer = 0;
1804
1805	if (sc->sc_tx_timer > 0) {
1806	if (--sc->sc_tx_timer == 0) {
1807	printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1808	rt2860_stop(ifp, 0);
1809	rt2860_init(ifp);
1810	ifp->if_oerrorsif_data.ifi_oerrors++;
1811	return;
1812	}
1813	ifp->if_timer = 1;
1814	}
1815
1816	ieee80211_watchdog(ifp);
1817	}
1818
1819	int
1820	rt2860_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1821	{
1822	struct rt2860_softc *sc = ifp->if_softc;
1823	struct ieee80211com *ic = &sc->sc_ic;
1824	int s, error = 0;
1825
1826	s = splnet()splraise(0x4);
1827
1828	switch (cmd) {
1829	case SIOCSIFADDR((unsigned long)0x80000000 \| ((sizeof(struct ifreq) & 0x1fff ) << 16) \| ((('i')) << 8) \| ((12))):
1830	ifp->if_flags \|= IFF_UP0x1;
1831	/* FALLTHROUGH */
1832	case SIOCSIFFLAGS((unsigned long)0x80000000 \| ((sizeof(struct ifreq) & 0x1fff ) << 16) \| ((('i')) << 8) \| ((16))):
1833	if (ifp->if_flags & IFF_UP0x1) {
1834	if (!(ifp->if_flags & IFF_RUNNING0x40))
1835	rt2860_init(ifp);
1836	} else {
1837	if (ifp->if_flags & IFF_RUNNING0x40)
1838	rt2860_stop(ifp, 1);
1839	}
1840	break;
1841
1842	case SIOCS80211CHANNEL((unsigned long)0x80000000 \| ((sizeof(struct ieee80211chanreq ) & 0x1fff) << 16) \| ((('i')) << 8) \| ((238)) ):
1843	/*
1844	* This allows for fast channel switching in monitor mode
1845	* (used by kismet). In IBSS mode, we must explicitly reset
1846	* the interface to generate a new beacon frame.
1847	*/
1848	error = ieee80211_ioctl(ifp, cmd, data);
1849	if (error == ENETRESET52 &&
1850	ic->ic_opmode == IEEE80211_M_MONITOR) {
1851	if ((ifp->if_flags & (IFF_UP0x1 \| IFF_RUNNING0x40)) ==
1852	(IFF_UP0x1 \| IFF_RUNNING0x40))
1853	rt2860_switch_chan(sc, ic->ic_ibss_chan);
1854	error = 0;
1855	}
1856	break;
1857
1858	default:
1859	error = ieee80211_ioctl(ifp, cmd, data);
1860	}
1861
1862	if (error == ENETRESET52) {
1863	if ((ifp->if_flags & (IFF_UP0x1 \| IFF_RUNNING0x40)) ==
1864	(IFF_UP0x1 \| IFF_RUNNING0x40)) {
1865	rt2860_stop(ifp, 0);
1866	rt2860_init(ifp);
1867	}
1868	error = 0;
1869	}
1870
1871	splx(s)spllower(s);
1872
1873	return error;
1874	}
1875
1876	/*
1877	* Reading and writing from/to the BBP is different from RT2560 and RT2661.
1878	* We access the BBP through the 8051 microcontroller unit which means that
1879	* the microcode must be loaded first.
1880	*/
1881	void
1882	rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
1883	{
1884	int ntries;
1885
1886	for (ntries = 0; ntries < 100; ntries++) {
1887	if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7028)))) & RT2860_BBP_CSR_KICK(1 << 17)))
1888	break;
1889	DELAY(1)(*delay_func)(1);
1890	}
1891	if (ntries == 100) {
1892	printf("%s: could not write to BBP through MCU\n",
1893	sc->sc_dev.dv_xname);
1894	return;
1895	}
1896
1897	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7028)), ( ((1 << 19) \| (1 << 17) \| reg << 8 \| val))))
1898	RT2860_BBP_CSR_KICK \| reg << 8 \| val)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7028)), ( ((1 << 19) \| (1 << 17) \| reg << 8 \| val))));
1899	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
1900
1901	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP0x80, 0, 0);
1902	DELAY(1000)(*delay_func)(1000);
1903	}
1904
1905	uint8_t
1906	rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
1907	{
1908	uint32_t val;
1909	int ntries;
1910
1911	for (ntries = 0; ntries < 100; ntries++) {
1912	if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7028)))) & RT2860_BBP_CSR_KICK(1 << 17)))
1913	break;
1914	DELAY(1)(*delay_func)(1);
1915	}
1916	if (ntries == 100) {
1917	printf("%s: could not read from BBP through MCU\n",
1918	sc->sc_dev.dv_xname);
1919	return 0;
1920	}
1921
1922	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7028)), ( ((1 << 19) \| (1 << 17) \| (1 << 16) \| reg << 8))))
1923	RT2860_BBP_CSR_KICK \| RT2860_BBP_CSR_READ \| reg << 8)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7028)), ( ((1 << 19) \| (1 << 17) \| (1 << 16) \| reg << 8))));
1924	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
1925
1926	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP0x80, 0, 0);
1927	DELAY(1000)(*delay_func)(1000);
1928
1929	for (ntries = 0; ntries < 100; ntries++) {
1930	val = RAL_READ(sc, RT2860_H2M_BBPAGENT)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7028))));
1931	if (!(val & RT2860_BBP_CSR_KICK(1 << 17)))
1932	return val & 0xff;
1933	DELAY(1)(*delay_func)(1);
1934	}
1935	printf("%s: could not read from BBP through MCU\n",
1936	sc->sc_dev.dv_xname);
1937
1938	return 0;
1939	}
1940
1941	/*
1942	* Write to one of the 4 programmable 24-bit RF registers.
1943	*/
1944	void
1945	rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
1946	{
1947	uint32_t tmp;
1948	int ntries;
1949
1950	for (ntries = 0; ntries < 100; ntries++) {
1951	if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1020)))) & RT2860_RF_REG_CTRL(1U << 31)))
1952	break;
1953	DELAY(1)(*delay_func)(1);
1954	}
1955	if (ntries == 100) {
1956	printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
1957	return;
1958	}
1959
1960	/* RF registers are 24-bit on the RT2860 */
1961	tmp = RT2860_RF_REG_CTRL(1U << 31) \| 24 << RT2860_RF_REG_WIDTH_SHIFT24 \|
1962	(val & 0x3fffff) << 2 \| (reg & 3);
1963	RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1020)), ( (tmp))));
1964	}
1965
1966	uint8_t
1967	rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
1968	{
1969	uint32_t tmp;
1970	int ntries;
1971
1972	for (ntries = 0; ntries < 100; ntries++) {
1973	if (!(RAL_READ(sc, RT3070_RF_CSR_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0500)))) & RT3070_RF_KICK(1 << 17)))
1974	break;
1975	DELAY(1)(*delay_func)(1);
1976	}
1977	if (ntries == 100) {
1978	printf("%s: could not read RF register\n",
1979	sc->sc_dev.dv_xname);
1980	return 0xff;
1981	}
1982	tmp = RT3070_RF_KICK(1 << 17) \| reg << 8;
1983	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0500)), ( (tmp))));
1984
1985	for (ntries = 0; ntries < 100; ntries++) {
1986	tmp = RAL_READ(sc, RT3070_RF_CSR_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0500))));
1987	if (!(tmp & RT3070_RF_KICK(1 << 17)))
1988	break;
1989	DELAY(1)(*delay_func)(1);
1990	}
1991	if (ntries == 100) {
1992	printf("%s: could not read RF register\n",
1993	sc->sc_dev.dv_xname);
1994	return 0xff;
1995	}
1996	return tmp & 0xff;
1997	}
1998
1999	void
2000	rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
2001	{
2002	uint32_t tmp;
2003	int ntries;
2004
2005	for (ntries = 0; ntries < 10; ntries++) {
2006	if (!(RAL_READ(sc, RT3070_RF_CSR_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0500)))) & RT3070_RF_KICK(1 << 17)))
2007	break;
2008	DELAY(10)(*delay_func)(10);
2009	}
2010	if (ntries == 10) {
2011	printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
2012	return;
2013	}
2014
2015	tmp = RT3070_RF_WRITE(1 << 16) \| RT3070_RF_KICK(1 << 17) \| reg << 8 \| val;
2016	RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0500)), ( (tmp))));
2017	}
2018
2019	/*
2020	* Send a command to the 8051 microcontroller unit.
2021	*/
2022	int
2023	rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
2024	{
2025	int slot, ntries;
2026	uint32_t tmp;
2027	uint8_t cid;
2028
2029	for (ntries = 0; ntries < 100; ntries++) {
2030	if (!(RAL_READ(sc, RT2860_H2M_MAILBOX)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7010)))) & RT2860_H2M_BUSY(1 << 24)))
2031	break;
2032	DELAY(2)(*delay_func)(2);
2033	}
2034	if (ntries == 100)
2035	return EIO5;
2036
2037	cid = wait ? cmd : RT2860_TOKEN_NO_INTR0xff;
2038	RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY \| cid << 16 \| arg)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7010)), ( ((1 << 24) \| cid << 16 \| arg))));
2039	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
2040	RAL_WRITE(sc, RT2860_HOST_CMD, cmd)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0404)), ( (cmd))));
2041
2042	if (!wait)
2043	return 0;
2044	/* wait for the command to complete */
2045	for (ntries = 0; ntries < 200; ntries++) {
2046	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7014))));
2047	/* find the command slot */
2048	for (slot = 0; slot < 4; slot++, tmp >>= 8)
2049	if ((tmp & 0xff) == cid)
2050	break;
2051	if (slot < 4)
2052	break;
2053	DELAY(100)(*delay_func)(100);
2054	}
2055	if (ntries == 200) {
2056	/* clear command and status */
2057	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x701c)), ( (0xffffffff))));
2058	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7014)), ( (0xffffffff))));
2059	return ETIMEDOUT60;
2060	}
2061	/* get command status (1 means success) */
2062	tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x701c))));
2063	tmp = (tmp >> (slot * 8)) & 0xff;
2064	DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
2065	cmd, slot, tmp));
2066	/* clear command and status */
2067	RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x701c)), ( (0xffffffff))));
2068	RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7014)), ( (0xffffffff))));
2069	return (tmp == 1) ? 0 : EIO5;
2070	}
2071
2072	void
2073	rt2860_enable_mrr(struct rt2860_softc *sc)
2074	{
2075	#define CCK(mcs) (mcs)
2076	#define OFDM(mcs) (1 << 3 \| (mcs))
2077	RAL_WRITE(sc, RT2860_LG_FBK_CFG0,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2078	OFDM(6) << 28 \| /* 54->48 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2079	OFDM(5) << 24 \| /* 48->36 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2080	OFDM(4) << 20 \| /* 36->24 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2081	OFDM(3) << 16 \| /* 24->18 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2082	OFDM(2) << 12 \| /* 18->12 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2083	OFDM(1) << 8 \| /* 12-> 9 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2084	OFDM(0) << 4 \| /* 9-> 6 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0)))))
2085	OFDM(0))(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x135c)), ( (OFDM(6) << 28 \| OFDM(5) << 24 \| OFDM(4) << 20 \| OFDM(3) << 16 \| OFDM(2) << 12 \| OFDM(1) << 8 \| OFDM(0) << 4 \| OFDM(0))))); /* 6-> 6 */
2086
2087	RAL_WRITE(sc, RT2860_LG_FBK_CFG1,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1360)), ( (CCK(2) << 12 \| CCK(1) << 8 \| CCK(0) << 4 \| CCK(0)))))
2088	CCK(2) << 12 \| /* 11->5.5 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1360)), ( (CCK(2) << 12 \| CCK(1) << 8 \| CCK(0) << 4 \| CCK(0)))))
2089	CCK(1) << 8 \| /* 5.5-> 2 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1360)), ( (CCK(2) << 12 \| CCK(1) << 8 \| CCK(0) << 4 \| CCK(0)))))
2090	CCK(0) << 4 \| /* 2-> 1 */(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1360)), ( (CCK(2) << 12 \| CCK(1) << 8 \| CCK(0) << 4 \| CCK(0)))))
2091	CCK(0))(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1360)), ( (CCK(2) << 12 \| CCK(1) << 8 \| CCK(0) << 4 \| CCK(0))))); /* 1-> 1 */
2092	#undef OFDM
2093	#undef CCK
2094	}
2095
2096	void
2097	rt2860_set_txpreamble(struct rt2860_softc *sc)
2098	{
2099	uint32_t tmp;
2100
2101	tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1404))));
2102	tmp &= ~RT2860_CCK_SHORT_EN(1 << 4);
2103	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE0x00040000)
2104	tmp \|= RT2860_CCK_SHORT_EN(1 << 4);
2105	RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1404)), ( (tmp))));
2106	}
2107
2108	void
2109	rt2860_set_basicrates(struct rt2860_softc *sc)
2110	{
2111	struct ieee80211com *ic = &sc->sc_ic;
2112
2113	/* set basic rates mask */
2114	if (ic->ic_curmode == IEEE80211_MODE_11B)
2115	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x003)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1408)), ( (0x003))));
2116	else if (ic->ic_curmode == IEEE80211_MODE_11A)
2117	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x150)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1408)), ( (0x150))));
2118	else /* 11g */
2119	RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x15f)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1408)), ( (0x15f))));
2120	}
2121
2122	void
2123	rt2860_select_chan_group(struct rt2860_softc *sc, int group)
