xref: /openbsd/sys/dev/ic/rt2661.c (revision 7b36286a)
1 /*	$OpenBSD: rt2661.c,v 1.44 2008/08/27 09:05:03 damien Exp $	*/
2 
3 /*-
4  * Copyright (c) 2006
5  *	Damien Bergamini <damien.bergamini@free.fr>
6  *
7  * Permission to use, copy, modify, and distribute this software for any
8  * purpose with or without fee is hereby granted, provided that the above
9  * copyright notice and this permission notice appear in all copies.
10  *
11  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18  */
19 
20 /*-
21  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
22  * http://www.ralinktech.com/
23  */
24 
25 #include "bpfilter.h"
26 
27 #include <sys/param.h>
28 #include <sys/sockio.h>
29 #include <sys/sysctl.h>
30 #include <sys/mbuf.h>
31 #include <sys/kernel.h>
32 #include <sys/socket.h>
33 #include <sys/systm.h>
34 #include <sys/malloc.h>
35 #include <sys/timeout.h>
36 #include <sys/conf.h>
37 #include <sys/device.h>
38 
39 #include <machine/bus.h>
40 #include <machine/endian.h>
41 #include <machine/intr.h>
42 
43 #if NBPFILTER > 0
44 #include <net/bpf.h>
45 #endif
46 #include <net/if.h>
47 #include <net/if_arp.h>
48 #include <net/if_dl.h>
49 #include <net/if_media.h>
50 #include <net/if_types.h>
51 
52 #include <netinet/in.h>
53 #include <netinet/in_systm.h>
54 #include <netinet/in_var.h>
55 #include <netinet/if_ether.h>
56 #include <netinet/ip.h>
57 
58 #include <net80211/ieee80211_var.h>
59 #include <net80211/ieee80211_amrr.h>
60 #include <net80211/ieee80211_radiotap.h>
61 
62 #include <dev/ic/rt2661reg.h>
63 #include <dev/ic/rt2661var.h>
64 
65 #include <dev/pci/pcireg.h>
66 #include <dev/pci/pcivar.h>
67 #include <dev/pci/pcidevs.h>
68 
69 #ifdef RAL_DEBUG
70 #define DPRINTF(x)	do { if (rt2661_debug > 0) printf x; } while (0)
71 #define DPRINTFN(n, x)	do { if (rt2661_debug >= (n)) printf x; } while (0)
72 int rt2661_debug = 1;
73 #else
74 #define DPRINTF(x)
75 #define DPRINTFN(n, x)
76 #endif
77 
78 int		rt2661_alloc_tx_ring(struct rt2661_softc *,
79 		    struct rt2661_tx_ring *, int);
80 void		rt2661_reset_tx_ring(struct rt2661_softc *,
81 		    struct rt2661_tx_ring *);
82 void		rt2661_free_tx_ring(struct rt2661_softc *,
83 		    struct rt2661_tx_ring *);
84 int		rt2661_alloc_rx_ring(struct rt2661_softc *,
85 		    struct rt2661_rx_ring *, int);
86 void		rt2661_reset_rx_ring(struct rt2661_softc *,
87 		    struct rt2661_rx_ring *);
88 void		rt2661_free_rx_ring(struct rt2661_softc *,
89 		    struct rt2661_rx_ring *);
90 struct		ieee80211_node *rt2661_node_alloc(struct ieee80211com *);
91 int		rt2661_media_change(struct ifnet *);
92 void		rt2661_next_scan(void *);
93 void		rt2661_iter_func(void *, struct ieee80211_node *);
94 void		rt2661_updatestats(void *);
95 void		rt2661_newassoc(struct ieee80211com *, struct ieee80211_node *,
96 		    int);
97 int		rt2661_newstate(struct ieee80211com *, enum ieee80211_state,
98 		    int);
99 uint16_t	rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
100 void		rt2661_tx_intr(struct rt2661_softc *);
101 void		rt2661_tx_dma_intr(struct rt2661_softc *,
102 		    struct rt2661_tx_ring *);
103 void		rt2661_rx_intr(struct rt2661_softc *);
104 #ifndef IEEE80211_STA_ONLY
105 void		rt2661_mcu_beacon_expire(struct rt2661_softc *);
106 #endif
107 void		rt2661_mcu_wakeup(struct rt2661_softc *);
108 void		rt2661_mcu_cmd_intr(struct rt2661_softc *);
109 int		rt2661_intr(void *);
110 #if NBPFILTER > 0
111 uint8_t		rt2661_rxrate(const struct rt2661_rx_desc *);
112 #endif
113 int		rt2661_ack_rate(struct ieee80211com *, int);
114 uint16_t	rt2661_txtime(int, int, uint32_t);
115 uint8_t		rt2661_plcp_signal(int);
116 void		rt2661_setup_tx_desc(struct rt2661_softc *,
117 		    struct rt2661_tx_desc *, uint32_t, uint16_t, int, int,
118 		    const bus_dma_segment_t *, int, int);
119 int		rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
120 		    struct ieee80211_node *);
121 int		rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
122 		    struct ieee80211_node *, int);
123 void		rt2661_start(struct ifnet *);
124 void		rt2661_watchdog(struct ifnet *);
125 int		rt2661_ioctl(struct ifnet *, u_long, caddr_t);
126 void		rt2661_bbp_write(struct rt2661_softc *, uint8_t, uint8_t);
127 uint8_t		rt2661_bbp_read(struct rt2661_softc *, uint8_t);
128 void		rt2661_rf_write(struct rt2661_softc *, uint8_t, uint32_t);
129 int		rt2661_tx_cmd(struct rt2661_softc *, uint8_t, uint16_t);
130 void		rt2661_select_antenna(struct rt2661_softc *);
131 void		rt2661_enable_mrr(struct rt2661_softc *);
132 void		rt2661_set_txpreamble(struct rt2661_softc *);
133 void		rt2661_set_basicrates(struct rt2661_softc *);
134 void		rt2661_select_band(struct rt2661_softc *,
135 		    struct ieee80211_channel *);
136 void		rt2661_set_chan(struct rt2661_softc *,
137 		    struct ieee80211_channel *);
138 void		rt2661_set_bssid(struct rt2661_softc *, const uint8_t *);
139 void		rt2661_set_macaddr(struct rt2661_softc *, const uint8_t *);
140 void		rt2661_update_promisc(struct rt2661_softc *);
141 void		rt2661_updateslot(struct ieee80211com *);
142 void		rt2661_set_slottime(struct rt2661_softc *);
143 const char	*rt2661_get_rf(int);
144 void		rt2661_read_eeprom(struct rt2661_softc *);
145 int		rt2661_bbp_init(struct rt2661_softc *);
146 int		rt2661_init(struct ifnet *);
147 void		rt2661_stop(struct ifnet *, int);
148 int		rt2661_load_microcode(struct rt2661_softc *, const uint8_t *,
149 		    int);
150 void		rt2661_rx_tune(struct rt2661_softc *);
151 #ifdef notyet
152 void		rt2661_radar_start(struct rt2661_softc *);
153 int		rt2661_radar_stop(struct rt2661_softc *);
154 #endif
155 #ifndef IEEE80211_STA_ONLY
156 int		rt2661_prepare_beacon(struct rt2661_softc *);
157 #endif
158 void		rt2661_enable_tsf_sync(struct rt2661_softc *);
159 int		rt2661_get_rssi(struct rt2661_softc *, uint8_t);
160 void		rt2661_power(int, void *);
161 
162 static const struct {
163 	uint32_t	reg;
164 	uint32_t	val;
165 } rt2661_def_mac[] = {
166 	RT2661_DEF_MAC
167 };
168 
169 static const struct {
170 	uint8_t	reg;
171 	uint8_t	val;
172 } rt2661_def_bbp[] = {
173 	RT2661_DEF_BBP
174 };
175 
176 static const struct rfprog {
177 	uint8_t		chan;
178 	uint32_t	r1, r2, r3, r4;
179 }  rt2661_rf5225_1[] = {
180 	RT2661_RF5225_1
181 }, rt2661_rf5225_2[] = {
182 	RT2661_RF5225_2
183 };
184 
185 int
186 rt2661_attach(void *xsc, int id)
187 {
188 	struct rt2661_softc *sc = xsc;
189 	struct ieee80211com *ic = &sc->sc_ic;
190 	struct ifnet *ifp = &ic->ic_if;
191 	uint32_t val;
192 	int error, ac, i, ntries;
193 
194 	sc->sc_id = id;
195 
196 	sc->amrr.amrr_min_success_threshold =  1;
197 	sc->amrr.amrr_max_success_threshold = 15;
198 	timeout_set(&sc->amrr_to, rt2661_updatestats, sc);
199 	timeout_set(&sc->scan_to, rt2661_next_scan, sc);
200 
201 	/* wait for NIC to initialize */
202 	for (ntries = 0; ntries < 1000; ntries++) {
203 		if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
204 			break;
205 		DELAY(1000);
206 	}
207 	if (ntries == 1000) {
208 		printf("%s: timeout waiting for NIC to initialize\n",
209 		    sc->sc_dev.dv_xname);
210 		return EIO;
211 	}
212 
213 	/* retrieve RF rev. no and various other things from EEPROM */
214 	rt2661_read_eeprom(sc);
215 	printf(", address %s\n", ether_sprintf(ic->ic_myaddr));
216 
217 	printf("%s: MAC/BBP RT%X, RF %s\n", sc->sc_dev.dv_xname, val,
218 	    rt2661_get_rf(sc->rf_rev));
219 
220 	/*
221 	 * Allocate Tx and Rx rings.
222 	 */
223 	for (ac = 0; ac < 4; ac++) {
224 		error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
225 		    RT2661_TX_RING_COUNT);
226 		if (error != 0) {
227 			printf("%s: could not allocate Tx ring %d\n",
228 			    sc->sc_dev.dv_xname, ac);
229 			goto fail1;
230 		}
231 	}
232 
233 	error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
234 	if (error != 0) {
235 		printf("%s: could not allocate Mgt ring\n",
236 		    sc->sc_dev.dv_xname);
237 		goto fail1;
238 	}
239 
240 	error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
241 	if (error != 0) {
242 		printf("%s: could not allocate Rx ring\n",
243 		    sc->sc_dev.dv_xname);
244 		goto fail2;
245 	}
246 
247 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
248 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
249 	ic->ic_state = IEEE80211_S_INIT;
250 
251 	/* set device capabilities */
252 	ic->ic_caps =
253 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
254 #ifndef IEEE80211_STA_ONLY
255 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
256 	    IEEE80211_C_HOSTAP |	/* HostAP mode supported */
257 #endif
258 	    IEEE80211_C_TXPMGT |	/* tx power management */
259 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
260 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
261 	    IEEE80211_C_WEP |		/* s/w WEP */
262 	    IEEE80211_C_RSN;		/* WPA/RSN */
263 
264 	if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
265 		/* set supported .11a rates */
266 		ic->ic_sup_rates[IEEE80211_MODE_11A] =
267 		    ieee80211_std_rateset_11a;
268 
269 		/* set supported .11a channels */
270 		for (i = 36; i <= 64; i += 4) {
271 			ic->ic_channels[i].ic_freq =
272 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
273 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
274 		}
275 		for (i = 100; i <= 140; i += 4) {
276 			ic->ic_channels[i].ic_freq =
277 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
278 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
279 		}
280 		for (i = 149; i <= 165; i += 4) {
281 			ic->ic_channels[i].ic_freq =
282 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
283 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
284 		}
285 	}
286 
287 	/* set supported .11b and .11g rates */
288 	ic->ic_sup_rates[IEEE80211_MODE_11B] = ieee80211_std_rateset_11b;
289 	ic->ic_sup_rates[IEEE80211_MODE_11G] = ieee80211_std_rateset_11g;
290 
291 	/* set supported .11b and .11g channels (1 through 14) */
292 	for (i = 1; i <= 14; i++) {
293 		ic->ic_channels[i].ic_freq =
294 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
295 		ic->ic_channels[i].ic_flags =
296 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
297 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
298 	}
299 
300 	ifp->if_softc = sc;
301 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
302 	ifp->if_init = rt2661_init;
303 	ifp->if_ioctl = rt2661_ioctl;
304 	ifp->if_start = rt2661_start;
305 	ifp->if_watchdog = rt2661_watchdog;
306 	IFQ_SET_READY(&ifp->if_snd);
307 	memcpy(ifp->if_xname, sc->sc_dev.dv_xname, IFNAMSIZ);
308 
309 	if_attach(ifp);
310 	ieee80211_ifattach(ifp);
311 	ic->ic_node_alloc = rt2661_node_alloc;
312 	ic->ic_newassoc = rt2661_newassoc;
313 	ic->ic_updateslot = rt2661_updateslot;
314 
315 	/* override state transition machine */
316 	sc->sc_newstate = ic->ic_newstate;
317 	ic->ic_newstate = rt2661_newstate;
318 	ieee80211_media_init(ifp, rt2661_media_change, ieee80211_media_status);
319 
320 #if NBPFILTER > 0
321 	bpfattach(&sc->sc_drvbpf, ifp, DLT_IEEE802_11_RADIO,
322 	    sizeof (struct ieee80211_frame) + 64);
323 
324 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
325 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
326 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2661_RX_RADIOTAP_PRESENT);
327 
328 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
329 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
330 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2661_TX_RADIOTAP_PRESENT);
331 #endif
332 
333 	/*
334 	 * Make sure the interface is shutdown during reboot.
