1 /*
2 	Copyright (C) 2004 - 2009 Ivo van Doorn <IvDoorn@gmail.com>
3 	<http://rt2x00.serialmonkey.com>
4 
5 	This program is free software; you can redistribute it and/or modify
6 	it under the terms of the GNU General Public License as published by
7 	the Free Software Foundation; either version 2 of the License, or
8 	(at your option) any later version.
9 
10 	This program is distributed in the hope that it will be useful,
11 	but WITHOUT ANY WARRANTY; without even the implied warranty of
12 	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 	GNU General Public License for more details.
14 
15 	You should have received a copy of the GNU General Public License
16 	along with this program; if not, see <http://www.gnu.org/licenses/>.
17  */
18 
19 /*
20 	Module: rt61pci
21 	Abstract: rt61pci device specific routines.
22 	Supported chipsets: RT2561, RT2561s, RT2661.
23  */
24 
25 #include <linux/crc-itu-t.h>
26 #include <linux/delay.h>
27 #include <linux/etherdevice.h>
28 #include <linux/kernel.h>
29 #include <linux/module.h>
30 #include <linux/slab.h>
31 #include <linux/pci.h>
32 #include <linux/eeprom_93cx6.h>
33 
34 #include "rt2x00.h"
35 #include "rt2x00mmio.h"
36 #include "rt2x00pci.h"
37 #include "rt61pci.h"
38 
39 /*
40  * Allow hardware encryption to be disabled.
41  */
42 static bool modparam_nohwcrypt = false;
43 module_param_named(nohwcrypt, modparam_nohwcrypt, bool, 0444);
44 MODULE_PARM_DESC(nohwcrypt, "Disable hardware encryption.");
45 
46 /*
47  * Register access.
48  * BBP and RF register require indirect register access,
49  * and use the CSR registers PHY_CSR3 and PHY_CSR4 to achieve this.
50  * These indirect registers work with busy bits,
51  * and we will try maximal REGISTER_BUSY_COUNT times to access
52  * the register while taking a REGISTER_BUSY_DELAY us delay
53  * between each attempt. When the busy bit is still set at that time,
54  * the access attempt is considered to have failed,
55  * and we will print an error.
56  */
57 #define WAIT_FOR_BBP(__dev, __reg) \
58 	rt2x00mmio_regbusy_read((__dev), PHY_CSR3, PHY_CSR3_BUSY, (__reg))
59 #define WAIT_FOR_RF(__dev, __reg) \
60 	rt2x00mmio_regbusy_read((__dev), PHY_CSR4, PHY_CSR4_BUSY, (__reg))
61 #define WAIT_FOR_MCU(__dev, __reg) \
62 	rt2x00mmio_regbusy_read((__dev), H2M_MAILBOX_CSR, \
63 				H2M_MAILBOX_CSR_OWNER, (__reg))
64 
65 static void rt61pci_bbp_write(struct rt2x00_dev *rt2x00dev,
66 			      const unsigned int word, const u8 value)
67 {
68 	u32 reg;
69 
70 	mutex_lock(&rt2x00dev->csr_mutex);
71 
72 	/*
73 	 * Wait until the BBP becomes available, afterwards we
74 	 * can safely write the new data into the register.
75 	 */
76 	if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
77 		reg = 0;
78 		rt2x00_set_field32(&reg, PHY_CSR3_VALUE, value);
79 		rt2x00_set_field32(&reg, PHY_CSR3_REGNUM, word);
80 		rt2x00_set_field32(&reg, PHY_CSR3_BUSY, 1);
81 		rt2x00_set_field32(&reg, PHY_CSR3_READ_CONTROL, 0);
82 
83 		rt2x00mmio_register_write(rt2x00dev, PHY_CSR3, reg);
84 	}
85 
86 	mutex_unlock(&rt2x00dev->csr_mutex);
87 }
88 
89 static u8 rt61pci_bbp_read(struct rt2x00_dev *rt2x00dev,
90 			   const unsigned int word)
91 {
92 	u32 reg;
93 	u8 value;
94 
95 	mutex_lock(&rt2x00dev->csr_mutex);
96 
97 	/*
98 	 * Wait until the BBP becomes available, afterwards we
99 	 * can safely write the read request into the register.
100 	 * After the data has been written, we wait until hardware
101 	 * returns the correct value, if at any time the register
102 	 * doesn't become available in time, reg will be 0xffffffff
103 	 * which means we return 0xff to the caller.
104 	 */
105 	if (WAIT_FOR_BBP(rt2x00dev, &reg)) {
106 		reg = 0;
107 		rt2x00_set_field32(&reg, PHY_CSR3_REGNUM, word);
108 		rt2x00_set_field32(&reg, PHY_CSR3_BUSY, 1);
109 		rt2x00_set_field32(&reg, PHY_CSR3_READ_CONTROL, 1);
110 
111 		rt2x00mmio_register_write(rt2x00dev, PHY_CSR3, reg);
112 
113 		WAIT_FOR_BBP(rt2x00dev, &reg);
114 	}
115 
116 	value = rt2x00_get_field32(reg, PHY_CSR3_VALUE);
117 
118 	mutex_unlock(&rt2x00dev->csr_mutex);
119 
120 	return value;
121 }
122 
123 static void rt61pci_rf_write(struct rt2x00_dev *rt2x00dev,
124 			     const unsigned int word, const u32 value)
125 {
126 	u32 reg;
127 
128 	mutex_lock(&rt2x00dev->csr_mutex);
129 
130 	/*
131 	 * Wait until the RF becomes available, afterwards we
132 	 * can safely write the new data into the register.
133 	 */
134 	if (WAIT_FOR_RF(rt2x00dev, &reg)) {
135 		reg = 0;
136 		rt2x00_set_field32(&reg, PHY_CSR4_VALUE, value);
137 		rt2x00_set_field32(&reg, PHY_CSR4_NUMBER_OF_BITS, 21);
138 		rt2x00_set_field32(&reg, PHY_CSR4_IF_SELECT, 0);
139 		rt2x00_set_field32(&reg, PHY_CSR4_BUSY, 1);
140 
141 		rt2x00mmio_register_write(rt2x00dev, PHY_CSR4, reg);
142 		rt2x00_rf_write(rt2x00dev, word, value);
143 	}
144 
145 	mutex_unlock(&rt2x00dev->csr_mutex);
146 }
147 
148 static void rt61pci_mcu_request(struct rt2x00_dev *rt2x00dev,
149 				const u8 command, const u8 token,
150 				const u8 arg0, const u8 arg1)
151 {
152 	u32 reg;
153 
154 	mutex_lock(&rt2x00dev->csr_mutex);
155 
156 	/*
157 	 * Wait until the MCU becomes available, afterwards we
158 	 * can safely write the new data into the register.
159 	 */
160 	if (WAIT_FOR_MCU(rt2x00dev, &reg)) {
161 		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_OWNER, 1);
162 		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_CMD_TOKEN, token);
163 		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG0, arg0);
164 		rt2x00_set_field32(&reg, H2M_MAILBOX_CSR_ARG1, arg1);
165 		rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CSR, reg);
166 
167 		reg = rt2x00mmio_register_read(rt2x00dev, HOST_CMD_CSR);
168 		rt2x00_set_field32(&reg, HOST_CMD_CSR_HOST_COMMAND, command);
169 		rt2x00_set_field32(&reg, HOST_CMD_CSR_INTERRUPT_MCU, 1);
170 		rt2x00mmio_register_write(rt2x00dev, HOST_CMD_CSR, reg);
171 	}
172 
173 	mutex_unlock(&rt2x00dev->csr_mutex);
174 
175 }
176 
177 static void rt61pci_eepromregister_read(struct eeprom_93cx6 *eeprom)
178 {
179 	struct rt2x00_dev *rt2x00dev = eeprom->data;
180 	u32 reg;
181 
182 	reg = rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR);
183 
184 	eeprom->reg_data_in = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_IN);
185 	eeprom->reg_data_out = !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_OUT);
186 	eeprom->reg_data_clock =
187 	    !!rt2x00_get_field32(reg, E2PROM_CSR_DATA_CLOCK);
188 	eeprom->reg_chip_select =
189 	    !!rt2x00_get_field32(reg, E2PROM_CSR_CHIP_SELECT);
190 }
191 
192 static void rt61pci_eepromregister_write(struct eeprom_93cx6 *eeprom)
193 {
194 	struct rt2x00_dev *rt2x00dev = eeprom->data;
195 	u32 reg = 0;
196 
197 	rt2x00_set_field32(&reg, E2PROM_CSR_DATA_IN, !!eeprom->reg_data_in);
198 	rt2x00_set_field32(&reg, E2PROM_CSR_DATA_OUT, !!eeprom->reg_data_out);
199 	rt2x00_set_field32(&reg, E2PROM_CSR_DATA_CLOCK,
200 			   !!eeprom->reg_data_clock);
201 	rt2x00_set_field32(&reg, E2PROM_CSR_CHIP_SELECT,
202 			   !!eeprom->reg_chip_select);
203 
204 	rt2x00mmio_register_write(rt2x00dev, E2PROM_CSR, reg);
205 }
206 
207 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
208 static const struct rt2x00debug rt61pci_rt2x00debug = {
209 	.owner	= THIS_MODULE,
210 	.csr	= {
211 		.read		= rt2x00mmio_register_read,
212 		.write		= rt2x00mmio_register_write,
213 		.flags		= RT2X00DEBUGFS_OFFSET,
214 		.word_base	= CSR_REG_BASE,
215 		.word_size	= sizeof(u32),
216 		.word_count	= CSR_REG_SIZE / sizeof(u32),
217 	},
218 	.eeprom	= {
219 		.read		= rt2x00_eeprom_read,
220 		.write		= rt2x00_eeprom_write,
221 		.word_base	= EEPROM_BASE,
222 		.word_size	= sizeof(u16),
223 		.word_count	= EEPROM_SIZE / sizeof(u16),
224 	},
225 	.bbp	= {
226 		.read		= rt61pci_bbp_read,
227 		.write		= rt61pci_bbp_write,
228 		.word_base	= BBP_BASE,
229 		.word_size	= sizeof(u8),
230 		.word_count	= BBP_SIZE / sizeof(u8),
231 	},
232 	.rf	= {
233 		.read		= rt2x00_rf_read,
234 		.write		= rt61pci_rf_write,
235 		.word_base	= RF_BASE,
236 		.word_size	= sizeof(u32),
237 		.word_count	= RF_SIZE / sizeof(u32),
238 	},
239 };
240 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
241 
242 static int rt61pci_rfkill_poll(struct rt2x00_dev *rt2x00dev)
243 {
244 	u32 reg;
245 
246 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR13);
247 	return rt2x00_get_field32(reg, MAC_CSR13_VAL5);
248 }
249 
250 #ifdef CONFIG_RT2X00_LIB_LEDS
251 static void rt61pci_brightness_set(struct led_classdev *led_cdev,
252 				   enum led_brightness brightness)
253 {
254 	struct rt2x00_led *led =
255 	    container_of(led_cdev, struct rt2x00_led, led_dev);
256 	unsigned int enabled = brightness != LED_OFF;
257 	unsigned int a_mode =
258 	    (enabled && led->rt2x00dev->curr_band == NL80211_BAND_5GHZ);
259 	unsigned int bg_mode =
260 	    (enabled && led->rt2x00dev->curr_band == NL80211_BAND_2GHZ);
261 
262 	if (led->type == LED_TYPE_RADIO) {
263 		rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
264 				   MCU_LEDCS_RADIO_STATUS, enabled);
265 
266 		rt61pci_mcu_request(led->rt2x00dev, MCU_LED, 0xff,
267 				    (led->rt2x00dev->led_mcu_reg & 0xff),
268 				    ((led->rt2x00dev->led_mcu_reg >> 8)));
269 	} else if (led->type == LED_TYPE_ASSOC) {
270 		rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
271 				   MCU_LEDCS_LINK_BG_STATUS, bg_mode);
272 		rt2x00_set_field16(&led->rt2x00dev->led_mcu_reg,
273 				   MCU_LEDCS_LINK_A_STATUS, a_mode);
274 
275 		rt61pci_mcu_request(led->rt2x00dev, MCU_LED, 0xff,
276 				    (led->rt2x00dev->led_mcu_reg & 0xff),
277 				    ((led->rt2x00dev->led_mcu_reg >> 8)));
278 	} else if (led->type == LED_TYPE_QUALITY) {
279 		/*
280 		 * The brightness is divided into 6 levels (0 - 5),
281 		 * this means we need to convert the brightness
282 		 * argument into the matching level within that range.
283 		 */
284 		rt61pci_mcu_request(led->rt2x00dev, MCU_LED_STRENGTH, 0xff,
285 				    brightness / (LED_FULL / 6), 0);
286 	}
287 }
288 
289 static int rt61pci_blink_set(struct led_classdev *led_cdev,
290 			     unsigned long *delay_on,
291 			     unsigned long *delay_off)
292 {
293 	struct rt2x00_led *led =
294 	    container_of(led_cdev, struct rt2x00_led, led_dev);
295 	u32 reg;
296 
297 	reg = rt2x00mmio_register_read(led->rt2x00dev, MAC_CSR14);
298 	rt2x00_set_field32(&reg, MAC_CSR14_ON_PERIOD, *delay_on);
299 	rt2x00_set_field32(&reg, MAC_CSR14_OFF_PERIOD, *delay_off);
300 	rt2x00mmio_register_write(led->rt2x00dev, MAC_CSR14, reg);
301 
302 	return 0;
303 }
304 
305 static void rt61pci_init_led(struct rt2x00_dev *rt2x00dev,
306 			     struct rt2x00_led *led,
307 			     enum led_type type)
308 {
309 	led->rt2x00dev = rt2x00dev;
310 	led->type = type;
311 	led->led_dev.brightness_set = rt61pci_brightness_set;
312 	led->led_dev.blink_set = rt61pci_blink_set;
313 	led->flags = LED_INITIALIZED;
314 }
315 #endif /* CONFIG_RT2X00_LIB_LEDS */
316 
317 /*
318  * Configuration handlers.
319  */
320 static int rt61pci_config_shared_key(struct rt2x00_dev *rt2x00dev,
321 				     struct rt2x00lib_crypto *crypto,
322 				     struct ieee80211_key_conf *key)
323 {
324 	/*
325 	 * Let the software handle the shared keys,
326 	 * since the hardware decryption does not work reliably,
327 	 * because the firmware does not know the key's keyidx.
328 	 */
329 	return -EOPNOTSUPP;
330 }
331 
332 static int rt61pci_config_pairwise_key(struct rt2x00_dev *rt2x00dev,
333 				       struct rt2x00lib_crypto *crypto,
334 				       struct ieee80211_key_conf *key)
335 {
336 	struct hw_pairwise_ta_entry addr_entry;
337 	struct hw_key_entry key_entry;
338 	u32 mask;
339 	u32 reg;
340 
341 	if (crypto->cmd == SET_KEY) {
342 		/*
343 		 * rt2x00lib can't determine the correct free
344 		 * key_idx for pairwise keys. We have 2 registers
345 		 * with key valid bits. The goal is simple: read
346 		 * the first register. If that is full, move to
347 		 * the next register.
348 		 * When both registers are full, we drop the key.
349 		 * Otherwise, we use the first invalid entry.
350 		 */
351 		reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR2);
352 		if (reg && reg == ~0) {
353 			key->hw_key_idx = 32;
354 			reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR3);
355 			if (reg && reg == ~0)
356 				return -ENOSPC;
357 		}
358 
359 		key->hw_key_idx += reg ? ffz(reg) : 0;
360 
361 		/*
362 		 * Upload key to hardware
363 		 */
364 		memcpy(key_entry.key, crypto->key,
365 		       sizeof(key_entry.key));
366 		memcpy(key_entry.tx_mic, crypto->tx_mic,
367 		       sizeof(key_entry.tx_mic));
368 		memcpy(key_entry.rx_mic, crypto->rx_mic,
369 		       sizeof(key_entry.rx_mic));
370 
371 		memset(&addr_entry, 0, sizeof(addr_entry));
372 		memcpy(&addr_entry, crypto->address, ETH_ALEN);
373 		addr_entry.cipher = crypto->cipher;
374 
375 		reg = PAIRWISE_KEY_ENTRY(key->hw_key_idx);
376 		rt2x00mmio_register_multiwrite(rt2x00dev, reg,
377 					       &key_entry, sizeof(key_entry));
378 
379 		reg = PAIRWISE_TA_ENTRY(key->hw_key_idx);
380 		rt2x00mmio_register_multiwrite(rt2x00dev, reg,
381 					       &addr_entry, sizeof(addr_entry));
382 
383 		/*
384 		 * Enable pairwise lookup table for given BSS idx.
385 		 * Without this, received frames will not be decrypted
386 		 * by the hardware.
387 		 */
388 		reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR4);
389 		reg |= (1 << crypto->bssidx);
390 		rt2x00mmio_register_write(rt2x00dev, SEC_CSR4, reg);
391 
392 		/*
393 		 * The driver does not support the IV/EIV generation
394 		 * in hardware. However it doesn't support the IV/EIV
395 		 * inside the ieee80211 frame either, but requires it
396 		 * to be provided separately for the descriptor.
397 		 * rt2x00lib will cut the IV/EIV data out of all frames
398 		 * given to us by mac80211, but we must tell mac80211
399 		 * to generate the IV/EIV data.
400 		 */
401 		key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
402 	}
403 
404 	/*
405 	 * SEC_CSR2 and SEC_CSR3 contain only single-bit fields to indicate
406 	 * a particular key is valid. Because using the FIELD32()
407 	 * defines directly will cause a lot of overhead, we use
408 	 * a calculation to determine the correct bit directly.