2124	{
2125	uint32_t tmp;
2126	uint8_t agc;
2127
2128	/* Wait for BBP to settle */
2129	DELAY(1000)(*delay_func)(1000);
2130
2131	rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
2132	rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
2133	rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
2134	rt2860_mcu_bbp_write(sc, 86, 0x00);
2135
2136	if (group == 0) {
2137	if (sc->ext_2ghz_lna) {
2138	rt2860_mcu_bbp_write(sc, 82, 0x62);
2139	rt2860_mcu_bbp_write(sc, 75, 0x46);
2140	} else {
2141	rt2860_mcu_bbp_write(sc, 82, 0x84);
2142	rt2860_mcu_bbp_write(sc, 75, 0x50);
2143	}
2144	} else {
2145	if (sc->mac_ver == 0x3572)
2146	rt2860_mcu_bbp_write(sc, 82, 0x94);
2147	else
2148	rt2860_mcu_bbp_write(sc, 82, 0xf2);
2149
2150	if (sc->ext_5ghz_lna)
2151	rt2860_mcu_bbp_write(sc, 75, 0x46);
2152	else
2153	rt2860_mcu_bbp_write(sc, 75, 0x50);
2154	}
2155
2156	tmp = RAL_READ(sc, RT2860_TX_BAND_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x132c))));
2157	tmp &= ~(RT2860_5G_BAND_SEL_N(1 << 2) \| RT2860_5G_BAND_SEL_P(1 << 1));
2158	tmp \|= (group == 0) ? RT2860_5G_BAND_SEL_N(1 << 2) : RT2860_5G_BAND_SEL_P(1 << 1);
2159	RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x132c)), ( (tmp))));
2160
2161	/* enable appropriate Power Amplifiers and Low Noise Amplifiers */
2162	tmp = RT2860_RFTR_EN(1U << 16) \| RT2860_TRSW_EN(1U << 18) \| RT2860_LNA_PE0_EN((1U << 8) \| (1U << 9));
2163	if (sc->nrxchains > 1)
2164	tmp \|= RT2860_LNA_PE1_EN((1U << 10) \| (1U << 11));
2165	if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
2166	tmp \|= RT3593_LNA_PE2_EN((1U << 28) \| (1U << 29));
2167	if (group == 0) { /* 2GHz */
2168	tmp \|= RT2860_PA_PE_G0_EN(1U << 1);
2169	if (sc->ntxchains > 1)
2170	tmp \|= RT2860_PA_PE_G1_EN(1U << 3);
2171	if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2172	tmp \|= RT3593_PA_PE_G2_EN(1U << 25);
2173	} else { /* 5GHz */
2174	tmp \|= RT2860_PA_PE_A0_EN(1U << 0);
2175	if (sc->ntxchains > 1)
2176	tmp \|= RT2860_PA_PE_A1_EN(1U << 2);
2177	if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
2178	tmp \|= RT3593_PA_PE_A2_EN(1U << 24);
2179	}
2180	if (sc->mac_ver == 0x3572) {
2181	rt3090_rf_write(sc, 8, 0x00);
2182	RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1328)), ( (tmp))));
2183	rt3090_rf_write(sc, 8, 0x80);
2184	} else
2185	RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1328)), ( (tmp))));
2186
2187	if (sc->mac_ver == 0x3593) {
2188	tmp = RAL_READ(sc, RT2860_GPIO_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0228))));
2189	if (sc->sc_flags & RT2860_PCIE(1 << 2)) {
2190	tmp &= ~0x01010000;
2191	if (group == 0)
2192	tmp \|= 0x00010000;
2193	} else {
2194	tmp &= ~0x00008080;
2195	if (group == 0)
2196	tmp \|= 0x00000080;
2197	}
2198	tmp = (tmp & ~0x00001000) \| 0x00000010;
2199	RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0228)), ( (tmp))));
2200	}
2201
2202	/* set initial AGC value */
2203	if (group == 0) { /* 2GHz band */
2204	if (sc->mac_ver >= 0x3071)
2205	agc = 0x1c + sc->lna[0] * 2;
2206	else
2207	agc = 0x2e + sc->lna[0];
2208	} else { /* 5GHz band */
2209	if (sc->mac_ver == 0x3572)
2210	agc = 0x22 + (sc->lna[group] * 5) / 3;
2211	else
2212	agc = 0x32 + (sc->lna[group] * 5) / 3;
2213	}
2214	rt2860_mcu_bbp_write(sc, 66, agc);
2215
2216	DELAY(1000)(*delay_func)(1000);
2217	}
2218
2219	void
2220	rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
2221	{
2222	const struct rfprog *rfprog = rt2860_rf2850;
2223	uint32_t r2, r3, r4;
2224	int8_t txpow1, txpow2;
2225	u_int i;
2226
2227	/* find the settings for this channel (we know it exists) */
2228	for (i = 0; rfprog[i].chan != chan; i++);
2229
2230	r2 = rfprog[i].r2;
2231	if (sc->ntxchains == 1)
2232	r2 \|= 1 << 12; /* 1T: disable Tx chain 2 */
2233	if (sc->nrxchains == 1)
2234	r2 \|= 1 << 15 \| 1 << 4; /* 1R: disable Rx chains 2 & 3 */
2235	else if (sc->nrxchains == 2)
2236	r2 \|= 1 << 4; /* 2R: disable Rx chain 3 */
2237
2238	/* use Tx power values from EEPROM */
2239	txpow1 = sc->txpow1[i];
2240	txpow2 = sc->txpow2[i];
2241	if (chan > 14) {
2242	if (txpow1 >= 0)
2243	txpow1 = txpow1 << 1 \| 1;
2244	else
2245	txpow1 = (7 + txpow1) << 1;
2246	if (txpow2 >= 0)
2247	txpow2 = txpow2 << 1 \| 1;
2248	else
2249	txpow2 = (7 + txpow2) << 1;
2250	}
2251	r3 = rfprog[i].r3 \| txpow1 << 7;
2252	r4 = rfprog[i].r4 \| sc->freq << 13 \| txpow2 << 4;
2253
2254	rt2860_rf_write(sc, RT2860_RF10, rfprog[i].r1);
2255	rt2860_rf_write(sc, RT2860_RF22, r2);
2256	rt2860_rf_write(sc, RT2860_RF31, r3);
2257	rt2860_rf_write(sc, RT2860_RF43, r4);
2258
2259	DELAY(200)(*delay_func)(200);
2260
2261	rt2860_rf_write(sc, RT2860_RF10, rfprog[i].r1);
2262	rt2860_rf_write(sc, RT2860_RF22, r2);
2263	rt2860_rf_write(sc, RT2860_RF31, r3 \| 1);
2264	rt2860_rf_write(sc, RT2860_RF43, r4);
2265
2266	DELAY(200)(*delay_func)(200);
2267
2268	rt2860_rf_write(sc, RT2860_RF10, rfprog[i].r1);
2269	rt2860_rf_write(sc, RT2860_RF22, r2);
2270	rt2860_rf_write(sc, RT2860_RF31, r3);
2271	rt2860_rf_write(sc, RT2860_RF43, r4);
2272	}
2273
2274	void
2275	rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
2276	{
2277	int8_t txpow1, txpow2;
2278	uint8_t rf;
2279	int i;
2280
2281	KASSERT(chan >= 1 && chan <= 14)((chan >= 1 && chan <= 14) ? (void)0 : __assert ("diagnostic ", "/usr/src/sys/dev/ic/rt2860.c", 2281, "chan >= 1 && chan <= 14" )); /* RT3090 is 2GHz only */
2282
2283	/* find the settings for this channel (we know it exists) */
2284	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2285
2286	/* use Tx power values from EEPROM */
2287	txpow1 = sc->txpow1[i];
2288	txpow2 = sc->txpow2[i];
2289
2290	rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
2291	rf = rt3090_rf_read(sc, 3);
2292	rf = (rf & ~0x0f) \| rt3090_freqs[i].k;
2293	rt3090_rf_write(sc, 3, rf);
2294	rf = rt3090_rf_read(sc, 6);
2295	rf = (rf & ~0x03) \| rt3090_freqs[i].r;
2296	rt3090_rf_write(sc, 6, rf);
2297
2298	/* set Tx0 power */
2299	rf = rt3090_rf_read(sc, 12);
2300	rf = (rf & ~0x1f) \| txpow1;
2301	rt3090_rf_write(sc, 12, rf);
2302
2303	/* set Tx1 power */
2304	rf = rt3090_rf_read(sc, 13);
2305	rf = (rf & ~0x1f) \| txpow2;
2306	rt3090_rf_write(sc, 13, rf);
2307
2308	rf = rt3090_rf_read(sc, 1);
2309	rf &= ~0xfc;
2310	if (sc->ntxchains == 1)
2311	rf \|= RT3070_TX1_PD(1 << 5) \| RT3070_TX2_PD(1 << 7);
2312	else if (sc->ntxchains == 2)
2313	rf \|= RT3070_TX2_PD(1 << 7);
2314	if (sc->nrxchains == 1)
2315	rf \|= RT3070_RX1_PD(1 << 4) \| RT3070_RX2_PD(1 << 6);
2316	else if (sc->nrxchains == 2)
2317	rf \|= RT3070_RX2_PD(1 << 6);
2318	rt3090_rf_write(sc, 1, rf);
2319
2320	/* set RF offset */
2321	rf = rt3090_rf_read(sc, 23);
2322	rf = (rf & ~0x7f) \| sc->freq;
2323	rt3090_rf_write(sc, 23, rf);
2324
2325	/* program RF filter */
2326	rf = rt3090_rf_read(sc, 24); /* Tx */
2327	rf = (rf & ~0x3f) \| sc->rf24_20mhz;
2328	rt3090_rf_write(sc, 24, rf);
2329	rf = rt3090_rf_read(sc, 31); /* Rx */
2330	rf = (rf & ~0x3f) \| sc->rf24_20mhz;
2331	rt3090_rf_write(sc, 31, rf);
2332
2333	/* enable RF tuning */
2334	rf = rt3090_rf_read(sc, 7);
2335	rt3090_rf_write(sc, 7, rf \| RT3070_TUNE(1 << 0));
2336	}
2337
2338	void
2339	rt5390_set_chan(struct rt2860_softc *sc, u_int chan)
2340	{
2341	uint8_t h20mhz, rf, tmp;
2342	int8_t txpow1, txpow2;
2343	int i;
2344
2345	/* RT5390 is 2GHz only */
2346	KASSERT(chan >= 1 && chan <= 14)((chan >= 1 && chan <= 14) ? (void)0 : __assert ("diagnostic ", "/usr/src/sys/dev/ic/rt2860.c", 2346, "chan >= 1 && chan <= 14" ));
2347
2348	/* find the settings for this channel (we know it exists) */
2349	for (i = 0; rt2860_rf2850[i].chan != chan; i++);
2350
2351	/* use Tx power values from EEPROM */
2352	txpow1 = sc->txpow1[i];
2353	txpow2 = sc->txpow2[i];
2354
2355	rt3090_rf_write(sc, 8, rt3090_freqs[i].n);
2356	rt3090_rf_write(sc, 9, rt3090_freqs[i].k & 0x0f);
2357	rf = rt3090_rf_read(sc, 11);
2358	rf = (rf & ~0x03) \| (rt3090_freqs[i].r & 0x03);
2359	rt3090_rf_write(sc, 11, rf);
2360
2361	rf = rt3090_rf_read(sc, 49);
2362	rf = (rf & ~0x3f) \| (txpow1 & 0x3f);
2363	/* the valid range of the RF R49 is 0x00~0x27 */
2364	if ((rf & 0x3f) > 0x27)
2365	rf = (rf & ~0x3f) \| 0x27;
2366	rt3090_rf_write(sc, 49, rf);
2367	if (sc->mac_ver == 0x5392) {
2368	rf = rt3090_rf_read(sc, 50);
2369	rf = (rf & ~0x3f) \| (txpow2 & 0x3f);
2370	/* the valid range of the RF R50 is 0x00~0x27 */
2371	if ((rf & 0x3f) > 0x27)
2372	rf = (rf & ~0x3f) \| 0x27;
2373	rt3090_rf_write(sc, 50, rf);
2374	}
2375
2376	rf = rt3090_rf_read(sc, 1);
2377	rf \|= RT3070_RF_BLOCK(1 << 0) \| RT3070_PLL_PD(1 << 1) \| RT3070_RX0_PD(1 << 2) \| RT3070_TX0_PD(1 << 3);
2378	if (sc->mac_ver == 0x5392)
2379	rf \|= RT3070_RX1_PD(1 << 4) \| RT3070_TX1_PD(1 << 5);
2380	rt3090_rf_write(sc, 1, rf);
2381
2382	rf = rt3090_rf_read(sc, 2);
2383	rt3090_rf_write(sc, 2, rf \| RT3593_RESCAL(1 << 7));
2384	DELAY(1000)(*delay_func)(1000);
2385	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL(1 << 7));
2386
2387	rf = rt3090_rf_read(sc, 17);
2388	tmp = rf;
2389	rf = (rf & ~0x7f) \| (sc->freq & 0x7f);
2390	rf = MIN(rf, 0x5f)(((rf)<(0x5f))?(rf):(0x5f));
2391	if (tmp != rf)
2392	rt2860_mcu_cmd(sc, 0x74, (tmp << 8 ) \| rf, 0);
2393
2394	if (sc->mac_ver == 0x5390) {
2395	if (chan <= 4)
2396	rf = 0x73;
2397	else if (chan >= 5 && chan <= 6)
2398	rf = 0x63;
2399	else if (chan >= 7 && chan <= 10)
2400	rf = 0x53;
2401	else
2402	rf = 43;
2403	rt3090_rf_write(sc, 55, rf);
2404
2405	if (chan == 1)
2406	rf = 0x0c;
2407	else if (chan == 2)
2408	rf = 0x0b;
2409	else if (chan == 3)
2410	rf = 0x0a;
2411	else if (chan >= 4 && chan <= 6)
2412	rf = 0x09;
2413	else if (chan >= 7 && chan <= 12)
2414	rf = 0x08;
2415	else if (chan == 13)
2416	rf = 0x07;
2417	else
2418	rf = 0x06;
2419	rt3090_rf_write(sc, 59, rf);
2420	} else if (sc->mac_ver == 0x3290) {
2421	if (chan == 6)
2422	rt2860_mcu_bbp_write(sc, 68, 0x0c);
2423	else
2424	rt2860_mcu_bbp_write(sc, 68, 0x0b);
2425
2426	if (chan >= 1 && chan < 6)
2427	rf = 0x0f;
2428	else if (chan >= 7 && chan <= 11)
2429	rf = 0x0e;
2430	else if (chan >= 12 && chan <= 14)
2431	rf = 0x0d;
2432	rt3090_rf_write(sc, 59, rf);
2433	}
2434
2435	/* Tx/Rx h20M */
2436	h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
2437	rf = rt3090_rf_read(sc, 30);
2438	rf = (rf & ~0x06) \| (h20mhz << 1) \| (h20mhz << 2);
2439	rt3090_rf_write(sc, 30, rf);
2440
2441	/* Rx BB filter VCM */
2442	rf = rt3090_rf_read(sc, 30);
2443	rf = (rf & ~0x18) \| 0x10;
2444	rt3090_rf_write(sc, 30, rf);
2445
2446	/* Initiate VCO calibration. */
2447	rf = rt3090_rf_read(sc, 3);
2448	rf \|= RT3593_VCOCAL(1 << 7);
2449	rt3090_rf_write(sc, 3, rf);
2450	}
2451
2452	int
2453	rt3090_rf_init(struct rt2860_softc *sc)
2454	{
2455	uint32_t tmp;
2456	uint8_t rf, bbp;
2457	int i;
2458
2459	rf = rt3090_rf_read(sc, 30);
2460	/* toggle RF R30 bit 7 */
2461	rt3090_rf_write(sc, 30, rf \| 0x80);
2462	DELAY(1000)(*delay_func)(1000);
2463	rt3090_rf_write(sc, 30, rf & ~0x80);
2464
2465	tmp = RAL_READ(sc, RT3070_LDO_CFG0)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x05d4))));
2466	tmp &= ~0x1f000000;
2467	if (sc->patch_dac && sc->mac_rev < 0x0211)
2468	tmp \|= 0x0d000000; /* 1.35V */
2469	else
2470	tmp \|= 0x01000000; /* 1.2V */
2471	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x05d4)), ( (tmp))));
2472
2473	/* patch LNA_PE_G1 */
2474	tmp = RAL_READ(sc, RT3070_GPIO_SWITCH)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x05dc))));
2475	RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x05dc)), ( (tmp & ~0x20))));
2476
2477	/* initialize RF registers to default value */
2478	if (sc->mac_ver == 0x3572) {
2479	for (i = 0; i < nitems(rt3572_def_rf)(sizeof((rt3572_def_rf)) / sizeof((rt3572_def_rf)[0])); i++) {
2480	rt3090_rf_write(sc, rt3572_def_rf[i].reg,
2481	rt3572_def_rf[i].val);
2482	}
2483	} else {
2484	for (i = 0; i < nitems(rt3090_def_rf)(sizeof((rt3090_def_rf)) / sizeof((rt3090_def_rf)[0])); i++) {
2485	rt3090_rf_write(sc, rt3090_def_rf[i].reg,
2486	rt3090_def_rf[i].val);
2487	}
2488	}
2489
2490	/* select 20MHz bandwidth */
2491	rt3090_rf_write(sc, 31, 0x14);
2492
2493	rf = rt3090_rf_read(sc, 6);
