xref: /dflybsd-src/sys/dev/netif/ral/rt2661.c (revision 744c01d0dc2aa1481a40e5b0988d15691602f5c9)
1 /*
2  * Copyright (c) 2006
3  *	Damien Bergamini <damien.bergamini@free.fr>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  *
17  * $FreeBSD: src/sys/dev/ral/rt2661.c,v 1.4 2006/03/21 21:15:43 damien Exp $
18  * $DragonFly: src/sys/dev/netif/ral/rt2661.c,v 1.10 2007/01/02 23:28:49 swildner Exp $
19  */
20 
21 /*
22  * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
23  * http://www.ralinktech.com/
24  */
25 
26 #include <sys/param.h>
27 #include <sys/bus.h>
28 #include <sys/endian.h>
29 #include <sys/kernel.h>
30 #include <sys/malloc.h>
31 #include <sys/mbuf.h>
32 #include <sys/module.h>
33 #include <sys/queue.h>
34 #include <sys/rman.h>
35 #include <sys/socket.h>
36 #include <sys/sockio.h>
37 #include <sys/sysctl.h>
38 #include <sys/serialize.h>
39 
40 #include <net/bpf.h>
41 #include <net/if.h>
42 #include <net/if_arp.h>
43 #include <net/ethernet.h>
44 #include <net/if_dl.h>
45 #include <net/if_media.h>
46 #include <net/ifq_var.h>
47 
48 #include <netproto/802_11/ieee80211_var.h>
49 #include <netproto/802_11/ieee80211_radiotap.h>
50 
51 #include <dev/netif/ral/if_ralrate.h>
52 #include <dev/netif/ral/rt2661reg.h>
53 #include <dev/netif/ral/rt2661var.h>
54 #include <dev/netif/ral/rt2661_ucode.h>
55 
56 #ifdef RAL_DEBUG
57 #define DPRINTF(x)	do { if (ral_debug > 0) kprintf x; } while (0)
58 #define DPRINTFN(n, x)	do { if (ral_debug >= (n)) kprintf x; } while (0)
59 int ral_debug = 1;
60 SYSCTL_INT(_debug, OID_AUTO, ral, CTLFLAG_RW, &ral_debug, 0, "ral debug level");
61 #else
62 #define DPRINTF(x)
63 #define DPRINTFN(n, x)
64 #endif
65 
66 MALLOC_DEFINE(M_RT2661, "rt2661_ratectl", "rt2661 rate control data");
67 
68 static void		rt2661_dma_map_addr(void *, bus_dma_segment_t *, int,
69 			    int);
70 static void		rt2661_dma_map_mbuf(void *, bus_dma_segment_t *, int,
71 					    bus_size_t, int);
72 static int		rt2661_alloc_tx_ring(struct rt2661_softc *,
73 			    struct rt2661_tx_ring *, int);
74 static void		rt2661_reset_tx_ring(struct rt2661_softc *,
75 			    struct rt2661_tx_ring *);
76 static void		rt2661_free_tx_ring(struct rt2661_softc *,
77 			    struct rt2661_tx_ring *);
78 static int		rt2661_alloc_rx_ring(struct rt2661_softc *,
79 			    struct rt2661_rx_ring *, int);
80 static void		rt2661_reset_rx_ring(struct rt2661_softc *,
81 			    struct rt2661_rx_ring *);
82 static void		rt2661_free_rx_ring(struct rt2661_softc *,
83 			    struct rt2661_rx_ring *);
84 static struct		ieee80211_node *rt2661_node_alloc(
85 			    struct ieee80211_node_table *);
86 static int		rt2661_media_change(struct ifnet *);
87 static void		rt2661_next_scan(void *);
88 static int		rt2661_newstate(struct ieee80211com *,
89 			    enum ieee80211_state, int);
90 static uint16_t		rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
91 static void		rt2661_rx_intr(struct rt2661_softc *);
92 static void		rt2661_tx_intr(struct rt2661_softc *);
93 static void		rt2661_tx_dma_intr(struct rt2661_softc *,
94 			    struct rt2661_tx_ring *);
95 static void		rt2661_mcu_beacon_expire(struct rt2661_softc *);
96 static void		rt2661_mcu_wakeup(struct rt2661_softc *);
97 static void		rt2661_mcu_cmd_intr(struct rt2661_softc *);
98 static int		rt2661_ack_rate(struct ieee80211com *, int);
99 static uint16_t		rt2661_txtime(int, int, uint32_t);
100 static uint8_t		rt2661_rxrate(struct rt2661_rx_desc *);
101 static uint8_t		rt2661_plcp_signal(int);
102 static void		rt2661_setup_tx_desc(struct rt2661_softc *,
103 			    struct rt2661_tx_desc *, uint32_t, uint16_t, int,
104 			    int, const bus_dma_segment_t *, int, int, int);
105 static struct mbuf *	rt2661_get_rts(struct rt2661_softc *,
106 			    struct ieee80211_frame *, uint16_t);
107 static int		rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
108 			    struct ieee80211_node *, int);
109 static int		rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
110 			    struct ieee80211_node *);
111 static void		rt2661_start(struct ifnet *);
112 static void		rt2661_watchdog(struct ifnet *);
113 static int		rt2661_reset(struct ifnet *);
114 static int		rt2661_ioctl(struct ifnet *, u_long, caddr_t,
115 				     struct ucred *);
116 static void		rt2661_bbp_write(struct rt2661_softc *, uint8_t,
117 			    uint8_t);
118 static uint8_t		rt2661_bbp_read(struct rt2661_softc *, uint8_t);
119 static void		rt2661_rf_write(struct rt2661_softc *, uint8_t,
120 			    uint32_t);
121 static int		rt2661_tx_cmd(struct rt2661_softc *, uint8_t,
122 			    uint16_t);
123 static void		rt2661_select_antenna(struct rt2661_softc *);
124 static void		rt2661_enable_mrr(struct rt2661_softc *);
125 static void		rt2661_set_txpreamble(struct rt2661_softc *);
126 static void		rt2661_set_basicrates(struct rt2661_softc *,
127 			    const struct ieee80211_rateset *);
128 static void		rt2661_select_band(struct rt2661_softc *,
129 			    struct ieee80211_channel *);
130 static void		rt2661_set_chan(struct rt2661_softc *,
131 			    struct ieee80211_channel *);
132 static void		rt2661_set_bssid(struct rt2661_softc *,
133 			    const uint8_t *);
134 static void		rt2661_set_macaddr(struct rt2661_softc *,
135 			   const uint8_t *);
136 static void		rt2661_update_promisc(struct rt2661_softc *);
137 static int		rt2661_wme_update(struct ieee80211com *) __unused;
138 static void		rt2661_update_slot(struct ifnet *);
139 static const char	*rt2661_get_rf(int);
140 static void		rt2661_read_eeprom(struct rt2661_softc *);
141 static int		rt2661_bbp_init(struct rt2661_softc *);
142 static void		rt2661_init(void *);
143 static void		rt2661_stop(void *);
144 static void		rt2661_intr(void *);
145 static int		rt2661_load_microcode(struct rt2661_softc *,
146 			    const uint8_t *, int);
147 #ifdef notyet
148 static void		rt2661_rx_tune(struct rt2661_softc *);
149 static void		rt2661_radar_start(struct rt2661_softc *);
150 static int		rt2661_radar_stop(struct rt2661_softc *);
151 #endif
152 static int		rt2661_prepare_beacon(struct rt2661_softc *);
153 static void		rt2661_enable_tsf_sync(struct rt2661_softc *);
154 static int		rt2661_get_rssi(struct rt2661_softc *, uint8_t);
155 static void		rt2661_led_newstate(struct rt2661_softc *,
156 					    enum ieee80211_state);
157 
158 /*
159  * Supported rates for 802.11a/b/g modes (in 500Kbps unit).
160  */
161 static const struct ieee80211_rateset rt2661_rateset_11a =
162 	{ 8, { 12, 18, 24, 36, 48, 72, 96, 108 } };
163 
164 static const struct ieee80211_rateset rt2661_rateset_11b =
165 	{ 4, { 2, 4, 11, 22 } };
166 
167 static const struct ieee80211_rateset rt2661_rateset_11g =
168 	{ 12, { 2, 4, 11, 22, 12, 18, 24, 36, 48, 72, 96, 108 } };
169 
170 static const struct {
171 	uint32_t	reg;
172 	uint32_t	val;
173 } rt2661_def_mac[] = {
174 	RT2661_DEF_MAC
175 };
176 
177 static const struct {
178 	uint8_t	reg;
179 	uint8_t	val;
180 } rt2661_def_bbp[] = {
181 	RT2661_DEF_BBP
182 };
183 
184 static const struct rfprog {
185 	uint8_t		chan;
186 	uint32_t	r1, r2, r3, r4;
187 }  rt2661_rf5225_1[] = {
188 	RT2661_RF5225_1
189 }, rt2661_rf5225_2[] = {
190 	RT2661_RF5225_2
191 };
192 
193 #define LED_EE2MCU(bit)	{ \
194 	.ee_bit		= RT2661_EE_LED_##bit, \
195 	.mcu_bit	= RT2661_MCU_LED_##bit \
196 }
197 static const struct {
198 	uint16_t	ee_bit;
199 	uint16_t	mcu_bit;
200 } led_ee2mcu[] = {
201 	LED_EE2MCU(RDYG),
202 	LED_EE2MCU(RDYA),
203 	LED_EE2MCU(ACT),
204 	LED_EE2MCU(GPIO0),
205 	LED_EE2MCU(GPIO1),
206 	LED_EE2MCU(GPIO2),
207 	LED_EE2MCU(GPIO3),
208 	LED_EE2MCU(GPIO4)
209 };
210 #undef LED_EE2MCU
211 
212 struct rt2661_dmamap {
213 	bus_dma_segment_t	segs[RT2661_MAX_SCATTER];
214 	int			nseg;
215 };
216 
217 int
218 rt2661_attach(device_t dev, int id)
219 {
220 	struct rt2661_softc *sc = device_get_softc(dev);
221 	struct ieee80211com *ic = &sc->sc_ic;
222 	struct ifnet *ifp = &ic->ic_if;
223 	uint32_t val;
224 	const uint8_t *ucode = NULL;
225 	int error, i, ac, ntries, size = 0;
226 
227 	callout_init(&sc->scan_ch);
228 	callout_init(&sc->rssadapt_ch);
229 
230 	sc->sc_irq_rid = 0;
231 	sc->sc_irq = bus_alloc_resource_any(dev, SYS_RES_IRQ, &sc->sc_irq_rid,
232 					    RF_ACTIVE | RF_SHAREABLE);
233 	if (sc->sc_irq == NULL) {
234 		device_printf(dev, "could not allocate interrupt resource\n");
235 		return ENXIO;
236 	}
237 
238 	/* wait for NIC to initialize */
239 	for (ntries = 0; ntries < 1000; ntries++) {
240 		if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
241 			break;
242 		DELAY(1000);
243 	}
244 	if (ntries == 1000) {
245 		device_printf(sc->sc_dev,
246 		    "timeout waiting for NIC to initialize\n");
247 		error = EIO;
248 		goto fail;
249 	}
250 
251 	/* retrieve RF rev. no and various other things from EEPROM */
252 	rt2661_read_eeprom(sc);
253 
254 	device_printf(dev, "MAC/BBP RT%X, RF %s\n", val,
255 	    rt2661_get_rf(sc->rf_rev));
256 
257 	/*
258 	 * Load 8051 microcode into NIC.
259 	 */
260 	switch (id) {
261 	case 0x0301:
262 		ucode = rt2561s_ucode;
263 		size = sizeof rt2561s_ucode;
264 		break;
265 	case 0x0302:
266 		ucode = rt2561_ucode;
267 		size = sizeof rt2561_ucode;
268 		break;
269 	case 0x0401:
270 		ucode = rt2661_ucode;
271 		size = sizeof rt2661_ucode;
272 		break;
273 	}
274 
275 	error = rt2661_load_microcode(sc, ucode, size);
276 	if (error != 0) {
277 		device_printf(sc->sc_dev, "could not load 8051 microcode\n");
278 		goto fail;
279 	}
280 
281 	/*
282 	 * Allocate Tx and Rx rings.
