The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/dev/ral/rt2661.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $FreeBSD: releng/11.0/sys/dev/ral/rt2661.c 300759 2016-05-26 17:06:43Z avos $   */
    2 
    3 /*-
    4  * Copyright (c) 2006
    5  *      Damien Bergamini <damien.bergamini@free.fr>
    6  *
    7  * Permission to use, copy, modify, and distribute this software for any
    8  * purpose with or without fee is hereby granted, provided that the above
    9  * copyright notice and this permission notice appear in all copies.
   10  *
   11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
   12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
   13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
   14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
   15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
   17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
   18  */
   19 
   20 #include <sys/cdefs.h>
   21 __FBSDID("$FreeBSD: releng/11.0/sys/dev/ral/rt2661.c 300759 2016-05-26 17:06:43Z avos $");
   22 
   23 /*-
   24  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
   25  * http://www.ralinktech.com/
   26  */
   27 
   28 #include <sys/param.h>
   29 #include <sys/sysctl.h>
   30 #include <sys/sockio.h>
   31 #include <sys/mbuf.h>
   32 #include <sys/kernel.h>
   33 #include <sys/socket.h>
   34 #include <sys/systm.h>
   35 #include <sys/malloc.h>
   36 #include <sys/lock.h>
   37 #include <sys/mutex.h>
   38 #include <sys/module.h>
   39 #include <sys/bus.h>
   40 #include <sys/endian.h>
   41 #include <sys/firmware.h>
   42 
   43 #include <machine/bus.h>
   44 #include <machine/resource.h>
   45 #include <sys/rman.h>
   46 
   47 #include <net/bpf.h>
   48 #include <net/if.h>
   49 #include <net/if_var.h>
   50 #include <net/if_arp.h>
   51 #include <net/ethernet.h>
   52 #include <net/if_dl.h>
   53 #include <net/if_media.h>
   54 #include <net/if_types.h>
   55 
   56 #include <net80211/ieee80211_var.h>
   57 #include <net80211/ieee80211_radiotap.h>
   58 #include <net80211/ieee80211_regdomain.h>
   59 #include <net80211/ieee80211_ratectl.h>
   60 
   61 #include <netinet/in.h>
   62 #include <netinet/in_systm.h>
   63 #include <netinet/in_var.h>
   64 #include <netinet/ip.h>
   65 #include <netinet/if_ether.h>
   66 
   67 #include <dev/ral/rt2661reg.h>
   68 #include <dev/ral/rt2661var.h>
   69 
   70 #define RAL_DEBUG
   71 #ifdef RAL_DEBUG
   72 #define DPRINTF(sc, fmt, ...) do {                              \
   73         if (sc->sc_debug > 0)                                   \
   74                 printf(fmt, __VA_ARGS__);                       \
   75 } while (0)
   76 #define DPRINTFN(sc, n, fmt, ...) do {                          \
   77         if (sc->sc_debug >= (n))                                \
   78                 printf(fmt, __VA_ARGS__);                       \
   79 } while (0)
   80 #else
   81 #define DPRINTF(sc, fmt, ...)
   82 #define DPRINTFN(sc, n, fmt, ...)
   83 #endif
   84 
   85 static struct ieee80211vap *rt2661_vap_create(struct ieee80211com *,
   86                             const char [IFNAMSIZ], int, enum ieee80211_opmode,
   87                             int, const uint8_t [IEEE80211_ADDR_LEN],
   88                             const uint8_t [IEEE80211_ADDR_LEN]);
   89 static void             rt2661_vap_delete(struct ieee80211vap *);
   90 static void             rt2661_dma_map_addr(void *, bus_dma_segment_t *, int,
   91                             int);
   92 static int              rt2661_alloc_tx_ring(struct rt2661_softc *,
   93                             struct rt2661_tx_ring *, int);
   94 static void             rt2661_reset_tx_ring(struct rt2661_softc *,
   95                             struct rt2661_tx_ring *);
   96 static void             rt2661_free_tx_ring(struct rt2661_softc *,
   97                             struct rt2661_tx_ring *);
   98 static int              rt2661_alloc_rx_ring(struct rt2661_softc *,
   99                             struct rt2661_rx_ring *, int);
  100 static void             rt2661_reset_rx_ring(struct rt2661_softc *,
  101                             struct rt2661_rx_ring *);
  102 static void             rt2661_free_rx_ring(struct rt2661_softc *,
  103                             struct rt2661_rx_ring *);
  104 static int              rt2661_newstate(struct ieee80211vap *,
  105                             enum ieee80211_state, int);
  106 static uint16_t         rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
  107 static void             rt2661_rx_intr(struct rt2661_softc *);
  108 static void             rt2661_tx_intr(struct rt2661_softc *);
  109 static void             rt2661_tx_dma_intr(struct rt2661_softc *,
  110                             struct rt2661_tx_ring *);
  111 static void             rt2661_mcu_beacon_expire(struct rt2661_softc *);
  112 static void             rt2661_mcu_wakeup(struct rt2661_softc *);
  113 static void             rt2661_mcu_cmd_intr(struct rt2661_softc *);
  114 static void             rt2661_scan_start(struct ieee80211com *);
  115 static void             rt2661_scan_end(struct ieee80211com *);
  116 static void             rt2661_getradiocaps(struct ieee80211com *, int, int *,
  117                             struct ieee80211_channel[]);
  118 static void             rt2661_set_channel(struct ieee80211com *);
  119 static void             rt2661_setup_tx_desc(struct rt2661_softc *,
  120                             struct rt2661_tx_desc *, uint32_t, uint16_t, int,
  121                             int, const bus_dma_segment_t *, int, int);
  122 static int              rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
  123                             struct ieee80211_node *, int);
  124 static int              rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
  125                             struct ieee80211_node *);
  126 static int              rt2661_transmit(struct ieee80211com *, struct mbuf *);
  127 static void             rt2661_start(struct rt2661_softc *);
  128 static int              rt2661_raw_xmit(struct ieee80211_node *, struct mbuf *,
  129                             const struct ieee80211_bpf_params *);
  130 static void             rt2661_watchdog(void *);
  131 static void             rt2661_parent(struct ieee80211com *);
  132 static void             rt2661_bbp_write(struct rt2661_softc *, uint8_t,
  133                             uint8_t);
  134 static uint8_t          rt2661_bbp_read(struct rt2661_softc *, uint8_t);
  135 static void             rt2661_rf_write(struct rt2661_softc *, uint8_t,
  136                             uint32_t);
  137 static int              rt2661_tx_cmd(struct rt2661_softc *, uint8_t,
  138                             uint16_t);
  139 static void             rt2661_select_antenna(struct rt2661_softc *);
  140 static void             rt2661_enable_mrr(struct rt2661_softc *);
  141 static void             rt2661_set_txpreamble(struct rt2661_softc *);
  142 static void             rt2661_set_basicrates(struct rt2661_softc *,
  143                             const struct ieee80211_rateset *);
  144 static void             rt2661_select_band(struct rt2661_softc *,
  145                             struct ieee80211_channel *);
  146 static void             rt2661_set_chan(struct rt2661_softc *,
  147                             struct ieee80211_channel *);
  148 static void             rt2661_set_bssid(struct rt2661_softc *,
  149                             const uint8_t *);
  150 static void             rt2661_set_macaddr(struct rt2661_softc *,
  151                            const uint8_t *);
  152 static void             rt2661_update_promisc(struct ieee80211com *);
  153 static int              rt2661_wme_update(struct ieee80211com *) __unused;
  154 static void             rt2661_update_slot(struct ieee80211com *);
  155 static const char       *rt2661_get_rf(int);
  156 static void             rt2661_read_eeprom(struct rt2661_softc *,
  157                             uint8_t macaddr[IEEE80211_ADDR_LEN]);
  158 static int              rt2661_bbp_init(struct rt2661_softc *);
  159 static void             rt2661_init_locked(struct rt2661_softc *);
  160 static void             rt2661_init(void *);
  161 static void             rt2661_stop_locked(struct rt2661_softc *);
  162 static void             rt2661_stop(void *);
  163 static int              rt2661_load_microcode(struct rt2661_softc *);
  164 #ifdef notyet
  165 static void             rt2661_rx_tune(struct rt2661_softc *);
  166 static void             rt2661_radar_start(struct rt2661_softc *);
  167 static int              rt2661_radar_stop(struct rt2661_softc *);
  168 #endif
  169 static int              rt2661_prepare_beacon(struct rt2661_softc *,
  170                             struct ieee80211vap *);
  171 static void             rt2661_enable_tsf_sync(struct rt2661_softc *);
  172 static void             rt2661_enable_tsf(struct rt2661_softc *);
  173 static int              rt2661_get_rssi(struct rt2661_softc *, uint8_t);
  174 
  175 static const struct {
  176         uint32_t        reg;
  177         uint32_t        val;
  178 } rt2661_def_mac[] = {
  179         RT2661_DEF_MAC
  180 };
  181 
  182 static const struct {
  183         uint8_t reg;
  184         uint8_t val;
  185 } rt2661_def_bbp[] = {
  186         RT2661_DEF_BBP
  187 };
  188 
  189 static const struct rfprog {
  190         uint8_t         chan;
  191         uint32_t        r1, r2, r3, r4;
  192 }  rt2661_rf5225_1[] = {
  193         RT2661_RF5225_1
  194 }, rt2661_rf5225_2[] = {
  195         RT2661_RF5225_2
  196 };
  197 
  198 static const uint8_t rt2661_chan_2ghz[] =
  199         { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14 };
  200 static const uint8_t rt2661_chan_5ghz[] =
  201         { 36, 40, 44, 48, 52, 56, 60, 64,
  202           100, 104, 108, 112, 116, 120, 124, 128, 132, 136, 140,
  203           149, 153, 157, 161, 165 };
  204 
  205 int
  206 rt2661_attach(device_t dev, int id)
  207 {
  208         struct rt2661_softc *sc = device_get_softc(dev);
  209         struct ieee80211com *ic = &sc->sc_ic;
  210         uint32_t val;
  211         int error, ac, ntries;
  212 
  213         sc->sc_id = id;
  214         sc->sc_dev = dev;
  215 
  216         mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
  217             MTX_DEF | MTX_RECURSE);
  218 
  219         callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
  220         mbufq_init(&sc->sc_snd, ifqmaxlen);
  221 
  222         /* wait for NIC to initialize */
  223         for (ntries = 0; ntries < 1000; ntries++) {
  224                 if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
  225                         break;
  226                 DELAY(1000);
  227         }
  228         if (ntries == 1000) {
  229                 device_printf(sc->sc_dev,
  230                     "timeout waiting for NIC to initialize\n");
  231                 error = EIO;
  232                 goto fail1;
  233         }
  234 
  235         /* retrieve RF rev. no and various other things from EEPROM */
  236         rt2661_read_eeprom(sc, ic->ic_macaddr);
  237 
  238         device_printf(dev, "MAC/BBP RT%X, RF %s\n", val,
  239             rt2661_get_rf(sc->rf_rev));
  240 
  241         /*
  242          * Allocate Tx and Rx rings.
