The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/netif/ral/rt2661.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD: head/sys/dev/ral/rt2661.c 195618 2009-07-11 15:02:45Z rpaulo $        */
    2 
    3 /*-
    4  * Copyright (c) 2006
    5  *      Damien Bergamini <damien.bergamini@free.fr>
    6  *
    7  * Permission to use, copy, modify, and distribute this software for any
    8  * purpose with or without fee is hereby granted, provided that the above
    9  * copyright notice and this permission notice appear in all copies.
   10  *
   11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   18  *
   19  * $FreeBSD: head/sys/dev/ral/rt2661.c 195618 2009-07-11 15:02:45Z rpaulo $
   20  */
   21 
   22 /*-
   23  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
   24  * http://www.ralinktech.com/
   25  */
   26 
   27 #include <sys/param.h>
   28 #include <sys/sysctl.h>
   29 #include <sys/sockio.h>
   30 #include <sys/mbuf.h>
   31 #include <sys/kernel.h>
   32 #include <sys/socket.h>
   33 #include <sys/systm.h>
   34 #include <sys/malloc.h>
   35 #include <sys/lock.h>
   36 #include <sys/mutex.h>
   37 #include <sys/module.h>
   38 #include <sys/bus.h>
   39 #include <sys/endian.h>
   40 #include <sys/firmware.h>
   41 #include <sys/rman.h>
   42 
   43 #include <net/bpf.h>
   44 #include <net/if.h>
   45 #include <net/if_arp.h>
   46 #include <net/ethernet.h>
   47 #include <net/if_dl.h>
   48 #include <net/if_media.h>
   49 #include <net/if_types.h>
   50 #include <net/ifq_var.h>
   51 
   52 #include <netproto/802_11/ieee80211_var.h>
   53 #include <netproto/802_11/ieee80211_radiotap.h>
   54 #include <netproto/802_11/ieee80211_regdomain.h>
   55 #include <netproto/802_11/ieee80211_ratectl.h>
   56 
   57 #include <netinet/in.h>
   58 #include <netinet/in_systm.h>
   59 #include <netinet/in_var.h>
   60 #include <netinet/ip.h>
   61 #include <netinet/if_ether.h>
   62 
   63 #include <dev/netif/ral/rt2661reg.h>
   64 #include <dev/netif/ral/rt2661var.h>
   65 
   66 #define RAL_DEBUG
   67 #ifdef RAL_DEBUG
   68 #define DPRINTF(sc, fmt, ...) do {                              \
   69         if (sc->sc_debug > 0)                                   \
   70                 kprintf(fmt, __VA_ARGS__);                      \
   71 } while (0)
   72 #define DPRINTFN(sc, n, fmt, ...) do {                          \
   73         if (sc->sc_debug >= (n))                                \
   74                 kprintf(fmt, __VA_ARGS__);                      \
   75 } while (0)
   76 #else
   77 #define DPRINTF(sc, fmt, ...)
   78 #define DPRINTFN(sc, n, fmt, ...)
   79 #endif
   80 
   81 static struct ieee80211vap *rt2661_vap_create(struct ieee80211com *,
   82                             const char name[IFNAMSIZ], int unit,
   83                             enum ieee80211_opmode opmode,
   84                             int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
   85                             const uint8_t mac[IEEE80211_ADDR_LEN]);
   86 static void             rt2661_vap_delete(struct ieee80211vap *);
   87 static void             rt2661_dma_map_addr(void *, bus_dma_segment_t *, int,
   88                             int);
   89 static int              rt2661_alloc_tx_ring(struct rt2661_softc *,
   90                             struct rt2661_tx_ring *, int);
   91 static void             rt2661_reset_tx_ring(struct rt2661_softc *,
   92                             struct rt2661_tx_ring *);
   93 static void             rt2661_free_tx_ring(struct rt2661_softc *,
   94                             struct rt2661_tx_ring *);
   95 static int              rt2661_alloc_rx_ring(struct rt2661_softc *,
   96                             struct rt2661_rx_ring *, int);
   97 static void             rt2661_reset_rx_ring(struct rt2661_softc *,
   98                             struct rt2661_rx_ring *);
   99 static void             rt2661_free_rx_ring(struct rt2661_softc *,
  100                             struct rt2661_rx_ring *);
  101 static void             rt2661_newassoc(struct ieee80211_node *, int);
  102 static int              rt2661_newstate(struct ieee80211vap *,
  103                             enum ieee80211_state, int);
  104 static uint16_t         rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
  105 static void             rt2661_rx_intr(struct rt2661_softc *);
  106 static void             rt2661_tx_intr(struct rt2661_softc *);
  107 static void             rt2661_tx_dma_intr(struct rt2661_softc *,
  108                             struct rt2661_tx_ring *);
  109 static void             rt2661_mcu_beacon_expire(struct rt2661_softc *);
  110 static void             rt2661_mcu_wakeup(struct rt2661_softc *);
  111 static void             rt2661_mcu_cmd_intr(struct rt2661_softc *);
  112 static void             rt2661_scan_start(struct ieee80211com *);
  113 static void             rt2661_scan_end(struct ieee80211com *);
  114 static void             rt2661_set_channel(struct ieee80211com *);
  115 static void             rt2661_setup_tx_desc(struct rt2661_softc *,
  116                             struct rt2661_tx_desc *, uint32_t, uint16_t, int,
  117                             int, const bus_dma_segment_t *, int, int);
  118 static int              rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
  119                             struct ieee80211_node *, int);
  120 static int              rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
  121                             struct ieee80211_node *);
  122 static void             rt2661_start_locked(struct ifnet *);
  123 static void             rt2661_start(struct ifnet *, struct ifaltq_subque *);
  124 static int              rt2661_raw_xmit(struct ieee80211_node *, struct mbuf *,
  125                             const struct ieee80211_bpf_params *);
  126 static void             rt2661_watchdog_callout(void *);
  127 static int              rt2661_ioctl(struct ifnet *, u_long, caddr_t,
  128                             struct ucred *);
  129 static void             rt2661_bbp_write(struct rt2661_softc *, uint8_t,
  130                             uint8_t);
  131 static uint8_t          rt2661_bbp_read(struct rt2661_softc *, uint8_t);
  132 static void             rt2661_rf_write(struct rt2661_softc *, uint8_t,
  133                             uint32_t);
  134 static int              rt2661_tx_cmd(struct rt2661_softc *, uint8_t,
  135                             uint16_t);
  136 static void             rt2661_select_antenna(struct rt2661_softc *);
  137 static void             rt2661_enable_mrr(struct rt2661_softc *);
  138 static void             rt2661_set_txpreamble(struct rt2661_softc *);
  139 static void             rt2661_set_basicrates(struct rt2661_softc *,
  140                             const struct ieee80211_rateset *);
  141 static void             rt2661_select_band(struct rt2661_softc *,
  142                             struct ieee80211_channel *);
  143 static void             rt2661_set_chan(struct rt2661_softc *,
  144                             struct ieee80211_channel *);
  145 static void             rt2661_set_bssid(struct rt2661_softc *,
  146                             const uint8_t *);
  147 static void             rt2661_set_macaddr(struct rt2661_softc *,
  148                            const uint8_t *);
  149 static void             rt2661_update_promisc(struct ifnet *);
  150 static int              rt2661_wme_update(struct ieee80211com *) __unused;
  151 static void             rt2661_update_slot(struct ifnet *);
  152 static const char       *rt2661_get_rf(int);
  153 static void             rt2661_read_eeprom(struct rt2661_softc *,
  154                             uint8_t macaddr[IEEE80211_ADDR_LEN]);
  155 static int              rt2661_bbp_init(struct rt2661_softc *);
  156 static void             rt2661_init_locked(struct rt2661_softc *);
  157 static void             rt2661_init(void *);
  158 static void             rt2661_stop_locked(struct rt2661_softc *);
  159 static void             rt2661_stop(void *);
  160 static int              rt2661_load_microcode(struct rt2661_softc *);
  161 #ifdef notyet
  162 static void             rt2661_rx_tune(struct rt2661_softc *);
  163 static void             rt2661_radar_start(struct rt2661_softc *);
  164 static int              rt2661_radar_stop(struct rt2661_softc *);
  165 #endif
  166 static int              rt2661_prepare_beacon(struct rt2661_softc *,
  167                             struct ieee80211vap *);
  168 static void             rt2661_enable_tsf_sync(struct rt2661_softc *);
  169 static void             rt2661_enable_tsf(struct rt2661_softc *);
  170 static int              rt2661_get_rssi(struct rt2661_softc *, uint8_t);
  171 
  172 static const struct {
  173         uint32_t        reg;
  174         uint32_t        val;
  175 } rt2661_def_mac[] = {
  176         RT2661_DEF_MAC
  177 };
  178 
  179 static const struct {
  180         uint8_t reg;
  181         uint8_t val;
  182 } rt2661_def_bbp[] = {
  183         RT2661_DEF_BBP
  184 };
  185 
  186 static const struct rfprog {
  187         uint8_t         chan;
  188         uint32_t        r1, r2, r3, r4;
  189 }  rt2661_rf5225_1[] = {
  190         RT2661_RF5225_1
  191 }, rt2661_rf5225_2[] = {
  192         RT2661_RF5225_2
  193 };
  194 
  195 int
  196 rt2661_attach(device_t dev, int id)
  197 {
  198         struct rt2661_softc *sc = device_get_softc(dev);
  199         struct ieee80211com *ic;
  200         struct ifnet *ifp;
  201         uint32_t val;
  202         int error, ac, ntries;
  203         uint8_t bands;
  204         uint8_t macaddr[IEEE80211_ADDR_LEN];
  205         struct sysctl_ctx_list *ctx;
  206         struct sysctl_oid *tree;
  207 
  208         sc->sc_id = id;
  209         sc->sc_dev = dev;
  210 
  211         ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
  212         if (ifp == NULL) {
  213                 device_printf(sc->sc_dev, "can not if_alloc()\n");
  214                 return ENOMEM;
  215         }
  216         ic = ifp->if_l2com;
  217 
  218         callout_init(&sc->watchdog_ch);
  219 
  220         /* wait for NIC to initialize */
  221         for (ntries = 0; ntries < 1000; ntries++) {
  222                 if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
  223                         break;
  224                 DELAY(1000);
  225         }
  226         if (ntries == 1000) {
  227                 device_printf(sc->sc_dev,
  228                     "timeout waiting for NIC to initialize\n");
  229                 error = EIO;
  230                 goto fail1;
  231         }
  232 
  233         /* retrieve RF rev. no and various other things from EEPROM */
  234         rt2661_read_eeprom(sc, macaddr);
  235 
  236         device_printf(dev, "MAC/BBP RT%X, RF %s\n", val,
  237             rt2661_get_rf(sc->rf_rev));
  238 
  239         /*
  240          * Allocate Tx and Rx rings.
