The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ic/rt2661.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: rt2661.c,v 1.44 2021/06/16 00:21:18 riastradh Exp $    */
    2 /*      $OpenBSD: rt2661.c,v 1.17 2006/05/01 08:41:11 damien Exp $      */
    3 /*      $FreeBSD: rt2560.c,v 1.5 2006/06/02 19:59:31 csjp Exp $ */
    4 
    5 /*-
    6  * Copyright (c) 2006
    7  *      Damien Bergamini <damien.bergamini@free.fr>
    8  *
    9  * Permission to use, copy, modify, and distribute this software for any
   10  * purpose with or without fee is hereby granted, provided that the above
   11  * copyright notice and this permission notice appear in all copies.
   12  *
   13  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   14  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   15  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   16  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   17  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   18  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   19  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   20  */
   21 
   22 /*-
   23  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
   24  * http://www.ralinktech.com/
   25  */
   26 
   27 #include <sys/cdefs.h>
   28 __KERNEL_RCSID(0, "$NetBSD: rt2661.c,v 1.44 2021/06/16 00:21:18 riastradh Exp $");
   29 
   30 
   31 #include <sys/param.h>
   32 #include <sys/sockio.h>
   33 #include <sys/sysctl.h>
   34 #include <sys/mbuf.h>
   35 #include <sys/kernel.h>
   36 #include <sys/socket.h>
   37 #include <sys/systm.h>
   38 #include <sys/malloc.h>
   39 #include <sys/callout.h>
   40 #include <sys/conf.h>
   41 #include <sys/device.h>
   42 
   43 #include <sys/bus.h>
   44 #include <machine/endian.h>
   45 #include <sys/intr.h>
   46 
   47 #include <net/bpf.h>
   48 #include <net/if.h>
   49 #include <net/if_arp.h>
   50 #include <net/if_dl.h>
   51 #include <net/if_media.h>
   52 #include <net/if_types.h>
   53 #include <net/if_ether.h>
   54 
   55 #include <netinet/in.h>
   56 #include <netinet/in_systm.h>
   57 #include <netinet/in_var.h>
   58 #include <netinet/ip.h>
   59 
   60 #include <net80211/ieee80211_var.h>
   61 #include <net80211/ieee80211_amrr.h>
   62 #include <net80211/ieee80211_radiotap.h>
   63 
   64 #include <dev/ic/rt2661reg.h>
   65 #include <dev/ic/rt2661var.h>
   66 
   67 #include <dev/pci/pcireg.h>
   68 #include <dev/pci/pcivar.h>
   69 #include <dev/pci/pcidevs.h>
   70 
   71 #include <dev/firmload.h>
   72 
   73 #ifdef RAL_DEBUG
   74 #define DPRINTF(x)      do { if (rt2661_debug > 0) printf x; } while (0)
   75 #define DPRINTFN(n, x)  do { if (rt2661_debug >= (n)) printf x; } while (0)
   76 int rt2661_debug = 0;
   77 #else
   78 #define DPRINTF(x)
   79 #define DPRINTFN(n, x)
   80 #endif
   81 
   82 static int      rt2661_alloc_tx_ring(struct rt2661_softc *,
   83                     struct rt2661_tx_ring *, int);
   84 static void     rt2661_reset_tx_ring(struct rt2661_softc *,
   85                     struct rt2661_tx_ring *);
   86 static void     rt2661_free_tx_ring(struct rt2661_softc *,
   87                     struct rt2661_tx_ring *);
   88 static int      rt2661_alloc_rx_ring(struct rt2661_softc *,
   89                     struct rt2661_rx_ring *, int);
   90 static void     rt2661_reset_rx_ring(struct rt2661_softc *,
   91                     struct rt2661_rx_ring *);
   92 static void     rt2661_free_rx_ring(struct rt2661_softc *,
   93                     struct rt2661_rx_ring *);
   94 static struct ieee80211_node *
   95                 rt2661_node_alloc(struct ieee80211_node_table *);
   96 static int      rt2661_media_change(struct ifnet *);
   97 static void     rt2661_next_scan(void *);
   98 static void     rt2661_iter_func(void *, struct ieee80211_node *);
   99 static void     rt2661_updatestats(void *);
  100 static void     rt2661_newassoc(struct ieee80211_node *, int);
  101 static int      rt2661_newstate(struct ieee80211com *, enum ieee80211_state,
  102                     int);
  103 static uint16_t rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
  104 static void     rt2661_tx_intr(struct rt2661_softc *);
  105 static void     rt2661_tx_dma_intr(struct rt2661_softc *,
  106                     struct rt2661_tx_ring *);
  107 static void     rt2661_rx_intr(struct rt2661_softc *);
  108 static void     rt2661_mcu_beacon_expire(struct rt2661_softc *);
  109 static void     rt2661_mcu_wakeup(struct rt2661_softc *);
  110 static void     rt2661_mcu_cmd_intr(struct rt2661_softc *);
  111 int             rt2661_intr(void *);
  112 static uint8_t  rt2661_rxrate(struct rt2661_rx_desc *);
  113 static int      rt2661_ack_rate(struct ieee80211com *, int);
  114 static uint16_t rt2661_txtime(int, int, uint32_t);
  115 static uint8_t  rt2661_plcp_signal(int);
  116 static void     rt2661_setup_tx_desc(struct rt2661_softc *,
  117                     struct rt2661_tx_desc *, uint32_t, uint16_t, int, int,
  118                     const bus_dma_segment_t *, int, int);
  119 static int      rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
  120                     struct ieee80211_node *);
  121 static struct mbuf *
  122                 rt2661_get_rts(struct rt2661_softc *,
  123                     struct ieee80211_frame *, uint16_t);
  124 static int      rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
  125                     struct ieee80211_node *, int);
  126 static void     rt2661_start(struct ifnet *);
  127 static void     rt2661_watchdog(struct ifnet *);
  128 static int      rt2661_reset(struct ifnet *);
  129 static int      rt2661_ioctl(struct ifnet *, u_long, void *);
  130 static void     rt2661_bbp_write(struct rt2661_softc *, uint8_t, uint8_t);
  131 static uint8_t  rt2661_bbp_read(struct rt2661_softc *, uint8_t);
  132 static void     rt2661_rf_write(struct rt2661_softc *, uint8_t, uint32_t);
  133 static int      rt2661_tx_cmd(struct rt2661_softc *, uint8_t, uint16_t);
  134 static void     rt2661_select_antenna(struct rt2661_softc *);
  135 static void     rt2661_enable_mrr(struct rt2661_softc *);
  136 static void     rt2661_set_txpreamble(struct rt2661_softc *);
  137 static void     rt2661_set_basicrates(struct rt2661_softc *,
  138                         const struct ieee80211_rateset *);
  139 static void     rt2661_select_band(struct rt2661_softc *,
  140                     struct ieee80211_channel *);
  141 static void     rt2661_set_chan(struct rt2661_softc *,
  142                     struct ieee80211_channel *);
  143 static void     rt2661_set_bssid(struct rt2661_softc *, const uint8_t *);
  144 static void     rt2661_set_macaddr(struct rt2661_softc *, const uint8_t *);
  145 static void     rt2661_update_promisc(struct rt2661_softc *);
  146 #if 0
  147 static int      rt2661_wme_update(struct ieee80211com *);
  148 #endif
  149 
  150 static void     rt2661_updateslot(struct ifnet *);
  151 static void     rt2661_set_slottime(struct rt2661_softc *);
  152 static const char *
  153                 rt2661_get_rf(int);
  154 static void     rt2661_read_eeprom(struct rt2661_softc *);
  155 static int      rt2661_bbp_init(struct rt2661_softc *);
  156 static int      rt2661_init(struct ifnet *);
  157 static void     rt2661_stop(struct ifnet *, int);
  158 static int      rt2661_load_microcode(struct rt2661_softc *, const uint8_t *,
  159                     int);
  160 static void     rt2661_rx_tune(struct rt2661_softc *);
  161 #ifdef notyet
  162 static void     rt2661_radar_start(struct rt2661_softc *);
  163 static int      rt2661_radar_stop(struct rt2661_softc *);
  164 #endif
  165 static int      rt2661_prepare_beacon(struct rt2661_softc *);
  166 static void     rt2661_enable_tsf_sync(struct rt2661_softc *);
  167 static int      rt2661_get_rssi(struct rt2661_softc *, uint8_t);
  168 static void     rt2661_softintr(void *);
  169 
  170 static const struct {
  171         uint32_t        reg;
  172         uint32_t        val;
  173 } rt2661_def_mac[] = {
  174         RT2661_DEF_MAC
  175 };
  176 
  177 static const struct {
  178         uint8_t reg;
  179         uint8_t val;
  180 } rt2661_def_bbp[] = {
  181         RT2661_DEF_BBP
  182 };
  183 
  184 static const struct rfprog {
  185         uint8_t         chan;
  186         uint32_t        r1, r2, r3, r4;
  187 } rt2661_rf5225_1[] = {
  188         RT2661_RF5225_1
  189 }, rt2661_rf5225_2[] = {
  190         RT2661_RF5225_2
  191 };
  192 
  193 int
  194 rt2661_attach(void *xsc, int id)
  195 {
  196         struct rt2661_softc *sc = xsc;
  197         struct ieee80211com *ic = &sc->sc_ic;
  198         struct ifnet *ifp = &sc->sc_if;
  199         uint32_t val;
  200         int error, i, ntries;
  201 
  202         sc->sc_id = id;
  203 
  204         sc->amrr.amrr_min_success_threshold =  1;
  205         sc->amrr.amrr_max_success_threshold = 15;
  206         callout_init(&sc->scan_ch, 0);
  207         callout_init(&sc->amrr_ch, 0);
  208 
  209         /* wait for NIC to initialize */
  210         for (ntries = 0; ntries < 1000; ntries++) {
  211                 if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
  212                         break;
  213                 DELAY(1000);
  214         }
  215         if (ntries == 1000) {
  216                 aprint_error_dev(sc->sc_dev, "timeout waiting for NIC to initialize\n");
  217                 return EIO;
  218         }
  219 
  220         /* retrieve RF rev. no and various other things from EEPROM */
  221         rt2661_read_eeprom(sc);
  222         aprint_normal_dev(sc->sc_dev, "802.11 address %s\n",
  223             ether_sprintf(ic->ic_myaddr));
  224 
  225         aprint_normal_dev(sc->sc_dev, "MAC/BBP RT%X, RF %s\n", val,
  226             rt2661_get_rf(sc->rf_rev));
  227 
  228         sc->sc_soft_ih = softint_establish(SOFTINT_NET, rt2661_softintr, sc);
  229         if (sc->sc_soft_ih == NULL) {
  230                 aprint_error_dev(sc->sc_dev, "could not establish softint\n");
  231                 goto fail0;
  232         }
  233 
  234         /*
  235          * Allocate Tx and Rx rings.
