rt2661.c revision 195618
1/*	$FreeBSD: head/sys/dev/ral/rt2661.c 195618 2009-07-11 15:02:45Z rpaulo $	*/
2
3/*-
4 * Copyright (c) 2006
5 *	Damien Bergamini <damien.bergamini@free.fr>
6 *
7 * Permission to use, copy, modify, and distribute this software for any
8 * purpose with or without fee is hereby granted, provided that the above
9 * copyright notice and this permission notice appear in all copies.
10 *
11 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
12 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
13 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
14 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
15 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
16 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
17 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
18 */
19
20#include <sys/cdefs.h>
21__FBSDID("$FreeBSD: head/sys/dev/ral/rt2661.c 195618 2009-07-11 15:02:45Z rpaulo $");
22
23/*-
24 * Ralink Technology RT2561, RT2561S and RT2661 chipset driver
25 * http://www.ralinktech.com/
26 */
27
28#include <sys/param.h>
29#include <sys/sysctl.h>
30#include <sys/sockio.h>
31#include <sys/mbuf.h>
32#include <sys/kernel.h>
33#include <sys/socket.h>
34#include <sys/systm.h>
35#include <sys/malloc.h>
36#include <sys/lock.h>
37#include <sys/mutex.h>
38#include <sys/module.h>
39#include <sys/bus.h>
40#include <sys/endian.h>
41#include <sys/firmware.h>
42
43#include <machine/bus.h>
44#include <machine/resource.h>
45#include <sys/rman.h>
46
47#include <net/bpf.h>
48#include <net/if.h>
49#include <net/if_arp.h>
50#include <net/ethernet.h>
51#include <net/if_dl.h>
52#include <net/if_media.h>
53#include <net/if_types.h>
54
55#include <net80211/ieee80211_var.h>
56#include <net80211/ieee80211_radiotap.h>
57#include <net80211/ieee80211_regdomain.h>
58#include <net80211/ieee80211_amrr.h>
59
60#include <netinet/in.h>
61#include <netinet/in_systm.h>
62#include <netinet/in_var.h>
63#include <netinet/ip.h>
64#include <netinet/if_ether.h>
65
66#include <dev/ral/rt2661reg.h>
67#include <dev/ral/rt2661var.h>
68
69#define RAL_DEBUG
70#ifdef RAL_DEBUG
71#define DPRINTF(sc, fmt, ...) do {				\
72	if (sc->sc_debug > 0)					\
73		printf(fmt, __VA_ARGS__);			\
74} while (0)
75#define DPRINTFN(sc, n, fmt, ...) do {				\
76	if (sc->sc_debug >= (n))				\
77		printf(fmt, __VA_ARGS__);			\
78} while (0)
79#else
80#define DPRINTF(sc, fmt, ...)
81#define DPRINTFN(sc, n, fmt, ...)
82#endif
83
84static struct ieee80211vap *rt2661_vap_create(struct ieee80211com *,
85			    const char name[IFNAMSIZ], int unit, int opmode,
86			    int flags, const uint8_t bssid[IEEE80211_ADDR_LEN],
87			    const uint8_t mac[IEEE80211_ADDR_LEN]);
88static void		rt2661_vap_delete(struct ieee80211vap *);
89static void		rt2661_dma_map_addr(void *, bus_dma_segment_t *, int,
90			    int);
91static int		rt2661_alloc_tx_ring(struct rt2661_softc *,
92			    struct rt2661_tx_ring *, int);
93static void		rt2661_reset_tx_ring(struct rt2661_softc *,
94			    struct rt2661_tx_ring *);
95static void		rt2661_free_tx_ring(struct rt2661_softc *,
96			    struct rt2661_tx_ring *);
97static int		rt2661_alloc_rx_ring(struct rt2661_softc *,
98			    struct rt2661_rx_ring *, int);
99static void		rt2661_reset_rx_ring(struct rt2661_softc *,
100			    struct rt2661_rx_ring *);
101static void		rt2661_free_rx_ring(struct rt2661_softc *,
102			    struct rt2661_rx_ring *);
103static struct ieee80211_node *rt2661_node_alloc(struct ieee80211vap *,
104			    const uint8_t [IEEE80211_ADDR_LEN]);
105static void		rt2661_newassoc(struct ieee80211_node *, int);
106static int		rt2661_newstate(struct ieee80211vap *,
107			    enum ieee80211_state, int);
108static uint16_t		rt2661_eeprom_read(struct rt2661_softc *, uint8_t);
109static void		rt2661_rx_intr(struct rt2661_softc *);
110static void		rt2661_tx_intr(struct rt2661_softc *);
111static void		rt2661_tx_dma_intr(struct rt2661_softc *,
112			    struct rt2661_tx_ring *);
113static void		rt2661_mcu_beacon_expire(struct rt2661_softc *);
114static void		rt2661_mcu_wakeup(struct rt2661_softc *);
115static void		rt2661_mcu_cmd_intr(struct rt2661_softc *);
116static void		rt2661_scan_start(struct ieee80211com *);
117static void		rt2661_scan_end(struct ieee80211com *);
118static void		rt2661_set_channel(struct ieee80211com *);
119static void		rt2661_setup_tx_desc(struct rt2661_softc *,
120			    struct rt2661_tx_desc *, uint32_t, uint16_t, int,
121			    int, const bus_dma_segment_t *, int, int);
122static int		rt2661_tx_data(struct rt2661_softc *, struct mbuf *,
123			    struct ieee80211_node *, int);
124static int		rt2661_tx_mgt(struct rt2661_softc *, struct mbuf *,
125			    struct ieee80211_node *);
126static void		rt2661_start_locked(struct ifnet *);
127static void		rt2661_start(struct ifnet *);
128static int		rt2661_raw_xmit(struct ieee80211_node *, struct mbuf *,
129			    const struct ieee80211_bpf_params *);
130static void		rt2661_watchdog(void *);
131static int		rt2661_ioctl(struct ifnet *, u_long, caddr_t);
132static void		rt2661_bbp_write(struct rt2661_softc *, uint8_t,
133			    uint8_t);
134static uint8_t		rt2661_bbp_read(struct rt2661_softc *, uint8_t);
135static void		rt2661_rf_write(struct rt2661_softc *, uint8_t,
136			    uint32_t);
137static int		rt2661_tx_cmd(struct rt2661_softc *, uint8_t,
138			    uint16_t);
139static void		rt2661_select_antenna(struct rt2661_softc *);
140static void		rt2661_enable_mrr(struct rt2661_softc *);
141static void		rt2661_set_txpreamble(struct rt2661_softc *);
142static void		rt2661_set_basicrates(struct rt2661_softc *,
143			    const struct ieee80211_rateset *);
144static void		rt2661_select_band(struct rt2661_softc *,
145			    struct ieee80211_channel *);
146static void		rt2661_set_chan(struct rt2661_softc *,
147			    struct ieee80211_channel *);
148static void		rt2661_set_bssid(struct rt2661_softc *,
149			    const uint8_t *);
150static void		rt2661_set_macaddr(struct rt2661_softc *,
151			   const uint8_t *);
152static void		rt2661_update_promisc(struct ifnet *);
153static int		rt2661_wme_update(struct ieee80211com *) __unused;
154static void		rt2661_update_slot(struct ifnet *);
155static const char	*rt2661_get_rf(int);
156static void		rt2661_read_eeprom(struct rt2661_softc *,
157			    uint8_t macaddr[IEEE80211_ADDR_LEN]);
158static int		rt2661_bbp_init(struct rt2661_softc *);
159static void		rt2661_init_locked(struct rt2661_softc *);
160static void		rt2661_init(void *);
161static void             rt2661_stop_locked(struct rt2661_softc *);
162static void		rt2661_stop(void *);
163static int		rt2661_load_microcode(struct rt2661_softc *);
164#ifdef notyet
165static void		rt2661_rx_tune(struct rt2661_softc *);
166static void		rt2661_radar_start(struct rt2661_softc *);
167static int		rt2661_radar_stop(struct rt2661_softc *);
168#endif
169static int		rt2661_prepare_beacon(struct rt2661_softc *,
170			    struct ieee80211vap *);
171static void		rt2661_enable_tsf_sync(struct rt2661_softc *);
172static void		rt2661_enable_tsf(struct rt2661_softc *);
173static int		rt2661_get_rssi(struct rt2661_softc *, uint8_t);
174
175static const struct {
176	uint32_t	reg;
177	uint32_t	val;
178} rt2661_def_mac[] = {
179	RT2661_DEF_MAC
180};
181
182static const struct {
183	uint8_t	reg;
184	uint8_t	val;
185} rt2661_def_bbp[] = {
186	RT2661_DEF_BBP
187};
188
189static const struct rfprog {
190	uint8_t		chan;
191	uint32_t	r1, r2, r3, r4;
192}  rt2661_rf5225_1[] = {
193	RT2661_RF5225_1
194}, rt2661_rf5225_2[] = {
195	RT2661_RF5225_2
196};
197
198int
199rt2661_attach(device_t dev, int id)
200{
201	struct rt2661_softc *sc = device_get_softc(dev);
202	struct ieee80211com *ic;
203	struct ifnet *ifp;
204	uint32_t val;
205	int error, ac, ntries;
206	uint8_t bands;
207	uint8_t macaddr[IEEE80211_ADDR_LEN];
208
209	sc->sc_id = id;
210	sc->sc_dev = dev;
211
212	ifp = sc->sc_ifp = if_alloc(IFT_IEEE80211);
213	if (ifp == NULL) {
214		device_printf(sc->sc_dev, "can not if_alloc()\n");
215		return ENOMEM;
216	}
217	ic = ifp->if_l2com;
218
219	mtx_init(&sc->sc_mtx, device_get_nameunit(dev), MTX_NETWORK_LOCK,
220	    MTX_DEF | MTX_RECURSE);
221
222	callout_init_mtx(&sc->watchdog_ch, &sc->sc_mtx, 0);
223
224	/* wait for NIC to initialize */
225	for (ntries = 0; ntries < 1000; ntries++) {
226		if ((val = RAL_READ(sc, RT2661_MAC_CSR0)) != 0)
227			break;
228		DELAY(1000);
229	}
230	if (ntries == 1000) {
231		device_printf(sc->sc_dev,
232		    "timeout waiting for NIC to initialize\n");
233		error = EIO;
234		goto fail1;
235	}
236
237	/* retrieve RF rev. no and various other things from EEPROM */
238	rt2661_read_eeprom(sc, macaddr);
239
240	device_printf(dev, "MAC/BBP RT%X, RF %s\n", val,
241	    rt2661_get_rf(sc->rf_rev));
242
243	/*
244	 * Allocate Tx and Rx rings.