  241          */
  242         for (ac = 0; ac < 4; ac++) {
  243                 error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
  244                     RT2661_TX_RING_COUNT);
  245                 if (error != 0) {
  246                         device_printf(sc->sc_dev,
  247                             "could not allocate Tx ring %d\n", ac);
  248                         goto fail2;
  249                 }
  250         }
  251 
  252         error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
  253         if (error != 0) {
  254                 device_printf(sc->sc_dev, "could not allocate Mgt ring\n");
  255                 goto fail2;
  256         }
  257 
  258         error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
  259         if (error != 0) {
  260                 device_printf(sc->sc_dev, "could not allocate Rx ring\n");
  261                 goto fail3;
  262         }
  263 
  264         ifp->if_softc = sc;
  265         if_initname(ifp, device_get_name(dev), device_get_unit(dev));
  266         ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
  267         ifp->if_init = rt2661_init;
  268         ifp->if_ioctl = rt2661_ioctl;
  269         ifp->if_start = rt2661_start;
  270         ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
  271 #ifdef notyet
  272         ifq_set_ready(&ifp->if_snd);
  273 #endif
  274 
  275         ic->ic_ifp = ifp;
  276         ic->ic_opmode = IEEE80211_M_STA;
  277         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
  278 
  279         /* set device capabilities */
  280         ic->ic_caps =
  281                   IEEE80211_C_STA               /* station mode */
  282                 | IEEE80211_C_IBSS              /* ibss, nee adhoc, mode */
  283                 | IEEE80211_C_HOSTAP            /* hostap mode */
  284                 | IEEE80211_C_MONITOR           /* monitor mode */
  285                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
  286                 | IEEE80211_C_WDS               /* 4-address traffic works */
  287                 | IEEE80211_C_MBSS              /* mesh point link mode */
  288                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
  289                 | IEEE80211_C_SHSLOT            /* short slot time supported */
  290                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
  291                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
  292 #ifdef notyet
  293                 | IEEE80211_C_TXFRAG            /* handle tx frags */
  294                 | IEEE80211_C_WME               /* 802.11e */
  295 #endif
  296                 ;
  297 
  298         bands = 0;
  299         setbit(&bands, IEEE80211_MODE_11B);
  300         setbit(&bands, IEEE80211_MODE_11G);
  301         if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) 
  302                 setbit(&bands, IEEE80211_MODE_11A);
  303         ieee80211_init_channels(ic, NULL, &bands);
  304 
  305         ieee80211_ifattach(ic, macaddr);
  306         ic->ic_newassoc = rt2661_newassoc;
  307 #if 0
  308         ic->ic_wme.wme_update = rt2661_wme_update;
  309 #endif
  310         ic->ic_scan_start = rt2661_scan_start;
  311         ic->ic_scan_end = rt2661_scan_end;
  312         ic->ic_set_channel = rt2661_set_channel;
  313         ic->ic_updateslot = rt2661_update_slot;
  314         ic->ic_update_promisc = rt2661_update_promisc;
  315         ic->ic_raw_xmit = rt2661_raw_xmit;
  316 
  317         ic->ic_vap_create = rt2661_vap_create;
  318         ic->ic_vap_delete = rt2661_vap_delete;
  319 
  320         ieee80211_radiotap_attach(ic,
  321             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
  322                 RT2661_TX_RADIOTAP_PRESENT,
  323             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
  324                 RT2661_RX_RADIOTAP_PRESENT);
  325 
  326         ctx = &sc->sc_sysctl_ctx;
  327         sysctl_ctx_init(ctx);
  328         tree = SYSCTL_ADD_NODE(ctx, SYSCTL_STATIC_CHILDREN(_hw),
  329                                OID_AUTO,
  330                                device_get_nameunit(sc->sc_dev),
  331                                CTLFLAG_RD, 0, "");
  332         if (tree == NULL) {
  333                 device_printf(sc->sc_dev, "can't add sysctl node\n");
  334                 return 0;
  335         }
  336 #ifdef RAL_DEBUG
  337         SYSCTL_ADD_INT(ctx, SYSCTL_CHILDREN(tree), OID_AUTO,
  338             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
  339 #endif
  340         if (bootverbose)
  341                 ieee80211_announce(ic);
  342 
  343         return 0;
  344 
  345 fail3:  rt2661_free_tx_ring(sc, &sc->mgtq);
  346 fail2:  while (--ac >= 0)
  347                 rt2661_free_tx_ring(sc, &sc->txq[ac]);
  348 fail1:
  349         if_free(ifp);
  350         return error;
  351 }
  352 
  353 int
  354 rt2661_detach(void *xsc)
  355 {
  356         struct rt2661_softc *sc = xsc;
  357         struct ifnet *ifp = sc->sc_ifp;
  358         struct ieee80211com *ic = ifp->if_l2com;
  359         
  360         rt2661_stop_locked(sc);
  361 
  362         ieee80211_ifdetach(ic);
  363 
  364         rt2661_free_tx_ring(sc, &sc->txq[0]);
  365         rt2661_free_tx_ring(sc, &sc->txq[1]);
  366         rt2661_free_tx_ring(sc, &sc->txq[2]);
  367         rt2661_free_tx_ring(sc, &sc->txq[3]);
  368         rt2661_free_tx_ring(sc, &sc->mgtq);
  369         rt2661_free_rx_ring(sc, &sc->rxq);
  370 
  371         if_free(ifp);
  372 
  373         return 0;
  374 }
  375 
  376 static struct ieee80211vap *
  377 rt2661_vap_create(struct ieee80211com *ic,
  378         const char name[IFNAMSIZ], int unit,
  379         enum ieee80211_opmode opmode, int flags,
  380         const uint8_t bssid[IEEE80211_ADDR_LEN],
  381         const uint8_t mac[IEEE80211_ADDR_LEN])
  382 {
  383         struct ifnet *ifp = ic->ic_ifp;
  384         struct rt2661_vap *rvp;
  385         struct ieee80211vap *vap;
  386 
  387         switch (opmode) {
  388         case IEEE80211_M_STA:
  389         case IEEE80211_M_IBSS:
  390         case IEEE80211_M_AHDEMO:
  391         case IEEE80211_M_MONITOR:
  392         case IEEE80211_M_HOSTAP:
  393         case IEEE80211_M_MBSS:
  394                 /* XXXRP: TBD */
  395                 if (!TAILQ_EMPTY(&ic->ic_vaps)) {
  396                         if_printf(ifp, "only 1 vap supported\n");
  397                         return NULL;
  398                 }
  399                 if (opmode == IEEE80211_M_STA)
  400                         flags |= IEEE80211_CLONE_NOBEACONS;
  401                 break;
  402         case IEEE80211_M_WDS:
  403                 if (TAILQ_EMPTY(&ic->ic_vaps) ||
  404                     ic->ic_opmode != IEEE80211_M_HOSTAP) {
  405                         if_printf(ifp, "wds only supported in ap mode\n");
  406                         return NULL;
  407                 }
  408                 /*
  409                  * Silently remove any request for a unique
  410                  * bssid; WDS vap's always share the local
  411                  * mac address.
  412                  */
  413                 flags &= ~IEEE80211_CLONE_BSSID;
  414                 break;
  415         default:
  416                 if_printf(ifp, "unknown opmode %d\n", opmode);
  417                 return NULL;
  418         }
  419         rvp = (struct rt2661_vap *) kmalloc(sizeof(struct rt2661_vap),
  420             M_80211_VAP, M_INTWAIT | M_ZERO);
  421         if (rvp == NULL)
  422                 return NULL;
  423         vap = &rvp->ral_vap;
  424         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
  425 
  426         /* override state transition machine */
  427         rvp->ral_newstate = vap->iv_newstate;
  428         vap->iv_newstate = rt2661_newstate;
  429 #if 0
  430         vap->iv_update_beacon = rt2661_beacon_update;
  431 #endif
  432 
  433         ieee80211_ratectl_init(vap);
  434         /* complete setup */
  435         ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
  436         if (TAILQ_FIRST(&ic->ic_vaps) == vap)
  437                 ic->ic_opmode = opmode;
  438         return vap;
  439 }
  440 
  441 static void
  442 rt2661_vap_delete(struct ieee80211vap *vap)
  443 {
  444         struct rt2661_vap *rvp = RT2661_VAP(vap);
  445 
  446         ieee80211_ratectl_deinit(vap);
  447         ieee80211_vap_detach(vap);
  448         kfree(rvp, M_80211_VAP);
  449 }
  450 
  451 void
  452 rt2661_shutdown(void *xsc)
  453 {
  454         struct rt2661_softc *sc = xsc;
  455 
  456         rt2661_stop(sc);
  457 }
  458 
  459 void
  460 rt2661_suspend(void *xsc)
  461 {
  462         struct rt2661_softc *sc = xsc;
  463 
  464         rt2661_stop(sc);
  465 }
  466 
  467 void
  468 rt2661_resume(void *xsc)
  469 {
  470         struct rt2661_softc *sc = xsc;
  471         struct ifnet *ifp = sc->sc_ifp;
  472 
  473         if (ifp->if_flags & IFF_UP)
  474                 rt2661_init(sc);
  475 }
  476 
  477 static void
  478 rt2661_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
  479 {
  480         if (error != 0)
  481                 return;
  482 
  483         KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
  484 
  485         *(bus_addr_t *)arg = segs[0].ds_addr;
  486 }
  487 
  488 static int
  489 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
  490     int count)
  491 {
  492         int i, error;
  493 
  494         ring->count = count;
  495         ring->queued = 0;
  496         ring->cur = ring->next = ring->stat = 0;
  497 
  498         error = bus_dma_tag_create(ring->desc_dmat, 4, 0, 
  499             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
  500             count * RT2661_TX_DESC_SIZE, 1, count * RT2661_TX_DESC_SIZE,
  501             0, &ring->desc_dmat);
  502         if (error != 0) {
  503                 device_printf(sc->sc_dev, "could not create desc DMA tag\n");
  504                 goto fail;
  505         }
  506 
  507         error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
  508             BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
  509         if (error != 0) {
  510                 device_printf(sc->sc_dev, "could not allocate DMA memory\n");
  511                 goto fail;
  512         }
  513 
  514         error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
  515             count * RT2661_TX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
  516             0);
  517         if (error != 0) {
  518                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
  519                 goto fail;
  520         }
  521 
  522         ring->data = kmalloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
  523             M_INTWAIT | M_ZERO);
  524         if (ring->data == NULL) {
  525                 device_printf(sc->sc_dev, "could not allocate soft data\n");
  526                 error = ENOMEM;
  527                 goto fail;
  528         }
  529 
  530         error = bus_dma_tag_create(ring->data_dmat, 1, 0, 
  531             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
  532             RT2661_MAX_SCATTER, MCLBYTES, 0, &ring->data_dmat);
  533         if (error != 0) {
  534                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
  535                 goto fail;
  536         }
  537 
  538         for (i = 0; i < count; i++) {
  539                 error = bus_dmamap_create(ring->data_dmat, 0,
  540                     &ring->data[i].map);
  541                 if (error != 0) {
  542                         device_printf(sc->sc_dev, "could not create DMA map\n");
  543                         goto fail;
  544                 }
  545         }
  546 
  547         return 0;
  548 
  549 fail:   rt2661_free_tx_ring(sc, ring);
  550         return error;
  551 }
  552 
  553 static void
  554 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  555 {
  556         struct rt2661_tx_desc *desc;
  557         struct rt2661_tx_data *data;
  558         int i;
  559 
  560         for (i = 0; i < ring->count; i++) {
  561                 desc = &ring->desc[i];
  562                 data = &ring->data[i];
  563 
  564                 if (data->m != NULL) {
  565                         bus_dmamap_sync(ring->data_dmat, data->map,
  566                             BUS_DMASYNC_POSTWRITE);
  567                         bus_dmamap_unload(ring->data_dmat, data->map);
  568                         m_freem(data->m);
  569                         data->m = NULL;
  570                 }
  571 
  572                 if (data->ni != NULL) {
  573                         ieee80211_free_node(data->ni);
  574                         data->ni = NULL;
  575                 }
  576 
  577                 desc->flags = 0;
  578         }
  579 
  580         bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
  581 
  582         ring->queued = 0;
  583         ring->cur = ring->next = ring->stat = 0;
  584 }
  585 
  586 static void
  587 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  588 {
  589         struct rt2661_tx_data *data;
  590         int i;
  591 
  592         if (ring->desc != NULL) {
  593                 bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
  594                     BUS_DMASYNC_POSTWRITE);
  595                 bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
  596                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
  597         }
  598 
  599         if (ring->desc_dmat != NULL)
  600                 bus_dma_tag_destroy(ring->desc_dmat);
  601 
  602         if (ring->data != NULL) {
  603                 for (i = 0; i < ring->count; i++) {
  604                         data = &ring->data[i];
  605 
  606                         if (data->m != NULL) {
  607                                 bus_dmamap_sync(ring->data_dmat, data->map,
  608                                     BUS_DMASYNC_POSTWRITE);
  609                                 bus_dmamap_unload(ring->data_dmat, data->map);
  610                                 m_freem(data->m);
  611                         }
  612 
  613                         if (data->ni != NULL)
  614                                 ieee80211_free_node(data->ni);
  615 
  616                         if (data->map != NULL)
  617                                 bus_dmamap_destroy(ring->data_dmat, data->map);
  618                 }
  619 
  620                 kfree(ring->data, M_DEVBUF);
  621         }
  622 
  623         if (ring->data_dmat != NULL)
  624                 bus_dma_tag_destroy(ring->data_dmat);
  625 }
  626 
  627 static int
  628 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
  629     int count)
  630 {
  631         struct rt2661_rx_desc *desc;
  632         struct rt2661_rx_data *data;
  633         bus_addr_t physaddr;
  634         int i, error;
  635 
  636         ring->count = count;
  637         ring->cur = ring->next = 0;
  638 
  639         error = bus_dma_tag_create(ring->desc_dmat, 4, 0, 
  640             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
  641             count * RT2661_RX_DESC_SIZE, 1, count * RT2661_RX_DESC_SIZE,
  642             0, &ring->desc_dmat);
  643         if (error != 0) {
  644                 device_printf(sc->sc_dev, "could not create desc DMA tag\n");
  645                 goto fail;
  646         }
  647 
  648         error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
  649             BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
  650         if (error != 0) {
  651                 device_printf(sc->sc_dev, "could not allocate DMA memory\n");
  652                 goto fail;
  653         }
  654 
  655         error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
  656             count * RT2661_RX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
  657             0);
  658         if (error != 0) {
  659                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
  660                 goto fail;
  661         }
  662 
  663         ring->data = kmalloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
  664             M_INTWAIT | M_ZERO);
  665         if (ring->data == NULL) {
  666                 device_printf(sc->sc_dev, "could not allocate soft data\n");
  667                 error = ENOMEM;
  668                 goto fail;
  669         }
  670 
  671         /*
  672          * Pre-allocate Rx buffers and populate Rx ring.
