The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/rt2661.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: rt2661.c,v 1.24 2008/04/29 22:21:45 scw Exp $  */
    2 /*      $OpenBSD: rt2661.c,v 1.17 2006/05/01 08:41:11 damien Exp $      */
    3 /*      $FreeBSD: rt2560.c,v 1.5 2006/06/02 19:59:31 csjp Exp $ */
    4 
    5 /*-
    6  * Copyright (c) 2006
    7  *      Damien Bergamini <damien.bergamini@free.fr>
    8  *
    9  * Permission to use, copy, modify, and distribute this software for any
   10  * purpose with or without fee is hereby granted, provided that the above
   11  * copyright notice and this permission notice appear in all copies.
   12  *
   13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   20  */
   21 
   22 /*-
   23  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
   24  * http://www.ralinktech.com/
   25  */
   26 
   27 #include <sys/cdefs.h>
   28 __KERNEL_RCSID(0, "$NetBSD: rt2661.c,v 1.24 2008/04/29 22:21:45 scw Exp $");
   29 
   30 #include "bpfilter.h"
   31 
   32 #include <sys/param.h>
   33 #include <sys/sockio.h>
   34 #include <sys/sysctl.h>
   35 #include <sys/mbuf.h>
   36 #include <sys/kernel.h>
   37 #include <sys/socket.h>
   38 #include <sys/systm.h>
   39 #include <sys/malloc.h>
   40 #include <sys/callout.h>
   41 #include <sys/conf.h>
   42 #include <sys/device.h>
   43 
   44 #include <sys/bus.h>
   45 #include <machine/endian.h>
   46 #include <sys/intr.h>
   47 
   48 #if NBPFILTER > 0
   49 #include <net/bpf.h>
   50 #endif
   51 #include <net/if.h>
   52 #include <net/if_arp.h>
   53 #include <net/if_dl.h>
   54 #include <net/if_media.h>
   55 #include <net/if_types.h>
   56 #include <net/if_ether.h>
   57 
   58 #include <netinet/in.h>
   59 #include <netinet/in_systm.h>
   60 #include <netinet/in_var.h>
   61 #include <netinet/ip.h>
   62 
   63 #include <net80211/ieee80211_var.h>
   64 #include <net80211/ieee80211_amrr.h>
   65 #include <net80211/ieee80211_radiotap.h>
   66 
   67 #include <dev/ic/rt2661reg.h>
   68 #include <dev/ic/rt2661var.h>
   69 
   70 #include <dev/pci/pcireg.h>
   71 #include <dev/pci/pcivar.h>
   72 #include <dev/pci/pcidevs.h>
   73 
   74 #include <dev/firmload.h>
   75 
   76 #ifdef RAL_DEBUG
   77 #define DPRINTF(x)      do { if (rt2661_debug > 0) printf x; } while (0)
   78 #define DPRINTFN(n, x)  do { if (rt2661_debug >= (n)) printf x; } while (0)
   79 int rt2661_debug = 0;
   80 #else
   81 #define DPRINTF(x)
   82 #define DPRINTFN(n, x)
   83 #endif
   84 
   85 static int      rt2661_alloc_tx_ring(struct rt2661_softc *,
   86                     struct rt2661_tx_ring *, int);
   87 static void     rt2661_reset_tx_ring(struct rt2661_softc *,
   88                     struct rt2661_tx_ring *);
   89 static void     rt2661_free_tx_ring(struct rt2661_softc *,
   90                     struct rt2661_tx_ring *);
   91 static int      rt2661_alloc_rx_ring(struct rt2661_softc *,
   92                     struct rt2661_rx_ring *, int);
   93 static void     rt2661_reset_rx_ring(struct rt2661_softc *,
   94                     struct rt2661_rx_ring *);
   95 static void     rt2661_free_rx_ring(struct rt2661_softc *,
   96                     struct rt2661_rx_ring *);
   97 static struct ieee80211_node *
   98                 rt2661_node_alloc(struct ieee80211_node_table *);
   99 static int      rt2661_media_change(struct ifnet *);
  100 static void     rt2661_next_scan(void *);
  101 static void     rt2661_iter_func(void *, struct ieee80211_node *);
  102 static void     rt2661_updatestats(void *);
  103 static void     rt2661_newassoc(struct ieee80211_node *, int);
  104 static int      rt2661_newstate(struct ieee80211com *, enum ieee80211_state,
  105                     int);
  106 static uint16_t rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
  107 static void     rt2661_tx_intr(struct rt2661_softc *);
  108 static void     rt2661_tx_dma_intr(struct rt2661_softc *,
  109                     struct rt2661_tx_ring *);
  110 static void     rt2661_rx_intr(struct rt2661_softc *);
  111 static void     rt2661_mcu_beacon_expire(struct rt2661_softc *);
  112 static void     rt2661_mcu_wakeup(struct rt2661_softc *);
  113 static void     rt2661_mcu_cmd_intr(struct rt2661_softc *);
  114 int             rt2661_intr(void *);
  115 #if NBPFILTER > 0
  116 static uint8_t  rt2661_rxrate(struct rt2661_rx_desc *);
  117 #endif
  118 static int      rt2661_ack_rate(struct ieee80211com *, int);
  119 static uint16_t rt2661_txtime(int, int, uint32_t);
  120 static uint8_t  rt2661_plcp_signal(int);
  121 static void     rt2661_setup_tx_desc(struct rt2661_softc *,
  122                     struct rt2661_tx_desc *, uint32_t, uint16_t, int, int,
  123                     const bus_dma_segment_t *, int, int);
  124 static int      rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
  125                     struct ieee80211_node *);
  126 static struct mbuf *
  127                 rt2661_get_rts(struct rt2661_softc *,
  128                     struct ieee80211_frame *, uint16_t);
  129 static int      rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
  130                     struct ieee80211_node *, int);
  131 static void     rt2661_start(struct ifnet *);
  132 static void     rt2661_watchdog(struct ifnet *);
  133 static int      rt2661_reset(struct ifnet *);
  134 static int      rt2661_ioctl(struct ifnet *, u_long, void *);
  135 static void     rt2661_bbp_write(struct rt2661_softc *, uint8_t, uint8_t);
  136 static uint8_t  rt2661_bbp_read(struct rt2661_softc *, uint8_t);
  137 static void     rt2661_rf_write(struct rt2661_softc *, uint8_t, uint32_t);
  138 static int      rt2661_tx_cmd(struct rt2661_softc *, uint8_t, uint16_t);
  139 static void     rt2661_select_antenna(struct rt2661_softc *);
  140 static void     rt2661_enable_mrr(struct rt2661_softc *);
  141 static void     rt2661_set_txpreamble(struct rt2661_softc *);
  142 static void     rt2661_set_basicrates(struct rt2661_softc *,
  143                         const struct ieee80211_rateset *);
  144 static void     rt2661_select_band(struct rt2661_softc *,
  145                     struct ieee80211_channel *);
  146 static void     rt2661_set_chan(struct rt2661_softc *,
  147                     struct ieee80211_channel *);
  148 static void     rt2661_set_bssid(struct rt2661_softc *, const uint8_t *);
  149 static void     rt2661_set_macaddr(struct rt2661_softc *, const uint8_t *);
  150 static void     rt2661_update_promisc(struct rt2661_softc *);
  151 #if 0
  152 static int      rt2661_wme_update(struct ieee80211com *);
  153 #endif
  154 
  155 static void     rt2661_updateslot(struct ifnet *);
  156 static void     rt2661_set_slottime(struct rt2661_softc *);
  157 static const char *
  158                 rt2661_get_rf(int);
  159 static void     rt2661_read_eeprom(struct rt2661_softc *);
  160 static int      rt2661_bbp_init(struct rt2661_softc *);
  161 static int      rt2661_init(struct ifnet *);
  162 static void     rt2661_stop(struct ifnet *, int);
  163 static int      rt2661_load_microcode(struct rt2661_softc *, const uint8_t *,
  164                     int);
  165 static void     rt2661_rx_tune(struct rt2661_softc *);
  166 #ifdef notyet
  167 static void     rt2661_radar_start(struct rt2661_softc *);
  168 static int      rt2661_radar_stop(struct rt2661_softc *);
  169 #endif
  170 static int      rt2661_prepare_beacon(struct rt2661_softc *);
  171 static void     rt2661_enable_tsf_sync(struct rt2661_softc *);
  172 static int      rt2661_get_rssi(struct rt2661_softc *, uint8_t);
  173 
  174 /*
  175  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
  176  */
  177 static const struct ieee80211_rateset rt2661_rateset_11a =
  178         { 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
  179 
  180 static const struct ieee80211_rateset rt2661_rateset_11b =
  181         { 4, { 2, 4, 11, 22 } };
  182 
  183 static const struct ieee80211_rateset rt2661_rateset_11g =
  184         { 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
  185 
  186 static const struct {
  187         uint32_t        reg;
  188         uint32_t        val;
  189 } rt2661_def_mac[] = {
  190         RT2661_DEF_MAC
  191 };
  192 
  193 static const struct {
  194         uint8_t reg;
  195         uint8_t val;
  196 } rt2661_def_bbp[] = {
  197         RT2661_DEF_BBP
  198 };
  199 
  200 static const struct rfprog {
  201         uint8_t         chan;
  202         uint32_t        r1, r2, r3, r4;
  203 } rt2661_rf5225_1[] = {
  204         RT2661_RF5225_1
  205 }, rt2661_rf5225_2[] = {
  206         RT2661_RF5225_2
  207 };
  208 
  209 int
  210 rt2661_attach(void *xsc, int id)
  211 {
  212         struct rt2661_softc *sc = xsc;
  213         struct ieee80211com *ic = &sc->sc_ic;
  214         struct ifnet *ifp = &sc->sc_if;
  215         uint32_t val;
  216         int error, i, ntries;
  217 
  218         sc->sc_id = id;
  219 
  220         sc->amrr.amrr_min_success_threshold =  1;
  221         sc->amrr.amrr_max_success_threshold = 15;
  222         callout_init(&sc->scan_ch, 0);
  223         callout_init(&sc->amrr_ch, 0);
  224 
  225         /* wait for NIC to initialize */
  226         for (ntries = 0; ntries < 1000; ntries++) {
  227                 if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
  228                         break;
  229                 DELAY(1000);
  230         }
  231         if (ntries == 1000) {
  232                 aprint_error_dev(&sc->sc_dev, "timeout waiting for NIC to initialize\n");
  233                 return EIO;
  234         }
  235 
  236         /* retrieve RF rev. no and various other things from EEPROM */
  237         rt2661_read_eeprom(sc);
  238         aprint_normal_dev(&sc->sc_dev, "802.11 address %s\n",
  239             ether_sprintf(ic->ic_myaddr));
  240 
  241         aprint_normal_dev(&sc->sc_dev, "MAC/BBP RT%X, RF %s\n", val,
  242             rt2661_get_rf(sc->rf_rev));
  243 
  244         /*
  245          * Allocate Tx and Rx rings.