  236          */
  237         error = rt2661_alloc_tx_ring(sc, &sc->txq[0], RT2661_TX_RING_COUNT);
  238         if (error != 0) {
  239                 aprint_error_dev(sc->sc_dev, "could not allocate Tx ring 0\n");
  240                 goto fail1;
  241         }
  242 
  243         error = rt2661_alloc_tx_ring(sc, &sc->txq[1], RT2661_TX_RING_COUNT);
  244         if (error != 0) {
  245                 aprint_error_dev(sc->sc_dev, "could not allocate Tx ring 1\n");
  246                 goto fail2;
  247         }
  248 
  249         error = rt2661_alloc_tx_ring(sc, &sc->txq[2], RT2661_TX_RING_COUNT);
  250         if (error != 0) {
  251                 aprint_error_dev(sc->sc_dev, "could not allocate Tx ring 2\n");
  252                 goto fail3;
  253         }
  254 
  255         error = rt2661_alloc_tx_ring(sc, &sc->txq[3], RT2661_TX_RING_COUNT);
  256         if (error != 0) {
  257                 aprint_error_dev(sc->sc_dev, "could not allocate Tx ring 3\n");
  258                 goto fail4;
  259         }
  260 
  261         error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
  262         if (error != 0) {
  263                 aprint_error_dev(sc->sc_dev, "could not allocate Mgt ring\n");
  264                 goto fail5;
  265         }
  266 
  267         error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
  268         if (error != 0) {
  269                 aprint_error_dev(sc->sc_dev, "could not allocate Rx ring\n");
  270                 goto fail6;
  271         }
  272 
  273         ifp->if_softc = sc;
  274         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
  275         ifp->if_init = rt2661_init;
  276         ifp->if_stop = rt2661_stop;
  277         ifp->if_ioctl = rt2661_ioctl;
  278         ifp->if_start = rt2661_start;
  279         ifp->if_watchdog = rt2661_watchdog;
  280         IFQ_SET_READY(&ifp->if_snd);
  281         memcpy(ifp->if_xname, device_xname(sc->sc_dev), IFNAMSIZ);
  282 
  283         ic->ic_ifp = ifp;
  284         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
  285         ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
  286         ic->ic_state = IEEE80211_S_INIT;
  287 
  288         /* set device capabilities */
  289         ic->ic_caps =
  290             IEEE80211_C_IBSS |          /* IBSS mode supported */
  291             IEEE80211_C_MONITOR |       /* monitor mode supported */
  292             IEEE80211_C_HOSTAP |        /* HostAP mode supported */
  293             IEEE80211_C_TXPMGT |        /* tx power management */
  294             IEEE80211_C_SHPREAMBLE |    /* short preamble supported */
  295             IEEE80211_C_SHSLOT |        /* short slot time supported */
  296             IEEE80211_C_WPA;            /* 802.11i */
  297 
  298         if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
  299                 /* set supported .11a rates */
  300                 ic->ic_sup_rates[IEEE80211_MODE_11A] = ieee80211_std_rateset_11a;
  301 
  302                 /* set supported .11a channels */
  303                 for (i = 36; i <= 64; i += 4) {
  304                         ic->ic_channels[i].ic_freq =
  305                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
  306                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
  307                 }
  308                 for (i = 100; i <= 140; i += 4) {
  309                         ic->ic_channels[i].ic_freq =
  310                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
  311                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
  312                 }
  313                 for (i = 149; i <= 165; i += 4) {
  314                         ic->ic_channels[i].ic_freq =
  315                             ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
  316                         ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
  317                 }
  318         }
  319 
  320         /* set supported .11b and .11g rates */
  321         ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
  322         ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
  323 
  324         /* set supported .11b and .11g channels (1 through 14) */
  325         for (i = 1; i <= 14; i++) {
  326                 ic->ic_channels[i].ic_freq =
  327                     ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
  328                 ic->ic_channels[i].ic_flags =
  329                     IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
  330                     IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
  331         }
  332 
  333         if_initialize(ifp);
  334         ieee80211_ifattach(ic);
  335         /* Use common softint-based if_input */
  336         ifp->if_percpuq = if_percpuq_create(ifp);
  337         if_register(ifp);
  338 
  339         ic->ic_node_alloc = rt2661_node_alloc;
  340         ic->ic_newassoc = rt2661_newassoc;
  341         ic->ic_updateslot = rt2661_updateslot;
  342         ic->ic_reset = rt2661_reset;
  343 
  344         /* override state transition machine */
  345         sc->sc_newstate = ic->ic_newstate;
  346         ic->ic_newstate = rt2661_newstate;
  347         ieee80211_media_init(ic, rt2661_media_change, ieee80211_media_status);
  348 
  349         bpf_attach2(ifp, DLT_IEEE802_11_RADIO,
  350             sizeof(struct ieee80211_frame) + sizeof(sc->sc_txtap),
  351             &sc->sc_drvbpf);
  352 
  353         sc->sc_rxtap_len = roundup(sizeof(sc->sc_rxtap), sizeof(u_int32_t));
  354         sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
  355         sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2661_RX_RADIOTAP_PRESENT);
  356 
  357         sc->sc_txtap_len = roundup(sizeof(sc->sc_txtap), sizeof(u_int32_t));
  358         sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
  359         sc->sc_txtap.wt_ihdr.it_present = htole32(RT2661_TX_RADIOTAP_PRESENT);
  360 
  361         ieee80211_announce(ic);
  362 
  363         if (pmf_device_register(sc->sc_dev, NULL, NULL))
  364                 pmf_class_network_register(sc->sc_dev, ifp);
  365         else
  366                 aprint_error_dev(sc->sc_dev,
  367                     "couldn't establish power handler\n");
  368 
  369         return 0;
  370 
  371 fail6:  rt2661_free_tx_ring(sc, &sc->mgtq);
  372 fail5:  rt2661_free_tx_ring(sc, &sc->txq[3]);
  373 fail4:  rt2661_free_tx_ring(sc, &sc->txq[2]);
  374 fail3:  rt2661_free_tx_ring(sc, &sc->txq[1]);
  375 fail2:  rt2661_free_tx_ring(sc, &sc->txq[0]);
  376 fail1:  softint_disestablish(sc->sc_soft_ih);
  377         sc->sc_soft_ih = NULL;
  378 fail0:  return ENXIO;
  379 }
  380 
  381 int
  382 rt2661_detach(void *xsc)
  383 {
  384         struct rt2661_softc *sc = xsc;
  385         struct ifnet *ifp = &sc->sc_if;
  386 
  387         callout_stop(&sc->scan_ch);
  388         callout_stop(&sc->amrr_ch);
  389 
  390         pmf_device_deregister(sc->sc_dev);
  391 
  392         ieee80211_ifdetach(&sc->sc_ic);
  393         if_detach(ifp);
  394 
  395         rt2661_free_tx_ring(sc, &sc->txq[0]);
  396         rt2661_free_tx_ring(sc, &sc->txq[1]);
  397         rt2661_free_tx_ring(sc, &sc->txq[2]);
  398         rt2661_free_tx_ring(sc, &sc->txq[3]);
  399         rt2661_free_tx_ring(sc, &sc->mgtq);
  400         rt2661_free_rx_ring(sc, &sc->rxq);
  401 
  402         if (sc->sc_soft_ih != NULL) {
  403                 softint_disestablish(sc->sc_soft_ih);
  404                 sc->sc_soft_ih = NULL;
  405         }
  406 
  407         return 0;
  408 }
  409 
  410 static int
  411 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
  412     int count)
  413 {
  414         int i, nsegs, error;
  415 
  416         ring->count = count;
  417         ring->queued = 0;
  418         ring->cur = ring->next = ring->stat = 0;
  419 
  420         error = bus_dmamap_create(sc->sc_dmat, count * RT2661_TX_DESC_SIZE, 1,
  421             count * RT2661_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
  422         if (error != 0) {
  423                 aprint_error_dev(sc->sc_dev, "could not create desc DMA map\n");
  424                 goto fail;
  425         }
  426 
  427         error = bus_dmamem_alloc(sc->sc_dmat, count * RT2661_TX_DESC_SIZE,
  428             PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
  429         if (error != 0) {
  430                 aprint_error_dev(sc->sc_dev, "could not allocate DMA memory\n");
  431                 goto fail;
  432         }
  433 
  434         error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
  435             count * RT2661_TX_DESC_SIZE, (void **)&ring->desc,
  436             BUS_DMA_NOWAIT);
  437         if (error != 0) {
  438                 aprint_error_dev(sc->sc_dev, "could not map desc DMA memory\n");
  439                 goto fail;
  440         }
  441 
  442         error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
  443             count * RT2661_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
  444         if (error != 0) {
  445                 aprint_error_dev(sc->sc_dev, "could not load desc DMA map\n");
  446                 goto fail;
  447         }
  448 
  449         memset(ring->desc, 0, count * RT2661_TX_DESC_SIZE);
  450         ring->physaddr = ring->map->dm_segs->ds_addr;
  451 
  452         ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
  453             M_WAITOK | M_ZERO);
  454 
  455         for (i = 0; i < count; i++) {
  456                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
  457                     RT2661_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
  458                     &ring->data[i].map);
  459                 if (error != 0) {
  460                         aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
  461                         goto fail;
  462                 }
  463         }
  464 
  465         return 0;
  466 
  467 fail:   rt2661_free_tx_ring(sc, ring);
  468         return error;
  469 }
  470 
  471 static void
  472 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  473 {
  474         struct rt2661_tx_desc *desc;
  475         struct rt2661_tx_data *data;
  476         int i;
  477 
  478         for (i = 0; i < ring->count; i++) {
  479                 desc = &ring->desc[i];
  480                 data = &ring->data[i];
  481 
  482                 if (data->m != NULL) {
  483                         bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  484                             data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  485                         bus_dmamap_unload(sc->sc_dmat, data->map);
  486                         m_freem(data->m);
  487                         data->m = NULL;
  488                 }
  489 
  490                 if (data->ni != NULL) {
  491                         ieee80211_free_node(data->ni);
  492                         data->ni = NULL;
  493                 }
  494 
  495                 desc->flags = 0;
  496         }
  497 
  498         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  499             BUS_DMASYNC_PREWRITE);
  500 
  501         ring->queued = 0;
  502         ring->cur = ring->next = ring->stat = 0;
  503 }
  504 
  505 
  506 static void
  507 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  508 {
  509         struct rt2661_tx_data *data;
  510         int i;
  511 
  512         if (ring->desc != NULL) {
  513                 bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
  514                     ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  515                 bus_dmamap_unload(sc->sc_dmat, ring->map);
  516                 bus_dmamem_unmap(sc->sc_dmat, (void *)ring->desc,
  517                     ring->count * RT2661_TX_DESC_SIZE);
  518                 bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
  519         }
  520 
  521         if (ring->data != NULL) {
  522                 for (i = 0; i < ring->count; i++) {
  523                         data = &ring->data[i];
  524 
  525                         if (data->m != NULL) {
  526                                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  527                                     data->map->dm_mapsize,
  528                                     BUS_DMASYNC_POSTWRITE);
  529                                 bus_dmamap_unload(sc->sc_dmat, data->map);
  530                                 m_freem(data->m);
  531                         }
  532 
  533                         if (data->ni != NULL)
  534                                 ieee80211_free_node(data->ni);
  535 
  536                         if (data->map != NULL)
  537                                 bus_dmamap_destroy(sc->sc_dmat, data->map);
  538                 }
  539                 free(ring->data, M_DEVBUF);
  540         }
  541 }
  542 
  543 static int
  544 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
  545     int count)
  546 {
  547         struct rt2661_rx_desc *desc;
  548         struct rt2661_rx_data *data;
  549         int i, nsegs, error;
  550 
  551         ring->count = count;
  552         ring->cur = ring->next = 0;
  553 
  554         error = bus_dmamap_create(sc->sc_dmat, count * RT2661_RX_DESC_SIZE, 1,
  555             count * RT2661_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
  556         if (error != 0) {
  557                 aprint_error_dev(sc->sc_dev, "could not create desc DMA map\n");
  558                 goto fail;
  559         }
  560 
  561         error = bus_dmamem_alloc(sc->sc_dmat, count * RT2661_RX_DESC_SIZE,
  562             PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
  563         if (error != 0) {
  564                 aprint_error_dev(sc->sc_dev, "could not allocate DMA memory\n");
  565                 goto fail;
  566         }
  567 
  568         error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
  569             count * RT2661_RX_DESC_SIZE, (void **)&ring->desc,
  570             BUS_DMA_NOWAIT);
  571         if (error != 0) {
  572                 aprint_error_dev(sc->sc_dev, "could not map desc DMA memory\n");
  573                 goto fail;
  574         }
  575 
  576         error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
  577             count * RT2661_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
  578         if (error != 0) {
  579                 aprint_error_dev(sc->sc_dev, "could not load desc DMA map\n");
  580                 goto fail;
  581         }
  582 
  583         memset(ring->desc, 0, count * RT2661_RX_DESC_SIZE);
  584         ring->physaddr = ring->map->dm_segs->ds_addr;
  585 
  586         ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
  587             M_WAITOK | M_ZERO);
  588 
  589         /*
  590          * Pre-allocate Rx buffers and populate Rx ring.
  591          */
  592         for (i = 0; i < count; i++) {
  593                 desc = &sc->rxq.desc[i];
  594                 data = &sc->rxq.data[i];
  595 
  596                 error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
  597                     0, BUS_DMA_NOWAIT, &data->map);
  598                 if (error != 0) {
  599                         aprint_error_dev(sc->sc_dev, "could not create DMA map\n");
  600                         goto fail;
  601                 }
  602 
  603                 MGETHDR(data->m, M_DONTWAIT, MT_DATA);
  604                 if (data->m == NULL) {
  605                         aprint_error_dev(sc->sc_dev, "could not allocate rx mbuf\n");
  606                         error = ENOMEM;
  607                         goto fail;
  608                 }
  609 
  610                 MCLGET(data->m, M_DONTWAIT);
  611                 if (!(data->m->m_flags & M_EXT)) {
  612                         aprint_error_dev(sc->sc_dev, "could not allocate rx mbuf cluster\n");
  613                         error = ENOMEM;
  614                         goto fail;
  615                 }
  616 
  617                 error = bus_dmamap_load(sc->sc_dmat, data->map,
  618                     mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
  619                 if (error != 0) {
  620                         aprint_error_dev(sc->sc_dev, "could not load rx buf DMA map");
  621                         goto fail;
  622                 }
  623 
  624                 desc->physaddr = htole32(data->map->dm_segs->ds_addr);
  625                 desc->flags = htole32(RT2661_RX_BUSY);
  626         }
  627 
  628         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  629             BUS_DMASYNC_PREWRITE);
  630 
  631         return 0;
  632 
  633 fail:   rt2661_free_rx_ring(sc, ring);
  634         return error;
  635 }
  636 
  637 static void
  638 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  639 {
  640         int i;
  641 
  642         for (i = 0; i < ring->count; i++)
  643                 ring->desc[i].flags = htole32(RT2661_RX_BUSY);
  644 
  645         bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
  646             BUS_DMASYNC_PREWRITE);
  647 
  648         ring->cur = ring->next = 0;
  649 }
  650 
  651 static void
  652 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  653 {
  654         struct rt2661_rx_data *data;
  655         int i;
  656 
  657         if (ring->desc != NULL) {
  658                 bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
  659                     ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  660                 bus_dmamap_unload(sc->sc_dmat, ring->map);
  661                 bus_dmamem_unmap(sc->sc_dmat, (void *)ring->desc,
  662                     ring->count * RT2661_RX_DESC_SIZE);
  663                 bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
  664         }
  665 
  666         if (ring->data != NULL) {
  667                 for (i = 0; i < ring->count; i++) {
  668                         data = &ring->data[i];
  669 
  670                         if (data->m != NULL) {
  671                                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  672                                     data->map->dm_mapsize,
  673                                     BUS_DMASYNC_POSTREAD);
  674                                 bus_dmamap_unload(sc->sc_dmat, data->map);
  675                                 m_freem(data->m);
  676                         }
  677 
  678                         if (data->map != NULL)
  679                                 bus_dmamap_destroy(sc->sc_dmat, data->map);
  680                 }
  681                 free(ring->data, M_DEVBUF);
  682         }
  683 }
  684 
  685 static struct ieee80211_node *
  686 rt2661_node_alloc(struct ieee80211_node_table *nt)
  687 {
  688         struct rt2661_node *rn;
  689 
  690         rn = malloc(sizeof (struct rt2661_node), M_80211_NODE,
  691             M_NOWAIT | M_ZERO);
  692 
  693         return (rn != NULL) ? &rn->ni : NULL;
  694 }
  695 
  696 static int
  697 rt2661_media_change(struct ifnet *ifp)
  698 {
  699         int error;
  700 
  701         error = ieee80211_media_change(ifp);
  702         if (error != ENETRESET)
  703                 return error;
  704 
  705         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
  706                 rt2661_init(ifp);
  707 
  708         return 0;
  709 }
  710 
  711 /*
  712  * This function is called periodically (every 200ms) during scanning to
  713  * switch from one channel to another.
  714  */
  715 static void
  716 rt2661_next_scan(void *arg)
  717 {
  718         struct rt2661_softc *sc = arg;
  719         struct ieee80211com *ic = &sc->sc_ic;
  720         int s;
  721 
  722         s = splnet();
  723         if (ic->ic_state == IEEE80211_S_SCAN)
  724                 ieee80211_next_scan(ic);
  725         splx(s);
  726 }
  727 
  728 /*
  729  * This function is called for each neighbor node.