409 	 */
410 	if (key->hw_key_idx < 32) {
411 		mask = 1 << key->hw_key_idx;
412 
413 		reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR2);
414 		if (crypto->cmd == SET_KEY)
415 			reg |= mask;
416 		else if (crypto->cmd == DISABLE_KEY)
417 			reg &= ~mask;
418 		rt2x00mmio_register_write(rt2x00dev, SEC_CSR2, reg);
419 	} else {
420 		mask = 1 << (key->hw_key_idx - 32);
421 
422 		reg = rt2x00mmio_register_read(rt2x00dev, SEC_CSR3);
423 		if (crypto->cmd == SET_KEY)
424 			reg |= mask;
425 		else if (crypto->cmd == DISABLE_KEY)
426 			reg &= ~mask;
427 		rt2x00mmio_register_write(rt2x00dev, SEC_CSR3, reg);
428 	}
429 
430 	return 0;
431 }
432 
433 static void rt61pci_config_filter(struct rt2x00_dev *rt2x00dev,
434 				  const unsigned int filter_flags)
435 {
436 	u32 reg;
437 
438 	/*
439 	 * Start configuration steps.
440 	 * Note that the version error will always be dropped
441 	 * and broadcast frames will always be accepted since
442 	 * there is no filter for it at this time.
443 	 */
444 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0);
445 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CRC,
446 			   !(filter_flags & FIF_FCSFAIL));
447 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_PHYSICAL,
448 			   !(filter_flags & FIF_PLCPFAIL));
449 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_CONTROL,
450 			   !(filter_flags & (FIF_CONTROL | FIF_PSPOLL)));
451 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_NOT_TO_ME,
452 			   !test_bit(CONFIG_MONITORING, &rt2x00dev->flags));
453 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_TO_DS,
454 			   !test_bit(CONFIG_MONITORING, &rt2x00dev->flags) &&
455 			   !rt2x00dev->intf_ap_count);
456 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_VERSION_ERROR, 1);
457 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_MULTICAST,
458 			   !(filter_flags & FIF_ALLMULTI));
459 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_BROADCAST, 0);
460 	rt2x00_set_field32(&reg, TXRX_CSR0_DROP_ACK_CTS,
461 			   !(filter_flags & FIF_CONTROL));
462 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
463 }
464 
465 static void rt61pci_config_intf(struct rt2x00_dev *rt2x00dev,
466 				struct rt2x00_intf *intf,
467 				struct rt2x00intf_conf *conf,
468 				const unsigned int flags)
469 {
470 	u32 reg;
471 
472 	if (flags & CONFIG_UPDATE_TYPE) {
473 		/*
474 		 * Enable synchronisation.
475 		 */
476 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
477 		rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, conf->sync);
478 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
479 	}
480 
481 	if (flags & CONFIG_UPDATE_MAC) {
482 		reg = le32_to_cpu(conf->mac[1]);
483 		rt2x00_set_field32(&reg, MAC_CSR3_UNICAST_TO_ME_MASK, 0xff);
484 		conf->mac[1] = cpu_to_le32(reg);
485 
486 		rt2x00mmio_register_multiwrite(rt2x00dev, MAC_CSR2,
487 					       conf->mac, sizeof(conf->mac));
488 	}
489 
490 	if (flags & CONFIG_UPDATE_BSSID) {
491 		reg = le32_to_cpu(conf->bssid[1]);
492 		rt2x00_set_field32(&reg, MAC_CSR5_BSS_ID_MASK, 3);
493 		conf->bssid[1] = cpu_to_le32(reg);
494 
495 		rt2x00mmio_register_multiwrite(rt2x00dev, MAC_CSR4,
496 					       conf->bssid,
497 					       sizeof(conf->bssid));
498 	}
499 }
500 
501 static void rt61pci_config_erp(struct rt2x00_dev *rt2x00dev,
502 			       struct rt2x00lib_erp *erp,
503 			       u32 changed)
504 {
505 	u32 reg;
506 
507 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0);
508 	rt2x00_set_field32(&reg, TXRX_CSR0_RX_ACK_TIMEOUT, 0x32);
509 	rt2x00_set_field32(&reg, TXRX_CSR0_TSF_OFFSET, IEEE80211_HEADER);
510 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
511 
512 	if (changed & BSS_CHANGED_ERP_PREAMBLE) {
513 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR4);
514 		rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_ENABLE, 1);
515 		rt2x00_set_field32(&reg, TXRX_CSR4_AUTORESPOND_PREAMBLE,
516 				   !!erp->short_preamble);
517 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR4, reg);
518 	}
519 
520 	if (changed & BSS_CHANGED_BASIC_RATES)
521 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR5,
522 					  erp->basic_rates);
523 
524 	if (changed & BSS_CHANGED_BEACON_INT) {
525 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
526 		rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL,
527 				   erp->beacon_int * 16);
528 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
529 	}
530 
531 	if (changed & BSS_CHANGED_ERP_SLOT) {
532 		reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR9);
533 		rt2x00_set_field32(&reg, MAC_CSR9_SLOT_TIME, erp->slot_time);
534 		rt2x00mmio_register_write(rt2x00dev, MAC_CSR9, reg);
535 
536 		reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR8);
537 		rt2x00_set_field32(&reg, MAC_CSR8_SIFS, erp->sifs);
538 		rt2x00_set_field32(&reg, MAC_CSR8_SIFS_AFTER_RX_OFDM, 3);
539 		rt2x00_set_field32(&reg, MAC_CSR8_EIFS, erp->eifs);
540 		rt2x00mmio_register_write(rt2x00dev, MAC_CSR8, reg);
541 	}
542 }
543 
544 static void rt61pci_config_antenna_5x(struct rt2x00_dev *rt2x00dev,
545 				      struct antenna_setup *ant)
546 {
547 	u8 r3;
548 	u8 r4;
549 	u8 r77;
550 
551 	r3 = rt61pci_bbp_read(rt2x00dev, 3);
552 	r4 = rt61pci_bbp_read(rt2x00dev, 4);
553 	r77 = rt61pci_bbp_read(rt2x00dev, 77);
554 
555 	rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF5325));
556 
557 	/*
558 	 * Configure the RX antenna.
559 	 */
560 	switch (ant->rx) {
561 	case ANTENNA_HW_DIVERSITY:
562 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 2);
563 		rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
564 				  (rt2x00dev->curr_band != NL80211_BAND_5GHZ));
565 		break;
566 	case ANTENNA_A:
567 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
568 		rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, 0);
569 		if (rt2x00dev->curr_band == NL80211_BAND_5GHZ)
570 			rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
571 		else
572 			rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
573 		break;
574 	case ANTENNA_B:
575 	default:
576 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
577 		rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END, 0);
578 		if (rt2x00dev->curr_band == NL80211_BAND_5GHZ)
579 			rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
580 		else
581 			rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
582 		break;
583 	}
584 
585 	rt61pci_bbp_write(rt2x00dev, 77, r77);
586 	rt61pci_bbp_write(rt2x00dev, 3, r3);
587 	rt61pci_bbp_write(rt2x00dev, 4, r4);
588 }
589 
590 static void rt61pci_config_antenna_2x(struct rt2x00_dev *rt2x00dev,
591 				      struct antenna_setup *ant)
592 {
593 	u8 r3;
594 	u8 r4;
595 	u8 r77;
596 
597 	r3 = rt61pci_bbp_read(rt2x00dev, 3);
598 	r4 = rt61pci_bbp_read(rt2x00dev, 4);
599 	r77 = rt61pci_bbp_read(rt2x00dev, 77);
600 
601 	rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, rt2x00_rf(rt2x00dev, RF2529));
602 	rt2x00_set_field8(&r4, BBP_R4_RX_FRAME_END,
603 			  !rt2x00_has_cap_frame_type(rt2x00dev));
604 
605 	/*
606 	 * Configure the RX antenna.
607 	 */
608 	switch (ant->rx) {
609 	case ANTENNA_HW_DIVERSITY:
610 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 2);
611 		break;
612 	case ANTENNA_A:
613 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
614 		rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
615 		break;
616 	case ANTENNA_B:
617 	default:
618 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
619 		rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
620 		break;
621 	}
622 
623 	rt61pci_bbp_write(rt2x00dev, 77, r77);
624 	rt61pci_bbp_write(rt2x00dev, 3, r3);
625 	rt61pci_bbp_write(rt2x00dev, 4, r4);
626 }
627 
628 static void rt61pci_config_antenna_2529_rx(struct rt2x00_dev *rt2x00dev,
629 					   const int p1, const int p2)
630 {
631 	u32 reg;
632 
633 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR13);
634 
635 	rt2x00_set_field32(&reg, MAC_CSR13_DIR4, 0);
636 	rt2x00_set_field32(&reg, MAC_CSR13_VAL4, p1);
637 
638 	rt2x00_set_field32(&reg, MAC_CSR13_DIR3, 0);
639 	rt2x00_set_field32(&reg, MAC_CSR13_VAL3, !p2);
640 
641 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR13, reg);
642 }
643 
644 static void rt61pci_config_antenna_2529(struct rt2x00_dev *rt2x00dev,
645 					struct antenna_setup *ant)
646 {
647 	u8 r3;
648 	u8 r4;
649 	u8 r77;
650 
651 	r3 = rt61pci_bbp_read(rt2x00dev, 3);
652 	r4 = rt61pci_bbp_read(rt2x00dev, 4);
653 	r77 = rt61pci_bbp_read(rt2x00dev, 77);
654 
655 	/*
656 	 * Configure the RX antenna.
657 	 */
658 	switch (ant->rx) {
659 	case ANTENNA_A:
660 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
661 		rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 0);
662 		rt61pci_config_antenna_2529_rx(rt2x00dev, 0, 0);
663 		break;
664 	case ANTENNA_HW_DIVERSITY:
665 		/*
666 		 * FIXME: Antenna selection for the rf 2529 is very confusing
667 		 * in the legacy driver. Just default to antenna B until the
668 		 * legacy code can be properly translated into rt2x00 code.
669 		 */
670 	case ANTENNA_B:
671 	default:
672 		rt2x00_set_field8(&r4, BBP_R4_RX_ANTENNA_CONTROL, 1);
673 		rt2x00_set_field8(&r77, BBP_R77_RX_ANTENNA, 3);
674 		rt61pci_config_antenna_2529_rx(rt2x00dev, 1, 1);
675 		break;
676 	}
677 
678 	rt61pci_bbp_write(rt2x00dev, 77, r77);
679 	rt61pci_bbp_write(rt2x00dev, 3, r3);
680 	rt61pci_bbp_write(rt2x00dev, 4, r4);
681 }
682 
683 struct antenna_sel {
684 	u8 word;
685 	/*
686 	 * value[0] -> non-LNA
687 	 * value[1] -> LNA
688 	 */
689 	u8 value[2];
690 };
691 
692 static const struct antenna_sel antenna_sel_a[] = {
693 	{ 96,  { 0x58, 0x78 } },
694 	{ 104, { 0x38, 0x48 } },
695 	{ 75,  { 0xfe, 0x80 } },
696 	{ 86,  { 0xfe, 0x80 } },
697 	{ 88,  { 0xfe, 0x80 } },
698 	{ 35,  { 0x60, 0x60 } },
699 	{ 97,  { 0x58, 0x58 } },
700 	{ 98,  { 0x58, 0x58 } },
701 };
702 
703 static const struct antenna_sel antenna_sel_bg[] = {
704 	{ 96,  { 0x48, 0x68 } },
705 	{ 104, { 0x2c, 0x3c } },
706 	{ 75,  { 0xfe, 0x80 } },
707 	{ 86,  { 0xfe, 0x80 } },
708 	{ 88,  { 0xfe, 0x80 } },
709 	{ 35,  { 0x50, 0x50 } },
710 	{ 97,  { 0x48, 0x48 } },
711 	{ 98,  { 0x48, 0x48 } },
712 };
713 
714 static void rt61pci_config_ant(struct rt2x00_dev *rt2x00dev,
715 			       struct antenna_setup *ant)
716 {
717 	const struct antenna_sel *sel;
718 	unsigned int lna;
719 	unsigned int i;
720 	u32 reg;
721 
722 	/*
723 	 * We should never come here because rt2x00lib is supposed
724 	 * to catch this and send us the correct antenna explicitely.
725 	 */
726 	BUG_ON(ant->rx == ANTENNA_SW_DIVERSITY ||
727 	       ant->tx == ANTENNA_SW_DIVERSITY);
728 
729 	if (rt2x00dev->curr_band == NL80211_BAND_5GHZ) {
730 		sel = antenna_sel_a;
731 		lna = rt2x00_has_cap_external_lna_a(rt2x00dev);
732 	} else {
733 		sel = antenna_sel_bg;
734 		lna = rt2x00_has_cap_external_lna_bg(rt2x00dev);
735 	}
736 
737 	for (i = 0; i < ARRAY_SIZE(antenna_sel_a); i++)
738 		rt61pci_bbp_write(rt2x00dev, sel[i].word, sel[i].value[lna]);
739 
740 	reg = rt2x00mmio_register_read(rt2x00dev, PHY_CSR0);
741 
742 	rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_BG,
743 			   rt2x00dev->curr_band == NL80211_BAND_2GHZ);
744 	rt2x00_set_field32(&reg, PHY_CSR0_PA_PE_A,
745 			   rt2x00dev->curr_band == NL80211_BAND_5GHZ);
746 
747 	rt2x00mmio_register_write(rt2x00dev, PHY_CSR0, reg);
748 
749 	if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325))
750 		rt61pci_config_antenna_5x(rt2x00dev, ant);
751 	else if (rt2x00_rf(rt2x00dev, RF2527))
752 		rt61pci_config_antenna_2x(rt2x00dev, ant);
753 	else if (rt2x00_rf(rt2x00dev, RF2529)) {
754 		if (rt2x00_has_cap_double_antenna(rt2x00dev))
755 			rt61pci_config_antenna_2x(rt2x00dev, ant);
756 		else
757 			rt61pci_config_antenna_2529(rt2x00dev, ant);
758 	}
759 }
760 
761 static void rt61pci_config_lna_gain(struct rt2x00_dev *rt2x00dev,
762 				    struct rt2x00lib_conf *libconf)
763 {
764 	u16 eeprom;
765 	short lna_gain = 0;
766 
767 	if (libconf->conf->chandef.chan->band == NL80211_BAND_2GHZ) {
768 		if (rt2x00_has_cap_external_lna_bg(rt2x00dev))
769 			lna_gain += 14;
770 
771 		eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_BG);
772 		lna_gain -= rt2x00_get_field16(eeprom, EEPROM_RSSI_OFFSET_BG_1);
773 	} else {
774 		if (rt2x00_has_cap_external_lna_a(rt2x00dev))
775 			lna_gain += 14;
776 
777 		eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_A);
778 		lna_gain -= rt2x00_get_field16(eeprom, EEPROM_RSSI_OFFSET_A_1);
779 	}
780 
781 	rt2x00dev->lna_gain = lna_gain;
782 }
783 
784 static void rt61pci_config_channel(struct rt2x00_dev *rt2x00dev,
785 				   struct rf_channel *rf, const int txpower)
786 {
787 	u8 r3;
788 	u8 r94;
789 	u8 smart;
790 
791 	rt2x00_set_field32(&rf->rf3, RF3_TXPOWER, TXPOWER_TO_DEV(txpower));
792 	rt2x00_set_field32(&rf->rf4, RF4_FREQ_OFFSET, rt2x00dev->freq_offset);
793 
794 	smart = !(rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF2527));
795 
796 	r3 = rt61pci_bbp_read(rt2x00dev, 3);
797 	rt2x00_set_field8(&r3, BBP_R3_SMART_MODE, smart);
798 	rt61pci_bbp_write(rt2x00dev, 3, r3);
799 
800 	r94 = 6;
801 	if (txpower > MAX_TXPOWER && txpower <= (MAX_TXPOWER + r94))
802 		r94 += txpower - MAX_TXPOWER;
803 	else if (txpower < MIN_TXPOWER && txpower >= (MIN_TXPOWER - r94))
804 		r94 += txpower;
805 	rt61pci_bbp_write(rt2x00dev, 94, r94);
806 
807 	rt61pci_rf_write(rt2x00dev, 1, rf->rf1);
808 	rt61pci_rf_write(rt2x00dev, 2, rf->rf2);
809 	rt61pci_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
810 	rt61pci_rf_write(rt2x00dev, 4, rf->rf4);
811 
812 	udelay(200);
813 
814 	rt61pci_rf_write(rt2x00dev, 1, rf->rf1);
815 	rt61pci_rf_write(rt2x00dev, 2, rf->rf2);
816 	rt61pci_rf_write(rt2x00dev, 3, rf->rf3 | 0x00000004);
817 	rt61pci_rf_write(rt2x00dev, 4, rf->rf4);
818 
819 	udelay(200);
820 
821 	rt61pci_rf_write(rt2x00dev, 1, rf->rf1);
822 	rt61pci_rf_write(rt2x00dev, 2, rf->rf2);
823 	rt61pci_rf_write(rt2x00dev, 3, rf->rf3 & ~0x00000004);
824 	rt61pci_rf_write(rt2x00dev, 4, rf->rf4);
825 
826 	msleep(1);
827 }
828 
829 static void rt61pci_config_txpower(struct rt2x00_dev *rt2x00dev,
830 				   const int txpower)
831 {
832 	struct rf_channel rf;
833 
834 	rf.rf1 = rt2x00_rf_read(rt2x00dev, 1);
835 	rf.rf2 = rt2x00_rf_read(rt2x00dev, 2);
836 	rf.rf3 = rt2x00_rf_read(rt2x00dev, 3);
837 	rf.rf4 = rt2x00_rf_read(rt2x00dev, 4);
838 
839 	rt61pci_config_channel(rt2x00dev, &rf, txpower);
840 }
841 
842 static void rt61pci_config_retry_limit(struct rt2x00_dev *rt2x00dev,
843 				    struct rt2x00lib_conf *libconf)
844 {
845 	u32 reg;
846 
847 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR4);
848 	rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_DOWN, 1);
849 	rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_RATE_STEP, 0);
850 	rt2x00_set_field32(&reg, TXRX_CSR4_OFDM_TX_FALLBACK_CCK, 0);
851 	rt2x00_set_field32(&reg, TXRX_CSR4_LONG_RETRY_LIMIT,
852 			   libconf->conf->long_frame_max_tx_count);
853 	rt2x00_set_field32(&reg, TXRX_CSR4_SHORT_RETRY_LIMIT,
854 			   libconf->conf->short_frame_max_tx_count);
855 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR4, reg);
856 }
857 
858 static void rt61pci_config_ps(struct rt2x00_dev *rt2x00dev,
859 				struct rt2x00lib_conf *libconf)
860 {
861 	enum dev_state state =
862 	    (libconf->conf->flags & IEEE80211_CONF_PS) ?
