xref: /dragonfly/sys/dev/netif/ral/rt2661.c (revision 62f7f702)
1 /*
2  * Copyright (c) 2006
3  *	Damien Bergamini <damien.bergamini@free.fr>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $FreeBSD: src/sys/dev/ral/rt2661.c,v 1.4 2006/03/21 21:15:43 damien Exp $
18  * $DragonFly: src/sys/dev/netif/ral/rt2661.c,v 1.29 2008/02/08 09:42:30 sephe Exp $
19  */
20 
21 /*
22  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
23  * http://www.ralinktech.com/
24  */
25 
26 #include <sys/param.h>
27 #include <sys/bus.h>
28 #include <sys/endian.h>
29 #include <sys/kernel.h>
30 #include <sys/malloc.h>
31 #include <sys/mbuf.h>
32 #include <sys/module.h>
33 #include <sys/queue.h>
34 #include <sys/rman.h>
35 #include <sys/socket.h>
36 #include <sys/sockio.h>
37 #include <sys/sysctl.h>
38 #include <sys/serialize.h>
39 
40 #include <net/bpf.h>
41 #include <net/if.h>
42 #include <net/if_arp.h>
43 #include <net/ethernet.h>
44 #include <net/if_dl.h>
45 #include <net/if_media.h>
46 #include <net/ifq_var.h>
47 
48 #include <netproto/802_11/ieee80211_var.h>
49 #include <netproto/802_11/ieee80211_radiotap.h>
50 #include <netproto/802_11/wlan_ratectl/onoe/ieee80211_onoe_param.h>
51 #include <netproto/802_11/wlan_ratectl/sample/ieee80211_sample_param.h>
52 
53 #include <dev/netif/ral/rt2661reg.h>
54 #include <dev/netif/ral/rt2661var.h>
55 #include <dev/netif/ral/rt2661_ucode.h>
56 
57 #ifdef RAL_DEBUG
58 #define DPRINTF(sc, x)		\
59 	do { if ((sc)->sc_debug > 0) kprintf x; } while (0)
60 #define DPRINTFN(sc, n, x)	\
61 	do { if ((sc)->sc_debug >= (n)) kprintf x; } while (0)
62 #else
63 #define DPRINTF(sc, x)
64 #define DPRINTFN(sc, n, x)
65 #endif
66 
67 MALLOC_DEFINE(M_RT2661, "rt2661_ratectl", "rt2661 rate control data");
68 
69 static void		rt2661_dma_map_addr(void *, bus_dma_segment_t *, int,
70 			    int);
71 static void		rt2661_dma_map_mbuf(void *, bus_dma_segment_t *, int,
72 					    bus_size_t, int);
73 static int		rt2661_alloc_tx_ring(struct rt2661_softc *,
74 			    struct rt2661_tx_ring *, int);
75 static void		rt2661_reset_tx_ring(struct rt2661_softc *,
76 			    struct rt2661_tx_ring *);
77 static void		rt2661_free_tx_ring(struct rt2661_softc *,
78 			    struct rt2661_tx_ring *);
79 static int		rt2661_alloc_rx_ring(struct rt2661_softc *,
80 			    struct rt2661_rx_ring *, int);
81 static void		rt2661_reset_rx_ring(struct rt2661_softc *,
82 			    struct rt2661_rx_ring *);
83 static void		rt2661_free_rx_ring(struct rt2661_softc *,
84 			    struct rt2661_rx_ring *);
85 static int		rt2661_media_change(struct ifnet *);
86 static void		rt2661_next_scan(void *);
87 static int		rt2661_newstate(struct ieee80211com *,
88 			    enum ieee80211_state, int);
89 static uint16_t		rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
90 static void		rt2661_rx_intr(struct rt2661_softc *);
91 static void		rt2661_tx_intr(struct rt2661_softc *);
92 static void		rt2661_tx_dma_intr(struct rt2661_softc *,
93 			    struct rt2661_tx_ring *);
94 static void		rt2661_mcu_beacon_expire(struct rt2661_softc *);
95 static void		rt2661_mcu_wakeup(struct rt2661_softc *);
96 static void		rt2661_mcu_cmd_intr(struct rt2661_softc *);
97 static uint8_t		rt2661_rxrate(struct rt2661_rx_desc *);
98 static uint8_t		rt2661_plcp_signal(int);
99 static void		rt2661_setup_tx_desc(struct rt2661_softc *,
100 			    struct rt2661_tx_desc *, uint32_t, uint16_t, int,
101 			    int, const bus_dma_segment_t *, int, int, int,
102 			    const struct ieee80211_key *, void *,
103 			    const struct ieee80211_crypto_iv *);
104 static struct mbuf *	rt2661_get_rts(struct rt2661_softc *,
105 			    struct ieee80211_frame *, uint16_t);
106 static int		rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
107 			    struct ieee80211_node *, int);
108 static int		rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
109 			    struct ieee80211_node *);
110 static void		rt2661_start(struct ifnet *);
111 static void		rt2661_watchdog(struct ifnet *);
112 static int		rt2661_reset(struct ifnet *);
113 static int		rt2661_ioctl(struct ifnet *, u_long, caddr_t,
114 				     struct ucred *);
115 static void		rt2661_bbp_write(struct rt2661_softc *, uint8_t,
116 			    uint8_t);
117 static uint8_t		rt2661_bbp_read(struct rt2661_softc *, uint8_t);
118 static void		rt2661_rf_write(struct rt2661_softc *, uint8_t,
119 			    uint32_t);
120 static int		rt2661_tx_cmd(struct rt2661_softc *, uint8_t,
121 			    uint16_t);
122 static void		rt2661_select_antenna(struct rt2661_softc *);
123 static void		rt2661_enable_mrr(struct rt2661_softc *);
124 static void		rt2661_set_txpreamble(struct rt2661_softc *);
125 static void		rt2661_set_ackrates(struct rt2661_softc *,
126 			    const struct ieee80211_rateset *);
127 static void		rt2661_select_band(struct rt2661_softc *,
128 			    struct ieee80211_channel *);
129 static void		rt2661_set_chan(struct rt2661_softc *,
130 			    struct ieee80211_channel *);
131 static void		rt2661_set_bssid(struct rt2661_softc *,
132 			    const uint8_t *);
133 static void		rt2661_set_macaddr(struct rt2661_softc *,
134 			   const uint8_t *);
135 static void		rt2661_update_promisc(struct rt2661_softc *);
136 static int		rt2661_wme_update(struct ieee80211com *) __unused;
137 static void		rt2661_update_slot(struct ifnet *);
138 static const char	*rt2661_get_rf(int);
139 static void		rt2661_read_config(struct rt2661_softc *);
140 static void		rt2661_read_txpower_config(struct rt2661_softc *,
141 						   uint8_t, int, int *);
142 static int		rt2661_bbp_init(struct rt2661_softc *);
143 static void		rt2661_init(void *);
144 static void		rt2661_stop(void *);
145 static void		rt2661_intr(void *);
146 static int		rt2661_load_microcode(struct rt2661_softc *,
147 			    const uint8_t *, int);
148 static int		rt2661_prepare_beacon(struct rt2661_softc *);
149 static void		rt2661_enable_tsf_sync(struct rt2661_softc *);
150 static int		rt2661_get_rssi(struct rt2661_softc *, uint8_t, int);
151 static void		rt2661_led_newstate(struct rt2661_softc *,
152 					    enum ieee80211_state);
153 static int		rt2661_key_alloc(struct ieee80211com *,
154 					 const struct ieee80211_key *,
155 					 ieee80211_keyix *, ieee80211_keyix *);
156 static int		rt2661_key_delete(struct ieee80211com *,
157 					  const struct ieee80211_key *);
158 static int		rt2661_key_set(struct ieee80211com *,
159 				       const struct ieee80211_key *,
160 				       const uint8_t mac[IEEE80211_ADDR_LEN]);
161 static void		*rt2661_ratectl_attach(struct ieee80211com *, u_int);
162 static void		rt2661_set_txpower(struct rt2661_softc *, int8_t);
163 static void		rt2661_calibrate(void *);
164 static void		rt2661_calib_txpower(struct rt2661_softc *);
165 static void		rt2661_calib_rxsensibility(struct rt2661_softc *,
166 						   uint32_t);
167 
168 /*
169  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
170  */
171 static const struct ieee80211_rateset rt2661_rateset_11a =
172 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
173 
174 static const struct ieee80211_rateset rt2661_rateset_11b =
175 	{ 4, { 2, 4, 11, 22 } };
176 
177 static const struct ieee80211_rateset rt2661_rateset_11g =
178 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
179 
180 static const struct {
181 	uint32_t	reg;
182 	uint32_t	val;
183 } rt2661_def_mac[] = {
184 	RT2661_DEF_MAC
185 };
186 
187 static const struct {
188 	uint8_t	reg;
189 	uint8_t	val;
190 } rt2661_def_bbp[] = {
191 	RT2661_DEF_BBP
192 };
193 
194 static const struct rt2661_rfprog rt2661_rf5225_1[] = { RT2661_RF5225_1 };
195 static const struct rt2661_rfprog rt2661_rf5225_2[] = { RT2661_RF5225_2 };
196 
197 #define LED_EE2MCU(bit)	{ \
198 	.ee_bit		= RT2661_EE_LED_##bit, \
199 	.mcu_bit	= RT2661_MCU_LED_##bit \
200 }
201 static const struct {
202 	uint16_t	ee_bit;
203 	uint16_t	mcu_bit;
204 } led_ee2mcu[] = {
205 	LED_EE2MCU(RDYG),
206 	LED_EE2MCU(RDYA),
207 	LED_EE2MCU(ACT),
208 	LED_EE2MCU(GPIO0),
209 	LED_EE2MCU(GPIO1),
210 	LED_EE2MCU(GPIO2),
211 	LED_EE2MCU(GPIO3),
212 	LED_EE2MCU(GPIO4)
213 };
214 #undef LED_EE2MCU
215 
216 struct rt2661_dmamap {
217 	bus_dma_segment_t	segs[RT2661_MAX_SCATTER];
218 	int			nseg;
219 };
220 
221 static __inline int
222 rt2661_cipher(const struct ieee80211_key *k)
223 {
224 	switch (k->wk_cipher->ic_cipher) {
225 	case IEEE80211_CIPHER_WEP:
226 		if (k->wk_keylen == (40 / NBBY))
227 			return RT2661_CIPHER_WEP40;
228 		else
229 			return RT2661_CIPHER_WEP104;
230 	case IEEE80211_CIPHER_TKIP:
231 		return RT2661_CIPHER_TKIP;
232 	case IEEE80211_CIPHER_AES_CCM:
233 		return RT2661_CIPHER_AES;
234 	default:
235 		return RT2661_CIPHER_NONE;
236 	}
237 }
238 
239 static __inline int8_t
240 rt2661_txpower(const struct rt2661_softc *sc, int8_t power)
241 {
242 	if (sc->sc_txpwr_corr > 0) {
243 		if (power > sc->sc_txpwr_corr)
244 			power -= sc->sc_txpwr_corr;
245 		else
246 			power = 0;
247 	}
248 	return power;
249 }
250 
251 static __inline int
252 rt2661_avgrssi(const struct rt2661_softc *sc)
253 {
254 	int rssi_dbm;
255 
256 	rssi_dbm = sc->avg_rssi[0] + RT2661_NOISE_FLOOR;
257 	if (sc->rf_rev == RT2661_RF_2529) {
258 		if (sc->avg_rssi[1] > sc->avg_rssi[0])
259 			rssi_dbm = sc->avg_rssi[0] + RT2661_NOISE_FLOOR;
260 	}
261 	return rssi_dbm;
262 }
263 
264 int
265 rt2661_attach(device_t dev, int id)
266 {
267 	struct rt2661_softc *sc = device_get_softc(dev);
268 	struct ieee80211com *ic = &sc->sc_ic;
269 	struct ifnet *ifp = &ic->ic_if;
270 	uint32_t val, bbp_type;
271 	const uint8_t *ucode = NULL;
272 	int error, i, ac, ntries, size = 0;
273 
274 	callout_init(&sc->scan_ch);
275 	callout_init(&sc->calib_ch);
276 #ifdef RAL_DEBUG
277 	sc->sc_debug = 1;
278 #endif
279 
280 	sc->sc_irq_rid = 0;
281 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->sc_irq_rid,
282 					    RF_ACTIVE | RF_SHAREABLE);
283 	if (sc->sc_irq == NULL) {
284 		device_printf(dev, "could not allocate interrupt resource\n");
285 		return ENXIO;
286 	}
287 
288 	/* wait for NIC to initialize */
289 	for (ntries = 0; ntries < 1000; ntries++) {
290 		if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
291 			break;
292 		DELAY(1000);
293 	}
294 	if (ntries == 1000) {
295 		device_printf(sc->sc_dev,
296 		    "timeout waiting for NIC to initialize\n");
297 		error = EIO;
298 		goto fail;
299 	}
300 	bbp_type = val;
301 
302 	/* retrieve RF rev. no and various other things from EEPROM */
303 	rt2661_read_config(sc);
304 
305 	device_printf(dev, "MAC/BBP RT%X, RF %s\n", bbp_type,
306 	    rt2661_get_rf(sc->rf_rev));
307 
308 	/*
309 	 * Load 8051 microcode into NIC.
310 	 */
311 	switch (id) {
312 	case 0x0301:
313 		ucode = rt2561s_ucode;
314 		size = sizeof rt2561s_ucode;
315 		break;
316 	case 0x0302:
317 		ucode = rt2561_ucode;
318 		size = sizeof rt2561_ucode;
319 		break;
320 	case 0x0401:
321 		ucode = rt2661_ucode;
322 		size = sizeof rt2661_ucode;
323 		break;
324 	}
325 
326 	error = rt2661_load_microcode(sc, ucode, size);
327 	if (error != 0) {
328 		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
329 		goto fail;
330 	}
331 
332 	/*
333 	 * Allocate Tx and Rx rings.