245	 */
246	for (ac = 0; ac < 4; ac++) {
247		error = rt2661_alloc_tx_ring(sc, &sc->txq[ac],
248		    RT2661_TX_RING_COUNT);
249		if (error != 0) {
250			device_printf(sc->sc_dev,
251			    "could not allocate Tx ring %d\n", ac);
252			goto fail2;
253		}
254	}
255
256	error = rt2661_alloc_tx_ring(sc, &sc->mgtq, RT2661_MGT_RING_COUNT);
257	if (error != 0) {
258		device_printf(sc->sc_dev, "could not allocate Mgt ring\n");
259		goto fail2;
260	}
261
262	error = rt2661_alloc_rx_ring(sc, &sc->rxq, RT2661_RX_RING_COUNT);
263	if (error != 0) {
264		device_printf(sc->sc_dev, "could not allocate Rx ring\n");
265		goto fail3;
266	}
267
268	ifp->if_softc = sc;
269	if_initname(ifp, device_get_name(dev), device_get_unit(dev));
270	ifp->if_flags = IFF_BROADCAST | IFF_SIMPLEX | IFF_MULTICAST;
271	ifp->if_init = rt2661_init;
272	ifp->if_ioctl = rt2661_ioctl;
273	ifp->if_start = rt2661_start;
274	IFQ_SET_MAXLEN(&ifp->if_snd, IFQ_MAXLEN);
275	ifp->if_snd.ifq_drv_maxlen = IFQ_MAXLEN;
276	IFQ_SET_READY(&ifp->if_snd);
277
278	ic->ic_ifp = ifp;
279	ic->ic_opmode = IEEE80211_M_STA;
280	ic->ic_phytype = IEEE80211_T_OFDM; /* not only, but not used */
281
282	/* set device capabilities */
283	ic->ic_caps =
284		  IEEE80211_C_STA		/* station mode */
285		| IEEE80211_C_IBSS		/* ibss, nee adhoc, mode */
286		| IEEE80211_C_HOSTAP		/* hostap mode */
287		| IEEE80211_C_MONITOR		/* monitor mode */
288		| IEEE80211_C_AHDEMO		/* adhoc demo mode */
289		| IEEE80211_C_WDS		/* 4-address traffic works */
290		| IEEE80211_C_MBSS		/* mesh point link mode */
291		| IEEE80211_C_SHPREAMBLE	/* short preamble supported */
292		| IEEE80211_C_SHSLOT		/* short slot time supported */
293		| IEEE80211_C_WPA		/* capable of WPA1+WPA2 */
294		| IEEE80211_C_BGSCAN		/* capable of bg scanning */
295#ifdef notyet
296		| IEEE80211_C_TXFRAG		/* handle tx frags */
297		| IEEE80211_C_WME		/* 802.11e */
298#endif
299		;
300
301	bands = 0;
302	setbit(&bands, IEEE80211_MODE_11B);
303	setbit(&bands, IEEE80211_MODE_11G);
304	if (sc->rf_rev == RT2661_RF_5225 || sc->rf_rev == RT2661_RF_5325)
305		setbit(&bands, IEEE80211_MODE_11A);
306	ieee80211_init_channels(ic, NULL, &bands);
307
308	ieee80211_ifattach(ic, macaddr);
309	ic->ic_newassoc = rt2661_newassoc;
310	ic->ic_node_alloc = rt2661_node_alloc;
311#if 0
312	ic->ic_wme.wme_update = rt2661_wme_update;
313#endif
314	ic->ic_scan_start = rt2661_scan_start;
315	ic->ic_scan_end = rt2661_scan_end;
316	ic->ic_set_channel = rt2661_set_channel;
317	ic->ic_updateslot = rt2661_update_slot;
318	ic->ic_update_promisc = rt2661_update_promisc;
319	ic->ic_raw_xmit = rt2661_raw_xmit;
320
321	ic->ic_vap_create = rt2661_vap_create;
322	ic->ic_vap_delete = rt2661_vap_delete;
323
324	ieee80211_radiotap_attach(ic,
325	    &sc->sc_txtap.wt_ihdr, sizeof(sc->sc_txtap),
326		RT2661_TX_RADIOTAP_PRESENT,
327	    &sc->sc_rxtap.wr_ihdr, sizeof(sc->sc_rxtap),
328		RT2661_RX_RADIOTAP_PRESENT);
329
330#ifdef RAL_DEBUG
331	SYSCTL_ADD_INT(device_get_sysctl_ctx(dev),
332	    SYSCTL_CHILDREN(device_get_sysctl_tree(dev)), OID_AUTO,
333	    "debug", CTLFLAG_RW, &sc->sc_debug, 0, "debug msgs");
334#endif
335	if (bootverbose)
336		ieee80211_announce(ic);
337
338	return 0;
339
340fail3:	rt2661_free_tx_ring(sc, &sc->mgtq);
341fail2:	while (--ac >= 0)
342		rt2661_free_tx_ring(sc, &sc->txq[ac]);
343fail1:	mtx_destroy(&sc->sc_mtx);
344	if_free(ifp);
345	return error;
346}
347
348int
349rt2661_detach(void *xsc)
350{
351	struct rt2661_softc *sc = xsc;
352	struct ifnet *ifp = sc->sc_ifp;
353	struct ieee80211com *ic = ifp->if_l2com;
354
355	RAL_LOCK(sc);
356	rt2661_stop_locked(sc);
357	RAL_UNLOCK(sc);
358
359	ieee80211_ifdetach(ic);
360
361	rt2661_free_tx_ring(sc, &sc->txq[0]);
362	rt2661_free_tx_ring(sc, &sc->txq[1]);
363	rt2661_free_tx_ring(sc, &sc->txq[2]);
364	rt2661_free_tx_ring(sc, &sc->txq[3]);
365	rt2661_free_tx_ring(sc, &sc->mgtq);
366	rt2661_free_rx_ring(sc, &sc->rxq);
367
368	if_free(ifp);
369
370	mtx_destroy(&sc->sc_mtx);
371
372	return 0;
373}
374
375static struct ieee80211vap *
376rt2661_vap_create(struct ieee80211com *ic,
377	const char name[IFNAMSIZ], int unit, int opmode, int flags,
378	const uint8_t bssid[IEEE80211_ADDR_LEN],
379	const uint8_t mac[IEEE80211_ADDR_LEN])
380{
381	struct ifnet *ifp = ic->ic_ifp;
382	struct rt2661_vap *rvp;
383	struct ieee80211vap *vap;
384
385	switch (opmode) {
386	case IEEE80211_M_STA:
387	case IEEE80211_M_IBSS:
388	case IEEE80211_M_AHDEMO:
389	case IEEE80211_M_MONITOR:
390	case IEEE80211_M_HOSTAP:
391	case IEEE80211_M_MBSS:
392		/* XXXRP: TBD */
393		if (!TAILQ_EMPTY(&ic->ic_vaps)) {
394			if_printf(ifp, "only 1 vap supported\n");
395			return NULL;
396		}
397		if (opmode == IEEE80211_M_STA)
398			flags |= IEEE80211_CLONE_NOBEACONS;
399		break;
400	case IEEE80211_M_WDS:
401		if (TAILQ_EMPTY(&ic->ic_vaps) ||
402		    ic->ic_opmode != IEEE80211_M_HOSTAP) {
403			if_printf(ifp, "wds only supported in ap mode\n");
404			return NULL;
405		}
406		/*
407		 * Silently remove any request for a unique
408		 * bssid; WDS vap's always share the local
409		 * mac address.
410		 */
411		flags &= ~IEEE80211_CLONE_BSSID;
412		break;
413	default:
414		if_printf(ifp, "unknown opmode %d\n", opmode);
415		return NULL;
416	}
417	rvp = (struct rt2661_vap *) malloc(sizeof(struct rt2661_vap),
418	    M_80211_VAP, M_NOWAIT | M_ZERO);
419	if (rvp == NULL)
420		return NULL;
421	vap = &rvp->ral_vap;
422	ieee80211_vap_setup(ic, vap, name, unit, opmode, flags, bssid, mac);
423
424	/* override state transition machine */
425	rvp->ral_newstate = vap->iv_newstate;
426	vap->iv_newstate = rt2661_newstate;
427#if 0
428	vap->iv_update_beacon = rt2661_beacon_update;
429#endif
430
431	ieee80211_amrr_init(&rvp->amrr, vap,
432	    IEEE80211_AMRR_MIN_SUCCESS_THRESHOLD,
433	    IEEE80211_AMRR_MAX_SUCCESS_THRESHOLD,
434	    500 /* ms */);
435
436	/* complete setup */
437	ieee80211_vap_attach(vap, ieee80211_media_change, ieee80211_media_status);
438	if (TAILQ_FIRST(&ic->ic_vaps) == vap)
439		ic->ic_opmode = opmode;
440	return vap;
441}
442
443static void
444rt2661_vap_delete(struct ieee80211vap *vap)
445{
446	struct rt2661_vap *rvp = RT2661_VAP(vap);
447
448	ieee80211_amrr_cleanup(&rvp->amrr);
449	ieee80211_vap_detach(vap);
450	free(rvp, M_80211_VAP);
451}
452
453void
454rt2661_shutdown(void *xsc)
455{
456	struct rt2661_softc *sc = xsc;
457
458	rt2661_stop(sc);
459}
460
461void
462rt2661_suspend(void *xsc)
463{
464	struct rt2661_softc *sc = xsc;
465
466	rt2661_stop(sc);
467}
468
469void
470rt2661_resume(void *xsc)
471{
472	struct rt2661_softc *sc = xsc;
473	struct ifnet *ifp = sc->sc_ifp;
474
475	if (ifp->if_flags & IFF_UP)
476		rt2661_init(sc);
477}
478
479static void
480rt2661_dma_map_addr(void *arg, bus_dma_segment_t *segs, int nseg, int error)
481{
482	if (error != 0)
483		return;
484
485	KASSERT(nseg == 1, ("too many DMA segments, %d should be 1", nseg));
486
487	*(bus_addr_t *)arg = segs[0].ds_addr;
488}
489
490static int
491rt2661_alloc_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring,
492    int count)
493{
494	int i, error;
495
496	ring->count = count;
497	ring->queued = 0;
498	ring->cur = ring->next = ring->stat = 0;
499
500	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 4, 0,
501	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
502	    count * RT2661_TX_DESC_SIZE, 1, count * RT2661_TX_DESC_SIZE,
503	    0, NULL, NULL, &ring->desc_dmat);
504	if (error != 0) {
505		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
506		goto fail;
507	}
508
509	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
510	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
511	if (error != 0) {
512		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
513		goto fail;
514	}
515
516	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
517	    count * RT2661_TX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
518	    0);
519	if (error != 0) {
520		device_printf(sc->sc_dev, "could not load desc DMA map\n");
521		goto fail;
522	}
523
524	ring->data = malloc(count * sizeof (struct rt2661_tx_data), M_DEVBUF,
525	    M_NOWAIT | M_ZERO);
526	if (ring->data == NULL) {
527		device_printf(sc->sc_dev, "could not allocate soft data\n");
528		error = ENOMEM;
529		goto fail;
530	}
531
532	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
533	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
534	    RT2661_MAX_SCATTER, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
535	if (error != 0) {
536		device_printf(sc->sc_dev, "could not create data DMA tag\n");
537		goto fail;
538	}
539
540	for (i = 0; i < count; i++) {
541		error = bus_dmamap_create(ring->data_dmat, 0,
542		    &ring->data[i].map);
543		if (error != 0) {
544			device_printf(sc->sc_dev, "could not create DMA map\n");
545			goto fail;
546		}
547	}
548
549	return 0;
550
551fail:	rt2661_free_tx_ring(sc, ring);
552	return error;
553}
554
555static void
556rt2661_reset_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
557{
558	struct rt2661_tx_desc *desc;
559	struct rt2661_tx_data *data;
560	int i;
561
562	for (i = 0; i < ring->count; i++) {
563		desc = &ring->desc[i];
564		data = &ring->data[i];
565
566		if (data->m != NULL) {
567			bus_dmamap_sync(ring->data_dmat, data->map,
568			    BUS_DMASYNC_POSTWRITE);
569			bus_dmamap_unload(ring->data_dmat, data->map);
570			m_freem(data->m);
571			data->m = NULL;
572		}
573
574		if (data->ni != NULL) {
575			ieee80211_free_node(data->ni);
576			data->ni = NULL;
577		}
578
579		desc->flags = 0;
580	}
581
582	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
583
584	ring->queued = 0;
585	ring->cur = ring->next = ring->stat = 0;
586}
587
588static void
589rt2661_free_tx_ring(struct rt2661_softc *sc, struct rt2661_tx_ring *ring)
590{
591	struct rt2661_tx_data *data;
592	int i;
593
594	if (ring->desc != NULL) {
595		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
596		    BUS_DMASYNC_POSTWRITE);
597		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
598		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
599	}
600
601	if (ring->desc_dmat != NULL)
602		bus_dma_tag_destroy(ring->desc_dmat);
603
604	if (ring->data != NULL) {
605		for (i = 0; i < ring->count; i++) {
606			data = &ring->data[i];
607
608			if (data->m != NULL) {
609				bus_dmamap_sync(ring->data_dmat, data->map,
610				    BUS_DMASYNC_POSTWRITE);
611				bus_dmamap_unload(ring->data_dmat, data->map);
612				m_freem(data->m);
613			}
614
615			if (data->ni != NULL)
616				ieee80211_free_node(data->ni);
617
618			if (data->map != NULL)
619				bus_dmamap_destroy(ring->data_dmat, data->map);
620		}
621
622		free(ring->data, M_DEVBUF);
623	}
624
625	if (ring->data_dmat != NULL)
626		bus_dma_tag_destroy(ring->data_dmat);
627}
628
629static int
630rt2661_alloc_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring,
631    int count)
632{
633	struct rt2661_rx_desc *desc;
634	struct rt2661_rx_data *data;
635	bus_addr_t physaddr;
636	int i, error;
637
638	ring->count = count;
639	ring->cur = ring->next = 0;
640
641	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 4, 0,
642	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL,
643	    count * RT2661_RX_DESC_SIZE, 1, count * RT2661_RX_DESC_SIZE,
644	    0, NULL, NULL, &ring->desc_dmat);
645	if (error != 0) {
646		device_printf(sc->sc_dev, "could not create desc DMA tag\n");
647		goto fail;
648	}
649
650	error = bus_dmamem_alloc(ring->desc_dmat, (void **)&ring->desc,
651	    BUS_DMA_NOWAIT | BUS_DMA_ZERO, &ring->desc_map);
652	if (error != 0) {
653		device_printf(sc->sc_dev, "could not allocate DMA memory\n");
654		goto fail;
655	}
656
657	error = bus_dmamap_load(ring->desc_dmat, ring->desc_map, ring->desc,
658	    count * RT2661_RX_DESC_SIZE, rt2661_dma_map_addr, &ring->physaddr,
659	    0);
660	if (error != 0) {
661		device_printf(sc->sc_dev, "could not load desc DMA map\n");
662		goto fail;
663	}
664
665	ring->data = malloc(count * sizeof (struct rt2661_rx_data), M_DEVBUF,
666	    M_NOWAIT | M_ZERO);
667	if (ring->data == NULL) {
668		device_printf(sc->sc_dev, "could not allocate soft data\n");
669		error = ENOMEM;
670		goto fail;
671	}
672
673	/*
674	 * Pre-allocate Rx buffers and populate Rx ring.