  243          */
  244         for (ac = 0; ac < 4; ac++) {
  245                 error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
  246                     RT2661_TX_RING_COUNT);
  247                 if (error != 0) {
  248                         device_printf(sc->sc_dev,
  249                             "could not allocate Tx ring %d\n", ac);
  250                         goto fail2;
  251                 }
  252         }
  253 
  254         error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
  255         if (error != 0) {
  256                 device_printf(sc->sc_dev, "could not allocate Mgt ring\n");
  257                 goto fail2;
  258         }
  259 
  260         error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
  261         if (error != 0) {
  262                 device_printf(sc->sc_dev, "could not allocate Rx ring\n");
  263                 goto fail3;
  264         }
  265 
  266         ic->ic_softc = sc;
  267         ic->ic_name = device_get_nameunit(dev);
  268         ic->ic_opmode = IEEE80211_M_STA;
  269         ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
  270 
  271         /* set device capabilities */
  272         ic->ic_caps =
  273                   IEEE80211_C_STA               /* station mode */
  274                 | IEEE80211_C_IBSS              /* ibss, nee adhoc, mode */
  275                 | IEEE80211_C_HOSTAP            /* hostap mode */
  276                 | IEEE80211_C_MONITOR           /* monitor mode */
  277                 | IEEE80211_C_AHDEMO            /* adhoc demo mode */
  278                 | IEEE80211_C_WDS               /* 4-address traffic works */
  279                 | IEEE80211_C_MBSS              /* mesh point link mode */
  280                 | IEEE80211_C_SHPREAMBLE        /* short preamble supported */
  281                 | IEEE80211_C_SHSLOT            /* short slot time supported */
  282                 | IEEE80211_C_WPA               /* capable of WPA1+WPA2 */
  283                 | IEEE80211_C_BGSCAN            /* capable of bg scanning */
  284 #ifdef notyet
  285                 | IEEE80211_C_TXFRAG            /* handle tx frags */
  286                 | IEEE80211_C_WME               /* 802.11e */
  287 #endif
  288                 ;
  289 
  290         rt2661_getradiocaps(ic, IEEE80211_CHAN_MAX, &ic->ic_nchans,
  291             ic->ic_channels);
  292 
  293         ieee80211_ifattach(ic);
  294 #if 0
  295         ic->ic_wme.wme_update = rt2661_wme_update;
  296 #endif
  297         ic->ic_scan_start = rt2661_scan_start;
  298         ic->ic_scan_end = rt2661_scan_end;
  299         ic->ic_getradiocaps = rt2661_getradiocaps;
  300         ic->ic_set_channel = rt2661_set_channel;
  301         ic->ic_updateslot = rt2661_update_slot;
  302         ic->ic_update_promisc = rt2661_update_promisc;
  303         ic->ic_raw_xmit = rt2661_raw_xmit;
  304         ic->ic_transmit = rt2661_transmit;
  305         ic->ic_parent = rt2661_parent;
  306         ic->ic_vap_create = rt2661_vap_create;
  307         ic->ic_vap_delete = rt2661_vap_delete;
  308 
  309         ieee80211_radiotap_attach(ic,
  310             &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
  311                 RT2661_TX_RADIOTAP_PRESENT,
  312             &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
  313                 RT2661_RX_RADIOTAP_PRESENT);
  314 
  315 #ifdef RAL_DEBUG
  316         SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
  317             SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
  318             "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
  319 #endif
  320         if (bootverbose)
  321                 ieee80211_announce(ic);
  322 
  323         return 0;
  324 
  325 fail3:  rt2661_free_tx_ring(sc, &sc->mgtq);
  326 fail2:  while (--ac >= 0)
  327                 rt2661_free_tx_ring(sc, &sc->txq[ac]);
  328 fail1:  mtx_destroy(&sc->sc_mtx);
  329         return error;
  330 }
  331 
  332 int
  333 rt2661_detach(void *xsc)
  334 {
  335         struct rt2661_softc *sc = xsc;
  336         struct ieee80211com *ic = &sc->sc_ic;
  337         
  338         RAL_LOCK(sc);
  339         rt2661_stop_locked(sc);
  340         RAL_UNLOCK(sc);
  341 
  342         ieee80211_ifdetach(ic);
  343         mbufq_drain(&sc->sc_snd);
  344 
  345         rt2661_free_tx_ring(sc, &sc->txq[0]);
  346         rt2661_free_tx_ring(sc, &sc->txq[1]);
  347         rt2661_free_tx_ring(sc, &sc->txq[2]);
  348         rt2661_free_tx_ring(sc, &sc->txq[3]);
  349         rt2661_free_tx_ring(sc, &sc->mgtq);
  350         rt2661_free_rx_ring(sc, &sc->rxq);
  351 
  352         mtx_destroy(&sc->sc_mtx);
  353 
  354         return 0;
  355 }
  356 
  357 static struct ieee80211vap *
  358 rt2661_vap_create(struct ieee80211com *ic, const char name[IFNAMSIZ], int unit,
  359     enum ieee80211_opmode opmode, int flags,
  360     const uint8_t bssid[IEEE80211_ADDR_LEN],
  361     const uint8_t mac[IEEE80211_ADDR_LEN])
  362 {
  363         struct rt2661_softc *sc = ic->ic_softc;
  364         struct rt2661_vap *rvp;
  365         struct ieee80211vap *vap;
  366 
  367         switch (opmode) {
  368         case IEEE80211_M_STA:
  369         case IEEE80211_M_IBSS:
  370         case IEEE80211_M_AHDEMO:
  371         case IEEE80211_M_MONITOR:
  372         case IEEE80211_M_HOSTAP:
  373         case IEEE80211_M_MBSS:
  374                 /* XXXRP: TBD */
  375                 if (!TAILQ_EMPTY(&ic->ic_vaps)) {
  376                         device_printf(sc->sc_dev, "only 1 vap supported\n");
  377                         return NULL;
  378                 }
  379                 if (opmode == IEEE80211_M_STA)
  380                         flags |= IEEE80211_CLONE_NOBEACONS;
  381                 break;
  382         case IEEE80211_M_WDS:
  383                 if (TAILQ_EMPTY(&ic->ic_vaps) ||
  384                     ic->ic_opmode != IEEE80211_M_HOSTAP) {
  385                         device_printf(sc->sc_dev,
  386                             "wds only supported in ap mode\n");
  387                         return NULL;
  388                 }
  389                 /*
  390                  * Silently remove any request for a unique
  391                  * bssid; WDS vap's always share the local
  392                  * mac address.
  393                  */
  394                 flags &= ~IEEE80211_CLONE_BSSID;
  395                 break;
  396         default:
  397                 device_printf(sc->sc_dev, "unknown opmode %d\n", opmode);
  398                 return NULL;
  399         }
  400         rvp = malloc(sizeof(struct rt2661_vap), M_80211_VAP, M_WAITOK | M_ZERO);
  401         vap = &rvp->ral_vap;
  402         ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid);
  403 
  404         /* override state transition machine */
  405         rvp->ral_newstate = vap->iv_newstate;
  406         vap->iv_newstate = rt2661_newstate;
  407 #if 0
  408         vap->iv_update_beacon = rt2661_beacon_update;
  409 #endif
  410 
  411         ieee80211_ratectl_init(vap);
  412         /* complete setup */
  413         ieee80211_vap_attach(vap, ieee80211_media_change,
  414             ieee80211_media_status, mac);
  415         if (TAILQ_FIRST(&ic->ic_vaps) == vap)
  416                 ic->ic_opmode = opmode;
  417         return vap;
  418 }
  419 
  420 static void
  421 rt2661_vap_delete(struct ieee80211vap *vap)
  422 {
  423         struct rt2661_vap *rvp = RT2661_VAP(vap);
  424 
  425         ieee80211_ratectl_deinit(vap);
  426         ieee80211_vap_detach(vap);
  427         free(rvp, M_80211_VAP);
  428 }
  429 
  430 void
  431 rt2661_shutdown(void *xsc)
  432 {
  433         struct rt2661_softc *sc = xsc;
  434 
  435         rt2661_stop(sc);
  436 }
  437 
  438 void
  439 rt2661_suspend(void *xsc)
  440 {
  441         struct rt2661_softc *sc = xsc;
  442 
  443         rt2661_stop(sc);
  444 }
  445 
  446 void
  447 rt2661_resume(void *xsc)
  448 {
  449         struct rt2661_softc *sc = xsc;
  450 
  451         if (sc->sc_ic.ic_nrunning > 0)
  452                 rt2661_init(sc);
  453 }
  454 
  455 static void
  456 rt2661_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
  457 {
  458         if (error != 0)
  459                 return;
  460 
  461         KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
  462 
  463         *(bus_addr_t *)arg = segs[0].ds_addr;
  464 }
  465 
  466 static int
  467 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
  468     int count)
  469 {
  470         int i, error;
  471 
  472         ring->count = count;
  473         ring->queued = 0;
  474         ring->cur = ring->next = ring->stat = 0;
  475 
  476         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 4, 0, 
  477             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
  478             count * RT2661_TX_DESC_SIZE, 1, count * RT2661_TX_DESC_SIZE,
  479             0, NULL, NULL, &ring->desc_dmat);
  480         if (error != 0) {
  481                 device_printf(sc->sc_dev, "could not create desc DMA tag\n");
  482                 goto fail;
  483         }
  484 
  485         error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
  486             BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
  487         if (error != 0) {
  488                 device_printf(sc->sc_dev, "could not allocate DMA memory\n");
  489                 goto fail;
  490         }
  491 
  492         error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
  493             count * RT2661_TX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
  494             0);
  495         if (error != 0) {
  496                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
  497                 goto fail;
  498         }
  499 
  500         ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
  501             M_NOWAIT | M_ZERO);
  502         if (ring->data == NULL) {
  503                 device_printf(sc->sc_dev, "could not allocate soft data\n");
  504                 error = ENOMEM;
  505                 goto fail;
  506         }
  507 
  508         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0, 
  509             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
  510             RT2661_MAX_SCATTER, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
  511         if (error != 0) {
  512                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
  513                 goto fail;
  514         }
  515 
  516         for (i = 0; i < count; i++) {
  517                 error = bus_dmamap_create(ring->data_dmat, 0,
  518                     &ring->data[i].map);
  519                 if (error != 0) {
  520                         device_printf(sc->sc_dev, "could not create DMA map\n");
  521                         goto fail;
  522                 }
  523         }
  524 
  525         return 0;
  526 
  527 fail:   rt2661_free_tx_ring(sc, ring);
  528         return error;
  529 }
  530 
  531 static void
  532 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  533 {
  534         struct rt2661_tx_desc *desc;
  535         struct rt2661_tx_data *data;
  536         int i;
  537 
  538         for (i = 0; i < ring->count; i++) {
  539                 desc = &ring->desc[i];
  540                 data = &ring->data[i];
  541 
  542                 if (data->m != NULL) {
  543                         bus_dmamap_sync(ring->data_dmat, data->map,
  544                             BUS_DMASYNC_POSTWRITE);
  545                         bus_dmamap_unload(ring->data_dmat, data->map);
  546                         m_freem(data->m);
  547                         data->m = NULL;
  548                 }
  549 
  550                 if (data->ni != NULL) {
  551                         ieee80211_free_node(data->ni);
  552                         data->ni = NULL;
  553                 }
  554 
  555                 desc->flags = 0;
  556         }
  557 
  558         bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
  559 
  560         ring->queued = 0;
  561         ring->cur = ring->next = ring->stat = 0;
  562 }
  563 
  564 static void
  565 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
  566 {
  567         struct rt2661_tx_data *data;
  568         int i;
  569 
  570         if (ring->desc != NULL) {
  571                 bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
  572                     BUS_DMASYNC_POSTWRITE);
  573                 bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
  574                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
  575         }
  576 
  577         if (ring->desc_dmat != NULL)
  578                 bus_dma_tag_destroy(ring->desc_dmat);
  579 
  580         if (ring->data != NULL) {
  581                 for (i = 0; i < ring->count; i++) {
  582                         data = &ring->data[i];
  583 
  584                         if (data->m != NULL) {
  585                                 bus_dmamap_sync(ring->data_dmat, data->map,
  586                                     BUS_DMASYNC_POSTWRITE);
  587                                 bus_dmamap_unload(ring->data_dmat, data->map);
  588                                 m_freem(data->m);
  589                         }
  590 
  591                         if (data->ni != NULL)
  592                                 ieee80211_free_node(data->ni);
  593 
  594                         if (data->map != NULL)
  595                                 bus_dmamap_destroy(ring->data_dmat, data->map);
  596                 }
  597 
  598                 free(ring->data, M_DEVBUF);
  599         }
  600 
  601         if (ring->data_dmat != NULL)
  602                 bus_dma_tag_destroy(ring->data_dmat);
  603 }
  604 
  605 static int
  606 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
  607     int count)
  608 {
  609         struct rt2661_rx_desc *desc;
  610         struct rt2661_rx_data *data;
  611         bus_addr_t physaddr;
  612         int i, error;
  613 
  614         ring->count = count;
  615         ring->cur = ring->next = 0;
  616 
  617         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 4, 0, 
  618             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
  619             count * RT2661_RX_DESC_SIZE, 1, count * RT2661_RX_DESC_SIZE,
  620             0, NULL, NULL, &ring->desc_dmat);
  621         if (error != 0) {
  622                 device_printf(sc->sc_dev, "could not create desc DMA tag\n");
  623                 goto fail;
  624         }
  625 
  626         error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
  627             BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
  628         if (error != 0) {
  629                 device_printf(sc->sc_dev, "could not allocate DMA memory\n");
  630                 goto fail;
  631         }
  632 
  633         error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
  634             count * RT2661_RX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
  635             0);
  636         if (error != 0) {
  637                 device_printf(sc->sc_dev, "could not load desc DMA map\n");
  638                 goto fail;
  639         }
  640 
  641         ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
  642             M_NOWAIT | M_ZERO);
  643         if (ring->data == NULL) {
  644                 device_printf(sc->sc_dev, "could not allocate soft data\n");
  645                 error = ENOMEM;
  646                 goto fail;
  647         }
  648 
  649         /*
  650          * Pre-allocate Rx buffers and populate Rx ring.