  673          */
  674         error = bus_dma_tag_create(ring->data_dmat, 1, 0, 
  675             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
  676             1, MCLBYTES, 0, &ring->data_dmat);
  677         if (error != 0) {
  678                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
  679                 goto fail;
  680         }
  681 
  682         for (i = 0; i < count; i++) {
  683                 desc = &sc->rxq.desc[i];
  684                 data = &sc->rxq.data[i];
  685 
  686                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
  687                 if (error != 0) {
  688                         device_printf(sc->sc_dev, "could not create DMA map\n");
  689                         goto fail;
  690                 }
  691 
  692                 data->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
  693                 if (data->m == NULL) {
  694                         device_printf(sc->sc_dev,
  695                             "could not allocate rx mbuf\n");
  696                         error = ENOMEM;
  697                         goto fail;
  698                 }
  699 
  700                 error = bus_dmamap_load(ring->data_dmat, data->map,
  701                     mtod(data->m, void *), MCLBYTES, rt2661_dma_map_addr,
  702                     &physaddr, 0);
  703                 if (error != 0) {
  704                         device_printf(sc->sc_dev,
  705                             "could not load rx buf DMA map");
  706                         goto fail;
  707                 }
  708 
  709                 desc->flags = htole32(RT2661_RX_BUSY);
  710                 desc->physaddr = htole32(physaddr);
  711         }
  712 
  713         bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
  714 
  715         return 0;
  716 
  717 fail:   rt2661_free_rx_ring(sc, ring);
  718         return error;
  719 }
  720 
  721 static void
  722 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  723 {
  724         int i;
  725 
  726         for (i = 0; i < ring->count; i++)
  727                 ring->desc[i].flags = htole32(RT2661_RX_BUSY);
  728 
  729         bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
  730 
  731         ring->cur = ring->next = 0;
  732 }
  733 
  734 static void
  735 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  736 {
  737         struct rt2661_rx_data *data;
  738         int i;
  739 
  740         if (ring->desc != NULL) {
  741                 bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
  742                     BUS_DMASYNC_POSTWRITE);
  743                 bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
  744                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
  745         }
  746 
  747         if (ring->desc_dmat != NULL)
  748                 bus_dma_tag_destroy(ring->desc_dmat);
  749 
  750         if (ring->data != NULL) {
  751                 for (i = 0; i < ring->count; i++) {
  752                         data = &ring->data[i];
  753 
  754                         if (data->m != NULL) {
  755                                 bus_dmamap_sync(ring->data_dmat, data->map,
  756                                     BUS_DMASYNC_POSTREAD);
  757                                 bus_dmamap_unload(ring->data_dmat, data->map);
  758                                 m_freem(data->m);
  759                         }
  760 
  761                         if (data->map != NULL)
  762                                 bus_dmamap_destroy(ring->data_dmat, data->map);
  763                 }
  764 
  765                 kfree(ring->data, M_DEVBUF);
  766         }
  767 
  768         if (ring->data_dmat != NULL)
  769                 bus_dma_tag_destroy(ring->data_dmat);
  770 }
  771 
  772 static void
  773 rt2661_newassoc(struct ieee80211_node *ni, int isnew)
  774 {
  775         ieee80211_ratectl_node_deinit(ni);
  776         ieee80211_ratectl_node_init(ni);
  777 }
  778 
  779 static int
  780 rt2661_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  781 {
  782         struct rt2661_vap *rvp = RT2661_VAP(vap);
  783         struct ieee80211com *ic = vap->iv_ic;
  784         struct rt2661_softc *sc = ic->ic_ifp->if_softc;
  785         int error;
  786 
  787         if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
  788                 uint32_t tmp;
  789 
  790                 /* abort TSF synchronization */
  791                 tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
  792                 RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
  793         }
  794 
  795         error = rvp->ral_newstate(vap, nstate, arg);
  796 
  797         if (error == 0 && nstate == IEEE80211_S_RUN) {
  798                 struct ieee80211_node *ni = vap->iv_bss;
  799 
  800                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
  801                         rt2661_enable_mrr(sc);
  802                         rt2661_set_txpreamble(sc);
  803                         rt2661_set_basicrates(sc, &ni->ni_rates);
  804                         rt2661_set_bssid(sc, ni->ni_bssid);
  805                 }
  806 
  807                 if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
  808                     vap->iv_opmode == IEEE80211_M_IBSS ||
  809                     vap->iv_opmode == IEEE80211_M_MBSS) {
  810                         error = rt2661_prepare_beacon(sc, vap);
  811                         if (error != 0)
  812                                 return error;
  813                 }
  814                 if (vap->iv_opmode != IEEE80211_M_MONITOR)
  815                         rt2661_enable_tsf_sync(sc);
  816                 else
  817                         rt2661_enable_tsf(sc);
  818         }
  819         return error;
  820 }
  821 
  822 /*
  823  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
  824  * 93C66).
  825  */
  826 static uint16_t
  827 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
  828 {
  829         uint32_t tmp;
  830         uint16_t val;
  831         int n;
  832 
  833         /* clock C once before the first command */
  834         RT2661_EEPROM_CTL(sc, 0);
  835 
  836         RT2661_EEPROM_CTL(sc, RT2661_S);
  837         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  838         RT2661_EEPROM_CTL(sc, RT2661_S);
  839 
  840         /* write start bit (1) */
  841         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  842         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  843 
  844         /* write READ opcode (10) */
  845         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  846         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  847         RT2661_EEPROM_CTL(sc, RT2661_S);
  848         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  849 
  850         /* write address (A5-A0 or A7-A0) */
  851         n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
  852         for (; n >= 0; n--) {
  853                 RT2661_EEPROM_CTL(sc, RT2661_S |
  854                     (((addr >> n) & 1) << RT2661_SHIFT_D));
  855                 RT2661_EEPROM_CTL(sc, RT2661_S |
  856                     (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
  857         }
  858 
  859         RT2661_EEPROM_CTL(sc, RT2661_S);
  860 
  861         /* read data Q15-Q0 */
  862         val = 0;
  863         for (n = 15; n >= 0; n--) {
  864                 RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  865                 tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
  866                 val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
  867                 RT2661_EEPROM_CTL(sc, RT2661_S);
  868         }
  869 
  870         RT2661_EEPROM_CTL(sc, 0);
  871 
  872         /* clear Chip Select and clock C */
  873         RT2661_EEPROM_CTL(sc, RT2661_S);
  874         RT2661_EEPROM_CTL(sc, 0);
  875         RT2661_EEPROM_CTL(sc, RT2661_C);
  876 
  877         return val;
  878 }
  879 
  880 static void
  881 rt2661_tx_intr(struct rt2661_softc *sc)
  882 {
  883         struct ifnet *ifp = sc->sc_ifp;
  884         struct rt2661_tx_ring *txq;
  885         struct rt2661_tx_data *data;
  886         uint32_t val;
  887         int qid, retrycnt;
  888         struct ieee80211vap *vap;
  889 
  890         for (;;) {
  891                 struct ieee80211_node *ni;
  892                 struct mbuf *m;
  893 
  894                 val = RAL_READ(sc, RT2661_STA_CSR4);
  895                 if (!(val & RT2661_TX_STAT_VALID))
  896                         break;
  897 
  898                 /* retrieve the queue in which this frame was sent */
  899                 qid = RT2661_TX_QID(val);
  900                 txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
  901 
  902                 /* retrieve rate control algorithm context */
  903                 data = &txq->data[txq->stat];
  904                 m = data->m;
  905                 data->m = NULL;
  906 
  907                 ni = data->ni;
  908                 data->ni = NULL;
  909 
  910                 /* if no frame has been sent, ignore */
  911                 if (ni == NULL)
  912                         continue;
  913 
  914                 vap = ni->ni_vap;
  915 
  916                 switch (RT2661_TX_RESULT(val)) {
  917                 case RT2661_TX_SUCCESS:
  918                         retrycnt = RT2661_TX_RETRYCNT(val);
  919 
  920                         DPRINTFN(sc, 10, "data frame sent successfully after "
  921                             "%d retries\n", retrycnt);
  922                         if (data->rix != IEEE80211_FIXED_RATE_NONE)
  923                                 ieee80211_ratectl_tx_complete(vap, ni,
  924                                     IEEE80211_RATECTL_TX_SUCCESS,
  925                                     &retrycnt, NULL);
  926                         IFNET_STAT_INC(ifp, opackets, 1);
  927                         break;
  928 
  929                 case RT2661_TX_RETRY_FAIL:
  930                         retrycnt = RT2661_TX_RETRYCNT(val);
  931 
  932                         DPRINTFN(sc, 9, "%s\n",
  933                             "sending data frame failed (too much retries)");
  934                         if (data->rix != IEEE80211_FIXED_RATE_NONE)
  935                                 ieee80211_ratectl_tx_complete(vap, ni,
  936                                     IEEE80211_RATECTL_TX_FAILURE,
  937                                     &retrycnt, NULL);
  938                         IFNET_STAT_INC(ifp, oerrors, 1);
  939                         break;
  940 
  941                 default:
  942                         /* other failure */
  943                         device_printf(sc->sc_dev,
  944                             "sending data frame failed 0x%08x\n", val);
  945                         IFNET_STAT_INC(ifp, oerrors, 1);
  946                 }
  947 
  948                 DPRINTFN(sc, 15, "tx done q=%d idx=%u\n", qid, txq->stat);
  949 
  950                 txq->queued--;
  951                 if (++txq->stat >= txq->count)  /* faster than % count */
  952                         txq->stat = 0;
  953 
  954                 if (m->m_flags & M_TXCB)
  955                         ieee80211_process_callback(ni, m,
  956                                 RT2661_TX_RESULT(val) != RT2661_TX_SUCCESS);
  957                 m_freem(m);
  958                 ieee80211_free_node(ni);
  959         }
  960 
  961         sc->sc_tx_timer = 0;
  962         ifq_clr_oactive(&ifp->if_snd);
  963 
  964         rt2661_start_locked(ifp);
  965 }
  966 
  967 static void
  968 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
  969 {
  970         struct rt2661_tx_desc *desc;
  971         struct rt2661_tx_data *data;
  972 
  973         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_POSTREAD);
  974 
  975         for (;;) {
  976                 desc = &txq->desc[txq->next];
  977                 data = &txq->data[txq->next];
  978 
  979                 if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
  980                     !(le32toh(desc->flags) & RT2661_TX_VALID))
  981                         break;
  982 
  983                 bus_dmamap_sync(txq->data_dmat, data->map,
  984                     BUS_DMASYNC_POSTWRITE);
  985                 bus_dmamap_unload(txq->data_dmat, data->map);
  986 
  987                 /* descriptor is no longer valid */
  988                 desc->flags &= ~htole32(RT2661_TX_VALID);
  989 
  990                 DPRINTFN(sc, 15, "tx dma done q=%p idx=%u\n", txq, txq->next);
  991 
  992                 if (++txq->next >= txq->count)  /* faster than % count */
  993                         txq->next = 0;
  994         }
  995 
  996         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
  997 }
  998 
  999 static void
 1000 rt2661_rx_intr(struct rt2661_softc *sc)
 1001 {
 1002         struct ifnet *ifp = sc->sc_ifp;
 1003         struct ieee80211com *ic = ifp->if_l2com;
 1004         struct rt2661_rx_desc *desc;
 1005         struct rt2661_rx_data *data;
 1006         bus_addr_t physaddr;
 1007         struct ieee80211_frame *wh;
 1008         struct ieee80211_node *ni;
 1009         struct mbuf *mnew, *m;
 1010         int error;
 1011 
 1012         bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
 1013             BUS_DMASYNC_POSTREAD);
 1014 
 1015         for (;;) {
 1016                 int8_t rssi, nf;
 1017 
 1018                 desc = &sc->rxq.desc[sc->rxq.cur];
 1019                 data = &sc->rxq.data[sc->rxq.cur];
 1020 
 1021                 if (le32toh(desc->flags) & RT2661_RX_BUSY)
 1022                         break;
 1023 
 1024                 if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
 1025                     (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
 1026                         /*
 1027                          * This should not happen since we did not request
 1028                          * to receive those frames when we filled TXRX_CSR0.
 1029                          */
 1030                         DPRINTFN(sc, 5, "PHY or CRC error flags 0x%08x\n",
 1031                             le32toh(desc->flags));
 1032                         IFNET_STAT_INC(ifp, ierrors, 1);
 1033                         goto skip;
 1034                 }
 1035 
 1036                 if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
 1037                         IFNET_STAT_INC(ifp, ierrors, 1);
 1038                         goto skip;
 1039                 }
 1040 
 1041                 /*
 1042                  * Try to allocate a new mbuf for this ring element and load it
 1043                  * before processing the current mbuf. If the ring element
 1044                  * cannot be loaded, drop the received packet and reuse the old
 1045                  * mbuf. In the unlikely case that the old mbuf can't be
 1046                  * reloaded either, explicitly panic.