  730  */
  731 static void
  732 rt2661_iter_func(void *arg, struct ieee80211_node *ni)
  733 {
  734         struct rt2661_softc *sc = arg;
  735         struct rt2661_node *rn = (struct rt2661_node *)ni;
  736 
  737         ieee80211_amrr_choose(&sc->amrr, ni, &rn->amn);
  738 }
  739 
  740 /*
  741  * This function is called periodically (every 500ms) in RUN state to update
  742  * various settings like rate control statistics or Rx sensitivity.
  743  */
  744 static void
  745 rt2661_updatestats(void *arg)
  746 {
  747         struct rt2661_softc *sc = arg;
  748         struct ieee80211com *ic = &sc->sc_ic;
  749         int s;
  750 
  751         s = splnet();
  752         if (ic->ic_opmode == IEEE80211_M_STA)
  753                 rt2661_iter_func(sc, ic->ic_bss);
  754         else
  755                 ieee80211_iterate_nodes(&ic->ic_sta, rt2661_iter_func, arg);
  756 
  757         /* update rx sensitivity every 1 sec */
  758         if (++sc->ncalls & 1)
  759                 rt2661_rx_tune(sc);
  760         splx(s);
  761 
  762         callout_reset(&sc->amrr_ch, hz / 2, rt2661_updatestats, sc);
  763 }
  764 
  765 static void
  766 rt2661_newassoc(struct ieee80211_node *ni, int isnew)
  767 {
  768         struct rt2661_softc *sc = ni->ni_ic->ic_ifp->if_softc;
  769         int i;
  770 
  771         ieee80211_amrr_node_init(&sc->amrr, &((struct rt2661_node *)ni)->amn);
  772 
  773         /* set rate to some reasonable initial value */
  774         for (i = ni->ni_rates.rs_nrates - 1;
  775              i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
  776              i--);
  777         ni->ni_txrate = i;
  778 }
  779 
  780 static int
  781 rt2661_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
  782 {
  783         struct rt2661_softc *sc = ic->ic_ifp->if_softc;
  784         enum ieee80211_state ostate;
  785         struct ieee80211_node *ni;
  786         uint32_t tmp;
  787 
  788         ostate = ic->ic_state;
  789         callout_stop(&sc->scan_ch);
  790 
  791         switch (nstate) {
  792         case IEEE80211_S_INIT:
  793                 callout_stop(&sc->amrr_ch);
  794 
  795                 if (ostate == IEEE80211_S_RUN) {
  796                         /* abort TSF synchronization */
  797                         tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
  798                         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
  799                 }
  800                 break;
  801 
  802         case IEEE80211_S_SCAN:
  803                 rt2661_set_chan(sc, ic->ic_curchan);
  804                 callout_reset(&sc->scan_ch, hz / 5, rt2661_next_scan, sc);
  805                 break;
  806 
  807         case IEEE80211_S_AUTH:
  808         case IEEE80211_S_ASSOC:
  809                 rt2661_set_chan(sc, ic->ic_curchan);
  810                 break;
  811 
  812         case IEEE80211_S_RUN:
  813                 rt2661_set_chan(sc, ic->ic_curchan);
  814 
  815                 ni = ic->ic_bss;
  816 
  817                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
  818                         rt2661_set_slottime(sc);
  819                         rt2661_enable_mrr(sc);
  820                         rt2661_set_txpreamble(sc);
  821                         rt2661_set_basicrates(sc, &ni->ni_rates);
  822                         rt2661_set_bssid(sc, ni->ni_bssid);
  823                 }
  824 
  825                 if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
  826                     ic->ic_opmode == IEEE80211_M_IBSS)
  827                         rt2661_prepare_beacon(sc);
  828 
  829                 if (ic->ic_opmode == IEEE80211_M_STA) {
  830                         /* fake a join to init the tx rate */
  831                         rt2661_newassoc(ni, 1);
  832                 }
  833 
  834                 if (ic->ic_opmode != IEEE80211_M_MONITOR) {
  835                         sc->ncalls = 0;
  836                         sc->avg_rssi = -95;     /* reset EMA */
  837                         callout_reset(&sc->amrr_ch, hz / 2,
  838                             rt2661_updatestats, sc);
  839                         rt2661_enable_tsf_sync(sc);
  840                 }
  841                 break;
  842         }
  843 
  844         return sc->sc_newstate(ic, nstate, arg);
  845 }
  846 
  847 /*
  848  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
  849  * 93C66).
  850  */
  851 static uint16_t
  852 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
  853 {
  854         uint32_t tmp;
  855         uint16_t val;
  856         int n;
  857 
  858         /* clock C once before the first command */
  859         RT2661_EEPROM_CTL(sc, 0);
  860 
  861         RT2661_EEPROM_CTL(sc, RT2661_S);
  862         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  863         RT2661_EEPROM_CTL(sc, RT2661_S);
  864 
  865         /* write start bit (1) */
  866         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  867         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  868 
  869         /* write READ opcode (10) */
  870         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  871         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  872         RT2661_EEPROM_CTL(sc, RT2661_S);
  873         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  874 
  875         /* write address (A5-A0 or A7-A0) */
  876         n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
  877         for (; n >= 0; n--) {
  878                 RT2661_EEPROM_CTL(sc, RT2661_S |
  879                     (((addr >> n) & 1) << RT2661_SHIFT_D));
  880                 RT2661_EEPROM_CTL(sc, RT2661_S |
  881                     (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
  882         }
  883 
  884         RT2661_EEPROM_CTL(sc, RT2661_S);
  885 
  886         /* read data Q15-Q0 */
  887         val = 0;
  888         for (n = 15; n >= 0; n--) {
  889                 RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  890                 tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
  891                 val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
  892                 RT2661_EEPROM_CTL(sc, RT2661_S);
  893         }
  894 
  895         RT2661_EEPROM_CTL(sc, 0);
  896 
  897         /* clear Chip Select and clock C */
  898         RT2661_EEPROM_CTL(sc, RT2661_S);
  899         RT2661_EEPROM_CTL(sc, 0);
  900         RT2661_EEPROM_CTL(sc, RT2661_C);
  901 
  902         return val;
  903 }
  904 
  905 static void
  906 rt2661_tx_intr(struct rt2661_softc *sc)
  907 {
  908         struct ifnet *ifp = &sc->sc_if;
  909         struct rt2661_tx_ring *txq;
  910         struct rt2661_tx_data *data;
  911         struct rt2661_node *rn;
  912         uint32_t val;
  913         int qid, retrycnt, s;
  914 
  915         s = splnet();
  916 
  917         for (;;) {
  918                 val = RAL_READ(sc, RT2661_STA_CSR4);
  919                 if (!(val & RT2661_TX_STAT_VALID))
  920                         break;
  921 
  922                 /* retrieve the queue in which this frame was sent */
  923                 qid = RT2661_TX_QID(val);
  924                 txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
  925 
  926                 /* retrieve rate control algorithm context */
  927                 data = &txq->data[txq->stat];
  928                 rn = (struct rt2661_node *)data->ni;
  929 
  930                 /* if no frame has been sent, ignore */
  931                 if (rn == NULL)
  932                         continue;
  933 
  934                 switch (RT2661_TX_RESULT(val)) {
  935                 case RT2661_TX_SUCCESS:
  936                         retrycnt = RT2661_TX_RETRYCNT(val);
  937 
  938                         DPRINTFN(10, ("data frame sent successfully after "
  939                             "%d retries\n", retrycnt));
  940                         rn->amn.amn_txcnt++;
  941                         if (retrycnt > 0)
  942                                 rn->amn.amn_retrycnt++;
  943                         if_statinc(ifp, if_opackets);
  944                         break;
  945 
  946                 case RT2661_TX_RETRY_FAIL:
  947                         DPRINTFN(9, ("sending data frame failed (too much "
  948                             "retries)\n"));
  949                         rn->amn.amn_txcnt++;
  950                         rn->amn.amn_retrycnt++;
  951                         if_statinc(ifp, if_oerrors);
  952                         break;
  953 
  954                 default:
  955                         /* other failure */
  956                         aprint_error_dev(sc->sc_dev, "sending data frame failed 0x%08x\n", val);
  957                         if_statinc(ifp, if_oerrors);
  958                 }
  959 
  960                 ieee80211_free_node(data->ni);
  961                 data->ni = NULL;
  962 
  963                 DPRINTFN(15, ("tx done q=%d idx=%u\n", qid, txq->stat));
  964 
  965                 txq->queued--;
  966                 if (++txq->stat >= txq->count)  /* faster than % count */
  967                         txq->stat = 0;
  968         }
  969 
  970         sc->sc_tx_timer = 0;
  971         ifp->if_flags &= ~IFF_OACTIVE;
  972         rt2661_start(ifp); /* in softint */
  973 
  974         splx(s);
  975 }
  976 
  977 static void
  978 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
  979 {
  980         struct rt2661_tx_desc *desc;
  981         struct rt2661_tx_data *data;
  982 
  983         for (;;) {
  984                 desc = &txq->desc[txq->next];
  985                 data = &txq->data[txq->next];
  986 
  987                 bus_dmamap_sync(sc->sc_dmat, txq->map,
  988                     txq->next * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
  989                     BUS_DMASYNC_POSTREAD);
  990 
  991                 if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
  992                     !(le32toh(desc->flags) & RT2661_TX_VALID))
  993                         break;
  994 
  995                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
  996                     data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
  997                 bus_dmamap_unload(sc->sc_dmat, data->map);
  998                 m_freem(data->m);
  999                 data->m = NULL;
 1000                 /* node reference is released in rt2661_tx_intr() */
 1001 
 1002                 /* descriptor is no longer valid */
 1003                 desc->flags &= ~htole32(RT2661_TX_VALID);
 1004 
 1005                 bus_dmamap_sync(sc->sc_dmat, txq->map,
 1006                     txq->next * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
 1007                     BUS_DMASYNC_PREWRITE);
 1008 
 1009                 DPRINTFN(15, ("tx dma done q=%p idx=%u\n", txq, txq->next));
 1010 
 1011                 if (++txq->next >= txq->count)  /* faster than % count */
 1012                         txq->next = 0;
 1013         }
 1014 }
 1015 
 1016 static void
 1017 rt2661_rx_intr(struct rt2661_softc *sc)
 1018 {
 1019         struct ieee80211com *ic = &sc->sc_ic;
 1020         struct ifnet *ifp = &sc->sc_if;
 1021         struct rt2661_rx_desc *desc;
 1022         struct rt2661_rx_data *data;
 1023         struct ieee80211_frame *wh;
 1024         struct ieee80211_node *ni;
 1025         struct mbuf *mnew, *m;
 1026         int error, rssi, s;
 1027 
 1028         for (;;) {
 1029                 desc = &sc->rxq.desc[sc->rxq.cur];
 1030                 data = &sc->rxq.data[sc->rxq.cur];
 1031 
 1032                 bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
 1033                     sc->rxq.cur * RT2661_RX_DESC_SIZE, RT2661_RX_DESC_SIZE,
 1034                     BUS_DMASYNC_POSTREAD);
 1035 
 1036                 if (le32toh(desc->flags) & RT2661_RX_BUSY)
 1037                         break;
 1038 
 1039                 if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
 1040                     (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
 1041                         /*
 1042                          * This should not happen since we did not request
 1043                          * to receive those frames when we filled TXRX_CSR0.
 1044                          */
 1045                         DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
 1046                             le32toh(desc->flags)));
 1047                         if_statinc(ifp, if_ierrors);
 1048                         goto skip;
 1049                 }
 1050 
 1051                 if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
 1052                         if_statinc(ifp, if_ierrors);
 1053                         goto skip;
 1054                 }
 1055 
 1056                 /*
 1057                  * Try to allocate a new mbuf for this ring element and load it
 1058                  * before processing the current mbuf. If the ring element
 1059                  * cannot be loaded, drop the received packet and reuse the old
 1060                  * mbuf. In the unlikely case that the old mbuf can't be
 1061                  * reloaded either, explicitly panic.
 1062                  */
 1063                 MGETHDR(mnew, M_DONTWAIT, MT_DATA);
 1064                 if (mnew == NULL) {
 1065                         if_statinc(ifp, if_ierrors);
 1066                         goto skip;
 1067                 }
 1068 
 1069                 MCLGET(mnew, M_DONTWAIT);
 1070                 if (!(mnew->m_flags & M_EXT)) {
 1071                         m_freem(mnew);
 1072                         if_statinc(ifp, if_ierrors);
 1073                         goto skip;
 1074                 }
 1075 
 1076                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1077                     data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
 1078                 bus_dmamap_unload(sc->sc_dmat, data->map);
 1079 
 1080                 error = bus_dmamap_load(sc->sc_dmat, data->map,
 1081                     mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
 1082                 if (error != 0) {
 1083                         m_freem(mnew);
 1084 
 1085                         /* try to reload the old mbuf */
 1086                         error = bus_dmamap_load(sc->sc_dmat, data->map,
 1087                             mtod(data->m, void *), MCLBYTES, NULL,
 1088                             BUS_DMA_NOWAIT);
 1089                         if (error != 0) {
 1090                                 /* very unlikely that it will fail... */
 1091                                 panic("%s: could not load old rx mbuf",
 1092                                     device_xname(sc->sc_dev));
 1093                         }
 1094                         /* physical address may have changed */
 1095                         desc->physaddr = htole32(data->map->dm_segs->ds_addr);
 1096                         if_statinc(ifp, if_ierrors);
 1097                         goto skip;
 1098                 }
 1099 
 1100                 /*
 1101                  * New mbuf successfully loaded, update Rx ring and continue
 1102                  * processing.