  651          */
  652         error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0, 
  653             BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
  654             1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
  655         if (error != 0) {
  656                 device_printf(sc->sc_dev, "could not create data DMA tag\n");
  657                 goto fail;
  658         }
  659 
  660         for (i = 0; i < count; i++) {
  661                 desc = &sc->rxq.desc[i];
  662                 data = &sc->rxq.data[i];
  663 
  664                 error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
  665                 if (error != 0) {
  666                         device_printf(sc->sc_dev, "could not create DMA map\n");
  667                         goto fail;
  668                 }
  669 
  670                 data->m = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
  671                 if (data->m == NULL) {
  672                         device_printf(sc->sc_dev,
  673                             "could not allocate rx mbuf\n");
  674                         error = ENOMEM;
  675                         goto fail;
  676                 }
  677 
  678                 error = bus_dmamap_load(ring->data_dmat, data->map,
  679                     mtod(data->m, void *), MCLBYTES, rt2661_dma_map_addr,
  680                     &physaddr, 0);
  681                 if (error != 0) {
  682                         device_printf(sc->sc_dev,
  683                             "could not load rx buf DMA map");
  684                         goto fail;
  685                 }
  686 
  687                 desc->flags = htole32(RT2661_RX_BUSY);
  688                 desc->physaddr = htole32(physaddr);
  689         }
  690 
  691         bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
  692 
  693         return 0;
  694 
  695 fail:   rt2661_free_rx_ring(sc, ring);
  696         return error;
  697 }
  698 
  699 static void
  700 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  701 {
  702         int i;
  703 
  704         for (i = 0; i < ring->count; i++)
  705                 ring->desc[i].flags = htole32(RT2661_RX_BUSY);
  706 
  707         bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
  708 
  709         ring->cur = ring->next = 0;
  710 }
  711 
  712 static void
  713 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
  714 {
  715         struct rt2661_rx_data *data;
  716         int i;
  717 
  718         if (ring->desc != NULL) {
  719                 bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
  720                     BUS_DMASYNC_POSTWRITE);
  721                 bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
  722                 bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
  723         }
  724 
  725         if (ring->desc_dmat != NULL)
  726                 bus_dma_tag_destroy(ring->desc_dmat);
  727 
  728         if (ring->data != NULL) {
  729                 for (i = 0; i < ring->count; i++) {
  730                         data = &ring->data[i];
  731 
  732                         if (data->m != NULL) {
  733                                 bus_dmamap_sync(ring->data_dmat, data->map,
  734                                     BUS_DMASYNC_POSTREAD);
  735                                 bus_dmamap_unload(ring->data_dmat, data->map);
  736                                 m_freem(data->m);
  737                         }
  738 
  739                         if (data->map != NULL)
  740                                 bus_dmamap_destroy(ring->data_dmat, data->map);
  741                 }
  742 
  743                 free(ring->data, M_DEVBUF);
  744         }
  745 
  746         if (ring->data_dmat != NULL)
  747                 bus_dma_tag_destroy(ring->data_dmat);
  748 }
  749 
  750 static int
  751 rt2661_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
  752 {
  753         struct rt2661_vap *rvp = RT2661_VAP(vap);
  754         struct ieee80211com *ic = vap->iv_ic;
  755         struct rt2661_softc *sc = ic->ic_softc;
  756         int error;
  757 
  758         if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
  759                 uint32_t tmp;
  760 
  761                 /* abort TSF synchronization */
  762                 tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
  763                 RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
  764         }
  765 
  766         error = rvp->ral_newstate(vap, nstate, arg);
  767 
  768         if (error == 0 && nstate == IEEE80211_S_RUN) {
  769                 struct ieee80211_node *ni = vap->iv_bss;
  770 
  771                 if (vap->iv_opmode != IEEE80211_M_MONITOR) {
  772                         rt2661_enable_mrr(sc);
  773                         rt2661_set_txpreamble(sc);
  774                         rt2661_set_basicrates(sc, &ni->ni_rates);
  775                         rt2661_set_bssid(sc, ni->ni_bssid);
  776                 }
  777 
  778                 if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
  779                     vap->iv_opmode == IEEE80211_M_IBSS ||
  780                     vap->iv_opmode == IEEE80211_M_MBSS) {
  781                         error = rt2661_prepare_beacon(sc, vap);
  782                         if (error != 0)
  783                                 return error;
  784                 }
  785                 if (vap->iv_opmode != IEEE80211_M_MONITOR)
  786                         rt2661_enable_tsf_sync(sc);
  787                 else
  788                         rt2661_enable_tsf(sc);
  789         }
  790         return error;
  791 }
  792 
  793 /*
  794  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
  795  * 93C66).
  796  */
  797 static uint16_t
  798 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
  799 {
  800         uint32_t tmp;
  801         uint16_t val;
  802         int n;
  803 
  804         /* clock C once before the first command */
  805         RT2661_EEPROM_CTL(sc, 0);
  806 
  807         RT2661_EEPROM_CTL(sc, RT2661_S);
  808         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  809         RT2661_EEPROM_CTL(sc, RT2661_S);
  810 
  811         /* write start bit (1) */
  812         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  813         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  814 
  815         /* write READ opcode (10) */
  816         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
  817         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
  818         RT2661_EEPROM_CTL(sc, RT2661_S);
  819         RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  820 
  821         /* write address (A5-A0 or A7-A0) */
  822         n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
  823         for (; n >= 0; n--) {
  824                 RT2661_EEPROM_CTL(sc, RT2661_S |
  825                     (((addr >> n) & 1) << RT2661_SHIFT_D));
  826                 RT2661_EEPROM_CTL(sc, RT2661_S |
  827                     (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
  828         }
  829 
  830         RT2661_EEPROM_CTL(sc, RT2661_S);
  831 
  832         /* read data Q15-Q0 */
  833         val = 0;
  834         for (n = 15; n >= 0; n--) {
  835                 RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
  836                 tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
  837                 val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
  838                 RT2661_EEPROM_CTL(sc, RT2661_S);
  839         }
  840 
  841         RT2661_EEPROM_CTL(sc, 0);
  842 
  843         /* clear Chip Select and clock C */
  844         RT2661_EEPROM_CTL(sc, RT2661_S);
  845         RT2661_EEPROM_CTL(sc, 0);
  846         RT2661_EEPROM_CTL(sc, RT2661_C);
  847 
  848         return val;
  849 }
  850 
  851 static void
  852 rt2661_tx_intr(struct rt2661_softc *sc)
  853 {
  854         struct rt2661_tx_ring *txq;
  855         struct rt2661_tx_data *data;
  856         uint32_t val;
  857         int error, qid, retrycnt;
  858         struct ieee80211vap *vap;
  859 
  860         for (;;) {
  861                 struct ieee80211_node *ni;
  862                 struct mbuf *m;
  863 
  864                 val = RAL_READ(sc, RT2661_STA_CSR4);
  865                 if (!(val & RT2661_TX_STAT_VALID))
  866                         break;
  867 
  868                 /* retrieve the queue in which this frame was sent */
  869                 qid = RT2661_TX_QID(val);
  870                 txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
  871 
  872                 /* retrieve rate control algorithm context */
  873                 data = &txq->data[txq->stat];
  874                 m = data->m;
  875                 data->m = NULL;
  876                 ni = data->ni;
  877                 data->ni = NULL;
  878 
  879                 /* if no frame has been sent, ignore */
  880                 if (ni == NULL)
  881                         continue;
  882                 else
  883                         vap = ni->ni_vap;
  884 
  885                 switch (RT2661_TX_RESULT(val)) {
  886                 case RT2661_TX_SUCCESS:
  887                         retrycnt = RT2661_TX_RETRYCNT(val);
  888 
  889                         DPRINTFN(sc, 10, "data frame sent successfully after "
  890                             "%d retries\n", retrycnt);
  891                         if (data->rix != IEEE80211_FIXED_RATE_NONE)
  892                                 ieee80211_ratectl_tx_complete(vap, ni,
  893                                     IEEE80211_RATECTL_TX_SUCCESS,
  894                                     &retrycnt, NULL);
  895                         error = 0;
  896                         break;
  897 
  898                 case RT2661_TX_RETRY_FAIL:
  899                         retrycnt = RT2661_TX_RETRYCNT(val);
  900 
  901                         DPRINTFN(sc, 9, "%s\n",
  902                             "sending data frame failed (too much retries)");
  903                         if (data->rix != IEEE80211_FIXED_RATE_NONE)
  904                                 ieee80211_ratectl_tx_complete(vap, ni,
  905                                     IEEE80211_RATECTL_TX_FAILURE,
  906                                     &retrycnt, NULL);
  907                         error = 1;
  908                         break;
  909 
  910                 default:
  911                         /* other failure */
  912                         device_printf(sc->sc_dev,
  913                             "sending data frame failed 0x%08x\n", val);
  914                         error = 1;
  915                 }
  916 
  917                 DPRINTFN(sc, 15, "tx done q=%d idx=%u\n", qid, txq->stat);
  918 
  919                 txq->queued--;
  920                 if (++txq->stat >= txq->count)  /* faster than % count */
  921                         txq->stat = 0;
  922 
  923                 ieee80211_tx_complete(ni, m, error);
  924         }
  925 
  926         sc->sc_tx_timer = 0;
  927 
  928         rt2661_start(sc);
  929 }
  930 
  931 static void
  932 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
  933 {
  934         struct rt2661_tx_desc *desc;
  935         struct rt2661_tx_data *data;
  936 
  937         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_POSTREAD);
  938 
  939         for (;;) {
  940                 desc = &txq->desc[txq->next];
  941                 data = &txq->data[txq->next];
  942 
  943                 if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
  944                     !(le32toh(desc->flags) & RT2661_TX_VALID))
  945                         break;
  946 
  947                 bus_dmamap_sync(txq->data_dmat, data->map,
  948                     BUS_DMASYNC_POSTWRITE);
  949                 bus_dmamap_unload(txq->data_dmat, data->map);
  950 
  951                 /* descriptor is no longer valid */
  952                 desc->flags &= ~htole32(RT2661_TX_VALID);
  953 
  954                 DPRINTFN(sc, 15, "tx dma done q=%p idx=%u\n", txq, txq->next);
  955 
  956                 if (++txq->next >= txq->count)  /* faster than % count */
  957                         txq->next = 0;
  958         }
  959 
  960         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
  961 }
  962 
  963 static void
  964 rt2661_rx_intr(struct rt2661_softc *sc)
  965 {
  966         struct ieee80211com *ic = &sc->sc_ic;
  967         struct rt2661_rx_desc *desc;
  968         struct rt2661_rx_data *data;
  969         bus_addr_t physaddr;
  970         struct ieee80211_frame *wh;
  971         struct ieee80211_node *ni;
  972         struct mbuf *mnew, *m;
  973         int error;
  974 
  975         bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
  976             BUS_DMASYNC_POSTREAD);
  977 
  978         for (;;) {
  979                 int8_t rssi, nf;
  980 
  981                 desc = &sc->rxq.desc[sc->rxq.cur];
  982                 data = &sc->rxq.data[sc->rxq.cur];
  983 
  984                 if (le32toh(desc->flags) & RT2661_RX_BUSY)
  985                         break;
  986 
  987                 if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
  988                     (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
  989                         /*
  990                          * This should not happen since we did not request
  991                          * to receive those frames when we filled TXRX_CSR0.
  992                          */
  993                         DPRINTFN(sc, 5, "PHY or CRC error flags 0x%08x\n",
  994                             le32toh(desc->flags));
  995                         counter_u64_add(ic->ic_ierrors, 1);
  996                         goto skip;
  997                 }
  998 
  999                 if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
 1000                         counter_u64_add(ic->ic_ierrors, 1);
 1001                         goto skip;
 1002                 }
 1003 
 1004                 /*
 1005                  * Try to allocate a new mbuf for this ring element and load it
 1006                  * before processing the current mbuf. If the ring element
 1007                  * cannot be loaded, drop the received packet and reuse the old
 1008                  * mbuf. In the unlikely case that the old mbuf can't be
 1009                  * reloaded either, explicitly panic.
 1010                  */
 1011                 mnew = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 1012                 if (mnew == NULL) {
 1013                         counter_u64_add(ic->ic_ierrors, 1);
 1014                         goto skip;
 1015                 }
 1016 
 1017                 bus_dmamap_sync(sc->rxq.data_dmat, data->map,
 1018                     BUS_DMASYNC_POSTREAD);
 1019                 bus_dmamap_unload(sc->rxq.data_dmat, data->map);
 1020 
 1021                 error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
 1022                     mtod(mnew, void *), MCLBYTES, rt2661_dma_map_addr,
 1023                     &physaddr, 0);
 1024                 if (error != 0) {
 1025                         m_freem(mnew);
 1026 
 1027                         /* try to reload the old mbuf */
 1028                         error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
 1029                             mtod(data->m, void *), MCLBYTES,
 1030                             rt2661_dma_map_addr, &physaddr, 0);
 1031                         if (error != 0) {
 1032                                 /* very unlikely that it will fail... */
 1033                                 panic("%s: could not load old rx mbuf",
 1034                                     device_get_name(sc->sc_dev));
 1035                         }
 1036                         counter_u64_add(ic->ic_ierrors, 1);
 1037                         goto skip;
 1038                 }
 1039 
 1040                 /*
 1041                  * New mbuf successfully loaded, update Rx ring and continue
 1042                  * processing.
