diff -urp ral.orig/rt2560.c ral/rt2560.c
--- ral.orig/rt2560.c	2008-01-19 18:44:02 +0800
+++ ral/rt2560.c	2008-01-23 10:03:48 +0800
@@ -150,7 +150,7 @@ static void		rt2560_set_macaddr(struct r
 static void		rt2560_get_macaddr(struct rt2560_softc *, uint8_t *);
 static void		rt2560_update_promisc(struct rt2560_softc *);
 static const char	*rt2560_get_rf(int);
-static void		rt2560_read_eeprom(struct rt2560_softc *);
+static void		rt2560_read_config(struct rt2560_softc *);
 static int		rt2560_bbp_init(struct rt2560_softc *);
 static void		rt2560_set_txantenna(struct rt2560_softc *, int);
 static void		rt2560_set_rxantenna(struct rt2560_softc *, int);
@@ -211,7 +211,7 @@ rt2560_attach(device_t dev, int id)
 	rt2560_get_macaddr(sc, ic->ic_myaddr);
 
 	/* retrieve RF rev. no and various other things from EEPROM */
-	rt2560_read_eeprom(sc);
+	rt2560_read_config(sc);
 
 	device_printf(dev, "MAC/BBP RT2560 (rev 0x%02x), RF %s\n",
 	    sc->asic_rev, rt2560_get_rf(sc->rf_rev));
@@ -1370,8 +1370,10 @@ rt2560_intr(void *arg)
 	if (r & RT2560_DECRYPTION_DONE)
 		rt2560_decryption_intr(sc);
 
-	if (r & RT2560_RX_DONE)
+	if (r & RT2560_RX_DONE) {
 		rt2560_rx_intr(sc);
+		rt2560_encryption_intr(sc);
+	}
 
 	/* re-enable interrupts */
 	RAL_WRITE(sc, RT2560_CSR8, RT2560_INTR_MASK);
@@ -1515,8 +1517,6 @@ rt2560_setup_tx_desc(struct rt2560_softc
 
 	desc->flags = htole32(flags);
 	desc->flags |= htole32(len << 16);
-	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY) :
-	    htole32(RT2560_TX_BUSY | RT2560_TX_VALID);
 
 	desc->physaddr = htole32(physaddr);
 	desc->wme = htole16(
@@ -1548,6 +1548,11 @@ rt2560_setup_tx_desc(struct rt2560_softc
 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 			desc->plcp_signal |= 0x08;
 	}
+
+	if (!encrypt)
+		desc->flags |= htole32(RT2560_TX_VALID);
+	desc->flags |= encrypt ? htole32(RT2560_TX_CIPHER_BUSY)
+			       : htole32(RT2560_TX_BUSY);
 }
 
 static int
@@ -2195,6 +2200,16 @@ rt2560_bbp_read(struct rt2560_softc *sc,
 	uint32_t val;
 	int ntries;
 
+	for (ntries = 0; ntries < 100; ntries++) {
+		if (!(RAL_READ(sc, RT2560_BBPCSR) & RT2560_BBP_BUSY))
+			break;
+		DELAY(1);
+	}
+	if (ntries == 100) {
+		device_printf(sc->sc_dev, "could not read from BBP\n");
+		return 0;
+	}
+
 	val = RT2560_BBP_BUSY | reg << 8;
 	RAL_WRITE(sc, RT2560_BBPCSR, val);
 
@@ -2440,7 +2455,11 @@ rt2560_update_slot(struct ifnet *ifp)
 	uint16_t tx_sifs, tx_pifs, tx_difs, eifs;
 	uint32_t tmp;
 
+#ifdef foo
 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
+#else
+	slottime = 20;
+#endif
 