675	 */
676	error = bus_dma_tag_create(bus_get_dma_tag(sc->sc_dev), 1, 0,
677	    BUS_SPACE_MAXADDR_32BIT, BUS_SPACE_MAXADDR, NULL, NULL, MCLBYTES,
678	    1, MCLBYTES, 0, NULL, NULL, &ring->data_dmat);
679	if (error != 0) {
680		device_printf(sc->sc_dev, "could not create data DMA tag\n");
681		goto fail;
682	}
683
684	for (i = 0; i < count; i++) {
685		desc = &sc->rxq.desc[i];
686		data = &sc->rxq.data[i];
687
688		error = bus_dmamap_create(ring->data_dmat, 0, &data->map);
689		if (error != 0) {
690			device_printf(sc->sc_dev, "could not create DMA map\n");
691			goto fail;
692		}
693
694		data->m = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
695		if (data->m == NULL) {
696			device_printf(sc->sc_dev,
697			    "could not allocate rx mbuf\n");
698			error = ENOMEM;
699			goto fail;
700		}
701
702		error = bus_dmamap_load(ring->data_dmat, data->map,
703		    mtod(data->m, void *), MCLBYTES, rt2661_dma_map_addr,
704		    &physaddr, 0);
705		if (error != 0) {
706			device_printf(sc->sc_dev,
707			    "could not load rx buf DMA map");
708			goto fail;
709		}
710
711		desc->flags = htole32(RT2661_RX_BUSY);
712		desc->physaddr = htole32(physaddr);
713	}
714
715	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
716
717	return 0;
718
719fail:	rt2661_free_rx_ring(sc, ring);
720	return error;
721}
722
723static void
724rt2661_reset_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
725{
726	int i;
727
728	for (i = 0; i < ring->count; i++)
729		ring->desc[i].flags = htole32(RT2661_RX_BUSY);
730
731	bus_dmamap_sync(ring->desc_dmat, ring->desc_map, BUS_DMASYNC_PREWRITE);
732
733	ring->cur = ring->next = 0;
734}
735
736static void
737rt2661_free_rx_ring(struct rt2661_softc *sc, struct rt2661_rx_ring *ring)
738{
739	struct rt2661_rx_data *data;
740	int i;
741
742	if (ring->desc != NULL) {
743		bus_dmamap_sync(ring->desc_dmat, ring->desc_map,
744		    BUS_DMASYNC_POSTWRITE);
745		bus_dmamap_unload(ring->desc_dmat, ring->desc_map);
746		bus_dmamem_free(ring->desc_dmat, ring->desc, ring->desc_map);
747	}
748
749	if (ring->desc_dmat != NULL)
750		bus_dma_tag_destroy(ring->desc_dmat);
751
752	if (ring->data != NULL) {
753		for (i = 0; i < ring->count; i++) {
754			data = &ring->data[i];
755
756			if (data->m != NULL) {
757				bus_dmamap_sync(ring->data_dmat, data->map,
758				    BUS_DMASYNC_POSTREAD);
759				bus_dmamap_unload(ring->data_dmat, data->map);
760				m_freem(data->m);
761			}
762
763			if (data->map != NULL)
764				bus_dmamap_destroy(ring->data_dmat, data->map);
765		}
766
767		free(ring->data, M_DEVBUF);
768	}
769
770	if (ring->data_dmat != NULL)
771		bus_dma_tag_destroy(ring->data_dmat);
772}
773
774static struct ieee80211_node *
775rt2661_node_alloc(struct ieee80211vap *vap,
776	const uint8_t mac[IEEE80211_ADDR_LEN])
777{
778	struct rt2661_node *rn;
779
780	rn = malloc(sizeof (struct rt2661_node), M_80211_NODE,
781	    M_NOWAIT | M_ZERO);
782
783	return (rn != NULL) ? &rn->ni : NULL;
784}
785
786static void
787rt2661_newassoc(struct ieee80211_node *ni, int isnew)
788{
789	struct ieee80211vap *vap = ni->ni_vap;
790
791	ieee80211_amrr_node_init(&RT2661_VAP(vap)->amrr,
792	    &RT2661_NODE(ni)->amrr, ni);
793}
794
795static int
796rt2661_newstate(struct ieee80211vap *vap, enum ieee80211_state nstate, int arg)
797{
798	struct rt2661_vap *rvp = RT2661_VAP(vap);
799	struct ieee80211com *ic = vap->iv_ic;
800	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
801	int error;
802
803	if (nstate == IEEE80211_S_INIT && vap->iv_state == IEEE80211_S_RUN) {
804		uint32_t tmp;
805
806		/* abort TSF synchronization */
807		tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
808		RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0x00ffffff);
809	}
810
811	error = rvp->ral_newstate(vap, nstate, arg);
812
813	if (error == 0 && nstate == IEEE80211_S_RUN) {
814		struct ieee80211_node *ni = vap->iv_bss;
815
816		if (vap->iv_opmode != IEEE80211_M_MONITOR) {
817			rt2661_enable_mrr(sc);
818			rt2661_set_txpreamble(sc);
819			rt2661_set_basicrates(sc, &ni->ni_rates);
820			rt2661_set_bssid(sc, ni->ni_bssid);
821		}
822
823		if (vap->iv_opmode == IEEE80211_M_HOSTAP ||
824		    vap->iv_opmode == IEEE80211_M_IBSS ||
825		    vap->iv_opmode == IEEE80211_M_MBSS) {
826			error = rt2661_prepare_beacon(sc, vap);
827			if (error != 0)
828				return error;
829		}
830		if (vap->iv_opmode != IEEE80211_M_MONITOR)
831			rt2661_enable_tsf_sync(sc);
832		else
833			rt2661_enable_tsf(sc);
834	}
835	return error;
836}
837
838/*
839 * Read 16 bits at address 'addr' from the serial EEPROM (either 93C46 or
840 * 93C66).
841 */
842static uint16_t
843rt2661_eeprom_read(struct rt2661_softc *sc, uint8_t addr)
844{
845	uint32_t tmp;
846	uint16_t val;
847	int n;
848
849	/* clock C once before the first command */
850	RT2661_EEPROM_CTL(sc, 0);
851
852	RT2661_EEPROM_CTL(sc, RT2661_S);
853	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
854	RT2661_EEPROM_CTL(sc, RT2661_S);
855
856	/* write start bit (1) */
857	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
858	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
859
860	/* write READ opcode (10) */
861	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D);
862	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_D | RT2661_C);
863	RT2661_EEPROM_CTL(sc, RT2661_S);
864	RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
865
866	/* write address (A5-A0 or A7-A0) */
867	n = (RAL_READ(sc, RT2661_E2PROM_CSR) & RT2661_93C46) ? 5 : 7;
868	for (; n >= 0; n--) {
869		RT2661_EEPROM_CTL(sc, RT2661_S |
870		    (((addr >> n) & 1) << RT2661_SHIFT_D));
871		RT2661_EEPROM_CTL(sc, RT2661_S |
872		    (((addr >> n) & 1) << RT2661_SHIFT_D) | RT2661_C);
873	}
874
875	RT2661_EEPROM_CTL(sc, RT2661_S);
876
877	/* read data Q15-Q0 */
878	val = 0;
879	for (n = 15; n >= 0; n--) {
880		RT2661_EEPROM_CTL(sc, RT2661_S | RT2661_C);
881		tmp = RAL_READ(sc, RT2661_E2PROM_CSR);
882		val |= ((tmp & RT2661_Q) >> RT2661_SHIFT_Q) << n;
883		RT2661_EEPROM_CTL(sc, RT2661_S);
884	}
885
886	RT2661_EEPROM_CTL(sc, 0);
887
888	/* clear Chip Select and clock C */
889	RT2661_EEPROM_CTL(sc, RT2661_S);
890	RT2661_EEPROM_CTL(sc, 0);
891	RT2661_EEPROM_CTL(sc, RT2661_C);
892
893	return val;
894}
895
896static void
897rt2661_tx_intr(struct rt2661_softc *sc)
898{
899	struct ifnet *ifp = sc->sc_ifp;
900	struct rt2661_tx_ring *txq;
901	struct rt2661_tx_data *data;
902	struct rt2661_node *rn;
903	uint32_t val;
904	int qid, retrycnt;
905
906	for (;;) {
907		struct ieee80211_node *ni;
908		struct mbuf *m;
909
910		val = RAL_READ(sc, RT2661_STA_CSR4);
911		if (!(val & RT2661_TX_STAT_VALID))
912			break;
913
914		/* retrieve the queue in which this frame was sent */
915		qid = RT2661_TX_QID(val);
916		txq = (qid <= 3) ? &sc->txq[qid] : &sc->mgtq;
917
918		/* retrieve rate control algorithm context */
919		data = &txq->data[txq->stat];
920		m = data->m;
921		data->m = NULL;
922		ni = data->ni;
923		data->ni = NULL;
924
925		/* if no frame has been sent, ignore */
926		if (ni == NULL)
927			continue;
928
929		rn = RT2661_NODE(ni);
930
931		switch (RT2661_TX_RESULT(val)) {
932		case RT2661_TX_SUCCESS:
933			retrycnt = RT2661_TX_RETRYCNT(val);
934
935			DPRINTFN(sc, 10, "data frame sent successfully after "
936			    "%d retries\n", retrycnt);
937			if (data->rix != IEEE80211_FIXED_RATE_NONE)
938				ieee80211_amrr_tx_complete(&rn->amrr,
939				    IEEE80211_AMRR_SUCCESS, retrycnt);
940			ifp->if_opackets++;
941			break;
942
943		case RT2661_TX_RETRY_FAIL:
944			retrycnt = RT2661_TX_RETRYCNT(val);
945
946			DPRINTFN(sc, 9, "%s\n",
947			    "sending data frame failed (too much retries)");
948			if (data->rix != IEEE80211_FIXED_RATE_NONE)
949				ieee80211_amrr_tx_complete(&rn->amrr,
950				    IEEE80211_AMRR_FAILURE, retrycnt);
951			ifp->if_oerrors++;
952			break;
953
954		default:
955			/* other failure */
956			device_printf(sc->sc_dev,
957			    "sending data frame failed 0x%08x\n", val);
958			ifp->if_oerrors++;
959		}
960
961		DPRINTFN(sc, 15, "tx done q=%d idx=%u\n", qid, txq->stat);
962
963		txq->queued--;
964		if (++txq->stat >= txq->count)	/* faster than % count */
965			txq->stat = 0;
966
967		if (m->m_flags & M_TXCB)
968			ieee80211_process_callback(ni, m,
969				RT2661_TX_RESULT(val) != RT2661_TX_SUCCESS);
970		m_freem(m);
971		ieee80211_free_node(ni);
972	}
973
974	sc->sc_tx_timer = 0;
975	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
976
977	rt2661_start_locked(ifp);
978}
979
980static void
981rt2661_tx_dma_intr(struct rt2661_softc *sc, struct rt2661_tx_ring *txq)
982{
983	struct rt2661_tx_desc *desc;
984	struct rt2661_tx_data *data;
985
986	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_POSTREAD);
987
988	for (;;) {
989		desc = &txq->desc[txq->next];
990		data = &txq->data[txq->next];
991
992		if ((le32toh(desc->flags) & RT2661_TX_BUSY) ||
993		    !(le32toh(desc->flags) & RT2661_TX_VALID))
994			break;
995
996		bus_dmamap_sync(txq->data_dmat, data->map,
997		    BUS_DMASYNC_POSTWRITE);
998		bus_dmamap_unload(txq->data_dmat, data->map);
999
1000		/* descriptor is no longer valid */
1001		desc->flags &= ~htole32(RT2661_TX_VALID);
1002
1003		DPRINTFN(sc, 15, "tx dma done q=%p idx=%u\n", txq, txq->next);
1004
1005		if (++txq->next >= txq->count)	/* faster than % count */
1006			txq->next = 0;
1007	}
1008
1009	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1010}
1011
1012static void
1013rt2661_rx_intr(struct rt2661_softc *sc)
1014{
1015	struct ifnet *ifp = sc->sc_ifp;
1016	struct ieee80211com *ic = ifp->if_l2com;
1017	struct rt2661_rx_desc *desc;
1018	struct rt2661_rx_data *data;
1019	bus_addr_t physaddr;
1020	struct ieee80211_frame *wh;
1021	struct ieee80211_node *ni;
1022	struct mbuf *mnew, *m;
1023	int error;
1024
1025	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1026	    BUS_DMASYNC_POSTREAD);
1027
1028	for (;;) {
1029		int8_t rssi, nf;
1030
1031		desc = &sc->rxq.desc[sc->rxq.cur];
1032		data = &sc->rxq.data[sc->rxq.cur];
1033
1034		if (le32toh(desc->flags) & RT2661_RX_BUSY)
1035			break;
1036
1037		if ((le32toh(desc->flags) & RT2661_RX_PHY_ERROR) ||
1038		    (le32toh(desc->flags) & RT2661_RX_CRC_ERROR)) {
1039			/*
1040			 * This should not happen since we did not request
1041			 * to receive those frames when we filled TXRX_CSR0.
1042			 */
1043			DPRINTFN(sc, 5, "PHY or CRC error flags 0x%08x\n",
1044			    le32toh(desc->flags));
1045			ifp->if_ierrors++;
1046			goto skip;
1047		}
1048
1049		if ((le32toh(desc->flags) & RT2661_RX_CIPHER_MASK) != 0) {
1050			ifp->if_ierrors++;
1051			goto skip;
1052		}
1053
1054		/*
1055		 * Try to allocate a new mbuf for this ring element and load it
1056		 * before processing the current mbuf. If the ring element
1057		 * cannot be loaded, drop the received packet and reuse the old
1058		 * mbuf. In the unlikely case that the old mbuf can't be
1059		 * reloaded either, explicitly panic.
1060		 */
1061		mnew = m_getcl(M_DONTWAIT, MT_DATA, M_PKTHDR);
1062		if (mnew == NULL) {
1063			ifp->if_ierrors++;
1064			goto skip;
1065		}
1066
1067		bus_dmamap_sync(sc->rxq.data_dmat, data->map,
1068		    BUS_DMASYNC_POSTREAD);
1069		bus_dmamap_unload(sc->rxq.data_dmat, data->map);
1070
1071		error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1072		    mtod(mnew, void *), MCLBYTES, rt2661_dma_map_addr,
1073		    &physaddr, 0);
1074		if (error != 0) {
1075			m_freem(mnew);
1076
1077			/* try to reload the old mbuf */
1078			error = bus_dmamap_load(sc->rxq.data_dmat, data->map,
1079			    mtod(data->m, void *), MCLBYTES,
1080			    rt2661_dma_map_addr, &physaddr, 0);
1081			if (error != 0) {
1082				/* very unlikely that it will fail... */
1083				panic("%s: could not load old rx mbuf",
1084				    device_get_name(sc->sc_dev));
1085			}
1086			ifp->if_ierrors++;
1087			goto skip;
1088		}
1089
1090		/*
1091	 	 * New mbuf successfully loaded, update Rx ring and continue
1092		 * processing.
1093		 */
1094		m = data->m;
1095		data->m = mnew;
1096		desc->physaddr = htole32(physaddr);
1097
1098		/* finalize mbuf */
1099		m->m_pkthdr.rcvif = ifp;
1100		m->m_pkthdr.len = m->m_len =
1101		    (le32toh(desc->flags) >> 16) & 0xfff;
1102
1103		rssi = rt2661_get_rssi(sc, desc->rssi);
1104		/* Error happened during RSSI conversion. */
1105		if (rssi < 0)
1106			rssi = -30;	/* XXX ignored by net80211 */
1107		nf = RT2661_NOISE_FLOOR;
1108
1109		if (ieee80211_radiotap_active(ic)) {
1110			struct rt2661_rx_radiotap_header *tap = &sc->sc_rxtap;
1111			uint32_t tsf_lo, tsf_hi;
1112
1113			/* get timestamp (low and high 32 bits) */
1114			tsf_hi = RAL_READ(sc, RT2661_TXRX_CSR13);
1115			tsf_lo = RAL_READ(sc, RT2661_TXRX_CSR12);
1116
1117			tap->wr_tsf =
1118			    htole64(((uint64_t)tsf_hi << 32) | tsf_lo);
1119			tap->wr_flags = 0;
1120			tap->wr_rate = ieee80211_plcp2rate(desc->rate,
1121			    (desc->flags & htole32(RT2661_RX_OFDM)) ?
