xref: /dragonfly/sys/dev/netif/ral/rt2661.c (revision fcce2b94)
1 /*
2  * Copyright (c) 2006
3  *	Damien Bergamini <damien.bergamini@free.fr>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $FreeBSD: src/sys/dev/ral/rt2661.c,v 1.4 2006/03/21 21:15:43 damien Exp $
18  * $DragonFly: src/sys/dev/netif/ral/rt2661.c,v 1.1 2006/05/20 09:13:09 sephe Exp $
19  */
20 
21 /*
22  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
23  * http://www.ralinktech.com/
24  */
25 
26 #include <sys/param.h>
27 #include <sys/sysctl.h>
28 #include <sys/sockio.h>
29 #include <sys/mbuf.h>
30 #include <sys/kernel.h>
31 #include <sys/socket.h>
32 #include <sys/systm.h>
33 #include <sys/malloc.h>
34 #include <sys/module.h>
35 #include <sys/bus.h>
36 #include <sys/endian.h>
37 
38 #include <machine/bus.h>
39 #include <machine/resource.h>
40 #include <machine/clock.h>
41 #include <sys/rman.h>
42 
43 #include <net/bpf.h>
44 #include <net/if.h>
45 #include <net/if_arp.h>
46 #include <net/ethernet.h>
47 #include <net/if_dl.h>
48 #include <net/if_media.h>
49 #include <net/if_types.h>
50 #include <net/ifq_var.h>
51 
52 #include <netproto/802_11/ieee80211_var.h>
53 #include <netproto/802_11/ieee80211_radiotap.h>
54 
55 #include <netinet/in.h>
56 #include <netinet/in_systm.h>
57 #include <netinet/in_var.h>
58 #include <netinet/ip.h>
59 #include <netinet/if_ether.h>
60 
61 #include <dev/netif/ral/if_ralrate.h>
62 #include <dev/netif/ral/rt2661reg.h>
63 #include <dev/netif/ral/rt2661var.h>
64 #include <dev/netif/ral/rt2661_ucode.h>
65 
66 #ifdef RAL_DEBUG
67 #define DPRINTF(x)	do { if (ral_debug > 0) printf x; } while (0)
68 #define DPRINTFN(n, x)	do { if (ral_debug >= (n)) printf x; } while (0)
69 int ral_debug = 0;
70 SYSCTL_INT(_debug, OID_AUTO, ral, CTLFLAG_RW, &ral_debug, 0, "ral debug level");
71 #else
72 #define DPRINTF(x)
73 #define DPRINTFN(n, x)
74 #endif
75 
76 static void		rt2661_dma_map_addr(void *, bus_dma_segment_t *, int,
77 			    int);
78 static void		rt2661_dma_map_mbuf(void *, bus_dma_segment_t *, int,
79 					    bus_size_t, int);
80 static int		rt2661_alloc_tx_ring(struct rt2661_softc *,
81 			    struct rt2661_tx_ring *, int);
82 static void		rt2661_reset_tx_ring(struct rt2661_softc *,
83 			    struct rt2661_tx_ring *);
84 static void		rt2661_free_tx_ring(struct rt2661_softc *,
85 			    struct rt2661_tx_ring *);
86 static int		rt2661_alloc_rx_ring(struct rt2661_softc *,
87 			    struct rt2661_rx_ring *, int);
88 static void		rt2661_reset_rx_ring(struct rt2661_softc *,
89 			    struct rt2661_rx_ring *);
90 static void		rt2661_free_rx_ring(struct rt2661_softc *,
91 			    struct rt2661_rx_ring *);
92 static struct		ieee80211_node *rt2661_node_alloc(
93 			    struct ieee80211_node_table *);
94 static int		rt2661_media_change(struct ifnet *);
95 static void		rt2661_next_scan(void *);
96 static int		rt2661_newstate(struct ieee80211com *,
97 			    enum ieee80211_state, int);
98 static uint16_t		rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
99 static void		rt2661_rx_intr(struct rt2661_softc *);
100 static void		rt2661_tx_intr(struct rt2661_softc *);
101 static void		rt2661_tx_dma_intr(struct rt2661_softc *,
102 			    struct rt2661_tx_ring *);
103 static void		rt2661_mcu_beacon_expire(struct rt2661_softc *);
104 static void		rt2661_mcu_wakeup(struct rt2661_softc *);
105 static void		rt2661_mcu_cmd_intr(struct rt2661_softc *);
106 static int		rt2661_ack_rate(struct ieee80211com *, int);
107 static uint16_t		rt2661_txtime(int, int, uint32_t);
108 static uint8_t		rt2661_rxrate(struct rt2661_rx_desc *);
109 static uint8_t		rt2661_plcp_signal(int);
110 static void		rt2661_setup_tx_desc(struct rt2661_softc *,
111 			    struct rt2661_tx_desc *, uint32_t, uint16_t, int,
112 			    int, const bus_dma_segment_t *, int, int);
113 static struct mbuf *	rt2661_get_rts(struct rt2661_softc *,
114 			    struct ieee80211_frame *, uint16_t);
115 static int		rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
116 			    struct ieee80211_node *, int);
117 static int		rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
118 			    struct ieee80211_node *);
119 static void		rt2661_start(struct ifnet *);
120 static void		rt2661_watchdog(struct ifnet *);
121 static int		rt2661_reset(struct ifnet *);
122 static int		rt2661_ioctl(struct ifnet *, u_long, caddr_t,
123 				     struct ucred *);
124 static void		rt2661_bbp_write(struct rt2661_softc *, uint8_t,
125 			    uint8_t);
126 static uint8_t		rt2661_bbp_read(struct rt2661_softc *, uint8_t);
127 static void		rt2661_rf_write(struct rt2661_softc *, uint8_t,
128 			    uint32_t);
129 static int		rt2661_tx_cmd(struct rt2661_softc *, uint8_t,
130 			    uint16_t);
131 static void		rt2661_select_antenna(struct rt2661_softc *);
132 static void		rt2661_enable_mrr(struct rt2661_softc *);
133 static void		rt2661_set_txpreamble(struct rt2661_softc *);
134 static void		rt2661_set_basicrates(struct rt2661_softc *,
135 			    const struct ieee80211_rateset *);
136 static void		rt2661_select_band(struct rt2661_softc *,
137 			    struct ieee80211_channel *);
138 static void		rt2661_set_chan(struct rt2661_softc *,
139 			    struct ieee80211_channel *);
140 static void		rt2661_set_bssid(struct rt2661_softc *,
141 			    const uint8_t *);
142 static void		rt2661_set_macaddr(struct rt2661_softc *,
143 			   const uint8_t *);
144 static void		rt2661_update_promisc(struct rt2661_softc *);
145 static int		rt2661_wme_update(struct ieee80211com *) __unused;
146 static void		rt2661_update_slot(struct ifnet *);
147 static const char	*rt2661_get_rf(int);
148 static void		rt2661_read_eeprom(struct rt2661_softc *);
149 static int		rt2661_bbp_init(struct rt2661_softc *);
150 static void		rt2661_init(void *);
151 static void		rt2661_stop(void *);
152 static void		rt2661_intr(void *);
153 static int		rt2661_load_microcode(struct rt2661_softc *,
154 			    const uint8_t *, int);
155 #ifdef notyet
156 static void		rt2661_rx_tune(struct rt2661_softc *);
157 static void		rt2661_radar_start(struct rt2661_softc *);
158 static int		rt2661_radar_stop(struct rt2661_softc *);
159 #endif
160 static int		rt2661_prepare_beacon(struct rt2661_softc *);
161 static void		rt2661_enable_tsf_sync(struct rt2661_softc *);
162 static int		rt2661_get_rssi(struct rt2661_softc *, uint8_t);
163 
164 /*
165  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
166  */
167 static const struct ieee80211_rateset rt2661_rateset_11a =
168 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
169 
170 static const struct ieee80211_rateset rt2661_rateset_11b =
171 	{ 4, { 2, 4, 11, 22 } };
172 
173 static const struct ieee80211_rateset rt2661_rateset_11g =
174 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
175 
176 static const struct {
177 	uint32_t	reg;
178 	uint32_t	val;
179 } rt2661_def_mac[] = {
180 	RT2661_DEF_MAC
181 };
182 
183 static const struct {
184 	uint8_t	reg;
185 	uint8_t	val;
186 } rt2661_def_bbp[] = {
187 	RT2661_DEF_BBP
188 };
189 
190 static const struct rfprog {
191 	uint8_t		chan;
192 	uint32_t	r1, r2, r3, r4;
193 }  rt2661_rf5225_1[] = {
194 	RT2661_RF5225_1
195 }, rt2661_rf5225_2[] = {
196 	RT2661_RF5225_2
197 };
198 
199 struct rt2661_dmamap {
200 	bus_dma_segment_t	segs[RT2661_MAX_SCATTER];
201 	int			nseg;
202 };
203 
204 int
205 rt2661_attach(device_t dev, int id)
206 {
207 	struct rt2661_softc *sc = device_get_softc(dev);
208 	struct ieee80211com *ic = &sc->sc_ic;
209 	struct ifnet *ifp = &ic->ic_if;
210 	uint32_t val;
211 	const uint8_t *ucode = NULL;
212 	int error, i, ac, ntries, size = 0;
213 
214 	callout_init(&sc->scan_ch);
215 	callout_init(&sc->rssadapt_ch);
216 
217 	sc->sc_irq_rid = 0;
218 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->sc_irq_rid,
219 					    RF_ACTIVE | RF_SHAREABLE);
220 	if (sc->sc_irq == NULL) {
221 		device_printf(dev, "could not allocate interrupt resource\n");
222 		return ENXIO;
223 	}
224 
225 	/* wait for NIC to initialize */
226 	for (ntries = 0; ntries < 1000; ntries++) {
227 		if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
228 			break;
229 		DELAY(1000);
230 	}
231 	if (ntries == 1000) {
232 		device_printf(sc->sc_dev,
233 		    "timeout waiting for NIC to initialize\n");
234 		error = EIO;
235 		goto fail;
236 	}
237 
238 	/* retrieve RF rev. no and various other things from EEPROM */
239 	rt2661_read_eeprom(sc);
240 
241 	device_printf(dev, "MAC/BBP RT%X, RF %s\n", val,
242 	    rt2661_get_rf(sc->rf_rev));
243 
244 	/*
245 	 * Load 8051 microcode into NIC.
246 	 */
247 	switch (id) {
248 	case 0x0301:
249 		ucode = rt2561s_ucode;
250 		size = sizeof rt2561s_ucode;
251 		break;
252 	case 0x0302:
253 		ucode = rt2561_ucode;
254 		size = sizeof rt2561_ucode;
255 		break;
256 	case 0x0401:
257 		ucode = rt2661_ucode;
258 		size = sizeof rt2661_ucode;
259 		break;
260 	}
261 
262 	error = rt2661_load_microcode(sc, ucode, size);
263 	if (error != 0) {
264 		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
265 		goto fail;
266 	}
267 
268 	/*
269 	 * Allocate Tx and Rx rings.