334 	 */
335 	for (ac = 0; ac < 4; ac++) {
336 		error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
337 		    RT2661_TX_RING_COUNT);
338 		if (error != 0) {
339 			device_printf(sc->sc_dev,
340 			    "could not allocate Tx ring %d\n", ac);
341 			goto fail;
342 		}
343 	}
344 
345 	error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
346 	if (error != 0) {
347 		device_printf(sc->sc_dev, "could not allocate Mgt ring\n");
348 		goto fail;
349 	}
350 
351 	error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
352 	if (error != 0) {
353 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
354 		goto fail;
355 	}
356 
357 	STAILQ_INIT(&sc->tx_ratectl);
358 
359 	sysctl_ctx_init(&sc->sysctl_ctx);
360 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
361 					  SYSCTL_STATIC_CHILDREN(_hw),
362 					  OID_AUTO,
363 					  device_get_nameunit(dev),
364 					  CTLFLAG_RD, 0, "");
365 	if (sc->sysctl_tree == NULL) {
366 		device_printf(dev, "could not add sysctl node\n");
367 		error = ENXIO;
368 		goto fail;
369 	}
370 
371 	ifp->if_softc = sc;
372 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
373 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
374 	ifp->if_init = rt2661_init;
375 	ifp->if_ioctl = rt2661_ioctl;
376 	ifp->if_start = rt2661_start;
377 	ifp->if_watchdog = rt2661_watchdog;
378 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
379 	ifq_set_ready(&ifp->if_snd);
380 
381 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
382 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
383 	ic->ic_state = IEEE80211_S_INIT;
384 	rt2661_led_newstate(sc, IEEE80211_S_INIT);
385 
386 	IEEE80211_ONOE_PARAM_SETUP(&sc->sc_onoe_param);
387 	ic->ic_ratectl.rc_st_ratectl_cap = IEEE80211_RATECTL_CAP_ONOE;
388 	if (bbp_type == RT2661_BBP_2661D) {
389 		ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_ONOE;
390 	} else {
391 		IEEE80211_SAMPLE_PARAM_SETUP(&sc->sc_sample_param);
392 		ic->ic_ratectl.rc_st_ratectl_cap |=
393 			IEEE80211_RATECTL_CAP_SAMPLE;
394 		ic->ic_ratectl.rc_st_ratectl = IEEE80211_RATECTL_SAMPLE;
395 	}
396 	ic->ic_ratectl.rc_st_attach = rt2661_ratectl_attach;
397 
398 	/* set device capabilities */
399 	ic->ic_caps =
400 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
401 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
402 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
403 	    IEEE80211_C_TXPMGT |	/* tx power management */
404 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
405 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
406 #ifdef notyet
407 	    IEEE80211_C_WME |		/* 802.11e */
408 #endif
409 	    IEEE80211_C_WPA;		/* 802.11i */
410 
411 	/* Set hardware crypto capabilities. */
412 	ic->ic_caps |= IEEE80211_C_WEP |
413 		       IEEE80211_C_TKIP |
414 		       IEEE80211_C_TKIPMIC |
415 		       IEEE80211_C_AES_CCM;
416 
417 	ic->ic_caps_ext = IEEE80211_CEXT_CRYPTO_HDR |
418 			  IEEE80211_CEXT_STRIP_MIC;
419 
420 	if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
421 		/* set supported .11a rates */
422 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2661_rateset_11a;
423 
424 		/* set supported .11a channels */
425 		for (i = 36; i <= 64; i += 4) {
426 			ic->ic_channels[i].ic_freq =
427 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
428 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
429 		}
430 		for (i = 100; i <= 140; i += 4) {
431 			ic->ic_channels[i].ic_freq =
432 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
433 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
434 		}
435 		for (i = 149; i <= 165; i += 4) {
436 			ic->ic_channels[i].ic_freq =
437 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
438 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
439 		}
440 	}
441 
442 	/* set supported .11b and .11g rates */
443 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2661_rateset_11b;
444 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2661_rateset_11g;
445 
446 	/* set supported .11b and .11g channels (1 through 14) */
447 	for (i = 1; i <= 14; i++) {
448 		ic->ic_channels[i].ic_freq =
449 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
450 		ic->ic_channels[i].ic_flags =
451 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
452 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
453 	}
454 
455 	sc->sc_sifs = IEEE80211_DUR_SIFS;	/* Default SIFS */
456 
457 	ieee80211_ifattach(ic);
458 /*	ic->ic_wme.wme_update = rt2661_wme_update;*/
459 	ic->ic_updateslot = rt2661_update_slot;
460 	ic->ic_reset = rt2661_reset;
461 	/* enable s/w bmiss handling in sta mode */
462 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
463 
464 	sc->sc_key_alloc = ic->ic_crypto.cs_key_alloc;
465 	sc->sc_key_delete = ic->ic_crypto.cs_key_delete;
466 	sc->sc_key_set = ic->ic_crypto.cs_key_set;
467 
468 	ic->ic_crypto.cs_max_keyix = RT2661_KEY_MAX;
469 	ic->ic_crypto.cs_key_alloc = rt2661_key_alloc;
470 	ic->ic_crypto.cs_key_delete = rt2661_key_delete;
471 	ic->ic_crypto.cs_key_set = rt2661_key_set;
472 
473 	/* override state transition machine */
474 	sc->sc_newstate = ic->ic_newstate;
475 	ic->ic_newstate = rt2661_newstate;
476 	ieee80211_media_init(ic, rt2661_media_change, ieee80211_media_status);
477 
478 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
479 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
480 
481 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
482 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
483 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2661_RX_RADIOTAP_PRESENT);
484 
485 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
486 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
487 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2661_TX_RADIOTAP_PRESENT);
488 
489 	/*
490 	 * Add a few sysctl knobs.
491 	 */
492 	sc->sc_dwelltime = 200;	/* milliseconds */
493 	sc->sc_txpwr_corr = -1;	/* Disable */
494 	sc->sc_calib_txpwr = 0;	/* Disable */
495 	sc->sc_calib_rxsns = 0;	/* Disable */
496 
497 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
498 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "dwell",
499 	    CTLFLAG_RW, &sc->sc_dwelltime, 0,
500 	    "Channel dwell time (ms) for AP/station scanning");
501 
502 #ifdef RAL_DEBUG
503 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
504 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "debug",
505 	    CTLFLAG_RW, &sc->sc_debug, 0, "debug level");
506 #endif
507 
508 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
509 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "txpwr_corr",
510 	    CTLFLAG_RW, &sc->sc_txpwr_corr, 0,
511 	    "TX power correction value (<0 no correction)");
512 
513 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
514 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "calib_txpwr",
515 	    CTLFLAG_RW, &sc->sc_calib_txpwr, 0,
516 	    "Enable TX power calibration (sta mode)");
517 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
518 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "calib_rxsns",
519 	    CTLFLAG_RW, &sc->sc_calib_rxsns, 0,
520 	    "Enable RX sensibility calibration (sta mode)");
521 
522 	error = bus_setup_intr(dev, sc->sc_irq, INTR_MPSAFE, rt2661_intr,
523 			       sc, &sc->sc_ih, ifp->if_serializer);
524 	if (error != 0) {
525 		device_printf(dev, "could not set up interrupt\n");
526 		bpfdetach(ifp);
527 		ieee80211_ifdetach(ic);
528 		goto fail;
529 	}
530 
531 	if (bootverbose)
532 		ieee80211_announce(ic);
533 	return 0;
534 fail:
535 	rt2661_detach(sc);
536 	return error;
537 }
538 
539 int
540 rt2661_detach(void *xsc)
541 {
542 	struct rt2661_softc *sc = xsc;
543 	struct ieee80211com *ic = &sc->sc_ic;
544 	struct ifnet *ifp = &ic->ic_if;
545 
546 	if (device_is_attached(sc->sc_dev)) {
547 		lwkt_serialize_enter(ifp->if_serializer);
548 
549 		callout_stop(&sc->scan_ch);
550 		rt2661_stop(sc);
551 		bus_teardown_intr(sc->sc_dev, sc->sc_irq, sc->sc_ih);
552 
553 		lwkt_serialize_exit(ifp->if_serializer);
554 
555 		bpfdetach(ifp);
556 		ieee80211_ifdetach(ic);
557 	}
558 
559 	rt2661_free_tx_ring(sc, &sc->txq[0]);
560 	rt2661_free_tx_ring(sc, &sc->txq[1]);
561 	rt2661_free_tx_ring(sc, &sc->txq[2]);
562 	rt2661_free_tx_ring(sc, &sc->txq[3]);
563 	rt2661_free_tx_ring(sc, &sc->mgtq);
564 	rt2661_free_rx_ring(sc, &sc->rxq);
565 
566 	if (sc->sc_irq != NULL) {
567 		bus_release_resource(sc->sc_dev, SYS_RES_IRQ, sc->sc_irq_rid,
568 				     sc->sc_irq);
569 	}
570 
571 	if (sc->sysctl_tree != NULL)
572 		sysctl_ctx_free(&sc->sysctl_ctx);
573 
574 	return 0;
575 }
576 
577 void
578 rt2661_shutdown(void *xsc)
579 {
580 	struct rt2661_softc *sc = xsc;
581 	struct ifnet *ifp = &sc->sc_ic.ic_if;
582 
583 	lwkt_serialize_enter(ifp->if_serializer);
584 	rt2661_stop(sc);
585 	lwkt_serialize_exit(ifp->if_serializer);
586 }
587 
588 void
589 rt2661_suspend(void *xsc)
590 {
591 	struct rt2661_softc *sc = xsc;
592 	struct ifnet *ifp = &sc->sc_ic.ic_if;
593 
594 	lwkt_serialize_enter(ifp->if_serializer);
595 	rt2661_stop(sc);
596 	lwkt_serialize_exit(ifp->if_serializer);
597 }
598 
599 void
600 rt2661_resume(void *xsc)
601 {
602 	struct rt2661_softc *sc = xsc;
603 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
604 
605 	lwkt_serialize_enter(ifp->if_serializer);
606 	if (ifp->if_flags & IFF_UP) {
607 		ifp->if_init(ifp->if_softc);
608 		if (ifp->if_flags & IFF_RUNNING)
609 			ifp->if_start(ifp);
610 	}
611 	lwkt_serialize_exit(ifp->if_serializer);
612 }
613 
614 static void
615 rt2661_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
616 {
617 	if (error != 0)
618 		return;
619 
620 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
621 
622 	*(bus_addr_t *)arg = segs[0].ds_addr;
623 }
624 
625 static int
626 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
627     int count)
628 {
629 	int i, error;
630 
631 	ring->count = count;
632 	ring->queued = 0;
633 	ring->cur = ring->next = 0;
634 
635 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
636 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2661_TX_DESC_SIZE, 1,
637 	    count * RT2661_TX_DESC_SIZE, 0, &ring->desc_dmat);
638 	if (error != 0) {
639 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
640 		goto fail;
641 	}
642 
643 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
644 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
645 	if (error != 0) {
646 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
647 		goto fail;
648 	}
649 
650 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
651 	    count * RT2661_TX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
652 	    0);
653 	if (error != 0) {
654 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
655 
656 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
657 		ring->desc = NULL;
658 		goto fail;
659 	}
660 
661 	ring->data = kmalloc(count * sizeof (struct rt2661_data), M_DEVBUF,
662 	    M_WAITOK | M_ZERO);
663 
664 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
665 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES * RT2661_MAX_SCATTER,
666 	    RT2661_MAX_SCATTER, MCLBYTES, 0, &ring->data_dmat);
667 	if (error != 0) {
668 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
669 		goto fail;
670 	}
671 
672 	for (i = 0; i < count; i++) {
673 		error = bus_dmamap_create(ring->data_dmat, 0,
674 		    &ring->data[i].map);
675 		if (error != 0) {
676 			device_printf(sc->sc_dev, "could not create DMA map\n");
677 			goto fail;
678 		}
679 	}
680 	return 0;
681 
682 fail:	rt2661_free_tx_ring(sc, ring);
683 	return error;
684 }
685 
686 static void
687 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
688 {
689 	struct rt2661_tx_desc *desc;
690 	struct rt2661_data *data;
691 	int i;
692 
693 	for (i = 0; i < ring->count; i++) {
694 		desc = &ring->desc[i];
695 		data = &ring->data[i];
696 
697 		if (data->m != NULL) {
698 			bus_dmamap_sync(ring->data_dmat, data->map,
699 			    BUS_DMASYNC_POSTWRITE);
700 			bus_dmamap_unload(ring->data_dmat, data->map);
701 			m_freem(data->m);
702 			data->m = NULL;
703 		}
704 
705 		desc->flags = 0;
706 	}
707 
708 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
709 
710 	ring->queued = 0;
711 	ring->cur = ring->next = 0;
712 }
713 
714 static void
715 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
716 {
717 	struct rt2661_data *data;
718 	int i;
719 
720 	if (ring->desc != NULL) {
721 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
722 		    BUS_DMASYNC_POSTWRITE);
723 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
724 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
725 		ring->desc = NULL;
726 	}
727 
728 	if (ring->desc_dmat != NULL) {
729 		bus_dma_tag_destroy(ring->desc_dmat);
730 		ring->desc_dmat = NULL;
731 	}
732 
733 	if (ring->data != NULL) {
734 		for (i = 0; i < ring->count; i++) {
735 			data = &ring->data[i];
736 
737 			if (data->m != NULL) {
738 				bus_dmamap_sync(ring->data_dmat, data->map,
739 				    BUS_DMASYNC_POSTWRITE);
740 				bus_dmamap_unload(ring->data_dmat, data->map);
741 				m_freem(data->m);
742 				data->m = NULL;
743 			}
744 
745 			if (data->map != NULL) {
746 				bus_dmamap_destroy(ring->data_dmat, data->map);
747 				data->map = NULL;
748 			}
749 		}
750 
751 		kfree(ring->data, M_DEVBUF);
752 		ring->data = NULL;
753 	}
754 
755 	if (ring->data_dmat != NULL) {
756 		bus_dma_tag_destroy(ring->data_dmat);
757 		ring->data_dmat = NULL;
758 	}
759 }
760 
761 static int
762 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
763     int count)
764 {
765 	struct rt2661_rx_desc *desc;
766 	struct rt2661_data *data;
767 	bus_addr_t physaddr;
768 	int i, error;
769 
770 	ring->count = count;
771 	ring->cur = ring->next = 0;
772 
773 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
774 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2661_RX_DESC_SIZE, 1,
775 	    count * RT2661_RX_DESC_SIZE, 0, &ring->desc_dmat);
776 	if (error != 0) {
777 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
778 		goto fail;
779 	}
780 
781 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
782 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
783 	if (error != 0) {
784 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
785 		goto fail;
786 	}
787 
788 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
789 	    count * RT2661_RX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
790 	    0);
791 	if (error != 0) {
792 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
793 
794 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
795 		ring->desc = NULL;
796 		goto fail;
797 	}
798 
799 	ring->data = kmalloc(count * sizeof (struct rt2661_data), M_DEVBUF,
800 	    M_WAITOK | M_ZERO);
801 
802 	/*
803 	 * Pre-allocate Rx buffers and populate Rx ring.
804 	 */
805 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
806 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0,
807 	    &ring->data_dmat);
808 	if (error != 0) {
809 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
810 		goto fail;
811 	}
812 
813 	for (i = 0; i < count; i++) {
814 		desc = &sc->rxq.desc[i];
815 		data = &sc->rxq.data[i];
816 
817 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
818 		if (error != 0) {
819 			device_printf(sc->sc_dev, "could not create DMA map\n");
820 			goto fail;
821 		}
822 
823 		data->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
824 		if (data->m == NULL) {
825 			device_printf(sc->sc_dev,
826 			    "could not allocate rx mbuf\n");
827 			error = ENOMEM;
828 			goto fail;
829 		}
830 
831 		error = bus_dmamap_load(ring->data_dmat, data->map,
832 		    mtod(data->m, void *), MCLBYTES, rt2661_dma_map_addr,
833 		    &physaddr, 0);
834 		if (error != 0) {
835 			device_printf(sc->sc_dev,
836 			    "could not load rx buf DMA map");
837 
838 			m_freem(data->m);
839 			data->m = NULL;
840 			goto fail;
841 		}
842 
843 		desc->flags = htole32(RT2661_RX_BUSY);
844 		desc->physaddr = htole32(physaddr);
845 	}
846 
847 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
848 
849 	return 0;
850 
851 fail:	rt2661_free_rx_ring(sc, ring);
852 	return error;
853 }
854 
855 static void
856 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
857 {
858 	int i;
859 
860 	for (i = 0; i < ring->count; i++)
861 		ring->desc[i].flags = htole32(RT2661_RX_BUSY);
862 
863 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
864 
865 	ring->cur = ring->next = 0;
866 }
867 
868 static void
869 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
870 {
871 	struct rt2661_data *data;
872 	int i;
873 
874 	if (ring->desc != NULL) {
875 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
876 		    BUS_DMASYNC_POSTWRITE);
877 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
878 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
879 		ring->desc = NULL;
880 	}
881 
882 	if (ring->desc_dmat != NULL) {
883 		bus_dma_tag_destroy(ring->desc_dmat);
884 		ring->desc_dmat = NULL;
885 	}
886 
887 	if (ring->data != NULL) {
888 		for (i = 0; i < ring->count; i++) {
889 			data = &ring->data[i];
890 
891 			if (data->m != NULL) {
892 				bus_dmamap_sync(ring->data_dmat, data->map,
893 				    BUS_DMASYNC_POSTREAD);
894 				bus_dmamap_unload(ring->data_dmat, data->map);
895 				m_freem(data->m);
896 				data->m = NULL;
897 			}
898 
899 			if (data->map != NULL) {
900 				bus_dmamap_destroy(ring->data_dmat, data->map);
901 				data->map = NULL;
902 			}
903 		}
904 
905 		kfree(ring->data, M_DEVBUF);
906 		ring->data = NULL;
907 	}
908 
909 	if (ring->data_dmat != NULL) {
910 		bus_dma_tag_destroy(ring->data_dmat);
911 		ring->data_dmat = NULL;
912 	}
913 }
914 
915 static int
916 rt2661_media_change(struct ifnet *ifp)
917 {
918 	struct rt2661_softc *sc = ifp->if_softc;
919 	int error;
920 
921 	error = ieee80211_media_change(ifp);
922 	if (error != ENETRESET)
923 		return error;
924 
925 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
926 		rt2661_init(sc);
927 	return 0;
928 }
929 
930 /*
931  * This function is called periodically (every 200ms) during scanning to
932  * switch from one channel to another.