1122				IEEE80211_T_OFDM : IEEE80211_T_CCK);
1123			tap->wr_antsignal = nf + rssi;
1124			tap->wr_antnoise = nf;
1125		}
1126		sc->sc_flags |= RAL_INPUT_RUNNING;
1127		RAL_UNLOCK(sc);
1128		wh = mtod(m, struct ieee80211_frame *);
1129
1130		/* send the frame to the 802.11 layer */
1131		ni = ieee80211_find_rxnode(ic,
1132		    (struct ieee80211_frame_min *)wh);
1133		if (ni != NULL) {
1134			(void) ieee80211_input(ni, m, rssi, nf);
1135			ieee80211_free_node(ni);
1136		} else
1137			(void) ieee80211_input_all(ic, m, rssi, nf);
1138
1139		RAL_LOCK(sc);
1140		sc->sc_flags &= ~RAL_INPUT_RUNNING;
1141
1142skip:		desc->flags |= htole32(RT2661_RX_BUSY);
1143
1144		DPRINTFN(sc, 15, "rx intr idx=%u\n", sc->rxq.cur);
1145
1146		sc->rxq.cur = (sc->rxq.cur + 1) % RT2661_RX_RING_COUNT;
1147	}
1148
1149	bus_dmamap_sync(sc->rxq.desc_dmat, sc->rxq.desc_map,
1150	    BUS_DMASYNC_PREWRITE);
1151}
1152
1153/* ARGSUSED */
1154static void
1155rt2661_mcu_beacon_expire(struct rt2661_softc *sc)
1156{
1157	/* do nothing */
1158}
1159
1160static void
1161rt2661_mcu_wakeup(struct rt2661_softc *sc)
1162{
1163	RAL_WRITE(sc, RT2661_MAC_CSR11, 5 << 16);
1164
1165	RAL_WRITE(sc, RT2661_SOFT_RESET_CSR, 0x7);
1166	RAL_WRITE(sc, RT2661_IO_CNTL_CSR, 0x18);
1167	RAL_WRITE(sc, RT2661_PCI_USEC_CSR, 0x20);
1168
1169	/* send wakeup command to MCU */
1170	rt2661_tx_cmd(sc, RT2661_MCU_CMD_WAKEUP, 0);
1171}
1172
1173static void
1174rt2661_mcu_cmd_intr(struct rt2661_softc *sc)
1175{
1176	RAL_READ(sc, RT2661_M2H_CMD_DONE_CSR);
1177	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
1178}
1179
1180void
1181rt2661_intr(void *arg)
1182{
1183	struct rt2661_softc *sc = arg;
1184	struct ifnet *ifp = sc->sc_ifp;
1185	uint32_t r1, r2;
1186
1187	RAL_LOCK(sc);
1188
1189	/* disable MAC and MCU interrupts */
1190	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffff7f);
1191	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
1192
1193	/* don't re-enable interrupts if we're shutting down */
1194	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1195		RAL_UNLOCK(sc);
1196		return;
1197	}
1198
1199	r1 = RAL_READ(sc, RT2661_INT_SOURCE_CSR);
1200	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, r1);
1201
1202	r2 = RAL_READ(sc, RT2661_MCU_INT_SOURCE_CSR);
1203	RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, r2);
1204
1205	if (r1 & RT2661_MGT_DONE)
1206		rt2661_tx_dma_intr(sc, &sc->mgtq);
1207
1208	if (r1 & RT2661_RX_DONE)
1209		rt2661_rx_intr(sc);
1210
1211	if (r1 & RT2661_TX0_DMA_DONE)
1212		rt2661_tx_dma_intr(sc, &sc->txq[0]);
1213
1214	if (r1 & RT2661_TX1_DMA_DONE)
1215		rt2661_tx_dma_intr(sc, &sc->txq[1]);
1216
1217	if (r1 & RT2661_TX2_DMA_DONE)
1218		rt2661_tx_dma_intr(sc, &sc->txq[2]);
1219
1220	if (r1 & RT2661_TX3_DMA_DONE)
1221		rt2661_tx_dma_intr(sc, &sc->txq[3]);
1222
1223	if (r1 & RT2661_TX_DONE)
1224		rt2661_tx_intr(sc);
1225
1226	if (r2 & RT2661_MCU_CMD_DONE)
1227		rt2661_mcu_cmd_intr(sc);
1228
1229	if (r2 & RT2661_MCU_BEACON_EXPIRE)
1230		rt2661_mcu_beacon_expire(sc);
1231
1232	if (r2 & RT2661_MCU_WAKEUP)
1233		rt2661_mcu_wakeup(sc);
1234
1235	/* re-enable MAC and MCU interrupts */
1236	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
1237	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
1238
1239	RAL_UNLOCK(sc);
1240}
1241
1242static uint8_t
1243rt2661_plcp_signal(int rate)
1244{
1245	switch (rate) {
1246	/* OFDM rates (cf IEEE Std 802.11a-1999, pp. 14 Table 80) */
1247	case 12:	return 0xb;
1248	case 18:	return 0xf;
1249	case 24:	return 0xa;
1250	case 36:	return 0xe;
1251	case 48:	return 0x9;
1252	case 72:	return 0xd;
1253	case 96:	return 0x8;
1254	case 108:	return 0xc;
1255
1256	/* CCK rates (NB: not IEEE std, device-specific) */
1257	case 2:		return 0x0;
1258	case 4:		return 0x1;
1259	case 11:	return 0x2;
1260	case 22:	return 0x3;
1261	}
1262	return 0xff;		/* XXX unsupported/unknown rate */
1263}
1264
1265static void
1266rt2661_setup_tx_desc(struct rt2661_softc *sc, struct rt2661_tx_desc *desc,
1267    uint32_t flags, uint16_t xflags, int len, int rate,
1268    const bus_dma_segment_t *segs, int nsegs, int ac)
1269{
1270	struct ifnet *ifp = sc->sc_ifp;
1271	struct ieee80211com *ic = ifp->if_l2com;
1272	uint16_t plcp_length;
1273	int i, remainder;
1274
1275	desc->flags = htole32(flags);
1276	desc->flags |= htole32(len << 16);
1277	desc->flags |= htole32(RT2661_TX_BUSY | RT2661_TX_VALID);
1278
1279	desc->xflags = htole16(xflags);
1280	desc->xflags |= htole16(nsegs << 13);
1281
1282	desc->wme = htole16(
1283	    RT2661_QID(ac) |
1284	    RT2661_AIFSN(2) |
1285	    RT2661_LOGCWMIN(4) |
1286	    RT2661_LOGCWMAX(10));
1287
1288	/*
1289	 * Remember in which queue this frame was sent. This field is driver
1290	 * private data only. It will be made available by the NIC in STA_CSR4
1291	 * on Tx interrupts.
1292	 */
1293	desc->qid = ac;
1294
1295	/* setup PLCP fields */
1296	desc->plcp_signal  = rt2661_plcp_signal(rate);
1297	desc->plcp_service = 4;
1298
1299	len += IEEE80211_CRC_LEN;
1300	if (ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM) {
1301		desc->flags |= htole32(RT2661_TX_OFDM);
1302
1303		plcp_length = len & 0xfff;
1304		desc->plcp_length_hi = plcp_length >> 6;
1305		desc->plcp_length_lo = plcp_length & 0x3f;
1306	} else {
1307		plcp_length = (16 * len + rate - 1) / rate;
1308		if (rate == 22) {
1309			remainder = (16 * len) % 22;
1310			if (remainder != 0 && remainder < 7)
1311				desc->plcp_service |= RT2661_PLCP_LENGEXT;
1312		}
1313		desc->plcp_length_hi = plcp_length >> 8;
1314		desc->plcp_length_lo = plcp_length & 0xff;
1315
1316		if (rate != 2 && (ic->ic_flags & IEEE80211_F_SHPREAMBLE))
1317			desc->plcp_signal |= 0x08;
1318	}
1319
1320	/* RT2x61 supports scatter with up to 5 segments */
1321	for (i = 0; i < nsegs; i++) {
1322		desc->addr[i] = htole32(segs[i].ds_addr);
1323		desc->len [i] = htole16(segs[i].ds_len);
1324	}
1325}
1326
1327static int
1328rt2661_tx_mgt(struct rt2661_softc *sc, struct mbuf *m0,
1329    struct ieee80211_node *ni)
1330{
1331	struct ieee80211vap *vap = ni->ni_vap;
1332	struct ieee80211com *ic = ni->ni_ic;
1333	struct rt2661_tx_desc *desc;
1334	struct rt2661_tx_data *data;
1335	struct ieee80211_frame *wh;
1336	struct ieee80211_key *k;
1337	bus_dma_segment_t segs[RT2661_MAX_SCATTER];
1338	uint16_t dur;
1339	uint32_t flags = 0;	/* XXX HWSEQ */
1340	int nsegs, rate, error;
1341
1342	desc = &sc->mgtq.desc[sc->mgtq.cur];
1343	data = &sc->mgtq.data[sc->mgtq.cur];
1344
1345	rate = vap->iv_txparms[ieee80211_chan2mode(ic->ic_curchan)].mgmtrate;
1346
1347	wh = mtod(m0, struct ieee80211_frame *);
1348
1349	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1350		k = ieee80211_crypto_encap(ni, m0);
1351		if (k == NULL) {
1352			m_freem(m0);
1353			return ENOBUFS;
1354		}
1355	}
1356
1357	error = bus_dmamap_load_mbuf_sg(sc->mgtq.data_dmat, data->map, m0,
1358	    segs, &nsegs, 0);
1359	if (error != 0) {
1360		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1361		    error);
1362		m_freem(m0);
1363		return error;
1364	}
1365
1366	if (ieee80211_radiotap_active_vap(vap)) {
1367		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1368
1369		tap->wt_flags = 0;
1370		tap->wt_rate = rate;
1371
1372		ieee80211_radiotap_tx(vap, m0);
1373	}
1374
1375	data->m = m0;
1376	data->ni = ni;
1377	/* management frames are not taken into account for amrr */
1378	data->rix = IEEE80211_FIXED_RATE_NONE;
1379
1380	wh = mtod(m0, struct ieee80211_frame *);
1381
1382	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1383		flags |= RT2661_TX_NEED_ACK;
1384
1385		dur = ieee80211_ack_duration(ic->ic_rt,
1386		    rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1387		*(uint16_t *)wh->i_dur = htole16(dur);
1388
1389		/* tell hardware to add timestamp in probe responses */
1390		if ((wh->i_fc[0] &
1391		    (IEEE80211_FC0_TYPE_MASK | IEEE80211_FC0_SUBTYPE_MASK)) ==
1392		    (IEEE80211_FC0_TYPE_MGT | IEEE80211_FC0_SUBTYPE_PROBE_RESP))
1393			flags |= RT2661_TX_TIMESTAMP;
1394	}
1395
1396	rt2661_setup_tx_desc(sc, desc, flags, 0 /* XXX HWSEQ */,
1397	    m0->m_pkthdr.len, rate, segs, nsegs, RT2661_QID_MGT);
1398
1399	bus_dmamap_sync(sc->mgtq.data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1400	bus_dmamap_sync(sc->mgtq.desc_dmat, sc->mgtq.desc_map,
1401	    BUS_DMASYNC_PREWRITE);
1402
1403	DPRINTFN(sc, 10, "sending mgt frame len=%u idx=%u rate=%u\n",
1404	    m0->m_pkthdr.len, sc->mgtq.cur, rate);
1405
1406	/* kick mgt */
1407	sc->mgtq.queued++;
1408	sc->mgtq.cur = (sc->mgtq.cur + 1) % RT2661_MGT_RING_COUNT;
1409	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, RT2661_KICK_MGT);
1410
1411	return 0;
1412}
1413
1414static int
1415rt2661_sendprot(struct rt2661_softc *sc, int ac,
1416    const struct mbuf *m, struct ieee80211_node *ni, int prot, int rate)
1417{
1418	struct ieee80211com *ic = ni->ni_ic;
1419	struct rt2661_tx_ring *txq = &sc->txq[ac];
1420	const struct ieee80211_frame *wh;
1421	struct rt2661_tx_desc *desc;
1422	struct rt2661_tx_data *data;
1423	struct mbuf *mprot;
1424	int protrate, ackrate, pktlen, flags, isshort, error;
1425	uint16_t dur;
1426	bus_dma_segment_t segs[RT2661_MAX_SCATTER];
1427	int nsegs;
1428
1429	KASSERT(prot == IEEE80211_PROT_RTSCTS || prot == IEEE80211_PROT_CTSONLY,
1430	    ("protection %d", prot));
1431
1432	wh = mtod(m, const struct ieee80211_frame *);
1433	pktlen = m->m_pkthdr.len + IEEE80211_CRC_LEN;
1434
1435	protrate = ieee80211_ctl_rate(ic->ic_rt, rate);
1436	ackrate = ieee80211_ack_rate(ic->ic_rt, rate);
1437
1438	isshort = (ic->ic_flags & IEEE80211_F_SHPREAMBLE) != 0;
1439	dur = ieee80211_compute_duration(ic->ic_rt, pktlen, rate, isshort)
1440	    + ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1441	flags = RT2661_TX_MORE_FRAG;
1442	if (prot == IEEE80211_PROT_RTSCTS) {
1443		/* NB: CTS is the same size as an ACK */
1444		dur += ieee80211_ack_duration(ic->ic_rt, rate, isshort);
1445		flags |= RT2661_TX_NEED_ACK;
1446		mprot = ieee80211_alloc_rts(ic, wh->i_addr1, wh->i_addr2, dur);
1447	} else {
1448		mprot = ieee80211_alloc_cts(ic, ni->ni_vap->iv_myaddr, dur);
1449	}
1450	if (mprot == NULL) {
1451		/* XXX stat + msg */
1452		return ENOBUFS;
1453	}
1454
1455	data = &txq->data[txq->cur];
1456	desc = &txq->desc[txq->cur];
1457
1458	error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, mprot, segs,
1459	    &nsegs, 0);
1460	if (error != 0) {
1461		device_printf(sc->sc_dev,
1462		    "could not map mbuf (error %d)\n", error);
1463		m_freem(mprot);
1464		return error;
1465	}
1466
1467	data->m = mprot;
1468	data->ni = ieee80211_ref_node(ni);
1469	/* ctl frames are not taken into account for amrr */
1470	data->rix = IEEE80211_FIXED_RATE_NONE;
1471
1472	rt2661_setup_tx_desc(sc, desc, flags, 0, mprot->m_pkthdr.len,
1473	    protrate, segs, 1, ac);
1474
1475	bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1476	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1477
1478	txq->queued++;
1479	txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1480
1481	return 0;
1482}
1483
1484static int
1485rt2661_tx_data(struct rt2661_softc *sc, struct mbuf *m0,
1486    struct ieee80211_node *ni, int ac)
1487{
1488	struct ieee80211vap *vap = ni->ni_vap;
1489	struct ifnet *ifp = sc->sc_ifp;
1490	struct ieee80211com *ic = ifp->if_l2com;
1491	struct rt2661_tx_ring *txq = &sc->txq[ac];
1492	struct rt2661_tx_desc *desc;
1493	struct rt2661_tx_data *data;