 1043                  */
 1044                 m = data->m;
 1045                 data->m = mnew;
 1046                 desc->physaddr = htole32(physaddr);
 1047 
 1048                 /* finalize mbuf */
 1049                 m->m_pkthdr.len = m->m_len =
 1050                     (le32toh(desc->flags) >> 16) & 0xfff;
 1051 
 1052                 rssi = rt2661_get_rssi(sc, desc->rssi);
 1053                 /* Error happened during RSSI conversion. */
 1054                 if (rssi < 0)
 1055                         rssi = -30;     /* XXX ignored by net80211 */
 1056                 nf = RT2661_NOISE_FLOOR;
 1057 
 1058                 if (ieee80211_radiotap_active(ic)) {
 1059                         struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
 1060                         uint32_t tsf_lo, tsf_hi;
 1061 
 1062                         /* get timestamp (low and high 32 bits) */
 1063                         tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
 1064                         tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
 1065 
 1066                         tap->wr_tsf =
 1067                             htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
 1068                         tap->wr_flags = 0;
 1069                         tap->wr_rate = ieee80211_plcp2rate(desc->rate,
 1070                             (desc->flags & htole32(RT2661_RX_OFDM)) ?
 1071                                 IEEE80211_T_OFDM : IEEE80211_T_CCK);
 1072                         tap->wr_antsignal = nf + rssi;
 1073                         tap->wr_antnoise = nf;
 1074                 }
 1075                 sc->sc_flags |= RAL_INPUT_RUNNING;
 1076                 RAL_UNLOCK(sc);
 1077                 wh = mtod(m, struct ieee80211_frame *);
 1078 
 1079                 /* send the frame to the 802.11 layer */
 1080                 ni = ieee80211_find_rxnode(ic,
 1081                     (struct ieee80211_frame_min *)wh);
 1082                 if (ni != NULL) {
 1083                         (void) ieee80211_input(ni, m, rssi, nf);
 1084                         ieee80211_free_node(ni);
 1085                 } else
 1086                         (void) ieee80211_input_all(ic, m, rssi, nf);
 1087 
 1088                 RAL_LOCK(sc);
 1089                 sc->sc_flags &= ~RAL_INPUT_RUNNING;
 1090 
 1091 skip:           desc->flags |= htole32(RT2661_RX_BUSY);
 1092 
 1093                 DPRINTFN(sc, 15, "rx intr idx=%u\n", sc->rxq.cur);
 1094 
 1095                 sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
 1096         }
 1097 
 1098         bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
 1099             BUS_DMASYNC_PREWRITE);
 1100 }
 1101 
 1102 /* ARGSUSED */
 1103 static void
 1104 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
 1105 {
 1106         /* do nothing */
 1107 }
 1108 
 1109 static void
 1110 rt2661_mcu_wakeup(struct rt2661_softc *sc)
 1111 {
 1112         RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
 1113 
 1114         RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
 1115         RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
 1116         RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
 1117 
 1118         /* send wakeup command to MCU */
 1119         rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
 1120 }
 1121 
 1122 static void
 1123 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
 1124 {
 1125         RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
 1126         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 1127 }
 1128 
 1129 void
 1130 rt2661_intr(void *arg)
 1131 {
 1132         struct rt2661_softc *sc = arg;
 1133         uint32_t r1, r2;
 1134 
 1135         RAL_LOCK(sc);
 1136 
 1137         /* disable MAC and MCU interrupts */
 1138         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
 1139         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 1140 
 1141         /* don't re-enable interrupts if we're shutting down */
 1142         if (!(sc->sc_flags & RAL_RUNNING)) {
 1143                 RAL_UNLOCK(sc);
 1144                 return;
 1145         }
 1146 
 1147         r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
 1148         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
 1149 
 1150         r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
 1151         RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
 1152 
 1153         if (r1 & RT2661_MGT_DONE)
 1154                 rt2661_tx_dma_intr(sc, &sc->mgtq);
 1155 
 1156         if (r1 & RT2661_RX_DONE)
 1157                 rt2661_rx_intr(sc);
 1158 
 1159         if (r1 & RT2661_TX0_DMA_DONE)
 1160                 rt2661_tx_dma_intr(sc, &sc->txq[0]);
 1161 
 1162         if (r1 & RT2661_TX1_DMA_DONE)
 1163                 rt2661_tx_dma_intr(sc, &sc->txq[1]);
 1164 
 1165         if (r1 & RT2661_TX2_DMA_DONE)
 1166                 rt2661_tx_dma_intr(sc, &sc->txq[2]);
 1167 
 1168         if (r1 & RT2661_TX3_DMA_DONE)
 1169                 rt2661_tx_dma_intr(sc, &sc->txq[3]);
 1170 
 1171         if (r1 & RT2661_TX_DONE)
 1172                 rt2661_tx_intr(sc);
 1173 
 1174         if (r2 & RT2661_MCU_CMD_DONE)
 1175                 rt2661_mcu_cmd_intr(sc);
 1176 
 1177         if (r2 & RT2661_MCU_BEACON_EXPIRE)
 1178                 rt2661_mcu_beacon_expire(sc);
 1179 
 1180         if (r2 & RT2661_MCU_WAKEUP)
 1181                 rt2661_mcu_wakeup(sc);
 1182 
 1183         /* re-enable MAC and MCU interrupts */
 1184         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 1185         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 1186 
 1187         RAL_UNLOCK(sc);
 1188 }
 1189 
 1190 static uint8_t
 1191 rt2661_plcp_signal(int rate)
 1192 {
 1193         switch (rate) {
 1194         /* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
 1195         case 12:        return 0xb;
 1196         case 18:        return 0xf;
 1197         case 24:        return 0xa;
 1198         case 36:        return 0xe;
 1199         case 48:        return 0x9;
 1200         case 72:        return 0xd;
 1201         case 96:        return 0x8;
 1202         case 108:       return 0xc;
 1203 
 1204         /* CCK rates (NB: not IEEE std, device-specific) */
 1205         case 2:         return 0x0;
 1206         case 4:         return 0x1;
 1207         case 11:        return 0x2;
 1208         case 22:        return 0x3;
 1209         }
 1210         return 0xff;            /* XXX unsupported/unknown rate */
 1211 }
 1212 
 1213 static void
 1214 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
 1215     uint32_t flags, uint16_t xflags, int len, int rate,
 1216     const bus_dma_segment_t *segs, int nsegs, int ac)
 1217 {
 1218         struct ieee80211com *ic = &sc->sc_ic;
 1219         uint16_t plcp_length;
 1220         int i, remainder;
 1221 
 1222         desc->flags = htole32(flags);
 1223         desc->flags |= htole32(len << 16);
 1224         desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
 1225 
 1226         desc->xflags = htole16(xflags);
 1227         desc->xflags |= htole16(nsegs << 13);
 1228 
 1229         desc->wme = htole16(
 1230             RT2661_QID(ac) |
 1231             RT2661_AIFSN(2) |
 1232             RT2661_LOGCWMIN(4) |
 1233             RT2661_LOGCWMAX(10));
 1234 
 1235         /*
 1236          * Remember in which queue this frame was sent. This field is driver
 1237          * private data only. It will be made available by the NIC in STA_CSR4
 1238          * on Tx interrupts.
 1239          */
 1240         desc->qid = ac;
 1241 
 1242         /* setup PLCP fields */
 1243         desc->plcp_signal  = rt2661_plcp_signal(rate);
 1244         desc->plcp_service = 4;
 1245 
 1246         len += IEEE80211_CRC_LEN;
 1247         if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM) {
 1248                 desc->flags |= htole32(RT2661_TX_OFDM);
 1249 
 1250                 plcp_length = len & 0xfff;
 1251                 desc->plcp_length_hi = plcp_length >> 6;
 1252                 desc->plcp_length_lo = plcp_length & 0x3f;
 1253         } else {
 1254                 plcp_length = howmany(16 * len, rate);
 1255                 if (rate == 22) {
 1256                         remainder = (16 * len) % 22;
 1257                         if (remainder != 0 && remainder < 7)
 1258                                 desc->plcp_service |= RT2661_PLCP_LENGEXT;
 1259                 }
 1260                 desc->plcp_length_hi = plcp_length >> 8;
 1261                 desc->plcp_length_lo = plcp_length & 0xff;
 1262 
 1263                 if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
 1264                         desc->plcp_signal |= 0x08;
 1265         }
 1266 
 1267         /* RT2x61 supports scatter with up to 5 segments */
 1268         for (i = 0; i < nsegs; i++) {
 1269                 desc->addr[i] = htole32(segs[i].ds_addr);
 1270                 desc->len [i] = htole16(segs[i].ds_len);
 1271         }
 1272 }
 1273 
 1274 static int
 1275 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
 1276     struct ieee80211_node *ni)
 1277 {
 1278         struct ieee80211vap *vap = ni->ni_vap;
 1279         struct ieee80211com *ic = ni->ni_ic;
 1280         struct rt2661_tx_desc *desc;
 1281         struct rt2661_tx_data *data;
 1282         struct ieee80211_frame *wh;
 1283         struct ieee80211_key *k;
 1284         bus_dma_segment_t segs[RT2661_MAX_SCATTER];
 1285         uint16_t dur;
 1286         uint32_t flags = 0;     /* XXX HWSEQ */
 1287         int nsegs, rate, error;
 1288 
 1289         desc = &sc->mgtq.desc[sc->mgtq.cur];
 1290         data = &sc->mgtq.data[sc->mgtq.cur];
 1291 
 1292         rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
 1293 
 1294         wh = mtod(m0, struct ieee80211_frame *);
 1295 
 1296         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 1297                 k = ieee80211_crypto_encap(ni, m0);
 1298                 if (k == NULL) {
 1299                         m_freem(m0);
 1300                         return ENOBUFS;
 1301                 }
 1302         }
 1303 
 1304         error = bus_dmamap_load_mbuf_sg(sc->mgtq.data_dmat, data->map, m0,
 1305             segs, &nsegs, 0);
 1306         if (error != 0) {
 1307                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
 1308                     error);
 1309                 m_freem(m0);
 1310                 return error;
 1311         }
 1312 
 1313         if (ieee80211_radiotap_active_vap(vap)) {
 1314                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1315 
 1316                 tap->wt_flags = 0;
 1317                 tap->wt_rate = rate;
 1318 
 1319                 ieee80211_radiotap_tx(vap, m0);
 1320         }
 1321 
 1322         data->m = m0;
 1323         data->ni = ni;
 1324         /* management frames are not taken into account for amrr */
 1325         data->rix = IEEE80211_FIXED_RATE_NONE;
 1326 
 1327         wh = mtod(m0, struct ieee80211_frame *);
 1328 
 1329         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1330                 flags |= RT2661_TX_NEED_ACK;
 1331 
 1332                 dur = ieee80211_ack_duration(ic->ic_rt,
 1333                     rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
 1334                 *(uint16_t *)wh->i_dur = htole16(dur);
 1335 
 1336                 /* tell hardware to add timestamp in probe responses */
 1337                 if ((wh->i_fc[0] &
 1338                     (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
 1339                     (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
 1340                         flags |= RT2661_TX_TIMESTAMP;
 1341         }
 1342 
 1343         rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
 1344             m0->m_pkthdr.len, rate, segs, nsegs, RT2661_QID_MGT);
 1345 
 1346         bus_dmamap_sync(sc->mgtq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 1347         bus_dmamap_sync(sc->mgtq.desc_dmat, sc->mgtq.desc_map,
 1348             BUS_DMASYNC_PREWRITE);
 1349 
 1350         DPRINTFN(sc, 10, "sending mgt frame len=%u idx=%u rate=%u\n",