 1103                  */
 1104                 m = data->m;
 1105                 data->m = mnew;
 1106                 desc->physaddr = htole32(data->map->dm_segs->ds_addr);
 1107 
 1108                 /* finalize mbuf */
 1109                 m_set_rcvif(m, ifp);
 1110                 m->m_pkthdr.len = m->m_len =
 1111                     (le32toh(desc->flags) >> 16) & 0xfff;
 1112 
 1113                 s = splnet();
 1114 
 1115                 if (sc->sc_drvbpf != NULL) {
 1116                         struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
 1117                         uint32_t tsf_lo, tsf_hi;
 1118 
 1119                         /* get timestamp (low and high 32 bits) */
 1120                         tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
 1121                         tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
 1122 
 1123                         tap->wr_tsf =
 1124                             htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
 1125                         tap->wr_flags = 0;
 1126                         tap->wr_rate = rt2661_rxrate(desc);
 1127                         tap->wr_chan_freq = htole16(sc->sc_curchan->ic_freq);
 1128                         tap->wr_chan_flags = htole16(sc->sc_curchan->ic_flags);
 1129                         tap->wr_antsignal = desc->rssi;
 1130 
 1131                         bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_rxtap_len, m,
 1132                             BPF_D_IN);
 1133                 }
 1134 
 1135                 wh = mtod(m, struct ieee80211_frame *);
 1136                 ni = ieee80211_find_rxnode(ic, 
 1137                     (struct ieee80211_frame_min *)wh);
 1138 
 1139                 /* send the frame to the 802.11 layer */
 1140                 ieee80211_input(ic, m, ni, desc->rssi, 0);
 1141 
 1142                 /*-
 1143                  * Keep track of the average RSSI using an Exponential Moving
 1144                  * Average (EMA) of 8 Wilder's days:
 1145                  *     avg = (1 / N) x rssi + ((N - 1) / N) x avg
 1146                  */
 1147                 rssi = rt2661_get_rssi(sc, desc->rssi);
 1148                 sc->avg_rssi = (rssi + 7 * sc->avg_rssi) / 8;
 1149 
 1150                 /* node is no longer needed */
 1151                 ieee80211_free_node(ni);
 1152 
 1153                 splx(s);
 1154 
 1155 skip:           desc->flags |= htole32(RT2661_RX_BUSY);
 1156 
 1157                 bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
 1158                     sc->rxq.cur * RT2661_RX_DESC_SIZE, RT2661_RX_DESC_SIZE,
 1159                     BUS_DMASYNC_PREWRITE);
 1160 
 1161                 DPRINTFN(16, ("rx intr idx=%u\n", sc->rxq.cur));
 1162 
 1163                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
 1164         }
 1165 
 1166         /*
 1167          * In HostAP mode, ieee80211_input() will enqueue packets in if_snd
 1168          * without calling if_start().
 1169          */
 1170         s = splnet();
 1171         if (!IFQ_IS_EMPTY(&ifp->if_snd) && !(ifp->if_flags & IFF_OACTIVE))
 1172                 rt2661_start(ifp);
 1173         splx(s);
 1174 }
 1175 
 1176 /*
 1177  * This function is called in HostAP or IBSS modes when it's time to send a
 1178  * new beacon (every ni_intval milliseconds).
 1179  */
 1180 static void
 1181 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
 1182 {
 1183         struct ieee80211com *ic = &sc->sc_ic;
 1184 
 1185         if (sc->sc_flags & RT2661_UPDATE_SLOT) {
 1186                 sc->sc_flags &= ~RT2661_UPDATE_SLOT;
 1187                 sc->sc_flags |= RT2661_SET_SLOTTIME;
 1188         } else if (sc->sc_flags & RT2661_SET_SLOTTIME) {
 1189                 sc->sc_flags &= ~RT2661_SET_SLOTTIME;
 1190                 rt2661_set_slottime(sc);
 1191         }
 1192 
 1193         if (ic->ic_curmode == IEEE80211_MODE_11G) {
 1194                 /* update ERP Information Element */
 1195                 RAL_WRITE_1(sc, sc->erp_csr, ic->ic_bss->ni_erp);
 1196                 RAL_RW_BARRIER_1(sc, sc->erp_csr);
 1197         }
 1198 
 1199         DPRINTFN(15, ("beacon expired\n"));
 1200 }
 1201 
 1202 static void
 1203 rt2661_mcu_wakeup(struct rt2661_softc *sc)
 1204 {
 1205         RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
 1206 
 1207         RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
 1208         RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
 1209         RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
 1210 
 1211         /* send wakeup command to MCU */
 1212         rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
 1213 }
 1214 
 1215 static void
 1216 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
 1217 {
 1218         RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
 1219         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 1220 }
 1221 
 1222 int
 1223 rt2661_intr(void *arg)
 1224 {
 1225         struct rt2661_softc *sc = arg;
 1226         struct ifnet *ifp = &sc->sc_if;
 1227         uint32_t r1, r2;
 1228 
 1229         /* don't re-enable interrupts if we're shutting down */
 1230         if (!(ifp->if_flags & IFF_RUNNING)) {
 1231                 /* disable MAC and MCU interrupts */
 1232                 RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 1233                 RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 1234                 return 0;
 1235         }
 1236 
 1237         r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
 1238         r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
 1239 
 1240         if ((r1 & RT2661_INT_CSR_ALL) == 0 && (r2 & RT2661_MCU_INT_ALL) == 0)
 1241                 return 0;
 1242 
 1243         /* disable interrupts */
 1244         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 1245         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 1246 
 1247         softint_schedule(sc->sc_soft_ih);
 1248         return 1;
 1249 }
 1250 
 1251 static void
 1252 rt2661_softintr(void *arg)
 1253 {
 1254         struct rt2661_softc *sc = arg;
 1255         uint32_t r1, r2;
 1256 
 1257         for (;;) {
 1258                 r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
 1259                 r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
 1260 
 1261                 if ((r1 & RT2661_INT_CSR_ALL) == 0 &&
 1262                     (r2 & RT2661_MCU_INT_ALL) == 0)
 1263                         break;
 1264 
 1265                 RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
 1266                 RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
 1267 
 1268                 if (r1 & RT2661_MGT_DONE)
 1269                         rt2661_tx_dma_intr(sc, &sc->mgtq);
 1270 
 1271                 if (r1 & RT2661_RX_DONE)
 1272                         rt2661_rx_intr(sc);
 1273 
 1274                 if (r1 & RT2661_TX0_DMA_DONE)
 1275                         rt2661_tx_dma_intr(sc, &sc->txq[0]);
 1276 
 1277                 if (r1 & RT2661_TX1_DMA_DONE)
 1278                         rt2661_tx_dma_intr(sc, &sc->txq[1]);
 1279 
 1280                 if (r1 & RT2661_TX2_DMA_DONE)
 1281                         rt2661_tx_dma_intr(sc, &sc->txq[2]);
 1282 
 1283                 if (r1 & RT2661_TX3_DMA_DONE)
 1284                         rt2661_tx_dma_intr(sc, &sc->txq[3]);
 1285 
 1286                 if (r1 & RT2661_TX_DONE)
 1287                         rt2661_tx_intr(sc);
 1288 
 1289                 if (r2 & RT2661_MCU_CMD_DONE)
 1290                         rt2661_mcu_cmd_intr(sc);
 1291 
 1292                 if (r2 & RT2661_MCU_BEACON_EXPIRE)
 1293                         rt2661_mcu_beacon_expire(sc);
 1294 
 1295                 if (r2 & RT2661_MCU_WAKEUP)
 1296                         rt2661_mcu_wakeup(sc);
 1297         }
 1298 
 1299         /* enable interrupts */
 1300         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 1301         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 1302 }
 1303 
 1304 /* quickly determine if a given rate is CCK or OFDM */
 1305 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
 1306 
 1307 #define RAL_ACK_SIZE    14      /* 10 + 4(FCS) */
 1308 #define RAL_CTS_SIZE    14      /* 10 + 4(FCS) */
 1309 
 1310 /*
 1311  * This function is only used by the Rx radiotap code. It returns the rate at
 1312  * which a given frame was received.
 1313  */
 1314 static uint8_t
 1315 rt2661_rxrate(struct rt2661_rx_desc *desc)
 1316 {
 1317         if (le32toh(desc->flags) & RT2661_RX_OFDM) {
 1318                 /* reverse function of rt2661_plcp_signal */
 1319                 switch (desc->rate & 0xf) {
 1320                 case 0xb:       return 12;
 1321                 case 0xf:       return 18;
 1322                 case 0xa:       return 24;
 1323                 case 0xe:       return 36;
 1324                 case 0x9:       return 48;
 1325                 case 0xd:       return 72;
 1326                 case 0x8:       return 96;
 1327                 case 0xc:       return 108;
 1328                 }
 1329         } else {
 1330                 if (desc->rate == 10)
 1331                         return 2;
 1332                 if (desc->rate == 20)
 1333                         return 4;
 1334                 if (desc->rate == 55)
 1335                         return 11;
 1336                 if (desc->rate == 110)
 1337                         return 22;
 1338         }
 1339         return 2;       /* should not get there */
 1340 }
 1341 
 1342 /*
 1343  * Return the expected ack rate for a frame transmitted at rate `rate'.
 1344  * XXX: this should depend on the destination node basic rate set.
 1345  */
 1346 static int
 1347 rt2661_ack_rate(struct ieee80211com *ic, int rate)
 1348 {
 1349         switch (rate) {
 1350         /* CCK rates */
 1351         case 2:
 1352                 return 2;
 1353         case 4:
 1354         case 11:
 1355         case 22:
 1356                 return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
 1357 
 1358         /* OFDM rates */
 1359         case 12:
 1360         case 18:
 1361                 return 12;
 1362         case 24:
 1363         case 36:
 1364                 return 24;
 1365         case 48:
 1366         case 72:
 1367         case 96:
 1368         case 108:
 1369                 return 48;
 1370         }
 1371 
 1372         /* default to 1Mbps */
 1373         return 2;
 1374 }
 1375 
 1376 /*
 1377  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
 1378  * The function automatically determines the operating mode depending on the
 1379  * given rate. `flags' indicates whether short preamble is in use or not.
 1380  */
 1381 static uint16_t
 1382 rt2661_txtime(int len, int rate, uint32_t flags)
 1383 {
 1384         uint16_t txtime;
 1385 
 1386         if (RAL_RATE_IS_OFDM(rate)) {
 1387                 /* IEEE Std 802.11g-2003, pp. 44 */
 1388                 txtime = (8 + 4 * len + 3 + rate - 1) / rate;
 1389                 txtime = 16 + 4 + 4 * txtime + 6;
 1390         } else {
 1391                 /* IEEE Std 802.11b-1999, pp. 28 */
 1392                 txtime = (16 * len + rate - 1) / rate;
 1393                 if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
 1394                         txtime +=  72 + 24;
 1395                 else
 1396                         txtime += 144 + 48;
 1397         }
 1398         return txtime;
 1399 }
 1400 
 1401 static uint8_t
 1402 rt2661_plcp_signal(int rate)
 1403 {
 1404         switch (rate) {
 1405         /* CCK rates (returned values are device-dependent) */
 1406         case 2:         return 0x0;
 1407         case 4:         return 0x1;
 1408         case 11:        return 0x2;
 1409         case 22:        return 0x3;
 1410 
 1411         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 1412         case 12:        return 0xb;
 1413         case 18:        return 0xf;
 1414         case 24:        return 0xa;
 1415         case 36:        return 0xe;
 1416         case 48:        return 0x9;
 1417         case 72:        return 0xd;
 1418         case 96:        return 0x8;
 1419         case 108:       return 0xc;
 1420 
 1421         /* unsupported rates (should not get there) */
 1422         default:        return 0xff;
 1423         }
 1424 }
 1425 
 1426 static void
 1427 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
 1428     uint32_t flags, uint16_t xflags, int len, int rate,
 1429     const bus_dma_segment_t *segs, int nsegs, int ac)
 1430 {
 1431         struct ieee80211com *ic = &sc->sc_ic;
 1432         uint16_t plcp_length;
 1433         int i, remainder;
 1434 
 1435         desc->flags = htole32(flags);
 1436         desc->flags |= htole32(len << 16);
 1437 
 1438         desc->xflags = htole16(xflags);
 1439         desc->xflags |= htole16(nsegs << 13);
 1440 
 1441         desc->wme = htole16(
 1442             RT2661_QID(ac) |
 1443             RT2661_AIFSN(2) |
 1444             RT2661_LOGCWMIN(4) |
 1445             RT2661_LOGCWMAX(10));
 1446 
 1447         /*
 1448          * Remember in which queue this frame was sent. This field is driver
 1449          * private data only. It will be made available by the NIC in STA_CSR4
 1450          * on Tx interrupts.