933  */
934 static void
935 rt2661_next_scan(void *arg)
936 {
937 	struct rt2661_softc *sc = arg;
938 	struct ieee80211com *ic = &sc->sc_ic;
939 	struct ifnet *ifp = &ic->ic_if;
940 
941 	lwkt_serialize_enter(ifp->if_serializer);
942 	if (ic->ic_state == IEEE80211_S_SCAN)
943 		ieee80211_next_scan(ic);
944 	lwkt_serialize_exit(ifp->if_serializer);
945 }
946 
947 static int
948 rt2661_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
949 {
950 	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
951 	enum ieee80211_state ostate;
952 	struct ieee80211_node *ni;
953 	uint32_t tmp;
954 	int error = 0;
955 
956 	ostate = ic->ic_state;
957 	callout_stop(&sc->scan_ch);
958 	callout_stop(&sc->calib_ch);
959 
960 	if (ostate != nstate)
961 		rt2661_led_newstate(sc, nstate);
962 
963 	ieee80211_ratectl_newstate(ic, nstate);
964 
965 	switch (nstate) {
966 	case IEEE80211_S_INIT:
967 		if (ostate == IEEE80211_S_RUN) {
968 			/* abort TSF synchronization */
969 			tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
970 			RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
971 		}
972 		break;
973 
974 	case IEEE80211_S_SCAN:
975 		rt2661_set_chan(sc, ic->ic_curchan);
976 		callout_reset(&sc->scan_ch, (sc->sc_dwelltime * hz) / 1000,
977 		    rt2661_next_scan, sc);
978 		break;
979 
980 	case IEEE80211_S_AUTH:
981 	case IEEE80211_S_ASSOC:
982 		rt2661_set_chan(sc, ic->ic_curchan);
983 		break;
984 
985 	case IEEE80211_S_RUN:
986 		RT2661_RESET_AVG_RSSI(sc);
987 
988 		rt2661_set_chan(sc, ic->ic_curchan);
989 
990 		ni = ic->ic_bss;
991 
992 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
993 			rt2661_enable_mrr(sc);
994 			rt2661_set_txpreamble(sc);
995 			rt2661_set_ackrates(sc, &ni->ni_rates);
996 			rt2661_set_bssid(sc, ni->ni_bssid);
997 		}
998 
999 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
1000 		    ic->ic_opmode == IEEE80211_M_IBSS) {
1001 			if ((error = rt2661_prepare_beacon(sc)) != 0)
1002 				break;
1003 		}
1004 
1005 		if (ic->ic_opmode != IEEE80211_M_MONITOR)
1006 			rt2661_enable_tsf_sync(sc);
1007 
1008 		if (ic->ic_opmode == IEEE80211_M_STA) {
1009 			uint32_t sta[4];
1010 
1011 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
1012 			/* clear STA registers */
1013 			RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
1014 #undef N
1015 			sc->sc_txpwr_cnt = 0;
1016 			callout_reset(&sc->calib_ch, hz, rt2661_calibrate, sc);
1017 		}
1018 		break;
1019 	}
1020 
1021 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
1022 }
1023 
1024 /*
1025  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
1026  * 93C66).
1027  */
1028 static uint16_t
1029 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
1030 {
1031 	uint32_t tmp;
1032 	uint16_t val;
1033 	int n;
1034 
1035 	/* clock C once before the first command */
1036 	RT2661_EEPROM_CTL(sc, 0);
1037 
1038 	RT2661_EEPROM_CTL(sc, RT2661_S);
1039 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
1040 	RT2661_EEPROM_CTL(sc, RT2661_S);
1041 
1042 	/* write start bit (1) */
1043 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
1044 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
1045 
1046 	/* write READ opcode (10) */
1047 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
1048 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
1049 	RT2661_EEPROM_CTL(sc, RT2661_S);
1050 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
1051 
1052 	/* write address (A5-A0 or A7-A0) */
1053 	n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
1054 	for (; n >= 0; n--) {
1055 		RT2661_EEPROM_CTL(sc, RT2661_S |
1056 		    (((addr >> n) & 1) << RT2661_SHIFT_D));
1057 		RT2661_EEPROM_CTL(sc, RT2661_S |
1058 		    (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
1059 	}
1060 
1061 	RT2661_EEPROM_CTL(sc, RT2661_S);
1062 
1063 	/* read data Q15-Q0 */
1064 	val = 0;
1065 	for (n = 15; n >= 0; n--) {
1066 		RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
1067 		tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
1068 		val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
1069 		RT2661_EEPROM_CTL(sc, RT2661_S);
1070 	}
1071 
1072 	RT2661_EEPROM_CTL(sc, 0);
1073 
1074 	/* clear Chip Select and clock C */
1075 	RT2661_EEPROM_CTL(sc, RT2661_S);
1076 	RT2661_EEPROM_CTL(sc, 0);
1077 	RT2661_EEPROM_CTL(sc, RT2661_C);
1078 
1079 	return val;
1080 }
1081 
1082 static void
1083 rt2661_tx_intr(struct rt2661_softc *sc)
1084 {
1085 	struct ieee80211com *ic = &sc->sc_ic;
1086 	struct ifnet *ifp = ic->ic_ifp;
1087 	struct rt2661_tx_ratectl *rctl;
1088 	uint32_t val, result;
1089 	int retrycnt;
1090 
1091 	for (;;) {
1092 		struct ieee80211_ratectl_res res;
1093 
1094 		val = RAL_READ(sc, RT2661_STA_CSR4);
1095 		if (!(val & RT2661_TX_STAT_VALID))
1096 			break;
1097 
1098 		/* Gather statistics */
1099 		result = RT2661_TX_RESULT(val);
1100 		if (result == RT2661_TX_SUCCESS)
1101 			ifp->if_opackets++;
1102 		else
1103 			ifp->if_oerrors++;
1104 
1105 		/* No rate control */
1106 		if (RT2661_TX_QID(val) == 0)
1107 			continue;
1108 
1109 		/* retrieve rate control algorithm context */
1110 		rctl = STAILQ_FIRST(&sc->tx_ratectl);
1111 		if (rctl == NULL) {
1112 			/*
1113 			 * XXX
1114 			 * This really should not happen.  Maybe we should
1115 			 * use assertion here?  But why should we rely on
1116 			 * hardware to do the correct things?  Even the
1117 			 * reference driver (RT61?) provided by Ralink does
1118 			 * not provide enough clue that this kind of interrupt
1119 			 * is promised to be generated for each packet.  So
1120 			 * just print a message and keep going ...
1121 			 */
1122 			if_printf(ifp, "WARNING: no rate control information\n");
1123 			continue;
1124 		}
1125 		STAILQ_REMOVE_HEAD(&sc->tx_ratectl, link);
1126 
1127 		retrycnt = 7;
1128 		switch (result) {
1129 		case RT2661_TX_SUCCESS:
1130 			retrycnt = RT2661_TX_RETRYCNT(val);
1131 			DPRINTFN(sc, 10, ("data frame sent successfully after "
1132 			    "%d retries\n", retrycnt));
1133 			break;
1134 
1135 		case RT2661_TX_RETRY_FAIL:
1136 			DPRINTFN(sc, 9, ("sending data frame failed (too much "
1137 			    "retries)\n"));
1138 			break;
1139 
1140 		default:
1141 			/* other failure */
1142 			device_printf(sc->sc_dev,
1143 			    "sending data frame failed 0x%08x\n", val);
1144 			break;
1145 		}
1146 
1147 		res.rc_res_rateidx = rctl->rateidx;
1148 		res.rc_res_tries = retrycnt + 1;
1149 		ieee80211_ratectl_tx_complete(rctl->ni, rctl->len, &res, 1,
1150 			retrycnt, 0, result != RT2661_TX_SUCCESS);
1151 
1152 		ieee80211_free_node(rctl->ni);
1153 		rctl->ni = NULL;
1154 		kfree(rctl, M_RT2661);
1155 	}
1156 }
1157 
1158 static void
1159 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
1160 {
1161 	struct rt2661_tx_desc *desc;
1162 	struct rt2661_data *data;
1163 
1164 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_POSTREAD);
1165 
1166 	for (;;) {
1167 		desc = &txq->desc[txq->next];
1168 		data = &txq->data[txq->next];
1169 
1170 		if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
1171 		    !(le32toh(desc->flags) & RT2661_TX_VALID))
1172 			break;
1173 
1174 		bus_dmamap_sync(txq->data_dmat, data->map,
1175 		    BUS_DMASYNC_POSTWRITE);
1176 		bus_dmamap_unload(txq->data_dmat, data->map);
1177 		m_freem(data->m);
1178 		data->m = NULL;
1179 
1180 		/* descriptor is no longer valid */
1181 		desc->flags &= ~htole32(RT2661_TX_VALID);
1182 
1183 		DPRINTFN(sc, 15, ("tx dma done q=%p idx=%u\n", txq, txq->next));
1184 
1185 		txq->queued--;
1186 		if (++txq->next >= txq->count)	/* faster than % count */
1187 			txq->next = 0;
1188 	}
1189 
1190 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1191 
1192 	if (txq->queued < txq->count) {
1193 		struct ifnet *ifp = &sc->sc_ic.ic_if;
1194 
1195 		sc->sc_tx_timer = 0;
1196 		ifp->if_flags &= ~IFF_OACTIVE;
1197 		rt2661_start(ifp);
1198 	}
1199 }
1200 
1201 static void
1202 rt2661_rx_intr(struct rt2661_softc *sc)
1203 {
1204 	struct ieee80211com *ic = &sc->sc_ic;
1205 	struct ifnet *ifp = ic->ic_ifp;
1206 	struct rt2661_rx_desc *desc;
1207 	struct rt2661_data *data;
1208 	bus_addr_t physaddr;
1209 	struct ieee80211_frame_min *wh;
1210 	struct ieee80211_node *ni;
1211 	struct mbuf *mnew, *m;
1212 	int error;
1213 
1214 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1215 	    BUS_DMASYNC_POSTREAD);
1216 
1217 	for (;;) {
1218 		uint32_t flags;
1219 		int rssi;
1220 
1221 		desc = &sc->rxq.desc[sc->rxq.cur];
1222 		data = &sc->rxq.data[sc->rxq.cur];
1223 		flags = le32toh(desc->flags);
1224 
1225 		if (flags & RT2661_RX_BUSY)
1226 			break;
1227 
1228 		if (flags & RT2661_RX_CRC_ERROR) {
1229 			/*
1230 			 * This should not happen since we did not request
1231 			 * to receive those frames when we filled TXRX_CSR0.
1232 			 */
1233 			DPRINTFN(sc, 5, ("CRC error flags 0x%08x\n", flags));
1234 			ifp->if_ierrors++;
1235 			goto skip;
1236 		}
1237 
1238 		if (flags & RT2661_RX_CIPHER_MASK) {
1239 			DPRINTFN(sc, 5, ("cipher error 0x%08x\n", flags));
1240 			ifp->if_ierrors++;
1241 			goto skip;
1242 		}
1243 
1244 		/*
1245 		 * Try to allocate a new mbuf for this ring element and load it
1246 		 * before processing the current mbuf. If the ring element
1247 		 * cannot be loaded, drop the received packet and reuse the old
1248 		 * mbuf. In the unlikely case that the old mbuf can't be
1249 		 * reloaded either, explicitly panic.
1250 		 */
1251 		mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1252 		if (mnew == NULL) {
1253 			ifp->if_ierrors++;
1254 			goto skip;
1255 		}
1256 
1257 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1258 		    BUS_DMASYNC_POSTREAD);
1259 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1260 
1261 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1262 		    mtod(mnew, void *), MCLBYTES, rt2661_dma_map_addr,
1263 		    &physaddr, 0);
1264 		if (error != 0) {
1265 			m_freem(mnew);
1266 
1267 			/* try to reload the old mbuf */
1268 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1269 			    mtod(data->m, void *), MCLBYTES,
1270 			    rt2661_dma_map_addr, &physaddr, 0);
1271 			if (error != 0) {
1272 				/* very unlikely that it will fail... */
1273 				panic("%s: could not load old rx mbuf",
1274 				    device_get_name(sc->sc_dev));
1275 			}
1276 			ifp->if_ierrors++;
1277 			goto skip;
1278 		}
1279 
1280 		/*
1281 	 	 * New mbuf successfully loaded, update Rx ring and continue
1282 		 * processing.