283 	 */
284 	for (ac = 0; ac < 4; ac++) {
285 		error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
286 		    RT2661_TX_RING_COUNT);
287 		if (error != 0) {
288 			device_printf(sc->sc_dev,
289 			    "could not allocate Tx ring %d\n", ac);
290 			goto fail;
291 		}
292 	}
293 
294 	error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
295 	if (error != 0) {
296 		device_printf(sc->sc_dev, "could not allocate Mgt ring\n");
297 		goto fail;
298 	}
299 
300 	error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
301 	if (error != 0) {
302 		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
303 		goto fail;
304 	}
305 
306 	STAILQ_INIT(&sc->tx_ratectl);
307 
308 	sysctl_ctx_init(&sc->sysctl_ctx);
309 	sc->sysctl_tree = SYSCTL_ADD_NODE(&sc->sysctl_ctx,
310 					  SYSCTL_STATIC_CHILDREN(_hw),
311 					  OID_AUTO,
312 					  device_get_nameunit(dev),
313 					  CTLFLAG_RD, 0, "");
314 	if (sc->sysctl_tree == NULL) {
315 		device_printf(dev, "could not add sysctl node\n");
316 		error = ENXIO;
317 		goto fail;
318 	}
319 
320 	ifp->if_softc = sc;
321 	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
322 	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
323 	ifp->if_init = rt2661_init;
324 	ifp->if_ioctl = rt2661_ioctl;
325 	ifp->if_start = rt2661_start;
326 	ifp->if_watchdog = rt2661_watchdog;
327 	ifq_set_maxlen(&ifp->if_snd, IFQ_MAXLEN);
328 	ifq_set_ready(&ifp->if_snd);
329 
330 	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
331 	ic->ic_opmode = IEEE80211_M_STA; /* default to BSS mode */
332 	ic->ic_state = IEEE80211_S_INIT;
333 	rt2661_led_newstate(sc, IEEE80211_S_INIT);
334 
335 	/* set device capabilities */
336 	ic->ic_caps =
337 	    IEEE80211_C_IBSS |		/* IBSS mode supported */
338 	    IEEE80211_C_MONITOR |	/* monitor mode supported */
339 	    IEEE80211_C_HOSTAP |	/* HostAp mode supported */
340 	    IEEE80211_C_TXPMGT |	/* tx power management */
341 	    IEEE80211_C_SHPREAMBLE |	/* short preamble supported */
342 	    IEEE80211_C_SHSLOT |	/* short slot time supported */
343 #ifdef notyet
344 	    IEEE80211_C_WME |		/* 802.11e */
345 #endif
346 	    IEEE80211_C_WEP |		/* WEP */
347 	    IEEE80211_C_WPA;		/* 802.11i */
348 
349 	if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325) {
350 		/* set supported .11a rates */
351 		ic->ic_sup_rates[IEEE80211_MODE_11A] = rt2661_rateset_11a;
352 
353 		/* set supported .11a channels */
354 		for (i = 36; i <= 64; i += 4) {
355 			ic->ic_channels[i].ic_freq =
356 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
357 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
358 		}
359 		for (i = 100; i <= 140; i += 4) {
360 			ic->ic_channels[i].ic_freq =
361 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
362 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
363 		}
364 		for (i = 149; i <= 165; i += 4) {
365 			ic->ic_channels[i].ic_freq =
366 			    ieee80211_ieee2mhz(i, IEEE80211_CHAN_5GHZ);
367 			ic->ic_channels[i].ic_flags = IEEE80211_CHAN_A;
368 		}
369 	}
370 
371 	/* set supported .11b and .11g rates */
372 	ic->ic_sup_rates[IEEE80211_MODE_11B] = rt2661_rateset_11b;
373 	ic->ic_sup_rates[IEEE80211_MODE_11G] = rt2661_rateset_11g;
374 
375 	/* set supported .11b and .11g channels (1 through 14) */
376 	for (i = 1; i <= 14; i++) {
377 		ic->ic_channels[i].ic_freq =
378 		    ieee80211_ieee2mhz(i, IEEE80211_CHAN_2GHZ);
379 		ic->ic_channels[i].ic_flags =
380 		    IEEE80211_CHAN_CCK | IEEE80211_CHAN_OFDM |
381 		    IEEE80211_CHAN_DYN | IEEE80211_CHAN_2GHZ;
382 	}
383 
384 	ieee80211_ifattach(ic);
385 	ic->ic_node_alloc = rt2661_node_alloc;
386 /*	ic->ic_wme.wme_update = rt2661_wme_update;*/
387 	ic->ic_updateslot = rt2661_update_slot;
388 	ic->ic_reset = rt2661_reset;
389 	/* enable s/w bmiss handling in sta mode */
390 	ic->ic_flags_ext |= IEEE80211_FEXT_SWBMISS;
391 
392 	/* override state transition machine */
393 	sc->sc_newstate = ic->ic_newstate;
394 	ic->ic_newstate = rt2661_newstate;
395 	ieee80211_media_init(ic, rt2661_media_change, ieee80211_media_status);
396 
397 	bpfattach_dlt(ifp, DLT_IEEE802_11_RADIO,
398 	    sizeof (struct ieee80211_frame) + 64, &sc->sc_drvbpf);
399 
400 	sc->sc_rxtap_len = sizeof sc->sc_rxtapu;
401 	sc->sc_rxtap.wr_ihdr.it_len = htole16(sc->sc_rxtap_len);
402 	sc->sc_rxtap.wr_ihdr.it_present = htole32(RT2661_RX_RADIOTAP_PRESENT);
403 
404 	sc->sc_txtap_len = sizeof sc->sc_txtapu;
405 	sc->sc_txtap.wt_ihdr.it_len = htole16(sc->sc_txtap_len);
406 	sc->sc_txtap.wt_ihdr.it_present = htole32(RT2661_TX_RADIOTAP_PRESENT);
407 
408 	/*
409 	 * Add a few sysctl knobs.
410 	 */
411 	sc->dwelltime = 200;
412 
413 	SYSCTL_ADD_INT(&sc->sysctl_ctx,
414 	    SYSCTL_CHILDREN(sc->sysctl_tree), OID_AUTO, "dwell",
415 	    CTLFLAG_RW, &sc->dwelltime, 0,
416 	    "channel dwell time (ms) for AP/station scanning");
417 
418 	error = bus_setup_intr(dev, sc->sc_irq, INTR_MPSAFE, rt2661_intr,
419 			       sc, &sc->sc_ih, ifp->if_serializer);
420 	if (error != 0) {
421 		device_printf(dev, "could not set up interrupt\n");
422 		bpfdetach(ifp);
423 		ieee80211_ifdetach(ic);
424 		goto fail;
425 	}
426 
427 	if (bootverbose)
428 		ieee80211_announce(ic);
429 	return 0;
430 fail:
431 	rt2661_detach(sc);
432 	return error;
433 }
434 
435 int
436 rt2661_detach(void *xsc)
437 {
438 	struct rt2661_softc *sc = xsc;
439 	struct ieee80211com *ic = &sc->sc_ic;
440 	struct ifnet *ifp = &ic->ic_if;
441 
442 	if (device_is_attached(sc->sc_dev)) {
443 		lwkt_serialize_enter(ifp->if_serializer);
444 
445 		callout_stop(&sc->scan_ch);
446 		callout_stop(&sc->rssadapt_ch);
447 		rt2661_stop(sc);
448 		bus_teardown_intr(sc->sc_dev, sc->sc_irq, sc->sc_ih);
449 
450 		lwkt_serialize_exit(ifp->if_serializer);
451 
452 		bpfdetach(ifp);
453 		ieee80211_ifdetach(ic);
454 	}
455 
456 	rt2661_free_tx_ring(sc, &sc->txq[0]);
457 	rt2661_free_tx_ring(sc, &sc->txq[1]);
458 	rt2661_free_tx_ring(sc, &sc->txq[2]);
459 	rt2661_free_tx_ring(sc, &sc->txq[3]);
460 	rt2661_free_tx_ring(sc, &sc->mgtq);
461 	rt2661_free_rx_ring(sc, &sc->rxq);
462 
463 	if (sc->sc_irq != NULL) {
464 		bus_release_resource(sc->sc_dev, SYS_RES_IRQ, sc->sc_irq_rid,
465 				     sc->sc_irq);
466 	}
467 
468 	if (sc->sysctl_tree != NULL)
469 		sysctl_ctx_free(&sc->sysctl_ctx);
470 
471 	return 0;
472 }
473 
474 void
475 rt2661_shutdown(void *xsc)
476 {
477 	struct rt2661_softc *sc = xsc;
478 	struct ifnet *ifp = &sc->sc_ic.ic_if;
479 
480 	lwkt_serialize_enter(ifp->if_serializer);
481 	rt2661_stop(sc);
482 	lwkt_serialize_exit(ifp->if_serializer);
483 }
484 
485 void
486 rt2661_suspend(void *xsc)
487 {
488 	struct rt2661_softc *sc = xsc;
489 	struct ifnet *ifp = &sc->sc_ic.ic_if;
490 
491 	lwkt_serialize_enter(ifp->if_serializer);
492 	rt2661_stop(sc);
493 	lwkt_serialize_exit(ifp->if_serializer);
494 }
495 
496 void
497 rt2661_resume(void *xsc)
498 {
499 	struct rt2661_softc *sc = xsc;
500 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
501 
502 	lwkt_serialize_enter(ifp->if_serializer);
503 	if (ifp->if_flags & IFF_UP) {
504 		ifp->if_init(ifp->if_softc);
505 		if (ifp->if_flags & IFF_RUNNING)
506 			ifp->if_start(ifp);
507 	}
508 	lwkt_serialize_exit(ifp->if_serializer);
509 }
510 
511 static void
512 rt2661_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
513 {
514 	if (error != 0)
515 		return;
516 
517 	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
518 
519 	*(bus_addr_t *)arg = segs[0].ds_addr;
520 }
521 
522 static int
523 rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
524     int count)
525 {
526 	int i, error;
527 
528 	ring->count = count;
529 	ring->queued = 0;
530 	ring->cur = ring->next = 0;
531 
532 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
533 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2661_TX_DESC_SIZE, 1,
534 	    count * RT2661_TX_DESC_SIZE, 0, &ring->desc_dmat);
535 	if (error != 0) {
536 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
537 		goto fail;
538 	}
539 
540 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
541 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
542 	if (error != 0) {
543 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
544 		goto fail;
545 	}
546 
547 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
548 	    count * RT2661_TX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
549 	    0);
550 	if (error != 0) {
551 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
552 
553 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
554 		ring->desc = NULL;
555 		goto fail;
556 	}
557 
558 	ring->data = kmalloc(count * sizeof (struct rt2661_data), M_DEVBUF,
559 	    M_WAITOK | M_ZERO);
560 
561 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
562 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES * RT2661_MAX_SCATTER,
563 	    RT2661_MAX_SCATTER, MCLBYTES, 0, &ring->data_dmat);
564 	if (error != 0) {
565 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
566 		goto fail;
567 	}
568 
569 	for (i = 0; i < count; i++) {
570 		error = bus_dmamap_create(ring->data_dmat, 0,
571 		    &ring->data[i].map);
572 		if (error != 0) {
573 			device_printf(sc->sc_dev, "could not create DMA map\n");
574 			goto fail;
575 		}
576 	}
577 	return 0;
578 
579 fail:	rt2661_free_tx_ring(sc, ring);
580 	return error;
581 }
582 
583 static void
584 rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
585 {
586 	struct rt2661_tx_desc *desc;
587 	struct rt2661_data *data;
588 	int i;
589 
590 	for (i = 0; i < ring->count; i++) {
591 		desc = &ring->desc[i];
592 		data = &ring->data[i];
593 
594 		if (data->m != NULL) {
595 			bus_dmamap_sync(ring->data_dmat, data->map,
596 			    BUS_DMASYNC_POSTWRITE);
597 			bus_dmamap_unload(ring->data_dmat, data->map);
598 			m_freem(data->m);
599 			data->m = NULL;
600 		}
601 
602 		desc->flags = 0;
603 	}
604 
605 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
606 
607 	ring->queued = 0;
608 	ring->cur = ring->next = 0;
609 }
610 
611 static void
612 rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
613 {
614 	struct rt2661_data *data;
615 	int i;
616 
617 	if (ring->desc != NULL) {
618 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
619 		    BUS_DMASYNC_POSTWRITE);
620 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
621 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
622 		ring->desc = NULL;
623 	}
624 
625 	if (ring->desc_dmat != NULL) {
626 		bus_dma_tag_destroy(ring->desc_dmat);
627 		ring->desc_dmat = NULL;
628 	}
629 
630 	if (ring->data != NULL) {
631 		for (i = 0; i < ring->count; i++) {
632 			data = &ring->data[i];
633 
634 			if (data->m != NULL) {
635 				bus_dmamap_sync(ring->data_dmat, data->map,
636 				    BUS_DMASYNC_POSTWRITE);
637 				bus_dmamap_unload(ring->data_dmat, data->map);
638 				m_freem(data->m);
639 				data->m = NULL;
640 			}
641 
642 			if (data->map != NULL) {
643 				bus_dmamap_destroy(ring->data_dmat, data->map);
644 				data->map = NULL;
645 			}
646 		}
647 
648 		kfree(ring->data, M_DEVBUF);
649 		ring->data = NULL;
650 	}
651 
652 	if (ring->data_dmat != NULL) {
653 		bus_dma_tag_destroy(ring->data_dmat);
654 		ring->data_dmat = NULL;
655 	}
656 }
657 
658 static int
659 rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
660     int count)
661 {
662 	struct rt2661_rx_desc *desc;
663 	struct rt2661_data *data;
664 	bus_addr_t physaddr;
665 	int i, error;
666 
667 	ring->count = count;
668 	ring->cur = ring->next = 0;
669 
670 	error = bus_dma_tag_create(NULL, 4, 0, BUS_SPACE_MAXADDR_32BIT,
671 	    BUS_SPACE_MAXADDR, NULL, NULL, count * RT2661_RX_DESC_SIZE, 1,
672 	    count * RT2661_RX_DESC_SIZE, 0, &ring->desc_dmat);
673 	if (error != 0) {
674 		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
675 		goto fail;
676 	}
677 
678 	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
679 	    BUS_DMA_WAITOK | BUS_DMA_ZERO, &ring->desc_map);
680 	if (error != 0) {
681 		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
682 		goto fail;
683 	}
684 
685 	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
686 	    count * RT2661_RX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
687 	    0);
688 	if (error != 0) {
689 		device_printf(sc->sc_dev, "could not load desc DMA map\n");
690 
691 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
692 		ring->desc = NULL;
693 		goto fail;
694 	}
695 
696 	ring->data = kmalloc(count * sizeof (struct rt2661_data), M_DEVBUF,
697 	    M_WAITOK | M_ZERO);
698 
699 	/*
700 	 * Pre-allocate Rx buffers and populate Rx ring.