  246          */
  247         error = rt2661_alloc_tx_ring(sc, &sc->txq[0], RT2661_TX_RING_COUNT);
  248         if (error != 0) {
  249                 aprint_error_dev(&sc->sc_dev, "could not allocate Tx ring 0\n");
  250                 goto fail1;
  251         }
  252 
  253         error = rt2661_alloc_tx_ring(sc, &sc->txq[1], RT2661_TX_RING_COUNT);
  254         if (error != 0) {
  255                 aprint_error_dev(&sc->sc_dev, "could not allocate Tx ring 1\n");
  256                 goto fail2;
  257         }
  258 
  259         error = rt2661_alloc_tx_ring(sc, &sc->txq[2], RT2661_TX_RING_COUNT);
  260         if (error != 0) {
  261                 aprint_error_dev(&sc->sc_dev, "could not allocate Tx ring 2\n");
  262                 goto fail3;
  263         }
  264 
  265         error = rt2661_alloc_tx_ring(sc, &sc->txq[3], RT2661_TX_RING_COUNT);
  266         if (error != 0) {
  267                 aprint_error_dev(&sc->sc_dev, "could not allocate Tx ring 3\n");
  268                 goto fail4;
  269         }
  270 
  271         error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
  272         if (error != 0) {
  273                 aprint_error_dev(&sc->sc_dev, "could not allocate Mgt ring\n");
  274                 goto fail5;
  275         }
  276 
  277         error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
  278         if (error != 0) {
  279                 aprint_error_dev(&sc->sc_dev, "could not allocate Rx ring\n");
  280                 goto fail6;
  281         }
  282 
  283         ifp->if_softc = sc;
  284         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
  285         ifp->if_init = rt2661_init;
  286         ifp->if_stop = rt2661_stop;
  287         ifp->if_ioctl = rt2661_ioctl;
  288         ifp->if_start = rt2661_start;
  289         ifp->if_watchdog = rt2661_watchdog;
  290         IFQ_SET_READY(&ifp->if_snd);
  291         memcpy(ifp->if_xname, device_xname(&sc->sc_dev), IFNAMSIZ);
  292 
  293         ic->ic_ifp = ifp;
  294         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
  295         ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
  296         ic->ic_state = IEEE80211_S_INIT;
  297 
  298         /* set device capabilities */
  299         ic->ic_caps =
  300             IEEE80211_C_IBSS |          /* IBSS mode supported */
  301             IEEE80211_C_MONITOR |       /* monitor mode supported */
  302             IEEE80211_C_HOSTAP |        /* HostAP mode supported */
  303             IEEE80211_C_TXPMGT |        /* tx power management */
  304             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
  305             IEEE80211_C_SHSLOT |        /* short slot time supported */
  306             IEEE80211_C_WPA;            /* 802.11i */
  307 
  308         if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
  309                 /* set supported .11a rates */
  310                 ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2661_rateset_11a;
  311 
  312                 /* set supported .11a channels */
  313                 for (i = 36; i <= 64; i += 4) {
  314                         ic->ic_channels[i].ic_freq =
  315                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
  316                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
  317                 }
  318                 for (i = 100; i <= 140; i += 4) {
  319                         ic->ic_channels[i].ic_freq =
  320                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
  321                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
  322                 }
  323                 for (i = 149; i <= 165; i += 4) {
  324                         ic->ic_channels[i].ic_freq =
  325                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
  326                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
  327                 }
  328         }
  329 
  330         /* set supported .11b and .11g rates */
  331         ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2661_rateset_11b;
  332         ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2661_rateset_11g;
  333 
  334         /* set supported .11b and .11g channels (1 through 14) */
  335         for (i = 1; i <= 14; i++) {
  336                 ic->ic_channels[i].ic_freq =
  337                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
  338                 ic->ic_channels[i].ic_flags =
  339                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
  340                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
  341         }
  342 
  343         if_attach(ifp);
  344         ieee80211_ifattach(ic);
  345         ic->ic_node_alloc = rt2661_node_alloc;
  346         ic->ic_newassoc = rt2661_newassoc;
  347         ic->ic_updateslot = rt2661_updateslot;
  348         ic->ic_reset = rt2661_reset;
  349 
  350         /* override state transition machine */
  351         sc->sc_newstate = ic->ic_newstate;
  352         ic->ic_newstate = rt2661_newstate;
  353         ieee80211_media_init(ic, rt2661_media_change, ieee80211_media_status);
  354 
  355 #if NBPFILTER > 0
  356         bpfattach2(ifp, DLT_IEEE802_11_RADIO,
  357             sizeof (struct ieee80211_frame) + sizeof(sc->sc_txtap),
  358             &sc->sc_drvbpf);
  359 
  360         sc->sc_rxtap_len = roundup(sizeof(sc->sc_rxtap), sizeof(u_int32_t));
  361         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
  362         sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2661_RX_RADIOTAP_PRESENT);
  363 
  364         sc->sc_txtap_len = roundup(sizeof(sc->sc_txtap), sizeof(u_int32_t));
  365         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
  366         sc->sc_txtap.wt_ihdr.it_present = htole32(RT2661_TX_RADIOTAP_PRESENT);
  367 #endif
  368 
  369         ieee80211_announce(ic);
  370 
  371         if (!pmf_device_register(&sc->sc_dev, NULL, NULL))
  372                 aprint_error_dev(&sc->sc_dev, "couldn't establish power handler\n");
  373         else
  374                 pmf_class_network_register(&sc->sc_dev, ifp);
  375 
  376         return 0;
  377 
  378 fail6:  rt2661_free_tx_ring(sc, &sc->mgtq);
  379 fail5:  rt2661_free_tx_ring(sc, &sc->txq[3]);
  380 fail4:  rt2661_free_tx_ring(sc, &sc->txq[2]);
  381 fail3:  rt2661_free_tx_ring(sc, &sc->txq[1]);
  382 fail2:  rt2661_free_tx_ring(sc, &sc->txq[0]);
  383 fail1:  return ENXIO;
  384 }
  385 
  386 int
  387 rt2661_detach(void *xsc)
  388 {
  389         struct rt2661_softc *sc = xsc;
  390         struct ifnet *ifp = &sc->sc_if;
  391 
  392         callout_stop(&sc->scan_ch);
  393         callout_stop(&sc->amrr_ch);
  394 
  395         pmf_device_deregister(&sc->sc_dev);
  396 
  397         ieee80211_ifdetach(&sc->sc_ic);
  398         if_detach(ifp);
  399 
  400         rt2661_free_tx_ring(sc, &sc->txq[0]);
  401         rt2661_free_tx_ring(sc, &sc->txq[1]);
  402         rt2661_free_tx_ring(sc, &sc->txq[2]);
  403         rt2661_free_tx_ring(sc, &sc->txq[3]);
  404         rt2661_free_tx_ring(sc, &sc->mgtq);
  405         rt2661_free_rx_ring(sc, &sc->rxq);
  406 
  407         return 0;
  408 }
  409 
  410 static int
  411 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
  412     int count)
  413 {
  414         int i, nsegs, error;
  415 
  416         ring->count = count;
  417         ring->queued = 0;
  418         ring->cur = ring->next = ring->stat = 0;
  419 
  420         error = bus_dmamap_create(sc->sc_dmat, count * RT2661_TX_DESC_SIZE, 1,
  421             count * RT2661_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
  422         if (error != 0) {
  423                 aprint_error_dev(&sc->sc_dev, "could not create desc DMA map\n");
  424                 goto fail;
  425         }
  426 
  427         error = bus_dmamem_alloc(sc->sc_dmat, count * RT2661_TX_DESC_SIZE,
  428             PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
  429         if (error != 0) {
  430                 aprint_error_dev(&sc->sc_dev, "could not allocate DMA memory\n");
  431                 goto fail;
  432         }
  433 
  434         error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
  435             count * RT2661_TX_DESC_SIZE, (void **)&ring->desc,
  436             BUS_DMA_NOWAIT);
  437         if (error != 0) {
  438                 aprint_error_dev(&sc->sc_dev, "could not map desc DMA memory\n");
  439                 goto fail;
  440         }
  441 
  442         error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
  443             count * RT2661_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
  444         if (error != 0) {
  445                 aprint_error_dev(&sc->sc_dev, "could not load desc DMA map\n");
  446                 goto fail;
  447         }
  448 
  449         memset(ring->desc, 0, count * RT2661_TX_DESC_SIZE);
  450         ring->physaddr = ring->map->dm_segs->ds_addr;
  451 
  452         ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
  453             M_NOWAIT);
  454         if (ring->data == NULL) {
  455                 aprint_error_dev(&sc->sc_dev, "could not allocate soft data\n");
  456                 error = ENOMEM;
  457                 goto fail;
  458         }
  459 
  460         memset(ring->data, 0, count * sizeof (struct rt2661_tx_data));
  461         for (i = 0; i < count; i++) {
  462                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
  463                     RT2661_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
  464                     &ring->data[i].map);
  465                 if (error != 0) {
  466                         aprint_error_dev(&sc->sc_dev, "could not create DMA map\n");
  467                         goto fail;
  468                 }
  469         }
  470 
  471         return 0;
  472 
  473 fail:   rt2661_free_tx_ring(sc, ring);
  474         return error;
  475 }
  476 
  477 static void
  478 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  479 {
  480         struct rt2661_tx_desc *desc;
  481         struct rt2661_tx_data *data;
  482         int i;
  483 
  484         for (i = 0; i < ring->count; i++) {
  485                 desc = &ring->desc[i];
  486                 data = &ring->data[i];
  487 
  488                 if (data->m != NULL) {
  489                         bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  490                             data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  491                         bus_dmamap_unload(sc->sc_dmat, data->map);
  492                         m_freem(data->m);
  493                         data->m = NULL;
  494                 }
  495 
  496                 if (data->ni != NULL) {
  497                         ieee80211_free_node(data->ni);
  498                         data->ni = NULL;
  499                 }
  500 
  501                 desc->flags = 0;
  502         }
  503 
  504         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  505             BUS_DMASYNC_PREWRITE);
  506 
  507         ring->queued = 0;
  508         ring->cur = ring->next = ring->stat = 0;
  509 }
  510 
  511 
  512 static void
  513 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  514 {
  515         struct rt2661_tx_data *data;
  516         int i;
  517 
  518         if (ring->desc != NULL) {
  519                 bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
  520                     ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  521                 bus_dmamap_unload(sc->sc_dmat, ring->map);
  522                 bus_dmamem_unmap(sc->sc_dmat, (void *)ring->desc,
  523                     ring->count * RT2661_TX_DESC_SIZE);
  524                 bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
  525         }
  526 
  527         if (ring->data != NULL) {
  528                 for (i = 0; i < ring->count; i++) {
  529                         data = &ring->data[i];
  530 
  531                         if (data->m != NULL) {
  532                                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  533                                     data->map->dm_mapsize,
  534                                     BUS_DMASYNC_POSTWRITE);
  535                                 bus_dmamap_unload(sc->sc_dmat, data->map);
  536                                 m_freem(data->m);
  537                         }
  538 
  539                         if (data->ni != NULL)
  540                                 ieee80211_free_node(data->ni);
  541 
  542                         if (data->map != NULL)
  543                                 bus_dmamap_destroy(sc->sc_dmat, data->map);
  544                 }
  545                 free(ring->data, M_DEVBUF);
  546         }
  547 }
  548 
  549 static int
  550 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
  551     int count)
  552 {
  553         struct rt2661_rx_desc *desc;
  554         struct rt2661_rx_data *data;
  555         int i, nsegs, error;
  556 
  557         ring->count = count;
  558         ring->cur = ring->next = 0;
  559 
  560         error = bus_dmamap_create(sc->sc_dmat, count * RT2661_RX_DESC_SIZE, 1,
  561             count * RT2661_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
  562         if (error != 0) {
  563                 aprint_error_dev(&sc->sc_dev, "could not create desc DMA map\n");
  564                 goto fail;
  565         }
  566 
  567         error = bus_dmamem_alloc(sc->sc_dmat, count * RT2661_RX_DESC_SIZE,
  568             PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
  569         if (error != 0) {
  570                 aprint_error_dev(&sc->sc_dev, "could not allocate DMA memory\n");
  571                 goto fail;
  572         }
  573 
  574         error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
  575             count * RT2661_RX_DESC_SIZE, (void **)&ring->desc,
  576             BUS_DMA_NOWAIT);
  577         if (error != 0) {
  578                 aprint_error_dev(&sc->sc_dev, "could not map desc DMA memory\n");
  579                 goto fail;
  580         }
  581 
  582         error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
  583             count * RT2661_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
  584         if (error != 0) {
  585                 aprint_error_dev(&sc->sc_dev, "could not load desc DMA map\n");
  586                 goto fail;
  587         }
  588 
  589         memset(ring->desc, 0, count * RT2661_RX_DESC_SIZE);
  590         ring->physaddr = ring->map->dm_segs->ds_addr;
  591 
  592         ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
  593             M_NOWAIT);
  594         if (ring->data == NULL) {
  595                 aprint_error_dev(&sc->sc_dev, "could not allocate soft data\n");
  596                 error = ENOMEM;
  597                 goto fail;
  598         }
  599 
  600         /*
  601          * Pre-allocate Rx buffers and populate Rx ring.
  602          */
  603         memset(ring->data, 0, count * sizeof (struct rt2661_rx_data));
  604         for (i = 0; i < count; i++) {
  605                 desc = &sc->rxq.desc[i];
  606                 data = &sc->rxq.data[i];
  607 
  608                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
  609                     0, BUS_DMA_NOWAIT, &data->map);
  610                 if (error != 0) {
  611                         aprint_error_dev(&sc->sc_dev, "could not create DMA map\n");
  612                         goto fail;
  613                 }
  614 
  615                 MGETHDR(data->m, M_DONTWAIT, MT_DATA);
  616                 if (data->m == NULL) {
  617                         aprint_error_dev(&sc->sc_dev, "could not allocate rx mbuf\n");
  618                         error = ENOMEM;
  619                         goto fail;
  620                 }
  621 
  622                 MCLGET(data->m, M_DONTWAIT);
  623                 if (!(data->m->m_flags & M_EXT)) {
  624                         aprint_error_dev(&sc->sc_dev, "could not allocate rx mbuf cluster\n");
  625                         error = ENOMEM;
  626                         goto fail;
  627                 }
  628 
  629                 error = bus_dmamap_load(sc->sc_dmat, data->map,
  630                     mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
  631                 if (error != 0) {
  632                         aprint_error_dev(&sc->sc_dev, "could not load rx buf DMA map");
  633                         goto fail;
  634                 }
  635 
  636                 desc->physaddr = htole32(data->map->dm_segs->ds_addr);
  637                 desc->flags = htole32(RT2661_RX_BUSY);
  638         }
  639 
  640         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  641             BUS_DMASYNC_PREWRITE);
  642 
  643         return 0;
  644 
  645 fail:   rt2661_free_rx_ring(sc, ring);
  646         return error;
  647 }
  648 
  649 static void
  650 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  651 {
  652         int i;
  653 
  654         for (i = 0; i < ring->count; i++)
  655                 ring->desc[i].flags = htole32(RT2661_RX_BUSY);
  656 
  657         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  658             BUS_DMASYNC_PREWRITE);
  659 
  660         ring->cur = ring->next = 0;
  661 }
  662 
  663 static void
  664 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  665 {
  666         struct rt2661_rx_data *data;
  667         int i;
  668 
  669         if (ring->desc != NULL) {
  670                 bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
  671                     ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  672                 bus_dmamap_unload(sc->sc_dmat, ring->map);
  673                 bus_dmamem_unmap(sc->sc_dmat, (void *)ring->desc,
  674                     ring->count * RT2661_RX_DESC_SIZE);
  675                 bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
  676         }
  677 
  678         if (ring->data != NULL) {
  679                 for (i = 0; i < ring->count; i++) {
  680                         data = &ring->data[i];
  681 
  682                         if (data->m != NULL) {
  683                                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  684                                     data->map->dm_mapsize,
  685                                     BUS_DMASYNC_POSTREAD);
  686                                 bus_dmamap_unload(sc->sc_dmat, data->map);
  687                                 m_freem(data->m);
  688                         }
  689 
  690                         if (data->map != NULL)
  691                                 bus_dmamap_destroy(sc->sc_dmat, data->map);
  692                 }
  693                 free(ring->data, M_DEVBUF);
  694         }
  695 }
  696 
  697 static struct ieee80211_node *
  698 rt2661_node_alloc(struct ieee80211_node_table *nt)
  699 {
  700         struct rt2661_node *rn;
  701 
  702         rn = malloc(sizeof (struct rt2661_node), M_80211_NODE,
  703             M_NOWAIT | M_ZERO);
  704 
  705         return (rn != NULL) ? &rn->ni : NULL;
  706 }
  707 
  708 static int
  709 rt2661_media_change(struct ifnet *ifp)
  710 {
  711         int error;
  712 
  713         error = ieee80211_media_change(ifp);
  714         if (error != ENETRESET)
  715                 return error;
  716 
  717         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
  718                 rt2661_init(ifp);
  719 
  720         return 0;
  721 }
  722 
  723 /*
  724  * This function is called periodically (every 200ms) during scanning to
  725  * switch from one channel to another.