2494	rt3090_rf_write(sc, 6, rf \| 0x40);
2495
2496	if (sc->mac_ver != 0x3593) {
2497	/* calibrate filter for 20MHz bandwidth */
2498	sc->rf24_20mhz = 0x1f; /* default value */
2499	rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
2500
2501	/* select 40MHz bandwidth */
2502	bbp = rt2860_mcu_bbp_read(sc, 4);
2503	rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) \| 0x10);
2504	rf = rt3090_rf_read(sc, 31);
2505	rt3090_rf_write(sc, 31, rf \| 0x20);
2506
2507	/* calibrate filter for 40MHz bandwidth */
2508	sc->rf24_40mhz = 0x2f; /* default value */
2509	rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
2510
2511	/* go back to 20MHz bandwidth */
2512	bbp = rt2860_mcu_bbp_read(sc, 4);
2513	rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
2514	}
2515	if (sc->mac_rev < 0x0211)
2516	rt3090_rf_write(sc, 27, 0x03);
2517
2518	tmp = RAL_READ(sc, RT3070_OPT_14)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0114))));
2519	RAL_WRITE(sc, RT3070_OPT_14, tmp \| 1)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0114)), ( (tmp \| 1))));
2520
2521	if (sc->rf_rev == RT3070_RF_30200x0005)
2522	rt3090_set_rx_antenna(sc, 0);
2523
2524	bbp = rt2860_mcu_bbp_read(sc, 138);
2525	if (sc->mac_ver == 0x3593) {
2526	if (sc->ntxchains == 1)
2527	bbp \|= 0x60; /* turn off DAC1 and DAC2 */
2528	else if (sc->ntxchains == 2)
2529	bbp \|= 0x40; /* turn off DAC2 */
2530	if (sc->nrxchains == 1)
2531	bbp &= ~0x06; /* turn off ADC1 and ADC2 */
2532	else if (sc->nrxchains == 2)
2533	bbp &= ~0x04; /* turn off ADC2 */
2534	} else {
2535	if (sc->ntxchains == 1)
2536	bbp \|= 0x20; /* turn off DAC1 */
2537	if (sc->nrxchains == 1)
2538	bbp &= ~0x02; /* turn off ADC1 */
2539	}
2540	rt2860_mcu_bbp_write(sc, 138, bbp);
2541
2542	rf = rt3090_rf_read(sc, 1);
2543	rf &= ~(RT3070_RX0_PD(1 << 2) \| RT3070_TX0_PD(1 << 3));
2544	rf \|= RT3070_RF_BLOCK(1 << 0) \| RT3070_RX1_PD(1 << 4) \| RT3070_TX1_PD(1 << 5);
2545	rt3090_rf_write(sc, 1, rf);
2546
2547	rf = rt3090_rf_read(sc, 15);
2548	rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2(1 << 3));
2549
2550	rf = rt3090_rf_read(sc, 17);
2551	rf &= ~RT3070_TX_LO1(1 << 3);
2552	if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
2553	rf \|= 0x20; /* fix for long range Rx issue */
2554	if (sc->txmixgain_2ghz >= 2)
2555	rf = (rf & ~0x7) \| sc->txmixgain_2ghz;
2556	rt3090_rf_write(sc, 17, rf);
2557
2558	rf = rt3090_rf_read(sc, 20);
2559	rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1(1 << 3));
2560
2561	rf = rt3090_rf_read(sc, 21);
2562	rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2(1 << 3));
2563
2564	return 0;
2565	}
2566
2567	void
2568	rt5390_rf_init(struct rt2860_softc *sc)
2569	{
2570	uint8_t rf, bbp;
2571	int i;
2572
2573	rf = rt3090_rf_read(sc, 2);
2574	/* Toggle RF R2 bit 7. */
2575	rt3090_rf_write(sc, 2, rf \| RT3593_RESCAL(1 << 7));
2576	DELAY(1000)(*delay_func)(1000);
2577	rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL(1 << 7));
2578
2579	/* Initialize RF registers to default value. */
2580	if (sc->mac_ver == 0x5392) {
2581	for (i = 0; i < nitems(rt5392_def_rf)(sizeof((rt5392_def_rf)) / sizeof((rt5392_def_rf)[0])); i++) {
2582	rt3090_rf_write(sc, rt5392_def_rf[i].reg,
2583	rt5392_def_rf[i].val);
2584	}
2585	} else if (sc->mac_ver == 0x3290) {
2586	for (i = 0; i < nitems(rt3290_def_rf)(sizeof((rt3290_def_rf)) / sizeof((rt3290_def_rf)[0])); i++) {
2587	rt3090_rf_write(sc, rt3290_def_rf[i].reg,
2588	rt3290_def_rf[i].val);
2589	}
2590	} else {
2591	for (i = 0; i < nitems(rt5390_def_rf)(sizeof((rt5390_def_rf)) / sizeof((rt5390_def_rf)[0])); i++) {
2592	rt3090_rf_write(sc, rt5390_def_rf[i].reg,
2593	rt5390_def_rf[i].val);
2594	}
2595	}
2596
2597	sc->rf24_20mhz = 0x1f;
2598	sc->rf24_40mhz = 0x2f;
2599
2600	if (sc->mac_rev < 0x0211)
2601	rt3090_rf_write(sc, 27, 0x03);
2602
2603	/* Set led open drain enable. */
2604	RAL_WRITE(sc, RT3070_OPT_14, RAL_READ(sc, RT3070_OPT_14) \| 1)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0114)), ( ((((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0114)))) \| 1))));
2605
2606	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1334)), ( (0))));
2607	RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1338)), ( (0))));
2608
2609	if (sc->mac_ver == 0x3290 \|\|
2610	sc->mac_ver == 0x5390)
2611	rt3090_set_rx_antenna(sc, 0);
2612
2613	/* Patch RSSI inaccurate issue. */
2614	rt2860_mcu_bbp_write(sc, 79, 0x13);
2615	rt2860_mcu_bbp_write(sc, 80, 0x05);
2616	rt2860_mcu_bbp_write(sc, 81, 0x33);
2617
2618	/* Enable DC filter. */
2619	if (sc->mac_rev >= 0x0211 \|\|
2620	sc->mac_ver == 0x3290)
2621	rt2860_mcu_bbp_write(sc, 103, 0xc0);
2622
2623	bbp = rt2860_mcu_bbp_read(sc, 138);
2624	if (sc->ntxchains == 1)
2625	bbp \|= 0x20; /* Turn off DAC1. */
2626	if (sc->nrxchains == 1)
2627	bbp &= ~0x02; /* Turn off ADC1. */
2628	rt2860_mcu_bbp_write(sc, 138, bbp);
2629
2630	/* Enable RX LO1 and LO2. */
2631	rt3090_rf_write(sc, 38, rt3090_rf_read(sc, 38) & ~RT5390_RX_LO1(1 << 5));
2632	rt3090_rf_write(sc, 39, rt3090_rf_read(sc, 39) & ~RT5390_RX_LO2(1 << 7));
2633
2634	/* Avoid data lost and CRC error. */
2635	rt2860_mcu_bbp_write(sc, 4,
2636	rt2860_mcu_bbp_read(sc, 4) \| RT5390_MAC_IF_CTRL(1 << 6));
2637
2638	rf = rt3090_rf_read(sc, 30);
2639	rf = (rf & ~0x18) \| 0x10;
2640	rt3090_rf_write(sc, 30, rf);
2641
2642	/* Disable hardware antenna diversity. */
2643	if (sc->mac_ver == 0x5390)
2644	rt2860_mcu_bbp_write(sc, 154, 0);
2645	}
2646
2647	void
2648	rt3090_rf_wakeup(struct rt2860_softc *sc)
2649	{
2650	uint32_t tmp;
2651	uint8_t rf;
2652
2653	if (sc->mac_ver == 0x3593) {
2654	/* enable VCO */
2655	rf = rt3090_rf_read(sc, 1);
2656	rt3090_rf_write(sc, 1, rf \| RT3593_VCO(1 << 0));
2657
2658	/* initiate VCO calibration */
2659	rf = rt3090_rf_read(sc, 3);
2660	rt3090_rf_write(sc, 3, rf \| RT3593_VCOCAL(1 << 7));
2661
2662	/* enable VCO bias current control */
2663	rf = rt3090_rf_read(sc, 6);
2664	rt3090_rf_write(sc, 6, rf \| RT3593_VCO_IC(1 << 6));
2665
2666	/* initiate res calibration */
2667	rf = rt3090_rf_read(sc, 2);
2668	rt3090_rf_write(sc, 2, rf \| RT3593_RESCAL(1 << 7));
2669
2670	/* set reference current control to 0.33 mA */
2671	rf = rt3090_rf_read(sc, 22);
2672	rf &= ~RT3593_CP_IC_MASK0xe0;
2673	rf \|= 1 << RT3593_CP_IC_SHIFT5;
2674	rt3090_rf_write(sc, 22, rf);
2675
2676	/* enable RX CTB */
2677	rf = rt3090_rf_read(sc, 46);
2678	rt3090_rf_write(sc, 46, rf \| RT3593_RX_CTB(1 << 5));
2679
2680	rf = rt3090_rf_read(sc, 20);
2681	rf &= ~(RT3593_LDO_RF_VC_MASK0xe0 \| RT3593_LDO_PLL_VC_MASK0x0e);
2682	rt3090_rf_write(sc, 20, rf);
2683	} else {
2684	/* enable RF block */
2685	rf = rt3090_rf_read(sc, 1);
2686	rt3090_rf_write(sc, 1, rf \| RT3070_RF_BLOCK(1 << 0));
2687
2688	/* enable VCO bias current control */
2689	rf = rt3090_rf_read(sc, 7);
2690	rt3090_rf_write(sc, 7, rf \| 0x30);
2691
2692	rf = rt3090_rf_read(sc, 9);
2693	rt3090_rf_write(sc, 9, rf \| 0x0e);
2694
2695	/* enable RX CTB */
2696	rf = rt3090_rf_read(sc, 21);
2697	rt3090_rf_write(sc, 21, rf \| RT3070_RX_CTB(1 << 7));
2698
2699	/* fix Tx to Rx IQ glitch by raising RF voltage */
2700	rf = rt3090_rf_read(sc, 27);
2701	rf &= ~0x77;
2702	if (sc->mac_rev < 0x0211)
2703	rf \|= 0x03;
2704	rt3090_rf_write(sc, 27, rf);
2705	}
2706	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2707	tmp = RAL_READ(sc, RT3070_LDO_CFG0)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x05d4))));
2708	tmp = (tmp & ~0x1f000000) \| 0x0d000000;
2709	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x05d4)), ( (tmp))));
2710	}
2711	}
2712
2713	void
2714	rt5390_rf_wakeup(struct rt2860_softc *sc)
2715	{
2716	uint32_t tmp;
2717	uint8_t rf;
2718
2719	rf = rt3090_rf_read(sc, 1);
2720	rf \|= RT3070_RF_BLOCK(1 << 0) \| RT3070_PLL_PD(1 << 1) \| RT3070_RX0_PD(1 << 2) \|
2721	RT3070_TX0_PD(1 << 3);
2722	if (sc->mac_ver == 0x5392)
2723	rf \|= RT3070_RX1_PD(1 << 4) \| RT3070_TX1_PD(1 << 5);
2724	rt3090_rf_write(sc, 1, rf);
2725
2726	rf = rt3090_rf_read(sc, 6);
2727	rf \|= RT3593_VCO_IC(1 << 6) \| RT3593_VCOCAL(1 << 7);
2728	if (sc->mac_ver == 0x5390)
2729	rf &= ~RT3593_VCO_IC(1 << 6);
2730	rt3090_rf_write(sc, 6, rf);
2731
2732	rt3090_rf_write(sc, 2, rt3090_rf_read(sc, 2) \| RT3593_RESCAL(1 << 7));
2733
2734	rf = rt3090_rf_read(sc, 22);
2735	rf = (rf & ~0xe0) \| 0x20;
2736	rt3090_rf_write(sc, 22, rf);
2737
2738	rt3090_rf_write(sc, 42, rt3090_rf_read(sc, 42) \| RT5390_RX_CTB(1 << 6));
2739	rt3090_rf_write(sc, 20, rt3090_rf_read(sc, 20) & ~0x77);
2740	rt3090_rf_write(sc, 3, rt3090_rf_read(sc, 3) \| RT3593_VCOCAL(1 << 7));
2741
2742	if (sc->patch_dac && sc->mac_rev < 0x0211) {
2743	tmp = RAL_READ(sc, RT3070_LDO_CFG0)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x05d4))));
2744	tmp = (tmp & ~0x1f000000) \| 0x0d000000;
2745	RAL_WRITE(sc, RT3070_LDO_CFG0, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x05d4)), ( (tmp))));
2746	}
2747	}
2748
2749	int
2750	rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
2751	uint8_t *val)
2752	{
2753	uint8_t rf22, rf24;
2754	uint8_t bbp55_pb, bbp55_sb, delta;
2755	int ntries;
2756
2757	/* program filter */
2758	rf24 = rt3090_rf_read(sc, 24);
2759	rf24 = (rf24 & 0xc0) \| init; /* initial filter value */
2760	rt3090_rf_write(sc, 24, rf24);
2761
2762	/* enable baseband loopback mode */
2763	rf22 = rt3090_rf_read(sc, 22);
2764	rt3090_rf_write(sc, 22, rf22 \| RT3070_BB_LOOPBACK(1 << 0));
2765
2766	/* set power and frequency of passband test tone */
2767	rt2860_mcu_bbp_write(sc, 24, 0x00);
2768	for (ntries = 0; ntries < 100; ntries++) {
2769	/* transmit test tone */
2770	rt2860_mcu_bbp_write(sc, 25, 0x90);
2771	DELAY(1000)(*delay_func)(1000);
2772	/* read received power */
2773	bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
2774	if (bbp55_pb != 0)
2775	break;
2776	}
2777	if (ntries == 100)
2778	return ETIMEDOUT60;
2779
2780	/* set power and frequency of stopband test tone */
2781	rt2860_mcu_bbp_write(sc, 24, 0x06);
2782	for (ntries = 0; ntries < 100; ntries++) {
2783	/* transmit test tone */
2784	rt2860_mcu_bbp_write(sc, 25, 0x90);
2785	DELAY(1000)(*delay_func)(1000);
2786	/* read received power */
2787	bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
2788
2789	delta = bbp55_pb - bbp55_sb;
2790	if (delta > target)
2791	break;
2792
2793	/* reprogram filter */
2794	rf24++;
2795	rt3090_rf_write(sc, 24, rf24);
2796	}
2797	if (ntries < 100) {
2798	if (rf24 != init)
2799	rf24--; /* backtrack */
2800	*val = rf24;
2801	rt3090_rf_write(sc, 24, rf24);
2802	}
2803
2804	/* restore initial state */
2805	rt2860_mcu_bbp_write(sc, 24, 0x00);
2806
2807	/* disable baseband loopback mode */
2808	rf22 = rt3090_rf_read(sc, 22);
2809	rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK(1 << 0));
2810
2811	return 0;
2812	}
2813
2814	void
2815	rt3090_rf_setup(struct rt2860_softc *sc)
2816	{
2817	uint8_t bbp;
2818	int i;
2819
2820	if (sc->mac_rev >= 0x0211) {
2821	/* enable DC filter */
2822	rt2860_mcu_bbp_write(sc, 103, 0xc0);
2823
2824	/* improve power consumption */
2825	bbp = rt2860_mcu_bbp_read(sc, 31);
2826	rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
2827	}
2828
2829	RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1334)), ( (0))));
2830	if (sc->mac_rev < 0x0211) {
2831	RAL_WRITE(sc, RT2860_TX_SW_CFG2,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1338)), ( (sc->patch_dac ? 0x2c : 0x0f))))
2832	sc->patch_dac ? 0x2c : 0x0f)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1338)), ( (sc->patch_dac ? 0x2c : 0x0f))));
2833	} else
2834	RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1338)), ( (0))));
2835
2836	/* initialize RF registers from ROM */
2837	if (sc->mac_ver < 0x5390) {
2838	for (i = 0; i < 10; i++) {
2839	if (sc->rf[i].reg == 0 \|\| sc->rf[i].reg == 0xff)
2840	continue;
2841	rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
2842	}
2843	}
2844	}
2845
2846	void
2847	rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
2848	{
2849	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS0x50,
2850	which \| (sc->leds & 0x7f), 0);
2851	}
2852
2853	/*
2854	* Hardware has a general-purpose programmable timer interrupt that can