 1451          */
 1452         desc->qid = ac;
 1453 
 1454         /* setup PLCP fields */
 1455         desc->plcp_signal  = rt2661_plcp_signal(rate);
 1456         desc->plcp_service = 4;
 1457 
 1458         len += IEEE80211_CRC_LEN;
 1459         if (RAL_RATE_IS_OFDM(rate)) {
 1460                 desc->flags |= htole32(RT2661_TX_OFDM);
 1461 
 1462                 plcp_length = len & 0xfff;
 1463                 desc->plcp_length_hi = plcp_length >> 6;
 1464                 desc->plcp_length_lo = plcp_length & 0x3f;
 1465         } else {
 1466                 plcp_length = (16 * len + rate - 1) / rate;
 1467                 if (rate == 22) {
 1468                         remainder = (16 * len) % 22;
 1469                         if (remainder != 0 && remainder < 7)
 1470                                 desc->plcp_service |= RT2661_PLCP_LENGEXT;
 1471                 }
 1472                 desc->plcp_length_hi = plcp_length >> 8;
 1473                 desc->plcp_length_lo = plcp_length & 0xff;
 1474 
 1475                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 1476                         desc->plcp_signal |= 0x08;
 1477         }
 1478 
 1479         /* RT2x61 supports scatter with up to 5 segments */
 1480         for (i = 0; i < nsegs; i++) {
 1481                 desc->addr[i] = htole32(segs[i].ds_addr);
 1482                 desc->len [i] = htole16(segs[i].ds_len);
 1483         }
 1484 
 1485         desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
 1486 }
 1487 
 1488 static int
 1489 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
 1490     struct ieee80211_node *ni)
 1491 {
 1492         struct ieee80211com *ic = &sc->sc_ic;
 1493         struct rt2661_tx_desc *desc;
 1494         struct rt2661_tx_data *data;
 1495         struct ieee80211_frame *wh;
 1496         uint16_t dur;
 1497         uint32_t flags = 0;
 1498         int rate, error;
 1499 
 1500         desc = &sc->mgtq.desc[sc->mgtq.cur];
 1501         data = &sc->mgtq.data[sc->mgtq.cur];
 1502 
 1503         /* send mgt frames at the lowest available rate */
 1504         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
 1505 
 1506         wh = mtod(m0, struct ieee80211_frame *);
 1507 
 1508         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1509                 if (ieee80211_crypto_encap(ic, ni, m0) == NULL) {
 1510                         m_freem(m0);
 1511                         return ENOBUFS;
 1512                 }
 1513 
 1514                 /* packet header may have moved, reset our local pointer */
 1515                 wh = mtod(m0, struct ieee80211_frame *);
 1516         }
 1517 
 1518         error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 1519             BUS_DMA_NOWAIT);
 1520         if (error != 0) {
 1521                 aprint_error_dev(sc->sc_dev, "could not map mbuf (error %d)\n",
 1522                     error);
 1523                 m_freem(m0);
 1524                 return error;
 1525         }
 1526 
 1527         if (sc->sc_drvbpf != NULL) {
 1528                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1529 
 1530                 tap->wt_flags = 0;
 1531                 tap->wt_rate = rate;
 1532                 tap->wt_chan_freq = htole16(sc->sc_curchan->ic_freq);
 1533                 tap->wt_chan_flags = htole16(sc->sc_curchan->ic_flags);
 1534 
 1535                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
 1536         }
 1537 
 1538         data->m = m0;
 1539         data->ni = ni;
 1540 
 1541         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1542                 flags |= RT2661_TX_NEED_ACK;
 1543 
 1544                 dur = rt2661_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
 1545                     sc->sifs;
 1546                 *(uint16_t *)wh->i_dur = htole16(dur);
 1547 
 1548                 /* tell hardware to set timestamp in probe responses */
 1549                 if ((wh->i_fc[0] &
 1550                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
 1551                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
 1552                         flags |= RT2661_TX_TIMESTAMP;
 1553         }
 1554 
 1555         rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
 1556             m0->m_pkthdr.len, rate, data->map->dm_segs, data->map->dm_nsegs,
 1557             RT2661_QID_MGT);
 1558 
 1559         bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
 1560             BUS_DMASYNC_PREWRITE);
 1561         bus_dmamap_sync(sc->sc_dmat, sc->mgtq.map,
 1562             sc->mgtq.cur * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
 1563             BUS_DMASYNC_PREWRITE);
 1564 
 1565         DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
 1566             m0->m_pkthdr.len, sc->mgtq.cur, rate));
 1567 
 1568         /* kick mgt */
 1569         sc->mgtq.queued++;
 1570         sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
 1571         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
 1572 
 1573         return 0;
 1574 }
 1575 
 1576 /*
 1577  * Build a RTS control frame.
 1578  */
 1579 static struct mbuf *
 1580 rt2661_get_rts(struct rt2661_softc *sc, struct ieee80211_frame *wh,
 1581     uint16_t dur)
 1582 {
 1583         struct ieee80211_frame_rts *rts;
 1584         struct mbuf *m;
 1585 
 1586         MGETHDR(m, M_DONTWAIT, MT_DATA);
 1587         if (m == NULL) {
 1588                 sc->sc_ic.ic_stats.is_tx_nobuf++;
 1589                 aprint_error_dev(sc->sc_dev, "could not allocate RTS frame\n");
 1590                 return NULL;
 1591         }
 1592 
 1593         rts = mtod(m, struct ieee80211_frame_rts *);
 1594 
 1595         rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
 1596             IEEE80211_FC0_SUBTYPE_RTS;
 1597         rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
 1598         *(uint16_t *)rts->i_dur = htole16(dur);
 1599         IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
 1600         IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
 1601 
 1602         m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
 1603 
 1604         return m;
 1605 }
 1606 
 1607 static int
 1608 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 1609     struct ieee80211_node *ni, int ac)
 1610 {
 1611         struct ieee80211com *ic = &sc->sc_ic;
 1612         struct rt2661_tx_ring *txq = &sc->txq[ac];
 1613         struct rt2661_tx_desc *desc;
 1614         struct rt2661_tx_data *data;
 1615         struct ieee80211_frame *wh;
 1616         struct ieee80211_key *k;
 1617         struct mbuf *mnew;
 1618         uint16_t dur;
 1619         uint32_t flags = 0;
 1620         int rate, useprot, error, tid;
 1621 
 1622         wh = mtod(m0, struct ieee80211_frame *);
 1623 
 1624         if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
 1625                 rate = ic->ic_sup_rates[ic->ic_curmode].
 1626                     rs_rates[ic->ic_fixed_rate];
 1627         } else
 1628                 rate = ni->ni_rates.rs_rates[ni->ni_txrate];
 1629         rate &= IEEE80211_RATE_VAL;
 1630         if (rate == 0)
 1631                 rate = 2;       /* XXX should not happen */
 1632 
 1633         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1634                 k = ieee80211_crypto_encap(ic, ni, m0);
 1635                 if (k == NULL) {
 1636                         m_freem(m0);
 1637                         return ENOBUFS;
 1638                 }
 1639 
 1640                 /* packet header may have moved, reset our local pointer */
 1641                 wh = mtod(m0, struct ieee80211_frame *);
 1642         }
 1643 
 1644         /*
 1645          * Packet Bursting: backoff after ppb=8 frames to give other STAs a
 1646          * chance to contend for the wireless medium.
 1647          */
 1648         tid = WME_AC_TO_TID(M_WME_GETAC(m0));
 1649         if (ic->ic_opmode == IEEE80211_M_STA && (ni->ni_txseqs[tid] & 7))
 1650                 flags |= RT2661_TX_IFS_SIFS;
 1651 
 1652         /*
 1653          * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
 1654          * for directed frames only when the length of the MPDU is greater
 1655          * than the length threshold indicated by" ic_rtsthreshold.
 1656          *
 1657          * IEEE Std 802.11-2003g, pp 13: "ERP STAs shall use protection
 1658          * mechanism (such as RTS/CTS or CTS-to-self) for ERP-OFDM MPDUs of
 1659          * type Data or an MMPDU".
 1660          */
 1661         useprot = !IEEE80211_IS_MULTICAST(wh->i_addr1) &&
 1662             (m0->m_pkthdr.len + IEEE80211_CRC_LEN > ic->ic_rtsthreshold ||
 1663             ((ic->ic_flags & IEEE80211_F_USEPROT) && RAL_RATE_IS_OFDM(rate)));
 1664         if (useprot) {
 1665                 struct mbuf *m;
 1666                 int rtsrate, ackrate;
 1667 
 1668                 rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
 1669                 ackrate = rt2661_ack_rate(ic, rate);
 1670 
 1671                 dur = rt2661_txtime(m0->m_pkthdr.len + 4, rate, ic->ic_flags) +
 1672                       rt2661_txtime(RAL_CTS_SIZE, rtsrate, ic->ic_flags) +
 1673                       rt2661_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
 1674                       3 * sc->sifs;
 1675 
 1676                 m = rt2661_get_rts(sc, wh, dur);
 1677                 if (m == NULL) {
 1678                         aprint_error_dev(sc->sc_dev, "could not allocate RTS "
 1679                             "frame\n");
 1680                         m_freem(m0);
 1681                         return ENOBUFS;
 1682                 }
 1683 
 1684                 desc = &txq->desc[txq->cur];
 1685                 data = &txq->data[txq->cur];
 1686 
 1687                 error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m,
 1688                     BUS_DMA_NOWAIT);
 1689                 if (error != 0) {
 1690                         aprint_error_dev(sc->sc_dev, "could not map mbuf (error %d)\n", error);
 1691                         m_freem(m);
 1692                         m_freem(m0);
 1693                         return error;
 1694                 }
 1695 
 1696                 /* avoid multiple free() of the same node for each fragment */
 1697                 ieee80211_ref_node(ni);
 1698 
 1699                 data->m = m;
 1700                 data->ni = ni;
 1701 
 1702                 rt2661_setup_tx_desc(sc, desc, RT2661_TX_NEED_ACK |
 1703                     RT2661_TX_MORE_FRAG, 0, m->m_pkthdr.len, rtsrate,
 1704                     data->map->dm_segs, data->map->dm_nsegs, ac);
 1705 
 1706                 bus_dmamap_sync(sc->sc_dmat, data->map, 0,
 1707                     data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
 1708                 bus_dmamap_sync(sc->sc_dmat, txq->map,
 1709                     txq->cur * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
 1710                     BUS_DMASYNC_PREWRITE);
 1711 
 1712                 txq->queued++;
 1713                 txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1714 
 1715                 flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS_SIFS;
 1716         }
 1717 
 1718         data = &txq->data[txq->cur];
 1719         desc = &txq->desc[txq->cur];
 1720 
 1721         error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 1722             BUS_DMA_NOWAIT);
 1723         if (error != 0 && error != EFBIG) {
 1724                 aprint_error_dev(sc->sc_dev, "could not map mbuf (error %d)\n",
 1725                     error);
 1726                 m_freem(m0);
 1727                 return error;
 1728         }
 1729         if (error != 0) {
 1730                 /* too many fragments, linearize */
 1731 
 1732                 MGETHDR(mnew, M_DONTWAIT, MT_DATA);
 1733                 if (mnew == NULL) {
 1734                         m_freem(m0);
 1735                         return ENOMEM;
 1736                 }
 1737 
 1738                 m_copy_pkthdr(mnew, m0);
 1739                 if (m0->m_pkthdr.len > MHLEN) {
 1740                         MCLGET(mnew, M_DONTWAIT);
 1741                         if (!(mnew->m_flags & M_EXT)) {
 1742                                 m_freem(m0);
 1743                                 m_freem(mnew);
 1744                                 return ENOMEM;
 1745                         }
 1746                 }
 1747 
 1748                 m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, void *));
 1749                 m_freem(m0);
 1750                 mnew->m_len = mnew->m_pkthdr.len;
 1751                 m0 = mnew;
 1752 
 1753                 error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
 1754                     BUS_DMA_NOWAIT);
 1755                 if (error != 0) {
 1756                         aprint_error_dev(sc->sc_dev, "could not map mbuf (error %d)\n", error);
 1757                         m_freem(m0);
 1758                         return error;
 1759                 }
 1760 
 1761                 /* packet header have moved, reset our local pointer */
 1762                 wh = mtod(m0, struct ieee80211_frame *);
 1763         }
 1764 
 1765         if (sc->sc_drvbpf != NULL) {
 1766                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1767 
 1768                 tap->wt_flags = 0;
 1769                 tap->wt_rate = rate;
 1770                 tap->wt_chan_freq = htole16(sc->sc_curchan->ic_freq);
 1771                 tap->wt_chan_flags = htole16(sc->sc_curchan->ic_flags);
 1772 
 1773                 bpf_mtap2(sc->sc_drvbpf, tap, sc->sc_txtap_len, m0, BPF_D_OUT);
 1774         }
 1775 
 1776         data->m = m0;
 1777         data->ni = ni;
 1778 
 1779         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1780                 flags |= RT2661_TX_NEED_ACK;
 1781 
 1782                 dur = rt2661_txtime(RAL_ACK_SIZE, rt2661_ack_rate(ic, rate),
 1783                     ic->ic_flags) + sc->sifs;
 1784                 *(uint16_t *)wh->i_dur = htole16(dur);
 1785         }
 1786 
 1787         rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate,
 1788             data->map->dm_segs, data->map->dm_nsegs, ac);
 1789 
 1790         bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
 1791             BUS_DMASYNC_PREWRITE);
 1792         bus_dmamap_sync(sc->sc_dmat, txq->map, txq->cur * RT2661_TX_DESC_SIZE,
 1793             RT2661_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
 1794 
 1795         DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
 1796             m0->m_pkthdr.len, txq->cur, rate));
 1797 
 1798         /* kick Tx */
 1799         txq->queued++;
 1800         txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1801         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1);
 1802 
 1803         return 0;
 1804 }
 1805 
 1806 static void
 1807 rt2661_start(struct ifnet *ifp)
 1808 {
 1809         struct rt2661_softc *sc = ifp->if_softc;
 1810         struct ieee80211com *ic = &sc->sc_ic;
 1811         struct mbuf *m0;
 1812         struct ether_header *eh;
 1813         struct ieee80211_node *ni = NULL;
 1814 
 1815         /*
 1816          * net80211 may still try to send management frames even if the
 1817          * IFF_RUNNING flag is not set...