  726  */
  727 static void
  728 rt2661_next_scan(void *arg)
  729 {
  730         struct rt2661_softc *sc = arg;
  731         struct ieee80211com *ic = &sc->sc_ic;
  732         int s;
  733 
  734         s = splnet();
  735         if (ic->ic_state == IEEE80211_S_SCAN)
  736                 ieee80211_next_scan(ic);
  737         splx(s);
  738 }
  739 
  740 /*
  741  * This function is called for each neighbor node.
  742  */
  743 static void
  744 rt2661_iter_func(void *arg, struct ieee80211_node *ni)
  745 {
  746         struct rt2661_softc *sc = arg;
  747         struct rt2661_node *rn = (struct rt2661_node *)ni;
  748 
  749         ieee80211_amrr_choose(&sc->amrr, ni, &rn->amn);
  750 }
  751 
  752 /*
  753  * This function is called periodically (every 500ms) in RUN state to update
  754  * various settings like rate control statistics or Rx sensitivity.
  755  */
  756 static void
  757 rt2661_updatestats(void *arg)
  758 {
  759         struct rt2661_softc *sc = arg;
  760         struct ieee80211com *ic = &sc->sc_ic;
  761         int s;
  762 
  763         s = splnet();
  764         if (ic->ic_opmode == IEEE80211_M_STA)
  765                 rt2661_iter_func(sc, ic->ic_bss);
  766         else
  767                 ieee80211_iterate_nodes(&ic->ic_sta, rt2661_iter_func, arg);
  768 
  769         /* update rx sensitivity every 1 sec */
  770         if (++sc->ncalls & 1)
  771                 rt2661_rx_tune(sc);
  772         splx(s);
  773 
  774         callout_reset(&sc->amrr_ch, hz / 2, rt2661_updatestats, sc);
  775 }
  776 
  777 static void
  778 rt2661_newassoc(struct ieee80211_node *ni, int isnew)
  779 {
  780         struct rt2661_softc *sc = ni->ni_ic->ic_ifp->if_softc;
  781         int i;
  782 
  783         ieee80211_amrr_node_init(&sc->amrr, &((struct rt2661_node *)ni)->amn);
  784 
  785         /* set rate to some reasonable initial value */
  786         for (i = ni->ni_rates.rs_nrates - 1;
  787              i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
  788              i--);
  789         ni->ni_txrate = i;
  790 }
  791 
  792 static int
  793 rt2661_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
  794 {
  795         struct rt2661_softc *sc = ic->ic_ifp->if_softc;
  796         enum ieee80211_state ostate;
  797         struct ieee80211_node *ni;
  798         uint32_t tmp;
  799 
  800         ostate = ic->ic_state;
  801         callout_stop(&sc->scan_ch);
  802 
  803         switch (nstate) {
  804         case IEEE80211_S_INIT:
  805                 callout_stop(&sc->amrr_ch);
  806 
  807                 if (ostate == IEEE80211_S_RUN) {
  808                         /* abort TSF synchronization */
  809                         tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
  810                         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
  811                 }
  812                 break;
  813 
  814         case IEEE80211_S_SCAN:
  815                 rt2661_set_chan(sc, ic->ic_curchan);
  816                 callout_reset(&sc->scan_ch, hz / 5, rt2661_next_scan, sc);
  817                 break;
  818 
  819         case IEEE80211_S_AUTH:
  820         case IEEE80211_S_ASSOC:
  821                 rt2661_set_chan(sc, ic->ic_curchan);
  822                 break;
  823 
  824         case IEEE80211_S_RUN:
  825                 rt2661_set_chan(sc, ic->ic_curchan);
  826 
  827                 ni = ic->ic_bss;
  828 
  829                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
  830                         rt2661_set_slottime(sc);
  831                         rt2661_enable_mrr(sc);
  832                         rt2661_set_txpreamble(sc);
  833                         rt2661_set_basicrates(sc, &ni->ni_rates);
  834                         rt2661_set_bssid(sc, ni->ni_bssid);
  835                 }
  836 
  837                 if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
  838                     ic->ic_opmode == IEEE80211_M_IBSS)
  839                         rt2661_prepare_beacon(sc);
  840 
  841                 if (ic->ic_opmode == IEEE80211_M_STA) {
  842                         /* fake a join to init the tx rate */
  843                         rt2661_newassoc(ni, 1);
  844                 }
  845 
  846                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
  847                         sc->ncalls = 0;
  848                         sc->avg_rssi = -95;     /* reset EMA */
  849                         callout_reset(&sc->amrr_ch, hz / 2,
  850                             rt2661_updatestats, sc);
  851                         rt2661_enable_tsf_sync(sc);
  852                 }
  853                 break;
  854         }
  855 
  856         return sc->sc_newstate(ic, nstate, arg);
  857 }
  858 
  859 /*
  860  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
  861  * 93C66).
  862  */
  863 static uint16_t
  864 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
  865 {
  866         uint32_t tmp;
  867         uint16_t val;
  868         int n;
  869 
  870         /* clock C once before the first command */
  871         RT2661_EEPROM_CTL(sc, 0);
  872 
  873         RT2661_EEPROM_CTL(sc, RT2661_S);
  874         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  875         RT2661_EEPROM_CTL(sc, RT2661_S);
  876 
  877         /* write start bit (1) */
  878         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  879         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  880 
  881         /* write READ opcode (10) */
  882         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  883         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  884         RT2661_EEPROM_CTL(sc, RT2661_S);
  885         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  886 
  887         /* write address (A5-A0 or A7-A0) */
  888         n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
  889         for (; n >= 0; n--) {
  890                 RT2661_EEPROM_CTL(sc, RT2661_S |
  891                     (((addr >> n) & 1) << RT2661_SHIFT_D));
  892                 RT2661_EEPROM_CTL(sc, RT2661_S |
  893                     (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
  894         }
  895 
  896         RT2661_EEPROM_CTL(sc, RT2661_S);
  897 
  898         /* read data Q15-Q0 */
  899         val = 0;
  900         for (n = 15; n >= 0; n--) {
  901                 RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  902                 tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
  903                 val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
  904                 RT2661_EEPROM_CTL(sc, RT2661_S);
  905         }
  906 
  907         RT2661_EEPROM_CTL(sc, 0);
  908 
  909         /* clear Chip Select and clock C */
  910         RT2661_EEPROM_CTL(sc, RT2661_S);
  911         RT2661_EEPROM_CTL(sc, 0);
  912         RT2661_EEPROM_CTL(sc, RT2661_C);
  913 
  914         return val;
  915 }
  916 
  917 static void
  918 rt2661_tx_intr(struct rt2661_softc *sc)
  919 {
  920         struct ifnet *ifp = &sc->sc_if;
  921         struct rt2661_tx_ring *txq;
  922         struct rt2661_tx_data *data;
  923         struct rt2661_node *rn;
  924         uint32_t val;
  925         int qid, retrycnt;
  926 
  927         for (;;) {
  928                 val = RAL_READ(sc, RT2661_STA_CSR4);
  929                 if (!(val & RT2661_TX_STAT_VALID))
  930                         break;
  931 
  932                 /* retrieve the queue in which this frame was sent */
  933                 qid = RT2661_TX_QID(val);
  934                 txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
  935 
  936                 /* retrieve rate control algorithm context */
  937                 data = &txq->data[txq->stat];
  938                 rn = (struct rt2661_node *)data->ni;
  939 
  940                 /* if no frame has been sent, ignore */
  941                 if (rn == NULL)
  942                         continue;
  943 
  944                 switch (RT2661_TX_RESULT(val)) {
  945                 case RT2661_TX_SUCCESS:
  946                         retrycnt = RT2661_TX_RETRYCNT(val);
  947 
  948                         DPRINTFN(10, ("data frame sent successfully after "
  949                             "%d retries\n", retrycnt));
  950                         rn->amn.amn_txcnt++;
  951                         if (retrycnt > 0)
  952                                 rn->amn.amn_retrycnt++;
  953                         ifp->if_opackets++;
  954                         break;
  955 
  956                 case RT2661_TX_RETRY_FAIL:
  957                         DPRINTFN(9, ("sending data frame failed (too much "
  958                             "retries)\n"));
  959                         rn->amn.amn_txcnt++;
  960                         rn->amn.amn_retrycnt++;
  961                         ifp->if_oerrors++;
  962                         break;
  963 
  964                 default:
  965                         /* other failure */
  966                         aprint_error_dev(&sc->sc_dev, "sending data frame failed 0x%08x\n", val);
  967                         ifp->if_oerrors++;
  968                 }
  969 
  970                 ieee80211_free_node(data->ni);
  971                 data->ni = NULL;
  972 
  973                 DPRINTFN(15, ("tx done q=%d idx=%u\n", qid, txq->stat));
  974 
  975                 txq->queued--;
  976                 if (++txq->stat >= txq->count)  /* faster than % count */
  977                         txq->stat = 0;
  978         }
  979 
  980         sc->sc_tx_timer = 0;
  981         ifp->if_flags &= ~IFF_OACTIVE;
  982         rt2661_start(ifp);
  983 }
  984 
  985 static void
  986 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
  987 {
  988         struct rt2661_tx_desc *desc;
  989         struct rt2661_tx_data *data;
  990 
  991         for (;;) {
  992                 desc = &txq->desc[txq->next];
  993                 data = &txq->data[txq->next];
  994 
  995                 bus_dmamap_sync(sc->sc_dmat, txq->map,
  996                     txq->next * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
  997                     BUS_DMASYNC_POSTREAD);
  998 
  999                 if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
 1000                     !(le32toh(desc->flags) & RT2661_TX_VALID))
 1001                         break;
 1002 
 1003                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1004                     data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
 1005                 bus_dmamap_unload(sc->sc_dmat, data->map);
 1006                 m_freem(data->m);
 1007                 data->m = NULL;
 1008                 /* node reference is released in rt2661_tx_intr() */
 1009 
 1010                 /* descriptor is no longer valid */
 1011                 desc->flags &= ~htole32(RT2661_TX_VALID);
 1012 
 1013                 bus_dmamap_sync(sc->sc_dmat, txq->map,
 1014                     txq->next * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
 1015                     BUS_DMASYNC_PREWRITE);
 1016 
 1017                 DPRINTFN(15, ("tx dma done q=%p idx=%u\n", txq, txq->next));
 1018 
 1019                 if (++txq->next >= txq->count)  /* faster than % count */
 1020                         txq->next = 0;
 1021         }
 1022 }
 1023 
 1024 static void
 1025 rt2661_rx_intr(struct rt2661_softc *sc)
 1026 {
 1027         struct ieee80211com *ic = &sc->sc_ic;
 1028         struct ifnet *ifp = &sc->sc_if;
 1029         struct rt2661_rx_desc *desc;
 1030         struct rt2661_rx_data *data;
 1031         struct ieee80211_frame *wh;
 1032         struct ieee80211_node *ni;
 1033         struct mbuf *mnew, *m;
 1034         int error, rssi;
 1035 
 1036         for (;;) {
 1037                 desc = &sc->rxq.desc[sc->rxq.cur];
 1038                 data = &sc->rxq.data[sc->rxq.cur];
 1039 
 1040                 bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
 1041                     sc->rxq.cur * RT2661_RX_DESC_SIZE, RT2661_RX_DESC_SIZE,
 1042                     BUS_DMASYNC_POSTREAD);
 1043 
 1044                 if (le32toh(desc->flags) & RT2661_RX_BUSY)
 1045                         break;
 1046 
 1047                 if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
 1048                     (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
 1049                         /*
 1050                          * This should not happen since we did not request
 1051                          * to receive those frames when we filled TXRX_CSR0.
 1052                          */
 1053                         DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
 1054                             le32toh(desc->flags)));
 1055                         ifp->if_ierrors++;
 1056                         goto skip;
 1057                 }
 1058 
 1059                 if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
 1060                         ifp->if_ierrors++;
 1061                         goto skip;
 1062                 }
 1063 
 1064                 /*
 1065                  * Try to allocate a new mbuf for this ring element and load it
 1066                  * before processing the current mbuf. If the ring element
 1067                  * cannot be loaded, drop the received packet and reuse the old
 1068                  * mbuf. In the unlikely case that the old mbuf can't be
 1069                  * reloaded either, explicitly panic.
 1070                  */
 1071                 MGETHDR(mnew, M_DONTWAIT, MT_DATA);
 1072                 if (mnew == NULL) {
 1073                         ifp->if_ierrors++;
 1074                         goto skip;
 1075                 }
 1076 
 1077                 MCLGET(mnew, M_DONTWAIT);
 1078                 if (!(mnew->m_flags & M_EXT)) {
 1079                         m_freem(mnew);
 1080                         ifp->if_ierrors++;
 1081                         goto skip;
 1082                 }
 1083 
 1084                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1085                     data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
 1086                 bus_dmamap_unload(sc->sc_dmat, data->map);
 1087 
 1088                 error = bus_dmamap_load(sc->sc_dmat, data->map,
 1089                     mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
 1090                 if (error != 0) {
 1091                         m_freem(mnew);
 1092 
 1093                         /* try to reload the old mbuf */
 1094                         error = bus_dmamap_load(sc->sc_dmat, data->map,
 1095                             mtod(data->m, void *), MCLBYTES, NULL,
 1096                             BUS_DMA_NOWAIT);
 1097                         if (error != 0) {
 1098                                 /* very unlikely that it will fail... */
 1099                                 panic("%s: could not load old rx mbuf",
 1100                                     device_xname(&sc->sc_dev));
 1101                         }
 1102                         /* physical address may have changed */
 1103                         desc->physaddr = htole32(data->map->dm_segs->ds_addr);
 1104                         ifp->if_ierrors++;
 1105                         goto skip;
 1106                 }
 1107 
 1108                 /*
 1109                  * New mbuf successfully loaded, update Rx ring and continue
 1110                  * processing.