863 		STATE_SLEEP : STATE_AWAKE;
864 	u32 reg;
865 
866 	if (state == STATE_SLEEP) {
867 		reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR11);
868 		rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN,
869 				   rt2x00dev->beacon_int - 10);
870 		rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP,
871 				   libconf->conf->listen_interval - 1);
872 		rt2x00_set_field32(&reg, MAC_CSR11_WAKEUP_LATENCY, 5);
873 
874 		/* We must first disable autowake before it can be enabled */
875 		rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 0);
876 		rt2x00mmio_register_write(rt2x00dev, MAC_CSR11, reg);
877 
878 		rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 1);
879 		rt2x00mmio_register_write(rt2x00dev, MAC_CSR11, reg);
880 
881 		rt2x00mmio_register_write(rt2x00dev, SOFT_RESET_CSR,
882 					  0x00000005);
883 		rt2x00mmio_register_write(rt2x00dev, IO_CNTL_CSR, 0x0000001c);
884 		rt2x00mmio_register_write(rt2x00dev, PCI_USEC_CSR, 0x00000060);
885 
886 		rt61pci_mcu_request(rt2x00dev, MCU_SLEEP, 0xff, 0, 0);
887 	} else {
888 		reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR11);
889 		rt2x00_set_field32(&reg, MAC_CSR11_DELAY_AFTER_TBCN, 0);
890 		rt2x00_set_field32(&reg, MAC_CSR11_TBCN_BEFORE_WAKEUP, 0);
891 		rt2x00_set_field32(&reg, MAC_CSR11_AUTOWAKE, 0);
892 		rt2x00_set_field32(&reg, MAC_CSR11_WAKEUP_LATENCY, 0);
893 		rt2x00mmio_register_write(rt2x00dev, MAC_CSR11, reg);
894 
895 		rt2x00mmio_register_write(rt2x00dev, SOFT_RESET_CSR,
896 					  0x00000007);
897 		rt2x00mmio_register_write(rt2x00dev, IO_CNTL_CSR, 0x00000018);
898 		rt2x00mmio_register_write(rt2x00dev, PCI_USEC_CSR, 0x00000020);
899 
900 		rt61pci_mcu_request(rt2x00dev, MCU_WAKEUP, 0xff, 0, 0);
901 	}
902 }
903 
904 static void rt61pci_config(struct rt2x00_dev *rt2x00dev,
905 			   struct rt2x00lib_conf *libconf,
906 			   const unsigned int flags)
907 {
908 	/* Always recalculate LNA gain before changing configuration */
909 	rt61pci_config_lna_gain(rt2x00dev, libconf);
910 
911 	if (flags & IEEE80211_CONF_CHANGE_CHANNEL)
912 		rt61pci_config_channel(rt2x00dev, &libconf->rf,
913 				       libconf->conf->power_level);
914 	if ((flags & IEEE80211_CONF_CHANGE_POWER) &&
915 	    !(flags & IEEE80211_CONF_CHANGE_CHANNEL))
916 		rt61pci_config_txpower(rt2x00dev, libconf->conf->power_level);
917 	if (flags & IEEE80211_CONF_CHANGE_RETRY_LIMITS)
918 		rt61pci_config_retry_limit(rt2x00dev, libconf);
919 	if (flags & IEEE80211_CONF_CHANGE_PS)
920 		rt61pci_config_ps(rt2x00dev, libconf);
921 }
922 
923 /*
924  * Link tuning
925  */
926 static void rt61pci_link_stats(struct rt2x00_dev *rt2x00dev,
927 			       struct link_qual *qual)
928 {
929 	u32 reg;
930 
931 	/*
932 	 * Update FCS error count from register.
933 	 */
934 	reg = rt2x00mmio_register_read(rt2x00dev, STA_CSR0);
935 	qual->rx_failed = rt2x00_get_field32(reg, STA_CSR0_FCS_ERROR);
936 
937 	/*
938 	 * Update False CCA count from register.
939 	 */
940 	reg = rt2x00mmio_register_read(rt2x00dev, STA_CSR1);
941 	qual->false_cca = rt2x00_get_field32(reg, STA_CSR1_FALSE_CCA_ERROR);
942 }
943 
944 static inline void rt61pci_set_vgc(struct rt2x00_dev *rt2x00dev,
945 				   struct link_qual *qual, u8 vgc_level)
946 {
947 	if (qual->vgc_level != vgc_level) {
948 		rt61pci_bbp_write(rt2x00dev, 17, vgc_level);
949 		qual->vgc_level = vgc_level;
950 		qual->vgc_level_reg = vgc_level;
951 	}
952 }
953 
954 static void rt61pci_reset_tuner(struct rt2x00_dev *rt2x00dev,
955 				struct link_qual *qual)
956 {
957 	rt61pci_set_vgc(rt2x00dev, qual, 0x20);
958 }
959 
960 static void rt61pci_link_tuner(struct rt2x00_dev *rt2x00dev,
961 			       struct link_qual *qual, const u32 count)
962 {
963 	u8 up_bound;
964 	u8 low_bound;
965 
966 	/*
967 	 * Determine r17 bounds.
968 	 */
969 	if (rt2x00dev->curr_band == NL80211_BAND_5GHZ) {
970 		low_bound = 0x28;
971 		up_bound = 0x48;
972 		if (rt2x00_has_cap_external_lna_a(rt2x00dev)) {
973 			low_bound += 0x10;
974 			up_bound += 0x10;
975 		}
976 	} else {
977 		low_bound = 0x20;
978 		up_bound = 0x40;
979 		if (rt2x00_has_cap_external_lna_bg(rt2x00dev)) {
980 			low_bound += 0x10;
981 			up_bound += 0x10;
982 		}
983 	}
984 
985 	/*
986 	 * If we are not associated, we should go straight to the
987 	 * dynamic CCA tuning.
988 	 */
989 	if (!rt2x00dev->intf_associated)
990 		goto dynamic_cca_tune;
991 
992 	/*
993 	 * Special big-R17 for very short distance
994 	 */
995 	if (qual->rssi >= -35) {
996 		rt61pci_set_vgc(rt2x00dev, qual, 0x60);
997 		return;
998 	}
999 
1000 	/*
1001 	 * Special big-R17 for short distance
1002 	 */
1003 	if (qual->rssi >= -58) {
1004 		rt61pci_set_vgc(rt2x00dev, qual, up_bound);
1005 		return;
1006 	}
1007 
1008 	/*
1009 	 * Special big-R17 for middle-short distance
1010 	 */
1011 	if (qual->rssi >= -66) {
1012 		rt61pci_set_vgc(rt2x00dev, qual, low_bound + 0x10);
1013 		return;
1014 	}
1015 
1016 	/*
1017 	 * Special mid-R17 for middle distance
1018 	 */
1019 	if (qual->rssi >= -74) {
1020 		rt61pci_set_vgc(rt2x00dev, qual, low_bound + 0x08);
1021 		return;
1022 	}
1023 
1024 	/*
1025 	 * Special case: Change up_bound based on the rssi.
1026 	 * Lower up_bound when rssi is weaker then -74 dBm.
1027 	 */
1028 	up_bound -= 2 * (-74 - qual->rssi);
1029 	if (low_bound > up_bound)
1030 		up_bound = low_bound;
1031 
1032 	if (qual->vgc_level > up_bound) {
1033 		rt61pci_set_vgc(rt2x00dev, qual, up_bound);
1034 		return;
1035 	}
1036 
1037 dynamic_cca_tune:
1038 
1039 	/*
1040 	 * r17 does not yet exceed upper limit, continue and base
1041 	 * the r17 tuning on the false CCA count.
1042 	 */
1043 	if ((qual->false_cca > 512) && (qual->vgc_level < up_bound))
1044 		rt61pci_set_vgc(rt2x00dev, qual, ++qual->vgc_level);
1045 	else if ((qual->false_cca < 100) && (qual->vgc_level > low_bound))
1046 		rt61pci_set_vgc(rt2x00dev, qual, --qual->vgc_level);
1047 }
1048 
1049 /*
1050  * Queue handlers.
1051  */
1052 static void rt61pci_start_queue(struct data_queue *queue)
1053 {
1054 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
1055 	u32 reg;
1056 
1057 	switch (queue->qid) {
1058 	case QID_RX:
1059 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0);
1060 		rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX, 0);
1061 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
1062 		break;
1063 	case QID_BEACON:
1064 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
1065 		rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 1);
1066 		rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 1);
1067 		rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
1068 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
1069 		break;
1070 	default:
1071 		break;
1072 	}
1073 }
1074 
1075 static void rt61pci_kick_queue(struct data_queue *queue)
1076 {
1077 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
1078 	u32 reg;
1079 
1080 	switch (queue->qid) {
1081 	case QID_AC_VO:
1082 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1083 		rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC0, 1);
1084 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1085 		break;
1086 	case QID_AC_VI:
1087 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1088 		rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC1, 1);
1089 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1090 		break;
1091 	case QID_AC_BE:
1092 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1093 		rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC2, 1);
1094 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1095 		break;
1096 	case QID_AC_BK:
1097 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1098 		rt2x00_set_field32(&reg, TX_CNTL_CSR_KICK_TX_AC3, 1);
1099 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1100 		break;
1101 	default:
1102 		break;
1103 	}
1104 }
1105 
1106 static void rt61pci_stop_queue(struct data_queue *queue)
1107 {
1108 	struct rt2x00_dev *rt2x00dev = queue->rt2x00dev;
1109 	u32 reg;
1110 
1111 	switch (queue->qid) {
1112 	case QID_AC_VO:
1113 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1114 		rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC0, 1);
1115 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1116 		break;
1117 	case QID_AC_VI:
1118 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1119 		rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC1, 1);
1120 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1121 		break;
1122 	case QID_AC_BE:
1123 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1124 		rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC2, 1);
1125 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1126 		break;
1127 	case QID_AC_BK:
1128 		reg = rt2x00mmio_register_read(rt2x00dev, TX_CNTL_CSR);
1129 		rt2x00_set_field32(&reg, TX_CNTL_CSR_ABORT_TX_AC3, 1);
1130 		rt2x00mmio_register_write(rt2x00dev, TX_CNTL_CSR, reg);
1131 		break;
1132 	case QID_RX:
1133 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0);
1134 		rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX, 1);
1135 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
1136 		break;
1137 	case QID_BEACON:
1138 		reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
1139 		rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 0);
1140 		rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 0);
1141 		rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
1142 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
1143 
1144 		/*
1145 		 * Wait for possibly running tbtt tasklets.
1146 		 */
1147 		tasklet_kill(&rt2x00dev->tbtt_tasklet);
1148 		break;
1149 	default:
1150 		break;
1151 	}
1152 }
1153 
1154 /*
1155  * Firmware functions
1156  */
1157 static char *rt61pci_get_firmware_name(struct rt2x00_dev *rt2x00dev)
1158 {
1159 	u16 chip;
1160 	char *fw_name;
1161 
1162 	pci_read_config_word(to_pci_dev(rt2x00dev->dev), PCI_DEVICE_ID, &chip);
1163 	switch (chip) {
1164 	case RT2561_PCI_ID:
1165 		fw_name = FIRMWARE_RT2561;
1166 		break;
1167 	case RT2561s_PCI_ID:
1168 		fw_name = FIRMWARE_RT2561s;
1169 		break;
1170 	case RT2661_PCI_ID:
1171 		fw_name = FIRMWARE_RT2661;
1172 		break;
1173 	default:
1174 		fw_name = NULL;
1175 		break;
1176 	}
1177 
1178 	return fw_name;
1179 }
1180 
1181 static int rt61pci_check_firmware(struct rt2x00_dev *rt2x00dev,
1182 				  const u8 *data, const size_t len)
1183 {
1184 	u16 fw_crc;
1185 	u16 crc;
1186 
1187 	/*
1188 	 * Only support 8kb firmware files.
1189 	 */
1190 	if (len != 8192)
1191 		return FW_BAD_LENGTH;
1192 
1193 	/*
1194 	 * The last 2 bytes in the firmware array are the crc checksum itself.
1195 	 * This means that we should never pass those 2 bytes to the crc
1196 	 * algorithm.
1197 	 */
1198 	fw_crc = (data[len - 2] << 8 | data[len - 1]);
1199 
1200 	/*
1201 	 * Use the crc itu-t algorithm.
1202 	 */
1203 	crc = crc_itu_t(0, data, len - 2);
1204 	crc = crc_itu_t_byte(crc, 0);
1205 	crc = crc_itu_t_byte(crc, 0);
1206 
1207 	return (fw_crc == crc) ? FW_OK : FW_BAD_CRC;
1208 }
1209 
1210 static int rt61pci_load_firmware(struct rt2x00_dev *rt2x00dev,
1211 				 const u8 *data, const size_t len)
1212 {
1213 	int i;
1214 	u32 reg;
1215 
1216 	/*
1217 	 * Wait for stable hardware.
1218 	 */
1219 	for (i = 0; i < 100; i++) {
1220 		reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR0);
1221 		if (reg)
1222 			break;
1223 		msleep(1);
1224 	}
1225 
1226 	if (!reg) {
1227 		rt2x00_err(rt2x00dev, "Unstable hardware\n");
1228 		return -EBUSY;
1229 	}
1230 
1231 	/*
1232 	 * Prepare MCU and mailbox for firmware loading.
1233 	 */
1234 	reg = 0;
1235 	rt2x00_set_field32(&reg, MCU_CNTL_CSR_RESET, 1);
1236 	rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
1237 	rt2x00mmio_register_write(rt2x00dev, M2H_CMD_DONE_CSR, 0xffffffff);
1238 	rt2x00mmio_register_write(rt2x00dev, H2M_MAILBOX_CSR, 0);
1239 	rt2x00mmio_register_write(rt2x00dev, HOST_CMD_CSR, 0);
1240 
1241 	/*
1242 	 * Write firmware to device.
1243 	 */
1244 	reg = 0;
1245 	rt2x00_set_field32(&reg, MCU_CNTL_CSR_RESET, 1);
1246 	rt2x00_set_field32(&reg, MCU_CNTL_CSR_SELECT_BANK, 1);
1247 	rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
1248 
1249 	rt2x00mmio_register_multiwrite(rt2x00dev, FIRMWARE_IMAGE_BASE,
1250 				       data, len);
1251 
1252 	rt2x00_set_field32(&reg, MCU_CNTL_CSR_SELECT_BANK, 0);
1253 	rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
1254 
1255 	rt2x00_set_field32(&reg, MCU_CNTL_CSR_RESET, 0);
1256 	rt2x00mmio_register_write(rt2x00dev, MCU_CNTL_CSR, reg);
1257 
1258 	for (i = 0; i < 100; i++) {
1259 		reg = rt2x00mmio_register_read(rt2x00dev, MCU_CNTL_CSR);
1260 		if (rt2x00_get_field32(reg, MCU_CNTL_CSR_READY))
1261 			break;
1262 		msleep(1);
1263 	}
1264 
1265 	if (i == 100) {
1266 		rt2x00_err(rt2x00dev, "MCU Control register not ready\n");
1267 		return -EBUSY;
1268 	}
1269 
1270 	/*
1271 	 * Hardware needs another millisecond before it is ready.
1272 	 */
1273 	msleep(1);
1274 
1275 	/*
1276 	 * Reset MAC and BBP registers.
1277 	 */
1278 	reg = 0;
1279 	rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 1);
1280 	rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 1);
1281 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
1282 
1283 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR1);
1284 	rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 0);
1285 	rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 0);
1286 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
1287 
1288 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR1);
1289 	rt2x00_set_field32(&reg, MAC_CSR1_HOST_READY, 1);
1290 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
1291 
1292 	return 0;
1293 }
1294 
1295 /*
1296  * Initialization functions.