 1047                  */
 1048                 mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
 1049                 if (mnew == NULL) {
 1050                         IFNET_STAT_INC(ifp, ierrors, 1);
 1051                         goto skip;
 1052                 }
 1053 
 1054                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
 1055                     BUS_DMASYNC_POSTREAD);
 1056                 bus_dmamap_unload(sc->rxq.data_dmat, data->map);
 1057 
 1058                 error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
 1059                     mtod(mnew, void *), MCLBYTES, rt2661_dma_map_addr,
 1060                     &physaddr, 0);
 1061                 if (error != 0) {
 1062                         m_freem(mnew);
 1063 
 1064                         /* try to reload the old mbuf */
 1065                         error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
 1066                             mtod(data->m, void *), MCLBYTES,
 1067                             rt2661_dma_map_addr, &physaddr, 0);
 1068                         if (error != 0) {
 1069                                 /* very unlikely that it will fail... */
 1070                                 panic("%s: could not load old rx mbuf",
 1071                                     device_get_name(sc->sc_dev));
 1072                         }
 1073                         IFNET_STAT_INC(ifp, ierrors, 1);
 1074                         goto skip;
 1075                 }
 1076 
 1077                 /*
 1078                  * New mbuf successfully loaded, update Rx ring and continue
 1079                  * processing.
 1080                  */
 1081                 m = data->m;
 1082                 data->m = mnew;
 1083                 desc->physaddr = htole32(physaddr);
 1084 
 1085                 /* finalize mbuf */
 1086                 m->m_pkthdr.rcvif = ifp;
 1087                 m->m_pkthdr.len = m->m_len =
 1088                     (le32toh(desc->flags) >> 16) & 0xfff;
 1089 
 1090                 rssi = rt2661_get_rssi(sc, desc->rssi);
 1091                 /* Error happened during RSSI conversion. */
 1092                 if (rssi < 0)
 1093                         rssi = -30;     /* XXX ignored by net80211 */
 1094                 nf = RT2661_NOISE_FLOOR;
 1095 
 1096                 if (ieee80211_radiotap_active(ic)) {
 1097                         struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
 1098                         uint32_t tsf_lo, tsf_hi;
 1099 
 1100                         /* get timestamp (low and high 32 bits) */
 1101                         tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
 1102                         tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
 1103 
 1104                         tap->wr_tsf =
 1105                             htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
 1106                         tap->wr_flags = 0;
 1107                         tap->wr_rate = ieee80211_plcp2rate(desc->rate,
 1108                             (desc->flags & htole32(RT2661_RX_OFDM)) ?
 1109                                 IEEE80211_T_OFDM : IEEE80211_T_CCK);
 1110                         tap->wr_antsignal = nf + rssi;
 1111                         tap->wr_antnoise = nf;
 1112                 }
 1113                 sc->sc_flags |= RAL_INPUT_RUNNING;
 1114                 wh = mtod(m, struct ieee80211_frame *);
 1115 
 1116                 /* send the frame to the 802.11 layer */
 1117                 ni = ieee80211_find_rxnode(ic,
 1118                     (struct ieee80211_frame_min *)wh);
 1119                 if (ni != NULL) {
 1120                         (void) ieee80211_input(ni, m, rssi, nf);
 1121                         ieee80211_free_node(ni);
 1122                 } else
 1123                         (void) ieee80211_input_all(ic, m, rssi, nf);
 1124 
 1125                 sc->sc_flags &= ~RAL_INPUT_RUNNING;
 1126 
 1127 skip:           desc->flags |= htole32(RT2661_RX_BUSY);
 1128 
 1129                 DPRINTFN(sc, 15, "rx intr idx=%u\n", sc->rxq.cur);
 1130 
 1131                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
 1132         }
 1133 
 1134         bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
 1135             BUS_DMASYNC_PREWRITE);
 1136 }
 1137 
 1138 /* ARGSUSED */
 1139 static void
 1140 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
 1141 {
 1142         /* do nothing */
 1143 }
 1144 
 1145 static void
 1146 rt2661_mcu_wakeup(struct rt2661_softc *sc)
 1147 {
 1148         RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
 1149 
 1150         RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
 1151         RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
 1152         RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
 1153 
 1154         /* send wakeup command to MCU */
 1155         rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
 1156 }
 1157 
 1158 static void
 1159 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
 1160 {
 1161         RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
 1162         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 1163 }
 1164 
 1165 void
 1166 rt2661_intr(void *arg)
 1167 {
 1168         struct rt2661_softc *sc = arg;
 1169         struct ifnet *ifp = sc->sc_ifp;
 1170         uint32_t r1, r2;
 1171 
 1172         /* disable MAC and MCU interrupts */
 1173         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 1174         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 1175 
 1176         /* don't re-enable interrupts if we're shutting down */
 1177         if (!(ifp->if_flags & IFF_RUNNING)) {
 1178                 return;
 1179         }
 1180 
 1181         r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
 1182         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
 1183 
 1184         r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
 1185         RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
 1186 
 1187         if (r1 & RT2661_MGT_DONE)
 1188                 rt2661_tx_dma_intr(sc, &sc->mgtq);
 1189 
 1190         if (r1 & RT2661_RX_DONE)
 1191                 rt2661_rx_intr(sc);
 1192 
 1193         if (r1 & RT2661_TX0_DMA_DONE)
 1194                 rt2661_tx_dma_intr(sc, &sc->txq[0]);
 1195 
 1196         if (r1 & RT2661_TX1_DMA_DONE)
 1197                 rt2661_tx_dma_intr(sc, &sc->txq[1]);
 1198 
 1199         if (r1 & RT2661_TX2_DMA_DONE)
 1200                 rt2661_tx_dma_intr(sc, &sc->txq[2]);
 1201 
 1202         if (r1 & RT2661_TX3_DMA_DONE)
 1203                 rt2661_tx_dma_intr(sc, &sc->txq[3]);
 1204 
 1205         if (r1 & RT2661_TX_DONE)
 1206                 rt2661_tx_intr(sc);
 1207 
 1208         if (r2 & RT2661_MCU_CMD_DONE)
 1209                 rt2661_mcu_cmd_intr(sc);
 1210 
 1211         if (r2 & RT2661_MCU_BEACON_EXPIRE)
 1212                 rt2661_mcu_beacon_expire(sc);
 1213 
 1214         if (r2 & RT2661_MCU_WAKEUP)
 1215                 rt2661_mcu_wakeup(sc);
 1216 
 1217         /* re-enable MAC and MCU interrupts */
 1218         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 1219         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 1220 
 1221 }
 1222 
 1223 static uint8_t
 1224 rt2661_plcp_signal(int rate)
 1225 {
 1226         switch (rate) {
 1227         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 1228         case 12:        return 0xb;
 1229         case 18:        return 0xf;
 1230         case 24:        return 0xa;
 1231         case 36:        return 0xe;
 1232         case 48:        return 0x9;
 1233         case 72:        return 0xd;
 1234         case 96:        return 0x8;
 1235         case 108:       return 0xc;
 1236 
 1237         /* CCK rates (NB: not IEEE std, device-specific) */
 1238         case 2:         return 0x0;
 1239         case 4:         return 0x1;
 1240         case 11:        return 0x2;
 1241         case 22:        return 0x3;
 1242         }
 1243         return 0xff;            /* XXX unsupported/unknown rate */
 1244 }
 1245 
 1246 static void
 1247 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
 1248     uint32_t flags, uint16_t xflags, int len, int rate,
 1249     const bus_dma_segment_t *segs, int nsegs, int ac)
 1250 {
 1251         struct ifnet *ifp = sc->sc_ifp;
 1252         struct ieee80211com *ic = ifp->if_l2com;
 1253         uint16_t plcp_length;
 1254         int i, remainder;
 1255 
 1256         desc->flags = htole32(flags);
 1257         desc->flags |= htole32(len << 16);
 1258         desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
 1259 
 1260         desc->xflags = htole16(xflags);
 1261         desc->xflags |= htole16(nsegs << 13);
 1262 
 1263         desc->wme = htole16(
 1264             RT2661_QID(ac) |
 1265             RT2661_AIFSN(2) |
 1266             RT2661_LOGCWMIN(4) |
 1267             RT2661_LOGCWMAX(10));
 1268 
 1269         /*
 1270          * Remember in which queue this frame was sent. This field is driver
 1271          * private data only. It will be made available by the NIC in STA_CSR4
 1272          * on Tx interrupts.
 1273          */
 1274         desc->qid = ac;
 1275 
 1276         /* setup PLCP fields */
 1277         desc->plcp_signal  = rt2661_plcp_signal(rate);
 1278         desc->plcp_service = 4;
 1279 
 1280         len += IEEE80211_CRC_LEN;
 1281         if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM) {
 1282                 desc->flags |= htole32(RT2661_TX_OFDM);
 1283 
 1284                 plcp_length = len & 0xfff;
 1285                 desc->plcp_length_hi = plcp_length >> 6;
 1286                 desc->plcp_length_lo = plcp_length & 0x3f;
 1287         } else {
 1288                 plcp_length = (16 * len + rate - 1) / rate;
 1289                 if (rate == 22) {
 1290                         remainder = (16 * len) % 22;
 1291                         if (remainder != 0 && remainder < 7)
 1292                                 desc->plcp_service |= RT2661_PLCP_LENGEXT;
 1293                 }
 1294                 desc->plcp_length_hi = plcp_length >> 8;
 1295                 desc->plcp_length_lo = plcp_length & 0xff;
 1296 
 1297                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 1298                         desc->plcp_signal |= 0x08;
 1299         }
 1300 
 1301         /* RT2x61 supports scatter with up to 5 segments */
 1302         for (i = 0; i < nsegs; i++) {
 1303                 desc->addr[i] = htole32(segs[i].ds_addr);
 1304                 desc->len [i] = htole16(segs[i].ds_len);
 1305         }
 1306 }
 1307 
 1308 static int
 1309 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
 1310     struct ieee80211_node *ni)
 1311 {
 1312         struct ieee80211vap *vap = ni->ni_vap;
 1313         struct ieee80211com *ic = ni->ni_ic;
 1314         struct rt2661_tx_desc *desc;
 1315         struct rt2661_tx_data *data;
 1316         struct ieee80211_frame *wh;
 1317         struct ieee80211_key *k;
 1318         bus_dma_segment_t segs[RT2661_MAX_SCATTER];
 1319         uint16_t dur;
 1320         uint32_t flags = 0;     /* XXX HWSEQ */
 1321         int nsegs, rate, error;
 1322 
 1323         desc = &sc->mgtq.desc[sc->mgtq.cur];
 1324         data = &sc->mgtq.data[sc->mgtq.cur];
 1325 
 1326         rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
 1327 
 1328         wh = mtod(m0, struct ieee80211_frame *);
 1329 
 1330         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1331                 k = ieee80211_crypto_encap(ni, m0);
 1332                 if (k == NULL) {
 1333                         m_freem(m0);
 1334                         return ENOBUFS;
 1335                 }
 1336         }
 1337 
 1338         error = bus_dmamap_load_mbuf_segment(sc->mgtq.data_dmat, data->map, m0,
 1339             segs, 1, &nsegs, BUS_DMA_NOWAIT);
 1340         if (error != 0) {
 1341                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
 1342                     error);
 1343                 m_freem(m0);
 1344                 return error;
 1345         }
 1346 
 1347         if (ieee80211_radiotap_active_vap(vap)) {
 1348                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1349 
 1350                 tap->wt_flags = 0;
 1351                 tap->wt_rate = rate;
 1352 
 1353                 ieee80211_radiotap_tx(vap, m0);
 1354         }
 1355 
 1356         data->m = m0;
 1357         data->ni = ni;
 1358         /* management frames are not taken into account for amrr */
 1359         data->rix = IEEE80211_FIXED_RATE_NONE;
 1360 
 1361         wh = mtod(m0, struct ieee80211_frame *);
 1362 
 1363         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1364                 flags |= RT2661_TX_NEED_ACK;
 1365 
 1366                 dur = ieee80211_ack_duration(ic->ic_rt,
 1367                     rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
