The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/rt2860.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: rt2860.c,v 1.36 2021/06/16 00:21:18 riastradh Exp $    */
    2 /*      $OpenBSD: rt2860.c,v 1.90 2016/04/13 10:49:26 mpi Exp $ */
    3 /*      $FreeBSD: head/sys/dev/ral/rt2860.c 306591 2016-10-02 20:35:55Z avos $ */
    4 
    5 /*-
    6  * Copyright (c) 2007-2010 Damien Bergamini <damien.bergamini@free.fr>
    7  * Copyright (c) 2012 Bernhard Schmidt <bschmidt@FreeBSD.org>
    8  *
    9  * Permission to use, copy, modify, and distribute this software for any
   10  * purpose with or without fee is hereby granted, provided that the above
   11  * copyright notice and this permission notice appear in all copies.
   12  *
   13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   20  */
   21 
   22 /*-
   23  * Ralink Technology RT2860/RT3090/RT3390/RT3562/RT5390/RT5392 chipset driver
   24  * http://www.ralinktech.com/
   25  */
   26 
   27 #include <sys/cdefs.h>
   28 __KERNEL_RCSID(0, "$NetBSD: rt2860.c,v 1.36 2021/06/16 00:21:18 riastradh Exp $");
   29 
   30 #include <sys/param.h>
   31 #include <sys/sockio.h>
   32 #include <sys/sysctl.h>
   33 #include <sys/mbuf.h>
   34 #include <sys/kernel.h>
   35 #include <sys/socket.h>
   36 #include <sys/systm.h>
   37 #include <sys/malloc.h>
   38 #include <sys/queue.h>
   39 #include <sys/callout.h>
   40 #include <sys/module.h>
   41 #include <sys/conf.h>
   42 #include <sys/device.h>
   43 #include <sys/endian.h>
   44 #include <sys/cprng.h>
   45 
   46 #include <sys/bus.h>
   47 #include <sys/intr.h>
   48 
   49 #include <net/bpf.h>
   50 #include <net/if.h>
   51 #include <net/if_dl.h>
   52 #include <net/if_ether.h>
   53 #include <net/if_media.h>
   54 
   55 #include <net80211/ieee80211_var.h>
   56 #include <net80211/ieee80211_amrr.h>
   57 #include <net80211/ieee80211_radiotap.h>
   58 
   59 #include <dev/firmload.h>
   60 
   61 #include <dev/ic/rt2860var.h>
   62 #include <dev/ic/rt2860reg.h>
   63 
   64 #include <dev/pci/pcidevs.h>
   65 
   66 #ifdef RAL_DEBUG
   67 #define DPRINTF(x)      do { if (rt2860_debug > 0) printf x; } while (0)
   68 #define DPRINTFN(n, x)  do { if (rt2860_debug >= (n)) printf x; } while (0)
   69 int rt2860_debug = 0;
   70 #else
   71 #define DPRINTF(x)
   72 #define DPRINTFN(n, x)
   73 #endif
   74 #define MAXQS   6 /* Tx (4 EDCAs + HCCA + Mgt) and Rx rings */
   75 
   76 static void     rt2860_attachhook(device_t);
   77 static bool     rt2860_suspend(device_t self, const pmf_qual_t *qual);
   78 static bool     rt2860_wakeup(device_t self, const pmf_qual_t *qual);
   79 static int      rt2860_alloc_tx_ring(struct rt2860_softc *,
   80                     struct rt2860_tx_ring *);
   81 static void     rt2860_reset_tx_ring(struct rt2860_softc *,
   82                     struct rt2860_tx_ring *);
   83 static void     rt2860_free_tx_ring(struct rt2860_softc *,
   84                     struct rt2860_tx_ring *);
   85 static int      rt2860_alloc_tx_pool(struct rt2860_softc *);
   86 static void     rt2860_free_tx_pool(struct rt2860_softc *);
   87 static int      rt2860_alloc_rx_ring(struct rt2860_softc *,
   88                     struct rt2860_rx_ring *);
   89 static void     rt2860_reset_rx_ring(struct rt2860_softc *,
   90                     struct rt2860_rx_ring *);
   91 static void     rt2860_free_rx_ring(struct rt2860_softc *,
   92                     struct rt2860_rx_ring *);
   93 static struct   ieee80211_node *rt2860_node_alloc(struct ieee80211_node_table *);
   94 static int      rt2860_media_change(struct ifnet *);
   95 static void     rt2860_iter_func(void *, struct ieee80211_node *);
   96 static void     rt2860_updatestats(struct rt2860_softc *);
   97 static void     rt2860_update_promisc(struct ifnet *);
   98 static void     rt2860_newassoc(struct ieee80211_node *,
   99                     int);
  100 #ifdef notyet
  101 static int      rt2860_ampdu_rx_start(struct ieee80211com *,
  102                     struct ieee80211_node *, uint8_t);
  103 static void     rt2860_ampdu_rx_stop(struct ieee80211com *,
  104                     struct ieee80211_node *, uint8_t);
  105 #endif
  106 static int      rt2860_newstate(struct ieee80211com *, enum ieee80211_state,
  107                     int);
  108 static uint16_t rt3090_efuse_read_2(struct rt2860_softc *, uint16_t);
  109 static uint16_t rt2860_eeprom_read_2(struct rt2860_softc *, uint16_t);
  110 static void     rt2860_intr_coherent(struct rt2860_softc *);
  111 static void     rt2860_drain_stats_fifo(struct rt2860_softc *);
  112 static void     rt2860_tx_intr(struct rt2860_softc *, int);
  113 static void     rt2860_rx_intr(struct rt2860_softc *);
  114 static void     rt2860_tbtt_intr(struct rt2860_softc *);
  115 static void     rt2860_gp_intr(struct rt2860_softc *);
  116 static int      rt2860_tx(struct rt2860_softc *, struct mbuf **,
  117                     struct ieee80211_node *);
  118 static void     rt2860_start(struct ifnet *);
  119 static void     rt2860_watchdog(struct ifnet *);
  120 static int      rt2860_ioctl(struct ifnet *, u_long, void *);
  121 static void     rt2860_mcu_bbp_write(struct rt2860_softc *, uint8_t, uint8_t);
  122 static uint8_t  rt2860_mcu_bbp_read(struct rt2860_softc *, uint8_t);
  123 static void     rt2860_rf_write(struct rt2860_softc *, uint8_t, uint32_t);
  124 static uint8_t  rt3090_rf_read(struct rt2860_softc *, uint8_t);
  125 static void     rt3090_rf_write(struct rt2860_softc *, uint8_t, uint8_t);
  126 static int      rt2860_mcu_cmd(struct rt2860_softc *, uint8_t, uint16_t, int);
  127 static void     rt2860_enable_mrr(struct rt2860_softc *);
  128 static void     rt2860_set_txpreamble(struct rt2860_softc *);
  129 static void     rt2860_set_basicrates(struct rt2860_softc *);
  130 static void     rt2860_select_chan_group(struct rt2860_softc *, int);
  131 static void     rt2860_set_chan(struct rt2860_softc *, u_int);
  132 static void     rt3090_set_chan(struct rt2860_softc *, u_int);
  133 static void     rt5390_set_chan(struct rt2860_softc *, u_int);
  134 static void     rt3090_rf_init(struct rt2860_softc *);
  135 static void     rt5390_rf_init(struct rt2860_softc *);
  136 static void     rt3090_rf_wakeup(struct rt2860_softc *);
  137 static void     rt5390_rf_wakeup(struct rt2860_softc *);
  138 static int      rt3090_filter_calib(struct rt2860_softc *, uint8_t, uint8_t,
  139                     uint8_t *);
  140 static void     rt3090_rf_setup(struct rt2860_softc *);
  141 static void     rt2860_set_leds(struct rt2860_softc *, uint16_t);
  142 static void     rt2860_set_gp_timer(struct rt2860_softc *, int);
  143 static void     rt2860_set_bssid(struct rt2860_softc *, const uint8_t *);
  144 static void     rt2860_set_macaddr(struct rt2860_softc *, const uint8_t *);
  145 static void     rt2860_updateslot(struct ifnet *);
  146 static void     rt2860_updateprot(struct ieee80211com *);
  147 static int      rt2860_updateedca(struct ieee80211com *);
  148 
  149 #ifdef HW_CRYPTO
  150 static int      rt2860_set_key(struct ieee80211com *, 
  151                     const struct ieee80211_key *, const uint8_t *);
  152 static int      rt2860_delete_key(struct ieee80211com *,
  153                     const struct ieee80211_key *);
  154 #endif
  155 static int8_t   rt2860_rssi2dbm(struct rt2860_softc *, uint8_t, uint8_t);
  156 static const char *     rt2860_get_rf(uint32_t);
  157 static int      rt2860_read_eeprom(struct rt2860_softc *);
  158 static int      rt2860_bbp_init(struct rt2860_softc *);
  159 static int      rt5390_bbp_init(struct rt2860_softc *);
  160 static int      rt2860_txrx_enable(struct rt2860_softc *);
  161 static int      rt2860_init(struct ifnet *);
  162 static void     rt2860_stop(struct ifnet *, int);
  163 static int      rt2860_load_microcode(struct rt2860_softc *);
  164 #if 0
  165 static void     rt2860_calib(struct rt2860_softc *);
  166 #endif
  167 static void     rt3090_set_rx_antenna(struct rt2860_softc *, int);
  168 static void     rt2860_switch_chan(struct rt2860_softc *,
  169                     struct ieee80211_channel *);
  170 #ifndef IEEE80211_STA_ONLY
  171 static int      rt2860_setup_beacon(struct rt2860_softc *);
  172 #endif
  173 static void     rt2860_enable_tsf_sync(struct rt2860_softc *);
  174 static void     rt2860_softintr(void *);
  175 
  176 static const struct {
  177         uint32_t        reg;
  178         uint32_t        val;
  179 } rt2860_def_mac[] = {
  180         RT2860_DEF_MAC
  181 };
  182 
  183 static const struct {
  184         uint8_t reg;
  185         uint8_t val;
  186 } rt2860_def_bbp[] = {
  187         RT2860_DEF_BBP
  188 }, rt5390_def_bbp[] = {
  189         RT5390_DEF_BBP
  190 };
  191 
  192 static const struct rfprog {
  193         uint8_t         chan;
  194         uint32_t        r1, r2, r3, r4;
  195 } rt2860_rf2850[] = {
  196         RT2860_RF2850
  197 };
  198 
  199 static const struct {
  200         uint8_t n, r, k;
  201 } rt3090_freqs[] = {
  202         RT3070_RF3052
  203 };
  204 
  205 static const struct {
  206         uint8_t reg;
  207         uint8_t val;
  208 }  rt3090_def_rf[] = {
  209         RT3070_DEF_RF
  210 }, rt3572_def_rf[] = {
  211         RT3572_DEF_RF
  212 }, rt5390_def_rf[] = {
  213         RT5390_DEF_RF
  214 }, rt5392_def_rf[] = {
  215         RT5392_DEF_RF
  216 };
  217 
  218 int
  219 rt2860_attach(void *xsc, int id)
  220 {
  221         struct rt2860_softc *sc = xsc;
  222         struct ieee80211com *ic = &sc->sc_ic;
  223         int qid, ntries, error;
  224         uint32_t tmp;
  225 
  226         sc->amrr.amrr_min_success_threshold =  1;
  227         sc->amrr.amrr_max_success_threshold = 15;
  228 
  229         /* wait for NIC to initialize */
  230         for (ntries = 0; ntries < 100; ntries++) {
  231                 tmp = RAL_READ(sc, RT2860_ASIC_VER_ID);
  232                 if (tmp != 0 && tmp != 0xffffffff)
  233                         break;
  234                 DELAY(10);
  235         }
  236         if (ntries == 100) {
  237                 aprint_error_dev(sc->sc_dev, 
  238                     "timeout waiting for NIC to initialize\n");
  239                 return ETIMEDOUT;
  240         }
  241         sc->mac_ver = tmp >> 16;
  242         sc->mac_rev = tmp & 0xffff;
  243 
  244         if (sc->mac_ver != 0x2860 &&
  245             (id == PCI_PRODUCT_RALINK_RT2890 ||
  246              id == PCI_PRODUCT_RALINK_RT2790 ||
  247              id == PCI_PRODUCT_AWT_RT2890))
  248                 sc->sc_flags |= RT2860_ADVANCED_PS;
  249 
  250         /* retrieve RF rev. no and various other things from EEPROM */
  251         rt2860_read_eeprom(sc);
  252         aprint_normal_dev(sc->sc_dev, "802.11 address %s\n",
  253             ether_sprintf(ic->ic_myaddr));
  254         aprint_normal_dev(sc->sc_dev, "MAC/BBP RT%X (rev 0x%04X), "
  255             "RF %s (MIMO %dT%dR)\n",
  256             sc->mac_ver, sc->mac_rev, rt2860_get_rf(sc->rf_rev),
  257             sc->ntxchains, sc->nrxchains);
  258 
  259         sc->sc_soft_ih = softint_establish(SOFTINT_NET, rt2860_softintr, sc);
  260         if (sc->sc_soft_ih == NULL) {
  261                 aprint_error_dev(sc->sc_dev, "could not establish softint\n");
  262                 error = EINVAL;
  263                 goto fail0;
  264         }
  265 
  266         /*
  267          * Allocate Tx (4 EDCAs + HCCA + Mgt) and Rx rings.
  268          */
  269         for (qid = 0; qid < MAXQS; qid++) {
  270                 if ((error = rt2860_alloc_tx_ring(sc, &sc->txq[qid])) != 0) {
  271                         aprint_error_dev(sc->sc_dev,
  272                             "could not allocate Tx ring %d\n", qid);
  273                         goto fail1;
  274                 }
  275         }
  276 
  277         if ((error = rt2860_alloc_rx_ring(sc, &sc->rxq)) != 0) {
  278                 aprint_error_dev(sc->sc_dev, "could not allocate Rx ring\n");
  279                 goto fail1;
  280         }
  281 
  282         if ((error = rt2860_alloc_tx_pool(sc)) != 0) {
  283                 aprint_error_dev(sc->sc_dev, "could not allocate Tx pool\n");
  284                 goto fail2;
  285         }
  286 
  287         /* mgmt ring is broken on RT2860C, use EDCA AC VO ring instead */
  288         sc->mgtqid = (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) ?
  289             WME_AC_VO : 5;
  290 
  291         config_mountroot(sc->sc_dev, rt2860_attachhook);
  292 
  293         return 0;
  294 
  295 fail2:  rt2860_free_rx_ring(sc, &sc->rxq);
  296 fail1:  while (--qid >= 0)
  297                 rt2860_free_tx_ring(sc, &sc->txq[qid]);
  298 fail0:  softint_disestablish(sc->sc_soft_ih);
  299         sc->sc_soft_ih = NULL;
  300         return error;
  301 }
  302 
  303 static int
  304 firmware_load(const char *dname, const char *iname, uint8_t **ucodep,
  305     size_t *sizep)
  306 {
  307         firmware_handle_t fh;
  308         int error;
  309 
  310         if ((error = firmware_open(dname, iname, &fh)) != 0)
  311                 return (error);
  312         *sizep = firmware_get_size(fh);
  313         if ((*ucodep = firmware_malloc(*sizep)) == NULL) {
  314                 firmware_close(fh);
  315                 return (ENOMEM);
  316         }
  317         if ((error = firmware_read(fh, 0, *ucodep, *sizep)) != 0)
  318                 firmware_free(*ucodep, *sizep);
  319         firmware_close(fh);
  320 
  321         return (error);
  322 }
  323 
  324 static void
  325 rt2860_attachhook(device_t self)
  326 {
  327         struct rt2860_softc *sc = device_private(self);
  328         struct ieee80211com *ic = &sc->sc_ic;
  329         struct ifnet *ifp = &sc->sc_if;
  330         int i, error;
  331 
  332         error = firmware_load("ral", "ral-rt2860", &sc->ucode, &sc->ucsize);
  333         if (error != 0) {
  334                 aprint_error_dev(sc->sc_dev,
  335                     "error %d, could not read firmware file %s\n",
  336                     error, "ral-rt2860");
  337                 return;
  338         }
  339 
  340         ic->ic_ifp = ifp;
  341         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
  342         ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
  343         ic->ic_state = IEEE80211_S_INIT;
  344 
  345         /* set device capabilities */
  346         ic->ic_caps =
  347             IEEE80211_C_MONITOR |       /* monitor mode supported */
  348 #ifndef IEEE80211_STA_ONLY
  349             IEEE80211_C_IBSS |          /* IBSS mode supported */
  350             IEEE80211_C_HOSTAP |        /* HostAP mode supported */
  351 #ifdef IEEE80211_C_APPMGT
  352             IEEE80211_C_APPMGT |        /* HostAP power management */
  353 #endif
  354 #endif
  355             IEEE80211_C_WDS |           /* 4-address traffic works */
  356             IEEE80211_C_WME |           /* 802.11e */
  357             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
  358             IEEE80211_C_SHSLOT |        /* short slot time supported */
  359 #ifdef HW_CRYPTO
  360             IEEE80211_C_WEP |           /* WEP */
  361 #endif
  362             IEEE80211_C_WPA;            /* 802.11i */
  363 
  364         if (sc->rf_rev == RT2860_RF_2750 || sc->rf_rev == RT2860_RF_2850) {
  365                 /* set supported .11a rates */
  366                 ic->ic_sup_rates[IEEE80211_MODE_11A] =
  367                     ieee80211_std_rateset_11a;
  368 
  369                 /* set supported .11a channels */
  370                 for (i = 14; i < (int)__arraycount(rt2860_rf2850); i++) {
  371                         uint8_t chan = rt2860_rf2850[i].chan;
  372                         ic->ic_channels[chan].ic_freq =
  373                             ieee80211_ieee2mhz(chan, IEEE80211_CHAN_5GHZ);
  374                         ic->ic_channels[chan].ic_flags = IEEE80211_CHAN_A;
  375                 }
  376         }
  377 
  378         /* set supported .11b and .11g rates */
  379         ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
  380         ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
  381 
  382         /* set supported .11b and .11g channels (1 through 14) */
  383         for (i = 1; i <= 14; i++) {
  384                 ic->ic_channels[i].ic_freq =
  385                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
  386                 ic->ic_channels[i].ic_flags =
  387                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
  388                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
  389         }
  390 
  391         /* HW supports up to 255 STAs (0-254) in HostAP and IBSS modes */
  392         ic->ic_max_aid = uimin(IEEE80211_AID_MAX, RT2860_WCID_MAX);
  393 
  394         ifp->if_softc = sc;
  395         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
  396         ifp->if_init = rt2860_init;
  397         ifp->if_ioctl = rt2860_ioctl;
  398         ifp->if_start = rt2860_start;
  399         ifp->if_stop = rt2860_stop;
  400         ifp->if_watchdog = rt2860_watchdog;
  401         IFQ_SET_READY(&ifp->if_snd);
  402         memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
  403 
  404         if_initialize(ifp);
  405         ieee80211_ifattach(ic);
  406         /* Use common softint-based if_input */
  407         ifp->if_percpuq = if_percpuq_create(ifp);
  408         if_register(ifp);
  409 
  410         ic->ic_node_alloc = rt2860_node_alloc;
  411         ic->ic_newassoc = rt2860_newassoc;
  412 #ifdef notyet
  413         ic->ic_ampdu_rx_start = rt2860_ampdu_rx_start;
  414         ic->ic_ampdu_rx_stop = rt2860_ampdu_rx_stop;
  415 #endif
  416         ic->ic_updateslot = rt2860_updateslot;
  417         ic->ic_wme.wme_update = rt2860_updateedca;
  418 #ifdef HW_CRYPTO
  419         ic->ic_crypto.cs_key_set = rt2860_set_key;
  420         ic->ic_crypto.cs_key_delete = rt2860_delete_key;
  421 #endif
  422         /* override state transition machine */
  423         sc->sc_newstate = ic->ic_newstate;
  424         ic->ic_newstate = rt2860_newstate;
  425         ieee80211_media_init(ic, rt2860_media_change, ieee80211_media_status);
  426 
  427         bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
  428             sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
  429 
  430         sc->sc_rxtap_len = roundup(sizeof(sc->sc_rxtap), sizeof(u_int32_t));
  431         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
  432         sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2860_RX_RADIOTAP_PRESENT);
  433 
  434         sc->sc_txtap_len = roundup(sizeof(sc->sc_txtap), sizeof(u_int32_t));
  435         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
  436         sc->sc_txtap.wt_ihdr.it_present = htole32(RT2860_TX_RADIOTAP_PRESENT);
  437 
  438         ieee80211_announce(ic);
  439 
  440         if (pmf_device_register(sc->sc_dev, rt2860_wakeup, rt2860_suspend))
  441                 pmf_class_network_register(sc->sc_dev, ifp);
  442         else
  443                 aprint_error_dev(sc->sc_dev,
  444                     "couldn't establish power handler\n");
  445 }
  446 
  447 int
  448 rt2860_detach(void *xsc)
  449 {
  450         struct rt2860_softc *sc = xsc;
  451         struct ifnet *ifp = &sc->sc_if;
  452         int qid;
  453 
  454         pmf_device_deregister(sc->sc_dev);
  455 
  456         rt2860_stop(ifp, 1);
  457 
  458         ieee80211_ifdetach(&sc->sc_ic); /* free all nodes */
  459         if_detach(ifp);
  460 
  461         for (qid = 0; qid < MAXQS; qid++)
  462                 rt2860_free_tx_ring(sc, &sc->txq[qid]);
  463         rt2860_free_rx_ring(sc, &sc->rxq);
  464         rt2860_free_tx_pool(sc);
  465 
  466         if (sc->sc_soft_ih != NULL) {
  467                 softint_disestablish(sc->sc_soft_ih);
  468                 sc->sc_soft_ih = NULL;
  469         }
  470 
  471         if (sc->ucode != NULL)
  472                 firmware_free(sc->ucode, sc->ucsize);
  473 
  474         return 0;
  475 }
  476 
  477 static bool
  478 rt2860_suspend(device_t self, const pmf_qual_t *qual)
  479 {
  480         struct rt2860_softc *sc = device_private(self);
  481         struct ifnet *ifp = &sc->sc_if;
  482 
  483         if (ifp->if_flags & IFF_RUNNING)
  484                 rt2860_stop(ifp, 1);
  485 
  486         return true;
  487 }
  488 
  489 static bool
  490 rt2860_wakeup(device_t self, const pmf_qual_t *qual)
  491 {
  492         struct rt2860_softc *sc = device_private(self);
  493         struct ifnet *ifp = &sc->sc_if;
  494         int s;
  495 
  496         s = splnet();
  497         if (ifp->if_flags & IFF_UP)
  498                 rt2860_init(ifp);
  499         splx(s);
  500 
  501         return true;
  502 }
  503 
  504 static int
  505 rt2860_alloc_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
  506 {
  507         int nsegs, size, error;
  508 
  509         size = RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd);
  510 
  511         error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
  512             BUS_DMA_NOWAIT, &ring->map);
  513         if (error != 0) {
  514                 aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
  515                 goto fail;
  516         }
  517 
  518         /* Tx rings must be 4-DWORD aligned */
  519         error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,
  520             &nsegs, BUS_DMA_NOWAIT);
  521         if (error != 0) {
  522                 aprint_error_dev(sc->sc_dev,
  523                     "could not allocate DMA memory\n");
  524                 goto fail;
  525         }
  526 
  527         error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,
  528             (void **)&ring->txd, BUS_DMA_NOWAIT);
  529         if (error != 0) {
  530                 aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
  531                 goto fail;
  532         }
  533 
  534         error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->txd, size, NULL,
  535             BUS_DMA_NOWAIT);
  536         if (error != 0) {
  537                 aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
  538                 goto fail;
  539         }
  540 
  541         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE);
  542 
  543         ring->paddr = ring->map->dm_segs[0].ds_addr;
  544 
  545         return 0;
  546 
  547 fail:   rt2860_free_tx_ring(sc, ring);
  548         return error;
  549 }
  550 
  551 static void
  552 rt2860_reset_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
  553 {
  554         struct rt2860_tx_data *data;
  555         int i;
  556 
  557         for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
  558                 if ((data = ring->data[i]) == NULL)
  559                         continue;       /* nothing mapped in this slot */
  560 
  561                 if (data->ni != NULL) {
  562                         ieee80211_free_node(data->ni);
  563                         data->ni = NULL;
  564                 }
  565 
  566                 if (data->m != NULL) {
  567                         bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  568                             data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  569                         bus_dmamap_unload(sc->sc_dmat, data->map);
  570                         m_freem(data->m);
  571                         data->m = NULL;
  572                 }
  573 
  574                 SLIST_INSERT_HEAD(&sc->data_pool, data, next);
  575                 ring->data[i] = NULL;
  576         }
  577 
  578         ring->queued = 0;
  579         ring->cur = ring->next = 0;
  580 }
  581 
  582 static void
  583 rt2860_free_tx_ring(struct rt2860_softc *sc, struct rt2860_tx_ring *ring)
  584 {
  585         struct rt2860_tx_data *data;
  586         int i;
  587 
  588         if (ring->txd != NULL) {
  589                 bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
  590                     ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  591                 bus_dmamap_unload(sc->sc_dmat, ring->map);
  592                 bus_dmamem_unmap(sc->sc_dmat, (void *)ring->txd,
  593                     RT2860_TX_RING_COUNT * sizeof (struct rt2860_txd));
  594                 bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
  595         }
  596         if (ring->map != NULL)
  597                 bus_dmamap_destroy(sc->sc_dmat, ring->map);
  598 
  599         for (i = 0; i < RT2860_TX_RING_COUNT; i++) {
  600                 if ((data = ring->data[i]) == NULL)
  601                         continue;       /* nothing mapped in this slot */
  602 
  603                 if (data->ni != NULL) {
  604                         ieee80211_free_node(data->ni);
  605                         data->ni = NULL;
  606                 }
  607                 if (data->m != NULL) {
  608                         bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  609                             data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  610                         bus_dmamap_unload(sc->sc_dmat, data->map);
  611                         m_freem(data->m);
  612                         data->m = NULL;
  613                 }
  614 
  615                 SLIST_INSERT_HEAD(&sc->data_pool, data, next);
  616                 ring->data[i] = NULL;
  617         }
  618         ring->queued = 0;
  619         ring->cur = ring->next = 0;
  620 }
  621 
  622 /*
  623  * Allocate a pool of TX Wireless Information blocks.