270 	 */
271 	for (ac = 0; ac < 4; ac++) {
272 		error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
273 		    RT2661_TX_RING_COUNT);
274 		if (error != 0) {
275 			device_printf(sc->sc_dev,
276 			    "could not allocate Tx ring %d\n", ac);
277 			goto fail;
278 		}
279 	}
280 
281 	error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
282 	if (error != 0) {
283 		device_printf(sc->sc_dev, "could not allocate Mgt ring\n");
284 		goto fail;
285 	}
286 
287 	error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
288 	if (error != 0) {
289 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
290 		goto fail;
291 	}
292 
293 	sysctl_ctx_init(&sc->sysctl_ctx);
294 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
295 					  SYSCTL_STATIC_CHILDREN(_hw),
296 					  OID_AUTO,
297 					  device_get_nameunit(dev),
298 					  CTLFLAG_RD, 0, "");
299 	if (sc->sysctl_tree == NULL) {
300 		device_printf(dev, "could not add sysctl node\n");
301 		error = ENXIO;
302 		goto fail;
303 	}
304 
305 	ifp->if_softc = sc;
306 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
307 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
308 	ifp->if_init = rt2661_init;
309 	ifp->if_ioctl = rt2661_ioctl;
310 	ifp->if_start = rt2661_start;
311 	ifp->if_watchdog = rt2661_watchdog;
312 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
313 	ifq_set_ready(&ifp->if_snd);
314 
315 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
316 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
317 	ic->ic_state = IEEE80211_S_INIT;
318 
319 	/* set device capabilities */
320 	ic->ic_caps =
321 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
322 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
323 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
324 	    IEEE80211_C_TXPMGT |	/* tx power management */
325 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
326 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
327 #ifdef notyet
328 	    IEEE80211_C_WME |		/* 802.11e */
329 #endif
330 	    IEEE80211_C_WEP |		/* WEP */
331 	    IEEE80211_C_WPA;		/* 802.11i */
332 
333 	if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
334 		/* set supported .11a rates */
335 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2661_rateset_11a;
336 
337 		/* set supported .11a channels */
338 		for (i = 36; i <= 64; i += 4) {
339 			ic->ic_channels[i].ic_freq =
340 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
341 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
342 		}
343 		for (i = 100; i <= 140; i += 4) {
344 			ic->ic_channels[i].ic_freq =
345 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
346 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
347 		}
348 		for (i = 149; i <= 165; i += 4) {
349 			ic->ic_channels[i].ic_freq =
350 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
351 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
352 		}
353 	}
354 
355 	/* set supported .11b and .11g rates */
356 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2661_rateset_11b;
357 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2661_rateset_11g;
358 
359 	/* set supported .11b and .11g channels (1 through 14) */
360 	for (i = 1; i <= 14; i++) {
361 		ic->ic_channels[i].ic_freq =
362 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
363 		ic->ic_channels[i].ic_flags =
364 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
365 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
366 	}
367 
368 	ieee80211_ifattach(ic);
369 	ic->ic_node_alloc = rt2661_node_alloc;
370 /*	ic->ic_wme.wme_update = rt2661_wme_update;*/
371 	ic->ic_updateslot = rt2661_update_slot;
372 	ic->ic_reset = rt2661_reset;
373 	/* enable s/w bmiss handling in sta mode */
374 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
375 
376 	/* override state transition machine */
377 	sc->sc_newstate = ic->ic_newstate;
378 	ic->ic_newstate = rt2661_newstate;
379 	ieee80211_media_init(ic, rt2661_media_change, ieee80211_media_status);
380 
381 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
382 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
383 
384 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
385 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
386 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2661_RX_RADIOTAP_PRESENT);
387 
388 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
389 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
390 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2661_TX_RADIOTAP_PRESENT);
391 
392 	/*
393 	 * Add a few sysctl knobs.
394 	 */
395 	sc->dwelltime = 200;
396 
397 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
398 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "dwell",
399 	    CTLFLAG_RW, &sc->dwelltime, 0,
400 	    "channel dwell time (ms) for AP/station scanning");
401 
402 	error = bus_setup_intr(dev, sc->sc_irq, INTR_MPSAFE, rt2661_intr,
403 			       sc, &sc->sc_ih, ifp->if_serializer);
404 	if (error != 0) {
405 		device_printf(dev, "could not set up interrupt\n");
406 		bpfdetach(ifp);
407 		ieee80211_ifdetach(ic);
408 		goto fail;
409 	}
410 
411 	if (bootverbose)
412 		ieee80211_announce(ic);
413 	return 0;
414 fail:
415 	rt2661_detach(sc);
416 	return error;
417 }
418 
419 int
420 rt2661_detach(void *xsc)
421 {
422 	struct rt2661_softc *sc = xsc;
423 	struct ieee80211com *ic = &sc->sc_ic;
424 	struct ifnet *ifp = &ic->ic_if;
425 
426 	if (device_is_attached(sc->sc_dev)) {
427 		lwkt_serialize_enter(ifp->if_serializer);
428 
429 		callout_stop(&sc->scan_ch);
430 		callout_stop(&sc->rssadapt_ch);
431 		rt2661_stop(sc);
432 		bus_teardown_intr(sc->sc_dev, sc->sc_irq, sc->sc_ih);
433 
434 		lwkt_serialize_exit(ifp->if_serializer);
435 
436 		bpfdetach(ifp);
437 		ieee80211_ifdetach(ic);
438 	}
439 
440 	rt2661_free_tx_ring(sc, &sc->txq[0]);
441 	rt2661_free_tx_ring(sc, &sc->txq[1]);
442 	rt2661_free_tx_ring(sc, &sc->txq[2]);
443 	rt2661_free_tx_ring(sc, &sc->txq[3]);
444 	rt2661_free_tx_ring(sc, &sc->mgtq);
445 	rt2661_free_rx_ring(sc, &sc->rxq);
446 
447 	if (sc->sc_irq != NULL) {
448 		bus_release_resource(sc->sc_dev, SYS_RES_IRQ, sc->sc_irq_rid,
449 				     sc->sc_irq);
450 	}
451 
452 	if (sc->sysctl_tree != NULL)
453 		sysctl_ctx_free(&sc->sysctl_ctx);
454 
455 	return 0;
456 }
457 
458 void
459 rt2661_shutdown(void *xsc)
460 {
461 	struct rt2661_softc *sc = xsc;
462 	struct ifnet *ifp = &sc->sc_ic.ic_if;
463 
464 	lwkt_serialize_enter(ifp->if_serializer);
465 	rt2661_stop(sc);
466 	lwkt_serialize_exit(ifp->if_serializer);
467 }
468 
469 void
470 rt2661_suspend(void *xsc)
471 {
472 	struct rt2661_softc *sc = xsc;
473 	struct ifnet *ifp = &sc->sc_ic.ic_if;
474 
475 	lwkt_serialize_enter(ifp->if_serializer);
476 	rt2661_stop(sc);
477 	lwkt_serialize_exit(ifp->if_serializer);
478 }
479 
480 void
481 rt2661_resume(void *xsc)
482 {
483 	struct rt2661_softc *sc = xsc;
484 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
485 
486 	lwkt_serialize_enter(ifp->if_serializer);
487 	if (ifp->if_flags & IFF_UP) {
488 		ifp->if_init(ifp->if_softc);
489 		if (ifp->if_flags & IFF_RUNNING)
490 			ifp->if_start(ifp);
491 	}
492 	lwkt_serialize_exit(ifp->if_serializer);
493 }
494 
495 static void
496 rt2661_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
497 {
498 	if (error != 0)
499 		return;
500 
501 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
502 
503 	*(bus_addr_t *)arg = segs[0].ds_addr;
504 }
505 
506 static int
507 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
508     int count)
509 {
510 	int i, error;
511 
512 	ring->count = count;
513 	ring->queued = 0;
514 	ring->cur = ring->next = ring->stat = 0;
515 
516 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
517 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2661_TX_DESC_SIZE, 1,
518 	    count * RT2661_TX_DESC_SIZE, 0, &ring->desc_dmat);
519 	if (error != 0) {
520 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
521 		goto fail;
522 	}
523 
524 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
525 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
526 	if (error != 0) {
527 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
528 		goto fail;
529 	}
530 
531 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
532 	    count * RT2661_TX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
533 	    0);
534 	if (error != 0) {
535 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
536 
537 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
538 		ring->desc = NULL;
539 		goto fail;
540 	}
541 
542 	ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
543 	    M_WAITOK | M_ZERO);
544 
545 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
546 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, RT2661_MAX_SCATTER,
547 	    MCLBYTES, 0, &ring->data_dmat);
548 	if (error != 0) {
549 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
550 		goto fail;
551 	}
552 
553 	for (i = 0; i < count; i++) {
554 		error = bus_dmamap_create(ring->data_dmat, 0,
555 		    &ring->data[i].map);
556 		if (error != 0) {
557 			device_printf(sc->sc_dev, "could not create DMA map\n");
558 			goto fail;
559 		}
560 	}
561 	return 0;
562 
563 fail:	rt2661_free_tx_ring(sc, ring);
564 	return error;
565 }
566 
567 static void
568 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
569 {
570 	struct rt2661_tx_desc *desc;
571 	struct rt2661_tx_data *data;
572 	int i;
573 
574 	for (i = 0; i < ring->count; i++) {
575 		desc = &ring->desc[i];
576 		data = &ring->data[i];
577 
578 		if (data->m != NULL) {
579 			bus_dmamap_sync(ring->data_dmat, data->map,
580 			    BUS_DMASYNC_POSTWRITE);
581 			bus_dmamap_unload(ring->data_dmat, data->map);
582 			m_freem(data->m);
583 			data->m = NULL;
584 		}
585 
586 		if (data->ni != NULL) {
587 			ieee80211_free_node(data->ni);
588 			data->ni = NULL;
589 		}
590 
591 		desc->flags = 0;
592 	}
593 
594 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
595 
596 	ring->queued = 0;
597 	ring->cur = ring->next = ring->stat = 0;
598 }
599 
600 static void
601 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
602 {
603 	struct rt2661_tx_data *data;
604 	int i;
605 
606 	if (ring->desc != NULL) {
607 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
608 		    BUS_DMASYNC_POSTWRITE);
609 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
610 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
611 		ring->desc = NULL;
612 	}
613 
614 	if (ring->desc_dmat != NULL) {
615 		bus_dma_tag_destroy(ring->desc_dmat);
616 		ring->desc_dmat = NULL;
617 	}
618 
619 	if (ring->data != NULL) {
620 		for (i = 0; i < ring->count; i++) {
621 			data = &ring->data[i];
622 
623 			if (data->m != NULL) {
624 				bus_dmamap_sync(ring->data_dmat, data->map,
625 				    BUS_DMASYNC_POSTWRITE);
626 				bus_dmamap_unload(ring->data_dmat, data->map);
627 				m_freem(data->m);
628 				data->m = NULL;
629 			}
630 
631 			if (data->ni != NULL) {
632 				ieee80211_free_node(data->ni);
633 				data->ni = NULL;
634 			}
635 
636 			if (data->map != NULL) {
637 				bus_dmamap_destroy(ring->data_dmat, data->map);
638 				data->map = NULL;
639 			}
640 		}
641 
642 		free(ring->data, M_DEVBUF);
643 		ring->data = NULL;
644 	}
645 
646 	if (ring->data_dmat != NULL) {
647 		bus_dma_tag_destroy(ring->data_dmat);
648 		ring->data_dmat = NULL;
649 	}
650 }
651 
652 static int
653 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
654     int count)
655 {
656 	struct rt2661_rx_desc *desc;
657 	struct rt2661_rx_data *data;
658 	bus_addr_t physaddr;
659 	int i, error;
660 
661 	ring->count = count;
662 	ring->cur = ring->next = 0;
663 
664 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
665 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2661_RX_DESC_SIZE, 1,
666 	    count * RT2661_RX_DESC_SIZE, 0, &ring->desc_dmat);
667 	if (error != 0) {
668 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
669 		goto fail;
670 	}
671 
672 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
673 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
674 	if (error != 0) {
675 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
676 		goto fail;
677 	}
678 
679 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
680 	    count * RT2661_RX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
681 	    0);
682 	if (error != 0) {
683 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
684 
685 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
686 		ring->desc = NULL;
687 		goto fail;
688 	}
689 
690 	ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
691 	    M_WAITOK | M_ZERO);
692 
693 	/*
694 	 * Pre-allocate Rx buffers and populate Rx ring.