1283 		 */
1284 		m = data->m;
1285 		data->m = mnew;
1286 		desc->physaddr = htole32(physaddr);
1287 
1288 		/* finalize mbuf */
1289 		m->m_pkthdr.rcvif = ifp;
1290 		m->m_pkthdr.len = m->m_len = (flags >> 16) & 0xfff;
1291 
1292 		rssi = rt2661_get_rssi(sc, desc->rssi, 0);
1293 		if (sc->rf_rev == RT2661_RF_2529)
1294 			rt2661_get_rssi(sc, desc->rssi, 1);
1295 
1296 		wh = mtod(m, struct ieee80211_frame_min *);
1297 		if (wh->i_fc[1] & IEEE80211_FC1_WEP)
1298 			DPRINTFN(sc, 5, ("keyix %d\n", RT2661_RX_KEYIX(flags)));
1299 
1300 		ni = ieee80211_find_rxnode(ic, wh);
1301 
1302 		/* Error happened during RSSI conversion. */
1303 		if (rssi < 0)
1304 			rssi = ni->ni_rssi;
1305 
1306 		if (sc->sc_drvbpf != NULL) {
1307 			struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
1308 			uint32_t tsf_lo, tsf_hi;
1309 
1310 			/* get timestamp (low and high 32 bits) */
1311 			tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
1312 			tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
1313 
1314 			tap->wr_tsf =
1315 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1316 			tap->wr_flags = 0;
1317 			tap->wr_rate = rt2661_rxrate(desc);
1318 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1319 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1320 			tap->wr_antsignal = rssi;
1321 
1322 			bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1323 		}
1324 
1325 		/* send the frame to the 802.11 layer */
1326 		if (RT2661_RX_CIPHER(flags) != RT2661_CIPHER_NONE) {
1327 			struct ieee80211_crypto_iv iv;
1328 
1329 			memcpy(iv.ic_iv, desc->iv, sizeof(iv.ic_iv));
1330 			memcpy(iv.ic_eiv, desc->eiv, sizeof(iv.ic_eiv));
1331 			ieee80211_input_withiv(ic, m, ni, rssi, 0, &iv);
1332 		} else {
1333 			ieee80211_input(ic, m, ni, rssi, 0);
1334 		}
1335 
1336 		/* node is no longer needed */
1337 		ieee80211_free_node(ni);
1338 
1339 skip:		desc->flags |= htole32(RT2661_RX_BUSY);
1340 
1341 		DPRINTFN(sc, 15, ("rx intr idx=%u\n", sc->rxq.cur));
1342 
1343 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
1344 	}
1345 
1346 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1347 	    BUS_DMASYNC_PREWRITE);
1348 }
1349 
1350 /* ARGSUSED */
1351 static void
1352 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
1353 {
1354 	/* do nothing */
1355 }
1356 
1357 static void
1358 rt2661_mcu_wakeup(struct rt2661_softc *sc)
1359 {
1360 	RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
1361 
1362 	RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
1363 	RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
1364 	RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
1365 
1366 	/* send wakeup command to MCU */
1367 	rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
1368 }
1369 
1370 static void
1371 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
1372 {
1373 	RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
1374 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
1375 }
1376 
1377 static void
1378 rt2661_intr(void *arg)
1379 {
1380 	struct rt2661_softc *sc = arg;
1381 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1382 	uint32_t r1, r2;
1383 
1384 	/* disable MAC and MCU interrupts */
1385 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
1386 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
1387 
1388 	/* don't re-enable interrupts if we're shutting down */
1389 	if (!(ifp->if_flags & IFF_RUNNING))
1390 		return;
1391 
1392 	r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
1393 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
1394 
1395 	r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
1396 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
1397 
1398 	if (r1 & RT2661_MGT_DONE)
1399 		rt2661_tx_dma_intr(sc, &sc->mgtq);
1400 
1401 	if (r1 & RT2661_RX_DONE)
1402 		rt2661_rx_intr(sc);
1403 
1404 	if (r1 & RT2661_TX0_DMA_DONE)
1405 		rt2661_tx_dma_intr(sc, &sc->txq[0]);
1406 
1407 	if (r1 & RT2661_TX1_DMA_DONE)
1408 		rt2661_tx_dma_intr(sc, &sc->txq[1]);
1409 
1410 	if (r1 & RT2661_TX2_DMA_DONE)
1411 		rt2661_tx_dma_intr(sc, &sc->txq[2]);
1412 
1413 	if (r1 & RT2661_TX3_DMA_DONE)
1414 		rt2661_tx_dma_intr(sc, &sc->txq[3]);
1415 
1416 	if (r1 & RT2661_TX_DONE)
1417 		rt2661_tx_intr(sc);
1418 
1419 	if (r2 & RT2661_MCU_CMD_DONE)
1420 		rt2661_mcu_cmd_intr(sc);
1421 
1422 	if (r2 & RT2661_MCU_BEACON_EXPIRE)
1423 		rt2661_mcu_beacon_expire(sc);
1424 
1425 	if (r2 & RT2661_MCU_WAKEUP)
1426 		rt2661_mcu_wakeup(sc);
1427 
1428 	/* re-enable MAC and MCU interrupts */
1429 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
1430 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
1431 }
1432 
1433 /* quickly determine if a given rate is CCK or OFDM */
1434 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1435 
1436 #define RAL_ACK_SIZE	(sizeof(struct ieee80211_frame_ack) + IEEE80211_CRC_LEN)
1437 #define RAL_CTS_SIZE	(sizeof(struct ieee80211_frame_cts) + IEEE80211_CRC_LEN)
1438 
1439 /*
1440  * This function is only used by the Rx radiotap code. It returns the rate at
1441  * which a given frame was received.
1442  */
1443 static uint8_t
1444 rt2661_rxrate(struct rt2661_rx_desc *desc)
1445 {
1446 	if (le32toh(desc->flags) & RT2661_RX_OFDM) {
1447 		/* reverse function of rt2661_plcp_signal */
1448 		switch (desc->rate & 0xf) {
1449 		case 0xb:	return 12;
1450 		case 0xf:	return 18;
1451 		case 0xa:	return 24;
1452 		case 0xe:	return 36;
1453 		case 0x9:	return 48;
1454 		case 0xd:	return 72;
1455 		case 0x8:	return 96;
1456 		case 0xc:	return 108;
1457 		}
1458 	} else {
1459 		if (desc->rate == 10)
1460 			return 2;
1461 		if (desc->rate == 20)
1462 			return 4;
1463 		if (desc->rate == 55)
1464 			return 11;
1465 		if (desc->rate == 110)
1466 			return 22;
1467 	}
1468 	return 2;	/* should not get there */
1469 }
1470 
1471 static uint8_t
1472 rt2661_plcp_signal(int rate)
1473 {
1474 	switch (rate) {
1475 	/* CCK rates (returned values are device-dependent) */
1476 	case 2:		return 0x0;
1477 	case 4:		return 0x1;
1478 	case 11:	return 0x2;
1479 	case 22:	return 0x3;
1480 
1481 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1482 	case 12:	return 0xb;
1483 	case 18:	return 0xf;
1484 	case 24:	return 0xa;
1485 	case 36:	return 0xe;
1486 	case 48:	return 0x9;
1487 	case 72:	return 0xd;
1488 	case 96:	return 0x8;
1489 	case 108:	return 0xc;
1490 
1491 	/* unsupported rates (should not get there) */
1492 	default:	return 0xff;
1493 	}
1494 }
1495 
1496 static void
1497 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
1498     uint32_t flags, uint16_t xflags, int len, int rate,
1499     const bus_dma_segment_t *segs, int nsegs, int ac, int ratectl,
1500     const struct ieee80211_key *key, void *buf,
1501     const struct ieee80211_crypto_iv *iv)
1502 {
1503 	const struct ieee80211_cipher *cip = NULL;
1504 	struct ieee80211com *ic = &sc->sc_ic;
1505 	uint16_t plcp_length;
1506 	int i, remainder;
1507 
1508 	if (key != NULL)
1509 		cip = key->wk_cipher;
1510 
1511 	desc->flags = htole32(flags);
1512 	desc->flags |= htole32(len << 16);
1513 	desc->flags |= htole32(RT2661_TX_VALID);
1514 	if (key != NULL) {
1515 		int cipher = rt2661_cipher(key);
1516 
1517 		desc->flags |= htole32(cipher << 29);
1518 		desc->flags |= htole32(key->wk_keyix << 10);
1519 		if (key->wk_keyix >= IEEE80211_WEP_NKID)
1520 			desc->flags |= htole32(RT2661_TX_PAIRWISE_KEY);
1521 
1522 		/* XXX fragmentation */
1523 		desc->flags |= htole32(RT2661_TX_HWMIC);
1524 	}
1525 
1526 	desc->xflags = htole16(xflags);
1527 	desc->xflags |= htole16(nsegs << 13);
1528 	if (key != NULL) {
1529 		int hdrsize;
1530 
1531 		hdrsize = ieee80211_hdrspace(ic, buf);
1532 		desc->xflags |= htole16(hdrsize);
1533 	}
1534 
1535 	desc->wme = htole16(
1536 	    RT2661_QID(ac) |
1537 	    RT2661_AIFSN(2) |
1538 	    RT2661_LOGCWMIN(4) |
1539 	    RT2661_LOGCWMAX(10));
1540 
1541 	if (key != NULL && iv != NULL) {
1542 		memcpy(desc->iv, iv->ic_iv, sizeof(desc->iv));
1543 		memcpy(desc->eiv, iv->ic_eiv, sizeof(desc->eiv));
1544 	}
1545 
1546 	/*
1547 	 * Remember whether TX rate control information should be gathered.
1548 	 * This field is driver private data only.  It will be made available
1549 	 * by the NIC in STA_CSR4 on Tx done interrupts.
1550 	 */
1551 	desc->qid = ratectl;
1552 
1553 	/* setup PLCP fields */
1554 	desc->plcp_signal  = rt2661_plcp_signal(rate);
1555 	desc->plcp_service = 4;
1556 
1557 	len += IEEE80211_CRC_LEN;
1558 	if (cip != NULL) {
1559 		len += cip->ic_header + cip->ic_trailer;
1560 
1561 		/* XXX fragmentation */
1562 		len += cip->ic_miclen;
1563 	}
1564 
1565 	if (RAL_RATE_IS_OFDM(rate)) {
1566 		desc->flags |= htole32(RT2661_TX_OFDM);
1567 
1568 		plcp_length = len & 0xfff;
1569 		desc->plcp_length_hi = plcp_length >> 6;
1570 		desc->plcp_length_lo = plcp_length & 0x3f;
1571 	} else {
1572 		plcp_length = (16 * len + rate - 1) / rate;
1573 		if (rate == 22) {
1574 			remainder = (16 * len) % 22;
1575 			if (remainder != 0 && remainder < 7)
1576 				desc->plcp_service |= RT2661_PLCP_LENGEXT;
1577 		}
1578 		desc->plcp_length_hi = plcp_length >> 8;
1579 		desc->plcp_length_lo = plcp_length & 0xff;
1580 
1581 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1582 			desc->plcp_signal |= 0x08;
1583 	}
1584 
1585 	/* RT2x61 supports scatter with up to 5 segments */
1586 	for (i = 0; i < nsegs; i++) {
1587 		desc->addr[i] = htole32(segs[i].ds_addr);
1588 		desc->len [i] = htole16(segs[i].ds_len);
1589 	}
1590 
1591 	desc->flags |= htole32(RT2661_TX_BUSY);
1592 }
1593 
1594 static int
1595 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
1596     struct ieee80211_node *ni)
1597 {
1598 	struct ieee80211com *ic = &sc->sc_ic;
1599 	struct rt2661_tx_desc *desc;
1600 	struct rt2661_data *data;
1601 	struct ieee80211_frame *wh;
1602 	struct rt2661_dmamap map;
1603 	uint16_t dur;
1604 	uint32_t flags = 0;	/* XXX HWSEQ */
1605 	int rate, error;
1606 
1607 	desc = &sc->mgtq.desc[sc->mgtq.cur];
1608 	data = &sc->mgtq.data[sc->mgtq.cur];
1609 
1610 	/* send mgt frames at the lowest available rate */
1611 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1612 
1613 	error = bus_dmamap_load_mbuf(sc->mgtq.data_dmat, data->map, m0,
1614 				     rt2661_dma_map_mbuf, &map, 0);
1615 	if (error != 0) {
1616 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1617 		    error);
1618 		ieee80211_free_node(ni);
1619 		m_freem(m0);
1620 		return error;
1621 	}
1622 
1623 	if (sc->sc_drvbpf != NULL) {
1624 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1625 
1626 		tap->wt_flags = 0;
1627 		tap->wt_rate = rate;
1628 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1629 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1630 
1631 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1632 	}
1633 
1634 	data->m = m0;
1635 
1636 	wh = mtod(m0, struct ieee80211_frame *);
1637 
1638 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1639 		flags |= RT2661_TX_NEED_ACK;
1640 
1641 		dur = ieee80211_txtime(ni, RAL_ACK_SIZE, rate, ic->ic_flags) +
1642 		      sc->sc_sifs;
1643 		*(uint16_t *)wh->i_dur = htole16(dur);
1644 
1645 		/* tell hardware to add timestamp in probe responses */
1646 		if ((wh->i_fc[0] &
1647 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1648 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1649 			flags |= RT2661_TX_TIMESTAMP;
1650 	}
1651 
1652 	rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
1653 	    m0->m_pkthdr.len, rate, map.segs, map.nseg, RT2661_QID_MGT, 0, NULL, NULL, NULL);
1654 
1655 	bus_dmamap_sync(sc->mgtq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1656 	bus_dmamap_sync(sc->mgtq.desc_dmat, sc->mgtq.desc_map,
1657 	    BUS_DMASYNC_PREWRITE);
1658 
1659 	DPRINTFN(sc, 10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1660 	    m0->m_pkthdr.len, sc->mgtq.cur, rate));
1661 
1662 	/* kick mgt */
1663 	sc->mgtq.queued++;
1664 	sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
1665 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
1666 
1667 	ieee80211_free_node(ni);
1668 
1669 	return 0;
1670 }
1671 
1672 /*
1673  * Build a RTS control frame.
1674  */
1675 static struct mbuf *
1676 rt2661_get_rts(struct rt2661_softc *sc, struct ieee80211_frame *wh,
1677     uint16_t dur)
1678 {
1679 	struct ieee80211_frame_rts *rts;
1680 	struct mbuf *m;
1681 
1682 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1683 	if (m == NULL) {
1684 		sc->sc_ic.ic_stats.is_tx_nobuf++;
1685 		device_printf(sc->sc_dev, "could not allocate RTS frame\n");
1686 		return NULL;
1687 	}
1688 
1689 	rts = mtod(m, struct ieee80211_frame_rts *);
1690 
1691 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1692 	    IEEE80211_FC0_SUBTYPE_RTS;
1693 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1694 	*(uint16_t *)rts->i_dur = htole16(dur);
1695 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1696 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1697 
1698 	m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
1699 
1700 	return m;
1701 }
1702 
1703 static int
1704 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
1705     struct ieee80211_node *ni, int ac)
1706 {
1707 	struct ieee80211com *ic = &sc->sc_ic;
1708 	struct rt2661_tx_ring *txq = &sc->txq[ac];
1709 	struct rt2661_tx_desc *desc;
1710 	struct rt2661_data *data;
1711 	struct rt2661_tx_ratectl *rctl;
1712 	struct ieee80211_frame *wh;
1713 	struct ieee80211_key *k = NULL;
1714 	const struct chanAccParams *cap;
1715 	struct mbuf *mnew;
1716 	struct rt2661_dmamap map;
1717 	uint16_t dur;
1718 	uint32_t flags = 0;
1719 	int error, rate, ackrate, noack = 0, rateidx;
1720 	struct ieee80211_crypto_iv iv, *ivp = NULL;
1721 
1722 	wh = mtod(m0, struct ieee80211_frame *);
1723 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1724 		cap = &ic->ic_wme.wme_chanParams;
1725 		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1726 	}
1727 
1728 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1729 		k = ieee80211_crypto_findkey(ic, ni, m0);
1730 		if (k == NULL) {
1731 			m_freem(m0);
1732 			return ENOBUFS;
1733 		}
1734 
1735 		if (k->wk_flags & IEEE80211_KEY_SWCRYPT) {
1736 			k = ieee80211_crypto_encap_withkey(ic, m0, k);
1737 		} else {
1738 			k = ieee80211_crypto_getiv(ic, &iv, k);
1739 			ivp = &iv;
1740 		}
1741 		if (k == NULL) {
1742 			m_freem(m0);
1743 			return ENOBUFS;
1744 		}
1745 
1746 		if (ivp == NULL)
1747 			k = NULL;
1748 
1749 		/* packet header may have moved, reset our local pointer */
1750 		wh = mtod(m0, struct ieee80211_frame *);
1751 	}
1752 
1753 	ieee80211_ratectl_findrate(ni, m0->m_pkthdr.len, &rateidx, 1);
1754 	rate = IEEE80211_RS_RATE(&ni->ni_rates, rateidx);
1755 
1756 	ackrate = ieee80211_ack_rate(ni, rate);
1757 
1758 	/*
1759 	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1760 	 * for directed frames only when the length of the MPDU is greater
1761 	 * than the length threshold indicated by [...]" ic_rtsthreshold.