701 	 */
702 	error = bus_dma_tag_create(NULL, 1, 0, BUS_SPACE_MAXADDR_32BIT,
703 	    BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES, 1, MCLBYTES, 0,
704 	    &ring->data_dmat);
705 	if (error != 0) {
706 		device_printf(sc->sc_dev, "could not create data DMA tag\n");
707 		goto fail;
708 	}
709 
710 	for (i = 0; i < count; i++) {
711 		desc = &sc->rxq.desc[i];
712 		data = &sc->rxq.data[i];
713 
714 		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
715 		if (error != 0) {
716 			device_printf(sc->sc_dev, "could not create DMA map\n");
717 			goto fail;
718 		}
719 
720 		data->m = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
721 		if (data->m == NULL) {
722 			device_printf(sc->sc_dev,
723 			    "could not allocate rx mbuf\n");
724 			error = ENOMEM;
725 			goto fail;
726 		}
727 
728 		error = bus_dmamap_load(ring->data_dmat, data->map,
729 		    mtod(data->m, void *), MCLBYTES, rt2661_dma_map_addr,
730 		    &physaddr, 0);
731 		if (error != 0) {
732 			device_printf(sc->sc_dev,
733 			    "could not load rx buf DMA map");
734 
735 			m_freem(data->m);
736 			data->m = NULL;
737 			goto fail;
738 		}
739 
740 		desc->flags = htole32(RT2661_RX_BUSY);
741 		desc->physaddr = htole32(physaddr);
742 	}
743 
744 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
745 
746 	return 0;
747 
748 fail:	rt2661_free_rx_ring(sc, ring);
749 	return error;
750 }
751 
752 static void
753 rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
754 {
755 	int i;
756 
757 	for (i = 0; i < ring->count; i++)
758 		ring->desc[i].flags = htole32(RT2661_RX_BUSY);
759 
760 	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
761 
762 	ring->cur = ring->next = 0;
763 }
764 
765 static void
766 rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
767 {
768 	struct rt2661_data *data;
769 	int i;
770 
771 	if (ring->desc != NULL) {
772 		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
773 		    BUS_DMASYNC_POSTWRITE);
774 		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
775 		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
776 		ring->desc = NULL;
777 	}
778 
779 	if (ring->desc_dmat != NULL) {
780 		bus_dma_tag_destroy(ring->desc_dmat);
781 		ring->desc_dmat = NULL;
782 	}
783 
784 	if (ring->data != NULL) {
785 		for (i = 0; i < ring->count; i++) {
786 			data = &ring->data[i];
787 
788 			if (data->m != NULL) {
789 				bus_dmamap_sync(ring->data_dmat, data->map,
790 				    BUS_DMASYNC_POSTREAD);
791 				bus_dmamap_unload(ring->data_dmat, data->map);
792 				m_freem(data->m);
793 				data->m = NULL;
794 			}
795 
796 			if (data->map != NULL) {
797 				bus_dmamap_destroy(ring->data_dmat, data->map);
798 				data->map = NULL;
799 			}
800 		}
801 
802 		kfree(ring->data, M_DEVBUF);
803 		ring->data = NULL;
804 	}
805 
806 	if (ring->data_dmat != NULL) {
807 		bus_dma_tag_destroy(ring->data_dmat);
808 		ring->data_dmat = NULL;
809 	}
810 }
811 
812 static struct ieee80211_node *
813 rt2661_node_alloc(struct ieee80211_node_table *nt)
814 {
815 	struct rt2661_node *rn;
816 
817 	rn = kmalloc(sizeof (struct rt2661_node), M_80211_NODE,
818 	    M_NOWAIT | M_ZERO);
819 
820 	return (rn != NULL) ? &rn->ni : NULL;
821 }
822 
823 static int
824 rt2661_media_change(struct ifnet *ifp)
825 {
826 	struct rt2661_softc *sc = ifp->if_softc;
827 	int error;
828 
829 	error = ieee80211_media_change(ifp);
830 	if (error != ENETRESET)
831 		return error;
832 
833 	if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) == (IFF_UP | IFF_RUNNING))
834 		rt2661_init(sc);
835 	return 0;
836 }
837 
838 /*
839  * This function is called periodically (every 200ms) during scanning to
840  * switch from one channel to another.
841  */
842 static void
843 rt2661_next_scan(void *arg)
844 {
845 	struct rt2661_softc *sc = arg;
846 	struct ieee80211com *ic = &sc->sc_ic;
847 	struct ifnet *ifp = &ic->ic_if;
848 
849 	lwkt_serialize_enter(ifp->if_serializer);
850 	if (ic->ic_state == IEEE80211_S_SCAN)
851 		ieee80211_next_scan(ic);
852 	lwkt_serialize_exit(ifp->if_serializer);
853 }
854 
855 /*
856  * This function is called for each node present in the node station table.
857  */
858 static void
859 rt2661_iter_func(void *arg, struct ieee80211_node *ni)
860 {
861 	struct rt2661_node *rn = (struct rt2661_node *)ni;
862 
863 	ral_rssadapt_updatestats(&rn->rssadapt);
864 }
865 
866 /*
867  * This function is called periodically (every 100ms) in RUN state to update
868  * the rate adaptation statistics.
869  */
870 static void
871 rt2661_update_rssadapt(void *arg)
872 {
873 	struct rt2661_softc *sc = arg;
874 	struct ieee80211com *ic = &sc->sc_ic;
875 	struct ifnet *ifp = &ic->ic_if;
876 
877 	lwkt_serialize_enter(ifp->if_serializer);
878 
879 	ieee80211_iterate_nodes(&ic->ic_sta, rt2661_iter_func, arg);
880 	callout_reset(&sc->rssadapt_ch, hz / 10, rt2661_update_rssadapt, sc);
881 
882 	lwkt_serialize_exit(ifp->if_serializer);
883 }
884 
885 static int
886 rt2661_newstate(struct ieee80211com *ic, enum ieee80211_state nstate, int arg)
887 {
888 	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
889 	enum ieee80211_state ostate;
890 	struct ieee80211_node *ni;
891 	uint32_t tmp;
892 	int error = 0;
893 
894 	ostate = ic->ic_state;
895 	callout_stop(&sc->scan_ch);
896 
897 	if (ostate != nstate)
898 		rt2661_led_newstate(sc, nstate);
899 
900 	switch (nstate) {
901 	case IEEE80211_S_INIT:
902 		callout_stop(&sc->rssadapt_ch);
903 
904 		if (ostate == IEEE80211_S_RUN) {
905 			/* abort TSF synchronization */
906 			tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
907 			RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
908 		}
909 		break;
910 
911 	case IEEE80211_S_SCAN:
912 		rt2661_set_chan(sc, ic->ic_curchan);
913 		callout_reset(&sc->scan_ch, (sc->dwelltime * hz) / 1000,
914 		    rt2661_next_scan, sc);
915 		break;
916 
917 	case IEEE80211_S_AUTH:
918 	case IEEE80211_S_ASSOC:
919 		rt2661_set_chan(sc, ic->ic_curchan);
920 		break;
921 
922 	case IEEE80211_S_RUN:
923 		rt2661_set_chan(sc, ic->ic_curchan);
924 
925 		ni = ic->ic_bss;
926 
927 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
928 			rt2661_enable_mrr(sc);
929 			rt2661_set_txpreamble(sc);
930 			rt2661_set_basicrates(sc, &ni->ni_rates);
931 			rt2661_set_bssid(sc, ni->ni_bssid);
932 		}
933 
934 		if (ic->ic_opmode == IEEE80211_M_HOSTAP ||
935 		    ic->ic_opmode == IEEE80211_M_IBSS) {
936 			if ((error = rt2661_prepare_beacon(sc)) != 0)
937 				break;
938 		}
939 
940 		if (ic->ic_opmode != IEEE80211_M_MONITOR) {
941 			callout_reset(&sc->rssadapt_ch, hz / 10,
942 			    rt2661_update_rssadapt, sc);
943 			rt2661_enable_tsf_sync(sc);
944 		}
945 		break;
946 	}
947 
948 	return (error != 0) ? error : sc->sc_newstate(ic, nstate, arg);
949 }
950 
951 /*
952  * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
953  * 93C66).
954  */
955 static uint16_t
956 rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
957 {
958 	uint32_t tmp;
959 	uint16_t val;
960 	int n;
961 
962 	/* clock C once before the first command */
963 	RT2661_EEPROM_CTL(sc, 0);
964 
965 	RT2661_EEPROM_CTL(sc, RT2661_S);
966 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
967 	RT2661_EEPROM_CTL(sc, RT2661_S);
968 
969 	/* write start bit (1) */
970 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
971 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
972 
973 	/* write READ opcode (10) */
974 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
975 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
976 	RT2661_EEPROM_CTL(sc, RT2661_S);
977 	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
978 
979 	/* write address (A5-A0 or A7-A0) */
980 	n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
981 	for (; n >= 0; n--) {
982 		RT2661_EEPROM_CTL(sc, RT2661_S |
983 		    (((addr >> n) & 1) << RT2661_SHIFT_D));
984 		RT2661_EEPROM_CTL(sc, RT2661_S |
985 		    (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
986 	}
987 
988 	RT2661_EEPROM_CTL(sc, RT2661_S);
989 
990 	/* read data Q15-Q0 */
991 	val = 0;
992 	for (n = 15; n >= 0; n--) {
993 		RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
994 		tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
995 		val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
996 		RT2661_EEPROM_CTL(sc, RT2661_S);
997 	}
998 
999 	RT2661_EEPROM_CTL(sc, 0);
1000 
1001 	/* clear Chip Select and clock C */
1002 	RT2661_EEPROM_CTL(sc, RT2661_S);
1003 	RT2661_EEPROM_CTL(sc, 0);
1004 	RT2661_EEPROM_CTL(sc, RT2661_C);
1005 
1006 	return val;
1007 }
1008 
1009 static void
1010 rt2661_tx_intr(struct rt2661_softc *sc)
1011 {
1012 	struct ieee80211com *ic = &sc->sc_ic;
1013 	struct ifnet *ifp = ic->ic_ifp;
1014 	struct rt2661_tx_ratectl *rctl;
1015 	struct rt2661_node *rn;
1016 	uint32_t val, result;
1017 	int retrycnt;
1018 
1019 	for (;;) {
1020 		val = RAL_READ(sc, RT2661_STA_CSR4);
1021 		if (!(val & RT2661_TX_STAT_VALID))
1022 			break;
1023 
1024 		/* Gather statistics */
1025 		result = RT2661_TX_RESULT(val);
1026 		if (result == RT2661_TX_SUCCESS)
1027 			ifp->if_opackets++;
1028 		else
1029 			ifp->if_oerrors++;
1030 
1031 		/* No rate control */
1032 		if (RT2661_TX_QID(val) == 0)
1033 			continue;
1034 
1035 		/* retrieve rate control algorithm context */
1036 		rctl = STAILQ_FIRST(&sc->tx_ratectl);
1037 		if (rctl == NULL) {
1038 			/*
1039 			 * XXX
1040 			 * This really should not happen.  Maybe we should
1041 			 * use assertion here?  But why should we rely on
1042 			 * hardware to do the correct things?  Even the
1043 			 * reference driver (RT61?) provided by Ralink does
1044 			 * not provide enough clue that this kind of interrupt
1045 			 * is promised to be generated for each packet.  So
1046 			 * just print a message and keep going ...
1047 			 */
1048 			if_printf(ifp, "WARNING: no rate control information\n");
1049 			continue;
1050 		}
1051 		STAILQ_REMOVE_HEAD(&sc->tx_ratectl, link);
1052 
1053 		rn = (struct rt2661_node *)rctl->ni;
1054 
1055 		switch (result) {
1056 		case RT2661_TX_SUCCESS:
1057 			retrycnt = RT2661_TX_RETRYCNT(val);
1058 
1059 			DPRINTFN(10, ("data frame sent successfully after "
1060 			    "%d retries\n", retrycnt));
1061 			if (retrycnt == 0 && rctl->id.id_node != NULL) {
1062 				ral_rssadapt_raise_rate(ic, &rn->rssadapt,
1063 				    &rctl->id);
1064 			}
1065 			break;
1066 
1067 		case RT2661_TX_RETRY_FAIL:
1068 			DPRINTFN(9, ("sending data frame failed (too much "
1069 			    "retries)\n"));
1070 			if (rctl->id.id_node != NULL) {
1071 				ral_rssadapt_lower_rate(ic, rctl->ni,
1072 				    &rn->rssadapt, &rctl->id);
1073 			}
1074 			break;
1075 
1076 		default:
1077 			/* other failure */
1078 			device_printf(sc->sc_dev,
1079 			    "sending data frame failed 0x%08x\n", val);
1080 			break;
1081 		}
1082 
1083 		ieee80211_free_node(rctl->ni);
1084 		rctl->ni = NULL;
1085 		kfree(rctl, M_RT2661);
1086 	}
1087 }
1088 
1089 static void
1090 rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
1091 {
1092 	struct rt2661_tx_desc *desc;
1093 	struct rt2661_data *data;
1094 
1095 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_POSTREAD);
1096 
1097 	for (;;) {
1098 		desc = &txq->desc[txq->next];
1099 		data = &txq->data[txq->next];
1100 
1101 		if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
1102 		    !(le32toh(desc->flags) & RT2661_TX_VALID))
1103 			break;
1104 
1105 		bus_dmamap_sync(txq->data_dmat, data->map,
1106 		    BUS_DMASYNC_POSTWRITE);
1107 		bus_dmamap_unload(txq->data_dmat, data->map);
1108 		m_freem(data->m);
1109 		data->m = NULL;
1110 
1111 		/* descriptor is no longer valid */
1112 		desc->flags &= ~htole32(RT2661_TX_VALID);
1113 
1114 		DPRINTFN(15, ("tx dma done q=%p idx=%u\n", txq, txq->next));
1115 
1116 		txq->queued--;
1117 		if (++txq->next >= txq->count)	/* faster than % count */
1118 			txq->next = 0;
1119 	}
1120 
1121 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1122 
1123 	if (txq->queued < txq->count) {
1124 		struct ifnet *ifp = &sc->sc_ic.ic_if;
1125 
1126 		sc->sc_tx_timer = 0;
1127 		ifp->if_flags &= ~IFF_OACTIVE;
1128 		rt2661_start(ifp);
1129 	}
1130 }
1131 
1132 static void
1133 rt2661_rx_intr(struct rt2661_softc *sc)
1134 {
1135 	struct ieee80211com *ic = &sc->sc_ic;
1136 	struct ifnet *ifp = ic->ic_ifp;
1137 	struct rt2661_rx_desc *desc;
1138 	struct rt2661_data *data;
1139 	bus_addr_t physaddr;
1140 	struct ieee80211_frame *wh;
1141 	struct ieee80211_node *ni;
1142 	struct rt2661_node *rn;
1143 	struct mbuf *mnew, *m;
1144 	int error;
1145 
1146 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1147 	    BUS_DMASYNC_POSTREAD);
1148 
1149 	for (;;) {
1150 		desc = &sc->rxq.desc[sc->rxq.cur];
1151 		data = &sc->rxq.data[sc->rxq.cur];
1152 
1153 		if (le32toh(desc->flags) & RT2661_RX_BUSY)
1154 			break;
1155 
1156 		if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
1157 		    (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
1158 			/*
1159 			 * This should not happen since we did not request
1160 			 * to receive those frames when we filled TXRX_CSR0.