 1818          */
 1819         if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
 1820                 return;
 1821 
 1822         for (;;) {
 1823                 IF_POLL(&ic->ic_mgtq, m0);
 1824                 if (m0 != NULL) {
 1825                         if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
 1826                                 ifp->if_flags |= IFF_OACTIVE;
 1827                                 break;
 1828                         }
 1829                         IF_DEQUEUE(&ic->ic_mgtq, m0);
 1830                         if (m0 == NULL)
 1831                                 break;
 1832 
 1833                         ni = M_GETCTX(m0, struct ieee80211_node *);
 1834                         M_CLEARCTX(m0);
 1835                         bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
 1836                         if (rt2661_tx_mgt(sc, m0, ni) != 0)
 1837                                 break;
 1838 
 1839                 } else {
 1840                         IF_POLL(&ifp->if_snd, m0);
 1841                         if (m0 == NULL || ic->ic_state != IEEE80211_S_RUN)
 1842                                 break;
 1843 
 1844                         if (sc->txq[0].queued >= RT2661_TX_RING_COUNT - 1) {
 1845                                 /* there is no place left in this ring */
 1846                                 ifp->if_flags |= IFF_OACTIVE;
 1847                                 break;
 1848                         }
 1849 
 1850                         IFQ_DEQUEUE(&ifp->if_snd, m0);
 1851 
 1852                         if (m0->m_len < sizeof (struct ether_header) &&
 1853                             !(m0 = m_pullup(m0, sizeof (struct ether_header))))
 1854                                 continue;
 1855 
 1856                         eh = mtod(m0, struct ether_header *);
 1857                         ni = ieee80211_find_txnode(ic, eh->ether_dhost);
 1858                         if (ni == NULL) {
 1859                                 m_freem(m0);
 1860                                 if_statinc(ifp, if_oerrors);
 1861                                 continue;
 1862                         }
 1863 
 1864                         bpf_mtap(ifp, m0, BPF_D_OUT);
 1865                         m0 = ieee80211_encap(ic, m0, ni);
 1866                         if (m0 == NULL) {
 1867                                 ieee80211_free_node(ni);
 1868                                 if_statinc(ifp, if_oerrors);
 1869                                 continue;
 1870                         }
 1871                         bpf_mtap3(ic->ic_rawbpf, m0, BPF_D_OUT);
 1872                         if (rt2661_tx_data(sc, m0, ni, 0) != 0) {
 1873                                 if (ni != NULL)
 1874                                         ieee80211_free_node(ni);
 1875                                 if_statinc(ifp, if_oerrors);
 1876                                 break;
 1877                         }
 1878                 }
 1879 
 1880                 sc->sc_tx_timer = 5;
 1881                 ifp->if_timer = 1;
 1882         }
 1883 }
 1884 
 1885 static void
 1886 rt2661_watchdog(struct ifnet *ifp)
 1887 {
 1888         struct rt2661_softc *sc = ifp->if_softc;
 1889 
 1890         ifp->if_timer = 0;
 1891 
 1892         if (sc->sc_tx_timer > 0) {
 1893                 if (--sc->sc_tx_timer == 0) {
 1894                         aprint_error_dev(sc->sc_dev, "device timeout\n");
 1895                         rt2661_init(ifp);
 1896                         if_statinc(ifp, if_oerrors);
 1897                         return;
 1898                 }
 1899                 ifp->if_timer = 1;
 1900         }
 1901 
 1902         ieee80211_watchdog(&sc->sc_ic);
 1903 }
 1904 
 1905 /*
 1906  * This function allows for fast channel switching in monitor mode (used by
 1907  * kismet). In IBSS mode, we must explicitly reset the interface to
 1908  * generate a new beacon frame.
 1909  */
 1910 static int
 1911 rt2661_reset(struct ifnet *ifp)
 1912 {
 1913         struct rt2661_softc *sc = ifp->if_softc;
 1914         struct ieee80211com *ic = &sc->sc_ic;
 1915 
 1916         if (ic->ic_opmode != IEEE80211_M_MONITOR)
 1917                 return ENETRESET;
 1918 
 1919         rt2661_set_chan(sc, ic->ic_curchan);
 1920 
 1921         return 0;
 1922 }
 1923 
 1924 static int
 1925 rt2661_ioctl(struct ifnet *ifp, u_long cmd, void *data)
 1926 {
 1927         struct rt2661_softc *sc = ifp->if_softc;
 1928         struct ieee80211com *ic = &sc->sc_ic;
 1929         int s, error = 0;
 1930 
 1931         s = splnet();
 1932 
 1933         switch (cmd) {
 1934         case SIOCSIFFLAGS:
 1935                 if ((error = ifioctl_common(ifp, cmd, data)) != 0)
 1936                         break;
 1937                 if (ifp->if_flags & IFF_UP) {
 1938                         if (ifp->if_flags & IFF_RUNNING)
 1939                                 rt2661_update_promisc(sc);
 1940                         else
 1941                                 rt2661_init(ifp);
 1942                 } else {
 1943                         if (ifp->if_flags & IFF_RUNNING)
 1944                                 rt2661_stop(ifp, 1);
 1945                 }
 1946                 break;
 1947 
 1948         case SIOCADDMULTI:
 1949         case SIOCDELMULTI:
 1950                 /* XXX no h/w multicast filter? --dyoung */
 1951                 if ((error = ether_ioctl(ifp, cmd, data)) == ENETRESET)
 1952                         error = 0;
 1953                 break;
 1954 
 1955         case SIOCS80211CHANNEL:
 1956                 /*
 1957                  * This allows for fast channel switching in monitor mode
 1958                  * (used by kismet). In IBSS mode, we must explicitly reset
 1959                  * the interface to generate a new beacon frame.
 1960                  */
 1961                 error = ieee80211_ioctl(ic, cmd, data);
 1962                 if (error == ENETRESET &&
 1963                     ic->ic_opmode == IEEE80211_M_MONITOR) {
 1964                         if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
 1965                              (IFF_UP | IFF_RUNNING))
 1966                                 rt2661_set_chan(sc, ic->ic_ibss_chan);
 1967                         error = 0;
 1968                 }
 1969                 break;
 1970 
 1971         default:
 1972                 error = ieee80211_ioctl(ic, cmd, data);
 1973 
 1974         }
 1975 
 1976         if (error == ENETRESET) {
 1977                 if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
 1978                     (IFF_UP | IFF_RUNNING))
 1979                         rt2661_init(ifp);
 1980                 error = 0;
 1981         }
 1982 
 1983         splx(s);
 1984 
 1985         return error;
 1986 }
 1987 
 1988 static void
 1989 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
 1990 {
 1991         uint32_t tmp;
 1992         int ntries;
 1993 
 1994         for (ntries = 0; ntries < 100; ntries++) {
 1995                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 1996                         break;
 1997                 DELAY(1);
 1998         }
 1999         if (ntries == 100) {
 2000                 aprint_error_dev(sc->sc_dev, "could not write to BBP\n");
 2001                 return;
 2002         }
 2003 
 2004         tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
 2005         RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
 2006 
 2007         DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
 2008 }
 2009 
 2010 static uint8_t
 2011 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
 2012 {
 2013         uint32_t val;
 2014         int ntries;
 2015 
 2016         for (ntries = 0; ntries < 100; ntries++) {
 2017                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 2018                         break;
 2019                 DELAY(1);
 2020         }
 2021         if (ntries == 100) {
 2022                 aprint_error_dev(sc->sc_dev, "could not read from BBP\n");
 2023                 return 0;
 2024         }
 2025 
 2026         val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
 2027         RAL_WRITE(sc, RT2661_PHY_CSR3, val);
 2028 
 2029         for (ntries = 0; ntries < 100; ntries++) {
 2030                 val = RAL_READ(sc, RT2661_PHY_CSR3);
 2031                 if (!(val & RT2661_BBP_BUSY))
 2032                         return val & 0xff;
 2033                 DELAY(1);
 2034         }
 2035 
 2036         aprint_error_dev(sc->sc_dev, "could not read from BBP\n");
 2037         return 0;
 2038 }
 2039 
 2040 static void
 2041 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
 2042 {
 2043         uint32_t tmp;
 2044         int ntries;
 2045 
 2046         for (ntries = 0; ntries < 100; ntries++) {
 2047                 if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
 2048                         break;
 2049                 DELAY(1);
 2050         }
 2051         if (ntries == 100) {
 2052                 aprint_error_dev(sc->sc_dev, "could not write to RF\n");
 2053                 return;
 2054         }
 2055         tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
 2056             (reg & 3);
 2057         RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
 2058 
 2059         /* remember last written value in sc */
 2060         sc->rf_regs[reg] = val;
 2061 
 2062         DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff));
 2063 }
 2064 
 2065 static int
 2066 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
 2067 {
 2068         if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
 2069                 return EIO;     /* there is already a command pending */
 2070 
 2071         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
 2072             RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
 2073 
 2074         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
 2075 
 2076         return 0;
 2077 }
 2078 
 2079 static void
 2080 rt2661_select_antenna(struct rt2661_softc *sc)
 2081 {
 2082         uint8_t bbp4, bbp77;
 2083         uint32_t tmp;
 2084 
 2085         bbp4  = rt2661_bbp_read(sc,  4);
 2086         bbp77 = rt2661_bbp_read(sc, 77);
 2087 
 2088         /* TBD */
 2089 
 2090         /* make sure Rx is disabled before switching antenna */
 2091         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2092         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2093 
 2094         rt2661_bbp_write(sc,  4, bbp4);
 2095         rt2661_bbp_write(sc, 77, bbp77);
 2096 
 2097         /* restore Rx filter */
 2098         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2099 }
 2100 
 2101 /*
 2102  * Enable multi-rate retries for frames sent at OFDM rates.
 2103  * In 802.11b/g mode, allow fallback to CCK rates.
 2104  */
 2105 static void
 2106 rt2661_enable_mrr(struct rt2661_softc *sc)
 2107 {
 2108         struct ieee80211com *ic = &sc->sc_ic;
 2109         uint32_t tmp;
 2110 
 2111         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 2112 
 2113         tmp &= ~RT2661_MRR_CCK_FALLBACK;
 2114         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan))
 2115                 tmp |= RT2661_MRR_CCK_FALLBACK;
 2116         tmp |= RT2661_MRR_ENABLED;
 2117 
 2118         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 2119 }
 2120 
 2121 static void
 2122 rt2661_set_txpreamble(struct rt2661_softc *sc)
 2123 {
 2124         uint32_t tmp;
 2125 
 2126         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 2127 
 2128         tmp &= ~RT2661_SHORT_PREAMBLE;
 2129         if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
 2130                 tmp |= RT2661_SHORT_PREAMBLE;
 2131 
 2132         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 2133 }
 2134 
 2135 static void
 2136 rt2661_set_basicrates(struct rt2661_softc *sc,
 2137     const struct ieee80211_rateset *rs)
 2138 {
 2139 #define RV(r)   ((r) & IEEE80211_RATE_VAL)
 2140         uint32_t mask = 0;
 2141         uint8_t rate;
 2142         int i, j;
 2143 
 2144         for (i = 0; i < rs->rs_nrates; i++) {
 2145                 rate = rs->rs_rates[i];
 2146 
 2147                 if (!(rate & IEEE80211_RATE_BASIC))
 2148                         continue;
 2149 
 2150                 /*
 2151                  * Find h/w rate index.  We know it exists because the rate
 2152                  * set has already been negotiated.
 2153                  */
 2154                 for (j = 0; ieee80211_std_rateset_11g.rs_rates[j] != RV(rate); j++);
 2155 
 2156                 mask |= 1 << j;
 2157         }
 2158 
 2159         RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
 2160 
 2161         DPRINTF(("Setting basic rate mask to 0x%x\n", mask));
 2162 #undef RV
 2163 }
 2164 
 2165 /*
 2166  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
 2167  * driver.
 2168  */
 2169 static void
 2170 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
 2171 {
 2172         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
 2173         uint32_t tmp;
 2174 
 2175         /* update all BBP registers that depend on the band */
 2176         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
 2177         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
 2178         if (IEEE80211_IS_CHAN_5GHZ(c)) {
 2179                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
 2180                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
 2181         }
 2182         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 2183             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 2184                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
 2185         }
 2186 
 2187         sc->bbp17 = bbp17;
 2188         rt2661_bbp_write(sc,  17, bbp17);
 2189         rt2661_bbp_write(sc,  96, bbp96);
 2190         rt2661_bbp_write(sc, 104, bbp104);
 2191 
 2192         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 2193             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 2194                 rt2661_bbp_write(sc, 75, 0x80);
 2195                 rt2661_bbp_write(sc, 86, 0x80);
 2196                 rt2661_bbp_write(sc, 88, 0x80);
 2197         }
 2198 
 2199         rt2661_bbp_write(sc, 35, bbp35);
 2200         rt2661_bbp_write(sc, 97, bbp97);
 2201         rt2661_bbp_write(sc, 98, bbp98);
 2202 
 2203         tmp = RAL_READ(sc, RT2661_PHY_CSR0);
 2204         tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
 2205         if (IEEE80211_IS_CHAN_2GHZ(c))
 2206                 tmp |= RT2661_PA_PE_2GHZ;
 2207         else
 2208                 tmp |= RT2661_PA_PE_5GHZ;
 2209         RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
 2210 
 2211         /* 802.11a uses a 16 microseconds short interframe space */
 2212         sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
 2213 }
 2214 
 2215 static void
 2216 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
 2217 {
 2218         struct ieee80211com *ic = &sc->sc_ic;
 2219         const struct rfprog *rfprog;
 2220         uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
 2221         int8_t power;
 2222         u_int i, chan;
 2223 
 2224         chan = ieee80211_chan2ieee(ic, c);
 2225         if (chan == 0 || chan == IEEE80211_CHAN_ANY)
 2226                 return;
 2227 
 2228         /* select the appropriate RF settings based on what EEPROM says */
 2229         rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
 2230 
 2231         /* find the settings for this channel (we know it exists) */
 2232         for (i = 0; rfprog[i].chan != chan; i++);
 2233 
 2234         power = sc->txpow[i];
 2235         if (power < 0) {
 2236                 bbp94 += power;
 2237                 power = 0;
 2238         } else if (power > 31) {
 2239                 bbp94 += power - 31;
 2240                 power = 31;
 2241         }
 2242 
 2243         /*
 2244          * If we've yet to select a channel, or we are switching from the
 2245          * 2GHz band to the 5GHz band or vice-versa, BBP registers need to
 2246          * be reprogrammed.