695 	 */
696 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
697 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0,
698 	    &ring->data_dmat);
699 	if (error != 0) {
700 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
701 		goto fail;
702 	}
703 
704 	for (i = 0; i < count; i++) {
705 		desc = &sc->rxq.desc[i];
706 		data = &sc->rxq.data[i];
707 
708 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
709 		if (error != 0) {
710 			device_printf(sc->sc_dev, "could not create DMA map\n");
711 			goto fail;
712 		}
713 
714 		data->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
715 		if (data->m == NULL) {
716 			device_printf(sc->sc_dev,
717 			    "could not allocate rx mbuf\n");
718 			error = ENOMEM;
719 			goto fail;
720 		}
721 
722 		error = bus_dmamap_load(ring->data_dmat, data->map,
723 		    mtod(data->m, void *), MCLBYTES, rt2661_dma_map_addr,
724 		    &physaddr, 0);
725 		if (error != 0) {
726 			device_printf(sc->sc_dev,
727 			    "could not load rx buf DMA map");
728 
729 			m_freem(data->m);
730 			data->m = NULL;
731 			goto fail;
732 		}
733 
734 		desc->flags = htole32(RT2661_RX_BUSY);
735 		desc->physaddr = htole32(physaddr);
736 	}
737 
738 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
739 
740 	return 0;
741 
742 fail:	rt2661_free_rx_ring(sc, ring);
743 	return error;
744 }
745 
746 static void
747 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
748 {
749 	int i;
750 
751 	for (i = 0; i < ring->count; i++)
752 		ring->desc[i].flags = htole32(RT2661_RX_BUSY);
753 
754 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
755 
756 	ring->cur = ring->next = 0;
757 }
758 
759 static void
760 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
761 {
762 	struct rt2661_rx_data *data;
763 	int i;
764 
765 	if (ring->desc != NULL) {
766 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
767 		    BUS_DMASYNC_POSTWRITE);
768 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
769 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
770 		ring->desc = NULL;
771 	}
772 
773 	if (ring->desc_dmat != NULL) {
774 		bus_dma_tag_destroy(ring->desc_dmat);
775 		ring->desc_dmat = NULL;
776 	}
777 
778 	if (ring->data != NULL) {
779 		for (i = 0; i < ring->count; i++) {
780 			data = &ring->data[i];
781 
782 			if (data->m != NULL) {
783 				bus_dmamap_sync(ring->data_dmat, data->map,
784 				    BUS_DMASYNC_POSTREAD);
785 				bus_dmamap_unload(ring->data_dmat, data->map);
786 				m_freem(data->m);
787 				data->m = NULL;
788 			}
789 
790 			if (data->map != NULL) {
791 				bus_dmamap_destroy(ring->data_dmat, data->map);
792 				data->map = NULL;
793 			}
794 		}
795 
796 		free(ring->data, M_DEVBUF);
797 		ring->data = NULL;
798 	}
799 
800 	if (ring->data_dmat != NULL) {
801 		bus_dma_tag_destroy(ring->data_dmat);
802 		ring->data_dmat = NULL;
803 	}
804 }
805 
806 static struct ieee80211_node *
807 rt2661_node_alloc(struct ieee80211_node_table *nt)
808 {
809 	struct rt2661_node *rn;
810 
811 	rn = malloc(sizeof (struct rt2661_node), M_80211_NODE,
812 	    M_NOWAIT | M_ZERO);
813 
814 	return (rn != NULL) ? &rn->ni : NULL;
815 }
816 
817 static int
818 rt2661_media_change(struct ifnet *ifp)
819 {
820 	struct rt2661_softc *sc = ifp->if_softc;
821 	int error;
822 
823 	error = ieee80211_media_change(ifp);
824 	if (error != ENETRESET)
825 		return error;
826 
827 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
828 		rt2661_init(sc);
829 	return 0;
830 }
831 
832 /*
833  * This function is called periodically (every 200ms) during scanning to
834  * switch from one channel to another.
835  */
836 static void
837 rt2661_next_scan(void *arg)
838 {
839 	struct rt2661_softc *sc = arg;
840 	struct ieee80211com *ic = &sc->sc_ic;
841 	struct ifnet *ifp = &ic->ic_if;
842 
843 	lwkt_serialize_enter(ifp->if_serializer);
844 	if (ic->ic_state == IEEE80211_S_SCAN)
845 		ieee80211_next_scan(ic);
846 	lwkt_serialize_exit(ifp->if_serializer);
847 }
848 
849 /*
850  * This function is called for each node present in the node station table.
851  */
852 static void
853 rt2661_iter_func(void *arg, struct ieee80211_node *ni)
854 {
855 	struct rt2661_node *rn = (struct rt2661_node *)ni;
856 
857 	ral_rssadapt_updatestats(&rn->rssadapt);
858 }
859 
860 /*
861  * This function is called periodically (every 100ms) in RUN state to update
862  * the rate adaptation statistics.
863  */
864 static void
865 rt2661_update_rssadapt(void *arg)
866 {
867 	struct rt2661_softc *sc = arg;
868 	struct ieee80211com *ic = &sc->sc_ic;
869 	struct ifnet *ifp = &ic->ic_if;
870 
871 	lwkt_serialize_enter(ifp->if_serializer);
872 
873 	ieee80211_iterate_nodes(&ic->ic_sta, rt2661_iter_func, arg);
874 	callout_reset(&sc->rssadapt_ch, hz / 10, rt2661_update_rssadapt, sc);
875 
876 	lwkt_serialize_exit(ifp->if_serializer);
877 }
878 
879 static int
880 rt2661_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
881 {
882 	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
883 	enum ieee80211_state ostate;
884 	struct ieee80211_node *ni;
885 	uint32_t tmp;
886 	int error = 0;
887 
888 	ostate = ic->ic_state;
889 	callout_stop(&sc->scan_ch);
890 
891 	switch (nstate) {
892 	case IEEE80211_S_INIT:
893 		callout_stop(&sc->rssadapt_ch);
894 
895 		if (ostate == IEEE80211_S_RUN) {
896 			/* abort TSF synchronization */
897 			tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
898 			RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
899 		}
900 		break;
901 
902 	case IEEE80211_S_SCAN:
903 		rt2661_set_chan(sc, ic->ic_curchan);
904 		callout_reset(&sc->scan_ch, (sc->dwelltime * hz) / 1000,
905 		    rt2661_next_scan, sc);
906 		break;
907 
908 	case IEEE80211_S_AUTH:
909 	case IEEE80211_S_ASSOC:
910 		rt2661_set_chan(sc, ic->ic_curchan);
911 		break;
912 
913 	case IEEE80211_S_RUN:
914 		rt2661_set_chan(sc, ic->ic_curchan);
915 
916 		ni = ic->ic_bss;
917 
918 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
919 			rt2661_enable_mrr(sc);
920 			rt2661_set_txpreamble(sc);
921 			rt2661_set_basicrates(sc, &ni->ni_rates);
922 			rt2661_set_bssid(sc, ni->ni_bssid);
923 		}
924 
925 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
926 		    ic->ic_opmode == IEEE80211_M_IBSS) {
927 			if ((error = rt2661_prepare_beacon(sc)) != 0)
928 				break;
929 		}
930 
931 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
932 			callout_reset(&sc->rssadapt_ch, hz / 10,
933 			    rt2661_update_rssadapt, sc);
934 			rt2661_enable_tsf_sync(sc);
935 		}
936 		break;
937 	}
938 
939 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
940 }
941 
942 /*
943  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
944  * 93C66).
945  */
946 static uint16_t
947 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
948 {
949 	uint32_t tmp;
950 	uint16_t val;
951 	int n;
952 
953 	/* clock C once before the first command */
954 	RT2661_EEPROM_CTL(sc, 0);
955 
956 	RT2661_EEPROM_CTL(sc, RT2661_S);
957 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
958 	RT2661_EEPROM_CTL(sc, RT2661_S);
959 
960 	/* write start bit (1) */
961 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
962 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
963 
964 	/* write READ opcode (10) */
965 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
966 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
967 	RT2661_EEPROM_CTL(sc, RT2661_S);
968 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
969 
970 	/* write address (A5-A0 or A7-A0) */
971 	n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
972 	for (; n >= 0; n--) {
973 		RT2661_EEPROM_CTL(sc, RT2661_S |
974 		    (((addr >> n) & 1) << RT2661_SHIFT_D));
975 		RT2661_EEPROM_CTL(sc, RT2661_S |
976 		    (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
977 	}
978 
979 	RT2661_EEPROM_CTL(sc, RT2661_S);
980 
981 	/* read data Q15-Q0 */
982 	val = 0;
983 	for (n = 15; n >= 0; n--) {
984 		RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
985 		tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
986 		val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
987 		RT2661_EEPROM_CTL(sc, RT2661_S);
988 	}
989 
990 	RT2661_EEPROM_CTL(sc, 0);
991 
992 	/* clear Chip Select and clock C */
993 	RT2661_EEPROM_CTL(sc, RT2661_S);
994 	RT2661_EEPROM_CTL(sc, 0);
995 	RT2661_EEPROM_CTL(sc, RT2661_C);
996 
997 	return val;
998 }
999 
1000 static void
1001 rt2661_tx_intr(struct rt2661_softc *sc)
1002 {
1003 	struct ieee80211com *ic = &sc->sc_ic;
1004 	struct ifnet *ifp = ic->ic_ifp;
1005 	struct rt2661_tx_ring *txq;
1006 	struct rt2661_tx_data *data;
1007 	struct rt2661_node *rn;
1008 	uint32_t val;
1009 	int qid, retrycnt;
1010 
1011 	for (;;) {
1012 		val = RAL_READ(sc, RT2661_STA_CSR4);
1013 		if (!(val & RT2661_TX_STAT_VALID))
1014 			break;
1015 
1016 		/* retrieve the queue in which this frame was sent */
1017 		qid = RT2661_TX_QID(val);
1018 		txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
1019 
1020 		/* retrieve rate control algorithm context */
1021 		data = &txq->data[txq->stat];
1022 		rn = (struct rt2661_node *)data->ni;
1023 
1024 		switch (RT2661_TX_RESULT(val)) {
1025 		case RT2661_TX_SUCCESS:
1026 			retrycnt = RT2661_TX_RETRYCNT(val);
1027 
1028 			DPRINTFN(10, ("data frame sent successfully after "
1029 			    "%d retries\n", retrycnt));
1030 			if (retrycnt == 0 && data->id.id_node != NULL) {
1031 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1032 				    &data->id);
1033 			}
1034 			ifp->if_opackets++;
1035 			break;
1036 
1037 		case RT2661_TX_RETRY_FAIL:
1038 			DPRINTFN(9, ("sending data frame failed (too much "
1039 			    "retries)\n"));
1040 			if (data->id.id_node != NULL) {
1041 				ral_rssadapt_lower_rate(ic, data->ni,
1042 				    &rn->rssadapt, &data->id);
1043 			}
1044 			ifp->if_oerrors++;
1045 			break;
1046 
1047 		default:
1048 			/* other failure */
1049 			device_printf(sc->sc_dev,
1050 			    "sending data frame failed 0x%08x\n", val);
1051 			ifp->if_oerrors++;
1052 		}
1053 
1054 		ieee80211_free_node(data->ni);
1055 		data->ni = NULL;
1056 
1057 		DPRINTFN(15, ("tx done q=%d idx=%u\n", qid, txq->stat));
1058 
1059 		txq->queued--;
1060 		if (++txq->stat >= txq->count)	/* faster than % count */
1061 			txq->stat = 0;
1062 	}
1063 
1064 	sc->sc_tx_timer = 0;
1065 	ifp->if_flags &= ~IFF_OACTIVE;
1066 	rt2661_start(ifp);
1067 }
1068 
1069 static void
1070 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
1071 {
1072 	struct rt2661_tx_desc *desc;
1073 	struct rt2661_tx_data *data;
1074 
1075 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_POSTREAD);
1076 
1077 	for (;;) {
1078 		desc = &txq->desc[txq->next];
1079 		data = &txq->data[txq->next];
1080 
1081 		if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
1082 		    !(le32toh(desc->flags) & RT2661_TX_VALID))
1083 			break;
1084 
1085 		bus_dmamap_sync(txq->data_dmat, data->map,
1086 		    BUS_DMASYNC_POSTWRITE);
1087 		bus_dmamap_unload(txq->data_dmat, data->map);
1088 		m_freem(data->m);
1089 		data->m = NULL;
1090 		/* node reference is released in rt2661_tx_intr() */
1091 
1092 		/* descriptor is no longer valid */
1093 		desc->flags &= ~htole32(RT2661_TX_VALID);
1094 
1095 		DPRINTFN(15, ("tx dma done q=%p idx=%u\n", txq, txq->next));
1096 
1097 		if (++txq->next >= txq->count)	/* faster than % count */
1098 			txq->next = 0;
1099 	}
1100 
1101 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1102 }
1103 
1104 static void
1105 rt2661_rx_intr(struct rt2661_softc *sc)
1106 {
1107 	struct ieee80211com *ic = &sc->sc_ic;
1108 	struct ifnet *ifp = ic->ic_ifp;
1109 	struct rt2661_rx_desc *desc;
1110 	struct rt2661_rx_data *data;
1111 	bus_addr_t physaddr;
1112 	struct ieee80211_frame *wh;
1113 	struct ieee80211_node *ni;
1114 	struct rt2661_node *rn;
1115 	struct mbuf *mnew, *m;
1116 	int error;
1117 
1118 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1119 	    BUS_DMASYNC_POSTREAD);
1120 
1121 	for (;;) {
1122 		desc = &sc->rxq.desc[sc->rxq.cur];
1123 		data = &sc->rxq.data[sc->rxq.cur];
1124 
1125 		if (le32toh(desc->flags) & RT2661_RX_BUSY)
1126 			break;
1127 
1128 		if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
1129 		    (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
1130 			/*
1131 			 * This should not happen since we did not request
1132 			 * to receive those frames when we filled TXRX_CSR0.