335 	 */
336 	sc->sc_sdhook = shutdownhook_establish(rt2661_shutdown, sc);
337 	if (sc->sc_sdhook == NULL) {
338 		printf("%s: WARNING: unable to establish shutdown hook\n",
339 		    sc->sc_dev.dv_xname);
340 	}
341 
342 	sc->sc_powerhook = powerhook_establish(rt2661_power, sc);
343 	if (sc->sc_powerhook == NULL) {
344 		printf("%s: WARNING: unable to establish power hook\n",
345 		    sc->sc_dev.dv_xname);
346 	}
347 
348 	return 0;
349 
350 fail2:	rt2661_free_tx_ring(sc, &sc->mgtq);
351 fail1:	while (--ac >= 0)
352 		rt2661_free_tx_ring(sc, &sc->txq[ac]);
353 	return ENXIO;
354 }
355 
356 int
357 rt2661_detach(void *xsc)
358 {
359 	struct rt2661_softc *sc = xsc;
360 	struct ifnet *ifp = &sc->sc_ic.ic_if;
361 	int ac;
362 
363 	timeout_del(&sc->scan_to);
364 	timeout_del(&sc->amrr_to);
365 
366 	ieee80211_ifdetach(ifp);	/* free all nodes */
367 	if_detach(ifp);
368 
369 	if (sc->sc_powerhook != NULL)
370 		powerhook_disestablish(sc->sc_powerhook);
371 
372 	if (sc->sc_sdhook != NULL)
373 		shutdownhook_disestablish(sc->sc_sdhook);
374 
375 	for (ac = 0; ac < 4; ac++)
376 		rt2661_free_tx_ring(sc, &sc->txq[ac]);
377 	rt2661_free_tx_ring(sc, &sc->mgtq);
378 	rt2661_free_rx_ring(sc, &sc->rxq);
379 
380 	return 0;
381 }
382 
383 int
384 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
385     int count)
386 {
387 	int i, nsegs, error;
388 
389 	ring->count = count;
390 	ring->queued = 0;
391 	ring->cur = ring->next = ring->stat = 0;
392 
393 	error = bus_dmamap_create(sc->sc_dmat, count * RT2661_TX_DESC_SIZE, 1,
394 	    count * RT2661_TX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
395 	if (error != 0) {
396 		printf("%s: could not create desc DMA map\n",
397 		    sc->sc_dev.dv_xname);
398 		goto fail;
399 	}
400 
401 	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2661_TX_DESC_SIZE,
402 	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
403 	if (error != 0) {
404 		printf("%s: could not allocate DMA memory\n",
405 		    sc->sc_dev.dv_xname);
406 		goto fail;
407 	}
408 
409 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
410 	    count * RT2661_TX_DESC_SIZE, (caddr_t *)&ring->desc,
411 	    BUS_DMA_NOWAIT);
412 	if (error != 0) {
413 		printf("%s: could not map desc DMA memory\n",
414 		    sc->sc_dev.dv_xname);
415 		goto fail;
416 	}
417 
418 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
419 	    count * RT2661_TX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
420 	if (error != 0) {
421 		printf("%s: could not load desc DMA map\n",
422 		    sc->sc_dev.dv_xname);
423 		goto fail;
424 	}
425 
426 	memset(ring->desc, 0, count * RT2661_TX_DESC_SIZE);
427 	ring->physaddr = ring->map->dm_segs->ds_addr;
428 
429 	ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
430 	    M_NOWAIT | M_ZERO);
431 	if (ring->data == NULL) {
432 		printf("%s: could not allocate soft data\n",
433 		    sc->sc_dev.dv_xname);
434 		error = ENOMEM;
435 		goto fail;
436 	}
437 
438 	for (i = 0; i < count; i++) {
439 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES,
440 		    RT2661_MAX_SCATTER, MCLBYTES, 0, BUS_DMA_NOWAIT,
441 		    &ring->data[i].map);
442 		if (error != 0) {
443 			printf("%s: could not create DMA map\n",
444 			    sc->sc_dev.dv_xname);
445 			goto fail;
446 		}
447 	}
448 
449 	return 0;
450 
451 fail:	rt2661_free_tx_ring(sc, ring);
452 	return error;
453 }
454 
455 void
456 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
457 {
458 	int i;
459 
460 	for (i = 0; i < ring->count; i++) {
461 		struct rt2661_tx_desc *desc = &ring->desc[i];
462 		struct rt2661_tx_data *data = &ring->data[i];
463 
464 		if (data->m != NULL) {
465 			bus_dmamap_sync(sc->sc_dmat, data->map, 0,
466 			    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
467 			bus_dmamap_unload(sc->sc_dmat, data->map);
468 			m_freem(data->m);
469 			data->m = NULL;
470 		}
471 
472 		/*
473 		 * The node has already been freed at that point so don't call
474 		 * ieee80211_release_node() here.
475 		 */
476 		data->ni = NULL;
477 
478 		desc->flags = 0;
479 	}
480 
481 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
482 	    BUS_DMASYNC_PREWRITE);
483 
484 	ring->queued = 0;
485 	ring->cur = ring->next = ring->stat = 0;
486 }
487 
488 void
489 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
490 {
491 	int i;
492 
493 	if (ring->desc != NULL) {
494 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
495 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
496 		bus_dmamap_unload(sc->sc_dmat, ring->map);
497 		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
498 		    ring->count * RT2661_TX_DESC_SIZE);
499 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
500 	}
501 
502 	if (ring->data != NULL) {
503 		for (i = 0; i < ring->count; i++) {
504 			struct rt2661_tx_data *data = &ring->data[i];
505 
506 			if (data->m != NULL) {
507 				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
508 				    data->map->dm_mapsize,
509 				    BUS_DMASYNC_POSTWRITE);
510 				bus_dmamap_unload(sc->sc_dmat, data->map);
511 				m_freem(data->m);
512 			}
513 			/*
514 			 * The node has already been freed at that point so
515 			 * don't call ieee80211_release_node() here.
516 			 */
517 			data->ni = NULL;
518 
519 			if (data->map != NULL)
520 				bus_dmamap_destroy(sc->sc_dmat, data->map);
521 		}
522 		free(ring->data, M_DEVBUF);
523 	}
524 }
525 
526 int
527 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
528     int count)
529 {
530 	int i, nsegs, error;
531 
532 	ring->count = count;
533 	ring->cur = ring->next = 0;
534 
535 	error = bus_dmamap_create(sc->sc_dmat, count * RT2661_RX_DESC_SIZE, 1,
536 	    count * RT2661_RX_DESC_SIZE, 0, BUS_DMA_NOWAIT, &ring->map);
537 	if (error != 0) {
538 		printf("%s: could not create desc DMA map\n",
539 		    sc->sc_dev.dv_xname);
540 		goto fail;
541 	}
542 
543 	error = bus_dmamem_alloc(sc->sc_dmat, count * RT2661_RX_DESC_SIZE,
544 	    PAGE_SIZE, 0, &ring->seg, 1, &nsegs, BUS_DMA_NOWAIT);
545 	if (error != 0) {
546 		printf("%s: could not allocate DMA memory\n",
547 		    sc->sc_dev.dv_xname);
548 		goto fail;
549 	}
550 
551 	error = bus_dmamem_map(sc->sc_dmat, &ring->seg, nsegs,
552 	    count * RT2661_RX_DESC_SIZE, (caddr_t *)&ring->desc,
553 	    BUS_DMA_NOWAIT);
554 	if (error != 0) {
555 		printf("%s: could not map desc DMA memory\n",
556 		    sc->sc_dev.dv_xname);
557 		goto fail;
558 	}
559 
560 	error = bus_dmamap_load(sc->sc_dmat, ring->map, ring->desc,
561 	    count * RT2661_RX_DESC_SIZE, NULL, BUS_DMA_NOWAIT);
562 	if (error != 0) {
563 		printf("%s: could not load desc DMA map\n",
564 		    sc->sc_dev.dv_xname);
565 		goto fail;
566 	}
567 
568 	memset(ring->desc, 0, count * RT2661_RX_DESC_SIZE);
569 	ring->physaddr = ring->map->dm_segs->ds_addr;
570 
571 	ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
572 	    M_NOWAIT | M_ZERO);
573 	if (ring->data == NULL) {
574 		printf("%s: could not allocate soft data\n",
575 		    sc->sc_dev.dv_xname);
576 		error = ENOMEM;
577 		goto fail;
578 	}
579 
580 	/*
581 	 * Pre-allocate Rx buffers and populate Rx ring.
582 	 */
583 	for (i = 0; i < count; i++) {
584 		struct rt2661_rx_desc *desc = &sc->rxq.desc[i];
585 		struct rt2661_rx_data *data = &sc->rxq.data[i];
586 
587 		error = bus_dmamap_create(sc->sc_dmat, MCLBYTES, 1, MCLBYTES,
588 		    0, BUS_DMA_NOWAIT, &data->map);
589 		if (error != 0) {
590 			printf("%s: could not create DMA map\n",
591 			    sc->sc_dev.dv_xname);
592 			goto fail;
593 		}
594 
595 		MGETHDR(data->m, M_DONTWAIT, MT_DATA);
596 		if (data->m == NULL) {
597 			printf("%s: could not allocate rx mbuf\n",
598 			    sc->sc_dev.dv_xname);
599 			error = ENOMEM;
600 			goto fail;
601 		}
602 		MCLGET(data->m, M_DONTWAIT);
603 		if (!(data->m->m_flags & M_EXT)) {
604 			printf("%s: could not allocate rx mbuf cluster\n",
605 			    sc->sc_dev.dv_xname);
606 			error = ENOMEM;
607 			goto fail;
608 		}
609 
610 		error = bus_dmamap_load(sc->sc_dmat, data->map,
611 		    mtod(data->m, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
612 		if (error != 0) {
613 			printf("%s: could not load rx buf DMA map",
614 			    sc->sc_dev.dv_xname);
615 			goto fail;
616 		}
617 
618 		desc->flags = htole32(RT2661_RX_BUSY);
619 		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
620 	}
621 
622 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
623 	    BUS_DMASYNC_PREWRITE);
624 
625 	return 0;
626 
627 fail:	rt2661_free_rx_ring(sc, ring);
628 	return error;
629 }
630 
631 void
632 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
633 {
634 	int i;
635 
636 	for (i = 0; i < ring->count; i++)
637 		ring->desc[i].flags = htole32(RT2661_RX_BUSY);
638 
639 	bus_dmamap_sync(sc->sc_dmat, ring->map, 0, ring->map->dm_mapsize,
640 	    BUS_DMASYNC_PREWRITE);
641 
642 	ring->cur = ring->next = 0;
643 }
644 
645 void
646 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
647 {
648 	int i;
649 
650 	if (ring->desc != NULL) {
651 		bus_dmamap_sync(sc->sc_dmat, ring->map, 0,
652 		    ring->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
653 		bus_dmamap_unload(sc->sc_dmat, ring->map);
654 		bus_dmamem_unmap(sc->sc_dmat, (caddr_t)ring->desc,
655 		    ring->count * RT2661_RX_DESC_SIZE);
656 		bus_dmamem_free(sc->sc_dmat, &ring->seg, 1);
657 	}
658 
659 	if (ring->data != NULL) {
660 		for (i = 0; i < ring->count; i++) {
661 			struct rt2661_rx_data *data = &ring->data[i];
662 
663 			if (data->m != NULL) {
664 				bus_dmamap_sync(sc->sc_dmat, data->map, 0,
665 				    data->map->dm_mapsize,
666 				    BUS_DMASYNC_POSTREAD);
667 				bus_dmamap_unload(sc->sc_dmat, data->map);
668 				m_freem(data->m);
669 			}
670 
671 			if (data->map != NULL)
672 				bus_dmamap_destroy(sc->sc_dmat, data->map);
673 		}
674 		free(ring->data, M_DEVBUF);
675 	}
676 }
677 
678 struct ieee80211_node *
679 rt2661_node_alloc(struct ieee80211com *ic)
680 {
681 	return malloc(sizeof (struct rt2661_node), M_DEVBUF,
682 	    M_NOWAIT | M_ZERO);
683 }
684 
685 int
686 rt2661_media_change(struct ifnet *ifp)
687 {
688 	int error;
689 
690 	error = ieee80211_media_change(ifp);
691 	if (error != ENETRESET)
692 		return error;
693 
694 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
695 		rt2661_init(ifp);
696 
697 	return 0;
698 }
699 
700 /*
701  * This function is called periodically (every 200ms) during scanning to
702  * switch from one channel to another.
703  */
704 void
705 rt2661_next_scan(void *arg)
706 {
707 	struct rt2661_softc *sc = arg;
708 	struct ieee80211com *ic = &sc->sc_ic;
709 	struct ifnet *ifp = &ic->ic_if;
710 	int s;
711 
712 	s = splnet();
713 	if (ic->ic_state == IEEE80211_S_SCAN)
714 		ieee80211_next_scan(ifp);
715 	splx(s);
716 }
717 
718 /*
719  * This function is called for each neighbor node.