 1111                  */
 1112                 m = data->m;
 1113                 data->m = mnew;
 1114                 desc->physaddr = htole32(data->map->dm_segs->ds_addr);
 1115 
 1116                 /* finalize mbuf */
 1117                 m->m_pkthdr.rcvif = ifp;
 1118                 m->m_pkthdr.len = m->m_len =
 1119                     (le32toh(desc->flags) >> 16) & 0xfff;
 1120 
 1121 #if NBPFILTER > 0
 1122                 if (sc->sc_drvbpf != NULL) {
 1123                         struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
 1124                         uint32_t tsf_lo, tsf_hi;
 1125 
 1126                         /* get timestamp (low and high 32 bits) */
 1127                         tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
 1128                         tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
 1129 
 1130                         tap->wr_tsf =
 1131                             htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
 1132                         tap->wr_flags = 0;
 1133                         tap->wr_rate = rt2661_rxrate(desc);
 1134                         tap->wr_chan_freq = htole16(sc->sc_curchan->ic_freq);
 1135                         tap->wr_chan_flags = htole16(sc->sc_curchan->ic_flags);
 1136                         tap->wr_antsignal = desc->rssi;
 1137 
 1138                         bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m);
 1139                 }
 1140 #endif
 1141 
 1142                 wh = mtod(m, struct ieee80211_frame *);
 1143                 ni = ieee80211_find_rxnode(ic, 
 1144                     (struct ieee80211_frame_min *)wh);
 1145 
 1146                 /* send the frame to the 802.11 layer */
 1147                 ieee80211_input(ic, m, ni, desc->rssi, 0);
 1148 
 1149                 /*-
 1150                  * Keep track of the average RSSI using an Exponential Moving
 1151                  * Average (EMA) of 8 Wilder's days:
 1152                  *     avg = (1 / N) x rssi + ((N - 1) / N) x avg
 1153                  */
 1154                 rssi = rt2661_get_rssi(sc, desc->rssi);
 1155                 sc->avg_rssi = (rssi + 7 * sc->avg_rssi) / 8;
 1156 
 1157                 /* node is no longer needed */
 1158                 ieee80211_free_node(ni);
 1159 
 1160 skip:           desc->flags |= htole32(RT2661_RX_BUSY);
 1161 
 1162                 bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
 1163                     sc->rxq.cur * RT2661_RX_DESC_SIZE, RT2661_RX_DESC_SIZE,
 1164                     BUS_DMASYNC_PREWRITE);
 1165 
 1166                 DPRINTFN(16, ("rx intr idx=%u\n", sc->rxq.cur));
 1167 
 1168                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
 1169         }
 1170 
 1171         /*
 1172          * In HostAP mode, ieee80211_input() will enqueue packets in if_snd
 1173          * without calling if_start().
 1174          */
 1175         if (!IFQ_IS_EMPTY(&ifp->if_snd) && !(ifp->if_flags & IFF_OACTIVE))
 1176                 rt2661_start(ifp);
 1177 }
 1178 
 1179 /*
 1180  * This function is called in HostAP or IBSS modes when it's time to send a
 1181  * new beacon (every ni_intval milliseconds).
 1182  */
 1183 static void
 1184 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
 1185 {
 1186         struct ieee80211com *ic = &sc->sc_ic;
 1187 
 1188         if (sc->sc_flags & RT2661_UPDATE_SLOT) {
 1189                 sc->sc_flags &= ~RT2661_UPDATE_SLOT;
 1190                 sc->sc_flags |= RT2661_SET_SLOTTIME;
 1191         } else if (sc->sc_flags & RT2661_SET_SLOTTIME) {
 1192                 sc->sc_flags &= ~RT2661_SET_SLOTTIME;
 1193                 rt2661_set_slottime(sc);
 1194         }
 1195 
 1196         if (ic->ic_curmode == IEEE80211_MODE_11G) {
 1197                 /* update ERP Information Element */
 1198                 RAL_WRITE_1(sc, sc->erp_csr, ic->ic_bss->ni_erp);
 1199                 RAL_RW_BARRIER_1(sc, sc->erp_csr);
 1200         }
 1201 
 1202         DPRINTFN(15, ("beacon expired\n"));
 1203 }
 1204 
 1205 static void
 1206 rt2661_mcu_wakeup(struct rt2661_softc *sc)
 1207 {
 1208         RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
 1209 
 1210         RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
 1211         RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
 1212         RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
 1213 
 1214         /* send wakeup command to MCU */
 1215         rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
 1216 }
 1217 
 1218 static void
 1219 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
 1220 {
 1221         RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
 1222         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 1223 }
 1224 
 1225 int
 1226 rt2661_intr(void *arg)
 1227 {
 1228         struct rt2661_softc *sc = arg;
 1229         struct ifnet *ifp = &sc->sc_if;
 1230         uint32_t r1, r2;
 1231         int rv = 0;
 1232 
 1233         /* don't re-enable interrupts if we're shutting down */
 1234         if (!(ifp->if_flags & IFF_RUNNING)) {
 1235                 /* disable MAC and MCU interrupts */
 1236                 RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 1237                 RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 1238                 return 0;
 1239         }
 1240 
 1241         for (;;) {
 1242                 r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
 1243                 r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
 1244 
 1245                 if ((r1 & RT2661_INT_CSR_ALL) == 0 &&
 1246                     (r2 & RT2661_MCU_INT_ALL) == 0)
 1247                         break;
 1248 
 1249                 RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
 1250                 RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
 1251 
 1252                 rv = 1;
 1253 
 1254                 if (r1 & RT2661_MGT_DONE)
 1255                         rt2661_tx_dma_intr(sc, &sc->mgtq);
 1256 
 1257                 if (r1 & RT2661_RX_DONE)
 1258                         rt2661_rx_intr(sc);
 1259 
 1260                 if (r1 & RT2661_TX0_DMA_DONE)
 1261                         rt2661_tx_dma_intr(sc, &sc->txq[0]);
 1262 
 1263                 if (r1 & RT2661_TX1_DMA_DONE)
 1264                         rt2661_tx_dma_intr(sc, &sc->txq[1]);
 1265 
 1266                 if (r1 & RT2661_TX2_DMA_DONE)
 1267                         rt2661_tx_dma_intr(sc, &sc->txq[2]);
 1268 
 1269                 if (r1 & RT2661_TX3_DMA_DONE)
 1270                         rt2661_tx_dma_intr(sc, &sc->txq[3]);
 1271 
 1272                 if (r1 & RT2661_TX_DONE)
 1273                         rt2661_tx_intr(sc);
 1274 
 1275                 if (r2 & RT2661_MCU_CMD_DONE)
 1276                         rt2661_mcu_cmd_intr(sc);
 1277 
 1278                 if (r2 & RT2661_MCU_BEACON_EXPIRE)
 1279                         rt2661_mcu_beacon_expire(sc);
 1280 
 1281                 if (r2 & RT2661_MCU_WAKEUP)
 1282                         rt2661_mcu_wakeup(sc);
 1283         }
 1284 
 1285         return rv;
 1286 }
 1287 
 1288 /* quickly determine if a given rate is CCK or OFDM */
 1289 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
 1290 
 1291 #define RAL_ACK_SIZE    14      /* 10 + 4(FCS) */
 1292 #define RAL_CTS_SIZE    14      /* 10 + 4(FCS) */
 1293 
 1294 /*
 1295  * This function is only used by the Rx radiotap code. It returns the rate at
 1296  * which a given frame was received.
 1297  */
 1298 #if NBPFILTER > 0
 1299 static uint8_t
 1300 rt2661_rxrate(struct rt2661_rx_desc *desc)
 1301 {
 1302         if (le32toh(desc->flags) & RT2661_RX_OFDM) {
 1303                 /* reverse function of rt2661_plcp_signal */
 1304                 switch (desc->rate & 0xf) {
 1305                 case 0xb:       return 12;
 1306                 case 0xf:       return 18;
 1307                 case 0xa:       return 24;
 1308                 case 0xe:       return 36;
 1309                 case 0x9:       return 48;
 1310                 case 0xd:       return 72;
 1311                 case 0x8:       return 96;
 1312                 case 0xc:       return 108;
 1313                 }
 1314         } else {
 1315                 if (desc->rate == 10)
 1316                         return 2;
 1317                 if (desc->rate == 20)
 1318                         return 4;
 1319                 if (desc->rate == 55)
 1320                         return 11;
 1321                 if (desc->rate == 110)
 1322                         return 22;
 1323         }
 1324         return 2;       /* should not get there */
 1325 }
 1326 #endif
 1327 
 1328 /*
 1329  * Return the expected ack rate for a frame transmitted at rate `rate'.
 1330  * XXX: this should depend on the destination node basic rate set.
 1331  */
 1332 static int
 1333 rt2661_ack_rate(struct ieee80211com *ic, int rate)
 1334 {
 1335         switch (rate) {
 1336         /* CCK rates */
 1337         case 2:
 1338                 return 2;
 1339         case 4:
 1340         case 11:
 1341         case 22:
 1342                 return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
 1343 
 1344         /* OFDM rates */
 1345         case 12:
 1346         case 18:
 1347                 return 12;
 1348         case 24:
 1349         case 36:
 1350                 return 24;
 1351         case 48:
 1352         case 72:
 1353         case 96:
 1354         case 108:
 1355                 return 48;
 1356         }
 1357 
 1358         /* default to 1Mbps */
 1359         return 2;
 1360 }
 1361 
 1362 /*
 1363  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
 1364  * The function automatically determines the operating mode depending on the
 1365  * given rate. `flags' indicates whether short preamble is in use or not.
 1366  */
 1367 static uint16_t
 1368 rt2661_txtime(int len, int rate, uint32_t flags)
 1369 {
 1370         uint16_t txtime;
 1371 
 1372         if (RAL_RATE_IS_OFDM(rate)) {
 1373                 /* IEEE Std 802.11g-2003, pp. 44 */
 1374                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
 1375                 txtime = 16 + 4 + 4 * txtime + 6;
 1376         } else {
 1377                 /* IEEE Std 802.11b-1999, pp. 28 */
 1378                 txtime = (16 * len + rate - 1) / rate;
 1379                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
 1380                         txtime +=  72 + 24;
 1381                 else
 1382                         txtime += 144 + 48;
 1383         }
 1384         return txtime;
 1385 }
 1386 
 1387 static uint8_t
 1388 rt2661_plcp_signal(int rate)
 1389 {
 1390         switch (rate) {
 1391         /* CCK rates (returned values are device-dependent) */
 1392         case 2:         return 0x0;
 1393         case 4:         return 0x1;
 1394         case 11:        return 0x2;
 1395         case 22:        return 0x3;
 1396 
 1397         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 1398         case 12:        return 0xb;
 1399         case 18:        return 0xf;
 1400         case 24:        return 0xa;
 1401         case 36:        return 0xe;
 1402         case 48:        return 0x9;
 1403         case 72:        return 0xd;
 1404         case 96:        return 0x8;
 1405         case 108:       return 0xc;
 1406 
 1407         /* unsupported rates (should not get there) */
 1408         default:        return 0xff;
 1409         }
 1410 }
 1411 
 1412 static void
 1413 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
 1414     uint32_t flags, uint16_t xflags, int len, int rate,
 1415     const bus_dma_segment_t *segs, int nsegs, int ac)
 1416 {
 1417         struct ieee80211com *ic = &sc->sc_ic;
 1418         uint16_t plcp_length;
 1419         int i, remainder;
 1420 
 1421         desc->flags = htole32(flags);
 1422         desc->flags |= htole32(len << 16);
 1423 
 1424         desc->xflags = htole16(xflags);
 1425         desc->xflags |= htole16(nsegs << 13);
 1426 
 1427         desc->wme = htole16(
 1428             RT2661_QID(ac) |
 1429             RT2661_AIFSN(2) |
 1430             RT2661_LOGCWMIN(4) |
 1431             RT2661_LOGCWMAX(10));
 1432 
 1433         /*
 1434          * Remember in which queue this frame was sent. This field is driver
 1435          * private data only. It will be made available by the NIC in STA_CSR4
 1436          * on Tx interrupts.