2855	* periodically raise MAC_INT_4.
2856	*/
2857	void
2858	rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
2859	{
2860	uint32_t tmp;
2861
2862	/* disable GP timer before reprogramming it */
2863	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x112c))));
2864	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x112c)), ( (tmp & ~(1 << 1)))));
2865
2866	if (ms == 0)
2867	return;
2868
2869	tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1128))));
2870	ms = 16; / Unit: 64us */
2871	tmp = (tmp & 0xffff) \| ms << RT2860_GP_TIMER_SHIFT16;
2872	RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1128)), ( (tmp))));
2873
2874	/* enable GP timer */
2875	tmp = RAL_READ(sc, RT2860_INT_TIMER_EN)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x112c))));
2876	RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp \| RT2860_GP_TIMER_EN)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x112c)), ( (tmp \| (1 << 1)))));
2877	}
2878
2879	void
2880	rt2860_set_bssid(struct rt2860_softc sc, const uint8_t bssid)
2881	{
2882	RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1010)), ( (bssid[0] \| bssid[1] << 8 \| bssid[2] << 16 \| bssid [3] << 24))))
2883	bssid[0] \| bssid[1] << 8 \| bssid[2] << 16 \| bssid[3] << 24)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1010)), ( (bssid[0] \| bssid[1] << 8 \| bssid[2] << 16 \| bssid [3] << 24))));
2884	RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1014)), ( (bssid[4] \| bssid[5] << 8))))
2885	bssid[4] \| bssid[5] << 8)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1014)), ( (bssid[4] \| bssid[5] << 8))));
2886	}
2887
2888	void
2889	rt2860_set_macaddr(struct rt2860_softc sc, const uint8_t addr)
2890	{
2891	RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1008)), ( (addr[0] \| addr[1] << 8 \| addr[2] << 16 \| addr[3] << 24))))
2892	addr[0] \| addr[1] << 8 \| addr[2] << 16 \| addr[3] << 24)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1008)), ( (addr[0] \| addr[1] << 8 \| addr[2] << 16 \| addr[3] << 24))));
2893	RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x100c)), ( (addr[4] \| addr[5] << 8 \| 0xff << 16))))
2894	addr[4] \| addr[5] << 8 \| 0xff << 16)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x100c)), ( (addr[4] \| addr[5] << 8 \| 0xff << 16))));
2895	}
2896
2897	void
2898	rt2860_updateslot(struct ieee80211com *ic)
2899	{
2900	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
2901	uint32_t tmp;
2902
2903	tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1104))));
2904	tmp &= ~0xff;
2905	tmp \|= (ic->ic_flags & IEEE80211_F_SHSLOT0x00020000) ?
2906	IEEE80211_DUR_DS_SHSLOT9 : IEEE80211_DUR_DS_SLOT20;
2907	RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1104)), ( (tmp))));
2908	}
2909
2910	void
2911	rt2860_updateprot(struct ieee80211com *ic)
2912	{
2913	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
2914	uint32_t tmp;
2915
2916	tmp = RT2860_RTSTH_EN(1 << 26) \| RT2860_PROT_NAV_SHORT(1 << 18) \| RT2860_TXOP_ALLOW_ALL(0x3f << 20);
2917	/* setup protection frame rate (MCS code) */
2918	tmp \|= (ic->ic_curmode == IEEE80211_MODE_11A) ?
2919	rt2860_rates[RT2860_RIDX_OFDM64].mcs :
2920	rt2860_rates[RT2860_RIDX_CCK113].mcs;
2921
2922	/* CCK frames don't require protection */
2923	RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1364)), ( (tmp))));
2924
2925	if (ic->ic_flags & IEEE80211_F_USEPROT0x00100000) {
2926	if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
2927	tmp \|= RT2860_PROT_CTRL_RTS_CTS(1 << 16);
2928	else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
2929	tmp \|= RT2860_PROT_CTRL_CTS(2 << 16);
2930	}
2931	RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1368)), ( (tmp))));
2932	}
2933
2934	void
2935	rt2860_updateedca(struct ieee80211com *ic)
2936	{
2937	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
2938	int aci;
2939
2940	/* update MAC TX configuration registers */
2941	for (aci = 0; aci < EDCA_NUM_AC4; aci++) {
2942	RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1300 + ( aci) * 4))), ((ic->ic_edca_ac[aci].ac_ecwmax << 16 \| ic->ic_edca_ac[aci].ac_ecwmin << 12 \| ic->ic_edca_ac [aci].ac_aifsn << 8 \| ic->ic_edca_ac[aci].ac_txoplimit ))))
2943	ic->ic_edca_ac[aci].ac_ecwmax << 16 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1300 + ( aci) * 4))), ((ic->ic_edca_ac[aci].ac_ecwmax << 16 \| ic->ic_edca_ac[aci].ac_ecwmin << 12 \| ic->ic_edca_ac [aci].ac_aifsn << 8 \| ic->ic_edca_ac[aci].ac_txoplimit ))))
2944	ic->ic_edca_ac[aci].ac_ecwmin << 12 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1300 + ( aci) * 4))), ((ic->ic_edca_ac[aci].ac_ecwmax << 16 \| ic->ic_edca_ac[aci].ac_ecwmin << 12 \| ic->ic_edca_ac [aci].ac_aifsn << 8 \| ic->ic_edca_ac[aci].ac_txoplimit ))))
2945	ic->ic_edca_ac[aci].ac_aifsn << 8 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1300 + ( aci) * 4))), ((ic->ic_edca_ac[aci].ac_ecwmax << 16 \| ic->ic_edca_ac[aci].ac_ecwmin << 12 \| ic->ic_edca_ac [aci].ac_aifsn << 8 \| ic->ic_edca_ac[aci].ac_txoplimit ))))
2946	ic->ic_edca_ac[aci].ac_txoplimit)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1300 + ( aci) * 4))), ((ic->ic_edca_ac[aci].ac_ecwmax << 16 \| ic->ic_edca_ac[aci].ac_ecwmin << 12 \| ic->ic_edca_ac [aci].ac_aifsn << 8 \| ic->ic_edca_ac[aci].ac_txoplimit ))));
2947	}
2948
2949	/* update SCH/DMA registers too */
2950	RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0214)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_aifsn << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_aifsn << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_aifsn << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_aifsn))))
2951	ic->ic_edca_ac[EDCA_AC_VO].ac_aifsn << 12 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0214)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_aifsn << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_aifsn << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_aifsn << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_aifsn))))
2952	ic->ic_edca_ac[EDCA_AC_VI].ac_aifsn << 8 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0214)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_aifsn << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_aifsn << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_aifsn << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_aifsn))))
2953	ic->ic_edca_ac[EDCA_AC_BK].ac_aifsn << 4 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0214)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_aifsn << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_aifsn << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_aifsn << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_aifsn))))
2954	ic->ic_edca_ac[EDCA_AC_BE].ac_aifsn)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0214)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_aifsn << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_aifsn << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_aifsn << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_aifsn))));
2955	RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0218)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmin << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmin << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmin << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmin))))
2956	ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmin << 12 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0218)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmin << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmin << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmin << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmin))))
2957	ic->ic_edca_ac[EDCA_AC_VI].ac_ecwmin << 8 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0218)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmin << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmin << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmin << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmin))))
2958	ic->ic_edca_ac[EDCA_AC_BK].ac_ecwmin << 4 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0218)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmin << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmin << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmin << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmin))))
2959	ic->ic_edca_ac[EDCA_AC_BE].ac_ecwmin)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0218)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmin << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmin << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmin << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmin))));
2960	RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x021c)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmax << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmax << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmax << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmax))))
2961	ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmax << 12 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x021c)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmax << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmax << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmax << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmax))))
2962	ic->ic_edca_ac[EDCA_AC_VI].ac_ecwmax << 8 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x021c)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmax << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmax << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmax << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmax))))
2963	ic->ic_edca_ac[EDCA_AC_BK].ac_ecwmax << 4 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x021c)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmax << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmax << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmax << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmax))))
2964	ic->ic_edca_ac[EDCA_AC_BE].ac_ecwmax)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x021c)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_ecwmax << 12 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_ecwmax << 8 \| ic->ic_edca_ac [EDCA_AC_BK].ac_ecwmax << 4 \| ic->ic_edca_ac[EDCA_AC_BE ].ac_ecwmax))));
2965	RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0220)), ( (ic->ic_edca_ac[EDCA_AC_BK].ac_txoplimit << 16 \| ic-> ic_edca_ac[EDCA_AC_BE].ac_txoplimit))))
2966	ic->ic_edca_ac[EDCA_AC_BK].ac_txoplimit << 16 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0220)), ( (ic->ic_edca_ac[EDCA_AC_BK].ac_txoplimit << 16 \| ic-> ic_edca_ac[EDCA_AC_BE].ac_txoplimit))))
2967	ic->ic_edca_ac[EDCA_AC_BE].ac_txoplimit)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0220)), ( (ic->ic_edca_ac[EDCA_AC_BK].ac_txoplimit << 16 \| ic-> ic_edca_ac[EDCA_AC_BE].ac_txoplimit))));
2968	RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0224)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_txoplimit << 16 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_txoplimit))))
2969	ic->ic_edca_ac[EDCA_AC_VO].ac_txoplimit << 16 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0224)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_txoplimit << 16 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_txoplimit))))
2970	ic->ic_edca_ac[EDCA_AC_VI].ac_txoplimit)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0224)), ( (ic->ic_edca_ac[EDCA_AC_VO].ac_txoplimit << 16 \| ic-> ic_edca_ac[EDCA_AC_VI].ac_txoplimit))));
2971	}
2972
2973	int
2974	rt2860_set_key(struct ieee80211com ic, struct ieee80211_node ni,
2975	struct ieee80211_key *k)
2976	{
2977	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
2978	bus_size_t base;
2979	uint32_t attr;
2980	uint8_t mode, wcid, iv[8];
2981
2982	/* defer setting of WEP keys until interface is brought up */