720  */
721 void
722 rt2661_iter_func(void *arg, struct ieee80211_node *ni)
723 {
724 	struct rt2661_softc *sc = arg;
725 	struct rt2661_node *rn = (struct rt2661_node *)ni;
726 
727 	ieee80211_amrr_choose(&sc->amrr, ni, &rn->amn);
728 }
729 
730 /*
731  * This function is called periodically (every 500ms) in RUN state to update
732  * various settings like rate control statistics or Rx sensitivity.
733  */
734 void
735 rt2661_updatestats(void *arg)
736 {
737 	struct rt2661_softc *sc = arg;
738 	struct ieee80211com *ic = &sc->sc_ic;
739 	int s;
740 
741 	s = splnet();
742 	if (ic->ic_opmode == IEEE80211_M_STA)
743 		rt2661_iter_func(sc, ic->ic_bss);
744 	else
745 		ieee80211_iterate_nodes(ic, rt2661_iter_func, arg);
746 
747 	/* update rx sensitivity every 1 sec */
748 	if (++sc->ncalls & 1)
749 		rt2661_rx_tune(sc);
750 	splx(s);
751 
752 	timeout_add(&sc->amrr_to, hz / 2);
753 }
754 
755 void
756 rt2661_newassoc(struct ieee80211com *ic, struct ieee80211_node *ni, int isnew)
757 {
758 	struct rt2661_softc *sc = ic->ic_softc;
759 	int i;
760 
761 	ieee80211_amrr_node_init(&sc->amrr, &((struct rt2661_node *)ni)->amn);
762 
763 	/* set rate to some reasonable initial value */
764 	for (i = ni->ni_rates.rs_nrates - 1;
765 	     i > 0 && (ni->ni_rates.rs_rates[i] & IEEE80211_RATE_VAL) > 72;
766 	     i--);
767 	ni->ni_txrate = i;
768 }
769 
770 int
771 rt2661_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
772 {
773 	struct rt2661_softc *sc = ic->ic_if.if_softc;
774 	enum ieee80211_state ostate;
775 	struct ieee80211_node *ni;
776 	uint32_t tmp;
777 
778 	ostate = ic->ic_state;
779 	timeout_del(&sc->scan_to);
780 	timeout_del(&sc->amrr_to);
781 
782 	switch (nstate) {
783 	case IEEE80211_S_INIT:
784 		if (ostate == IEEE80211_S_RUN) {
785 			/* abort TSF synchronization */
786 			tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
787 			RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
788 		}
789 		break;
790 
791 	case IEEE80211_S_SCAN:
792 		rt2661_set_chan(sc, ic->ic_bss->ni_chan);
793 		timeout_add(&sc->scan_to, hz / 5);
794 		break;
795 
796 	case IEEE80211_S_AUTH:
797 	case IEEE80211_S_ASSOC:
798 		rt2661_set_chan(sc, ic->ic_bss->ni_chan);
799 		break;
800 
801 	case IEEE80211_S_RUN:
802 		rt2661_set_chan(sc, ic->ic_bss->ni_chan);
803 
804 		ni = ic->ic_bss;
805 
806 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
807 			rt2661_set_slottime(sc);
808 			rt2661_enable_mrr(sc);
809 			rt2661_set_txpreamble(sc);
810 			rt2661_set_basicrates(sc);
811 			rt2661_set_bssid(sc, ni->ni_bssid);
812 		}
813 
814 #ifndef IEEE80211_STA_ONLY
815 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
816 		    ic->ic_opmode == IEEE80211_M_IBSS)
817 			rt2661_prepare_beacon(sc);
818 #endif
819 
820 		if (ic->ic_opmode == IEEE80211_M_STA) {
821 			/* fake a join to init the tx rate */
822 			rt2661_newassoc(ic, ni, 1);
823 		}
824 
825 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
826 			sc->ncalls = 0;
827 			sc->avg_rssi = -95;	/* reset EMA */
828 			timeout_add(&sc->amrr_to, hz / 2);
829 			rt2661_enable_tsf_sync(sc);
830 		}
831 		break;
832 	}
833 
834 	return sc->sc_newstate(ic, nstate, arg);
835 }
836 
837 /*
838  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
839  * 93C66).
840  */
841 uint16_t
842 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
843 {
844 	uint32_t tmp;
845 	uint16_t val;
846 	int n;
847 
848 	/* clock C once before the first command */
849 	RT2661_EEPROM_CTL(sc, 0);
850 
851 	RT2661_EEPROM_CTL(sc, RT2661_S);
852 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
853 	RT2661_EEPROM_CTL(sc, RT2661_S);
854 
855 	/* write start bit (1) */
856 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
857 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
858 
859 	/* write READ opcode (10) */
860 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
861 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
862 	RT2661_EEPROM_CTL(sc, RT2661_S);
863 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
864 
865 	/* write address (A5-A0 or A7-A0) */
866 	n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
867 	for (; n >= 0; n--) {
868 		RT2661_EEPROM_CTL(sc, RT2661_S |
869 		    (((addr >> n) & 1) << RT2661_SHIFT_D));
870 		RT2661_EEPROM_CTL(sc, RT2661_S |
871 		    (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
872 	}
873 
874 	RT2661_EEPROM_CTL(sc, RT2661_S);
875 
876 	/* read data Q15-Q0 */
877 	val = 0;
878 	for (n = 15; n >= 0; n--) {
879 		RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
880 		tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
881 		val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
882 		RT2661_EEPROM_CTL(sc, RT2661_S);
883 	}
884 
885 	RT2661_EEPROM_CTL(sc, 0);
886 
887 	/* clear Chip Select and clock C */
888 	RT2661_EEPROM_CTL(sc, RT2661_S);
889 	RT2661_EEPROM_CTL(sc, 0);
890 	RT2661_EEPROM_CTL(sc, RT2661_C);
891 
892 	return val;
893 }
894 
895 void
896 rt2661_tx_intr(struct rt2661_softc *sc)
897 {
898 	struct ieee80211com *ic = &sc->sc_ic;
899 	struct ifnet *ifp = &ic->ic_if;
900 	struct rt2661_tx_ring *txq;
901 	struct rt2661_tx_data *data;
902 	struct rt2661_node *rn;
903 	int qid, retrycnt;
904 
905 	for (;;) {
906 		const uint32_t val = RAL_READ(sc, RT2661_STA_CSR4);
907 		if (!(val & RT2661_TX_STAT_VALID))
908 			break;
909 
910 		/* retrieve the queue in which this frame was sent */
911 		qid = RT2661_TX_QID(val);
912 		txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
913 
914 		/* retrieve rate control algorithm context */
915 		data = &txq->data[txq->stat];
916 		rn = (struct rt2661_node *)data->ni;
917 
918 		/* if no frame has been sent, ignore */
919 		if (rn == NULL)
920 			continue;
921 
922 		switch (RT2661_TX_RESULT(val)) {
923 		case RT2661_TX_SUCCESS:
924 			retrycnt = RT2661_TX_RETRYCNT(val);
925 
926 			DPRINTFN(10, ("data frame sent successfully after "
927 			    "%d retries\n", retrycnt));
928 			rn->amn.amn_txcnt++;
929 			if (retrycnt > 0)
930 				rn->amn.amn_retrycnt++;
931 			ifp->if_opackets++;
932 			break;
933 
934 		case RT2661_TX_RETRY_FAIL:
935 			DPRINTFN(9, ("sending data frame failed (too much "
936 			    "retries)\n"));
937 			rn->amn.amn_txcnt++;
938 			rn->amn.amn_retrycnt++;
939 			ifp->if_oerrors++;
940 			break;
941 
942 		default:
943 			/* other failure */
944 			printf("%s: sending data frame failed 0x%08x\n",
945 			    sc->sc_dev.dv_xname, val);
946 			ifp->if_oerrors++;
947 		}
948 
949 		ieee80211_release_node(ic, data->ni);
950 		data->ni = NULL;
951 
952 		DPRINTFN(15, ("tx done q=%d idx=%u\n", qid, txq->stat));
953 
954 		txq->queued--;
955 		if (++txq->stat >= txq->count)	/* faster than % count */
956 			txq->stat = 0;
957 	}
958 
959 	sc->sc_tx_timer = 0;
960 	ifp->if_flags &= ~IFF_OACTIVE;
961 	rt2661_start(ifp);
962 }
963 
964 void
965 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
966 {
967 	for (;;) {
968 		struct rt2661_tx_desc *desc = &txq->desc[txq->next];
969 		struct rt2661_tx_data *data = &txq->data[txq->next];
970 
971 		bus_dmamap_sync(sc->sc_dmat, txq->map,
972 		    txq->next * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
973 		    BUS_DMASYNC_POSTREAD);
974 
975 		if ((letoh32(desc->flags) & RT2661_TX_BUSY) ||
976 		    !(letoh32(desc->flags) & RT2661_TX_VALID))
977 			break;
978 
979 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
980 		    data->map->dm_mapsize, BUS_DMASYNC_POSTWRITE);
981 		bus_dmamap_unload(sc->sc_dmat, data->map);
982 		m_freem(data->m);
983 		data->m = NULL;
984 		/* node reference is released in rt2661_tx_intr() */
985 
986 		/* descriptor is no longer valid */
987 		desc->flags &= ~htole32(RT2661_TX_VALID);
988 
989 		bus_dmamap_sync(sc->sc_dmat, txq->map,
990 		    txq->next * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
991 		    BUS_DMASYNC_PREWRITE);
992 
993 		DPRINTFN(15, ("tx dma done q=%p idx=%u\n", txq, txq->next));
994 
995 		if (++txq->next >= txq->count)	/* faster than % count */
996 			txq->next = 0;
997 	}
998 }
999 
1000 void
1001 rt2661_rx_intr(struct rt2661_softc *sc)
1002 {
1003 	struct ieee80211com *ic = &sc->sc_ic;
1004 	struct ifnet *ifp = &ic->ic_if;
1005 	struct ieee80211_frame *wh;
1006 	struct ieee80211_rxinfo rxi;
1007 	struct ieee80211_node *ni;
1008 	struct mbuf *mnew, *m;
1009 	int error, rssi;
1010 
1011 	for (;;) {
1012 		struct rt2661_rx_desc *desc = &sc->rxq.desc[sc->rxq.cur];
1013 		struct rt2661_rx_data *data = &sc->rxq.data[sc->rxq.cur];
1014 
1015 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1016 		    sc->rxq.cur * RT2661_RX_DESC_SIZE, RT2661_RX_DESC_SIZE,
1017 		    BUS_DMASYNC_POSTREAD);
1018 
1019 		if (letoh32(desc->flags) & RT2661_RX_BUSY)
1020 			break;
1021 
1022 		if ((letoh32(desc->flags) & RT2661_RX_PHY_ERROR) ||
1023 		    (letoh32(desc->flags) & RT2661_RX_CRC_ERROR)) {
1024 			/*
1025 			 * This should not happen since we did not request
1026 			 * to receive those frames when we filled TXRX_CSR0.
1027 			 */
1028 			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1029 			    letoh32(desc->flags)));
1030 			ifp->if_ierrors++;
1031 			goto skip;
1032 		}
1033 
1034 		if ((letoh32(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
1035 			ifp->if_ierrors++;
1036 			goto skip;
1037 		}
1038 
1039 		/*
1040 		 * Try to allocate a new mbuf for this ring element and load it
1041 		 * before processing the current mbuf. If the ring element
1042 		 * cannot be loaded, drop the received packet and reuse the old
1043 		 * mbuf. In the unlikely case that the old mbuf can't be
1044 		 * reloaded either, explicitly panic.
1045 		 */
1046 		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1047 		if (mnew == NULL) {
1048 			ifp->if_ierrors++;
1049 			goto skip;
1050 		}
1051 		MCLGET(mnew, M_DONTWAIT);
1052 		if (!(mnew->m_flags & M_EXT)) {
1053 			m_freem(mnew);
1054 			ifp->if_ierrors++;
1055 			goto skip;
1056 		}
1057 
1058 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1059 		    data->map->dm_mapsize, BUS_DMASYNC_POSTREAD);
1060 		bus_dmamap_unload(sc->sc_dmat, data->map);
1061 
1062 		error = bus_dmamap_load(sc->sc_dmat, data->map,
1063 		    mtod(mnew, void *), MCLBYTES, NULL, BUS_DMA_NOWAIT);
1064 		if (error != 0) {
1065 			m_freem(mnew);
1066 
1067 			/* try to reload the old mbuf */
1068 			error = bus_dmamap_load(sc->sc_dmat, data->map,
1069 			    mtod(data->m, void *), MCLBYTES, NULL,
1070 			    BUS_DMA_NOWAIT);
1071 			if (error != 0) {
1072 				/* very unlikely that it will fail... */
1073 				panic("%s: could not load old rx mbuf",
1074 				    sc->sc_dev.dv_xname);
1075 			}
1076 			/* physical address may have changed */
1077 			desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1078 			ifp->if_ierrors++;
1079 			goto skip;
1080 		}
1081 
1082 		/*
1083 	 	 * New mbuf successfully loaded, update Rx ring and continue
1084 		 * processing.