1161 			 */
1162 			DPRINTFN(5, ("PHY or CRC error flags 0x%08x\n",
1163 			    le32toh(desc->flags)));
1164 			ifp->if_ierrors++;
1165 			goto skip;
1166 		}
1167 
1168 		if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
1169 			ifp->if_ierrors++;
1170 			goto skip;
1171 		}
1172 
1173 		/*
1174 		 * Try to allocate a new mbuf for this ring element and load it
1175 		 * before processing the current mbuf. If the ring element
1176 		 * cannot be loaded, drop the received packet and reuse the old
1177 		 * mbuf. In the unlikely case that the old mbuf can't be
1178 		 * reloaded either, explicitly panic.
1179 		 */
1180 		mnew = m_getcl(MB_DONTWAIT, MT_DATA, M_PKTHDR);
1181 		if (mnew == NULL) {
1182 			ifp->if_ierrors++;
1183 			goto skip;
1184 		}
1185 
1186 		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1187 		    BUS_DMASYNC_POSTREAD);
1188 		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1189 
1190 		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1191 		    mtod(mnew, void *), MCLBYTES, rt2661_dma_map_addr,
1192 		    &physaddr, 0);
1193 		if (error != 0) {
1194 			m_freem(mnew);
1195 
1196 			/* try to reload the old mbuf */
1197 			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1198 			    mtod(data->m, void *), MCLBYTES,
1199 			    rt2661_dma_map_addr, &physaddr, 0);
1200 			if (error != 0) {
1201 				/* very unlikely that it will fail... */
1202 				panic("%s: could not load old rx mbuf",
1203 				    device_get_name(sc->sc_dev));
1204 			}
1205 			ifp->if_ierrors++;
1206 			goto skip;
1207 		}
1208 
1209 		/*
1210 	 	 * New mbuf successfully loaded, update Rx ring and continue
1211 		 * processing.
1212 		 */
1213 		m = data->m;
1214 		data->m = mnew;
1215 		desc->physaddr = htole32(physaddr);
1216 
1217 		/* finalize mbuf */
1218 		m->m_pkthdr.rcvif = ifp;
1219 		m->m_pkthdr.len = m->m_len =
1220 		    (le32toh(desc->flags) >> 16) & 0xfff;
1221 
1222 		if (sc->sc_drvbpf != NULL) {
1223 			struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
1224 			uint32_t tsf_lo, tsf_hi;
1225 
1226 			/* get timestamp (low and high 32 bits) */
1227 			tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
1228 			tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
1229 
1230 			tap->wr_tsf =
1231 			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1232 			tap->wr_flags = 0;
1233 			tap->wr_rate = rt2661_rxrate(desc);
1234 			tap->wr_chan_freq = htole16(ic->ic_curchan->ic_freq);
1235 			tap->wr_chan_flags = htole16(ic->ic_curchan->ic_flags);
1236 			tap->wr_antsignal = desc->rssi;
1237 
1238 			bpf_ptap(sc->sc_drvbpf, m, tap, sc->sc_rxtap_len);
1239 		}
1240 
1241 		wh = mtod(m, struct ieee80211_frame *);
1242 		ni = ieee80211_find_rxnode(ic,
1243 		    (struct ieee80211_frame_min *)wh);
1244 
1245 		/* send the frame to the 802.11 layer */
1246 		ieee80211_input(ic, m, ni, desc->rssi, 0);
1247 
1248 		/* give rssi to the rate adatation algorithm */
1249 		rn = (struct rt2661_node *)ni;
1250 		ral_rssadapt_input(ic, ni, &rn->rssadapt,
1251 		    rt2661_get_rssi(sc, desc->rssi));
1252 
1253 		/* node is no longer needed */
1254 		ieee80211_free_node(ni);
1255 
1256 skip:		desc->flags |= htole32(RT2661_RX_BUSY);
1257 
1258 		DPRINTFN(15, ("rx intr idx=%u\n", sc->rxq.cur));
1259 
1260 		sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
1261 	}
1262 
1263 	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1264 	    BUS_DMASYNC_PREWRITE);
1265 }
1266 
1267 /* ARGSUSED */
1268 static void
1269 rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
1270 {
1271 	/* do nothing */
1272 }
1273 
1274 static void
1275 rt2661_mcu_wakeup(struct rt2661_softc *sc)
1276 {
1277 	RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
1278 
1279 	RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
1280 	RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
1281 	RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
1282 
1283 	/* send wakeup command to MCU */
1284 	rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
1285 }
1286 
1287 static void
1288 rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
1289 {
1290 	RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
1291 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
1292 }
1293 
1294 static void
1295 rt2661_intr(void *arg)
1296 {
1297 	struct rt2661_softc *sc = arg;
1298 	struct ifnet *ifp = &sc->sc_ic.ic_if;
1299 	uint32_t r1, r2;
1300 
1301 	/* disable MAC and MCU interrupts */
1302 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
1303 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
1304 
1305 	/* don't re-enable interrupts if we're shutting down */
1306 	if (!(ifp->if_flags & IFF_RUNNING))
1307 		return;
1308 
1309 	r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
1310 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
1311 
1312 	r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
1313 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
1314 
1315 	if (r1 & RT2661_MGT_DONE)
1316 		rt2661_tx_dma_intr(sc, &sc->mgtq);
1317 
1318 	if (r1 & RT2661_RX_DONE)
1319 		rt2661_rx_intr(sc);
1320 
1321 	if (r1 & RT2661_TX0_DMA_DONE)
1322 		rt2661_tx_dma_intr(sc, &sc->txq[0]);
1323 
1324 	if (r1 & RT2661_TX1_DMA_DONE)
1325 		rt2661_tx_dma_intr(sc, &sc->txq[1]);
1326 
1327 	if (r1 & RT2661_TX2_DMA_DONE)
1328 		rt2661_tx_dma_intr(sc, &sc->txq[2]);
1329 
1330 	if (r1 & RT2661_TX3_DMA_DONE)
1331 		rt2661_tx_dma_intr(sc, &sc->txq[3]);
1332 
1333 	if (r1 & RT2661_TX_DONE)
1334 		rt2661_tx_intr(sc);
1335 
1336 	if (r2 & RT2661_MCU_CMD_DONE)
1337 		rt2661_mcu_cmd_intr(sc);
1338 
1339 	if (r2 & RT2661_MCU_BEACON_EXPIRE)
1340 		rt2661_mcu_beacon_expire(sc);
1341 
1342 	if (r2 & RT2661_MCU_WAKEUP)
1343 		rt2661_mcu_wakeup(sc);
1344 
1345 	/* re-enable MAC and MCU interrupts */
1346 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
1347 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
1348 }
1349 
1350 /* quickly determine if a given rate is CCK or OFDM */
1351 #define RAL_RATE_IS_OFDM(rate) ((rate) >= 12 && (rate) != 22)
1352 
1353 #define RAL_ACK_SIZE	14	/* 10 + 4(FCS) */
1354 #define RAL_CTS_SIZE	14	/* 10 + 4(FCS) */
1355 
1356 #define RAL_SIFS	10	/* us */
1357 
1358 /*
1359  * This function is only used by the Rx radiotap code. It returns the rate at
1360  * which a given frame was received.
1361  */
1362 static uint8_t
1363 rt2661_rxrate(struct rt2661_rx_desc *desc)
1364 {
1365 	if (le32toh(desc->flags) & RT2661_RX_OFDM) {
1366 		/* reverse function of rt2661_plcp_signal */
1367 		switch (desc->rate & 0xf) {
1368 		case 0xb:	return 12;
1369 		case 0xf:	return 18;
1370 		case 0xa:	return 24;
1371 		case 0xe:	return 36;
1372 		case 0x9:	return 48;
1373 		case 0xd:	return 72;
1374 		case 0x8:	return 96;
1375 		case 0xc:	return 108;
1376 		}
1377 	} else {
1378 		if (desc->rate == 10)
1379 			return 2;
1380 		if (desc->rate == 20)
1381 			return 4;
1382 		if (desc->rate == 55)
1383 			return 11;
1384 		if (desc->rate == 110)
1385 			return 22;
1386 	}
1387 	return 2;	/* should not get there */
1388 }
1389 
1390 /*
1391  * Return the expected ack rate for a frame transmitted at rate `rate'.
1392  * XXX: this should depend on the destination node basic rate set.
1393  */
1394 static int
1395 rt2661_ack_rate(struct ieee80211com *ic, int rate)
1396 {
1397 	switch (rate) {
1398 	/* CCK rates */
1399 	case 2:
1400 		return 2;
1401 	case 4:
1402 	case 11:
1403 	case 22:
1404 		return (ic->ic_curmode == IEEE80211_MODE_11B) ? 4 : rate;
1405 
1406 	/* OFDM rates */
1407 	case 12:
1408 	case 18:
1409 		return 12;
1410 	case 24:
1411 	case 36:
1412 		return 24;
1413 	case 48:
1414 	case 72:
1415 	case 96:
1416 	case 108:
1417 		return 48;
1418 	}
1419 
1420 	/* default to 1Mbps */
1421 	return 2;
1422 }
1423 
1424 /*
1425  * Compute the duration (in us) needed to transmit `len' bytes at rate `rate'.
1426  * The function automatically determines the operating mode depending on the
1427  * given rate. `flags' indicates whether short preamble is in use or not.
1428  */
1429 static uint16_t
1430 rt2661_txtime(int len, int rate, uint32_t flags)
1431 {
1432 	uint16_t txtime;
1433 
1434 	if (RAL_RATE_IS_OFDM(rate)) {
1435 		/* IEEE Std 802.11a-1999, pp. 37 */
1436 		txtime = (8 + 4 * len + 3 + rate - 1) / rate;
1437 		txtime = 16 + 4 + 4 * txtime + 6;
1438 	} else {
1439 		/* IEEE Std 802.11b-1999, pp. 28 */
1440 		txtime = (16 * len + rate - 1) / rate;
1441 		if (rate != 2 && (flags & IEEE80211_F_SHPREAMBLE))
1442 			txtime +=  72 + 24;
1443 		else
1444 			txtime += 144 + 48;
1445 	}
1446 
1447 	return txtime;
1448 }
1449 
1450 static uint8_t
1451 rt2661_plcp_signal(int rate)
1452 {
1453 	switch (rate) {
1454 	/* CCK rates (returned values are device-dependent) */
1455 	case 2:		return 0x0;
1456 	case 4:		return 0x1;
1457 	case 11:	return 0x2;
1458 	case 22:	return 0x3;
1459 
1460 	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1461 	case 12:	return 0xb;
1462 	case 18:	return 0xf;
1463 	case 24:	return 0xa;
1464 	case 36:	return 0xe;
1465 	case 48:	return 0x9;
1466 	case 72:	return 0xd;
1467 	case 96:	return 0x8;
1468 	case 108:	return 0xc;
1469 
1470 	/* unsupported rates (should not get there) */
1471 	default:	return 0xff;
1472 	}
1473 }
1474 
1475 static void
1476 rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
1477     uint32_t flags, uint16_t xflags, int len, int rate,
1478     const bus_dma_segment_t *segs, int nsegs, int ac, int ratectl)
1479 {
1480 	struct ieee80211com *ic = &sc->sc_ic;
1481 	uint16_t plcp_length;
1482 	int i, remainder;
1483 
1484 	desc->flags = htole32(flags);
1485 	desc->flags |= htole32(len << 16);
1486 	desc->flags |= htole32(RT2661_TX_VALID);
1487 
1488 	desc->xflags = htole16(xflags);
1489 	desc->xflags |= htole16(nsegs << 13);
1490 
1491 	desc->wme = htole16(
1492 	    RT2661_QID(ac) |
1493 	    RT2661_AIFSN(2) |
1494 	    RT2661_LOGCWMIN(4) |
1495 	    RT2661_LOGCWMAX(10));
1496 
1497 	/*
1498 	 * Remember whether TX rate control information should be gathered.
1499 	 * This field is driver private data only.  It will be made available
1500 	 * by the NIC in STA_CSR4 on Tx done interrupts.