2983	if ((ic->ic_ific_ac.ac_if.if_flags & (IFF_UP0x1 \| IFF_RUNNING0x40)) !=
2984	(IFF_UP0x1 \| IFF_RUNNING0x40))
2985	return 0;
2986
2987	/* map net80211 cipher to RT2860 security mode */
2988	switch (k->k_cipher) {
2989	case IEEE80211_CIPHER_WEP40:
2990	mode = RT2860_MODE_WEP401;
2991	break;
2992	case IEEE80211_CIPHER_WEP104:
2993	mode = RT2860_MODE_WEP1042;
2994	break;
2995	case IEEE80211_CIPHER_TKIP:
2996	mode = RT2860_MODE_TKIP3;
2997	break;
2998	case IEEE80211_CIPHER_CCMP:
2999	mode = RT2860_MODE_AES_CCMP4;
3000	break;
3001	default:
3002	return EINVAL22;
3003	}
3004
3005	if (k->k_flags & IEEE80211_KEY_GROUP0x00000001) {
3006	wcid = 0; /* NB: update WCID0 for group keys */
3007	base = RT2860_SKEY(0, k->k_id)(0x6c00 + (0) * 128 + (k->k_id) * 32);
3008	} else {
3009	wcid = ((struct rt2860_node *)ni)->wcid;
3010	base = RT2860_PKEY(wcid)(0x4000 + (wcid) * 32);
3011	}
3012
3013	if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3014	RAL_WRITE_REGION_1(sc, base, k->k_key, 16)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((base )), ((k->k_key)), ((16))));
3015	#ifndef IEEE80211_STA_ONLY
3016	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
3017	RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[16], 8)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((base + 16)), ((&k->k_key[16])), ((8))));
3018	RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[24], 8)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((base + 24)), ((&k->k_key[24])), ((8))));
3019	} else
3020	#endif
3021	{
3022	RAL_WRITE_REGION_1(sc, base + 16, &k->k_key[24], 8)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((base + 16)), ((&k->k_key[24])), ((8))));
3023	RAL_WRITE_REGION_1(sc, base + 24, &k->k_key[16], 8)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((base + 24)), ((&k->k_key[16])), ((8))));
3024	}
3025	} else
3026	RAL_WRITE_REGION_1(sc, base, k->k_key, k->k_len)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((base )), ((k->k_key)), ((k->k_len))));
3027
3028	if (!(k->k_flags & IEEE80211_KEY_GROUP0x00000001) \|\|
3029	(k->k_flags & IEEE80211_KEY_TX0x00000002)) {
3030	/* set initial packet number in IV+EIV */
3031	if (k->k_cipher == IEEE80211_CIPHER_WEP40 \|\|
3032	k->k_cipher == IEEE80211_CIPHER_WEP104) {
3033	uint32_t val = arc4random();
3034	/* skip weak IVs from Fluhrer/Mantin/Shamir */
3035	if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
3036	val += 0x000100;
3037	iv[0] = val;
3038	iv[1] = val >> 8;
3039	iv[2] = val >> 16;
3040	iv[3] = k->k_id << 6;
3041	iv[4] = iv[5] = iv[6] = iv[7] = 0;
3042	} else {
3043	if (k->k_cipher == IEEE80211_CIPHER_TKIP) {
3044	iv[0] = k->k_tsc >> 8;
3045	iv[1] = (iv[0] \| 0x20) & 0x7f;
3046	iv[2] = k->k_tsc;
3047	} else /* CCMP */ {
3048	iv[0] = k->k_tsc;
3049	iv[1] = k->k_tsc >> 8;
3050	iv[2] = 0;
3051	}
3052	iv[3] = k->k_id << 6 \| IEEE80211_WEP_EXTIV0x20;
3053	iv[4] = k->k_tsc >> 16;
3054	iv[5] = k->k_tsc >> 24;
3055	iv[6] = k->k_tsc >> 32;
3056	iv[7] = k->k_tsc >> 40;
3057	}
3058	RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x6000 + (wcid) * 8))), ((iv)), ((8))));
3059	}
3060
3061	if (k->k_flags & IEEE80211_KEY_GROUP0x00000001) {
3062	/* install group key */
3063	attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7000))));
3064	attr &= ~(0xf << (k->k_id * 4));
3065	attr \|= mode << (k->k_id * 4);
3066	RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7000)), ( (attr))));
3067	} else {
3068	/* install pairwise key */
3069	attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid))(((sc)->sc_st)->read_4(((sc)->sc_sh), (((0x6800 + (wcid ) * 4)))));
3070	attr = (attr & ~0xf) \| (mode << 1) \| RT2860_RX_PKEY_EN(1 << 0);
3071	RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x6800 + ( wcid) * 4))), ((attr))));
3072	}
3073	return 0;
3074	}
3075
3076	void
3077	rt2860_delete_key(struct ieee80211com ic, struct ieee80211_node ni,
3078	struct ieee80211_key *k)
3079	{
3080	struct rt2860_softc *sc = ic->ic_softcic_ac.ac_if.if_softc;
3081	uint32_t attr;
3082	uint8_t wcid;
3083
3084	if (k->k_flags & IEEE80211_KEY_GROUP0x00000001) {
3085	/* remove group key */
3086	attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x7000))));
3087	attr &= ~(0xf << (k->k_id * 4));
3088	RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7000)), ( (attr))));
3089
3090	} else {
3091	/* remove pairwise key */
3092	wcid = ((struct rt2860_node *)ni)->wcid;
3093	attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid))(((sc)->sc_st)->read_4(((sc)->sc_sh), (((0x6800 + (wcid ) * 4)))));
3094	attr &= ~0xf;
3095	RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x6800 + ( wcid) * 4))), ((attr))));
3096	}
3097	}
3098
3099	#if NBPFILTER1 > 0
3100	int8_t
3101	rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
3102	{
3103	struct ieee80211com *ic = &sc->sc_ic;
3104	struct ieee80211_channel *c = ic->ic_ibss_chan;
3105	int delta;
3106
3107	if (IEEE80211_IS_CHAN_5GHZ(c)(((c)->ic_flags & 0x0100) != 0)) {
3108	u_int chan = ieee80211_chan2ieee(ic, c);
3109	delta = sc->rssi_5ghz[rxchain];
3110
3111	/* determine channel group */
3112	if (chan <= 64)
3113	delta -= sc->lna[1];
3114	else if (chan <= 128)
3115	delta -= sc->lna[2];
3116	else
3117	delta -= sc->lna[3];
3118	} else
3119	delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
3120
3121	return -12 - delta - rssi;
3122	}
3123	#endif
3124
3125	/*
3126	* Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
3127	* Used to adjust per-rate Tx power registers.
3128	*/
3129	static __inline uint32_t
3130	b4inc(uint32_t b32, int8_t delta)
3131	{
3132	int8_t i, b4;
3133
3134	for (i = 0; i < 8; i++) {
3135	b4 = b32 & 0xf;
3136	b4 += delta;
3137	if (b4 < 0)
3138	b4 = 0;
3139	else if (b4 > 0xf)
3140	b4 = 0xf;
3141	b32 = b32 >> 4 \| b4 << 28;
3142	}
3143	return b32;
3144	}
3145
3146	const char *
3147	rt2860_get_rf(uint16_t rev)
3148	{
3149	switch (rev) {
3150	case RT2860_RF_28200x0001: return "RT2820";
3151	case RT2860_RF_28500x0002: return "RT2850";
3152	case RT2860_RF_27200x0003: return "RT2720";
3153	case RT2860_RF_27500x0004: return "RT2750";
3154	case RT3070_RF_30200x0005: return "RT3020";
3155	case RT3070_RF_20200x0006: return "RT2020";
3156	case RT3070_RF_30210x0007: return "RT3021";
3157	case RT3070_RF_30220x0008: return "RT3022";
3158	case RT3070_RF_30520x0009: return "RT3052";
3159	case RT3070_RF_33200x000b: return "RT3320";
3160	case RT3070_RF_30530x000d: return "RT3053";
3161	case RT3290_RF_32900x3290: return "RT3290";
3162	case RT5390_RF_53600x5360: return "RT5360";
3163	case RT5390_RF_53900x5390: return "RT5390";
3164	case RT5390_RF_53920x5392: return "RT5392";
3165	default: return "unknown";
3166	}
3167	}
3168
3169	int
3170	rt2860_read_eeprom(struct rt2860_softc *sc)
3171	{
3172	struct ieee80211com *ic = &sc->sc_ic;
3173	int8_t delta_2ghz, delta_5ghz;
3174	uint32_t tmp;
3175	uint16_t val;
3176	int ridx, ant, i;
3177
3178	/* check whether the ROM is eFUSE ROM or EEPROM */
3179	sc->sc_srom_read = rt2860_eeprom_read_2;
3180	if (sc->mac_ver == 0x3290) {
3181	tmp = RAL_READ(sc, RT3290_EFUSE_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0024))));
3182	DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
3183	if (tmp & RT3070_SEL_EFUSE(1U << 31))
3184	sc->sc_srom_read = rt3290_efuse_read_2;
3185	} else if (sc->mac_ver >= 0x3071) {
3186	tmp = RAL_READ(sc, RT3070_EFUSE_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0580))));
3187	DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
3188	if (tmp & RT3070_SEL_EFUSE(1U << 31))
3189	sc->sc_srom_read = rt3090_efuse_read_2;
3190	}
3191
3192	/* read EEPROM version */
3193	val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION0x01);
3194	DPRINTF(("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8));
3195
3196	/* read MAC address */
3197	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC010x02);
3198	ic->ic_myaddr[0] = val & 0xff;
3199	ic->ic_myaddr[1] = val >> 8;
3200	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC230x03);
3201	ic->ic_myaddr[2] = val & 0xff;
3202	ic->ic_myaddr[3] = val >> 8;
3203	val = rt2860_srom_read(sc, RT2860_EEPROM_MAC450x04);
3204	ic->ic_myaddr[4] = val & 0xff;
3205	ic->ic_myaddr[5] = val >> 8;
3206
3207	/* read country code */
3208	val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY0x1c);
3209	DPRINTF(("EEPROM region code=0x%04x\n", val));
3210
3211	/* read vendor BBP settings */
3212	for (i = 0; i < 8; i++) {
3213	val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE0x78 + i);
3214	sc->bbp[i].val = val & 0xff;
3215	sc->bbp[i].reg = val >> 8;
3216	DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
3217	}
3218	if (sc->mac_ver >= 0x3071) {
3219	/* read vendor RF settings */
3220	for (i = 0; i < 10; i++) {
3221	val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE0x82 + i);
3222	sc->rf[i].val = val & 0xff;
3223	sc->rf[i].reg = val >> 8;
3224	DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
3225	sc->rf[i].val));
3226	}
3227	}
3228
3229	/* read RF frequency offset from EEPROM */
3230	val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS0x1d);
3231	sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
3232	DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
3233	if ((val >> 8) != 0xff) {
3234	/* read LEDs operating mode */
3235	sc->leds = val >> 8;
3236	sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED10x1e);
3237	sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED20x1f);
3238	sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED30x20);
3239	} else {
3240	/* broken EEPROM, use default settings */
3241	sc->leds = 0x01;
3242	sc->led[0] = 0x5555;
3243	sc->led[1] = 0x2221;
3244	sc->led[2] = 0xa9f8;
3245	}
3246	DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
3247	sc->leds, sc->led[0], sc->led[1], sc->led[2]));
3248
3249	/* read RF information */
3250	val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA0x1a);
3251	DPRINTF(("EEPROM ANT 0x%04x\n", val));
3252	if (sc->mac_ver >= 0x5390 \|\| sc->mac_ver == 0x3290)
3253	sc->rf_rev = rt2860_srom_read(sc, RT2860_EEPROM_CHIPID0x00);
3254	else
3255	sc->rf_rev = (val >> 8) & 0xf;
3256	sc->ntxchains = (val >> 4) & 0xf;
3257	sc->nrxchains = val & 0xf;
3258	DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
3259	sc->rf_rev, sc->ntxchains, sc->nrxchains));
3260
3261	/* check if RF supports automatic Tx access gain control */
3262	val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG0x1b);
3263	DPRINTF(("EEPROM CFG 0x%04x\n", val));
3264	/* check if driver should patch the DAC issue */
3265	if ((val >> 8) != 0xff)
3266	sc->patch_dac = (val >> 15) & 1;
3267	if ((val & 0xff) != 0xff) {
3268	sc->ext_5ghz_lna = (val >> 3) & 1;
3269	sc->ext_2ghz_lna = (val >> 2) & 1;
3270	/* check if RF supports automatic Tx access gain control */
3271	sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */;
3272	/* check if we have a hardware radio switch */
3273	sc->rfswitch = val & 1;
3274	}
3275	if (sc->sc_flags & RT2860_ADVANCED_PS(1 << 1)) {
3276	/* read PCIe power save level */
3277	val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL0x11);
3278	if ((val & 0xff) != 0xff) {
3279	sc->pslevel = val & 0x3;
3280	val = rt2860_srom_read(sc, RT2860_EEPROM_REV0x12);
3281	if ((val & 0xff80) != 0x9280)
3282	sc->pslevel = MIN(sc->pslevel, 1)(((sc->pslevel)<(1))?(sc->pslevel):(1));
3283	DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
3284	}
3285	}
3286
3287	/* read power settings for 2GHz channels */
3288	for (i = 0; i < 14; i += 2) {
3289	val = rt2860_srom_read(sc,
3290	RT2860_EEPROM_PWR2GHZ_BASE10x29 + i / 2);
3291	sc->txpow1[i + 0] = (int8_t)(val & 0xff);
3292	sc->txpow1[i + 1] = (int8_t)(val >> 8);
3293
3294	if (sc->mac_ver != 0x5390) {
3295	val = rt2860_srom_read(sc,
3296	RT2860_EEPROM_PWR2GHZ_BASE20x30 + i / 2);
3297	sc->txpow2[i + 0] = (int8_t)(val & 0xff);
3298	sc->txpow2[i + 1] = (int8_t)(val >> 8);
3299	}
3300	}
3301	/* fix broken Tx power entries */
3302	for (i = 0; i < 14; i++) {
3303	if (sc->txpow1[i] < 0 \|\|
3304	sc->txpow1[i] > ((sc->mac_ver >= 0x5390) ? 39 : 31))
3305	sc->txpow1[i] = 5;