1297  */
1298 static bool rt61pci_get_entry_state(struct queue_entry *entry)
1299 {
1300 	struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
1301 	u32 word;
1302 
1303 	if (entry->queue->qid == QID_RX) {
1304 		word = rt2x00_desc_read(entry_priv->desc, 0);
1305 
1306 		return rt2x00_get_field32(word, RXD_W0_OWNER_NIC);
1307 	} else {
1308 		word = rt2x00_desc_read(entry_priv->desc, 0);
1309 
1310 		return (rt2x00_get_field32(word, TXD_W0_OWNER_NIC) ||
1311 		        rt2x00_get_field32(word, TXD_W0_VALID));
1312 	}
1313 }
1314 
1315 static void rt61pci_clear_entry(struct queue_entry *entry)
1316 {
1317 	struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
1318 	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
1319 	u32 word;
1320 
1321 	if (entry->queue->qid == QID_RX) {
1322 		word = rt2x00_desc_read(entry_priv->desc, 5);
1323 		rt2x00_set_field32(&word, RXD_W5_BUFFER_PHYSICAL_ADDRESS,
1324 				   skbdesc->skb_dma);
1325 		rt2x00_desc_write(entry_priv->desc, 5, word);
1326 
1327 		word = rt2x00_desc_read(entry_priv->desc, 0);
1328 		rt2x00_set_field32(&word, RXD_W0_OWNER_NIC, 1);
1329 		rt2x00_desc_write(entry_priv->desc, 0, word);
1330 	} else {
1331 		word = rt2x00_desc_read(entry_priv->desc, 0);
1332 		rt2x00_set_field32(&word, TXD_W0_VALID, 0);
1333 		rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 0);
1334 		rt2x00_desc_write(entry_priv->desc, 0, word);
1335 	}
1336 }
1337 
1338 static int rt61pci_init_queues(struct rt2x00_dev *rt2x00dev)
1339 {
1340 	struct queue_entry_priv_mmio *entry_priv;
1341 	u32 reg;
1342 
1343 	/*
1344 	 * Initialize registers.
1345 	 */
1346 	reg = rt2x00mmio_register_read(rt2x00dev, TX_RING_CSR0);
1347 	rt2x00_set_field32(&reg, TX_RING_CSR0_AC0_RING_SIZE,
1348 			   rt2x00dev->tx[0].limit);
1349 	rt2x00_set_field32(&reg, TX_RING_CSR0_AC1_RING_SIZE,
1350 			   rt2x00dev->tx[1].limit);
1351 	rt2x00_set_field32(&reg, TX_RING_CSR0_AC2_RING_SIZE,
1352 			   rt2x00dev->tx[2].limit);
1353 	rt2x00_set_field32(&reg, TX_RING_CSR0_AC3_RING_SIZE,
1354 			   rt2x00dev->tx[3].limit);
1355 	rt2x00mmio_register_write(rt2x00dev, TX_RING_CSR0, reg);
1356 
1357 	reg = rt2x00mmio_register_read(rt2x00dev, TX_RING_CSR1);
1358 	rt2x00_set_field32(&reg, TX_RING_CSR1_TXD_SIZE,
1359 			   rt2x00dev->tx[0].desc_size / 4);
1360 	rt2x00mmio_register_write(rt2x00dev, TX_RING_CSR1, reg);
1361 
1362 	entry_priv = rt2x00dev->tx[0].entries[0].priv_data;
1363 	reg = rt2x00mmio_register_read(rt2x00dev, AC0_BASE_CSR);
1364 	rt2x00_set_field32(&reg, AC0_BASE_CSR_RING_REGISTER,
1365 			   entry_priv->desc_dma);
1366 	rt2x00mmio_register_write(rt2x00dev, AC0_BASE_CSR, reg);
1367 
1368 	entry_priv = rt2x00dev->tx[1].entries[0].priv_data;
1369 	reg = rt2x00mmio_register_read(rt2x00dev, AC1_BASE_CSR);
1370 	rt2x00_set_field32(&reg, AC1_BASE_CSR_RING_REGISTER,
1371 			   entry_priv->desc_dma);
1372 	rt2x00mmio_register_write(rt2x00dev, AC1_BASE_CSR, reg);
1373 
1374 	entry_priv = rt2x00dev->tx[2].entries[0].priv_data;
1375 	reg = rt2x00mmio_register_read(rt2x00dev, AC2_BASE_CSR);
1376 	rt2x00_set_field32(&reg, AC2_BASE_CSR_RING_REGISTER,
1377 			   entry_priv->desc_dma);
1378 	rt2x00mmio_register_write(rt2x00dev, AC2_BASE_CSR, reg);
1379 
1380 	entry_priv = rt2x00dev->tx[3].entries[0].priv_data;
1381 	reg = rt2x00mmio_register_read(rt2x00dev, AC3_BASE_CSR);
1382 	rt2x00_set_field32(&reg, AC3_BASE_CSR_RING_REGISTER,
1383 			   entry_priv->desc_dma);
1384 	rt2x00mmio_register_write(rt2x00dev, AC3_BASE_CSR, reg);
1385 
1386 	reg = rt2x00mmio_register_read(rt2x00dev, RX_RING_CSR);
1387 	rt2x00_set_field32(&reg, RX_RING_CSR_RING_SIZE, rt2x00dev->rx->limit);
1388 	rt2x00_set_field32(&reg, RX_RING_CSR_RXD_SIZE,
1389 			   rt2x00dev->rx->desc_size / 4);
1390 	rt2x00_set_field32(&reg, RX_RING_CSR_RXD_WRITEBACK_SIZE, 4);
1391 	rt2x00mmio_register_write(rt2x00dev, RX_RING_CSR, reg);
1392 
1393 	entry_priv = rt2x00dev->rx->entries[0].priv_data;
1394 	reg = rt2x00mmio_register_read(rt2x00dev, RX_BASE_CSR);
1395 	rt2x00_set_field32(&reg, RX_BASE_CSR_RING_REGISTER,
1396 			   entry_priv->desc_dma);
1397 	rt2x00mmio_register_write(rt2x00dev, RX_BASE_CSR, reg);
1398 
1399 	reg = rt2x00mmio_register_read(rt2x00dev, TX_DMA_DST_CSR);
1400 	rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC0, 2);
1401 	rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC1, 2);
1402 	rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC2, 2);
1403 	rt2x00_set_field32(&reg, TX_DMA_DST_CSR_DEST_AC3, 2);
1404 	rt2x00mmio_register_write(rt2x00dev, TX_DMA_DST_CSR, reg);
1405 
1406 	reg = rt2x00mmio_register_read(rt2x00dev, LOAD_TX_RING_CSR);
1407 	rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC0, 1);
1408 	rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC1, 1);
1409 	rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC2, 1);
1410 	rt2x00_set_field32(&reg, LOAD_TX_RING_CSR_LOAD_TXD_AC3, 1);
1411 	rt2x00mmio_register_write(rt2x00dev, LOAD_TX_RING_CSR, reg);
1412 
1413 	reg = rt2x00mmio_register_read(rt2x00dev, RX_CNTL_CSR);
1414 	rt2x00_set_field32(&reg, RX_CNTL_CSR_LOAD_RXD, 1);
1415 	rt2x00mmio_register_write(rt2x00dev, RX_CNTL_CSR, reg);
1416 
1417 	return 0;
1418 }
1419 
1420 static int rt61pci_init_registers(struct rt2x00_dev *rt2x00dev)
1421 {
1422 	u32 reg;
1423 
1424 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR0);
1425 	rt2x00_set_field32(&reg, TXRX_CSR0_AUTO_TX_SEQ, 1);
1426 	rt2x00_set_field32(&reg, TXRX_CSR0_DISABLE_RX, 0);
1427 	rt2x00_set_field32(&reg, TXRX_CSR0_TX_WITHOUT_WAITING, 0);
1428 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR0, reg);
1429 
1430 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR1);
1431 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID0, 47); /* CCK Signal */
1432 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID0_VALID, 1);
1433 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID1, 30); /* Rssi */
1434 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID1_VALID, 1);
1435 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID2, 42); /* OFDM Rate */
1436 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID2_VALID, 1);
1437 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID3, 30); /* Rssi */
1438 	rt2x00_set_field32(&reg, TXRX_CSR1_BBP_ID3_VALID, 1);
1439 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR1, reg);
1440 
1441 	/*
1442 	 * CCK TXD BBP registers
1443 	 */
1444 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR2);
1445 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID0, 13);
1446 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID0_VALID, 1);
1447 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID1, 12);
1448 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID1_VALID, 1);
1449 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID2, 11);
1450 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID2_VALID, 1);
1451 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID3, 10);
1452 	rt2x00_set_field32(&reg, TXRX_CSR2_BBP_ID3_VALID, 1);
1453 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR2, reg);
1454 
1455 	/*
1456 	 * OFDM TXD BBP registers
1457 	 */
1458 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR3);
1459 	rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID0, 7);
1460 	rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID0_VALID, 1);
1461 	rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID1, 6);
1462 	rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID1_VALID, 1);
1463 	rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID2, 5);
1464 	rt2x00_set_field32(&reg, TXRX_CSR3_BBP_ID2_VALID, 1);
1465 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR3, reg);
1466 
1467 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR7);
1468 	rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_6MBS, 59);
1469 	rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_9MBS, 53);
1470 	rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_12MBS, 49);
1471 	rt2x00_set_field32(&reg, TXRX_CSR7_ACK_CTS_18MBS, 46);
1472 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR7, reg);
1473 
1474 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR8);
1475 	rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_24MBS, 44);
1476 	rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_36MBS, 42);
1477 	rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_48MBS, 42);
1478 	rt2x00_set_field32(&reg, TXRX_CSR8_ACK_CTS_54MBS, 42);
1479 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR8, reg);
1480 
1481 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
1482 	rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_INTERVAL, 0);
1483 	rt2x00_set_field32(&reg, TXRX_CSR9_TSF_TICKING, 0);
1484 	rt2x00_set_field32(&reg, TXRX_CSR9_TSF_SYNC, 0);
1485 	rt2x00_set_field32(&reg, TXRX_CSR9_TBTT_ENABLE, 0);
1486 	rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
1487 	rt2x00_set_field32(&reg, TXRX_CSR9_TIMESTAMP_COMPENSATE, 0);
1488 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
1489 
1490 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR15, 0x0000000f);
1491 
1492 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR6, 0x00000fff);
1493 
1494 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR9);
1495 	rt2x00_set_field32(&reg, MAC_CSR9_CW_SELECT, 0);
1496 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR9, reg);
1497 
1498 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR10, 0x0000071c);
1499 
1500 	if (rt2x00dev->ops->lib->set_device_state(rt2x00dev, STATE_AWAKE))
1501 		return -EBUSY;
1502 
1503 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR13, 0x0000e000);
1504 
1505 	/*
1506 	 * Invalidate all Shared Keys (SEC_CSR0),
1507 	 * and clear the Shared key Cipher algorithms (SEC_CSR1 & SEC_CSR5)
1508 	 */
1509 	rt2x00mmio_register_write(rt2x00dev, SEC_CSR0, 0x00000000);
1510 	rt2x00mmio_register_write(rt2x00dev, SEC_CSR1, 0x00000000);
1511 	rt2x00mmio_register_write(rt2x00dev, SEC_CSR5, 0x00000000);
1512 
1513 	rt2x00mmio_register_write(rt2x00dev, PHY_CSR1, 0x000023b0);
1514 	rt2x00mmio_register_write(rt2x00dev, PHY_CSR5, 0x060a100c);
1515 	rt2x00mmio_register_write(rt2x00dev, PHY_CSR6, 0x00080606);
1516 	rt2x00mmio_register_write(rt2x00dev, PHY_CSR7, 0x00000a08);
1517 
1518 	rt2x00mmio_register_write(rt2x00dev, PCI_CFG_CSR, 0x28ca4404);
1519 
1520 	rt2x00mmio_register_write(rt2x00dev, TEST_MODE_CSR, 0x00000200);
1521 
1522 	rt2x00mmio_register_write(rt2x00dev, M2H_CMD_DONE_CSR, 0xffffffff);
1523 
1524 	/*
1525 	 * Clear all beacons
1526 	 * For the Beacon base registers we only need to clear
1527 	 * the first byte since that byte contains the VALID and OWNER
1528 	 * bits which (when set to 0) will invalidate the entire beacon.
1529 	 */
1530 	rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE0, 0);
1531 	rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE1, 0);
1532 	rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE2, 0);
1533 	rt2x00mmio_register_write(rt2x00dev, HW_BEACON_BASE3, 0);
1534 
1535 	/*
1536 	 * We must clear the error counters.
1537 	 * These registers are cleared on read,
1538 	 * so we may pass a useless variable to store the value.
1539 	 */
1540 	reg = rt2x00mmio_register_read(rt2x00dev, STA_CSR0);
1541 	reg = rt2x00mmio_register_read(rt2x00dev, STA_CSR1);
1542 	reg = rt2x00mmio_register_read(rt2x00dev, STA_CSR2);
1543 
1544 	/*
1545 	 * Reset MAC and BBP registers.
1546 	 */
1547 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR1);
1548 	rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 1);
1549 	rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 1);
1550 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
1551 
1552 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR1);
1553 	rt2x00_set_field32(&reg, MAC_CSR1_SOFT_RESET, 0);
1554 	rt2x00_set_field32(&reg, MAC_CSR1_BBP_RESET, 0);
1555 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
1556 
1557 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR1);
1558 	rt2x00_set_field32(&reg, MAC_CSR1_HOST_READY, 1);
1559 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR1, reg);
1560 
1561 	return 0;
1562 }
1563 
1564 static int rt61pci_wait_bbp_ready(struct rt2x00_dev *rt2x00dev)
1565 {
1566 	unsigned int i;
1567 	u8 value;
1568 
1569 	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
1570 		value = rt61pci_bbp_read(rt2x00dev, 0);
1571 		if ((value != 0xff) && (value != 0x00))
1572 			return 0;
1573 		udelay(REGISTER_BUSY_DELAY);
1574 	}
1575 
1576 	rt2x00_err(rt2x00dev, "BBP register access failed, aborting\n");
1577 	return -EACCES;
1578 }
1579 
1580 static int rt61pci_init_bbp(struct rt2x00_dev *rt2x00dev)
1581 {
1582 	unsigned int i;
1583 	u16 eeprom;
1584 	u8 reg_id;
1585 	u8 value;
1586 
1587 	if (unlikely(rt61pci_wait_bbp_ready(rt2x00dev)))
1588 		return -EACCES;
1589 
1590 	rt61pci_bbp_write(rt2x00dev, 3, 0x00);
1591 	rt61pci_bbp_write(rt2x00dev, 15, 0x30);
1592 	rt61pci_bbp_write(rt2x00dev, 21, 0xc8);
1593 	rt61pci_bbp_write(rt2x00dev, 22, 0x38);
1594 	rt61pci_bbp_write(rt2x00dev, 23, 0x06);
1595 	rt61pci_bbp_write(rt2x00dev, 24, 0xfe);
1596 	rt61pci_bbp_write(rt2x00dev, 25, 0x0a);
1597 	rt61pci_bbp_write(rt2x00dev, 26, 0x0d);
1598 	rt61pci_bbp_write(rt2x00dev, 34, 0x12);
1599 	rt61pci_bbp_write(rt2x00dev, 37, 0x07);
1600 	rt61pci_bbp_write(rt2x00dev, 39, 0xf8);
1601 	rt61pci_bbp_write(rt2x00dev, 41, 0x60);
1602 	rt61pci_bbp_write(rt2x00dev, 53, 0x10);
1603 	rt61pci_bbp_write(rt2x00dev, 54, 0x18);
1604 	rt61pci_bbp_write(rt2x00dev, 60, 0x10);
1605 	rt61pci_bbp_write(rt2x00dev, 61, 0x04);
1606 	rt61pci_bbp_write(rt2x00dev, 62, 0x04);
1607 	rt61pci_bbp_write(rt2x00dev, 75, 0xfe);
1608 	rt61pci_bbp_write(rt2x00dev, 86, 0xfe);
1609 	rt61pci_bbp_write(rt2x00dev, 88, 0xfe);
1610 	rt61pci_bbp_write(rt2x00dev, 90, 0x0f);
1611 	rt61pci_bbp_write(rt2x00dev, 99, 0x00);
1612 	rt61pci_bbp_write(rt2x00dev, 102, 0x16);
1613 	rt61pci_bbp_write(rt2x00dev, 107, 0x04);
1614 
1615 	for (i = 0; i < EEPROM_BBP_SIZE; i++) {
1616 		eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_BBP_START + i);
1617 
1618 		if (eeprom != 0xffff && eeprom != 0x0000) {
1619 			reg_id = rt2x00_get_field16(eeprom, EEPROM_BBP_REG_ID);
1620 			value = rt2x00_get_field16(eeprom, EEPROM_BBP_VALUE);
1621 			rt61pci_bbp_write(rt2x00dev, reg_id, value);
1622 		}
1623 	}
1624 
1625 	return 0;
1626 }
1627 
1628 /*
1629  * Device state switch handlers.
1630  */
1631 static void rt61pci_toggle_irq(struct rt2x00_dev *rt2x00dev,
1632 			       enum dev_state state)
1633 {
1634 	int mask = (state == STATE_RADIO_IRQ_OFF);
1635 	u32 reg;
1636 	unsigned long flags;
1637 
1638 	/*
1639 	 * When interrupts are being enabled, the interrupt registers
1640 	 * should clear the register to assure a clean state.
1641 	 */
1642 	if (state == STATE_RADIO_IRQ_ON) {
1643 		reg = rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR);
1644 		rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
1645 
1646 		reg = rt2x00mmio_register_read(rt2x00dev, MCU_INT_SOURCE_CSR);
1647 		rt2x00mmio_register_write(rt2x00dev, MCU_INT_SOURCE_CSR, reg);
1648 	}
1649 
1650 	/*
1651 	 * Only toggle the interrupts bits we are going to use.