 1437          */
 1438         desc->qid = ac;
 1439 
 1440         /* setup PLCP fields */
 1441         desc->plcp_signal  = rt2661_plcp_signal(rate);
 1442         desc->plcp_service = 4;
 1443 
 1444         len += IEEE80211_CRC_LEN;
 1445         if (RAL_RATE_IS_OFDM(rate)) {
 1446                 desc->flags |= htole32(RT2661_TX_OFDM);
 1447 
 1448                 plcp_length = len & 0xfff;
 1449                 desc->plcp_length_hi = plcp_length >> 6;
 1450                 desc->plcp_length_lo = plcp_length & 0x3f;
 1451         } else {
 1452                 plcp_length = (16 * len + rate - 1) / rate;
 1453                 if (rate == 22) {
 1454                         remainder = (16 * len) % 22;
 1455                         if (remainder != 0 && remainder < 7)
 1456                                 desc->plcp_service |= RT2661_PLCP_LENGEXT;
 1457                 }
 1458                 desc->plcp_length_hi = plcp_length >> 8;
 1459                 desc->plcp_length_lo = plcp_length & 0xff;
 1460 
 1461                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 1462                         desc->plcp_signal |= 0x08;
 1463         }
 1464 
 1465         /* RT2x61 supports scatter with up to 5 segments */
 1466         for (i = 0; i < nsegs; i++) {
 1467                 desc->addr[i] = htole32(segs[i].ds_addr);
 1468                 desc->len [i] = htole16(segs[i].ds_len);
 1469         }
 1470 
 1471         desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
 1472 }
 1473 
 1474 static int
 1475 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
 1476     struct ieee80211_node *ni)
 1477 {
 1478         struct ieee80211com *ic = &sc->sc_ic;
 1479         struct rt2661_tx_desc *desc;
 1480         struct rt2661_tx_data *data;
 1481         struct ieee80211_frame *wh;
 1482         uint16_t dur;
 1483         uint32_t flags = 0;
 1484         int rate, error;
 1485 
 1486         desc = &sc->mgtq.desc[sc->mgtq.cur];
 1487         data = &sc->mgtq.data[sc->mgtq.cur];
 1488 
 1489         /* send mgt frames at the lowest available rate */
 1490         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
 1491 
 1492         wh = mtod(m0, struct ieee80211_frame *);
 1493 
 1494         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1495                 if (ieee80211_crypto_encap(ic, ni, m0) == NULL) {
 1496                         m_freem(m0);
 1497                         return ENOBUFS;
 1498                 }
 1499 
 1500                 /* packet header may have moved, reset our local pointer */
 1501                 wh = mtod(m0, struct ieee80211_frame *);
 1502         }
 1503 
 1504         error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 1505             BUS_DMA_NOWAIT);
 1506         if (error != 0) {
 1507                 aprint_error_dev(&sc->sc_dev, "could not map mbuf (error %d)\n",
 1508                     error);
 1509                 m_freem(m0);
 1510                 return error;
 1511         }
 1512 
 1513 #if NBPFILTER > 0
 1514         if (sc->sc_drvbpf != NULL) {
 1515                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1516 
 1517                 tap->wt_flags = 0;
 1518                 tap->wt_rate = rate;
 1519                 tap->wt_chan_freq = htole16(sc->sc_curchan->ic_freq);
 1520                 tap->wt_chan_flags = htole16(sc->sc_curchan->ic_flags);
 1521 
 1522                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
 1523         }
 1524 #endif
 1525 
 1526         data->m = m0;
 1527         data->ni = ni;
 1528 
 1529         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1530                 flags |= RT2661_TX_NEED_ACK;
 1531 
 1532                 dur = rt2661_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
 1533                     sc->sifs;
 1534                 *(uint16_t *)wh->i_dur = htole16(dur);
 1535 
 1536                 /* tell hardware to set timestamp in probe responses */
 1537                 if ((wh->i_fc[0] &
 1538                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
 1539                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
 1540                         flags |= RT2661_TX_TIMESTAMP;
 1541         }
 1542 
 1543         rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
 1544             m0->m_pkthdr.len, rate, data->map->dm_segs, data->map->dm_nsegs,
 1545             RT2661_QID_MGT);
 1546 
 1547         bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
 1548             BUS_DMASYNC_PREWRITE);
 1549         bus_dmamap_sync(sc->sc_dmat, sc->mgtq.map,
 1550             sc->mgtq.cur * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
 1551             BUS_DMASYNC_PREWRITE);
 1552 
 1553         DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
 1554             m0->m_pkthdr.len, sc->mgtq.cur, rate));
 1555 
 1556         /* kick mgt */
 1557         sc->mgtq.queued++;
 1558         sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
 1559         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
 1560 
 1561         return 0;
 1562 }
 1563 
 1564 /*
 1565  * Build a RTS control frame.
 1566  */
 1567 static struct mbuf *
 1568 rt2661_get_rts(struct rt2661_softc *sc, struct ieee80211_frame *wh,
 1569     uint16_t dur)
 1570 {
 1571         struct ieee80211_frame_rts *rts;
 1572         struct mbuf *m;
 1573 
 1574         MGETHDR(m, M_DONTWAIT, MT_DATA);
 1575         if (m == NULL) {
 1576                 sc->sc_ic.ic_stats.is_tx_nobuf++;
 1577                 aprint_error_dev(&sc->sc_dev, "could not allocate RTS frame\n");
 1578                 return NULL;
 1579         }
 1580 
 1581         rts = mtod(m, struct ieee80211_frame_rts *);
 1582 
 1583         rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
 1584             IEEE80211_FC0_SUBTYPE_RTS;
 1585         rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
 1586         *(uint16_t *)rts->i_dur = htole16(dur);
 1587         IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
 1588         IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
 1589 
 1590         m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
 1591 
 1592         return m;
 1593 }
 1594 
 1595 static int
 1596 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 1597     struct ieee80211_node *ni, int ac)
 1598 {
 1599         struct ieee80211com *ic = &sc->sc_ic;
 1600         struct rt2661_tx_ring *txq = &sc->txq[ac];
 1601         struct rt2661_tx_desc *desc;
 1602         struct rt2661_tx_data *data;
 1603         struct ieee80211_frame *wh;
 1604         struct ieee80211_key *k;
 1605         struct mbuf *mnew;
 1606         uint16_t dur;
 1607         uint32_t flags = 0;
 1608         int rate, useprot, error, tid;
 1609 
 1610         wh = mtod(m0, struct ieee80211_frame *);
 1611 
 1612         if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
 1613                 rate = ic->ic_sup_rates[ic->ic_curmode].
 1614                     rs_rates[ic->ic_fixed_rate];
 1615         } else
 1616                 rate = ni->ni_rates.rs_rates[ni->ni_txrate];
 1617         rate &= IEEE80211_RATE_VAL;
 1618         if (rate == 0)
 1619                 rate = 2;       /* XXX should not happen */
 1620 
 1621         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1622                 k = ieee80211_crypto_encap(ic, ni, m0);
 1623                 if (k == NULL) {
 1624                         m_freem(m0);
 1625                         return ENOBUFS;
 1626                 }
 1627 
 1628                 /* packet header may have moved, reset our local pointer */
 1629                 wh = mtod(m0, struct ieee80211_frame *);
 1630         }
 1631 
 1632         /*
 1633          * Packet Bursting: backoff after ppb=8 frames to give other STAs a
 1634          * chance to contend for the wireless medium.
 1635          */
 1636         tid = WME_AC_TO_TID(M_WME_GETAC(m0));
 1637         if (ic->ic_opmode == IEEE80211_M_STA && (ni->ni_txseqs[tid] & 7))
 1638                 flags |= RT2661_TX_IFS_SIFS;
 1639 
 1640         /*
 1641          * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
 1642          * for directed frames only when the length of the MPDU is greater
 1643          * than the length threshold indicated by" ic_rtsthreshold.
 1644          *
 1645          * IEEE Std 802.11-2003g, pp 13: "ERP STAs shall use protection
 1646          * mechanism (such as RTS/CTS or CTS-to-self) for ERP-OFDM MPDUs of
 1647          * type Data or an MMPDU".
 1648          */
 1649         useprot = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 1650             (m0->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
 1651             ((ic->ic_flags & IEEE80211_F_USEPROT) && RAL_RATE_IS_OFDM(rate)));
 1652         if (useprot) {
 1653                 struct mbuf *m;
 1654                 int rtsrate, ackrate;
 1655 
 1656                 rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
 1657                 ackrate = rt2661_ack_rate(ic, rate);
 1658 
 1659                 dur = rt2661_txtime(m0->m_pkthdr.len + 4, rate, ic->ic_flags) +
 1660                       rt2661_txtime(RAL_CTS_SIZE, rtsrate, ic->ic_flags) +
 1661                       rt2661_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
 1662                       3 * sc->sifs;
 1663 
 1664                 m = rt2661_get_rts(sc, wh, dur);
 1665                 if (m == NULL) {
 1666                         aprint_error_dev(&sc->sc_dev, "could not allocate RTS "
 1667                             "frame\n");
 1668                         m_freem(m0);
 1669                         return ENOBUFS;
 1670                 }
 1671 
 1672                 desc = &txq->desc[txq->cur];
 1673                 data = &txq->data[txq->cur];
 1674 
 1675                 error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m,
 1676                     BUS_DMA_NOWAIT);
 1677                 if (error != 0) {
 1678                         aprint_error_dev(&sc->sc_dev, "could not map mbuf (error %d)\n", error);
 1679                         m_freem(m);
 1680                         m_freem(m0);
 1681                         return error;
 1682                 }
 1683 
 1684                 /* avoid multiple free() of the same node for each fragment */
 1685                 ieee80211_ref_node(ni);
 1686 
 1687                 data->m = m;
 1688                 data->ni = ni;
 1689 
 1690                 rt2661_setup_tx_desc(sc, desc, RT2661_TX_NEED_ACK |
 1691                     RT2661_TX_MORE_FRAG, 0, m->m_pkthdr.len, rtsrate,
 1692                     data->map->dm_segs, data->map->dm_nsegs, ac);
 1693 
 1694                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1695                     data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
 1696                 bus_dmamap_sync(sc->sc_dmat, txq->map,
 1697                     txq->cur * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
 1698                     BUS_DMASYNC_PREWRITE);
 1699 
 1700                 txq->queued++;
 1701                 txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1702 
 1703                 flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS_SIFS;
 1704         }
 1705 
 1706         data = &txq->data[txq->cur];
 1707         desc = &txq->desc[txq->cur];
 1708 
 1709         error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 1710             BUS_DMA_NOWAIT);
 1711         if (error != 0 && error != EFBIG) {
 1712                 aprint_error_dev(&sc->sc_dev, "could not map mbuf (error %d)\n",
 1713                     error);
 1714                 m_freem(m0);
 1715                 return error;
 1716         }
 1717         if (error != 0) {
 1718                 /* too many fragments, linearize */
 1719 
 1720                 MGETHDR(mnew, M_DONTWAIT, MT_DATA);
 1721                 if (mnew == NULL) {
 1722                         m_freem(m0);
 1723                         return ENOMEM;
 1724                 }
 1725 
 1726                 M_COPY_PKTHDR(mnew, m0);
 1727                 if (m0->m_pkthdr.len > MHLEN) {
 1728                         MCLGET(mnew, M_DONTWAIT);
 1729                         if (!(mnew->m_flags & M_EXT)) {
 1730                                 m_freem(m0);
 1731                                 m_freem(mnew);
 1732                                 return ENOMEM;
 1733                         }
 1734                 }
 1735 
 1736                 m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, void *));
 1737                 m_freem(m0);
 1738                 mnew->m_len = mnew->m_pkthdr.len;
 1739                 m0 = mnew;
 1740 
 1741                 error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 1742                     BUS_DMA_NOWAIT);
 1743                 if (error != 0) {
 1744                         aprint_error_dev(&sc->sc_dev, "could not map mbuf (error %d)\n", error);
 1745                         m_freem(m0);
 1746                         return error;
 1747                 }
 1748 
 1749                 /* packet header have moved, reset our local pointer */
 1750                 wh = mtod(m0, struct ieee80211_frame *);
 1751         }
 1752 
 1753 #if NBPFILTER > 0
 1754         if (sc->sc_drvbpf != NULL) {
 1755                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1756 
 1757                 tap->wt_flags = 0;
 1758                 tap->wt_rate = rate;
 1759                 tap->wt_chan_freq = htole16(sc->sc_curchan->ic_freq);
 1760                 tap->wt_chan_flags = htole16(sc->sc_curchan->ic_flags);
 1761 
 1762                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0);
 1763         }
 1764 #endif
 1765 
 1766         data->m = m0;
 1767         data->ni = ni;
 1768 
 1769         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1770                 flags |= RT2661_TX_NEED_ACK;
 1771 
 1772                 dur = rt2661_txtime(RAL_ACK_SIZE, rt2661_ack_rate(ic, rate),
 1773                     ic->ic_flags) + sc->sifs;
 1774                 *(uint16_t *)wh->i_dur = htole16(dur);
 1775         }
 1776 
 1777         rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate,
 1778             data->map->dm_segs, data->map->dm_nsegs, ac);
 1779 
 1780         bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
 1781             BUS_DMASYNC_PREWRITE);
 1782         bus_dmamap_sync(sc->sc_dmat, txq->map, txq->cur * RT2661_TX_DESC_SIZE,
 1783             RT2661_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
 1784 
 1785         DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
 1786             m0->m_pkthdr.len, txq->cur, rate));
 1787 
 1788         /* kick Tx */
 1789         txq->queued++;
 1790         txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1791         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1);
 1792 
 1793         return 0;
 1794 }
 1795 
 1796 static void
 1797 rt2661_start(struct ifnet *ifp)
 1798 {
 1799         struct rt2661_softc *sc = ifp->if_softc;
 1800         struct ieee80211com *ic = &sc->sc_ic;
 1801         struct mbuf *m0;
 1802         struct ether_header *eh;
 1803         struct ieee80211_node *ni = NULL;
 1804 
 1805         /*
 1806          * net80211 may still try to send management frames even if the
 1807          * IFF_RUNNING flag is not set...