3306	if (sc->mac_ver != 0x5390) {
3307	if (sc->txpow2[i] < 0 \|\|
3308	sc->txpow2[i] > ((sc->mac_ver == 0x5392) ? 39 : 31))
3309	sc->txpow2[i] = 5;
3310	}
3311	DPRINTF(("chan %d: power1=%d, power2=%d\n",
3312	rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
3313	}
3314	/* read power settings for 5GHz channels */
3315	for (i = 0; i < 40; i += 2) {
3316	val = rt2860_srom_read(sc,
3317	RT2860_EEPROM_PWR5GHZ_BASE10x3c + i / 2);
3318	sc->txpow1[i + 14] = (int8_t)(val & 0xff);
3319	sc->txpow1[i + 15] = (int8_t)(val >> 8);
3320
3321	val = rt2860_srom_read(sc,
3322	RT2860_EEPROM_PWR5GHZ_BASE20x53 + i / 2);
3323	sc->txpow2[i + 14] = (int8_t)(val & 0xff);
3324	sc->txpow2[i + 15] = (int8_t)(val >> 8);
3325	}
3326	/* fix broken Tx power entries */
3327	for (i = 0; i < 40; i++) {
3328	if (sc->txpow1[14 + i] < -7 \|\| sc->txpow1[14 + i] > 15)
3329	sc->txpow1[14 + i] = 5;
3330	if (sc->txpow2[14 + i] < -7 \|\| sc->txpow2[14 + i] > 15)
3331	sc->txpow2[14 + i] = 5;
3332	DPRINTF(("chan %d: power1=%d, power2=%d\n",
3333	rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
3334	sc->txpow2[14 + i]));
3335	}
3336
3337	/* read Tx power compensation for each Tx rate */
3338	val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR0x28);
3339	delta_2ghz = delta_5ghz = 0;
3340	if ((val & 0xff) != 0xff && (val & 0x80)) {
3341	delta_2ghz = val & 0xf;
3342	if (!(val & 0x40)) /* negative number */
3343	delta_2ghz = -delta_2ghz;
3344	}
3345	val >>= 8;
3346	if ((val & 0xff) != 0xff && (val & 0x80)) {
3347	delta_5ghz = val & 0xf;
3348	if (!(val & 0x40)) /* negative number */
3349	delta_5ghz = -delta_5ghz;
3350	}
3351	DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
3352	delta_2ghz, delta_5ghz));
3353
3354	for (ridx = 0; ridx < 5; ridx++) {
3355	uint32_t reg;
3356
3357	val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR0x6f + ridx * 2);
3358	reg = val;
3359	val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR0x6f + ridx * 2 + 1);
3360	reg \|= (uint32_t)val << 16;
3361
3362	sc->txpow20mhz[ridx] = reg;
3363	sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
3364	sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
3365
3366	DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
3367	"40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
3368	sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
3369	}
3370
3371	/* read factory-calibrated samples for temperature compensation */
3372	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ0x37);
3373	sc->tssi_2ghz[0] = val & 0xff; /* [-4] */
3374	sc->tssi_2ghz[1] = val >> 8; /* [-3] */
3375	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ0x38);
3376	sc->tssi_2ghz[2] = val & 0xff; /* [-2] */
3377	sc->tssi_2ghz[3] = val >> 8; /* [-1] */
3378	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ0x39);
3379	sc->tssi_2ghz[4] = val & 0xff; /* [+0] */
3380	sc->tssi_2ghz[5] = val >> 8; /* [+1] */
3381	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ0x3a);
3382	sc->tssi_2ghz[6] = val & 0xff; /* [+2] */
3383	sc->tssi_2ghz[7] = val >> 8; /* [+3] */
3384	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ0x3b);
3385	sc->tssi_2ghz[8] = val & 0xff; /* [+4] */
3386	sc->step_2ghz = val >> 8;
3387	DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3388	"0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
3389	sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
3390	sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
3391	sc->tssi_2ghz[8], sc->step_2ghz));
3392	/* check that ref value is correct, otherwise disable calibration */
3393	if (sc->tssi_2ghz[4] == 0xff)
3394	sc->calib_2ghz = 0;
3395
3396	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ0x6a);
3397	sc->tssi_5ghz[0] = val & 0xff; /* [-4] */
3398	sc->tssi_5ghz[1] = val >> 8; /* [-3] */
3399	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ0x6b);
3400	sc->tssi_5ghz[2] = val & 0xff; /* [-2] */
3401	sc->tssi_5ghz[3] = val >> 8; /* [-1] */
3402	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ0x6c);
3403	sc->tssi_5ghz[4] = val & 0xff; /* [+0] */
3404	sc->tssi_5ghz[5] = val >> 8; /* [+1] */
3405	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ0x6d);
3406	sc->tssi_5ghz[6] = val & 0xff; /* [+2] */
3407	sc->tssi_5ghz[7] = val >> 8; /* [+3] */
3408	val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ0x6e);
3409	sc->tssi_5ghz[8] = val & 0xff; /* [+4] */
3410	sc->step_5ghz = val >> 8;
3411	DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
3412	"0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
3413	sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
3414	sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
3415	sc->tssi_5ghz[8], sc->step_5ghz));
3416	/* check that ref value is correct, otherwise disable calibration */
3417	if (sc->tssi_5ghz[4] == 0xff)
3418	sc->calib_5ghz = 0;
3419
3420	/* read RSSI offsets and LNA gains from EEPROM */
3421	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ0x23);
3422	sc->rssi_2ghz[0] = val & 0xff; /* Ant A */
3423	sc->rssi_2ghz[1] = val >> 8; /* Ant B */
3424	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ0x24);
3425	if (sc->mac_ver >= 0x3071) {
3426	/*
3427	* On RT3090 chips (limited to 2 Rx chains), this ROM
3428	* field contains the Tx mixer gain for the 2GHz band.
3429	*/
3430	if ((val & 0xff) != 0xff)
3431	sc->txmixgain_2ghz = val & 0x7;
3432	DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
3433	} else
3434	sc->rssi_2ghz[2] = val & 0xff; /* Ant C */
3435	sc->lna[2] = val >> 8; /* channel group 2 */
3436
3437	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ0x25);
3438	sc->rssi_5ghz[0] = val & 0xff; /* Ant A */
3439	sc->rssi_5ghz[1] = val >> 8; /* Ant B */
3440	val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ0x26);
3441	sc->rssi_5ghz[2] = val & 0xff; /* Ant C */
3442	sc->lna[3] = val >> 8; /* channel group 3 */
3443
3444	val = rt2860_srom_read(sc, RT2860_EEPROM_LNA0x22);
3445	if (sc->mac_ver >= 0x3071)
3446	sc->lna[0] = RT3090_DEF_LNA10;
3447	else /* channel group 0 */
3448	sc->lna[0] = val & 0xff;
3449	sc->lna[1] = val >> 8; /* channel group 1 */
3450
3451	/* fix broken 5GHz LNA entries */
3452	if (sc->lna[2] == 0 \|\| sc->lna[2] == 0xff) {
3453	DPRINTF(("invalid LNA for channel group %d\n", 2));
3454	sc->lna[2] = sc->lna[1];
3455	}
3456	if (sc->lna[3] == 0 \|\| sc->lna[3] == 0xff) {
3457	DPRINTF(("invalid LNA for channel group %d\n", 3));
3458	sc->lna[3] = sc->lna[1];
3459	}
3460
3461	/* fix broken RSSI offset entries */
3462	for (ant = 0; ant < 3; ant++) {
3463	if (sc->rssi_2ghz[ant] < -10 \|\| sc->rssi_2ghz[ant] > 10) {
3464	DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
3465	ant + 1, sc->rssi_2ghz[ant]));
3466	sc->rssi_2ghz[ant] = 0;
3467	}
3468	if (sc->rssi_5ghz[ant] < -10 \|\| sc->rssi_5ghz[ant] > 10) {
3469	DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
3470	ant + 1, sc->rssi_5ghz[ant]));
3471	sc->rssi_5ghz[ant] = 0;
3472	}
3473	}
3474
3475	return 0;
3476	}
3477
3478	int
3479	rt2860_bbp_init(struct rt2860_softc *sc)
3480	{
3481	int i, ntries;
3482
3483	/* wait for BBP to wake up */
3484	for (ntries = 0; ntries < 20; ntries++) {
3485	uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
3486	if (bbp0 != 0 && bbp0 != 0xff)
3487	break;
3488	}
3489	if (ntries == 20) {
3490	printf("%s: timeout waiting for BBP to wake up\n",
3491	sc->sc_dev.dv_xname);
3492	return ETIMEDOUT60;
3493	}
3494
3495	/* initialize BBP registers to default values */
3496	if (sc->mac_ver >= 0x5390 \|\|
3497	sc->mac_ver == 0x3290)
3498	rt5390_bbp_init(sc);
3499	else {
3500	for (i = 0; i < nitems(rt2860_def_bbp)(sizeof((rt2860_def_bbp)) / sizeof((rt2860_def_bbp)[0])); i++) {
3501	rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
3502	rt2860_def_bbp[i].val);
3503	}
3504	}
3505
3506	/* fix BBP84 for RT2860E */
3507	if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
3508	rt2860_mcu_bbp_write(sc, 84, 0x19);
3509
3510	if (sc->mac_ver >= 0x3071) {
3511	rt2860_mcu_bbp_write(sc, 79, 0x13);
3512	rt2860_mcu_bbp_write(sc, 80, 0x05);
3513	rt2860_mcu_bbp_write(sc, 81, 0x33);
3514	} else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
3515	rt2860_mcu_bbp_write(sc, 69, 0x16);
3516	rt2860_mcu_bbp_write(sc, 73, 0x12);
3517	}
3518
3519	return 0;
3520	}
3521
3522	void
3523	rt5390_bbp_init(struct rt2860_softc *sc)
3524	{
3525	uint8_t bbp;
3526	int i;
3527
3528	/* Apply maximum likelihood detection for 2 stream case. */
3529	if (sc->nrxchains > 1) {
3530	bbp = rt2860_mcu_bbp_read(sc, 105);
3531	rt2860_mcu_bbp_write(sc, 105, bbp \| RT5390_MLD(1 << 2));
3532	}
3533
3534	/* Avoid data lost and CRC error. */
3535	bbp = rt2860_mcu_bbp_read(sc, 4);
3536	rt2860_mcu_bbp_write(sc, 4, bbp \| RT5390_MAC_IF_CTRL(1 << 6));
3537	if (sc->mac_ver == 0x3290) {
3538	for (i = 0; i < nitems(rt3290_def_bbp)(sizeof((rt3290_def_bbp)) / sizeof((rt3290_def_bbp)[0])); i++) {
3539	rt2860_mcu_bbp_write(sc, rt3290_def_bbp[i].reg,
3540	rt3290_def_bbp[i].val);
3541	}
3542	} else {
3543	for (i = 0; i < nitems(rt5390_def_bbp)(sizeof((rt5390_def_bbp)) / sizeof((rt5390_def_bbp)[0])); i++) {
3544	rt2860_mcu_bbp_write(sc, rt5390_def_bbp[i].reg,
3545	rt5390_def_bbp[i].val);
3546	}
3547	}
3548
3549	if (sc->mac_ver == 0x5392) {
3550	rt2860_mcu_bbp_write(sc, 84, 0x9a);
3551	rt2860_mcu_bbp_write(sc, 95, 0x9a);
3552	rt2860_mcu_bbp_write(sc, 98, 0x12);
3553	rt2860_mcu_bbp_write(sc, 106, 0x05);
3554	rt2860_mcu_bbp_write(sc, 134, 0xd0);
3555	rt2860_mcu_bbp_write(sc, 135, 0xf6);
3556	}
3557
3558	bbp = rt2860_mcu_bbp_read(sc, 152);
3559	rt2860_mcu_bbp_write(sc, 152, bbp \| 0x80);
3560
3561	/* Disable hardware antenna diversity. */
3562	if (sc->mac_ver == 0x5390)
3563	rt2860_mcu_bbp_write(sc, 154, 0);
3564	}
3565
3566	int
3567	rt3290_wlan_enable(struct rt2860_softc *sc)
3568	{
3569	uint32_t tmp;
3570	int ntries;
3571
3572	/* enable chip and check readiness */
3573	tmp = RAL_READ(sc, RT3290_WLAN_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0080))));
3574	tmp \|= RT3290_WLAN_EN(1U << 0) \| RT3290_FRC_WL_ANT_SET(1U << 5) \|
3575	RT3290_GPIO_OUT_OE_ALL(0xff << 24);
3576	RAL_WRITE(sc, RT3290_WLAN_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0080)), ( (tmp))));
3577
3578	for (ntries = 0; ntries < 200; ntries++) {
3579	tmp = RAL_READ(sc, RT3290_CMB_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0020))));
3580	if ((tmp & RT3290_PLL_LD(1U << 23)) &&
3581	(tmp & RT3290_XTAL_RDY(1U << 22)))
3582	break;
3583	DELAY(20)(*delay_func)(20);
3584	}
3585	if (ntries == 200)
3586	return EIO5;
3587
3588	/* toggle reset */
3589	tmp = RAL_READ(sc, RT3290_WLAN_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0080))));
3590	tmp \|= RT3290_WLAN_RESET(1U << 3) \| RT3290_WLAN_CLK_EN(1U << 1);
3591	tmp &= ~RT3290_PCIE_APP0_CLK_REQ(1U << 4);
3592	RAL_WRITE(sc, RT3290_WLAN_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0080)), ( (tmp))));
3593	DELAY(20)(*delay_func)(20);
3594	tmp &= ~RT3290_WLAN_RESET(1U << 3);
3595	RAL_WRITE(sc, RT3290_WLAN_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0080)), ( (tmp))));
3596	DELAY(1000)(*delay_func)(1000);
3597
3598	/* clear garbage interrupts */
3599	RAL_WRITE(sc, RT2860_INT_STATUS, 0x7fffffff)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0200)), ( (0x7fffffff))));
3600
3601	return 0;
3602	}
3603
3604	int
3605	rt2860_txrx_enable(struct rt2860_softc *sc)
3606	{
3607	uint32_t tmp;
3608	int ntries;
3609
3610	/* enable Tx/Rx DMA engine */
3611	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 2)))));
3612	RAL_BARRIER_READ_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x01 \| 0x02);
3613	for (ntries = 0; ntries < 200; ntries++) {
3614	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0208))));
3615	if ((tmp & (RT2860_TX_DMA_BUSY(1 << 1) \| RT2860_RX_DMA_BUSY(1 << 3))) == 0)
3616	break;
3617	DELAY(1000)(*delay_func)(1000);
3618	}
3619	if (ntries == 200) {
3620	printf("%s: timeout waiting for DMA engine\n",
3621	sc->sc_dev.dv_xname);
3622	return ETIMEDOUT60;
3623	}
3624
3625	DELAY(50)(*delay_func)(50);
3626
3627	tmp \|= RT2860_RX_DMA_EN(1 << 2) \| RT2860_TX_DMA_EN(1 << 0) \|