  624  */
  625 static int
  626 rt2860_alloc_tx_pool(struct rt2860_softc *sc)
  627 {
  628         char *vaddr;
  629         bus_addr_t paddr;
  630         int i, nsegs, size, error;
  631 
  632         size = RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ;
  633 
  634         /* init data_pool early in case of failure.. */
  635         SLIST_INIT(&sc->data_pool);
  636 
  637         error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
  638             BUS_DMA_NOWAIT, &sc->txwi_map);
  639         if (error != 0) {
  640                 aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
  641                 goto fail;
  642         }
  643 
  644         error = bus_dmamem_alloc(sc->sc_dmat, size, PAGE_SIZE, 0,
  645             &sc->txwi_seg, 1, &nsegs, BUS_DMA_NOWAIT);
  646         if (error != 0) {
  647                 aprint_error_dev(sc->sc_dev,
  648                     "could not allocate DMA memory\n");
  649                 goto fail;
  650         }
  651 
  652         error = bus_dmamem_map(sc->sc_dmat, &sc->txwi_seg, nsegs, size,
  653             &sc->txwi_vaddr, BUS_DMA_NOWAIT);
  654         if (error != 0) {
  655                 aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
  656                 goto fail;
  657         }
  658 
  659         error = bus_dmamap_load(sc->sc_dmat, sc->txwi_map, sc->txwi_vaddr,
  660             size, NULL, BUS_DMA_NOWAIT);
  661         if (error != 0) {
  662                 aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
  663                 goto fail;
  664         }
  665 
  666         bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0, size,
  667             BUS_DMASYNC_PREWRITE);
  668 
  669         vaddr = sc->txwi_vaddr;
  670         paddr = sc->txwi_map->dm_segs[0].ds_addr;
  671         for (i = 0; i < RT2860_TX_POOL_COUNT; i++) {
  672                 struct rt2860_tx_data *data = &sc->data[i];
  673 
  674                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
  675                     RT2860_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
  676                     &data->map); /* <0> */
  677                 if (error != 0) {
  678                         aprint_error_dev(sc->sc_dev,
  679                             "could not create DMA map\n");
  680                         goto fail;
  681                 }
  682                 data->txwi = (struct rt2860_txwi *)vaddr;
  683                 data->paddr = paddr;
  684                 vaddr += RT2860_TXWI_DMASZ;
  685                 paddr += RT2860_TXWI_DMASZ;
  686 
  687                 SLIST_INSERT_HEAD(&sc->data_pool, data, next);
  688         }
  689 
  690         return 0;
  691 
  692 fail:   rt2860_free_tx_pool(sc);
  693         return error;
  694 }
  695 
  696 static void
  697 rt2860_free_tx_pool(struct rt2860_softc *sc)
  698 {
  699         if (sc->txwi_vaddr != NULL) {
  700                 bus_dmamap_sync(sc->sc_dmat, sc->txwi_map, 0,
  701                     sc->txwi_map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  702                 bus_dmamap_unload(sc->sc_dmat, sc->txwi_map);
  703                 bus_dmamem_unmap(sc->sc_dmat, sc->txwi_vaddr,
  704                     RT2860_TX_POOL_COUNT * RT2860_TXWI_DMASZ);
  705                 bus_dmamem_free(sc->sc_dmat, &sc->txwi_seg, 1);
  706         }
  707         if (sc->txwi_map != NULL)
  708                 bus_dmamap_destroy(sc->sc_dmat, sc->txwi_map);
  709 
  710         while (!SLIST_EMPTY(&sc->data_pool)) {
  711                 struct rt2860_tx_data *data;
  712                 data = SLIST_FIRST(&sc->data_pool);
  713                 bus_dmamap_destroy(sc->sc_dmat, data->map);
  714                 SLIST_REMOVE_HEAD(&sc->data_pool, next);
  715         }
  716 }
  717 
  718 static int
  719 rt2860_alloc_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
  720 {
  721         int i, nsegs, size, error;
  722 
  723         size = RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd);
  724 
  725         error = bus_dmamap_create(sc->sc_dmat, size, 1, size, 0,
  726             BUS_DMA_NOWAIT, &ring->map);
  727         if (error != 0) {
  728                 aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
  729                 goto fail;
  730         }
  731 
  732         /* Rx ring must be 4-DWORD aligned */
  733         error = bus_dmamem_alloc(sc->sc_dmat, size, 16, 0, &ring->seg, 1,
  734             &nsegs, BUS_DMA_NOWAIT);
  735         if (error != 0) {
  736                 aprint_error_dev(sc->sc_dev,
  737                     "could not allocate DMA memory\n");
  738                 goto fail;
  739         }
  740 
  741         error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs, size,
  742             (void **)&ring->rxd, BUS_DMA_NOWAIT);
  743         if (error != 0) {
  744                 aprint_error_dev(sc->sc_dev, "can't map DMA memory\n");
  745                 goto fail;
  746         }
  747 
  748         error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->rxd, size, NULL,
  749             BUS_DMA_NOWAIT);
  750         if (error != 0) {
  751                 aprint_error_dev(sc->sc_dev, "could not load DMA map\n");
  752                 goto fail;
  753         }
  754 
  755         ring->paddr = ring->map->dm_segs[0].ds_addr;
  756 
  757         for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
  758                 struct rt2860_rx_data *data = &ring->data[i];
  759                 struct rt2860_rxd *rxd = &ring->rxd[i];
  760                 const char *msg;
  761 
  762                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
  763                     0, BUS_DMA_NOWAIT, &data->map);
  764                 if (error != 0) {
  765                         aprint_error_dev(sc->sc_dev,
  766                             "could not create DMA map\n");
  767                         goto fail;
  768                 }
  769 
  770                 MGETHDR(data->m, M_DONTWAIT, MT_DATA);
  771                 if (data->m == NULL) {
  772                         msg = "allocate Rx mbuf";
  773                         goto fail1;
  774                 }
  775                 MCLGET(data->m, M_DONTWAIT);
  776                 if ((data->m->m_flags & M_EXT) == 0) {
  777                         msg = "allocate Rx mbuf cluster";
  778                         goto fail1;
  779                 }
  780 
  781 
  782                 error = bus_dmamap_load(sc->sc_dmat, data->map,
  783                     mtod(data->m, void *), MCLBYTES, NULL,
  784                     BUS_DMA_READ | BUS_DMA_NOWAIT);
  785                 if (error != 0) {
  786                         msg = "load DMA map";
  787                 fail1:
  788                         aprint_error_dev(sc->sc_dev, "could not %s\n", msg);
  789                         m_freem(data->m);
  790                         data->m = NULL;
  791                         error = ENOBUFS;
  792                         goto fail;
  793                 }
  794 
  795                 rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
  796                 rxd->sdl0 = htole16(MCLBYTES);
  797         }
  798 
  799         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, size, BUS_DMASYNC_PREWRITE);
  800 
  801         return 0;
  802 fail:   rt2860_free_rx_ring(sc, ring);
  803         return error;
  804 }
  805 
  806 static void
  807 rt2860_reset_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
  808 {
  809         int i;
  810 
  811         for (i = 0; i < RT2860_RX_RING_COUNT; i++)
  812                 ring->rxd[i].sdl0 &= ~htole16(RT2860_RX_DDONE);
  813 
  814         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  815             BUS_DMASYNC_PREWRITE);
  816 
  817         ring->cur = 0;
  818 }
  819 
  820 static void
  821 rt2860_free_rx_ring(struct rt2860_softc *sc, struct rt2860_rx_ring *ring)
  822 {
  823         int i;
  824 
  825         if (ring->rxd != NULL) {
  826                 bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
  827                     ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  828                 bus_dmamap_unload(sc->sc_dmat, ring->map);
  829                 bus_dmamem_unmap(sc->sc_dmat, (void *)ring->rxd,
  830                     RT2860_RX_RING_COUNT * sizeof (struct rt2860_rxd));
  831                 bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
  832                 ring->rxd = NULL;
  833         }
  834         if (ring->map != NULL) {
  835                 bus_dmamap_destroy(sc->sc_dmat, ring->map);
  836                 ring->map = NULL;
  837         }
  838 
  839         for (i = 0; i < RT2860_RX_RING_COUNT; i++) {
  840                 struct rt2860_rx_data *data = &ring->data[i];
  841 
  842                 if (data->m != NULL) {
  843                         bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  844                             data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
  845                         bus_dmamap_unload(sc->sc_dmat, data->map);
  846                         m_freem(data->m);
  847                         data->m = NULL;
  848                 }
  849                 if (data->map != NULL) {
  850                         bus_dmamap_destroy(sc->sc_dmat, data->map);
  851                         data->map = NULL;
  852                 }
  853         }
  854 }
  855 
  856 static struct ieee80211_node *
  857 rt2860_node_alloc(struct ieee80211_node_table *nt)
  858 {
  859         struct rt2860_node *rn = malloc(sizeof(*rn), M_80211_NODE,
  860             M_NOWAIT | M_ZERO);
  861         return rn ? &rn->ni : NULL;
  862 }
  863 
  864 static int
  865 rt2860_media_change(struct ifnet *ifp)
  866 {
  867         struct rt2860_softc *sc = ifp->if_softc;
  868         struct ieee80211com *ic = &sc->sc_ic;
  869         uint8_t rate, ridx;
  870         int error;
  871 
  872         error = ieee80211_media_change(ifp);
  873         if (error != ENETRESET)
  874                 return error;
  875 
  876         if (ic->ic_fixed_rate != -1) {
  877                 rate = ic->ic_sup_rates[ic->ic_curmode].
  878                     rs_rates[ic->ic_fixed_rate] & IEEE80211_RATE_VAL;
  879                 for (ridx = 0; ridx <= RT2860_RIDX_MAX; ridx++)
  880                         if (rt2860_rates[ridx].rate == rate)
  881                                 break;
  882                 sc->fixed_ridx = ridx;
  883         }
  884 
  885         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
  886             (IFF_UP | IFF_RUNNING)) {
  887                 rt2860_stop(ifp, 0);
  888                 rt2860_init(ifp);
  889         }
  890         return 0;
  891 }
  892 
  893 static void
  894 rt2860_iter_func(void *arg, struct ieee80211_node *ni)
  895 {
  896         struct rt2860_softc *sc = arg;
  897         uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
  898 
  899         ieee80211_amrr_choose(&sc->amrr, ni, &sc->amn[wcid]);
  900 }
  901 
  902 static void
  903 rt2860_updatestats(struct rt2860_softc *sc)
  904 {
  905         struct ieee80211com *ic = &sc->sc_ic;
  906         int s;
  907 
  908 #ifndef IEEE80211_STA_ONLY
  909         /*
  910          * In IBSS or HostAP modes (when the hardware sends beacons), the
  911          * MAC can run into a livelock and start sending CTS-to-self frames
  912          * like crazy if protection is enabled.  Fortunately, we can detect
  913          * when such a situation occurs and reset the MAC.
  914          */
  915         if (ic->ic_curmode != IEEE80211_M_STA) {
  916                 /* check if we're in a livelock situation.. */
  917                 uint32_t tmp = RAL_READ(sc, RT2860_DEBUG);
  918                 if ((tmp & (1 << 29)) && (tmp & (1 << 7 | 1 << 5))) {
  919                         /* ..and reset MAC/BBP for a while.. */
  920                         DPRINTF(("CTS-to-self livelock detected\n"));
  921                         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_SRST);
  922                         RAL_BARRIER_WRITE(sc);
  923                         DELAY(1);
  924                         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
  925                             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
  926                 }
  927         }
  928 #endif
  929         s = splnet();
  930         if (ic->ic_opmode == IEEE80211_M_STA)
  931                 rt2860_iter_func(sc, ic->ic_bss);
  932 #ifndef IEEE80211_STA_ONLY
  933         else
  934                 ieee80211_iterate_nodes(&ic->ic_sta, rt2860_iter_func, sc);
  935 #endif
  936         splx(s);
  937 }
  938 
  939 static void
  940 rt2860_newassoc(struct ieee80211_node *ni, int isnew)
  941 {
  942         struct rt2860_softc *sc = ni->ni_ic->ic_ifp->if_softc;
  943         struct rt2860_node *rn = (void *)ni;
  944         struct ieee80211_rateset *rs = &ni->ni_rates;
  945         uint8_t rate, wcid = 0;
  946         int ridx, i, j;
  947 
  948         if (isnew && ni->ni_associd != 0) {
  949                 /* only interested in true associations */
  950                 wcid = rn->wcid = IEEE80211_AID(ni->ni_associd);
  951 
  952                 /* init WCID table entry */
  953                 RAL_WRITE_REGION_1(sc, RT2860_WCID_ENTRY(wcid),
  954                     ni->ni_macaddr, IEEE80211_ADDR_LEN);
  955         }
  956         DPRINTF(("new assoc isnew=%d addr=%s WCID=%d\n",
  957             isnew, ether_sprintf(ni->ni_macaddr), wcid));
  958 
  959         ieee80211_amrr_node_init(&sc->amrr, &sc->amn[wcid]);
  960         /* start at lowest available bit-rate, AMRR will raise */
  961         ni->ni_txrate = 0;
  962 
  963         for (i = 0; i < rs->rs_nrates; i++) {
  964                 rate = rs->rs_rates[i] & IEEE80211_RATE_VAL;
  965                 /* convert 802.11 rate to hardware rate index */
  966                 for (ridx = 0; ridx < RT2860_RIDX_MAX; ridx++)
  967                         if (rt2860_rates[ridx].rate == rate)
  968                                 break;
  969                 rn->ridx[i] = ridx;
  970                 /* determine rate of control response frames */
  971                 for (j = i; j >= 0; j--) {
  972                         if ((rs->rs_rates[j] & IEEE80211_RATE_BASIC) &&
  973                             rt2860_rates[rn->ridx[i]].phy ==
  974                             rt2860_rates[rn->ridx[j]].phy)
  975                                 break;
  976                 }
  977                 if (j >= 0) {
  978                         rn->ctl_ridx[i] = rn->ridx[j];
  979                 } else {
  980                         /* no basic rate found, use mandatory one */
  981                         rn->ctl_ridx[i] = rt2860_rates[ridx].ctl_ridx;
  982                 }
  983                 DPRINTF(("rate=0x%02x ridx=%d ctl_ridx=%d\n",
  984                     rs->rs_rates[i], rn->ridx[i], rn->ctl_ridx[i]));
  985         }
  986 }
  987 
  988 #ifdef notyet
  989 static int
  990 rt2860_ampdu_rx_start(struct ieee80211com *ic, struct ieee80211_node *ni,
  991     uint8_t tid)
  992 {
  993         struct rt2860_softc *sc = ic->ic_softc;
  994         uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
  995         uint32_t tmp;
  996 
  997         /* update BA session mask */
  998         tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
  999         tmp |= (1 << tid) << 16;
 1000         RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
 1001         return 0;
 1002 }
 1003 
 1004 static void
 1005 rt2860_ampdu_rx_stop(struct ieee80211com *ic, struct ieee80211_node *ni,
 1006     uint8_t tid)
 1007 {
 1008         struct rt2860_softc *sc = ic->ic_softc;
 1009         uint8_t wcid = ((struct rt2860_node *)ni)->wcid;
 1010         uint32_t tmp;
 1011 
 1012         /* update BA session mask */
 1013         tmp = RAL_READ(sc, RT2860_WCID_ENTRY(wcid) + 4);
 1014         tmp &= ~((1 << tid) << 16);
 1015         RAL_WRITE(sc, RT2860_WCID_ENTRY(wcid) + 4, tmp);
 1016 }
 1017 #endif
 1018 
 1019 static int
 1020 rt2860_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
 1021 {
 1022         struct rt2860_softc *sc = ic->ic_ifp->if_softc;
 1023         enum ieee80211_state ostate;
 1024         uint32_t tmp;
 1025 
 1026         ostate = ic->ic_state;
 1027 
 1028         DPRINTF(("ostate = %d nstate = %d\n", ostate, nstate));
 1029         if (ostate == IEEE80211_S_RUN) {
 1030                 /* turn link LED off */
 1031                 rt2860_set_leds(sc, RT2860_LED_RADIO);
 1032         }
 1033 
 1034         switch (nstate) {
 1035         case IEEE80211_S_INIT:
 1036                 if (ostate == IEEE80211_S_RUN) {
 1037                         /* abort TSF synchronization */
 1038                         tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
 1039                         RAL_WRITE(sc, RT2860_BCN_TIME_CFG,
 1040                             tmp & ~(RT2860_BCN_TX_EN | RT2860_TSF_TIMER_EN |
 1041                             RT2860_TBTT_TIMER_EN));
 1042                 }
 1043                 rt2860_set_gp_timer(sc, 0);
 1044                 break;
 1045 
 1046         case IEEE80211_S_SCAN:
 1047                 rt2860_switch_chan(sc, ic->ic_curchan);
 1048                 if (ostate != IEEE80211_S_SCAN)
 1049                         rt2860_set_gp_timer(sc, 150);
 1050                 break;
 1051 
 1052         case IEEE80211_S_AUTH:
 1053         case IEEE80211_S_ASSOC:
 1054                 rt2860_set_gp_timer(sc, 0);
 1055                 rt2860_switch_chan(sc, ic->ic_curchan);
 1056                 break;
 1057 
 1058         case IEEE80211_S_RUN:
 1059                 rt2860_set_gp_timer(sc, 0);
 1060                 rt2860_switch_chan(sc, ic->ic_curchan);
 1061 
 1062                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 1063                         rt2860_updateslot(ic->ic_ifp);
 1064                         rt2860_enable_mrr(sc);
 1065                         rt2860_set_txpreamble(sc);
 1066                         rt2860_set_basicrates(sc);
 1067                         rt2860_set_bssid(sc, ic->ic_bss->ni_bssid);
 1068                 }
 1069 
 1070 #ifndef IEEE80211_STA_ONLY
 1071                 if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
 1072                     ic->ic_opmode == IEEE80211_M_IBSS)
 1073                         (void)rt2860_setup_beacon(sc);
 1074 #endif
 1075 
 1076                 if (ic->ic_opmode == IEEE80211_M_STA) {
 1077                         /* fake a join to init the tx rate */
 1078                         rt2860_newassoc(ic->ic_bss, 1);
 1079                 }
 1080 
 1081                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 1082                         rt2860_enable_tsf_sync(sc);
 1083                         rt2860_set_gp_timer(sc, 500);
 1084                 }
 1085 
 1086                 /* turn link LED on */
 1087                 rt2860_set_leds(sc, RT2860_LED_RADIO |
 1088                     (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan) ?
 1089                      RT2860_LED_LINK_2GHZ : RT2860_LED_LINK_5GHZ));
 1090                 break;
 1091         }
 1092 
 1093         return sc->sc_newstate(ic, nstate, arg);
 1094 }
 1095 
 1096 /* Read 16-bit from eFUSE ROM (>=RT3071 only.) */
 1097 static uint16_t
 1098 rt3090_efuse_read_2(struct rt2860_softc *sc, uint16_t addr)
 1099 {
 1100         uint32_t tmp;
 1101         uint16_t reg;
 1102         int ntries;
 1103 
 1104         addr *= 2;
 1105         /*-
 1106          * Read one 16-byte block into registers EFUSE_DATA[0-3]:
 1107          * DATA0: F E D C
 1108          * DATA1: B A 9 8
 1109          * DATA2: 7 6 5 4
 1110          * DATA3: 3 2 1 0
 1111          */
 1112         tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
 1113         tmp &= ~(RT3070_EFSROM_MODE_MASK | RT3070_EFSROM_AIN_MASK);
 1114         tmp |= (addr & ~0xf) << RT3070_EFSROM_AIN_SHIFT | RT3070_EFSROM_KICK;
 1115         RAL_WRITE(sc, RT3070_EFUSE_CTRL, tmp);
 1116         for (ntries = 0; ntries < 500; ntries++) {
 1117                 tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
 1118                 if (!(tmp & RT3070_EFSROM_KICK))
 1119                         break;
 1120                 DELAY(2);
 1121         }
 1122         if (ntries == 500)
 1123                 return 0xffff;
 1124 
 1125         if ((tmp & RT3070_EFUSE_AOUT_MASK) == RT3070_EFUSE_AOUT_MASK)
 1126                 return 0xffff;  /* address not found */
 1127 
 1128         /* determine to which 32-bit register our 16-bit word belongs */
 1129         reg = RT3070_EFUSE_DATA3 - (addr & 0xc);
 1130         tmp = RAL_READ(sc, reg);
 1131 
 1132         return (addr & 2) ? tmp >> 16 : tmp & 0xffff;
 1133 }
 1134 
 1135 /*
 1136  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46,
 1137  * 93C66 or 93C86).