 1808          */
 1809         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
 1810                 return;
 1811 
 1812         for (;;) {
 1813                 IF_POLL(&ic->ic_mgtq, m0);
 1814                 if (m0 != NULL) {
 1815                         if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
 1816                                 ifp->if_flags |= IFF_OACTIVE;
 1817                                 break;
 1818                         }
 1819                         IF_DEQUEUE(&ic->ic_mgtq, m0);
 1820                         if (m0 == NULL)
 1821                                 break;
 1822 
 1823                         ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
 1824                         m0->m_pkthdr.rcvif = NULL;
 1825 #if NBPFILTER > 0
 1826                         if (ic->ic_rawbpf != NULL)
 1827                                 bpf_mtap(ic->ic_rawbpf, m0);
 1828 #endif
 1829                         if (rt2661_tx_mgt(sc, m0, ni) != 0)
 1830                                 break;
 1831 
 1832                 } else {
 1833                         IF_POLL(&ifp->if_snd, m0);
 1834                         if (m0 == NULL || ic->ic_state != IEEE80211_S_RUN)
 1835                                 break;
 1836 
 1837                         if (sc->txq[0].queued >= RT2661_TX_RING_COUNT - 1) {
 1838                                 /* there is no place left in this ring */
 1839                                 ifp->if_flags |= IFF_OACTIVE;
 1840                                 break;
 1841                         }
 1842 
 1843                         IFQ_DEQUEUE(&ifp->if_snd, m0);
 1844 
 1845                         if (m0->m_len < sizeof (struct ether_header) &&
 1846                             !(m0 = m_pullup(m0, sizeof (struct ether_header))))
 1847                                 continue;
 1848 
 1849                         eh = mtod(m0, struct ether_header *);
 1850                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
 1851                         if (ni == NULL) {
 1852                                 m_freem(m0);
 1853                                 ifp->if_oerrors++;
 1854                                 continue;
 1855                         }
 1856 
 1857 #if NBPFILTER > 0
 1858                         if (ifp->if_bpf != NULL)
 1859                                 bpf_mtap(ifp->if_bpf, m0);
 1860 #endif
 1861                         m0 = ieee80211_encap(ic, m0, ni);
 1862                         if (m0 == NULL) {
 1863                                 ieee80211_free_node(ni);
 1864                                 ifp->if_oerrors++;
 1865                                 continue;
 1866                         }
 1867 #if NBPFILTER > 0
 1868                         if (ic->ic_rawbpf != NULL)
 1869                                 bpf_mtap(ic->ic_rawbpf, m0);
 1870 #endif
 1871                         if (rt2661_tx_data(sc, m0, ni, 0) != 0) {
 1872                                 if (ni != NULL)
 1873                                         ieee80211_free_node(ni);
 1874                                 ifp->if_oerrors++;
 1875                                 break;
 1876                         }
 1877                 }
 1878 
 1879                 sc->sc_tx_timer = 5;
 1880                 ifp->if_timer = 1;
 1881         }
 1882 }
 1883 
 1884 static void
 1885 rt2661_watchdog(struct ifnet *ifp)
 1886 {
 1887         struct rt2661_softc *sc = ifp->if_softc;
 1888 
 1889         ifp->if_timer = 0;
 1890 
 1891         if (sc->sc_tx_timer > 0) {
 1892                 if (--sc->sc_tx_timer == 0) {
 1893                         aprint_error_dev(&sc->sc_dev, "device timeout\n");
 1894                         rt2661_init(ifp);
 1895                         ifp->if_oerrors++;
 1896                         return;
 1897                 }
 1898                 ifp->if_timer = 1;
 1899         }
 1900 
 1901         ieee80211_watchdog(&sc->sc_ic);
 1902 }
 1903 
 1904 /*
 1905  * This function allows for fast channel switching in monitor mode (used by
 1906  * kismet). In IBSS mode, we must explicitly reset the interface to
 1907  * generate a new beacon frame.
 1908  */
 1909 static int
 1910 rt2661_reset(struct ifnet *ifp)
 1911 {
 1912         struct rt2661_softc *sc = ifp->if_softc;
 1913         struct ieee80211com *ic = &sc->sc_ic;
 1914 
 1915         if (ic->ic_opmode != IEEE80211_M_MONITOR)
 1916                 return ENETRESET;
 1917 
 1918         rt2661_set_chan(sc, ic->ic_curchan);
 1919 
 1920         return 0;
 1921 }
 1922 
 1923 static int
 1924 rt2661_ioctl(struct ifnet *ifp, u_long cmd, void *data)
 1925 {
 1926         struct rt2661_softc *sc = ifp->if_softc;
 1927         struct ieee80211com *ic = &sc->sc_ic;
 1928         int s, error = 0;
 1929 
 1930         s = splnet();
 1931 
 1932         switch (cmd) {
 1933         case SIOCSIFFLAGS:
 1934                 if (ifp->if_flags & IFF_UP) {
 1935                         if (ifp->if_flags & IFF_RUNNING)
 1936                                 rt2661_update_promisc(sc);
 1937                         else
 1938                                 rt2661_init(ifp);
 1939                 } else {
 1940                         if (ifp->if_flags & IFF_RUNNING)
 1941                                 rt2661_stop(ifp, 1);
 1942                 }
 1943                 break;
 1944 
 1945         case SIOCADDMULTI:
 1946         case SIOCDELMULTI:
 1947                 /* XXX no h/w multicast filter? --dyoung */
 1948                 if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
 1949                         error = 0;
 1950                 break;
 1951 
 1952         case SIOCS80211CHANNEL:
 1953                 /*
 1954                  * This allows for fast channel switching in monitor mode
 1955                  * (used by kismet). In IBSS mode, we must explicitly reset
 1956                  * the interface to generate a new beacon frame.
 1957                  */
 1958                 error = ieee80211_ioctl(ic, cmd, data);
 1959                 if (error == ENETRESET &&
 1960                     ic->ic_opmode == IEEE80211_M_MONITOR) {
 1961                         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
 1962                              (IFF_UP | IFF_RUNNING))
 1963                                 rt2661_set_chan(sc, ic->ic_ibss_chan);
 1964                         error = 0;
 1965                 }
 1966                 break;
 1967 
 1968         default:
 1969                 error = ieee80211_ioctl(ic, cmd, data);
 1970 
 1971         }
 1972 
 1973         if (error == ENETRESET) {
 1974                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
 1975                     (IFF_UP | IFF_RUNNING))
 1976                         rt2661_init(ifp);
 1977                 error = 0;
 1978         }
 1979 
 1980         splx(s);
 1981 
 1982         return error;
 1983 }
 1984 
 1985 static void
 1986 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
 1987 {
 1988         uint32_t tmp;
 1989         int ntries;
 1990 
 1991         for (ntries = 0; ntries < 100; ntries++) {
 1992                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 1993                         break;
 1994                 DELAY(1);
 1995         }
 1996         if (ntries == 100) {
 1997                 aprint_error_dev(&sc->sc_dev, "could not write to BBP\n");
 1998                 return;
 1999         }
 2000 
 2001         tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
 2002         RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
 2003 
 2004         DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
 2005 }
 2006 
 2007 static uint8_t
 2008 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
 2009 {
 2010         uint32_t val;
 2011         int ntries;
 2012 
 2013         for (ntries = 0; ntries < 100; ntries++) {
 2014                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 2015                         break;
 2016                 DELAY(1);
 2017         }
 2018         if (ntries == 100) {
 2019                 aprint_error_dev(&sc->sc_dev, "could not read from BBP\n");
 2020                 return 0;
 2021         }
 2022 
 2023         val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
 2024         RAL_WRITE(sc, RT2661_PHY_CSR3, val);
 2025 
 2026         for (ntries = 0; ntries < 100; ntries++) {
 2027                 val = RAL_READ(sc, RT2661_PHY_CSR3);
 2028                 if (!(val & RT2661_BBP_BUSY))
 2029                         return val & 0xff;
 2030                 DELAY(1);
 2031         }
 2032 
 2033         aprint_error_dev(&sc->sc_dev, "could not read from BBP\n");
 2034         return 0;
 2035 }
 2036 
 2037 static void
 2038 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
 2039 {
 2040         uint32_t tmp;
 2041         int ntries;
 2042 
 2043         for (ntries = 0; ntries < 100; ntries++) {
 2044                 if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
 2045                         break;
 2046                 DELAY(1);
 2047         }
 2048         if (ntries == 100) {
 2049                 aprint_error_dev(&sc->sc_dev, "could not write to RF\n");
 2050                 return;
 2051         }
 2052         tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
 2053             (reg & 3);
 2054         RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
 2055 
 2056         /* remember last written value in sc */
 2057         sc->rf_regs[reg] = val;
 2058 
 2059         DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff));
 2060 }
 2061 
 2062 static int
 2063 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
 2064 {
 2065         if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
 2066                 return EIO;     /* there is already a command pending */
 2067 
 2068         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
 2069             RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
 2070 
 2071         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
 2072 
 2073         return 0;
 2074 }
 2075 
 2076 static void
 2077 rt2661_select_antenna(struct rt2661_softc *sc)
 2078 {
 2079         uint8_t bbp4, bbp77;
 2080         uint32_t tmp;
 2081 
 2082         bbp4  = rt2661_bbp_read(sc,  4);
 2083         bbp77 = rt2661_bbp_read(sc, 77);
 2084 
 2085         /* TBD */
 2086 
 2087         /* make sure Rx is disabled before switching antenna */
 2088         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2089         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2090 
 2091         rt2661_bbp_write(sc,  4, bbp4);
 2092         rt2661_bbp_write(sc, 77, bbp77);
 2093 
 2094         /* restore Rx filter */
 2095         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2096 }
 2097 
 2098 /*
 2099  * Enable multi-rate retries for frames sent at OFDM rates.
 2100  * In 802.11b/g mode, allow fallback to CCK rates.
 2101  */
 2102 static void
 2103 rt2661_enable_mrr(struct rt2661_softc *sc)
 2104 {
 2105         struct ieee80211com *ic = &sc->sc_ic;
 2106         uint32_t tmp;
 2107 
 2108         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 2109 
 2110         tmp &= ~RT2661_MRR_CCK_FALLBACK;
 2111         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan))
 2112                 tmp |= RT2661_MRR_CCK_FALLBACK;
 2113         tmp |= RT2661_MRR_ENABLED;
 2114 
 2115         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 2116 }
 2117 
 2118 static void
 2119 rt2661_set_txpreamble(struct rt2661_softc *sc)
 2120 {
 2121         uint32_t tmp;
 2122 
 2123         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 2124 
 2125         tmp &= ~RT2661_SHORT_PREAMBLE;
 2126         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
 2127                 tmp |= RT2661_SHORT_PREAMBLE;
 2128 
 2129         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 2130 }
 2131 
 2132 static void
 2133 rt2661_set_basicrates(struct rt2661_softc *sc,
 2134     const struct ieee80211_rateset *rs)
 2135 {
 2136 #define RV(r)   ((r) & IEEE80211_RATE_VAL)
 2137         uint32_t mask = 0;
 2138         uint8_t rate;
 2139         int i, j;
 2140 
 2141         for (i = 0; i < rs->rs_nrates; i++) {
 2142                 rate = rs->rs_rates[i];
 2143 
 2144                 if (!(rate & IEEE80211_RATE_BASIC))
 2145                         continue;
 2146 
 2147                 /*
 2148                  * Find h/w rate index.  We know it exists because the rate
 2149                  * set has already been negotiated.
 2150                  */
 2151                 for (j = 0; rt2661_rateset_11g.rs_rates[j] != RV(rate); j++);
 2152 
 2153                 mask |= 1 << j;
 2154         }
 2155 
 2156         RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
 2157 
 2158         DPRINTF(("Setting basic rate mask to 0x%x\n", mask));
 2159 #undef RV
 2160 }
 2161 
 2162 /*
 2163  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
 2164  * driver.
 2165  */
 2166 static void
 2167 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
 2168 {
 2169         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
 2170         uint32_t tmp;
 2171 
 2172         /* update all BBP registers that depend on the band */
 2173         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
 2174         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
 2175         if (IEEE80211_IS_CHAN_5GHZ(c)) {
 2176                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
 2177                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
 2178         }
 2179         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 2180             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 2181                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
 2182         }
 2183 
 2184         sc->bbp17 = bbp17;
 2185         rt2661_bbp_write(sc,  17, bbp17);
 2186         rt2661_bbp_write(sc,  96, bbp96);
 2187         rt2661_bbp_write(sc, 104, bbp104);
 2188 
 2189         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 2190             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 2191                 rt2661_bbp_write(sc, 75, 0x80);
 2192                 rt2661_bbp_write(sc, 86, 0x80);
 2193                 rt2661_bbp_write(sc, 88, 0x80);
 2194         }
 2195 
 2196         rt2661_bbp_write(sc, 35, bbp35);
 2197         rt2661_bbp_write(sc, 97, bbp97);
 2198         rt2661_bbp_write(sc, 98, bbp98);
 2199 
 2200         tmp = RAL_READ(sc, RT2661_PHY_CSR0);
 2201         tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
 2202         if (IEEE80211_IS_CHAN_2GHZ(c))
 2203                 tmp |= RT2661_PA_PE_2GHZ;
 2204         else
 2205                 tmp |= RT2661_PA_PE_5GHZ;
 2206         RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
 2207 
 2208         /* 802.11a uses a 16 microseconds short interframe space */
 2209         sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
 2210 }
 2211 
 2212 static void
 2213 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
 2214 {
 2215         struct ieee80211com *ic = &sc->sc_ic;
 2216         const struct rfprog *rfprog;
 2217         uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
 2218         int8_t power;
 2219         u_int i, chan;
 2220 
 2221         chan = ieee80211_chan2ieee(ic, c);
 2222         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
 2223                 return;
 2224 
 2225         /* select the appropriate RF settings based on what EEPROM says */
 2226         rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
 2227 
 2228         /* find the settings for this channel (we know it exists) */
 2229         for (i = 0; rfprog[i].chan != chan; i++);
 2230 
 2231         power = sc->txpow[i];
 2232         if (power < 0) {
 2233                 bbp94 += power;
 2234                 power = 0;
 2235         } else if (power > 31) {
 2236                 bbp94 += power - 31;
 2237                 power = 31;
 2238         }
 2239 
 2240         /*
 2241          * If we've yet to select a channel, or we are switching from the
 2242          * 2GHz band to the 5GHz band or vice-versa, BBP registers need to
 2243          * be reprogrammed.