1762 	 */
1763 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1764 	    m0->m_pkthdr.len > ic->ic_rtsthreshold) {
1765 		struct mbuf *m;
1766 		uint16_t dur;
1767 		int rtsrate;
1768 
1769 		rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1770 
1771 		/* XXX: noack (QoS)? */
1772 		dur = ieee80211_txtime(ni, m0->m_pkthdr.len + IEEE80211_CRC_LEN,
1773 				       rate, ic->ic_flags) +
1774 		      ieee80211_txtime(ni, RAL_CTS_SIZE, rtsrate, ic->ic_flags)+
1775 		      ieee80211_txtime(ni, RAL_ACK_SIZE, ackrate, ic->ic_flags)+
1776 		      3 * sc->sc_sifs;
1777 
1778 		m = rt2661_get_rts(sc, wh, dur);
1779 
1780 		desc = &txq->desc[txq->cur];
1781 		data = &txq->data[txq->cur];
1782 
1783 		error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m,
1784 					     rt2661_dma_map_mbuf, &map, 0);
1785 		if (error != 0) {
1786 			device_printf(sc->sc_dev,
1787 			    "could not map mbuf (error %d)\n", error);
1788 			m_freem(m);
1789 			m_freem(m0);
1790 			return error;
1791 		}
1792 
1793 		data->m = m;
1794 
1795 		rt2661_setup_tx_desc(sc, desc, RT2661_TX_NEED_ACK |
1796 				     RT2661_TX_MORE_FRAG, 0, m->m_pkthdr.len,
1797 				     rtsrate, map.segs, map.nseg, ac, 0, NULL, NULL, NULL);
1798 
1799 		bus_dmamap_sync(txq->data_dmat, data->map,
1800 		    BUS_DMASYNC_PREWRITE);
1801 
1802 		txq->queued++;
1803 		txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1804 
1805 		/*
1806 		 * IEEE Std 802.11-1999: when an RTS/CTS exchange is used, the
1807 		 * asynchronous data frame shall be transmitted after the CTS
1808 		 * frame and a SIFS period.
1809 		 */
1810 		flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS;
1811 	}
1812 
1813 	data = &txq->data[txq->cur];
1814 	desc = &txq->desc[txq->cur];
1815 
1816 	error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1817 				     rt2661_dma_map_mbuf, &map, 0);
1818 	if (error != 0 && error != EFBIG) {
1819 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1820 		    error);
1821 		m_freem(m0);
1822 		return error;
1823 	}
1824 	if (error != 0) {
1825 		mnew = m_defrag(m0, MB_DONTWAIT);
1826 		if (mnew == NULL) {
1827 			device_printf(sc->sc_dev,
1828 			    "could not defragment mbuf\n");
1829 			m_freem(m0);
1830 			return ENOBUFS;
1831 		}
1832 		m0 = mnew;
1833 
1834 		error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1835 					     rt2661_dma_map_mbuf, &map, 0);
1836 		if (error != 0) {
1837 			device_printf(sc->sc_dev,
1838 			    "could not map mbuf (error %d)\n", error);
1839 			m_freem(m0);
1840 			return error;
1841 		}
1842 
1843 		/* packet header have moved, reset our local pointer */
1844 		wh = mtod(m0, struct ieee80211_frame *);
1845 	}
1846 
1847 	if (sc->sc_drvbpf != NULL) {
1848 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1849 
1850 		tap->wt_flags = 0;
1851 		tap->wt_rate = rate;
1852 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1853 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1854 
1855 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1856 	}
1857 
1858 	data->m = m0;
1859 
1860 	rctl = kmalloc(sizeof(*rctl), M_RT2661, M_NOWAIT);
1861 	if (rctl != NULL) {
1862 		rctl->ni = ni;
1863 		rctl->len = m0->m_pkthdr.len;
1864 		rctl->rateidx = rateidx;
1865 		STAILQ_INSERT_TAIL(&sc->tx_ratectl, rctl, link);
1866 	}
1867 
1868 	if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1869 		flags |= RT2661_TX_NEED_ACK;
1870 
1871 		dur = ieee80211_txtime(ni, RAL_ACK_SIZE, ackrate, ic->ic_flags)+
1872 		      sc->sc_sifs;
1873 		*(uint16_t *)wh->i_dur = htole16(dur);
1874 	}
1875 
1876 	rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate,
1877 			     map.segs, map.nseg, ac, rctl != NULL, k, wh, ivp);
1878 
1879 	bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1880 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1881 
1882 	DPRINTFN(sc, 10, ("sending data frame len=%u idx=%u rate=%u\n",
1883 	    m0->m_pkthdr.len, txq->cur, rate));
1884 
1885 	/* kick Tx */
1886 	txq->queued++;
1887 	txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1888 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1 << ac);
1889 
1890 	if (rctl == NULL)
1891 		ieee80211_free_node(ni);
1892 
1893 	return 0;
1894 }
1895 
1896 static void
1897 rt2661_start(struct ifnet *ifp)
1898 {
1899 	struct rt2661_softc *sc = ifp->if_softc;
1900 	struct ieee80211com *ic = &sc->sc_ic;
1901 	struct mbuf *m0;
1902 	struct ether_header *eh;
1903 	struct ieee80211_node *ni;
1904 	int ac;
1905 
1906 	/* prevent management frames from being sent if we're not ready */
1907 	if (!(ifp->if_flags & IFF_RUNNING))
1908 		return;
1909 
1910 	for (;;) {
1911 		IF_POLL(&ic->ic_mgtq, m0);
1912 		if (m0 != NULL) {
1913 			if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
1914 				ifp->if_flags |= IFF_OACTIVE;
1915 				break;
1916 			}
1917 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1918 
1919 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1920 			m0->m_pkthdr.rcvif = NULL;
1921 
1922 			if (ic->ic_rawbpf != NULL)
1923 				bpf_mtap(ic->ic_rawbpf, m0);
1924 
1925 			if (rt2661_tx_mgt(sc, m0, ni) != 0)
1926 				break;
1927 		} else {
1928 			if (ic->ic_state != IEEE80211_S_RUN)
1929 				break;
1930 
1931 			m0 = ifq_dequeue(&ifp->if_snd, NULL);
1932 			if (m0 == NULL)
1933 				break;
1934 
1935 			if (m0->m_len < sizeof (struct ether_header) &&
1936 			    !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1937 				continue;
1938 
1939 			eh = mtod(m0, struct ether_header *);
1940 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1941 			if (ni == NULL) {
1942 				m_freem(m0);
1943 				ifp->if_oerrors++;
1944 				continue;
1945 			}
1946 
1947 			/* classify mbuf so we can find which tx ring to use */
1948 			if (ieee80211_classify(ic, m0, ni) != 0) {
1949 				m_freem(m0);
1950 				ieee80211_free_node(ni);
1951 				ifp->if_oerrors++;
1952 				continue;
1953 			}
1954 
1955 			/* no QoS encapsulation for EAPOL frames */
1956 			ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1957 			    M_WME_GETAC(m0) : WME_AC_BE;
1958 
1959 			if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
1960 				/* there is no place left in this ring */
1961 				ifp->if_flags |= IFF_OACTIVE;
1962 				m_freem(m0);
1963 				ieee80211_free_node(ni);
1964 				break;
1965 			}
1966 
1967 			BPF_MTAP(ifp, m0);
1968 
1969 			m0 = ieee80211_encap(ic, m0, ni);
1970 			if (m0 == NULL) {
1971 				ieee80211_free_node(ni);
1972 				ifp->if_oerrors++;
1973 				continue;
1974 			}
1975 
1976 			if (ic->ic_rawbpf != NULL)
1977 				bpf_mtap(ic->ic_rawbpf, m0);
1978 
1979 			if (rt2661_tx_data(sc, m0, ni, ac) != 0) {
1980 				ieee80211_free_node(ni);
1981 				ifp->if_oerrors++;
1982 				break;
1983 			}
1984 		}
1985 
1986 		sc->sc_tx_timer = 5;
1987 		ifp->if_timer = 1;
1988 	}
1989 }
1990 
1991 static void
1992 rt2661_watchdog(struct ifnet *ifp)
1993 {
1994 	struct rt2661_softc *sc = ifp->if_softc;
1995 	struct ieee80211com *ic = &sc->sc_ic;
1996 
1997 	ifp->if_timer = 0;
1998 
1999 	if (sc->sc_tx_timer > 0) {
2000 		if (--sc->sc_tx_timer == 0) {
2001 			device_printf(sc->sc_dev, "device timeout\n");
2002 			rt2661_init(sc);
2003 			ifp->if_oerrors++;
2004 			return;
2005 		}
2006 		ifp->if_timer = 1;
2007 	}
2008 
2009 	ieee80211_watchdog(ic);
2010 }
2011 
2012 /*
2013  * This function allows for fast channel switching in monitor mode (used by
2014  * net-mgmt/kismet). In IBSS mode, we must explicitly reset the interface to
2015  * generate a new beacon frame.
2016  */
2017 static int
2018 rt2661_reset(struct ifnet *ifp)
2019 {
2020 	struct rt2661_softc *sc = ifp->if_softc;
2021 	struct ieee80211com *ic = &sc->sc_ic;
2022 
2023 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
2024 		return ENETRESET;
2025 
2026 	rt2661_set_chan(sc, ic->ic_curchan);
2027 
2028 	return 0;
2029 }
2030 
2031 static int
2032 rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
2033 {
2034 	struct rt2661_softc *sc = ifp->if_softc;
2035 	struct ieee80211com *ic = &sc->sc_ic;
2036 	int error = 0;
2037 
2038 	switch (cmd) {
2039 	case SIOCSIFFLAGS:
2040 		if (ifp->if_flags & IFF_UP) {
2041 			if (ifp->if_flags & IFF_RUNNING)
2042 				rt2661_update_promisc(sc);
2043 			else
2044 				rt2661_init(sc);
2045 		} else {
2046 			if (ifp->if_flags & IFF_RUNNING)
2047 				rt2661_stop(sc);
2048 		}
2049 		break;
2050 
2051 	default:
2052 		error = ieee80211_ioctl(ic, cmd, data, cr);
2053 	}
2054 
2055 	if (error == ENETRESET) {
2056 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2057 		    (IFF_UP | IFF_RUNNING) &&
2058 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2059 			rt2661_init(sc);
2060 		error = 0;
2061 	}
2062 	return error;
2063 }
2064 
2065 static void
2066 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
2067 {
2068 	uint32_t tmp;
2069 	int ntries;
2070 
2071 	for (ntries = 0; ntries < 100; ntries++) {
2072 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
2073 			break;
2074 		DELAY(1);
2075 	}
2076 	if (ntries == 100) {
2077 		device_printf(sc->sc_dev, "could not write to BBP\n");
2078 		return;
2079 	}
2080 
2081 	tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
2082 	RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
2083 
2084 	DPRINTFN(sc, 15, ("BBP R%u <- 0x%02x\n", reg, val));
2085 
2086 	/* XXX */
2087 	if (reg == 17) {
2088 		DPRINTF(sc, ("record bbp17 %#x\n", val));
2089 		sc->bbp17 = val;
2090 	}
2091 }
2092 
2093 static uint8_t
2094 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
2095 {
2096 	uint32_t val;
2097 	int ntries;
2098 
2099 	for (ntries = 0; ntries < 100; ntries++) {
2100 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
2101 			break;
2102 		DELAY(1);
2103 	}
2104 	if (ntries == 100) {
2105 		device_printf(sc->sc_dev, "could not read from BBP\n");
2106 		return 0;
2107 	}
2108 
2109 	val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
2110 	RAL_WRITE(sc, RT2661_PHY_CSR3, val);
2111 
2112 	for (ntries = 0; ntries < 100; ntries++) {
2113 		val = RAL_READ(sc, RT2661_PHY_CSR3);
2114 		if (!(val & RT2661_BBP_BUSY))
2115 			return val & 0xff;
2116 		DELAY(1);
2117 	}
2118 
2119 	device_printf(sc->sc_dev, "could not read from BBP\n");
2120 	return 0;
2121 }
2122 
2123 static void
2124 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
2125 {
2126 	uint32_t tmp;
2127 	int ntries;
2128 
2129 	for (ntries = 0; ntries < 100; ntries++) {
2130 		if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
2131 			break;
2132 		DELAY(1);
2133 	}
2134 	if (ntries == 100) {
2135 		device_printf(sc->sc_dev, "could not write to RF\n");
2136 		return;
2137 	}
2138 
2139 	tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
2140 	    (reg & 3);
2141 	RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
2142 
2143 	/* remember last written value in sc */
2144 	sc->rf_regs[reg] = val;
2145 
2146 	DPRINTFN(sc, 15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff));
2147 }
2148 
2149 static int
2150 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
2151 {
2152 	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
2153 		return EIO;	/* there is already a command pending */
2154 
2155 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
2156 	    RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
2157 
2158 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
2159 
2160 	return 0;
2161 }
2162 
2163 static void
2164 rt2661_select_antenna(struct rt2661_softc *sc)
2165 {
2166 	uint8_t bbp4, bbp77;
2167 	uint32_t tmp;
2168 
2169 	bbp4  = rt2661_bbp_read(sc,  4);
2170 	bbp77 = rt2661_bbp_read(sc, 77);
2171 
2172 	/* TBD */
2173 
2174 	/* make sure Rx is disabled before switching antenna */
2175 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2176 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2177 
2178 	rt2661_bbp_write(sc,  4, bbp4);
2179 	rt2661_bbp_write(sc, 77, bbp77);
2180 
2181 	/* restore Rx filter */
2182 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2183 }
2184 
2185 /*
2186  * Enable multi-rate retries for frames sent at OFDM rates.
2187  * In 802.11b/g mode, allow fallback to CCK rates.
2188  */
2189 static void
2190 rt2661_enable_mrr(struct rt2661_softc *sc)
2191 {
2192 	struct ieee80211com *ic = &sc->sc_ic;
2193 	uint32_t tmp;
2194 
2195 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2196 
2197 	tmp &= ~RT2661_MRR_CCK_FALLBACK;
2198 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan))
2199 		tmp |= RT2661_MRR_CCK_FALLBACK;
2200 	tmp |= RT2661_MRR_ENABLED;
2201 	tmp |= RT2661_SRETRY_LIMIT(7) | RT2661_LRETRY_LIMIT(4);
2202 
2203 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2204 }
2205 
2206 static void
2207 rt2661_set_txpreamble(struct rt2661_softc *sc)
2208 {
2209 	uint32_t tmp;
2210 
2211 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2212 
2213 	tmp &= ~RT2661_SHORT_PREAMBLE;
2214 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
2215 		tmp |= RT2661_SHORT_PREAMBLE;
2216 
2217 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2218 }
2219 
2220 static void
2221 rt2661_set_ackrates(struct rt2661_softc *sc, const struct ieee80211_rateset *rs)
2222 {
2223 #define RV(r)	((r) & IEEE80211_RATE_VAL)
2224 	struct ieee80211com *ic = &sc->sc_ic;
2225 	uint32_t mask = 0;
2226 	uint8_t rate;
2227 	int i, j;
2228 
2229 	for (i = 0; i < rs->rs_nrates; i++) {
2230 		rate = rs->rs_rates[i];
2231 
2232 		if (!(rate & IEEE80211_RATE_BASIC))
2233 			continue;
2234 
2235 		/*
2236 		 * Find h/w rate index.  We know it exists because the rate
2237 		 * set has already been negotiated.