3628	RT2860_WPDMA_BT_SIZE642 << RT2860_WPDMA_BT_SIZE_SHIFT4;
3629	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0208)), ( (tmp))));
3630
3631	/* set Rx filter */
3632	tmp = RT2860_DROP_CRC_ERR(1 << 0) \| RT2860_DROP_PHY_ERR(1 << 1);
3633	if (sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR) {
3634	tmp \|= RT2860_DROP_UC_NOME(1 << 2) \| RT2860_DROP_DUPL(1 << 7) \|
3635	RT2860_DROP_CTS(1 << 11) \| RT2860_DROP_BA(1 << 14) \| RT2860_DROP_ACK(1 << 10) \|
3636	RT2860_DROP_VER_ERR(1 << 4) \| RT2860_DROP_CTRL_RSV(1 << 16) \|
3637	RT2860_DROP_CFACK(1 << 8) \| RT2860_DROP_CFEND(1 << 9);
3638	if (sc->sc_ic.ic_opmode == IEEE80211_M_STA)
3639	tmp \|= RT2860_DROP_RTS(1 << 12) \| RT2860_DROP_PSPOLL(1 << 13);
3640	}
3641	RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1400)), ( (tmp))));
3642
3643	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 3) \| (1 << 2)))))
3644	RT2860_MAC_RX_EN \| RT2860_MAC_TX_EN)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 3) \| (1 << 2)))));
3645
3646	return 0;
3647	}
3648
3649	int
3650	rt2860_init(struct ifnet *ifp)
3651	{
3652	struct rt2860_softc *sc = ifp->if_softc;
3653	struct ieee80211com *ic = &sc->sc_ic;
3654	uint32_t tmp;
3655	uint8_t bbp1, bbp3;
3656	int i, qid, ridx, ntries, error;
3657
3658	/* for CardBus, power on the socket */
3659	if (!(sc->sc_flags & RT2860_ENABLED(1 << 0))) {
3660	if (sc->sc_enable != NULL((void )0) && (sc->sc_enable)(sc) != 0) {
3661	printf("%s: could not enable device\n",
3662	sc->sc_dev.dv_xname);
3663	return EIO5;
3664	}
3665	sc->sc_flags \|= RT2860_ENABLED(1 << 0);
3666	}
3667
3668	if (sc->mac_ver == 0x3290) {
3669	if ((error = rt3290_wlan_enable(sc)) != 0) {
3670	printf("%s: could not enable wlan\n",
3671	sc->sc_dev.dv_xname);
3672	rt2860_stop(ifp, 1);
3673	return error;
3674	}
3675	}
3676
3677	if (sc->mac_ver == 0x3290 && sc->rfswitch){
3678	/* hardware has a radio switch on GPIO pin 0 */
3679	if (!(RAL_READ(sc, RT3290_WLAN_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0080)))) & RT3290_RADIO_EN(1U << 8))) {
3680	printf("%s: radio is disabled by hardware switch\n",
3681	sc->sc_dev.dv_xname);
3682	}
3683	} else if (sc->rfswitch) {
3684	/* hardware has a radio switch on GPIO pin 2 */
3685	if (!(RAL_READ(sc, RT2860_GPIO_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0228)))) & (1 << 2))) {
3686	printf("%s: radio is disabled by hardware switch\n",
3687	sc->sc_dev.dv_xname);
3688	#ifdef notyet
3689	rt2860_stop(ifp, 1);
3690	return EPERM1;
3691	#endif
3692	}
3693	}
3694	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1204)), ( ((1 << 1)))));
3695
3696	/* disable DMA */
3697	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0208))));
3698	tmp &= 0xff0;
3699	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0208)), ( (tmp))));
3700
3701	/* PBF hardware reset */
3702	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( (0xe1f))));
3703	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
3704	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( (0xe00))));
3705
3706	if ((error = rt2860_load_microcode(sc)) != 0) {
3707	printf("%s: could not load 8051 microcode\n",
3708	sc->sc_dev.dv_xname);
3709	rt2860_stop(ifp, 1);
3710	return error;
3711	}
3712
3713	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl))__builtin_memcpy((ic->ic_myaddr), (((caddr_t)((ifp->if_sadl )->sdl_data + (ifp->if_sadl)->sdl_nlen))), (6));
3714	rt2860_set_macaddr(sc, ic->ic_myaddr);
3715
3716	/* init Tx power for all Tx rates (from EEPROM) */
3717	for (ridx = 0; ridx < 5; ridx++) {
3718	if (sc->txpow20mhz[ridx] == 0xffffffff)
3719	continue;
3720	RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx])(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1314 + ( ridx) * 4))), ((sc->txpow20mhz[ridx]))));
3721	}
3722
3723	for (ntries = 0; ntries < 100; ntries++) {
3724	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0208))));
3725	if ((tmp & (RT2860_TX_DMA_BUSY(1 << 1) \| RT2860_RX_DMA_BUSY(1 << 3))) == 0)
3726	break;
3727	DELAY(1000)(*delay_func)(1000);
3728	}
3729	if (ntries == 100) {
3730	printf("%s: timeout waiting for DMA engine\n",
3731	sc->sc_dev.dv_xname);
3732	rt2860_stop(ifp, 1);
3733	return ETIMEDOUT60;
3734	}
3735	tmp &= 0xff0;
3736	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0208)), ( (tmp))));
3737
3738	/* reset Rx ring and all 6 Tx rings */
3739	RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x020c)), ( (0x1003f))));
3740
3741	/* PBF hardware reset */
3742	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( (0xe1f))));
3743	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
3744	RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( (0xe00))));
3745
3746	RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE \| RT2860_IO_RF_PE)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1204)), ( ((1 << 1) \| (1 << 0)))));
3747
3748	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST \| RT2860_MAC_SRST)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 1) \| (1 << 0)))));
3749	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
3750	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( (0))));
3751
3752	for (i = 0; i < nitems(rt2860_def_mac)(sizeof((rt2860_def_mac)) / sizeof((rt2860_def_mac)[0])); i++)
3753	RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((rt2860_def_mac [i].reg)), ((rt2860_def_mac[i].val))));
3754	if (sc->mac_ver == 0x3290 \|\|
3755	sc->mac_ver >= 0x5390)
3756	RAL_WRITE(sc, RT2860_TX_SW_CFG0, 0x00000404)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1330)), ( (0x00000404))));
3757	else if (sc->mac_ver >= 0x3071) {
3758	/* set delay of PA_PE assertion to 1us (unit of 0.25us) */
3759	RAL_WRITE(sc, RT2860_TX_SW_CFG0,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1330)), ( (4 << 8))))
3760	4 << RT2860_DLY_PAPE_EN_SHIFT)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1330)), ( (4 << 8))));
3761	}
3762
3763	if (!(RAL_READ(sc, RT2860_PCI_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0000)))) & RT2860_PCI_CFG_PCI(1 << 16))) {
3764	sc->sc_flags \|= RT2860_PCIE(1 << 2);
3765	/* PCIe has different clock cycle count than PCI */
3766	tmp = RAL_READ(sc, RT2860_US_CYC_CNT)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x02a4))));
3767	tmp = (tmp & ~0xff) \| 0x7d;
3768	RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x02a4)), ( (tmp))));
3769	}
3770
3771	/* wait while MAC is busy */
3772	for (ntries = 0; ntries < 100; ntries++) {
3773	if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1200)))) &
3774	(RT2860_RX_STATUS_BUSY(1 << 1) \| RT2860_TX_STATUS_BUSY(1 << 0))))
3775	break;
3776	DELAY(1000)(*delay_func)(1000);
3777	}
3778	if (ntries == 100) {
3779	printf("%s: timeout waiting for MAC\n", sc->sc_dev.dv_xname);
3780	rt2860_stop(ifp, 1);
3781	return ETIMEDOUT60;
3782	}
3783
3784	/* clear Host to MCU mailbox */
3785	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7028)), ( (0))));
3786	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7010)), ( (0))));
3787
3788	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET0x72, 0, 0);
3789	DELAY(1000)(*delay_func)(1000);
3790
3791	if ((error = rt2860_bbp_init(sc)) != 0) {
3792	rt2860_stop(ifp, 1);
3793	return error;
3794	}
3795
3796	/* clear RX WCID search table */
3797	RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), (((0x1800 + (0) * 8))), ((0)), ((512))));
3798	/* clear pairwise key table */
3799	RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), (((0x4000 + (0) * 32))), ((0)), ((2048))));
3800	/* clear IV/EIV table */
3801	RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), (((0x6000 + (0) * 8))), ((0)), ((512))));
3802	/* clear WCID attribute table */
3803	RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), (((0x6800 + (0) * 4))), ((0)), ((256))));
3804	/* clear shared key table */
3805	RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), (((0x6c00 + (0) * 128 + (0) * 32))), ((0)), ((8 * 32))));
3806	/* clear shared key mode */
3807	RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4)(((sc)->sc_st)->set_region_4(((sc)->sc_sh), ((0x7000 )), ((0)), ((4))));
3808
3809	/* init Tx rings (4 EDCAs + HCCA + Mgt) */
3810	for (qid = 0; qid < 6; qid++) {
3811	RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x0230 + ( qid) * 16))), ((sc->txq[qid].paddr))));
3812	RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x0234 + ( qid) * 16))), ((64))));
3813	RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x0238 + ( qid) * 16))), ((0))));
3814	}
3815
3816	/* init Rx ring */
3817	RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0290)), ( (sc->rxq.paddr))));
3818	RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0294)), ( (128))));
3819	RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0298)), ( (128 - 1))));
3820
3821	/* setup maximum buffer sizes */
3822	RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 \|(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1018)), ( (1 << 12 \| ((1 << 11) - sizeof (struct rt2860_rxwi ) - 2)))))
3823	(MCLBYTES - sizeof (struct rt2860_rxwi) - 2))(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1018)), ( (1 << 12 \| ((1 << 11) - sizeof (struct rt2860_rxwi ) - 2)))));
3824
3825	for (ntries = 0; ntries < 100; ntries++) {
3826	tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0208))));
3827	if ((tmp & (RT2860_TX_DMA_BUSY(1 << 1) \| RT2860_RX_DMA_BUSY(1 << 3))) == 0)
3828	break;
3829	DELAY(1000)(*delay_func)(1000);
3830	}
3831	if (ntries == 100) {
3832	printf("%s: timeout waiting for DMA engine\n",
3833	sc->sc_dev.dv_xname);
3834	rt2860_stop(ifp, 1);
3835	return ETIMEDOUT60;
3836	}
3837	tmp &= 0xff0;
3838	RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0208)), ( (tmp))));
3839
3840	/* disable interrupts mitigation */
3841	RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0210)), ( (0))));
3842
3843	/* write vendor-specific BBP values (from EEPROM) */
3844	for (i = 0; i < 8; i++) {
3845	if (sc->bbp[i].reg == 0 \|\| sc->bbp[i].reg == 0xff)
3846	continue;
3847	rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
3848	}
3849
3850	/* select Main antenna for 1T1R devices */
3851	if (sc->rf_rev == RT3070_RF_20200x0006 \|\|
3852	sc->rf_rev == RT3070_RF_30200x0005 \|\|
3853	sc->rf_rev == RT3290_RF_32900x3290 \|\|
3854	sc->rf_rev == RT3070_RF_33200x000b \|\|
3855	sc->rf_rev == RT5390_RF_53900x5390)
3856	rt3090_set_rx_antenna(sc, 0);
3857
3858	/* send LEDs operating mode to microcontroller */
3859	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED10x52, sc->led[0], 0);
3860	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED20x53, sc->led[1], 0);
3861	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED30x54, sc->led[2], 0);
3862
3863	if (sc->mac_ver == 0x3290 \|\|
3864	sc->mac_ver >= 0x5390)
3865	rt5390_rf_init(sc);
3866	else if (sc->mac_ver >= 0x3071)
3867	rt3090_rf_init(sc);
3868
3869	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP0x30, 0x02ff, 1);
3870	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP0x31, 0, 1);
3871
3872	if (sc->mac_ver == 0x3290 \|\|
3873	sc->mac_ver >= 0x5390)
3874	rt5390_rf_wakeup(sc);
3875	else if (sc->mac_ver >= 0x3071)
3876	rt3090_rf_wakeup(sc);
3877
3878	/* disable non-existing Rx chains */
3879	bbp3 = rt2860_mcu_bbp_read(sc, 3);
3880	bbp3 &= ~(1 << 3 \| 1 << 4);
3881	if (sc->nrxchains == 2)
3882	bbp3 \|= 1 << 3;
3883	else if (sc->nrxchains == 3)
3884	bbp3 \|= 1 << 4;
3885	rt2860_mcu_bbp_write(sc, 3, bbp3);
3886
3887	/* disable non-existing Tx chains */
3888	bbp1 = rt2860_mcu_bbp_read(sc, 1);
3889	if (sc->ntxchains == 1)
3890	bbp1 = (bbp1 & ~(1 << 3 \| 1 << 4));
3891	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
3892	bbp1 = (bbp1 & ~(1 << 4)) \| 1 << 3;
3893	else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
3894	bbp1 = (bbp1 & ~(1 << 3)) \| 1 << 4;
3895	rt2860_mcu_bbp_write(sc, 1, bbp1);
3896
3897	if (sc->mac_ver >= 0x3071)
3898	rt3090_rf_setup(sc);
3899
3900	/* select default channel */
3901	ic->ic_bss->ni_chan = ic->ic_ibss_chan;
3902	rt2860_switch_chan(sc, ic->ic_ibss_chan);
3903
3904	/* reset RF from MCU */