1494	struct ieee80211_frame *wh;
1495	const struct ieee80211_txparam *tp;
1496	struct ieee80211_key *k;
1497	const struct chanAccParams *cap;
1498	struct mbuf *mnew;
1499	bus_dma_segment_t segs[RT2661_MAX_SCATTER];
1500	uint16_t dur;
1501	uint32_t flags;
1502	int error, nsegs, rate, noack = 0;
1503
1504	wh = mtod(m0, struct ieee80211_frame *);
1505
1506	tp = &vap->iv_txparms[ieee80211_chan2mode(ni->ni_chan)];
1507	if (IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1508		rate = tp->mcastrate;
1509	} else if (m0->m_flags & M_EAPOL) {
1510		rate = tp->mgmtrate;
1511	} else if (tp->ucastrate != IEEE80211_FIXED_RATE_NONE) {
1512		rate = tp->ucastrate;
1513	} else {
1514		(void) ieee80211_amrr_choose(ni, &RT2661_NODE(ni)->amrr);
1515		rate = ni->ni_txrate;
1516	}
1517	rate &= IEEE80211_RATE_VAL;
1518
1519	if (wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_QOS) {
1520		cap = &ic->ic_wme.wme_chanParams;
1521		noack = cap->cap_wmeParams[ac].wmep_noackPolicy;
1522	}
1523
1524	if (wh->i_fc[1] & IEEE80211_FC1_WEP) {
1525		k = ieee80211_crypto_encap(ni, m0);
1526		if (k == NULL) {
1527			m_freem(m0);
1528			return ENOBUFS;
1529		}
1530
1531		/* packet header may have moved, reset our local pointer */
1532		wh = mtod(m0, struct ieee80211_frame *);
1533	}
1534
1535	flags = 0;
1536	if (!IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1537		int prot = IEEE80211_PROT_NONE;
1538		if (m0->m_pkthdr.len + IEEE80211_CRC_LEN > vap->iv_rtsthreshold)
1539			prot = IEEE80211_PROT_RTSCTS;
1540		else if ((ic->ic_flags & IEEE80211_F_USEPROT) &&
1541		    ieee80211_rate2phytype(ic->ic_rt, rate) == IEEE80211_T_OFDM)
1542			prot = ic->ic_protmode;
1543		if (prot != IEEE80211_PROT_NONE) {
1544			error = rt2661_sendprot(sc, ac, m0, ni, prot, rate);
1545			if (error) {
1546				m_freem(m0);
1547				return error;
1548			}
1549			flags |= RT2661_TX_LONG_RETRY | RT2661_TX_IFS;
1550		}
1551	}
1552
1553	data = &txq->data[txq->cur];
1554	desc = &txq->desc[txq->cur];
1555
1556	error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, m0, segs,
1557	    &nsegs, 0);
1558	if (error != 0 && error != EFBIG) {
1559		device_printf(sc->sc_dev, "could not map mbuf (error %d)\n",
1560		    error);
1561		m_freem(m0);
1562		return error;
1563	}
1564	if (error != 0) {
1565		mnew = m_defrag(m0, M_DONTWAIT);
1566		if (mnew == NULL) {
1567			device_printf(sc->sc_dev,
1568			    "could not defragment mbuf\n");
1569			m_freem(m0);
1570			return ENOBUFS;
1571		}
1572		m0 = mnew;
1573
1574		error = bus_dmamap_load_mbuf_sg(txq->data_dmat, data->map, m0,
1575		    segs, &nsegs, 0);
1576		if (error != 0) {
1577			device_printf(sc->sc_dev,
1578			    "could not map mbuf (error %d)\n", error);
1579			m_freem(m0);
1580			return error;
1581		}
1582
1583		/* packet header have moved, reset our local pointer */
1584		wh = mtod(m0, struct ieee80211_frame *);
1585	}
1586
1587	if (ieee80211_radiotap_active_vap(vap)) {
1588		struct rt2661_tx_radiotap_header *tap = &sc->sc_txtap;
1589
1590		tap->wt_flags = 0;
1591		tap->wt_rate = rate;
1592
1593		ieee80211_radiotap_tx(vap, m0);
1594	}
1595
1596	data->m = m0;
1597	data->ni = ni;
1598
1599	/* remember link conditions for rate adaptation algorithm */
1600	if (tp->ucastrate == IEEE80211_FIXED_RATE_NONE) {
1601		data->rix = ni->ni_txrate;
1602		/* XXX probably need last rssi value and not avg */
1603		data->rssi = ic->ic_node_getrssi(ni);
1604	} else
1605		data->rix = IEEE80211_FIXED_RATE_NONE;
1606
1607	if (!noack && !IEEE80211_IS_MULTICAST(wh->i_addr1)) {
1608		flags |= RT2661_TX_NEED_ACK;
1609
1610		dur = ieee80211_ack_duration(ic->ic_rt,
1611		    rate, ic->ic_flags & IEEE80211_F_SHPREAMBLE);
1612		*(uint16_t *)wh->i_dur = htole16(dur);
1613	}
1614
1615	rt2661_setup_tx_desc(sc, desc, flags, 0, m0->m_pkthdr.len, rate, segs,
1616	    nsegs, ac);
1617
1618	bus_dmamap_sync(txq->data_dmat, data->map, BUS_DMASYNC_PREWRITE);
1619	bus_dmamap_sync(txq->desc_dmat, txq->desc_map, BUS_DMASYNC_PREWRITE);
1620
1621	DPRINTFN(sc, 10, "sending data frame len=%u idx=%u rate=%u\n",
1622	    m0->m_pkthdr.len, txq->cur, rate);
1623
1624	/* kick Tx */
1625	txq->queued++;
1626	txq->cur = (txq->cur + 1) % RT2661_TX_RING_COUNT;
1627	RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 1 << ac);
1628
1629	return 0;
1630}
1631
1632static void
1633rt2661_start_locked(struct ifnet *ifp)
1634{
1635	struct rt2661_softc *sc = ifp->if_softc;
1636	struct mbuf *m;
1637	struct ieee80211_node *ni;
1638	int ac;
1639
1640	RAL_LOCK_ASSERT(sc);
1641
1642	/* prevent management frames from being sent if we're not ready */
1643	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING) || sc->sc_invalid)
1644		return;
1645
1646	for (;;) {
1647		IFQ_DRV_DEQUEUE(&ifp->if_snd, m);
1648		if (m == NULL)
1649			break;
1650
1651		ac = M_WME_GETAC(m);
1652		if (sc->txq[ac].queued >= RT2661_TX_RING_COUNT - 1) {
1653			/* there is no place left in this ring */
1654			IFQ_DRV_PREPEND(&ifp->if_snd, m);
1655			ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1656			break;
1657		}
1658		ni = (struct ieee80211_node *) m->m_pkthdr.rcvif;
1659		if (rt2661_tx_data(sc, m, ni, ac) != 0) {
1660			ieee80211_free_node(ni);
1661			ifp->if_oerrors++;
1662			break;
1663		}
1664
1665		sc->sc_tx_timer = 5;
1666	}
1667}
1668
1669static void
1670rt2661_start(struct ifnet *ifp)
1671{
1672	struct rt2661_softc *sc = ifp->if_softc;
1673
1674	RAL_LOCK(sc);
1675	rt2661_start_locked(ifp);
1676	RAL_UNLOCK(sc);
1677}
1678
1679static int
1680rt2661_raw_xmit(struct ieee80211_node *ni, struct mbuf *m,
1681	const struct ieee80211_bpf_params *params)
1682{
1683	struct ieee80211com *ic = ni->ni_ic;
1684	struct ifnet *ifp = ic->ic_ifp;
1685	struct rt2661_softc *sc = ifp->if_softc;
1686
1687	RAL_LOCK(sc);
1688
1689	/* prevent management frames from being sent if we're not ready */
1690	if (!(ifp->if_drv_flags & IFF_DRV_RUNNING)) {
1691		RAL_UNLOCK(sc);
1692		m_freem(m);
1693		ieee80211_free_node(ni);
1694		return ENETDOWN;
1695	}
1696	if (sc->mgtq.queued >= RT2661_MGT_RING_COUNT) {
1697		ifp->if_drv_flags |= IFF_DRV_OACTIVE;
1698		RAL_UNLOCK(sc);
1699		m_freem(m);
1700		ieee80211_free_node(ni);
1701		return ENOBUFS;		/* XXX */
1702	}
1703
1704	ifp->if_opackets++;
1705
1706	/*
1707	 * Legacy path; interpret frame contents to decide
1708	 * precisely how to send the frame.
1709	 * XXX raw path
1710	 */
1711	if (rt2661_tx_mgt(sc, m, ni) != 0)
1712		goto bad;
1713	sc->sc_tx_timer = 5;
1714
1715	RAL_UNLOCK(sc);
1716
1717	return 0;
1718bad:
1719	ifp->if_oerrors++;
1720	ieee80211_free_node(ni);
1721	RAL_UNLOCK(sc);
1722	return EIO;		/* XXX */
1723}
1724
1725static void
1726rt2661_watchdog(void *arg)
1727{
1728	struct rt2661_softc *sc = (struct rt2661_softc *)arg;
1729	struct ifnet *ifp = sc->sc_ifp;
1730
1731	RAL_LOCK_ASSERT(sc);
1732
1733	KASSERT(ifp->if_drv_flags & IFF_DRV_RUNNING, ("not running"));
1734
1735	if (sc->sc_invalid)		/* card ejected */
1736		return;
1737
1738	if (sc->sc_tx_timer > 0 && --sc->sc_tx_timer == 0) {
1739		if_printf(ifp, "device timeout\n");
1740		rt2661_init_locked(sc);
1741		ifp->if_oerrors++;
1742		/* NB: callout is reset in rt2661_init() */
1743		return;
1744	}
1745	callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog, sc);
1746}
1747
1748static int
1749rt2661_ioctl(struct ifnet *ifp, u_long cmd, caddr_t data)
1750{
1751	struct rt2661_softc *sc = ifp->if_softc;
1752	struct ieee80211com *ic = ifp->if_l2com;
1753	struct ifreq *ifr = (struct ifreq *) data;
1754	int error = 0, startall = 0;
1755
1756	switch (cmd) {
1757	case SIOCSIFFLAGS:
1758		RAL_LOCK(sc);
1759		if (ifp->if_flags & IFF_UP) {
1760			if ((ifp->if_drv_flags & IFF_DRV_RUNNING) == 0) {
1761				rt2661_init_locked(sc);
1762				startall = 1;
1763			} else
1764				rt2661_update_promisc(ifp);
1765		} else {
1766			if (ifp->if_drv_flags & IFF_DRV_RUNNING)
1767				rt2661_stop_locked(sc);
1768		}
1769		RAL_UNLOCK(sc);
1770		if (startall)
1771			ieee80211_start_all(ic);
1772		break;
1773	case SIOCGIFMEDIA:
1774		error = ifmedia_ioctl(ifp, ifr, &ic->ic_media, cmd);
1775		break;
1776	case SIOCGIFADDR:
1777		error = ether_ioctl(ifp, cmd, data);
1778		break;
1779	default:
1780		error = EINVAL;
1781		break;
1782	}
1783	return error;
1784}
1785
1786static void
1787rt2661_bbp_write(struct rt2661_softc *sc, uint8_t reg, uint8_t val)
1788{
1789	uint32_t tmp;
1790	int ntries;
1791
1792	for (ntries = 0; ntries < 100; ntries++) {
1793		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
1794			break;
1795		DELAY(1);
1796	}
1797	if (ntries == 100) {
1798		device_printf(sc->sc_dev, "could not write to BBP\n");
1799		return;
1800	}
1801
1802	tmp = RT2661_BBP_BUSY | (reg & 0x7f) << 8 | val;
1803	RAL_WRITE(sc, RT2661_PHY_CSR3, tmp);
1804
1805	DPRINTFN(sc, 15, "BBP R%u <- 0x%02x\n", reg, val);
1806}
1807
1808static uint8_t
1809rt2661_bbp_read(struct rt2661_softc *sc, uint8_t reg)
1810{
1811	uint32_t val;
1812	int ntries;
1813
1814	for (ntries = 0; ntries < 100; ntries++) {
1815		if (!(RAL_READ(sc, RT2661_PHY_CSR3) & RT2661_BBP_BUSY))
1816			break;
1817		DELAY(1);
1818	}
1819	if (ntries == 100) {
1820		device_printf(sc->sc_dev, "could not read from BBP\n");
1821		return 0;
1822	}
1823
1824	val = RT2661_BBP_BUSY | RT2661_BBP_READ | reg << 8;
1825	RAL_WRITE(sc, RT2661_PHY_CSR3, val);
1826
1827	for (ntries = 0; ntries < 100; ntries++) {
1828		val = RAL_READ(sc, RT2661_PHY_CSR3);
1829		if (!(val & RT2661_BBP_BUSY))
1830			return val & 0xff;
1831		DELAY(1);
1832	}
1833
1834	device_printf(sc->sc_dev, "could not read from BBP\n");
1835	return 0;
1836}
1837
1838static void
1839rt2661_rf_write(struct rt2661_softc *sc, uint8_t reg, uint32_t val)
1840{
1841	uint32_t tmp;
1842	int ntries;
1843
1844	for (ntries = 0; ntries < 100; ntries++) {
1845		if (!(RAL_READ(sc, RT2661_PHY_CSR4) & RT2661_RF_BUSY))
1846			break;
1847		DELAY(1);
1848	}
1849	if (ntries == 100) {
1850		device_printf(sc->sc_dev, "could not write to RF\n");
1851		return;
1852	}
1853
1854	tmp = RT2661_RF_BUSY | RT2661_RF_21BIT | (val & 0x1fffff) << 2 |
1855	    (reg & 3);
1856	RAL_WRITE(sc, RT2661_PHY_CSR4, tmp);
1857
1858	/* remember last written value in sc */
1859	sc->rf_regs[reg] = val;
1860
1861	DPRINTFN(sc, 15, "RF R[%u] <- 0x%05x\n", reg & 3, val & 0x1fffff);
1862}
1863
1864static int
1865rt2661_tx_cmd(struct rt2661_softc *sc, uint8_t cmd, uint16_t arg)
1866{
1867	if (RAL_READ(sc, RT2661_H2M_MAILBOX_CSR) & RT2661_H2M_BUSY)
1868		return EIO;	/* there is already a command pending */
1869
1870	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR,
1871	    RT2661_H2M_BUSY | RT2661_TOKEN_NO_INTR << 16 | arg);
1872
1873	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, RT2661_KICK_CMD | cmd);
1874
1875	return 0;
1876}
1877
1878static void
1879rt2661_select_antenna(struct rt2661_softc *sc)
1880{
1881	uint8_t bbp4, bbp77;
1882	uint32_t tmp;
1883
1884	bbp4  = rt2661_bbp_read(sc,  4);
1885	bbp77 = rt2661_bbp_read(sc, 77);
1886
1887	/* TBD */
1888
1889	/* make sure Rx is disabled before switching antenna */
1890	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
1891	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
1892
1893	rt2661_bbp_write(sc,  4, bbp4);
1894	rt2661_bbp_write(sc, 77, bbp77);
1895
1896	/* restore Rx filter */
1897	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
1898}
1899
1900/*
1901 * Enable multi-rate retries for frames sent at OFDM rates.