1501 	 */
1502 	desc->qid = ratectl;
1503 
1504 	/* setup PLCP fields */
1505 	desc->plcp_signal  = rt2661_plcp_signal(rate);
1506 	desc->plcp_service = 4;
1507 
1508 	len += IEEE80211_CRC_LEN;
1509 	if (RAL_RATE_IS_OFDM(rate)) {
1510 		desc->flags |= htole32(RT2661_TX_OFDM);
1511 
1512 		plcp_length = len & 0xfff;
1513 		desc->plcp_length_hi = plcp_length >> 6;
1514 		desc->plcp_length_lo = plcp_length & 0x3f;
1515 	} else {
1516 		plcp_length = (16 * len + rate - 1) / rate;
1517 		if (rate == 22) {
1518 			remainder = (16 * len) % 22;
1519 			if (remainder != 0 && remainder < 7)
1520 				desc->plcp_service |= RT2661_PLCP_LENGEXT;
1521 		}
1522 		desc->plcp_length_hi = plcp_length >> 8;
1523 		desc->plcp_length_lo = plcp_length & 0xff;
1524 
1525 		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1526 			desc->plcp_signal |= 0x08;
1527 	}
1528 
1529 	/* RT2x61 supports scatter with up to 5 segments */
1530 	for (i = 0; i < nsegs; i++) {
1531 		desc->addr[i] = htole32(segs[i].ds_addr);
1532 		desc->len [i] = htole16(segs[i].ds_len);
1533 	}
1534 
1535 	desc->flags |= htole32(RT2661_TX_BUSY);
1536 }
1537 
1538 static int
1539 rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
1540     struct ieee80211_node *ni)
1541 {
1542 	struct ieee80211com *ic = &sc->sc_ic;
1543 	struct rt2661_tx_desc *desc;
1544 	struct rt2661_data *data;
1545 	struct ieee80211_frame *wh;
1546 	struct rt2661_dmamap map;
1547 	uint16_t dur;
1548 	uint32_t flags = 0;	/* XXX HWSEQ */
1549 	int rate, error;
1550 
1551 	desc = &sc->mgtq.desc[sc->mgtq.cur];
1552 	data = &sc->mgtq.data[sc->mgtq.cur];
1553 
1554 	/* send mgt frames at the lowest available rate */
1555 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1556 
1557 	error = bus_dmamap_load_mbuf(sc->mgtq.data_dmat, data->map, m0,
1558 				     rt2661_dma_map_mbuf, &map, 0);
1559 	if (error != 0) {
1560 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1561 		    error);
1562 		m_freem(m0);
1563 		return error;
1564 	}
1565 
1566 	if (sc->sc_drvbpf != NULL) {
1567 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1568 
1569 		tap->wt_flags = 0;
1570 		tap->wt_rate = rate;
1571 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1572 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1573 
1574 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1575 	}
1576 
1577 	data->m = m0;
1578 
1579 	wh = mtod(m0, struct ieee80211_frame *);
1580 
1581 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1582 		flags |= RT2661_TX_NEED_ACK;
1583 
1584 		dur = rt2661_txtime(RAL_ACK_SIZE, rate, ic->ic_flags) +
1585 		    RAL_SIFS;
1586 		*(uint16_t *)wh->i_dur = htole16(dur);
1587 
1588 		/* tell hardware to add timestamp in probe responses */
1589 		if ((wh->i_fc[0] &
1590 		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1591 		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1592 			flags |= RT2661_TX_TIMESTAMP;
1593 	}
1594 
1595 	rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
1596 	    m0->m_pkthdr.len, rate, map.segs, map.nseg, RT2661_QID_MGT, 0);
1597 
1598 	bus_dmamap_sync(sc->mgtq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1599 	bus_dmamap_sync(sc->mgtq.desc_dmat, sc->mgtq.desc_map,
1600 	    BUS_DMASYNC_PREWRITE);
1601 
1602 	DPRINTFN(10, ("sending mgt frame len=%u idx=%u rate=%u\n",
1603 	    m0->m_pkthdr.len, sc->mgtq.cur, rate));
1604 
1605 	/* kick mgt */
1606 	sc->mgtq.queued++;
1607 	sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
1608 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
1609 
1610 	ieee80211_free_node(ni);
1611 
1612 	return 0;
1613 }
1614 
1615 /*
1616  * Build a RTS control frame.
1617  */
1618 static struct mbuf *
1619 rt2661_get_rts(struct rt2661_softc *sc, struct ieee80211_frame *wh,
1620     uint16_t dur)
1621 {
1622 	struct ieee80211_frame_rts *rts;
1623 	struct mbuf *m;
1624 
1625 	MGETHDR(m, MB_DONTWAIT, MT_DATA);
1626 	if (m == NULL) {
1627 		sc->sc_ic.ic_stats.is_tx_nobuf++;
1628 		device_printf(sc->sc_dev, "could not allocate RTS frame\n");
1629 		return NULL;
1630 	}
1631 
1632 	rts = mtod(m, struct ieee80211_frame_rts *);
1633 
1634 	rts->i_fc[0] = IEEE80211_FC0_VERSION_0 | IEEE80211_FC0_TYPE_CTL |
1635 	    IEEE80211_FC0_SUBTYPE_RTS;
1636 	rts->i_fc[1] = IEEE80211_FC1_DIR_NODS;
1637 	*(uint16_t *)rts->i_dur = htole16(dur);
1638 	IEEE80211_ADDR_COPY(rts->i_ra, wh->i_addr1);
1639 	IEEE80211_ADDR_COPY(rts->i_ta, wh->i_addr2);
1640 
1641 	m->m_pkthdr.len = m->m_len = sizeof (struct ieee80211_frame_rts);
1642 
1643 	return m;
1644 }
1645 
1646 static int
1647 rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
1648     struct ieee80211_node *ni, int ac)
1649 {
1650 	struct ieee80211com *ic = &sc->sc_ic;
1651 	struct rt2661_tx_ring *txq = &sc->txq[ac];
1652 	struct rt2661_tx_desc *desc;
1653 	struct rt2661_data *data;
1654 	struct rt2661_tx_ratectl *rctl;
1655 	struct rt2661_node *rn;
1656 	struct ieee80211_rateset *rs;
1657 	struct ieee80211_frame *wh;
1658 	struct ieee80211_key *k;
1659 	const struct chanAccParams *cap;
1660 	struct mbuf *mnew;
1661 	struct rt2661_dmamap map;
1662 	uint16_t dur;
1663 	uint32_t flags = 0;
1664 	int error, rate, noack = 0;
1665 
1666 	wh = mtod(m0, struct ieee80211_frame *);
1667 
1668 	if (ic->ic_fixed_rate != IEEE80211_FIXED_RATE_NONE) {
1669 		rs = &ic->ic_sup_rates[ic->ic_curmode];
1670 		rate = rs->rs_rates[ic->ic_fixed_rate];
1671 	} else {
1672 		rs = &ni->ni_rates;
1673 		rn = (struct rt2661_node *)ni;
1674 		ni->ni_txrate = ral_rssadapt_choose(&rn->rssadapt, rs,
1675 		    wh, m0->m_pkthdr.len, NULL, 0);
1676 		rate = rs->rs_rates[ni->ni_txrate];
1677 	}
1678 	rate &= IEEE80211_RATE_VAL;
1679 
1680 	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1681 		cap = &ic->ic_wme.wme_chanParams;
1682 		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1683 	}
1684 
1685 	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1686 		k = ieee80211_crypto_encap(ic, ni, m0);
1687 		if (k == NULL) {
1688 			m_freem(m0);
1689 			return ENOBUFS;
1690 		}
1691 
1692 		/* packet header may have moved, reset our local pointer */
1693 		wh = mtod(m0, struct ieee80211_frame *);
1694 	}
1695 
1696 	/*
1697 	 * IEEE Std 802.11-1999, pp 82: "A STA shall use an RTS/CTS exchange
1698 	 * for directed frames only when the length of the MPDU is greater
1699 	 * than the length threshold indicated by [...]" ic_rtsthreshold.
1700 	 */
1701 	if (!IEEE80211_IS_MULTICAST(wh->i_addr1) &&
1702 	    m0->m_pkthdr.len > ic->ic_rtsthreshold) {
1703 		struct mbuf *m;
1704 		uint16_t dur;
1705 		int rtsrate, ackrate;
1706 
1707 		rtsrate = IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan) ? 12 : 2;
1708 		ackrate = rt2661_ack_rate(ic, rate);
1709 
1710 		dur = rt2661_txtime(m0->m_pkthdr.len + 4, rate, ic->ic_flags) +
1711 		      rt2661_txtime(RAL_CTS_SIZE, rtsrate, ic->ic_flags) +
1712 		      /* XXX: noack (QoS)? */
1713 		      rt2661_txtime(RAL_ACK_SIZE, ackrate, ic->ic_flags) +
1714 		      3 * RAL_SIFS;
1715 
1716 		m = rt2661_get_rts(sc, wh, dur);
1717 
1718 		desc = &txq->desc[txq->cur];
1719 		data = &txq->data[txq->cur];
1720 
1721 		error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m,
1722 					     rt2661_dma_map_mbuf, &map, 0);
1723 		if (error != 0) {
1724 			device_printf(sc->sc_dev,
1725 			    "could not map mbuf (error %d)\n", error);
1726 			m_freem(m);
1727 			m_freem(m0);
1728 			return error;
1729 		}
1730 
1731 		data->m = m;
1732 
1733 		rt2661_setup_tx_desc(sc, desc, RT2661_TX_NEED_ACK |
1734 				     RT2661_TX_MORE_FRAG, 0, m->m_pkthdr.len,
1735 				     rtsrate, map.segs, map.nseg, ac, 0);
1736 
1737 		bus_dmamap_sync(txq->data_dmat, data->map,
1738 		    BUS_DMASYNC_PREWRITE);
1739 
1740 		txq->queued++;
1741 		txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1742 
1743 		/*
1744 		 * IEEE Std 802.11-1999: when an RTS/CTS exchange is used, the
1745 		 * asynchronous data frame shall be transmitted after the CTS
1746 		 * frame and a SIFS period.
1747 		 */
1748 		flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS;
1749 	}
1750 
1751 	data = &txq->data[txq->cur];
1752 	desc = &txq->desc[txq->cur];
1753 
1754 	error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1755 				     rt2661_dma_map_mbuf, &map, 0);
1756 	if (error != 0 && error != EFBIG) {
1757 		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1758 		    error);
1759 		m_freem(m0);
1760 		return error;
1761 	}
1762 	if (error != 0) {
1763 		mnew = m_defrag(m0, MB_DONTWAIT);
1764 		if (mnew == NULL) {
1765 			device_printf(sc->sc_dev,
1766 			    "could not defragment mbuf\n");
1767 			m_freem(m0);
1768 			return ENOBUFS;
1769 		}
1770 		m0 = mnew;
1771 
1772 		error = bus_dmamap_load_mbuf(txq->data_dmat, data->map, m0,
1773 					     rt2661_dma_map_mbuf, &map, 0);
1774 		if (error != 0) {
1775 			device_printf(sc->sc_dev,
1776 			    "could not map mbuf (error %d)\n", error);
1777 			m_freem(m0);
1778 			return error;
1779 		}
1780 
1781 		/* packet header have moved, reset our local pointer */
1782 		wh = mtod(m0, struct ieee80211_frame *);
1783 	}
1784 
1785 	if (sc->sc_drvbpf != NULL) {
1786 		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1787 
1788 		tap->wt_flags = 0;
1789 		tap->wt_rate = rate;
1790 		tap->wt_chan_freq = htole16(ic->ic_curchan->ic_freq);
1791 		tap->wt_chan_flags = htole16(ic->ic_curchan->ic_flags);
1792 
1793 		bpf_ptap(sc->sc_drvbpf, m0, tap, sc->sc_txtap_len);
1794 	}
1795 
1796 	data->m = m0;
1797 
1798 	rctl = kmalloc(sizeof(*rctl), M_RT2661, M_NOWAIT);
1799 	if (rctl != NULL) {
1800 		rctl->ni = ni;
1801 
1802 		/* remember link conditions for rate adaptation algorithm */
1803 		if (ic->ic_fixed_rate == IEEE80211_FIXED_RATE_NONE) {
1804 			rctl->id.id_len = m0->m_pkthdr.len;
1805 			rctl->id.id_rateidx = ni->ni_txrate;
1806 			rctl->id.id_node = ni;
1807 			rctl->id.id_rssi = ni->ni_rssi;
1808 		} else {
1809 			rctl->id.id_node = NULL;
1810 		}
1811 		STAILQ_INSERT_TAIL(&sc->tx_ratectl, rctl, link);
1812 	}
1813 
1814 	if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1815 		flags |= RT2661_TX_NEED_ACK;
1816 
1817 		dur = rt2661_txtime(RAL_ACK_SIZE, rt2661_ack_rate(ic, rate),
1818 		    ic->ic_flags) + RAL_SIFS;
1819 		*(uint16_t *)wh->i_dur = htole16(dur);
1820 	}
1821 
1822 	rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate,
1823 			     map.segs, map.nseg, ac, rctl != NULL);
1824 
1825 	bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1826 	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1827 
1828 	DPRINTFN(10, ("sending data frame len=%u idx=%u rate=%u\n",
1829 	    m0->m_pkthdr.len, txq->cur, rate));
1830 
1831 	/* kick Tx */
1832 	txq->queued++;
1833 	txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1834 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1 << ac);
1835 
1836 	if (rctl == NULL)
1837 		ieee80211_free_node(ni);
1838 
1839 	return 0;
1840 }
1841 
1842 static void
1843 rt2661_start(struct ifnet *ifp)
1844 {
1845 	struct rt2661_softc *sc = ifp->if_softc;
1846 	struct ieee80211com *ic = &sc->sc_ic;
1847 	struct mbuf *m0;
1848 	struct ether_header *eh;
1849 	struct ieee80211_node *ni;
1850 	int ac;
1851 
1852 	/* prevent management frames from being sent if we're not ready */
1853 	if (!(ifp->if_flags & IFF_RUNNING))
1854 		return;
1855 
1856 	for (;;) {
1857 		IF_POLL(&ic->ic_mgtq, m0);
1858 		if (m0 != NULL) {
1859 			if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
1860 				ifp->if_flags |= IFF_OACTIVE;
1861 				break;
1862 			}
1863 			IF_DEQUEUE(&ic->ic_mgtq, m0);
1864 
1865 			ni = (struct ieee80211_node *)m0->m_pkthdr.rcvif;
1866 			m0->m_pkthdr.rcvif = NULL;
1867 
1868 			if (ic->ic_rawbpf != NULL)
1869 				bpf_mtap(ic->ic_rawbpf, m0);
1870 
1871 			if (rt2661_tx_mgt(sc, m0, ni) != 0)
1872 				break;
1873 
1874 		} else {
1875 			if (ic->ic_state != IEEE80211_S_RUN)
1876 				break;
1877 
1878 			m0 = ifq_dequeue(&ifp->if_snd, NULL);
1879 			if (m0 == NULL)
1880 				break;
1881 
1882 			if (m0->m_len < sizeof (struct ether_header) &&
1883 			    !(m0 = m_pullup(m0, sizeof (struct ether_header))))
1884 				continue;
1885 
1886 			eh = mtod(m0, struct ether_header *);
1887 			ni = ieee80211_find_txnode(ic, eh->ether_dhost);
1888 			if (ni == NULL) {
1889 				m_freem(m0);
1890 				ifp->if_oerrors++;
1891 				continue;
1892 			}
1893 
1894 			/* classify mbuf so we can find which tx ring to use */
1895 			if (ieee80211_classify(ic, m0, ni) != 0) {
1896 				m_freem(m0);
1897 				ieee80211_free_node(ni);
1898 				ifp->if_oerrors++;
1899 				continue;
1900 			}
1901 
1902 			/* no QoS encapsulation for EAPOL frames */
1903 			ac = (eh->ether_type != htons(ETHERTYPE_PAE)) ?