 2244          */
 2245         if (sc->sc_curchan == NULL || c->ic_flags != sc->sc_curchan->ic_flags) {
 2246                 rt2661_select_band(sc, c);
 2247                 rt2661_select_antenna(sc);
 2248         }
 2249         sc->sc_curchan = c;
 2250 
 2251         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2252         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2253         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 2254         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2255 
 2256         DELAY(200);
 2257 
 2258         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2259         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2260         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
 2261         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2262 
 2263         DELAY(200);
 2264 
 2265         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2266         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2267         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 2268         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2269 
 2270         /* enable smart mode for MIMO-capable RFs */
 2271         bbp3 = rt2661_bbp_read(sc, 3);
 2272 
 2273         bbp3 &= ~RT2661_SMART_MODE;
 2274         if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
 2275                 bbp3 |= RT2661_SMART_MODE;
 2276 
 2277         rt2661_bbp_write(sc, 3, bbp3);
 2278 
 2279         if (bbp94 != RT2661_BBPR94_DEFAULT)
 2280                 rt2661_bbp_write(sc, 94, bbp94);
 2281 
 2282         /* 5GHz radio needs a 1ms delay here */
 2283         if (IEEE80211_IS_CHAN_5GHZ(c))
 2284                 DELAY(1000);
 2285 }
 2286 
 2287 static void
 2288 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
 2289 {
 2290         uint32_t tmp;
 2291 
 2292         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
 2293         RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
 2294 
 2295         tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
 2296         RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
 2297 }
 2298 
 2299 static void
 2300 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
 2301 {
 2302         uint32_t tmp;
 2303 
 2304         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
 2305         RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
 2306 
 2307         tmp = addr[4] | addr[5] << 8 | 0xff << 16;
 2308         RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
 2309 }
 2310 
 2311 static void
 2312 rt2661_update_promisc(struct rt2661_softc *sc)
 2313 {
 2314         struct ifnet *ifp = sc->sc_ic.ic_ifp;
 2315         uint32_t tmp;
 2316 
 2317         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2318 
 2319         tmp &= ~RT2661_DROP_NOT_TO_ME;
 2320         if (!(ifp->if_flags & IFF_PROMISC))
 2321                 tmp |= RT2661_DROP_NOT_TO_ME;
 2322 
 2323         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2324 
 2325         DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
 2326             "entering" : "leaving"));
 2327 }
 2328 
 2329 #if 0
 2330 /*
 2331  * Update QoS (802.11e) settings for each h/w Tx ring.
 2332  */
 2333 static int
 2334 rt2661_wme_update(struct ieee80211com *ic)
 2335 {
 2336         struct rt2661_softc *sc = ic->ic_ifp->if_softc;
 2337         const struct wmeParams *wmep;
 2338 
 2339         wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
 2340 
 2341         /* XXX: not sure about shifts. */
 2342         /* XXX: the reference driver plays with AC_VI settings too. */
 2343 
 2344         /* update TxOp */
 2345         RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
 2346             wmep[WME_AC_BE].wmep_txopLimit << 16 |
 2347             wmep[WME_AC_BK].wmep_txopLimit);
 2348         RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
 2349             wmep[WME_AC_VI].wmep_txopLimit << 16 |
 2350             wmep[WME_AC_VO].wmep_txopLimit);
 2351 
 2352         /* update CWmin */
 2353         RAL_WRITE(sc, RT2661_CWMIN_CSR,
 2354             wmep[WME_AC_BE].wmep_logcwmin << 12 |
 2355             wmep[WME_AC_BK].wmep_logcwmin <<  8 |
 2356             wmep[WME_AC_VI].wmep_logcwmin <<  4 |
 2357             wmep[WME_AC_VO].wmep_logcwmin);
 2358 
 2359         /* update CWmax */
 2360         RAL_WRITE(sc, RT2661_CWMAX_CSR,
 2361             wmep[WME_AC_BE].wmep_logcwmax << 12 |
 2362             wmep[WME_AC_BK].wmep_logcwmax <<  8 |
 2363             wmep[WME_AC_VI].wmep_logcwmax <<  4 |
 2364             wmep[WME_AC_VO].wmep_logcwmax);
 2365 
 2366         /* update Aifsn */
 2367         RAL_WRITE(sc, RT2661_AIFSN_CSR,
 2368             wmep[WME_AC_BE].wmep_aifsn << 12 |
 2369             wmep[WME_AC_BK].wmep_aifsn <<  8 |
 2370             wmep[WME_AC_VI].wmep_aifsn <<  4 |
 2371             wmep[WME_AC_VO].wmep_aifsn);
 2372 
 2373         return 0;
 2374 }
 2375 #endif
 2376 
 2377 static void
 2378 rt2661_updateslot(struct ifnet *ifp)
 2379 {
 2380         struct rt2661_softc *sc = ifp->if_softc;
 2381         struct ieee80211com *ic = &sc->sc_ic;
 2382 
 2383         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 2384                 /*
 2385                  * In HostAP mode, we defer setting of new slot time until
 2386                  * updated ERP Information Element has propagated to all
 2387                  * associated STAs.
 2388                  */
 2389                 sc->sc_flags |= RT2661_UPDATE_SLOT;
 2390         } else
 2391                 rt2661_set_slottime(sc);
 2392 }
 2393 
 2394 static void
 2395 rt2661_set_slottime(struct rt2661_softc *sc)
 2396 {
 2397         struct ieee80211com *ic = &sc->sc_ic;
 2398         uint8_t slottime;
 2399         uint32_t tmp;
 2400 
 2401         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
 2402 
 2403         tmp = RAL_READ(sc, RT2661_MAC_CSR9);
 2404         tmp = (tmp & ~0xff) | slottime;
 2405         RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
 2406 
 2407         DPRINTF(("setting slot time to %uus\n", slottime));
 2408 }
 2409 
 2410 static const char *
 2411 rt2661_get_rf(int rev)
 2412 {
 2413         switch (rev) {
 2414         case RT2661_RF_5225:    return "RT5225";
 2415         case RT2661_RF_5325:    return "RT5325 (MIMO XR)";
 2416         case RT2661_RF_2527:    return "RT2527";
 2417         case RT2661_RF_2529:    return "RT2529 (MIMO XR)";
 2418         default:                return "unknown";
 2419         }
 2420 }
 2421 
 2422 static void
 2423 rt2661_read_eeprom(struct rt2661_softc *sc)
 2424 {
 2425         struct ieee80211com *ic = &sc->sc_ic;
 2426         uint16_t val;
 2427         int i;
 2428 
 2429         /* read MAC address */
 2430         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
 2431         ic->ic_myaddr[0] = val & 0xff;
 2432         ic->ic_myaddr[1] = val >> 8;
 2433 
 2434         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
 2435         ic->ic_myaddr[2] = val & 0xff;
 2436         ic->ic_myaddr[3] = val >> 8;
 2437 
 2438         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
 2439         ic->ic_myaddr[4] = val & 0xff;
 2440         ic->ic_myaddr[5] = val >> 8;
 2441 
 2442         val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
 2443         /* XXX: test if different from 0xffff? */
 2444         sc->rf_rev   = (val >> 11) & 0x1f;
 2445         sc->hw_radio = (val >> 10) & 0x1;
 2446         sc->rx_ant   = (val >> 4)  & 0x3;
 2447         sc->tx_ant   = (val >> 2)  & 0x3;
 2448         sc->nb_ant   = val & 0x3;
 2449 
 2450         DPRINTF(("RF revision=%d\n", sc->rf_rev));
 2451 
 2452         val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
 2453         sc->ext_5ghz_lna = (val >> 6) & 0x1;
 2454         sc->ext_2ghz_lna = (val >> 4) & 0x1;
 2455 
 2456         DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
 2457             sc->ext_2ghz_lna, sc->ext_5ghz_lna));
 2458 
 2459         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
 2460         if ((val & 0xff) != 0xff)
 2461                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2462 
 2463         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
 2464         if ((val & 0xff) != 0xff)
 2465                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2466 
 2467         /* adjust RSSI correction for external low-noise amplifier */
 2468         if (sc->ext_2ghz_lna)
 2469                 sc->rssi_2ghz_corr -= 14;
 2470         if (sc->ext_5ghz_lna)
 2471                 sc->rssi_5ghz_corr -= 14;
 2472 
 2473         DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
 2474             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
 2475 
 2476         val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
 2477         if ((val >> 8) != 0xff)
 2478                 sc->rfprog = (val >> 8) & 0x3;
 2479         if ((val & 0xff) != 0xff)
 2480                 sc->rffreq = val & 0xff;
 2481 
 2482         DPRINTF(("RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq));
 2483 
 2484         /* read Tx power for all a/b/g channels */
 2485         for (i = 0; i < 19; i++) {
 2486                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
 2487                 sc->txpow[i * 2] = (int8_t)(val >> 8);          /* signed */
 2488                 DPRINTF(("Channel=%d Tx power=%d\n",
 2489                     rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]));
 2490                 sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);    /* signed */
 2491                 DPRINTF(("Channel=%d Tx power=%d\n",
 2492                     rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]));
 2493         }
 2494 
 2495         /* read vendor-specific BBP values */
 2496         for (i = 0; i < 16; i++) {
 2497                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
 2498                 if (val == 0 || val == 0xffff)
 2499                         continue;       /* skip invalid entries */
 2500                 sc->bbp_prom[i].reg = val >> 8;
 2501                 sc->bbp_prom[i].val = val & 0xff;
 2502                 DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
 2503                     sc->bbp_prom[i].val));
 2504         }
 2505 }
 2506 
 2507 static int
 2508 rt2661_bbp_init(struct rt2661_softc *sc)
 2509 {
 2510 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
 2511         int i, ntries;
 2512         uint8_t val;
 2513 
 2514         /* wait for BBP to be ready */
 2515         for (ntries = 0; ntries < 100; ntries++) {
 2516                 val = rt2661_bbp_read(sc, 0);
 2517                 if (val != 0 && val != 0xff)
 2518                         break;
 2519                 DELAY(100);
 2520         }
 2521         if (ntries == 100) {
 2522                 aprint_error_dev(&sc->sc_dev, "timeout waiting for BBP\n");
 2523                 return EIO;
 2524         }
 2525 
 2526         /* initialize BBP registers to default values */
 2527         for (i = 0; i < N(rt2661_def_bbp); i++) {
 2528                 rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
 2529                     rt2661_def_bbp[i].val);
 2530         }
 2531 
 2532         /* write vendor-specific BBP values (from EEPROM) */
 2533         for (i = 0; i < 16; i++) {
 2534                 if (sc->bbp_prom[i].reg == 0)
 2535                         continue;
 2536                 rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
 2537         }
 2538 
 2539         return 0;
 2540 #undef N
 2541 }
 2542 
 2543 static int
 2544 rt2661_init(struct ifnet *ifp)
 2545 {
 2546 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
 2547         struct rt2661_softc *sc = ifp->if_softc;
 2548         struct ieee80211com *ic = &sc->sc_ic;
 2549         const char *name = NULL;        /* make lint happy */
 2550         uint8_t *ucode;
 2551         size_t size;
 2552         uint32_t tmp, star[3];
 2553         int i, ntries;
 2554         firmware_handle_t fh;
 2555 
 2556         /* for CardBus, power on the socket */
 2557         if (!(sc->sc_flags & RT2661_ENABLED)) {
 2558                 if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
 2559                         aprint_error_dev(&sc->sc_dev, "could not enable device\n");
 2560                         return EIO;
 2561                 }
 2562                 sc->sc_flags |= RT2661_ENABLED;
 2563         }
 2564 
 2565         rt2661_stop(ifp, 0);
 2566 
 2567         if (!(sc->sc_flags & RT2661_FWLOADED)) {
 2568                 switch (sc->sc_id) {
 2569                 case PCI_PRODUCT_RALINK_RT2561:
 2570                         name = "ral-rt2561";
 2571                         break;
 2572                 case PCI_PRODUCT_RALINK_RT2561S:
 2573                         name = "ral-rt2561s";
 2574                         break;
 2575                 case PCI_PRODUCT_RALINK_RT2661:
 2576                         name = "ral-rt2661";
 2577                         break;
 2578                 }
 2579 
 2580                 if (firmware_open("ral", name, &fh) != 0) {
 2581                         aprint_error_dev(&sc->sc_dev, "could not open microcode %s\n", name);
 2582                         rt2661_stop(ifp, 1);
 2583                         return EIO;
 2584                 }
 2585 
 2586                 size = firmware_get_size(fh);
 2587                 if (!(ucode = firmware_malloc(size))) {
 2588                         aprint_error_dev(&sc->sc_dev, "could not alloc microcode memory\n");
 2589                         firmware_close(fh);
 2590                         rt2661_stop(ifp, 1);
 2591                         return ENOMEM;
 2592                 }
 2593 
 2594                 if (firmware_read(fh, 0, ucode, size) != 0) {
 2595                         aprint_error_dev(&sc->sc_dev, "could not read microcode %s\n", name);
 2596                         firmware_free(ucode, 0);
 2597                         firmware_close(fh);
 2598                         rt2661_stop(ifp, 1);
 2599                         return EIO;
 2600                 }
 2601 
 2602                 if (rt2661_load_microcode(sc, ucode, size) != 0) {
 2603                         aprint_error_dev(&sc->sc_dev, "could not load 8051 microcode\n");
 2604                         firmware_free(ucode, 0);
 2605                         firmware_close(fh);
 2606                         rt2661_stop(ifp, 1);
 2607                         return EIO;
 2608                 }
 2609 
 2610                 firmware_free(ucode, 0);
 2611                 firmware_close(fh);
 2612                 sc->sc_flags |= RT2661_FWLOADED;
 2613         }
 2614 
 2615         /* initialize Tx rings */
 2616         RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
 2617         RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
 2618         RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
 2619         RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
 2620 
 2621         /* initialize Mgt ring */
 2622         RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
 2623 
 2624         /* initialize Rx ring */
 2625         RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
 2626 
 2627         /* initialize Tx rings sizes */
 2628         RAL_WRITE(sc, RT2661_TX_RING_CSR0,
 2629             RT2661_TX_RING_COUNT << 24 |
 2630             RT2661_TX_RING_COUNT << 16 |
 2631             RT2661_TX_RING_COUNT <<  8 |
 2632             RT2661_TX_RING_COUNT);
 2633 
 2634         RAL_WRITE(sc, RT2661_TX_RING_CSR1,
 2635             RT2661_TX_DESC_WSIZE << 16 |
 2636             RT2661_TX_RING_COUNT <<  8 |        /* XXX: HCCA ring unused */
 2637             RT2661_MGT_RING_COUNT);
 2638 
 2639         /* initialize Rx rings */
 2640         RAL_WRITE(sc, RT2661_RX_RING_CSR,
 2641             RT2661_RX_DESC_BACK  << 16 |
 2642             RT2661_RX_DESC_WSIZE <<  8 |
 2643             RT2661_RX_RING_COUNT);