1085 		 */
1086 		m = data->m;
1087 		data->m = mnew;
1088 		desc->physaddr = htole32(data->map->dm_segs->ds_addr);
1089 
1090 		/* finalize mbuf */
1091 		m->m_pkthdr.rcvif = ifp;
1092 		m->m_pkthdr.len = m->m_len =
1093 		    (letoh32(desc->flags) >> 16) & 0xfff;
1094 
1095 #if NBPFILTER > 0
1096 		if (sc->sc_drvbpf != NULL) {
1097 			struct mbuf mb;
1098 			struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
1099 			uint32_t tsf_lo, tsf_hi;
1100 
1101 			/* get timestamp (low and high 32 bits) */
1102 			tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
1103 			tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
1104 
1105 			tap->wr_tsf =
1106 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1107 			tap->wr_flags = 0;
1108 			tap->wr_rate = rt2661_rxrate(desc);
1109 			tap->wr_chan_freq = htole16(sc->sc_curchan->ic_freq);
1110 			tap->wr_chan_flags = htole16(sc->sc_curchan->ic_flags);
1111 			tap->wr_antsignal = desc->rssi;
1112 
1113 			mb.m_data = (caddr_t)tap;
1114 			mb.m_len = sc->sc_rxtap_len;
1115 			mb.m_next = m;
1116 			mb.m_nextpkt = NULL;
1117 			mb.m_type = 0;
1118 			mb.m_flags = 0;
1119 			bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_IN);
1120 		}
1121 #endif
1122 
1123 		wh = mtod(m, struct ieee80211_frame *);
1124 		ni = ieee80211_find_rxnode(ic, wh);
1125 
1126 		/* send the frame to the 802.11 layer */
1127 		rxi.rxi_flags = 0;
1128 		rxi.rxi_rssi = desc->rssi;
1129 		rxi.rxi_tstamp = 0;	/* unused */
1130 		ieee80211_input(ifp, m, ni, &rxi);
1131 
1132 		/*-
1133 		 * Keep track of the average RSSI using an Exponential Moving
1134 		 * Average (EMA) of 8 Wilder's days:
1135 		 *     avg = (1 / N) x rssi + ((N - 1) / N) x avg
1136 		 */
1137 		rssi = rt2661_get_rssi(sc, desc->rssi);
1138 		sc->avg_rssi = (rssi + 7 * sc->avg_rssi) / 8;
1139 
1140 		/* node is no longer needed */
1141 		ieee80211_release_node(ic, ni);
1142 
1143 skip:		desc->flags |= htole32(RT2661_RX_BUSY);
1144 
1145 		bus_dmamap_sync(sc->sc_dmat, sc->rxq.map,
1146 		    sc->rxq.cur * RT2661_RX_DESC_SIZE, RT2661_RX_DESC_SIZE,
1147 		    BUS_DMASYNC_PREWRITE);
1148 
1149 		DPRINTFN(15, ("rx intr idx=%u\n", sc->rxq.cur));
1150 
1151 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
1152 	}
1153 }
1154 
1155 #ifndef IEEE80211_STA_ONLY
1156 /*
1157  * This function is called in HostAP or IBSS modes when it's time to send a
1158  * new beacon (every ni_intval milliseconds).
1159  */
1160 void
1161 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
1162 {
1163 	struct ieee80211com *ic = &sc->sc_ic;
1164 
1165 	if (sc->sc_flags & RT2661_UPDATE_SLOT) {
1166 		sc->sc_flags &= ~RT2661_UPDATE_SLOT;
1167 		sc->sc_flags |= RT2661_SET_SLOTTIME;
1168 	} else if (sc->sc_flags & RT2661_SET_SLOTTIME) {
1169 		sc->sc_flags &= ~RT2661_SET_SLOTTIME;
1170 		rt2661_set_slottime(sc);
1171 	}
1172 
1173 	if (ic->ic_curmode == IEEE80211_MODE_11G) {
1174 		/* update ERP Information Element */
1175 		RAL_WRITE_1(sc, sc->erp_csr, ic->ic_bss->ni_erp);
1176 		RAL_RW_BARRIER_1(sc, sc->erp_csr);
1177 	}
1178 
1179 	DPRINTFN(15, ("beacon expired\n"));
1180 }
1181 #endif
1182 
1183 void
1184 rt2661_mcu_wakeup(struct rt2661_softc *sc)
1185 {
1186 	RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
1187 
1188 	RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
1189 	RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
1190 	RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
1191 
1192 	/* send wakeup command to MCU */
1193 	rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
1194 }
1195 
1196 void
1197 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
1198 {
1199 	RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
1200 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
1201 }
1202 
1203 int
1204 rt2661_intr(void *arg)
1205 {
1206 	struct rt2661_softc *sc = arg;
1207 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1208 	uint32_t r1, r2;
1209 
1210 	r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
1211 	r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
1212 	if (r1 == 0 && r2 == 0)
1213 		return 0;	/* not for us */
1214 
1215 	/* disable MAC and MCU interrupts */
1216 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
1217 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
1218 
1219 	/* acknowledge interrupts */
1220 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
1221 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
1222 
1223 	/* don't re-enable interrupts if we're shutting down */
1224 	if (!(ifp->if_flags & IFF_RUNNING))
1225 		return 0;
1226 
1227 	if (r1 & RT2661_MGT_DONE)
1228 		rt2661_tx_dma_intr(sc, &sc->mgtq);
1229 
1230 	if (r1 & RT2661_RX_DONE)
1231 		rt2661_rx_intr(sc);
1232 
1233 	if (r1 & RT2661_TX0_DMA_DONE)
1234 		rt2661_tx_dma_intr(sc, &sc->txq[0]);
1235 
1236 	if (r1 & RT2661_TX1_DMA_DONE)
1237 		rt2661_tx_dma_intr(sc, &sc->txq[1]);
1238 
1239 	if (r1 & RT2661_TX2_DMA_DONE)
1240 		rt2661_tx_dma_intr(sc, &sc->txq[2]);
1241 
1242 	if (r1 & RT2661_TX3_DMA_DONE)
1243 		rt2661_tx_dma_intr(sc, &sc->txq[3]);
1244 
1245 	if (r1 & RT2661_TX_DONE)
1246 		rt2661_tx_intr(sc);
1247 
1248 	if (r2 & RT2661_MCU_CMD_DONE)
1249 		rt2661_mcu_cmd_intr(sc);
1250 
1251 #ifndef IEEE80211_STA_ONLY
1252 	if (r2 & RT2661_MCU_BEACON_EXPIRE)
1253 		rt2661_mcu_beacon_expire(sc);
1254 #endif
1255 
1256 	if (r2 & RT2661_MCU_WAKEUP)
1257 		rt2661_mcu_wakeup(sc);
1258 
1259 	/* re-enable MAC and MCU interrupts */
1260 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
1261 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
1262 
1263 	return 1;
1264 }
1265 
1266 /* quickly determine if a given rate is CCK or OFDM */
1267 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1268 
1269 #define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1270 #define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1271 
1272 /*
1273  * This function is only used by the Rx radiotap code. It returns the rate at
1274  * which a given frame was received.
1275  */
1276 #if NBPFILTER > 0
1277 uint8_t
1278 rt2661_rxrate(const struct rt2661_rx_desc *desc)
1279 {
1280 	if (letoh32(desc->flags) & RT2661_RX_OFDM) {
1281 		/* reverse function of rt2661_plcp_signal */
1282 		switch (desc->rate & 0xf) {
1283 		case 0xb:	return 12;
1284 		case 0xf:	return 18;
1285 		case 0xa:	return 24;
1286 		case 0xe:	return 36;
1287 		case 0x9:	return 48;
1288 		case 0xd:	return 72;
1289 		case 0x8:	return 96;
1290 		case 0xc:	return 108;
1291 		}
1292 	} else {
1293 		if (desc->rate == 10)
1294 			return 2;
1295 		if (desc->rate == 20)
1296 			return 4;
1297 		if (desc->rate == 55)
1298 			return 11;
1299 		if (desc->rate == 110)
1300 			return 22;
1301 	}
1302 	return 2;	/* should not get there */
1303 }
1304 #endif
1305 
1306 /*
1307  * Return the expected ack rate for a frame transmitted at rate `rate'.
1308  */
1309 int
1310 rt2661_ack_rate(struct ieee80211com *ic, int rate)
1311 {
1312 	switch (rate) {
1313 	/* CCK rates */
1314 	case 2:
1315 		return 2;
1316 	case 4:
1317 	case 11:
1318 	case 22:
1319 		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1320 
1321 	/* OFDM rates */
1322 	case 12:
1323 	case 18:
1324 		return 12;
1325 	case 24:
1326 	case 36:
1327 		return 24;
1328 	case 48:
1329 	case 72:
1330 	case 96:
1331 	case 108:
1332 		return 48;
1333 	}
1334 
1335 	/* default to 1Mbps */
1336 	return 2;
1337 }
1338 
1339 /*
1340  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1341  * The function automatically determines the operating mode depending on the
1342  * given rate. `flags' indicates whether short preamble is in use or not.
1343  */
1344 uint16_t
1345 rt2661_txtime(int len, int rate, uint32_t flags)
1346 {
1347 	uint16_t txtime;
1348 
1349 	if (RAL_RATE_IS_OFDM(rate)) {
1350 		/* IEEE Std 802.11g-2003, pp. 44 */
1351 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1352 		txtime = 16 + 4 + 4 * txtime + 6;
1353 	} else {
1354 		/* IEEE Std 802.11b-1999, pp. 28 */
1355 		txtime = (16 * len + rate - 1) / rate;
1356 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1357 			txtime +=  72 + 24;
1358 		else
1359 			txtime += 144 + 48;
1360 	}
1361 	return txtime;
1362 }
1363 
1364 uint8_t
1365 rt2661_plcp_signal(int rate)
1366 {
1367 	switch (rate) {
1368 	/* CCK rates (returned values are device-dependent) */
1369 	case 2:		return 0x0;
1370 	case 4:		return 0x1;
1371 	case 11:	return 0x2;
1372 	case 22:	return 0x3;
1373 
1374 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1375 	case 12:	return 0xb;
1376 	case 18:	return 0xf;
1377 	case 24:	return 0xa;
1378 	case 36:	return 0xe;
1379 	case 48:	return 0x9;
1380 	case 72:	return 0xd;
1381 	case 96:	return 0x8;
1382 	case 108:	return 0xc;
1383 
1384 	/* unsupported rates (should not get there) */
1385 	default:	return 0xff;
1386 	}
1387 }
1388 
1389 void
1390 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
1391     uint32_t flags, uint16_t xflags, int len, int rate,
1392     const bus_dma_segment_t *segs, int nsegs, int ac)
1393 {
1394 	struct ieee80211com *ic = &sc->sc_ic;
1395 	uint16_t plcp_length;
1396 	int i, remainder;
1397 
1398 	desc->flags = htole32(flags);
1399 	desc->flags |= htole32(len << 16);
1400 	desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
1401 
1402 	desc->xflags = htole16(xflags);
1403 	desc->xflags |= htole16(nsegs << 13);
1404 
1405 	desc->wme = htole16(
1406 	    RT2661_QID(ac) |
1407 	    RT2661_AIFSN(2) |
1408 	    RT2661_LOGCWMIN(4) |
1409 	    RT2661_LOGCWMAX(10));
1410 
1411 	/*
1412 	 * Remember in which queue this frame was sent. This field is driver
1413 	 * private data only. It will be made available by the NIC in STA_CSR4
1414 	 * on Tx interrupts.