1133 			 */
1134 			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1135 			    le32toh(desc->flags)));
1136 			ifp->if_ierrors++;
1137 			goto skip;
1138 		}
1139 
1140 		if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
1141 			ifp->if_ierrors++;
1142 			goto skip;
1143 		}
1144 
1145 		/*
1146 		 * Try to allocate a new mbuf for this ring element and load it
1147 		 * before processing the current mbuf. If the ring element
1148 		 * cannot be loaded, drop the received packet and reuse the old
1149 		 * mbuf. In the unlikely case that the old mbuf can't be
1150 		 * reloaded either, explicitly panic.
1151 		 */
1152 		mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1153 		if (mnew == NULL) {
1154 			ifp->if_ierrors++;
1155 			goto skip;
1156 		}
1157 
1158 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1159 		    BUS_DMASYNC_POSTREAD);
1160 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1161 
1162 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1163 		    mtod(mnew, void *), MCLBYTES, rt2661_dma_map_addr,
1164 		    &physaddr, 0);
1165 		if (error != 0) {
1166 			m_freem(mnew);
1167 
1168 			/* try to reload the old mbuf */
1169 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1170 			    mtod(data->m, void *), MCLBYTES,
1171 			    rt2661_dma_map_addr, &physaddr, 0);
1172 			if (error != 0) {
1173 				/* very unlikely that it will fail... */
1174 				panic("%s: could not load old rx mbuf",
1175 				    device_get_name(sc->sc_dev));
1176 			}
1177 			ifp->if_ierrors++;
1178 			goto skip;
1179 		}
1180 
1181 		/*
1182 	 	 * New mbuf successfully loaded, update Rx ring and continue
1183 		 * processing.
1184 		 */
1185 		m = data->m;
1186 		data->m = mnew;
1187 		desc->physaddr = htole32(physaddr);
1188 
1189 		/* finalize mbuf */
1190 		m->m_pkthdr.rcvif = ifp;
1191 		m->m_pkthdr.len = m->m_len =
1192 		    (le32toh(desc->flags) >> 16) & 0xfff;
1193 
1194 		if (sc->sc_drvbpf != NULL) {
1195 			struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
1196 			uint32_t tsf_lo, tsf_hi;
1197 
1198 			/* get timestamp (low and high 32 bits) */
1199 			tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
1200 			tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
1201 
1202 			tap->wr_tsf =
1203 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1204 			tap->wr_flags = 0;
1205 			tap->wr_rate = rt2661_rxrate(desc);
1206 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1207 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1208 			tap->wr_antsignal = desc->rssi;
1209 
1210 			bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1211 		}
1212 
1213 		wh = mtod(m, struct ieee80211_frame *);
1214 		ni = ieee80211_find_rxnode(ic,
1215 		    (struct ieee80211_frame_min *)wh);
1216 
1217 		/* send the frame to the 802.11 layer */
1218 		ieee80211_input(ic, m, ni, desc->rssi, 0);
1219 
1220 		/* give rssi to the rate adatation algorithm */
1221 		rn = (struct rt2661_node *)ni;
1222 		ral_rssadapt_input(ic, ni, &rn->rssadapt,
1223 		    rt2661_get_rssi(sc, desc->rssi));
1224 
1225 		/* node is no longer needed */
1226 		ieee80211_free_node(ni);
1227 
1228 skip:		desc->flags |= htole32(RT2661_RX_BUSY);
1229 
1230 		DPRINTFN(15, ("rx intr idx=%u\n", sc->rxq.cur));
1231 
1232 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
1233 	}
1234 
1235 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1236 	    BUS_DMASYNC_PREWRITE);
1237 }
1238 
1239 /* ARGSUSED */
1240 static void
1241 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
1242 {
1243 	/* do nothing */
1244 }
1245 
1246 static void
1247 rt2661_mcu_wakeup(struct rt2661_softc *sc)
1248 {
1249 	RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
1250 
1251 	RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
1252 	RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
1253 	RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
1254 
1255 	/* send wakeup command to MCU */
1256 	rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
1257 }
1258 
1259 static void
1260 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
1261 {
1262 	RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
1263 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
1264 }
1265 
1266 static void
1267 rt2661_intr(void *arg)
1268 {
1269 	struct rt2661_softc *sc = arg;
1270 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1271 	uint32_t r1, r2;
1272 
1273 	/* disable MAC and MCU interrupts */
1274 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
1275 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
1276 
1277 	/* don't re-enable interrupts if we're shutting down */
1278 	if (!(ifp->if_flags & IFF_RUNNING))
1279 		return;
1280 
1281 	r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
1282 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
1283 
1284 	r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
1285 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
1286 
1287 	if (r1 & RT2661_MGT_DONE)
1288 		rt2661_tx_dma_intr(sc, &sc->mgtq);
1289 
1290 	if (r1 & RT2661_RX_DONE)
1291 		rt2661_rx_intr(sc);
1292 
1293 	if (r1 & RT2661_TX0_DMA_DONE)
1294 		rt2661_tx_dma_intr(sc, &sc->txq[0]);
1295 
1296 	if (r1 & RT2661_TX1_DMA_DONE)
1297 		rt2661_tx_dma_intr(sc, &sc->txq[1]);
1298 
1299 	if (r1 & RT2661_TX2_DMA_DONE)
1300 		rt2661_tx_dma_intr(sc, &sc->txq[2]);
1301 
1302 	if (r1 & RT2661_TX3_DMA_DONE)
1303 		rt2661_tx_dma_intr(sc, &sc->txq[3]);
1304 
1305 	if (r1 & RT2661_TX_DONE)
1306 		rt2661_tx_intr(sc);
1307 
1308 	if (r2 & RT2661_MCU_CMD_DONE)
1309 		rt2661_mcu_cmd_intr(sc);
1310 
1311 	if (r2 & RT2661_MCU_BEACON_EXPIRE)
1312 		rt2661_mcu_beacon_expire(sc);
1313 
1314 	if (r2 & RT2661_MCU_WAKEUP)
1315 		rt2661_mcu_wakeup(sc);
1316 
1317 	/* re-enable MAC and MCU interrupts */
1318 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
1319 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
1320 }
1321 
1322 /* quickly determine if a given rate is CCK or OFDM */
1323 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1324 
1325 #define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1326 #define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1327 
1328 #define RAL_SIFS	10	/* us */
1329 
1330 /*
1331  * This function is only used by the Rx radiotap code. It returns the rate at
1332  * which a given frame was received.
1333  */
1334 static uint8_t
1335 rt2661_rxrate(struct rt2661_rx_desc *desc)
1336 {
1337 	if (le32toh(desc->flags) & RT2661_RX_OFDM) {
1338 		/* reverse function of rt2661_plcp_signal */
1339 		switch (desc->rate & 0xf) {
1340 		case 0xb:	return 12;
1341 		case 0xf:	return 18;
1342 		case 0xa:	return 24;
1343 		case 0xe:	return 36;
1344 		case 0x9:	return 48;
1345 		case 0xd:	return 72;
1346 		case 0x8:	return 96;
1347 		case 0xc:	return 108;
1348 		}
1349 	} else {
1350 		if (desc->rate == 10)
1351 			return 2;
1352 		if (desc->rate == 20)
1353 			return 4;
1354 		if (desc->rate == 55)
1355 			return 11;
1356 		if (desc->rate == 110)
1357 			return 22;
1358 	}
1359 	return 2;	/* should not get there */
1360 }
1361 
1362 /*
1363  * Return the expected ack rate for a frame transmitted at rate `rate'.
1364  * XXX: this should depend on the destination node basic rate set.
1365  */
1366 static int
1367 rt2661_ack_rate(struct ieee80211com *ic, int rate)
1368 {
1369 	switch (rate) {
1370 	/* CCK rates */
1371 	case 2:
1372 		return 2;
1373 	case 4:
1374 	case 11:
1375 	case 22:
1376 		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1377 
1378 	/* OFDM rates */
1379 	case 12:
1380 	case 18:
1381 		return 12;
1382 	case 24:
1383 	case 36:
1384 		return 24;
1385 	case 48:
1386 	case 72:
1387 	case 96:
1388 	case 108:
1389 		return 48;
1390 	}
1391 
1392 	/* default to 1Mbps */
1393 	return 2;
1394 }
1395 
1396 /*
1397  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1398  * The function automatically determines the operating mode depending on the
1399  * given rate. `flags' indicates whether short preamble is in use or not.
1400  */
1401 static uint16_t
1402 rt2661_txtime(int len, int rate, uint32_t flags)
1403 {
1404 	uint16_t txtime;
1405 
1406 	if (RAL_RATE_IS_OFDM(rate)) {
1407 		/* IEEE Std 802.11a-1999, pp. 37 */
1408 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1409 		txtime = 16 + 4 + 4 * txtime + 6;
1410 	} else {
1411 		/* IEEE Std 802.11b-1999, pp. 28 */
1412 		txtime = (16 * len + rate - 1) / rate;
1413 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1414 			txtime +=  72 + 24;
1415 		else
1416 			txtime += 144 + 48;
1417 	}
1418 
1419 	return txtime;
1420 }
1421 
1422 static uint8_t
1423 rt2661_plcp_signal(int rate)
1424 {
1425 	switch (rate) {
1426 	/* CCK rates (returned values are device-dependent) */
1427 	case 2:		return 0x0;
1428 	case 4:		return 0x1;
1429 	case 11:	return 0x2;
1430 	case 22:	return 0x3;
1431 
1432 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1433 	case 12:	return 0xb;
1434 	case 18:	return 0xf;
1435 	case 24:	return 0xa;
1436 	case 36:	return 0xe;
1437 	case 48:	return 0x9;
1438 	case 72:	return 0xd;
1439 	case 96:	return 0x8;
1440 	case 108:	return 0xc;
1441 
1442 	/* unsupported rates (should not get there) */
1443 	default:	return 0xff;
1444 	}
1445 }
1446 
1447 static void
1448 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
1449     uint32_t flags, uint16_t xflags, int len, int rate,
1450     const bus_dma_segment_t *segs, int nsegs, int ac)
1451 {
1452 	struct ieee80211com *ic = &sc->sc_ic;
1453 	uint16_t plcp_length;
1454 	int i, remainder;
1455 
1456 	desc->flags = htole32(flags);
1457 	desc->flags |= htole32(len << 16);
1458 	desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
1459 
1460 	desc->xflags = htole16(xflags);
1461 	desc->xflags |= htole16(nsegs << 13);
1462 
1463 	desc->wme = htole16(
1464 	    RT2661_QID(ac) |
1465 	    RT2661_AIFSN(2) |
1466 	    RT2661_LOGCWMIN(4) |
1467 	    RT2661_LOGCWMAX(10));
1468 
1469 	/*
1470 	 * Remember in which queue this frame was sent. This field is driver
1471 	 * private data only. It will be made available by the NIC in STA_CSR4
1472 	 * on Tx interrupts.