 1138  */
 1139 static uint16_t
 1140 rt2860_eeprom_read_2(struct rt2860_softc *sc, uint16_t addr)
 1141 {
 1142         uint32_t tmp;
 1143         uint16_t val;
 1144         int n;
 1145 
 1146         /* clock C once before the first command */
 1147         RT2860_EEPROM_CTL(sc, 0);
 1148 
 1149         RT2860_EEPROM_CTL(sc, RT2860_S);
 1150         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
 1151         RT2860_EEPROM_CTL(sc, RT2860_S);
 1152 
 1153         /* write start bit (1) */
 1154         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
 1155         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
 1156 
 1157         /* write READ opcode (10) */
 1158         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D);
 1159         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_D | RT2860_C);
 1160         RT2860_EEPROM_CTL(sc, RT2860_S);
 1161         RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
 1162 
 1163         /* write address (A5-A0 or A7-A0) */
 1164         n = ((RAL_READ(sc, RT2860_PCI_EECTRL) & 0x30) == 0) ? 5 : 7;
 1165         for (; n >= 0; n--) {
 1166                 RT2860_EEPROM_CTL(sc, RT2860_S |
 1167                     (((addr >> n) & 1) << RT2860_SHIFT_D));
 1168                 RT2860_EEPROM_CTL(sc, RT2860_S |
 1169                     (((addr >> n) & 1) << RT2860_SHIFT_D) | RT2860_C);
 1170         }
 1171 
 1172         RT2860_EEPROM_CTL(sc, RT2860_S);
 1173 
 1174         /* read data Q15-Q0 */
 1175         val = 0;
 1176         for (n = 15; n >= 0; n--) {
 1177                 RT2860_EEPROM_CTL(sc, RT2860_S | RT2860_C);
 1178                 tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
 1179                 val |= ((tmp & RT2860_Q) >> RT2860_SHIFT_Q) << n;
 1180                 RT2860_EEPROM_CTL(sc, RT2860_S);
 1181         }
 1182 
 1183         RT2860_EEPROM_CTL(sc, 0);
 1184 
 1185         /* clear Chip Select and clock C */
 1186         RT2860_EEPROM_CTL(sc, RT2860_S);
 1187         RT2860_EEPROM_CTL(sc, 0);
 1188         RT2860_EEPROM_CTL(sc, RT2860_C);
 1189 
 1190         return val;
 1191 }
 1192 
 1193 static __inline uint16_t
 1194 rt2860_srom_read(struct rt2860_softc *sc, uint8_t addr)
 1195 {
 1196         /* either eFUSE ROM or EEPROM */
 1197         return sc->sc_srom_read(sc, addr);
 1198 }
 1199 
 1200 static void
 1201 rt2860_intr_coherent(struct rt2860_softc *sc)
 1202 {
 1203         uint32_t tmp;
 1204 
 1205         /* DMA finds data coherent event when checking the DDONE bit */
 1206 
 1207         DPRINTF(("Tx/Rx Coherent interrupt\n"));
 1208 
 1209         /* restart DMA engine */
 1210         tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
 1211         tmp &= ~(RT2860_TX_WB_DDONE | RT2860_RX_DMA_EN | RT2860_TX_DMA_EN);
 1212         RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
 1213 
 1214         (void)rt2860_txrx_enable(sc);
 1215 }
 1216 
 1217 static void
 1218 rt2860_drain_stats_fifo(struct rt2860_softc *sc)
 1219 {
 1220         struct ifnet *ifp = &sc->sc_if;
 1221         struct ieee80211_amrr_node *amn;
 1222         uint32_t stat;
 1223         uint8_t wcid, mcs, pid;
 1224 
 1225         /* drain Tx status FIFO (maxsize = 16) */
 1226         while ((stat = RAL_READ(sc, RT2860_TX_STAT_FIFO)) & RT2860_TXQ_VLD) {
 1227                 DPRINTFN(4, ("tx stat 0x%08x\n", stat));
 1228 
 1229                 wcid = (stat >> RT2860_TXQ_WCID_SHIFT) & 0xff;
 1230 
 1231                 /* if no ACK was requested, no feedback is available */
 1232                 if (!(stat & RT2860_TXQ_ACKREQ) || wcid == 0xff)
 1233                         continue;
 1234 
 1235                 /* update per-STA AMRR stats */
 1236                 amn = &sc->amn[wcid];
 1237                 amn->amn_txcnt++;
 1238                 if (stat & RT2860_TXQ_OK) {
 1239                         /*
 1240                          * Check if there were retries, ie if the Tx success
 1241                          * rate is different from the requested rate.  Note
 1242                          * that it works only because we do not allow rate
 1243                          * fallback from OFDM to CCK.
 1244                          */
 1245                         mcs = (stat >> RT2860_TXQ_MCS_SHIFT) & 0x7f;
 1246                         pid = (stat >> RT2860_TXQ_PID_SHIFT) & 0xf;
 1247                         if (mcs + 1 != pid)
 1248                                 amn->amn_retrycnt++;
 1249                 } else {
 1250                         amn->amn_retrycnt++;
 1251                         if_statinc(ifp, if_oerrors);
 1252                 }
 1253         }
 1254 }
 1255 
 1256 static void
 1257 rt2860_tx_intr(struct rt2860_softc *sc, int qid)
 1258 {
 1259         struct ifnet *ifp = &sc->sc_if;
 1260         struct rt2860_tx_ring *ring = &sc->txq[qid];
 1261         uint32_t hw;
 1262         int s;
 1263 
 1264         s = splnet();
 1265 
 1266         rt2860_drain_stats_fifo(sc);
 1267 
 1268         hw = RAL_READ(sc, RT2860_TX_DTX_IDX(qid));
 1269         DPRINTF(("%s: tx mbuf %#x\n", __func__, hw));
 1270         while (ring->next != hw) {
 1271                 struct rt2860_tx_data *data = ring->data[ring->next];
 1272 
 1273                 if (data != NULL) {
 1274                         bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1275                             data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
 1276                         bus_dmamap_unload(sc->sc_dmat, data->map);
 1277                         m_freem(data->m);
 1278                         data->m = NULL;
 1279                         ieee80211_free_node(data->ni);
 1280                         data->ni = NULL;
 1281 
 1282                         SLIST_INSERT_HEAD(&sc->data_pool, data, next);
 1283                         ring->data[ring->next] = NULL;
 1284 
 1285                         if_statinc(ifp, if_opackets);
 1286                 }
 1287                 ring->queued--;
 1288                 ring->next = (ring->next + 1) % RT2860_TX_RING_COUNT;
 1289         }
 1290 
 1291         sc->sc_tx_timer = 0;
 1292         if (ring->queued <= RT2860_TX_RING_ONEMORE)
 1293                 sc->qfullmsk &= ~(1 << qid);
 1294         ifp->if_flags &= ~IFF_OACTIVE;
 1295         rt2860_start(ifp); /* in softint */
 1296 
 1297         splx(s);
 1298 }
 1299 
 1300 /*
 1301  * Return the Rx chain with the highest RSSI for a given frame.
 1302  */
 1303 static __inline uint8_t
 1304 rt2860_maxrssi_chain(struct rt2860_softc *sc, const struct rt2860_rxwi *rxwi)
 1305 {
 1306         uint8_t rxchain = 0;
 1307 
 1308         if (sc->nrxchains > 1) {
 1309                 if (rxwi->rssi[1] > rxwi->rssi[rxchain])
 1310                         rxchain = 1;
 1311                 if (sc->nrxchains > 2)
 1312                         if (rxwi->rssi[2] > rxwi->rssi[rxchain])
 1313                                 rxchain = 2;
 1314         }
 1315         return rxchain;
 1316 }
 1317 
 1318 static void
 1319 rt2860_rx_intr(struct rt2860_softc *sc)
 1320 {
 1321         struct ieee80211com *ic = &sc->sc_ic;
 1322         struct ifnet *ifp = &sc->sc_if;
 1323         struct ieee80211_frame *wh;
 1324         struct ieee80211_node *ni;
 1325         struct mbuf *m, *m1;
 1326         uint32_t hw;
 1327         uint8_t ant, rssi;
 1328         int error, s;
 1329         struct rt2860_rx_radiotap_header *tap;
 1330         uint16_t phy;
 1331 
 1332         hw = RAL_READ(sc, RT2860_FS_DRX_IDX) & 0xfff;
 1333         DPRINTF(("%s: rx mbuf %#x\n", __func__, hw));
 1334         while (sc->rxq.cur != hw) {
 1335                 struct rt2860_rx_data *data = &sc->rxq.data[sc->rxq.cur];
 1336                 struct rt2860_rxd *rxd = &sc->rxq.rxd[sc->rxq.cur];
 1337                 struct rt2860_rxwi *rxwi;
 1338 
 1339                 bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
 1340                     sc->rxq.cur * sizeof (struct rt2860_rxd),
 1341                     sizeof (struct rt2860_rxd), BUS_DMASYNC_POSTREAD);
 1342 
 1343                 if (__predict_false(!(rxd->sdl0 & htole16(RT2860_RX_DDONE)))) {
 1344                         DPRINTF(("RXD DDONE bit not set!\n"));
 1345                         break;  /* should not happen */
 1346                 }
 1347 
 1348                 if (__predict_false(rxd->flags &
 1349                     htole32(RT2860_RX_CRCERR | RT2860_RX_ICVERR))) {
 1350                         DPRINTF(("error %#x\n", rxd->flags));
 1351                         if_statinc(ifp, if_ierrors);
 1352                         goto skip;
 1353                 }
 1354 
 1355 
 1356                 MGETHDR(m1, M_DONTWAIT, MT_DATA);
 1357                 if (__predict_false(m1 == NULL)) {
 1358                         DPRINTF(("error2 %#x\n", rxd->flags));
 1359                         if_statinc(ifp, if_ierrors);
 1360                         goto skip;
 1361                 }
 1362                 MCLGET(m1, M_DONTWAIT);
 1363                 if (__predict_false((m1->m_flags & M_EXT) == 0)) {
 1364                         DPRINTF(("no mbuf\n"));
 1365                         m_freem(m1);
 1366                         if_statinc(ifp, if_ierrors);
 1367                         goto skip;
 1368                 }
 1369 
 1370                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1371                     data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
 1372                 bus_dmamap_unload(sc->sc_dmat, data->map);
 1373 
 1374                 error = bus_dmamap_load(sc->sc_dmat, data->map,
 1375                     mtod(m1, void *), MCLBYTES, NULL,
 1376                     BUS_DMA_READ | BUS_DMA_NOWAIT);
 1377                 if (__predict_false(error != 0)) {
 1378                         DPRINTF(("dma error %d\n", error));
 1379                         m_freem(m1);
 1380 
 1381                         /* try to reload the old mbuf */
 1382                         error = bus_dmamap_load(sc->sc_dmat, data->map,
 1383                             mtod(data->m, void *), MCLBYTES, NULL,
 1384                             BUS_DMA_READ | BUS_DMA_NOWAIT);
 1385                         if (__predict_false(error != 0)) {
 1386                                 panic("%s: could not load old rx mbuf",
 1387                                     device_xname(sc->sc_dev));
 1388                         }
 1389                         /* physical address may have changed */
 1390                         rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
 1391                         if_statinc(ifp, if_ierrors);
 1392                         goto skip;
 1393                 }
 1394 
 1395                 /*
 1396                  * New mbuf successfully loaded, update Rx ring and continue
 1397                  * processing.
 1398                  */
 1399                 m = data->m;
 1400                 data->m = m1;
 1401                 rxd->sdp0 = htole32(data->map->dm_segs[0].ds_addr);
 1402 
 1403                 rxwi = mtod(m, struct rt2860_rxwi *);
 1404 
 1405                 /* finalize mbuf */
 1406                 m->m_data = (void *)(rxwi + 1);
 1407                 m_set_rcvif(m, ifp);
 1408                 m->m_pkthdr.len = m->m_len = le16toh(rxwi->len) & 0xfff;
 1409 
 1410                 wh = mtod(m, struct ieee80211_frame *);
 1411 #ifdef HW_CRYPTO
 1412                 if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 1413                         /* frame is decrypted by hardware */
 1414                         wh->i_fc[1] &= ~IEEE80211_FC1_PROTECTED;
 1415                 }
 1416 #endif
 1417 
 1418                 /* HW may insert 2 padding bytes after 802.11 header */
 1419                 if (rxd->flags & htole32(RT2860_RX_L2PAD)) {
 1420                         u_int hdrlen = ieee80211_hdrsize(wh);
 1421                         memmove((char *)wh + 2, wh, hdrlen);
 1422                         m->m_data += 2;
 1423                         wh = mtod(m, struct ieee80211_frame *);
 1424                 }
 1425 
 1426 #ifdef HW_CRYPTO
 1427                 if (__predict_false(rxd->flags & htole32(RT2860_RX_MICERR))) {
 1428                         /* report MIC failures to net80211 for TKIP */
 1429                         ieee80211_notify_michael_failure(ic, wh, 0/* XXX */);
 1430                         DPRINTF(("error2 %#x\n", rxd->flags));
 1431                         if_statinc(ifp, if_ierrors);
 1432                         goto skip;
 1433                 }
 1434 #endif
 1435                 ant = rt2860_maxrssi_chain(sc, rxwi);
 1436                 rssi = rxwi->rssi[ant];
 1437 
 1438                 s = splnet();
 1439 
 1440                 if (__predict_true(sc->sc_drvbpf == NULL))
 1441                         goto skipbpf;
 1442 
 1443                 tap = &sc->sc_rxtap;
 1444                 tap->wr_flags = 0;
 1445                 tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
 1446                 tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
 1447                 tap->wr_antsignal = rssi;
 1448                 tap->wr_antenna = ant;
 1449                 tap->wr_dbm_antsignal = rt2860_rssi2dbm(sc, rssi, ant);
 1450                 tap->wr_rate = 2;       /* in case it can't be found below */
 1451                 phy = le16toh(rxwi->phy);
 1452                 switch (phy & RT2860_PHY_MODE) {
 1453                 case RT2860_PHY_CCK:
 1454                         switch ((phy & RT2860_PHY_MCS) & ~RT2860_PHY_SHPRE) {
 1455                         case 0: tap->wr_rate =   2; break;
 1456                         case 1: tap->wr_rate =   4; break;
 1457                         case 2: tap->wr_rate =  11; break;
 1458                         case 3: tap->wr_rate =  22; break;
 1459                         }
 1460                         if (phy & RT2860_PHY_SHPRE)
 1461                                 tap->wr_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
 1462                         break;
 1463                 case RT2860_PHY_OFDM:
 1464                         switch (phy & RT2860_PHY_MCS) {
 1465                         case 0: tap->wr_rate =  12; break;
 1466                         case 1: tap->wr_rate =  18; break;
 1467                         case 2: tap->wr_rate =  24; break;
 1468                         case 3: tap->wr_rate =  36; break;
 1469                         case 4: tap->wr_rate =  48; break;
 1470                         case 5: tap->wr_rate =  72; break;
 1471                         case 6: tap->wr_rate =  96; break;
 1472                         case 7: tap->wr_rate = 108; break;
 1473                         }
 1474                         break;
 1475                 }
 1476                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m, BPF_D_IN);
 1477 skipbpf:
 1478                 /* grab a reference to the source node */
 1479                 ni = ieee80211_find_rxnode(ic,
 1480                     (struct ieee80211_frame_min *)wh);
 1481 
 1482                 /* send the frame to the 802.11 layer */
 1483                 ieee80211_input(ic, m, ni, rssi, 0);
 1484 
 1485                 /* node is no longer needed */
 1486                 ieee80211_free_node(ni);
 1487 
 1488                 splx(s);
 1489 
 1490 skip:           rxd->sdl0 &= ~htole16(RT2860_RX_DDONE);
 1491 
 1492                 bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
 1493                     sc->rxq.cur * sizeof (struct rt2860_rxd),
 1494                     sizeof (struct rt2860_rxd), BUS_DMASYNC_PREWRITE);
 1495 
 1496                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2860_RX_RING_COUNT;
 1497         }
 1498 
 1499         /* tell HW what we have processed */
 1500         RAL_WRITE(sc, RT2860_RX_CALC_IDX,
 1501             (sc->rxq.cur - 1) % RT2860_RX_RING_COUNT);
 1502 }
 1503 
 1504 static void
 1505 rt2860_tbtt_intr(struct rt2860_softc *sc)
 1506 {
 1507         struct ieee80211com *ic = &sc->sc_ic;
 1508 
 1509 #ifndef IEEE80211_STA_ONLY
 1510         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 1511                 /* one less beacon until next DTIM */
 1512                 if (ic->ic_dtim_count == 0)
 1513                         ic->ic_dtim_count = ic->ic_dtim_period - 1;
 1514                 else
 1515                         ic->ic_dtim_count--;
 1516 
 1517                 /* update dynamic parts of beacon */
 1518                 rt2860_setup_beacon(sc);
 1519 
 1520 #if 0
 1521                 /* flush buffered multicast frames */
 1522                 if (ic->ic_dtim_count == 0)
 1523                         ieee80211_notify_dtim(ic);
 1524 #endif
 1525         }
 1526 #endif
 1527         /* check if protection mode has changed */
 1528         if ((sc->sc_ic_flags ^ ic->ic_flags) & IEEE80211_F_USEPROT) {
 1529                 rt2860_updateprot(ic);
 1530                 sc->sc_ic_flags = ic->ic_flags;
 1531         }
 1532 }
 1533 
 1534 static void
 1535 rt2860_gp_intr(struct rt2860_softc *sc)
 1536 {
 1537         struct ieee80211com *ic = &sc->sc_ic;
 1538         int s;
 1539 
 1540         DPRINTFN(2, ("GP timeout state=%d\n", ic->ic_state));
 1541 
 1542         s = splnet();
 1543         if (ic->ic_state == IEEE80211_S_SCAN)
 1544                 ieee80211_next_scan(ic);
 1545         else if (ic->ic_state == IEEE80211_S_RUN)
 1546                 rt2860_updatestats(sc);
 1547         splx(s);
 1548 }
 1549 
 1550 int
 1551 rt2860_intr(void *arg)
 1552 {
 1553         struct rt2860_softc *sc = arg;
 1554         uint32_t r;
 1555 
 1556         r = RAL_READ(sc, RT2860_INT_STATUS);
 1557         if (__predict_false(r == 0xffffffff))
 1558                 return 0;       /* device likely went away */
 1559         if (r == 0)
 1560                 return 0;       /* not for us */
 1561 
 1562         softint_schedule(sc->sc_soft_ih);
 1563         return 1;
 1564 }
 1565 
 1566 static void
 1567 rt2860_softintr(void *arg)
 1568 {
 1569         struct rt2860_softc *sc = arg;
 1570         uint32_t r;
 1571 
 1572         r = RAL_READ(sc, RT2860_INT_STATUS);
 1573         if (__predict_false(r == 0xffffffff))
 1574                 goto out;       /* device likely went away */
 1575         if (r == 0)
 1576                 goto out;
 1577 
 1578         /* acknowledge interrupts */
 1579         RAL_WRITE(sc, RT2860_INT_STATUS, r);
 1580 
 1581         if (r & RT2860_TX_RX_COHERENT)
 1582                 rt2860_intr_coherent(sc);
 1583 
 1584         if (r & RT2860_MAC_INT_2)       /* TX status */
 1585                 rt2860_drain_stats_fifo(sc);
 1586 
 1587         if (r & RT2860_TX_DONE_INT5)
 1588                 rt2860_tx_intr(sc, 5);
 1589 
 1590         if (r & RT2860_RX_DONE_INT)
 1591                 rt2860_rx_intr(sc);
 1592 
 1593         if (r & RT2860_TX_DONE_INT4)
 1594                 rt2860_tx_intr(sc, 4);
 1595 
 1596         if (r & RT2860_TX_DONE_INT3)
 1597                 rt2860_tx_intr(sc, 3);
 1598 
 1599         if (r & RT2860_TX_DONE_INT2)
 1600                 rt2860_tx_intr(sc, 2);
 1601 
 1602         if (r & RT2860_TX_DONE_INT1)
 1603                 rt2860_tx_intr(sc, 1);
 1604 
 1605         if (r & RT2860_TX_DONE_INT0)
 1606                 rt2860_tx_intr(sc, 0);
 1607 
 1608         if (r & RT2860_MAC_INT_0)       /* TBTT */
 1609                 rt2860_tbtt_intr(sc);
 1610 
 1611         if (r & RT2860_MAC_INT_3) {     /* Auto wakeup */
 1612                 /* TBD wakeup */
 1613         }
 1614 
 1615         if (r & RT2860_MAC_INT_4)       /* GP timer */
 1616                 rt2860_gp_intr(sc);
 1617 
 1618 out:
 1619         /* enable interrupts */
 1620         RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
 1621 }
 1622 
 1623 static int
 1624 rt2860_tx(struct rt2860_softc *sc, struct mbuf **m0, struct ieee80211_node *ni)
 1625 {
 1626         struct ieee80211com *ic = &sc->sc_ic;
 1627         struct rt2860_node *rn = (void *)ni;
 1628         struct rt2860_tx_ring *ring;
 1629         struct rt2860_tx_data *data;
 1630         struct rt2860_txd *txd;
 1631         struct rt2860_txwi *txwi;
 1632         struct ieee80211_frame *wh;
 1633         struct mbuf *m = *m0;
 1634         bus_dma_segment_t *seg;
 1635         u_int hdrlen;
 1636         uint16_t qos, dur;
 1637         uint8_t type, qsel, mcs, pid, tid, qid;
 1638         int nsegs, hasqos, ridx, ctl_ridx;
 1639 
 1640         /* the data pool contains at least one element, pick the first */
 1641         data = SLIST_FIRST(&sc->data_pool);
 1642 
 1643         wh = mtod(m, struct ieee80211_frame *);
 1644 #ifndef HW_CRYPTO
 1645         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 1646                 struct ieee80211_key *k = ieee80211_crypto_encap(ic, ni, m);
 1647                 if (k == NULL) {
 1648                         m_freem(m);
 1649                         *m0 = NULL;
 1650                         return ENOBUFS;
 1651                 }
 1652 
 1653                 /* packet header may have moved, reset our local pointer */
 1654                 wh = mtod(m, struct ieee80211_frame *);
 1655         }
 1656 #endif
 1657 
 1658         hdrlen = ieee80211_anyhdrsize(wh);
 1659         type = wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK;
 1660 
 1661         if ((hasqos = ieee80211_has_qos(wh))) {
 1662                 qos = ieee80211_get_qos(wh);
 1663                 tid = qos & IEEE80211_QOS_TID;
 1664                 qid = TID_TO_WME_AC(tid);
 1665         } else {
 1666                 qos = 0;
 1667                 tid = 0;
 1668                 qid = (type == IEEE80211_FC0_TYPE_MGT) ?
 1669                     sc->mgtqid : WME_AC_BE;
 1670         }
 1671         KASSERT(qid < MAXQS);
 1672         ring = &sc->txq[qid];
 1673 
 1674         /* pickup a rate index */
 1675         if (IEEE80211_IS_MULTICAST(wh->i_addr1) ||
 1676             type != IEEE80211_FC0_TYPE_DATA) {
 1677                 ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
 1678                     RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
 1679                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
 1680         } else if (ic->ic_fixed_rate != -1) {
 1681                 ridx = sc->fixed_ridx;
 1682                 ctl_ridx = rt2860_rates[ridx].ctl_ridx;
 1683         } else {
 1684                 ridx = rn->ridx[ni->ni_txrate];
 1685                 ctl_ridx = rn->ctl_ridx[ni->ni_txrate];
 1686         }
 1687 
 1688         /* get MCS code from rate index */
 1689         mcs = rt2860_rates[ridx].mcs;
 1690 
 1691         /* setup TX Wireless Information */
 1692         txwi = data->txwi;
 1693         txwi->flags = 0;
 1694         /* let HW generate seq numbers for non-QoS frames */
 1695         txwi->xflags = hasqos ? 0 : RT2860_TX_NSEQ;
 1696         txwi->wcid = (type == IEEE80211_FC0_TYPE_DATA) ? rn->wcid : 0xff;
 1697         txwi->len = htole16(m->m_pkthdr.len);
 1698         if (rt2860_rates[ridx].phy == IEEE80211_T_DS) {
 1699                 txwi->phy = htole16(RT2860_PHY_CCK);
 1700                 if (ridx != RT2860_RIDX_CCK1 &&
 1701                     (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 1702                         mcs |= RT2860_PHY_SHPRE;
 1703         } else
 1704                 txwi->phy = htole16(RT2860_PHY_OFDM);
 1705         txwi->phy |= htole16(mcs);
 1706 
 1707         /*
 1708          * We store the MCS code into the driver-private PacketID field.
 1709          * The PacketID is latched into TX_STAT_FIFO when Tx completes so
 1710          * that we know at which initial rate the frame was transmitted.
 1711          * We add 1 to the MCS code because setting the PacketID field to
 1712          * 0 means that we don't want feedback in TX_STAT_FIFO.