1415 	 */
1416 	desc->qid = ac;
1417 
1418 	/* setup PLCP fields */
1419 	desc->plcp_signal  = rt2661_plcp_signal(rate);
1420 	desc->plcp_service = 4;
1421 
1422 	len += IEEE80211_CRC_LEN;
1423 	if (RAL_RATE_IS_OFDM(rate)) {
1424 		desc->flags |= htole32(RT2661_TX_OFDM);
1425 
1426 		plcp_length = len & 0xfff;
1427 		desc->plcp_length_hi = plcp_length >> 6;
1428 		desc->plcp_length_lo = plcp_length & 0x3f;
1429 	} else {
1430 		plcp_length = (16 * len + rate - 1) / rate;
1431 		if (rate == 22) {
1432 			remainder = (16 * len) % 22;
1433 			if (remainder != 0 && remainder < 7)
1434 				desc->plcp_service |= RT2661_PLCP_LENGEXT;
1435 		}
1436 		desc->plcp_length_hi = plcp_length >> 8;
1437 		desc->plcp_length_lo = plcp_length & 0xff;
1438 
1439 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1440 			desc->plcp_signal |= 0x08;
1441 	}
1442 
1443 	/* RT2x61 supports scatter with up to 5 segments */
1444 	for (i = 0; i < nsegs; i++) {
1445 		desc->addr[i] = htole32(segs[i].ds_addr);
1446 		desc->len [i] = htole16(segs[i].ds_len);
1447 	}
1448 }
1449 
1450 int
1451 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
1452     struct ieee80211_node *ni)
1453 {
1454 	struct ieee80211com *ic = &sc->sc_ic;
1455 	struct rt2661_tx_desc *desc;
1456 	struct rt2661_tx_data *data;
1457 	struct ieee80211_frame *wh;
1458 	uint16_t dur;
1459 	uint32_t flags = 0;
1460 	int rate, error;
1461 
1462 	desc = &sc->mgtq.desc[sc->mgtq.cur];
1463 	data = &sc->mgtq.data[sc->mgtq.cur];
1464 
1465 	/* send mgt frames at the lowest available rate */
1466 	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1467 
1468 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1469 	    BUS_DMA_NOWAIT);
1470 	if (error != 0) {
1471 		printf("%s: could not map mbuf (error %d)\n",
1472 		    sc->sc_dev.dv_xname, error);
1473 		m_freem(m0);
1474 		return error;
1475 	}
1476 
1477 #if NBPFILTER > 0
1478 	if (sc->sc_drvbpf != NULL) {
1479 		struct mbuf mb;
1480 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1481 
1482 		tap->wt_flags = 0;
1483 		tap->wt_rate = rate;
1484 		tap->wt_chan_freq = htole16(sc->sc_curchan->ic_freq);
1485 		tap->wt_chan_flags = htole16(sc->sc_curchan->ic_flags);
1486 
1487 		mb.m_data = (caddr_t)tap;
1488 		mb.m_len = sc->sc_txtap_len;
1489 		mb.m_next = m0;
1490 		mb.m_nextpkt = NULL;
1491 		mb.m_type = 0;
1492 		mb.m_flags = 0;
1493 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1494 	}
1495 #endif
1496 
1497 	data->m = m0;
1498 	data->ni = ni;
1499 
1500 	wh = mtod(m0, struct ieee80211_frame *);
1501 
1502 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1503 		flags |= RT2661_TX_NEED_ACK;
1504 
1505 		dur = rt2661_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1506 		    sc->sifs;
1507 		*(uint16_t *)wh->i_dur = htole16(dur);
1508 
1509 #ifndef IEEE80211_STA_ONLY
1510 		/* tell hardware to set timestamp in probe responses */
1511 		if ((wh->i_fc[0] &
1512 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1513 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1514 			flags |= RT2661_TX_TIMESTAMP;
1515 #endif
1516 	}
1517 
1518 	rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
1519 	    m0->m_pkthdr.len, rate, data->map->dm_segs, data->map->dm_nsegs,
1520 	    RT2661_QID_MGT);
1521 
1522 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1523 	    BUS_DMASYNC_PREWRITE);
1524 	bus_dmamap_sync(sc->sc_dmat, sc->mgtq.map,
1525 	    sc->mgtq.cur * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
1526 	    BUS_DMASYNC_PREWRITE);
1527 
1528 	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1529 	    m0->m_pkthdr.len, sc->mgtq.cur, rate));
1530 
1531 	/* kick mgt */
1532 	sc->mgtq.queued++;
1533 	sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
1534 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
1535 
1536 	return 0;
1537 }
1538 
1539 int
1540 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
1541     struct ieee80211_node *ni, int ac)
1542 {
1543 	struct ieee80211com *ic = &sc->sc_ic;
1544 	struct rt2661_tx_ring *txq = &sc->txq[ac];
1545 	struct rt2661_tx_desc *desc;
1546 	struct rt2661_tx_data *data;
1547 	struct ieee80211_frame *wh;
1548 	struct ieee80211_key *k;
1549 	struct mbuf *mnew;
1550 	uint16_t dur;
1551 	uint32_t flags = 0;
1552 	int pktlen, rate, needcts = 0, needrts = 0, error;
1553 
1554 	wh = mtod(m0, struct ieee80211_frame *);
1555 
1556 	if (wh->i_fc[1] & IEEE80211_FC1_PROTECTED) {
1557 		k = ieee80211_get_txkey(ic, wh, ni);
1558 
1559 		if ((m0 = ieee80211_encrypt(ic, m0, k)) == NULL)
1560 			return ENOBUFS;
1561 
1562 		/* packet header may have moved, reset our local pointer */
1563 		wh = mtod(m0, struct ieee80211_frame *);
1564 	}
1565 
1566 	/* compute actual packet length (including CRC and crypto overhead) */
1567 	pktlen = m0->m_pkthdr.len + IEEE80211_CRC_LEN;
1568 
1569 	/* pickup a rate */
1570 	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1571 		/* multicast frames are sent at the lowest avail. rate */
1572 		rate = ni->ni_rates.rs_rates[0];
1573 	} else if (ic->ic_fixed_rate != -1) {
1574 		rate = ic->ic_sup_rates[ic->ic_curmode].
1575 		    rs_rates[ic->ic_fixed_rate];
1576 	} else
1577 		rate = ni->ni_rates.rs_rates[ni->ni_txrate];
1578 	if (rate == 0)
1579 		rate = 2;	/* XXX should not happen */
1580 	rate &= IEEE80211_RATE_VAL;
1581 
1582 	/*
1583 	 * Packet Bursting: backoff after ppb=8 frames to give other STAs a
1584 	 * chance to contend for the wireless medium.
1585 	 */
1586 	if (ic->ic_opmode == IEEE80211_M_STA && (ni->ni_txseq & 7))
1587 		flags |= RT2661_TX_IFS_SIFS;
1588 
1589 	/* check if RTS/CTS or CTS-to-self protection must be used */
1590 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1591 		/* multicast frames are not sent at OFDM rates in 802.11b/g */
1592 		if (pktlen > ic->ic_rtsthreshold) {
1593 			needrts = 1;	/* RTS/CTS based on frame length */
1594 		} else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1595 		    RAL_RATE_IS_OFDM(rate)) {
1596 			if (ic->ic_protmode == IEEE80211_PROT_CTSONLY)
1597 				needcts = 1;	/* CTS-to-self */
1598 			else if (ic->ic_protmode == IEEE80211_PROT_RTSCTS)
1599 				needrts = 1;	/* RTS/CTS */
1600 		}
1601 	}
1602 	if (needrts || needcts) {
1603 		struct mbuf *mprot;
1604 		int protrate, ackrate;
1605 
1606 		protrate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
1607 		ackrate  = rt2661_ack_rate(ic, rate);
1608 
1609 		dur = rt2661_txtime(pktlen, rate, ic->ic_flags) +
1610 		      rt2661_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1611 		      2 * sc->sifs;
1612 		if (needrts) {
1613 			dur += rt2661_txtime(RAL_CTS_SIZE, rt2661_ack_rate(ic,
1614 			    protrate), ic->ic_flags) + sc->sifs;
1615 			mprot = ieee80211_get_rts(ic, wh, dur);
1616 		} else {
1617 			mprot = ieee80211_get_cts_to_self(ic, dur);
1618 		}
1619 		if (mprot == NULL) {
1620 			printf("%s: could not allocate protection frame\n",
1621 			    sc->sc_dev.dv_xname);
1622 			m_freem(m0);
1623 			return ENOBUFS;
1624 		}
1625 
1626 		desc = &txq->desc[txq->cur];
1627 		data = &txq->data[txq->cur];
1628 
1629 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, mprot,
1630 		    BUS_DMA_NOWAIT);
1631 		if (error != 0) {
1632 			printf("%s: could not map mbuf (error %d)\n",
1633 			    sc->sc_dev.dv_xname, error);
1634 			m_freem(mprot);
1635 			m_freem(m0);
1636 			return error;
1637 		}
1638 
1639 		data->m = mprot;
1640 		/* avoid multiple free() of the same node for each fragment */
1641 		data->ni = ieee80211_ref_node(ni);
1642 
1643 		/* XXX may want to pass the protection frame to BPF */
1644 
1645 		rt2661_setup_tx_desc(sc, desc,
1646 		    (needrts ? RT2661_TX_NEED_ACK : 0) | RT2661_TX_MORE_FRAG,
1647 		    0, mprot->m_pkthdr.len, protrate, data->map->dm_segs,
1648 		    data->map->dm_nsegs, ac);
1649 
1650 		bus_dmamap_sync(sc->sc_dmat, data->map, 0,
1651 		    data->map->dm_mapsize, BUS_DMASYNC_PREWRITE);
1652 		bus_dmamap_sync(sc->sc_dmat, txq->map,
1653 		    txq->cur * RT2661_TX_DESC_SIZE, RT2661_TX_DESC_SIZE,
1654 		    BUS_DMASYNC_PREWRITE);
1655 
1656 		txq->queued++;
1657 		txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1658 
1659 		flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS_SIFS;
1660 	}
1661 
1662 	data = &txq->data[txq->cur];
1663 	desc = &txq->desc[txq->cur];
1664 
1665 	error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1666 	    BUS_DMA_NOWAIT);
1667 	if (error != 0 && error != EFBIG) {
1668 		printf("%s: could not map mbuf (error %d)\n",
1669 		    sc->sc_dev.dv_xname, error);
1670 		m_freem(m0);
1671 		return error;
1672 	}
1673 	if (error != 0) {
1674 		/* too many fragments, linearize */
1675 
1676 		MGETHDR(mnew, M_DONTWAIT, MT_DATA);
1677 		if (mnew == NULL) {
1678 			m_freem(m0);
1679 			return ENOMEM;
1680 		}
1681 		M_DUP_PKTHDR(mnew, m0);
1682 		if (m0->m_pkthdr.len > MHLEN) {
1683 			MCLGET(mnew, M_DONTWAIT);
1684 			if (!(mnew->m_flags & M_EXT)) {
1685 				m_freem(m0);
1686 				m_freem(mnew);
1687 				return ENOMEM;
1688 			}
1689 		}
1690 
1691 		m_copydata(m0, 0, m0->m_pkthdr.len, mtod(mnew, caddr_t));
1692 		m_freem(m0);
1693 		mnew->m_len = mnew->m_pkthdr.len;
1694 		m0 = mnew;
1695 
1696 		error = bus_dmamap_load_mbuf(sc->sc_dmat, data->map, m0,
1697 		    BUS_DMA_NOWAIT);
1698 		if (error != 0) {
1699 			printf("%s: could not map mbuf (error %d)\n",
1700 			    sc->sc_dev.dv_xname, error);
1701 			m_freem(m0);
1702 			return error;
1703 		}
1704 
1705 		/* packet header have moved, reset our local pointer */
1706 		wh = mtod(m0, struct ieee80211_frame *);
1707 	}
1708 
1709 #if NBPFILTER > 0
1710 	if (sc->sc_drvbpf != NULL) {
1711 		struct mbuf mb;
1712 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1713 
1714 		tap->wt_flags = 0;
1715 		tap->wt_rate = rate;
1716 		tap->wt_chan_freq = htole16(sc->sc_curchan->ic_freq);
1717 		tap->wt_chan_flags = htole16(sc->sc_curchan->ic_flags);
1718 
1719 		mb.m_data = (caddr_t)tap;
1720 		mb.m_len = sc->sc_txtap_len;
1721 		mb.m_next = m0;
1722 		mb.m_nextpkt = NULL;
1723 		mb.m_type = 0;
1724 		mb.m_flags = 0;
1725 		bpf_mtap(sc->sc_drvbpf, &mb, BPF_DIRECTION_OUT);
1726 	}
1727 #endif
1728 
1729 	data->m = m0;
1730 	data->ni = ni;
1731 
1732 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1733 		flags |= RT2661_TX_NEED_ACK;
1734 
1735 		dur = rt2661_txtime(RAL_ACK_SIZE, rt2661_ack_rate(ic, rate),
1736 		    ic->ic_flags) + sc->sifs;
1737 		*(uint16_t *)wh->i_dur = htole16(dur);
1738 	}
1739 
1740 	rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate,
1741 	    data->map->dm_segs, data->map->dm_nsegs, ac);
1742 
1743 	bus_dmamap_sync(sc->sc_dmat, data->map, 0, data->map->dm_mapsize,
1744 	    BUS_DMASYNC_PREWRITE);
1745 	bus_dmamap_sync(sc->sc_dmat, txq->map, txq->cur * RT2661_TX_DESC_SIZE,
1746 	    RT2661_TX_DESC_SIZE, BUS_DMASYNC_PREWRITE);
1747 
1748 	DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
1749 	    m0->m_pkthdr.len, txq->cur, rate));
1750 
1751 	/* kick Tx */
1752 	txq->queued++;
1753 	txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1754 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1);
1755 
1756 	return 0;
1757 }
1758 
1759 void
1760 rt2661_start(struct ifnet *ifp)
1761 {
1762 	struct rt2661_softc *sc = ifp->if_softc;
1763 	struct ieee80211com *ic = &sc->sc_ic;
1764 	struct mbuf *m0;
1765 	struct ieee80211_node *ni;
1766 
1767 	/*
1768 	 * net80211 may still try to send management frames even if the
1769 	 * IFF_RUNNING flag is not set...