 1368                 *(uint16_t *)wh->i_dur = htole16(dur);
 1369 
 1370                 /* tell hardware to add timestamp in probe responses */
 1371                 if ((wh->i_fc[0] &
 1372                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
 1373                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
 1374                         flags |= RT2661_TX_TIMESTAMP;
 1375         }
 1376 
 1377         rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
 1378             m0->m_pkthdr.len, rate, segs, nsegs, RT2661_QID_MGT);
 1379 
 1380         bus_dmamap_sync(sc->mgtq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 1381         bus_dmamap_sync(sc->mgtq.desc_dmat, sc->mgtq.desc_map,
 1382             BUS_DMASYNC_PREWRITE);
 1383 
 1384         DPRINTFN(sc, 10, "sending mgt frame len=%u idx=%u rate=%u\n",
 1385             m0->m_pkthdr.len, sc->mgtq.cur, rate);
 1386 
 1387         /* kick mgt */
 1388         sc->mgtq.queued++;
 1389         sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
 1390         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
 1391 
 1392         return 0;
 1393 }
 1394 
 1395 static int
 1396 rt2661_sendprot(struct rt2661_softc *sc, int ac,
 1397     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
 1398 {
 1399         struct ieee80211com *ic = ni->ni_ic;
 1400         struct rt2661_tx_ring *txq = &sc->txq[ac];
 1401         const struct ieee80211_frame *wh;
 1402         struct rt2661_tx_desc *desc;
 1403         struct rt2661_tx_data *data;
 1404         struct mbuf *mprot;
 1405         int protrate, pktlen, flags, isshort, error;
 1406         uint16_t dur;
 1407         bus_dma_segment_t segs[RT2661_MAX_SCATTER];
 1408         int nsegs;
 1409 
 1410         KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
 1411             ("protection %d", prot));
 1412 
 1413         wh = mtod(m, const struct ieee80211_frame *);
 1414         pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
 1415 
 1416         protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
 1417         ieee80211_ack_rate(ic->ic_rt, rate);
 1418 
 1419         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
 1420         dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort)
 1421             + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
 1422         flags = RT2661_TX_MORE_FRAG;
 1423         if (prot == IEEE80211_PROT_RTSCTS) {
 1424                 /* NB: CTS is the same size as an ACK */
 1425                 dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
 1426                 flags |= RT2661_TX_NEED_ACK;
 1427                 mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
 1428         } else {
 1429                 mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
 1430         }
 1431         if (mprot == NULL) {
 1432                 /* XXX stat + msg */
 1433                 return ENOBUFS;
 1434         }
 1435 
 1436         data = &txq->data[txq->cur];
 1437         desc = &txq->desc[txq->cur];
 1438 
 1439         error = bus_dmamap_load_mbuf_segment(txq->data_dmat, data->map, mprot, segs,
 1440             1, &nsegs, BUS_DMA_NOWAIT);
 1441         if (error != 0) {
 1442                 device_printf(sc->sc_dev,
 1443                     "could not map mbuf (error %d)\n", error);
 1444                 m_freem(mprot);
 1445                 return error;
 1446         }
 1447 
 1448         data->m = mprot;
 1449         data->ni = ieee80211_ref_node(ni);
 1450         /* ctl frames are not taken into account for amrr */
 1451         data->rix = IEEE80211_FIXED_RATE_NONE;
 1452 
 1453         rt2661_setup_tx_desc(sc, desc, flags, 0, mprot->m_pkthdr.len,
 1454             protrate, segs, 1, ac);
 1455 
 1456         bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 1457         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
 1458 
 1459         txq->queued++;
 1460         txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1461 
 1462         return 0;
 1463 }
 1464 
 1465 static int
 1466 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 1467     struct ieee80211_node *ni, int ac)
 1468 {
 1469         struct ieee80211vap *vap = ni->ni_vap;
 1470         struct ifnet *ifp = sc->sc_ifp;
 1471         struct ieee80211com *ic = ifp->if_l2com;
 1472         struct rt2661_tx_ring *txq = &sc->txq[ac];
 1473         struct rt2661_tx_desc *desc;
 1474         struct rt2661_tx_data *data;
 1475         struct ieee80211_frame *wh;
 1476         const struct ieee80211_txparam *tp;
 1477         struct ieee80211_key *k;
 1478         const struct chanAccParams *cap;
 1479         struct mbuf *mnew;
 1480         bus_dma_segment_t segs[RT2661_MAX_SCATTER];
 1481         uint16_t dur;
 1482         uint32_t flags;
 1483         int error, nsegs, rate, noack = 0;
 1484 
 1485         wh = mtod(m0, struct ieee80211_frame *);
 1486 
 1487         tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
 1488         if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1489                 rate = tp->mcastrate;
 1490         } else if (m0->m_flags & M_EAPOL) {
 1491                 rate = tp->mgmtrate;
 1492         } else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
 1493                 rate = tp->ucastrate;
 1494         } else {
 1495                 ieee80211_ratectl_rate(ni, NULL, 0);
 1496                 rate = ni->ni_txrate;
 1497         }
 1498         rate &= IEEE80211_RATE_VAL;
 1499 
 1500         if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
 1501                 cap = &ic->ic_wme.wme_chanParams;
 1502                 noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
 1503         }
 1504 
 1505         if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
 1506                 k = ieee80211_crypto_encap(ni, m0);
 1507                 if (k == NULL) {
 1508                         m_freem(m0);
 1509                         return ENOBUFS;
 1510                 }
 1511 
 1512                 /* packet header may have moved, reset our local pointer */
 1513                 wh = mtod(m0, struct ieee80211_frame *);
 1514         }
 1515 
 1516         flags = 0;
 1517         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1518                 int prot = IEEE80211_PROT_NONE;
 1519                 if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
 1520                         prot = IEEE80211_PROT_RTSCTS;
 1521                 else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
 1522                     ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM)
 1523                         prot = ic->ic_protmode;
 1524                 if (prot != IEEE80211_PROT_NONE) {
 1525                         error = rt2661_sendprot(sc, ac, m0, ni, prot, rate);
 1526                         if (error) {
 1527                                 m_freem(m0);
 1528                                 return error;
 1529                         }
 1530                         flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS;
 1531                 }
 1532         }
 1533 
 1534         data = &txq->data[txq->cur];
 1535         desc = &txq->desc[txq->cur];
 1536 
 1537         error = bus_dmamap_load_mbuf_segment(txq->data_dmat, data->map, m0, segs,
 1538             1, &nsegs, BUS_DMA_NOWAIT);
 1539         if (error != 0 && error != EFBIG) {
 1540                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
 1541                     error);
 1542                 m_freem(m0);
 1543                 return error;
 1544         }
 1545         if (error != 0) {
 1546                 mnew = m_defrag(m0, MB_DONTWAIT);
 1547                 if (mnew == NULL) {
 1548                         device_printf(sc->sc_dev,
 1549                             "could not defragment mbuf\n");
 1550                         m_freem(m0);
 1551                         return ENOBUFS;
 1552                 }
 1553                 m0 = mnew;
 1554 
 1555                 error = bus_dmamap_load_mbuf_segment(txq->data_dmat, data->map, m0,
 1556                     segs, 1, &nsegs, BUS_DMA_NOWAIT);
 1557                 if (error != 0) {
 1558                         device_printf(sc->sc_dev,
 1559                             "could not map mbuf (error %d)\n", error);
 1560                         m_freem(m0);
 1561                         return error;
 1562                 }
 1563 
 1564                 /* packet header have moved, reset our local pointer */
 1565                 wh = mtod(m0, struct ieee80211_frame *);
 1566         }
 1567 
 1568         if (ieee80211_radiotap_active_vap(vap)) {
 1569                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1570 
 1571                 tap->wt_flags = 0;
 1572                 tap->wt_rate = rate;
 1573 
 1574                 ieee80211_radiotap_tx(vap, m0);
 1575         }
 1576 
 1577         data->m = m0;
 1578         data->ni = ni;
 1579 
 1580         /* remember link conditions for rate adaptation algorithm */
 1581         if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
 1582                 data->rix = ni->ni_txrate;
 1583                 /* XXX probably need last rssi value and not avg */
 1584                 data->rssi = ic->ic_node_getrssi(ni);
 1585         } else
 1586                 data->rix = IEEE80211_FIXED_RATE_NONE;
 1587 
 1588         if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1589                 flags |= RT2661_TX_NEED_ACK;
 1590 
 1591                 dur = ieee80211_ack_duration(ic->ic_rt,
 1592                     rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
 1593                 *(uint16_t *)wh->i_dur = htole16(dur);
 1594         }
 1595 
 1596         rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate, segs,
 1597             nsegs, ac);
 1598 
 1599         bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 1600         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
 1601 
 1602         DPRINTFN(sc, 10, "sending data frame len=%u idx=%u rate=%u\n",
 1603             m0->m_pkthdr.len, txq->cur, rate);
 1604 
 1605         /* kick Tx */
 1606         txq->queued++;
 1607         txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1608         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1 << ac);
 1609 
 1610         return 0;
 1611 }
 1612 
 1613 static void
 1614 rt2661_start_locked(struct ifnet *ifp)
 1615 {
 1616         struct rt2661_softc *sc = ifp->if_softc;
 1617         struct mbuf *m;
 1618         struct ieee80211_node *ni;
 1619         int ac;
 1620 
 1621         /* prevent management frames from being sent if we're not ready */
 1622         if (!(ifp->if_flags & IFF_RUNNING) || sc->sc_invalid)
 1623                 return;
 1624 
 1625         for (;;) {
 1626                 m = ifq_dequeue(&ifp->if_snd);
 1627                 if (m == NULL)
 1628                         break;
 1629 
 1630                 ac = M_WME_GETAC(m);
 1631                 if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
 1632                         /* there is no place left in this ring */
 1633                         ifq_prepend(&ifp->if_snd, m);
 1634                         ifq_set_oactive(&ifp->if_snd);
 1635                         break;
 1636                 }
 1637                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 1638                 if (rt2661_tx_data(sc, m, ni, ac) != 0) {
 1639                         ieee80211_free_node(ni);
 1640                         IFNET_STAT_INC(ifp, oerrors, 1);
 1641                         break;
 1642                 }
 1643 
 1644                 sc->sc_tx_timer = 5;
 1645         }
 1646 }
 1647 
 1648 static void
 1649 rt2661_start(struct ifnet *ifp, struct ifaltq_subque *ifsq)
 1650 {
 1651         ASSERT_ALTQ_SQ_DEFAULT(ifp, ifsq);
 1652         rt2661_start_locked(ifp);
 1653 }
 1654 
 1655 static int
 1656 rt2661_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1657         const struct ieee80211_bpf_params *params)
 1658 {
 1659         struct ieee80211com *ic = ni->ni_ic;
 1660         struct ifnet *ifp = ic->ic_ifp;
 1661         struct rt2661_softc *sc = ifp->if_softc;
 1662 
 1663         /* prevent management frames from being sent if we're not ready */
 1664         if (!(ifp->if_flags & IFF_RUNNING)) {
 1665                 m_freem(m);
 1666                 ieee80211_free_node(ni);
 1667                 return ENETDOWN;
 1668         }
 1669         if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
 1670                 ifq_set_oactive(&ifp->if_snd);
 1671                 m_freem(m);
 1672                 ieee80211_free_node(ni);
 1673                 return ENOBUFS;         /* XXX */
 1674         }
 1675 
 1676         IFNET_STAT_INC(ifp, opackets, 1);
 1677 
 1678         /*
 1679          * Legacy path; interpret frame contents to decide
 1680          * precisely how to send the frame.