1904 			    M_WME_GETAC(m0) : WME_AC_BE;
1905 
1906 			if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
1907 				/* there is no place left in this ring */
1908 				ifp->if_flags |= IFF_OACTIVE;
1909 				m_freem(m0);
1910 				ieee80211_free_node(ni);
1911 				break;
1912 			}
1913 
1914 			BPF_MTAP(ifp, m0);
1915 
1916 			m0 = ieee80211_encap(ic, m0, ni);
1917 			if (m0 == NULL) {
1918 				ieee80211_free_node(ni);
1919 				ifp->if_oerrors++;
1920 				continue;
1921 			}
1922 
1923 			if (ic->ic_rawbpf != NULL)
1924 				bpf_mtap(ic->ic_rawbpf, m0);
1925 
1926 			if (rt2661_tx_data(sc, m0, ni, ac) != 0) {
1927 				ieee80211_free_node(ni);
1928 				ifp->if_oerrors++;
1929 				break;
1930 			}
1931 		}
1932 
1933 		sc->sc_tx_timer = 5;
1934 		ifp->if_timer = 1;
1935 	}
1936 }
1937 
1938 static void
1939 rt2661_watchdog(struct ifnet *ifp)
1940 {
1941 	struct rt2661_softc *sc = ifp->if_softc;
1942 	struct ieee80211com *ic = &sc->sc_ic;
1943 
1944 	ifp->if_timer = 0;
1945 
1946 	if (sc->sc_tx_timer > 0) {
1947 		if (--sc->sc_tx_timer == 0) {
1948 			device_printf(sc->sc_dev, "device timeout\n");
1949 			rt2661_init(sc);
1950 			ifp->if_oerrors++;
1951 			return;
1952 		}
1953 		ifp->if_timer = 1;
1954 	}
1955 
1956 	ieee80211_watchdog(ic);
1957 }
1958 
1959 /*
1960  * This function allows for fast channel switching in monitor mode (used by
1961  * net-mgmt/kismet). In IBSS mode, we must explicitly reset the interface to
1962  * generate a new beacon frame.
1963  */
1964 static int
1965 rt2661_reset(struct ifnet *ifp)
1966 {
1967 	struct rt2661_softc *sc = ifp->if_softc;
1968 	struct ieee80211com *ic = &sc->sc_ic;
1969 
1970 	if (ic->ic_opmode != IEEE80211_M_MONITOR)
1971 		return ENETRESET;
1972 
1973 	rt2661_set_chan(sc, ic->ic_curchan);
1974 
1975 	return 0;
1976 }
1977 
1978 static int
1979 rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data, struct ucred *cr)
1980 {
1981 	struct rt2661_softc *sc = ifp->if_softc;
1982 	struct ieee80211com *ic = &sc->sc_ic;
1983 	int error = 0;
1984 
1985 	switch (cmd) {
1986 	case SIOCSIFFLAGS:
1987 		if (ifp->if_flags & IFF_UP) {
1988 			if (ifp->if_flags & IFF_RUNNING)
1989 				rt2661_update_promisc(sc);
1990 			else
1991 				rt2661_init(sc);
1992 		} else {
1993 			if (ifp->if_flags & IFF_RUNNING)
1994 				rt2661_stop(sc);
1995 		}
1996 		break;
1997 
1998 	default:
1999 		error = ieee80211_ioctl(ic, cmd, data, cr);
2000 	}
2001 
2002 	if (error == ENETRESET) {
2003 		if ((ifp->if_flags & (IFF_UP | IFF_RUNNING)) ==
2004 		    (IFF_UP | IFF_RUNNING) &&
2005 		    (ic->ic_roaming != IEEE80211_ROAMING_MANUAL))
2006 			rt2661_init(sc);
2007 		error = 0;
2008 	}
2009 	return error;
2010 }
2011 
2012 static void
2013 rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
2014 {
2015 	uint32_t tmp;
2016 	int ntries;
2017 
2018 	for (ntries = 0; ntries < 100; ntries++) {
2019 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
2020 			break;
2021 		DELAY(1);
2022 	}
2023 	if (ntries == 100) {
2024 		device_printf(sc->sc_dev, "could not write to BBP\n");
2025 		return;
2026 	}
2027 
2028 	tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
2029 	RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
2030 
2031 	DPRINTFN(15, ("BBP R%u <- 0x%02x\n", reg, val));
2032 }
2033 
2034 static uint8_t
2035 rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
2036 {
2037 	uint32_t val;
2038 	int ntries;
2039 
2040 	for (ntries = 0; ntries < 100; ntries++) {
2041 		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
2042 			break;
2043 		DELAY(1);
2044 	}
2045 	if (ntries == 100) {
2046 		device_printf(sc->sc_dev, "could not read from BBP\n");
2047 		return 0;
2048 	}
2049 
2050 	val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
2051 	RAL_WRITE(sc, RT2661_PHY_CSR3, val);
2052 
2053 	for (ntries = 0; ntries < 100; ntries++) {
2054 		val = RAL_READ(sc, RT2661_PHY_CSR3);
2055 		if (!(val & RT2661_BBP_BUSY))
2056 			return val & 0xff;
2057 		DELAY(1);
2058 	}
2059 
2060 	device_printf(sc->sc_dev, "could not read from BBP\n");
2061 	return 0;
2062 }
2063 
2064 static void
2065 rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
2066 {
2067 	uint32_t tmp;
2068 	int ntries;
2069 
2070 	for (ntries = 0; ntries < 100; ntries++) {
2071 		if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
2072 			break;
2073 		DELAY(1);
2074 	}
2075 	if (ntries == 100) {
2076 		device_printf(sc->sc_dev, "could not write to RF\n");
2077 		return;
2078 	}
2079 
2080 	tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
2081 	    (reg & 3);
2082 	RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
2083 
2084 	/* remember last written value in sc */
2085 	sc->rf_regs[reg] = val;
2086 
2087 	DPRINTFN(15, ("RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff));
2088 }
2089 
2090 static int
2091 rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
2092 {
2093 	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
2094 		return EIO;	/* there is already a command pending */
2095 
2096 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
2097 	    RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
2098 
2099 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
2100 
2101 	return 0;
2102 }
2103 
2104 static void
2105 rt2661_select_antenna(struct rt2661_softc *sc)
2106 {
2107 	uint8_t bbp4, bbp77;
2108 	uint32_t tmp;
2109 
2110 	bbp4  = rt2661_bbp_read(sc,  4);
2111 	bbp77 = rt2661_bbp_read(sc, 77);
2112 
2113 	/* TBD */
2114 
2115 	/* make sure Rx is disabled before switching antenna */
2116 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2117 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2118 
2119 	rt2661_bbp_write(sc,  4, bbp4);
2120 	rt2661_bbp_write(sc, 77, bbp77);
2121 
2122 	/* restore Rx filter */
2123 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2124 }
2125 
2126 /*
2127  * Enable multi-rate retries for frames sent at OFDM rates.
2128  * In 802.11b/g mode, allow fallback to CCK rates.
2129  */
2130 static void
2131 rt2661_enable_mrr(struct rt2661_softc *sc)
2132 {
2133 	struct ieee80211com *ic = &sc->sc_ic;
2134 	uint32_t tmp;
2135 
2136 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2137 
2138 	tmp &= ~RT2661_MRR_CCK_FALLBACK;
2139 	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan))
2140 		tmp |= RT2661_MRR_CCK_FALLBACK;
2141 	tmp |= RT2661_MRR_ENABLED;
2142 
2143 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2144 }
2145 
2146 static void
2147 rt2661_set_txpreamble(struct rt2661_softc *sc)
2148 {
2149 	uint32_t tmp;
2150 
2151 	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
2152 
2153 	tmp &= ~RT2661_SHORT_PREAMBLE;
2154 	if (sc->sc_ic.ic_flags & IEEE80211_F_SHPREAMBLE)
2155 		tmp |= RT2661_SHORT_PREAMBLE;
2156 
2157 	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
2158 }
2159 
2160 static void
2161 rt2661_set_basicrates(struct rt2661_softc *sc,
2162     const struct ieee80211_rateset *rs)
2163 {
2164 #define RV(r)	((r) & IEEE80211_RATE_VAL)
2165 	uint32_t mask = 0;
2166 	uint8_t rate;
2167 	int i, j;
2168 
2169 	for (i = 0; i < rs->rs_nrates; i++) {
2170 		rate = rs->rs_rates[i];
2171 
2172 		if (!(rate & IEEE80211_RATE_BASIC))
2173 			continue;
2174 
2175 		/*
2176 		 * Find h/w rate index.  We know it exists because the rate
2177 		 * set has already been negotiated.
2178 		 */
2179 		for (j = 0; rt2661_rateset_11g.rs_rates[j] != RV(rate); j++);
2180 
2181 		mask |= 1 << j;
2182 	}
2183 
2184 	RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
2185 
2186 	DPRINTF(("Setting basic rate mask to 0x%x\n", mask));
2187 #undef RV
2188 }
2189 
2190 /*
2191  * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
2192  * driver.
2193  */
2194 static void
2195 rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
2196 {
2197 	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
2198 	uint32_t tmp;
2199 
2200 	/* update all BBP registers that depend on the band */
2201 	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
2202 	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
2203 	if (IEEE80211_IS_CHAN_5GHZ(c)) {
2204 		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
2205 		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
2206 	}
2207 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2208 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2209 		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
2210 	}
2211 
2212 	rt2661_bbp_write(sc,  17, bbp17);
2213 	rt2661_bbp_write(sc,  96, bbp96);
2214 	rt2661_bbp_write(sc, 104, bbp104);
2215 
2216 	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
2217 	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
2218 		rt2661_bbp_write(sc, 75, 0x80);
2219 		rt2661_bbp_write(sc, 86, 0x80);
2220 		rt2661_bbp_write(sc, 88, 0x80);
2221 	}
2222 
2223 	rt2661_bbp_write(sc, 35, bbp35);
2224 	rt2661_bbp_write(sc, 97, bbp97);
2225 	rt2661_bbp_write(sc, 98, bbp98);
2226 
2227 	tmp = RAL_READ(sc, RT2661_PHY_CSR0);
2228 	tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
2229 	if (IEEE80211_IS_CHAN_2GHZ(c))
2230 		tmp |= RT2661_PA_PE_2GHZ;
2231 	else
2232 		tmp |= RT2661_PA_PE_5GHZ;
2233 	RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
2234 }
2235 
2236 static void
2237 rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
2238 {
2239 	struct ieee80211com *ic = &sc->sc_ic;
2240 	const struct rfprog *rfprog;
2241 	uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
2242 	int8_t power;
2243 	u_int i, chan;
2244 
2245 	chan = ieee80211_chan2ieee(ic, c);
2246 	if (chan == 0 || chan == IEEE80211_CHAN_ANY)
2247 		return;
2248 
2249 	/* select the appropriate RF settings based on what EEPROM says */
2250 	rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
2251 
2252 	/* find the settings for this channel (we know it exists) */
2253 	for (i = 0; rfprog[i].chan != chan; i++);
2254 
2255 	power = sc->txpow[i];
2256 	if (power < 0) {
2257 		bbp94 += power;
2258 		power = 0;
2259 	} else if (power > 31) {
2260 		bbp94 += power - 31;
2261 		power = 31;
2262 	}
2263 
2264 	/*
2265 	 * If we are switching from the 2GHz band to the 5GHz band or
2266 	 * vice-versa, BBP registers need to be reprogrammed.