2238 		 */
2239 		for (j = 0; rt2661_rateset_11g.rs_rates[j] != RV(rate); j++)
2240 			; /* EMPTY */
2241 
2242 		mask |= 1 << j;
2243 	}
2244 
2245 	if (IEEE80211_IS_CHAN_2GHZ(ic->ic_curchan) &&
2246 	    ic->ic_curmode != IEEE80211_MODE_11B &&
2247 	    ieee80211_iserp_rateset(ic, rs)) {
2248 		/*
2249 		 * Always set following rates as ACK rates to conform
2250 		 * IEEE Std 802.11g-2003 clause 9.6
2251 		 *
2252 		 * 24Mbits/s	0x100
2253 		 * 12Mbits/s	0x040
2254 		 *  6Mbits/s	0x010
2255 		 */
2256 		mask |= 0x150;
2257 	}
2258 
2259 	RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
2260 
2261 	DPRINTF(sc, ("Setting ack rate mask to 0x%x\n", mask));
2262 #undef RV
2263 }
2264 
2265 /*
2266  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
2267  * driver.
2268  */
2269 static void
2270 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
2271 {
2272 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
2273 	uint32_t tmp;
2274 
2275 	/* update all BBP registers that depend on the band */
2276 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
2277 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
2278 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2279 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
2280 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
2281 	}
2282 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2283 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2284 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
2285 	}
2286 
2287 	rt2661_bbp_write(sc,  17, bbp17);
2288 	rt2661_bbp_write(sc,  96, bbp96);
2289 	rt2661_bbp_write(sc, 104, bbp104);
2290 
2291 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2292 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2293 		rt2661_bbp_write(sc, 75, 0x80);
2294 		rt2661_bbp_write(sc, 86, 0x80);
2295 		rt2661_bbp_write(sc, 88, 0x80);
2296 	}
2297 
2298 	rt2661_bbp_write(sc, 35, bbp35);
2299 	rt2661_bbp_write(sc, 97, bbp97);
2300 	rt2661_bbp_write(sc, 98, bbp98);
2301 
2302 	tmp = RAL_READ(sc, RT2661_PHY_CSR0);
2303 	tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
2304 	if (IEEE80211_IS_CHAN_2GHZ(c))
2305 		tmp |= RT2661_PA_PE_2GHZ;
2306 	else
2307 		tmp |= RT2661_PA_PE_5GHZ;
2308 	RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
2309 }
2310 
2311 static void
2312 rt2661_set_txpower(struct rt2661_softc *sc, int8_t power)
2313 {
2314 	const struct rt2661_rfprog *rfprog = sc->rfprog;
2315 	int i = sc->sc_curchan_idx;
2316 
2317 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2318 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2319 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2320 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2321 
2322 	DELAY(200);
2323 
2324 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2325 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2326 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
2327 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2328 
2329 	DELAY(200);
2330 
2331 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2332 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2333 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2334 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2335 
2336 	sc->sc_txpwr = power;
2337 }
2338 
2339 static void
2340 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
2341 {
2342 	struct ieee80211com *ic = &sc->sc_ic;
2343 	const struct rt2661_rfprog *rfprog = sc->rfprog;
2344 	uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
2345 	int8_t power;
2346 	u_int i, chan;
2347 
2348 	chan = ieee80211_chan2ieee(ic, c);
2349 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2350 		return;
2351 
2352 	/* find the settings for this channel (we know it exists) */
2353 	for (i = 0; rfprog[i].chan != chan; i++)
2354 		; /* EMPTY */
2355 	KASSERT(i < RT2661_NCHAN_MAX, ("invalid channel %d\n", chan));
2356 	sc->sc_curchan_idx = i;
2357 
2358 	power = sc->txpow[i];
2359 	if (power < 0) {
2360 		bbp94 += power;
2361 		power = 0;
2362 	} else if (power > 31) {
2363 		bbp94 += power - 31;
2364 		power = 31;
2365 	}
2366 
2367 	power = rt2661_txpower(sc, power);
2368 
2369 	/*
2370 	 * If we are switching from the 2GHz band to the 5GHz band or
2371 	 * vice-versa, BBP registers need to be reprogrammed.
2372 	 */
2373 	if (c->ic_flags != sc->sc_curchan->ic_flags) {
2374 		rt2661_select_band(sc, c);
2375 		rt2661_select_antenna(sc);
2376 	}
2377 	sc->sc_curchan = c;
2378 
2379 	rt2661_set_txpower(sc, power);
2380 
2381 	/* enable smart mode for MIMO-capable RFs */
2382 	bbp3 = rt2661_bbp_read(sc, 3);
2383 
2384 	bbp3 &= ~RT2661_SMART_MODE;
2385 	if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
2386 		bbp3 |= RT2661_SMART_MODE;
2387 
2388 	rt2661_bbp_write(sc, 3, bbp3);
2389 
2390 	if (bbp94 != RT2661_BBPR94_DEFAULT)
2391 		rt2661_bbp_write(sc, 94, bbp94);
2392 
2393 	/* 5GHz radio needs a 1ms delay here */
2394 	if (IEEE80211_IS_CHAN_5GHZ(c))
2395 		DELAY(1000);
2396 
2397 	sc->sc_sifs = IEEE80211_IS_CHAN_5GHZ(c) ? IEEE80211_DUR_OFDM_SIFS
2398 						: IEEE80211_DUR_SIFS;
2399 }
2400 
2401 static void
2402 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
2403 {
2404 	uint32_t tmp;
2405 
2406 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2407 	RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
2408 
2409 	tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
2410 	RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
2411 }
2412 
2413 static void
2414 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
2415 {
2416 	uint32_t tmp;
2417 
2418 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2419 	RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
2420 
2421 	tmp = addr[4] | addr[5] << 8;
2422 	RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
2423 }
2424 
2425 static void
2426 rt2661_update_promisc(struct rt2661_softc *sc)
2427 {
2428 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2429 	uint32_t tmp;
2430 
2431 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2432 
2433 	tmp &= ~RT2661_DROP_NOT_TO_ME;
2434 	if (!(ifp->if_flags & IFF_PROMISC))
2435 		tmp |= RT2661_DROP_NOT_TO_ME;
2436 
2437 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2438 
2439 	DPRINTF(sc, ("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2440 	    "entering" : "leaving"));
2441 }
2442 
2443 /*
2444  * Update QoS (802.11e) settings for each h/w Tx ring.
2445  */
2446 static int
2447 rt2661_wme_update(struct ieee80211com *ic)
2448 {
2449 	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
2450 	const struct wmeParams *wmep;
2451 
2452 	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
2453 
2454 	/* XXX: not sure about shifts. */
2455 	/* XXX: the reference driver plays with AC_VI settings too. */
2456 
2457 	/* update TxOp */
2458 	RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
2459 	    wmep[WME_AC_BE].wmep_txopLimit << 16 |
2460 	    wmep[WME_AC_BK].wmep_txopLimit);
2461 	RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
2462 	    wmep[WME_AC_VI].wmep_txopLimit << 16 |
2463 	    wmep[WME_AC_VO].wmep_txopLimit);
2464 
2465 	/* update CWmin */
2466 	RAL_WRITE(sc, RT2661_CWMIN_CSR,
2467 	    wmep[WME_AC_BE].wmep_logcwmin << 12 |
2468 	    wmep[WME_AC_BK].wmep_logcwmin <<  8 |
2469 	    wmep[WME_AC_VI].wmep_logcwmin <<  4 |
2470 	    wmep[WME_AC_VO].wmep_logcwmin);
2471 
2472 	/* update CWmax */
2473 	RAL_WRITE(sc, RT2661_CWMAX_CSR,
2474 	    wmep[WME_AC_BE].wmep_logcwmax << 12 |
2475 	    wmep[WME_AC_BK].wmep_logcwmax <<  8 |
2476 	    wmep[WME_AC_VI].wmep_logcwmax <<  4 |
2477 	    wmep[WME_AC_VO].wmep_logcwmax);
2478 
2479 	/* update Aifsn */
2480 	RAL_WRITE(sc, RT2661_AIFSN_CSR,
2481 	    wmep[WME_AC_BE].wmep_aifsn << 12 |
2482 	    wmep[WME_AC_BK].wmep_aifsn <<  8 |
2483 	    wmep[WME_AC_VI].wmep_aifsn <<  4 |
2484 	    wmep[WME_AC_VO].wmep_aifsn);
2485 
2486 	return 0;
2487 }
2488 
2489 static void
2490 rt2661_update_slot(struct ifnet *ifp)
2491 {
2492 	struct rt2661_softc *sc = ifp->if_softc;
2493 	struct ieee80211com *ic = &sc->sc_ic;
2494 	uint8_t slottime;
2495 	uint32_t tmp;
2496 
2497 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2498 
2499 	tmp = RAL_READ(sc, RT2661_MAC_CSR9);
2500 	tmp = (tmp & ~0xff) | slottime;
2501 	RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
2502 }
2503 
2504 static const char *
2505 rt2661_get_rf(int rev)
2506 {
2507 	switch (rev) {
2508 	case RT2661_RF_5225:	return "RT5225";
2509 	case RT2661_RF_5325:	return "RT5325 (MIMO XR)";
2510 	case RT2661_RF_2527:	return "RT2527";
2511 	case RT2661_RF_2529:	return "RT2529 (MIMO XR)";
2512 	default:		return "unknown";
2513 	}
2514 }
2515 
2516 static void
2517 rt2661_read_config(struct rt2661_softc *sc)
2518 {
2519 	struct ieee80211com *ic = &sc->sc_ic;
2520 	uint16_t val;
2521 	uint8_t rfprog = 0;
2522 	int i, start_chan;
2523 
2524 	/* read MAC address */
2525 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
2526 	ic->ic_myaddr[0] = val & 0xff;
2527 	ic->ic_myaddr[1] = val >> 8;
2528 
2529 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
2530 	ic->ic_myaddr[2] = val & 0xff;
2531 	ic->ic_myaddr[3] = val >> 8;
2532 
2533 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
2534 	ic->ic_myaddr[4] = val & 0xff;
2535 	ic->ic_myaddr[5] = val >> 8;
2536 
2537 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
2538 	/* XXX: test if different from 0xffff? */
2539 	sc->rf_rev   = (val >> 11) & 0x1f;
2540 	sc->hw_radio = (val >> 10) & 0x1;
2541 	sc->auto_txagc = (val >> 9) & 0x1;
2542 	sc->rx_ant   = (val >> 4)  & 0x3;
2543 	sc->tx_ant   = (val >> 2)  & 0x3;
2544 	sc->nb_ant   = val & 0x3;
2545 
2546 	DPRINTF(sc, ("RF revision=%d\n", sc->rf_rev));
2547 	DPRINTF(sc, ("Number of ant %d, rxant %d, txant %d\n",
2548 		 sc->nb_ant, sc->rx_ant, sc->tx_ant));
2549 
2550 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
2551 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
2552 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
2553 
2554 	DPRINTF(sc, ("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
2555 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
2556 
2557 	if (sc->ext_2ghz_lna) {
2558 		sc->bbp17_2ghz_min = 0x30;
2559 		sc->bbp17_2ghz_max = 0x50;
2560 	} else {
2561 		sc->bbp17_2ghz_min = 0x20;
2562 		sc->bbp17_2ghz_max = 0x40;
2563 	}
2564 
2565 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
2566 	sc->rssi_2ghz_corr[0] = (int8_t)(val & 0xff);	/* signed */
2567 	sc->rssi_2ghz_corr[1] = (int8_t)(val >> 8);	/* signed */
2568 
2569 	/* Only [-10, 10] is valid */
2570 	for (i = 0; i < 2; ++i) {
2571 		if (sc->rssi_2ghz_corr[i] < -10 || sc->rssi_2ghz_corr[i] > 10)
2572 			sc->rssi_2ghz_corr[i] = 0;
2573 	}
2574 
2575 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
2576 	if ((val & 0xff) != 0xff)
2577 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2578 
2579 	/* Only [-10, 10] is valid */
2580 	if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
2581 		sc->rssi_5ghz_corr = 0;
2582 
2583 	/* adjust RSSI correction for external low-noise amplifier */
2584 	if (sc->ext_2ghz_lna) {
2585 		sc->rssi_2ghz_corr[0] -= 14;
2586 		sc->rssi_2ghz_corr[1] -= 14;
2587 	}
2588 	if (sc->ext_5ghz_lna)
2589 		sc->rssi_5ghz_corr -= 14;
2590 
2591 	DPRINTF(sc, ("RSSI 2GHz corr0=%d corr1=%d\nRSSI 5GHz corr=%d\n",
2592 	    sc->rssi_2ghz_corr[0], sc->rssi_2ghz_corr[1], sc->rssi_5ghz_corr));
2593 
2594 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
2595 	if ((val >> 8) != 0xff)
2596 		rfprog = (val >> 8) & 0x3;
2597 	if ((val & 0xff) != 0xff)
2598 		sc->rffreq = val & 0xff;
2599 
2600 	DPRINTF(sc, ("RF prog=%d\nRF freq=%d\n", rfprog, sc->rffreq));
2601 
2602 	sc->rfprog = rfprog == 0 ? rt2661_rf5225_1 : rt2661_rf5225_2;
2603 
2604 #define NCHAN_2GHZ	14
2605 #define NCHAN_5GHZ	24
2606 	/*
2607 	 * Read channel TX power
2608 	 */
2609 	start_chan = 0;
2610 	rt2661_read_txpower_config(sc, RT2661_EEPROM_TXPOWER_2GHZ,
2611 				   NCHAN_2GHZ, &start_chan);
2612 	rt2661_read_txpower_config(sc, RT2661_EEPROM_TXPOWER_5GHZ,
2613 				   NCHAN_5GHZ, &start_chan);
2614 #undef NCHAN_2GHZ
2615 #undef NCHAN_5GHZ
2616 
2617 	/* read vendor-specific BBP values */
2618 	for (i = 0; i < 16; i++) {
2619 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
2620 		if (val == 0 || val == 0xffff)
2621 			continue;	/* skip invalid entries */
2622 		sc->bbp_prom[i].reg = val >> 8;
2623 		sc->bbp_prom[i].val = val & 0xff;
2624 		DPRINTF(sc, ("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
2625 		    sc->bbp_prom[i].val));
2626 	}
2627 
2628 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_LED_OFFSET);
2629 	DPRINTF(sc, ("LED %02x\n", val));
2630 	if (val == 0xffff) {
2631 		sc->mcu_led = RT2661_MCU_LED_DEFAULT;
2632 	} else {
2633 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
2634 