 1681          * XXX raw path
 1682          */
 1683         if (rt2661_tx_mgt(sc, m, ni) != 0)
 1684                 goto bad;
 1685         sc->sc_tx_timer = 5;
 1686 
 1687         return 0;
 1688 bad:
 1689         IFNET_STAT_INC(ifp, oerrors, 1);
 1690         ieee80211_free_node(ni);
 1691         return EIO;             /* XXX */
 1692 }
 1693 
 1694 static void
 1695 rt2661_watchdog_callout(void *arg)
 1696 {
 1697         struct rt2661_softc *sc = (struct rt2661_softc *)arg;
 1698         struct ifnet *ifp = sc->sc_ifp;
 1699 
 1700         KASSERT(ifp->if_flags & IFF_RUNNING, ("not running"));
 1701 
 1702         if (sc->sc_invalid)             /* card ejected */
 1703                 return;
 1704 
 1705         if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
 1706                 if_printf(ifp, "device timeout\n");
 1707                 rt2661_init_locked(sc);
 1708                 IFNET_STAT_INC(ifp, oerrors, 1);
 1709                 /* NB: callout is reset in rt2661_init() */
 1710                 return;
 1711         }
 1712         callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog_callout, sc);
 1713 
 1714 }
 1715 
 1716 static int
 1717 rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *ucred)
 1718 {
 1719         struct rt2661_softc *sc = ifp->if_softc;
 1720         struct ieee80211com *ic = ifp->if_l2com;
 1721         struct ifreq *ifr = (struct ifreq *) data;
 1722         int error = 0, startall = 0;
 1723 
 1724         switch (cmd) {
 1725         case SIOCSIFFLAGS:
 1726                 if (ifp->if_flags & IFF_UP) {
 1727                         if ((ifp->if_flags & IFF_RUNNING) == 0) {
 1728                                 rt2661_init_locked(sc);
 1729                                 startall = 1;
 1730                         } else
 1731                                 rt2661_update_promisc(ifp);
 1732                 } else {
 1733                         if (ifp->if_flags & IFF_RUNNING)
 1734                                 rt2661_stop_locked(sc);
 1735                 }
 1736                 if (startall)
 1737                         ieee80211_start_all(ic);
 1738                 break;
 1739         case SIOCGIFMEDIA:
 1740                 error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
 1741                 break;
 1742         case SIOCGIFADDR:
 1743                 error = ether_ioctl(ifp, cmd, data);
 1744                 break;
 1745         default:
 1746                 error = EINVAL;
 1747                 break;
 1748         }
 1749         return error;
 1750 }
 1751 
 1752 static void
 1753 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
 1754 {
 1755         uint32_t tmp;
 1756         int ntries;
 1757 
 1758         for (ntries = 0; ntries < 100; ntries++) {
 1759                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 1760                         break;
 1761                 DELAY(1);
 1762         }
 1763         if (ntries == 100) {
 1764                 device_printf(sc->sc_dev, "could not write to BBP\n");
 1765                 return;
 1766         }
 1767 
 1768         tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
 1769         RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
 1770 
 1771         DPRINTFN(sc, 15, "BBP R%u <- 0x%02x\n", reg, val);
 1772 }
 1773 
 1774 static uint8_t
 1775 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
 1776 {
 1777         uint32_t val;
 1778         int ntries;
 1779 
 1780         for (ntries = 0; ntries < 100; ntries++) {
 1781                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 1782                         break;
 1783                 DELAY(1);
 1784         }
 1785         if (ntries == 100) {
 1786                 device_printf(sc->sc_dev, "could not read from BBP\n");
 1787                 return 0;
 1788         }
 1789 
 1790         val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
 1791         RAL_WRITE(sc, RT2661_PHY_CSR3, val);
 1792 
 1793         for (ntries = 0; ntries < 100; ntries++) {
 1794                 val = RAL_READ(sc, RT2661_PHY_CSR3);
 1795                 if (!(val & RT2661_BBP_BUSY))
 1796                         return val & 0xff;
 1797                 DELAY(1);
 1798         }
 1799 
 1800         device_printf(sc->sc_dev, "could not read from BBP\n");
 1801         return 0;
 1802 }
 1803 
 1804 static void
 1805 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
 1806 {
 1807         uint32_t tmp;
 1808         int ntries;
 1809 
 1810         for (ntries = 0; ntries < 100; ntries++) {
 1811                 if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
 1812                         break;
 1813                 DELAY(1);
 1814         }
 1815         if (ntries == 100) {
 1816                 device_printf(sc->sc_dev, "could not write to RF\n");
 1817                 return;
 1818         }
 1819 
 1820         tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
 1821             (reg & 3);
 1822         RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
 1823 
 1824         /* remember last written value in sc */
 1825         sc->rf_regs[reg] = val;
 1826 
 1827         DPRINTFN(sc, 15, "RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff);
 1828 }
 1829 
 1830 static int
 1831 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
 1832 {
 1833         if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
 1834                 return EIO;     /* there is already a command pending */
 1835 
 1836         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
 1837             RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
 1838 
 1839         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
 1840 
 1841         return 0;
 1842 }
 1843 
 1844 static void
 1845 rt2661_select_antenna(struct rt2661_softc *sc)
 1846 {
 1847         uint8_t bbp4, bbp77;
 1848         uint32_t tmp;
 1849 
 1850         bbp4  = rt2661_bbp_read(sc,  4);
 1851         bbp77 = rt2661_bbp_read(sc, 77);
 1852 
 1853         /* TBD */
 1854 
 1855         /* make sure Rx is disabled before switching antenna */
 1856         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 1857         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 1858 
 1859         rt2661_bbp_write(sc,  4, bbp4);
 1860         rt2661_bbp_write(sc, 77, bbp77);
 1861 
 1862         /* restore Rx filter */
 1863         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 1864 }
 1865 
 1866 /*
 1867  * Enable multi-rate retries for frames sent at OFDM rates.
 1868  * In 802.11b/g mode, allow fallback to CCK rates.
 1869  */
 1870 static void
 1871 rt2661_enable_mrr(struct rt2661_softc *sc)
 1872 {
 1873         struct ifnet *ifp = sc->sc_ifp;
 1874         struct ieee80211com *ic = ifp->if_l2com;
 1875         uint32_t tmp;
 1876 
 1877         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 1878 
 1879         tmp &= ~RT2661_MRR_CCK_FALLBACK;
 1880         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan))
 1881                 tmp |= RT2661_MRR_CCK_FALLBACK;
 1882         tmp |= RT2661_MRR_ENABLED;
 1883 
 1884         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 1885 }
 1886 
 1887 static void
 1888 rt2661_set_txpreamble(struct rt2661_softc *sc)
 1889 {
 1890         struct ifnet *ifp = sc->sc_ifp;
 1891         struct ieee80211com *ic = ifp->if_l2com;
 1892         uint32_t tmp;
 1893 
 1894         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 1895 
 1896         tmp &= ~RT2661_SHORT_PREAMBLE;
 1897         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
 1898                 tmp |= RT2661_SHORT_PREAMBLE;
 1899 
 1900         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 1901 }
 1902 
 1903 static void
 1904 rt2661_set_basicrates(struct rt2661_softc *sc,
 1905     const struct ieee80211_rateset *rs)
 1906 {
 1907 #define RV(r)   ((r) & IEEE80211_RATE_VAL)
 1908         struct ifnet *ifp = sc->sc_ifp;
 1909         struct ieee80211com *ic = ifp->if_l2com;
 1910         uint32_t mask = 0;
 1911         uint8_t rate;
 1912         int i, j;
 1913 
 1914         for (i = 0; i < rs->rs_nrates; i++) {
 1915                 rate = rs->rs_rates[i];
 1916 
 1917                 if (!(rate & IEEE80211_RATE_BASIC))
 1918                         continue;
 1919 
 1920                 /*
 1921                  * Find h/w rate index.  We know it exists because the rate
 1922                  * set has already been negotiated.
 1923                  */
 1924                 for (j = 0; ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates[j] != RV(rate); j++);
 1925 
 1926                 mask |= 1 << j;
 1927         }
 1928 
 1929         RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
 1930 
 1931         DPRINTF(sc, "Setting basic rate mask to 0x%x\n", mask);
 1932 #undef RV
 1933 }
 1934 
 1935 /*
 1936  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
 1937  * driver.
 1938  */
 1939 static void
 1940 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
 1941 {
 1942         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
 1943         uint32_t tmp;
 1944 
 1945         /* update all BBP registers that depend on the band */
 1946         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
 1947         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
 1948         if (IEEE80211_IS_CHAN_5GHZ(c)) {
 1949                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
 1950                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
 1951         }
 1952         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 1953             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 1954                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
 1955         }
 1956 
 1957         rt2661_bbp_write(sc,  17, bbp17);
 1958         rt2661_bbp_write(sc,  96, bbp96);
 1959         rt2661_bbp_write(sc, 104, bbp104);
 1960 
 1961         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 1962             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 1963                 rt2661_bbp_write(sc, 75, 0x80);
 1964                 rt2661_bbp_write(sc, 86, 0x80);
 1965                 rt2661_bbp_write(sc, 88, 0x80);
 1966         }
 1967 
 1968         rt2661_bbp_write(sc, 35, bbp35);
 1969         rt2661_bbp_write(sc, 97, bbp97);
 1970         rt2661_bbp_write(sc, 98, bbp98);
 1971 
 1972         tmp = RAL_READ(sc, RT2661_PHY_CSR0);
 1973         tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
 1974         if (IEEE80211_IS_CHAN_2GHZ(c))
 1975                 tmp |= RT2661_PA_PE_2GHZ;
 1976         else
 1977                 tmp |= RT2661_PA_PE_5GHZ;
 1978         RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
 1979 }
 1980 
 1981 static void
 1982 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
 1983 {
 1984         struct ifnet *ifp = sc->sc_ifp;
 1985         struct ieee80211com *ic = ifp->if_l2com;
 1986         const struct rfprog *rfprog;
 1987         uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
 1988         int8_t power;
 1989         u_int i, chan;
 1990 
 1991         chan = ieee80211_chan2ieee(ic, c);
 1992         KASSERT(chan != 0 && chan != IEEE80211_CHAN_ANY, ("chan 0x%x", chan));
 1993 
 1994         /* select the appropriate RF settings based on what EEPROM says */
 1995         rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
 1996 
 1997         /* find the settings for this channel (we know it exists) */
 1998         for (i = 0; rfprog[i].chan != chan; i++);
 1999 
 2000         power = sc->txpow[i];
 2001         if (power < 0) {
 2002                 bbp94 += power;
 2003                 power = 0;
 2004         } else if (power > 31) {
 2005                 bbp94 += power - 31;
 2006                 power = 31;
 2007         }
 2008 
 2009         /*
 2010          * If we are switching from the 2GHz band to the 5GHz band or
 2011          * vice-versa, BBP registers need to be reprogrammed.
 2012          */
 2013         if (c->ic_flags != sc->sc_curchan->ic_flags) {
 2014                 rt2661_select_band(sc, c);
 2015                 rt2661_select_antenna(sc);
 2016         }
 2017         sc->sc_curchan = c;
 2018 
 2019         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2020         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2021         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 2022         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2023 
 2024         DELAY(200);
 2025 
 2026         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2027         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2028         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
 2029         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2030 
 2031         DELAY(200);
 2032 
 2033         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 2034         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 2035         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 2036         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 2037 
 2038         /* enable smart mode for MIMO-capable RFs */
 2039         bbp3 = rt2661_bbp_read(sc, 3);
 2040 
 2041         bbp3 &= ~RT2661_SMART_MODE;
 2042         if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
 2043                 bbp3 |= RT2661_SMART_MODE;
 2044 
 2045         rt2661_bbp_write(sc, 3, bbp3);
 2046 
 2047         if (bbp94 != RT2661_BBPR94_DEFAULT)
 2048                 rt2661_bbp_write(sc, 94, bbp94);
 2049 
 2050         /* 5GHz radio needs a 1ms delay here */
 2051         if (IEEE80211_IS_CHAN_5GHZ(c))
 2052                 DELAY(1000);
 2053 }
 2054 
 2055 static void
 2056 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
 2057 {
 2058         uint32_t tmp;
 2059 
 2060         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
 2061         RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
 2062 
 2063         tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
 2064         RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
 2065 }
 2066 
 2067 static void
 2068 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
 2069 {
 2070         uint32_t tmp;
 2071 
 2072         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
 2073         RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
 2074 
 2075         tmp = addr[4] | addr[5] << 8;
 2076         RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
 2077 }
 2078 
 2079 static void
 2080 rt2661_update_promisc(struct ifnet *ifp)
 2081 {
 2082         struct rt2661_softc *sc = ifp->if_softc;
 2083         uint32_t tmp;
 2084 
 2085         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2086 
 2087         tmp &= ~RT2661_DROP_NOT_TO_ME;
 2088         if (!(ifp->if_flags & IFF_PROMISC))
 2089                 tmp |= RT2661_DROP_NOT_TO_ME;
 2090 
 2091         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2092 
 2093         DPRINTF(sc, "%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
 2094             "entering" : "leaving");
 2095 }
 2096 
 2097 /*
 2098  * Update QoS (802.11e) settings for each h/w Tx ring.