2267 	 */
2268 	if (c->ic_flags != sc->sc_curchan->ic_flags) {
2269 		rt2661_select_band(sc, c);
2270 		rt2661_select_antenna(sc);
2271 	}
2272 	sc->sc_curchan = c;
2273 
2274 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2275 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2276 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2277 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2278 
2279 	DELAY(200);
2280 
2281 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2282 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2283 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
2284 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2285 
2286 	DELAY(200);
2287 
2288 	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2289 	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2290 	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2291 	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2292 
2293 	/* enable smart mode for MIMO-capable RFs */
2294 	bbp3 = rt2661_bbp_read(sc, 3);
2295 
2296 	bbp3 &= ~RT2661_SMART_MODE;
2297 	if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
2298 		bbp3 |= RT2661_SMART_MODE;
2299 
2300 	rt2661_bbp_write(sc, 3, bbp3);
2301 
2302 	if (bbp94 != RT2661_BBPR94_DEFAULT)
2303 		rt2661_bbp_write(sc, 94, bbp94);
2304 
2305 	/* 5GHz radio needs a 1ms delay here */
2306 	if (IEEE80211_IS_CHAN_5GHZ(c))
2307 		DELAY(1000);
2308 }
2309 
2310 static void
2311 rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
2312 {
2313 	uint32_t tmp;
2314 
2315 	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2316 	RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
2317 
2318 	tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
2319 	RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
2320 }
2321 
2322 static void
2323 rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
2324 {
2325 	uint32_t tmp;
2326 
2327 	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2328 	RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
2329 
2330 	tmp = addr[4] | addr[5] << 8;
2331 	RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
2332 }
2333 
2334 static void
2335 rt2661_update_promisc(struct rt2661_softc *sc)
2336 {
2337 	struct ifnet *ifp = sc->sc_ic.ic_ifp;
2338 	uint32_t tmp;
2339 
2340 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2341 
2342 	tmp &= ~RT2661_DROP_NOT_TO_ME;
2343 	if (!(ifp->if_flags & IFF_PROMISC))
2344 		tmp |= RT2661_DROP_NOT_TO_ME;
2345 
2346 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2347 
2348 	DPRINTF(("%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2349 	    "entering" : "leaving"));
2350 }
2351 
2352 /*
2353  * Update QoS (802.11e) settings for each h/w Tx ring.
2354  */
2355 static int
2356 rt2661_wme_update(struct ieee80211com *ic)
2357 {
2358 	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
2359 	const struct wmeParams *wmep;
2360 
2361 	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
2362 
2363 	/* XXX: not sure about shifts. */
2364 	/* XXX: the reference driver plays with AC_VI settings too. */
2365 
2366 	/* update TxOp */
2367 	RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
2368 	    wmep[WME_AC_BE].wmep_txopLimit << 16 |
2369 	    wmep[WME_AC_BK].wmep_txopLimit);
2370 	RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
2371 	    wmep[WME_AC_VI].wmep_txopLimit << 16 |
2372 	    wmep[WME_AC_VO].wmep_txopLimit);
2373 
2374 	/* update CWmin */
2375 	RAL_WRITE(sc, RT2661_CWMIN_CSR,
2376 	    wmep[WME_AC_BE].wmep_logcwmin << 12 |
2377 	    wmep[WME_AC_BK].wmep_logcwmin <<  8 |
2378 	    wmep[WME_AC_VI].wmep_logcwmin <<  4 |
2379 	    wmep[WME_AC_VO].wmep_logcwmin);
2380 
2381 	/* update CWmax */
2382 	RAL_WRITE(sc, RT2661_CWMAX_CSR,
2383 	    wmep[WME_AC_BE].wmep_logcwmax << 12 |
2384 	    wmep[WME_AC_BK].wmep_logcwmax <<  8 |
2385 	    wmep[WME_AC_VI].wmep_logcwmax <<  4 |
2386 	    wmep[WME_AC_VO].wmep_logcwmax);
2387 
2388 	/* update Aifsn */
2389 	RAL_WRITE(sc, RT2661_AIFSN_CSR,
2390 	    wmep[WME_AC_BE].wmep_aifsn << 12 |
2391 	    wmep[WME_AC_BK].wmep_aifsn <<  8 |
2392 	    wmep[WME_AC_VI].wmep_aifsn <<  4 |
2393 	    wmep[WME_AC_VO].wmep_aifsn);
2394 
2395 	return 0;
2396 }
2397 
2398 static void
2399 rt2661_update_slot(struct ifnet *ifp)
2400 {
2401 	struct rt2661_softc *sc = ifp->if_softc;
2402 	struct ieee80211com *ic = &sc->sc_ic;
2403 	uint8_t slottime;
2404 	uint32_t tmp;
2405 
2406 	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2407 
2408 	tmp = RAL_READ(sc, RT2661_MAC_CSR9);
2409 	tmp = (tmp & ~0xff) | slottime;
2410 	RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
2411 }
2412 
2413 static const char *
2414 rt2661_get_rf(int rev)
2415 {
2416 	switch (rev) {
2417 	case RT2661_RF_5225:	return "RT5225";
2418 	case RT2661_RF_5325:	return "RT5325 (MIMO XR)";
2419 	case RT2661_RF_2527:	return "RT2527";
2420 	case RT2661_RF_2529:	return "RT2529 (MIMO XR)";
2421 	default:		return "unknown";
2422 	}
2423 }
2424 
2425 static void
2426 rt2661_read_eeprom(struct rt2661_softc *sc)
2427 {
2428 	struct ieee80211com *ic = &sc->sc_ic;
2429 	uint16_t val;
2430 	int i;
2431 
2432 	/* read MAC address */
2433 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
2434 	ic->ic_myaddr[0] = val & 0xff;
2435 	ic->ic_myaddr[1] = val >> 8;
2436 
2437 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
2438 	ic->ic_myaddr[2] = val & 0xff;
2439 	ic->ic_myaddr[3] = val >> 8;
2440 
2441 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
2442 	ic->ic_myaddr[4] = val & 0xff;
2443 	ic->ic_myaddr[5] = val >> 8;
2444 
2445 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
2446 	/* XXX: test if different from 0xffff? */
2447 	sc->rf_rev   = (val >> 11) & 0x1f;
2448 	sc->hw_radio = (val >> 10) & 0x1;
2449 	sc->rx_ant   = (val >> 4)  & 0x3;
2450 	sc->tx_ant   = (val >> 2)  & 0x3;
2451 	sc->nb_ant   = val & 0x3;
2452 
2453 	DPRINTF(("RF revision=%d\n", sc->rf_rev));
2454 
2455 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
2456 	sc->ext_5ghz_lna = (val >> 6) & 0x1;
2457 	sc->ext_2ghz_lna = (val >> 4) & 0x1;
2458 
2459 	DPRINTF(("External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
2460 	    sc->ext_2ghz_lna, sc->ext_5ghz_lna));
2461 
2462 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
2463 	if ((val & 0xff) != 0xff)
2464 		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
2465 
2466 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
2467 	if ((val & 0xff) != 0xff)
2468 		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2469 
2470 	/* adjust RSSI correction for external low-noise amplifier */
2471 	if (sc->ext_2ghz_lna)
2472 		sc->rssi_2ghz_corr -= 14;
2473 	if (sc->ext_5ghz_lna)
2474 		sc->rssi_5ghz_corr -= 14;
2475 
2476 	DPRINTF(("RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
2477 	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr));
2478 
2479 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
2480 	if ((val >> 8) != 0xff)
2481 		sc->rfprog = (val >> 8) & 0x3;
2482 	if ((val & 0xff) != 0xff)
2483 		sc->rffreq = val & 0xff;
2484 
2485 	DPRINTF(("RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq));
2486 
2487 	/* read Tx power for all a/b/g channels */
2488 	for (i = 0; i < 19; i++) {
2489 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
2490 		sc->txpow[i * 2] = (int8_t)(val >> 8);		/* signed */
2491 		DPRINTF(("Channel=%d Tx power=%d\n",
2492 		    rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]));
2493 		sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);	/* signed */
2494 		DPRINTF(("Channel=%d Tx power=%d\n",
2495 		    rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]));
2496 	}
2497 
2498 	/* read vendor-specific BBP values */
2499 	for (i = 0; i < 16; i++) {
2500 		val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
2501 		if (val == 0 || val == 0xffff)
2502 			continue;	/* skip invalid entries */
2503 		sc->bbp_prom[i].reg = val >> 8;
2504 		sc->bbp_prom[i].val = val & 0xff;
2505 		DPRINTF(("BBP R%d=%02x\n", sc->bbp_prom[i].reg,
2506 		    sc->bbp_prom[i].val));
2507 	}
2508 
2509 	val = rt2661_eeprom_read(sc, RT2661_EEPROM_LED_OFFSET);
2510 	DPRINTF(("LED %02x\n", val));
2511 	if (val == 0xffff) {
2512 		sc->mcu_led = RT2661_MCU_LED_DEFAULT;
2513 	} else {
2514 #define N(arr)	(int)(sizeof(arr) / sizeof(arr[0]))
2515 
2516 		for (i = 0; i < N(led_ee2mcu); ++i) {
2517 			if (val & led_ee2mcu[i].ee_bit)
2518 				sc->mcu_led |= led_ee2mcu[i].mcu_bit;
2519 		}
2520 
2521 #undef N
2522 
2523 		sc->mcu_led |= ((val >> RT2661_EE_LED_MODE_SHIFT) &
2524 				RT2661_EE_LED_MODE_MASK);
2525 	}
2526 }
2527 
2528 static int
2529 rt2661_bbp_init(struct rt2661_softc *sc)
2530 {
2531 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2532 	int i, ntries;
2533 	uint8_t val;
2534 
2535 	/* wait for BBP to be ready */
2536 	for (ntries = 0; ntries < 100; ntries++) {
2537 		val = rt2661_bbp_read(sc, 0);
2538 		if (val != 0 && val != 0xff)
2539 			break;
2540 		DELAY(100);
2541 	}
2542 	if (ntries == 100) {
2543 		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2544 		return EIO;
2545 	}
2546 
2547 	/* initialize BBP registers to default values */
2548 	for (i = 0; i < N(rt2661_def_bbp); i++) {
2549 		rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
2550 		    rt2661_def_bbp[i].val);
2551 	}
2552 
2553 	/* write vendor-specific BBP values (from EEPROM) */
2554 	for (i = 0; i < 16; i++) {
2555 		if (sc->bbp_prom[i].reg == 0)
2556 			continue;
2557 		rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2558 	}
2559 
2560 	return 0;
2561 #undef N
2562 }
2563 
2564 static void
2565 rt2661_init(void *priv)
2566 {
2567 #define N(a)	(sizeof (a) / sizeof ((a)[0]))
2568 	struct rt2661_softc *sc = priv;
2569 	struct ieee80211com *ic = &sc->sc_ic;
2570 	struct ifnet *ifp = ic->ic_ifp;
2571 	uint32_t tmp, sta[3];
2572 	int i, ntries;
2573 
2574 	rt2661_stop(sc);
2575 
2576 	/* initialize Tx rings */
2577 	RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
2578 	RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
2579 	RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
2580 	RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
2581 
2582 	/* initialize Mgt ring */
2583 	RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
2584 
2585 	/* initialize Rx ring */
2586 	RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
2587 
2588 	/* initialize Tx rings sizes */
2589 	RAL_WRITE(sc, RT2661_TX_RING_CSR0,
2590 	    RT2661_TX_RING_COUNT << 24 |
2591 	    RT2661_TX_RING_COUNT << 16 |
2592 	    RT2661_TX_RING_COUNT <<  8 |
2593 	    RT2661_TX_RING_COUNT);
2594 
2595 	RAL_WRITE(sc, RT2661_TX_RING_CSR1,
2596 	    RT2661_TX_DESC_WSIZE << 16 |
2597 	    RT2661_TX_RING_COUNT <<  8 |	/* XXX: HCCA ring unused */
2598 	    RT2661_MGT_RING_COUNT);
2599 
2600 	/* initialize Rx rings */
2601 	RAL_WRITE(sc, RT2661_RX_RING_CSR,
2602 	    RT2661_RX_DESC_BACK  << 16 |
2603 	    RT2661_RX_DESC_WSIZE <<  8 |
2604 	    RT2661_RX_RING_COUNT);
2605 
2606 	/* XXX: some magic here */
2607 	RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
2608 
2609 	/* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
2610 	RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
2611 
2612 	/* load base address of Rx ring */
2613 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
2614 
2615 	/* initialize MAC registers to default values */
2616 	for (i = 0; i < N(rt2661_def_mac); i++)
2617 		RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
2618 
2619 	IEEE80211_ADDR_COPY(ic->ic_myaddr, IF_LLADDR(ifp));
2620 	rt2661_set_macaddr(sc, ic->ic_myaddr);
2621 
2622 	/* set host ready */
2623 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2624 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2625 
2626 	/* wait for BBP/RF to wakeup */
2627 	for (ntries = 0; ntries < 1000; ntries++) {
2628 		if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
2629 			break;
2630 		DELAY(1000);
2631 	}
2632 	if (ntries == 1000) {
2633 		kprintf("timeout waiting for BBP/RF to wakeup\n");
2634 		rt2661_stop(sc);
2635 		return;
2636 	}
2637 
2638 	if (rt2661_bbp_init(sc) != 0) {
2639 		rt2661_stop(sc);
2640 		return;
2641 	}
2642 
2643 	/* select default channel */
2644 	sc->sc_curchan = ic->ic_curchan;