2635 		for (i = 0; i < N(led_ee2mcu); ++i) {
2636 			if (val & led_ee2mcu[i].ee_bit)
2637 				sc->mcu_led |= led_ee2mcu[i].mcu_bit;
2638 		}
2639 
2640 #undef N
2641 
2642 		sc->mcu_led |= ((val >> RT2661_EE_LED_MODE_SHIFT) &
2643 				RT2661_EE_LED_MODE_MASK);
2644 	}
2645 
2646 	/* TX power down step array */
2647 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_2GHZ_TSSI1);
2648 	sc->tssi_2ghz_down[3] = val & 0xff;
2649 	sc->tssi_2ghz_down[2] = val >> 8;
2650 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_2GHZ_TSSI2);
2651 	sc->tssi_2ghz_down[1] = val & 0xff;
2652 	sc->tssi_2ghz_down[0] = val >> 8;
2653 	DPRINTF(sc, ("2GHZ tssi down 0:%u 1:%u 2:%u 3:%u\n",
2654 		 sc->tssi_2ghz_down[0], sc->tssi_2ghz_down[1],
2655 		 sc->tssi_2ghz_down[2], sc->tssi_2ghz_down[3]));
2656 
2657 	/* TX power up step array */
2658 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_2GHZ_TSSI3);
2659 	sc->tssi_2ghz_up[0] = val & 0xff;
2660 	sc->tssi_2ghz_up[1] = val >> 8;
2661 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_2GHZ_TSSI4);
2662 	sc->tssi_2ghz_up[2] = val & 0xff;
2663 	sc->tssi_2ghz_up[3] = val >> 8;
2664 	DPRINTF(sc, ("2GHZ tssi up 0:%u 1:%u 2:%u 3:%u\n",
2665 		 sc->tssi_2ghz_up[0], sc->tssi_2ghz_up[1],
2666 		 sc->tssi_2ghz_up[2], sc->tssi_2ghz_up[3]));
2667 
2668 	/* TX power adjustment reference value and step */
2669 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_2GHZ_TSSI5);
2670 	sc->tssi_2ghz_ref = val & 0xff;
2671 	sc->tssi_2ghz_step = val >> 8;
2672 	DPRINTF(sc, ("2GHZ tssi ref %u, step %d\n",
2673 		 sc->tssi_2ghz_ref, sc->tssi_2ghz_step));
2674 
2675 	if (sc->tssi_2ghz_ref == 0xff)
2676 		sc->auto_txagc = 0;
2677 	DPRINTF(sc, ("Auto TX AGC %d\n", sc->auto_txagc));
2678 }
2679 
2680 static int
2681 rt2661_bbp_init(struct rt2661_softc *sc)
2682 {
2683 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2684 	int i, ntries;
2685 	uint8_t val;
2686 
2687 	/* wait for BBP to be ready */
2688 	for (ntries = 0; ntries < 100; ntries++) {
2689 		val = rt2661_bbp_read(sc, 0);
2690 		if (val != 0 && val != 0xff)
2691 			break;
2692 		DELAY(100);
2693 	}
2694 	if (ntries == 100) {
2695 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2696 		return EIO;
2697 	}
2698 
2699 	/* initialize BBP registers to default values */
2700 	for (i = 0; i < N(rt2661_def_bbp); i++) {
2701 		rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
2702 		    rt2661_def_bbp[i].val);
2703 	}
2704 
2705 	/* write vendor-specific BBP values (from EEPROM) */
2706 	for (i = 0; i < 16; i++) {
2707 		if (sc->bbp_prom[i].reg == 0)
2708 			continue;
2709 		rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2710 	}
2711 
2712 	return 0;
2713 #undef N
2714 }
2715 
2716 static void
2717 rt2661_init(void *priv)
2718 {
2719 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2720 	struct rt2661_softc *sc = priv;
2721 	struct ieee80211com *ic = &sc->sc_ic;
2722 	struct ifnet *ifp = ic->ic_ifp;
2723 	uint32_t tmp, sta[3];
2724 	int i, ntries;
2725 
2726 	rt2661_stop(sc);
2727 
2728 	/* initialize Tx rings */
2729 	RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
2730 	RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
2731 	RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
2732 	RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
2733 
2734 	/* initialize Mgt ring */
2735 	RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
2736 
2737 	/* initialize Rx ring */
2738 	RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
2739 
2740 	/* initialize Tx rings sizes */
2741 	RAL_WRITE(sc, RT2661_TX_RING_CSR0,
2742 	    RT2661_TX_RING_COUNT << 24 |
2743 	    RT2661_TX_RING_COUNT << 16 |
2744 	    RT2661_TX_RING_COUNT <<  8 |
2745 	    RT2661_TX_RING_COUNT);
2746 
2747 	RAL_WRITE(sc, RT2661_TX_RING_CSR1,
2748 	    RT2661_TX_DESC_WSIZE << 16 |
2749 	    RT2661_TX_RING_COUNT <<  8 |	/* XXX: HCCA ring unused */
2750 	    RT2661_MGT_RING_COUNT);
2751 
2752 	/* initialize Rx rings */
2753 	RAL_WRITE(sc, RT2661_RX_RING_CSR,
2754 	    RT2661_RX_DESC_BACK  << 16 |
2755 	    RT2661_RX_DESC_WSIZE <<  8 |
2756 	    RT2661_RX_RING_COUNT);
2757 
2758 	/* XXX: some magic here */
2759 	RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
2760 
2761 	/* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
2762 	RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
2763 
2764 	/* load base address of Rx ring */
2765 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
2766 
2767 	/* initialize MAC registers to default values */
2768 	for (i = 0; i < N(rt2661_def_mac); i++)
2769 		RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
2770 
2771 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2772 	rt2661_set_macaddr(sc, ic->ic_myaddr);
2773 
2774 	/* set host ready */
2775 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2776 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2777 
2778 	/* wait for BBP/RF to wakeup */
2779 	for (ntries = 0; ntries < 1000; ntries++) {
2780 		if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
2781 			break;
2782 		DELAY(1000);
2783 	}
2784 	if (ntries == 1000) {
2785 		kprintf("timeout waiting for BBP/RF to wakeup\n");
2786 		rt2661_stop(sc);
2787 		return;
2788 	}
2789 
2790 	if (rt2661_bbp_init(sc) != 0) {
2791 		rt2661_stop(sc);
2792 		return;
2793 	}
2794 
2795 	/* select default channel */
2796 	sc->sc_curchan = ic->ic_curchan;
2797 	rt2661_select_band(sc, sc->sc_curchan);
2798 	rt2661_select_antenna(sc);
2799 	rt2661_set_chan(sc, sc->sc_curchan);
2800 
2801 	/* update Rx filter */
2802 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
2803 
2804 	tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
2805 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2806 		tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
2807 		       RT2661_DROP_ACKCTS;
2808 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2809 			tmp |= RT2661_DROP_TODS;
2810 		if (!(ifp->if_flags & IFF_PROMISC))
2811 			tmp |= RT2661_DROP_NOT_TO_ME;
2812 	}
2813 
2814 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2815 
2816 	/* clear STA registers */
2817 	RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
2818 
2819 	/* initialize ASIC */
2820 	RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
2821 
2822 	/* clear any pending interrupt */
2823 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2824 
2825 	/* enable interrupts */
2826 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
2827 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
2828 
2829 	/* kick Rx */
2830 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
2831 
2832 	ifp->if_flags &= ~IFF_OACTIVE;
2833 	ifp->if_flags |= IFF_RUNNING;
2834 
2835 	for (i = 0; i < IEEE80211_WEP_NKID; ++i) {
2836 		uint8_t mac[IEEE80211_ADDR_LEN];
2837 		const struct ieee80211_key *k = &ic->ic_nw_keys[i];
2838 
2839 		if (k->wk_keyix != IEEE80211_KEYIX_NONE)
2840 			rt2661_key_set(ic, k, mac);
2841 	}
2842 
2843 	RT2661_RESET_AVG_RSSI(sc);
2844 
2845 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2846 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2847 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2848 	} else {
2849 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2850 	}
2851 #undef N
2852 }
2853 
2854 void
2855 rt2661_stop(void *priv)
2856 {
2857 	struct rt2661_softc *sc = priv;
2858 	struct ieee80211com *ic = &sc->sc_ic;
2859 	struct ifnet *ifp = ic->ic_ifp;
2860 	struct rt2661_tx_ratectl *rctl;
2861 	uint32_t tmp;
2862 
2863 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2864 
2865 	sc->sc_tx_timer = 0;
2866 	ifp->if_timer = 0;
2867 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2868 
2869 	/* abort Tx (for all 5 Tx rings) */
2870 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
2871 
2872 	/* disable Rx (value remains after reset!) */
2873 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2874 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2875 
2876 	/* reset ASIC */
2877 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2878 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2879 
2880 	/* disable interrupts */
2881 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffffff);
2882 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
2883 
2884 	/* clear any pending interrupt */
2885 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2886 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
2887 
2888 	while ((rctl = STAILQ_FIRST(&sc->tx_ratectl)) != NULL) {
2889 		STAILQ_REMOVE_HEAD(&sc->tx_ratectl, link);
2890 		ieee80211_free_node(rctl->ni);
2891 		rctl->ni = NULL;
2892 		kfree(rctl, M_RT2661);
2893 	}
2894 
2895 	/* reset Tx and Rx rings */
2896 	rt2661_reset_tx_ring(sc, &sc->txq[0]);
2897 	rt2661_reset_tx_ring(sc, &sc->txq[1]);
2898 	rt2661_reset_tx_ring(sc, &sc->txq[2]);
2899 	rt2661_reset_tx_ring(sc, &sc->txq[3]);
2900 	rt2661_reset_tx_ring(sc, &sc->mgtq);
2901 	rt2661_reset_rx_ring(sc, &sc->rxq);
2902 
2903 	/* Clear key map. */
2904 	bzero(sc->sc_keymap, sizeof(sc->sc_keymap));
2905 }
2906 
2907 static int
2908 rt2661_load_microcode(struct rt2661_softc *sc, const uint8_t *ucode, int size)
2909 {
2910 	int ntries;
2911 
2912 	/* reset 8051 */
2913 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2914 
2915 	/* cancel any pending Host to MCU command */
2916 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
2917 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
2918 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
2919 
2920 	/* write 8051's microcode */
2921 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
2922 	RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, ucode, size);
2923 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2924 
2925 	/* kick 8051's ass */
2926 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
2927 
2928 	/* wait for 8051 to initialize */
2929 	for (ntries = 0; ntries < 500; ntries++) {
2930 		if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
2931 			break;
2932 		DELAY(100);
2933 	}
2934 	if (ntries == 500) {
2935 		kprintf("timeout waiting for MCU to initialize\n");
2936 		return EIO;
2937 	}
2938 	return 0;
2939 }
2940 
2941 static int
2942 rt2661_prepare_beacon(struct rt2661_softc *sc)
2943 {
2944 	struct ieee80211com *ic = &sc->sc_ic;
2945 	struct ieee80211_beacon_offsets bo;
2946 	struct rt2661_tx_desc desc;
2947 	struct mbuf *m0;
2948 	int rate;
2949 
2950 	m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
2951 	if (m0 == NULL) {
2952 		device_printf(sc->sc_dev, "could not allocate beacon frame\n");
2953 		return ENOBUFS;
2954 	}
2955 
2956 	/* send beacons at the lowest available rate */
2957 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan) ? 12 : 2;
2958 
2959 	rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
2960 	    m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT, 0, NULL, NULL, NULL);
2961 
2962 	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2963 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2964 
2965 	/* copy beacon header and payload into NIC memory */
2966 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
2967 	    mtod(m0, uint8_t *), m0->m_pkthdr.len);
2968 
2969 	m_freem(m0);
2970 	return 0;
2971 }
2972 
2973 /*
2974  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
2975  * and HostAP operating modes.
2976  */
2977 static void
2978 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
2979 {
2980 	struct ieee80211com *ic = &sc->sc_ic;
2981 	uint32_t tmp;
2982 
2983 	if (ic->ic_opmode != IEEE80211_M_STA) {
2984 		/*
2985 		 * Change default 16ms TBTT adjustment to 8ms.
2986 		 * Must be done before enabling beacon generation.
2987 		 */
2988 		RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
2989 	}
2990 
2991 	tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
2992 
2993 	/* set beacon interval (in 1/16ms unit) */
2994 	tmp |= ic->ic_bss->ni_intval * 16;
2995 
2996 	tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
2997 	if (ic->ic_opmode == IEEE80211_M_STA)
2998 		tmp |= RT2661_TSF_MODE(1);
2999 	else
3000 		tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
3001 
3002 	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
3003 }
3004 
3005 /*
3006  * Retrieve the "Received Signal Strength Indicator" from the raw values
3007  * contained in Rx descriptors.  The computation depends on which band the
3008  * frame was received.  Correction values taken from the reference driver.
3009  */
3010 static int
3011 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw, int i)
3012 {
3013 	int lna, agc, rssi;
3014 
3015 	lna = (raw >> 5) & 0x3;
3016 	agc = raw & 0x1f;
3017 
3018 	if (lna == 0) {
3019 		/*
3020 		 * No RSSI mapping
3021 		 *
3022 		 * NB: Since RSSI is relative to noise floor, -1 is
3023 		 *     adequate for caller to know error happened.