 2099  */
 2100 static int
 2101 rt2661_wme_update(struct ieee80211com *ic)
 2102 {
 2103         struct rt2661_softc *sc = ic->ic_ifp->if_softc;
 2104         const struct wmeParams *wmep;
 2105 
 2106         wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
 2107 
 2108         /* XXX: not sure about shifts. */
 2109         /* XXX: the reference driver plays with AC_VI settings too. */
 2110 
 2111         /* update TxOp */
 2112         RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
 2113             wmep[WME_AC_BE].wmep_txopLimit << 16 |
 2114             wmep[WME_AC_BK].wmep_txopLimit);
 2115         RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
 2116             wmep[WME_AC_VI].wmep_txopLimit << 16 |
 2117             wmep[WME_AC_VO].wmep_txopLimit);
 2118 
 2119         /* update CWmin */
 2120         RAL_WRITE(sc, RT2661_CWMIN_CSR,
 2121             wmep[WME_AC_BE].wmep_logcwmin << 12 |
 2122             wmep[WME_AC_BK].wmep_logcwmin <<  8 |
 2123             wmep[WME_AC_VI].wmep_logcwmin <<  4 |
 2124             wmep[WME_AC_VO].wmep_logcwmin);
 2125 
 2126         /* update CWmax */
 2127         RAL_WRITE(sc, RT2661_CWMAX_CSR,
 2128             wmep[WME_AC_BE].wmep_logcwmax << 12 |
 2129             wmep[WME_AC_BK].wmep_logcwmax <<  8 |
 2130             wmep[WME_AC_VI].wmep_logcwmax <<  4 |
 2131             wmep[WME_AC_VO].wmep_logcwmax);
 2132 
 2133         /* update Aifsn */
 2134         RAL_WRITE(sc, RT2661_AIFSN_CSR,
 2135             wmep[WME_AC_BE].wmep_aifsn << 12 |
 2136             wmep[WME_AC_BK].wmep_aifsn <<  8 |
 2137             wmep[WME_AC_VI].wmep_aifsn <<  4 |
 2138             wmep[WME_AC_VO].wmep_aifsn);
 2139 
 2140         return 0;
 2141 }
 2142 
 2143 static void
 2144 rt2661_update_slot(struct ifnet *ifp)
 2145 {
 2146         struct rt2661_softc *sc = ifp->if_softc;
 2147         struct ieee80211com *ic = ifp->if_l2com;
 2148         uint8_t slottime;
 2149         uint32_t tmp;
 2150 
 2151         slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
 2152 
 2153         tmp = RAL_READ(sc, RT2661_MAC_CSR9);
 2154         tmp = (tmp & ~0xff) | slottime;
 2155         RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
 2156 }
 2157 
 2158 static const char *
 2159 rt2661_get_rf(int rev)
 2160 {
 2161         switch (rev) {
 2162         case RT2661_RF_5225:    return "RT5225";
 2163         case RT2661_RF_5325:    return "RT5325 (MIMO XR)";
 2164         case RT2661_RF_2527:    return "RT2527";
 2165         case RT2661_RF_2529:    return "RT2529 (MIMO XR)";
 2166         default:                return "unknown";
 2167         }
 2168 }
 2169 
 2170 static void
 2171 rt2661_read_eeprom(struct rt2661_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
 2172 {
 2173         uint16_t val;
 2174         int i;
 2175 
 2176         /* read MAC address */
 2177         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
 2178         macaddr[0] = val & 0xff;
 2179         macaddr[1] = val >> 8;
 2180 
 2181         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
 2182         macaddr[2] = val & 0xff;
 2183         macaddr[3] = val >> 8;
 2184 
 2185         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
 2186         macaddr[4] = val & 0xff;
 2187         macaddr[5] = val >> 8;
 2188 
 2189         val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
 2190         /* XXX: test if different from 0xffff? */
 2191         sc->rf_rev   = (val >> 11) & 0x1f;
 2192         sc->hw_radio = (val >> 10) & 0x1;
 2193         sc->rx_ant   = (val >> 4)  & 0x3;
 2194         sc->tx_ant   = (val >> 2)  & 0x3;
 2195         sc->nb_ant   = val & 0x3;
 2196 
 2197         DPRINTF(sc, "RF revision=%d\n", sc->rf_rev);
 2198 
 2199         val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
 2200         sc->ext_5ghz_lna = (val >> 6) & 0x1;
 2201         sc->ext_2ghz_lna = (val >> 4) & 0x1;
 2202 
 2203         DPRINTF(sc, "External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
 2204             sc->ext_2ghz_lna, sc->ext_5ghz_lna);
 2205 
 2206         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
 2207         if ((val & 0xff) != 0xff)
 2208                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2209 
 2210         /* Only [-10, 10] is valid */
 2211         if (sc->rssi_2ghz_corr < -10 || sc->rssi_2ghz_corr > 10)
 2212                 sc->rssi_2ghz_corr = 0;
 2213 
 2214         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
 2215         if ((val & 0xff) != 0xff)
 2216                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2217 
 2218         /* Only [-10, 10] is valid */
 2219         if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
 2220                 sc->rssi_5ghz_corr = 0;
 2221 
 2222         /* adjust RSSI correction for external low-noise amplifier */
 2223         if (sc->ext_2ghz_lna)
 2224                 sc->rssi_2ghz_corr -= 14;
 2225         if (sc->ext_5ghz_lna)
 2226                 sc->rssi_5ghz_corr -= 14;
 2227 
 2228         DPRINTF(sc, "RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
 2229             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr);
 2230 
 2231         val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
 2232         if ((val >> 8) != 0xff)
 2233                 sc->rfprog = (val >> 8) & 0x3;
 2234         if ((val & 0xff) != 0xff)
 2235                 sc->rffreq = val & 0xff;
 2236 
 2237         DPRINTF(sc, "RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq);
 2238 
 2239         /* read Tx power for all a/b/g channels */
 2240         for (i = 0; i < 19; i++) {
 2241                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
 2242                 sc->txpow[i * 2] = (int8_t)(val >> 8);          /* signed */
 2243                 DPRINTF(sc, "Channel=%d Tx power=%d\n",
 2244                     rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]);
 2245                 sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);    /* signed */
 2246                 DPRINTF(sc, "Channel=%d Tx power=%d\n",
 2247                     rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]);
 2248         }
 2249 
 2250         /* read vendor-specific BBP values */
 2251         for (i = 0; i < 16; i++) {
 2252                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
 2253                 if (val == 0 || val == 0xffff)
 2254                         continue;       /* skip invalid entries */
 2255                 sc->bbp_prom[i].reg = val >> 8;
 2256                 sc->bbp_prom[i].val = val & 0xff;
 2257                 DPRINTF(sc, "BBP R%d=%02x\n", sc->bbp_prom[i].reg,
 2258                     sc->bbp_prom[i].val);
 2259         }
 2260 }
 2261 
 2262 static int
 2263 rt2661_bbp_init(struct rt2661_softc *sc)
 2264 {
 2265 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
 2266         int i, ntries;
 2267         uint8_t val;
 2268 
 2269         /* wait for BBP to be ready */
 2270         for (ntries = 0; ntries < 100; ntries++) {
 2271                 val = rt2661_bbp_read(sc, 0);
 2272                 if (val != 0 && val != 0xff)
 2273                         break;
 2274                 DELAY(100);
 2275         }
 2276         if (ntries == 100) {
 2277                 device_printf(sc->sc_dev, "timeout waiting for BBP\n");
 2278                 return EIO;
 2279         }
 2280 
 2281         /* initialize BBP registers to default values */
 2282         for (i = 0; i < N(rt2661_def_bbp); i++) {
 2283                 rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
 2284                     rt2661_def_bbp[i].val);
 2285         }
 2286 
 2287         /* write vendor-specific BBP values (from EEPROM) */
 2288         for (i = 0; i < 16; i++) {
 2289                 if (sc->bbp_prom[i].reg == 0)
 2290                         continue;
 2291                 rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
 2292         }
 2293 
 2294         return 0;
 2295 #undef N
 2296 }
 2297 
 2298 static void
 2299 rt2661_init_locked(struct rt2661_softc *sc)
 2300 {
 2301 #define N(a)    (sizeof (a) / sizeof ((a)[0]))
 2302         struct ifnet *ifp = sc->sc_ifp;
 2303         struct ieee80211com *ic = ifp->if_l2com;
 2304         uint32_t tmp, sta[3];
 2305         int i, error, ntries;
 2306 
 2307         if ((sc->sc_flags & RAL_FW_LOADED) == 0) {
 2308                 error = rt2661_load_microcode(sc);
 2309                 if (error != 0) {
 2310                         if_printf(ifp,
 2311                             "%s: could not load 8051 microcode, error %d\n",
 2312                             __func__, error);
 2313                         return;
 2314                 }
 2315                 sc->sc_flags |= RAL_FW_LOADED;
 2316         }
 2317 
 2318         rt2661_stop_locked(sc);
 2319 
 2320         /* initialize Tx rings */
 2321         RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
 2322         RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
 2323         RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
 2324         RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
 2325 
 2326         /* initialize Mgt ring */
 2327         RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
 2328 
 2329         /* initialize Rx ring */
 2330         RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
 2331 
 2332         /* initialize Tx rings sizes */
 2333         RAL_WRITE(sc, RT2661_TX_RING_CSR0,
 2334             RT2661_TX_RING_COUNT << 24 |
 2335             RT2661_TX_RING_COUNT << 16 |
 2336             RT2661_TX_RING_COUNT <<  8 |
 2337             RT2661_TX_RING_COUNT);
 2338 
 2339         RAL_WRITE(sc, RT2661_TX_RING_CSR1,
 2340             RT2661_TX_DESC_WSIZE << 16 |
 2341             RT2661_TX_RING_COUNT <<  8 |        /* XXX: HCCA ring unused */
 2342             RT2661_MGT_RING_COUNT);
 2343 
 2344         /* initialize Rx rings */
 2345         RAL_WRITE(sc, RT2661_RX_RING_CSR,
 2346             RT2661_RX_DESC_BACK  << 16 |
 2347             RT2661_RX_DESC_WSIZE <<  8 |
 2348             RT2661_RX_RING_COUNT);
 2349 
 2350         /* XXX: some magic here */
 2351         RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
 2352 
 2353         /* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
 2354         RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
 2355 
 2356         /* load base address of Rx ring */
 2357         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
 2358 
 2359         /* initialize MAC registers to default values */
 2360         for (i = 0; i < N(rt2661_def_mac); i++)
 2361                 RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
 2362 
 2363         rt2661_set_macaddr(sc, IF_LLADDR(ifp));
 2364 
 2365         /* set host ready */
 2366         RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2367         RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2368 
 2369         /* wait for BBP/RF to wakeup */
 2370         for (ntries = 0; ntries < 1000; ntries++) {
 2371                 if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
 2372                         break;
 2373                 DELAY(1000);
 2374         }
 2375         if (ntries == 1000) {
 2376                 kprintf("timeout waiting for BBP/RF to wakeup\n");
 2377                 rt2661_stop_locked(sc);
 2378                 return;
 2379         }
 2380 
 2381         if (rt2661_bbp_init(sc) != 0) {
 2382                 rt2661_stop_locked(sc);
 2383                 return;
 2384         }
 2385 
 2386         /* select default channel */
 2387         sc->sc_curchan = ic->ic_curchan;
 2388         rt2661_select_band(sc, sc->sc_curchan);
 2389         rt2661_select_antenna(sc);
 2390         rt2661_set_chan(sc, sc->sc_curchan);
 2391 
 2392         /* update Rx filter */
 2393         tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
 2394 
 2395         tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
 2396         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 2397                 tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
 2398                        RT2661_DROP_ACKCTS;
 2399                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
 2400                     ic->ic_opmode != IEEE80211_M_MBSS)
 2401                         tmp |= RT2661_DROP_TODS;
 2402                 if (!(ifp->if_flags & IFF_PROMISC))
 2403                         tmp |= RT2661_DROP_NOT_TO_ME;
 2404         }
 2405 
 2406         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2407 
 2408         /* clear STA registers */
 2409         RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
 2410 
 2411         /* initialize ASIC */
 2412         RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
 2413 
 2414         /* clear any pending interrupt */
 2415         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2416 
 2417         /* enable interrupts */
 2418         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 2419         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 2420 
 2421         /* kick Rx */
 2422         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
 2423 
 2424         ifq_clr_oactive(&ifp->if_snd);
 2425         ifp->if_flags |= IFF_RUNNING;
 2426 
 2427         callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog_callout, sc);
 2428 #undef N
 2429 }
 2430 
 2431 static void
 2432 rt2661_init(void *priv)
 2433 {
 2434         struct rt2661_softc *sc = priv;
 2435         struct ifnet *ifp = sc->sc_ifp;
 2436         struct ieee80211com *ic = ifp->if_l2com;
 2437 
 2438         rt2661_init_locked(sc);
 2439 
 2440         if (ifp->if_flags & IFF_RUNNING)
 2441                 ieee80211_start_all(ic);                /* start all vap's */
 2442 }
 2443 
 2444 void
 2445 rt2661_stop_locked(struct rt2661_softc *sc)
 2446 {
 2447         struct ifnet *ifp = sc->sc_ifp;
 2448         uint32_t tmp;
 2449         volatile int *flags = &sc->sc_flags;
 2450 
 2451         while (*flags & RAL_INPUT_RUNNING)
 2452                 zsleep(sc, &wlan_global_serializer, 0, "ralrunning", hz/10);
 2453 
 2454         callout_stop(&sc->watchdog_ch);
 2455         sc->sc_tx_timer = 0;
 2456 
 2457         if (ifp->if_flags & IFF_RUNNING) {
 2458                 ifp->if_flags &= ~IFF_RUNNING;
 2459                 ifq_clr_oactive(&ifp->if_snd);
 2460 
 2461                 /* abort Tx (for all 5 Tx rings) */
 2462                 RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
 2463                 
 2464                 /* disable Rx (value remains after reset!) */
 2465                 tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2466                 RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2467                 
 2468                 /* reset ASIC */
 2469                 RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2470                 RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2471                 
 2472                 /* disable interrupts */
 2473                 RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffffff);
 2474                 RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 2475                 
 2476                 /* clear any pending interrupt */
 2477                 RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2478                 RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
 2479                 
 2480                 /* reset Tx and Rx rings */
 2481                 rt2661_reset_tx_ring(sc, &sc->txq[0]);
 2482                 rt2661_reset_tx_ring(sc, &sc->txq[1]);
 2483                 rt2661_reset_tx_ring(sc, &sc->txq[2]);
 2484                 rt2661_reset_tx_ring(sc, &sc->txq[3]);
 2485                 rt2661_reset_tx_ring(sc, &sc->mgtq);
 2486                 rt2661_reset_rx_ring(sc, &sc->rxq);
 2487         }
 2488 }
 2489 
 2490 void
 2491 rt2661_stop(void *priv)
 2492 {
 2493         struct rt2661_softc *sc = priv;
 2494 
 2495         rt2661_stop_locked(sc);
 2496 }
 2497 
 2498 static int
 2499 rt2661_load_microcode(struct rt2661_softc *sc)
 2500 {
 2501         struct ifnet *ifp = sc->sc_ifp;
 2502         const struct firmware *fp;
 2503         const char *imagename;
 2504         int ntries, error;
 2505 
 2506         switch (sc->sc_id) {
 2507         case 0x0301: imagename = "rt2561sfw"; break;
 2508         case 0x0302: imagename = "rt2561fw"; break;
 2509         case 0x0401: imagename = "rt2661fw"; break;
 2510         default:
 2511                 if_printf(ifp, "%s: unexpected pci device id 0x%x, "
 2512                     "don't know how to retrieve firmware\n",
 2513                     __func__, sc->sc_id);
 2514                 return EINVAL;
 2515         }
 2516 
 2517         wlan_assert_serialized();
 2518         wlan_serialize_exit();
 2519         fp = firmware_get(imagename);
 2520         wlan_serialize_enter();
 2521 
 2522         if (fp == NULL) {
 2523                 if_printf(ifp, "%s: unable to retrieve firmware image %s\n",
 2524                     __func__, imagename);
 2525                 return EINVAL;
 2526         }
 2527 
 2528         /*
 2529          * Load 8051 microcode into NIC.