1652 	 * Non-checked interrupt bits are disabled by default.
1653 	 */
1654 	spin_lock_irqsave(&rt2x00dev->irqmask_lock, flags);
1655 
1656 	reg = rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR);
1657 	rt2x00_set_field32(&reg, INT_MASK_CSR_TXDONE, mask);
1658 	rt2x00_set_field32(&reg, INT_MASK_CSR_RXDONE, mask);
1659 	rt2x00_set_field32(&reg, INT_MASK_CSR_BEACON_DONE, mask);
1660 	rt2x00_set_field32(&reg, INT_MASK_CSR_ENABLE_MITIGATION, mask);
1661 	rt2x00_set_field32(&reg, INT_MASK_CSR_MITIGATION_PERIOD, 0xff);
1662 	rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
1663 
1664 	reg = rt2x00mmio_register_read(rt2x00dev, MCU_INT_MASK_CSR);
1665 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_0, mask);
1666 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_1, mask);
1667 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_2, mask);
1668 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_3, mask);
1669 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_4, mask);
1670 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_5, mask);
1671 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_6, mask);
1672 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_7, mask);
1673 	rt2x00_set_field32(&reg, MCU_INT_MASK_CSR_TWAKEUP, mask);
1674 	rt2x00mmio_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
1675 
1676 	spin_unlock_irqrestore(&rt2x00dev->irqmask_lock, flags);
1677 
1678 	if (state == STATE_RADIO_IRQ_OFF) {
1679 		/*
1680 		 * Ensure that all tasklets are finished.
1681 		 */
1682 		tasklet_kill(&rt2x00dev->txstatus_tasklet);
1683 		tasklet_kill(&rt2x00dev->rxdone_tasklet);
1684 		tasklet_kill(&rt2x00dev->autowake_tasklet);
1685 		tasklet_kill(&rt2x00dev->tbtt_tasklet);
1686 	}
1687 }
1688 
1689 static int rt61pci_enable_radio(struct rt2x00_dev *rt2x00dev)
1690 {
1691 	u32 reg;
1692 
1693 	/*
1694 	 * Initialize all registers.
1695 	 */
1696 	if (unlikely(rt61pci_init_queues(rt2x00dev) ||
1697 		     rt61pci_init_registers(rt2x00dev) ||
1698 		     rt61pci_init_bbp(rt2x00dev)))
1699 		return -EIO;
1700 
1701 	/*
1702 	 * Enable RX.
1703 	 */
1704 	reg = rt2x00mmio_register_read(rt2x00dev, RX_CNTL_CSR);
1705 	rt2x00_set_field32(&reg, RX_CNTL_CSR_ENABLE_RX_DMA, 1);
1706 	rt2x00mmio_register_write(rt2x00dev, RX_CNTL_CSR, reg);
1707 
1708 	return 0;
1709 }
1710 
1711 static void rt61pci_disable_radio(struct rt2x00_dev *rt2x00dev)
1712 {
1713 	/*
1714 	 * Disable power
1715 	 */
1716 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR10, 0x00001818);
1717 }
1718 
1719 static int rt61pci_set_state(struct rt2x00_dev *rt2x00dev, enum dev_state state)
1720 {
1721 	u32 reg, reg2;
1722 	unsigned int i;
1723 	char put_to_sleep;
1724 
1725 	put_to_sleep = (state != STATE_AWAKE);
1726 
1727 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR12);
1728 	rt2x00_set_field32(&reg, MAC_CSR12_FORCE_WAKEUP, !put_to_sleep);
1729 	rt2x00_set_field32(&reg, MAC_CSR12_PUT_TO_SLEEP, put_to_sleep);
1730 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR12, reg);
1731 
1732 	/*
1733 	 * Device is not guaranteed to be in the requested state yet.
1734 	 * We must wait until the register indicates that the
1735 	 * device has entered the correct state.
1736 	 */
1737 	for (i = 0; i < REGISTER_BUSY_COUNT; i++) {
1738 		reg2 = rt2x00mmio_register_read(rt2x00dev, MAC_CSR12);
1739 		state = rt2x00_get_field32(reg2, MAC_CSR12_BBP_CURRENT_STATE);
1740 		if (state == !put_to_sleep)
1741 			return 0;
1742 		rt2x00mmio_register_write(rt2x00dev, MAC_CSR12, reg);
1743 		msleep(10);
1744 	}
1745 
1746 	return -EBUSY;
1747 }
1748 
1749 static int rt61pci_set_device_state(struct rt2x00_dev *rt2x00dev,
1750 				    enum dev_state state)
1751 {
1752 	int retval = 0;
1753 
1754 	switch (state) {
1755 	case STATE_RADIO_ON:
1756 		retval = rt61pci_enable_radio(rt2x00dev);
1757 		break;
1758 	case STATE_RADIO_OFF:
1759 		rt61pci_disable_radio(rt2x00dev);
1760 		break;
1761 	case STATE_RADIO_IRQ_ON:
1762 	case STATE_RADIO_IRQ_OFF:
1763 		rt61pci_toggle_irq(rt2x00dev, state);
1764 		break;
1765 	case STATE_DEEP_SLEEP:
1766 	case STATE_SLEEP:
1767 	case STATE_STANDBY:
1768 	case STATE_AWAKE:
1769 		retval = rt61pci_set_state(rt2x00dev, state);
1770 		break;
1771 	default:
1772 		retval = -ENOTSUPP;
1773 		break;
1774 	}
1775 
1776 	if (unlikely(retval))
1777 		rt2x00_err(rt2x00dev, "Device failed to enter state %d (%d)\n",
1778 			   state, retval);
1779 
1780 	return retval;
1781 }
1782 
1783 /*
1784  * TX descriptor initialization
1785  */
1786 static void rt61pci_write_tx_desc(struct queue_entry *entry,
1787 				  struct txentry_desc *txdesc)
1788 {
1789 	struct skb_frame_desc *skbdesc = get_skb_frame_desc(entry->skb);
1790 	struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
1791 	__le32 *txd = entry_priv->desc;
1792 	u32 word;
1793 
1794 	/*
1795 	 * Start writing the descriptor words.
1796 	 */
1797 	word = rt2x00_desc_read(txd, 1);
1798 	rt2x00_set_field32(&word, TXD_W1_HOST_Q_ID, entry->queue->qid);
1799 	rt2x00_set_field32(&word, TXD_W1_AIFSN, entry->queue->aifs);
1800 	rt2x00_set_field32(&word, TXD_W1_CWMIN, entry->queue->cw_min);
1801 	rt2x00_set_field32(&word, TXD_W1_CWMAX, entry->queue->cw_max);
1802 	rt2x00_set_field32(&word, TXD_W1_IV_OFFSET, txdesc->iv_offset);
1803 	rt2x00_set_field32(&word, TXD_W1_HW_SEQUENCE,
1804 			   test_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags));
1805 	rt2x00_set_field32(&word, TXD_W1_BUFFER_COUNT, 1);
1806 	rt2x00_desc_write(txd, 1, word);
1807 
1808 	word = rt2x00_desc_read(txd, 2);
1809 	rt2x00_set_field32(&word, TXD_W2_PLCP_SIGNAL, txdesc->u.plcp.signal);
1810 	rt2x00_set_field32(&word, TXD_W2_PLCP_SERVICE, txdesc->u.plcp.service);
1811 	rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_LOW,
1812 			   txdesc->u.plcp.length_low);
1813 	rt2x00_set_field32(&word, TXD_W2_PLCP_LENGTH_HIGH,
1814 			   txdesc->u.plcp.length_high);
1815 	rt2x00_desc_write(txd, 2, word);
1816 
1817 	if (test_bit(ENTRY_TXD_ENCRYPT, &txdesc->flags)) {
1818 		_rt2x00_desc_write(txd, 3, skbdesc->iv[0]);
1819 		_rt2x00_desc_write(txd, 4, skbdesc->iv[1]);
1820 	}
1821 
1822 	word = rt2x00_desc_read(txd, 5);
1823 	rt2x00_set_field32(&word, TXD_W5_PID_TYPE, entry->queue->qid);
1824 	rt2x00_set_field32(&word, TXD_W5_PID_SUBTYPE, entry->entry_idx);
1825 	rt2x00_set_field32(&word, TXD_W5_TX_POWER,
1826 			   TXPOWER_TO_DEV(entry->queue->rt2x00dev->tx_power));
1827 	rt2x00_set_field32(&word, TXD_W5_WAITING_DMA_DONE_INT, 1);
1828 	rt2x00_desc_write(txd, 5, word);
1829 
1830 	if (entry->queue->qid != QID_BEACON) {
1831 		word = rt2x00_desc_read(txd, 6);
1832 		rt2x00_set_field32(&word, TXD_W6_BUFFER_PHYSICAL_ADDRESS,
1833 				   skbdesc->skb_dma);
1834 		rt2x00_desc_write(txd, 6, word);
1835 
1836 		word = rt2x00_desc_read(txd, 11);
1837 		rt2x00_set_field32(&word, TXD_W11_BUFFER_LENGTH0,
1838 				   txdesc->length);
1839 		rt2x00_desc_write(txd, 11, word);
1840 	}
1841 
1842 	/*
1843 	 * Writing TXD word 0 must the last to prevent a race condition with
1844 	 * the device, whereby the device may take hold of the TXD before we
1845 	 * finished updating it.
1846 	 */
1847 	word = rt2x00_desc_read(txd, 0);
1848 	rt2x00_set_field32(&word, TXD_W0_OWNER_NIC, 1);
1849 	rt2x00_set_field32(&word, TXD_W0_VALID, 1);
1850 	rt2x00_set_field32(&word, TXD_W0_MORE_FRAG,
1851 			   test_bit(ENTRY_TXD_MORE_FRAG, &txdesc->flags));
1852 	rt2x00_set_field32(&word, TXD_W0_ACK,
1853 			   test_bit(ENTRY_TXD_ACK, &txdesc->flags));
1854 	rt2x00_set_field32(&word, TXD_W0_TIMESTAMP,
1855 			   test_bit(ENTRY_TXD_REQ_TIMESTAMP, &txdesc->flags));
1856 	rt2x00_set_field32(&word, TXD_W0_OFDM,
1857 			   (txdesc->rate_mode == RATE_MODE_OFDM));
1858 	rt2x00_set_field32(&word, TXD_W0_IFS, txdesc->u.plcp.ifs);
1859 	rt2x00_set_field32(&word, TXD_W0_RETRY_MODE,
1860 			   test_bit(ENTRY_TXD_RETRY_MODE, &txdesc->flags));
1861 	rt2x00_set_field32(&word, TXD_W0_TKIP_MIC,
1862 			   test_bit(ENTRY_TXD_ENCRYPT_MMIC, &txdesc->flags));
1863 	rt2x00_set_field32(&word, TXD_W0_KEY_TABLE,
1864 			   test_bit(ENTRY_TXD_ENCRYPT_PAIRWISE, &txdesc->flags));
1865 	rt2x00_set_field32(&word, TXD_W0_KEY_INDEX, txdesc->key_idx);
1866 	rt2x00_set_field32(&word, TXD_W0_DATABYTE_COUNT, txdesc->length);
1867 	rt2x00_set_field32(&word, TXD_W0_BURST,
1868 			   test_bit(ENTRY_TXD_BURST, &txdesc->flags));
1869 	rt2x00_set_field32(&word, TXD_W0_CIPHER_ALG, txdesc->cipher);
1870 	rt2x00_desc_write(txd, 0, word);
1871 
1872 	/*
1873 	 * Register descriptor details in skb frame descriptor.
1874 	 */
1875 	skbdesc->desc = txd;
1876 	skbdesc->desc_len = (entry->queue->qid == QID_BEACON) ? TXINFO_SIZE :
1877 			    TXD_DESC_SIZE;
1878 }
1879 
1880 /*
1881  * TX data initialization
1882  */
1883 static void rt61pci_write_beacon(struct queue_entry *entry,
1884 				 struct txentry_desc *txdesc)
1885 {
1886 	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
1887 	struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
1888 	unsigned int beacon_base;
1889 	unsigned int padding_len;
1890 	u32 orig_reg, reg;
1891 
1892 	/*
1893 	 * Disable beaconing while we are reloading the beacon data,
1894 	 * otherwise we might be sending out invalid data.
1895 	 */
1896 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
1897 	orig_reg = reg;
1898 	rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
1899 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
1900 
1901 	/*
1902 	 * Write the TX descriptor for the beacon.
1903 	 */
1904 	rt61pci_write_tx_desc(entry, txdesc);
1905 
1906 	/*
1907 	 * Dump beacon to userspace through debugfs.
1908 	 */
1909 	rt2x00debug_dump_frame(rt2x00dev, DUMP_FRAME_BEACON, entry);
1910 
1911 	/*
1912 	 * Write entire beacon with descriptor and padding to register.
1913 	 */
1914 	padding_len = roundup(entry->skb->len, 4) - entry->skb->len;
1915 	if (padding_len && skb_pad(entry->skb, padding_len)) {
1916 		rt2x00_err(rt2x00dev, "Failure padding beacon, aborting\n");
1917 		/* skb freed by skb_pad() on failure */
1918 		entry->skb = NULL;
1919 		rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
1920 		return;
1921 	}
1922 
1923 	beacon_base = HW_BEACON_OFFSET(entry->entry_idx);
1924 	rt2x00mmio_register_multiwrite(rt2x00dev, beacon_base,
1925 				       entry_priv->desc, TXINFO_SIZE);
1926 	rt2x00mmio_register_multiwrite(rt2x00dev, beacon_base + TXINFO_SIZE,
1927 				       entry->skb->data,
1928 				       entry->skb->len + padding_len);
1929 
1930 	/*
1931 	 * Enable beaconing again.
1932 	 *
1933 	 * For Wi-Fi faily generated beacons between participating
1934 	 * stations. Set TBTT phase adaptive adjustment step to 8us.
1935 	 */
1936 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR10, 0x00001008);
1937 
1938 	rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 1);
1939 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
1940 
1941 	/*
1942 	 * Clean up beacon skb.
1943 	 */
1944 	dev_kfree_skb_any(entry->skb);
1945 	entry->skb = NULL;
1946 }
1947 
1948 static void rt61pci_clear_beacon(struct queue_entry *entry)
1949 {
1950 	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
1951 	u32 orig_reg, reg;
1952 
1953 	/*
1954 	 * Disable beaconing while we are reloading the beacon data,
1955 	 * otherwise we might be sending out invalid data.
1956 	 */
1957 	orig_reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR9);
1958 	reg = orig_reg;
1959 	rt2x00_set_field32(&reg, TXRX_CSR9_BEACON_GEN, 0);
1960 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, reg);
1961 
1962 	/*
1963 	 * Clear beacon.
1964 	 */
1965 	rt2x00mmio_register_write(rt2x00dev,
1966 				  HW_BEACON_OFFSET(entry->entry_idx), 0);
1967 
1968 	/*
1969 	 * Restore global beaconing state.
1970 	 */
1971 	rt2x00mmio_register_write(rt2x00dev, TXRX_CSR9, orig_reg);
1972 }
1973 
1974 /*
1975  * RX control handlers
1976  */
1977 static int rt61pci_agc_to_rssi(struct rt2x00_dev *rt2x00dev, int rxd_w1)
1978 {
1979 	u8 offset = rt2x00dev->lna_gain;
1980 	u8 lna;
1981 
1982 	lna = rt2x00_get_field32(rxd_w1, RXD_W1_RSSI_LNA);
1983 	switch (lna) {
1984 	case 3:
1985 		offset += 90;
1986 		break;
1987 	case 2:
1988 		offset += 74;
1989 		break;
1990 	case 1:
1991 		offset += 64;
1992 		break;
1993 	default:
1994 		return 0;
1995 	}
1996 
1997 	if (rt2x00dev->curr_band == NL80211_BAND_5GHZ) {
1998 		if (lna == 3 || lna == 2)
1999 			offset += 10;
2000 	}
2001 
2002 	return rt2x00_get_field32(rxd_w1, RXD_W1_RSSI_AGC) * 2 - offset;
2003 }
2004 
2005 static void rt61pci_fill_rxdone(struct queue_entry *entry,
2006 				struct rxdone_entry_desc *rxdesc)
2007 {
2008 	struct rt2x00_dev *rt2x00dev = entry->queue->rt2x00dev;
2009 	struct queue_entry_priv_mmio *entry_priv = entry->priv_data;
2010 	u32 word0;
2011 	u32 word1;
2012 
2013 	word0 = rt2x00_desc_read(entry_priv->desc, 0);
2014 	word1 = rt2x00_desc_read(entry_priv->desc, 1);
2015 
2016 	if (rt2x00_get_field32(word0, RXD_W0_CRC_ERROR))
2017 		rxdesc->flags |= RX_FLAG_FAILED_FCS_CRC;
2018 
2019 	rxdesc->cipher = rt2x00_get_field32(word0, RXD_W0_CIPHER_ALG);
2020 	rxdesc->cipher_status = rt2x00_get_field32(word0, RXD_W0_CIPHER_ERROR);
2021 
2022 	if (rxdesc->cipher != CIPHER_NONE) {
2023 		rxdesc->iv[0] = _rt2x00_desc_read(entry_priv->desc, 2);
2024 		rxdesc->iv[1] = _rt2x00_desc_read(entry_priv->desc, 3);
2025 		rxdesc->dev_flags |= RXDONE_CRYPTO_IV;
2026 
2027 		rxdesc->icv = _rt2x00_desc_read(entry_priv->desc, 4);
2028 		rxdesc->dev_flags |= RXDONE_CRYPTO_ICV;
2029 
2030 		/*
2031 		 * Hardware has stripped IV/EIV data from 802.11 frame during
2032 		 * decryption. It has provided the data separately but rt2x00lib
2033 		 * should decide if it should be reinserted.