 1351             m0->m_pkthdr.len, sc->mgtq.cur, rate);
 1352 
 1353         /* kick mgt */
 1354         sc->mgtq.queued++;
 1355         sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
 1356         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
 1357 
 1358         return 0;
 1359 }
 1360 
 1361 static int
 1362 rt2661_sendprot(struct rt2661_softc *sc, int ac,
 1363     const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
 1364 {
 1365         struct ieee80211com *ic = ni->ni_ic;
 1366         struct rt2661_tx_ring *txq = &sc->txq[ac];
 1367         const struct ieee80211_frame *wh;
 1368         struct rt2661_tx_desc *desc;
 1369         struct rt2661_tx_data *data;
 1370         struct mbuf *mprot;
 1371         int protrate, ackrate, pktlen, flags, isshort, error;
 1372         uint16_t dur;
 1373         bus_dma_segment_t segs[RT2661_MAX_SCATTER];
 1374         int nsegs;
 1375 
 1376         KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
 1377             ("protection %d", prot));
 1378 
 1379         wh = mtod(m, const struct ieee80211_frame *);
 1380         pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
 1381 
 1382         protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
 1383         ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
 1384 
 1385         isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
 1386         dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort)
 1387             + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
 1388         flags = RT2661_TX_MORE_FRAG;
 1389         if (prot == IEEE80211_PROT_RTSCTS) {
 1390                 /* NB: CTS is the same size as an ACK */
 1391                 dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
 1392                 flags |= RT2661_TX_NEED_ACK;
 1393                 mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
 1394         } else {
 1395                 mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
 1396         }
 1397         if (mprot == NULL) {
 1398                 /* XXX stat + msg */
 1399                 return ENOBUFS;
 1400         }
 1401 
 1402         data = &txq->data[txq->cur];
 1403         desc = &txq->desc[txq->cur];
 1404 
 1405         error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, mprot, segs,
 1406             &nsegs, 0);
 1407         if (error != 0) {
 1408                 device_printf(sc->sc_dev,
 1409                     "could not map mbuf (error %d)\n", error);
 1410                 m_freem(mprot);
 1411                 return error;
 1412         }
 1413 
 1414         data->m = mprot;
 1415         data->ni = ieee80211_ref_node(ni);
 1416         /* ctl frames are not taken into account for amrr */
 1417         data->rix = IEEE80211_FIXED_RATE_NONE;
 1418 
 1419         rt2661_setup_tx_desc(sc, desc, flags, 0, mprot->m_pkthdr.len,
 1420             protrate, segs, 1, ac);
 1421 
 1422         bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 1423         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
 1424 
 1425         txq->queued++;
 1426         txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1427 
 1428         return 0;
 1429 }
 1430 
 1431 static int
 1432 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
 1433     struct ieee80211_node *ni, int ac)
 1434 {
 1435         struct ieee80211vap *vap = ni->ni_vap;
 1436         struct ieee80211com *ic = &sc->sc_ic;
 1437         struct rt2661_tx_ring *txq = &sc->txq[ac];
 1438         struct rt2661_tx_desc *desc;
 1439         struct rt2661_tx_data *data;
 1440         struct ieee80211_frame *wh;
 1441         const struct ieee80211_txparam *tp;
 1442         struct ieee80211_key *k;
 1443         const struct chanAccParams *cap;
 1444         struct mbuf *mnew;
 1445         bus_dma_segment_t segs[RT2661_MAX_SCATTER];
 1446         uint16_t dur;
 1447         uint32_t flags;
 1448         int error, nsegs, rate, noack = 0;
 1449 
 1450         wh = mtod(m0, struct ieee80211_frame *);
 1451 
 1452         tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
 1453         if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1454                 rate = tp->mcastrate;
 1455         } else if (m0->m_flags & M_EAPOL) {
 1456                 rate = tp->mgmtrate;
 1457         } else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
 1458                 rate = tp->ucastrate;
 1459         } else {
 1460                 (void) ieee80211_ratectl_rate(ni, NULL, 0);
 1461                 rate = ni->ni_txrate;
 1462         }
 1463         rate &= IEEE80211_RATE_VAL;
 1464 
 1465         if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
 1466                 cap = &ic->ic_wme.wme_chanParams;
 1467                 noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
 1468         }
 1469 
 1470         if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
 1471                 k = ieee80211_crypto_encap(ni, m0);
 1472                 if (k == NULL) {
 1473                         m_freem(m0);
 1474                         return ENOBUFS;
 1475                 }
 1476 
 1477                 /* packet header may have moved, reset our local pointer */
 1478                 wh = mtod(m0, struct ieee80211_frame *);
 1479         }
 1480 
 1481         flags = 0;
 1482         if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1483                 int prot = IEEE80211_PROT_NONE;
 1484                 if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
 1485                         prot = IEEE80211_PROT_RTSCTS;
 1486                 else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
 1487                     ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM)
 1488                         prot = ic->ic_protmode;
 1489                 if (prot != IEEE80211_PROT_NONE) {
 1490                         error = rt2661_sendprot(sc, ac, m0, ni, prot, rate);
 1491                         if (error) {
 1492                                 m_freem(m0);
 1493                                 return error;
 1494                         }
 1495                         flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS;
 1496                 }
 1497         }
 1498 
 1499         data = &txq->data[txq->cur];
 1500         desc = &txq->desc[txq->cur];
 1501 
 1502         error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, m0, segs,
 1503             &nsegs, 0);
 1504         if (error != 0 && error != EFBIG) {
 1505                 device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
 1506                     error);
 1507                 m_freem(m0);
 1508                 return error;
 1509         }
 1510         if (error != 0) {
 1511                 mnew = m_defrag(m0, M_NOWAIT);
 1512                 if (mnew == NULL) {
 1513                         device_printf(sc->sc_dev,
 1514                             "could not defragment mbuf\n");
 1515                         m_freem(m0);
 1516                         return ENOBUFS;
 1517                 }
 1518                 m0 = mnew;
 1519 
 1520                 error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, m0,
 1521                     segs, &nsegs, 0);
 1522                 if (error != 0) {
 1523                         device_printf(sc->sc_dev,
 1524                             "could not map mbuf (error %d)\n", error);
 1525                         m_freem(m0);
 1526                         return error;
 1527                 }
 1528 
 1529                 /* packet header have moved, reset our local pointer */
 1530                 wh = mtod(m0, struct ieee80211_frame *);
 1531         }
 1532 
 1533         if (ieee80211_radiotap_active_vap(vap)) {
 1534                 struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
 1535 
 1536                 tap->wt_flags = 0;
 1537                 tap->wt_rate = rate;
 1538 
 1539                 ieee80211_radiotap_tx(vap, m0);
 1540         }
 1541 
 1542         data->m = m0;
 1543         data->ni = ni;
 1544 
 1545         /* remember link conditions for rate adaptation algorithm */
 1546         if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
 1547                 data->rix = ni->ni_txrate;
 1548                 /* XXX probably need last rssi value and not avg */
 1549                 data->rssi = ic->ic_node_getrssi(ni);
 1550         } else
 1551                 data->rix = IEEE80211_FIXED_RATE_NONE;
 1552 
 1553         if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
 1554                 flags |= RT2661_TX_NEED_ACK;
 1555 
 1556                 dur = ieee80211_ack_duration(ic->ic_rt,
 1557                     rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
 1558                 *(uint16_t *)wh->i_dur = htole16(dur);
 1559         }
 1560 
 1561         rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate, segs,
 1562             nsegs, ac);
 1563 
 1564         bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
 1565         bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
 1566 
 1567         DPRINTFN(sc, 10, "sending data frame len=%u idx=%u rate=%u\n",
 1568             m0->m_pkthdr.len, txq->cur, rate);
 1569 
 1570         /* kick Tx */
 1571         txq->queued++;
 1572         txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
 1573         RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1 << ac);
 1574 
 1575         return 0;
 1576 }
 1577 
 1578 static int
 1579 rt2661_transmit(struct ieee80211com *ic, struct mbuf *m)   
 1580 {
 1581         struct rt2661_softc *sc = ic->ic_softc;
 1582         int error;
 1583 
 1584         RAL_LOCK(sc);
 1585         if ((sc->sc_flags & RAL_RUNNING) == 0) {
 1586                 RAL_UNLOCK(sc);
 1587                 return (ENXIO);
 1588         }
 1589         error = mbufq_enqueue(&sc->sc_snd, m);
 1590         if (error) {
 1591                 RAL_UNLOCK(sc);
 1592                 return (error);
 1593         }
 1594         rt2661_start(sc);
 1595         RAL_UNLOCK(sc);
 1596 
 1597         return (0);
 1598 }
 1599 
 1600 static void
 1601 rt2661_start(struct rt2661_softc *sc)
 1602 {
 1603         struct mbuf *m;
 1604         struct ieee80211_node *ni;
 1605         int ac;
 1606 
 1607         RAL_LOCK_ASSERT(sc);
 1608 
 1609         /* prevent management frames from being sent if we're not ready */
 1610         if (!(sc->sc_flags & RAL_RUNNING) || sc->sc_invalid)
 1611                 return;
 1612 
 1613         while ((m = mbufq_dequeue(&sc->sc_snd)) != NULL) {
 1614                 ac = M_WME_GETAC(m);
 1615                 if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
 1616                         /* there is no place left in this ring */
 1617                         mbufq_prepend(&sc->sc_snd, m);
 1618                         break;
 1619                 }
 1620                 ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
 1621                 if (rt2661_tx_data(sc, m, ni, ac) != 0) {
 1622                         ieee80211_free_node(ni);
 1623                         if_inc_counter(ni->ni_vap->iv_ifp,
 1624                             IFCOUNTER_OERRORS, 1);
 1625                         break;
 1626                 }
 1627                 sc->sc_tx_timer = 5;
 1628         }
 1629 }
 1630 
 1631 static int
 1632 rt2661_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
 1633         const struct ieee80211_bpf_params *params)
 1634 {
 1635         struct ieee80211com *ic = ni->ni_ic;
 1636         struct rt2661_softc *sc = ic->ic_softc;
 1637 
 1638         RAL_LOCK(sc);
 1639 
 1640         /* prevent management frames from being sent if we're not ready */
 1641         if (!(sc->sc_flags & RAL_RUNNING)) {
 1642                 RAL_UNLOCK(sc);
 1643                 m_freem(m);
 1644                 return ENETDOWN;
 1645         }
 1646         if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
 1647                 RAL_UNLOCK(sc);
 1648                 m_freem(m);
 1649                 return ENOBUFS;         /* XXX */
 1650         }
 1651 
 1652         /*
 1653          * Legacy path; interpret frame contents to decide
 1654          * precisely how to send the frame.