1473 	 */
1474 	desc->qid = ac;
1475 
1476 	/* setup PLCP fields */
1477 	desc->plcp_signal  = rt2661_plcp_signal(rate);
1478 	desc->plcp_service = 4;
1479 
1480 	len += IEEE80211_CRC_LEN;
1481 	if (RAL_RATE_IS_OFDM(rate)) {
1482 		desc->flags |= htole32(RT2661_TX_OFDM);
1483 
1484 		plcp_length = len & 0xfff;
1485 		desc->plcp_length_hi = plcp_length >> 6;
1486 		desc->plcp_length_lo = plcp_length & 0x3f;
1487 	} else {
1488 		plcp_length = (16 * len + rate - 1) / rate;
1489 		if (rate == 22) {
1490 			remainder = (16 * len) % 22;
1491 			if (remainder != 0 && remainder < 7)
1492 				desc->plcp_service |= RT2661_PLCP_LENGEXT;
1493 		}
1494 		desc->plcp_length_hi = plcp_length >> 8;
1495 		desc->plcp_length_lo = plcp_length & 0xff;
1496 
1497 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1498 			desc->plcp_signal |= 0x08;
1499 	}
1500 
1501 	/* RT2x61 supports scatter with up to 5 segments */
1502 	for (i = 0; i < nsegs; i++) {
1503 		desc->addr[i] = htole32(segs[i].ds_addr);
1504 		desc->len [i] = htole16(segs[i].ds_len);
1505 	}
1506 }
1507 
1508 static int
1509 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
1510     struct ieee80211_node *ni)
1511 {
1512 	struct ieee80211com *ic = &sc->sc_ic;
1513 	struct rt2661_tx_desc *desc;
1514 	struct rt2661_tx_data *data;
1515 	struct ieee80211_frame *wh;
1516 	struct rt2661_dmamap map;
1517 	uint16_t dur;
1518 	uint32_t flags = 0;	/* XXX HWSEQ */
1519 	int rate, error;
1520 
1521 	desc = &sc->mgtq.desc[sc->mgtq.cur];
1522 	data = &sc->mgtq.data[sc->mgtq.cur];
1523 
1524 	/* send mgt frames at the lowest available rate */
1525 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1526 
1527 	error = bus_dmamap_load_mbuf(sc->mgtq.data_dmat, data->map, m0,
1528 				     rt2661_dma_map_mbuf, &map, 0);
1529 	if (error != 0) {
1530 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1531 		    error);
1532 		m_freem(m0);
1533 		return error;
1534 	}
1535 
1536 	if (sc->sc_drvbpf != NULL) {
1537 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1538 
1539 		tap->wt_flags = 0;
1540 		tap->wt_rate = rate;
1541 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1542 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1543 
1544 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1545 	}
1546 
1547 	data->m = m0;
1548 	data->ni = ni;
1549 
1550 	wh = mtod(m0, struct ieee80211_frame *);
1551 
1552 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1553 		flags |= RT2661_TX_NEED_ACK;
1554 
1555 		dur = rt2661_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1556 		    RAL_SIFS;
1557 		*(uint16_t *)wh->i_dur = htole16(dur);
1558 
1559 		/* tell hardware to add timestamp in probe responses */
1560 		if ((wh->i_fc[0] &
1561 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1562 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1563 			flags |= RT2661_TX_TIMESTAMP;
1564 	}
1565 
1566 	rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
1567 	    m0->m_pkthdr.len, rate, map.segs, map.nseg, RT2661_QID_MGT);
1568 
1569 	bus_dmamap_sync(sc->mgtq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1570 	bus_dmamap_sync(sc->mgtq.desc_dmat, sc->mgtq.desc_map,
1571 	    BUS_DMASYNC_PREWRITE);
1572 
1573 	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1574 	    m0->m_pkthdr.len, sc->mgtq.cur, rate));
1575 
1576 	/* kick mgt */
1577 	sc->mgtq.queued++;
1578 	sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
1579 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
1580 
1581 	return 0;
1582 }
1583 
1584 /*
1585  * Build a RTS control frame.
1586  */
1587 static struct mbuf *
1588 rt2661_get_rts(struct rt2661_softc *sc, struct ieee80211_frame *wh,
1589     uint16_t dur)
1590 {
1591 	struct ieee80211_frame_rts *rts;
1592 	struct mbuf *m;
1593 
1594 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1595 	if (m == NULL) {
1596 		sc->sc_ic.ic_stats.is_tx_nobuf++;
1597 		device_printf(sc->sc_dev, "could not allocate RTS frame\n");
1598 		return NULL;
1599 	}
1600 
1601 	rts = mtod(m, struct ieee80211_frame_rts *);
1602 
1603 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1604 	    IEEE80211_FC0_SUBTYPE_RTS;
1605 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1606 	*(uint16_t *)rts->i_dur = htole16(dur);
1607 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1608 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1609 
1610 	m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
1611 
1612 	return m;
1613 }
1614 
1615 static int
1616 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
1617     struct ieee80211_node *ni, int ac)
1618 {
1619 	struct ieee80211com *ic = &sc->sc_ic;
1620 	struct rt2661_tx_ring *txq = &sc->txq[ac];
1621 	struct rt2661_tx_desc *desc;
1622 	struct rt2661_tx_data *data;
1623 	struct rt2661_node *rn;
1624 	struct ieee80211_rateset *rs;
1625 	struct ieee80211_frame *wh;
1626 	struct ieee80211_key *k;
1627 	const struct chanAccParams *cap;
1628 	struct mbuf *mnew;
1629 	struct rt2661_dmamap map;
1630 	uint16_t dur;
1631 	uint32_t flags = 0;
1632 	int error, rate, noack = 0;
1633 
1634 	wh = mtod(m0, struct ieee80211_frame *);
1635 
1636 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1637 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1638 		rate = rs->rs_rates[ic->ic_fixed_rate];
1639 	} else {
1640 		rs = &ni->ni_rates;
1641 		rn = (struct rt2661_node *)ni;
1642 		ni->ni_txrate = ral_rssadapt_choose(&rn->rssadapt, rs,
1643 		    wh, m0->m_pkthdr.len, NULL, 0);
1644 		rate = rs->rs_rates[ni->ni_txrate];
1645 	}
1646 	rate &= IEEE80211_RATE_VAL;
1647 
1648 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1649 		cap = &ic->ic_wme.wme_chanParams;
1650 		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1651 	}
1652 
1653 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1654 		k = ieee80211_crypto_encap(ic, ni, m0);
1655 		if (k == NULL) {
1656 			m_freem(m0);
1657 			return ENOBUFS;
1658 		}
1659 
1660 		/* packet header may have moved, reset our local pointer */
1661 		wh = mtod(m0, struct ieee80211_frame *);
1662 	}
1663 
1664 	/*
1665 	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1666 	 * for directed frames only when the length of the MPDU is greater
1667 	 * than the length threshold indicated by [...]" ic_rtsthreshold.
1668 	 */
1669 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1670 	    m0->m_pkthdr.len > ic->ic_rtsthreshold) {
1671 		struct mbuf *m;
1672 		uint16_t dur;
1673 		int rtsrate, ackrate;
1674 
1675 		rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1676 		ackrate = rt2661_ack_rate(ic, rate);
1677 
1678 		dur = rt2661_txtime(m0->m_pkthdr.len + 4, rate, ic->ic_flags) +
1679 		      rt2661_txtime(RAL_CTS_SIZE, rtsrate, ic->ic_flags) +
1680 		      /* XXX: noack (QoS)? */
1681 		      rt2661_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1682 		      3 * RAL_SIFS;
1683 
1684 		m = rt2661_get_rts(sc, wh, dur);
1685 
1686 		desc = &txq->desc[txq->cur];
1687 		data = &txq->data[txq->cur];
1688 
1689 		error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m,
1690 					     rt2661_dma_map_mbuf, &map, 0);
1691 		if (error != 0) {
1692 			device_printf(sc->sc_dev,
1693 			    "could not map mbuf (error %d)\n", error);
1694 			m_freem(m);
1695 			m_freem(m0);
1696 			return error;
1697 		}
1698 
1699 		/* avoid multiple free() of the same node for each fragment */
1700 		ieee80211_ref_node(ni);
1701 
1702 		data->m = m;
1703 		data->ni = ni;
1704 
1705 		/* RTS frames are not taken into account for rssadapt */
1706 		data->id.id_node = NULL;
1707 
1708 		rt2661_setup_tx_desc(sc, desc, RT2661_TX_NEED_ACK |
1709 				     RT2661_TX_MORE_FRAG, 0, m->m_pkthdr.len,
1710 				     rtsrate, map.segs, map.nseg, ac);
1711 
1712 		bus_dmamap_sync(txq->data_dmat, data->map,
1713 		    BUS_DMASYNC_PREWRITE);
1714 
1715 		txq->queued++;
1716 		txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1717 
1718 		/*
1719 		 * IEEE Std 802.11-1999: when an RTS/CTS exchange is used, the
1720 		 * asynchronous data frame shall be transmitted after the CTS
1721 		 * frame and a SIFS period.