2034 		 */
2035 		rxdesc->flags |= RX_FLAG_IV_STRIPPED;
2036 
2037 		/*
2038 		 * The hardware has already checked the Michael Mic and has
2039 		 * stripped it from the frame. Signal this to mac80211.
2040 		 */
2041 		rxdesc->flags |= RX_FLAG_MMIC_STRIPPED;
2042 
2043 		if (rxdesc->cipher_status == RX_CRYPTO_SUCCESS)
2044 			rxdesc->flags |= RX_FLAG_DECRYPTED;
2045 		else if (rxdesc->cipher_status == RX_CRYPTO_FAIL_MIC)
2046 			rxdesc->flags |= RX_FLAG_MMIC_ERROR;
2047 	}
2048 
2049 	/*
2050 	 * Obtain the status about this packet.
2051 	 * When frame was received with an OFDM bitrate,
2052 	 * the signal is the PLCP value. If it was received with
2053 	 * a CCK bitrate the signal is the rate in 100kbit/s.
2054 	 */
2055 	rxdesc->signal = rt2x00_get_field32(word1, RXD_W1_SIGNAL);
2056 	rxdesc->rssi = rt61pci_agc_to_rssi(rt2x00dev, word1);
2057 	rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
2058 
2059 	if (rt2x00_get_field32(word0, RXD_W0_OFDM))
2060 		rxdesc->dev_flags |= RXDONE_SIGNAL_PLCP;
2061 	else
2062 		rxdesc->dev_flags |= RXDONE_SIGNAL_BITRATE;
2063 	if (rt2x00_get_field32(word0, RXD_W0_MY_BSS))
2064 		rxdesc->dev_flags |= RXDONE_MY_BSS;
2065 }
2066 
2067 /*
2068  * Interrupt functions.
2069  */
2070 static void rt61pci_txdone(struct rt2x00_dev *rt2x00dev)
2071 {
2072 	struct data_queue *queue;
2073 	struct queue_entry *entry;
2074 	struct queue_entry *entry_done;
2075 	struct queue_entry_priv_mmio *entry_priv;
2076 	struct txdone_entry_desc txdesc;
2077 	u32 word;
2078 	u32 reg;
2079 	int type;
2080 	int index;
2081 	int i;
2082 
2083 	/*
2084 	 * TX_STA_FIFO is a stack of X entries, hence read TX_STA_FIFO
2085 	 * at most X times and also stop processing once the TX_STA_FIFO_VALID
2086 	 * flag is not set anymore.
2087 	 *
2088 	 * The legacy drivers use X=TX_RING_SIZE but state in a comment
2089 	 * that the TX_STA_FIFO stack has a size of 16. We stick to our
2090 	 * tx ring size for now.
2091 	 */
2092 	for (i = 0; i < rt2x00dev->tx->limit; i++) {
2093 		reg = rt2x00mmio_register_read(rt2x00dev, STA_CSR4);
2094 		if (!rt2x00_get_field32(reg, STA_CSR4_VALID))
2095 			break;
2096 
2097 		/*
2098 		 * Skip this entry when it contains an invalid
2099 		 * queue identication number.
2100 		 */
2101 		type = rt2x00_get_field32(reg, STA_CSR4_PID_TYPE);
2102 		queue = rt2x00queue_get_tx_queue(rt2x00dev, type);
2103 		if (unlikely(!queue))
2104 			continue;
2105 
2106 		/*
2107 		 * Skip this entry when it contains an invalid
2108 		 * index number.
2109 		 */
2110 		index = rt2x00_get_field32(reg, STA_CSR4_PID_SUBTYPE);
2111 		if (unlikely(index >= queue->limit))
2112 			continue;
2113 
2114 		entry = &queue->entries[index];
2115 		entry_priv = entry->priv_data;
2116 		word = rt2x00_desc_read(entry_priv->desc, 0);
2117 
2118 		if (rt2x00_get_field32(word, TXD_W0_OWNER_NIC) ||
2119 		    !rt2x00_get_field32(word, TXD_W0_VALID))
2120 			return;
2121 
2122 		entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
2123 		while (entry != entry_done) {
2124 			/* Catch up.
2125 			 * Just report any entries we missed as failed.
2126 			 */
2127 			rt2x00_warn(rt2x00dev, "TX status report missed for entry %d\n",
2128 				    entry_done->entry_idx);
2129 
2130 			rt2x00lib_txdone_noinfo(entry_done, TXDONE_UNKNOWN);
2131 			entry_done = rt2x00queue_get_entry(queue, Q_INDEX_DONE);
2132 		}
2133 
2134 		/*
2135 		 * Obtain the status about this packet.
2136 		 */
2137 		txdesc.flags = 0;
2138 		switch (rt2x00_get_field32(reg, STA_CSR4_TX_RESULT)) {
2139 		case 0: /* Success, maybe with retry */
2140 			__set_bit(TXDONE_SUCCESS, &txdesc.flags);
2141 			break;
2142 		case 6: /* Failure, excessive retries */
2143 			__set_bit(TXDONE_EXCESSIVE_RETRY, &txdesc.flags);
2144 			/* Fall through - this is a failed frame! */
2145 		default: /* Failure */
2146 			__set_bit(TXDONE_FAILURE, &txdesc.flags);
2147 		}
2148 		txdesc.retry = rt2x00_get_field32(reg, STA_CSR4_RETRY_COUNT);
2149 
2150 		/*
2151 		 * the frame was retried at least once
2152 		 * -> hw used fallback rates
2153 		 */
2154 		if (txdesc.retry)
2155 			__set_bit(TXDONE_FALLBACK, &txdesc.flags);
2156 
2157 		rt2x00lib_txdone(entry, &txdesc);
2158 	}
2159 }
2160 
2161 static void rt61pci_wakeup(struct rt2x00_dev *rt2x00dev)
2162 {
2163 	struct rt2x00lib_conf libconf = { .conf = &rt2x00dev->hw->conf };
2164 
2165 	rt61pci_config(rt2x00dev, &libconf, IEEE80211_CONF_CHANGE_PS);
2166 }
2167 
2168 static inline void rt61pci_enable_interrupt(struct rt2x00_dev *rt2x00dev,
2169 					    struct rt2x00_field32 irq_field)
2170 {
2171 	u32 reg;
2172 
2173 	/*
2174 	 * Enable a single interrupt. The interrupt mask register
2175 	 * access needs locking.
2176 	 */
2177 	spin_lock_irq(&rt2x00dev->irqmask_lock);
2178 
2179 	reg = rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR);
2180 	rt2x00_set_field32(&reg, irq_field, 0);
2181 	rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
2182 
2183 	spin_unlock_irq(&rt2x00dev->irqmask_lock);
2184 }
2185 
2186 static void rt61pci_enable_mcu_interrupt(struct rt2x00_dev *rt2x00dev,
2187 					 struct rt2x00_field32 irq_field)
2188 {
2189 	u32 reg;
2190 
2191 	/*
2192 	 * Enable a single MCU interrupt. The interrupt mask register
2193 	 * access needs locking.
2194 	 */
2195 	spin_lock_irq(&rt2x00dev->irqmask_lock);
2196 
2197 	reg = rt2x00mmio_register_read(rt2x00dev, MCU_INT_MASK_CSR);
2198 	rt2x00_set_field32(&reg, irq_field, 0);
2199 	rt2x00mmio_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
2200 
2201 	spin_unlock_irq(&rt2x00dev->irqmask_lock);
2202 }
2203 
2204 static void rt61pci_txstatus_tasklet(unsigned long data)
2205 {
2206 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
2207 	rt61pci_txdone(rt2x00dev);
2208 	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
2209 		rt61pci_enable_interrupt(rt2x00dev, INT_MASK_CSR_TXDONE);
2210 }
2211 
2212 static void rt61pci_tbtt_tasklet(unsigned long data)
2213 {
2214 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
2215 	rt2x00lib_beacondone(rt2x00dev);
2216 	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
2217 		rt61pci_enable_interrupt(rt2x00dev, INT_MASK_CSR_BEACON_DONE);
2218 }
2219 
2220 static void rt61pci_rxdone_tasklet(unsigned long data)
2221 {
2222 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
2223 	if (rt2x00mmio_rxdone(rt2x00dev))
2224 		tasklet_schedule(&rt2x00dev->rxdone_tasklet);
2225 	else if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
2226 		rt61pci_enable_interrupt(rt2x00dev, INT_MASK_CSR_RXDONE);
2227 }
2228 
2229 static void rt61pci_autowake_tasklet(unsigned long data)
2230 {
2231 	struct rt2x00_dev *rt2x00dev = (struct rt2x00_dev *)data;
2232 	rt61pci_wakeup(rt2x00dev);
2233 	rt2x00mmio_register_write(rt2x00dev,
2234 				  M2H_CMD_DONE_CSR, 0xffffffff);
2235 	if (test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
2236 		rt61pci_enable_mcu_interrupt(rt2x00dev, MCU_INT_MASK_CSR_TWAKEUP);
2237 }
2238 
2239 static irqreturn_t rt61pci_interrupt(int irq, void *dev_instance)
2240 {
2241 	struct rt2x00_dev *rt2x00dev = dev_instance;
2242 	u32 reg_mcu, mask_mcu;
2243 	u32 reg, mask;
2244 
2245 	/*
2246 	 * Get the interrupt sources & saved to local variable.
2247 	 * Write register value back to clear pending interrupts.
2248 	 */
2249 	reg_mcu = rt2x00mmio_register_read(rt2x00dev, MCU_INT_SOURCE_CSR);
2250 	rt2x00mmio_register_write(rt2x00dev, MCU_INT_SOURCE_CSR, reg_mcu);
2251 
2252 	reg = rt2x00mmio_register_read(rt2x00dev, INT_SOURCE_CSR);
2253 	rt2x00mmio_register_write(rt2x00dev, INT_SOURCE_CSR, reg);
2254 
2255 	if (!reg && !reg_mcu)
2256 		return IRQ_NONE;
2257 
2258 	if (!test_bit(DEVICE_STATE_ENABLED_RADIO, &rt2x00dev->flags))
2259 		return IRQ_HANDLED;
2260 
2261 	/*
2262 	 * Schedule tasklets for interrupt handling.
2263 	 */
2264 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_RXDONE))
2265 		tasklet_schedule(&rt2x00dev->rxdone_tasklet);
2266 
2267 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_TXDONE))
2268 		tasklet_schedule(&rt2x00dev->txstatus_tasklet);
2269 
2270 	if (rt2x00_get_field32(reg, INT_SOURCE_CSR_BEACON_DONE))
2271 		tasklet_hi_schedule(&rt2x00dev->tbtt_tasklet);
2272 
2273 	if (rt2x00_get_field32(reg_mcu, MCU_INT_SOURCE_CSR_TWAKEUP))
2274 		tasklet_schedule(&rt2x00dev->autowake_tasklet);
2275 
2276 	/*
2277 	 * Since INT_MASK_CSR and INT_SOURCE_CSR use the same bits
2278 	 * for interrupts and interrupt masks we can just use the value of
2279 	 * INT_SOURCE_CSR to create the interrupt mask.
2280 	 */
2281 	mask = reg;
2282 	mask_mcu = reg_mcu;
2283 
2284 	/*
2285 	 * Disable all interrupts for which a tasklet was scheduled right now,
2286 	 * the tasklet will reenable the appropriate interrupts.
2287 	 */
2288 	spin_lock(&rt2x00dev->irqmask_lock);
2289 
2290 	reg = rt2x00mmio_register_read(rt2x00dev, INT_MASK_CSR);
2291 	reg |= mask;
2292 	rt2x00mmio_register_write(rt2x00dev, INT_MASK_CSR, reg);
2293 
2294 	reg = rt2x00mmio_register_read(rt2x00dev, MCU_INT_MASK_CSR);
2295 	reg |= mask_mcu;
2296 	rt2x00mmio_register_write(rt2x00dev, MCU_INT_MASK_CSR, reg);
2297 
2298 	spin_unlock(&rt2x00dev->irqmask_lock);
2299 
2300 	return IRQ_HANDLED;
2301 }
2302 
2303 /*
2304  * Device probe functions.
2305  */
2306 static int rt61pci_validate_eeprom(struct rt2x00_dev *rt2x00dev)
2307 {
2308 	struct eeprom_93cx6 eeprom;
2309 	u32 reg;
2310 	u16 word;
2311 	u8 *mac;
2312 	s8 value;
2313 
2314 	reg = rt2x00mmio_register_read(rt2x00dev, E2PROM_CSR);
2315 
2316 	eeprom.data = rt2x00dev;
2317 	eeprom.register_read = rt61pci_eepromregister_read;
2318 	eeprom.register_write = rt61pci_eepromregister_write;
2319 	eeprom.width = rt2x00_get_field32(reg, E2PROM_CSR_TYPE_93C46) ?
2320 	    PCI_EEPROM_WIDTH_93C46 : PCI_EEPROM_WIDTH_93C66;
2321 	eeprom.reg_data_in = 0;
2322 	eeprom.reg_data_out = 0;
2323 	eeprom.reg_data_clock = 0;
2324 	eeprom.reg_chip_select = 0;
2325 
2326 	eeprom_93cx6_multiread(&eeprom, EEPROM_BASE, rt2x00dev->eeprom,
2327 			       EEPROM_SIZE / sizeof(u16));
2328 
2329 	/*
2330 	 * Start validation of the data that has been read.
2331 	 */
2332 	mac = rt2x00_eeprom_addr(rt2x00dev, EEPROM_MAC_ADDR_0);
2333 	rt2x00lib_set_mac_address(rt2x00dev, mac);
2334 
2335 	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);
2336 	if (word == 0xffff) {
2337 		rt2x00_set_field16(&word, EEPROM_ANTENNA_NUM, 2);
2338 		rt2x00_set_field16(&word, EEPROM_ANTENNA_TX_DEFAULT,
2339 				   ANTENNA_B);
2340 		rt2x00_set_field16(&word, EEPROM_ANTENNA_RX_DEFAULT,
2341 				   ANTENNA_B);
2342 		rt2x00_set_field16(&word, EEPROM_ANTENNA_FRAME_TYPE, 0);
2343 		rt2x00_set_field16(&word, EEPROM_ANTENNA_DYN_TXAGC, 0);
2344 		rt2x00_set_field16(&word, EEPROM_ANTENNA_HARDWARE_RADIO, 0);
2345 		rt2x00_set_field16(&word, EEPROM_ANTENNA_RF_TYPE, RF5225);
2346 		rt2x00_eeprom_write(rt2x00dev, EEPROM_ANTENNA, word);
2347 		rt2x00_eeprom_dbg(rt2x00dev, "Antenna: 0x%04x\n", word);
2348 	}
2349 
2350 	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC);
2351 	if (word == 0xffff) {
2352 		rt2x00_set_field16(&word, EEPROM_NIC_ENABLE_DIVERSITY, 0);
2353 		rt2x00_set_field16(&word, EEPROM_NIC_TX_DIVERSITY, 0);
2354 		rt2x00_set_field16(&word, EEPROM_NIC_RX_FIXED, 0);
2355 		rt2x00_set_field16(&word, EEPROM_NIC_TX_FIXED, 0);
2356 		rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_BG, 0);
2357 		rt2x00_set_field16(&word, EEPROM_NIC_CARDBUS_ACCEL, 0);
2358 		rt2x00_set_field16(&word, EEPROM_NIC_EXTERNAL_LNA_A, 0);
2359 		rt2x00_eeprom_write(rt2x00dev, EEPROM_NIC, word);
2360 		rt2x00_eeprom_dbg(rt2x00dev, "NIC: 0x%04x\n", word);
2361 	}
2362 
2363 	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_LED);
2364 	if (word == 0xffff) {
2365 		rt2x00_set_field16(&word, EEPROM_LED_LED_MODE,
2366 				   LED_MODE_DEFAULT);
2367 		rt2x00_eeprom_write(rt2x00dev, EEPROM_LED, word);
2368 		rt2x00_eeprom_dbg(rt2x00dev, "Led: 0x%04x\n", word);
2369 	}
2370 
2371 	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ);
2372 	if (word == 0xffff) {
2373 		rt2x00_set_field16(&word, EEPROM_FREQ_OFFSET, 0);
2374 		rt2x00_set_field16(&word, EEPROM_FREQ_SEQ, 0);
2375 		rt2x00_eeprom_write(rt2x00dev, EEPROM_FREQ, word);
2376 		rt2x00_eeprom_dbg(rt2x00dev, "Freq: 0x%04x\n", word);
2377 	}
2378 
2379 	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_BG);
2380 	if (word == 0xffff) {
2381 		rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_BG_1, 0);
2382 		rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_BG_2, 0);
2383 		rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_OFFSET_BG, word);
2384 		rt2x00_eeprom_dbg(rt2x00dev, "RSSI OFFSET BG: 0x%04x\n", word);
2385 	} else {
2386 		value = rt2x00_get_field16(word, EEPROM_RSSI_OFFSET_BG_1);
2387 		if (value < -10 || value > 10)
2388 			rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_BG_1, 0);
2389 		value = rt2x00_get_field16(word, EEPROM_RSSI_OFFSET_BG_2);
2390 		if (value < -10 || value > 10)
2391 			rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_BG_2, 0);
2392 		rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_OFFSET_BG, word);
2393 	}
2394 
2395 	word = rt2x00_eeprom_read(rt2x00dev, EEPROM_RSSI_OFFSET_A);
2396 	if (word == 0xffff) {
2397 		rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_1, 0);
2398 		rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_2, 0);
2399 		rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_OFFSET_A, word);
2400 		rt2x00_eeprom_dbg(rt2x00dev, "RSSI OFFSET A: 0x%04x\n", word);
2401 	} else {
2402 		value = rt2x00_get_field16(word, EEPROM_RSSI_OFFSET_A_1);
2403 		if (value < -10 || value > 10)
2404 			rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_1, 0);
2405 		value = rt2x00_get_field16(word, EEPROM_RSSI_OFFSET_A_2);
2406 		if (value < -10 || value > 10)
2407 			rt2x00_set_field16(&word, EEPROM_RSSI_OFFSET_A_2, 0);
2408 		rt2x00_eeprom_write(rt2x00dev, EEPROM_RSSI_OFFSET_A, word);
2409 	}
2410 
2411 	return 0;
2412 }
2413 
2414 static int rt61pci_init_eeprom(struct rt2x00_dev *rt2x00dev)
2415 {
2416 	u32 reg;
2417 	u16 value;
2418 	u16 eeprom;
2419 
2420 	/*
2421 	 * Read EEPROM word for configuration.