 2247          */
 2248         if (sc->sc_curchan == NULL || c->ic_flags != sc->sc_curchan->ic_flags) {
 2249                 rt2661_select_band(sc, c);
 2250                 rt2661_select_antenna(sc);
 2251         }
 2252         sc->sc_curchan = c;
 2253 
 2254         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2255         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2256         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 2257         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2258 
 2259         DELAY(200);
 2260 
 2261         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2262         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2263         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
 2264         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2265 
 2266         DELAY(200);
 2267 
 2268         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2269         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2270         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 2271         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2272 
 2273         /* enable smart mode for MIMO-capable RFs */
 2274         bbp3 = rt2661_bbp_read(sc, 3);
 2275 
 2276         bbp3 &= ~RT2661_SMART_MODE;
 2277         if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
 2278                 bbp3 |= RT2661_SMART_MODE;
 2279 
 2280         rt2661_bbp_write(sc, 3, bbp3);
 2281 
 2282         if (bbp94 != RT2661_BBPR94_DEFAULT)
 2283                 rt2661_bbp_write(sc, 94, bbp94);
 2284 
 2285         /* 5GHz radio needs a 1ms delay here */
 2286         if (IEEE80211_IS_CHAN_5GHZ(c))
 2287                 DELAY(1000);
 2288 }
 2289 
 2290 static void
 2291 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
 2292 {
 2293         uint32_t tmp;
 2294 
 2295         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
 2296         RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
 2297 
 2298         tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
 2299         RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
 2300 }
 2301 
 2302 static void
 2303 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
 2304 {
 2305         uint32_t tmp;
 2306 
 2307         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
 2308         RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
 2309 
 2310         tmp = addr[4] | addr[5] << 8 | 0xff << 16;
 2311         RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
 2312 }
 2313 
 2314 static void
 2315 rt2661_update_promisc(struct rt2661_softc *sc)
 2316 {
 2317         struct ifnet *ifp = sc->sc_ic.ic_ifp;
 2318         uint32_t tmp;
 2319 
 2320         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2321 
 2322         tmp &= ~RT2661_DROP_NOT_TO_ME;
 2323         if (!(ifp->if_flags & IFF_PROMISC))
 2324                 tmp |= RT2661_DROP_NOT_TO_ME;
 2325 
 2326         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2327 
 2328         DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
 2329             "entering" : "leaving"));
 2330 }
 2331 
 2332 #if 0
 2333 /*
 2334  * Update QoS (802.11e) settings for each h/w Tx ring.
 2335  */
 2336 static int
 2337 rt2661_wme_update(struct ieee80211com *ic)
 2338 {
 2339         struct rt2661_softc *sc = ic->ic_ifp->if_softc;
 2340         const struct wmeParams *wmep;
 2341 
 2342         wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
 2343 
 2344         /* XXX: not sure about shifts. */
 2345         /* XXX: the reference driver plays with AC_VI settings too. */
 2346 
 2347         /* update TxOp */
 2348         RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
 2349             wmep[WME_AC_BE].wmep_txopLimit << 16 |
 2350             wmep[WME_AC_BK].wmep_txopLimit);
 2351         RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
 2352             wmep[WME_AC_VI].wmep_txopLimit << 16 |
 2353             wmep[WME_AC_VO].wmep_txopLimit);
 2354 
 2355         /* update CWmin */
 2356         RAL_WRITE(sc, RT2661_CWMIN_CSR,
 2357             wmep[WME_AC_BE].wmep_logcwmin << 12 |
 2358             wmep[WME_AC_BK].wmep_logcwmin <<  8 |
 2359             wmep[WME_AC_VI].wmep_logcwmin <<  4 |
 2360             wmep[WME_AC_VO].wmep_logcwmin);
 2361 
 2362         /* update CWmax */
 2363         RAL_WRITE(sc, RT2661_CWMAX_CSR,
 2364             wmep[WME_AC_BE].wmep_logcwmax << 12 |
 2365             wmep[WME_AC_BK].wmep_logcwmax <<  8 |
 2366             wmep[WME_AC_VI].wmep_logcwmax <<  4 |
 2367             wmep[WME_AC_VO].wmep_logcwmax);
 2368 
 2369         /* update Aifsn */
 2370         RAL_WRITE(sc, RT2661_AIFSN_CSR,
 2371             wmep[WME_AC_BE].wmep_aifsn << 12 |
 2372             wmep[WME_AC_BK].wmep_aifsn <<  8 |
 2373             wmep[WME_AC_VI].wmep_aifsn <<  4 |
 2374             wmep[WME_AC_VO].wmep_aifsn);
 2375 
 2376         return 0;
 2377 }
 2378 #endif
 2379 
 2380 static void
 2381 rt2661_updateslot(struct ifnet *ifp)
 2382 {
 2383         struct rt2661_softc *sc = ifp->if_softc;
 2384         struct ieee80211com *ic = &sc->sc_ic;
 2385 
 2386         if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
 2387                 /*
 2388                  * In HostAP mode, we defer setting of new slot time until
 2389                  * updated ERP Information Element has propagated to all
 2390                  * associated STAs.
 2391                  */
 2392                 sc->sc_flags |= RT2661_UPDATE_SLOT;
 2393         } else
 2394                 rt2661_set_slottime(sc);
 2395 }
 2396 
 2397 static void
 2398 rt2661_set_slottime(struct rt2661_softc *sc)
 2399 {
 2400         struct ieee80211com *ic = &sc->sc_ic;
 2401         uint8_t slottime;
 2402         uint32_t tmp;
 2403 
 2404         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
 2405 
 2406         tmp = RAL_READ(sc, RT2661_MAC_CSR9);
 2407         tmp = (tmp & ~0xff) | slottime;
 2408         RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
 2409 
 2410         DPRINTF(("setting slot time to %uus\n", slottime));
 2411 }
 2412 
 2413 static const char *
 2414 rt2661_get_rf(int rev)
 2415 {
 2416         switch (rev) {
 2417         case RT2661_RF_5225:    return "RT5225";
 2418         case RT2661_RF_5325:    return "RT5325 (MIMO XR)";
 2419         case RT2661_RF_2527:    return "RT2527";
 2420         case RT2661_RF_2529:    return "RT2529 (MIMO XR)";
 2421         default:                return "unknown";
 2422         }
 2423 }
 2424 
 2425 static void
 2426 rt2661_read_eeprom(struct rt2661_softc *sc)
 2427 {
 2428         struct ieee80211com *ic = &sc->sc_ic;
 2429         uint16_t val;
 2430         int i;
 2431 
 2432         /* read MAC address */
 2433         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
 2434         ic->ic_myaddr[0] = val & 0xff;
 2435         ic->ic_myaddr[1] = val >> 8;
 2436 
 2437         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
 2438         ic->ic_myaddr[2] = val & 0xff;
 2439         ic->ic_myaddr[3] = val >> 8;
 2440 
 2441         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
 2442         ic->ic_myaddr[4] = val & 0xff;
 2443         ic->ic_myaddr[5] = val >> 8;
 2444 
 2445         val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
 2446         /* XXX: test if different from 0xffff? */
 2447         sc->rf_rev   = (val >> 11) & 0x1f;
 2448         sc->hw_radio = (val >> 10) & 0x1;
 2449         sc->rx_ant   = (val >> 4)  & 0x3;
 2450         sc->tx_ant   = (val >> 2)  & 0x3;
 2451         sc->nb_ant   = val & 0x3;
 2452 
 2453         DPRINTF(("RF revision=%d\n", sc->rf_rev));
 2454 
 2455         val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
 2456         sc->ext_5ghz_lna = (val >> 6) & 0x1;
 2457         sc->ext_2ghz_lna = (val >> 4) & 0x1;
 2458 
 2459         DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
 2460             sc->ext_2ghz_lna, sc->ext_5ghz_lna));
 2461 
 2462         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
 2463         if ((val & 0xff) != 0xff)
 2464                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2465 
 2466         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
 2467         if ((val & 0xff) != 0xff)
 2468                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2469 
 2470         /* adjust RSSI correction for external low-noise amplifier */
 2471         if (sc->ext_2ghz_lna)
 2472                 sc->rssi_2ghz_corr -= 14;
 2473         if (sc->ext_5ghz_lna)
 2474                 sc->rssi_5ghz_corr -= 14;
 2475 
 2476         DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
 2477             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
 2478 
 2479         val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
 2480         if ((val >> 8) != 0xff)
 2481                 sc->rfprog = (val >> 8) & 0x3;
 2482         if ((val & 0xff) != 0xff)
 2483                 sc->rffreq = val & 0xff;
 2484 
 2485         DPRINTF(("RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq));
 2486 
 2487         /* read Tx power for all a/b/g channels */
 2488         for (i = 0; i < 19; i++) {
 2489                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
 2490                 sc->txpow[i * 2] = (int8_t)(val >> 8);          /* signed */
 2491                 DPRINTF(("Channel=%d Tx power=%d\n",
 2492                     rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]));
 2493                 sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);    /* signed */
 2494                 DPRINTF(("Channel=%d Tx power=%d\n",
 2495                     rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]));
 2496         }
 2497 
 2498         /* read vendor-specific BBP values */
 2499         for (i = 0; i < 16; i++) {
 2500                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
 2501                 if (val == 0 || val == 0xffff)
 2502                         continue;       /* skip invalid entries */
 2503                 sc->bbp_prom[i].reg = val >> 8;
 2504                 sc->bbp_prom[i].val = val & 0xff;
 2505                 DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
 2506                     sc->bbp_prom[i].val));
 2507         }
 2508 }
 2509 
 2510 static int
 2511 rt2661_bbp_init(struct rt2661_softc *sc)
 2512 {
 2513 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
 2514         int i, ntries;
 2515         uint8_t val;
 2516 
 2517         /* wait for BBP to be ready */
 2518         for (ntries = 0; ntries < 100; ntries++) {
 2519                 val = rt2661_bbp_read(sc, 0);
 2520                 if (val != 0 && val != 0xff)
 2521                         break;
 2522                 DELAY(100);
 2523         }
 2524         if (ntries == 100) {
 2525                 aprint_error_dev(sc->sc_dev, "timeout waiting for BBP\n");
 2526                 return EIO;
 2527         }
 2528 
 2529         /* initialize BBP registers to default values */
 2530         for (i = 0; i < N(rt2661_def_bbp); i++) {
 2531                 rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
 2532                     rt2661_def_bbp[i].val);
 2533         }
 2534 
 2535         /* write vendor-specific BBP values (from EEPROM) */
 2536         for (i = 0; i < 16; i++) {
 2537                 if (sc->bbp_prom[i].reg == 0)
 2538                         continue;
 2539                 rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
 2540         }
 2541 
 2542         return 0;
 2543 #undef N
 2544 }
 2545 
 2546 static int
 2547 rt2661_init(struct ifnet *ifp)
 2548 {
 2549 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
 2550         struct rt2661_softc *sc = ifp->if_softc;
 2551         struct ieee80211com *ic = &sc->sc_ic;
 2552         const char *name = NULL;        /* make lint happy */
 2553         uint8_t *ucode;
 2554         size_t size;
 2555         uint32_t tmp, star[3];
 2556         int i, ntries;
 2557         firmware_handle_t fh;
 2558 
 2559         /* for CardBus, power on the socket */
 2560         if (!(sc->sc_flags & RT2661_ENABLED)) {
 2561                 if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
 2562                         aprint_error_dev(sc->sc_dev, "could not enable device\n");
 2563                         return EIO;
 2564                 }
 2565                 sc->sc_flags |= RT2661_ENABLED;
 2566         }
 2567 
 2568         rt2661_stop(ifp, 0);
 2569 
 2570         if (!(sc->sc_flags & RT2661_FWLOADED)) {
 2571                 switch (sc->sc_id) {
 2572                 case PCI_PRODUCT_RALINK_RT2561:
 2573                         name = "ral-rt2561";
 2574                         break;
 2575                 case PCI_PRODUCT_RALINK_RT2561S:
 2576                         name = "ral-rt2561s";
 2577                         break;
 2578                 case PCI_PRODUCT_RALINK_RT2661:
 2579                         name = "ral-rt2661";
 2580                         break;
 2581                 }
 2582 
 2583                 if (firmware_open("ral", name, &fh) != 0) {
 2584                         aprint_error_dev(sc->sc_dev, "could not open microcode %s\n", name);
 2585                         rt2661_stop(ifp, 1);
 2586                         return EIO;
 2587                 }
 2588 
 2589                 size = firmware_get_size(fh);
 2590                 if (!(ucode = firmware_malloc(size))) {
 2591                         aprint_error_dev(sc->sc_dev, "could not alloc microcode memory\n");
 2592                         firmware_close(fh);
 2593                         rt2661_stop(ifp, 1);
 2594                         return ENOMEM;
 2595                 }
 2596 
 2597                 if (firmware_read(fh, 0, ucode, size) != 0) {
 2598                         aprint_error_dev(sc->sc_dev, "could not read microcode %s\n", name);
 2599                         firmware_free(ucode, size);
 2600                         firmware_close(fh);
 2601                         rt2661_stop(ifp, 1);
 2602                         return EIO;
 2603                 }
 2604 
 2605                 if (rt2661_load_microcode(sc, ucode, size) != 0) {
 2606                         aprint_error_dev(sc->sc_dev, "could not load 8051 microcode\n");
 2607                         firmware_free(ucode, size);
 2608                         firmware_close(fh);
 2609                         rt2661_stop(ifp, 1);
 2610                         return EIO;
 2611                 }
 2612 
 2613                 firmware_free(ucode, size);
 2614                 firmware_close(fh);
 2615                 sc->sc_flags |= RT2661_FWLOADED;
 2616         }
 2617 
 2618         /* initialize Tx rings */
 2619         RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
 2620         RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
 2621         RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
 2622         RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
 2623 
 2624         /* initialize Mgt ring */
 2625         RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
 2626 
 2627         /* initialize Rx ring */
 2628         RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
 2629 
 2630         /* initialize Tx rings sizes */
 2631         RAL_WRITE(sc, RT2661_TX_RING_CSR0,
 2632             RT2661_TX_RING_COUNT << 24 |
 2633             RT2661_TX_RING_COUNT << 16 |
 2634             RT2661_TX_RING_COUNT <<  8 |
 2635             RT2661_TX_RING_COUNT);
 2636 
 2637         RAL_WRITE(sc, RT2661_TX_RING_CSR1,
 2638             RT2661_TX_DESC_WSIZE << 16 |
 2639             RT2661_TX_RING_COUNT <<  8 |        /* XXX: HCCA ring unused */
 2640             RT2661_MGT_RING_COUNT);
 2641 
 2642         /* initialize Rx rings */
 2643         RAL_WRITE(sc, RT2661_RX_RING_CSR,
 2644             RT2661_RX_DESC_BACK  << 16 |
 2645             RT2661_RX_DESC_WSIZE <<  8 |