1902 * In 802.11b/g mode, allow fallback to CCK rates.
1903 */
1904static void
1905rt2661_enable_mrr(struct rt2661_softc *sc)
1906{
1907	struct ifnet *ifp = sc->sc_ifp;
1908	struct ieee80211com *ic = ifp->if_l2com;
1909	uint32_t tmp;
1910
1911	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
1912
1913	tmp &= ~RT2661_MRR_CCK_FALLBACK;
1914	if (!IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan))
1915		tmp |= RT2661_MRR_CCK_FALLBACK;
1916	tmp |= RT2661_MRR_ENABLED;
1917
1918	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
1919}
1920
1921static void
1922rt2661_set_txpreamble(struct rt2661_softc *sc)
1923{
1924	struct ifnet *ifp = sc->sc_ifp;
1925	struct ieee80211com *ic = ifp->if_l2com;
1926	uint32_t tmp;
1927
1928	tmp = RAL_READ(sc, RT2661_TXRX_CSR4);
1929
1930	tmp &= ~RT2661_SHORT_PREAMBLE;
1931	if (ic->ic_flags & IEEE80211_F_SHPREAMBLE)
1932		tmp |= RT2661_SHORT_PREAMBLE;
1933
1934	RAL_WRITE(sc, RT2661_TXRX_CSR4, tmp);
1935}
1936
1937static void
1938rt2661_set_basicrates(struct rt2661_softc *sc,
1939    const struct ieee80211_rateset *rs)
1940{
1941#define RV(r)	((r) & IEEE80211_RATE_VAL)
1942	struct ifnet *ifp = sc->sc_ifp;
1943	struct ieee80211com *ic = ifp->if_l2com;
1944	uint32_t mask = 0;
1945	uint8_t rate;
1946	int i, j;
1947
1948	for (i = 0; i < rs->rs_nrates; i++) {
1949		rate = rs->rs_rates[i];
1950
1951		if (!(rate & IEEE80211_RATE_BASIC))
1952			continue;
1953
1954		/*
1955		 * Find h/w rate index.  We know it exists because the rate
1956		 * set has already been negotiated.
1957		 */
1958		for (j = 0; ic->ic_sup_rates[IEEE80211_MODE_11G].rs_rates[j] != RV(rate); j++);
1959
1960		mask |= 1 << j;
1961	}
1962
1963	RAL_WRITE(sc, RT2661_TXRX_CSR5, mask);
1964
1965	DPRINTF(sc, "Setting basic rate mask to 0x%x\n", mask);
1966#undef RV
1967}
1968
1969/*
1970 * Reprogram MAC/BBP to switch to a new band.  Values taken from the reference
1971 * driver.
1972 */
1973static void
1974rt2661_select_band(struct rt2661_softc *sc, struct ieee80211_channel *c)
1975{
1976	uint8_t bbp17, bbp35, bbp96, bbp97, bbp98, bbp104;
1977	uint32_t tmp;
1978
1979	/* update all BBP registers that depend on the band */
1980	bbp17 = 0x20; bbp96 = 0x48; bbp104 = 0x2c;
1981	bbp35 = 0x50; bbp97 = 0x48; bbp98  = 0x48;
1982	if (IEEE80211_IS_CHAN_5GHZ(c)) {
1983		bbp17 += 0x08; bbp96 += 0x10; bbp104 += 0x0c;
1984		bbp35 += 0x10; bbp97 += 0x10; bbp98  += 0x10;
1985	}
1986	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1987	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1988		bbp17 += 0x10; bbp96 += 0x10; bbp104 += 0x10;
1989	}
1990
1991	rt2661_bbp_write(sc,  17, bbp17);
1992	rt2661_bbp_write(sc,  96, bbp96);
1993	rt2661_bbp_write(sc, 104, bbp104);
1994
1995	if ((IEEE80211_IS_CHAN_2GHZ(c) && sc->ext_2ghz_lna) ||
1996	    (IEEE80211_IS_CHAN_5GHZ(c) && sc->ext_5ghz_lna)) {
1997		rt2661_bbp_write(sc, 75, 0x80);
1998		rt2661_bbp_write(sc, 86, 0x80);
1999		rt2661_bbp_write(sc, 88, 0x80);
2000	}
2001
2002	rt2661_bbp_write(sc, 35, bbp35);
2003	rt2661_bbp_write(sc, 97, bbp97);
2004	rt2661_bbp_write(sc, 98, bbp98);
2005
2006	tmp = RAL_READ(sc, RT2661_PHY_CSR0);
2007	tmp &= ~(RT2661_PA_PE_2GHZ | RT2661_PA_PE_5GHZ);
2008	if (IEEE80211_IS_CHAN_2GHZ(c))
2009		tmp |= RT2661_PA_PE_2GHZ;
2010	else
2011		tmp |= RT2661_PA_PE_5GHZ;
2012	RAL_WRITE(sc, RT2661_PHY_CSR0, tmp);
2013}
2014
2015static void
2016rt2661_set_chan(struct rt2661_softc *sc, struct ieee80211_channel *c)
2017{
2018	struct ifnet *ifp = sc->sc_ifp;
2019	struct ieee80211com *ic = ifp->if_l2com;
2020	const struct rfprog *rfprog;
2021	uint8_t bbp3, bbp94 = RT2661_BBPR94_DEFAULT;
2022	int8_t power;
2023	u_int i, chan;
2024
2025	chan = ieee80211_chan2ieee(ic, c);
2026	KASSERT(chan != 0 && chan != IEEE80211_CHAN_ANY, ("chan 0x%x", chan));
2027
2028	/* select the appropriate RF settings based on what EEPROM says */
2029	rfprog = (sc->rfprog == 0) ? rt2661_rf5225_1 : rt2661_rf5225_2;
2030
2031	/* find the settings for this channel (we know it exists) */
2032	for (i = 0; rfprog[i].chan != chan; i++);
2033
2034	power = sc->txpow[i];
2035	if (power < 0) {
2036		bbp94 += power;
2037		power = 0;
2038	} else if (power > 31) {
2039		bbp94 += power - 31;
2040		power = 31;
2041	}
2042
2043	/*
2044	 * If we are switching from the 2GHz band to the 5GHz band or
2045	 * vice-versa, BBP registers need to be reprogrammed.
2046	 */
2047	if (c->ic_flags != sc->sc_curchan->ic_flags) {
2048		rt2661_select_band(sc, c);
2049		rt2661_select_antenna(sc);
2050	}
2051	sc->sc_curchan = c;
2052
2053	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2054	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2055	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2056	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2057
2058	DELAY(200);
2059
2060	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2061	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2062	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7 | 1);
2063	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2064
2065	DELAY(200);
2066
2067	rt2661_rf_write(sc, RAL_RF1, rfprog[i].r1);
2068	rt2661_rf_write(sc, RAL_RF2, rfprog[i].r2);
2069	rt2661_rf_write(sc, RAL_RF3, rfprog[i].r3 | power << 7);
2070	rt2661_rf_write(sc, RAL_RF4, rfprog[i].r4 | sc->rffreq << 10);
2071
2072	/* enable smart mode for MIMO-capable RFs */
2073	bbp3 = rt2661_bbp_read(sc, 3);
2074
2075	bbp3 &= ~RT2661_SMART_MODE;
2076	if (sc->rf_rev == RT2661_RF_5325 || sc->rf_rev == RT2661_RF_2529)
2077		bbp3 |= RT2661_SMART_MODE;
2078
2079	rt2661_bbp_write(sc, 3, bbp3);
2080
2081	if (bbp94 != RT2661_BBPR94_DEFAULT)
2082		rt2661_bbp_write(sc, 94, bbp94);
2083
2084	/* 5GHz radio needs a 1ms delay here */
2085	if (IEEE80211_IS_CHAN_5GHZ(c))
2086		DELAY(1000);
2087}
2088
2089static void
2090rt2661_set_bssid(struct rt2661_softc *sc, const uint8_t *bssid)
2091{
2092	uint32_t tmp;
2093
2094	tmp = bssid[0] | bssid[1] << 8 | bssid[2] << 16 | bssid[3] << 24;
2095	RAL_WRITE(sc, RT2661_MAC_CSR4, tmp);
2096
2097	tmp = bssid[4] | bssid[5] << 8 | RT2661_ONE_BSSID << 16;
2098	RAL_WRITE(sc, RT2661_MAC_CSR5, tmp);
2099}
2100
2101static void
2102rt2661_set_macaddr(struct rt2661_softc *sc, const uint8_t *addr)
2103{
2104	uint32_t tmp;
2105
2106	tmp = addr[0] | addr[1] << 8 | addr[2] << 16 | addr[3] << 24;
2107	RAL_WRITE(sc, RT2661_MAC_CSR2, tmp);
2108
2109	tmp = addr[4] | addr[5] << 8;
2110	RAL_WRITE(sc, RT2661_MAC_CSR3, tmp);
2111}
2112
2113static void
2114rt2661_update_promisc(struct ifnet *ifp)
2115{
2116	struct rt2661_softc *sc = ifp->if_softc;
2117	uint32_t tmp;
2118
2119	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2120
2121	tmp &= ~RT2661_DROP_NOT_TO_ME;
2122	if (!(ifp->if_flags & IFF_PROMISC))
2123		tmp |= RT2661_DROP_NOT_TO_ME;
2124
2125	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2126
2127	DPRINTF(sc, "%s promiscuous mode\n", (ifp->if_flags & IFF_PROMISC) ?
2128	    "entering" : "leaving");
2129}
2130
2131/*
2132 * Update QoS (802.11e) settings for each h/w Tx ring.