 1713          */
 1714         pid = (mcs + 1) & 0xf;
 1715         txwi->len |= htole16(pid << RT2860_TX_PID_SHIFT);
 1716 
 1717         /* check if RTS/CTS or CTS-to-self protection is required */
 1718         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 1719             (m->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
 1720              ((ic->ic_flags & IEEE80211_F_USEPROT) &&
 1721               rt2860_rates[ridx].phy == IEEE80211_T_OFDM)))
 1722                 txwi->txop = RT2860_TX_TXOP_HT;
 1723         else
 1724                 txwi->txop = RT2860_TX_TXOP_BACKOFF;
 1725 
 1726         if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 1727             (!hasqos || (qos & IEEE80211_QOS_ACKPOLICY) !=
 1728              IEEE80211_QOS_ACKPOLICY_NOACK)) {
 1729                 txwi->xflags |= RT2860_TX_ACK;
 1730 
 1731                 if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
 1732                         dur = rt2860_rates[ctl_ridx].sp_ack_dur;
 1733                 else
 1734                         dur = rt2860_rates[ctl_ridx].lp_ack_dur;
 1735                 *(uint16_t *)wh->i_dur = htole16(dur);
 1736         }
 1737 #ifndef IEEE80211_STA_ONLY
 1738         /* ask MAC to insert timestamp into probe responses */
 1739         if ((wh->i_fc[0] &
 1740              (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
 1741              (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
 1742             /* NOTE: beacons do not pass through tx_data() */
 1743                 txwi->flags |= RT2860_TX_TS;
 1744 #endif
 1745 
 1746         if (__predict_false(sc->sc_drvbpf != NULL)) {
 1747                 struct rt2860_tx_radiotap_header *tap = &sc->sc_txtap;
 1748 
 1749                 tap->wt_flags = 0;
 1750                 tap->wt_rate = rt2860_rates[ridx].rate;
 1751                 tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
 1752                 tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
 1753                 tap->wt_hwqueue = qid;
 1754                 if (mcs & RT2860_PHY_SHPRE)
 1755                         tap->wt_flags |= IEEE80211_RADIOTAP_F_SHORTPRE;
 1756 
 1757                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m, BPF_D_OUT);
 1758         }
 1759 
 1760         /* copy and trim 802.11 header */
 1761         memcpy(txwi + 1, wh, hdrlen);
 1762         m_adj(m, hdrlen);
 1763 
 1764         KASSERT (ring->queued <= RT2860_TX_RING_ONEMORE); /* <1> */
 1765         if (bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m, BUS_DMA_NOWAIT)) {
 1766                 struct mbuf *m_new = m_defrag(m, M_DONTWAIT);
 1767                 if (m_new != NULL) {
 1768                         /* m got freed */
 1769                         m = m_new;
 1770                         *m0 = m_new;
 1771                 } else {
 1772                         return (ENOBUFS);
 1773                 }
 1774                 if (bus_dmamap_load_mbuf(sc->sc_dmat,
 1775                     data->map, m, BUS_DMA_NOWAIT))
 1776                         return (EFBIG);
 1777         }
 1778 
 1779         /* The map will fit into the tx ring: (a "full" ring may have a few
 1780          * unused descriptors, at most (txds(MAX_SCATTER) - 1))
 1781          *
 1782          *   ring->queued + txds(data->map->nsegs)
 1783          * <=   { <0> data->map->nsegs <= MAX_SCATTER }
 1784          *   ring->queued + txds(MAX_SCATTER)
 1785          * <=   { <1> ring->queued <= TX_RING_MAX - txds(MAX_SCATTER) }
 1786          *   TX_RING_MAX - txds(MAX_SCATTER) + txds(MAX_SCATTER)
 1787          * <=   { arithmetic }
 1788          *   TX_RING_MAX
 1789          */
 1790 
 1791         qsel = (qid < WME_NUM_AC) ? RT2860_TX_QSEL_EDCA : RT2860_TX_QSEL_MGMT;
 1792 
 1793         /* first segment is TXWI + 802.11 header */
 1794         txd = &ring->txd[ring->cur];
 1795         txd->sdp0 = htole32(data->paddr);
 1796         txd->sdl0 = htole16(sizeof (struct rt2860_txwi) + hdrlen);
 1797         txd->flags = qsel;
 1798 
 1799         /* setup payload segments */
 1800         seg = data->map->dm_segs;
 1801         for (nsegs = data->map->dm_nsegs; nsegs >= 2; nsegs -= 2) {
 1802                 txd->sdp1 = htole32(seg->ds_addr);
 1803                 txd->sdl1 = htole16(seg->ds_len);
 1804                 seg++;
 1805                 ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
 1806                 /* grab a new Tx descriptor */
 1807                 txd = &ring->txd[ring->cur];
 1808                 txd->sdp0 = htole32(seg->ds_addr);
 1809                 txd->sdl0 = htole16(seg->ds_len);
 1810                 txd->flags = qsel;
 1811                 seg++;
 1812         }
 1813         /* finalize last segment */
 1814         if (nsegs > 0) {
 1815                 txd->sdp1 = htole32(seg->ds_addr);
 1816                 txd->sdl1 = htole16(seg->ds_len | RT2860_TX_LS1);
 1817         } else {
 1818                 txd->sdl0 |= htole16(RT2860_TX_LS0);
 1819                 txd->sdl1 = 0;
 1820         }
 1821 
 1822         /* remove from the free pool and link it into the SW Tx slot */
 1823         SLIST_REMOVE_HEAD(&sc->data_pool, next);
 1824         data->m = m;
 1825         data->ni = ni;
 1826         ring->data[ring->cur] = data;
 1827 
 1828         bus_dmamap_sync(sc->sc_dmat, sc->txwi_map,
 1829             (uintptr_t)txwi - (uintptr_t)sc->txwi_vaddr, RT2860_TXWI_DMASZ,
 1830             BUS_DMASYNC_PREWRITE);
 1831         bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
 1832             BUS_DMASYNC_PREWRITE);
 1833         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
 1834             BUS_DMASYNC_PREWRITE);
 1835 
 1836         DPRINTFN(4, ("sending frame qid=%d wcid=%d nsegs=%d ridx=%d\n",
 1837             qid, txwi->wcid, data->map->dm_nsegs, ridx));
 1838 
 1839         ring->cur = (ring->cur + 1) % RT2860_TX_RING_COUNT;
 1840         ring->queued += 1 + (data->map->dm_nsegs / 2);
 1841         if (ring->queued > RT2860_TX_RING_ONEMORE)
 1842                 sc->qfullmsk |= 1 << qid;
 1843 
 1844         /* kick Tx */
 1845         RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), ring->cur);
 1846 
 1847         return 0;
 1848 }
 1849 
 1850 static void
 1851 rt2860_start(struct ifnet *ifp)
 1852 {
 1853         struct rt2860_softc *sc = ifp->if_softc;
 1854         struct ieee80211com *ic = &sc->sc_ic;
 1855         struct ether_header *eh;
 1856         struct ieee80211_node *ni;
 1857         struct mbuf *m;
 1858 
 1859         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
 1860                 return;
 1861 
 1862         for (;;) {
 1863                 if (SLIST_EMPTY(&sc->data_pool) || sc->qfullmsk != 0) {
 1864                         DPRINTF(("%s: stuffup\n", __func__));
 1865                         ifp->if_flags |= IFF_OACTIVE;
 1866                         break;
 1867                 }
 1868                 /* send pending management frames first */
 1869                 IF_DEQUEUE(&ic->ic_mgtq, m);
 1870                 if (m != NULL) {
 1871                         ni = M_GETCTX(m, struct ieee80211_node *);
 1872                         M_CLEARCTX(m);
 1873                         DPRINTF(("%s: send management\n", __func__));
 1874                         goto sendit;
 1875                 }
 1876                 if (ic->ic_state != IEEE80211_S_RUN) {
 1877                         DPRINTF(("%s: not running %d\n", __func__,
 1878                             ic->ic_state));
 1879                         break;
 1880                 }
 1881 
 1882                 /* encapsulate and send data frames */
 1883                 IFQ_DEQUEUE(&ifp->if_snd, m);
 1884                 if (m == NULL) {
 1885                         DPRINTF(("%s: nothing to send\n", __func__));
 1886                         break;
 1887                 }
 1888                 if (m->m_len < (int)sizeof(*eh) &&
 1889                     (m = m_pullup(m, sizeof(*eh))) == NULL) {
 1890                         DPRINTF(("%s: nothing to send\n", __func__));
 1891                         if_statinc(ifp, if_oerrors);
 1892                         continue;
 1893                 }
 1894 
 1895                 eh = mtod(m, struct ether_header *);
 1896 
 1897                 ni = ieee80211_find_txnode(ic, eh->ether_dhost);
 1898                 if (ni == NULL) {
 1899                         DPRINTF(("%s: can't find tx node\n", __func__));
 1900                         m_freem(m);
 1901                         if_statinc(ifp, if_oerrors);
 1902                         continue;
 1903                 }
 1904 
 1905                 bpf_mtap(ifp, m, BPF_D_OUT);
 1906 
 1907                 if ((m = ieee80211_encap(ic, m, ni)) == NULL) {
 1908                         DPRINTF(("%s: can't encap\n", __func__));
 1909                         ieee80211_free_node(ni);
 1910                         if_statinc(ifp, if_oerrors);
 1911                         continue;
 1912                 }
 1913 sendit:
 1914                 bpf_mtap3(ic->ic_rawbpf, m, BPF_D_OUT);
 1915 
 1916                 if (rt2860_tx(sc, &m, ni) != 0) {
 1917                         DPRINTF(("%s: can't tx\n", __func__));
 1918                         m_freem(m);
 1919                         ieee80211_free_node(ni);
 1920                         if_statinc(ifp, if_oerrors);
 1921                         continue;
 1922                 }
 1923 
 1924                 sc->sc_tx_timer = 5;
 1925                 ifp->if_timer = 1;
 1926         }
 1927 }
 1928 
 1929 static void
 1930 rt2860_watchdog(struct ifnet *ifp)
 1931 {
 1932         struct rt2860_softc *sc = ifp->if_softc;
 1933         struct ieee80211com *ic = &sc->sc_ic;
 1934 
 1935         ifp->if_timer = 0;
 1936 
 1937         if (sc->sc_tx_timer > 0) {
 1938                 if (--sc->sc_tx_timer == 0) {
 1939                         aprint_error_dev(sc->sc_dev, "device timeout\n");
 1940                         rt2860_stop(ifp, 0);
 1941                         rt2860_init(ifp);
 1942                         if_statinc(ifp, if_oerrors);
 1943                         return;
 1944                 }
 1945                 ifp->if_timer = 1;
 1946         }
 1947 
 1948         ieee80211_watchdog(ic);
 1949 }
 1950 
 1951 static int
 1952 rt2860_ioctl(struct ifnet *ifp, u_long cmd, void *data)
 1953 {
 1954         struct rt2860_softc *sc = ifp->if_softc;
 1955         struct ieee80211com *ic = &sc->sc_ic;
 1956         int s, error = 0;
 1957 
 1958         s = splnet();
 1959 
 1960         switch (cmd) {
 1961         case SIOCSIFFLAGS:
 1962                 if ((error = ifioctl_common(ifp, cmd, data)) != 0)
 1963                         break;
 1964                 switch (ifp->if_flags & (IFF_UP|IFF_RUNNING)) {
 1965                 case IFF_UP|IFF_RUNNING:
 1966                         rt2860_update_promisc(ifp);
 1967                         break;
 1968                 case IFF_UP:
 1969                         rt2860_init(ifp);
 1970                         break;
 1971                 case IFF_RUNNING:
 1972                         rt2860_stop(ifp, 1);
 1973                         break;
 1974                 case 0:
 1975                         break;
 1976                 }
 1977                 break;
 1978 
 1979         case SIOCADDMULTI:
 1980         case SIOCDELMULTI:
 1981                 if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET) {
 1982                         /* setup multicast filter, etc */
 1983                         error = 0;
 1984                 }
 1985                 break;
 1986 
 1987         case SIOCS80211CHANNEL:
 1988                 /*
 1989                  * This allows for fast channel switching in monitor mode
 1990                  * (used by kismet). In IBSS mode, we must explicitly reset
 1991                  * the interface to generate a new beacon frame.
 1992                  */
 1993                 error = ieee80211_ioctl(ic, cmd, data);
 1994                 if (error == ENETRESET &&
 1995                     ic->ic_opmode == IEEE80211_M_MONITOR) {
 1996                         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
 1997                             (IFF_UP | IFF_RUNNING))
 1998                                 rt2860_switch_chan(sc, ic->ic_ibss_chan);
 1999                         error = 0;
 2000                 }
 2001                 break;
 2002 
 2003         default:
 2004                 error = ieee80211_ioctl(ic, cmd, data);
 2005         }
 2006 
 2007         if (error == ENETRESET) {
 2008                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
 2009                     (IFF_UP | IFF_RUNNING)) {
 2010                         rt2860_stop(ifp, 0);
 2011                         rt2860_init(ifp);
 2012                 }
 2013                 error = 0;
 2014         }
 2015 
 2016         splx(s);
 2017 
 2018         return error;
 2019 }
 2020 
 2021 /*
 2022  * Reading and writing from/to the BBP is different from RT2560 and RT2661.
 2023  * We access the BBP through the 8051 microcontroller unit which means that
 2024  * the microcode must be loaded first.
 2025  */
 2026 static void
 2027 rt2860_mcu_bbp_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
 2028 {
 2029         int ntries;
 2030 
 2031         for (ntries = 0; ntries < 100; ntries++) {
 2032                 if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
 2033                         break;
 2034                 DELAY(1);
 2035         }
 2036         if (ntries == 100) {
 2037                 aprint_error_dev(sc->sc_dev,
 2038                     "could not write to BBP through MCU\n");
 2039                 return;
 2040         }
 2041 
 2042         RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
 2043             RT2860_BBP_CSR_KICK | reg << 8 | val);
 2044         RAL_BARRIER_WRITE(sc);
 2045 
 2046         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
 2047         DELAY(1000);
 2048 }
 2049 
 2050 static uint8_t
 2051 rt2860_mcu_bbp_read(struct rt2860_softc *sc, uint8_t reg)
 2052 {
 2053         uint32_t val;
 2054         int ntries;
 2055 
 2056         for (ntries = 0; ntries < 100; ntries++) {
 2057                 if (!(RAL_READ(sc, RT2860_H2M_BBPAGENT) & RT2860_BBP_CSR_KICK))
 2058                         break;
 2059                 DELAY(1);
 2060         }
 2061         if (ntries == 100) {
 2062                 aprint_error_dev(sc->sc_dev,
 2063                     "could not read from BBP through MCU\n");
 2064                 return 0;
 2065         }
 2066 
 2067         RAL_WRITE(sc, RT2860_H2M_BBPAGENT, RT2860_BBP_RW_PARALLEL |
 2068             RT2860_BBP_CSR_KICK | RT2860_BBP_CSR_READ | reg << 8);
 2069         RAL_BARRIER_WRITE(sc);
 2070 
 2071         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_BBP, 0, 0);
 2072         DELAY(1000);
 2073 
 2074         for (ntries = 0; ntries < 100; ntries++) {
 2075                 val = RAL_READ(sc, RT2860_H2M_BBPAGENT);
 2076                 if (!(val & RT2860_BBP_CSR_KICK))
 2077                         return val & 0xff;
 2078                 DELAY(1);
 2079         }
 2080         aprint_error_dev(sc->sc_dev, "could not read from BBP through MCU\n");
 2081 
 2082         return 0;
 2083 }
 2084 
 2085 /*
 2086  * Write to one of the 4 programmable 24-bit RF registers.
 2087  */
 2088 static void
 2089 rt2860_rf_write(struct rt2860_softc *sc, uint8_t reg, uint32_t val)
 2090 {
 2091         uint32_t tmp;
 2092         int ntries;
 2093 
 2094         for (ntries = 0; ntries < 100; ntries++) {
 2095                 if (!(RAL_READ(sc, RT2860_RF_CSR_CFG0) & RT2860_RF_REG_CTRL))
 2096                         break;
 2097                 DELAY(1);
 2098         }
 2099         if (ntries == 100) {
 2100                 aprint_error_dev(sc->sc_dev, "could not write to RF\n");
 2101                 return;
 2102         }
 2103 
 2104         /* RF registers are 24-bit on the RT2860 */
 2105         tmp = RT2860_RF_REG_CTRL | 24 << RT2860_RF_REG_WIDTH_SHIFT |
 2106             (val & 0x3fffff) << 2 | (reg & 3);
 2107         RAL_WRITE(sc, RT2860_RF_CSR_CFG0, tmp);
 2108 }
 2109 
 2110 static uint8_t
 2111 rt3090_rf_read(struct rt2860_softc *sc, uint8_t reg)
 2112 {
 2113         uint32_t tmp;
 2114         int ntries;
 2115 
 2116         for (ntries = 0; ntries < 100; ntries++) {
 2117                 if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
 2118                         break;
 2119                 DELAY(1);
 2120         }
 2121         if (ntries == 100) {
 2122                 aprint_error_dev(sc->sc_dev, "could not read RF register\n");
 2123                 return 0xff;
 2124         }
 2125         tmp = RT3070_RF_KICK | reg << 8;
 2126         RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
 2127 
 2128         for (ntries = 0; ntries < 100; ntries++) {
 2129                 tmp = RAL_READ(sc, RT3070_RF_CSR_CFG);
 2130                 if (!(tmp & RT3070_RF_KICK))
 2131                         break;
 2132                 DELAY(1);
 2133         }
 2134         if (ntries == 100) {
 2135                 aprint_error_dev(sc->sc_dev, "could not read RF register\n");
 2136                 return 0xff;
 2137         }
 2138         return tmp & 0xff;
 2139 }
 2140 
 2141 static void
 2142 rt3090_rf_write(struct rt2860_softc *sc, uint8_t reg, uint8_t val)
 2143 {
 2144         uint32_t tmp;
 2145         int ntries;
 2146 
 2147         for (ntries = 0; ntries < 10; ntries++) {
 2148                 if (!(RAL_READ(sc, RT3070_RF_CSR_CFG) & RT3070_RF_KICK))
 2149                         break;
 2150                 DELAY(10);
 2151         }
 2152         if (ntries == 10) {
 2153                 aprint_error_dev(sc->sc_dev, "could not write to RF\n");
 2154                 return;
 2155         }
 2156 
 2157         tmp = RT3070_RF_WRITE | RT3070_RF_KICK | reg << 8 | val;
 2158         RAL_WRITE(sc, RT3070_RF_CSR_CFG, tmp);
 2159 }
 2160 
 2161 /*
 2162  * Send a command to the 8051 microcontroller unit.
 2163  */
 2164 static int
 2165 rt2860_mcu_cmd(struct rt2860_softc *sc, uint8_t cmd, uint16_t arg, int wait)
 2166 {
 2167         int slot, ntries;
 2168         uint32_t tmp;
 2169         uint8_t cid;
 2170 
 2171         for (ntries = 0; ntries < 100; ntries++) {
 2172                 if (!(RAL_READ(sc, RT2860_H2M_MAILBOX) & RT2860_H2M_BUSY))
 2173                         break;
 2174                 DELAY(2);
 2175         }
 2176         if (ntries == 100)
 2177                 return EIO;
 2178 
 2179         cid = wait ? cmd : RT2860_TOKEN_NO_INTR;
 2180         RAL_WRITE(sc, RT2860_H2M_MAILBOX, RT2860_H2M_BUSY | cid << 16 | arg);
 2181         RAL_BARRIER_WRITE(sc);
 2182         RAL_WRITE(sc, RT2860_HOST_CMD, cmd);
 2183 
 2184         if (!wait)
 2185                 return 0;
 2186         /* wait for the command to complete */
 2187         for (ntries = 0; ntries < 200; ntries++) {
 2188                 tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_CID);
 2189                 /* find the command slot */
 2190                 for (slot = 0; slot < 4; slot++, tmp >>= 8)
 2191                         if ((tmp & 0xff) == cid)
 2192                                 break;
 2193                 if (slot < 4)
 2194                         break;
 2195                 DELAY(100);
 2196         }
 2197         if (ntries == 200) {
 2198                 /* clear command and status */
 2199                 RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
 2200                 RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
 2201                 return ETIMEDOUT;
 2202         }
 2203         /* get command status (1 means success) */
 2204         tmp = RAL_READ(sc, RT2860_H2M_MAILBOX_STATUS);
 2205         tmp = (tmp >> (slot * 8)) & 0xff;
 2206         DPRINTF(("MCU command=0x%02x slot=%d status=0x%02x\n",
 2207             cmd, slot, tmp));
 2208         /* clear command and status */
 2209         RAL_WRITE(sc, RT2860_H2M_MAILBOX_STATUS, 0xffffffff);
 2210         RAL_WRITE(sc, RT2860_H2M_MAILBOX_CID, 0xffffffff);
 2211         return (tmp == 1) ? 0 : EIO;
 2212 }
 2213 
 2214 static void
 2215 rt2860_enable_mrr(struct rt2860_softc *sc)
 2216 {
 2217 #define CCK(mcs)        (mcs)
 2218 #define OFDM(mcs)       (1U << 3 | (mcs))
 2219         RAL_WRITE(sc, RT2860_LG_FBK_CFG0,
 2220             OFDM(6) << 28 |     /* 54->48 */
 2221             OFDM(5) << 24 |     /* 48->36 */
 2222             OFDM(4) << 20 |     /* 36->24 */
 2223             OFDM(3) << 16 |     /* 24->18 */
 2224             OFDM(2) << 12 |     /* 18->12 */
 2225             OFDM(1) <<  8 |     /* 12-> 9 */
 2226             OFDM(0) <<  4 |     /*  9-> 6 */
 2227             OFDM(0));           /*  6-> 6 */
 2228 
 2229         RAL_WRITE(sc, RT2860_LG_FBK_CFG1,
 2230             CCK(2) << 12 |      /* 11->5.5 */
 2231             CCK(1) <<  8 |      /* 5.5-> 2 */
 2232             CCK(0) <<  4 |      /*   2-> 1 */
 2233             CCK(0));            /*   1-> 1 */
 2234 #undef OFDM
 2235 #undef CCK
 2236 }
 2237 
 2238 static void
 2239 rt2860_set_txpreamble(struct rt2860_softc *sc)
 2240 {
 2241         uint32_t tmp;
 2242 
 2243         tmp = RAL_READ(sc, RT2860_AUTO_RSP_CFG);
 2244         tmp &= ~RT2860_CCK_SHORT_EN;
 2245         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
 2246                 tmp |= RT2860_CCK_SHORT_EN;
 2247         RAL_WRITE(sc, RT2860_AUTO_RSP_CFG, tmp);
 2248 }
 2249 
 2250 static void
 2251 rt2860_set_basicrates(struct rt2860_softc *sc)
 2252 {
 2253         struct ieee80211com *ic = &sc->sc_ic;
 2254 
 2255         /* set basic rates mask */
 2256         if (ic->ic_curmode == IEEE80211_MODE_11B)
 2257                 RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x003);
 2258         else if (ic->ic_curmode == IEEE80211_MODE_11A)
 2259                 RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x150);
 2260         else    /* 11g */
 2261                 RAL_WRITE(sc, RT2860_LEGACY_BASIC_RATE, 0x15f);
 2262 }
 2263 
 2264 static void
 2265 rt2860_select_chan_group(struct rt2860_softc *sc, int group)
 2266 {
 2267         uint32_t tmp;
 2268         uint8_t agc;
 2269 
 2270         /* Wait for BBP to settle */
 2271         DELAY(1000);
 2272 
 2273         rt2860_mcu_bbp_write(sc, 62, 0x37 - sc->lna[group]);
 2274         rt2860_mcu_bbp_write(sc, 63, 0x37 - sc->lna[group]);
 2275         rt2860_mcu_bbp_write(sc, 64, 0x37 - sc->lna[group]);
 2276         rt2860_mcu_bbp_write(sc, 86, 0x00);
 2277 
 2278         if (group == 0) {
 2279                 if (sc->ext_2ghz_lna) {
 2280                         rt2860_mcu_bbp_write(sc, 82, 0x62);
 2281                         rt2860_mcu_bbp_write(sc, 75, 0x46);
 2282                 } else {
 2283                         rt2860_mcu_bbp_write(sc, 82, 0x84);
 2284                         rt2860_mcu_bbp_write(sc, 75, 0x50);
 2285                 }
 2286         } else {
 2287                 if (sc->mac_ver == 0x3572)
 2288                         rt2860_mcu_bbp_write(sc, 82, 0x94);
 2289                 else
 2290                         rt2860_mcu_bbp_write(sc, 82, 0xf2);
 2291 
 2292                 if (sc->ext_5ghz_lna)
 2293                         rt2860_mcu_bbp_write(sc, 75, 0x46);
 2294                 else
 2295                         rt2860_mcu_bbp_write(sc, 75, 0x50);
 2296         }
 2297 
 2298         tmp = RAL_READ(sc, RT2860_TX_BAND_CFG);
 2299         tmp &= ~(RT2860_5G_BAND_SEL_N | RT2860_5G_BAND_SEL_P);
 2300         tmp |= (group == 0) ? RT2860_5G_BAND_SEL_N : RT2860_5G_BAND_SEL_P;
 2301         RAL_WRITE(sc, RT2860_TX_BAND_CFG, tmp);
 2302 
 2303         /* enable appropriate Power Amplifiers and Low Noise Amplifiers */
 2304         tmp = RT2860_RFTR_EN | RT2860_TRSW_EN | RT2860_LNA_PE0_EN;
 2305         if (sc->nrxchains > 1)
 2306                 tmp |= RT2860_LNA_PE1_EN;
 2307         if (sc->mac_ver == 0x3593 && sc->nrxchains > 2)
 2308                 tmp |= RT3593_LNA_PE2_EN;
 2309         if (group == 0) {       /* 2GHz */
 2310                 tmp |= RT2860_PA_PE_G0_EN;
 2311                 if (sc->ntxchains > 1)
 2312                         tmp |= RT2860_PA_PE_G1_EN;
 2313                 if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
 2314                         tmp |= RT3593_PA_PE_G2_EN;
 2315         } else {                /* 5GHz */
 2316                 tmp |= RT2860_PA_PE_A0_EN;
 2317                 if (sc->ntxchains > 1)
 2318                         tmp |= RT2860_PA_PE_A1_EN;
 2319                 if (sc->mac_ver == 0x3593 && sc->ntxchains > 2)
 2320                         tmp |= RT3593_PA_PE_A2_EN;
 2321         }
 2322         if (sc->mac_ver == 0x3572) {
 2323                 rt3090_rf_write(sc, 8, 0x00);
 2324                 RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
 2325                 rt3090_rf_write(sc, 8, 0x80);
 2326         } else
 2327                 RAL_WRITE(sc, RT2860_TX_PIN_CFG, tmp);
 2328 
 2329         if (sc->mac_ver == 0x3593) {
 2330                 tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
 2331                 if (sc->sc_flags & RT2860_PCIE) {