1722 		 */
1723 		flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS;
1724 	}
1725 
1726 	data = &txq->data[txq->cur];
1727 	desc = &txq->desc[txq->cur];
1728 
1729 	error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1730 				     rt2661_dma_map_mbuf, &map, 0);
1731 	if (error != 0 && error != EFBIG) {
1732 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1733 		    error);
1734 		m_freem(m0);
1735 		return error;
1736 	}
1737 	if (error != 0) {
1738 		mnew = m_defrag(m0, MB_DONTWAIT);
1739 		if (mnew == NULL) {
1740 			device_printf(sc->sc_dev,
1741 			    "could not defragment mbuf\n");
1742 			m_freem(m0);
1743 			return ENOBUFS;
1744 		}
1745 		m0 = mnew;
1746 
1747 		error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1748 					     rt2661_dma_map_mbuf, &map, 0);
1749 		if (error != 0) {
1750 			device_printf(sc->sc_dev,
1751 			    "could not map mbuf (error %d)\n", error);
1752 			m_freem(m0);
1753 			return error;
1754 		}
1755 
1756 		/* packet header have moved, reset our local pointer */
1757 		wh = mtod(m0, struct ieee80211_frame *);
1758 	}
1759 
1760 	if (sc->sc_drvbpf != NULL) {
1761 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1762 
1763 		tap->wt_flags = 0;
1764 		tap->wt_rate = rate;
1765 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1766 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1767 
1768 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1769 	}
1770 
1771 	data->m = m0;
1772 	data->ni = ni;
1773 
1774 	/* remember link conditions for rate adaptation algorithm */
1775 	if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1776 		data->id.id_len = m0->m_pkthdr.len;
1777 		data->id.id_rateidx = ni->ni_txrate;
1778 		data->id.id_node = ni;
1779 		data->id.id_rssi = ni->ni_rssi;
1780 	} else
1781 		data->id.id_node = NULL;
1782 
1783 	if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1784 		flags |= RT2661_TX_NEED_ACK;
1785 
1786 		dur = rt2661_txtime(RAL_ACK_SIZE, rt2661_ack_rate(ic, rate),
1787 		    ic->ic_flags) + RAL_SIFS;
1788 		*(uint16_t *)wh->i_dur = htole16(dur);
1789 	}
1790 
1791 	rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate,
1792 			     map.segs, map.nseg, ac);
1793 
1794 	bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1795 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1796 
1797 	DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
1798 	    m0->m_pkthdr.len, txq->cur, rate));
1799 
1800 	/* kick Tx */
1801 	txq->queued++;
1802 	txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1803 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1 << ac);
1804 
1805 	return 0;
1806 }
1807 
1808 static void
1809 rt2661_start(struct ifnet *ifp)
1810 {
1811 	struct rt2661_softc *sc = ifp->if_softc;
1812 	struct ieee80211com *ic = &sc->sc_ic;
1813 	struct mbuf *m0;
1814 	struct ether_header *eh;
1815 	struct ieee80211_node *ni;
1816 	int ac;
1817 
1818 	/* prevent management frames from being sent if we're not ready */
1819 	if (!(ifp->if_flags & IFF_RUNNING))
1820 		return;
1821 
1822 	for (;;) {
1823 		IF_POLL(&ic->ic_mgtq, m0);
1824 		if (m0 != NULL) {
1825 			if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
1826 				ifp->if_flags |= IFF_OACTIVE;
1827 				break;
1828 			}
1829 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1830 
1831 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1832 			m0->m_pkthdr.rcvif = NULL;
1833 
1834 			if (ic->ic_rawbpf != NULL)
1835 				bpf_mtap(ic->ic_rawbpf, m0);
1836 
1837 			if (rt2661_tx_mgt(sc, m0, ni) != 0)
1838 				break;
1839 
1840 		} else {
1841 			if (ic->ic_state != IEEE80211_S_RUN)
1842 				break;
1843 
1844 			m0 = ifq_dequeue(&ifp->if_snd, NULL);
1845 			if (m0 == NULL)
1846 				break;
1847 
1848 			if (m0->m_len < sizeof (struct ether_header) &&
1849 			    !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1850 				continue;
1851 
1852 			eh = mtod(m0, struct ether_header *);
1853 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1854 			if (ni == NULL) {
1855 				m_freem(m0);
1856 				ifp->if_oerrors++;
1857 				continue;
1858 			}
1859 
1860 			/* classify mbuf so we can find which tx ring to use */
1861 			if (ieee80211_classify(ic, m0, ni) != 0) {
1862 				m_freem(m0);
1863 				ieee80211_free_node(ni);
1864 				ifp->if_oerrors++;
1865 				continue;
1866 			}
1867 
1868 			/* no QoS encapsulation for EAPOL frames */
1869 			ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1870 			    M_WME_GETAC(m0) : WME_AC_BE;
1871 
1872 			if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
1873 				/* there is no place left in this ring */
1874 				ifp->if_flags |= IFF_OACTIVE;
1875 				m_freem(m0);
1876 				ieee80211_free_node(ni);
1877 				break;
1878 			}
1879 
1880 			BPF_MTAP(ifp, m0);
1881 
1882 			m0 = ieee80211_encap(ic, m0, ni);
1883 			if (m0 == NULL) {
1884 				ieee80211_free_node(ni);
1885 				ifp->if_oerrors++;
1886 				continue;
1887 			}
1888 
1889 			if (ic->ic_rawbpf != NULL)
1890 				bpf_mtap(ic->ic_rawbpf, m0);
1891 
1892 			if (rt2661_tx_data(sc, m0, ni, ac) != 0) {
1893 				ieee80211_free_node(ni);
1894 				ifp->if_oerrors++;
1895 				break;
1896 			}
1897 		}
1898 
1899 		sc->sc_tx_timer = 5;
1900 		ifp->if_timer = 1;
1901 	}
1902 }
1903 
1904 static void
1905 rt2661_watchdog(struct ifnet *ifp)
1906 {
1907 	struct rt2661_softc *sc = ifp->if_softc;
1908 	struct ieee80211com *ic = &sc->sc_ic;
1909 
1910 	ifp->if_timer = 0;
1911 
1912 	if (sc->sc_tx_timer > 0) {
1913 		if (--sc->sc_tx_timer == 0) {
1914 			device_printf(sc->sc_dev, "device timeout\n");
1915 			rt2661_init(sc);
1916 			ifp->if_oerrors++;
1917 			return;
1918 		}
1919 		ifp->if_timer = 1;
1920 	}
1921 
1922 	ieee80211_watchdog(ic);
1923 }
1924 
1925 /*
1926  * This function allows for fast channel switching in monitor mode (used by
1927  * net-mgmt/kismet). In IBSS mode, we must explicitly reset the interface to
1928  * generate a new beacon frame.
1929  */
1930 static int
1931 rt2661_reset(struct ifnet *ifp)
1932 {
1933 	struct rt2661_softc *sc = ifp->if_softc;
1934 	struct ieee80211com *ic = &sc->sc_ic;
1935 
1936 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
1937 		return ENETRESET;
1938 
1939 	rt2661_set_chan(sc, ic->ic_curchan);
1940 
1941 	return 0;
1942 }
1943 
1944 static int
1945 rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1946 {
1947 	struct rt2661_softc *sc = ifp->if_softc;
1948 	struct ieee80211com *ic = &sc->sc_ic;
1949 	int error = 0;
1950 
1951 	switch (cmd) {
1952 	case SIOCSIFFLAGS:
1953 		if (ifp->if_flags & IFF_UP) {
1954 			if (ifp->if_flags & IFF_RUNNING)
1955 				rt2661_update_promisc(sc);
1956 			else
1957 				rt2661_init(sc);
1958 		} else {
1959 			if (ifp->if_flags & IFF_RUNNING)
1960 				rt2661_stop(sc);
1961 		}
1962 		break;
1963 
1964 	default:
1965 		error = ieee80211_ioctl(ic, cmd, data, cr);
1966 	}
1967 
1968 	if (error == ENETRESET) {
1969 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
1970 		    (IFF_UP | IFF_RUNNING) &&
1971 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
1972 			rt2661_init(sc);
1973 		error = 0;
1974 	}
1975 	return error;
1976 }
1977 
1978 static void
1979 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
1980 {
1981 	uint32_t tmp;
1982 	int ntries;
1983 
1984 	for (ntries = 0; ntries < 100; ntries++) {
1985 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
1986 			break;
1987 		DELAY(1);
1988 	}
1989 	if (ntries == 100) {
1990 		device_printf(sc->sc_dev, "could not write to BBP\n");
1991 		return;
1992 	}
1993 
1994 	tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
1995 	RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
1996 
1997 	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
1998 }
1999 
2000 static uint8_t
2001 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
2002 {
2003 	uint32_t val;
2004 	int ntries;
2005 
2006 	for (ntries = 0; ntries < 100; ntries++) {
2007 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
2008 			break;
2009 		DELAY(1);
2010 	}
2011 	if (ntries == 100) {
2012 		device_printf(sc->sc_dev, "could not read from BBP\n");
2013 		return 0;
2014 	}
2015 
2016 	val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
2017 	RAL_WRITE(sc, RT2661_PHY_CSR3, val);
2018 
2019 	for (ntries = 0; ntries < 100; ntries++) {
2020 		val = RAL_READ(sc, RT2661_PHY_CSR3);
2021 		if (!(val & RT2661_BBP_BUSY))
2022 			return val & 0xff;
2023 		DELAY(1);
2024 	}
2025 
2026 	device_printf(sc->sc_dev, "could not read from BBP\n");
2027 	return 0;
2028 }
2029 
2030 static void
2031 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
2032 {
2033 	uint32_t tmp;
2034 	int ntries;
2035 
2036 	for (ntries = 0; ntries < 100; ntries++) {
2037 		if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
2038 			break;
2039 		DELAY(1);
2040 	}
2041 	if (ntries == 100) {
2042 		device_printf(sc->sc_dev, "could not write to RF\n");
2043 		return;
2044 	}
2045 
2046 	tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
2047 	    (reg & 3);
2048 	RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
2049 
2050 	/* remember last written value in sc */
2051 	sc->rf_regs[reg] = val;
2052 
2053 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff));
2054 }
2055 
2056 static int
2057 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
2058 {
2059 	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
2060 		return EIO;	/* there is already a command pending */
2061 
2062 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
2063 	    RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
2064 
2065 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
2066 
2067 	return 0;
2068 }
2069 
2070 static void
2071 rt2661_select_antenna(struct rt2661_softc *sc)
2072 {
2073 	uint8_t bbp4, bbp77;
2074 	uint32_t tmp;
2075 
2076 	bbp4  = rt2661_bbp_read(sc,  4);
2077 	bbp77 = rt2661_bbp_read(sc, 77);
2078 
2079 	/* TBD */
2080 
2081 	/* make sure Rx is disabled before switching antenna */
2082 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2083 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2084 
2085 	rt2661_bbp_write(sc,  4, bbp4);
2086 	rt2661_bbp_write(sc, 77, bbp77);
2087 
2088 	/* restore Rx filter */
2089 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2090 }
2091 
2092 /*
2093  * Enable multi-rate retries for frames sent at OFDM rates.
2094  * In 802.11b/g mode, allow fallback to CCK rates.
2095  */
2096 static void
2097 rt2661_enable_mrr(struct rt2661_softc *sc)
2098 {
2099 	struct ieee80211com *ic = &sc->sc_ic;
2100 	uint32_t tmp;
2101 
2102 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2103 
2104 	tmp &= ~RT2661_MRR_CCK_FALLBACK;
2105 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan))
2106 		tmp |= RT2661_MRR_CCK_FALLBACK;
2107 	tmp |= RT2661_MRR_ENABLED;
2108 
2109 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2110 }
2111 
2112 static void
2113 rt2661_set_txpreamble(struct rt2661_softc *sc)
2114 {
2115 	uint32_t tmp;
2116 
2117 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2118 
2119 	tmp &= ~RT2661_SHORT_PREAMBLE;
2120 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
2121 		tmp |= RT2661_SHORT_PREAMBLE;
2122 
2123 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2124 }
2125 
2126 static void
2127 rt2661_set_basicrates(struct rt2661_softc *sc,
2128     const struct ieee80211_rateset *rs)
2129 {
2130 #define RV(r)	((r) & IEEE80211_RATE_VAL)
2131 	uint32_t mask = 0;
2132 	uint8_t rate;
2133 	int i, j;
2134 
2135 	for (i = 0; i < rs->rs_nrates; i++) {
2136 		rate = rs->rs_rates[i];
2137 
2138 		if (!(rate & IEEE80211_RATE_BASIC))
2139 			continue;
2140 
2141 		/*
2142 		 * Find h/w rate index.  We know it exists because the rate
2143 		 * set has already been negotiated.
2144 		 */
2145 		for (j = 0; rt2661_rateset_11g.rs_rates[j] != RV(rate); j++);
2146 
2147 		mask |= 1 << j;
2148 	}
2149 
2150 	RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
2151 
2152 	DPRINTF(("Setting basic rate mask to 0x%x\n", mask));
2153 #undef RV
2154 }
2155 
2156 /*
2157  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
2158  * driver.
2159  */
2160 static void
2161 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
2162 {
2163 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
2164 	uint32_t tmp;
2165 
2166 	/* update all BBP registers that depend on the band */
2167 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
2168 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
2169 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2170 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
2171 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
2172 	}
2173 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2174 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2175 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
2176 	}
2177 
2178 	rt2661_bbp_write(sc,  17, bbp17);
2179 	rt2661_bbp_write(sc,  96, bbp96);
2180 	rt2661_bbp_write(sc, 104, bbp104);
2181 
2182 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2183 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2184 		rt2661_bbp_write(sc, 75, 0x80);
2185 		rt2661_bbp_write(sc, 86, 0x80);
2186 		rt2661_bbp_write(sc, 88, 0x80);
2187 	}
2188 
2189 	rt2661_bbp_write(sc, 35, bbp35);
2190 	rt2661_bbp_write(sc, 97, bbp97);
2191 	rt2661_bbp_write(sc, 98, bbp98);
2192 
2193 	tmp = RAL_READ(sc, RT2661_PHY_CSR0);
2194 	tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
2195 	if (IEEE80211_IS_CHAN_2GHZ(c))
2196 		tmp |= RT2661_PA_PE_2GHZ;
2197 	else
2198 		tmp |= RT2661_PA_PE_5GHZ;
2199 	RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
2200 }
2201 
2202 static void
2203 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
2204 {
2205 	struct ieee80211com *ic = &sc->sc_ic;
2206 	const struct rfprog *rfprog;
2207 	uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
2208 	int8_t power;
2209 	u_int i, chan;
2210 
2211 	chan = ieee80211_chan2ieee(ic, c);
2212 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2213 		return;
2214 
2215 	/* select the appropriate RF settings based on what EEPROM says */
2216 	rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
2217 
2218 	/* find the settings for this channel (we know it exists) */
2219 	for (i = 0; rfprog[i].chan != chan; i++);
2220 
2221 	power = sc->txpow[i];
2222 	if (power < 0) {
2223 		bbp94 += power;
2224 		power = 0;
2225 	} else if (power > 31) {
2226 		bbp94 += power - 31;
2227 		power = 31;
2228 	}
2229 
2230 	/*
2231 	 * If we are switching from the 2GHz band to the 5GHz band or
2232 	 * vice-versa, BBP registers need to be reprogrammed.