 	/* update the MAC slot boundaries */
 	tx_sifs = RAL_SIFS - RT2560_TXRX_TURNAROUND;
@@ -2567,7 +2586,7 @@ rt2560_get_rf(int rev)
 }
 
 static void
-rt2560_read_eeprom(struct rt2560_softc *sc)
+rt2560_read_config(struct rt2560_softc *sc)
 {
 	uint16_t val;
 	int i;
@@ -2583,6 +2602,9 @@ rt2560_read_eeprom(struct rt2560_softc *
 	/* read default values for BBP registers */
 	for (i = 0; i < 16; i++) {
 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_BBP_BASE + i);
+		if (val == 0 || val == 0xffff)
+			continue;
+
 		sc->bbp_prom[i].reg = val >> 8;
 		sc->bbp_prom[i].val = val & 0xff;
 	}
@@ -2590,8 +2612,12 @@ rt2560_read_eeprom(struct rt2560_softc *
 	/* read Tx power for all b/g channels */
 	for (i = 0; i < 14 / 2; i++) {
 		val = rt2560_eeprom_read(sc, RT2560_EEPROM_TXPOWER + i);
-		sc->txpow[i * 2] = val >> 8;
-		sc->txpow[i * 2 + 1] = val & 0xff;
+		sc->txpow[i * 2] = val & 0xff;
+		sc->txpow[i * 2 + 1] = val >> 8;
+	}
+	for (i = 0; i < 14; ++i) {
+		if (sc->txpow[i] > 31)
+			sc->txpow[i] = 24;
 	}
 
 	val = rt2560_eeprom_read(sc, RT2560_EEPROM_CALIBRATE);
@@ -2648,14 +2674,14 @@ rt2560_bbp_init(struct rt2560_softc *sc)
 		rt2560_bbp_write(sc, rt2560_def_bbp[i].reg,
 		    rt2560_def_bbp[i].val);
 	}
-#if 0
+
 	/* initialize BBP registers to values stored in EEPROM */
 	for (i = 0; i < 16; i++) {
-		if (sc->bbp_prom[i].reg == 0xff)
-			continue;
+		if (sc->bbp_prom[i].reg == 0 && sc->bbp_prom[i].val == 0)
+			break;
 		rt2560_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
 	}
-#endif
+	rt2560_bbp_write(sc, 17, 0x48);	/* XXX restore bbp17 */
 
 	return 0;
 #undef N
@@ -2752,8 +2778,6 @@ rt2560_init(void *priv)
 	/* set basic rate set (will be updated later) */
 	RAL_WRITE(sc, RT2560_ARSP_PLCP_1, 0x153);
 
-	rt2560_set_txantenna(sc, sc->tx_ant);
-	rt2560_set_rxantenna(sc, sc->rx_ant);
 	rt2560_update_slot(ifp);
 	rt2560_update_plcp(sc);
 	rt2560_update_led(sc, 0, 0);
@@ -2767,6 +2791,9 @@ rt2560_init(void *priv)
 		return;
 	}
 
+	rt2560_set_txantenna(sc, sc->tx_ant);
+	rt2560_set_rxantenna(sc, sc->rx_ant);
+
 	/* set default BSS channel */
 	rt2560_set_chan(sc, ic->ic_curchan);
 
diff -urp ral.orig/rt2560reg.h ral/rt2560reg.h
--- ral.orig/rt2560reg.h	2008-01-19 18:44:49 +0800
+++ ral/rt2560reg.h	2008-01-19 18:44:22 +0800
@@ -333,8 +333,8 @@ struct rt2560_rx_desc {
 	{ RT2560_TXCSR1,      0x07614562 },	\
 	{ RT2560_ARSP_PLCP_0, 0x8c8d8b8a },	\
 	{ RT2560_ACKPCTCSR,   0x7038140a },	\
-	{ RT2560_ARTCSR1,     0x1d21252d },	\
-	{ RT2560_ARTCSR2,     0x1919191d },	\
+	{ RT2560_ARTCSR1,     0x21212929 },	\
+	{ RT2560_ARTCSR2,     0x1d1d1d1d },	\
 	{ RT2560_RXCSR0,      0xffffffff },	\
 	{ RT2560_RXCSR3,      0xb3aab3af },	\
 	{ RT2560_PCICSR,      0x000003b8 },	\