 2332                         tmp &= ~0x01010000;
 2333                         if (group == 0)
 2334                                 tmp |= 0x00010000;
 2335                 } else {
 2336                         tmp &= ~0x00008080;
 2337                         if (group == 0)
 2338                                 tmp |= 0x00000080;
 2339                 }
 2340                 tmp = (tmp & ~0x00001000) | 0x00000010;
 2341                 RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp);
 2342         }
 2343 
 2344         /* set initial AGC value */
 2345         if (group == 0) {       /* 2GHz band */
 2346                 if (sc->mac_ver >= 0x3071)
 2347                         agc = 0x1c + sc->lna[0] * 2;
 2348                 else
 2349                         agc = 0x2e + sc->lna[0];
 2350         } else {                /* 5GHz band */
 2351                 if (sc->mac_ver == 0x3572)
 2352                         agc = 0x22 + (sc->lna[group] * 5) / 3;
 2353                 else
 2354                         agc = 0x32 + (sc->lna[group] * 5) / 3;
 2355         }
 2356         rt2860_mcu_bbp_write(sc, 66, agc);
 2357 
 2358         DELAY(1000);
 2359 }
 2360 
 2361 static void
 2362 rt2860_set_chan(struct rt2860_softc *sc, u_int chan)
 2363 {
 2364         const struct rfprog *rfprog = rt2860_rf2850;
 2365         uint32_t r2, r3, r4;
 2366         int8_t txpow1, txpow2;
 2367         u_int i;
 2368 
 2369         /* find the settings for this channel (we know it exists) */
 2370         for (i = 0; rfprog[i].chan != chan; i++);
 2371 
 2372         r2 = rfprog[i].r2;
 2373         if (sc->ntxchains == 1)
 2374                 r2 |= 1 << 12;          /* 1T: disable Tx chain 2 */
 2375         if (sc->nrxchains == 1)
 2376                 r2 |= 1 << 15 | 1 << 4; /* 1R: disable Rx chains 2 & 3 */
 2377         else if (sc->nrxchains == 2)
 2378                 r2 |= 1 << 4;           /* 2R: disable Rx chain 3 */
 2379 
 2380         /* use Tx power values from EEPROM */
 2381         txpow1 = sc->txpow1[i];
 2382         txpow2 = sc->txpow2[i];
 2383         if (chan > 14) {
 2384                 if (txpow1 >= 0)
 2385                         txpow1 = txpow1 << 1 | 1;
 2386                 else
 2387                         txpow1 = (7 + txpow1) << 1;
 2388                 if (txpow2 >= 0)
 2389                         txpow2 = txpow2 << 1 | 1;
 2390                 else
 2391                         txpow2 = (7 + txpow2) << 1;
 2392         }
 2393         r3 = rfprog[i].r3 | txpow1 << 7;
 2394         r4 = rfprog[i].r4 | sc->freq << 13 | txpow2 << 4;
 2395 
 2396         rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
 2397         rt2860_rf_write(sc, RT2860_RF2, r2);
 2398         rt2860_rf_write(sc, RT2860_RF3, r3);
 2399         rt2860_rf_write(sc, RT2860_RF4, r4);
 2400 
 2401         DELAY(200);
 2402 
 2403         rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
 2404         rt2860_rf_write(sc, RT2860_RF2, r2);
 2405         rt2860_rf_write(sc, RT2860_RF3, r3 | 1);
 2406         rt2860_rf_write(sc, RT2860_RF4, r4);
 2407 
 2408         DELAY(200);
 2409 
 2410         rt2860_rf_write(sc, RT2860_RF1, rfprog[i].r1);
 2411         rt2860_rf_write(sc, RT2860_RF2, r2);
 2412         rt2860_rf_write(sc, RT2860_RF3, r3);
 2413         rt2860_rf_write(sc, RT2860_RF4, r4);
 2414 }
 2415 
 2416 static void
 2417 rt3090_set_chan(struct rt2860_softc *sc, u_int chan)
 2418 {
 2419         int8_t txpow1, txpow2;
 2420         uint8_t rf;
 2421         int i;
 2422 
 2423         KASSERT(chan >= 1 && chan <= 14);       /* RT3090 is 2GHz only */
 2424 
 2425         /* find the settings for this channel (we know it exists) */
 2426         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
 2427 
 2428         /* use Tx power values from EEPROM */
 2429         txpow1 = sc->txpow1[i];
 2430         txpow2 = sc->txpow2[i];
 2431 
 2432         rt3090_rf_write(sc, 2, rt3090_freqs[i].n);
 2433         rf = rt3090_rf_read(sc, 3);
 2434         rf = (rf & ~0x0f) | rt3090_freqs[i].k;
 2435         rt3090_rf_write(sc, 3, rf);
 2436         rf = rt3090_rf_read(sc, 6);
 2437         rf = (rf & ~0x03) | rt3090_freqs[i].r;
 2438         rt3090_rf_write(sc, 6, rf);
 2439 
 2440         /* set Tx0 power */
 2441         rf = rt3090_rf_read(sc, 12);
 2442         rf = (rf & ~0x1f) | txpow1;
 2443         rt3090_rf_write(sc, 12, rf);
 2444 
 2445         /* set Tx1 power */
 2446         rf = rt3090_rf_read(sc, 13);
 2447         rf = (rf & ~0x1f) | txpow2;
 2448         rt3090_rf_write(sc, 13, rf);
 2449 
 2450         rf = rt3090_rf_read(sc, 1);
 2451         rf &= ~0xfc;
 2452         if (sc->ntxchains == 1)
 2453                 rf |= RT3070_TX1_PD | RT3070_TX2_PD;
 2454         else if (sc->ntxchains == 2)
 2455                 rf |= RT3070_TX2_PD;
 2456         if (sc->nrxchains == 1)
 2457                 rf |= RT3070_RX1_PD | RT3070_RX2_PD;
 2458         else if (sc->nrxchains == 2)
 2459                 rf |= RT3070_RX2_PD;
 2460         rt3090_rf_write(sc, 1, rf);
 2461 
 2462         /* set RF offset */
 2463         rf = rt3090_rf_read(sc, 23);
 2464         rf = (rf & ~0x7f) | sc->freq;
 2465         rt3090_rf_write(sc, 23, rf);
 2466 
 2467         /* program RF filter */
 2468         rf = rt3090_rf_read(sc, 24);    /* Tx */
 2469         rf = (rf & ~0x3f) | sc->rf24_20mhz;
 2470         rt3090_rf_write(sc, 24, rf);
 2471         rf = rt3090_rf_read(sc, 31);    /* Rx */
 2472         rf = (rf & ~0x3f) | sc->rf24_20mhz;
 2473         rt3090_rf_write(sc, 31, rf);
 2474 
 2475         /* enable RF tuning */
 2476         rf = rt3090_rf_read(sc, 7);
 2477         rt3090_rf_write(sc, 7, rf | RT3070_TUNE);
 2478 }
 2479 
 2480 static void
 2481 rt5390_set_chan(struct rt2860_softc *sc, u_int chan)
 2482 {
 2483         uint8_t h20mhz, rf, tmp;
 2484         int8_t txpow1, txpow2;
 2485         int i;
 2486 
 2487         /* RT5390 is 2GHz only */
 2488         KASSERT(chan >= 1 && chan <= 14);
 2489 
 2490         /* find the settings for this channel (we know it exists) */
 2491         for (i = 0; rt2860_rf2850[i].chan != chan; i++);
 2492 
 2493         /* use Tx power values from EEPROM */
 2494         txpow1 = sc->txpow1[i];
 2495         txpow2 = sc->txpow2[i];
 2496 
 2497         rt3090_rf_write(sc, 8, rt3090_freqs[i].n);
 2498         rt3090_rf_write(sc, 9, rt3090_freqs[i].k & 0x0f);
 2499         rf = rt3090_rf_read(sc, 11);
 2500         rf = (rf & ~0x03) | (rt3090_freqs[i].r & 0x03);
 2501         rt3090_rf_write(sc, 11, rf);
 2502 
 2503         rf = rt3090_rf_read(sc, 49);
 2504         rf = (rf & ~0x3f) | (txpow1 & 0x3f);
 2505         /* the valid range of the RF R49 is 0x00~0x27 */
 2506         if ((rf & 0x3f) > 0x27)
 2507                 rf = (rf & ~0x3f) | 0x27;
 2508         rt3090_rf_write(sc, 49, rf);
 2509         if (sc->mac_ver == 0x5392) {
 2510                 rf = rt3090_rf_read(sc, 50);
 2511                 rf = (rf & ~0x3f) | (txpow2 & 0x3f);
 2512                 /* the valid range of the RF R50 is 0x00~0x27 */
 2513                 if ((rf & 0x3f) > 0x27)
 2514                         rf = (rf & ~0x3f) | 0x27;
 2515                 rt3090_rf_write(sc, 50, rf);
 2516         }
 2517 
 2518         rf = rt3090_rf_read(sc, 1);
 2519         rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | RT3070_TX0_PD;
 2520         if (sc->mac_ver == 0x5392)
 2521                 rf |= RT3070_RX1_PD | RT3070_TX1_PD;
 2522         rt3090_rf_write(sc, 1, rf);
 2523 
 2524         rf = rt3090_rf_read(sc, 2);
 2525         rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
 2526         DELAY(1000);
 2527         rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
 2528 
 2529         rf = rt3090_rf_read(sc, 17);
 2530         tmp = rf;
 2531         rf = (rf & ~0x7f) | (sc->freq & 0x7f);
 2532         rf = MIN(rf, 0x5f);
 2533         if (tmp != rf)
 2534                 rt2860_mcu_cmd(sc, 0x74, (tmp << 8 ) | rf, 0);
 2535         
 2536         if (sc->mac_ver == 0x5390) {
 2537                 if (chan <= 4)
 2538                         rf = 0x73;
 2539                 else if (chan >= 5 && chan <= 6)
 2540                         rf = 0x63;
 2541                 else if (chan >= 7 && chan <= 10)
 2542                         rf = 0x53;
 2543                 else
 2544                         rf = 43;
 2545                 rt3090_rf_write(sc, 55, rf);
 2546 
 2547                 if (chan == 1)
 2548                         rf = 0x0c;
 2549                 else if (chan == 2)
 2550                         rf = 0x0b;
 2551                 else if (chan == 3)
 2552                         rf = 0x0a;
 2553                 else if (chan >= 4 && chan <= 6)
 2554                         rf = 0x09;
 2555                 else if (chan >= 7 && chan <= 12)
 2556                         rf = 0x08;
 2557                 else if (chan == 13)
 2558                         rf = 0x07;
 2559                 else
 2560                         rf = 0x06;
 2561                 rt3090_rf_write(sc, 59, rf);
 2562         }
 2563 
 2564         /* Tx/Rx h20M */
 2565         h20mhz = (sc->rf24_20mhz & 0x20) >> 5;
 2566         rf = rt3090_rf_read(sc, 30);
 2567         rf = (rf & ~0x06) | (h20mhz << 1) | (h20mhz << 2);
 2568         rt3090_rf_write(sc, 30, rf);
 2569 
 2570         /* Rx BB filter VCM */
 2571         rf = rt3090_rf_read(sc, 30);
 2572         rf = (rf & ~0x18) | 0x10;
 2573         rt3090_rf_write(sc, 30, rf);
 2574 
 2575         /* Initiate VCO calibration. */
 2576         rf = rt3090_rf_read(sc, 3);
 2577         rf |= RT3593_VCOCAL;
 2578         rt3090_rf_write(sc, 3, rf);
 2579 }
 2580 
 2581 static void
 2582 rt3090_rf_init(struct rt2860_softc *sc)
 2583 {
 2584         uint32_t tmp;
 2585         uint8_t rf, bbp;
 2586         int i;
 2587 
 2588         rf = rt3090_rf_read(sc, 30);
 2589         /* toggle RF R30 bit 7 */
 2590         rt3090_rf_write(sc, 30, rf | 0x80);
 2591         DELAY(1000);
 2592         rt3090_rf_write(sc, 30, rf & ~0x80);
 2593 
 2594         tmp = RAL_READ(sc, RT3070_LDO_CFG0);
 2595         tmp &= ~0x1f000000;
 2596         if (sc->patch_dac && sc->mac_rev < 0x0211)
 2597                 tmp |= 0x0d000000;      /* 1.35V */
 2598         else
 2599                 tmp |= 0x01000000;      /* 1.2V */
 2600         RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
 2601 
 2602         /* patch LNA_PE_G1 */
 2603         tmp = RAL_READ(sc, RT3070_GPIO_SWITCH);
 2604         RAL_WRITE(sc, RT3070_GPIO_SWITCH, tmp & ~0x20);
 2605 
 2606         /* initialize RF registers to default value */
 2607         if (sc->mac_ver == 0x3572) {
 2608                 for (i = 0; i < (int)__arraycount(rt3572_def_rf); i++) {
 2609                         rt3090_rf_write(sc, rt3572_def_rf[i].reg,
 2610                             rt3572_def_rf[i].val);
 2611                 }
 2612         } else {
 2613                 for (i = 0; i < (int)__arraycount(rt3090_def_rf); i++) {
 2614                         rt3090_rf_write(sc, rt3090_def_rf[i].reg,
 2615                             rt3090_def_rf[i].val);
 2616                 }
 2617         }
 2618 
 2619         /* select 20MHz bandwidth */
 2620         rt3090_rf_write(sc, 31, 0x14);
 2621 
 2622         rf = rt3090_rf_read(sc, 6);
 2623         rt3090_rf_write(sc, 6, rf | 0x40);
 2624 
 2625         if (sc->mac_ver != 0x3593) {
 2626                 /* calibrate filter for 20MHz bandwidth */
 2627                 sc->rf24_20mhz = 0x1f;  /* default value */
 2628                 rt3090_filter_calib(sc, 0x07, 0x16, &sc->rf24_20mhz);
 2629 
 2630                 /* select 40MHz bandwidth */
 2631                 bbp = rt2860_mcu_bbp_read(sc, 4);
 2632                 rt2860_mcu_bbp_write(sc, 4, (bbp & ~0x08) | 0x10);
 2633                 rf = rt3090_rf_read(sc, 31);
 2634                 rt3090_rf_write(sc, 31, rf | 0x20);
 2635 
 2636                 /* calibrate filter for 40MHz bandwidth */
 2637                 sc->rf24_40mhz = 0x2f;  /* default value */
 2638                 rt3090_filter_calib(sc, 0x27, 0x19, &sc->rf24_40mhz);
 2639 
 2640                 /* go back to 20MHz bandwidth */
 2641                 bbp = rt2860_mcu_bbp_read(sc, 4);
 2642                 rt2860_mcu_bbp_write(sc, 4, bbp & ~0x18);
 2643         }
 2644         if (sc->mac_rev < 0x0211)
 2645                 rt3090_rf_write(sc, 27, 0x03);
 2646 
 2647         tmp = RAL_READ(sc, RT3070_OPT_14);
 2648         RAL_WRITE(sc, RT3070_OPT_14, tmp | 1);
 2649 
 2650         if (sc->rf_rev == RT3070_RF_3020)
 2651                 rt3090_set_rx_antenna(sc, 0);
 2652 
 2653         bbp = rt2860_mcu_bbp_read(sc, 138);
 2654         if (sc->mac_ver == 0x3593) {
 2655                 if (sc->ntxchains == 1)
 2656                         bbp |= 0x60;    /* turn off DAC1 and DAC2 */
 2657                 else if (sc->ntxchains == 2)
 2658                         bbp |= 0x40;    /* turn off DAC2 */
 2659                 if (sc->nrxchains == 1)
 2660                         bbp &= ~0x06;   /* turn off ADC1 and ADC2 */
 2661                 else if (sc->nrxchains == 2)
 2662                         bbp &= ~0x04;   /* turn off ADC2 */
 2663         } else {
 2664                 if (sc->ntxchains == 1)
 2665                         bbp |= 0x20;    /* turn off DAC1 */
 2666                 if (sc->nrxchains == 1)
 2667                         bbp &= ~0x02;   /* turn off ADC1 */
 2668         }
 2669         rt2860_mcu_bbp_write(sc, 138, bbp);
 2670 
 2671         rf = rt3090_rf_read(sc, 1);
 2672         rf &= ~(RT3070_RX0_PD | RT3070_TX0_PD);
 2673         rf |= RT3070_RF_BLOCK | RT3070_RX1_PD | RT3070_TX1_PD;
 2674         rt3090_rf_write(sc, 1, rf);
 2675 
 2676         rf = rt3090_rf_read(sc, 15);
 2677         rt3090_rf_write(sc, 15, rf & ~RT3070_TX_LO2);
 2678 
 2679         rf = rt3090_rf_read(sc, 17);
 2680         rf &= ~RT3070_TX_LO1;
 2681         if (sc->mac_rev >= 0x0211 && !sc->ext_2ghz_lna)
 2682                 rf |= 0x20;     /* fix for long range Rx issue */
 2683         if (sc->txmixgain_2ghz >= 2)
 2684                 rf = (rf & ~0x7) | sc->txmixgain_2ghz;
 2685         rt3090_rf_write(sc, 17, rf);
 2686 
 2687         rf = rt3090_rf_read(sc, 20);
 2688         rt3090_rf_write(sc, 20, rf & ~RT3070_RX_LO1);
 2689 
 2690         rf = rt3090_rf_read(sc, 21);
 2691         rt3090_rf_write(sc, 21, rf & ~RT3070_RX_LO2);
 2692 }
 2693 
 2694 static void
 2695 rt5390_rf_init(struct rt2860_softc *sc)
 2696 {
 2697         uint8_t rf, bbp;
 2698         int i;
 2699 
 2700         rf = rt3090_rf_read(sc, 2);
 2701         /* Toggle RF R2 bit 7. */
 2702         rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
 2703         DELAY(1000);
 2704         rt3090_rf_write(sc, 2, rf & ~RT3593_RESCAL);
 2705 
 2706         /* Initialize RF registers to default value. */
 2707         if (sc->mac_ver == 0x5392) {
 2708                 for (i = 0; i < __arraycount(rt5392_def_rf); i++) {
 2709                         rt3090_rf_write(sc, rt5392_def_rf[i].reg,
 2710                             rt5392_def_rf[i].val);
 2711                 }
 2712         } else {
 2713                 for (i = 0; i < __arraycount(rt5390_def_rf); i++) {
 2714                         rt3090_rf_write(sc, rt5390_def_rf[i].reg,
 2715                             rt5390_def_rf[i].val);
 2716                 }
 2717         }
 2718 
 2719         sc->rf24_20mhz = 0x1f;
 2720         sc->rf24_40mhz = 0x2f;
 2721 
 2722         if (sc->mac_rev < 0x0211)
 2723                 rt3090_rf_write(sc, 27, 0x03);
 2724 
 2725         /* Set led open drain enable. */
 2726         RAL_WRITE(sc, RT3070_OPT_14, RAL_READ(sc, RT3070_OPT_14) | 1);
 2727 
 2728         RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
 2729         RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
 2730 
 2731         if (sc->mac_ver == 0x5390)
 2732                 rt3090_set_rx_antenna(sc, 0);
 2733 
 2734         /* Patch RSSI inaccurate issue. */
 2735         rt2860_mcu_bbp_write(sc, 79, 0x13);
 2736         rt2860_mcu_bbp_write(sc, 80, 0x05);
 2737         rt2860_mcu_bbp_write(sc, 81, 0x33);
 2738 
 2739         /* Enable DC filter. */
 2740         if (sc->mac_rev >= 0x0211)
 2741                 rt2860_mcu_bbp_write(sc, 103, 0xc0);
 2742 
 2743         bbp = rt2860_mcu_bbp_read(sc, 138);
 2744         if (sc->ntxchains == 1)
 2745                 bbp |= 0x20;    /* Turn off DAC1. */
 2746         if (sc->nrxchains == 1)
 2747                 bbp &= ~0x02;   /* Turn off ADC1. */
 2748         rt2860_mcu_bbp_write(sc, 138, bbp);
 2749 
 2750         /* Enable RX LO1 and LO2. */
 2751         rt3090_rf_write(sc, 38, rt3090_rf_read(sc, 38) & ~RT5390_RX_LO1);
 2752         rt3090_rf_write(sc, 39, rt3090_rf_read(sc, 39) & ~RT5390_RX_LO2);
 2753 
 2754         /* Avoid data lost and CRC error. */
 2755         rt2860_mcu_bbp_write(sc, 4,
 2756             rt2860_mcu_bbp_read(sc, 4) | RT5390_MAC_IF_CTRL);
 2757 
 2758         rf = rt3090_rf_read(sc, 30);
 2759         rf = (rf & ~0x18) | 0x10;
 2760         rt3090_rf_write(sc, 30, rf);
 2761 }
 2762 
 2763 static void
 2764 rt3090_rf_wakeup(struct rt2860_softc *sc)
 2765 {
 2766         uint32_t tmp;
 2767         uint8_t rf;
 2768 
 2769         if (sc->mac_ver == 0x3593) {
 2770                 /* enable VCO */
 2771                 rf = rt3090_rf_read(sc, 1);
 2772                 rt3090_rf_write(sc, 1, rf | RT3593_VCO);
 2773 
 2774                 /* initiate VCO calibration */
 2775                 rf = rt3090_rf_read(sc, 3);
 2776                 rt3090_rf_write(sc, 3, rf | RT3593_VCOCAL);
 2777 
 2778                 /* enable VCO bias current control */
 2779                 rf = rt3090_rf_read(sc, 6);
 2780                 rt3090_rf_write(sc, 6, rf | RT3593_VCO_IC);
 2781 
 2782                 /* initiate res calibration */
 2783                 rf = rt3090_rf_read(sc, 2);
 2784                 rt3090_rf_write(sc, 2, rf | RT3593_RESCAL);
 2785 
 2786                 /* set reference current control to 0.33 mA */
 2787                 rf = rt3090_rf_read(sc, 22);
 2788                 rf &= ~RT3593_CP_IC_MASK;
 2789                 rf |= 1 << RT3593_CP_IC_SHIFT;
 2790                 rt3090_rf_write(sc, 22, rf);
 2791 
 2792                 /* enable RX CTB */
 2793                 rf = rt3090_rf_read(sc, 46);
 2794                 rt3090_rf_write(sc, 46, rf | RT3593_RX_CTB);
 2795 
 2796                 rf = rt3090_rf_read(sc, 20);
 2797                 rf &= ~(RT3593_LDO_RF_VC_MASK | RT3593_LDO_PLL_VC_MASK);
 2798                 rt3090_rf_write(sc, 20, rf);
 2799         } else {
 2800                 /* enable RF block */
 2801                 rf = rt3090_rf_read(sc, 1);
 2802                 rt3090_rf_write(sc, 1, rf | RT3070_RF_BLOCK);
 2803 
 2804                 /* enable VCO bias current control */
 2805                 rf = rt3090_rf_read(sc, 7);
 2806                 rt3090_rf_write(sc, 7, rf | 0x30);
 2807 
 2808                 rf = rt3090_rf_read(sc, 9);
 2809                 rt3090_rf_write(sc, 9, rf | 0x0e);
 2810 
 2811                 /* enable RX CTB */
 2812                 rf = rt3090_rf_read(sc, 21);
 2813                 rt3090_rf_write(sc, 21, rf | RT3070_RX_CTB);
 2814 
 2815                 /* fix Tx to Rx IQ glitch by raising RF voltage */
 2816                 rf = rt3090_rf_read(sc, 27);
 2817                 rf &= ~0x77;
 2818                 if (sc->mac_rev < 0x0211)
 2819                         rf |= 0x03;
 2820                 rt3090_rf_write(sc, 27, rf);
 2821         }
 2822         if (sc->patch_dac && sc->mac_rev < 0x0211) {
 2823                 tmp = RAL_READ(sc, RT3070_LDO_CFG0);
 2824                 tmp = (tmp & ~0x1f000000) | 0x0d000000;
 2825                 RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
 2826         }
 2827 }
 2828 
 2829 static void
 2830 rt5390_rf_wakeup(struct rt2860_softc *sc)
 2831 {
 2832         uint32_t tmp;
 2833         uint8_t rf;
 2834 
 2835         rf = rt3090_rf_read(sc, 1);
 2836         rf |= RT3070_RF_BLOCK | RT3070_PLL_PD | RT3070_RX0_PD | 
 2837             RT3070_TX0_PD;
 2838         if (sc->mac_ver == 0x5392)
 2839                 rf |= RT3070_RX1_PD | RT3070_TX1_PD;
 2840         rt3090_rf_write(sc, 1, rf);
 2841 
 2842         rf = rt3090_rf_read(sc, 6);
 2843         rf |= RT3593_VCO_IC | RT3593_VCOCAL;
 2844         if (sc->mac_ver == 0x5390)
 2845                 rf &= ~RT3593_VCO_IC;
 2846         rt3090_rf_write(sc, 6, rf);
 2847 
 2848         rt3090_rf_write(sc, 2, rt3090_rf_read(sc, 2) | RT3593_RESCAL);
 2849 
 2850         rf = rt3090_rf_read(sc, 22);
 2851         rf = (rf & ~0xe0) | 0x20;
 2852         rt3090_rf_write(sc, 22, rf);
 2853 
 2854         rt3090_rf_write(sc, 42, rt3090_rf_read(sc, 42) | RT5390_RX_CTB);
 2855         rt3090_rf_write(sc, 20, rt3090_rf_read(sc, 20) & ~0x77);
 2856         rt3090_rf_write(sc, 3, rt3090_rf_read(sc, 3) | RT3593_VCOCAL);
 2857 
 2858         if (sc->patch_dac && sc->mac_rev < 0x0211) {
 2859                 tmp = RAL_READ(sc, RT3070_LDO_CFG0);
 2860                 tmp = (tmp & ~0x1f000000) | 0x0d000000;
 2861                 RAL_WRITE(sc, RT3070_LDO_CFG0, tmp);
 2862         }
 2863 }
 2864 
 2865 static int
 2866 rt3090_filter_calib(struct rt2860_softc *sc, uint8_t init, uint8_t target,
 2867     uint8_t *val)
 2868 {
 2869         uint8_t rf22, rf24;
 2870         uint8_t bbp55_pb, bbp55_sb, delta;
 2871         int ntries;
 2872 
 2873         /* program filter */
 2874         rf24 = rt3090_rf_read(sc, 24);
 2875         rf24 = (rf24 & 0xc0) | init;    /* initial filter value */
 2876         rt3090_rf_write(sc, 24, rf24);
 2877 
 2878         /* enable baseband loopback mode */
 2879         rf22 = rt3090_rf_read(sc, 22);
 2880         rt3090_rf_write(sc, 22, rf22 | RT3070_BB_LOOPBACK);
 2881 
 2882         /* set power and frequency of passband test tone */
 2883         rt2860_mcu_bbp_write(sc, 24, 0x00);
 2884         for (ntries = 0; ntries < 100; ntries++) {
 2885                 /* transmit test tone */
 2886                 rt2860_mcu_bbp_write(sc, 25, 0x90);
 2887                 DELAY(1000);
 2888                 /* read received power */
 2889                 bbp55_pb = rt2860_mcu_bbp_read(sc, 55);
 2890                 if (bbp55_pb != 0)
 2891                         break;
 2892         }
 2893         if (ntries == 100)
 2894                 return ETIMEDOUT;
 2895 
 2896         /* set power and frequency of stopband test tone */
 2897         rt2860_mcu_bbp_write(sc, 24, 0x06);
 2898         for (ntries = 0; ntries < 100; ntries++) {
 2899                 /* transmit test tone */
 2900                 rt2860_mcu_bbp_write(sc, 25, 0x90);
 2901                 DELAY(1000);
 2902                 /* read received power */
 2903                 bbp55_sb = rt2860_mcu_bbp_read(sc, 55);
 2904 
 2905                 delta = bbp55_pb - bbp55_sb;
 2906                 if (delta > target)
 2907                         break;
 2908 
 2909                 /* reprogram filter */
 2910                 rf24++;
 2911                 rt3090_rf_write(sc, 24, rf24);
 2912         }
 2913         if (ntries < 100) {
 2914                 if (rf24 != init)
 2915                         rf24--; /* backtrack */
 2916                 *val = rf24;
 2917                 rt3090_rf_write(sc, 24, rf24);
 2918         }
 2919 
 2920         /* restore initial state */
 2921         rt2860_mcu_bbp_write(sc, 24, 0x00);
 2922 
 2923         /* disable baseband loopback mode */
 2924         rf22 = rt3090_rf_read(sc, 22);
 2925         rt3090_rf_write(sc, 22, rf22 & ~RT3070_BB_LOOPBACK);
 2926 
 2927         return 0;
 2928 }
 2929 
 2930 static void
 2931 rt3090_rf_setup(struct rt2860_softc *sc)
 2932 {
 2933         uint8_t bbp;
 2934         int i;
 2935 
 2936         if (sc->mac_rev >= 0x0211) {
 2937                 /* enable DC filter */
 2938                 rt2860_mcu_bbp_write(sc, 103, 0xc0);
 2939 
 2940                 /* improve power consumption */
 2941                 bbp = rt2860_mcu_bbp_read(sc, 31);
 2942                 rt2860_mcu_bbp_write(sc, 31, bbp & ~0x03);
 2943         }
 2944 
 2945         RAL_WRITE(sc, RT2860_TX_SW_CFG1, 0);
 2946         if (sc->mac_rev < 0x0211) {
 2947                 RAL_WRITE(sc, RT2860_TX_SW_CFG2,
 2948                     sc->patch_dac ? 0x2c : 0x0f);
 2949         } else
 2950                 RAL_WRITE(sc, RT2860_TX_SW_CFG2, 0);
 2951 
 2952         /* initialize RF registers from ROM */
 2953         if (sc->mac_ver < 0x5390) {
 2954                 for (i = 0; i < 10; i++) {
 2955                         if (sc->rf[i].reg == 0 || sc->rf[i].reg == 0xff)
 2956                                 continue;
 2957                         rt3090_rf_write(sc, sc->rf[i].reg, sc->rf[i].val);
 2958                 }
 2959         }
 2960 }
 2961 
 2962 static void
 2963 rt2860_set_leds(struct rt2860_softc *sc, uint16_t which)
 2964 {
 2965         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LEDS,
 2966             which | (sc->leds & 0x7f), 0);
 2967 }
 2968 
 2969 /*
 2970  * Hardware has a general-purpose programmable timer interrupt that can
 2971  * periodically raise MAC_INT_4.