 1655          * XXX raw path
 1656          */
 1657         if (rt2661_tx_mgt(sc, m, ni) != 0)
 1658                 goto bad;
 1659         sc->sc_tx_timer = 5;
 1660 
 1661         RAL_UNLOCK(sc);
 1662 
 1663         return 0;
 1664 bad:
 1665         RAL_UNLOCK(sc);
 1666         return EIO;             /* XXX */
 1667 }
 1668 
 1669 static void
 1670 rt2661_watchdog(void *arg)
 1671 {
 1672         struct rt2661_softc *sc = (struct rt2661_softc *)arg;
 1673 
 1674         RAL_LOCK_ASSERT(sc);
 1675 
 1676         KASSERT(sc->sc_flags & RAL_RUNNING, ("not running"));
 1677 
 1678         if (sc->sc_invalid)             /* card ejected */
 1679                 return;
 1680 
 1681         if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
 1682                 device_printf(sc->sc_dev, "device timeout\n");
 1683                 rt2661_init_locked(sc);
 1684                 counter_u64_add(sc->sc_ic.ic_oerrors, 1);
 1685                 /* NB: callout is reset in rt2661_init() */
 1686                 return;
 1687         }
 1688         callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog, sc);
 1689 }
 1690 
 1691 static void
 1692 rt2661_parent(struct ieee80211com *ic)
 1693 {
 1694         struct rt2661_softc *sc = ic->ic_softc;
 1695         int startall = 0;
 1696 
 1697         RAL_LOCK(sc);
 1698         if (ic->ic_nrunning > 0) {
 1699                 if ((sc->sc_flags & RAL_RUNNING) == 0) {
 1700                         rt2661_init_locked(sc);
 1701                         startall = 1;
 1702                 } else
 1703                         rt2661_update_promisc(ic);
 1704         } else if (sc->sc_flags & RAL_RUNNING)
 1705                 rt2661_stop_locked(sc);
 1706         RAL_UNLOCK(sc);
 1707         if (startall)
 1708                 ieee80211_start_all(ic);
 1709 }
 1710 
 1711 static void
 1712 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
 1713 {
 1714         uint32_t tmp;
 1715         int ntries;
 1716 
 1717         for (ntries = 0; ntries < 100; ntries++) {
 1718                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 1719                         break;
 1720                 DELAY(1);
 1721         }
 1722         if (ntries == 100) {
 1723                 device_printf(sc->sc_dev, "could not write to BBP\n");
 1724                 return;
 1725         }
 1726 
 1727         tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
 1728         RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
 1729 
 1730         DPRINTFN(sc, 15, "BBP R%u <- 0x%02x\n", reg, val);
 1731 }
 1732 
 1733 static uint8_t
 1734 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
 1735 {
 1736         uint32_t val;
 1737         int ntries;
 1738 
 1739         for (ntries = 0; ntries < 100; ntries++) {
 1740                 if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
 1741                         break;
 1742                 DELAY(1);
 1743         }
 1744         if (ntries == 100) {
 1745                 device_printf(sc->sc_dev, "could not read from BBP\n");
 1746                 return 0;
 1747         }
 1748 
 1749         val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
 1750         RAL_WRITE(sc, RT2661_PHY_CSR3, val);
 1751 
 1752         for (ntries = 0; ntries < 100; ntries++) {
 1753                 val = RAL_READ(sc, RT2661_PHY_CSR3);
 1754                 if (!(val & RT2661_BBP_BUSY))
 1755                         return val & 0xff;
 1756                 DELAY(1);
 1757         }
 1758 
 1759         device_printf(sc->sc_dev, "could not read from BBP\n");
 1760         return 0;
 1761 }
 1762 
 1763 static void
 1764 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
 1765 {
 1766         uint32_t tmp;
 1767         int ntries;
 1768 
 1769         for (ntries = 0; ntries < 100; ntries++) {
 1770                 if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
 1771                         break;
 1772                 DELAY(1);
 1773         }
 1774         if (ntries == 100) {
 1775                 device_printf(sc->sc_dev, "could not write to RF\n");
 1776                 return;
 1777         }
 1778 
 1779         tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
 1780             (reg & 3);
 1781         RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
 1782 
 1783         /* remember last written value in sc */
 1784         sc->rf_regs[reg] = val;
 1785 
 1786         DPRINTFN(sc, 15, "RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff);
 1787 }
 1788 
 1789 static int
 1790 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
 1791 {
 1792         if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
 1793                 return EIO;     /* there is already a command pending */
 1794 
 1795         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
 1796             RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
 1797 
 1798         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
 1799 
 1800         return 0;
 1801 }
 1802 
 1803 static void
 1804 rt2661_select_antenna(struct rt2661_softc *sc)
 1805 {
 1806         uint8_t bbp4, bbp77;
 1807         uint32_t tmp;
 1808 
 1809         bbp4  = rt2661_bbp_read(sc,  4);
 1810         bbp77 = rt2661_bbp_read(sc, 77);
 1811 
 1812         /* TBD */
 1813 
 1814         /* make sure Rx is disabled before switching antenna */
 1815         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 1816         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 1817 
 1818         rt2661_bbp_write(sc,  4, bbp4);
 1819         rt2661_bbp_write(sc, 77, bbp77);
 1820 
 1821         /* restore Rx filter */
 1822         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 1823 }
 1824 
 1825 /*
 1826  * Enable multi-rate retries for frames sent at OFDM rates.
 1827  * In 802.11b/g mode, allow fallback to CCK rates.
 1828  */
 1829 static void
 1830 rt2661_enable_mrr(struct rt2661_softc *sc)
 1831 {
 1832         struct ieee80211com *ic = &sc->sc_ic;
 1833         uint32_t tmp;
 1834 
 1835         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 1836 
 1837         tmp &= ~RT2661_MRR_CCK_FALLBACK;
 1838         if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan))
 1839                 tmp |= RT2661_MRR_CCK_FALLBACK;
 1840         tmp |= RT2661_MRR_ENABLED;
 1841 
 1842         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 1843 }
 1844 
 1845 static void
 1846 rt2661_set_txpreamble(struct rt2661_softc *sc)
 1847 {
 1848         struct ieee80211com *ic = &sc->sc_ic;
 1849         uint32_t tmp;
 1850 
 1851         tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
 1852 
 1853         tmp &= ~RT2661_SHORT_PREAMBLE;
 1854         if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
 1855                 tmp |= RT2661_SHORT_PREAMBLE;
 1856 
 1857         RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
 1858 }
 1859 
 1860 static void
 1861 rt2661_set_basicrates(struct rt2661_softc *sc,
 1862     const struct ieee80211_rateset *rs)
 1863 {
 1864         struct ieee80211com *ic = &sc->sc_ic;
 1865         uint32_t mask = 0;
 1866         uint8_t rate;
 1867         int i;
 1868 
 1869         for (i = 0; i < rs->rs_nrates; i++) {
 1870                 rate = rs->rs_rates[i];
 1871 
 1872                 if (!(rate & IEEE80211_RATE_BASIC))
 1873                         continue;
 1874 
 1875                 mask |= 1 << ieee80211_legacy_rate_lookup(ic->ic_rt,
 1876                     IEEE80211_RV(rate));
 1877         }
 1878 
 1879         RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
 1880 
 1881         DPRINTF(sc, "Setting basic rate mask to 0x%x\n", mask);
 1882 }
 1883 
 1884 /*
 1885  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
 1886  * driver.
 1887  */
 1888 static void
 1889 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
 1890 {
 1891         uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
 1892         uint32_t tmp;
 1893 
 1894         /* update all BBP registers that depend on the band */
 1895         bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
 1896         bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
 1897         if (IEEE80211_IS_CHAN_5GHZ(c)) {
 1898                 bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
 1899                 bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
 1900         }
 1901         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 1902             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 1903                 bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
 1904         }
 1905 
 1906         rt2661_bbp_write(sc,  17, bbp17);
 1907         rt2661_bbp_write(sc,  96, bbp96);
 1908         rt2661_bbp_write(sc, 104, bbp104);
 1909 
 1910         if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
 1911             (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
 1912                 rt2661_bbp_write(sc, 75, 0x80);
 1913                 rt2661_bbp_write(sc, 86, 0x80);
 1914                 rt2661_bbp_write(sc, 88, 0x80);
 1915         }
 1916 
 1917         rt2661_bbp_write(sc, 35, bbp35);
 1918         rt2661_bbp_write(sc, 97, bbp97);
 1919         rt2661_bbp_write(sc, 98, bbp98);
 1920 
 1921         tmp = RAL_READ(sc, RT2661_PHY_CSR0);
 1922         tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
 1923         if (IEEE80211_IS_CHAN_2GHZ(c))
 1924                 tmp |= RT2661_PA_PE_2GHZ;
 1925         else
 1926                 tmp |= RT2661_PA_PE_5GHZ;
 1927         RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
 1928 }
 1929 
 1930 static void
 1931 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
 1932 {
 1933         struct ieee80211com *ic = &sc->sc_ic;
 1934         const struct rfprog *rfprog;
 1935         uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
 1936         int8_t power;
 1937         u_int i, chan;
 1938 
 1939         chan = ieee80211_chan2ieee(ic, c);
 1940         KASSERT(chan != 0 && chan != IEEE80211_CHAN_ANY, ("chan 0x%x", chan));
 1941 
 1942         /* select the appropriate RF settings based on what EEPROM says */
 1943         rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
 1944 
 1945         /* find the settings for this channel (we know it exists) */
 1946         for (i = 0; rfprog[i].chan != chan; i++);
 1947 
 1948         power = sc->txpow[i];
 1949         if (power < 0) {
 1950                 bbp94 += power;
 1951                 power = 0;
 1952         } else if (power > 31) {
 1953                 bbp94 += power - 31;
 1954                 power = 31;
 1955         }
 1956 
 1957         /*
 1958          * If we are switching from the 2GHz band to the 5GHz band or
 1959          * vice-versa, BBP registers need to be reprogrammed.
 1960          */
 1961         if (c->ic_flags != sc->sc_curchan->ic_flags) {
 1962                 rt2661_select_band(sc, c);
 1963                 rt2661_select_antenna(sc);
 1964         }
 1965         sc->sc_curchan = c;
 1966 
 1967         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 1968         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 1969         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 1970         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 1971 
 1972         DELAY(200);
 1973 
 1974         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 1975         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 1976         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
 1977         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 1978 
 1979         DELAY(200);
 1980 
 1981         rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
 1982         rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
 1983         rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
 1984         rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
 1985 
 1986         /* enable smart mode for MIMO-capable RFs */
 1987         bbp3 = rt2661_bbp_read(sc, 3);
 1988 
 1989         bbp3 &= ~RT2661_SMART_MODE;
 1990         if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
 1991                 bbp3 |= RT2661_SMART_MODE;
 1992 
 1993         rt2661_bbp_write(sc, 3, bbp3);
 1994 
 1995         if (bbp94 != RT2661_BBPR94_DEFAULT)
 1996                 rt2661_bbp_write(sc, 94, bbp94);
 1997 
 1998         /* 5GHz radio needs a 1ms delay here */
 1999         if (IEEE80211_IS_CHAN_5GHZ(c))
 2000                 DELAY(1000);
 2001 }
 2002 
 2003 static void
 2004 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
 2005 {
 2006         uint32_t tmp;
 2007 
 2008         tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
 2009         RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
 2010 
 2011         tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
 2012         RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
 2013 }
 2014 
 2015 static void
 2016 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
 2017 {
 2018         uint32_t tmp;
 2019 
 2020         tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
 2021         RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
 2022 
 2023         tmp = addr[4] | addr[5] << 8;
 2024         RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
 2025 }
 2026 
 2027 static void
 2028 rt2661_update_promisc(struct ieee80211com *ic)
 2029 {
 2030         struct rt2661_softc *sc = ic->ic_softc;
 2031         uint32_t tmp;
 2032 
 2033         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2034 
 2035         tmp &= ~RT2661_DROP_NOT_TO_ME;
 2036         if (ic->ic_promisc == 0)
 2037                 tmp |= RT2661_DROP_NOT_TO_ME;
 2038 
 2039         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2040 
 2041         DPRINTF(sc, "%s promiscuous mode\n",
 2042             (ic->ic_promisc > 0) ?  "entering" : "leaving");
 2043 }
 2044 
 2045 /*
 2046  * Update QoS (802.11e) settings for each h/w Tx ring.