2233 	 */
2234 	if (c->ic_flags != sc->sc_curchan->ic_flags) {
2235 		rt2661_select_band(sc, c);
2236 		rt2661_select_antenna(sc);
2237 	}
2238 	sc->sc_curchan = c;
2239 
2240 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2241 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2242 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2243 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2244 
2245 	DELAY(200);
2246 
2247 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2248 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2249 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
2250 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2251 
2252 	DELAY(200);
2253 
2254 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2255 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2256 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2257 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2258 
2259 	/* enable smart mode for MIMO-capable RFs */
2260 	bbp3 = rt2661_bbp_read(sc, 3);
2261 
2262 	bbp3 &= ~RT2661_SMART_MODE;
2263 	if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
2264 		bbp3 |= RT2661_SMART_MODE;
2265 
2266 	rt2661_bbp_write(sc, 3, bbp3);
2267 
2268 	if (bbp94 != RT2661_BBPR94_DEFAULT)
2269 		rt2661_bbp_write(sc, 94, bbp94);
2270 
2271 	/* 5GHz radio needs a 1ms delay here */
2272 	if (IEEE80211_IS_CHAN_5GHZ(c))
2273 		DELAY(1000);
2274 }
2275 
2276 static void
2277 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
2278 {
2279 	uint32_t tmp;
2280 
2281 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2282 	RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
2283 
2284 	tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
2285 	RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
2286 }
2287 
2288 static void
2289 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
2290 {
2291 	uint32_t tmp;
2292 
2293 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2294 	RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
2295 
2296 	tmp = addr[4] | addr[5] << 8;
2297 	RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
2298 }
2299 
2300 static void
2301 rt2661_update_promisc(struct rt2661_softc *sc)
2302 {
2303 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2304 	uint32_t tmp;
2305 
2306 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2307 
2308 	tmp &= ~RT2661_DROP_NOT_TO_ME;
2309 	if (!(ifp->if_flags & IFF_PROMISC))
2310 		tmp |= RT2661_DROP_NOT_TO_ME;
2311 
2312 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2313 
2314 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2315 	    "entering" : "leaving"));
2316 }
2317 
2318 /*
2319  * Update QoS (802.11e) settings for each h/w Tx ring.
2320  */
2321 static int
2322 rt2661_wme_update(struct ieee80211com *ic)
2323 {
2324 	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
2325 	const struct wmeParams *wmep;
2326 
2327 	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
2328 
2329 	/* XXX: not sure about shifts. */
2330 	/* XXX: the reference driver plays with AC_VI settings too. */
2331 
2332 	/* update TxOp */
2333 	RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
2334 	    wmep[WME_AC_BE].wmep_txopLimit << 16 |
2335 	    wmep[WME_AC_BK].wmep_txopLimit);
2336 	RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
2337 	    wmep[WME_AC_VI].wmep_txopLimit << 16 |
2338 	    wmep[WME_AC_VO].wmep_txopLimit);
2339 
2340 	/* update CWmin */
2341 	RAL_WRITE(sc, RT2661_CWMIN_CSR,
2342 	    wmep[WME_AC_BE].wmep_logcwmin << 12 |
2343 	    wmep[WME_AC_BK].wmep_logcwmin <<  8 |
2344 	    wmep[WME_AC_VI].wmep_logcwmin <<  4 |
2345 	    wmep[WME_AC_VO].wmep_logcwmin);
2346 
2347 	/* update CWmax */
2348 	RAL_WRITE(sc, RT2661_CWMAX_CSR,
2349 	    wmep[WME_AC_BE].wmep_logcwmax << 12 |
2350 	    wmep[WME_AC_BK].wmep_logcwmax <<  8 |
2351 	    wmep[WME_AC_VI].wmep_logcwmax <<  4 |
2352 	    wmep[WME_AC_VO].wmep_logcwmax);
2353 
2354 	/* update Aifsn */
2355 	RAL_WRITE(sc, RT2661_AIFSN_CSR,
2356 	    wmep[WME_AC_BE].wmep_aifsn << 12 |
2357 	    wmep[WME_AC_BK].wmep_aifsn <<  8 |
2358 	    wmep[WME_AC_VI].wmep_aifsn <<  4 |
2359 	    wmep[WME_AC_VO].wmep_aifsn);
2360 
2361 	return 0;
2362 }
2363 
2364 static void
2365 rt2661_update_slot(struct ifnet *ifp)
2366 {
2367 	struct rt2661_softc *sc = ifp->if_softc;
2368 	struct ieee80211com *ic = &sc->sc_ic;
2369 	uint8_t slottime;
2370 	uint32_t tmp;
2371 
2372 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2373 
2374 	tmp = RAL_READ(sc, RT2661_MAC_CSR9);
2375 	tmp = (tmp & ~0xff) | slottime;
2376 	RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
2377 }
2378 
2379 static const char *
2380 rt2661_get_rf(int rev)
2381 {
2382 	switch (rev) {
2383 	case RT2661_RF_5225:	return "RT5225";
2384 	case RT2661_RF_5325:	return "RT5325 (MIMO XR)";
2385 	case RT2661_RF_2527:	return "RT2527";
2386 	case RT2661_RF_2529:	return "RT2529 (MIMO XR)";
2387 	default:		return "unknown";
2388 	}
2389 }
2390 
2391 static void
2392 rt2661_read_eeprom(struct rt2661_softc *sc)
2393 {
2394 	struct ieee80211com *ic = &sc->sc_ic;
2395 	uint16_t val;
2396 	int i;
2397 
2398 	/* read MAC address */
2399 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
2400 	ic->ic_myaddr[0] = val & 0xff;
2401 	ic->ic_myaddr[1] = val >> 8;
2402 
2403 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
2404 	ic->ic_myaddr[2] = val & 0xff;
2405 	ic->ic_myaddr[3] = val >> 8;
2406 
2407 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
2408 	ic->ic_myaddr[4] = val & 0xff;
2409 	ic->ic_myaddr[5] = val >> 8;
2410 
2411 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
2412 	/* XXX: test if different from 0xffff? */
2413 	sc->rf_rev   = (val >> 11) & 0x1f;
2414 	sc->hw_radio = (val >> 10) & 0x1;
2415 	sc->rx_ant   = (val >> 4)  & 0x3;
2416 	sc->tx_ant   = (val >> 2)  & 0x3;
2417 	sc->nb_ant   = val & 0x3;
2418 
2419 	DPRINTF(("RF revision=%d\n", sc->rf_rev));
2420 
2421 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
2422 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
2423 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
2424 
2425 	DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
2426 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
2427 
2428 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
2429 	if ((val & 0xff) != 0xff)
2430 		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
2431 
2432 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
2433 	if ((val & 0xff) != 0xff)
2434 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2435 
2436 	/* adjust RSSI correction for external low-noise amplifier */
2437 	if (sc->ext_2ghz_lna)
2438 		sc->rssi_2ghz_corr -= 14;
2439 	if (sc->ext_5ghz_lna)
2440 		sc->rssi_5ghz_corr -= 14;
2441 
2442 	DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
2443 	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
2444 
2445 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
2446 	if ((val >> 8) != 0xff)
2447 		sc->rfprog = (val >> 8) & 0x3;
2448 	if ((val & 0xff) != 0xff)
2449 		sc->rffreq = val & 0xff;
2450 
2451 	DPRINTF(("RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq));
2452 
2453 	/* read Tx power for all a/b/g channels */
2454 	for (i = 0; i < 19; i++) {
2455 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
2456 		sc->txpow[i * 2] = (int8_t)(val >> 8);		/* signed */
2457 		DPRINTF(("Channel=%d Tx power=%d\n",
2458 		    rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]));
2459 		sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);	/* signed */
2460 		DPRINTF(("Channel=%d Tx power=%d\n",
2461 		    rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]));
2462 	}
2463 
2464 	/* read vendor-specific BBP values */
2465 	for (i = 0; i < 16; i++) {
2466 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
2467 		if (val == 0 || val == 0xffff)
2468 			continue;	/* skip invalid entries */
2469 		sc->bbp_prom[i].reg = val >> 8;
2470 		sc->bbp_prom[i].val = val & 0xff;
2471 		DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
2472 		    sc->bbp_prom[i].val));
2473 	}
2474 }
2475 
2476 static int
2477 rt2661_bbp_init(struct rt2661_softc *sc)
2478 {
2479 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2480 	int i, ntries;
2481 	uint8_t val;
2482 
2483 	/* wait for BBP to be ready */
2484 	for (ntries = 0; ntries < 100; ntries++) {
2485 		val = rt2661_bbp_read(sc, 0);
2486 		if (val != 0 && val != 0xff)
2487 			break;
2488 		DELAY(100);
2489 	}
2490 	if (ntries == 100) {
2491 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2492 		return EIO;
2493 	}
2494 
2495 	/* initialize BBP registers to default values */
2496 	for (i = 0; i < N(rt2661_def_bbp); i++) {
2497 		rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
2498 		    rt2661_def_bbp[i].val);
2499 	}
2500 
2501 	/* write vendor-specific BBP values (from EEPROM) */
2502 	for (i = 0; i < 16; i++) {
2503 		if (sc->bbp_prom[i].reg == 0)
2504 			continue;
2505 		rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2506 	}
2507 
2508 	return 0;
2509 #undef N
2510 }
2511 
2512 static void
2513 rt2661_init(void *priv)
2514 {
2515 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2516 	struct rt2661_softc *sc = priv;
2517 	struct ieee80211com *ic = &sc->sc_ic;
2518 	struct ifnet *ifp = ic->ic_ifp;
2519 	uint32_t tmp, sta[3];
2520 	int i, ntries;
2521 
2522 	rt2661_stop(sc);
2523 
2524 	/* initialize Tx rings */
2525 	RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
2526 	RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
2527 	RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
2528 	RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
2529 
2530 	/* initialize Mgt ring */
2531 	RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
2532 
2533 	/* initialize Rx ring */
2534 	RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
2535 
2536 	/* initialize Tx rings sizes */
2537 	RAL_WRITE(sc, RT2661_TX_RING_CSR0,
2538 	    RT2661_TX_RING_COUNT << 24 |
2539 	    RT2661_TX_RING_COUNT << 16 |
2540 	    RT2661_TX_RING_COUNT <<  8 |
2541 	    RT2661_TX_RING_COUNT);
2542 
2543 	RAL_WRITE(sc, RT2661_TX_RING_CSR1,
2544 	    RT2661_TX_DESC_WSIZE << 16 |
2545 	    RT2661_TX_RING_COUNT <<  8 |	/* XXX: HCCA ring unused */
2546 	    RT2661_MGT_RING_COUNT);
2547 
2548 	/* initialize Rx rings */
2549 	RAL_WRITE(sc, RT2661_RX_RING_CSR,
2550 	    RT2661_RX_DESC_BACK  << 16 |
2551 	    RT2661_RX_DESC_WSIZE <<  8 |
2552 	    RT2661_RX_RING_COUNT);
2553 
2554 	/* XXX: some magic here */
2555 	RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
2556 
2557 	/* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
2558 	RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
2559 
2560 	/* load base address of Rx ring */
2561 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
2562 
2563 	/* initialize MAC registers to default values */
2564 	for (i = 0; i < N(rt2661_def_mac); i++)
2565 		RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
2566 
2567 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2568 	rt2661_set_macaddr(sc, ic->ic_myaddr);
2569 
2570 	/* set host ready */
2571 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2572 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2573 
2574 	/* wait for BBP/RF to wakeup */
2575 	for (ntries = 0; ntries < 1000; ntries++) {