 2646             RT2661_RX_RING_COUNT);
 2647 
 2648         /* XXX: some magic here */
 2649         RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
 2650 
 2651         /* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
 2652         RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
 2653 
 2654         /* load base address of Rx ring */
 2655         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
 2656 
 2657         /* initialize MAC registers to default values */
 2658         for (i = 0; i < N(rt2661_def_mac); i++)
 2659                 RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
 2660 
 2661         IEEE80211_ADDR_COPY(ic->ic_myaddr, CLLADDR(ifp->if_sadl));
 2662         rt2661_set_macaddr(sc, ic->ic_myaddr);
 2663 
 2664         /* set host ready */
 2665         RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2666         RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2667 
 2668         /* wait for BBP/RF to wakeup */
 2669         for (ntries = 0; ntries < 1000; ntries++) {
 2670                 if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
 2671                         break;
 2672                 DELAY(1000);
 2673         }
 2674         if (ntries == 1000) {
 2675                 printf("timeout waiting for BBP/RF to wakeup\n");
 2676                 rt2661_stop(ifp, 1);
 2677                 return EIO;
 2678         }
 2679 
 2680         if (rt2661_bbp_init(sc) != 0) {
 2681                 rt2661_stop(ifp, 1);
 2682                 return EIO;
 2683         }
 2684 
 2685         /* select default channel */
 2686         sc->sc_curchan = ic->ic_curchan;
 2687         rt2661_select_band(sc, sc->sc_curchan);
 2688         rt2661_select_antenna(sc);
 2689         rt2661_set_chan(sc, sc->sc_curchan);
 2690 
 2691         /* update Rx filter */
 2692         tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
 2693 
 2694         tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
 2695         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 2696                 tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
 2697                        RT2661_DROP_ACKCTS;
 2698                 if (ic->ic_opmode != IEEE80211_M_HOSTAP)
 2699                         tmp |= RT2661_DROP_TODS;
 2700                 if (!(ifp->if_flags & IFF_PROMISC))
 2701                         tmp |= RT2661_DROP_NOT_TO_ME;
 2702         }
 2703 
 2704         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2705 
 2706         /* clear STA registers */
 2707         RAL_READ_REGION_4(sc, RT2661_STA_CSR0, star, N(star));
 2708 
 2709         /* initialize ASIC */
 2710         RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
 2711 
 2712         /* clear any pending interrupt */
 2713         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2714 
 2715         /* enable interrupts */
 2716         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 2717         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 2718 
 2719         /* kick Rx */
 2720         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
 2721 
 2722         ifp->if_flags &= ~IFF_OACTIVE;
 2723         ifp->if_flags |= IFF_RUNNING;
 2724 
 2725         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 2726                 if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
 2727                         ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
 2728         } else
 2729                 ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
 2730 
 2731         return 0;
 2732 #undef N
 2733 }
 2734 
 2735 static void
 2736 rt2661_stop(struct ifnet *ifp, int disable)
 2737 {
 2738         struct rt2661_softc *sc = ifp->if_softc;
 2739         struct ieee80211com *ic = &sc->sc_ic;
 2740         uint32_t tmp;
 2741 
 2742         sc->sc_tx_timer = 0;
 2743         ifp->if_timer = 0;
 2744         ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
 2745 
 2746         ieee80211_new_state(ic, IEEE80211_S_INIT, -1);  /* free all nodes */
 2747 
 2748         /* abort Tx (for all 5 Tx rings) */
 2749         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
 2750 
 2751         /* disable Rx (value remains after reset!) */
 2752         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2753         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2754 
 2755         /* reset ASIC */
 2756         RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2757         RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2758 
 2759         /* disable interrupts */
 2760         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 2761         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 2762 
 2763         /* clear any pending interrupt */
 2764         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2765         RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
 2766 
 2767         /* reset Tx and Rx rings */
 2768         rt2661_reset_tx_ring(sc, &sc->txq[0]);
 2769         rt2661_reset_tx_ring(sc, &sc->txq[1]);
 2770         rt2661_reset_tx_ring(sc, &sc->txq[2]);
 2771         rt2661_reset_tx_ring(sc, &sc->txq[3]);
 2772         rt2661_reset_tx_ring(sc, &sc->mgtq);
 2773         rt2661_reset_rx_ring(sc, &sc->rxq);
 2774 
 2775         /* for CardBus, power down the socket */
 2776         if (disable && sc->sc_disable != NULL) {
 2777                 if (sc->sc_flags & RT2661_ENABLED) {
 2778                         (*sc->sc_disable)(sc);
 2779                         sc->sc_flags &= ~(RT2661_ENABLED | RT2661_FWLOADED);
 2780                 }
 2781         }
 2782 }
 2783 
 2784 static int
 2785 rt2661_load_microcode(struct rt2661_softc *sc, const uint8_t *ucode, int size)
 2786 {
 2787         int ntries;
 2788 
 2789         /* reset 8051 */
 2790         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2791 
 2792         /* cancel any pending Host to MCU command */
 2793         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
 2794         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 2795         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
 2796 
 2797         /* write 8051's microcode */
 2798         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
 2799         RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, ucode, size);
 2800         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2801 
 2802         /* kick 8051's ass */
 2803         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
 2804 
 2805         /* wait for 8051 to initialize */
 2806         for (ntries = 0; ntries < 500; ntries++) {
 2807                 if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
 2808                         break;
 2809                 DELAY(100);
 2810         }
 2811         if (ntries == 500) {
 2812                 printf("timeout waiting for MCU to initialize\n");
 2813                 return EIO;
 2814         }
 2815         return 0;
 2816 }
 2817 
 2818 /*
 2819  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
 2820  * false CCA count.  This function is called periodically (every seconds) when
 2821  * in the RUN state.  Values taken from the reference driver.
 2822  */
 2823 static void
 2824 rt2661_rx_tune(struct rt2661_softc *sc)
 2825 {
 2826         uint8_t bbp17;
 2827         uint16_t cca;
 2828         int lo, hi, dbm;
 2829 
 2830         /*
 2831          * Tuning range depends on operating band and on the presence of an
 2832          * external low-noise amplifier.
 2833          */
 2834         lo = 0x20;
 2835         if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
 2836                 lo += 0x08;
 2837         if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
 2838             (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
 2839                 lo += 0x10;
 2840         hi = lo + 0x20;
 2841 
 2842         dbm = sc->avg_rssi;
 2843         /* retrieve false CCA count since last call (clear on read) */
 2844         cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
 2845 
 2846         DPRINTFN(2, ("RSSI=%ddBm false CCA=%d\n", dbm, cca));
 2847 
 2848         if (dbm < -74) {
 2849                 /* very bad RSSI, tune using false CCA count */
 2850                 bbp17 = sc->bbp17; /* current value */
 2851 
 2852                 hi -= 2 * (-74 - dbm);
 2853                 if (hi < lo)
 2854                         hi = lo;
 2855 
 2856                 if (bbp17 > hi)
 2857                         bbp17 = hi;
 2858                 else if (cca > 512)
 2859                         bbp17 = uimin(bbp17 + 1, hi);
 2860                 else if (cca < 100)
 2861                         bbp17 = uimax(bbp17 - 1, lo);
 2862 
 2863         } else if (dbm < -66) {
 2864                 bbp17 = lo + 0x08;
 2865         } else if (dbm < -58) {
 2866                 bbp17 = lo + 0x10;
 2867         } else if (dbm < -35) {
 2868                 bbp17 = hi;
 2869         } else {        /* very good RSSI >= -35dBm */
 2870                 bbp17 = 0x60;   /* very low sensitivity */
 2871         }
 2872 
 2873         if (bbp17 != sc->bbp17) {
 2874                 DPRINTF(("BBP17 %x->%x\n", sc->bbp17, bbp17));
 2875                 rt2661_bbp_write(sc, 17, bbp17);
 2876                 sc->bbp17 = bbp17;
 2877         }
 2878 }
 2879 
 2880 #ifdef notyet
 2881 /*
 2882  * Enter/Leave radar detection mode.
 2883  * This is for 802.11h additional regulatory domains.
 2884  */
 2885 static void
 2886 rt2661_radar_start(struct rt2661_softc *sc)
 2887 {
 2888         uint32_t tmp;
 2889 
 2890         /* disable Rx */
 2891         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2892         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2893 
 2894         rt2661_bbp_write(sc, 82, 0x20);
 2895         rt2661_bbp_write(sc, 83, 0x00);
 2896         rt2661_bbp_write(sc, 84, 0x40);
 2897 
 2898         /* save current BBP registers values */
 2899         sc->bbp18 = rt2661_bbp_read(sc, 18);
 2900         sc->bbp21 = rt2661_bbp_read(sc, 21);
 2901         sc->bbp22 = rt2661_bbp_read(sc, 22);
 2902         sc->bbp16 = rt2661_bbp_read(sc, 16);
 2903         sc->bbp17 = rt2661_bbp_read(sc, 17);
 2904         sc->bbp64 = rt2661_bbp_read(sc, 64);
 2905 
 2906         rt2661_bbp_write(sc, 18, 0xff);
 2907         rt2661_bbp_write(sc, 21, 0x3f);
 2908         rt2661_bbp_write(sc, 22, 0x3f);
 2909         rt2661_bbp_write(sc, 16, 0xbd);
 2910         rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
 2911         rt2661_bbp_write(sc, 64, 0x21);
 2912 
 2913         /* restore Rx filter */
 2914         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2915 }
 2916 
 2917 static int
 2918 rt2661_radar_stop(struct rt2661_softc *sc)
 2919 {
 2920         uint8_t bbp66;
 2921 
 2922         /* read radar detection result */
 2923         bbp66 = rt2661_bbp_read(sc, 66);
 2924 
 2925         /* restore BBP registers values */
 2926         rt2661_bbp_write(sc, 16, sc->bbp16);
 2927         rt2661_bbp_write(sc, 17, sc->bbp17);
 2928         rt2661_bbp_write(sc, 18, sc->bbp18);
 2929         rt2661_bbp_write(sc, 21, sc->bbp21);
 2930         rt2661_bbp_write(sc, 22, sc->bbp22);
 2931         rt2661_bbp_write(sc, 64, sc->bbp64);
 2932 
 2933         return bbp66 == 1;
 2934 }
 2935 #endif
 2936 
 2937 static int
 2938 rt2661_prepare_beacon(struct rt2661_softc *sc)
 2939 {
 2940         struct ieee80211com *ic = &sc->sc_ic;
 2941         struct ieee80211_node *ni = ic->ic_bss;
 2942         struct rt2661_tx_desc desc;
 2943         struct mbuf *m0;
 2944         struct ieee80211_beacon_offsets bo;
 2945         int rate;
 2946 
 2947         m0 = ieee80211_beacon_alloc(ic, ni, &bo);
 2948         if (m0 == NULL) {
 2949                 aprint_error_dev(sc->sc_dev, "could not allocate beacon frame\n");
 2950                 return ENOBUFS;
 2951         }
 2952 
 2953         /* send beacons at the lowest available rate */
 2954         rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
 2955 
 2956         rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
 2957             m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
 2958 
 2959         /* copy the first 24 bytes of Tx descriptor into NIC memory */
 2960         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
 2961 
 2962         /* copy beacon header and payload into NIC memory */
 2963         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
 2964             mtod(m0, uint8_t *), m0->m_pkthdr.len);
 2965 
 2966         m_freem(m0);
 2967 
 2968         /*
 2969          * Store offset of ERP Information Element so that we can update it
 2970          * dynamically when the slot time changes.
 2971          * XXX: this is ugly since it depends on how net80211 builds beacon
 2972          * frames but ieee80211_beacon_alloc() doesn't store offsets for us.
 2973          */
 2974         if (ic->ic_curmode == IEEE80211_MODE_11G) {
 2975                 sc->erp_csr =
 2976                     RT2661_HW_BEACON_BASE0 + 24 +
 2977                     sizeof (struct ieee80211_frame) +
 2978                     8 + 2 + 2 + 2 + ni->ni_esslen +
 2979                     2 + uimin(ni->ni_rates.rs_nrates, IEEE80211_RATE_SIZE) +
 2980                     2 + 1 +
 2981                     ((ic->ic_opmode == IEEE80211_M_IBSS) ? 4 : 6) +
 2982                     2;
 2983         }
 2984 
 2985         return 0;
 2986 }
 2987 
 2988 /*
 2989  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
 2990  * and HostAP operating modes.
 2991  */
 2992 static void
 2993 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
 2994 {
 2995         struct ieee80211com *ic = &sc->sc_ic;
 2996         uint32_t tmp;
 2997 
 2998         if (ic->ic_opmode != IEEE80211_M_STA) {
 2999                 /*
 3000                  * Change default 16ms TBTT adjustment to 8ms.
 3001                  * Must be done before enabling beacon generation.
 3002                  */
 3003                 RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
 3004         }
 3005 
 3006         tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
 3007 
 3008         /* set beacon interval (in 1/16ms unit) */
 3009         tmp |= ic->ic_bss->ni_intval * 16;
 3010 
 3011         tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
 3012         if (ic->ic_opmode == IEEE80211_M_STA)
 3013                 tmp |= RT2661_TSF_MODE(1);
 3014         else
 3015                 tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
 3016 
 3017         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
 3018 }
 3019 
 3020 /*
 3021  * Retrieve the "Received Signal Strength Indicator" from the raw values
 3022  * contained in Rx descriptors.  The computation depends on which band the
 3023  * frame was received.  Correction values taken from the reference driver.
 3024  */
 3025 static int
 3026 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
 3027 {
 3028         int lna, agc, rssi;
 3029 
 3030         lna = (raw >> 5) & 0x3;
 3031         agc = raw & 0x1f;
 3032 
 3033         rssi = 2 * agc;
 3034 
 3035         if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
 3036                 rssi += sc->rssi_2ghz_corr;
 3037 
 3038                 if (lna == 1)
 3039                         rssi -= 64;
 3040                 else if (lna == 2)
 3041                         rssi -= 74;
 3042                 else if (lna == 3)
 3043                         rssi -= 90;
 3044         } else {
 3045                 rssi += sc->rssi_5ghz_corr;
 3046 
 3047                 if (lna == 1)
 3048                         rssi -= 64;
 3049                 else if (lna == 2)
 3050                         rssi -= 86;
 3051                 else if (lna == 3)
 3052                         rssi -= 100;
 3053         }
 3054         return rssi;
 3055 }

Cache object: 323380cd4e3a5dc44067d201e74baf4c


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.