1770 	 */
1771 	if ((ifp->if_flags & (IFF_RUNNING | IFF_OACTIVE)) != IFF_RUNNING)
1772 		return;
1773 
1774 	for (;;) {
1775 		IF_POLL(&ic->ic_mgtq, m0);
1776 		if (m0 != NULL) {
1777 			if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
1778 				ifp->if_flags |= IFF_OACTIVE;
1779 				break;
1780 			}
1781 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1782 
1783 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1784 			m0->m_pkthdr.rcvif = NULL;
1785 #if NBPFILTER > 0
1786 			if (ic->ic_rawbpf != NULL)
1787 				bpf_mtap(ic->ic_rawbpf, m0, BPF_DIRECTION_OUT);
1788 #endif
1789 			if (rt2661_tx_mgt(sc, m0, ni) != 0)
1790 				break;
1791 
1792 		} else {
1793 			if (ic->ic_state != IEEE80211_S_RUN)
1794 				break;
1795 			IFQ_POLL(&ifp->if_snd, m0);
1796 			if (m0 == NULL)
1797 				break;
1798 			if (sc->txq[0].queued >= RT2661_TX_RING_COUNT - 1) {
1799 				/* there is no place left in this ring */
1800 				ifp->if_flags |= IFF_OACTIVE;
1801 				break;
1802 			}
1803 			IFQ_DEQUEUE(&ifp->if_snd, m0);
1804 #if NBPFILTER > 0
1805 			if (ifp->if_bpf != NULL)
1806 				bpf_mtap(ifp->if_bpf, m0, BPF_DIRECTION_OUT);
1807 #endif
1808 			m0 = ieee80211_encap(ifp, m0, &ni);
1809 			if (m0 == NULL)
1810 				continue;
1811 #if NBPFILTER > 0
1812 			if (ic->ic_rawbpf != NULL)
1813 				bpf_mtap(ic->ic_rawbpf, m0,
1814 				    BPF_DIRECTION_OUT);
1815 #endif
1816 			if (rt2661_tx_data(sc, m0, ni, 0) != 0) {
1817 				if (ni != NULL)
1818 					ieee80211_release_node(ic, ni);
1819 				ifp->if_oerrors++;
1820 				break;
1821 			}
1822 		}
1823 
1824 		sc->sc_tx_timer = 5;
1825 		ifp->if_timer = 1;
1826 	}
1827 }
1828 
1829 void
1830 rt2661_watchdog(struct ifnet *ifp)
1831 {
1832 	struct rt2661_softc *sc = ifp->if_softc;
1833 
1834 	ifp->if_timer = 0;
1835 
1836 	if (sc->sc_tx_timer > 0) {
1837 		if (--sc->sc_tx_timer == 0) {
1838 			printf("%s: device timeout\n", sc->sc_dev.dv_xname);
1839 			rt2661_init(ifp);
1840 			ifp->if_oerrors++;
1841 			return;
1842 		}
1843 		ifp->if_timer = 1;
1844 	}
1845 
1846 	ieee80211_watchdog(ifp);
1847 }
1848 
1849 int
1850 rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1851 {
1852 	struct rt2661_softc *sc = ifp->if_softc;
1853 	struct ieee80211com *ic = &sc->sc_ic;
1854 	struct ifaddr *ifa;
1855 	struct ifreq *ifr;
1856 	int s, error = 0;
1857 
1858 	s = splnet();
1859 
1860 	switch (cmd) {
1861 	case SIOCSIFADDR:
1862 		ifa = (struct ifaddr *)data;
1863 		ifp->if_flags |= IFF_UP;
1864 #ifdef INET
1865 		if (ifa->ifa_addr->sa_family == AF_INET)
1866 			arp_ifinit(&ic->ic_ac, ifa);
1867 #endif
1868 		/* FALLTHROUGH */
1869 	case SIOCSIFFLAGS:
1870 		if (ifp->if_flags & IFF_UP) {
1871 			if (ifp->if_flags & IFF_RUNNING)
1872 				rt2661_update_promisc(sc);
1873 			else
1874 				rt2661_init(ifp);
1875 		} else {
1876 			if (ifp->if_flags & IFF_RUNNING)
1877 				rt2661_stop(ifp, 1);
1878 		}
1879 		break;
1880 
1881 	case SIOCADDMULTI:
1882 	case SIOCDELMULTI:
1883 		ifr = (struct ifreq *)data;
1884 		error = (cmd == SIOCADDMULTI) ?
1885 		    ether_addmulti(ifr, &ic->ic_ac) :
1886 		    ether_delmulti(ifr, &ic->ic_ac);
1887 
1888 		if (error == ENETRESET)
1889 			error = 0;
1890 		break;
1891 
1892 	case SIOCS80211CHANNEL:
1893 		/*
1894 		 * This allows for fast channel switching in monitor mode
1895 		 * (used by kismet). In IBSS mode, we must explicitly reset
1896 		 * the interface to generate a new beacon frame.
1897 		 */
1898 		error = ieee80211_ioctl(ifp, cmd, data);
1899 		if (error == ENETRESET &&
1900 		    ic->ic_opmode == IEEE80211_M_MONITOR) {
1901 			if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1902 			    (IFF_UP | IFF_RUNNING))
1903 				rt2661_set_chan(sc, ic->ic_ibss_chan);
1904 			error = 0;
1905 		}
1906 		break;
1907 
1908 	default:
1909 		error = ieee80211_ioctl(ifp, cmd, data);
1910 	}
1911 
1912 	if (error == ENETRESET) {
1913 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1914 		    (IFF_UP | IFF_RUNNING))
1915 			rt2661_init(ifp);
1916 		error = 0;
1917 	}
1918 
1919 	splx(s);
1920 
1921 	return error;
1922 }
1923 
1924 void
1925 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
1926 {
1927 	uint32_t tmp;
1928 	int ntries;
1929 
1930 	for (ntries = 0; ntries < 100; ntries++) {
1931 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
1932 			break;
1933 		DELAY(1);
1934 	}
1935 	if (ntries == 100) {
1936 		printf("%s: could not write to BBP\n", sc->sc_dev.dv_xname);
1937 		return;
1938 	}
1939 
1940 	tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
1941 	RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
1942 
1943 	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
1944 }
1945 
1946 uint8_t
1947 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
1948 {
1949 	uint32_t val;
1950 	int ntries;
1951 
1952 	for (ntries = 0; ntries < 100; ntries++) {
1953 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
1954 			break;
1955 		DELAY(1);
1956 	}
1957 	if (ntries == 100) {
1958 		printf("%s: could not read from BBP\n", sc->sc_dev.dv_xname);
1959 		return 0;
1960 	}
1961 
1962 	val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
1963 	RAL_WRITE(sc, RT2661_PHY_CSR3, val);
1964 
1965 	for (ntries = 0; ntries < 100; ntries++) {
1966 		val = RAL_READ(sc, RT2661_PHY_CSR3);
1967 		if (!(val & RT2661_BBP_BUSY))
1968 			return val & 0xff;
1969 		DELAY(1);
1970 	}
1971 
1972 	printf("%s: could not read from BBP\n", sc->sc_dev.dv_xname);
1973 	return 0;
1974 }
1975 
1976 void
1977 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
1978 {
1979 	uint32_t tmp;
1980 	int ntries;
1981 
1982 	for (ntries = 0; ntries < 100; ntries++) {
1983 		if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
1984 			break;
1985 		DELAY(1);
1986 	}
1987 	if (ntries == 100) {
1988 		printf("%s: could not write to RF\n", sc->sc_dev.dv_xname);
1989 		return;
1990 	}
1991 
1992 	tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
1993 	    (reg & 3);
1994 	RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
1995 
1996 	/* remember last written value in sc */
1997 	sc->rf_regs[reg] = val;
1998 
1999 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff));
2000 }
2001 
2002 int
2003 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
2004 {
2005 	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
2006 		return EIO;	/* there is already a command pending */
2007 
2008 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
2009 	    RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
2010 
2011 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
2012 
2013 	return 0;
2014 }
2015 
2016 void
2017 rt2661_select_antenna(struct rt2661_softc *sc)
2018 {
2019 	uint8_t bbp4, bbp77;
2020 	uint32_t tmp;
2021 
2022 	bbp4  = rt2661_bbp_read(sc,  4);
2023 	bbp77 = rt2661_bbp_read(sc, 77);
2024 
2025 	/* TBD */
2026 
2027 	/* make sure Rx is disabled before switching antenna */
2028 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2029 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2030 
2031 	rt2661_bbp_write(sc,  4, bbp4);
2032 	rt2661_bbp_write(sc, 77, bbp77);
2033 
2034 	/* restore Rx filter */
2035 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2036 }
2037 
2038 /*
2039  * Enable multi-rate retries for frames sent at OFDM rates.
2040  * In 802.11b/g mode, allow fallback to CCK rates.
2041  */
2042 void
2043 rt2661_enable_mrr(struct rt2661_softc *sc)
2044 {
2045 	struct ieee80211com *ic = &sc->sc_ic;
2046 	uint32_t tmp;
2047 
2048 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2049 
2050 	tmp &= ~RT2661_MRR_CCK_FALLBACK;
2051 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan))
2052 		tmp |= RT2661_MRR_CCK_FALLBACK;
2053 	tmp |= RT2661_MRR_ENABLED;
2054 
2055 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2056 }
2057 
2058 void
2059 rt2661_set_txpreamble(struct rt2661_softc *sc)
2060 {
2061 	uint32_t tmp;
2062 
2063 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2064 
2065 	tmp &= ~RT2661_SHORT_PREAMBLE;
2066 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
2067 		tmp |= RT2661_SHORT_PREAMBLE;
2068 
2069 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2070 }
2071 
2072 void
2073 rt2661_set_basicrates(struct rt2661_softc *sc)
2074 {
2075 	struct ieee80211com *ic = &sc->sc_ic;
2076 
2077 	/* update basic rate set */
2078 	if (ic->ic_curmode == IEEE80211_MODE_11B) {
2079 		/* 11b basic rates: 1, 2Mbps */
2080 		RAL_WRITE(sc, RT2661_TXRX_CSR5, 0x3);
2081 	} else if (ic->ic_curmode == IEEE80211_MODE_11A) {
2082 		/* 11a basic rates: 6, 12, 24Mbps */
2083 		RAL_WRITE(sc, RT2661_TXRX_CSR5, 0x150);
2084 	} else {
2085 		/* 11b/g basic rates: 1, 2, 5.5, 11Mbps */
2086 		RAL_WRITE(sc, RT2661_TXRX_CSR5, 0xf);
2087 	}
2088 }
2089 
2090 /*
2091  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
2092  * driver.
2093  */
2094 void
2095 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
2096 {
2097 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
2098 	uint32_t tmp;
2099 
2100 	/* update all BBP registers that depend on the band */
2101 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
2102 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
2103 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2104 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
2105 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
2106 	}
2107 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2108 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2109 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
2110 	}
2111 
2112 	sc->bbp17 = bbp17;
2113 	rt2661_bbp_write(sc,  17, bbp17);
2114 	rt2661_bbp_write(sc,  96, bbp96);
2115 	rt2661_bbp_write(sc, 104, bbp104);
2116 
2117 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2118 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2119 		rt2661_bbp_write(sc, 75, 0x80);
2120 		rt2661_bbp_write(sc, 86, 0x80);
2121 		rt2661_bbp_write(sc, 88, 0x80);
2122 	}
2123 
2124 	rt2661_bbp_write(sc, 35, bbp35);
2125 	rt2661_bbp_write(sc, 97, bbp97);
2126 	rt2661_bbp_write(sc, 98, bbp98);
2127 
2128 	tmp = RAL_READ(sc, RT2661_PHY_CSR0);
2129 	tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
2130 	if (IEEE80211_IS_CHAN_2GHZ(c))
2131 		tmp |= RT2661_PA_PE_2GHZ;
2132 	else
2133 		tmp |= RT2661_PA_PE_5GHZ;
2134 	RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
2135 
2136 	/* 802.11a uses a 16 microseconds short interframe space */
2137 	sc->sifs = IEEE80211_IS_CHAN_5GHZ(c) ? 16 : 10;
2138 }
2139 
2140 void
2141 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
2142 {
2143 	struct ieee80211com *ic = &sc->sc_ic;
2144 	const struct rfprog *rfprog;
2145 	uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
2146 	int8_t power;
2147 	u_int i, chan;
2148 
2149 	chan = ieee80211_chan2ieee(ic, c);
2150 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2151 		return;
2152 
2153 	/* select the appropriate RF settings based on what EEPROM says */
2154 	rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
2155 
2156 	/* find the settings for this channel (we know it exists) */
2157 	for (i = 0; rfprog[i].chan != chan; i++);
2158 
2159 	power = sc->txpow[i];
2160 	if (power < 0) {
2161 		bbp94 += power;
2162 		power = 0;
2163 	} else if (power > 31) {
2164 		bbp94 += power - 31;
2165 		power = 31;
2166 	}
2167 
2168 	/*
2169 	 * If we are switching from the 2GHz band to the 5GHz band or
2170 	 * vice-versa, BBP registers need to be reprogrammed.