2576 		if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
2577 			break;
2578 		DELAY(1000);
2579 	}
2580 	if (ntries == 1000) {
2581 		printf("timeout waiting for BBP/RF to wakeup\n");
2582 		rt2661_stop(sc);
2583 		return;
2584 	}
2585 
2586 	if (rt2661_bbp_init(sc) != 0) {
2587 		rt2661_stop(sc);
2588 		return;
2589 	}
2590 
2591 	/* select default channel */
2592 	sc->sc_curchan = ic->ic_curchan;
2593 	rt2661_select_band(sc, sc->sc_curchan);
2594 	rt2661_select_antenna(sc);
2595 	rt2661_set_chan(sc, sc->sc_curchan);
2596 
2597 	/* update Rx filter */
2598 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
2599 
2600 	tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
2601 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2602 		tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
2603 		       RT2661_DROP_ACKCTS;
2604 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2605 			tmp |= RT2661_DROP_TODS;
2606 		if (!(ifp->if_flags & IFF_PROMISC))
2607 			tmp |= RT2661_DROP_NOT_TO_ME;
2608 	}
2609 
2610 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2611 
2612 	/* clear STA registers */
2613 	RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
2614 
2615 	/* initialize ASIC */
2616 	RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
2617 
2618 	/* clear any pending interrupt */
2619 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2620 
2621 	/* enable interrupts */
2622 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
2623 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
2624 
2625 	/* kick Rx */
2626 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
2627 
2628 	ifp->if_flags &= ~IFF_OACTIVE;
2629 	ifp->if_flags |= IFF_RUNNING;
2630 
2631 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2632 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2633 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2634 	} else
2635 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2636 #undef N
2637 }
2638 
2639 void
2640 rt2661_stop(void *priv)
2641 {
2642 	struct rt2661_softc *sc = priv;
2643 	struct ieee80211com *ic = &sc->sc_ic;
2644 	struct ifnet *ifp = ic->ic_ifp;
2645 	uint32_t tmp;
2646 
2647 	sc->sc_tx_timer = 0;
2648 	ifp->if_timer = 0;
2649 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2650 
2651 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2652 
2653 	/* abort Tx (for all 5 Tx rings) */
2654 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
2655 
2656 	/* disable Rx (value remains after reset!) */
2657 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2658 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2659 
2660 	/* reset ASIC */
2661 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2662 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2663 
2664 	/* disable interrupts */
2665 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffffff);
2666 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
2667 
2668 	/* clear any pending interrupt */
2669 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2670 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
2671 
2672 	/* reset Tx and Rx rings */
2673 	rt2661_reset_tx_ring(sc, &sc->txq[0]);
2674 	rt2661_reset_tx_ring(sc, &sc->txq[1]);
2675 	rt2661_reset_tx_ring(sc, &sc->txq[2]);
2676 	rt2661_reset_tx_ring(sc, &sc->txq[3]);
2677 	rt2661_reset_tx_ring(sc, &sc->mgtq);
2678 	rt2661_reset_rx_ring(sc, &sc->rxq);
2679 }
2680 
2681 static int
2682 rt2661_load_microcode(struct rt2661_softc *sc, const uint8_t *ucode, int size)
2683 {
2684 	int ntries;
2685 
2686 	/* reset 8051 */
2687 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2688 
2689 	/* cancel any pending Host to MCU command */
2690 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
2691 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
2692 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
2693 
2694 	/* write 8051's microcode */
2695 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
2696 	RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, ucode, size);
2697 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2698 
2699 	/* kick 8051's ass */
2700 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
2701 
2702 	/* wait for 8051 to initialize */
2703 	for (ntries = 0; ntries < 500; ntries++) {
2704 		if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
2705 			break;
2706 		DELAY(100);
2707 	}
2708 	if (ntries == 500) {
2709 		printf("timeout waiting for MCU to initialize\n");
2710 		return EIO;
2711 	}
2712 	return 0;
2713 }
2714 
2715 #ifdef notyet
2716 /*
2717  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
2718  * false CCA count.  This function is called periodically (every seconds) when
2719  * in the RUN state.  Values taken from the reference driver.
2720  */
2721 static void
2722 rt2661_rx_tune(struct rt2661_softc *sc)
2723 {
2724 	uint8_t bbp17;
2725 	uint16_t cca;
2726 	int lo, hi, dbm;
2727 
2728 	/*
2729 	 * Tuning range depends on operating band and on the presence of an
2730 	 * external low-noise amplifier.
2731 	 */
2732 	lo = 0x20;
2733 	if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
2734 		lo += 0x08;
2735 	if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
2736 	    (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
2737 		lo += 0x10;
2738 	hi = lo + 0x20;
2739 
2740 	/* retrieve false CCA count since last call (clear on read) */
2741 	cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
2742 
2743 	if (dbm >= -35) {
2744 		bbp17 = 0x60;
2745 	} else if (dbm >= -58) {
2746 		bbp17 = hi;
2747 	} else if (dbm >= -66) {
2748 		bbp17 = lo + 0x10;
2749 	} else if (dbm >= -74) {
2750 		bbp17 = lo + 0x08;
2751 	} else {
2752 		/* RSSI < -74dBm, tune using false CCA count */
2753 
2754 		bbp17 = sc->bbp17; /* current value */
2755 
2756 		hi -= 2 * (-74 - dbm);
2757 		if (hi < lo)
2758 			hi = lo;
2759 
2760 		if (bbp17 > hi) {
2761 			bbp17 = hi;
2762 
2763 		} else if (cca > 512) {
2764 			if (++bbp17 > hi)
2765 				bbp17 = hi;
2766 		} else if (cca < 100) {
2767 			if (--bbp17 < lo)
2768 				bbp17 = lo;
2769 		}
2770 	}
2771 
2772 	if (bbp17 != sc->bbp17) {
2773 		rt2661_bbp_write(sc, 17, bbp17);
2774 		sc->bbp17 = bbp17;
2775 	}
2776 }
2777 
2778 /*
2779  * Enter/Leave radar detection mode.
2780  * This is for 802.11h additional regulatory domains.
2781  */
2782 static void
2783 rt2661_radar_start(struct rt2661_softc *sc)
2784 {
2785 	uint32_t tmp;
2786 
2787 	/* disable Rx */
2788 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2789 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2790 
2791 	rt2661_bbp_write(sc, 82, 0x20);
2792 	rt2661_bbp_write(sc, 83, 0x00);
2793 	rt2661_bbp_write(sc, 84, 0x40);
2794 
2795 	/* save current BBP registers values */
2796 	sc->bbp18 = rt2661_bbp_read(sc, 18);
2797 	sc->bbp21 = rt2661_bbp_read(sc, 21);
2798 	sc->bbp22 = rt2661_bbp_read(sc, 22);
2799 	sc->bbp16 = rt2661_bbp_read(sc, 16);
2800 	sc->bbp17 = rt2661_bbp_read(sc, 17);
2801 	sc->bbp64 = rt2661_bbp_read(sc, 64);
2802 
2803 	rt2661_bbp_write(sc, 18, 0xff);
2804 	rt2661_bbp_write(sc, 21, 0x3f);
2805 	rt2661_bbp_write(sc, 22, 0x3f);
2806 	rt2661_bbp_write(sc, 16, 0xbd);
2807 	rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
2808 	rt2661_bbp_write(sc, 64, 0x21);
2809 
2810 	/* restore Rx filter */
2811 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2812 }
2813 
2814 static int
2815 rt2661_radar_stop(struct rt2661_softc *sc)
2816 {
2817 	uint8_t bbp66;
2818 
2819 	/* read radar detection result */
2820 	bbp66 = rt2661_bbp_read(sc, 66);
2821 
2822 	/* restore BBP registers values */
2823 	rt2661_bbp_write(sc, 16, sc->bbp16);
2824 	rt2661_bbp_write(sc, 17, sc->bbp17);
2825 	rt2661_bbp_write(sc, 18, sc->bbp18);
2826 	rt2661_bbp_write(sc, 21, sc->bbp21);
2827 	rt2661_bbp_write(sc, 22, sc->bbp22);
2828 	rt2661_bbp_write(sc, 64, sc->bbp64);
2829 
2830 	return bbp66 == 1;
2831 }
2832 #endif
2833 
2834 static int
2835 rt2661_prepare_beacon(struct rt2661_softc *sc)
2836 {
2837 	struct ieee80211com *ic = &sc->sc_ic;
2838 	struct ieee80211_beacon_offsets bo;
2839 	struct rt2661_tx_desc desc;
2840 	struct mbuf *m0;
2841 	int rate;
2842 
2843 	m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
2844 	if (m0 == NULL) {
2845 		device_printf(sc->sc_dev, "could not allocate beacon frame\n");
2846 		return ENOBUFS;
2847 	}
2848 
2849 	/* send beacons at the lowest available rate */
2850 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan) ? 12 : 2;
2851 
2852 	rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
2853 	    m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
2854 
2855 	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2856 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2857 
2858 	/* copy beacon header and payload into NIC memory */
2859 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
2860 	    mtod(m0, uint8_t *), m0->m_pkthdr.len);
2861 
2862 	m_freem(m0);
2863 	return 0;
2864 }
2865 
2866 /*
2867  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
2868  * and HostAP operating modes.
2869  */
2870 static void
2871 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
2872 {
2873 	struct ieee80211com *ic = &sc->sc_ic;
2874 	uint32_t tmp;
2875 
2876 	if (ic->ic_opmode != IEEE80211_M_STA) {
2877 		/*
2878 		 * Change default 16ms TBTT adjustment to 8ms.
2879 		 * Must be done before enabling beacon generation.
2880 		 */
2881 		RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
2882 	}
2883 
2884 	tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
2885 
2886 	/* set beacon interval (in 1/16ms unit) */
2887 	tmp |= ic->ic_bss->ni_intval * 16;
2888 
2889 	tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
2890 	if (ic->ic_opmode == IEEE80211_M_STA)
2891 		tmp |= RT2661_TSF_MODE(1);
2892 	else
2893 		tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
2894 
2895 	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
2896 }
2897 
2898 /*
2899  * Retrieve the "Received Signal Strength Indicator" from the raw values
2900  * contained in Rx descriptors.  The computation depends on which band the
2901  * frame was received.  Correction values taken from the reference driver.
2902  */
2903 static int
2904 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
2905 {
2906 	int lna, agc, rssi;
2907 
2908 	lna = (raw >> 5) & 0x3;
2909 	agc = raw & 0x1f;
2910 
2911 	rssi = 2 * agc;
2912 
2913 	if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
2914 		rssi += sc->rssi_2ghz_corr;
2915 
2916 		if (lna == 1)
2917 			rssi -= 64;
2918 		else if (lna == 2)
2919 			rssi -= 74;
2920 		else if (lna == 3)
2921 			rssi -= 90;
2922 	} else {
2923 		rssi += sc->rssi_5ghz_corr;
2924 
2925 		if (lna == 1)
2926 			rssi -= 64;
2927 		else if (lna == 2)
2928 			rssi -= 86;
2929 		else if (lna == 3)
2930 			rssi -= 100;
2931 	}
2932 	return rssi;
2933 }
2934 
2935 static void
2936 rt2661_dma_map_mbuf(void *arg, bus_dma_segment_t *seg, int nseg,
2937 		    bus_size_t map_size __unused, int error)
2938 {
2939 	struct rt2661_dmamap *map = arg;
2940 
2941 	if (error)
2942 		return;
2943 
2944 	KASSERT(nseg <= RT2661_MAX_SCATTER, ("too many DMA segments"));
2945 
2946 	bcopy(seg, map->segs, nseg * sizeof(bus_dma_segment_t));
2947 	map->nseg = nseg;
2948 }
2949