 2644 
 2645         /* XXX: some magic here */
 2646         RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
 2647 
 2648         /* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
 2649         RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
 2650 
 2651         /* load base address of Rx ring */
 2652         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
 2653 
 2654         /* initialize MAC registers to default values */
 2655         for (i = 0; i < N(rt2661_def_mac); i++)
 2656                 RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
 2657 
 2658         IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
 2659         rt2661_set_macaddr(sc, ic->ic_myaddr);
 2660 
 2661         /* set host ready */
 2662         RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2663         RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2664 
 2665         /* wait for BBP/RF to wakeup */
 2666         for (ntries = 0; ntries < 1000; ntries++) {
 2667                 if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
 2668                         break;
 2669                 DELAY(1000);
 2670         }
 2671         if (ntries == 1000) {
 2672                 printf("timeout waiting for BBP/RF to wakeup\n");
 2673                 rt2661_stop(ifp, 1);
 2674                 return EIO;
 2675         }
 2676 
 2677         if (rt2661_bbp_init(sc) != 0) {
 2678                 rt2661_stop(ifp, 1);
 2679                 return EIO;
 2680         }
 2681 
 2682         /* select default channel */
 2683         sc->sc_curchan = ic->ic_curchan;
 2684         rt2661_select_band(sc, sc->sc_curchan);
 2685         rt2661_select_antenna(sc);
 2686         rt2661_set_chan(sc, sc->sc_curchan);
 2687 
 2688         /* update Rx filter */
 2689         tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
 2690 
 2691         tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
 2692         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 2693                 tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
 2694                        RT2661_DROP_ACKCTS;
 2695                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
 2696                         tmp |= RT2661_DROP_TODS;
 2697                 if (!(ifp->if_flags & IFF_PROMISC))
 2698                         tmp |= RT2661_DROP_NOT_TO_ME;
 2699         }
 2700 
 2701         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2702 
 2703         /* clear STA registers */
 2704         RAL_READ_REGION_4(sc, RT2661_STA_CSR0, star, N(star));
 2705 
 2706         /* initialize ASIC */
 2707         RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
 2708 
 2709         /* clear any pending interrupt */
 2710         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2711 
 2712         /* enable interrupts */
 2713         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 2714         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 2715 
 2716         /* kick Rx */
 2717         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
 2718 
 2719         ifp->if_flags &= ~IFF_OACTIVE;
 2720         ifp->if_flags |= IFF_RUNNING;
 2721 
 2722         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 2723                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 2724                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 2725         } else
 2726                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 2727 
 2728         return 0;
 2729 #undef N
 2730 }
 2731 
 2732 static void
 2733 rt2661_stop(struct ifnet *ifp, int disable)
 2734 {
 2735         struct rt2661_softc *sc = ifp->if_softc;
 2736         struct ieee80211com *ic = &sc->sc_ic;
 2737         uint32_t tmp;
 2738 
 2739         sc->sc_tx_timer = 0;
 2740         ifp->if_timer = 0;
 2741         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 2742 
 2743         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);  /* free all nodes */
 2744 
 2745         /* abort Tx (for all 5 Tx rings) */
 2746         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
 2747 
 2748         /* disable Rx (value remains after reset!) */
 2749         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2750         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2751 
 2752         /* reset ASIC */
 2753         RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2754         RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2755 
 2756         /* disable interrupts */
 2757         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 2758         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 2759 
 2760         /* clear any pending interrupt */
 2761         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2762         RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
 2763 
 2764         /* reset Tx and Rx rings */
 2765         rt2661_reset_tx_ring(sc, &sc->txq[0]);
 2766         rt2661_reset_tx_ring(sc, &sc->txq[1]);
 2767         rt2661_reset_tx_ring(sc, &sc->txq[2]);
 2768         rt2661_reset_tx_ring(sc, &sc->txq[3]);
 2769         rt2661_reset_tx_ring(sc, &sc->mgtq);
 2770         rt2661_reset_rx_ring(sc, &sc->rxq);
 2771 
 2772         /* for CardBus, power down the socket */
 2773         if (disable && sc->sc_disable != NULL) {
 2774                 if (sc->sc_flags & RT2661_ENABLED) {
 2775                         (*sc->sc_disable)(sc);
 2776                         sc->sc_flags &= ~(RT2661_ENABLED | RT2661_FWLOADED);
 2777                 }
 2778         }
 2779 }
 2780 
 2781 static int
 2782 rt2661_load_microcode(struct rt2661_softc *sc, const uint8_t *ucode, int size)
 2783 {
 2784         int ntries;
 2785 
 2786         /* reset 8051 */
 2787         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2788 
 2789         /* cancel any pending Host to MCU command */
 2790         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
 2791         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 2792         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
 2793 
 2794         /* write 8051's microcode */
 2795         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
 2796         RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, ucode, size);
 2797         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2798 
 2799         /* kick 8051's ass */
 2800         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
 2801 
 2802         /* wait for 8051 to initialize */
 2803         for (ntries = 0; ntries < 500; ntries++) {
 2804                 if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
 2805                         break;
 2806                 DELAY(100);
 2807         }
 2808         if (ntries == 500) {
 2809                 printf("timeout waiting for MCU to initialize\n");
 2810                 return EIO;
 2811         }
 2812         return 0;
 2813 }
 2814 
 2815 /*
 2816  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
 2817  * false CCA count.  This function is called periodically (every seconds) when
 2818  * in the RUN state.  Values taken from the reference driver.
 2819  */
 2820 static void
 2821 rt2661_rx_tune(struct rt2661_softc *sc)
 2822 {
 2823         uint8_t bbp17;
 2824         uint16_t cca;
 2825         int lo, hi, dbm;
 2826 
 2827         /*
 2828          * Tuning range depends on operating band and on the presence of an
 2829          * external low-noise amplifier.
 2830          */
 2831         lo = 0x20;
 2832         if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
 2833                 lo += 0x08;
 2834         if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
 2835             (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
 2836                 lo += 0x10;
 2837         hi = lo + 0x20;
 2838 
 2839         dbm = sc->avg_rssi;
 2840         /* retrieve false CCA count since last call (clear on read) */
 2841         cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
 2842 
 2843         DPRINTFN(2, ("RSSI=%ddBm false CCA=%d\n", dbm, cca));
 2844 
 2845         if (dbm < -74) {
 2846                 /* very bad RSSI, tune using false CCA count */
 2847                 bbp17 = sc->bbp17; /* current value */
 2848 
 2849                 hi -= 2 * (-74 - dbm);
 2850                 if (hi < lo)
 2851                         hi = lo;
 2852 
 2853                 if (bbp17 > hi)
 2854                         bbp17 = hi;
 2855                 else if (cca > 512)
 2856                         bbp17 = min(bbp17 + 1, hi);
 2857                 else if (cca < 100)
 2858                         bbp17 = max(bbp17 - 1, lo);
 2859 
 2860         } else if (dbm < -66) {
 2861                 bbp17 = lo + 0x08;
 2862         } else if (dbm < -58) {
 2863                 bbp17 = lo + 0x10;
 2864         } else if (dbm < -35) {
 2865                 bbp17 = hi;
 2866         } else {        /* very good RSSI >= -35dBm */
 2867                 bbp17 = 0x60;   /* very low sensitivity */
 2868         }
 2869 
 2870         if (bbp17 != sc->bbp17) {
 2871                 DPRINTF(("BBP17 %x->%x\n", sc->bbp17, bbp17));
 2872                 rt2661_bbp_write(sc, 17, bbp17);
 2873                 sc->bbp17 = bbp17;
 2874         }
 2875 }
 2876 
 2877 #ifdef notyet
 2878 /*
 2879  * Enter/Leave radar detection mode.
 2880  * This is for 802.11h additional regulatory domains.
 2881  */
 2882 static void
 2883 rt2661_radar_start(struct rt2661_softc *sc)
 2884 {
 2885         uint32_t tmp;
 2886 
 2887         /* disable Rx */
 2888         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2889         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2890 
 2891         rt2661_bbp_write(sc, 82, 0x20);
 2892         rt2661_bbp_write(sc, 83, 0x00);
 2893         rt2661_bbp_write(sc, 84, 0x40);
 2894 
 2895         /* save current BBP registers values */
 2896         sc->bbp18 = rt2661_bbp_read(sc, 18);
 2897         sc->bbp21 = rt2661_bbp_read(sc, 21);
 2898         sc->bbp22 = rt2661_bbp_read(sc, 22);
 2899         sc->bbp16 = rt2661_bbp_read(sc, 16);
 2900         sc->bbp17 = rt2661_bbp_read(sc, 17);
 2901         sc->bbp64 = rt2661_bbp_read(sc, 64);
 2902 
 2903         rt2661_bbp_write(sc, 18, 0xff);
 2904         rt2661_bbp_write(sc, 21, 0x3f);
 2905         rt2661_bbp_write(sc, 22, 0x3f);
 2906         rt2661_bbp_write(sc, 16, 0xbd);
 2907         rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
 2908         rt2661_bbp_write(sc, 64, 0x21);
 2909 
 2910         /* restore Rx filter */
 2911         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2912 }
 2913 
 2914 static int
 2915 rt2661_radar_stop(struct rt2661_softc *sc)
 2916 {
 2917         uint8_t bbp66;
 2918 
 2919         /* read radar detection result */
 2920         bbp66 = rt2661_bbp_read(sc, 66);
 2921 
 2922         /* restore BBP registers values */
 2923         rt2661_bbp_write(sc, 16, sc->bbp16);
 2924         rt2661_bbp_write(sc, 17, sc->bbp17);
 2925         rt2661_bbp_write(sc, 18, sc->bbp18);
 2926         rt2661_bbp_write(sc, 21, sc->bbp21);
 2927         rt2661_bbp_write(sc, 22, sc->bbp22);
 2928         rt2661_bbp_write(sc, 64, sc->bbp64);
 2929 
 2930         return bbp66 == 1;
 2931 }
 2932 #endif
 2933 
 2934 static int
 2935 rt2661_prepare_beacon(struct rt2661_softc *sc)
 2936 {
 2937         struct ieee80211com *ic = &sc->sc_ic;
 2938         struct ieee80211_node *ni = ic->ic_bss;
 2939         struct rt2661_tx_desc desc;
 2940         struct mbuf *m0;
 2941         struct ieee80211_beacon_offsets bo;
 2942         int rate;
 2943 
 2944         m0 = ieee80211_beacon_alloc(ic, ni, &bo);
 2945         if (m0 == NULL) {
 2946                 aprint_error_dev(&sc->sc_dev, "could not allocate beacon frame\n");
 2947                 return ENOBUFS;
 2948         }
 2949 
 2950         /* send beacons at the lowest available rate */
 2951         rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
 2952 
 2953         rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
 2954             m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
 2955 
 2956         /* copy the first 24 bytes of Tx descriptor into NIC memory */
 2957         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
 2958 
 2959         /* copy beacon header and payload into NIC memory */
 2960         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
 2961             mtod(m0, uint8_t *), m0->m_pkthdr.len);
 2962 
 2963         m_freem(m0);
 2964 
 2965         /*
 2966          * Store offset of ERP Information Element so that we can update it
 2967          * dynamically when the slot time changes.
 2968          * XXX: this is ugly since it depends on how net80211 builds beacon
 2969          * frames but ieee80211_beacon_alloc() doesn't store offsets for us.
 2970          */
 2971         if (ic->ic_curmode == IEEE80211_MODE_11G) {
 2972                 sc->erp_csr =
 2973                     RT2661_HW_BEACON_BASE0 + 24 +
 2974                     sizeof (struct ieee80211_frame) +
 2975                     8 + 2 + 2 + 2 + ni->ni_esslen +
 2976                     2 + min(ni->ni_rates.rs_nrates, IEEE80211_RATE_SIZE) +
 2977                     2 + 1 +
 2978                     ((ic->ic_opmode == IEEE80211_M_IBSS) ? 4 : 6) +
 2979                     2;
 2980         }
 2981 
 2982         return 0;
 2983 }
 2984 
 2985 /*
 2986  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
 2987  * and HostAP operating modes.
 2988  */
 2989 static void
 2990 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
 2991 {
 2992         struct ieee80211com *ic = &sc->sc_ic;
 2993         uint32_t tmp;
 2994 
 2995         if (ic->ic_opmode != IEEE80211_M_STA) {
 2996                 /*
 2997                  * Change default 16ms TBTT adjustment to 8ms.
 2998                  * Must be done before enabling beacon generation.
 2999                  */
 3000                 RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
 3001         }
 3002 
 3003         tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
 3004 
 3005         /* set beacon interval (in 1/16ms unit) */
 3006         tmp |= ic->ic_bss->ni_intval * 16;
 3007 
 3008         tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
 3009         if (ic->ic_opmode == IEEE80211_M_STA)
 3010                 tmp |= RT2661_TSF_MODE(1);
 3011         else
 3012                 tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
 3013 
 3014         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
 3015 }
 3016 
 3017 /*
 3018  * Retrieve the "Received Signal Strength Indicator" from the raw values
 3019  * contained in Rx descriptors.  The computation depends on which band the
 3020  * frame was received.  Correction values taken from the reference driver.
 3021  */
 3022 static int
 3023 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
 3024 {
 3025         int lna, agc, rssi;
 3026 
 3027         lna = (raw >> 5) & 0x3;
 3028         agc = raw & 0x1f;
 3029 
 3030         rssi = 2 * agc;
 3031 
 3032         if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
 3033                 rssi += sc->rssi_2ghz_corr;
 3034 
 3035                 if (lna == 1)
 3036                         rssi -= 64;
 3037                 else if (lna == 2)
 3038                         rssi -= 74;
 3039                 else if (lna == 3)
 3040                         rssi -= 90;
 3041         } else {
 3042                 rssi += sc->rssi_5ghz_corr;
 3043 
 3044                 if (lna == 1)
 3045                         rssi -= 64;
 3046                 else if (lna == 2)
 3047                         rssi -= 86;
 3048                 else if (lna == 3)
 3049                         rssi -= 100;
 3050         }
 3051         return rssi;
 3052 }

Cache object: 3a4a6bdd12ac1fe521e7da6cd8ebd833


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.