2171 	 */
2172 	if (c->ic_flags != sc->sc_curchan->ic_flags) {
2173 		rt2661_select_band(sc, c);
2174 		rt2661_select_antenna(sc);
2175 	}
2176 	sc->sc_curchan = c;
2177 
2178 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2179 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2180 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2181 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2182 
2183 	DELAY(200);
2184 
2185 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2186 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2187 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
2188 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2189 
2190 	DELAY(200);
2191 
2192 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2193 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2194 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2195 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2196 
2197 	/* enable smart mode for MIMO-capable RFs */
2198 	bbp3 = rt2661_bbp_read(sc, 3);
2199 
2200 	bbp3 &= ~RT2661_SMART_MODE;
2201 	if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
2202 		bbp3 |= RT2661_SMART_MODE;
2203 
2204 	rt2661_bbp_write(sc, 3, bbp3);
2205 
2206 	if (bbp94 != RT2661_BBPR94_DEFAULT)
2207 		rt2661_bbp_write(sc, 94, bbp94);
2208 
2209 	/* 5GHz radio needs a 1ms delay here */
2210 	if (IEEE80211_IS_CHAN_5GHZ(c))
2211 		DELAY(1000);
2212 }
2213 
2214 void
2215 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
2216 {
2217 	uint32_t tmp;
2218 
2219 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2220 	RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
2221 
2222 	tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
2223 	RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
2224 }
2225 
2226 void
2227 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
2228 {
2229 	uint32_t tmp;
2230 
2231 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2232 	RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
2233 
2234 	tmp = addr[4] | addr[5] << 8 | 0xff << 16;
2235 	RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
2236 }
2237 
2238 void
2239 rt2661_update_promisc(struct rt2661_softc *sc)
2240 {
2241 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2242 	uint32_t tmp;
2243 
2244 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2245 
2246 	tmp &= ~RT2661_DROP_NOT_TO_ME;
2247 	if (!(ifp->if_flags & IFF_PROMISC))
2248 		tmp |= RT2661_DROP_NOT_TO_ME;
2249 
2250 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2251 
2252 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2253 	    "entering" : "leaving"));
2254 }
2255 
2256 void
2257 rt2661_updateslot(struct ieee80211com *ic)
2258 {
2259 	struct rt2661_softc *sc = ic->ic_if.if_softc;
2260 
2261 #ifndef IEEE80211_STA_ONLY
2262 	if (ic->ic_opmode == IEEE80211_M_HOSTAP) {
2263 		/*
2264 		 * In HostAP mode, we defer setting of new slot time until
2265 		 * updated ERP Information Element has propagated to all
2266 		 * associated STAs.
2267 		 */
2268 		sc->sc_flags |= RT2661_UPDATE_SLOT;
2269 	} else
2270 #endif
2271 		rt2661_set_slottime(sc);
2272 }
2273 
2274 void
2275 rt2661_set_slottime(struct rt2661_softc *sc)
2276 {
2277 	struct ieee80211com *ic = &sc->sc_ic;
2278 	uint8_t slottime;
2279 	uint32_t tmp;
2280 
2281 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2282 
2283 	tmp = RAL_READ(sc, RT2661_MAC_CSR9);
2284 	tmp = (tmp & ~0xff) | slottime;
2285 	RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
2286 
2287 	DPRINTF(("setting slot time to %uus\n", slottime));
2288 }
2289 
2290 const char *
2291 rt2661_get_rf(int rev)
2292 {
2293 	switch (rev) {
2294 	case RT2661_RF_5225:	return "RT5225";
2295 	case RT2661_RF_5325:	return "RT5325 (MIMO XR)";
2296 	case RT2661_RF_2527:	return "RT2527";
2297 	case RT2661_RF_2529:	return "RT2529 (MIMO XR)";
2298 	default:		return "unknown";
2299 	}
2300 }
2301 
2302 void
2303 rt2661_read_eeprom(struct rt2661_softc *sc)
2304 {
2305 	struct ieee80211com *ic = &sc->sc_ic;
2306 	uint16_t val;
2307 	int i;
2308 
2309 	/* read MAC address */
2310 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
2311 	ic->ic_myaddr[0] = val & 0xff;
2312 	ic->ic_myaddr[1] = val >> 8;
2313 
2314 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
2315 	ic->ic_myaddr[2] = val & 0xff;
2316 	ic->ic_myaddr[3] = val >> 8;
2317 
2318 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
2319 	ic->ic_myaddr[4] = val & 0xff;
2320 	ic->ic_myaddr[5] = val >> 8;
2321 
2322 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
2323 	/* XXX: test if different from 0xffff? */
2324 	sc->rf_rev   = (val >> 11) & 0x1f;
2325 	sc->hw_radio = (val >> 10) & 0x1;
2326 	sc->rx_ant   = (val >> 4)  & 0x3;
2327 	sc->tx_ant   = (val >> 2)  & 0x3;
2328 	sc->nb_ant   = val & 0x3;
2329 
2330 	DPRINTF(("RF revision=%d\n", sc->rf_rev));
2331 
2332 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
2333 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
2334 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
2335 
2336 	DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
2337 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
2338 
2339 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
2340 	if ((val & 0xff) != 0xff)
2341 		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
2342 
2343 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
2344 	if ((val & 0xff) != 0xff)
2345 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2346 
2347 	/* adjust RSSI correction for external low-noise amplifier */
2348 	if (sc->ext_2ghz_lna)
2349 		sc->rssi_2ghz_corr -= 14;
2350 	if (sc->ext_5ghz_lna)
2351 		sc->rssi_5ghz_corr -= 14;
2352 
2353 	DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
2354 	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
2355 
2356 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
2357 	if ((val >> 8) != 0xff)
2358 		sc->rfprog = (val >> 8) & 0x3;
2359 	if ((val & 0xff) != 0xff)
2360 		sc->rffreq = val & 0xff;
2361 
2362 	DPRINTF(("RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq));
2363 
2364 	/* read Tx power for all a/b/g channels */
2365 	for (i = 0; i < 19; i++) {
2366 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
2367 		sc->txpow[i * 2] = (int8_t)(val >> 8);		/* signed */
2368 		DPRINTF(("Channel=%d Tx power=%d\n",
2369 		    rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]));
2370 		sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);	/* signed */
2371 		DPRINTF(("Channel=%d Tx power=%d\n",
2372 		    rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]));
2373 	}
2374 
2375 	/* read vendor-specific BBP values */
2376 	for (i = 0; i < 16; i++) {
2377 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
2378 		if (val == 0 || val == 0xffff)
2379 			continue;	/* skip invalid entries */
2380 		sc->bbp_prom[i].reg = val >> 8;
2381 		sc->bbp_prom[i].val = val & 0xff;
2382 		DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
2383 		    sc->bbp_prom[i].val));
2384 	}
2385 }
2386 
2387 int
2388 rt2661_bbp_init(struct rt2661_softc *sc)
2389 {
2390 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2391 	int i, ntries;
2392 
2393 	/* wait for BBP to be ready */
2394 	for (ntries = 0; ntries < 100; ntries++) {
2395 		const uint8_t val = rt2661_bbp_read(sc, 0);
2396 		if (val != 0 && val != 0xff)
2397 			break;
2398 		DELAY(100);
2399 	}
2400 	if (ntries == 100) {
2401 		printf("%s: timeout waiting for BBP\n", sc->sc_dev.dv_xname);
2402 		return EIO;
2403 	}
2404 
2405 	/* initialize BBP registers to default values */
2406 	for (i = 0; i < N(rt2661_def_bbp); i++) {
2407 		rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
2408 		    rt2661_def_bbp[i].val);
2409 	}
2410 
2411 	/* write vendor-specific BBP values (from EEPROM) */
2412 	for (i = 0; i < 16; i++) {
2413 		if (sc->bbp_prom[i].reg == 0)
2414 			continue;
2415 		rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2416 	}
2417 
2418 	return 0;
2419 #undef N
2420 }
2421 
2422 int
2423 rt2661_init(struct ifnet *ifp)
2424 {
2425 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2426 	struct rt2661_softc *sc = ifp->if_softc;
2427 	struct ieee80211com *ic = &sc->sc_ic;
2428 	const char *name = NULL;	/* make lint happy */
2429 	uint8_t *ucode;
2430 	size_t size;
2431 	uint32_t tmp, sta[3];
2432 	int i, ntries, error;
2433 
2434 	/* for CardBus, power on the socket */
2435 	if (!(sc->sc_flags & RT2661_ENABLED)) {
2436 		if (sc->sc_enable != NULL && (*sc->sc_enable)(sc) != 0) {
2437 			printf("%s: could not enable device\n",
2438 			    sc->sc_dev.dv_xname);
2439 			return EIO;
2440 		}
2441 		sc->sc_flags |= RT2661_ENABLED;
2442 	}
2443 
2444 	rt2661_stop(ifp, 0);
2445 
2446 	if (!(sc->sc_flags & RT2661_FWLOADED)) {
2447 		switch (sc->sc_id) {
2448 		case PCI_PRODUCT_RALINK_RT2561:
2449 			name = "ral-rt2561";
2450 			break;
2451 		case PCI_PRODUCT_RALINK_RT2561S:
2452 			name = "ral-rt2561s";
2453 			break;
2454 		case PCI_PRODUCT_RALINK_RT2661:
2455 			name = "ral-rt2661";
2456 			break;
2457 		}
2458 
2459 		if ((error = loadfirmware(name, &ucode, &size)) != 0) {
2460 			printf("%s: error %d, could not read firmware %s\n",
2461 			    sc->sc_dev.dv_xname, error, name);
2462 			rt2661_stop(ifp, 1);
2463 			return EIO;
2464 		}
2465 
2466 		if (rt2661_load_microcode(sc, ucode, size) != 0) {
2467 			printf("%s: could not load 8051 microcode\n",
2468 			    sc->sc_dev.dv_xname);
2469 			free(ucode, M_DEVBUF);
2470 			rt2661_stop(ifp, 1);
2471 			return EIO;
2472 		}
2473 
2474 		free(ucode, M_DEVBUF);
2475 		sc->sc_flags |= RT2661_FWLOADED;
2476 	}
2477 
2478 	/* initialize Tx rings */
2479 	RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
2480 	RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
2481 	RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
2482 	RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
2483 
2484 	/* initialize Mgt ring */
2485 	RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
2486 
2487 	/* initialize Rx ring */
2488 	RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
2489 
2490 	/* initialize Tx rings sizes */
2491 	RAL_WRITE(sc, RT2661_TX_RING_CSR0,
2492 	    RT2661_TX_RING_COUNT << 24 |
2493 	    RT2661_TX_RING_COUNT << 16 |
2494 	    RT2661_TX_RING_COUNT <<  8 |
2495 	    RT2661_TX_RING_COUNT);
2496 
2497 	RAL_WRITE(sc, RT2661_TX_RING_CSR1,
2498 	    RT2661_TX_DESC_WSIZE << 16 |
2499 	    RT2661_TX_RING_COUNT <<  8 |	/* XXX: HCCA ring unused */
2500 	    RT2661_MGT_RING_COUNT);
2501 
2502 	/* initialize Rx rings */
2503 	RAL_WRITE(sc, RT2661_RX_RING_CSR,
2504 	    RT2661_RX_DESC_BACK  << 16 |
2505 	    RT2661_RX_DESC_WSIZE <<  8 |
2506 	    RT2661_RX_RING_COUNT);
2507 
2508 	/* XXX: some magic here */
2509 	RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
2510 
2511 	/* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
2512 	RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
2513 
2514 	/* load base address of Rx ring */
2515 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
2516 
2517 	/* initialize MAC registers to default values */
2518 	for (i = 0; i < N(rt2661_def_mac); i++)
2519 		RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
2520 
2521 	IEEE80211_ADDR_COPY(ic->ic_myaddr, LLADDR(ifp->if_sadl));
2522 	rt2661_set_macaddr(sc, ic->ic_myaddr);
2523 
2524 	/* set host ready */
2525 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2526 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2527 
2528 	/* wait for BBP/RF to wakeup */
2529 	for (ntries = 0; ntries < 1000; ntries++) {
2530 		if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
2531 			break;
2532 		DELAY(1000);
2533 	}
2534 	if (ntries == 1000) {
2535 		printf("timeout waiting for BBP/RF to wakeup\n");
2536 		rt2661_stop(ifp, 1);
2537 		return EIO;
2538 	}
2539 
2540 	if (rt2661_bbp_init(sc) != 0) {
2541 		rt2661_stop(ifp, 1);
2542 		return EIO;
2543 	}
2544 
2545 	/* select default channel */
2546 	sc->sc_curchan = ic->ic_bss->ni_chan = ic->ic_ibss_chan;
2547 	rt2661_select_band(sc, sc->sc_curchan);
2548 	rt2661_select_antenna(sc);
2549 	rt2661_set_chan(sc, sc->sc_curchan);
2550 
2551 	/* update Rx filter */
2552 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
2553 
2554 	tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
2555 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2556 		tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
2557 		       RT2661_DROP_ACKCTS;
2558 #ifndef IEEE80211_STA_ONLY
2559 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2560 #endif
2561 			tmp |= RT2661_DROP_TODS;
2562 		if (!(ifp->if_flags & IFF_PROMISC))
2563 			tmp |= RT2661_DROP_NOT_TO_ME;
2564 	}
2565 
2566 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2567 
2568 	/* clear STA registers */
2569 	RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
2570 
2571 	/* initialize ASIC */
2572 	RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
2573 
2574 	/* clear any pending interrupt */
2575 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2576 
2577 	/* enable interrupts */
2578 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
2579 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
2580 
2581 	/* kick Rx */
2582 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
2583 
2584 	ifp->if_flags &= ~IFF_OACTIVE;
2585 	ifp->if_flags |= IFF_RUNNING;
2586 
2587 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2588 		ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2589 	else
2590 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2591 
2592 	return 0;
2593 #undef N
2594 }
2595 
2596 void
2597 rt2661_stop(struct ifnet *ifp, int disable)
2598 {
2599 	struct rt2661_softc *sc = ifp->if_softc;
2600 	struct ieee80211com *ic = &sc->sc_ic;
2601 	uint32_t tmp;
2602 	int ac;
2603 
2604 	sc->sc_tx_timer = 0;
2605 	ifp->if_timer = 0;
2606 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2607 
2608 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);	/* free all nodes */
2609 
2610 	/* abort Tx (for all 5 Tx rings) */
2611 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
2612 
2613 	/* disable Rx (value remains after reset!) */
2614 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2615 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2616 
2617 	/* reset ASIC */
2618 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2619 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2620 
2621 	/* disable interrupts */
2622 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
2623 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
2624 
2625 	/* clear any pending interrupt */
2626 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2627 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
2628 
2629 	/* reset Tx and Rx rings */
2630 	for (ac = 0; ac < 4; ac++)
2631 		rt2661_reset_tx_ring(sc, &sc->txq[ac]);
2632 	rt2661_reset_tx_ring(sc, &sc->mgtq);
2633 	rt2661_reset_rx_ring(sc, &sc->rxq);
2634 
2635 	/* for CardBus, power down the socket */
2636 	if (disable && sc->sc_disable != NULL) {
2637 		if (sc->sc_flags & RT2661_ENABLED) {
2638 			(*sc->sc_disable)(sc);
2639 			sc->sc_flags &= ~(RT2661_ENABLED | RT2661_FWLOADED);
2640 		}
2641 	}
2642 }
2643 
2644 int
2645 rt2661_load_microcode(struct rt2661_softc *sc, const uint8_t *ucode, int size)
2646 {
2647 	int ntries;
2648 
2649 	/* reset 8051 */
2650 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2651 
2652 	/* cancel any pending Host to MCU command */
2653 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
2654 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
2655 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
2656 
2657 	/* write 8051's microcode */
2658 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
2659 	RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, ucode, size);
2660 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2661 
2662 	/* kick 8051's ass */
2663 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
2664 
2665 	/* wait for 8051 to initialize */
2666 	for (ntries = 0; ntries < 500; ntries++) {
2667 		if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
2668 			break;
2669 		DELAY(100);
2670 	}
2671 	if (ntries == 500) {
2672 		printf("%s: timeout waiting for MCU to initialize\n",
2673 		    sc->sc_dev.dv_xname);
2674 		return EIO;
2675 	}
2676 	return 0;
2677 }
2678 
2679 /*
2680  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
2681  * false CCA count.  This function is called periodically (every seconds) when
2682  * in the RUN state.  Values taken from the reference driver.