3905	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET0x72, 0, 0);
3906
3907	/* set RTS threshold */
3908	tmp = RAL_READ(sc, RT2860_TX_RTS_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1344))));
3909	tmp &= ~0xffff00;
3910	tmp \|= ic->ic_rtsthreshold << 8;
3911	RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1344)), ( (tmp))));
3912
3913	/* setup initial protection mode */
3914	sc->sc_ic_flags = ic->ic_flags;
3915	rt2860_updateprot(ic);
3916
3917	/* turn radio LED on */
3918	rt2860_set_leds(sc, RT2860_LED_RADIO(1 << 13));
3919
3920	/* enable Tx/Rx DMA engine */
3921	if ((error = rt2860_txrx_enable(sc)) != 0) {
3922	rt2860_stop(ifp, 1);
3923	return error;
3924	}
3925
3926	/* clear pending interrupts */
3927	RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0200)), ( (0xffffffff))));
3928	/* enable interrupts */
3929	RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0204)), ( (0x3fffc))));
3930
3931	if (sc->sc_flags & RT2860_ADVANCED_PS(1 << 1))
3932	rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL0x83, sc->pslevel, 0);
3933
3934	ifp->if_flags \|= IFF_RUNNING0x40;
3935	ifq_clr_oactive(&ifp->if_snd);
3936
3937	if (ic->ic_flags & IEEE80211_F_WEPON0x00000100) {
3938	/* install WEP keys */
3939	for (i = 0; i < IEEE80211_WEP_NKID4; i++)
3940	(void)rt2860_set_key(ic, NULL((void *)0), &ic->ic_nw_keys[i]);
3941	}
3942
3943	if (ic->ic_opmode != IEEE80211_M_MONITOR)
3944	ieee80211_new_state(ic, IEEE80211_S_SCAN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_SCAN), (-1)));
3945	else
3946	ieee80211_new_state(ic, IEEE80211_S_RUN, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_RUN), (-1)));
3947
3948	return 0;
3949	}
3950
3951	void
3952	rt2860_stop(struct ifnet *ifp, int disable)
3953	{
3954	struct rt2860_softc *sc = ifp->if_softc;
3955	struct ieee80211com *ic = &sc->sc_ic;
3956	uint32_t tmp;
3957	int qid;
3958
3959	if (ifp->if_flags & IFF_RUNNING0x40)
3960	rt2860_set_leds(sc, 0); /* turn all LEDs off */
3961
3962	sc->sc_tx_timer = 0;
3963	ifp->if_timer = 0;
3964	ifp->if_flags &= ~IFF_RUNNING0x40;
3965	ifq_clr_oactive(&ifp->if_snd);
3966
3967	ieee80211_new_state(ic, IEEE80211_S_INIT, -1)(((ic)->ic_newstate)((ic), (IEEE80211_S_INIT), (-1))); /* free all nodes */
3968
3969	/* disable interrupts */
3970	RAL_WRITE(sc, RT2860_INT_MASK, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0204)), ( (0))));
3971
3972	/* disable GP timer */
3973	rt2860_set_gp_timer(sc, 0);
3974
3975	/* disable Rx */
3976	tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1004))));
3977	tmp &= ~(RT2860_MAC_RX_EN(1 << 3) \| RT2860_MAC_TX_EN(1 << 2));
3978	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( (tmp))));
3979
3980	/* reset adapter */
3981	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST \| RT2860_MAC_SRST)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( ((1 << 1) \| (1 << 0)))));
3982	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
3983	RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1004)), ( (0))));
3984
3985	/* reset Tx and Rx rings (and reclaim TXWIs) */
3986	sc->qfullmsk = 0;
3987	for (qid = 0; qid < 6; qid++)
3988	rt2860_reset_tx_ring(sc, &sc->txq[qid]);
3989	rt2860_reset_rx_ring(sc, &sc->rxq);
3990
3991	/* for CardBus, power down the socket */
3992	if (disable && sc->sc_disable != NULL((void *)0)) {
3993	if (sc->sc_flags & RT2860_ENABLED(1 << 0)) {
3994	(*sc->sc_disable)(sc);
3995	sc->sc_flags &= ~RT2860_ENABLED(1 << 0);
3996	}
3997	}
3998	}
3999
4000	int
4001	rt2860_load_microcode(struct rt2860_softc *sc)
4002	{
4003	int ntries;
4004
4005	/* set "host program ram write selection" bit */
4006	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( ((1 << 16)))));
4007	/* write microcode image */
4008	RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, sc->ucode, sc->ucsize)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), ((0x2000 )), ((sc->ucode)), ((sc->ucsize))));
4009	/* kick microcontroller unit */
4010	RAL_WRITE(sc, RT2860_SYS_CTRL, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( (0))));
4011	RAL_BARRIER_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x02 );
4012	RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0400)), ( ((1 << 0)))));
4013
4014	RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7028)), ( (0))));
4015	RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x7010)), ( (0))));
4016
4017	/* wait until microcontroller is ready */
4018	RAL_BARRIER_READ_WRITE(sc)bus_space_barrier((sc)->sc_st, (sc)->sc_sh, 0, 0x1800, 0x01 \| 0x02);
4019	for (ntries = 0; ntries < 1000; ntries++) {
4020	if (RAL_READ(sc, RT2860_SYS_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0400)))) & RT2860_MCU_READY(1 << 7))
4021	break;
4022	DELAY(1000)(*delay_func)(1000);
4023	}
4024	if (ntries == 1000) {
4025	printf("%s: timeout waiting for MCU to initialize\n",
4026	sc->sc_dev.dv_xname);
4027	return ETIMEDOUT60;
4028	}
4029	return 0;
4030	}
4031
4032	/*
4033	* This function is called periodically to adjust Tx power based on
4034	* temperature variation.
4035	*/
4036	void
4037	rt2860_calib(struct rt2860_softc *sc)
4038	{
4039	struct ieee80211com *ic = &sc->sc_ic;
4040	const uint8_t *tssi;
4041	uint8_t step, bbp49;
4042	int8_t ridx, d;
4043
4044	/* read current temperature */
4045	bbp49 = rt2860_mcu_bbp_read(sc, 49);
4046
4047	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)(((ic->ic_bss->ni_chan)->ic_flags & 0x0080) != 0 )) {
4048	tssi = &sc->tssi_2ghz[4];
4049	step = sc->step_2ghz;
4050	} else {
4051	tssi = &sc->tssi_5ghz[4];
4052	step = sc->step_5ghz;
4053	}
4054
4055	if (bbp49 < tssi[0]) { /* lower than reference */
4056	/* use higher Tx power than default */
4057	for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
4058	} else if (bbp49 > tssi[0]) { /* greater than reference */
4059	/* use lower Tx power than default */
4060	for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
4061	} else {
4062	/* use default Tx power */
4063	d = 0;
4064	}
4065	d *= step;
4066
4067	DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
4068
4069	/* write adjusted Tx power values for each Tx rate */
4070	for (ridx = 0; ridx < 5; ridx++) {
4071	if (sc->txpow20mhz[ridx] == 0xffffffff)
4072	continue;
4073	RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1314 + ( ridx) * 4))), ((b4inc(sc->txpow20mhz[ridx], d)))))
4074	b4inc(sc->txpow20mhz[ridx], d))(((sc)->sc_st)->write_4(((sc)->sc_sh), (((0x1314 + ( ridx) * 4))), ((b4inc(sc->txpow20mhz[ridx], d)))));
4075	}
4076	}
4077
4078	void
4079	rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
4080	{
4081	uint32_t tmp;
4082	if (aux) {
4083	if (sc->mac_ver == 0x5390) {
4084	rt2860_mcu_bbp_write(sc, 152,
4085	rt2860_mcu_bbp_read(sc, 152) & ~0x80);
4086	} else {
4087	tmp = RAL_READ(sc, RT2860_PCI_EECTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0004))));
4088	RAL_WRITE(sc, RT2860_PCI_EECTRL,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0004)), ( (tmp & ~(1 << 0)))))
4089	tmp & ~RT2860_C)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0004)), ( (tmp & ~(1 << 0)))));
4090	tmp = RAL_READ(sc, RT2860_GPIO_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0228))));
4091	RAL_WRITE(sc, RT2860_GPIO_CTRL,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0228)), ( ((tmp & ~0x0808) \| 0x08))))
4092	(tmp & ~0x0808) \| 0x08)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0228)), ( ((tmp & ~0x0808) \| 0x08))));
4093	}
4094	} else {
4095	if (sc->mac_ver == 0x5390) {
4096	rt2860_mcu_bbp_write(sc, 152,
4097	rt2860_mcu_bbp_read(sc, 152) \| 0x80);
4098	} else {
4099	tmp = RAL_READ(sc, RT2860_PCI_EECTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0004))));
4100	RAL_WRITE(sc, RT2860_PCI_EECTRL,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0004)), ( (tmp \| (1 << 0)))))
4101	tmp \| RT2860_C)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0004)), ( (tmp \| (1 << 0)))));
4102	tmp = RAL_READ(sc, RT2860_GPIO_CTRL)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x0228))));
4103	RAL_WRITE(sc, RT2860_GPIO_CTRL,(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0228)), ( (tmp & ~0x0808))))
4104	tmp & ~0x0808)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x0228)), ( (tmp & ~0x0808))));
4105	}
4106	}
4107	}
4108
4109	void
4110	rt2860_switch_chan(struct rt2860_softc sc, struct ieee80211_channel c)
4111	{
4112	struct ieee80211com *ic = &sc->sc_ic;
4113	u_int chan, group;
4114
4115	chan = ieee80211_chan2ieee(ic, c);
4116	if (chan == 0 \|\| chan == IEEE80211_CHAN_ANY0xffff)
4117	return;
4118
4119	if (sc->mac_ver == 0x3290 \|\|
4120	sc->mac_ver >= 0x5390)
4121	rt5390_set_chan(sc, chan);
4122	else if (sc->mac_ver >= 0x3071)
4123	rt3090_set_chan(sc, chan);
4124	else
4125	rt2860_set_chan(sc, chan);
4126
4127	/* determine channel group */
4128	if (chan <= 14)
4129	group = 0;
4130	else if (chan <= 64)
4131	group = 1;
4132	else if (chan <= 128)
4133	group = 2;
4134	else
4135	group = 3;
4136
4137	/* XXX necessary only when group has changed! */
4138	if (sc->mac_ver <= 0x5390)
4139	rt2860_select_chan_group(sc, group);
4140
4141	DELAY(1000)(*delay_func)(1000);
4142	}
4143
4144	#ifndef IEEE80211_STA_ONLY
4145	int
4146	rt2860_setup_beacon(struct rt2860_softc *sc)
4147	{
4148	struct ieee80211com *ic = &sc->sc_ic;
4149	struct rt2860_txwi txwi;
4150	struct mbuf *m;
4151	int ridx;
4152
4153	if ((m = ieee80211_beacon_alloc(ic, ic->ic_bss)) == NULL((void *)0))
4154	return ENOBUFS55;
4155
4156	memset(&txwi, 0, sizeof txwi)__builtin_memset((&txwi), (0), (sizeof txwi));
4157	txwi.wcid = 0xff;
4158	txwi.len = htole16(m->m_pkthdr.len)((__uint16_t)(m->M_dat.MH.MH_pkthdr.len));
4159	/* send beacons at the lowest available rate */
4160	ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
4161	RT2860_RIDX_OFDM64 : RT2860_RIDX_CCK10;
4162	txwi.phy = htole16(rt2860_rates[ridx].mcs)((__uint16_t)(rt2860_rates[ridx].mcs));
4163	if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
4164	txwi.phy \|= htole16(RT2860_PHY_OFDM)((__uint16_t)((1 << 14)));
4165	txwi.txop = RT2860_TX_TXOP_HT0;
4166	txwi.flags = RT2860_TX_TS(1 << 3);
4167	txwi.xflags = RT2860_TX_NSEQ(1 << 1);
4168
4169	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x7800 + (0) * 512))), (((uint8_t *)&txwi)), ((sizeof txwi))))
4170	(uint8_t )&txwi, sizeof txwi)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x7800 + (0) 512))), (((uint8_t *)&txwi)), ((sizeof txwi))));
4171	RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x7800 + (0) * 512) + sizeof txwi)), ((((uint8_t *)((m)->m_hdr.mh_data )))), ((m->M_dat.MH.MH_pkthdr.len))))
4172	mtod(m, uint8_t ), m->m_pkthdr.len)(((sc)->sc_st)->write_region_1(((sc)->sc_sh), (((0x7800 + (0) 512) + sizeof txwi)), ((((uint8_t *)((m)->m_hdr.mh_data )))), ((m->M_dat.MH.MH_pkthdr.len))));
4173
4174	m_freem(m);
4175
4176	return 0;
4177	}
4178	#endif
4179
4180	void
4181	rt2860_enable_tsf_sync(struct rt2860_softc *sc)
4182	{
4183	struct ieee80211com *ic = &sc->sc_ic;
4184	uint32_t tmp;
4185
4186	tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG)(((sc)->sc_st)->read_4(((sc)->sc_sh), ((0x1114))));
4187
4188	tmp &= ~0x1fffff;
4189	tmp \|= ic->ic_bss->ni_intval * 16;
4190	tmp \|= RT2860_TSF_TIMER_EN(1 << 16) \| RT2860_TBTT_TIMER_EN(1 << 19);
4191	if (ic->ic_opmode == IEEE80211_M_STA) {
4192	/*
4193	* Local TSF is always updated with remote TSF on beacon
4194	* reception.
4195	*/
4196	tmp \|= 1 << RT2860_TSF_SYNC_MODE_SHIFT17;
4197	}
4198	#ifndef IEEE80211_STA_ONLY
4199	else if (ic->ic_opmode == IEEE80211_M_IBSS) {
4200	tmp \|= RT2860_BCN_TX_EN(1 << 20);
4201	/*
4202	* Local TSF is updated with remote TSF on beacon reception
4203	* only if the remote TSF is greater than local TSF.
4204	*/
4205	tmp \|= 2 << RT2860_TSF_SYNC_MODE_SHIFT17;
4206	} else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
4207	tmp \|= RT2860_BCN_TX_EN(1 << 20);
4208	/* SYNC with nobody */
4209	tmp \|= 3 << RT2860_TSF_SYNC_MODE_SHIFT17;
4210	}
4211	#endif
4212
4213	RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp)(((sc)->sc_st)->write_4(((sc)->sc_sh), ((0x1114)), ( (tmp))));
4214	}