 2972  */
 2973 static void
 2974 rt2860_set_gp_timer(struct rt2860_softc *sc, int ms)
 2975 {
 2976         uint32_t tmp;
 2977 
 2978         /* disable GP timer before reprogramming it */
 2979         tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
 2980         RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp & ~RT2860_GP_TIMER_EN);
 2981 
 2982         if (ms == 0)
 2983                 return;
 2984 
 2985         tmp = RAL_READ(sc, RT2860_INT_TIMER_CFG);
 2986         ms *= 16;       /* Unit: 64us */
 2987         tmp = (tmp & 0xffff) | ms << RT2860_GP_TIMER_SHIFT;
 2988         RAL_WRITE(sc, RT2860_INT_TIMER_CFG, tmp);
 2989 
 2990         /* enable GP timer */
 2991         tmp = RAL_READ(sc, RT2860_INT_TIMER_EN);
 2992         RAL_WRITE(sc, RT2860_INT_TIMER_EN, tmp | RT2860_GP_TIMER_EN);
 2993 }
 2994 
 2995 static void
 2996 rt2860_set_bssid(struct rt2860_softc *sc, const uint8_t *bssid)
 2997 {
 2998         RAL_WRITE(sc, RT2860_MAC_BSSID_DW0,
 2999             bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24);
 3000         RAL_WRITE(sc, RT2860_MAC_BSSID_DW1,
 3001             bssid[4] | bssid[5] << 8);
 3002 }
 3003 
 3004 static void
 3005 rt2860_set_macaddr(struct rt2860_softc *sc, const uint8_t *addr)
 3006 {
 3007         RAL_WRITE(sc, RT2860_MAC_ADDR_DW0,
 3008             addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24);
 3009         RAL_WRITE(sc, RT2860_MAC_ADDR_DW1,
 3010             addr[4] | addr[5] << 8 | 0xff << 16);
 3011 }
 3012 
 3013 static void
 3014 rt2860_updateslot(struct ifnet *ifp)
 3015 {
 3016         struct rt2860_softc *sc = ifp->if_softc;
 3017         struct ieee80211com *ic = &sc->sc_ic;
 3018         uint32_t tmp;
 3019 
 3020         tmp = RAL_READ(sc, RT2860_BKOFF_SLOT_CFG);
 3021         tmp &= ~0xff;
 3022         tmp |= (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
 3023         RAL_WRITE(sc, RT2860_BKOFF_SLOT_CFG, tmp);
 3024 }
 3025 
 3026 static void
 3027 rt2860_updateprot(struct ieee80211com *ic)
 3028 {
 3029         struct rt2860_softc *sc = ic->ic_ifp->if_softc;
 3030         uint32_t tmp;
 3031 
 3032         tmp = RT2860_RTSTH_EN | RT2860_PROT_NAV_SHORT | RT2860_TXOP_ALLOW_ALL;
 3033         /* setup protection frame rate (MCS code) */
 3034         tmp |= (ic->ic_curmode == IEEE80211_MODE_11A) ?
 3035             rt2860_rates[RT2860_RIDX_OFDM6].mcs :
 3036             rt2860_rates[RT2860_RIDX_CCK11].mcs;
 3037 
 3038         /* CCK frames don't require protection */
 3039         RAL_WRITE(sc, RT2860_CCK_PROT_CFG, tmp);
 3040 
 3041         if (ic->ic_flags & IEEE80211_F_USEPROT) {
 3042                 if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
 3043                         tmp |= RT2860_PROT_CTRL_RTS_CTS;
 3044                 else if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
 3045                         tmp |= RT2860_PROT_CTRL_CTS;
 3046         }
 3047         RAL_WRITE(sc, RT2860_OFDM_PROT_CFG, tmp);
 3048 }
 3049 
 3050 static void
 3051 rt2860_update_promisc(struct ifnet *ifp)
 3052 {
 3053         struct rt2860_softc *sc = ifp->if_softc;
 3054         uint32_t tmp;
 3055 
 3056         tmp = RAL_READ(sc, RT2860_RX_FILTR_CFG);
 3057         tmp &= ~RT2860_DROP_NOT_MYBSS;
 3058         if (!(ifp->if_flags & IFF_PROMISC))
 3059                 tmp |= RT2860_DROP_NOT_MYBSS;
 3060         RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
 3061 }
 3062 
 3063 static int
 3064 rt2860_updateedca(struct ieee80211com *ic)
 3065 {
 3066         struct rt2860_softc *sc = ic->ic_ifp->if_softc;
 3067         int aci;
 3068 
 3069         /* update MAC TX configuration registers */
 3070         for (aci = 0; aci < WME_NUM_AC; aci++) {
 3071                 RAL_WRITE(sc, RT2860_EDCA_AC_CFG(aci),
 3072                     ic->ic_wme.wme_params[aci].wmep_logcwmax << 16 |
 3073                     ic->ic_wme.wme_params[aci].wmep_logcwmin << 12 |
 3074                     ic->ic_wme.wme_params[aci].wmep_aifsn  <<  8 |
 3075                     ic->ic_wme.wme_params[aci].wmep_txopLimit);
 3076         }
 3077 
 3078         /* update SCH/DMA registers too */
 3079         RAL_WRITE(sc, RT2860_WMM_AIFSN_CFG,
 3080             ic->ic_wme.wme_params[WME_AC_VO].wmep_aifsn  << 12 |
 3081             ic->ic_wme.wme_params[WME_AC_VI].wmep_aifsn  <<  8 |
 3082             ic->ic_wme.wme_params[WME_AC_BK].wmep_aifsn  <<  4 |
 3083             ic->ic_wme.wme_params[WME_AC_BE].wmep_aifsn);
 3084         RAL_WRITE(sc, RT2860_WMM_CWMIN_CFG,
 3085             ic->ic_wme.wme_params[WME_AC_VO].wmep_logcwmin << 12 |
 3086             ic->ic_wme.wme_params[WME_AC_VI].wmep_logcwmin <<  8 |
 3087             ic->ic_wme.wme_params[WME_AC_BK].wmep_logcwmin <<  4 |
 3088             ic->ic_wme.wme_params[WME_AC_BE].wmep_logcwmin);
 3089         RAL_WRITE(sc, RT2860_WMM_CWMAX_CFG,
 3090             ic->ic_wme.wme_params[WME_AC_VO].wmep_logcwmax << 12 |
 3091             ic->ic_wme.wme_params[WME_AC_VI].wmep_logcwmax <<  8 |
 3092             ic->ic_wme.wme_params[WME_AC_BK].wmep_logcwmax <<  4 |
 3093             ic->ic_wme.wme_params[WME_AC_BE].wmep_logcwmax);
 3094         RAL_WRITE(sc, RT2860_WMM_TXOP0_CFG,
 3095             ic->ic_wme.wme_params[WME_AC_BK].wmep_txopLimit << 16 |
 3096             ic->ic_wme.wme_params[WME_AC_BE].wmep_txopLimit);
 3097         RAL_WRITE(sc, RT2860_WMM_TXOP1_CFG,
 3098             ic->ic_wme.wme_params[WME_AC_VO].wmep_txopLimit << 16 |
 3099             ic->ic_wme.wme_params[WME_AC_VI].wmep_txopLimit);
 3100         return 0;
 3101 }
 3102 
 3103 #ifdef HW_CRYPTO
 3104 static int
 3105 rt2860_set_key(struct ieee80211com *ic, const struct ieee80211_key *ck,
 3106     const uint8_t *mac)
 3107 {
 3108         struct rt2860_softc *sc = ic->ic_ifp->if_softc;
 3109         struct ieee80211_node *ni = ic->ic_bss;
 3110         bus_size_t base;
 3111         uint32_t attr;
 3112         uint8_t mode, wcid, iv[8];
 3113         struct ieee80211_key *k = __UNCONST(ck); /* XXX */
 3114 
 3115         DPRINTF(("%s: cipher %d\n", __func__, k->wk_cipher->ic_cipher));
 3116         /* defer setting of WEP keys until interface is brought up */
 3117         if ((ic->ic_ifp->if_flags & (IFF_UP | IFF_RUNNING)) !=
 3118             (IFF_UP | IFF_RUNNING)) {
 3119                 DPRINTF(("%s: not running %d\n", __func__,
 3120                     k->wk_cipher->ic_cipher));
 3121                 return 1;
 3122         }
 3123         /* map net80211 cipher to RT2860 security mode */
 3124         switch (k->wk_cipher->ic_cipher) {
 3125         case IEEE80211_CIPHER_WEP:
 3126                 k->wk_flags |= IEEE80211_KEY_GROUP; /* XXX */
 3127                 if (k->wk_keylen == 5)
 3128                         mode = RT2860_MODE_WEP40;
 3129                 else
 3130                         mode = RT2860_MODE_WEP104;
 3131                 break;
 3132         case IEEE80211_CIPHER_TKIP:
 3133                 mode = RT2860_MODE_TKIP;
 3134                 break;
 3135         case IEEE80211_CIPHER_AES_CCM:
 3136                 mode = RT2860_MODE_AES_CCMP;
 3137                 break;
 3138         default:
 3139                 DPRINTF(("%s: bad\n", __func__));
 3140                 return 0;
 3141         }
 3142 
 3143         if (k->wk_flags & IEEE80211_KEY_GROUP) {
 3144                 wcid = 0;       /* NB: update WCID0 for group keys */
 3145                 base = RT2860_SKEY(0, k->wk_keyix);
 3146         } else {
 3147                 wcid = ((struct rt2860_node *)ni)->wcid;
 3148                 base = RT2860_PKEY(wcid);
 3149         }
 3150 
 3151         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
 3152                 RAL_WRITE_REGION_1(sc, base, k->wk_key, 16);
 3153 #ifndef IEEE80211_STA_ONLY
 3154                 if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 3155                         RAL_WRITE_REGION_1(sc, base + 16, &k->wk_key[16], 8);
 3156                         RAL_WRITE_REGION_1(sc, base + 24, &k->wk_key[24], 8);
 3157                 } else
 3158 #endif
 3159                 {
 3160                         RAL_WRITE_REGION_1(sc, base + 16, &k->wk_key[24], 8);
 3161                         RAL_WRITE_REGION_1(sc, base + 24, &k->wk_key[16], 8);
 3162                 }
 3163         } else
 3164                 RAL_WRITE_REGION_1(sc, base, k->wk_key, k->wk_keylen);
 3165 
 3166         if (!(k->wk_flags & IEEE80211_KEY_GROUP) ||
 3167             (k->wk_flags & IEEE80211_KEY_XMIT)) {
 3168                 /* set initial packet number in IV+EIV */
 3169                 if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_WEP) {
 3170                         uint32_t val = cprng_fast32();
 3171                         /* skip weak IVs from Fluhrer/Mantin/Shamir */
 3172                         if (val >= 0x03ff00 && (val & 0xf8ff00) == 0x00ff00)
 3173                                 val += 0x000100;
 3174                         iv[0] = val;
 3175                         iv[1] = val >> 8;
 3176                         iv[2] = val >> 16;
 3177                         iv[3] = k->wk_keyix << 6;
 3178                         iv[4] = iv[5] = iv[6] = iv[7] = 0;
 3179                 } else {
 3180                         if (k->wk_cipher->ic_cipher == IEEE80211_CIPHER_TKIP) {
 3181                                 iv[0] = k->wk_keytsc >> 8;
 3182                                 iv[1] = (iv[0] | 0x20) & 0x7f;
 3183                                 iv[2] = k->wk_keytsc;
 3184                         } else /* CCMP */ {
 3185                                 iv[0] = k->wk_keytsc;
 3186                                 iv[1] = k->wk_keytsc >> 8;
 3187                                 iv[2] = 0;
 3188                         }
 3189                         iv[3] = k->wk_keyix << 6 | IEEE80211_WEP_EXTIV;
 3190                         iv[4] = k->wk_keytsc >> 16;
 3191                         iv[5] = k->wk_keytsc >> 24;
 3192                         iv[6] = k->wk_keytsc >> 32;
 3193                         iv[7] = k->wk_keytsc >> 40;
 3194                 }
 3195                 RAL_WRITE_REGION_1(sc, RT2860_IVEIV(wcid), iv, 8);
 3196         }
 3197 
 3198         if (k->wk_flags & IEEE80211_KEY_GROUP) {
 3199                 /* install group key */
 3200                 attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
 3201                 attr &= ~(0xf << (k->wk_keyix * 4));
 3202                 attr |= mode << (k->wk_keyix * 4);
 3203                 RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
 3204         } else {
 3205                 /* install pairwise key */
 3206                 attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
 3207                 attr = (attr & ~0xf) | (mode << 1) | RT2860_RX_PKEY_EN;
 3208                 RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
 3209         }
 3210         DPRINTF(("%s: ok\n", __func__));
 3211         return 1;
 3212 }
 3213 
 3214 static int
 3215 rt2860_delete_key(struct ieee80211com *ic, const struct ieee80211_key *k)
 3216 {
 3217         struct rt2860_softc *sc = ic->ic_ifp->if_softc;
 3218         struct ieee80211_node *ni = ic->ic_bss;
 3219         uint32_t attr;
 3220         uint8_t wcid;
 3221 
 3222         if (k->wk_flags & IEEE80211_KEY_GROUP) {
 3223                 /* remove group key */
 3224                 attr = RAL_READ(sc, RT2860_SKEY_MODE_0_7);
 3225                 attr &= ~(0xf << (k->wk_keyix * 4));
 3226                 RAL_WRITE(sc, RT2860_SKEY_MODE_0_7, attr);
 3227 
 3228         } else {
 3229                 /* remove pairwise key */
 3230                 wcid = ((struct rt2860_node *)ni)->wcid;
 3231                 attr = RAL_READ(sc, RT2860_WCID_ATTR(wcid));
 3232                 attr &= ~0xf;
 3233                 RAL_WRITE(sc, RT2860_WCID_ATTR(wcid), attr);
 3234         }
 3235         return 1;
 3236 }
 3237 #endif
 3238 
 3239 static int8_t
 3240 rt2860_rssi2dbm(struct rt2860_softc *sc, uint8_t rssi, uint8_t rxchain)
 3241 {
 3242         struct ieee80211com *ic = &sc->sc_ic;
 3243         struct ieee80211_channel *c = ic->ic_curchan;
 3244         int delta;
 3245 
 3246         if (IEEE80211_IS_CHAN_5GHZ(c)) {
 3247                 u_int chan = ieee80211_chan2ieee(ic, c);
 3248                 delta = sc->rssi_5ghz[rxchain];
 3249 
 3250                 /* determine channel group */
 3251                 if (chan <= 64)
 3252                         delta -= sc->lna[1];
 3253                 else if (chan <= 128)
 3254                         delta -= sc->lna[2];
 3255                 else
 3256                         delta -= sc->lna[3];
 3257         } else
 3258                 delta = sc->rssi_2ghz[rxchain] - sc->lna[0];
 3259 
 3260         return -12 - delta - rssi;
 3261 }
 3262 
 3263 /*
 3264  * Add `delta' (signed) to each 4-bit sub-word of a 32-bit word.
 3265  * Used to adjust per-rate Tx power registers.