2422 	 */
2423 	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_ANTENNA);
2424 
2425 	/*
2426 	 * Identify RF chipset.
2427 	 */
2428 	value = rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RF_TYPE);
2429 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR0);
2430 	rt2x00_set_chip(rt2x00dev, rt2x00_get_field32(reg, MAC_CSR0_CHIPSET),
2431 			value, rt2x00_get_field32(reg, MAC_CSR0_REVISION));
2432 
2433 	if (!rt2x00_rf(rt2x00dev, RF5225) &&
2434 	    !rt2x00_rf(rt2x00dev, RF5325) &&
2435 	    !rt2x00_rf(rt2x00dev, RF2527) &&
2436 	    !rt2x00_rf(rt2x00dev, RF2529)) {
2437 		rt2x00_err(rt2x00dev, "Invalid RF chipset detected\n");
2438 		return -ENODEV;
2439 	}
2440 
2441 	/*
2442 	 * Determine number of antennas.
2443 	 */
2444 	if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_NUM) == 2)
2445 		__set_bit(CAPABILITY_DOUBLE_ANTENNA, &rt2x00dev->cap_flags);
2446 
2447 	/*
2448 	 * Identify default antenna configuration.
2449 	 */
2450 	rt2x00dev->default_ant.tx =
2451 	    rt2x00_get_field16(eeprom, EEPROM_ANTENNA_TX_DEFAULT);
2452 	rt2x00dev->default_ant.rx =
2453 	    rt2x00_get_field16(eeprom, EEPROM_ANTENNA_RX_DEFAULT);
2454 
2455 	/*
2456 	 * Read the Frame type.
2457 	 */
2458 	if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_FRAME_TYPE))
2459 		__set_bit(CAPABILITY_FRAME_TYPE, &rt2x00dev->cap_flags);
2460 
2461 	/*
2462 	 * Detect if this device has a hardware controlled radio.
2463 	 */
2464 	if (rt2x00_get_field16(eeprom, EEPROM_ANTENNA_HARDWARE_RADIO))
2465 		__set_bit(CAPABILITY_HW_BUTTON, &rt2x00dev->cap_flags);
2466 
2467 	/*
2468 	 * Read frequency offset and RF programming sequence.
2469 	 */
2470 	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_FREQ);
2471 	if (rt2x00_get_field16(eeprom, EEPROM_FREQ_SEQ))
2472 		__set_bit(CAPABILITY_RF_SEQUENCE, &rt2x00dev->cap_flags);
2473 
2474 	rt2x00dev->freq_offset = rt2x00_get_field16(eeprom, EEPROM_FREQ_OFFSET);
2475 
2476 	/*
2477 	 * Read external LNA informations.
2478 	 */
2479 	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_NIC);
2480 
2481 	if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_A))
2482 		__set_bit(CAPABILITY_EXTERNAL_LNA_A, &rt2x00dev->cap_flags);
2483 	if (rt2x00_get_field16(eeprom, EEPROM_NIC_EXTERNAL_LNA_BG))
2484 		__set_bit(CAPABILITY_EXTERNAL_LNA_BG, &rt2x00dev->cap_flags);
2485 
2486 	/*
2487 	 * When working with a RF2529 chip without double antenna,
2488 	 * the antenna settings should be gathered from the NIC
2489 	 * eeprom word.
2490 	 */
2491 	if (rt2x00_rf(rt2x00dev, RF2529) &&
2492 	    !rt2x00_has_cap_double_antenna(rt2x00dev)) {
2493 		rt2x00dev->default_ant.rx =
2494 		    ANTENNA_A + rt2x00_get_field16(eeprom, EEPROM_NIC_RX_FIXED);
2495 		rt2x00dev->default_ant.tx =
2496 		    ANTENNA_B - rt2x00_get_field16(eeprom, EEPROM_NIC_TX_FIXED);
2497 
2498 		if (rt2x00_get_field16(eeprom, EEPROM_NIC_TX_DIVERSITY))
2499 			rt2x00dev->default_ant.tx = ANTENNA_SW_DIVERSITY;
2500 		if (rt2x00_get_field16(eeprom, EEPROM_NIC_ENABLE_DIVERSITY))
2501 			rt2x00dev->default_ant.rx = ANTENNA_SW_DIVERSITY;
2502 	}
2503 
2504 	/*
2505 	 * Store led settings, for correct led behaviour.
2506 	 * If the eeprom value is invalid,
2507 	 * switch to default led mode.
2508 	 */
2509 #ifdef CONFIG_RT2X00_LIB_LEDS
2510 	eeprom = rt2x00_eeprom_read(rt2x00dev, EEPROM_LED);
2511 	value = rt2x00_get_field16(eeprom, EEPROM_LED_LED_MODE);
2512 
2513 	rt61pci_init_led(rt2x00dev, &rt2x00dev->led_radio, LED_TYPE_RADIO);
2514 	rt61pci_init_led(rt2x00dev, &rt2x00dev->led_assoc, LED_TYPE_ASSOC);
2515 	if (value == LED_MODE_SIGNAL_STRENGTH)
2516 		rt61pci_init_led(rt2x00dev, &rt2x00dev->led_qual,
2517 				 LED_TYPE_QUALITY);
2518 
2519 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_LED_MODE, value);
2520 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_0,
2521 			   rt2x00_get_field16(eeprom,
2522 					      EEPROM_LED_POLARITY_GPIO_0));
2523 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_1,
2524 			   rt2x00_get_field16(eeprom,
2525 					      EEPROM_LED_POLARITY_GPIO_1));
2526 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_2,
2527 			   rt2x00_get_field16(eeprom,
2528 					      EEPROM_LED_POLARITY_GPIO_2));
2529 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_3,
2530 			   rt2x00_get_field16(eeprom,
2531 					      EEPROM_LED_POLARITY_GPIO_3));
2532 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_GPIO_4,
2533 			   rt2x00_get_field16(eeprom,
2534 					      EEPROM_LED_POLARITY_GPIO_4));
2535 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_ACT,
2536 			   rt2x00_get_field16(eeprom, EEPROM_LED_POLARITY_ACT));
2537 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_READY_BG,
2538 			   rt2x00_get_field16(eeprom,
2539 					      EEPROM_LED_POLARITY_RDY_G));
2540 	rt2x00_set_field16(&rt2x00dev->led_mcu_reg, MCU_LEDCS_POLARITY_READY_A,
2541 			   rt2x00_get_field16(eeprom,
2542 					      EEPROM_LED_POLARITY_RDY_A));
2543 #endif /* CONFIG_RT2X00_LIB_LEDS */
2544 
2545 	return 0;
2546 }
2547 
2548 /*
2549  * RF value list for RF5225 & RF5325
2550  * Supports: 2.4 GHz & 5.2 GHz, rf_sequence disabled
2551  */
2552 static const struct rf_channel rf_vals_noseq[] = {
2553 	{ 1,  0x00002ccc, 0x00004786, 0x00068455, 0x000ffa0b },
2554 	{ 2,  0x00002ccc, 0x00004786, 0x00068455, 0x000ffa1f },
2555 	{ 3,  0x00002ccc, 0x0000478a, 0x00068455, 0x000ffa0b },
2556 	{ 4,  0x00002ccc, 0x0000478a, 0x00068455, 0x000ffa1f },
2557 	{ 5,  0x00002ccc, 0x0000478e, 0x00068455, 0x000ffa0b },
2558 	{ 6,  0x00002ccc, 0x0000478e, 0x00068455, 0x000ffa1f },
2559 	{ 7,  0x00002ccc, 0x00004792, 0x00068455, 0x000ffa0b },
2560 	{ 8,  0x00002ccc, 0x00004792, 0x00068455, 0x000ffa1f },
2561 	{ 9,  0x00002ccc, 0x00004796, 0x00068455, 0x000ffa0b },
2562 	{ 10, 0x00002ccc, 0x00004796, 0x00068455, 0x000ffa1f },
2563 	{ 11, 0x00002ccc, 0x0000479a, 0x00068455, 0x000ffa0b },
2564 	{ 12, 0x00002ccc, 0x0000479a, 0x00068455, 0x000ffa1f },
2565 	{ 13, 0x00002ccc, 0x0000479e, 0x00068455, 0x000ffa0b },
2566 	{ 14, 0x00002ccc, 0x000047a2, 0x00068455, 0x000ffa13 },
2567 
2568 	/* 802.11 UNI / HyperLan 2 */
2569 	{ 36, 0x00002ccc, 0x0000499a, 0x0009be55, 0x000ffa23 },
2570 	{ 40, 0x00002ccc, 0x000049a2, 0x0009be55, 0x000ffa03 },
2571 	{ 44, 0x00002ccc, 0x000049a6, 0x0009be55, 0x000ffa0b },
2572 	{ 48, 0x00002ccc, 0x000049aa, 0x0009be55, 0x000ffa13 },
2573 	{ 52, 0x00002ccc, 0x000049ae, 0x0009ae55, 0x000ffa1b },
2574 	{ 56, 0x00002ccc, 0x000049b2, 0x0009ae55, 0x000ffa23 },
2575 	{ 60, 0x00002ccc, 0x000049ba, 0x0009ae55, 0x000ffa03 },
2576 	{ 64, 0x00002ccc, 0x000049be, 0x0009ae55, 0x000ffa0b },
2577 
2578 	/* 802.11 HyperLan 2 */
2579 	{ 100, 0x00002ccc, 0x00004a2a, 0x000bae55, 0x000ffa03 },
2580 	{ 104, 0x00002ccc, 0x00004a2e, 0x000bae55, 0x000ffa0b },
2581 	{ 108, 0x00002ccc, 0x00004a32, 0x000bae55, 0x000ffa13 },
2582 	{ 112, 0x00002ccc, 0x00004a36, 0x000bae55, 0x000ffa1b },
2583 	{ 116, 0x00002ccc, 0x00004a3a, 0x000bbe55, 0x000ffa23 },
2584 	{ 120, 0x00002ccc, 0x00004a82, 0x000bbe55, 0x000ffa03 },
2585 	{ 124, 0x00002ccc, 0x00004a86, 0x000bbe55, 0x000ffa0b },
2586 	{ 128, 0x00002ccc, 0x00004a8a, 0x000bbe55, 0x000ffa13 },
2587 	{ 132, 0x00002ccc, 0x00004a8e, 0x000bbe55, 0x000ffa1b },
2588 	{ 136, 0x00002ccc, 0x00004a92, 0x000bbe55, 0x000ffa23 },
2589 
2590 	/* 802.11 UNII */
2591 	{ 140, 0x00002ccc, 0x00004a9a, 0x000bbe55, 0x000ffa03 },
2592 	{ 149, 0x00002ccc, 0x00004aa2, 0x000bbe55, 0x000ffa1f },
2593 	{ 153, 0x00002ccc, 0x00004aa6, 0x000bbe55, 0x000ffa27 },
2594 	{ 157, 0x00002ccc, 0x00004aae, 0x000bbe55, 0x000ffa07 },
2595 	{ 161, 0x00002ccc, 0x00004ab2, 0x000bbe55, 0x000ffa0f },
2596 	{ 165, 0x00002ccc, 0x00004ab6, 0x000bbe55, 0x000ffa17 },
2597 
2598 	/* MMAC(Japan)J52 ch 34,38,42,46 */
2599 	{ 34, 0x00002ccc, 0x0000499a, 0x0009be55, 0x000ffa0b },
2600 	{ 38, 0x00002ccc, 0x0000499e, 0x0009be55, 0x000ffa13 },
2601 	{ 42, 0x00002ccc, 0x000049a2, 0x0009be55, 0x000ffa1b },
2602 	{ 46, 0x00002ccc, 0x000049a6, 0x0009be55, 0x000ffa23 },
2603 };
2604 
2605 /*
2606  * RF value list for RF5225 & RF5325
2607  * Supports: 2.4 GHz & 5.2 GHz, rf_sequence enabled
2608  */
2609 static const struct rf_channel rf_vals_seq[] = {
2610 	{ 1,  0x00002ccc, 0x00004786, 0x00068455, 0x000ffa0b },
2611 	{ 2,  0x00002ccc, 0x00004786, 0x00068455, 0x000ffa1f },
2612 	{ 3,  0x00002ccc, 0x0000478a, 0x00068455, 0x000ffa0b },
2613 	{ 4,  0x00002ccc, 0x0000478a, 0x00068455, 0x000ffa1f },
2614 	{ 5,  0x00002ccc, 0x0000478e, 0x00068455, 0x000ffa0b },
2615 	{ 6,  0x00002ccc, 0x0000478e, 0x00068455, 0x000ffa1f },
2616 	{ 7,  0x00002ccc, 0x00004792, 0x00068455, 0x000ffa0b },
2617 	{ 8,  0x00002ccc, 0x00004792, 0x00068455, 0x000ffa1f },
2618 	{ 9,  0x00002ccc, 0x00004796, 0x00068455, 0x000ffa0b },
2619 	{ 10, 0x00002ccc, 0x00004796, 0x00068455, 0x000ffa1f },
2620 	{ 11, 0x00002ccc, 0x0000479a, 0x00068455, 0x000ffa0b },
2621 	{ 12, 0x00002ccc, 0x0000479a, 0x00068455, 0x000ffa1f },
2622 	{ 13, 0x00002ccc, 0x0000479e, 0x00068455, 0x000ffa0b },
2623 	{ 14, 0x00002ccc, 0x000047a2, 0x00068455, 0x000ffa13 },
2624 
2625 	/* 802.11 UNI / HyperLan 2 */
2626 	{ 36, 0x00002cd4, 0x0004481a, 0x00098455, 0x000c0a03 },
2627 	{ 40, 0x00002cd0, 0x00044682, 0x00098455, 0x000c0a03 },
2628 	{ 44, 0x00002cd0, 0x00044686, 0x00098455, 0x000c0a1b },
2629 	{ 48, 0x00002cd0, 0x0004468e, 0x00098655, 0x000c0a0b },
2630 	{ 52, 0x00002cd0, 0x00044692, 0x00098855, 0x000c0a23 },
2631 	{ 56, 0x00002cd0, 0x0004469a, 0x00098c55, 0x000c0a13 },
2632 	{ 60, 0x00002cd0, 0x000446a2, 0x00098e55, 0x000c0a03 },
2633 	{ 64, 0x00002cd0, 0x000446a6, 0x00099255, 0x000c0a1b },
2634 
2635 	/* 802.11 HyperLan 2 */
2636 	{ 100, 0x00002cd4, 0x0004489a, 0x000b9855, 0x000c0a03 },
2637 	{ 104, 0x00002cd4, 0x000448a2, 0x000b9855, 0x000c0a03 },
2638 	{ 108, 0x00002cd4, 0x000448aa, 0x000b9855, 0x000c0a03 },
2639 	{ 112, 0x00002cd4, 0x000448b2, 0x000b9a55, 0x000c0a03 },
2640 	{ 116, 0x00002cd4, 0x000448ba, 0x000b9a55, 0x000c0a03 },
2641 	{ 120, 0x00002cd0, 0x00044702, 0x000b9a55, 0x000c0a03 },
2642 	{ 124, 0x00002cd0, 0x00044706, 0x000b9a55, 0x000c0a1b },
2643 	{ 128, 0x00002cd0, 0x0004470e, 0x000b9c55, 0x000c0a0b },
2644 	{ 132, 0x00002cd0, 0x00044712, 0x000b9c55, 0x000c0a23 },
2645 	{ 136, 0x00002cd0, 0x0004471a, 0x000b9e55, 0x000c0a13 },
2646 
2647 	/* 802.11 UNII */
2648 	{ 140, 0x00002cd0, 0x00044722, 0x000b9e55, 0x000c0a03 },
2649 	{ 149, 0x00002cd0, 0x0004472e, 0x000ba255, 0x000c0a1b },
2650 	{ 153, 0x00002cd0, 0x00044736, 0x000ba255, 0x000c0a0b },
2651 	{ 157, 0x00002cd4, 0x0004490a, 0x000ba255, 0x000c0a17 },
2652 	{ 161, 0x00002cd4, 0x00044912, 0x000ba255, 0x000c0a17 },
2653 	{ 165, 0x00002cd4, 0x0004491a, 0x000ba255, 0x000c0a17 },
2654 
2655 	/* MMAC(Japan)J52 ch 34,38,42,46 */
2656 	{ 34, 0x00002ccc, 0x0000499a, 0x0009be55, 0x000c0a0b },
2657 	{ 38, 0x00002ccc, 0x0000499e, 0x0009be55, 0x000c0a13 },
2658 	{ 42, 0x00002ccc, 0x000049a2, 0x0009be55, 0x000c0a1b },
2659 	{ 46, 0x00002ccc, 0x000049a6, 0x0009be55, 0x000c0a23 },
2660 };
2661 
2662 static int rt61pci_probe_hw_mode(struct rt2x00_dev *rt2x00dev)
2663 {
2664 	struct hw_mode_spec *spec = &rt2x00dev->spec;
2665 	struct channel_info *info;
2666 	char *tx_power;
2667 	unsigned int i;
2668 
2669 	/*
2670 	 * Disable powersaving as default.