2133 */
2134static int
2135rt2661_wme_update(struct ieee80211com *ic)
2136{
2137	struct rt2661_softc *sc = ic->ic_ifp->if_softc;
2138	const struct wmeParams *wmep;
2139
2140	wmep = ic->ic_wme.wme_chanParams.cap_wmeParams;
2141
2142	/* XXX: not sure about shifts. */
2143	/* XXX: the reference driver plays with AC_VI settings too. */
2144
2145	/* update TxOp */
2146	RAL_WRITE(sc, RT2661_AC_TXOP_CSR0,
2147	    wmep[WME_AC_BE].wmep_txopLimit << 16 |
2148	    wmep[WME_AC_BK].wmep_txopLimit);
2149	RAL_WRITE(sc, RT2661_AC_TXOP_CSR1,
2150	    wmep[WME_AC_VI].wmep_txopLimit << 16 |
2151	    wmep[WME_AC_VO].wmep_txopLimit);
2152
2153	/* update CWmin */
2154	RAL_WRITE(sc, RT2661_CWMIN_CSR,
2155	    wmep[WME_AC_BE].wmep_logcwmin << 12 |
2156	    wmep[WME_AC_BK].wmep_logcwmin <<  8 |
2157	    wmep[WME_AC_VI].wmep_logcwmin <<  4 |
2158	    wmep[WME_AC_VO].wmep_logcwmin);
2159
2160	/* update CWmax */
2161	RAL_WRITE(sc, RT2661_CWMAX_CSR,
2162	    wmep[WME_AC_BE].wmep_logcwmax << 12 |
2163	    wmep[WME_AC_BK].wmep_logcwmax <<  8 |
2164	    wmep[WME_AC_VI].wmep_logcwmax <<  4 |
2165	    wmep[WME_AC_VO].wmep_logcwmax);
2166
2167	/* update Aifsn */
2168	RAL_WRITE(sc, RT2661_AIFSN_CSR,
2169	    wmep[WME_AC_BE].wmep_aifsn << 12 |
2170	    wmep[WME_AC_BK].wmep_aifsn <<  8 |
2171	    wmep[WME_AC_VI].wmep_aifsn <<  4 |
2172	    wmep[WME_AC_VO].wmep_aifsn);
2173
2174	return 0;
2175}
2176
2177static void
2178rt2661_update_slot(struct ifnet *ifp)
2179{
2180	struct rt2661_softc *sc = ifp->if_softc;
2181	struct ieee80211com *ic = ifp->if_l2com;
2182	uint8_t slottime;
2183	uint32_t tmp;
2184
2185	slottime = (ic->ic_flags & IEEE80211_F_SHSLOT) ? 9 : 20;
2186
2187	tmp = RAL_READ(sc, RT2661_MAC_CSR9);
2188	tmp = (tmp & ~0xff) | slottime;
2189	RAL_WRITE(sc, RT2661_MAC_CSR9, tmp);
2190}
2191
2192static const char *
2193rt2661_get_rf(int rev)
2194{
2195	switch (rev) {
2196	case RT2661_RF_5225:	return "RT5225";
2197	case RT2661_RF_5325:	return "RT5325 (MIMO XR)";
2198	case RT2661_RF_2527:	return "RT2527";
2199	case RT2661_RF_2529:	return "RT2529 (MIMO XR)";
2200	default:		return "unknown";
2201	}
2202}
2203
2204static void
2205rt2661_read_eeprom(struct rt2661_softc *sc, uint8_t macaddr[IEEE80211_ADDR_LEN])
2206{
2207	uint16_t val;
2208	int i;
2209
2210	/* read MAC address */
2211	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC01);
2212	macaddr[0] = val & 0xff;
2213	macaddr[1] = val >> 8;
2214
2215	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC23);
2216	macaddr[2] = val & 0xff;
2217	macaddr[3] = val >> 8;
2218
2219	val = rt2661_eeprom_read(sc, RT2661_EEPROM_MAC45);
2220	macaddr[4] = val & 0xff;
2221	macaddr[5] = val >> 8;
2222
2223	val = rt2661_eeprom_read(sc, RT2661_EEPROM_ANTENNA);
2224	/* XXX: test if different from 0xffff? */
2225	sc->rf_rev   = (val >> 11) & 0x1f;
2226	sc->hw_radio = (val >> 10) & 0x1;
2227	sc->rx_ant   = (val >> 4)  & 0x3;
2228	sc->tx_ant   = (val >> 2)  & 0x3;
2229	sc->nb_ant   = val & 0x3;
2230
2231	DPRINTF(sc, "RF revision=%d\n", sc->rf_rev);
2232
2233	val = rt2661_eeprom_read(sc, RT2661_EEPROM_CONFIG2);
2234	sc->ext_5ghz_lna = (val >> 6) & 0x1;
2235	sc->ext_2ghz_lna = (val >> 4) & 0x1;
2236
2237	DPRINTF(sc, "External 2GHz LNA=%d\nExternal 5GHz LNA=%d\n",
2238	    sc->ext_2ghz_lna, sc->ext_5ghz_lna);
2239
2240	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_2GHZ_OFFSET);
2241	if ((val & 0xff) != 0xff)
2242		sc->rssi_2ghz_corr = (int8_t)(val & 0xff);	/* signed */
2243
2244	/* Only [-10, 10] is valid */
2245	if (sc->rssi_2ghz_corr < -10 || sc->rssi_2ghz_corr > 10)
2246		sc->rssi_2ghz_corr = 0;
2247
2248	val = rt2661_eeprom_read(sc, RT2661_EEPROM_RSSI_5GHZ_OFFSET);
2249	if ((val & 0xff) != 0xff)
2250		sc->rssi_5ghz_corr = (int8_t)(val & 0xff);	/* signed */
2251
2252	/* Only [-10, 10] is valid */
2253	if (sc->rssi_5ghz_corr < -10 || sc->rssi_5ghz_corr > 10)
2254		sc->rssi_5ghz_corr = 0;
2255
2256	/* adjust RSSI correction for external low-noise amplifier */
2257	if (sc->ext_2ghz_lna)
2258		sc->rssi_2ghz_corr -= 14;
2259	if (sc->ext_5ghz_lna)
2260		sc->rssi_5ghz_corr -= 14;
2261
2262	DPRINTF(sc, "RSSI 2GHz corr=%d\nRSSI 5GHz corr=%d\n",
2263	    sc->rssi_2ghz_corr, sc->rssi_5ghz_corr);
2264
2265	val = rt2661_eeprom_read(sc, RT2661_EEPROM_FREQ_OFFSET);
2266	if ((val >> 8) != 0xff)
2267		sc->rfprog = (val >> 8) & 0x3;
2268	if ((val & 0xff) != 0xff)
2269		sc->rffreq = val & 0xff;
2270
2271	DPRINTF(sc, "RF prog=%d\nRF freq=%d\n", sc->rfprog, sc->rffreq);
2272
2273	/* read Tx power for all a/b/g channels */
2274	for (i = 0; i < 19; i++) {
2275		val = rt2661_eeprom_read(sc, RT2661_EEPROM_TXPOWER + i);
2276		sc->txpow[i * 2] = (int8_t)(val >> 8);		/* signed */
2277		DPRINTF(sc, "Channel=%d Tx power=%d\n",
2278		    rt2661_rf5225_1[i * 2].chan, sc->txpow[i * 2]);
2279		sc->txpow[i * 2 + 1] = (int8_t)(val & 0xff);	/* signed */
2280		DPRINTF(sc, "Channel=%d Tx power=%d\n",
2281		    rt2661_rf5225_1[i * 2 + 1].chan, sc->txpow[i * 2 + 1]);
2282	}
2283
2284	/* read vendor-specific BBP values */
2285	for (i = 0; i < 16; i++) {
2286		val = rt2661_eeprom_read(sc, RT2661_EEPROM_BBP_BASE + i);
2287		if (val == 0 || val == 0xffff)
2288			continue;	/* skip invalid entries */
2289		sc->bbp_prom[i].reg = val >> 8;
2290		sc->bbp_prom[i].val = val & 0xff;
2291		DPRINTF(sc, "BBP R%d=%02x\n", sc->bbp_prom[i].reg,
2292		    sc->bbp_prom[i].val);
2293	}
2294}
2295
2296static int
2297rt2661_bbp_init(struct rt2661_softc *sc)
2298{
2299#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2300	int i, ntries;
2301	uint8_t val;
2302
2303	/* wait for BBP to be ready */
2304	for (ntries = 0; ntries < 100; ntries++) {
2305		val = rt2661_bbp_read(sc, 0);
2306		if (val != 0 && val != 0xff)
2307			break;
2308		DELAY(100);
2309	}
2310	if (ntries == 100) {
2311		device_printf(sc->sc_dev, "timeout waiting for BBP\n");
2312		return EIO;
2313	}
2314
2315	/* initialize BBP registers to default values */
2316	for (i = 0; i < N(rt2661_def_bbp); i++) {
2317		rt2661_bbp_write(sc, rt2661_def_bbp[i].reg,
2318		    rt2661_def_bbp[i].val);
2319	}
2320
2321	/* write vendor-specific BBP values (from EEPROM) */
2322	for (i = 0; i < 16; i++) {
2323		if (sc->bbp_prom[i].reg == 0)
2324			continue;
2325		rt2661_bbp_write(sc, sc->bbp_prom[i].reg, sc->bbp_prom[i].val);
2326	}
2327
2328	return 0;
2329#undef N
2330}
2331
2332static void
2333rt2661_init_locked(struct rt2661_softc *sc)
2334{
2335#define N(a)	(sizeof (a) / sizeof ((a)[0]))
2336	struct ifnet *ifp = sc->sc_ifp;
2337	struct ieee80211com *ic = ifp->if_l2com;
2338	uint32_t tmp, sta[3];
2339	int i, error, ntries;
2340
2341	RAL_LOCK_ASSERT(sc);
2342
2343	if ((sc->sc_flags & RAL_FW_LOADED) == 0) {
2344		error = rt2661_load_microcode(sc);
2345		if (error != 0) {
2346			if_printf(ifp,
2347			    "%s: could not load 8051 microcode, error %d\n",
2348			    __func__, error);
2349			return;
2350		}
2351		sc->sc_flags |= RAL_FW_LOADED;
2352	}
2353
2354	rt2661_stop_locked(sc);
2355
2356	/* initialize Tx rings */
2357	RAL_WRITE(sc, RT2661_AC1_BASE_CSR, sc->txq[1].physaddr);
2358	RAL_WRITE(sc, RT2661_AC0_BASE_CSR, sc->txq[0].physaddr);
2359	RAL_WRITE(sc, RT2661_AC2_BASE_CSR, sc->txq[2].physaddr);
2360	RAL_WRITE(sc, RT2661_AC3_BASE_CSR, sc->txq[3].physaddr);
2361
2362	/* initialize Mgt ring */
2363	RAL_WRITE(sc, RT2661_MGT_BASE_CSR, sc->mgtq.physaddr);
2364
2365	/* initialize Rx ring */
2366	RAL_WRITE(sc, RT2661_RX_BASE_CSR, sc->rxq.physaddr);
2367
2368	/* initialize Tx rings sizes */
2369	RAL_WRITE(sc, RT2661_TX_RING_CSR0,
2370	    RT2661_TX_RING_COUNT << 24 |
2371	    RT2661_TX_RING_COUNT << 16 |
2372	    RT2661_TX_RING_COUNT <<  8 |
2373	    RT2661_TX_RING_COUNT);
2374
2375	RAL_WRITE(sc, RT2661_TX_RING_CSR1,
2376	    RT2661_TX_DESC_WSIZE << 16 |
2377	    RT2661_TX_RING_COUNT <<  8 |	/* XXX: HCCA ring unused */
2378	    RT2661_MGT_RING_COUNT);
2379
2380	/* initialize Rx rings */
2381	RAL_WRITE(sc, RT2661_RX_RING_CSR,
2382	    RT2661_RX_DESC_BACK  << 16 |
2383	    RT2661_RX_DESC_WSIZE <<  8 |
2384	    RT2661_RX_RING_COUNT);
2385
2386	/* XXX: some magic here */
2387	RAL_WRITE(sc, RT2661_TX_DMA_DST_CSR, 0xaa);
2388
2389	/* load base addresses of all 5 Tx rings (4 data + 1 mgt) */
2390	RAL_WRITE(sc, RT2661_LOAD_TX_RING_CSR, 0x1f);
2391
2392	/* load base address of Rx ring */
2393	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 2);
2394
2395	/* initialize MAC registers to default values */
2396	for (i = 0; i < N(rt2661_def_mac); i++)
2397		RAL_WRITE(sc, rt2661_def_mac[i].reg, rt2661_def_mac[i].val);
2398
2399	rt2661_set_macaddr(sc, IF_LLADDR(ifp));
2400
2401	/* set host ready */
2402	RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2403	RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2404
2405	/* wait for BBP/RF to wakeup */
2406	for (ntries = 0; ntries < 1000; ntries++) {
2407		if (RAL_READ(sc, RT2661_MAC_CSR12) & 8)
2408			break;
2409		DELAY(1000);
2410	}
2411	if (ntries == 1000) {
2412		printf("timeout waiting for BBP/RF to wakeup\n");
2413		rt2661_stop_locked(sc);
2414		return;
2415	}
2416
2417	if (rt2661_bbp_init(sc) != 0) {
2418		rt2661_stop_locked(sc);
2419		return;
2420	}
2421
2422	/* select default channel */
2423	sc->sc_curchan = ic->ic_curchan;
2424	rt2661_select_band(sc, sc->sc_curchan);
2425	rt2661_select_antenna(sc);
2426	rt2661_set_chan(sc, sc->sc_curchan);
2427
2428	/* update Rx filter */
2429	tmp = RAL_READ(sc, RT2661_TXRX_CSR0) & 0xffff;
2430
2431	tmp |= RT2661_DROP_PHY_ERROR | RT2661_DROP_CRC_ERROR;
2432	if (ic->ic_opmode != IEEE80211_M_MONITOR) {
2433		tmp |= RT2661_DROP_CTL | RT2661_DROP_VER_ERROR |
2434		       RT2661_DROP_ACKCTS;
2435		if (ic->ic_opmode != IEEE80211_M_HOSTAP &&
2436		    ic->ic_opmode != IEEE80211_M_MBSS)
2437			tmp |= RT2661_DROP_TODS;
2438		if (!(ifp->if_flags & IFF_PROMISC))
2439			tmp |= RT2661_DROP_NOT_TO_ME;
2440	}
2441
2442	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2443
2444	/* clear STA registers */
2445	RAL_READ_REGION_4(sc, RT2661_STA_CSR0, sta, N(sta));
2446
2447	/* initialize ASIC */
2448	RAL_WRITE(sc, RT2661_MAC_CSR1, 4);
2449
2450	/* clear any pending interrupt */
2451	RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2452
2453	/* enable interrupts */
2454	RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0x0000ff10);
2455	RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0);
2456
2457	/* kick Rx */
2458	RAL_WRITE(sc, RT2661_RX_CNTL_CSR, 1);
2459
2460	ifp->if_drv_flags &= ~IFF_DRV_OACTIVE;
2461	ifp->if_drv_flags |= IFF_DRV_RUNNING;
2462
2463	callout_reset(&sc->watchdog_ch, hz, rt2661_watchdog, sc);
2464#undef N
2465}
2466
2467static void
2468rt2661_init(void *priv)
2469{
2470	struct rt2661_softc *sc = priv;
2471	struct ifnet *ifp = sc->sc_ifp;
2472	struct ieee80211com *ic = ifp->if_l2com;
2473
2474	RAL_LOCK(sc);
2475	rt2661_init_locked(sc);
2476	RAL_UNLOCK(sc);
2477
2478	if (ifp->if_drv_flags & IFF_DRV_RUNNING)
2479		ieee80211_start_all(ic);		/* start all vap's */
2480}
2481
2482void
2483rt2661_stop_locked(struct rt2661_softc *sc)
2484{
2485	struct ifnet *ifp = sc->sc_ifp;
2486	uint32_t tmp;
2487	volatile int *flags = &sc->sc_flags;
2488
2489	while (*flags & RAL_INPUT_RUNNING)
2490		msleep(sc, &sc->sc_mtx, 0, "ralrunning", hz/10);
2491
2492	callout_stop(&sc->watchdog_ch);
2493	sc->sc_tx_timer = 0;
2494
2495	if (ifp->if_drv_flags & IFF_DRV_RUNNING) {
2496		ifp->if_drv_flags &= ~(IFF_DRV_RUNNING | IFF_DRV_OACTIVE);
2497
2498		/* abort Tx (for all 5 Tx rings) */
2499		RAL_WRITE(sc, RT2661_TX_CNTL_CSR, 0x1f << 16);
2500
2501		/* disable Rx (value remains after reset!) */
2502		tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2503		RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2504
2505		/* reset ASIC */
2506		RAL_WRITE(sc, RT2661_MAC_CSR1, 3);
2507		RAL_WRITE(sc, RT2661_MAC_CSR1, 0);
2508
2509		/* disable interrupts */
2510		RAL_WRITE(sc, RT2661_INT_MASK_CSR, 0xffffffff);
2511		RAL_WRITE(sc, RT2661_MCU_INT_MASK_CSR, 0xffffffff);
2512
2513		/* clear any pending interrupt */
2514		RAL_WRITE(sc, RT2661_INT_SOURCE_CSR, 0xffffffff);
2515		RAL_WRITE(sc, RT2661_MCU_INT_SOURCE_CSR, 0xffffffff);
2516
2517		/* reset Tx and Rx rings */
2518		rt2661_reset_tx_ring(sc, &sc->txq[0]);
2519		rt2661_reset_tx_ring(sc, &sc->txq[1]);
2520		rt2661_reset_tx_ring(sc, &sc->txq[2]);
2521		rt2661_reset_tx_ring(sc, &sc->txq[3]);
2522		rt2661_reset_tx_ring(sc, &sc->mgtq);
2523		rt2661_reset_rx_ring(sc, &sc->rxq);
2524	}
2525}
2526
2527void
2528rt2661_stop(void *priv)
2529{
2530	struct rt2661_softc *sc = priv;
2531
2532	RAL_LOCK(sc);
2533	rt2661_stop_locked(sc);
2534	RAL_UNLOCK(sc);
2535}
2536
2537static int
2538rt2661_load_microcode(struct rt2661_softc *sc)
2539{
2540	struct ifnet *ifp = sc->sc_ifp;
2541	const struct firmware *fp;
2542	const char *imagename;
2543	int ntries, error;
2544
2545	RAL_LOCK_ASSERT(sc);
2546
2547	switch (sc->sc_id) {
2548	case 0x0301: imagename = "rt2561sfw"; break;
2549	case 0x0302: imagename = "rt2561fw"; break;
2550	case 0x0401: imagename = "rt2661fw"; break;
2551	default:
2552		if_printf(ifp, "%s: unexpected pci device id 0x%x, "
2553		    "don't know how to retrieve firmware\n",
2554		    __func__, sc->sc_id);
2555		return EINVAL;
2556	}
2557	RAL_UNLOCK(sc);
2558	fp = firmware_get(imagename);
2559	RAL_LOCK(sc);
2560	if (fp == NULL) {
2561		if_printf(ifp, "%s: unable to retrieve firmware image %s\n",
2562		    __func__, imagename);
2563		return EINVAL;
2564	}
2565
2566	/*
2567	 * Load 8051 microcode into NIC.