 3266  */
 3267 static __inline uint32_t
 3268 b4inc(uint32_t b32, int8_t delta)
 3269 {
 3270         int8_t i, b4;
 3271 
 3272         for (i = 0; i < 8; i++) {
 3273                 b4 = b32 & 0xf;
 3274                 b4 += delta;
 3275                 if (b4 < 0)
 3276                         b4 = 0;
 3277                 else if (b4 > 0xf)
 3278                         b4 = 0xf;
 3279                 b32 = b32 >> 4 | (uint32_t)b4 << 28;
 3280         }
 3281         return b32;
 3282 }
 3283 
 3284 static const char *
 3285 rt2860_get_rf(uint32_t rev)
 3286 {
 3287         switch (rev) {
 3288         case RT2860_RF_2820:    return "RT2820";
 3289         case RT2860_RF_2850:    return "RT2850";
 3290         case RT2860_RF_2720:    return "RT2720";
 3291         case RT2860_RF_2750:    return "RT2750";
 3292         case RT3070_RF_3020:    return "RT3020";
 3293         case RT3070_RF_2020:    return "RT2020";
 3294         case RT3070_RF_3021:    return "RT3021";
 3295         case RT3070_RF_3022:    return "RT3022";
 3296         case RT3070_RF_3052:    return "RT3052";
 3297         case RT3070_RF_3320:    return "RT3320";
 3298         case RT3070_RF_3053:    return "RT3053";
 3299         case RT5390_RF_5360:    return "RT5360";
 3300         case RT5390_RF_5390:    return "RT5390";
 3301         case RT5390_RF_5392:    return "RT5392";
 3302         default:                return "unknown";
 3303         }
 3304 }
 3305 
 3306 static int
 3307 rt2860_read_eeprom(struct rt2860_softc *sc)
 3308 {
 3309         struct ieee80211com *ic = &sc->sc_ic;
 3310         int8_t delta_2ghz, delta_5ghz;
 3311         uint32_t tmp;
 3312         uint16_t val;
 3313         int ridx, ant, i;
 3314 
 3315         /* check whether the ROM is eFUSE ROM or EEPROM */
 3316         sc->sc_srom_read = rt2860_eeprom_read_2;
 3317         if (sc->mac_ver >= 0x3071) {
 3318                 tmp = RAL_READ(sc, RT3070_EFUSE_CTRL);
 3319                 DPRINTF(("EFUSE_CTRL=0x%08x\n", tmp));
 3320                 if (tmp & RT3070_SEL_EFUSE)
 3321                         sc->sc_srom_read = rt3090_efuse_read_2;
 3322         }
 3323 
 3324 #ifdef RAL_DEBUG
 3325         /* read EEPROM version */
 3326         val = rt2860_srom_read(sc, RT2860_EEPROM_VERSION);
 3327         DPRINTF(("EEPROM rev=%d, FAE=%d\n", val & 0xff, val >> 8));
 3328 #endif
 3329 
 3330         /* read MAC address */
 3331         val = rt2860_srom_read(sc, RT2860_EEPROM_MAC01);
 3332         ic->ic_myaddr[0] = val & 0xff;
 3333         ic->ic_myaddr[1] = val >> 8;
 3334         val = rt2860_srom_read(sc, RT2860_EEPROM_MAC23);
 3335         ic->ic_myaddr[2] = val & 0xff;
 3336         ic->ic_myaddr[3] = val >> 8;
 3337         val = rt2860_srom_read(sc, RT2860_EEPROM_MAC45);
 3338         ic->ic_myaddr[4] = val & 0xff;
 3339         ic->ic_myaddr[5] = val >> 8;
 3340 
 3341 #ifdef RAL_DEBUG
 3342         /* read country code */
 3343         val = rt2860_srom_read(sc, RT2860_EEPROM_COUNTRY);
 3344         DPRINTF(("EEPROM region code=0x%04x\n", val));
 3345 #endif
 3346 
 3347         /* read vendor BBP settings */
 3348         for (i = 0; i < 8; i++) {
 3349                 val = rt2860_srom_read(sc, RT2860_EEPROM_BBP_BASE + i);
 3350                 sc->bbp[i].val = val & 0xff;
 3351                 sc->bbp[i].reg = val >> 8;
 3352                 DPRINTF(("BBP%d=0x%02x\n", sc->bbp[i].reg, sc->bbp[i].val));
 3353         }
 3354         if (sc->mac_ver >= 0x3071) {
 3355                 /* read vendor RF settings */
 3356                 for (i = 0; i < 10; i++) {
 3357                         val = rt2860_srom_read(sc, RT3071_EEPROM_RF_BASE + i);
 3358                         sc->rf[i].val = val & 0xff;
 3359                         sc->rf[i].reg = val >> 8;
 3360                         DPRINTF(("RF%d=0x%02x\n", sc->rf[i].reg,
 3361                             sc->rf[i].val));
 3362                 }
 3363         }
 3364 
 3365         /* read RF frequency offset from EEPROM */
 3366         val = rt2860_srom_read(sc, RT2860_EEPROM_FREQ_LEDS);
 3367         sc->freq = ((val & 0xff) != 0xff) ? val & 0xff : 0;
 3368         DPRINTF(("EEPROM freq offset %d\n", sc->freq & 0xff));
 3369         if ((val >> 8) != 0xff) {
 3370                 /* read LEDs operating mode */
 3371                 sc->leds = val >> 8;
 3372                 sc->led[0] = rt2860_srom_read(sc, RT2860_EEPROM_LED1);
 3373                 sc->led[1] = rt2860_srom_read(sc, RT2860_EEPROM_LED2);
 3374                 sc->led[2] = rt2860_srom_read(sc, RT2860_EEPROM_LED3);
 3375         } else {
 3376                 /* broken EEPROM, use default settings */
 3377                 sc->leds = 0x01;
 3378                 sc->led[0] = 0x5555;
 3379                 sc->led[1] = 0x2221;
 3380                 sc->led[2] = 0xa9f8;
 3381         }
 3382         DPRINTF(("EEPROM LED mode=0x%02x, LEDs=0x%04x/0x%04x/0x%04x\n",
 3383             sc->leds, sc->led[0], sc->led[1], sc->led[2]));
 3384 
 3385         /* read RF information */
 3386         val = rt2860_srom_read(sc, RT2860_EEPROM_ANTENNA);
 3387         if (sc->mac_ver >= 0x5390)
 3388                 sc->rf_rev = rt2860_srom_read(sc, RT2860_EEPROM_CHIPID);
 3389         else
 3390                 sc->rf_rev = (val >> 8) & 0xf;
 3391         sc->ntxchains = (val >> 4) & 0xf;
 3392         sc->nrxchains = val & 0xf;
 3393         DPRINTF(("EEPROM RF rev=0x%02x chains=%dT%dR\n",
 3394             sc->rf_rev, sc->ntxchains, sc->nrxchains));
 3395 
 3396         /* check if RF supports automatic Tx access gain control */
 3397         val = rt2860_srom_read(sc, RT2860_EEPROM_CONFIG);
 3398         DPRINTF(("EEPROM CFG 0x%04x\n", val));
 3399         /* check if driver should patch the DAC issue */
 3400         if ((val >> 8) != 0xff)
 3401                 sc->patch_dac = (val >> 15) & 1;
 3402         if ((val & 0xff) != 0xff) {
 3403                 sc->ext_5ghz_lna = (val >> 3) & 1;
 3404                 sc->ext_2ghz_lna = (val >> 2) & 1;
 3405                 /* check if RF supports automatic Tx access gain control */
 3406                 sc->calib_2ghz = sc->calib_5ghz = 0; /* XXX (val >> 1) & 1 */
 3407                 /* check if we have a hardware radio switch */
 3408                 sc->rfswitch = val & 1;
 3409         }
 3410         if (sc->sc_flags & RT2860_ADVANCED_PS) {
 3411                 /* read PCIe power save level */
 3412                 val = rt2860_srom_read(sc, RT2860_EEPROM_PCIE_PSLEVEL);
 3413                 if ((val & 0xff) != 0xff) {
 3414                         sc->pslevel = val & 0x3;
 3415                         val = rt2860_srom_read(sc, RT2860_EEPROM_REV);
 3416                         if ((val & 0xff80) != 0x9280)
 3417                                 sc->pslevel = MIN(sc->pslevel, 1);
 3418                         DPRINTF(("EEPROM PCIe PS Level=%d\n", sc->pslevel));
 3419                 }
 3420         }
 3421 
 3422         /* read power settings for 2GHz channels */
 3423         for (i = 0; i < 14; i += 2) {
 3424                 val = rt2860_srom_read(sc,
 3425                     RT2860_EEPROM_PWR2GHZ_BASE1 + i / 2);
 3426                 sc->txpow1[i + 0] = (int8_t)(val & 0xff);
 3427                 sc->txpow1[i + 1] = (int8_t)(val >> 8);
 3428 
 3429                 if (sc->mac_ver != 0x5390) {
 3430                         val = rt2860_srom_read(sc,
 3431                             RT2860_EEPROM_PWR2GHZ_BASE2 + i / 2);
 3432                         sc->txpow2[i + 0] = (int8_t)(val & 0xff);
 3433                         sc->txpow2[i + 1] = (int8_t)(val >> 8);
 3434                 }
 3435             }
 3436         /* fix broken Tx power entries */
 3437         for (i = 0; i < 14; i++) {
 3438                 if (sc->txpow1[i] < 0 ||
 3439                     sc->txpow1[i] > ((sc->mac_ver >= 0x5390) ? 39 : 31))
 3440                         sc->txpow1[i] = 5;
 3441                 if (sc->mac_ver != 0x5390) {
 3442                         if (sc->txpow2[i] < 0 || 
 3443                             sc->txpow2[i] > ((sc->mac_ver >= 0x5392) ? 39 : 31))
 3444                                 sc->txpow2[i] = 5;
 3445                 }
 3446                 DPRINTF(("chan %d: power1=%d, power2=%d\n",
 3447                     rt2860_rf2850[i].chan, sc->txpow1[i], sc->txpow2[i]));
 3448         }
 3449         /* read power settings for 5GHz channels */
 3450         for (i = 0; i < 40; i += 2) {
 3451                 val = rt2860_srom_read(sc,
 3452                     RT2860_EEPROM_PWR5GHZ_BASE1 + i / 2);
 3453                 sc->txpow1[i + 14] = (int8_t)(val & 0xff);
 3454                 sc->txpow1[i + 15] = (int8_t)(val >> 8);
 3455 
 3456                 val = rt2860_srom_read(sc,
 3457                     RT2860_EEPROM_PWR5GHZ_BASE2 + i / 2);
 3458                 sc->txpow2[i + 14] = (int8_t)(val & 0xff);
 3459                 sc->txpow2[i + 15] = (int8_t)(val >> 8);
 3460         }
 3461         /* fix broken Tx power entries */
 3462         for (i = 0; i < 40; i++) {
 3463                 if (sc->txpow1[14 + i] < -7 || sc->txpow1[14 + i] > 15)
 3464                         sc->txpow1[14 + i] = 5;
 3465                 if (sc->txpow2[14 + i] < -7 || sc->txpow2[14 + i] > 15)
 3466                         sc->txpow2[14 + i] = 5;
 3467                 DPRINTF(("chan %d: power1=%d, power2=%d\n",
 3468                     rt2860_rf2850[14 + i].chan, sc->txpow1[14 + i],
 3469                     sc->txpow2[14 + i]));
 3470         }
 3471 
 3472         /* read Tx power compensation for each Tx rate */
 3473         val = rt2860_srom_read(sc, RT2860_EEPROM_DELTAPWR);
 3474         delta_2ghz = delta_5ghz = 0;
 3475         if ((val & 0xff) != 0xff && (val & 0x80)) {
 3476                 delta_2ghz = val & 0xf;
 3477                 if (!(val & 0x40))      /* negative number */
 3478                         delta_2ghz = -delta_2ghz;
 3479         }
 3480         val >>= 8;
 3481         if ((val & 0xff) != 0xff && (val & 0x80)) {
 3482                 delta_5ghz = val & 0xf;
 3483                 if (!(val & 0x40))      /* negative number */
 3484                         delta_5ghz = -delta_5ghz;
 3485         }
 3486         DPRINTF(("power compensation=%d (2GHz), %d (5GHz)\n",
 3487             delta_2ghz, delta_5ghz));
 3488 
 3489         for (ridx = 0; ridx < 5; ridx++) {
 3490                 uint32_t reg;
 3491 
 3492                 val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2);
 3493                 reg = val;
 3494                 val = rt2860_srom_read(sc, RT2860_EEPROM_RPWR + ridx * 2 + 1);
 3495                 reg |= (uint32_t)val << 16;
 3496 
 3497                 sc->txpow20mhz[ridx] = reg;
 3498                 sc->txpow40mhz_2ghz[ridx] = b4inc(reg, delta_2ghz);
 3499                 sc->txpow40mhz_5ghz[ridx] = b4inc(reg, delta_5ghz);
 3500 
 3501                 DPRINTF(("ridx %d: power 20MHz=0x%08x, 40MHz/2GHz=0x%08x, "
 3502                     "40MHz/5GHz=0x%08x\n", ridx, sc->txpow20mhz[ridx],
 3503                     sc->txpow40mhz_2ghz[ridx], sc->txpow40mhz_5ghz[ridx]));
 3504         }
 3505 
 3506         /* read factory-calibrated samples for temperature compensation */
 3507         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_2GHZ);
 3508         sc->tssi_2ghz[0] = val & 0xff;  /* [-4] */
 3509         sc->tssi_2ghz[1] = val >> 8;    /* [-3] */
 3510         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_2GHZ);
 3511         sc->tssi_2ghz[2] = val & 0xff;  /* [-2] */
 3512         sc->tssi_2ghz[3] = val >> 8;    /* [-1] */
 3513         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_2GHZ);
 3514         sc->tssi_2ghz[4] = val & 0xff;  /* [+0] */
 3515         sc->tssi_2ghz[5] = val >> 8;    /* [+1] */
 3516         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_2GHZ);
 3517         sc->tssi_2ghz[6] = val & 0xff;  /* [+2] */
 3518         sc->tssi_2ghz[7] = val >> 8;    /* [+3] */
 3519         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_2GHZ);
 3520         sc->tssi_2ghz[8] = val & 0xff;  /* [+4] */
 3521         sc->step_2ghz = val >> 8;
 3522         DPRINTF(("TSSI 2GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
 3523             "0x%02x 0x%02x step=%d\n", sc->tssi_2ghz[0], sc->tssi_2ghz[1],
 3524             sc->tssi_2ghz[2], sc->tssi_2ghz[3], sc->tssi_2ghz[4],
 3525             sc->tssi_2ghz[5], sc->tssi_2ghz[6], sc->tssi_2ghz[7],
 3526             sc->tssi_2ghz[8], sc->step_2ghz));
 3527         /* check that ref value is correct, otherwise disable calibration */
 3528         if (sc->tssi_2ghz[4] == 0xff)
 3529                 sc->calib_2ghz = 0;
 3530 
 3531         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI1_5GHZ);
 3532         sc->tssi_5ghz[0] = val & 0xff;  /* [-4] */
 3533         sc->tssi_5ghz[1] = val >> 8;    /* [-3] */
 3534         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI2_5GHZ);
 3535         sc->tssi_5ghz[2] = val & 0xff;  /* [-2] */
 3536         sc->tssi_5ghz[3] = val >> 8;    /* [-1] */
 3537         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI3_5GHZ);
 3538         sc->tssi_5ghz[4] = val & 0xff;  /* [+0] */
 3539         sc->tssi_5ghz[5] = val >> 8;    /* [+1] */
 3540         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI4_5GHZ);
 3541         sc->tssi_5ghz[6] = val & 0xff;  /* [+2] */
 3542         sc->tssi_5ghz[7] = val >> 8;    /* [+3] */
 3543         val = rt2860_srom_read(sc, RT2860_EEPROM_TSSI5_5GHZ);
 3544         sc->tssi_5ghz[8] = val & 0xff;  /* [+4] */
 3545         sc->step_5ghz = val >> 8;
 3546         DPRINTF(("TSSI 5GHz: 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x 0x%02x "
 3547             "0x%02x 0x%02x step=%d\n", sc->tssi_5ghz[0], sc->tssi_5ghz[1],
 3548             sc->tssi_5ghz[2], sc->tssi_5ghz[3], sc->tssi_5ghz[4],
 3549             sc->tssi_5ghz[5], sc->tssi_5ghz[6], sc->tssi_5ghz[7],
 3550             sc->tssi_5ghz[8], sc->step_5ghz));
 3551         /* check that ref value is correct, otherwise disable calibration */
 3552         if (sc->tssi_5ghz[4] == 0xff)
 3553                 sc->calib_5ghz = 0;
 3554 
 3555         /* read RSSI offsets and LNA gains from EEPROM */
 3556         val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_2GHZ);
 3557         sc->rssi_2ghz[0] = val & 0xff;  /* Ant A */
 3558         sc->rssi_2ghz[1] = val >> 8;    /* Ant B */
 3559         val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_2GHZ);
 3560         if (sc->mac_ver >= 0x3071) {
 3561                 /*
 3562                  * On RT3090 chips (limited to 2 Rx chains), this ROM
 3563                  * field contains the Tx mixer gain for the 2GHz band.
 3564                  */
 3565                 if ((val & 0xff) != 0xff)
 3566                         sc->txmixgain_2ghz = val & 0x7;
 3567                 DPRINTF(("tx mixer gain=%u (2GHz)\n", sc->txmixgain_2ghz));
 3568         } else
 3569                 sc->rssi_2ghz[2] = val & 0xff;  /* Ant C */
 3570         sc->lna[2] = val >> 8;          /* channel group 2 */
 3571 
 3572         val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI1_5GHZ);
 3573         sc->rssi_5ghz[0] = val & 0xff;  /* Ant A */
 3574         sc->rssi_5ghz[1] = val >> 8;    /* Ant B */
 3575         val = rt2860_srom_read(sc, RT2860_EEPROM_RSSI2_5GHZ);
 3576         sc->rssi_5ghz[2] = val & 0xff;  /* Ant C */
 3577         sc->lna[3] = val >> 8;          /* channel group 3 */
 3578 
 3579         val = rt2860_srom_read(sc, RT2860_EEPROM_LNA);
 3580         if (sc->mac_ver >= 0x3071)
 3581                 sc->lna[0] = RT3090_DEF_LNA;
 3582         else                            /* channel group 0 */
 3583                 sc->lna[0] = val & 0xff;
 3584         sc->lna[1] = val >> 8;          /* channel group 1 */
 3585 
 3586         /* fix broken 5GHz LNA entries */
 3587         if (sc->lna[2] == 0 || sc->lna[2] == 0xff) {
 3588                 DPRINTF(("invalid LNA for channel group %d\n", 2));
 3589                 sc->lna[2] = sc->lna[1];
 3590         }
 3591         if (sc->lna[3] == 0 || sc->lna[3] == 0xff) {
 3592                 DPRINTF(("invalid LNA for channel group %d\n", 3));
 3593                 sc->lna[3] = sc->lna[1];
 3594         }
 3595 
 3596         /* fix broken RSSI offset entries */
 3597         for (ant = 0; ant < 3; ant++) {
 3598                 if (sc->rssi_2ghz[ant] < -10 || sc->rssi_2ghz[ant] > 10) {
 3599                         DPRINTF(("invalid RSSI%d offset: %d (2GHz)\n",
 3600                             ant + 1, sc->rssi_2ghz[ant]));
 3601                         sc->rssi_2ghz[ant] = 0;
 3602                 }
 3603                 if (sc->rssi_5ghz[ant] < -10 || sc->rssi_5ghz[ant] > 10) {
 3604                         DPRINTF(("invalid RSSI%d offset: %d (5GHz)\n",
 3605                             ant + 1, sc->rssi_5ghz[ant]));
 3606                         sc->rssi_5ghz[ant] = 0;
 3607                 }
 3608         }
 3609 
 3610         return 0;
 3611 }
 3612 
 3613 static int
 3614 rt2860_bbp_init(struct rt2860_softc *sc)
 3615 {
 3616         int i, ntries;
 3617 
 3618         /* wait for BBP to wake up */
 3619         for (ntries = 0; ntries < 20; ntries++) {
 3620                 uint8_t bbp0 = rt2860_mcu_bbp_read(sc, 0);
 3621                 if (bbp0 != 0 && bbp0 != 0xff)
 3622                         break;
 3623         }
 3624         if (ntries == 20) {
 3625                 aprint_error_dev(sc->sc_dev,
 3626                     "timeout waiting for BBP to wake up\n");
 3627                 return ETIMEDOUT;
 3628         }
 3629 
 3630         /* initialize BBP registers to default values */
 3631         if (sc->mac_ver >= 0x5390)
 3632                 rt5390_bbp_init(sc);
 3633         else {
 3634                 for (i = 0; i < (int)__arraycount(rt2860_def_bbp); i++) {
 3635                         rt2860_mcu_bbp_write(sc, rt2860_def_bbp[i].reg,
 3636                             rt2860_def_bbp[i].val);
 3637                 }
 3638         }
 3639 
 3640         /* fix BBP84 for RT2860E */
 3641         if (sc->mac_ver == 0x2860 && sc->mac_rev != 0x0101)
 3642                 rt2860_mcu_bbp_write(sc, 84, 0x19);
 3643 
 3644         if (sc->mac_ver >= 0x3071) {
 3645                 rt2860_mcu_bbp_write(sc, 79, 0x13);
 3646                 rt2860_mcu_bbp_write(sc, 80, 0x05);
 3647                 rt2860_mcu_bbp_write(sc, 81, 0x33);
 3648         } else if (sc->mac_ver == 0x2860 && sc->mac_rev == 0x0100) {
 3649                 rt2860_mcu_bbp_write(sc, 69, 0x16);
 3650                 rt2860_mcu_bbp_write(sc, 73, 0x12);
 3651         }
 3652 
 3653         return 0;
 3654 }
 3655 
 3656 static int
 3657 rt5390_bbp_init(struct rt2860_softc *sc)
 3658 {
 3659         uint8_t bbp;
 3660         int i;
 3661 
 3662         /* Apply maximum likelihood detection for 2 stream case. */
 3663         if (sc->nrxchains > 1) {
 3664                 bbp = rt2860_mcu_bbp_read(sc, 105);
 3665                 rt2860_mcu_bbp_write(sc, 105, bbp | RT5390_MLD);
 3666         }
 3667 
 3668         /* Avoid data lost and CRC error. */
 3669         bbp = rt2860_mcu_bbp_read(sc, 4);
 3670         rt2860_mcu_bbp_write(sc, 4, bbp | RT5390_MAC_IF_CTRL);
 3671 
 3672         for (i = 0; i < __arraycount(rt5390_def_bbp); i++) {
 3673                 rt2860_mcu_bbp_write(sc, rt5390_def_bbp[i].reg,
 3674                     rt5390_def_bbp[i].val);
 3675         }
 3676 
 3677         if (sc->mac_ver == 0x5392) {
 3678                 rt2860_mcu_bbp_write(sc, 84, 0x9a);
 3679                 rt2860_mcu_bbp_write(sc, 95, 0x9a);
 3680                 rt2860_mcu_bbp_write(sc, 98, 0x12);
 3681                 rt2860_mcu_bbp_write(sc, 106, 0x05);
 3682                 rt2860_mcu_bbp_write(sc, 134, 0xd0);
 3683                 rt2860_mcu_bbp_write(sc, 135, 0xf6);
 3684         }
 3685 
 3686         bbp = rt2860_mcu_bbp_read(sc, 152);
 3687         rt2860_mcu_bbp_write(sc, 152, bbp | 0x80);
 3688 
 3689         /* Disable hardware antenna diversity. */
 3690         if (sc->mac_ver == 0x5390)
 3691                 rt2860_mcu_bbp_write(sc, 154, 0);
 3692 
 3693         return 0;
 3694 }
 3695 
 3696 static int
 3697 rt2860_txrx_enable(struct rt2860_softc *sc)
 3698 {
 3699         uint32_t tmp;
 3700         int ntries;
 3701 
 3702         /* enable Tx/Rx DMA engine */
 3703         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_MAC_TX_EN);
 3704         RAL_BARRIER_READ_WRITE(sc);
 3705         for (ntries = 0; ntries < 200; ntries++) {
 3706                 tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
 3707                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
 3708                         break;
 3709                 DELAY(1000);
 3710         }
 3711         if (ntries == 200) {
 3712                 aprint_error_dev(sc->sc_dev,
 3713                     "timeout waiting for DMA engine\n");
 3714                 return ETIMEDOUT;
 3715         }
 3716 
 3717         DELAY(50);
 3718 
 3719         tmp |= RT2860_RX_DMA_EN | RT2860_TX_DMA_EN |
 3720             RT2860_WPDMA_BT_SIZE64 << RT2860_WPDMA_BT_SIZE_SHIFT;
 3721         RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
 3722 
 3723         /* set Rx filter */
 3724         tmp = RT2860_DROP_CRC_ERR | RT2860_DROP_PHY_ERR;
 3725         if (sc->sc_ic.ic_opmode != IEEE80211_M_MONITOR) {
 3726                 tmp |= RT2860_DROP_UC_NOME | RT2860_DROP_DUPL |
 3727                     RT2860_DROP_CTS | RT2860_DROP_BA | RT2860_DROP_ACK |
 3728                     RT2860_DROP_VER_ERR | RT2860_DROP_CTRL_RSV |
 3729                     RT2860_DROP_CFACK | RT2860_DROP_CFEND;
 3730                 if (sc->sc_ic.ic_opmode == IEEE80211_M_STA)
 3731                         tmp |= RT2860_DROP_RTS | RT2860_DROP_PSPOLL;
 3732         }
 3733         RAL_WRITE(sc, RT2860_RX_FILTR_CFG, tmp);
 3734 
 3735         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL,
 3736             RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
 3737 
 3738         return 0;
 3739 }
 3740 
 3741 static int
 3742 rt2860_init(struct ifnet *ifp)
 3743 {
 3744         struct rt2860_softc *sc = ifp->if_softc;
 3745         struct ieee80211com *ic = &sc->sc_ic;
 3746         uint32_t tmp;
 3747         uint8_t bbp1, bbp3;
 3748         int i, qid, ridx, ntries, error;
 3749 
 3750         /* for CardBus, power on the socket */
 3751         if (!(sc->sc_flags & RT2860_ENABLED)) {