2645 	rt2661_select_band(sc, sc->sc_curchan);
2646 	rt2661_select_antenna(sc);
2647 	rt2661_set_chan(sc, sc->sc_curchan);
2648 
2649 	/* update Rx filter */
2650 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
2651 
2652 	tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
2653 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2654 		tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
2655 		       RT2661_DROP_ACKCTS;
2656 		if (ic->ic_opmode != IEEE80211_M_HOSTAP)
2657 			tmp |= RT2661_DROP_TODS;
2658 		if (!(ifp->if_flags & IFF_PROMISC))
2659 			tmp |= RT2661_DROP_NOT_TO_ME;
2660 	}
2661 
2662 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2663 
2664 	/* clear STA registers */
2665 	RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
2666 
2667 	/* initialize ASIC */
2668 	RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
2669 
2670 	/* clear any pending interrupt */
2671 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2672 
2673 	/* enable interrupts */
2674 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
2675 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
2676 
2677 	/* kick Rx */
2678 	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
2679 
2680 	ifp->if_flags &= ~IFF_OACTIVE;
2681 	ifp->if_flags |= IFF_RUNNING;
2682 
2683 	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2684 		if (ic->ic_roaming != IEEE80211_ROAMING_MANUAL)
2685 			ieee80211_new_state(ic, IEEE80211_S_SCAN, -1);
2686 	} else
2687 		ieee80211_new_state(ic, IEEE80211_S_RUN, -1);
2688 #undef N
2689 }
2690 
2691 void
2692 rt2661_stop(void *priv)
2693 {
2694 	struct rt2661_softc *sc = priv;
2695 	struct ieee80211com *ic = &sc->sc_ic;
2696 	struct ifnet *ifp = ic->ic_ifp;
2697 	struct rt2661_tx_ratectl *rctl;
2698 	uint32_t tmp;
2699 
2700 	ieee80211_new_state(ic, IEEE80211_S_INIT, -1);
2701 
2702 	sc->sc_tx_timer = 0;
2703 	ifp->if_timer = 0;
2704 	ifp->if_flags &= ~(IFF_RUNNING | IFF_OACTIVE);
2705 
2706 	/* abort Tx (for all 5 Tx rings) */
2707 	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
2708 
2709 	/* disable Rx (value remains after reset!) */
2710 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2711 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2712 
2713 	/* reset ASIC */
2714 	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2715 	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2716 
2717 	/* disable interrupts */
2718 	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffffff);
2719 	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
2720 
2721 	/* clear any pending interrupt */
2722 	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2723 	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
2724 
2725 	while ((rctl = STAILQ_FIRST(&sc->tx_ratectl)) != NULL) {
2726 		STAILQ_REMOVE_HEAD(&sc->tx_ratectl, link);
2727 		ieee80211_free_node(rctl->ni);
2728 		rctl->ni = NULL;
2729 		kfree(rctl, M_RT2661);
2730 	}
2731 
2732 	/* reset Tx and Rx rings */
2733 	rt2661_reset_tx_ring(sc, &sc->txq[0]);
2734 	rt2661_reset_tx_ring(sc, &sc->txq[1]);
2735 	rt2661_reset_tx_ring(sc, &sc->txq[2]);
2736 	rt2661_reset_tx_ring(sc, &sc->txq[3]);
2737 	rt2661_reset_tx_ring(sc, &sc->mgtq);
2738 	rt2661_reset_rx_ring(sc, &sc->rxq);
2739 }
2740 
2741 static int
2742 rt2661_load_microcode(struct rt2661_softc *sc, const uint8_t *ucode, int size)
2743 {
2744 	int ntries;
2745 
2746 	/* reset 8051 */
2747 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2748 
2749 	/* cancel any pending Host to MCU command */
2750 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
2751 	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
2752 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
2753 
2754 	/* write 8051's microcode */
2755 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
2756 	RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, ucode, size);
2757 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2758 
2759 	/* kick 8051's ass */
2760 	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
2761 
2762 	/* wait for 8051 to initialize */
2763 	for (ntries = 0; ntries < 500; ntries++) {
2764 		if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
2765 			break;
2766 		DELAY(100);
2767 	}
2768 	if (ntries == 500) {
2769 		kprintf("timeout waiting for MCU to initialize\n");
2770 		return EIO;
2771 	}
2772 	return 0;
2773 }
2774 
2775 #ifdef notyet
2776 /*
2777  * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
2778  * false CCA count.  This function is called periodically (every seconds) when
2779  * in the RUN state.  Values taken from the reference driver.
2780  */
2781 static void
2782 rt2661_rx_tune(struct rt2661_softc *sc)
2783 {
2784 	uint8_t bbp17;
2785 	uint16_t cca;
2786 	int lo, hi, dbm;
2787 
2788 	/*
2789 	 * Tuning range depends on operating band and on the presence of an
2790 	 * external low-noise amplifier.
2791 	 */
2792 	lo = 0x20;
2793 	if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
2794 		lo += 0x08;
2795 	if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
2796 	    (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
2797 		lo += 0x10;
2798 	hi = lo + 0x20;
2799 
2800 	/* retrieve false CCA count since last call (clear on read) */
2801 	cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
2802 
2803 	if (dbm >= -35) {
2804 		bbp17 = 0x60;
2805 	} else if (dbm >= -58) {
2806 		bbp17 = hi;
2807 	} else if (dbm >= -66) {
2808 		bbp17 = lo + 0x10;
2809 	} else if (dbm >= -74) {
2810 		bbp17 = lo + 0x08;
2811 	} else {
2812 		/* RSSI < -74dBm, tune using false CCA count */
2813 
2814 		bbp17 = sc->bbp17; /* current value */
2815 
2816 		hi -= 2 * (-74 - dbm);
2817 		if (hi < lo)
2818 			hi = lo;
2819 
2820 		if (bbp17 > hi) {
2821 			bbp17 = hi;
2822 
2823 		} else if (cca > 512) {
2824 			if (++bbp17 > hi)
2825 				bbp17 = hi;
2826 		} else if (cca < 100) {
2827 			if (--bbp17 < lo)
2828 				bbp17 = lo;
2829 		}
2830 	}
2831 
2832 	if (bbp17 != sc->bbp17) {
2833 		rt2661_bbp_write(sc, 17, bbp17);
2834 		sc->bbp17 = bbp17;
2835 	}
2836 }
2837 
2838 /*
2839  * Enter/Leave radar detection mode.
2840  * This is for 802.11h additional regulatory domains.
2841  */
2842 static void
2843 rt2661_radar_start(struct rt2661_softc *sc)
2844 {
2845 	uint32_t tmp;
2846 
2847 	/* disable Rx */
2848 	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2849 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2850 
2851 	rt2661_bbp_write(sc, 82, 0x20);
2852 	rt2661_bbp_write(sc, 83, 0x00);
2853 	rt2661_bbp_write(sc, 84, 0x40);
2854 
2855 	/* save current BBP registers values */
2856 	sc->bbp18 = rt2661_bbp_read(sc, 18);
2857 	sc->bbp21 = rt2661_bbp_read(sc, 21);
2858 	sc->bbp22 = rt2661_bbp_read(sc, 22);
2859 	sc->bbp16 = rt2661_bbp_read(sc, 16);
2860 	sc->bbp17 = rt2661_bbp_read(sc, 17);
2861 	sc->bbp64 = rt2661_bbp_read(sc, 64);
2862 
2863 	rt2661_bbp_write(sc, 18, 0xff);
2864 	rt2661_bbp_write(sc, 21, 0x3f);
2865 	rt2661_bbp_write(sc, 22, 0x3f);
2866 	rt2661_bbp_write(sc, 16, 0xbd);
2867 	rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
2868 	rt2661_bbp_write(sc, 64, 0x21);
2869 
2870 	/* restore Rx filter */
2871 	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2872 }
2873 
2874 static int
2875 rt2661_radar_stop(struct rt2661_softc *sc)
2876 {
2877 	uint8_t bbp66;
2878 
2879 	/* read radar detection result */
2880 	bbp66 = rt2661_bbp_read(sc, 66);
2881 
2882 	/* restore BBP registers values */
2883 	rt2661_bbp_write(sc, 16, sc->bbp16);
2884 	rt2661_bbp_write(sc, 17, sc->bbp17);
2885 	rt2661_bbp_write(sc, 18, sc->bbp18);
2886 	rt2661_bbp_write(sc, 21, sc->bbp21);
2887 	rt2661_bbp_write(sc, 22, sc->bbp22);
2888 	rt2661_bbp_write(sc, 64, sc->bbp64);
2889 
2890 	return bbp66 == 1;
2891 }
2892 #endif
2893 
2894 static int
2895 rt2661_prepare_beacon(struct rt2661_softc *sc)
2896 {
2897 	struct ieee80211com *ic = &sc->sc_ic;
2898 	struct ieee80211_beacon_offsets bo;
2899 	struct rt2661_tx_desc desc;
2900 	struct mbuf *m0;
2901 	int rate;
2902 
2903 	m0 = ieee80211_beacon_alloc(ic, ic->ic_bss, &bo);
2904 	if (m0 == NULL) {
2905 		device_printf(sc->sc_dev, "could not allocate beacon frame\n");
2906 		return ENOBUFS;
2907 	}
2908 
2909 	/* send beacons at the lowest available rate */
2910 	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bss->ni_chan) ? 12 : 2;
2911 
2912 	rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
2913 	    m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT, 0);
2914 
2915 	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2916 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2917 
2918 	/* copy beacon header and payload into NIC memory */
2919 	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
2920 	    mtod(m0, uint8_t *), m0->m_pkthdr.len);
2921 
2922 	m_freem(m0);
2923 	return 0;
2924 }
2925 
2926 /*
2927  * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
2928  * and HostAP operating modes.
2929  */
2930 static void
2931 rt2661_enable_tsf_sync(struct rt2661_softc *sc)
2932 {
2933 	struct ieee80211com *ic = &sc->sc_ic;
2934 	uint32_t tmp;
2935 
2936 	if (ic->ic_opmode != IEEE80211_M_STA) {
2937 		/*
2938 		 * Change default 16ms TBTT adjustment to 8ms.
2939 		 * Must be done before enabling beacon generation.
2940 		 */
2941 		RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
2942 	}
2943 
2944 	tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
2945 
2946 	/* set beacon interval (in 1/16ms unit) */
2947 	tmp |= ic->ic_bss->ni_intval * 16;
2948 
2949 	tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
2950 	if (ic->ic_opmode == IEEE80211_M_STA)
2951 		tmp |= RT2661_TSF_MODE(1);
2952 	else
2953 		tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
2954 
2955 	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
2956 }
2957 
2958 /*
2959  * Retrieve the "Received Signal Strength Indicator" from the raw values
2960  * contained in Rx descriptors.  The computation depends on which band the
2961  * frame was received.  Correction values taken from the reference driver.
2962  */
2963 static int
2964 rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
2965 {
2966 	int lna, agc, rssi;
2967 
2968 	lna = (raw >> 5) & 0x3;
2969 	agc = raw & 0x1f;
2970 
2971 	rssi = 2 * agc;
2972 
2973 	if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
2974 		rssi += sc->rssi_2ghz_corr;
2975 
2976 		if (lna == 1)
2977 			rssi -= 64;
2978 		else if (lna == 2)
2979 			rssi -= 74;
2980 		else if (lna == 3)
2981 			rssi -= 90;
2982 	} else {
2983 		rssi += sc->rssi_5ghz_corr;
2984 
2985 		if (lna == 1)
2986 			rssi -= 64;
2987 		else if (lna == 2)
2988 			rssi -= 86;
2989 		else if (lna == 3)
2990 			rssi -= 100;
2991 	}
2992 	return rssi;
2993 }
2994 
2995 static void
2996 rt2661_dma_map_mbuf(void *arg, bus_dma_segment_t *seg, int nseg,
2997 		    bus_size_t map_size __unused, int error)
2998 {
2999 	struct rt2661_dmamap *map = arg;
3000 
3001 	if (error)
3002 		return;
3003 
3004 	KASSERT(nseg <= RT2661_MAX_SCATTER, ("too many DMA segments"));
3005 
3006 	bcopy(seg, map->segs, nseg * sizeof(bus_dma_segment_t));
3007 	map->nseg = nseg;
3008 }
3009 
3010 static void
3011 rt2661_led_newstate(struct rt2661_softc *sc, enum ieee80211_state nstate)
3012 {
3013 	struct ieee80211com *ic = &sc->sc_ic;
3014 	uint32_t off, on;
3015 	uint32_t mail = sc->mcu_led;
3016 
3017 	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY) {
3018 		DPRINTF(("%s failed\n", __func__));
3019 		return;
3020 	}
3021 
3022 	switch (nstate) {
3023 	case IEEE80211_S_INIT:
3024 		mail &= ~(RT2661_MCU_LED_LINKA | RT2661_MCU_LED_LINKG |
3025 			  RT2661_MCU_LED_RF);
3026 		break;
3027 	default:
3028 		if (ic->ic_curchan == NULL)
3029 			return;
3030 
3031 		on = RT2661_MCU_LED_LINKG;
3032 		off = RT2661_MCU_LED_LINKA;
3033 		if (IEEE80211_IS_CHAN_5GHZ(ic->ic_curchan)) {
3034 			on = RT2661_MCU_LED_LINKA;
3035 			off = RT2661_MCU_LED_LINKG;
3036 		}
3037 
3038 		mail |= RT2661_MCU_LED_RF | on;
3039 		mail &= ~off;
3040 		break;
3041 	}
3042 
3043 	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
3044 		  RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | mail);
3045 	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | RT2661_MCU_SET_LED);
3046 }
3047