2568	 */
2569	/* reset 8051 */
2570	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2571
2572	/* cancel any pending Host to MCU command */
2573	RAL_WRITE(sc, RT2661_H2M_MAILBOX_CSR, 0);
2574	RAL_WRITE(sc, RT2661_M2H_CMD_DONE_CSR, 0xffffffff);
2575	RAL_WRITE(sc, RT2661_HOST_CMD_CSR, 0);
2576
2577	/* write 8051's microcode */
2578	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET | RT2661_MCU_SEL);
2579	RAL_WRITE_REGION_1(sc, RT2661_MCU_CODE_BASE, fp->data, fp->datasize);
2580	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, RT2661_MCU_RESET);
2581
2582	/* kick 8051's ass */
2583	RAL_WRITE(sc, RT2661_MCU_CNTL_CSR, 0);
2584
2585	/* wait for 8051 to initialize */
2586	for (ntries = 0; ntries < 500; ntries++) {
2587		if (RAL_READ(sc, RT2661_MCU_CNTL_CSR) & RT2661_MCU_READY)
2588			break;
2589		DELAY(100);
2590	}
2591	if (ntries == 500) {
2592		if_printf(ifp, "%s: timeout waiting for MCU to initialize\n",
2593		    __func__);
2594		error = EIO;
2595	} else
2596		error = 0;
2597
2598	firmware_put(fp, FIRMWARE_UNLOAD);
2599	return error;
2600}
2601
2602#ifdef notyet
2603/*
2604 * Dynamically tune Rx sensitivity (BBP register 17) based on average RSSI and
2605 * false CCA count.  This function is called periodically (every seconds) when
2606 * in the RUN state.  Values taken from the reference driver.
2607 */
2608static void
2609rt2661_rx_tune(struct rt2661_softc *sc)
2610{
2611	uint8_t bbp17;
2612	uint16_t cca;
2613	int lo, hi, dbm;
2614
2615	/*
2616	 * Tuning range depends on operating band and on the presence of an
2617	 * external low-noise amplifier.
2618	 */
2619	lo = 0x20;
2620	if (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan))
2621		lo += 0x08;
2622	if ((IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan) && sc->ext_2ghz_lna) ||
2623	    (IEEE80211_IS_CHAN_5GHZ(sc->sc_curchan) && sc->ext_5ghz_lna))
2624		lo += 0x10;
2625	hi = lo + 0x20;
2626
2627	/* retrieve false CCA count since last call (clear on read) */
2628	cca = RAL_READ(sc, RT2661_STA_CSR1) & 0xffff;
2629
2630	if (dbm >= -35) {
2631		bbp17 = 0x60;
2632	} else if (dbm >= -58) {
2633		bbp17 = hi;
2634	} else if (dbm >= -66) {
2635		bbp17 = lo + 0x10;
2636	} else if (dbm >= -74) {
2637		bbp17 = lo + 0x08;
2638	} else {
2639		/* RSSI < -74dBm, tune using false CCA count */
2640
2641		bbp17 = sc->bbp17; /* current value */
2642
2643		hi -= 2 * (-74 - dbm);
2644		if (hi < lo)
2645			hi = lo;
2646
2647		if (bbp17 > hi) {
2648			bbp17 = hi;
2649
2650		} else if (cca > 512) {
2651			if (++bbp17 > hi)
2652				bbp17 = hi;
2653		} else if (cca < 100) {
2654			if (--bbp17 < lo)
2655				bbp17 = lo;
2656		}
2657	}
2658
2659	if (bbp17 != sc->bbp17) {
2660		rt2661_bbp_write(sc, 17, bbp17);
2661		sc->bbp17 = bbp17;
2662	}
2663}
2664
2665/*
2666 * Enter/Leave radar detection mode.
2667 * This is for 802.11h additional regulatory domains.
2668 */
2669static void
2670rt2661_radar_start(struct rt2661_softc *sc)
2671{
2672	uint32_t tmp;
2673
2674	/* disable Rx */
2675	tmp = RAL_READ(sc, RT2661_TXRX_CSR0);
2676	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp | RT2661_DISABLE_RX);
2677
2678	rt2661_bbp_write(sc, 82, 0x20);
2679	rt2661_bbp_write(sc, 83, 0x00);
2680	rt2661_bbp_write(sc, 84, 0x40);
2681
2682	/* save current BBP registers values */
2683	sc->bbp18 = rt2661_bbp_read(sc, 18);
2684	sc->bbp21 = rt2661_bbp_read(sc, 21);
2685	sc->bbp22 = rt2661_bbp_read(sc, 22);
2686	sc->bbp16 = rt2661_bbp_read(sc, 16);
2687	sc->bbp17 = rt2661_bbp_read(sc, 17);
2688	sc->bbp64 = rt2661_bbp_read(sc, 64);
2689
2690	rt2661_bbp_write(sc, 18, 0xff);
2691	rt2661_bbp_write(sc, 21, 0x3f);
2692	rt2661_bbp_write(sc, 22, 0x3f);
2693	rt2661_bbp_write(sc, 16, 0xbd);
2694	rt2661_bbp_write(sc, 17, sc->ext_5ghz_lna ? 0x44 : 0x34);
2695	rt2661_bbp_write(sc, 64, 0x21);
2696
2697	/* restore Rx filter */
2698	RAL_WRITE(sc, RT2661_TXRX_CSR0, tmp);
2699}
2700
2701static int
2702rt2661_radar_stop(struct rt2661_softc *sc)
2703{
2704	uint8_t bbp66;
2705
2706	/* read radar detection result */
2707	bbp66 = rt2661_bbp_read(sc, 66);
2708
2709	/* restore BBP registers values */
2710	rt2661_bbp_write(sc, 16, sc->bbp16);
2711	rt2661_bbp_write(sc, 17, sc->bbp17);
2712	rt2661_bbp_write(sc, 18, sc->bbp18);
2713	rt2661_bbp_write(sc, 21, sc->bbp21);
2714	rt2661_bbp_write(sc, 22, sc->bbp22);
2715	rt2661_bbp_write(sc, 64, sc->bbp64);
2716
2717	return bbp66 == 1;
2718}
2719#endif
2720
2721static int
2722rt2661_prepare_beacon(struct rt2661_softc *sc, struct ieee80211vap *vap)
2723{
2724	struct ieee80211com *ic = vap->iv_ic;
2725	struct ieee80211_beacon_offsets bo;
2726	struct rt2661_tx_desc desc;
2727	struct mbuf *m0;
2728	int rate;
2729
2730	m0 = ieee80211_beacon_alloc(vap->iv_bss, &bo);
2731	if (m0 == NULL) {
2732		device_printf(sc->sc_dev, "could not allocate beacon frame\n");
2733		return ENOBUFS;
2734	}
2735
2736	/* send beacons at the lowest available rate */
2737	rate = IEEE80211_IS_CHAN_5GHZ(ic->ic_bsschan) ? 12 : 2;
2738
2739	rt2661_setup_tx_desc(sc, &desc, RT2661_TX_TIMESTAMP, RT2661_TX_HWSEQ,
2740	    m0->m_pkthdr.len, rate, NULL, 0, RT2661_QID_MGT);
2741
2742	/* copy the first 24 bytes of Tx descriptor into NIC memory */
2743	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0, (uint8_t *)&desc, 24);
2744
2745	/* copy beacon header and payload into NIC memory */
2746	RAL_WRITE_REGION_1(sc, RT2661_HW_BEACON_BASE0 + 24,
2747	    mtod(m0, uint8_t *), m0->m_pkthdr.len);
2748
2749	m_freem(m0);
2750
2751	return 0;
2752}
2753
2754/*
2755 * Enable TSF synchronization and tell h/w to start sending beacons for IBSS
2756 * and HostAP operating modes.
2757 */
2758static void
2759rt2661_enable_tsf_sync(struct rt2661_softc *sc)
2760{
2761	struct ifnet *ifp = sc->sc_ifp;
2762	struct ieee80211com *ic = ifp->if_l2com;
2763	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2764	uint32_t tmp;
2765
2766	if (vap->iv_opmode != IEEE80211_M_STA) {
2767		/*
2768		 * Change default 16ms TBTT adjustment to 8ms.
2769		 * Must be done before enabling beacon generation.
2770		 */
2771		RAL_WRITE(sc, RT2661_TXRX_CSR10, 1 << 12 | 8);
2772	}
2773
2774	tmp = RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000;
2775
2776	/* set beacon interval (in 1/16ms unit) */
2777	tmp |= vap->iv_bss->ni_intval * 16;
2778
2779	tmp |= RT2661_TSF_TICKING | RT2661_ENABLE_TBTT;
2780	if (vap->iv_opmode == IEEE80211_M_STA)
2781		tmp |= RT2661_TSF_MODE(1);
2782	else
2783		tmp |= RT2661_TSF_MODE(2) | RT2661_GENERATE_BEACON;
2784
2785	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp);
2786}
2787
2788static void
2789rt2661_enable_tsf(struct rt2661_softc *sc)
2790{
2791	RAL_WRITE(sc, RT2661_TXRX_CSR9,
2792	      (RAL_READ(sc, RT2661_TXRX_CSR9) & 0xff000000)
2793	    | RT2661_TSF_TICKING | RT2661_TSF_MODE(2));
2794}
2795
2796/*
2797 * Retrieve the "Received Signal Strength Indicator" from the raw values
2798 * contained in Rx descriptors.  The computation depends on which band the
2799 * frame was received.  Correction values taken from the reference driver.
2800 */
2801static int
2802rt2661_get_rssi(struct rt2661_softc *sc, uint8_t raw)
2803{
2804	int lna, agc, rssi;
2805
2806	lna = (raw >> 5) & 0x3;
2807	agc = raw & 0x1f;
2808
2809	if (lna == 0) {
2810		/*
2811		 * No mapping available.
2812		 *
2813		 * NB: Since RSSI is relative to noise floor, -1 is
2814		 *     adequate for caller to know error happened.
2815		 */
2816		return -1;
2817	}
2818
2819	rssi = (2 * agc) - RT2661_NOISE_FLOOR;
2820
2821	if (IEEE80211_IS_CHAN_2GHZ(sc->sc_curchan)) {
2822		rssi += sc->rssi_2ghz_corr;
2823
2824		if (lna == 1)
2825			rssi -= 64;
2826		else if (lna == 2)
2827			rssi -= 74;
2828		else if (lna == 3)
2829			rssi -= 90;
2830	} else {
2831		rssi += sc->rssi_5ghz_corr;
2832
2833		if (lna == 1)
2834			rssi -= 64;
2835		else if (lna == 2)
2836			rssi -= 86;
2837		else if (lna == 3)
2838			rssi -= 100;
2839	}
2840	return rssi;
2841}
2842
2843static void
2844rt2661_scan_start(struct ieee80211com *ic)
2845{
2846	struct ifnet *ifp = ic->ic_ifp;
2847	struct rt2661_softc *sc = ifp->if_softc;
2848	uint32_t tmp;
2849
2850	/* abort TSF synchronization */
2851	tmp = RAL_READ(sc, RT2661_TXRX_CSR9);
2852	RAL_WRITE(sc, RT2661_TXRX_CSR9, tmp & ~0xffffff);
2853	rt2661_set_bssid(sc, ifp->if_broadcastaddr);
2854}
2855
2856static void
2857rt2661_scan_end(struct ieee80211com *ic)
2858{
2859	struct ifnet *ifp = ic->ic_ifp;
2860	struct rt2661_softc *sc = ifp->if_softc;
2861	struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
2862
2863	rt2661_enable_tsf_sync(sc);
2864	/* XXX keep local copy */
2865	rt2661_set_bssid(sc, vap->iv_bss->ni_bssid);
2866}
2867
2868static void
2869rt2661_set_channel(struct ieee80211com *ic)
2870{
2871	struct ifnet *ifp = ic->ic_ifp;
2872	struct rt2661_softc *sc = ifp->if_softc;
2873
2874	RAL_LOCK(sc);
2875	rt2661_set_chan(sc, ic->ic_curchan);
2876	RAL_UNLOCK(sc);
2877
2878}
2879