2683  */
2684 void
2685 rt2661_rx_tune(struct rt2661_softc *sc)
2686 {
2687 	uint8_t bbp17;
2688 	uint16_t cca;
2689 	int lo, hi, dbm;
2690 
2691 	/*
2692 	 * Tuning range depends on operating band and on the presence of an
2693 	 * external low-noise amplifier.
2694 	 */
2695 	lo = 0x20;
2696 	if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
2697 		lo += 0x08;
2698 	if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
2699 	    (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
2700 		lo += 0x10;
2701 	hi = lo + 0x20;
2702 
2703 	dbm = sc->avg_rssi;
2704 	/* retrieve false CCA count since last call (clear on read) */
2705 	cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
2706 
2707 	DPRINTFN(2, ("RSSI=%ddBm false CCA=%d\n", dbm, cca));
2708 
2709 	if (dbm < -74) {
2710 		/* very bad RSSI, tune using false CCA count */
2711 		bbp17 = sc->bbp17; /* current value */
2712 
2713 		hi -= 2 * (-74 - dbm);
2714 		if (hi < lo)
2715 			hi = lo;
2716 
2717 		if (bbp17 > hi)
2718 			bbp17 = hi;
2719 		else if (cca > 512)
2720 			bbp17 = min(bbp17 + 1, hi);
2721 		else if (cca < 100)
2722 			bbp17 = max(bbp17 - 1, lo);
2723 
2724 	} else if (dbm < -66) {
2725 		bbp17 = lo + 0x08;
2726 	} else if (dbm < -58) {
2727 		bbp17 = lo + 0x10;
2728 	} else if (dbm < -35) {
2729 		bbp17 = hi;
2730 	} else {	/* very good RSSI >= -35dBm */
2731 		bbp17 = 0x60;	/* very low sensitivity */
2732 	}
2733 
2734 	if (bbp17 != sc->bbp17) {
2735 		DPRINTF(("BBP17 %x->%x\n", sc->bbp17, bbp17));
2736 		rt2661_bbp_write(sc, 17, bbp17);
2737 		sc->bbp17 = bbp17;
2738 	}
2739 }
2740 
2741 #ifdef notyet
2742 /*
2743  * Enter/Leave radar detection mode.
2744  * This is for 802.11h additional regulatory domains.
2745  */
2746 void
2747 rt2661_radar_start(struct rt2661_softc *sc)
2748 {
2749 	uint32_t tmp;
2750 
2751 	/* disable Rx */
2752 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2753 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2754 
2755 	rt2661_bbp_write(sc, 82, 0x20);
2756 	rt2661_bbp_write(sc, 83, 0x00);
2757 	rt2661_bbp_write(sc, 84, 0x40);
2758 
2759 	/* save current BBP registers values */
2760 	sc->bbp18 = rt2661_bbp_read(sc, 18);
2761 	sc->bbp21 = rt2661_bbp_read(sc, 21);
2762 	sc->bbp22 = rt2661_bbp_read(sc, 22);
2763 	sc->bbp16 = rt2661_bbp_read(sc, 16);
2764 	sc->bbp17 = rt2661_bbp_read(sc, 17);
2765 	sc->bbp64 = rt2661_bbp_read(sc, 64);
2766 
2767 	rt2661_bbp_write(sc, 18, 0xff);
2768 	rt2661_bbp_write(sc, 21, 0x3f);
2769 	rt2661_bbp_write(sc, 22, 0x3f);
2770 	rt2661_bbp_write(sc, 16, 0xbd);
2771 	rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
2772 	rt2661_bbp_write(sc, 64, 0x21);
2773 
2774 	/* restore Rx filter */
2775 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2776 }
2777 
2778 int
2779 rt2661_radar_stop(struct rt2661_softc *sc)
2780 {
2781 	uint8_t bbp66;
2782 
2783 	/* read radar detection result */
2784 	bbp66 = rt2661_bbp_read(sc, 66);
2785 
2786 	/* restore BBP registers values */
2787 	rt2661_bbp_write(sc, 16, sc->bbp16);
2788 	rt2661_bbp_write(sc, 17, sc->bbp17);
2789 	rt2661_bbp_write(sc, 18, sc->bbp18);
2790 	rt2661_bbp_write(sc, 21, sc->bbp21);
2791 	rt2661_bbp_write(sc, 22, sc->bbp22);
2792 	rt2661_bbp_write(sc, 64, sc->bbp64);
2793 
2794 	return bbp66 == 1;
2795 }
2796 #endif
2797 
2798 #ifndef IEEE80211_STA_ONLY
2799 int
2800 rt2661_prepare_beacon(struct rt2661_softc *sc)
2801 {
2802 	struct ieee80211com *ic = &sc->sc_ic;
2803 	struct ieee80211_node *ni = ic->ic_bss;
2804 	struct rt2661_tx_desc desc;
2805 	struct mbuf *m0;
2806 	int rate;
2807 
2808 	m0 = ieee80211_beacon_alloc(ic, ni);
2809 	if (m0 == NULL) {
2810 		printf("%s: could not allocate beacon frame\n",
2811 		    sc->sc_dev.dv_xname);
2812 		return ENOBUFS;
2813 	}
2814 
2815 	/* send beacons at the lowest available rate */
2816 	rate = IEEE80211_IS_CHAN_5GHZ(ni->ni_chan) ? 12 : 2;
2817 
2818 	rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
2819 	    m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
2820 
2821 	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2822 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2823 
2824 	/* copy beacon header and payload into NIC memory */
2825 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
2826 	    mtod(m0, uint8_t *), m0->m_pkthdr.len);
2827 
2828 	m_freem(m0);
2829 
2830 	/*
2831 	 * Store offset of ERP Information Element so that we can update it
2832 	 * dynamically when the slot time changes.
2833 	 * XXX: this is ugly since it depends on how net80211 builds beacon
2834 	 * frames but ieee80211_beacon_alloc() doesn't store offsets for us.
2835 	 */
2836 	if (ic->ic_curmode == IEEE80211_MODE_11G) {
2837 		sc->erp_csr =
2838 		    RT2661_HW_BEACON_BASE0 + 24 +
2839 		    sizeof (struct ieee80211_frame) +
2840 		    8 + 2 + 2 +
2841 		    ((ic->ic_flags & IEEE80211_F_HIDENWID) ?
2842 			1 : 2 + ni->ni_esslen) +
2843 		    2 + min(ni->ni_rates.rs_nrates, IEEE80211_RATE_SIZE) +
2844 		    2 + 1 +
2845 		    ((ic->ic_opmode == IEEE80211_M_IBSS) ? 4 : 6) +
2846 		    2;
2847 	}
2848 
2849 	return 0;
2850 }
2851 #endif
2852 
2853 /*
2854  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
2855  * and HostAP operating modes.
2856  */
2857 void
2858 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
2859 {
2860 	struct ieee80211com *ic = &sc->sc_ic;
2861 	uint32_t tmp;
2862 
2863 #ifndef IEEE80211_STA_ONLY
2864 	if (ic->ic_opmode != IEEE80211_M_STA) {
2865 		/*
2866 		 * Change default 16ms TBTT adjustment to 8ms.
2867 		 * Must be done before enabling beacon generation.
2868 		 */
2869 		RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
2870 	}
2871 #endif
2872 	tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
2873 
2874 	/* set beacon interval (in 1/16ms unit) */
2875 	tmp |= ic->ic_bss->ni_intval * 16;
2876 
2877 	tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
2878 	if (ic->ic_opmode == IEEE80211_M_STA)
2879 		tmp |= RT2661_TSF_MODE(1);
2880 #ifndef IEEE80211_STA_ONLY
2881 	else
2882 		tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
2883 #endif
2884 	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
2885 }
2886 
2887 /*
2888  * Retrieve the "Received Signal Strength Indicator" from the raw values
2889  * contained in Rx descriptors.  The computation depends on which band the
2890  * frame was received.  Correction values taken from the reference driver.
2891  */
2892 int
2893 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
2894 {
2895 	int lna, agc, rssi;
2896 
2897 	lna = (raw >> 5) & 0x3;
2898 	agc = raw & 0x1f;
2899 
2900 	rssi = 2 * agc;
2901 
2902 	if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
2903 		rssi += sc->rssi_2ghz_corr;
2904 
2905 		if (lna == 1)
2906 			rssi -= 64;
2907 		else if (lna == 2)
2908 			rssi -= 74;
2909 		else if (lna == 3)
2910 			rssi -= 90;
2911 	} else {
2912 		rssi += sc->rssi_5ghz_corr;
2913 
2914 		if (lna == 1)
2915 			rssi -= 64;
2916 		else if (lna == 2)
2917 			rssi -= 86;
2918 		else if (lna == 3)
2919 			rssi -= 100;
2920 	}
2921 	return rssi;
2922 }
2923 
2924 void
2925 rt2661_power(int why, void *arg)
2926 {
2927 	struct rt2661_softc *sc = arg;
2928 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2929 	int s;
2930 
2931 	DPRINTF(("%s: rt2661_power(%d)\n", sc->sc_dev.dv_xname, why));
2932 
2933 	s = splnet();
2934 	switch (why) {
2935 	case PWR_SUSPEND:
2936 	case PWR_STANDBY:
2937 		rt2661_stop(ifp, 1);
2938 		sc->sc_flags &= ~RT2661_FWLOADED;
2939 		if (sc->sc_power != NULL)
2940 			(*sc->sc_power)(sc, why);
2941 		break;
2942 	case PWR_RESUME:
2943 		if (ifp->if_flags & IFF_UP) {
2944 			rt2661_init(ifp);
2945 			if (sc->sc_power != NULL)
2946 				(*sc->sc_power)(sc, why);
2947 			if (ifp->if_flags & IFF_RUNNING)
2948 				rt2661_start(ifp);
2949 		}
2950 		break;
2951 	}
2952 	splx(s);
2953 }
2954 
2955 void
2956 rt2661_shutdown(void *arg)
2957 {
2958 	struct rt2661_softc *sc = arg;
2959 	struct ifnet *ifp = &sc->sc_ic.ic_if;
2960 
2961 	rt2661_stop(ifp, 1);
2962 }
2963