 3752                 if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
 3753                         aprint_error_dev(sc->sc_dev,
 3754                             "could not enable device\n");
 3755                         return EIO;
 3756                 }
 3757                 sc->sc_flags |= RT2860_ENABLED;
 3758         }
 3759 
 3760         if (sc->rfswitch) {
 3761                 /* hardware has a radio switch on GPIO pin 2 */
 3762                 if (!(RAL_READ(sc, RT2860_GPIO_CTRL) & (1 << 2))) {
 3763                         aprint_normal_dev(sc->sc_dev,
 3764                             "radio is disabled by hardware switch\n");
 3765 #ifdef notyet
 3766                         rt2860_stop(ifp, 1);
 3767                         return EPERM;
 3768 #endif
 3769                 }
 3770         }
 3771         RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE);
 3772 
 3773         /* disable DMA */
 3774         tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
 3775         tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
 3776             RT2860_TX_DMA_EN);
 3777         tmp |= RT2860_TX_WB_DDONE;
 3778         RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
 3779 
 3780         /* reset DMA indexes */
 3781         RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, RT2860_RST_DRX_IDX0 |
 3782             RT2860_RST_DTX_IDX5 | RT2860_RST_DTX_IDX4 | RT2860_RST_DTX_IDX3 |
 3783             RT2860_RST_DTX_IDX2 | RT2860_RST_DTX_IDX1 | RT2860_RST_DTX_IDX0);
 3784 
 3785         /* PBF hardware reset */
 3786         RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
 3787         RAL_BARRIER_WRITE(sc);
 3788         RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
 3789 
 3790         if ((error = rt2860_load_microcode(sc)) != 0) {
 3791                 aprint_error_dev(sc->sc_dev,
 3792                     "could not load 8051 microcode\n");
 3793                 rt2860_stop(ifp, 1);
 3794                 return error;
 3795         }
 3796 
 3797         IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
 3798         rt2860_set_macaddr(sc, ic->ic_myaddr);
 3799 
 3800         /* init Tx power for all Tx rates (from EEPROM) */
 3801         for (ridx = 0; ridx < 5; ridx++) {
 3802                 if (sc->txpow20mhz[ridx] == 0xffffffff)
 3803                         continue;
 3804                 RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx), sc->txpow20mhz[ridx]);
 3805         }
 3806 
 3807         for (ntries = 0; ntries < 100; ntries++) {
 3808                 tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
 3809                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
 3810                         break;
 3811                 DELAY(1000);
 3812         }
 3813         if (ntries == 100) {
 3814                 aprint_error_dev(sc->sc_dev,
 3815                     "timeout waiting for DMA engine\n");
 3816                 rt2860_stop(ifp, 1);
 3817                 return ETIMEDOUT;
 3818         }
 3819         tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
 3820             RT2860_TX_DMA_EN);
 3821         tmp |= RT2860_TX_WB_DDONE;
 3822         RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
 3823 
 3824         /* reset Rx ring and all 6 Tx rings */
 3825         RAL_WRITE(sc, RT2860_WPDMA_RST_IDX, 0x1003f);
 3826 
 3827         /* PBF hardware reset */
 3828         RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe1f);
 3829         RAL_BARRIER_WRITE(sc);
 3830         RAL_WRITE(sc, RT2860_SYS_CTRL, 0xe00);
 3831 
 3832         RAL_WRITE(sc, RT2860_PWR_PIN_CFG, RT2860_IO_RA_PE | RT2860_IO_RF_PE);
 3833 
 3834         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
 3835         RAL_BARRIER_WRITE(sc);
 3836         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
 3837 
 3838         for (i = 0; i < (int)__arraycount(rt2860_def_mac); i++)
 3839                 RAL_WRITE(sc, rt2860_def_mac[i].reg, rt2860_def_mac[i].val);
 3840         if (sc->mac_ver >= 0x5390)
 3841                 RAL_WRITE(sc, RT2860_TX_SW_CFG0, 0x00000404);
 3842         else if (sc->mac_ver >= 0x3071) {
 3843                 /* set delay of PA_PE assertion to 1us (unit of 0.25us) */
 3844                 RAL_WRITE(sc, RT2860_TX_SW_CFG0,
 3845                     4 << RT2860_DLY_PAPE_EN_SHIFT);
 3846         }
 3847 
 3848         if (!(RAL_READ(sc, RT2860_PCI_CFG) & RT2860_PCI_CFG_PCI)) {
 3849                 sc->sc_flags |= RT2860_PCIE;
 3850                 /* PCIe has different clock cycle count than PCI */
 3851                 tmp = RAL_READ(sc, RT2860_US_CYC_CNT);
 3852                 tmp = (tmp & ~0xff) | 0x7d;
 3853                 RAL_WRITE(sc, RT2860_US_CYC_CNT, tmp);
 3854         }
 3855 
 3856         /* wait while MAC is busy */
 3857         for (ntries = 0; ntries < 100; ntries++) {
 3858                 if (!(RAL_READ(sc, RT2860_MAC_STATUS_REG) &
 3859                     (RT2860_RX_STATUS_BUSY | RT2860_TX_STATUS_BUSY)))
 3860                         break;
 3861                 DELAY(1000);
 3862         }
 3863         if (ntries == 100) {
 3864                 aprint_error_dev(sc->sc_dev, "timeout waiting for MAC\n");
 3865                 rt2860_stop(ifp, 1);
 3866                 return ETIMEDOUT;
 3867         }
 3868 
 3869         /* clear Host to MCU mailbox */
 3870         RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
 3871         RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
 3872 
 3873         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
 3874         DELAY(1000);
 3875 
 3876         if ((error = rt2860_bbp_init(sc)) != 0) {
 3877                 rt2860_stop(ifp, 1);
 3878                 return error;
 3879         }
 3880 
 3881         /* clear RX WCID search table */
 3882         RAL_SET_REGION_4(sc, RT2860_WCID_ENTRY(0), 0, 512);
 3883         /* clear pairwise key table */
 3884         RAL_SET_REGION_4(sc, RT2860_PKEY(0), 0, 2048);
 3885         /* clear IV/EIV table */
 3886         RAL_SET_REGION_4(sc, RT2860_IVEIV(0), 0, 512);
 3887         /* clear WCID attribute table */
 3888         RAL_SET_REGION_4(sc, RT2860_WCID_ATTR(0), 0, 256);
 3889         /* clear shared key table */
 3890         RAL_SET_REGION_4(sc, RT2860_SKEY(0, 0), 0, 8 * 32);
 3891         /* clear shared key mode */
 3892         RAL_SET_REGION_4(sc, RT2860_SKEY_MODE_0_7, 0, 4);
 3893 
 3894         /* init Tx rings (4 EDCAs + HCCA + Mgt) */
 3895         for (qid = 0; qid < MAXQS; qid++) {
 3896                 RAL_WRITE(sc, RT2860_TX_BASE_PTR(qid), sc->txq[qid].paddr);
 3897                 RAL_WRITE(sc, RT2860_TX_MAX_CNT(qid), RT2860_TX_RING_COUNT);
 3898                 RAL_WRITE(sc, RT2860_TX_CTX_IDX(qid), 0);
 3899         }
 3900 
 3901         /* init Rx ring */
 3902         RAL_WRITE(sc, RT2860_RX_BASE_PTR, sc->rxq.paddr);
 3903         RAL_WRITE(sc, RT2860_RX_MAX_CNT, RT2860_RX_RING_COUNT);
 3904         RAL_WRITE(sc, RT2860_RX_CALC_IDX, RT2860_RX_RING_COUNT - 1);
 3905 
 3906         /* setup maximum buffer sizes */
 3907         RAL_WRITE(sc, RT2860_MAX_LEN_CFG, 1 << 12 |
 3908             (MCLBYTES - sizeof (struct rt2860_rxwi) - 2));
 3909 
 3910         for (ntries = 0; ntries < 100; ntries++) {
 3911                 tmp = RAL_READ(sc, RT2860_WPDMA_GLO_CFG);
 3912                 if ((tmp & (RT2860_TX_DMA_BUSY | RT2860_RX_DMA_BUSY)) == 0)
 3913                         break;
 3914                 DELAY(1000);
 3915         }
 3916         if (ntries == 100) {
 3917                 aprint_error_dev(sc->sc_dev,
 3918                     "timeout waiting for DMA engine\n");
 3919                 rt2860_stop(ifp, 1);
 3920                 return ETIMEDOUT;
 3921         }
 3922         tmp &= ~(RT2860_RX_DMA_BUSY | RT2860_RX_DMA_EN | RT2860_TX_DMA_BUSY |
 3923             RT2860_TX_DMA_EN);
 3924         tmp |= RT2860_TX_WB_DDONE;
 3925         RAL_WRITE(sc, RT2860_WPDMA_GLO_CFG, tmp);
 3926 
 3927         /* disable interrupts mitigation */
 3928         RAL_WRITE(sc, RT2860_DELAY_INT_CFG, 0);
 3929 
 3930         /* write vendor-specific BBP values (from EEPROM) */
 3931         for (i = 0; i < 8; i++) {
 3932                 if (sc->bbp[i].reg == 0 || sc->bbp[i].reg == 0xff)
 3933                         continue;
 3934                 rt2860_mcu_bbp_write(sc, sc->bbp[i].reg, sc->bbp[i].val);
 3935         }
 3936 
 3937         /* select Main antenna for 1T1R devices */
 3938         if (sc->rf_rev == RT3070_RF_2020 ||
 3939             sc->rf_rev == RT3070_RF_3020 ||
 3940             sc->rf_rev == RT3070_RF_3320 ||
 3941             sc->rf_rev == RT5390_RF_5390)
 3942                 rt3090_set_rx_antenna(sc, 0);
 3943 
 3944         /* send LEDs operating mode to microcontroller */
 3945         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED1, sc->led[0], 0);
 3946         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED2, sc->led[1], 0);
 3947         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_LED3, sc->led[2], 0);
 3948 
 3949         if (sc->mac_ver >= 0x5390)
 3950                 rt5390_rf_init(sc);
 3951         else if (sc->mac_ver >= 0x3071)
 3952                 rt3090_rf_init(sc);
 3953 
 3954         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_SLEEP, 0x02ff, 1);
 3955         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_WAKEUP, 0, 1);
 3956 
 3957         if (sc->mac_ver >= 0x5390)
 3958                 rt5390_rf_wakeup(sc);
 3959         else if (sc->mac_ver >= 0x3071)
 3960                 rt3090_rf_wakeup(sc);
 3961 
 3962         /* disable non-existing Rx chains */
 3963         bbp3 = rt2860_mcu_bbp_read(sc, 3);
 3964         bbp3 &= ~(1 << 3 | 1 << 4);
 3965         if (sc->nrxchains == 2)
 3966                 bbp3 |= 1 << 3;
 3967         else if (sc->nrxchains == 3)
 3968                 bbp3 |= 1 << 4;
 3969         rt2860_mcu_bbp_write(sc, 3, bbp3);
 3970 
 3971         /* disable non-existing Tx chains */
 3972         bbp1 = rt2860_mcu_bbp_read(sc, 1);
 3973         if (sc->ntxchains == 1)
 3974                 bbp1 = (bbp1 & ~(1 << 3 | 1 << 4));
 3975         else if (sc->mac_ver == 0x3593 && sc->ntxchains == 2)
 3976                 bbp1 = (bbp1 & ~(1 << 4)) | 1 << 3;
 3977         else if (sc->mac_ver == 0x3593 && sc->ntxchains == 3)
 3978                 bbp1 = (bbp1 & ~(1 << 3)) | 1 << 4;
 3979         rt2860_mcu_bbp_write(sc, 1, bbp1);
 3980 
 3981         if (sc->mac_ver >= 0x3071)
 3982                 rt3090_rf_setup(sc);
 3983 
 3984         /* select default channel */
 3985         ic->ic_bss->ni_chan = ic->ic_ibss_chan;
 3986         rt2860_switch_chan(sc, ic->ic_ibss_chan);
 3987 
 3988         /* reset RF from MCU */
 3989         rt2860_mcu_cmd(sc, RT2860_MCU_CMD_RFRESET, 0, 0);
 3990 
 3991         /* set RTS threshold */
 3992         tmp = RAL_READ(sc, RT2860_TX_RTS_CFG);
 3993         tmp &= ~0xffff00;
 3994         tmp |= ic->ic_rtsthreshold << 8;
 3995         RAL_WRITE(sc, RT2860_TX_RTS_CFG, tmp);
 3996 
 3997         /* setup initial protection mode */
 3998         sc->sc_ic_flags = ic->ic_flags;
 3999         rt2860_updateprot(ic);
 4000 
 4001         /* turn radio LED on */
 4002         rt2860_set_leds(sc, RT2860_LED_RADIO);
 4003 
 4004         /* enable Tx/Rx DMA engine */
 4005         if ((error = rt2860_txrx_enable(sc)) != 0) {
 4006                 rt2860_stop(ifp, 1);
 4007                 return error;
 4008         }
 4009 
 4010         /* clear pending interrupts */
 4011         RAL_WRITE(sc, RT2860_INT_STATUS, 0xffffffff);
 4012         /* enable interrupts */
 4013         RAL_WRITE(sc, RT2860_INT_MASK, 0x3fffc);
 4014 
 4015         if (sc->sc_flags & RT2860_ADVANCED_PS)
 4016                 rt2860_mcu_cmd(sc, RT2860_MCU_CMD_PSLEVEL, sc->pslevel, 0);
 4017 
 4018         ifp->if_flags |= IFF_RUNNING;
 4019         ifp->if_flags &= ~IFF_OACTIVE;
 4020 
 4021         if (ic->ic_opmode != IEEE80211_M_MONITOR)
 4022                 ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 4023         else
 4024                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 4025 
 4026         return 0;
 4027 }
 4028 
 4029 static void
 4030 rt2860_stop(struct ifnet *ifp, int disable)
 4031 {
 4032         struct rt2860_softc *sc = ifp->if_softc;
 4033         struct ieee80211com *ic = &sc->sc_ic;
 4034         uint32_t tmp;
 4035         int qid;
 4036 
 4037         if (ifp->if_flags & IFF_RUNNING)
 4038                 rt2860_set_leds(sc, 0); /* turn all LEDs off */
 4039 
 4040         sc->sc_tx_timer = 0;
 4041         ifp->if_timer = 0;
 4042         ifp->if_flags &= ~IFF_RUNNING;
 4043         ifp->if_flags &= ~IFF_OACTIVE;
 4044 
 4045         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);  /* free all nodes */
 4046 
 4047         /* disable interrupts */
 4048         RAL_WRITE(sc, RT2860_INT_MASK, 0);
 4049 
 4050         /* disable GP timer */
 4051         rt2860_set_gp_timer(sc, 0);
 4052 
 4053         /* disable Rx */
 4054         tmp = RAL_READ(sc, RT2860_MAC_SYS_CTRL);
 4055         tmp &= ~(RT2860_MAC_RX_EN | RT2860_MAC_TX_EN);
 4056         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, tmp);
 4057 
 4058         /* reset adapter */
 4059         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, RT2860_BBP_HRST | RT2860_MAC_SRST);
 4060         RAL_BARRIER_WRITE(sc);
 4061         RAL_WRITE(sc, RT2860_MAC_SYS_CTRL, 0);
 4062 
 4063         /* reset Tx and Rx rings (and reclaim TXWIs) */
 4064         sc->qfullmsk = 0;
 4065         for (qid = 0; qid < MAXQS; qid++)
 4066                 rt2860_reset_tx_ring(sc, &sc->txq[qid]);
 4067         rt2860_reset_rx_ring(sc, &sc->rxq);
 4068 
 4069         /* for CardBus, power down the socket */
 4070         if (disable && sc->sc_disable != NULL) {
 4071                 if (sc->sc_flags & RT2860_ENABLED) {
 4072                         (*sc->sc_disable)(sc);
 4073                         sc->sc_flags &= ~RT2860_ENABLED;
 4074                 }
 4075         }
 4076 }
 4077 
 4078 static int
 4079 rt2860_load_microcode(struct rt2860_softc *sc)
 4080 {
 4081         int ntries;
 4082 
 4083         /* set "host program ram write selection" bit */
 4084         RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_HST_PM_SEL);
 4085         /* write microcode image */
 4086         RAL_WRITE_REGION_1(sc, RT2860_FW_BASE, sc->ucode, sc->ucsize);
 4087         /* kick microcontroller unit */
 4088         RAL_WRITE(sc, RT2860_SYS_CTRL, 0);
 4089         RAL_BARRIER_WRITE(sc);
 4090         RAL_WRITE(sc, RT2860_SYS_CTRL, RT2860_MCU_RESET);
 4091 
 4092         RAL_WRITE(sc, RT2860_H2M_BBPAGENT, 0);
 4093         RAL_WRITE(sc, RT2860_H2M_MAILBOX, 0);
 4094 
 4095         /* wait until microcontroller is ready */
 4096         RAL_BARRIER_READ_WRITE(sc);
 4097         for (ntries = 0; ntries < 1000; ntries++) {
 4098                 if (RAL_READ(sc, RT2860_SYS_CTRL) & RT2860_MCU_READY)
 4099                         break;
 4100                 DELAY(1000);
 4101         }
 4102         if (ntries == 1000) {
 4103                 aprint_error_dev(sc->sc_dev,
 4104                     "timeout waiting for MCU to initialize\n");
 4105                 return ETIMEDOUT;
 4106         }
 4107         return 0;
 4108 }
 4109 
 4110 #if 0
 4111 /*
 4112  * This function is called periodically to adjust Tx power based on
 4113  * temperature variation.
 4114  */
 4115 static void
 4116 rt2860_calib(struct rt2860_softc *sc)
 4117 {
 4118         struct ieee80211com *ic = &sc->sc_ic;
 4119         const uint8_t *tssi;
 4120         uint8_t step, bbp49;
 4121         int8_t ridx, d;
 4122 
 4123         /* read current temperature */
 4124         bbp49 = rt2860_mcu_bbp_read(sc, 49);
 4125 
 4126         if (IEEE80211_IS_CHAN_2GHZ(ic->ic_bss->ni_chan)) {
 4127                 tssi = &sc->tssi_2ghz[4];
 4128                 step = sc->step_2ghz;
 4129         } else {
 4130                 tssi = &sc->tssi_5ghz[4];
 4131                 step = sc->step_5ghz;
 4132         }
 4133 
 4134         if (bbp49 < tssi[0]) {          /* lower than reference */
 4135                 /* use higher Tx power than default */
 4136                 for (d = 0; d > -4 && bbp49 <= tssi[d - 1]; d--);
 4137         } else if (bbp49 > tssi[0]) {   /* greater than reference */
 4138                 /* use lower Tx power than default */
 4139                 for (d = 0; d < +4 && bbp49 >= tssi[d + 1]; d++);
 4140         } else {
 4141                 /* use default Tx power */
 4142                 d = 0;
 4143         }
 4144         d *= step;
 4145 
 4146         DPRINTF(("BBP49=0x%02x, adjusting Tx power by %d\n", bbp49, d));
 4147 
 4148         /* write adjusted Tx power values for each Tx rate */
 4149         for (ridx = 0; ridx < 5; ridx++) {
 4150                 if (sc->txpow20mhz[ridx] == 0xffffffff)
 4151                         continue;
 4152                 RAL_WRITE(sc, RT2860_TX_PWR_CFG(ridx),
 4153                     b4inc(sc->txpow20mhz[ridx], d));
 4154         }
 4155 }
 4156 #endif /* 0 */
 4157 
 4158 static void
 4159 rt3090_set_rx_antenna(struct rt2860_softc *sc, int aux)
 4160 {
 4161         uint32_t tmp;
 4162 
 4163         if (aux) {
 4164                 if (sc->mac_ver == 0x5390) {
 4165                         rt2860_mcu_bbp_write(sc, 152, 
 4166                             rt2860_mcu_bbp_read(sc, 152) & ~0x80);
 4167                 } else {
 4168                         tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
 4169                         RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp & ~RT2860_C);
 4170                         tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
 4171                         RAL_WRITE(sc, RT2860_GPIO_CTRL, (tmp & ~0x0808) | 0x08);
 4172                 }
 4173         } else {
 4174                 if (sc->mac_ver == 0x5390) {
 4175                         rt2860_mcu_bbp_write(sc, 152, 
 4176                             rt2860_mcu_bbp_read(sc, 152) | 0x80);
 4177                 } else {
 4178                         tmp = RAL_READ(sc, RT2860_PCI_EECTRL);
 4179                         RAL_WRITE(sc, RT2860_PCI_EECTRL, tmp | RT2860_C);
 4180                         tmp = RAL_READ(sc, RT2860_GPIO_CTRL);
 4181                         RAL_WRITE(sc, RT2860_GPIO_CTRL, tmp & ~0x0808);
 4182                 }
 4183         }
 4184 }
 4185 
 4186 static void
 4187 rt2860_switch_chan(struct rt2860_softc *sc, struct ieee80211_channel *c)
 4188 {
 4189         struct ieee80211com *ic = &sc->sc_ic;
 4190         u_int chan, group;
 4191 
 4192         chan = ieee80211_chan2ieee(ic, c);
 4193         DPRINTF(("switch channel %u\n", chan));
 4194         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
 4195                 return;
 4196 
 4197         if (sc->mac_ver >= 0x5390)
 4198                 rt5390_set_chan(sc, chan);
 4199         else if (sc->mac_ver >= 0x3071)
 4200                 rt3090_set_chan(sc, chan);
 4201         else
 4202                 rt2860_set_chan(sc, chan);
 4203 
 4204         /* determine channel group */
 4205         if (chan <= 14)
 4206                 group = 0;
 4207         else if (chan <= 64)
 4208                 group = 1;
 4209         else if (chan <= 128)
 4210                 group = 2;
 4211         else
 4212                 group = 3;
 4213 
 4214         /* XXX necessary only when group has changed! */
 4215         if (sc->mac_ver < 0x5390)
 4216                 rt2860_select_chan_group(sc, group);
 4217 
 4218         DELAY(1000);
 4219 }
 4220 
 4221 #ifndef IEEE80211_STA_ONLY
 4222 static int
 4223 rt2860_setup_beacon(struct rt2860_softc *sc)
 4224 {
 4225         struct ieee80211com *ic = &sc->sc_ic;
 4226         struct rt2860_txwi txwi;
 4227         struct mbuf *m;
 4228         int ridx;
 4229 
 4230         if ((m = ieee80211_beacon_alloc(ic, ic->ic_bss, &sc->sc_bo)) == NULL)
 4231                 return ENOBUFS;
 4232 
 4233         memset(&txwi, 0, sizeof txwi);
 4234         txwi.wcid = 0xff;
 4235         txwi.len = htole16(m->m_pkthdr.len);
 4236         /* send beacons at the lowest available rate */
 4237         ridx = (ic->ic_curmode == IEEE80211_MODE_11A) ?
 4238             RT2860_RIDX_OFDM6 : RT2860_RIDX_CCK1;
 4239         txwi.phy = htole16(rt2860_rates[ridx].mcs);
 4240         if (rt2860_rates[ridx].phy == IEEE80211_T_OFDM)
 4241                 txwi.phy |= htole16(RT2860_PHY_OFDM);
 4242         txwi.txop = RT2860_TX_TXOP_HT;
 4243         txwi.flags = RT2860_TX_TS;
 4244         txwi.xflags = RT2860_TX_NSEQ;
 4245 
 4246         RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0),
 4247             (uint8_t *)&txwi, sizeof txwi);
 4248         RAL_WRITE_REGION_1(sc, RT2860_BCN_BASE(0) + sizeof txwi,
 4249             mtod(m, uint8_t *), m->m_pkthdr.len);
 4250 
 4251         m_freem(m);
 4252 
 4253         return 0;
 4254 }
 4255 #endif
 4256 
 4257 static void
 4258 rt2860_enable_tsf_sync(struct rt2860_softc *sc)
 4259 {
 4260         struct ieee80211com *ic = &sc->sc_ic;
 4261         uint32_t tmp;
 4262 
 4263         tmp = RAL_READ(sc, RT2860_BCN_TIME_CFG);
 4264 
 4265         tmp &= ~0x1fffff;
 4266         tmp |= ic->ic_bss->ni_intval * 16;
 4267         tmp |= RT2860_TSF_TIMER_EN | RT2860_TBTT_TIMER_EN;
 4268         if (ic->ic_opmode == IEEE80211_M_STA) {
 4269                 /*
 4270                  * Local TSF is always updated with remote TSF on beacon
 4271                  * reception.
 4272                  */
 4273                 tmp |= 1 << RT2860_TSF_SYNC_MODE_SHIFT;
 4274         }
 4275 #ifndef IEEE80211_STA_ONLY
 4276         else if (ic->ic_opmode == IEEE80211_M_IBSS) {
 4277                 tmp |= RT2860_BCN_TX_EN;
 4278                 /*
 4279                  * Local TSF is updated with remote TSF on beacon reception
 4280                  * only if the remote TSF is greater than local TSF.
 4281                  */
 4282                 tmp |= 2 << RT2860_TSF_SYNC_MODE_SHIFT;
 4283         } else if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 4284                 tmp |= RT2860_BCN_TX_EN;
 4285                 /* SYNC with nobody */
 4286                 tmp |= 3 << RT2860_TSF_SYNC_MODE_SHIFT;
 4287         }
 4288 #endif
 4289 
 4290         RAL_WRITE(sc, RT2860_BCN_TIME_CFG, tmp);
 4291 }

Cache object: baa899cc173c1dcd537cbecb02467ee6


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.