3024 		 */
3025 		return -1;
3026 	}
3027 
3028 	rssi = (2 * agc) - RT2661_NOISE_FLOOR;
3029 
3030 	if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
3031 		rssi += sc->rssi_2ghz_corr[i];
3032 
3033 		if (lna == 1)
3034 			rssi -= 64;
3035 		else if (lna == 2)
3036 			rssi -= 74;
3037 		else if (lna == 3)
3038 			rssi -= 90;
3039 	} else {
3040 		rssi += sc->rssi_5ghz_corr;
3041 
3042 		if (lna == 1)
3043 			rssi -= 64;
3044 		else if (lna == 2)
3045 			rssi -= 86;
3046 		else if (lna == 3)
3047 			rssi -= 100;
3048 	}
3049 
3050 	if (sc->avg_rssi[i] < 0) {
3051 		sc->avg_rssi[i] = rssi;
3052 	} else {
3053 		sc->avg_rssi[i] =
3054 		((sc->avg_rssi[i] << 3) - sc->avg_rssi[i] + rssi) >> 3;
3055 	}
3056 	return rssi;
3057 }
3058 
3059 static void
3060 rt2661_dma_map_mbuf(void *arg, bus_dma_segment_t *seg, int nseg,
3061 		    bus_size_t map_size __unused, int error)
3062 {
3063 	struct rt2661_dmamap *map = arg;
3064 
3065 	if (error)
3066 		return;
3067 
3068 	KASSERT(nseg <= RT2661_MAX_SCATTER, ("too many DMA segments"));
3069 
3070 	bcopy(seg, map->segs, nseg * sizeof(bus_dma_segment_t));
3071 	map->nseg = nseg;
3072 }
3073 
3074 static void
3075 rt2661_led_newstate(struct rt2661_softc *sc, enum ieee80211_state nstate)
3076 {
3077 	struct ieee80211com *ic = &sc->sc_ic;
3078 	uint32_t off, on;
3079 	uint32_t mail = sc->mcu_led;
3080 
3081 	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY) {
3082 		DPRINTF(sc, ("%s failed\n", __func__));
3083 		return;
3084 	}
3085 
3086 	switch (nstate) {
3087 	case IEEE80211_S_INIT:
3088 		mail &= ~(RT2661_MCU_LED_LINKA | RT2661_MCU_LED_LINKG |
3089 			  RT2661_MCU_LED_RF);
3090 		break;
3091 	default:
3092 		if (ic->ic_curchan == NULL)
3093 			return;
3094 
3095 		on = RT2661_MCU_LED_LINKG;
3096 		off = RT2661_MCU_LED_LINKA;
3097 		if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
3098 			on = RT2661_MCU_LED_LINKA;
3099 			off = RT2661_MCU_LED_LINKG;
3100 		}
3101 
3102 		mail |= RT2661_MCU_LED_RF | on;
3103 		mail &= ~off;
3104 		break;
3105 	}
3106 
3107 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
3108 		  RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | mail);
3109 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | RT2661_MCU_SET_LED);
3110 }
3111 
3112 static void
3113 rt2661_read_txpower_config(struct rt2661_softc *sc, uint8_t txpwr_ofs,
3114 			   int nchan, int *start_chan0)
3115 {
3116 	int i, loop_max;
3117 	int start_chan = *start_chan0;
3118 
3119 	KASSERT(nchan % 2 == 0, ("number of channels %d is not even\n", nchan));
3120 	KASSERT(start_chan + nchan <= RT2661_NCHAN_MAX, ("too many channels"));
3121 
3122 	loop_max = nchan / 2;
3123 
3124 	for (i = 0; i < loop_max; i++) {
3125 		int chan_idx, j;
3126 		uint16_t val;
3127 
3128 		val = rt2661_eeprom_read(sc, txpwr_ofs + i);
3129 		chan_idx = i * 2 + start_chan;
3130 
3131 		for (j = 0; j < 2; ++j) {
3132 			int8_t tx_power;	/* signed */
3133 
3134 			tx_power = (int8_t)((val >> (8 * j)) & 0xff);
3135 			if (tx_power > RT2661_TXPOWER_MAX)
3136 				tx_power = RT2661_TXPOWER_DEFAULT;
3137 
3138 			sc->txpow[chan_idx] = tx_power;
3139 			DPRINTF(sc, ("Channel=%d Tx power=%d\n",
3140 			    rt2661_rf5225_1[chan_idx].chan, sc->txpow[chan_idx]));
3141 
3142 			++chan_idx;
3143 		}
3144 	}
3145 	*start_chan0 += nchan;
3146 }
3147 
3148 static int
3149 rt2661_key_alloc(struct ieee80211com *ic, const struct ieee80211_key *key,
3150 		 ieee80211_keyix *keyix, ieee80211_keyix *rxkeyix)
3151 {
3152 	struct rt2661_softc *sc = ic->ic_if.if_softc;
3153 
3154 	DPRINTF(sc, ("%s: ", __func__));
3155 
3156 	if (key->wk_flags & IEEE80211_KEY_SWCRYPT) {
3157 		DPRINTF(sc, ("alloc sw key\n"));
3158 		return sc->sc_key_alloc(ic, key, keyix, rxkeyix);
3159 	}
3160 
3161 	if (key->wk_flags & IEEE80211_KEY_GROUP) {	/* Global key */
3162 		DPRINTF(sc, ("alloc group key\n"));
3163 
3164 		KASSERT(key >= &ic->ic_nw_keys[0] &&
3165 			key < &ic->ic_nw_keys[IEEE80211_WEP_NKID],
3166 			("bogus group key\n"));
3167 
3168 		*keyix = *rxkeyix = key - ic->ic_nw_keys;
3169 		return 1;
3170 	} else {					/* Pairwise key */
3171 		int i;
3172 
3173 		DPRINTF(sc, ("alloc pairwise key\n"));
3174 
3175 		for (i = IEEE80211_WEP_NKID; i < RT2661_KEY_MAX; ++i) {
3176 			if (!RT2661_KEY_ISSET(sc, i))
3177 				break;
3178 		}
3179 #ifndef MIXED_KEY_TEST
3180 		if (i == RT2661_KEY_MAX)
3181 			return 0;
3182 #else
3183 		if (i != IEEE80211_WEP_NKID)
3184 			return 0;
3185 #endif
3186 
3187 		RT2661_KEY_SET(sc, i);
3188 		*keyix = *rxkeyix = i;
3189 		return 1;
3190 	}
3191 }
3192 
3193 static int
3194 rt2661_key_delete(struct ieee80211com *ic, const struct ieee80211_key *key)
3195 {
3196 	struct rt2661_softc *sc = ic->ic_if.if_softc;
3197 	uint32_t val;
3198 
3199 	DPRINTF(sc, ("%s: keyix %d, rxkeyix %d, ", __func__,
3200 		 key->wk_keyix, key->wk_rxkeyix));
3201 
3202 	if (key->wk_flags & IEEE80211_KEY_SWCRYPT) {
3203 		DPRINTF(sc, ("delete sw key\n"));
3204 		return sc->sc_key_delete(ic, key);
3205 	}
3206 
3207 	if (key->wk_keyix < IEEE80211_WEP_NKID) {	/* Global key */
3208 		DPRINTF(sc, ("delete global key\n"));
3209 		val = RAL_READ(sc, RT2661_SEC_CSR0);
3210 		val &= ~(1 << key->wk_keyix);
3211 		RAL_WRITE(sc, RT2661_SEC_CSR0, val);
3212 	} else {					/* Pairwise key */
3213 		DPRINTF(sc, ("delete pairwise key\n"));
3214 
3215 		RT2661_KEY_CLR(sc, key->wk_keyix);
3216 		if (key->wk_keyix < 32) {
3217 			val = RAL_READ(sc, RT2661_SEC_CSR2);
3218 			val &= ~(1 << key->wk_keyix);
3219 			RAL_WRITE(sc, RT2661_SEC_CSR2, val);
3220 		} else {
3221 			val = RAL_READ(sc, RT2661_SEC_CSR3);
3222 			val &= ~(1 << (key->wk_keyix - 32));
3223 			RAL_WRITE(sc, RT2661_SEC_CSR3, val);
3224 		}
3225 	}
3226 	return 1;
3227 }
3228 
3229 static int
3230 rt2661_key_set(struct ieee80211com *ic, const struct ieee80211_key *key,
3231 	       const uint8_t mac[IEEE80211_ADDR_LEN])
3232 {
3233 	struct rt2661_softc *sc = ic->ic_if.if_softc;
3234 	uint32_t addr, val;
3235 
3236 	DPRINTF(sc, ("%s: keyix %d, rxkeyix %d, flags 0x%04x, ", __func__,
3237 		 key->wk_keyix, key->wk_rxkeyix, key->wk_flags));
3238 
3239 	if (key->wk_flags & IEEE80211_KEY_SWCRYPT) {
3240 		DPRINTF(sc, ("set sw key\n"));
3241 		return sc->sc_key_set(ic, key, mac);
3242 	}
3243 
3244 	if (key->wk_keyix < IEEE80211_WEP_NKID) {	/* Global Key */
3245 		int cipher, keyix_shift;
3246 
3247 		DPRINTF(sc, ("set global key\n"));
3248 
3249 		/*
3250 		 * Install key content.
3251 		 */
3252 		addr = RT2661_GLOBAL_KEY_BASE +
3253 		       (key->wk_keyix * sizeof(key->wk_key));
3254 		RAL_WRITE_REGION_1(sc, addr, key->wk_key, sizeof(key->wk_key));
3255 
3256 		/*
3257 		 * Set key cipher.
3258 		 */
3259 		cipher = rt2661_cipher(key);
3260 		keyix_shift = key->wk_keyix * 4;
3261 
3262 		val = RAL_READ(sc, RT2661_SEC_CSR1);
3263 		val &= ~(0xf << keyix_shift);
3264 		val |= cipher << keyix_shift;
3265 		RAL_WRITE(sc, RT2661_SEC_CSR1, val);
3266 
3267 		/*
3268 		 * Enable key slot.
3269 		 */
3270 		val = RAL_READ(sc, RT2661_SEC_CSR0);
3271 		val |= 1 << key->wk_keyix;
3272 		RAL_WRITE(sc, RT2661_SEC_CSR0, val);
3273 	} else {					/* Pairwise key */
3274 		uint8_t mac_cipher[IEEE80211_ADDR_LEN + 1];
3275 
3276 		DPRINTF(sc, ("set pairwise key\n"));
3277 
3278 		/*
3279 		 * Install key content.
3280 		 */
3281 		addr = RT2661_PAIRWISE_KEY_BASE +
3282 		       (key->wk_keyix * sizeof(key->wk_key));
3283 		RAL_WRITE_REGION_1(sc, addr, key->wk_key, sizeof(key->wk_key));
3284 
3285 		/*
3286 		 * Set target address and key cipher.
3287 		 */
3288 		memcpy(mac_cipher, mac, IEEE80211_ADDR_LEN);
3289 		mac_cipher[IEEE80211_ADDR_LEN] = rt2661_cipher(key);
3290 
3291 		/* XXX Actually slot size is 1 byte bigger than mac_cipher */
3292 		addr = RT2661_TARGET_ADDR_BASE +
3293 		       (key->wk_keyix * (IEEE80211_ADDR_LEN + 2));
3294 		RAL_WRITE_REGION_1(sc, addr, mac_cipher, sizeof(mac_cipher));
3295 
3296 		/*
3297 		 * Enable key slot.
3298 		 */
3299 		if (key->wk_keyix < 32) {
3300 			val = RAL_READ(sc, RT2661_SEC_CSR2);
3301 			val |= 1 << key->wk_keyix;
3302 			RAL_WRITE(sc, RT2661_SEC_CSR2, val);
3303 		} else {
3304 			val = RAL_READ(sc, RT2661_SEC_CSR3);
3305 			val |= 1 << (key->wk_keyix - 32);
3306 			RAL_WRITE(sc, RT2661_SEC_CSR3, val);
3307 		}
3308 
3309 		/*
3310 		 * Enable pairwise key looking up when RX.
3311 		 */
3312 		RAL_WRITE(sc, RT2661_SEC_CSR4, 1);
3313 	}
3314 	return 1;
3315 }
3316 
3317 static void *
3318 rt2661_ratectl_attach(struct ieee80211com *ic, u_int rc)
3319 {
3320 	struct rt2661_softc *sc = ic->ic_if.if_softc;
3321 
3322 	switch (rc) {
3323 	case IEEE80211_RATECTL_ONOE:
3324 		return &sc->sc_onoe_param;
3325 
3326 	case IEEE80211_RATECTL_SAMPLE:
3327 		if ((ic->ic_ratectl.rc_st_ratectl_cap &
3328 		     IEEE80211_RATECTL_CAP_SAMPLE) == 0)
3329 			panic("sample rate control algo is not supported\n");
3330 		return &sc->sc_sample_param;
3331 
3332 	case IEEE80211_RATECTL_NONE:
3333 		/* This could only happen during detaching */
3334 		return NULL;
3335 
3336 	default:
3337 		panic("unknown rate control algo %u\n", rc);
3338 		return NULL;
3339 	}
3340 }
3341 
3342 static void
3343 rt2661_calib_txpower(struct rt2661_softc *sc)
3344 {
3345 	int8_t txpower;
3346 	int rssi_dbm;
3347 
3348 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN)
3349 		return;
3350 
3351 	txpower = sc->txpow[sc->sc_curchan_idx];
3352 	if (txpower < 0)
3353 		txpower = 0;
3354 	else if (txpower > 31)
3355 		txpower = 31;
3356 	txpower = rt2661_txpower(sc, txpower);
3357 
3358 	if (sc->auto_txagc) {
3359 		/*
3360 		 * Compensate TX power according to temperature change
3361 		 */
3362 		if (sc->sc_txpwr_cnt++ % 4 == 0) {
3363 			uint8_t bbp1;
3364 			int i;
3365 
3366 			/*
3367 			 * Adjust compensation very 4 seconds
3368 			 */
3369 			bbp1 = rt2661_bbp_read(sc, 1);
3370 			if (bbp1 > sc->tssi_2ghz_ref) {
3371 				for (i = 0; i < RT2661_TSSI_LIMSZ; ++i) {
3372 					if (bbp1 <= sc->tssi_2ghz_down[i])
3373 						break;
3374 				}
3375 				if (txpower > (sc->tssi_2ghz_step * i)) {
3376 					sc->tssi_2ghz_comp =
3377 					-(sc->tssi_2ghz_step * i);
3378 				} else {
3379 					sc->tssi_2ghz_comp = -txpower;
3380 				}
3381 			} else if (bbp1 < sc->tssi_2ghz_ref) {
3382 				for (i = 0; i < RT2661_TSSI_LIMSZ; ++i) {
3383 					if (bbp1 >= sc->tssi_2ghz_up[i])
3384 						break;
3385 				}
3386 				sc->tssi_2ghz_comp = sc->tssi_2ghz_step * i;
3387 			}
3388 		}
3389 		txpower += sc->tssi_2ghz_comp;
3390 	}
3391 
3392 	/*
3393 	 * Adjust TX power according to RSSI
3394 	 */
3395 	rssi_dbm = rt2661_avgrssi(sc);
3396 	DPRINTF(sc, ("dbm %d, txpower %d\n", rssi_dbm, txpower));
3397 
3398 	if (rssi_dbm > -30) {
3399 		if (txpower > 16)
3400 			txpower -= 16;
3401 		else
3402 			txpower = 0;
3403 	} else if (rssi_dbm > -45) {
3404 		if (txpower > 6)
3405 			txpower -= 6;
3406 		else
3407 			txpower = 0;
3408 	}
3409 
3410 	if (txpower != sc->sc_txpwr)
3411 		rt2661_set_txpower(sc, txpower);
3412 }
3413 
3414 static void
3415 rt2661_calib_rxsensibility(struct rt2661_softc *sc, uint32_t false_cca)
3416 {
3417 #define MIDRANGE_RSSI	-74
3418 
3419 	uint8_t bbp17;
3420 	int rssi_dbm;
3421 
3422 	if (sc->sc_ic.ic_state != IEEE80211_S_RUN)
3423 		return;
3424 
3425 	rssi_dbm = rt2661_avgrssi(sc);
3426 
3427 	if (rssi_dbm >= MIDRANGE_RSSI) {
3428 		if (rssi_dbm >= -35)
3429 			bbp17 = 0x60;
3430 		else if (rssi_dbm >= -58)
3431 			bbp17 = sc->bbp17_2ghz_max;
3432 		else if (rssi_dbm >= -66)
3433 			bbp17 = sc->bbp17_2ghz_min + 0x10;
3434 		else
3435 			bbp17 = sc->bbp17_2ghz_min + 0x8;
3436 
3437 		if (sc->bbp17 != bbp17)
3438 			rt2661_bbp_write(sc, 17, bbp17);
3439 		return;
3440 	}
3441 
3442 	bbp17 = sc->bbp17_2ghz_max - (2 * (MIDRANGE_RSSI - rssi_dbm));
3443 	if (bbp17 < sc->bbp17_2ghz_min)
3444 		bbp17 = sc->bbp17_2ghz_min;
3445 
3446 	if (sc->bbp17 > bbp17) {
3447 		rt2661_bbp_write(sc, 17, bbp17);
3448 		return;
3449 	}
3450 
3451 	DPRINTF(sc, ("calibrate according to false CCA\n"));
3452 
3453 	if (false_cca > 512 && sc->bbp17 > sc->bbp17_2ghz_min)
3454 		rt2661_bbp_write(sc, 17, sc->bbp17 - 1);
3455 	else if (false_cca < 100 && sc->bbp17 < bbp17)
3456 		rt2661_bbp_write(sc, 17, sc->bbp17 + 1);
3457 
3458 #undef MIDRANGE_RSSI
3459 }
3460 
3461 static void
3462 rt2661_calibrate(void *xsc)
3463 {
3464 	struct rt2661_softc *sc = xsc;
3465 	struct ifnet *ifp = &sc->sc_ic.ic_if;
3466 	uint32_t false_cca;
3467 
3468 	lwkt_serialize_enter(ifp->if_serializer);
3469 
3470 	false_cca = (RAL_READ(sc, RT2661_STA_CSR1) >> 16);
3471 	DPRINTF(sc, ("false cca %u\n", false_cca));
3472 
3473 	if (sc->sc_calib_rxsns)
3474 		rt2661_calib_rxsensibility(sc, false_cca);
3475 
3476 	if (sc->sc_calib_txpwr)
3477 		rt2661_calib_txpower(sc);
3478 
3479 	callout_reset(&sc->calib_ch, hz, rt2661_calibrate, sc);
3480 
3481 	lwkt_serialize_exit(ifp->if_serializer);
3482 }
3483