 2530          */
 2531         /* reset 8051 */
 2532         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2533 
 2534         /* cancel any pending Host to MCU command */
 2535         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
 2536         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 2537         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
 2538 
 2539         /* write 8051's microcode */
 2540         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
 2541         RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, fp->data, fp->datasize);
 2542         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2543 
 2544         /* kick 8051's ass */
 2545         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
 2546 
 2547         /* wait for 8051 to initialize */
 2548         for (ntries = 0; ntries < 500; ntries++) {
 2549                 if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
 2550                         break;
 2551                 DELAY(100);
 2552         }
 2553         if (ntries == 500) {
 2554                 if_printf(ifp, "%s: timeout waiting for MCU to initialize\n",
 2555                     __func__);
 2556                 error = EIO;
 2557         } else
 2558                 error = 0;
 2559 
 2560         firmware_put(fp, FIRMWARE_UNLOAD);
 2561         return error;
 2562 }
 2563 
 2564 #ifdef notyet
 2565 /*
 2566  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
 2567  * false CCA count.  This function is called periodically (every seconds) when
 2568  * in the RUN state.  Values taken from the reference driver.
 2569  */
 2570 static void
 2571 rt2661_rx_tune(struct rt2661_softc *sc)
 2572 {
 2573         uint8_t bbp17;
 2574         uint16_t cca;
 2575         int lo, hi, dbm;
 2576 
 2577         /*
 2578          * Tuning range depends on operating band and on the presence of an
 2579          * external low-noise amplifier.
 2580          */
 2581         lo = 0x20;
 2582         if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
 2583                 lo += 0x08;
 2584         if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
 2585             (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
 2586                 lo += 0x10;
 2587         hi = lo + 0x20;
 2588 
 2589         /* retrieve false CCA count since last call (clear on read) */
 2590         cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
 2591 
 2592         if (dbm >= -35) {
 2593                 bbp17 = 0x60;
 2594         } else if (dbm >= -58) {
 2595                 bbp17 = hi;
 2596         } else if (dbm >= -66) {
 2597                 bbp17 = lo + 0x10;
 2598         } else if (dbm >= -74) {
 2599                 bbp17 = lo + 0x08;
 2600         } else {
 2601                 /* RSSI < -74dBm, tune using false CCA count */
 2602 
 2603                 bbp17 = sc->bbp17; /* current value */
 2604 
 2605                 hi -= 2 * (-74 - dbm);
 2606                 if (hi < lo)
 2607                         hi = lo;
 2608 
 2609                 if (bbp17 > hi) {
 2610                         bbp17 = hi;
 2611 
 2612                 } else if (cca > 512) {
 2613                         if (++bbp17 > hi)
 2614                                 bbp17 = hi;
 2615                 } else if (cca < 100) {
 2616                         if (--bbp17 < lo)
 2617                                 bbp17 = lo;
 2618                 }
 2619         }
 2620 
 2621         if (bbp17 != sc->bbp17) {
 2622                 rt2661_bbp_write(sc, 17, bbp17);
 2623                 sc->bbp17 = bbp17;
 2624         }
 2625 }
 2626 
 2627 /*
 2628  * Enter/Leave radar detection mode.
 2629  * This is for 802.11h additional regulatory domains.
 2630  */
 2631 static void
 2632 rt2661_radar_start(struct rt2661_softc *sc)
 2633 {
 2634         uint32_t tmp;
 2635 
 2636         /* disable Rx */
 2637         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2638         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2639 
 2640         rt2661_bbp_write(sc, 82, 0x20);
 2641         rt2661_bbp_write(sc, 83, 0x00);
 2642         rt2661_bbp_write(sc, 84, 0x40);
 2643 
 2644         /* save current BBP registers values */
 2645         sc->bbp18 = rt2661_bbp_read(sc, 18);
 2646         sc->bbp21 = rt2661_bbp_read(sc, 21);
 2647         sc->bbp22 = rt2661_bbp_read(sc, 22);
 2648         sc->bbp16 = rt2661_bbp_read(sc, 16);
 2649         sc->bbp17 = rt2661_bbp_read(sc, 17);
 2650         sc->bbp64 = rt2661_bbp_read(sc, 64);
 2651 
 2652         rt2661_bbp_write(sc, 18, 0xff);
 2653         rt2661_bbp_write(sc, 21, 0x3f);
 2654         rt2661_bbp_write(sc, 22, 0x3f);
 2655         rt2661_bbp_write(sc, 16, 0xbd);
 2656         rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
 2657         rt2661_bbp_write(sc, 64, 0x21);
 2658 
 2659         /* restore Rx filter */
 2660         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2661 }
 2662 
 2663 static int
 2664 rt2661_radar_stop(struct rt2661_softc *sc)
 2665 {
 2666         uint8_t bbp66;
 2667 
 2668         /* read radar detection result */
 2669         bbp66 = rt2661_bbp_read(sc, 66);
 2670 
 2671         /* restore BBP registers values */
 2672         rt2661_bbp_write(sc, 16, sc->bbp16);
 2673         rt2661_bbp_write(sc, 17, sc->bbp17);
 2674         rt2661_bbp_write(sc, 18, sc->bbp18);
 2675         rt2661_bbp_write(sc, 21, sc->bbp21);
 2676         rt2661_bbp_write(sc, 22, sc->bbp22);
 2677         rt2661_bbp_write(sc, 64, sc->bbp64);
 2678 
 2679         return bbp66 == 1;
 2680 }
 2681 #endif
 2682 
 2683 static int
 2684 rt2661_prepare_beacon(struct rt2661_softc *sc, struct ieee80211vap *vap)
 2685 {
 2686         struct ieee80211com *ic = vap->iv_ic;
 2687         struct ieee80211_beacon_offsets bo;
 2688         struct rt2661_tx_desc desc;
 2689         struct mbuf *m0;
 2690         int rate;
 2691 
 2692         m0 = ieee80211_beacon_alloc(vap->iv_bss, &bo);
 2693         if (m0 == NULL) {
 2694                 device_printf(sc->sc_dev, "could not allocate beacon frame\n");
 2695                 return ENOBUFS;
 2696         }
 2697 
 2698         /* send beacons at the lowest available rate */
 2699         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan) ? 12 : 2;
 2700 
 2701         rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
 2702             m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
 2703 
 2704         /* copy the first 24 bytes of Tx descriptor into NIC memory */
 2705         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
 2706 
 2707         /* copy beacon header and payload into NIC memory */
 2708         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
 2709             mtod(m0, uint8_t *), m0->m_pkthdr.len);
 2710 
 2711         m_freem(m0);
 2712 
 2713         return 0;
 2714 }
 2715 
 2716 /*
 2717  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
 2718  * and HostAP operating modes.
 2719  */
 2720 static void
 2721 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
 2722 {
 2723         struct ifnet *ifp = sc->sc_ifp;
 2724         struct ieee80211com *ic = ifp->if_l2com;
 2725         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 2726         uint32_t tmp;
 2727 
 2728         if (vap->iv_opmode != IEEE80211_M_STA) {
 2729                 /*
 2730                  * Change default 16ms TBTT adjustment to 8ms.
 2731                  * Must be done before enabling beacon generation.
 2732                  */
 2733                 RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
 2734         }
 2735 
 2736         tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
 2737 
 2738         /* set beacon interval (in 1/16ms unit) */
 2739         tmp |= vap->iv_bss->ni_intval * 16;
 2740 
 2741         tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
 2742         if (vap->iv_opmode == IEEE80211_M_STA)
 2743                 tmp |= RT2661_TSF_MODE(1);
 2744         else
 2745                 tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
 2746 
 2747         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
 2748 }
 2749 
 2750 static void
 2751 rt2661_enable_tsf(struct rt2661_softc *sc)
 2752 {
 2753         RAL_WRITE(sc, RT2661_TXRX_CSR9, 
 2754               (RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000)
 2755             | RT2661_TSF_TICKING | RT2661_TSF_MODE(2));
 2756 }
 2757 
 2758 /*
 2759  * Retrieve the "Received Signal Strength Indicator" from the raw values
 2760  * contained in Rx descriptors.  The computation depends on which band the
 2761  * frame was received.  Correction values taken from the reference driver.
 2762  */
 2763 static int
 2764 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
 2765 {
 2766         int lna, agc, rssi;
 2767 
 2768         lna = (raw >> 5) & 0x3;
 2769         agc = raw & 0x1f;
 2770 
 2771         if (lna == 0) {
 2772                 /*
 2773                  * No mapping available.
 2774                  *
 2775                  * NB: Since RSSI is relative to noise floor, -1 is
 2776                  *     adequate for caller to know error happened.
 2777                  */
 2778                 return -1;
 2779         }
 2780 
 2781         rssi = (2 * agc) - RT2661_NOISE_FLOOR;
 2782 
 2783         if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
 2784                 rssi += sc->rssi_2ghz_corr;
 2785 
 2786                 if (lna == 1)
 2787                         rssi -= 64;
 2788                 else if (lna == 2)
 2789                         rssi -= 74;
 2790                 else if (lna == 3)
 2791                         rssi -= 90;
 2792         } else {
 2793                 rssi += sc->rssi_5ghz_corr;
 2794 
 2795                 if (lna == 1)
 2796                         rssi -= 64;
 2797                 else if (lna == 2)
 2798                         rssi -= 86;
 2799                 else if (lna == 3)
 2800                         rssi -= 100;
 2801         }
 2802         return rssi;
 2803 }
 2804 
 2805 static void
 2806 rt2661_scan_start(struct ieee80211com *ic)
 2807 {
 2808         struct ifnet *ifp = ic->ic_ifp;
 2809         struct rt2661_softc *sc = ifp->if_softc;
 2810         uint32_t tmp;
 2811 
 2812         /* abort TSF synchronization */
 2813         tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
 2814         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0xffffff);
 2815         rt2661_set_bssid(sc, ifp->if_broadcastaddr);
 2816 }
 2817 
 2818 static void
 2819 rt2661_scan_end(struct ieee80211com *ic)
 2820 {
 2821         struct ifnet *ifp = ic->ic_ifp;
 2822         struct rt2661_softc *sc = ifp->if_softc;
 2823         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 2824 
 2825         rt2661_enable_tsf_sync(sc);
 2826         /* XXX keep local copy */
 2827         rt2661_set_bssid(sc, vap->iv_bss->ni_bssid);
 2828 }
 2829 
 2830 static void
 2831 rt2661_set_channel(struct ieee80211com *ic)
 2832 {
 2833         struct ifnet *ifp = ic->ic_ifp;
 2834         struct rt2661_softc *sc = ifp->if_softc;
 2835 
 2836         rt2661_set_chan(sc, ic->ic_curchan);
 2837 }

Cache object: a931ca45b1caecfe0ea7d8f7e571d59c


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.