 2047  */
 2048 static int
 2049 rt2661_wme_update(struct ieee80211com *ic)
 2050 {
 2051         struct rt2661_softc *sc = ic->ic_softc;
 2052         const struct wmeParams *wmep;
 2053 
 2054         wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
 2055 
 2056         /* XXX: not sure about shifts. */
 2057         /* XXX: the reference driver plays with AC_VI settings too. */
 2058 
 2059         /* update TxOp */
 2060         RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
 2061             wmep[WME_AC_BE].wmep_txopLimit << 16 |
 2062             wmep[WME_AC_BK].wmep_txopLimit);
 2063         RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
 2064             wmep[WME_AC_VI].wmep_txopLimit << 16 |
 2065             wmep[WME_AC_VO].wmep_txopLimit);
 2066 
 2067         /* update CWmin */
 2068         RAL_WRITE(sc, RT2661_CWMIN_CSR,
 2069             wmep[WME_AC_BE].wmep_logcwmin << 12 |
 2070             wmep[WME_AC_BK].wmep_logcwmin <<  8 |
 2071             wmep[WME_AC_VI].wmep_logcwmin <<  4 |
 2072             wmep[WME_AC_VO].wmep_logcwmin);
 2073 
 2074         /* update CWmax */
 2075         RAL_WRITE(sc, RT2661_CWMAX_CSR,
 2076             wmep[WME_AC_BE].wmep_logcwmax << 12 |
 2077             wmep[WME_AC_BK].wmep_logcwmax <<  8 |
 2078             wmep[WME_AC_VI].wmep_logcwmax <<  4 |
 2079             wmep[WME_AC_VO].wmep_logcwmax);
 2080 
 2081         /* update Aifsn */
 2082         RAL_WRITE(sc, RT2661_AIFSN_CSR,
 2083             wmep[WME_AC_BE].wmep_aifsn << 12 |
 2084             wmep[WME_AC_BK].wmep_aifsn <<  8 |
 2085             wmep[WME_AC_VI].wmep_aifsn <<  4 |
 2086             wmep[WME_AC_VO].wmep_aifsn);
 2087 
 2088         return 0;
 2089 }
 2090 
 2091 static void
 2092 rt2661_update_slot(struct ieee80211com *ic)
 2093 {
 2094         struct rt2661_softc *sc = ic->ic_softc;
 2095         uint8_t slottime;
 2096         uint32_t tmp;
 2097 
 2098         slottime = IEEE80211_GET_SLOTTIME(ic);
 2099 
 2100         tmp = RAL_READ(sc, RT2661_MAC_CSR9);
 2101         tmp = (tmp & ~0xff) | slottime;
 2102         RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
 2103 }
 2104 
 2105 static const char *
 2106 rt2661_get_rf(int rev)
 2107 {
 2108         switch (rev) {
 2109         case RT2661_RF_5225:    return "RT5225";
 2110         case RT2661_RF_5325:    return "RT5325 (MIMO XR)";
 2111         case RT2661_RF_2527:    return "RT2527";
 2112         case RT2661_RF_2529:    return "RT2529 (MIMO XR)";
 2113         default:                return "unknown";
 2114         }
 2115 }
 2116 
 2117 static void
 2118 rt2661_read_eeprom(struct rt2661_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
 2119 {
 2120         uint16_t val;
 2121         int i;
 2122 
 2123         /* read MAC address */
 2124         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
 2125         macaddr[0] = val & 0xff;
 2126         macaddr[1] = val >> 8;
 2127 
 2128         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
 2129         macaddr[2] = val & 0xff;
 2130         macaddr[3] = val >> 8;
 2131 
 2132         val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
 2133         macaddr[4] = val & 0xff;
 2134         macaddr[5] = val >> 8;
 2135 
 2136         val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
 2137         /* XXX: test if different from 0xffff? */
 2138         sc->rf_rev   = (val >> 11) & 0x1f;
 2139         sc->hw_radio = (val >> 10) & 0x1;
 2140         sc->rx_ant   = (val >> 4)  & 0x3;
 2141         sc->tx_ant   = (val >> 2)  & 0x3;
 2142         sc->nb_ant   = val & 0x3;
 2143 
 2144         DPRINTF(sc, "RF revision=%d\n", sc->rf_rev);
 2145 
 2146         val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
 2147         sc->ext_5ghz_lna = (val >> 6) & 0x1;
 2148         sc->ext_2ghz_lna = (val >> 4) & 0x1;
 2149 
 2150         DPRINTF(sc, "External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
 2151             sc->ext_2ghz_lna, sc->ext_5ghz_lna);
 2152 
 2153         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
 2154         if ((val & 0xff) != 0xff)
 2155                 sc->rssi_2ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2156 
 2157         /* Only [-10, 10] is valid */
 2158         if (sc->rssi_2ghz_corr < -10 || sc->rssi_2ghz_corr > 10)
 2159                 sc->rssi_2ghz_corr = 0;
 2160 
 2161         val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
 2162         if ((val & 0xff) != 0xff)
 2163                 sc->rssi_5ghz_corr = (int8_t)(val & 0xff);      /* signed */
 2164 
 2165         /* Only [-10, 10] is valid */
 2166         if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
 2167                 sc->rssi_5ghz_corr = 0;
 2168 
 2169         /* adjust RSSI correction for external low-noise amplifier */
 2170         if (sc->ext_2ghz_lna)
 2171                 sc->rssi_2ghz_corr -= 14;
 2172         if (sc->ext_5ghz_lna)
 2173                 sc->rssi_5ghz_corr -= 14;
 2174 
 2175         DPRINTF(sc, "RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
 2176             sc->rssi_2ghz_corr, sc->rssi_5ghz_corr);
 2177 
 2178         val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
 2179         if ((val >> 8) != 0xff)
 2180                 sc->rfprog = (val >> 8) & 0x3;
 2181         if ((val & 0xff) != 0xff)
 2182                 sc->rffreq = val & 0xff;
 2183 
 2184         DPRINTF(sc, "RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq);
 2185 
 2186         /* read Tx power for all a/b/g channels */
 2187         for (i = 0; i < 19; i++) {
 2188                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
 2189                 sc->txpow[i * 2] = (int8_t)(val >> 8);          /* signed */
 2190                 DPRINTF(sc, "Channel=%d Tx power=%d\n",
 2191                     rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]);
 2192                 sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);    /* signed */
 2193                 DPRINTF(sc, "Channel=%d Tx power=%d\n",
 2194                     rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]);
 2195         }
 2196 
 2197         /* read vendor-specific BBP values */
 2198         for (i = 0; i < 16; i++) {
 2199                 val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
 2200                 if (val == 0 || val == 0xffff)
 2201                         continue;       /* skip invalid entries */
 2202                 sc->bbp_prom[i].reg = val >> 8;
 2203                 sc->bbp_prom[i].val = val & 0xff;
 2204                 DPRINTF(sc, "BBP R%d=%02x\n", sc->bbp_prom[i].reg,
 2205                     sc->bbp_prom[i].val);
 2206         }
 2207 }
 2208 
 2209 static int
 2210 rt2661_bbp_init(struct rt2661_softc *sc)
 2211 {
 2212         int i, ntries;
 2213         uint8_t val;
 2214 
 2215         /* wait for BBP to be ready */
 2216         for (ntries = 0; ntries < 100; ntries++) {
 2217                 val = rt2661_bbp_read(sc, 0);
 2218                 if (val != 0 && val != 0xff)
 2219                         break;
 2220                 DELAY(100);
 2221         }
 2222         if (ntries == 100) {
 2223                 device_printf(sc->sc_dev, "timeout waiting for BBP\n");
 2224                 return EIO;
 2225         }
 2226 
 2227         /* initialize BBP registers to default values */
 2228         for (i = 0; i < nitems(rt2661_def_bbp); i++) {
 2229                 rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
 2230                     rt2661_def_bbp[i].val);
 2231         }
 2232 
 2233         /* write vendor-specific BBP values (from EEPROM) */
 2234         for (i = 0; i < 16; i++) {
 2235                 if (sc->bbp_prom[i].reg == 0)
 2236                         continue;
 2237                 rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
 2238         }
 2239 
 2240         return 0;
 2241 }
 2242 
 2243 static void
 2244 rt2661_init_locked(struct rt2661_softc *sc)
 2245 {
 2246         struct ieee80211com *ic = &sc->sc_ic;
 2247         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 2248         uint32_t tmp, sta[3];
 2249         int i, error, ntries;
 2250 
 2251         RAL_LOCK_ASSERT(sc);
 2252 
 2253         if ((sc->sc_flags & RAL_FW_LOADED) == 0) {
 2254                 error = rt2661_load_microcode(sc);
 2255                 if (error != 0) {
 2256                         device_printf(sc->sc_dev,
 2257                             "%s: could not load 8051 microcode, error %d\n",
 2258                             __func__, error);
 2259                         return;
 2260                 }
 2261                 sc->sc_flags |= RAL_FW_LOADED;
 2262         }
 2263 
 2264         rt2661_stop_locked(sc);
 2265 
 2266         /* initialize Tx rings */
 2267         RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
 2268         RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
 2269         RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
 2270         RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
 2271 
 2272         /* initialize Mgt ring */
 2273         RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
 2274 
 2275         /* initialize Rx ring */
 2276         RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
 2277 
 2278         /* initialize Tx rings sizes */
 2279         RAL_WRITE(sc, RT2661_TX_RING_CSR0,
 2280             RT2661_TX_RING_COUNT << 24 |
 2281             RT2661_TX_RING_COUNT << 16 |
 2282             RT2661_TX_RING_COUNT <<  8 |
 2283             RT2661_TX_RING_COUNT);
 2284 
 2285         RAL_WRITE(sc, RT2661_TX_RING_CSR1,
 2286             RT2661_TX_DESC_WSIZE << 16 |
 2287             RT2661_TX_RING_COUNT <<  8 |        /* XXX: HCCA ring unused */
 2288             RT2661_MGT_RING_COUNT);
 2289 
 2290         /* initialize Rx rings */
 2291         RAL_WRITE(sc, RT2661_RX_RING_CSR,
 2292             RT2661_RX_DESC_BACK  << 16 |
 2293             RT2661_RX_DESC_WSIZE <<  8 |
 2294             RT2661_RX_RING_COUNT);
 2295 
 2296         /* XXX: some magic here */
 2297         RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
 2298 
 2299         /* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
 2300         RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
 2301 
 2302         /* load base address of Rx ring */
 2303         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
 2304 
 2305         /* initialize MAC registers to default values */
 2306         for (i = 0; i < nitems(rt2661_def_mac); i++)
 2307                 RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
 2308 
 2309         rt2661_set_macaddr(sc, vap ? vap->iv_myaddr : ic->ic_macaddr);
 2310 
 2311         /* set host ready */
 2312         RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2313         RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2314 
 2315         /* wait for BBP/RF to wakeup */
 2316         for (ntries = 0; ntries < 1000; ntries++) {
 2317                 if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
 2318                         break;
 2319                 DELAY(1000);
 2320         }
 2321         if (ntries == 1000) {
 2322                 printf("timeout waiting for BBP/RF to wakeup\n");
 2323                 rt2661_stop_locked(sc);
 2324                 return;
 2325         }
 2326 
 2327         if (rt2661_bbp_init(sc) != 0) {
 2328                 rt2661_stop_locked(sc);
 2329                 return;
 2330         }
 2331 
 2332         /* select default channel */
 2333         sc->sc_curchan = ic->ic_curchan;
 2334         rt2661_select_band(sc, sc->sc_curchan);
 2335         rt2661_select_antenna(sc);
 2336         rt2661_set_chan(sc, sc->sc_curchan);
 2337 
 2338         /* update Rx filter */
 2339         tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
 2340 
 2341         tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
 2342         if (ic->ic_opmode != IEEE80211_M_MONITOR) {
 2343                 tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
 2344                        RT2661_DROP_ACKCTS;
 2345                 if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
 2346                     ic->ic_opmode != IEEE80211_M_MBSS)
 2347                         tmp |= RT2661_DROP_TODS;
 2348                 if (ic->ic_promisc == 0)
 2349                         tmp |= RT2661_DROP_NOT_TO_ME;
 2350         }
 2351 
 2352         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2353 
 2354         /* clear STA registers */
 2355         RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, nitems(sta));
 2356 
 2357         /* initialize ASIC */
 2358         RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
 2359 
 2360         /* clear any pending interrupt */
 2361         RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2362 
 2363         /* enable interrupts */
 2364         RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
 2365         RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
 2366 
 2367         /* kick Rx */
 2368         RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
 2369 
 2370         sc->sc_flags |= RAL_RUNNING;
 2371 
 2372         callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog, sc);
 2373 }
 2374 
 2375 static void
 2376 rt2661_init(void *priv)
 2377 {
 2378         struct rt2661_softc *sc = priv;
 2379         struct ieee80211com *ic = &sc->sc_ic;
 2380 
 2381         RAL_LOCK(sc);
 2382         rt2661_init_locked(sc);
 2383         RAL_UNLOCK(sc);
 2384 
 2385         if (sc->sc_flags & RAL_RUNNING)
 2386                 ieee80211_start_all(ic);                /* start all vap's */
 2387 }
 2388 
 2389 void
 2390 rt2661_stop_locked(struct rt2661_softc *sc)
 2391 {
 2392         volatile int *flags = &sc->sc_flags;
 2393         uint32_t tmp;
 2394 
 2395         while (*flags & RAL_INPUT_RUNNING)
 2396                 msleep(sc, &sc->sc_mtx, 0, "ralrunning", hz/10);
 2397 
 2398         callout_stop(&sc->watchdog_ch);
 2399         sc->sc_tx_timer = 0;
 2400 
 2401         if (sc->sc_flags & RAL_RUNNING) {
 2402                 sc->sc_flags &= ~RAL_RUNNING;
 2403 
 2404                 /* abort Tx (for all 5 Tx rings) */
 2405                 RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
 2406                 
 2407                 /* disable Rx (value remains after reset!) */
 2408                 tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2409                 RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2410                 
 2411                 /* reset ASIC */
 2412                 RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
 2413                 RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
 2414                 
 2415                 /* disable interrupts */
 2416                 RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffffff);
 2417                 RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
 2418                 
 2419                 /* clear any pending interrupt */
 2420                 RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
 2421                 RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
 2422                 
 2423                 /* reset Tx and Rx rings */
 2424                 rt2661_reset_tx_ring(sc, &sc->txq[0]);
 2425                 rt2661_reset_tx_ring(sc, &sc->txq[1]);
 2426                 rt2661_reset_tx_ring(sc, &sc->txq[2]);
 2427                 rt2661_reset_tx_ring(sc, &sc->txq[3]);
 2428                 rt2661_reset_tx_ring(sc, &sc->mgtq);
 2429                 rt2661_reset_rx_ring(sc, &sc->rxq);
 2430         }
 2431 }
 2432 
 2433 void
 2434 rt2661_stop(void *priv)
 2435 {
 2436         struct rt2661_softc *sc = priv;
 2437 
 2438         RAL_LOCK(sc);
 2439         rt2661_stop_locked(sc);
 2440         RAL_UNLOCK(sc);
 2441 }
 2442 
 2443 static int
 2444 rt2661_load_microcode(struct rt2661_softc *sc)
 2445 {
 2446         const struct firmware *fp;
 2447         const char *imagename;
 2448         int ntries, error;
 2449 
 2450         RAL_LOCK_ASSERT(sc);
 2451 
 2452         switch (sc->sc_id) {
 2453         case 0x0301: imagename = "rt2561sfw"; break;
 2454         case 0x0302: imagename = "rt2561fw"; break;
 2455         case 0x0401: imagename = "rt2661fw"; break;
 2456         default:
 2457                 device_printf(sc->sc_dev, "%s: unexpected pci device id 0x%x, "
 2458                     "don't know how to retrieve firmware\n",
 2459                     __func__, sc->sc_id);
 2460                 return EINVAL;
 2461         }
 2462         RAL_UNLOCK(sc);
 2463         fp = firmware_get(imagename);
 2464         RAL_LOCK(sc);
 2465         if (fp == NULL) {
 2466                 device_printf(sc->sc_dev,
 2467                     "%s: unable to retrieve firmware image %s\n",
 2468                     __func__, imagename);
 2469                 return EINVAL;
 2470         }
 2471 
 2472         /*
 2473          * Load 8051 microcode into NIC.