2671 	 */
2672 	rt2x00dev->hw->wiphy->flags &= ~WIPHY_FLAG_PS_ON_BY_DEFAULT;
2673 
2674 	/*
2675 	 * Initialize all hw fields.
2676 	 */
2677 	ieee80211_hw_set(rt2x00dev->hw, PS_NULLFUNC_STACK);
2678 	ieee80211_hw_set(rt2x00dev->hw, SUPPORTS_PS);
2679 	ieee80211_hw_set(rt2x00dev->hw, HOST_BROADCAST_PS_BUFFERING);
2680 	ieee80211_hw_set(rt2x00dev->hw, SIGNAL_DBM);
2681 
2682 	SET_IEEE80211_DEV(rt2x00dev->hw, rt2x00dev->dev);
2683 	SET_IEEE80211_PERM_ADDR(rt2x00dev->hw,
2684 				rt2x00_eeprom_addr(rt2x00dev,
2685 						   EEPROM_MAC_ADDR_0));
2686 
2687 	/*
2688 	 * As rt61 has a global fallback table we cannot specify
2689 	 * more then one tx rate per frame but since the hw will
2690 	 * try several rates (based on the fallback table) we should
2691 	 * initialize max_report_rates to the maximum number of rates
2692 	 * we are going to try. Otherwise mac80211 will truncate our
2693 	 * reported tx rates and the rc algortihm will end up with
2694 	 * incorrect data.
2695 	 */
2696 	rt2x00dev->hw->max_rates = 1;
2697 	rt2x00dev->hw->max_report_rates = 7;
2698 	rt2x00dev->hw->max_rate_tries = 1;
2699 
2700 	/*
2701 	 * Initialize hw_mode information.
2702 	 */
2703 	spec->supported_bands = SUPPORT_BAND_2GHZ;
2704 	spec->supported_rates = SUPPORT_RATE_CCK | SUPPORT_RATE_OFDM;
2705 
2706 	if (!rt2x00_has_cap_rf_sequence(rt2x00dev)) {
2707 		spec->num_channels = 14;
2708 		spec->channels = rf_vals_noseq;
2709 	} else {
2710 		spec->num_channels = 14;
2711 		spec->channels = rf_vals_seq;
2712 	}
2713 
2714 	if (rt2x00_rf(rt2x00dev, RF5225) || rt2x00_rf(rt2x00dev, RF5325)) {
2715 		spec->supported_bands |= SUPPORT_BAND_5GHZ;
2716 		spec->num_channels = ARRAY_SIZE(rf_vals_seq);
2717 	}
2718 
2719 	/*
2720 	 * Create channel information array
2721 	 */
2722 	info = kcalloc(spec->num_channels, sizeof(*info), GFP_KERNEL);
2723 	if (!info)
2724 		return -ENOMEM;
2725 
2726 	spec->channels_info = info;
2727 
2728 	tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_G_START);
2729 	for (i = 0; i < 14; i++) {
2730 		info[i].max_power = MAX_TXPOWER;
2731 		info[i].default_power1 = TXPOWER_FROM_DEV(tx_power[i]);
2732 	}
2733 
2734 	if (spec->num_channels > 14) {
2735 		tx_power = rt2x00_eeprom_addr(rt2x00dev, EEPROM_TXPOWER_A_START);
2736 		for (i = 14; i < spec->num_channels; i++) {
2737 			info[i].max_power = MAX_TXPOWER;
2738 			info[i].default_power1 =
2739 					TXPOWER_FROM_DEV(tx_power[i - 14]);
2740 		}
2741 	}
2742 
2743 	return 0;
2744 }
2745 
2746 static int rt61pci_probe_hw(struct rt2x00_dev *rt2x00dev)
2747 {
2748 	int retval;
2749 	u32 reg;
2750 
2751 	/*
2752 	 * Disable power saving.
2753 	 */
2754 	rt2x00mmio_register_write(rt2x00dev, SOFT_RESET_CSR, 0x00000007);
2755 
2756 	/*
2757 	 * Allocate eeprom data.
2758 	 */
2759 	retval = rt61pci_validate_eeprom(rt2x00dev);
2760 	if (retval)
2761 		return retval;
2762 
2763 	retval = rt61pci_init_eeprom(rt2x00dev);
2764 	if (retval)
2765 		return retval;
2766 
2767 	/*
2768 	 * Enable rfkill polling by setting GPIO direction of the
2769 	 * rfkill switch GPIO pin correctly.
2770 	 */
2771 	reg = rt2x00mmio_register_read(rt2x00dev, MAC_CSR13);
2772 	rt2x00_set_field32(&reg, MAC_CSR13_DIR5, 1);
2773 	rt2x00mmio_register_write(rt2x00dev, MAC_CSR13, reg);
2774 
2775 	/*
2776 	 * Initialize hw specifications.
2777 	 */
2778 	retval = rt61pci_probe_hw_mode(rt2x00dev);
2779 	if (retval)
2780 		return retval;
2781 
2782 	/*
2783 	 * This device has multiple filters for control frames,
2784 	 * but has no a separate filter for PS Poll frames.
2785 	 */
2786 	__set_bit(CAPABILITY_CONTROL_FILTERS, &rt2x00dev->cap_flags);
2787 
2788 	/*
2789 	 * This device requires firmware and DMA mapped skbs.
2790 	 */
2791 	__set_bit(REQUIRE_FIRMWARE, &rt2x00dev->cap_flags);
2792 	__set_bit(REQUIRE_DMA, &rt2x00dev->cap_flags);
2793 	if (!modparam_nohwcrypt)
2794 		__set_bit(CAPABILITY_HW_CRYPTO, &rt2x00dev->cap_flags);
2795 	__set_bit(CAPABILITY_LINK_TUNING, &rt2x00dev->cap_flags);
2796 
2797 	/*
2798 	 * Set the rssi offset.
2799 	 */
2800 	rt2x00dev->rssi_offset = DEFAULT_RSSI_OFFSET;
2801 
2802 	return 0;
2803 }
2804 
2805 /*
2806  * IEEE80211 stack callback functions.
2807  */
2808 static int rt61pci_conf_tx(struct ieee80211_hw *hw,
2809 			   struct ieee80211_vif *vif, u16 queue_idx,
2810 			   const struct ieee80211_tx_queue_params *params)
2811 {
2812 	struct rt2x00_dev *rt2x00dev = hw->priv;
2813 	struct data_queue *queue;
2814 	struct rt2x00_field32 field;
2815 	int retval;
2816 	u32 reg;
2817 	u32 offset;
2818 
2819 	/*
2820 	 * First pass the configuration through rt2x00lib, that will
2821 	 * update the queue settings and validate the input. After that
2822 	 * we are free to update the registers based on the value
2823 	 * in the queue parameter.
2824 	 */
2825 	retval = rt2x00mac_conf_tx(hw, vif, queue_idx, params);
2826 	if (retval)
2827 		return retval;
2828 
2829 	/*
2830 	 * We only need to perform additional register initialization
2831 	 * for WMM queues.
2832 	 */
2833 	if (queue_idx >= 4)
2834 		return 0;
2835 
2836 	queue = rt2x00queue_get_tx_queue(rt2x00dev, queue_idx);
2837 
2838 	/* Update WMM TXOP register */
2839 	offset = AC_TXOP_CSR0 + (sizeof(u32) * (!!(queue_idx & 2)));
2840 	field.bit_offset = (queue_idx & 1) * 16;
2841 	field.bit_mask = 0xffff << field.bit_offset;
2842 
2843 	reg = rt2x00mmio_register_read(rt2x00dev, offset);
2844 	rt2x00_set_field32(&reg, field, queue->txop);
2845 	rt2x00mmio_register_write(rt2x00dev, offset, reg);
2846 
2847 	/* Update WMM registers */
2848 	field.bit_offset = queue_idx * 4;
2849 	field.bit_mask = 0xf << field.bit_offset;
2850 
2851 	reg = rt2x00mmio_register_read(rt2x00dev, AIFSN_CSR);
2852 	rt2x00_set_field32(&reg, field, queue->aifs);
2853 	rt2x00mmio_register_write(rt2x00dev, AIFSN_CSR, reg);
2854 
2855 	reg = rt2x00mmio_register_read(rt2x00dev, CWMIN_CSR);
2856 	rt2x00_set_field32(&reg, field, queue->cw_min);
2857 	rt2x00mmio_register_write(rt2x00dev, CWMIN_CSR, reg);
2858 
2859 	reg = rt2x00mmio_register_read(rt2x00dev, CWMAX_CSR);
2860 	rt2x00_set_field32(&reg, field, queue->cw_max);
2861 	rt2x00mmio_register_write(rt2x00dev, CWMAX_CSR, reg);
2862 
2863 	return 0;
2864 }
2865 
2866 static u64 rt61pci_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif)
2867 {
2868 	struct rt2x00_dev *rt2x00dev = hw->priv;
2869 	u64 tsf;
2870 	u32 reg;
2871 
2872 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR13);
2873 	tsf = (u64) rt2x00_get_field32(reg, TXRX_CSR13_HIGH_TSFTIMER) << 32;
2874 	reg = rt2x00mmio_register_read(rt2x00dev, TXRX_CSR12);
2875 	tsf |= rt2x00_get_field32(reg, TXRX_CSR12_LOW_TSFTIMER);
2876 
2877 	return tsf;
2878 }
2879 
2880 static const struct ieee80211_ops rt61pci_mac80211_ops = {
2881 	.tx			= rt2x00mac_tx,
2882 	.start			= rt2x00mac_start,
2883 	.stop			= rt2x00mac_stop,
2884 	.add_interface		= rt2x00mac_add_interface,
2885 	.remove_interface	= rt2x00mac_remove_interface,
2886 	.config			= rt2x00mac_config,
2887 	.configure_filter	= rt2x00mac_configure_filter,
2888 	.set_key		= rt2x00mac_set_key,
2889 	.sw_scan_start		= rt2x00mac_sw_scan_start,
2890 	.sw_scan_complete	= rt2x00mac_sw_scan_complete,
2891 	.get_stats		= rt2x00mac_get_stats,
2892 	.bss_info_changed	= rt2x00mac_bss_info_changed,
2893 	.conf_tx		= rt61pci_conf_tx,
2894 	.get_tsf		= rt61pci_get_tsf,
2895 	.rfkill_poll		= rt2x00mac_rfkill_poll,
2896 	.flush			= rt2x00mac_flush,
2897 	.set_antenna		= rt2x00mac_set_antenna,
2898 	.get_antenna		= rt2x00mac_get_antenna,
2899 	.get_ringparam		= rt2x00mac_get_ringparam,
2900 	.tx_frames_pending	= rt2x00mac_tx_frames_pending,
2901 };
2902 
2903 static const struct rt2x00lib_ops rt61pci_rt2x00_ops = {
2904 	.irq_handler		= rt61pci_interrupt,
2905 	.txstatus_tasklet	= rt61pci_txstatus_tasklet,
2906 	.tbtt_tasklet		= rt61pci_tbtt_tasklet,
2907 	.rxdone_tasklet		= rt61pci_rxdone_tasklet,
2908 	.autowake_tasklet	= rt61pci_autowake_tasklet,
2909 	.probe_hw		= rt61pci_probe_hw,
2910 	.get_firmware_name	= rt61pci_get_firmware_name,
2911 	.check_firmware		= rt61pci_check_firmware,
2912 	.load_firmware		= rt61pci_load_firmware,
2913 	.initialize		= rt2x00mmio_initialize,
2914 	.uninitialize		= rt2x00mmio_uninitialize,
2915 	.get_entry_state	= rt61pci_get_entry_state,
2916 	.clear_entry		= rt61pci_clear_entry,
2917 	.set_device_state	= rt61pci_set_device_state,
2918 	.rfkill_poll		= rt61pci_rfkill_poll,
2919 	.link_stats		= rt61pci_link_stats,
2920 	.reset_tuner		= rt61pci_reset_tuner,
2921 	.link_tuner		= rt61pci_link_tuner,
2922 	.start_queue		= rt61pci_start_queue,
2923 	.kick_queue		= rt61pci_kick_queue,
2924 	.stop_queue		= rt61pci_stop_queue,
2925 	.flush_queue		= rt2x00mmio_flush_queue,
2926 	.write_tx_desc		= rt61pci_write_tx_desc,
2927 	.write_beacon		= rt61pci_write_beacon,
2928 	.clear_beacon		= rt61pci_clear_beacon,
2929 	.fill_rxdone		= rt61pci_fill_rxdone,
2930 	.config_shared_key	= rt61pci_config_shared_key,
2931 	.config_pairwise_key	= rt61pci_config_pairwise_key,
2932 	.config_filter		= rt61pci_config_filter,
2933 	.config_intf		= rt61pci_config_intf,
2934 	.config_erp		= rt61pci_config_erp,
2935 	.config_ant		= rt61pci_config_ant,
2936 	.config			= rt61pci_config,
2937 };
2938 
2939 static void rt61pci_queue_init(struct data_queue *queue)
2940 {
2941 	switch (queue->qid) {
2942 	case QID_RX:
2943 		queue->limit = 32;
2944 		queue->data_size = DATA_FRAME_SIZE;
2945 		queue->desc_size = RXD_DESC_SIZE;
2946 		queue->priv_size = sizeof(struct queue_entry_priv_mmio);
2947 		break;
2948 
2949 	case QID_AC_VO:
2950 	case QID_AC_VI:
2951 	case QID_AC_BE:
2952 	case QID_AC_BK:
2953 		queue->limit = 32;
2954 		queue->data_size = DATA_FRAME_SIZE;
2955 		queue->desc_size = TXD_DESC_SIZE;
2956 		queue->priv_size = sizeof(struct queue_entry_priv_mmio);
2957 		break;
2958 
2959 	case QID_BEACON:
2960 		queue->limit = 4;
2961 		queue->data_size = 0; /* No DMA required for beacons */
2962 		queue->desc_size = TXINFO_SIZE;
2963 		queue->priv_size = sizeof(struct queue_entry_priv_mmio);
2964 		break;
2965 
2966 	case QID_ATIM:
2967 		/* fallthrough */
2968 	default:
2969 		BUG();
2970 		break;
2971 	}
2972 }
2973 
2974 static const struct rt2x00_ops rt61pci_ops = {
2975 	.name			= KBUILD_MODNAME,
2976 	.max_ap_intf		= 4,
2977 	.eeprom_size		= EEPROM_SIZE,
2978 	.rf_size		= RF_SIZE,
2979 	.tx_queues		= NUM_TX_QUEUES,
2980 	.queue_init		= rt61pci_queue_init,
2981 	.lib			= &rt61pci_rt2x00_ops,
2982 	.hw			= &rt61pci_mac80211_ops,
2983 #ifdef CONFIG_RT2X00_LIB_DEBUGFS
2984 	.debugfs		= &rt61pci_rt2x00debug,
2985 #endif /* CONFIG_RT2X00_LIB_DEBUGFS */
2986 };
2987 
2988 /*
2989  * RT61pci module information.
2990  */
2991 static const struct pci_device_id rt61pci_device_table[] = {
2992 	/* RT2561s */
2993 	{ PCI_DEVICE(0x1814, 0x0301) },
2994 	/* RT2561 v2 */
2995 	{ PCI_DEVICE(0x1814, 0x0302) },
2996 	/* RT2661 */
2997 	{ PCI_DEVICE(0x1814, 0x0401) },
2998 	{ 0, }
2999 };
3000 
3001 MODULE_AUTHOR(DRV_PROJECT);
3002 MODULE_VERSION(DRV_VERSION);
3003 MODULE_DESCRIPTION("Ralink RT61 PCI & PCMCIA Wireless LAN driver.");
3004 MODULE_SUPPORTED_DEVICE("Ralink RT2561, RT2561s & RT2661 "
3005 			"PCI & PCMCIA chipset based cards");
3006 MODULE_DEVICE_TABLE(pci, rt61pci_device_table);
3007 MODULE_FIRMWARE(FIRMWARE_RT2561);
3008 MODULE_FIRMWARE(FIRMWARE_RT2561s);
3009 MODULE_FIRMWARE(FIRMWARE_RT2661);
3010 MODULE_LICENSE("GPL");
3011 
3012 static int rt61pci_probe(struct pci_dev *pci_dev,
3013 			 const struct pci_device_id *id)
3014 {
3015 	return rt2x00pci_probe(pci_dev, &rt61pci_ops);
3016 }
3017 
3018 static struct pci_driver rt61pci_driver = {
3019 	.name		= KBUILD_MODNAME,
3020 	.id_table	= rt61pci_device_table,
3021 	.probe		= rt61pci_probe,
3022 	.remove		= rt2x00pci_remove,
3023 	.suspend	= rt2x00pci_suspend,
3024 	.resume		= rt2x00pci_resume,
3025 };
3026 
3027 module_pci_driver(rt61pci_driver);
3028