 2474          */
 2475         /* reset 8051 */
 2476         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2477 
 2478         /* cancel any pending Host to MCU command */
 2479         RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
 2480         RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
 2481         RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
 2482 
 2483         /* write 8051's microcode */
 2484         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
 2485         RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, fp->data, fp->datasize);
 2486         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
 2487 
 2488         /* kick 8051's ass */
 2489         RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
 2490 
 2491         /* wait for 8051 to initialize */
 2492         for (ntries = 0; ntries < 500; ntries++) {
 2493                 if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
 2494                         break;
 2495                 DELAY(100);
 2496         }
 2497         if (ntries == 500) {
 2498                 device_printf(sc->sc_dev,
 2499                     "%s: timeout waiting for MCU to initialize\n", __func__);
 2500                 error = EIO;
 2501         } else
 2502                 error = 0;
 2503 
 2504         firmware_put(fp, FIRMWARE_UNLOAD);
 2505         return error;
 2506 }
 2507 
 2508 #ifdef notyet
 2509 /*
 2510  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
 2511  * false CCA count.  This function is called periodically (every seconds) when
 2512  * in the RUN state.  Values taken from the reference driver.
 2513  */
 2514 static void
 2515 rt2661_rx_tune(struct rt2661_softc *sc)
 2516 {
 2517         uint8_t bbp17;
 2518         uint16_t cca;
 2519         int lo, hi, dbm;
 2520 
 2521         /*
 2522          * Tuning range depends on operating band and on the presence of an
 2523          * external low-noise amplifier.
 2524          */
 2525         lo = 0x20;
 2526         if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
 2527                 lo += 0x08;
 2528         if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
 2529             (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
 2530                 lo += 0x10;
 2531         hi = lo + 0x20;
 2532 
 2533         /* retrieve false CCA count since last call (clear on read) */
 2534         cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
 2535 
 2536         if (dbm >= -35) {
 2537                 bbp17 = 0x60;
 2538         } else if (dbm >= -58) {
 2539                 bbp17 = hi;
 2540         } else if (dbm >= -66) {
 2541                 bbp17 = lo + 0x10;
 2542         } else if (dbm >= -74) {
 2543                 bbp17 = lo + 0x08;
 2544         } else {
 2545                 /* RSSI < -74dBm, tune using false CCA count */
 2546 
 2547                 bbp17 = sc->bbp17; /* current value */
 2548 
 2549                 hi -= 2 * (-74 - dbm);
 2550                 if (hi < lo)
 2551                         hi = lo;
 2552 
 2553                 if (bbp17 > hi) {
 2554                         bbp17 = hi;
 2555 
 2556                 } else if (cca > 512) {
 2557                         if (++bbp17 > hi)
 2558                                 bbp17 = hi;
 2559                 } else if (cca < 100) {
 2560                         if (--bbp17 < lo)
 2561                                 bbp17 = lo;
 2562                 }
 2563         }
 2564 
 2565         if (bbp17 != sc->bbp17) {
 2566                 rt2661_bbp_write(sc, 17, bbp17);
 2567                 sc->bbp17 = bbp17;
 2568         }
 2569 }
 2570 
 2571 /*
 2572  * Enter/Leave radar detection mode.
 2573  * This is for 802.11h additional regulatory domains.
 2574  */
 2575 static void
 2576 rt2661_radar_start(struct rt2661_softc *sc)
 2577 {
 2578         uint32_t tmp;
 2579 
 2580         /* disable Rx */
 2581         tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
 2582         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
 2583 
 2584         rt2661_bbp_write(sc, 82, 0x20);
 2585         rt2661_bbp_write(sc, 83, 0x00);
 2586         rt2661_bbp_write(sc, 84, 0x40);
 2587 
 2588         /* save current BBP registers values */
 2589         sc->bbp18 = rt2661_bbp_read(sc, 18);
 2590         sc->bbp21 = rt2661_bbp_read(sc, 21);
 2591         sc->bbp22 = rt2661_bbp_read(sc, 22);
 2592         sc->bbp16 = rt2661_bbp_read(sc, 16);
 2593         sc->bbp17 = rt2661_bbp_read(sc, 17);
 2594         sc->bbp64 = rt2661_bbp_read(sc, 64);
 2595 
 2596         rt2661_bbp_write(sc, 18, 0xff);
 2597         rt2661_bbp_write(sc, 21, 0x3f);
 2598         rt2661_bbp_write(sc, 22, 0x3f);
 2599         rt2661_bbp_write(sc, 16, 0xbd);
 2600         rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
 2601         rt2661_bbp_write(sc, 64, 0x21);
 2602 
 2603         /* restore Rx filter */
 2604         RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
 2605 }
 2606 
 2607 static int
 2608 rt2661_radar_stop(struct rt2661_softc *sc)
 2609 {
 2610         uint8_t bbp66;
 2611 
 2612         /* read radar detection result */
 2613         bbp66 = rt2661_bbp_read(sc, 66);
 2614 
 2615         /* restore BBP registers values */
 2616         rt2661_bbp_write(sc, 16, sc->bbp16);
 2617         rt2661_bbp_write(sc, 17, sc->bbp17);
 2618         rt2661_bbp_write(sc, 18, sc->bbp18);
 2619         rt2661_bbp_write(sc, 21, sc->bbp21);
 2620         rt2661_bbp_write(sc, 22, sc->bbp22);
 2621         rt2661_bbp_write(sc, 64, sc->bbp64);
 2622 
 2623         return bbp66 == 1;
 2624 }
 2625 #endif
 2626 
 2627 static int
 2628 rt2661_prepare_beacon(struct rt2661_softc *sc, struct ieee80211vap *vap)
 2629 {
 2630         struct ieee80211com *ic = vap->iv_ic;
 2631         struct rt2661_tx_desc desc;
 2632         struct mbuf *m0;
 2633         int rate;
 2634 
 2635         if ((m0 = ieee80211_beacon_alloc(vap->iv_bss))== NULL) {
 2636                 device_printf(sc->sc_dev, "could not allocate beacon frame\n");
 2637                 return ENOBUFS;
 2638         }
 2639 
 2640         /* send beacons at the lowest available rate */
 2641         rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan) ? 12 : 2;
 2642 
 2643         rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
 2644             m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
 2645 
 2646         /* copy the first 24 bytes of Tx descriptor into NIC memory */
 2647         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
 2648 
 2649         /* copy beacon header and payload into NIC memory */
 2650         RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
 2651             mtod(m0, uint8_t *), m0->m_pkthdr.len);
 2652 
 2653         m_freem(m0);
 2654 
 2655         return 0;
 2656 }
 2657 
 2658 /*
 2659  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
 2660  * and HostAP operating modes.
 2661  */
 2662 static void
 2663 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
 2664 {
 2665         struct ieee80211com *ic = &sc->sc_ic;
 2666         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 2667         uint32_t tmp;
 2668 
 2669         if (vap->iv_opmode != IEEE80211_M_STA) {
 2670                 /*
 2671                  * Change default 16ms TBTT adjustment to 8ms.
 2672                  * Must be done before enabling beacon generation.
 2673                  */
 2674                 RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
 2675         }
 2676 
 2677         tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
 2678 
 2679         /* set beacon interval (in 1/16ms unit) */
 2680         tmp |= vap->iv_bss->ni_intval * 16;
 2681 
 2682         tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
 2683         if (vap->iv_opmode == IEEE80211_M_STA)
 2684                 tmp |= RT2661_TSF_MODE(1);
 2685         else
 2686                 tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
 2687 
 2688         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
 2689 }
 2690 
 2691 static void
 2692 rt2661_enable_tsf(struct rt2661_softc *sc)
 2693 {
 2694         RAL_WRITE(sc, RT2661_TXRX_CSR9, 
 2695               (RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000)
 2696             | RT2661_TSF_TICKING | RT2661_TSF_MODE(2));
 2697 }
 2698 
 2699 /*
 2700  * Retrieve the "Received Signal Strength Indicator" from the raw values
 2701  * contained in Rx descriptors.  The computation depends on which band the
 2702  * frame was received.  Correction values taken from the reference driver.
 2703  */
 2704 static int
 2705 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
 2706 {
 2707         int lna, agc, rssi;
 2708 
 2709         lna = (raw >> 5) & 0x3;
 2710         agc = raw & 0x1f;
 2711 
 2712         if (lna == 0) {
 2713                 /*
 2714                  * No mapping available.
 2715                  *
 2716                  * NB: Since RSSI is relative to noise floor, -1 is
 2717                  *     adequate for caller to know error happened.
 2718                  */
 2719                 return -1;
 2720         }
 2721 
 2722         rssi = (2 * agc) - RT2661_NOISE_FLOOR;
 2723 
 2724         if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
 2725                 rssi += sc->rssi_2ghz_corr;
 2726 
 2727                 if (lna == 1)
 2728                         rssi -= 64;
 2729                 else if (lna == 2)
 2730                         rssi -= 74;
 2731                 else if (lna == 3)
 2732                         rssi -= 90;
 2733         } else {
 2734                 rssi += sc->rssi_5ghz_corr;
 2735 
 2736                 if (lna == 1)
 2737                         rssi -= 64;
 2738                 else if (lna == 2)
 2739                         rssi -= 86;
 2740                 else if (lna == 3)
 2741                         rssi -= 100;
 2742         }
 2743         return rssi;
 2744 }
 2745 
 2746 static void
 2747 rt2661_scan_start(struct ieee80211com *ic)
 2748 {
 2749         struct rt2661_softc *sc = ic->ic_softc;
 2750         uint32_t tmp;
 2751 
 2752         /* abort TSF synchronization */
 2753         tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
 2754         RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0xffffff);
 2755         rt2661_set_bssid(sc, ieee80211broadcastaddr);
 2756 }
 2757 
 2758 static void
 2759 rt2661_scan_end(struct ieee80211com *ic)
 2760 {
 2761         struct rt2661_softc *sc = ic->ic_softc;
 2762         struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
 2763 
 2764         rt2661_enable_tsf_sync(sc);
 2765         /* XXX keep local copy */
 2766         rt2661_set_bssid(sc, vap->iv_bss->ni_bssid);
 2767 }
 2768 
 2769 static void
 2770 rt2661_getradiocaps(struct ieee80211com *ic,
 2771     int maxchans, int *nchans, struct ieee80211_channel chans[])
 2772 {
 2773         struct rt2661_softc *sc = ic->ic_softc;
 2774         uint8_t bands[IEEE80211_MODE_BYTES];
 2775 
 2776         memset(bands, 0, sizeof(bands));
 2777         setbit(bands, IEEE80211_MODE_11B);
 2778         setbit(bands, IEEE80211_MODE_11G);
 2779         ieee80211_add_channel_list_2ghz(chans, maxchans, nchans,
 2780             rt2661_chan_2ghz, nitems(rt2661_chan_2ghz), bands, 0);
 2781 
 2782         if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
 2783                 setbit(bands, IEEE80211_MODE_11A);
 2784                 ieee80211_add_channel_list_5ghz(chans, maxchans, nchans,
 2785                     rt2661_chan_5ghz, nitems(rt2661_chan_5ghz), bands, 0);
 2786         }
 2787 }
 2788 
 2789 static void
 2790 rt2661_set_channel(struct ieee80211com *ic)
 2791 {
 2792         struct rt2661_softc *sc = ic->ic_softc;
 2793 
 2794         RAL_LOCK(sc);
 2795         rt2661_set_chan(sc, ic->ic_curchan);
 2796         RAL_UNLOCK(sc);
 2797 
 2798 }

Cache object: d5e60ee3747d117d9c33244d987f33bb


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.